@sentry/junior 0.256.0 → 0.258.0

package/dist/app.js

@@ -1,38 +1,39 @@
-import { At as consumeSandboxEgressPermissionDeniedSignal, B as effectiveTaskOutcomes, Ct as ingestEvent, Dt as SANDBOX_EGRESS_PROXY_PATH, E as requestAttachmentDeletion, Et as shouldPropagateSandboxEgressTrace, F as logScheduledAutomationRunSkipped, I as scheduledAutomationRunAttributes, It as startOAuthFlow, Kt as getConfigDefaults, Lt as createUserTokenStore, Nt as formatProviderLabel, O as parseSlackThreadId, Ot as clearSandboxEgressSignals, St as processWorkspaceSnapshotJob, Tt as normalizeSandboxEgressTracePropagationDomains, U as stopConversationSession, W as recordSubagentEnded, b as unpublishedArtifactHeaders, i as executeCredentialedEgressRequest, jt as parseSandboxEgressCredentialToken, kt as consumeSandboxEgressAuthRequiredSignal, lt as listPendingAgentInvocationMailboxAppends, n as executeAgentRun, qt as setConfigDefaults, t as createAgentRunner, ut as listPendingAgentInvocationResults, v as publicArtifactHeaders, w as collectAttachmentGarbage, wt as resolveSandboxEgressProviderForHost, x as lookupSlackUserProfile, y as readPublicArtifact } from "./agent-runner-C6_cd61V.js";
-import { C as withLogContext, O as JUNIOR_PLUGIN_TASK_CALLBACK_ROUTE, S as withContext, d as logException, f as logInfo, j as JUNIOR_WORKSPACE_SNAPSHOT_JOB_CALLBACK_ROUTE, p as logWarn, r as createRequestContext, v as setSpanAttributes, w as withSpan, y as setSpanStatus } from "./logging-tPQeUe2i.js";
-import { n as captureMessage, r as continueTrace } from "./sentry-CgWZM_kV.js";
-import { t as JUNIOR_VERSION } from "./version-DBc4Qt_P.js";
-import { _ as snapshotRuntimeConfig, d as restoreRuntimeConfig, f as setBotModelConfig, g as setSlackReactionConfig, h as setRuntimeLimits, i as getChatConfig, m as setProfiles, n as botConfig, o as getSlackBotToken, p as setCrossActorMidRunMode, u as resetRuntimeConfig } from "./config-DdBiDanf.js";
-import { _ as slackMessageTsSchema, d as parseSlackTeamId, f as parseSlackUserId, h as slackUserIdSchema, m as slackTeamIdSchema, o as parseActorUserId, p as slackChannelIdSchema } from "./actor-BTtLaeWy.js";
-import { c as getConversationEventStore, d as getDb, f as getSqlExecutor, g as withConversationMutationLock, m as withConversationEventLock, r as readActorIdentity, u as getConversationStore } from "./viewer-C-9nFKYr.js";
-import { a as juniorAgentInvocations, d as juniorDestinations, i as juniorAgentBindings, s as juniorConversations } from "./agent-invocations-BY60iNw-.js";
-import { f as juniorConversationBriefs, h as juniorConversationEvents, o as juniorAutomationRuns, s as juniorAutomations } from "./executor-BroK9oKy.js";
-import { n as pluginCatalogRuntime } from "./catalog-runtime-DF5OWqCc.js";
-import { Gt as projectConversationMessages, H as slackEntitySchema, Ht as appendConversationMessages, Jt as settleConversationTitleWork, N as slackMention, U as slackExternalRefIdSchema, b as admitEventAutomationRun, c as withScheduledAutomationLock, i as readScheduledAutomation, l as blockEventAutomation, n as listScheduledAutomationsForTeam, o as saveScheduledAutomationInLock, p as findMatchingEventAutomations, s as scheduledRunId, u as collectEventAutomationMatchKeys, x as eventAutomationRunLimitReason } from "./tasks-CODtRzvX.js";
-import { $ as bindSlackDirectCredentialSubject, At as resolveRootVisibility, Ht as getSlackClient, Jt as getWorkspaceTeamId, Nt as listConversationAnnotations, Q as bindScheduledAutomationCredentialSubject, U as collectEventMatchKeys, Wt as isDmChannel, X as takeDueTimerWatches, Yt as runWithWorkspaceTeamId, Z as bindEventAutomationCredentialSubject, a as getPluginRoutes, at as getDashboardConversationLink, ct as setDashboardConversationLinkOptions, d as setPlugins, et as verifyEventAutomationCredentialSubject, f as validatePlugins, ft as createPluginLogger, h as setBriefsConfig, i as getPluginApiRoutes, lt as createPluginState, nt as verifySlackDirectCredentialSubject, pt as readConversationAccessFromSql, q as findMatchingWatches, st as getDashboardTaskLink, tt as verifyScheduledAutomationCredentialSubject, u as getPlugins } from "./agent-hooks-DlSK8PQQ.js";
-import { W as annotationCard } from "./conversation-T18Xlkx9.js";
-import { O as withLock$1, w as getStateAdapter } from "./profile-Bb1zCVGP.js";
-import { c as getThreadStopDecision } from "./pending-auth-DT3MRVW8.js";
-import { O as renderTaskInput, f as slackChannelMessageEvent, l as getEventCatalog, p as slackChannelMessageReplyThreadTs, u as SLACK_EVENT_NAMESPACE, y as eventGuidance } from "./session-stop-q-6GNHx6.js";
-import { n as getNextRunAtMs } from "./cadence-D00SCzT1.js";
-import { f as setSandboxResourceConfig, u as getSandboxResourceConfig } from "./resolve-B6ZZ9duG.js";
-import { a as getVercelConversationWorkQueue, g as isConversationQueueMessageRejectedError, h as conversationQueueMessageSchema, i as verifyWorkspaceSnapshotJobMessage, o as resolveConversationWorkQueueTopic, s as verifyConversationQueueMessage, t as WORKSPACE_SNAPSHOT_JOB_QUEUE_TOPIC } from "./job-queue-BbGg3gvu.js";
-import { A as hasRunnableConversationWork$1, M as isInvalidConversationRecordError, O as CONVERSATION_WORK_STALE_ENQUEUE_MS, S as removeActiveConversation, _ as hasRunnableConversationWork, c as clearExpiredConversationLease, g as getConversationWorkState, h as getConversation, m as ensureConversationWake, r as appendAndEnqueueInboundMessage, v as listActiveConversationIds } from "./store-D2It0ozF.js";
-import { D as scheduledRunSchema } from "./automation-CHdlHVZP.js";
-import { i as setExperimentalFeatures, n as getExperimentalFeatures, r as isExperimentalFeatureEnabled } from "./experimental-Qn9rKLgx.js";
-import { n as validatePluginRegistrations, t as validatePluginEgressCredentialHooks } from "./validation-DCd69-cP.js";
-import { a as pluginRuntimeRegistrationsFromPluginSet, n as pluginCatalogConfigFromEnv, r as pluginCatalogConfigFromPluginSet, t as defineJuniorPlugins } from "./plugins-egKWjgue.js";
-import { A as withNormalizedThreadId, C as buildSlackInboundMessage, D as isSlackMessageStopped, E as verifySlackSignature, F as renderSlackObjectCard, I as createVercelAttachmentStorage, M as THREAD_OPTOUT_ACK, N as startProcessingReaction, O as stopSlackThread, P as parseContent, R as enqueueAgentDispatch, S as recordSkippedConversationMessage, T as runWithSlackInstallation, a as recordWebConversationActivity, c as createProductionSlackWebhookServices, f as createSlackWebApiStatusSender, j as stopConversationTurn, k as normalizeIncomingSlackThreadId, l as getProductionSlackAdapter, n as conversationTurnIdForMessage, o as webActorFromEmail, s as createProductionConversationWorkOptions, t as appendAndEnqueueWebMessage, v as readViewerAutomationSummary, w as clearSlackPendingReactions, z as GET$3 } from "./web-input-Cv42P3ni.js";
-import { M as recordAutomationExecution, S as existingConversationId, a as confirmDispatchMailboxAppend, b as notifyAutomationBlocked, f as getPluginDispatchProjection, m as listPendingDispatchMailboxAppends, o as createOrGetDispatch, p as isTerminalDispatchStatus, s as getDispatchConversationId, t as processPluginTask, u as getDispatchRecord, v as markDispatchFailed } from "./task-runner-cIGU5VwJ.js";
-import { o as getAuthPausedConversationTurnId, t as enqueueAgentInvocationResult } from "./result-j9nS0se-.js";
-import { r as enqueueAgentInvocation } from "./work-6UmVQq1V.js";
-import { s as coerceThreadConversationState } from "./thread-state-BPkwVmvK.js";
-import { o as unlinkProvider } from "./connections-CG04HdpC.js";
-import { a as GET$4, i as publishAppHomeView, r as GET$5, t as receiveLocalOAuthCredential } from "./credential-sync-DKWNdcgm.js";
-import { a as registerVercelPluginTaskDevConsumer, n as createVercelPluginTaskCallback, s as queueCallback } from "./task-queue-ZMk9bLRT.js";
-import { t as processConversationWork } from "./worker-DAoBZuZn.js";
-import { t as bindMessageAgent } from "./message-DdPGRYQP.js";
-import { t as bindSpawnAgent } from "./spawn-Do5mX3d_.js";
+import { At as consumeSandboxEgressPermissionDeniedSignal, B as effectiveTaskOutcomes, Ct as ingestEvent, Dt as SANDBOX_EGRESS_PROXY_PATH, E as requestAttachmentDeletion, Et as shouldPropagateSandboxEgressTrace, F as logScheduledAutomationRunSkipped, Ft as resolveBaseUrl, I as scheduledAutomationRunAttributes, It as startOAuthFlow, Kt as getConfigDefaults, Lt as createUserTokenStore, Nt as formatProviderLabel, O as parseSlackThreadId, Ot as clearSandboxEgressSignals, St as processWorkspaceSnapshotJob, Tt as normalizeSandboxEgressTracePropagationDomains, U as stopConversationSession, W as recordSubagentEnded, b as unpublishedArtifactHeaders, i as executeCredentialedEgressRequest, jt as parseSandboxEgressCredentialToken, kt as consumeSandboxEgressAuthRequiredSignal, lt as listPendingAgentInvocationMailboxAppends, n as executeAgentRun, qt as setConfigDefaults, t as createAgentRunner, ut as listPendingAgentInvocationResults, v as publicArtifactHeaders, w as collectAttachmentGarbage, wt as resolveSandboxEgressProviderForHost, x as lookupSlackUserProfile, y as readPublicArtifact } from "./agent-runner-DGsFQw72.js";
+import { C as withContext, M as JUNIOR_WORKSPACE_SNAPSHOT_JOB_CALLBACK_ROUTE, R as normalizeIdentityEmail, T as withSpan, b as setSpanStatus, f as logException, k as JUNIOR_PLUGIN_TASK_CALLBACK_ROUTE, m as logWarn, p as logInfo, r as createRequestContext, v as setSentryUser, w as withLogContext, y as setSpanAttributes } from "./logging-DsHONhVm.js";
+import { n as captureMessage, r as continueTrace } from "./sentry-BBUlHih9.js";
+import { t as JUNIOR_VERSION } from "./version-C0U6rHg0.js";
+import { _ as snapshotRuntimeConfig, d as restoreRuntimeConfig, f as setBotModelConfig, g as setSlackReactionConfig, h as setRuntimeLimits, i as getChatConfig, m as setProfiles, n as botConfig, o as getSlackBotToken, p as setCrossActorMidRunMode, u as resetRuntimeConfig } from "./config-_WO_AjCB.js";
+import { _ as slackMessageTsSchema, d as parseSlackTeamId, f as parseSlackUserId, h as slackUserIdSchema, m as slackTeamIdSchema, o as parseActorUserId, p as slackChannelIdSchema } from "./actor-tlxzqaRe.js";
+import { N as recordGoogleSignIn, _ as withConversationMutationLock, c as getConversationEventStore, d as getDb, f as getSqlExecutor, m as withConversationEventLock, r as readActorIdentity, u as getConversationStore } from "./viewer-CGvvRqKp.js";
+import { a as juniorAgentInvocations, d as juniorDestinations, i as juniorAgentBindings, s as juniorConversations } from "./agent-invocations-Qfz7dWgU.js";
+import { a as juniorAutomationRuns, f as juniorConversationBriefs, h as juniorConversationEvents, s as juniorAutomations } from "./executor-RvG6kVe1.js";
+import { m as credentialLogContext } from "./registry-Du566MtJ.js";
+import { n as pluginCatalogRuntime } from "./catalog-runtime-BN4DVxco.js";
+import { C as automationVersionOf, Kt as projectConversationMessages, P as slackMention, U as slackEntitySchema, Ut as appendConversationMessages, W as slackExternalRefIdSchema, Yt as settleConversationTitleWork, b as admitEventAutomationRun, c as withScheduledAutomationLock, i as readScheduledAutomation, l as blockEventAutomation, n as listScheduledAutomationsForTeam, o as saveScheduledAutomationInLock, p as findMatchingEventAutomations, s as scheduledRunId, u as collectEventAutomationMatchKeys, x as eventAutomationRunLimitReason } from "./tasks-CEXKTASS.js";
+import { $ as bindSlackDirectCredentialSubject, At as resolveRootVisibility, Ht as getSlackClient, Jt as getWorkspaceTeamId, Nt as listConversationAnnotations, Q as bindScheduledAutomationCredentialSubject, U as collectEventMatchKeys, Wt as isDmChannel, X as takeDueTimerWatches, Yt as runWithWorkspaceTeamId, Z as bindEventAutomationCredentialSubject, a as getPluginRoutes, at as getDashboardConversationLink, ct as setDashboardConversationLinkOptions, d as setPlugins, et as verifyEventAutomationCredentialSubject, f as validatePlugins, ft as createPluginLogger, h as setBriefsConfig, i as getPluginApiRoutes, lt as createPluginState, nt as verifySlackDirectCredentialSubject, pt as readConversationAccessFromSql, q as findMatchingWatches, st as getDashboardTaskLink, tt as verifyScheduledAutomationCredentialSubject, u as getPlugins } from "./agent-hooks-BJ_5mlRH.js";
+import { W as annotationCard } from "./conversation-DjN3mlog.js";
+import { O as withLock$1, w as getStateAdapter } from "./profile-DpYjfKke.js";
+import { l as getThreadStopDecision, o as SubscribedReplyReason } from "./pending-auth-D8J1uJUS.js";
+import { b as eventGuidance, f as slackChannelMessageEvent, k as renderTaskInput, l as getEventCatalog, m as slackChannelMessageRunsAutomation, p as slackChannelMessageReplyThreadTs, u as SLACK_EVENT_NAMESPACE } from "./session-stop-CIoFiwwe.js";
+import { n as getNextRunAtMs } from "./cadence-R7Em4RjE.js";
+import { f as setSandboxResourceConfig, u as getSandboxResourceConfig } from "./resolve-ClCIgh8E.js";
+import { a as getVercelConversationWorkQueue, g as isConversationQueueMessageRejectedError, h as conversationQueueMessageSchema, i as verifyWorkspaceSnapshotJobMessage, o as resolveConversationWorkQueueTopic, s as verifyConversationQueueMessage, t as WORKSPACE_SNAPSHOT_JOB_QUEUE_TOPIC } from "./job-queue-DVe37it2.js";
+import { A as hasRunnableConversationWork$1, M as isInvalidConversationRecordError, O as CONVERSATION_WORK_STALE_ENQUEUE_MS, S as removeActiveConversation, _ as hasRunnableConversationWork, c as clearExpiredConversationLease, g as getConversationWorkState, h as getConversation, m as ensureConversationWake, r as appendAndEnqueueInboundMessage, v as listActiveConversationIds } from "./store-DJLwq4x8.js";
+import { D as scheduledRunSchema } from "./automation-DWBFBenG.js";
+import { i as setExperimentalFeatures, n as getExperimentalFeatures, r as isExperimentalFeatureEnabled } from "./experimental-BNK1l1jv.js";
+import { n as validatePluginRegistrations, t as validatePluginEgressCredentialHooks } from "./validation-BHRxa5G4.js";
+import { a as pluginRuntimeRegistrationsFromPluginSet, n as pluginCatalogConfigFromEnv, r as pluginCatalogConfigFromPluginSet, t as defineJuniorPlugins } from "./plugins-DOm9Y6qI.js";
+import { A as THREAD_OPTOUT_ACK, C as buildSlackInboundMessage, D as normalizeIncomingSlackThreadId, E as stopSlackThread, F as renderSlackObjectCard, I as createVercelAttachmentStorage, M as parseContent, N as runWithSlackInstallation, O as withNormalizedThreadId, P as verifySlackSignature, R as enqueueAgentDispatch, S as recordSkippedConversationMessage, T as isSlackMessageStopped, a as recordWebConversationActivity, c as createProductionSlackWebhookServices, f as createSlackWebApiStatusSender, j as startProcessingReaction, k as stopConversationTurn, l as getProductionSlackAdapter, n as conversationTurnIdForMessage, o as webActorFromEmail, s as createProductionConversationWorkOptions, t as appendAndEnqueueWebMessage, v as readViewerAutomationSummary, w as clearSlackPendingReactions, z as GET$3 } from "./web-input-Keb5GRWj.js";
+import { C as existingConversationId, N as recordAutomationExecution, c as getDispatchConversationId, d as getDispatchRecord, h as listPendingDispatchMailboxAppends, i as buildDispatchId, m as isTerminalDispatchStatus, o as confirmDispatchMailboxAppend, p as getPluginDispatchProjection, s as createOrGetDispatch, t as processPluginTask, x as notifyAutomationBlocked, y as markDispatchFailed } from "./task-runner-D3qJh4fK.js";
+import { o as getAuthPausedConversationTurnId, t as enqueueAgentInvocationResult } from "./result-BBbKA61B.js";
+import { r as enqueueAgentInvocation } from "./work-DRcsJ3hV.js";
+import { s as coerceThreadConversationState } from "./thread-state-W3f6kAtz.js";
+import { o as unlinkProvider } from "./connections-ag_1JOhB.js";
+import { a as GET$4, i as publishAppHomeView, r as GET$5, t as receiveLocalOAuthCredential } from "./credential-sync-B-CPX_ag.js";
+import { a as registerVercelPluginTaskDevConsumer, n as createVercelPluginTaskCallback, s as queueCallback } from "./task-queue-BzW4MaWU.js";
+import { t as processConversationWork } from "./worker-Cjo-QqPq.js";
+import { t as bindMessageAgent } from "./message-DyitL8no.js";
+import { t as bindSpawnAgent } from "./spawn-Dqfeo7XP.js";
 import { createRequire } from "node:module";
 import { Hono } from "hono";
 import { z } from "zod";
@@ -44,7 +45,9 @@ import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import { createRemoteJWKSet, decodeJwt, jwtVerify } from "jose";
 import { ChannelImpl, ThreadImpl } from "chat";
 import * as acp from "@agentclientprotocol/sdk";
-//#region src/chat/events/timers.ts
+import { createAuthMiddleware } from "better-auth/api";
+import { betterAuth } from "better-auth/minimal";
+// src/chat/events/timers.ts
 /** Publish a bounded batch of due timers; the mailbox owns agent execution. */
 async function runTimerWatchHeartbeat(args) {
 	const errors = [];
@@ -63,8 +66,7 @@ async function runTimerWatchHeartbeat(args) {
 	}
 	if (errors.length) throw new AggregateError(errors, "Timer Watch delivery failed");
 }
-//#endregion
-//#region src/chat/task-execution/heartbeat.ts
+// src/chat/task-execution/heartbeat.ts
 const DEFAULT_RECOVERY_LIMIT = 25;
 function heartbeatIdempotencyKey(reason, conversationId, nowMs) {
 	return `heartbeat:${reason}:${conversationId}:${nowMs}`;
@@ -163,8 +165,7 @@ async function recoverConversationWork(args) {
 	});
 	return result;
 }
-//#endregion
-//#region src/chat/agent-dispatch/validation.ts
+// src/chat/agent-dispatch/validation.ts
 function hasIssueAtPath(issues, path) {
 	return issues.some((issue) => issue.path.length === path.length && issue.path.every((value, index) => value === path[index]));
 }
@@ -214,8 +215,7 @@ async function verifyDispatchCredentialSubjectAccess(options, plugin) {
 		subject: options.credentialSubject
 	}))) throw new Error("Dispatch credentialSubject is not valid for this action");
 }
-//#endregion
-//#region src/chat/agent-dispatch/context.ts
+// src/chat/agent-dispatch/context.ts
 const MAX_DISPATCHES_PER_HEARTBEAT = 25;
 function bindDispatchCredentialSubject(options, plugin) {
 	const { credentialSubject, ...baseOptions } = options;
@@ -303,7 +303,11 @@ async function dispatchEventAutomation(args) {
 		...unboundOptions,
 		...outcomes !== void 0 ? { outcomes } : void 0,
 		...boundSubject ? { credentialSubject: boundSubject } : void 0,
-		source: { kind: "event_automation" }
+		source: {
+			kind: "event_automation",
+			automationId: args.automationId,
+			automationRunId: buildDispatchId(plugin, unboundOptions.idempotencyKey)
+		}
 	};
 	return await dispatch({
 		conversationWorkQueue: args.conversationWorkQueue,
@@ -326,7 +330,11 @@ async function dispatchScheduledAutomation(args) {
 		...unboundOptions,
 		...outcomes !== void 0 ? { outcomes } : void 0,
 		...boundSubject ? { credentialSubject: boundSubject } : void 0,
-		source: { kind: "scheduled_automation" }
+		source: {
+			kind: "scheduled_automation",
+			automationId: args.automationId,
+			automationRunId: unboundOptions.idempotencyKey
+		}
 	};
 	return await dispatch({
 		conversationWorkQueue: args.conversationWorkQueue,
@@ -342,17 +350,18 @@ async function getScheduledAutomationDispatch(id) {
 		id
 	});
 }
-//#endregion
-//#region src/chat/event-automations/runs.ts
+// src/chat/event-automations/runs.ts
 /**
-* Record a dispatched event automation run and link its Conversation when it
-* exists. The dispatch can finish before this write, so a stored run, or a
-* retry of the same Event, keeps the row it has.
+* Record a dispatched event automation run with the Automation version it ran,
+* and link its Conversation when it exists. The dispatch can finish before
+* this write, so a stored run, or a retry of the same Event, keeps the row it
+* has.
 */
 async function recordEventAutomationRunStarted(db, args) {
 	await db.insert(juniorAutomationRuns).values({
 		id: args.dispatchId,
-		automationId: args.automationId,
+		automationId: args.automation.id,
+		automationVersion: automationVersionOf(args.automation),
 		conversationId: existingConversationId(getDispatchConversationId({ id: args.dispatchId })),
 		startedAtMs: args.nowMs,
 		status: "running"
@@ -380,8 +389,7 @@ async function settleEventAutomationRuns(db, nowMs) {
 		});
 	}
 }
-//#endregion
-//#region src/chat/automations/reply-attribution.ts
+// src/chat/automations/reply-attribution.ts
 /** Name the Automation in the footer of the replies that its runs post. */
 function automationReplyAttribution(title) {
 	const detail = (title ?? "").replace(/\s+/g, " ").trim().slice(0, 128).trim();
@@ -390,8 +398,7 @@ function automationReplyAttribution(title) {
 		detail
 	} : { label: "Automation" };
 }
-//#endregion
-//#region src/chat/scheduled-automations/runs.ts
+// src/chat/scheduled-automations/runs.ts
 const PENDING_CLAIM_STALE_MS = 6e4;
 const MISSED_RUN_MAX_AGE_MS = 864e5;
 const INCOMPLETE_RUN_STATUSES = ["pending", "running"];
@@ -419,9 +426,14 @@ async function readRun(db, runId) {
 	const rows = await db.select().from(juniorAutomationRuns).where(eq(juniorAutomationRuns.id, runId)).limit(1);
 	return rows[0] ? parseScheduledRunRow(rows[0]) : void 0;
 }
-async function writeRun(db, run) {
+/**
+* Save a Scheduled automation run. Pass `automationVersion` only when the run
+* is dispatched. Later writes keep the stored version.
+*/
+async function writeRun(db, run, automationVersion) {
 	const stored = scheduledRunSchema.parse(run);
 	const columns = {
+		...automationVersion ? { automationVersion } : void 0,
 		attempt: stored.attempt,
 		automationId: stored.taskId,
 		claimedAtMs: stored.claimedAtMs,
@@ -588,14 +600,14 @@ async function claimDueScheduledRun(db, args) {
 	for (const skipped of skippedRuns) logScheduledAutomationRunSkipped(skipped.task, skipped.run, { "app.task.run.error": skipped.errorMessage });
 	return claimed;
 }
-async function updateRun(db, runId, update) {
+async function updateRun(db, runId, update, automationVersion) {
 	return await db.transaction(async (tx) => {
 		await tx.execute(sql`SELECT pg_advisory_xact_lock(hashtext(${`junior:scheduler:run:${runId}:lock`}))`);
 		const current = await readRun(tx, runId);
 		if (!current) return void 0;
 		const next = update(current);
 		if (!next) return void 0;
-		await writeRun(tx, next);
+		await writeRun(tx, next, automationVersion);
 		return next;
 	});
 }
@@ -603,14 +615,17 @@ function canFinishRun(run, startedAtMs) {
 	if (run.status === "pending") return startedAtMs === void 0;
 	return run.status === "running" && run.startedAtMs === startedAtMs;
 }
-/** Mark a pending run dispatched only for the active claim. */
+/**
+* Mark a pending run dispatched only for the active claim, and store the
+* version of `task` that the dispatch ran.
+*/
 async function markScheduledRunDispatched(db, args) {
 	return await updateRun(db, args.runId, (run) => run.status === "pending" && run.claimedAtMs === args.claimedAtMs ? {
 		...run,
 		dispatchId: args.dispatchId,
 		startedAtMs: args.nowMs,
 		status: "running"
-	} : void 0);
+	} : void 0, automationVersionOf(args.task));
 }
 /** Complete a run only for its active start timestamp. */
 async function markScheduledRunCompleted(db, args) {
@@ -708,8 +723,7 @@ async function advanceScheduledAutomationAfterRun(db, args) {
 		return args.status === "blocked";
 	});
 }
-//#endregion
-//#region src/chat/scheduled-automations/heartbeat.ts
+// src/chat/scheduled-automations/heartbeat.ts
 const SCHEDULED_AUTOMATION_HEARTBEAT_LIMIT = 10;
 function singleLineMetadataValue(value) {
 	return value.replace(/[\r\n]+/g, " ").replace(/\s+/g, " ").trim();
@@ -940,6 +954,7 @@ async function runScheduledAutomationHeartbeat(args) {
 		let dispatch;
 		try {
 			dispatch = await dispatchScheduledAutomation({
+				automationId: task.id,
 				conversationWorkQueue: args.conversationWorkQueue,
 				nowMs: args.nowMs,
 				options: {
@@ -972,7 +987,8 @@ async function runScheduledAutomationHeartbeat(args) {
 			claimedAtMs: run.claimedAtMs,
 			dispatchId: dispatch.id,
 			nowMs: args.nowMs,
-			runId: run.id
+			runId: run.id,
+			task
 		});
 		logInfo("scheduled_automation.run.dispatched", scheduledAutomationRunAttributes(task, dispatched ?? {
 			...run,
@@ -982,8 +998,7 @@ async function runScheduledAutomationHeartbeat(args) {
 	}
 	return dispatchCount;
 }
-//#endregion
-//#region src/chat/agent-dispatch/heartbeat.ts
+// src/chat/agent-dispatch/heartbeat.ts
 const DEFAULT_PLUGIN_LIMIT = 25;
 const PLUGIN_HEARTBEAT_TIMEOUT_MS = 25e3;
 const DISPATCH_MAILBOX_APPEND_LIMIT = 100;
@@ -1117,8 +1132,7 @@ async function runHeartbeat(args) {
 		nowMs: args.nowMs
 	});
 }
-//#endregion
-//#region src/handlers/heartbeat.ts
+// src/handlers/heartbeat.ts
 function getHeartbeatSecret() {
 	return process.env.JUNIOR_SCHEDULER_SECRET?.trim() || process.env.CRON_SECRET?.trim();
 }
@@ -1143,8 +1157,7 @@ async function GET$2(request, waitUntil, options = {}) {
 	}));
 	return new Response("Accepted", { status: 202 });
 }
-//#endregion
-//#region src/chat/conversations/sql/purge.ts
+// src/chat/conversations/sql/purge.ts
 /** Discover a root and its current descendants via `parent_conversation_id`. */
 async function discoverConversationTree(executor, root) {
 	const all = /* @__PURE__ */ new Map([[root.conversationId, root]]);
@@ -1303,8 +1316,7 @@ async function purgeConversationTree(executor, args) {
 		});
 	});
 }
-//#endregion
-//#region src/chat/conversations/retention.ts
+// src/chat/conversations/retention.ts
 /**
 * Content retention policy and the bounded purge job.
 *
@@ -1380,8 +1392,7 @@ async function runRetentionPurge(executor, args) {
 		attachments: attachmentResult.deleted
 	};
 }
-//#endregion
-//#region src/handlers/retention.ts
+// src/handlers/retention.ts
 function getRetentionSecret() {
 	return process.env.JUNIOR_SCHEDULER_SECRET?.trim() || process.env.CRON_SECRET?.trim();
 }
@@ -1412,8 +1423,7 @@ async function GET$1(request, options = {}) {
 		return new Response("Retention purge failed", { status: 500 });
 	}
 }
-//#endregion
-//#region src/chat/sandbox/egress/oidc.ts
+// src/chat/sandbox/egress/oidc.ts
 const OIDC_DISCOVERY_CACHE_TTL_MS = 36e5;
 const OIDC_DISCOVERY_CACHE_MAX_ENTRIES = 8;
 const jwksByIssuer = /* @__PURE__ */ new Map();
@@ -1465,8 +1475,7 @@ async function verifyVercelSandboxOidcToken(token, options = {}) {
 		...options.currentDate ? { currentDate: options.currentDate } : void 0
 	})).payload;
 }
-//#endregion
-//#region src/chat/sandbox/egress/proxy.ts
+// src/chat/sandbox/egress/proxy.ts
 const OIDC_TOKEN_HEADER = "vercel-sandbox-oidc-token";
 const FORWARDED_HOST_HEADER = "vercel-forwarded-host";
 const FORWARDED_SCHEME_HEADER = "vercel-forwarded-scheme";
@@ -1604,11 +1613,26 @@ function buildUpstreamUrl(request) {
 		};
 	}
 }
+/**
+* Name the Conversation and the accountable person from the verified token.
+* Each proxy request is a new HTTP request with no run log context, so the
+* proxy binds the same fields that the run binds.
+*/
+function sandboxEgressLogContext(context) {
+	return {
+		...context.conversationId ? { conversationId: context.conversationId } : void 0,
+		...credentialLogContext(context.credentials)
+	};
+}
 /** Continue inbound trace context only after sandbox egress verification succeeds. */
-function continueSandboxEgressTrace(request, upstreamHost, tracePropagation, callback) {
+function continueSandboxEgressTrace(request, upstreamHost, tracePropagation, credentialContext, callback) {
 	const sentryTrace = request.headers.get("sentry-trace") ?? void 0;
 	const baggage = request.headers.get("baggage") ?? void 0;
-	const run = () => withSpan("sandbox.egress", "http.server", {}, callback, {
+	const logContext = sandboxEgressLogContext(credentialContext);
+	const run = () => withSpan("sandbox.egress", "http.server", logContext, async () => {
+		setSentryUser(logContext.userId ? { id: logContext.userId } : void 0);
+		return await callback();
+	}, {
 		"http.request.method": request.method,
 		"url.path": redactedProxyPath(new URL(request.url).pathname)
 	});
@@ -1697,7 +1721,7 @@ async function proxySandboxEgressRequest(request, deps = {}) {
 		});
 		return jsonError("Sandbox egress credential context is not authorized", 403);
 	}
-	return await continueSandboxEgressTrace(request, upstreamUrl.hostname, deps.tracePropagation ?? {}, async () => await executeCredentialedEgressRequest({
+	return await continueSandboxEgressTrace(request, upstreamUrl.hostname, deps.tracePropagation ?? {}, credentialContext, async () => await executeCredentialedEgressRequest({
 		activeEgressId,
 		credentialContext,
 		deps,
@@ -1706,8 +1730,7 @@ async function proxySandboxEgressRequest(request, deps = {}) {
 		upstreamUrl
 	}));
 }
-//#endregion
-//#region src/handlers/sandbox-egress-proxy.ts
+// src/handlers/sandbox-egress-proxy.ts
 /** Handles Vercel Sandbox firewall egress proxy requests. */
 async function ALL(request, options = {}) {
 	return await proxySandboxEgressRequest(request, {
@@ -1720,8 +1743,7 @@ async function ALL(request, options = {}) {
 function isSandboxEgressRequest(request) {
 	return isSandboxEgressForwardedRequest(request);
 }
-//#endregion
-//#region src/handlers/sandbox-egress-route.ts
+// src/handlers/sandbox-egress-route.ts
 /**
 * Route authenticated sandbox egress proxy traffic before ordinary app routes.
 */
@@ -1729,8 +1751,7 @@ async function handleSandboxEgressRoute(request, tracePropagationDomains, next)
 	if (isSandboxEgressRequest(request)) return await ALL(request, { tracePropagation: { domains: tracePropagationDomains } });
 	await next();
 }
-//#endregion
-//#region src/handlers/sandbox-egress-signals.ts
+// src/handlers/sandbox-egress-signals.ts
 const SANDBOX_EGRESS_TOKEN_HEADER = "x-junior-sandbox-egress-token";
 function isLoopbackDevelopmentRequest(request) {
 	const hostname = new URL(request.url).hostname;
@@ -1755,8 +1776,7 @@ async function GET(request) {
 		...permissionDenied ? { permission_denied: permissionDenied } : void 0
 	});
 }
-//#endregion
-//#region src/chat/slack/annotation-details.ts
+// src/chat/slack/annotation-details.ts
 const eventSchema$1 = z.object({
 	trigger_id: z.string().min(1),
 	user: z.string().min(1),
@@ -1834,8 +1854,7 @@ async function presentSlackAnnotationDetails(event, teamId) {
 		metadata: slackEntitySchema.parse(entity)
 	});
 }
-//#endregion
-//#region src/chat/ingress/slack-payload.ts
+// src/chat/ingress/slack-payload.ts
 const eventTimestampSchema = slackMessageTsSchema.refine((value) => Number.isFinite((/* @__PURE__ */ new Date(Number(value) * 1e3)).getTime()));
 const slackSlashCommandSchema = z.object({
 	channel_id: z.string().trim().pipe(slackChannelIdSchema),
@@ -1932,8 +1951,173 @@ const slackInteractivePayloadSchema = z.object({
 		team_id: z.string().optional()
 	}).optional()
 });
-//#endregion
-//#region src/chat/ingress/bot-mention.ts
+// src/chat/ingress/slash-command.ts
+async function postEphemeral(event, text) {
+	await event.channel.postEphemeral(event.userId, text, { fallbackToDM: false });
+}
+function getCommandName() {
+	return getChatConfig().slack.slashCommand;
+}
+async function handleLink(event, provider) {
+	if (!pluginCatalogRuntime.isProvider(provider)) {
+		await postEphemeral(event, `Unknown provider: \`${provider}\``);
+		return;
+	}
+	if (!pluginCatalogRuntime.getOAuthConfig(provider)) {
+		await postEphemeral(event, `${formatProviderLabel(provider)} doesn't support account linking.`);
+		return;
+	}
+	const result = await startOAuthFlow(provider, {
+		actorId: event.userId,
+		actor: {
+			platform: "slack",
+			teamId: event.teamId,
+			userId: event.userId
+		},
+		channelId: event.channelId
+	});
+	if (!result.ok) {
+		await postEphemeral(event, `Failed to start linking: ${result.error}`);
+		return;
+	}
+	if (result.delivery === "fallback_dm") await postEphemeral(event, `Check your DMs for a ${formatProviderLabel(provider)} authorization link.`);
+	else if (result.delivery === false) await postEphemeral(event, "I wasn't able to send you a private authorization link. Please try again in a direct message.");
+}
+async function handleUnlink(event, provider) {
+	if (!pluginCatalogRuntime.isProvider(provider)) {
+		await postEphemeral(event, `Unknown provider: \`${provider}\``);
+		return;
+	}
+	if (!(Boolean(pluginCatalogRuntime.getOAuthConfig(provider)) || Boolean(pluginCatalogRuntime.getDefinition(provider)?.manifest.mcp))) {
+		await postEphemeral(event, `${formatProviderLabel(provider)} doesn't support account unlinking.`);
+		return;
+	}
+	const tokenStore = createUserTokenStore();
+	await unlinkProvider(event.userId, provider, tokenStore, event.teamId);
+	logInfo("slash_command.credential.unlinked", { "app.credential.provider": provider });
+	await postEphemeral(event, `Your ${formatProviderLabel(provider)} account has been unlinked.`);
+}
+/** Route link and unlink slash commands to the appropriate OAuth flow. */
+async function handleSlashCommand(event) {
+	const [subcommand, provider, ...rest] = event.text.trim().split(/\s+/);
+	if (!subcommand || !["link", "unlink"].includes(subcommand)) {
+		await postEphemeral(event, `Usage: \`${getCommandName()} link <provider>\` or \`${getCommandName()} unlink <provider>\``);
+		return;
+	}
+	if (!provider || rest.length > 0) {
+		await postEphemeral(event, `Usage: \`${getCommandName()} ${subcommand} <provider>\``);
+		return;
+	}
+	const normalized = provider.toLowerCase();
+	if (subcommand === "link") await handleLink(event, normalized);
+	else await handleUnlink(event, normalized);
+}
+// src/chat/ingress/slack-form.ts
+function parseJson$1(body) {
+	try {
+		return JSON.parse(body);
+	} catch {
+		return;
+	}
+}
+function requireSlackPayloadUserId(value, source) {
+	const userId = parseActorUserId(value);
+	if (!userId) throw new Error(`${source} is missing a Slack user id`);
+	return userId;
+}
+async function handleSlashCommandForm(args) {
+	const { channel_id: channelId, team_id: teamId, user_id: userId } = args.form;
+	const channel = new ChannelImpl({
+		id: `slack:${channelId}`,
+		adapter: args.adapter,
+		stateAdapter: args.state
+	});
+	await withSpan("chat.slash_command", "chat.slash_command", { userId }, async () => {
+		await handleSlashCommand({
+			channel,
+			channelId,
+			teamId,
+			text: args.form.text,
+			userId
+		});
+	});
+}
+async function handleInteractivePayload(args) {
+	if (args.payload.type !== "block_actions") return;
+	const action = args.payload.actions?.find((candidate) => candidate.action_id === "app_home_disconnect");
+	const provider = action?.selected_option?.value ?? action?.value;
+	if (!provider) return;
+	const userId = requireSlackPayloadUserId(args.payload.user?.id, "Slack app home disconnect payload");
+	await withSpan("chat.app_home_disconnect", "chat.app_home_disconnect", { userId }, async () => {
+		try {
+			await unlinkProvider(userId, provider, args.userTokenStore, getWorkspaceTeamId());
+		} catch (error) {
+			logException(error, "app_home.disconnect_unlink.failed", { "app.credential.provider": provider });
+		}
+		try {
+			await publishAppHomeView(getSlackClient(), userId, args.userTokenStore);
+		} catch (error) {
+			logException(error, "app_home.disconnect_publish.failed", { "app.credential.provider": provider });
+		}
+	});
+}
+function installationFromInteractive(payload) {
+	return { teamId: payload.team?.id ?? payload.user?.team_id };
+}
+/** Handle a Slack slash command or interactive payload form. */
+async function handleSlackForm(args) {
+	const params = new URLSearchParams(args.body);
+	const { adapter, state } = args;
+	await state.connect();
+	if (params.has("command") && !params.has("payload")) {
+		const result = slackSlashCommandSchema.safeParse(Object.fromEntries(params));
+		if (!result.success) return new Response("Invalid slash command payload", { status: 400 });
+		const form = result.data;
+		const installation = {
+			teamId: form.team_id,
+			enterpriseId: form.enterprise_id,
+			isEnterpriseInstall: form.is_enterprise_install === "true"
+		};
+		args.waitUntil(withLogContext({
+			platform: "slack",
+			userId: form.user_id
+		}, () => runWithWorkspaceTeamId(installation.teamId, () => runWithSlackInstallation({
+			adapter,
+			installation,
+			state,
+			task: () => handleSlashCommandForm({
+				adapter,
+				form,
+				state
+			})
+		})).catch((error) => {
+			logException(error, "slash_command.failed");
+		})));
+		return new Response("", { status: 200 });
+	}
+	const rawPayload = params.get("payload");
+	if (!rawPayload) return new Response("Missing payload", { status: 400 });
+	const result = slackInteractivePayloadSchema.safeParse(parseJson$1(rawPayload));
+	if (!result.success) return new Response("Invalid payload JSON", { status: 400 });
+	const payload = result.data;
+	const installation = installationFromInteractive(payload);
+	args.waitUntil(withLogContext({
+		platform: "slack",
+		userId: payload.user?.id?.trim() || void 0
+	}, () => runWithWorkspaceTeamId(installation.teamId, () => runWithSlackInstallation({
+		adapter,
+		installation,
+		state,
+		task: () => handleInteractivePayload({
+			payload,
+			userTokenStore: args.getUserTokenStore()
+		})
+	})).catch((error) => {
+		logException(error, "slack.interactive.payload.failed");
+	})));
+	return new Response("", { status: 200 });
+}
+// src/chat/ingress/bot-mention.ts
 /**
 * Detect Slack bot @mentions that should activate Junior.
 *
@@ -2010,8 +2194,7 @@ function textMentionsBot(text, botUserId) {
 	const id = escapeRegExp(botUserId);
 	return new RegExp(`<@${id}(?:\\|[^>]+)?>`).test(outside);
 }
-//#endregion
-//#region src/chat/event-automations/ingest.ts
+// src/chat/event-automations/ingest.ts
 /**
 * Owns event matching and durable event-automation dispatch.
 *
@@ -2043,7 +2226,7 @@ async function ingestEventAutomations(input, options) {
 	const event = eventSchema.parse(input);
 	const db = getDb();
 	const nowMs = options.nowMs ?? Date.now();
-	const tasks = await findMatchingEventAutomations(db, event, options.teamId);
+	const tasks = (await findMatchingEventAutomations(db, event, options.teamId)).filter((task) => slackChannelMessageRunsAutomation(event, task));
 	let dispatched = 0;
 	const errors = [];
 	for (const task of tasks) try {
@@ -2068,7 +2251,8 @@ async function ingestEventAutomations(input, options) {
 					},
 					extra: {
 						"app.event.event_type": event.eventType,
-						"app.event_automation.max_runs_per_hour": botConfig.maxEventAutomationRunsPerHour,
+						"app.event_automation.max_runs": botConfig.maxEventAutomationRuns,
+						"app.event_automation.run_window_ms": botConfig.eventAutomationRunWindowMs,
 						"app.event_automation.resource_type": task.trigger.resourceType,
 						"app.task.id": task.id
 					}
@@ -2094,6 +2278,7 @@ async function ingestEventAutomations(input, options) {
 			taskId: task.id
 		} : void 0;
 		const dispatch = await dispatchEventAutomation({
+			automationId: task.id,
 			conversationWorkQueue: options.queue,
 			nowMs,
 			options: {
@@ -2108,7 +2293,7 @@ async function ingestEventAutomations(input, options) {
 			}
 		});
 		await recordEventAutomationRunStarted(db, {
-			automationId: task.id,
+			automation: task,
 			dispatchId: dispatch.id,
 			nowMs
 		});
@@ -2119,8 +2304,7 @@ async function ingestEventAutomations(input, options) {
 	if (errors.length > 0) throw new AggregateError(errors, "Failed to dispatch one or more event automations");
 	return { dispatched };
 }
-//#endregion
-//#region src/chat/ingress/workspace-membership.ts
+// src/chat/ingress/workspace-membership.ts
 const MEMBER_TTL_MS = 3e5;
 const NON_MEMBER_TTL_MS = 3e4;
 const authorTeamSchema = z.object({
@@ -2166,8 +2350,73 @@ async function isSlackWorkspaceMember(raw, state) {
 	if (!result.acquired) throw new Error("Could not acquire Slack membership lookup lock");
 	return result.value;
 }
-//#endregion
-//#region src/chat/ingress/slack-message-telemetry.ts
+// src/chat/sign-in/allowlist.ts
+/**
+* Domains that may use Junior. Slack authors must have a Slack profile email
+* on one of them, and dashboard Google sign-ins must come from a Google
+* Workspace account whose `hd` claim is one of them. Slack and the dashboard
+* share one list.
+*/
+/** Read a list env var: a JSON string array or comma-separated values. */
+function readEnvList(name) {
+	const value = process.env[name]?.trim();
+	if (!value) return void 0;
+	if (!value.startsWith("[")) return value.split(",");
+	let parsed;
+	try {
+		parsed = JSON.parse(value);
+	} catch (error) {
+		throw new Error(`${name} must be a JSON string array`, { cause: error });
+	}
+	const list = z.array(z.string()).safeParse(parsed);
+	if (!list.success) throw new Error(`${name} must be a JSON string array`);
+	return list.data;
+}
+/**
+* Resolve the allowed domains: the `createApp` option when set, else
+* `JUNIOR_ALLOWED_DOMAINS`. An empty list allows every domain.
+*/
+function resolveAllowedDomains(allowedDomains) {
+	return [...new Set((allowedDomains ?? readEnvList("JUNIOR_ALLOWED_DOMAINS") ?? []).map((value) => value.trim().toLowerCase()).filter(Boolean))];
+}
+/**
+* Fail startup on the removed Google-specific names. Ignoring them would
+* leave the list empty, which lets every Slack workspace member in.
+*/
+function assertNoLegacyAllowedDomains(dashboardOptionKeys) {
+	if (dashboardOptionKeys.includes("allowedGoogleDomains")) throw new Error("dashboard.allowedGoogleDomains was removed; set createApp({ allowedDomains }) instead");
+	if (process.env.JUNIOR_DASHBOARD_GOOGLE_DOMAINS?.trim()) throw new Error("JUNIOR_DASHBOARD_GOOGLE_DOMAINS was removed; set JUNIOR_ALLOWED_DOMAINS instead");
+}
+/** Return whether a verified domain may use Junior. An empty list allows all. */
+function isAllowedDomain(domain, allowedDomains) {
+	if (allowedDomains.length === 0) return true;
+	return Boolean(domain && allowedDomains.includes(domain.toLowerCase()));
+}
+// src/chat/ingress/slack-allowed-domain.ts
+const ALLOWED_TTL_MS = 3e5;
+const NOT_ALLOWED_TTL_MS = 3e4;
+/**
+* Return whether a Slack author may start a Turn. With allowed domains, the
+* email of the author's Slack profile must be on one of them. Slack verifies
+* that email, so Junior trusts it. Without allowed domains, every author may.
+*/
+async function isSlackAuthorDomainAllowed(args) {
+	if (args.allowedDomains.length === 0) return true;
+	const userId = parseSlackUserId(args.user);
+	if (!args.teamId || !userId) return false;
+	const key = `slack:allowed-domain:${args.teamId}:${userId}`;
+	const cached = await args.state.get(key);
+	if (typeof cached === "boolean") return cached;
+	const profile = await lookupSlackUserProfile(userId);
+	const email = profile.email?.toLowerCase();
+	const separator = email?.lastIndexOf("@") ?? -1;
+	const domain = separator > 0 ? email?.slice(separator + 1) : void 0;
+	const allowed = profile.id === userId && isAllowedDomain(domain, args.allowedDomains);
+	if (!allowed) logWarn("slack.allowed_domain.rejected", { "app.reason": email ? "domain_not_allowed" : "missing_email" });
+	await args.state.set(key, allowed, allowed ? ALLOWED_TTL_MS : NOT_ALLOWED_TTL_MS);
+	return allowed;
+}
+// src/chat/ingress/slack-message-telemetry.ts
 function field(value, pattern) {
 	if (value === void 0) return "missing";
 	return typeof value === "string" && value.length <= 64 && pattern.test(value) ? value : "invalid";
@@ -2191,70 +2440,7 @@ function slackMessageAttributes(body) {
 		"app.slack.is_ext_shared_channel": typeof body.is_ext_shared_channel === "boolean" ? body.is_ext_shared_channel : body.is_ext_shared_channel === void 0 ? "missing" : "invalid"
 	};
 }
-//#endregion
-//#region src/chat/ingress/slash-command.ts
-async function postEphemeral(event, text) {
-	await event.channel.postEphemeral(event.userId, text, { fallbackToDM: false });
-}
-function getCommandName() {
-	return getChatConfig().slack.slashCommand;
-}
-async function handleLink(event, provider) {
-	if (!pluginCatalogRuntime.isProvider(provider)) {
-		await postEphemeral(event, `Unknown provider: \`${provider}\``);
-		return;
-	}
-	if (!pluginCatalogRuntime.getOAuthConfig(provider)) {
-		await postEphemeral(event, `${formatProviderLabel(provider)} doesn't support account linking.`);
-		return;
-	}
-	const result = await startOAuthFlow(provider, {
-		actorId: event.userId,
-		actor: {
-			platform: "slack",
-			teamId: event.teamId,
-			userId: event.userId
-		},
-		channelId: event.channelId
-	});
-	if (!result.ok) {
-		await postEphemeral(event, `Failed to start linking: ${result.error}`);
-		return;
-	}
-	if (result.delivery === "fallback_dm") await postEphemeral(event, `Check your DMs for a ${formatProviderLabel(provider)} authorization link.`);
-	else if (result.delivery === false) await postEphemeral(event, "I wasn't able to send you a private authorization link. Please try again in a direct message.");
-}
-async function handleUnlink(event, provider) {
-	if (!pluginCatalogRuntime.isProvider(provider)) {
-		await postEphemeral(event, `Unknown provider: \`${provider}\``);
-		return;
-	}
-	if (!(Boolean(pluginCatalogRuntime.getOAuthConfig(provider)) || Boolean(pluginCatalogRuntime.getDefinition(provider)?.manifest.mcp))) {
-		await postEphemeral(event, `${formatProviderLabel(provider)} doesn't support account unlinking.`);
-		return;
-	}
-	const tokenStore = createUserTokenStore();
-	await unlinkProvider(event.userId, provider, tokenStore, event.teamId);
-	logInfo("slash_command.credential.unlinked", { "app.credential.provider": provider });
-	await postEphemeral(event, `Your ${formatProviderLabel(provider)} account has been unlinked.`);
-}
-/** Route link and unlink slash commands to the appropriate OAuth flow. */
-async function handleSlashCommand(event) {
-	const [subcommand, provider, ...rest] = event.text.trim().split(/\s+/);
-	if (!subcommand || !["link", "unlink"].includes(subcommand)) {
-		await postEphemeral(event, `Usage: \`${getCommandName()} link <provider>\` or \`${getCommandName()} unlink <provider>\``);
-		return;
-	}
-	if (!provider || rest.length > 0) {
-		await postEphemeral(event, `Usage: \`${getCommandName()} ${subcommand} <provider>\``);
-		return;
-	}
-	const normalized = provider.toLowerCase();
-	if (subcommand === "link") await handleLink(event, normalized);
-	else await handleUnlink(event, normalized);
-}
-//#endregion
-//#region src/chat/slack/automation-details.ts
+// src/chat/slack/automation-details.ts
 function textField(key, label, value) {
 	return {
 		key,
@@ -2355,8 +2541,7 @@ async function presentSlackAutomationDetails(event, teamId) {
 		metadata: slackEntitySchema.parse(entity)
 	});
 }
-//#endregion
-//#region src/chat/ingress/slack-webhook.ts
+// src/chat/ingress/slack-webhook.ts
 function slackEventLogContext(event) {
 	const channelId = event?.channel?.trim() || void 0;
 	const threadTs = event?.thread_ts?.trim() || event?.ts?.trim() || void 0;
@@ -2550,7 +2735,7 @@ async function handleSlackThreadStop(args) {
 	recordSkippedConversationMessage({
 		conversation,
 		message: args.message,
-		skippedReason: `thread_opt_out:${args.stopReason}`,
+		skippedReason: `${SubscribedReplyReason.ThreadOptOut}:${args.stopReason}`,
 		text: content.text
 	});
 	await appendConversationMessages(getConversationEventStore(), {
@@ -2651,13 +2836,19 @@ async function routeParsedMessage(args) {
 		});
 		return;
 	}
+	if (route === "mention" && !await isSlackAuthorDomainAllowed({
+		allowedDomains: args.allowedDomains,
+		state: args.state,
+		teamId: args.installation.teamId,
+		user: args.event.user
+	})) return;
 	if (isSubscribed && !isExperimentalFeatureEnabled("passive-routing")) {
 		const content = parseContent(message);
 		const conversation = coerceThreadConversationState(void 0);
 		recordSkippedConversationMessage({
 			conversation,
 			message,
-			skippedReason: `passive_disabled:passive-routing`,
+			skippedReason: `${SubscribedReplyReason.PassiveDisabled}:passive-routing`,
 			text: content.text
 		});
 		await appendConversationMessages(getConversationEventStore(), {
@@ -2767,6 +2958,7 @@ async function handleSlackEvent(args) {
 					conversationStore: args.services.conversationStore,
 					queue: args.services.queue,
 					receivedAtMs,
+					allowedDomains: args.services.allowedDomains ?? [],
 					state
 				}), {
 					keepAlive: true,
@@ -2776,103 +2968,6 @@ async function handleSlackEvent(args) {
 		}
 	}));
 }
-function requireSlackPayloadUserId(value, source) {
-	const userId = parseActorUserId(value);
-	if (!userId) throw new Error(`${source} is missing a Slack user id`);
-	return userId;
-}
-async function handleSlashCommandForm(args) {
-	const { channel_id: channelId, team_id: teamId, user_id: userId } = args.form;
-	const channel = new ChannelImpl({
-		id: `slack:${channelId}`,
-		adapter: args.adapter,
-		stateAdapter: args.state
-	});
-	await withSpan("chat.slash_command", "chat.slash_command", { userId }, async () => {
-		await handleSlashCommand({
-			channel,
-			channelId,
-			teamId,
-			text: args.form.text,
-			userId
-		});
-	});
-}
-async function handleInteractivePayload(args) {
-	if (args.payload.type !== "block_actions") return;
-	const action = args.payload.actions?.find((candidate) => candidate.action_id === "app_home_disconnect");
-	const provider = action?.selected_option?.value ?? action?.value;
-	if (!provider) return;
-	const userId = requireSlackPayloadUserId(args.payload.user?.id, "Slack app home disconnect payload");
-	await withSpan("chat.app_home_disconnect", "chat.app_home_disconnect", { userId }, async () => {
-		try {
-			await unlinkProvider(userId, provider, args.userTokenStore, getWorkspaceTeamId());
-		} catch (error) {
-			logException(error, "app_home.disconnect_unlink.failed", { "app.credential.provider": provider });
-		}
-		try {
-			await publishAppHomeView(getSlackClient(), userId, args.userTokenStore);
-		} catch (error) {
-			logException(error, "app_home.disconnect_publish.failed", { "app.credential.provider": provider });
-		}
-	});
-}
-function installationFromInteractive(payload) {
-	return { teamId: payload.team?.id ?? payload.user?.team_id };
-}
-async function handleSlackForm(args) {
-	const params = new URLSearchParams(args.body);
-	const adapter = args.services.getSlackAdapter();
-	const state = args.services.state ?? getStateAdapter();
-	await state.connect();
-	if (params.has("command") && !params.has("payload")) {
-		const result = slackSlashCommandSchema.safeParse(Object.fromEntries(params));
-		if (!result.success) return new Response("Invalid slash command payload", { status: 400 });
-		const form = result.data;
-		const installation = {
-			teamId: form.team_id,
-			enterpriseId: form.enterprise_id,
-			isEnterpriseInstall: form.is_enterprise_install === "true"
-		};
-		enqueue(args.waitUntil, withLogContext({
-			platform: "slack",
-			userId: form.user_id
-		}, () => runWithWorkspaceTeamId(installation.teamId, () => runWithSlackInstallation({
-			adapter,
-			installation,
-			state,
-			task: () => handleSlashCommandForm({
-				adapter,
-				form,
-				state
-			})
-		})).catch((error) => {
-			logException(error, "slash_command.failed");
-		})));
-		return new Response("", { status: 200 });
-	}
-	const rawPayload = params.get("payload");
-	if (!rawPayload) return new Response("Missing payload", { status: 400 });
-	const result = slackInteractivePayloadSchema.safeParse(parseJson(rawPayload));
-	if (!result.success) return new Response("Invalid payload JSON", { status: 400 });
-	const payload = result.data;
-	const installation = installationFromInteractive(payload);
-	enqueue(args.waitUntil, withLogContext({
-		platform: "slack",
-		userId: payload.user?.id?.trim() || void 0
-	}, () => runWithWorkspaceTeamId(installation.teamId, () => runWithSlackInstallation({
-		adapter,
-		installation,
-		state,
-		task: () => handleInteractivePayload({
-			payload,
-			userTokenStore: getUserTokenStore(args.services)
-		})
-	})).catch((error) => {
-		logException(error, "slack.interactive.payload.failed");
-	})));
-	return new Response("", { status: 200 });
-}
 /** Handle Slack webhooks by enqueueing durable conversation work. */
 async function handleSlackWebhook(args) {
 	const adapter = args.services.getSlackAdapter();
@@ -2883,8 +2978,10 @@ async function handleSlackWebhook(args) {
 		request: args.request
 	})) return new Response("Invalid signature", { status: 401 });
 	if ((args.request.headers.get("content-type") || "").includes("application/x-www-form-urlencoded")) return await handleSlackForm({
+		adapter,
 		body,
-		services: args.services,
+		getUserTokenStore: () => getUserTokenStore(args.services),
+		state: args.services.state ?? getStateAdapter(),
 		waitUntil: args.waitUntil
 	});
 	const result = slackEventEnvelopeSchema.safeParse(parseJson(body));
@@ -2919,8 +3016,7 @@ async function handleSlackWebhook(args) {
 	}
 	return new Response("ok", { status: 200 });
 }
-//#endregion
-//#region src/handlers/webhooks.ts
+// src/handlers/webhooks.ts
 /** Run a platform webhook with shared request tracing and error logging. */
 async function handleWebhookRequest(request, platform, run) {
 	const requestContext = createRequestContext(request, { platform });
@@ -2961,8 +3057,7 @@ async function handleWebhookRequest(request, platform, run) {
 		}
 	});
 }
-//#endregion
-//#region src/handlers/slack-webhook.ts
+// src/handlers/slack-webhook.ts
 /** Handle the production Slack webhook route. */
 async function POST(request, waitUntil, services) {
 	return handleWebhookRequest(request, "slack", () => handleSlackWebhook({
@@ -3060,8 +3155,7 @@ function createVercelConversationWorkCallback(options) {
 function registerVercelConversationWorkDevConsumer(options) {
 	return conversationWorkCallback(options).registerDev();
 }
-//#endregion
-//#region src/chat/sandbox/snapshot/job-callback.ts
+// src/chat/sandbox/snapshot/job-callback.ts
 const WORKSPACE_SNAPSHOT_JOB_DEV_CONSUMER_GROUP = "junior_workspace_snapshots_dev";
 function logWorkspaceSnapshotJobRejected(reason, metadata) {
 	logWarn("workspace.snapshot.job.queue_message.rejected", {
@@ -3090,8 +3184,7 @@ function createVercelWorkspaceSnapshotJobCallback() {
 function registerVercelWorkspaceSnapshotJobDevConsumer() {
 	return workspaceSnapshotJobCallback().registerDev();
 }
-//#endregion
-//#region src/handlers/artifacts.ts
+// src/handlers/artifacts.ts
 /** Serve one content-addressed public artifact without authentication. */
 async function publicArtifactGET(args) {
 	try {
@@ -3110,8 +3203,7 @@ async function publicArtifactGET(args) {
 		return new Response("Internal Server Error", { status: 500 });
 	}
 }
-//#endregion
-//#region src/chat/events/workspace.ts
+// src/chat/events/workspace.ts
 /**
 * Resolve the single-bot Slack team id for event-automation indexing and
 * Event people mentions.
@@ -3135,8 +3227,7 @@ function createEventTeamIdResolver() {
 		return await pending;
 	};
 }
-//#endregion
-//#region src/chat/events/app-publisher.ts
+// src/chat/events/app-publisher.ts
 /** Build the core event publisher used by plugin routes. */
 function createEventAppPublisher(args) {
 	const resolveEventAutomationTeamId = createEventTeamIdResolver();
@@ -3184,8 +3275,7 @@ function createEventAppPublisher(args) {
 		}
 	};
 }
-//#endregion
-//#region src/api/acp/conversations.ts
+// src/api/acp/conversations.ts
 const EVENT_PAGE_SIZE = 50;
 function actorFromUser(user) {
 	return webActorFromEmail(user.email, user.displayName ? { fullName: user.displayName } : void 0);
@@ -3321,8 +3411,7 @@ function createAcpConversations(options) {
 		}
 	};
 }
-//#endregion
-//#region src/api/acp/state.ts
+// src/api/acp/state.ts
 const MUTATION_LOCK_TTL_MS = 1e4;
 /** Run one ACP state mutation while its shared lock remains owned. */
 async function withLock(state, key, run, options = {}) {
@@ -3351,8 +3440,7 @@ async function withLock(state, key, run, options = {}) {
 async function fenceLock(state, lock, ttlMs = MUTATION_LOCK_TTL_MS) {
 	if (!await state.extendLock(lock, ttlMs)) throw new Error(`ACP lock ownership was lost before write for ${lock.threadId}`);
 }
-//#endregion
-//#region src/api/acp/schema.ts
+// src/api/acp/schema.ts
 /** Validate the ACP wire messages that Junior supports. */
 const ACP_SESSION_ID_PATTERN = /^local:acp:[a-f0-9]{32}$/;
 const metaSchema = z.record(z.string(), z.unknown()).nullable();
@@ -3448,8 +3536,7 @@ const cancelParamsSchema = z.object({
 	_meta: metaSchema.optional(),
 	sessionId: acpSessionIdSchema
 }).strict();
-//#endregion
-//#region src/api/acp/sleep.ts
+// src/api/acp/sleep.ts
 /** Wait for a duration and reject when the ACP request stops. */
 function sleep(ms, signal) {
 	return new Promise((resolve, reject) => {
@@ -3468,8 +3555,7 @@ function sleep(ms, signal) {
 		signal.addEventListener("abort", onAbort, { once: true });
 	});
 }
-//#endregion
-//#region src/api/acp/transport.ts
+// src/api/acp/transport.ts
 /**
 * Short-lived ACP transport state.
 *
@@ -4040,8 +4126,7 @@ function createSseBody(args) {
 		}
 	});
 }
-//#endregion
-//#region src/api/acp/auth.ts
+// src/api/acp/auth.ts
 /** Own ACP browser authorization records and connection binding. */
 const ACP_AUTHORIZATION_TTL_MS = 6e5;
 const ACP_CONNECTION_COOKIE = "junior_acp_connection";
@@ -4380,8 +4465,7 @@ async function expireAcpAuthorization(args) {
 	if (!result.acquired) return false;
 	return result.value;
 }
-//#endregion
-//#region src/api/acp/route.ts
+// src/api/acp/route.ts
 /**
 * Own the remote ACP v1 Streamable HTTP edge.
 *
@@ -4819,8 +4903,7 @@ function createAcpHttpHandler(options) {
 		}
 	};
 }
-//#endregion
-//#region src/api/acp/authorization-page.ts
+// src/api/acp/authorization-page.ts
 const ACP_AUTHORIZATION_PATH = "/_junior/acp/auth/:transactionId";
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function escapeHtml(value) {
@@ -4944,14 +5027,176 @@ async function handleAcpAuthorizationPage(args) {
 	});
 	return renderResult(args.agentName, result);
 }
-//#endregion
-//#region src/dashboard-routes.ts
+// src/chat/sign-in/auth.ts
+/**
+* Google sign-in session for the dashboard.
+*
+* Better Auth runs the Google OAuth flow and keeps the browser session in an
+* encrypted cookie. With allowed domains, only Google Workspace accounts on
+* those domains can sign in. Each sign-in also saves the native Google
+* identity.
+*/
+const DEFAULT_AUTH_PATH = "/api/auth";
+const DEFAULT_SESSION_MAX_AGE_SECONDS = 28800;
+const googleClaimsSchema = z.object({
+	sub: z.string().min(1),
+	email: z.string().optional(),
+	email_verified: z.boolean().optional(),
+	hd: z.string().optional(),
+	name: z.string().optional(),
+	picture: z.string().optional()
+});
+/**
+* Read Google ID token claims. Returns undefined for a malformed token, so
+* Better Auth redirects with `unable_to_get_user_info` instead of a 500.
+*/
+function readGoogleClaims(idToken) {
+	let payload;
+	try {
+		payload = decodeJwt(idToken);
+	} catch {
+		return;
+	}
+	const parsed = googleClaimsSchema.safeParse(payload);
+	return parsed.success ? parsed.data : void 0;
+}
+function trimSlashes(value, leading) {
+	let start = 0;
+	let end = value.length;
+	while (leading && start < end && value[start] === "/") start += 1;
+	while (end > start && value[end - 1] === "/") end -= 1;
+	return value.slice(start, end);
+}
+function withHttps(host) {
+	return /^https?:\/\//.test(host) ? host : `https://${host}`;
+}
+/** Resolve sign-in settings from dashboard options and environment. */
+function resolveSignInAuthConfig(agentName, allowedDomains, options = {}) {
+	return {
+		agentName,
+		allowedDomains,
+		authPath: `/${trimSlashes(options.authPath?.trim() || DEFAULT_AUTH_PATH, true)}`,
+		baseURL: trimSlashes(withHttps(options.baseURL?.trim() || resolveBaseUrl() || "http://localhost:3000"), false),
+		sessionMaxAgeSeconds: options.sessionMaxAgeSeconds,
+		trustedOrigins: options.trustedOrigins ?? readEnvList("JUNIOR_DASHBOARD_TRUSTED_ORIGINS") ?? []
+	};
+}
+function required(value, name) {
+	if (!value?.trim()) throw new Error(`${name} is required for Junior sign-in`);
+	return value.trim();
+}
+function createBetterAuth(config) {
+	const secret = required(config.secret ?? process.env.BETTER_AUTH_SECRET ?? process.env.JUNIOR_SECRET, "JUNIOR_SECRET or BETTER_AUTH_SECRET");
+	const sessionMaxAgeSeconds = config.sessionMaxAgeSeconds ?? DEFAULT_SESSION_MAX_AGE_SECONDS;
+	const { allowedDomains } = config;
+	const hostedDomain = allowedDomains.length === 0 ? void 0 : allowedDomains.length === 1 ? allowedDomains[0] : "*";
+	return betterAuth({
+		appName: config.agentName,
+		baseURL: config.baseURL,
+		basePath: config.authPath,
+		secret,
+		trustedOrigins: config.trustedOrigins,
+		socialProviders: { google: {
+			clientId: required(config.googleClientId ?? process.env.GOOGLE_CLIENT_ID, "GOOGLE_CLIENT_ID"),
+			clientSecret: required(config.googleClientSecret ?? process.env.GOOGLE_CLIENT_SECRET, "GOOGLE_CLIENT_SECRET"),
+			hd: hostedDomain,
+			prompt: "select_account",
+			async getUserInfo(token) {
+				if (!token.idToken) return null;
+				const claims = readGoogleClaims(token.idToken);
+				if (!claims) return null;
+				if (!isAllowedDomain(claims.hd, allowedDomains)) return null;
+				return {
+					user: {
+						id: claims.sub,
+						email: claims.email,
+						emailVerified: claims.email_verified === true,
+						image: claims.picture,
+						name: claims.name
+					},
+					data: claims
+				};
+			}
+		} },
+		account: {
+			storeStateStrategy: "cookie",
+			storeAccountCookie: false,
+			updateAccountOnSignIn: false
+		},
+		session: {
+			expiresIn: sessionMaxAgeSeconds,
+			disableSessionRefresh: true,
+			cookieCache: {
+				enabled: true,
+				strategy: "jwe",
+				maxAge: sessionMaxAgeSeconds,
+				refreshCache: false
+			}
+		},
+		hooks: { after: createAuthMiddleware(async (ctx) => {
+			const created = ctx.context.newSession;
+			if (!created || !ctx.path.startsWith("/callback/")) return;
+			const email = normalizeIdentityEmail(created.user.email);
+			if (!created.user.emailVerified || !email) return;
+			const google = (await ctx.context.internalAdapter.findAccounts(created.user.id)).find((account) => account.providerId === "google");
+			if (!google) throw new Error("Google sign-in has no Google account");
+			await recordGoogleSignIn(getSqlExecutor(), {
+				email,
+				subject: google.accountId,
+				displayName: created.user.name || void 0
+			});
+		}) }
+	});
+}
+/**
+* Create the Google sign-in session. Better Auth starts on first use, so apps
+* that never sign in need no Google credentials.
+*/
+function createSignInAuth(config) {
+	let auth;
+	const getAuth = () => auth ??= createBetterAuth(config);
+	return {
+		handler(request) {
+			return getAuth().handler(request);
+		},
+		async getSession(request) {
+			const session = await getAuth().api.getSession({ headers: request.headers });
+			if (!session) return null;
+			const { email, emailVerified, name } = session.user;
+			return { user: {
+				email,
+				emailVerified,
+				name
+			} };
+		},
+		async signInWithGoogle(request, callbackURL, errorCallbackURL) {
+			const result = await getAuth().api.signInSocial({
+				body: {
+					provider: "google",
+					callbackURL,
+					errorCallbackURL
+				},
+				headers: request.headers,
+				returnHeaders: true
+			});
+			if (!("url" in result.response) || !result.response.url) throw new Error("Google sign-in did not return a redirect URL");
+			result.headers.set("location", result.response.url);
+			return new Response(null, {
+				status: 302,
+				headers: result.headers
+			});
+		}
+	};
+}
+// src/dashboard-routes.ts
 const DASHBOARD_PACKAGE_NAME = "@sentry/junior-dashboard";
 /** Mount the dashboard app on the dashboard-owned host paths. */
 async function createDashboardRouteRegistrations(args) {
 	if (!args.dashboard || args.dashboard.disabled) return [];
 	const createDashboardApp = args.createDashboardApp ?? await loadDashboardAppFactory();
 	return dashboardRouteRegistrations({
+		allowedDomains: args.allowedDomains,
+		auth: args.auth,
 		authenticatedRoutes: args.authenticatedRoutes,
 		conversationWorkQueue: args.conversationWorkQueue,
 		dashboard: args.dashboard,
@@ -5074,7 +5319,7 @@ function routePatternMatchesConcretePath(pattern, concretePath) {
 	const patternSegments = routeSegments(pattern);
 	const pathSegments = routeSegments(concretePath);
 	for (let index = 0; index < patternSegments.length; index += 1) {
-		const segment = patternSegments[index];
+		const segment = patternSegments[index] ?? "";
 		if (segment === "**" || segment === "*") return true;
 		const value = pathSegments[index];
 		if (!value || !routeSegmentMatches(segment, value)) return false;
@@ -5100,6 +5345,8 @@ function dashboardRouteRegistrations(args) {
 		const dashboardOptions = {
 			...args.dashboard,
 			agentName: botConfig.userName,
+			allowedDomains: args.allowedDomains,
+			...args.auth ? { auth: args.auth } : void 0,
 			authenticatedRoutes: args.authenticatedRoutes,
 			conversationWorkQueue: args.conversationWorkQueue,
 			pluginRoutes: args.pluginRoutes
@@ -5118,8 +5365,7 @@ function validateDashboardRouteOwnership(args) {
 	if (!args.dashboard || args.dashboard.disabled) return;
 	for (const route of args.routes) if (dashboardOwnedRoutePath(route.path, args.dashboard, args.authenticatedRoutes)) throw new Error(`Plugin "${route.pluginName}" route "${route.path}" conflicts with core dashboard routes`);
 }
-//#endregion
-//#region src/app.ts
+// src/app.ts
 /** Resolve the public deployment URL used by ACP browser authorization. */
 function resolveAcpBaseURL(dashboard) {
 	const configured = dashboard?.baseURL?.trim() || process.env.JUNIOR_BASE_URL?.trim();
@@ -5236,6 +5482,8 @@ async function createApp(options) {
 		queue: conversationWorkQueue
 	}) });
 	let sandboxEgressTracePropagationDomains = [];
+	let signInConfig;
+	let allowedDomains = [];
 	try {
 		sandboxEgressTracePropagationDomains = normalizeSandboxEgressTracePropagationDomains(options?.sandbox?.egressTracePropagationDomains);
 		setSandboxResourceConfig(options?.sandbox);
@@ -5248,6 +5496,10 @@ async function createApp(options) {
 		setRuntimeLimits(options?.limits);
 		setSlackReactionConfig(options?.slack ?? {});
 		if (options?.slack?.crossActorMidRunMode) setCrossActorMidRunMode(options.slack.crossActorMidRunMode);
+		assertNoLegacyAllowedDomains(Object.keys(dashboard ?? {}));
+		allowedDomains = resolveAllowedDomains(options?.allowedDomains);
+		if (allowedDomains.length === 0) logWarn("app.allowed_domains.unset", { "app.reason": "allowedDomains is empty, so any Slack workspace member can use Junior" });
+		if (dashboard && !dashboard.disabled) signInConfig = resolveSignInAuthConfig(botConfig.userName, allowedDomains, dashboard);
 		if (shouldValidatePluginCatalog) {
 			pluginCatalogRuntime.getSignature();
 			validatePluginRegistrations(configuredPlugins?.registrations ?? []);
@@ -5335,10 +5587,14 @@ async function createApp(options) {
 		restoreRuntimeConfig$1();
 		throw error;
 	}
-	const slackWebhookServices = createProductionSlackWebhookServices({
-		queue: conversationWorkQueue,
-		services: runtimeServiceOverrides
-	});
+	const signInAuth = signInConfig ? createSignInAuth(signInConfig) : void 0;
+	const slackWebhookServices = {
+		...createProductionSlackWebhookServices({
+			queue: conversationWorkQueue,
+			services: runtimeServiceOverrides
+		}),
+		allowedDomains
+	};
 	const app = new Hono();
 	app.onError((err, c) => {
 		logException(err, "route.unhandled.exception");
@@ -5354,9 +5610,14 @@ async function createApp(options) {
 	], "/api/acp", (c) => getAcpRuntime().handleRequest(c.req.raw));
 	mountRoutes(app, pluginRoutes);
 	mountRoutes(app, await createDashboardRouteRegistrations({
+		allowedDomains,
+		auth: signInAuth,
 		authenticatedRoutes,
 		conversationWorkQueue,
-		dashboard,
+		dashboard: dashboard && signInConfig ? {
+			...dashboard,
+			baseURL: signInConfig.baseURL
+		} : dashboard,
 		createDashboardApp: virtualConfig?.createDashboardApp,
 		pluginRoutes: pluginApiRoutes
 	}));
@@ -5415,5 +5676,4 @@ async function createApp(options) {
 	});
 	return app;
 }
-//#endregion
 export { JUNIOR_VERSION, createApp, defineJuniorPlugins };