@sentry/junior 0.259.0 → 0.261.0

package/dist/{agent-hooks-B00FaKdP.js → agent-hooks-ghyZZQqB.js}

@@ -1,27 +1,27 @@
 import { t as __exportAll } from "./rolldown-runtime-nwUcYXjP.js";
-import { i as completeObject, o as embedTexts } from "./client-BZdxgKyL.js";
-import { T as withSpan, a as extractGenAiUsageSummary, b as setSpanStatus, f as logException, m as logWarn, p as logInfo, y as setSpanAttributes, z as isRecord$1 } from "./logging-BStXN56b.js";
+import { i as completeObject, o as embedTexts } from "./client-2i0JJpoC.js";
+import { T as withSpan, a as extractGenAiUsageSummary, b as setSpanStatus, f as logException, m as logWarn, p as logInfo, y as setSpanAttributes, z as isRecord$1 } from "./logging-BLTa7R7f.js";
 import { a as getClient$1 } from "./sentry-BBUlHih9.js";
-import { t as canExposeConversationPayload } from "./conversation-privacy-CFhNKxp-.js";
-import { i as getChatConfig, n as botConfig, o as getSlackBotToken } from "./config-Deqpfpg9.js";
+import { t as canExposeConversationPayload } from "./conversation-privacy-1iTiFX1O.js";
+import { i as getChatConfig, n as botConfig, o as getSlackBotToken } from "./config-C9qM41O0.js";
 import { r as defaultModelId } from "./model-profile-Bg8EoCKD.js";
 import { d as parseSlackTeamId, g as parseSlackMessageTs, i as isActorUserId, o as parseActorUserId, u as parseSlackChannelReferenceId } from "./actor-tlxzqaRe.js";
-import { D as hasAgentTurnUsage, M as readUserTimezone, P as saveUserTimezone, c as getConversationEventStore, d as getDb, f as getSqlExecutor, g as createSqlStore, i as resolveViewerUser, r as readActorIdentity } from "./viewer-B2_ABsYi.js";
+import { D as hasAgentTurnUsage, M as readUserTimezone, P as saveUserTimezone, c as getConversationEventStore, d as getDb, f as getSqlExecutor, g as createSqlStore, i as resolveViewerUser, r as readActorIdentity } from "./viewer-C5xFaYVi.js";
 import { c as juniorIdentities, d as juniorDestinations, l as juniorUsers, s as juniorConversations } from "./agent-invocations-Qfz7dWgU.js";
-import { _ as juniorConversationAnnotations, b as juniorAttachments, f as juniorConversationBriefs, h as juniorConversationEvents, i as juniorWorkspaces, n as juniorSnapshots, r as juniorWorkspaceRepos, u as juniorConversationParticipants, v as juniorCodeChanges, y as juniorCodeRepositories } from "./executor-Bb3eQb8q.js";
+import { _ as juniorConversationAnnotations, b as juniorAttachments, f as juniorConversationBriefs, h as juniorConversationEvents, i as juniorWorkspaces, n as juniorSnapshots, r as juniorWorkspaceRepos, u as juniorConversationParticipants, v as juniorCodeChanges, y as juniorCodeRepositories } from "./executor-Rimyj8HZ.js";
 import { o as decodeStoredConversationEvent } from "./history-AY8rs-FR.js";
-import { h as credentialSubjectSchema } from "./registry-B_M_x_iS.js";
-import { C as conversationReportEventSchema, F as readMessageAttachments, H as conversationBriefSchema, U as parseBriefInput, q as readMessageCardRefs } from "./conversation-DjN3mlog.js";
-import { E as SANDBOX_WORKSPACE_ROOT, S as sleep$1, l as isSandboxMissingError, n as hash, v as getVercelSandboxCredentials, x as runNonInteractiveCommand } from "./profile-qBM6B_-V.js";
-import { n as getDefaultRedisStateAdapterFor, r as getStateAdapter } from "./adapter-Bn0gFVSF.js";
+import { h as credentialSubjectSchema } from "./registry-BnSaArNb.js";
 import { i as isValidTimeZone } from "./cadence-R7Em4RjE.js";
-import { n as briefEntriesFromReportEvents, s as generateBrief, t as BRIEF_PROMPT } from "./prompt-xgpyMtg7.js";
+import { B as readMessageAttachments, C as conversationReportEventSchema, F as readMessageCardRefs, J as parseBriefInput, q as conversationBriefSchema, w as conversationReportMessageEventSchema } from "./conversation-CvuKJ3tA.js";
+import { n as briefEntriesFromReportEvents, s as generateBrief, t as BRIEF_PROMPT } from "./prompt-DeVax2qO.js";
+import { n as getDefaultRedisStateAdapterFor, r as getStateAdapter } from "./adapter-Bx_1B2De.js";
+import { E as SANDBOX_WORKSPACE_ROOT, S as runNonInteractiveCommand, l as isSandboxMissingError, n as hash, v as getVercelSandboxCredentials, y as sleep$1 } from "./profile-CthM2qFM.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { z } from "zod";
 import { createHash, createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import { and, arrayContains, asc, desc, eq, exists, getTableColumns, gte, inArray, isNotNull, isNull, lt, lte, max, ne, notExists, or, sql } from "drizzle-orm";
 import { codeChangeInputSchema, conversationAnnotationInputSchema, conversationEventPresentationSchema, defineConversationEvent, eventInputSchema, eventMatchSchema, eventMatches, eventTypeSchema, missingToolAnnotationKeys, normalizeEventIdentifier, objectAnnotationSchema, objectIconPath, objectTypeSchema, pluginEventsSchema, promptContextSchema, promptMessageSchema, stableEventMatchKey } from "@sentry/junior-plugin-api";
-import { alias } from "drizzle-orm/pg-core";
+import { alias, union } from "drizzle-orm/pg-core";
 import { WebClient } from "@slack/web-api";
 import { Sandbox } from "@vercel/sandbox";
 // src/chat/conversations/structured-events.ts
@@ -157,731 +157,382 @@ function renderJuniorNativeConversationEvent(args) {
 	const presentation = definition.renderEvent(definition.parse(args.content));
 	return presentation === void 0 ? void 0 : conversationEventPresentationSchema.parse(presentation);
 }
-// src/chat/slack/workspace-context.ts
-const workspaceTeamIdStorage = new AsyncLocalStorage();
-/** Run a callback with the Slack workspace team ID for the inbound webhook. */
-function runWithWorkspaceTeamId(teamId, fn) {
-	if (!teamId) return fn();
-	return workspaceTeamIdStorage.run(teamId, fn);
-}
-/** Return the Slack workspace team ID for the current inbound webhook. */
-function getWorkspaceTeamId() {
-	return workspaceTeamIdStorage.getStore();
+// src/chat/slack/user.ts
+const slackUserInfoSchema = z.object({
+	ok: z.literal(true),
+	user: z.object({
+		name: z.string().nullish(),
+		tz: z.string().nullish(),
+		profile: z.object({
+			email: z.string().nullish(),
+			real_name: z.string().nullish()
+		}).optional()
+	})
+});
+const USER_CACHE_TTL_MS = 3e5;
+const userCache = /* @__PURE__ */ new Map();
+function userCacheKey(teamId, userId) {
+	return `${teamId}:${userId}`;
 }
-// src/chat/slack/client.ts
-var SlackActionError = class extends Error {
-	code;
-	apiError;
-	needed;
-	provided;
-	statusCode;
-	requestId;
-	errorData;
-	retryAfterSeconds;
-	detail;
-	detailLine;
-	detailRule;
-	constructor(message, code, options = {}) {
-		super(message);
-		this.name = "SlackActionError";
-		this.code = code;
-		this.apiError = options.apiError;
-		this.needed = options.needed;
-		this.provided = options.provided;
-		this.statusCode = options.statusCode;
-		this.requestId = options.requestId;
-		this.errorData = options.errorData;
-		this.retryAfterSeconds = options.retryAfterSeconds;
-		this.detail = options.detail;
-		this.detailLine = options.detailLine;
-		this.detailRule = options.detailRule;
-	}
-};
-function serializeSlackErrorData(data) {
-	if (!data || typeof data !== "object") return;
-	const filtered = Object.fromEntries(Object.entries(data).filter(([key]) => key !== "error"));
-	if (Object.keys(filtered).length === 0) return;
-	try {
-		const serialized = JSON.stringify(filtered);
-		return serialized.length <= 600 ? serialized : `${serialized.slice(0, 597)}...`;
-	} catch {
-		return;
+function readFromCache(teamId, userId) {
+	const hit = userCache.get(userCacheKey(teamId, userId));
+	if (!hit) return null;
+	if (hit.expiresAt < Date.now()) {
+		userCache.delete(userCacheKey(teamId, userId));
+		return null;
 	}
+	return hit.value;
 }
-/** Extract a header value by case-insensitive name from a raw headers object. */
-function getHeaderString(headers, name) {
-	if (!headers || typeof headers !== "object") return;
-	const key = name.toLowerCase();
-	const entries = headers;
-	for (const [entryKey, value] of Object.entries(entries)) {
-		if (entryKey.toLowerCase() !== key) continue;
-		if (typeof value === "string") return value;
-		if (Array.isArray(value)) {
-			const first = value.find((entry) => typeof entry === "string");
-			return typeof first === "string" ? first : void 0;
+function writeToCache(teamId, userId, value) {
+	userCache.set(userCacheKey(teamId, userId), {
+		value,
+		expiresAt: Date.now() + USER_CACHE_TTL_MS
+	});
+}
+/** Fetch Slack user profile info with in-memory TTL cache to avoid repeated API calls. */
+async function lookupSlackUser(teamId, userId) {
+	if (!teamId || !userId) return null;
+	const cached = readFromCache(teamId, userId);
+	if (cached) return cached;
+	const token = getSlackBotToken();
+	if (!token) return null;
+	try {
+		const response = await fetch(`https://slack.com/api/users.info?user=${encodeURIComponent(userId)}`, { headers: { authorization: `Bearer ${token}` } });
+		if (!response.ok) {
+			logWarn("slack.user.lookup.failed", {
+				"app.slack.user_id": userId,
+				"app.slack.team_id": teamId,
+				"http.response.status_code": response.status
+			});
+			return null;
 		}
+		const parsed = slackUserInfoSchema.safeParse(await response.json());
+		if (!parsed.success) return null;
+		const payload = parsed.data;
+		const result = {
+			userName: payload.user.name?.trim() || void 0,
+			fullName: payload.user.profile?.real_name?.trim() || void 0,
+			email: payload.user.profile?.email?.trim() || void 0,
+			timezone: payload.user.tz?.trim() || void 0
+		};
+		writeToCache(teamId, userId, result);
+		return result;
+	} catch (error) {
+		logWarn("slack.user.lookup.failed", {
+			"app.slack.user_id": userId,
+			"app.slack.team_id": teamId,
+			"exception.message": error instanceof Error ? error.message : String(error)
+		});
+		return null;
 	}
 }
-function parseSlackCanvasDetail(detail) {
-	if (typeof detail !== "string") return {};
-	const trimmed = detail.trim();
-	if (!trimmed) return {};
-	const parsed = { detail: trimmed };
-	const lineMatch = trimmed.match(/line\s+(\d+):/i);
-	if (lineMatch) {
-		const line = Number.parseInt(lineMatch[1] ?? "", 10);
-		if (Number.isFinite(line)) parsed.detailLine = line;
-	}
-	if (/unsupported heading depth/i.test(trimmed)) parsed.detailRule = "unsupported_heading_depth";
-	return parsed;
+// src/chat/identities/timezone.ts
+const DEFAULT_TIMEZONE = "America/Los_Angeles";
+/** The install timezone, used when Junior does not know a person's timezone. */
+function defaultTimezone() {
+	return process.env.JUNIOR_TIMEZONE?.trim() || DEFAULT_TIMEZONE;
 }
 /**
-* Ambient destination-installation token for Slack outbound calls, bound by
-* installation-scoped entry points so writes carry the destination
-* workspace's credentials instead of the process-global env token.
-*/
-const installationTokenStorage = new AsyncLocalStorage();
-const clientsByToken = /* @__PURE__ */ new Map();
-/**
-* Bind a workspace installation token for all Slack Web API calls inside
-* `fn`, so multi-workspace outbound writes use the destination workspace's
-* credentials rather than the env fallback token.
+* Pick a person's timezone: their Slack profile, then the saved user
+* timezone, then the install default. A valid Slack timezone is saved on the
+* linked user, so later lookups without Slack still find it.
 */
-function runWithSlackInstallationToken(token, fn) {
-	const trimmed = token.trim();
-	if (!trimmed) throw new SlackActionError("Slack installation token binding requires a non-empty token", "missing_token");
-	return installationTokenStorage.run({ token: trimmed }, fn);
+async function resolveUserTimezone(args) {
+	const timezone = (args.slack ? await lookupSlackUser(args.slack.teamId, args.slack.userId) : void 0)?.timezone;
+	if (timezone && isValidTimeZone(timezone)) {
+		if (args.userId) await saveUserTimezone(args.db, args.userId, timezone, args.nowMs);
+		return timezone;
+	}
+	return (args.userId ? await readUserTimezone(args.db, args.userId) : void 0) ?? defaultTimezone();
 }
-/**
-* Token precedence: ambient installation token, then env token, then a hard
-* failure for team-scoped calls — a call scoped to one workspace must never
-* silently fall through to another workspace's credentials.
-*/
-function resolveSlackToken() {
-	const ambientToken = installationTokenStorage.getStore()?.token;
-	if (ambientToken) return ambientToken;
-	const envToken = getSlackBotToken();
-	if (envToken) return envToken;
-	const teamId = getWorkspaceTeamId();
-	if (teamId) throw new SlackActionError(`Slack call is scoped to workspace ${teamId} but no installation token is bound and no default bot token is configured`, "missing_token");
-	throw new SlackActionError("SLACK_BOT_TOKEN (or SLACK_BOT_USER_TOKEN) is required for Slack Web API actions in this service", "missing_token");
+// src/chat/plugins/annotations.ts
+function annotationFromRow(row) {
+	const parsed = conversationAnnotationInputSchema.safeParse(row.annotation);
+	if (!parsed.success) return void 0;
+	return {
+		...parsed.data,
+		plugin: row.plugin,
+		createdAt: row.createdAt.toISOString(),
+		updatedAt: row.updatedAt.toISOString()
+	};
 }
-/** Normalize Junior Slack references to native Slack conversation IDs. */
-function normalizeSlackConversationId(channelId) {
-	return parseSlackChannelReferenceId(channelId);
+function createPluginAnnotations(args) {
+	return {
+		async upsert(input) {
+			const annotation = conversationAnnotationInputSchema.parse(input);
+			const now = /* @__PURE__ */ new Date();
+			await args.db.insert(juniorConversationAnnotations).values({
+				annotation,
+				conversationId: args.conversationId,
+				createdAt: now,
+				key: annotation.key,
+				kind: annotation.kind,
+				plugin: args.plugin,
+				updatedAt: now
+			}).onConflictDoUpdate({
+				target: [
+					juniorConversationAnnotations.conversationId,
+					juniorConversationAnnotations.plugin,
+					juniorConversationAnnotations.kind,
+					juniorConversationAnnotations.key
+				],
+				set: {
+					annotation,
+					updatedAt: now
+				}
+			});
+		},
+		async remove(kind, key) {
+			await args.db.delete(juniorConversationAnnotations).where(and(eq(juniorConversationAnnotations.conversationId, args.conversationId), eq(juniorConversationAnnotations.plugin, args.plugin), eq(juniorConversationAnnotations.kind, kind), eq(juniorConversationAnnotations.key, key)));
+		},
+		async list() {
+			return (await listConversationAnnotations(args.db, args.conversationId)).filter((a) => a.plugin === args.plugin);
+		}
+	};
 }
-/**
-* Return the per-token cached WebClient. `withSlackRetries` owns retry
-* classification for this boundary: the WebClient's built-in policy would
-* re-post timed-out writes (a duplicate-message hazard) and sleep for the
-* full unbounded Retry-After inside the request, so both internal behaviors
-* are disabled here.
-*/
-function getClient() {
-	const token = resolveSlackToken();
-	let cached = clientsByToken.get(token);
-	if (!cached) {
-		cached = new WebClient(token, {
-			retryConfig: { retries: 0 },
-			rejectRateLimitedCalls: true
-		});
-		clientsByToken.set(token, cached);
+/** Load stored annotations for one conversation, newest update first. */
+async function listConversationAnnotations(db, conversationId) {
+	return (await listConversationAnnotationsById(db, [conversationId])).get(conversationId) ?? [];
+}
+/** Load stored annotations for a bounded set of conversations. */
+async function listConversationAnnotationsById(db, conversationIds) {
+	const byConversation = /* @__PURE__ */ new Map();
+	if (conversationIds.length === 0) return byConversation;
+	const rows = await db.select().from(juniorConversationAnnotations).where(inArray(juniorConversationAnnotations.conversationId, [...conversationIds])).orderBy(desc(juniorConversationAnnotations.updatedAt));
+	for (const row of rows) {
+		const annotation = annotationFromRow(row);
+		if (!annotation) continue;
+		const current = byConversation.get(row.conversationId);
+		if (current) current.push(annotation);
+		else byConversation.set(row.conversationId, [annotation]);
 	}
-	return cached;
+	return byConversation;
 }
-function mapSlackError(error) {
-	if (error instanceof SlackActionError) return error;
-	const candidate = error;
-	const apiError = candidate.data?.error;
-	const message = candidate.message ?? "Slack action failed";
-	const baseOptions = {
-		apiError,
-		statusCode: candidate.statusCode,
-		requestId: getHeaderString(candidate.headers, "x-slack-req-id"),
-		errorData: serializeSlackErrorData(candidate.data),
-		...parseSlackCanvasDetail(candidate.data?.detail)
-	};
-	if (apiError === "missing_scope") return new SlackActionError(message, "missing_scope", {
-		...baseOptions,
-		needed: candidate.data?.needed,
-		provided: candidate.data?.provided
-	});
-	if (apiError === "not_in_channel") return new SlackActionError(message, "not_in_channel", baseOptions);
-	if (apiError === "restricted_action_read_only_channel") return new SlackActionError(message, "read_only_channel", baseOptions);
-	if (apiError === "already_reacted") return new SlackActionError(message, "already_reacted", baseOptions);
-	if (apiError === "no_reaction") return new SlackActionError(message, "no_reaction", baseOptions);
-	if (apiError === "invalid_arguments") return new SlackActionError(message, "invalid_arguments", baseOptions);
-	if (apiError === "invalid_cursor") return new SlackActionError(message, "invalid_arguments", baseOptions);
-	if (apiError === "invalid_name") return new SlackActionError(message, "invalid_arguments", baseOptions);
-	if (apiError === "not_found" || apiError === "channel_not_found" || apiError === "message_not_found") return new SlackActionError(message, "not_found", baseOptions);
-	if (apiError === "feature_not_enabled" || apiError === "not_allowed_token_type") return new SlackActionError(message, "feature_unavailable", baseOptions);
-	if (apiError === "canvas_creation_failed") return new SlackActionError(message, "canvas_creation_failed", baseOptions);
-	if (apiError === "canvas_editing_failed") return new SlackActionError(message, "canvas_editing_failed", baseOptions);
-	if (candidate.code === "slack_webapi_rate_limited_error" || candidate.statusCode === 429) return new SlackActionError(message, "rate_limited", {
-		...baseOptions,
-		retryAfterSeconds: candidate.retryAfter
+// src/chat/conversations/annotation-results.ts
+/** Save object annotations and retain returned facts in the tool result. */
+async function saveObjectAnnotations(conversationId, plugin, value) {
+	const annotations = objectAnnotationSchema.array().parse(value);
+	await getDb().transaction(async (db) => {
+		const store = createPluginAnnotations({
+			conversationId,
+			plugin,
+			db
+		});
+		for (const annotation of annotations) {
+			await store.upsert(annotation);
+			await store.remove("resource_link", annotation.key);
+		}
 	});
-	return new SlackActionError(message, "internal_error", baseOptions);
+	return annotations.map((annotation) => ({
+		...annotation,
+		plugin
+	}));
 }
-const MAX_RETRY_DELAY_MS = 1e4;
-const MAX_TOTAL_RETRY_DELAY_MS = 2e4;
-const CONNECTION_ERROR_CODES = /* @__PURE__ */ new Set([
-	"ECONNREFUSED",
-	"ECONNRESET",
-	"ENOTFOUND",
-	"EAI_AGAIN"
-]);
-const TIMEOUT_ERROR_CODES = /* @__PURE__ */ new Set([
-	"ETIMEDOUT",
-	"ECONNABORTED",
-	"ESOCKETTIMEDOUT"
-]);
-function findNetworkErrorCode(error, depth = 0) {
-	if (!error || typeof error !== "object" || depth > 4) return;
-	const candidate = error;
-	if (typeof candidate.code === "string" && (CONNECTION_ERROR_CODES.has(candidate.code) || TIMEOUT_ERROR_CODES.has(candidate.code))) return candidate.code;
-	return findNetworkErrorCode(candidate.original, depth + 1) ?? findNetworkErrorCode(candidate.cause, depth + 1);
+/** Save annotations from a successful plugin tool result and attach their cards. */
+async function annotateToolResult(conversationId, plugin, result) {
+	if (!isRecord$1(result) || result.isError === true) return result;
+	const details = isRecord$1(result.details) ? result.details : result;
+	if (details.timed_out === true || details.isError === true || !Array.isArray(details.objectAnnotations)) return result;
+	const cards = await saveObjectAnnotations(conversationId, plugin, details.objectAnnotations);
+	const { objectAnnotations: _annotations, ...rest } = details;
+	const annotated = {
+		...rest,
+		objectCards: cards
+	};
+	if (isRecord$1(result.details)) return {
+		...result,
+		details: annotated
+	};
+	return annotated;
 }
-function hasSocketHangUpMessage(error) {
-	return error instanceof Error && error.message.toLowerCase().includes("socket hang up");
+// src/chat/conversations/sql/privacy.ts
+const privacyRoot = alias(juniorConversations, "privacy_root");
+/** Accept only a structurally valid persisted root as privacy authority. */
+async function readRootCandidate(executor, conversationId) {
+	const row = (await executor.db().select({
+		requestedConversationId: juniorConversations.conversationId,
+		requestedParentConversationId: juniorConversations.parentConversationId,
+		requestedRootConversationId: juniorConversations.rootConversationId,
+		rootConversationId: privacyRoot.conversationId,
+		rootDestinationId: privacyRoot.destinationId,
+		rootParentConversationId: privacyRoot.parentConversationId,
+		rootRootConversationId: privacyRoot.rootConversationId
+	}).from(juniorConversations).leftJoin(privacyRoot, eq(privacyRoot.conversationId, juniorConversations.rootConversationId)).where(eq(juniorConversations.conversationId, conversationId)))[0];
+	return row !== void 0 && row.requestedRootConversationId !== null && (row.requestedParentConversationId !== null || row.requestedRootConversationId === row.requestedConversationId) && row.rootConversationId === row.requestedRootConversationId && row.rootRootConversationId === row.rootConversationId && row.rootParentConversationId === null && row.rootDestinationId !== null ? {
+		destinationId: row.rootDestinationId,
+		rootConversationId: row.rootConversationId
+	} : void 0;
 }
-/**
-* Classify a failed Slack call for retry: rate limits, Slack 5xx, and
-* connection-phase failures are always retryable; timeouts are retried only
-* for idempotent operations because Slack may already have accepted the
-* request.
-*/
-function classifySlackRetry(raw, mapped) {
-	if (mapped.code === "rate_limited") return "rate_limited";
-	if (mapped.statusCode !== void 0 && mapped.statusCode >= 500) return "server_error";
-	const networkCode = findNetworkErrorCode(raw);
-	if (networkCode && CONNECTION_ERROR_CODES.has(networkCode)) return "connection";
-	if (networkCode && TIMEOUT_ERROR_CODES.has(networkCode)) return "timeout";
-	if (hasSocketHangUpMessage(raw)) return "connection";
-	return "none";
+async function readCandidateVisibility(executor, candidate) {
+	const destinations = await executor.db().select({ visibility: juniorDestinations.visibility }).from(juniorDestinations).where(eq(juniorDestinations.id, candidate.destinationId)).for("share");
+	return {
+		rootConversationId: candidate.rootConversationId,
+		visibility: destinations[0]?.visibility ?? null
+	};
 }
 /**
-* Run a Slack Web API call with bounded retries so transient platform
-* failures do not surface as turn failures, while non-idempotent posts are
-* never re-sent when Slack may already have accepted them.
+* Resolve a conversation's privacy authority from its persisted root.
 *
-* Retry classes: rate limits (bounded Retry-After), connection-phase network
-* failures, and Slack 5xx responses always retry; request timeouts retry only
-* when the caller marks the operation `idempotent`.
+* Missing or structurally invalid root metadata fails closed. The root
+* destination is locked so callers that keep the transaction open receive a
+* stable visibility decision.
 */
-async function withSlackRetries(task, maxAttempts = 3, context = {}) {
-	let attempt = 0;
-	let totalDelayMs = 0;
-	const action = context.action ?? "unknown";
-	while (attempt < maxAttempts) {
-		attempt += 1;
-		const attemptNumber = attempt;
-		try {
-			return await withSpan(`POST slack.com/api/${action}`, "http.client", {}, async () => {
-				try {
-					return await task();
-				} catch (error) {
-					const mapped = mapSlackError(error);
-					const errorAttrs = { "error.type": mapped.code };
-					if (mapped.apiError) errorAttrs["app.slack.api_error_code"] = mapped.apiError;
-					if (mapped.code === "rate_limited") {
-						errorAttrs["http.response.status_code"] = 429;
-						if (mapped.retryAfterSeconds) errorAttrs["app.slack.retry_after_ms"] = mapped.retryAfterSeconds * 1e3;
-					} else if (mapped.statusCode != null) errorAttrs["http.response.status_code"] = mapped.statusCode;
-					setSpanAttributes(errorAttrs);
-					setSpanStatus("error");
-					throw error;
-				}
-			}, {
-				"http.request.method": "POST",
-				"server.address": "slack.com",
-				"url.scheme": "https",
-				"url.path": `/api/${action}`,
-				"app.slack.method": action,
-				"app.retry.max_attempts": maxAttempts,
-				...attemptNumber > 1 ? { "http.request.resend_count": attemptNumber - 1 } : void 0,
-				...context.attributes ?? {},
-				...context.spanAttributes ?? {}
-			});
-		} catch (error) {
-			const mapped = mapSlackError(error);
-			const retryClass = classifySlackRetry(error, mapped);
-			const isRetryable = retryClass === "rate_limited" || retryClass === "connection" || retryClass === "server_error" || retryClass === "timeout" && context.idempotent === true;
-			const remainingDelayBudgetMs = MAX_TOTAL_RETRY_DELAY_MS - totalDelayMs;
-			const baseLogAttributes = {
-				"app.slack.action": action,
-				"app.slack.error_code": mapped.code,
-				...mapped.apiError ? { "app.slack.api_error": mapped.apiError } : void 0,
-				...mapped.detail ? { "app.slack.detail": mapped.detail } : void 0,
-				...mapped.detailLine !== void 0 ? { "app.slack.detail_line": mapped.detailLine } : void 0,
-				...mapped.detailRule ? { "app.slack.detail_rule": mapped.detailRule } : void 0,
-				...mapped.requestId ? { "app.slack.request_id": mapped.requestId } : void 0,
-				...mapped.statusCode !== void 0 ? { "http.response.status_code": mapped.statusCode } : void 0,
-				...context.attributes ?? {}
-			};
-			if (!isRetryable || attempt >= maxAttempts || remainingDelayBudgetMs <= 0) {
-				logWarn("slack.action.failed", {
-					...baseLogAttributes,
-					...mapped.errorData ? { "app.slack.error_data": mapped.errorData } : void 0
-				});
-				throw mapped;
-			}
-			logWarn("slack.action.retrying", {
-				...baseLogAttributes,
-				"app.slack.retry_attempt": attempt,
-				"app.slack.retry_class": retryClass
-			});
-			const retryAfterMs = retryClass === "rate_limited" && mapped.retryAfterSeconds && mapped.retryAfterSeconds > 0 ? mapped.retryAfterSeconds * 1e3 : void 0;
-			const backoffMs = Math.min(2e3, 250 * 2 ** (attempt - 1));
-			const delayMs = Math.min(retryAfterMs ?? backoffMs, MAX_RETRY_DELAY_MS, remainingDelayBudgetMs);
-			totalDelayMs += delayMs;
-			await sleep$1(delayMs);
-		}
+async function resolveRootVisibility(executor, conversationId) {
+	const candidate = await readRootCandidate(executor, conversationId);
+	if (!candidate) return {
+		rootConversationId: conversationId,
+		visibility: null
+	};
+	return readCandidateVisibility(executor, candidate);
+}
+// src/chat/briefs/events.ts
+/** Durable cost and size record for one stored Brief version. */
+const briefUpdatedEvent = defineConversationEvent({
+	name: "brief_updated",
+	version: 1,
+	schema: z.object({
+		version: z.number().int().positive(),
+		modelId: z.string().min(1),
+		costUsd: z.number().finite().nonnegative().optional(),
+		decisions: z.number().int().nonnegative(),
+		openDecisions: z.number().int().nonnegative(),
+		links: z.number().int().nonnegative()
+	}).strict(),
+	renderEvent(event) {
+		return {
+			icon: "activity",
+			title: `Brief updated (v${event.version})`
+		};
 	}
-	throw new SlackActionError("Slack action exhausted retries", "internal_error");
+});
+// src/chat/slack/attachments.ts
+/** Save the vision summary for a stored Slack attachment. */
+async function recordSlackAttachment(args) {
+	await args.db.db().update(juniorAttachments).set({ visionSummary: args.visionSummary }).where(and(eq(juniorAttachments.id, args.attachmentId), eq(juniorAttachments.conversationId, args.conversationId), isNull(juniorAttachments.deleteRequestedAt)));
 }
-/**
-* Slack Web API client for the current destination workspace: the ambient
-* installation token when one is bound, otherwise the env bot token for
-* single-workspace deployments. Fails instead of falling back when the call
-* is workspace-scoped and no installation token can be resolved, so a write
-* never goes out with another workspace's credentials.
-*/
-function getSlackClient(options) {
-	if (options) return new WebClient(resolveSlackToken(), {
-		retryConfig: { retries: 0 },
-		rejectRateLimitedCalls: true,
-		timeout: options.timeoutMs
-	});
-	return getClient();
+/** Read a saved vision summary for one live attachment. */
+async function readAttachmentVisionSummary(args) {
+	const [row] = await args.db.db().select({ visionSummary: juniorAttachments.visionSummary }).from(juniorAttachments).where(and(eq(juniorAttachments.id, args.attachmentId), eq(juniorAttachments.conversationId, args.conversationId), isNull(juniorAttachments.deleteRequestedAt)));
+	return row?.visionSummary;
 }
-/**
-* Slack channel ID prefixes:
-* - C: channel — modern private channels also use C, so the prefix never
-*   proves a channel is public
-* - G: legacy private channel / group DM
-* - D: direct message (1:1)
-*/
-function isDmChannel(channelId) {
-	const normalized = normalizeSlackConversationId(channelId);
-	return Boolean(normalized && normalized.startsWith("D"));
+/** Match live conversation attachments to Slack file ids. */
+async function matchSlackAttachments(args) {
+	if (args.providerIds.length === 0) return [];
+	return await args.db.db().select({
+		id: juniorAttachments.id,
+		providerId: juniorAttachments.providerId,
+		bytes: juniorAttachments.bytes,
+		contentType: juniorAttachments.contentType,
+		filename: juniorAttachments.filename
+	}).from(juniorAttachments).where(and(eq(juniorAttachments.conversationId, args.conversationId), eq(juniorAttachments.provider, "slack"), inArray(juniorAttachments.providerId, args.providerIds), isNull(juniorAttachments.deleteRequestedAt)));
 }
-/**
-* Conversation-scoped Slack contexts backed by a concrete conversation ID.
-* Includes channels/groups/DMs (C/G/D).
-*/
-function isConversationScopedChannel(channelId) {
-	const normalized = normalizeSlackConversationId(channelId);
-	if (!normalized) return false;
-	return normalized.startsWith("C") || normalized.startsWith("G") || normalized.startsWith("D");
+/** Read the Slack file identity retained by the Chat SDK. */
+function getSlackFileId(attachment) {
+	const metadataId = attachment.fetchMetadata?.fileId;
+	if (metadataId) return metadataId;
+	return (attachment.url ?? attachment.fetchMetadata?.url ?? "").match(/(?:^|[-/])(F[A-Z0-9]+)(?:[-/]|$)/i)?.[1];
 }
-function isConversationChannel(channelId) {
-	const normalized = normalizeSlackConversationId(channelId);
-	if (!normalized) return false;
-	return normalized.startsWith("C") || normalized.startsWith("G");
+// src/api/conversations/message-attachments.ts
+/** Resolve saved Slack file references without exposing private storage details. */
+async function hydrateMessageAttachments(db, conversationId, events) {
+	const messages = events.flatMap((event) => event.data.type === "message" ? [event.data] : []);
+	const ids = [...new Set(messages.flatMap((message) => slackFileIds(message.meta)))];
+	if (!ids.length) return;
+	const attachments = await matchSlackAttachments({
+		db,
+		conversationId,
+		providerIds: ids
+	});
+	const byFileId = new Map(attachments.map(({ providerId, ...attachment }) => [providerId, attachment]));
+	for (const message of messages) {
+		const stored = readMessageAttachments(message.meta?.attachments);
+		const matched = slackFileIds(message.meta).flatMap((id) => {
+			const attachment = byFileId.get(id);
+			return attachment ? [attachment] : [];
+		});
+		if (matched.length) message.meta = {
+			...message.meta,
+			attachments: [...stored, ...matched]
+		};
+	}
 }
-async function getFilePermalink(fileId) {
-	const client = getClient();
-	return (await withSlackRetries(() => client.files.info({ file: fileId }), 3, {
-		action: "files.info",
-		idempotent: true,
-		spanAttributes: { "app.slack.file_id": fileId }
-	})).file?.permalink;
+function slackFileIds(meta) {
+	const ids = meta?.slackFileIds ?? meta?.imageFileIds;
+	return Array.isArray(ids) ? ids.filter((id) => typeof id === "string") : [];
 }
-async function downloadPrivateSlackFile(url) {
-	const token = resolveSlackToken();
-	return withSpan("GET files.slack.com", "http.client", {}, async () => {
-		const response = await fetch(url, { headers: { Authorization: `Bearer ${token}` } });
-		setSpanAttributes({ "http.response.status_code": response.status });
-		if (!response.ok) {
-			setSpanAttributes({ "error.type": String(response.status) });
-			setSpanStatus("error");
-			throw new Error(`Slack file download failed: ${response.status}`);
-		}
-		return Buffer.from(await response.arrayBuffer());
-	}, {
-		"http.request.method": "GET",
-		"server.address": "files.slack.com",
-		"url.scheme": "https",
-		"app.slack.method": "files.download"
-	});
+// src/chat/sentry-links.ts
+function getSentryOrgSlug() {
+	return process.env.SENTRY_ORG_SLUG?.trim() || void 0;
 }
-// src/chat/slack/user.ts
-const slackUserInfoSchema = z.object({
-	ok: z.literal(true),
-	user: z.object({
-		name: z.string().nullish(),
-		tz: z.string().nullish(),
-		profile: z.object({
-			email: z.string().nullish(),
-			real_name: z.string().nullish()
-		}).optional()
-	})
-});
-const USER_CACHE_TTL_MS = 3e5;
-const userCache = /* @__PURE__ */ new Map();
-function userCacheKey(teamId, userId) {
-	return `${teamId}:${userId}`;
+function isSentrySaasDsnHost(host) {
+	return host === "sentry.io" || host.endsWith(".sentry.io");
 }
-function readFromCache(teamId, userId) {
-	const hit = userCache.get(userCacheKey(teamId, userId));
-	if (!hit) return null;
-	if (hit.expiresAt < Date.now()) {
-		userCache.delete(userCacheKey(teamId, userId));
-		return null;
-	}
-	return hit.value;
+function buildSentryWebBaseUrl(dsn) {
+	if (isSentrySaasDsnHost(dsn.host)) return "https://sentry.io";
+	const port = dsn.port ? `:${dsn.port}` : "";
+	const path = dsn.path ? `/${dsn.path}` : "";
+	return `${dsn.protocol}://${dsn.host}${port}${path}`;
 }
-function writeToCache(teamId, userId, value) {
-	userCache.set(userCacheKey(teamId, userId), {
-		value,
-		expiresAt: Date.now() + USER_CACHE_TTL_MS
+function buildSentryOrgPath(args) {
+	const dsn = getClient$1()?.getDsn();
+	if (!dsn?.host || !dsn.projectId) return;
+	const orgSlug = getSentryOrgSlug();
+	if (!orgSlug) return;
+	const params = new URLSearchParams();
+	params.set("project", dsn.projectId);
+	if (args.query) for (const [key, value] of Object.entries(args.query)) params.set(key, value);
+	const path = `${args.path}?${params.toString()}`;
+	if (isSentrySaasDsnHost(dsn.host)) return `https://${orgSlug}.sentry.io/${path}`;
+	return `${buildSentryWebBaseUrl(dsn)}/organizations/${orgSlug}/${path}`;
+}
+/** Build a Sentry conversation URL only when the runtime has enough Sentry config. */
+function buildSentryConversationUrl(conversationId) {
+	return buildSentryOrgPath({ path: `explore/conversations/${encodeURIComponent(conversationId)}/` });
+}
+/** Build a Sentry event URL only when the runtime has enough Sentry config. */
+function buildSentryEventUrl(eventId) {
+	return buildSentryOrgPath({
+		path: "issues/",
+		query: { query: eventId }
 	});
 }
-/** Fetch Slack user profile info with in-memory TTL cache to avoid repeated API calls. */
-async function lookupSlackUser(teamId, userId) {
-	if (!teamId || !userId) return null;
-	const cached = readFromCache(teamId, userId);
-	if (cached) return cached;
-	const token = getSlackBotToken();
-	if (!token) return null;
-	try {
-		const response = await fetch(`https://slack.com/api/users.info?user=${encodeURIComponent(userId)}`, { headers: { authorization: `Bearer ${token}` } });
-		if (!response.ok) {
-			logWarn("slack.user.lookup.failed", {
-				"app.slack.user_id": userId,
-				"app.slack.team_id": teamId,
-				"http.response.status_code": response.status
-			});
-			return null;
+// src/api/conversations/event-model.ts
+/** Apply recorded model choices without carrying a previous turn's settings forward. */
+function conversationEventModel(data, current) {
+	if (data.type === "turn_started") return void 0;
+	if (data.type === "turn_routed" || data.type === "handoff") return {
+		modelId: data.modelId,
+		modelProfile: data.modelProfile,
+		...data.reasoningLevel ? { reasoningLevel: data.reasoningLevel } : void 0
+	};
+	if (data.type === "assistant_message") {
+		const model = text$1(data.model);
+		const provider = text$1(data.provider);
+		if (model) {
+			const modelId = model.includes("/") || !provider ? model : `${provider}/${model}`;
+			return {
+				...current,
+				modelId
+			};
 		}
-		const parsed = slackUserInfoSchema.safeParse(await response.json());
-		if (!parsed.success) return null;
-		const payload = parsed.data;
-		const result = {
-			userName: payload.user.name?.trim() || void 0,
-			fullName: payload.user.profile?.real_name?.trim() || void 0,
-			email: payload.user.profile?.email?.trim() || void 0,
-			timezone: payload.user.tz?.trim() || void 0
-		};
-		writeToCache(teamId, userId, result);
-		return result;
-	} catch (error) {
-		logWarn("slack.user.lookup.failed", {
-			"app.slack.user_id": userId,
-			"app.slack.team_id": teamId,
-			"exception.message": error instanceof Error ? error.message : String(error)
-		});
-		return null;
 	}
+	return current;
 }
-// src/chat/identities/timezone.ts
-const DEFAULT_TIMEZONE = "America/Los_Angeles";
-/** The install timezone, used when Junior does not know a person's timezone. */
-function defaultTimezone() {
-	return process.env.JUNIOR_TIMEZONE?.trim() || DEFAULT_TIMEZONE;
-}
-/**
-* Pick a person's timezone: their Slack profile, then the saved user
-* timezone, then the install default. A valid Slack timezone is saved on the
-* linked user, so later lookups without Slack still find it.
-*/
-async function resolveUserTimezone(args) {
-	const timezone = (args.slack ? await lookupSlackUser(args.slack.teamId, args.slack.userId) : void 0)?.timezone;
-	if (timezone && isValidTimeZone(timezone)) {
-		if (args.userId) await saveUserTimezone(args.db, args.userId, timezone, args.nowMs);
-		return timezone;
-	}
-	return (args.userId ? await readUserTimezone(args.db, args.userId) : void 0) ?? defaultTimezone();
+function text$1(value) {
+	return typeof value === "string" && value.length > 0 ? value : void 0;
 }
-// src/chat/plugins/annotations.ts
-function annotationFromRow(row) {
-	const parsed = conversationAnnotationInputSchema.safeParse(row.annotation);
-	if (!parsed.success) return void 0;
+/** Allowlist model-call diagnostics; never expose opaque provider metadata. */
+function conversationEventModelCall(data) {
+	if (data.type !== "assistant_message") return void 0;
+	const usage = extractGenAiUsageSummary(data);
+	const provider = text$1(data.provider);
+	const api = text$1(data.api);
+	const stopReason = text$1(data.stopReason);
 	return {
-		...parsed.data,
-		plugin: row.plugin,
-		createdAt: row.createdAt.toISOString(),
-		updatedAt: row.updatedAt.toISOString()
-	};
-}
-function createPluginAnnotations(args) {
-	return {
-		async upsert(input) {
-			const annotation = conversationAnnotationInputSchema.parse(input);
-			const now = /* @__PURE__ */ new Date();
-			await args.db.insert(juniorConversationAnnotations).values({
-				annotation,
-				conversationId: args.conversationId,
-				createdAt: now,
-				key: annotation.key,
-				kind: annotation.kind,
-				plugin: args.plugin,
-				updatedAt: now
-			}).onConflictDoUpdate({
-				target: [
-					juniorConversationAnnotations.conversationId,
-					juniorConversationAnnotations.plugin,
-					juniorConversationAnnotations.kind,
-					juniorConversationAnnotations.key
-				],
-				set: {
-					annotation,
-					updatedAt: now
-				}
-			});
-		},
-		async remove(kind, key) {
-			await args.db.delete(juniorConversationAnnotations).where(and(eq(juniorConversationAnnotations.conversationId, args.conversationId), eq(juniorConversationAnnotations.plugin, args.plugin), eq(juniorConversationAnnotations.kind, kind), eq(juniorConversationAnnotations.key, key)));
-		},
-		async list() {
-			return (await listConversationAnnotations(args.db, args.conversationId)).filter((a) => a.plugin === args.plugin);
-		}
-	};
-}
-/** Load stored annotations for one conversation, newest update first. */
-async function listConversationAnnotations(db, conversationId) {
-	return (await listConversationAnnotationsById(db, [conversationId])).get(conversationId) ?? [];
-}
-/** Load stored annotations for a bounded set of conversations. */
-async function listConversationAnnotationsById(db, conversationIds) {
-	const byConversation = /* @__PURE__ */ new Map();
-	if (conversationIds.length === 0) return byConversation;
-	const rows = await db.select().from(juniorConversationAnnotations).where(inArray(juniorConversationAnnotations.conversationId, [...conversationIds])).orderBy(desc(juniorConversationAnnotations.updatedAt));
-	for (const row of rows) {
-		const annotation = annotationFromRow(row);
-		if (!annotation) continue;
-		const current = byConversation.get(row.conversationId);
-		if (current) current.push(annotation);
-		else byConversation.set(row.conversationId, [annotation]);
-	}
-	return byConversation;
-}
-// src/chat/conversations/annotation-results.ts
-/** Save object annotations and retain returned facts in the tool result. */
-async function saveObjectAnnotations(conversationId, plugin, value) {
-	const annotations = objectAnnotationSchema.array().parse(value);
-	await getDb().transaction(async (db) => {
-		const store = createPluginAnnotations({
-			conversationId,
-			plugin,
-			db
-		});
-		for (const annotation of annotations) {
-			await store.upsert(annotation);
-			await store.remove("resource_link", annotation.key);
-		}
-	});
-	return annotations.map((annotation) => ({
-		...annotation,
-		plugin
-	}));
-}
-/** Save annotations from a successful plugin tool result and attach their cards. */
-async function annotateToolResult(conversationId, plugin, result) {
-	if (!isRecord$1(result) || result.isError === true) return result;
-	const details = isRecord$1(result.details) ? result.details : result;
-	if (details.timed_out === true || details.isError === true || !Array.isArray(details.objectAnnotations)) return result;
-	const cards = await saveObjectAnnotations(conversationId, plugin, details.objectAnnotations);
-	const { objectAnnotations: _annotations, ...rest } = details;
-	const annotated = {
-		...rest,
-		objectCards: cards
-	};
-	if (isRecord$1(result.details)) return {
-		...result,
-		details: annotated
-	};
-	return annotated;
-}
-// src/chat/conversations/sql/privacy.ts
-const privacyRoot = alias(juniorConversations, "privacy_root");
-/** Accept only a structurally valid persisted root as privacy authority. */
-async function readRootCandidate(executor, conversationId) {
-	const row = (await executor.db().select({
-		requestedConversationId: juniorConversations.conversationId,
-		requestedParentConversationId: juniorConversations.parentConversationId,
-		requestedRootConversationId: juniorConversations.rootConversationId,
-		rootConversationId: privacyRoot.conversationId,
-		rootDestinationId: privacyRoot.destinationId,
-		rootParentConversationId: privacyRoot.parentConversationId,
-		rootRootConversationId: privacyRoot.rootConversationId
-	}).from(juniorConversations).leftJoin(privacyRoot, eq(privacyRoot.conversationId, juniorConversations.rootConversationId)).where(eq(juniorConversations.conversationId, conversationId)))[0];
-	return row !== void 0 && row.requestedRootConversationId !== null && (row.requestedParentConversationId !== null || row.requestedRootConversationId === row.requestedConversationId) && row.rootConversationId === row.requestedRootConversationId && row.rootRootConversationId === row.rootConversationId && row.rootParentConversationId === null && row.rootDestinationId !== null ? {
-		destinationId: row.rootDestinationId,
-		rootConversationId: row.rootConversationId
-	} : void 0;
-}
-async function readCandidateVisibility(executor, candidate) {
-	const destinations = await executor.db().select({ visibility: juniorDestinations.visibility }).from(juniorDestinations).where(eq(juniorDestinations.id, candidate.destinationId)).for("share");
-	return {
-		rootConversationId: candidate.rootConversationId,
-		visibility: destinations[0]?.visibility ?? null
-	};
-}
-/**
-* Resolve a conversation's privacy authority from its persisted root.
-*
-* Missing or structurally invalid root metadata fails closed. The root
-* destination is locked so callers that keep the transaction open receive a
-* stable visibility decision.
-*/
-async function resolveRootVisibility(executor, conversationId) {
-	const candidate = await readRootCandidate(executor, conversationId);
-	if (!candidate) return {
-		rootConversationId: conversationId,
-		visibility: null
-	};
-	return readCandidateVisibility(executor, candidate);
-}
-// src/chat/briefs/events.ts
-/** Durable cost and size record for one stored Brief version. */
-const briefUpdatedEvent = defineConversationEvent({
-	name: "brief_updated",
-	version: 1,
-	schema: z.object({
-		version: z.number().int().positive(),
-		modelId: z.string().min(1),
-		costUsd: z.number().finite().nonnegative().optional(),
-		decisions: z.number().int().nonnegative(),
-		openDecisions: z.number().int().nonnegative(),
-		links: z.number().int().nonnegative()
-	}).strict(),
-	renderEvent(event) {
-		return {
-			icon: "activity",
-			title: `Brief updated (v${event.version})`
-		};
-	}
-});
-// src/chat/slack/attachments.ts
-/** Save the vision summary for a stored Slack attachment. */
-async function recordSlackAttachment(args) {
-	await args.db.db().update(juniorAttachments).set({ visionSummary: args.visionSummary }).where(and(eq(juniorAttachments.id, args.attachmentId), eq(juniorAttachments.conversationId, args.conversationId), isNull(juniorAttachments.deleteRequestedAt)));
-}
-/** Read a saved vision summary for one live attachment. */
-async function readAttachmentVisionSummary(args) {
-	const [row] = await args.db.db().select({ visionSummary: juniorAttachments.visionSummary }).from(juniorAttachments).where(and(eq(juniorAttachments.id, args.attachmentId), eq(juniorAttachments.conversationId, args.conversationId), isNull(juniorAttachments.deleteRequestedAt)));
-	return row?.visionSummary;
-}
-/** Match live conversation attachments to Slack file ids. */
-async function matchSlackAttachments(args) {
-	if (args.providerIds.length === 0) return [];
-	return await args.db.db().select({
-		id: juniorAttachments.id,
-		providerId: juniorAttachments.providerId,
-		bytes: juniorAttachments.bytes,
-		contentType: juniorAttachments.contentType,
-		filename: juniorAttachments.filename
-	}).from(juniorAttachments).where(and(eq(juniorAttachments.conversationId, args.conversationId), eq(juniorAttachments.provider, "slack"), inArray(juniorAttachments.providerId, args.providerIds), isNull(juniorAttachments.deleteRequestedAt)));
-}
-/** Read the Slack file identity retained by the Chat SDK. */
-function getSlackFileId(attachment) {
-	const metadataId = attachment.fetchMetadata?.fileId;
-	if (metadataId) return metadataId;
-	return (attachment.url ?? attachment.fetchMetadata?.url ?? "").match(/(?:^|[-/])(F[A-Z0-9]+)(?:[-/]|$)/i)?.[1];
-}
-// src/api/conversations/message-attachments.ts
-/** Resolve saved Slack file references without exposing private storage details. */
-async function hydrateMessageAttachments(db, conversationId, events) {
-	const messages = events.flatMap((event) => event.data.type === "message" ? [event.data] : []);
-	const ids = [...new Set(messages.flatMap((message) => slackFileIds(message.meta)))];
-	if (!ids.length) return;
-	const attachments = await matchSlackAttachments({
-		db,
-		conversationId,
-		providerIds: ids
-	});
-	const byFileId = new Map(attachments.map(({ providerId, ...attachment }) => [providerId, attachment]));
-	for (const message of messages) {
-		const stored = readMessageAttachments(message.meta?.attachments);
-		const matched = slackFileIds(message.meta).flatMap((id) => {
-			const attachment = byFileId.get(id);
-			return attachment ? [attachment] : [];
-		});
-		if (matched.length) message.meta = {
-			...message.meta,
-			attachments: [...stored, ...matched]
-		};
-	}
-}
-function slackFileIds(meta) {
-	const ids = meta?.slackFileIds ?? meta?.imageFileIds;
-	return Array.isArray(ids) ? ids.filter((id) => typeof id === "string") : [];
-}
-// src/chat/sentry-links.ts
-function getSentryOrgSlug() {
-	return process.env.SENTRY_ORG_SLUG?.trim() || void 0;
-}
-function isSentrySaasDsnHost(host) {
-	return host === "sentry.io" || host.endsWith(".sentry.io");
-}
-function buildSentryWebBaseUrl(dsn) {
-	if (isSentrySaasDsnHost(dsn.host)) return "https://sentry.io";
-	const port = dsn.port ? `:${dsn.port}` : "";
-	const path = dsn.path ? `/${dsn.path}` : "";
-	return `${dsn.protocol}://${dsn.host}${port}${path}`;
-}
-function buildSentryOrgPath(args) {
-	const dsn = getClient$1()?.getDsn();
-	if (!dsn?.host || !dsn.projectId) return;
-	const orgSlug = getSentryOrgSlug();
-	if (!orgSlug) return;
-	const params = new URLSearchParams();
-	params.set("project", dsn.projectId);
-	if (args.query) for (const [key, value] of Object.entries(args.query)) params.set(key, value);
-	const path = `${args.path}?${params.toString()}`;
-	if (isSentrySaasDsnHost(dsn.host)) return `https://${orgSlug}.sentry.io/${path}`;
-	return `${buildSentryWebBaseUrl(dsn)}/organizations/${orgSlug}/${path}`;
-}
-/** Build a Sentry conversation URL only when the runtime has enough Sentry config. */
-function buildSentryConversationUrl(conversationId) {
-	return buildSentryOrgPath({ path: `explore/conversations/${encodeURIComponent(conversationId)}/` });
-}
-/** Build a Sentry event URL only when the runtime has enough Sentry config. */
-function buildSentryEventUrl(eventId) {
-	return buildSentryOrgPath({
-		path: "issues/",
-		query: { query: eventId }
-	});
-}
-// src/api/conversations/event-model.ts
-/** Apply recorded model choices without carrying a previous turn's settings forward. */
-function conversationEventModel(data, current) {
-	if (data.type === "turn_started") return void 0;
-	if (data.type === "turn_routed" || data.type === "handoff") return {
-		modelId: data.modelId,
-		modelProfile: data.modelProfile,
-		...data.reasoningLevel ? { reasoningLevel: data.reasoningLevel } : void 0
-	};
-	if (data.type === "assistant_message") {
-		const model = text$1(data.model);
-		const provider = text$1(data.provider);
-		if (model) {
-			const modelId = model.includes("/") || !provider ? model : `${provider}/${model}`;
-			return {
-				...current,
-				modelId
-			};
-		}
-	}
-	return current;
-}
-function text$1(value) {
-	return typeof value === "string" && value.length > 0 ? value : void 0;
-}
-/** Allowlist model-call diagnostics; never expose opaque provider metadata. */
-function conversationEventModelCall(data) {
-	if (data.type !== "assistant_message") return void 0;
-	const usage = extractGenAiUsageSummary(data);
-	const provider = text$1(data.provider);
-	const api = text$1(data.api);
-	const stopReason = text$1(data.stopReason);
-	return {
-		...provider ? { provider } : void 0,
-		...api ? { api } : void 0,
-		...stopReason ? { stopReason } : void 0,
-		...hasAgentTurnUsage(usage) ? { usage } : void 0
+		...provider ? { provider } : void 0,
+		...api ? { api } : void 0,
+		...stopReason ? { stopReason } : void 0,
+		...hasAgentTurnUsage(usage) ? { usage } : void 0
 	};
 }
 // src/api/conversations/events.ts
@@ -1072,6 +723,12 @@ function conversationReportToolResultIds(events) {
 		return result.success ? [result.data.toolCallId] : [];
 	}))];
 }
+const storedMessageEventsSchema = z.array(conversationReportMessageEventSchema);
+/** Read the Events listed on a message that holds several Events. */
+function reportMessageEvents(meta) {
+	const parsed = storedMessageEventsSchema.safeParse(meta?.events);
+	return parsed.success ? { events: parsed.data } : void 0;
+}
 function reportEventData(args) {
 	const { data } = args;
 	if (data.type === "structured_event") {
@@ -1100,6 +757,7 @@ function reportEventData(args) {
 				...typeof data.meta?.eventType === "string" ? { eventType: data.meta.eventType } : void 0,
 				...typeof data.meta?.explicitMention === "boolean" ? { explicitMention: data.meta.explicitMention } : void 0,
 				...args.canExposePayload && typeof data.meta?.trustedSummary === "string" ? { trustedSummary: data.meta.trustedSummary } : void 0,
+				...args.canExposePayload ? reportMessageEvents(data.meta) : void 0,
 				...args.canExposePayload && (data.meta?.cards || data.meta?.objectCards) ? { cards: readMessageCardRefs(data.meta) } : void 0,
 				...args.canExposePayload ? {
 					text: data.text,
@@ -1793,12 +1451,16 @@ function conversationHasParticipantUser(userId) {
 	return exists(participant);
 }
 /**
-* True when a verified primary-email user participates on this root
-* conversation. Used only for the actorEmail feed fallback.
+* True when the conversation is one the person started or participates in.
+* Feeds filter with this id set instead of a per-row membership check, so
+* Postgres reads only that person's conversations, not every root.
 */
-function conversationHasParticipantEmail(email) {
-	const participant = getDb().select({ rootConversationId: juniorConversationParticipants.rootConversationId }).from(juniorConversationParticipants).innerJoin(juniorUsers, eq(juniorUsers.id, juniorConversationParticipants.userId)).where(and(eq(juniorConversationParticipants.rootConversationId, juniorConversations.conversationId), eq(juniorUsers.primaryEmailNormalized, email)));
-	return exists(participant);
+function conversationIsMemberRoot(member) {
+	const db = getDb();
+	const started = db.select({ conversationId: juniorConversations.conversationId }).from(juniorConversations).innerJoin(juniorIdentities, eq(juniorIdentities.id, juniorConversations.actorIdentityId));
+	const participating = db.select({ conversationId: juniorConversationParticipants.rootConversationId }).from(juniorConversationParticipants);
+	const memberRoots = "userId" in member ? union(started.where(eq(juniorIdentities.userId, member.userId)), participating.where(eq(juniorConversationParticipants.userId, member.userId))) : union(started.innerJoin(juniorUsers, eq(juniorUsers.id, juniorIdentities.userId)).where(eq(juniorUsers.primaryEmailNormalized, member.email)), participating.innerJoin(juniorUsers, eq(juniorUsers.id, juniorConversationParticipants.userId)).where(eq(juniorUsers.primaryEmailNormalized, member.email)));
+	return inArray(juniorConversations.conversationId, memberRoots);
 }
 /** True when one user's personal feed has archived this root after the cutoff. */
 function conversationArchivedForUser(userId, archivedAfter) {
@@ -2229,6 +1891,355 @@ async function updateTimerIndex(state, operation) {
 		await state.releaseLock(lock);
 	}
 }
+// src/chat/slack/workspace-context.ts
+const workspaceTeamIdStorage = new AsyncLocalStorage();
+/** Run a callback with the Slack workspace team ID for the inbound webhook. */
+function runWithWorkspaceTeamId(teamId, fn) {
+	if (!teamId) return fn();
+	return workspaceTeamIdStorage.run(teamId, fn);
+}
+/** Return the Slack workspace team ID for the current inbound webhook. */
+function getWorkspaceTeamId() {
+	return workspaceTeamIdStorage.getStore();
+}
+// src/chat/slack/client.ts
+var SlackActionError = class extends Error {
+	code;
+	apiError;
+	needed;
+	provided;
+	statusCode;
+	requestId;
+	errorData;
+	retryAfterSeconds;
+	detail;
+	detailLine;
+	detailRule;
+	constructor(message, code, options = {}) {
+		super(message);
+		this.name = "SlackActionError";
+		this.code = code;
+		this.apiError = options.apiError;
+		this.needed = options.needed;
+		this.provided = options.provided;
+		this.statusCode = options.statusCode;
+		this.requestId = options.requestId;
+		this.errorData = options.errorData;
+		this.retryAfterSeconds = options.retryAfterSeconds;
+		this.detail = options.detail;
+		this.detailLine = options.detailLine;
+		this.detailRule = options.detailRule;
+	}
+};
+function serializeSlackErrorData(data) {
+	if (!data || typeof data !== "object") return;
+	const filtered = Object.fromEntries(Object.entries(data).filter(([key]) => key !== "error"));
+	if (Object.keys(filtered).length === 0) return;
+	try {
+		const serialized = JSON.stringify(filtered);
+		return serialized.length <= 600 ? serialized : `${serialized.slice(0, 597)}...`;
+	} catch {
+		return;
+	}
+}
+/** Extract a header value by case-insensitive name from a raw headers object. */
+function getHeaderString(headers, name) {
+	if (!headers || typeof headers !== "object") return;
+	const key = name.toLowerCase();
+	const entries = headers;
+	for (const [entryKey, value] of Object.entries(entries)) {
+		if (entryKey.toLowerCase() !== key) continue;
+		if (typeof value === "string") return value;
+		if (Array.isArray(value)) {
+			const first = value.find((entry) => typeof entry === "string");
+			return typeof first === "string" ? first : void 0;
+		}
+	}
+}
+function parseSlackCanvasDetail(detail) {
+	if (typeof detail !== "string") return {};
+	const trimmed = detail.trim();
+	if (!trimmed) return {};
+	const parsed = { detail: trimmed };
+	const lineMatch = trimmed.match(/line\s+(\d+):/i);
+	if (lineMatch) {
+		const line = Number.parseInt(lineMatch[1] ?? "", 10);
+		if (Number.isFinite(line)) parsed.detailLine = line;
+	}
+	if (/unsupported heading depth/i.test(trimmed)) parsed.detailRule = "unsupported_heading_depth";
+	return parsed;
+}
+/**
+* Ambient destination-installation token for Slack outbound calls, bound by
+* installation-scoped entry points so writes carry the destination
+* workspace's credentials instead of the process-global env token.
+*/
+const installationTokenStorage = new AsyncLocalStorage();
+const clientsByToken = /* @__PURE__ */ new Map();
+/**
+* Bind a workspace installation token for all Slack Web API calls inside
+* `fn`, so multi-workspace outbound writes use the destination workspace's
+* credentials rather than the env fallback token.
+*/
+function runWithSlackInstallationToken(token, fn) {
+	const trimmed = token.trim();
+	if (!trimmed) throw new SlackActionError("Slack installation token binding requires a non-empty token", "missing_token");
+	return installationTokenStorage.run({ token: trimmed }, fn);
+}
+/**
+* Token precedence: ambient installation token, then env token, then a hard
+* failure for team-scoped calls — a call scoped to one workspace must never
+* silently fall through to another workspace's credentials.
+*/
+function resolveSlackToken() {
+	const ambientToken = installationTokenStorage.getStore()?.token;
+	if (ambientToken) return ambientToken;
+	const envToken = getSlackBotToken();
+	if (envToken) return envToken;
+	const teamId = getWorkspaceTeamId();
+	if (teamId) throw new SlackActionError(`Slack call is scoped to workspace ${teamId} but no installation token is bound and no default bot token is configured`, "missing_token");
+	throw new SlackActionError("SLACK_BOT_TOKEN (or SLACK_BOT_USER_TOKEN) is required for Slack Web API actions in this service", "missing_token");
+}
+/** Normalize Junior Slack references to native Slack conversation IDs. */
+function normalizeSlackConversationId(channelId) {
+	return parseSlackChannelReferenceId(channelId);
+}
+/**
+* Return the per-token cached WebClient. `withSlackRetries` owns retry
+* classification for this boundary: the WebClient's built-in policy would
+* re-post timed-out writes (a duplicate-message hazard) and sleep for the
+* full unbounded Retry-After inside the request, so both internal behaviors
+* are disabled here.
+*/
+function getClient() {
+	const token = resolveSlackToken();
+	let cached = clientsByToken.get(token);
+	if (!cached) {
+		cached = new WebClient(token, {
+			retryConfig: { retries: 0 },
+			rejectRateLimitedCalls: true
+		});
+		clientsByToken.set(token, cached);
+	}
+	return cached;
+}
+function mapSlackError(error) {
+	if (error instanceof SlackActionError) return error;
+	const candidate = error;
+	const apiError = candidate.data?.error;
+	const message = candidate.message ?? "Slack action failed";
+	const baseOptions = {
+		apiError,
+		statusCode: candidate.statusCode,
+		requestId: getHeaderString(candidate.headers, "x-slack-req-id"),
+		errorData: serializeSlackErrorData(candidate.data),
+		...parseSlackCanvasDetail(candidate.data?.detail)
+	};
+	if (apiError === "missing_scope") return new SlackActionError(message, "missing_scope", {
+		...baseOptions,
+		needed: candidate.data?.needed,
+		provided: candidate.data?.provided
+	});
+	if (apiError === "not_in_channel") return new SlackActionError(message, "not_in_channel", baseOptions);
+	if (apiError === "restricted_action_read_only_channel") return new SlackActionError(message, "read_only_channel", baseOptions);
+	if (apiError === "already_reacted") return new SlackActionError(message, "already_reacted", baseOptions);
+	if (apiError === "no_reaction") return new SlackActionError(message, "no_reaction", baseOptions);
+	if (apiError === "invalid_arguments") return new SlackActionError(message, "invalid_arguments", baseOptions);
+	if (apiError === "invalid_cursor") return new SlackActionError(message, "invalid_arguments", baseOptions);
+	if (apiError === "invalid_name") return new SlackActionError(message, "invalid_arguments", baseOptions);
+	if (apiError === "not_found" || apiError === "channel_not_found" || apiError === "message_not_found") return new SlackActionError(message, "not_found", baseOptions);
+	if (apiError === "feature_not_enabled" || apiError === "not_allowed_token_type") return new SlackActionError(message, "feature_unavailable", baseOptions);
+	if (apiError === "canvas_creation_failed") return new SlackActionError(message, "canvas_creation_failed", baseOptions);
+	if (apiError === "canvas_editing_failed") return new SlackActionError(message, "canvas_editing_failed", baseOptions);
+	if (candidate.code === "slack_webapi_rate_limited_error" || candidate.statusCode === 429) return new SlackActionError(message, "rate_limited", {
+		...baseOptions,
+		retryAfterSeconds: candidate.retryAfter
+	});
+	return new SlackActionError(message, "internal_error", baseOptions);
+}
+const MAX_RETRY_DELAY_MS = 1e4;
+const MAX_TOTAL_RETRY_DELAY_MS = 2e4;
+const CONNECTION_ERROR_CODES = /* @__PURE__ */ new Set([
+	"ECONNREFUSED",
+	"ECONNRESET",
+	"ENOTFOUND",
+	"EAI_AGAIN"
+]);
+const TIMEOUT_ERROR_CODES = /* @__PURE__ */ new Set([
+	"ETIMEDOUT",
+	"ECONNABORTED",
+	"ESOCKETTIMEDOUT"
+]);
+function findNetworkErrorCode(error, depth = 0) {
+	if (!error || typeof error !== "object" || depth > 4) return;
+	const candidate = error;
+	if (typeof candidate.code === "string" && (CONNECTION_ERROR_CODES.has(candidate.code) || TIMEOUT_ERROR_CODES.has(candidate.code))) return candidate.code;
+	return findNetworkErrorCode(candidate.original, depth + 1) ?? findNetworkErrorCode(candidate.cause, depth + 1);
+}
+function hasSocketHangUpMessage(error) {
+	return error instanceof Error && error.message.toLowerCase().includes("socket hang up");
+}
+/**
+* Classify a failed Slack call for retry: rate limits, Slack 5xx, and
+* connection-phase failures are always retryable; timeouts are retried only
+* for idempotent operations because Slack may already have accepted the
+* request.
+*/
+function classifySlackRetry(raw, mapped) {
+	if (mapped.code === "rate_limited") return "rate_limited";
+	if (mapped.statusCode !== void 0 && mapped.statusCode >= 500) return "server_error";
+	const networkCode = findNetworkErrorCode(raw);
+	if (networkCode && CONNECTION_ERROR_CODES.has(networkCode)) return "connection";
+	if (networkCode && TIMEOUT_ERROR_CODES.has(networkCode)) return "timeout";
+	if (hasSocketHangUpMessage(raw)) return "connection";
+	return "none";
+}
+/**
+* Run a Slack Web API call with bounded retries so transient platform
+* failures do not surface as turn failures, while non-idempotent posts are
+* never re-sent when Slack may already have accepted them.
+*
+* Retry classes: rate limits (bounded Retry-After), connection-phase network
+* failures, and Slack 5xx responses always retry; request timeouts retry only
+* when the caller marks the operation `idempotent`.
+*/
+async function withSlackRetries(task, maxAttempts = 3, context = {}) {
+	let attempt = 0;
+	let totalDelayMs = 0;
+	const action = context.action ?? "unknown";
+	while (attempt < maxAttempts) {
+		attempt += 1;
+		const attemptNumber = attempt;
+		try {
+			return await withSpan(`POST slack.com/api/${action}`, "http.client", {}, async () => {
+				try {
+					return await task();
+				} catch (error) {
+					const mapped = mapSlackError(error);
+					const errorAttrs = { "error.type": mapped.code };
+					if (mapped.apiError) errorAttrs["app.slack.api_error_code"] = mapped.apiError;
+					if (mapped.code === "rate_limited") {
+						errorAttrs["http.response.status_code"] = 429;
+						if (mapped.retryAfterSeconds) errorAttrs["app.slack.retry_after_ms"] = mapped.retryAfterSeconds * 1e3;
+					} else if (mapped.statusCode != null) errorAttrs["http.response.status_code"] = mapped.statusCode;
+					setSpanAttributes(errorAttrs);
+					setSpanStatus("error");
+					throw error;
+				}
+			}, {
+				"http.request.method": "POST",
+				"server.address": "slack.com",
+				"url.scheme": "https",
+				"url.path": `/api/${action}`,
+				"app.slack.method": action,
+				"app.retry.max_attempts": maxAttempts,
+				...attemptNumber > 1 ? { "http.request.resend_count": attemptNumber - 1 } : void 0,
+				...context.attributes ?? {},
+				...context.spanAttributes ?? {}
+			});
+		} catch (error) {
+			const mapped = mapSlackError(error);
+			const retryClass = classifySlackRetry(error, mapped);
+			const isRetryable = retryClass === "rate_limited" || retryClass === "connection" || retryClass === "server_error" || retryClass === "timeout" && context.idempotent === true;
+			const remainingDelayBudgetMs = MAX_TOTAL_RETRY_DELAY_MS - totalDelayMs;
+			const baseLogAttributes = {
+				"app.slack.action": action,
+				"app.slack.error_code": mapped.code,
+				...mapped.apiError ? { "app.slack.api_error": mapped.apiError } : void 0,
+				...mapped.detail ? { "app.slack.detail": mapped.detail } : void 0,
+				...mapped.detailLine !== void 0 ? { "app.slack.detail_line": mapped.detailLine } : void 0,
+				...mapped.detailRule ? { "app.slack.detail_rule": mapped.detailRule } : void 0,
+				...mapped.requestId ? { "app.slack.request_id": mapped.requestId } : void 0,
+				...mapped.statusCode !== void 0 ? { "http.response.status_code": mapped.statusCode } : void 0,
+				...context.attributes ?? {}
+			};
+			if (!isRetryable || attempt >= maxAttempts || remainingDelayBudgetMs <= 0) {
+				logWarn("slack.action.failed", {
+					...baseLogAttributes,
+					...mapped.errorData ? { "app.slack.error_data": mapped.errorData } : void 0
+				});
+				throw mapped;
+			}
+			logWarn("slack.action.retrying", {
+				...baseLogAttributes,
+				"app.slack.retry_attempt": attempt,
+				"app.slack.retry_class": retryClass
+			});
+			const retryAfterMs = retryClass === "rate_limited" && mapped.retryAfterSeconds && mapped.retryAfterSeconds > 0 ? mapped.retryAfterSeconds * 1e3 : void 0;
+			const backoffMs = Math.min(2e3, 250 * 2 ** (attempt - 1));
+			const delayMs = Math.min(retryAfterMs ?? backoffMs, MAX_RETRY_DELAY_MS, remainingDelayBudgetMs);
+			totalDelayMs += delayMs;
+			await sleep$1(delayMs);
+		}
+	}
+	throw new SlackActionError("Slack action exhausted retries", "internal_error");
+}
+/**
+* Slack Web API client for the current destination workspace: the ambient
+* installation token when one is bound, otherwise the env bot token for
+* single-workspace deployments. Fails instead of falling back when the call
+* is workspace-scoped and no installation token can be resolved, so a write
+* never goes out with another workspace's credentials.
+*/
+function getSlackClient(options) {
+	if (options) return new WebClient(resolveSlackToken(), {
+		retryConfig: { retries: 0 },
+		rejectRateLimitedCalls: true,
+		timeout: options.timeoutMs
+	});
+	return getClient();
+}
+/**
+* Slack channel ID prefixes:
+* - C: channel — modern private channels also use C, so the prefix never
+*   proves a channel is public
+* - G: legacy private channel / group DM
+* - D: direct message (1:1)
+*/
+function isDmChannel(channelId) {
+	const normalized = normalizeSlackConversationId(channelId);
+	return Boolean(normalized && normalized.startsWith("D"));
+}
+/**
+* Conversation-scoped Slack contexts backed by a concrete conversation ID.
+* Includes channels/groups/DMs (C/G/D).
+*/
+function isConversationScopedChannel(channelId) {
+	const normalized = normalizeSlackConversationId(channelId);
+	if (!normalized) return false;
+	return normalized.startsWith("C") || normalized.startsWith("G") || normalized.startsWith("D");
+}
+function isConversationChannel(channelId) {
+	const normalized = normalizeSlackConversationId(channelId);
+	if (!normalized) return false;
+	return normalized.startsWith("C") || normalized.startsWith("G");
+}
+async function getFilePermalink(fileId) {
+	const client = getClient();
+	return (await withSlackRetries(() => client.files.info({ file: fileId }), 3, {
+		action: "files.info",
+		idempotent: true,
+		spanAttributes: { "app.slack.file_id": fileId }
+	})).file?.permalink;
+}
+async function downloadPrivateSlackFile(url) {
+	const token = resolveSlackToken();
+	return withSpan("GET files.slack.com", "http.client", {}, async () => {
+		const response = await fetch(url, { headers: { Authorization: `Bearer ${token}` } });
+		setSpanAttributes({ "http.response.status_code": response.status });
+		if (!response.ok) {
+			setSpanAttributes({ "error.type": String(response.status) });
+			setSpanStatus("error");
+			throw new Error(`Slack file download failed: ${response.status}`);
+		}
+		return Buffer.from(await response.arrayBuffer());
+	}, {
+		"http.request.method": "GET",
+		"server.address": "files.slack.com",
+		"url.scheme": "https",
+		"app.slack.method": "files.download"
+	});
+}
 // src/chat/credentials/subject.ts
 const CREDENTIAL_SUBJECT_HMAC_CONTEXT = "junior.credential_subject.v1";
 const CREDENTIAL_SUBJECT_SIGNATURE_VERSION = "v1";
@@ -3058,6 +3069,8 @@ function normalizeWorkspaceRecipe(input) {
 	const setupScript = input.setupScript ?? "";
 	if (typeof setupScript !== "string") throw new WorkspaceValidationError("Setup script must be a string.");
 	if (Buffer.byteLength(setupScript, "utf8") > MAX_SETUP_SCRIPT_BYTES) throw new WorkspaceValidationError(`Setup script must be at most ${MAX_SETUP_SCRIPT_BYTES} bytes.`);
+	const vcpus = input.vcpus ?? null;
+	if (vcpus !== null && (!Number.isSafeInteger(vcpus) || vcpus <= 0)) throw new WorkspaceValidationError("vCPUs must be a positive integer.");
 	if (!Array.isArray(input.repos)) throw new WorkspaceValidationError("Repositories must be an array.");
 	if (input.repos.length > MAX_REPOS) throw new WorkspaceValidationError(`A Workspace can include at most ${MAX_REPOS} repositories.`);
 	const repos = input.repos.map((entry, index) => {
@@ -3087,6 +3100,7 @@ function normalizeWorkspaceRecipe(input) {
 	return {
 		name,
 		setupScript,
+		vcpus,
 		repos
 	};
 }
@@ -3096,6 +3110,7 @@ function workspaceFromRows(row, repos, snapshot) {
 		id: row.id,
 		name: row.name,
 		setupScript: row.setupScript,
+		vcpus: row.vcpus,
 		repos: repos.map((repo) => ({
 			provider: repo.provider,
 			repo: repo.repo
@@ -3194,6 +3209,7 @@ async function createWorkspace(input) {
 				id,
 				name: recipe.name,
 				setupScript: recipe.setupScript,
+				vcpus: recipe.vcpus,
 				createdAt: now,
 				updatedAt: now
 			});
@@ -3220,6 +3236,7 @@ async function updateWorkspace(id, input) {
 			const rows = await db.update(juniorWorkspaces).set({
 				name: recipe.name,
 				setupScript: recipe.setupScript,
+				vcpus: recipe.vcpus,
 				updatedAt: now
 			}).where(eq(juniorWorkspaces.id, id)).returning();
 			await replaceWorkspaceRepos(db, id, recipe.repos);
@@ -4332,4 +4349,4 @@ function createPluginHookRunner(input = {}) {
 		}
 	};
 }
-export { bindSlackDirectCredentialSubject as $, authenticationUnlinkedEvent as $t, getWorkspaceSnapshotBuilder as A, resolveRootVisibility as At, STOP_WATCHING_TOOL_NAME as B, getFilePermalink as Bt, WorkspaceValidationError as C, readLatestConversationBrief as Ct, setWorkspaceSnapshotBuild as D, matchSlackAttachments as Dt, setWorkspaceSnapshot as E, getSlackFileId as Et, isSlackMessageTurn as F, defaultTimezone as Ft, createWatch as G, normalizeSlackConversationId as Gt, cancelWatch as H, getSlackClient as Ht, slackMessageTurnDisabledReason as I, resolveUserTimezone as It, getWatch as J, getWorkspaceTeamId as Jt, deliverWatch as K, runWithSlackInstallationToken as Kt, RESOURCE_SUBSCRIPTION_DEFAULT_TTL_MS as L, lookupSlackUser as Lt, workspaceRepoCheckoutPath as M, createPluginAnnotations as Mt, resolveChannelCapabilities as N, listConversationAnnotations as Nt, SANDBOX_RUNTIME as O, readAttachmentVisionSummary as Ot, getSlackToolContext as P, listConversationAnnotationsById as Pt, bindScheduledAutomationCredentialSubject as Q, authenticationLinkedEvent as Qt, RESOURCE_SUBSCRIPTION_MAX_TTL_MS as R, SlackActionError as Rt, updateWorkspace as S, createPluginConversationEvents as St, loadSnapshotsForProfile as T, buildSentryConversationUrl as Tt, collectEventMatchKeys as U, isConversationScopedChannel as Ut, cancelSubscriptions as V, getHeaderString as Vt, createTimerWatch as W, isDmChannel as Wt, takeDueTimerWatches as X, JUNIOR_NATIVE_EVENT_NAMESPACE as Xt, listWatches as Y, runWithWorkspaceTeamId as Yt, bindEventAutomationCredentialSubject as Z, agentsInstructionsUpdatedEvent as Zt, deleteWorkspace as _, conversationHasParticipantEmail as _t, getPluginRoutes as a, getDashboardConversationLink as at, listWorkspaces as b, conversationNotArchivedForUser as bt, getPluginTools as c, setDashboardConversationLinkOptions as ct, setPlugins as d, createPluginModel as dt, conversationNoteEvent as en, verifyEventAutomationCredentialSubject as et, validatePlugins as f, createPluginLogger as ft, createWorkspace as g, conversationArchivedForUser as gt, setBriefsConfig as h, conversationArchivedForEmail as ht, getPluginApiRoutes as i, JUNIOR_THREAD_STATE_TTL_MS as it, tryWorkspaceRepoCheckoutPath as j, saveObjectAnnotations as jt, deleteWorkspaceSnapshotBuilders as k, recordSlackAttachment as kt, getPluginUserPromptContributions as l, createPluginState as lt, registration_exports as m, conversationArchiveTimes as mt, applyPluginFormatMarkdown as n, verifySlackDirectCredentialSubject as nt, getPluginSlackConversationLink as o, getDashboardObjectIconLink as ot, coreTaskRegistrations as p, readConversationAccessFromSql as pt, findMatchingWatches as q, withSlackRetries as qt, createPluginHookRunner as r, verifyTimerWatchCredentialSubject as rt, getPluginSystemPromptContributions as s, getDashboardTaskLink as st, agent_hooks_exports as t, verifyScheduledAutomationCredentialSubject as tt, getPlugins as u, createPluginEmbedder as ut, getWorkspace as v, conversationHasParticipantUser as vt, invalidateReadySnapshot as w, readConversationEventPage as wt, listWorkspacesByRepository as x, viewerConversationMembership as xt, getWorkspaceByName as y, conversationNotArchivedForEmail as yt, RESOURCE_WATCH_TOOL_SOURCE as z, downloadPrivateSlackFile as zt };
+export { bindSlackDirectCredentialSubject as $, authenticationUnlinkedEvent as $t, getWorkspaceSnapshotBuilder as A, conversationIsMemberRoot as At, STOP_WATCHING_TOOL_NAME as B, readAttachmentVisionSummary as Bt, WorkspaceValidationError as C, createPluginModel as Ct, setWorkspaceSnapshotBuild as D, conversationArchivedForEmail as Dt, setWorkspaceSnapshot as E, conversationArchiveTimes as Et, isSlackMessageTurn as F, readLatestConversationBrief as Ft, createWatch as G, listConversationAnnotations as Gt, cancelWatch as H, resolveRootVisibility as Ht, slackMessageTurnDisabledReason as I, readConversationEventPage as It, getWatch as J, resolveUserTimezone as Jt, deliverWatch as K, listConversationAnnotationsById as Kt, RESOURCE_SUBSCRIPTION_DEFAULT_TTL_MS as L, buildSentryConversationUrl as Lt, workspaceRepoCheckoutPath as M, conversationNotArchivedForUser as Mt, resolveChannelCapabilities as N, viewerConversationMembership as Nt, SANDBOX_RUNTIME as O, conversationArchivedForUser as Ot, getSlackToolContext as P, createPluginConversationEvents as Pt, bindScheduledAutomationCredentialSubject as Q, authenticationLinkedEvent as Qt, RESOURCE_SUBSCRIPTION_MAX_TTL_MS as R, getSlackFileId as Rt, updateWorkspace as S, createPluginEmbedder as St, loadSnapshotsForProfile as T, readConversationAccessFromSql as Tt, collectEventMatchKeys as U, saveObjectAnnotations as Ut, cancelSubscriptions as V, recordSlackAttachment as Vt, createTimerWatch as W, createPluginAnnotations as Wt, takeDueTimerWatches as X, JUNIOR_NATIVE_EVENT_NAMESPACE as Xt, listWatches as Y, lookupSlackUser as Yt, bindEventAutomationCredentialSubject as Z, agentsInstructionsUpdatedEvent as Zt, deleteWorkspace as _, getDashboardConversationLink as _t, getPluginRoutes as a, downloadPrivateSlackFile as at, listWorkspaces as b, setDashboardConversationLinkOptions as bt, getPluginTools as c, getSlackClient as ct, setPlugins as d, normalizeSlackConversationId as dt, conversationNoteEvent as en, verifyEventAutomationCredentialSubject as et, validatePlugins as f, runWithSlackInstallationToken as ft, createWorkspace as g, JUNIOR_THREAD_STATE_TTL_MS as gt, setBriefsConfig as h, runWithWorkspaceTeamId as ht, getPluginApiRoutes as i, SlackActionError as it, tryWorkspaceRepoCheckoutPath as j, conversationNotArchivedForEmail as jt, deleteWorkspaceSnapshotBuilders as k, conversationHasParticipantUser as kt, getPluginUserPromptContributions as l, isConversationScopedChannel as lt, registration_exports as m, getWorkspaceTeamId as mt, applyPluginFormatMarkdown as n, verifySlackDirectCredentialSubject as nt, getPluginSlackConversationLink as o, getFilePermalink as ot, coreTaskRegistrations as p, withSlackRetries as pt, findMatchingWatches as q, defaultTimezone as qt, createPluginHookRunner as r, verifyTimerWatchCredentialSubject as rt, getPluginSystemPromptContributions as s, getHeaderString as st, agent_hooks_exports as t, verifyScheduledAutomationCredentialSubject as tt, getPlugins as u, isDmChannel as ut, getWorkspace as v, getDashboardObjectIconLink as vt, invalidateReadySnapshot as w, createPluginLogger as wt, listWorkspacesByRepository as x, createPluginState as xt, getWorkspaceByName as y, getDashboardTaskLink as yt, RESOURCE_WATCH_TOOL_SOURCE as z, matchSlackAttachments as zt };