@open-everywhere/provider-slack 0.1.0

package/dist/agent/channels/slack-shortcut.js

@@ -0,0 +1,262 @@
+// SLACK SHORTCUTS AS A WAKE ORIGIN (OPE-1376).
+//
+// Slack gives a person two ways to hand something to an app without typing at it: a MESSAGE
+// shortcut (the `…` overflow menu on one message) and a GLOBAL shortcut (the ⚡ composer /
+// search-bar entry). Both arrive on the app's INTERACTIVITY Request URL as a urlencoded
+// `payload=…` body — the same URL and the same body family as a button click, never as an
+// Events API `event_callback`.
+//
+// 🔴 A SHORTCUT IS A WAKE ORIGIN, NOT A NEW PLANE. This module does exactly one thing: it turns a
+// shortcut payload into the {@link ParsedMessageEvent} the rest of the Slack front door already
+// speaks. Every downstream property — the partition, the seat, the window, the dedupe, the spend
+// gate, the external-participant policy, the wake trust tier — is then derived by the SAME code a
+// mention or a DM goes through. Nothing here decides posture, and nothing here posts.
+//
+// WHY OE OWNS THE PAYLOAD RATHER THAN FORWARDING IT TO EVE. eve 0.48.0 added an `onShortcut` hook
+// to `slackChannel`, and `slack.ts` does not configure one. So a forwarded shortcut is a
+// guaranteed no-op today. The hook could not carry this work either: `SlackShortcutContext`
+// (eve's own type) hands the handler a workspace API handle and NOTHING else — no session, no
+// resolved seat, no `send`. The machinery that turns an inbound Slack event into a wake on the
+// right window lives in `slack-front.ts`, so the shortcut is classified and handled there, beside
+// the approval click, and never forwarded.
+//
+// 🔴 THE PRINCIPAL IS THE INVOKER, NEVER THE MESSAGE AUTHOR. A message shortcut names two people:
+// whoever clicked it, and whoever wrote the message it was clicked on. The wake binds to the
+// CLICKER. Binding to the author would let one person invoke a shortcut on another person's
+// message and get a turn that runs with the author's access, memory scope and admin standing —
+// the message body is the CONTENT, and content never selects the principal. See
+// {@link shortcutMessageEvent}, which is the only place the two identities meet.
+import { ingestUntrusted, noteIngestionVerdict, taintMarkLands, } from "@open-everywhere/core/agent/adapter-api.js";
+import { parseSlackFiles } from "./slack-events.js";
+import { slackInteractivityTenantIds } from "./slack-tenant-fence.js";
+function str(v) {
+    return typeof v === "string" && v.length > 0 ? v : undefined;
+}
+function obj(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v) ? v : undefined;
+}
+/**
+ * Decode an already-JSON-parsed interactivity payload into a {@link ParsedSlackShortcut}, or
+ * `null` for anything that is not a shortcut. TOTAL AND PURE: it never throws and it writes
+ * nothing.
+ *
+ * 🔴 PURITY IS A SECURITY PROPERTY HERE, NOT A STYLE CHOICE (OPE-1442). This runs inside
+ * `classifyEnvelope`, which decides what a request IS — long before the dedupe, the readability
+ * gate and the ambient-off drop decide whether it wakes anything. An earlier revision registered
+ * the target message's attachments right here, so every click seeded the process-global registry
+ * (a 1000-entry LRU) even when the shortcut went on to wake NOTHING: repeated clicks on a domain
+ * with the unified window off evicted the records real uploads depend on, and `describe_image`
+ * then failed closed on a genuine image. The registry is now seeded by the front door's shortcut
+ * branch, after the gates it must sit behind.
+ *
+ * A payload is REFUSED (null) when it cannot produce a wake:
+ *   • the outer `type` is neither `message_action` nor `shortcut`;
+ *   • `callback_id`, `trigger_id` or `user.id` is missing — the first two are the trigger's name
+ *     and its idempotency key, and the third is the principal, so a wake without any of them
+ *     would have to be invented rather than derived;
+ *   • a `message_action` that carries no `channel.id` or no `message.ts` — a message shortcut
+ *     whose target cannot be addressed is not a message shortcut.
+ * Refusing is FAIL-CLOSED: the front route acks Slack and wakes nothing.
+ *
+ * `message.text` is allowed to be EMPTY and still parses. Slack sends an empty `text` for a message
+ * whose content lives entirely in blocks or files, and dropping a click a person made is the worse
+ * answer. The wake then renders an empty body — it says nothing ABOUT the emptiness. Files on that
+ * message ride through as attachments only where the front door admits them
+ * ({@link shortcutMessageEvent}'s `admitAttachments`), so a shortcut on a screenshot in a room the
+ * app cannot read wakes with an empty body and no file.
+ */
+export function parseSlackShortcutPayload(raw) {
+    const p = obj(raw);
+    if (!p)
+        return null;
+    const type = str(p.type);
+    if (type !== "message_action" && type !== "shortcut")
+        return null;
+    const callbackId = str(p.callback_id);
+    const triggerId = str(p.trigger_id);
+    const userId = str(obj(p.user)?.id);
+    if (!callbackId || !triggerId || !userId)
+        return null;
+    // THE WORKSPACE AND THE GRID RUNG (OPE-1559), read by the ONE reader every interactivity ingress
+    // spends — `slackInteractivityTenantIds` (slack-tenant-fence.ts), which also states which three
+    // spellings of the Grid id it unions and why `context_enterprise_id` is excluded. A shortcut is
+    // one interactivity payload among six click families (OPE-1680), and a second copy of the reading
+    // rule here is the drift that leaf module exists to prevent.
+    const { teamId, enterpriseId } = slackInteractivityTenantIds(p);
+    if (type === "shortcut") {
+        return { kind: "global", callbackId, triggerId, userId, ...(teamId ? { teamId } : {}), ...(enterpriseId ? { enterpriseId } : {}) };
+    }
+    const channelId = str(obj(p.channel)?.id);
+    const message = obj(p.message);
+    const ts = str(message?.ts);
+    if (!channelId || !message || !ts)
+        return null;
+    const threadTs = str(message.thread_ts);
+    const authorId = str(message.user);
+    // File REFERENCES only. Parsing is all this function does with them: registering an id is what
+    // makes it fetchable with the bot token, and that decision belongs to the front door, which knows
+    // whether this shortcut wakes anything and whether the app may read the room at all. See
+    // {@link shortcutMessageEvent}'s `admitAttachments`.
+    const attachments = parseSlackFiles(message.files);
+    return {
+        kind: "message",
+        callbackId,
+        triggerId,
+        userId,
+        ...(teamId ? { teamId } : {}),
+        ...(enterpriseId ? { enterpriseId } : {}),
+        channelId,
+        message: {
+            text: typeof message.text === "string" ? message.text : "",
+            ts,
+            ...(threadTs ? { threadTs } : {}),
+            ...(authorId ? { userId: authorId } : {}),
+            ...(attachments.length > 0 ? { attachments } : {}),
+        },
+    };
+}
+/**
+ * The idempotency key for one shortcut invocation.
+ *
+ * Keyed on `trigger_id`, NOT on the target message. What that buys is certain: a person stays free
+ * to invoke the same shortcut on the same message twice on purpose, which keying on `channel:ts`
+ * (the shape an Events API wake falls back to) would have swallowed for ten minutes.
+ *
+ * What it de-dupes rests on an UNMEASURED assumption — that a Slack redelivery of one click carries
+ * the same trigger id (see {@link ParsedSlackShortcut.triggerId}). Wrong ⇒ a double wake, never a
+ * missed one, which is the direction the whole dedupe layer already fails in.
+ *
+ * It carries no bot-identity prefix, unlike `slack-front.ts`'s `wakeKey`. A trigger id is minted by
+ * Slack per app, so two apps in one workspace cannot collide on one; the `oe-shortcut:` prefix
+ * keeps it out of the Events API key space.
+ */
+export function shortcutWakeKey(sc) {
+    return `oe-shortcut:${sc.triggerId}`;
+}
+/**
+ * Fence the target message's body, and declare the ingestion route this door opens.
+ *
+ * The declaration is the kind-binding entry for the route (access/ingestion-binding-manifest.ts). A
+ * message shortcut carries a Slack message body in through the INTERACTIVITY door, which no Events
+ * API route uses, so the route says what it ingests: `chat-message`.
+ *
+ * 🔴 WHY IT FENCES, AND WHAT THE FENCE STANDS IN FOR. The wake envelope attributes every message to
+ * ONE author and grades it with ONE trust tier, and on this path both are the INVOKER'S:
+ * `triggerMessage` (slack-events.ts) renders `author`/`author-id` from `ev.userId` and `trust` from
+ * the tier the front door resolved for the person who pressed the button. So the target message's
+ * OWN author is never graded here — this route resolves no author facts for them and makes no
+ * `users.info` probe on them, which means the OPE-466 non-member taint join that the channel door
+ * applies does not see them either.
+ *
+ * The consequence, stated plainly: read through the channel door, a guest's or a Connect stranger's
+ * message is graded `unauth` and the envelope fences it. Handed over by a `principal` invoker's
+ * shortcut, the SAME bytes would render under that invoker's tier — and
+ * `authorTrustAdmitsUnfencedBody` (channels/wake-envelope.ts) lets a `peer`/`principal` human body
+ * through UNFENCED. This fence is what closes that gap: the body carries its own wrapper because it
+ * cannot carry its own tier.
+ *
+ * That is deliberately MORE conservative than the ruled Slack-forward precedent (slack-events.ts's
+ * note on quoted attachment content, which inherits the forwarder's tier unfenced). The difference
+ * is who chose: a forward is text a person retyped into their own message, while a shortcut hands
+ * over somebody else's message untouched, so there is no editorial act to inherit a tier from.
+ *
+ * `taintMarkLands()` reports the RUNTIME effect rather than asserting one, for the reason that
+ * function's header states: this runs in the INGRESS process, outside any turn, so the taint half
+ * of `ingestUntrusted` no-ops here and the declaration says so honestly.
+ */
+function fenceAndDeclareShortcutIngestion(text) {
+    noteIngestionVerdict({ kind: "chat-message", label: "slack:shortcut" }, taintMarkLands());
+    return ingestUntrusted(text, { source: "slack message shortcut" });
+}
+/**
+ * The body a GLOBAL shortcut wakes with. It has no message, so the trigger's own name is the whole
+ * content — which is the honest thing to hand the model: somebody pressed a named button.
+ *
+ * The callback id is operator-authored configuration, not somebody's Slack message, so it is NOT
+ * fenced as untrusted content — the same reasoning that leaves a slash-command name unfenced.
+ */
+export function globalShortcutText(sc) {
+    return `Shortcut "${sc.callbackId}" invoked.`;
+}
+/**
+ * A Slack-shaped `ts` for the one wake that has no message behind it: a global shortcut.
+ *
+ * Slack's format is `<seconds>.<microseconds>`, and the wake envelope reads it back with
+ * `Number.parseFloat` to render `sent-at`. Minting from the clock therefore makes `sent-at` say
+ * exactly what is true — when the person pressed the button. The microsecond field carries this
+ * instant's milliseconds; the last three digits are zero, because a millisecond clock cannot
+ * honestly claim more precision than it has.
+ */
+function slackTsFromMs(nowMs) {
+    const seconds = Math.floor(nowMs / 1000);
+    const millis = nowMs % 1000;
+    return `${seconds}.${String(millis).padStart(3, "0")}000`;
+}
+/**
+ * Map a shortcut onto the shared {@link ParsedMessageEvent} shape, so the front door's existing
+ * wake spine (partition → seat → window → dedupe → gates → divert) runs over it unchanged.
+ *
+ * 🔴 `userId` IS THE INVOKER on both kinds. See the file header: the target message's author never
+ * becomes the wake's principal.
+ *
+ * THE TWO TEXT FIELDS CARRY THE MESSAGE-SHORTCUT SPLIT EXACTLY AS THEY ALREADY MEAN IT. A message
+ * shortcut is a FORWARD with no covering note — the invoker typed nothing and pointed at somebody
+ * else's message — and {@link ParsedMessageEvent} already draws that line: `text` is "own text
+ * plus any quoted message", `authoredText` is "the author's OWN typed text". So `text` carries the
+ * target message and `authoredText` is empty. Any rule that asks "what did this person SAY?" then
+ * correctly answers "nothing", which is true, and the model still receives the message as the
+ * wake's content.
+ *
+ * `ts` differs by kind, and deliberately:
+ *   • a MESSAGE shortcut takes the target message's real ts, so the reply anchors under the
+ *     message the shortcut was invoked on (`routeSupervisorEvent` reads `threadTs ?? ts`);
+ *   • a GLOBAL shortcut has no message, so it MINTS one from `nowMs` in Slack's own
+ *     `seconds.microseconds` shape. 🔴 It must be ts-SHAPED, not merely unique: the envelope
+ *     renders `sent-at` by running `Number.parseFloat` over this field (`slackTsToIso`), so a
+ *     non-numeric id silently becomes a nonsense date — the trigger id `13345224609.7384…` parses
+ *     to the year 2392. Minting from the clock makes `sent-at` the truth: the moment the person
+ *     pressed the button. Uniqueness is not this field's job — the wake's idempotency key is
+ *     {@link shortcutWakeKey}, which does key on the trigger id.
+ *
+ * `isAppMention` is false on both. It reports whether the TEXT contains `<@bot>`, and neither body
+ * does; the "was the agent addressed?" question is answered by the caller passing `directMention`,
+ * which is the same seam the single-window mention divert uses.
+ *
+ * 🔴 `admitAttachments` GATES THE TARGET MESSAGE'S FILES, AND IT DEFAULTS TO FALSE (OPE-1442).
+ * Slack delivers a `message_action` for a room the app is not in, and the payload carries that
+ * message's `files[].url_private` — bytes the app's own channel reads refuse. So the files ride
+ * through only when the caller has POSITIVELY established that the app can read the room
+ * (`slackChannelFactsFor`'s `appCanRead`). The default is closed because the cost of the two
+ * mistakes is not symmetric: a withheld file is a wake that says less, an admitted one is the bot
+ * token downloading somebody's private upload from a room the agent cannot open.
+ *
+ * WITHHOLDING DROPS THE REFERENCE TOO, rather than passing an id that resolves to nothing. The
+ * envelope renders an attachment as an id and `describe_image` fails closed on an id the registry
+ * never saw, so an advertised-but-unresolvable file tells the model an image exists and then
+ * cannot show it — worse than not mentioning it.
+ */
+export function shortcutMessageEvent(sc, channelId, channelType, nowMs = Date.now(), opts = {}) {
+    const attachments = opts.admitAttachments === true ? sc.message?.attachments : undefined;
+    const text = sc.kind === "message" && sc.message ? fenceAndDeclareShortcutIngestion(sc.message.text) : globalShortcutText(sc);
+    return {
+        channelId,
+        ts: sc.kind === "message" && sc.message ? sc.message.ts : slackTsFromMs(nowMs),
+        ...(sc.kind === "message" && sc.message?.threadTs ? { threadTs: sc.message.threadTs } : {}),
+        ...(sc.teamId ? { teamId: sc.teamId } : {}),
+        // The Grid rung the payload named (OPE-1559), spread conditionally exactly as the wake routes
+        // spread it: it reaches `buildSlackAuth` through `authForEvent` and `scheduleDmWake`, so a
+        // shortcut in a Grid workspace declared only at the enterprise key now resolves that line, and a
+        // non-Grid shortcut stamps nothing.
+        ...(sc.enterpriseId ? { enterpriseId: sc.enterpriseId } : {}),
+        userId: sc.userId,
+        ...(channelType ? { channelType } : {}),
+        text,
+        ...(attachments && attachments.length > 0 ? { attachments } : {}),
+        // A global shortcut's body IS what the invoker did — they pressed that named button and typed
+        // nothing else, so the trigger line is their own "text". A message shortcut's body is somebody
+        // else's message, so the invoker authored nothing.
+        authoredText: sc.kind === "global" ? text : "",
+        isAppMention: false,
+    };
+}
+//# sourceMappingURL=slack-shortcut.js.map

package/dist/agent/channels/slack-shortcut.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-shortcut.js","sourceRoot":"","sources":["../../../agent/channels/slack-shortcut.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,EAAE;AACF,4FAA4F;AAC5F,0FAA0F;AAC1F,wFAAwF;AACxF,0FAA0F;AAC1F,+BAA+B;AAC/B,EAAE;AACF,kGAAkG;AAClG,gGAAgG;AAChG,iGAAiG;AACjG,kGAAkG;AAClG,sFAAsF;AACtF,EAAE;AACF,kGAAkG;AAClG,yFAAyF;AACzF,4FAA4F;AAC5F,8FAA8F;AAC9F,+FAA+F;AAC/F,kGAAkG;AAClG,2CAA2C;AAC3C,EAAE;AACF,kGAAkG;AAClG,6FAA6F;AAC7F,4FAA4F;AAC5F,+FAA+F;AAC/F,gFAAgF;AAChF,iFAAiF;AAEjF,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,cAAc,GAEf,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,eAAe,EAA2B,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EAAE,2BAA2B,EAAE,MAAM,yBAAyB,CAAC;AA6DtE,SAAS,GAAG,CAAC,CAAU;IACrB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC;AAED,SAAS,GAAG,CAAC,CAAU;IACrB,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAA6B,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/G,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,yBAAyB,CAAC,GAAY;IACpD,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACnB,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzB,IAAI,IAAI,KAAK,gBAAgB,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,IAAI,CAAC;IAClE,MAAM,UAAU,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACtD,iGAAiG;IACjG,gGAAgG;IAChG,gGAAgG;IAChG,kGAAkG;IAClG,6DAA6D;IAC7D,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,2BAA2B,CAAC,CAAC,CAAC,CAAC;IAChE,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACrI,CAAC;IACD,MAAM,SAAS,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC5B,IAAI,CAAC,SAAS,IAAI,CAAC,OAAO,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,+FAA+F;IAC/F,kGAAkG;IAClG,yFAAyF;IACzF,qDAAqD;IACrD,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,UAAU;QACV,SAAS;QACT,MAAM;QACN,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,SAAS;QACT,OAAO,EAAE;YACP,IAAI,EAAE,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;YAC1D,EAAE;YACF,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnD;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe,CAAC,EAAuB;IACrD,OAAO,eAAe,EAAE,CAAC,SAAS,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,SAAS,gCAAgC,CAAC,IAAY;IACpD,oBAAoB,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;IAC1F,OAAO,eAAe,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAuB;IACxD,OAAO,aAAa,EAAE,CAAC,UAAU,YAAY,CAAC;AAChD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACzC,MAAM,MAAM,GAAG,KAAK,GAAG,IAAI,CAAC;IAC5B,OAAO,GAAG,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAM,UAAU,oBAAoB,CAClC,EAAuB,EACvB,SAAiB,EACjB,WAAoB,EACpB,KAAK,GAAW,IAAI,CAAC,GAAG,EAAE,EAC1B,IAAI,GAA4C,EAAE;IAElD,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,gCAAgC,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAC9H,OAAO;QACL,SAAS;QACT,EAAE,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC;QAC9E,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,8FAA8F;QAC9F,2FAA2F;QAC3F,iGAAiG;QACjG,oCAAoC;QACpC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,IAAI;QACJ,GAAG,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,8FAA8F;QAC9F,+FAA+F;QAC/F,mDAAmD;QACnD,YAAY,EAAE,EAAE,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;QAC9C,YAAY,EAAE,KAAK;KACpB,CAAC;AACJ,CAAC"}

package/dist/agent/channels/slack-signature.d.ts

@@ -0,0 +1,19 @@
+/** The header carrying the signature. Exported so no caller re-types the string. */
+export declare const SLACK_SIGNATURE_HEADER = "x-slack-signature";
+/** The header carrying the signed unix-seconds timestamp. */
+export declare const SLACK_TIMESTAMP_HEADER = "x-slack-request-timestamp";
+/** The version tag that both prefixes the signature and opens the basestring. */
+export declare const SLACK_SIGNATURE_VERSION = "v0";
+/**
+ * The signature Slack would send for this `(secret, timestamp, rawBody)` — `v0=<hex>` over
+ * `v0:<timestamp>:<rawBody>`.
+ *
+ * `timestamp` is taken as the STRING off the header, never a number, because it is signed
+ * character-for-character: re-formatting it (leading zeros, a float round-trip) changes the
+ * basestring and breaks a signature that is perfectly good.
+ */
+export declare function slackSignature(secret: string, timestamp: string, rawBody: string): string;
+/** Length-prechecked constant-time compare of a presented signature against the expected one —
+ *  the shape every verifier in this tree uses. */
+export declare function slackSignatureMatches(secret: string, timestamp: string, rawBody: string, presented: string): boolean;
+//# sourceMappingURL=slack-signature.d.ts.map

package/dist/agent/channels/slack-signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-signature.d.ts","sourceRoot":"","sources":["../../../agent/channels/slack-signature.ts"],"names":[],"mappings":"AA2BA,oFAAoF;AACpF,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAC1D,6DAA6D;AAC7D,eAAO,MAAM,sBAAsB,8BAA8B,CAAC;AAClE,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAE5C;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEzF;AAED;kDACkD;AAClD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAIpH"}

package/dist/agent/channels/slack-signature.js

@@ -0,0 +1,50 @@
+// SLACK'S `v0=` SIGNATURE SCHEME, as a leaf primitive — the ONE implementation of Slack's digest in
+// this tree, extracted (OPE-197) so the two callers that need it cannot drift into two schemes:
+//
+//   • channels/slack-front.ts `verifySlackSignature` — the SURFACE front door (events, interactivity,
+//     `/oe` slash commands), which reads its secret from `SLACK_SIGNING_SECRET` and answers a Slack
+//     Request URL.
+//   • channels/slack-webhook-verifier.ts — the WEBHOOK VERIFIER REGISTRY entry, which reads its keys
+//     from a hook's `secretRef` list and answers the generic ingress.
+//
+// Those two resolve their key differently and discriminate failures differently; what they must
+// share to the byte is the BASESTRING and the DIGEST, because a difference there is a signature that
+// verifies on one route and 401s on the other with nothing saying why. So exactly that much lives
+// here and nothing else — no header reading, no skew window, no key resolution.
+//
+// THE SCHEME (https://api.slack.com/authentication/verifying-requests-from-slack):
+//   X-Slack-Request-Timestamp: <unix seconds>
+//   X-Slack-Signature:         v0=<hex>   HMAC-SHA256 of `v0:<timestamp>:<raw body>`, keyed by the
+//                                         app's Signing Secret.
+// The timestamp is INSIDE the signed basestring, which is what makes a skew check meaningful here
+// (contrast GitHub, which signs the body alone) — but enforcing that window is the caller's, since
+// the two callers bound it differently on purpose.
+//
+// Pinned by Slack's OWN PUBLISHED TEST VECTOR in scripts/slack-webhook-verifier-test.ts — the only
+// assertion that proves we implement THEIR scheme rather than a self-consistent idea of it.
+import { createHmac, timingSafeEqual } from "node:crypto";
+/** The header carrying the signature. Exported so no caller re-types the string. */
+export const SLACK_SIGNATURE_HEADER = "x-slack-signature";
+/** The header carrying the signed unix-seconds timestamp. */
+export const SLACK_TIMESTAMP_HEADER = "x-slack-request-timestamp";
+/** The version tag that both prefixes the signature and opens the basestring. */
+export const SLACK_SIGNATURE_VERSION = "v0";
+/**
+ * The signature Slack would send for this `(secret, timestamp, rawBody)` — `v0=<hex>` over
+ * `v0:<timestamp>:<rawBody>`.
+ *
+ * `timestamp` is taken as the STRING off the header, never a number, because it is signed
+ * character-for-character: re-formatting it (leading zeros, a float round-trip) changes the
+ * basestring and breaks a signature that is perfectly good.
+ */
+export function slackSignature(secret, timestamp, rawBody) {
+    return `${SLACK_SIGNATURE_VERSION}=${createHmac("sha256", secret).update(`${SLACK_SIGNATURE_VERSION}:${timestamp}:${rawBody}`).digest("hex")}`;
+}
+/** Length-prechecked constant-time compare of a presented signature against the expected one —
+ *  the shape every verifier in this tree uses. */
+export function slackSignatureMatches(secret, timestamp, rawBody, presented) {
+    const a = Buffer.from(slackSignature(secret, timestamp, rawBody));
+    const b = Buffer.from(presented);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+//# sourceMappingURL=slack-signature.js.map

package/dist/agent/channels/slack-signature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-signature.js","sourceRoot":"","sources":["../../../agent/channels/slack-signature.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,gGAAgG;AAChG,EAAE;AACF,sGAAsG;AACtG,oGAAoG;AACpG,mBAAmB;AACnB,qGAAqG;AACrG,sEAAsE;AACtE,EAAE;AACF,gGAAgG;AAChG,qGAAqG;AACrG,kGAAkG;AAClG,gFAAgF;AAChF,EAAE;AACF,mFAAmF;AACnF,8CAA8C;AAC9C,mGAAmG;AACnG,gEAAgE;AAChE,kGAAkG;AAClG,mGAAmG;AACnG,mDAAmD;AACnD,EAAE;AACF,mGAAmG;AACnG,4FAA4F;AAE5F,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D,oFAAoF;AACpF,MAAM,CAAC,MAAM,sBAAsB,GAAG,mBAAmB,CAAC;AAC1D,6DAA6D;AAC7D,MAAM,CAAC,MAAM,sBAAsB,GAAG,2BAA2B,CAAC;AAClE,iFAAiF;AACjF,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAE5C;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,SAAiB,EAAE,OAAe;IAC/E,OAAO,GAAG,uBAAuB,IAAI,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,uBAAuB,IAAI,SAAS,IAAI,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;AACjJ,CAAC;AAED;kDACkD;AAClD,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,SAAiB,EAAE,OAAe,EAAE,SAAiB;IACzG,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;IAClE,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC"}

package/dist/agent/channels/slack-spend-gate.d.ts

@@ -0,0 +1,22 @@
+import { type IngressSpendGateInput, type SpendGateDecision, type SpendRefusalCopyInput } from "@open-everywhere/core/agent/adapter-api.js";
+export type { SpendGateDoor, SpendGateDecision, SpendGateAuditRow } from "@open-everywhere/core/agent/adapter-api.js";
+/** Slack's shape of the shared gate input: `teamId` is the Slack team id (the shared gate's generic
+ *  `workspaceRef`, emitted as `team` on the audit row), and `mode` stays REQUIRED here because both
+ *  Slack doors resolve dm/mpim/channel themselves before the gate is reached. */
+export interface SlackSpendGateInput extends Omit<IngressSpendGateInput, "workspaceRef" | "badges" | "mode"> {
+    readonly mode: NonNullable<IngressSpendGateInput["mode"]>;
+    /** Slack team id, for the audit row only (`null` when the event carried none). */
+    readonly teamId?: string | null;
+}
+/** The refusal copy with Slack's mrkdwn shortcode badge — same sentences as every other surface
+ *  (they live in core), only the leading emoji differs. The caller passes core's own input, so a
+ *  Slack refusal names the breached layer and its key exactly as every other surface does
+ *  (OPE-1860); nothing about the copy is decided here. */
+export declare function spendRefusalCopy(input: Omit<SpendRefusalCopyInput, "badge">): string;
+/** The admin-bypass warning with Slack's mrkdwn shortcode badge. */
+export declare function spendBypassWarnCopy(reason: string | undefined): string;
+/** Decide whether a Slack wake may spend — the shared decision table, bound to Slack's badges.
+ *  See the core module for the full posture (check fails OPEN, a definite OVER fails CLOSED, an
+ *  admin proceeds as audited sudo). */
+export declare function slackSpendGate(input: SlackSpendGateInput): Promise<SpendGateDecision>;
+//# sourceMappingURL=slack-spend-gate.d.ts.map

package/dist/agent/channels/slack-spend-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-spend-gate.d.ts","sourceRoot":"","sources":["../../../agent/channels/slack-spend-gate.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAkI,KAAK,qBAAqB,EAAE,KAAK,iBAAiB,EAAE,KAAK,qBAAqB,EAAE,MAAM,4CAA4C,CAAC;AAE5Q,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,4CAA4C,CAAC;AAEtH;;iFAEiF;AACjF,MAAM,WAAW,mBAAoB,SAAQ,IAAI,CAAC,qBAAqB,EAAE,cAAc,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC1G,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1D,kFAAkF;IAClF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED;;;0DAG0D;AAC1D,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,qBAAqB,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpF;AAED,oEAAoE;AACpE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAEtE;AAED;;uCAEuC;AACvC,wBAAgB,cAAc,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAKrF"}

package/dist/agent/channels/slack-spend-gate.js

@@ -0,0 +1,48 @@
+// The Slack ingress SPEND GATE — a THIN BINDING over the shared core gate
+// (@open-everywhere/core/agent/spend/ingress-gate.ts), called at BOTH doors a Slack wake can arrive
+// through (OPE-33).
+//
+// WHY THE GATE IS NOT INLINE IN `slack.ts` (live-diagnosed 2026-07-25). It used to be, inside
+// `onInbound` — eve's `onAppMention`/`onDirectMessage` handler. That covers the MENTION door only.
+// Since eve 0.27.5 the compiled `slackChannel` drops any message it considers self-authored BEFORE
+// the mention hooks run:
+//
+//   isSelfAuthoredSlackMessage(e,t){ return e.botUserId!==void 0 && t.author?.userId===e.botUserId
+//     ? !0 : e.appId!==void 0 && t.raw.app_id===e.appId }
+//
+// …applied to the `app_mention`/`direct_message` leg AND to eve's own `onMessage` leg — but NOT to
+// the `onEvent` leg. Slack stamps `app_id` on ANY message an app posts through the Web API
+// (including with a user token), so every driver-app-authored mention now bypasses `onInbound`
+// entirely and re-enters through our engagement front route (slack-front.ts → slack-events.ts),
+// which had no spend gate at all. Net effect: a capped surface silently kept spending.
+//
+// WHY THE IMPLEMENTATION NOW LIVES IN CORE. The fix was always structural, not version-specific: the
+// gate is a WAKE-ADMISSION decision, so it belongs at every point a wake is about to dispatch a
+// model turn — and the same defect then recurred on five other surfaces AND on the cross-surface
+// window's own divert. The decision logic, the refusal copy, the admin-bypass semantics and the
+// audit row therefore exist exactly once, in core, and every door — Slack's two, each other
+// surface's native leg, and `divertToUnifiedWindow` — calls that one function. This module keeps
+// only what is genuinely Slack-shaped: the mrkdwn shortcode badges (`:no_entry:` / `:warning:`,
+// which no other surface renders) and the Slack-named type aliases its call sites use.
+import { ingressSpendGate, SLACK_SPEND_BADGES, spendRefusalCopy as coreSpendRefusalCopy, spendBypassWarnCopy as coreSpendBypassWarnCopy } from "@open-everywhere/core/agent/adapter-api.js";
+/** The refusal copy with Slack's mrkdwn shortcode badge — same sentences as every other surface
+ *  (they live in core), only the leading emoji differs. The caller passes core's own input, so a
+ *  Slack refusal names the breached layer and its key exactly as every other surface does
+ *  (OPE-1860); nothing about the copy is decided here. */
+export function spendRefusalCopy(input) {
+    return coreSpendRefusalCopy({ ...input, badge: SLACK_SPEND_BADGES.refusal });
+}
+/** The admin-bypass warning with Slack's mrkdwn shortcode badge. */
+export function spendBypassWarnCopy(reason) {
+    return coreSpendBypassWarnCopy(reason, SLACK_SPEND_BADGES.warning);
+}
+/** Decide whether a Slack wake may spend — the shared decision table, bound to Slack's badges.
+ *  See the core module for the full posture (check fails OPEN, a definite OVER fails CLOSED, an
+ *  admin proceeds as audited sudo). */
+export function slackSpendGate(input) {
+    const { teamId, ...rest } = input;
+    // `?? null` (never omitted): Slack's row has always carried a `team` key, present-but-null when
+    // the event carried no team id, and a live probe reads it that way.
+    return ingressSpendGate({ ...rest, workspaceRef: teamId ?? null, badges: SLACK_SPEND_BADGES });
+}
+//# sourceMappingURL=slack-spend-gate.js.map

package/dist/agent/channels/slack-spend-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-spend-gate.js","sourceRoot":"","sources":["../../../agent/channels/slack-spend-gate.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,oGAAoG;AACpG,oBAAoB;AACpB,EAAE;AACF,8FAA8F;AAC9F,mGAAmG;AACnG,mGAAmG;AACnG,yBAAyB;AACzB,EAAE;AACF,mGAAmG;AACnG,0DAA0D;AAC1D,EAAE;AACF,mGAAmG;AACnG,2FAA2F;AAC3F,+FAA+F;AAC/F,gGAAgG;AAChG,uFAAuF;AACvF,EAAE;AACF,qGAAqG;AACrG,gGAAgG;AAChG,iGAAiG;AACjG,gGAAgG;AAChG,4FAA4F;AAC5F,iGAAiG;AACjG,gGAAgG;AAChG,uFAAuF;AAEvF,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,gBAAgB,IAAI,oBAAoB,EAAE,mBAAmB,IAAI,uBAAuB,EAAkF,MAAM,4CAA4C,CAAC;AAa5Q;;;0DAG0D;AAC1D,MAAM,UAAU,gBAAgB,CAAC,KAA2C;IAC1E,OAAO,oBAAoB,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,kBAAkB,CAAC,OAAO,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,mBAAmB,CAAC,MAA0B;IAC5D,OAAO,uBAAuB,CAAC,MAAM,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAC;AACrE,CAAC;AAED;;uCAEuC;AACvC,MAAM,UAAU,cAAc,CAAC,KAA0B;IACvD,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IAClC,gGAAgG;IAChG,oEAAoE;IACpE,OAAO,gBAAgB,CAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;AACjG,CAAC"}

package/dist/agent/channels/slack-tenant-fence.d.ts

@@ -0,0 +1,61 @@
+import { type TenantAdmissionDecision } from "@open-everywhere/core/agent/adapter-api.js";
+/**
+ * Is this delivery's Slack tenant admitted on this deployment? `proceed` also covers every
+ * deliberate inert case (nothing declared, operator opted in, no ids on the event at all) — see
+ * access/tenant-admission.ts's classifyTenantAdmission for why each one is a choice rather than a
+ * gap. `unadmitted` means: drop the wake, write the audit row, run no model turn.
+ *
+ * 🔴 PASS THE ENTERPRISE ID WHERE THE DOOR CAN READ ONE (OPE-1645). An ORG-WIDE Enterprise Grid
+ * install delivers an interactivity payload that names the Grid (`E…`) and NO workspace, so a call
+ * that hands over the workspace alone asks the fence to judge a delivery on the one field it is
+ * missing — and the classifier's "a delivery naming no tenant proceeds" path then ADMITS a foreign
+ * Grid. A door with no enterprise id to read omits the argument and gets the workspace-only
+ * decision it had before.
+ */
+export declare function slackTenantAdmission(teamId: string | undefined | null, enterpriseId?: string | undefined | null): TenantAdmissionDecision;
+/** The workspace and Grid one INTERACTIVITY payload names. Either field is absent where the payload
+ *  named none — see {@link slackInteractivityTenantIds} for which install shape omits which. */
+export interface SlackInteractivityTenantIds {
+    readonly teamId?: string;
+    readonly enterpriseId?: string;
+}
+/**
+ * Read the tenant ids off an already-JSON-parsed INTERACTIVITY payload — a `block_actions` click, a
+ * `view_submission`, a shortcut. TOTAL AND PURE: any shape that names neither id yields `{}`, which
+ * {@link slackTenantAdmission} judges as "names no tenant".
+ *
+ * 🔴 THE GRID RUNG, IN ALL THREE SPELLINGS AN INTERACTIVITY PAYLOAD USES (OPE-1559). Which one
+ * arrives depends on how the app was installed, so reading fewer than three loses the rung on some
+ * installs — silently, and in the direction that ADMITS:
+ *   • a top-level `enterprise` OBJECT (an org-wide install; `team` may then be null);
+ *   • a top-level `enterprise_id` STRING;
+ *   • `team: { id, enterprise_id }` — what a PER-WORKSPACE install on a Grid sends.
+ * Order is widest-first; the top-level object wins where more than one is present.
+ *
+ * 🔴 NO SINGLE PLACE IN eve READS ALL THREE, so this union is OURS and cannot be delegated.
+ * Re-measured against eve 0.54.3: `parseShortcutPayload` (public/channels/slack/interactions.js) reads
+ * NO enterprise at all; `extractInstallationFromInteractive`
+ * (compiled/@chat-adapter/slack/index.js) reads `enterprise?.id || enterprise_id`; and the adapter's
+ * event path reads the top-level `enterprise_id` alone. Three readers, three different subsets — and
+ * none of them reads the `team.enterprise_id` arm, which is why the union stays ours.
+ * ⚠️ NOT RE-READ AT 0.54.3: the `enterprise.id || team.enterprise_id` shape this block used to
+ * attribute to the block_actions / view_submission parsers. It is not findable in the 0.54.3 bytes, so
+ * it is not restated as a measurement. The claim above does not rest on it.
+ *
+ * 🔴 `context_enterprise_id` IS DELIBERATELY NOT READ, though eve falls back to it. On a Slack
+ * Connect payload that field can name ANOTHER organisation, so trusting it would let a foreign Grid
+ * declaration vouch our room. `slackEnterpriseIdFromEnvelope` (slack-events.ts) makes the same
+ * exclusion on the event side. Every field below names the delivery's OWN workspace or Grid.
+ *
+ * 🔴 `user.team_id` IS NOT READ EITHER, and that omission is the point. It names the CLICKER's home
+ * workspace, which on a Grid is not the workspace the click happened in — so a fence built on it
+ * would judge the wrong tenant, in both directions. The question this fence asks is "which tenant
+ * DELIVERED this", and `team` / `enterprise` are the only fields that answer it.
+ *
+ * 🔴 IT LIVES HERE RATHER THAN AT A DOOR because the shortcut ingress and the six CLICK branches
+ * (OPE-1680) both need it, and a second copy of the reading rule at a second door is exactly the
+ * drift this module exists to prevent — the same argument that keeps {@link slackTenantAdmission}
+ * out of `slack-events.ts`.
+ */
+export declare function slackInteractivityTenantIds(raw: unknown): SlackInteractivityTenantIds;
+//# sourceMappingURL=slack-tenant-fence.d.ts.map

package/dist/agent/channels/slack-tenant-fence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-tenant-fence.d.ts","sourceRoot":"","sources":["../../../agent/channels/slack-tenant-fence.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAsD,KAAK,uBAAuB,EAAE,MAAM,4CAA4C,CAAC;AAE9I;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,uBAAuB,CAEzI;AAED;gGACgG;AAChG,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,OAAO,GAAG,2BAA2B,CAOrF"}

package/dist/agent/channels/slack-tenant-fence.js

@@ -0,0 +1,88 @@
+// SLACK'S TENANT FENCE WIRING (OPE-309 phase 0c) — one helper, every wake door.
+//
+// The decision itself is core's (access/tenant-admission.ts): pure, unit-tested, platform-neutral.
+// This module is only the Slack-shaped call — "read the admitted set from config, classify this
+// delivery's ids" — named ONCE so the mention door, the four engagement routes, the join door, the
+// `/oe` slash door, the shortcut ingress and the DM window cannot drift apart on what "a tenant we
+// admit" means. Exactly the shape `slackWakeSpendGate` uses for the spend question.
+//
+// WHY SLACK IS THE PLATFORM THAT NEEDS IT. Slack's Events API verifies an APP-LEVEL signing
+// secret, which every workspace that installs the app shares — so `slack-front.ts` cannot tell a
+// second workspace from the first, and there is no team allowlist anywhere else in the tree. The
+// only thing bounding the deployment to one workspace is Slack's own app-distribution setting: a
+// boundary we do not own. Slack is also the one platform in TENANT_SCOPED_PLATFORMS, i.e. the one
+// whose person ids are issued per tenant, so a second workspace is precisely where two humans
+// start sharing one `slack/<id>` principal key.
+//
+// This module lives OUTSIDE slack-events.ts on purpose: slack.ts's mention door needs it too, and
+// a leaf module is how both get it without an import cycle.
+import { classifyTenantAdmission, admittedTenantsFromConfig } from "@open-everywhere/core/agent/adapter-api.js";
+/**
+ * Is this delivery's Slack tenant admitted on this deployment? `proceed` also covers every
+ * deliberate inert case (nothing declared, operator opted in, no ids on the event at all) — see
+ * access/tenant-admission.ts's classifyTenantAdmission for why each one is a choice rather than a
+ * gap. `unadmitted` means: drop the wake, write the audit row, run no model turn.
+ *
+ * 🔴 PASS THE ENTERPRISE ID WHERE THE DOOR CAN READ ONE (OPE-1645). An ORG-WIDE Enterprise Grid
+ * install delivers an interactivity payload that names the Grid (`E…`) and NO workspace, so a call
+ * that hands over the workspace alone asks the fence to judge a delivery on the one field it is
+ * missing — and the classifier's "a delivery naming no tenant proceeds" path then ADMITS a foreign
+ * Grid. A door with no enterprise id to read omits the argument and gets the workspace-only
+ * decision it had before.
+ */
+export function slackTenantAdmission(teamId, enterpriseId) {
+    return classifyTenantAdmission({ platform: "slack", tenant: teamId, enterprise: enterpriseId, admitted: admittedTenantsFromConfig("slack") });
+}
+/**
+ * Read the tenant ids off an already-JSON-parsed INTERACTIVITY payload — a `block_actions` click, a
+ * `view_submission`, a shortcut. TOTAL AND PURE: any shape that names neither id yields `{}`, which
+ * {@link slackTenantAdmission} judges as "names no tenant".
+ *
+ * 🔴 THE GRID RUNG, IN ALL THREE SPELLINGS AN INTERACTIVITY PAYLOAD USES (OPE-1559). Which one
+ * arrives depends on how the app was installed, so reading fewer than three loses the rung on some
+ * installs — silently, and in the direction that ADMITS:
+ *   • a top-level `enterprise` OBJECT (an org-wide install; `team` may then be null);
+ *   • a top-level `enterprise_id` STRING;
+ *   • `team: { id, enterprise_id }` — what a PER-WORKSPACE install on a Grid sends.
+ * Order is widest-first; the top-level object wins where more than one is present.
+ *
+ * 🔴 NO SINGLE PLACE IN eve READS ALL THREE, so this union is OURS and cannot be delegated.
+ * Re-measured against eve 0.54.3: `parseShortcutPayload` (public/channels/slack/interactions.js) reads
+ * NO enterprise at all; `extractInstallationFromInteractive`
+ * (compiled/@chat-adapter/slack/index.js) reads `enterprise?.id || enterprise_id`; and the adapter's
+ * event path reads the top-level `enterprise_id` alone. Three readers, three different subsets — and
+ * none of them reads the `team.enterprise_id` arm, which is why the union stays ours.
+ * ⚠️ NOT RE-READ AT 0.54.3: the `enterprise.id || team.enterprise_id` shape this block used to
+ * attribute to the block_actions / view_submission parsers. It is not findable in the 0.54.3 bytes, so
+ * it is not restated as a measurement. The claim above does not rest on it.
+ *
+ * 🔴 `context_enterprise_id` IS DELIBERATELY NOT READ, though eve falls back to it. On a Slack
+ * Connect payload that field can name ANOTHER organisation, so trusting it would let a foreign Grid
+ * declaration vouch our room. `slackEnterpriseIdFromEnvelope` (slack-events.ts) makes the same
+ * exclusion on the event side. Every field below names the delivery's OWN workspace or Grid.
+ *
+ * 🔴 `user.team_id` IS NOT READ EITHER, and that omission is the point. It names the CLICKER's home
+ * workspace, which on a Grid is not the workspace the click happened in — so a fence built on it
+ * would judge the wrong tenant, in both directions. The question this fence asks is "which tenant
+ * DELIVERED this", and `team` / `enterprise` are the only fields that answer it.
+ *
+ * 🔴 IT LIVES HERE RATHER THAN AT A DOOR because the shortcut ingress and the six CLICK branches
+ * (OPE-1680) both need it, and a second copy of the reading rule at a second door is exactly the
+ * drift this module exists to prevent — the same argument that keeps {@link slackTenantAdmission}
+ * out of `slack-events.ts`.
+ */
+export function slackInteractivityTenantIds(raw) {
+    const p = asObject(raw);
+    if (p === undefined)
+        return {};
+    const teamId = asNonEmptyString(asObject(p.team)?.id);
+    const enterpriseId = asNonEmptyString(asObject(p.enterprise)?.id) ?? asNonEmptyString(p.enterprise_id) ?? asNonEmptyString(asObject(p.team)?.enterprise_id);
+    return { ...(teamId === undefined ? {} : { teamId }), ...(enterpriseId === undefined ? {} : { enterpriseId }) };
+}
+function asObject(v) {
+    return typeof v === "object" && v !== null ? v : undefined;
+}
+function asNonEmptyString(v) {
+    return typeof v === "string" && v.length > 0 ? v : undefined;
+}
+//# sourceMappingURL=slack-tenant-fence.js.map

package/dist/agent/channels/slack-tenant-fence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-tenant-fence.js","sourceRoot":"","sources":["../../../agent/channels/slack-tenant-fence.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,EAAE;AACF,mGAAmG;AACnG,gGAAgG;AAChG,mGAAmG;AACnG,mGAAmG;AACnG,oFAAoF;AACpF,EAAE;AACF,4FAA4F;AAC5F,iGAAiG;AACjG,iGAAiG;AACjG,iGAAiG;AACjG,kGAAkG;AAClG,8FAA8F;AAC9F,gDAAgD;AAChD,EAAE;AACF,kGAAkG;AAClG,4DAA4D;AAE5D,OAAO,EAAE,uBAAuB,EAAE,yBAAyB,EAAgC,MAAM,4CAA4C,CAAC;AAE9I;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAiC,EAAE,YAAwC;IAC9G,OAAO,uBAAuB,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,yBAAyB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAChJ,CAAC;AASD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AACH,MAAM,UAAU,2BAA2B,CAAC,GAAY;IACtD,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IACxB,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;IACtD,MAAM,YAAY,GAChB,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,IAAI,gBAAgB,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,CAAC;IACzI,OAAO,EAAE,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,CAAC;AAClH,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAE,CAA6B,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1F,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAU;IAClC,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/D,CAAC"}