@automagik/omni 2.260804.3 → 2.260830.2

package/dist/server/index.js

@@ -24040,6 +24040,8 @@ var init_instance = __esm(() => {
     sessionIdPrefix: exports_external.string().max(50).nullable(),
     discordBotToken: exports_external.string().nullable(),
     slackBotToken: exports_external.string().nullable(),
+    slackUserToken: exports_external.string().nullable(),
+    slackAuthMode: exports_external.string().nullable(),
     slackAppToken: exports_external.string().nullable(),
     slackSigningSecret: exports_external.string().nullable(),
     telegramBotToken: exports_external.string().nullable(),
@@ -138240,11 +138242,11 @@ var require_applyToDefaults = __commonJS((exports, module) => {
     return Merge(copy, source, { nullOverride, mergeArrays: false });
   };
   internals.reachCopy = function(dst, src, path) {
-    for (const segment of path) {
-      if (!(segment in src)) {
+    for (const segment2 of path) {
+      if (!(segment2 in src)) {
         return;
       }
-      const val = src[segment];
+      const val = src[segment2];
       if (typeof val !== "object" || val === null) {
         return;
       }
@@ -138253,11 +138255,11 @@ var require_applyToDefaults = __commonJS((exports, module) => {
     const value = src;
     let ref = dst;
     for (let i = 0;i < path.length - 1; ++i) {
-      const segment = path[i];
-      if (typeof ref[segment] !== "object") {
-        ref[segment] = {};
+      const segment2 = path[i];
+      if (typeof ref[segment2] !== "object") {
+        ref[segment2] = {};
       }
-      ref = ref[segment];
+      ref = ref[segment2];
     }
     ref[path[path.length - 1]] = value;
   };
@@ -156556,11 +156558,11 @@ var require_applyToDefaults2 = __commonJS((exports, module) => {
     return Merge(copy, source, { nullOverride, mergeArrays: false });
   };
   internals.reachCopy = function(dst, src, path) {
-    for (const segment of path) {
-      if (!(segment in src)) {
+    for (const segment2 of path) {
+      if (!(segment2 in src)) {
         return;
       }
-      const val = src[segment];
+      const val = src[segment2];
       if (typeof val !== "object" || val === null) {
         return;
       }
@@ -156569,11 +156571,11 @@ var require_applyToDefaults2 = __commonJS((exports, module) => {
     const value = src;
     let ref = dst;
     for (let i = 0;i < path.length - 1; ++i) {
-      const segment = path[i];
-      if (typeof ref[segment] !== "object") {
-        ref[segment] = {};
+      const segment2 = path[i];
+      if (typeof ref[segment2] !== "object") {
+        ref[segment2] = {};
       }
-      ref = ref[segment];
+      ref = ref[segment2];
     }
     ref[path[path.length - 1]] = value;
   };
@@ -164339,6 +164341,9 @@ __export(exports_schema, {
   settingValueTypes: () => settingValueTypes,
   settingChangeHistoryRelations: () => settingChangeHistoryRelations,
   settingChangeHistory: () => settingChangeHistory,
+  scheduledMessages: () => scheduledMessages,
+  scheduledMessageStatuses: () => scheduledMessageStatuses,
+  scheduledMessageDeliveryModes: () => scheduledMessageDeliveryModes,
   ruleTypes: () => ruleTypes,
   replyFilterMode: () => replyFilterMode,
   providerSchemas: () => providerSchemas,
@@ -164439,7 +164444,7 @@ __export(exports_schema, {
   accessRules: () => accessRules,
   accessModes: () => accessModes
 });
-var channelTypes, agentTypes, agentSystems, agentEntityTypes, debounceMode, splitDelayMode, supersedeMode, replyFilterMode, agentSessionStrategies, ruleTypes, accessModes, settingValueTypes, apiKeyStatuses, apiKeyProfiles, eventTypes, contentTypes, chatTypes, messageSources, messageTypes, messageStatuses, deliveryStatuses, jobStatuses, providerSchemas, agentProviders, agents, agentRoutes, agentSessions, apiKeys, apiKeyAuditLogs, apiKeysRelations, apiKeyAuditLogsRelations, instances, whatsappTemplates, whatsappFlowKeys, persons, platformIdentities, conversations, chats, chatParticipants, omniGroups, messages2, omniEvents, handoffLogs, closeContactOutcomes, closeContactLogs, accessRules, globalSettings, settingChangeHistory, batchJobs, syncJobTypes, syncJobs, mediaContent, chatIdMappings, pluginStorage, agentProvidersRelations, agentsRelations, instancesRelations, syncJobsRelations, personsRelations, platformIdentitiesRelations, conversationsRelations, chatsRelations, chatParticipantsRelations, messagesRelations, omniEventsRelations, accessRulesRelations, globalSettingsRelations, settingChangeHistoryRelations, batchJobsRelations, mediaContentRelations, chatIdMappingsRelations, deadLetterStatuses, deadLetterEvents, payloadStorageConfig, payloadStages, eventPayloads, webhookSources, conditionOperators, actionTypes, automationDebounceModes, automations2, automationLogStatuses, automationLogs, consumerOffsets, automationsRelations, automationLogsRelations, triggerLogs, triggerLogsRelations, agentRoutesRelations, agentTaskStatuses, agentTasks, agentTasksRelations, turnStatuses, turnActions, turns, turnsRelations, followUpDisarmReasons, chatFollowUpState, chatFollowUpStateRelations, processedEvents, genieHosts, tenantStatuses, principalTypes, principalStatuses, tenantRoles, membershipStatuses, credentialClasses, authCredentialStatuses, platformApiKeyStatuses, tenants, principals, tenantMemberships, tenantRolePolicies, platformApiKeys, tenantKeyLineage, authCredentials, tenantAuditLogs, platformAuditLogs, platformProviderCatalog, tenantProviderConfig, platformSettings, tenantSettings, platformSettingChangeHistory, tenantSettingChangeHistory, platformPluginStorage, tenantPluginStorage, platformPayloadStorageConfig, tenantPayloadStorageOverrides, tenantMigrationLedger, tenantMigrationLedgerHistory;
+var channelTypes, agentTypes, agentSystems, agentEntityTypes, debounceMode, splitDelayMode, supersedeMode, replyFilterMode, agentSessionStrategies, ruleTypes, accessModes, settingValueTypes, apiKeyStatuses, apiKeyProfiles, eventTypes, contentTypes, chatTypes, messageSources, messageTypes, messageStatuses, deliveryStatuses, scheduledMessageDeliveryModes, scheduledMessageStatuses, jobStatuses, providerSchemas, agentProviders, agents, agentRoutes, agentSessions, apiKeys, apiKeyAuditLogs, apiKeysRelations, apiKeyAuditLogsRelations, instances, whatsappTemplates, whatsappFlowKeys, scheduledMessages, persons, platformIdentities, conversations, chats, chatParticipants, omniGroups, messages2, omniEvents, handoffLogs, closeContactOutcomes, closeContactLogs, accessRules, globalSettings, settingChangeHistory, batchJobs, syncJobTypes, syncJobs, mediaContent, chatIdMappings, pluginStorage, agentProvidersRelations, agentsRelations, instancesRelations, syncJobsRelations, personsRelations, platformIdentitiesRelations, conversationsRelations, chatsRelations, chatParticipantsRelations, messagesRelations, omniEventsRelations, accessRulesRelations, globalSettingsRelations, settingChangeHistoryRelations, batchJobsRelations, mediaContentRelations, chatIdMappingsRelations, deadLetterStatuses, deadLetterEvents, payloadStorageConfig, payloadStages, eventPayloads, webhookSources, conditionOperators, actionTypes, automationDebounceModes, automations2, automationLogStatuses, automationLogs, consumerOffsets, automationsRelations, automationLogsRelations, triggerLogs, triggerLogsRelations, agentRoutesRelations, agentTaskStatuses, agentTasks, agentTasksRelations, turnStatuses, turnActions, turns, turnsRelations, followUpDisarmReasons, chatFollowUpState, chatFollowUpStateRelations, processedEvents, genieHosts, tenantStatuses, principalTypes, principalStatuses, tenantRoles, membershipStatuses, credentialClasses, authCredentialStatuses, platformApiKeyStatuses, tenants, principals, tenantMemberships, tenantRolePolicies, platformApiKeys, tenantKeyLineage, authCredentials, tenantAuditLogs, platformAuditLogs, platformProviderCatalog, tenantProviderConfig, platformSettings, tenantSettings, platformSettingChangeHistory, tenantSettingChangeHistory, platformPluginStorage, tenantPluginStorage, platformPayloadStorageConfig, tenantPayloadStorageOverrides, tenantMigrationLedger, tenantMigrationLedgerHistory;
 var init_schema2 = __esm(() => {
   init_events();
   init_types5();
@@ -164514,6 +164519,8 @@ var init_schema2 = __esm(() => {
   ];
   messageStatuses = ["active", "edited", "deleted", "expired"];
   deliveryStatuses = ["pending", "sent", "delivered", "read", "failed"];
+  scheduledMessageDeliveryModes = ["platform", "local"];
+  scheduledMessageStatuses = ["pending", "sending", "sent", "canceled", "failed"];
   jobStatuses = ["pending", "running", "completed", "failed", "cancelled"];
   providerSchemas = [
     "agno",
@@ -164716,6 +164723,8 @@ var init_schema2 = __esm(() => {
     guildConfigOverrides: jsonb("guild_config_overrides").$type(),
     discordPresence: jsonb("discord_presence").$type(),
     slackBotToken: text("slack_bot_token"),
+    slackUserToken: text("slack_user_token"),
+    slackAuthMode: varchar("slack_auth_mode", { length: 10 }),
     slackAppToken: text("slack_app_token"),
     slackSigningSecret: text("slack_signing_secret"),
     telegramBotToken: text("telegram_bot_token"),
@@ -164860,6 +164869,31 @@ var init_schema2 = __esm(() => {
   }, (t) => ({
     instanceUnique: uniqueIndex("idx_wa_flow_keys_instance").on(t.instanceId)
   }));
+  scheduledMessages = pgTable("scheduled_messages", {
+    id: uuid("id").primaryKey().defaultRandom(),
+    instanceId: uuid("instance_id").notNull().references(() => instances.id, { onDelete: "cascade" }),
+    chatExternalId: varchar("chat_external_id", { length: 255 }).notNull(),
+    threadExternalId: varchar("thread_external_id", { length: 255 }),
+    isThreadBroadcast: boolean("is_thread_broadcast").notNull().default(false),
+    content: jsonb("content").$type().notNull(),
+    sendAt: timestamp("send_at", { withTimezone: true }).notNull(),
+    deliveryMode: varchar("delivery_mode", { length: 20 }).notNull().$type(),
+    status: varchar("status", { length: 20 }).notNull().default("pending").$type(),
+    externalScheduledId: varchar("external_scheduled_id", { length: 255 }),
+    sentExternalId: varchar("sent_external_id", { length: 255 }),
+    sentAt: timestamp("sent_at", { withTimezone: true }),
+    canceledAt: timestamp("canceled_at", { withTimezone: true }),
+    failedAt: timestamp("failed_at", { withTimezone: true }),
+    lastError: text("last_error"),
+    attemptCount: integer("attempt_count").notNull().default(0),
+    createdByAgentId: uuid("created_by_agent_id"),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  }, (t) => ({
+    dueIdx: index("scheduled_messages_due_idx").on(t.status, t.sendAt),
+    instanceIdx: index("scheduled_messages_instance_idx").on(t.instanceId, t.status),
+    chatIdx: index("scheduled_messages_chat_idx").on(t.instanceId, t.chatExternalId)
+  }));
   persons = pgTable("persons", {
     id: uuid("id").primaryKey().defaultRandom(),
     displayName: varchar("display_name", { length: 255 }),
@@ -165044,6 +165078,15 @@ var init_schema2 = __esm(() => {
     replyToExternalId: varchar("reply_to_external_id", { length: 255 }),
     quotedText: text("quoted_text"),
     quotedSenderName: varchar("quoted_sender_name", { length: 255 }),
+    threadExternalId: varchar("thread_external_id", { length: 255 }),
+    threadRootMessageId: uuid("thread_root_message_id"),
+    isThreadBroadcast: boolean("is_thread_broadcast").notNull().default(false),
+    replyCount: integer("reply_count").notNull().default(0),
+    latestReplyAt: timestamp("latest_reply_at", { withTimezone: true }),
+    permalink: text("permalink"),
+    pinnedAt: timestamp("pinned_at", { withTimezone: true }),
+    pinnedBy: varchar("pinned_by", { length: 255 }),
+    starredAt: timestamp("starred_at", { withTimezone: true }),
     forwardedFromMessageId: uuid("forwarded_from_message_id"),
     forwardedFromExternalId: varchar("forwarded_from_external_id", { length: 255 }),
     forwardCount: integer("forward_count").notNull().default(0),
@@ -165081,6 +165124,8 @@ var init_schema2 = __esm(() => {
     platformTimestampIdx: index("messages_platform_timestamp_idx").on(table3.platformTimestamp),
     replyToIdx: index("messages_reply_to_idx").on(table3.replyToMessageId),
     replyToExternalIdx: index("messages_reply_to_external_idx").on(table3.chatId, table3.replyToExternalId, table3.isFromMe),
+    threadExternalIdx: index("messages_thread_external_idx").on(table3.chatId, table3.threadExternalId, table3.platformTimestamp),
+    threadRootIdx: index("messages_thread_root_idx").on(table3.threadRootMessageId),
     hasMediaIdx: index("messages_has_media_idx").on(table3.hasMedia),
     originalEventIdx: index("messages_original_event_idx").on(table3.originalEventId)
   }));
@@ -169982,6 +170027,9 @@ __export(exports_src3, {
   settingChangeHistoryRelations: () => settingChangeHistoryRelations,
   settingChangeHistory: () => settingChangeHistory,
   scrubDdlCredential: () => scrubDdlCredential,
+  scheduledMessages: () => scheduledMessages,
+  scheduledMessageStatuses: () => scheduledMessageStatuses,
+  scheduledMessageDeliveryModes: () => scheduledMessageDeliveryModes,
   ruleTypes: () => ruleTypes,
   roleAttributeViolations: () => roleAttributeViolations,
   revertTenantRlsEnforcement: () => revertTenantRlsEnforcement,
@@ -171390,6 +171438,7 @@ var init_plugin = __esm(() => {
           type: content.type,
           text: content.text ?? content.caption,
           mediaUrl: content.mediaUrl,
+          mediaId: content.mediaId,
           mimeType: content.mimeType,
           isVoiceNote: content.isVoiceNote
         },
@@ -242836,7 +242885,7 @@ var init_sentry_scrub = __esm(() => {
 var require_package7 = __commonJS((exports, module) => {
   module.exports = {
     name: "@omni/api",
-    version: "2.260804.3",
+    version: "2.260830.2",
     type: "module",
     exports: {
       ".": {
@@ -278805,7 +278854,7 @@ var require_channelz = __commonJS((exports) => {
     return (0, net_1.isIPv6)(ipAddress) && ipAddress.toLowerCase().startsWith("::ffff:") && (0, net_1.isIPv4)(ipAddress.substring(7));
   }
   function ipv4AddressStringToBuffer(ipAddress) {
-    return Buffer.from(Uint8Array.from(ipAddress.split(".").map((segment) => Number.parseInt(segment))));
+    return Buffer.from(Uint8Array.from(ipAddress.split(".").map((segment2) => Number.parseInt(segment2))));
   }
   function ipAddressStringToBuffer(ipAddress) {
     if ((0, net_1.isIPv4)(ipAddress)) {
@@ -289942,21 +289991,21 @@ var splitPath2 = (path2) => {
   const segments = path2.split("/");
   const results = [];
   let basePath = "";
-  segments.forEach((segment) => {
-    if (segment !== "" && !/\:/.test(segment)) {
-      basePath += "/" + segment;
-    } else if (/\:/.test(segment)) {
-      if (/\?/.test(segment)) {
+  segments.forEach((segment2) => {
+    if (segment2 !== "" && !/\:/.test(segment2)) {
+      basePath += "/" + segment2;
+    } else if (/\:/.test(segment2)) {
+      if (/\?/.test(segment2)) {
         if (results.length === 0 && basePath === "") {
           results.push("/");
         } else {
           results.push(basePath);
         }
-        const optionalSegment = segment.replace("?", "");
+        const optionalSegment = segment2.replace("?", "");
         basePath += "/" + optionalSegment;
         results.push(basePath);
       } else {
-        basePath += "/" + segment;
+        basePath += "/" + segment2;
       }
     }
   });
@@ -291488,11 +291537,11 @@ var defaultJoin = (...paths) => {
   result = result.replace(/(?<=\/)\/+/g, "");
   const segments = result.split("/");
   const resolved = [];
-  for (const segment of segments) {
-    if (segment === ".." && resolved.length > 0 && resolved.at(-1) !== "..") {
+  for (const segment2 of segments) {
+    if (segment2 === ".." && resolved.length > 0 && resolved.at(-1) !== "..") {
       resolved.pop();
-    } else if (segment !== ".") {
-      resolved.push(segment);
+    } else if (segment2 !== ".") {
+      resolved.push(segment2);
     }
   }
   return resolved.join("/") || ".";
@@ -293281,9 +293330,13 @@ var init_profiles = __esm(() => {
 });
 
 // ../api/src/middleware/output-redactor.ts
+import { createHash as createHash12 } from "crypto";
 function escapeRegex(literal) {
   return literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+function hashPattern(source) {
+  return createHash12("sha256").update(source).digest("hex").slice(0, 12);
+}
 function compilePatterns(literals) {
   const out = [];
   for (const literal of literals) {
@@ -293453,7 +293506,7 @@ async function emitRedactionEvents(c, apiKey, presetKey, hits) {
         keyId: apiKey.id,
         profile: apiKey.profile ?? null,
         presetKey,
-        pattern: hit.pattern,
+        patternHash: hashPattern(hit.pattern),
         field: hit.field,
         count: hit.count,
         route: c.req.path,
@@ -293462,7 +293515,7 @@ async function emitRedactionEvents(c, apiKey, presetKey, hits) {
     } catch (err2) {
       log60.warn("output-redactor: failed to publish secret.redacted", {
         keyId: apiKey.id,
-        pattern: hit.pattern,
+        patternHash: hashPattern(hit.pattern),
         error: String(err2)
       });
     }
@@ -293653,6 +293706,9 @@ var init_scopes = __esm(() => {
     "GET /instances/:id/status": "instances:read",
     "GET /instances/:id/qr": "instances:read",
     "POST /instances/:id/pair": "instances:write",
+    "GET /instances/:id/passkey": "instances:read",
+    "POST /instances/:id/passkey/response": "instances:write",
+    "POST /instances/:id/passkey/confirm": "instances:write",
     "POST /instances/:id/connect": "instances:write",
     "POST /instances/:id/disconnect": "instances:write",
     "POST /instances/:id/restart": "instances:write",
@@ -294377,17 +294433,18 @@ var init_route_ownership = __esm(() => {
     "DELETE /api/v2/follow-up/chats/:id",
     "DELETE /api/v2/follow-up/instances/:id",
     "DELETE /api/v2/instances/:id",
-    "DELETE /api/v2/instances/:id/whatsapp-flows/:flowId",
     "DELETE /api/v2/instances/:id/block",
     "DELETE /api/v2/instances/:id/guilds/:guildId/config",
     "DELETE /api/v2/instances/:id/profile/picture",
     "DELETE /api/v2/instances/:id/whatsapp-business/connection",
+    "DELETE /api/v2/instances/:id/whatsapp-flows/:flowId",
     "DELETE /api/v2/instances/:id/whatsapp-templates/:templateId",
     "DELETE /api/v2/instances/:instanceId/routes/:id",
     "DELETE /api/v2/messages/:id",
     "DELETE /api/v2/messages/:id/reactions",
     "DELETE /api/v2/messages/:id/star",
     "DELETE /api/v2/providers/:id",
+    "DELETE /api/v2/scheduled-messages/:id",
     "DELETE /api/v2/settings/:key",
     "DELETE /api/v2/webhook-sources/:id",
     "GET /api/v2",
@@ -294456,6 +294513,7 @@ var init_route_ownership = __esm(() => {
     "GET /api/v2/instances/:id/guilds/:guildId/audit",
     "GET /api/v2/instances/:id/guilds/:guildId/config",
     "GET /api/v2/instances/:id/pairing-requests",
+    "GET /api/v2/instances/:id/passkey",
     "GET /api/v2/instances/:id/privacy",
     "GET /api/v2/instances/:id/qr",
     "GET /api/v2/instances/:id/status",
@@ -294480,6 +294538,7 @@ var init_route_ownership = __esm(() => {
     "GET /api/v2/media/:instanceId/*",
     "GET /api/v2/messages",
     "GET /api/v2/messages/:id",
+    "GET /api/v2/messages/:id/permalink",
     "GET /api/v2/messages/by-external",
     "GET /api/v2/messages/tts/voices",
     "GET /api/v2/payload-config",
@@ -294495,9 +294554,12 @@ var init_route_ownership = __esm(() => {
     "GET /api/v2/providers/:id/teams",
     "GET /api/v2/providers/:id/workflows",
     "GET /api/v2/routes/metrics",
+    "GET /api/v2/scheduled-messages",
+    "GET /api/v2/scheduled-messages/:id",
     "GET /api/v2/settings",
     "GET /api/v2/settings/:key",
     "GET /api/v2/settings/:key/history",
+    "GET /api/v2/slack/search",
     "GET /api/v2/turns",
     "GET /api/v2/turns/:id",
     "GET /api/v2/turns/stats",
@@ -294589,6 +294651,8 @@ var init_route_ownership = __esm(() => {
     "POST /api/v2/instances/:id/groups/join",
     "POST /api/v2/instances/:id/logout",
     "POST /api/v2/instances/:id/pair",
+    "POST /api/v2/instances/:id/passkey/confirm",
+    "POST /api/v2/instances/:id/passkey/response",
     "POST /api/v2/instances/:id/pairing-requests/:requestId/action",
     "POST /api/v2/instances/:id/replay",
     "POST /api/v2/instances/:id/restart",
@@ -294643,6 +294707,8 @@ var init_route_ownership = __esm(() => {
     "POST /api/v2/persons/unlink",
     "POST /api/v2/providers",
     "POST /api/v2/providers/:id/health",
+    "POST /api/v2/scheduled-messages",
+    "POST /api/v2/slack/dm/open",
     "POST /api/v2/turns/:id/close",
     "POST /api/v2/turns/close",
     "POST /api/v2/turns/close-all",
@@ -294661,9 +294727,9 @@ var init_route_ownership = __esm(() => {
     "PUT /api/v2/instances/:id/presence",
     "PUT /api/v2/instances/:id/profile/name",
     "PUT /api/v2/instances/:id/profile/picture",
+    "PUT /api/v2/instances/:id/profile/status",
     "PUT /api/v2/instances/:id/whatsapp-business/profile",
     "PUT /api/v2/instances/:id/whatsapp-flows/:flowId",
-    "PUT /api/v2/instances/:id/profile/status",
     "PUT /api/v2/payload-config/:eventType",
     "PUT /api/v2/settings/:key"
   ];
@@ -316521,10 +316587,10 @@ var import_p_retry, import_google_auth_library, _defaultBaseGeminiUrl = undefine
   invalidSegments.sort((a, b3) => a.start - b3.start);
   if (invalidSegments.length > 0) {
     let lastEnd = 0;
-    const underline = invalidSegments.reduce((acc, segment) => {
-      const spaces = " ".repeat(segment.start - lastEnd);
-      const arrows = "^".repeat(segment.length);
-      lastEnd = segment.start + segment.length;
+    const underline = invalidSegments.reduce((acc, segment2) => {
+      const spaces = " ".repeat(segment2.start - lastEnd);
+      const arrows = "^".repeat(segment2.length);
+      lastEnd = segment2.start + segment2.length;
       return acc + spaces + arrows;
     }, "");
     throw new GeminiNextGenAPIClientError(`Path parameters result in path with invalid segments:
@@ -322500,10 +322566,10 @@ function extractSegments(buffer3) {
     const splitIndex = remaining.indexOf(`
 
 `);
-    const segment = remaining.slice(0, splitIndex).trim();
+    const segment2 = remaining.slice(0, splitIndex).trim();
     remaining = remaining.slice(splitIndex + 2);
-    if (segment)
-      segments.push(segment);
+    if (segment2)
+      segments.push(segment2);
   }
   return [segments, remaining];
 }
@@ -322518,8 +322584,8 @@ async function* processStreamChunks(streamGenerator, enableSplit) {
 `)) {
       const [segments, remaining] = extractSegments(buffer3);
       buffer3 = remaining;
-      for (const segment of segments) {
-        yield segment;
+      for (const segment2 of segments) {
+        yield segment2;
       }
     }
     if (chunk2.isComplete && buffer3.trim()) {
@@ -327231,12 +327297,12 @@ var is_array, hex_table, limit = 1024, encode3 = (str, _defaultEncoder, charset,
   }
   let out = "";
   for (let j2 = 0;j2 < string.length; j2 += limit) {
-    const segment = string.length >= limit ? string.slice(j2, j2 + limit) : string;
+    const segment2 = string.length >= limit ? string.slice(j2, j2 + limit) : string;
     const arr = [];
-    for (let i = 0;i < segment.length; ++i) {
-      let c = segment.charCodeAt(i);
+    for (let i = 0;i < segment2.length; ++i) {
+      let c = segment2.charCodeAt(i);
       if (c === 45 || c === 46 || c === 95 || c === 126 || c >= 48 && c <= 57 || c >= 65 && c <= 90 || c >= 97 && c <= 122 || format === RFC1738 && (c === 40 || c === 41)) {
-        arr[arr.length] = segment.charAt(i);
+        arr[arr.length] = segment2.charAt(i);
         continue;
       }
       if (c < 128) {
@@ -327252,7 +327318,7 @@ var is_array, hex_table, limit = 1024, encode3 = (str, _defaultEncoder, charset,
         continue;
       }
       i += 1;
-      c = 65536 + ((c & 1023) << 10 | segment.charCodeAt(i) & 1023);
+      c = 65536 + ((c & 1023) << 10 | segment2.charCodeAt(i) & 1023);
       arr[arr.length] = hex_table[240 | c >> 18] + hex_table[128 | c >> 12 & 63] + hex_table[128 | c >> 6 & 63] + hex_table[128 | c & 63];
     }
     out += arr.join("");
@@ -346313,6 +346379,7 @@ var init_instances = __esm(() => {
   SEALED_CREDENTIAL_COLUMNS = [
     "discordBotToken",
     "slackBotToken",
+    "slackUserToken",
     "slackAppToken",
     "slackSigningSecret",
     "telegramBotToken",
@@ -346468,7 +346535,7 @@ class MessageService {
     return result;
   }
   async hasBotRepliedInThread(chatId, threadExternalId) {
-    const [result] = await this.db.select({ id: messages2.id }).from(messages2).where(and2(eq(messages2.chatId, chatId), eq(messages2.isFromMe, true), or2(eq(messages2.replyToExternalId, threadExternalId), eq(messages2.externalId, threadExternalId)))).limit(1);
+    const [result] = await this.db.select({ id: messages2.id }).from(messages2).where(and2(eq(messages2.chatId, chatId), eq(messages2.isFromMe, true), or2(eq(messages2.threadExternalId, threadExternalId), eq(messages2.replyToExternalId, threadExternalId), eq(messages2.externalId, threadExternalId)))).limit(1);
     return !!result;
   }
   async getByExternalId(chatId, externalId) {
@@ -346557,6 +346624,8 @@ class MessageService {
         quotedSenderName: options.quotedSenderName,
         isForwarded: options.isForwarded ?? false,
         forwardedFromExternalId: options.forwardedFromExternalId,
+        threadExternalId: options.threadExternalId,
+        isThreadBroadcast: options.isThreadBroadcast ?? false,
         rawPayload: options.rawPayload,
         originalEventId: options.originalEventId,
         latestEventId: options.originalEventId
@@ -346760,6 +346829,19 @@ class MessageService {
     const [replyToMessage] = await this.db.select({ id: messages2.id }).from(messages2).where(and2(eq(messages2.chatId, chatId), eq(messages2.externalId, replyToExternalId))).limit(1);
     return replyToMessage?.id ?? null;
   }
+  async setStarred(chatId, externalId, starred) {
+    await this.db.update(messages2).set({ starredAt: starred ? new Date : null, updatedAt: new Date }).where(and2(eq(messages2.chatId, chatId), eq(messages2.externalId, externalId)));
+  }
+  async setPinned(chatId, externalId, pinned, pinnedBy) {
+    await this.db.update(messages2).set({
+      pinnedAt: pinned ? new Date : null,
+      pinnedBy: pinned ? pinnedBy ?? null : null,
+      updatedAt: new Date
+    }).where(and2(eq(messages2.chatId, chatId), eq(messages2.externalId, externalId)));
+  }
+  async setPermalink(chatId, externalId, permalink) {
+    await this.db.update(messages2).set({ permalink, updatedAt: new Date }).where(and2(eq(messages2.chatId, chatId), eq(messages2.externalId, externalId)));
+  }
   async updateReplyToReference(id, replyToMessageId) {
     await this.db.update(messages2).set({ replyToMessageId, updatedAt: new Date }).where(eq(messages2.id, id));
   }
@@ -346941,7 +347023,92 @@ var init_payload_store2 = __esm(() => {
   log97 = createLogger("payload-store");
 });
 
+// ../api/src/utils/phone.ts
+function isValidE164Phone(phone) {
+  const bare = phone.replace(/^\+/, "");
+  if (!/^\d+$/.test(bare))
+    return false;
+  return bare.length >= 7 && bare.length <= 15;
+}
+function isLidFormat(platformUserId) {
+  const bare = platformUserId.split("@")[0] || platformUserId;
+  return /^\d{14,}$/.test(bare);
+}
+function validateContactPhone(phone, platformUserId) {
+  if (!phone)
+    return;
+  if (!isValidE164Phone(phone))
+    return;
+  const barePhone = phone.replace(/^\+/, "");
+  const barePuid = platformUserId.split("@")[0] || platformUserId;
+  if (isLidFormat(platformUserId) && barePhone === barePuid)
+    return;
+  return phone;
+}
+
+// ../api/src/utils/canonical-handle.ts
+function isWhatsAppFamily(channel5) {
+  return WHATSAPP_FAMILY_CHANNELS.has(channel5);
+}
+function isPersonlessChannel(channel5) {
+  return PERSONLESS_CHANNELS.has(channel5);
+}
+function stripProviderPrefix(raw2) {
+  return raw2.replace(/^whatsapp:/i, "").trim();
+}
+function stripDeviceSuffix2(local) {
+  const colon = local.indexOf(":");
+  return colon === -1 ? local : local.slice(0, colon);
+}
+function canonicalizeHandle(channel5, rawUserId) {
+  if (!rawUserId)
+    return { platformUserId: rawUserId };
+  if (!isWhatsAppFamily(channel5))
+    return { platformUserId: rawUserId };
+  const stripped = stripProviderPrefix(rawUserId);
+  const atIndex = stripped.indexOf("@");
+  const suffix = atIndex === -1 ? "" : stripped.slice(atIndex);
+  const localRaw = atIndex === -1 ? stripped : stripped.slice(0, atIndex);
+  if (suffix === "@lid") {
+    return { platformUserId: `${stripDeviceSuffix2(localRaw)}@lid` };
+  }
+  if (suffix === "@g.us" || suffix === "@broadcast" || suffix === "@newsletter") {
+    return { platformUserId: stripped };
+  }
+  const digits = stripDeviceSuffix2(localRaw).replace(/^\+/, "");
+  if (isValidE164Phone(digits)) {
+    return { platformUserId: `${digits}${WA_PHONE_SUFFIX}`, phone: `+${digits}` };
+  }
+  return { platformUserId: rawUserId };
+}
+var WHATSAPP_FAMILY_CHANNELS, PERSONLESS_CHANNELS, WA_PHONE_SUFFIX = "@s.whatsapp.net";
+var init_canonical_handle = __esm(() => {
+  WHATSAPP_FAMILY_CHANNELS = new Set([
+    "whatsapp-baileys",
+    "whatsapp-business",
+    "twilio-whatsapp",
+    "gupshup",
+    "hermes"
+  ]);
+  PERSONLESS_CHANNELS = new Set(["internal", "a2a"]);
+});
+
 // ../api/src/services/persons.ts
+function canonicalizeIdentityInput(rawData, rawLinkOptions) {
+  const data = {
+    ...rawData,
+    platformUserId: canonicalizeHandle(rawData.channel, rawData.platformUserId).platformUserId
+  };
+  if (rawLinkOptions?.matchByPlatformUserId === undefined) {
+    return { data, linkOptions: rawLinkOptions };
+  }
+  const linkOptions = {
+    ...rawLinkOptions,
+    matchByPlatformUserId: canonicalizeHandle(rawData.channel, rawLinkOptions.matchByPlatformUserId).platformUserId
+  };
+  return { data, linkOptions };
+}
+
 class PersonService {
   pool;
   eventBus;
@@ -347034,8 +347201,8 @@ class PersonService {
     `);
     return result;
   }
-  async getById(id) {
-    const [result] = await this.db.select().from(persons).where(eq(persons.id, id)).limit(1);
+  async getById(id, handle = this.db) {
+    const [result] = await handle.select().from(persons).where(eq(persons.id, id)).limit(1);
     if (!result) {
       throw new NotFoundError("Person", id);
     }
@@ -347101,8 +347268,8 @@ class PersonService {
     const [mapping] = await this.db.select({ phoneId: chatIdMappings.phoneId }).from(chatIdMappings).where(and2(eq(chatIdMappings.instanceId, instanceId), eq(chatIdMappings.lidId, lidId))).limit(1);
     return mapping?.phoneId ?? null;
   }
-  async findPersonByPhone(phone) {
-    const [existing] = await this.db.select().from(persons).where(eq(persons.primaryPhone, phone)).limit(1);
+  async findPersonByPhone(phone, handle = this.db) {
+    const [existing] = await handle.select().from(persons).where(eq(persons.primaryPhone, phone)).limit(1);
     return existing ? { personId: existing.id, wasLinked: true } : null;
   }
   async findPersonToLink(linkOptions) {
@@ -347135,9 +347302,9 @@ class PersonService {
       return { wasLinked: false };
     return this.createPersonWithConflictHandling(linkOptions);
   }
-  async createPersonWithConflictHandling(linkOptions) {
+  async createPersonWithConflictHandling(linkOptions, handle = this.db) {
     try {
-      const [newPerson] = await this.db.insert(persons).values({
+      const [newPerson] = await handle.insert(persons).values({
         displayName: linkOptions.displayName,
         primaryPhone: linkOptions.matchByPhone,
         primaryEmail: linkOptions.matchByEmail
@@ -347145,17 +347312,17 @@ class PersonService {
       if (newPerson)
         return { personId: newPerson.id, wasLinked: false };
       if (linkOptions.matchByPhone) {
-        return await this.findPersonByPhone(linkOptions.matchByPhone) ?? { wasLinked: false };
+        return await this.findPersonByPhone(linkOptions.matchByPhone, handle) ?? { wasLinked: false };
       }
     } catch {
       if (linkOptions.matchByPhone) {
-        return await this.findPersonByPhone(linkOptions.matchByPhone) ?? { wasLinked: false };
+        return await this.findPersonByPhone(linkOptions.matchByPhone, handle) ?? { wasLinked: false };
       }
     }
     return { wasLinked: false };
   }
-  async updateExistingIdentity(existing, data) {
-    const [updated] = await this.db.update(platformIdentities).set({
+  async updateExistingIdentity(existing, data, handle = this.db) {
+    const [updated] = await handle.update(platformIdentities).set({
       platformUsername: data.platformUsername ?? existing.platformUsername,
       profilePicUrl: data.profilePicUrl ?? existing.profilePicUrl,
       profileData: data.profileData ?? existing.profileData,
@@ -347167,23 +347334,24 @@ class PersonService {
     }
     let person2 = null;
     if (updated.personId) {
-      person2 = await this.getById(updated.personId);
+      person2 = await this.getById(updated.personId, handle);
     }
     return { identity: updated, person: person2, isNew: false, wasLinked: false };
   }
-  async findOrCreateIdentity(data, linkOptions) {
-    const instanceId = data.instanceId;
+  async findOrCreateIdentity(rawData, rawLinkOptions) {
+    const instanceId = rawData.instanceId;
     if (!instanceId) {
       throw new Error("instanceId is required");
     }
+    const { data, linkOptions } = canonicalizeIdentityInput(rawData, rawLinkOptions);
     const existing = await this.db.select().from(platformIdentities).where(and2(eq(platformIdentities.channel, data.channel), eq(platformIdentities.instanceId, instanceId), eq(platformIdentities.platformUserId, data.platformUserId))).limit(1);
     if (existing[0]) {
       return this.updateExistingIdentity(existing[0], data);
     }
     let personId = data.personId;
     let wasLinked = false;
+    let resolvedLinkOptions = linkOptions;
     if (!personId && linkOptions) {
-      let resolvedLinkOptions = linkOptions;
       if (!linkOptions.matchByPhone && data.platformUserId.endsWith("@lid") && instanceId) {
         const phoneFromLid = await this.resolvePhoneFromLid(instanceId, data.platformUserId);
         if (phoneFromLid) {
@@ -347191,31 +347359,63 @@ class PersonService {
           resolvedLinkOptions = { ...linkOptions, matchByPhone: phoneNumber };
         }
       }
-      const linkResult = await this.findPersonToLink({ ...resolvedLinkOptions, instanceId });
+      const linkResult = await this.findPersonToLink({ ...resolvedLinkOptions, instanceId, createPerson: false });
       personId = linkResult.personId;
       wasLinked = linkResult.wasLinked;
     }
     const matchType = linkOptions?.matchByPhone ? "phone" : linkOptions?.matchByEmail ? "email" : "platform_id";
     const linkedBy = wasLinked ? `${matchType}_match` : personId ? "initial" : undefined;
     const linkReason = wasLinked ? `Matched by ${matchType}` : undefined;
-    const [created] = await this.db.insert(platformIdentities).values({
-      ...data,
+    const createPersonOptions = !personId && resolvedLinkOptions?.createPerson ? {
+      matchByPhone: resolvedLinkOptions.matchByPhone,
+      matchByEmail: resolvedLinkOptions.matchByEmail,
+      displayName: resolvedLinkOptions.displayName
+    } : undefined;
+    return this.secureIdentity({
+      data,
       personId,
+      wasLinked,
       linkedBy,
+      linkReason,
       confidence: wasLinked ? 90 : 100,
-      linkReason
-    }).returning();
-    if (!created) {
-      throw new Error("Failed to create identity");
-    }
-    let person2 = null;
-    if (personId) {
-      person2 = await this.getById(personId);
-    }
-    return { identity: created, person: person2, isNew: true, wasLinked };
+      createPersonOptions
+    });
+  }
+  async secureIdentity(params) {
+    const { data, personId, wasLinked, linkedBy, linkReason, confidence, createPersonOptions } = params;
+    const { instanceId, channel: channel5, platformUserId } = data;
+    return this.db.transaction(async (tx) => {
+      const txDb = tx;
+      const [inserted] = await txDb.insert(platformIdentities).values({
+        ...data,
+        personId,
+        linkedBy,
+        confidence,
+        linkReason
+      }).onConflictDoNothing().returning();
+      if (!inserted) {
+        const [existing] = await txDb.select().from(platformIdentities).where(and2(eq(platformIdentities.channel, channel5), eq(platformIdentities.instanceId, instanceId ?? ""), eq(platformIdentities.platformUserId, platformUserId))).limit(1);
+        if (!existing) {
+          throw new Error("Failed to resolve identity after conflict");
+        }
+        return this.updateExistingIdentity(existing, data, txDb);
+      }
+      if (inserted.personId || !createPersonOptions) {
+        const person3 = inserted.personId ? await this.getById(inserted.personId, txDb) : null;
+        return { identity: inserted, person: person3, isNew: true, wasLinked };
+      }
+      const created = await this.createPersonWithConflictHandling(createPersonOptions, txDb);
+      if (!created.personId) {
+        return { identity: inserted, person: null, isNew: true, wasLinked };
+      }
+      const [linked] = await txDb.update(platformIdentities).set({ personId: created.personId, linkedBy: "initial", confidence: 100, updatedAt: new Date }).where(eq(platformIdentities.id, inserted.id)).returning();
+      const person2 = await this.getById(created.personId, txDb);
+      return { identity: linked ?? inserted, person: person2, isNew: true, wasLinked: created.wasLinked };
+    });
   }
   async getIdentityByPlatformId(channel5, instanceId, platformUserId) {
-    const [identity] = await this.db.select().from(platformIdentities).where(and2(eq(platformIdentities.channel, channel5), eq(platformIdentities.instanceId, instanceId), eq(platformIdentities.platformUserId, platformUserId))).limit(1);
+    const canonicalUserId = canonicalizeHandle(channel5, platformUserId).platformUserId;
+    const [identity] = await this.db.select().from(platformIdentities).where(and2(eq(platformIdentities.channel, channel5), eq(platformIdentities.instanceId, instanceId), eq(platformIdentities.platformUserId, canonicalUserId))).limit(1);
     return identity || null;
   }
   async listIdentitiesByInstance(instanceId, options = {}) {
@@ -347392,6 +347592,7 @@ var init_persons = __esm(() => {
   init_src5();
   init_drizzle_orm();
   init_tenant_scope();
+  init_canonical_handle();
 });
 
 // ../api/src/lib/agent-key-name.ts
@@ -348363,16 +348564,6 @@ function buildSentChatPreview(payload) {
   const badge = payload.content.type !== "text" ? MEDIA_BADGES2[payload.content.type] ?? `[${payload.content.type}]` : "";
   return badge ? text3 ? `${badge} ${text3}` : badge : text3;
 }
-function extractPhoneFromSender(senderId, channel5) {
-  if (!channel5.startsWith("whatsapp"))
-    return;
-  const bare = senderId.split("@")[0] || senderId;
-  if (!/^\d+$/.test(bare))
-    return;
-  if (bare.length < 7 || bare.length > 15)
-    return;
-  return `+${bare}`;
-}
 async function processSenderIdentity(services, payload, metadata, channel5, trustedTenantId) {
   if (metadata.platformIdentityId) {
     return { personId: metadata.personId, platformIdentityId: metadata.platformIdentityId };
@@ -348380,11 +348571,15 @@ async function processSenderIdentity(services, payload, metadata, channel5, trus
   if (!payload.from) {
     return { personId: metadata.personId, platformIdentityId: undefined };
   }
+  if (isPersonlessChannel(channel5)) {
+    return { personId: metadata.personId, platformIdentityId: metadata.platformIdentityId };
+  }
   const displayName = truncate4(payload.senderName ?? payload.rawPayload?.pushName, 255);
-  const platformUserId = truncate4(payload.from, 255) ?? payload.from;
+  const canonical = canonicalizeHandle(channel5, payload.from);
+  const platformUserId = truncate4(canonical.platformUserId, 255) ?? canonical.platformUserId;
   const isLidAddressed = payload.rawPayload?.addressingMode === "lid" || payload.rawPayload?.senderIsLid === true;
   const resolvedPhone = isLidAddressed ? payload.rawPayload?.resolvedSenderPhone : undefined;
-  const phoneNumber = isLidAddressed ? resolvedPhone ? `+${resolvedPhone}` : undefined : extractPhoneFromSender(platformUserId, channel5);
+  const phoneNumber = isLidAddressed ? resolvedPhone ? `+${resolvedPhone}` : undefined : canonical.phone;
   const { identity, person: person2, isNew } = await services.persons.findOrCreateIdentity({ channel: channel5, instanceId: metadata.instanceId, platformUserId, platformUsername: displayName }, {
     createPerson: true,
     displayName,
@@ -348559,6 +348754,22 @@ async function resolveOrCreateChat(services, instanceId, chatExternalId, chatTyp
     canonicalId
   });
 }
+async function linkReplyTarget(services, chatId, messageId, replyToExternalId) {
+  if (!replyToExternalId)
+    return;
+  try {
+    const replyToMessageId = await services.messages.resolveReplyToMessage(chatId, replyToExternalId);
+    if (replyToMessageId) {
+      await services.messages.updateReplyToReference(messageId, replyToMessageId);
+    }
+  } catch (error3) {
+    log103.debug("Could not resolve reply target", {
+      chatId,
+      replyToExternalId,
+      error: error3 instanceof Error ? error3.message : String(error3)
+    });
+  }
+}
 async function handleMessageReceived(services, payload, metadata, eventTimestamp, trustedTenantId, identity) {
   const channel5 = metadata.channelType ?? "whatsapp";
   const isHistorySync = metadata.ingestMode === "history-sync";
@@ -348602,12 +348813,15 @@ async function handleMessageReceived(services, payload, metadata, eventTimestamp
     replyToExternalId: truncate4(payload.replyToId, 255),
     quotedText: quotedMessage?.conversation,
     quotedSenderName: truncate4(quotedMessage?.pushName, 255),
+    threadExternalId: truncate4(payload.threadId, 255),
+    isThreadBroadcast: rawPayload?.isThreadBroadcast === true,
     isForwarded: !!(rawPayload?.isForwarded || rawPayload?.forwardingScore),
     rawPayload
   });
   await maybeRecordMessageEdit(services, created, rawPayload, message2.id, sanitizeText(payload.content.text) ?? undefined, platformTimestamp ?? new Date(eventTimestamp), payload.from);
   if (created) {
     log103.debug("Created message", { externalId: payload.externalId, chatId: chat2.id });
+    await linkReplyTarget(services, chat2.id, message2.id, payload.replyToId);
   }
   await maybeRecordParticipantActivity(services, chat2.id, payload.from);
   maybeUpdateRecency(services, metadata.instanceId, chat2.id, rawPayload, payload, platformTimestamp ?? new Date(eventTimestamp), trustedTenantId);
@@ -348705,7 +348919,8 @@ async function setupMessagePersistence(eventBus, services) {
             mediaLocalPath: sentContent.mediaLocalPath,
             mediaMetadata: sentContent.mediaMetadata,
             rawPayload: sentContent.rawPayload,
-            replyToExternalId: truncate4(payload.replyToId, 255)
+            replyToExternalId: truncate4(payload.replyToId, 255),
+            threadExternalId: truncate4(payload.threadId, 255)
           });
           return { chat: chat3, message: message3, created: created2 };
         });
@@ -348903,6 +349118,7 @@ var init_message_persistence = __esm(() => {
   init_esm5();
   init_sentry_scrub();
   init_worker_tenant_context();
+  init_canonical_handle();
   init_loader2();
   log103 = createLogger("message-persistence");
   CONTENT_TYPE_MAP = {
@@ -349038,12 +349254,12 @@ var init_session_storage = __esm(() => {
 });
 
 // ../api/src/plugins/agent-dispatcher.ts
-import { createHash as createHash12 } from "crypto";
+import { createHash as createHash13 } from "crypto";
 import { unlink, writeFile as writeFile5 } from "fs/promises";
 import { tmpdir as tmpdir12 } from "os";
 import { join as join22, resolve as resolve3 } from "path";
 function sha256Digest(value) {
-  return `sha256:${createHash12("sha256").update(value).digest("hex")}`;
+  return `sha256:${createHash13("sha256").update(value).digest("hex")}`;
 }
 function redactLifecycleText(value) {
   return value.replace(/[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/gi, "[EMAIL]").replace(/\b\+?\d[\d\s().-]{5,}\d\b/g, "[PHONE]").replace(/\b\d{6,}\b/g, "[NUMBER]").replace(/\b[^\s@]+@(s\.whatsapp\.net|g\.us|lid|newsletter)\b/gi, "[JID]");
@@ -365905,6 +366121,10 @@ function sanitizeInstance(instance4) {
 function applySlackProfileMetadata(opts, metadata) {
   if (!metadata)
     return;
+  if (metadata.mode)
+    opts.mode = metadata.mode;
+  if (metadata.httpPort)
+    opts.httpPort = metadata.httpPort;
   if (metadata.replyToMode)
     opts.replyToMode = metadata.replyToMode;
   if (metadata.streamMode)
@@ -365918,6 +366138,12 @@ function applySlackConnectOptions(opts, instance4, overrides) {
   const botToken = overrides?.slackBotToken ?? instance4.slackBotToken ?? opts.token;
   if (botToken)
     opts.botToken = botToken;
+  const userToken = overrides?.slackUserToken ?? instance4.slackUserToken;
+  if (userToken)
+    opts.userToken = userToken;
+  const authMode = overrides?.slackAuthMode ?? instance4.slackAuthMode;
+  if (authMode)
+    opts.authMode = authMode;
   const appToken = overrides?.slackAppToken ?? instance4.slackAppToken;
   if (appToken)
     opts.appToken = appToken;
@@ -365942,8 +366168,13 @@ function applyTelegramConnectionOptions(options, input) {
   options.telegramReactionLevel = input.telegramReactionLevel;
 }
 function applySlackConnectionOptions(options, input) {
+  applySlackProfileMetadata(options, input.profileMetadata);
   if (input.token)
     options.botToken = input.token;
+  if (input.slackUserToken)
+    options.userToken = input.slackUserToken;
+  if (input.slackAuthMode)
+    options.authMode = input.slackAuthMode;
   if (input.slackAppToken)
     options.appToken = input.slackAppToken;
   if (input.slackSigningSecret)
@@ -366054,6 +366285,10 @@ function buildTokenPersistUpdates(channel5, body) {
   if (channel5 === "slack") {
     if (body.slackBotToken)
       updates.slackBotToken = body.slackBotToken;
+    if (body.slackUserToken)
+      updates.slackUserToken = body.slackUserToken;
+    if (body.slackAuthMode)
+      updates.slackAuthMode = body.slackAuthMode;
     if (body.slackAppToken)
       updates.slackAppToken = body.slackAppToken;
     if (body.slackSigningSecret)
@@ -366113,6 +366348,9 @@ async function handleAgentKeyProvisioning(services, instanceId, newAgentId, oldA
     }
   }
 }
+function supportsPasskey(plugin10) {
+  return "getPasskeyState" in plugin10 && "submitPasskeyResponse" in plugin10 && "confirmPasskey" in plugin10;
+}
 function buildConnectConnectionOptions(instance4, body, forceNewQr) {
   const connectToken = body.token ?? persistedTokenForChannel(instance4);
   return buildInstanceConnectionOptions({
@@ -366120,8 +366358,11 @@ function buildConnectConnectionOptions(instance4, body, forceNewQr) {
     forceNewQr,
     token: connectToken,
     telegramReactionLevel: instance4.telegramReactionLevel,
+    slackUserToken: body.slackUserToken ?? instance4.slackUserToken,
+    slackAuthMode: body.slackAuthMode ?? instance4.slackAuthMode,
     slackAppToken: body.slackAppToken ?? instance4.slackAppToken,
     slackSigningSecret: body.slackSigningSecret ?? instance4.slackSigningSecret,
+    profileMetadata: instance4.profileMetadata,
     whatsapp: body.whatsapp,
     gupshupCallbackUrl: instance4.gupshupCallbackUrl,
     gupshupAuthToken: instance4.gupshupAuthToken,
@@ -366279,7 +366520,7 @@ function getCacheKey(instanceId, guildId) {
 function invalidateGuildCache(instanceId, guildId) {
   guildConfigCache.delete(getCacheKey(instanceId, guildId));
 }
-var log115, instancesRoutes, instanceAccess2, listQuerySchema12, agentReplyFilterSchema, createInstanceSchema, updateInstanceSchema, DEFAULT_AGENT_REPLY_FILTER, SENSITIVE_INSTANCE_FIELDS, pairingCodeSchema, connectInstanceSchema, syncRequestSchema, listContactsQuerySchema, listGroupsQuerySchema, checkNumberSchema, updateBioSchema, blockContactSchema, groupParticipantActionSchema, groupSettingSchema, groupParticipantsSchema, groupParticipantsPatchSchema, updateGroupSubjectSchema, updateGroupDescriptionSchema, updateGroupSettingsSchema, patchGroupSchema, resyncSchema, replaySchema, pairingActionSchema, guildConfigOverrideSchema, guildConfigCache, GUILD_CONFIG_TTL, presenceSchema;
+var log115, instancesRoutes, instanceAccess2, listQuerySchema12, agentReplyFilterSchema, createInstanceSchema, updateInstanceSchema, DEFAULT_AGENT_REPLY_FILTER, SENSITIVE_INSTANCE_FIELDS, pairingCodeSchema, passkeyBase64UrlSchema, passkeyCredentialSchema, connectInstanceSchema, syncRequestSchema, listContactsQuerySchema, listGroupsQuerySchema, checkNumberSchema, updateBioSchema, blockContactSchema, groupParticipantActionSchema, groupSettingSchema, groupParticipantsSchema, groupParticipantsPatchSchema, updateGroupSubjectSchema, updateGroupDescriptionSchema, updateGroupSettingsSchema, patchGroupSchema, resyncSchema, replaySchema, pairingActionSchema, guildConfigOverrideSchema, guildConfigCache, GUILD_CONFIG_TTL, presenceSchema;
 var init_instances3 = __esm(() => {
   init_dist6();
   init_src();
@@ -366346,6 +366587,8 @@ var init_instances3 = __esm(() => {
     agentGatePrompt: exports_external.string().nullable().default(null).describe("Custom prompt for response gate (null = use default)"),
     telegramBotToken: exports_external.string().optional().nullable().describe("Telegram bot token (persisted for reconnection)"),
     discordBotToken: exports_external.string().optional().nullable().describe("Discord bot token (persisted for reconnection)"),
+    slackUserToken: exports_external.string().optional().nullable().describe("Slack user token xoxp (required when slackAuthMode is user)"),
+    slackAuthMode: exports_external.enum(["bot", "user"]).optional().nullable().describe("Slack identity for outbound actions"),
     slackBotToken: exports_external.string().optional().nullable().describe("Slack bot token (persisted for reconnection)"),
     slackAppToken: exports_external.string().optional().nullable().describe("Slack app token (persisted for reconnection)"),
     slackSigningSecret: exports_external.string().optional().nullable().describe("Slack signing secret (persisted for reconnection)"),
@@ -366377,6 +366620,7 @@ var init_instances3 = __esm(() => {
     allowFirstParty: exports_external.boolean().default(false).describe(`When true, this instance processes (does not drop) inbound messages whose sender matches another active instance owner. Lets an "assistant" instance reply to messages from the operator's own personal number. Default: false (loop-protection drop).`)
   });
   updateInstanceSchema = createInstanceSchema.partial().extend({
+    profileMetadata: exports_external.record(exports_external.unknown()).nullable().optional(),
     agentId: exports_external.string().uuid().nullable().optional(),
     agentErrorMessages: exports_external.array(exports_external.string()).nullable().optional(),
     agentReplyFilter: agentReplyFilterSchema.nullable().optional(),
@@ -366384,6 +366628,8 @@ var init_instances3 = __esm(() => {
     telegramBotToken: exports_external.string().nullable().optional(),
     discordBotToken: exports_external.string().nullable().optional(),
     slackBotToken: exports_external.string().nullable().optional(),
+    slackUserToken: exports_external.string().nullable().optional(),
+    slackAuthMode: exports_external.enum(["bot", "user"]).nullable().optional(),
     slackAppToken: exports_external.string().nullable().optional(),
     gupshupCallbackUrl: exports_external.string().nullable().optional(),
     gupshupAuthToken: exports_external.string().nullable().optional(),
@@ -366418,6 +366664,7 @@ var init_instances3 = __esm(() => {
     "telegramBotToken",
     "discordBotToken",
     "slackBotToken",
+    "slackUserToken",
     "slackAppToken",
     "slackSigningSecret",
     "gupshupAuthToken",
@@ -366509,8 +366756,11 @@ var init_instances3 = __esm(() => {
       forceNewQr: true,
       token: connectToken,
       telegramReactionLevel: instance4.telegramReactionLevel,
+      slackUserToken: instance4.slackUserToken,
+      slackAuthMode: instance4.slackAuthMode,
       slackAppToken: instance4.slackAppToken,
       slackSigningSecret: instance4.slackSigningSecret,
+      profileMetadata: instance4.profileMetadata,
       gupshupCallbackUrl: instance4.gupshupCallbackUrl,
       gupshupAuthToken: instance4.gupshupAuthToken,
       gupshupEventId: instance4.gupshupEventId,
@@ -366656,6 +366906,18 @@ var init_instances3 = __esm(() => {
   pairingCodeSchema = exports_external.object({
     phoneNumber: exports_external.string().min(10).max(20).describe("Phone number in international format (e.g., +5511999999999)")
   });
+  passkeyBase64UrlSchema = exports_external.string().min(1).regex(/^[A-Za-z0-9_-]+$/);
+  passkeyCredentialSchema = exports_external.object({
+    id: passkeyBase64UrlSchema,
+    rawId: passkeyBase64UrlSchema,
+    type: exports_external.literal("public-key"),
+    response: exports_external.object({
+      clientDataJSON: passkeyBase64UrlSchema,
+      authenticatorData: passkeyBase64UrlSchema,
+      signature: passkeyBase64UrlSchema,
+      userHandle: passkeyBase64UrlSchema.nullable()
+    })
+  });
   instancesRoutes.post("/:id/pair", instanceAccess2, zValidator("json", pairingCodeSchema), async (c) => {
     const id = c.req.param("id");
     const { phoneNumber } = c.req.valid("json");
@@ -366691,9 +366953,59 @@ var init_instances3 = __esm(() => {
       return c.json({ error: { code: "PAIRING_FAILED", message: message2 } }, 500);
     }
   });
+  instancesRoutes.get("/:id/passkey", instanceAccess2, async (c) => {
+    const id = c.req.param("id");
+    const services = c.get("services");
+    const channelRegistry2 = c.get("channelRegistry");
+    const instance4 = await services.instances.getById(id);
+    if (!instance4.channel.startsWith("whatsapp")) {
+      return c.json({ error: { code: "INVALID_OPERATION", message: "Passkey is only available for WhatsApp." } }, 400);
+    }
+    const plugin10 = channelRegistry2?.get(instance4.channel);
+    if (!plugin10 || !supportsPasskey(plugin10)) {
+      return c.json({ error: { code: "NOT_SUPPORTED", message: "This WhatsApp connector does not support passkey." } }, 400);
+    }
+    return c.json({ data: plugin10.getPasskeyState(id) });
+  });
+  instancesRoutes.post("/:id/passkey/response", instanceAccess2, zValidator("json", passkeyCredentialSchema), async (c) => {
+    const id = c.req.param("id");
+    const services = c.get("services");
+    const channelRegistry2 = c.get("channelRegistry");
+    const instance4 = await services.instances.getById(id);
+    const plugin10 = channelRegistry2?.get(instance4.channel);
+    if (!instance4.channel.startsWith("whatsapp") || !plugin10 || !supportsPasskey(plugin10)) {
+      return c.json({ error: { code: "NOT_SUPPORTED", message: "Passkey is not available for this instance." } }, 400);
+    }
+    try {
+      await plugin10.submitPasskeyResponse(id, c.req.valid("json"));
+      return c.json({ data: { status: "submitted" } });
+    } catch (error3) {
+      const message2 = error3 instanceof Error ? error3.message : "Unable to submit passkey response.";
+      return c.json({ error: { code: "PASSKEY_FAILED", message: message2 } }, 500);
+    }
+  });
+  instancesRoutes.post("/:id/passkey/confirm", instanceAccess2, async (c) => {
+    const id = c.req.param("id");
+    const services = c.get("services");
+    const channelRegistry2 = c.get("channelRegistry");
+    const instance4 = await services.instances.getById(id);
+    const plugin10 = channelRegistry2?.get(instance4.channel);
+    if (!instance4.channel.startsWith("whatsapp") || !plugin10 || !supportsPasskey(plugin10)) {
+      return c.json({ error: { code: "NOT_SUPPORTED", message: "Passkey is not available for this instance." } }, 400);
+    }
+    try {
+      await plugin10.confirmPasskey(id);
+      return c.json({ data: { status: "confirmed" } });
+    } catch (error3) {
+      const message2 = error3 instanceof Error ? error3.message : "Unable to confirm passkey pairing.";
+      return c.json({ error: { code: "PASSKEY_FAILED", message: message2 } }, 500);
+    }
+  });
   connectInstanceSchema = exports_external.object({
     token: exports_external.string().optional().describe("Bot token for Discord/Telegram instances"),
     slackBotToken: exports_external.string().optional().describe("Slack bot token (xoxb-...)"),
+    slackUserToken: exports_external.string().optional().describe("Slack user token (xoxp-...), for authMode user"),
+    slackAuthMode: exports_external.enum(["bot", "user"]).optional().describe("Act as the bot (default) or as the authorizing user"),
     slackAppToken: exports_external.string().optional().describe("Slack app-level token (xapp-...)"),
     slackSigningSecret: exports_external.string().optional().describe("Slack signing secret"),
     forceNewQr: exports_external.boolean().optional().describe("Force new QR code for WhatsApp (re-authentication)"),
@@ -366787,11 +367099,6 @@ var init_instances3 = __esm(() => {
         restartOptions.token = restartToken;
       if (instance4.channel === "telegram") {
         restartOptions.telegramReactionLevel = instance4.telegramReactionLevel;
-      } else if (instance4.channel === "slack") {
-        if (restartToken)
-          restartOptions.botToken = restartToken;
-        if (instance4.slackAppToken)
-          restartOptions.appToken = instance4.slackAppToken;
       }
       if (instance4.channel === "slack") {
         applySlackConnectOptions(restartOptions, instance4);
@@ -369496,8 +369803,8 @@ var init_media2 = __esm(() => {
       return c.json({ error: { code: "INVALID_PATH", message: "No path specified" } }, 400);
     }
     const pathSegments = path3.split("/");
-    for (const segment of pathSegments) {
-      if (!isValidPathComponent(segment)) {
+    for (const segment2 of pathSegments) {
+      if (!isValidPathComponent(segment2)) {
         return c.json({ error: { code: "INVALID_PATH", message: "Invalid path" } }, 400);
       }
     }
@@ -369685,6 +369992,13 @@ async function resolveRecipient(to, channelType, services) {
     recoverable: false
   });
 }
+async function persistStarState(services, instanceId, channelExternalId, messageExternalId, starred) {
+  try {
+    const chat2 = await services.chats.getByExternalId(instanceId, channelExternalId);
+    if (chat2)
+      await services.messages.setStarred(chat2.id, messageExternalId, starred);
+  } catch {}
+}
 async function getPluginForInstance2(services, channelRegistry2, instanceId, requiredCapability) {
   const instance4 = await services.instances.getById(instanceId);
   if (!channelRegistry2) {
@@ -369850,7 +370164,7 @@ async function computeCloseContactTerminalState(db2, chatUuid, outcome, auditRow
   return { terminal: false, escalated: false, closeUntil };
 }
 function hasPresenceStatusSender(plugin10) {
-  return typeof plugin10 === "object" && plugin10 !== null && "sendPresenceStatus" in plugin10 && typeof plugin10.sendPresenceStatus === "function";
+  return typeof plugin10 === "object" && plugin10 !== null && typeof plugin10.sendPresenceStatus === "function";
 }
 async function verifyMessageInstanceOwnership(services, message2, instanceId) {
   if (!message2.chatId)
@@ -369873,7 +370187,7 @@ async function resolveChannelMessageId(services, messageId, instanceId) {
   log117.debug("Resolved internal UUID to external ID", { messageId, externalId: message2.externalId });
   return message2.externalId;
 }
-var log117, mediaDownloadLog, messagesRoutes, MIME_BY_EXTENSION, DEFAULT_MIME_BY_MEDIA_TYPE, UUID_REGEX2, MessageSourceSchema, MessageTypeSchema, MessageStatusSchema, DeliveryStatusSchema, listQuerySchema14, createMessageSchema, updateMessageSchema, recordEditSchema, addReactionSchema, removeReactionSchema, updateDeliveryStatusSchema, MentionSchema, sendTextSchema, sendMediaSchema, sendReactionSchema, sendStickerSchema, sendContactSchema, sendLocationSchema, sendHandoffSchema, sendCloseContactSchema, messageRefSchema, _mediaStorageForDownload = null, sendTtsSchema, forwardMessageSchema, sendPresenceSchema, markMessageReadSchema, markBatchReadSchema, sendPollSchema, sendEmbedSchema, editMessageChannelSchema, deleteMessageChannelSchema, starMessageSchema;
+var log117, mediaDownloadLog, messagesRoutes, MIME_BY_EXTENSION, DEFAULT_MIME_BY_MEDIA_TYPE, UUID_REGEX2, permalinkQuerySchema, MessageSourceSchema, MessageTypeSchema, MessageStatusSchema, DeliveryStatusSchema, listQuerySchema14, createMessageSchema, updateMessageSchema, recordEditSchema, addReactionSchema, removeReactionSchema, updateDeliveryStatusSchema, MentionSchema, sendTextSchema, sendMediaSchema, sendReactionSchema, sendStickerSchema, sendContactSchema, sendLocationSchema, sendHandoffSchema, sendCloseContactSchema, messageRefSchema, _mediaStorageForDownload = null, sendTtsSchema, forwardMessageSchema, sendPresenceSchema, markMessageReadSchema, markBatchReadSchema, sendPollSchema, sendEmbedSchema, editMessageChannelSchema, deleteMessageChannelSchema, starMessageSchema;
 var init_messages5 = __esm(() => {
   init_dist6();
   init_src2();
@@ -369916,6 +370230,42 @@ var init_messages5 = __esm(() => {
     document: "application/octet-stream"
   };
   UUID_REGEX2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+  permalinkQuerySchema = exports_external.object({
+    instanceId: exports_external.string().uuid(),
+    channelId: exports_external.string().min(1).describe("Platform chat/channel id containing the message")
+  });
+  messagesRoutes.get("/:id/permalink", zValidator("query", permalinkQuerySchema), async (c) => {
+    const messageId = c.req.param("id");
+    const { instanceId, channelId } = c.req.valid("query");
+    checkInstanceAccess2(c.get("apiKey"), instanceId);
+    const services = c.get("services");
+    const chat2 = await services.chats.getByExternalId(instanceId, channelId);
+    const stored = chat2 ? await services.messages.getByExternalId(chat2.id, messageId) : null;
+    if (stored?.permalink) {
+      return c.json({ data: { messageId, permalink: stored.permalink, cached: true } });
+    }
+    const { instance: instance4, plugin: plugin10 } = await getPluginForInstance2(services, c.get("channelRegistry"), instanceId);
+    if (typeof plugin10.getPermalink !== "function") {
+      throw new OmniError({
+        code: ERROR_CODES.CAPABILITY_NOT_SUPPORTED,
+        message: `Channel ${instance4.channel} cannot resolve permalinks`,
+        context: { channelType: instance4.channel },
+        recoverable: false
+      });
+    }
+    const permalink = await plugin10.getPermalink(instanceId, channelId, messageId);
+    if (!permalink) {
+      throw new OmniError({
+        code: ERROR_CODES.NOT_FOUND,
+        message: `No permalink available for message ${messageId}`,
+        recoverable: false
+      });
+    }
+    if (chat2) {
+      await services.messages.setPermalink(chat2.id, messageId, permalink).catch(() => {});
+    }
+    return c.json({ data: { messageId, permalink, cached: false } });
+  });
   MessageSourceSchema = exports_external.enum(["realtime", "sync", "api", "import"]);
   MessageTypeSchema = exports_external.enum([
     "text",
@@ -370928,7 +371278,7 @@ var init_messages5 = __esm(() => {
       stability: data.stability,
       similarityBoost: data.similarityBoost
     });
-    if ("sendTyping" in plugin10 && typeof plugin10.sendTyping === "function") {
+    if (typeof plugin10.sendTyping === "function") {
       const presenceDuration = data.presenceDelay ?? Math.min(ttsResult.durationMs, 15000);
       try {
         await plugin10.sendTyping(data.instanceId, resolvedTo, presenceDuration);
@@ -371105,7 +371455,7 @@ var init_messages5 = __esm(() => {
       status,
       loadingMessages
     }) : await (async () => {
-      if (!("sendTyping" in plugin10) || typeof plugin10.sendTyping !== "function") {
+      if (typeof plugin10.sendTyping !== "function") {
         throw new OmniError({
           code: ERROR_CODES.CAPABILITY_NOT_SUPPORTED,
           message: `Channel ${instance4.channel} plugin does not implement sendTyping`,
@@ -371157,7 +371507,7 @@ var init_messages5 = __esm(() => {
       });
     }
     const { instance: instance4, plugin: plugin10 } = await getPluginForInstance2(services, channelRegistry2, instanceId, "canReceiveReadReceipts");
-    if (!("markAsRead" in plugin10) || typeof plugin10.markAsRead !== "function") {
+    if (typeof plugin10.markAsRead !== "function") {
       throw new OmniError({
         code: ERROR_CODES.CAPABILITY_NOT_SUPPORTED,
         message: `Channel ${instance4.channel} plugin does not implement markAsRead`,
@@ -371183,7 +371533,7 @@ var init_messages5 = __esm(() => {
     const channelRegistry2 = c.get("channelRegistry");
     checkInstanceAccess2(c.get("apiKey"), instanceId);
     const { instance: instance4, plugin: plugin10 } = await getPluginForInstance2(services, channelRegistry2, instanceId, "canReceiveReadReceipts");
-    if (!("markAsRead" in plugin10) || typeof plugin10.markAsRead !== "function") {
+    if (typeof plugin10.markAsRead !== "function") {
       throw new OmniError({
         code: ERROR_CODES.CAPABILITY_NOT_SUPPORTED,
         message: `Channel ${instance4.channel} plugin does not implement markAsRead`,
@@ -371419,7 +371769,7 @@ var init_messages5 = __esm(() => {
         recoverable: false
       });
     }
-    if (!("editMessage" in plugin10) || typeof plugin10.editMessage !== "function") {
+    if (typeof plugin10.editMessage !== "function") {
       throw new OmniError({
         code: ERROR_CODES.CAPABILITY_NOT_SUPPORTED,
         message: `Channel ${instance4.channel} plugin does not implement editMessage`,
@@ -371475,7 +371825,7 @@ var init_messages5 = __esm(() => {
         recoverable: false
       });
     }
-    if (!("deleteMessage" in plugin10) || typeof plugin10.deleteMessage !== "function") {
+    if (typeof plugin10.deleteMessage !== "function") {
       throw new OmniError({
         code: ERROR_CODES.CAPABILITY_NOT_SUPPORTED,
         message: `Channel ${instance4.channel} plugin does not implement deleteMessage`,
@@ -371518,7 +371868,7 @@ var init_messages5 = __esm(() => {
         recoverable: false
       });
     }
-    if (!("starMessage" in plugin10) || typeof plugin10.starMessage !== "function") {
+    if (typeof plugin10.starMessage !== "function") {
       throw new OmniError({
         code: ERROR_CODES.CAPABILITY_NOT_SUPPORTED,
         message: `Channel ${instance4.channel} does not support starring messages`,
@@ -371527,6 +371877,7 @@ var init_messages5 = __esm(() => {
       });
     }
     await plugin10.starMessage(instanceId, channelId, messageId, true, fromMe);
+    await persistStarState(services, instanceId, channelId, messageId, true);
     return c.json({
       success: true,
       data: { messageId, starred: true }
@@ -371555,7 +371906,7 @@ var init_messages5 = __esm(() => {
         recoverable: false
       });
     }
-    if (!("starMessage" in plugin10) || typeof plugin10.starMessage !== "function") {
+    if (typeof plugin10.starMessage !== "function") {
       throw new OmniError({
         code: ERROR_CODES.CAPABILITY_NOT_SUPPORTED,
         message: `Channel ${instance4.channel} does not support starring messages`,
@@ -371564,6 +371915,7 @@ var init_messages5 = __esm(() => {
       });
     }
     await plugin10.starMessage(instanceId, channelId, messageId, false, fromMe);
+    await persistStarState(services, instanceId, channelId, messageId, false);
     return c.json({
       success: true,
       data: { messageId, starred: false }
@@ -372029,15 +372381,345 @@ var init_providers4 = __esm(() => {
   });
 });
 
+// ../api/src/services/scheduled-messages.ts
+function accumulate(total, pass) {
+  total.scanned += pass.scanned;
+  total.sent += pass.sent;
+  total.failed += pass.failed;
+}
+function parseOutgoingContent(raw2, scheduledMessageId) {
+  if (!raw2 || typeof raw2 !== "object" || Array.isArray(raw2)) {
+    throw callerError(`Scheduled message ${scheduledMessageId} has non-object content`);
+  }
+  const type = raw2.type;
+  if (typeof type !== "string" || type.length === 0) {
+    throw callerError(`Scheduled message ${scheduledMessageId} has content without a 'type' discriminant`);
+  }
+  return raw2;
+}
+function callerError(message2) {
+  return new OmniError({ code: ERROR_CODES.VALIDATION, message: message2, recoverable: false });
+}
+
+class ScheduledMessageService {
+  db;
+  resolvePlugin;
+  logger;
+  authPlaneDb;
+  warnedMissingAuthPlane = false;
+  constructor(db2, resolvePlugin, logger7) {
+    this.db = db2;
+    this.resolvePlugin = resolvePlugin;
+    this.logger = logger7 ?? createLogger("services:scheduled-messages");
+  }
+  async schedule(input) {
+    if (input.sendAt.getTime() <= Date.now()) {
+      throw callerError(`sendAt must be in the future (got ${input.sendAt.toISOString()})`);
+    }
+    parseOutgoingContent(input.content, "(new)");
+    const plugin10 = await this.resolvePlugin(input.instanceId);
+    if (!plugin10) {
+      throw new Error(`No channel plugin for instance ${input.instanceId}`);
+    }
+    const native = plugin10.capabilities.canScheduleMessage === true && typeof plugin10.scheduleMessage === "function";
+    const deliveryMode = native ? "platform" : "local";
+    const maxAhead = plugin10.capabilities.maxScheduleAheadMs;
+    if (native && typeof maxAhead === "number" && input.sendAt.getTime() - Date.now() > maxAhead) {
+      throw callerError(`sendAt exceeds what ${plugin10.id} accepts natively (${Math.round(maxAhead / 86400000)} days ahead).`);
+    }
+    let externalScheduledId;
+    if (native) {
+      externalScheduledId = await plugin10.scheduleMessage?.(input.instanceId, this.toOutgoingMessage(input), input.sendAt);
+    }
+    try {
+      const [row] = await this.db.insert(scheduledMessages).values({
+        instanceId: input.instanceId,
+        chatExternalId: input.chatExternalId,
+        threadExternalId: input.threadExternalId,
+        isThreadBroadcast: input.isThreadBroadcast ?? false,
+        content: input.content,
+        sendAt: input.sendAt,
+        deliveryMode,
+        status: "pending",
+        externalScheduledId,
+        createdByAgentId: input.createdByAgentId
+      }).returning();
+      if (!row)
+        throw new Error("Failed to persist scheduled message");
+      return row;
+    } catch (error3) {
+      if (native && externalScheduledId) {
+        try {
+          await plugin10.cancelScheduledMessage?.(input.instanceId, input.chatExternalId, externalScheduledId);
+        } catch (cancelError) {
+          this.logger.warn("Failed to roll back native schedule after a row-insert failure", {
+            instanceId: input.instanceId,
+            externalScheduledId,
+            error: cancelError instanceof Error ? cancelError.message : String(cancelError)
+          });
+        }
+      }
+      throw error3;
+    }
+  }
+  async cancel(id) {
+    const row = await this.getById(id);
+    if (!row)
+      return null;
+    if (row.status !== "pending")
+      return row;
+    if (row.deliveryMode === "platform" && row.externalScheduledId) {
+      const plugin10 = await this.resolvePlugin(row.instanceId);
+      try {
+        await plugin10?.cancelScheduledMessage?.(row.instanceId, row.chatExternalId, row.externalScheduledId);
+      } catch (error3) {
+        this.logger.warn("Platform refused the cancel; marking canceled locally anyway", {
+          scheduledMessageId: id,
+          error: error3 instanceof Error ? error3.message : String(error3)
+        });
+      }
+    }
+    const [updated] = await this.db.update(scheduledMessages).set({ status: "canceled", canceledAt: new Date, updatedAt: new Date }).where(and2(eq(scheduledMessages.id, id), eq(scheduledMessages.status, "pending"))).returning();
+    return updated ?? row;
+  }
+  async getById(id) {
+    const [row] = await this.db.select().from(scheduledMessages).where(eq(scheduledMessages.id, id)).limit(1);
+    return row ?? null;
+  }
+  async listPending(instanceId, limit2 = 100) {
+    return this.db.select().from(scheduledMessages).where(and2(eq(scheduledMessages.instanceId, instanceId), eq(scheduledMessages.status, "pending"))).orderBy(asc(scheduledMessages.sendAt)).limit(limit2);
+  }
+  setAuthPlane(db2) {
+    this.authPlaneDb = db2;
+  }
+  async sweep() {
+    if (!isMultitenancyEnabled()) {
+      return this.sweepWorld({ kind: "all" });
+    }
+    const totals = { scanned: 0, sent: 0, failed: 0 };
+    if (this.authPlaneDb) {
+      for (const tenantId of await enumerateActiveWorkTenants(this.authPlaneDb)) {
+        try {
+          accumulate(totals, await this.sweepWorld({ kind: "tenant", tenantId }));
+        } catch (error3) {
+          this.logger.warn("scheduled-message sweeper: tenant pass failed", {
+            tenantId,
+            error: error3 instanceof Error ? error3.message : String(error3)
+          });
+        }
+      }
+    } else if (!this.warnedMissingAuthPlane) {
+      this.warnedMissingAuthPlane = true;
+      this.logger.warn("scheduled-message sweeper: multitenancy is enabled but no auth-plane connection was injected \u2014 tenant rows will not be swept");
+    }
+    if (resolveEnforcementMode(process.env) !== "enforced") {
+      accumulate(totals, await this.sweepWorld({ kind: "legacy-rows" }));
+    }
+    return totals;
+  }
+  worldPredicate(world) {
+    if (world.kind === "tenant") {
+      return [
+        sql`EXISTS (SELECT 1 FROM ${instances} WHERE ${instances.id} = ${scheduledMessages.instanceId} AND ${instances.tenantId} = ${world.tenantId})`
+      ];
+    }
+    if (world.kind === "legacy-rows") {
+      return [
+        sql`EXISTS (SELECT 1 FROM ${instances} WHERE ${instances.id} = ${scheduledMessages.instanceId} AND ${instances.tenantId} IS NULL)`
+      ];
+    }
+    return [];
+  }
+  async sweepWorld(world) {
+    const stats = { scanned: 0, sent: 0, failed: 0 };
+    const now = new Date;
+    const claimCutoff = new Date(now.getTime() - CLAIM_LEASE_MS);
+    const due = await this.db.transaction(async (tx) => {
+      const locked = await tx.select({ id: scheduledMessages.id }).from(scheduledMessages).where(and2(eq(scheduledMessages.deliveryMode, "local"), lte(scheduledMessages.sendAt, now), or2(eq(scheduledMessages.status, "pending"), and2(eq(scheduledMessages.status, "sending"), lte(scheduledMessages.updatedAt, claimCutoff))), ...this.worldPredicate(world))).orderBy(asc(scheduledMessages.sendAt)).limit(MAX_PER_TICK).for("update", { skipLocked: true });
+      if (locked.length === 0)
+        return [];
+      return tx.update(scheduledMessages).set({ status: "sending", updatedAt: now }).where(inArray(scheduledMessages.id, locked.map((r) => r.id))).returning();
+    });
+    stats.scanned = due.length;
+    for (const row of due) {
+      try {
+        const plugin10 = await this.resolvePlugin(row.instanceId);
+        if (!plugin10)
+          throw new Error(`No channel plugin for instance ${row.instanceId}`);
+        const result = await plugin10.sendMessage(row.instanceId, {
+          to: row.chatExternalId,
+          threadId: row.threadExternalId ?? undefined,
+          content: parseOutgoingContent(row.content, row.id),
+          metadata: { isThreadBroadcast: row.isThreadBroadcast }
+        });
+        if (!result.success) {
+          throw new Error(result.error ?? "sendMessage reported failure without an error");
+        }
+        await this.db.update(scheduledMessages).set({
+          status: "sent",
+          sentAt: new Date,
+          sentExternalId: result.messageId,
+          attemptCount: row.attemptCount + 1,
+          updatedAt: new Date
+        }).where(and2(eq(scheduledMessages.id, row.id), eq(scheduledMessages.status, "sending")));
+        stats.sent++;
+      } catch (error3) {
+        const message2 = error3 instanceof Error ? error3.message : String(error3);
+        const attempts = row.attemptCount + 1;
+        const exhausted = attempts >= MAX_ATTEMPTS;
+        await this.db.update(scheduledMessages).set({
+          status: exhausted ? "failed" : "pending",
+          failedAt: exhausted ? new Date : null,
+          lastError: message2,
+          attemptCount: attempts,
+          updatedAt: new Date
+        }).where(and2(eq(scheduledMessages.id, row.id), eq(scheduledMessages.status, "sending")));
+        stats.failed++;
+        this.logger.warn("Scheduled message delivery failed", {
+          scheduledMessageId: row.id,
+          attempts,
+          exhausted,
+          error: message2
+        });
+      }
+    }
+    return stats;
+  }
+  async pruneTerminal(olderThan) {
+    const result = await this.db.delete(scheduledMessages).where(and2(sql`${scheduledMessages.status} IN ('sent', 'canceled', 'failed')`, lte(scheduledMessages.updatedAt, olderThan))).returning({ id: scheduledMessages.id });
+    return result.length;
+  }
+  toOutgoingMessage(input) {
+    return {
+      to: input.chatExternalId,
+      threadId: input.threadExternalId,
+      content: parseOutgoingContent(input.content, "(new)"),
+      metadata: { isThreadBroadcast: input.isThreadBroadcast ?? false }
+    };
+  }
+}
+function createPluginResolver(db2, getPlugin2) {
+  return async (instanceId) => {
+    const [row] = await db2.select({ channel: instances.channel }).from(instances).where(eq(instances.id, instanceId)).limit(1);
+    if (!row)
+      return null;
+    return getPlugin2(row.channel) ?? null;
+  };
+}
+var MAX_PER_TICK = 50, MAX_ATTEMPTS = 3, CLAIM_LEASE_MS;
+var init_scheduled_messages = __esm(() => {
+  init_src();
+  init_src5();
+  init_drizzle_orm();
+  init_periodic_tenant_work();
+  CLAIM_LEASE_MS = 5 * 60000;
+});
+
+// ../api/src/routes/v2/scheduled-messages.ts
+function getService(c) {
+  const db2 = c.get("db");
+  const registry5 = c.get("channelRegistry");
+  if (!registry5) {
+    throw new OmniError({
+      code: ERROR_CODES.CHANNEL_NOT_CONNECTED,
+      message: "Channel registry not available",
+      recoverable: false
+    });
+  }
+  return new ScheduledMessageService(db2, createPluginResolver(db2, (channel5) => registry5.get(channel5)));
+}
+var scheduledMessagesRoutes, scheduleSchema, listQuerySchema17;
+var init_scheduled_messages2 = __esm(() => {
+  init_dist6();
+  init_src();
+  init_dist2();
+  init_zod();
+  init_scheduled_messages();
+  scheduledMessagesRoutes = new Hono2;
+  scheduleSchema = exports_external.object({
+    instanceId: exports_external.string().uuid(),
+    chatId: exports_external.string().min(1).describe("Platform chat/channel id (e.g. Slack C\u2026/D\u2026)"),
+    content: exports_external.record(exports_external.unknown()).describe("OutgoingContent, e.g. { type: 'text', text: 'oi' }"),
+    sendAt: exports_external.string().datetime().describe("ISO-8601 delivery time (UTC-aware)"),
+    threadId: exports_external.string().optional().describe("Post into this thread (Slack thread_ts)"),
+    isThreadBroadcast: exports_external.boolean().optional().describe("Also surface it in the channel (Slack reply_broadcast)")
+  });
+  listQuerySchema17 = exports_external.object({
+    instanceId: exports_external.string().uuid(),
+    limit: exports_external.coerce.number().int().min(1).max(500).default(100)
+  });
+  scheduledMessagesRoutes.post("/", zValidator("json", scheduleSchema), async (c) => {
+    const body = c.req.valid("json");
+    const sendAt = new Date(body.sendAt);
+    try {
+      const row = await getService(c).schedule({
+        instanceId: body.instanceId,
+        chatExternalId: body.chatId,
+        content: body.content,
+        sendAt,
+        threadExternalId: body.threadId,
+        isThreadBroadcast: body.isThreadBroadcast
+      });
+      return c.json({ success: true, data: row }, 201);
+    } catch (error3) {
+      if (error3 instanceof OmniError)
+        throw error3;
+      throw new OmniError({
+        code: ERROR_CODES.UNKNOWN,
+        message: error3 instanceof Error ? error3.message : String(error3),
+        recoverable: false,
+        cause: error3 instanceof Error ? error3 : undefined
+      });
+    }
+  });
+  scheduledMessagesRoutes.get("/", zValidator("query", listQuerySchema17), async (c) => {
+    const { instanceId, limit: limit2 } = c.req.valid("query");
+    const rows = await getService(c).listPending(instanceId, limit2);
+    return c.json({
+      data: rows,
+      meta: {
+        count: rows.length,
+        scope: "scheduled-via-omni"
+      }
+    });
+  });
+  scheduledMessagesRoutes.get("/:id", async (c) => {
+    const row = await getService(c).getById(c.req.param("id"));
+    if (!row) {
+      throw new OmniError({
+        code: ERROR_CODES.NOT_FOUND,
+        message: `Scheduled message ${c.req.param("id")} not found`,
+        recoverable: false
+      });
+    }
+    return c.json({ data: row });
+  });
+  scheduledMessagesRoutes.delete("/:id", async (c) => {
+    const id = c.req.param("id");
+    const row = await getService(c).cancel(id);
+    if (!row) {
+      throw new OmniError({
+        code: ERROR_CODES.NOT_FOUND,
+        message: `Scheduled message ${id} not found`,
+        recoverable: false
+      });
+    }
+    return c.json({
+      success: true,
+      data: { id: row.id, status: row.status, canceledAt: row.canceledAt }
+    });
+  });
+});
+
 // ../api/src/routes/v2/settings.ts
-var settingsRoutes, listQuerySchema17, setSettingSchema, bulkUpdateSchema, historyQuerySchema;
+var settingsRoutes, listQuerySchema18, setSettingSchema, bulkUpdateSchema, historyQuerySchema;
 var init_settings3 = __esm(() => {
   init_dist6();
   init_dist2();
   init_zod();
   init_date_query();
   settingsRoutes = new Hono2;
-  listQuerySchema17 = exports_external.object({
+  listQuerySchema18 = exports_external.object({
     category: exports_external.string().optional()
   });
   setSettingSchema = exports_external.object({
@@ -372052,7 +372734,7 @@ var init_settings3 = __esm(() => {
     limit: exports_external.coerce.number().int().min(1).max(100).default(50),
     since: optionalDateParam("since")
   });
-  settingsRoutes.get("/", zValidator("query", listQuerySchema17), async (c) => {
+  settingsRoutes.get("/", zValidator("query", listQuerySchema18), async (c) => {
     const { category } = c.req.valid("query");
     const services = c.get("services");
     const settings = await services.settings.list(category);
@@ -372127,6 +372809,116 @@ var init_settings3 = __esm(() => {
   });
 });
 
+// ../api/src/routes/v2/slack.ts
+function checkInstanceAccess3(apiKey, instanceId) {
+  if (apiKey && !ApiKeyService.instanceAllowed(apiKey.instanceIds, instanceId)) {
+    throw new OmniError({
+      code: ERROR_CODES.FORBIDDEN,
+      message: "API key does not have access to this instance",
+      context: { instanceId },
+      recoverable: false
+    });
+  }
+}
+async function getSlackPlugin(c, instanceId) {
+  checkInstanceAccess3(c.get("apiKey"), instanceId);
+  const services = c.get("services");
+  const registry5 = c.get("channelRegistry");
+  const instance4 = await services.instances.getById(instanceId);
+  if (instance4.channel !== "slack") {
+    throw new OmniError({
+      code: ERROR_CODES.CAPABILITY_NOT_SUPPORTED,
+      message: `Instance ${instanceId} is a ${instance4.channel} instance; these endpoints are Slack-only`,
+      context: { channelType: instance4.channel },
+      recoverable: false
+    });
+  }
+  if (!registry5) {
+    throw new OmniError({
+      code: ERROR_CODES.CHANNEL_NOT_CONNECTED,
+      message: "Channel registry not available",
+      recoverable: false
+    });
+  }
+  const plugin10 = registry5.get("slack");
+  if (!plugin10) {
+    throw new OmniError({
+      code: ERROR_CODES.CHANNEL_NOT_CONNECTED,
+      message: "Slack plugin not registered",
+      recoverable: false
+    });
+  }
+  return plugin10;
+}
+var slackRoutes, openDmSchema, searchSchema;
+var init_slack = __esm(() => {
+  init_dist6();
+  init_src();
+  init_dist2();
+  init_zod();
+  init_api_keys();
+  slackRoutes = new Hono2;
+  openDmSchema = exports_external.object({
+    instanceId: exports_external.string().uuid(),
+    userId: exports_external.string().min(1).describe("Slack user id (U\u2026) to open a DM with")
+  });
+  searchSchema = exports_external.object({
+    instanceId: exports_external.string().uuid(),
+    query: exports_external.string().min(1),
+    count: exports_external.coerce.number().int().min(1).max(100).default(20),
+    page: exports_external.coerce.number().int().min(1).default(1)
+  });
+  slackRoutes.post("/dm/open", zValidator("json", openDmSchema), async (c) => {
+    const { instanceId, userId } = c.req.valid("json");
+    const plugin10 = await getSlackPlugin(c, instanceId);
+    if (typeof plugin10.openDirectMessage !== "function") {
+      throw new OmniError({
+        code: ERROR_CODES.CAPABILITY_NOT_SUPPORTED,
+        message: "Slack plugin does not implement openDirectMessage",
+        recoverable: false
+      });
+    }
+    try {
+      const channelId = await plugin10.openDirectMessage(instanceId, userId);
+      return c.json({ success: true, data: { userId, channelId } });
+    } catch (error3) {
+      throw new OmniError({
+        code: ERROR_CODES.CHANNEL_SEND_FAILED,
+        message: error3 instanceof Error ? error3.message : String(error3),
+        recoverable: true
+      });
+    }
+  });
+  slackRoutes.get("/search", zValidator("query", searchSchema), async (c) => {
+    const { instanceId, query, count: count3, page } = c.req.valid("query");
+    const plugin10 = await getSlackPlugin(c, instanceId);
+    if (typeof plugin10.searchMessages !== "function") {
+      throw new OmniError({
+        code: ERROR_CODES.CAPABILITY_NOT_SUPPORTED,
+        message: "Slack plugin does not implement searchMessages",
+        recoverable: false
+      });
+    }
+    try {
+      const matches = await plugin10.searchMessages(instanceId, query, { count: count3, page });
+      return c.json({
+        data: matches,
+        meta: {
+          count: matches.length,
+          page,
+          scope: "authorizing-user"
+        }
+      });
+    } catch (error3) {
+      throw new OmniError({
+        code: ERROR_CODES.CAPABILITY_NOT_SUPPORTED,
+        message: error3 instanceof Error ? error3.message : String(error3),
+        recoverable: false
+      });
+    }
+  });
+});
+
 // ../api/src/routes/v2/templates.ts
 function jsonError(message2, code = "BAD_REQUEST", _status = 400) {
   return { error: { code, message: message2 } };
@@ -372151,7 +372943,7 @@ function makeClient(cfg) {
 function variablesToBodyParameters(variables) {
   return Object.entries(variables).map(([k2, v2]) => [Number.parseInt(k2, 10), v2]).filter(([n2]) => Number.isFinite(n2) && n2 >= 1).sort((a, b3) => a[0] - b3[0]).map(([, v2]) => v2);
 }
-var log118, templatesRoutes, instanceAccess3, idParamSchema6, templateIdParamSchema, templateNameParamSchema, listQuerySchema18, createBodySchema, sendTestBodySchema, sendByNameBodySchema;
+var log118, templatesRoutes, instanceAccess3, idParamSchema6, templateIdParamSchema, templateNameParamSchema, listQuerySchema19, createBodySchema, sendTestBodySchema, sendByNameBodySchema;
 var init_templates3 = __esm(() => {
   init_dist6();
   init_src6();
@@ -372176,7 +372968,7 @@ var init_templates3 = __esm(() => {
     id: exports_external.string().uuid(),
     templateName: exports_external.string().min(1)
   });
-  listQuerySchema18 = exports_external.object({
+  listQuerySchema19 = exports_external.object({
     status: MetaTemplateStatusSchema.optional(),
     category: MetaTemplateCategorySchema.optional(),
     language: exports_external.string().min(2).optional(),
@@ -372204,7 +372996,7 @@ var init_templates3 = __esm(() => {
       filename: exports_external.string().optional()
     }).optional()
   });
-  templatesRoutes.get("/instances/:id/whatsapp-templates", instanceAccess3, zValidator("param", idParamSchema6), zValidator("query", listQuerySchema18), async (c) => {
+  templatesRoutes.get("/instances/:id/whatsapp-templates", instanceAccess3, zValidator("param", idParamSchema6), zValidator("query", listQuerySchema19), async (c) => {
     const { id: instanceId } = c.req.valid("param");
     const { status, category, language, sync } = c.req.valid("query");
     const services = c.get("services");
@@ -372494,7 +373286,7 @@ async function resolveOpenTurn(services, keyId, turnId, headerInstanceId, header
   }
   return null;
 }
-var turnsRoutes, closeTurnSchema, listQuerySchema19, adminForceCloseSchema, bulkCloseSchema;
+var turnsRoutes, closeTurnSchema, listQuerySchema20, adminForceCloseSchema, bulkCloseSchema;
 var init_turns2 = __esm(() => {
   init_dist6();
   init_dist2();
@@ -372557,7 +373349,7 @@ var init_turns2 = __esm(() => {
       }
     });
   });
-  listQuerySchema19 = exports_external.object({
+  listQuerySchema20 = exports_external.object({
     status: exports_external.enum(["open", "done", "timeout"]).optional(),
     instanceId: exports_external.string().uuid().optional(),
     chatId: exports_external.string().optional(),
@@ -372572,7 +373364,7 @@ var init_turns2 = __esm(() => {
     confirm: exports_external.boolean(),
     reason: exports_external.string().optional()
   });
-  turnsRoutes.get("/", zValidator("query", listQuerySchema19), async (c) => {
+  turnsRoutes.get("/", zValidator("query", listQuerySchema20), async (c) => {
     const denied = requireAdmin(c);
     if (denied)
       return denied;
@@ -372803,7 +373595,7 @@ var init_voice2 = __esm(() => {
 });
 
 // ../api/src/routes/v2/webhooks.ts
-var webhooksRoutes, createWebhookSourceSchema, updateWebhookSourceSchema, listQuerySchema20, triggerEventSchema;
+var webhooksRoutes, createWebhookSourceSchema, updateWebhookSourceSchema, listQuerySchema21, triggerEventSchema;
 var init_webhooks3 = __esm(() => {
   init_dist6();
   init_dist2();
@@ -372817,10 +373609,10 @@ var init_webhooks3 = __esm(() => {
     enabled: exports_external.boolean().default(true).describe("Whether source is enabled")
   });
   updateWebhookSourceSchema = createWebhookSourceSchema.partial();
-  listQuerySchema20 = exports_external.object({
+  listQuerySchema21 = exports_external.object({
     enabled: exports_external.coerce.boolean().optional()
   });
-  webhooksRoutes.get("/webhook-sources", zValidator("query", listQuerySchema20), async (c) => {
+  webhooksRoutes.get("/webhook-sources", zValidator("query", listQuerySchema21), async (c) => {
     const { enabled } = c.req.valid("query");
     const services = c.get("services");
     const sources = await services.webhooks.list({ enabled });
@@ -373685,7 +374477,9 @@ var init_v2 = __esm(() => {
   init_persons3();
   init_processed_events();
   init_providers4();
+  init_scheduled_messages2();
   init_settings3();
+  init_slack();
   init_templates3();
   init_trust();
   init_turns2();
@@ -373702,6 +374496,8 @@ var init_v2 = __esm(() => {
   v2Routes.route("/instances", instancesRoutes);
   v2Routes.route("/logs", logsRoutes);
   v2Routes.route("/messages", messagesRoutes);
+  v2Routes.route("/scheduled-messages", scheduledMessagesRoutes);
+  v2Routes.route("/slack", slackRoutes);
   v2Routes.route("/events", eventsRoutes);
   v2Routes.route("/journeys", journeysRoutes);
   v2Routes.route("/persons", personsRoutes);
@@ -374818,6 +375614,27 @@ async function downloadMediaFromUrl(ctx, instanceId, messageId, mediaUrl, mimeTy
     return null;
   }
 }
+async function downloadMediaViaPlugin(ctx, instanceId, messageId, channelType, mediaRef, fallbackMimeType, platformTimestamp, trustedTenantId) {
+  const plugin10 = await (ctx.resolveChannelPlugin ?? getPlugin)(channelType);
+  if (!plugin10?.downloadInboundMedia) {
+    log122.warn("Channel plugin cannot materialize deferred media", { channelType, messageId });
+    return null;
+  }
+  try {
+    const { buffer: buffer3, mimeType } = pluginMediaSchema.parse(await plugin10.downloadInboundMedia(instanceId, mediaRef));
+    const result = await ctx.mediaStorage.storeFromBuffer(instanceId, messageId, buffer3, mimeType || fallbackMimeType, platformTimestamp, trustedTenantId);
+    await runMediaDb(ctx, trustedTenantId, () => ctx.mediaStorage.updateMessageLocalPath(messageId, result.localPath));
+    log122.debug("Downloaded inbound media via plugin", { messageId, channelType, filePath: result.localPath });
+    return result.localPath;
+  } catch (error3) {
+    log122.error("Failed to download inbound media via plugin", {
+      error: String(error3),
+      channelType,
+      messageId
+    });
+    return null;
+  }
+}
 async function resolveMediaPath2(ctx, instanceId, chatId, externalId, content, mimeType, channelType, trustedTenantId) {
   const maxWaitMs = 5000;
   const pollMs = 250;
@@ -374847,6 +375664,11 @@ async function resolveMediaPath2(ctx, instanceId, chatId, externalId, content, m
     if (!filePath)
       return null;
   }
+  if (!filePath && content.mediaId && channelType) {
+    filePath = await downloadMediaViaPlugin(ctx, instanceId, message2.id, channelType, content.mediaId, mimeType, message2.platformTimestamp ?? undefined, trustedTenantId);
+    if (!filePath)
+      return null;
+  }
   if (!filePath) {
     log122.debug("No media file path available", { externalId });
     return null;
@@ -375144,17 +375966,23 @@ async function setupMediaProcessor(eventBus, db2, services) {
   });
   log122.info("Media processor initialized");
 }
-var log122, PROCESSABLE_MEDIA_TYPES;
+var log122, PROCESSABLE_MEDIA_TYPES, pluginMediaSchema;
 var init_media_processor = __esm(() => {
   init_src();
   init_src5();
   init_src8();
   init_drizzle_orm();
+  init_zod();
   init_media_storage();
   init_tenant_scope();
   init_worker_tenant_context();
+  init_loader2();
   log122 = createLogger("media-processor");
   PROCESSABLE_MEDIA_TYPES = new Set(["audio", "image", "document", "video"]);
+  pluginMediaSchema = exports_external.object({
+    buffer: exports_external.instanceof(Buffer),
+    mimeType: exports_external.string().min(1).optional()
+  });
 });
 
 // ../api/src/tenancy/inflight-revocation.ts
@@ -375207,29 +376035,6 @@ var init_inflight_revocation = __esm(() => {
   };
 });
 
-// ../api/src/utils/phone.ts
-function isValidE164Phone(phone) {
-  const bare = phone.replace(/^\+/, "");
-  if (!/^\d+$/.test(bare))
-    return false;
-  return bare.length >= 7 && bare.length <= 15;
-}
-function isLidFormat(platformUserId) {
-  const bare = platformUserId.split("@")[0] || platformUserId;
-  return /^\d{14,}$/.test(bare);
-}
-function validateContactPhone(phone, platformUserId) {
-  if (!phone)
-    return;
-  if (!isValidE164Phone(phone))
-    return;
-  const barePhone = phone.replace(/^\+/, "");
-  const barePuid = platformUserId.split("@")[0] || platformUserId;
-  if (isLidFormat(platformUserId) && barePhone === barePuid)
-    return;
-  return phone;
-}
-
 // ../api/src/plugins/sync-worker.ts
 class RateLimiter {
   lastRequest = 0;
@@ -376801,6 +377606,11 @@ async function withCronMonitor(slug, cron2, checkinMargin, maxRuntime, handler)
     await handler();
   }
 }
+function createScheduledMessageSweeper(services, channelRegistry2) {
+  const sweeper2 = new ScheduledMessageService(services.db, createPluginResolver(services.db, (channel5) => channelRegistry2.get(channel5) ?? undefined));
+  sweeper2.setAuthPlane(services.authPlane.db);
+  return sweeper2;
+}
 function setupScheduler(services, channelRegistry2) {
   const scheduler = getScheduler();
   scheduler.register({
@@ -376929,6 +377739,29 @@ function setupScheduler(services, channelRegistry2) {
       });
     }
   });
+  if (channelRegistry2) {
+    const scheduledMessages2 = createScheduledMessageSweeper(services, channelRegistry2);
+    scheduler.register({
+      name: "scheduled-message-sweeper",
+      cron: "*/15 * * * * *",
+      runOnStart: false,
+      handler: async () => {
+        await withCronMonitor("scheduled-message-sweeper", "*/15 * * * * *", 1, 1, async () => {
+          const startTime3 = Date.now();
+          try {
+            const stats = await scheduledMessages2.sweep();
+            recordScheduledJob("scheduled-message-sweeper", "success", (Date.now() - startTime3) / 1000);
+            if (stats.scanned > 0) {
+              log127.debug("Scheduled-message sweep tick", { ...stats });
+            }
+          } catch (err2) {
+            recordScheduledJob("scheduled-message-sweeper", "failure", (Date.now() - startTime3) / 1000);
+            throw err2;
+          }
+        });
+      }
+    });
+  }
   scheduler.register({
     name: "unread-count-refresh",
     cron: CronExpressions.EVERY_HOUR,
@@ -376980,6 +377813,7 @@ var init_scheduler2 = __esm(() => {
   init_src();
   init_esm5();
   init_sentry_scrub();
+  init_scheduled_messages();
   init_periodic_tenant_work();
   log127 = createLogger("scheduler:setup");
 });
@@ -383701,6 +384535,11 @@ var SLACK_CAPABILITIES = {
   canDeleteMessage: true,
   canReplyToMessage: true,
   canForwardMessage: false,
+  canScheduleMessage: true,
+  maxScheduleAheadMs: 120 * 24 * 60 * 60 * 1000,
+  canGetPermalink: true,
+  canPinMessage: true,
+  canSearchMessages: false,
   canSendContact: false,
   canSendLocation: false,
   canSendSticker: false,
@@ -383754,7 +384593,17 @@ function resolveStreamThrottle(throttleMs) {
 // ../channel-slack/src/connection/bolt-client.ts
 init_types10();
 var import_bolt = __toESM(require_dist16(), 1);
+var import_web_api = __toESM(require_dist13(), 1);
 var HTTP_MAX_BODY_BYTES = 1024 * 1024;
+function buildActingClients(options, botClient) {
+  if (options.authMode !== "user")
+    return { actingClient: botClient };
+  if (!options.userToken) {
+    throw new SlackError(SlackErrorCode.CONNECTION_FAILED, "userToken is required when authMode is 'user'");
+  }
+  const userClient = new import_web_api.WebClient(options.userToken);
+  return { actingClient: userClient, userClient };
+}
 function createBoltApp(options, logger5) {
   const mode = options.mode ?? "socket";
   if (mode === "http") {
@@ -383788,6 +384637,7 @@ function createSocketBoltApp(options, logger5) {
   return {
     app,
     client: app.client,
+    ...buildActingClients(options, app.client),
     botToken: options.botToken,
     mode: "socket"
   };
@@ -383820,6 +384670,7 @@ function createHttpBoltApp(options, logger5) {
   return {
     app,
     client: app.client,
+    ...buildActingClients(options, app.client),
     botToken: options.botToken,
     mode: "http",
     httpPort: options.httpPort,
@@ -383895,11 +384746,22 @@ async function startBoltConnection(connection, logger5) {
       teamId: connection.teamId,
       teamName: connection.teamName
     });
+    if (connection.userClient) {
+      const userAuth = await connection.userClient.auth.test();
+      connection.actingUserId = userAuth.user_id ?? undefined;
+      logger5.info("Acting user identity resolved", {
+        actingUserId: connection.actingUserId,
+        actingUser: userAuth.user
+      });
+    }
   } catch (error) {
     logger5.warn("Failed to resolve bot identity before start \u2014 self-message filtering may be unreliable", {
       error: String(error)
     });
   }
+  if (connection.userClient && !connection.actingUserId) {
+    throw new SlackError(SlackErrorCode.CONNECTION_FAILED, "User mode requires a resolved acting user id, but it could not be determined from the user token. Refusing to start.");
+  }
   if (connection.mode === "http") {
     const port = connection.httpPort ?? 3001;
     try {
@@ -384228,12 +385090,13 @@ function extractMessageMeta(event) {
     ts,
     userId,
     teamId,
-    isDm: channelType === "im",
+    isDm: channelType === "im" || channelType === "mpim",
+    isMpim: channelType === "mpim",
     isThreadReply: threadTs !== undefined && threadTs !== ts,
     channelType
   };
 }
-function shouldSkipMessage(msg, botUserId) {
+function shouldSkipMessage(msg, selfUserIds) {
   if (msg.subtype === "bot_message" || msg.bot_id)
     return true;
   if (msg.subtype === "message_changed" || msg.subtype === "message_deleted")
@@ -384241,7 +385104,7 @@ function shouldSkipMessage(msg, botUserId) {
   const userId = msg.user;
   if (!userId)
     return true;
-  if (botUserId && userId === botUserId)
+  if (selfUserIds.some((id) => id && id === userId))
     return true;
   return false;
 }
@@ -384265,6 +385128,7 @@ function buildRawPayload(meta, msg, extra) {
     channelType: meta.channelType,
     teamId: meta.teamId,
     isDm: meta.isDm,
+    isMpim: meta.isMpim === true,
     isThreadReply: meta.isThreadReply,
     files: msg.files,
     ...extra
@@ -384358,11 +385222,12 @@ async function processMessage2(instanceId, msg, currentBotUserId, callbacks, log
   }
   await callbacks.onMessage(instanceId, meta.ts, meta.channelId, userId, content, replyToId, rawPayload, platformTimestamp, meta);
 }
-function setupMessageHandlers2(app, instanceId, botUserId, callbacks, dmPolicyConfig, logger5, filterConfig, reliability) {
+function setupMessageHandlers2(app, instanceId, botUserId, callbacks, dmPolicyConfig, logger5, filterConfig, reliability, actingUserId) {
   const resolveBotUserId = () => typeof botUserId === "function" ? botUserId() : botUserId;
+  const resolveActingUserId = () => typeof actingUserId === "function" ? actingUserId() : actingUserId;
   app.message(async ({ message: message2 }) => {
     const msg = message2;
-    if (shouldSkipMessage(msg, resolveBotUserId()))
+    if (shouldSkipMessage(msg, [resolveBotUserId(), resolveActingUserId()]))
       return;
     const userId = msg.user;
     const meta = extractMessageMeta(msg);
@@ -384514,16 +385379,52 @@ async function uploadFileFromUrl(client, options, logger5) {
 
 // ../channel-slack/src/markdown.ts
 var MAX_SLACK_MESSAGE_LENGTH = 4000;
+function escapeMrkdwn(text) {
+  return text.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+}
+function segment(text) {
+  const segments = [];
+  const pattern = /(```[\s\S]*?```|`[^`\n]*`)/g;
+  let lastIndex = 0;
+  for (const match of text.matchAll(pattern)) {
+    const start = match.index ?? 0;
+    if (start > lastIndex) {
+      segments.push({ text: text.slice(lastIndex, start), isCode: false });
+    }
+    segments.push({ text: match[0], isCode: true });
+    lastIndex = start + match[0].length;
+  }
+  if (lastIndex < text.length) {
+    segments.push({ text: text.slice(lastIndex), isCode: false });
+  }
+  return segments;
+}
+function unescapeUrl(url) {
+  return url.replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">");
+}
+function convertProse(text) {
+  const BOLD = "\x00B\x00";
+  let out = escapeMrkdwn(text);
+  out = out.replace(/^&gt;\s?/gm, "> ");
+  out = out.replace(/^#{1,6}\s+(.+)$/gm, `${BOLD}$1${BOLD}`);
+  out = out.replace(/!\[([^\]]*)\]\(([^)]+)\)/g, (_m, alt, url) => `<${unescapeUrl(url)}|${alt}>`);
+  out = out.replace(/\[([^\]]+)\]\(([^)]+)\)/g, (_m, label, url) => `<${unescapeUrl(url)}|${label}>`);
+  out = out.replace(/^(-{3,}|\*{3,}|_{3,})$/gm, "\u2014\u2014\u2014");
+  out = out.replace(/^(\s*)[-*+]\s+/gm, "$1\u2022 ");
+  out = out.replace(/\*\*(.+?)\*\*/g, `${BOLD}$1${BOLD}`);
+  out = out.replace(/(^|[\s(])\*(?!\s)([^*\n]+?)\*(?=[\s).,;:!?]|$)/g, "$1_$2_");
+  out = out.split(BOLD).join("*");
+  out = out.replace(/~~(.+?)~~/g, "~$1~");
+  return out;
+}
 function markdownToMrkdwn(markdown) {
-  let text = markdown;
-  text = text.replace(/^#{1,6}\s+(.+)$/gm, "*$1*");
-  text = text.replace(/\*\*(.+?)\*\*/g, "*$1*");
-  text = text.replace(/~~(.+?)~~/g, "~$1~");
-  text = text.replace(/!\[([^\]]*)\]\(([^)]+)\)/g, "<$2|$1>");
-  text = text.replace(/\[([^\]]+)\]\(([^)]+)\)/g, "<$2|$1>");
-  text = text.replace(/^>\s?/gm, "> ");
-  text = text.replace(/^(-{3,}|\*{3,}|_{3,})$/gm, "\u2014\u2014\u2014");
-  return text;
+  return segment(markdown).map((s) => s.isCode ? s.text : convertProse(s.text)).join("");
+}
+function findOpenFence(text) {
+  const fences = text.match(/```[^\n]*/g);
+  if (!fences || fences.length % 2 === 0)
+    return null;
+  return fences[fences.length - 1]?.slice(3).trim() ?? "";
 }
 function chunkMessage2(text, maxLength = MAX_SLACK_MESSAGE_LENGTH) {
   if (text.length <= maxLength) {
@@ -384531,21 +385432,37 @@ function chunkMessage2(text, maxLength = MAX_SLACK_MESSAGE_LENGTH) {
   }
   const chunks = [];
   let remaining = text;
+  let carryFence = null;
   while (remaining.length > 0) {
-    if (remaining.length <= maxLength) {
-      chunks.push(remaining);
+    const prefix = carryFence === null ? "" : `\`\`\`${carryFence}
+`;
+    if (prefix.length + remaining.length <= maxLength) {
+      chunks.push(prefix + remaining);
       break;
     }
-    let splitIndex = remaining.lastIndexOf(`
-`, maxLength);
-    if (splitIndex <= 0 || splitIndex < maxLength * 0.5) {
-      splitIndex = remaining.lastIndexOf(" ", maxLength);
-    }
-    if (splitIndex <= 0 || splitIndex < maxLength * 0.5) {
-      splitIndex = maxLength;
-    }
-    chunks.push(remaining.substring(0, splitIndex));
-    remaining = remaining.substring(splitIndex).trimStart();
+    const split = (budget) => {
+      let at = remaining.lastIndexOf(`
+`, budget);
+      if (at <= 0 || at < budget * 0.5)
+        at = remaining.lastIndexOf(" ", budget);
+      if (at <= 0 || at < budget * 0.5)
+        at = budget;
+      return at;
+    };
+    const plainBudget = Math.max(1, maxLength - prefix.length);
+    let splitIndex = split(plainBudget);
+    let head = remaining.slice(0, splitIndex);
+    let openFence = findOpenFence(prefix + head);
+    if (openFence !== null) {
+      const fencedBudget = Math.max(1, maxLength - prefix.length - 4);
+      splitIndex = split(fencedBudget);
+      head = remaining.slice(0, splitIndex);
+      openFence = findOpenFence(prefix + head);
+    }
+    chunks.push(openFence === null ? prefix + head : `${prefix + head}
+\`\`\``);
+    carryFence = openFence;
+    remaining = remaining.slice(splitIndex).trimStart();
   }
   return chunks;
 }
@@ -384887,6 +385804,55 @@ async function sendTextMessage2(client, options, logger5) {
   }
   return lastTs;
 }
+var MAX_SCHEDULE_AHEAD_MS = 120 * 24 * 60 * 60 * 1000;
+async function scheduleTextMessage(client, options, logger5) {
+  const formattedText = options.formatMode === "passthrough" ? options.text : markdownToMrkdwn(options.text);
+  if (formattedText.length > MAX_SLACK_MESSAGE_LENGTH) {
+    throw new SlackError(SlackErrorCode.SEND_FAILED, `Scheduled message is ${formattedText.length} chars, over Slack's ${MAX_SLACK_MESSAGE_LENGTH} limit. Chunking is not applied when scheduling \u2014 each chunk would get its own handle and a later cancel could half-fire.`);
+  }
+  const leadMs = options.postAt.getTime() - Date.now();
+  if (leadMs <= 0) {
+    throw new SlackError(SlackErrorCode.SEND_FAILED, `postAt is in the past (${options.postAt.toISOString()})`);
+  }
+  if (leadMs > MAX_SCHEDULE_AHEAD_MS) {
+    throw new SlackError(SlackErrorCode.SEND_FAILED, `postAt is ${Math.round(leadMs / 86400000)} days out; Slack accepts at most 120.`);
+  }
+  try {
+    const result = await client.chat.scheduleMessage({
+      channel: options.channelId,
+      text: formattedText,
+      post_at: Math.floor(options.postAt.getTime() / 1000),
+      thread_ts: options.threadTs,
+      reply_broadcast: options.replyBroadcast,
+      username: options.username,
+      icon_url: options.iconUrl,
+      icon_emoji: options.iconEmoji
+    });
+    const scheduledId = result.scheduled_message_id;
+    if (!scheduledId) {
+      throw new SlackError(SlackErrorCode.SEND_FAILED, "chat.scheduleMessage returned no scheduled_message_id \u2014 cannot cancel later");
+    }
+    return scheduledId;
+  } catch (error) {
+    if (error instanceof SlackError)
+      throw error;
+    const message2 = error instanceof Error ? error.message : String(error);
+    logger5.error("Failed to schedule message", { error: message2, channelId: options.channelId });
+    throw new SlackError(SlackErrorCode.SEND_FAILED, `Failed to schedule message: ${message2}`);
+  }
+}
+async function cancelScheduledSlackMessage(client, channelId, scheduledMessageId, logger5) {
+  try {
+    await client.chat.deleteScheduledMessage({
+      channel: channelId,
+      scheduled_message_id: scheduledMessageId
+    });
+  } catch (error) {
+    const message2 = error instanceof Error ? error.message : String(error);
+    logger5.error("Failed to cancel scheduled message", { error: message2, channelId, scheduledMessageId });
+    throw new SlackError(SlackErrorCode.SEND_FAILED, `Failed to cancel scheduled message: ${message2}`);
+  }
+}
 async function editSlackMessage(client, channelId, ts, newText, formatMode, logger5) {
   const formattedText = formatMode === "passthrough" ? newText : markdownToMrkdwn(newText);
   try {
@@ -384919,19 +385885,27 @@ init_types10();
 var downloadGuard4 = createDownloadGuard();
 function resolveSlackTokens(slackConfig, rawOptions, rawCredentials) {
   const botToken = slackConfig.botToken ?? rawOptions.token ?? rawCredentials.botToken ?? rawCredentials.token;
+  const userToken = slackConfig.userToken ?? rawCredentials.userToken;
+  const authMode = slackConfig.authMode ?? "bot";
   const appToken = slackConfig.appToken ?? rawCredentials.appToken;
   const signingSecret = slackConfig.signingSecret ?? rawCredentials.signingSecret;
   const mode = slackConfig.mode ?? "socket";
   if (!botToken) {
     throw new SlackError(SlackErrorCode.INVALID_TOKEN, "botToken (xoxb-...) is required");
   }
+  if (authMode === "user" && !userToken) {
+    throw new SlackError(SlackErrorCode.INVALID_TOKEN, "userToken (xoxp-...) is required when authMode is 'user' \u2014 without it every action would silently go out as the bot");
+  }
+  if (userToken && !userToken.startsWith("xoxp-")) {
+    throw new SlackError(SlackErrorCode.INVALID_TOKEN, "userToken must be a user token (xoxp-...); got a token with a different prefix");
+  }
   if (mode === "socket" && !appToken) {
     throw new SlackError(SlackErrorCode.INVALID_TOKEN, "appToken (xapp-...) is required for Socket Mode");
   }
   if (mode === "http" && !signingSecret) {
     throw new SlackError(SlackErrorCode.INVALID_TOKEN, "signingSecret is required for HTTP mode");
   }
-  return { botToken, appToken, signingSecret, mode };
+  return { botToken, userToken, authMode, appToken, signingSecret, mode };
 }
 
 class SlackPlugin extends BaseChannelPlugin {
@@ -385010,6 +385984,8 @@ class SlackPlugin extends BaseChannelPlugin {
       }
       connection = createBoltApp({
         botToken: resolved.botToken,
+        userToken: resolved.userToken,
+        authMode: resolved.authMode,
         appToken: resolved.appToken,
         signingSecret: resolved.signingSecret,
         retryConfig: slackConfig.retryConfig,
@@ -385138,7 +386114,7 @@ class SlackPlugin extends BaseChannelPlugin {
     const streamMode = resolveStreamMode(slackConfig.streamMode);
     const throttleMs = resolveStreamThrottle(slackConfig.streamThrottleMs);
     const base2 = streamMode === "native" ? createNativeStreamSender({
-      client: connection.client,
+      client: connection.actingClient,
       channelId: chatId,
       threadTs,
       throttleMs,
@@ -385148,7 +386124,7 @@ class SlackPlugin extends BaseChannelPlugin {
       formatMode: options?.formatMode ?? "convert",
       logger: this.logger
     }) : createSlackStreamSender({
-      client: connection.client,
+      client: connection.actingClient,
       channelId: chatId,
       threadTs,
       streamMode,
@@ -385195,12 +386171,12 @@ class SlackPlugin extends BaseChannelPlugin {
     const status = shouldClear ? "" : options?.status ?? (type === "recording" ? "is recording..." : "is typing...");
     const timerKey = this.presenceStatusTimerKey(instanceId, chatId, threadTs);
     const delivered = status === "" ? await clearTypingStatus({
-      client: connection.client,
+      client: connection.actingClient,
       channelId: chatId,
       threadTs,
       logger: this.logger
     }) : await setSlackThreadStatus({
-      client: connection.client,
+      client: connection.actingClient,
       channelId: chatId,
       threadTs,
       status,
@@ -385216,7 +386192,7 @@ class SlackPlugin extends BaseChannelPlugin {
           return;
         this.presenceStatusTimers.delete(timerKey);
         clearTypingStatus({
-          client: connection.client,
+          client: connection.actingClient,
           channelId: chatId,
           threadTs,
           logger: this.logger
@@ -385253,21 +386229,105 @@ class SlackPlugin extends BaseChannelPlugin {
   }
   async editMessage(instanceId, channelId, messageTs, newText) {
     const connection = this.getConnection(instanceId);
-    await editSlackMessage(connection.client, channelId, messageTs, newText, "convert", this.logger);
+    await editSlackMessage(connection.actingClient, channelId, messageTs, newText, "convert", this.logger);
   }
   async deleteMessage(instanceId, channelId, messageTs) {
     const connection = this.getConnection(instanceId);
-    await deleteSlackMessage(connection.client, channelId, messageTs, this.logger);
+    await deleteSlackMessage(connection.actingClient, channelId, messageTs, this.logger);
+  }
+  async scheduleMessage(instanceId, message2, sendAt) {
+    const connection = this.getConnection(instanceId);
+    const config2 = this.slackConfigs.get(instanceId);
+    if (message2.content.type !== "text" || !message2.content.text) {
+      throw new SlackError(SlackErrorCode.SEND_FAILED, `Only text messages can be scheduled (got '${message2.content.type}') \u2014 chat.scheduleMessage carries no attachment.`);
+    }
+    const threadTs = this.resolveThreadTs(config2?.replyToMode ?? "all", message2.replyTo, message2.threadId);
+    return scheduleTextMessage(connection.actingClient, {
+      channelId: message2.to,
+      text: message2.content.text,
+      threadTs,
+      replyBroadcast: message2.metadata?.isThreadBroadcast === true,
+      username: config2?.defaultUsername,
+      iconUrl: config2?.defaultIconUrl,
+      iconEmoji: config2?.defaultIconEmoji,
+      formatMode: message2.metadata?.messageFormatMode,
+      postAt: sendAt
+    }, this.logger);
+  }
+  async openDirectMessage(instanceId, userId) {
+    const connection = this.getConnection(instanceId);
+    try {
+      const result = await connection.actingClient.conversations.open({ users: userId });
+      const channelId = result.channel?.id;
+      if (!channelId) {
+        throw new SlackError(SlackErrorCode.SEND_FAILED, `conversations.open returned no channel for user ${userId}`);
+      }
+      return channelId;
+    } catch (error) {
+      if (error instanceof SlackError)
+        throw error;
+      const message2 = error instanceof Error ? error.message : String(error);
+      throw new SlackError(SlackErrorCode.SEND_FAILED, `Failed to open DM with ${userId}: ${message2}`);
+    }
+  }
+  async searchMessages(instanceId, query, options = {}) {
+    const connection = this.getConnection(instanceId);
+    const config2 = this.slackConfigs.get(instanceId);
+    if (config2?.authMode !== "user" || !connection.userClient) {
+      throw new SlackError(SlackErrorCode.SEND_FAILED, "search.messages needs a user token (search:read); this instance runs in 'bot' auth mode");
+    }
+    try {
+      const result = await connection.userClient.search.messages({
+        query,
+        count: options.count ?? 20,
+        page: options.page ?? 1
+      });
+      const matches = result.messages?.matches ?? [];
+      return matches.map((raw) => {
+        const m2 = raw;
+        return {
+          channelId: m2.channel?.id,
+          ts: m2.ts,
+          text: m2.text,
+          permalink: m2.permalink,
+          username: m2.username
+        };
+      });
+    } catch (error) {
+      const message2 = error instanceof Error ? error.message : String(error);
+      throw new SlackError(SlackErrorCode.SEND_FAILED, `Search failed: ${message2}`);
+    }
+  }
+  async cancelScheduledMessage(instanceId, channelId, scheduledId) {
+    const connection = this.getConnection(instanceId);
+    await cancelScheduledSlackMessage(connection.actingClient, channelId, scheduledId, this.logger);
+  }
+  async getPermalink(instanceId, channelId, messageTs) {
+    const connection = this.getConnection(instanceId);
+    try {
+      const result = await connection.actingClient.chat.getPermalink({
+        channel: channelId,
+        message_ts: messageTs
+      });
+      return result.permalink ?? null;
+    } catch (error) {
+      this.logger.warn("Failed to resolve permalink", {
+        error: error instanceof Error ? error.message : String(error),
+        channelId,
+        messageTs
+      });
+      return null;
+    }
   }
   async addReaction(instanceId, channelId, messageTs, emoji) {
     const connection = this.getConnection(instanceId);
     const { addReaction: addReaction3 } = await Promise.resolve().then(() => (init_tools(), exports_tools));
-    await addReaction3(connection.client, channelId, messageTs, emoji, this.logger);
+    await addReaction3(connection.actingClient, channelId, messageTs, emoji, this.logger);
   }
   async removeReaction(instanceId, channelId, messageTs, emoji) {
     const connection = this.getConnection(instanceId);
     const { removeReaction: removeReaction3 } = await Promise.resolve().then(() => (init_tools(), exports_tools));
-    await removeReaction3(connection.client, channelId, messageTs, emoji, this.logger);
+    await removeReaction3(connection.actingClient, channelId, messageTs, emoji, this.logger);
   }
   async getProfile(instanceId) {
     const connection = this.getConnection(instanceId);
@@ -385286,7 +386346,7 @@ class SlackPlugin extends BaseChannelPlugin {
   async fetchUserProfile(instanceId, userId) {
     const connection = this.getConnection(instanceId);
     try {
-      const result = await connection.client.users.info({ user: userId });
+      const result = await connection.actingClient.users.info({ user: userId });
       const user = result.user;
       if (!user)
         return {};
@@ -385346,11 +386406,7 @@ class SlackPlugin extends BaseChannelPlugin {
     if (!channelId || !threadTs)
       return { totalFetched: 0, messages: [] };
     const botUserId = connection.botUserId;
-    const botToken = this.slackConfigs.get(instanceId)?.botToken;
-    if (!botToken) {
-      this.logger.warn("fetchHistory: no botToken for instance", { instanceId });
-      return { totalFetched: 0, messages: [] };
-    }
+    const botToken = connection.botToken;
     const limit = options.limit ?? 200;
     const messages = await this.paginateThreadHistory(connection, channelId, threadTs, botUserId, botToken, limit);
     return { totalFetched: messages.length, messages };
@@ -385359,7 +386415,7 @@ class SlackPlugin extends BaseChannelPlugin {
     const messages = [];
     let cursor;
     do {
-      const response = await connection.client.conversations.replies({
+      const response = await connection.actingClient.conversations.replies({
         channel: channelId,
         ts: threadTs,
         limit: Math.min(200, maxMessages - messages.length),
@@ -385432,7 +386488,7 @@ class SlackPlugin extends BaseChannelPlugin {
     const connection = this.getConnection(instanceId);
     const slackName = SlackPlugin.EMOJI_TO_SLACK[emoji] ?? emoji.replace(/^:|:$/g, "");
     try {
-      await connection.client.reactions.add({ channel: chatId, timestamp: messageId, name: slackName });
+      await connection.actingClient.reactions.add({ channel: chatId, timestamp: messageId, name: slackName });
     } catch (err2) {
       this.logger.warn("react: failed to add reaction", { chatId, messageId, emoji, error: String(err2) });
     }
@@ -385441,7 +386497,7 @@ class SlackPlugin extends BaseChannelPlugin {
     const connection = this.getConnection(instanceId);
     const slackName = SlackPlugin.EMOJI_TO_SLACK[emoji] ?? emoji.replace(/^:|:$/g, "");
     try {
-      await connection.client.reactions.remove({ channel: chatId, timestamp: messageId, name: slackName });
+      await connection.actingClient.reactions.remove({ channel: chatId, timestamp: messageId, name: slackName });
     } catch (err2) {
       this.logger.warn("unreact: failed to remove reaction", { chatId, messageId, emoji, error: String(err2) });
     }
@@ -385453,7 +386509,7 @@ class SlackPlugin extends BaseChannelPlugin {
     const emojiName = typeof ackEmoji === "string" ? ackEmoji.replace(/^:|:$/g, "") : null;
     if (!emojiName)
       return;
-    connection.client.reactions.add({ channel: channelId, timestamp: messageTs, name: emojiName }).catch((err2) => {
+    connection.actingClient.reactions.add({ channel: channelId, timestamp: messageTs, name: emojiName }).catch((err2) => {
       this.logger.warn("ack reaction: failed to add", { channelId, messageTs, emoji: emojiName, error: String(err2) });
     });
     if (config2.removeAckAfterReply !== false) {
@@ -385472,7 +386528,7 @@ class SlackPlugin extends BaseChannelPlugin {
       if (!emojiName)
         continue;
       this.pendingAckReactions.delete(key);
-      connection.client.reactions.remove({ channel: channelId, timestamp: ts, name: emojiName }).catch((err2) => {
+      connection.actingClient.reactions.remove({ channel: channelId, timestamp: ts, name: emojiName }).catch((err2) => {
         this.logger.warn("ack reaction: failed to remove", { channelId, ts, emoji: emojiName, error: String(err2) });
       });
       break;
@@ -385486,7 +386542,7 @@ class SlackPlugin extends BaseChannelPlugin {
     if (!resolvedThread)
       return;
     await clearTypingStatus({
-      client: connection.client,
+      client: connection.actingClient,
       channelId,
       threadTs: resolvedThread,
       logger: this.logger
@@ -385532,14 +386588,16 @@ class SlackPlugin extends BaseChannelPlugin {
   async buildEnrichedPayload(instanceId, from, rawPayload) {
     const displayName = await this.resolveUserDisplayName(instanceId, from);
     const isDm = rawPayload.isDm;
-    const chatName = isDm ? displayName : undefined;
+    const isMpim = rawPayload.isMpim === true;
+    const isOneToOne = isDm && !isMpim;
+    const chatName = isOneToOne ? displayName : undefined;
     return {
       ...rawPayload,
       displayName,
       senderName: displayName,
       pushName: displayName,
       chatName,
-      isGroup: !isDm
+      isGroup: !isOneToOne
     };
   }
   async dispatchMessageFromDebounce(instanceId, args) {
@@ -385570,7 +386628,7 @@ class SlackPlugin extends BaseChannelPlugin {
       },
       onDmRejected: async (_instId, channelId, _userId, message2) => {
         try {
-          await sendTextMessage2(connection.client, {
+          await sendTextMessage2(connection.actingClient, {
             channelId,
             text: message2,
             formatMode: "passthrough"
@@ -385587,7 +386645,7 @@ class SlackPlugin extends BaseChannelPlugin {
       channelAllowlist: config2.channelAllowlist,
       channelBlocklist: config2.channelBlocklist,
       channels: config2.channels
-    }, reliability);
+    }, reliability, () => connection.actingUserId);
     setupReactionHandlers2(connection.app, instanceId, () => connection.botUserId, {
       onReaction: async (instId, messageId, chatId, userId, emoji, action) => {
         await this.handleReactionReceived(instId, messageId, chatId, userId, emoji, action);
@@ -385627,7 +386685,7 @@ class SlackPlugin extends BaseChannelPlugin {
     const formatMode = message2.metadata?.messageFormatMode ?? "convert";
     const replyToMode = config2.replyToMode ?? "all";
     const threadTs = this.resolveThreadTs(replyToMode, message2.replyTo, message2.threadId);
-    return sendTextMessage2(connection.client, {
+    return sendTextMessage2(connection.actingClient, {
       channelId,
       text: message2.content.text ?? "",
       threadTs,
@@ -385645,7 +386703,7 @@ class SlackPlugin extends BaseChannelPlugin {
     if (message2.metadata?.base64) {
       const buffer2 = Buffer.from(message2.metadata.base64, "base64");
       const filename = message2.content.filename || `file-${Date.now()}`;
-      return uploadFile(connection.client, {
+      return uploadFile(connection.actingClient, {
         channelId,
         content: buffer2,
         filename,
@@ -385656,7 +386714,7 @@ class SlackPlugin extends BaseChannelPlugin {
     if (!message2.content.mediaUrl) {
       throw new SlackError(SlackErrorCode.SEND_FAILED, "Media URL or base64 required");
     }
-    return uploadFileFromUrl(connection.client, {
+    return uploadFileFromUrl(connection.actingClient, {
       channelId,
       url: message2.content.mediaUrl,
       filename: message2.content.filename || `file-${Date.now()}`,
@@ -385671,7 +386729,7 @@ class SlackPlugin extends BaseChannelPlugin {
       throw new SlackError(SlackErrorCode.SEND_FAILED, "Reaction requires emoji and target message");
     }
     const { addReaction: addReaction3 } = await Promise.resolve().then(() => (init_tools(), exports_tools));
-    await addReaction3(connection.client, channelId, targetTs, emoji, this.logger);
+    await addReaction3(connection.actingClient, channelId, targetTs, emoji, this.logger);
     return targetTs;
   }
   async handleInboundFiles(instanceId, externalId, chatId, from, content, replyToId, rawPayload, platformTimestamp) {
@@ -385697,6 +386755,7 @@ class SlackPlugin extends BaseChannelPlugin {
     const timings = platformTimestamp ? this.captureInboundTimings(platformTimestamp) : undefined;
     const senderName = typeof rawPayload.senderName === "string" ? rawPayload.senderName : typeof rawPayload.displayName === "string" ? rawPayload.displayName : undefined;
     const chatName = typeof rawPayload.chatName === "string" ? rawPayload.chatName : undefined;
+    const threadTs = typeof rawPayload.threadTs === "string" ? rawPayload.threadTs : undefined;
     const correlationId = await this.emitMessageReceived({
       instanceId,
       externalId,
@@ -385705,7 +386764,7 @@ class SlackPlugin extends BaseChannelPlugin {
       senderName,
       chatName,
       content,
-      replyToId,
+      threadId: threadTs,
       rawPayload,
       timings
     });
@@ -387055,14 +388114,14 @@ var protectedSplitters = {
   expandable_blockquote: trySplitBlockquote,
   plain: () => null
 };
-function splitLongProtectedSegment(segment, maxLength) {
-  if (segment.value.length <= maxLength)
-    return [segment.value];
-  const splitter = protectedSplitters[segment.type];
-  const result = splitter(segment.value, maxLength);
+function splitLongProtectedSegment(segment2, maxLength) {
+  if (segment2.value.length <= maxLength)
+    return [segment2.value];
+  const splitter = protectedSplitters[segment2.type];
+  const result = splitter(segment2.value, maxLength);
   if (result)
     return result;
-  return splitPlainByBoundaries(segment.value, maxLength);
+  return splitPlainByBoundaries(segment2.value, maxLength);
 }
 function findNextProtected(html, from) {
   const patterns = [
@@ -387146,12 +388205,12 @@ class ChunkAccumulator {
     return this.chunks.length > 0 ? this.chunks : [""];
   }
 }
-function processPlainSegment(acc, segment, maxLength) {
-  const plainParts = splitPlainHtmlPreservingTags(segment.value, maxLength);
+function processPlainSegment(acc, segment2, maxLength) {
+  const plainParts = splitPlainHtmlPreservingTags(segment2.value, maxLength);
   acc.appendParts(plainParts);
 }
-function processProtectedSegment(acc, segment, maxLength) {
-  const protectedParts = splitLongProtectedSegment(segment, maxLength);
+function processProtectedSegment(acc, segment2, maxLength) {
+  const protectedParts = splitLongProtectedSegment(segment2, maxLength);
   for (const part of protectedParts) {
     if (part.length > maxLength) {
       const hardParts = splitPlainByBoundaries(part, maxLength);
@@ -387166,11 +388225,11 @@ function splitHtmlMessage(html, maxLength = 4096) {
     return [html];
   const segments = segmentHtml(html);
   const acc = new ChunkAccumulator(maxLength);
-  for (const segment of segments) {
-    if (segment.type === "plain") {
-      processPlainSegment(acc, segment, maxLength);
+  for (const segment2 of segments) {
+    if (segment2.type === "plain") {
+      processPlainSegment(acc, segment2, maxLength);
     } else {
-      processProtectedSegment(acc, segment, maxLength);
+      processProtectedSegment(acc, segment2, maxLength);
     }
   }
   return acc.result();
@@ -477591,6 +478650,7 @@ for (const [i, DOUBLE_BYTE_TOKEN] of DOUBLE_BYTE_TOKENS.entries()) {
 
 // ../../node_modules/.bun/baileys@vendor+baileys-v7.0.0-rc10.tgz+89588f7e3fe8b2e6/node_modules/baileys/lib/WABinary/jid-utils.js
 var S_WHATSAPP_NET = "@s.whatsapp.net";
+var SERVER_JID = "server@c.us";
 var PSA_WID = "0@c.us";
 var WAJIDDomains;
 (function(WAJIDDomains2) {
@@ -490823,6 +491883,181 @@ function buildAckStanza(node, errorCode, meId) {
   }
   return stanza;
 }
+// ../../node_modules/.bun/baileys@vendor+baileys-v7.0.0-rc10.tgz+89588f7e3fe8b2e6/node_modules/baileys/lib/Utils/passkey.js
+var BASE64URL_PATTERN = /^[A-Za-z0-9_-]+$/;
+var PASSKEY_HANDOFF_INFO = "shortcake-passkey-handoff-v1";
+var PAIRING_ENCRYPTION_INFO = "Pairing Information Encryption Key";
+var assertBase64Url = (value, field, nullable = false) => {
+  if (nullable && value === null) {
+    return null;
+  }
+  if (typeof value !== "string" || !value || !BASE64URL_PATTERN.test(value)) {
+    throw new Error(`Invalid ${field} in passkey payload`);
+  }
+  return value;
+};
+var parseAllowedCredentials = (value) => {
+  if (value === undefined) {
+    return;
+  }
+  if (!Array.isArray(value)) {
+    throw new Error("Invalid allowCredentials in passkey request");
+  }
+  return value.map((credential, index) => {
+    if (!credential || typeof credential !== "object") {
+      throw new Error(`Invalid allowCredentials[${index}] in passkey request`);
+    }
+    const candidate = credential;
+    if (typeof candidate.type !== "string" || !candidate.type) {
+      throw new Error(`Invalid allowCredentials[${index}].type in passkey request`);
+    }
+    if (candidate.transports !== undefined && (!Array.isArray(candidate.transports) || candidate.transports.some((item) => typeof item !== "string"))) {
+      throw new Error(`Invalid allowCredentials[${index}].transports in passkey request`);
+    }
+    return {
+      id: assertBase64Url(candidate.id, `allowCredentials[${index}].id`),
+      type: candidate.type,
+      ...candidate.transports ? { transports: candidate.transports } : {}
+    };
+  });
+};
+var parsePasskeyRequestOptions = (content) => {
+  let parsed;
+  try {
+    parsed = JSON.parse(content.toString("utf8"));
+  } catch {
+    throw new Error("WhatsApp sent malformed passkey request JSON");
+  }
+  if (!parsed || typeof parsed !== "object") {
+    throw new Error("WhatsApp sent an invalid passkey request");
+  }
+  const value = parsed;
+  if (typeof value.rpId !== "string" || value.rpId !== "whatsapp.com") {
+    throw new Error("WhatsApp sent an unexpected passkey relying party");
+  }
+  if (value.timeout !== undefined && (typeof value.timeout !== "number" || value.timeout <= 0)) {
+    throw new Error("WhatsApp sent an invalid passkey timeout");
+  }
+  if (value.userVerification !== undefined && typeof value.userVerification !== "string") {
+    throw new Error("WhatsApp sent an invalid passkey user verification mode");
+  }
+  if (value.extensions !== undefined && (!value.extensions || typeof value.extensions !== "object")) {
+    throw new Error("WhatsApp sent invalid passkey extensions");
+  }
+  return {
+    challenge: assertBase64Url(value.challenge, "challenge"),
+    rpId: value.rpId,
+    ...value.timeout === undefined ? {} : { timeout: value.timeout },
+    ...value.allowCredentials === undefined ? {} : { allowCredentials: parseAllowedCredentials(value.allowCredentials) },
+    ...value.userVerification === undefined ? {} : { userVerification: value.userVerification },
+    ...value.extensions === undefined ? {} : { extensions: value.extensions }
+  };
+};
+var parsePasskeyCredentialResponse = (input) => {
+  if (!input || typeof input !== "object") {
+    throw new Error("Invalid passkey credential response");
+  }
+  const value = input;
+  if (value.type !== "public-key") {
+    throw new Error("Invalid passkey credential type");
+  }
+  if (!value.response || typeof value.response !== "object") {
+    throw new Error("Invalid passkey authenticator response");
+  }
+  const response = value.response;
+  return {
+    id: assertBase64Url(value.id, "credential id"),
+    rawId: assertBase64Url(value.rawId, "raw credential id"),
+    type: value.type,
+    response: {
+      clientDataJSON: assertBase64Url(response.clientDataJSON, "clientDataJSON"),
+      authenticatorData: assertBase64Url(response.authenticatorData, "authenticatorData"),
+      signature: assertBase64Url(response.signature, "signature"),
+      userHandle: assertBase64Url(response.userHandle, "userHandle", true)
+    }
+  };
+};
+var getPasskeyDeviceType = (browser) => {
+  const browserName = browser[1].toLowerCase();
+  if (browserName.includes("firefox"))
+    return proto.DeviceProps.PlatformType.FIREFOX;
+  if (browserName.includes("edge"))
+    return proto.DeviceProps.PlatformType.EDGE;
+  if (browserName.includes("opera"))
+    return proto.DeviceProps.PlatformType.OPERA;
+  if (browserName.includes("safari"))
+    return proto.DeviceProps.PlatformType.SAFARI;
+  return proto.DeviceProps.PlatformType.CHROME;
+};
+var derivePasskeyHandoffKey = (advSecretKey) => Buffer.from(hkdf(Buffer.from(advSecretKey, "base64"), 32, { info: PASSKEY_HANDOFF_INFO }));
+var buildPasskeyPrologue = ({ credential, pairingRef, browser, handoffKey, keyPair = Curve.generateKeyPair(), companionNonce }) => {
+  if (companionNonce.length !== 32) {
+    throw new Error("Passkey companion nonce must contain 32 bytes");
+  }
+  const deviceType = getPasskeyDeviceType(browser);
+  const identity = Buffer.from(proto.CompanionEphemeralIdentity.encode({
+    publicKey: keyPair.public,
+    deviceType,
+    ref: pairingRef
+  }).finish());
+  const commitment = sha256(Buffer.concat([identity, companionNonce]));
+  const payload = Buffer.from(proto.ProloguePayload.encode({
+    companionEphemeralIdentity: identity,
+    commitment: { hash: commitment }
+  }).finish());
+  const content = [
+    { tag: "credential_id", attrs: {}, content: Buffer.from(credential.rawId, "base64url") },
+    { tag: "webauthn_assertion", attrs: {}, content: Buffer.from(JSON.stringify(credential), "utf8") },
+    { tag: "prologue_payload", attrs: {}, content: payload }
+  ];
+  if (handoffKey) {
+    content.push({ tag: "pairing_handoff_proof", attrs: {}, content: hmacSign(payload, handoffKey) });
+  }
+  return {
+    content,
+    payload,
+    cache: { keyPair, companionNonce, pairingRef, deviceType },
+    skipHandoffUX: Boolean(handoffKey)
+  };
+};
+var continuePasskeyPairing = ({ cache: cache2, primaryIdentity }) => {
+  const publicKey = primaryIdentity.publicKey ? Buffer.from(primaryIdentity.publicKey) : undefined;
+  const nonce = primaryIdentity.nonce ? Buffer.from(primaryIdentity.nonce) : undefined;
+  if (!publicKey || publicKey.length !== 32) {
+    throw new Error("Invalid primary passkey public key");
+  }
+  if (!nonce || nonce.length !== 32) {
+    throw new Error("Invalid primary passkey nonce");
+  }
+  const sharedSecret = Curve.sharedKey(cache2.keyPair.private, publicKey);
+  const salt = `Companion Pairing ${cache2.deviceType} with ref ${cache2.pairingRef}`;
+  const encryptionKey = Buffer.from(hkdf(sharedSecret, 32, { salt: Buffer.from(salt, "utf8"), info: PAIRING_ENCRYPTION_INFO }));
+  const digest = sha256(Buffer.concat([cache2.companionNonce, publicKey]));
+  const codeBytes = Buffer.alloc(5);
+  for (let index = 0;index < codeBytes.length; index += 1) {
+    codeBytes[index] = nonce[index] ^ digest[index];
+  }
+  const encodedCode = bytesToCrockford(codeBytes);
+  return {
+    cache: { ...cache2, encryptionKey },
+    code: `${encodedCode.slice(0, 4)}-${encodedCode.slice(4)}`
+  };
+};
+var buildEncryptedPasskeyPairingRequest = ({ cache: cache2, noisePublicKey, identityPublicKey, advSecretKey, iv }) => {
+  if (!cache2.encryptionKey) {
+    throw new Error("Passkey confirmation is not ready");
+  }
+  if (iv.length !== 12) {
+    throw new Error("Passkey encryption IV must contain 12 bytes");
+  }
+  const request = Buffer.from(proto.PairingRequest.encode({
+    companionPublicKey: noisePublicKey,
+    companionIdentityKey: identityPublicKey,
+    advSecret: Buffer.from(advSecretKey, "base64")
+  }).finish());
+  const encryptedPayload = aesEncryptGCM(request, cache2.encryptionKey, iv, Buffer.alloc(0));
+  return Buffer.from(proto.EncryptedPairingRequest.encode({ encryptedPayload, iv }).finish());
+};
 // ../../node_modules/.bun/baileys@vendor+baileys-v7.0.0-rc10.tgz+89588f7e3fe8b2e6/node_modules/baileys/lib/Signal/Group/sender-key-name.js
 function isNull(str) {
   return str === null || str === "";
@@ -490874,14 +492109,14 @@ class SenderKeyName2 {
 }
 
 // ../../node_modules/.bun/baileys@vendor+baileys-v7.0.0-rc10.tgz+89588f7e3fe8b2e6/node_modules/baileys/lib/Signal/Group/sender-chain-key.js
-var import_crypto18 = __toESM(require_crypto(), 1);
+var import_crypto19 = __toESM(require_crypto(), 1);
 
 // ../../node_modules/.bun/baileys@vendor+baileys-v7.0.0-rc10.tgz+89588f7e3fe8b2e6/node_modules/baileys/lib/Signal/Group/sender-message-key.js
-var import_crypto17 = __toESM(require_crypto(), 1);
+var import_crypto18 = __toESM(require_crypto(), 1);
 
 class SenderMessageKey {
   constructor(iteration, seed) {
-    const derivative = import_crypto17.deriveSecrets(seed, Buffer.alloc(32), Buffer.from("WhisperGroup"));
+    const derivative = import_crypto18.deriveSecrets(seed, Buffer.alloc(32), Buffer.from("WhisperGroup"));
     const keys = new Uint8Array(32);
     keys.set(new Uint8Array(derivative[0].slice(16)));
     keys.set(new Uint8Array(derivative[1].slice(0, 16)), 16);
@@ -490925,7 +492160,7 @@ class SenderChainKey {
     return this.chainKey;
   }
   getDerivative(seed, key) {
-    return import_crypto18.calculateMAC(key, seed);
+    return import_crypto19.calculateMAC(key, seed);
   }
 }
 
@@ -491162,7 +492397,7 @@ class GroupSessionBuilder2 {
   }
 }
 // ../../node_modules/.bun/baileys@vendor+baileys-v7.0.0-rc10.tgz+89588f7e3fe8b2e6/node_modules/baileys/lib/Signal/Group/group_cipher.js
-var import_crypto19 = __toESM(require_crypto(), 1);
+var import_crypto20 = __toESM(require_crypto(), 1);
 
 // ../../node_modules/.bun/baileys@vendor+baileys-v7.0.0-rc10.tgz+89588f7e3fe8b2e6/node_modules/baileys/lib/Signal/Group/sender-key-message.js
 var import_curve2 = __toESM(require_curve2(), 1);
@@ -491287,14 +492522,14 @@ class GroupCipher2 {
   }
   async getPlainText(iv, key, ciphertext) {
     try {
-      return import_crypto19.decrypt(key, ciphertext, iv);
+      return import_crypto20.decrypt(key, ciphertext, iv);
     } catch (e) {
       throw new Error("InvalidMessageException");
     }
   }
   async getCipherText(iv, key, plaintext) {
     try {
-      return import_crypto19.encrypt(key, plaintext, iv);
+      return import_crypto20.encrypt(key, plaintext, iv);
     } catch (e) {
       throw new Error("InvalidMessageException");
     }
@@ -493982,6 +495217,9 @@ var makeSocket = (config2) => {
   let epoch = 1;
   let keepAliveReq;
   let qrTimer;
+  let passkeyHandoff;
+  let passkeyLinkingCache;
+  let passkeySkipHandoffUX = false;
   let closed = false;
   const socketEndHandlers = [];
   const onUnexpectedError = (err2, msg) => {
@@ -494337,6 +495575,156 @@ var makeSocket = (config2) => {
     const ciphered = aesEncryptCTR(authState.creds.pairingEphemeralKeyPair.public, key, randomIv);
     return Buffer.concat([salt, randomIv, ciphered]);
   }
+  const getPasskeyRequestOptions = async (notification) => {
+    let optionsNode = notification ? getBinaryNodeChild(notification, "passkey_request_options") : undefined;
+    if (!optionsNode) {
+      const response = await query({
+        tag: "iq",
+        attrs: {
+          to: S_WHATSAPP_NET,
+          type: "get",
+          xmlns: "md"
+        },
+        content: [{ tag: "passkey_request_options", attrs: {} }]
+      });
+      optionsNode = getBinaryNodeChild(response, "passkey_request_options");
+    }
+    if (!optionsNode?.content || Array.isArray(optionsNode.content)) {
+      throw new Error("Passkey request did not contain public key options");
+    }
+    return parsePasskeyRequestOptions(Buffer.from(optionsNode.content));
+  };
+  const handlePasskeyRequest = async (notification) => {
+    if (notification.attrs.from !== S_WHATSAPP_NET && notification.attrs.from !== SERVER_JID) {
+      logger5.warn({ from: notification.attrs.from }, "ignored passkey request from unexpected sender");
+      return;
+    }
+    try {
+      const publicKey = await getPasskeyRequestOptions(notification);
+      clearTimeout(qrTimer);
+      passkeyHandoff = {
+        key: derivePasskeyHandoffKey(creds.advSecretKey),
+        createdAt: Date.now()
+      };
+      creds.advSecretKey = randomBytes9(32).toString("base64");
+      ev.emit("creds.update", { advSecretKey: creds.advSecretKey });
+      ev.emit("connection.update", {
+        qr: undefined,
+        passkey: { state: "request", publicKey }
+      });
+    } catch (error) {
+      const message2 = error instanceof Error ? error.message : "Unable to process passkey request";
+      logger5.warn({ err: error }, "failed to process passkey request");
+      ev.emit("connection.update", {
+        passkey: { state: "error", phase: "request", message: message2 }
+      });
+    }
+  };
+  const sendPasskeyResponse = async (input) => {
+    const credential = parsePasskeyCredentialResponse(input);
+    const refResponse = await query({
+      tag: "iq",
+      attrs: {
+        to: S_WHATSAPP_NET,
+        type: "get",
+        xmlns: "md"
+      },
+      content: [{ tag: "ref", attrs: {} }]
+    });
+    const refNode = getBinaryNodeChild(refResponse, "ref");
+    if (!refNode?.content || Array.isArray(refNode.content)) {
+      throw new Error("WhatsApp did not provide a companion reference");
+    }
+    const handoffKey = passkeyHandoff && Date.now() - passkeyHandoff.createdAt < 5 * 60000 ? passkeyHandoff.key : undefined;
+    const prologue = buildPasskeyPrologue({
+      credential,
+      pairingRef: Buffer.from(refNode.content).toString("utf8"),
+      browser,
+      handoffKey,
+      companionNonce: randomBytes9(32)
+    });
+    passkeyLinkingCache = prologue.cache;
+    passkeySkipHandoffUX = prologue.skipHandoffUX;
+    await query({
+      tag: "iq",
+      attrs: {
+        to: S_WHATSAPP_NET,
+        type: "set",
+        xmlns: "md"
+      },
+      content: [{ tag: "passkey_prologue", attrs: {}, content: prologue.content }]
+    });
+    passkeyHandoff = undefined;
+  };
+  const handlePasskeyContinuation = async (notification) => {
+    if (notification.attrs.from !== S_WHATSAPP_NET && notification.attrs.from !== SERVER_JID) {
+      logger5.warn({ from: notification.attrs.from }, "ignored passkey continuation from unexpected sender");
+      return;
+    }
+    try {
+      if (!passkeyLinkingCache) {
+        throw new Error("Passkey continuation arrived without an active ceremony");
+      }
+      const identityNode = getBinaryNodeChild(notification, "primary_ephemeral_identity");
+      if (!identityNode?.content || Array.isArray(identityNode.content)) {
+        throw new Error("Passkey continuation did not contain a primary identity");
+      }
+      const primaryIdentity = proto.PrimaryEphemeralIdentity.decode(Buffer.from(identityNode.content));
+      const continuation = continuePasskeyPairing({ cache: passkeyLinkingCache, primaryIdentity });
+      passkeyLinkingCache = continuation.cache;
+      await query({
+        tag: "iq",
+        attrs: {
+          to: S_WHATSAPP_NET,
+          type: "set",
+          xmlns: "md"
+        },
+        content: [
+          {
+            tag: "companion_nonce",
+            attrs: {},
+            content: passkeyLinkingCache.companionNonce
+          }
+        ]
+      });
+      ev.emit("connection.update", {
+        passkey: {
+          state: "confirmation",
+          code: continuation.code,
+          skipHandoffUX: passkeySkipHandoffUX
+        }
+      });
+    } catch (error) {
+      const message2 = error instanceof Error ? error.message : "Unable to continue passkey pairing";
+      logger5.warn({ err: error }, "failed to process passkey continuation");
+      ev.emit("connection.update", {
+        passkey: { state: "error", phase: "continuation", message: message2 }
+      });
+    }
+  };
+  const sendPasskeyConfirmation = async () => {
+    if (!passkeyLinkingCache) {
+      throw new Error("No passkey confirmation is pending");
+    }
+    const encryptedRequest = buildEncryptedPasskeyPairingRequest({
+      cache: passkeyLinkingCache,
+      noisePublicKey: creds.noiseKey.public,
+      identityPublicKey: creds.signedIdentityKey.public,
+      advSecretKey: creds.advSecretKey,
+      iv: randomBytes9(12)
+    });
+    await query({
+      tag: "iq",
+      attrs: {
+        to: S_WHATSAPP_NET,
+        type: "set",
+        xmlns: "md"
+      },
+      content: [{ tag: "encrypted_pairing_request", attrs: {}, content: encryptedRequest }]
+    });
+    passkeyLinkingCache = undefined;
+    passkeySkipHandoffUX = false;
+  };
   const sendWAMBuffer = (wamBuffer) => {
     return query({
       tag: "iq",
@@ -494366,6 +495754,12 @@ var makeSocket = (config2) => {
   ws.on("error", mapWebSocketError(end));
   ws.on("close", () => void end(new import_boom14.Boom("Connection Terminated", { statusCode: DisconnectReason.connectionClosed })));
   ws.on("CB:xmlstreamend", () => void end(new import_boom14.Boom("Connection Terminated by Server", { statusCode: DisconnectReason.connectionClosed })));
+  ws.on("CB:notification,type:passkey_prologue_request", (notification) => {
+    handlePasskeyRequest(notification);
+  });
+  ws.on("CB:notification,type:crsc_continuation", (notification) => {
+    handlePasskeyContinuation(notification);
+  });
   ws.on("CB:iq,type:set,pair-device", async (stanza) => {
     const iq = {
       tag: "iq",
@@ -494593,6 +495987,8 @@ var makeSocket = (config2) => {
     digestKeyBundle,
     rotateSignedPreKey,
     requestPairingCode,
+    sendPasskeyResponse,
+    sendPasskeyConfirmation,
     updateServerTimeOffset,
     sendUnifiedSession,
     wamBuffer: publicWAMBuffer,
@@ -500123,6 +501519,7 @@ var MAX_QR_ATTEMPTS = 3;
 var qrCycleAttempts = new Map;
 var MAX_QR_CYCLES = 2;
 var activeQrCodes = new Map;
+var passkeyInstances = new Set;
 var connectionTimeouts = new Map;
 var CONNECTION_TIMEOUT_MS = 45000;
 var authenticatedInstances = new Set;
@@ -500219,6 +501616,7 @@ async function handleConnectionClose(plugin7, instanceId, lastDisconnect, config
     qrCodeAttempts.delete(instanceId);
     qrCycleAttempts.delete(instanceId);
     authenticatedInstances.delete(instanceId);
+    passkeyInstances.delete(instanceId);
     cancelPendingReconnect(instanceId);
     await plugin7.handleDisconnected(instanceId, "Logged out from WhatsApp", false);
     return;
@@ -500266,6 +501664,7 @@ async function handleConnectionOpen(plugin7, instanceId, sock) {
   qrCodeAttempts.delete(instanceId);
   qrCycleAttempts.delete(instanceId);
   activeQrCodes.delete(instanceId);
+  passkeyInstances.delete(instanceId);
   clearConnectionTimeout(instanceId);
   authenticatedInstances.add(instanceId);
   log51.info("Connection opened", { instanceId });
@@ -500273,8 +501672,16 @@ async function handleConnectionOpen(plugin7, instanceId, sock) {
 }
 function setupConnectionHandlers2(sock, plugin7, instanceId, onReconnect, clearAuthAndReconnect, config2 = DEFAULT_RECONNECT_CONFIG2) {
   sock.ev.on("connection.update", async (update) => {
-    const { connection, lastDisconnect, qr } = update;
-    if (qr) {
+    const { connection, lastDisconnect, passkey: passkey2, qr } = update;
+    if (passkey2) {
+      passkeyInstances.add(instanceId);
+      activeQrCodes.delete(instanceId);
+      qrCodeAttempts.delete(instanceId);
+      qrCycleAttempts.delete(instanceId);
+      clearConnectionTimeout(instanceId);
+      await plugin7.handlePasskeyUpdate(instanceId, passkey2);
+    }
+    if (qr && !passkey2 && !passkeyInstances.has(instanceId)) {
       const shouldContinue = await handleQrCode(plugin7, instanceId, qr, clearAuthAndReconnect);
       if (!shouldContinue) {
         return;
@@ -500301,6 +501708,7 @@ function resetConnectionState2(instanceId) {
   qrCodeAttempts.delete(instanceId);
   qrCycleAttempts.delete(instanceId);
   activeQrCodes.delete(instanceId);
+  passkeyInstances.delete(instanceId);
   authenticatedInstances.delete(instanceId);
   clearConnectionTimeout(instanceId);
   cancelPendingReconnect(instanceId);
@@ -500492,6 +501900,77 @@ function getMediaSize(msg) {
 var log52 = createLogger("whatsapp:messages");
 var fallbackDedupeCache3 = createInboundDedupeCache();
 var downloadGuard6 = createDownloadGuard({ maxSizeBytes: getWhatsAppMediaDownloadMaxBytes() });
+function joinLines(...parts) {
+  const text = parts.filter((p2) => typeof p2 === "string" && p2.trim().length > 0).join(`
+`);
+  return text.length > 0 ? text : undefined;
+}
+function bracketButtons(labels) {
+  const clean = labels.filter((l) => typeof l === "string" && l.trim().length > 0);
+  return clean.length > 0 ? clean.map((l) => `[${l.trim()}]`).join(" ") : undefined;
+}
+function extractListMessageText(list) {
+  const rows = (list.sections ?? []).flatMap((s) => (s.rows ?? []).map((r) => r.title ? `\u2022 ${r.title}` : ""));
+  return joinLines(list.title, list.description, ...rows, list.footerText);
+}
+function extractButtonsMessageText(bm) {
+  const labels = bracketButtons((bm.buttons ?? []).map((b2) => b2.buttonText?.displayText));
+  return joinLines(bm.contentText ?? bm.text, bm.footerText, labels);
+}
+function extractInteractiveMessageText(im) {
+  const labels = bracketButtons((im.nativeFlowMessage?.buttons ?? []).map((b2) => b2.name));
+  return joinLines(im.header?.title, im.header?.subtitle, im.body?.text, im.footer?.text, labels);
+}
+function extractTemplateMessageText(tpl) {
+  const hydrated = tpl.hydratedTemplate ?? tpl.hydratedFourRowTemplate;
+  if (hydrated) {
+    const labels = bracketButtons((hydrated.hydratedButtons ?? []).map((b2) => b2.quickReplyButton?.displayText ?? b2.urlButton?.displayText ?? b2.callButton?.displayText));
+    return joinLines(hydrated.hydratedTitleText, hydrated.hydratedContentText, hydrated.hydratedFooterText, labels);
+  }
+  return tpl.interactiveMessageTemplate ? extractInteractiveMessageText(tpl.interactiveMessageTemplate) : undefined;
+}
+function extractInteractiveMediaHeader(container, caption) {
+  if (container.imageMessage) {
+    return {
+      type: "image",
+      caption: caption ?? container.imageMessage.caption ?? undefined,
+      mimeType: container.imageMessage.mimetype ?? "image/jpeg",
+      mediaUrl: container.imageMessage.url ?? undefined
+    };
+  }
+  if (container.videoMessage) {
+    return {
+      type: "video",
+      caption: caption ?? container.videoMessage.caption ?? undefined,
+      mimeType: container.videoMessage.mimetype ?? "video/mp4",
+      mediaUrl: container.videoMessage.url ?? undefined
+    };
+  }
+  if (container.documentMessage) {
+    return {
+      type: "document",
+      filename: container.documentMessage.fileName ?? undefined,
+      caption: caption ?? container.documentMessage.caption ?? undefined,
+      mimeType: container.documentMessage.mimetype ?? "application/octet-stream",
+      mediaUrl: container.documentMessage.url ?? undefined
+    };
+  }
+  return null;
+}
+function extractButtonsMessage(bm) {
+  const text = extractButtonsMessageText(bm);
+  return extractInteractiveMediaHeader(bm, text) ?? { type: "text", text };
+}
+function extractInteractiveMessage(im) {
+  const text = extractInteractiveMessageText(im);
+  return extractInteractiveMediaHeader(im.header ?? {}, text) ?? { type: "text", text };
+}
+function extractTemplateMessage(tpl) {
+  const text = extractTemplateMessageText(tpl);
+  const hydrated = tpl.hydratedTemplate ?? tpl.hydratedFourRowTemplate;
+  const media = hydrated ? extractInteractiveMediaHeader(hydrated, text) : null;
+  return media ?? { type: "text", text };
+}
 var contentExtractors = [
   {
     check: (m2) => !!m2.conversation,
@@ -500695,6 +502174,25 @@ var contentExtractors = [
       text: m2.buttonsResponseMessage?.selectedDisplayText ?? m2.buttonsResponseMessage?.selectedButtonId ?? undefined
     })
   },
+  {
+    check: (m2) => !!m2.listMessage,
+    extract: (m2) => ({
+      type: "text",
+      text: m2.listMessage ? extractListMessageText(m2.listMessage) : undefined
+    })
+  },
+  {
+    check: (m2) => !!m2.buttonsMessage,
+    extract: (m2) => m2.buttonsMessage ? extractButtonsMessage(m2.buttonsMessage) : null
+  },
+  {
+    check: (m2) => !!m2.interactiveMessage,
+    extract: (m2) => m2.interactiveMessage ? extractInteractiveMessage(m2.interactiveMessage) : null
+  },
+  {
+    check: (m2) => !!m2.templateMessage,
+    extract: (m2) => m2.templateMessage ? extractTemplateMessage(m2.templateMessage) : null
+  },
   {
     check: (m2) => !!m2.senderKeyDistributionMessage,
     extract: () => null
@@ -501499,9 +502997,9 @@ function splitWhatsAppMessage(text, maxLength = DEFAULT_MAX_LENGTH2) {
     flushCurrent();
     current = piece;
   };
-  for (const segment of segments) {
-    if (segment.type === "text") {
-      const paragraphUnits = splitByDelimiter(segment.value, `
+  for (const segment2 of segments) {
+    if (segment2.type === "text") {
+      const paragraphUnits = splitByDelimiter(segment2.value, `
 
 `);
       const textPieces = packUnits(paragraphUnits, maxLength);
@@ -501510,12 +503008,12 @@ function splitWhatsAppMessage(text, maxLength = DEFAULT_MAX_LENGTH2) {
       }
       continue;
     }
-    if (segment.value.length <= maxLength) {
-      appendPiece(segment.value);
+    if (segment2.value.length <= maxLength) {
+      appendPiece(segment2.value);
       continue;
     }
     flushCurrent();
-    const splitCode = splitHugeCodeBlock(segment.value, maxLength);
+    const splitCode = splitHugeCodeBlock(segment2.value, maxLength);
     for (const piece of splitCode) {
       appendPiece(piece);
     }
@@ -502131,6 +503629,7 @@ class WhatsAppPlugin extends BaseChannelPlugin {
   version = "1.0.0";
   capabilities = WHATSAPP_CAPABILITIES;
   sockets = new Map;
+  passkeyStates = new Map;
   pluginConfig = {};
   historySyncCallbacks = new Map;
   historyPushFetchCount = new Map;
@@ -502496,6 +503995,7 @@ class WhatsAppPlugin extends BaseChannelPlugin {
   async onInitialize(_context) {}
   async connect(instanceId, config2) {
     if (config2.options?.forceNewQr === true) {
+      this.passkeyStates.delete(instanceId);
       const existingSocket = this.sockets.get(instanceId);
       if (existingSocket) {
         existingSocket.ev.removeAllListeners("connection.update");
@@ -502589,6 +504089,7 @@ class WhatsAppPlugin extends BaseChannelPlugin {
     await this.emitInstanceDisconnected(instanceId, "User requested disconnect");
   }
   clearInstanceCaches(instanceId) {
+    this.passkeyStates.delete(instanceId);
     this.groupMetadataCache.delete(instanceId);
     this.groupsCache.delete(instanceId);
     this.contactsCache.delete(instanceId);
@@ -502632,6 +504133,91 @@ class WhatsAppPlugin extends BaseChannelPlugin {
       throw new WhatsAppError(ErrorCode2.PAIRING_FAILED, `Failed to request pairing code: ${message2}`);
     }
   }
+  getPasskeyState(instanceId) {
+    return this.passkeyStates.get(instanceId) ?? null;
+  }
+  async submitPasskeyResponse(instanceId, credential) {
+    const sock = this.sockets.get(instanceId);
+    if (!sock) {
+      throw new WhatsAppError(ErrorCode2.NOT_CONNECTED, `Instance ${instanceId} is not connected.`);
+    }
+    const current = this.passkeyStates.get(instanceId);
+    if (current?.state !== "request") {
+      throw new WhatsAppError(ErrorCode2.PAIRING_FAILED, "No passkey authentication is pending.");
+    }
+    this.passkeyStates.set(instanceId, { state: "confirming", requestedAt: current.requestedAt });
+    try {
+      await sock.sendPasskeyResponse(credential);
+    } catch (error) {
+      this.passkeyStates.set(instanceId, current);
+      throw error;
+    }
+  }
+  async confirmPasskey(instanceId) {
+    const sock = this.sockets.get(instanceId);
+    if (!sock) {
+      throw new WhatsAppError(ErrorCode2.NOT_CONNECTED, `Instance ${instanceId} is not connected.`);
+    }
+    const current = this.passkeyStates.get(instanceId);
+    if (current?.state !== "confirmation") {
+      throw new WhatsAppError(ErrorCode2.PAIRING_FAILED, "No passkey confirmation is pending.");
+    }
+    this.passkeyStates.set(instanceId, { state: "confirming", requestedAt: current.requestedAt });
+    try {
+      await sock.sendPasskeyConfirmation();
+    } catch (error) {
+      this.passkeyStates.set(instanceId, current);
+      throw error;
+    }
+  }
+  async handlePasskeyUpdate(instanceId, update) {
+    const requestedAt = new Date().toISOString();
+    if (update.state === "request") {
+      this.passkeyStates.set(instanceId, { state: "request", publicKey: update.publicKey, requestedAt });
+      return;
+    }
+    if (update.state === "error") {
+      this.passkeyStates.set(instanceId, {
+        state: "error",
+        phase: update.phase,
+        message: update.message,
+        requestedAt
+      });
+      return;
+    }
+    if (update.skipHandoffUX) {
+      this.passkeyStates.set(instanceId, { state: "confirming", requestedAt });
+      const sock = this.sockets.get(instanceId);
+      if (!sock) {
+        this.passkeyStates.set(instanceId, {
+          state: "error",
+          phase: "continuation",
+          message: "WhatsApp connection ended before passkey confirmation.",
+          requestedAt
+        });
+        return;
+      }
+      try {
+        await sock.sendPasskeyConfirmation();
+      } catch (error) {
+        const message2 = error instanceof Error ? error.message : "Unable to confirm passkey pairing.";
+        this.passkeyStates.set(instanceId, {
+          state: "error",
+          phase: "continuation",
+          message: message2,
+          requestedAt
+        });
+        this.logger.warn("Failed to auto-confirm passkey pairing", { instanceId, error: message2 });
+      }
+      return;
+    }
+    this.passkeyStates.set(instanceId, {
+      state: "confirmation",
+      code: update.code,
+      requiresUserConfirmation: true,
+      requestedAt
+    });
+  }
   buildQuotedOptions(message2, jid) {
     if (!message2.replyTo)
       return;
@@ -503556,6 +505142,7 @@ class WhatsAppPlugin extends BaseChannelPlugin {
     }
   }
   async handleConnected(instanceId, sock) {
+    this.passkeyStates.delete(instanceId);
     let profileName;
     let profilePicUrl;
     let ownerIdentifier;