@hostwebhook/node-types 1.69.0 → 1.71.0

package/dist/esm/shopify-operations.js

@@ -0,0 +1,259 @@
+/**
+ * Shopify Admin API operations — single source of truth across the api, the
+ * dashboard and downstream consumers (MCP server).
+ *
+ * ## Four, out of several hundred
+ *
+ * The Admin API has hundreds of mutations. This node exposes four, and the
+ * choice is argued in `api/docs/ADR-0007-shopify.md`: a menu of everything is
+ * how a node becomes unusable, and these four cover what people actually
+ * automate — put a customer in the store, tag something, sync stock, and read
+ * back what the store already knows.
+ *
+ * Product creation and order fulfilment were considered and left out of v1.
+ * A product means variants, media and prices; a fulfilment means a location, a
+ * fulfilment service and a state machine. Each is a configuration surface of
+ * its own, not a field.
+ *
+ * ## GraphQL only, and the version is not ours to drift on
+ *
+ * REST went legacy in October 2024 and public apps have been GraphQL-only
+ * since April 2025, so there is no REST path here to fall back to. Every
+ * `apiRoute` below is a GraphQL mutation or query name, checkable against
+ * `shopify.dev/docs/api/admin-graphql`. The API version lives in ONE constant
+ * on the api side (`SHOPIFY_API_VERSION`) — never interpolated per call site.
+ *
+ * ## What was verified, and what was not (2026-08-25)
+ *
+ * Checked against the Admin GraphQL reference, not from memory:
+ *
+ * - `tagsAdd(id: ID!, tags: [String!]!)` and `tagsRemove` with the same
+ *   shape. Both accept Order, DraftOrder, Customer, Product, Article and
+ *   DiscountNode.
+ * - `customerCreate(input: CustomerInput!)` and `customerUpdate(input:
+ *   CustomerInput!)` — for the update, **the id goes inside the input**, not
+ *   as a sibling argument.
+ * - `inventoryAdjustQuantities(input: InventoryAdjustQuantitiesInput!)`, whose
+ *   input requires `reason`, `name` and a `changes[]` of
+ *   `{ delta, inventoryItemId, locationId }`.
+ *
+ * ⚠️ **NOT verified, and deliberately left loose below** — do not turn either
+ * into a hard-coded dropdown until someone reads the enumeration:
+ *
+ * - The full vocabulary of `reason`. Only `"correction"` is documented by
+ *   example.
+ * - The full vocabulary of `name`. Only `"available"` is documented by
+ *   example; the docs mention `on_hand` moving as a consequence, which is not
+ *   the same as it being a valid input.
+ * - The exact search syntax for finding a customer by email
+ *   (`customers(query: "email:…")`). It is the obvious shape and almost
+ *   certainly right, which is exactly why it is worth confirming rather than
+ *   assuming.
+ *
+ * ⚠️ **`@idempotent` is mandatory.** As of API version 2026-04,
+ * `inventoryAdjustQuantities` must be sent with the `@idempotent` directive
+ * and an idempotency key. A stock adjustment is the one operation here where a
+ * silent retry is a real inventory error, so this is not boilerplate.
+ */
+export const SHOPIFY_OPERATIONS = [
+    'upsertCustomer',
+    'setTags',
+    'adjustInventory',
+    'findRecords',
+];
+/** Type guard — for DTOs and AI tool calls, where the input is untrusted. */
+export function isShopifyOperation(value) {
+    return (typeof value === 'string' &&
+        SHOPIFY_OPERATIONS.includes(value));
+}
+/**
+ * The resources `tagsAdd` / `tagsRemove` accept. Taken from the mutation
+ * reference — this list is the API's, not a subset we chose.
+ *
+ * `article` and `discountNode` are left out of the node's own picker on
+ * purpose: neither is something a HostWebhook flow tags in practice, and every
+ * extra option is a field the user has to read past.
+ */
+export const SHOPIFY_TAGGABLE_RESOURCES = [
+    'order',
+    'customer',
+    'product',
+    'draftOrder',
+];
+/** What `findRecords` can read back. */
+export const SHOPIFY_SEARCHABLE_RESOURCES = [
+    'orders',
+    'customers',
+    'products',
+];
+export const SHOPIFY_OPERATION_SPECS = {
+    upsertCustomer: {
+        label: 'Add or update customer',
+        description: 'Look the customer up by email, then create them or update the fields you set.',
+        apiRoute: 'mutation customerCreate / customerUpdate (lookup by email first)',
+        params: [
+            {
+                name: 'email',
+                label: 'Email address',
+                type: 'email',
+                required: true,
+                description: 'Identifies the customer. This is what decides between creating and updating — there is no separate "id" to keep.',
+                placeholder: '{{payload.email}}',
+            },
+            {
+                name: 'firstName',
+                label: 'First name',
+                type: 'string',
+                description: 'Left untouched on an existing customer if you leave it empty.',
+                placeholder: '{{payload.firstName}}',
+            },
+            {
+                name: 'lastName',
+                label: 'Last name',
+                type: 'string',
+                description: 'Left untouched on an existing customer if you leave it empty.',
+                placeholder: '{{payload.lastName}}',
+            },
+            {
+                name: 'phone',
+                label: 'Phone',
+                type: 'string',
+                description: 'Shopify wants it in E.164 (+52…). A malformed number fails the whole mutation, not just the field.',
+            },
+            {
+                name: 'tags',
+                label: 'Tags',
+                type: 'tags',
+                description: 'Tags to set on the customer. Note these REPLACE the customer tags — to add without losing the existing ones, use the tag operation instead.',
+            },
+            {
+                name: 'note',
+                label: 'Note',
+                type: 'string',
+                description: 'Internal note, visible to staff in the Shopify admin.',
+            },
+            {
+                name: 'emailMarketingConsent',
+                label: 'Email marketing consent',
+                type: 'json',
+                description: 'Leave this EMPTY unless the customer actually consented. Omitting it leaves their consent exactly as it was; writing a subscribed state for someone who never opted in is a legal problem, not a technical one. Shape: {"marketingState":"SUBSCRIBED","marketingOptInLevel":"SINGLE_OPT_IN"}.',
+            },
+        ],
+    },
+    setTags: {
+        label: 'Add or remove tags',
+        description: 'Tag an order, a customer or a product. Adding and removing are separate calls, so one node does one of the two.',
+        apiRoute: 'mutation tagsAdd / tagsRemove',
+        params: [
+            {
+                name: 'resource',
+                label: 'What to tag',
+                type: 'taggableResource',
+                required: true,
+                description: 'Shopify tags many resource types through the same mutation; this only picks which id you are passing.',
+            },
+            {
+                name: 'resourceId',
+                label: 'Resource id',
+                type: 'gid',
+                required: true,
+                description: 'The Shopify global id, e.g. gid://shopify/Order/1234. A Shopify trigger gives you this directly in the payload.',
+                placeholder: '{{payload.admin_graphql_api_id}}',
+            },
+            {
+                name: 'tags',
+                label: 'Tags',
+                type: 'tags',
+                required: true,
+                description: 'One or more tags.',
+            },
+            {
+                name: 'remove',
+                label: 'Remove instead of add',
+                type: 'boolean',
+                description: 'Off adds the tags (tagsAdd); on removes them (tagsRemove). Unlike Mailchimp, Shopify cannot do both in one call.',
+            },
+        ],
+    },
+    adjustInventory: {
+        label: 'Adjust inventory',
+        description: 'Move stock by a delta at one location. For the case where the real stock lives in another system.',
+        apiRoute: 'mutation inventoryAdjustQuantities',
+        params: [
+            {
+                name: 'inventoryItemId',
+                label: 'Inventory item id',
+                type: 'gid',
+                required: true,
+                description: 'gid://shopify/InventoryItem/1234. This is the inventory item, NOT the product or the variant — a variant points at one.',
+                placeholder: '{{payload.inventory_item_id}}',
+            },
+            {
+                name: 'locationId',
+                label: 'Location',
+                type: 'location',
+                required: true,
+                description: 'Which location the stock moves at. A store with one location still has to name it.',
+            },
+            {
+                name: 'delta',
+                label: 'Change by',
+                type: 'number',
+                required: true,
+                description: 'A DELTA, not a total. 5 adds five units and -5 removes five. Sending the absolute stock level here is the mistake that silently multiplies inventory.',
+                placeholder: '{{payload.delta}}',
+            },
+            {
+                name: 'name',
+                label: 'Quantity type',
+                type: 'string',
+                required: true,
+                description: 'Which quantity is being changed. "available" is the documented value; check the reference before using another.',
+                placeholder: 'available',
+            },
+            {
+                name: 'reason',
+                label: 'Reason',
+                type: 'string',
+                required: true,
+                description: 'Why the stock moved — it lands in the store\'s inventory history. "correction" is the documented value; check the reference before using another.',
+                placeholder: 'correction',
+            },
+            {
+                name: 'referenceDocumentUri',
+                label: 'Reference',
+                type: 'string',
+                description: 'Optional audit-trail link back to whatever caused the change, so someone reading Shopify\'s inventory history can find it.',
+            },
+        ],
+    },
+    findRecords: {
+        label: 'Find orders, customers or products',
+        description: 'Read back what the store knows, to enrich a payload that came from somewhere else.',
+        apiRoute: 'query orders / customers / products (with search syntax)',
+        params: [
+            {
+                name: 'resource',
+                label: 'What to look for',
+                type: 'searchableResource',
+                required: true,
+                description: 'Which collection to search.',
+            },
+            {
+                name: 'query',
+                label: 'Search',
+                type: 'string',
+                required: true,
+                description: 'Shopify search syntax, e.g. email:someone@example.com or financial_status:paid. Empty would return the newest records, which is rarely what anyone means.',
+                placeholder: 'email:{{payload.email}}',
+            },
+            {
+                name: 'first',
+                label: 'How many',
+                type: 'number',
+                description: 'Defaults to 1, which is the enrichment case. Asking for many costs more against the query-cost budget, not more calls.',
+                placeholder: '1',
+            },
+        ],
+    },
+};

package/dist/esm/slack-operations.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Slack Web API operation enum — single source of truth across the
+ * api, dashboard, and downstream consumers (Message Broker, MCP server).
+ * Used by:
+ *   - slackAction entity / DTO (api): operation field + validation
+ *   - dashboard SlackAction operation picker + form generation
+ *   - MCP toolkit-specs expansion (one aiEnabled slackAction → N tools)
+ *
+ * v1 covers 16 ops — messaging, channel CRUD, members, reactions, files.
+ * Future additions (pin / unpin, files.list, conversations.archive, app
+ * publish, scheduled.list, etc.) extend this list — bump the package and
+ * re-install in consumers, same pattern as Gmail / Calendar / Discord.
+ */
+import { type CapacidadesPorCredencial } from './capacidad-de-credencial.js';
+export declare const SLACK_OPERATIONS: readonly ["sendMessage", "updateMessage", "deleteMessage", "sendEphemeral", "scheduleMessage", "getMessage", "listChannels", "getChannelHistory", "getThreadReplies", "createChannel", "inviteToChannel", "addReaction", "removeReaction", "listUsers", "getUserInfo", "uploadFile"];
+export type SlackOperation = (typeof SLACK_OPERATIONS)[number];
+/** Type guard — useful when validating untrusted input (DTOs, AI tool calls). */
+export declare function isSlackOperation(value: unknown): value is SlackOperation;
+/**
+ * Per-operation parameter schema. Drives:
+ *   1. Form auto-generation in the SlackAction detail page (dashboard).
+ *   2. AI tool argument schema when `aiEnabled === true`.
+ *   3. MCP tools/list expansion (one slackAction → N MCP tools).
+ *
+ * Field types kept narrow on purpose so the dashboard form picker can
+ * render the right control (channel-picker vs free text vs number).
+ * The api side `SlackOperationsService` accepts the same shapes.
+ */
+export interface SlackParamSpec {
+    /** Field key — also the property name on operationConfig / payload. */
+    name: string;
+    /** UI label. */
+    label: string;
+    /** Param type for form rendering + AI tool schema. */
+    type: 'channel' | 'user' | 'string' | 'text' | 'number' | 'boolean' | 'emoji' | 'blocks' | 'json' | 'fileUrl';
+    /** Required at submit time. */
+    required?: boolean;
+    /** Human description — also used as the AI tool param description. */
+    description: string;
+    /** Hint shown under the input. */
+    placeholder?: string;
+}
+export interface SlackOperationSpec {
+    /** UI label for the operation picker. */
+    label: string;
+    /** Description shown in the picker + reused by the AI tool description
+     *  when the user hasn't set a custom one on the entity. */
+    description: string;
+    /** Verb the operation maps to in Slack's docs (slack.com/methods/...). */
+    apiMethod: string;
+    /** Parameter schema. Order matters for form rendering. */
+    params: SlackParamSpec[];
+}
+export declare const SLACK_OPERATION_SPECS: Record<SlackOperation, SlackOperationSpec>;
+/**
+ * Lo que puede hacer una credencial de Slack que NO es OAuth.
+ *
+ * Medido contra la documentación de Slack, no de memoria:
+ * https://docs.slack.dev/messaging/sending-messages-using-incoming-webhooks
+ *
+ * Es el caso extremo, y conviene que se lea así de crudo: **una** operación de
+ * las 16. Un incoming webhook publica y nada más. Textualmente: «Incoming
+ * webhooks do not allow you to delete a message after it's been posted», no
+ * lee, no sube ficheros, y editar exige `chat.update`, que es token.
+ *
+ * Y el campo que se cae es el que más duele, porque no parece una restricción
+ * hasta que lo es: **`channel` no se puede elegir**. «You cannot override the
+ * default channel (chosen by the user who installed your app)». El destino se
+ * decide al crear la credencial, así que ofrecer el campo sería ofrecer una
+ * pregunta cuya respuesta se ignora — que es peor que no ofrecerla.
+ *
+ * `text` y `blocks` se quedan (Block Kit está soportado), y `threadTs` también:
+ * la doc lo admite si ya tienes el `ts` del padre por otra vía.
+ */
+export declare const SLACK_CAPACIDADES_POR_CREDENCIAL: CapacidadesPorCredencial<SlackOperation>;
+/** Las operaciones que ofrecer para una credencial de Slack. */
+export declare function operacionesDeSlackPara(tipoDeCredencial: string | null | undefined): readonly SlackOperation[];
+/** Si esa credencial puede ejecutar esa operación de Slack. */
+export declare function slackPuedeEjecutar(tipoDeCredencial: string | null | undefined, operacion: SlackOperation): boolean;
+/** Los campos que esa credencial de Slack no deja elegir. */
+export declare function camposDeSlackNoDisponibles(tipoDeCredencial: string | null | undefined): ReadonlySet<string>;

package/dist/esm/slack-operations.js

@@ -0,0 +1,244 @@
+/**
+ * Slack Web API operation enum — single source of truth across the
+ * api, dashboard, and downstream consumers (Message Broker, MCP server).
+ * Used by:
+ *   - slackAction entity / DTO (api): operation field + validation
+ *   - dashboard SlackAction operation picker + form generation
+ *   - MCP toolkit-specs expansion (one aiEnabled slackAction → N tools)
+ *
+ * v1 covers 16 ops — messaging, channel CRUD, members, reactions, files.
+ * Future additions (pin / unpin, files.list, conversations.archive, app
+ * publish, scheduled.list, etc.) extend this list — bump the package and
+ * re-install in consumers, same pattern as Gmail / Calendar / Discord.
+ */
+import { camposNoDisponiblesPara, operacionesPara, puedeEjecutar, } from './capacidad-de-credencial.js';
+export const SLACK_OPERATIONS = [
+    // Messages
+    'sendMessage',
+    'updateMessage',
+    'deleteMessage',
+    'sendEphemeral',
+    'scheduleMessage',
+    'getMessage',
+    // Channels
+    'listChannels',
+    'getChannelHistory',
+    'getThreadReplies',
+    'createChannel',
+    'inviteToChannel',
+    // Reactions
+    'addReaction',
+    'removeReaction',
+    // Users
+    'listUsers',
+    'getUserInfo',
+    // Files
+    'uploadFile',
+];
+/** Type guard — useful when validating untrusted input (DTOs, AI tool calls). */
+export function isSlackOperation(value) {
+    return (typeof value === 'string' &&
+        SLACK_OPERATIONS.includes(value));
+}
+export const SLACK_OPERATION_SPECS = {
+    sendMessage: {
+        label: 'Send message',
+        description: 'Post a message to a channel, group, or DM.',
+        apiMethod: 'chat.postMessage',
+        params: [
+            { name: 'channel', label: 'Channel', type: 'channel', required: true, description: 'Channel id (C…) or DM id (D…) where the message will be posted.' },
+            { name: 'text', label: 'Text', type: 'text', description: 'Message text. Supports Slack mrkdwn. Required when blocks is empty.' },
+            { name: 'blocks', label: 'Blocks (optional)', type: 'blocks', description: 'Slack Block Kit JSON for rich layouts. Overrides text rendering when set.' },
+            { name: 'threadTs', label: 'Thread ts (optional)', type: 'string', description: 'When set, the message replies inside an existing thread. Use the parent message timestamp.' },
+        ],
+    },
+    updateMessage: {
+        label: 'Update message',
+        description: 'Edit a message the bot posted earlier.',
+        apiMethod: 'chat.update',
+        params: [
+            { name: 'channel', label: 'Channel', type: 'channel', required: true, description: 'Channel where the original message lives.' },
+            { name: 'ts', label: 'Message ts', type: 'string', required: true, description: 'Timestamp of the message to edit (returned by sendMessage).' },
+            { name: 'text', label: 'New text', type: 'text', description: 'Replacement text. Required when blocks is empty.' },
+            { name: 'blocks', label: 'New blocks (optional)', type: 'blocks', description: 'Replacement Block Kit layout.' },
+        ],
+    },
+    deleteMessage: {
+        label: 'Delete message',
+        description: 'Delete a message the bot posted earlier.',
+        apiMethod: 'chat.delete',
+        params: [
+            { name: 'channel', label: 'Channel', type: 'channel', required: true, description: 'Channel where the message lives.' },
+            { name: 'ts', label: 'Message ts', type: 'string', required: true, description: 'Timestamp of the message to delete.' },
+        ],
+    },
+    sendEphemeral: {
+        label: 'Send ephemeral',
+        description: 'Post a message visible only to a single user (the rest of the channel does not see it).',
+        apiMethod: 'chat.postEphemeral',
+        params: [
+            { name: 'channel', label: 'Channel', type: 'channel', required: true, description: 'Channel where the ephemeral message will appear.' },
+            { name: 'user', label: 'User', type: 'user', required: true, description: 'User id (U…) — only this user sees the message.' },
+            { name: 'text', label: 'Text', type: 'text', description: 'Message text. Required when blocks is empty.' },
+            { name: 'blocks', label: 'Blocks (optional)', type: 'blocks', description: 'Block Kit layout.' },
+        ],
+    },
+    scheduleMessage: {
+        label: 'Schedule message',
+        description: 'Schedule a message to be posted at a future time.',
+        apiMethod: 'chat.scheduleMessage',
+        params: [
+            { name: 'channel', label: 'Channel', type: 'channel', required: true, description: 'Channel where the scheduled message will be posted.' },
+            { name: 'postAt', label: 'Post at (unix sec)', type: 'number', required: true, description: 'When Slack should post the message — unix timestamp in seconds.' },
+            { name: 'text', label: 'Text', type: 'text', description: 'Message text. Required when blocks is empty.' },
+            { name: 'blocks', label: 'Blocks (optional)', type: 'blocks', description: 'Block Kit layout.' },
+        ],
+    },
+    getMessage: {
+        label: 'Get message',
+        description: 'Fetch a single message by its timestamp.',
+        apiMethod: 'conversations.history',
+        params: [
+            { name: 'channel', label: 'Channel', type: 'channel', required: true, description: 'Channel where the message lives.' },
+            { name: 'ts', label: 'Message ts', type: 'string', required: true, description: 'Timestamp of the message to fetch.' },
+        ],
+    },
+    listChannels: {
+        label: 'List channels',
+        description: 'List public + private channels the bot can see in the workspace.',
+        apiMethod: 'conversations.list',
+        params: [
+            { name: 'limit', label: 'Limit', type: 'number', description: 'Max channels to return (1-1000). Default 200.' },
+            { name: 'excludeArchived', label: 'Exclude archived', type: 'boolean', description: 'Hide archived channels. Default true.' },
+        ],
+    },
+    getChannelHistory: {
+        label: 'Get channel history',
+        description: 'Read recent messages from a channel.',
+        apiMethod: 'conversations.history',
+        params: [
+            { name: 'channel', label: 'Channel', type: 'channel', required: true, description: 'Channel to read from.' },
+            { name: 'limit', label: 'Limit', type: 'number', description: 'Max messages to return (1-200). Default 50.' },
+            { name: 'oldest', label: 'Oldest ts', type: 'string', description: 'Only messages after this timestamp.' },
+            { name: 'latest', label: 'Latest ts', type: 'string', description: 'Only messages before this timestamp.' },
+        ],
+    },
+    getThreadReplies: {
+        label: 'Get thread replies',
+        description: 'Fetch replies to a thread.',
+        apiMethod: 'conversations.replies',
+        params: [
+            { name: 'channel', label: 'Channel', type: 'channel', required: true, description: 'Channel where the thread lives.' },
+            { name: 'ts', label: 'Parent ts', type: 'string', required: true, description: 'Timestamp of the thread parent message.' },
+            { name: 'limit', label: 'Limit', type: 'number', description: 'Max replies to return (1-1000). Default 100.' },
+        ],
+    },
+    createChannel: {
+        label: 'Create channel',
+        description: 'Create a new public or private channel.',
+        apiMethod: 'conversations.create',
+        params: [
+            { name: 'name', label: 'Name', type: 'string', required: true, description: 'Channel name (lowercase, no spaces, < 80 chars).' },
+            { name: 'isPrivate', label: 'Private', type: 'boolean', description: 'Create a private channel instead of public. Default false.' },
+        ],
+    },
+    inviteToChannel: {
+        label: 'Invite to channel',
+        description: 'Invite one or more users to a channel.',
+        apiMethod: 'conversations.invite',
+        params: [
+            { name: 'channel', label: 'Channel', type: 'channel', required: true, description: 'Channel id to invite users to.' },
+            { name: 'users', label: 'Users', type: 'string', required: true, description: 'Comma-separated user ids (U…) to invite.' },
+        ],
+    },
+    addReaction: {
+        label: 'Add reaction',
+        description: 'Add an emoji reaction to a message.',
+        apiMethod: 'reactions.add',
+        params: [
+            { name: 'channel', label: 'Channel', type: 'channel', required: true, description: 'Channel where the message lives.' },
+            { name: 'ts', label: 'Message ts', type: 'string', required: true, description: 'Timestamp of the message to react to.' },
+            { name: 'name', label: 'Emoji name', type: 'emoji', required: true, description: 'Emoji name without colons (e.g. thumbsup, white_check_mark).' },
+        ],
+    },
+    removeReaction: {
+        label: 'Remove reaction',
+        description: 'Remove an emoji reaction from a message.',
+        apiMethod: 'reactions.remove',
+        params: [
+            { name: 'channel', label: 'Channel', type: 'channel', required: true, description: 'Channel where the message lives.' },
+            { name: 'ts', label: 'Message ts', type: 'string', required: true, description: 'Timestamp of the message.' },
+            { name: 'name', label: 'Emoji name', type: 'emoji', required: true, description: 'Emoji name without colons.' },
+        ],
+    },
+    listUsers: {
+        label: 'List users',
+        description: 'List human members of the workspace (excludes deleted users + bots by default).',
+        apiMethod: 'users.list',
+        params: [
+            { name: 'limit', label: 'Limit', type: 'number', description: 'Max users to return (1-1000). Default 200.' },
+            { name: 'includeDeleted', label: 'Include deleted', type: 'boolean', description: 'Include deactivated users. Default false.' },
+            { name: 'includeBots', label: 'Include bots', type: 'boolean', description: 'Include bot users + app users. Default false.' },
+        ],
+    },
+    getUserInfo: {
+        label: 'Get user info',
+        description: 'Fetch a user profile (name, email, timezone, status).',
+        apiMethod: 'users.info',
+        params: [
+            { name: 'user', label: 'User', type: 'user', required: true, description: 'User id (U…) to look up.' },
+        ],
+    },
+    uploadFile: {
+        label: 'Upload file',
+        description: 'Upload a file (PDF, image, anything) and optionally share it in a channel.',
+        apiMethod: 'files.uploadV2',
+        params: [
+            { name: 'url', label: 'File URL', type: 'fileUrl', description: 'Public URL or HW file _file.downloadUrl that HW will fetch and re-upload.' },
+            { name: 'contentBase64', label: 'File content (base64)', type: 'text', description: 'Inline file content as base64 — alternative to url for small payloads.' },
+            { name: 'filename', label: 'Filename', type: 'string', description: 'Display name in Slack. Auto-derived from URL when omitted.' },
+            { name: 'channel', label: 'Channel (optional)', type: 'channel', description: 'Channel to share the uploaded file in.' },
+            { name: 'title', label: 'Title (optional)', type: 'string', description: 'Title shown above the file in Slack.' },
+            { name: 'initialComment', label: 'Initial comment (optional)', type: 'text', description: 'Message Slack posts together with the file.' },
+            { name: 'threadTs', label: 'Thread ts (optional)', type: 'string', description: 'Attach the file to an existing thread.' },
+        ],
+    },
+};
+/**
+ * Lo que puede hacer una credencial de Slack que NO es OAuth.
+ *
+ * Medido contra la documentación de Slack, no de memoria:
+ * https://docs.slack.dev/messaging/sending-messages-using-incoming-webhooks
+ *
+ * Es el caso extremo, y conviene que se lea así de crudo: **una** operación de
+ * las 16. Un incoming webhook publica y nada más. Textualmente: «Incoming
+ * webhooks do not allow you to delete a message after it's been posted», no
+ * lee, no sube ficheros, y editar exige `chat.update`, que es token.
+ *
+ * Y el campo que se cae es el que más duele, porque no parece una restricción
+ * hasta que lo es: **`channel` no se puede elegir**. «You cannot override the
+ * default channel (chosen by the user who installed your app)». El destino se
+ * decide al crear la credencial, así que ofrecer el campo sería ofrecer una
+ * pregunta cuya respuesta se ignora — que es peor que no ofrecerla.
+ *
+ * `text` y `blocks` se quedan (Block Kit está soportado), y `threadTs` también:
+ * la doc lo admite si ya tienes el `ts` del padre por otra vía.
+ */
+export const SLACK_CAPACIDADES_POR_CREDENCIAL = {
+    slack_webhook: {
+        operaciones: ['sendMessage'],
+        camposNoDisponibles: ['channel'],
+    },
+};
+/** Las operaciones que ofrecer para una credencial de Slack. */
+export function operacionesDeSlackPara(tipoDeCredencial) {
+    return operacionesPara(SLACK_OPERATIONS, SLACK_CAPACIDADES_POR_CREDENCIAL, tipoDeCredencial);
+}
+/** Si esa credencial puede ejecutar esa operación de Slack. */
+export function slackPuedeEjecutar(tipoDeCredencial, operacion) {
+    return puedeEjecutar(SLACK_OPERATIONS, SLACK_CAPACIDADES_POR_CREDENCIAL, tipoDeCredencial, operacion);
+}
+/** Los campos que esa credencial de Slack no deja elegir. */
+export function camposDeSlackNoDisponibles(tipoDeCredencial) {
+    return camposNoDisponiblesPara(SLACK_CAPACIDADES_POR_CREDENCIAL, tipoDeCredencial);
+}

package/dist/esm/slack-toolkit.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Slack AI Toolkit — las herramientas que un slackAction expone cuando
+ * `aiEnabled` está encendido.
+ *
+ * **Se escribe una sola vez.** Antes vivía dos veces: una copia en
+ * `dashboard/components/slack-actions/slack-operations-schemas.ts` y otra en
+ * `api/src/mcp-servers/toolkit-specs.ts`, las dos a mano y en repos distintos,
+ * así que ningún test podía compararlas. Es la octava y novena mudanza de esta
+ * serie; de las siete anteriores, la de Contacts salió de que una copia
+ * anunciara 15 herramientas y expusiera una.
+ *
+ * La deriva aquí era gorda: **14 de las 16 descripciones** diferían. Gana la de
+ * la api en todas —es sistemáticamente la más completa y es la que sirve el MCP
+ * hoy—, y una no era cosmética: en `deleteMessage` la api nombra el permiso que
+ * hace falta (`chat:write.public` + admin) y el dashboard sólo decía «admin
+ * perms». Operaciones, nombres de herramienta y parámetros sí coincidían.
+ *
+ * Los nombres llevan `_slack_` para no chocar con los de Telegram y Discord
+ * cuando un mismo AI Node tiene varios toolkits encendidos.
+ *
+ * La forma es la que ya consume `toolkitSpecToMcpTool` en la api, para que
+ * pueda usarse sin adaptador. Los textos van en inglés porque los lee el modelo
+ * y quien mire la lista de herramientas del servidor MCP.
+ */
+import type { SlackOperation } from './slack-operations.js';
+export interface SlackToolkitParameter {
+    name: string;
+    type: 'string' | 'number' | 'boolean';
+    description: string;
+    required: boolean;
+}
+export interface SlackToolkitSpec {
+    operation: SlackOperation;
+    /** Etiqueta corta de la fila en la lista de herramientas. */
+    label: string;
+    /** Nombre con el que el LLM llama a la herramienta. */
+    toolName: string;
+    /** Descripción (más reglas de uso) que ve el LLM. */
+    description: string;
+    parameters: SlackToolkitParameter[];
+    /** Operaciones irreversibles o que cambian privilegios. La capa MCP las
+     *  bloquea cuando el nodo de IA lleva `requireConfirmationForDestructive`,
+     *  salvo que la llamada traiga confirmación explícita. */
+    destructive?: boolean;
+}
+export declare const SLACK_TOOLKIT_SPECS: SlackToolkitSpec[];
+export declare const SLACK_TOOLKIT_BY_TOOL_NAME: Record<string, SlackToolkitSpec>;
+/**
+ * Las herramientas que ofrecerle al modelo con ESTA credencial.
+ *
+ * Gemelo de `herramientasDeDiscordPara`, y por la misma razón: los dos
+ * consumidores —la expansión MCP de la api y el selector del AI Node del
+ * dashboard— filtrarían por su cuenta y acabarían discrepando.
+ *
+ * En Slack el recorte es brutal y conviene verlo escrito: con un webhook el
+ * modelo pasa de **16 herramientas a una**, y esa una pierde el `channel`,
+ * porque el destino lo fijó quien instaló la credencial. Dejarle el campo sería
+ * invitarle a elegir un canal que Slack va a ignorar sin decir nada.
+ */
+export declare function herramientasDeSlackPara(tipoDeCredencial: string | null | undefined): SlackToolkitSpec[];