@intentface/latch-channels 0.9.1

package/dist/slack/manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/slack/manifest.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,kBAAkB;IACjC,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,UAoB5B,CAAC;AAyBF,2DAA2D;AAC3D,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA2ChF;AAED,qFAAqF;AACrF,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAG/E"}

package/dist/slack/manifest.js

@@ -0,0 +1,102 @@
+/**
+ * Generate the Slack **app manifest** for a single agent's dedicated app. Used
+ * both ways: posted to `apps.manifest.create` (config-token / "one-button"
+ * flow), or shown to the user with a "Create from manifest" deep-link (manual
+ * flow). One app per agent → its own bot user and @-handle.
+ */
+/** Bot scopes for the supported feature set (mentions, DMs, posting, status). */
+export const SLACK_BOT_SCOPES = [
+    "app_mentions:read",
+    "chat:write",
+    "chat:write.customize",
+    "im:history",
+    "im:read",
+    "im:write",
+    "channels:history",
+    // List public channels — pickers and the mirage sandbox's read-only /slack
+    // mount (its transport guard forces types=public_channel regardless).
+    "channels:read",
+    "groups:history",
+    // Membership checks on private channels for the requester-visibility gate
+    // (conversations.members). Listing stays public-only above.
+    "groups:read",
+    // Reserved for a later per-binding "auto-join public channels" opt-in —
+    // granted now so enabling it won't need a reinstall.
+    "channels:join",
+    "assistant:write",
+    "commands",
+];
+const BOT_SCOPES = SLACK_BOT_SCOPES;
+/**
+ * Slack's "short description" limit as the CREATE-APP WIZARD enforces it. The
+ * manifest reference documents 140 for `display_information.description`, but
+ * the wizard rejects a 124-char description as "too long" (observed live) and
+ * leaves its confirm button disabled until it fits — the app-listing limit of
+ * 100 is the one that actually gates creation. Trimmed at a word boundary so a
+ * long agent description doesn't get cut mid-word.
+ */
+const DESCRIPTION_MAX = 100;
+function trimDescription(text) {
+    if (text.length <= DESCRIPTION_MAX)
+        return text;
+    let cut = text.slice(0, DESCRIPTION_MAX - 1);
+    // Never end the cut on a high surrogate — slicing inside an astral pair
+    // (an emoji, say) would ship a lone surrogate in the manifest.
+    if (/[\uD800-\uDBFF]$/.test(cut))
+        cut = cut.slice(0, -1);
+    // Break at the LAST whitespace of any kind (newlines, tabs, NBSP — not just
+    // spaces), unless that would give up more than half the budget.
+    const lastWs = /\s\S*$/.exec(cut)?.index ?? -1;
+    return `${(lastWs > DESCRIPTION_MAX / 2 ? cut.slice(0, lastWs) : cut).trimEnd()}…`;
+}
+/** Build the Slack manifest object (JSON-serializable). */
+export function slackManifest(input) {
+    const name = input.displayName.slice(0, 35); // Slack app name limit.
+    return {
+        display_information: {
+            name,
+            description: trimDescription(input.description ?? `${name} on Latch`),
+        },
+        features: {
+            bot_user: { display_name: name, always_online: true },
+            // Agent Sessions (the "Agents" pane). Replaces the deprecated
+            // assistant_view (sunset Feb 2027); Slack treats the flip as ONE-WAY.
+            agent_view: { agent_description: `Chat with ${name}`.slice(0, 200) },
+        },
+        oauth_config: {
+            ...(input.redirectUrl ? { redirect_urls: [input.redirectUrl] } : {}),
+            scopes: { bot: BOT_SCOPES },
+        },
+        settings: {
+            event_subscriptions: {
+                request_url: input.requestUrl,
+                // message.channels/groups power thread-following (continue without
+                // re-@-mentioning); mentions still come via app_mention. Subscribing
+                // to agent_session_stopped is what makes the native Stop button
+                // appear; tokens_revoked/app_uninstalled let the host disable dead
+                // bindings instead of erroring forever.
+                bot_events: [
+                    "app_mention",
+                    "message.im",
+                    "message.channels",
+                    "message.groups",
+                    "app_home_opened",
+                    "app_context_changed",
+                    "agent_session_stopped",
+                    "agent_session_title_changed",
+                    "tokens_revoked",
+                    "app_uninstalled",
+                ],
+            },
+            interactivity: { is_enabled: true, request_url: input.requestUrl },
+            org_deploy_enabled: false,
+            socket_mode_enabled: false,
+        },
+    };
+}
+/** A pre-filled "Create New App → From a manifest" deep-link for the manual flow. */
+export function createFromManifestUrl(manifest) {
+    const json = encodeURIComponent(JSON.stringify(manifest));
+    return `https://api.slack.com/apps?new_app=1&manifest_json=${json}`;
+}
+//# sourceMappingURL=manifest.js.map

package/dist/slack/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../src/slack/manifest.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAaH,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,mBAAmB;IACnB,YAAY;IACZ,sBAAsB;IACtB,YAAY;IACZ,SAAS;IACT,UAAU;IACV,kBAAkB;IAClB,2EAA2E;IAC3E,sEAAsE;IACtE,eAAe;IACf,gBAAgB;IAChB,0EAA0E;IAC1E,4DAA4D;IAC5D,aAAa;IACb,wEAAwE;IACxE,qDAAqD;IACrD,eAAe;IACf,iBAAiB;IACjB,UAAU;CACX,CAAC;AACF,MAAM,UAAU,GAAG,gBAAgB,CAAC;AAEpC;;;;;;;GAOG;AACH,MAAM,eAAe,GAAG,GAAG,CAAC;AAE5B,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,IAAI,CAAC,MAAM,IAAI,eAAe;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,CAAC,CAAC;IAC7C,wEAAwE;IACxE,+DAA+D;IAC/D,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACzD,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC;IAC/C,OAAO,GAAG,CAAC,MAAM,GAAG,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC;AACrF,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,aAAa,CAAC,KAAyB;IACrD,MAAM,IAAI,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,wBAAwB;IACrE,OAAO;QACL,mBAAmB,EAAE;YACnB,IAAI;YACJ,WAAW,EAAE,eAAe,CAAC,KAAK,CAAC,WAAW,IAAI,GAAG,IAAI,WAAW,CAAC;SACtE;QACD,QAAQ,EAAE;YACR,QAAQ,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE;YACrD,8DAA8D;YAC9D,sEAAsE;YACtE,UAAU,EAAE,EAAE,iBAAiB,EAAE,aAAa,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SACrE;QACD,YAAY,EAAE;YACZ,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,MAAM,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE;SAC5B;QACD,QAAQ,EAAE;YACR,mBAAmB,EAAE;gBACnB,WAAW,EAAE,KAAK,CAAC,UAAU;gBAC7B,mEAAmE;gBACnE,qEAAqE;gBACrE,gEAAgE;gBAChE,mEAAmE;gBACnE,wCAAwC;gBACxC,UAAU,EAAE;oBACV,aAAa;oBACb,YAAY;oBACZ,kBAAkB;oBAClB,gBAAgB;oBAChB,iBAAiB;oBACjB,qBAAqB;oBACrB,uBAAuB;oBACvB,6BAA6B;oBAC7B,gBAAgB;oBAChB,iBAAiB;iBAClB;aACF;YACD,aAAa,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,CAAC,UAAU,EAAE;YAClE,kBAAkB,EAAE,KAAK;YACzB,mBAAmB,EAAE,KAAK;SAC3B;KACF,CAAC;AACJ,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,qBAAqB,CAAC,QAAiC;IACrE,MAAM,IAAI,GAAG,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1D,OAAO,sDAAsD,IAAI,EAAE,CAAC;AACtE,CAAC"}

package/dist/slack/normalize.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Inbound message normalization — what the model sees of a Slack message.
+ *
+ * Slack text arrives with mrkdwn tokens (`<@U…>`, `<#C…|name>`, `<url|label>`)
+ * and HTML-escaped entities. v1 only stripped a LEADING bot mention and used a
+ * `<@` substring test to gate thread replies — so mentioning a colleague
+ * mid-message silently dropped the message. v2 rewrites every token to a plain
+ * representation and gates on message shape, never on text content.
+ *
+ * No `users:read` scope: a user mention without an inline label renders as the
+ * raw id (`@U123`) — a stable handle the model can echo back, which the
+ * outbound side re-links.
+ */
+/**
+ * Turn Slack mrkdwn source text into plain prompt text.
+ * Bot self-mentions vanish; everything else stays human-readable.
+ */
+export declare function normalizeSlackText(text: string, botUserId?: string): string;
+/**
+ * Is this `message`/`app_mention` event a human message the channel should
+ * consider running a turn for? Shape checks only — the caller layers admission
+ * (dedupe, ownership, authorization) on top.
+ *
+ * The subtype ALLOWLIST replaces v1's blanket `!subtype` + separate
+ * `bot_message` checks: everything not explicitly allowed (edits, joins,
+ * bot_message, channel_topic, …) is out. The only self-check is the bot user
+ * id — v2 requires hosts to know it (captured at install), so the weaker
+ * `bot_id`-presence heuristic covers other bots, not identity.
+ */
+export declare function isRenderableUserMessage(ev: {
+    user?: string;
+    subtype?: string;
+    bot_id?: string;
+}, botUserId: string): boolean;
+//# sourceMappingURL=normalize.d.ts.map

package/dist/slack/normalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../src/slack/normalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CA0B3E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,EAAE,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EACxD,SAAS,EAAE,MAAM,GAChB,OAAO,CAKT"}

package/dist/slack/normalize.js

@@ -0,0 +1,63 @@
+/**
+ * Inbound message normalization — what the model sees of a Slack message.
+ *
+ * Slack text arrives with mrkdwn tokens (`<@U…>`, `<#C…|name>`, `<url|label>`)
+ * and HTML-escaped entities. v1 only stripped a LEADING bot mention and used a
+ * `<@` substring test to gate thread replies — so mentioning a colleague
+ * mid-message silently dropped the message. v2 rewrites every token to a plain
+ * representation and gates on message shape, never on text content.
+ *
+ * No `users:read` scope: a user mention without an inline label renders as the
+ * raw id (`@U123`) — a stable handle the model can echo back, which the
+ * outbound side re-links.
+ */
+/** Subtypes that still carry a human message worth running a turn for. */
+const SUBTYPE_ALLOWLIST = new Set(["file_share", "thread_broadcast"]);
+/**
+ * Turn Slack mrkdwn source text into plain prompt text.
+ * Bot self-mentions vanish; everything else stays human-readable.
+ */
+export function normalizeSlackText(text, botUserId) {
+    let out = text;
+    // User mentions: `<@U123|display>` → `@display`, `<@U123>` → `@U123`;
+    // the bot's own mention (anywhere, not just leading) is removed.
+    out = out.replace(/<@([A-Z0-9]+)(?:\|([^>]*))?>/g, (_m, id, label) => {
+        if (botUserId && id === botUserId)
+            return "";
+        return `@${label || id}`;
+    });
+    // Channel references and broadcast keywords.
+    out = out.replace(/<#([A-Z0-9]+)(?:\|([^>]*))?>/g, (_m, id, label) => {
+        return `#${label || id}`;
+    });
+    out = out.replace(/<!(here|channel|everyone)(?:\|[^>]*)?>/g, "@$1");
+    // Links: `<url|label>` → `label (url)`, `<url>` → `url`.
+    out = out.replace(/<((?:https?|mailto):[^>|]*)\|([^>]*)>/g, "$2 ($1)");
+    out = out.replace(/<((?:https?|mailto):[^>|]*)>/g, "$1");
+    // Entities LAST — the token forms above use raw angle brackets, escaped
+    // `&lt;` in user text must not become parseable tokens first.
+    out = out.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
+    // Removed mentions leave double spaces behind; collapse within lines only.
+    return out.replace(/[^\S\n]{2,}/g, " ").trim();
+}
+/**
+ * Is this `message`/`app_mention` event a human message the channel should
+ * consider running a turn for? Shape checks only — the caller layers admission
+ * (dedupe, ownership, authorization) on top.
+ *
+ * The subtype ALLOWLIST replaces v1's blanket `!subtype` + separate
+ * `bot_message` checks: everything not explicitly allowed (edits, joins,
+ * bot_message, channel_topic, …) is out. The only self-check is the bot user
+ * id — v2 requires hosts to know it (captured at install), so the weaker
+ * `bot_id`-presence heuristic covers other bots, not identity.
+ */
+export function isRenderableUserMessage(ev, botUserId) {
+    if (ev.bot_id)
+        return false;
+    if (ev.subtype && !SUBTYPE_ALLOWLIST.has(ev.subtype))
+        return false;
+    if (!ev.user || ev.user === botUserId)
+        return false;
+    return true;
+}
+//# sourceMappingURL=normalize.js.map

package/dist/slack/normalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.js","sourceRoot":"","sources":["../../src/slack/normalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,0EAA0E;AAC1E,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAEtE;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,SAAkB;IACjE,IAAI,GAAG,GAAG,IAAI,CAAC;IAEf,sEAAsE;IACtE,iEAAiE;IACjE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,+BAA+B,EAAE,CAAC,EAAE,EAAE,EAAU,EAAE,KAAc,EAAE,EAAE;QACpF,IAAI,SAAS,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QAC7C,OAAO,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,6CAA6C;IAC7C,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,+BAA+B,EAAE,CAAC,EAAE,EAAE,EAAU,EAAE,KAAc,EAAE,EAAE;QACpF,OAAO,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,yCAAyC,EAAE,KAAK,CAAC,CAAC;IAEpE,yDAAyD;IACzD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,wCAAwC,EAAE,SAAS,CAAC,CAAC;IACvE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,+BAA+B,EAAE,IAAI,CAAC,CAAC;IAEzD,wEAAwE;IACxE,8DAA8D;IAC9D,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAE7E,2EAA2E;IAC3E,OAAO,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CACrC,EAAwD,EACxD,SAAiB;IAEjB,IAAI,EAAE,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,EAAE,CAAC,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACnE,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACpD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/slack/payloads.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Signed interaction payloads — what rides in a Block Kit button `value`.
+ *
+ * v1 buttons carried unsigned JSON: trust rested entirely on Slack's request
+ * signature over the outer POST, and a payload never expired. v2 payloads are
+ * HMAC-signed with a key DERIVED from the app's signing secret (domain-
+ * separated, so a signature over a button value can never double as anything
+ * else), carry the actor who may click, and expire.
+ *
+ * Format: `b64url(json) + "." + b64url(HMAC_SHA256(derivedKey, json))`.
+ * Slack caps a button `value` at 2000 chars — encode asserts it.
+ */
+export interface ActionPayload {
+    v: 2;
+    kind: "approval";
+    /** The Latch chat the approval belongs to. */
+    chatId: string;
+    /** The approval to resolve via `runtime.applyApproval`. */
+    approvalId: string;
+    /** Display only — never trusted for dispatch. */
+    tool?: string;
+    /** Slack user id whose message triggered the run — the only one who may click. */
+    actor: string;
+    /** Expiry, epoch seconds. */
+    exp: number;
+}
+export declare function encodeAction(payload: Omit<ActionPayload, "v" | "exp"> & {
+    exp?: number;
+}, signingSecret: string, nowMs?: number): string;
+/**
+ * Decode + verify. Null for anything not exactly right: bad shape, wrong
+ * signature, expired, foreign version. Callers treat null as "this button is
+ * dead", never as an error to surface loudly (stale buttons are normal).
+ */
+export declare function decodeAction(value: string, signingSecret: string, nowMs?: number): ActionPayload | null;
+//# sourceMappingURL=payloads.d.ts.map

package/dist/slack/payloads.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payloads.d.ts","sourceRoot":"","sources":["../../src/slack/payloads.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,MAAM,WAAW,aAAa;IAC5B,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,UAAU,CAAC;IACjB,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAC;IACnB,iDAAiD;IACjD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,KAAK,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,GAAG,EAAE,MAAM,CAAC;CACb;AAcD,wBAAgB,YAAY,CAC1B,OAAO,EAAE,IAAI,CAAC,aAAa,EAAE,GAAG,GAAG,KAAK,CAAC,GAAG;IAAE,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,EAC5D,aAAa,EAAE,MAAM,EACrB,KAAK,SAAa,GACjB,MAAM,CAcR;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,KAAK,SAAa,GACjB,aAAa,GAAG,IAAI,CAkCtB"}

package/dist/slack/payloads.js

@@ -0,0 +1,80 @@
+/**
+ * Signed interaction payloads — what rides in a Block Kit button `value`.
+ *
+ * v1 buttons carried unsigned JSON: trust rested entirely on Slack's request
+ * signature over the outer POST, and a payload never expired. v2 payloads are
+ * HMAC-signed with a key DERIVED from the app's signing secret (domain-
+ * separated, so a signature over a button value can never double as anything
+ * else), carry the actor who may click, and expire.
+ *
+ * Format: `b64url(json) + "." + b64url(HMAC_SHA256(derivedKey, json))`.
+ * Slack caps a button `value` at 2000 chars — encode asserts it.
+ */
+import { createHmac, timingSafeEqual } from "node:crypto";
+const DOMAIN = "latch-slack-action-v2";
+const DEFAULT_TTL_S = 7 * 24 * 3600;
+/** Key derivation: per-app isolation for free, zero new secrets to manage. */
+function deriveKey(signingSecret) {
+    return createHmac("sha256", signingSecret).update(DOMAIN).digest();
+}
+function sign(json, signingSecret) {
+    return createHmac("sha256", deriveKey(signingSecret)).update(json).digest();
+}
+export function encodeAction(payload, signingSecret, nowMs = Date.now()) {
+    const full = {
+        exp: Math.floor(nowMs / 1000) + DEFAULT_TTL_S,
+        ...payload,
+        v: 2,
+    };
+    const json = Buffer.from(JSON.stringify(full), "utf8");
+    const value = `${json.toString("base64url")}.${sign(json, signingSecret).toString("base64url")}`;
+    if (value.length > 2000) {
+        // A payload is ids + one user id — hitting this means a bug upstream
+        // (e.g. someone stuffed tool input in), not an oversized legitimate value.
+        throw new Error(`slack action payload too large (${value.length} > 2000)`);
+    }
+    return value;
+}
+/**
+ * Decode + verify. Null for anything not exactly right: bad shape, wrong
+ * signature, expired, foreign version. Callers treat null as "this button is
+ * dead", never as an error to surface loudly (stale buttons are normal).
+ */
+export function decodeAction(value, signingSecret, nowMs = Date.now()) {
+    const dot = value.indexOf(".");
+    if (dot < 0)
+        return null;
+    let json;
+    let sig;
+    try {
+        json = Buffer.from(value.slice(0, dot), "base64url");
+        sig = Buffer.from(value.slice(dot + 1), "base64url");
+    }
+    catch {
+        return null;
+    }
+    const expected = sign(json, signingSecret);
+    if (sig.length !== expected.length || !timingSafeEqual(sig, expected))
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(json.toString("utf8"));
+    }
+    catch {
+        return null;
+    }
+    const p = parsed;
+    if (!p ||
+        p.v !== 2 ||
+        p.kind !== "approval" ||
+        typeof p.chatId !== "string" ||
+        typeof p.approvalId !== "string" ||
+        typeof p.actor !== "string" ||
+        typeof p.exp !== "number") {
+        return null;
+    }
+    if (p.exp * 1000 < nowMs)
+        return null;
+    return p;
+}
+//# sourceMappingURL=payloads.js.map

package/dist/slack/payloads.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payloads.js","sourceRoot":"","sources":["../../src/slack/payloads.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAiB1D,MAAM,MAAM,GAAG,uBAAuB,CAAC;AACvC,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpC,8EAA8E;AAC9E,SAAS,SAAS,CAAC,aAAqB;IACtC,OAAO,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AACrE,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,aAAqB;IAC/C,OAAO,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,OAA4D,EAC5D,aAAqB,EACrB,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;IAElB,MAAM,IAAI,GAAkB;QAC1B,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,aAAa;QAC7C,GAAG,OAAO;QACV,CAAC,EAAE,CAAC;KACL,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IACjG,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QACxB,qEAAqE;QACrE,2EAA2E;QAC3E,MAAM,IAAI,KAAK,CAAC,mCAAmC,KAAK,CAAC,MAAM,UAAU,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAC1B,KAAa,EACb,aAAqB,EACrB,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;IAElB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,IAAY,CAAC;IACjB,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;QACrD,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC3C,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnF,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,GAAG,MAAuC,CAAC;IAClD,IACE,CAAC,CAAC;QACF,CAAC,CAAC,CAAC,KAAK,CAAC;QACT,CAAC,CAAC,IAAI,KAAK,UAAU;QACrB,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAC5B,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAChC,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;QAC3B,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,EACzB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,GAAG,KAAK;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,CAAkB,CAAC;AAC5B,CAAC"}

package/dist/slack/slackChannel.d.ts

@@ -0,0 +1,152 @@
+import type { AuthResult, ChannelRunOps } from "../types.js";
+import { type SlackApiOptions, type SlackToken } from "./api.js";
+/**
+ * The Slack channel, v2. One agent's dedicated Slack app; the host wires
+ * `handleRequest` to a single webhook route.
+ *
+ * Design invariants (each one is a production incident that can't recur):
+ *
+ *  - **ACK first.** Pre-ACK work is signature verification and a minimal
+ *    parse — nothing else. Every DB/Vault/history read happens in deferred
+ *    workers. (The v1 pre-ACK chain caused the 3s timeouts whose retries the
+ *    dedupe layers then had to absorb.)
+ *  - **Admission is atomic.** One `claimOnce` primitive (TTL'd test-and-set)
+ *    dedupes deliveries, messages and interactions. One live run per chat is
+ *    core's storage invariant (`ChatBusyError`), rendered here as the busy
+ *    notice; a host on an adapter without it may still wire `claimTurn`. No
+ *    read-then-act preflights.
+ *  - **Threads are initiator-owned.** The first user to engage a chat owns
+ *    it; everyone else gets ONE quiet notice. Nobody ever acts with another
+ *    user's credentials — approvals are actor-bound in a signed payload.
+ *  - **DMs are continuous.** Un-threaded DM messages share one chat per DM
+ *    channel; session-pane threads and channel threads get one chat per
+ *    thread, always scoped to this app.
+ */
+/** Everything Latch remembers about one Slack-anchored chat. */
+export interface SlackChatMeta {
+    /** The Slack user whose message created this chat — the only driver. */
+    initiatorUserId: string;
+    teamId: string;
+    createdAt: number;
+}
+/**
+ * Host-backed thread registry: ownership + the cross-instance stop flag.
+ * `claim` is atomic first-writer-wins and returns the OWNING meta either way.
+ */
+export interface SlackThreadStore {
+    claim(chatId: string, meta: SlackChatMeta): Promise<SlackChatMeta>;
+    get(chatId: string): Promise<SlackChatMeta | null>;
+    /** The viewer pressed Stop (possibly on another instance). */
+    markStopped(chatId: string): Promise<void>;
+    /** Was a stop raised after `sinceMs`? Polled by the streaming renderer. */
+    stoppedSince(chatId: string, sinceMs: number): Promise<boolean>;
+}
+export interface SlackChannelConfig<P> {
+    /** The agent this app serves (own-app-per-agent). */
+    agent: string;
+    /** The Slack app id — the chat-id namespace. Required: no unscoped chats. */
+    appId: string;
+    /** The binding's owner — the principal a turn runs as unless `authorizeUser` says otherwise. */
+    principal: P;
+    /** The workspace's bot token (vault-backed in practice). */
+    botToken: SlackToken;
+    runtime: ChannelRunOps<P>;
+    /**
+     * The bot's own Slack user id — REQUIRED. The authoritative self-check;
+     * v2 has no `bot_id`/`subtype` identity fallback, a binding without it
+     * must be reinstalled.
+     */
+    botUserId: string;
+    /** The installed workspace — `chat.startStream` needs it in channels. */
+    teamId: string;
+    signingSecret: string | (() => string | Promise<string>);
+    /**
+     * Keep a serverless function alive for the deferred worker after the ACK.
+     * Without it the worker is awaited inline (fine off-serverless, but the ACK
+     * then waits on the whole turn).
+     */
+    waitUntil?: (p: Promise<unknown>) => void;
+    /**
+     * Atomic TTL'd test-and-set: TRUE when THIS call claimed the key, false
+     * when someone already holds it. One primitive covers delivery retries
+     * (`evt:`), the same message arriving as two event shapes (`msg:`),
+     * interaction redeliveries (`act:`) and once-ever notices (`note:`).
+     */
+    claimOnce: (key: string, ttlMs: number) => Promise<boolean>;
+    /**
+     * Optional host-side one-turn-per-chat lease (`null` = busy). Core's storage
+     * adapter already refuses a second live run per chat (`ChatBusyError`, shown
+     * as the busy notice), so this is only for hosts on an adapter without that
+     * invariant.
+     */
+    claimTurn?: (chatId: string) => Promise<string | null>;
+    releaseTurn?: (chatId: string, token: string) => Promise<void>;
+    /** Thread ownership + stop flag. */
+    threads: SlackThreadStore;
+    /**
+     * Gate inbound users (identity link, org membership, credential mode).
+     * `principal` (when returned with `allowed: true`) runs THIS turn as that
+     * principal — how per-user credentials work. `silent` suppresses the
+     * refusal notice (disabled bindings shouldn't reply at all).
+     */
+    authorizeUser?: (user: {
+        teamId: string;
+        userId: string;
+        channelId: string;
+        threadRoot: string;
+        /** The asking message's ts — hosts holding the message for a post-link
+         *  replay keep it so the replay can thread where the question was. */
+        anchorTs?: string;
+        prompt: string;
+    }) => Promise<AuthResult<P>>;
+    /** Build the platform authorize URL for a `connect_<name>` OAuth approval. */
+    authorizeUrl?: (connectionName: string, ctx: {
+        chatId: string;
+        channelId: string;
+        threadTs: string;
+        userId: string;
+        approvalId: string;
+    }) => string;
+    /** `tokens_revoked` / `app_uninstalled` → the host disables the binding. */
+    onLifecycle?: (info: {
+        type: "tokens_revoked" | "app_uninstalled";
+        teamId: string;
+    }) => Promise<void>;
+    /**
+     * Streaming-engine telemetry: called when the engine is decided (`stream`,
+     * or `fallback` + Slack's refusal code) and again if a live stream dies
+     * mid-turn. Hosts persist the last value so the binding health row can say
+     * WHY a bot degraded to post-at-finish mode.
+     */
+    onStreamMode?: (info: {
+        chatId: string;
+        mode: "stream" | "fallback";
+        code?: string;
+        detail?: string;
+    }) => Promise<void>;
+    /** Test seam for the Slack Web API client. */
+    apiOptions?: SlackApiOptions;
+}
+export declare function slackChannel<P>(config: SlackChannelConfig<P>): {
+    handleRequest: (request: Request) => Promise<Response>;
+    runMessage: (ctx: {
+        channel: string;
+        /** Thread root ts, or `dm` for the un-threaded DM chat. */
+        root: string;
+        /** For `dm` roots: the message ts the replayed turn should thread under. */
+        anchorTs?: string;
+        userId: string;
+        prompt: string;
+        context?: string;
+        principal?: P;
+    }) => Promise<void>;
+    resumeApproval: (ctx: {
+        chatId: string;
+        approvalId: string;
+        userId: string;
+        /** For `_dm` chats: the thread the connect card lives in. */
+        anchorTs?: string;
+        principal?: P;
+    }) => Promise<void>;
+};
+//# sourceMappingURL=slackChannel.d.ts.map

package/dist/slack/slackChannel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slackChannel.d.ts","sourceRoot":"","sources":["../../src/slack/slackChannel.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG7D,OAAO,EAAY,KAAK,eAAe,EAAE,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AAe3E;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,gEAAgE;AAChE,MAAM,WAAW,aAAa;IAC5B,wEAAwE;IACxE,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACnE,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACnD,8DAA8D;IAC9D,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,2EAA2E;IAC3E,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACjE;AAED,MAAM,WAAW,kBAAkB,CAAC,CAAC;IACnC,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAC;IAEd,gGAAgG;IAChG,SAAS,EAAE,CAAC,CAAC;IACb,4DAA4D;IAC5D,QAAQ,EAAE,UAAU,CAAC;IACrB,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IAC1B;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;IAEf,aAAa,EAAE,MAAM,GAAG,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IACzD;;;;OAIG;IACH,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;IAE1C;;;;;OAKG;IACH,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5D;;;;;OAKG;IACH,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvD,WAAW,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/D,oCAAoC;IACpC,OAAO,EAAE,gBAAgB,CAAC;IAE1B;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE;QACrB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB;8EACsE;QACtE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;KAChB,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAE7B,8EAA8E;IAC9E,YAAY,CAAC,EAAE,CACb,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE;QACH,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;QACjB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;KACpB,KACE,MAAM,CAAC;IAEZ,4EAA4E;IAC5E,WAAW,CAAC,EAAE,CAAC,IAAI,EAAE;QACnB,IAAI,EAAE,gBAAgB,GAAG,iBAAiB,CAAC;QAC3C,MAAM,EAAE,MAAM,CAAC;KAChB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,QAAQ,GAAG,UAAU,CAAC;QAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpB,8CAA8C;IAC9C,UAAU,CAAC,EAAE,eAAe,CAAC;CAC9B;AAsCD,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAC;6BAyhBrB,OAAO,KAAG,OAAO,CAAC,QAAQ,CAAC;sBAqFlC;QAC7B,OAAO,EAAE,MAAM,CAAC;QAChB,2DAA2D;QAC3D,IAAI,EAAE,MAAM,CAAC;QACb,4EAA4E;QAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC;QACf,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,CAAC,CAAC;KACf,KAAG,OAAO,CAAC,IAAI,CAAC;0BA4BkB;QACjC,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,MAAM,EAAE,MAAM,CAAC;QACf,6DAA6D;QAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,CAAC,CAAC;KACf,KAAG,OAAO,CAAC,IAAI,CAAC;EAsDlB"}