@sentry/junior 0.267.0 → 0.268.0

package/dist/{viewer-DrN3oC2X.js → viewer-CpXTGlep.js}

@@ -1,9 +1,9 @@
 import { t as __exportAll } from "./rolldown-runtime-nwUcYXjP.js";
-import { i as getChatConfig } from "./config-CdB6yJj5.js";
-import { L as GOOGLE_IDENTITY_PROVIDER, z as normalizeIdentityEmail } from "./logging-DuZ1A4ab.js";
-import { c as toStoredSlackActor, d as parseSlackTeamId, o as parseActorUserId, u as parseSlackChannelReferenceId } from "./actor-DZSokpwj.js";
-import { c as juniorIdentities, d as juniorDestinations, l as juniorUsers, o as conversationReadColumns, s as juniorConversations } from "./agent-invocations-CxKldAeB.js";
-import { _ as juniorConversationAnnotations, d as juniorConversationBindings, h as juniorConversationEvents, m as juniorConversationMetrics, p as CONVERSATION_METRICS, t as createJuniorSqlExecutor, u as juniorConversationParticipants } from "./executor-VYrx_K4w.js";
+import { i as getChatConfig } from "./config-DrTeF80T.js";
+import { L as GOOGLE_IDENTITY_PROVIDER, z as normalizeIdentityEmail } from "./logging-DLSpkSSr.js";
+import { a as isSlackUserId, d as parseSlackChannelReferenceId, f as parseSlackTeamId, s as parseActorUserId } from "./actor-CP9K2Idu.js";
+import { c as juniorIdentities, d as juniorDestinations, l as juniorUsers, o as conversationReadColumns, s as juniorConversations } from "./agent-invocations-C1RNOCs8.js";
+import { _ as CONVERSATION_METRICS, h as juniorConversationBindings, m as juniorConversationParticipants, t as createJuniorSqlExecutor, v as juniorConversationMetrics, x as juniorConversationAnnotations, y as juniorConversationEvents } from "./executor-4vhvsMZJ.js";
 import { c as newConversationEventSchema, h as usageSchema, l as encodeHistoryPayload, o as decodeStoredConversationEvent, r as conversationEventDataSchema, s as historyReplacementSchema } from "./history-C84mlAwO.js";
 import { randomUUID } from "node:crypto";
 import { and, asc, desc, eq, gt, gte, inArray, isNull, lt, lte, ne, or, sql } from "drizzle-orm";
@@ -37,161 +37,6 @@ function sameDestination(left, right) {
 	if (left.platform === "slack" && right.platform === "slack") return left.teamId === right.teamId && left.channelId === right.channelId;
 	return false;
 }
-// src/chat/identities/sql.ts
-function dateFromMs$1(ms) {
-	return new Date(ms);
-}
-function tenantId$1(value) {
-	return value ?? "";
-}
-async function upsertUser(executor, args) {
-	const id = (await executor.db().insert(juniorUsers).values({
-		id: randomUUID(),
-		primaryEmail: args.email,
-		primaryEmailNormalized: args.emailNormalized,
-		displayName: args.displayName ?? null,
-		createdAt: dateFromMs$1(args.nowMs),
-		updatedAt: dateFromMs$1(args.nowMs)
-	}).onConflictDoUpdate({
-		target: juniorUsers.primaryEmailNormalized,
-		set: {
-			displayName: sql`coalesce(${juniorUsers.displayName}, excluded.display_name)`,
-			updatedAt: sql`excluded.updated_at`
-		}
-	}).returning({ id: juniorUsers.id }))[0]?.id;
-	if (!id) throw new Error("User identity upsert returned no row");
-	return id;
-}
-async function existingIdentity(executor, identity) {
-	return (await executor.db().select().from(juniorIdentities).where(and(eq(juniorIdentities.provider, identity.provider), eq(juniorIdentities.providerTenantId, tenantId$1(identity.providerTenantId)), eq(juniorIdentities.providerSubjectId, identity.providerSubjectId))))[0];
-}
-async function upsertIdentityRecord(executor, identity, linkedUserId, nowMs) {
-	const emailNormalized = normalizeIdentityEmail(identity.email);
-	const email = emailNormalized ? identity.email?.trim() || emailNormalized : void 0;
-	const existing = await existingIdentity(executor, identity);
-	const userEmailNormalized = existing?.emailVerified && existing.emailNormalized ? existing.emailNormalized : identity.emailVerified ? emailNormalized : void 0;
-	const userEmail = existing?.emailVerified && existing.email ? existing.email : email ?? userEmailNormalized;
-	const verifiedUserId = identity.kind === "user" && userEmailNormalized ? await upsertUser(executor, {
-		email: userEmail ?? userEmailNormalized,
-		emailNormalized: userEmailNormalized,
-		nowMs,
-		...existing?.displayName || identity.displayName ? { displayName: existing?.displayName ?? identity.displayName } : void 0
-	}) : void 0;
-	if (existing?.userId && verifiedUserId && existing.userId !== verifiedUserId) throw new Error("Identity verified email conflicts with linked user");
-	if (linkedUserId && verifiedUserId && linkedUserId !== verifiedUserId) throw new Error("Linked identity conflicts with verified email user");
-	if (existing?.userId && linkedUserId && existing.userId !== linkedUserId) throw new Error("Identity conflicts with linked user");
-	const userId = existing?.userId ?? linkedUserId ?? verifiedUserId;
-	const row = (await executor.db().insert(juniorIdentities).values({
-		id: randomUUID(),
-		userId: userId ?? null,
-		kind: identity.kind,
-		provider: identity.provider,
-		providerTenantId: tenantId$1(identity.providerTenantId),
-		providerSubjectId: identity.providerSubjectId,
-		displayName: identity.displayName ?? null,
-		handle: identity.handle ?? null,
-		email: email ?? null,
-		emailNormalized: emailNormalized ?? null,
-		emailVerified: Boolean(identity.emailVerified && emailNormalized),
-		avatarUrl: null,
-		metadata: identity.metadata ?? null,
-		createdAt: dateFromMs$1(nowMs),
-		updatedAt: dateFromMs$1(nowMs)
-	}).onConflictDoUpdate({
-		target: [
-			juniorIdentities.provider,
-			juniorIdentities.providerTenantId,
-			juniorIdentities.providerSubjectId
-		],
-		set: {
-			kind: sql`excluded.kind`,
-			userId: sql`coalesce(${juniorIdentities.userId}, excluded.user_id)`,
-			displayName: linkedUserId ? sql`coalesce(excluded.display_name, ${juniorIdentities.displayName})` : sql`coalesce(${juniorIdentities.displayName}, excluded.display_name)`,
-			handle: linkedUserId ? sql`coalesce(excluded.handle, ${juniorIdentities.handle})` : sql`coalesce(${juniorIdentities.handle}, excluded.handle)`,
-			email: sql`case when ${juniorIdentities.emailVerified} then coalesce(${juniorIdentities.email}, excluded.email) when excluded.email_verified then excluded.email else coalesce(${juniorIdentities.email}, excluded.email) end`,
-			emailNormalized: sql`case when ${juniorIdentities.emailVerified} then coalesce(${juniorIdentities.emailNormalized}, excluded.email_normalized) when excluded.email_verified then excluded.email_normalized else coalesce(${juniorIdentities.emailNormalized}, excluded.email_normalized) end`,
-			emailVerified: sql`${juniorIdentities.emailVerified} OR excluded.email_verified`,
-			avatarUrl: sql`coalesce(${juniorIdentities.avatarUrl}, excluded.avatar_url)`,
-			metadata: sql`coalesce(${juniorIdentities.metadata}, excluded.metadata_json)`,
-			updatedAt: sql`excluded.updated_at`
-		},
-		...linkedUserId ? { setWhere: sql`${juniorIdentities.userId} IS NULL OR ${juniorIdentities.userId} = excluded.user_id` } : void 0
-	}).returning({
-		id: juniorIdentities.id,
-		userId: juniorIdentities.userId
-	}))[0];
-	if (!row) {
-		if (linkedUserId) throw new Error("Identity conflicts with linked user");
-		throw new Error("Identity upsert returned no row");
-	}
-	return {
-		id: row.id,
-		...row.userId ? { userId: row.userId } : void 0
-	};
-}
-/** Read the saved timezone for one user. */
-async function readUserTimezone(db, userId) {
-	return (await db.select({ timezone: juniorUsers.timezone }).from(juniorUsers).where(eq(juniorUsers.id, userId)).limit(1))[0]?.timezone ?? void 0;
-}
-/** Save the IANA timezone for one user. */
-async function saveUserTimezone(db, userId, timezone, nowMs) {
-	await db.update(juniorUsers).set({
-		timezone,
-		updatedAt: dateFromMs$1(nowMs)
-	}).where(and(eq(juniorUsers.id, userId), sql`${juniorUsers.timezone} is distinct from ${timezone}`));
-}
-/** Persist one provider identity observation and link verified emails to users. */
-async function upsertIdentity(executor, identity, nowMs = Date.now()) {
-	return await upsertIdentityRecord(executor, identity, void 0, nowMs);
-}
-/**
-* Persist one provider identity after a trusted account-linking flow.
-* Callers must use provider-verified account data, such as GitHub's authenticated
-* user response, never identity claims inferred from content such as Git commits.
-*/
-async function upsertLinkedIdentity(executor, userId, identity, nowMs = Date.now()) {
-	return await upsertIdentityRecord(executor, identity, userId, nowMs);
-}
-/**
-* Find the one user whose primary email is in a provider-verified email list.
-* Return undefined when no user or more than one user matches.
-*/
-async function findUserByVerifiedEmails(executor, emails) {
-	const normalized = new Set(emails.map((email) => normalizeIdentityEmail(email) ?? ""));
-	normalized.delete("");
-	if (normalized.size === 0) return void 0;
-	const rows = await executor.db().select({
-		email: juniorUsers.primaryEmail,
-		userId: juniorUsers.id
-	}).from(juniorUsers).where(inArray(juniorUsers.primaryEmailNormalized, Array.from(normalized))).limit(2);
-	return rows.length === 1 ? rows[0] : void 0;
-}
-/** Remove one exact provider identity owned by a workspace Slack user. */
-async function deleteProviderIdentityForSlackUser(executor, slackTeamId, slackUserId, provider, providerSubjectId) {
-	const userId = (await executor.db().select({ userId: juniorIdentities.userId }).from(juniorIdentities).where(and(eq(juniorIdentities.kind, "user"), eq(juniorIdentities.provider, "slack"), eq(juniorIdentities.providerTenantId, slackTeamId), eq(juniorIdentities.providerSubjectId, slackUserId))).limit(1))[0]?.userId;
-	if (!userId) return;
-	await deleteProviderIdentityForUser(executor, userId, provider, providerSubjectId);
-}
-/** Remove one exact provider identity owned by a user. */
-async function deleteProviderIdentityForUser(executor, userId, provider, providerSubjectId) {
-	await executor.db().delete(juniorIdentities).where(and(eq(juniorIdentities.userId, userId), eq(juniorIdentities.provider, provider), eq(juniorIdentities.providerTenantId, ""), eq(juniorIdentities.providerSubjectId, providerSubjectId)));
-}
-/**
-* Save one Google sign-in. Link the Google identity to the user of its
-* verified email, and set its sign-in time.
-*/
-async function recordGoogleSignIn(executor, account, nowMs = Date.now()) {
-	const stored = await upsertIdentity(executor, {
-		kind: "user",
-		provider: GOOGLE_IDENTITY_PROVIDER,
-		providerSubjectId: account.subject,
-		email: account.email,
-		emailVerified: true,
-		displayName: account.displayName
-	}, nowMs);
-	await executor.db().update(juniorIdentities).set({ signedInAt: dateFromMs$1(nowMs) }).where(eq(juniorIdentities.id, stored.id));
-	return stored;
-}
 // src/chat/conversations/sql/participants.ts
 /** Resolve the root conversation id that owns personal-feed membership. */
 async function resolveRootConversationId(executor, conversationId) {
@@ -339,6 +184,38 @@ function conversationMetricValues(args) {
 		cost_usd: agentTurnCostUsd(usage)
 	};
 }
+/**
+* Read one Run's stored totals from its metric rows.
+*
+* Returns undefined when the Run has no rows. Cost keeps only its total.
+*/
+async function readConversationRunMetrics(executor, args) {
+	const rows = await executor.db().select({
+		metric: juniorConversationMetrics.metric,
+		value: juniorConversationMetrics.value
+	}).from(juniorConversationMetrics).where(and(eq(juniorConversationMetrics.conversationId, args.conversationId), eq(juniorConversationMetrics.runId, args.runId)));
+	const values = new Map(rows.map((row) => [row.metric, row.value]));
+	const durationMs = values.get("duration_ms");
+	if (durationMs === void 0) return void 0;
+	const components = {
+		inputTokens: values.get("input_tokens"),
+		outputTokens: values.get("output_tokens"),
+		cachedInputTokens: values.get("cached_input_tokens"),
+		cacheCreationTokens: values.get("cache_creation_tokens")
+	};
+	const hasComponents = Object.values(components).some((value) => value !== void 0);
+	const costUsd = values.get("cost_usd");
+	const usage = Object.fromEntries(Object.entries({
+		...components,
+		reasoningTokens: values.get("reasoning_tokens"),
+		totalTokens: hasComponents ? void 0 : values.get("total_tokens"),
+		cost: costUsd === void 0 ? void 0 : { total: costUsd }
+	}).filter(([, value]) => value !== void 0));
+	return {
+		durationMs,
+		...Object.keys(usage).length > 0 ? { usage } : void 0
+	};
+}
 /** Replace one Run's metric rows and refresh its Conversation totals. */
 async function replaceConversationMetrics(executor, args) {
 	const [current] = await executor.db().select({ updatedAt: juniorConversationMetrics.updatedAt }).from(juniorConversationMetrics).where(and(eq(juniorConversationMetrics.conversationId, args.conversationId), eq(juniorConversationMetrics.runId, args.runId))).limit(1);
@@ -448,44 +325,260 @@ async function bindProviderConversation(executor, args) {
 		createdAt: /* @__PURE__ */ new Date()
 	}).onConflictDoNothing().returning({ conversationId: juniorConversationBindings.conversationId }))[0]?.conversationId ?? await getConversationIdByProviderConversation(executor, args)) !== args.conversationId) throw new Error("Provider conversation is already bound to another conversation");
 }
+// src/chat/identities/sql.ts
+function dateFromMs$1(ms) {
+	return new Date(ms);
+}
+function tenantId$1(value) {
+	return value ?? "";
+}
+async function upsertUser(executor, args) {
+	const id = (await executor.db().insert(juniorUsers).values({
+		id: randomUUID(),
+		primaryEmail: args.email,
+		primaryEmailNormalized: args.emailNormalized,
+		displayName: args.displayName ?? null,
+		createdAt: dateFromMs$1(args.nowMs),
+		updatedAt: dateFromMs$1(args.nowMs)
+	}).onConflictDoUpdate({
+		target: juniorUsers.primaryEmailNormalized,
+		set: {
+			displayName: sql`coalesce(${juniorUsers.displayName}, excluded.display_name)`,
+			updatedAt: sql`excluded.updated_at`
+		}
+	}).returning({ id: juniorUsers.id }))[0]?.id;
+	if (!id) throw new Error("User identity upsert returned no row");
+	return id;
+}
+async function existingIdentity(executor, identity) {
+	return (await executor.db().select().from(juniorIdentities).where(and(eq(juniorIdentities.provider, identity.provider), eq(juniorIdentities.providerTenantId, tenantId$1(identity.providerTenantId)), eq(juniorIdentities.providerSubjectId, identity.providerSubjectId))))[0];
+}
+async function upsertIdentityRecord(executor, identity, linkedUserId, nowMs) {
+	const emailNormalized = normalizeIdentityEmail(identity.email);
+	const email = emailNormalized ? identity.email?.trim() || emailNormalized : void 0;
+	const existing = await existingIdentity(executor, identity);
+	const userEmailNormalized = existing?.emailVerified && existing.emailNormalized ? existing.emailNormalized : identity.emailVerified ? emailNormalized : void 0;
+	const userEmail = existing?.emailVerified && existing.email ? existing.email : email ?? userEmailNormalized;
+	const verifiedUserId = identity.kind === "user" && userEmailNormalized ? await upsertUser(executor, {
+		email: userEmail ?? userEmailNormalized,
+		emailNormalized: userEmailNormalized,
+		nowMs,
+		...existing?.displayName || identity.displayName ? { displayName: existing?.displayName ?? identity.displayName } : void 0
+	}) : void 0;
+	if (existing?.userId && verifiedUserId && existing.userId !== verifiedUserId) throw new Error("Identity verified email conflicts with linked user");
+	if (linkedUserId && verifiedUserId && linkedUserId !== verifiedUserId) throw new Error("Linked identity conflicts with verified email user");
+	if (existing?.userId && linkedUserId && existing.userId !== linkedUserId) throw new Error("Identity conflicts with linked user");
+	const userId = existing?.userId ?? linkedUserId ?? verifiedUserId;
+	const row = (await executor.db().insert(juniorIdentities).values({
+		id: randomUUID(),
+		userId: userId ?? null,
+		kind: identity.kind,
+		provider: identity.provider,
+		providerTenantId: tenantId$1(identity.providerTenantId),
+		providerSubjectId: identity.providerSubjectId,
+		displayName: identity.displayName ?? null,
+		handle: identity.handle ?? null,
+		email: email ?? null,
+		emailNormalized: emailNormalized ?? null,
+		emailVerified: Boolean(identity.emailVerified && emailNormalized),
+		avatarUrl: null,
+		metadata: identity.metadata ?? null,
+		createdAt: dateFromMs$1(nowMs),
+		updatedAt: dateFromMs$1(nowMs)
+	}).onConflictDoUpdate({
+		target: [
+			juniorIdentities.provider,
+			juniorIdentities.providerTenantId,
+			juniorIdentities.providerSubjectId
+		],
+		set: {
+			kind: sql`excluded.kind`,
+			userId: sql`coalesce(${juniorIdentities.userId}, excluded.user_id)`,
+			displayName: linkedUserId ? sql`coalesce(excluded.display_name, ${juniorIdentities.displayName})` : sql`coalesce(${juniorIdentities.displayName}, excluded.display_name)`,
+			handle: linkedUserId ? sql`coalesce(excluded.handle, ${juniorIdentities.handle})` : sql`coalesce(${juniorIdentities.handle}, excluded.handle)`,
+			email: sql`case when ${juniorIdentities.emailVerified} then coalesce(${juniorIdentities.email}, excluded.email) when excluded.email_verified then excluded.email else coalesce(${juniorIdentities.email}, excluded.email) end`,
+			emailNormalized: sql`case when ${juniorIdentities.emailVerified} then coalesce(${juniorIdentities.emailNormalized}, excluded.email_normalized) when excluded.email_verified then excluded.email_normalized else coalesce(${juniorIdentities.emailNormalized}, excluded.email_normalized) end`,
+			emailVerified: sql`${juniorIdentities.emailVerified} OR excluded.email_verified`,
+			avatarUrl: sql`coalesce(${juniorIdentities.avatarUrl}, excluded.avatar_url)`,
+			metadata: sql`coalesce(${juniorIdentities.metadata}, excluded.metadata_json)`,
+			updatedAt: sql`excluded.updated_at`
+		},
+		...linkedUserId ? { setWhere: sql`${juniorIdentities.userId} IS NULL OR ${juniorIdentities.userId} = excluded.user_id` } : void 0
+	}).returning({
+		id: juniorIdentities.id,
+		userId: juniorIdentities.userId
+	}))[0];
+	if (!row) {
+		if (linkedUserId) throw new Error("Identity conflicts with linked user");
+		throw new Error("Identity upsert returned no row");
+	}
+	return {
+		id: row.id,
+		...row.userId ? { userId: row.userId } : void 0
+	};
+}
+/** Read the saved timezone for one user. */
+async function readUserTimezone(db, userId) {
+	return (await db.select({ timezone: juniorUsers.timezone }).from(juniorUsers).where(eq(juniorUsers.id, userId)).limit(1))[0]?.timezone ?? void 0;
+}
+/** Save the IANA timezone for one user. */
+async function saveUserTimezone(db, userId, timezone, nowMs) {
+	await db.update(juniorUsers).set({
+		timezone,
+		updatedAt: dateFromMs$1(nowMs)
+	}).where(and(eq(juniorUsers.id, userId), sql`${juniorUsers.timezone} is distinct from ${timezone}`));
+}
+/** Persist one provider identity observation and link verified emails to users. */
+async function upsertIdentity(executor, identity, nowMs = Date.now()) {
+	return await upsertIdentityRecord(executor, identity, void 0, nowMs);
+}
+/**
+* Persist one provider identity after a trusted account-linking flow.
+* Callers must use provider-verified account data, such as GitHub's authenticated
+* user response, never identity claims inferred from content such as Git commits.
+*/
+async function upsertLinkedIdentity(executor, userId, identity, nowMs = Date.now()) {
+	return await upsertIdentityRecord(executor, identity, userId, nowMs);
+}
+/**
+* Find the one user whose primary email is in a provider-verified email list.
+* Return undefined when no user or more than one user matches.
+*/
+async function findUserByVerifiedEmails(executor, emails) {
+	const normalized = new Set(emails.map((email) => normalizeIdentityEmail(email) ?? ""));
+	normalized.delete("");
+	if (normalized.size === 0) return void 0;
+	const rows = await executor.db().select({
+		email: juniorUsers.primaryEmail,
+		userId: juniorUsers.id
+	}).from(juniorUsers).where(inArray(juniorUsers.primaryEmailNormalized, Array.from(normalized))).limit(2);
+	return rows.length === 1 ? rows[0] : void 0;
+}
+/** Remove one exact provider identity owned by a workspace Slack user. */
+async function deleteProviderIdentityForSlackUser(executor, slackTeamId, slackUserId, provider, providerSubjectId) {
+	const userId = (await executor.db().select({ userId: juniorIdentities.userId }).from(juniorIdentities).where(and(eq(juniorIdentities.kind, "user"), eq(juniorIdentities.provider, "slack"), eq(juniorIdentities.providerTenantId, slackTeamId), eq(juniorIdentities.providerSubjectId, slackUserId))).limit(1))[0]?.userId;
+	if (!userId) return;
+	await deleteProviderIdentityForUser(executor, userId, provider, providerSubjectId);
+}
+/** Remove one exact provider identity owned by a user. */
+async function deleteProviderIdentityForUser(executor, userId, provider, providerSubjectId) {
+	await executor.db().delete(juniorIdentities).where(and(eq(juniorIdentities.userId, userId), eq(juniorIdentities.provider, provider), eq(juniorIdentities.providerTenantId, ""), eq(juniorIdentities.providerSubjectId, providerSubjectId)));
+}
+/**
+* Save one Google sign-in. Link the Google identity to the user of its
+* verified email, and set its sign-in time.
+*/
+async function recordGoogleSignIn(executor, account, nowMs = Date.now()) {
+	const stored = await upsertIdentity(executor, {
+		kind: "user",
+		provider: GOOGLE_IDENTITY_PROVIDER,
+		providerSubjectId: account.subject,
+		email: account.email,
+		emailVerified: true,
+		displayName: account.displayName
+	}, nowMs);
+	await executor.db().update(juniorIdentities).set({ signedInAt: dateFromMs$1(nowMs) }).where(eq(juniorIdentities.id, stored.id));
+	return stored;
+}
+// src/chat/identities/actor.ts
+/**
+* Resolve runtime Actors to the Identity rows that Junior stores for them.
+*
+* The Conversation store, OAuth, the viewer, and message events use this
+* module, so they agree on one Identity per person. The key for each Actor
+* stays private here, so it can change without changing callers.
+*/
+/** The one Identity for work that Junior does on its own. */
+const SYSTEM_IDENTITY = {
+	kind: "system",
+	provider: "junior",
+	providerSubjectId: "system",
+	displayName: "System"
+};
+/**
+* Return the Identity key for one Actor.
+*
+* Every SystemActor uses the one system Identity. `SystemActor.name` is
+* provenance, not part of the key. A LocalActor uses the system Identity too,
+* because the local runner has no per-person user id.
+*/
+function identityKey(actor) {
+	switch (actor.platform) {
+		case "slack": return {
+			kind: "user",
+			provider: "slack",
+			providerTenantId: actor.teamId,
+			providerSubjectId: actor.userId,
+			...actor.fullName ? { displayName: actor.fullName } : void 0,
+			...actor.userName ? { handle: actor.userName } : void 0,
+			...actor.email ? {
+				email: actor.email,
+				emailVerified: true
+			} : void 0,
+			metadata: { platform: "slack" }
+		};
+		case "web": {
+			const email = normalizeIdentityEmail(actor.email);
+			if (!email) return;
+			return {
+				kind: "user",
+				provider: "junior",
+				providerSubjectId: email,
+				email,
+				emailVerified: true,
+				...actor.fullName ? { displayName: actor.fullName } : void 0,
+				metadata: { platform: "web" }
+			};
+		}
+		case "local":
+		case "system": return SYSTEM_IDENTITY;
+	}
+}
+/**
+* Save the Identity for one Actor and return its id.
+* Return undefined only for a web Actor without a verified email.
+*/
+async function resolveActorIdentityId(executor, actor, nowMs = Date.now()) {
+	const key = identityKey(actor);
+	return key ? (await upsertIdentity(executor, key, nowMs)).id : void 0;
+}
+/** Find the stored Identity id for one Actor without writing. */
+async function findActorIdentityId(db, actor) {
+	const key = identityKey(actor);
+	if (!key) return;
+	return (await db.select({ id: juniorIdentities.id }).from(juniorIdentities).where(and(eq(juniorIdentities.provider, key.provider), eq(juniorIdentities.providerTenantId, key.providerTenantId ?? ""), eq(juniorIdentities.providerSubjectId, key.providerSubjectId))).limit(1))[0]?.id;
+}
 // src/chat/conversations/sql/actor-identity.ts
-/** Build a durable identity observation from a stored conversation actor. */
-function identityFromActor(actor) {
+/**
+* Convert an Actor in the stored Conversation shape to a runtime Actor.
+*
+* TODO(dcramer): Remove after Conversations store the Identity id instead of
+* StoredSlackActor.
+*/
+function actorFromStoredActor(actor) {
 	if (actor?.slackUserId) return {
-		kind: "user",
-		provider: "slack",
-		providerTenantId: actor.teamId,
-		providerSubjectId: actor.slackUserId,
-		...actor.fullName ? { displayName: actor.fullName } : void 0,
-		...actor.slackUserName ? { handle: actor.slackUserName } : void 0,
-		...actor.email ? {
-			email: actor.email,
-			emailVerified: true
-		} : void 0,
-		metadata: { platform: "slack" }
+		...actor.email ? { email: actor.email } : void 0,
+		...actor.fullName ? { fullName: actor.fullName } : void 0,
+		platform: "slack",
+		teamId: actor.teamId ?? "",
+		userId: actor.slackUserId,
+		...actor.slackUserName ? { userName: actor.slackUserName } : void 0
 	};
-	const email = actor?.email?.trim().toLowerCase();
-	if (!email) return;
+	if (!actor?.email) return;
 	return {
-		kind: "user",
-		provider: "junior",
-		providerSubjectId: email,
-		email,
-		emailVerified: true,
-		...actor?.fullName ? { displayName: actor.fullName } : void 0,
-		metadata: { platform: "web" }
+		email: actor.email,
+		...actor.fullName ? { fullName: actor.fullName } : void 0,
+		platform: "web",
+		userId: actor.email
 	};
 }
 /**
-* Build the identity observation for one runtime actor with the same key the
-* Conversation write path stores. Local and system actors have no user
-* identity.
+* Build the legacy system Identity for a Conversation that has no Actor.
+*
+* TODO(dcramer): Remove after every ingress supplies its Actor. These rows use
+* one subject per Source (`scheduler`, `local-cli`, `event`). An Actor
+* uses the one system Identity instead, so the backfill must merge them.
 */
-function identityFromRuntimeActor(actor) {
-	if (actor.platform === "slack") return identityFromActor(toStoredSlackActor(actor));
-	if (actor.platform === "web") return identityFromActor(actor.email ? { email: actor.email } : void 0);
-}
-/** Build a system identity when a conversation has no user actor. */
 function systemIdentityFromSource(source) {
 	if (source === "scheduler") return {
 		kind: "system",
@@ -506,9 +599,15 @@ function systemIdentityFromSource(source) {
 		displayName: "Event"
 	};
 }
-/** Prefer the user actor identity, else a source-derived system identity. */
-function actorIdentityForConversation(conversation) {
-	return identityFromActor(conversation.actor) ?? systemIdentityFromSource(conversation.source);
+/**
+* Save the Identity of a Conversation's actor and return its id. Use the
+* legacy source system Identity when the Conversation has no actor.
+*/
+async function resolveConversationActorIdentityId(executor, conversation) {
+	const actor = actorFromStoredActor(conversation.actor);
+	if (actor) return await resolveActorIdentityId(executor, actor, conversation.updatedAtMs);
+	const fallback = systemIdentityFromSource(conversation.source);
+	return fallback ? (await upsertIdentity(executor, fallback, conversation.updatedAtMs)).id : void 0;
 }
 /**
 * Reconstruct a stored actor with the linked user name and identity-scoped
@@ -780,6 +879,9 @@ var SqlStore = class {
 		if (!row) return;
 		return conversationFromRow(row);
 	}
+	async getRunMetrics(args) {
+		return await readConversationRunMetrics(this.executor, args);
+	}
 	async recordActivity(args) {
 		const nowMs = args.nowMs ?? now();
 		const activityAtMs = args.activityAtMs ?? nowMs;
@@ -824,7 +926,12 @@ var SqlStore = class {
 			const existing = existingRow ? conversationFromRow(existingRow) : void 0;
 			if (!existing && !args.destination) return;
 			const incomingExecutionAt = args.execution.updatedAtMs ?? args.updatedAtMs;
-			const incomingIsFresh = incomingExecutionAt >= (existing?.execution.updatedAtMs ?? existing?.updatedAtMs ?? 0);
+			const existingExecutionAt = existing?.execution.updatedAtMs ?? existing?.updatedAtMs ?? 0;
+			const latestMetricRunId = existing?.executionMetrics?.runId;
+			const incomingIsFresh = !(args.metrics !== null && args.execution.runId !== void 0 && latestMetricRunId !== void 0 && latestMetricRunId !== args.execution.runId && (args.execution.status === "idle" || args.execution.status === "failed") && await readConversationRunMetrics(this.executor, {
+				conversationId: args.conversationId,
+				runId: args.execution.runId
+			}) !== void 0) && incomingExecutionAt >= existingExecutionAt;
 			const execution = incomingIsFresh ? args.execution : existing?.execution ?? args.execution;
 			const actor = mergeActor(existing?.actor, args.actor);
 			const source = existing?.source ?? args.source;
@@ -924,8 +1031,7 @@ var SqlStore = class {
 			location: conversation.location,
 			sessionSource: conversation.sessionSource
 		});
-		const actorIdentityObservation = actorIdentityForConversation(conversation);
-		const actorIdentity = actorIdentityObservation ? await upsertIdentity(this.executor, actorIdentityObservation, conversation.updatedAtMs) : void 0;
+		const actorIdentityId = await resolveConversationActorIdentityId(this.executor, conversation);
 		const rootConversationId = conversation.parentConversationId ? sql`(
           select parent.root_conversation_id
           from junior_conversations parent
@@ -939,7 +1045,7 @@ var SqlStore = class {
 			location: location ?? null,
 			destinationId: destinationId ?? null,
 			destination: null,
-			actorIdentityId: actorIdentity?.id ?? null,
+			actorIdentityId: actorIdentityId ?? null,
 			creatorIdentityId: null,
 			credentialSubjectIdentityId: null,
 			actor: null,
@@ -1061,7 +1167,6 @@ async function ensureConversationRow(executor, conversationId, atMs, options = {
 	});
 }
 // src/chat/conversations/sql/event-actor.ts
-const SLACK_USER_ID_PATTERN = /^[UW][A-Z0-9]{5,}$/;
 function isRecord(value) {
 	return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
@@ -1130,36 +1235,28 @@ async function resolveEventActorIdentityId(executor, args) {
 	if (author.isBot === true) return;
 	const userId = parseActorUserId(author.userId);
 	if (!userId) return;
-	if (SLACK_USER_ID_PATTERN.test(userId)) {
+	if (isSlackUserId(userId)) {
 		const tenantId = await loadConversationSlackTenantId(executor, args.conversationId);
-		const observation = {
-			kind: "user",
-			provider: "slack",
-			providerSubjectId: userId,
-			...tenantId ? { providerTenantId: tenantId } : void 0,
-			...author.fullName ? { displayName: author.fullName } : void 0,
-			...author.userName ? { handle: author.userName } : void 0,
-			...author.email ? {
-				email: author.email,
-				emailVerified: true
-			} : void 0
-		};
-		if (tenantId) return (await upsertIdentity(executor, observation, args.nowMs)).id;
-		return await findIdentityIdByProviderSubject(executor, {
+		if (!tenantId) return await findIdentityIdByProviderSubject(executor, {
 			provider: "slack",
 			providerSubjectId: userId
-		}) ?? void 0;
+		});
+		return await resolveActorIdentityId(executor, {
+			platform: "slack",
+			teamId: tenantId,
+			userId,
+			...author.email ? { email: author.email } : void 0,
+			...author.fullName ? { fullName: author.fullName } : void 0,
+			...author.userName ? { userName: author.userName } : void 0
+		}, args.nowMs);
 	}
-	const email = typeof author.email === "string" && author.email.includes("@") ? author.email.trim().toLowerCase() : userId.includes("@") ? userId.trim().toLowerCase() : void 0;
-	if (email) return (await upsertIdentity(executor, {
-		kind: "user",
-		provider: "junior",
-		providerSubjectId: email,
+	const email = typeof author.email === "string" && author.email.includes("@") ? author.email : userId.includes("@") ? userId : void 0;
+	if (email) return await resolveActorIdentityId(executor, {
+		platform: "web",
+		userId,
 		email,
-		emailVerified: true,
-		...author.fullName ? { displayName: author.fullName } : void 0,
-		metadata: { platform: "web" }
-	}, args.nowMs)).id;
+		...author.fullName ? { fullName: author.fullName } : void 0
+	}, args.nowMs);
 	if (userId.startsWith("dashboard:")) return findJuniorIdentityIdByDashboardAuthorId(executor, userId);
 	return findJuniorIdentityIdByEmail(executor, userId);
 }
@@ -1641,17 +1738,8 @@ async function listAdminUsersFromSql(db) {
 }
 /** Resolve the stored identity and linked user for one runtime actor. */
 async function readActorIdentityFromSql(db, actor) {
-	const key = identityFromRuntimeActor(actor);
-	if (!key) return void 0;
-	const row = (await db.select({
-		identity: juniorIdentities,
-		user: juniorUsers
-	}).from(juniorIdentities).leftJoin(juniorUsers, eq(juniorUsers.id, juniorIdentities.userId)).where(and(eq(juniorIdentities.kind, "user"), eq(juniorIdentities.provider, key.provider), eq(juniorIdentities.providerTenantId, key.providerTenantId ?? ""), eq(juniorIdentities.providerSubjectId, key.providerSubjectId))).limit(1))[0];
-	if (!row) return void 0;
-	return {
-		identity: identityFromRow(row.identity),
-		...row.user ? { user: await readUserById(db, row.user) } : void 0
-	};
+	const identityId = await findActorIdentityId(db, actor);
+	return identityId ? await readIdentityByIdFromSql(db, identityId) : void 0;
 }
 /** Resolve the stored identity and linked user for one runtime actor. */
 async function readActorIdentity(actor) {
@@ -1673,4 +1761,4 @@ async function readIdentityByIdFromSql(db, identityId) {
 async function readIdentityById(identityId) {
 	return await readIdentityByIdFromSql(getDb(), identityId);
 }
-export { resolveRootConversationId as A, parseDestination as B, bindProviderConversation as C, agentTurnTotalTokens as D, agentTurnCostUsd as E, recordGoogleSignIn as F, sameDestination as H, saveUserTimezone as I, upsertIdentity as L, deleteProviderIdentityForUser as M, findUserByVerifiedEmails as N, agentTurnUsageSchema as O, readUserTimezone as P, upsertLinkedIdentity as R, identityFromActor as S, addAgentTurnUsage as T, requireSlackDestination as V, loadConversationSlackTenantIds as _, resolveViewerUser as a, locationFromRow as b, closeDb as c, getConversationMessageSearchStore as d, getConversationStore as f, withConversationEventLock as g, createSqlConversationEventStore as h, readIdentityById as i, deleteProviderIdentityForSlackUser as j, hasAgentTurnUsage as k, db_exports as l, getSqlExecutor as m, listAdminUsersFromSql as n, setUserAdminFromSql as o, getDb as p, readActorIdentity as r, updateViewerDisplayName as s, findUserByEmail as t, getConversationEventStore as u, createSqlStore as v, parseSessionSource as w, startLocationThread as x, withConversationMutationLock as y, createSlackDestination as z };
+export { upsertLinkedIdentity as A, parseDestination as B, resolveActorIdentityId as C, readUserTimezone as D, findUserByVerifiedEmails as E, agentTurnTotalTokens as F, sameDestination as H, agentTurnUsageSchema as I, hasAgentTurnUsage as L, parseSessionSource as M, addAgentTurnUsage as N, recordGoogleSignIn as O, agentTurnCostUsd as P, resolveRootConversationId as R, startLocationThread as S, deleteProviderIdentityForUser as T, requireSlackDestination as V, withConversationEventLock as _, readIdentityById as a, withConversationMutationLock as b, updateViewerDisplayName as c, getConversationEventStore as d, getConversationMessageSearchStore as f, createSqlConversationEventStore as g, getSqlExecutor as h, readActorIdentity as i, bindProviderConversation as j, saveUserTimezone as k, closeDb as l, getDb as m, findUserByEmailFromSql as n, resolveViewerUser as o, getConversationStore as p, listAdminUsersFromSql as r, setUserAdminFromSql as s, findUserByEmail as t, db_exports as u, loadConversationSlackTenantIds as v, deleteProviderIdentityForSlackUser as w, locationFromRow as x, createSqlStore as y, createSlackDestination as z };