@agent-native/dispatch 0.0.0-beta-20260819155526 → 0.0.0-beta-20260819172516

package/dist/actions/ask_app.d.ts

@@ -9,6 +9,7 @@ declare const _default: import("@agent-native/core").ActionDefinition<{
     taskId: string;
     status: string;
     response?: string;
+    receipts?: import("node_modules/@agent-native/core/dist/a2a/artifact-response.js").A2APersistedMutationReceipt[];
     error?: string;
     inputRequired?: string;
     statusRead?: "unavailable";

package/dist/actions/ask_app_status.d.ts

@@ -7,6 +7,7 @@ declare const _default: import("@agent-native/core").ActionDefinition<{
     taskId: string;
     status: string;
     response?: string;
+    receipts?: import("node_modules/@agent-native/core/dist/a2a/artifact-response.js").A2APersistedMutationReceipt[];
     error?: string;
     inputRequired?: string;
     statusRead?: "unavailable";

package/dist/server/lib/dispatch-integrations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch-integrations.d.ts","sourceRoot":"","sources":["../../../src/server/lib/dispatch-integrations.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EACV,eAAe,EACf,2BAA2B,EAC3B,eAAe,EAChB,MAAM,2BAA2B,CAAC;AA2BnC,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,eAAe,GACxB,MAAM,GAAG,IAAI,CAmBf;AAwOD,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,MAAM,CAAC,CA8DjB;AAED;;;;GAIG;AACH,wBAAsB,+BAA+B,CACnD,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,2BAA2B,CAAC,CAgGtC;AAED,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,eAAe,EACzB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,CAAC,CAwDxE"}
+{"version":3,"file":"dispatch-integrations.d.ts","sourceRoot":"","sources":["../../../src/server/lib/dispatch-integrations.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EACV,eAAe,EACf,2BAA2B,EAC3B,eAAe,EAChB,MAAM,2BAA2B,CAAC;AA2BnC,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,eAAe,GACxB,MAAM,GAAG,IAAI,CAmBf;AA+VD,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,MAAM,CAAC,CA8DjB;AAED;;;;GAIG;AACH,wBAAsB,+BAA+B,CACnD,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,2BAA2B,CAAC,CAwHtC;AAED,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,eAAe,EACzB,OAAO,EAAE,eAAe,GACvB,OAAO,CAAC;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,CAAC,CA0FxE"}

package/dist/server/lib/dispatch-integrations.js

@@ -1,6 +1,6 @@
 import crypto from "node:crypto";
 import { evaluateIntegrationScopePolicy, getActiveIntegrationInstallationByKey, getIntegrationScope, resolveIntegrationTokenBundle, resolveSlackBotTokenForIncoming, saveIntegrationScope, slackInstallationKey, } from "@agent-native/core/integrations";
-import { resolveOrgIdForEmail } from "@agent-native/core/org";
+import { isOrgMember, resolveOrgIdForEmail } from "@agent-native/core/org";
 import { withConfiguredAppBasePath } from "@agent-native/core/server";
 import { handleRemoteCodeCommand } from "./dispatch-remote-commands.js";
 import { dispatchIntegrationRoutingHint, } from "./dispatch-routing.js";
@@ -82,14 +82,30 @@ async function resolveManagedSlackInstallation(incoming) {
     if (incoming.platform !== "slack")
         return null;
     const teamId = contextString(incoming.platformContext.teamId);
+    const enterpriseId = contextString(incoming.platformContext.enterpriseId);
     const apiAppId = contextString(incoming.platformContext.apiAppId);
-    if (!teamId)
+    const isEnterpriseInstall = incoming.platformContext.isEnterpriseInstall === true;
+    if ((!teamId && !enterpriseId) || (isEnterpriseInstall && !enterpriseId))
         return null;
+    return getActiveIntegrationInstallationByKey("slack", slackInstallationKey({
+        teamId,
+        enterpriseId,
+        apiAppId,
+        isEnterpriseInstall,
+    }));
+}
+class ManagedSlackInstallationLookupError extends Error {
+    constructor(options) {
+        super("Managed Slack installation identity is temporarily unavailable", options);
+        this.name = "ManagedSlackInstallationLookupError";
+    }
+}
+async function resolveManagedSlackInstallationOrFail(incoming) {
     try {
-        return await getActiveIntegrationInstallationByKey("slack", slackInstallationKey({ teamId, apiAppId }));
+        return await resolveManagedSlackInstallation(incoming);
     }
-    catch {
-        return null;
+    catch (cause) {
+        throw new ManagedSlackInstallationLookupError({ cause });
     }
 }
 async function resolveManagedSlackToken(incoming) {
@@ -113,6 +129,12 @@ function formatSlackLinkRequiredMessage() {
         : "Open Dispatch while signed in, create a Slack link token, then send `/link <token>` in this DM.";
     return `Agent Native is ready, but this Slack account is not linked to an Agent Native user yet. ${linkStep}`;
 }
+function formatSlackIdentityVerificationFailedMessage() {
+    return "I couldn't verify your Slack identity just now, so I can't run this request. Please try again in a moment.";
+}
+function formatSlackIdentityDeniedMessage() {
+    return "This assistant is only available to members of this workspace's organization.";
+}
 async function resolveSlackSenderProfile(incoming) {
     if (incoming.platform !== "slack") {
         return { email: null, name: null, trust: "unknown" };
@@ -147,7 +169,8 @@ async function resolveSlackSenderProfile(incoming) {
                     data.user?.real_name?.trim() ||
                     data.user?.name?.trim() ||
                     null,
-                trust: data.user?.is_ultra_restricted === true
+                trust: data.user?.is_stranger === true ||
+                    data.user?.is_ultra_restricted === true
                     ? "external_shared"
                     : data.user?.is_restricted === true
                         ? "guest"
@@ -179,6 +202,74 @@ async function resolveSlackOwnerFromVerifiedEmail(incoming) {
     const orgId = await resolveOrgIdForEmail(profile.email);
     return orgId ? profile.email : null;
 }
+async function resolveManagedSlackDmExecutionContext(incoming, installation) {
+    const profile = await resolveSlackSenderProfile(incoming);
+    incoming.actorTrust = {
+        memberType: profile.trust === "guest"
+            ? "guest"
+            : profile.trust === "external_shared"
+                ? "external"
+                : profile.trust === "trusted"
+                    ? "member"
+                    : "unknown",
+        verified: profile.trust !== "unknown",
+    };
+    incoming.senderVerified = profile.email !== null;
+    if (profile.email) {
+        incoming.senderEmail = profile.email;
+        incoming.platformContext.senderEmail = profile.email;
+    }
+    if (profile.name) {
+        incoming.senderName = profile.name;
+        incoming.platformContext.senderName = profile.name;
+    }
+    const deniedContext = () => ({
+        ownerEmail: fallbackOwnerForIncoming(incoming),
+        orgId: null,
+        principalType: "user",
+        installationId: installation.id,
+    });
+    if (profile.trust === "unknown") {
+        incoming.platformContext.identityVerificationFailed = true;
+        return deniedContext();
+    }
+    if (profile.trust === "guest" || profile.trust === "external_shared") {
+        incoming.platformContext.identityAccessDenied = true;
+        return deniedContext();
+    }
+    if (!installation.orgId) {
+        incoming.platformContext.identityLinkRequired = true;
+        return deniedContext();
+    }
+    incoming.platformContext.managedInstallationOrgId = installation.orgId;
+    let linkedOwner;
+    try {
+        linkedOwner = await resolveLinkedOwner("slack", identityKeyForIncoming(incoming), { orgId: installation.orgId });
+    }
+    catch {
+        incoming.platformContext.identityVerificationFailed = true;
+        return deniedContext();
+    }
+    const candidates = [profile.email, linkedOwner].filter((email, index, values) => !!email && values.indexOf(email) === index);
+    for (const ownerEmail of candidates) {
+        try {
+            if (await isOrgMember(installation.orgId, ownerEmail)) {
+                return {
+                    ownerEmail,
+                    orgId: installation.orgId,
+                    principalType: "user",
+                    installationId: installation.id,
+                };
+            }
+        }
+        catch {
+            incoming.platformContext.identityVerificationFailed = true;
+            return deniedContext();
+        }
+    }
+    incoming.platformContext.identityLinkRequired = true;
+    return deniedContext();
+}
 async function resolveSlackConversationTrust(incoming, actorTrust) {
     if (incoming.triggerKind === "dm") {
         return { trust: actorTrust, conversationType: "direct_message" };
@@ -276,6 +367,31 @@ export async function resolveDispatchOwner(incoming) {
  * personal credentials or memory.
  */
 export async function resolveDispatchExecutionContext(incoming) {
+    if (incoming.platform === "slack" && incoming.triggerKind === "dm") {
+        let installation;
+        try {
+            installation = await resolveManagedSlackInstallationOrFail(incoming);
+        }
+        catch (error) {
+            if (!(error instanceof ManagedSlackInstallationLookupError))
+                throw error;
+            incoming.platformContext.identityVerificationFailed = true;
+            return {
+                ownerEmail: fallbackOwnerForIncoming(incoming),
+                orgId: null,
+                principalType: "user",
+            };
+        }
+        if (installation) {
+            return resolveManagedSlackDmExecutionContext(incoming, installation);
+        }
+        incoming.platformContext.identityVerificationFailed = true;
+        return {
+            ownerEmail: fallbackOwnerForIncoming(incoming),
+            orgId: null,
+            principalType: "user",
+        };
+    }
     if (incoming.platform !== "slack" || incoming.triggerKind === "dm") {
         const ownerEmail = await resolveDispatchOwner(incoming);
         if (incoming.platform === "slack" &&
@@ -291,7 +407,7 @@ export async function resolveDispatchExecutionContext(incoming) {
             principalType: "user",
         };
     }
-    const installation = await resolveManagedSlackInstallation(incoming);
+    const installation = await resolveManagedSlackInstallationOrFail(incoming);
     if (!installation) {
         // Preserve the legacy manually configured app path while managed installs
         // roll out. Its behavior remains explicit and visible in Settings.
@@ -365,6 +481,30 @@ export async function beforeDispatchProcess(incoming, adapter) {
     const trimmed = incoming.text.trim();
     const commandText = contextString(incoming.platformContext.rawText) || trimmed;
     const match = commandText.match(/^\/link(?:@\w+)?\s+([a-zA-Z0-9_-]+)$/);
+    if (match &&
+        incoming.platform === "slack" &&
+        incoming.triggerKind === "dm" &&
+        !contextString(incoming.platformContext.managedInstallationOrgId) &&
+        incoming.platformContext.identityVerificationFailed !== true &&
+        incoming.platformContext.identityAccessDenied !== true) {
+        await resolveDispatchExecutionContext(incoming);
+    }
+    if (incoming.platform === "slack" &&
+        incoming.triggerKind === "dm" &&
+        incoming.platformContext.identityVerificationFailed === true) {
+        return {
+            handled: true,
+            responseText: formatSlackIdentityVerificationFailedMessage(),
+        };
+    }
+    if (incoming.platform === "slack" &&
+        incoming.triggerKind === "dm" &&
+        incoming.platformContext.identityAccessDenied === true) {
+        return {
+            handled: true,
+            responseText: formatSlackIdentityDeniedMessage(),
+        };
+    }
     if (!match) {
         const routedIncoming = incoming;
         routedIncoming.routingHint ??= dispatchIntegrationRoutingHint(trimmed);
@@ -390,11 +530,13 @@ export async function beforeDispatchProcess(incoming, adapter) {
         });
     }
     try {
+        const expectedOrgId = contextString(incoming.platformContext.managedInstallationOrgId);
         const owner = await consumeLinkToken({
             platform: incoming.platform,
             token: match[1],
             externalUserId: identityKeyForIncoming(incoming),
             externalUserName: incoming.senderName || null,
+            ...(expectedOrgId ? { expectedOrgId } : {}),
         });
         return {
             handled: true,

package/dist/server/lib/dispatch-integrations.js.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch-integrations.js","sourceRoot":"","sources":["../../../src/server/lib/dispatch-integrations.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EACL,8BAA8B,EAC9B,qCAAqC,EACrC,mBAAmB,EACnB,6BAA6B,EAC7B,+BAA+B,EAC/B,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAOtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EACL,8BAA8B,GAE/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAQ3E,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAG9B,CAAC;AACJ,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/C,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACnE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,QAAyB;IAEzB,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC9D,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;IACrD,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACrC,MAAM,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QAC5E,OAAO,aAAa,CAAC,CAAC,CAAC,GAAG,aAAa,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;IACnE,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClC,OAAO,QAAQ,CAAC,WAAW,EAAE,CAAC;IAChC,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB,CAAC,QAAyB;IACzD,MAAM,MAAM,GACV,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC;QAC9C,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,aAAa,CAAC;QACrD,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC;QAC9C,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC;QAC5C,QAAQ,CAAC,gBAAgB,CAAC;IAC5B,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,QAAQ,IAAI,MAAM,IAAI,QAAQ,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;IACxE,MAAM,IAAI,GAAG,MAAM;SAChB,UAAU,CAAC,QAAQ,CAAC;SACpB,MAAM,CAAC,GAAG,CAAC;SACX,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,YAAY,IAAI,oBAAoB,CAAC;AAC9C,CAAC;AAED,SAAS,iCAAiC,CACxC,QAAyB;IAEzB,2EAA2E;IAC3E,sEAAsE;IACtE,8EAA8E;IAC9E,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,CAAC;IAC/D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC;AAED,SAAS,4BAA4B,CAAC,QAAyB;IAC7D,0EAA0E;IAC1E,kEAAkE;IAClE,OAAO,QAAQ,CAAC,QAAQ,KAAK,UAAU,CAAC;AAC1C,CAAC;AAED,SAAS,+BAA+B;IACtC,MAAM,GAAG,GACP,OAAO,CAAC,GAAG,CAAC,qBAAqB;QACjC,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,GAAG;QACf,OAAO,CAAC,GAAG,CAAC,UAAU;QACtB,OAAO,CAAC,GAAG,CAAC,eAAe;QAC3B,EAAE,CAAC;IACL,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,EAAE,CAAC;IAChE,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CACZ,YAAY,EACZ,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAC1D,CAAC,QAAQ,EAAE,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,QAAyB;IACtE,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,MAAM,qCAAqC,CAChD,OAAO,EACP,oBAAoB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAC3C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,QAAyB;IAEzB,MAAM,YAAY,GAAG,MAAM,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IACrE,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAChD,OAAO,EACP,YAAY,CAAC,eAAe,CAC7B,CAAC;IACF,OAAO,MAAM,EAAE,WAAW,IAAI,IAAI,CAAC;AACrC,CAAC;AAED,SAAS,iCAAiC;IACxC,MAAM,aAAa,GAAG,+BAA+B,EAAE,CAAC;IACxD,MAAM,QAAQ,GAAG,aAAa;QAC5B,CAAC,CAAC,OAAO,aAAa,mEAAmE;QACzF,CAAC,CAAC,8FAA8F,CAAC;IACnG,OAAO,+FAA+F,QAAQ,+DAA+D,CAAC;AAChL,CAAC;AAED,SAAS,8BAA8B;IACrC,MAAM,aAAa,GAAG,+BAA+B,EAAE,CAAC;IACxD,MAAM,QAAQ,GAAG,aAAa;QAC5B,CAAC,CAAC,QAAQ,aAAa,sEAAsE;QAC7F,CAAC,CAAC,iGAAiG,CAAC;IACtG,OAAO,4FAA4F,QAAQ,EAAE,CAAC;AAChH,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,QAAyB;IAEzB,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACvD,CAAC;IAED,wEAAwE;IACxE,sEAAsE;IACtE,wEAAwE;IACxE,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,MAAM,CAAC,OAAO,CAAC;IACrE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,oCAAoC,MAAM,EAAE,EAAE;YACpE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAa7B,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE;YACrB,CAAC,CAAC;gBACE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,IAAI;gBAC9D,IAAI,EACF,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE;oBACrC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE;oBACxC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;oBAC5B,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE;oBACvB,IAAI;gBACN,KAAK,EACH,IAAI,CAAC,IAAI,EAAE,mBAAmB,KAAK,IAAI;oBACrC,CAAC,CAAE,iBAA2B;oBAC9B,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,KAAK,IAAI;wBACjC,CAAC,CAAE,OAAiB;wBACpB,CAAC,CAAE,SAAmB;aAC7B;YACH,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAkB,EAAE,CAAC;QAC3D,IAAI,QAAQ,EAAE,CAAC;YACb,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE;gBAC9B,OAAO;gBACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,uBAAuB;aAChD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kCAAkC,CAC/C,QAAyB;IAEzB,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAEhC,QAAQ,CAAC,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC;IACrC,QAAQ,CAAC,eAAe,CAAC,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC;IACrD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,QAAQ,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;QACnC,QAAQ,CAAC,eAAe,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IACrD,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,QAAyB,EACzB,UAAuC;IAKvC,IAAI,QAAQ,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAClC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;IACnE,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IAClE,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,4CAA4C,MAAM,EAAE,EACpD,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,CAClD,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAOlC,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAC;QAC3D,CAAC;QACD,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU;YACnE,gBAAgB,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK;gBACnC,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO;oBACrB,CAAC,CAAC,sBAAsB;oBACxB,CAAC,CAAC,SAAS;SAChB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,QAAyB;IAEzB,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAExD,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,EAAE,cAAc,EAAE;YACxE,mBAAmB,EAAE,IAAI;SAC1B,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QAExB,0EAA0E;QAC1E,2EAA2E;QAC3E,wEAAwE;QACxE,8DAA8D;QAC9D,wEAAwE;QACxE,6DAA6D;QAC7D,kEAAkE;QAClE,8CAA8C;QAC9C,2EAA2E;QAC3E,sEAAsE;QACtE,qEAAqE;QACrE,EAAE;QACF,wEAAwE;QACxE,wEAAwE;QACxE,oEAAoE;QACpE,uEAAuE;QACvE,gDAAgD;QAChD,IACE,QAAQ,CAAC,QAAQ,KAAK,OAAO;YAC7B,QAAQ,CAAC,QAAQ;YACjB,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAC/B,CAAC;YACD,IAAI,OAAO,CAAC,GAAG,CAAC,sCAAsC,KAAK,GAAG,EAAE,CAAC;gBAC/D,OAAO,QAAQ,CAAC,QAAQ,CAAC;YAC3B,CAAC;YACD,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;gBAC5B,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC5D,IAAI,KAAK;oBAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC;YACtC,CAAC;YACD,wEAAwE;YACxE,sCAAsC;QACxC,CAAC;QAED,0EAA0E;QAC1E,uEAAuE;QACvE,0EAA0E;QAC1E,iCAAiC;QACjC,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAClC,MAAM,UAAU,GAAG,MAAM,kCAAkC,CAAC,QAAQ,CAAC,CAAC;YACtE,IAAI,UAAU;gBAAE,OAAO,UAAU,CAAC;QACpC,CAAC;QAED,MAAM,YAAY,GAAG,iCAAiC,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,YAAY;YAAE,OAAO,YAAY,CAAC;QAEtC,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,YAAY,GAAG,iCAAiC,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,YAAY;YAAE,OAAO,YAAY,CAAC;QACtC,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,QAAyB;IAEzB,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QACnE,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACxD,IACE,QAAQ,CAAC,QAAQ,KAAK,OAAO;YAC7B,UAAU,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EACzC,CAAC;YACD,wEAAwE;YACxE,qEAAqE;YACrE,oCAAoC;YACpC,QAAQ,CAAC,eAAe,CAAC,oBAAoB,GAAG,IAAI,CAAC;QACvD,CAAC;QACD,OAAO;YACL,UAAU;YACV,KAAK,EAAE,CAAC,MAAM,oBAAoB,CAAC,UAAU,CAAC,CAAC,IAAI,IAAI;YACvD,aAAa,EAAE,MAAM;SACtB,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IACrE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,0EAA0E;QAC1E,mEAAmE;QACnE,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACxD,OAAO;YACL,UAAU;YACV,KAAK,EAAE,CAAC,MAAM,oBAAoB,CAAC,UAAU,CAAC,CAAC,IAAI,IAAI;YACvD,aAAa,EAAE,MAAM;SACtB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,MAAM,6BAA6B,CACtD,QAAQ,EACR,OAAO,CAAC,KAAK,CACd,CAAC;IACF,MAAM,MAAM,GAAG;QACb,UAAU,EAAE,YAAY,CAAC,UAAU;QACnC,KAAK,EAAE,YAAY,CAAC,KAAK;KAC1B,CAAC;IACF,MAAM,GAAG,GAAG;QACV,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,SAAS;KAC1B,CAAC;IACF,IAAI,KAAK,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACjD,KAAK,GAAG,MAAM,oBAAoB,CAChC;YACE,GAAG,GAAG;YACN,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;YAC/C,KAAK,EAAE,YAAY,CAAC,KAAK;YACzB,KAAK,EAAE,YAAY,CAAC,KAAK;YACzB,cAAc,EAAE,YAAY,CAAC,EAAE;SAChC,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,8BAA8B,CAAC,KAAK,EAAE;QACrD,yEAAyE;QACzE,qEAAqE;QACrE,SAAS,EACP,QAAQ,CAAC,WAAW,KAAK,SAAS;YAClC,QAAQ,CAAC,WAAW,KAAK,cAAc;KAC1C,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,QAAQ,CAAC,kBAAkB,GAAG,KAAK,CAAC,EAAE,CAAC;IACvC,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,QAAQ,CAAC,eAAe,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IAC7D,CAAC;IACD,QAAQ,CAAC,UAAU,GAAG;QACpB,UAAU,EACR,YAAY,CAAC,KAAK,KAAK,OAAO;YAC5B,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,YAAY,CAAC,KAAK,KAAK,iBAAiB;gBACxC,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,YAAY,CAAC,KAAK,KAAK,SAAS;oBAChC,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,SAAS;QACnB,QAAQ,EAAE,YAAY,CAAC,KAAK,KAAK,SAAS;KAC3C,CAAC;IACF,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,iBAAiB;QACnC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,aAAa,EAAE,SAAS;QACxB,cAAc,EAAE,YAAY,CAAC,EAAE;QAC/B,OAAO,EAAE,KAAK,CAAC,EAAE;KAClB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAyB,EACzB,OAAwB;IAExB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,WAAW,GACf,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC;IAC7D,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACxE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,cAAc,GAAG,QAEtB,CAAC;QACF,cAAc,CAAC,WAAW,KAAK,8BAA8B,CAAC,OAAO,CAAC,CAAC;QACvE,IACE,QAAQ,CAAC,QAAQ,KAAK,OAAO;YAC7B,QAAQ,CAAC,WAAW,KAAK,IAAI;YAC7B,QAAQ,CAAC,eAAe,CAAC,oBAAoB,KAAK,IAAI,EACtD,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,YAAY,EAAE,8BAA8B,EAAE;aAC/C,CAAC;QACJ,CAAC;QACD,IAAI,4BAA4B,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,QAAQ,CAAC,QAAQ,EACjB,sBAAsB,CAAC,QAAQ,CAAC,EAChC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAC9B,CAAC;YACF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,YAAY,EAAE,iCAAiC,EAAE;iBAClD,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,uBAAuB,CAAC,QAAQ,EAAE,OAAO,EAAE;YAChD,YAAY,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC;SACnD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC;YACnC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;YACf,cAAc,EAAE,sBAAsB,CAAC,QAAQ,CAAC;YAChD,gBAAgB,EAAE,QAAQ,CAAC,UAAU,IAAI,IAAI;SAC9C,CAAC,CAAC;QACH,OAAO;YACL,OAAO,EAAE,IAAI;YACb,YAAY,EAAE,+BAA+B,QAAQ,CAAC,QAAQ,sBAAsB,KAAK,+BAA+B;SACzH,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,IAAI;YACb,YAAY,EACV,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B;SAC1E,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import crypto from \"node:crypto\";\n\nimport {\n  evaluateIntegrationScopePolicy,\n  getActiveIntegrationInstallationByKey,\n  getIntegrationScope,\n  resolveIntegrationTokenBundle,\n  resolveSlackBotTokenForIncoming,\n  saveIntegrationScope,\n  slackInstallationKey,\n} from \"@agent-native/core/integrations\";\nimport { resolveOrgIdForEmail } from \"@agent-native/core/org\";\nimport { withConfiguredAppBasePath } from \"@agent-native/core/server\";\nimport type {\n  IncomingMessage,\n  IntegrationExecutionContext,\n  PlatformAdapter,\n} from \"@agent-native/core/server\";\n\nimport { handleRemoteCodeCommand } from \"./dispatch-remote-commands.js\";\nimport {\n  dispatchIntegrationRoutingHint,\n  type DispatchIntegrationRoutingHint,\n} from \"./dispatch-routing.js\";\nimport { consumeLinkToken, resolveLinkedOwner } from \"./dispatch-store.js\";\n\ntype SlackSenderProfile = {\n  email: string | null;\n  name: string | null;\n  trust: \"trusted\" | \"guest\" | \"external_shared\" | \"unknown\";\n};\n\nconst slackProfileCache = new Map<\n  string,\n  { profile: SlackSenderProfile; expiresAt: number }\n>();\nconst SLACK_PROFILE_CACHE_TTL = 10 * 60 * 1000;\n\nfunction contextString(value: unknown): string | null {\n  if (typeof value === \"string\" && value.trim()) return value.trim();\n  if (typeof value === \"number\" && Number.isFinite(value)) return String(value);\n  return null;\n}\n\nexport function identityKeyForIncoming(\n  incoming: IncomingMessage,\n): string | null {\n  const senderId = contextString(incoming.senderId);\n  if (!senderId) return null;\n\n  if (incoming.platform === \"slack\") {\n    const teamId = contextString(incoming.platformContext.teamId);\n    return teamId ? `${teamId}:${senderId}` : senderId;\n  }\n\n  if (incoming.platform === \"whatsapp\") {\n    const phoneNumberId = contextString(incoming.platformContext.phoneNumberId);\n    return phoneNumberId ? `${phoneNumberId}:${senderId}` : senderId;\n  }\n\n  if (incoming.platform === \"email\") {\n    return senderId.toLowerCase();\n  }\n\n  return senderId;\n}\n\nfunction fallbackOwnerForIncoming(incoming: IncomingMessage): string {\n  const tenant =\n    contextString(incoming.platformContext.teamId) ||\n    contextString(incoming.platformContext.phoneNumberId) ||\n    contextString(incoming.platformContext.chatId) ||\n    contextString(incoming.platformContext.from) ||\n    incoming.externalThreadId;\n  const raw = `${incoming.platform}:${tenant}:${incoming.senderId || \"\"}`;\n  const hash = crypto\n    .createHash(\"sha256\")\n    .update(raw)\n    .digest(\"hex\")\n    .slice(0, 16);\n  return `dispatch+${hash}@integration.local`;\n}\n\nfunction configuredDefaultOwnerForIncoming(\n  incoming: IncomingMessage,\n): string | null {\n  // This is intentionally Slack-only: a deployment-wide default owner grants\n  // that Slack workspace access to the owner's connected agents and org\n  // credentials, so other platforms should opt in with explicit identity links.\n  if (incoming.platform !== \"slack\") return null;\n  const email = process.env.DISPATCH_DEFAULT_OWNER_EMAIL?.trim();\n  if (!email) return null;\n  return /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(email) ? email : null;\n}\n\nfunction platformRequiresExplicitLink(incoming: IncomingMessage): boolean {\n  // Telegram does not provide a verified email address. Require an explicit\n  // identity link before it can act as a Builder/Agent-Native user.\n  return incoming.platform === \"telegram\";\n}\n\nfunction configuredDispatchIdentitiesUrl(): string | null {\n  const raw =\n    process.env.WORKSPACE_GATEWAY_URL ||\n    process.env.APP_URL ||\n    process.env.URL ||\n    process.env.DEPLOY_URL ||\n    process.env.BETTER_AUTH_URL ||\n    \"\";\n  if (!raw.trim()) return null;\n  const base = /^https?:\\/\\//i.test(raw) ? raw : `https://${raw}`;\n  try {\n    return new URL(\n      \"identities\",\n      `${withConfiguredAppBasePath(base).replace(/\\/+$/, \"\")}/`,\n    ).toString();\n  } catch {\n    return null;\n  }\n}\n\nasync function resolveManagedSlackInstallation(incoming: IncomingMessage) {\n  if (incoming.platform !== \"slack\") return null;\n  const teamId = contextString(incoming.platformContext.teamId);\n  const apiAppId = contextString(incoming.platformContext.apiAppId);\n  if (!teamId) return null;\n  try {\n    return await getActiveIntegrationInstallationByKey(\n      \"slack\",\n      slackInstallationKey({ teamId, apiAppId }),\n    );\n  } catch {\n    return null;\n  }\n}\n\nasync function resolveManagedSlackToken(\n  incoming: IncomingMessage,\n): Promise<string | null> {\n  const installation = await resolveManagedSlackInstallation(incoming);\n  if (!installation) return null;\n  const bundle = await resolveIntegrationTokenBundle(\n    \"slack\",\n    installation.installationKey,\n  );\n  return bundle?.accessToken ?? null;\n}\n\nfunction formatTelegramLinkRequiredMessage(): string {\n  const identitiesUrl = configuredDispatchIdentitiesUrl();\n  const linkStep = identitiesUrl\n    ? `Tap ${identitiesUrl}, create a Telegram link token, then send \\`/link <token>\\` here.`\n    : \"Open Dispatch while signed in, create a Telegram link token, then send `/link <token>` here.\";\n  return `Telegram is connected, but this Telegram account is not linked to an Agent-Native user yet. ${linkStep} After that I can use your Builder.io org and connected apps.`;\n}\n\nfunction formatSlackLinkRequiredMessage(): string {\n  const identitiesUrl = configuredDispatchIdentitiesUrl();\n  const linkStep = identitiesUrl\n    ? `Open ${identitiesUrl}, create a Slack link token, then send \\`/link <token>\\` in this DM.`\n    : \"Open Dispatch while signed in, create a Slack link token, then send `/link <token>` in this DM.\";\n  return `Agent Native is ready, but this Slack account is not linked to an Agent Native user yet. ${linkStep}`;\n}\n\nasync function resolveSlackSenderProfile(\n  incoming: IncomingMessage,\n): Promise<SlackSenderProfile> {\n  if (incoming.platform !== \"slack\") {\n    return { email: null, name: null, trust: \"unknown\" };\n  }\n  const token = await resolveSlackBotTokenForIncoming(incoming);\n  const userId = contextString(incoming.senderId);\n  const teamId = contextString(incoming.platformContext.teamId);\n  if (!token || !userId) {\n    return { email: null, name: null, trust: \"unknown\" };\n  }\n\n  // Slack user IDs are scoped per workspace, so without a teamId we can't\n  // safely cache: two installs of the bot in different workspaces could\n  // share user-id strings and collide on a single \"default\" key. Skip the\n  // cache (and lookup on every request) when teamId is missing.\n  const cacheKey = teamId ? `${teamId}:${userId}` : null;\n  if (cacheKey) {\n    const cached = slackProfileCache.get(cacheKey);\n    if (cached && cached.expiresAt > Date.now()) return cached.profile;\n  }\n\n  try {\n    const params = new URLSearchParams({ user: userId });\n    const res = await fetch(`https://slack.com/api/users.info?${params}`, {\n      headers: { Authorization: `Bearer ${token}` },\n    });\n    const data = (await res.json()) as {\n      ok?: boolean;\n      user?: {\n        real_name?: string;\n        name?: string;\n        profile?: {\n          email?: string;\n          real_name?: string;\n          display_name?: string;\n        };\n        is_restricted?: boolean;\n        is_ultra_restricted?: boolean;\n      };\n    };\n    const profile = data.ok\n      ? {\n          email: data.user?.profile?.email?.trim().toLowerCase() || null,\n          name:\n            data.user?.profile?.real_name?.trim() ||\n            data.user?.profile?.display_name?.trim() ||\n            data.user?.real_name?.trim() ||\n            data.user?.name?.trim() ||\n            null,\n          trust:\n            data.user?.is_ultra_restricted === true\n              ? (\"external_shared\" as const)\n              : data.user?.is_restricted === true\n                ? (\"guest\" as const)\n                : (\"trusted\" as const),\n        }\n      : { email: null, name: null, trust: \"unknown\" as const };\n    if (cacheKey) {\n      slackProfileCache.set(cacheKey, {\n        profile,\n        expiresAt: Date.now() + SLACK_PROFILE_CACHE_TTL,\n      });\n    }\n    return profile;\n  } catch {\n    return { email: null, name: null, trust: \"unknown\" };\n  }\n}\n\nasync function resolveSlackOwnerFromVerifiedEmail(\n  incoming: IncomingMessage,\n): Promise<string | null> {\n  const profile = await resolveSlackSenderProfile(incoming);\n  if (!profile.email) return null;\n\n  incoming.senderEmail = profile.email;\n  incoming.platformContext.senderEmail = profile.email;\n  if (profile.name) {\n    incoming.senderName = profile.name;\n    incoming.platformContext.senderName = profile.name;\n  }\n\n  const orgId = await resolveOrgIdForEmail(profile.email);\n  return orgId ? profile.email : null;\n}\n\nasync function resolveSlackConversationTrust(\n  incoming: IncomingMessage,\n  actorTrust: SlackSenderProfile[\"trust\"],\n): Promise<{\n  trust: SlackSenderProfile[\"trust\"];\n  conversationType: \"channel\" | \"direct_message\" | \"group_direct_message\";\n}> {\n  if (incoming.triggerKind === \"dm\") {\n    return { trust: actorTrust, conversationType: \"direct_message\" };\n  }\n  const token = await resolveManagedSlackToken(incoming);\n  const channel = contextString(incoming.platformContext.channelId);\n  if (!token || !channel) {\n    return { trust: \"unknown\", conversationType: \"channel\" };\n  }\n  try {\n    const params = new URLSearchParams({ channel });\n    const response = await fetch(\n      `https://slack.com/api/conversations.info?${params}`,\n      { headers: { Authorization: `Bearer ${token}` } },\n    );\n    const data = (await response.json()) as {\n      ok?: boolean;\n      channel?: {\n        is_ext_shared?: boolean;\n        is_im?: boolean;\n        is_mpim?: boolean;\n      };\n    };\n    if (!data.ok) {\n      return { trust: \"unknown\", conversationType: \"channel\" };\n    }\n    return {\n      trust: data.channel?.is_ext_shared ? \"external_shared\" : actorTrust,\n      conversationType: data.channel?.is_im\n        ? \"direct_message\"\n        : data.channel?.is_mpim\n          ? \"group_direct_message\"\n          : \"channel\",\n    };\n  } catch {\n    return { trust: \"unknown\", conversationType: \"channel\" };\n  }\n}\n\nexport async function resolveDispatchOwner(\n  incoming: IncomingMessage,\n): Promise<string> {\n  try {\n    const externalUserId = identityKeyForIncoming(incoming);\n\n    // Webhooks do not have the browser request's org context, so allow a safe\n    // cross-org fallback when the linked platform identity maps to one owner.\n    const owner = await resolveLinkedOwner(incoming.platform, externalUserId, {\n      allowAnyOrgFallback: true,\n    });\n    if (owner) return owner;\n\n    // For email, the sender's `From:` address is attacker-settable: SMTP lets\n    // anyone claim any From, and our inbound webhook secret only authenticates\n    // the provider→app hop, not the original sender. So we must NOT grant a\n    // real user's identity (their API keys, org secrets, personal\n    // instructions, ownable data) off the bare From. Mirror the Slack gate:\n    // only return the sender email as the acting owner when BOTH\n    //   (a) the message is DKIM/SPF-verified for the From domain, AND\n    //   (b) that email maps to a real org member.\n    // Otherwise fall through to the synthetic, credential-less fallback owner.\n    // (A linked identity, handled by resolveLinkedOwner above, remains an\n    // always-allowed way to bind an address regardless of verification.)\n    //\n    // Escape hatch: set DISPATCH_TRUST_UNVERIFIED_EMAIL_SENDER=1 to restore\n    // the legacy \"trust the From header\" behavior. OFF by default; only use\n    // this if you fully control the inbound mail path and accept that a\n    // spoofed From can act as any org member. See FINDING 3 (inbound-email\n    // impersonation) in the webhook security audit.\n    if (\n      incoming.platform === \"email\" &&\n      incoming.senderId &&\n      incoming.senderId.includes(\"@\")\n    ) {\n      if (process.env.DISPATCH_TRUST_UNVERIFIED_EMAIL_SENDER === \"1\") {\n        return incoming.senderId;\n      }\n      if (incoming.senderVerified) {\n        const orgId = await resolveOrgIdForEmail(incoming.senderId);\n        if (orgId) return incoming.senderId;\n      }\n      // Unverified or not an org member — do not impersonate. Fall through to\n      // the synthetic fallback owner below.\n    }\n\n    // Slack gives us a user id in the event payload. Resolve it to a verified\n    // workspace email and use that user's own org context when they are an\n    // Agent-Native member, so artifacts created via @agent-native are visible\n    // when they open the target app.\n    if (incoming.platform === \"slack\") {\n      const slackOwner = await resolveSlackOwnerFromVerifiedEmail(incoming);\n      if (slackOwner) return slackOwner;\n    }\n\n    const defaultOwner = configuredDefaultOwnerForIncoming(incoming);\n    if (defaultOwner) return defaultOwner;\n\n    return fallbackOwnerForIncoming(incoming);\n  } catch {\n    const defaultOwner = configuredDefaultOwnerForIncoming(incoming);\n    if (defaultOwner) return defaultOwner;\n    return fallbackOwnerForIncoming(incoming);\n  }\n}\n\n/**\n * Resolve a personal DM user or a workspace-qualified channel service\n * principal. Managed Slack channels never silently inherit one requester's\n * personal credentials or memory.\n */\nexport async function resolveDispatchExecutionContext(\n  incoming: IncomingMessage,\n): Promise<IntegrationExecutionContext> {\n  if (incoming.platform !== \"slack\" || incoming.triggerKind === \"dm\") {\n    const ownerEmail = await resolveDispatchOwner(incoming);\n    if (\n      incoming.platform === \"slack\" &&\n      ownerEmail.endsWith(\"@integration.local\")\n    ) {\n      // Preserve a credential-less principal long enough for beforeProcess to\n      // deliver linking guidance or consume `/link <token>`. Never run the\n      // agent under this synthetic owner.\n      incoming.platformContext.identityLinkRequired = true;\n    }\n    return {\n      ownerEmail,\n      orgId: (await resolveOrgIdForEmail(ownerEmail)) ?? null,\n      principalType: \"user\",\n    };\n  }\n\n  const installation = await resolveManagedSlackInstallation(incoming);\n  if (!installation) {\n    // Preserve the legacy manually configured app path while managed installs\n    // roll out. Its behavior remains explicit and visible in Settings.\n    const ownerEmail = await resolveDispatchOwner(incoming);\n    return {\n      ownerEmail,\n      orgId: (await resolveOrgIdForEmail(ownerEmail)) ?? null,\n      principalType: \"user\",\n    };\n  }\n\n  const teamId = contextString(incoming.platformContext.teamId);\n  const channelId = contextString(incoming.platformContext.channelId);\n  if (!teamId || !channelId) {\n    throw new Error(\"Slack channel identity is incomplete\");\n  }\n  const profile = await resolveSlackSenderProfile(incoming);\n  const conversation = await resolveSlackConversationTrust(\n    incoming,\n    profile.trust,\n  );\n  const access = {\n    ownerEmail: installation.ownerEmail,\n    orgId: installation.orgId,\n  };\n  const key = {\n    platform: \"slack\",\n    tenantId: teamId,\n    conversationId: channelId,\n  };\n  let scope = await getIntegrationScope(key, access);\n  if (!scope && incoming.triggerKind === \"mention\") {\n    scope = await saveIntegrationScope(\n      {\n        ...key,\n        conversationType: conversation.conversationType,\n        trust: conversation.trust,\n        orgId: installation.orgId,\n        installationId: installation.id,\n      },\n      access,\n    );\n  }\n  if (!scope) throw new Error(\"Slack channel is not enabled for Agent Native\");\n  const decision = evaluateIntegrationScopePolicy(scope, {\n    // Slack channel turns only arrive here after an explicit current-message\n    // mention; keep the generic thread_reply trigger for other adapters.\n    mentioned:\n      incoming.triggerKind === \"mention\" ||\n      incoming.triggerKind === \"thread_reply\",\n  });\n  if (!decision.allowed) {\n    throw new Error(`Slack channel policy denied: ${decision.reason}`);\n  }\n  incoming.integrationScopeId = scope.id;\n  if (scope.defaultModel) {\n    incoming.platformContext.defaultModel = scope.defaultModel;\n  }\n  incoming.actorTrust = {\n    memberType:\n      conversation.trust === \"guest\"\n        ? \"guest\"\n        : conversation.trust === \"external_shared\"\n          ? \"external\"\n          : conversation.trust === \"trusted\"\n            ? \"member\"\n            : \"unknown\",\n    verified: conversation.trust !== \"unknown\",\n  };\n  return {\n    ownerEmail: scope.serviceOwnerEmail,\n    orgId: scope.orgId,\n    principalType: \"service\",\n    installationId: installation.id,\n    scopeId: scope.id,\n  };\n}\n\nexport async function beforeDispatchProcess(\n  incoming: IncomingMessage,\n  adapter: PlatformAdapter,\n): Promise<{ handled: true; responseText?: string } | { handled: false }> {\n  const trimmed = incoming.text.trim();\n  const commandText =\n    contextString(incoming.platformContext.rawText) || trimmed;\n  const match = commandText.match(/^\\/link(?:@\\w+)?\\s+([a-zA-Z0-9_-]+)$/);\n  if (!match) {\n    const routedIncoming = incoming as IncomingMessage & {\n      routingHint?: DispatchIntegrationRoutingHint;\n    };\n    routedIncoming.routingHint ??= dispatchIntegrationRoutingHint(trimmed);\n    if (\n      incoming.platform === \"slack\" &&\n      incoming.triggerKind === \"dm\" &&\n      incoming.platformContext.identityLinkRequired === true\n    ) {\n      return {\n        handled: true,\n        responseText: formatSlackLinkRequiredMessage(),\n      };\n    }\n    if (platformRequiresExplicitLink(incoming)) {\n      const owner = await resolveLinkedOwner(\n        incoming.platform,\n        identityKeyForIncoming(incoming),\n        { allowAnyOrgFallback: true },\n      );\n      if (!owner) {\n        return {\n          handled: true,\n          responseText: formatTelegramLinkRequiredMessage(),\n        };\n      }\n    }\n    return handleRemoteCodeCommand(incoming, adapter, {\n      resolveOwner: () => resolveDispatchOwner(incoming),\n    });\n  }\n\n  try {\n    const owner = await consumeLinkToken({\n      platform: incoming.platform,\n      token: match[1],\n      externalUserId: identityKeyForIncoming(incoming),\n      externalUserName: incoming.senderName || null,\n    });\n    return {\n      handled: true,\n      responseText: `Linked successfully. Future ${incoming.platform} messages will use ${owner}'s personal dispatch context.`,\n    };\n  } catch (error) {\n    return {\n      handled: true,\n      responseText:\n        error instanceof Error ? error.message : \"Failed to link this account.\",\n    };\n  }\n}\n"]}
+{"version":3,"file":"dispatch-integrations.js","sourceRoot":"","sources":["../../../src/server/lib/dispatch-integrations.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EACL,8BAA8B,EAC9B,qCAAqC,EACrC,mBAAmB,EACnB,6BAA6B,EAC7B,+BAA+B,EAC/B,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAOtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EACL,8BAA8B,GAE/B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAQ3E,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAG9B,CAAC;AACJ,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/C,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACnE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,QAAyB;IAEzB,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC9D,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;IACrD,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QACrC,MAAM,aAAa,GAAG,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,aAAa,CAAC,CAAC;QAC5E,OAAO,aAAa,CAAC,CAAC,CAAC,GAAG,aAAa,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;IACnE,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClC,OAAO,QAAQ,CAAC,WAAW,EAAE,CAAC;IAChC,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,wBAAwB,CAAC,QAAyB;IACzD,MAAM,MAAM,GACV,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC;QAC9C,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,aAAa,CAAC;QACrD,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC;QAC9C,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC;QAC5C,QAAQ,CAAC,gBAAgB,CAAC;IAC5B,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,QAAQ,IAAI,MAAM,IAAI,QAAQ,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;IACxE,MAAM,IAAI,GAAG,MAAM;SAChB,UAAU,CAAC,QAAQ,CAAC;SACpB,MAAM,CAAC,GAAG,CAAC;SACX,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,OAAO,YAAY,IAAI,oBAAoB,CAAC;AAC9C,CAAC;AAED,SAAS,iCAAiC,CACxC,QAAyB;IAEzB,2EAA2E;IAC3E,sEAAsE;IACtE,8EAA8E;IAC9E,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,CAAC;IAC/D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,OAAO,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACjE,CAAC;AAED,SAAS,4BAA4B,CAAC,QAAyB;IAC7D,0EAA0E;IAC1E,kEAAkE;IAClE,OAAO,QAAQ,CAAC,QAAQ,KAAK,UAAU,CAAC;AAC1C,CAAC;AAED,SAAS,+BAA+B;IACtC,MAAM,GAAG,GACP,OAAO,CAAC,GAAG,CAAC,qBAAqB;QACjC,OAAO,CAAC,GAAG,CAAC,OAAO;QACnB,OAAO,CAAC,GAAG,CAAC,GAAG;QACf,OAAO,CAAC,GAAG,CAAC,UAAU;QACtB,OAAO,CAAC,GAAG,CAAC,eAAe;QAC3B,EAAE,CAAC;IACL,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7B,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,GAAG,EAAE,CAAC;IAChE,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CACZ,YAAY,EACZ,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAC1D,CAAC,QAAQ,EAAE,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,+BAA+B,CAAC,QAAyB;IACtE,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;IAClE,MAAM,mBAAmB,GACvB,QAAQ,CAAC,eAAe,CAAC,mBAAmB,KAAK,IAAI,CAAC;IACxD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,mBAAmB,IAAI,CAAC,YAAY,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,OAAO,qCAAqC,CAC1C,OAAO,EACP,oBAAoB,CAAC;QACnB,MAAM;QACN,YAAY;QACZ,QAAQ;QACR,mBAAmB;KACpB,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,mCAAoC,SAAQ,KAAK;IACrD,YAAY,OAAsB;QAChC,KAAK,CACH,gEAAgE,EAChE,OAAO,CACR,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qCAAqC,CAAC;IACpD,CAAC;CACF;AAED,KAAK,UAAU,qCAAqC,CAClD,QAAyB;IAEzB,IAAI,CAAC;QACH,OAAO,MAAM,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,mCAAmC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,KAAK,UAAU,wBAAwB,CACrC,QAAyB;IAEzB,MAAM,YAAY,GAAG,MAAM,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IACrE,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAChD,OAAO,EACP,YAAY,CAAC,eAAe,CAC7B,CAAC;IACF,OAAO,MAAM,EAAE,WAAW,IAAI,IAAI,CAAC;AACrC,CAAC;AAED,SAAS,iCAAiC;IACxC,MAAM,aAAa,GAAG,+BAA+B,EAAE,CAAC;IACxD,MAAM,QAAQ,GAAG,aAAa;QAC5B,CAAC,CAAC,OAAO,aAAa,mEAAmE;QACzF,CAAC,CAAC,8FAA8F,CAAC;IACnG,OAAO,+FAA+F,QAAQ,+DAA+D,CAAC;AAChL,CAAC;AAED,SAAS,8BAA8B;IACrC,MAAM,aAAa,GAAG,+BAA+B,EAAE,CAAC;IACxD,MAAM,QAAQ,GAAG,aAAa;QAC5B,CAAC,CAAC,QAAQ,aAAa,sEAAsE;QAC7F,CAAC,CAAC,iGAAiG,CAAC;IACtG,OAAO,4FAA4F,QAAQ,EAAE,CAAC;AAChH,CAAC;AAED,SAAS,4CAA4C;IACnD,OAAO,4GAA4G,CAAC;AACtH,CAAC;AAED,SAAS,gCAAgC;IACvC,OAAO,+EAA+E,CAAC;AACzF,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,QAAyB;IAEzB,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACvD,CAAC;IAED,wEAAwE;IACxE,sEAAsE;IACtE,wEAAwE;IACxE,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,MAAM,CAAC,OAAO,CAAC;IACrE,CAAC;IAED,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,oCAAoC,MAAM,EAAE,EAAE;YACpE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAc7B,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE;YACrB,CAAC,CAAC;gBACE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,IAAI,IAAI;gBAC9D,IAAI,EACF,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE;oBACrC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE;oBACxC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE;oBAC5B,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE;oBACvB,IAAI;gBACN,KAAK,EACH,IAAI,CAAC,IAAI,EAAE,WAAW,KAAK,IAAI;oBAC/B,IAAI,CAAC,IAAI,EAAE,mBAAmB,KAAK,IAAI;oBACrC,CAAC,CAAE,iBAA2B;oBAC9B,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,KAAK,IAAI;wBACjC,CAAC,CAAE,OAAiB;wBACpB,CAAC,CAAE,SAAmB;aAC7B;YACH,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAkB,EAAE,CAAC;QAC3D,IAAI,QAAQ,EAAE,CAAC;YACb,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE;gBAC9B,OAAO;gBACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,uBAAuB;aAChD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,kCAAkC,CAC/C,QAAyB;IAEzB,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAEhC,QAAQ,CAAC,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC;IACrC,QAAQ,CAAC,eAAe,CAAC,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC;IACrD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,QAAQ,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;QACnC,QAAQ,CAAC,eAAe,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IACrD,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,qCAAqC,CAClD,QAAyB,EACzB,YAEC;IAED,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC1D,QAAQ,CAAC,UAAU,GAAG;QACpB,UAAU,EACR,OAAO,CAAC,KAAK,KAAK,OAAO;YACvB,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,iBAAiB;gBACnC,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS;oBAC3B,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,SAAS;QACnB,QAAQ,EAAE,OAAO,CAAC,KAAK,KAAK,SAAS;KACtC,CAAC;IACF,QAAQ,CAAC,cAAc,GAAG,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC;IACjD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,QAAQ,CAAC,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC;QACrC,QAAQ,CAAC,eAAe,CAAC,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,QAAQ,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;QACnC,QAAQ,CAAC,eAAe,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;IACrD,CAAC;IAED,MAAM,aAAa,GAAG,GAAgC,EAAE,CAAC,CAAC;QACxD,UAAU,EAAE,wBAAwB,CAAC,QAAQ,CAAC;QAC9C,KAAK,EAAE,IAAI;QACX,aAAa,EAAE,MAAM;QACrB,cAAc,EAAE,YAAY,CAAC,EAAE;KAChC,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,QAAQ,CAAC,eAAe,CAAC,0BAA0B,GAAG,IAAI,CAAC;QAC3D,OAAO,aAAa,EAAE,CAAC;IACzB,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,iBAAiB,EAAE,CAAC;QACrE,QAAQ,CAAC,eAAe,CAAC,oBAAoB,GAAG,IAAI,CAAC;QACrD,OAAO,aAAa,EAAE,CAAC;IACzB,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QACxB,QAAQ,CAAC,eAAe,CAAC,oBAAoB,GAAG,IAAI,CAAC;QACrD,OAAO,aAAa,EAAE,CAAC;IACzB,CAAC;IACD,QAAQ,CAAC,eAAe,CAAC,wBAAwB,GAAG,YAAY,CAAC,KAAK,CAAC;IAEvE,IAAI,WAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,kBAAkB,CACpC,OAAO,EACP,sBAAsB,CAAC,QAAQ,CAAC,EAChC,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,CAC9B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,eAAe,CAAC,0BAA0B,GAAG,IAAI,CAAC;QAC3D,OAAO,aAAa,EAAE,CAAC;IACzB,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,MAAM,CACpD,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAmB,EAAE,CACxC,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,CAC7C,CAAC;IACF,KAAK,MAAM,UAAU,IAAI,UAAU,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,IAAI,MAAM,WAAW,CAAC,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;gBACtD,OAAO;oBACL,UAAU;oBACV,KAAK,EAAE,YAAY,CAAC,KAAK;oBACzB,aAAa,EAAE,MAAM;oBACrB,cAAc,EAAE,YAAY,CAAC,EAAE;iBAChC,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,eAAe,CAAC,0BAA0B,GAAG,IAAI,CAAC;YAC3D,OAAO,aAAa,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAED,QAAQ,CAAC,eAAe,CAAC,oBAAoB,GAAG,IAAI,CAAC;IACrD,OAAO,aAAa,EAAE,CAAC;AACzB,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,QAAyB,EACzB,UAAuC;IAKvC,IAAI,QAAQ,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAClC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,CAAC;IACnE,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IAClE,IAAI,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,4CAA4C,MAAM,EAAE,EACpD,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,EAAE,CAClD,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAOlC,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAC;QAC3D,CAAC;QACD,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU;YACnE,gBAAgB,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK;gBACnC,CAAC,CAAC,gBAAgB;gBAClB,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO;oBACrB,CAAC,CAAC,sBAAsB;oBACxB,CAAC,CAAC,SAAS;SAChB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,QAAyB;IAEzB,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAExD,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,EAAE,cAAc,EAAE;YACxE,mBAAmB,EAAE,IAAI;SAC1B,CAAC,CAAC;QACH,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QAExB,0EAA0E;QAC1E,2EAA2E;QAC3E,wEAAwE;QACxE,8DAA8D;QAC9D,wEAAwE;QACxE,6DAA6D;QAC7D,kEAAkE;QAClE,8CAA8C;QAC9C,2EAA2E;QAC3E,sEAAsE;QACtE,qEAAqE;QACrE,EAAE;QACF,wEAAwE;QACxE,wEAAwE;QACxE,oEAAoE;QACpE,uEAAuE;QACvE,gDAAgD;QAChD,IACE,QAAQ,CAAC,QAAQ,KAAK,OAAO;YAC7B,QAAQ,CAAC,QAAQ;YACjB,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAC/B,CAAC;YACD,IAAI,OAAO,CAAC,GAAG,CAAC,sCAAsC,KAAK,GAAG,EAAE,CAAC;gBAC/D,OAAO,QAAQ,CAAC,QAAQ,CAAC;YAC3B,CAAC;YACD,IAAI,QAAQ,CAAC,cAAc,EAAE,CAAC;gBAC5B,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC5D,IAAI,KAAK;oBAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC;YACtC,CAAC;YACD,wEAAwE;YACxE,sCAAsC;QACxC,CAAC;QAED,0EAA0E;QAC1E,uEAAuE;QACvE,0EAA0E;QAC1E,iCAAiC;QACjC,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAClC,MAAM,UAAU,GAAG,MAAM,kCAAkC,CAAC,QAAQ,CAAC,CAAC;YACtE,IAAI,UAAU;gBAAE,OAAO,UAAU,CAAC;QACpC,CAAC;QAED,MAAM,YAAY,GAAG,iCAAiC,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,YAAY;YAAE,OAAO,YAAY,CAAC;QAEtC,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,YAAY,GAAG,iCAAiC,CAAC,QAAQ,CAAC,CAAC;QACjE,IAAI,YAAY;YAAE,OAAO,YAAY,CAAC;QACtC,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,QAAyB;IAEzB,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QACnE,IAAI,YAAY,CAAC;QACjB,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,qCAAqC,CAAC,QAAQ,CAAC,CAAC;QACvE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,mCAAmC,CAAC;gBAAE,MAAM,KAAK,CAAC;YACzE,QAAQ,CAAC,eAAe,CAAC,0BAA0B,GAAG,IAAI,CAAC;YAC3D,OAAO;gBACL,UAAU,EAAE,wBAAwB,CAAC,QAAQ,CAAC;gBAC9C,KAAK,EAAE,IAAI;gBACX,aAAa,EAAE,MAAM;aACtB,CAAC;QACJ,CAAC;QACD,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,qCAAqC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;QACvE,CAAC;QACD,QAAQ,CAAC,eAAe,CAAC,0BAA0B,GAAG,IAAI,CAAC;QAC3D,OAAO;YACL,UAAU,EAAE,wBAAwB,CAAC,QAAQ,CAAC;YAC9C,KAAK,EAAE,IAAI;YACX,aAAa,EAAE,MAAM;SACtB,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,IAAI,QAAQ,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QACnE,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACxD,IACE,QAAQ,CAAC,QAAQ,KAAK,OAAO;YAC7B,UAAU,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EACzC,CAAC;YACD,wEAAwE;YACxE,qEAAqE;YACrE,oCAAoC;YACpC,QAAQ,CAAC,eAAe,CAAC,oBAAoB,GAAG,IAAI,CAAC;QACvD,CAAC;QACD,OAAO;YACL,UAAU;YACV,KAAK,EAAE,CAAC,MAAM,oBAAoB,CAAC,UAAU,CAAC,CAAC,IAAI,IAAI;YACvD,aAAa,EAAE,MAAM;SACtB,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,qCAAqC,CAAC,QAAQ,CAAC,CAAC;IAC3E,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,0EAA0E;QAC1E,mEAAmE;QACnE,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACxD,OAAO;YACL,UAAU;YACV,KAAK,EAAE,CAAC,MAAM,oBAAoB,CAAC,UAAU,CAAC,CAAC,IAAI,IAAI;YACvD,aAAa,EAAE,MAAM;SACtB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,MAAM,6BAA6B,CACtD,QAAQ,EACR,OAAO,CAAC,KAAK,CACd,CAAC;IACF,MAAM,MAAM,GAAG;QACb,UAAU,EAAE,YAAY,CAAC,UAAU;QACnC,KAAK,EAAE,YAAY,CAAC,KAAK;KAC1B,CAAC;IACF,MAAM,GAAG,GAAG;QACV,QAAQ,EAAE,OAAO;QACjB,QAAQ,EAAE,MAAM;QAChB,cAAc,EAAE,SAAS;KAC1B,CAAC;IACF,IAAI,KAAK,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACjD,KAAK,GAAG,MAAM,oBAAoB,CAChC;YACE,GAAG,GAAG;YACN,gBAAgB,EAAE,YAAY,CAAC,gBAAgB;YAC/C,KAAK,EAAE,YAAY,CAAC,KAAK;YACzB,KAAK,EAAE,YAAY,CAAC,KAAK;YACzB,cAAc,EAAE,YAAY,CAAC,EAAE;SAChC,EACD,MAAM,CACP,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAG,8BAA8B,CAAC,KAAK,EAAE;QACrD,yEAAyE;QACzE,qEAAqE;QACrE,SAAS,EACP,QAAQ,CAAC,WAAW,KAAK,SAAS;YAClC,QAAQ,CAAC,WAAW,KAAK,cAAc;KAC1C,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,QAAQ,CAAC,kBAAkB,GAAG,KAAK,CAAC,EAAE,CAAC;IACvC,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACvB,QAAQ,CAAC,eAAe,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAC;IAC7D,CAAC;IACD,QAAQ,CAAC,UAAU,GAAG;QACpB,UAAU,EACR,YAAY,CAAC,KAAK,KAAK,OAAO;YAC5B,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,YAAY,CAAC,KAAK,KAAK,iBAAiB;gBACxC,CAAC,CAAC,UAAU;gBACZ,CAAC,CAAC,YAAY,CAAC,KAAK,KAAK,SAAS;oBAChC,CAAC,CAAC,QAAQ;oBACV,CAAC,CAAC,SAAS;QACnB,QAAQ,EAAE,YAAY,CAAC,KAAK,KAAK,SAAS;KAC3C,CAAC;IACF,OAAO;QACL,UAAU,EAAE,KAAK,CAAC,iBAAiB;QACnC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,aAAa,EAAE,SAAS;QACxB,cAAc,EAAE,YAAY,CAAC,EAAE;QAC/B,OAAO,EAAE,KAAK,CAAC,EAAE;KAClB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAyB,EACzB,OAAwB;IAExB,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,WAAW,GACf,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC;IAC7D,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACxE,IACE,KAAK;QACL,QAAQ,CAAC,QAAQ,KAAK,OAAO;QAC7B,QAAQ,CAAC,WAAW,KAAK,IAAI;QAC7B,CAAC,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,wBAAwB,CAAC;QACjE,QAAQ,CAAC,eAAe,CAAC,0BAA0B,KAAK,IAAI;QAC5D,QAAQ,CAAC,eAAe,CAAC,oBAAoB,KAAK,IAAI,EACtD,CAAC;QACD,MAAM,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IAClD,CAAC;IACD,IACE,QAAQ,CAAC,QAAQ,KAAK,OAAO;QAC7B,QAAQ,CAAC,WAAW,KAAK,IAAI;QAC7B,QAAQ,CAAC,eAAe,CAAC,0BAA0B,KAAK,IAAI,EAC5D,CAAC;QACD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,YAAY,EAAE,4CAA4C,EAAE;SAC7D,CAAC;IACJ,CAAC;IACD,IACE,QAAQ,CAAC,QAAQ,KAAK,OAAO;QAC7B,QAAQ,CAAC,WAAW,KAAK,IAAI;QAC7B,QAAQ,CAAC,eAAe,CAAC,oBAAoB,KAAK,IAAI,EACtD,CAAC;QACD,OAAO;YACL,OAAO,EAAE,IAAI;YACb,YAAY,EAAE,gCAAgC,EAAE;SACjD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,cAAc,GAAG,QAEtB,CAAC;QACF,cAAc,CAAC,WAAW,KAAK,8BAA8B,CAAC,OAAO,CAAC,CAAC;QACvE,IACE,QAAQ,CAAC,QAAQ,KAAK,OAAO;YAC7B,QAAQ,CAAC,WAAW,KAAK,IAAI;YAC7B,QAAQ,CAAC,eAAe,CAAC,oBAAoB,KAAK,IAAI,EACtD,CAAC;YACD,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,YAAY,EAAE,8BAA8B,EAAE;aAC/C,CAAC;QACJ,CAAC;QACD,IAAI,4BAA4B,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,MAAM,kBAAkB,CACpC,QAAQ,CAAC,QAAQ,EACjB,sBAAsB,CAAC,QAAQ,CAAC,EAChC,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAC9B,CAAC;YACF,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO;oBACL,OAAO,EAAE,IAAI;oBACb,YAAY,EAAE,iCAAiC,EAAE;iBAClD,CAAC;YACJ,CAAC;QACH,CAAC;QACD,OAAO,uBAAuB,CAAC,QAAQ,EAAE,OAAO,EAAE;YAChD,YAAY,EAAE,GAAG,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC;SACnD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,aAAa,CACjC,QAAQ,CAAC,eAAe,CAAC,wBAAwB,CAClD,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC;YACnC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;YACf,cAAc,EAAE,sBAAsB,CAAC,QAAQ,CAAC;YAChD,gBAAgB,EAAE,QAAQ,CAAC,UAAU,IAAI,IAAI;YAC7C,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAC,CAAC;QACH,OAAO;YACL,OAAO,EAAE,IAAI;YACb,YAAY,EAAE,+BAA+B,QAAQ,CAAC,QAAQ,sBAAsB,KAAK,+BAA+B;SACzH,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,IAAI;YACb,YAAY,EACV,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B;SAC1E,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import crypto from \"node:crypto\";\n\nimport {\n  evaluateIntegrationScopePolicy,\n  getActiveIntegrationInstallationByKey,\n  getIntegrationScope,\n  resolveIntegrationTokenBundle,\n  resolveSlackBotTokenForIncoming,\n  saveIntegrationScope,\n  slackInstallationKey,\n} from \"@agent-native/core/integrations\";\nimport { isOrgMember, resolveOrgIdForEmail } from \"@agent-native/core/org\";\nimport { withConfiguredAppBasePath } from \"@agent-native/core/server\";\nimport type {\n  IncomingMessage,\n  IntegrationExecutionContext,\n  PlatformAdapter,\n} from \"@agent-native/core/server\";\n\nimport { handleRemoteCodeCommand } from \"./dispatch-remote-commands.js\";\nimport {\n  dispatchIntegrationRoutingHint,\n  type DispatchIntegrationRoutingHint,\n} from \"./dispatch-routing.js\";\nimport { consumeLinkToken, resolveLinkedOwner } from \"./dispatch-store.js\";\n\ntype SlackSenderProfile = {\n  email: string | null;\n  name: string | null;\n  trust: \"trusted\" | \"guest\" | \"external_shared\" | \"unknown\";\n};\n\nconst slackProfileCache = new Map<\n  string,\n  { profile: SlackSenderProfile; expiresAt: number }\n>();\nconst SLACK_PROFILE_CACHE_TTL = 10 * 60 * 1000;\n\nfunction contextString(value: unknown): string | null {\n  if (typeof value === \"string\" && value.trim()) return value.trim();\n  if (typeof value === \"number\" && Number.isFinite(value)) return String(value);\n  return null;\n}\n\nexport function identityKeyForIncoming(\n  incoming: IncomingMessage,\n): string | null {\n  const senderId = contextString(incoming.senderId);\n  if (!senderId) return null;\n\n  if (incoming.platform === \"slack\") {\n    const teamId = contextString(incoming.platformContext.teamId);\n    return teamId ? `${teamId}:${senderId}` : senderId;\n  }\n\n  if (incoming.platform === \"whatsapp\") {\n    const phoneNumberId = contextString(incoming.platformContext.phoneNumberId);\n    return phoneNumberId ? `${phoneNumberId}:${senderId}` : senderId;\n  }\n\n  if (incoming.platform === \"email\") {\n    return senderId.toLowerCase();\n  }\n\n  return senderId;\n}\n\nfunction fallbackOwnerForIncoming(incoming: IncomingMessage): string {\n  const tenant =\n    contextString(incoming.platformContext.teamId) ||\n    contextString(incoming.platformContext.phoneNumberId) ||\n    contextString(incoming.platformContext.chatId) ||\n    contextString(incoming.platformContext.from) ||\n    incoming.externalThreadId;\n  const raw = `${incoming.platform}:${tenant}:${incoming.senderId || \"\"}`;\n  const hash = crypto\n    .createHash(\"sha256\")\n    .update(raw)\n    .digest(\"hex\")\n    .slice(0, 16);\n  return `dispatch+${hash}@integration.local`;\n}\n\nfunction configuredDefaultOwnerForIncoming(\n  incoming: IncomingMessage,\n): string | null {\n  // This is intentionally Slack-only: a deployment-wide default owner grants\n  // that Slack workspace access to the owner's connected agents and org\n  // credentials, so other platforms should opt in with explicit identity links.\n  if (incoming.platform !== \"slack\") return null;\n  const email = process.env.DISPATCH_DEFAULT_OWNER_EMAIL?.trim();\n  if (!email) return null;\n  return /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(email) ? email : null;\n}\n\nfunction platformRequiresExplicitLink(incoming: IncomingMessage): boolean {\n  // Telegram does not provide a verified email address. Require an explicit\n  // identity link before it can act as a Builder/Agent-Native user.\n  return incoming.platform === \"telegram\";\n}\n\nfunction configuredDispatchIdentitiesUrl(): string | null {\n  const raw =\n    process.env.WORKSPACE_GATEWAY_URL ||\n    process.env.APP_URL ||\n    process.env.URL ||\n    process.env.DEPLOY_URL ||\n    process.env.BETTER_AUTH_URL ||\n    \"\";\n  if (!raw.trim()) return null;\n  const base = /^https?:\\/\\//i.test(raw) ? raw : `https://${raw}`;\n  try {\n    return new URL(\n      \"identities\",\n      `${withConfiguredAppBasePath(base).replace(/\\/+$/, \"\")}/`,\n    ).toString();\n  } catch {\n    return null;\n  }\n}\n\nasync function resolveManagedSlackInstallation(incoming: IncomingMessage) {\n  if (incoming.platform !== \"slack\") return null;\n  const teamId = contextString(incoming.platformContext.teamId);\n  const enterpriseId = contextString(incoming.platformContext.enterpriseId);\n  const apiAppId = contextString(incoming.platformContext.apiAppId);\n  const isEnterpriseInstall =\n    incoming.platformContext.isEnterpriseInstall === true;\n  if ((!teamId && !enterpriseId) || (isEnterpriseInstall && !enterpriseId))\n    return null;\n  return getActiveIntegrationInstallationByKey(\n    \"slack\",\n    slackInstallationKey({\n      teamId,\n      enterpriseId,\n      apiAppId,\n      isEnterpriseInstall,\n    }),\n  );\n}\n\nclass ManagedSlackInstallationLookupError extends Error {\n  constructor(options?: ErrorOptions) {\n    super(\n      \"Managed Slack installation identity is temporarily unavailable\",\n      options,\n    );\n    this.name = \"ManagedSlackInstallationLookupError\";\n  }\n}\n\nasync function resolveManagedSlackInstallationOrFail(\n  incoming: IncomingMessage,\n) {\n  try {\n    return await resolveManagedSlackInstallation(incoming);\n  } catch (cause) {\n    throw new ManagedSlackInstallationLookupError({ cause });\n  }\n}\n\nasync function resolveManagedSlackToken(\n  incoming: IncomingMessage,\n): Promise<string | null> {\n  const installation = await resolveManagedSlackInstallation(incoming);\n  if (!installation) return null;\n  const bundle = await resolveIntegrationTokenBundle(\n    \"slack\",\n    installation.installationKey,\n  );\n  return bundle?.accessToken ?? null;\n}\n\nfunction formatTelegramLinkRequiredMessage(): string {\n  const identitiesUrl = configuredDispatchIdentitiesUrl();\n  const linkStep = identitiesUrl\n    ? `Tap ${identitiesUrl}, create a Telegram link token, then send \\`/link <token>\\` here.`\n    : \"Open Dispatch while signed in, create a Telegram link token, then send `/link <token>` here.\";\n  return `Telegram is connected, but this Telegram account is not linked to an Agent-Native user yet. ${linkStep} After that I can use your Builder.io org and connected apps.`;\n}\n\nfunction formatSlackLinkRequiredMessage(): string {\n  const identitiesUrl = configuredDispatchIdentitiesUrl();\n  const linkStep = identitiesUrl\n    ? `Open ${identitiesUrl}, create a Slack link token, then send \\`/link <token>\\` in this DM.`\n    : \"Open Dispatch while signed in, create a Slack link token, then send `/link <token>` in this DM.\";\n  return `Agent Native is ready, but this Slack account is not linked to an Agent Native user yet. ${linkStep}`;\n}\n\nfunction formatSlackIdentityVerificationFailedMessage(): string {\n  return \"I couldn't verify your Slack identity just now, so I can't run this request. Please try again in a moment.\";\n}\n\nfunction formatSlackIdentityDeniedMessage(): string {\n  return \"This assistant is only available to members of this workspace's organization.\";\n}\n\nasync function resolveSlackSenderProfile(\n  incoming: IncomingMessage,\n): Promise<SlackSenderProfile> {\n  if (incoming.platform !== \"slack\") {\n    return { email: null, name: null, trust: \"unknown\" };\n  }\n  const token = await resolveSlackBotTokenForIncoming(incoming);\n  const userId = contextString(incoming.senderId);\n  const teamId = contextString(incoming.platformContext.teamId);\n  if (!token || !userId) {\n    return { email: null, name: null, trust: \"unknown\" };\n  }\n\n  // Slack user IDs are scoped per workspace, so without a teamId we can't\n  // safely cache: two installs of the bot in different workspaces could\n  // share user-id strings and collide on a single \"default\" key. Skip the\n  // cache (and lookup on every request) when teamId is missing.\n  const cacheKey = teamId ? `${teamId}:${userId}` : null;\n  if (cacheKey) {\n    const cached = slackProfileCache.get(cacheKey);\n    if (cached && cached.expiresAt > Date.now()) return cached.profile;\n  }\n\n  try {\n    const params = new URLSearchParams({ user: userId });\n    const res = await fetch(`https://slack.com/api/users.info?${params}`, {\n      headers: { Authorization: `Bearer ${token}` },\n    });\n    const data = (await res.json()) as {\n      ok?: boolean;\n      user?: {\n        real_name?: string;\n        name?: string;\n        profile?: {\n          email?: string;\n          real_name?: string;\n          display_name?: string;\n        };\n        is_restricted?: boolean;\n        is_ultra_restricted?: boolean;\n        is_stranger?: boolean;\n      };\n    };\n    const profile = data.ok\n      ? {\n          email: data.user?.profile?.email?.trim().toLowerCase() || null,\n          name:\n            data.user?.profile?.real_name?.trim() ||\n            data.user?.profile?.display_name?.trim() ||\n            data.user?.real_name?.trim() ||\n            data.user?.name?.trim() ||\n            null,\n          trust:\n            data.user?.is_stranger === true ||\n            data.user?.is_ultra_restricted === true\n              ? (\"external_shared\" as const)\n              : data.user?.is_restricted === true\n                ? (\"guest\" as const)\n                : (\"trusted\" as const),\n        }\n      : { email: null, name: null, trust: \"unknown\" as const };\n    if (cacheKey) {\n      slackProfileCache.set(cacheKey, {\n        profile,\n        expiresAt: Date.now() + SLACK_PROFILE_CACHE_TTL,\n      });\n    }\n    return profile;\n  } catch {\n    return { email: null, name: null, trust: \"unknown\" };\n  }\n}\n\nasync function resolveSlackOwnerFromVerifiedEmail(\n  incoming: IncomingMessage,\n): Promise<string | null> {\n  const profile = await resolveSlackSenderProfile(incoming);\n  if (!profile.email) return null;\n\n  incoming.senderEmail = profile.email;\n  incoming.platformContext.senderEmail = profile.email;\n  if (profile.name) {\n    incoming.senderName = profile.name;\n    incoming.platformContext.senderName = profile.name;\n  }\n\n  const orgId = await resolveOrgIdForEmail(profile.email);\n  return orgId ? profile.email : null;\n}\n\nasync function resolveManagedSlackDmExecutionContext(\n  incoming: IncomingMessage,\n  installation: NonNullable<\n    Awaited<ReturnType<typeof resolveManagedSlackInstallation>>\n  >,\n): Promise<IntegrationExecutionContext> {\n  const profile = await resolveSlackSenderProfile(incoming);\n  incoming.actorTrust = {\n    memberType:\n      profile.trust === \"guest\"\n        ? \"guest\"\n        : profile.trust === \"external_shared\"\n          ? \"external\"\n          : profile.trust === \"trusted\"\n            ? \"member\"\n            : \"unknown\",\n    verified: profile.trust !== \"unknown\",\n  };\n  incoming.senderVerified = profile.email !== null;\n  if (profile.email) {\n    incoming.senderEmail = profile.email;\n    incoming.platformContext.senderEmail = profile.email;\n  }\n  if (profile.name) {\n    incoming.senderName = profile.name;\n    incoming.platformContext.senderName = profile.name;\n  }\n\n  const deniedContext = (): IntegrationExecutionContext => ({\n    ownerEmail: fallbackOwnerForIncoming(incoming),\n    orgId: null,\n    principalType: \"user\",\n    installationId: installation.id,\n  });\n\n  if (profile.trust === \"unknown\") {\n    incoming.platformContext.identityVerificationFailed = true;\n    return deniedContext();\n  }\n  if (profile.trust === \"guest\" || profile.trust === \"external_shared\") {\n    incoming.platformContext.identityAccessDenied = true;\n    return deniedContext();\n  }\n  if (!installation.orgId) {\n    incoming.platformContext.identityLinkRequired = true;\n    return deniedContext();\n  }\n  incoming.platformContext.managedInstallationOrgId = installation.orgId;\n\n  let linkedOwner: string | null;\n  try {\n    linkedOwner = await resolveLinkedOwner(\n      \"slack\",\n      identityKeyForIncoming(incoming),\n      { orgId: installation.orgId },\n    );\n  } catch {\n    incoming.platformContext.identityVerificationFailed = true;\n    return deniedContext();\n  }\n  const candidates = [profile.email, linkedOwner].filter(\n    (email, index, values): email is string =>\n      !!email && values.indexOf(email) === index,\n  );\n  for (const ownerEmail of candidates) {\n    try {\n      if (await isOrgMember(installation.orgId, ownerEmail)) {\n        return {\n          ownerEmail,\n          orgId: installation.orgId,\n          principalType: \"user\",\n          installationId: installation.id,\n        };\n      }\n    } catch {\n      incoming.platformContext.identityVerificationFailed = true;\n      return deniedContext();\n    }\n  }\n\n  incoming.platformContext.identityLinkRequired = true;\n  return deniedContext();\n}\n\nasync function resolveSlackConversationTrust(\n  incoming: IncomingMessage,\n  actorTrust: SlackSenderProfile[\"trust\"],\n): Promise<{\n  trust: SlackSenderProfile[\"trust\"];\n  conversationType: \"channel\" | \"direct_message\" | \"group_direct_message\";\n}> {\n  if (incoming.triggerKind === \"dm\") {\n    return { trust: actorTrust, conversationType: \"direct_message\" };\n  }\n  const token = await resolveManagedSlackToken(incoming);\n  const channel = contextString(incoming.platformContext.channelId);\n  if (!token || !channel) {\n    return { trust: \"unknown\", conversationType: \"channel\" };\n  }\n  try {\n    const params = new URLSearchParams({ channel });\n    const response = await fetch(\n      `https://slack.com/api/conversations.info?${params}`,\n      { headers: { Authorization: `Bearer ${token}` } },\n    );\n    const data = (await response.json()) as {\n      ok?: boolean;\n      channel?: {\n        is_ext_shared?: boolean;\n        is_im?: boolean;\n        is_mpim?: boolean;\n      };\n    };\n    if (!data.ok) {\n      return { trust: \"unknown\", conversationType: \"channel\" };\n    }\n    return {\n      trust: data.channel?.is_ext_shared ? \"external_shared\" : actorTrust,\n      conversationType: data.channel?.is_im\n        ? \"direct_message\"\n        : data.channel?.is_mpim\n          ? \"group_direct_message\"\n          : \"channel\",\n    };\n  } catch {\n    return { trust: \"unknown\", conversationType: \"channel\" };\n  }\n}\n\nexport async function resolveDispatchOwner(\n  incoming: IncomingMessage,\n): Promise<string> {\n  try {\n    const externalUserId = identityKeyForIncoming(incoming);\n\n    // Webhooks do not have the browser request's org context, so allow a safe\n    // cross-org fallback when the linked platform identity maps to one owner.\n    const owner = await resolveLinkedOwner(incoming.platform, externalUserId, {\n      allowAnyOrgFallback: true,\n    });\n    if (owner) return owner;\n\n    // For email, the sender's `From:` address is attacker-settable: SMTP lets\n    // anyone claim any From, and our inbound webhook secret only authenticates\n    // the provider→app hop, not the original sender. So we must NOT grant a\n    // real user's identity (their API keys, org secrets, personal\n    // instructions, ownable data) off the bare From. Mirror the Slack gate:\n    // only return the sender email as the acting owner when BOTH\n    //   (a) the message is DKIM/SPF-verified for the From domain, AND\n    //   (b) that email maps to a real org member.\n    // Otherwise fall through to the synthetic, credential-less fallback owner.\n    // (A linked identity, handled by resolveLinkedOwner above, remains an\n    // always-allowed way to bind an address regardless of verification.)\n    //\n    // Escape hatch: set DISPATCH_TRUST_UNVERIFIED_EMAIL_SENDER=1 to restore\n    // the legacy \"trust the From header\" behavior. OFF by default; only use\n    // this if you fully control the inbound mail path and accept that a\n    // spoofed From can act as any org member. See FINDING 3 (inbound-email\n    // impersonation) in the webhook security audit.\n    if (\n      incoming.platform === \"email\" &&\n      incoming.senderId &&\n      incoming.senderId.includes(\"@\")\n    ) {\n      if (process.env.DISPATCH_TRUST_UNVERIFIED_EMAIL_SENDER === \"1\") {\n        return incoming.senderId;\n      }\n      if (incoming.senderVerified) {\n        const orgId = await resolveOrgIdForEmail(incoming.senderId);\n        if (orgId) return incoming.senderId;\n      }\n      // Unverified or not an org member — do not impersonate. Fall through to\n      // the synthetic fallback owner below.\n    }\n\n    // Slack gives us a user id in the event payload. Resolve it to a verified\n    // workspace email and use that user's own org context when they are an\n    // Agent-Native member, so artifacts created via @agent-native are visible\n    // when they open the target app.\n    if (incoming.platform === \"slack\") {\n      const slackOwner = await resolveSlackOwnerFromVerifiedEmail(incoming);\n      if (slackOwner) return slackOwner;\n    }\n\n    const defaultOwner = configuredDefaultOwnerForIncoming(incoming);\n    if (defaultOwner) return defaultOwner;\n\n    return fallbackOwnerForIncoming(incoming);\n  } catch {\n    const defaultOwner = configuredDefaultOwnerForIncoming(incoming);\n    if (defaultOwner) return defaultOwner;\n    return fallbackOwnerForIncoming(incoming);\n  }\n}\n\n/**\n * Resolve a personal DM user or a workspace-qualified channel service\n * principal. Managed Slack channels never silently inherit one requester's\n * personal credentials or memory.\n */\nexport async function resolveDispatchExecutionContext(\n  incoming: IncomingMessage,\n): Promise<IntegrationExecutionContext> {\n  if (incoming.platform === \"slack\" && incoming.triggerKind === \"dm\") {\n    let installation;\n    try {\n      installation = await resolveManagedSlackInstallationOrFail(incoming);\n    } catch (error) {\n      if (!(error instanceof ManagedSlackInstallationLookupError)) throw error;\n      incoming.platformContext.identityVerificationFailed = true;\n      return {\n        ownerEmail: fallbackOwnerForIncoming(incoming),\n        orgId: null,\n        principalType: \"user\",\n      };\n    }\n    if (installation) {\n      return resolveManagedSlackDmExecutionContext(incoming, installation);\n    }\n    incoming.platformContext.identityVerificationFailed = true;\n    return {\n      ownerEmail: fallbackOwnerForIncoming(incoming),\n      orgId: null,\n      principalType: \"user\",\n    };\n  }\n\n  if (incoming.platform !== \"slack\" || incoming.triggerKind === \"dm\") {\n    const ownerEmail = await resolveDispatchOwner(incoming);\n    if (\n      incoming.platform === \"slack\" &&\n      ownerEmail.endsWith(\"@integration.local\")\n    ) {\n      // Preserve a credential-less principal long enough for beforeProcess to\n      // deliver linking guidance or consume `/link <token>`. Never run the\n      // agent under this synthetic owner.\n      incoming.platformContext.identityLinkRequired = true;\n    }\n    return {\n      ownerEmail,\n      orgId: (await resolveOrgIdForEmail(ownerEmail)) ?? null,\n      principalType: \"user\",\n    };\n  }\n\n  const installation = await resolveManagedSlackInstallationOrFail(incoming);\n  if (!installation) {\n    // Preserve the legacy manually configured app path while managed installs\n    // roll out. Its behavior remains explicit and visible in Settings.\n    const ownerEmail = await resolveDispatchOwner(incoming);\n    return {\n      ownerEmail,\n      orgId: (await resolveOrgIdForEmail(ownerEmail)) ?? null,\n      principalType: \"user\",\n    };\n  }\n\n  const teamId = contextString(incoming.platformContext.teamId);\n  const channelId = contextString(incoming.platformContext.channelId);\n  if (!teamId || !channelId) {\n    throw new Error(\"Slack channel identity is incomplete\");\n  }\n  const profile = await resolveSlackSenderProfile(incoming);\n  const conversation = await resolveSlackConversationTrust(\n    incoming,\n    profile.trust,\n  );\n  const access = {\n    ownerEmail: installation.ownerEmail,\n    orgId: installation.orgId,\n  };\n  const key = {\n    platform: \"slack\",\n    tenantId: teamId,\n    conversationId: channelId,\n  };\n  let scope = await getIntegrationScope(key, access);\n  if (!scope && incoming.triggerKind === \"mention\") {\n    scope = await saveIntegrationScope(\n      {\n        ...key,\n        conversationType: conversation.conversationType,\n        trust: conversation.trust,\n        orgId: installation.orgId,\n        installationId: installation.id,\n      },\n      access,\n    );\n  }\n  if (!scope) throw new Error(\"Slack channel is not enabled for Agent Native\");\n  const decision = evaluateIntegrationScopePolicy(scope, {\n    // Slack channel turns only arrive here after an explicit current-message\n    // mention; keep the generic thread_reply trigger for other adapters.\n    mentioned:\n      incoming.triggerKind === \"mention\" ||\n      incoming.triggerKind === \"thread_reply\",\n  });\n  if (!decision.allowed) {\n    throw new Error(`Slack channel policy denied: ${decision.reason}`);\n  }\n  incoming.integrationScopeId = scope.id;\n  if (scope.defaultModel) {\n    incoming.platformContext.defaultModel = scope.defaultModel;\n  }\n  incoming.actorTrust = {\n    memberType:\n      conversation.trust === \"guest\"\n        ? \"guest\"\n        : conversation.trust === \"external_shared\"\n          ? \"external\"\n          : conversation.trust === \"trusted\"\n            ? \"member\"\n            : \"unknown\",\n    verified: conversation.trust !== \"unknown\",\n  };\n  return {\n    ownerEmail: scope.serviceOwnerEmail,\n    orgId: scope.orgId,\n    principalType: \"service\",\n    installationId: installation.id,\n    scopeId: scope.id,\n  };\n}\n\nexport async function beforeDispatchProcess(\n  incoming: IncomingMessage,\n  adapter: PlatformAdapter,\n): Promise<{ handled: true; responseText?: string } | { handled: false }> {\n  const trimmed = incoming.text.trim();\n  const commandText =\n    contextString(incoming.platformContext.rawText) || trimmed;\n  const match = commandText.match(/^\\/link(?:@\\w+)?\\s+([a-zA-Z0-9_-]+)$/);\n  if (\n    match &&\n    incoming.platform === \"slack\" &&\n    incoming.triggerKind === \"dm\" &&\n    !contextString(incoming.platformContext.managedInstallationOrgId) &&\n    incoming.platformContext.identityVerificationFailed !== true &&\n    incoming.platformContext.identityAccessDenied !== true\n  ) {\n    await resolveDispatchExecutionContext(incoming);\n  }\n  if (\n    incoming.platform === \"slack\" &&\n    incoming.triggerKind === \"dm\" &&\n    incoming.platformContext.identityVerificationFailed === true\n  ) {\n    return {\n      handled: true,\n      responseText: formatSlackIdentityVerificationFailedMessage(),\n    };\n  }\n  if (\n    incoming.platform === \"slack\" &&\n    incoming.triggerKind === \"dm\" &&\n    incoming.platformContext.identityAccessDenied === true\n  ) {\n    return {\n      handled: true,\n      responseText: formatSlackIdentityDeniedMessage(),\n    };\n  }\n  if (!match) {\n    const routedIncoming = incoming as IncomingMessage & {\n      routingHint?: DispatchIntegrationRoutingHint;\n    };\n    routedIncoming.routingHint ??= dispatchIntegrationRoutingHint(trimmed);\n    if (\n      incoming.platform === \"slack\" &&\n      incoming.triggerKind === \"dm\" &&\n      incoming.platformContext.identityLinkRequired === true\n    ) {\n      return {\n        handled: true,\n        responseText: formatSlackLinkRequiredMessage(),\n      };\n    }\n    if (platformRequiresExplicitLink(incoming)) {\n      const owner = await resolveLinkedOwner(\n        incoming.platform,\n        identityKeyForIncoming(incoming),\n        { allowAnyOrgFallback: true },\n      );\n      if (!owner) {\n        return {\n          handled: true,\n          responseText: formatTelegramLinkRequiredMessage(),\n        };\n      }\n    }\n    return handleRemoteCodeCommand(incoming, adapter, {\n      resolveOwner: () => resolveDispatchOwner(incoming),\n    });\n  }\n\n  try {\n    const expectedOrgId = contextString(\n      incoming.platformContext.managedInstallationOrgId,\n    );\n    const owner = await consumeLinkToken({\n      platform: incoming.platform,\n      token: match[1],\n      externalUserId: identityKeyForIncoming(incoming),\n      externalUserName: incoming.senderName || null,\n      ...(expectedOrgId ? { expectedOrgId } : {}),\n    });\n    return {\n      handled: true,\n      responseText: `Linked successfully. Future ${incoming.platform} messages will use ${owner}'s personal dispatch context.`,\n    };\n  } catch (error) {\n    return {\n      handled: true,\n      responseText:\n        error instanceof Error ? error.message : \"Failed to link this account.\",\n    };\n  }\n}\n"]}

package/dist/server/lib/dispatch-store.d.ts

@@ -286,6 +286,7 @@ export declare function consumeLinkToken(input: {
     token: string;
     externalUserId?: string | null;
     externalUserName?: string | null;
+    expectedOrgId?: string;
 }): Promise<string>;
 export declare function listOverview(): Promise<{
     counts: {

package/dist/server/lib/dispatch-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch-store.d.ts","sourceRoot":"","sources":["../../../src/server/lib/dispatch-store.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,qBAAqB,oBAAoB,CAAC;AAqFvD;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;aAEf,YAAY,EAAE,MAAM;IADhD,QAAQ,CAAC,IAAI,uBAAuB;IACpC,YAA4B,YAAY,EAAE,MAAM,EAI/C;CACF;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAKD,wBAAgB,iBAAiB,IAAI,MAAM,CAI1C;AAED,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAE5C;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,wBAAgB,kBAAkB,IAAI,WAAW,CAEhD;AAwBD,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAYzE;AAgCD,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB;;;;;;;;;;;;;;;;;;;;GAgBpE;AAED,wBAAsB,WAAW,CAAC,KAAK,EAAE;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,iBAeA;AAED,wBAAsB,eAAe,CAAC,KAAK,SAAK;;;;;;;;;;;KAgB/C;AAED,wBAAsB,gBAAgB;;;;;;;;;;;;KAerC;AAED,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,MAAM,EACrB,GAAG,GAAE,WAAkC;;;;;;;;;;;;GAcxC;AAsHD,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;;;;;;;;;;;;;;;;;GAiCA;AAED,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAetE;AAED,wBAAsB,iBAAiB,CAAC,aAAa,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkB5D;AAED,wBAAsB,oBAAoB;;;;;;;;;;;;;;;;;KAezC;AA8FD,wBAAsB,cAAc,CAAC,SAAS,EAAE,MAAM;;;;;;;;;;;;;;;;;GAqFrD;AAED,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;;;;;;;;;;;;;;;;;GAqC5E;AAED,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM;;;;;GAuCrD;AAED,wBAAsB,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BtC;AAED,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,EAC9B,OAAO,GAAE;IACP,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC1B,0BAuCP;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC,mBA8GA;AAED,wBAAsB,YAAY;;QAY5B,YAAY;QACZ,gBAAgB;QAEhB,gBAAgB;QAChB,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GASjB"}
+{"version":3,"file":"dispatch-store.d.ts","sourceRoot":"","sources":["../../../src/server/lib/dispatch-store.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,qBAAqB,oBAAoB,CAAC;AAqFvD;;;;GAIG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;aAEf,YAAY,EAAE,MAAM;IADhD,QAAQ,CAAC,IAAI,uBAAuB;IACpC,YAA4B,YAAY,EAAE,MAAM,EAI/C;CACF;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAwB;IACvC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAKD,wBAAgB,iBAAiB,IAAI,MAAM,CAI1C;AAED,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAE5C;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,wBAAgB,kBAAkB,IAAI,WAAW,CAEhD;AAwBD,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAYzE;AAgCD,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB;;;;;;;;;;;;;;;;;;;;GAgBpE;AAED,wBAAsB,WAAW,CAAC,KAAK,EAAE;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,iBAeA;AAED,wBAAsB,eAAe,CAAC,KAAK,SAAK;;;;;;;;;;;KAgB/C;AAED,wBAAsB,gBAAgB;;;;;;;;;;;;KAerC;AAED,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,MAAM,EACrB,GAAG,GAAE,WAAkC;;;;;;;;;;;;GAcxC;AAsHD,wBAAsB,qBAAqB,CAAC,KAAK,EAAE;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;;;;;;;;;;;;;;;;;GAiCA;AAED,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAetE;AAED,wBAAsB,iBAAiB,CAAC,aAAa,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkB5D;AAED,wBAAsB,oBAAoB;;;;;;;;;;;;;;;;;KAezC;AA8FD,wBAAsB,cAAc,CAAC,SAAS,EAAE,MAAM;;;;;;;;;;;;;;;;;GAqFrD;AAED,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;;;;;;;;;;;;;;;;;GAqC5E;AAED,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM;;;;;GAuCrD;AAED,wBAAsB,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BtC;AAED,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,MAAM,EAChB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,EAC9B,OAAO,GAAE;IACP,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC1B,0BAuCP;AAED,wBAAsB,gBAAgB,CAAC,KAAK,EAAE;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,mBAoHA;AAED,wBAAsB,YAAY;;QAY5B,YAAY;QACZ,gBAAgB;QAEhB,gBAAgB;QAChB,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GASjB"}

package/dist/server/lib/dispatch-store.js

@@ -643,6 +643,10 @@ export async function consumeLinkToken(input) {
         recordLinkFailure(input.platform, input.externalUserId);
         throw new Error("Link token has expired");
     }
+    if (input.expectedOrgId && tokenRow.orgId !== input.expectedOrgId) {
+        recordLinkFailure(input.platform, input.externalUserId);
+        throw new Error("This link token belongs to a different organization. Create a token from this workspace and try again.");
+    }
     const timestamp = now();
     const [existing] = await db
         .select()