@sentry/junior 0.266.0 → 0.268.0

package/dist/app.js

@@ -1,37 +1,38 @@
-import { C as automationVersionOf, Cn as getConfigDefaults, Q as projectConversationMessages, Y as appendConversationMessages, _n as isExperimentalFeatureEnabled, b as admitEventAutomationRun, c as withScheduledAutomationLock, fn as getThreadStopDecision, gn as getExperimentalFeatures, i as readScheduledAutomation, l as blockEventAutomation, ln as SubscribedReplyReason, n as listScheduledAutomationsForTeam, o as saveScheduledAutomationInLock, p as findMatchingEventAutomations, s as scheduledRunId, tt as settleConversationTitleWork, u as collectEventAutomationMatchKeys, vn as setExperimentalFeatures, wn as setConfigDefaults, x as eventAutomationRunLimitReason } from "./tasks-DDT-J3Rf.js";
-import { _ as snapshotRuntimeConfig, d as restoreRuntimeConfig, f as setBotModelConfig, g as setSlackReactionConfig, h as setRuntimeLimits, i as getChatConfig, m as setProfiles, n as botConfig, o as getSlackBotToken, p as setCrossActorMidRunMode, u as resetRuntimeConfig } from "./config-C0UwYqDK.js";
-import { C as withContext, M as JUNIOR_WORKSPACE_SNAPSHOT_JOB_CALLBACK_ROUTE, R as normalizeIdentityEmail, T as withSpan, f as logException, k as JUNIOR_PLUGIN_TASK_CALLBACK_ROUTE, m as logWarn, p as logInfo, r as createRequestContext, w as withLogContext, y as setSpanAttributes } from "./logging-Ce0mXZ8J.js";
+import { $t as CONVERSATION_WORK_STALE_ENQUEUE_MS, C as automationVersionOf, I as eventGuidance, _n as isInvalidConversationRecordError, _r as setConfigDefaults, _t as settleConversationTitleWork, ar as getThreadStopDecision, b as admitEventAutomationRun, c as withScheduledAutomationLock, dr as setExperimentalFeatures, dt as appendConversationMessages, gr as getConfigDefaults, hn as hasRunnableConversationWork, i as readScheduledAutomation, l as blockEventAutomation, lr as getExperimentalFeatures, mt as projectConversationMessages, n as listScheduledAutomationsForTeam, nr as SubscribedReplyReason, o as saveScheduledAutomationInLock, p as findMatchingEventAutomations, s as scheduledRunId, u as collectEventAutomationMatchKeys, ur as isExperimentalFeatureEnabled, x as eventAutomationRunLimitReason } from "./tasks-SB9z-VTU.js";
+import { _ as snapshotRuntimeConfig, d as restoreRuntimeConfig, f as setBotModelConfig, g as setSlackReactionConfig, h as setRuntimeLimits, i as getChatConfig, m as setProfiles, n as botConfig, o as getSlackBotToken, p as setCrossActorMidRunMode, u as resetRuntimeConfig } from "./config-DrTeF80T.js";
+import { A as JUNIOR_PLUGIN_TASK_CALLBACK_ROUTE, E as withSpan, N as JUNIOR_WORKSPACE_SNAPSHOT_JOB_CALLBACK_ROUTE, T as withLogContext, b as setSpanAttributes, h as logWarn, m as logInfo, p as logException, r as createRequestContext, w as withContext, z as normalizeIdentityEmail } from "./logging-DLSpkSSr.js";
 import { n as captureMessage } from "./sentry-MDkYAVPV.js";
-import { t as JUNIOR_VERSION } from "./version-oaLfxxnf.js";
-import { _ as slackMessageTsSchema, d as parseSlackTeamId, f as parseSlackUserId, h as slackUserIdSchema, m as slackTeamIdSchema, o as parseActorUserId, p as slackChannelIdSchema } from "./actor-tlxzqaRe.js";
-import { P as recordGoogleSignIn, d as getConversationStore, f as getDb, h as withConversationEventLock, l as getConversationEventStore, p as getSqlExecutor, r as readActorIdentity, v as withConversationMutationLock } from "./viewer-BpE6Z3qf.js";
-import { a as juniorAgentInvocations, d as juniorDestinations, i as juniorAgentBindings, s as juniorConversations } from "./agent-invocations-CxKldAeB.js";
-import { a as juniorAutomationRuns, f as juniorConversationBriefs, h as juniorConversationEvents, s as juniorAutomations } from "./executor-TnWbvL09.js";
-import { n as pluginCatalogRuntime } from "./catalog-runtime-DAJjAbSx.js";
-import { C as requestAttachmentDeletion, H as recordSubagentEnded, J as processWorkspaceSnapshotJob, L as effectiveTaskOutcomes, M as logScheduledAutomationRunSkipped, N as scheduledAutomationRunAttributes, T as parseSlackThreadId, V as stopConversationSession, Y as ingestEvent, _ as unpublishedArtifactHeaders, g as readPublicArtifact, h as publicArtifactHeaders, n as executeAgentRun, t as createAgentRunner, v as lookupSlackUserProfile, x as collectAttachmentGarbage } from "./agent-runner-BtYK7bht.js";
-import { An as createPluginLogger, Dn as createPluginState, Ft as collectEventMatchKeys, G as isVercelSandboxEgressRequest, Gt as bindSlackDirectCredentialSubject, Ht as takeDueTimerWatches, J as consumeSandboxEgressAuthRequiredSignal, Jn as resolveRootVisibility, Jt as verifySlackDirectCredentialSubject, K as proxyVercelSandboxEgressRequest, Kt as verifyEventAutomationCredentialSubject, St as slackExternalRefIdSchema, Ut as bindEventAutomationCredentialSubject, Wt as bindScheduledAutomationCredentialSubject, Y as consumeSandboxEgressPermissionDeniedSignal, Z as parseSandboxEgressCredentialToken, Zn as listConversationAnnotations, at as formatProviderLabel, c as getPluginRoutes, cn as runWithWorkspaceTeamId, ct as startOAuthFlow, en as getSlackClient, fn as getDashboardTaskLink, h as validatePlugins, jn as readConversationAccessFromSql, m as setPlugins, n as createUserTokenStore, nn as isDmChannel, nr as createPluginCache, p as getPlugins, pn as setDashboardConversationLinkOptions, pt as slackMention, q as clearSandboxEgressSignals, qt as verifyScheduledAutomationCredentialSubject, rr as createCache, rt as normalizeSandboxEgressTracePropagationDomains, s as getPluginApiRoutes, sn as getWorkspaceTeamId, st as resolveBaseUrl, un as getDashboardConversationLink, v as setBriefsConfig, xt as slackEntitySchema, zt as findMatchingWatches } from "./credentialed-enF5Bf3y.js";
-import { r as getStateAdapter, s as withLock$1 } from "./adapter-eRFA_naf.js";
+import { t as JUNIOR_VERSION } from "./version-jHwJp4hC.js";
+import { f as parseSlackTeamId, g as slackMessageTsSchema, h as slackMessageTsFromMs, m as parseSlackMessageTs, n as createSlackActor, p as parseSlackUserId, s as parseActorUserId, u as parseSlackChannelId } from "./actor-CP9K2Idu.js";
+import { O as recordGoogleSignIn, _ as withConversationEventLock, b as withConversationMutationLock, d as getConversationEventStore, h as getSqlExecutor, i as readActorIdentity, l as closeDb, m as getDb, o as resolveViewerUser, p as getConversationStore } from "./viewer-CpXTGlep.js";
+import { a as juniorAgentInvocations, d as juniorDestinations, i as juniorAgentBindings, s as juniorConversations } from "./agent-invocations-C1RNOCs8.js";
+import { d as juniorAutomations, g as juniorConversationBriefs, l as juniorAutomationRuns, y as juniorConversationEvents } from "./executor-4vhvsMZJ.js";
+import { n as pluginCatalogRuntime } from "./catalog-runtime-BD9GSpc6.js";
+import { C as getOpenSlackUserInput, Ct as requestAttachmentDeletion, Dt as recordSubagentEnded, E as parseSlackThreadId, Et as stopConversationSession, G as parseSlackReviewItemClick, H as syncReviewItemSlackCards, J as buildSlackUserInputModal, K as parseSlackReviewItemFormTarget, N as logScheduledAutomationRunSkipped, Nt as processWorkspaceSnapshotJob, P as scheduledAutomationRunAttributes, Pt as ingestEvent, Q as slackUserInputAnswerNote, R as effectiveTaskOutcomes, S as closeSlackUserInput, T as releaseSlackUserInput, V as readSlackReviewItemCardConversationId, W as buildSlackReviewItemModal, X as parseSlackUserInputSubmission, Y as parseSlackUserInputFormTarget, Z as slackUserInputAction, _ as unpublishedArtifactHeaders, _t as recordWebConversationActivity, dt as sendReviewItemMessages, et as runWithSlackInstallation, g as readPublicArtifact, h as publicArtifactHeaders, mt as conversationTurnIdForMessage, n as executeAgentRun, pt as appendAndEnqueueWebMessage, t as createAgentRunner, tt as verifySlackSignature, ut as renderReviewItemMessage, v as lookupSlackUserProfile, vt as webActorFromEmail, w as persistSlackUserInputReply, x as claimSlackUserInput, xt as collectAttachmentGarbage } from "./agent-runner-CAYfFmU7.js";
+import { $ as openSlackModal, I as isVercelSandboxEgressRequest, In as createPluginLogger, Jt as bindScheduledAutomationCredentialSubject, Kt as takeDueTimerWatches, L as proxyVercelSandboxEgressRequest, Ln as readConversationAccessFromSql, Nn as createPluginState, Qt as verifySlackDirectCredentialSubject, Tt as normalizeSandboxEgressTracePropagationDomains, Ut as findMatchingWatches, V as resolveBaseUrl, Xt as verifyEventAutomationCredentialSubject, Yt as bindSlackDirectCredentialSubject, Zt as verifyScheduledAutomationCredentialSubject, _n as getDashboardTaskLink, _t as consumeSandboxEgressPermissionDeniedSignal, at as slackEntitySchema, c as getPluginRoutes, cr as createPluginCache, dn as getWorkspaceTeamId, er as resolveRootVisibility, et as postSlackEphemeralMessage, fn as runWithWorkspaceTeamId, gt as consumeSandboxEgressAuthRequiredSignal, h as validatePlugins, ht as clearSandboxEgressSignals, in as getSlackClient, lr as createCache, m as setPlugins, mn as getDashboardConversationLink, n as createUserTokenStore, on as isDmChannel, ot as slackExternalRefIdSchema, p as getPlugins, q as slackMention, qt as bindEventAutomationCredentialSubject, rr as listConversationAnnotations, s as getPluginApiRoutes, v as setBriefsConfig, vn as setDashboardConversationLinkOptions, yt as parseSandboxEgressCredentialToken, zt as collectEventMatchKeys } from "./credentialed-lukuD-cc.js";
+import { a as MUTATION_LOCK_TTL_MS, c as withLock, i as getStateAdapter, s as fenceLock, t as disconnectStateAdapter } from "./adapter-04AcD2SO.js";
 import { n as getNextRunAtMs } from "./cadence-R7Em4RjE.js";
-import { M as annotationCard } from "./conversation-DF4rUcjb.js";
-import { b as listPendingAgentInvocationMailboxAppends, x as listPendingAgentInvocationResults } from "./store-DcKkzrdt.js";
-import { C as eventGuidance, N as renderTaskInput, d as getEventCatalog, f as SLACK_EVENT_NAMESPACE, g as slackChannelMessageRunsAutomation, h as slackChannelMessageReplyThreadTs, m as slackChannelMessageEvent } from "./session-stop-tZOw9AJD.js";
-import { c as setSandboxResourceConfig, o as getSandboxResourceConfig } from "./resolve-BSHHkEGE.js";
-import { a as getVercelConversationWorkQueue, d as getQueueProvider, g as isConversationQueueMessageRejectedError, h as conversationQueueMessageSchema, i as verifyWorkspaceSnapshotJobMessage, o as resolveConversationWorkQueueTopic, s as verifyConversationQueueMessage, t as WORKSPACE_SNAPSHOT_JOB_QUEUE_TOPIC } from "./job-queue-DBpHmKnd.js";
-import { A as hasRunnableConversationWork$1, M as isInvalidConversationRecordError, O as CONVERSATION_WORK_STALE_ENQUEUE_MS, S as removeActiveConversation, _ as hasRunnableConversationWork, c as clearExpiredConversationLease, g as getConversationWorkState, h as getConversation, m as ensureConversationWake, r as appendAndEnqueueInboundMessage, v as listActiveConversationIds } from "./store-FALy-JQb.js";
-import { D as scheduledRunSchema } from "./automation-BKpY9LPa.js";
-import { n as validatePluginRegistrations, t as validatePluginEgressCredentialHooks } from "./validation-C2lllinq.js";
+import { D as conversationSurfaceSchema, I as annotationCard, T as conversationReportStatusSchema, h as conversationFeedQuerySchema } from "./conversation-DSo310Ps.js";
+import { b as listPendingAgentInvocationMailboxAppends, x as listPendingAgentInvocationResults } from "./store-C5PN02QO.js";
+import { E as renderSlackObjectCard, S as renderTaskInput, d as getEventCatalog, f as SLACK_EVENT_NAMESPACE, g as slackChannelMessageRunsAutomation, h as slackChannelMessageReplyThreadTs, m as slackChannelMessageEvent } from "./session-stop-Dam1EI7B.js";
+import { a as isEmptyUserInputAnswer, i as formatUserInputAnswer, o as normalizeUserInputAnswer, r as buttonUserInputField } from "./web-message-id-DlHNANtd.js";
+import { c as setSandboxResourceConfig, o as getSandboxResourceConfig } from "./resolve-Cpa4Bu1O.js";
+import { a as getVercelConversationWorkQueue, d as getQueueProvider, g as isConversationQueueMessageRejectedError, h as conversationQueueMessageSchema, i as verifyWorkspaceSnapshotJobMessage, o as resolveConversationWorkQueueTopic, s as verifyConversationQueueMessage, t as WORKSPACE_SNAPSHOT_JOB_QUEUE_TOPIC } from "./job-queue-In9QKz-I.js";
+import { S as removeActiveConversation, _ as hasRunnableConversationWork$1, c as clearExpiredConversationLease, g as getConversationWorkState, h as getConversation, m as ensureConversationWake, r as appendAndEnqueueInboundMessage, v as listActiveConversationIds } from "./store-zPEoJPBB.js";
+import { D as scheduledRunSchema } from "./automation-CmeFBSEh.js";
+import { n as validatePluginRegistrations, t as validatePluginEgressCredentialHooks } from "./validation--JsAGLwc.js";
 import { a as pluginRuntimeRegistrationsFromPluginSet, n as pluginCatalogConfigFromEnv, r as pluginCatalogConfigFromPluginSet, t as defineJuniorPlugins } from "./plugins-DOm9Y6qI.js";
-import { A as THREAD_OPTOUT_ACK, C as buildSlackInboundMessage, D as normalizeIncomingSlackThreadId, E as stopSlackThread, F as renderSlackObjectCard, I as getAttachmentStorage, M as parseContent, N as runWithSlackInstallation, O as withNormalizedThreadId, P as verifySlackSignature, R as enqueueAgentDispatch, S as recordSkippedConversationMessage, T as isSlackMessageStopped, a as recordWebConversationActivity, c as createProductionSlackWebhookServices, f as createSlackWebApiStatusSender, j as startProcessingReaction, k as stopConversationTurn, l as getProductionSlackAdapter, n as conversationTurnIdForMessage, o as webActorFromEmail, s as createProductionConversationWorkOptions, t as appendAndEnqueueWebMessage, v as readViewerAutomationSummary, w as clearSlackPendingReactions, z as GET$3 } from "./web-input-B-bMjD1V.js";
-import { C as existingConversationId, N as recordAutomationExecution, c as getDispatchConversationId, d as getDispatchRecord, h as listPendingDispatchMailboxAppends, i as buildDispatchId, m as isTerminalDispatchStatus, o as confirmDispatchMailboxAppend, p as getPluginDispatchProjection, s as createOrGetDispatch, t as processPluginTask, x as notifyAutomationBlocked, y as markDispatchFailed } from "./task-runner-8N5LIkSg.js";
-import { o as getAuthPausedConversationTurnId, t as enqueueAgentInvocationResult } from "./result-CwOpzqdh.js";
-import { r as enqueueAgentInvocation } from "./work-VX1SHWha.js";
-import { s as coerceThreadConversationState } from "./thread-state-cprEaxgl.js";
-import { o as unlinkProvider } from "./connections-Bwu3VORi.js";
-import { a as GET$4, i as publishAppHomeView, r as GET$5, t as receiveLocalOAuthCredential } from "./credential-sync-VGAMUTGp.js";
-import { a as registerVercelPluginTaskDevConsumer, n as createVercelPluginTaskCallback, s as queueCallback } from "./task-queue-Bg4RS2Gy.js";
-import { t as processConversationWork } from "./worker-hook-y_Y.js";
-import { t as bindMessageAgent } from "./message-VZ3DFpGb.js";
-import { t as bindSpawnAgent } from "./spawn-6rokq7l_.js";
+import { A as assertNoLegacyAllowedDomains, B as normalizeIncomingSlackThreadId, E as readViewerAutomationSummary, F as recordSkippedConversationMessage, G as parseContent, H as stopConversationTurn, I as buildSlackInboundMessage, J as canActOnReviewItem, K as ReviewItemActionError, L as clearSlackPendingReactions, M as isAllowedSignInEmail, N as readEnvList, P as resolveAllowedDomains, Q as getAttachmentStorage, R as isSlackMessageStopped, U as THREAD_OPTOUT_ACK, V as withNormalizedThreadId, W as startProcessingReaction, X as readReviewItemForUser, Z as reviewItemChange, _ as createProductionConversationWorkOptions, b as createSlackWebApiStatusSender, et as enqueueAgentDispatch, j as isAllowedDomain, q as actOnReviewItem, t as readConversationFeed, tt as GET$3, v as createProductionSlackWebhookServices, y as getProductionSlackAdapter, z as stopSlackThread } from "./list-BkgnXEEB.js";
+import { C as existingConversationId, N as recordAutomationExecution, c as getDispatchConversationId, d as getDispatchRecord, h as listPendingDispatchMailboxAppends, i as buildDispatchId, m as isTerminalDispatchStatus, o as confirmDispatchMailboxAppend, p as getPluginDispatchProjection, s as createOrGetDispatch, t as processPluginTask, x as notifyAutomationBlocked, y as markDispatchFailed } from "./task-runner-DMI2prDO.js";
+import { o as getAuthPausedConversationTurnId, t as enqueueAgentInvocationResult } from "./result-D3TSmZZ8.js";
+import { r as enqueueAgentInvocation } from "./work-3N-GHY9m.js";
+import { o as coerceThreadConversationState } from "./thread-state-BbbPh0Sn.js";
+import { o as unlinkProvider } from "./connections-D46f8vvi.js";
+import { a as GET$4, i as publishAppHomeView, r as GET$5, t as receiveLocalOAuthCredential } from "./credential-sync-sm9fegLY.js";
+import { a as pluginTaskQueueConsumer, c as queueCallback, n as createVercelPluginTaskCallback, o as registerVercelPluginTaskDevConsumer } from "./task-queue-_mf28dSu.js";
+import { t as processConversationWork } from "./worker-CCdbcItd.js";
+import { t as bindMessageAgent } from "./message-BObyg59s.js";
+import { t as bindSpawnAgent } from "./spawn-cmq9p4Ly.js";
 import { createRequire } from "node:module";
 import { Hono } from "hono";
 import { z } from "zod";
@@ -39,10 +40,15 @@ import { createHash, randomBytes, randomUUID, timingSafeEqual } from "node:crypt
 import { and, asc, eq, inArray, isNotNull, isNull, lte, or, sql } from "drizzle-orm";
 import { EVENT_SUMMARY_MAX_LENGTH, EVENT_TEXT_MAX_LENGTH, dispatchOptionsSchema, eventSchema, eventTriggerFiltersText, isSlackDestination, userSchema } from "@sentry/junior-plugin-api";
 import { pathToFileURL } from "node:url";
-import { setTimeout as setTimeout$1 } from "node:timers/promises";
+import net from "node:net";
 import { decodeJwt } from "jose";
-import { ChannelImpl, ThreadImpl } from "chat";
+import https from "node:https";
+import { Message, ThreadImpl } from "chat";
 import * as acp from "@agentclientprotocol/sdk";
+import dns from "node:dns";
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
+import { bodyLimit } from "hono/body-limit";
 import { createAuthMiddleware } from "better-auth/api";
 import { betterAuth } from "better-auth/minimal";
 // src/chat/events/timers.ts
@@ -146,7 +152,7 @@ async function recoverConversationWork(args) {
 				}
 				return;
 			}
-			if (work.execution.lease || !hasRunnableConversationWork(work)) return;
+			if (work.execution.lease || !hasRunnableConversationWork$1(work)) return;
 			if ((await ensureConversationWake({
 				conversationId,
 				idempotencyKey: heartbeatIdempotencyKey("pending", conversationId, args.nowMs),
@@ -1548,14 +1554,6 @@ async function presentSlackAnnotationDetails(event, teamId) {
 }
 // src/chat/ingress/slack-payload.ts
 const eventTimestampSchema = slackMessageTsSchema.refine((value) => Number.isFinite((/* @__PURE__ */ new Date(Number(value) * 1e3)).getTime()));
-const slackSlashCommandSchema = z.object({
-	channel_id: z.string().trim().pipe(slackChannelIdSchema),
-	team_id: z.string().trim().pipe(slackTeamIdSchema),
-	user_id: z.string().trim().pipe(slackUserIdSchema),
-	text: z.string(),
-	enterprise_id: z.string().optional(),
-	is_enterprise_install: z.enum(["true", "false"]).optional()
-});
 const slackAssistantThreadSchema = z.object({
 	channel_id: z.string().min(1),
 	thread_ts: eventTimestampSchema,
@@ -1630,163 +1628,547 @@ const slackEventEnvelopeSchema = z.object({
 	type: z.string(),
 	challenge: z.string().optional()
 });
+const slackViewStateValueSchema = z.object({
+	selected_option: z.object({ value: z.string().optional() }).nullish(),
+	selected_options: z.array(z.object({ value: z.string().optional() })).nullish(),
+	value: z.string().nullish()
+});
 const slackInteractivePayloadSchema = z.object({
 	actions: z.array(z.object({
 		action_id: z.string().optional(),
+		action_ts: z.string().optional(),
 		selected_option: z.object({ value: z.string().optional() }).optional(),
 		value: z.string().optional()
 	})).optional(),
+	channel: z.object({ id: z.string().optional() }).nullish(),
+	message: z.object({
+		thread_ts: z.string().optional(),
+		ts: z.string().optional()
+	}).nullish(),
 	team: z.object({ id: z.string().optional() }).nullish(),
+	trigger_id: z.string().optional(),
 	type: z.string(),
 	user: z.object({
 		id: z.string().optional(),
 		team_id: z.string().optional()
-	}).optional()
+	}).optional(),
+	view: z.object({
+		callback_id: z.string().optional(),
+		id: z.string().optional(),
+		private_metadata: z.string().optional(),
+		state: z.object({ values: z.record(z.string(), z.record(z.string(), slackViewStateValueSchema)) }).optional()
+	}).nullish()
+});
+// src/chat/ingress/workspace-membership.ts
+const MEMBER_TTL_MS = 3e5;
+const NON_MEMBER_TTL_MS = 3e4;
+const authorTeamSchema = z.object({
+	user_team: z.string().optional(),
+	source_team: z.string().optional(),
+	user: z.unknown().optional()
 });
-// src/chat/ingress/slash-command.ts
-async function postEphemeral(event, text) {
-	await event.channel.postEphemeral(event.userId, text, { fallbackToDM: false });
+/** Accept only verified workspace authors, reusing recent membership lookups. */
+async function isSlackWorkspaceMember(raw, state) {
+	const workspaceTeamId = getWorkspaceTeamId();
+	if (!workspaceTeamId) return false;
+	const parsed = authorTeamSchema.safeParse(raw);
+	if (!parsed.success) return false;
+	const event = parsed.data;
+	const userId = parseSlackUserId(event.user);
+	if (!userId) return false;
+	const cache = createCache(state, "core");
+	const key = `slack:membership:${workspaceTeamId}:${userId}`;
+	const authorTeam = parseSlackTeamId(event.user_team);
+	if (authorTeam === workspaceTeamId) return true;
+	if (event.user_team !== void 0 && !authorTeam && !/^E[A-Z0-9]+$/.test(event.user_team)) return false;
+	if (authorTeam !== void 0) return await cache.getOrLoad(key, async () => ({
+		value: false,
+		ttlMs: NON_MEMBER_TTL_MS
+	}), { refresh: true });
+	return await cache.getOrLoad(key, async () => {
+		const user = await lookupSlackUserProfile(userId);
+		const authorTeam = parseSlackTeamId(user.team_id);
+		if (user.id !== userId || !authorTeam) return { value: false };
+		const member = authorTeam === workspaceTeamId && !user.is_deleted;
+		return {
+			value: member,
+			ttlMs: member ? MEMBER_TTL_MS : NON_MEMBER_TTL_MS
+		};
+	});
 }
-function getCommandName() {
-	return getChatConfig().slack.slashCommand;
+// src/chat/ingress/slack-interaction-input.ts
+/**
+* Build the Slack input that a click or form makes in a thread, as a
+* mention from the person who acted. The input has no Slack message of its
+* own, so `messageId` is not a timestamp. Every Slack timestamp reader, such
+* as reactions, the actor `slack_ts`, and attachment lookup, then resolves
+* `raw.ts`: the message that the person clicked. `inputTs` sets the time of
+* the input.
+*/
+function buildSlackInteractionInput(args) {
+	const event = {
+		type: "message",
+		channel: args.channelId,
+		team: args.payload.team?.id,
+		text: args.text,
+		thread_ts: args.threadTs,
+		ts: args.inputTs,
+		user: args.userId,
+		user_team: args.payload.user?.team_id
+	};
+	const parsed = args.adapter.parseMessage(event);
+	return new Message({
+		attachments: parsed.attachments,
+		author: parsed.author,
+		formatted: parsed.formatted,
+		id: args.messageId,
+		isMention: true,
+		links: parsed.links,
+		metadata: parsed.metadata,
+		raw: {
+			...event,
+			ts: args.messageTs
+		},
+		text: parsed.text,
+		threadId: parsed.threadId
+	});
 }
-async function handleLink(event, provider) {
-	if (!pluginCatalogRuntime.isProvider(provider)) {
-		await postEphemeral(event, `Unknown provider: \`${provider}\``);
-		return;
-	}
-	if (!pluginCatalogRuntime.getOAuthConfig(provider)) {
-		await postEphemeral(event, `${formatProviderLabel(provider)} doesn't support account linking.`);
+// src/chat/ingress/slack-review-item.ts
+async function tellPerson(target, userId, text) {
+	await postSlackEphemeralMessage({
+		channelId: target.channelId,
+		text,
+		threadTs: target.threadTs,
+		userId
+	});
+}
+/**
+* Resolve the Junior User of the person who acted. An action starts a Turn
+* as that person, so it needs the same workspace and allowed domain checks
+* as a Slack mention.
+*/
+async function resolveActingUser(services, payload, target) {
+	const slackUserId = parseActorUserId(payload.user?.id);
+	const teamId = payload.team?.id ?? payload.user?.team_id;
+	if (!slackUserId || !teamId) throw new Error("Slack review item payload is missing a user or team");
+	if (!await isSlackWorkspaceMember({
+		user: slackUserId,
+		user_team: payload.user?.team_id
+	}, services.state) || !await services.isAuthorAllowed(slackUserId)) return;
+	const user = (await readActorIdentity(createSlackActor(teamId, slackUserId, void 0)))?.user;
+	if (!user) {
+		await tellPerson(target, slackUserId, "Junior does not know your account yet. Sign in to the Junior dashboard, then try again.");
 		return;
 	}
-	const result = await startOAuthFlow(provider, {
-		actorId: event.userId,
-		actor: {
-			platform: "slack",
-			teamId: event.teamId,
-			userId: event.userId
-		},
-		channelId: event.channelId
+	return {
+		slackUserId,
+		user
+	};
+}
+/** Show the current state of an item, such as after a click on a stale card. */
+async function refreshCards(services, user, itemId) {
+	const item = await readReviewItemForUser(user, itemId).catch(() => void 0);
+	if (!item) return;
+	await syncReviewItemSlackCards({
+		getSlackAdapter: () => services.adapter,
+		itemId: item.id
 	});
-	if (!result.ok) {
-		await postEphemeral(event, `Failed to start linking: ${result.error}`);
+}
+/**
+* Do one person action from a Slack card. The thread of the card gets the
+* action as Slack input from the person, like an answer to
+* `requestUserInput`. The other linked Conversations get messages from
+* `actOnReviewItem`. An expected failure, such as an item that is already
+* closed, goes to the person as an ephemeral message.
+*/
+async function act(args) {
+	const { services, target } = args;
+	const actor = await resolveActingUser(services, args.payload, target);
+	if (!actor) return;
+	const conversationId = await readSlackReviewItemCardConversationId({
+		...target,
+		itemId: args.itemId
+	}) ?? `slack:${target.channelId}:${target.threadTs}`;
+	let item;
+	try {
+		const current = await readReviewItemForUser(actor.user, args.itemId);
+		item = await actOnReviewItem({
+			action: args.action,
+			exceptConversationId: conversationId,
+			firstCloseOnly: true,
+			getSlackAdapter: () => services.adapter,
+			id: current.id,
+			queue: services.queue,
+			user: actor.user,
+			...args.answer ? { answer: args.answer(current) } : void 0
+		});
+	} catch (error) {
+		if (!(error instanceof ReviewItemActionError)) throw error;
+		await tellPerson(target, actor.slackUserId, error.message);
+		await refreshCards(services, actor.user, args.itemId);
 		return;
 	}
-	if (result.delivery === "fallback_dm") await postEphemeral(event, `Check your DMs for a ${formatProviderLabel(provider)} authorization link.`);
-	else if (result.delivery === false) await postEphemeral(event, "I wasn't able to send you a private authorization link. Please try again in a direct message.");
+	if (!item.conversationIds.includes(conversationId)) return;
+	const change = reviewItemChange(args.action, actor.user);
+	try {
+		await services.persistMessage(buildSlackInteractionInput({
+			adapter: services.adapter,
+			channelId: target.channelId,
+			inputTs: args.inputTs,
+			messageId: args.messageId,
+			messageTs: target.messageTs,
+			payload: args.payload,
+			text: renderReviewItemMessage(item, change),
+			threadTs: target.threadTs,
+			userId: actor.slackUserId
+		}));
+	} catch (error) {
+		logException(error, "review_item.slack_input.persist.failed", { "app.review_item.id": item.id });
+		await sendReviewItemMessages({
+			change,
+			item,
+			nowMs: Date.now(),
+			queue: services.queue
+		});
+	}
+}
+function cardTarget(payload) {
+	const channelId = parseSlackChannelId(payload.channel?.id);
+	const messageTs = parseSlackMessageTs(payload.message?.ts);
+	if (!channelId || !messageTs) throw new Error("Slack review item payload is incomplete");
+	return {
+		channelId,
+		messageTs,
+		threadTs: parseSlackMessageTs(payload.message?.thread_ts) ?? messageTs
+	};
 }
-async function handleUnlink(event, provider) {
-	if (!pluginCatalogRuntime.isProvider(provider)) {
-		await postEphemeral(event, `Unknown provider: \`${provider}\``);
+async function openAnswerForm(args) {
+	const { target } = args;
+	const triggerId = args.payload.trigger_id;
+	if (!triggerId) throw new Error("Slack review item form payload is missing a trigger id");
+	const actor = await resolveActingUser(args.services, args.payload, target);
+	if (!actor) return;
+	let item;
+	try {
+		item = await readReviewItemForUser(actor.user, args.itemId);
+	} catch (error) {
+		if (!(error instanceof ReviewItemActionError)) throw error;
+		await tellPerson(target, actor.slackUserId, error.message);
 		return;
 	}
-	if (!(Boolean(pluginCatalogRuntime.getOAuthConfig(provider)) || Boolean(pluginCatalogRuntime.getDefinition(provider)?.manifest.mcp))) {
-		await postEphemeral(event, `${formatProviderLabel(provider)} doesn't support account unlinking.`);
+	if (!canActOnReviewItem(item, actor.user.id)) {
+		await tellPerson(target, actor.slackUserId, item.status === "open" ? "Only an assignee can act on this item." : "This item is already closed.");
+		await refreshCards(args.services, actor.user, item.id);
 		return;
 	}
-	const tokenStore = createUserTokenStore();
-	await unlinkProvider(event.userId, provider, tokenStore, event.teamId);
-	logInfo("slash_command.credential.unlinked", { "app.credential.provider": provider });
-	await postEphemeral(event, `Your ${formatProviderLabel(provider)} account has been unlinked.`);
-}
-/** Route link and unlink slash commands to the appropriate OAuth flow. */
-async function handleSlashCommand(event) {
-	const [subcommand, provider, ...rest] = event.text.trim().split(/\s+/);
-	if (!subcommand || !["link", "unlink"].includes(subcommand)) {
-		await postEphemeral(event, `Usage: \`${getCommandName()} link <provider>\` or \`${getCommandName()} unlink <provider>\``);
+	const view = buildSlackReviewItemModal(item, {
+		...target,
+		itemId: item.id
+	});
+	if (!view) return;
+	await openSlackModal({
+		triggerId,
+		view
+	});
+}
+/** Handle one click on a Review item card. */
+async function handleSlackReviewItemClick(args) {
+	const { click, payload, services } = args;
+	const target = cardTarget(payload);
+	if (click.kind === "answer") {
+		await openAnswerForm({
+			itemId: click.itemId,
+			payload,
+			services,
+			target
+		});
 		return;
 	}
-	if (!provider || rest.length > 0) {
-		await postEphemeral(event, `Usage: \`${getCommandName()} ${subcommand} <provider>\``);
+	const actionTs = parseSlackMessageTs(args.action.action_ts);
+	if (!actionTs) throw new Error("Slack review item click payload is incomplete");
+	const common = {
+		inputTs: actionTs,
+		itemId: click.itemId,
+		messageId: `slack-review-item:${actionTs}`,
+		payload,
+		services,
+		target
+	};
+	if (click.kind === "done") {
+		await act({
+			...common,
+			action: "complete"
+		});
 		return;
 	}
-	const normalized = provider.toLowerCase();
-	if (subcommand === "link") await handleLink(event, normalized);
-	else await handleUnlink(event, normalized);
-}
-// src/chat/ingress/slack-form.ts
-function parseJson$1(body) {
-	try {
-		return JSON.parse(body);
-	} catch {
+	if (click.kind === "dismiss") {
+		await act({
+			...common,
+			action: "dismiss"
+		});
 		return;
 	}
+	await act({
+		...common,
+		action: "submit",
+		answer: (item) => {
+			const field = item.request && buttonUserInputField(item.request);
+			if (!field?.options.some((option) => option.label === click.label)) throw new ReviewItemActionError("conflict", "This card changed. Use the updated card.");
+			return {
+				requestId: item.id,
+				values: { [field.id]: [click.label] }
+			};
+		}
+	});
+}
+/** Submit the answer of a Review item form. */
+async function handleSlackReviewItemSubmission(args) {
+	const view = args.payload.view;
+	const formTarget = parseSlackReviewItemFormTarget(view?.private_metadata);
+	const channelId = parseSlackChannelId(formTarget?.channelId);
+	const messageTs = parseSlackMessageTs(formTarget?.messageTs);
+	const threadTs = parseSlackMessageTs(formTarget?.threadTs);
+	if (!view?.id || !formTarget || !channelId || !messageTs || !threadTs) throw new Error("Slack review item form submission is incomplete");
+	await act({
+		action: "submit",
+		answer: (item) => item.request ? parseSlackUserInputSubmission({
+			request: item.request,
+			requestId: item.id,
+			values: view.state?.values ?? {}
+		}) : {
+			requestId: item.id,
+			values: {}
+		},
+		inputTs: slackMessageTsFromMs(Date.now()),
+		itemId: formTarget.itemId,
+		messageId: `slack-review-item:${view.id}`,
+		payload: args.payload,
+		services: args.services,
+		target: {
+			channelId,
+			messageTs,
+			threadTs
+		}
+	});
 }
+// src/chat/ingress/slack-interactive.ts
 function requireSlackPayloadUserId(value, source) {
 	const userId = parseActorUserId(value);
 	if (!userId) throw new Error(`${source} is missing a Slack user id`);
 	return userId;
 }
-async function handleSlashCommandForm(args) {
-	const { channel_id: channelId, team_id: teamId, user_id: userId } = args.form;
-	const channel = new ChannelImpl({
-		id: `slack:${channelId}`,
+async function handleAppHomeDisconnect(args) {
+	await withSpan("chat.app_home_disconnect", "chat.app_home_disconnect", { userId: args.userId }, async () => {
+		try {
+			await unlinkProvider(args.userId, args.provider, args.userTokenStore, getWorkspaceTeamId());
+		} catch (error) {
+			logException(error, "app_home.disconnect_unlink.failed", { "app.credential.provider": args.provider });
+		}
+		try {
+			await publishAppHomeView(getSlackClient(), args.userId, args.userTokenStore);
+		} catch (error) {
+			logException(error, "app_home.disconnect_publish.failed", { "app.credential.provider": args.provider });
+		}
+	});
+}
+/**
+* Save the first answer to the open request of a Slack thread as Slack input
+* from the person who answered. The input text is the formatted answer, so
+* the model reads one format on every surface. Later answers to the same
+* request do nothing. A stale request, such as one that a newer request
+* replaced, also does nothing.
+*/
+async function answerSlackUserInput(args) {
+	const userId = requireSlackPayloadUserId(args.payload.user?.id, "Slack user input payload");
+	const { channelId, messageTs } = args;
+	const open = await getOpenSlackUserInput(args.state, {
+		channelId,
+		threadTs: args.threadTs
+	});
+	if (!open || open.messageTs !== messageTs) return;
+	const answer = args.answer(open);
+	if (isEmptyUserInputAnswer(answer)) return;
+	const userTeam = args.payload.user?.team_id;
+	if (!await isSlackWorkspaceMember({
+		user: userId,
+		user_team: userTeam
+	}, args.state)) return;
+	if (!await args.isAuthorAllowed(userId)) return;
+	if (!await claimSlackUserInput(args.state, {
+		channelId,
+		claimedBy: userId,
+		messageTs
+	})) return;
+	const message = buildSlackInteractionInput({
 		adapter: args.adapter,
-		stateAdapter: args.state
+		channelId,
+		inputTs: args.inputTs,
+		messageId: args.messageId,
+		messageTs,
+		payload: args.payload,
+		text: formatUserInputAnswer(open.request, answer),
+		threadTs: args.threadTs,
+		userId
 	});
-	await withSpan("chat.slash_command", "chat.slash_command", { userId }, async () => {
-		await handleSlashCommand({
-			channel,
+	try {
+		await args.persistMessage(message);
+	} catch (error) {
+		await releaseSlackUserInput(args.state, {
 			channelId,
-			teamId,
-			text: args.form.text,
-			userId
+			messageTs
 		});
+		throw error;
+	}
+	await closeSlackUserInput({
+		note: slackUserInputAnswerNote({
+			answer,
+			request: open.request,
+			who: slackMention(userId)
+		}),
+		open
+	});
+}
+/** Read the request message and thread of a block action. */
+function blockActionTarget(payload) {
+	const channelId = parseSlackChannelId(payload.channel?.id);
+	const messageTs = parseSlackMessageTs(payload.message?.ts);
+	if (!channelId || !messageTs) throw new Error("Slack user input payload is incomplete");
+	return {
+		channelId,
+		messageTs,
+		threadTs: parseSlackMessageTs(payload.message?.thread_ts) ?? messageTs
+	};
+}
+/** Answer a one-click request with the clicked choice. */
+async function handleUserInputChoice(args) {
+	const target = blockActionTarget(args.payload);
+	const actionTs = parseSlackMessageTs(args.action.action_ts);
+	const choice = args.action.value?.trim();
+	if (!actionTs || !choice) throw new Error("Slack user input click payload is incomplete");
+	await answerSlackUserInput({
+		...target,
+		adapter: args.adapter,
+		answer: (open) => {
+			const field = buttonUserInputField(open.request);
+			return normalizeUserInputAnswer(open.request, {
+				requestId: open.requestId,
+				values: field ? { [field.id]: [choice] } : {}
+			});
+		},
+		inputTs: actionTs,
+		messageId: `slack-user-input-answer:${actionTs}`,
+		payload: args.payload,
+		isAuthorAllowed: args.isAuthorAllowed,
+		persistMessage: args.persistMessage,
+		state: args.state
+	});
+}
+/** Open the answer form of the open request for the person who clicked. */
+async function handleUserInputOpenForm(args) {
+	const target = blockActionTarget(args.payload);
+	const triggerId = args.payload.trigger_id;
+	if (!triggerId) throw new Error("Slack user input form payload is missing a trigger id");
+	const open = await getOpenSlackUserInput(args.state, target);
+	if (!open || open.messageTs !== target.messageTs) return;
+	await openSlackModal({
+		triggerId,
+		view: buildSlackUserInputModal(open.request, target)
+	});
+}
+/** Answer a request with the values of its submitted form. */
+async function handleUserInputSubmission(args) {
+	const view = args.payload.view;
+	const formTarget = parseSlackUserInputFormTarget(view?.private_metadata);
+	const channelId = parseSlackChannelId(formTarget?.channelId);
+	const messageTs = parseSlackMessageTs(formTarget?.messageTs);
+	const threadTs = parseSlackMessageTs(formTarget?.threadTs);
+	if (!view?.id || !channelId || !messageTs || !threadTs) throw new Error("Slack user input form submission is incomplete");
+	const inputTs = slackMessageTsFromMs(Date.now());
+	await answerSlackUserInput({
+		adapter: args.adapter,
+		answer: (open) => parseSlackUserInputSubmission({
+			request: open.request,
+			requestId: open.requestId,
+			values: view.state?.values ?? {}
+		}),
+		channelId,
+		inputTs,
+		messageId: `slack-user-input-answer:${view.id}`,
+		messageTs,
+		payload: args.payload,
+		isAuthorAllowed: args.isAuthorAllowed,
+		persistMessage: args.persistMessage,
+		state: args.state,
+		threadTs
 	});
 }
-async function handleInteractivePayload(args) {
+/**
+* Handle Slack interactions from App Home, user input requests, and Review
+* item cards: block actions and submitted forms.
+*/
+async function handleSlackInteractivePayload(args) {
+	const spanAttributes = { userId: args.payload.user?.id?.trim() || void 0 };
+	if (args.payload.type === "view_submission" && args.payload.view?.callback_id === "junior_review_item") {
+		await withSpan("chat.slack_review_item_submit", "chat.slack_review_item_submit", spanAttributes, () => handleSlackReviewItemSubmission({
+			payload: args.payload,
+			services: args
+		}));
+		return;
+	}
+	if (args.payload.type === "view_submission" && args.payload.view?.callback_id === "junior_user_input") {
+		await withSpan("chat.slack_user_input_submit", "chat.slack_user_input_submit", spanAttributes, () => handleUserInputSubmission(args));
+		return;
+	}
 	if (args.payload.type !== "block_actions") return;
-	const action = args.payload.actions?.find((candidate) => candidate.action_id === "app_home_disconnect");
-	const provider = action?.selected_option?.value ?? action?.value;
-	if (!provider) return;
-	const userId = requireSlackPayloadUserId(args.payload.user?.id, "Slack app home disconnect payload");
-	await withSpan("chat.app_home_disconnect", "chat.app_home_disconnect", { userId }, async () => {
-		try {
-			await unlinkProvider(userId, provider, args.userTokenStore, getWorkspaceTeamId());
-		} catch (error) {
-			logException(error, "app_home.disconnect_unlink.failed", { "app.credential.provider": provider });
+	for (const action of args.payload.actions ?? []) {
+		const click = parseSlackReviewItemClick(action);
+		if (click) {
+			await withSpan("chat.slack_review_item_click", "chat.slack_review_item_click", spanAttributes, () => handleSlackReviewItemClick({
+				action,
+				click,
+				payload: args.payload,
+				services: args
+			}));
+			return;
 		}
-		try {
-			await publishAppHomeView(getSlackClient(), userId, args.userTokenStore);
-		} catch (error) {
-			logException(error, "app_home.disconnect_publish.failed", { "app.credential.provider": provider });
+		const kind = slackUserInputAction(action.action_id);
+		if (kind === "choice") {
+			await withSpan("chat.slack_user_input_click", "chat.slack_user_input_click", spanAttributes, () => handleUserInputChoice({
+				...args,
+				action
+			}));
+			return;
+		}
+		if (kind === "open_form") {
+			await withSpan("chat.slack_user_input_open_form", "chat.slack_user_input_open_form", spanAttributes, () => handleUserInputOpenForm(args));
+			return;
 		}
+	}
+	const disconnect = args.payload.actions?.find((candidate) => candidate.action_id === "app_home_disconnect");
+	const provider = disconnect?.selected_option?.value ?? disconnect?.value;
+	if (!provider) return;
+	await handleAppHomeDisconnect({
+		provider,
+		userId: requireSlackPayloadUserId(args.payload.user?.id, "Slack app home disconnect payload"),
+		userTokenStore: args.userTokenStore
 	});
 }
+// src/chat/ingress/slack-form.ts
+function parseJson$1(body) {
+	try {
+		return JSON.parse(body);
+	} catch {
+		return;
+	}
+}
 function installationFromInteractive(payload) {
 	return { teamId: payload.team?.id ?? payload.user?.team_id };
 }
-/** Handle a Slack slash command or interactive payload form. */
+/** Handle a Slack interactive payload form. */
 async function handleSlackForm(args) {
 	const params = new URLSearchParams(args.body);
 	const { adapter, state } = args;
 	await state.connect();
-	if (params.has("command") && !params.has("payload")) {
-		const result = slackSlashCommandSchema.safeParse(Object.fromEntries(params));
-		if (!result.success) return new Response("Invalid slash command payload", { status: 400 });
-		const form = result.data;
-		const installation = {
-			teamId: form.team_id,
-			enterpriseId: form.enterprise_id,
-			isEnterpriseInstall: form.is_enterprise_install === "true"
-		};
-		args.waitUntil(withLogContext({
-			platform: "slack",
-			userId: form.user_id
-		}, () => runWithWorkspaceTeamId(installation.teamId, () => runWithSlackInstallation({
-			adapter,
-			installation,
-			state,
-			task: () => handleSlashCommandForm({
-				adapter,
-				form,
-				state
-			})
-		})).catch((error) => {
-			logException(error, "slash_command.failed");
-		})));
-		return new Response("", { status: 200 });
-	}
 	const rawPayload = params.get("payload");
 	if (!rawPayload) return new Response("Missing payload", { status: 400 });
 	const result = slackInteractivePayloadSchema.safeParse(parseJson$1(rawPayload));
@@ -1800,8 +2182,13 @@ async function handleSlackForm(args) {
 		adapter,
 		installation,
 		state,
-		task: () => handleInteractivePayload({
+		task: () => handleSlackInteractivePayload({
+			adapter,
 			payload,
+			isAuthorAllowed: (userId) => args.isAuthorAllowed(userId, installation),
+			persistMessage: (message) => args.persistMessage(message, installation),
+			queue: args.queue,
+			state,
 			userTokenStore: args.getUserTokenStore()
 		})
 	})).catch((error) => {
@@ -1898,8 +2285,8 @@ function eventAutomationDispatchKey(taskId, namespace, eventKey) {
 	return `event-automation:${createHash("sha256").update(`${taskId}\0${namespace}\0${eventKey}`).digest("hex").slice(0, 32)}`;
 }
 /** Render plain agent input for one matching event automation. */
-function eventInput(task, event, outcomes) {
-	const guidance = eventGuidance(getEventCatalog(), event.namespace, task.trigger.resourceType, event.eventType);
+function eventInput(task, event, outcomes, catalog) {
+	const guidance = eventGuidance(catalog, event.namespace, event.eventType);
 	return renderTaskInput({
 		about: task.trigger.label,
 		creator: slackMention(task.createdBy.slackUserId),
@@ -1913,12 +2300,20 @@ function eventInput(task, event, outcomes) {
 		externalTextMaxLength: EVENT_TEXT_MAX_LENGTH
 	});
 }
-/** Match a normalized event and dispatch every matching automation. */
+/**
+* Match a normalized event and dispatch every matching automation.
+*
+* Plugins publish one copy of an occurrence for each scope, such as a pull
+* request and its repository. All copies share one event key. An automation
+* with no identifier matches every copy, and the dispatch key and the run
+* limit both use the event key, so it runs and counts once.
+*/
 async function ingestEventAutomations(input, options) {
 	const event = eventSchema.parse(input);
 	const db = getDb();
 	const nowMs = options.nowMs ?? Date.now();
-	const tasks = (await findMatchingEventAutomations(db, event, options.teamId)).filter((task) => slackChannelMessageRunsAutomation(event, task));
+	const catalog = getEventCatalog();
+	const tasks = (await findMatchingEventAutomations(db, event, options.teamId, catalog)).filter((task) => slackChannelMessageRunsAutomation(event, task));
 	let dispatched = 0;
 	const errors = [];
 	for (const task of tasks) try {
@@ -1945,7 +2340,7 @@ async function ingestEventAutomations(input, options) {
 						"app.event.event_type": event.eventType,
 						"app.event_automation.max_runs": botConfig.maxEventAutomationRuns,
 						"app.event_automation.run_window_ms": botConfig.eventAutomationRunWindowMs,
-						"app.event_automation.resource_type": task.trigger.resourceType,
+						"app.event_automation.resource_type": task.trigger.resourceType ?? "any",
 						"app.task.id": task.id
 					}
 				});
@@ -1978,7 +2373,7 @@ async function ingestEventAutomations(input, options) {
 				...credentialSubject ? { credentialSubject } : void 0,
 				destination,
 				destinationVisibility: task.destinationVisibility,
-				input: eventInput(task, event, outcomes),
+				input: eventInput(task, event, outcomes, catalog),
 				metadata: { eventAutomationId: task.id },
 				replyAttribution: automationReplyAttribution(task.title),
 				outcomes
@@ -1996,85 +2391,6 @@ async function ingestEventAutomations(input, options) {
 	if (errors.length > 0) throw new AggregateError(errors, "Failed to dispatch one or more event automations");
 	return { dispatched };
 }
-// src/chat/ingress/workspace-membership.ts
-const MEMBER_TTL_MS = 3e5;
-const NON_MEMBER_TTL_MS = 3e4;
-const authorTeamSchema = z.object({
-	user_team: z.string().optional(),
-	source_team: z.string().optional(),
-	user: z.unknown().optional()
-});
-/** Accept only verified workspace authors, reusing recent membership lookups. */
-async function isSlackWorkspaceMember(raw, state) {
-	const workspaceTeamId = getWorkspaceTeamId();
-	if (!workspaceTeamId) return false;
-	const parsed = authorTeamSchema.safeParse(raw);
-	if (!parsed.success) return false;
-	const event = parsed.data;
-	const userId = parseSlackUserId(event.user);
-	if (!userId) return false;
-	const cache = createCache(state, "core");
-	const key = `slack:membership:${workspaceTeamId}:${userId}`;
-	const authorTeam = parseSlackTeamId(event.user_team);
-	if (authorTeam === workspaceTeamId) return true;
-	if (event.user_team !== void 0 && !authorTeam && !/^E[A-Z0-9]+$/.test(event.user_team)) return false;
-	if (authorTeam !== void 0) return await cache.getOrLoad(key, async () => ({
-		value: false,
-		ttlMs: NON_MEMBER_TTL_MS
-	}), { refresh: true });
-	return await cache.getOrLoad(key, async () => {
-		const user = await lookupSlackUserProfile(userId);
-		const authorTeam = parseSlackTeamId(user.team_id);
-		if (user.id !== userId || !authorTeam) return { value: false };
-		const member = authorTeam === workspaceTeamId && !user.is_deleted;
-		return {
-			value: member,
-			ttlMs: member ? MEMBER_TTL_MS : NON_MEMBER_TTL_MS
-		};
-	});
-}
-// src/chat/sign-in/allowlist.ts
-/**
-* Domains that may use Junior. Slack authors must have a Slack profile email
-* on one of them, and dashboard Google sign-ins must come from a Google
-* Workspace account whose `hd` claim is one of them. Slack and the dashboard
-* share one list.
-*/
-/** Read a list env var: a JSON string array or comma-separated values. */
-function readEnvList(name) {
-	const value = process.env[name]?.trim();
-	if (!value) return void 0;
-	if (!value.startsWith("[")) return value.split(",");
-	let parsed;
-	try {
-		parsed = JSON.parse(value);
-	} catch (error) {
-		throw new Error(`${name} must be a JSON string array`, { cause: error });
-	}
-	const list = z.array(z.string()).safeParse(parsed);
-	if (!list.success) throw new Error(`${name} must be a JSON string array`);
-	return list.data;
-}
-/**
-* Resolve the allowed domains: the `createApp` option when set, else
-* `JUNIOR_ALLOWED_DOMAINS`. An empty list allows every domain.
-*/
-function resolveAllowedDomains(allowedDomains) {
-	return [...new Set((allowedDomains ?? readEnvList("JUNIOR_ALLOWED_DOMAINS") ?? []).map((value) => value.trim().toLowerCase()).filter(Boolean))];
-}
-/**
-* Fail startup on the removed Google-specific names. Ignoring them would
-* leave the list empty, which lets every Slack workspace member in.
-*/
-function assertNoLegacyAllowedDomains(dashboardOptionKeys) {
-	if (dashboardOptionKeys.includes("allowedGoogleDomains")) throw new Error("dashboard.allowedGoogleDomains was removed; set createApp({ allowedDomains }) instead");
-	if (process.env.JUNIOR_DASHBOARD_GOOGLE_DOMAINS?.trim()) throw new Error("JUNIOR_DASHBOARD_GOOGLE_DOMAINS was removed; set JUNIOR_ALLOWED_DOMAINS instead");
-}
-/** Return whether a verified domain may use Junior. An empty list allows all. */
-function isAllowedDomain(domain, allowedDomains) {
-	if (allowedDomains.length === 0) return true;
-	return Boolean(domain && allowedDomains.includes(domain.toLowerCase()));
-}
 // src/chat/ingress/slack-allowed-domain.ts
 const ALLOWED_TTL_MS = 3e5;
 const NOT_ALLOWED_TTL_MS = 3e4;
@@ -2126,6 +2442,19 @@ function slackMessageAttributes(body) {
 		"app.slack.is_ext_shared_channel": typeof body.is_ext_shared_channel === "boolean" ? body.is_ext_shared_channel : body.is_ext_shared_channel === void 0 ? "missing" : "invalid"
 	};
 }
+// src/chat/ingress/slack-event-persistence-error.ts
+/** A Slack input that Junior could not fully save and wake a worker for. */
+var SlackEventPersistenceError = class extends Error {
+	cause;
+	/** True when the mailbox kept the input and only the queue send failed. */
+	saved;
+	constructor(cause, saved) {
+		super("Slack event durable persistence failed");
+		this.name = "SlackEventPersistenceError";
+		this.cause = cause;
+		this.saved = saved;
+	}
+};
 // src/chat/slack/automation-details.ts
 function textField(key, label, value) {
 	return {
@@ -2265,14 +2594,6 @@ const IGNORED_MESSAGE_SUBTYPES = /* @__PURE__ */ new Set([
 	"ekm_access_denied",
 	"tombstone"
 ]);
-var SlackEventPersistenceError = class extends Error {
-	cause;
-	constructor(cause) {
-		super("Slack event durable persistence failed");
-		this.name = "SlackEventPersistenceError";
-		this.cause = cause;
-	}
-};
 function enqueue(waitUntil, task) {
 	waitUntil(task);
 }
@@ -2373,11 +2694,12 @@ async function persistSlackMessage(args) {
 		queue: args.queue,
 		state: args.state
 	}).catch(async (error) => {
-		if (!(await getConversationWorkState({
+		const kept = (await getConversationWorkState({
 			conversationId,
 			state: args.state
-		}))?.execution.inboundMessageIds.includes(inbound.inboundMessageId)) await receipt?.stop();
-		throw new SlackEventPersistenceError(error);
+		}))?.execution.inboundMessageIds.includes(inbound.inboundMessageId) === true;
+		if (!kept) await receipt?.stop();
+		throw new SlackEventPersistenceError(error, kept);
 	});
 }
 /**
@@ -2430,7 +2752,7 @@ async function handleSlackThreadStop(args) {
 	});
 	await appendConversationMessages(getConversationEventStore(), {
 		conversation,
-		conversationId: args.canonicalThreadId
+		conversationId
 	});
 	await thread.post(THREAD_OPTOUT_ACK);
 }
@@ -2533,6 +2855,11 @@ async function routeParsedMessage(args) {
 		teamId: args.installation.teamId,
 		user: args.event.user
 	})) return;
+	const conversationId = await resolveSlackConversationId({
+		canonicalThreadId,
+		conversationStore: args.conversationStore,
+		installation: args.installation
+	});
 	if (isSubscribed && !isExperimentalFeatureEnabled("passive-routing")) {
 		const content = parseContent(message);
 		const conversation = coerceThreadConversationState(void 0);
@@ -2544,16 +2871,11 @@ async function routeParsedMessage(args) {
 		});
 		await appendConversationMessages(getConversationEventStore(), {
 			conversation,
-			conversationId: canonicalThreadId
+			conversationId
 		});
 		return;
 	}
-	const conversationId = await resolveSlackConversationId({
-		canonicalThreadId,
-		conversationStore: args.conversationStore,
-		installation: args.installation
-	});
-	await persistSlackMessage({
+	const persist = () => persistSlackMessage({
 		adapter: args.adapter,
 		installation: args.installation,
 		message,
@@ -2564,6 +2886,22 @@ async function routeParsedMessage(args) {
 		route,
 		state: args.state
 	});
+	if (route !== "mention") {
+		await persist();
+		return;
+	}
+	await persistSlackUserInputReply({
+		channelId: args.event.channel,
+		claimedBy: message.author.userId,
+		isSaved: (error) => error instanceof SlackEventPersistenceError && error.saved,
+		note: (request) => slackUserInputAnswerNote({
+			request,
+			who: slackMention(message.author.userId)
+		}),
+		persist,
+		state: args.state,
+		threadTs: args.event.thread_ts
+	});
 }
 async function handleSlackEvent(args) {
 	const event = args.body.event;
@@ -2622,7 +2960,7 @@ async function handleSlackEvent(args) {
 				if (!await isSlackWorkspaceMember(event, state)) return;
 				const channelId = event.channel;
 				const threadTs = event.thread_ts;
-				if (!(await withLock$1(state, `slack:ingress:slack:${channelId}:${threadTs}`, () => handleSlackSessionStop({
+				if (!(await withLock(state, `slack:ingress:slack:${channelId}:${threadTs}`, () => handleSlackSessionStop({
 					adapter,
 					channelId,
 					conversationStore: args.services.conversationStore,
@@ -2641,7 +2979,7 @@ async function handleSlackEvent(args) {
 				setSpanAttributes({ "app.slack.membership": member ? "verified" : "unverified" });
 				if (!member) return;
 				const message = adapter.parseMessage(event);
-				if (!(await withLock$1(state, `slack:ingress:${normalizeMessageThreadId(message).threadId}`, () => routeParsedMessage({
+				if (!(await withLock(state, `slack:ingress:${normalizeMessageThreadId(message).threadId}`, () => routeParsedMessage({
 					adapter,
 					event,
 					installation,
@@ -2660,22 +2998,69 @@ async function handleSlackEvent(args) {
 		}
 	}));
 }
-/** Handle Slack webhooks by enqueueing durable conversation work. */
-async function handleSlackWebhook(args) {
-	const adapter = args.services.getSlackAdapter();
-	const body = await args.request.text();
+/**
+* Persist one Slack input as a mention under the thread's ingress lock.
+* Slack does not retry interactions. Saved input still runs through heartbeat
+* recovery, so a failed queue send after the append does not reject it.
+*/
+async function persistSlackMentionWithLock(args) {
+	const { message, threadId } = normalizeMessageThreadId(args.message);
+	try {
+		if (!(await withLock(args.state, `slack:ingress:${threadId}`, () => persistSlackMessage({
+			adapter: args.adapter,
+			installation: args.installation,
+			message,
+			conversationStore: args.services.conversationStore,
+			queue: args.services.queue,
+			receivedAtMs: Date.now(),
+			route: "mention",
+			state: args.state
+		}), {
+			keepAlive: true,
+			waitMs: 1e4
+		})).acquired) throw new Error("Could not acquire Slack ingress lock");
+	} catch (error) {
+		if (error instanceof SlackEventPersistenceError && error.saved) {
+			logException(error.cause, "slack.event.wake.failed");
+			return;
+		}
+		throw error;
+	}
+}
+/** Handle Slack webhooks by enqueueing durable conversation work. */
+async function handleSlackWebhook(args) {
+	const adapter = args.services.getSlackAdapter();
+	const body = await args.request.text();
 	if (!verifySlackSignature({
 		adapter,
 		body,
 		request: args.request
 	})) return new Response("Invalid signature", { status: 401 });
-	if ((args.request.headers.get("content-type") || "").includes("application/x-www-form-urlencoded")) return await handleSlackForm({
-		adapter,
-		body,
-		getUserTokenStore: () => getUserTokenStore(args.services),
-		state: args.services.state ?? getStateAdapter(),
-		waitUntil: args.waitUntil
-	});
+	if ((args.request.headers.get("content-type") || "").includes("application/x-www-form-urlencoded")) {
+		const state = args.services.state ?? getStateAdapter();
+		return await handleSlackForm({
+			adapter,
+			body,
+			getUserTokenStore: () => getUserTokenStore(args.services),
+			isAuthorAllowed: (userId, installation) => isSlackAuthorDomainAllowed({
+				allowedBotUserIds: args.services.allowedBotUserIds ?? [],
+				allowedDomains: args.services.allowedDomains ?? [],
+				state,
+				teamId: installation.teamId,
+				user: userId
+			}),
+			persistMessage: (message, installation) => persistSlackMentionWithLock({
+				adapter,
+				installation,
+				message,
+				services: args.services,
+				state
+			}),
+			queue: args.services.queue,
+			state,
+			waitUntil: args.waitUntil
+		});
+	}
 	const result = slackEventEnvelopeSchema.safeParse(parseJson(body));
 	if (!result.success) return new Response("Invalid JSON", { status: 400 });
 	const parsed = result.data;
@@ -2855,6 +3240,10 @@ function conversationWorkCallback(options) {
 function createVercelConversationWorkCallback(options) {
 	return conversationWorkCallback(options).create();
 }
+/** Return the queue consumer for conversation work, for a pulling queue worker. */
+function conversationWorkQueueConsumer(options) {
+	return conversationWorkCallback(options).consumer;
+}
 /** Register the Vercel Queue local-dev consumer for Nitro's central route dispatcher. */
 function registerVercelConversationWorkDevConsumer(options) {
 	return conversationWorkCallback(options).registerDev();
@@ -2885,6 +3274,10 @@ function workspaceSnapshotJobCallback() {
 function createVercelWorkspaceSnapshotJobCallback() {
 	return workspaceSnapshotJobCallback().create();
 }
+/** Return the queue consumer for snapshot builds, for a pulling queue worker. */
+function workspaceSnapshotJobQueueConsumer() {
+	return workspaceSnapshotJobCallback().consumer;
+}
 /** Receive snapshot build messages during local development. */
 function registerVercelWorkspaceSnapshotJobDevConsumer() {
 	return workspaceSnapshotJobCallback().registerDev();
@@ -2946,7 +3339,7 @@ function createEventAppPublisher(args) {
 				namespace: event.namespace,
 				identifier: event.identifier,
 				state: work.state
-			}), eventAutomationTeamId ? findMatchingEventAutomations(getDb(), event, eventAutomationTeamId) : Promise.resolve([])]);
+			}), eventAutomationTeamId ? findMatchingEventAutomations(getDb(), event, eventAutomationTeamId, getEventCatalog()) : Promise.resolve([])]);
 			return subscriptions.length > 0 || tasks.length > 0;
 		},
 		async neededMatchKeys(input) {
@@ -2958,6 +3351,8 @@ function createEventAppPublisher(args) {
 				namespace: input.namespace,
 				state: work.state
 			}), eventAutomationTeamId ? collectEventAutomationMatchKeys(getDb(), {
+				catalog: getEventCatalog(),
+				...input.data ? { data: input.data } : void 0,
 				eventTypes: input.eventTypes,
 				identifiers: input.identifiers,
 				namespace: input.namespace,
@@ -2996,7 +3391,7 @@ async function turnTerminalIsReady(args) {
 		state: args.state
 	});
 	if (conversation?.execution.pendingMessages.some((message) => message.inboundMessageId === args.messageId)) return false;
-	if (!conversation || !hasRunnableConversationWork$1(conversation)) return true;
+	if (!conversation || !hasRunnableConversationWork(conversation)) return true;
 	return (await args.eventStore.query(args.conversationId, {
 		afterSeq: args.terminalSeq,
 		limit: 1,
@@ -3116,34 +3511,32 @@ function createAcpConversations(options) {
 		}
 	};
 }
-// src/api/acp/state.ts
-const MUTATION_LOCK_TTL_MS = 1e4;
-/** Run one ACP state mutation while its shared lock remains owned. */
-async function withLock(state, key, run, options = {}) {
-	const ttlMs = options.ttlMs ?? 1e4;
-	const startedAtMs = Date.now();
-	let lock;
-	while (true) {
-		lock = await state.acquireLock(key, ttlMs);
-		if (lock) break;
-		if (Date.now() - startedAtMs >= (options.waitMs ?? 0)) return { acquired: false };
-		await setTimeout$1(options.retryMs ?? 25, void 0, { ref: false });
-	}
-	const heartbeat = options.keepAlive ? setInterval(() => void state.extendLock(lock, ttlMs).catch(() => void 0), Math.floor(ttlMs / 3)) : void 0;
-	heartbeat?.unref();
-	try {
-		return {
-			acquired: true,
-			value: await run(lock)
-		};
-	} finally {
-		if (heartbeat) clearInterval(heartbeat);
-		await state.releaseLock(lock);
+// src/api/public-origin.ts
+/** Loopback hostnames, in the bracketed form that `URL.hostname` uses. */
+const LOOPBACK_HOSTNAMES = [
+	"localhost",
+	"127.0.0.1",
+	"[::1]"
+];
+/**
+* Resolve the public origin of this Junior app for browser sign-in and
+* protocol metadata. A configured origin always wins. The request origin is
+* used only on loopback, because a deployed request can carry any host.
+*/
+function resolvePublicOrigin(request, configured) {
+	const value = configured?.trim();
+	let origin;
+	if (value) origin = /^https?:\/\//.test(value) ? value : `https://${value}`;
+	else {
+		const requestURL = new URL(request.url);
+		if (!LOOPBACK_HOSTNAMES.includes(requestURL.hostname)) return void 0;
+		origin = requestURL.origin;
 	}
-}
-/** Prove ACP lock ownership immediately before a blind state write. */
-async function fenceLock(state, lock, ttlMs = MUTATION_LOCK_TTL_MS) {
-	if (!await state.extendLock(lock, ttlMs)) throw new Error(`ACP lock ownership was lost before write for ${lock.threadId}`);
+	const url = new URL(origin);
+	url.pathname = "/";
+	url.search = "";
+	url.hash = "";
+	return url;
 }
 // src/api/acp/schema.ts
 /** Validate the ACP wire messages that Junior supports. */
@@ -3859,11 +4252,11 @@ const ACP_AUTH_METHOD = {
 	name: "Sign in to Junior",
 	description: "Sign in with the Google account allowed by this Junior app."
 };
-function authorizationKey(transactionId) {
+function authorizationKey$1(transactionId) {
 	return `junior:acp:v1:authorization:${transactionId}`;
 }
 function authorizationLockKey(transactionId) {
-	return `${authorizationKey(transactionId)}:lock`;
+	return `${authorizationKey$1(transactionId)}:lock`;
 }
 function authorizationPointerKey(connectionId) {
 	return `junior:acp:v1:connection:${connectionId}:authorization`;
@@ -3923,27 +4316,12 @@ function hasAcpConnectionCredential(request, expectedHash) {
 }
 /** Resolve a trusted browser origin, with request fallback only on loopback. */
 function authorizationBaseURL(request, configured) {
-	const value = configured?.trim();
-	let origin;
-	if (value) origin = /^https?:\/\//.test(value) ? value : `https://${value}`;
-	else {
-		const requestURL = new URL(request.url);
-		const hostname = requestURL.hostname.replace(/^\[|\]$/g, "");
-		if (![
-			"localhost",
-			"127.0.0.1",
-			"::1"
-		].includes(hostname)) throw acp.RequestError.internalError(void 0, "Junior ACP sign-in requires a configured public base URL");
-		origin = requestURL.origin;
-	}
-	const url = new URL(origin);
-	url.pathname = "/";
-	url.search = "";
-	url.hash = "";
+	const url = resolvePublicOrigin(request, configured);
+	if (!url) throw acp.RequestError.internalError(void 0, "Junior ACP sign-in requires a configured public base URL");
 	return url;
 }
 async function readAuthorization(state, transactionId) {
-	const value = await state.get(authorizationKey(transactionId));
+	const value = await state.get(authorizationKey$1(transactionId));
 	return value === null || value === void 0 ? void 0 : acpAuthorizationSchema.parse(value);
 }
 async function readAuthorizationPointer(state, connectionId) {
@@ -3964,7 +4342,7 @@ async function deleteAuthorizationPointer(state, connectionId, transactionId) {
 /** Remove one completed transaction and its matching connection pointer. */
 async function deleteAuthorization(state, authorization, transactionId) {
 	await deleteAuthorizationPointer(state, authorization.connectionId, transactionId);
-	await state.delete(authorizationKey(transactionId));
+	await state.delete(authorizationKey$1(transactionId));
 }
 function completionReceipt(authorization, response) {
 	return {
@@ -4018,7 +4396,7 @@ async function beginAcpAuthorization(args) {
 			userCodeHash: userCodeHash(userCode)
 		});
 		await fenceLock(args.state, lock, MUTATION_LOCK_TTL_MS);
-		await args.state.set(authorizationKey(transactionId), authorization, ACP_STATE_TTL_MS);
+		await args.state.set(authorizationKey$1(transactionId), authorization, ACP_STATE_TTL_MS);
 		await fenceLock(args.state, lock, MUTATION_LOCK_TTL_MS);
 		await args.state.set(authorizationPointerKey(args.connectionId), {
 			expiresAtMs: authorization.expiresAtMs,
@@ -4608,12 +4986,1093 @@ function createAcpHttpHandler(options) {
 		}
 	};
 }
-// src/api/acp/authorization-page.ts
-const ACP_AUTHORIZATION_PATH = "/_junior/acp/auth/:transactionId";
-const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+// src/api/html.ts
+/** Escape text before it enters server-rendered HTML. */
 function escapeHtml(value) {
 	return value.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll("\"", "&quot;").replaceAll("'", "&#039;");
 }
+/** Return true when a browser request comes from its own URL origin. */
+function requestHasSameOrigin(request) {
+	const origin = request.headers.get("origin");
+	return origin !== null && URL.parse(origin)?.origin === new URL(request.url).origin;
+}
+/**
+* Render one sign-in page that browsers cannot frame or cache. `bodyHtml`
+* follows the heading, and the caller escapes every value in it.
+*/
+function renderHtmlPage(page) {
+	return new Response(`<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>${escapeHtml(page.title)}</title>
+</head>
+<body style="margin:0;background:#000;color:#fff;font-family:ui-sans-serif,system-ui,sans-serif">
+  <main style="min-height:100vh;display:grid;place-items:center;padding:2rem">
+    <section style="max-width:32rem;border-left:4px solid #a78bfa;padding-left:1rem">
+      <h1 style="margin:0 0 .75rem;font-size:2rem">${escapeHtml(page.title)}</h1>
+${page.bodyHtml}
+    </section>
+  </main>
+</body>
+</html>`, {
+		status: page.status,
+		headers: {
+			"cache-control": "no-store",
+			"content-type": "text/html; charset=utf-8",
+			"x-frame-options": "DENY",
+			...page.headers
+		}
+	});
+}
+// src/net/public-address.ts
+/**
+* Own the public-address rule for fetches of URLs that any person can submit.
+*
+* Such a fetch must not reach loopback, private, link-local, cloud metadata,
+* or other special addresses. The lookup checks every resolved address at
+* connect time, so a second DNS answer cannot move the request to a blocked
+* address.
+*/
+/** Special-use ranges from RFC 6890 and the IANA special-purpose registries. */
+const BLOCKED_SUBNETS = [
+	[
+		"0.0.0.0",
+		8,
+		"ipv4"
+	],
+	[
+		"10.0.0.0",
+		8,
+		"ipv4"
+	],
+	[
+		"100.64.0.0",
+		10,
+		"ipv4"
+	],
+	[
+		"127.0.0.0",
+		8,
+		"ipv4"
+	],
+	[
+		"169.254.0.0",
+		16,
+		"ipv4"
+	],
+	[
+		"172.16.0.0",
+		12,
+		"ipv4"
+	],
+	[
+		"192.0.0.0",
+		24,
+		"ipv4"
+	],
+	[
+		"192.0.2.0",
+		24,
+		"ipv4"
+	],
+	[
+		"192.168.0.0",
+		16,
+		"ipv4"
+	],
+	[
+		"198.18.0.0",
+		15,
+		"ipv4"
+	],
+	[
+		"198.51.100.0",
+		24,
+		"ipv4"
+	],
+	[
+		"203.0.113.0",
+		24,
+		"ipv4"
+	],
+	[
+		"224.0.0.0",
+		4,
+		"ipv4"
+	],
+	[
+		"240.0.0.0",
+		4,
+		"ipv4"
+	],
+	[
+		"::",
+		96,
+		"ipv6"
+	],
+	[
+		"64:ff9b::",
+		96,
+		"ipv6"
+	],
+	[
+		"64:ff9b:1::",
+		48,
+		"ipv6"
+	],
+	[
+		"100::",
+		64,
+		"ipv6"
+	],
+	[
+		"2001::",
+		32,
+		"ipv6"
+	],
+	[
+		"2001:db8::",
+		32,
+		"ipv6"
+	],
+	[
+		"2002::",
+		16,
+		"ipv6"
+	],
+	[
+		"fc00::",
+		7,
+		"ipv6"
+	],
+	[
+		"fe80::",
+		10,
+		"ipv6"
+	],
+	[
+		"fec0::",
+		10,
+		"ipv6"
+	],
+	[
+		"ff00::",
+		8,
+		"ipv6"
+	]
+];
+function blockedAddressList() {
+	const list = new net.BlockList();
+	for (const [network, prefix, family] of BLOCKED_SUBNETS) list.addSubnet(network, prefix, family);
+	return list;
+}
+const blockedAddresses = blockedAddressList();
+/** Return true only for an IP address outside every blocked range. */
+function isPublicAddress(address) {
+	const family = net.isIP(address);
+	if (family === 0) return false;
+	return !blockedAddresses.check(address, family === 4 ? "ipv4" : "ipv6");
+}
+function blockedAddressError(hostname) {
+	return Object.assign(/* @__PURE__ */ new Error(`${hostname} does not resolve to a public address`), { code: "EADDRNOTPUBLIC" });
+}
+/**
+* Resolve a hostname for an outbound socket. Fail when any answer is not a
+* public address.
+*/
+const publicAddressLookup = (hostname, options, callback) => {
+	dns.lookup(hostname, {
+		all: true,
+		verbatim: true
+	}, (error, addresses) => {
+		if (error) {
+			callback(error, "", 0);
+			return;
+		}
+		const allowed = addresses.filter((entry) => !options.family || entry.family === options.family || `IPv${entry.family}` === options.family);
+		const first = allowed[0];
+		if (!first || !addresses.every((entry) => isPublicAddress(entry.address))) {
+			callback(blockedAddressError(hostname), "", 0);
+			return;
+		}
+		if (options.all) {
+			callback(null, allowed);
+			return;
+		}
+		callback(null, first.address, first.family);
+	});
+};
+// src/api/mcp/oauth/state.ts
+/** Return the SHA-256 hex digest of a secret or unbounded value. */
+function sha256Hex(value) {
+	return createHash("sha256").update(value, "utf8").digest("hex");
+}
+/** Build one versioned MCP state key. */
+function mcpStateKey(kind, id) {
+	return `junior:mcp:v1:${kind}:${id}`;
+}
+/** Read and parse one MCP state record. A missing record reads as undefined. */
+async function readRecord(state, key, schema) {
+	const value = await state.get(key);
+	return value === null ? void 0 : schema.parse(value);
+}
+// src/api/mcp/oauth/client-metadata.ts
+/**
+* Own MCP OAuth clients. Junior accepts only Client ID Metadata Documents
+* (CIMD): the `client_id` is an HTTPS URL, and the document at that URL
+* names the client and its redirect URIs. Junior has no client registration.
+*/
+const CLIENT_ID_MAX_LENGTH = 2e3;
+const CLIENT_METADATA_MAX_BYTES = 5120;
+const CLIENT_METADATA_TIMEOUT_MS = 5e3;
+const CLIENT_METADATA_CACHE_TTL_MS = 3e5;
+const INVALID_CLIENT_CACHE_TTL_MS = 6e4;
+const clientMetadataDocumentSchema = z.object({
+	client_id: z.string(),
+	client_name: z.string().trim().min(1).max(200).optional(),
+	redirect_uris: z.array(z.string().max(CLIENT_ID_MAX_LENGTH)).min(1).max(20),
+	token_endpoint_auth_method: z.literal("none").optional()
+});
+const mcpClientSchema = z.object({
+	clientId: z.string().min(1),
+	name: z.string().min(1).optional(),
+	redirectUris: z.array(z.string()).min(1)
+}).strict();
+const invalidClientSchema = z.object({ invalid: z.literal(true) }).strict();
+const cachedClientSchema = z.union([mcpClientSchema, invalidClientSchema]);
+/**
+* Parse a CIMD client ID. It must be a canonical `https:` URL with a path,
+* no fragment, no credentials, and no loopback or private IP host.
+*/
+function parseClientId(value) {
+	if (value.length > CLIENT_ID_MAX_LENGTH || value.includes("#")) return;
+	const url = URL.parse(value);
+	if (!url) return void 0;
+	const hostname = url.hostname.replace(/^\[|\]$/g, "");
+	if (url.href !== value || url.protocol !== "https:" || url.pathname === "/" || url.username || url.password || hostname === "localhost" || hostname.endsWith(".localhost") || net.isIP(hostname) !== 0 && !isPublicAddress(hostname)) return;
+	return url;
+}
+/**
+* Fetch one client metadata document. Redirects, non-200 responses, slow or
+* large responses, blocked addresses, and invalid JSON all give `undefined`,
+* because each one only means that the client is invalid.
+*/
+function fetchClientMetadataDocument(url) {
+	return new Promise((resolve) => {
+		const request = https.request(url, {
+			headers: { accept: "application/json" },
+			agent: false,
+			lookup: publicAddressLookup,
+			method: "GET",
+			signal: AbortSignal.timeout(CLIENT_METADATA_TIMEOUT_MS)
+		}, (response) => {
+			if (response.statusCode !== 200) {
+				request.destroy();
+				resolve(void 0);
+				return;
+			}
+			const chunks = [];
+			let size = 0;
+			response.on("data", (chunk) => {
+				size += chunk.length;
+				if (size > CLIENT_METADATA_MAX_BYTES) {
+					request.destroy();
+					resolve(void 0);
+					return;
+				}
+				chunks.push(chunk);
+			});
+			response.on("end", () => {
+				try {
+					resolve(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+				} catch {
+					resolve(void 0);
+				}
+			});
+			response.on("error", () => resolve(void 0));
+		});
+		request.on("error", () => resolve(void 0));
+		request.end();
+	});
+}
+/**
+* Resolve a client from its CIMD URL. Return `undefined` when the client ID or
+* its document is invalid. Valid documents are cached for 5 minutes, and
+* failed fetches for 1 minute.
+*/
+async function resolveMcpClient(state, clientId) {
+	const url = parseClientId(clientId);
+	if (!url) return void 0;
+	const key = mcpStateKey("client", sha256Hex(clientId));
+	const cached = await readRecord(state, key, cachedClientSchema);
+	if (cached) return "invalid" in cached ? void 0 : cached;
+	const parsed = clientMetadataDocumentSchema.safeParse(await fetchClientMetadataDocument(url));
+	if (!parsed.success || parsed.data.client_id !== clientId) {
+		await state.set(key, { invalid: true }, INVALID_CLIENT_CACHE_TTL_MS);
+		return;
+	}
+	const client = {
+		clientId,
+		name: parsed.data.client_name,
+		redirectUris: parsed.data.redirect_uris
+	};
+	await state.set(key, client, CLIENT_METADATA_CACHE_TTL_MS);
+	return client;
+}
+function isLoopbackHttp(url) {
+	return url.protocol === "http:" && LOOPBACK_HOSTNAMES.includes(url.hostname);
+}
+/**
+* Return true when a requested redirect URI is allowed for a client. The URI
+* must be `https:` or loopback `http:`, and must equal a registered URI. A
+* loopback URI may use any port (RFC 8252 section 7.3), because native
+* clients such as Claude Code listen on a random port.
+*/
+function redirectUriMatches(registered, requested) {
+	const url = URL.parse(requested);
+	if (!url || requested.includes("#") || url.protocol !== "https:" && !isLoopbackHttp(url)) return false;
+	return registered.some((entry) => {
+		if (entry === requested) return true;
+		if (!isLoopbackHttp(url)) return false;
+		const candidate = URL.parse(entry);
+		return candidate !== null && isLoopbackHttp(candidate) && candidate.hostname === url.hostname && candidate.pathname === url.pathname && candidate.search === url.search;
+	});
+}
+// src/api/mcp/oauth/metadata.ts
+/**
+* Own the MCP OAuth paths, scope, and discovery documents.
+*
+* Every URL comes from the trusted public origin of the app. The documents
+* advertise Client ID Metadata Documents and no client registration endpoint.
+*/
+const MCP_PATH = "/api/mcp";
+const MCP_SCOPE = "conversations:read";
+const MCP_RESOURCE_METADATA_PATH = "/.well-known/oauth-protected-resource/api/mcp";
+const MCP_AUTHORIZATION_SERVER_METADATA_PATH = "/.well-known/oauth-authorization-server";
+const MCP_AUTHORIZE_PATH = "/api/mcp/oauth/authorize";
+const MCP_TOKEN_PATH = "/api/mcp/oauth/token";
+/** Dashboard-authenticated consent page for one pending authorization. */
+const MCP_CONSENT_PATH = "/_junior/mcp/authorize/:authorizationId";
+/** Resolve the MCP URLs for this request from the trusted public origin. */
+function resolveMcpUrls(request, baseURL) {
+	const origin = resolvePublicOrigin(request, baseURL);
+	if (!origin) throw new Error("Junior MCP requires a configured public base URL");
+	const url = (path) => new URL(path, origin).toString();
+	return {
+		authorize: url(MCP_AUTHORIZE_PATH),
+		issuer: origin.origin,
+		resource: url(MCP_PATH),
+		resourceMetadata: url(MCP_RESOURCE_METADATA_PATH),
+		token: url(MCP_TOKEN_PATH),
+		consent: (authorizationId) => url(MCP_CONSENT_PATH.replace(":authorizationId", encodeURIComponent(authorizationId)))
+	};
+}
+/** RFC 9728 protected resource metadata for `/api/mcp`. */
+function protectedResourceMetadata(urls) {
+	return {
+		resource: urls.resource,
+		authorization_servers: [urls.issuer],
+		bearer_methods_supported: ["header"],
+		scopes_supported: [MCP_SCOPE]
+	};
+}
+/** RFC 8414 authorization server metadata. CIMD is the only client model. */
+function authorizationServerMetadata(urls) {
+	return {
+		issuer: urls.issuer,
+		authorization_endpoint: urls.authorize,
+		token_endpoint: urls.token,
+		scopes_supported: [MCP_SCOPE],
+		response_types_supported: ["code"],
+		grant_types_supported: ["authorization_code", "refresh_token"],
+		code_challenge_methods_supported: ["S256"],
+		token_endpoint_auth_methods_supported: ["none"],
+		authorization_response_iss_parameter_supported: true,
+		client_id_metadata_document_supported: true
+	};
+}
+// src/api/mcp/oauth/page.ts
+/** Render one MCP sign-in page. It sends no referrer and loads no resources. */
+function renderMcpPage(page) {
+	const formAction = ["'self'", ...page.formOrigin ? [page.formOrigin] : []];
+	const message = `      <p style="margin:0 0 1rem;color:#b8b8b8;line-height:1.5">${escapeHtml(page.message)}</p>`;
+	return renderHtmlPage({
+		bodyHtml: page.bodyHtml ? `${message}\n${page.bodyHtml}` : message,
+		headers: {
+			"content-security-policy": `default-src 'none'; style-src 'unsafe-inline'; frame-ancestors 'none'; form-action ${formAction.join(" ")}`,
+			"referrer-policy": "no-referrer"
+		},
+		status: page.status,
+		title: page.title
+	});
+}
+// src/api/mcp/oauth/authorization.ts
+/**
+* Own the OAuth authorization endpoint and its pending requests.
+*
+* The endpoint checks the client and redirect URI first. When either one is
+* invalid, it shows an error page and never redirects, so an attacker cannot
+* use Junior as an open redirect. Other errors go back to the client as OAuth
+* error redirects. A valid request waits for consent on a dashboard page.
+*/
+const AUTHORIZATION_TTL_MS = 6e5;
+const STATE_MAX_LENGTH = 1e3;
+const AUTHORIZATION_ID_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+const CODE_CHALLENGE_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+const mcpAuthorizationSchema = z.object({
+	clientId: z.string().min(1),
+	clientName: z.string().min(1).optional(),
+	codeChallenge: z.string().regex(CODE_CHALLENGE_PATTERN),
+	/** Fixed end of the request. Opening the consent page does not move it. */
+	expiresAtMs: z.number().int().positive(),
+	redirectUri: z.string().min(1),
+	resource: z.string().min(1),
+	scope: z.literal(MCP_SCOPE),
+	state: z.string().max(STATE_MAX_LENGTH).optional()
+}).strict();
+/** The user who owns one consent page, and the hash of its form token. */
+const mcpConsentSchema = z.object({
+	csrfHash: z.string().length(64),
+	userId: z.string().min(1)
+}).strict();
+function authorizationKey(authorizationId) {
+	return mcpStateKey("authorization", authorizationId);
+}
+function consentKey(authorizationId) {
+	return `${authorizationKey(authorizationId)}:consent`;
+}
+function claimedKey(authorizationId) {
+	return `${authorizationKey(authorizationId)}:claimed`;
+}
+/**
+* Read one pending authorization and its consent binding. Malformed ids,
+* ended requests, and claimed requests read as missing.
+*/
+async function readMcpAuthorization(state, authorizationId) {
+	if (!AUTHORIZATION_ID_PATTERN.test(authorizationId)) return void 0;
+	const authorization = await readRecord(state, authorizationKey(authorizationId), mcpAuthorizationSchema);
+	if (!authorization || authorization.expiresAtMs <= Date.now()) return;
+	if (await state.get(claimedKey(authorizationId)) !== null) return void 0;
+	return {
+		authorization,
+		consent: await readRecord(state, consentKey(authorizationId), mcpConsentSchema)
+	};
+}
+/**
+* Bind a pending authorization to the first user who opens its consent page,
+* and return a new form token for that user. Return `undefined` when another
+* user owns it. Only the bound user can approve, so a page that an attacker
+* opened cannot be submitted for a victim. The binding never extends the
+* request, and a claimed request stays claimed.
+*/
+async function bindMcpConsent(args) {
+	const ttlMs = args.authorization.expiresAtMs - Date.now();
+	if (ttlMs <= 0) return void 0;
+	const csrfToken = randomBytes(32).toString("base64url");
+	const consent = {
+		csrfHash: sha256Hex(csrfToken),
+		userId: args.userId
+	};
+	const key = consentKey(args.authorizationId);
+	if (await args.state.setIfNotExists(key, consent, ttlMs)) return csrfToken;
+	if ((await readRecord(args.state, key, mcpConsentSchema))?.userId !== args.userId) return void 0;
+	await args.state.set(key, consent, ttlMs);
+	return csrfToken;
+}
+/**
+* Claim a pending authorization for one consent decision. Only one caller
+* can claim it, so one consent cannot issue two codes.
+*/
+async function claimMcpAuthorization(state, authorizationId) {
+	const claimed = await state.setIfNotExists(claimedKey(authorizationId), true, AUTHORIZATION_TTL_MS);
+	if (claimed) {
+		await state.delete(authorizationKey(authorizationId));
+		await state.delete(consentKey(authorizationId));
+	}
+	return claimed;
+}
+/** Build the client redirect for an OAuth authorization response. */
+function authorizationRedirect(args) {
+	const url = new URL(args.redirectUri);
+	for (const [name, value] of Object.entries(args.params)) url.searchParams.set(name, value);
+	if (args.state !== void 0) url.searchParams.set("state", args.state);
+	url.searchParams.set("iss", args.issuer);
+	return new Response(null, {
+		status: 303,
+		headers: {
+			"cache-control": "no-store",
+			location: url.toString()
+		}
+	});
+}
+function invalidClientPage(message) {
+	return renderMcpPage({
+		message,
+		status: 400,
+		title: "This app cannot connect"
+	});
+}
+/** Handle `GET /api/mcp/oauth/authorize` and hand off to the consent page. */
+async function handleMcpAuthorize(args) {
+	const params = new URL(args.request.url).searchParams;
+	const clientId = params.get("client_id") ?? "";
+	const redirectUri = params.get("redirect_uri") ?? "";
+	const client = await resolveMcpClient(args.state, clientId);
+	if (!client) return invalidClientPage("The client ID is not a valid client metadata document URL.");
+	if (!redirectUriMatches(client.redirectUris, redirectUri)) return invalidClientPage("The redirect URI is not registered by this client.");
+	const oauthState = params.get("state") ?? void 0;
+	const fail = (error, description) => authorizationRedirect({
+		issuer: args.urls.issuer,
+		params: {
+			error,
+			error_description: description
+		},
+		redirectUri,
+		state: oauthState
+	});
+	if (params.get("response_type") !== "code") return fail("unsupported_response_type", "Use response_type=code.");
+	const codeChallenge = params.get("code_challenge") ?? "";
+	if (params.get("code_challenge_method") !== "S256" || !CODE_CHALLENGE_PATTERN.test(codeChallenge)) return fail("invalid_request", "PKCE with S256 is required.");
+	if (oauthState !== void 0 && oauthState.length > STATE_MAX_LENGTH) return fail("invalid_request", "The state parameter is too long.");
+	const scope = params.get("scope")?.trim();
+	if (scope && scope !== "conversations:read") return fail("invalid_scope", `The only scope is ${MCP_SCOPE}.`);
+	if (params.get("resource") !== args.urls.resource) return fail("invalid_target", `The resource must be ${args.urls.resource}.`);
+	const authorizationId = randomBytes(32).toString("base64url");
+	const authorization = {
+		clientId: client.clientId,
+		clientName: client.name,
+		codeChallenge,
+		expiresAtMs: Date.now() + AUTHORIZATION_TTL_MS,
+		redirectUri,
+		resource: args.urls.resource,
+		scope: MCP_SCOPE,
+		state: oauthState
+	};
+	await args.state.set(authorizationKey(authorizationId), authorization, AUTHORIZATION_TTL_MS);
+	return new Response(null, {
+		status: 302,
+		headers: {
+			"cache-control": "no-store",
+			location: args.urls.consent(authorizationId)
+		}
+	});
+}
+// src/api/mcp/oauth/grants.ts
+/**
+* Own MCP OAuth grants: authorization codes, access tokens, and refresh
+* tokens. Every secret is random, opaque, and stored only as a SHA-256 hash
+* in shared state with a TTL. A grant ends `GRANT_MAX_AGE_MS` after consent,
+* and refresh does not extend it.
+*/
+const CODE_TTL_MS = 6e4;
+const ACCESS_TOKEN_TTL_MS = 36e5;
+const GRANT_MAX_AGE_MS = 2592e6;
+const REFRESH_REUSE_GRACE_MS = 6e4;
+const ACCESS_TOKEN_PREFIX = "jr_mcp_at_";
+const REFRESH_TOKEN_PREFIX = "jr_mcp_rt_";
+const CODE_VERIFIER_PATTERN = /^[A-Za-z0-9._~-]{43,128}$/;
+const authorizationCodeSchema = z.object({
+	clientId: z.string().min(1),
+	codeChallenge: z.string().min(1),
+	/** Verified email of the user who approved consent. */
+	email: z.string().min(1),
+	/** Grant that this code creates. Reuse of the code revokes it. */
+	grantId: z.string().uuid(),
+	redirectUri: z.string().min(1),
+	resource: z.string().min(1),
+	scope: z.literal(MCP_SCOPE)
+}).strict();
+const grantSchema = z.object({
+	clientId: z.string().min(1),
+	email: z.string().min(1),
+	/** Absolute end of the grant. Refresh never moves it. */
+	expiresAtMs: z.number().int().positive(),
+	resource: z.string().min(1),
+	scope: z.literal(MCP_SCOPE)
+}).strict();
+const tokenSchema = z.object({ grantId: z.string().uuid() }).strict();
+function codeKey(code) {
+	return mcpStateKey("code", sha256Hex(code));
+}
+function grantKey(grantId) {
+	return mcpStateKey("grant", grantId);
+}
+function revokedGrantKey(grantId) {
+	return `${grantKey(grantId)}:revoked`;
+}
+function accessTokenKey(token) {
+	return mcpStateKey("access", sha256Hex(token));
+}
+function refreshTokenKey(token) {
+	return mcpStateKey("refresh", sha256Hex(token));
+}
+function invalidGrant(description) {
+	return {
+		description,
+		error: "invalid_grant",
+		ok: false
+	};
+}
+/** Issue a single-use authorization code for one approved consent. */
+async function issueAuthorizationCode(args) {
+	const code = randomBytes(32).toString("base64url");
+	const record = {
+		clientId: args.clientId,
+		codeChallenge: args.codeChallenge,
+		email: args.email,
+		grantId: randomUUID(),
+		redirectUri: args.redirectUri,
+		resource: args.resource,
+		scope: MCP_SCOPE
+	};
+	await args.state.set(codeKey(code), record, CODE_TTL_MS);
+	return code;
+}
+/**
+* Revoke a grant after a reused code or refresh token. The marker lives for
+* `GRANT_MAX_AGE_MS`, and no grant or token lives longer, so a racing request
+* that saves the grant again cannot bring it back.
+*/
+async function revokeGrant(args) {
+	await args.state.set(revokedGrantKey(args.grantId), true, GRANT_MAX_AGE_MS);
+	await args.state.delete(grantKey(args.grantId));
+	logWarn("mcp.oauth.grant.revoked", {
+		"app.mcp.client_id": args.clientId,
+		"app.mcp.revoke_reason": args.reason
+	});
+}
+/** Read a grant that is not revoked and has not ended. */
+async function readGrant(state, grantId) {
+	if (await state.get(revokedGrantKey(grantId)) !== null) return void 0;
+	const grant = await readRecord(state, grantKey(grantId), grantSchema);
+	return grant && grant.expiresAtMs > Date.now() ? grant : void 0;
+}
+/** Return true when the RFC 7636 S256 verifier matches the challenge. */
+function verifierMatches(verifier, challenge) {
+	return CODE_VERIFIER_PATTERN.test(verifier) && createHash("sha256").update(verifier).digest("base64url") === challenge;
+}
+/**
+* Save a grant and issue a new access and refresh token pair for it. No
+* record outlives the grant.
+*/
+async function issueTokens(state, grantId, grant) {
+	const grantTtlMs = grant.expiresAtMs - Date.now();
+	if (grantTtlMs <= 0) return invalidGrant("The grant has expired.");
+	const accessTtlMs = Math.min(ACCESS_TOKEN_TTL_MS, grantTtlMs);
+	const accessToken = `${ACCESS_TOKEN_PREFIX}${randomBytes(32).toString("base64url")}`;
+	const refreshToken = `${REFRESH_TOKEN_PREFIX}${randomBytes(32).toString("base64url")}`;
+	await state.set(grantKey(grantId), grant, grantTtlMs);
+	await state.set(accessTokenKey(accessToken), { grantId }, accessTtlMs);
+	await state.set(refreshTokenKey(refreshToken), { grantId }, grantTtlMs);
+	return {
+		ok: true,
+		tokens: {
+			access_token: accessToken,
+			expires_in: Math.floor(accessTtlMs / 1e3),
+			refresh_token: refreshToken,
+			scope: grant.scope,
+			token_type: "Bearer"
+		}
+	};
+}
+/**
+* Exchange one authorization code for tokens. The code stays stored until it
+* expires. A second valid use of the code revokes the grant that the first
+* use created (RFC 6749 section 4.1.2).
+*/
+async function exchangeAuthorizationCode(args) {
+	const key = codeKey(args.code);
+	const code = await readRecord(args.state, key, authorizationCodeSchema);
+	if (!code || code.clientId !== args.clientId || code.redirectUri !== args.redirectUri || args.resource !== void 0 && args.resource !== code.resource || !verifierMatches(args.codeVerifier, code.codeChallenge)) return invalidGrant("The authorization code is not valid.");
+	if (!await args.state.setIfNotExists(`${key}:used`, true, CODE_TTL_MS)) {
+		await revokeGrant({
+			clientId: code.clientId,
+			grantId: code.grantId,
+			reason: "authorization_code_reused",
+			state: args.state
+		});
+		return invalidGrant("The authorization code was already used.");
+	}
+	return await issueTokens(args.state, code.grantId, {
+		clientId: code.clientId,
+		email: code.email,
+		expiresAtMs: Date.now() + GRANT_MAX_AGE_MS,
+		resource: code.resource,
+		scope: code.scope
+	});
+}
+/**
+* Rotate a refresh token. Each refresh token works once. A second use of a
+* rotated token within `REFRESH_REUSE_GRACE_MS` fails. A later second use
+* revokes the whole grant, so a stolen token stops working for both the
+* thief and the client.
+*/
+async function refreshGrant(args) {
+	if (!args.refreshToken.startsWith(REFRESH_TOKEN_PREFIX)) return invalidGrant("The refresh token is not valid.");
+	const key = refreshTokenKey(args.refreshToken);
+	const token = await readRecord(args.state, key, tokenSchema);
+	const grant = token ? await readGrant(args.state, token.grantId) : void 0;
+	if (!token || !grant || grant.clientId !== args.clientId || args.resource !== void 0 && args.resource !== grant.resource) return invalidGrant("The refresh token is not valid.");
+	if (args.scope !== void 0 && args.scope !== grant.scope) return {
+		description: `The only scope is ${MCP_SCOPE}.`,
+		error: "invalid_scope",
+		ok: false
+	};
+	const usedKey = `${key}:used`;
+	if (!await args.state.setIfNotExists(usedKey, Date.now(), grant.expiresAtMs - Date.now())) {
+		const usedAtMs = await readRecord(args.state, usedKey, z.number());
+		if (usedAtMs !== void 0 && Date.now() - usedAtMs < REFRESH_REUSE_GRACE_MS) return invalidGrant("The refresh token was already rotated.");
+		await revokeGrant({
+			clientId: grant.clientId,
+			grantId: token.grantId,
+			reason: "refresh_token_reused",
+			state: args.state
+		});
+		return invalidGrant("The refresh token was already used.");
+	}
+	return await issueTokens(args.state, token.grantId, grant);
+}
+/**
+* Return the user email of one MCP access token for one resource. Personal
+* tokens and other bearer values never match, because only this module
+* stores MCP access tokens.
+*/
+async function authenticateMcpAccessToken(args) {
+	if (!args.token.startsWith(ACCESS_TOKEN_PREFIX)) return void 0;
+	const token = await readRecord(args.state, accessTokenKey(args.token), tokenSchema);
+	if (!token) return void 0;
+	const grant = await readGrant(args.state, token.grantId);
+	if (!grant || grant.resource !== args.resource) return void 0;
+	return grant.email;
+}
+// src/api/mcp/oauth/consent-page.ts
+/**
+* Own the dashboard-authenticated MCP consent page.
+*
+* The dashboard verifies Google sign-in before it calls this page. A POST must
+* come from the same origin and carry the form token issued to the same user
+* on GET. Approve and deny each end the pending authorization.
+*/
+function expiredPage() {
+	return renderMcpPage({
+		message: "Return to your MCP client and connect again.",
+		status: 410,
+		title: "This sign-in request expired"
+	});
+}
+function blockedPage() {
+	return renderMcpPage({
+		message: "Return to your MCP client and connect again.",
+		status: 403,
+		title: "Request blocked"
+	});
+}
+function consentPage(args) {
+	const clientHost = new URL(args.authorization.clientId).host;
+	const clientName = args.authorization.clientName ?? clientHost;
+	const button = (action, label, primary) => `<button type="submit" name="action" value="${action}" style="border:0;border-radius:.375rem;cursor:pointer;font:inherit;font-weight:700;padding:.625rem 1rem;margin-right:.5rem;${primary ? "background:#a78bfa;color:#000" : "background:#333;color:#fff"}">${label}</button>`;
+	return renderMcpPage({
+		bodyHtml: `      <p style="margin:0 0 1rem;color:#b8b8b8;line-height:1.5">The app is published at <strong style="color:#fff">${escapeHtml(clientHost)}</strong>. It can list your ${escapeHtml(args.agentName)} conversations.</p>
+      <form method="post">
+        <input type="hidden" name="csrf" value="${escapeHtml(args.csrfToken)}">
+        ${button("approve", "Allow", true)}${button("deny", "Deny", false)}
+      </form>`,
+		formOrigin: new URL(args.authorization.redirectUri).origin,
+		message: `${clientName} wants to connect to ${args.agentName}. Only continue if you started this connection.`,
+		status: 200,
+		title: `Connect ${clientName}`
+	});
+}
+function csrfMatches(value, expectedHash) {
+	const actual = Buffer.from(sha256Hex(value), "hex");
+	const expected = Buffer.from(expectedHash, "hex");
+	return actual.length === expected.length && timingSafeEqual(actual, expected);
+}
+async function readForm(request) {
+	try {
+		const form = await request.formData();
+		const action = form.get("action");
+		const csrf = form.get("csrf");
+		return {
+			action: typeof action === "string" ? action : void 0,
+			csrf: typeof csrf === "string" ? csrf : void 0
+		};
+	} catch {
+		return {};
+	}
+}
+/** Show or complete MCP consent for one dashboard-authenticated user. */
+async function handleMcpConsentPage(args) {
+	const authorizationId = new URL(args.request.url).pathname.split("/").at(-1) ?? "";
+	const pending = await readMcpAuthorization(args.state, authorizationId);
+	if (!pending) return expiredPage();
+	const { authorization, consent } = pending;
+	if (args.request.method === "GET") {
+		const csrfToken = await bindMcpConsent({
+			authorization,
+			authorizationId,
+			state: args.state,
+			userId: args.user.id
+		});
+		if (!csrfToken) return blockedPage();
+		return consentPage({
+			agentName: args.agentName,
+			authorization,
+			csrfToken
+		});
+	}
+	const form = await readForm(args.request);
+	if (!requestHasSameOrigin(args.request) || consent?.userId !== args.user.id || !form.csrf || !csrfMatches(form.csrf, consent.csrfHash) || form.action !== "approve" && form.action !== "deny") return blockedPage();
+	if (!await claimMcpAuthorization(args.state, authorizationId)) return expiredPage();
+	const { issuer } = resolveMcpUrls(args.request, args.baseURL);
+	if (form.action === "deny") return authorizationRedirect({
+		issuer,
+		params: {
+			error: "access_denied",
+			error_description: "The user denied access."
+		},
+		redirectUri: authorization.redirectUri,
+		state: authorization.state
+	});
+	return authorizationRedirect({
+		issuer,
+		params: { code: await issueAuthorizationCode({
+			clientId: authorization.clientId,
+			codeChallenge: authorization.codeChallenge,
+			email: args.user.email,
+			redirectUri: authorization.redirectUri,
+			resource: authorization.resource,
+			state: args.state
+		}) },
+		redirectUri: authorization.redirectUri,
+		state: authorization.state
+	});
+}
+// src/api/mcp/tools/list-conversations.ts
+/** MCP view of one Conversation. It omits dashboard-only fields. */
+const mcpConversationSchema = z.object({
+	conversationId: z.string(),
+	title: z.string(),
+	status: conversationReportStatusSchema,
+	surface: conversationSurfaceSchema,
+	channelName: z.string().optional(),
+	locationUrl: z.string().optional(),
+	startedAt: z.string(),
+	lastSeenAt: z.string(),
+	archivedAt: z.string().optional(),
+	url: z.string().optional()
+}).strict();
+function mcpConversation(summary) {
+	return {
+		conversationId: summary.conversationId,
+		title: summary.displayTitle,
+		status: summary.status,
+		surface: summary.surface,
+		channelName: summary.channelNameRedacted ? void 0 : summary.channelName,
+		locationUrl: summary.locationUrl,
+		startedAt: summary.startedAt,
+		lastSeenAt: summary.lastSeenAt,
+		archivedAt: summary.archivedAt ?? void 0,
+		url: getDashboardConversationLink(summary.conversationId)
+	};
+}
+/** Register `listConversations`, which lists the Conversations of `user`. */
+function registerListConversationsTool(server, user) {
+	const feedQuery = conversationFeedQuerySchema.shape;
+	server.registerTool("listConversations", {
+		title: "List conversations",
+		description: "List up to 50 of your conversations, newest activity first. Only conversations that you started or take part in are listed.",
+		inputSchema: {
+			q: feedQuery.q.describe("Text to search for in titles and Briefs."),
+			status: feedQuery.status.describe("List conversations that you have not archived (default) or that you archived. A search ignores this filter.")
+		},
+		outputSchema: { conversations: z.array(mcpConversationSchema) },
+		annotations: {
+			readOnlyHint: true,
+			openWorldHint: false
+		}
+	}, async ({ q, status }) => {
+		const result = { conversations: (await readConversationFeed({
+			q,
+			status,
+			viewer: user
+		})).conversations.map(mcpConversation) };
+		return {
+			content: [{
+				type: "text",
+				text: JSON.stringify(result)
+			}],
+			structuredContent: result
+		};
+	});
+}
+// src/api/mcp/server.ts
+/**
+* Own the MCP server behind `/api/mcp`. Each tool lives in its own file under
+* `tools/`.
+*
+* Each request gets a new server and a stateless transport that answers with
+* JSON. No MCP session or SSE stream outlives the request, so the route works
+* on any app instance and is not limited by the live-stream duration.
+*/
+/** Build the MCP server for one authenticated user. */
+function createMcpServer(user) {
+	const server = new McpServer({
+		name: "junior",
+		version: JUNIOR_VERSION
+	});
+	registerListConversationsTool(server, user);
+	return server;
+}
+/** Answer one Streamable HTTP POST for an authenticated user. */
+async function handleMcpServerRequest(request, user) {
+	const server = createMcpServer(user);
+	const transport = new WebStandardStreamableHTTPServerTransport({
+		enableJsonResponse: true,
+		sessionIdGenerator: void 0
+	});
+	await server.connect(transport);
+	try {
+		return await transport.handleRequest(request);
+	} finally {
+		await server.close();
+	}
+}
+// src/api/mcp/oauth/token.ts
+/**
+* Own the OAuth token endpoint. It accepts public clients only, so a request
+* names its `client_id` and carries no client secret. Every response uses
+* `Cache-Control: no-store`.
+*/
+const TOKEN_HEADERS = {
+	"cache-control": "no-store",
+	pragma: "no-cache"
+};
+function tokenError(error, description, status = 400) {
+	return Response.json({
+		error,
+		error_description: description
+	}, {
+		status,
+		headers: TOKEN_HEADERS
+	});
+}
+/** Limit token request bodies. A token request is a few short form fields. */
+const mcpTokenBodyLimit = bodyLimit({
+	maxSize: 8192,
+	onError: () => tokenError("invalid_request", "The request body is too large.", 413)
+});
+function tokenResponse(result) {
+	return result.ok ? Response.json(result.tokens, { headers: TOKEN_HEADERS }) : tokenError(result.error, result.description);
+}
+/** Handle `POST /api/mcp/oauth/token` for code exchange and refresh. */
+async function handleMcpToken(args) {
+	if (!(args.request.headers.get("content-type") ?? "").startsWith("application/x-www-form-urlencoded")) return tokenError("invalid_request", "Send a form-encoded body.");
+	const form = new URLSearchParams(await args.request.text());
+	const value = (name) => form.get(name) ?? void 0;
+	const clientId = value("client_id");
+	if (!clientId) return tokenError("invalid_request", "The client_id is required.");
+	switch (value("grant_type")) {
+		case "authorization_code": {
+			const code = value("code");
+			const codeVerifier = value("code_verifier");
+			const redirectUri = value("redirect_uri");
+			if (!code || !codeVerifier || !redirectUri) return tokenError("invalid_request", "The code, code_verifier, and redirect_uri are required.");
+			return tokenResponse(await exchangeAuthorizationCode({
+				clientId,
+				code,
+				codeVerifier,
+				redirectUri,
+				resource: value("resource"),
+				state: args.state
+			}));
+		}
+		case "refresh_token": {
+			const refreshToken = value("refresh_token");
+			if (!refreshToken) return tokenError("invalid_request", "The refresh_token is required.");
+			return tokenResponse(await refreshGrant({
+				clientId,
+				refreshToken,
+				resource: value("resource"),
+				scope: value("scope"),
+				state: args.state
+			}));
+		}
+		default: return tokenError("unsupported_grant_type", "Use authorization_code or refresh_token.");
+	}
+}
+// src/api/mcp/route.ts
+/**
+* Own the remote MCP HTTP edge: discovery metadata, OAuth endpoints, and the
+* Streamable HTTP route at `/api/mcp`.
+*/
+/** Host paths that the app forwards to the MCP handler. */
+const MCP_ROUTE_PATHS = [
+	MCP_PATH,
+	MCP_RESOURCE_METADATA_PATH,
+	MCP_AUTHORIZATION_SERVER_METADATA_PATH,
+	MCP_AUTHORIZE_PATH,
+	MCP_TOKEN_PATH
+];
+/**
+* Return the RFC 6750 challenge that points clients to resource metadata.
+* A request that sent a token also gets `invalid_token`.
+*/
+function unauthorized(urls, sentToken) {
+	return new Response(null, {
+		status: 401,
+		headers: {
+			"cache-control": "no-store",
+			"www-authenticate": `Bearer ${sentToken ? "error=\"invalid_token\", " : ""}resource_metadata="${urls.resourceMetadata}", scope="${MCP_SCOPE}"`
+		}
+	});
+}
+function bearerToken(request) {
+	return (request.headers.get("authorization")?.match(/^Bearer\s+(\S+)$/i))?.[1];
+}
+/** Create the fetch handler for every path in `MCP_ROUTE_PATHS`. */
+function createMcpHttpHandler(options) {
+	const app = new Hono();
+	const urls = (request) => resolveMcpUrls(request, options.baseURL);
+	app.get(MCP_RESOURCE_METADATA_PATH, (c) => Response.json(protectedResourceMetadata(urls(c.req.raw))));
+	app.get(MCP_AUTHORIZATION_SERVER_METADATA_PATH, (c) => Response.json(authorizationServerMetadata(urls(c.req.raw))));
+	app.get(MCP_AUTHORIZE_PATH, (c) => handleMcpAuthorize({
+		request: c.req.raw,
+		state: options.state,
+		urls: urls(c.req.raw)
+	}));
+	app.post(MCP_TOKEN_PATH, mcpTokenBodyLimit, (c) => handleMcpToken({
+		request: c.req.raw,
+		state: options.state
+	}));
+	app.on([
+		"GET",
+		"POST",
+		"DELETE"
+	], MCP_PATH, async (c) => {
+		const requestUrls = urls(c.req.raw);
+		const token = bearerToken(c.req.raw);
+		const email = token ? await authenticateMcpAccessToken({
+			resource: requestUrls.resource,
+			state: options.state,
+			token
+		}) : void 0;
+		const user = email && isAllowedSignInEmail(email, options.allowedDomains) ? await resolveViewerUser(email) : void 0;
+		if (!user) return unauthorized(requestUrls, token !== void 0);
+		if (c.req.method !== "POST") return new Response(null, {
+			status: 405,
+			headers: { allow: "POST" }
+		});
+		return await handleMcpServerRequest(c.req.raw, user);
+	});
+	return app.fetch;
+}
+// src/api/acp/authorization-page.ts
+const ACP_AUTHORIZATION_PATH = "/_junior/acp/auth/:transactionId";
+const ACP_PAGE_HEADERS = { "content-security-policy": "frame-ancestors 'none'; form-action 'self'" };
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function renderResult(agentName, result) {
 	const content = {
 		blocked: {
@@ -4647,66 +6106,24 @@ function renderResult(agentName, result) {
 			message: "Return to your ACP client and enter the code shown there."
 		}
 	}[result];
-	return new Response(`<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="utf-8" />
-  <meta name="viewport" content="width=device-width, initial-scale=1" />
-  <title>${escapeHtml(content.title)}</title>
-</head>
-<body style="margin:0;background:#000;color:#fff;font-family:ui-sans-serif,system-ui,sans-serif">
-  <main style="min-height:100vh;display:grid;place-items:center;padding:2rem">
-    <section style="max-width:32rem;border-left:4px solid #a78bfa;padding-left:1rem">
-      <h1 style="margin:0 0 .75rem;font-size:2rem">${escapeHtml(content.title)}</h1>
-      <p style="margin:0;color:#b8b8b8;line-height:1.5">${escapeHtml(content.message)}</p>
-    </section>
-  </main>
-</body>
-</html>`, {
+	return renderHtmlPage({
+		bodyHtml: `      <p style="margin:0;color:#b8b8b8;line-height:1.5">${escapeHtml(content.message)}</p>`,
+		headers: ACP_PAGE_HEADERS,
 		status: content.status,
-		headers: {
-			"cache-control": "no-store",
-			"content-security-policy": "frame-ancestors 'none'; form-action 'self'",
-			"content-type": "text/html; charset=utf-8",
-			"x-frame-options": "DENY"
-		}
+		title: content.title
 	});
 }
 function renderConfirmation(agentName) {
-	return new Response(`<!DOCTYPE html>
-<html lang="en">
-<head>
-  <meta charset="utf-8" />
-  <meta name="viewport" content="width=device-width, initial-scale=1" />
-  <title>Connect ${escapeHtml(agentName)}</title>
-</head>
-<body style="margin:0;background:#000;color:#fff;font-family:ui-sans-serif,system-ui,sans-serif">
-  <main style="min-height:100vh;display:grid;place-items:center;padding:2rem">
-    <section style="max-width:32rem;border-left:4px solid #a78bfa;padding-left:1rem">
-      <h1 style="margin:0 0 .75rem;font-size:2rem">Connect ${escapeHtml(agentName)}</h1>
-      <p style="margin:0 0 1rem;color:#b8b8b8;line-height:1.5">Only continue if you started sign-in from your ACP client. Enter the verification code shown by the client.</p>
+	return renderHtmlPage({
+		bodyHtml: `      <p style="margin:0 0 1rem;color:#b8b8b8;line-height:1.5">Only continue if you started sign-in from your ACP client. Enter the verification code shown by the client.</p>
       <form method="post">
         <label style="display:block;margin:0 0 1rem">Verification code<br><input name="code" required autocomplete="one-time-code" inputmode="text" style="box-sizing:border-box;margin-top:.5rem;padding:.625rem;width:100%"></label>
         <button type="submit" style="border:0;border-radius:.375rem;background:#a78bfa;color:#000;cursor:pointer;font:inherit;font-weight:700;padding:.625rem 1rem">Connect</button>
-      </form>
-    </section>
-  </main>
-</body>
-</html>`, { headers: {
-		"cache-control": "no-store",
-		"content-security-policy": "frame-ancestors 'none'; form-action 'self'",
-		"content-type": "text/html; charset=utf-8",
-		"x-frame-options": "DENY"
-	} });
-}
-function requestHasSameOrigin(request) {
-	const origin = request.headers.get("origin");
-	if (!origin) return false;
-	try {
-		return new URL(origin).origin === new URL(request.url).origin;
-	} catch {
-		return false;
-	}
+      </form>`,
+		headers: ACP_PAGE_HEADERS,
+		status: 200,
+		title: `Connect ${agentName}`
+	});
 }
 function transactionIdFromRequest(request) {
 	const transactionId = new URL(request.url).pathname.split("/").at(-1);
@@ -4894,6 +6311,16 @@ function createSignInAuth(config) {
 }
 // src/dashboard-routes.ts
 const DASHBOARD_PACKAGE_NAME = "@sentry/junior-dashboard";
+/**
+* Return true when the dashboard requires Google sign-in. Core passes this
+* value to the dashboard app, so features that need a signed-in user use the
+* same rule as the dashboard.
+*/
+function dashboardRequiresSignIn(dashboard) {
+	if (!dashboard || dashboard.disabled) return false;
+	if (dashboard.authRequired !== void 0) return dashboard.authRequired;
+	return process.env.JUNIOR_DASHBOARD_AUTH_REQUIRED?.trim() !== "false";
+}
 /** Mount the dashboard app on the dashboard-owned host paths. */
 async function createDashboardRouteRegistrations(args) {
 	if (!args.dashboard || args.dashboard.disabled) return [];
@@ -4951,6 +6378,7 @@ function dashboardHostRoutePaths(dashboard, authenticatedRoutes = []) {
 		`${conversationsPath}/*`,
 		pagePath("locations"),
 		`${pagePath("locations")}/*`,
+		pagePath("review"),
 		peoplePath,
 		`${peoplePath}/*`,
 		pagePath("automations"),
@@ -4984,6 +6412,8 @@ function dashboardHostRoutePaths(dashboard, authenticatedRoutes = []) {
 		"/api/plugin-reports",
 		"/api/user-pages",
 		"/api/user-pages/*",
+		"/api/user-customization",
+		"/api/user-customization/*",
 		"/api/automations",
 		"/api/automations/*",
 		"/api/skills",
@@ -4998,6 +6428,8 @@ function dashboardHostRoutePaths(dashboard, authenticatedRoutes = []) {
 		"/api/locations/*",
 		"/api/people",
 		"/api/people/*",
+		"/api/review-items",
+		"/api/review-items/*",
 		"/api/personal-tokens",
 		"/api/personal-tokens/*",
 		"/api/service-accounts",
@@ -5051,6 +6483,7 @@ function dashboardRouteRegistrations(args) {
 			...args.dashboard,
 			agentName: botConfig.userName,
 			allowedDomains: args.allowedDomains,
+			authRequired: dashboardRequiresSignIn(args.dashboard),
 			...args.auth ? { auth: args.auth } : void 0,
 			authenticatedRoutes: args.authenticatedRoutes,
 			conversationWorkQueue: args.conversationWorkQueue,
@@ -5065,14 +6498,17 @@ function dashboardRouteRegistrations(args) {
 		path
 	}));
 }
-/** Reject plugin routes that would shadow dashboard or auth paths. */
+/**
+* Reject plugin routes that would shadow dashboard or auth paths, or other
+* core routes that need the dashboard, such as the MCP routes.
+*/
 function validateDashboardRouteOwnership(args) {
 	if (!args.dashboard || args.dashboard.disabled) return;
-	for (const route of args.routes) if (dashboardOwnedRoutePath(route.path, args.dashboard, args.authenticatedRoutes)) throw new Error(`Plugin "${route.pluginName}" route "${route.path}" conflicts with core dashboard routes`);
+	for (const route of args.routes) if (dashboardOwnedRoutePath(route.path, args.dashboard, args.authenticatedRoutes) || (args.coreRoutePaths ?? []).some((path) => routePatternOverlaps(path, route.path))) throw new Error(`Plugin "${route.pluginName}" route "${route.path}" conflicts with core dashboard routes`);
 }
 // src/app.ts
-/** Resolve the public deployment URL used by ACP browser authorization. */
-function resolveAcpBaseURL(dashboard) {
+/** Resolve the public deployment URL used by ACP and MCP browser authorization. */
+function resolvePublicBaseURL(dashboard) {
 	const configured = dashboard?.baseURL?.trim() || process.env.JUNIOR_BASE_URL?.trim();
 	if (configured) return configured;
 	const vercelURL = process.env.VERCEL_PROJECT_PRODUCTION_URL?.trim() || process.env.VERCEL_URL?.trim();
@@ -5150,6 +6586,23 @@ function mountRoutes(app, routes) {
 		else if (explicitMethods.length > 0) app.on(explicitMethods, route.path, handler);
 	}
 }
+async function startQueueWorker(consumers, backgroundWork) {
+	const provider = getQueueProvider();
+	if (!provider.startWorker) throw new Error(`The ${provider.messagingSystem} queue provider has no queue worker`);
+	const worker = await provider.startWorker(consumers);
+	return { close: async () => {
+		try {
+			await worker.close();
+		} finally {
+			while (backgroundWork.size > 0) await Promise.allSettled(backgroundWork);
+			try {
+				await disconnectStateAdapter();
+			} finally {
+				await closeDb();
+			}
+		}
+	} };
+}
 /** Create a Hono app with all Junior routes. */
 async function createApp(options) {
 	const virtualConfig = await resolveVirtualConfig();
@@ -5235,6 +6688,7 @@ async function createApp(options) {
 		sandbox: { tracePropagation },
 		visionContext: { attachmentStorage }
 	};
+	const backgroundWork = /* @__PURE__ */ new Set();
 	let conversationWorkOptions;
 	const getConversationWorkOptions = () => {
 		conversationWorkOptions ??= options?.conversationWork ?? createProductionConversationWorkOptions({
@@ -5242,7 +6696,11 @@ async function createApp(options) {
 			queue: conversationWorkQueue,
 			...pluginTaskQueue ? { sendPluginTask: (message) => pluginTaskQueue.send(message) } : void 0,
 			services: runtimeServiceOverrides,
-			waitUntil: (task) => waitUntil(task)
+			waitUntil: (task) => {
+				backgroundWork.add(task);
+				task.finally(() => backgroundWork.delete(task)).catch(() => void 0);
+				waitUntil(task);
+			}
 		});
 		return conversationWorkOptions;
 	};
@@ -5254,7 +6712,7 @@ async function createApp(options) {
 		const state = work.state ?? getStateAdapter();
 		acpRuntime = {
 			handleRequest: createAcpHttpHandler({
-				...dashboard && !dashboard.disabled ? { browserAuth: { baseURL: resolveAcpBaseURL(dashboard) } } : void 0,
+				...dashboard && !dashboard.disabled ? { browserAuth: { baseURL: resolvePublicBaseURL(dashboard) } } : void 0,
 				conversations: createAcpConversations({
 					conversationStore: work.conversationStore,
 					eventStore: getConversationEventStore(),
@@ -5272,6 +6730,19 @@ async function createApp(options) {
 		};
 		return acpRuntime;
 	};
+	const mcpEnabled = dashboardRequiresSignIn(dashboard);
+	const getMcpState = () => options?.conversationWork?.state ?? getStateAdapter();
+	const mcpConsentRoute = {
+		handler: (request, user) => handleMcpConsentPage({
+			agentName: botConfig.userName,
+			baseURL: resolvePublicBaseURL(dashboard),
+			request,
+			state: getMcpState(),
+			user
+		}),
+		method: ["GET", "POST"],
+		path: MCP_CONSENT_PATH
+	};
 	const authenticatedRoutes = dashboard && !dashboard.disabled ? [{
 		handler: (request, user) => handleAcpAuthorizationPage({
 			agentName: botConfig.userName,
@@ -5281,10 +6752,11 @@ async function createApp(options) {
 		}),
 		method: ["GET", "POST"],
 		path: ACP_AUTHORIZATION_PATH
-	}] : [];
+	}, ...mcpEnabled ? [mcpConsentRoute] : []] : [];
 	try {
 		validateDashboardRouteOwnership({
 			authenticatedRoutes,
+			coreRoutePaths: mcpEnabled ? MCP_ROUTE_PATHS : [],
 			dashboard,
 			routes: pluginRoutes
 		});
@@ -5314,6 +6786,21 @@ async function createApp(options) {
 		"POST",
 		"DELETE"
 	], "/api/acp", (c) => getAcpRuntime().handleRequest(c.req.raw));
+	if (mcpEnabled) {
+		let handleMcpRequest;
+		app.on([
+			"GET",
+			"POST",
+			"DELETE"
+		], MCP_ROUTE_PATHS, (c) => {
+			handleMcpRequest ??= createMcpHttpHandler({
+				allowedDomains,
+				baseURL: resolvePublicBaseURL(dashboard),
+				state: getMcpState()
+			});
+			return handleMcpRequest(c.req.raw);
+		});
+	}
 	mountRoutes(app, pluginRoutes);
 	mountRoutes(app, await createDashboardRouteRegistrations({
 		allowedDomains,
@@ -5380,6 +6867,10 @@ async function createApp(options) {
 	app.post("/api/webhooks/:platform", (c) => {
 		return new Response(`Unknown platform: ${c.req.param("platform")}`, { status: 404 });
 	});
-	return app;
+	return Object.assign(app, { startQueueWorker: () => startQueueWorker([
+		conversationWorkQueueConsumer(getConversationWorkOptions()),
+		pluginTaskQueueConsumer(),
+		workspaceSnapshotJobQueueConsumer()
+	], backgroundWork) });
 }
 export { JUNIOR_VERSION, createApp, defineJuniorPlugins };