@assemblyline-agents/slack 5.0.10 → 6.0.1

package/README.md

@@ -2,12 +2,10 @@
 
 Official Assembly Line Slack channel plugin.
 
-It exports `defineSlackChannel(options)`, which receives Slack Events API callbacks over HTTP (with request-signature verification) and delivers agent replies through the Slack Web API, including file uploads and recent-activity context. The package also registers a Slack connection plugin (`defineSlackConnection`). A single installation requires `SLACK_SIGNING_SECRET`, `SLACK_BOT_TOKEN`, and the default bot scopes including `files:read` and `files:write`.
-
-Channel-aware authored tools may call the host-owned `slack_api` operation for
-the reviewed `chat.postMessage` and `conversations.open` methods. The runtime
-keeps the bot token out of tool input and returns only the destination and
-provider message identifiers; arbitrary Slack Web API methods are rejected.
+The `slack` channel profile verifies Events API requests and delivers replies,
+files, and recent-activity context through the Slack Web API. A single
+installation requires `SLACK_SIGNING_SECRET`, `SLACK_BOT_TOKEN`, and the
+documented bot scopes.
 
 Inbound message text is decoded from Slack's mrkdwn transport form before it
 reaches the agent: auto-linked URLs (`<https://…>`, `<https://…|label>`)
@@ -17,8 +15,56 @@ pairing packets arrives exactly as the user typed it. Mention and command
 sequences (`<@…>`, `<#…>`, `<!…>`) pass through unchanged.
 
 Inbound files preserve their Slack media type and attachment classification.
-Voice clips are therefore routed through any configured gateway media processor,
-such as `openRouterAudioTranscription()`, before the model receives the turn.
+Voice clips use the Slack channel profile's default OpenRouter transcription
+before the model receives the turn. Set `channels.slack.audio` to `openai` or
+`disabled` only when the agent needs a different policy.
+
+Selecting `channels: [slack]` also activates the plugin-owned
+`slack_retrieve_file` tool. The tool retrieves a private Slack file by id into
+`/workspace/slack-files` for analysis, root `deliver_artifact` delivery, or a
+subagent `handoff_artifact`. It enforces a 50 MB limit and uses the credentials
+for the event's workspace.
+
+Authored tools can use two typed, host-owned channel operations without gaining
+access to a raw Slack Web API method:
+
+- `resolve_dm_by_email` looks up a workspace member and opens or resumes the
+  bot's DM with that person. It requires only `users:read`, `users:read.email`,
+  and `im:write`.
+- `post_message` posts standard Markdown to a channel or DM. It requires only
+  `chat:write`.
+
+Use `callSlackChannelOperation` to keep operation names, inputs, and results
+typed:
+
+```ts
+import { callSlackChannelOperation } from "@assemblyline-agents/slack";
+
+const destination = await callSlackChannelOperation(ctx, "resolve_dm_by_email", {
+  email: ownerEmail,
+  teamId
+});
+
+await callSlackChannelOperation(ctx, "post_message", {
+  channel: destination.channelId,
+  teamId,
+  text: "## Review ready\n\nThe memo is ready for review.",
+  idempotencyKey: ctx.idempotencyKey(`memo-ready:${memoId}`),
+  unfurlLinks: false,
+  unfurlMedia: false
+});
+```
+
+Both operations select the existing single- or multi-workspace bot credential.
+`post_message` uses the same 12,000-character Markdown splitting, broadcast
+neutralization, retry policy, and phase-aware errors as normal Slack delivery.
+Each chunk receives a stable Slack `client_msg_id` derived from the caller's
+idempotency key, so a retry does not duplicate a successfully accepted chunk.
+The operation allowlist and per-operation input validation prevent authored
+tools from passing arbitrary Slack API methods or payload fields.
+
+The optional Slack MCP connection remains an explicit `capabilities: [slack]`
+selection.
 
 Outbound replies use Slack's standard Markdown, so headings, bold text, labeled
 links, lists, tables, and code from an agent render natively without
@@ -35,8 +81,10 @@ neutralizes broadcast commands: `<!here>`, `<!channel>`, and `<!everyone>`
 input therefore cannot ping the whole channel; links and user mentions in
 outbound text keep working.
 
-File delivery is explicit and durable. An agent calls `deliver_artifact` once
-for every completed `/workspace` file it needs to attach. The connector posts
+File delivery is explicit and durable. A root agent calls `deliver_artifact`
+once for every completed `/workspace` or `/files/handoffs` file it needs to
+attach. A subagent calls `handoff_artifact` instead; the root then decides
+whether to attach the returned file. The connector posts
 the final response together with all selected files and reports success only
 when Slack confirms every file id. Upload or completion failures leave the
 combined delivery unsent for that attempt and the durable queue retries it. If
@@ -83,9 +131,10 @@ callbacks may omit that ID, so only that callback shape is checked against the
 configured signing-secret set; team-identified events remain pinned to their
 mapped secret.
 
-Slack turns include a provider-scoped user principal by default. Map that
-sender to a canonical company identity before agent hooks run when roles,
-memory, or connection grants must follow the employee across channels:
+Slack turns include a provider-scoped user principal by default. A custom local
+channel plugin can wrap `defineSlackChannel` to map the sender to a canonical
+company identity before hooks run. This callback is plugin code, not an
+`agent.md` option:
 
 ```ts
 export default defineSlackChannel({
@@ -104,14 +153,14 @@ export default defineSlackChannel({
 
 Slack also reports each surface's privacy. DMs and assistant threads are
 private to the authenticated principal; channel threads are shared. When the
-agent opts into `audienceIsolation: true` in `agent.ts`, the runtime uses that
+agent opts into `audienceIsolation: true` in `agent.md`, the runtime uses that
 boundary for memory, history, personal connections, subagents, schedules, and
 delivery, so private DM context is unavailable in a channel or another user's
 DM. Without the opt-in (the default), every surface is trusted and the signal
 has no effect.
 
-Under isolation, a personal Slack where every channel belongs to one trusted
-owner can still mark every surface private:
+Under isolation, a custom Slack implementation for a personal workspace can
+mark every surface private:
 
 ```ts
 export default defineSlackChannel({
@@ -121,24 +170,17 @@ export default defineSlackChannel({
 
 ## Install
 
-```sh
-npm install @assemblyline-agents/slack
-```
-
-With the Assembly Line CLI, add the channel instead:
-
 ```sh
 assembly-line add slack /path/to/agent
 ```
 
-This creates both `channels/slack.ts` and `slack-app-manifest.json`. The latter
-comes from the package's reusable
-[`templates/slack-app-manifest.json`](templates/slack-app-manifest.json) and
-contains the bot scopes and `app_mention`/`message.im` event subscriptions
-expected by the connector.
+The command installs the package and selects `channels: [slack]` in `agent.md`.
+It does not create a root channel file. The reusable
+[`templates/slack-app-manifest.json`](templates/slack-app-manifest.json)
+contains the expected bot scopes and event subscriptions.
 
-1. Replace `https://your-agent.example.com/slack/events` in the generated
-   manifest with the deployed agent URL.
+1. Copy the package template and replace
+   `https://your-agent.example.com/slack/events` with the deployed agent URL.
 2. In Slack's app dashboard, create an app **from an app manifest** and paste or
    upload the JSON.
 3. Install the app to the workspace.
@@ -146,10 +188,11 @@ expected by the connector.
    `SLACK_BOT_TOKEN` from **OAuth & Permissions** in the agent environment.
 5. Verify the installation with `assembly-line channels check /path/to/agent`.
 
-The loading indicator only needs `chat:write`. The default manifest also
-includes optional `groups:history` so private-channel thread context works
-without another reinstall. Remove `groups:history` if the bot will never be
-invited to private channels.
+The loading indicator and `post_message` operation need `chat:write`.
+`resolve_dm_by_email` needs `users:read`, `users:read.email`, and `im:write`.
+The default manifest also includes optional `groups:history` so private-channel
+thread context works without another reinstall. Remove `groups:history` if the
+bot will never be invited to private channels.
 
 ## Part of Assembly Line
 

package/ai.assemblyline/connections/slack.json

@@ -0,0 +1,43 @@
+{
+  "kind": "slack",
+  "role": "connection",
+  "packageName": "@assemblyline-agents/slack",
+  "helper": "defineSlackConnection",
+  "protocol": "mcp",
+  "transport": "http",
+  "provider": "slack",
+  "description": "Slack workspace search, channels, messages, files, and users through Slack MCP.",
+  "defaultUrl": "https://mcp.slack.com/mcp",
+  "urlEnv": "SLACK_MCP_URL",
+  "tokenEnv": "SLACK_MCP_TOKEN",
+  "tokenRequired": true,
+  "capabilities": [
+    "mcp",
+    "live-tools",
+    "streamable-http"
+  ],
+  "scopes": [],
+  "subject": "workspace",
+  "readToolPatterns": [
+    "regex:(^|[-_])(search|read|list|fetch|get|retrieve|query|lookup|find|describe|details?|discover)([-_]|$)"
+  ],
+  "writeToolPatterns": [
+    "regex:(^|[-_])(add|append|archive|assign|book|buy|cancel|checkout|close|complete|create|delete|draft|duplicate|edit|execute|insert|invite|kick|link|merge|modify|move|mutate|open|pay|post|publish|purchase|push|react|reaction|remove|rename|reply|reserve|resolve|reopen|run|schedule|send|set|share|submit|transfer|transition|unassign|unlink|update|upload|write)([-_]|$)"
+  ],
+  "setup": [
+    {
+      "kind": "connection",
+      "name": "slack-developer-configuration",
+      "required": true,
+      "message": "Configure Slack credentials, OAuth application, or MCP bridge for this deployment."
+    }
+  ],
+  "requiredConfig": [],
+  "optionalConfig": [
+    "SLACK_MCP_URL"
+  ],
+  "requiredCredentials": [
+    "SLACK_MCP_TOKEN"
+  ],
+  "optionalCredentials": []
+}

package/ai.assemblyline/index.cjs

@@ -0,0 +1,94 @@
+module.exports = {
+  "channels": {
+    "slack": {
+      "definition": "@assemblyline-agents/slack",
+      "factory": "defineSlackChannel",
+      "transport": "http",
+      "route": "/slack/events",
+      "methods": [
+        "POST"
+      ],
+      "requiredCredentials": [
+        "SLACK_SIGNING_SECRET",
+        "SLACK_BOT_TOKEN"
+      ],
+      "optionalConfig": [
+        "SLACK_BOT_USER_ID",
+        "SLACK_ASSISTANT_ENABLED"
+      ],
+      "optionalCredentials": [
+        "SLACK_WORKSPACE_CREDENTIALS_JSON"
+      ],
+      "defaultAudio": "openrouter",
+      "configSchema": {
+        "type": "object",
+        "additionalProperties": false
+      },
+      "metadata": {
+        "provider": "slack",
+        "ingress": {
+          "requiredSecretEnv": [
+            [
+              "SLACK_SIGNING_SECRET"
+            ]
+          ]
+        },
+        "installation": {
+          "requiredBotScopes": [
+            "app_mentions:read",
+            "channels:history",
+            "chat:write",
+            "files:read",
+            "files:write",
+            "im:history",
+            "im:write",
+            "users:read",
+            "users:read.email"
+          ],
+          "optionalBotScopes": [
+            "assistant:write",
+            "groups:history"
+          ],
+          "channelOperations": {
+            "resolve_dm_by_email": {
+              "requiredBotScopes": ["users:read", "users:read.email", "im:write"]
+            },
+            "post_message": {
+              "requiredBotScopes": ["chat:write"]
+            }
+          }
+        }
+      }
+    }
+  },
+  "connections": {
+    "slack": {
+      "contract": "./ai.assemblyline/connections/slack.json",
+      "definition": "@assemblyline-agents/slack",
+      "factory": "defineSlackConnection"
+    }
+  },
+  "tools": {
+    "slack_retrieve_file": {
+      "definition": "@assemblyline-agents/slack",
+      "factory": "defineSlackRetrieveFileTool",
+      "description": "Retrieve an existing private Slack file by id into the run sandbox.",
+      "inputSchema": {
+        "type": "object",
+        "additionalProperties": false,
+        "properties": {
+          "fileId": { "type": "string" },
+          "filename": { "type": "string" },
+          "teamId": { "type": "string" }
+        },
+        "required": ["fileId"]
+      },
+      "capability": {
+        "visibility": "deferred",
+        "execution": "direct",
+        "namespace": "slack",
+        "tags": ["slack", "file", "attachment", "download"]
+      }
+    }
+  }
+};

package/dist/channel-operations.d.ts

@@ -0,0 +1,51 @@
+import type { JsonObject, ToolExecutionContext } from "@assemblyline-agents/core";
+import type { ChannelContext, ChannelTurn } from "@assemblyline-agents/runtime";
+export declare const SLACK_CHANNEL_OPERATIONS: readonly ["resolve_dm_by_email", "post_message"];
+export type SlackChannelOperation = typeof SLACK_CHANNEL_OPERATIONS[number];
+/** Exact bot-token scopes used by each semantic operation. */
+export declare const SLACK_CHANNEL_OPERATION_REQUIRED_BOT_SCOPES: {
+    readonly resolve_dm_by_email: readonly ["users:read", "users:read.email", "im:write"];
+    readonly post_message: readonly ["chat:write"];
+};
+export interface SlackResolveDmByEmailInput extends JsonObject {
+    email: string;
+    teamId?: string;
+}
+export interface SlackResolveDmByEmailResult extends JsonObject {
+    ok: true;
+    userId: string;
+    channelId: string;
+    teamId?: string;
+}
+export interface SlackPostMessageInput extends JsonObject {
+    channel: string;
+    text: string;
+    idempotencyKey: string;
+    teamId?: string;
+    threadTs?: string;
+    unfurlLinks?: boolean;
+    unfurlMedia?: boolean;
+}
+export interface SlackPostMessageResult extends JsonObject {
+    ok: true;
+    provider: "slack";
+    mode: "chat.postMessage";
+    channel: string;
+    threadTs?: string;
+    slackMessageTs: string[];
+    messageCount: number;
+    idempotencyKey: string;
+}
+export interface SlackChannelOperationInputs {
+    resolve_dm_by_email: SlackResolveDmByEmailInput;
+    post_message: SlackPostMessageInput;
+}
+export interface SlackChannelOperationResults {
+    resolve_dm_by_email: SlackResolveDmByEmailResult;
+    post_message: SlackPostMessageResult;
+}
+/** Typed authored-tool entrypoint for the current Slack channel capability. */
+export declare function callSlackChannelOperation<Operation extends SlackChannelOperation>(ctx: Pick<ToolExecutionContext, "channel">, operation: Operation, input: SlackChannelOperationInputs[Operation]): Promise<SlackChannelOperationResults[Operation]>;
+/** Runtime dispatcher. Only the named semantic operations can reach Slack. */
+export declare function executeSlackChannelOperation(operation: string, input: JsonObject, turn: ChannelTurn, ctx: ChannelContext): Promise<JsonObject>;
+//# sourceMappingURL=channel-operations.d.ts.map

package/dist/channel-operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-operations.d.ts","sourceRoot":"","sources":["../src/channel-operations.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAClF,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAchF,eAAO,MAAM,wBAAwB,kDAAmD,CAAC;AACzF,MAAM,MAAM,qBAAqB,GAAG,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;AAE5E,8DAA8D;AAC9D,eAAO,MAAM,2CAA2C;;;CAGa,CAAC;AAEtE,MAAM,WAAW,0BAA2B,SAAQ,UAAU;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,2BAA4B,SAAQ,UAAU;IAC7D,EAAE,EAAE,IAAI,CAAC;IACT,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAsB,SAAQ,UAAU;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,sBAAuB,SAAQ,UAAU;IACxD,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,2BAA2B;IAC1C,mBAAmB,EAAE,0BAA0B,CAAC;IAChD,YAAY,EAAE,qBAAqB,CAAC;CACrC;AAED,MAAM,WAAW,4BAA4B;IAC3C,mBAAmB,EAAE,2BAA2B,CAAC;IACjD,YAAY,EAAE,sBAAsB,CAAC;CACtC;AAED,+EAA+E;AAC/E,wBAAsB,yBAAyB,CAAC,SAAS,SAAS,qBAAqB,EACrF,GAAG,EAAE,IAAI,CAAC,oBAAoB,EAAE,SAAS,CAAC,EAC1C,SAAS,EAAE,SAAS,EACpB,KAAK,EAAE,2BAA2B,CAAC,SAAS,CAAC,GAC5C,OAAO,CAAC,4BAA4B,CAAC,SAAS,CAAC,CAAC,CAKlD;AAED,8EAA8E;AAC9E,wBAAsB,4BAA4B,CAChD,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,cAAc,GAClB,OAAO,CAAC,UAAU,CAAC,CAQrB"}

package/dist/channel-operations.js

@@ -0,0 +1,145 @@
+import { postSlackMarkdown, slackPhaseError, slackTextDeliveryMetadata } from "./message-delivery.js";
+import { slackApi } from "./slack-api.js";
+const SLACK_CONVERSATION_ID = /^[CDG][A-Z0-9]+$/u;
+const SLACK_DM_ID = /^D[A-Z0-9]+$/u;
+const SLACK_TEAM_ID = /^T[A-Z0-9]+$/u;
+const SLACK_TIMESTAMP = /^\d+\.\d+$/u;
+const SLACK_USER_ID = /^[UW][A-Z0-9]+$/u;
+export const SLACK_CHANNEL_OPERATIONS = ["resolve_dm_by_email", "post_message"];
+/** Exact bot-token scopes used by each semantic operation. */
+export const SLACK_CHANNEL_OPERATION_REQUIRED_BOT_SCOPES = {
+    resolve_dm_by_email: ["users:read", "users:read.email", "im:write"],
+    post_message: ["chat:write"]
+};
+/** Typed authored-tool entrypoint for the current Slack channel capability. */
+export async function callSlackChannelOperation(ctx, operation, input) {
+    if (!ctx.channel?.perform) {
+        throw new Error("Slack operations require a host-owned Slack channel capability.");
+    }
+    return await ctx.channel.perform(operation, input);
+}
+/** Runtime dispatcher. Only the named semantic operations can reach Slack. */
+export async function executeSlackChannelOperation(operation, input, turn, ctx) {
+    if (operation === "resolve_dm_by_email") {
+        return resolveSlackDmByEmail(validateResolveDmInput(input), turn, ctx);
+    }
+    if (operation === "post_message") {
+        return postSlackMessage(validatePostMessageInput(input), turn, ctx);
+    }
+    throw new Error(`Unsupported Slack channel operation: ${operation}.`);
+}
+async function resolveSlackDmByEmail(input, turn, ctx) {
+    const teamId = input.teamId ?? slackTeamIdForTurn(turn);
+    let lookup;
+    try {
+        lookup = await slackApi(ctx, "users.lookupByEmail", { email: input.email }, teamId);
+    }
+    catch (error) {
+        throw slackPhaseError(`Slack direct-message user lookup failed for ${input.email}`, error);
+    }
+    const userId = stringValue(recordValue(lookup.user)?.id);
+    if (!userId || !SLACK_USER_ID.test(userId)) {
+        throw new Error(`Slack direct-message user lookup returned no user id for ${input.email}.`);
+    }
+    let opened;
+    try {
+        opened = await slackApi(ctx, "conversations.open", { users: userId }, teamId);
+    }
+    catch (error) {
+        throw slackPhaseError(`Slack direct-message open failed for user ${userId}`, error);
+    }
+    const channelId = stringValue(recordValue(opened.channel)?.id);
+    if (!channelId || !SLACK_DM_ID.test(channelId)) {
+        throw new Error(`Slack direct-message open returned no valid channel id for user ${userId}.`);
+    }
+    return {
+        ok: true,
+        userId,
+        channelId,
+        ...(teamId ? { teamId } : {})
+    };
+}
+async function postSlackMessage(input, turn, ctx) {
+    const teamId = input.teamId ?? slackTeamIdForTurn(turn);
+    const results = await postSlackMarkdown(input.text, input.channel, input.threadTs, ctx, teamId, {
+        idempotencyKey: input.idempotencyKey,
+        ...(input.unfurlLinks !== undefined ? { unfurlLinks: input.unfurlLinks } : {}),
+        ...(input.unfurlMedia !== undefined ? { unfurlMedia: input.unfurlMedia } : {})
+    });
+    return {
+        ...slackTextDeliveryMetadata(input.channel, input.threadTs, input.idempotencyKey, results),
+        ok: true
+    };
+}
+function validateResolveDmInput(input) {
+    assertAllowedKeys(input, new Set(["email", "teamId"]), "resolve_dm_by_email");
+    const email = requiredString(input.email, "Slack resolve_dm_by_email requires email.");
+    if (!email.includes("@"))
+        throw new Error("Slack resolve_dm_by_email requires a valid email address.");
+    const teamId = optionalTeamId(input.teamId);
+    return { email, ...(teamId ? { teamId } : {}) };
+}
+function validatePostMessageInput(input) {
+    assertAllowedKeys(input, new Set(["channel", "text", "idempotencyKey", "teamId", "threadTs", "unfurlLinks", "unfurlMedia"]), "post_message");
+    const channel = requiredString(input.channel, "Slack post_message requires channel.").toUpperCase();
+    if (!SLACK_CONVERSATION_ID.test(channel)) {
+        throw new Error("Slack post_message requires a channel id beginning with C, D, or G.");
+    }
+    const text = requiredString(input.text, "Slack post_message requires non-empty text.", false);
+    const idempotencyKey = requiredString(input.idempotencyKey, "Slack post_message requires idempotencyKey.");
+    const teamId = optionalTeamId(input.teamId);
+    const threadTs = optionalString(input.threadTs);
+    if (threadTs && !SLACK_TIMESTAMP.test(threadTs)) {
+        throw new Error("Slack post_message threadTs must be a Slack timestamp.");
+    }
+    if (input.unfurlLinks !== undefined && typeof input.unfurlLinks !== "boolean") {
+        throw new Error("Slack post_message unfurlLinks must be a boolean.");
+    }
+    if (input.unfurlMedia !== undefined && typeof input.unfurlMedia !== "boolean") {
+        throw new Error("Slack post_message unfurlMedia must be a boolean.");
+    }
+    return {
+        channel,
+        text,
+        idempotencyKey,
+        ...(teamId ? { teamId } : {}),
+        ...(threadTs ? { threadTs } : {}),
+        ...(typeof input.unfurlLinks === "boolean" ? { unfurlLinks: input.unfurlLinks } : {}),
+        ...(typeof input.unfurlMedia === "boolean" ? { unfurlMedia: input.unfurlMedia } : {})
+    };
+}
+function slackTeamIdForTurn(turn) {
+    const slack = recordValue(turn.metadata?.slack);
+    const delivery = recordValue(turn.delivery);
+    return stringValue(slack?.teamId) ?? stringValue(delivery?.teamId);
+}
+function optionalTeamId(value) {
+    const teamId = optionalString(value)?.toUpperCase();
+    if (teamId && !SLACK_TEAM_ID.test(teamId)) {
+        throw new Error("Slack teamId must begin with T.");
+    }
+    return teamId;
+}
+function requiredString(value, message, trim = true) {
+    if (typeof value !== "string" || !value.trim())
+        throw new Error(message);
+    return trim ? value.trim() : value;
+}
+function optionalString(value) {
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+function assertAllowedKeys(input, allowed, operation) {
+    const unsupported = Object.keys(input).filter((key) => !allowed.has(key));
+    if (unsupported.length > 0) {
+        throw new Error(`Slack ${operation} does not accept: ${unsupported.join(", ")}.`);
+    }
+}
+function recordValue(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function stringValue(value) {
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+//# sourceMappingURL=channel-operations.js.map

package/dist/channel-operations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-operations.js","sourceRoot":"","sources":["../src/channel-operations.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,iBAAiB,EACjB,eAAe,EACf,yBAAyB,EAC1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,MAAM,qBAAqB,GAAG,mBAAmB,CAAC;AAClD,MAAM,WAAW,GAAG,eAAe,CAAC;AACpC,MAAM,aAAa,GAAG,eAAe,CAAC;AACtC,MAAM,eAAe,GAAG,aAAa,CAAC;AACtC,MAAM,aAAa,GAAG,kBAAkB,CAAC;AAEzC,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,qBAAqB,EAAE,cAAc,CAAU,CAAC;AAGzF,8DAA8D;AAC9D,MAAM,CAAC,MAAM,2CAA2C,GAAG;IACzD,mBAAmB,EAAE,CAAC,YAAY,EAAE,kBAAkB,EAAE,UAAU,CAAC;IACnE,YAAY,EAAE,CAAC,YAAY,CAAC;CACuC,CAAC;AA6CtE,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAA0C,EAC1C,SAAoB,EACpB,KAA6C;IAE7C,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,MAAM,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAA4C,CAAC;AAChG,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,SAAiB,EACjB,KAAiB,EACjB,IAAiB,EACjB,GAAmB;IAEnB,IAAI,SAAS,KAAK,qBAAqB,EAAE,CAAC;QACxC,OAAO,qBAAqB,CAAC,sBAAsB,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;QACjC,OAAO,gBAAgB,CAAC,wBAAwB,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,wCAAwC,SAAS,GAAG,CAAC,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,KAAiC,EACjC,IAAiB,EACjB,GAAmB;IAEnB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,qBAAqB,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,eAAe,CAAC,+CAA+C,KAAK,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,4DAA4D,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;IAC9F,CAAC;IAED,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CAAC,GAAG,EAAE,oBAAoB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,eAAe,CAAC,6CAA6C,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,SAAS,GAAG,WAAW,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/D,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,mEAAmE,MAAM,GAAG,CAAC,CAAC;IAChG,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM;QACN,SAAS;QACT,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,KAA4B,EAC5B,IAAiB,EACjB,GAAmB;IAEnB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CACrC,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,OAAO,EACb,KAAK,CAAC,QAAQ,EACd,GAAG,EACH,MAAM,EACN;QACE,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/E,CACF,CAAC;IACF,OAAO;QACL,GAAG,yBAAyB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,cAAc,EAAE,OAAO,CAAC;QAC1F,EAAE,EAAE,IAAI;KACiB,CAAC;AAC9B,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAiB;IAC/C,iBAAiB,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,2CAA2C,CAAC,CAAC;IACvF,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACvG,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAiB;IACjD,iBAAiB,CACf,KAAK,EACL,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC,EAClG,cAAc,CACf,CAAC;IACF,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,sCAAsC,CAAC,CAAC,WAAW,EAAE,CAAC;IACpG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,6CAA6C,EAAE,KAAK,CAAC,CAAC;IAC9F,MAAM,cAAc,GAAG,cAAc,CAAC,KAAK,CAAC,cAAc,EAAE,6CAA6C,CAAC,CAAC;IAC3G,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,QAAQ,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,OAAO;QACL,OAAO;QACP,IAAI;QACJ,cAAc;QACd,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,OAAO,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,GAAG,CAAC,OAAO,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAiB;IAC3C,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,OAAO,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IACpD,IAAI,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,OAAe,EAAE,IAAI,GAAG,IAAI;IAClE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IACzE,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AACrC,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAiB,EAAE,OAA4B,EAAE,SAAiB;IAC3F,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1E,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,SAAS,SAAS,qBAAqB,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAC,KAAmB;QACrB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC"}

package/dist/file-retrieval.d.ts

@@ -0,0 +1,5 @@
+import type { JsonObject } from "@assemblyline-agents/core";
+import type { ChannelContext, ChannelTurn } from "@assemblyline-agents/runtime";
+/** Fetch a private Slack file inside the trusted channel boundary. */
+export declare function retrieveSlackFile(input: JsonObject, turn: ChannelTurn, ctx: ChannelContext): Promise<JsonObject>;
+//# sourceMappingURL=file-retrieval.d.ts.map

package/dist/file-retrieval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-retrieval.d.ts","sourceRoot":"","sources":["../src/file-retrieval.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAC;AAMhF,sEAAsE;AACtE,wBAAsB,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,CAmCtH"}

package/dist/file-retrieval.js

@@ -0,0 +1,77 @@
+import { slackWorkspaceCredentials } from "./workspace-credentials.js";
+const MAX_FILE_BYTES = 50 * 1024 * 1024;
+const SLACK_FILE_ID = /^F[A-Z0-9]+$/u;
+/** Fetch a private Slack file inside the trusted channel boundary. */
+export async function retrieveSlackFile(input, turn, ctx) {
+    const fileId = stringValue(input.fileId)?.toUpperCase();
+    if (!fileId || !SLACK_FILE_ID.test(fileId))
+        throw new Error("Slack file retrieval requires a valid file id beginning with F.");
+    const teamId = stringValue(input.teamId) ?? slackTeamId(turn.metadata);
+    const token = slackWorkspaceCredentials(ctx.env, teamId).botToken?.trim();
+    if (!token)
+        return failure(fileId, "slack_file_read_not_configured", "No Slack file-read credential is configured for this workspace.");
+    const infoResponse = await ctx.fetch(`https://slack.com/api/files.info?file=${encodeURIComponent(fileId)}`, {
+        headers: { authorization: `Bearer ${token}` },
+        signal: AbortSignal.timeout(30_000)
+    });
+    const info = await infoResponse.json().catch(() => ({}));
+    if (!infoResponse.ok || info.ok !== true || !isRecord(info.file)) {
+        const detail = typeof info.error === "string" ? info.error : `HTTP ${infoResponse.status}`;
+        return failure(fileId, "slack_file_lookup_failed", `Slack could not resolve ${fileId}: ${detail}.`);
+    }
+    const file = info.file;
+    const downloadUrl = firstString(file.url_private_download, file.url_private);
+    if (!downloadUrl || !isAllowedSlackFileUrl(downloadUrl))
+        return failure(fileId, "slack_file_download_url_missing", "Slack returned no allowed private download URL.");
+    const announcedSize = finitePositiveNumber(file.size);
+    if (announcedSize !== undefined && announcedSize > MAX_FILE_BYTES)
+        throw new Error(`Slack file ${fileId} is above the 50 MB retrieval limit.`);
+    const download = await ctx.fetch(downloadUrl, {
+        headers: { authorization: `Bearer ${token}` },
+        redirect: "error",
+        signal: AbortSignal.timeout(90_000)
+    });
+    if (!download.ok)
+        return failure(fileId, "slack_file_download_failed", `Slack file download failed with HTTP ${download.status}.`);
+    const bytes = await boundedBytes(download, MAX_FILE_BYTES);
+    return {
+        ok: true,
+        fileId,
+        filename: safeFilename(stringValue(input.filename)) ?? safeFilename(firstString(file.name, file.title)) ?? `${fileId}.bin`,
+        bytesBase64: Buffer.from(bytes).toString("base64"),
+        sizeBytes: bytes.byteLength,
+        contentType: download.headers.get("content-type") ?? "application/octet-stream"
+    };
+}
+function failure(fileId, error, message) { return { ok: false, fileId, error, message }; }
+function stringValue(value) { return typeof value === "string" && value.trim() ? value.trim() : undefined; }
+function slackTeamId(metadata) { const slack = isRecord(metadata?.slack) ? metadata.slack : undefined; return stringValue(slack?.teamId); }
+function firstString(...values) { return values.find((value) => typeof value === "string" && value.trim() !== "")?.trim(); }
+function finitePositiveNumber(value) { return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : undefined; }
+function isRecord(value) { return Boolean(value) && typeof value === "object" && !Array.isArray(value); }
+function safeFilename(value) {
+    if (!value)
+        return undefined;
+    const cleaned = value.trim().replace(/[\\/\u0000-\u001f\u007f]+/gu, "-").replace(/[^a-z0-9._() -]+/giu, "-").replace(/\s+/gu, " ").replace(/^-+|-+$/gu, "").slice(0, 160);
+    return cleaned && cleaned !== "." && cleaned !== ".." ? cleaned : undefined;
+}
+function isAllowedSlackFileUrl(value) {
+    try {
+        const url = new URL(value);
+        const hostname = url.hostname.toLowerCase();
+        return url.protocol === "https:" && (hostname === "files.slack.com" || hostname.endsWith(".slack.com"));
+    }
+    catch {
+        return false;
+    }
+}
+async function boundedBytes(response, maxBytes) {
+    const declared = Number(response.headers.get("content-length"));
+    if (Number.isFinite(declared) && declared > maxBytes)
+        throw new Error("The Slack file exceeded the 50 MB retrieval limit.");
+    const bytes = new Uint8Array(await response.arrayBuffer());
+    if (bytes.byteLength > maxBytes)
+        throw new Error("The Slack file exceeded the 50 MB retrieval limit.");
+    return bytes;
+}
+//# sourceMappingURL=file-retrieval.js.map

package/dist/file-retrieval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-retrieval.js","sourceRoot":"","sources":["../src/file-retrieval.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAEvE,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACxC,MAAM,aAAa,GAAG,eAAe,CAAC;AAEtC,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAAiB,EAAE,IAAiB,EAAE,GAAmB;IAC/F,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;IACxD,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IAC/H,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,yBAAyB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1E,IAAI,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC,MAAM,EAAE,gCAAgC,EAAE,iEAAiE,CAAC,CAAC;IACxI,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,yCAAyC,kBAAkB,CAAC,MAAM,CAAC,EAAE,EAAE;QAC1G,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;QAC7C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAA4B,CAAC;IACpF,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjE,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,YAAY,CAAC,MAAM,EAAE,CAAC;QAC3F,OAAO,OAAO,CAAC,MAAM,EAAE,0BAA0B,EAAE,2BAA2B,MAAM,KAAK,MAAM,GAAG,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACvB,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,oBAAoB,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC7E,IAAI,CAAC,WAAW,IAAI,CAAC,qBAAqB,CAAC,WAAW,CAAC;QAAE,OAAO,OAAO,CAAC,MAAM,EAAE,iCAAiC,EAAE,iDAAiD,CAAC,CAAC;IACtK,MAAM,aAAa,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,GAAG,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,cAAc,MAAM,sCAAsC,CAAC,CAAC;IAC/I,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE;QAC5C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;QAC7C,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,MAAM,EAAE,4BAA4B,EAAE,wCAAwC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;IACnI,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC3D,OAAO;QACL,EAAE,EAAE,IAAI;QACR,MAAM;QACN,QAAQ,EAAE,YAAY,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,MAAM,MAAM;QAC1H,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAClD,SAAS,EAAE,KAAK,CAAC,UAAU;QAC3B,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,0BAA0B;KAChF,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,MAAc,EAAE,KAAa,EAAE,OAAe,IAAgB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AAC9H,SAAS,WAAW,CAAC,KAAc,IAAwB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AACzI,SAAS,WAAW,CAAC,QAAgC,IAAwB,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACvL,SAAS,WAAW,CAAC,GAAG,MAAiB,IAAwB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC5K,SAAS,oBAAoB,CAAC,KAAc,IAAwB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AACnK,SAAS,QAAQ,CAAC,KAAc,IAAsC,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACpJ,SAAS,YAAY,CAAC,KAAyB;IAC7C,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1K,OAAO,OAAO,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AACD,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,CAAC;QAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAAC,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,KAAK,iBAAiB,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IAAC,CAAC;IACzL,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AACzB,CAAC;AACD,KAAK,UAAU,YAAY,CAAC,QAAkB,EAAE,QAAgB;IAC9D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAChE,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IAC5H,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3D,IAAI,KAAK,CAAC,UAAU,GAAG,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACvG,OAAO,KAAK,CAAC;AACf,CAAC"}