@sentry/junior 0.203.0 → 0.204.0

package/dist/agent-hooks-Bbcp9e33.js

@@ -0,0 +1,4040 @@
+import { t as __exportAll } from "./rolldown-runtime-B4FMCO8f.js";
+import { _ as completeObject, i as getChatConfig, n as botConfig, o as getSlackBotToken, y as embedTexts } from "./config-nGCW1OTG.js";
+import { C as withSpan, P as normalizeIdentityEmail, _ as setSpanAttributes, d as logInfo, f as logWarn, u as logException, v as setSpanStatus } from "./logging-BzAk1S_s.js";
+import { n as defaultModelId } from "./model-profile-CZmVoGdX.js";
+import { _ as parseSlackMessageTs, c as isActorUserId, h as parseSlackTeamId, m as parseSlackChannelReferenceId, u as parseActorUserId } from "./context-B45_WqVX.js";
+import { n as juniorDestinations } from "./destinations-BeBiJeEM.js";
+import { C as juniorConversations, S as conversationReadColumns, T as juniorUsers, b as juniorCodeRepositories, g as juniorConversationEvents, h as juniorConversationBindings, i as juniorWorkspaces, m as juniorConversationParticipants, n as juniorSnapshots, r as juniorWorkspaceRepos, t as createJuniorSqlExecutor, v as juniorConversationAnnotations, w as juniorIdentities, y as juniorCodeChanges } from "./executor-DcMSlI5c.js";
+import { c as newConversationEventSchema, o as decodeStoredConversationEvent, r as conversationEventDataSchema, s as historyReplacementSchema } from "./history-CqTuSAdI.js";
+import { A as sleep$1, P as SANDBOX_WORKSPACE_ROOT, l as isSandboxMissingError, n as hash, v as getVercelSandboxCredentials, w as getStateAdapter, x as runNonInteractiveCommand } from "./profile-CrT5nXbw.js";
+import { AsyncLocalStorage } from "node:async_hooks";
+import { z } from "zod";
+import { createHash, createHmac, randomUUID, timingSafeEqual } from "node:crypto";
+import { and, asc, desc, eq, gt, gte, inArray, isNull, lt, lte, ne, or, sql } from "drizzle-orm";
+import { codeChangeInputSchema, conversationAnnotationInputSchema, destinationSchema, identitySchema, locationSchema, missingToolAnnotationKeys, normalizeResourceEventIdentifier, pluginResourceEventsSchema, promptContextSchema, promptMessageSchema, resourceEventInputSchema, resourceEventMatchSchema, resourceEventMatches, resourceEventTypeSchema, sourceSchema, stableResourceEventMatchKey, userSchema } from "@sentry/junior-plugin-api";
+import { WebClient } from "@slack/web-api";
+import { Sandbox } from "@vercel/sandbox";
+//#region src/chat/destination.ts
+/** Build Junior's canonical destination from Slack workspace and channel ids. */
+function createSlackDestination(input) {
+	const channelId = parseSlackChannelReferenceId(input.channelId);
+	const teamId = parseSlackTeamId(input.teamId);
+	if (!channelId || !teamId) return;
+	return {
+		platform: "slack",
+		teamId,
+		channelId
+	};
+}
+/** Parse and validate a serialized destination that crossed a runtime boundary. */
+function parseDestination(value) {
+	const parsed = destinationSchema.safeParse(value);
+	return parsed.success ? parsed.data : void 0;
+}
+/** Require a Slack destination at a Slack-only runtime boundary. */
+function requireSlackDestination(destination, action) {
+	if (destination?.platform === "slack") return destination;
+	throw new Error(`${action} requires a Slack destination`);
+}
+/** Compare two destinations without relying on object identity. */
+function sameDestination(left, right) {
+	if (left.platform !== right.platform) return false;
+	if (left.platform === "local" && right.platform === "local") return left.conversationId === right.conversationId;
+	if (left.platform === "slack" && right.platform === "slack") return left.teamId === right.teamId && left.channelId === right.channelId;
+	return false;
+}
+//#endregion
+//#region src/chat/identities/sql.ts
+function dateFromMs$1(ms) {
+	return new Date(ms);
+}
+function tenantId$1(value) {
+	return value ?? "";
+}
+async function upsertUser(executor, args) {
+	const id = (await executor.db().insert(juniorUsers).values({
+		id: randomUUID(),
+		primaryEmail: args.email,
+		primaryEmailNormalized: args.emailNormalized,
+		displayName: args.displayName ?? null,
+		createdAt: dateFromMs$1(args.nowMs),
+		updatedAt: dateFromMs$1(args.nowMs)
+	}).onConflictDoUpdate({
+		target: juniorUsers.primaryEmailNormalized,
+		set: {
+			displayName: sql`coalesce(${juniorUsers.displayName}, excluded.display_name)`,
+			updatedAt: sql`excluded.updated_at`
+		}
+	}).returning({ id: juniorUsers.id }))[0]?.id;
+	if (!id) throw new Error("User identity upsert returned no row");
+	return id;
+}
+async function existingIdentity(executor, identity) {
+	return (await executor.db().select().from(juniorIdentities).where(and(eq(juniorIdentities.provider, identity.provider), eq(juniorIdentities.providerTenantId, tenantId$1(identity.providerTenantId)), eq(juniorIdentities.providerSubjectId, identity.providerSubjectId))))[0];
+}
+async function upsertIdentityRecord(executor, identity, linkedUserId, nowMs) {
+	const emailNormalized = normalizeIdentityEmail(identity.email);
+	const email = emailNormalized ? identity.email?.trim() || emailNormalized : void 0;
+	const existing = await existingIdentity(executor, identity);
+	const userEmailNormalized = existing?.emailVerified && existing.emailNormalized ? existing.emailNormalized : identity.emailVerified ? emailNormalized : void 0;
+	const userEmail = existing?.emailVerified && existing.email ? existing.email : email ?? userEmailNormalized;
+	const verifiedUserId = identity.kind === "user" && userEmailNormalized ? await upsertUser(executor, {
+		email: userEmail ?? userEmailNormalized,
+		emailNormalized: userEmailNormalized,
+		nowMs,
+		...existing?.displayName || identity.displayName ? { displayName: existing?.displayName ?? identity.displayName } : void 0
+	}) : void 0;
+	if (existing?.userId && verifiedUserId && existing.userId !== verifiedUserId) throw new Error("Identity verified email conflicts with linked user");
+	if (linkedUserId && verifiedUserId && linkedUserId !== verifiedUserId) throw new Error("Linked identity conflicts with verified email user");
+	if (existing?.userId && linkedUserId && existing.userId !== linkedUserId) throw new Error("Identity conflicts with linked user");
+	const userId = existing?.userId ?? linkedUserId ?? verifiedUserId;
+	const row = (await executor.db().insert(juniorIdentities).values({
+		id: randomUUID(),
+		userId: userId ?? null,
+		kind: identity.kind,
+		provider: identity.provider,
+		providerTenantId: tenantId$1(identity.providerTenantId),
+		providerSubjectId: identity.providerSubjectId,
+		displayName: identity.displayName ?? null,
+		handle: identity.handle ?? null,
+		email: email ?? null,
+		emailNormalized: emailNormalized ?? null,
+		emailVerified: Boolean(identity.emailVerified && emailNormalized),
+		avatarUrl: null,
+		metadata: identity.metadata ?? null,
+		createdAt: dateFromMs$1(nowMs),
+		updatedAt: dateFromMs$1(nowMs)
+	}).onConflictDoUpdate({
+		target: [
+			juniorIdentities.provider,
+			juniorIdentities.providerTenantId,
+			juniorIdentities.providerSubjectId
+		],
+		set: {
+			kind: sql`excluded.kind`,
+			userId: sql`coalesce(${juniorIdentities.userId}, excluded.user_id)`,
+			displayName: linkedUserId ? sql`coalesce(excluded.display_name, ${juniorIdentities.displayName})` : sql`coalesce(${juniorIdentities.displayName}, excluded.display_name)`,
+			handle: linkedUserId ? sql`coalesce(excluded.handle, ${juniorIdentities.handle})` : sql`coalesce(${juniorIdentities.handle}, excluded.handle)`,
+			email: sql`case when ${juniorIdentities.emailVerified} then coalesce(${juniorIdentities.email}, excluded.email) when excluded.email_verified then excluded.email else coalesce(${juniorIdentities.email}, excluded.email) end`,
+			emailNormalized: sql`case when ${juniorIdentities.emailVerified} then coalesce(${juniorIdentities.emailNormalized}, excluded.email_normalized) when excluded.email_verified then excluded.email_normalized else coalesce(${juniorIdentities.emailNormalized}, excluded.email_normalized) end`,
+			emailVerified: sql`${juniorIdentities.emailVerified} OR excluded.email_verified`,
+			avatarUrl: sql`coalesce(${juniorIdentities.avatarUrl}, excluded.avatar_url)`,
+			metadata: sql`coalesce(${juniorIdentities.metadata}, excluded.metadata_json)`,
+			updatedAt: sql`excluded.updated_at`
+		},
+		...linkedUserId ? { setWhere: sql`${juniorIdentities.userId} IS NULL OR ${juniorIdentities.userId} = excluded.user_id` } : void 0
+	}).returning({
+		id: juniorIdentities.id,
+		userId: juniorIdentities.userId
+	}))[0];
+	if (!row) {
+		if (linkedUserId) throw new Error("Identity conflicts with linked user");
+		throw new Error("Identity upsert returned no row");
+	}
+	return {
+		id: row.id,
+		...row.userId ? { userId: row.userId } : void 0
+	};
+}
+/** Persist one provider identity observation and link verified emails to users. */
+async function upsertIdentity(executor, identity, nowMs = Date.now()) {
+	return await upsertIdentityRecord(executor, identity, void 0, nowMs);
+}
+/**
+* Persist one provider identity after a trusted account-linking flow.
+* Callers must use provider-verified account data, such as GitHub's authenticated
+* user response, never identity claims inferred from content such as Git commits.
+*/
+async function upsertLinkedIdentity(executor, userId, identity, nowMs = Date.now()) {
+	return await upsertIdentityRecord(executor, identity, userId, nowMs);
+}
+/** Remove one exact provider identity owned by a workspace Slack user. */
+async function deleteProviderIdentityForSlackUser(executor, slackTeamId, slackUserId, provider, providerSubjectId) {
+	const userId = (await executor.db().select({ userId: juniorIdentities.userId }).from(juniorIdentities).where(and(eq(juniorIdentities.kind, "user"), eq(juniorIdentities.provider, "slack"), eq(juniorIdentities.providerTenantId, slackTeamId), eq(juniorIdentities.providerSubjectId, slackUserId))).limit(1))[0]?.userId;
+	if (!userId) return;
+	await executor.db().delete(juniorIdentities).where(and(eq(juniorIdentities.userId, userId), eq(juniorIdentities.provider, provider), eq(juniorIdentities.providerTenantId, ""), eq(juniorIdentities.providerSubjectId, providerSubjectId)));
+}
+//#endregion
+//#region src/chat/conversations/sql/participants.ts
+/** Resolve the root conversation id that owns personal-feed membership. */
+async function resolveRootConversationId(executor, conversationId) {
+	const [row] = await executor.db().select({ rootConversationId: juniorConversations.rootConversationId }).from(juniorConversations).where(eq(juniorConversations.conversationId, conversationId)).limit(1);
+	return row?.rootConversationId ?? conversationId;
+}
+/**
+* Upsert one linked user as a participant on a root conversation.
+* No-ops when the identity is missing, unlinked, or not a user.
+*/
+async function recordConversationParticipant(executor, args) {
+	const [identity] = await executor.db().select({
+		kind: juniorIdentities.kind,
+		userId: juniorIdentities.userId
+	}).from(juniorIdentities).where(eq(juniorIdentities.id, args.actorIdentityId)).limit(1);
+	if (!identity?.userId || identity.kind !== "user") return;
+	const rootConversationId = await resolveRootConversationId(executor, args.conversationId);
+	const at = new Date(args.atMs);
+	await executor.db().insert(juniorConversationParticipants).values({
+		userId: identity.userId,
+		rootConversationId,
+		lastMessageAt: at
+	}).onConflictDoUpdate({
+		target: [juniorConversationParticipants.userId, juniorConversationParticipants.rootConversationId],
+		set: {
+			lastMessageAt: sql`greatest(${juniorConversationParticipants.lastMessageAt}, excluded.last_message_at)`,
+			...args.restoreArchive ? { archivedAt: null } : void 0
+		}
+	});
+}
+//#endregion
+//#region src/chat/source.ts
+/**
+* Normalize a Turn Source into legacy provider fields stored on a Conversation.
+* System Sources do not contain a Conversation Location.
+*/
+function normalizeSessionSource(value) {
+	if (!value) return;
+	if (value.kind === "local") return {
+		kind: "local",
+		visibility: value.visibility,
+		conversationId: value.conversationId
+	};
+	if (value.kind === "web") return {
+		kind: "web",
+		visibility: value.visibility,
+		conversationId: value.conversationId
+	};
+	if (value.kind === "resource_event" || value.kind === "scheduled_task" || value.kind === "event_task" || value.kind === "plugin_dispatch" || value.kind === "agent_invocation") return;
+	const threadTs = value.threadTs?.trim();
+	return {
+		kind: "slack",
+		visibility: value.visibility,
+		teamId: value.teamId,
+		channelId: value.channelId,
+		...threadTs ? { threadTs } : void 0
+	};
+}
+/** Parse a serialized Source into legacy provider fields stored on a Conversation. */
+function parseSessionSource(value) {
+	const parsed = sourceSchema.safeParse(value);
+	return parsed.success ? normalizeSessionSource(parsed.data) : void 0;
+}
+//#endregion
+//#region src/chat/conversations/sql/bindings.ts
+/** Resolve the durable conversation bound to provider-owned coordinates. */
+async function getConversationIdByProviderConversation(executor, args) {
+	return (await executor.db().select({ conversationId: juniorConversationBindings.conversationId }).from(juniorConversationBindings).where(and(eq(juniorConversationBindings.provider, args.provider), eq(juniorConversationBindings.providerTenantId, args.providerTenantId), eq(juniorConversationBindings.providerDestinationId, args.providerDestinationId), eq(juniorConversationBindings.providerConversationId, args.providerConversationId))).limit(1))[0]?.conversationId;
+}
+/** Bind provider coordinates to a durable conversation in the caller's SQL scope. */
+async function bindProviderConversation(executor, args) {
+	if (((await executor.db().insert(juniorConversationBindings).values({
+		...args,
+		createdAt: /* @__PURE__ */ new Date()
+	}).onConflictDoNothing().returning({ conversationId: juniorConversationBindings.conversationId }))[0]?.conversationId ?? await getConversationIdByProviderConversation(executor, args)) !== args.conversationId) throw new Error("Provider conversation is already bound to another conversation");
+}
+//#endregion
+//#region src/chat/conversations/sql/actor-identity.ts
+/** Build a durable identity observation from a stored conversation actor. */
+function identityFromActor(actor) {
+	if (actor?.slackUserId) return {
+		kind: "user",
+		provider: "slack",
+		providerTenantId: actor.teamId,
+		providerSubjectId: actor.slackUserId,
+		...actor.fullName ? { displayName: actor.fullName } : void 0,
+		...actor.slackUserName ? { handle: actor.slackUserName } : void 0,
+		...actor.email ? {
+			email: actor.email,
+			emailVerified: true
+		} : void 0,
+		metadata: { platform: "slack" }
+	};
+	const email = actor?.email?.trim().toLowerCase();
+	if (!email) return;
+	return {
+		kind: "user",
+		provider: "junior",
+		providerSubjectId: email,
+		email,
+		emailVerified: true,
+		...actor?.fullName ? { displayName: actor.fullName } : void 0,
+		metadata: { platform: "web" }
+	};
+}
+/** Build a system identity when a conversation has no user actor. */
+function systemIdentityFromSource(source) {
+	if (source === "scheduler") return {
+		kind: "system",
+		provider: "junior",
+		providerSubjectId: "scheduler",
+		displayName: "Junior Scheduler"
+	};
+	if (source === "local") return {
+		kind: "system",
+		provider: "junior",
+		providerSubjectId: "local-cli",
+		displayName: "Local CLI"
+	};
+	if (source === "resource_event") return {
+		kind: "system",
+		provider: "junior",
+		providerSubjectId: "resource-event",
+		displayName: "Resource Event"
+	};
+}
+/** Prefer the user actor identity, else a source-derived system identity. */
+function actorIdentityForConversation(conversation) {
+	return identityFromActor(conversation.actor) ?? systemIdentityFromSource(conversation.source);
+}
+/**
+* Reconstruct a stored actor with the linked user name and identity-scoped
+* provider fields.
+*/
+function actorFromIdentityRow(identity, userDisplayName) {
+	if (!identity) return;
+	const fullName = userDisplayName?.trim() ? userDisplayName : identity.displayName;
+	const email = identity.emailNormalized ?? identity.email ?? void 0;
+	if (identity.provider === "slack") return {
+		...email ? { email } : void 0,
+		...fullName ? { fullName } : void 0,
+		platform: "slack",
+		slackUserId: identity.providerSubjectId,
+		...identity.handle ? { slackUserName: identity.handle } : void 0,
+		...identity.providerTenantId ? { teamId: identity.providerTenantId } : void 0
+	};
+	if (identity.provider === "junior" && email) return {
+		email,
+		...fullName ? { fullName } : void 0
+	};
+}
+/** Merge later actor observations without replacing a durable Slack subject. */
+function mergeActor(current, next) {
+	if (!current) return next;
+	if (!next) return current;
+	if (current.slackUserId && next.slackUserId && current.slackUserId !== next.slackUserId) return current;
+	return {
+		...current,
+		...current.email ?? next.email ? { email: current.email ?? next.email } : void 0,
+		...current.fullName ?? next.fullName ? { fullName: current.fullName ?? next.fullName } : void 0,
+		...current.platform ?? next.platform ? { platform: current.platform ?? next.platform } : void 0,
+		...current.slackUserId ?? next.slackUserId ? { slackUserId: current.slackUserId ?? next.slackUserId } : void 0,
+		...current.slackUserName ?? next.slackUserName ? { slackUserName: current.slackUserName ?? next.slackUserName } : void 0,
+		...current.teamId ?? next.teamId ? { teamId: current.teamId ?? next.teamId } : void 0
+	};
+}
+//#endregion
+//#region src/chat/conversations/sql/location.ts
+/** Build the complete Location for one Conversation SQL write. */
+function locationForWrite(args) {
+	const location = args.location ? locationSchema.parse(args.location) : void 0;
+	const destination = args.destination?.platform === "slack" ? args.destination : void 0;
+	const source = args.sessionSource?.kind === "slack" ? args.sessionSource : void 0;
+	if (location) {
+		if (destination && (location.id !== args.destinationId || location.teamId !== destination.teamId || location.channelId !== destination.channelId) || source && (location.teamId !== source.teamId || location.channelId !== source.channelId)) throw new Error("Conversation Location changed");
+		return source?.threadTs && !location.threadTs ? {
+			...location,
+			threadTs: source.threadTs
+		} : location;
+	}
+	if (destination && source && (destination.teamId !== source.teamId || destination.channelId !== source.channelId)) throw new Error("Conversation Location does not match its session Source");
+	if (!destination || !args.destinationId) return;
+	return locationSchema.parse({
+		id: args.destinationId,
+		provider: "slack",
+		teamId: destination.teamId,
+		channelId: destination.channelId,
+		...source?.threadTs ? { threadTs: source.threadTs } : void 0
+	});
+}
+/** Read one complete Location from SQL. */
+function locationFromRow(value, row, sessionSource) {
+	if (value !== void 0 && value !== null) {
+		const location = locationSchema.parse(value);
+		const slackSource = !location.threadTs && sessionSource?.kind === "slack" && sessionSource.teamId === location.teamId && sessionSource.channelId === location.channelId ? sessionSource : void 0;
+		return slackSource?.threadTs ? {
+			...location,
+			threadTs: slackSource.threadTs
+		} : location;
+	}
+	if (!row || row.provider === "local") return;
+	if (row.provider !== "slack") throw new Error("Conversation Location provider is not supported");
+	const slackSource = sessionSource?.kind === "slack" && sessionSource.teamId === row.providerTenantId && sessionSource.channelId === row.providerDestinationId ? sessionSource : void 0;
+	return locationSchema.parse({
+		id: row.id,
+		provider: "slack",
+		teamId: row.providerTenantId,
+		channelId: row.providerDestinationId,
+		...slackSource?.threadTs ? { threadTs: slackSource.threadTs } : void 0
+	});
+}
+/** Read confirmed visibility from one linked Location row. */
+function visibilityFromLocationRow(row) {
+	if (!row) return;
+	if (row.visibility === "public" || row.visibility === "private") return row.visibility;
+}
+//#endregion
+//#region src/chat/conversations/sql/store.ts
+const CONVERSATION_MUTATION_LOCK_PREFIX = "junior_conversation";
+/** Serialize one conversation's durable mutations inside a SQL transaction. */
+async function withConversationMutationLock(executor, conversationId, callback) {
+	return await executor.withLock(`${CONVERSATION_MUTATION_LOCK_PREFIX}:${conversationId}`, async () => await executor.transaction(callback));
+}
+function now() {
+	return Date.now();
+}
+function dateFromMs(ms) {
+	return new Date(ms);
+}
+function msFromDate(value) {
+	if (value === null || value === void 0) return;
+	return (value instanceof Date ? value : new Date(value)).getTime();
+}
+function requiredMsFromDate(value) {
+	const ms = msFromDate(value);
+	if (typeof ms !== "number" || Number.isNaN(ms)) throw new Error("Conversation record timestamp is invalid");
+	return ms;
+}
+function tenantId(value) {
+	return value ?? "";
+}
+function sourceFromValue(value) {
+	if (value === "api" || value === "internal" || value === "local" || value === "plugin" || value === "resource_event" || value === "scheduler" || value === "slack" || value === "web") return value;
+}
+function originTypeFromSource(source) {
+	return source;
+}
+function localWorkspaceFromConversationId(conversationId) {
+	return /^local:([^:]+):/.exec(conversationId)?.[1];
+}
+function destinationUpsertFromDestination(args) {
+	const { destination } = args;
+	if (!destination) return;
+	if (destination.platform === "slack") {
+		const channelId = destination.channelId;
+		return {
+			kind: channelId.startsWith("D") ? "dm" : channelId.startsWith("G") ? "group" : "channel",
+			provider: "slack",
+			providerTenantId: destination.teamId,
+			providerDestinationId: channelId,
+			refreshVisibility: args.visibility !== void 0,
+			visibility: args.visibility ?? "unknown",
+			...args.channelName ? { displayName: args.channelName } : void 0,
+			metadata: { platform: "slack" }
+		};
+	}
+	return {
+		kind: "local_conversation",
+		provider: "local",
+		providerTenantId: localWorkspaceFromConversationId(destination.conversationId) ?? localWorkspaceFromConversationId(args.conversationId ?? ""),
+		providerDestinationId: destination.conversationId,
+		refreshVisibility: args.visibility !== void 0,
+		visibility: args.visibility ?? "direct",
+		metadata: { platform: "local" }
+	};
+}
+function executionStatusFromValue(value) {
+	if (value === "awaiting_resume" || value === "paused") return "paused";
+	if (value === "failed" || value === "idle" || value === "pending" || value === "running") return value;
+	throw new Error("Conversation record execution status is invalid");
+}
+function executionStatusToSql(status) {
+	return status === "paused" ? "awaiting_resume" : status;
+}
+function destinationFromRow(destination) {
+	return parseDestination(destination?.provider === "slack" ? {
+		platform: "slack",
+		teamId: destination.providerTenantId,
+		channelId: destination.providerDestinationId
+	} : destination?.provider === "local" ? {
+		platform: "local",
+		conversationId: destination.providerDestinationId
+	} : void 0);
+}
+/** Decode one SQL row and reject invalid durable conversation records. */
+function conversationFromRow(readRow) {
+	const row = readRow.conversation;
+	const visibility = visibilityFromLocationRow(readRow.destination);
+	if (row.schemaVersion !== 1) throw new Error("Conversation record schema version is invalid");
+	if (row.destination !== null && readRow.destination === null) throw new Error("Conversation legacy destination is not migrated");
+	if (row.actor !== null && readRow.actorIdentity === null) throw new Error("Conversation legacy actor is not migrated");
+	const destination = destinationFromRow(readRow.destination);
+	const actor = actorFromIdentityRow(readRow.actorIdentity, readRow.actorUserDisplayName);
+	if (readRow.destination !== null && !destination) throw new Error("Conversation record destination is invalid");
+	const source = row.source === void 0 || row.source === null ? void 0 : sourceFromValue(row.source);
+	if (row.source !== void 0 && row.source !== null && !source) throw new Error("Conversation record source is invalid");
+	const sessionSource = row.sessionSource === void 0 || row.sessionSource === null ? void 0 : parseSessionSource(row.sessionSource);
+	if (row.sessionSource !== void 0 && row.sessionSource !== null && !sessionSource) throw new Error("Conversation record session source is invalid");
+	const execution = {
+		status: executionStatusFromValue(row.executionStatus),
+		lastCheckpointAtMs: msFromDate(row.lastCheckpointAt),
+		lastEnqueuedAtMs: msFromDate(row.lastEnqueuedAt),
+		...row.runId ? { runId: row.runId } : void 0,
+		updatedAtMs: msFromDate(row.executionUpdatedAt) ?? requiredMsFromDate(row.updatedAt)
+	};
+	const location = locationFromRow(row.location, readRow.destination, sessionSource);
+	return {
+		schemaVersion: 1,
+		conversationId: row.conversationId,
+		createdAtMs: requiredMsFromDate(row.createdAt),
+		lastActivityAtMs: requiredMsFromDate(row.lastActivityAt),
+		updatedAtMs: requiredMsFromDate(row.updatedAt),
+		execution,
+		executionMetrics: {
+			durationMs: row.executionDurationMs,
+			...row.metricRunId ? { runId: row.metricRunId } : void 0,
+			...row.executionUsage ? { usage: row.executionUsage } : void 0
+		},
+		...row.parentConversationId ? { parentConversationId: row.parentConversationId } : void 0,
+		...destination ? { destination } : void 0,
+		...location ? { location } : void 0,
+		...actor ? { actor } : void 0,
+		...row.channelName ? { channelName: row.channelName } : void 0,
+		...source ? { source } : void 0,
+		...sessionSource ? { sessionSource } : void 0,
+		...row.title ? { title: row.title } : void 0,
+		...msFromDate(row.transcriptPurgedAt) !== void 0 ? { transcriptPurgedAtMs: msFromDate(row.transcriptPurgedAt) } : void 0,
+		...visibility ? { visibility } : void 0
+	};
+}
+function emptyConversation(args) {
+	return {
+		schemaVersion: 1,
+		conversationId: args.conversationId,
+		createdAtMs: args.nowMs,
+		lastActivityAtMs: args.nowMs,
+		updatedAtMs: args.nowMs,
+		...args.destination ? { destination: args.destination } : void 0,
+		...args.source ? { source: args.source } : void 0,
+		...args.sessionSource ? { sessionSource: args.sessionSource } : void 0,
+		execution: {
+			status: "idle",
+			updatedAtMs: args.nowMs
+		}
+	};
+}
+function assertSameConversationDestination(args) {
+	if (!args.current || sameDestination(args.current, args.next)) return;
+	throw new Error(`Conversation destination changed for ${args.conversationId}`);
+}
+function tokenTotal(usage) {
+	if (!usage) return 0;
+	if (usage.totalTokens !== void 0) return usage.totalTokens;
+	return (usage.inputTokens ?? 0) + (usage.outputTokens ?? 0) + (usage.cachedInputTokens ?? 0) + (usage.cacheCreationTokens ?? 0);
+}
+function updateConversationUsage(args) {
+	const usage = { totalTokens: tokenTotal(args.current) - tokenTotal(args.previousExecution) + tokenTotal(args.nextExecution) };
+	if (args.current?.reasoningTokens !== void 0 || args.previousExecution?.reasoningTokens !== void 0 || args.nextExecution.reasoningTokens !== void 0) usage.reasoningTokens = (args.current?.reasoningTokens ?? 0) - (args.previousExecution?.reasoningTokens ?? 0) + (args.nextExecution.reasoningTokens ?? 0);
+	const costFields = [
+		"input",
+		"output",
+		"cacheRead",
+		"cacheWrite",
+		"total"
+	];
+	const cost = {};
+	for (const field of costFields) {
+		if (args.current?.cost?.[field] === void 0 && args.previousExecution?.cost?.[field] === void 0 && args.nextExecution.cost?.[field] === void 0) continue;
+		cost[field] = Math.round(((args.current?.cost?.[field] ?? 0) - (args.previousExecution?.cost?.[field] ?? 0) + (args.nextExecution.cost?.[field] ?? 0)) * 0xe8d4a51000) / 0xe8d4a51000;
+	}
+	if (Object.keys(cost).length > 0) usage.cost = cost;
+	return usage;
+}
+var SqlStore = class {
+	executor;
+	constructor(executor) {
+		this.executor = executor;
+	}
+	async getConversationIdByProviderConversation(args) {
+		return await getConversationIdByProviderConversation(this.executor, args);
+	}
+	async bindProviderConversation(args) {
+		await bindProviderConversation(this.executor, args);
+	}
+	async createChild(args) {
+		const nowMs = args.nowMs ?? now();
+		await this.withConversationMutation(args.parentConversationId, async () => {
+			await this.withConversationMutation(args.childConversationId, async () => {
+				const existing = await this.get({ conversationId: args.childConversationId });
+				if (existing) {
+					if (existing.parentConversationId !== args.parentConversationId) throw new Error(`Conversation parent changed for ${args.childConversationId}`);
+					return;
+				}
+				const parent = await this.get({ conversationId: args.parentConversationId });
+				if (!parent) throw new Error(`Conversation parent is missing for ${args.childConversationId}`);
+				if (parent.parentConversationId) throw new Error("Recursive agent delegation is not enabled");
+				const child = {
+					...emptyConversation({
+						conversationId: args.childConversationId,
+						nowMs,
+						source: args.source
+					}),
+					parentConversationId: args.parentConversationId
+				};
+				await this.upsertConversation({ conversation: child });
+			});
+		});
+	}
+	async get(args) {
+		const row = await this.readConversationRow(args.conversationId);
+		if (!row) return;
+		return conversationFromRow(row);
+	}
+	async recordActivity(args) {
+		const nowMs = args.nowMs ?? now();
+		const activityAtMs = args.activityAtMs ?? nowMs;
+		const sessionSource = normalizeSessionSource(args.sessionSource);
+		await this.withConversationMutation(args.conversationId, async () => {
+			const existing = await this.get({ conversationId: args.conversationId });
+			if (existing && args.destination) assertSameConversationDestination({
+				conversationId: args.conversationId,
+				current: existing.destination,
+				next: args.destination
+			});
+			const current = existing ?? emptyConversation({
+				conversationId: args.conversationId,
+				destination: args.destination,
+				nowMs,
+				source: args.source,
+				...sessionSource ? { sessionSource } : void 0
+			});
+			const { sessionSource: _persistedSessionSource, visibility: _persistedVisibility, ...currentWithoutPersistedSignals } = current;
+			await this.upsertConversation({ conversation: {
+				...currentWithoutPersistedSignals,
+				destination: current.destination ?? args.destination,
+				source: current.source ?? args.source,
+				...sessionSource ? { sessionSource } : void 0,
+				channelName: current.channelName ?? args.channelName,
+				actor: mergeActor(current.actor, args.actor),
+				title: current.title ?? args.title,
+				lastActivityAtMs: Math.max(current.lastActivityAtMs, activityAtMs),
+				updatedAtMs: nowMs,
+				execution: {
+					...current.execution,
+					updatedAtMs: current.execution.updatedAtMs ?? nowMs
+				},
+				...args.visibility ? { visibility: args.visibility } : void 0
+			} });
+		});
+	}
+	async recordExecution(args) {
+		await this.withConversationMutation(args.conversationId, async () => {
+			const existingRow = await this.readConversationRow(args.conversationId);
+			const existing = existingRow ? conversationFromRow(existingRow) : void 0;
+			if (!existing && !args.destination) return;
+			const incomingIsFresh = (args.execution.updatedAtMs ?? args.updatedAtMs) >= (existing?.execution.updatedAtMs ?? existing?.updatedAtMs ?? 0);
+			const metricRunId = existingRow?.conversation.metricRunId;
+			const sameRun = Boolean(metricRunId) && metricRunId === args.execution.runId;
+			const execution = incomingIsFresh ? args.execution : existing?.execution ?? args.execution;
+			await this.upsertConversation({ conversation: {
+				schemaVersion: 1,
+				conversationId: args.conversationId,
+				createdAtMs: args.createdAtMs,
+				lastActivityAtMs: args.lastActivityAtMs,
+				updatedAtMs: args.updatedAtMs,
+				...existing?.parentConversationId ? { parentConversationId: existing.parentConversationId } : void 0,
+				...existing?.location ? { location: existing.location } : void 0,
+				...args.channelName ? { channelName: args.channelName } : void 0,
+				...args.destination ? { destination: args.destination } : void 0,
+				...args.actor ? { actor: args.actor } : void 0,
+				...args.source ? { source: args.source } : void 0,
+				...args.title ? { title: args.title } : void 0,
+				...args.visibility ? { visibility: args.visibility } : void 0,
+				execution
+			} });
+			if (incomingIsFresh && args.metrics) {
+				const row = existingRow?.conversation;
+				const usage = args.metrics.usage ? updateConversationUsage({
+					current: row?.usage ?? void 0,
+					previousExecution: sameRun ? row?.executionUsage ?? void 0 : void 0,
+					nextExecution: args.metrics.usage
+				}) : row?.usage ?? void 0;
+				await this.executor.db().update(juniorConversations).set({
+					durationMs: (row?.durationMs ?? 0) - (sameRun ? row?.executionDurationMs ?? 0 : 0) + args.metrics.durationMs,
+					usage: usage ?? null,
+					metricRunId: args.execution.runId ?? null,
+					executionDurationMs: args.metrics.durationMs,
+					executionUsage: args.metrics.usage ?? (sameRun ? row?.executionUsage ?? null : null)
+				}).where(eq(juniorConversations.conversationId, args.conversationId));
+			}
+		});
+	}
+	async listByActivity(args = {}) {
+		const rows = await this.executor.db().select({
+			conversation: conversationReadColumns(),
+			destination: juniorDestinations,
+			actorIdentity: juniorIdentities,
+			actorUserDisplayName: juniorUsers.displayName
+		}).from(juniorConversations).leftJoin(juniorDestinations, eq(juniorDestinations.id, juniorConversations.destinationId)).leftJoin(juniorIdentities, eq(juniorIdentities.id, juniorConversations.actorIdentityId)).leftJoin(juniorUsers, eq(juniorUsers.id, juniorIdentities.userId)).where(isNull(juniorConversations.parentConversationId)).orderBy(desc(juniorConversations.lastActivityAt), asc(juniorConversations.conversationId)).limit(Math.max(0, args.limit ?? 1e4)).offset(Math.max(0, args.offset ?? 0));
+		const conversations = [];
+		for (const row of rows) conversations.push(conversationFromRow(row));
+		return conversations;
+	}
+	async getDestinationVisibility(args) {
+		const row = (await this.executor.db().select({ visibility: juniorDestinations.visibility }).from(juniorDestinations).where(and(eq(juniorDestinations.provider, args.provider), eq(juniorDestinations.providerTenantId, tenantId(args.providerTenantId)), eq(juniorDestinations.providerDestinationId, args.providerDestinationId))))[0];
+		if (!row) return;
+		if (row.visibility === "public" || row.visibility === "private") return row.visibility;
+	}
+	async findSlackDestinationByName(args) {
+		const normalized = args.channelName.trim().replace(/^#/, "").toLowerCase();
+		if (!normalized) return;
+		const rows = await this.executor.db().select({
+			channelId: juniorDestinations.providerDestinationId,
+			channelName: juniorDestinations.displayName
+		}).from(juniorDestinations).where(and(eq(juniorDestinations.provider, "slack"), eq(juniorDestinations.providerTenantId, tenantId(args.teamId)), eq(juniorDestinations.kind, "channel"), sql`lower(ltrim(${juniorDestinations.displayName}, '#')) = ${normalized}`)).limit(2);
+		if (rows.length !== 1) return;
+		const row = rows[0];
+		if (!row?.channelId) return;
+		return {
+			channelId: row.channelId,
+			...row.channelName ? { channelName: row.channelName } : void 0
+		};
+	}
+	/** Serialize all durable mutations for one conversation inside a SQL transaction. */
+	async withConversationMutation(conversationId, callback) {
+		return await withConversationMutationLock(this.executor, conversationId, callback);
+	}
+	async readConversationRow(conversationId) {
+		return (await this.executor.db().select({
+			conversation: conversationReadColumns(),
+			destination: juniorDestinations,
+			actorIdentity: juniorIdentities,
+			actorUserDisplayName: juniorUsers.displayName
+		}).from(juniorConversations).leftJoin(juniorDestinations, eq(juniorDestinations.id, juniorConversations.destinationId)).leftJoin(juniorIdentities, eq(juniorIdentities.id, juniorConversations.actorIdentityId)).leftJoin(juniorUsers, eq(juniorUsers.id, juniorIdentities.userId)).where(eq(juniorConversations.conversationId, conversationId)))[0];
+	}
+	/** Upsert the conversation row while preserving previously discovered nullable metadata fields. */
+	async upsertConversation(args) {
+		const { conversation } = args;
+		if (!conversation.parentConversationId && !conversation.destination) {
+			if (!await this.get({ conversationId: conversation.conversationId })) throw new Error(`Conversation ${conversation.conversationId} requires a destination at create`);
+		}
+		const incomingExecutionVersion = sql`coalesce(excluded.execution_updated_at, excluded.updated_at)`;
+		const currentExecutionVersion = sql`coalesce(${juniorConversations.executionUpdatedAt}, ${juniorConversations.updatedAt})`;
+		const incomingExecutionIsFresh = sql`${incomingExecutionVersion} >= ${currentExecutionVersion}`;
+		const destinationId = await this.upsertDestination(destinationUpsertFromDestination({
+			channelName: conversation.channelName,
+			conversationId: conversation.conversationId,
+			destination: conversation.destination,
+			...conversation.visibility ? { visibility: conversation.visibility } : void 0
+		}), conversation.updatedAtMs);
+		const location = locationForWrite({
+			destination: conversation.destination,
+			destinationId,
+			location: conversation.location,
+			sessionSource: conversation.sessionSource
+		});
+		const actorIdentityObservation = actorIdentityForConversation(conversation);
+		const actorIdentity = actorIdentityObservation ? await upsertIdentity(this.executor, actorIdentityObservation, conversation.updatedAtMs) : void 0;
+		const rootConversationId = conversation.parentConversationId ? sql`(
+          select parent.root_conversation_id
+          from junior_conversations parent
+          where parent.conversation_id = ${conversation.parentConversationId}
+        )` : conversation.conversationId;
+		const row = (await this.executor.db().insert(juniorConversations).values({
+			conversationId: conversation.conversationId,
+			schemaVersion: 1,
+			source: conversation.source ?? null,
+			sessionSource: conversation.sessionSource ?? null,
+			originType: originTypeFromSource(conversation.source) ?? null,
+			originId: null,
+			originRunId: null,
+			location: location ?? null,
+			destinationId: destinationId ?? null,
+			destination: null,
+			actorIdentityId: actorIdentity?.id ?? null,
+			creatorIdentityId: null,
+			credentialSubjectIdentityId: null,
+			actor: null,
+			channelName: conversation.channelName ?? null,
+			title: conversation.title ?? null,
+			createdAt: dateFromMs(conversation.createdAtMs),
+			lastActivityAt: dateFromMs(conversation.lastActivityAtMs),
+			updatedAt: dateFromMs(conversation.updatedAtMs),
+			executionUpdatedAt: conversation.execution.updatedAtMs === void 0 ? null : dateFromMs(conversation.execution.updatedAtMs),
+			executionStatus: executionStatusToSql(conversation.execution.status),
+			runId: conversation.execution.runId ?? null,
+			lastCheckpointAt: conversation.execution.lastCheckpointAtMs === void 0 ? null : dateFromMs(conversation.execution.lastCheckpointAtMs),
+			lastEnqueuedAt: conversation.execution.lastEnqueuedAtMs === void 0 ? null : dateFromMs(conversation.execution.lastEnqueuedAtMs),
+			parentConversationId: conversation.parentConversationId ?? null,
+			rootConversationId
+		}).onConflictDoUpdate({
+			target: juniorConversations.conversationId,
+			set: {
+				source: sql`coalesce(${juniorConversations.source}, excluded.source)`,
+				sessionSource: sql`coalesce(${juniorConversations.sessionSource}, excluded.source_json)`,
+				originType: sql`coalesce(excluded.origin_type, ${juniorConversations.originType})`,
+				originId: sql`coalesce(excluded.origin_id, ${juniorConversations.originId})`,
+				originRunId: sql`coalesce(excluded.origin_run_id, ${juniorConversations.originRunId})`,
+				location: sql`coalesce(excluded.location_json, ${juniorConversations.location})`,
+				destinationId: sql`coalesce(excluded.destination_id, ${juniorConversations.destinationId})`,
+				actorIdentityId: sql`coalesce(excluded.actor_identity_id, ${juniorConversations.actorIdentityId})`,
+				creatorIdentityId: sql`coalesce(excluded.creator_identity_id, ${juniorConversations.creatorIdentityId})`,
+				credentialSubjectIdentityId: sql`coalesce(excluded.credential_subject_identity_id, ${juniorConversations.credentialSubjectIdentityId})`,
+				channelName: sql`coalesce(excluded.channel_name, ${juniorConversations.channelName})`,
+				title: sql`coalesce(excluded.title, ${juniorConversations.title})`,
+				createdAt: sql`least(${juniorConversations.createdAt}, excluded.created_at)`,
+				lastActivityAt: sql`greatest(${juniorConversations.lastActivityAt}, excluded.last_activity_at)`,
+				updatedAt: sql`greatest(${juniorConversations.updatedAt}, excluded.updated_at)`,
+				executionUpdatedAt: sql`case when ${incomingExecutionIsFresh} then excluded.execution_updated_at else ${juniorConversations.executionUpdatedAt} end`,
+				executionStatus: sql`case when ${incomingExecutionIsFresh} then excluded.execution_status else ${juniorConversations.executionStatus} end`,
+				runId: sql`case when ${incomingExecutionIsFresh} then excluded.run_id else ${juniorConversations.runId} end`,
+				lastCheckpointAt: sql`case when ${incomingExecutionIsFresh} then coalesce(excluded.last_checkpoint_at, ${juniorConversations.lastCheckpointAt}) else ${juniorConversations.lastCheckpointAt} end`,
+				lastEnqueuedAt: sql`case when ${incomingExecutionIsFresh} then coalesce(excluded.last_enqueued_at, ${juniorConversations.lastEnqueuedAt}) else ${juniorConversations.lastEnqueuedAt} end`,
+				rootConversationId: sql`coalesce(${juniorConversations.rootConversationId}, excluded.root_conversation_id)`
+			}
+		}).returning({
+			actorIdentityId: juniorConversations.actorIdentityId,
+			parentConversationId: juniorConversations.parentConversationId,
+			rootConversationId: juniorConversations.rootConversationId
+		}))[0];
+		if (!row?.rootConversationId) throw new Error("Conversation parent is missing its persisted root");
+		if (row.actorIdentityId && row.parentConversationId === null) await recordConversationParticipant(this.executor, {
+			actorIdentityId: row.actorIdentityId,
+			conversationId: conversation.conversationId,
+			atMs: conversation.lastActivityAtMs
+		});
+	}
+	async upsertDestination(destination, nowMs) {
+		if (!destination) return;
+		const visibilityUpdate = destination.refreshVisibility ? sql`excluded.visibility` : juniorDestinations.visibility;
+		return (await this.executor.db().insert(juniorDestinations).values({
+			id: randomUUID(),
+			provider: destination.provider,
+			providerTenantId: tenantId(destination.providerTenantId),
+			providerDestinationId: destination.providerDestinationId,
+			kind: destination.kind,
+			parentDestinationId: null,
+			displayName: destination.displayName ?? null,
+			visibility: destination.visibility,
+			metadata: destination.metadata ?? null,
+			createdAt: dateFromMs(nowMs),
+			updatedAt: dateFromMs(nowMs)
+		}).onConflictDoUpdate({
+			target: [
+				juniorDestinations.provider,
+				juniorDestinations.providerTenantId,
+				juniorDestinations.providerDestinationId
+			],
+			set: {
+				kind: sql`excluded.kind`,
+				displayName: sql`coalesce(excluded.display_name, ${juniorDestinations.displayName})`,
+				visibility: visibilityUpdate,
+				metadata: sql`coalesce(excluded.metadata_json, ${juniorDestinations.metadata})`,
+				updatedAt: sql`excluded.updated_at`
+			}
+		}).returning({ id: juniorDestinations.id }))[0]?.id;
+	}
+};
+/** Create a SQL-backed conversation store. */
+function createSqlStore(executor) {
+	return new SqlStore(executor);
+}
+//#endregion
+//#region src/chat/conversations/sql/conversation-row.ts
+/**
+* Establish the conversation metadata row on first contact for content writes
+* (conversation events, visible transcript) that can land before activity has
+* created the row, and whose tables FK to it.
+*
+* First contact creates the row; every later content write advances the
+* activity clock so retention mirrors append-refresh semantics (each content
+* append refreshes the retention window). Background observations may opt out
+* and leave an existing row unchanged. The timestamp is content-intrinsic (the
+* first item's `createdAtMs`), and `greatest(...)` guarantees a backfilled or
+* imported historical write — which carries an old timestamp — can never
+* regress `last_activity_at`.
+*/
+async function ensureConversationRow(executor, conversationId, atMs, options = {}) {
+	const at = new Date(atMs);
+	const insert = executor.db().insert(juniorConversations).values({
+		conversationId,
+		createdAt: at,
+		lastActivityAt: at,
+		updatedAt: at,
+		executionStatus: "idle"
+	});
+	if (options.activity === "preserve") {
+		await insert.onConflictDoNothing({ target: juniorConversations.conversationId });
+		return;
+	}
+	await insert.onConflictDoUpdate({
+		target: juniorConversations.conversationId,
+		set: {
+			lastActivityAt: sql`greatest(${juniorConversations.lastActivityAt}, excluded.last_activity_at)`,
+			updatedAt: sql`greatest(${juniorConversations.updatedAt}, excluded.updated_at)`,
+			transcriptPurgedAt: null
+		}
+	});
+}
+//#endregion
+//#region src/chat/conversations/sql/event-actor.ts
+const SLACK_USER_ID_PATTERN = /^[UW][A-Z0-9]{5,}$/;
+function isRecord$1(value) {
+	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function readAuthor(meta) {
+	if (!isRecord$1(meta) || !isRecord$1(meta.author)) return {};
+	const author = meta.author;
+	return {
+		...typeof author.email === "string" ? { email: author.email } : void 0,
+		...typeof author.fullName === "string" ? { fullName: author.fullName } : void 0,
+		...typeof author.isBot === "boolean" ? { isBot: author.isBot } : void 0,
+		...typeof author.userId === "string" ? { userId: author.userId } : void 0,
+		...typeof author.userName === "string" ? { userName: author.userName } : void 0
+	};
+}
+async function loadConversationSlackTenantId(executor, conversationId) {
+	const [row] = await executor.db().select({
+		providerTenantId: juniorDestinations.providerTenantId,
+		sessionSource: juniorConversations.sessionSource
+	}).from(juniorConversations).leftJoin(juniorDestinations, eq(juniorDestinations.id, juniorConversations.destinationId)).where(eq(juniorConversations.conversationId, conversationId)).limit(1);
+	const destinationTenant = row?.providerTenantId?.trim();
+	if (destinationTenant) return destinationTenant;
+	const sessionSource = parseSessionSource(row?.sessionSource);
+	if (sessionSource?.kind === "slack") return sessionSource.teamId;
+}
+async function findIdentityIdByProviderSubject(executor, args) {
+	return (await executor.db().select({ id: juniorIdentities.id }).from(juniorIdentities).where(and(eq(juniorIdentities.provider, args.provider), eq(juniorIdentities.providerSubjectId, args.providerSubjectId), args.providerTenantId === void 0 ? void 0 : eq(juniorIdentities.providerTenantId, args.providerTenantId))).limit(1))[0]?.id;
+}
+async function findJuniorIdentityIdByEmail(executor, email) {
+	const normalized = email.trim().toLowerCase();
+	if (!normalized) return void 0;
+	return (await executor.db().select({ id: juniorIdentities.id }).from(juniorIdentities).where(and(eq(juniorIdentities.provider, "junior"), eq(juniorIdentities.kind, "user"), or(eq(juniorIdentities.providerSubjectId, normalized), and(eq(juniorIdentities.emailNormalized, normalized), eq(juniorIdentities.emailVerified, true))))).limit(1))[0]?.id;
+}
+/**
+* Resolve a dashboard:<hash> author against junior identities keyed by email.
+* Web actors store userId as dashboard:${sha256(email).slice(0,24)} while the
+* durable identity subject remains the verified email.
+*/
+async function findJuniorIdentityIdByDashboardAuthorId(executor, dashboardAuthorId) {
+	if (!dashboardAuthorId.startsWith("dashboard:")) return;
+	return (await executor.db().select({ id: juniorIdentities.id }).from(juniorIdentities).where(and(eq(juniorIdentities.provider, "junior"), eq(juniorIdentities.kind, "user"), eq(juniorIdentities.emailVerified, true), sql`${juniorIdentities.emailNormalized} is not null`, sql`concat(
+          'dashboard:',
+          left(encode(digest(${juniorIdentities.emailNormalized}, 'sha256'), 'hex'), 24)
+        ) = ${dashboardAuthorId}`)).limit(1))[0]?.id;
+}
+/**
+* Resolve the durable actor identity for one event payload.
+* Human user messages get an identity when author data is enough; other events
+* keep a null actor.
+*/
+async function resolveEventActorIdentityId(executor, args) {
+	const data = args.data;
+	if (data.type !== "message" && data.type !== "message_updated") return;
+	if (typeof data.authorIdentityId === "string" && data.authorIdentityId) return data.authorIdentityId;
+	if (data.role !== "user") return;
+	const author = readAuthor(data.meta);
+	if (author.isBot === true) return;
+	const userId = parseActorUserId(author.userId);
+	if (!userId) return;
+	if (SLACK_USER_ID_PATTERN.test(userId)) {
+		const tenantId = await loadConversationSlackTenantId(executor, args.conversationId);
+		const observation = {
+			kind: "user",
+			provider: "slack",
+			providerSubjectId: userId,
+			...tenantId ? { providerTenantId: tenantId } : void 0,
+			...author.fullName ? { displayName: author.fullName } : void 0,
+			...author.userName ? { handle: author.userName } : void 0,
+			...author.email ? {
+				email: author.email,
+				emailVerified: true
+			} : void 0
+		};
+		if (tenantId) return (await upsertIdentity(executor, observation, args.nowMs)).id;
+		return await findIdentityIdByProviderSubject(executor, {
+			provider: "slack",
+			providerSubjectId: userId
+		}) ?? void 0;
+	}
+	const email = typeof author.email === "string" && author.email.includes("@") ? author.email.trim().toLowerCase() : userId.includes("@") ? userId.trim().toLowerCase() : void 0;
+	if (email) return (await upsertIdentity(executor, {
+		kind: "user",
+		provider: "junior",
+		providerSubjectId: email,
+		email,
+		emailVerified: true,
+		...author.fullName ? { displayName: author.fullName } : void 0,
+		metadata: { platform: "web" }
+	}, args.nowMs)).id;
+	if (userId.startsWith("dashboard:")) return findJuniorIdentityIdByDashboardAuthorId(executor, userId);
+	return findJuniorIdentityIdByEmail(executor, userId);
+}
+/** Drop payload-only authorIdentityId after lifting it onto the event column. */
+function stripPayloadAuthorIdentityId(data) {
+	if (data.type !== "message" && data.type !== "message_updated" || data.authorIdentityId === void 0) return data;
+	const { authorIdentityId: _authorIdentityId, ...rest } = data;
+	return rest;
+}
+//#endregion
+//#region src/db/postgres-json.ts
+/**
+* Replace actual NUL characters that PostgreSQL cannot store in JSONB.
+* Literal `\\u0000` text is preserved because it contains no NUL character.
+*/
+function sanitizePostgresJson(value) {
+	if (typeof value === "string") return value.replaceAll("\0", " ");
+	if (Array.isArray(value)) return value.map((item) => sanitizePostgresJson(item));
+	if (value === null || typeof value !== "object") return value;
+	const prototype = Object.getPrototypeOf(value);
+	if (prototype !== Object.prototype && prototype !== null) return value;
+	return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, sanitizePostgresJson(item)]));
+}
+//#endregion
+//#region src/chat/conversations/sql/event-lock.ts
+/** Serialize event sequence allocation with other conversation writes. */
+async function withConversationEventLock(executor, conversationId, callback) {
+	return executor.withLock(`junior_conversation:${conversationId}`, callback);
+}
+//#endregion
+//#region src/chat/conversations/sql/history.ts
+const messageHistoryEventTypes = [
+	"message",
+	"message_updated",
+	"message_handled"
+];
+const HUMAN_INSTRUCTION_PLATFORMS = /* @__PURE__ */ new Set([
+	"slack",
+	"local",
+	"web"
+]);
+/**
+* Whether one event should restore an archived conversation to the feed.
+*
+* Archive hides finished noise until a human comes back. Resource events,
+* turn lifecycle, compaction, and other system writes may still refresh
+* activity clocks, but they must not unarchive on their own.
+*/
+function eventUnarchivesConversation(data) {
+	if (data.type === "user_message") {
+		const provenance = data.provenance;
+		if (provenance.authority !== "instruction") return false;
+		const platform = provenance.actor?.platform;
+		return platform === void 0 || HUMAN_INSTRUCTION_PLATFORMS.has(platform);
+	}
+	if (data.type !== "message") return false;
+	if (data.role !== "user") return false;
+	const meta = data.meta;
+	if (!meta) return true;
+	if (typeof meta.eventType === "string" && meta.eventType.length > 0) return false;
+	const author = meta.author;
+	if (author && typeof author === "object" && !Array.isArray(author) && author.isBot === true) return false;
+	return true;
+}
+/** Split validated event data into column-lifted and JSON payload fields. */
+function insertFromEvent(conversationId, seq, historyVersion, event, actorIdentityId) {
+	const stripped = stripPayloadAuthorIdentityId(event.data);
+	const { type, ...payload } = conversationEventDataSchema.parse(stripped);
+	return {
+		conversationId,
+		seq,
+		historyVersion,
+		schemaVersion: 1,
+		idempotencyKey: event.idempotencyKey ?? null,
+		type,
+		payload: sanitizePostgresJson(payload),
+		actorIdentityId: actorIdentityId ?? null,
+		createdAt: new Date(event.createdAtMs)
+	};
+}
+/** Parse one physical event row into the storage-compatible domain envelope. */
+function eventFromRow(row) {
+	const payload = row.actorIdentityId && typeof row.payload === "object" && row.payload !== null && !Array.isArray(row.payload) && (row.type === "message" || row.type === "message_updated") && !("authorIdentityId" in row.payload) ? {
+		...row.payload,
+		authorIdentityId: row.actorIdentityId
+	} : row.payload;
+	return decodeStoredConversationEvent({
+		schemaVersion: row.schemaVersion,
+		seq: row.seq,
+		historyVersion: row.historyVersion,
+		...row.idempotencyKey ? { idempotencyKey: row.idempotencyKey } : void 0,
+		createdAtMs: row.createdAt.getTime(),
+		type: row.type,
+		payload
+	});
+}
+/** Decode the summary row that defines a readable message-history suffix. */
+function messagesSummarizedEventFromRow(row) {
+	const event = eventFromRow(row);
+	if (event.schemaVersion !== 1 || event.data.type !== "messages_summarized") throw new Error("Message compaction row did not decode as messages_summarized");
+	return {
+		...event,
+		schemaVersion: 1,
+		data: event.data
+	};
+}
+var SqlConversationEventStore = class {
+	executor;
+	constructor(executor) {
+		this.executor = executor;
+	}
+	async append(conversationId, events, options = {}) {
+		const parsed = events.map((event) => newConversationEventSchema.parse(event));
+		if (parsed.length === 0) return [];
+		return withConversationEventLock(this.executor, conversationId, async () => {
+			const existingKeys = parsed.map((event) => event.idempotencyKey).filter((key) => key !== void 0);
+			const persistedKeys = existingKeys.length === 0 ? /* @__PURE__ */ new Set() : new Set((await this.executor.db().select({ key: juniorConversationEvents.idempotencyKey }).from(juniorConversationEvents).where(and(eq(juniorConversationEvents.conversationId, conversationId), inArray(juniorConversationEvents.idempotencyKey, existingKeys)))).flatMap((row) => row.key ? [row.key] : []));
+			const acceptedKeys = new Set(persistedKeys);
+			const pending = parsed.filter((event) => {
+				if (event.idempotencyKey === void 0) return true;
+				if (acceptedKeys.has(event.idempotencyKey)) return false;
+				acceptedKeys.add(event.idempotencyKey);
+				return true;
+			});
+			if (pending.length === 0) return [];
+			const newestCreatedAtMs = Math.max(...pending.map((event) => event.createdAtMs));
+			await ensureConversationRow(this.executor, conversationId, newestCreatedAtMs, options);
+			const cursor = await this.readCursor(conversationId);
+			const historyVersion = cursor.maxHistoryVersion ?? 0;
+			let seq = cursor.nextSeq;
+			const rows = [];
+			for (const event of pending) {
+				const actorIdentityId = await resolveEventActorIdentityId(this.executor, {
+					conversationId,
+					data: event.data,
+					nowMs: event.createdAtMs
+				});
+				rows.push(insertFromEvent(conversationId, seq++, historyVersion, event, actorIdentityId));
+				if (actorIdentityId) await recordConversationParticipant(this.executor, {
+					actorIdentityId,
+					conversationId,
+					atMs: event.createdAtMs,
+					restoreArchive: eventUnarchivesConversation(event.data)
+				});
+			}
+			await this.executor.db().insert(juniorConversationEvents).values(rows);
+			return rows.map((row) => ({
+				seq: row.seq,
+				historyVersion: row.historyVersion
+			}));
+		});
+	}
+	async replaceHistory(conversationId, replacement) {
+		const parsed = historyReplacementSchema.parse(replacement);
+		await withConversationEventLock(this.executor, conversationId, async () => {
+			await ensureConversationRow(this.executor, conversationId, Date.now());
+			const cursor = await this.readCursor(conversationId);
+			const historyVersion = (cursor.maxHistoryVersion ?? 0) + 1;
+			await this.executor.db().insert(juniorConversationEvents).values(insertFromEvent(conversationId, cursor.nextSeq, historyVersion, parsed));
+		});
+	}
+	async loadCurrentHistoryVersion(conversationId) {
+		return (await this.readCursor(conversationId)).maxHistoryVersion ?? 0;
+	}
+	async loadCurrentHistory(conversationId) {
+		const cursor = await this.readCursor(conversationId);
+		if (cursor.maxHistoryVersion === null) return [];
+		return (await this.executor.db().select().from(juniorConversationEvents).where(and(eq(juniorConversationEvents.conversationId, conversationId), eq(juniorConversationEvents.historyVersion, cursor.maxHistoryVersion))).orderBy(asc(juniorConversationEvents.seq))).map(eventFromRow);
+	}
+	async loadByIdempotencyKey(conversationId, idempotencyKey) {
+		const [row] = await this.executor.db().select().from(juniorConversationEvents).where(and(eq(juniorConversationEvents.conversationId, conversationId), eq(juniorConversationEvents.idempotencyKey, idempotencyKey))).limit(1);
+		return row ? eventFromRow(row) : void 0;
+	}
+	async loadHistoryContaining(conversationId, seq, throughSeq) {
+		const [boundary] = await this.executor.db().select({ historyVersion: juniorConversationEvents.historyVersion }).from(juniorConversationEvents).where(and(eq(juniorConversationEvents.conversationId, conversationId), eq(juniorConversationEvents.seq, seq))).limit(1);
+		if (!boundary) return void 0;
+		return (await this.executor.db().select().from(juniorConversationEvents).where(and(eq(juniorConversationEvents.conversationId, conversationId), eq(juniorConversationEvents.historyVersion, boundary.historyVersion), throughSeq === void 0 ? void 0 : lte(juniorConversationEvents.seq, throughSeq))).orderBy(asc(juniorConversationEvents.seq))).map(eventFromRow);
+	}
+	async loadLatestStructuredEvent(conversationId, namespace, name) {
+		const [row] = await this.executor.db().select().from(juniorConversationEvents).where(and(eq(juniorConversationEvents.conversationId, conversationId), eq(juniorConversationEvents.type, "structured_event"), sql`${juniorConversationEvents.payload}->>'namespace' = ${namespace}`, sql`${juniorConversationEvents.payload}->>'name' = ${name}`)).orderBy(desc(juniorConversationEvents.seq)).limit(1);
+		return row ? eventFromRow(row) : void 0;
+	}
+	async loadLatestInstruction(conversationId) {
+		const [row] = await this.executor.db().select().from(juniorConversationEvents).where(and(eq(juniorConversationEvents.conversationId, conversationId), eq(juniorConversationEvents.type, "user_message"), sql`${juniorConversationEvents.payload}->'provenance'->>'authority' = 'instruction'`)).orderBy(desc(juniorConversationEvents.seq)).limit(1);
+		return row ? eventFromRow(row) : void 0;
+	}
+	async loadMessageHistory(conversationId) {
+		const [compactionRow] = await this.executor.db().select().from(juniorConversationEvents).where(and(eq(juniorConversationEvents.conversationId, conversationId), eq(juniorConversationEvents.type, "messages_summarized"))).orderBy(desc(juniorConversationEvents.seq)).limit(1);
+		const compaction = compactionRow ? messagesSummarizedEventFromRow(compactionRow) : void 0;
+		const historyFromSeq = compaction?.data.historyFromSeq ?? 0;
+		return {
+			events: (await this.executor.db().select().from(juniorConversationEvents).where(and(eq(juniorConversationEvents.conversationId, conversationId), inArray(juniorConversationEvents.type, messageHistoryEventTypes), gte(juniorConversationEvents.seq, historyFromSeq))).orderBy(asc(juniorConversationEvents.seq))).map(eventFromRow),
+			compaction,
+			historyFromSeq
+		};
+	}
+	async loadHistory(conversationId) {
+		return (await this.executor.db().select().from(juniorConversationEvents).where(eq(juniorConversationEvents.conversationId, conversationId)).orderBy(asc(juniorConversationEvents.seq))).map(eventFromRow);
+	}
+	async query(conversationId, query) {
+		if (query.limit < 1) throw new Error("Conversation event query limit must be at least 1");
+		if (query.afterSeq !== void 0 && query.beforeSeq !== void 0 && query.afterSeq >= query.beforeSeq) return {
+			events: [],
+			hasOlder: false,
+			hasNewer: false
+		};
+		const typeFilter = query.types && query.types.length > 0 ? inArray(juniorConversationEvents.type, [...query.types]) : void 0;
+		const bounds = and(eq(juniorConversationEvents.conversationId, conversationId), query.afterSeq === void 0 ? void 0 : gt(juniorConversationEvents.seq, query.afterSeq), query.beforeSeq === void 0 ? void 0 : lt(juniorConversationEvents.seq, query.beforeSeq), typeFilter);
+		const newestFirst = query.afterSeq === void 0;
+		const rows = await this.executor.db().select().from(juniorConversationEvents).where(bounds).orderBy(newestFirst ? desc(juniorConversationEvents.seq) : asc(juniorConversationEvents.seq)).limit(query.limit + 1);
+		const overflow = rows.length > query.limit;
+		const pageRows = overflow ? rows.slice(0, query.limit) : rows;
+		const events = (newestFirst ? [...pageRows].reverse() : pageRows).map(eventFromRow);
+		if (events.length === 0) return {
+			events,
+			hasOlder: false,
+			hasNewer: false
+		};
+		const firstSeq = events[0].seq;
+		const lastSeq = events[events.length - 1].seq;
+		return {
+			events,
+			hasOlder: newestFirst && overflow ? true : await this.hasMatchingEvent({
+				conversationId,
+				beforeSeq: firstSeq,
+				typeFilter
+			}),
+			hasNewer: !newestFirst && overflow ? true : await this.hasMatchingEvent({
+				conversationId,
+				afterSeq: lastSeq,
+				typeFilter
+			})
+		};
+	}
+	/** Return whether any matching event exists inside the exclusive seq window. */
+	async hasMatchingEvent(args) {
+		if (args.afterSeq !== void 0 && args.beforeSeq !== void 0 && args.afterSeq >= args.beforeSeq) return false;
+		const [row] = await this.executor.db().select({ seq: juniorConversationEvents.seq }).from(juniorConversationEvents).where(and(eq(juniorConversationEvents.conversationId, args.conversationId), args.afterSeq === void 0 ? void 0 : gt(juniorConversationEvents.seq, args.afterSeq), args.beforeSeq === void 0 ? void 0 : lt(juniorConversationEvents.seq, args.beforeSeq), args.typeFilter)).limit(1);
+		return row !== void 0;
+	}
+	/** Read the next sequence and active model-history version. */
+	async readCursor(conversationId) {
+		const rows = await this.executor.db().select({
+			maxSeq: sql`max(${juniorConversationEvents.seq})`,
+			maxHistoryVersion: sql`max(${juniorConversationEvents.historyVersion})`
+		}).from(juniorConversationEvents).where(eq(juniorConversationEvents.conversationId, conversationId));
+		const maxSeq = rows[0]?.maxSeq;
+		const maxHistoryVersion = rows[0]?.maxHistoryVersion;
+		return {
+			maxHistoryVersion: maxHistoryVersion === null || maxHistoryVersion === void 0 ? null : Number(maxHistoryVersion),
+			nextSeq: maxSeq === null || maxSeq === void 0 ? 0 : Number(maxSeq) + 1
+		};
+	}
+};
+/** Create a SQL-backed canonical conversation event store. */
+function createSqlConversationEventStore(executor) {
+	return new SqlConversationEventStore(executor);
+}
+//#endregion
+//#region src/chat/conversations/sql/message-search.ts
+const EXCERPT_WITHOUT_QUERY_CHARS = 240;
+var SqlConversationMessageSearchStore = class {
+	executor;
+	constructor(executor) {
+		this.executor = executor;
+	}
+	async search(args) {
+		const db = this.executor.db();
+		const query = args.filters.query?.trim() || void 0;
+		const text = sql`${juniorConversationEvents.payload}->>'text'`;
+		const role = sql`${juniorConversationEvents.payload}->>'role'`;
+		const messageId = sql`${juniorConversationEvents.payload}->>'messageId'`;
+		const tsquery = query ? sql`websearch_to_tsquery('english', ${query})` : void 0;
+		const rank = tsquery ? sql`ts_rank_cd(to_tsvector('english', ${text}), ${tsquery})` : sql`1`;
+		const excerpt = tsquery ? sql`ts_headline('english', ${text}, ${tsquery}, 'MaxFragments=2, MinWords=8, MaxWords=40, FragmentDelimiter=" … ", StartSel=**, StopSel=**')` : sql`left(${text}, ${EXCERPT_WITHOUT_QUERY_CHARS})`;
+		const conditions = [
+			eq(juniorConversations.source, "slack"),
+			isNull(juniorConversations.parentConversationId),
+			isNull(juniorConversations.transcriptPurgedAt),
+			ne(juniorConversations.conversationId, args.currentConversationId),
+			eq(juniorDestinations.provider, args.scope.provider),
+			eq(juniorDestinations.providerTenantId, args.scope.providerTenantId),
+			eq(juniorDestinations.visibility, "public"),
+			eq(juniorConversationEvents.type, "message"),
+			sql`${role} in ('user', 'assistant')`
+		];
+		if (tsquery) conditions.push(sql`to_tsvector('english', ${text}) @@ ${tsquery}`);
+		if (args.filters.channelId) conditions.push(eq(juniorDestinations.providerDestinationId, args.filters.channelId));
+		if (args.filters.afterMs !== void 0 && Number.isFinite(args.filters.afterMs)) conditions.push(gte(juniorConversations.lastActivityAt, new Date(args.filters.afterMs)));
+		if (args.filters.beforeMs !== void 0 && Number.isFinite(args.filters.beforeMs)) conditions.push(lt(juniorConversations.lastActivityAt, new Date(args.filters.beforeMs)));
+		if (args.filters.annotation) {
+			const annotation = args.filters.annotation.toLowerCase();
+			const nestedAnnotationPrefix = `${annotation}#`;
+			conditions.push(sql`exists (
+          select 1
+          from ${juniorConversationAnnotations}
+          where ${and(eq(juniorConversationAnnotations.conversationId, juniorConversations.conversationId), sql`(
+              lower(${juniorConversationAnnotations.key}) = ${annotation}
+              or starts_with(
+                lower(${juniorConversationAnnotations.key}),
+                ${nestedAnnotationPrefix}
+              )
+            )`)}
+        )`);
+		}
+		const bestPerConversation = db.selectDistinctOn([juniorConversations.conversationId], {
+			channelName: juniorDestinations.displayName,
+			conversationId: juniorConversations.conversationId,
+			excerpt: excerpt.as("excerpt"),
+			lastActivityAt: juniorConversations.lastActivityAt,
+			messageCreatedAt: juniorConversationEvents.createdAt,
+			messageId: messageId.as("message_id"),
+			providerDestinationId: juniorDestinations.providerDestinationId,
+			rank: rank.as("rank"),
+			role: role.as("role")
+		}).from(juniorConversationEvents).innerJoin(juniorConversations, eq(juniorConversations.conversationId, juniorConversationEvents.conversationId)).innerJoin(juniorDestinations, eq(juniorDestinations.id, juniorConversations.destinationId)).where(and(...conditions)).orderBy(juniorConversations.conversationId, desc(rank), desc(juniorConversationEvents.createdAt)).as("best_conversation_matches");
+		return (await db.select().from(bestPerConversation).orderBy(desc(bestPerConversation.rank), desc(bestPerConversation.lastActivityAt), desc(bestPerConversation.messageCreatedAt)).limit(args.limit)).map((row) => ({
+			conversationId: row.conversationId,
+			excerpt: row.excerpt,
+			messageCreatedAtMs: row.messageCreatedAt.getTime(),
+			messageId: row.messageId,
+			providerDestinationId: row.providerDestinationId,
+			role: row.role,
+			...row.channelName ? { channelName: row.channelName } : void 0
+		}));
+	}
+};
+/** Create a SQL-backed public workspace message search store. */
+function createSqlConversationMessageSearchStore(executor) {
+	return new SqlConversationMessageSearchStore(executor);
+}
+//#endregion
+//#region src/chat/db.ts
+var db_exports = /* @__PURE__ */ __exportAll({
+	closeDb: () => closeDb,
+	getConversationEventStore: () => getConversationEventStore,
+	getConversationMessageSearchStore: () => getConversationMessageSearchStore,
+	getConversationStore: () => getConversationStore,
+	getDb: () => getDb,
+	getSqlExecutor: () => getSqlExecutor
+});
+let current;
+function createDb(args) {
+	return createJuniorSqlExecutor({
+		connectionString: args.databaseUrl,
+		driver: args.driver,
+		statementTimeoutMs: args.statementTimeoutMs
+	});
+}
+/** Return the process SQL executor for SQL-specific queries and transactions. */
+function getSqlExecutor() {
+	const { sql } = getChatConfig();
+	if (current?.databaseUrl !== sql.databaseUrl || current.driver !== sql.driver || current.statementTimeoutMs !== sql.statementTimeoutMs) {
+		if (current) {
+			const previous = current;
+			current = void 0;
+			previous.db.close().catch(() => void 0);
+		}
+		const db = createDb({
+			databaseUrl: sql.databaseUrl,
+			driver: sql.driver,
+			statementTimeoutMs: sql.statementTimeoutMs
+		});
+		current = {
+			databaseUrl: sql.databaseUrl,
+			driver: sql.driver,
+			statementTimeoutMs: sql.statementTimeoutMs,
+			db,
+			store: createSqlStore(db),
+			eventStore: createSqlConversationEventStore(db),
+			searchStore: createSqlConversationMessageSearchStore(db)
+		};
+	}
+	return current.db;
+}
+/** Return the process Drizzle database. */
+function getDb() {
+	return getSqlExecutor().db();
+}
+/** Return the SQL-backed conversation store. */
+function getConversationStore() {
+	getSqlExecutor();
+	return current.store;
+}
+/** Return the canonical SQL-backed conversation event store. */
+function getConversationEventStore() {
+	getSqlExecutor();
+	return current.eventStore;
+}
+/** Return the SQL-backed public provider-tenant conversation search store. */
+function getConversationMessageSearchStore() {
+	getSqlExecutor();
+	return current.searchStore;
+}
+/** Close the process SQL database when it has been opened. */
+async function closeDb() {
+	const previous = current;
+	current = void 0;
+	await previous?.db.close();
+}
+//#endregion
+//#region src/chat/plugins/annotations.ts
+function annotationFromRow(row) {
+	const parsed = conversationAnnotationInputSchema.safeParse(row.annotation);
+	if (!parsed.success) return void 0;
+	return {
+		...parsed.data,
+		plugin: row.plugin,
+		createdAt: row.createdAt.toISOString(),
+		updatedAt: row.updatedAt.toISOString()
+	};
+}
+function createPluginAnnotations(args) {
+	return {
+		async upsert(input) {
+			const annotation = conversationAnnotationInputSchema.parse(input);
+			const now = /* @__PURE__ */ new Date();
+			await args.db.insert(juniorConversationAnnotations).values({
+				annotation,
+				conversationId: args.conversationId,
+				createdAt: now,
+				key: annotation.key,
+				kind: annotation.kind,
+				plugin: args.plugin,
+				updatedAt: now
+			}).onConflictDoUpdate({
+				target: [
+					juniorConversationAnnotations.conversationId,
+					juniorConversationAnnotations.plugin,
+					juniorConversationAnnotations.kind,
+					juniorConversationAnnotations.key
+				],
+				set: {
+					annotation,
+					updatedAt: now
+				}
+			});
+		},
+		async remove(kind, key) {
+			await args.db.delete(juniorConversationAnnotations).where(and(eq(juniorConversationAnnotations.conversationId, args.conversationId), eq(juniorConversationAnnotations.plugin, args.plugin), eq(juniorConversationAnnotations.kind, kind), eq(juniorConversationAnnotations.key, key)));
+		},
+		async list() {
+			return (await listConversationAnnotations(args.db, args.conversationId)).filter((a) => a.plugin === args.plugin);
+		}
+	};
+}
+/** Load stored annotations for one conversation, newest update first. */
+async function listConversationAnnotations(db, conversationId) {
+	return (await listConversationAnnotationsById(db, [conversationId])).get(conversationId) ?? [];
+}
+/** Load stored annotations for a bounded set of conversations. */
+async function listConversationAnnotationsById(db, conversationIds) {
+	const byConversation = /* @__PURE__ */ new Map();
+	if (conversationIds.length === 0) return byConversation;
+	const rows = await db.select().from(juniorConversationAnnotations).where(inArray(juniorConversationAnnotations.conversationId, [...conversationIds])).orderBy(desc(juniorConversationAnnotations.updatedAt));
+	for (const row of rows) {
+		const annotation = annotationFromRow(row);
+		if (!annotation) continue;
+		const current = byConversation.get(row.conversationId);
+		if (current) current.push(annotation);
+		else byConversation.set(row.conversationId, [annotation]);
+	}
+	return byConversation;
+}
+//#endregion
+//#region src/chat/plugins/conversation-events.ts
+function registeredDefinition(plugin, value) {
+	return plugin.conversationEvents?.find((definition) => definition === value.definition);
+}
+/** Keep operation idempotency stable when a registered event schema advances. */
+function eventIdentityVersion(plugin, definition) {
+	let version = definition.version;
+	for (const candidate of plugin.conversationEvents ?? []) if (candidate.eventName === definition.eventName) version = Math.min(version, candidate.version);
+	return version;
+}
+/** Create a conversation-bound writer for one plugin operation. */
+function createPluginConversationEvents(args) {
+	return { async emit(value) {
+		const definition = registeredDefinition(args.plugin, value);
+		if (!definition) throw new Error(`Plugin "${args.plugin.manifest.name}" cannot emit an unregistered conversation event.`);
+		const content = definition.parse(value.data);
+		const identityVersion = eventIdentityVersion(args.plugin, definition);
+		await getConversationEventStore().append(args.conversationId, [{
+			createdAtMs: Date.now(),
+			idempotencyKey: `plugin:${args.plugin.manifest.name}:operation:${args.operationId}:event:${definition.eventName}@${identityVersion}`,
+			data: {
+				type: "structured_event",
+				namespace: args.plugin.manifest.name,
+				name: definition.eventName,
+				version: definition.version,
+				turnId: args.turnId,
+				content
+			}
+		}], { activity: "preserve" });
+	} };
+}
+/** Render a stored plugin event through its currently registered definition. */
+function renderPluginConversationEvent(args) {
+	const definition = getPlugins().find((candidate) => candidate.manifest.name === args.namespace)?.conversationEvents?.find((candidate) => candidate.eventName === args.name && candidate.version === args.version);
+	if (!definition) return void 0;
+	return definition.renderEvent(definition.parse(args.content));
+}
+//#endregion
+//#region src/chat/plugins/conversation-event-stats.ts
+const DAY_MS = 864e5;
+const costRowSchema = z.object({
+	costUsd: z.number().finite().nonnegative(),
+	date: z.string().regex(/^\d{4}-\d{2}-\d{2}(T\d{2})?$/),
+	events: z.number().int().nonnegative()
+}).strict();
+function startOfUtcDay(value) {
+	const date = new Date(value);
+	date.setUTCHours(0, 0, 0, 0);
+	return date;
+}
+function registeredEventName(plugin, eventName) {
+	if (!plugin.conversationEvents?.some((definition) => definition.eventName === eventName)) throw new TypeError(`Plugin "${plugin.manifest.name}" did not register event "${eventName}"`);
+	return eventName;
+}
+/** Create aggregate event-cost reads bound to one plugin's registered namespace. */
+function createPluginConversationEventStats(plugin, now = Date.now) {
+	return {
+		async costsByHour(input) {
+			const eventName = registeredEventName(plugin, input.eventName);
+			const hourCount = input.hours ?? 24;
+			const end = new Date(now());
+			end.setUTCMinutes(0, 0, 0);
+			const start = /* @__PURE__ */ new Date(end.getTime() - (hourCount - 1) * 60 * 60 * 1e3);
+			const endExclusive = new Date(end.getTime() + 36e5);
+			const date = sql`TO_CHAR(
+        ${juniorConversationEvents.createdAt} AT TIME ZONE 'UTC',
+        'YYYY-MM-DD"T"HH24'
+      )`;
+			const cost = sql`CASE
+        WHEN jsonb_typeof(${juniorConversationEvents.payload}->'content'->'costUsd') = 'number'
+          THEN (${juniorConversationEvents.payload}->'content'->>'costUsd')::double precision
+        ELSE 0
+      END`;
+			const rows = await getDb().select({
+				costUsd: sql`SUM(${cost})::double precision`.mapWith(Number),
+				date,
+				events: sql`COUNT(*)::integer`.mapWith(Number)
+			}).from(juniorConversationEvents).where(and(eq(juniorConversationEvents.type, "structured_event"), sql`${juniorConversationEvents.payload}->>'namespace' = ${plugin.manifest.name}`, sql`${juniorConversationEvents.payload}->>'name' = ${eventName}`, gte(juniorConversationEvents.createdAt, start), lt(juniorConversationEvents.createdAt, endExclusive))).groupBy(date);
+			const byHour = new Map(z.array(costRowSchema).parse(rows).map((row) => [row.date, row]));
+			return Array.from({ length: hourCount }, (_, index) => {
+				const key = new Date(start.getTime() + index * 60 * 60 * 1e3).toISOString().slice(0, 13);
+				return byHour.get(key) ?? {
+					costUsd: 0,
+					date: key,
+					events: 0
+				};
+			});
+		},
+		async costsByDay(input) {
+			const eventName = registeredEventName(plugin, input.eventName);
+			const end = startOfUtcDay(now());
+			const start = /* @__PURE__ */ new Date(end.getTime() - (input.days - 1) * DAY_MS);
+			const endExclusive = new Date(end.getTime() + DAY_MS);
+			const date = sql`TO_CHAR(
+        ${juniorConversationEvents.createdAt} AT TIME ZONE 'UTC',
+        'YYYY-MM-DD'
+      )`;
+			const cost = sql`CASE
+        WHEN jsonb_typeof(${juniorConversationEvents.payload}->'content'->'costUsd') = 'number'
+          THEN (${juniorConversationEvents.payload}->'content'->>'costUsd')::double precision
+        ELSE 0
+      END`;
+			const rows = await getDb().select({
+				costUsd: sql`SUM(${cost})::double precision`.mapWith(Number),
+				date,
+				events: sql`COUNT(*)::integer`.mapWith(Number)
+			}).from(juniorConversationEvents).where(and(eq(juniorConversationEvents.type, "structured_event"), sql`${juniorConversationEvents.payload}->>'namespace' = ${plugin.manifest.name}`, sql`${juniorConversationEvents.payload}->>'name' = ${eventName}`, gte(juniorConversationEvents.createdAt, start), lt(juniorConversationEvents.createdAt, endExclusive))).groupBy(date);
+			const byDate = new Map(z.array(costRowSchema).parse(rows).map((row) => [row.date, row]));
+			return Array.from({ length: input.days }, (_, index) => {
+				const date = new Date(start.getTime() + index * DAY_MS).toISOString().slice(0, 10);
+				return byDate.get(date) ?? {
+					costUsd: 0,
+					date,
+					events: 0
+				};
+			});
+		}
+	};
+}
+//#endregion
+//#region src/chat/plugins/logging.ts
+/** Create the host logger exposed to plugin hooks. */
+function createPluginLogger(plugin) {
+	return {
+		info(message, metadata) {
+			logInfo("plugin.log.info", {
+				"app.log.message": message,
+				"app.plugin.name": plugin,
+				...metadata
+			});
+		},
+		warn(message, metadata) {
+			logWarn("plugin.log.warn", {
+				"app.log.message": message,
+				"app.plugin.name": plugin,
+				...metadata
+			});
+		},
+		error(message, metadata) {
+			logException(new Error(message), "plugin.log.error", {
+				"app.plugin.name": plugin,
+				...metadata
+			});
+		}
+	};
+}
+//#endregion
+//#region src/chat/plugins/model.ts
+/** Create the host-owned structured model capability exposed to plugins. */
+function createPluginModel(pluginName, options = {}, runtime = {}) {
+	return { async completeObject(input) {
+		const modelId = options.structuredModelId ?? (options.structuredModel === "default" ? defaultModelId(botConfig) : botConfig.fastModelId);
+		const result = await completeObject({
+			modelId,
+			schema: input.schema,
+			prompt: input.prompt,
+			...input.system !== void 0 ? { system: input.system } : void 0,
+			...input.maxTokens !== void 0 ? { maxTokens: input.maxTokens } : void 0,
+			signal: runtime.signal,
+			promptName: `${pluginName}.structured_completion`,
+			metadata: {
+				pluginName,
+				pluginModelRole: "structured"
+			}
+		});
+		return {
+			object: result.object,
+			...result.costUsd !== void 0 ? { costUsd: result.costUsd } : void 0
+		};
+	} };
+}
+/** Create the host-owned embedding capability exposed to prompt hooks. */
+function createPluginEmbedder(pluginName, runtime = {}) {
+	return { async embedTexts(input) {
+		return await embedTexts({
+			modelId: botConfig.embeddingModelId,
+			texts: input.texts,
+			signal: runtime.signal,
+			metadata: {
+				pluginName,
+				pluginModelRole: "embedding"
+			}
+		});
+	} };
+}
+//#endregion
+//#region src/chat/plugins/state.ts
+const MAX_PLUGIN_STATE_KEY_LENGTH = 512;
+function hashKeyPart(value) {
+	return createHash("sha256").update(value).digest("hex").slice(0, 32);
+}
+function pluginStateKey(plugin, key) {
+	const pluginPrefix = `junior:${plugin}`;
+	if (key === pluginPrefix || key.startsWith(`${pluginPrefix}:`)) return key;
+	return `junior:plugin_state:${hashKeyPart(plugin)}:${hashKeyPart(key)}`;
+}
+function validatePluginStateKey(key) {
+	if (!key.trim()) throw new Error("Plugin state key is required");
+	if (key.length > MAX_PLUGIN_STATE_KEY_LENGTH) throw new Error("Plugin state key exceeds the maximum length");
+}
+/** Create a durable state namespace scoped to one plugin. */
+function createPluginState(plugin, adapter) {
+	const getAdapter = () => adapter ?? getStateAdapter();
+	return {
+		async delete(key) {
+			validatePluginStateKey(key);
+			const state = getAdapter();
+			await state.connect();
+			await state.delete(pluginStateKey(plugin, key));
+		},
+		async get(key) {
+			validatePluginStateKey(key);
+			const state = getAdapter();
+			await state.connect();
+			return await state.get(pluginStateKey(plugin, key)) ?? void 0;
+		},
+		async set(key, value, ttlMs) {
+			validatePluginStateKey(key);
+			const state = getAdapter();
+			await state.connect();
+			await state.set(pluginStateKey(plugin, key), value, ttlMs);
+		},
+		async setIfNotExists(key, value, ttlMs) {
+			validatePluginStateKey(key);
+			const state = getAdapter();
+			await state.connect();
+			return await state.setIfNotExists(pluginStateKey(plugin, key), value, ttlMs);
+		},
+		async withLock(key, ttlMs, callback) {
+			validatePluginStateKey(key);
+			const state = getAdapter();
+			await state.connect();
+			const lockKey = pluginStateKey(plugin, key);
+			const lock = await state.acquireLock(lockKey, ttlMs);
+			if (!lock) throw new Error(`Could not acquire plugin state lock for ${key}`);
+			try {
+				return await callback();
+			} finally {
+				await state.releaseLock(lock);
+			}
+		}
+	};
+}
+//#endregion
+//#region src/chat/slack/dashboard-link.ts
+let dashboardConversationLinkOptions;
+function withHttps(host) {
+	return /^https?:\/\//.test(host) ? host : `https://${host}`;
+}
+function stripTrailingSlashes(value) {
+	let end = value.length;
+	while (end > 1 && value.charCodeAt(end - 1) === 47) end -= 1;
+	return end === value.length ? value : value.slice(0, end);
+}
+function normalizeDashboardPath(path, fallback) {
+	const value = path?.trim() || fallback;
+	return stripTrailingSlashes(value.startsWith("/") ? value : `/${value}`);
+}
+function resolveDashboardBaseURL(config) {
+	const explicit = config.baseURL ?? process.env.JUNIOR_BASE_URL;
+	if (explicit?.trim()) return stripTrailingSlashes(withHttps(explicit.trim()));
+	const vercelProd = process.env.VERCEL_PROJECT_PRODUCTION_URL?.trim();
+	if (vercelProd) return stripTrailingSlashes(withHttps(vercelProd));
+	const vercelUrl = process.env.VERCEL_URL?.trim();
+	if (vercelUrl) return stripTrailingSlashes(withHttps(vercelUrl));
+	return "http://localhost:3000";
+}
+/** Configure core dashboard links used in Slack footers. */
+function setDashboardConversationLinkOptions(options) {
+	const previous = dashboardConversationLinkOptions;
+	dashboardConversationLinkOptions = options?.disabled ? void 0 : options;
+	return previous;
+}
+function resolveDashboardPath(segmentPath) {
+	if (!dashboardConversationLinkOptions) return;
+	const baseURL = resolveDashboardBaseURL(dashboardConversationLinkOptions);
+	const basePath = normalizeDashboardPath(dashboardConversationLinkOptions.basePath, "/");
+	return `${baseURL}${basePath === "/" ? segmentPath : `${basePath}${segmentPath}`}`;
+}
+/** Build the dashboard conversation URL when the core dashboard is enabled. */
+function getDashboardConversationLink(conversationId) {
+	return resolveDashboardPath(`/conversations/${encodeURIComponent(conversationId)}`);
+}
+/** Build the dashboard task detail URL when the core dashboard is enabled. */
+function getDashboardTaskLink(taskId) {
+	return resolveDashboardPath(`/tasks/${encodeURIComponent(taskId)}`);
+}
+//#endregion
+//#region src/chat/state/ttl.ts
+/** Retain expiring conversation/runtime state long enough for resume and dashboard history. */
+const JUNIOR_THREAD_STATE_TTL_MS = 6048e5;
+//#endregion
+//#region src/chat/resource-events/store.ts
+const RESOURCE_EVENT_PREFIX = "junior:resource_event_subscription:v5";
+const INDEX_LOCK_TTL_MS = 1e4;
+const SUBSCRIPTION_LOCK_TTL_MS = 1e4;
+const SUBSCRIPTION_LOCK_WAIT_MS = 1e4;
+const SUBSCRIPTION_LOCK_RETRY_MS = 25;
+const SUBSCRIPTION_LOCK_HEARTBEAT_MS = 3e3;
+const subscriptionStatusSchema = z.enum([
+	"active",
+	"cancelled",
+	"completed"
+]);
+const subscriptionIdIndexSchema = z.array(z.string().min(1));
+const subscriptionSchema = z.object({
+	conversationId: z.string().min(1),
+	createdAtMs: z.number().finite(),
+	events: z.array(resourceEventTypeSchema).min(1),
+	expiresAtMs: z.number().finite(),
+	id: z.string().min(1),
+	intent: z.string().min(1),
+	label: z.string().min(1),
+	match: resourceEventMatchSchema.optional(),
+	namespace: z.string().min(1),
+	identifier: z.string().min(1),
+	resourceType: z.string().min(1),
+	status: subscriptionStatusSchema,
+	updatedAtMs: z.number().finite()
+}).strict();
+function digest(value) {
+	return createHash("sha256").update(value).digest("hex").slice(0, 32);
+}
+function subscriptionKey(id) {
+	return `${RESOURCE_EVENT_PREFIX}:record:${id}`;
+}
+function subscriptionLockKey(id) {
+	return `${RESOURCE_EVENT_PREFIX}:lock:${id}`;
+}
+function resourceIndexKey(namespace, identifier) {
+	return `${RESOURCE_EVENT_PREFIX}:resource:${digest(`${namespace}\0${identifier}`)}`;
+}
+function conversationIndexKey(conversationId) {
+	return `${RESOURCE_EVENT_PREFIX}:conversation:${digest(conversationId)}`;
+}
+function indexLockKey(key) {
+	return `${key}:lock`;
+}
+async function sleep(ms) {
+	await new Promise((resolve) => {
+		setTimeout(resolve, ms).unref?.();
+	});
+}
+async function acquireSubscriptionLock(state, subscriptionId, waitDeadlineMs = Date.now() + SUBSCRIPTION_LOCK_WAIT_MS) {
+	while (true) {
+		const lock = await state.acquireLock(subscriptionLockKey(subscriptionId), SUBSCRIPTION_LOCK_TTL_MS);
+		if (lock) return lock;
+		if (Date.now() >= waitDeadlineMs) throw new Error(`Could not acquire resource event subscription lock for ${subscriptionId}`);
+		await sleep(SUBSCRIPTION_LOCK_RETRY_MS);
+	}
+}
+/** Run one subscription lifecycle transition while keeping its lease alive. */
+async function withSubscriptionLock(state, subscriptionId, callback, waitDeadlineMs) {
+	const lock = await acquireSubscriptionLock(state, subscriptionId, waitDeadlineMs);
+	let lockLostError;
+	let heartbeatError;
+	let heartbeat;
+	const timer = setInterval(() => {
+		if (heartbeat) return;
+		heartbeat = state.extendLock(lock, SUBSCRIPTION_LOCK_TTL_MS).then((extended) => {
+			if (extended) heartbeatError = void 0;
+			else lockLostError = /* @__PURE__ */ new Error(`Resource event subscription lock was lost for ${subscriptionId}`);
+		}).catch((error) => {
+			heartbeatError = error instanceof Error ? error : /* @__PURE__ */ new Error(`Failed to extend subscription lock: ${String(error)}`);
+		}).finally(() => {
+			heartbeat = void 0;
+		});
+	}, SUBSCRIPTION_LOCK_HEARTBEAT_MS);
+	timer.unref?.();
+	let result;
+	try {
+		result = await callback();
+	} finally {
+		clearInterval(timer);
+		await heartbeat;
+		await state.releaseLock(lock);
+	}
+	const lockError = lockLostError ?? heartbeatError;
+	if (lockError) throw lockError;
+	return result;
+}
+function ttlUntil(expiresAtMs, nowMs) {
+	return Math.max(1, expiresAtMs - nowMs);
+}
+async function readSubscriptionIdIndex(state, key) {
+	const value = await state.get(key);
+	if (value === void 0 || value === null) return [];
+	return subscriptionIdIndexSchema.parse(value);
+}
+function buildSubscriptionId(input) {
+	const eventKey = [...new Set(input.events)].sort().join("\0");
+	const matchKey = stableResourceEventMatchKey(input.match);
+	return `resub_${digest(matchKey ? `${input.namespace}\0${input.identifier}\0${input.conversationId}\0${eventKey}\0${matchKey}` : `${input.namespace}\0${input.identifier}\0${input.conversationId}\0${eventKey}`)}`;
+}
+async function withIndexLock(state, key, callback) {
+	const lock = await state.acquireLock(indexLockKey(key), INDEX_LOCK_TTL_MS);
+	if (!lock) throw new Error(`Could not acquire resource event index lock for ${key}`);
+	try {
+		return await callback();
+	} finally {
+		await state.releaseLock(lock);
+	}
+}
+async function addToIndex(state, key, subscriptionId, nowMs) {
+	await withIndexLock(state, key, async () => {
+		const ids = [...new Set(await readSubscriptionIdIndex(state, key))];
+		const next = ids.includes(subscriptionId) ? ids : [...ids, subscriptionId];
+		await state.set(key, next, await indexTtlMs(state, next, nowMs));
+	});
+}
+async function removeFromIndex(state, key, subscriptionId, nowMs) {
+	await withIndexLock(state, key, async () => {
+		const next = (await readSubscriptionIdIndex(state, key)).filter((id) => id !== subscriptionId);
+		await state.set(key, next, await indexTtlMs(state, next, nowMs));
+	});
+}
+async function indexTtlMs(state, subscriptionIds, nowMs) {
+	const records = await Promise.all(subscriptionIds.map(async (id) => parseSubscription(await state.get(subscriptionKey(id)))));
+	return ttlUntil(Math.max(nowMs, ...records.filter((record) => record !== void 0 && activeAt(record, nowMs)).map((record) => record.expiresAtMs)), nowMs);
+}
+function parseSubscription(value) {
+	if (value === void 0 || value === null) return;
+	return subscriptionSchema.parse(value);
+}
+function activeAt(subscription, nowMs) {
+	return subscription.status === "active" && subscription.expiresAtMs > nowMs;
+}
+function matchesEvent(subscription, input) {
+	return subscription.namespace === input.namespace && subscription.identifier === input.identifier && subscription.events.includes(input.eventType) && activeAt(subscription, input.nowMs) && resourceEventMatches(subscription.match, input.data);
+}
+/** Create or replace the active subscription for one conversation/resource/event set. */
+async function createResourceEventSubscription(input, options = {}) {
+	const state = options.state ?? getStateAdapter();
+	await state.connect();
+	const nowMs = options.nowMs ?? Date.now();
+	const events = [...new Set(input.events.map((event) => event.trim()))].filter(Boolean);
+	if (events.length === 0) throw new Error("Resource event subscription requires at least one event");
+	if (input.expiresAtMs <= nowMs) throw new Error("Resource event subscription expiry must be in the future");
+	const match = input.match && Object.keys(input.match).length > 0 ? input.match : void 0;
+	const id = buildSubscriptionId({
+		conversationId: input.conversationId,
+		events,
+		match,
+		namespace: input.namespace,
+		identifier: input.identifier
+	});
+	const record = {
+		conversationId: input.conversationId,
+		createdAtMs: nowMs,
+		events,
+		expiresAtMs: input.expiresAtMs,
+		id,
+		intent: input.intent,
+		label: input.label,
+		...match ? { match } : void 0,
+		namespace: input.namespace,
+		identifier: input.identifier,
+		resourceType: input.resourceType,
+		status: "active",
+		updatedAtMs: nowMs
+	};
+	const parsed = subscriptionSchema.parse(record);
+	await state.set(subscriptionKey(id), parsed, ttlUntil(parsed.expiresAtMs, nowMs));
+	await addToIndex(state, resourceIndexKey(input.namespace, input.identifier), id, nowMs);
+	await addToIndex(state, conversationIndexKey(input.conversationId), id, nowMs);
+	return parsed;
+}
+/** List active subscriptions bound to one conversation. */
+async function listResourceEventSubscriptions(input) {
+	const state = input.state ?? getStateAdapter();
+	await state.connect();
+	const nowMs = input.nowMs ?? Date.now();
+	const ids = await readSubscriptionIdIndex(state, conversationIndexKey(input.conversationId));
+	return (await Promise.all(ids.map(async (id) => parseSubscription(await state.get(subscriptionKey(id)))))).filter((record) => record !== void 0 && record.conversationId === input.conversationId && activeAt(record, nowMs)).sort((left, right) => left.createdAtMs - right.createdAtMs);
+}
+/** Cancel a current-conversation subscription and remove it from match indexes. */
+async function cancelResourceEventSubscription(input) {
+	const state = input.state ?? getStateAdapter();
+	await state.connect();
+	return await withSubscriptionLock(state, input.id, async () => {
+		const current = parseSubscription(await state.get(subscriptionKey(input.id)));
+		if (!current || current.conversationId !== input.conversationId) return;
+		const nowMs = input.nowMs ?? Date.now();
+		const next = {
+			...current,
+			status: "cancelled",
+			updatedAtMs: nowMs
+		};
+		await state.set(subscriptionKey(input.id), next, JUNIOR_THREAD_STATE_TTL_MS);
+		await removeFromIndex(state, resourceIndexKey(current.namespace, current.identifier), input.id, nowMs);
+		await removeFromIndex(state, conversationIndexKey(current.conversationId), input.id, nowMs);
+		return next;
+	});
+}
+/** Cancel every active resource event subscription bound to one conversation. */
+async function cancelSubscriptions(input) {
+	const subscriptions = await listResourceEventSubscriptions(input);
+	for (const subscription of subscriptions) await cancelResourceEventSubscription({
+		conversationId: input.conversationId,
+		id: subscription.id,
+		nowMs: input.nowMs,
+		state: input.state
+	});
+}
+/**
+* Collect match keys from active watches for these identifiers and event types.
+* Does not evaluate match values — only reports keys that filters use.
+*/
+async function collectResourceEventMatchKeys(input) {
+	const state = input.state ?? getStateAdapter();
+	await state.connect();
+	const nowMs = input.nowMs ?? Date.now();
+	const eventTypes = new Set(input.eventTypes.map((eventType) => eventType.trim()).filter(Boolean));
+	if (eventTypes.size === 0) return [];
+	const keys = /* @__PURE__ */ new Set();
+	const identifiers = new Set(input.identifiers.map((value) => value.trim()).filter(Boolean));
+	for (const identifier of identifiers) {
+		const ids = await readSubscriptionIdIndex(state, resourceIndexKey(input.namespace, identifier));
+		const records = await Promise.all(ids.map(async (id) => parseSubscription(await state.get(subscriptionKey(id)))));
+		for (const record of records) {
+			if (!record) continue;
+			if (record.namespace !== input.namespace) continue;
+			if (record.identifier !== identifier) continue;
+			if (!activeAt(record, nowMs)) continue;
+			if (!record.events.some((eventType) => eventTypes.has(eventType))) continue;
+			for (const key of Object.keys(record.match ?? {})) keys.add(key);
+		}
+	}
+	return [...keys].sort();
+}
+/** Find active subscriptions interested in a normalized resource event. */
+async function findMatchingResourceEventSubscriptions(input) {
+	const state = input.state ?? getStateAdapter();
+	await state.connect();
+	const nowMs = input.nowMs ?? Date.now();
+	const ids = await readSubscriptionIdIndex(state, resourceIndexKey(input.namespace, input.identifier));
+	return (await Promise.all(ids.map(async (id) => parseSubscription(await state.get(subscriptionKey(id)))))).filter((record) => record !== void 0 && matchesEvent(record, {
+		data: input.data,
+		eventType: input.eventType,
+		nowMs,
+		namespace: input.namespace,
+		identifier: input.identifier
+	}));
+}
+/** Recheck and deliver a matched subscription while holding its status lock. */
+async function deliverResourceEventSubscription(input) {
+	const state = input.state ?? getStateAdapter();
+	await state.connect();
+	return await withSubscriptionLock(state, input.subscription.id, async () => {
+		const nowMs = input.nowMs ?? Date.now();
+		const current = parseSubscription(await state.get(subscriptionKey(input.subscription.id)));
+		if (!current || !matchesEvent(current, {
+			data: input.data,
+			eventType: input.eventType,
+			nowMs,
+			namespace: input.namespace,
+			identifier: input.identifier
+		})) return false;
+		const delivered = await input.deliver(current);
+		if (input.terminal) {
+			const latest = parseSubscription(await state.get(subscriptionKey(current.id)));
+			if (!latest || latest.status !== current.status || latest.updatedAtMs !== current.updatedAtMs) return delivered;
+			const next = {
+				...current,
+				status: "completed",
+				updatedAtMs: nowMs
+			};
+			await state.set(subscriptionKey(current.id), next, JUNIOR_THREAD_STATE_TTL_MS);
+			await removeFromIndex(state, resourceIndexKey(current.namespace, current.identifier), current.id, nowMs);
+			await removeFromIndex(state, conversationIndexKey(current.conversationId), current.id, nowMs);
+		}
+		return delivered;
+	}, input.waitDeadlineMs);
+}
+//#endregion
+//#region src/chat/resource-events/tool-support.ts
+/** Default lifetime for temporary resource subscriptions. */
+const RESOURCE_SUBSCRIPTION_DEFAULT_TTL_MS = 12096e5;
+/** Hard upper bound for temporary resource subscriptions. */
+const RESOURCE_SUBSCRIPTION_MAX_TTL_MS = 2592e6;
+const STOP_WATCHING_TOOL_NAME = "stopWatchingResources";
+const RESOURCE_WATCH_TOOL_SOURCE = {
+	id: "resource-watches",
+	description: "Inspect or stop resource watches for the current conversation."
+};
+//#endregion
+//#region src/chat/slack/tool-support/context.ts
+/** Resolve Slack tool context from the Conversation Location. */
+function getSlackToolContext(context) {
+	const source = context.source.kind === "slack" ? context.source : void 0;
+	const location = context.location?.provider === "slack" ? context.location : source ? {
+		provider: "slack",
+		teamId: source.teamId,
+		channelId: source.channelId,
+		threadTs: source.threadTs
+	} : void 0;
+	if (!location) return void 0;
+	const destinationChannelId = parseSlackChannelReferenceId(context.destination.platform === "slack" ? context.destination.channelId : location.channelId);
+	const locationChannelId = parseSlackChannelReferenceId(location.channelId);
+	const teamId = parseSlackTeamId(location.teamId);
+	if (!destinationChannelId || !locationChannelId || !teamId) return;
+	return {
+		actor: context.actor?.platform === "slack" ? context.actor : void 0,
+		destinationChannelId,
+		locationChannelId,
+		messageChannelId: source ? parseSlackChannelReferenceId(source.channelId) : void 0,
+		messageTs: parseSlackMessageTs(source?.messageTs),
+		teamId,
+		threadTs: parseSlackMessageTs(location.threadTs)
+	};
+}
+//#endregion
+//#region src/chat/plugins/viewer.ts
+function identityFromRow(row) {
+	return identitySchema.parse({
+		id: row.id,
+		provider: row.provider,
+		providerSubjectId: row.providerSubjectId,
+		...row.providerTenantId ? { providerTenantId: row.providerTenantId } : void 0,
+		...row.displayName ? { displayName: row.displayName } : void 0,
+		...row.handle ? { handle: row.handle } : void 0
+	});
+}
+async function readUserById(db, userRow) {
+	const identityRows = await db.select().from(juniorIdentities).where(and(eq(juniorIdentities.userId, userRow.id), eq(juniorIdentities.kind, "user"))).orderBy(asc(juniorIdentities.provider), asc(juniorIdentities.providerTenantId), asc(juniorIdentities.providerSubjectId));
+	return userSchema.parse({
+		email: userRow.primaryEmail,
+		id: userRow.id,
+		identities: identityRows.map(identityFromRow),
+		...userRow.displayName ? { displayName: userRow.displayName } : void 0
+	});
+}
+/** Resolve or create the canonical user for one verified viewer email. */
+async function resolveViewerUserFromSql(db, email) {
+	const normalizedEmail = normalizeIdentityEmail(email);
+	if (!normalizedEmail) return void 0;
+	const now = /* @__PURE__ */ new Date();
+	const userRow = (await db.insert(juniorUsers).values({
+		id: randomUUID(),
+		primaryEmail: email.trim(),
+		primaryEmailNormalized: normalizedEmail,
+		displayName: null,
+		createdAt: now,
+		updatedAt: now
+	}).onConflictDoNothing({ target: juniorUsers.primaryEmailNormalized }).returning())[0] ?? (await db.select().from(juniorUsers).where(eq(juniorUsers.primaryEmailNormalized, normalizedEmail)).limit(1))[0];
+	return userRow ? await readUserById(db, userRow) : void 0;
+}
+/** Resolve or create the canonical user for one authenticated viewer. */
+async function resolveViewerUser(email) {
+	return await resolveViewerUserFromSql(getDb(), email);
+}
+/** Read one existing canonical user by verified email without creating a row. */
+async function findUserByEmailFromSql(db, email) {
+	const normalizedEmail = normalizeIdentityEmail(email);
+	if (!normalizedEmail) return void 0;
+	const userRow = (await db.select().from(juniorUsers).where(eq(juniorUsers.primaryEmailNormalized, normalizedEmail)).limit(1))[0];
+	return userRow ? await readUserById(db, userRow) : void 0;
+}
+/** Read one existing canonical user by verified email without creating a row. */
+async function findUserByEmail(email) {
+	return await findUserByEmailFromSql(getDb(), email);
+}
+/** Update one canonical user's display name in SQL. */
+async function updateViewerDisplayNameFromSql(db, userId, displayName) {
+	const userRow = (await db.update(juniorUsers).set({
+		displayName,
+		updatedAt: /* @__PURE__ */ new Date()
+	}).where(eq(juniorUsers.id, userId)).returning())[0];
+	return userRow ? await readUserById(db, userRow) : void 0;
+}
+/** Update one canonical user's display name. */
+async function updateViewerDisplayName(userId, displayName) {
+	return await updateViewerDisplayNameFromSql(getDb(), userId, displayName);
+}
+/** Resolve the stored identity and linked user for one runtime actor. */
+async function readActorIdentityFromSql(db, actor) {
+	if (actor.platform === "system") return void 0;
+	const providerTenantId = actor.platform === "slack" ? actor.teamId : "";
+	const row = (await db.select({
+		identity: juniorIdentities,
+		user: juniorUsers
+	}).from(juniorIdentities).leftJoin(juniorUsers, eq(juniorUsers.id, juniorIdentities.userId)).where(and(eq(juniorIdentities.kind, "user"), eq(juniorIdentities.provider, actor.platform), eq(juniorIdentities.providerTenantId, providerTenantId), eq(juniorIdentities.providerSubjectId, actor.userId))).limit(1))[0];
+	if (!row) return void 0;
+	return {
+		identity: identityFromRow(row.identity),
+		...row.user ? { user: await readUserById(db, row.user) } : void 0
+	};
+}
+/** Resolve the stored identity and linked user for one runtime actor. */
+async function readActorIdentity(actor) {
+	return await readActorIdentityFromSql(getDb(), actor);
+}
+//#endregion
+//#region src/chat/slack/workspace-context.ts
+const workspaceTeamIdStorage = new AsyncLocalStorage();
+/** Run a callback with the Slack workspace team ID for the inbound webhook. */
+function runWithWorkspaceTeamId(teamId, fn) {
+	if (!teamId) return fn();
+	return workspaceTeamIdStorage.run(teamId, fn);
+}
+/** Return the Slack workspace team ID for the current inbound webhook. */
+function getWorkspaceTeamId() {
+	return workspaceTeamIdStorage.getStore();
+}
+//#endregion
+//#region src/chat/slack/client.ts
+var SlackActionError = class extends Error {
+	code;
+	apiError;
+	needed;
+	provided;
+	statusCode;
+	requestId;
+	errorData;
+	retryAfterSeconds;
+	detail;
+	detailLine;
+	detailRule;
+	constructor(message, code, options = {}) {
+		super(message);
+		this.name = "SlackActionError";
+		this.code = code;
+		this.apiError = options.apiError;
+		this.needed = options.needed;
+		this.provided = options.provided;
+		this.statusCode = options.statusCode;
+		this.requestId = options.requestId;
+		this.errorData = options.errorData;
+		this.retryAfterSeconds = options.retryAfterSeconds;
+		this.detail = options.detail;
+		this.detailLine = options.detailLine;
+		this.detailRule = options.detailRule;
+	}
+};
+function serializeSlackErrorData(data) {
+	if (!data || typeof data !== "object") return;
+	const filtered = Object.fromEntries(Object.entries(data).filter(([key]) => key !== "error"));
+	if (Object.keys(filtered).length === 0) return;
+	try {
+		const serialized = JSON.stringify(filtered);
+		return serialized.length <= 600 ? serialized : `${serialized.slice(0, 597)}...`;
+	} catch {
+		return;
+	}
+}
+/** Extract a header value by case-insensitive name from a raw headers object. */
+function getHeaderString(headers, name) {
+	if (!headers || typeof headers !== "object") return;
+	const key = name.toLowerCase();
+	const entries = headers;
+	for (const [entryKey, value] of Object.entries(entries)) {
+		if (entryKey.toLowerCase() !== key) continue;
+		if (typeof value === "string") return value;
+		if (Array.isArray(value)) {
+			const first = value.find((entry) => typeof entry === "string");
+			return typeof first === "string" ? first : void 0;
+		}
+	}
+}
+function parseSlackCanvasDetail(detail) {
+	if (typeof detail !== "string") return {};
+	const trimmed = detail.trim();
+	if (!trimmed) return {};
+	const parsed = { detail: trimmed };
+	const lineMatch = trimmed.match(/line\s+(\d+):/i);
+	if (lineMatch) {
+		const line = Number.parseInt(lineMatch[1] ?? "", 10);
+		if (Number.isFinite(line)) parsed.detailLine = line;
+	}
+	if (/unsupported heading depth/i.test(trimmed)) parsed.detailRule = "unsupported_heading_depth";
+	return parsed;
+}
+/**
+* Ambient destination-installation token for Slack outbound calls, bound by
+* installation-scoped entry points so writes carry the destination
+* workspace's credentials instead of the process-global env token.
+*/
+const installationTokenStorage = new AsyncLocalStorage();
+const clientsByToken = /* @__PURE__ */ new Map();
+/**
+* Bind a workspace installation token for all Slack Web API calls inside
+* `fn`, so multi-workspace outbound writes use the destination workspace's
+* credentials rather than the env fallback token.
+*/
+function runWithSlackInstallationToken(token, fn) {
+	const trimmed = token.trim();
+	if (!trimmed) throw new SlackActionError("Slack installation token binding requires a non-empty token", "missing_token");
+	return installationTokenStorage.run({ token: trimmed }, fn);
+}
+/**
+* Token precedence: ambient installation token, then env token, then a hard
+* failure for team-scoped calls — a call scoped to one workspace must never
+* silently fall through to another workspace's credentials.
+*/
+function resolveSlackToken() {
+	const ambientToken = installationTokenStorage.getStore()?.token;
+	if (ambientToken) return ambientToken;
+	const envToken = getSlackBotToken();
+	if (envToken) return envToken;
+	const teamId = getWorkspaceTeamId();
+	if (teamId) throw new SlackActionError(`Slack call is scoped to workspace ${teamId} but no installation token is bound and no default bot token is configured`, "missing_token");
+	throw new SlackActionError("SLACK_BOT_TOKEN (or SLACK_BOT_USER_TOKEN) is required for Slack Web API actions in this service", "missing_token");
+}
+/** Normalize Junior Slack references to native Slack conversation IDs. */
+function normalizeSlackConversationId(channelId) {
+	return parseSlackChannelReferenceId(channelId);
+}
+/**
+* Return the per-token cached WebClient. `withSlackRetries` owns retry
+* classification for this boundary: the WebClient's built-in policy would
+* re-post timed-out writes (a duplicate-message hazard) and sleep for the
+* full unbounded Retry-After inside the request, so both internal behaviors
+* are disabled here.
+*/
+function getClient() {
+	const token = resolveSlackToken();
+	let cached = clientsByToken.get(token);
+	if (!cached) {
+		cached = new WebClient(token, {
+			retryConfig: { retries: 0 },
+			rejectRateLimitedCalls: true
+		});
+		clientsByToken.set(token, cached);
+	}
+	return cached;
+}
+function mapSlackError(error) {
+	if (error instanceof SlackActionError) return error;
+	const candidate = error;
+	const apiError = candidate.data?.error;
+	const message = candidate.message ?? "Slack action failed";
+	const baseOptions = {
+		apiError,
+		statusCode: candidate.statusCode,
+		requestId: getHeaderString(candidate.headers, "x-slack-req-id"),
+		errorData: serializeSlackErrorData(candidate.data),
+		...parseSlackCanvasDetail(candidate.data?.detail)
+	};
+	if (apiError === "missing_scope") return new SlackActionError(message, "missing_scope", {
+		...baseOptions,
+		needed: candidate.data?.needed,
+		provided: candidate.data?.provided
+	});
+	if (apiError === "not_in_channel") return new SlackActionError(message, "not_in_channel", baseOptions);
+	if (apiError === "restricted_action_read_only_channel") return new SlackActionError(message, "read_only_channel", baseOptions);
+	if (apiError === "already_reacted") return new SlackActionError(message, "already_reacted", baseOptions);
+	if (apiError === "no_reaction") return new SlackActionError(message, "no_reaction", baseOptions);
+	if (apiError === "invalid_arguments") return new SlackActionError(message, "invalid_arguments", baseOptions);
+	if (apiError === "invalid_cursor") return new SlackActionError(message, "invalid_arguments", baseOptions);
+	if (apiError === "invalid_name") return new SlackActionError(message, "invalid_arguments", baseOptions);
+	if (apiError === "not_found" || apiError === "channel_not_found" || apiError === "message_not_found") return new SlackActionError(message, "not_found", baseOptions);
+	if (apiError === "feature_not_enabled" || apiError === "not_allowed_token_type") return new SlackActionError(message, "feature_unavailable", baseOptions);
+	if (apiError === "canvas_creation_failed") return new SlackActionError(message, "canvas_creation_failed", baseOptions);
+	if (apiError === "canvas_editing_failed") return new SlackActionError(message, "canvas_editing_failed", baseOptions);
+	if (candidate.code === "slack_webapi_rate_limited_error" || candidate.statusCode === 429) return new SlackActionError(message, "rate_limited", {
+		...baseOptions,
+		retryAfterSeconds: candidate.retryAfter
+	});
+	return new SlackActionError(message, "internal_error", baseOptions);
+}
+const MAX_RETRY_DELAY_MS = 1e4;
+const MAX_TOTAL_RETRY_DELAY_MS = 2e4;
+const CONNECTION_ERROR_CODES = /* @__PURE__ */ new Set([
+	"ECONNREFUSED",
+	"ECONNRESET",
+	"ENOTFOUND",
+	"EAI_AGAIN"
+]);
+const TIMEOUT_ERROR_CODES = /* @__PURE__ */ new Set([
+	"ETIMEDOUT",
+	"ECONNABORTED",
+	"ESOCKETTIMEDOUT"
+]);
+function findNetworkErrorCode(error, depth = 0) {
+	if (!error || typeof error !== "object" || depth > 4) return;
+	const candidate = error;
+	if (typeof candidate.code === "string" && (CONNECTION_ERROR_CODES.has(candidate.code) || TIMEOUT_ERROR_CODES.has(candidate.code))) return candidate.code;
+	return findNetworkErrorCode(candidate.original, depth + 1) ?? findNetworkErrorCode(candidate.cause, depth + 1);
+}
+function hasSocketHangUpMessage(error) {
+	return error instanceof Error && error.message.toLowerCase().includes("socket hang up");
+}
+/**
+* Classify a failed Slack call for retry: rate limits, Slack 5xx, and
+* connection-phase failures are always retryable; timeouts are retried only
+* for idempotent operations because Slack may already have accepted the
+* request.
+*/
+function classifySlackRetry(raw, mapped) {
+	if (mapped.code === "rate_limited") return "rate_limited";
+	if (mapped.statusCode !== void 0 && mapped.statusCode >= 500) return "server_error";
+	const networkCode = findNetworkErrorCode(raw);
+	if (networkCode && CONNECTION_ERROR_CODES.has(networkCode)) return "connection";
+	if (networkCode && TIMEOUT_ERROR_CODES.has(networkCode)) return "timeout";
+	if (hasSocketHangUpMessage(raw)) return "connection";
+	return "none";
+}
+/**
+* Run a Slack Web API call with bounded retries so transient platform
+* failures do not surface as turn failures, while non-idempotent posts are
+* never re-sent when Slack may already have accepted them.
+*
+* Retry classes: rate limits (bounded Retry-After), connection-phase network
+* failures, and Slack 5xx responses always retry; request timeouts retry only
+* when the caller marks the operation `idempotent`.
+*/
+async function withSlackRetries(task, maxAttempts = 3, context = {}) {
+	let attempt = 0;
+	let totalDelayMs = 0;
+	const action = context.action ?? "unknown";
+	while (attempt < maxAttempts) {
+		attempt += 1;
+		const attemptNumber = attempt;
+		try {
+			return await withSpan(`POST slack.com/api/${action}`, "http.client", {}, async () => {
+				try {
+					return await task();
+				} catch (error) {
+					const mapped = mapSlackError(error);
+					const errorAttrs = { "error.type": mapped.code };
+					if (mapped.apiError) errorAttrs["app.slack.api_error_code"] = mapped.apiError;
+					if (mapped.code === "rate_limited") {
+						errorAttrs["http.response.status_code"] = 429;
+						if (mapped.retryAfterSeconds) errorAttrs["app.slack.retry_after_ms"] = mapped.retryAfterSeconds * 1e3;
+					} else if (mapped.statusCode != null) errorAttrs["http.response.status_code"] = mapped.statusCode;
+					setSpanAttributes(errorAttrs);
+					setSpanStatus("error");
+					throw error;
+				}
+			}, {
+				"http.request.method": "POST",
+				"server.address": "slack.com",
+				"url.scheme": "https",
+				"url.path": `/api/${action}`,
+				"app.slack.method": action,
+				"app.retry.max_attempts": maxAttempts,
+				...attemptNumber > 1 ? { "http.request.resend_count": attemptNumber - 1 } : void 0,
+				...context.attributes ?? {},
+				...context.spanAttributes ?? {}
+			});
+		} catch (error) {
+			const mapped = mapSlackError(error);
+			const retryClass = classifySlackRetry(error, mapped);
+			const isRetryable = retryClass === "rate_limited" || retryClass === "connection" || retryClass === "server_error" || retryClass === "timeout" && context.idempotent === true;
+			const remainingDelayBudgetMs = MAX_TOTAL_RETRY_DELAY_MS - totalDelayMs;
+			const baseLogAttributes = {
+				"app.slack.action": action,
+				"app.slack.error_code": mapped.code,
+				...mapped.apiError ? { "app.slack.api_error": mapped.apiError } : void 0,
+				...mapped.detail ? { "app.slack.detail": mapped.detail } : void 0,
+				...mapped.detailLine !== void 0 ? { "app.slack.detail_line": mapped.detailLine } : void 0,
+				...mapped.detailRule ? { "app.slack.detail_rule": mapped.detailRule } : void 0,
+				...mapped.requestId ? { "app.slack.request_id": mapped.requestId } : void 0,
+				...mapped.statusCode !== void 0 ? { "http.response.status_code": mapped.statusCode } : void 0,
+				...context.attributes ?? {}
+			};
+			if (!isRetryable || attempt >= maxAttempts || remainingDelayBudgetMs <= 0) {
+				logWarn("slack.action.failed", {
+					...baseLogAttributes,
+					...mapped.errorData ? { "app.slack.error_data": mapped.errorData } : void 0
+				});
+				throw mapped;
+			}
+			logWarn("slack.action.retrying", {
+				...baseLogAttributes,
+				"app.slack.retry_attempt": attempt,
+				"app.slack.retry_class": retryClass
+			});
+			const retryAfterMs = retryClass === "rate_limited" && mapped.retryAfterSeconds && mapped.retryAfterSeconds > 0 ? mapped.retryAfterSeconds * 1e3 : void 0;
+			const backoffMs = Math.min(2e3, 250 * 2 ** (attempt - 1));
+			const delayMs = Math.min(retryAfterMs ?? backoffMs, MAX_RETRY_DELAY_MS, remainingDelayBudgetMs);
+			totalDelayMs += delayMs;
+			await sleep$1(delayMs);
+		}
+	}
+	throw new SlackActionError("Slack action exhausted retries", "internal_error");
+}
+/**
+* Slack Web API client for the current destination workspace: the ambient
+* installation token when one is bound, otherwise the env bot token for
+* single-workspace deployments. Fails instead of falling back when the call
+* is workspace-scoped and no installation token can be resolved, so a write
+* never goes out with another workspace's credentials.
+*/
+function getSlackClient() {
+	return getClient();
+}
+/**
+* Slack channel ID prefixes:
+* - C: channel — modern private channels also use C, so the prefix never
+*   proves a channel is public
+* - G: legacy private channel / group DM
+* - D: direct message (1:1)
+*/
+function isDmChannel(channelId) {
+	const normalized = normalizeSlackConversationId(channelId);
+	return Boolean(normalized && normalized.startsWith("D"));
+}
+/**
+* Conversation-scoped Slack contexts backed by a concrete conversation ID.
+* Includes channels/groups/DMs (C/G/D).
+*/
+function isConversationScopedChannel(channelId) {
+	const normalized = normalizeSlackConversationId(channelId);
+	if (!normalized) return false;
+	return normalized.startsWith("C") || normalized.startsWith("G") || normalized.startsWith("D");
+}
+function isConversationChannel(channelId) {
+	const normalized = normalizeSlackConversationId(channelId);
+	if (!normalized) return false;
+	return normalized.startsWith("C") || normalized.startsWith("G");
+}
+async function getFilePermalink(fileId) {
+	const client = getClient();
+	return (await withSlackRetries(() => client.files.info({ file: fileId }), 3, {
+		action: "files.info",
+		idempotent: true,
+		spanAttributes: { "app.slack.file_id": fileId }
+	})).file?.permalink;
+}
+async function downloadPrivateSlackFile(url) {
+	const token = resolveSlackToken();
+	return withSpan("GET files.slack.com", "http.client", {}, async () => {
+		const response = await fetch(url, { headers: { Authorization: `Bearer ${token}` } });
+		setSpanAttributes({ "http.response.status_code": response.status });
+		if (!response.ok) {
+			setSpanAttributes({ "error.type": String(response.status) });
+			setSpanStatus("error");
+			throw new Error(`Slack file download failed: ${response.status}`);
+		}
+		return Buffer.from(await response.arrayBuffer());
+	}, {
+		"http.request.method": "GET",
+		"server.address": "files.slack.com",
+		"url.scheme": "https",
+		"app.slack.method": "files.download"
+	});
+}
+//#endregion
+//#region src/chat/credentials/subject.ts
+const CREDENTIAL_SUBJECT_HMAC_CONTEXT = "junior.credential_subject.v1";
+const CREDENTIAL_SUBJECT_SIGNATURE_VERSION = "v1";
+function getCredentialSubjectSecret() {
+	return process.env.JUNIOR_SECRET?.trim() || void 0;
+}
+/** Encode ordered signing fields without allowing delimiter ambiguity. */
+function buildPayload(parts) {
+	return [CREDENTIAL_SUBJECT_HMAC_CONTEXT, ...parts].join("\0");
+}
+function signPayload(secret, payload) {
+	const digest = createHmac("sha256", secret).update(payload).digest("hex");
+	return `${CREDENTIAL_SUBJECT_SIGNATURE_VERSION}=${digest}`;
+}
+function timingSafeMatch(expected, actual) {
+	const expectedBuffer = Buffer.from(expected);
+	const actualBuffer = Buffer.from(actual);
+	if (expectedBuffer.length !== actualBuffer.length) return false;
+	return timingSafeEqual(expectedBuffer, actualBuffer);
+}
+/** Create a delegated user credential subject for a verified Slack DM turn. */
+function createSlackDirectCredentialSubject(input) {
+	const channelId = normalizeSlackConversationId(input.channelId);
+	const teamId = input.teamId?.trim();
+	const userId = parseActorUserId(input.userId);
+	if (!channelId || !teamId || !userId || !isDmChannel(channelId)) return;
+	return {
+		type: "user",
+		userId,
+		allowedWhen: "private-direct-conversation"
+	};
+}
+/** Bind a delegated user subject to the Slack DM destination being dispatched. */
+function bindSlackDirectCredentialSubject(input) {
+	const channelId = normalizeSlackConversationId(input.channelId);
+	const teamId = input.teamId.trim();
+	const secret = getCredentialSubjectSecret();
+	const { subject } = input;
+	const userId = parseActorUserId(subject.userId);
+	if (!channelId || !teamId || !secret || !isDmChannel(channelId) || subject.type !== "user" || !userId || subject.allowedWhen !== "private-direct-conversation") return;
+	return {
+		type: "user",
+		userId,
+		allowedWhen: subject.allowedWhen,
+		binding: {
+			type: "slack-direct-conversation",
+			teamId,
+			channelId,
+			signature: signPayload(secret, buildPayload([
+				subject.allowedWhen,
+				teamId,
+				channelId,
+				userId
+			]))
+		}
+	};
+}
+/** Verify that a delegated subject was signed for the dispatch destination. */
+function verifySlackDirectCredentialSubject(input) {
+	const channelId = normalizeSlackConversationId(input.channelId);
+	const secret = getCredentialSubjectSecret();
+	if (!channelId || !secret) return false;
+	const { subject } = input;
+	const binding = subject.binding;
+	if (subject.type !== "user" || !isActorUserId(subject.userId) || subject.allowedWhen !== "private-direct-conversation" || !binding || binding.type !== "slack-direct-conversation" || typeof binding.signature !== "string" || !binding.signature || binding.teamId !== input.teamId || binding.channelId !== channelId) return false;
+	return timingSafeMatch(signPayload(secret, buildPayload([
+		subject.allowedWhen,
+		binding.teamId,
+		binding.channelId,
+		subject.userId
+	])), binding.signature);
+}
+/** Bind a delegated user subject to one scheduler task dispatch. */
+function bindScheduledTaskCredentialSubject(input) {
+	const secret = getCredentialSubjectSecret();
+	const plugin = input.plugin.trim();
+	const userId = parseActorUserId(input.subject.userId);
+	if (!secret || plugin !== "scheduler" || !userId || input.subject.allowedWhen !== "scheduled-task") return;
+	const taskId = input.subject.taskId;
+	if (!taskId || taskId !== taskId.trim()) return;
+	return {
+		type: "user",
+		userId,
+		allowedWhen: "scheduled-task",
+		taskId,
+		binding: {
+			type: "scheduled-task",
+			plugin,
+			taskId,
+			signature: signPayload(secret, buildPayload([
+				"scheduled-task",
+				plugin,
+				taskId,
+				userId
+			]))
+		}
+	};
+}
+/** Verify that a delegated subject was signed for one scheduler task. */
+function verifyScheduledTaskCredentialSubject(input) {
+	const secret = getCredentialSubjectSecret();
+	const { subject } = input;
+	const binding = subject.binding;
+	if (!secret || input.plugin !== "scheduler" || subject.type !== "user" || !isActorUserId(subject.userId) || subject.allowedWhen !== "scheduled-task" || !subject.taskId || binding.type !== "scheduled-task" || binding.plugin !== input.plugin || binding.taskId !== subject.taskId) return false;
+	return timingSafeMatch(signPayload(secret, buildPayload([
+		"scheduled-task",
+		binding.plugin,
+		binding.taskId,
+		subject.userId
+	])), binding.signature);
+}
+/** Bind a delegated user subject to one event task dispatch. */
+function bindEventTaskCredentialSubject(input) {
+	const secret = getCredentialSubjectSecret();
+	const plugin = input.plugin.trim();
+	const userId = parseActorUserId(input.subject.userId);
+	if (!secret || plugin !== "junior" || !userId || input.subject.allowedWhen !== "event-task") return;
+	const taskId = input.subject.taskId;
+	if (!taskId || taskId !== taskId.trim()) return;
+	return {
+		type: "user",
+		userId,
+		allowedWhen: "event-task",
+		taskId,
+		binding: {
+			type: "event-task",
+			plugin,
+			taskId,
+			signature: signPayload(secret, buildPayload([
+				"event-task",
+				plugin,
+				taskId,
+				userId
+			]))
+		}
+	};
+}
+/** Verify that a delegated subject was signed for one event task. */
+function verifyEventTaskCredentialSubject(input) {
+	const secret = getCredentialSubjectSecret();
+	const { subject } = input;
+	const binding = subject.binding;
+	if (!secret || input.plugin !== "junior" || subject.type !== "user" || !isActorUserId(subject.userId) || subject.allowedWhen !== "event-task" || !subject.taskId || binding.type !== "event-task" || binding.plugin !== input.plugin || binding.taskId !== subject.taskId) return false;
+	return timingSafeMatch(signPayload(secret, buildPayload([
+		"event-task",
+		binding.plugin,
+		binding.taskId,
+		subject.userId
+	])), binding.signature);
+}
+//#endregion
+//#region src/chat/slack/tool-support/channel-capabilities.ts
+/** Resolve channel capabilities from a Slack channel ID. */
+function resolveChannelCapabilities(channelId) {
+	return {
+		canCreateCanvas: isConversationScopedChannel(channelId),
+		canSendFiles: isConversationScopedChannel(channelId),
+		canPostToChannel: isConversationChannel(channelId),
+		canAddReactions: isConversationScopedChannel(channelId)
+	};
+}
+//#endregion
+//#region src/chat/workspaces/checkout-path.ts
+/** Derive the fixed sandbox checkout path for one repository, or undefined when invalid. */
+function tryWorkspaceRepoCheckoutPath(repo) {
+	const name = repo.split("/").filter(Boolean).at(-1);
+	if (!name || name === "." || name === ".." || !/^[A-Za-z0-9._-]+$/.test(name)) return;
+	return `repos/${name}`;
+}
+/** Derive the fixed sandbox checkout path for one repository. */
+function workspaceRepoCheckoutPath(repo) {
+	const path = tryWorkspaceRepoCheckoutPath(repo);
+	if (!path) throw new Error(`Invalid repository name for checkout path: ${repo}`);
+	return path;
+}
+//#endregion
+//#region src/chat/sandbox/snapshot/builder-sandbox.ts
+/** Resume the named Sandbox that owns one Workspace snapshot build. */
+async function getWorkspaceSnapshotBuilder(name, signal) {
+	const credentials = getVercelSandboxCredentials();
+	return await Sandbox.get({
+		name,
+		resume: true,
+		signal,
+		...credentials ?? {}
+	});
+}
+/** Permanently delete named Workspace snapshot builders without resuming them. */
+async function deleteWorkspaceSnapshotBuilders(names) {
+	const credentials = getVercelSandboxCredentials();
+	let hasError = false;
+	let firstError;
+	for (const name of new Set(names)) try {
+		await (await Sandbox.get({
+			name,
+			resume: false,
+			...credentials ?? {}
+		})).delete();
+	} catch (error) {
+		if (!isSandboxMissingError(error)) {
+			if (!hasError) firstError = error;
+			hasError = true;
+		}
+	}
+	if (hasError) throw firstError;
+}
+//#endregion
+//#region src/chat/sandbox/snapshot/runtime.ts
+/** Runtime used to build and start reusable Sandbox snapshots. */
+const SANDBOX_RUNTIME = "node22";
+//#endregion
+//#region src/chat/sandbox/snapshot/store.ts
+function builderNames(rows) {
+	return [...new Set(rows.map((row) => row.sandboxName).filter((name) => Boolean(name)))];
+}
+function sameWorkspaceRecipe(stored, expected) {
+	if (stored.setupScript !== expected.setupScript || stored.repos.length !== expected.repos.length) return false;
+	const expectedRepos = new Set(expected.repos.map((repo) => JSON.stringify([repo.provider, repo.repo])));
+	return stored.repos.every((repo) => expectedRepos.has(JSON.stringify([repo.provider, repo.repo])));
+}
+function snapshotFromRow(row) {
+	if (row.status !== "ready" || !row.snapshotId || !row.generatedAt || row.buildDurationMs == null) throw new Error(`Invalid ready Workspace snapshot row: ${row.id}`);
+	return {
+		id: row.snapshotId,
+		generatedAt: row.generatedAt,
+		buildDurationMs: row.buildDurationMs,
+		sizeBytes: row.sizeBytes,
+		profileHash: row.profileHash
+	};
+}
+function snapshotBuildFromRow(row) {
+	if (row.status === "ready" || !row.buildStartedAt || !row.buildPhase) throw new Error(`Invalid Workspace snapshot build row: ${row.id}`);
+	return {
+		id: row.id,
+		status: row.status,
+		phase: row.buildPhase,
+		profileHash: row.profileHash,
+		startedAt: row.buildStartedAt,
+		sandboxName: row.buildSandboxName,
+		commandId: row.buildCommandId,
+		error: row.buildError
+	};
+}
+/** Load bounded ready and build views for one Workspace profile hash. */
+async function loadSnapshotsForProfile(db, workspaceId, profileHash) {
+	const profile = and(eq(juniorSnapshots.workspaceId, workspaceId), eq(juniorSnapshots.profileHash, profileHash));
+	const order = [
+		desc(juniorSnapshots.updatedAt),
+		desc(juniorSnapshots.createdAt),
+		desc(juniorSnapshots.id)
+	];
+	const [readyRows, buildRows] = await Promise.all([db.select().from(juniorSnapshots).where(and(profile, eq(juniorSnapshots.status, "ready"))).orderBy(...order).limit(1), db.select().from(juniorSnapshots).where(and(profile, ne(juniorSnapshots.status, "ready"))).orderBy(asc(juniorSnapshots.status), ...order).limit(1)]);
+	return {
+		ready: readyRows[0] ? snapshotFromRow(readyRows[0]) : null,
+		build: buildRows[0] ? snapshotBuildFromRow(buildRows[0]) : null
+	};
+}
+/** Drop every snapshot row before its Workspace is deleted. */
+async function clearWorkspaceSnapshots(db, workspaceId) {
+	await db.select({ id: juniorWorkspaces.id }).from(juniorWorkspaces).where(eq(juniorWorkspaces.id, workspaceId)).for("update");
+	return builderNames(await db.delete(juniorSnapshots).where(eq(juniorSnapshots.workspaceId, workspaceId)).returning({ sandboxName: juniorSnapshots.buildSandboxName }));
+}
+/** Drop one ready snapshot and return the name of its provider owner. */
+async function invalidateReadySnapshot(params) {
+	const executor = getSqlExecutor();
+	return await executor.transaction(async () => {
+		return (await executor.db().delete(juniorSnapshots).where(and(eq(juniorSnapshots.workspaceId, params.workspaceId), eq(juniorSnapshots.profileHash, params.profileHash), eq(juniorSnapshots.status, "ready"), eq(juniorSnapshots.snapshotId, params.snapshotId))).returning({ sandboxName: juniorSnapshots.buildSandboxName }))[0]?.sandboxName ?? null;
+	});
+}
+/** Complete one owned build and report provider owners that it replaced. */
+async function setWorkspaceSnapshot(workspaceId, snapshot, options) {
+	const executor = getSqlExecutor();
+	return await executor.transaction(async () => {
+		const db = executor.db();
+		const now = /* @__PURE__ */ new Date();
+		if ((await db.update(juniorSnapshots).set({
+			status: "ready",
+			snapshotId: snapshot.id,
+			buildDurationMs: snapshot.buildDurationMs,
+			sizeBytes: snapshot.sizeBytes,
+			generatedAt: snapshot.generatedAt,
+			buildStartedAt: null,
+			buildPhase: null,
+			buildCommandId: null,
+			buildError: null,
+			updatedAt: now
+		}).where(and(eq(juniorSnapshots.id, options.buildId), eq(juniorSnapshots.workspaceId, workspaceId), eq(juniorSnapshots.profileHash, snapshot.profileHash), eq(juniorSnapshots.status, "building"))).returning({ id: juniorSnapshots.id })).length === 0) return {
+			written: false,
+			replacedBuilderNames: []
+		};
+		return {
+			written: true,
+			replacedBuilderNames: builderNames(await db.delete(juniorSnapshots).where(and(eq(juniorSnapshots.workspaceId, workspaceId), eq(juniorSnapshots.profileHash, snapshot.profileHash), ne(juniorSnapshots.id, options.buildId), or(eq(juniorSnapshots.status, "failed"), eq(juniorSnapshots.status, "ready")))).returning({ sandboxName: juniorSnapshots.buildSandboxName }))
+		};
+	});
+}
+/** Update an owned build row. Initial creation locks and verifies its Workspace. */
+async function setWorkspaceSnapshotBuild(workspaceId, build, options = {}) {
+	const executor = getSqlExecutor();
+	return await executor.transaction(async () => {
+		const db = executor.db();
+		const now = /* @__PURE__ */ new Date();
+		if ((await db.update(juniorSnapshots).set({
+			status: build.status,
+			buildStartedAt: build.startedAt,
+			buildPhase: build.phase,
+			buildSandboxName: build.sandboxName,
+			buildCommandId: build.commandId,
+			buildError: build.error,
+			updatedAt: now
+		}).where(and(eq(juniorSnapshots.id, build.id), eq(juniorSnapshots.workspaceId, workspaceId), eq(juniorSnapshots.profileHash, build.profileHash), eq(juniorSnapshots.status, "building"))).returning({ id: juniorSnapshots.id })).length > 0) return true;
+		if (!options.insertIfMissing) return false;
+		const workspace = (await db.select({ setupScript: juniorWorkspaces.setupScript }).from(juniorWorkspaces).where(eq(juniorWorkspaces.id, workspaceId)).for("update"))[0];
+		if (!workspace) return false;
+		if (options.expectedRecipe) {
+			const repos = await db.select({
+				provider: juniorWorkspaceRepos.provider,
+				repo: juniorWorkspaceRepos.repo
+			}).from(juniorWorkspaceRepos).where(eq(juniorWorkspaceRepos.workspaceId, workspaceId));
+			if (!sameWorkspaceRecipe({
+				...workspace,
+				repos
+			}, options.expectedRecipe)) return false;
+		}
+		return (await db.insert(juniorSnapshots).values({
+			id: build.id,
+			workspaceId,
+			profileHash: build.profileHash,
+			status: build.status,
+			snapshotId: null,
+			buildDurationMs: null,
+			sizeBytes: null,
+			generatedAt: null,
+			buildStartedAt: build.startedAt,
+			buildPhase: build.phase,
+			buildSandboxName: build.sandboxName,
+			buildCommandId: build.commandId,
+			buildError: build.error,
+			createdAt: now,
+			updatedAt: now
+		}).onConflictDoNothing().returning({ id: juniorSnapshots.id })).length > 0;
+	});
+}
+//#endregion
+//#region src/chat/workspaces/validation.ts
+const WORKSPACE_NAME_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;
+const PROVIDER_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;
+const REPO_PATTERN = /^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/;
+const MAX_SETUP_SCRIPT_BYTES = 65536;
+const MAX_REPOS = 32;
+/** Validation failure for one Workspace recipe write. */
+var WorkspaceValidationError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "WorkspaceValidationError";
+	}
+};
+/** Normalize and validate one Workspace recipe write payload. */
+function normalizeWorkspaceRecipe(input) {
+	const name = input.name.trim().toLowerCase();
+	if (!WORKSPACE_NAME_PATTERN.test(name)) throw new WorkspaceValidationError("Workspace name must start with a letter and use only lowercase letters, digits, underscores, or hyphens.");
+	const setupScript = input.setupScript ?? "";
+	if (typeof setupScript !== "string") throw new WorkspaceValidationError("Setup script must be a string.");
+	if (Buffer.byteLength(setupScript, "utf8") > MAX_SETUP_SCRIPT_BYTES) throw new WorkspaceValidationError(`Setup script must be at most ${MAX_SETUP_SCRIPT_BYTES} bytes.`);
+	if (!Array.isArray(input.repos)) throw new WorkspaceValidationError("Repositories must be an array.");
+	if (input.repos.length > MAX_REPOS) throw new WorkspaceValidationError(`A Workspace can include at most ${MAX_REPOS} repositories.`);
+	const repos = input.repos.map((entry, index) => {
+		const provider = entry.provider.trim().toLowerCase();
+		if (!PROVIDER_PATTERN.test(provider)) throw new WorkspaceValidationError(`Repository ${index + 1} provider is invalid.`);
+		const repo = entry.repo.trim();
+		if (!REPO_PATTERN.test(repo)) throw new WorkspaceValidationError(`Repository ${index + 1} must use owner/name format.`);
+		if (!tryWorkspaceRepoCheckoutPath(repo)) throw new WorkspaceValidationError(`Repository ${index + 1} name cannot be used as a checkout path.`);
+		return {
+			provider,
+			repo
+		};
+	});
+	const identities = /* @__PURE__ */ new Set();
+	for (const repo of repos) {
+		const identity = `${repo.provider}:${repo.repo.toLowerCase()}`;
+		if (identities.has(identity)) throw new WorkspaceValidationError(`Duplicate repository in Workspace: ${repo.provider}:${repo.repo}`);
+		identities.add(identity);
+	}
+	const checkoutPaths = /* @__PURE__ */ new Set();
+	for (const repo of repos) {
+		const path = tryWorkspaceRepoCheckoutPath(repo.repo);
+		const key = path.toLowerCase();
+		if (checkoutPaths.has(key)) throw new WorkspaceValidationError(`Workspace checkout path collision: ${path}`);
+		checkoutPaths.add(key);
+	}
+	return {
+		name,
+		setupScript,
+		repos
+	};
+}
+//#endregion
+//#region src/chat/workspaces/store.ts
+function workspaceFromRows(row, repos, snapshot) {
+	return {
+		id: row.id,
+		name: row.name,
+		setupScript: row.setupScript,
+		repos: repos.map((repo) => ({
+			provider: repo.provider,
+			repo: repo.repo
+		})),
+		snapshot
+	};
+}
+async function workspaceWithSnapshot(db, row, repos) {
+	const workspace = workspaceFromRows(row, repos, null);
+	const profileHash = hash(SANDBOX_RUNTIME, workspace);
+	if (!profileHash) return workspace;
+	const snapshots = await loadSnapshotsForProfile(db, workspace.id, profileHash);
+	return {
+		...workspace,
+		snapshot: snapshots.ready
+	};
+}
+async function loadWorkspaceRepos(db, workspaceId) {
+	return await db.select().from(juniorWorkspaceRepos).where(eq(juniorWorkspaceRepos.workspaceId, workspaceId)).orderBy(asc(juniorWorkspaceRepos.provider), asc(juniorWorkspaceRepos.repo));
+}
+async function replaceWorkspaceRepos(db, workspaceId, repos) {
+	await db.delete(juniorWorkspaceRepos).where(eq(juniorWorkspaceRepos.workspaceId, workspaceId));
+	if (repos.length === 0) return;
+	await db.insert(juniorWorkspaceRepos).values(repos.map((repo) => ({
+		workspaceId,
+		provider: repo.provider,
+		repo: repo.repo
+	})));
+}
+function sameWorkspaceRepos(current, next) {
+	if (current.length !== next.length) return false;
+	const identity = (repo) => `${repo.provider}:${repo.repo.toLowerCase()}`;
+	const currentIds = current.map(identity).sort();
+	const nextIds = next.map(identity).sort();
+	return currentIds.every((value, index) => value === nextIds[index]);
+}
+function isUniqueViolation(error) {
+	let current = error;
+	for (let depth = 0; current && depth < 6; depth += 1) {
+		if (typeof current === "object" && current !== null && "code" in current && current.code === "23505") return true;
+		current = typeof current === "object" && current !== null && "cause" in current ? current.cause : void 0;
+	}
+	return false;
+}
+async function cleanupSnapshotBuilders(workspaceId, names) {
+	if (names.length === 0) return;
+	try {
+		await deleteWorkspaceSnapshotBuilders(names);
+	} catch (error) {
+		logException(error, "sandbox.workspace_snapshot.builder.delete_failed", {
+			"app.workspace.id": workspaceId,
+			"app.sandbox.snapshot.builder_count": names.length
+		});
+	}
+}
+/** List Workspace recipes by stable name. */
+async function listWorkspaces(db) {
+	const [workspaces, repos] = await Promise.all([db.select().from(juniorWorkspaces).orderBy(asc(juniorWorkspaces.name)), db.select().from(juniorWorkspaceRepos).orderBy(asc(juniorWorkspaceRepos.workspaceId), asc(juniorWorkspaceRepos.provider), asc(juniorWorkspaceRepos.repo))]);
+	return workspaces.map((workspace) => workspaceFromRows(workspace, repos.filter((repo) => repo.workspaceId === workspace.id), null));
+}
+/** Find Workspace names that include one provider repository. */
+async function listWorkspaceNamesByRepository(db, input) {
+	const provider = input.provider.trim().toLowerCase();
+	const repo = input.repo.trim();
+	return (await db.select({ name: juniorWorkspaces.name }).from(juniorWorkspaceRepos).innerJoin(juniorWorkspaces, eq(juniorWorkspaces.id, juniorWorkspaceRepos.workspaceId)).where(and(eq(juniorWorkspaceRepos.provider, provider), sql`lower(${juniorWorkspaceRepos.repo}) = lower(${repo})`)).orderBy(asc(juniorWorkspaces.name))).map((row) => row.name);
+}
+/** Resolve one Workspace recipe by name. */
+async function getWorkspaceByName(db, name) {
+	const workspace = (await db.select().from(juniorWorkspaces).where(eq(juniorWorkspaces.name, name)).limit(1))[0];
+	if (!workspace) return void 0;
+	return await workspaceWithSnapshot(db, workspace, await loadWorkspaceRepos(db, workspace.id));
+}
+/** Resolve one Workspace recipe by id. */
+async function getWorkspace(db, id) {
+	const workspace = (await db.select().from(juniorWorkspaces).where(eq(juniorWorkspaces.id, id)).limit(1))[0];
+	if (!workspace) return void 0;
+	return await workspaceWithSnapshot(db, workspace, await loadWorkspaceRepos(db, workspace.id));
+}
+/** Create one install-wide Workspace recipe. */
+async function createWorkspace(input) {
+	const recipe = normalizeWorkspaceRecipe(input);
+	const executor = getSqlExecutor();
+	const now = /* @__PURE__ */ new Date();
+	const id = randomUUID();
+	try {
+		await executor.transaction(async () => {
+			const db = executor.db();
+			await db.insert(juniorWorkspaces).values({
+				id,
+				name: recipe.name,
+				setupScript: recipe.setupScript,
+				createdAt: now,
+				updatedAt: now
+			});
+			await replaceWorkspaceRepos(db, id, recipe.repos);
+		});
+	} catch (error) {
+		if (isUniqueViolation(error)) throw new WorkspaceValidationError(`Workspace name already exists: ${recipe.name}`);
+		throw error;
+	}
+	return await getWorkspace(executor.db(), id);
+}
+/** Replace one install-wide Workspace recipe. */
+async function updateWorkspace(id, input) {
+	const recipe = normalizeWorkspaceRecipe(input);
+	const executor = getSqlExecutor();
+	const now = /* @__PURE__ */ new Date();
+	try {
+		const result = await executor.transaction(async () => {
+			const db = executor.db();
+			const existing = (await db.select().from(juniorWorkspaces).where(eq(juniorWorkspaces.id, id)).limit(1))[0];
+			if (!existing) return void 0;
+			const existingRepos = await loadWorkspaceRepos(db, id);
+			const snapshotChanged = existing.setupScript !== recipe.setupScript || !sameWorkspaceRepos(existingRepos, recipe.repos);
+			const rows = await db.update(juniorWorkspaces).set({
+				name: recipe.name,
+				setupScript: recipe.setupScript,
+				updatedAt: now
+			}).where(eq(juniorWorkspaces.id, id)).returning();
+			await replaceWorkspaceRepos(db, id, recipe.repos);
+			return {
+				builderNames: snapshotChanged ? await clearWorkspaceSnapshots(db, id) : [],
+				workspace: rows[0]
+			};
+		});
+		if (!result) return void 0;
+		await cleanupSnapshotBuilders(id, result.builderNames);
+	} catch (error) {
+		if (isUniqueViolation(error)) throw new WorkspaceValidationError(`Workspace name already exists: ${recipe.name}`);
+		throw error;
+	}
+	return await getWorkspace(executor.db(), id);
+}
+/** Delete one install-wide Workspace recipe. */
+async function deleteWorkspace(id) {
+	const executor = getSqlExecutor();
+	const result = await executor.transaction(async () => {
+		const db = executor.db();
+		return {
+			builderNames: await clearWorkspaceSnapshots(db, id),
+			deleted: (await db.delete(juniorWorkspaces).where(eq(juniorWorkspaces.id, id)).returning({ id: juniorWorkspaces.id })).length > 0
+		};
+	});
+	await cleanupSnapshotBuilders(id, result.builderNames);
+	return result.deleted;
+}
+//#endregion
+//#region src/chat/code/store.ts
+/** Record the latest details for one code change created by Junior. */
+async function recordCodeChange(db, provider, input) {
+	const change = codeChangeInputSchema.parse(input);
+	const repositories = await db.insert(juniorCodeRepositories).values({
+		id: randomUUID(),
+		name: change.repository.name,
+		provider,
+		providerId: change.repository.providerId,
+		url: change.repository.url,
+		updatedAt: change.updatedAt
+	}).onConflictDoUpdate({
+		target: [juniorCodeRepositories.provider, juniorCodeRepositories.providerId],
+		set: {
+			name: change.repository.name,
+			...change.repository.url ? { url: change.repository.url } : void 0,
+			updatedAt: change.updatedAt
+		},
+		where: lte(juniorCodeRepositories.updatedAt, change.updatedAt)
+	}).returning({ id: juniorCodeRepositories.id });
+	const existingRepositories = repositories[0] ? [] : await db.select({ id: juniorCodeRepositories.id }).from(juniorCodeRepositories).where(and(eq(juniorCodeRepositories.provider, provider), eq(juniorCodeRepositories.providerId, change.repository.providerId))).limit(1);
+	const repositoryId = repositories[0]?.id ?? existingRepositories[0]?.id;
+	if (!repositoryId) throw new Error("Code repository upsert returned no row");
+	const conversationIds = sql.join(change.conversationIds.map((conversationId) => sql`${conversationId}`), sql`, `);
+	const values = {
+		closedAt: change.closedAt ?? null,
+		conversationIds: change.conversationIds.length > 0 ? sql`ARRAY(
+            SELECT DISTINCT value
+            FROM unnest(
+              ${juniorCodeChanges.conversationIds}
+              || ARRAY[${conversationIds}]::text[]
+            ) AS value
+            ORDER BY value
+          )` : juniorCodeChanges.conversationIds,
+		mergedAt: change.mergedAt ?? null,
+		number: change.number,
+		openedAt: change.openedAt,
+		repositoryId,
+		state: change.state,
+		...change.title ? { title: change.title } : void 0,
+		updatedAt: change.updatedAt,
+		url: change.url ?? null
+	};
+	await db.insert(juniorCodeChanges).values({
+		...values,
+		conversationIds: change.conversationIds,
+		id: randomUUID(),
+		provider,
+		providerId: change.providerId
+	}).onConflictDoUpdate({
+		target: [juniorCodeChanges.provider, juniorCodeChanges.providerId],
+		set: values,
+		where: lte(juniorCodeChanges.updatedAt, change.updatedAt)
+	});
+}
+/** Add conversation links to an existing code change. */
+async function associateCodeChangeConversations(db, provider, input) {
+	if (input.conversationIds.length === 0) return;
+	const conversationIds = sql.join(input.conversationIds.map((conversationId) => sql`${conversationId}`), sql`, `);
+	await db.update(juniorCodeChanges).set({ conversationIds: sql`ARRAY(
+        SELECT DISTINCT value
+        FROM unnest(
+          ${juniorCodeChanges.conversationIds}
+          || ARRAY[${conversationIds}]::text[]
+        ) AS value
+        ORDER BY value
+      )` }).where(and(eq(juniorCodeChanges.provider, provider), eq(juniorCodeChanges.providerId, input.providerId)));
+}
+//#endregion
+//#region src/chat/code/publisher.ts
+/** Connect a plugin to Junior's code records. */
+function createCodeChangePublisher(provider) {
+	return {
+		async associateConversations(input) {
+			await associateCodeChangeConversations(getDb(), provider, input);
+		},
+		async record(input) {
+			await recordCodeChange(getDb(), provider, input);
+		}
+	};
+}
+//#endregion
+//#region src/chat/plugins/agent-hooks.ts
+var agent_hooks_exports = /* @__PURE__ */ __exportAll({
+	PluginHookDeniedError: () => PluginHookDeniedError,
+	applyPluginFormatMarkdown: () => applyPluginFormatMarkdown,
+	createPluginHookRunner: () => createPluginHookRunner,
+	getPluginApiRoutes: () => getPluginApiRoutes,
+	getPluginOperationalReports: () => getPluginOperationalReports,
+	getPluginProfileReports: () => getPluginProfileReports,
+	getPluginRoutes: () => getPluginRoutes,
+	getPluginSlackConversationLink: () => getPluginSlackConversationLink,
+	getPluginSystemPromptContributions: () => getPluginSystemPromptContributions,
+	getPluginTools: () => getPluginTools,
+	getPluginUserPromptContributions: () => getPluginUserPromptContributions,
+	getPlugins: () => getPlugins,
+	setPlugins: () => setPlugins,
+	validatePlugins: () => validatePlugins
+});
+/** Signal that a plugin intentionally denied a tool execution. */
+var PluginHookDeniedError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "PluginHookDeniedError";
+	}
+};
+let registeredPlugins = [];
+const PLUGIN_NAME_RE = /^[a-z][a-z0-9-]*$/;
+const PLUGIN_TOOL_NAME_RE = /^[a-z][A-Za-z0-9]*$/;
+const OPERATIONAL_REPORT_MAX_METRICS = 8;
+const OPERATIONAL_REPORT_MAX_WIDGETS = 12;
+const OPERATIONAL_REPORT_MAX_CHART_SERIES = 8;
+const OPERATIONAL_REPORT_MAX_RECORD_SETS = 8;
+const OPERATIONAL_REPORT_MAX_FIELDS = 8;
+const OPERATIONAL_REPORT_MAX_RECORDS = 25;
+const OPERATIONAL_REPORT_MAX_LABEL_LENGTH = 80;
+const OPERATIONAL_REPORT_MAX_VALUE_LENGTH = 160;
+const PLUGIN_ROUTE_METHODS = /* @__PURE__ */ new Set([
+	"GET",
+	"POST",
+	"PUT",
+	"PATCH",
+	"DELETE",
+	"HEAD",
+	"OPTIONS",
+	"ALL"
+]);
+const PLUGIN_PROMPT_CONTRIBUTION_TOTAL_MAX_CHARS = 16e3;
+const PLUGIN_PROMPT_CONTEXT_MAX_BYTES = 8e3;
+const PLUGIN_PROMPT_CONTEXT_TOTAL_MAX_BYTES = 16e3;
+const systemPromptMessageArraySchema = z.array(promptMessageSchema);
+function isRecord(value) {
+	return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function basePluginContext(plugin) {
+	const name = plugin.manifest.name;
+	return {
+		plugin: { name },
+		log: createPluginLogger(name),
+		db: getDb()
+	};
+}
+/** Convert manifest names into model-facing tool namespaces. */
+function pluginToolNamespace(pluginName) {
+	const [first = "plugin", ...rest] = pluginName.split("-").filter(Boolean);
+	return `${first}${rest.map((part) => `${part[0]?.toUpperCase() ?? ""}${part.slice(1)}`).join("")}`;
+}
+function systemPromptPluginContext(plugin) {
+	return { ...basePluginContext(plugin) };
+}
+/** Bind Source, Destination, and Actor for one plugin invocation. */
+function pluginInvocationContext(context) {
+	const common = {
+		conversationId: context.conversationId,
+		locationId: context.locationId
+	};
+	switch (context.source.kind) {
+		case "slack":
+			if (context.destination.platform !== "slack") throw new TypeError("Slack plugin context requires Slack destination");
+			return {
+				...common,
+				actor: context.actor?.platform === "slack" ? context.actor : void 0,
+				destination: context.destination,
+				source: context.source
+			};
+		case "local":
+			if (context.destination.platform !== "local") throw new TypeError("Local plugin context requires local destination");
+			return {
+				...common,
+				actor: context.actor?.platform === "local" ? context.actor : void 0,
+				destination: context.destination,
+				source: context.source
+			};
+		case "web": return {
+			...common,
+			actor: context.actor?.platform === "web" ? context.actor : void 0,
+			destination: context.destination,
+			source: context.source
+		};
+		case "resource_event":
+		case "scheduled_task":
+		case "event_task":
+		case "plugin_dispatch":
+		case "agent_invocation": return {
+			...common,
+			actor: context.actor,
+			destination: context.destination,
+			source: context.source
+		};
+	}
+}
+function invocationPluginContext(plugin, context, turnId) {
+	return {
+		...basePluginContext(plugin),
+		conversationId: context.conversationId,
+		locationId: context.locationId,
+		embedder: createPluginEmbedder(plugin.manifest.name),
+		...context.conversationId && turnId ? { events: createPluginConversationEvents({
+			conversationId: context.conversationId,
+			operationId: `user-prompt:${turnId}`,
+			plugin,
+			turnId
+		}) } : void 0,
+		model: createPluginModel(plugin.manifest.name, plugin.model),
+		source: context.source,
+		text: context.userText ?? "",
+		state: createPluginState(plugin.manifest.name),
+		users: { resolveActor: context.resolveActorIdentity ?? (async () => void 0) },
+		...pluginInvocationContext(context)
+	};
+}
+function pluginMcpContext(plugin, context) {
+	const manager = context.mcpToolManager;
+	const wrappedTools = new Set(plugin.manifest.mcp?.wrappedTools ?? []);
+	if (!manager || wrappedTools.size === 0) return;
+	const provider = plugin.manifest.name;
+	const prepare = async () => {
+		await manager.activateProvider(provider);
+		return manager.getActiveProviders().includes(provider) ? "ready" : "authorization_pending";
+	};
+	return {
+		prepare,
+		async callTool(input) {
+			if (await prepare() === "authorization_pending") return { status: "authorization_pending" };
+			return await manager.callWrappedTool(provider, input.name, input.arguments ?? {}, input.toolCallId ? { toolCallId: input.toolCallId } : void 0);
+		}
+	};
+}
+function safeErrorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function toPromptContributionContext(args) {
+	return {
+		id: `${args.hookName}:${args.index}`,
+		pluginName: args.pluginName,
+		text: args.message.text
+	};
+}
+function normalizePromptContext(value) {
+	const serialized = JSON.stringify(value);
+	if (serialized === void 0 || Buffer.byteLength(serialized, "utf8") > PLUGIN_PROMPT_CONTEXT_MAX_BYTES) throw new TypeError("Plugin prompt context exceeded its serialized budget");
+	const parsed = JSON.parse(serialized);
+	if (!isRecord(parsed)) throw new TypeError("Plugin prompt context must be a JSON object");
+	return parsed;
+}
+function toUserPromptContributionContext(args) {
+	const message = promptMessageSchema.safeParse(args.value);
+	if (message.success) return toPromptContributionContext({
+		hookName: "userPrompt",
+		index: args.index,
+		message: message.data,
+		pluginName: args.pluginName
+	});
+	if (!isRecord(args.value) || typeof args.value.renderPrompt !== "function") return;
+	const context = promptContextSchema.safeParse(args.value.context);
+	if (!context.success) return;
+	const text = promptMessageSchema.safeParse({ text: args.value.renderPrompt() });
+	if (!text.success) return;
+	return {
+		id: `userPrompt:${args.index}`,
+		pluginName: args.pluginName,
+		text: text.data.text,
+		context: {
+			content: normalizePromptContext(context.data.content),
+			kind: context.data.kind,
+			loadedAtMs: Date.now(),
+			pluginName: args.pluginName,
+			version: context.data.version
+		}
+	};
+}
+function logInvalidPromptContributions(args) {
+	logWarn("plugin.prompt.contribution_result.invalid", {
+		"app.plugin.hook": args.hookName,
+		"app.plugin.name": args.pluginName,
+		"app.plugin.validation_reason": "invalid_shape"
+	});
+}
+/** Validate plugin identity before it can affect process-wide hooks. */
+function validatePlugins(plugins) {
+	const seen = /* @__PURE__ */ new Set();
+	for (const plugin of plugins) {
+		const name = plugin.manifest.name;
+		if (!PLUGIN_NAME_RE.test(name)) throw new Error(`Plugin name "${name}" must be a lowercase plugin identifier`);
+		if (seen.has(name)) throw new Error(`Duplicate plugin name "${name}"`);
+		if (plugin.resourceEvents !== void 0 && !pluginResourceEventsSchema.safeParse(plugin.resourceEvents).success) throw new Error(`Plugin "${name}" resourceEvents is invalid`);
+		for (const [taskName, task] of Object.entries(plugin.tasks ?? {})) {
+			if (!PLUGIN_TOOL_NAME_RE.test(taskName)) throw new Error(`Plugin task "${taskName}" from plugin "${name}" must be a camelCase identifier`);
+			if (typeof task.run !== "function") throw new Error(`Plugin task "${taskName}" from plugin "${name}" must define a run function`);
+		}
+		seen.add(name);
+	}
+}
+/** Replace runtime hook plugins and return the previous list for rollback. */
+function setPlugins(nextPlugins) {
+	validatePlugins(nextPlugins);
+	const previous = registeredPlugins;
+	registeredPlugins = [...nextPlugins].sort((left, right) => left.manifest.name.localeCompare(right.manifest.name));
+	return previous;
+}
+/** Return the current runtime hook plugins without exposing mutable state. */
+function getPlugins() {
+	return [...registeredPlugins];
+}
+/** Apply plugin Markdown rewrites before destination delivery formatting. */
+function applyPluginFormatMarkdown(text) {
+	let transformed = text;
+	for (const plugin of getPlugins()) {
+		const hook = plugin.hooks?.formatMarkdown;
+		if (!hook) continue;
+		try {
+			const next = hook({ text: transformed });
+			if (typeof next === "string") transformed = next;
+		} catch (error) {
+			logWarn("plugin.format_markdown.hook.failed", {
+				"app.plugin.name": plugin.manifest.name,
+				"exception.message": safeErrorMessage(error)
+			});
+		}
+	}
+	return transformed;
+}
+/** Collect stable plugin prompt contributions for the static system prompt. */
+async function getPluginSystemPromptContributions(platform) {
+	const contributions = [];
+	let totalChars = 0;
+	for (const plugin of getPlugins()) {
+		const pluginName = plugin.manifest.name;
+		const hook = plugin.hooks?.systemPrompt;
+		if (!hook) continue;
+		try {
+			const pluginContributions = await hook({
+				...systemPromptPluginContext(plugin),
+				platform
+			});
+			const result = systemPromptMessageArraySchema.safeParse(pluginContributions);
+			if (!result.success) {
+				logInvalidPromptContributions({
+					hookName: "systemPrompt",
+					pluginName
+				});
+				continue;
+			}
+			const acceptedContributions = result.data.map((message, index) => toPromptContributionContext({
+				hookName: "systemPrompt",
+				index,
+				message,
+				pluginName
+			}));
+			const pluginContributionChars = acceptedContributions.reduce((sum, contribution) => sum + contribution.text.length, 0);
+			if (totalChars + pluginContributionChars > PLUGIN_PROMPT_CONTRIBUTION_TOTAL_MAX_CHARS) {
+				logWarn("plugin.system_prompt.contribution_budget_exceeded", { "app.plugin.name": pluginName });
+				continue;
+			}
+			totalChars += pluginContributionChars;
+			contributions.push(...acceptedContributions);
+		} catch (error) {
+			logWarn("plugin.system_prompt.hook.failed", {
+				"app.plugin.name": pluginName,
+				"exception.message": safeErrorMessage(error)
+			});
+		}
+	}
+	return contributions;
+}
+/** Collect request-scoped plugin prompt contributions. */
+async function getPluginUserPromptContributions(args) {
+	const contributions = [];
+	let totalChars = 0;
+	let totalContextBytes = 0;
+	for (const plugin of getPlugins()) {
+		const pluginName = plugin.manifest.name;
+		const hook = plugin.hooks?.userPrompt;
+		if (!hook) continue;
+		try {
+			const rawResult = await hook({ ...invocationPluginContext(plugin, args.context, args.turnId) });
+			if (rawResult === void 0) continue;
+			if (!Array.isArray(rawResult)) {
+				logInvalidPromptContributions({
+					hookName: "userPrompt",
+					pluginName
+				});
+				continue;
+			}
+			const acceptedContributions = rawResult.map((value, index) => toUserPromptContributionContext({
+				index,
+				pluginName,
+				value
+			}));
+			if (acceptedContributions.some((contribution) => !contribution)) {
+				logInvalidPromptContributions({
+					hookName: "userPrompt",
+					pluginName
+				});
+				continue;
+			}
+			const validContributions = acceptedContributions.filter((contribution) => contribution !== void 0);
+			const pluginContributionChars = validContributions.reduce((sum, contribution) => sum + contribution.text.length, 0);
+			const pluginContextBytes = validContributions.reduce((sum, contribution) => sum + (contribution.context ? Buffer.byteLength(JSON.stringify(contribution.context.content), "utf8") : 0), 0);
+			if (totalChars + pluginContributionChars > PLUGIN_PROMPT_CONTRIBUTION_TOTAL_MAX_CHARS || totalContextBytes + pluginContextBytes > PLUGIN_PROMPT_CONTEXT_TOTAL_MAX_BYTES) {
+				logWarn("plugin.user_prompt.contribution_budget_exceeded", { "app.plugin.name": pluginName });
+				continue;
+			}
+			totalChars += pluginContributionChars;
+			totalContextBytes += pluginContextBytes;
+			contributions.push(...validContributions);
+		} catch (error) {
+			logWarn("plugin.user_prompt.hook.failed", {
+				"app.plugin.name": pluginName,
+				"exception.message": safeErrorMessage(error)
+			});
+		}
+	}
+	return contributions;
+}
+/** Collect turn-scoped tools exposed by plugins. */
+function getPluginTools(context, sandbox = createSandboxCapability(context.workspace)) {
+	const tools = {};
+	for (const plugin of getPlugins()) {
+		const pluginName = plugin.manifest.name;
+		const hook = plugin.hooks?.tools;
+		if (!hook) continue;
+		const slackToolContext = getSlackToolContext(context);
+		const credentialSubject = slackToolContext ? createSlackDirectCredentialSubject({
+			channelId: slackToolContext.locationChannelId,
+			teamId: slackToolContext.teamId,
+			userId: slackToolContext.actor?.userId
+		}) : void 0;
+		const dashboardConversationUrl = getDashboardConversationLink(context.conversationId);
+		const slackContext = slackToolContext ? {
+			channelCapabilities: resolveChannelCapabilities(slackToolContext.locationChannelId),
+			...dashboardConversationUrl ? { conversationLink: { url: dashboardConversationUrl } } : void 0,
+			...credentialSubject ? { credentialSubject } : void 0
+		} : void 0;
+		const annotations = createPluginAnnotations({
+			conversationId: context.conversationId,
+			db: getDb(),
+			plugin: pluginName
+		});
+		const mcp = pluginMcpContext(plugin, context);
+		const canSubscribe = Boolean(plugin.resourceEvents) && plugin.resourceEvents?.isEnabled?.() !== false;
+		const resourceEvents = {
+			canSubscribe,
+			async subscribe(input) {
+				if (!canSubscribe) throw new Error("Resource subscriptions are not available in this conversation.");
+				const registration = plugin.resourceEvents;
+				const resourceType = registration?.resourceTypes.find((candidate) => candidate.type === input.resource.type);
+				if (input.resource.namespace !== pluginName || !resourceType || input.events.length === 0 || input.events.some((eventType) => !resourceType.supportedEvents.includes(eventType))) throw new Error("Resource subscription contains an event or resource that the plugin does not support.");
+				const subscription = await createResourceEventSubscription({
+					conversationId: context.conversationId,
+					events: input.events,
+					expiresAtMs: Date.now() + RESOURCE_SUBSCRIPTION_DEFAULT_TTL_MS,
+					intent: input.intent,
+					label: input.resource.label,
+					namespace: pluginName,
+					identifier: normalizeResourceEventIdentifier(registration, input.resource.identifier),
+					resourceType: input.resource.type
+				});
+				return {
+					events: subscription.events,
+					id: subscription.id
+				};
+			}
+		};
+		const resolveActor = context.resolveActorIdentity ?? (async () => void 0);
+		const common = {
+			...basePluginContext(plugin),
+			annotations,
+			conversationId: context.conversationId,
+			locationId: context.locationId,
+			...slackContext ? { slack: slackContext } : void 0,
+			userText: context.userText,
+			embedder: createPluginEmbedder(pluginName),
+			egress: context.egress,
+			...mcp ? { mcp } : void 0,
+			model: createPluginModel(pluginName, plugin.model),
+			resourceEvents,
+			sandbox,
+			state: createPluginState(pluginName),
+			users: { resolveActor },
+			workspaces: { async findByRepository(input) {
+				return await listWorkspaceNamesByRepository(getDb(), input);
+			} }
+		};
+		let pluginContext;
+		switch (context.source.kind) {
+			case "slack":
+				if (context.destination.platform !== "slack") throw new TypeError("Slack plugin context requires Slack destination");
+				pluginContext = {
+					...common,
+					actor: context.actor?.platform === "slack" ? context.actor : void 0,
+					destination: context.destination,
+					source: context.source
+				};
+				break;
+			case "local":
+				if (context.destination.platform !== "local") throw new TypeError("Local plugin context requires local destination");
+				pluginContext = {
+					...common,
+					actor: context.actor?.platform === "local" ? context.actor : void 0,
+					destination: context.destination,
+					source: context.source
+				};
+				break;
+			case "web":
+				pluginContext = {
+					...common,
+					actor: context.actor?.platform === "web" ? context.actor : void 0,
+					destination: context.destination,
+					source: context.source
+				};
+				break;
+			case "resource_event":
+			case "scheduled_task":
+			case "event_task":
+			case "plugin_dispatch":
+			case "agent_invocation": pluginContext = {
+				...common,
+				actor: context.actor,
+				destination: context.destination,
+				source: context.source
+			};
+		}
+		const pluginTools = hook(pluginContext);
+		const namespace = pluginToolNamespace(pluginName);
+		for (const [localName, tool] of Object.entries(pluginTools)) {
+			if (!PLUGIN_TOOL_NAME_RE.test(localName)) throw new Error(`Plugin tool "${localName}" from plugin "${pluginName}" must be a camelCase identifier`);
+			const name = `${namespace}_${localName}`;
+			if (tools[name]) throw new Error(`Duplicate plugin tool "${name}" from plugin "${pluginName}"`);
+			const definition = tool;
+			const missingAnnotationKeys = missingToolAnnotationKeys(definition.annotations);
+			if (missingAnnotationKeys.length > 0) logWarn("plugin.tool_annotations.missing", {
+				"app.plugin.name": pluginName,
+				"gen_ai.tool.name": localName,
+				"app.tool.missing_annotations": missingAnnotationKeys.join(",")
+			});
+			definition.approvalMode ??= "auto";
+			definition.identity = {
+				id: `${pluginName}.${localName}`,
+				name: localName,
+				plugin: pluginName
+			};
+			definition.source = {
+				id: pluginName,
+				description: plugin.manifest.description
+			};
+			definition.exposure ??= "deferred";
+			tools[name] = definition;
+		}
+	}
+	return tools;
+}
+/** Normalize route methods so JS plugins cannot register invalid verbs. */
+function routeMethods(route, pluginName) {
+	const methods = Array.isArray(route.method) ? route.method : [route.method ?? "ALL"];
+	if (methods.length === 0) throw new Error(`Plugin route "${route.path}" from plugin "${pluginName}" must declare at least one method`);
+	for (const method of methods) if (!PLUGIN_ROUTE_METHODS.has(method)) throw new Error(`Plugin route "${route.path}" from plugin "${pluginName}" has invalid method "${String(method)}"`);
+	if (methods.includes("ALL") && methods.length > 1) throw new Error(`Plugin route "${route.path}" from plugin "${pluginName}" must not combine ALL with explicit methods`);
+	return methods;
+}
+function requirePublishedResourceEvent(plugin, eventType) {
+	const registration = plugin.resourceEvents;
+	if (!registration || registration.isEnabled?.() === false) throw new Error(`Plugin "${plugin.manifest.name}" cannot publish resource events without an active registration`);
+	if (!registration.resourceTypes.some((resourceType) => resourceType.supportedEvents.includes(eventType))) throw new Error(`Plugin "${plugin.manifest.name}" did not register resource event "${eventType}"`);
+}
+/** Collect route handlers exposed by plugins for app-level mounting. */
+function getPluginRoutes(options) {
+	const routes = [];
+	const seen = /* @__PURE__ */ new Set();
+	const methodsByPath = /* @__PURE__ */ new Map();
+	for (const plugin of getPlugins()) {
+		const pluginName = plugin.manifest.name;
+		const hook = plugin.hooks?.routes;
+		if (!hook) continue;
+		const pluginRoutes = hook({
+			...basePluginContext(plugin),
+			annotations: { forConversation: (conversationId) => createPluginAnnotations({
+				conversationId,
+				db: getDb(),
+				plugin: pluginName
+			}) },
+			codeChanges: createCodeChangePublisher(pluginName),
+			resourceEvents: {
+				async hasMatch(event) {
+					if (!options.resourceEvents.hasMatch) return false;
+					const parsed = resourceEventInputSchema.parse(event);
+					requirePublishedResourceEvent(plugin, parsed.eventType);
+					return await options.resourceEvents.hasMatch({
+						...parsed,
+						identifier: normalizeResourceEventIdentifier(plugin.resourceEvents, parsed.identifier),
+						namespace: pluginName
+					});
+				},
+				async neededMatchKeys(input) {
+					if (!options.resourceEvents.neededMatchKeys) return [];
+					const identifiers = [...new Set(input.identifiers.map((identifier) => normalizeResourceEventIdentifier(plugin.resourceEvents, identifier)).filter(Boolean))];
+					if (identifiers.length === 0 || input.eventTypes.length === 0) return [];
+					return await options.resourceEvents.neededMatchKeys({
+						eventTypes: input.eventTypes,
+						identifiers,
+						namespace: pluginName
+					});
+				},
+				async publish(event) {
+					const parsed = resourceEventInputSchema.parse(event);
+					requirePublishedResourceEvent(plugin, parsed.eventType);
+					await options.resourceEvents.publish({
+						...parsed,
+						identifier: normalizeResourceEventIdentifier(plugin.resourceEvents, parsed.identifier),
+						namespace: pluginName
+					});
+				}
+			}
+		});
+		if (!Array.isArray(pluginRoutes)) throw new Error(`Plugin routes hook from plugin "${pluginName}" must return an array`);
+		for (const route of pluginRoutes) {
+			if (!isRecord(route)) throw new Error(`Plugin route from plugin "${pluginName}" must be an object`);
+			if (typeof route.path !== "string" || !route.path.startsWith("/")) throw new Error(`Plugin route "${route.path}" from plugin "${pluginName}" must start with /`);
+			if (typeof route.handler !== "function") throw new Error(`Plugin route "${route.path}" from plugin "${pluginName}" must provide a handler`);
+			const methods = routeMethods(route, pluginName);
+			const pathMethods = methodsByPath.get(route.path) ?? /* @__PURE__ */ new Set();
+			if (pathMethods.has("ALL") || methods.includes("ALL") && pathMethods.size > 0) throw new Error(`Plugin route "${route.path}" conflicts with an ALL route for the same path`);
+			for (const method of methods) {
+				const key = `${method}:${route.path}`;
+				if (seen.has(key)) throw new Error(`Duplicate plugin route "${method} ${route.path}"`);
+				seen.add(key);
+				pathMethods.add(method);
+			}
+			methodsByPath.set(route.path, pathMethods);
+			routes.push({
+				...route,
+				pluginName
+			});
+		}
+	}
+	return routes;
+}
+/** Collect authenticated product API route apps exposed by plugins. */
+function getPluginApiRoutes() {
+	const routes = [];
+	for (const plugin of getPlugins()) {
+		const pluginName = plugin.manifest.name;
+		const hook = plugin.hooks?.apiRoutes;
+		if (!hook) continue;
+		const app = hook({
+			...basePluginContext(plugin),
+			eventStats: createPluginConversationEventStats(plugin),
+			users: { resolve: resolveViewerUser }
+		});
+		if (app === void 0) continue;
+		if (!isRecord(app) || typeof app.fetch !== "function") throw new Error(`Plugin apiRoutes hook from plugin "${pluginName}" must return a fetch-compatible app`);
+		routes.push({
+			app,
+			pluginName
+		});
+	}
+	return routes;
+}
+/** Return only absolute HTTP(S) URLs that Slack can render as footer links. */
+function trustedSlackConversationUrl(pluginName, link) {
+	const url = typeof link?.url === "string" ? link.url.trim() : "";
+	if (!url) return;
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch (error) {
+		throw new Error(`Plugin "${pluginName}" slackConversationLink must return an absolute http(s) URL`, { cause: error });
+	}
+	if (parsed.protocol !== "http:" && parsed.protocol !== "https:") throw new Error(`Plugin "${pluginName}" slackConversationLink must return an absolute http(s) URL`);
+	return parsed.toString();
+}
+/** Resolve the first plugin conversation URL for finalized Slack footers. */
+function getPluginSlackConversationLink(conversationId) {
+	for (const plugin of getPlugins()) {
+		const pluginName = plugin.manifest.name;
+		const hook = plugin.hooks?.slackConversationLink;
+		if (!hook) continue;
+		const url = trustedSlackConversationUrl(pluginName, hook({
+			...basePluginContext(plugin),
+			conversationId
+		}));
+		if (url) return { url };
+	}
+}
+function pluginReadState(state) {
+	return { get: state.get };
+}
+function operationalReportText(value, maxLength) {
+	if (typeof value !== "string") return;
+	const trimmed = value.trim();
+	if (!trimmed) return;
+	return trimmed.length <= maxLength ? trimmed : `${trimmed.slice(0, Math.max(0, maxLength - 3))}...`;
+}
+function operationalReportTone(tone) {
+	return tone === "danger" || tone === "good" || tone === "neutral" || tone === "warning" ? tone : void 0;
+}
+function sanitizeOperationalReport(args) {
+	const metrics = args.report.metrics?.slice(0, OPERATIONAL_REPORT_MAX_METRICS).map((metric) => {
+		const label = operationalReportText(metric.label, OPERATIONAL_REPORT_MAX_LABEL_LENGTH);
+		const value = operationalReportText(metric.value, OPERATIONAL_REPORT_MAX_VALUE_LENGTH);
+		if (!label || !value) return;
+		const sanitizedMetric = {
+			label,
+			value
+		};
+		const tone = operationalReportTone(metric.tone);
+		if (tone) sanitizedMetric.tone = tone;
+		return sanitizedMetric;
+	}).filter((metric) => Boolean(metric));
+	const recordSets = args.report.recordSets?.slice(0, OPERATIONAL_REPORT_MAX_RECORD_SETS).map((recordSet, recordSetIndex) => {
+		const title = operationalReportText(recordSet.title, OPERATIONAL_REPORT_MAX_LABEL_LENGTH);
+		if (!title) return;
+		const fields = recordSet.fields?.slice(0, OPERATIONAL_REPORT_MAX_FIELDS).map((field) => {
+			const key = operationalReportText(field.key, OPERATIONAL_REPORT_MAX_LABEL_LENGTH);
+			const label = operationalReportText(field.label, OPERATIONAL_REPORT_MAX_LABEL_LENGTH);
+			return key && label ? {
+				key,
+				label
+			} : void 0;
+		}).filter((field) => Boolean(field));
+		const records = recordSet.records?.slice(0, OPERATIONAL_REPORT_MAX_RECORDS).map((record, recordIndex) => {
+			const sanitizedRecord = {
+				id: operationalReportText(record.id, OPERATIONAL_REPORT_MAX_LABEL_LENGTH) ?? `${recordSetIndex}:${recordIndex}`,
+				values: Object.fromEntries((fields ?? []).map((field) => [field.key, operationalReportText(record.values[field.key], OPERATIONAL_REPORT_MAX_VALUE_LENGTH) ?? ""]))
+			};
+			const tone = operationalReportTone(record.tone);
+			if (tone) sanitizedRecord.tone = tone;
+			return sanitizedRecord;
+		});
+		const sanitizedRecordSet = { title };
+		if (fields?.length) sanitizedRecordSet.fields = fields;
+		const emptyText = operationalReportText(recordSet.emptyText, OPERATIONAL_REPORT_MAX_VALUE_LENGTH);
+		if (emptyText) sanitizedRecordSet.emptyText = emptyText;
+		if (records?.length) sanitizedRecordSet.records = records;
+		return sanitizedRecordSet;
+	}).filter((recordSet) => Boolean(recordSet));
+	const widgets = args.report.widgets?.slice(0, OPERATIONAL_REPORT_MAX_WIDGETS).map((widget, widgetIndex) => {
+		const id = operationalReportText(widget.id, OPERATIONAL_REPORT_MAX_LABEL_LENGTH) ?? String(widgetIndex);
+		const title = operationalReportText(widget.title, OPERATIONAL_REPORT_MAX_LABEL_LENGTH);
+		if (!title) return;
+		const seriesEntries = widget.series.slice(0, OPERATIONAL_REPORT_MAX_CHART_SERIES).map((item) => {
+			const key = operationalReportText(item.key, OPERATIONAL_REPORT_MAX_LABEL_LENGTH);
+			const label = operationalReportText(item.label, OPERATIONAL_REPORT_MAX_LABEL_LENGTH);
+			if (!key || !label) return;
+			const sanitizedSeries = {
+				key,
+				label
+			};
+			if (item.format === "usd") sanitizedSeries.format = "usd";
+			const tone = operationalReportTone(item.tone);
+			if (tone) sanitizedSeries.tone = tone;
+			return {
+				sanitizedSeries,
+				sourceKey: item.key
+			};
+		}).filter((item) => Boolean(item));
+		if (!seriesEntries.length) return;
+		const series = seriesEntries.map((item) => item.sanitizedSeries);
+		const sanitizedWidget = {
+			categories: widget.categories.slice(-100).map((category, categoryIndex) => ({
+				id: operationalReportText(category.id, OPERATIONAL_REPORT_MAX_LABEL_LENGTH) ?? `${widgetIndex}:${categoryIndex}`,
+				label: operationalReportText(category.label, OPERATIONAL_REPORT_MAX_LABEL_LENGTH) ?? String(categoryIndex + 1),
+				values: Object.fromEntries(seriesEntries.map(({ sanitizedSeries, sourceKey }) => [sanitizedSeries.key, Number.isFinite(category.values[sourceKey]) ? category.values[sourceKey] : 0]))
+			})),
+			id,
+			series,
+			title,
+			type: "bar_chart"
+		};
+		const description = operationalReportText(widget.description, OPERATIONAL_REPORT_MAX_VALUE_LENGTH);
+		if (description) sanitizedWidget.description = description;
+		const emptyText = operationalReportText(widget.emptyText, OPERATIONAL_REPORT_MAX_VALUE_LENGTH);
+		if (emptyText) sanitizedWidget.emptyText = emptyText;
+		const timeRangeDays = widget.timeRangeDays?.filter((days) => days === 1 || days === 7 || days === 30 || days === 90);
+		if (timeRangeDays?.length) sanitizedWidget.timeRangeDays = [...new Set(timeRangeDays)];
+		return sanitizedWidget;
+	}).filter((widget) => Boolean(widget));
+	const sanitized = { pluginName: args.pluginName };
+	const generatedAt = operationalReportText(args.report.generatedAt, OPERATIONAL_REPORT_MAX_VALUE_LENGTH);
+	if (generatedAt) sanitized.generatedAt = generatedAt;
+	if (recordSets?.length) sanitized.recordSets = recordSets;
+	if (metrics?.length) sanitized.metrics = metrics;
+	if (widgets?.length) sanitized.widgets = widgets;
+	const title = operationalReportText(args.report.title, OPERATIONAL_REPORT_MAX_LABEL_LENGTH);
+	if (title) sanitized.title = title;
+	return sanitized;
+}
+function failedOperationalReport(args) {
+	return {
+		generatedAt: new Date(args.nowMs).toISOString(),
+		pluginName: args.pluginName,
+		metrics: [{
+			label: "report",
+			tone: "danger",
+			value: "failed"
+		}],
+		title: args.pluginName,
+		recordSets: [{
+			emptyText: "This plugin report failed to load.",
+			title: "Error"
+		}]
+	};
+}
+/** Collect read-only operational summaries exposed by plugins. */
+async function getPluginOperationalReports(nowMs) {
+	const reports = [];
+	for (const plugin of getPlugins()) {
+		const pluginName = plugin.manifest.name;
+		const hook = plugin.hooks?.operationalReport;
+		if (!hook) continue;
+		try {
+			const state = createPluginState(pluginName);
+			const report = await hook({
+				...basePluginContext(plugin),
+				eventStats: createPluginConversationEventStats(plugin, () => nowMs),
+				nowMs,
+				state: pluginReadState(state)
+			});
+			if (!report) continue;
+			reports.push(sanitizeOperationalReport({
+				pluginName,
+				report
+			}));
+		} catch (error) {
+			createPluginLogger(pluginName).error("Plugin operational report failed", { error: error instanceof Error ? error.message : String(error) });
+			reports.push(failedOperationalReport({
+				nowMs,
+				pluginName
+			}));
+		}
+	}
+	return reports;
+}
+/** Collect person-scoped plugin reports for one profile subject. */
+async function getPluginProfileReports(args) {
+	const reports = [];
+	for (const plugin of getPlugins()) {
+		const pluginName = plugin.manifest.name;
+		const hook = plugin.hooks?.profileReport;
+		if (!hook) continue;
+		try {
+			const state = createPluginState(pluginName);
+			const report = await hook({
+				...basePluginContext(plugin),
+				nowMs: args.nowMs,
+				state: pluginReadState(state),
+				subject: args.subject,
+				viewer: args.viewer
+			});
+			if (!report) continue;
+			reports.push(sanitizeOperationalReport({
+				pluginName,
+				report
+			}));
+		} catch (error) {
+			createPluginLogger(pluginName).error("Plugin profile report failed", { error: error instanceof Error ? error.message : String(error) });
+		}
+	}
+	return reports;
+}
+function normalizeEnv(value) {
+	if (!isRecord(value)) return {};
+	const env = {};
+	for (const [key, rawValue] of Object.entries(value)) if (typeof rawValue === "string") env[key] = rawValue;
+	return env;
+}
+function preparationSignal(inputSignal, ownerSignal) {
+	if (!inputSignal) return ownerSignal;
+	if (!ownerSignal) return inputSignal;
+	return AbortSignal.any([inputSignal, ownerSignal]);
+}
+function createSandboxCapability(workspace, ownerSignal) {
+	return {
+		root: SANDBOX_WORKSPACE_ROOT,
+		juniorRoot: `${SANDBOX_WORKSPACE_ROOT}/.junior`,
+		async readFile(filePath) {
+			return await workspace.readFileToBuffer({ path: filePath }) ?? null;
+		},
+		async run(input) {
+			const signal = preparationSignal(input.signal, ownerSignal);
+			const result = await runNonInteractiveCommand(workspace, {
+				...input,
+				...signal ? { signal } : void 0
+			});
+			return {
+				exitCode: result.exitCode,
+				stdout: result.stdout,
+				stderr: result.stderr
+			};
+		},
+		async writeFile(input) {
+			await workspace.writeFiles([{
+				path: input.path,
+				content: input.content,
+				...input.mode !== void 0 ? { mode: input.mode } : void 0
+			}]);
+		}
+	};
+}
+/** Create one runner over runtime hook plugins registered by the app. */
+function createPluginHookRunner(input = {}) {
+	const loaded = getPlugins();
+	return {
+		async afterMcpTool(tool) {
+			for (const plugin of loaded) {
+				if (plugin.manifest.name !== tool.provider) continue;
+				const hook = plugin.hooks?.afterMcpTool;
+				if (!hook) continue;
+				const annotations = tool.conversationId ? createPluginAnnotations({
+					conversationId: tool.conversationId,
+					db: getDb(),
+					plugin: plugin.manifest.name
+				}) : void 0;
+				try {
+					await hook({
+						...basePluginContext(plugin),
+						...tool.conversationId ? { conversationId: tool.conversationId } : void 0,
+						...annotations ? { annotations } : void 0,
+						result: tool.structuredContent !== void 0 ? { structuredContent: tool.structuredContent } : {},
+						tool: {
+							arguments: tool.arguments,
+							name: tool.toolName
+						}
+					});
+				} catch (error) {
+					logWarn("agent.plugin.after_mcp_tool.failed", {
+						"app.plugin.name": plugin.manifest.name,
+						"gen_ai.tool.name": tool.toolName,
+						"exception.message": error instanceof Error ? error.message : String(error)
+					});
+				}
+			}
+		},
+		async prepareWorkspace(sandbox, repos, signal) {
+			const preparers = new Set(loaded.filter((plugin) => plugin.hooks?.workspacePrepare).map((plugin) => plugin.manifest.name));
+			const unhandledProviders = [...new Set(repos.map((repo) => repo.provider).filter((provider) => !preparers.has(provider)))].sort();
+			if (unhandledProviders.length > 0) throw new Error(`Workspace repository providers have no preparation hook: ${unhandledProviders.join(", ")}`);
+			const selectedRepos = repos.map((repo) => ({
+				provider: repo.provider,
+				repo: repo.repo,
+				path: workspaceRepoCheckoutPath(repo.repo)
+			}));
+			const paths = /* @__PURE__ */ new Set();
+			for (const entry of selectedRepos) {
+				const key = entry.path.toLowerCase();
+				if (paths.has(key)) throw new Error(`Workspace checkout path collision: ${entry.path}`);
+				paths.add(key);
+			}
+			const sandboxCapability = createSandboxCapability(sandbox, signal);
+			for (const plugin of loaded) {
+				const hook = plugin.hooks?.workspacePrepare;
+				if (!hook) continue;
+				const selected = selectedRepos.filter((repo) => repo.provider === plugin.manifest.name).map((repo) => ({
+					path: repo.path,
+					repo: repo.repo
+				}));
+				if (selected.length === 0) continue;
+				await hook({
+					...basePluginContext(plugin),
+					repos: selected,
+					sandbox: sandboxCapability
+				});
+			}
+		},
+		async prepareSandbox(sandbox) {
+			const sandboxCapability = createSandboxCapability(sandbox);
+			for (const plugin of loaded) {
+				const pluginName = plugin.manifest.name;
+				const hook = plugin.hooks?.sandboxPrepare;
+				if (!hook) continue;
+				logInfo("agent.plugin.sandbox_preparation.started", { "app.plugin.name": pluginName });
+				await hook({
+					...basePluginContext(plugin),
+					actor: input.actor,
+					sandbox: sandboxCapability
+				});
+			}
+		},
+		async beforeToolExecute(tool) {
+			const env = {};
+			let nextInput = { ...tool.input };
+			const actors = input.actors?.() ?? (input.actor ? [input.actor] : []);
+			for (const plugin of loaded) {
+				const pluginName = plugin.manifest.name;
+				const hook = plugin.hooks?.beforeToolExecute;
+				if (!hook) continue;
+				let replacement;
+				let denied;
+				await hook({
+					...basePluginContext(plugin),
+					actor: input.actor,
+					actors,
+					tool: {
+						name: tool.name,
+						input: nextInput
+					},
+					users: { resolveActor: async () => input.actor ? await readActorIdentity(input.actor) : void 0 },
+					env: {
+						get(key) {
+							return env[key] ?? normalizeEnv(nextInput.env)[key];
+						},
+						set(key, value) {
+							env[key] = value;
+						}
+					},
+					decision: {
+						deny(message) {
+							denied = message;
+						},
+						replaceInput(input) {
+							replacement = input;
+						}
+					}
+				});
+				if (denied) throw new PluginHookDeniedError(denied);
+				if (replacement !== void 0) {
+					if (!isRecord(replacement)) throw new Error(`Plugin "${pluginName}" replaced tool input with a non-object value`);
+					nextInput = { ...replacement };
+				}
+			}
+			return {
+				input: nextInput,
+				env
+			};
+		}
+	};
+}
+//#endregion
+export { RESOURCE_SUBSCRIPTION_DEFAULT_TTL_MS as $, bindEventTaskCredentialSubject as A, sanitizePostgresJson as At, getSlackClient as B, parseDestination as Bt, setWorkspaceSnapshotBuild as C, getConversationEventStore as Ct, tryWorkspaceRepoCheckoutPath as D, getSqlExecutor as Dt, getWorkspaceSnapshotBuilder as E, getDb as Et, verifySlackDirectCredentialSubject as F, resolveRootConversationId as Ft, withSlackRetries as G, isDmChannel as H, sameDestination as Ht, SlackActionError as I, deleteProviderIdentityForSlackUser as It, findUserByEmail as J, getWorkspaceTeamId as K, downloadPrivateSlackFile as L, upsertIdentity as Lt, bindSlackDirectCredentialSubject as M, locationFromRow as Mt, verifyEventTaskCredentialSubject as N, bindProviderConversation as Nt, workspaceRepoCheckoutPath as O, createSqlConversationEventStore as Ot, verifyScheduledTaskCredentialSubject as P, parseSessionSource as Pt, getSlackToolContext as Q, getFilePermalink as R, upsertLinkedIdentity as Rt, setWorkspaceSnapshot as S, db_exports as St, deleteWorkspaceSnapshotBuilders as T, getConversationStore as Tt, normalizeSlackConversationId as U, isConversationScopedChannel as V, requireSlackDestination as Vt, runWithSlackInstallationToken as W, resolveViewerUser as X, readActorIdentity as Y, updateViewerDisplayName as Z, listWorkspaces as _, createPluginLogger as _t, getPluginRoutes as a, collectResourceEventMatchKeys as at, invalidateReadySnapshot as b, listConversationAnnotations as bt, getPluginTools as c, findMatchingResourceEventSubscriptions as ct, setPlugins as d, getDashboardConversationLink as dt, RESOURCE_SUBSCRIPTION_MAX_TTL_MS as et, validatePlugins as f, getDashboardTaskLink as ft, getWorkspaceByName as g, createPluginModel as gt, getWorkspace as h, createPluginEmbedder as ht, getPluginApiRoutes as i, cancelSubscriptions as it, bindScheduledTaskCredentialSubject as j, withConversationMutationLock as jt, resolveChannelCapabilities as k, withConversationEventLock as kt, getPluginUserPromptContributions as l, listResourceEventSubscriptions as lt, deleteWorkspace as m, createPluginState as mt, applyPluginFormatMarkdown as n, STOP_WATCHING_TOOL_NAME as nt, getPluginSlackConversationLink as o, createResourceEventSubscription as ot, createWorkspace as p, setDashboardConversationLinkOptions as pt, runWithWorkspaceTeamId as q, createPluginHookRunner as r, cancelResourceEventSubscription as rt, getPluginSystemPromptContributions as s, deliverResourceEventSubscription as st, agent_hooks_exports as t, RESOURCE_WATCH_TOOL_SOURCE as tt, getPlugins as u, JUNIOR_THREAD_STATE_TTL_MS as ut, updateWorkspace as v, createPluginConversationEvents as vt, SANDBOX_RUNTIME as w, getConversationMessageSearchStore as wt, loadSnapshotsForProfile as x, listConversationAnnotationsById as xt, WorkspaceValidationError as y, renderPluginConversationEvent as yt, getHeaderString as z, createSlackDestination as zt };