@mastra/factory 0.0.0-esbuild-bundle-worker-20260807173433

package/dist/integrations/slack/connect-route.js

@@ -0,0 +1,186 @@
+import { registerApiRoute } from "@mastra/core/server";
+//#region src/integrations/slack/connect-route.ts
+const SLACK_AUTHORIZE_URL = "https://slack.com/openid/connect/authorize";
+const SLACK_TOKEN_URL = "https://slack.com/api/openid.connect.token";
+const OIDC_CALLBACK_PATH = "/connect/slack/oidc/callback";
+const SLACK_TOKEN_TIMEOUT_MS = 1e4;
+/** Matches the signer's own `state` lifetime — past it, `verify` rejects anyway. */
+const STATE_REPLAY_WINDOW_MS = 600 * 1e3;
+/**
+* Decode a JWT's payload WITHOUT signature verification. Safe here because the
+* `id_token` arrives directly from Slack's token endpoint over TLS in a
+* confidential-client code exchange — the transport authenticates the issuer,
+* which is the standard OIDC allowance for this flow. `iss`/`aud`/`exp` are
+* still checked by the caller.
+*/
+function decodeJwtPayload(jwt) {
+	const payload = jwt.split(".")[1];
+	if (!payload) return null;
+	try {
+		return JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+	} catch {
+		return null;
+	}
+}
+/**
+* Slack account-linking routes.
+*
+* A link is only ever written by the OIDC flow below, where Slack itself
+* asserts the `(team, user)` pair in the id_token — so the web user has to
+* actually control the Slack account they bind. `/connect/slack` is just the
+* Slack-side entry point: it carries no identity and writes nothing, it only
+* sends the visitor to Connections, where the flow starts.
+*/
+function createSlackConnectRoutes(deps) {
+	const { auth, accountLinks, tenantStateSigner, oidc, projects } = deps;
+	const oidcEnabled = Boolean(oidc && tenantStateSigner);
+	const uiOrigin = oidc?.uiOrigin?.replace(/\/$/, "") ?? "";
+	const consumedNonces = /* @__PURE__ */ new Map();
+	const consumeNonce = (nonce) => {
+		const now = Date.now();
+		for (const [seen, expiresAt] of consumedNonces) if (expiresAt <= now) consumedNonces.delete(seen);
+		if (consumedNonces.has(nonce)) return false;
+		consumedNonces.set(nonce, now + STATE_REPLAY_WINDOW_MS);
+		return true;
+	};
+	const loose = (c) => c;
+	return [
+		registerApiRoute("/connect/slack", {
+			method: "GET",
+			requiresAuth: false,
+			handler: async (c) => c.redirect(`${uiOrigin}/settings/connections`)
+		}),
+		registerApiRoute("/connect/slack/oidc/start", {
+			method: "GET",
+			requiresAuth: false,
+			handler: async (c) => {
+				if (!oidcEnabled) return c.redirect(`${uiOrigin}/?slack=error`);
+				const factoryProjectId = c.req.query("factoryId")?.trim() || void 0;
+				const startPath = factoryProjectId ? `/connect/slack/oidc/start?factoryId=${encodeURIComponent(factoryProjectId)}` : "/connect/slack/oidc/start";
+				await auth.ensureUser(loose(c));
+				const tenant = auth.tenant(loose(c));
+				if (!tenant) return c.redirect(`/auth/login?returnTo=${encodeURIComponent(startPath)}`);
+				const params = new URLSearchParams({
+					response_type: "code",
+					scope: "openid profile",
+					client_id: oidc.clientId,
+					state: tenantStateSigner.sign(tenant.orgId ?? "", tenant.userId, { factoryProjectId }),
+					redirect_uri: `${oidc.redirectBaseUrl.replace(/\/$/, "")}${OIDC_CALLBACK_PATH}`
+				});
+				return c.redirect(`${SLACK_AUTHORIZE_URL}?${params.toString()}`);
+			}
+		}),
+		registerApiRoute(OIDC_CALLBACK_PATH, {
+			method: "GET",
+			requiresAuth: false,
+			handler: async (c) => {
+				if (!oidcEnabled) return c.redirect(`${uiOrigin}/?slack=error`);
+				const tenant = tenantStateSigner.verify(c.req.query("state"));
+				const code = c.req.query("code");
+				if (!tenant || !code) return c.redirect(`${uiOrigin}/?slack=error`);
+				if (!consumeNonce(tenant.nonce)) return c.redirect(`${uiOrigin}/?slack=error`);
+				const tokenRes = await fetch(SLACK_TOKEN_URL, {
+					method: "POST",
+					headers: { "content-type": "application/x-www-form-urlencoded" },
+					body: new URLSearchParams({
+						client_id: oidc.clientId,
+						client_secret: oidc.clientSecret,
+						code,
+						redirect_uri: `${oidc.redirectBaseUrl.replace(/\/$/, "")}${OIDC_CALLBACK_PATH}`
+					}),
+					signal: AbortSignal.timeout(SLACK_TOKEN_TIMEOUT_MS)
+				}).catch(() => null);
+				const token = await tokenRes?.json().catch(() => null);
+				if (!tokenRes?.ok || !token?.ok || typeof token.id_token !== "string") return c.redirect(`${uiOrigin}/?slack=error`);
+				const claims = decodeJwtPayload(token.id_token);
+				const teamId = claims?.["https://slack.com/team_id"];
+				const slackUserId = claims?.["https://slack.com/user_id"];
+				const teamName = claims?.["https://slack.com/team_name"];
+				const userName = claims?.name;
+				const expiresAt = typeof claims?.exp === "number" ? claims.exp * 1e3 : null;
+				if (!claims || claims.iss !== "https://slack.com" || claims.aud !== oidc.clientId || expiresAt === null || expiresAt <= Date.now() || typeof teamId !== "string" || typeof slackUserId !== "string") return c.redirect(`${uiOrigin}/?slack=error`);
+				await accountLinks.saveAccountLink({
+					platform: "slack",
+					externalTeamId: teamId,
+					externalUserId: slackUserId,
+					orgId: tenant.orgId || void 0,
+					userId: tenant.userId,
+					externalTeamName: typeof teamName === "string" ? teamName : void 0,
+					externalUserName: typeof userName === "string" ? userName : void 0
+				});
+				const successPath = tenant.factoryProjectId ? `/factories/${encodeURIComponent(tenant.factoryProjectId)}/settings/connections/slack` : "/settings/connections";
+				return c.redirect(`${uiOrigin}${successPath}?slack=connected`);
+			}
+		}),
+		registerApiRoute("/web/channel-accounts", {
+			method: "GET",
+			requiresAuth: false,
+			handler: async (c) => {
+				await auth.ensureUser(loose(c));
+				const tenant = auth.tenant(loose(c));
+				if (!tenant) return c.json({ error: "unauthorized" }, 401);
+				const accounts = (await accountLinks.listAccountLinksForUser(tenant.userId)).map((link) => ({
+					platform: link.platform,
+					externalTeamId: link.externalTeamId,
+					externalUserId: link.externalUserId,
+					externalTeamName: link.externalTeamName,
+					externalUserName: link.externalUserName,
+					defaultFactoryProjectId: link.defaultFactoryProjectId,
+					linkedAt: link.linkedAt.toISOString()
+				}));
+				return c.json({
+					accounts,
+					canConnect: oidcEnabled
+				});
+			}
+		}),
+		registerApiRoute("/web/channel-accounts", {
+			method: "DELETE",
+			requiresAuth: false,
+			handler: async (c) => {
+				await auth.ensureUser(loose(c));
+				const tenant = auth.tenant(loose(c));
+				if (!tenant) return c.json({ error: "unauthorized" }, 401);
+				const body = await c.req.json().catch(() => null);
+				if (!body?.platform || !body.externalTeamId || !body.externalUserId) return c.json({ error: "platform, externalTeamId and externalUserId are required" }, 400);
+				const deleted = await accountLinks.deleteAccountLinkForUser({
+					userId: tenant.userId,
+					platform: body.platform,
+					externalTeamId: body.externalTeamId,
+					externalUserId: body.externalUserId
+				});
+				return c.json({ deleted });
+			}
+		}),
+		registerApiRoute("/web/channel-accounts/default-factory", {
+			method: "PATCH",
+			requiresAuth: false,
+			handler: async (c) => {
+				await auth.ensureUser(loose(c));
+				const tenant = auth.tenant(loose(c));
+				if (!tenant) return c.json({ error: "unauthorized" }, 401);
+				const body = await c.req.json().catch(() => null);
+				if (!body?.platform || !body.externalTeamId || !body.externalUserId || body.factoryProjectId === void 0) return c.json({ error: "platform, externalTeamId, externalUserId and factoryProjectId (nullable) are required" }, 400);
+				if (body.factoryProjectId !== null) {
+					if (!projects) return c.json({ error: "factory routing is not configured" }, 400);
+					if (!await projects.get({
+						orgId: tenant.orgId ?? "",
+						id: body.factoryProjectId
+					})) return c.json({ error: "unknown factory" }, 400);
+				}
+				const updated = await accountLinks.setDefaultFactory({
+					userId: tenant.userId,
+					platform: body.platform,
+					externalTeamId: body.externalTeamId,
+					externalUserId: body.externalUserId,
+					factoryProjectId: body.factoryProjectId
+				});
+				return c.json({ updated });
+			}
+		})
+	];
+}
+//#endregion
+export { createSlackConnectRoutes };
+
+//# sourceMappingURL=connect-route.js.map

package/dist/integrations/slack/connect-route.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-route.js","names":[],"sources":["../../../src/integrations/slack/connect-route.ts"],"sourcesContent":["import { registerApiRoute } from '@mastra/core/server';\nimport type { ApiRoute } from '@mastra/core/server';\nimport type { RouteAuth } from '../../routes/route.js';\nimport type { StateSigner } from '../../state-signing.js';\nimport type { ChannelIdentityStorage } from '../../storage/domains/channel-identity/base.js';\nimport type { FactoryProjectsStorage } from '../../storage/domains/projects/base.js';\n\n/**\n * Payload shape for the Connections list: the platform sender key +\n * link time, without the tenant ids (the caller IS the tenant).\n */\ninterface ConnectedChannelAccountPayload {\n  platform: string;\n  externalTeamId: string;\n  externalUserId: string;\n  /** Display names captured at link time (OIDC profile claims); ids fall back. */\n  externalTeamName?: string;\n  externalUserName?: string;\n  /** Which Factory project this link's channel runs route to (unset = not picked yet). */\n  defaultFactoryProjectId?: string;\n  linkedAt: string;\n}\n\n/**\n * Config for the web-initiated \"Sign in with Slack\" (OIDC) connect flow. All\n * values come from the env-supplied Slack app. Absent → the OIDC routes\n * respond with an error redirect and the list endpoint reports\n * `canConnect: false` so the UI hides its Connect button.\n */\ninterface SlackOidcConfig {\n  clientId: string;\n  clientSecret: string;\n  /**\n   * Public HTTPS origin the OIDC `redirect_uri` is built from (Slack rejects\n   * plain-http redirect URLs, so locally this is the tunnel origin). Must also\n   * be registered as a redirect URL on the Slack app.\n   */\n  redirectBaseUrl: string;\n  /** Browser-facing origin post-connect redirects land on (the SPA host). */\n  uiOrigin?: string;\n}\n\nconst SLACK_AUTHORIZE_URL = 'https://slack.com/openid/connect/authorize';\nconst SLACK_TOKEN_URL = 'https://slack.com/api/openid.connect.token';\nconst OIDC_CALLBACK_PATH = '/connect/slack/oidc/callback';\nconst SLACK_TOKEN_TIMEOUT_MS = 10_000;\n/** Matches the signer's own `state` lifetime — past it, `verify` rejects anyway. */\nconst STATE_REPLAY_WINDOW_MS = 10 * 60 * 1000;\n\n/**\n * Decode a JWT's payload WITHOUT signature verification. Safe here because the\n * `id_token` arrives directly from Slack's token endpoint over TLS in a\n * confidential-client code exchange — the transport authenticates the issuer,\n * which is the standard OIDC allowance for this flow. `iss`/`aud`/`exp` are\n * still checked by the caller.\n */\nfunction decodeJwtPayload(jwt: string): Record<string, unknown> | null {\n  const payload = jwt.split('.')[1];\n  if (!payload) return null;\n  try {\n    return JSON.parse(Buffer.from(payload, 'base64url').toString('utf8')) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Slack account-linking routes.\n *\n * A link is only ever written by the OIDC flow below, where Slack itself\n * asserts the `(team, user)` pair in the id_token — so the web user has to\n * actually control the Slack account they bind. `/connect/slack` is just the\n * Slack-side entry point: it carries no identity and writes nothing, it only\n * sends the visitor to Connections, where the flow starts.\n */\nexport function createSlackConnectRoutes(deps: {\n  auth: RouteAuth;\n  accountLinks: ChannelIdentityStorage;\n  /** Signs the OIDC `state`, binding the round-trip to the initiating tenant. */\n  tenantStateSigner?: StateSigner;\n  oidc?: SlackOidcConfig;\n  /**\n   * Factory projects domain, for validating (and listing to) the per-link\n   * default factory. Unset → the default-factory PATCH route rejects.\n   */\n  projects?: FactoryProjectsStorage;\n}): ApiRoute[] {\n  const { auth, accountLinks, tenantStateSigner, oidc, projects } = deps;\n  const oidcEnabled = Boolean(oidc && tenantStateSigner);\n  const uiOrigin = oidc?.uiOrigin?.replace(/\\/$/, '') ?? '';\n\n  // A signed `state` stays valid for its whole 10-minute window, so on its own\n  // it authorizes the binding repeatedly: anyone who captures a callback URL\n  // can re-run the exchange with their own fresh Slack `code` and bind their\n  // Slack account to the tenant that started the flow. Burning the nonce makes\n  // the state single-use. Scope note: this is per-process, so it does not stop\n  // a replay routed to a different replica — narrowing that further needs\n  // shared storage, which is out of proportion to a 10-minute window here.\n  const consumedNonces = new Map<string, number>();\n  const consumeNonce = (nonce: string): boolean => {\n    const now = Date.now();\n    for (const [seen, expiresAt] of consumedNonces) {\n      if (expiresAt <= now) consumedNonces.delete(seen);\n    }\n    if (consumedNonces.has(nonce)) return false;\n    consumedNonces.set(nonce, now + STATE_REPLAY_WINDOW_MS);\n    return true;\n  };\n\n  // mc-web can resolve a different hono version than @mastra/factory, so the\n  // registerApiRoute handler `Context` and the factory `RouteAuth` `Context`\n  // are structurally incompatible (private `[GET_MATCH_RESULT]` symbol). Cast\n  // through `unknown` at the seam — same `loose()` workaround the factory\n  // routes use internally.\n  type RouteAuthContext = Parameters<RouteAuth['ensureUser']>[0];\n  const loose = (c: unknown): RouteAuthContext => c as RouteAuthContext;\n\n  return [\n    registerApiRoute('/connect/slack', {\n      method: 'GET',\n      // No auth: nothing here reads a tenant or writes a link. The SPA route\n      // this lands on requires a session and bounces through login itself.\n      requiresAuth: false,\n      handler: async c => c.redirect(`${uiOrigin}/settings/connections`),\n    }),\n    // Web-initiated connect: \"Sign in with Slack\" (OIDC). The only route that\n    // writes a link, because it is the only one that proves the signed-in web\n    // user actually CONTROLS the Slack account: Slack itself asserts the\n    // (team, user) pair in the id_token.\n    registerApiRoute('/connect/slack/oidc/start', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        if (!oidcEnabled) return c.redirect(`${uiOrigin}/?slack=error`);\n\n        const factoryProjectId = c.req.query('factoryId')?.trim() || undefined;\n        const startPath = factoryProjectId\n          ? `/connect/slack/oidc/start?factoryId=${encodeURIComponent(factoryProjectId)}`\n          : '/connect/slack/oidc/start';\n\n        await auth.ensureUser(loose(c));\n        const tenant = auth.tenant(loose(c));\n        if (!tenant) {\n          return c.redirect(`/auth/login?returnTo=${encodeURIComponent(startPath)}`);\n        }\n\n        const params = new URLSearchParams({\n          response_type: 'code',\n          // `profile` adds display-name claims (user name, team name) to the\n          // id_token so Connections can show names instead of ids.\n          scope: 'openid profile',\n          client_id: oidc!.clientId,\n          // Personal accounts have no org; the signer requires a string, so an\n          // empty org round-trips and is mapped back to undefined on save.\n          state: tenantStateSigner!.sign(tenant.orgId ?? '', tenant.userId, { factoryProjectId }),\n          redirect_uri: `${oidc!.redirectBaseUrl.replace(/\\/$/, '')}${OIDC_CALLBACK_PATH}`,\n        });\n        return c.redirect(`${SLACK_AUTHORIZE_URL}?${params.toString()}`);\n      },\n    }),\n    // OIDC callback. Authenticates via the signed `state` (which carries the\n    // initiating tenant) rather than the session cookie — the callback may\n    // arrive on a different origin (the public tunnel) where the SPA's\n    // host-scoped cookie is not sent.\n    registerApiRoute(OIDC_CALLBACK_PATH, {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        if (!oidcEnabled) return c.redirect(`${uiOrigin}/?slack=error`);\n\n        const tenant = tenantStateSigner!.verify(c.req.query('state'));\n        const code = c.req.query('code');\n        if (!tenant || !code) return c.redirect(`${uiOrigin}/?slack=error`);\n        // Burn the state before spending the code, not after saving: a replay\n        // must be refused even if the first attempt fails partway through.\n        if (!consumeNonce(tenant.nonce)) return c.redirect(`${uiOrigin}/?slack=error`);\n\n        // Bound the exchange: without a deadline a slow token endpoint parks the\n        // request until the platform's own timeout, and this route is reachable\n        // by anyone holding a signed state.\n        const tokenRes = await fetch(SLACK_TOKEN_URL, {\n          method: 'POST',\n          headers: { 'content-type': 'application/x-www-form-urlencoded' },\n          body: new URLSearchParams({\n            client_id: oidc!.clientId,\n            client_secret: oidc!.clientSecret,\n            code,\n            redirect_uri: `${oidc!.redirectBaseUrl.replace(/\\/$/, '')}${OIDC_CALLBACK_PATH}`,\n          }),\n          signal: AbortSignal.timeout(SLACK_TOKEN_TIMEOUT_MS),\n        }).catch(() => null);\n        const token = (await tokenRes?.json().catch(() => null)) as { ok?: boolean; id_token?: string } | null;\n        if (!tokenRes?.ok || !token?.ok || typeof token.id_token !== 'string') {\n          return c.redirect(`${uiOrigin}/?slack=error`);\n        }\n\n        const claims = decodeJwtPayload(token.id_token);\n        const teamId = claims?.['https://slack.com/team_id'];\n        const slackUserId = claims?.['https://slack.com/user_id'];\n        // Display-only claims from the `profile` scope — absent claims just\n        // mean the settings list falls back to ids.\n        const teamName = claims?.['https://slack.com/team_name'];\n        const userName = claims?.name;\n        // `exp` is seconds since the epoch. A missing or past `exp` means the\n        // assertion is not currently valid, so it cannot bind an account.\n        const expiresAt = typeof claims?.exp === 'number' ? claims.exp * 1000 : null;\n        if (\n          !claims ||\n          claims.iss !== 'https://slack.com' ||\n          claims.aud !== oidc!.clientId ||\n          expiresAt === null ||\n          expiresAt <= Date.now() ||\n          typeof teamId !== 'string' ||\n          typeof slackUserId !== 'string'\n        ) {\n          return c.redirect(`${uiOrigin}/?slack=error`);\n        }\n\n        await accountLinks.saveAccountLink({\n          platform: 'slack',\n          externalTeamId: teamId,\n          externalUserId: slackUserId,\n          orgId: tenant.orgId || undefined,\n          userId: tenant.userId,\n          externalTeamName: typeof teamName === 'string' ? teamName : undefined,\n          externalUserName: typeof userName === 'string' ? userName : undefined,\n        });\n\n        const successPath = tenant.factoryProjectId\n          ? `/factories/${encodeURIComponent(tenant.factoryProjectId)}/settings/connections/slack`\n          : '/settings/connections';\n        return c.redirect(`${uiOrigin}${successPath}?slack=connected`);\n      },\n    }),\n    // The caller's own linked channel accounts for Connections. Tenant-scoped:\n    // you only ever see your own links.\n    registerApiRoute('/web/channel-accounts', {\n      method: 'GET',\n      requiresAuth: false,\n      handler: async c => {\n        await auth.ensureUser(loose(c));\n        const tenant = auth.tenant(loose(c));\n        if (!tenant) return c.json({ error: 'unauthorized' }, 401);\n\n        const links = await accountLinks.listAccountLinksForUser(tenant.userId);\n        const accounts: ConnectedChannelAccountPayload[] = links.map(link => ({\n          platform: link.platform,\n          externalTeamId: link.externalTeamId,\n          externalUserId: link.externalUserId,\n          externalTeamName: link.externalTeamName,\n          externalUserName: link.externalUserName,\n          defaultFactoryProjectId: link.defaultFactoryProjectId,\n          linkedAt: link.linkedAt.toISOString(),\n        }));\n        // `canConnect` tells the settings UI whether the web-initiated OIDC\n        // connect flow is configured (vs. Slack-side Connect card only).\n        return c.json({ accounts, canConnect: oidcEnabled });\n      },\n    }),\n    // Self-service disconnect. The storage delete is guarded by the caller's\n    // tenant userId, so a known sender key alone can never sever someone\n    // else's link.\n    registerApiRoute('/web/channel-accounts', {\n      method: 'DELETE',\n      requiresAuth: false,\n      handler: async c => {\n        await auth.ensureUser(loose(c));\n        const tenant = auth.tenant(loose(c));\n        if (!tenant) return c.json({ error: 'unauthorized' }, 401);\n\n        const body = (await c.req.json().catch(() => null)) as {\n          platform?: string;\n          externalTeamId?: string;\n          externalUserId?: string;\n        } | null;\n        if (!body?.platform || !body.externalTeamId || !body.externalUserId) {\n          return c.json({ error: 'platform, externalTeamId and externalUserId are required' }, 400);\n        }\n\n        const deleted = await accountLinks.deleteAccountLinkForUser({\n          userId: tenant.userId,\n          platform: body.platform,\n          externalTeamId: body.externalTeamId,\n          externalUserId: body.externalUserId,\n        });\n        return c.json({ deleted });\n      },\n    }),\n    // Set (or clear, with `factoryProjectId: null`) which Factory project a\n    // link's channel runs route to. The storage write is guarded by the\n    // caller's tenant userId — a known sender key alone can never repoint\n    // someone else's link — and a non-null factory must exist in the caller's\n    // org.\n    registerApiRoute('/web/channel-accounts/default-factory', {\n      method: 'PATCH',\n      requiresAuth: false,\n      handler: async c => {\n        await auth.ensureUser(loose(c));\n        const tenant = auth.tenant(loose(c));\n        if (!tenant) return c.json({ error: 'unauthorized' }, 401);\n\n        const body = (await c.req.json().catch(() => null)) as {\n          platform?: string;\n          externalTeamId?: string;\n          externalUserId?: string;\n          factoryProjectId?: string | null;\n        } | null;\n        if (!body?.platform || !body.externalTeamId || !body.externalUserId || body.factoryProjectId === undefined) {\n          return c.json(\n            { error: 'platform, externalTeamId, externalUserId and factoryProjectId (nullable) are required' },\n            400,\n          );\n        }\n\n        if (body.factoryProjectId !== null) {\n          if (!projects) return c.json({ error: 'factory routing is not configured' }, 400);\n          const factory = await projects.get({ orgId: tenant.orgId ?? '', id: body.factoryProjectId });\n          if (!factory) return c.json({ error: 'unknown factory' }, 400);\n        }\n\n        const updated = await accountLinks.setDefaultFactory({\n          userId: tenant.userId,\n          platform: body.platform,\n          externalTeamId: body.externalTeamId,\n          externalUserId: body.externalUserId,\n          factoryProjectId: body.factoryProjectId,\n        });\n        return c.json({ updated });\n      },\n    }),\n  ];\n}\n"],"mappings":";;AA0CA,MAAM,sBAAsB;AAC5B,MAAM,kBAAkB;AACxB,MAAM,qBAAqB;AAC3B,MAAM,yBAAyB;;AAE/B,MAAM,yBAAyB,MAAU;;;;;;;;AASzC,SAAS,iBAAiB,KAA6C;CACrE,MAAM,UAAU,IAAI,MAAM,GAAG,CAAC,CAAC;CAC/B,IAAI,CAAC,SAAS,OAAO;CACrB,IAAI;EACF,OAAO,KAAK,MAAM,OAAO,KAAK,SAAS,WAAW,CAAC,CAAC,SAAS,MAAM,CAAC;CACtE,QAAQ;EACN,OAAO;CACT;AACF;;;;;;;;;;AAWA,SAAgB,yBAAyB,MAW1B;CACb,MAAM,EAAE,MAAM,cAAc,mBAAmB,MAAM,aAAa;CAClE,MAAM,cAAc,QAAQ,QAAQ,iBAAiB;CACrD,MAAM,WAAW,MAAM,UAAU,QAAQ,OAAO,EAAE,KAAK;CASvD,MAAM,iCAAiB,IAAI,IAAoB;CAC/C,MAAM,gBAAgB,UAA2B;EAC/C,MAAM,MAAM,KAAK,IAAI;EACrB,KAAK,MAAM,CAAC,MAAM,cAAc,gBAC9B,IAAI,aAAa,KAAK,eAAe,OAAO,IAAI;EAElD,IAAI,eAAe,IAAI,KAAK,GAAG,OAAO;EACtC,eAAe,IAAI,OAAO,MAAM,sBAAsB;EACtD,OAAO;CACT;CAQA,MAAM,SAAS,MAAiC;CAEhD,OAAO;EACL,iBAAiB,kBAAkB;GACjC,QAAQ;GAGR,cAAc;GACd,SAAS,OAAM,MAAK,EAAE,SAAS,GAAG,SAAS,sBAAsB;EACnE,CAAC;EAKD,iBAAiB,6BAA6B;GAC5C,QAAQ;GACR,cAAc;GACd,SAAS,OAAM,MAAK;IAClB,IAAI,CAAC,aAAa,OAAO,EAAE,SAAS,GAAG,SAAS,cAAc;IAE9D,MAAM,mBAAmB,EAAE,IAAI,MAAM,WAAW,CAAC,EAAE,KAAK,KAAK,KAAA;IAC7D,MAAM,YAAY,mBACd,uCAAuC,mBAAmB,gBAAgB,MAC1E;IAEJ,MAAM,KAAK,WAAW,MAAM,CAAC,CAAC;IAC9B,MAAM,SAAS,KAAK,OAAO,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,QACH,OAAO,EAAE,SAAS,wBAAwB,mBAAmB,SAAS,GAAG;IAG3E,MAAM,SAAS,IAAI,gBAAgB;KACjC,eAAe;KAGf,OAAO;KACP,WAAW,KAAM;KAGjB,OAAO,kBAAmB,KAAK,OAAO,SAAS,IAAI,OAAO,QAAQ,EAAE,iBAAiB,CAAC;KACtF,cAAc,GAAG,KAAM,gBAAgB,QAAQ,OAAO,EAAE,IAAI;IAC9D,CAAC;IACD,OAAO,EAAE,SAAS,GAAG,oBAAoB,GAAG,OAAO,SAAS,GAAG;GACjE;EACF,CAAC;EAKD,iBAAiB,oBAAoB;GACnC,QAAQ;GACR,cAAc;GACd,SAAS,OAAM,MAAK;IAClB,IAAI,CAAC,aAAa,OAAO,EAAE,SAAS,GAAG,SAAS,cAAc;IAE9D,MAAM,SAAS,kBAAmB,OAAO,EAAE,IAAI,MAAM,OAAO,CAAC;IAC7D,MAAM,OAAO,EAAE,IAAI,MAAM,MAAM;IAC/B,IAAI,CAAC,UAAU,CAAC,MAAM,OAAO,EAAE,SAAS,GAAG,SAAS,cAAc;IAGlE,IAAI,CAAC,aAAa,OAAO,KAAK,GAAG,OAAO,EAAE,SAAS,GAAG,SAAS,cAAc;IAK7E,MAAM,WAAW,MAAM,MAAM,iBAAiB;KAC5C,QAAQ;KACR,SAAS,EAAE,gBAAgB,oCAAoC;KAC/D,MAAM,IAAI,gBAAgB;MACxB,WAAW,KAAM;MACjB,eAAe,KAAM;MACrB;MACA,cAAc,GAAG,KAAM,gBAAgB,QAAQ,OAAO,EAAE,IAAI;KAC9D,CAAC;KACD,QAAQ,YAAY,QAAQ,sBAAsB;IACpD,CAAC,CAAC,CAAC,YAAY,IAAI;IACnB,MAAM,QAAS,MAAM,UAAU,KAAK,CAAC,CAAC,YAAY,IAAI;IACtD,IAAI,CAAC,UAAU,MAAM,CAAC,OAAO,MAAM,OAAO,MAAM,aAAa,UAC3D,OAAO,EAAE,SAAS,GAAG,SAAS,cAAc;IAG9C,MAAM,SAAS,iBAAiB,MAAM,QAAQ;IAC9C,MAAM,SAAS,SAAS;IACxB,MAAM,cAAc,SAAS;IAG7B,MAAM,WAAW,SAAS;IAC1B,MAAM,WAAW,QAAQ;IAGzB,MAAM,YAAY,OAAO,QAAQ,QAAQ,WAAW,OAAO,MAAM,MAAO;IACxE,IACE,CAAC,UACD,OAAO,QAAQ,uBACf,OAAO,QAAQ,KAAM,YACrB,cAAc,QACd,aAAa,KAAK,IAAI,KACtB,OAAO,WAAW,YAClB,OAAO,gBAAgB,UAEvB,OAAO,EAAE,SAAS,GAAG,SAAS,cAAc;IAG9C,MAAM,aAAa,gBAAgB;KACjC,UAAU;KACV,gBAAgB;KAChB,gBAAgB;KAChB,OAAO,OAAO,SAAS,KAAA;KACvB,QAAQ,OAAO;KACf,kBAAkB,OAAO,aAAa,WAAW,WAAW,KAAA;KAC5D,kBAAkB,OAAO,aAAa,WAAW,WAAW,KAAA;IAC9D,CAAC;IAED,MAAM,cAAc,OAAO,mBACvB,cAAc,mBAAmB,OAAO,gBAAgB,EAAE,+BAC1D;IACJ,OAAO,EAAE,SAAS,GAAG,WAAW,YAAY,iBAAiB;GAC/D;EACF,CAAC;EAGD,iBAAiB,yBAAyB;GACxC,QAAQ;GACR,cAAc;GACd,SAAS,OAAM,MAAK;IAClB,MAAM,KAAK,WAAW,MAAM,CAAC,CAAC;IAC9B,MAAM,SAAS,KAAK,OAAO,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,QAAQ,OAAO,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;IAGzD,MAAM,YAA6C,MAD/B,aAAa,wBAAwB,OAAO,MAAM,EAAA,CACb,KAAI,UAAS;KACpE,UAAU,KAAK;KACf,gBAAgB,KAAK;KACrB,gBAAgB,KAAK;KACrB,kBAAkB,KAAK;KACvB,kBAAkB,KAAK;KACvB,yBAAyB,KAAK;KAC9B,UAAU,KAAK,SAAS,YAAY;IACtC,EAAE;IAGF,OAAO,EAAE,KAAK;KAAE;KAAU,YAAY;IAAY,CAAC;GACrD;EACF,CAAC;EAID,iBAAiB,yBAAyB;GACxC,QAAQ;GACR,cAAc;GACd,SAAS,OAAM,MAAK;IAClB,MAAM,KAAK,WAAW,MAAM,CAAC,CAAC;IAC9B,MAAM,SAAS,KAAK,OAAO,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,QAAQ,OAAO,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;IAEzD,MAAM,OAAQ,MAAM,EAAE,IAAI,KAAK,CAAC,CAAC,YAAY,IAAI;IAKjD,IAAI,CAAC,MAAM,YAAY,CAAC,KAAK,kBAAkB,CAAC,KAAK,gBACnD,OAAO,EAAE,KAAK,EAAE,OAAO,2DAA2D,GAAG,GAAG;IAG1F,MAAM,UAAU,MAAM,aAAa,yBAAyB;KAC1D,QAAQ,OAAO;KACf,UAAU,KAAK;KACf,gBAAgB,KAAK;KACrB,gBAAgB,KAAK;IACvB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC;GAC3B;EACF,CAAC;EAMD,iBAAiB,yCAAyC;GACxD,QAAQ;GACR,cAAc;GACd,SAAS,OAAM,MAAK;IAClB,MAAM,KAAK,WAAW,MAAM,CAAC,CAAC;IAC9B,MAAM,SAAS,KAAK,OAAO,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,QAAQ,OAAO,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;IAEzD,MAAM,OAAQ,MAAM,EAAE,IAAI,KAAK,CAAC,CAAC,YAAY,IAAI;IAMjD,IAAI,CAAC,MAAM,YAAY,CAAC,KAAK,kBAAkB,CAAC,KAAK,kBAAkB,KAAK,qBAAqB,KAAA,GAC/F,OAAO,EAAE,KACP,EAAE,OAAO,wFAAwF,GACjG,GACF;IAGF,IAAI,KAAK,qBAAqB,MAAM;KAClC,IAAI,CAAC,UAAU,OAAO,EAAE,KAAK,EAAE,OAAO,oCAAoC,GAAG,GAAG;KAEhF,IAAI,CAAC,MADiB,SAAS,IAAI;MAAE,OAAO,OAAO,SAAS;MAAI,IAAI,KAAK;KAAiB,CAAC,GAC7E,OAAO,EAAE,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;IAC/D;IAEA,MAAM,UAAU,MAAM,aAAa,kBAAkB;KACnD,QAAQ,OAAO;KACf,UAAU,KAAK;KACf,gBAAgB,KAAK;KACrB,gBAAgB,KAAK;KACrB,kBAAkB,KAAK;IACzB,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC;GAC3B;EACF,CAAC;CACH;AACF"}

package/dist/integrations/slack/integration.d.ts

@@ -0,0 +1,62 @@
+/**
+ * `SlackIntegration` — Slack as a `FactoryIntegration`.
+ *
+ * Slack contributes two things to a factory: the chat channels that carry
+ * inbound messages into agent runs (`channels()`), and the browser-facing
+ * account-link routes that bind a Slack sender to a Mastra tenant (`routes()`).
+ * Both used to be assembled by hand in the deploy entry, which had to reach
+ * into the prepared agent controller by string key, resolve storage domains
+ * itself, mint its own state signer, and splice routes onto the factory's
+ * assembled server config. Implementing the integration interface instead means
+ * the factory does all of that the same way it already does for GitHub and
+ * Linear, and the entry's job shrinks to reading Slack's env vars once.
+ *
+ * Slack ships as a factory built-in alongside GitHub and Linear (it originally
+ * lived in `mastracode/web` to keep `@mastra/slack`/`chat` out of this package;
+ * the team reversed that so `create-factory` consumers get Slack channels out
+ * of the box). The integration interface remains open — third parties still add
+ * capabilities by implementing `FactoryIntegration` from outside the package.
+ */
+import type { ApiRoute } from '@mastra/core/server';
+import type { FactoryChannelsConfig, FactoryIntegration, IntegrationContext } from '../base.js';
+/**
+ * Slack app credentials, read from env ONCE by the deploy entry. `signingSecret`
+ * is required because the Slack adapter validates it at construction — an
+ * integration constructed without it would throw during `prepare()` rather than
+ * reporting itself unconfigured.
+ */
+export interface SlackIntegrationConfig {
+    /** Verifies inbound Slack request signatures. Required. */
+    signingSecret: string;
+    /** Bot token used to post replies and ephemeral cards. */
+    botToken?: string;
+    /**
+     * OAuth client credentials. Required for account linking: "Sign in with
+     * Slack" (OIDC) is the only flow that writes a link, so without these the
+     * settings surface reports `canConnect: false` and no sender can link.
+     */
+    clientId?: string;
+    clientSecret?: string;
+    /**
+     * HTTPS origin Slack redirects back to. Slack requires HTTPS, so locally this
+     * is the tunnel origin rather than the app's own public URL.
+     */
+    oidcRedirectBaseUrl?: string;
+    /** SPA origin the post-connect redirect returns to. */
+    uiOrigin?: string;
+}
+export declare class SlackIntegration implements FactoryIntegration {
+    #private;
+    readonly id = "slack";
+    /**
+     * The OIDC connect flow round-trips a signed `state` through Slack, so the
+     * replica handling the callback must be able to verify a state a different
+     * replica signed.
+     */
+    readonly requiresStableStateSigner = true;
+    constructor(config: SlackIntegrationConfig);
+    channels(ctx: IntegrationContext): FactoryChannelsConfig;
+    routes(ctx: IntegrationContext): ApiRoute[];
+    diagnostics(): Record<string, unknown>;
+}
+//# sourceMappingURL=integration.d.ts.map

package/dist/integrations/slack/integration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration.d.ts","sourceRoot":"","sources":["../../../src/integrations/slack/integration.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,KAAK,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAKhG;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,2DAA2D;IAC3D,aAAa,EAAE,MAAM,CAAC;IACtB,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,gBAAiB,YAAW,kBAAkB;;IACzD,QAAQ,CAAC,EAAE,WAAW;IACtB;;;;OAIG;IACH,QAAQ,CAAC,yBAAyB,QAAQ;gBAU9B,MAAM,EAAE,sBAAsB;IAS1C,QAAQ,CAAC,GAAG,EAAE,kBAAkB,GAAG,qBAAqB;IAoBxD,MAAM,CAAC,GAAG,EAAE,kBAAkB,GAAG,QAAQ,EAAE;IAc3C,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CASvC"}

package/dist/integrations/slack/integration.js

@@ -0,0 +1,68 @@
+import { createSlackConnectRoutes } from "./connect-route.js";
+import { createSlackChannelsConfig } from "./slack.js";
+//#region src/integrations/slack/integration.ts
+var SlackIntegration = class {
+	id = "slack";
+	/**
+	* The OIDC connect flow round-trips a signed `state` through Slack, so the
+	* replica handling the callback must be able to verify a state a different
+	* replica signed.
+	*/
+	requiresStableStateSigner = true;
+	#config;
+	/**
+	* Whether `channels()` found a source-control owner on the context and wired
+	* repo-backed sessions. Set at the channels() attach path, which runs once at
+	* boot before diagnostics are served.
+	*/
+	#repoBackedSessions = false;
+	constructor(config) {
+		if (!config.signingSecret) throw new Error("SlackIntegration: 'signingSecret' is required — Slack cannot verify inbound requests without it.");
+		this.#config = config;
+	}
+	channels(ctx) {
+		const sourceControlOwner = ctx.storage.sourceControlOwner;
+		this.#repoBackedSessions = Boolean(sourceControlOwner);
+		return createSlackChannelsConfig({
+			slack: {
+				clientId: this.#config.clientId,
+				clientSecret: this.#config.clientSecret,
+				signingSecret: this.#config.signingSecret,
+				botToken: this.#config.botToken
+			},
+			accountLinks: ctx.storage.channelIdentity,
+			projects: ctx.storage.projects,
+			sourceControl: sourceControlOwner,
+			memorySettings: ctx.storage.memorySettings,
+			workItems: ctx.rules?.workItems
+		});
+	}
+	routes(ctx) {
+		const { clientId, clientSecret, oidcRedirectBaseUrl, uiOrigin } = this.#config;
+		return createSlackConnectRoutes({
+			auth: ctx.auth,
+			accountLinks: ctx.storage.channelIdentity,
+			tenantStateSigner: ctx.stateSigner,
+			oidc: clientId && clientSecret && oidcRedirectBaseUrl ? {
+				clientId,
+				clientSecret,
+				redirectBaseUrl: oidcRedirectBaseUrl,
+				uiOrigin
+			} : void 0,
+			projects: ctx.storage.projects
+		});
+	}
+	diagnostics() {
+		const { clientId, clientSecret, botToken, oidcRedirectBaseUrl } = this.#config;
+		return {
+			configured: true,
+			botTokenConfigured: Boolean(botToken),
+			oidcConfigured: Boolean(clientId && clientSecret && oidcRedirectBaseUrl),
+			repoBackedSessions: this.#repoBackedSessions
+		};
+	}
+};
+//#endregion
+export { SlackIntegration };
+
+//# sourceMappingURL=integration.js.map

package/dist/integrations/slack/integration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration.js","names":["#config","#repoBackedSessions"],"sources":["../../../src/integrations/slack/integration.ts"],"sourcesContent":["/**\n * `SlackIntegration` — Slack as a `FactoryIntegration`.\n *\n * Slack contributes two things to a factory: the chat channels that carry\n * inbound messages into agent runs (`channels()`), and the browser-facing\n * account-link routes that bind a Slack sender to a Mastra tenant (`routes()`).\n * Both used to be assembled by hand in the deploy entry, which had to reach\n * into the prepared agent controller by string key, resolve storage domains\n * itself, mint its own state signer, and splice routes onto the factory's\n * assembled server config. Implementing the integration interface instead means\n * the factory does all of that the same way it already does for GitHub and\n * Linear, and the entry's job shrinks to reading Slack's env vars once.\n *\n * Slack ships as a factory built-in alongside GitHub and Linear (it originally\n * lived in `mastracode/web` to keep `@mastra/slack`/`chat` out of this package;\n * the team reversed that so `create-factory` consumers get Slack channels out\n * of the box). The integration interface remains open — third parties still add\n * capabilities by implementing `FactoryIntegration` from outside the package.\n */\n\nimport type { ApiRoute } from '@mastra/core/server';\n\nimport type { FactoryChannelsConfig, FactoryIntegration, IntegrationContext } from '../base.js';\n\nimport { createSlackConnectRoutes } from './connect-route.js';\nimport { createSlackChannelsConfig } from './slack.js';\n\n/**\n * Slack app credentials, read from env ONCE by the deploy entry. `signingSecret`\n * is required because the Slack adapter validates it at construction — an\n * integration constructed without it would throw during `prepare()` rather than\n * reporting itself unconfigured.\n */\nexport interface SlackIntegrationConfig {\n  /** Verifies inbound Slack request signatures. Required. */\n  signingSecret: string;\n  /** Bot token used to post replies and ephemeral cards. */\n  botToken?: string;\n  /**\n   * OAuth client credentials. Required for account linking: \"Sign in with\n   * Slack\" (OIDC) is the only flow that writes a link, so without these the\n   * settings surface reports `canConnect: false` and no sender can link.\n   */\n  clientId?: string;\n  clientSecret?: string;\n  /**\n   * HTTPS origin Slack redirects back to. Slack requires HTTPS, so locally this\n   * is the tunnel origin rather than the app's own public URL.\n   */\n  oidcRedirectBaseUrl?: string;\n  /** SPA origin the post-connect redirect returns to. */\n  uiOrigin?: string;\n}\n\nexport class SlackIntegration implements FactoryIntegration {\n  readonly id = 'slack';\n  /**\n   * The OIDC connect flow round-trips a signed `state` through Slack, so the\n   * replica handling the callback must be able to verify a state a different\n   * replica signed.\n   */\n  readonly requiresStableStateSigner = true;\n\n  readonly #config: SlackIntegrationConfig;\n  /**\n   * Whether `channels()` found a source-control owner on the context and wired\n   * repo-backed sessions. Set at the channels() attach path, which runs once at\n   * boot before diagnostics are served.\n   */\n  #repoBackedSessions = false;\n\n  constructor(config: SlackIntegrationConfig) {\n    if (!config.signingSecret) {\n      throw new Error(\n        \"SlackIntegration: 'signingSecret' is required — Slack cannot verify inbound requests without it.\",\n      );\n    }\n    this.#config = config;\n  }\n\n  channels(ctx: IntegrationContext): FactoryChannelsConfig {\n    // Repo-backed sessions come from the factory's source-control owner\n    // (GitHub, when registered) — no config-level wiring by the entry.\n    const sourceControlOwner = ctx.storage.sourceControlOwner;\n    this.#repoBackedSessions = Boolean(sourceControlOwner);\n    return createSlackChannelsConfig({\n      slack: {\n        clientId: this.#config.clientId,\n        clientSecret: this.#config.clientSecret,\n        signingSecret: this.#config.signingSecret,\n        botToken: this.#config.botToken,\n      },\n      accountLinks: ctx.storage.channelIdentity,\n      projects: ctx.storage.projects,\n      sourceControl: sourceControlOwner,\n      memorySettings: ctx.storage.memorySettings,\n      workItems: ctx.rules?.workItems,\n    });\n  }\n\n  routes(ctx: IntegrationContext): ApiRoute[] {\n    const { clientId, clientSecret, oidcRedirectBaseUrl, uiOrigin } = this.#config;\n    return createSlackConnectRoutes({\n      auth: ctx.auth,\n      accountLinks: ctx.storage.channelIdentity,\n      tenantStateSigner: ctx.stateSigner,\n      oidc:\n        clientId && clientSecret && oidcRedirectBaseUrl\n          ? { clientId, clientSecret, redirectBaseUrl: oidcRedirectBaseUrl, uiOrigin }\n          : undefined,\n      projects: ctx.storage.projects,\n    });\n  }\n\n  diagnostics(): Record<string, unknown> {\n    const { clientId, clientSecret, botToken, oidcRedirectBaseUrl } = this.#config;\n    return {\n      configured: true,\n      botTokenConfigured: Boolean(botToken),\n      oidcConfigured: Boolean(clientId && clientSecret && oidcRedirectBaseUrl),\n      repoBackedSessions: this.#repoBackedSessions,\n    };\n  }\n}\n"],"mappings":";;;AAsDA,IAAa,mBAAb,MAA4D;CAC1D,KAAc;;;;;;CAMd,4BAAqC;CAErC;;;;;;CAMA,sBAAsB;CAEtB,YAAY,QAAgC;EAC1C,IAAI,CAAC,OAAO,eACV,MAAM,IAAI,MACR,kGACF;EAEF,KAAKA,UAAU;CACjB;CAEA,SAAS,KAAgD;EAGvD,MAAM,qBAAqB,IAAI,QAAQ;EACvC,KAAKC,sBAAsB,QAAQ,kBAAkB;EACrD,OAAO,0BAA0B;GAC/B,OAAO;IACL,UAAU,KAAKD,QAAQ;IACvB,cAAc,KAAKA,QAAQ;IAC3B,eAAe,KAAKA,QAAQ;IAC5B,UAAU,KAAKA,QAAQ;GACzB;GACA,cAAc,IAAI,QAAQ;GAC1B,UAAU,IAAI,QAAQ;GACtB,eAAe;GACf,gBAAgB,IAAI,QAAQ;GAC5B,WAAW,IAAI,OAAO;EACxB,CAAC;CACH;CAEA,OAAO,KAAqC;EAC1C,MAAM,EAAE,UAAU,cAAc,qBAAqB,aAAa,KAAKA;EACvE,OAAO,yBAAyB;GAC9B,MAAM,IAAI;GACV,cAAc,IAAI,QAAQ;GAC1B,mBAAmB,IAAI;GACvB,MACE,YAAY,gBAAgB,sBACxB;IAAE;IAAU;IAAc,iBAAiB;IAAqB;GAAS,IACzE,KAAA;GACN,UAAU,IAAI,QAAQ;EACxB,CAAC;CACH;CAEA,cAAuC;EACrC,MAAM,EAAE,UAAU,cAAc,UAAU,wBAAwB,KAAKA;EACvE,OAAO;GACL,YAAY;GACZ,oBAAoB,QAAQ,QAAQ;GACpC,gBAAgB,QAAQ,YAAY,gBAAgB,mBAAmB;GACvE,oBAAoB,KAAKC;EAC3B;CACF;AACF"}

package/dist/integrations/slack/slack.d.ts

@@ -0,0 +1,200 @@
+import type { ChannelHandler, ChannelHandlers, ChannelSessionStart, ResolveResourceId, ResolveThreadId } from '@mastra/core/channels';
+import type { ChannelAccountLink, ChannelAccountLinkKey, ChannelIdentityStorage } from '../../storage/domains/channel-identity/base.js';
+import type { MemorySettingsStorage } from '../../storage/domains/memory-settings/base.js';
+import type { FactoryProjectsStorage } from '../../storage/domains/projects/base.js';
+import type { SourceControlStorageHandle } from '../../storage/domains/source-control/base.js';
+import type { WorkItemsStorage } from '../../storage/domains/work-items/base.js';
+import type { FactoryChannelsConfig } from '../base.js';
+type HandlerThread = Parameters<ChannelHandler>[0];
+type HandlerMessage = Parameters<ChannelHandler>[1];
+/** Dependencies the Slack channel handlers close over, injected from the web entry. */
+interface SlackChannelDeps {
+    /**
+     * The factory's reverse-index store mapping a Slack sender to a Mastra
+     * tenant. When provided, inbound messages from an unlinked sender are not
+     * dispatched — the run only proceeds (with the sender's tenant stamped on
+     * the request context) once they've linked their account. Unlinked senders
+     * get an ephemeral "connect your account" card instead.
+     */
+    accountLinks?: ChannelIdentityStorage;
+    /**
+     * Factory projects domain. When provided (alongside `accountLinks`), a
+     * linked sender's run must also resolve to a Factory project before it
+     * dispatches: their link's default factory, else their tenant's only
+     * factory (stamped back onto the link), else an ephemeral "pick a default
+     * factory" card and no run. Unset → no factory routing (runs dispatch as
+     * before).
+     */
+    projects?: FactoryProjectsStorage;
+    /**
+     * Storage handle of the integration that owns source control
+     * (`IntegrationContext.storage.sourceControlOwner`). Used to make new Slack
+     * threads repo-backed: when the sender is linked and their factory has a
+     * repository, the thread's resourceId becomes a Factory user-session id (repo
+     * cloned on a `slack/{threadTs}` branch) instead of the chat-only
+     * `channel:...` id. It also lets a started session read back the project it
+     * belongs to. Nothing here is provider-specific — the connection is matched
+     * by the handle's own `integrationId`. Absent (no source-control integration
+     * registered) → chat-only sessions as before.
+     */
+    sourceControl?: SourceControlStorageHandle;
+    /**
+     * Observational-memory settings domain. When provided, a repo-backed session
+     * adopts its owner's memory settings on start, matching the web kickoff.
+     */
+    memorySettings?: MemorySettingsStorage;
+    /**
+     * Factory work-items domain. When provided, a dispatched new-session thread
+     * (DM or mention) upserts a Work-board card in Building (`execute`) carrying
+     * the Slack thread as its external source and binding the repo-backed
+     * session. Best-effort — a failure never blocks the run. Unset → no card.
+     */
+    workItems?: WorkItemsStorage;
+}
+/** Outcome of the sender-link gate for one inbound message. */
+type LinkedSenderResult = 
+/** Gating not configured — dispatch as before account linking existed. */
+{
+    status: 'ungated';
+}
+/** Sender unlinked — Connect card posted (when possible), do not dispatch. */
+ | {
+    status: 'blocked';
+}
+/** Sender linked — their tenant plus the sender key the link lives under. */
+ | {
+    status: 'linked';
+    link: ChannelAccountLink;
+    key: ChannelAccountLinkKey;
+};
+/**
+ * Resolve the sender's account link, posting an ephemeral "connect your
+ * account" card (visible only to the sender) linking into the web UI's
+ * Slack-connect flow when they're unlinked.
+ */
+export declare function resolveLinkedSender({ thread, message, accountLinks, }: {
+    thread: HandlerThread;
+    message: HandlerMessage;
+    accountLinks?: ChannelIdentityStorage;
+}): Promise<LinkedSenderResult>;
+/** Outcome of factory routing for one linked sender's inbound message. */
+type FactoryRouteResult = 
+/** Factory routing not configured — dispatch without a factory. */
+{
+    status: 'ungated';
+}
+/** No factory resolved — prompt card posted (when possible), do not dispatch. */
+ | {
+    status: 'blocked';
+}
+/** The Factory project this sender's runs route to. */
+ | {
+    status: 'resolved';
+    factoryProjectId: string;
+    slackWorkItemsEnabled: boolean;
+};
+/**
+ * Decide which Factory project a linked sender's run belongs to:
+ *
+ * 1. The link's `defaultFactoryProjectId`, when it still exists (a stale id —
+ *    deleted factory — falls through as if unset).
+ * 2. Else, the tenant's only factory, stamped back onto the link so it shows
+ *    up (and stays editable) in Connected Accounts settings.
+ * 3. Else — zero or several factories — an ephemeral "pick a default factory"
+ *    card deep-linking to settings, and the run is blocked.
+ */
+export declare function resolveFactoryForLink({ thread, message, link, key, accountLinks, projects, }: {
+    thread: HandlerThread;
+    message: HandlerMessage;
+    link: ChannelAccountLink;
+    key: ChannelAccountLinkKey;
+    accountLinks: ChannelIdentityStorage;
+    projects?: FactoryProjectsStorage;
+}): Promise<FactoryRouteResult>;
+/**
+ * Resolve the resourceId for a NEW Slack channel thread. A linked sender whose
+ * factory has a repository gets a Factory user-session id — the controller
+ * session then materializes the repo sandbox via the factory's dynamic
+ * workspace (clone + PAT), the session shows up in the web Sessions list, and
+ * View Session deep-links land on the normal workspace route. Everything else
+ * (unlinked, unrouted, repo-less, or no source control) keeps the chat-only
+ * `defaultResourceId`.
+ *
+ * Pure lookups only — cards for unlinked/unrouted senders are the dispatch
+ * gate's job; this hook must never post.
+ */
+export declare function createChannelResourceIdResolver(deps: SlackChannelDeps): ResolveResourceId;
+/**
+ * Thread id for a NEW Slack channel thread. Repo-backed threads take the
+ * user-session id AS their thread id, matching the web convention
+ * (FactoryStartCoordinator seeds threads with threadId = sessionId) so
+ * `/workspaces/{sessionId}/threads/{sessionId}` resolves Slack-created
+ * sessions exactly like web-created ones — no `?resourceId=` override needed.
+ * Chat-only threads keep the default random id: their `channel:...`
+ * resourceId is a memory key, not a unique thread id.
+ */
+export declare const resolveChannelThreadId: ResolveThreadId;
+/**
+ * Apply the factory's configuration to a Slack-created session the first time
+ * its thread reaches the controller.
+ *
+ * Without this a Slack session runs on the SDK's built-in mode default
+ * (`openai/gpt-5.5`), so a factory configured for any other provider fails every
+ * message with a missing-credentials error. The web kickoff has always applied
+ * the factory default; this brings Slack to the same footing.
+ *
+ * Only repo-backed threads are configured. Their resourceId IS the Factory
+ * session id, which the source-control rows turn back into a project — a
+ * chat-only `channel:...` id names no project, so there is nothing to read.
+ *
+ * Skips a session whose mode already has a model persisted on the thread. That
+ * is the durable record of a deliberate choice — either an earlier start or a
+ * user's own switch — and re-applying the factory default over it would undo
+ * the user's selection every time the process restarts.
+ */
+export declare function createChannelSessionStartHook(deps: SlackChannelDeps): ChannelSessionStart;
+/**
+ * Upsert the Work-board card for a dispatched Slack-thread run. Keyed on the
+ * thread via `externalSource` — the work-items domain's unique
+ * `(factory_project_id, source_key)` index makes repeat messages reuse the
+ * same card, and `reuseMode: 'preserve'` keeps a card a human already dragged
+ * across stages untouched. The card lands in Building (`execute`) for every
+ * dispatched thread (DM or mention) — there is deliberately no per-origin
+ * stage split; smart routing is a follow-up.
+ *
+ * The session id / branch / threadId and the workspace deep-link are resolved
+ * by the caller (which already looked up the internal thread), so this helper
+ * just shapes and writes. Best-effort: the run is already dispatched, so a
+ * failure logs instead of throwing — work-item creation must never abort a Slack run.
+ */
+export declare function upsertThreadWorkItem({ workItems, thread, message, link, factoryProjectId, session, url, }: {
+    workItems: WorkItemsStorage;
+    thread: HandlerThread;
+    message: HandlerMessage;
+    link: ChannelAccountLink;
+    factoryProjectId: string;
+    /**
+     * The repo-backed Factory session to bind under the `chat` role, or
+     * `undefined` for a chat-only thread (no Factory session to bind).
+     */
+    session?: {
+        sessionId: string;
+        branch: string;
+        threadId: string;
+    };
+    /** Workspace deep-link to the running session; omitted when no public URL. */
+    url?: string;
+}): Promise<void>;
+export declare const createHandlers: (deps: SlackChannelDeps) => ChannelHandlers;
+/** Slack app credentials, passed in explicitly rather than read from env here. */
+interface SlackCredentials {
+    clientId?: string;
+    clientSecret?: string;
+    signingSecret: string;
+    botToken?: string;
+}
+export declare function createSlackChannelsConfig(deps: SlackChannelDeps & {
+    slack: SlackCredentials;
+}): FactoryChannelsConfig;
+export {};
+//# sourceMappingURL=slack.d.ts.map

package/dist/integrations/slack/slack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack.d.ts","sourceRoot":"","sources":["../../../src/integrations/slack/slack.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,cAAc,EAEd,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EAChB,MAAM,uBAAuB,CAAC;AAW/B,OAAO,KAAK,EACV,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,gDAAgD,CAAC;AACxD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+CAA+C,CAAC;AAC3F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AACrF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AAC/F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AACjF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAOxD,KAAK,aAAa,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;AACnD,KAAK,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC;AAEpD,uFAAuF;AACvF,UAAU,gBAAgB;IACxB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,sBAAsB,CAAC;IACtC;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,sBAAsB,CAAC;IAClC;;;;;;;;;;OAUG;IACH,aAAa,CAAC,EAAE,0BAA0B,CAAC;IAC3C;;;OAGG;IACH,cAAc,CAAC,EAAE,qBAAqB,CAAC;IACvC;;;;;OAKG;IACH,SAAS,CAAC,EAAE,gBAAgB,CAAC;CAC9B;AAqCD,+DAA+D;AAC/D,KAAK,kBAAkB;AACrB,0EAA0E;AACxE;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE;AACvB,8EAA8E;GAC5E;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE;AACvB,6EAA6E;GAC3E;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,kBAAkB,CAAC;IAAC,GAAG,EAAE,qBAAqB,CAAA;CAAE,CAAC;AAE/E;;;;GAIG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,MAAM,EACN,OAAO,EACP,YAAY,GACb,EAAE;IACD,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,cAAc,CAAC;IACxB,YAAY,CAAC,EAAE,sBAAsB,CAAC;CACvC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAmB9B;AAsBD,0EAA0E;AAC1E,KAAK,kBAAkB;AACrB,mEAAmE;AACjE;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE;AACvB,iFAAiF;GAC/E;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE;AACvB,uDAAuD;GACrD;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC;IAAC,qBAAqB,EAAE,OAAO,CAAA;CAAE,CAAC;AAErF;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CAAC,EAC1C,MAAM,EACN,OAAO,EACP,IAAI,EACJ,GAAG,EACH,YAAY,EACZ,QAAQ,GACT,EAAE;IACD,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,cAAc,CAAC;IACxB,IAAI,EAAE,kBAAkB,CAAC;IACzB,GAAG,EAAE,qBAAqB,CAAC;IAC3B,YAAY,EAAE,sBAAsB,CAAC;IACrC,QAAQ,CAAC,EAAE,sBAAsB,CAAC;CACnC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAoD9B;AAaD;;;;;;;;;;;GAWG;AACH,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,gBAAgB,GAAG,iBAAiB,CA4DzF;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,EAAE,eAC6B,CAAC;AAEnE;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,6BAA6B,CAAC,IAAI,EAAE,gBAAgB,GAAG,mBAAmB,CAoBzF;AAqED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,oBAAoB,CAAC,EACzC,SAAS,EACT,MAAM,EACN,OAAO,EACP,IAAI,EACJ,gBAAgB,EAChB,OAAO,EACP,GAAG,GACJ,EAAE;IACD,SAAS,EAAE,gBAAgB,CAAC;IAC5B,MAAM,EAAE,aAAa,CAAC;IACtB,OAAO,EAAE,cAAc,CAAC;IACxB,IAAI,EAAE,kBAAkB,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,OAAO,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC;IAClE,8EAA8E;IAC9E,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,IAAI,CAAC,CA2BhB;AAkGD,eAAO,MAAM,cAAc,GAAI,MAAM,gBAAgB,KAAG,eAoBvD,CAAC;AAEF,kFAAkF;AAClF,UAAU,gBAAgB;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,gBAAgB,GAAG;IAAE,KAAK,EAAE,gBAAgB,CAAA;CAAE,GAAG,qBAAqB,CAiBrH"}