@moxxy/plugin-channel-slack 0.27.0

package/dist/keys.js

@@ -0,0 +1,78 @@
+/**
+ * Vault keys + env overrides + token validators shared by the channel, its
+ * subcommands, and the interactive setup wizard. Kept in their own module so the
+ * wizard / pair-flow helpers can import them without pulling in the plugin's
+ * full index.
+ */
+import { z } from '@moxxy/sdk';
+import { resolveSecret } from '@moxxy/channel-kit';
+/** Vault key for the Slack bot OAuth token (`xoxb-…`). */
+export const SLACK_BOT_TOKEN_KEY = 'slack_bot_token';
+/** Vault key for the Slack app signing secret (HMAC over the raw request body). */
+export const SLACK_SIGNING_SECRET_KEY = 'slack_signing_secret';
+/**
+ * Vault key for the authorized team/channel set (TOFU pairing). Stored as a
+ * JSON string of an authorization record so we can grow what we pin without a
+ * format change (today: `{ teamId, channelId? }`).
+ */
+export const SLACK_AUTHORIZED_KEY = 'slack_authorized';
+/** Env override for the bot token (beats the vault, matching every other channel). */
+export const SLACK_BOT_TOKEN_ENV = 'MOXXY_SLACK_BOT_TOKEN';
+/** Env override for the signing secret. */
+export const SLACK_SIGNING_SECRET_ENV = 'MOXXY_SLACK_SIGNING_SECRET';
+/** A Slack bot token always starts with `xoxb-`. */
+export const SLACK_BOT_TOKEN_RE = /^xoxb-[A-Za-z0-9-]{10,}$/;
+/** zod validator for a bot token (shape only — connectivity is tested via `auth.test`). */
+export const slackBotTokenSchema = z
+    .string()
+    .trim()
+    .regex(SLACK_BOT_TOKEN_RE, 'expected a Slack bot token like "xoxb-…"');
+/** zod validator for a signing secret (hex-ish; Slack uses a 32-byte hex secret). */
+export const slackSigningSecretSchema = z
+    .string()
+    .trim()
+    .min(16, 'signing secret looks too short')
+    .max(256, 'signing secret looks too long');
+/**
+ * Resolve the bot token: env override first, then the vault (the shared
+ * env→vault resolution in @moxxy/channel-kit). Returns null when neither is
+ * set. Trimmed; never returns an empty string.
+ */
+export async function resolveBotToken(vault) {
+    return resolveSecret(vault, { envVar: SLACK_BOT_TOKEN_ENV, vaultKey: SLACK_BOT_TOKEN_KEY });
+}
+/** Resolve the signing secret: env override first, then the vault. */
+export async function resolveSigningSecret(vault) {
+    return resolveSecret(vault, {
+        envVar: SLACK_SIGNING_SECRET_ENV,
+        vaultKey: SLACK_SIGNING_SECRET_KEY,
+    });
+}
+/** Parse the stored authorization record. Returns null for missing/corrupt. */
+export function parseAuthorization(raw) {
+    if (!raw)
+        return null;
+    try {
+        const parsed = JSON.parse(raw);
+        if (typeof parsed?.teamId === 'string' && parsed.teamId) {
+            return parsed.channelId
+                ? { teamId: parsed.teamId, channelId: parsed.channelId }
+                : { teamId: parsed.teamId };
+        }
+    }
+    catch {
+        /* corrupt — treat as unpaired */
+    }
+    return null;
+}
+/** Does an inbound event from `(teamId, channelId)` match the stored authorization? */
+export function authorizationMatches(auth, teamId, channelId) {
+    if (!auth || !teamId)
+        return false;
+    if (auth.teamId !== teamId)
+        return false;
+    if (auth.channelId && auth.channelId !== channelId)
+        return false;
+    return true;
+}
+//# sourceMappingURL=keys.js.map

package/dist/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,0DAA0D;AAC1D,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AACrD,mFAAmF;AACnF,MAAM,CAAC,MAAM,wBAAwB,GAAG,sBAAsB,CAAC;AAC/D;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAEvD,sFAAsF;AACtF,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAC3D,2CAA2C;AAC3C,MAAM,CAAC,MAAM,wBAAwB,GAAG,4BAA4B,CAAC;AAErE,oDAAoD;AACpD,MAAM,CAAC,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AAE7D,2FAA2F;AAC3F,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,KAAK,CAAC,kBAAkB,EAAE,0CAA0C,CAAC,CAAC;AAEzE,qFAAqF;AACrF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC;KACtC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,GAAG,CAAC,EAAE,EAAE,gCAAgC,CAAC;KACzC,GAAG,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;AAE7C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAErC;IACC,OAAO,aAAa,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,mBAAmB,EAAE,QAAQ,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAC9F,CAAC;AAED,sEAAsE;AACtE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAE1C;IACC,OAAO,aAAa,CAAC,KAAK,EAAE;QAC1B,MAAM,EAAE,wBAAwB;QAChC,QAAQ,EAAE,wBAAwB;KACnC,CAAC,CAAC;AACL,CAAC;AASD,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,GAA8B;IAC/D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgC,CAAC;QAC9D,IAAI,OAAO,MAAM,EAAE,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YACxD,OAAO,MAAM,CAAC,SAAS;gBACrB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE;gBACxD,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QAChC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iCAAiC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,oBAAoB,CAClC,IAA+B,EAC/B,MAA0B,EAC1B,SAA6B;IAE7B,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACjE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/pair-flow.d.ts

@@ -0,0 +1,18 @@
+import { type ChannelSubcommandContext } from '@moxxy/sdk';
+/**
+ * Drive the TOFU pairing flow end-to-end.
+ *
+ *   1. Build a SlackChannel from the subcommand ctx + wire the session's
+ *      permission resolver.
+ *   2. Subscribe to pair candidates BEFORE starting so the first @mention can't
+ *      race past us.
+ *   3. Start in `pair` mode (opens the tunnel; prints the Request URL).
+ *   4. Wait (with spinner) for the first verified inbound event.
+ *   5. Ask the operator to confirm the team/channel; on yes, persist it.
+ *   6. Hand off the running bot until Ctrl+C.
+ *
+ * Uses the default `proxyTunnel` provider (the channel imports it directly), so
+ * the public Request URL is available once the channel starts.
+ */
+export declare function runSlackPairFlow(ctx: ChannelSubcommandContext): Promise<number>;
+//# sourceMappingURL=pair-flow.d.ts.map

package/dist/pair-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pair-flow.d.ts","sourceRoot":"","sources":["../src/pair-flow.ts"],"names":[],"mappings":"AACA,OAAO,EAA0B,KAAK,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAOnF;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CA+FrF"}

package/dist/pair-flow.js

@@ -0,0 +1,106 @@
+import { confirm, isCancel, log, outro, spinner } from '@clack/prompts';
+import { exitAfterPairRequested } from '@moxxy/sdk';
+import { SlackChannel } from './channel.js';
+const ANSI = process.stdout.isTTY && !process.env.NO_COLOR;
+const dim = (s) => (ANSI ? `\x1b[2m${s}\x1b[22m` : s);
+/**
+ * Drive the TOFU pairing flow end-to-end.
+ *
+ *   1. Build a SlackChannel from the subcommand ctx + wire the session's
+ *      permission resolver.
+ *   2. Subscribe to pair candidates BEFORE starting so the first @mention can't
+ *      race past us.
+ *   3. Start in `pair` mode (opens the tunnel; prints the Request URL).
+ *   4. Wait (with spinner) for the first verified inbound event.
+ *   5. Ask the operator to confirm the team/channel; on yes, persist it.
+ *   6. Hand off the running bot until Ctrl+C.
+ *
+ * Uses the default `proxyTunnel` provider (the channel imports it directly), so
+ * the public Request URL is available once the channel starts.
+ */
+export async function runSlackPairFlow(ctx) {
+    const session = ctx.session;
+    const channel = new SlackChannel({
+        vault: ctx.deps.vault,
+        logger: ctx.deps.logger,
+    });
+    session.setPermissionResolver(channel.permissionResolver);
+    let candidateResolve = null;
+    const firstCandidate = new Promise((resolve) => {
+        candidateResolve = resolve;
+    });
+    const unsubscribe = channel.onPairCandidate((c) => {
+        candidateResolve?.(c);
+        candidateResolve = null;
+    });
+    outro(dim('opening pairing window…'));
+    let handle;
+    try {
+        handle = await channel.start({ session, pair: true });
+    }
+    catch (err) {
+        unsubscribe();
+        log.error(`Could not start the Slack channel: ${err instanceof Error ? err.message : String(err)}`);
+        return 1;
+    }
+    const stopBot = async () => {
+        unsubscribe();
+        try {
+            await handle.stop('wizard');
+        }
+        catch {
+            /* ignore */
+        }
+    };
+    if (channel.requestUrl) {
+        log.info(`Slack Request URL (paste into Event Subscriptions):\n  ${channel.requestUrl}\n` +
+            'Then mention the bot (@your-bot) in a channel to pair.');
+    }
+    const spin = spinner();
+    spin.start('Waiting for the first @mention from Slack…');
+    let candidate;
+    try {
+        candidate = await firstCandidate;
+    }
+    catch (err) {
+        spin.stop('pairing aborted');
+        log.error(`Pairing aborted: ${err instanceof Error ? err.message : String(err)}`);
+        await stopBot();
+        return 1;
+    }
+    spin.stop(`Got an event from team ${candidate.teamId}, channel ${candidate.channelId}.`);
+    const ok = await confirm({
+        message: `Authorize team ${candidate.teamId} / channel ${candidate.channelId}?`,
+    });
+    if (isCancel(ok) || !ok) {
+        log.warn('Pairing not confirmed.');
+        await stopBot();
+        return 0;
+    }
+    await channel.confirmPairing(candidate);
+    log.success(`Paired ✓ — team ${candidate.teamId} is authorized.`);
+    if (exitAfterPairRequested(ctx)) {
+        // Orchestrated pairing (`moxxy onboard`): hand control back — the caller
+        // starts the bot under its own service afterwards.
+        await stopBot();
+        return 0;
+    }
+    log.info('Bot is running. Press Ctrl+C to stop.');
+    const shutdown = async () => {
+        await stopBot();
+        await session.close('SIGINT').catch(() => undefined);
+        process.exit(0);
+    };
+    const onSignal = () => void shutdown();
+    process.once('SIGINT', onSignal);
+    process.once('SIGTERM', onSignal);
+    try {
+        await handle.running;
+        return 0;
+    }
+    finally {
+        process.removeListener('SIGINT', onSignal);
+        process.removeListener('SIGTERM', onSignal);
+    }
+}
+//# sourceMappingURL=pair-flow.js.map

package/dist/pair-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pair-flow.js","sourceRoot":"","sources":["../src/pair-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAiC,MAAM,YAAY,CAAC;AAEnF,OAAO,EAAE,YAAY,EAAsB,MAAM,cAAc,CAAC;AAEhE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC3D,MAAM,GAAG,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEtE;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAA6B;IAClE,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAC5B,MAAM,OAAO,GAAG,IAAI,YAAY,CAAC;QAC/B,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAmB;QACnC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAe;KACjC,CAAC,CAAC;IACH,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAE1D,IAAI,gBAAgB,GAAwC,IAAI,CAAC;IACjE,MAAM,cAAc,GAAG,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,EAAE;QAC5D,gBAAgB,GAAG,OAAO,CAAC;IAC7B,CAAC,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE;QAChD,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC;QACtB,gBAAgB,GAAG,IAAI,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,KAAK,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC;IAEtC,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,EAAE,CAAC;QACd,GAAG,CAAC,KAAK,CAAC,sCAAsC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpG,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;QACxC,WAAW,EAAE,CAAC;QACd,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,GAAG,CAAC,IAAI,CACN,0DAA0D,OAAO,CAAC,UAAU,IAAI;YAC9E,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAEzD,IAAI,SAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,cAAc,CAAC;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QAC7B,GAAG,CAAC,KAAK,CAAC,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClF,MAAM,OAAO,EAAE,CAAC;QAChB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,0BAA0B,SAAS,CAAC,MAAM,aAAa,SAAS,CAAC,SAAS,GAAG,CAAC,CAAC;IAEzF,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC;QACvB,OAAO,EAAE,kBAAkB,SAAS,CAAC,MAAM,cAAc,SAAS,CAAC,SAAS,GAAG;KAChF,CAAC,CAAC;IACH,IAAI,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACxB,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACnC,MAAM,OAAO,EAAE,CAAC;QAChB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,OAAO,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IACxC,GAAG,CAAC,OAAO,CAAC,mBAAmB,SAAS,CAAC,MAAM,iBAAiB,CAAC,CAAC;IAElE,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,yEAAyE;QACzE,mDAAmD;QACnD,MAAM,OAAO,EAAE,CAAC;QAChB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IAElD,MAAM,QAAQ,GAAG,KAAK,IAAmB,EAAE;QACzC,MAAM,OAAO,EAAE,CAAC;QAChB,MAAM,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,GAAS,EAAE,CAAC,KAAK,QAAQ,EAAE,CAAC;IAC7C,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAElC,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC3C,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC"}

package/dist/permission.d.ts

@@ -0,0 +1,27 @@
+import type { PermissionResolver } from '@moxxy/sdk';
+export interface SlackPermissionLogger {
+    info?(msg: string, meta?: Record<string, unknown>): void;
+}
+/**
+ * Build the Slack channel's autonomous permission resolver.
+ *
+ * The bot runs hands-off (no human-in-the-loop, like the HTTP channel): the
+ * operator declares trust upfront via `channels.slack.allowedTools`, and any
+ * tool NOT in that list is denied. The trust check + `'*'` expansion +
+ * audit-on-auto-approve wiring is the shared
+ * {@link createAuditedAllowListResolver} from `@moxxy/channel-kit` (which in
+ * turn reuses the SDK's `createAllowListResolver`: exact-name match →
+ * `allow_session`, else `deny`); this wrapper binds it to the Slack channel
+ * logger so every auto-approved call leaves a trail of what the autonomous run
+ * executed. An empty list denies everything (effectively read-only, since no
+ * side-effecting tool can run without a clicker).
+ *
+ * (Autonomous allow-list safety is a known trade-off; see TECH_DEBT — v1 has no
+ * Slack-button approval flow.)
+ */
+export declare function buildSlackPermissionResolver(opts: {
+    allowedTools: ReadonlyArray<string>;
+    allToolNames: ReadonlyArray<string>;
+    logger?: SlackPermissionLogger;
+}): PermissionResolver;
+//# sourceMappingURL=permission.d.ts.map

package/dist/permission.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.d.ts","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC1D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE;IACjD,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACpC,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,CAAC,EAAE,qBAAqB,CAAC;CAChC,GAAG,kBAAkB,CAarB"}

package/dist/permission.js

@@ -0,0 +1,33 @@
+import { createAuditedAllowListResolver } from '@moxxy/channel-kit';
+/**
+ * Build the Slack channel's autonomous permission resolver.
+ *
+ * The bot runs hands-off (no human-in-the-loop, like the HTTP channel): the
+ * operator declares trust upfront via `channels.slack.allowedTools`, and any
+ * tool NOT in that list is denied. The trust check + `'*'` expansion +
+ * audit-on-auto-approve wiring is the shared
+ * {@link createAuditedAllowListResolver} from `@moxxy/channel-kit` (which in
+ * turn reuses the SDK's `createAllowListResolver`: exact-name match →
+ * `allow_session`, else `deny`); this wrapper binds it to the Slack channel
+ * logger so every auto-approved call leaves a trail of what the autonomous run
+ * executed. An empty list denies everything (effectively read-only, since no
+ * side-effecting tool can run without a clicker).
+ *
+ * (Autonomous allow-list safety is a known trade-off; see TECH_DEBT — v1 has no
+ * Slack-button approval flow.)
+ */
+export function buildSlackPermissionResolver(opts) {
+    return createAuditedAllowListResolver({
+        name: 'slack-allow-list',
+        allowedTools: opts.allowedTools,
+        allToolNames: opts.allToolNames,
+        onAutoApprove: (call, { wildcard }) => {
+            opts.logger?.info?.('slack: auto-approved tool call', {
+                tool: call.name,
+                callId: call.callId,
+                wildcard,
+            });
+        },
+    });
+}
+//# sourceMappingURL=permission.js.map

package/dist/permission.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission.js","sourceRoot":"","sources":["../src/permission.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAOpE;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAI5C;IACC,OAAO,8BAA8B,CAAC;QACpC,IAAI,EAAE,kBAAkB;QACxB,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;YACpC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,gCAAgC,EAAE;gBACpD,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/server/dedupe.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Slack event idempotency cache. The implementation lives in
+ * `@moxxy/channel-kit` (the at-least-once delivery pattern is shared with
+ * every inbound-webhook channel and `@moxxy/plugin-webhooks`); re-exported
+ * here because it is part of this plugin's public API.
+ */
+export { DeliveryDedupeCache } from '@moxxy/channel-kit';
+//# sourceMappingURL=dedupe.d.ts.map

package/dist/server/dedupe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dedupe.d.ts","sourceRoot":"","sources":["../../src/server/dedupe.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/server/dedupe.js

@@ -0,0 +1,8 @@
+/**
+ * Slack event idempotency cache. The implementation lives in
+ * `@moxxy/channel-kit` (the at-least-once delivery pattern is shared with
+ * every inbound-webhook channel and `@moxxy/plugin-webhooks`); re-exported
+ * here because it is part of this plugin's public API.
+ */
+export { DeliveryDedupeCache } from '@moxxy/channel-kit';
+//# sourceMappingURL=dedupe.js.map

package/dist/server/dedupe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dedupe.js","sourceRoot":"","sources":["../../src/server/dedupe.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/server/ingest-server.d.ts

@@ -0,0 +1,80 @@
+import { DeliveryDedupeCache, type IngestHttpServerHandle } from '@moxxy/channel-kit';
+import { type SlackEventCallback } from './schema.js';
+/**
+ * The HTTP front-end for the Slack channel. Binds a `node:http` server to an
+ * ephemeral loopback port; the channel exposes it publicly via the proxy
+ * tunnel. Slack POSTs every event to `<public>/slack/events`.
+ *
+ * The transport scaffold (routing, health probe, size-capped raw-body read,
+ * verify gate, catch-all error handling) is `@moxxy/channel-kit`'s
+ * {@link IngestHttpServer}; Slack's HMAC scheme stays HERE as its verify hook,
+ * and this module owns everything after verification.
+ *
+ * Handler order — every gate runs BEFORE the session is touched (skill A8/A46):
+ *   1. POST-only (+ a GET `/slack/health` liveness probe).       [kit]
+ *   2. read the RAW body bytes (size cap) — required for the HMAC. [kit]
+ *   3. signature gate → 401 (verify over the raw bytes, before JSON.parse).
+ *   4. zod-validate the envelope → 400.
+ *   5. `url_verification` → echo `{ challenge }` (the handshake).
+ *   6. dedupe — drop on `X-Slack-Retry-Num` or a seen `event_id`.
+ *   7. drop the bot's own messages (`event.user === botUserId` / `event.bot_id`).
+ *   8. pairing gate — ignore unless the team/channel is authorized.
+ *   9. ACK 200 synchronously, THEN run the turn fire-and-forget (Slack's 3s
+ *      ack budget; never run `runTurn` on the request path).
+ *
+ * Every handler error is caught so a bad request can never escalate to a
+ * process-level uncaughtException.
+ */
+declare const EVENTS_PATH = "/slack/events";
+/** Decision the channel makes about an inbound event. */
+export interface DispatchContext {
+    readonly teamId: string | undefined;
+    readonly channel: string;
+    readonly text: string;
+    readonly user: string | undefined;
+    readonly threadTs: string;
+    readonly eventType: string;
+}
+export interface IngestServerHooks {
+    /** The bot's own user id, captured at start via `auth.test` (drop self-messages). */
+    readonly botUserId: string;
+    /** Is this team/channel authorized to drive the session? (pairing gate) */
+    isAuthorized(teamId: string | undefined, channel: string | undefined): boolean;
+    /**
+     * Observe a verified inbound event from a (possibly unauthorized) team/channel.
+     * Used by the TOFU `pair` flow to capture the first event and persist it.
+     * Returns true if the event was consumed by pairing (so it should NOT also
+     * drive a turn).
+     */
+    onVerifiedEvent?(ev: SlackEventCallback): boolean | Promise<boolean>;
+    /** Run a turn for an authorized, deduped, non-self event (fire-and-forget). */
+    dispatch(ctx: DispatchContext): void;
+}
+export interface IngestServerOptions {
+    readonly host?: string;
+    readonly signingSecret: string;
+    readonly hooks: IngestServerHooks;
+    /** Max request body size in bytes. Default 1MB. */
+    readonly maxBodyBytes?: number;
+    /** Override dedupe cache (tests). */
+    readonly dedupe?: DeliveryDedupeCache;
+    readonly logger?: {
+        info?(msg: string, meta?: Record<string, unknown>): void;
+        warn?(msg: string, meta?: Record<string, unknown>): void;
+    };
+}
+export type IngestServerHandle = IngestHttpServerHandle;
+export declare class IngestServer {
+    private readonly opts;
+    private readonly inner;
+    private readonly dedupe;
+    constructor(opts: IngestServerOptions);
+    get port(): number;
+    /** Bind on an ephemeral loopback port. Resolves once listening. */
+    start(): Promise<IngestServerHandle>;
+    stop(): Promise<void>;
+    /** Steps 4–9: everything after the raw-body + signature gates. */
+    private handleVerified;
+}
+export { EVENTS_PATH as SLACK_EVENTS_PATH };
+//# sourceMappingURL=ingest-server.d.ts.map

package/dist/server/ingest-server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingest-server.d.ts","sourceRoot":"","sources":["../../src/server/ingest-server.ts"],"names":[],"mappings":"AACA,OAAO,EACL,mBAAmB,EAGnB,KAAK,sBAAsB,EAC5B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAuB,KAAK,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAG3E;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,QAAA,MAAM,WAAW,kBAAkB,CAAC;AAGpC,yDAAyD;AACzD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,qFAAqF;IACrF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,2EAA2E;IAC3E,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;IAC/E;;;;;OAKG;IACH,eAAe,CAAC,CAAC,EAAE,EAAE,kBAAkB,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACrE,+EAA+E;IAC/E,QAAQ,CAAC,GAAG,EAAE,eAAe,GAAG,IAAI,CAAC;CACtC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAClC,mDAAmD;IACnD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,qCAAqC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;QACzD,IAAI,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;KAC1D,CAAC;CACH;AAED,MAAM,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AAExD,qBAAa,YAAY;IAIX,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAmB;IACzC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsB;gBAEhB,IAAI,EAAE,mBAAmB;IAgBtD,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,mEAAmE;IACnE,KAAK,IAAI,OAAO,CAAC,kBAAkB,CAAC;IAIpC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAIrB,kEAAkE;YACpD,cAAc;CAuF7B;AAED,OAAO,EAAE,WAAW,IAAI,iBAAiB,EAAE,CAAC"}

package/dist/server/ingest-server.js

@@ -0,0 +1,142 @@
+import { DeliveryDedupeCache, IngestHttpServer, respondJson, } from '@moxxy/channel-kit';
+import { slackEnvelopeSchema } from './schema.js';
+import { verifySlackSignature } from './verify.js';
+/**
+ * The HTTP front-end for the Slack channel. Binds a `node:http` server to an
+ * ephemeral loopback port; the channel exposes it publicly via the proxy
+ * tunnel. Slack POSTs every event to `<public>/slack/events`.
+ *
+ * The transport scaffold (routing, health probe, size-capped raw-body read,
+ * verify gate, catch-all error handling) is `@moxxy/channel-kit`'s
+ * {@link IngestHttpServer}; Slack's HMAC scheme stays HERE as its verify hook,
+ * and this module owns everything after verification.
+ *
+ * Handler order — every gate runs BEFORE the session is touched (skill A8/A46):
+ *   1. POST-only (+ a GET `/slack/health` liveness probe).       [kit]
+ *   2. read the RAW body bytes (size cap) — required for the HMAC. [kit]
+ *   3. signature gate → 401 (verify over the raw bytes, before JSON.parse).
+ *   4. zod-validate the envelope → 400.
+ *   5. `url_verification` → echo `{ challenge }` (the handshake).
+ *   6. dedupe — drop on `X-Slack-Retry-Num` or a seen `event_id`.
+ *   7. drop the bot's own messages (`event.user === botUserId` / `event.bot_id`).
+ *   8. pairing gate — ignore unless the team/channel is authorized.
+ *   9. ACK 200 synchronously, THEN run the turn fire-and-forget (Slack's 3s
+ *      ack budget; never run `runTurn` on the request path).
+ *
+ * Every handler error is caught so a bad request can never escalate to a
+ * process-level uncaughtException.
+ */
+const EVENTS_PATH = '/slack/events';
+const HEALTH_PATH = '/slack/health';
+export class IngestServer {
+    opts;
+    inner;
+    dedupe;
+    constructor(opts) {
+        this.opts = opts;
+        this.dedupe = opts.dedupe ?? new DeliveryDedupeCache();
+        this.inner = new IngestHttpServer({
+            ...(opts.host ? { host: opts.host } : {}),
+            eventsPath: EVENTS_PATH,
+            healthPath: HEALTH_PATH,
+            healthBody: () => ({ status: 'ok', listener: 'slack' }),
+            ...(opts.maxBodyBytes !== undefined ? { maxBodyBytes: opts.maxBodyBytes } : {}),
+            label: 'slack',
+            verify: ({ rawBody, headers }) => verifySlackSignature({ rawBody, headers, signingSecret: opts.signingSecret }),
+            handleVerified: (raw, req, res) => this.handleVerified(raw, req, res),
+            ...(opts.logger ? { logger: opts.logger } : {}),
+        });
+    }
+    get port() {
+        return this.inner.port;
+    }
+    /** Bind on an ephemeral loopback port. Resolves once listening. */
+    start() {
+        return this.inner.start();
+    }
+    stop() {
+        return this.inner.stop();
+    }
+    /** Steps 4–9: everything after the raw-body + signature gates. */
+    async handleVerified(raw, req, res) {
+        // 4) zod-validate the envelope.
+        let parsedJson;
+        try {
+            parsedJson = JSON.parse(raw.toString('utf8'));
+        }
+        catch {
+            respondJson(res, 400, { error: 'invalid_json' });
+            return;
+        }
+        const parsed = slackEnvelopeSchema.safeParse(parsedJson);
+        if (!parsed.success) {
+            this.opts.logger?.warn?.('slack: malformed envelope', {
+                issue: parsed.error.issues[0]?.message,
+            });
+            respondJson(res, 400, { error: 'bad_request' });
+            return;
+        }
+        const envelope = parsed.data;
+        // 5) url_verification handshake.
+        if (envelope.type === 'url_verification') {
+            respondJson(res, 200, { challenge: envelope.challenge });
+            return;
+        }
+        // From here on it's an event_callback. ACK fast; do everything else after
+        // (or fire-and-forget) so we stay inside Slack's 3-second ack budget.
+        const callback = envelope;
+        // 6) Dedupe — drop retries / repeated event ids. We record the id only for
+        // verified events so an unverified request can never poison the cache.
+        const isRetry = req.headers['x-slack-retry-num'] !== undefined;
+        const eventId = callback.event_id;
+        const dupe = isRetry || (eventId ? !this.dedupe.check(eventId) : false);
+        // 7) Self-message guard: never re-trigger on our own posts.
+        const ev = callback.event;
+        const isSelf = ev.bot_id !== undefined ||
+            (ev.user !== undefined && ev.user === this.opts.hooks.botUserId);
+        // ACK synchronously BEFORE running anything.
+        respondJson(res, 200, { status: 'ok' });
+        if (dupe || isSelf)
+            return;
+        // Pairing TOFU hook gets first crack at a verified event (even unauthorized),
+        // so it can capture + persist the first team/channel.
+        try {
+            const consumed = (await this.opts.hooks.onVerifiedEvent?.(callback)) ?? false;
+            if (consumed)
+                return;
+        }
+        catch (err) {
+            this.opts.logger?.warn?.('slack: pairing hook threw', { err: String(err) });
+        }
+        // 8) Pairing gate — only authorized team/channel drives the session.
+        if (!this.opts.hooks.isAuthorized(callback.team_id, ev.channel)) {
+            this.opts.logger?.info?.('slack: dropped event from unauthorized team/channel', {
+                team: callback.team_id,
+                channel: ev.channel,
+            });
+            return;
+        }
+        // Only act on message-ish events (we subscribe to app_mention primarily;
+        // message events with an edit/system subtype are ignored).
+        const eventType = ev.type;
+        if (eventType !== 'app_mention' && eventType !== 'message')
+            return;
+        if (ev.subtype)
+            return; // message_changed / message_deleted / channel_join …
+        const channel = ev.channel;
+        const text = (ev.text ?? '').trim();
+        if (!channel || !text)
+            return;
+        // 9) Run the turn fire-and-forget (already ACKed).
+        this.opts.hooks.dispatch({
+            teamId: callback.team_id,
+            channel,
+            text,
+            user: ev.user,
+            threadTs: ev.thread_ts ?? ev.ts ?? channel,
+            eventType,
+        });
+    }
+}
+export { EVENTS_PATH as SLACK_EVENTS_PATH };
+//# sourceMappingURL=ingest-server.js.map

package/dist/server/ingest-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingest-server.js","sourceRoot":"","sources":["../../src/server/ingest-server.ts"],"names":[],"mappings":"AACA,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,WAAW,GAEZ,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAA2B,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,WAAW,GAAG,eAAe,CAAC;AACpC,MAAM,WAAW,GAAG,eAAe,CAAC;AA4CpC,MAAM,OAAO,YAAY;IAIM;IAHZ,KAAK,CAAmB;IACxB,MAAM,CAAsB;IAE7C,YAA6B,IAAyB;QAAzB,SAAI,GAAJ,IAAI,CAAqB;QACpD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACvD,IAAI,CAAC,KAAK,GAAG,IAAI,gBAAgB,CAAC;YAChC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,UAAU,EAAE,WAAW;YACvB,UAAU,EAAE,WAAW;YACvB,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;YACvD,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/E,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAC/B,oBAAoB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC;YAC/E,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC;YACrE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;IAED,mEAAmE;IACnE,KAAK;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,kEAAkE;IAC1D,KAAK,CAAC,cAAc,CAC1B,GAAW,EACX,GAAoB,EACpB,GAAmB;QAEnB,gCAAgC;QAChC,IAAI,UAAmB,CAAC;QACxB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,2BAA2B,EAAE;gBACpD,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO;aACvC,CAAC,CAAC;YACH,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;QAE7B,iCAAiC;QACjC,IAAI,QAAQ,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;YACzC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QAED,0EAA0E;QAC1E,sEAAsE;QACtE,MAAM,QAAQ,GAAG,QAAQ,CAAC;QAE1B,2EAA2E;QAC3E,uEAAuE;QACvE,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,SAAS,CAAC;QAC/D,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC;QAClC,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAExE,4DAA4D;QAC5D,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC;QAC1B,MAAM,MAAM,GACV,EAAE,CAAC,MAAM,KAAK,SAAS;YACvB,CAAC,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAEnE,6CAA6C;QAC7C,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAExC,IAAI,IAAI,IAAI,MAAM;YAAE,OAAO;QAE3B,8EAA8E;QAC9E,sDAAsD;QACtD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,CAAC;YAC9E,IAAI,QAAQ;gBAAE,OAAO;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,2BAA2B,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC;QAED,qEAAqE;QACrE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;YAChE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,qDAAqD,EAAE;gBAC9E,IAAI,EAAE,QAAQ,CAAC,OAAO;gBACtB,OAAO,EAAE,EAAE,CAAC,OAAO;aACpB,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,yEAAyE;QACzE,2DAA2D;QAC3D,MAAM,SAAS,GAAG,EAAE,CAAC,IAAI,CAAC;QAC1B,IAAI,SAAS,KAAK,aAAa,IAAI,SAAS,KAAK,SAAS;YAAE,OAAO;QACnE,IAAI,EAAE,CAAC,OAAO;YAAE,OAAO,CAAC,qDAAqD;QAC7E,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC;QAC3B,MAAM,IAAI,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI;YAAE,OAAO;QAE9B,mDAAmD;QACnD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;YACvB,MAAM,EAAE,QAAQ,CAAC,OAAO;YACxB,OAAO;YACP,IAAI;YACJ,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,QAAQ,EAAE,EAAE,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,IAAI,OAAO;YAC1C,SAAS;SACV,CAAC,CAAC;IACL,CAAC;CACF;AAED,OAAO,EAAE,WAAW,IAAI,iBAAiB,EAAE,CAAC"}