@sentry/junior 0.257.0 → 0.259.0

package/dist/app.js

@@ -1,40 +1,39 @@
-import { At as consumeSandboxEgressPermissionDeniedSignal, B as effectiveTaskOutcomes, Ct as ingestEvent, Dt as SANDBOX_EGRESS_PROXY_PATH, E as requestAttachmentDeletion, Et as shouldPropagateSandboxEgressTrace, F as logScheduledAutomationRunSkipped, I as scheduledAutomationRunAttributes, It as resolveBaseUrl, Jt as setConfigDefaults, Lt as startOAuthFlow, Nt as deliverPrivateMessage, O as parseSlackThreadId, Ot as clearSandboxEgressSignals, Pt as formatProviderLabel, Rt as createUserTokenStore, St as processWorkspaceSnapshotJob, Tt as normalizeSandboxEgressTracePropagationDomains, U as stopConversationSession, W as recordSubagentEnded, b as unpublishedArtifactHeaders, i as executeCredentialedEgressRequest, jt as parseSandboxEgressCredentialToken, kt as consumeSandboxEgressAuthRequiredSignal, lt as listPendingAgentInvocationMailboxAppends, n as executeAgentRun, qt as getConfigDefaults, t as createAgentRunner, ut as listPendingAgentInvocationResults, v as publicArtifactHeaders, w as collectAttachmentGarbage, wt as resolveSandboxEgressProviderForHost, x as lookupSlackUserProfile, y as readPublicArtifact } from "./agent-runner-D7OboVb3.js";
-import { f as escapeXml } from "./client-D8HnkOQX.js";
-import { C as withContext, M as JUNIOR_WORKSPACE_SNAPSHOT_JOB_CALLBACK_ROUTE, R as normalizeIdentityEmail, T as withSpan, b as setSpanStatus, f as logException, k as JUNIOR_PLUGIN_TASK_CALLBACK_ROUTE, m as logWarn, p as logInfo, r as createRequestContext, v as setSentryUser, w as withLogContext, y as setSpanAttributes } from "./logging-CWxiIuCF.js";
-import { n as captureMessage, r as continueTrace } from "./sentry-CgWZM_kV.js";
-import { t as JUNIOR_VERSION } from "./version-BcdZy2zg.js";
-import { _ as snapshotRuntimeConfig, d as restoreRuntimeConfig, f as setBotModelConfig, g as setSlackReactionConfig, h as setRuntimeLimits, i as getChatConfig, m as setProfiles, n as botConfig, o as getSlackBotToken, p as setCrossActorMidRunMode, u as resetRuntimeConfig } from "./config-CJRnWK9H.js";
-import { _ as slackMessageTsSchema, d as parseSlackTeamId, f as parseSlackUserId, h as slackUserIdSchema, m as slackTeamIdSchema, o as parseActorUserId, p as slackChannelIdSchema } from "./actor-BTtLaeWy.js";
-import { F as recordGoogleSignIn, L as slackUserHasGoogleSignIn, M as findSlackIdentityUserId, R as upsertIdentity, d as getConversationStore, f as getDb, h as withConversationEventLock, i as readActorIdentity, l as getConversationEventStore, n as findUserByEmailFromSql, p as getSqlExecutor, v as withConversationMutationLock } from "./viewer-DSZXygMU.js";
-import { a as juniorAgentInvocations, d as juniorDestinations, i as juniorAgentBindings, s as juniorConversations } from "./agent-invocations-Bdu3ROfo.js";
-import { a as juniorAutomationRuns, f as juniorConversationBriefs, h as juniorConversationEvents, s as juniorAutomations } from "./executor-Do0THDRR.js";
-import { m as credentialLogContext } from "./registry-sLTr-sV9.js";
-import { n as pluginCatalogRuntime } from "./catalog-runtime-CZzhGQ7F.js";
-import { C as automationVersionOf, Kt as projectConversationMessages, P as slackMention, U as slackEntitySchema, Ut as appendConversationMessages, W as slackExternalRefIdSchema, Yt as settleConversationTitleWork, b as admitEventAutomationRun, c as withScheduledAutomationLock, i as readScheduledAutomation, j as formatSlackLink, l as blockEventAutomation, n as listScheduledAutomationsForTeam, o as saveScheduledAutomationInLock, p as findMatchingEventAutomations, s as scheduledRunId, u as collectEventAutomationMatchKeys, x as eventAutomationRunLimitReason } from "./tasks-D_WIJtvO.js";
-import { $ as bindSlackDirectCredentialSubject, At as resolveRootVisibility, Ht as getSlackClient, Jt as getWorkspaceTeamId, Nt as listConversationAnnotations, Q as bindScheduledAutomationCredentialSubject, U as collectEventMatchKeys, Wt as isDmChannel, X as takeDueTimerWatches, Yt as runWithWorkspaceTeamId, Z as bindEventAutomationCredentialSubject, a as getPluginRoutes, at as getDashboardConversationLink, ct as setDashboardConversationLinkOptions, d as setPlugins, et as verifyEventAutomationCredentialSubject, f as validatePlugins, ft as createPluginLogger, h as setBriefsConfig, i as getPluginApiRoutes, lt as createPluginState, nt as verifySlackDirectCredentialSubject, pt as readConversationAccessFromSql, q as findMatchingWatches, st as getDashboardTaskLink, tt as verifyScheduledAutomationCredentialSubject, u as getPlugins } from "./agent-hooks-BjtTzvru.js";
-import { W as annotationCard } from "./conversation-CKNLYBJt.js";
-import { O as withLock$1, w as getStateAdapter } from "./profile-h-72wM78.js";
-import { c as getThreadStopDecision } from "./pending-auth-s_QFribU.js";
-import { b as eventGuidance, f as slackChannelMessageEvent, k as renderTaskInput, l as getEventCatalog, m as slackChannelMessageRunsAutomation, p as slackChannelMessageReplyThreadTs, u as SLACK_EVENT_NAMESPACE } from "./session-stop-CQjKd4a2.js";
-import { n as getNextRunAtMs } from "./cadence-D00SCzT1.js";
-import { f as setSandboxResourceConfig, u as getSandboxResourceConfig } from "./resolve-ncQPZROQ.js";
-import { a as getVercelConversationWorkQueue, g as isConversationQueueMessageRejectedError, h as conversationQueueMessageSchema, i as verifyWorkspaceSnapshotJobMessage, o as resolveConversationWorkQueueTopic, s as verifyConversationQueueMessage, t as WORKSPACE_SNAPSHOT_JOB_QUEUE_TOPIC } from "./job-queue-B6SV9uVa.js";
-import { A as hasRunnableConversationWork$1, M as isInvalidConversationRecordError, O as CONVERSATION_WORK_STALE_ENQUEUE_MS, S as removeActiveConversation, _ as hasRunnableConversationWork, c as clearExpiredConversationLease, g as getConversationWorkState, h as getConversation, m as ensureConversationWake, r as appendAndEnqueueInboundMessage, v as listActiveConversationIds } from "./store-DXFIQy-G.js";
-import { D as scheduledRunSchema } from "./automation-CHdlHVZP.js";
-import { i as setExperimentalFeatures, n as getExperimentalFeatures, r as isExperimentalFeatureEnabled } from "./experimental-CQIvMUO7.js";
-import { n as validatePluginRegistrations, t as validatePluginEgressCredentialHooks } from "./validation-CXYxaNYx.js";
-import { a as pluginRuntimeRegistrationsFromPluginSet, n as pluginCatalogConfigFromEnv, r as pluginCatalogConfigFromPluginSet, t as defineJuniorPlugins } from "./plugins-egKWjgue.js";
-import { A as THREAD_OPTOUT_ACK, C as buildSlackInboundMessage, D as normalizeIncomingSlackThreadId, E as stopSlackThread, F as renderSlackObjectCard, I as createVercelAttachmentStorage, M as parseContent, N as runWithSlackInstallation, O as withNormalizedThreadId, P as verifySlackSignature, R as enqueueAgentDispatch, S as recordSkippedConversationMessage, T as isSlackMessageStopped, a as recordWebConversationActivity, c as createProductionSlackWebhookServices, f as createSlackWebApiStatusSender, j as startProcessingReaction, k as stopConversationTurn, l as getProductionSlackAdapter, n as conversationTurnIdForMessage, o as webActorFromEmail, s as createProductionConversationWorkOptions, t as appendAndEnqueueWebMessage, v as readViewerAutomationSummary, w as clearSlackPendingReactions, z as GET$3 } from "./web-input-B9Bv0_lR.js";
-import { M as recordAutomationExecution, S as existingConversationId, a as confirmDispatchMailboxAppend, b as notifyAutomationBlocked, f as getPluginDispatchProjection, m as listPendingDispatchMailboxAppends, o as createOrGetDispatch, p as isTerminalDispatchStatus, s as getDispatchConversationId, t as processPluginTask, u as getDispatchRecord, v as markDispatchFailed } from "./task-runner-DUjvzYXj.js";
-import { o as getAuthPausedConversationTurnId, t as enqueueAgentInvocationResult } from "./result-C883vngT.js";
-import { r as enqueueAgentInvocation } from "./work-nAfDSUFP.js";
-import { s as coerceThreadConversationState } from "./thread-state-Ch4yuCqG.js";
-import { o as unlinkProvider } from "./connections-ClYrKzpX.js";
-import { a as GET$4, i as publishAppHomeView, o as htmlCallbackResponse, r as GET$5, t as receiveLocalOAuthCredential } from "./credential-sync-BXfohNmJ.js";
-import { a as registerVercelPluginTaskDevConsumer, n as createVercelPluginTaskCallback, s as queueCallback } from "./task-queue-B17vV0La.js";
-import { t as processConversationWork } from "./worker-vGXZ6XFT.js";
-import { t as bindMessageAgent } from "./message-TUOdbSBW.js";
-import { t as bindSpawnAgent } from "./spawn-DY9CLXDL.js";
+import { At as parseSandboxEgressCredentialToken, B as effectiveTaskOutcomes, Ct as resolveSandboxEgressProviderForHost, Dt as clearSandboxEgressSignals, E as requestAttachmentDeletion, Et as SANDBOX_EGRESS_PROXY_PATH, F as logScheduledAutomationRunSkipped, Ft as startOAuthFlow, Gt as getConfigDefaults, I as scheduledAutomationRunAttributes, It as createUserTokenStore, Kt as setConfigDefaults, Mt as formatProviderLabel, O as parseSlackThreadId, Ot as consumeSandboxEgressAuthRequiredSignal, Pt as resolveBaseUrl, St as ingestEvent, Tt as shouldPropagateSandboxEgressTrace, U as stopConversationSession, W as recordSubagentEnded, b as unpublishedArtifactHeaders, i as executeCredentialedEgressRequest, kt as consumeSandboxEgressPermissionDeniedSignal, lt as listPendingAgentInvocationMailboxAppends, n as executeAgentRun, t as createAgentRunner, ut as listPendingAgentInvocationResults, v as publicArtifactHeaders, w as collectAttachmentGarbage, wt as normalizeSandboxEgressTracePropagationDomains, x as lookupSlackUserProfile, xt as processWorkspaceSnapshotJob, y as readPublicArtifact } from "./agent-runner-CPSd7rKm.js";
+import { C as withContext, M as JUNIOR_WORKSPACE_SNAPSHOT_JOB_CALLBACK_ROUTE, R as normalizeIdentityEmail, T as withSpan, b as setSpanStatus, f as logException, k as JUNIOR_PLUGIN_TASK_CALLBACK_ROUTE, m as logWarn, p as logInfo, r as createRequestContext, v as setSentryUser, w as withLogContext, y as setSpanAttributes } from "./logging-BStXN56b.js";
+import { n as captureMessage, r as continueTrace } from "./sentry-BBUlHih9.js";
+import { t as JUNIOR_VERSION } from "./version-B_XumRx-.js";
+import { _ as snapshotRuntimeConfig, d as restoreRuntimeConfig, f as setBotModelConfig, g as setSlackReactionConfig, h as setRuntimeLimits, i as getChatConfig, m as setProfiles, n as botConfig, o as getSlackBotToken, p as setCrossActorMidRunMode, u as resetRuntimeConfig } from "./config-Deqpfpg9.js";
+import { _ as slackMessageTsSchema, d as parseSlackTeamId, f as parseSlackUserId, h as slackUserIdSchema, m as slackTeamIdSchema, o as parseActorUserId, p as slackChannelIdSchema } from "./actor-tlxzqaRe.js";
+import { N as recordGoogleSignIn, _ as withConversationMutationLock, c as getConversationEventStore, d as getDb, f as getSqlExecutor, m as withConversationEventLock, r as readActorIdentity, u as getConversationStore } from "./viewer-B2_ABsYi.js";
+import { a as juniorAgentInvocations, d as juniorDestinations, i as juniorAgentBindings, s as juniorConversations } from "./agent-invocations-Qfz7dWgU.js";
+import { a as juniorAutomationRuns, f as juniorConversationBriefs, h as juniorConversationEvents, s as juniorAutomations } from "./executor-Bb3eQb8q.js";
+import { m as credentialLogContext } from "./registry-B_M_x_iS.js";
+import { n as pluginCatalogRuntime } from "./catalog-runtime-B8SuFPGb.js";
+import { C as automationVersionOf, Kt as projectConversationMessages, P as slackMention, U as slackEntitySchema, Ut as appendConversationMessages, W as slackExternalRefIdSchema, Yt as settleConversationTitleWork, b as admitEventAutomationRun, c as withScheduledAutomationLock, i as readScheduledAutomation, l as blockEventAutomation, n as listScheduledAutomationsForTeam, o as saveScheduledAutomationInLock, p as findMatchingEventAutomations, s as scheduledRunId, u as collectEventAutomationMatchKeys, x as eventAutomationRunLimitReason } from "./tasks-DieKX3d4.js";
+import { $ as bindSlackDirectCredentialSubject, At as resolveRootVisibility, Ht as getSlackClient, Jt as getWorkspaceTeamId, Nt as listConversationAnnotations, Q as bindScheduledAutomationCredentialSubject, U as collectEventMatchKeys, Wt as isDmChannel, X as takeDueTimerWatches, Yt as runWithWorkspaceTeamId, Z as bindEventAutomationCredentialSubject, a as getPluginRoutes, at as getDashboardConversationLink, ct as setDashboardConversationLinkOptions, d as setPlugins, et as verifyEventAutomationCredentialSubject, f as validatePlugins, ft as createPluginLogger, h as setBriefsConfig, i as getPluginApiRoutes, lt as createPluginState, nt as verifySlackDirectCredentialSubject, pt as readConversationAccessFromSql, q as findMatchingWatches, st as getDashboardTaskLink, tt as verifyScheduledAutomationCredentialSubject, u as getPlugins } from "./agent-hooks-B00FaKdP.js";
+import { W as annotationCard } from "./conversation-DjN3mlog.js";
+import { l as getThreadStopDecision, o as SubscribedReplyReason } from "./pending-auth-rG5U_QS1.js";
+import { b as eventGuidance, f as slackChannelMessageEvent, k as renderTaskInput, l as getEventCatalog, m as slackChannelMessageRunsAutomation, p as slackChannelMessageReplyThreadTs, u as SLACK_EVENT_NAMESPACE } from "./session-stop-CV65ZlU3.js";
+import { r as getStateAdapter, s as withLock$1 } from "./adapter-Bn0gFVSF.js";
+import { n as getNextRunAtMs } from "./cadence-R7Em4RjE.js";
+import { f as setSandboxResourceConfig, u as getSandboxResourceConfig } from "./resolve-BzpuLh8c.js";
+import { a as getVercelConversationWorkQueue, g as isConversationQueueMessageRejectedError, h as conversationQueueMessageSchema, i as verifyWorkspaceSnapshotJobMessage, o as resolveConversationWorkQueueTopic, s as verifyConversationQueueMessage, t as WORKSPACE_SNAPSHOT_JOB_QUEUE_TOPIC } from "./job-queue-vdGU-5ge.js";
+import { A as hasRunnableConversationWork$1, M as isInvalidConversationRecordError, O as CONVERSATION_WORK_STALE_ENQUEUE_MS, S as removeActiveConversation, _ as hasRunnableConversationWork, c as clearExpiredConversationLease, g as getConversationWorkState, h as getConversation, m as ensureConversationWake, r as appendAndEnqueueInboundMessage, v as listActiveConversationIds } from "./store-B1GES4gC.js";
+import { D as scheduledRunSchema } from "./automation-DWBFBenG.js";
+import { i as setExperimentalFeatures, n as getExperimentalFeatures, r as isExperimentalFeatureEnabled } from "./experimental-BNK1l1jv.js";
+import { n as validatePluginRegistrations, t as validatePluginEgressCredentialHooks } from "./validation-23d7K9tX.js";
+import { a as pluginRuntimeRegistrationsFromPluginSet, n as pluginCatalogConfigFromEnv, r as pluginCatalogConfigFromPluginSet, t as defineJuniorPlugins } from "./plugins-DOm9Y6qI.js";
+import { A as THREAD_OPTOUT_ACK, C as buildSlackInboundMessage, D as normalizeIncomingSlackThreadId, E as stopSlackThread, F as renderSlackObjectCard, I as createVercelAttachmentStorage, M as parseContent, N as runWithSlackInstallation, O as withNormalizedThreadId, P as verifySlackSignature, R as enqueueAgentDispatch, S as recordSkippedConversationMessage, T as isSlackMessageStopped, a as recordWebConversationActivity, c as createProductionSlackWebhookServices, f as createSlackWebApiStatusSender, j as startProcessingReaction, k as stopConversationTurn, l as getProductionSlackAdapter, n as conversationTurnIdForMessage, o as webActorFromEmail, s as createProductionConversationWorkOptions, t as appendAndEnqueueWebMessage, v as readViewerAutomationSummary, w as clearSlackPendingReactions, z as GET$3 } from "./web-input-BZDyxpzR.js";
+import { C as existingConversationId, N as recordAutomationExecution, c as getDispatchConversationId, d as getDispatchRecord, h as listPendingDispatchMailboxAppends, i as buildDispatchId, m as isTerminalDispatchStatus, o as confirmDispatchMailboxAppend, p as getPluginDispatchProjection, s as createOrGetDispatch, t as processPluginTask, x as notifyAutomationBlocked, y as markDispatchFailed } from "./task-runner-BlGhcQPi.js";
+import { o as getAuthPausedConversationTurnId, t as enqueueAgentInvocationResult } from "./result-DEZH_AnZ.js";
+import { r as enqueueAgentInvocation } from "./work-D3QKiV0O.js";
+import { s as coerceThreadConversationState } from "./thread-state-DpSWS4Rr.js";
+import { o as unlinkProvider } from "./connections-9gJkfS85.js";
+import { a as GET$4, i as publishAppHomeView, r as GET$5, t as receiveLocalOAuthCredential } from "./credential-sync-BABGymK3.js";
+import { a as registerVercelPluginTaskDevConsumer, n as createVercelPluginTaskCallback, s as queueCallback } from "./task-queue-BAeGEMjJ.js";
+import { t as processConversationWork } from "./worker-C8mUjYf9.js";
+import { t as bindMessageAgent } from "./message-DRf6m4uO.js";
+import { t as bindSpawnAgent } from "./spawn-BSAQ7UQZ.js";
 import { createRequire } from "node:module";
 import { Hono } from "hono";
 import { z } from "zod";
@@ -48,7 +47,7 @@ import { ChannelImpl, ThreadImpl } from "chat";
 import * as acp from "@agentclientprotocol/sdk";
 import { createAuthMiddleware } from "better-auth/api";
 import { betterAuth } from "better-auth/minimal";
-//#region src/chat/events/timers.ts
+// src/chat/events/timers.ts
 /** Publish a bounded batch of due timers; the mailbox owns agent execution. */
 async function runTimerWatchHeartbeat(args) {
 	const errors = [];
@@ -67,8 +66,7 @@ async function runTimerWatchHeartbeat(args) {
 	}
 	if (errors.length) throw new AggregateError(errors, "Timer Watch delivery failed");
 }
-//#endregion
-//#region src/chat/task-execution/heartbeat.ts
+// src/chat/task-execution/heartbeat.ts
 const DEFAULT_RECOVERY_LIMIT = 25;
 function heartbeatIdempotencyKey(reason, conversationId, nowMs) {
 	return `heartbeat:${reason}:${conversationId}:${nowMs}`;
@@ -167,8 +165,7 @@ async function recoverConversationWork(args) {
 	});
 	return result;
 }
-//#endregion
-//#region src/chat/agent-dispatch/validation.ts
+// src/chat/agent-dispatch/validation.ts
 function hasIssueAtPath(issues, path) {
 	return issues.some((issue) => issue.path.length === path.length && issue.path.every((value, index) => value === path[index]));
 }
@@ -218,8 +215,7 @@ async function verifyDispatchCredentialSubjectAccess(options, plugin) {
 		subject: options.credentialSubject
 	}))) throw new Error("Dispatch credentialSubject is not valid for this action");
 }
-//#endregion
-//#region src/chat/agent-dispatch/context.ts
+// src/chat/agent-dispatch/context.ts
 const MAX_DISPATCHES_PER_HEARTBEAT = 25;
 function bindDispatchCredentialSubject(options, plugin) {
 	const { credentialSubject, ...baseOptions } = options;
@@ -307,7 +303,11 @@ async function dispatchEventAutomation(args) {
 		...unboundOptions,
 		...outcomes !== void 0 ? { outcomes } : void 0,
 		...boundSubject ? { credentialSubject: boundSubject } : void 0,
-		source: { kind: "event_automation" }
+		source: {
+			kind: "event_automation",
+			automationId: args.automationId,
+			automationRunId: buildDispatchId(plugin, unboundOptions.idempotencyKey)
+		}
 	};
 	return await dispatch({
 		conversationWorkQueue: args.conversationWorkQueue,
@@ -330,7 +330,11 @@ async function dispatchScheduledAutomation(args) {
 		...unboundOptions,
 		...outcomes !== void 0 ? { outcomes } : void 0,
 		...boundSubject ? { credentialSubject: boundSubject } : void 0,
-		source: { kind: "scheduled_automation" }
+		source: {
+			kind: "scheduled_automation",
+			automationId: args.automationId,
+			automationRunId: unboundOptions.idempotencyKey
+		}
 	};
 	return await dispatch({
 		conversationWorkQueue: args.conversationWorkQueue,
@@ -346,8 +350,7 @@ async function getScheduledAutomationDispatch(id) {
 		id
 	});
 }
-//#endregion
-//#region src/chat/event-automations/runs.ts
+// src/chat/event-automations/runs.ts
 /**
 * Record a dispatched event automation run with the Automation version it ran,
 * and link its Conversation when it exists. The dispatch can finish before
@@ -386,8 +389,7 @@ async function settleEventAutomationRuns(db, nowMs) {
 		});
 	}
 }
-//#endregion
-//#region src/chat/automations/reply-attribution.ts
+// src/chat/automations/reply-attribution.ts
 /** Name the Automation in the footer of the replies that its runs post. */
 function automationReplyAttribution(title) {
 	const detail = (title ?? "").replace(/\s+/g, " ").trim().slice(0, 128).trim();
@@ -396,8 +398,7 @@ function automationReplyAttribution(title) {
 		detail
 	} : { label: "Automation" };
 }
-//#endregion
-//#region src/chat/scheduled-automations/runs.ts
+// src/chat/scheduled-automations/runs.ts
 const PENDING_CLAIM_STALE_MS = 6e4;
 const MISSED_RUN_MAX_AGE_MS = 864e5;
 const INCOMPLETE_RUN_STATUSES = ["pending", "running"];
@@ -722,8 +723,7 @@ async function advanceScheduledAutomationAfterRun(db, args) {
 		return args.status === "blocked";
 	});
 }
-//#endregion
-//#region src/chat/scheduled-automations/heartbeat.ts
+// src/chat/scheduled-automations/heartbeat.ts
 const SCHEDULED_AUTOMATION_HEARTBEAT_LIMIT = 10;
 function singleLineMetadataValue(value) {
 	return value.replace(/[\r\n]+/g, " ").replace(/\s+/g, " ").trim();
@@ -954,6 +954,7 @@ async function runScheduledAutomationHeartbeat(args) {
 		let dispatch;
 		try {
 			dispatch = await dispatchScheduledAutomation({
+				automationId: task.id,
 				conversationWorkQueue: args.conversationWorkQueue,
 				nowMs: args.nowMs,
 				options: {
@@ -997,8 +998,7 @@ async function runScheduledAutomationHeartbeat(args) {
 	}
 	return dispatchCount;
 }
-//#endregion
-//#region src/chat/agent-dispatch/heartbeat.ts
+// src/chat/agent-dispatch/heartbeat.ts
 const DEFAULT_PLUGIN_LIMIT = 25;
 const PLUGIN_HEARTBEAT_TIMEOUT_MS = 25e3;
 const DISPATCH_MAILBOX_APPEND_LIMIT = 100;
@@ -1132,8 +1132,7 @@ async function runHeartbeat(args) {
 		nowMs: args.nowMs
 	});
 }
-//#endregion
-//#region src/handlers/heartbeat.ts
+// src/handlers/heartbeat.ts
 function getHeartbeatSecret() {
 	return process.env.JUNIOR_SCHEDULER_SECRET?.trim() || process.env.CRON_SECRET?.trim();
 }
@@ -1158,8 +1157,7 @@ async function GET$2(request, waitUntil, options = {}) {
 	}));
 	return new Response("Accepted", { status: 202 });
 }
-//#endregion
-//#region src/chat/conversations/sql/purge.ts
+// src/chat/conversations/sql/purge.ts
 /** Discover a root and its current descendants via `parent_conversation_id`. */
 async function discoverConversationTree(executor, root) {
 	const all = /* @__PURE__ */ new Map([[root.conversationId, root]]);
@@ -1318,8 +1316,7 @@ async function purgeConversationTree(executor, args) {
 		});
 	});
 }
-//#endregion
-//#region src/chat/conversations/retention.ts
+// src/chat/conversations/retention.ts
 /**
 * Content retention policy and the bounded purge job.
 *
@@ -1395,8 +1392,7 @@ async function runRetentionPurge(executor, args) {
 		attachments: attachmentResult.deleted
 	};
 }
-//#endregion
-//#region src/handlers/retention.ts
+// src/handlers/retention.ts
 function getRetentionSecret() {
 	return process.env.JUNIOR_SCHEDULER_SECRET?.trim() || process.env.CRON_SECRET?.trim();
 }
@@ -1427,8 +1423,7 @@ async function GET$1(request, options = {}) {
 		return new Response("Retention purge failed", { status: 500 });
 	}
 }
-//#endregion
-//#region src/chat/sandbox/egress/oidc.ts
+// src/chat/sandbox/egress/oidc.ts
 const OIDC_DISCOVERY_CACHE_TTL_MS = 36e5;
 const OIDC_DISCOVERY_CACHE_MAX_ENTRIES = 8;
 const jwksByIssuer = /* @__PURE__ */ new Map();
@@ -1480,8 +1475,7 @@ async function verifyVercelSandboxOidcToken(token, options = {}) {
 		...options.currentDate ? { currentDate: options.currentDate } : void 0
 	})).payload;
 }
-//#endregion
-//#region src/chat/sandbox/egress/proxy.ts
+// src/chat/sandbox/egress/proxy.ts
 const OIDC_TOKEN_HEADER = "vercel-sandbox-oidc-token";
 const FORWARDED_HOST_HEADER = "vercel-forwarded-host";
 const FORWARDED_SCHEME_HEADER = "vercel-forwarded-scheme";
@@ -1736,8 +1730,7 @@ async function proxySandboxEgressRequest(request, deps = {}) {
 		upstreamUrl
 	}));
 }
-//#endregion
-//#region src/handlers/sandbox-egress-proxy.ts
+// src/handlers/sandbox-egress-proxy.ts
 /** Handles Vercel Sandbox firewall egress proxy requests. */
 async function ALL(request, options = {}) {
 	return await proxySandboxEgressRequest(request, {
@@ -1750,8 +1743,7 @@ async function ALL(request, options = {}) {
 function isSandboxEgressRequest(request) {
 	return isSandboxEgressForwardedRequest(request);
 }
-//#endregion
-//#region src/handlers/sandbox-egress-route.ts
+// src/handlers/sandbox-egress-route.ts
 /**
 * Route authenticated sandbox egress proxy traffic before ordinary app routes.
 */
@@ -1759,8 +1751,7 @@ async function handleSandboxEgressRoute(request, tracePropagationDomains, next)
 	if (isSandboxEgressRequest(request)) return await ALL(request, { tracePropagation: { domains: tracePropagationDomains } });
 	await next();
 }
-//#endregion
-//#region src/handlers/sandbox-egress-signals.ts
+// src/handlers/sandbox-egress-signals.ts
 const SANDBOX_EGRESS_TOKEN_HEADER = "x-junior-sandbox-egress-token";
 function isLoopbackDevelopmentRequest(request) {
 	const hostname = new URL(request.url).hostname;
@@ -1785,8 +1776,7 @@ async function GET(request) {
 		...permissionDenied ? { permission_denied: permissionDenied } : void 0
 	});
 }
-//#endregion
-//#region src/chat/slack/annotation-details.ts
+// src/chat/slack/annotation-details.ts
 const eventSchema$1 = z.object({
 	trigger_id: z.string().min(1),
 	user: z.string().min(1),
@@ -1864,8 +1854,7 @@ async function presentSlackAnnotationDetails(event, teamId) {
 		metadata: slackEntitySchema.parse(entity)
 	});
 }
-//#endregion
-//#region src/chat/ingress/slack-payload.ts
+// src/chat/ingress/slack-payload.ts
 const eventTimestampSchema = slackMessageTsSchema.refine((value) => Number.isFinite((/* @__PURE__ */ new Date(Number(value) * 1e3)).getTime()));
 const slackSlashCommandSchema = z.object({
 	channel_id: z.string().trim().pipe(slackChannelIdSchema),
@@ -1962,8 +1951,7 @@ const slackInteractivePayloadSchema = z.object({
 		team_id: z.string().optional()
 	}).optional()
 });
-//#endregion
-//#region src/chat/ingress/slash-command.ts
+// src/chat/ingress/slash-command.ts
 async function postEphemeral(event, text) {
 	await event.channel.postEphemeral(event.userId, text, { fallbackToDM: false });
 }
@@ -2024,8 +2012,7 @@ async function handleSlashCommand(event) {
 	if (subcommand === "link") await handleLink(event, normalized);
 	else await handleUnlink(event, normalized);
 }
-//#endregion
-//#region src/chat/ingress/slack-form.ts
+// src/chat/ingress/slack-form.ts
 function parseJson$1(body) {
 	try {
 		return JSON.parse(body);
@@ -2130,8 +2117,7 @@ async function handleSlackForm(args) {
 	})));
 	return new Response("", { status: 200 });
 }
-//#endregion
-//#region src/chat/ingress/bot-mention.ts
+// src/chat/ingress/bot-mention.ts
 /**
 * Detect Slack bot @mentions that should activate Junior.
 *
@@ -2208,8 +2194,7 @@ function textMentionsBot(text, botUserId) {
 	const id = escapeRegExp(botUserId);
 	return new RegExp(`<@${id}(?:\\|[^>]+)?>`).test(outside);
 }
-//#endregion
-//#region src/chat/event-automations/ingest.ts
+// src/chat/event-automations/ingest.ts
 /**
 * Owns event matching and durable event-automation dispatch.
 *
@@ -2266,7 +2251,8 @@ async function ingestEventAutomations(input, options) {
 					},
 					extra: {
 						"app.event.event_type": event.eventType,
-						"app.event_automation.max_runs_per_hour": botConfig.maxEventAutomationRunsPerHour,
+						"app.event_automation.max_runs": botConfig.maxEventAutomationRuns,
+						"app.event_automation.run_window_ms": botConfig.eventAutomationRunWindowMs,
 						"app.event_automation.resource_type": task.trigger.resourceType,
 						"app.task.id": task.id
 					}
@@ -2292,6 +2278,7 @@ async function ingestEventAutomations(input, options) {
 			taskId: task.id
 		} : void 0;
 		const dispatch = await dispatchEventAutomation({
+			automationId: task.id,
 			conversationWorkQueue: options.queue,
 			nowMs,
 			options: {
@@ -2317,8 +2304,7 @@ async function ingestEventAutomations(input, options) {
 	if (errors.length > 0) throw new AggregateError(errors, "Failed to dispatch one or more event automations");
 	return { dispatched };
 }
-//#endregion
-//#region src/chat/ingress/workspace-membership.ts
+// src/chat/ingress/workspace-membership.ts
 const MEMBER_TTL_MS = 3e5;
 const NON_MEMBER_TTL_MS = 3e4;
 const authorTeamSchema = z.object({
@@ -2364,13 +2350,14 @@ async function isSlackWorkspaceMember(raw, state) {
 	if (!result.acquired) throw new Error("Could not acquire Slack membership lookup lock");
 	return result.value;
 }
-//#endregion
-//#region src/chat/sign-in/allowlist.ts
-/** Google accounts that may sign in. The dashboard uses the same list. */
+// src/chat/sign-in/allowlist.ts
 /**
-* Read a list env var the same way as the dashboard: a JSON string array or
-* comma-separated values.
+* Domains that may use Junior. Slack authors must have a Slack profile email
+* on one of them, and dashboard Google sign-ins must come from a Google
+* Workspace account whose `hd` claim is one of them. Slack and the dashboard
+* share one list.
 */
+/** Read a list env var: a JSON string array or comma-separated values. */
 function readEnvList(name) {
 	const value = process.env[name]?.trim();
 	if (!value) return void 0;
@@ -2386,150 +2373,50 @@ function readEnvList(name) {
 	return list.data;
 }
 /**
-* Resolve the sign-in allowlist. Use the same values as the dashboard: its
-* options when set, else its environment variables.
+* Resolve the allowed domains: the `createApp` option when set, else
+* `JUNIOR_ALLOWED_DOMAINS`. An empty list allows every domain.
 */
-function resolveSignInAllowlist(options = {}) {
-	const list = (values, name) => (values ?? readEnvList(name) ?? []).map((value) => value.trim().toLowerCase()).filter(Boolean);
-	return {
-		domains: list(options.allowedGoogleDomains, "JUNIOR_DASHBOARD_GOOGLE_DOMAINS"),
-		emails: list(options.allowedEmails, "JUNIOR_DASHBOARD_ALLOWED_EMAILS")
-	};
+function resolveAllowedDomains(allowedDomains) {
+	return [...new Set((allowedDomains ?? readEnvList("JUNIOR_ALLOWED_DOMAINS") ?? []).map((value) => value.trim().toLowerCase()).filter(Boolean))];
 }
-/** Return whether a normalized Google email is on the allowlist. */
-function isSignInAllowed(email, allowlist) {
-	const domain = email.slice(email.lastIndexOf("@") + 1);
-	return allowlist.emails.includes(email) || allowlist.domains.includes(domain);
-}
-//#endregion
-//#region src/chat/sign-in/slack.ts
 /**
-* Slack sign-in through the shared Google sign-in session.
-*
-* Slack sends a person here when they have no recent Google sign-in. The page
-* uses the browser session that the dashboard also uses. When the person has
-* no session, or an old one, it starts a Google sign-in and comes back here.
-* The sign-in counts only when its Google email belongs to the user of the
-* Slack identity that got the link.
+* Fail startup on the removed Google-specific names. Ignoring them would
+* leave the list empty, which lets every Slack workspace member in.
 */
-const SLACK_SIGN_IN_PATH = "/api/sign-in/slack";
-const SIGN_IN_STATE_TTL_MS = 6e5;
-const signInStateSchema = z.object({
-	redirected: z.boolean(),
-	slackTeamId: z.string().min(1),
-	slackUserId: z.string().min(1)
-});
-function stateKey(state) {
-	return `sign-in:v2:${state}`;
-}
-function page(title, message, status) {
-	return htmlCallbackResponse(escapeXml(title), escapeXml(message), status);
-}
-/** Store one Slack sign-in request and return its link. */
-async function createSlackSignInUrl(args) {
-	const state = randomBytes(24).toString("base64url");
-	await args.state.set(stateKey(state), {
-		redirected: false,
-		slackTeamId: args.slackTeamId,
-		slackUserId: args.slackUserId
-	}, SIGN_IN_STATE_TTL_MS);
-	const url = new URL(SLACK_SIGN_IN_PATH, args.baseURL);
-	url.searchParams.set("state", state);
-	return url.toString();
-}
+function assertNoLegacyAllowedDomains(dashboardOptionKeys) {
+	if (dashboardOptionKeys.includes("allowedGoogleDomains")) throw new Error("dashboard.allowedGoogleDomains was removed; set createApp({ allowedDomains }) instead");
+	if (process.env.JUNIOR_DASHBOARD_GOOGLE_DOMAINS?.trim()) throw new Error("JUNIOR_DASHBOARD_GOOGLE_DOMAINS was removed; set JUNIOR_ALLOWED_DOMAINS instead");
+}
+/** Return whether a verified domain may use Junior. An empty list allows all. */
+function isAllowedDomain(domain, allowedDomains) {
+	if (allowedDomains.length === 0) return true;
+	return Boolean(domain && allowedDomains.includes(domain.toLowerCase()));
+}
+// src/chat/ingress/slack-allowed-domain.ts
+const ALLOWED_TTL_MS = 3e5;
+const NOT_ALLOWED_TTL_MS = 3e4;
 /**
-* Finish a Slack sign-in when the browser has a recent Google sign-in for the
-* user of the Slack identity. Otherwise start one Google sign-in.
+* Return whether a Slack author may start a Turn. With allowed domains, the
+* email of the author's Slack profile must be on one of them. Slack verifies
+* that email, so Junior trusts it. Without allowed domains, every author may.
 */
-async function handleSlackSignIn(args) {
-	const token = new URL(args.request.url).searchParams.get("state");
-	const parsed = token ? signInStateSchema.safeParse(await args.state.get(stateKey(token))) : void 0;
-	if (!token || !parsed?.success) return page("Sign-in link expired", `Mention ${botConfig.userName} in Slack again to get a new link.`, 400);
-	const stored = parsed.data;
-	const session = await args.auth.getSession(args.request);
-	const email = session?.user.emailVerified ? normalizeIdentityEmail(session.user.email) : void 0;
-	let failure;
-	if (email && !isSignInAllowed(email, args.allowlist)) failure = page("Account not allowed", `${email} cannot use ${botConfig.userName}. Sign in with your work account.`, 403);
-	else if (email) {
-		const executor = getSqlExecutor();
-		const userId = await findSlackIdentityUserId(executor, stored.slackTeamId, stored.slackUserId);
-		const user = await findUserByEmailFromSql(executor.db(), email);
-		if (!userId || user?.id !== userId) failure = page("Slack account does not match", `Your Slack email is not ${email}. Sign in with the account that matches your Slack email.`, 403);
-		else if (await slackUserHasGoogleSignIn(executor, {
-			signedInSince: new Date(Date.now() - args.signIn.maxAgeMs),
-			slackTeamId: stored.slackTeamId,
-			slackUserId: stored.slackUserId
-		})) {
-			await args.state.delete(stateKey(token));
-			return page("You are signed in", "Return to Slack and send your message again.", 200);
-		}
-	}
-	if (stored.redirected) return failure ?? page("Sign-in failed", "Google sign-in did not finish. Sign in with your work account.", 400);
-	await args.state.set(stateKey(token), {
-		...stored,
-		redirected: true
-	}, SIGN_IN_STATE_TTL_MS);
-	const returnUrl = new URL(SLACK_SIGN_IN_PATH, args.signIn.baseURL);
-	returnUrl.searchParams.set("state", token);
-	return await args.auth.signInWithGoogle(args.request, returnUrl.toString(), returnUrl.toString());
-}
-//#endregion
-//#region src/chat/ingress/slack-sign-in.ts
-/** Require a recent Google sign-in before a Slack user can start a Turn. */
-/**
-* Return whether this Slack user may start work.
-*
-* The user of the Slack identity must have signed in with Google, in Slack or
-* in the dashboard, within `signIn.maxAgeMs`. When it has not, save the Slack
-* identity with the email from the Slack profile, so the sign-in page can match
-* it, and check again. Then send the user a private sign-in link and drop the
-* message.
-*/
-async function hasSlackSignIn(args) {
-	if (!args.signIn) return true;
-	const teamId = args.installation.teamId;
-	const channelId = args.event.channel;
-	const userId = parseSlackUserId(args.event.user);
-	if (!teamId || !channelId || !userId) return false;
-	const executor = getSqlExecutor();
-	const signedInSince = new Date(Date.now() - args.signIn.maxAgeMs);
-	const hasSignIn = () => slackUserHasGoogleSignIn(executor, {
-		signedInSince,
-		slackTeamId: teamId,
-		slackUserId: userId
-	});
-	if (await hasSignIn()) return true;
+async function isSlackAuthorDomainAllowed(args) {
+	if (args.allowedDomains.length === 0) return true;
+	const userId = parseSlackUserId(args.user);
+	if (!args.teamId || !userId) return false;
+	const key = `slack:allowed-domain:${args.teamId}:${userId}`;
+	const cached = await args.state.get(key);
+	if (typeof cached === "boolean") return cached;
 	const profile = await lookupSlackUserProfile(userId);
-	await upsertIdentity(executor, {
-		kind: "user",
-		provider: "slack",
-		providerTenantId: teamId,
-		providerSubjectId: userId,
-		...profile.real_name ? { displayName: profile.real_name } : void 0,
-		...profile.name ? { handle: profile.name } : void 0,
-		...profile.email ? {
-			email: profile.email,
-			emailVerified: true
-		} : void 0,
-		metadata: { platform: "slack" }
-	});
-	if (await hasSignIn()) return true;
-	const link = await createSlackSignInUrl({
-		baseURL: args.signIn.baseURL,
-		slackTeamId: teamId,
-		slackUserId: userId,
-		state: args.state
-	});
-	await deliverPrivateMessage({
-		channelId,
-		...args.event.thread_ts ? { threadTs: args.event.thread_ts } : void 0,
-		userId,
-		text: `${formatSlackLink(link, `Sign in to use ${botConfig.userName}`)}. Sign in with your work Google account, then send your message again.`
-	});
-	return false;
-}
-//#endregion
-//#region src/chat/ingress/slack-message-telemetry.ts
+	const email = profile.email?.toLowerCase();
+	const separator = email?.lastIndexOf("@") ?? -1;
+	const domain = separator > 0 ? email?.slice(separator + 1) : void 0;
+	const allowed = profile.id === userId && isAllowedDomain(domain, args.allowedDomains);
+	if (!allowed) logWarn("slack.allowed_domain.rejected", { "app.reason": email ? "domain_not_allowed" : "missing_email" });
+	await args.state.set(key, allowed, allowed ? ALLOWED_TTL_MS : NOT_ALLOWED_TTL_MS);
+	return allowed;
+}
+// src/chat/ingress/slack-message-telemetry.ts
 function field(value, pattern) {
 	if (value === void 0) return "missing";
 	return typeof value === "string" && value.length <= 64 && pattern.test(value) ? value : "invalid";
@@ -2553,8 +2440,7 @@ function slackMessageAttributes(body) {
 		"app.slack.is_ext_shared_channel": typeof body.is_ext_shared_channel === "boolean" ? body.is_ext_shared_channel : body.is_ext_shared_channel === void 0 ? "missing" : "invalid"
 	};
 }
-//#endregion
-//#region src/chat/slack/automation-details.ts
+// src/chat/slack/automation-details.ts
 function textField(key, label, value) {
 	return {
 		key,
@@ -2655,8 +2541,7 @@ async function presentSlackAutomationDetails(event, teamId) {
 		metadata: slackEntitySchema.parse(entity)
 	});
 }
-//#endregion
-//#region src/chat/ingress/slack-webhook.ts
+// src/chat/ingress/slack-webhook.ts
 function slackEventLogContext(event) {
 	const channelId = event?.channel?.trim() || void 0;
 	const threadTs = event?.thread_ts?.trim() || event?.ts?.trim() || void 0;
@@ -2850,7 +2735,7 @@ async function handleSlackThreadStop(args) {
 	recordSkippedConversationMessage({
 		conversation,
 		message: args.message,
-		skippedReason: `thread_opt_out:${args.stopReason}`,
+		skippedReason: `${SubscribedReplyReason.ThreadOptOut}:${args.stopReason}`,
 		text: content.text
 	});
 	await appendConversationMessages(getConversationEventStore(), {
@@ -2951,14 +2836,19 @@ async function routeParsedMessage(args) {
 		});
 		return;
 	}
-	if (route === "mention" && !await hasSlackSignIn(args)) return;
+	if (route === "mention" && !await isSlackAuthorDomainAllowed({
+		allowedDomains: args.allowedDomains,
+		state: args.state,
+		teamId: args.installation.teamId,
+		user: args.event.user
+	})) return;
 	if (isSubscribed && !isExperimentalFeatureEnabled("passive-routing")) {
 		const content = parseContent(message);
 		const conversation = coerceThreadConversationState(void 0);
 		recordSkippedConversationMessage({
 			conversation,
 			message,
-			skippedReason: `passive_disabled:passive-routing`,
+			skippedReason: `${SubscribedReplyReason.PassiveDisabled}:passive-routing`,
 			text: content.text
 		});
 		await appendConversationMessages(getConversationEventStore(), {
@@ -3068,7 +2958,7 @@ async function handleSlackEvent(args) {
 					conversationStore: args.services.conversationStore,
 					queue: args.services.queue,
 					receivedAtMs,
-					signIn: args.services.signIn,
+					allowedDomains: args.services.allowedDomains ?? [],
 					state
 				}), {
 					keepAlive: true,
@@ -3126,8 +3016,7 @@ async function handleSlackWebhook(args) {
 	}
 	return new Response("ok", { status: 200 });
 }
-//#endregion
-//#region src/handlers/webhooks.ts
+// src/handlers/webhooks.ts
 /** Run a platform webhook with shared request tracing and error logging. */
 async function handleWebhookRequest(request, platform, run) {
 	const requestContext = createRequestContext(request, { platform });
@@ -3168,8 +3057,7 @@ async function handleWebhookRequest(request, platform, run) {
 		}
 	});
 }
-//#endregion
-//#region src/handlers/slack-webhook.ts
+// src/handlers/slack-webhook.ts
 /** Handle the production Slack webhook route. */
 async function POST(request, waitUntil, services) {
 	return handleWebhookRequest(request, "slack", () => handleSlackWebhook({
@@ -3267,8 +3155,7 @@ function createVercelConversationWorkCallback(options) {
 function registerVercelConversationWorkDevConsumer(options) {
 	return conversationWorkCallback(options).registerDev();
 }
-//#endregion
-//#region src/chat/sandbox/snapshot/job-callback.ts
+// src/chat/sandbox/snapshot/job-callback.ts
 const WORKSPACE_SNAPSHOT_JOB_DEV_CONSUMER_GROUP = "junior_workspace_snapshots_dev";
 function logWorkspaceSnapshotJobRejected(reason, metadata) {
 	logWarn("workspace.snapshot.job.queue_message.rejected", {
@@ -3297,8 +3184,7 @@ function createVercelWorkspaceSnapshotJobCallback() {
 function registerVercelWorkspaceSnapshotJobDevConsumer() {
 	return workspaceSnapshotJobCallback().registerDev();
 }
-//#endregion
-//#region src/handlers/artifacts.ts
+// src/handlers/artifacts.ts
 /** Serve one content-addressed public artifact without authentication. */
 async function publicArtifactGET(args) {
 	try {
@@ -3317,8 +3203,7 @@ async function publicArtifactGET(args) {
 		return new Response("Internal Server Error", { status: 500 });
 	}
 }
-//#endregion
-//#region src/chat/events/workspace.ts
+// src/chat/events/workspace.ts
 /**
 * Resolve the single-bot Slack team id for event-automation indexing and
 * Event people mentions.
@@ -3342,8 +3227,7 @@ function createEventTeamIdResolver() {
 		return await pending;
 	};
 }
-//#endregion
-//#region src/chat/events/app-publisher.ts
+// src/chat/events/app-publisher.ts
 /** Build the core event publisher used by plugin routes. */
 function createEventAppPublisher(args) {
 	const resolveEventAutomationTeamId = createEventTeamIdResolver();
@@ -3391,8 +3275,7 @@ function createEventAppPublisher(args) {
 		}
 	};
 }
-//#endregion
-//#region src/api/acp/conversations.ts
+// src/api/acp/conversations.ts
 const EVENT_PAGE_SIZE = 50;
 function actorFromUser(user) {
 	return webActorFromEmail(user.email, user.displayName ? { fullName: user.displayName } : void 0);
@@ -3528,8 +3411,7 @@ function createAcpConversations(options) {
 		}
 	};
 }
-//#endregion
-//#region src/api/acp/state.ts
+// src/api/acp/state.ts
 const MUTATION_LOCK_TTL_MS = 1e4;
 /** Run one ACP state mutation while its shared lock remains owned. */
 async function withLock(state, key, run, options = {}) {
@@ -3558,8 +3440,7 @@ async function withLock(state, key, run, options = {}) {
 async function fenceLock(state, lock, ttlMs = MUTATION_LOCK_TTL_MS) {
 	if (!await state.extendLock(lock, ttlMs)) throw new Error(`ACP lock ownership was lost before write for ${lock.threadId}`);
 }
-//#endregion
-//#region src/api/acp/schema.ts
+// src/api/acp/schema.ts
 /** Validate the ACP wire messages that Junior supports. */
 const ACP_SESSION_ID_PATTERN = /^local:acp:[a-f0-9]{32}$/;
 const metaSchema = z.record(z.string(), z.unknown()).nullable();
@@ -3655,8 +3536,7 @@ const cancelParamsSchema = z.object({
 	_meta: metaSchema.optional(),
 	sessionId: acpSessionIdSchema
 }).strict();
-//#endregion
-//#region src/api/acp/sleep.ts
+// src/api/acp/sleep.ts
 /** Wait for a duration and reject when the ACP request stops. */
 function sleep(ms, signal) {
 	return new Promise((resolve, reject) => {
@@ -3675,8 +3555,7 @@ function sleep(ms, signal) {
 		signal.addEventListener("abort", onAbort, { once: true });
 	});
 }
-//#endregion
-//#region src/api/acp/transport.ts
+// src/api/acp/transport.ts
 /**
 * Short-lived ACP transport state.
 *
@@ -4247,8 +4126,7 @@ function createSseBody(args) {
 		}
 	});
 }
-//#endregion
-//#region src/api/acp/auth.ts
+// src/api/acp/auth.ts
 /** Own ACP browser authorization records and connection binding. */
 const ACP_AUTHORIZATION_TTL_MS = 6e5;
 const ACP_CONNECTION_COOKIE = "junior_acp_connection";
@@ -4587,8 +4465,7 @@ async function expireAcpAuthorization(args) {
 	if (!result.acquired) return false;
 	return result.value;
 }
-//#endregion
-//#region src/api/acp/route.ts
+// src/api/acp/route.ts
 /**
 * Own the remote ACP v1 Streamable HTTP edge.
 *
@@ -5026,8 +4903,7 @@ function createAcpHttpHandler(options) {
 		}
 	};
 }
-//#endregion
-//#region src/api/acp/authorization-page.ts
+// src/api/acp/authorization-page.ts
 const ACP_AUTHORIZATION_PATH = "/_junior/acp/auth/:transactionId";
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function escapeHtml(value) {
@@ -5151,17 +5027,39 @@ async function handleAcpAuthorizationPage(args) {
 	});
 	return renderResult(args.agentName, result);
 }
-//#endregion
-//#region src/chat/sign-in/auth.ts
+// src/chat/sign-in/auth.ts
 /**
-* Google sign-in session shared by the dashboard and Slack.
+* Google sign-in session for the dashboard.
 *
 * Better Auth runs the Google OAuth flow and keeps the browser session in an
-* encrypted cookie. Each sign-in also saves the native Google identity with its
-* sign-in time, so Slack can check a recent sign-in without the browser.
+* encrypted cookie. With allowed domains, only Google Workspace accounts on
+* those domains can sign in. Each sign-in also saves the native Google
+* identity.
 */
 const DEFAULT_AUTH_PATH = "/api/auth";
 const DEFAULT_SESSION_MAX_AGE_SECONDS = 28800;
+const googleClaimsSchema = z.object({
+	sub: z.string().min(1),
+	email: z.string().optional(),
+	email_verified: z.boolean().optional(),
+	hd: z.string().optional(),
+	name: z.string().optional(),
+	picture: z.string().optional()
+});
+/**
+* Read Google ID token claims. Returns undefined for a malformed token, so
+* Better Auth redirects with `unable_to_get_user_info` instead of a 500.
+*/
+function readGoogleClaims(idToken) {
+	let payload;
+	try {
+		payload = decodeJwt(idToken);
+	} catch {
+		return;
+	}
+	const parsed = googleClaimsSchema.safeParse(payload);
+	return parsed.success ? parsed.data : void 0;
+}
 function trimSlashes(value, leading) {
 	let start = 0;
 	let end = value.length;
@@ -5173,14 +5071,12 @@ function withHttps(host) {
 	return /^https?:\/\//.test(host) ? host : `https://${host}`;
 }
 /** Resolve sign-in settings from dashboard options and environment. */
-function resolveSignInAuthConfig(agentName, options = {}) {
-	const authPath = `/${trimSlashes(options.authPath?.trim() || DEFAULT_AUTH_PATH, true)}`;
-	const baseURL = trimSlashes(withHttps(options.baseURL?.trim() || resolveBaseUrl() || "http://localhost:3000"), false);
+function resolveSignInAuthConfig(agentName, allowedDomains, options = {}) {
 	return {
 		agentName,
-		allowlist: resolveSignInAllowlist(options),
-		authPath,
-		baseURL,
+		allowedDomains,
+		authPath: `/${trimSlashes(options.authPath?.trim() || DEFAULT_AUTH_PATH, true)}`,
+		baseURL: trimSlashes(withHttps(options.baseURL?.trim() || resolveBaseUrl() || "http://localhost:3000"), false),
 		sessionMaxAgeSeconds: options.sessionMaxAgeSeconds,
 		trustedOrigins: options.trustedOrigins ?? readEnvList("JUNIOR_DASHBOARD_TRUSTED_ORIGINS") ?? []
 	};
@@ -5192,8 +5088,8 @@ function required(value, name) {
 function createBetterAuth(config) {
 	const secret = required(config.secret ?? process.env.BETTER_AUTH_SECRET ?? process.env.JUNIOR_SECRET, "JUNIOR_SECRET or BETTER_AUTH_SECRET");
 	const sessionMaxAgeSeconds = config.sessionMaxAgeSeconds ?? DEFAULT_SESSION_MAX_AGE_SECONDS;
-	const { domains, emails } = config.allowlist;
-	const hostedDomain = domains.length === 1 && emails.length === 0 ? domains[0] : void 0;
+	const { allowedDomains } = config;
+	const hostedDomain = allowedDomains.length === 0 ? void 0 : allowedDomains.length === 1 ? allowedDomains[0] : "*";
 	return betterAuth({
 		appName: config.agentName,
 		baseURL: config.baseURL,
@@ -5205,12 +5101,20 @@ function createBetterAuth(config) {
 			clientSecret: required(config.googleClientSecret ?? process.env.GOOGLE_CLIENT_SECRET, "GOOGLE_CLIENT_SECRET"),
 			hd: hostedDomain,
 			prompt: "select_account",
-			mapProfileToUser(profile) {
+			async getUserInfo(token) {
+				if (!token.idToken) return null;
+				const claims = readGoogleClaims(token.idToken);
+				if (!claims) return null;
+				if (!isAllowedDomain(claims.hd, allowedDomains)) return null;
 				return {
-					email: profile.email,
-					emailVerified: profile.email_verified,
-					image: profile.picture,
-					name: profile.name
+					user: {
+						id: claims.sub,
+						email: claims.email,
+						emailVerified: claims.email_verified === true,
+						image: claims.picture,
+						name: claims.name
+					},
+					data: claims
 				};
 			}
 		} },
@@ -5233,7 +5137,7 @@ function createBetterAuth(config) {
 			const created = ctx.context.newSession;
 			if (!created || !ctx.path.startsWith("/callback/")) return;
 			const email = normalizeIdentityEmail(created.user.email);
-			if (!created.user.emailVerified || !email || !isSignInAllowed(email, config.allowlist)) return;
+			if (!created.user.emailVerified || !email) return;
 			const google = (await ctx.context.internalAdapter.findAccounts(created.user.id)).find((account) => account.providerId === "google");
 			if (!google) throw new Error("Google sign-in has no Google account");
 			await recordGoogleSignIn(getSqlExecutor(), {
@@ -5245,8 +5149,8 @@ function createBetterAuth(config) {
 	});
 }
 /**
-* Create the shared Google sign-in session. Better Auth starts on first use,
-* so apps that never sign in need no Google credentials.
+* Create the Google sign-in session. Better Auth starts on first use, so apps
+* that never sign in need no Google credentials.
 */
 function createSignInAuth(config) {
 	let auth;
@@ -5284,14 +5188,14 @@ function createSignInAuth(config) {
 		}
 	};
 }
-//#endregion
-//#region src/dashboard-routes.ts
+// src/dashboard-routes.ts
 const DASHBOARD_PACKAGE_NAME = "@sentry/junior-dashboard";
 /** Mount the dashboard app on the dashboard-owned host paths. */
 async function createDashboardRouteRegistrations(args) {
 	if (!args.dashboard || args.dashboard.disabled) return [];
 	const createDashboardApp = args.createDashboardApp ?? await loadDashboardAppFactory();
 	return dashboardRouteRegistrations({
+		allowedDomains: args.allowedDomains,
 		auth: args.auth,
 		authenticatedRoutes: args.authenticatedRoutes,
 		conversationWorkQueue: args.conversationWorkQueue,
@@ -5393,6 +5297,8 @@ function dashboardHostRoutePaths(dashboard, authenticatedRoutes = []) {
 		"/api/people/*",
 		"/api/personal-tokens",
 		"/api/personal-tokens/*",
+		"/api/service-accounts",
+		"/api/service-accounts/*",
 		"/api/workspaces",
 		"/api/workspaces/*",
 		"/api/config",
@@ -5415,7 +5321,7 @@ function routePatternMatchesConcretePath(pattern, concretePath) {
 	const patternSegments = routeSegments(pattern);
 	const pathSegments = routeSegments(concretePath);
 	for (let index = 0; index < patternSegments.length; index += 1) {
-		const segment = patternSegments[index];
+		const segment = patternSegments[index] ?? "";
 		if (segment === "**" || segment === "*") return true;
 		const value = pathSegments[index];
 		if (!value || !routeSegmentMatches(segment, value)) return false;
@@ -5441,6 +5347,7 @@ function dashboardRouteRegistrations(args) {
 		const dashboardOptions = {
 			...args.dashboard,
 			agentName: botConfig.userName,
+			allowedDomains: args.allowedDomains,
 			...args.auth ? { auth: args.auth } : void 0,
 			authenticatedRoutes: args.authenticatedRoutes,
 			conversationWorkQueue: args.conversationWorkQueue,
@@ -5460,8 +5367,7 @@ function validateDashboardRouteOwnership(args) {
 	if (!args.dashboard || args.dashboard.disabled) return;
 	for (const route of args.routes) if (dashboardOwnedRoutePath(route.path, args.dashboard, args.authenticatedRoutes)) throw new Error(`Plugin "${route.pluginName}" route "${route.path}" conflicts with core dashboard routes`);
 }
-//#endregion
-//#region src/app.ts
+// src/app.ts
 /** Resolve the public deployment URL used by ACP browser authorization. */
 function resolveAcpBaseURL(dashboard) {
 	const configured = dashboard?.baseURL?.trim() || process.env.JUNIOR_BASE_URL?.trim();
@@ -5579,7 +5485,7 @@ async function createApp(options) {
 	}) });
 	let sandboxEgressTracePropagationDomains = [];
 	let signInConfig;
-	let slackSignIn;
+	let allowedDomains = [];
 	try {
 		sandboxEgressTracePropagationDomains = normalizeSandboxEgressTracePropagationDomains(options?.sandbox?.egressTracePropagationDomains);
 		setSandboxResourceConfig(options?.sandbox);
@@ -5592,18 +5498,10 @@ async function createApp(options) {
 		setRuntimeLimits(options?.limits);
 		setSlackReactionConfig(options?.slack ?? {});
 		if (options?.slack?.crossActorMidRunMode) setCrossActorMidRunMode(options.slack.crossActorMidRunMode);
-		const dashboardMounted = Boolean(dashboard && !dashboard.disabled);
-		if (isExperimentalFeatureEnabled("slack-sign-in") || dashboardMounted) signInConfig = resolveSignInAuthConfig(botConfig.userName, dashboard);
-		if (signInConfig && isExperimentalFeatureEnabled("slack-sign-in")) {
-			const { allowlist } = signInConfig;
-			if (!allowlist.domains.length && !allowlist.emails.length) throw new Error("experimental.slack-sign-in requires allowed Google domains or emails");
-			const maxAgeDays = options?.slack?.signInMaxAgeDays ?? 7;
-			if (!(maxAgeDays > 0)) throw new Error("slack.signInMaxAgeDays must be greater than 0");
-			slackSignIn = {
-				baseURL: signInConfig.baseURL,
-				maxAgeMs: maxAgeDays * 24 * 60 * 60 * 1e3
-			};
-		}
+		assertNoLegacyAllowedDomains(Object.keys(dashboard ?? {}));
+		allowedDomains = resolveAllowedDomains(options?.allowedDomains);
+		if (allowedDomains.length === 0) logWarn("app.allowed_domains.unset", { "app.reason": "allowedDomains is empty, so any Slack workspace member can use Junior" });
+		if (dashboard && !dashboard.disabled) signInConfig = resolveSignInAuthConfig(botConfig.userName, allowedDomains, dashboard);
 		if (shouldValidatePluginCatalog) {
 			pluginCatalogRuntime.getSignature();
 			validatePluginRegistrations(configuredPlugins?.registrations ?? []);
@@ -5697,7 +5595,7 @@ async function createApp(options) {
 			queue: conversationWorkQueue,
 			services: runtimeServiceOverrides
 		}),
-		...slackSignIn ? { signIn: slackSignIn } : void 0
+		allowedDomains
 	};
 	const app = new Hono();
 	app.onError((err, c) => {
@@ -5714,6 +5612,7 @@ async function createApp(options) {
 	], "/api/acp", (c) => getAcpRuntime().handleRequest(c.req.raw));
 	mountRoutes(app, pluginRoutes);
 	mountRoutes(app, await createDashboardRouteRegistrations({
+		allowedDomains,
 		auth: signInAuth,
 		authenticatedRoutes,
 		conversationWorkQueue,
@@ -5736,19 +5635,6 @@ async function createApp(options) {
 	app.get("/api/oauth/callback/:provider", (c) => {
 		return GET$5(c.req.raw, c.req.param("provider"), waitUntil, { conversationWorkQueue });
 	});
-	if (signInAuth && signInConfig && slackSignIn) {
-		const auth = signInAuth;
-		if (!dashboard || dashboard.disabled) app.on(["GET", "POST"], `${signInConfig.authPath}/*`, (c) => auth.handler(c.req.raw));
-		const { allowlist } = signInConfig;
-		const signIn = slackSignIn;
-		app.get(SLACK_SIGN_IN_PATH, (c) => handleSlackSignIn({
-			allowlist,
-			auth,
-			signIn,
-			request: c.req.raw,
-			state: getStateAdapter()
-		}));
-	}
 	app.get("/api/internal/sandbox-egress/signals", (c) => {
 		return GET(c.req.raw);
 	});
@@ -5792,5 +5678,4 @@ async function createApp(options) {
 	});
 	return app;
 }
-//#endregion
 export { JUNIOR_VERSION, createApp, defineJuniorPlugins };