@segmentstream/ontology 0.92.0 → 0.93.0

package/README.md

@@ -1399,10 +1399,47 @@ Grant `agent_chat:post_message` explicitly (`agent_chat:*` also covers it). The
 `AgentChannel`/`AgentMessage` exports and agent-origin configuration have been removed.
 Older ontology definitions still expose reads; posting requires the provider mapping.
 
+Slack chats are destinations only when `chat.slack` declares their connection, which must be
+listed in `connections` and must not be Telegram's:
+
+```ts
+const slack = connection("slack", { description: "Workspace Slack app." });
+defineOntology({
+  entities,
+  roles,
+  connections: [telegram, slack],
+  chat: { telegram: { connection: telegram }, slack: { connection: slack } },
+});
+```
+
+Its destinations are the `agent_chat` registry's Slack channels, which the agent's Slack channel
+reports, and `slack:private:<member UUID>` for each member paired on Slack, posted to their user
+id. A Slack post is one `chat.postMessage` with `markdown_text`: the member's exact Markdown, then
+the separator and attribution with Markdown escaped and the attribution in italics, as
+`renderSlack` from `@segmentstream/ontology/slack` renders it. `reply_to` is a thread message's
+`ts`. Slack's `ok: false` refusal consumes the key; a timeout, a 5xx or an unverifiable answer is
+`uncertain`. The receipt's `message_id` is the message's `ts`; it has no URL.
+
+Members' WhatsApp chats with the workspace's number are destinations only when `chat.whatsapp`
+declares the `WhatsAppConnection`, under the same rules. Each member with a live WhatsApp pairing
+is `whatsapp:private:<member UUID>`, posted to their WhatsApp id; WhatsApp has no group
+destinations. A WhatsApp post is one text message, `POST /phone/messages` on the connection's
+`graph` API with link previews off: the member's text as written, then the separator and the
+attribution in italics, whose WhatsApp formatting markers (`*`, `_`, `~`, `` ` ``) become
+look-alikes WhatsApp never formats, as `renderWhatsApp` from `@segmentstream/ontology/whatsapp`
+renders it. The body is at most 4096 characters, and `reply_to` is refused. Meta delivers
+free-form text only inside the 24-hour customer-service window: a post outside it fails with
+Meta's code 131047 and consumes the key. Any Meta refusal with an error code does the same; a
+timeout, a 5xx or an answer naming no message is `uncertain`. The receipt's `message_id` is the
+`wamid…` Meta accepted; it has no URL, and a failure Meta reports later in delivery statuses does
+not change it.
+
 `chat_list({ query?, chat?, after?, limit? })` returns eligible routing metadata and server-derived
 attribution. `query` filters titles by a case-insensitive literal substring before pagination.
 `chat` selects an exact ID/title. Choose an ID or exact title; ambiguous titles return candidates and never guess.
-Paired private chats have stable handles `telegram:private:<member UUID>`. Posting permission
+Paired private chats have stable handles `telegram:private:<member UUID>`, and
+`slack:private:<member UUID>` or `whatsapp:private:<member UUID>` when that provider is declared.
+Posting permission
 allows target discovery independently of history. `user_find` still requires `user:read`.
 
 External OAuth/service clients call `chat_post_message({ chat, text, reply_to?, idempotency_key })`.

package/dist/analyze.d.ts

@@ -65,11 +65,20 @@ export interface OntologyConfig<Entities extends ReadonlyArray<AnyEntity> = Read
      * handle an action lists must be here, and every handle here must be used by an action.
      */
     readonly connections?: ReadonlyArray<AnyConnectionHandle>;
-    /** Provider connections used by the built-in exact chat delivery action. */
+    /**
+     * The providers the built-in exact chat post delivers to, each through its connection, which
+     * must be listed in `connections`. Only declared providers are destinations.
+     */
     readonly chat?: {
         readonly telegram?: {
             readonly connection: AnyConnectionHandle;
         };
+        readonly slack?: {
+            readonly connection: AnyConnectionHandle;
+        };
+        readonly whatsapp?: {
+            readonly connection: AnyConnectionHandle;
+        };
         readonly attribution?: ChatAttributionSettings;
     };
     /**
@@ -184,6 +193,12 @@ export interface Analysis {
         readonly telegram?: {
             readonly connection: string;
         };
+        readonly slack?: {
+            readonly connection: string;
+        };
+        readonly whatsapp?: {
+            readonly connection: string;
+        };
         readonly attribution?: ChatAttributionSettings;
     };
     readonly entities: ReadonlyArray<ResolvedEntity>;

package/dist/analyze.js

@@ -30,6 +30,8 @@ import { MAX_WEBHOOK_HEADERS, MAX_WEBHOOKS, WEBHOOK_SIGNATURE_SCHEMES, webhookDe
 import { actionInputToWire } from "./authoring-input.js";
 import { validate } from "./runtime/validation.js";
 const GENERATED_UPSERT = new RegExp(`^${GENERATED_UPSERT_PREFIX}`);
+/** The providers `chat` may declare a posting connection for, in the order posting lists them. */
+const CHAT_PROVIDER_KEYS = ["telegram", "slack", "whatsapp"];
 function errorMessage(error) {
     return error instanceof Error ? error.message : String(error);
 }
@@ -126,39 +128,56 @@ export function analyze(config, options = {}) {
     ];
     let chat;
     if (config.chat !== undefined) {
-        if (!isPlainObject(config.chat) ||
-            Object.keys(config.chat).some((key) => key !== "telegram" && key !== "attribution") ||
-            (config.chat.telegram !== undefined &&
-                (!isPlainObject(config.chat.telegram) ||
-                    Object.keys(config.chat.telegram).some((key) => key !== "connection") ||
-                    !isConnection(config.chat.telegram.connection)))) {
-            report("invalid-connection", "chat", "chat.telegram.connection must reference a declared connection handle.");
-        }
-        else if (config.chat.telegram !== undefined) {
-            const handle = config.chat.telegram.connection;
-            if (!(config.connections ?? []).includes(handle)) {
-                report("invalid-connection", "chat.telegram.connection", "The chat provider connection must be listed in connections.");
-            }
-            else {
-                chat = {
-                    telegram: { connection: handle.key },
-                    ...(config.chat.attribution === undefined
-                        ? {}
-                        : { attribution: config.chat.attribution }),
-                };
-                resolved = resolved.map((entity) => entity.name !== "agent_chat"
-                    ? entity
-                    : {
-                        ...entity,
-                        actions: entity.actions.map((candidate) => candidate.name !== "post_message"
-                            ? candidate
-                            : {
-                                ...candidate,
-                                connections: [handle.key],
-                                action: { ...candidate.action, connections: [handle] },
-                            }),
-                    });
-            }
+        const declared = isPlainObject(config.chat)
+            ? CHAT_PROVIDER_KEYS.filter((name) => config.chat?.[name] !== undefined)
+            : [];
+        const unknown = isPlainObject(config.chat)
+            ? Object.keys(config.chat).find((key) => key !== "attribution" && !CHAT_PROVIDER_KEYS.includes(key))
+            : "chat";
+        const malformed = declared.find((name) => {
+            const provider = config.chat?.[name];
+            return (!isPlainObject(provider) ||
+                Object.keys(provider).some((key) => key !== "connection") ||
+                !isConnection(provider.connection));
+        });
+        // Read only once every declared provider is well formed.
+        const handles = malformed === undefined
+            ? declared.map((name) => [name, config.chat[name].connection])
+            : [];
+        const unlisted = handles.find(([, handle]) => !(config.connections ?? []).includes(handle));
+        const shared = handles.find(([, handle], index) => handles.findIndex(([, other]) => other === handle) !== index);
+        if (unknown !== undefined) {
+            report("invalid-connection", "chat", `chat accepts only ${CHAT_PROVIDER_KEYS.join(", ")} and attribution.`);
+        }
+        else if (malformed !== undefined) {
+            report("invalid-connection", "chat", `chat.${malformed}.connection must reference a declared connection handle.`);
+        }
+        else if (unlisted !== undefined) {
+            report("invalid-connection", `chat.${unlisted[0]}.connection`, "The chat provider connection must be listed in connections.");
+        }
+        else if (shared !== undefined) {
+            report("invalid-connection", `chat.${shared[0]}.connection`, "Each chat provider needs its own connection.");
+        }
+        else if (handles.length > 0) {
+            chat = {
+                ...Object.fromEntries(handles.map(([name, handle]) => [name, { connection: handle.key }])),
+                ...(config.chat.attribution === undefined ? {} : { attribution: config.chat.attribution }),
+            };
+            resolved = resolved.map((entity) => entity.name !== "agent_chat"
+                ? entity
+                : {
+                    ...entity,
+                    actions: entity.actions.map((candidate) => candidate.name !== "post_message"
+                        ? candidate
+                        : {
+                            ...candidate,
+                            connections: handles.map(([, handle]) => handle.key),
+                            action: {
+                                ...candidate.action,
+                                connections: handles.map(([, handle]) => handle),
+                            },
+                        }),
+                });
         }
     }
     const attribution = config.chat?.attribution;

package/dist/manifest.d.ts

@@ -53,6 +53,9 @@ import { type SignInOptions, type SignInPolicy } from "./sign-in.js";
  * Version 15 changes no field this SDK writes. Ontology SDKs 0.86.0 to 0.88.0 introduced it with
  * `executionCompatibility` and three workflow capabilities for a deploy guard that was withdrawn;
  * readers ignore them.
+ * Within version 15, `chat` may carry `slack` and `whatsapp` beside `telegram`: the connections
+ * exact chat posts to Slack chats and to members' WhatsApp chats go through. Older readers ignore
+ * them, and their services post to Telegram alone.
  */
 export declare const MANIFEST_VERSION = 15;
 /** The phrase used for a direction the author did not phrase. */
@@ -862,10 +865,20 @@ export declare const OntologyManifestWire: Schema.encodeKeys<Schema.Struct<{
         /** Written only when the ontology sends data out through the connection. */
         readonly delivers: Schema.optionalKey<Schema.Literal<true>>;
     }>>>;
+    /**
+     * The providers whose chats the built-in exact chat post delivers to, each through its declared
+     * connection, and the attribution it adds. Absent, or without a provider, delivers nowhere.
+     */
     readonly chat: Schema.optionalKey<Schema.Struct<{
         readonly telegram: Schema.optionalKey<Schema.Struct<{
             readonly connection: Schema.String;
         }>>;
+        readonly slack: Schema.optionalKey<Schema.Struct<{
+            readonly connection: Schema.String;
+        }>>;
+        readonly whatsapp: Schema.optionalKey<Schema.Struct<{
+            readonly connection: Schema.String;
+        }>>;
         readonly attribution: Schema.optionalKey<Schema.Struct<{
             readonly template: Schema.optionalKey<Schema.String>;
             readonly separator: Schema.optionalKey<Schema.String>;
@@ -1054,6 +1067,12 @@ export declare const OntologyManifest: Schema.declareConstructor<{
         readonly telegram?: {
             readonly connection: string;
         } | undefined;
+        readonly slack?: {
+            readonly connection: string;
+        } | undefined;
+        readonly whatsapp?: {
+            readonly connection: string;
+        } | undefined;
         readonly attribution?: {
             readonly template?: string | undefined;
             readonly separator?: string | undefined;
@@ -1275,6 +1294,12 @@ export declare const OntologyManifest: Schema.declareConstructor<{
         readonly telegram?: {
             readonly connection: string;
         } | undefined;
+        readonly slack?: {
+            readonly connection: string;
+        } | undefined;
+        readonly whatsapp?: {
+            readonly connection: string;
+        } | undefined;
         readonly attribution?: {
             readonly template?: string | undefined;
             readonly separator?: string | undefined;
@@ -1496,6 +1521,12 @@ export declare const OntologyManifest: Schema.declareConstructor<{
         readonly telegram?: {
             readonly connection: string;
         } | undefined;
+        readonly slack?: {
+            readonly connection: string;
+        } | undefined;
+        readonly whatsapp?: {
+            readonly connection: string;
+        } | undefined;
         readonly attribution?: {
             readonly template?: string | undefined;
             readonly separator?: string | undefined;
@@ -1717,6 +1748,12 @@ export declare const OntologyManifest: Schema.declareConstructor<{
         readonly telegram?: {
             readonly connection: string;
         } | undefined;
+        readonly slack?: {
+            readonly connection: string;
+        } | undefined;
+        readonly whatsapp?: {
+            readonly connection: string;
+        } | undefined;
         readonly attribution?: {
             readonly template?: string | undefined;
             readonly separator?: string | undefined;
@@ -2043,10 +2080,20 @@ export declare const OntologyManifest: Schema.declareConstructor<{
         /** Written only when the ontology sends data out through the connection. */
         readonly delivers: Schema.optionalKey<Schema.Literal<true>>;
     }>>>;
+    /**
+     * The providers whose chats the built-in exact chat post delivers to, each through its declared
+     * connection, and the attribution it adds. Absent, or without a provider, delivers nowhere.
+     */
     readonly chat: Schema.optionalKey<Schema.Struct<{
         readonly telegram: Schema.optionalKey<Schema.Struct<{
             readonly connection: Schema.String;
         }>>;
+        readonly slack: Schema.optionalKey<Schema.Struct<{
+            readonly connection: Schema.String;
+        }>>;
+        readonly whatsapp: Schema.optionalKey<Schema.Struct<{
+            readonly connection: Schema.String;
+        }>>;
         readonly attribution: Schema.optionalKey<Schema.Struct<{
             readonly template: Schema.optionalKey<Schema.String>;
             readonly separator: Schema.optionalKey<Schema.String>;
@@ -2327,10 +2374,20 @@ export declare const OntologyManifest: Schema.declareConstructor<{
         /** Written only when the ontology sends data out through the connection. */
         readonly delivers: Schema.optionalKey<Schema.Literal<true>>;
     }>>>;
+    /**
+     * The providers whose chats the built-in exact chat post delivers to, each through its declared
+     * connection, and the attribution it adds. Absent, or without a provider, delivers nowhere.
+     */
     readonly chat: Schema.optionalKey<Schema.Struct<{
         readonly telegram: Schema.optionalKey<Schema.Struct<{
             readonly connection: Schema.String;
         }>>;
+        readonly slack: Schema.optionalKey<Schema.Struct<{
+            readonly connection: Schema.String;
+        }>>;
+        readonly whatsapp: Schema.optionalKey<Schema.Struct<{
+            readonly connection: Schema.String;
+        }>>;
         readonly attribution: Schema.optionalKey<Schema.Struct<{
             readonly template: Schema.optionalKey<Schema.String>;
             readonly separator: Schema.optionalKey<Schema.String>;
@@ -2511,6 +2568,12 @@ export declare const OntologyManifest: Schema.declareConstructor<{
         readonly telegram?: {
             readonly connection: string;
         } | undefined;
+        readonly slack?: {
+            readonly connection: string;
+        } | undefined;
+        readonly whatsapp?: {
+            readonly connection: string;
+        } | undefined;
         readonly attribution?: {
             readonly template?: string | undefined;
             readonly separator?: string | undefined;
@@ -2732,6 +2795,12 @@ export declare const OntologyManifest: Schema.declareConstructor<{
         readonly telegram?: {
             readonly connection: string;
         } | undefined;
+        readonly slack?: {
+            readonly connection: string;
+        } | undefined;
+        readonly whatsapp?: {
+            readonly connection: string;
+        } | undefined;
         readonly attribution?: {
             readonly template?: string | undefined;
             readonly separator?: string | undefined;
@@ -2959,6 +3028,12 @@ export declare const decodeManifestDocument: (value: unknown) => Effect.Effect<{
         readonly telegram?: {
             readonly connection: string;
         } | undefined;
+        readonly slack?: {
+            readonly connection: string;
+        } | undefined;
+        readonly whatsapp?: {
+            readonly connection: string;
+        } | undefined;
         readonly attribution?: {
             readonly template?: string | undefined;
             readonly separator?: string | undefined;
@@ -3180,6 +3255,12 @@ export declare const decodeManifestDocument: (value: unknown) => Effect.Effect<{
         readonly telegram?: {
             readonly connection: string;
         } | undefined;
+        readonly slack?: {
+            readonly connection: string;
+        } | undefined;
+        readonly whatsapp?: {
+            readonly connection: string;
+        } | undefined;
         readonly attribution?: {
             readonly template?: string | undefined;
             readonly separator?: string | undefined;
@@ -3312,6 +3393,12 @@ export declare function buildManifest(input: {
         readonly telegram?: {
             readonly connection: string;
         };
+        readonly slack?: {
+            readonly connection: string;
+        };
+        readonly whatsapp?: {
+            readonly connection: string;
+        };
         readonly attribution?: ChatAttributionSettings;
     };
     readonly entities: ReadonlyArray<ResolvedEntity>;

package/dist/manifest.js

@@ -54,6 +54,9 @@ import { CHANNEL_PROVIDERS, DEFAULT_SIGN_IN_POLICY, isSignInPolicy, } from "./si
  * Version 15 changes no field this SDK writes. Ontology SDKs 0.86.0 to 0.88.0 introduced it with
  * `executionCompatibility` and three workflow capabilities for a deploy guard that was withdrawn;
  * readers ignore them.
+ * Within version 15, `chat` may carry `slack` and `whatsapp` beside `telegram`: the connections
+ * exact chat posts to Slack chats and to members' WhatsApp chats go through. Older readers ignore
+ * them, and their services post to Telegram alone.
  */
 export const MANIFEST_VERSION = 15;
 /** The first version whose documents use snake_case names on the wire. */
@@ -411,8 +414,14 @@ const OntologyManifestModel = Schema.Struct({
     emails: Schema.optionalKey(Schema.Record(Schema.String, EmailTemplateManifest)),
     /** The connections the actions call. Written only when there are some; absent reads as none. */
     connections: Schema.optionalKey(Schema.Array(ConnectionManifest)),
+    /**
+     * The providers whose chats the built-in exact chat post delivers to, each through its declared
+     * connection, and the attribution it adds. Absent, or without a provider, delivers nowhere.
+     */
     chat: Schema.optionalKey(Schema.Struct({
         telegram: Schema.optionalKey(Schema.Struct({ connection: Schema.String })),
+        slack: Schema.optionalKey(Schema.Struct({ connection: Schema.String })),
+        whatsapp: Schema.optionalKey(Schema.Struct({ connection: Schema.String })),
         attribution: Schema.optionalKey(Schema.Struct({
             template: Schema.optionalKey(Schema.String),
             separator: Schema.optionalKey(Schema.String),

package/dist/migrate/model.d.ts

@@ -400,6 +400,12 @@ export declare const MigrationPlan: Schema.Struct<{
             readonly telegram?: {
                 readonly connection: string;
             } | undefined;
+            readonly slack?: {
+                readonly connection: string;
+            } | undefined;
+            readonly whatsapp?: {
+                readonly connection: string;
+            } | undefined;
             readonly attribution?: {
                 readonly template?: string | undefined;
                 readonly separator?: string | undefined;
@@ -621,6 +627,12 @@ export declare const MigrationPlan: Schema.Struct<{
             readonly telegram?: {
                 readonly connection: string;
             } | undefined;
+            readonly slack?: {
+                readonly connection: string;
+            } | undefined;
+            readonly whatsapp?: {
+                readonly connection: string;
+            } | undefined;
             readonly attribution?: {
                 readonly template?: string | undefined;
                 readonly separator?: string | undefined;
@@ -842,6 +854,12 @@ export declare const MigrationPlan: Schema.Struct<{
             readonly telegram?: {
                 readonly connection: string;
             } | undefined;
+            readonly slack?: {
+                readonly connection: string;
+            } | undefined;
+            readonly whatsapp?: {
+                readonly connection: string;
+            } | undefined;
             readonly attribution?: {
                 readonly template?: string | undefined;
                 readonly separator?: string | undefined;
@@ -1063,6 +1081,12 @@ export declare const MigrationPlan: Schema.Struct<{
             readonly telegram?: {
                 readonly connection: string;
             } | undefined;
+            readonly slack?: {
+                readonly connection: string;
+            } | undefined;
+            readonly whatsapp?: {
+                readonly connection: string;
+            } | undefined;
             readonly attribution?: {
                 readonly template?: string | undefined;
                 readonly separator?: string | undefined;
@@ -1346,6 +1370,12 @@ export declare const MigrationPlan: Schema.Struct<{
             readonly telegram: Schema.optionalKey<Schema.Struct<{
                 readonly connection: Schema.String;
             }>>;
+            readonly slack: Schema.optionalKey<Schema.Struct<{
+                readonly connection: Schema.String;
+            }>>;
+            readonly whatsapp: Schema.optionalKey<Schema.Struct<{
+                readonly connection: Schema.String;
+            }>>;
             readonly attribution: Schema.optionalKey<Schema.Struct<{
                 readonly template: Schema.optionalKey<Schema.String>;
                 readonly separator: Schema.optionalKey<Schema.String>;
@@ -1562,6 +1592,12 @@ export declare const MigrationPlan: Schema.Struct<{
             readonly telegram: Schema.optionalKey<Schema.Struct<{
                 readonly connection: Schema.String;
             }>>;
+            readonly slack: Schema.optionalKey<Schema.Struct<{
+                readonly connection: Schema.String;
+            }>>;
+            readonly whatsapp: Schema.optionalKey<Schema.Struct<{
+                readonly connection: Schema.String;
+            }>>;
             readonly attribution: Schema.optionalKey<Schema.Struct<{
                 readonly template: Schema.optionalKey<Schema.String>;
                 readonly separator: Schema.optionalKey<Schema.String>;
@@ -1729,6 +1765,12 @@ export declare const MigrationPlan: Schema.Struct<{
             readonly telegram?: {
                 readonly connection: string;
             } | undefined;
+            readonly slack?: {
+                readonly connection: string;
+            } | undefined;
+            readonly whatsapp?: {
+                readonly connection: string;
+            } | undefined;
             readonly attribution?: {
                 readonly template?: string | undefined;
                 readonly separator?: string | undefined;
@@ -1950,6 +1992,12 @@ export declare const MigrationPlan: Schema.Struct<{
             readonly telegram?: {
                 readonly connection: string;
             } | undefined;
+            readonly slack?: {
+                readonly connection: string;
+            } | undefined;
+            readonly whatsapp?: {
+                readonly connection: string;
+            } | undefined;
             readonly attribution?: {
                 readonly template?: string | undefined;
                 readonly separator?: string | undefined;

package/dist/runtime-source.d.ts

@@ -1,6 +1,6 @@
 import { Schema } from "effect";
 /** Decoded only at a verified runtime boundary; ordinary action arguments never establish provenance. */
-export declare const RuntimeSource: Schema.Struct<{
+export declare const RuntimeSource: Schema.Union<readonly [Schema.Struct<{
     readonly provider: Schema.Literal<"telegram">;
     readonly chat_id: Schema.String;
     readonly thread_id: Schema.String;
@@ -15,7 +15,15 @@ export declare const RuntimeSource: Schema.Struct<{
         readonly media_type: Schema.optionalKey<Schema.String>;
         readonly staged_id: Schema.String;
     }>>>;
-}>;
+}>, Schema.Struct<{
+    readonly provider: Schema.Literals<readonly ["slack", "whatsapp"]>;
+    readonly chat_id: Schema.String;
+    readonly thread_id: Schema.String;
+    readonly kind: Schema.Literals<readonly ["private", "group"]>;
+    readonly peer: Schema.optionalKey<Schema.String>;
+    readonly message_id: Schema.optionalKey<Schema.String>;
+    readonly sender: Schema.optionalKey<Schema.String>;
+}>]>;
 export type RuntimeSource = typeof RuntimeSource.Type;
 export interface ActionRuntime {
     readonly source: RuntimeSource;

package/dist/runtime-source.js

@@ -1,7 +1,7 @@
 import { Schema } from "effect";
 const Id = Schema.String.check(Schema.isMinLength(1), Schema.isMaxLength(512));
-/** Decoded only at a verified runtime boundary; ordinary action arguments never establish provenance. */
-export const RuntimeSource = Schema.Struct({
+/** A Telegram chat, with the references Telegram's own actions and attachments use. */
+const TelegramRuntimeSource = Schema.Struct({
     provider: Schema.Literal("telegram"),
     chat_id: Id,
     thread_id: Schema.String.check(Schema.isMaxLength(512)),
@@ -26,3 +26,19 @@ export const RuntimeSource = Schema.Struct({
         staged_id: Id,
     })).check(Schema.isMaxLength(10))),
 });
+/**
+ * A conversation in another channel the agent serves. `kind` says whether it is one person's
+ * direct conversation; `peer` is that person's id on the provider, which a private destination on
+ * the same provider names, while `chat_id` names the conversation itself.
+ */
+const ChannelRuntimeSource = Schema.Struct({
+    provider: Schema.Literals(["slack", "whatsapp"]),
+    chat_id: Id,
+    thread_id: Schema.String.check(Schema.isMaxLength(512)),
+    kind: Schema.Literals(["private", "group"]),
+    peer: Schema.optionalKey(Id),
+    message_id: Schema.optionalKey(Id),
+    sender: Schema.optionalKey(Id),
+});
+/** Decoded only at a verified runtime boundary; ordinary action arguments never establish provenance. */
+export const RuntimeSource = Schema.Union([TelegramRuntimeSource, ChannelRuntimeSource]);

package/dist/service/agent/attachments.js

@@ -173,15 +173,19 @@ export function attachmentsLayer(options) {
                 subjectId: caller.principal.id,
             });
             const attachmentId = yield* idOf;
-            const { attachments: sourceAttachments, ...sourceFields } = metadata.envelope?.source ?? {};
-            const matchingAttachments = sourceAttachments?.filter((attachment) => attachment.staged_id === attachmentId);
-            const source = metadata.envelope?.source === undefined
+            const envelopeSource = metadata.envelope?.source;
+            // Only a Telegram source names the provider files a message carried.
+            const matchingAttachments = envelopeSource?.provider === "telegram"
+                ? envelopeSource.attachments?.filter((attachment) => attachment.staged_id === attachmentId)
+                : undefined;
+            const source = envelopeSource === undefined
                 ? undefined
-                : {
-                    ...metadata.envelope.source,
-                    ...sourceFields,
-                    attachments: matchingAttachments?.length ? matchingAttachments : undefined,
-                };
+                : envelopeSource.provider === "telegram"
+                    ? {
+                        ...envelopeSource,
+                        attachments: matchingAttachments?.length ? matchingAttachments : undefined,
+                    }
+                    : envelopeSource;
             const principal = source === undefined
                 ? caller.principal
                 : yield* agents.actingMember(caller.principal.id, source.provider);

package/dist/service/chat/delivery.d.ts

@@ -7,6 +7,7 @@ import type { ConnectionTransportFactory } from "../connections.js";
 import type { OntologyBackend } from "../runtime-contract.js";
 import type { DeliveryArchive } from "./archive.js";
 import type { RuntimeChatEnvelope } from "./envelope.js";
+import { type Destination } from "./resolve.js";
 export type ChatDeliveryFactory = (input: {
     readonly backend: OntologyBackend["Service"];
     readonly principal: Principal;
@@ -15,4 +16,10 @@ export type ChatDeliveryFactory = (input: {
     readonly requestId: string;
     readonly envelope?: RuntimeChatEnvelope;
 }) => ChatDelivery["Service"];
+/**
+ * Whether a post would land in the conversation it was asked from. A private destination names the
+ * person, not the conversation: a Slack direct message is `D…` while the person is `U…`, so a
+ * private source matches a private destination on the same provider by its `peer`.
+ */
+export declare function sameChat(source: NonNullable<RuntimeChatEnvelope["source"]>, target: Pick<Destination, "provider" | "external_id" | "kind">): boolean;
 export declare function makeChatDelivery(ontology: Ontology, connections: ConnectionTransportFactory, archive: DeliveryArchive, previews?: TelegramPreviewContext): ChatDeliveryFactory;