@sentry/junior 0.162.0 → 0.163.0

package/dist/{chunk-JRVURR3H.js → chunk-MWVQ35U6.js}

@@ -1,10 +1,10 @@
 import {
   createWebAuthorization,
   deleteWebAuthorization
-} from "./chunk-RDV4BQRZ.js";
+} from "./chunk-NL53P7PS.js";
 import {
   appendAndEnqueueInboundMessage
-} from "./chunk-5NEBOHRG.js";
+} from "./chunk-IIT23D3M.js";
 import {
   buildDeliveredTurnStatePatch,
   completeAuthPauseTurn,
@@ -12,25 +12,26 @@ import {
   getTurnUserMessage,
   processPluginTask,
   scheduleSessionCompletedPluginTasks
-} from "./chunk-KQSO4DJ4.js";
+} from "./chunk-O5ZZL7IR.js";
 import {
   ConversationTurnLifecycleService,
   coerceThreadConversationState,
   getPersistedSandboxState,
   getPersistedThreadState,
   persistThreadStateById
-} from "./chunk-OPNJRQDP.js";
+} from "./chunk-EKGJVUVS.js";
 import {
   healthReportSchema
 } from "./chunk-UTL3MHPC.js";
 import {
   parseSlackThreadId
-} from "./chunk-WHAJ3QVY.js";
+} from "./chunk-ICJ3KCA2.js";
 import {
   TurnInputCommitLostError,
   abandonTurnRecord,
   buildConversationContext,
   buildDeterministicTurnId,
+  clearPendingAuth,
   getAssistantReplyText,
   getConversationTurnBoundaryError,
   getTurnRecord,
@@ -48,17 +49,31 @@ import {
   saveTurnCheckpoint,
   startActiveTurn,
   upsertConversationMessage
-} from "./chunk-V7QL4QMW.js";
+} from "./chunk-MXFL7LNZ.js";
 import {
   normalizeSlackConversationId
-} from "./chunk-QHCIZLIX.js";
+} from "./chunk-ZF6IC27P.js";
 import {
   getConversationEventStore,
-  getConversationStore
-} from "./chunk-DDQ43S5Q.js";
+  getConversationStore,
+  getDb
+} from "./chunk-JI5EPI3O.js";
+import {
+  juniorApiTokens,
+  juniorConversationParticipants,
+  juniorConversations,
+  juniorIdentities,
+  juniorUsers
+} from "./chunk-ATWHPSMF.js";
 import {
   getSlackBotToken
-} from "./chunk-MNCEGXEH.js";
+} from "./chunk-YAUQXZVT.js";
+import {
+  juniorDestinations
+} from "./chunk-VFUK3X5B.js";
+import {
+  canExposeConversationPayload
+} from "./chunk-3T7RJVDJ.js";
 import {
   credentialContextForActor
 } from "./chunk-BDUENQD3.js";
@@ -67,7 +82,7 @@ import {
   logWarn,
   setTags,
   withLogContext
-} from "./chunk-Y75ZDQB5.js";
+} from "./chunk-TPT6EF7K.js";
 
 // src/handlers/health.ts
 function readHealthReport() {
@@ -105,115 +120,254 @@ function createVercelAttachmentStorage() {
   };
 }
 
-// src/chat/slack/user.ts
-import { z } from "zod";
-var slackUserInfoSchema = z.object({
-  ok: z.literal(true),
-  user: z.object({
-    name: z.string().nullish(),
-    profile: z.object({
-      email: z.string().nullish(),
-      real_name: z.string().nullish()
-    }).optional()
-  })
-});
-var USER_CACHE_TTL_MS = 5 * 60 * 1e3;
-var userCache = /* @__PURE__ */ new Map();
-function userCacheKey(teamId, userId) {
-  return `${teamId}:${userId}`;
+// src/personal-tokens/store.ts
+import { createHash, randomBytes, randomUUID } from "crypto";
+import { and, desc, eq, gt, isNull } from "drizzle-orm";
+var TOKEN_PREFIX = "jr_pat_";
+var TOKEN_SUFFIX_LENGTH = 8;
+var DEFAULT_TOKEN_LIFETIME_MS = 90 * 24 * 60 * 60 * 1e3;
+function normalizeEmail(email) {
+  return email.trim().toLowerCase();
 }
-function readFromCache(teamId, userId) {
-  const hit = userCache.get(userCacheKey(teamId, userId));
-  if (!hit) return null;
-  if (hit.expiresAt < Date.now()) {
-    userCache.delete(userCacheKey(teamId, userId));
-    return null;
+function hashToken(token) {
+  return createHash("sha256").update(token, "utf8").digest("hex");
+}
+function metadata(row) {
+  return {
+    id: row.id,
+    name: row.name,
+    tokenSuffix: row.tokenSuffix,
+    createdAt: row.createdAt.toISOString(),
+    expiresAt: row.expiresAt.toISOString(),
+    lastUsedAt: row.lastUsedAt?.toISOString() ?? null
+  };
+}
+async function createPersonalToken(args) {
+  const now = args.now ?? /* @__PURE__ */ new Date();
+  const token = `${TOKEN_PREFIX}${randomBytes(32).toString("base64url")}`;
+  const row = {
+    id: randomUUID(),
+    ownerEmailNormalized: normalizeEmail(args.email),
+    name: args.name.trim(),
+    tokenHash: hashToken(token),
+    tokenSuffix: token.slice(-TOKEN_SUFFIX_LENGTH),
+    createdAt: now,
+    expiresAt: new Date(now.getTime() + DEFAULT_TOKEN_LIFETIME_MS)
+  };
+  await getDb().insert(juniorApiTokens).values(row);
+  return { ...metadata({ ...row, lastUsedAt: null, revokedAt: null }), token };
+}
+async function listPersonalTokens(email, now = /* @__PURE__ */ new Date()) {
+  const rows = await getDb().select().from(juniorApiTokens).where(
+    and(
+      eq(juniorApiTokens.ownerEmailNormalized, normalizeEmail(email)),
+      isNull(juniorApiTokens.revokedAt),
+      gt(juniorApiTokens.expiresAt, now)
+    )
+  ).orderBy(desc(juniorApiTokens.createdAt));
+  return rows.map(metadata);
+}
+async function revokePersonalToken(args) {
+  const rows = await getDb().update(juniorApiTokens).set({ revokedAt: args.now ?? /* @__PURE__ */ new Date() }).where(
+    and(
+      eq(juniorApiTokens.id, args.id),
+      eq(juniorApiTokens.ownerEmailNormalized, normalizeEmail(args.email)),
+      isNull(juniorApiTokens.revokedAt)
+    )
+  ).returning({ id: juniorApiTokens.id });
+  return rows.length > 0;
+}
+async function authenticatePersonalToken(token, now = /* @__PURE__ */ new Date()) {
+  if (!token.startsWith(TOKEN_PREFIX)) return void 0;
+  const rows = await getDb().select({
+    id: juniorApiTokens.id,
+    ownerEmailNormalized: juniorApiTokens.ownerEmailNormalized
+  }).from(juniorApiTokens).where(
+    and(
+      eq(juniorApiTokens.tokenHash, hashToken(token)),
+      isNull(juniorApiTokens.revokedAt),
+      gt(juniorApiTokens.expiresAt, now)
+    )
+  ).limit(1);
+  const match = rows[0];
+  if (!match) return void 0;
+  await getDb().update(juniorApiTokens).set({ lastUsedAt: now }).where(eq(juniorApiTokens.id, match.id));
+  return match.ownerEmailNormalized;
+}
+
+// src/chat/api-turns/work.ts
+import { createHash as createHash2 } from "crypto";
+import {
+  createWebSource,
+  localDestinationSchema
+} from "@sentry/junior-plugin-api";
+
+// src/chat/api-turns/cancellation.ts
+function createApiTurnCancellation() {
+  const active = /* @__PURE__ */ new Map();
+  return {
+    begin(conversationId) {
+      if (active.has(conversationId)) {
+        return void 0;
+      }
+      const controller = new AbortController();
+      active.set(conversationId, {
+        connected: true,
+        controller,
+        parked: false
+      });
+      return controller.signal;
+    },
+    cancel(conversationId) {
+      const entry = active.get(conversationId);
+      if (!entry) {
+        return false;
+      }
+      entry.controller.abort(new Error("API Turn cancelled"));
+      return true;
+    },
+    disconnect(conversationId, signal) {
+      const entry = active.get(conversationId);
+      if (entry?.controller.signal !== signal) {
+        return;
+      }
+      entry.connected = false;
+      if (entry.parked) {
+        active.delete(conversationId);
+      }
+    },
+    finish(conversationId, signal) {
+      const entry = active.get(conversationId);
+      if (entry?.controller.signal === signal) {
+        active.delete(conversationId);
+      }
+    },
+    park(conversationId, signal) {
+      const entry = active.get(conversationId);
+      if (entry?.controller.signal !== signal) {
+        return;
+      }
+      entry.parked = true;
+      if (!entry.connected) {
+        active.delete(conversationId);
+      }
+    },
+    signal(conversationId) {
+      return active.get(conversationId)?.controller.signal;
+    }
+  };
+}
+async function completeCancelledApiTurn(args) {
+  try {
+    await abandonTurnRecord({
+      conversationId: args.conversationId,
+      turnId: args.turnId,
+      errorMessage: "API Turn cancelled"
+    });
+    clearPendingAuth(args.conversation, args.turnId);
+    markConversationMessage(args.conversation, args.userMessageId, {
+      replied: false,
+      skippedReason: "turn cancelled"
+    });
+    markTurnClosed({
+      conversation: args.conversation,
+      nowMs: Date.now(),
+      sessionId: args.turnId
+    });
+    await deleteWebAuthorization({
+      actorId: args.actorId,
+      conversationId: args.conversationId
+    });
+    await persistThreadStateById(args.conversationId, {
+      conversation: args.conversation,
+      sandboxRef: args.sandboxRef
+    });
+    await args.lifecycle.complete({
+      conversationId: args.conversationId,
+      createdAtMs: Date.now(),
+      outcome: "cancelled",
+      turnId: args.turnId
+    });
+  } finally {
+    if (args.signal) {
+      args.cancellation?.finish(args.conversationId, args.signal);
+    }
   }
-  return hit.value;
+  await args.acknowledge();
 }
-function writeToCache(teamId, userId, value) {
-  userCache.set(userCacheKey(teamId, userId), {
-    value,
-    expiresAt: Date.now() + USER_CACHE_TTL_MS
+
+// src/chat/api-turns/routing.ts
+import { z } from "zod";
+var apiTurnMailboxMetadataSchema = z.object({
+  authorEmail: z.string().email(),
+  authorFullName: z.string().min(1).optional(),
+  authorUserId: z.string().min(1),
+  authorUserName: z.string().min(1).optional(),
+  kind: z.literal("api_turn"),
+  messageId: z.string().min(1)
+}).strict();
+function parseApiTurnMessages(messages) {
+  if (messages.length === 0) {
+    return [];
+  }
+  const parsed = messages.map((message) => ({
+    message,
+    metadata: apiTurnMailboxMetadataSchema.safeParse(message.input.metadata)
+  }));
+  if (parsed.every((entry) => !entry.metadata.success)) {
+    return [];
+  }
+  if (parsed.some((entry) => !entry.metadata.success)) {
+    throw new Error("Conversation mailbox mixes web turns and other input");
+  }
+  return parsed.map((entry) => {
+    if (!entry.metadata.success) {
+      throw new Error("API turn mailbox metadata failed validation");
+    }
+    return { message: entry.message, metadata: entry.metadata.data };
   });
 }
-async function lookupSlackUser(teamId, userId) {
-  if (!teamId || !userId) {
-    return null;
-  }
-  const cached = readFromCache(teamId, userId);
-  if (cached) {
-    return cached;
+async function resolveApiTurnWork(context) {
+  const batch = parseApiTurnMessages(context.attempt.messages);
+  if (batch.length > 0) {
+    return { kind: "mailbox", batch };
   }
-  const token = getSlackBotToken();
-  if (!token) {
-    return null;
+  if (context.attempt.messages.length > 0) {
+    return void 0;
   }
-  try {
-    const response = await fetch(
-      `https://slack.com/api/users.info?user=${encodeURIComponent(userId)}`,
-      {
-        headers: {
-          authorization: `Bearer ${token}`
-        }
-      }
+  const summaries = await listTurnSummaries(context.conversationId);
+  const active = summaries.filter(
+    (summary) => summary.surface === "api" && !summary.dispatchId && (summary.state === "paused" || summary.state === "running")
+  );
+  if (active.length > 1) {
+    throw new Error(
+      `Conversation ${context.conversationId} has multiple active web turns`
     );
-    if (!response.ok) {
-      logWarn("slack.user.lookup.failed", {
-        "enduser.id": userId,
-        "app.slack.team_id": teamId,
-        "http.response.status_code": response.status
-      });
-      return null;
-    }
-    const parsed = slackUserInfoSchema.safeParse(await response.json());
-    if (!parsed.success) {
-      return null;
-    }
-    const payload = parsed.data;
-    const userName = payload.user.name?.trim() || void 0;
-    const fullName = payload.user.profile?.real_name?.trim() || void 0;
-    const result = {
-      userName,
-      fullName,
-      email: payload.user.profile?.email?.trim() || void 0
-    };
-    writeToCache(teamId, userId, result);
-    return result;
-  } catch (error) {
-    logWarn("slack.user.lookup.failed", {
-      "enduser.id": userId,
-      "app.slack.team_id": teamId,
-      "exception.message": error instanceof Error ? error.message : String(error)
-    });
-    return null;
   }
+  const turnId = active[0]?.turnId;
+  if (!turnId) {
+    return void 0;
+  }
+  const record = await getTurnRecord(context.conversationId, turnId);
+  if (!record || record.surface !== "api" || Boolean(record.dispatchId) || record.state !== "paused" && record.state !== "running") {
+    return void 0;
+  }
+  return { kind: "resume", turnId };
+}
+async function isApiTurnWork(context) {
+  return await resolveApiTurnWork(context) !== void 0;
 }
 
 // src/chat/api-turns/work.ts
-import { createHash } from "crypto";
-import { z as z2 } from "zod";
-import {
-  createWebSource,
-  localDestinationSchema
-} from "@sentry/junior-plugin-api";
-var apiTurnMailboxMetadataSchema = z2.object({
-  authorEmail: z2.string().email(),
-  authorFullName: z2.string().min(1).optional(),
-  authorUserId: z2.string().min(1),
-  authorUserName: z2.string().min(1).optional(),
-  kind: z2.literal("api_turn"),
-  messageId: z2.string().min(1)
-}).strict();
-function normalizeEmail(email) {
+function normalizeEmail2(email) {
   return email.trim().toLowerCase();
 }
 function stableHex(...parts) {
-  return createHash("sha256").update(parts.join("\0")).digest("hex").slice(0, 24);
+  return createHash2("sha256").update(parts.join("\0")).digest("hex").slice(0, 24);
 }
 function createApiConversationId(args) {
   return `local:web:${stableHex(
-    normalizeEmail(args.actorEmail),
+    normalizeEmail2(args.actorEmail),
     args.idempotencyKey
   )}`;
 }
@@ -245,23 +399,23 @@ function webSourceForConversation(args) {
     args.visibility === "private" ? "private" : "public"
   );
 }
-function actorFromMetadata(metadata) {
+function actorFromMetadata(metadata2) {
   return {
     platform: "web",
-    userId: metadata.authorUserId,
-    email: normalizeEmail(metadata.authorEmail),
-    ...metadata.authorFullName ? { fullName: metadata.authorFullName } : {},
-    ...metadata.authorUserName ? { userName: metadata.authorUserName } : {}
+    userId: metadata2.authorUserId,
+    email: normalizeEmail2(metadata2.authorEmail),
+    ...metadata2.authorFullName ? { fullName: metadata2.authorFullName } : {},
+    ...metadata2.authorUserName ? { userName: metadata2.authorUserName } : {}
   };
 }
 function storedActorFromApi(actor) {
   return {
-    ...actor.email ? { email: normalizeEmail(actor.email) } : {},
+    ...actor.email ? { email: normalizeEmail2(actor.email) } : {},
     ...actor.fullName ? { fullName: actor.fullName } : {}
   };
 }
 function webActorFromEmail(email, profile) {
-  const normalized = normalizeEmail(email);
+  const normalized = normalizeEmail2(email);
   return {
     platform: "web",
     userId: `dashboard:${stableHex(normalized)}`,
@@ -303,7 +457,7 @@ function buildApiTurnInboundMessage(args) {
       authorId: args.actor.userId,
       text,
       metadata: {
-        authorEmail: normalizeEmail(args.actor.email),
+        authorEmail: normalizeEmail2(args.actor.email),
         ...args.actor.fullName ? { authorFullName: args.actor.fullName } : {},
         authorUserId: args.actor.userId,
         ...args.actor.userName ? { authorUserName: args.actor.userName } : {},
@@ -401,57 +555,6 @@ async function appendAndEnqueueApiConversationMessage(input, options) {
     status: result.status === "duplicate" ? "duplicate" : "accepted"
   };
 }
-function parseApiTurnMessages(messages) {
-  if (messages.length === 0) {
-    return [];
-  }
-  const parsed = messages.map((message) => ({
-    message,
-    metadata: apiTurnMailboxMetadataSchema.safeParse(message.input.metadata)
-  }));
-  if (parsed.every((entry) => !entry.metadata.success)) {
-    return [];
-  }
-  if (parsed.some((entry) => !entry.metadata.success)) {
-    throw new Error("Conversation mailbox mixes web turns and other input");
-  }
-  return parsed.map((entry) => {
-    if (!entry.metadata.success) {
-      throw new Error("API turn mailbox metadata failed validation");
-    }
-    return { message: entry.message, metadata: entry.metadata.data };
-  });
-}
-async function resolveApiTurnWork(context) {
-  const batch = parseApiTurnMessages(context.attempt.messages);
-  if (batch.length > 0) {
-    return { kind: "mailbox", batch };
-  }
-  if (context.attempt.messages.length > 0) {
-    return void 0;
-  }
-  const summaries = await listTurnSummaries(context.conversationId);
-  const active = summaries.filter(
-    (summary) => summary.surface === "api" && !summary.dispatchId && (summary.state === "paused" || summary.state === "running")
-  );
-  if (active.length > 1) {
-    throw new Error(
-      `Conversation ${context.conversationId} has multiple active web turns`
-    );
-  }
-  const turnId = active[0]?.turnId;
-  if (!turnId) {
-    return void 0;
-  }
-  const record = await getTurnRecord(context.conversationId, turnId);
-  if (!record || record.surface !== "api" || Boolean(record.dispatchId) || record.state !== "paused" && record.state !== "running") {
-    return void 0;
-  }
-  return { kind: "resume", turnId };
-}
-async function isApiTurnWork(context) {
-  return await resolveApiTurnWork(context) !== void 0;
-}
 function captureApiBoundaryFailure(args) {
   const eventId = logException(args.error, `api.turn.${args.failureCode}`, {
     conversationId: args.conversationId,
@@ -460,6 +563,10 @@ function captureApiBoundaryFailure(args) {
   });
   return typeof eventId === "string" ? eventId : void 0;
 }
+function hasLostTurnInputCommit(error) {
+  const cause = getConversationTurnBoundaryError(error)?.cause ?? error;
+  return isTurnInputCommitLostError(error) || isTurnInputCommitLostError(cause);
+}
 function createApiTurnWorker(options) {
   return async (context) => {
     const resolved = await resolveApiTurnWork(context);
@@ -618,6 +725,39 @@ function createApiTurnWorker(options) {
         let modelFailureEventId;
         let modelFailureCaptureAttempted = false;
         let reply;
+        const cancellationSignal = options.cancellation?.signal(
+          context.conversationId
+        );
+        const finishCancellation = () => {
+          if (cancellationSignal) {
+            options.cancellation?.finish(
+              context.conversationId,
+              cancellationSignal
+            );
+          }
+        };
+        const completeCancelledTurn = async () => {
+          try {
+            await completeCancelledApiTurn({
+              acknowledge,
+              actorId: actor.userId,
+              cancellation: options.cancellation,
+              conversation,
+              conversationId: context.conversationId,
+              lifecycle,
+              sandboxRef,
+              signal: cancellationSignal,
+              turnId,
+              userMessageId
+            });
+          } catch (error) {
+            if (hasLostTurnInputCommit(error)) {
+              return { status: "lost_lease" };
+            }
+            throw error;
+          }
+          return { status: "completed" };
+        };
         const deliverAssistantMessage = async (value) => {
           const replyText = typeof value === "string" ? value : getAssistantReplyText(value);
           if (!replyText?.trim()) {
@@ -654,6 +794,9 @@ function createApiTurnWorker(options) {
           await persistThreadStateById(context.conversationId, {
             conversation
           });
+          if (cancellationSignal?.aborted) {
+            return await completeCancelledTurn();
+          }
           const piMessages = await loadProjection({
             conversationId: context.conversationId
           });
@@ -677,6 +820,7 @@ function createApiTurnWorker(options) {
             publishExternally: false,
             source,
             surface: "api",
+            ...cancellationSignal ? { signal: cancellationSignal } : {},
             authorization: createWebAuthorization({
               actorId: actor.userId,
               conversationId: context.conversationId
@@ -705,6 +849,9 @@ function createApiTurnWorker(options) {
               }
             }
           });
+          if (cancellationSignal?.aborted) {
+            return await completeCancelledTurn();
+          }
           if (outcome.status === "suspended") {
             return { status: "yielded" };
           }
@@ -717,9 +864,16 @@ function createApiTurnWorker(options) {
               conversation,
               sandboxRef
             });
+            if (cancellationSignal) {
+              options.cancellation?.park(
+                context.conversationId,
+                cancellationSignal
+              );
+            }
             await acknowledge();
             return { status: "completed" };
           }
+          finishCancellation();
           reply = outcome.result;
           modelFailureCaptureAttempted = reply.diagnostics.outcome !== "success";
           const finalized = finalizeFailedTurnReplyWithEvent({
@@ -808,10 +962,12 @@ function createApiTurnWorker(options) {
           await acknowledge();
           return { status: "completed" };
         } catch (error) {
-          const cause = getConversationTurnBoundaryError(error)?.cause ?? error;
-          if (isTurnInputCommitLostError(error) || isTurnInputCommitLostError(cause)) {
+          if (hasLostTurnInputCommit(error)) {
             return { status: "lost_lease" };
           }
+          if (cancellationSignal?.aborted) {
+            return await completeCancelledTurn();
+          }
           if (!context.attempt.isFinalAttempt) {
             throw error;
           }
@@ -850,6 +1006,7 @@ function createApiTurnWorker(options) {
             failureCode,
             turnId
           });
+          finishCancellation();
           await acknowledge();
           return { status: "completed" };
         }
@@ -863,6 +1020,217 @@ function routeApiTurnWork(options) {
   };
 }
 
+// src/api/conversations/access.ts
+import { eq as eq3, inArray as inArray2 } from "drizzle-orm";
+import { alias } from "drizzle-orm/pg-core";
+
+// src/api/conversations/membership.ts
+import { and as and2, eq as eq2, exists, inArray, or } from "drizzle-orm";
+function conversationHasParticipantUser(userId) {
+  const participant = getDb().select({
+    rootConversationId: juniorConversationParticipants.rootConversationId
+  }).from(juniorConversationParticipants).where(
+    and2(
+      eq2(
+        juniorConversationParticipants.rootConversationId,
+        juniorConversations.conversationId
+      ),
+      eq2(juniorConversationParticipants.userId, userId)
+    )
+  );
+  return exists(participant);
+}
+function conversationHasParticipantEmail(email) {
+  const participant = getDb().select({
+    rootConversationId: juniorConversationParticipants.rootConversationId
+  }).from(juniorConversationParticipants).innerJoin(
+    juniorUsers,
+    eq2(juniorUsers.id, juniorConversationParticipants.userId)
+  ).where(
+    and2(
+      eq2(
+        juniorConversationParticipants.rootConversationId,
+        juniorConversations.conversationId
+      ),
+      eq2(juniorUsers.primaryEmailNormalized, email)
+    )
+  );
+  return exists(participant);
+}
+function viewerConversationMembership(args) {
+  if (args.actorMatch && args.participantMatch) {
+    return or(args.actorMatch, args.participantMatch);
+  }
+  return args.actorMatch ?? args.participantMatch;
+}
+async function conversationIdsWithParticipantUser(db, conversationIds, userId) {
+  if (conversationIds.length === 0) {
+    return /* @__PURE__ */ new Set();
+  }
+  const rows = await db.select({
+    rootConversationId: juniorConversationParticipants.rootConversationId
+  }).from(juniorConversationParticipants).where(
+    and2(
+      eq2(juniorConversationParticipants.userId, userId),
+      inArray(juniorConversationParticipants.rootConversationId, [
+        ...conversationIds
+      ])
+    )
+  );
+  return new Set(rows.map((row) => row.rootConversationId));
+}
+
+// src/api/conversations/access.ts
+var rootConversation = alias(juniorConversations, "access_root_conversation");
+var rootDestination = alias(juniorDestinations, "access_root_destination");
+var rootIdentity = alias(juniorIdentities, "access_root_identity");
+async function readConversationAccessFromSql(db, conversationIds, viewer) {
+  if (conversationIds.length === 0) return /* @__PURE__ */ new Map();
+  const normalizedViewerEmail = viewer?.email.trim().toLowerCase() || void 0;
+  const rows = await db.select({
+    conversationId: juniorConversations.conversationId,
+    parentConversationId: juniorConversations.parentConversationId,
+    storedRootConversationId: juniorConversations.rootConversationId,
+    rootConversationId: rootConversation.conversationId,
+    rootParentConversationId: rootConversation.parentConversationId,
+    rootRootConversationId: rootConversation.rootConversationId,
+    visibility: rootDestination.visibility,
+    rootEmailNormalized: rootIdentity.emailNormalized,
+    rootEmailVerified: rootIdentity.emailVerified,
+    rootUserId: rootIdentity.userId
+  }).from(juniorConversations).leftJoin(
+    rootConversation,
+    eq3(
+      rootConversation.conversationId,
+      juniorConversations.rootConversationId
+    )
+  ).leftJoin(
+    rootDestination,
+    eq3(rootDestination.id, rootConversation.destinationId)
+  ).leftJoin(
+    rootIdentity,
+    eq3(rootIdentity.id, rootConversation.actorIdentityId)
+  ).where(inArray2(juniorConversations.conversationId, [...conversationIds]));
+  const membershipConversationIds = /* @__PURE__ */ new Set();
+  for (const row of rows) {
+    membershipConversationIds.add(row.conversationId);
+    if (row.storedRootConversationId) {
+      membershipConversationIds.add(row.storedRootConversationId);
+    }
+  }
+  const participantRootIds = viewer !== void 0 ? await conversationIdsWithParticipantUser(
+    db,
+    [...membershipConversationIds],
+    viewer.id
+  ) : /* @__PURE__ */ new Set();
+  return new Map(
+    rows.map((row) => {
+      const hasValidRoot = row.rootConversationId !== null && row.rootConversationId === row.storedRootConversationId && row.rootRootConversationId === row.rootConversationId && row.rootParentConversationId === null && (row.parentConversationId !== null || row.storedRootConversationId === row.conversationId);
+      const validRootConversationId = hasValidRoot ? row.rootConversationId ?? void 0 : void 0;
+      const visibility = validRootConversationId === void 0 ? null : row.visibility;
+      const isRootActor = validRootConversationId !== void 0 && viewer !== void 0 && (row.rootUserId === viewer.id || normalizedViewerEmail !== void 0 && row.rootEmailVerified === true && row.rootEmailNormalized === normalizedViewerEmail);
+      const isMaterializedParticipant = participantRootIds.has(row.conversationId) || validRootConversationId !== void 0 && participantRootIds.has(validRootConversationId);
+      const isParticipant = isRootActor || isMaterializedParticipant;
+      const canViewPrivateContent = isParticipant || validRootConversationId !== void 0 && canExposeConversationPayload({
+        visibility: visibility ?? void 0
+      });
+      return [
+        row.conversationId,
+        {
+          canViewPrivateContent,
+          isParticipant,
+          visibility
+        }
+      ];
+    })
+  );
+}
+
+// src/chat/slack/user.ts
+import { z as z2 } from "zod";
+var slackUserInfoSchema = z2.object({
+  ok: z2.literal(true),
+  user: z2.object({
+    name: z2.string().nullish(),
+    profile: z2.object({
+      email: z2.string().nullish(),
+      real_name: z2.string().nullish()
+    }).optional()
+  })
+});
+var USER_CACHE_TTL_MS = 5 * 60 * 1e3;
+var userCache = /* @__PURE__ */ new Map();
+function userCacheKey(teamId, userId) {
+  return `${teamId}:${userId}`;
+}
+function readFromCache(teamId, userId) {
+  const hit = userCache.get(userCacheKey(teamId, userId));
+  if (!hit) return null;
+  if (hit.expiresAt < Date.now()) {
+    userCache.delete(userCacheKey(teamId, userId));
+    return null;
+  }
+  return hit.value;
+}
+function writeToCache(teamId, userId, value) {
+  userCache.set(userCacheKey(teamId, userId), {
+    value,
+    expiresAt: Date.now() + USER_CACHE_TTL_MS
+  });
+}
+async function lookupSlackUser(teamId, userId) {
+  if (!teamId || !userId) {
+    return null;
+  }
+  const cached = readFromCache(teamId, userId);
+  if (cached) {
+    return cached;
+  }
+  const token = getSlackBotToken();
+  if (!token) {
+    return null;
+  }
+  try {
+    const response = await fetch(
+      `https://slack.com/api/users.info?user=${encodeURIComponent(userId)}`,
+      {
+        headers: {
+          authorization: `Bearer ${token}`
+        }
+      }
+    );
+    if (!response.ok) {
+      logWarn("slack.user.lookup.failed", {
+        "enduser.id": userId,
+        "app.slack.team_id": teamId,
+        "http.response.status_code": response.status
+      });
+      return null;
+    }
+    const parsed = slackUserInfoSchema.safeParse(await response.json());
+    if (!parsed.success) {
+      return null;
+    }
+    const payload = parsed.data;
+    const userName = payload.user.name?.trim() || void 0;
+    const fullName = payload.user.profile?.real_name?.trim() || void 0;
+    const result = {
+      userName,
+      fullName,
+      email: payload.user.profile?.email?.trim() || void 0
+    };
+    writeToCache(teamId, userId, result);
+    return result;
+  } catch (error) {
+    logWarn("slack.user.lookup.failed", {
+      "enduser.id": userId,
+      "app.slack.team_id": teamId,
+      "exception.message": error instanceof Error ? error.message : String(error)
+    });
+    return null;
+  }
+}
+
 // src/chat/slack/conversation-context.ts
 function normalizeConversationName(type, channelName) {
   const trimmed = channelName?.trim();
@@ -957,9 +1325,20 @@ export {
   resolveSlackConversationContext,
   resolveSlackConversationContextFromThreadId,
   formatSlackConversationRedactedLabel,
+  createApiTurnCancellation,
+  apiTurnIdForMessage,
   webActorFromEmail,
+  recordApiConversationActivity,
   createAndEnqueueApiConversation,
   appendAndEnqueueApiConversationMessage,
   createApiTurnWorker,
-  routeApiTurnWork
+  routeApiTurnWork,
+  conversationHasParticipantUser,
+  conversationHasParticipantEmail,
+  viewerConversationMembership,
+  readConversationAccessFromSql,
+  createPersonalToken,
+  listPersonalTokens,
+  revokePersonalToken,
+  authenticatePersonalToken
 };