@fastagent-sh/fastagent 0.29.0 → 0.30.1

package/dist/channels/slack/config-api.d.ts

@@ -1,69 +0,0 @@
-import type { SlackAppManifest } from "./manifest.ts";
-interface SlackErrorShape {
-    ok?: boolean;
-    error?: string;
-    errors?: {
-        message?: string;
-        pointer?: string;
-    }[];
-}
-export declare class SlackConfigApiError extends Error {
-    readonly code: string;
-    readonly status: number;
-    /** Kept, not just formatted into the message. */
-    readonly errors: {
-        message?: string;
-        pointer?: string;
-    }[];
-    constructor(method: string, status: number, data: SlackErrorShape, fallback: string);
-}
-/** Whether a manifest call failed because Slack could not verify the `request_url` it carries. */
-export declare function isSlackRequestUrlUnverified(error: unknown): boolean;
-/** Whether a manifest write was refused because the app has token rotation on, which Slack never lets off again. */
-export declare function isSlackRotationLocked(error: unknown): boolean;
-/** The remedy every rotating-app refusal points at. */
-export declare const SLACK_ROTATING_APP_REMEDY = "this app has token rotation on, which FastAgent does not support and Slack cannot turn off \u2014 create a new app (docs/slack.md \u2192 \"If token rotation is on\")";
-export interface SlackAppCredentials {
-    appId: string;
-    clientId: string;
-    clientSecret: string;
-    signingSecret: string;
-    oauthAuthorizeUrl?: string;
-}
-/** Single-attempt BY DESIGN: an ambiguous response may already have created the app, so this never retries itself. */
-export declare function createSlackApp(configToken: string, manifest: SlackAppManifest, options?: {
-    apiBaseUrl?: string;
-    fetch?: typeof fetch;
-}): Promise<SlackAppCredentials>;
-export declare function updateSlackAppManifest(configToken: string, appId: string, manifest: SlackAppManifest, options?: {
-    apiBaseUrl?: string;
-    fetch?: typeof fetch;
-}): Promise<void>;
-export interface RotatedSlackConfigToken {
-    token: string;
-    refreshToken: string;
-    expiresAt: number;
-    teamId?: string;
-}
-export declare function rotateSlackConfigToken(refreshToken: string, options?: {
-    apiBaseUrl?: string;
-    fetch?: typeof fetch;
-}): Promise<RotatedSlackConfigToken>;
-export interface SlackOAuthResult {
-    botToken: string;
-    appId: string;
-    teamId: string;
-    teamName?: string;
-    botUserId?: string;
-    scopes: string[];
-}
-export declare function exchangeSlackOAuthCode(input: {
-    clientId: string;
-    clientSecret: string;
-    code: string;
-    redirectUrl: string;
-}, options?: {
-    apiBaseUrl?: string;
-    fetch?: typeof fetch;
-}): Promise<SlackOAuthResult>;
-export {};

package/dist/channels/slack/config-api.js

@@ -1,162 +0,0 @@
-const SLACK_API = "https://slack.com/api";
-const REQUEST_TIMEOUT_MS = 30_000;
-/** One `errors[]` entry that means "Slack could not verify this URL", by either signal it may carry. */
-const rejectsRequestUrl = (e) => e.pointer?.endsWith("/request_url") === true ||
-    (/request.?url/i.test(e.message ?? "") && /verif|challenge/i.test(e.message ?? ""));
-export class SlackConfigApiError extends Error {
-    code;
-    status;
-    /** Kept, not just formatted into the message. */
-    errors;
-    constructor(method, status, data, fallback) {
-        const code = data.error ?? fallback;
-        const fields = data.errors
-            ?.map((error) => `${error.pointer ?? "manifest"}: ${error.message ?? "invalid"}`)
-            .join("; ");
-        super(`Slack ${method} failed: ${code}${fields ? ` — ${fields}` : ""}`);
-        this.name = "SlackConfigApiError";
-        this.code = code;
-        this.status = status;
-        this.errors = data.errors ?? [];
-    }
-}
-/** Whether a manifest call failed because Slack could not verify the `request_url` it carries. */
-export function isSlackRequestUrlUnverified(error) {
-    return (error instanceof SlackConfigApiError && error.code === "invalid_manifest" && error.errors.some(rejectsRequestUrl));
-}
-/** Whether a manifest write was refused because the app has token rotation on, which Slack never lets off again. */
-export function isSlackRotationLocked(error) {
-    if (!(error instanceof SlackConfigApiError))
-        return false;
-    return (error.code === "cannot_disable_once_enabled" ||
-        error.errors.some((e) => e.message?.includes("cannot_disable_once_enabled") || e.pointer?.endsWith("token_rotation_enabled")));
-}
-/** The remedy every rotating-app refusal points at. */
-export const SLACK_ROTATING_APP_REMEDY = 'this app has token rotation on, which FastAgent does not support and Slack cannot turn off — create a new app (docs/slack.md → "If token rotation is on")';
-async function slackJson(method, body, options = {}) {
-    const fetchFn = options.fetch ?? globalThis.fetch;
-    let response;
-    let raw;
-    try {
-        response = await fetchFn(`${options.apiBaseUrl ?? SLACK_API}/${method}`, {
-            method: "POST",
-            headers: {
-                "content-type": "application/json; charset=utf-8",
-                ...(options.token ? { authorization: `Bearer ${options.token}` } : {}),
-            },
-            body: JSON.stringify(body),
-            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-        });
-        raw = await response.text();
-    }
-    catch (error) {
-        throw new Error(`Slack ${method} request failed before receiving a response`, { cause: error });
-    }
-    let data;
-    try {
-        data = JSON.parse(raw);
-    }
-    catch {
-        throw new Error(`Slack ${method} failed: HTTP ${response.status} returned non-JSON`);
-    }
-    if (!response.ok || data.ok !== true) {
-        throw new SlackConfigApiError(method, response.status, data, raw.trim().slice(0, 200) || "unknown_error");
-    }
-    return data;
-}
-/** Single-attempt BY DESIGN: an ambiguous response may already have created the app, so this never retries itself. */
-export async function createSlackApp(configToken, manifest, options = {}) {
-    const data = await slackJson("apps.manifest.create", { manifest: JSON.stringify(manifest) }, { ...options, token: configToken });
-    const credentials = data.credentials;
-    if (!data.app_id || !credentials?.client_id || !credentials.client_secret || !credentials.signing_secret) {
-        throw new Error("Slack apps.manifest.create succeeded but returned incomplete app credentials");
-    }
-    return {
-        appId: data.app_id,
-        clientId: credentials.client_id,
-        clientSecret: credentials.client_secret,
-        signingSecret: credentials.signing_secret,
-        oauthAuthorizeUrl: data.oauth_authorize_url,
-    };
-}
-export async function updateSlackAppManifest(configToken, appId, manifest, options = {}) {
-    await slackJson("apps.manifest.update", { app_id: appId, manifest: JSON.stringify(manifest) }, { ...options, token: configToken });
-}
-export async function rotateSlackConfigToken(refreshToken, options = {}) {
-    const data = await slackJson("tooling.tokens.rotate", { refresh_token: refreshToken }, options);
-    if (!data.token || !data.refresh_token || typeof data.exp !== "number") {
-        throw new Error("Slack tooling.tokens.rotate succeeded but returned incomplete token credentials");
-    }
-    return {
-        token: data.token,
-        refreshToken: data.refresh_token,
-        expiresAt: data.exp * 1000,
-        teamId: data.team_id,
-    };
-}
-function slackOAuthFailure(status, code) {
-    const reason = (() => {
-        switch (code) {
-            case "bad_client_secret":
-                return "Slack rejected the app client secret";
-            case "invalid_client_id":
-                return "Slack rejected the app client ID";
-            case "bad_redirect_uri":
-            case "invalid_redirect_uri":
-                return "Slack rejected the temporary OAuth redirect URL";
-            case "invalid_code":
-                return "Slack rejected the authorization code";
-            case "code_already_used":
-                return "the Slack authorization code was already used";
-            case "access_denied":
-                return "the Slack installation was not approved";
-            default:
-                return "Slack rejected the OAuth exchange";
-        }
-    })();
-    return new Error(`${reason} (HTTP ${status}); re-run fastagent add slack to resume installation`);
-}
-export async function exchangeSlackOAuthCode(input, options = {}) {
-    const authorization = Buffer.from(`${input.clientId}:${input.clientSecret}`, "utf8").toString("base64");
-    const fetchFn = options.fetch ?? globalThis.fetch;
-    let response;
-    let raw;
-    try {
-        response = await fetchFn(`${options.apiBaseUrl ?? SLACK_API}/oauth.v2.access`, {
-            method: "POST",
-            headers: {
-                authorization: `Basic ${authorization}`,
-                "content-type": "application/x-www-form-urlencoded",
-            },
-            body: new URLSearchParams({ code: input.code, redirect_uri: input.redirectUrl }).toString(),
-            signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
-        });
-        raw = await response.text();
-    }
-    catch (error) {
-        throw new Error("Slack oauth.v2.access request failed before receiving a response", { cause: error });
-    }
-    let data;
-    try {
-        data = JSON.parse(raw);
-    }
-    catch {
-        throw new Error(`Slack oauth.v2.access failed: HTTP ${response.status} returned non-JSON`);
-    }
-    if (!response.ok || data.ok !== true)
-        throw slackOAuthFailure(response.status, data.error);
-    if (!data.access_token || !data.app_id || !data.team?.id) {
-        throw new Error("Slack oauth.v2.access succeeded but returned incomplete bot credentials/app identity");
-    }
-    return {
-        botToken: data.access_token,
-        appId: data.app_id,
-        teamId: data.team.id,
-        teamName: data.team.name,
-        botUserId: data.bot_user_id,
-        scopes: (data.scope ?? "")
-            .split(",")
-            .map((scope) => scope.trim())
-            .filter(Boolean),
-    };
-}

package/dist/channels/slack/onboard.d.ts

@@ -1,40 +0,0 @@
-import { createSlackApp, exchangeSlackOAuthCode, updateSlackAppManifest } from "./config-api.ts";
-import { type SlackOnboardingState } from "./onboarding-state.ts";
-export interface SlackOnboardIO {
-    note(message: string): void;
-    openUrl(url: string): void;
-    /** Wait for the one OAuth redirect. */
-    waitForOAuth(): Promise<{
-        code?: string;
-        state?: string;
-        error?: string;
-    }>;
-    /** Stage the runtime secrets into the gitignored .env. */
-    writeRuntimeSecrets(values: {
-        botToken?: string;
-        signingSecret?: string;
-    }): Promise<void>;
-}
-export interface SlackOnboardInput {
-    stateRoot: string;
-    state: SlackOnboardingState;
-    requestUrl: string;
-    redirectUrl: string;
-}
-/** Create/resume one internal Slack app and complete its workspace OAuth installation. */
-export declare function onboardSlackApp(input: SlackOnboardInput, io: SlackOnboardIO, deps?: {
-    createApp?: typeof createSlackApp;
-    updateManifest?: typeof updateSlackAppManifest;
-    exchangeCode?: typeof exchangeSlackOAuthCode;
-    /** Attempts absorbing the setup tunnel's warm-up before Slack can verify its URL. */
-    attempts?: number;
-    retryMs?: number;
-}): Promise<SlackOnboardingState>;
-export declare function newSlackOnboardingState(input: {
-    appName: string;
-    configToken: string;
-    configRefreshToken: string;
-    /** When the pair was captured; pass it through rather than re-deriving the same expiry twice. */
-    configTokenExpiresAt?: number;
-    now?: number;
-}): SlackOnboardingState;

package/dist/channels/slack/onboard.js

@@ -1,136 +0,0 @@
-import { randomBytes } from "node:crypto";
-import { retryWhile } from "../registration.js";
-import { createSlackApp, exchangeSlackOAuthCode, isSlackRequestUrlUnverified, isSlackRotationLocked, SLACK_ROTATING_APP_REMEDY, SlackConfigApiError, updateSlackAppManifest, } from "./config-api.js";
-import { buildSlackManifest, slackBotScopes } from "./manifest.js";
-import { configTokenExpiry, currentSlackConfigToken, writeSlackOnboardingState, } from "./onboarding-state.js";
-/** Create/resume one internal Slack app and complete its workspace OAuth installation. */
-export async function onboardSlackApp(input, io, deps = {}) {
-    let state = input.state;
-    const current = await currentSlackConfigToken(input.stateRoot, state);
-    state = current.state;
-    /**
-     * Slack challenges request_url from ITS network during a manifest call and validates the whole manifest before
-     * acting, so an unverifiable URL created nothing and the call is safe to repeat.
-     */
-    const whileUnverified = (call, onRetry) => retryWhile(call, isSlackRequestUrlUnverified, {
-        attempts: deps.attempts,
-        retryMs: deps.retryMs,
-        onRetry: ({ attempt, attempts }) => {
-            onRetry?.();
-            io.note(`Slack cannot reach the temporary setup URL yet (attempt ${attempt}/${attempts}); retrying…`);
-        },
-    });
-    const manifest = buildSlackManifest({
-        name: state.appName,
-        requestUrl: input.requestUrl,
-        redirectUrl: input.redirectUrl,
-    });
-    if (!state.appId) {
-        if (state.createAttemptedAt) {
-            throw new Error(`a Slack app creation request started at ${state.createAttemptedAt}, but no app ID was returned. ` +
-                "Inspect https://api.slack.com/apps before retrying; if an app exists, delete that incomplete app first, then remove the local Slack onboarding state and re-run");
-        }
-        io.note("Creating the internal Slack app from its FastAgent manifest…");
-        const setMarker = (value) => {
-            state = { ...state, createAttemptedAt: value };
-            writeSlackOnboardingState(input.stateRoot, state);
-        };
-        let created;
-        try {
-            created = await whileUnverified(() => {
-                // Record BEFORE the non-idempotent API call.
-                setMarker(new Date().toISOString());
-                return (deps.createApp ?? createSlackApp)(current.token, manifest);
-            }, () => setMarker(undefined));
-        }
-        catch (error) {
-            const ambiguous = !(error instanceof SlackConfigApiError) ||
-                ["fatal_error", "internal_error", "request_timeout", "service_unavailable", "failed_creating_app"].includes(error.code);
-            if (!ambiguous)
-                setMarker(undefined);
-            throw error;
-        }
-        state = {
-            ...state,
-            appId: created.appId,
-            createAttemptedAt: undefined,
-            clientId: created.clientId,
-            clientSecret: created.clientSecret,
-            signingSecret: created.signingSecret,
-        };
-        // Irreversible boundary first: a cancellation or .env write failure can resume without creating a duplicate.
-        writeSlackOnboardingState(input.stateRoot, state);
-        io.note(`Created Slack app ${created.appId}; credentials captured locally.`);
-    }
-    else {
-        if (!state.clientId || !state.clientSecret) {
-            throw new Error(`Slack app ${state.appId} exists but OAuth client credentials are no longer available — ` +
-                "the app appears already installed; set SLACK_BOT_TOKEN/SLACK_SIGNING_SECRET in .env or remove the app and onboarding state to start over");
-        }
-        const appId = state.appId;
-        io.note(`Resuming Slack app ${appId}; refreshing its temporary setup URLs…`);
-        try {
-            await whileUnverified(() => (deps.updateManifest ?? updateSlackAppManifest)(current.token, appId, manifest));
-        }
-        catch (error) {
-            // A resume of an app created with rotation on: the manifest is refused for good, so say what fixes it.
-            if (isSlackRotationLocked(error))
-                throw new Error(SLACK_ROTATING_APP_REMEDY, { cause: error });
-            throw error;
-        }
-    }
-    if (state.signingSecret) {
-        await io.writeRuntimeSecrets({ signingSecret: state.signingSecret });
-        state = { ...state, signingSecret: undefined };
-        writeSlackOnboardingState(input.stateRoot, state);
-    }
-    if (!state.appId || !state.clientId || !state.clientSecret) {
-        throw new Error("Slack onboarding state lost app OAuth credentials before installation");
-    }
-    const oauthState = randomBytes(24).toString("hex");
-    const authorize = new URL("https://slack.com/oauth/v2/authorize");
-    authorize.searchParams.set("client_id", state.clientId);
-    authorize.searchParams.set("scope", slackBotScopes().join(","));
-    authorize.searchParams.set("redirect_uri", input.redirectUrl);
-    authorize.searchParams.set("state", oauthState);
-    // The redirect lands on the tunnel hostname, which THIS machine may not resolve yet (#421).
-    io.note(`Click Allow in Slack to install the app: ${authorize}\nIf the page it returns to does not load, reload it.`);
-    io.openUrl(authorize.toString());
-    const callback = await io.waitForOAuth();
-    if (callback.error)
-        throw new Error("Slack OAuth installation was not approved");
-    if (!callback.code)
-        throw new Error("Slack OAuth callback carried no authorization code");
-    if (!callback.state || callback.state !== oauthState)
-        throw new Error("Slack OAuth callback state mismatch");
-    const oauth = await (deps.exchangeCode ?? exchangeSlackOAuthCode)({
-        clientId: state.clientId,
-        clientSecret: state.clientSecret,
-        code: callback.code,
-        redirectUrl: input.redirectUrl,
-    });
-    if (oauth.appId !== state.appId)
-        throw new Error("Slack OAuth installed a different app than the manifest app");
-    if (slackBotScopes().some((scope) => !oauth.scopes.includes(scope))) {
-        throw new Error("Slack OAuth completed without all required bot scopes; re-run fastagent add slack to reinstall");
-    }
-    await io.writeRuntimeSecrets({ botToken: oauth.botToken });
-    state = {
-        ...state,
-        clientSecret: undefined,
-        teamId: oauth.teamId,
-        teamName: oauth.teamName,
-        installedAt: new Date().toISOString(),
-    };
-    writeSlackOnboardingState(input.stateRoot, state);
-    return state;
-}
-export function newSlackOnboardingState(input) {
-    return {
-        version: 1,
-        appName: input.appName,
-        configToken: input.configToken,
-        configRefreshToken: input.configRefreshToken,
-        configTokenExpiresAt: input.configTokenExpiresAt ?? configTokenExpiry(input.now),
-    };
-}

package/dist/channels/slack/onboarding-state.d.ts

@@ -1,31 +0,0 @@
-/** When a token pair captured `now` stops being usable — the ONE place that answers it. */
-export declare function configTokenExpiry(now?: number): number;
-export interface SlackOnboardingState {
-    version: 1;
-    appName: string;
-    appId?: string;
-    /** Set before apps.manifest.create; without an appId it blocks blind duplicate-creation retries. */
-    createAttemptedAt?: string;
-    clientId?: string;
-    /** Kept only while OAuth installation is unfinished, then deleted. */
-    clientSecret?: string;
-    /** Kept only until it has been staged into .env, then deleted. */
-    signingSecret?: string;
-    configToken: string;
-    configRefreshToken: string;
-    configTokenExpiresAt: number;
-    teamId?: string;
-    teamName?: string;
-    installedAt?: string;
-}
-export declare function readSlackOnboardingState(stateRoot: string): SlackOnboardingState | undefined;
-/** Atomic replacement with owner-only permissions: this file carries a workspace-wide config refresh token. */
-export declare function writeSlackOnboardingState(stateRoot: string, state: SlackOnboardingState): void;
-export declare function currentSlackConfigToken(stateRoot: string, state: SlackOnboardingState, options?: {
-    now?: number;
-    apiBaseUrl?: string;
-    fetch?: typeof fetch;
-}): Promise<{
-    token: string;
-    state: SlackOnboardingState;
-}>;

package/dist/channels/slack/onboarding-state.js

@@ -1,64 +0,0 @@
-import { readFileSync } from "node:fs";
-import { join } from "node:path";
-import { writeFileAtomic } from "../../atomic-write.js";
-import { SECRET_FILE_MODE } from "../../paths.js";
-import { rotateSlackConfigToken } from "./config-api.js";
-/** Slack config access tokens expire in 12 hours; use 11h so registration rotates before the edge. */
-const CONFIG_TOKEN_TTL_MS = 11 * 60 * 60_000;
-/** When a token pair captured `now` stops being usable — the ONE place that answers it. */
-export function configTokenExpiry(now = Date.now()) {
-    return now + CONFIG_TOKEN_TTL_MS;
-}
-function slackOnboardingStatePath(stateRoot) {
-    return join(stateRoot, "channels", "slack", "onboarding.json");
-}
-function validState(value) {
-    const state = value;
-    return (typeof state === "object" &&
-        state !== null &&
-        state.version === 1 &&
-        typeof state.appName === "string" &&
-        typeof state.configToken === "string" &&
-        typeof state.configRefreshToken === "string" &&
-        typeof state.configTokenExpiresAt === "number");
-}
-export function readSlackOnboardingState(stateRoot) {
-    const file = slackOnboardingStatePath(stateRoot);
-    let raw;
-    try {
-        raw = readFileSync(file, "utf8");
-    }
-    catch (error) {
-        if (error.code === "ENOENT")
-            return undefined;
-        throw new Error(`cannot read Slack onboarding state ${file}: ${error.message}`);
-    }
-    try {
-        const value = JSON.parse(raw);
-        if (!validState(value))
-            throw new Error("unexpected shape/version");
-        return value;
-    }
-    catch (error) {
-        throw new Error(`invalid Slack onboarding state ${file}: ${error.message}`);
-    }
-}
-/** Atomic replacement with owner-only permissions: this file carries a workspace-wide config refresh token. */
-export function writeSlackOnboardingState(stateRoot, state) {
-    writeFileAtomic(slackOnboardingStatePath(stateRoot), `${JSON.stringify(state, null, 2)}\n`, SECRET_FILE_MODE);
-}
-export async function currentSlackConfigToken(stateRoot, state, options = {}) {
-    const now = options.now ?? Date.now();
-    if (state.configTokenExpiresAt > now + 5 * 60_000)
-        return { token: state.configToken, state };
-    const rotated = await rotateSlackConfigToken(state.configRefreshToken, options);
-    const next = {
-        ...state,
-        configToken: rotated.token,
-        configRefreshToken: rotated.refreshToken,
-        configTokenExpiresAt: rotated.expiresAt,
-        teamId: state.teamId ?? rotated.teamId,
-    };
-    writeSlackOnboardingState(stateRoot, next);
-    return { token: next.configToken, state: next };
-}

package/dist/channels/slack/register-webhook.d.ts

@@ -1,12 +0,0 @@
-import { type RegistrationOutcome } from "../registration.ts";
-export interface RegisterSlackWebhookOptions {
-    stateRoot: string;
-    environment?: "dev" | "production";
-    log?: (message: string) => void;
-    attempts?: number;
-    retryMs?: number;
-    apiBaseUrl?: string;
-    fetch?: typeof fetch;
-}
-/** Update one onboarded internal Slack app without sending its configuration credential to the host. */
-export declare function registerSlackWebhook(baseUrl: string, options: RegisterSlackWebhookOptions): Promise<RegistrationOutcome>;

package/dist/channels/slack/register-webhook.js

@@ -1,67 +0,0 @@
-import { retryWhile } from "../registration.js";
-import { SLACK_ROTATING_APP_REMEDY, isSlackRequestUrlUnverified, isSlackRotationLocked, updateSlackAppManifest, } from "./config-api.js";
-import { buildSlackManifest } from "./manifest.js";
-import { currentSlackConfigToken, readSlackOnboardingState } from "./onboarding-state.js";
-/** Update one onboarded internal Slack app without sending its configuration credential to the host. */
-export async function registerSlackWebhook(baseUrl, options) {
-    const note = options.log ?? ((message) => console.error(message));
-    const publicBaseUrl = baseUrl.replace(/\/$/, "");
-    const add = `fastagent add slack${options.environment === "production" ? " --env production" : ""}`;
-    const repair = `${add} --replace-config`;
-    let state;
-    try {
-        state = readSlackOnboardingState(options.stateRoot);
-    }
-    catch (error) {
-        note(`[fastagent] slack: cannot read local onboarding state: ${String(error)}`);
-        return "failed";
-    }
-    if (!state?.appId || !state.installedAt) {
-        note(`[fastagent] slack: no completed local onboarding state on this machine — the config credential lives only where \`${add}\` ran. ` +
-            `Set Event Subscriptions → Request URL = ${publicBaseUrl}/slack manually in the Slack console, or re-run this command from the onboarding machine ` +
-            `(repair its expired/revoked tokens with \`${repair}\`)`);
-        return "manual";
-    }
-    const consoleFallback = `set ${publicBaseUrl}/slack as the Event Subscriptions Request URL in the Slack console`;
-    let current;
-    try {
-        // Rotation is not retried with the manifest below.
-        current = await currentSlackConfigToken(options.stateRoot, state, {
-            apiBaseUrl: options.apiBaseUrl,
-            fetch: options.fetch,
-        });
-    }
-    catch (error) {
-        note(`[fastagent] slack: could not refresh the App Configuration token: ${String(error)} — ` +
-            `re-run \`${repair}\` to repair it, or ${consoleFallback}`);
-        return "failed";
-    }
-    // Slack verifies the new request_url with a challenge DURING apps.manifest.update, from Slack's own network.
-    try {
-        await retryWhile(() => updateSlackAppManifest(current.token, current.state.appId, buildSlackManifest({
-            name: current.state.appName,
-            requestUrl: `${publicBaseUrl}/slack`,
-            // A manifest update replaces the whole manifest and redirect_urls may not be empty, so a placeholder is
-            // declared.
-            redirectUrl: `${publicBaseUrl}/slack/oauth/callback`,
-        }), { apiBaseUrl: options.apiBaseUrl, fetch: options.fetch }), isSlackRequestUrlUnverified, {
-            attempts: options.attempts,
-            retryMs: options.retryMs,
-            onRetry: ({ attempt, attempts }) => note(`[fastagent] slack: Slack cannot verify ${publicBaseUrl}/slack yet (attempt ${attempt}/${attempts}); retrying…`),
-        });
-        note(`[fastagent] slack: Event Subscriptions Request URL registered → ${publicBaseUrl}/slack`);
-        return "registered";
-    }
-    catch (error) {
-        if (isSlackRotationLocked(error)) {
-            note(`[fastagent] slack: ${SLACK_ROTATING_APP_REMEDY}, or ${consoleFallback}`);
-            return "failed";
-        }
-        note(isSlackRequestUrlUnverified(error)
-            ? `[fastagent] slack: Slack could not verify ${publicBaseUrl}/slack after retries (last error: ${String(error)}) — ` +
-                `once the app is up, ${consoleFallback}`
-            : `[fastagent] slack: automatic Request URL registration failed: ${String(error)} — ` +
-                `re-run \`${repair}\` to repair the configuration tokens, or ${consoleFallback}`);
-        return "failed";
-    }
-}

package/dist/channels/slack/setup-server.d.ts

@@ -1,32 +0,0 @@
-export interface SlackSetupServer {
-    port: number;
-    requestPath: string;
-    redirectPath: string;
-    /**
-     * The page a person pastes an App Configuration token pair on, for a setup a coding agent runs: the pair never
-     * passes through the agent's conversation or any file. Its path is the server's secret, like the OAuth redirect's.
-     */
-    tokensPath: string;
-    /** The pair, once one `check` accepts is pasted; what `check` throws is shown on the page, which stays up. */
-    waitForTokens<T>(check: (pair: {
-        access: string;
-        refresh: string;
-    }) => T): Promise<T>;
-    /** Where the browser that pasted the pair goes next: Slack's install page. */
-    next(url: string): void;
-    /**
-     * Why the setup stopped, for a browser waiting on the page after the pair: resolves once it has been shown, at once
-     * when no browser waits there, or after one refresh window, so a setup can stop without leaving it on a dead page.
-     */
-    failed(message: string): Promise<void>;
-    /** What the setup did, for a browser waiting on that page when the setup ends there (a saved pair replaced), as `failed`. */
-    done(message: string): Promise<void>;
-    waitForOAuth(timeoutMs?: number): Promise<{
-        code?: string;
-        state?: string;
-        error?: string;
-    }>;
-    close(): Promise<void>;
-}
-/** Temporary onboarding-only responder. */
-export declare function startSlackSetupServer(): Promise<SlackSetupServer>;