@open-everywhere/provider-slack 0.1.0

package/dist/agent/channels/slack-events.d.ts

@@ -0,0 +1,1654 @@
+import { resolvePartition, type AttachSessionForCancel, type SeatCatchUpRequest, type SeatCatchUpResult, type ExternalPolicy, type IngestedChatMessage, PREFER_NO_REPLY_TOOL, type Partition, type BindableContext, type SingleWindowMentionPolicy, type UnifiedWindowWake, type ReplyDecision, type EngagementRow, type RoomRoster, type ContextLine, type WakeAttachment, type WakeMessageInput, type WakeParticipant, type WakeTrust, type NormalizedWake, type WakeEngagementTier } from "@open-everywhere/core/agent/adapter-api.js";
+import { type SpendGateDecision } from "./slack-spend-gate.js";
+import { type WakeBackscrollLines } from "./slack-wake-backscroll.js";
+export { PREFER_NO_REPLY_TOOL };
+import { type E2eDriverIdentity, type FinalMessageAction, type ReactionSinkDeps, type ReactionIngestOutcome, type ReactionVerb } from "@open-everywhere/core/agent/adapter-api.js";
+/**
+ * Minimal Slack `event_callback` envelope shape (the subset the parser reads). Mirrors
+ * Eve's internal `SlackEventCallback` without depending on a type it doesn't re-export.
+ */
+export interface SlackEventEnvelope {
+    readonly type?: string;
+    readonly team_id?: string;
+    /** The Enterprise Grid organisation the event's workspace belongs to (`E…`). Slack sends it on the
+     *  ENVELOPE, beside `team_id`, and only for a Grid install (OPE-1508). */
+    readonly enterprise_id?: string;
+    readonly event?: Record<string, unknown> & {
+        readonly type?: string;
+    };
+    readonly [key: string]: unknown;
+}
+/**
+ * The Enterprise Grid organisation id an event envelope names, or `undefined` (OPE-1508).
+ *
+ * 🔴 THE ENVELOPE IS THIS FUNCTION'S ONLY SOURCE. Slack puts `enterprise_id` beside `team_id` on the
+ * `event_callback` envelope and does NOT repeat it on the inner message object, so an ingress that
+ * only ever holds an inner event resolves nothing HERE and must carry the rung another way. Every
+ * ingress now carries it, and each reads exactly one source:
+ *   1. the wake paths driven from THIS file's own parses, and the group-DM/DM wake in
+ *      `slack-front.ts` — they hold the envelope, so they call this function;
+ *   2. the NATIVE MENTION forward, the common ingress. `slack-front.ts` forwards an ordinary
+ *      `app_mention` to eve's native channel handler (the single-window divert is the exception),
+ *      and eve hands that handler a `SlackMessage` whose `raw` is the inner event, with the envelope
+ *      already discarded. So the front route calls this function and stows the answer around the
+ *      forward (`withForwardedSlackEnvelope`, slack-identity.ts), and `slack.ts`'s `authFromFacts`
+ *      reads it back for that one message (OPE-1559);
+ *   3. the SHORTCUT ingress. A shortcut arrives on the interactivity route and has no event envelope
+ *      at all, so `slack-shortcut.ts` reads the payload's own `enterprise.id` OR `team.enterprise_id`
+ *      — Slack's two spellings for the same rung, one per install shape — into
+ *      `ParsedSlackShortcut.enterpriseId`, and `shortcutMessageEvent` spreads it onto the
+ *      `ParsedMessageEvent` (OPE-1559);
+ *   4. the `/oe` SLASH COMMAND door, which has its own route and its own urlencoded body.
+ *      `slack-commands.ts` reads the `enterprise_id` FORM FIELD straight into the bindable context
+ *      it hands `bindSlack` (OPE-1559).
+ * All four end at the same `enterprise_id` auth attribute, so one operator declaration answers for
+ * every door. Each source describes the ROOM's Grid; none of them reads the author's.
+ *
+ * The AUTHOR leg does not depend on any of this: it reads the author's own workspace and Grid from
+ * `users.info` ({@link slackAuthorIsMember}), so who counts as a member is decided the same way on
+ * every ingress.
+ *
+ * A non-string or empty value is `undefined` — the same defensive read `team_id` gets, because both
+ * are Slack's raw JSON.
+ */
+export declare function slackEnterpriseIdFromEnvelope(envelope: SlackEventEnvelope): string | undefined;
+/** A Slack `message` event narrowed to the fields the wake path needs. */
+export interface ParsedMessageEvent {
+    readonly channelId: string;
+    /** The message ts. */
+    readonly ts: string;
+    /** Thread root ts — present only for a threaded reply (engagement is per-thread). */
+    readonly threadTs?: string;
+    readonly teamId?: string;
+    /** The Enterprise Grid organisation the event's workspace sits in, when the envelope named one
+     *  ({@link slackEnterpriseIdFromEnvelope}). The trust walk's rung above the workspace. */
+    readonly enterpriseId?: string;
+    readonly userId?: string;
+    readonly botId?: string;
+    readonly subtype?: string;
+    readonly channelType?: string;
+    /** Plain text (mrkdwn) of the reply: the author's own text, plus any QUOTED SLACK MESSAGE
+     *  Slack parked in the message's legacy `attachments[]` — a forward, a share, or a message
+     *  permalink unfurl — appended under it ({@link resolveSlackInboundText}).
+     *
+     *  The de-dup unit is one EXTRACTED FIELD (an attachment's `text`, a block's line), never a
+     *  physical line: a field is kept or dropped whole. A field is dropped when the author's own
+     *  text already carries it as a phrase, or when the SAME attachment restated it. Two
+     *  DIFFERENT attachments carrying the same field both survive — that is two quoted messages
+     *  that agree, not a duplicate. A message with no quoted-message attachment is unchanged. */
+    readonly text: string;
+    /**
+     * The author's OWN typed text — `inner.text` verbatim, with no quoted content merged in.
+     *
+     * Use this, never {@link text}, for any rule that asks "what did this person SAY?" — the
+     * mention-sibling suppression and the name-drop wake needle both do. Reading the merged
+     * `text` there makes the agent act on words the author never typed: a forward of a message
+     * that @mentions the bot would be suppressed as a mention sibling, and a forward of a message
+     * naming the agent would wake it though nobody named it here. See the suppression in
+     * slack-front.ts for what is measured and what is assumed about Slack's `app_mention`.
+     */
+    readonly authoredText: string;
+    /**
+     * Pre-edit text, from Slack's `previous_message` — present ONLY for a `message_changed`
+     * edit (undefined otherwise, including a message_changed missing the field). Feeds the
+     * wake envelope's `<previous-body>` (wake-envelope.ts) so a judged turn can diff old↔new.
+     */
+    readonly previousText?: string;
+    /** True when the text @mentions the bot — those go through the normal mention path. */
+    readonly isAppMention: boolean;
+    /** Image/file attachment REFERENCES parsed off Slack's `files[]` (docs Part B) — surfaced in
+     *  the wake envelope so the agent knows an image exists and can `describe_image` it. Empty/
+     *  absent when the message carries no files. Never the bytes — just id/name/mimetype/url. */
+    readonly attachments?: readonly WakeAttachment[];
+}
+/** Parse Slack's `files[]` (on a message event's inner message) into attachment references.
+ *  Only well-formed entries survive; an image mimetype ⇒ kind "image" (describable), else
+ *  "file" (referenced, not yet readable). Pure; tolerant of Slack's loose shapes. */
+export declare function parseSlackFiles(files: unknown): WakeAttachment[];
+/**
+ * The text the model should see for one inbound Slack message: the author's own `text`, plus
+ * any QUOTED SLACK MESSAGE Slack put in `attachments[]` (a forward, a share, or a message
+ * permalink unfurl — see {@link hasSharedMessageAttachment}, which deliberately EXCLUDES a
+ * plain link unfurl) appended under it. A quoted field the author already typed is dropped, as is a field
+ * one attachment restates within itself. A field two DIFFERENT attachments carry is kept twice
+ * — that is two quoted messages that happen to agree, not a duplicate.
+ *
+ * IDENTITY on the common path: a message with no legacy `attachments[]`, and one whose
+ * attachments yield no new line, return the SAME `text` string unchanged. Only a message
+ * that actually carries unseen quoted content grows.
+ *
+ * 🔴 TRUST: the quoted content is merged INTO the author's body, so it INHERITS the forwarder's
+ * trust tier — it does not carry its own. `authorTrustAdmitsUnfencedBody` (wake-envelope.ts)
+ * keys on the author, so a vouched member's forward renders `from="human" trust="peer"` and the
+ * whole body is delivered UNFENCED: no `<untrusted_external_data>` wrapper, and no attribution
+ * separating the forwarder's words from the quoted author's. A member can therefore hand the
+ * model an outside author's words under their own standing. The body is still XML-escaped, so
+ * this is a standing question, not a structural one. It IS a widening of what a forward can put in
+ * front of the model, and it is deliberate. Attributing the quoted block to its own author is the
+ * improvement this leaves on the table.
+ *
+ * 🔴 THE SAME BOUNDARY NOW HOLDS ON BOTH PATHS (OPE-1380). eve's own inbound path merges legacy
+ * attachments too (`inbound.js` calls `resolveSlackInboundMrkdwn`), and it applies no such filter —
+ * so the `@mention` forward used to admit the plain LINK unfurl this function refuses.
+ * {@link stripUnfencedSlackAttachments} removes those attachments from the body before the forward,
+ * which is how the native path is held to `hasSharedMessageAttachment` without reaching inside eve.
+ * A quoted Slack message still reaches the model on both paths; scraped page text now reaches it on
+ * neither.
+ */
+/**
+ * Drop from a RAW webhook body every legacy attachment that is not a quoted Slack message, so the
+ * NATIVE forward path obeys the same boundary the diverted path does (OPE-1380).
+ *
+ * 🔴 WHY THIS EXISTS AT ALL. OPE-1374 fenced OUR path: {@link resolveSlackInboundText} reads only
+ * attachments {@link hasSharedMessageAttachment} admits, so a plain LINK unfurl's scraped page text
+ * never reaches the model. A direct `@mention` does not take that path — `slack-front.ts` forwards
+ * the request to eve's native `slackChannel`, whose own extractor
+ * (`dist/src/public/channels/slack/inbound-content.js`, `resolveSlackInboundMrkdwn`) flattens EVERY
+ * legacy attachment into the message body. It uses `hasSharedMessageAttachment` only to pick a merge
+ * STRATEGY, never to decide what may be extracted. So the same link unfurl the wake path refuses was
+ * merged, unfenced and untainted, into a `trust="peer"` member message on the mention path.
+ *
+ * WE CANNOT FENCE INSIDE EVE, SO WE FENCE WHAT EVE IS GIVEN. The attachment is removed from the body
+ * before the forward. The author's own `text` is untouched — including the URL they typed, which is
+ * the only part of a link unfurl a person actually wrote.
+ *
+ * 🔴 IDENTITY ON THE COMMON PATH, and that is load-bearing rather than an optimisation. A body with
+ * no `event.attachments`, and one whose attachments are ALL quoted Slack messages, is returned as
+ * the SAME string — so its Slack signature still verifies at the inner handler and the forward stays
+ * byte-identical to today's. Only a body that really carries an unfenced attachment is rewritten,
+ * and `slack-front.ts` re-signs exactly those.
+ *
+ * NEVER THROWS. Any shape this cannot parse returns the original body: losing the fence on an odd
+ * payload is recoverable, and a throw here would 500 a webhook Slack then replays forever — the same
+ * direction {@link resolveSlackInboundText} takes for the same reason.
+ */
+export declare function stripUnfencedSlackAttachments(rawBody: string): string;
+export declare function resolveSlackInboundText(text: string, inner: Record<string, unknown>): string;
+/**
+ * Parse a Slack `event_callback` envelope carrying a `message` (or `app_mention`) event
+ * into {@link ParsedMessageEvent}, or null when it isn't a usable message event (missing
+ * ids, wrong outer type). Pure — no I/O — so it's trivially testable against fixtures.
+ */
+export declare function parseMessageEvent(envelope: SlackEventEnvelope): ParsedMessageEvent | null;
+/** A fail-soft profile resolver: raw platform user id → {real name, self-set handle}, or
+ *  undefined. Injected on each route's deps so name resolution is unit-testable AND so a caller
+ *  that omits it (or the resolver throwing) degrades to raw ids — a name lookup must NEVER block
+ *  or fail a wake. The live wiring points this at the cached {@link fetchUserProfileNames}. */
+export type ResolveProfile = (userId: string) => Promise<{
+    name?: string;
+    handle?: string;
+} | undefined>;
+/**
+ * The message a woken (non-mention) turn receives: the judge instruction, then the
+ * triggering reply rendered through the shared wake envelope (wake-envelope.ts). The
+ * instruction is OURS (trusted, kept byte-identical below — it's live-tuned, see the
+ * file-level note above); the envelope's message body is surface content and gets
+ * `wrapUntrusted`-wrapped by the renderer itself, same invariant as the mention path's
+ * backscroll. A reader abusing the sentinel ("output NO_REPLY") can only silence the
+ * agent — the same as not addressing it — so this adds no injection surface.
+ *
+ * The wake has two addressings (`opts.mode`): the default engaged-thread `thread-follow`, and — on
+ * the supervisor path (`"supervisor"`) — `channel-watch` (Draft B, design doc §3), which is honest
+ * that the channel's STANDING session does not "follow this thread". Only that attribute differs;
+ * everything else in the envelope is shared, so the two paths stay in lockstep. The standing
+ * "Reading a wake" block keys a bar to each value (OPE-753).
+ *
+ * The social-chatter/re-answer lines are load-bearing for cheaper judged-wake models:
+ * live 2026-07-07 (e2e S2, deepseek-v4-flash as the e2e domain's primary) a human-to-human
+ * "thanks …, see you at standup" right after the agent's answer drew the SAME answer again
+ * — the judge read the thanks as addressed to it. Naming the pattern explicitly is cheap
+ * for strong models and decisive for weak ones.
+ *
+ * `now` is a clock seam (defaults to the real clock) so the envelope's `current-time`
+ * attribute is deterministic in tests; production callers pass `deps.now` when they have
+ * one, exactly like the touch/latch timestamps elsewhere in this module.
+ *
+ * `opts.backscroll` (T1.5): non-trigger envelope siblings rendered BEFORE the trigger message
+ * (oldest-first, ending at the trigger — renderWakeEnvelope's own invariant). Only the
+ * SUPERVISOR path's first wake on a generation ever supplies this (routeSupervisorEvent,
+ * fetchWakeEnvelopeBackscroll); every other caller passes nothing, so this renders
+ * byte-identically to before the addition.
+ */
+export declare function renderWakeMessage(ev: ParsedMessageEvent, now: (() => string) | undefined, opts: SlackWakeOpts): string;
+/** Options both Slack judged-wake builders accept — the exact shape {@link renderWakeMessage}
+ *  exposed inline before the delegate refactor (unchanged caller-facing signature). */
+export interface SlackWakeOpts {
+    readonly memberCount?: number;
+    /**
+     * Resolved per-wake trust tier for the TRIGGER author (identity/wake-trust.ts — the audit-wedge
+     * F3 assignment: roster admins → principal, internal members → peer, bots/external/unresolvable →
+     * relay, fail-closed). Every live route resolves and passes it.
+     *
+     * 🔴 REQUIRED, NOT OPTIONAL (OPE-596), and it is why `opts` itself is a REQUIRED argument on every
+     * builder that takes this bag. The field used to default to `"peer"`, which is fail-OPEN, and
+     * since OPE-577 the tier also decides whether the body carries the `<untrusted_external_data>`
+     * fence — so an absent tier REMOVED a fence. Leaving `opts` optional would have kept the same hole
+     * behind a different door: a caller that passes no bag at all still states no tier. A caller that
+     * cannot resolve a tier states the fail-closed one itself: `relay` for a machine author, `unauth`
+     * for a human the gate cannot vouch.
+     */
+    readonly trust: WakeTrust;
+    /** ENVELOPE-SIBLING backscroll (supervisor first-wake only): the carried TAIL of the outgoing
+     *  generation, or — with no recorded tail — the capped platform-history fallback. */
+    readonly backscroll?: readonly WakeMessageInput[];
+    /** The trigger author's resolved display name / handle (fail-safe: absent ⇒ raw id in `author`). */
+    readonly triggerAuthorName?: string;
+    readonly triggerAuthorHandle?: string;
+    /** The `<participants>` id→name/handle block (fail-safe: absent ⇒ no block). */
+    readonly participants?: readonly WakeParticipant[];
+    /** Wake mode. Default (undefined) = the engaged-thread `thread-follow` addressing;
+     *  `"supervisor"` = `channel-watch` — the channel supervisor is the channel's STANDING session, it
+     *  doesn't "follow this thread". Only {@link routeSupervisorEvent} passes it. */
+    readonly mode?: "supervisor";
+    /** Engagement calibration for a `channel-watch` wake (memory/domain.ts engagementTierFor), rendered
+     *  as the `<wake engagement>` attribute. Only the supervisor path passes it; unset ⇒ no attribute. */
+    readonly engagementTier?: WakeEngagementTier;
+    /**
+     * The trigger's thread carries a PARTICIPATING engagement row and is not stood down — render
+     * `follow-up="thread-engaged"`, the envelope's own word for "you are already in this
+     * conversation" (the standing "Reading a wake" block, instructions/access.ts). A WATCHER row
+     * (`participating: false`, what a name-drop latches) is not an enrolment and states nothing.
+     *
+     * 🔴 IT DOES NOT TOUCH `addressing`, DELIBERATELY. The supervisor path's `channel-watch` is the
+     * honest tier for a STANDING session (the Draft B decision this file's renderWakeMessage header
+     * records, pinned in slack-engagement-test.ts), and enrolment is a different fact from the
+     * silence bar. The two attributes were always meant to be read together; only one of them was
+     * ever emitted here.
+     *
+     * MEASURED (ship #195, F-EDIT / OPE-1673): the seat answered the thread root at 06:19:24Z, then
+     * declined the follow-up AND its edit as `not_relevant` — "not addressed to me" — because both
+     * wakes rendered as bare ambient activity. The engagement row `markEngaged` wrote for the root
+     * mention was in the store throughout; `routeSupervisorEvent` already reads it for the
+     * stood-down gate, so stating it costs no extra read.
+     *
+     * Unset/false ⇒ no attribute, byte-identical to before.
+     */
+    readonly threadEngaged?: boolean;
+    /** Host-minted wake id (rendered `<wake wake-id=…>`) — SINGLE-WINDOW unified path only
+     *  (channels/unified-window.ts): the id the model echoes to `reply` so the host resolves the
+     *  wake's origin from the map. Unset ⇒ byte-identical (no attribute). */
+    readonly wakeId?: string;
+    /** SINGLE-WINDOW addressed @mention (the GitHub reference's exact field —
+     *  github-supervisor.ts GitHubSupervisorWakeInput.directMention): render the supervisor wake
+     *  as `direct-mention` — the full judged envelope (so the `wake-id` survives for the reply
+     *  tool, the ONLY reply route on the unified channel) but with the ADDRESSED preamble that
+     *  tells the supervisor it was @mentioned and owes a reply, instead of the silence-biased
+     *  channel-watch preamble. Unset/false ⇒ the channel-watch wake, byte-identical to today.
+     *  Only routeSupervisorEvent's single-window mention path sets it (the front route kept the
+     *  mention because the seam said the unified window owns it). */
+    readonly directMention?: boolean;
+    /** THE DM WAKE (OPE-351 stage 2): render this as a direct-message wake — envelope `reason="dm"`
+     *  with the ADDRESSED preamble. Set only by slack-front.ts's `scheduleDmWake`. See
+     *  {@link slackDmWake} for why a DM is always addressed. Unset ⇒ byte-identical to today. */
+    readonly dm?: boolean;
+    /**
+     * The surface POSITIVELY REFUTED the trigger author's membership — a guest, a Connect stranger.
+     * It rides to the render as the trigger message's own `refuted`, which is a ONE-WAY FENCE
+     * BACKSTOP (wake-envelope.ts {@link authorTrustAdmitsUnfencedBody}): it can only ADD the
+     * `<untrusted_external_data>` fence to a body whose TIER already reads member-grade, never remove
+     * one, and it never moves the reference-only note.
+     *
+     * 🔴 IT EXISTS FOR THE DM FAMILY, where the tier and the refutation come apart (OPE-1486). Every
+     * CHANNEL route folds its refutation into `surfaceInternal` first, so a refuted channel author is
+     * already `unauth` and already fenced — those routes state nothing here and are byte-identical. A
+     * GROUP DM deliberately keeps the ROOM's tier, so an invited guest is still answered at
+     * `principal`; without this field that guest's body would reach the model UNFENCED. Absent means
+     * "not refuted", which includes "the probe could not answer" — this leg fails OPEN.
+     */
+    readonly triggerRefuted?: boolean;
+    /**
+     * THE NAME-DROP TIER on a standing-seat wake (OPE-1725): a person said the agent's name in this
+     * room without @-mentioning it, and the name-drop judge admitted the wake. Renders
+     * `addressing="name-drop"` plus the `follow-up="follows-on-reply"` contract.
+     * 🔴 IT IS A TIER, NOT A SESSION. Set only by {@link routeSupervisorEvent}'s name-drop path, which
+     * is the seat road: the wake lands in the ROOM'S OWN SEAT with the earlier exchange already in
+     * context, never in a fresh eve-native per-thread session. {@link directMention} wins where both
+     * are somehow set — an @mention is the more addressed fact. Unset ⇒ the channel-watch wake,
+     * byte-identical to today.
+     */
+    readonly nameDrop?: boolean;
+    /** This surface cannot read its own history between wakes, so the seat took no catch-up
+     *  (channels/seat-catch-up.ts `catchUpUnavailableReason`). Rendered as a trusted `<system-note>`;
+     *  unset ⇒ no note, which is every Slack wake, because Slack registers a fetch. */
+    readonly catchUpUnavailable?: string;
+    /**
+     * THE NAME-DROP HYDRATION, ON THE SEAT ROAD (OPE-1725). The surrounding conversation
+     * {@link routeNameDropEvent} fetches for a name-drop, as RAW {@link ContextLine}s — renderWake
+     * wraps them through the shared `renderContext`, exactly as it does on the native route.
+     *
+     * 🔴 IT IS THE SIDE-CHANNEL SLOT, NOT THE ENVELOPE BACKSCROLL, and the two must not be confused.
+     * {@link backscroll} carries the seat's own bootstrap/catch-up read as envelope siblings; this
+     * carries the name-drop judge's own "what is being discussed" hydration, which is the ONE slot
+     * `withholdNameDropContext` fills (OPE-525). Set only by the seat road's name-drop path; unset ⇒
+     * no context block at all, byte-identical to an ambient seat wake.
+     *
+     * 🔴 IT CARRIES ONLY WHAT {@link backscroll} DOES NOT (OPE-1743). The caller de-duplicates the two
+     * slots by message id before it fills them, so one wake renders each room message ONCE: the
+     * envelope keeps the overlap with its per-message author, tier and send time, and this slot keeps
+     * the older conversation the envelope's window never reached. ONE EXEMPTION: a line whose author the
+     * surface positively REFUTED stays here even when the envelope carries the same message, because the
+     * two slots are graded by different legs and the envelope's copy may be graded by neither (OPE-1742).
+     */
+    readonly contextLines?: readonly ContextLine[];
+    /** `renderContext`'s provenance label for {@link contextLines}. */
+    readonly contextSource?: string;
+    /** OUR trusted read-more instruction, appended OUTSIDE the untrusted wrap by `renderContext`
+     *  and only when the rendered slice fills the count cap. */
+    readonly readMoreHint?: string;
+}
+/** The engaged-conversation `thread-follow` judged wake (the default {@link renderWakeMessage} path). */
+export declare function slackThreadFollowWake(ev: ParsedMessageEvent, opts: SlackWakeOpts): NormalizedWake;
+/** The standing-session supervisor judged wake (routeSupervisorEvent's path): `channel-watch`
+ *  addressing by default, or — when {@link SlackWakeOpts.directMention} says the single-window seam
+ *  kept the @mention — the ADDRESSED `direct-mention` addressing, which keeps the envelope and its
+ *  wake-id and tells the standing block this wake is owed an answer. */
+export declare function slackChannelWatchWake(ev: ParsedMessageEvent, opts: SlackWakeOpts): NormalizedWake;
+/**
+ * THE DM WAKE (OPE-351 stage 2; group DMs added at stage 4) — the first producer of the `dm` envelope
+ * reason, which has been in the vocabulary (channels/wake-envelope.ts {@link WakeReason}) since it was
+ * reverse-engineered from Tag with no emitter behind it.
+ *
+ * ADDRESSING IS `direct-mention`, ALWAYS, and it is doing two jobs at once. Semantically it is simply
+ * TRUE for a 1:1: everything said in a 1:1 DM is said to the agent, so a DM is never judged for whether
+ * it was addressed — the engagement-tier dial, the name-drop judge and the channel-watch silence bias
+ * are all category errors here (slack-front.ts routes a DM around routeSupervisorEvent entirely for that
+ * reason). Mechanically it is LOAD-BEARING: `direct-mention` is what stamps `oe_addressing` through
+ * the divert, which marks the wake as OWED a reply. It selects the `[direct]` preamble, whose reply
+ * mandate names the wake-id the model must echo back, and it classifies the drop row if the turn
+ * ends in prose anyway.
+ * 🔴 IT IS NOT A DELIVERY PATH (OPE-1982). It used to arm the unified channel's addressed-prose
+ * bridge, so a DM answer written as prose instead of a `reply` call still reached the room. That
+ * bridge is deleted: on the unified channel a turn's closing prose is DROPPED on every addressing
+ * and re-driven once towards the tool, so a DM answer reaches its room only through a `reply` call.
+ *
+ * A GROUP DM IS THE SAME WAKE. The addressing is identical (the drop classification and the reply mandate
+ * are needed just the same), and the room shape reaches the model on `<channel type="mpim">` against
+ * a 1:1's `type="im"`. The old `groupDm` flag selected the opening clause of a PROSE preamble that no
+ * longer exists, so OPE-770 deleted it — the schema render has no prose to select. The silence escape
+ * the reply mandate carries is what makes unconditional WAKING compatible with conditional REPLYING
+ * in a room that also holds other humans.
+ *
+ * `reason` is `dm` rather than `mention` because the envelope's reason describes the SURFACE SHAPE the
+ * wake arrived on, and telling a DM it was "@mentioned" is a small lie that costs orientation. A group
+ * DM keeps `dm` for the same reason: {@link WakeReason}'s own definition is "a direct-message-EQUIVALENT
+ * surface", which an mpim is — inventing a fourth value for it would extrapolate a Tag-derived
+ * vocabulary with no evidence behind the new entry.
+ */
+export declare function slackDmWake(ev: ParsedMessageEvent, opts: SlackWakeOpts): NormalizedWake;
+/**
+ * What `message.completed` (channels/slack.ts) should actually DO with a terminal
+ * {@link FinalMessageAction} ("silent" or "post" — never "buffer-tool-status", which is
+ * an intermediate step with no turn-final effects at all and is handled before this is
+ * called), given whether an approval card already posted THIS turn (a propose tool —
+ * tools/set_spend_limit.ts and its siblings — calling requestApproval; see
+ * approvals/card-signal.ts).
+ *
+ * "reply" is the outcome for BOTH an ordinary post and a card-suppressed one: a card
+ * posting mid-turn still means the agent ACTED and is a PARTICIPANT in this thread —
+ * 👀 clears, the thread engages, oeUninvited clears — exactly like any other reply.
+ * `postText: false` gates ONLY the actual `channel.thread.post` call (Tommy, live: "the
+ * card should suffice" — the card already says everything a narrated reply would
+ * repeat). A refusal/validation path in a propose tool never reaches requestApproval at
+ * all (see tools/set_spend_limit.ts's header), so its thrown error still surfaces as a
+ * normal `postText: true` reply — only a turn where a card was ACTUALLY posted is
+ * suppressed.
+ */
+export type TurnEffects = {
+    readonly kind: "silent";
+} | {
+    readonly kind: "reply";
+    readonly postText: boolean;
+};
+export declare function turnEffectsFor(action: Extract<FinalMessageAction, {
+    kind: "silent";
+} | {
+    kind: "post";
+}>, cardPostedThisTurn: boolean): TurnEffects;
+/** Dependencies injected into {@link routeMessageEvent} so the decision is fully testable. */
+export interface MessageRouteDeps {
+    /** Engagement lookup (defaults to the operational store via isThreadEngaged). */
+    readonly isEngaged: (p: ReturnType<typeof resolvePartition>, threadTs: string) => Promise<boolean>;
+    /** Read the full engagement record — used to set oeUninvited from the thread's
+     *  `participating` flag. Optional so older test doubles keep compiling (absent ⇒
+     *  fail-safe uninvited); live wiring passes the real store call. */
+    readonly getEngagement?: (p: Partition, threadTs: string) => Promise<EngagementRow | null>;
+    /** The wake — continue the thread's session with this reply. */
+    readonly wake: (input: {
+        channelId: string;
+        threadTs: string;
+        auth: unknown;
+        message: string;
+        state?: unknown;
+    }) => Promise<void>;
+    /** Refresh the engagement's last-turn time after a successful wake. */
+    readonly touch?: (p: ReturnType<typeof resolvePartition>, threadTs: string, atIso: string) => Promise<void>;
+    /** Clock seam for the touch timestamp (tests pass a fixed value). */
+    readonly now?: () => string;
+    /**
+     * Positively confirm the channel is internal (TTL-cached conversations.info,
+     * fail-closed) so the wake auth can carry the trust verdict. Optional: absent (or
+     * unconfirmed) the wake still delivers, just with an UNSTAMPED auth — the session
+     * fails closed to `external` (no shared memory / domain skills) for that turn.
+     */
+    readonly confirmInternal?: (channelId: string) => Promise<boolean>;
+    /** Append a durable audit row. Optional; best-effort. */
+    readonly audit?: (action: string, detail: Record<string, unknown>) => Promise<void>;
+    /** Resolve the trigger author's display name for the envelope (fail-soft). Optional so
+     *  existing test doubles keep compiling AND so a wake never depends on a name lookup — absent
+     *  or throwing ⇒ the raw id renders. Live wiring points this at {@link fetchUserProfileNames}. */
+    readonly resolveProfile?: ResolveProfile;
+}
+/** The outcome of routing one message event — the decision plus whether a wake fired. */
+export interface RouteOutcome extends ReplyDecision {
+    readonly woke: boolean;
+}
+export declare function bindableFor(ev: ParsedMessageEvent): BindableContext;
+/**
+ * Route one parsed message event: apply the delivery policy and, if it passes, wake the
+ * engaged thread's session. Returns the decision + whether a wake fired. All side effects
+ * go through injected deps so the policy ordering is unit-tested without Slack or a live
+ * runtime. The engagement registry is consulted ONLY when the cheap, pure disqualifiers
+ * pass (subtype/bot/mention/not-in-thread), keeping the DB off the hot path for chatter.
+ */
+export declare function routeMessageEvent(ev: ParsedMessageEvent, deps: MessageRouteDeps): Promise<RouteOutcome>;
+/**
+ * Production deps: engagement from the operational store, and a wake built over a route
+ * handler's `send`. `send` is the channel-route primitive that continues a session by
+ * continuation token — `slackContinuationToken(channel, thread)` is the Slack thread's
+ * token, so this delivers the reply straight into the live thread session.
+ */
+/** The channel-route `send` shape the wake paths need (mirrors Eve's SendFn loosely). */
+export type WakeSend = (input: {
+    message: string;
+    context?: readonly string[];
+}, opts: {
+    auth: unknown;
+    continuationToken: string;
+    state?: unknown;
+}) => Promise<unknown>;
+/**
+ * The SPEND GATE at the ENGAGEMENT door (OPE-33) — the second call site of the ONE gate
+ * (slack-spend-gate.ts); the first is slack.ts `onInbound` (the mention door).
+ *
+ * WHY BOTH: on eve 0.27.5 the compiled slackChannel drops self-authored messages
+ * (`isSelfAuthoredSlackMessage`, matching `raw.app_id` against the envelope's `api_app_id`)
+ * BEFORE `onAppMention`/`onDirectMessage` run — and Slack stamps `app_id` on anything an app
+ * posts through the Web API, user token included. Every driver-app-authored mention therefore
+ * skips the mention door entirely and re-enters through THIS path (live-proven 2026-07-25:
+ * capped surfaces never refused). Gating only the mention handler is gating one of two doors.
+ *
+ * Refuse-and-drop semantics mirror the mention door exactly: over cap + no admin bypass ⇒ post
+ * the refusal, return "declined", and the caller dispatches NO model turn — DMs included
+ * (OPE-267 removed checkCap's DM exemption). Fail-open on any gate error (the helper's own
+ * console.warn).
+ *
+ * The refusal is posted through {@link postOnce}, keyed on (surface, thread root): an ambient
+ * channel over cap answers ONCE per conversation instead of once per message, while a genuinely
+ * new thread still gets told why it's being ignored. Fail-open by contract — a dedupe-store
+ * outage posts anyway.
+ */
+export declare function slackWakeSpendGate(ev: ParsedMessageEvent, p: Partition, threadRootTs: string): Promise<SpendGateDecision>;
+/**
+ * {@link tenantFenceDeclined} for a door the FRONT route owns — the diverted DM window and the
+ * shortcut ingress (OPE-1644).
+ *
+ * 🔴 WHY IT IS EXPORTED RATHER THAN COPIED. Those doors live in `slack-front.ts`, whose
+ * `scheduleDmWake` dispatches a full model turn onto the DM SEAT — the largest grant this
+ * deployment makes, holding a window token, delegation and memory — and which consulted no fence at
+ * all. A second copy of the rule at a second door is precisely the drift `slack-tenant-fence.ts`
+ * exists to prevent, so the front route calls THIS, and gets the same decision, the same audit row
+ * and the same silent-drop posture. Only `door` and `route` differ: an operator reading the trail
+ * needs to know which ingress refused.
+ */
+export declare function slackFrontTenantFenceDeclined(ev: ParsedMessageEvent, door: string, route: string): boolean;
+/**
+ * THE TENANT FENCE AT THE INTERACTIVITY CLICK INGRESS (OPE-1680) — the six `block_actions` /
+ * `view_submission` branches `slack-front.ts` owns, which arrive on the interactivity URL and carry
+ * no {@link ParsedMessageEvent}.
+ *
+ * 🔴 WHY A CLICK IS FENCED THOUGH IT RUNS NO MODEL TURN. What an unadmitted workspace reaches here is
+ * not a turn — it is the ALIASING the fence exists for, which is the same argument OPE-1633 used to
+ * fence `/oe`. On Slack a member id is issued PER WORKSPACE, so a foreign workspace's click is a
+ * bare `U…` that our own machinery must then decide about: it approves or rejects a pending action,
+ * opens a credential-intake modal, stores a pasted secret, mints an OAuth URL, answers a
+ * credential-grant ask, or cancels a running session. Every one of those consults the roster, writes
+ * audit rows into this deployment's trail, and posts back on OUR bot token.
+ *
+ * 🔴 WHAT THE FOREIGN CLICKER SEES: THE ACK, AND NOTHING ELSE. Slack still gets the empty 200 an
+ * interactivity route owes, so it does not retry. Nothing is POSTED back, for the reason every wake
+ * door gives — we cannot safely identify anybody in an unadmitted workspace, and a foreign tenant
+ * learning it reached a live deployment is more than it needs to know. "A silent button looks
+ * broken" does not apply: every one of these six buttons is posted BY THIS DEPLOYMENT, into a room
+ * it chose, and it posts into no unadmitted workspace — so a refused click has no legitimate reader
+ * waiting on it.
+ *
+ * 🔴 AND IT IS NOT A FORWARD. `forwardNative()` is the front route's fall-through when a handler
+ * disagrees with the classification; a tenant refusal must never take it, because eve's own channel
+ * asks no tenant question at all and would decide the same payload one layer down.
+ *
+ * The ROW is the same `surface.wake_dropped` row, carrying the same {@link UNADMITTED_TENANT_DROP_REASON},
+ * that every other door writes — so ONE control-API query still finds every tenant drop on this
+ * deployment. What differs is the key: a click has no message, so the row carries the click's own
+ * channel where the payload names one and {@link SLACK_INTERACTIVITY_SURFACE} where it does not, and
+ * its `ts` is `null` rather than an invented stamp. The partition resolves from those ids exactly as
+ * a message's does — the ORG is always this deployment's, and the platform/workspace/surface record
+ * the FOREIGN ids, which is what makes the row a statement about who was refused.
+ */
+export declare function slackInteractivityTenantFenceDeclined(ids: {
+    readonly teamId?: string | undefined;
+    readonly enterpriseId?: string | undefined;
+    readonly channelId?: string | undefined;
+    readonly userId?: string | undefined;
+}, door: string, route: string): boolean;
+/**
+ * The audit reason a STOOD-DOWN thread's dropped wake records (OPE-1669), and it is exported so the
+ * contract test pins the door against the constant rather than against a copy of its wording.
+ *
+ * 🔴 IT IS THE ROW THE SHIP HAD NO WAY TO ASK FOR. On #191 a plain thread-follow into a thread whose
+ * `engagement.stood_down` row said `marked:true` was answered anyway, and the trail could not say
+ * whether the door had fired and the reply plane leaked, or the door had never fired at all — this
+ * drop wrote nothing, so its absence proved nothing. It writes one row now, carrying the ANCHOR, so
+ * it joins to `engagement.stood_down` on the engagement registry's own key.
+ * The old rationale for silence was log volume in a chatty stopped thread. It is answered, not
+ * ignored: this fires only on a thread that is BOTH engaged and stopped, which is a conversation the
+ * agent was explicitly asked to leave — bounded by real human traffic in one thread, and the one
+ * question an operator asks about such a thread is exactly the one this row answers.
+ */
+export declare const STOOD_DOWN_DROP_REASON = "thread stopped \u2014 deterministic silence until an explicit @-mention re-invites";
+/**
+ * The audit reason the DM DOOR records when it drops a bot-authored message (OPE-1022).
+ *
+ * Deliberately NOT {@link BOT_AUTHOR_DROP_REASON}. The engagement door drops only a bot the driver
+ * allowlist does not vouch for, so its row can blame the allowlist. The DM door admits NO bot
+ * author at all — an allowlisted driver's DM is dropped here too — so a row that said "is not an
+ * allowlisted driver" would send the reader to fix an allowlist that was never consulted. The
+ * `vouchedDriver` detail carries that distinction as data instead.
+ */
+export declare const DM_BOT_AUTHOR_DROP_REASON = "bot author \u2014 the DM door admits no bot author";
+/**
+ * Audit the DM door's bot-author drop, and answer whether a row was written (OPE-1022).
+ *
+ * WHY THIS EXISTS. `slack-front.ts`'s DM branch dropped every bot-authored `message.im` /
+ * `message.mpim` with a bare `return OK()` — no audit row, no log line. Slack stamps `bot_id` on
+ * ANYTHING an app posts through the Web API, a user token included, so an operator probing the
+ * deployment with a script sees the whole surface go silent and has nothing to read. That is the
+ * exact shape diagnosed on 2026-08-23: two probe DMs vanished with zero trace and read as "Slack
+ * inbound is dead", when the drop was working as designed and only its silence was the defect.
+ *
+ * OUR OWN ECHO IS NOT AUDITED. Slack re-delivers every reply the bot posts as a `message.im` event
+ * carrying our own `bot_id`, so an unconditional row would double every reply with noise and make
+ * the trail unreadable — the same reasoning that keeps the ordinary engagement non-candidates out
+ * of the log. `selfBotId` comes from `auth.test` and is best-effort: when it cannot be resolved we
+ * audit the echo too, because an over-full trail beats a silent one.
+ *
+ * Best-effort by contract: never throws, never changes the decision. The caller hands the returned
+ * promise to `waitUntil` so the write survives the route's immediate 200.
+ */
+export declare function auditDmBotAuthorDrop(ev: ParsedMessageEvent, dmKind: "im" | "mpim", selfBotId: string | undefined): Promise<boolean>;
+/**
+ * THE DM DOOR'S NAMED-DRIVER CARVE-OUT (OPE-1023, OPE-1739). True ⇒ this bot-authored DM is one of
+ * the deployment's
+ * NAMED e2e driver and the door admits it; false ⇒ the door drops it, which is what every bot
+ * author gets by default.
+ *
+ * WHY IT EXISTS. Slack stamps `bot_id` on anything an app posts through the Web API, a USER token
+ * included (measured 2026-08-23). So the e2e driver — which posts as a real human through an `xoxp`
+ * token — cannot drive a real Slack DM: its post reaches this door as bot-authored and drops. The
+ * harness worked around it by FORGING a signed `event_callback` with no `bot_id`, which meant every
+ * DM leg in the pack exercised a synthetic envelope and a regression in Slack's own DM delivery to
+ * us was invisible. This carve-out lets the driver in through the real front door.
+ *
+ * WHY IT IS NOT THE `OE_TEST_DRIVER_IDS` ALLOWLIST, which already lifts the same bot at the
+ * engagement and mention doors. A DM seat holds a window token, delegation and memory, so admitting
+ * a bot into a DM is a strictly larger grant than admitting one into a watched channel. Reusing the
+ * channel allowlist would have widened the DM door for every deployment that already sets it, on
+ * upgrade, with no diff naming the change. The setting is the diff.
+ *
+ * POSTURE (every part load-bearing):
+ *   - EMPTY BY DEFAULT. The shipped `wake.e2eDrivers` is empty, and an empty list matches nothing
+ *     in `isE2eDriver` — so an unconfigured deployment reaches the same verdict, and the same
+ *     `surface.wake_dropped` row, that it did before this carve-out existed.
+ *   - NAMED IDENTITIES. The setting holds a LIST of `{ surface, principal }` entries, and this door
+ *     reads the `slack` ones alone — each a `teamId:botId` pair a bot is admitted by matching WHOLE.
+ *     The list is long because our e2e pack drives two Slack accounts (OPE-1739) and several other
+ *     surfaces besides (OPE-1754); it is a longer roll of named identities, not a wider grant, and
+ *     the grammar has no syntax for "any bot" in a workspace.
+ *   - EXACT MATCH, WORKSPACE-PINNED AND SURFACE-PINNED. `teamId` and `botId` must BOTH match on the
+ *     SAME listed pair, on an entry whose `surface` is `slack`; a driver named for one workspace —
+ *     or for another surface — has no standing here. No prefixes, no wildcards.
+ *   - `bot_id` IS THE FIELD SLACK SENDS. A `message.im`/`message.mpim` event carries `bot_id` (and
+ *     the human `user`); it does not carry `app_id` on the message itself, so the pair is written in
+ *     the terms the payload actually uses.
+ *   - LOUD. The caller writes a `surface.wake_admitted` row ({@link auditDmDriverAdmitted}), so a
+ *     soak review can tell an admitted driver DM from a human DM.
+ *
+ * Loop safety is unaffected: OE's own reply echo carries OE's own bot record, and the front route
+ * refuses a match against its own identity before it admits anything.
+ */
+export declare function dmDoorAdmitsDriver(ev: ParsedMessageEvent, configured?: readonly E2eDriverIdentity[]): boolean;
+/** The audit reason the DM door records when {@link dmDoorAdmitsDriver} admits a bot author. One
+ *  string, so a control-API query can find every such admission. */
+export declare const DM_DRIVER_ADMIT_REASON = "e2e driver \u2014 the DM door admits a named driver identity";
+/**
+ * Make the DM door's driver ADMISSION observable (OPE-1023) — the counterpart of
+ * {@link auditDmBotAuthorDrop}, which makes its refusals observable.
+ *
+ * A door that quietly widened for one identity would be worse than the silent drop OPE-1022 fixed:
+ * a soak reviewer reading a woken DM seat could not tell whether a human or the driver spoke. This
+ * row says which, and names the carve-out that let it through.
+ *
+ * Best-effort by contract: never throws, never changes the decision. The caller hands the returned
+ * promise to `waitUntil`, because the route wakes and returns before the write would land.
+ */
+export declare function auditDmDriverAdmitted(ev: ParsedMessageEvent, dmKind: "im" | "mpim"): Promise<void>;
+export declare function liveDeps(send: WakeSend): MessageRouteDeps;
+export declare const _engagementWakeMode: (ev: ParsedMessageEvent) => import("@open-everywhere/core/agent/adapter-api.js").SessionMode;
+/** One wake needle: an id (for logs/attribution) + the pattern that fires it. */
+export interface WakeTrigger {
+    readonly id: string;
+    readonly pattern: RegExp;
+}
+/**
+ * The wake triggers for a channel: the unified wake token set (always first — see
+ * {@link wakeNameDropTokens}), plus any caller-supplied extras (a future per-domain hook — none
+ * today). `displayName` is the surface's live vendor display name, or `undefined` when the lookup
+ * failed. Kept a pure builder so the list is assembled the same way everywhere the route needs it.
+ */
+export declare function buildWakeTriggers(displayName: string | undefined, extra?: readonly WakeTrigger[]): WakeTrigger[];
+/** First trigger whose pattern matches `text`, or undefined when none do. */
+export declare function matchWakeTriggers(text: string, triggers: readonly WakeTrigger[]): WakeTrigger | undefined;
+/** Inputs to the pure name-drop policy — staged by {@link routeNameDropEvent}. */
+export interface NameDropInput {
+    readonly inThread: boolean;
+    readonly authorIsBot: boolean;
+    readonly isAppMention: boolean;
+    readonly subtype?: string;
+    readonly channelType?: string;
+    readonly textMatchesName: boolean;
+    readonly domainEnabled: boolean;
+    readonly channelConfirmedInternal: boolean;
+}
+/**
+ * The name-drop policy. Every disqualifier before the single `deliver: true`, same
+ * fail-safe shape as {@link shouldDeliverReply}. Channels and private groups only —
+ * DMs always respond via the mention path, and group DMs are conversations the agent
+ * was explicitly added to person-by-person, where name-drop barging feels worst.
+ */
+export declare function shouldNameDropWake(input: NameDropInput): ReplyDecision;
+/**
+ * Did the built-in name-drop ABSTAIN on this message, as opposed to dropping it for policy?
+ *
+ * 🔴 THE WHOLE WAKE-ARM RUNG RESTS ON THIS DISTINCTION (OPE-1367, docs/extending/drop-in-arms.md).
+ * {@link shouldNameDropWake} answers `deliver: false` for seven different reasons and only ONE of
+ * them is "I have no opinion": the text does not name the agent. The other six are policy — a DM
+ * or group DM (the mention path already always-wakes a DM), a bot author, an `app_mention`, a
+ * message subtype, a domain that never enabled the name-drop wake, and a channel the internal probe
+ * could not confirm. A consumer's arm may fill the abstention. It may not overturn a policy drop.
+ *
+ * 🔴 DERIVED FROM THE BUILT-IN, NEVER RE-LISTED. This asks the built-in itself: with the name
+ * matched and everything else exactly as it is, would it wake? A hand-kept copy of the
+ * disqualifiers would go stale the first time somebody adds one to the policy above, and the arm
+ * would then reach a message the policy had just started dropping.
+ */
+export declare function nameDropAbstained(input: NameDropInput): boolean;
+/**
+ * The message a name-drop turn receives. A HIGHER bar than the engaged-thread judge:
+ * the agent was never invited into this conversation, so "when in doubt, stay out". The
+ * trigger renders through the same shared wake envelope as {@link renderWakeMessage} (see
+ * the T0.2/T0.3 note above it) — a top-level name-drop is `channel-activity`, an in-thread one
+ * is `thread-activity` (name-drop blanket-drops `message_changed`, see {@link
+ * shouldNameDropWake}, so it never sees an edit). `opts` carries the resolved trigger-author
+ * name/handle + `<participants>` block (fail-safe: absent ⇒ raw id in `author`, no block).
+ */
+export declare function renderNameDropMessage(ev: ParsedMessageEvent, name: string, now: (() => string) | undefined, opts: {
+    /** Resolved per-wake trust tier — 🔴 REQUIRED (OPE-596). This wrapper used to omit the field
+     *  from its own opts type entirely, so every render it produced took {@link slackNameDropWake}'s
+     *  fail-OPEN `"peer"` default whatever the author's real tier was. */
+    readonly trust: WakeTrust;
+    readonly triggerAuthorName?: string;
+    readonly triggerAuthorHandle?: string;
+    readonly participants?: readonly WakeParticipant[];
+}): string;
+/** The uninvited `name-drop` judged wake ({@link routeNameDropEvent}'s path). No memberCount /
+ *  envelope-sibling backscroll; a top-level trigger has no thread yet (replying CREATES
+ *  one). `contextLines` (W3) carries the surrounding-conversation hydration as RAW lines — renderWake
+ *  wraps them via the shared renderContext, so no pre-rendered string flows through the plumbing. */
+export declare function slackNameDropWake(ev: ParsedMessageEvent, name: string, opts: {
+    readonly triggerAuthorName?: string;
+    readonly triggerAuthorHandle?: string;
+    readonly participants?: readonly WakeParticipant[];
+    readonly contextLines?: readonly ContextLine[];
+    readonly contextSource?: string;
+    readonly readMoreHint?: string;
+    /** Resolved per-wake trust tier — 🔴 REQUIRED, and `opts` with it (see
+     *  {@link SlackWakeOpts.trust} for the whole reason). */
+    readonly trust: WakeTrust;
+}): NormalizedWake;
+/**
+ * Fetch the name-drop wake's surrounding conversation, RE-GRADE it and ADMIT it, on demand
+ * (OPE-1725, policed by OPE-1742).
+ *
+ * 🔴 IT IS A POLICED READ ON THE SEAT ROAD, AND ONLY THERE. Where `deps.seatRoute` is present the
+ * lines it returns have passed the domain's own admission policy (`seatAdmissionFor(channelKey)`,
+ * applied through channels/seat-admission.ts `admitContextLines`), the same policy the bootstrap
+ * backscroll and the since-last-wake catch-up apply — so a SEATED wake's three reads of the room
+ * admit one author identically. An UNSEATED deployment takes this same thunk and applies NO
+ * admission at all: its lines are byte-identical to the pre-OPE-1742 read, so a `members-only`
+ * domain with no seat still hydrates a refused author's line. That is deliberate, and the reason
+ * is at the call site ("THE SEAT ROAD ONLY") — `admission` is the STANDING SEAT's entry policy by
+ * declaration, and an unseated deployment has no seat for it to govern. `null` includes "the policy
+ * admitted nothing", which renders no context block rather than an empty one.
+ *
+ * 🔴 ONE HYDRATION, BOTH ROADS. `routeNameDropEvent` is the only SLACK route that fills the
+ * `contextLines` side-channel slot — Discord's gateway fills it too and calls no transform, so an
+ * excluded author's hydrated lines survive there (access/external-policy.ts `withholdWakeBodies`
+ * keeps that gap stated) — and `withholdNameDropContext` is the only thing that withholds a
+ * refuted author's bytes out of Slack's copy (OPE-525). When the judged wake hands off to the seat,
+ * the seat wake must carry THE SAME block — otherwise the room's hydration silently stops reaching
+ * the model on every seated deployment, and the withhold control has nothing left to act on.
+ *
+ * 🔴 IT IS A THUNK, NOT A VALUE, AND THAT IS WHAT KEEPS THE COST ORDER RIGHT. Each road pays for the
+ * history call only after ITS OWN tenant fence, spend gate and external-participant policy have
+ * admitted the wake — the seat road runs its copies inside {@link routeSupervisorEvent}, which is
+ * after the hand-off. Hydrating eagerly here would buy a Slack page for a wake the seat then refuses.
+ *
+ * `null` = nothing to add, or ANY failure: the fetch and the regrade are both fail-soft, so a wake
+ * still fires with just the message, exactly as it did before the hydration existed.
+ */
+export type NameDropContextHydrator = () => Promise<WakeBackscrollLines | null>;
+/** Dependencies for {@link routeNameDropEvent} — injected so the chain is unit-testable. */
+export interface NameDropRouteDeps {
+    /** Is name-drop wake enabled for this channel's domain? (sync — config lookup). */
+    readonly enabledFor: (surfaceKey: string) => boolean;
+    /** Positively confirm the channel is internal (not externally shared). Fail-closed. */
+    readonly confirmInternal: (channelId: string) => Promise<boolean>;
+    /**
+     * Recent conversation backscroll for the wake (surrounding thread/channel history), as RAW
+     * {@link ContextLine}s + source + hint (W3) — renderWake wraps them via the shared renderContext,
+     * so wrapping happens in exactly one place instead of pre-rendered strings threading through the
+     * plumbing. Fetched only AFTER the gate decides deliver:true, so a declined message never pays the
+     * API call. Fail-soft: `null` (or an absent dep) = wake with just the message, exactly as before.
+     * Optional so existing test doubles keep compiling.
+     * `threadAdmissionSlice` asks the THREAD leg for its wider admission slice (OPE-1744): the
+     * hydrator sets it on the seat road, where it admits first and caps itself afterwards.
+     */
+    readonly backscroll?: (input: {
+        channelId: string;
+        ts: string;
+        threadTs?: string;
+        threadAdmissionSlice?: boolean;
+    }) => Promise<WakeBackscrollLines | null>;
+    /** The per-author membership probe the hydrated-context withhold uses (OPE-525,
+     *  {@link withholdNameDropContext}). Defaults to the live {@link slackAuthorIsMember}; injectable
+     *  so the withhold is testable without Slack. Never called on the shipped `taint` grain. */
+    readonly authorIsMember?: SlackMemberProbe;
+    /** Start the judged turn in a thread rooted at the triggering message. `context` (when present)
+     *  is the backscroll — ADDITIONAL history the channel appends before the delivery turn. */
+    readonly wake: (input: {
+        channelId: string;
+        threadTs: string;
+        auth: unknown;
+        message: string;
+        context?: readonly string[];
+        state?: unknown;
+    }) => Promise<void>;
+    /**
+     * The bot's SLACK display name (cached lookup) — the agent's PUBLIC FACE: people type the
+     * name they see in the sidebar. It is ALSO the name the agent identifies as, unless the
+     * deployment sets the `identity.name` setting — that canonical name wins for
+     * self-identification on every surface, AND (OPE-571) joins this trigger's own token set
+     * alongside the display name (see {@link wakeNameDropTokens}), extendable/narrowable by
+     * `wake.nameDrop.include`/`wake.nameDrop.exclude`.
+     * Fail-soft: undefined (lookup failed) = no candidate at all = no name-drop wake, regardless
+     * of `identity.name` or the wake settings.
+     */
+    readonly displayName: () => Promise<string | undefined>;
+    /**
+     * WARM-ON-WAKE latch: engage the thread as a WATCHER (participating:false) right before
+     * the wake, so a later message rolls into THIS session even if this turn judges NO_REPLY.
+     * Best-effort + idempotent — never fails the wake. Optional so older test doubles keep
+     * compiling; live wiring passes markThreadEngaged.
+     */
+    readonly markEngaged?: (p: Partition, threadTs: string, atIso: string, opts?: {
+        participating?: boolean;
+    }) => Promise<void>;
+    /** Clock seam for the warm-latch timestamp (tests pass a fixed value). */
+    readonly now?: () => string;
+    /** Resolve the trigger author's display name for the envelope (fail-soft — absent/throwing ⇒
+     *  raw id renders, the wake still fires). Live wiring: {@link fetchUserProfileNames}. */
+    readonly resolveProfile?: ResolveProfile;
+    /**
+     * 🔴 THE SEAT ROAD (OPE-1725). Present ⇔ this channel HAS a standing seat, and then every gate in
+     * this route is still the judge — the name match, the domain's `nameDropWake` opt-in, the
+     * fail-closed internal confirmation, the wake arm — while the WAKE ITSELF goes to that seat
+     * ({@link routeSupervisorEvent} with `nameDrop: true`) instead of opening eve's native per-thread
+     * session below.
+     * WHY THE SPLIT IS HERE AND NOT IN SLACK-FRONT: the candidacy decision is asynchronous (it needs
+     * the live display name) and it is this route's own, so deciding the road before it would mean a
+     * second copy of the judge. The seat route runs its own tenant fence, spend gate, external-policy
+     * check and trust resolution, so this route hands off BEFORE its own copies of those and never
+     * runs them twice.
+     * It is handed the HYDRATOR and nothing else. The seat wake renders no matched name (the standing
+     * identity line states the agent's own name every turn), so passing one would be a parameter
+     * nothing reads — but the surrounding-conversation hydration IS this route's own, and the seat
+     * wake must carry the same block, withheld the same way (see {@link NameDropContextHydrator}).
+     * Absent ⇒ the native per-thread wake below, which is what an unseated deployment keeps, byte for
+     * byte.
+     */
+    readonly seatRoute?: (hydrateContext: NameDropContextHydrator) => Promise<RouteOutcome>;
+}
+/**
+ * Route one TOP-LEVEL message as a name-drop candidate: pure checks, then the name
+ * regex, then config, then the (cached) internal-channel confirmation, then the wake.
+ * The reply thread is rooted at the triggering message's own ts — replying creates
+ * the thread, exactly like a human clicking "reply in thread".
+ */
+export declare function routeNameDropEvent(ev: ParsedMessageEvent, deps: NameDropRouteDeps): Promise<RouteOutcome>;
+export declare function botDisplayName(): Promise<string | undefined>;
+/** Reset the cached display name (tests only). */
+export declare function _resetBotDisplayName(): void;
+/**
+ * Positively confirm a channel is internal (fail-closed, TTL-cached — see
+ * channelInternalAndMeta). Exported because the routine dispatcher
+ * (schedules/dispatch.ts) performs the same live recheck before stamping trust
+ * onto a fired session — one gate, two security consumers.
+ */
+export declare function confirmChannelInternal(channelId: string): Promise<boolean>;
+/**
+ * Positively confirm a channel is internal (fail-closed, same TTL-cached
+ * conversations.info as {@link confirmChannelInternal}) AND surface its member count —
+ * the count `confirmChannelInternal`'s boolean-only return discards. The T1.3 supervisor
+ * path needs both: the verdict gates the wake (fail-closed), the count enriches the wake
+ * envelope's `<channel member-count>`. One cached fetch serves both, so this is a widening
+ * of the existing gate, not a second API call.
+ */
+export declare function confirmChannelInternalWithMeta(channelId: string): Promise<{
+    internal: boolean;
+    memberCount?: number;
+}>;
+/**
+ * Is this Slack author a member this deployment admits? `true` = a vouched member, `false` = a guest
+ * (multi-channel or single-channel), a Connect stranger, a deleted account, or someone from a
+ * workspace the operator has not declared. `undefined` = no verdict: an empty `userId` (nobody to
+ * ask about), no bot token, a transport failure, or a Slack `ok:false` body. Every caller must read
+ * `undefined` as "not proven to be a non-member" — see this section's fail-OPEN note.
+ *
+ * 🔴 "THE EXPECTED WORKSPACE" IS A RUNG WALK SINCE OPE-1508, not an equality. The event's own
+ * workspace is a member with no declaration needed; any OTHER workspace is a member only where the
+ * operator declared it, or the Slack Enterprise Grid above it — which is what admits a Grid
+ * colleague whose home `team_id` is a sibling workspace. A BOT author walks the same rungs: the
+ * workspace's own app is a member, a foreign app is a guest. `is_bot` no longer refutes on its own.
+ * `partnerFactsFromInfo` (slack-identity.ts) holds the whole rule and its reasoning.
+ *
+ * 🔴 AN ABSENT `teamId` IS A GUEST QUESTION, NOT A "COULD NOT ASK" (OPE-1579). A caller that names
+ * no workspace still gets a verdict, because the walk reads the author's own workspace and Grid off
+ * `users.info`: `true` follows the operator's declaration, `false` follows its absence. A missing
+ * workspace is therefore never a reason to answer `undefined` — that verdict belongs to the four
+ * causes listed above. `partnerFactsFromInfo` decides both this probe and the 1:1 DM gate, so the
+ * two readers cannot drift on what an unnamed workspace means.
+ *
+ * Keyed by `teamId` too, because `partnerFactsFromInfo` compares `team_id` against it: caching one
+ * verdict per user id alone would let a workspace-A answer decide a workspace-B question. The `/`
+ * separator cannot collide: a Slack team id and a Slack user id are both `[A-Z0-9]+`, so two
+ * different (team, user) pairs can never compose the same key. The operator's declarations are
+ * process-wide config, so they add no dimension to the key.
+ */
+export declare function slackAuthorIsMember(userId: string, teamId: string | undefined): Promise<boolean | undefined>;
+/** Reset the cached per-author membership verdicts (tests only). */
+export declare function _resetAuthorMemberCache(): void;
+/**
+ * {@link slackAuthorIsMember}, inverted to a GUEST verdict (OPE-589) — the ONE reading both the
+ * approval clicker floor's leg D and the HITL-answer admission's leg B reuse, so the two planes
+ * cannot drift on what "positively a guest" means for a per-person click. `undefined` stays
+ * `undefined`: "we could not ask" must never become a fabricated guest OR member verdict.
+ */
+export declare function slackClickerIsGuest(userId: string, teamId: string | undefined): Promise<boolean | undefined>;
+/**
+ * The SURFACE-INTERNAL fact a chat wake site should hand {@link resolveWakeTrust} for a CHANNEL
+ * message: the room is internal AND the author is not a positively-identified non-member.
+ *
+ * 🔴 IT NARROWS THE WAKE TIER ONLY, never the wake AUTH. The `internal` verdict also stamps
+ * `trustChecked`/`isExternal` onto the delivery auth, which is what gives the whole channel session
+ * its memory tier. A guest posting one message must not demote a channel's memory for everybody, so
+ * the auth keeps reading the ROOM's verdict and only the per-message trust tier reads this one.
+ *
+ * This is the same composition Discord and Teams already make one layer earlier: their per-author
+ * signals (`member.pending`, Entra `userType: guest`) demote `binding.trust`, which is what
+ * `resolveWakeTrustFromContext` reads as its surface verdict. Slack had no such fold because its
+ * probe was DM-only.
+ */
+/** The probe as its two consumers below take it — injected ONLY so a unit test can drive the
+ *  composition without a live `users.info`. Every live call site lets it default. */
+export type SlackMemberProbe = (userId: string, teamId: string | undefined) => Promise<boolean | undefined>;
+/**
+ * BOTH facts a chat wake site needs about its trigger author, from ONE probe call.
+ *
+ * `surfaceInternal` is the surface fact {@link resolveWakeTrust} takes: the room is internal AND the
+ * author is not a positively-identified non-member.
+ *
+ * 🔴 IT NARROWS THE WAKE TIER ONLY, never the wake AUTH. The `internal` verdict also stamps
+ * `trustChecked`/`isExternal` onto the delivery auth, which is what gives the whole channel session
+ * its memory tier. A guest posting one message must not demote a channel's memory for everybody, so
+ * the auth keeps reading the ROOM's verdict and only the per-message trust tier reads this one.
+ *
+ * `refuted` is the separate question the chat-taint join asks (access/taint-signal.ts `nonMemberChatTrust`): did the
+ * probe POSITIVELY say this person is not a member? The two are not the same predicate and must not
+ * be re-derived from each other — `surfaceInternal: false` is also what an EXTERNAL ROOM produces,
+ * and an external room is not evidence about the author at all.
+ *
+ * Deriving both here, from one verdict, is what stops them disagreeing. The probe is TTL-cached, so
+ * a second call would be cheap but a second READ would be a second chance to be inconsistent.
+ */
+export declare function slackWakeAuthorFacts(channelInternal: boolean, userId: string | undefined, teamId: string | undefined, probe?: SlackMemberProbe): Promise<{
+    readonly surfaceInternal: boolean;
+    readonly refuted: boolean;
+}>;
+/**
+ * The resolved external-participant policy for one room: the ORG DEFAULT, with the DOMAIN OVERRIDE
+ * applied when the domain registry can be read. An unreadable registry degrades to the org default
+ * rather than throwing — the policy plane must never be the thing that breaks a wake.
+ */
+export declare function slackExternalPolicyForRoom(roomKey: string): ExternalPolicy;
+/**
+ * THE EXTERNAL-PARTICIPANT VERDICT for one Slack message — pure, so the four outcomes are tested
+ * without a Slack call, a store or a live workspace. The four values name WHAT THE CALLER OWES; the
+ * reasoning is stated once, on discord-gateway.ts's `DiscordExternalVerdict`.
+ *
+ * 🔴 THE AUTHOR GRAIN IS TESTED FIRST, AND THE ORDER MATTERS — an excluded author is owed a notice
+ * they can act on, where the room announcement tells the whole room something about the room.
+ */
+export type SlackExternalVerdict = "proceed" | "withheld-addressed" | "withheld-ambient" | "silent-room";
+export declare function slackExternalVerdict(input: {
+    readonly policy: ExternalPolicy;
+    readonly author: IngestedChatMessage;
+    /** The message @mentions the bot, or arrived in a DM — an ADDRESSED message is owed an answer. */
+    readonly addressed: boolean;
+    readonly isDm: boolean;
+    /** The SURFACE's vendor verdict — Slack Connect's `is_ext_shared`. Absent means "not reported",
+     *  which includes "the probe could not answer": this leg fails OPEN. */
+    readonly vendorExternal?: boolean;
+    /** The DOMAIN-grain surface key (a thread asks its parent channel), for the room classification. */
+    readonly roomKey: string;
+}): SlackExternalVerdict;
+/**
+ * Tell an EXCLUDED sender, PRIVATELY, that the agent will not act on their message (behaviour 1).
+ * Best-effort. Answers whether the notice REACHED the sender.
+ *
+ * 🔴 THIS NOTICE NEVER GOES TO THE CHANNEL, AND THAT RULING STANDS. Its text names the organisation
+ * ("messages from outside this organisation"), so posting it where the room can read it would
+ * announce that this person is classified as an outsider — a disclosure about a member of the room,
+ * not a notice to the sender. If `conversations.open` fails (no token, the sender cannot be DM'd,
+ * Slack refuses), THIS notice is not said anywhere.
+ *
+ * 🔴 THE `false` RETURN IS LOAD-BEARING (OPE-885). It does not mean "say nothing at all" any more.
+ * An EXPLICITLY ADDRESSED wake that this notice could not reach falls back to the room's fixed
+ * `EXTERNAL_MENTION_ACK`, which is a different string precisely because it discloses nothing — see
+ * `applySlackExternalPolicy`. So the caller needs the truth about delivery, and every failure arm
+ * here answers `false` rather than swallowing into a silent `void`.
+ *
+ * A message that ARRIVED in a DM needs no open — it posts straight back into that conversation.
+ */
+export declare function postSlackExternalSenderNotice(userId: string | undefined, dmChannelId?: string, seams?: {
+    readonly open?: (userId: string) => Promise<string | undefined>;
+    readonly post?: (channelId: string, text: string) => Promise<boolean>;
+}): Promise<boolean>;
+/**
+ * Post the SUPPRESSED-WAKE half of the silent-room announcement pair (OPE-504) — AT MOST ONCE PER
+ * ROOM, EVER. Slack had the JOIN half only ({@link announceSilentJoin}); this is its twin, and the
+ * pair is now the closed set `SILENT_NOTICE_KINDS` names.
+ *
+ * FAIL-CLOSED on the claim, which is the inverse of `postOnce`'s posture and deliberate: a duplicate
+ * here is not a lost message, it is exactly the repetition the pair exists to avoid.
+ */
+export declare function announceSlackSilentRoom(org: string, surfaceKey: string, channelId: string, store?: {
+    claimNotice: (org: string, key: string, at: string) => Promise<boolean>;
+}, post?: (channelId: string, text: string) => Promise<void>): Promise<boolean>;
+/** The one call each Slack wake path makes once its author evidence is in hand: decide, pay what the
+ *  verdict owes, and answer whether the path must stand down. Exported for slack-front.ts, whose DM
+ *  seat and native-mention forward are the two paths that do not live in this file. */
+export declare function applySlackExternalPolicy(ev: ParsedMessageEvent, p: Partition, facts: {
+    readonly trust: WakeTrust;
+    readonly refuted: boolean;
+}, route: string): Promise<SlackExternalVerdict>;
+/**
+ * Withhold an EXCLUDED author's HYDRATED CONTEXT LINES on the name-drop wake (OPE-525) — the
+ * side-channel slot `withholdWakeBodies` cannot fill on its own.
+ *
+ * 🔴 WHY THE TRANSFORM NEEDS HELP HERE. Its automatic leg reaches an author whose ENVELOPE message
+ * it withheld, and reads their id off that message. A name-drop's hydration quotes people who wrote
+ * nothing in the envelope at all, so there is no withheld message to read an id from. This resolves
+ * the answer for each distinct hydrated sender and hands the transform the sync predicate it takes.
+ *
+ * 🔴 A POSITIVE REFUTATION ONLY, AND ONLY FOR A HUMAN SENDER. `probe` returning `undefined` (no
+ * token, an API error) is NOT a refutation — absence of evidence, and this leg fails OPEN like every
+ * other in the plane. A `bot` line carries a bot id, and a machine author is never excluded, so only
+ * `senderType: "user"` lines are asked about.
+ *
+ * COSTS NOTHING ON THE SHIPPED GRAIN: `taint` returns the wake by reference before any probe runs.
+ * On `withhold` it costs one TTL-cached `users.info` per DISTINCT hydrated author, resolved in
+ * parallel, and the render budget caps the hydration at ten lines.
+ */
+export declare function withholdNameDropContext(nw: NormalizedWake, policy: ExternalPolicy, teamId: string | undefined, probe?: SlackMemberProbe): Promise<NormalizedWake>;
+/**
+ * Re-grade a first-wake BACKSCROLL bundle's per-message trust with the same per-author probe
+ * (OPE-466). `backscrollTrustResolver` is SYNCHRONOUS and takes the ROOM's internal verdict, so every
+ * sibling in a confirmed-internal channel resolved `peer` — including a guest's. This runs after the
+ * fetch, where the author ids are in hand, and demotes only what the probe positively refutes.
+ *
+ * ONE ANSWER FOR BOTH CONSUMERS, and that is why it re-grades the array rather than computing a
+ * side-channel boolean: the demoted tier reaches the RENDER (the model sees `trust="unauth"` on that
+ * line, and the envelope's reference-only `<system-note>` appears) and the taint JOIN reads the same
+ * field. A boolean computed beside the array would let the two disagree.
+ *
+ * ONLY EVER DOWN. `relay` (machine authors) and an already-`unauth` sibling are untouched, and
+ * nothing is ever promoted. Distinct authors only — a bundle re-quoting one person costs one probe,
+ * and the probe is TTL-cached on top of that. Fail-OPEN: an unresolvable author keeps its tier.
+ */
+export declare function regradeSlackBackscrollTrust(messages: readonly WakeMessageInput[], teamId: string | undefined, probe?: SlackMemberProbe): Promise<readonly WakeMessageInput[]>;
+/**
+ * Resolve + regrade PER-LINE trust for a name-drop wake's {@link ContextLine} backscroll (OPE-475)
+ * — the ContextLine analogue of {@link regradeSlackBackscrollTrust}, converging the two backscroll
+ * shapes on ONE trust story instead of a second mechanism. The same two steps, in the same order:
+ *
+ *   1. every `senderType==="user"` line starts at the tier {@link resolveWakeTrust} gives a
+ *      positively-confirmed-internal channel (peer, or principal for a domain admin) — the SAME
+ *      synchronous resolution {@link backscrollTrustResolver} runs for the graded WakeMessageInput
+ *      shape, just applied per ContextLine instead of per WakeMessageInput;
+ *   2. the SAME per-author probe ({@link slackAuthorIsMember}) then demotes any REFUTED non-member
+ *      to `trust:"unauth", refuted:true` — set together on the SAME line the render reads
+ *      ({@link renderContext}'s `trust="unauth"` marker + reference-only note), so the render and
+ *      the taint join can never disagree about one line.
+ *
+ * `agent`/`bot`/`unknown` lines are left untouched (no `trust`, no `refuted`) — machine or
+ * unattributable authors are not this leg's question, matching {@link backscrollTrustResolver}'s
+ * own machine-author floor. FAIL-OPEN: an unresolvable probe (network error, no token) leaves a
+ * line at its pre-probe tier — the SAME carriage rule the taint join itself uses, never a demotion
+ * on an assumption.
+ */
+export declare function regradeSlackContextLineTrust(lines: readonly ContextLine[], channelConfirmedInternal: boolean, channelKey: string | undefined, teamId: string | undefined, probe?: SlackMemberProbe): Promise<readonly ContextLine[]>;
+/**
+ * The LIVE single-window mention decision for one Slack @mention — the Slack arm of the shared
+ * seam (unified-window.ts {@link singleWindowMentionPolicy}), mirroring the GitHub reference
+ * (github.ts shouldSuppressNativeMention / ambientDelivery). Consulted by BOTH of slack-front's
+ * mention legs — the `app_mention` native-forward (suppress?) and its `message.channels` sibling
+ * (keep as an addressed wake?) — so the two stay exactly complementary: one call shape, one
+ * TTL-cached channel fact underneath.
+ *
+ * Inputs to the seam:
+ *  • `singleWindow` — does this surface have a STANDING SEAT (the domain grain's window bit)? Since
+ *    OPE-1695 that is every channel the bot is in, and the chattiness flag has no part in it: a
+ *    mention wakes the room's own seat whether or not ambient talk does. Any config error ⇒ false —
+ *    the native split, never a throw on the webhook path.
+ *  • `privacyOk` — Slack's POSITIVE privacy fact, by exact analogy to GitHub's
+ *    `repository.private === true` floor: the channel must be POSITIVELY CONFIRMED INTERNAL
+ *    (the same fail-closed TTL-cached conversations.info gate the supervisor wake + wake-trust
+ *    paths use — externally-shared/unconfirmable ⇒ false) AND be a real channel/group (the exact
+ *    surface {@link shouldSupervisorWake} accepts — an mpim/im mention must keep its native path
+ *    or suppressing it would gap, since the supervisor gate would drop the sibling).
+ *
+ * Fail-closed throughout: unknown privacy, config error, or API failure all yield today's
+ * behaviour (no suppression, no addressed wake). The non-single-window fast path returns without
+ * any Slack API call, so every ordinary workspace mention stays byte-identical AND call-free.
+ */
+export declare function slackSingleWindowMentionPolicy(channelId: string, surfaceKey: string): Promise<SingleWindowMentionPolicy>;
+/**
+ * The two facts the DM-FAMILY front route needs about a conversation it cannot classify from the
+ * envelope: its CHANNEL TYPE (`channel` | `group` | `im` | `mpim`, `undefined` when undetermined) and
+ * whether the trust gate POSITIVELY confirms it internal. OPE-351 stage 4.
+ *
+ * WHY IT EXISTS AT ALL: **a raw `app_mention` envelope carries no `channel_type`**, so the front route
+ * cannot tell an @mention in a GROUP DM from an @mention in a channel — and the two now need opposite
+ * routing (a group DM's mention must land in the mpim's own standing window; a channel's must not).
+ * The internal bit rides along because it comes from the SAME response and the mpim wake needs it for
+ * `resolveWakeTrust`: a group DM has no single "partner" to trust-check the way a 1:1 does, so the
+ * surface's own confirmed-internal verdict is what stands in — the same substitution
+ * {@link routeSupervisorEvent} makes for a channel.
+ *
+ * WHY AN API CALL IS ACCEPTABLE HERE, having been deliberately avoided in
+ * {@link slackSingleWindowMentionPolicy}. That function's common-path cost is genuinely zero because
+ * it short-circuits on a SYNC config read. This one cannot: the fact it needs lives only in Slack. But
+ * it is the SAME TTL-cached `conversations.info` the trust gate, the supervisor wake and the join intro
+ * already share, and — the point that settles it — eve's native mention path resolves the identical
+ * fact per mention through `enrichVisibility` (channels/slack.ts) with NO cache at all. A cached read
+ * at the front is therefore strictly cheaper than the uncached read the forward it replaces triggers.
+ *
+ * FAIL-SOFT, AND THE CALLER MUST READ THAT AS "keep today's routing". A workspace whose app predates
+ * the `mpim:read` scope (added to the manifest at OPE-332) gets `missing_scope` here on every group-DM
+ * lookup: this answers `{ internal: false }` with NO channelType, the mention forwards to the native
+ * path exactly as it did before stage 4, and the caller logs the miss by name — degraded, not broken,
+ * and never a crash on an absent field.
+ *
+ * `appCanRead` is the THIRD fact, and it is fail-CLOSED rather than fail-soft: see
+ * {@link appCanReadConversation}. It answers "can this app read this room at all", which the
+ * internal/external verdict does not — a public channel the app never joined is internal AND
+ * unreadable. The shortcut route (slack-front.ts, OPE-1442) reads it to decide whether the target
+ * message's FILES may be registered and fetched with the bot token.
+ *
+ * `extShared` and `trustChecked` are the RAW platform halves `internal` joins away (OPE-1486). The
+ * group-DM wake stamps them onto its auth so `bindSlack` grades an mpim on the same two facts a
+ * channel is graded on — which is what lets the member plane's G4b demote a Slack Connect group DM
+ * out of a workspace-wide `internal` declaration. Both are undefined when the probe answered
+ * nothing, and an undefined one stamps nothing: absence never demotes.
+ */
+export declare function slackChannelFactsFor(channelId: string): Promise<{
+    internal: boolean;
+    channelType?: string;
+    appCanRead: boolean;
+    extShared?: boolean;
+    trustChecked?: boolean;
+}>;
+/**
+ * SYNC predicate: does this surface route its wakes through a standing seat's WINDOW (a solo
+ * per-surface window, a named group, or a cross-surface one)? True ⇔ the supervisor grain uses a
+ * window — the SAME fact {@link slackSingleWindowMentionPolicy}'s `singleWindow` reads, without the
+ * async privacy floor. A seated surface's mentions divert into its seat and its thread follow-ups
+ * ride the seat (never a native per-thread session), so slack-front uses this to keep an ENGAGED
+ * thread on the supervisor path rather than misrouting it to routeMessageEvent (task #100). Any
+ * config-load error ⇒ false (fail-safe to the native per-channel split).
+ */
+export declare function slackDomainUsesUnifiedWindow(surfaceKey: string): boolean;
+export declare function slackForm(method: string, body: string, token?: string | undefined): Promise<Record<string, unknown> | undefined>;
+/**
+ * Render a `conversations.history` response (newest-first, raw Slack JSON — probe,
+ * never assume) as a compact oldest-first transcript, or undefined when there's
+ * nothing readable. System subtypes (joins/renames/…) are noise and dropped; when
+ * the block cap trims, it trims the OLDEST lines — the recent tail is what an intro
+ * needs. Pure, so the shape is unit-testable without Slack.
+ */
+export declare function transcriptFromHistory(history: unknown): string | undefined;
+export declare function fetchUserProfileNames(userId: string): Promise<{
+    name?: string;
+    handle?: string;
+} | undefined>;
+type RosterEntry = {
+    nativeId: string;
+    name?: string;
+    handle?: string;
+};
+/** Test seam / operator escape: drop the memoized roster so the next search re-reads Slack. */
+export declare function _resetWorkspaceRosterCache(): void;
+/**
+ * Every human account in the workspace, as `{nativeId, name, handle}` — fail-soft to `[]` on a
+ * missing scope, an API error, or a throw. The CALLER does the matching.
+ *
+ * Memoized for {@link SLACK_ROSTER_TTL_MS} (see the section header for why that TTL and not the
+ * process-lifetime memo the profile cache uses). Concurrent callers inside one window share ONE
+ * in-flight walk, so a burst cannot multiply the Tier-2 calls the cache exists to collapse.
+ */
+export declare function fetchWorkspaceRoster(): Promise<readonly RosterEntry[]>;
+export declare function fetchUserDisplayName(userId: string): Promise<string | undefined>;
+export declare function fetchChannelDisplayName(channelId: string): Promise<string | undefined>;
+/**
+ * Live Slack roster for a governance channel's floor tripwire (OPE-110, access/audience-floor.ts).
+ * Two fail-closed Slack reads: conversations.info (is_private + externally-shared bit) and
+ * conversations.members (member ids). The bot's own user id is excluded so the agent doesn't count
+ * as a non-admin member. FAIL CLOSED: any failed/absent lookup ⇒ `resolved: false` ⇒ the floor can
+ * never arm. `hasGuest` uses the channel's externally-shared bit as the available external signal;
+ * per-member guest classification rides the guest-detection work (design §2/§10 fragile-point #1) and
+ * is a future tightening, not a loosening (an internal-only private channel already needs every
+ * member on the roster to arm). Governance channels are small by config lint, so a single members
+ * page suffices; a channel larger than one page fails closed on the (unset) cursor rather than
+ * silently attesting a partial roster.
+ */
+export declare function slackGovernanceRoster(channelId: string): Promise<RoomRoster | undefined>;
+/**
+ * Register {@link slackGovernanceRoster} as the governance floor-tripwire member supplier (OPE-110).
+ * Core owns the seam + the fail-closed default; this is the Slack arm, wired at boot from
+ * register-adapters via the adapter-api barrel (the app never reaches into channels/ directly — the
+ * boundary rule). v1 is Slack-only (design fragile-point #1: membership APIs are the ground truth,
+ * Slack/Discord/Teams first); a non-slack channel key returns undefined ⇒ that governance channel
+ * simply can't arm yet, never a false attest.
+ */
+export declare function registerSlackGovernanceMembers(): void;
+/** Production deps for the name-drop route: domain config + live Slack confirmation. */
+export declare function liveNameDropDeps(send: WakeSend): NameDropRouteDeps;
+/** The reserved pseudo-thread sentinel for a supervisor generation — seeded into
+ *  `state.threadTs` (non-empty) to make eve's re-anchor structurally unreachable (amendment
+ *  A). Deliberately not a real Slack ts, so it can never collide with a thread token. */
+export declare function supervisorSentinel(generation: number): string;
+/** The reserved continuation token for a channel's supervisor session at a given generation:
+ *  `${channelId}:oe-sup:g<generation>` — built via {@link slackContinuationToken} so it shares
+ *  eve's exact `${channelId}:${threadTs}` namespacing with thread tokens (the threadTs part is
+ *  the sentinel, which no real thread can ever be). */
+export declare function supervisorToken(channelId: string, generation: number): string;
+/**
+ * The FIFO serialization key for a channel's supervisor wakes (slack-front.ts
+ * `scheduleUnownedWake`) — deliberately GENERATION-INDEPENDENT, unlike {@link supervisorToken}.
+ * The FIFO's job is to serialize supervisor delivery for one channel, and that must hold ACROSS
+ * a rotation boundary (T1.5): keying on the generation-bearing token would split one channel's
+ * serialized queue in two the instant a rotation minted a new generation, letting a pre- and
+ * post-rotation wake run concurrently. Keying on the channel alone fixes that AND needs no store
+ * read on the hot path (the earlier hardcode assumed generation was always 1 pre-rotation — see
+ * the T1.3 comment this replaces).
+ */
+export declare function supervisorFifoKey(channelId: string): string;
+/** Inputs to the pure supervisor-wake gate — staged by {@link routeSupervisorEvent}. */
+export interface SupervisorWakeInput {
+    readonly authorIsBot: boolean;
+    readonly isAppMention: boolean;
+    readonly subtype?: string;
+    readonly channelType?: string;
+    readonly channelConfirmedInternal: boolean;
+}
+/**
+ * The supervisor-wake gate. UNLIKE {@link shouldNameDropWake} there is NO name-regex needle —
+ * the supervisor judges EVERY unowned message (always-on teammate). Disqualifiers, in cost
+ * order: a non-edit subtype (system messages, and the bot's own posts arrive as subtypeless
+ * `bot_message`s caught by authorIsBot) → a bot author (relay/`trust="relay"` is Phase 2, so
+ * bot-authored still DROPS here) → an @mention (eve's own turn owns it) → non-channel/group
+ * surfaces → the fail-closed internal-channel confirmation. A `message_changed` edit is KEPT
+ * (the supervisor should notice edits — it wakes with `reason="message-edited"`).
+ */
+export declare function shouldSupervisorWake(input: SupervisorWakeInput): ReplyDecision;
+/** Dependencies for {@link routeSupervisorEvent} — injected so the chain is unit-testable. */
+export interface SupervisorRouteDeps {
+    /** Positively confirm the channel is internal (fail-closed) AND surface its member count,
+     *  one cached conversations.info. Unconfirmable/external → { internal: false }. */
+    readonly confirmInternalWithMeta: (channelId: string) => Promise<{
+        internal: boolean;
+        memberCount?: number;
+    }>;
+    /**
+     * Create-or-fetch the live supervisor session for (org, surfaceKey). Called ONLY after the
+     * internal confirmation passes, so an external channel never mints a registry row. Three
+     * outcomes, all reported via `freshGeneration`: (1) no row yet → mint generation 1; (2) an
+     * existing row that {@link shouldRotate} says has aged out (expiry, quiet-gap or a backstop) →
+     * rotate to generation+1; (3) an existing row that's still current → returned as-is.
+     * `freshGeneration` is true for (1) and (2) — a BRAND-NEW OR JUST-ROTATED generation's first
+     * wake carries channel backscroll (Tag §4.1); false for (3), an ongoing generation's later
+     * wake, which carries none.
+     */
+    readonly getOrCreateSession: (org: string, surfaceKey: string, channelId: string, atIso: string) => Promise<{
+        token: string;
+        generation: number;
+        freshGeneration: boolean;
+        tail: readonly WakeMessageInput[];
+        /** ISO-8601 of the most recent wake this generation delivered (the registry row's
+         *  `lastWakeAt`), or null on a freshly minted/rotated generation. The lower bound of the
+         *  since-last-wake catch-up read (OPE-1695 (b)); absent ⇒ the bootstrap window. */
+        lastWakeAt?: string | null;
+    }>;
+    /** Record one wake on the current generation (lastWakeAt/turnCount). Best-effort. */
+    readonly touchSession?: (org: string, surfaceKey: string, atIso: string) => Promise<void>;
+    /**
+     * Fetch the seat's channel backscroll as envelope siblings (fetchWakeEnvelopeBackscroll). ONE
+     * read: a FRESH generation's BOOTSTRAP window. It used to serve the since-last-wake catch-up too,
+     * through the `sinceMs` arm below; OPE-1726 moved that read to {@link catchUp} and the shared core
+     * path, so no caller sets `sinceMs` any more. Optional so older test doubles keep compiling
+     * (absent ⇒ no backscroll, same as an empty result); fail-soft by construction (the live impl
+     * never throws).
+     */
+    readonly fetchBackscroll?: (input: {
+        channelId: string;
+        ts: string;
+        /** The route's confirmInternal verdict for this surface — the SAME fact the trigger trust
+         *  uses (F3). The supervisor fetch only runs when internal, so it's true here; passing it
+         *  keeps the backscroll resolver deriving from the caller's real verdict, not a hardcode. */
+        surfaceInternal: boolean;
+        /** Domain-grain channel key (`platform/workspace/surface`) so a DOMAIN-admin backscroll author
+         *  resolves `principal`, not just org-roster admins (matches the trigger trust, which has it).
+         *  It also selects the domain's ADMISSION policy in the live wiring. */
+        channelKey?: string;
+        /** 🔴 DEAD since OPE-1726 — no caller sets it, and the live impl's bootstrap arm is the only one
+         *  reached. It was the catch-up's lower bound when Slack owned a private copy of that read; the
+         *  read now runs through {@link catchUp} and core `seatCatchUp`. Kept only so an older test
+         *  double that still passes it keeps compiling. Do NOT build a new catch-up on it: a window
+         *  fetched here bypasses the shared bounds, the domain's admission policy and the token cap. */
+        sinceMs?: number;
+    }) => Promise<readonly WakeMessageInput[]>;
+    /**
+     * THE SINCE-LAST-WAKE CATCH-UP, through the ONE shared path every surface now takes
+     * (channels/seat-catch-up.ts `seatCatchUp`). It replaces the `sinceMs` arm of
+     * {@link fetchBackscroll}, which was Slack's private copy of a read five other surfaces did not
+     * have: the bounds, the domain's admission policy and the token cap live in core, and Slack
+     * contributes only its registered fetch.
+     * Optional so older test doubles keep compiling (absent ⇒ no catch-up, which is what an ongoing
+     * generation's wake carried before OPE-1695). Fail-soft by construction.
+     */
+    readonly catchUp?: (req: SeatCatchUpRequest) => Promise<SeatCatchUpResult>;
+    /** The per-author membership probe the NAME-DROP hydration's withhold uses (OPE-525,
+     *  {@link withholdNameDropContext}) — the same dep, spelled the same way, as the native route it
+     *  replaces ({@link NameDropRouteDeps.authorIsMember}). Defaults to the live
+     *  {@link slackAuthorIsMember}; injectable so the withhold is testable without Slack. Never called
+     *  on the shipped `taint` grain, and never on a wake that carries no hydrated lines. */
+    readonly authorIsMember?: SlackMemberProbe;
+    /**
+     * Start/continue the supervisor session under its reserved token. `window` is present ONLY on
+     * the SINGLE-WINDOW unified path (unifiedMeta reported `singleWindow` — channels/
+     * unified-window.ts): the wakeId already rendered into this wake's envelope plus the wake's
+     * reply-target origin, which the live wiring registers in the durable map by DIVERTING the
+     * wake through eve's cross-channel `receive` into the synthetic `unified` channel instead of
+     * this channel's own `send`. Absent ⇒ today's send path, byte-identical.
+     */
+    readonly wake: (input: {
+        token: string;
+        auth: unknown;
+        message: string;
+        /** The untrusted-wrapped side-channel context block(s) — the NAME-DROP hydration this seat wake
+         *  carries (OPE-1725), already withheld. Omitted on every other seat wake, so the payload stays
+         *  message-only and byte-identical to today. */
+        context?: readonly string[];
+        state: unknown;
+        window?: UnifiedWindowWake;
+    }) => Promise<void>;
+    /** Append a durable audit row (e.g. `engagement.stop`). Optional; best-effort. */
+    readonly audit?: (action: string, detail: Record<string, unknown>) => Promise<void>;
+    /**
+     * ENGAGE the trigger's thread as a PARTICIPATING surface (task #100 — window-riding stop parity):
+     * called ONLY on an ADDRESSED `directMention` so a mention diverted into the window enrolls its
+     * thread exactly as the native path does (slack.ts onInbound `markThreadEngaged`) and the Discord
+     * divert does (divertDiscordWakeToUnifiedWindow, commit d4d6a17). That row is what the stop leg
+     * ({@link getEngagement}) reads on a later bare "stop". Optional + best-effort; absent ⇒ no enroll.
+     */
+    readonly markEngaged?: (p: Partition, threadTs: string, atIso: string, opts?: {
+        participating?: boolean;
+    }) => Promise<void>;
+    /** Read the trigger thread's engagement record — the ONE read shared by the stop leg AND the
+     *  stopped-suppression gate (task #100 + follow-up). A stop only acks a thread the supervisor is
+     *  participating in; a NON-mention message in a `stopped` thread is dropped before any wake.
+     *  Optional so older test doubles keep compiling (absent ⇒ neither leg fires); live wiring passes
+     *  the real store call. */
+    readonly getEngagement?: (p: Partition, threadTs: string) => Promise<EngagementRow | null>;
+    /** Mark the trigger thread STOPPED (task #100 follow-up stop leg). On the window path a stop
+     *  must NOT delete the row — the durable `stopped` marker is what the suppression gate reads to
+     *  drop later non-mention wakes (a deleted row suppresses nothing here). Sets the flag, keeps the
+     *  row. Optional; best-effort. (Discord keeps DELETing via its own path — see disengageThread.) */
+    readonly markStopped?: (p: Partition, threadTs: string) => Promise<boolean>;
+    /** Clock seam (defaults to the real clock) — the createdAt/lastWakeAt + envelope current-time. */
+    readonly now?: () => string;
+    /** Resolve trigger + backscroll author display names for the envelope (fail-soft — absent or
+     *  throwing ⇒ raw ids render, the wake still fires). Live wiring: {@link fetchUserProfileNames}. */
+    readonly resolveProfile?: ResolveProfile;
+    /** Resolve the surface's engagement calibration tier (memory/domain.ts engagementTierFor) for
+     *  the channel-watch preamble. Optional + fail-soft: absent or throwing ⇒ neutral (the
+     *  pre-tier byte-identical preamble). Live wiring reads the loaded domain config. */
+    readonly engagementTier?: (surfaceKey: string) => WakeEngagementTier;
+    /**
+     * UNIFIED cross-surface supervisor grain for this channel (channels/unified-supervisor.ts). Absent
+     * or `{ unified: false }` ⇒ the per-container path, byte-identical to today. `{ unified: true }` ⇒
+     * the wake is stamped with its `<channel platform>` address + the P5 disclosure preamble. This dep
+     * controls only the WAKE render; the registry-row/token re-key lives inside getOrCreateSession /
+     * touchSession (which receive the surfaceKey and resolve the same grain). Optional +
+     * fail-soft: absent or throwing ⇒ not unified (the byte-identical path). Live wiring reads the
+     * loaded domain config.
+     */
+    readonly unifiedMeta?: (surfaceKey: string) => {
+        unified: boolean;
+        label?: string;
+        singleWindow?: boolean;
+    };
+}
+/**
+ * Route one unowned message to the channel supervisor: pure disqualifiers, then the
+ * fail-closed internal-channel confirmation (which also surfaces the member count for the
+ * envelope), then create-or-fetch the supervisor session and deliver the judged wake. The
+ * caller (slack-front) only reaches here once the domain has opted into ambientSupervisor.
+ *
+ * `opts.directMention` (SINGLE-WINDOW @mention routing — the GitHub reference's
+ * `treatMentionAsDirect`/`directMention` shape): the trigger is the `message.channels` SIBLING of
+ * an `app_mention` that slack-front kept because {@link slackSingleWindowMentionPolicy} said the
+ * unified window owns it (native forward suppressed). The wake then renders as an ADDRESSED
+ * `direct-mention` (envelope + wake-id kept, silence bias dropped) and the minted window carries
+ * `addressing:"direct-mention"` so the unified channel arms the reply bridge. The final say stays
+ * with the SAME shared seam ({@link singleWindowMentionPolicy}) re-checked here against this
+ * route's own singleWindow + internal facts — a directMention flag on a non-single-window or
+ * non-internal wake degrades safely to the plain channel-watch treatment. Unset ⇒ byte-identical.
+ */
+export declare function routeSupervisorEvent(ev: ParsedMessageEvent, deps: SupervisorRouteDeps, opts?: {
+    readonly directMention?: boolean;
+    readonly nameDrop?: boolean;
+    /**
+     * THE NAME-DROP HYDRATION, HANDED ACROSS THE SEAT HAND-OFF (OPE-1725) — see
+     * {@link NameDropContextHydrator}. Read only on the `nameDrop` tier, and only AFTER this route's
+     * own tenant fence, spend gate and external-participant policy have admitted the wake, so a
+     * refused seat wake buys no Slack page. Absent ⇒ no side-channel context block, which is every
+     * other seat wake.
+     */
+    readonly nameDropContext?: NameDropContextHydrator;
+}): Promise<RouteOutcome>;
+/**
+ * Production deps for the supervisor route: the fail-closed internal+meta gate, a
+ * create-or-fetch over the channel_session registry (generation 1 on first mint; rotates to
+ * generation+1 when {@link shouldRotate} says the current generation has aged out — T1.5), a
+ * best-effort touch, the live time-windowed first-wake backscroll fetcher, and a wake that
+ * continues the session under its reserved token.
+ */
+export declare function liveSupervisorDeps(send: WakeSend): SupervisorRouteDeps;
+/** The per-turn reply target snapshotted at `turn.started` from the delivery's auth attributes
+ *  (`channel_id`/`thread_ts`). `threadTs` present ⇔ the triggering message was itself in a
+ *  thread; absent ⇔ it was a top-level channel message. */
+export interface SupervisorReplyTarget {
+    readonly channelId?: string;
+    readonly threadTs?: string;
+}
+/** The pure post plan for a supervisor turn. `post: null` = fail safe (no resolvable target →
+ *  post NOTHING). `bindThread` = the reply lands in a real thread and should mark it engaged
+ *  under the supervisor as owner (Tag "the channel session answers a cheap thread and now owns
+ *  it"); false for a top-level reply (binds nothing). */
+export interface SupervisorReplyPlan {
+    readonly post: {
+        readonly channel: string;
+        readonly threadTs?: string;
+    } | null;
+    readonly bindThread: boolean;
+    readonly reason: string;
+}
+/**
+ * Pure: resolve WHERE a supervisor turn's reply posts, from the per-turn target snapshot.
+ * FAIL SAFE: a missing/empty `channelId` yields `post: null` — the caller posts nothing rather
+ * than guessing a target. A non-empty `threadTs` means the trigger was threaded ⇒ post into that
+ * thread AND bind it; absent ⇒ a top-level channel post with no `thread_ts` and no bind.
+ */
+export declare function planSupervisorReply(target: SupervisorReplyTarget | undefined): SupervisorReplyPlan;
+/** Pure gate: is THIS turn a supervisor turn? The supervisor host-side reply branch (and the
+ *  `turn.started` target snapshot) fire ONLY when this is true, so a non-supervisor turn takes
+ *  eve's default reply path byte-identically. `oeSupervisor` is seeded by T1.3's wake `state`. */
+export declare function isSupervisorReplyTurn(state: unknown): boolean;
+/** Pure: the per-wake assistant-thread OVERRIDE for a DM-seat turn, or undefined when there is
+ *  none. Returns the snapshotted wake thread (`oeWakeThreadTs`) ONLY when it is present AND differs
+ *  from the session's persisted `threadTs` (the frozen seat anchor). Undefined for every non-DM
+ *  turn (`oeWakeThreadTs` unset), a DM whose wake IS the session thread (its first wake), and a
+ *  blank snapshot — every such case falls back to `state.threadTs`, byte-identical to pre-OPE-98. */
+export declare function dmWakeThreadOverride(state: unknown): string | undefined;
+/** Pure: the Slack thread a turn's reply + thinking-status must target, from the turn's channel
+ *  state. The DM-seat per-wake override wins; otherwise the session's persisted `state.threadTs`
+ *  (undefined ⇒ a top-level post with no `thread_ts`). This is the ONE targeting rule both the reply
+ *  post and the assistant-status set/clear read, so on a DM seat they can never diverge onto
+ *  different threads (the OPE-98 failure: reply on one thread, spinner stuck on another). */
+export declare function replyThreadTsForState(state: unknown): string | undefined;
+/** Dependencies injected into {@link deliverSupervisorReply} so the dispatch is testable without
+ *  Slack or a live runtime. `post` = the host-side `slackForm("chat.postMessage")` seam;
+ *  `resolveOwnerToken` = the supervisor's registry token (T1.3) for thread binding; `bind` =
+ *  `markThreadEngaged(…, { participating: true, ownerToken })`. */
+export interface SupervisorReplyDeps {
+    /** Whether the turn's text should actually post (false when a card already narrated it this
+     *  turn — the default path's `postText` gate; the reply still counts as participation). */
+    readonly postText: boolean;
+    /** The reply body (only posted when `postText`). */
+    readonly text: string;
+    /** The per-turn target snapshot from `channel.state.oeReplyTarget`. */
+    readonly target: SupervisorReplyTarget | undefined;
+    /** Host-side post: `slackForm("chat.postMessage", { channel, thread_ts?, text })`. */
+    readonly post: (channelId: string, threadTs: string | undefined, text: string) => Promise<void>;
+    /** The supervisor session's reserved token (the ownerToken for a bound thread), or undefined
+     *  when it can't be resolved — in which case the thread is left unbound (the reply still posts). */
+    readonly resolveOwnerToken: () => Promise<string | undefined>;
+    /** Mark the replied-into thread engaged with the supervisor as owner. */
+    readonly bind: (threadTs: string, ownerToken: string) => Promise<void>;
+}
+export interface SupervisorReplyResult {
+    readonly posted: boolean;
+    readonly bound: boolean;
+    readonly reason: string;
+}
+/**
+ * Dispatch a supervisor turn's reply host-side (NEVER via eve's `channel.thread.post`). Resolves
+ * the target with {@link planSupervisorReply}: no target ⇒ posts nothing (fail safe); a top-level
+ * target ⇒ posts to the channel with NO `thread_ts`; a threaded target ⇒ posts into the thread
+ * AND binds it to the supervisor (ownerToken = the supervisor's registry token). Binding is
+ * independent of `postText` — a card-narrated reply still participated, so it still owns the thread.
+ */
+export declare function deliverSupervisorReply(deps: SupervisorReplyDeps): Promise<SupervisorReplyResult>;
+/** A Slack `member_joined_channel` event narrowed to what the intro path needs. */
+export interface ParsedChannelJoinEvent {
+    readonly channelId: string;
+    /** The join event's ts — the "X joined" notice the intro threads under. */
+    readonly ts: string;
+    readonly teamId?: string;
+    /** The Enterprise Grid organisation the join happened in ({@link slackEnterpriseIdFromEnvelope}) —
+     *  carried so the intro turn's binding walks the SAME rungs a mention in that channel walks. */
+    readonly enterpriseId?: string;
+    /** Who joined. The front route only proceeds when this is the bot's OWN user id. */
+    readonly userId: string;
+    /** Who invited them, when Slack says (the human actor behind the join). */
+    readonly inviterId?: string;
+    /** member_joined_channel's own vocabulary: "C" (public channel) | "G" (private). */
+    readonly channelKind?: string;
+}
+/**
+ * Parse a `member_joined_channel` envelope into {@link ParsedChannelJoinEvent}, or null
+ * when it isn't one (wrong outer/event type, missing ids). Pure — no I/O.
+ */
+export declare function parseChannelJoinEvent(envelope: SlackEventEnvelope): ParsedChannelJoinEvent | null;
+/** The BindableContext a join event implies — same shape {@link bindableFor} builds. */
+export declare function bindableForJoin(ev: ParsedChannelJoinEvent): BindableContext;
+/** The channel metadata the join dispatch classifies from — one conversations.info. */
+export interface ChannelJoinMeta {
+    readonly channelId: string;
+    readonly name?: string;
+    readonly topic?: string;
+    readonly purpose?: string;
+    readonly memberCount?: number;
+    readonly channelType?: string;
+    readonly isPrivate?: boolean;
+    /**
+     * The VENDOR's own external verdict for this channel (OPE-504) — `conversations.info` reported
+     * `is_ext_shared` / `is_org_shared` / `is_shared` / `is_pending_ext_shared`, i.e. a Slack Connect
+     * or otherwise shared channel that can hold people from another organisation.
+     *
+     * 🔴 IT IS TRUE ONLY ON A SUCCESSFUL PROBE THAT SAID YES. `channelFactsFromInfo` fail-softs an
+     * unreadable response to no facts at all, and this field stays absent there rather than becoming
+     * `true` — "we could not ask" is not "we asked and it is external". Absent therefore means "not
+     * reported", which the external-room classification reads as no evidence (fail-open), exactly like
+     * every other carriage leg in that plane.
+     */
+    readonly vendorExternal?: boolean;
+}
+/**
+ * Extract {@link ChannelJoinMeta} from a `conversations.info` response. Defensive like
+ * {@link channelFactsFromInfo} (raw Slack JSON — probe, never assume); a failed lookup
+ * yields metadata-less meta, and the dispatch degrades to "(unknown)" fields.
+ */
+export declare function channelJoinMetaFromInfo(channelId: string, info: unknown): ChannelJoinMeta;
+/** The read-up context the route gathers before the intro wake (all fail-soft). */
+export interface ChannelJoinContext {
+    /** Compact oldest-first backscroll of the channel ({@link fetchChannelTranscript}). */
+    readonly transcript?: string;
+    /** Display name of whoever invited the bot. */
+    readonly inviterName?: string;
+}
+/** The route-posted ack that covers the read+judge latency (Tag's "reading up" reply). */
+export declare const JOIN_ACK_TEXT = "\uD83D\uDC4B Just joined \u2014 reading up on this channel; back in a moment.";
+export declare function renderChannelJoinMessage(meta: ChannelJoinMeta, context?: ChannelJoinContext): string;
+/** Dependencies for {@link routeChannelJoinEvent} — injected so the chain is unit-testable. */
+export interface ChannelJoinRouteDeps {
+    /** Has this surface already been introduced? (shared marker — onboarding/onboarding.ts). */
+    readonly isOnboarded: (p: ReturnType<typeof resolvePartition>) => Promise<boolean>;
+    /** Confirm internal + hand back the metadata from the SAME conversations.info. Fail-closed. */
+    readonly confirmInternal: (channelId: string) => Promise<{
+        internal: boolean;
+        meta?: ChannelJoinMeta;
+    }>;
+    /** Start the judged intro turn, threaded under the join notice. */
+    readonly wake: (input: {
+        channelId: string;
+        threadTs: string;
+        auth: unknown;
+        message: string;
+        state?: unknown;
+    }) => Promise<void>;
+    /** Claim the surface as onboarded BEFORE the wake (the double-intro race gate). */
+    readonly markOnboarded: (p: ReturnType<typeof resolvePartition>) => Promise<void>;
+    /** The channel's recent backscroll as a compact transcript (fail-soft undefined). */
+    readonly transcript: (channelId: string) => Promise<string | undefined>;
+    /** A user's display name, for "invited by" (fail-soft undefined). */
+    readonly userName: (userId: string) => Promise<string | undefined>;
+    /** Post the immediate "reading up" ack under the join notice (fail-soft). */
+    readonly ack: (channelId: string, threadTs: string, text: string) => Promise<void>;
+}
+/**
+ * Post the JOIN half of the silent-room announcement pair (OPE-504) — AT MOST ONCE PER ROOM, EVER.
+ *
+ * The claim (`claimNotice`) is a permanent row, not a TTL and not a process-local flag: a re-invite,
+ * a redeploy or a cold start must not make the agent say it again. Fail-CLOSED on the claim — if the
+ * store cannot prove the notice is unsaid, the agent stays quiet, because a repeat here is exactly
+ * the periodic announcement the design rejects.
+ *
+ * Exported for the test, which is the only way to drive it without a live Slack.
+ */
+export declare function announceSilentJoin(ev: ParsedChannelJoinEvent, p: ReturnType<typeof resolvePartition>, meta: ChannelJoinMeta | undefined, deps: Pick<ChannelJoinRouteDeps, "ack">, store?: {
+    claimNotice: (org: string, key: string, at: string) => Promise<boolean>;
+}): Promise<void>;
+/**
+ * Route one bot-join event: once-only check, then the fail-closed internal confirmation,
+ * then a judged intro wake threaded under the join notice. The caller (slack-front.ts)
+ * has already verified the joiner IS the bot and de-duped the event.
+ */
+export declare function routeChannelJoinEvent(ev: ParsedChannelJoinEvent, deps: ChannelJoinRouteDeps): Promise<RouteOutcome>;
+/** A Slack reaction_added / reaction_removed event, narrowed to the fields ingestion needs. */
+export interface ParsedSlackReaction {
+    readonly verb: ReactionVerb;
+    /** WHO reacted. */
+    readonly reactorId: string;
+    /** The bare Slack emoji name (may carry a `::skin-tone-N` suffix — the classifier strips it). */
+    readonly emoji: string;
+    /** The reacted message's channel + ts (`item.channel` / `item.ts`). */
+    readonly channelId: string;
+    readonly messageTs: string;
+    /** The AUTHOR of the reacted message (`item_user`), when Slack supplies it — used to
+     *  decide onBotReply against the bot's own user id. */
+    readonly itemUser?: string;
+    readonly teamId?: string;
+}
+/**
+ * Parse a Slack reaction envelope into {@link ParsedSlackReaction}, or null when it isn't a
+ * usable reaction on a message (wrong outer/event type, a non-`message` item, missing ids).
+ * Pure — no I/O — so it's trivially testable against fixtures. Note Slack only carries
+ * `item.channel`/`item.ts` for `item.type === "message"` (file/comment reactions have a
+ * different item shape and no channel/ts — dropped here as not-a-message-reaction).
+ */
+export declare function parseSlackReactionEvent(envelope: SlackEventEnvelope): ParsedSlackReaction | null;
+/** The BindableContext a reaction implies — same shape {@link bindableFor} builds, but from
+ *  the reaction's own coordinates (a reaction event carries no channel_type). */
+export declare function bindableForReaction(ev: ParsedSlackReaction): BindableContext;
+/** Dependencies for {@link routeReactionEvent} — injected so parse+route+record is unit-tested
+ *  without a live store or Slack. `botIdentity` is the ALREADY-RESOLVED identity (the front
+ *  route resolves it once, as it does for the wake/join paths — passing a value, not a lookup,
+ *  keeps this module free of a slack-front.ts import cycle). */
+export interface SlackReactionRouteDeps {
+    readonly botIdentity: {
+        readonly userId?: string;
+        readonly botId?: string;
+    };
+    readonly sink: ReactionSinkDeps;
+    /** eve's I/O-free cancel door, present only when the front route handed one in (the ✋ stop arm,
+     *  OPE-418). Absent ⇒ a ✋ is ingested as an ordinary reaction and nothing is cancelled. */
+    readonly attachSession?: AttachSessionForCancel;
+}
+/**
+ * Route one parsed Slack reaction: drop the bot's OWN reaction (its 👀/status reactions are
+ * not feedback), resolve whether the target is the bot's own message (item_user === bot),
+ * then hand the surface-neutral {@link ingestReaction} the parsed reaction. Returns the
+ * ingest outcome (recorded / telemetry-only / ignored). All side effects go through the
+ * injected sink.
+ */
+export declare function routeReactionEvent(ev: ParsedSlackReaction, deps: SlackReactionRouteDeps): Promise<ReactionIngestOutcome>;
+/** Production deps for the reaction route: the resolved bot identity + the live audit/telemetry
+ *  sink. `botIdentity` is passed in by the front route (which owns the cached auth.test lookup). */
+export declare function liveReactionDeps(botIdentity: {
+    readonly userId?: string;
+    readonly botId?: string;
+}, attachSession?: AttachSessionForCancel): SlackReactionRouteDeps;
+/** Production deps for the channel-join route: the shared marker + live Slack confirmation. */
+export declare function liveChannelJoinDeps(send: WakeSend): ChannelJoinRouteDeps;
+//# sourceMappingURL=slack-events.d.ts.map