@bugmole/cli 0.4.0

package/src/registry-worker/notifications/routes.ts

@@ -0,0 +1,280 @@
+// Routes for connecting Slack and choosing which alerts go where.
+import type { Env, Principal } from "../core.js";
+import { memberOfWorkspace, newId, requestJson, response } from "../core.js";
+import { getEntitlements } from "../billing/entitlements.js";
+import { flagOn } from "../flags.js";
+import { actorOf, recordAudit } from "../org/audit.js";
+import { matchPath, registerRoutes, type AuthedRouteContext } from "../routes/index.js";
+import { ALERT_EVENTS, isAlertEvent, slackBlocks } from "./alerts.js";
+import { drainSoon, enqueue } from "./outbox.js";
+import { canStoreSecrets, sealSecret, signState, verifyState } from "./secrets.js";
+import { exchangeSlackCode, slackAuthorizeUrl, slackConfigured } from "./slack.js";
+import { postTeamsMessage, teamsFetchEnv, validTeamsWebhookUrl } from "./teams.js";
+
+async function canManage(env: Env, principal: Principal, workspaceId: string): Promise<boolean> {
+  return memberOfWorkspace(env, principal, workspaceId, "workspace.manage");
+}
+
+async function slackAvailability(env: Env, workspaceId: string): Promise<{ available: boolean; reason?: string }> {
+  if (!(await flagOn(env, workspaceId, "slack")) || !slackConfigured(env) || !canStoreSecrets(env)) {
+    return { available: false, reason: "Slack isn't available yet." };
+  }
+  const { features } = await getEntitlements(env, workspaceId);
+  return features.slack ? { available: true } : { available: false, reason: "Slack alerts are included in Team and Business." };
+}
+
+async function teamsAvailability(env: Env, workspaceId: string): Promise<{ available: boolean; reason?: string }> {
+  if (!(await flagOn(env, workspaceId, "teams")) || !canStoreSecrets(env)) {
+    return { available: false, reason: "Microsoft Teams isn't available yet." };
+  }
+  const { features } = await getEntitlements(env, workspaceId);
+  return features.teams ? { available: true } : { available: false, reason: "Microsoft Teams alerts are included in Team and Business." };
+}
+
+async function overview({ env, principal }: AuthedRouteContext, workspaceId: string): Promise<Response> {
+  if (!(await memberOfWorkspace(env, principal, workspaceId))) return response({ error: "Workspace scope is not allowed" }, 403);
+  const installations = await env.DB.prepare(`
+    SELECT id, team_name AS teamName, channel_name AS channelName, created_at AS createdAt, revoked_at AS revokedAt, revoked_reason AS revokedReason
+    FROM slack_installations WHERE workspace_id = ? ORDER BY created_at DESC
+  `).bind(workspaceId).all();
+  const teamsInstallations = await env.DB.prepare(`
+    SELECT id, name, created_at AS createdAt, revoked_at AS revokedAt, revoked_reason AS revokedReason
+    FROM teams_installations WHERE workspace_id = ? ORDER BY created_at DESC
+  `).bind(workspaceId).all();
+  const rules = await env.DB.prepare(`
+    SELECT r.id, r.project_id AS projectId, p.name AS projectName, r.event, r.channel, r.target, r.enabled,
+           s.channel_name AS slackChannel, s.revoked_at AS slackRevokedAt,
+           t.name AS teamsName, t.revoked_at AS teamsRevokedAt
+    FROM alert_rules r
+    LEFT JOIN projects p ON p.id = r.project_id
+    LEFT JOIN slack_installations s ON r.channel = 'slack' AND s.id = r.target
+    LEFT JOIN teams_installations t ON r.channel = 'teams' AND t.id = r.target
+    WHERE r.workspace_id = ? ORDER BY r.created_at ASC
+  `).bind(workspaceId).all<Record<string, unknown>>();
+  const manager = await canManage(env, principal, workspaceId);
+  return response({
+    canManage: manager,
+    emailTargets: manager ? [...(await workspaceEmails(env, workspaceId))].sort() : [],
+    slack: { ...(await slackAvailability(env, workspaceId)), installations: installations.results },
+    teams: { ...(await teamsAvailability(env, workspaceId)), installations: teamsInstallations.results },
+    events: Object.entries(ALERT_EVENTS).map(([id, label]) => ({ id, label })),
+    rules: rules.results.map((rule) => ({ ...rule, enabled: Boolean(rule.enabled) })),
+  });
+}
+
+async function startSlackInstall({ env, principal }: AuthedRouteContext, workspaceId: string): Promise<Response> {
+  if (!(await canManage(env, principal, workspaceId))) return response({ error: "Only owners and admins can connect Slack" }, 403);
+  const slack = await slackAvailability(env, workspaceId);
+  if (!slack.available) return response({ error: slack.reason, code: "slack_unavailable" }, 402);
+  const state = await signState(env, "slack-install", { workspaceId, aegisId: principal.aegisId, nonce: newId("n") });
+  return response({ authorizeUrl: slackAuthorizeUrl(env, state) });
+}
+
+async function completeSlackInstall({ env, principal, request, ctx }: AuthedRouteContext): Promise<Response> {
+  const body = await requestJson(request);
+  const code = typeof body?.code === "string" ? body.code : "";
+  const state = typeof body?.state === "string" ? await verifyState<{ workspaceId: string; aegisId: string }>(env, "slack-install", body.state) : null;
+  // The person finishing the install must be the one who started it.
+  if (!code || !state || state.aegisId !== principal.aegisId) return response({ error: "This Slack connection link is invalid or has expired. Start again." }, 400);
+  const { workspaceId } = state;
+  if (!(await canManage(env, principal, workspaceId))) return response({ error: "Only owners and admins can connect Slack" }, 403);
+  let install;
+  try {
+    install = await exchangeSlackCode(env, code);
+  } catch (error) {
+    return response({ error: error instanceof Error ? error.message : "Slack didn't complete the install." }, 502);
+  }
+  const sealed = await sealSecret(env, install.accessToken);
+  const installationId = newId("slk");
+  await env.DB.prepare(`
+    INSERT INTO slack_installations (id, workspace_id, team_id, team_name, channel_id, channel_name, bot_token_ciphertext, bot_token_iv, installed_by)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+  `).bind(installationId, workspaceId, install.teamId, install.teamName, install.channelId, install.channelName, sealed.ciphertext, sealed.iv, principal.aegisId).run();
+  // Failures and fixes are what most teams want in Slack; they can change it after.
+  for (const event of ["run_failed", "run_fixed"] as const) {
+    await env.DB.prepare(`
+      INSERT INTO alert_rules (id, workspace_id, project_id, event, channel, target, created_by) VALUES (?, ?, NULL, ?, 'slack', ?, ?)
+      ON CONFLICT DO NOTHING
+    `).bind(newId("rule"), workspaceId, event, installationId, principal.aegisId).run();
+  }
+  await enqueue(env, "slack.message", {
+    installationId,
+    text: "Bugmole is connected",
+    blocks: slackBlocks({ title: "Bugmole is connected", text: "", tone: "good", lines: ["This channel will hear when a test run fails, and when a failing plan passes again."] }),
+  });
+  drainSoon(env, ctx);
+  await recordAudit(env, actorOf(principal), {
+    workspaceId, action: "integration.slack_connected", targetType: "slack_installation", targetId: installationId,
+    data: { team: install.teamName, channel: install.channelName },
+  }, request);
+  return response({ workspaceId, installation: { id: installationId, teamName: install.teamName, channelName: install.channelName } }, 201);
+}
+
+async function disconnectSlack({ env, principal, request }: AuthedRouteContext, workspaceId: string, installationId: string): Promise<Response> {
+  if (!(await canManage(env, principal, workspaceId))) return response({ error: "Only owners and admins can disconnect Slack" }, 403);
+  const updated = await env.DB.prepare(`
+    UPDATE slack_installations SET revoked_at = ?, revoked_reason = 'disconnected' WHERE id = ? AND workspace_id = ? AND revoked_at IS NULL
+  `).bind(new Date().toISOString(), installationId, workspaceId).run();
+  if ((updated.meta?.changes ?? 0) === 0) return response({ error: "Slack connection not found" }, 404);
+  await env.DB.prepare("DELETE FROM alert_rules WHERE workspace_id = ? AND channel = 'slack' AND target = ?").bind(workspaceId, installationId).run();
+  await recordAudit(env, actorOf(principal), { workspaceId, action: "integration.slack_disconnected", targetType: "slack_installation", targetId: installationId }, request);
+  return response({ disconnected: true });
+}
+
+async function testSlack({ env, principal, ctx }: AuthedRouteContext, workspaceId: string, installationId: string): Promise<Response> {
+  if (!(await canManage(env, principal, workspaceId))) return response({ error: "Only owners and admins can send a test" }, 403);
+  const install = await env.DB.prepare("SELECT id FROM slack_installations WHERE id = ? AND workspace_id = ? AND revoked_at IS NULL")
+    .bind(installationId, workspaceId).first();
+  if (!install) return response({ error: "Slack connection not found" }, 404);
+  await enqueue(env, "slack.message", {
+    installationId,
+    text: "Test message from Bugmole",
+    blocks: slackBlocks({ title: "Test message from Bugmole", text: "", tone: "info", lines: ["Alerts for this workspace arrive here."] }),
+  });
+  drainSoon(env, ctx);
+  return response({ queued: true }, 202);
+}
+
+async function connectTeams({ env, principal, request, ctx }: AuthedRouteContext, workspaceId: string): Promise<Response> {
+  if (!(await canManage(env, principal, workspaceId))) return response({ error: "Only owners and admins can connect Microsoft Teams" }, 403);
+  const teams = await teamsAvailability(env, workspaceId);
+  if (!teams.available) return response({ error: teams.reason, code: "teams_unavailable" }, 402);
+  const body = await requestJson(request);
+  const webhookUrl = typeof body?.webhookUrl === "string" ? body.webhookUrl.trim() : "";
+  const name = typeof body?.name === "string" && body.name.trim() ? body.name.trim().slice(0, 100) : null;
+  if (!validTeamsWebhookUrl(webhookUrl)) {
+    return response({ error: "That doesn't look like a Teams Workflows webhook URL. Create one from the Workflows app's \"Post to a channel when a webhook request is received\" template." }, 422);
+  }
+  try {
+    await postTeamsMessage(teamsFetchEnv(env), webhookUrl, "✅ Bugmole is connected. This channel will hear when a test run fails, and when a failing plan passes again.");
+  } catch (error) {
+    return response({ error: error instanceof Error ? error.message : "Teams didn't accept a test message on that webhook." }, 502);
+  }
+  const sealed = await sealSecret(env, webhookUrl);
+  const installationId = newId("tms");
+  await env.DB.prepare(`
+    INSERT INTO teams_installations (id, workspace_id, name, webhook_url_ciphertext, webhook_url_iv, installed_by) VALUES (?, ?, ?, ?, ?, ?)
+  `).bind(installationId, workspaceId, name, sealed.ciphertext, sealed.iv, principal.aegisId).run();
+  for (const event of ["run_failed", "run_fixed"] as const) {
+    await env.DB.prepare(`
+      INSERT INTO alert_rules (id, workspace_id, project_id, event, channel, target, created_by) VALUES (?, ?, NULL, ?, 'teams', ?, ?)
+      ON CONFLICT DO NOTHING
+    `).bind(newId("rule"), workspaceId, event, installationId, principal.aegisId).run();
+  }
+  drainSoon(env, ctx);
+  await recordAudit(env, actorOf(principal), { workspaceId, action: "integration.teams_connected", targetType: "teams_installation", targetId: installationId, data: { name } }, request);
+  return response({ workspaceId, installation: { id: installationId, name } }, 201);
+}
+
+async function disconnectTeams({ env, principal, request }: AuthedRouteContext, workspaceId: string, installationId: string): Promise<Response> {
+  if (!(await canManage(env, principal, workspaceId))) return response({ error: "Only owners and admins can disconnect Microsoft Teams" }, 403);
+  const updated = await env.DB.prepare(`
+    UPDATE teams_installations SET revoked_at = ?, revoked_reason = 'disconnected' WHERE id = ? AND workspace_id = ? AND revoked_at IS NULL
+  `).bind(new Date().toISOString(), installationId, workspaceId).run();
+  if ((updated.meta?.changes ?? 0) === 0) return response({ error: "Teams connection not found" }, 404);
+  await env.DB.prepare("DELETE FROM alert_rules WHERE workspace_id = ? AND channel = 'teams' AND target = ?").bind(workspaceId, installationId).run();
+  await recordAudit(env, actorOf(principal), { workspaceId, action: "integration.teams_disconnected", targetType: "teams_installation", targetId: installationId }, request);
+  return response({ disconnected: true });
+}
+
+async function testTeams({ env, principal, ctx }: AuthedRouteContext, workspaceId: string, installationId: string): Promise<Response> {
+  if (!(await canManage(env, principal, workspaceId))) return response({ error: "Only owners and admins can send a test" }, 403);
+  const install = await env.DB.prepare("SELECT id FROM teams_installations WHERE id = ? AND workspace_id = ? AND revoked_at IS NULL")
+    .bind(installationId, workspaceId).first();
+  if (!install) return response({ error: "Teams connection not found" }, 404);
+  await enqueue(env, "teams.message", { installationId, text: "ℹ️ Test message from Bugmole. Alerts for this workspace arrive here." });
+  drainSoon(env, ctx);
+  return response({ queued: true }, 202);
+}
+
+/** Email alerts only go to people in the workspace, so rules can't be used to send mail anywhere. */
+async function workspaceEmails(env: Env, workspaceId: string): Promise<Set<string>> {
+  const rows = await env.DB.prepare(`
+    SELECT u.email FROM workspace_memberships m JOIN aegis_users u ON u.id = m.aegis_id
+    WHERE m.workspace_id = ? AND m.status = 'active' AND u.email IS NOT NULL
+    UNION SELECT billing_email FROM workspace_plans WHERE workspace_id = ? AND billing_email IS NOT NULL
+  `).bind(workspaceId, workspaceId).all<{ email: string }>();
+  return new Set(rows.results.map((row) => row.email.toLowerCase()));
+}
+
+async function createRule({ env, principal, request }: AuthedRouteContext, workspaceId: string): Promise<Response> {
+  if (!(await canManage(env, principal, workspaceId))) return response({ error: "Only owners and admins can change alerts" }, 403);
+  const body = await requestJson(request);
+  const event = body?.event;
+  const channel = body?.channel;
+  const projectId = typeof body?.projectId === "string" && body.projectId ? body.projectId : null;
+  let target = typeof body?.target === "string" ? body.target.trim() : "";
+  if (!isAlertEvent(event)) return response({ error: "Unknown alert event" }, 422);
+  if (projectId) {
+    const project = await env.DB.prepare("SELECT id FROM projects WHERE id = ? AND workspace_id = ? AND deleted_at IS NULL").bind(projectId, workspaceId).first();
+    if (!project) return response({ error: "That project isn't in this workspace" }, 422);
+  }
+  if (channel === "slack") {
+    const slack = await slackAvailability(env, workspaceId);
+    if (!slack.available) return response({ error: slack.reason, code: "slack_unavailable" }, 402);
+    const install = await env.DB.prepare("SELECT id FROM slack_installations WHERE id = ? AND workspace_id = ? AND revoked_at IS NULL").bind(target, workspaceId).first();
+    if (!install) return response({ error: "Connect that Slack channel first" }, 422);
+  } else if (channel === "teams") {
+    const teams = await teamsAvailability(env, workspaceId);
+    if (!teams.available) return response({ error: teams.reason, code: "teams_unavailable" }, 402);
+    const install = await env.DB.prepare("SELECT id FROM teams_installations WHERE id = ? AND workspace_id = ? AND revoked_at IS NULL").bind(target, workspaceId).first();
+    if (!install) return response({ error: "Connect that Teams channel first" }, 422);
+  } else if (channel === "email") {
+    target = target.toLowerCase();
+    if (!(await workspaceEmails(env, workspaceId)).has(target)) {
+      return response({ error: "Email alerts can go to workspace members or the billing email" }, 422);
+    }
+  } else {
+    return response({ error: "channel must be slack, teams, or email" }, 422);
+  }
+  // The unique index can't see duplicates across "all projects" (a NULL project), so check first.
+  const existing = await env.DB.prepare(`
+    SELECT id FROM alert_rules WHERE workspace_id = ? AND project_id IS ? AND event = ? AND channel = ? AND target = ?
+  `).bind(workspaceId, projectId, event, channel, target).first();
+  if (existing) return response({ error: "That alert already exists" }, 409);
+  const id = newId("rule");
+  await env.DB.prepare(`
+    INSERT INTO alert_rules (id, workspace_id, project_id, event, channel, target, created_by) VALUES (?, ?, ?, ?, ?, ?, ?)
+  `).bind(id, workspaceId, projectId, event, channel, target, principal.aegisId).run();
+  await recordAudit(env, actorOf(principal), { workspaceId, action: "alert_rule.created", targetType: "alert_rule", targetId: id, data: { event, channel, projectId } }, request);
+  return response({ rule: { id, event, channel, target, projectId, enabled: true } }, 201);
+}
+
+async function updateRule({ env, principal, request }: AuthedRouteContext, workspaceId: string, ruleId: string): Promise<Response> {
+  if (!(await canManage(env, principal, workspaceId))) return response({ error: "Only owners and admins can change alerts" }, 403);
+  if (request.method === "DELETE") {
+    const deleted = await env.DB.prepare("DELETE FROM alert_rules WHERE id = ? AND workspace_id = ?").bind(ruleId, workspaceId).run();
+    if ((deleted.meta?.changes ?? 0) === 0) return response({ error: "Alert not found" }, 404);
+    await recordAudit(env, actorOf(principal), { workspaceId, action: "alert_rule.deleted", targetType: "alert_rule", targetId: ruleId }, request);
+    return response({ deleted: true });
+  }
+  const body = await requestJson(request);
+  if (typeof body?.enabled !== "boolean") return response({ error: "enabled must be true or false" }, 422);
+  const updated = await env.DB.prepare("UPDATE alert_rules SET enabled = ? WHERE id = ? AND workspace_id = ?").bind(body.enabled ? 1 : 0, ruleId, workspaceId).run();
+  if ((updated.meta?.changes ?? 0) === 0) return response({ error: "Alert not found" }, 404);
+  return response({ rule: { id: ruleId, enabled: body.enabled } });
+}
+
+registerRoutes(async (context) => {
+  const { request, url } = context;
+  let params = matchPath(url.pathname, "/api/workspaces/:workspaceId/notifications");
+  if (params && request.method === "GET") return overview(context, params.workspaceId);
+  params = matchPath(url.pathname, "/api/workspaces/:workspaceId/integrations/slack/install");
+  if (params && request.method === "POST") return startSlackInstall(context, params.workspaceId);
+  if (url.pathname === "/api/integrations/slack/complete" && request.method === "POST") return completeSlackInstall(context);
+  params = matchPath(url.pathname, "/api/workspaces/:workspaceId/integrations/slack/:installationId");
+  if (params && request.method === "DELETE") return disconnectSlack(context, params.workspaceId, params.installationId);
+  params = matchPath(url.pathname, "/api/workspaces/:workspaceId/integrations/slack/:installationId/test");
+  if (params && request.method === "POST") return testSlack(context, params.workspaceId, params.installationId);
+  params = matchPath(url.pathname, "/api/workspaces/:workspaceId/integrations/teams");
+  if (params && request.method === "POST") return connectTeams(context, params.workspaceId);
+  params = matchPath(url.pathname, "/api/workspaces/:workspaceId/integrations/teams/:installationId");
+  if (params && request.method === "DELETE") return disconnectTeams(context, params.workspaceId, params.installationId);
+  params = matchPath(url.pathname, "/api/workspaces/:workspaceId/integrations/teams/:installationId/test");
+  if (params && request.method === "POST") return testTeams(context, params.workspaceId, params.installationId);
+  params = matchPath(url.pathname, "/api/workspaces/:workspaceId/alert-rules");
+  if (params && request.method === "POST") return createRule(context, params.workspaceId);
+  params = matchPath(url.pathname, "/api/workspaces/:workspaceId/alert-rules/:ruleId");
+  if (params && (request.method === "PATCH" || request.method === "DELETE")) return updateRule(context, params.workspaceId, params.ruleId);
+  return null;
+});

package/src/registry-worker/notifications/secrets.ts

@@ -0,0 +1,49 @@
+// Third-party tokens (Slack, device clouds) are stored encrypted with
+// SECRETS_ENCRYPTION_KEY, never in plain text.
+import type { Env } from "../core.js";
+import { constantTimeEqual, decryptForSecret, encryptForSecret } from "../core.js";
+
+export type SecretsEnv = { SECRETS_ENCRYPTION_KEY?: string };
+
+function key(env: Env): string {
+  const value = (env as Env & SecretsEnv).SECRETS_ENCRYPTION_KEY;
+  if (!value) throw new Error("SECRETS_ENCRYPTION_KEY is not configured");
+  return value;
+}
+
+export function canStoreSecrets(env: Env): boolean {
+  return Boolean((env as Env & SecretsEnv).SECRETS_ENCRYPTION_KEY);
+}
+
+export function sealSecret(env: Env, value: string): Promise<{ ciphertext: string; iv: string }> {
+  return encryptForSecret(value, key(env));
+}
+
+export function openSecret(env: Env, ciphertext: string, iv: string): Promise<string> {
+  return decryptForSecret(ciphertext, iv, key(env));
+}
+
+/** A short-lived, signed value (OAuth state) bound to what it was issued for. */
+export async function signState(env: Env, purpose: string, payload: Record<string, unknown>, ttlMs = 10 * 60_000): Promise<string> {
+  const body = btoa(JSON.stringify({ ...payload, purpose, exp: Date.now() + ttlMs })).replace(/=+$/, "");
+  const mac = await hmac(env, body);
+  return `${body}.${mac}`;
+}
+
+export async function verifyState<T extends Record<string, unknown>>(env: Env, purpose: string, state: string): Promise<T | null> {
+  const [body, mac] = state.split(".");
+  if (!body || !mac || !constantTimeEqual(mac, await hmac(env, body))) return null;
+  try {
+    const parsed = JSON.parse(atob(body)) as T & { purpose?: string; exp?: number };
+    if (parsed.purpose !== purpose || typeof parsed.exp !== "number" || parsed.exp < Date.now()) return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+
+async function hmac(env: Env, value: string): Promise<string> {
+  const material = await crypto.subtle.importKey("raw", new TextEncoder().encode(`state:${key(env)}`), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  const signature = await crypto.subtle.sign("HMAC", material, new TextEncoder().encode(value));
+  return [...new Uint8Array(signature)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}

package/src/registry-worker/notifications/slack.ts

@@ -0,0 +1,96 @@
+// Slack: the OAuth install that picks a channel, and posting messages to it.
+import type { Env } from "../core.js";
+import { PermanentDeliveryError } from "./outbox.js";
+
+export type SlackEnv = {
+  SLACK_CLIENT_ID?: string;
+  SLACK_CLIENT_SECRET?: string;
+  /** Test seam. */
+  SLACK_FETCH?: typeof fetch;
+};
+
+export const SLACK_SCOPES = ["chat:write", "incoming-webhook"];
+
+function slack(env: Env): SlackEnv {
+  return env as Env & SlackEnv;
+}
+
+export function slackConfigured(env: Env): boolean {
+  return Boolean(slack(env).SLACK_CLIENT_ID && slack(env).SLACK_CLIENT_SECRET);
+}
+
+export function slackRedirectUri(env: Env): string {
+  return `${(env.DASHBOARD_URL || "https://app.bugmole.com").replace(/\/$/, "")}/api/integrations/slack/callback`;
+}
+
+export function slackAuthorizeUrl(env: Env, state: string): string {
+  const url = new URL("https://slack.com/oauth/v2/authorize");
+  url.searchParams.set("client_id", slack(env).SLACK_CLIENT_ID ?? "");
+  url.searchParams.set("scope", SLACK_SCOPES.join(","));
+  url.searchParams.set("redirect_uri", slackRedirectUri(env));
+  url.searchParams.set("state", state);
+  return url.toString();
+}
+
+export type SlackInstall = { accessToken: string; teamId: string; teamName: string | null; channelId: string; channelName: string | null };
+
+export async function exchangeSlackCode(env: Env, code: string): Promise<SlackInstall> {
+  const response = await (slack(env).SLACK_FETCH ?? fetch)("https://slack.com/api/oauth.v2.access", {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({
+      client_id: slack(env).SLACK_CLIENT_ID ?? "",
+      client_secret: slack(env).SLACK_CLIENT_SECRET ?? "",
+      code,
+      redirect_uri: slackRedirectUri(env),
+    }),
+  });
+  const body = await response.json().catch(() => ({})) as {
+    ok?: boolean;
+    error?: string;
+    access_token?: string;
+    team?: { id?: string; name?: string };
+    incoming_webhook?: { channel?: string; channel_id?: string };
+  };
+  if (!body.ok || !body.access_token || !body.team?.id || !body.incoming_webhook?.channel_id) {
+    throw new Error(`Slack didn't complete the install${body.error ? ` (${body.error})` : ""}`);
+  }
+  return {
+    accessToken: body.access_token,
+    teamId: body.team.id,
+    teamName: body.team.name ?? null,
+    channelId: body.incoming_webhook.channel_id,
+    channelName: body.incoming_webhook.channel ?? null,
+  };
+}
+
+/** Errors that mean the install no longer works; retrying won't help. */
+export const SLACK_REVOKED = new Set(["token_revoked", "invalid_auth", "account_inactive", "not_authed", "channel_not_found", "is_archived", "not_in_channel"]);
+
+export class SlackRevokedError extends PermanentDeliveryError {
+  constructor(readonly code: string) {
+    super(`Slack refused the message (${code})`);
+  }
+}
+
+export type SlackBlock = Record<string, unknown>;
+
+export async function postSlackMessage(env: Env, token: string, channel: string, message: { text: string; blocks?: SlackBlock[] }): Promise<void> {
+  const response = await (slack(env).SLACK_FETCH ?? fetch)("https://slack.com/api/chat.postMessage", {
+    method: "POST",
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json; charset=utf-8" },
+    body: JSON.stringify({ channel, text: message.text, blocks: message.blocks, unfurl_links: false }),
+  });
+  if (response.status === 429) throw new Error("Slack rate limit");
+  const body = await response.json().catch(() => ({})) as { ok?: boolean; error?: string };
+  if (body.ok) return;
+  const code = body.error ?? `http_${response.status}`;
+  if (SLACK_REVOKED.has(code)) throw new SlackRevokedError(code);
+  if (response.status >= 400 && response.status < 500 && code !== "ratelimited") throw new PermanentDeliveryError(`Slack refused the message (${code})`);
+  throw new Error(`Slack is unavailable (${code})`);
+}
+
+/** Slack mrkdwn needs &, < and > escaped in text we didn't write. */
+export function slackText(value: string): string {
+  return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;");
+}

package/src/registry-worker/notifications/teams.ts

@@ -0,0 +1,46 @@
+// Microsoft Teams: posting to a channel through a Workflows webhook — the
+// replacement for the retired Office 365 Connectors (fully retired as of
+// their extended March 2026 deadline). There's no OAuth app to register:
+// the customer creates their own webhook from the Workflows app template
+// ("Post to a channel when a webhook request is received") and pastes the
+// resulting URL in. Messages arrive from the Workflows "Flow bot" identity.
+import { PermanentDeliveryError } from "./outbox.js";
+
+export type TeamsFetchEnv = {
+  /** Test seam. */
+  TEAMS_FETCH?: typeof fetch;
+};
+
+export function teamsFetchEnv(env: object): TeamsFetchEnv {
+  return env as TeamsFetchEnv;
+}
+
+/** A Workflows webhook is a plain HTTPS URL on Microsoft's Logic Apps or Power Automate domains. */
+export function validTeamsWebhookUrl(value: string): boolean {
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" && /(^|\.)(logic\.azure\.com|azure-automation\.net|flow\.microsoft\.com)$/i.test(url.hostname);
+  } catch {
+    return false;
+  }
+}
+
+/** The webhook was deleted or the workflow disabled; retrying won't help. */
+export class TeamsRevokedError extends PermanentDeliveryError {}
+
+export async function postTeamsMessage(env: TeamsFetchEnv, webhookUrl: string, text: string): Promise<void> {
+  const response = await (env.TEAMS_FETCH ?? fetch)(webhookUrl, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ text }),
+  });
+  if (response.status === 429) throw new Error("Microsoft Teams rate limit");
+  if (response.status === 404 || response.status === 410) {
+    throw new TeamsRevokedError(`The Teams webhook no longer exists (${response.status})`);
+  }
+  if (response.status >= 400 && response.status < 500) {
+    const body = await response.text().catch(() => "");
+    throw new PermanentDeliveryError(`Teams refused the message (${response.status}) ${body.slice(0, 200)}`);
+  }
+  if (!response.ok) throw new Error(`Teams is unavailable (${response.status})`);
+}

package/src/registry-worker/org/audit.ts

@@ -0,0 +1,116 @@
+// Append-only record of who changed what in a workspace. Writes never fail
+// the request they describe: a lost audit row is logged, not thrown.
+import { type Env, type Principal, newId } from "../core.js";
+
+export type AuditActor =
+  | { type: "user" | "api_key"; id: string; apiKeyId?: string }
+  | { type: "system" | "scim" | "runner" | "webhook"; id: string };
+
+export type AuditEntry = {
+  workspaceId: string;
+  projectId?: string | null;
+  action: string;
+  targetType?: string;
+  targetId?: string;
+  data?: Record<string, unknown>;
+};
+
+export function actorOf(principal: Principal): AuditActor {
+  if (principal.runner) return { type: "runner", id: `${principal.runner.kind}:${principal.runner.id}` };
+  return principal.apiKeyId
+    ? { type: "api_key", id: principal.aegisId, apiKeyId: principal.apiKeyId }
+    : { type: "user", id: principal.aegisId };
+}
+
+export async function recordAudit(
+  env: Env,
+  actor: AuditActor,
+  entry: AuditEntry,
+  request?: Request,
+): Promise<void> {
+  const data = {
+    ...(entry.data ?? {}),
+    ...("apiKeyId" in actor && actor.apiKeyId ? { apiKeyId: actor.apiKeyId } : {}),
+  };
+  try {
+    await env.DB.prepare(`
+      INSERT INTO audit_log (id, workspace_id, project_id, actor_type, actor_id, action, target_type, target_id, ip, user_agent, data_json)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    `).bind(
+      newId("aud"),
+      entry.workspaceId,
+      entry.projectId ?? null,
+      actor.type,
+      actor.id,
+      entry.action,
+      entry.targetType ?? null,
+      entry.targetId ?? null,
+      request?.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || request?.headers.get("cf-connecting-ip") || null,
+      request?.headers.get("user-agent")?.slice(0, 300) ?? null,
+      Object.keys(data).length ? JSON.stringify(data) : null,
+    ).run();
+  } catch (error) {
+    console.error("[audit] failed to record", entry.action, error);
+  }
+}
+
+/** Audits an action on a project, looking up the workspace it belongs to. */
+export async function auditProject(
+  env: Env,
+  principal: Principal,
+  projectId: string,
+  entry: Omit<AuditEntry, "workspaceId" | "projectId">,
+  request?: Request,
+): Promise<void> {
+  const project = await env.DB.prepare("SELECT workspace_id AS workspaceId FROM projects WHERE id = ?")
+    .bind(projectId).first<{ workspaceId: string | null }>();
+  if (!project?.workspaceId) return;
+  await recordAudit(env, actorOf(principal), { ...entry, workspaceId: project.workspaceId, projectId }, request);
+}
+
+export type AuditRow = {
+  id: string;
+  workspaceId: string;
+  projectId: string | null;
+  actorType: string;
+  actorId: string;
+  action: string;
+  targetType: string | null;
+  targetId: string | null;
+  ip: string | null;
+  userAgent: string | null;
+  data: Record<string, unknown> | null;
+  createdAt: string;
+};
+
+export async function listAudit(
+  env: Env,
+  workspaceId: string,
+  { since, before, limit }: { since?: string; before?: string; limit: number },
+): Promise<AuditRow[]> {
+  const rows = await env.DB.prepare(`
+    SELECT id, workspace_id AS workspaceId, project_id AS projectId, actor_type AS actorType, actor_id AS actorId,
+           action, target_type AS targetType, target_id AS targetId, ip, user_agent AS userAgent,
+           data_json AS dataJson, created_at AS createdAt
+    FROM audit_log
+    WHERE workspace_id = ?
+      AND (? IS NULL OR created_at >= ?)
+      AND (? IS NULL OR created_at < ?)
+    ORDER BY created_at DESC, id DESC
+    LIMIT ?
+  `).bind(workspaceId, since ?? null, since ?? null, before ?? null, before ?? null, limit)
+    .all<Omit<AuditRow, "data"> & { dataJson: string | null }>();
+  return rows.results.map(({ dataJson, ...row }) => ({ ...row, data: dataJson ? JSON.parse(dataJson) : null }));
+}
+
+const CSV_COLUMNS = ["createdAt", "actorType", "actorId", "action", "targetType", "targetId", "projectId", "ip", "userAgent", "data"] as const;
+
+export function auditCsv(rows: AuditRow[]): string {
+  const cell = (value: unknown) => {
+    const text = value === null || value === undefined ? "" : typeof value === "string" ? value : JSON.stringify(value);
+    // Quote everything and neutralise spreadsheet formulas.
+    const safe = /^[=+\-@\t\r]/.test(text) ? `'${text}` : text;
+    return `"${safe.replaceAll('"', '""')}"`;
+  };
+  return [CSV_COLUMNS.join(","), ...rows.map((row) => CSV_COLUMNS.map((column) => cell(row[column])).join(","))].join("\r\n") + "\r\n";
+}