@sentry/junior 0.184.0 → 0.185.0

package/dist/{chunk-4CNDGK25.js → chunk-VH4IU3UC.js}

@@ -5,7 +5,7 @@ import {
   getConversationEventStore,
   getDb,
   getSqlExecutor
-} from "./chunk-IZDYYYGP.js";
+} from "./chunk-ABAX75GG.js";
 import {
   juniorCodeChanges,
   juniorCodeRepositories,
@@ -16,7 +16,7 @@ import {
   juniorUsers,
   juniorWorkspaceRepos,
   juniorWorkspaces
-} from "./chunk-BCHYQS4B.js";
+} from "./chunk-LVK4WJKM.js";
 import {
   SANDBOX_WORKSPACE_ROOT,
   getVercelSandboxCredentials,
@@ -24,17 +24,19 @@ import {
   isSandboxMissingError,
   runNonInteractiveCommand,
   sleep
-} from "./chunk-SHJK75Z2.js";
+} from "./chunk-EJYP3NQ4.js";
 import {
   getStateAdapter
-} from "./chunk-DUKIDPF6.js";
+} from "./chunk-PNYJOEVV.js";
 import {
   botConfig,
   completeObject,
-  defaultModelId,
   embedTexts,
   getSlackBotToken
-} from "./chunk-6UDPINOX.js";
+} from "./chunk-LRI5IRGY.js";
+import {
+  defaultModelId
+} from "./chunk-D4YV5TDV.js";
 import {
   isActorUserId,
   parseActorUserId,
@@ -50,7 +52,7 @@ import {
   setSpanAttributes,
   setSpanStatus,
   withSpan
-} from "./chunk-3S7ULUWW.js";
+} from "./chunk-OMQ2J6F6.js";
 
 // src/chat/plugins/agent-hooks.ts
 import {
@@ -468,1051 +470,996 @@ function getDashboardTaskLink(taskId) {
   return resolveDashboardPath(`/tasks/${encodeURIComponent(taskId)}`);
 }
 
-// src/chat/slack/client.ts
-import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
-import { WebClient } from "@slack/web-api";
-
-// src/chat/slack/workspace-context.ts
-import { AsyncLocalStorage } from "async_hooks";
-var workspaceTeamIdStorage = new AsyncLocalStorage();
-function runWithWorkspaceTeamId(teamId, fn) {
-  if (!teamId) return fn();
-  return workspaceTeamIdStorage.run(teamId, fn);
+// src/chat/resource-events/store.ts
+import { createHash as createHash2 } from "crypto";
+import {
+  destinationSchema,
+  resourceEventMatchSchema,
+  resourceEventMatches,
+  resourceEventTypeSchema,
+  stableResourceEventMatchKey
+} from "@sentry/junior-plugin-api";
+import { z as z2 } from "zod";
+var RESOURCE_EVENT_PREFIX = "junior:resource_event_subscription:v3";
+var INDEX_LOCK_TTL_MS = 1e4;
+var SUBSCRIPTION_LOCK_TTL_MS = 1e4;
+var SUBSCRIPTION_LOCK_WAIT_MS = 1e4;
+var SUBSCRIPTION_LOCK_RETRY_MS = 25;
+var SUBSCRIPTION_LOCK_HEARTBEAT_MS = 3e3;
+var subscriptionStatusSchema = z2.enum(["active", "cancelled", "completed"]);
+var subscriptionIdIndexSchema = z2.array(z2.string().min(1));
+var subscriptionSchema = z2.object({
+  conversationId: z2.string().min(1),
+  createdAtMs: z2.number().finite(),
+  destination: destinationSchema,
+  events: z2.array(resourceEventTypeSchema).min(1),
+  expiresAtMs: z2.number().finite(),
+  id: z2.string().min(1),
+  intent: z2.string().min(1),
+  label: z2.string().min(1),
+  match: resourceEventMatchSchema.optional(),
+  namespace: z2.string().min(1),
+  identifier: z2.string().min(1),
+  resourceType: z2.string().min(1),
+  status: subscriptionStatusSchema,
+  updatedAtMs: z2.number().finite()
+}).strict();
+function digest(value) {
+  return createHash2("sha256").update(value).digest("hex").slice(0, 32);
 }
-function getWorkspaceTeamId() {
-  return workspaceTeamIdStorage.getStore();
+function subscriptionKey(id) {
+  return `${RESOURCE_EVENT_PREFIX}:record:${id}`;
 }
-
-// src/chat/slack/client.ts
-var SlackActionError = class extends Error {
-  code;
-  apiError;
-  needed;
-  provided;
-  statusCode;
-  requestId;
-  errorData;
-  retryAfterSeconds;
-  detail;
-  detailLine;
-  detailRule;
-  constructor(message, code, options = {}) {
-    super(message);
-    this.name = "SlackActionError";
-    this.code = code;
-    this.apiError = options.apiError;
-    this.needed = options.needed;
-    this.provided = options.provided;
-    this.statusCode = options.statusCode;
-    this.requestId = options.requestId;
-    this.errorData = options.errorData;
-    this.retryAfterSeconds = options.retryAfterSeconds;
-    this.detail = options.detail;
-    this.detailLine = options.detailLine;
-    this.detailRule = options.detailRule;
-  }
-};
-function serializeSlackErrorData(data) {
-  if (!data || typeof data !== "object") {
-    return void 0;
-  }
-  const filtered = Object.fromEntries(
-    Object.entries(data).filter(
-      ([key]) => key !== "error"
-    )
-  );
-  if (Object.keys(filtered).length === 0) {
-    return void 0;
-  }
-  try {
-    const serialized = JSON.stringify(filtered);
-    return serialized.length <= 600 ? serialized : `${serialized.slice(0, 597)}...`;
-  } catch {
-    return void 0;
-  }
+function subscriptionLockKey(id) {
+  return `${RESOURCE_EVENT_PREFIX}:lock:${id}`;
 }
-function getHeaderString(headers, name) {
-  if (!headers || typeof headers !== "object") {
-    return void 0;
+function resourceIndexKey(teamId, namespace, identifier) {
+  return `${RESOURCE_EVENT_PREFIX}:resource:${digest(`${teamId}\0${namespace}\0${identifier}`)}`;
+}
+function subscriptionTeamId(destination) {
+  if (destination.platform !== "slack") {
+    throw new Error("Resource event subscriptions require a Slack destination");
   }
-  const key = name.toLowerCase();
-  const entries = headers;
-  for (const [entryKey, value] of Object.entries(entries)) {
-    if (entryKey.toLowerCase() !== key) continue;
-    if (typeof value === "string") return value;
-    if (Array.isArray(value)) {
-      const first = value.find((entry) => typeof entry === "string");
-      return typeof first === "string" ? first : void 0;
+  return destination.teamId;
+}
+function conversationIndexKey(conversationId) {
+  return `${RESOURCE_EVENT_PREFIX}:conversation:${digest(conversationId)}`;
+}
+function indexLockKey(key) {
+  return `${key}:lock`;
+}
+async function sleep2(ms) {
+  await new Promise((resolve) => {
+    const timer = setTimeout(resolve, ms);
+    timer.unref?.();
+  });
+}
+async function acquireSubscriptionLock(state, subscriptionId, waitDeadlineMs = Date.now() + SUBSCRIPTION_LOCK_WAIT_MS) {
+  while (true) {
+    const lock = await state.acquireLock(
+      subscriptionLockKey(subscriptionId),
+      SUBSCRIPTION_LOCK_TTL_MS
+    );
+    if (lock) {
+      return lock;
+    }
+    if (Date.now() >= waitDeadlineMs) {
+      throw new Error(
+        `Could not acquire resource event subscription lock for ${subscriptionId}`
+      );
     }
+    await sleep2(SUBSCRIPTION_LOCK_RETRY_MS);
   }
-  return void 0;
 }
-function parseSlackCanvasDetail(detail) {
-  if (typeof detail !== "string") {
-    return {};
-  }
-  const trimmed = detail.trim();
-  if (!trimmed) {
-    return {};
-  }
-  const parsed = {
-    detail: trimmed
-  };
-  const lineMatch = trimmed.match(/line\s+(\d+):/i);
-  if (lineMatch) {
-    const line = Number.parseInt(lineMatch[1] ?? "", 10);
-    if (Number.isFinite(line)) {
-      parsed.detailLine = line;
+async function withSubscriptionLock(state, subscriptionId, callback, waitDeadlineMs) {
+  const lock = await acquireSubscriptionLock(
+    state,
+    subscriptionId,
+    waitDeadlineMs
+  );
+  let lockLostError;
+  let heartbeatError;
+  let heartbeat;
+  const timer = setInterval(() => {
+    if (heartbeat) {
+      return;
     }
+    heartbeat = state.extendLock(lock, SUBSCRIPTION_LOCK_TTL_MS).then((extended) => {
+      if (extended) {
+        heartbeatError = void 0;
+      } else {
+        lockLostError = new Error(
+          `Resource event subscription lock was lost for ${subscriptionId}`
+        );
+      }
+    }).catch((error) => {
+      heartbeatError = error instanceof Error ? error : new Error(`Failed to extend subscription lock: ${String(error)}`);
+    }).finally(() => {
+      heartbeat = void 0;
+    });
+  }, SUBSCRIPTION_LOCK_HEARTBEAT_MS);
+  timer.unref?.();
+  let result;
+  try {
+    result = await callback();
+  } finally {
+    clearInterval(timer);
+    await heartbeat;
+    await state.releaseLock(lock);
   }
-  if (/unsupported heading depth/i.test(trimmed)) {
-    parsed.detailRule = "unsupported_heading_depth";
+  const lockError = lockLostError ?? heartbeatError;
+  if (lockError) {
+    throw lockError;
   }
-  return parsed;
+  return result;
 }
-var installationTokenStorage = new AsyncLocalStorage2();
-var clientsByToken = /* @__PURE__ */ new Map();
-function runWithSlackInstallationToken(token, fn) {
-  const trimmed = token.trim();
-  if (!trimmed) {
-    throw new SlackActionError(
-      "Slack installation token binding requires a non-empty token",
-      "missing_token"
-    );
-  }
-  return installationTokenStorage.run({ token: trimmed }, fn);
+function ttlUntil(expiresAtMs, nowMs) {
+  return Math.max(1, expiresAtMs - nowMs);
 }
-function resolveSlackToken() {
-  const ambientToken = installationTokenStorage.getStore()?.token;
-  if (ambientToken) {
-    return ambientToken;
+async function readSubscriptionIdIndex(state, key) {
+  const value = await state.get(key);
+  if (value === void 0 || value === null) {
+    return [];
   }
-  const envToken = getSlackBotToken();
-  if (envToken) {
-    return envToken;
+  return subscriptionIdIndexSchema.parse(value);
+}
+function buildSubscriptionId(input) {
+  const eventKey = [...new Set(input.events)].sort().join("\0");
+  const matchKey = stableResourceEventMatchKey(input.match);
+  const material = matchKey ? `${input.teamId}\0${input.namespace}\0${input.identifier}\0${input.conversationId}\0${eventKey}\0${matchKey}` : `${input.teamId}\0${input.namespace}\0${input.identifier}\0${input.conversationId}\0${eventKey}`;
+  return `resub_${digest(material)}`;
+}
+async function withIndexLock(state, key, callback) {
+  const lock = await state.acquireLock(indexLockKey(key), INDEX_LOCK_TTL_MS);
+  if (!lock) {
+    throw new Error(`Could not acquire resource event index lock for ${key}`);
   }
-  const teamId = getWorkspaceTeamId();
-  if (teamId) {
-    throw new SlackActionError(
-      `Slack call is scoped to workspace ${teamId} but no installation token is bound and no default bot token is configured`,
-      "missing_token"
-    );
+  try {
+    return await callback();
+  } finally {
+    await state.releaseLock(lock);
   }
-  throw new SlackActionError(
-    "SLACK_BOT_TOKEN (or SLACK_BOT_USER_TOKEN) is required for Slack Web API actions in this service",
-    "missing_token"
-  );
 }
-function normalizeSlackConversationId(channelId) {
-  return parseSlackChannelReferenceId(channelId);
+async function addToIndex(state, key, subscriptionId, nowMs) {
+  await withIndexLock(state, key, async () => {
+    const ids = [...new Set(await readSubscriptionIdIndex(state, key))];
+    const next = ids.includes(subscriptionId) ? ids : [...ids, subscriptionId];
+    await state.set(key, next, await indexTtlMs(state, next, nowMs));
+  });
 }
-function getClient() {
-  const token = resolveSlackToken();
-  let cached = clientsByToken.get(token);
-  if (!cached) {
-    cached = new WebClient(token, {
-      retryConfig: { retries: 0 },
-      rejectRateLimitedCalls: true
-    });
-    clientsByToken.set(token, cached);
-  }
-  return cached;
+async function removeFromIndex(state, key, subscriptionId, nowMs) {
+  await withIndexLock(state, key, async () => {
+    const existing = await readSubscriptionIdIndex(state, key);
+    const next = existing.filter((id) => id !== subscriptionId);
+    await state.set(key, next, await indexTtlMs(state, next, nowMs));
+  });
 }
-function mapSlackError(error) {
-  if (error instanceof SlackActionError) {
-    return error;
-  }
-  const candidate = error;
-  const apiError = candidate.data?.error;
-  const message = candidate.message ?? "Slack action failed";
-  const baseOptions = {
-    apiError,
-    statusCode: candidate.statusCode,
-    requestId: getHeaderString(candidate.headers, "x-slack-req-id"),
-    errorData: serializeSlackErrorData(candidate.data),
-    ...parseSlackCanvasDetail(candidate.data?.detail)
-  };
-  if (apiError === "missing_scope") {
-    return new SlackActionError(message, "missing_scope", {
-      ...baseOptions,
-      needed: candidate.data?.needed,
-      provided: candidate.data?.provided
-    });
-  }
-  if (apiError === "not_in_channel") {
-    return new SlackActionError(message, "not_in_channel", baseOptions);
-  }
-  if (apiError === "restricted_action_read_only_channel") {
-    return new SlackActionError(message, "read_only_channel", baseOptions);
-  }
-  if (apiError === "already_reacted") {
-    return new SlackActionError(message, "already_reacted", baseOptions);
-  }
-  if (apiError === "no_reaction") {
-    return new SlackActionError(message, "no_reaction", baseOptions);
-  }
-  if (apiError === "invalid_arguments") {
-    return new SlackActionError(message, "invalid_arguments", baseOptions);
-  }
-  if (apiError === "invalid_cursor") {
-    return new SlackActionError(message, "invalid_arguments", baseOptions);
-  }
-  if (apiError === "invalid_name") {
-    return new SlackActionError(message, "invalid_arguments", baseOptions);
-  }
-  if (apiError === "not_found" || apiError === "channel_not_found" || apiError === "message_not_found") {
-    return new SlackActionError(message, "not_found", baseOptions);
-  }
-  if (apiError === "feature_not_enabled" || apiError === "not_allowed_token_type") {
-    return new SlackActionError(message, "feature_unavailable", baseOptions);
-  }
-  if (apiError === "canvas_creation_failed") {
-    return new SlackActionError(message, "canvas_creation_failed", baseOptions);
-  }
-  if (apiError === "canvas_editing_failed") {
-    return new SlackActionError(message, "canvas_editing_failed", baseOptions);
-  }
-  if (candidate.code === "slack_webapi_rate_limited_error" || candidate.statusCode === 429) {
-    return new SlackActionError(message, "rate_limited", {
-      ...baseOptions,
-      retryAfterSeconds: candidate.retryAfter
-    });
-  }
-  return new SlackActionError(message, "internal_error", baseOptions);
+async function indexTtlMs(state, subscriptionIds, nowMs) {
+  const records = await Promise.all(
+    subscriptionIds.map(
+      async (id) => parseSubscription(await state.get(subscriptionKey(id)))
+    )
+  );
+  const latestExpiresAtMs = Math.max(
+    nowMs,
+    ...records.filter(
+      (record) => record !== void 0 && activeAt(record, nowMs)
+    ).map((record) => record.expiresAtMs)
+  );
+  return ttlUntil(latestExpiresAtMs, nowMs);
 }
-var MAX_RETRY_DELAY_MS = 1e4;
-var MAX_TOTAL_RETRY_DELAY_MS = 2e4;
-var CONNECTION_ERROR_CODES = /* @__PURE__ */ new Set([
-  "ECONNREFUSED",
-  "ECONNRESET",
-  "ENOTFOUND",
-  "EAI_AGAIN"
-]);
-var TIMEOUT_ERROR_CODES = /* @__PURE__ */ new Set([
-  "ETIMEDOUT",
-  "ECONNABORTED",
-  "ESOCKETTIMEDOUT"
-]);
-function findNetworkErrorCode(error, depth = 0) {
-  if (!error || typeof error !== "object" || depth > 4) {
+function parseSubscription(value) {
+  if (value === void 0 || value === null) {
     return void 0;
   }
-  const candidate = error;
-  if (typeof candidate.code === "string" && (CONNECTION_ERROR_CODES.has(candidate.code) || TIMEOUT_ERROR_CODES.has(candidate.code))) {
-    return candidate.code;
-  }
-  return findNetworkErrorCode(candidate.original, depth + 1) ?? findNetworkErrorCode(candidate.cause, depth + 1);
+  return subscriptionSchema.parse(value);
 }
-function hasSocketHangUpMessage(error) {
-  return error instanceof Error && error.message.toLowerCase().includes("socket hang up");
+function activeAt(subscription, nowMs) {
+  return subscription.status === "active" && subscription.expiresAtMs > nowMs;
 }
-function classifySlackRetry(raw, mapped) {
-  if (mapped.code === "rate_limited") {
-    return "rate_limited";
-  }
-  if (mapped.statusCode !== void 0 && mapped.statusCode >= 500) {
-    return "server_error";
-  }
-  const networkCode = findNetworkErrorCode(raw);
-  if (networkCode && CONNECTION_ERROR_CODES.has(networkCode)) {
-    return "connection";
-  }
-  if (networkCode && TIMEOUT_ERROR_CODES.has(networkCode)) {
-    return "timeout";
+function matchesEvent(subscription, input) {
+  return subscription.namespace === input.namespace && subscription.identifier === input.identifier && subscriptionTeamId(subscription.destination) === input.teamId && subscription.events.includes(input.eventType) && activeAt(subscription, input.nowMs) && resourceEventMatches(subscription.match, input.data);
+}
+async function createResourceEventSubscription(input, options = {}) {
+  const state = options.state ?? getStateAdapter();
+  await state.connect();
+  const nowMs = options.nowMs ?? Date.now();
+  const events = [...new Set(input.events.map((event) => event.trim()))].filter(
+    Boolean
+  );
+  if (events.length === 0) {
+    throw new Error("Resource event subscription requires at least one event");
   }
-  if (hasSocketHangUpMessage(raw)) {
-    return "connection";
+  if (input.expiresAtMs <= nowMs) {
+    throw new Error("Resource event subscription expiry must be in the future");
   }
-  return "none";
+  const match = input.match && Object.keys(input.match).length > 0 ? input.match : void 0;
+  const id = buildSubscriptionId({
+    conversationId: input.conversationId,
+    events,
+    match,
+    namespace: input.namespace,
+    identifier: input.identifier,
+    teamId: subscriptionTeamId(input.destination)
+  });
+  const record = {
+    conversationId: input.conversationId,
+    createdAtMs: nowMs,
+    destination: input.destination,
+    events,
+    expiresAtMs: input.expiresAtMs,
+    id,
+    intent: input.intent,
+    label: input.label,
+    ...match ? { match } : void 0,
+    namespace: input.namespace,
+    identifier: input.identifier,
+    resourceType: input.resourceType,
+    status: "active",
+    updatedAtMs: nowMs
+  };
+  const parsed = subscriptionSchema.parse(record);
+  await state.set(
+    subscriptionKey(id),
+    parsed,
+    ttlUntil(parsed.expiresAtMs, nowMs)
+  );
+  await addToIndex(
+    state,
+    resourceIndexKey(
+      subscriptionTeamId(parsed.destination),
+      input.namespace,
+      input.identifier
+    ),
+    id,
+    nowMs
+  );
+  await addToIndex(
+    state,
+    conversationIndexKey(input.conversationId),
+    id,
+    nowMs
+  );
+  return parsed;
 }
-async function withSlackRetries(task, maxAttempts = 3, context = {}) {
-  let attempt = 0;
-  let totalDelayMs = 0;
-  const action = context.action ?? "unknown";
-  while (attempt < maxAttempts) {
-    attempt += 1;
-    const attemptNumber = attempt;
-    try {
-      return await withSpan(
-        `POST slack.com/api/${action}`,
-        "http.client",
-        {},
-        async () => {
-          try {
-            return await task();
-          } catch (error) {
-            const mapped = mapSlackError(error);
-            const errorAttrs = {
-              "error.type": mapped.code
-            };
-            if (mapped.apiError) {
-              errorAttrs["app.slack.api_error_code"] = mapped.apiError;
-            }
-            if (mapped.code === "rate_limited") {
-              errorAttrs["http.response.status_code"] = 429;
-              if (mapped.retryAfterSeconds) {
-                errorAttrs["app.slack.retry_after_ms"] = mapped.retryAfterSeconds * 1e3;
-              }
-            } else if (mapped.statusCode != null) {
-              errorAttrs["http.response.status_code"] = mapped.statusCode;
-            }
-            setSpanAttributes(errorAttrs);
-            setSpanStatus("error");
-            throw error;
-          }
-        },
-        {
-          "http.request.method": "POST",
-          "server.address": "slack.com",
-          "url.scheme": "https",
-          "url.path": `/api/${action}`,
-          "app.slack.method": action,
-          "app.retry.max_attempts": maxAttempts,
-          ...attemptNumber > 1 ? { "http.request.resend_count": attemptNumber - 1 } : void 0,
-          ...context.attributes ?? {},
-          ...context.spanAttributes ?? {}
-        }
-      );
-    } catch (error) {
-      const mapped = mapSlackError(error);
-      const retryClass = classifySlackRetry(error, mapped);
-      const isRetryable = retryClass === "rate_limited" || retryClass === "connection" || retryClass === "server_error" || retryClass === "timeout" && context.idempotent === true;
-      const remainingDelayBudgetMs = MAX_TOTAL_RETRY_DELAY_MS - totalDelayMs;
-      const baseLogAttributes = {
-        "app.slack.action": action,
-        "app.slack.error_code": mapped.code,
-        ...mapped.apiError ? { "app.slack.api_error": mapped.apiError } : void 0,
-        ...mapped.detail ? { "app.slack.detail": mapped.detail } : void 0,
-        ...mapped.detailLine !== void 0 ? { "app.slack.detail_line": mapped.detailLine } : void 0,
-        ...mapped.detailRule ? { "app.slack.detail_rule": mapped.detailRule } : void 0,
-        ...mapped.requestId ? { "app.slack.request_id": mapped.requestId } : void 0,
-        ...mapped.statusCode !== void 0 ? { "http.response.status_code": mapped.statusCode } : void 0,
-        ...context.attributes ?? {}
-      };
-      if (!isRetryable || attempt >= maxAttempts || remainingDelayBudgetMs <= 0) {
-        logWarn("slack.action.failed", {
-          ...baseLogAttributes,
-          ...mapped.errorData ? { "app.slack.error_data": mapped.errorData } : void 0
-        });
-        throw mapped;
-      }
-      logWarn("slack.action.retrying", {
-        ...baseLogAttributes,
-        "app.slack.retry_attempt": attempt,
-        "app.slack.retry_class": retryClass
-      });
-      const retryAfterMs = retryClass === "rate_limited" && mapped.retryAfterSeconds && mapped.retryAfterSeconds > 0 ? mapped.retryAfterSeconds * 1e3 : void 0;
-      const backoffMs = Math.min(2e3, 250 * 2 ** (attempt - 1));
-      const delayMs = Math.min(
-        retryAfterMs ?? backoffMs,
-        MAX_RETRY_DELAY_MS,
-        remainingDelayBudgetMs
-      );
-      totalDelayMs += delayMs;
-      await sleep(delayMs);
-    }
-  }
-  throw new SlackActionError(
-    "Slack action exhausted retries",
-    "internal_error"
+async function listResourceEventSubscriptions(input) {
+  const state = input.state ?? getStateAdapter();
+  await state.connect();
+  const nowMs = input.nowMs ?? Date.now();
+  const ids = await readSubscriptionIdIndex(
+    state,
+    conversationIndexKey(input.conversationId)
   );
+  const records = await Promise.all(
+    ids.map(
+      async (id) => parseSubscription(await state.get(subscriptionKey(id)))
+    )
+  );
+  return records.filter(
+    (record) => record !== void 0 && record.conversationId === input.conversationId && activeAt(record, nowMs)
+  ).sort((left, right) => left.createdAtMs - right.createdAtMs);
 }
-function getSlackClient() {
-  return getClient();
-}
-function isDmChannel(channelId) {
-  const normalized = normalizeSlackConversationId(channelId);
-  return Boolean(normalized && normalized.startsWith("D"));
-}
-function isConversationScopedChannel(channelId) {
-  const normalized = normalizeSlackConversationId(channelId);
-  if (!normalized) return false;
-  return normalized.startsWith("C") || normalized.startsWith("G") || normalized.startsWith("D");
+async function cancelResourceEventSubscription(input) {
+  const state = input.state ?? getStateAdapter();
+  await state.connect();
+  return await withSubscriptionLock(state, input.id, async () => {
+    const current = parseSubscription(
+      await state.get(subscriptionKey(input.id))
+    );
+    if (!current || current.conversationId !== input.conversationId) {
+      return void 0;
+    }
+    const nowMs = input.nowMs ?? Date.now();
+    const next = {
+      ...current,
+      status: "cancelled",
+      updatedAtMs: nowMs
+    };
+    await state.set(
+      subscriptionKey(input.id),
+      next,
+      JUNIOR_THREAD_STATE_TTL_MS
+    );
+    await removeFromIndex(
+      state,
+      resourceIndexKey(
+        subscriptionTeamId(current.destination),
+        current.namespace,
+        current.identifier
+      ),
+      input.id,
+      nowMs
+    );
+    await removeFromIndex(
+      state,
+      conversationIndexKey(current.conversationId),
+      input.id,
+      nowMs
+    );
+    return next;
+  });
 }
-function isConversationChannel(channelId) {
-  const normalized = normalizeSlackConversationId(channelId);
-  if (!normalized) return false;
-  return normalized.startsWith("C") || normalized.startsWith("G");
+async function cancelSubscriptions(input) {
+  const subscriptions = await listResourceEventSubscriptions(input);
+  for (const subscription of subscriptions) {
+    await cancelResourceEventSubscription({
+      conversationId: input.conversationId,
+      id: subscription.id,
+      nowMs: input.nowMs,
+      state: input.state
+    });
+  }
 }
-async function getFilePermalink(fileId) {
-  const client = getClient();
-  const response = await withSlackRetries(
-    () => client.files.info({
-      file: fileId
-    }),
-    3,
-    {
-      action: "files.info",
-      idempotent: true,
-      spanAttributes: { "app.slack.file_id": fileId }
+async function collectResourceEventMatchKeys(input) {
+  const state = input.state ?? getStateAdapter();
+  await state.connect();
+  const nowMs = input.nowMs ?? Date.now();
+  const eventTypes = new Set(
+    input.eventTypes.map((eventType) => eventType.trim()).filter(Boolean)
+  );
+  if (eventTypes.size === 0) return [];
+  const keys = /* @__PURE__ */ new Set();
+  const identifiers = new Set(
+    input.identifiers.map((value) => value.trim()).filter(Boolean)
+  );
+  for (const identifier of identifiers) {
+    const ids = await readSubscriptionIdIndex(
+      state,
+      resourceIndexKey(input.teamId, input.namespace, identifier)
+    );
+    const records = await Promise.all(
+      ids.map(
+        async (id) => parseSubscription(await state.get(subscriptionKey(id)))
+      )
+    );
+    for (const record of records) {
+      if (!record) continue;
+      if (record.namespace !== input.namespace) continue;
+      if (record.identifier !== identifier) continue;
+      if (subscriptionTeamId(record.destination) !== input.teamId) continue;
+      if (!activeAt(record, nowMs)) continue;
+      if (!record.events.some((eventType) => eventTypes.has(eventType))) continue;
+      for (const key of Object.keys(record.match ?? {})) {
+        keys.add(key);
+      }
     }
+  }
+  return [...keys].sort();
+}
+async function findMatchingResourceEventSubscriptions(input) {
+  const state = input.state ?? getStateAdapter();
+  await state.connect();
+  const nowMs = input.nowMs ?? Date.now();
+  const ids = await readSubscriptionIdIndex(
+    state,
+    resourceIndexKey(input.teamId, input.namespace, input.identifier)
+  );
+  const records = await Promise.all(
+    ids.map(
+      async (id) => parseSubscription(await state.get(subscriptionKey(id)))
+    )
+  );
+  return records.filter(
+    (record) => record !== void 0 && matchesEvent(record, {
+      data: input.data,
+      eventType: input.eventType,
+      nowMs,
+      namespace: input.namespace,
+      identifier: input.identifier,
+      teamId: input.teamId
+    })
   );
-  return response.file?.permalink;
 }
-async function downloadPrivateSlackFile(url) {
-  const token = resolveSlackToken();
-  return withSpan(
-    "GET files.slack.com",
-    "http.client",
-    {},
+async function deliverResourceEventSubscription(input) {
+  const state = input.state ?? getStateAdapter();
+  await state.connect();
+  return await withSubscriptionLock(
+    state,
+    input.subscription.id,
     async () => {
-      const response = await fetch(url, {
-        headers: {
-          Authorization: `Bearer ${token}`
+      const nowMs = input.nowMs ?? Date.now();
+      const current = parseSubscription(
+        await state.get(subscriptionKey(input.subscription.id))
+      );
+      if (!current || !matchesEvent(current, {
+        data: input.data,
+        eventType: input.eventType,
+        nowMs,
+        namespace: input.namespace,
+        identifier: input.identifier,
+        teamId: input.teamId
+      })) {
+        return false;
+      }
+      const delivered = await input.deliver(current);
+      if (input.terminal) {
+        const latest = parseSubscription(
+          await state.get(subscriptionKey(current.id))
+        );
+        if (!latest || latest.status !== current.status || latest.updatedAtMs !== current.updatedAtMs) {
+          return delivered;
         }
-      });
-      setSpanAttributes({ "http.response.status_code": response.status });
-      if (!response.ok) {
-        setSpanAttributes({ "error.type": String(response.status) });
-        setSpanStatus("error");
-        throw new Error(`Slack file download failed: ${response.status}`);
+        const next = {
+          ...current,
+          status: "completed",
+          updatedAtMs: nowMs
+        };
+        await state.set(
+          subscriptionKey(current.id),
+          next,
+          JUNIOR_THREAD_STATE_TTL_MS
+        );
+        await removeFromIndex(
+          state,
+          resourceIndexKey(
+            subscriptionTeamId(current.destination),
+            current.namespace,
+            current.identifier
+          ),
+          current.id,
+          nowMs
+        );
+        await removeFromIndex(
+          state,
+          conversationIndexKey(current.conversationId),
+          current.id,
+          nowMs
+        );
       }
-      return Buffer.from(await response.arrayBuffer());
+      return delivered;
     },
-    {
-      "http.request.method": "GET",
-      "server.address": "files.slack.com",
-      "url.scheme": "https",
-      "app.slack.method": "files.download"
-    }
+    input.waitDeadlineMs
   );
 }
 
-// src/chat/resource-events/workspace.ts
-function canRouteResourceEvents() {
-  return Boolean(getSlackBotToken());
-}
-function createResourceEventTeamIdResolver() {
-  let pending;
-  return async () => {
-    if (!canRouteResourceEvents()) return void 0;
-    pending ??= getSlackClient().auth.test().then((result) => {
-      const teamId = result.team_id?.trim();
-      if (!teamId) {
-        throw new Error("Slack auth.test did not return a workspace team id");
-      }
-      return teamId;
-    }).catch((error) => {
-      pending = void 0;
-      throw error;
-    });
-    return await pending;
+// src/chat/resource-events/tool-support.ts
+var RESOURCE_SUBSCRIPTION_DEFAULT_TTL_MS = 14 * 24 * 60 * 60 * 1e3;
+var RESOURCE_SUBSCRIPTION_MAX_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
+var STOP_WATCHING_TOOL_NAME = "stopWatchingResources";
+var RESOURCE_WATCH_TOOL_SOURCE = {
+  id: "resource-watches",
+  description: "Inspect or stop resource watches for the current conversation."
+};
+
+// src/chat/slack/tool-support/context.ts
+function getSlackToolContext(context) {
+  if (context.source.platform !== "slack") {
+    return void 0;
+  }
+  if (context.destination.platform !== "slack") {
+    throw new TypeError("Slack source requires a Slack destination");
+  }
+  const destinationChannelId = parseSlackChannelReferenceId(
+    context.destination.channelId
+  );
+  const sourceChannelId = parseSlackChannelReferenceId(
+    context.source.channelId
+  );
+  const teamId = parseSlackTeamId(context.source.teamId);
+  if (!destinationChannelId || !sourceChannelId || !teamId) {
+    return void 0;
+  }
+  return {
+    destination: context.destination,
+    source: context.source,
+    actor: context.actor?.platform === "slack" ? context.actor : void 0,
+    destinationChannelId,
+    messageTs: parseSlackMessageTs(context.source.messageTs),
+    sourceChannelId,
+    teamId,
+    threadTs: parseSlackMessageTs(context.source.threadTs)
   };
 }
 
-// src/chat/resource-events/store.ts
-import { createHash as createHash2 } from "crypto";
+// src/chat/plugins/viewer.ts
+import { randomUUID } from "crypto";
+import { and as and3, asc, eq as eq3 } from "drizzle-orm";
 import {
-  destinationSchema,
-  resourceEventMatchSchema,
-  resourceEventMatches,
-  resourceEventTypeSchema,
-  stableResourceEventMatchKey
+  identitySchema,
+  userSchema
 } from "@sentry/junior-plugin-api";
-import { z as z2 } from "zod";
-var RESOURCE_EVENT_PREFIX = "junior:resource_event_subscription:v3";
-var INDEX_LOCK_TTL_MS = 1e4;
-var SUBSCRIPTION_LOCK_TTL_MS = 1e4;
-var SUBSCRIPTION_LOCK_WAIT_MS = 1e4;
-var SUBSCRIPTION_LOCK_RETRY_MS = 25;
-var SUBSCRIPTION_LOCK_HEARTBEAT_MS = 3e3;
-var subscriptionStatusSchema = z2.enum(["active", "cancelled", "completed"]);
-var subscriptionIdIndexSchema = z2.array(z2.string().min(1));
-var subscriptionSchema = z2.object({
-  conversationId: z2.string().min(1),
-  createdAtMs: z2.number().finite(),
-  destination: destinationSchema,
-  events: z2.array(resourceEventTypeSchema).min(1),
-  expiresAtMs: z2.number().finite(),
-  id: z2.string().min(1),
-  intent: z2.string().min(1),
-  label: z2.string().min(1),
-  match: resourceEventMatchSchema.optional(),
-  namespace: z2.string().min(1),
-  identifier: z2.string().min(1),
-  resourceType: z2.string().min(1),
-  status: subscriptionStatusSchema,
-  updatedAtMs: z2.number().finite()
-}).strict();
-function digest(value) {
-  return createHash2("sha256").update(value).digest("hex").slice(0, 32);
+function identityFromRow(row) {
+  return identitySchema.parse({
+    id: row.id,
+    provider: row.provider,
+    providerSubjectId: row.providerSubjectId,
+    ...row.providerTenantId ? { providerTenantId: row.providerTenantId } : void 0,
+    ...row.displayName ? { displayName: row.displayName } : void 0,
+    ...row.handle ? { handle: row.handle } : void 0
+  });
 }
-function subscriptionKey(id) {
-  return `${RESOURCE_EVENT_PREFIX}:record:${id}`;
+async function readUserById(db, userRow) {
+  const identityRows = await db.select().from(juniorIdentities).where(
+    and3(
+      eq3(juniorIdentities.userId, userRow.id),
+      eq3(juniorIdentities.kind, "user")
+    )
+  ).orderBy(
+    asc(juniorIdentities.provider),
+    asc(juniorIdentities.providerTenantId),
+    asc(juniorIdentities.providerSubjectId)
+  );
+  return userSchema.parse({
+    email: userRow.primaryEmail,
+    id: userRow.id,
+    identities: identityRows.map(identityFromRow),
+    ...userRow.displayName ? { displayName: userRow.displayName } : void 0
+  });
 }
-function subscriptionLockKey(id) {
-  return `${RESOURCE_EVENT_PREFIX}:lock:${id}`;
+async function resolveViewerUserFromSql(db, email) {
+  const normalizedEmail = normalizeIdentityEmail(email);
+  if (!normalizedEmail) return void 0;
+  const now = /* @__PURE__ */ new Date();
+  const rows = await db.insert(juniorUsers).values({
+    id: randomUUID(),
+    primaryEmail: email.trim(),
+    primaryEmailNormalized: normalizedEmail,
+    displayName: null,
+    createdAt: now,
+    updatedAt: now
+  }).onConflictDoNothing({ target: juniorUsers.primaryEmailNormalized }).returning();
+  const userRow = rows[0] ?? (await db.select().from(juniorUsers).where(eq3(juniorUsers.primaryEmailNormalized, normalizedEmail)).limit(1))[0];
+  return userRow ? await readUserById(db, userRow) : void 0;
 }
-function resourceIndexKey(teamId, namespace, identifier) {
-  return `${RESOURCE_EVENT_PREFIX}:resource:${digest(`${teamId}\0${namespace}\0${identifier}`)}`;
+async function resolveViewerUser(email) {
+  return await resolveViewerUserFromSql(getDb(), email);
 }
-function subscriptionTeamId(destination) {
-  if (destination.platform !== "slack") {
-    throw new Error("Resource event subscriptions require a Slack destination");
-  }
-  return destination.teamId;
+async function findUserByEmailFromSql(db, email) {
+  const normalizedEmail = normalizeIdentityEmail(email);
+  if (!normalizedEmail) return void 0;
+  const userRow = (await db.select().from(juniorUsers).where(eq3(juniorUsers.primaryEmailNormalized, normalizedEmail)).limit(1))[0];
+  return userRow ? await readUserById(db, userRow) : void 0;
 }
-function conversationIndexKey(conversationId) {
-  return `${RESOURCE_EVENT_PREFIX}:conversation:${digest(conversationId)}`;
+async function findUserByEmail(email) {
+  return await findUserByEmailFromSql(getDb(), email);
 }
-function indexLockKey(key) {
-  return `${key}:lock`;
+async function updateViewerDisplayNameFromSql(db, userId, displayName) {
+  const rows = await db.update(juniorUsers).set({ displayName, updatedAt: /* @__PURE__ */ new Date() }).where(eq3(juniorUsers.id, userId)).returning();
+  const userRow = rows[0];
+  return userRow ? await readUserById(db, userRow) : void 0;
 }
-async function sleep2(ms) {
-  await new Promise((resolve) => {
-    const timer = setTimeout(resolve, ms);
-    timer.unref?.();
-  });
+async function updateViewerDisplayName(userId, displayName) {
+  return await updateViewerDisplayNameFromSql(getDb(), userId, displayName);
 }
-async function acquireSubscriptionLock(state, subscriptionId, waitDeadlineMs = Date.now() + SUBSCRIPTION_LOCK_WAIT_MS) {
-  while (true) {
-    const lock = await state.acquireLock(
-      subscriptionLockKey(subscriptionId),
-      SUBSCRIPTION_LOCK_TTL_MS
-    );
-    if (lock) {
-      return lock;
-    }
-    if (Date.now() >= waitDeadlineMs) {
-      throw new Error(
-        `Could not acquire resource event subscription lock for ${subscriptionId}`
-      );
-    }
-    await sleep2(SUBSCRIPTION_LOCK_RETRY_MS);
-  }
+async function readActorIdentityFromSql(db, actor) {
+  if (actor.platform === "system") return void 0;
+  const providerTenantId = actor.platform === "slack" ? actor.teamId : "";
+  const rows = await db.select({
+    identity: juniorIdentities,
+    user: juniorUsers
+  }).from(juniorIdentities).leftJoin(juniorUsers, eq3(juniorUsers.id, juniorIdentities.userId)).where(
+    and3(
+      eq3(juniorIdentities.kind, "user"),
+      eq3(juniorIdentities.provider, actor.platform),
+      eq3(juniorIdentities.providerTenantId, providerTenantId),
+      eq3(juniorIdentities.providerSubjectId, actor.userId)
+    )
+  ).limit(1);
+  const row = rows[0];
+  if (!row) return void 0;
+  return {
+    identity: identityFromRow(row.identity),
+    ...row.user ? { user: await readUserById(db, row.user) } : void 0
+  };
 }
-async function withSubscriptionLock(state, subscriptionId, callback, waitDeadlineMs) {
-  const lock = await acquireSubscriptionLock(
-    state,
-    subscriptionId,
-    waitDeadlineMs
-  );
-  let lockLostError;
-  let heartbeatError;
-  let heartbeat;
-  const timer = setInterval(() => {
-    if (heartbeat) {
-      return;
-    }
-    heartbeat = state.extendLock(lock, SUBSCRIPTION_LOCK_TTL_MS).then((extended) => {
-      if (extended) {
-        heartbeatError = void 0;
-      } else {
-        lockLostError = new Error(
-          `Resource event subscription lock was lost for ${subscriptionId}`
-        );
-      }
-    }).catch((error) => {
-      heartbeatError = error instanceof Error ? error : new Error(`Failed to extend subscription lock: ${String(error)}`);
-    }).finally(() => {
-      heartbeat = void 0;
-    });
-  }, SUBSCRIPTION_LOCK_HEARTBEAT_MS);
-  timer.unref?.();
-  let result;
-  try {
-    result = await callback();
-  } finally {
-    clearInterval(timer);
-    await heartbeat;
-    await state.releaseLock(lock);
-  }
-  const lockError = lockLostError ?? heartbeatError;
-  if (lockError) {
-    throw lockError;
-  }
-  return result;
+async function readActorIdentity(actor) {
+  return await readActorIdentityFromSql(getDb(), actor);
 }
-function ttlUntil(expiresAtMs, nowMs) {
-  return Math.max(1, expiresAtMs - nowMs);
+
+// src/chat/credentials/subject.ts
+import { createHmac, timingSafeEqual } from "crypto";
+
+// src/chat/slack/client.ts
+import { AsyncLocalStorage as AsyncLocalStorage2 } from "async_hooks";
+import { WebClient } from "@slack/web-api";
+
+// src/chat/slack/workspace-context.ts
+import { AsyncLocalStorage } from "async_hooks";
+var workspaceTeamIdStorage = new AsyncLocalStorage();
+function runWithWorkspaceTeamId(teamId, fn) {
+  if (!teamId) return fn();
+  return workspaceTeamIdStorage.run(teamId, fn);
 }
-async function readSubscriptionIdIndex(state, key) {
-  const value = await state.get(key);
-  if (value === void 0 || value === null) {
-    return [];
-  }
-  return subscriptionIdIndexSchema.parse(value);
-}
-function buildSubscriptionId(input) {
-  const eventKey = [...new Set(input.events)].sort().join("\0");
-  const matchKey = stableResourceEventMatchKey(input.match);
-  const material = matchKey ? `${input.teamId}\0${input.namespace}\0${input.identifier}\0${input.conversationId}\0${eventKey}\0${matchKey}` : `${input.teamId}\0${input.namespace}\0${input.identifier}\0${input.conversationId}\0${eventKey}`;
-  return `resub_${digest(material)}`;
+function getWorkspaceTeamId() {
+  return workspaceTeamIdStorage.getStore();
 }
-async function withIndexLock(state, key, callback) {
-  const lock = await state.acquireLock(indexLockKey(key), INDEX_LOCK_TTL_MS);
-  if (!lock) {
-    throw new Error(`Could not acquire resource event index lock for ${key}`);
+
+// src/chat/slack/client.ts
+var SlackActionError = class extends Error {
+  code;
+  apiError;
+  needed;
+  provided;
+  statusCode;
+  requestId;
+  errorData;
+  retryAfterSeconds;
+  detail;
+  detailLine;
+  detailRule;
+  constructor(message, code, options = {}) {
+    super(message);
+    this.name = "SlackActionError";
+    this.code = code;
+    this.apiError = options.apiError;
+    this.needed = options.needed;
+    this.provided = options.provided;
+    this.statusCode = options.statusCode;
+    this.requestId = options.requestId;
+    this.errorData = options.errorData;
+    this.retryAfterSeconds = options.retryAfterSeconds;
+    this.detail = options.detail;
+    this.detailLine = options.detailLine;
+    this.detailRule = options.detailRule;
   }
-  try {
-    return await callback();
-  } finally {
-    await state.releaseLock(lock);
+};
+function serializeSlackErrorData(data) {
+  if (!data || typeof data !== "object") {
+    return void 0;
   }
-}
-async function addToIndex(state, key, subscriptionId, nowMs) {
-  await withIndexLock(state, key, async () => {
-    const ids = [...new Set(await readSubscriptionIdIndex(state, key))];
-    const next = ids.includes(subscriptionId) ? ids : [...ids, subscriptionId];
-    await state.set(key, next, await indexTtlMs(state, next, nowMs));
-  });
-}
-async function removeFromIndex(state, key, subscriptionId, nowMs) {
-  await withIndexLock(state, key, async () => {
-    const existing = await readSubscriptionIdIndex(state, key);
-    const next = existing.filter((id) => id !== subscriptionId);
-    await state.set(key, next, await indexTtlMs(state, next, nowMs));
-  });
-}
-async function indexTtlMs(state, subscriptionIds, nowMs) {
-  const records = await Promise.all(
-    subscriptionIds.map(
-      async (id) => parseSubscription(await state.get(subscriptionKey(id)))
+  const filtered = Object.fromEntries(
+    Object.entries(data).filter(
+      ([key]) => key !== "error"
     )
   );
-  const latestExpiresAtMs = Math.max(
-    nowMs,
-    ...records.filter(
-      (record) => record !== void 0 && activeAt(record, nowMs)
-    ).map((record) => record.expiresAtMs)
-  );
-  return ttlUntil(latestExpiresAtMs, nowMs);
-}
-function parseSubscription(value) {
-  if (value === void 0 || value === null) {
+  if (Object.keys(filtered).length === 0) {
+    return void 0;
+  }
+  try {
+    const serialized = JSON.stringify(filtered);
+    return serialized.length <= 600 ? serialized : `${serialized.slice(0, 597)}...`;
+  } catch {
     return void 0;
   }
-  return subscriptionSchema.parse(value);
-}
-function activeAt(subscription, nowMs) {
-  return subscription.status === "active" && subscription.expiresAtMs > nowMs;
 }
-function matchesEvent(subscription, input) {
-  return subscription.namespace === input.namespace && subscription.identifier === input.identifier && subscriptionTeamId(subscription.destination) === input.teamId && subscription.events.includes(input.eventType) && activeAt(subscription, input.nowMs) && resourceEventMatches(subscription.match, input.data);
+function getHeaderString(headers, name) {
+  if (!headers || typeof headers !== "object") {
+    return void 0;
+  }
+  const key = name.toLowerCase();
+  const entries = headers;
+  for (const [entryKey, value] of Object.entries(entries)) {
+    if (entryKey.toLowerCase() !== key) continue;
+    if (typeof value === "string") return value;
+    if (Array.isArray(value)) {
+      const first = value.find((entry) => typeof entry === "string");
+      return typeof first === "string" ? first : void 0;
+    }
+  }
+  return void 0;
 }
-async function createResourceEventSubscription(input, options = {}) {
-  const state = options.state ?? getStateAdapter();
-  await state.connect();
-  const nowMs = options.nowMs ?? Date.now();
-  const events = [...new Set(input.events.map((event) => event.trim()))].filter(
-    Boolean
-  );
-  if (events.length === 0) {
-    throw new Error("Resource event subscription requires at least one event");
+function parseSlackCanvasDetail(detail) {
+  if (typeof detail !== "string") {
+    return {};
   }
-  if (input.expiresAtMs <= nowMs) {
-    throw new Error("Resource event subscription expiry must be in the future");
+  const trimmed = detail.trim();
+  if (!trimmed) {
+    return {};
   }
-  const match = input.match && Object.keys(input.match).length > 0 ? input.match : void 0;
-  const id = buildSubscriptionId({
-    conversationId: input.conversationId,
-    events,
-    match,
-    namespace: input.namespace,
-    identifier: input.identifier,
-    teamId: subscriptionTeamId(input.destination)
-  });
-  const record = {
-    conversationId: input.conversationId,
-    createdAtMs: nowMs,
-    destination: input.destination,
-    events,
-    expiresAtMs: input.expiresAtMs,
-    id,
-    intent: input.intent,
-    label: input.label,
-    ...match ? { match } : void 0,
-    namespace: input.namespace,
-    identifier: input.identifier,
-    resourceType: input.resourceType,
-    status: "active",
-    updatedAtMs: nowMs
+  const parsed = {
+    detail: trimmed
   };
-  const parsed = subscriptionSchema.parse(record);
-  await state.set(
-    subscriptionKey(id),
-    parsed,
-    ttlUntil(parsed.expiresAtMs, nowMs)
-  );
-  await addToIndex(
-    state,
-    resourceIndexKey(
-      subscriptionTeamId(parsed.destination),
-      input.namespace,
-      input.identifier
-    ),
-    id,
-    nowMs
-  );
-  await addToIndex(
-    state,
-    conversationIndexKey(input.conversationId),
-    id,
-    nowMs
-  );
+  const lineMatch = trimmed.match(/line\s+(\d+):/i);
+  if (lineMatch) {
+    const line = Number.parseInt(lineMatch[1] ?? "", 10);
+    if (Number.isFinite(line)) {
+      parsed.detailLine = line;
+    }
+  }
+  if (/unsupported heading depth/i.test(trimmed)) {
+    parsed.detailRule = "unsupported_heading_depth";
+  }
   return parsed;
 }
-async function listResourceEventSubscriptions(input) {
-  const state = input.state ?? getStateAdapter();
-  await state.connect();
-  const nowMs = input.nowMs ?? Date.now();
-  const ids = await readSubscriptionIdIndex(
-    state,
-    conversationIndexKey(input.conversationId)
-  );
-  const records = await Promise.all(
-    ids.map(
-      async (id) => parseSubscription(await state.get(subscriptionKey(id)))
-    )
-  );
-  return records.filter(
-    (record) => record !== void 0 && record.conversationId === input.conversationId && activeAt(record, nowMs)
-  ).sort((left, right) => left.createdAtMs - right.createdAtMs);
-}
-async function cancelResourceEventSubscription(input) {
-  const state = input.state ?? getStateAdapter();
-  await state.connect();
-  return await withSubscriptionLock(state, input.id, async () => {
-    const current = parseSubscription(
-      await state.get(subscriptionKey(input.id))
-    );
-    if (!current || current.conversationId !== input.conversationId) {
-      return void 0;
-    }
-    const nowMs = input.nowMs ?? Date.now();
-    const next = {
-      ...current,
-      status: "cancelled",
-      updatedAtMs: nowMs
-    };
-    await state.set(
-      subscriptionKey(input.id),
-      next,
-      JUNIOR_THREAD_STATE_TTL_MS
-    );
-    await removeFromIndex(
-      state,
-      resourceIndexKey(
-        subscriptionTeamId(current.destination),
-        current.namespace,
-        current.identifier
-      ),
-      input.id,
-      nowMs
-    );
-    await removeFromIndex(
-      state,
-      conversationIndexKey(current.conversationId),
-      input.id,
-      nowMs
+var installationTokenStorage = new AsyncLocalStorage2();
+var clientsByToken = /* @__PURE__ */ new Map();
+function runWithSlackInstallationToken(token, fn) {
+  const trimmed = token.trim();
+  if (!trimmed) {
+    throw new SlackActionError(
+      "Slack installation token binding requires a non-empty token",
+      "missing_token"
     );
-    return next;
-  });
+  }
+  return installationTokenStorage.run({ token: trimmed }, fn);
 }
-async function cancelSubscriptions(input) {
-  const subscriptions = await listResourceEventSubscriptions(input);
-  for (const subscription of subscriptions) {
-    await cancelResourceEventSubscription({
-      conversationId: input.conversationId,
-      id: subscription.id,
-      nowMs: input.nowMs,
-      state: input.state
+function resolveSlackToken() {
+  const ambientToken = installationTokenStorage.getStore()?.token;
+  if (ambientToken) {
+    return ambientToken;
+  }
+  const envToken = getSlackBotToken();
+  if (envToken) {
+    return envToken;
+  }
+  const teamId = getWorkspaceTeamId();
+  if (teamId) {
+    throw new SlackActionError(
+      `Slack call is scoped to workspace ${teamId} but no installation token is bound and no default bot token is configured`,
+      "missing_token"
+    );
+  }
+  throw new SlackActionError(
+    "SLACK_BOT_TOKEN (or SLACK_BOT_USER_TOKEN) is required for Slack Web API actions in this service",
+    "missing_token"
+  );
+}
+function normalizeSlackConversationId(channelId) {
+  return parseSlackChannelReferenceId(channelId);
+}
+function getClient() {
+  const token = resolveSlackToken();
+  let cached = clientsByToken.get(token);
+  if (!cached) {
+    cached = new WebClient(token, {
+      retryConfig: { retries: 0 },
+      rejectRateLimitedCalls: true
     });
+    clientsByToken.set(token, cached);
   }
+  return cached;
 }
-async function collectResourceEventMatchKeys(input) {
-  const state = input.state ?? getStateAdapter();
-  await state.connect();
-  const nowMs = input.nowMs ?? Date.now();
-  const eventTypes = new Set(
-    input.eventTypes.map((eventType) => eventType.trim()).filter(Boolean)
-  );
-  if (eventTypes.size === 0) return [];
-  const keys = /* @__PURE__ */ new Set();
-  const identifiers = new Set(
-    input.identifiers.map((value) => value.trim()).filter(Boolean)
-  );
-  for (const identifier of identifiers) {
-    const ids = await readSubscriptionIdIndex(
-      state,
-      resourceIndexKey(input.teamId, input.namespace, identifier)
-    );
-    const records = await Promise.all(
-      ids.map(
-        async (id) => parseSubscription(await state.get(subscriptionKey(id)))
-      )
-    );
-    for (const record of records) {
-      if (!record) continue;
-      if (record.namespace !== input.namespace) continue;
-      if (record.identifier !== identifier) continue;
-      if (subscriptionTeamId(record.destination) !== input.teamId) continue;
-      if (!activeAt(record, nowMs)) continue;
-      if (!record.events.some((eventType) => eventTypes.has(eventType))) continue;
-      for (const key of Object.keys(record.match ?? {})) {
-        keys.add(key);
-      }
-    }
+function mapSlackError(error) {
+  if (error instanceof SlackActionError) {
+    return error;
   }
-  return [...keys].sort();
+  const candidate = error;
+  const apiError = candidate.data?.error;
+  const message = candidate.message ?? "Slack action failed";
+  const baseOptions = {
+    apiError,
+    statusCode: candidate.statusCode,
+    requestId: getHeaderString(candidate.headers, "x-slack-req-id"),
+    errorData: serializeSlackErrorData(candidate.data),
+    ...parseSlackCanvasDetail(candidate.data?.detail)
+  };
+  if (apiError === "missing_scope") {
+    return new SlackActionError(message, "missing_scope", {
+      ...baseOptions,
+      needed: candidate.data?.needed,
+      provided: candidate.data?.provided
+    });
+  }
+  if (apiError === "not_in_channel") {
+    return new SlackActionError(message, "not_in_channel", baseOptions);
+  }
+  if (apiError === "restricted_action_read_only_channel") {
+    return new SlackActionError(message, "read_only_channel", baseOptions);
+  }
+  if (apiError === "already_reacted") {
+    return new SlackActionError(message, "already_reacted", baseOptions);
+  }
+  if (apiError === "no_reaction") {
+    return new SlackActionError(message, "no_reaction", baseOptions);
+  }
+  if (apiError === "invalid_arguments") {
+    return new SlackActionError(message, "invalid_arguments", baseOptions);
+  }
+  if (apiError === "invalid_cursor") {
+    return new SlackActionError(message, "invalid_arguments", baseOptions);
+  }
+  if (apiError === "invalid_name") {
+    return new SlackActionError(message, "invalid_arguments", baseOptions);
+  }
+  if (apiError === "not_found" || apiError === "channel_not_found" || apiError === "message_not_found") {
+    return new SlackActionError(message, "not_found", baseOptions);
+  }
+  if (apiError === "feature_not_enabled" || apiError === "not_allowed_token_type") {
+    return new SlackActionError(message, "feature_unavailable", baseOptions);
+  }
+  if (apiError === "canvas_creation_failed") {
+    return new SlackActionError(message, "canvas_creation_failed", baseOptions);
+  }
+  if (apiError === "canvas_editing_failed") {
+    return new SlackActionError(message, "canvas_editing_failed", baseOptions);
+  }
+  if (candidate.code === "slack_webapi_rate_limited_error" || candidate.statusCode === 429) {
+    return new SlackActionError(message, "rate_limited", {
+      ...baseOptions,
+      retryAfterSeconds: candidate.retryAfter
+    });
+  }
+  return new SlackActionError(message, "internal_error", baseOptions);
 }
-async function findMatchingResourceEventSubscriptions(input) {
-  const state = input.state ?? getStateAdapter();
-  await state.connect();
-  const nowMs = input.nowMs ?? Date.now();
-  const ids = await readSubscriptionIdIndex(
-    state,
-    resourceIndexKey(input.teamId, input.namespace, input.identifier)
-  );
-  const records = await Promise.all(
-    ids.map(
-      async (id) => parseSubscription(await state.get(subscriptionKey(id)))
-    )
-  );
-  return records.filter(
-    (record) => record !== void 0 && matchesEvent(record, {
-      data: input.data,
-      eventType: input.eventType,
-      nowMs,
-      namespace: input.namespace,
-      identifier: input.identifier,
-      teamId: input.teamId
-    })
-  );
+var MAX_RETRY_DELAY_MS = 1e4;
+var MAX_TOTAL_RETRY_DELAY_MS = 2e4;
+var CONNECTION_ERROR_CODES = /* @__PURE__ */ new Set([
+  "ECONNREFUSED",
+  "ECONNRESET",
+  "ENOTFOUND",
+  "EAI_AGAIN"
+]);
+var TIMEOUT_ERROR_CODES = /* @__PURE__ */ new Set([
+  "ETIMEDOUT",
+  "ECONNABORTED",
+  "ESOCKETTIMEDOUT"
+]);
+function findNetworkErrorCode(error, depth = 0) {
+  if (!error || typeof error !== "object" || depth > 4) {
+    return void 0;
+  }
+  const candidate = error;
+  if (typeof candidate.code === "string" && (CONNECTION_ERROR_CODES.has(candidate.code) || TIMEOUT_ERROR_CODES.has(candidate.code))) {
+    return candidate.code;
+  }
+  return findNetworkErrorCode(candidate.original, depth + 1) ?? findNetworkErrorCode(candidate.cause, depth + 1);
 }
-async function deliverResourceEventSubscription(input) {
-  const state = input.state ?? getStateAdapter();
-  await state.connect();
-  return await withSubscriptionLock(
-    state,
-    input.subscription.id,
-    async () => {
-      const nowMs = input.nowMs ?? Date.now();
-      const current = parseSubscription(
-        await state.get(subscriptionKey(input.subscription.id))
-      );
-      if (!current || !matchesEvent(current, {
-        data: input.data,
-        eventType: input.eventType,
-        nowMs,
-        namespace: input.namespace,
-        identifier: input.identifier,
-        teamId: input.teamId
-      })) {
-        return false;
-      }
-      const delivered = await input.deliver(current);
-      if (input.terminal) {
-        const latest = parseSubscription(
-          await state.get(subscriptionKey(current.id))
-        );
-        if (!latest || latest.status !== current.status || latest.updatedAtMs !== current.updatedAtMs) {
-          return delivered;
+function hasSocketHangUpMessage(error) {
+  return error instanceof Error && error.message.toLowerCase().includes("socket hang up");
+}
+function classifySlackRetry(raw, mapped) {
+  if (mapped.code === "rate_limited") {
+    return "rate_limited";
+  }
+  if (mapped.statusCode !== void 0 && mapped.statusCode >= 500) {
+    return "server_error";
+  }
+  const networkCode = findNetworkErrorCode(raw);
+  if (networkCode && CONNECTION_ERROR_CODES.has(networkCode)) {
+    return "connection";
+  }
+  if (networkCode && TIMEOUT_ERROR_CODES.has(networkCode)) {
+    return "timeout";
+  }
+  if (hasSocketHangUpMessage(raw)) {
+    return "connection";
+  }
+  return "none";
+}
+async function withSlackRetries(task, maxAttempts = 3, context = {}) {
+  let attempt = 0;
+  let totalDelayMs = 0;
+  const action = context.action ?? "unknown";
+  while (attempt < maxAttempts) {
+    attempt += 1;
+    const attemptNumber = attempt;
+    try {
+      return await withSpan(
+        `POST slack.com/api/${action}`,
+        "http.client",
+        {},
+        async () => {
+          try {
+            return await task();
+          } catch (error) {
+            const mapped = mapSlackError(error);
+            const errorAttrs = {
+              "error.type": mapped.code
+            };
+            if (mapped.apiError) {
+              errorAttrs["app.slack.api_error_code"] = mapped.apiError;
+            }
+            if (mapped.code === "rate_limited") {
+              errorAttrs["http.response.status_code"] = 429;
+              if (mapped.retryAfterSeconds) {
+                errorAttrs["app.slack.retry_after_ms"] = mapped.retryAfterSeconds * 1e3;
+              }
+            } else if (mapped.statusCode != null) {
+              errorAttrs["http.response.status_code"] = mapped.statusCode;
+            }
+            setSpanAttributes(errorAttrs);
+            setSpanStatus("error");
+            throw error;
+          }
+        },
+        {
+          "http.request.method": "POST",
+          "server.address": "slack.com",
+          "url.scheme": "https",
+          "url.path": `/api/${action}`,
+          "app.slack.method": action,
+          "app.retry.max_attempts": maxAttempts,
+          ...attemptNumber > 1 ? { "http.request.resend_count": attemptNumber - 1 } : void 0,
+          ...context.attributes ?? {},
+          ...context.spanAttributes ?? {}
         }
-        const next = {
-          ...current,
-          status: "completed",
-          updatedAtMs: nowMs
-        };
-        await state.set(
-          subscriptionKey(current.id),
-          next,
-          JUNIOR_THREAD_STATE_TTL_MS
-        );
-        await removeFromIndex(
-          state,
-          resourceIndexKey(
-            subscriptionTeamId(current.destination),
-            current.namespace,
-            current.identifier
-          ),
-          current.id,
-          nowMs
-        );
-        await removeFromIndex(
-          state,
-          conversationIndexKey(current.conversationId),
-          current.id,
-          nowMs
-        );
+      );
+    } catch (error) {
+      const mapped = mapSlackError(error);
+      const retryClass = classifySlackRetry(error, mapped);
+      const isRetryable = retryClass === "rate_limited" || retryClass === "connection" || retryClass === "server_error" || retryClass === "timeout" && context.idempotent === true;
+      const remainingDelayBudgetMs = MAX_TOTAL_RETRY_DELAY_MS - totalDelayMs;
+      const baseLogAttributes = {
+        "app.slack.action": action,
+        "app.slack.error_code": mapped.code,
+        ...mapped.apiError ? { "app.slack.api_error": mapped.apiError } : void 0,
+        ...mapped.detail ? { "app.slack.detail": mapped.detail } : void 0,
+        ...mapped.detailLine !== void 0 ? { "app.slack.detail_line": mapped.detailLine } : void 0,
+        ...mapped.detailRule ? { "app.slack.detail_rule": mapped.detailRule } : void 0,
+        ...mapped.requestId ? { "app.slack.request_id": mapped.requestId } : void 0,
+        ...mapped.statusCode !== void 0 ? { "http.response.status_code": mapped.statusCode } : void 0,
+        ...context.attributes ?? {}
+      };
+      if (!isRetryable || attempt >= maxAttempts || remainingDelayBudgetMs <= 0) {
+        logWarn("slack.action.failed", {
+          ...baseLogAttributes,
+          ...mapped.errorData ? { "app.slack.error_data": mapped.errorData } : void 0
+        });
+        throw mapped;
       }
-      return delivered;
-    },
-    input.waitDeadlineMs
-  );
-}
-
-// src/chat/tools/execution/tool-input-error.ts
-var ToolInputError = class extends Error {
-  constructor(message, options) {
-    super(message, options);
-    this.name = "ToolInputError";
-  }
-};
-
-// src/chat/resource-events/tool-support.ts
-var RESOURCE_SUBSCRIPTION_DEFAULT_TTL_MS = 14 * 24 * 60 * 60 * 1e3;
-var RESOURCE_SUBSCRIPTION_MAX_TTL_MS = 30 * 24 * 60 * 60 * 1e3;
-var STOP_WATCHING_TOOL_NAME = "stopWatchingResources";
-var RESOURCE_WATCH_TOOL_SOURCE = {
-  id: "resource-watches",
-  description: "Inspect or stop resource watches for the current conversation."
-};
-function requireResourceWatchConversation(context) {
-  if (!context.conversationId) {
-    throw new ToolInputError(
-      "Resource event subscriptions require a conversation"
-    );
-  }
-  if (context.destination.platform !== "slack") {
-    throw new ToolInputError(
-      "Resource event subscriptions currently require Slack delivery"
-    );
-  }
-  if (!isSlackThreadConversationId(context.conversationId)) {
-    throw new ToolInputError(
-      "Resource event subscriptions require a Slack thread conversation"
-    );
-  }
-  return context.conversationId;
-}
-function canUseResourceEventSubscriptionTools(context) {
-  return context.destination.platform === "slack" && Boolean(
-    context.conversationId && isSlackThreadConversationId(context.conversationId)
-  );
-}
-function isSlackThreadConversationId(conversationId) {
-  const parts = conversationId.split(":");
-  return parts.length === 3 && parts[0] === "slack" && Boolean(parts[1]) && Boolean(parts[2]);
-}
-
-// src/chat/slack/tool-support/context.ts
-function getSlackToolContext(context) {
-  if (context.source.platform !== "slack") {
-    return void 0;
-  }
-  if (context.destination.platform !== "slack") {
-    throw new TypeError("Slack source requires a Slack destination");
-  }
-  const destinationChannelId = parseSlackChannelReferenceId(
-    context.destination.channelId
-  );
-  const sourceChannelId = parseSlackChannelReferenceId(
-    context.source.channelId
-  );
-  const teamId = parseSlackTeamId(context.source.teamId);
-  if (!destinationChannelId || !sourceChannelId || !teamId) {
-    return void 0;
+      logWarn("slack.action.retrying", {
+        ...baseLogAttributes,
+        "app.slack.retry_attempt": attempt,
+        "app.slack.retry_class": retryClass
+      });
+      const retryAfterMs = retryClass === "rate_limited" && mapped.retryAfterSeconds && mapped.retryAfterSeconds > 0 ? mapped.retryAfterSeconds * 1e3 : void 0;
+      const backoffMs = Math.min(2e3, 250 * 2 ** (attempt - 1));
+      const delayMs = Math.min(
+        retryAfterMs ?? backoffMs,
+        MAX_RETRY_DELAY_MS,
+        remainingDelayBudgetMs
+      );
+      totalDelayMs += delayMs;
+      await sleep(delayMs);
+    }
   }
-  return {
-    destination: context.destination,
-    source: context.source,
-    actor: context.actor?.platform === "slack" ? context.actor : void 0,
-    destinationChannelId,
-    messageTs: parseSlackMessageTs(context.source.messageTs),
-    sourceChannelId,
-    teamId,
-    threadTs: parseSlackMessageTs(context.source.threadTs)
-  };
-}
-
-// src/chat/plugins/viewer.ts
-import { randomUUID } from "crypto";
-import { and as and3, asc, eq as eq3 } from "drizzle-orm";
-import {
-  identitySchema,
-  userSchema
-} from "@sentry/junior-plugin-api";
-function identityFromRow(row) {
-  return identitySchema.parse({
-    id: row.id,
-    provider: row.provider,
-    providerSubjectId: row.providerSubjectId,
-    ...row.providerTenantId ? { providerTenantId: row.providerTenantId } : void 0,
-    ...row.displayName ? { displayName: row.displayName } : void 0,
-    ...row.handle ? { handle: row.handle } : void 0
-  });
-}
-async function readUserById(db, userRow) {
-  const identityRows = await db.select().from(juniorIdentities).where(
-    and3(
-      eq3(juniorIdentities.userId, userRow.id),
-      eq3(juniorIdentities.kind, "user")
-    )
-  ).orderBy(
-    asc(juniorIdentities.provider),
-    asc(juniorIdentities.providerTenantId),
-    asc(juniorIdentities.providerSubjectId)
+  throw new SlackActionError(
+    "Slack action exhausted retries",
+    "internal_error"
   );
-  return userSchema.parse({
-    email: userRow.primaryEmail,
-    id: userRow.id,
-    identities: identityRows.map(identityFromRow),
-    ...userRow.displayName ? { displayName: userRow.displayName } : void 0
-  });
-}
-async function resolveViewerUserFromSql(db, email) {
-  const normalizedEmail = normalizeIdentityEmail(email);
-  if (!normalizedEmail) return void 0;
-  const now = /* @__PURE__ */ new Date();
-  const rows = await db.insert(juniorUsers).values({
-    id: randomUUID(),
-    primaryEmail: email.trim(),
-    primaryEmailNormalized: normalizedEmail,
-    displayName: null,
-    createdAt: now,
-    updatedAt: now
-  }).onConflictDoNothing({ target: juniorUsers.primaryEmailNormalized }).returning();
-  const userRow = rows[0] ?? (await db.select().from(juniorUsers).where(eq3(juniorUsers.primaryEmailNormalized, normalizedEmail)).limit(1))[0];
-  return userRow ? await readUserById(db, userRow) : void 0;
 }
-async function resolveViewerUser(email) {
-  return await resolveViewerUserFromSql(getDb(), email);
-}
-async function findUserByEmailFromSql(db, email) {
-  const normalizedEmail = normalizeIdentityEmail(email);
-  if (!normalizedEmail) return void 0;
-  const userRow = (await db.select().from(juniorUsers).where(eq3(juniorUsers.primaryEmailNormalized, normalizedEmail)).limit(1))[0];
-  return userRow ? await readUserById(db, userRow) : void 0;
+function getSlackClient() {
+  return getClient();
 }
-async function findUserByEmail(email) {
-  return await findUserByEmailFromSql(getDb(), email);
+function isDmChannel(channelId) {
+  const normalized = normalizeSlackConversationId(channelId);
+  return Boolean(normalized && normalized.startsWith("D"));
 }
-async function updateViewerDisplayNameFromSql(db, userId, displayName) {
-  const rows = await db.update(juniorUsers).set({ displayName, updatedAt: /* @__PURE__ */ new Date() }).where(eq3(juniorUsers.id, userId)).returning();
-  const userRow = rows[0];
-  return userRow ? await readUserById(db, userRow) : void 0;
+function isConversationScopedChannel(channelId) {
+  const normalized = normalizeSlackConversationId(channelId);
+  if (!normalized) return false;
+  return normalized.startsWith("C") || normalized.startsWith("G") || normalized.startsWith("D");
 }
-async function updateViewerDisplayName(userId, displayName) {
-  return await updateViewerDisplayNameFromSql(getDb(), userId, displayName);
+function isConversationChannel(channelId) {
+  const normalized = normalizeSlackConversationId(channelId);
+  if (!normalized) return false;
+  return normalized.startsWith("C") || normalized.startsWith("G");
 }
-async function readActorIdentityFromSql(db, actor) {
-  if (actor.platform === "system") return void 0;
-  const providerTenantId = actor.platform === "slack" ? actor.teamId : "";
-  const rows = await db.select({
-    identity: juniorIdentities,
-    user: juniorUsers
-  }).from(juniorIdentities).leftJoin(juniorUsers, eq3(juniorUsers.id, juniorIdentities.userId)).where(
-    and3(
-      eq3(juniorIdentities.kind, "user"),
-      eq3(juniorIdentities.provider, actor.platform),
-      eq3(juniorIdentities.providerTenantId, providerTenantId),
-      eq3(juniorIdentities.providerSubjectId, actor.userId)
-    )
-  ).limit(1);
-  const row = rows[0];
-  if (!row) return void 0;
-  return {
-    identity: identityFromRow(row.identity),
-    ...row.user ? { user: await readUserById(db, row.user) } : void 0
-  };
+async function getFilePermalink(fileId) {
+  const client = getClient();
+  const response = await withSlackRetries(
+    () => client.files.info({
+      file: fileId
+    }),
+    3,
+    {
+      action: "files.info",
+      idempotent: true,
+      spanAttributes: { "app.slack.file_id": fileId }
+    }
+  );
+  return response.file?.permalink;
 }
-async function readActorIdentity(actor) {
-  return await readActorIdentityFromSql(getDb(), actor);
+async function downloadPrivateSlackFile(url) {
+  const token = resolveSlackToken();
+  return withSpan(
+    "GET files.slack.com",
+    "http.client",
+    {},
+    async () => {
+      const response = await fetch(url, {
+        headers: {
+          Authorization: `Bearer ${token}`
+        }
+      });
+      setSpanAttributes({ "http.response.status_code": response.status });
+      if (!response.ok) {
+        setSpanAttributes({ "error.type": String(response.status) });
+        setSpanStatus("error");
+        throw new Error(`Slack file download failed: ${response.status}`);
+      }
+      return Buffer.from(await response.arrayBuffer());
+    },
+    {
+      "http.request.method": "GET",
+      "server.address": "files.slack.com",
+      "url.scheme": "https",
+      "app.slack.method": "files.download"
+    }
+  );
 }
 
 // src/chat/credentials/subject.ts
-import { createHmac, timingSafeEqual } from "crypto";
 var CREDENTIAL_SUBJECT_HMAC_CONTEXT = "junior.credential_subject.v1";
 var CREDENTIAL_SUBJECT_SIGNATURE_VERSION = "v1";
 function getCredentialSubjectSecret() {
@@ -2726,7 +2673,9 @@ function getPluginTools(context, sandbox = createSandboxCapability(context.works
       teamId: slackToolContext.teamId,
       userId: slackToolContext.actor?.userId
     }) : void 0;
-    const dashboardConversationUrl = context.conversationId ? getDashboardConversationLink(context.conversationId) : void 0;
+    const dashboardConversationUrl = getDashboardConversationLink(
+      context.conversationId
+    );
     const slackContext = slackToolContext ? {
       channelCapabilities: resolveChannelCapabilities(
         slackToolContext.sourceChannelId
@@ -2734,17 +2683,17 @@ function getPluginTools(context, sandbox = createSandboxCapability(context.works
       ...dashboardConversationUrl ? { conversationLink: { url: dashboardConversationUrl } } : void 0,
       ...credentialSubject ? { credentialSubject } : void 0
     } : void 0;
-    const annotations = context.conversationId ? createPluginAnnotations({
+    const annotations = createPluginAnnotations({
       conversationId: context.conversationId,
       db: getDb(),
       plugin: pluginName
-    }) : void 0;
+    });
     const mcp = pluginMcpContext(plugin, context);
-    const canSubscribe = context.source.platform === "slack" && context.destination.platform === "slack" && Boolean(context.conversationId) && canRouteResourceEvents() && Boolean(plugin.resourceEvents) && plugin.resourceEvents?.isEnabled?.() !== false;
+    const canSubscribe = Boolean(plugin.resourceEvents) && plugin.resourceEvents?.isEnabled?.() !== false;
     const resourceEvents = {
       canSubscribe,
       async subscribe(input) {
-        if (!canSubscribe || context.destination.platform !== "slack") {
+        if (!canSubscribe) {
           throw new Error(
             "Resource subscriptions are not available in this conversation."
           );
@@ -2783,7 +2732,7 @@ function getPluginTools(context, sandbox = createSandboxCapability(context.works
     const resolveActor = context.resolveActorIdentity ?? (async () => void 0);
     const common = {
       ...basePluginContext(plugin),
-      ...annotations ? { annotations } : void 0,
+      annotations,
       conversationId: context.conversationId,
       locationId: context.locationId,
       userText: context.userText,
@@ -3575,7 +3524,6 @@ function createPluginHookRunner(input = {}) {
 }
 
 export {
-  ToolInputError,
   listConversationAnnotations,
   listConversationAnnotationsById,
   createPluginConversationEvents,
@@ -3587,20 +3535,6 @@ export {
   setDashboardConversationLinkOptions,
   getDashboardConversationLink,
   getDashboardTaskLink,
-  runWithWorkspaceTeamId,
-  getWorkspaceTeamId,
-  SlackActionError,
-  getHeaderString,
-  runWithSlackInstallationToken,
-  normalizeSlackConversationId,
-  withSlackRetries,
-  getSlackClient,
-  isDmChannel,
-  isConversationScopedChannel,
-  getFilePermalink,
-  downloadPrivateSlackFile,
-  canRouteResourceEvents,
-  createResourceEventTeamIdResolver,
   createResourceEventSubscription,
   listResourceEventSubscriptions,
   cancelResourceEventSubscription,
@@ -3612,13 +3546,23 @@ export {
   RESOURCE_SUBSCRIPTION_MAX_TTL_MS,
   STOP_WATCHING_TOOL_NAME,
   RESOURCE_WATCH_TOOL_SOURCE,
-  requireResourceWatchConversation,
-  canUseResourceEventSubscriptionTools,
   getSlackToolContext,
   resolveViewerUser,
   findUserByEmail,
   updateViewerDisplayName,
   readActorIdentity,
+  runWithWorkspaceTeamId,
+  getWorkspaceTeamId,
+  SlackActionError,
+  getHeaderString,
+  runWithSlackInstallationToken,
+  normalizeSlackConversationId,
+  withSlackRetries,
+  getSlackClient,
+  isDmChannel,
+  isConversationScopedChannel,
+  getFilePermalink,
+  downloadPrivateSlackFile,
   bindSlackDirectCredentialSubject,
   verifySlackDirectCredentialSubject,
   bindScheduledTaskCredentialSubject,