refactor(extensions): use scoped pairing helper

src/plugin-sdk/index.ts

@@ -216,6 +216,7 @@ export {
   type SenderGroupAccessReason,
 } from "./group-access.js";
 export { resolveSenderCommandAuthorization } from "./command-auth.js";
+export { createScopedPairingAccess } from "./pairing-access.js";
 export { handleSlackMessageAction } from "./slack-message-actions.js";
 export { extractToolSend } from "./tool-send.js";
 export {

src/plugin-sdk/pairing-access.ts

@@ -0,0 +1,36 @@
+import type { ChannelId } from "../channels/plugins/types.js";
+import type { PluginRuntime } from "../plugins/runtime/types.js";
+import { normalizeAccountId } from "../routing/session-key.js";
+
+type PairingApi = PluginRuntime["channel"]["pairing"];
+type ScopedUpsertInput = Omit<
+  Parameters<PairingApi["upsertPairingRequest"]>[0],
+  "channel" | "accountId"
+>;
+
+export function createScopedPairingAccess(params: {
+  core: PluginRuntime;
+  channel: ChannelId;
+  accountId: string;
+}) {
+  const resolvedAccountId = normalizeAccountId(params.accountId);
+  return {
+    accountId: resolvedAccountId,
+    readAllowFromStore: () =>
+      params.core.channel.pairing.readAllowFromStore({
+        channel: params.channel,
+        accountId: resolvedAccountId,
+      }),
+    readStoreForDmPolicy: (provider: ChannelId, accountId: string) =>
+      params.core.channel.pairing.readAllowFromStore({
+        channel: provider,
+        accountId: normalizeAccountId(accountId),
+      }),
+    upsertPairingRequest: (input: ScopedUpsertInput) =>
+      params.core.channel.pairing.upsertPairingRequest({
+        channel: params.channel,
+        accountId: resolvedAccountId,
+        ...input,
+      }),
+  };
+}