@open-everywhere/provider-slack 0.3.0 → 0.5.0

package/dist/agent/channels/slack-front.d.ts

@@ -1,6 +1,9 @@
+import { type SlackUserDeactivation } from "./slack-offboarding.js";
+import type { OffboardOutcome } from "@open-everywhere/core/agent/adapter-api.js";
 import { type Channel, type RouteHandlerArgs } from "eve/channels";
 import { liveSupervisorDeps, type SlackEventEnvelope } from "./slack-events.js";
 import { EventDedupe, ThreadFifo, type SingleWindowMentionPolicy, type DmSeat, type SetKeyViewResult } from "@open-everywhere/core/agent/adapter-api.js";
+import { type ParsedHomeClick, type ParsedHomeOpen, type ParsedHomeSubmission } from "./slack-home.js";
 import { type ParsedSlackShortcut } from "./slack-shortcut.js";
 /** An HTTP route handler — `RouteHandler` isn't a public eve export, so we mirror its shape. */
 type RouteHandler = (req: Request, args: RouteHandlerArgs) => Promise<Response>;
@@ -22,6 +25,13 @@ export type FrontDecision = {
     readonly kind: "join";
     readonly reason: string;
     readonly env: SlackEventEnvelope;
+}
+/** OPE-2423 — a `user_change` event. Ours: a `deleted` user is a deactivation report for core's
+ *  offboarding lever (slack-offboarding.ts); every other profile edit is acked with no work. */
+ | {
+    readonly kind: "user-change";
+    readonly reason: string;
+    readonly env: SlackEventEnvelope;
 } | {
     readonly kind: "reaction";
     readonly reason: string;
@@ -91,6 +101,31 @@ export type FrontDecision = {
     readonly kind: "shortcut";
     readonly reason: string;
     readonly shortcut: ParsedSlackShortcut;
+}
+/** A `channel_shared` (the channel became Slack Connect shared) — ours: re-run the memory canvas gate
+ *  on that channel, which clears the app's canvas when the channel no longer passes (OPE-2451). */
+ | {
+    readonly kind: "channel-shared";
+    readonly reason: string;
+    readonly env: SlackEventEnvelope;
+}
+/** An `app_home_opened` for the HOME tab (OPE-2451) — ours: publish the person's own page. */
+ | {
+    readonly kind: "home-open";
+    readonly reason: string;
+    readonly open: ParsedHomeOpen;
+}
+/** An `oe_home:` click on the Home tab (OPE-2451) — ours: run a button, or open an item's modal. */
+ | {
+    readonly kind: "home-click";
+    readonly reason: string;
+    readonly click: ParsedHomeClick;
+}
+/** A submission of the Home tab's own modal (OPE-2451) — ours: run the action, republish the page. */
+ | {
+    readonly kind: "home-submit";
+    readonly reason: string;
+    readonly submission: ParsedHomeSubmission;
 };
 /**
  * Decide how the front route handles a raw inbound body. FORWARD is the fail-safe default:
@@ -180,10 +215,27 @@ export interface FrontOptions {
      *  re-verifies standing host-side, then mints an ephemeral OAuth URL / opens the api-key intake.
      *  Injectable for tests. */
     readonly handleConnectClick?: (payload: unknown) => Promise<boolean>;
+    /** OPE-2423 — hand one deactivation report to core's offboarding lever. Defaults to
+     *  {@link routeSlackUserDeactivation} with a live `users.info` re-read. Injectable for tests. */
+    readonly routeUserDeactivation?: (d: SlackUserDeactivation) => Promise<OffboardOutcome>;
     /** Injected in tests; the live default is core's `handleGrantCardClick`. The signed grant-click
      *  branch schedules it through the route's `waitUntil`, so this handler may outlive the empty
      *  Slack acknowledgement. */
     readonly handleGrantCardClick?: (payload: unknown) => Promise<boolean>;
+    /** The three Home-tab handlers (OPE-2451). Injected in tests; the live defaults are slack-home.ts's,
+     *  over the live Slack deps. Each runs after the empty acknowledgement, through `waitUntil`. */
+    readonly handleHomeOpened?: (open: ParsedHomeOpen) => Promise<boolean>;
+    readonly handleHomeClick?: (click: ParsedHomeClick) => Promise<boolean>;
+    readonly handleHomeSubmission?: (submission: ParsedHomeSubmission) => Promise<boolean>;
+    /** The domain memory canvas recheck a trust event runs (OPE-2451): a person joined the channel, or it
+     *  was shared. Injected in tests; the live default is slack-memory-canvas.ts's, over the live deps. */
+    readonly recheckChannelCanvas?: (input: {
+        org: string;
+        teamId: string;
+        channelId: string;
+        trigger: "member-joined" | "channel-shared";
+        joinedUserId?: string;
+    }) => Promise<unknown>;
     /** SINGLE-WINDOW mention policy for one (channel, surface) — should the unified window own an
      *  @mention here (suppress the native forward + keep the sibling as an addressed wake)?
      *  Defaults to the live {@link slackSingleWindowMentionPolicy} (grain + fail-closed

package/dist/agent/channels/slack-front.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"slack-front.d.ts","sourceRoot":"","sources":["../../../agent/channels/slack-front.ts"],"names":[],"mappings":"AAyCA,OAAO,EAAQ,KAAK,OAAO,EAA4B,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKnG,OAAO,EAgBL,kBAAkB,EASlB,KAAK,kBAAkB,EAIxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,WAAW,EACX,UAAU,EAgCV,KAAK,yBAAyB,EAC9B,KAAK,MAAM,EACX,KAAK,gBAAgB,EAOtB,MAAM,4CAA4C,CAAC;AAgBpD,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,qBAAqB,CAAC;AAE7B,gGAAgG;AAChG,KAAK,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEhF,8FAA8F;AAC9F,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAClD,gGAAgG;AAChG,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAI5D;;0DAE0D;AAC1D,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAA;CAAE,GACpF;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAA;CAAE,GACpF;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAA;CAAE,GACxF;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE;AACzF;kEACkE;GAChE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE;AACvF;;wCAEwC;GACtC;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE;AACxF;uGACuG;GACrG;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE;AACxF;;6CAE6C;GAC3C;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE;AACtF;;;2FAG2F;GACzF;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAA;CAAE;AACzF;;;;;sDAKsD;GACpD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,GAAG,MAAM,CAAA;CAAE;AACzH;;;;6FAI6F;GAC3F;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE,CAAC;AAsInG;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,aAAa,CAmFpF;AAED;;;gGAGgG;AAChG,wBAAgB,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAErD;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,OAAO,EAChB,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,KAAK,GAAE,MAAmB,GACzB,OAAO,CAOT;AAMD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;AAiBnC,wBAAgB,kBAAkB,IAAI,OAAO,CAAC;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAkBnG;AAED,8CAA8C;AAC9C,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAID,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/F,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,wFAAwF;IACxF,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvF;2EACuE;IACvE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD;;kGAE8F;IAC9F,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7D;;;wGAGoG;IACpG,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;IAC5D;;;;;;;oEAOgE;IAChE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9H;oFACgF;IAChF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE;qGACiG;IACjG,QAAQ,CAAC,0BAA0B,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtF;;gCAE4B;IAC5B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrE;;iCAE6B;IAC7B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE;;;;;6DAKyD;IACzD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC1G;;;;;2CAKuC;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACnJ,kGAAkG;IAClG,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7F;;;uGAGmG;IACnG,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC,CAAC;IAC1H;;;;;;;;;;;;;;2FAcuF;IACvF,QAAQ,CAAC,eAAe,CAAC,EAAE,CACzB,SAAS,EAAE,MAAM,KACd,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC7H;;;;;2FAKuF;IACvF,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACpF;;;;;;kCAM8B;IAC9B,QAAQ,CAAC,cAAc,CAAC,EAAE,CACxB,eAAe,EAAE,OAAO,EACxB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,EAAE,MAAM,GAAG,SAAS,KACvB,OAAO,CAAC;QAAE,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAChF;AAqGD;;;;;;;;GAQG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAarF;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,IAAI,CA0CjE;AAED;;;;;GAKG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,EAC3C,EAAE,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAC1B,UAAU,EAAE,MAAM,GACjB,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAiCvC;AAmBD,sDAAsD;AACtD,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC;AAeD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAIV;AAED,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,YAAY,EAAE,IAAI,GAAE,YAAiB,GAAG,YAAY,CA2yCnG;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,GAAE,YAAiB,GAAG,CAAC,CAYxG"}
+{"version":3,"file":"slack-front.d.ts","sourceRoot":"","sources":["../../../agent/channels/slack-front.ts"],"names":[],"mappings":"AAyCA,OAAO,EAA0D,KAAK,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC5H,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAClF,OAAO,EAAQ,KAAK,OAAO,EAA4B,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAKnG,OAAO,EAgBL,kBAAkB,EASlB,KAAK,kBAAkB,EAIxB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,WAAW,EACX,UAAU,EAgCV,KAAK,yBAAyB,EAC9B,KAAK,MAAM,EACX,KAAK,gBAAgB,EAOtB,MAAM,4CAA4C,CAAC;AAiBpD,OAAO,EAQL,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EAC1B,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,qBAAqB,CAAC;AAE7B,gGAAgG;AAChG,KAAK,YAAY,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEhF,8FAA8F;AAC9F,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAClD,gGAAgG;AAChG,eAAO,MAAM,oBAAoB,0BAA0B,CAAC;AAI5D;;0DAE0D;AAC1D,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAA;CAAE,GACpF;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAA;CAAE;AACtF;gGACgG;GAC9F;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAA;CAAE,GAC3F;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAA;CAAE,GACxF;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE;AACzF;kEACkE;GAChE;IAAE,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE;AACvF;;wCAEwC;GACtC;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE;AACxF;uGACuG;GACrG;IAAE,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE;AACxF;;6CAE6C;GAC3C;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAAE;AACtF;;;2FAG2F;GACzF;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAA;CAAE;AACzF;;;;;sDAKsD;GACpD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,GAAG,MAAM,CAAA;CAAE;AACzH;;;;6FAI6F;GAC3F;IAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE;AAChG;mGACmG;GACjG;IAAE,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,kBAAkB,CAAA;CAAE;AAChG,8FAA8F;GAC5F;IAAE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;CAAE;AACxF,oGAAoG;GAClG;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;CAAE;AAC3F,sGAAsG;GACpG;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAsIzG;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,aAAa,CA4GpF;AAED;;;gGAGgG;AAChG,wBAAgB,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAErD;AAMD;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,OAAO,EAChB,aAAa,EAAE,MAAM,GAAG,SAAS,EACjC,KAAK,GAAE,MAAmB,GACzB,OAAO,CAOT;AAMD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;AAiBnC,wBAAgB,kBAAkB,IAAI,OAAO,CAAC;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAkBnG;AAED,8CAA8C;AAC9C,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAID,iFAAiF;AACjF,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/F,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,wFAAwF;IACxF,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvF;2EACuE;IACvE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD;;kGAE8F;IAC9F,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7D;;;wGAGoG;IACpG,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;IAC5D;;;;;;;oEAOgE;IAChE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9H;oFACgF;IAChF,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE;qGACiG;IACjG,QAAQ,CAAC,0BAA0B,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtF;;gCAE4B;IAC5B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrE;qGACiG;IACjG,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,EAAE,qBAAqB,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;IACxF;;iCAE6B;IAC7B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE;oGACgG;IAChG,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,IAAI,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC,UAAU,EAAE,oBAAoB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvF;2GACuG;IACvG,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,eAAe,GAAG,gBAAgB,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACpL;;;;;6DAKyD;IACzD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC1G;;;;;2CAKuC;IACvC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACnJ,kGAAkG;IAClG,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7F;;;uGAGmG;IACnG,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,UAAU,GAAG,UAAU,GAAG,SAAS,CAAC,CAAC;IAC1H;;;;;;;;;;;;;;2FAcuF;IACvF,QAAQ,CAAC,eAAe,CAAC,EAAE,CACzB,SAAS,EAAE,MAAM,KACd,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,OAAO,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC7H;;;;;2FAKuF;IACvF,QAAQ,CAAC,wBAAwB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACpF;;;;;;kCAM8B;IAC9B,QAAQ,CAAC,cAAc,CAAC,EAAE,CACxB,eAAe,EAAE,OAAO,EACxB,MAAM,EAAE,MAAM,GAAG,SAAS,EAC1B,MAAM,EAAE,MAAM,GAAG,SAAS,KACvB,OAAO,CAAC;QAAE,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAChF;AAqGD;;;;;;;;GAQG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAarF;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,IAAI,CA0CjE;AAED;;;;;GAKG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,yBAAyB,CACvC,IAAI,EAAE,UAAU,CAAC,OAAO,kBAAkB,CAAC,EAC3C,EAAE,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAC1B,UAAU,EAAE,MAAM,GACjB,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAiCvC;AAmBD,sDAAsD;AACtD,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC;AAeD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAC9C,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B,GAAG,OAAO,CAIV;AAED,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,YAAY,EAAE,IAAI,GAAE,YAAiB,GAAG,YAAY,CAi7CnG;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,SAAS,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,GAAE,YAAiB,GAAG,CAAC,CAYxG"}

package/dist/agent/channels/slack-front.js

@@ -38,6 +38,7 @@
 //      urlencoded body (Eve's own `eve_input:` HITL clicks, view_submission, slash
 //      commands) still forwards exactly as before.
 //   4. Idempotency + per-thread FIFO guard the wake (see EventDedupe / ThreadFifo below).
+import { parseSlackUserDeactivation, routeSlackUserDeactivation } from "./slack-offboarding.js";
 import { POST } from "eve/channels";
 import { SLACK_SIGNATURE_HEADER, SLACK_TIMESTAMP_HEADER, slackSignature, slackSignatureMatches } from "./slack-signature.js";
 import { slackSigningSecret } from "../setup/credentials.js";
@@ -46,9 +47,11 @@ import { callSlackWebApi } from "./slack-web-api.js";
 import { auditDmBotAuthorDrop, auditDmDriverAdmitted, dmDoorAdmitsDriver, parseMessageEvent, routeMessageEvent, liveDeps, routeNameDropEvent, liveNameDropDeps, parseChannelJoinEvent, routeChannelJoinEvent, liveChannelJoinDeps, parseSlackReactionEvent, routeReactionEvent, liveReactionDeps, routeSupervisorEvent, liveSupervisorDeps, supervisorFifoKey, bindableFor, bindableForJoin, bindableForReaction, slackSingleWindowMentionPolicy, slackDomainUsesUnifiedWindow, slackFrontTenantFenceDeclined, slackInteractivityTenantFenceDeclined, } from "./slack-events.js";
 import { slackInteractivityTenantIds } from "./slack-tenant-fence.js";
 import { EventDedupe, ThreadFifo, getOrCreateDmSeat as liveGetOrCreateDmSeat, touchDmSeat as liveTouchDmSeat, resolvePartition, domainKeyOf, isThreadEngaged, divertInboundToUnifiedWindow, isPrunedDeploymentWakeError, markUndeliveredAfterHeal, isUndeliveredAfterHeal, healPrunedDeploymentStrand, mintWakeId, slackVendorEventTime, spreadVendorTs, resolveWakeTrust, ambientSupervisorEnabled, getConfig, getOperationalStore, OE_APPROVAL_PREFIX, handleApprovalPayload as liveHandleApprovalPayload, OE_SETKEY_ACTION_PREFIX, OE_SETKEY_MODAL_CALLBACK, handleSetKeyClick as liveHandleSetKeyClick, handleSetKeyViewSubmission as liveHandleSetKeyViewSubmission, OE_CONNECT_ACTION_PREFIX, handleConnectClick as liveHandleConnectClick, OE_GRANT_ACTION_PREFIX, handleGrantCardClick as liveHandleGrantCardClick, buildRecord, enqueue as enqueueLogRecord, flushLogShip, stampNonMemberChatAuth, externalPolicyIsInert, recordWakeTail, tailAuthorGrain, dmWindowRegistryKey, stampSurfaceEventVerified, } from "@open-everywhere/core/agent/adapter-api.js";
-import { renderWakeMessage, slackChannelFactsFor, slackAuthorIsMember, slackClickerIsGuest, slackWakeAuthorFacts, slackExternalPolicyForRoom, applySlackExternalPolicy, stripUnfencedSlackAttachments, slackEnterpriseIdFromEnvelope, _resetAuthorMemberCache, } from "./slack-events.js";
+import { renderWakeMessage, slackChannelFactsFor, slackAuthorIsMember, slackClickerIsGuest, slackWakeAuthorFacts, slackExternalPolicyForRoom, applySlackExternalPolicy, stripUnfencedSlackAttachments, slackEnterpriseIdFromEnvelope, slackForm, _resetAuthorMemberCache, } from "./slack-events.js";
 import { buildSlackAuth, withForwardedSlackEnvelope } from "./slack-identity.js";
 import { holdRouteWork, routeHoldQuiesced, withSlackRouteHold } from "./slack-route-hold.js";
+import { liveMemoryCanvasDeps, recheckChannelCanvas } from "./slack-memory-canvas.js";
+import { handleHomeClick, handleHomeOpened, handleHomeSubmission, liveSlackHomeDeps, parseHomeClick, parseHomeOpened, parseHomeSubmission, } from "./slack-home.js";
 import { persistSlackAttachment, registerSlackAttachment } from "./slack-attachments.js";
 import { parseSlackShortcutPayload, shortcutMessageEvent, shortcutWakeKey, } from "./slack-shortcut.js";
 /** The public URL Slack POSTs every subscribed event to (Event Subscriptions Request URL). */
@@ -213,6 +216,17 @@ export function classifyEnvelope(rawBody, contentType) {
         if (grantClick !== undefined) {
             return { kind: "grant-click", reason: "block_actions oe_grant: click — ours, never forwarded", payload: grantClick };
         }
+        // THE HOME TAB (OPE-2451). Its clicks carry an `oe_home:` action id and its one modal a callback
+        // id of its own, so neither can be mistaken for another door's payload, nor for eve's.
+        const homePayload = decodeInteractivityPayload(rawBody);
+        const homeClick = parseHomeClick(homePayload);
+        if (homeClick !== undefined) {
+            return { kind: "home-click", reason: `block_actions oe_home: ${homeClick.action} — ours, never forwarded`, click: homeClick };
+        }
+        const homeSubmission = parseHomeSubmission(homePayload);
+        if (homeSubmission !== undefined) {
+            return { kind: "home-submit", reason: `view_submission for the Home tab modal (${homeSubmission.action}) — ours, never forwarded`, submission: homeSubmission };
+        }
         // A SHORTCUT (OPE-1376) — a `message_action` or `shortcut` payload. Ours, never forwarded; see
         // the `shortcut` arm of FrontDecision for why a forward could not do anything with it. It is
         // matched LAST among the urlencoded branches and cannot race any of them: every branch above
@@ -246,6 +260,21 @@ export function classifyEnvelope(rawBody, contentType) {
     if (eventType === "member_joined_channel") {
         return { kind: "join", reason: "member_joined_channel — channel-join intro candidate", env };
     }
+    if (eventType === "channel_shared") {
+        return { kind: "channel-shared", reason: "channel_shared — recheck the domain memory canvas", env };
+    }
+    if (eventType === "app_home_opened") {
+        // Only the HOME tab is ours (OPE-2451). The same event fires for the Messages tab, which has no
+        // page to publish, so that one forwards — eve acknowledges an event it has no handler for.
+        const open = parseHomeOpened(env);
+        if (open)
+            return { kind: "home-open", reason: "app_home_opened (home tab) — publish the person's page", open };
+        return { kind: "forward", reason: "app_home_opened for a tab other than home — nothing to publish" };
+    }
+    if (eventType === "user_change") {
+        // OPE-2423: slackChannel drops it, and a DEACTIVATED user is ours — automatic offboarding.
+        return { kind: "user-change", reason: "user_change — a deactivation report candidate", env };
+    }
     if (eventType === "reaction_added" || eventType === "reaction_removed") {
         // Inbound reactions: slackChannel drops them (no handler), so they're ours to ingest
         // (reaction-ingest.ts — a feedback signal on the bot's own replies + volume telemetry).
@@ -704,7 +733,12 @@ export function buildFrontHandler(innerHandler, opts = {}) {
     const handleSetKeyClick = opts.handleSetKeyClick ?? liveHandleSetKeyClick;
     const handleSetKeyViewSubmission = opts.handleSetKeyViewSubmission ?? liveHandleSetKeyViewSubmission;
     const handleConnectClick = opts.handleConnectClick ?? liveHandleConnectClick;
+    const routeUserDeactivation = opts.routeUserDeactivation ?? ((d) => routeSlackUserDeactivation(d, { usersInfo: (userId) => slackForm("users.info", `user=${encodeURIComponent(userId)}`) }));
     const handleGrantCardClick = opts.handleGrantCardClick ?? liveHandleGrantCardClick;
+    const homeOpened = opts.handleHomeOpened ?? ((open) => handleHomeOpened(open, liveSlackHomeDeps()));
+    const homeClicked = opts.handleHomeClick ?? ((click) => handleHomeClick(click, liveSlackHomeDeps()));
+    const recheckCanvas = opts.recheckChannelCanvas ?? ((input) => recheckChannelCanvas(input, liveMemoryCanvasDeps()));
+    const homeSubmitted = opts.handleHomeSubmission ?? ((submission) => handleHomeSubmission(submission, liveSlackHomeDeps()));
     const ambientEnabledFor = opts.ambientEnabledFor ?? ((surfaceKey) => ambientSupervisorEnabled(surfaceKey, getConfig().loadDomains()));
     const seatedSurface = opts.seatedSurfaceFor ?? slackDomainUsesUnifiedWindow;
     const mentionPolicyFor = opts.mentionPolicyFor ?? slackSingleWindowMentionPolicy;
@@ -859,16 +893,16 @@ export function buildFrontHandler(innerHandler, opts = {}) {
         /** The Events API form: key one `event_id` (falling back to `channel:ts`). Every existing wake
          *  route reads this one; only the shortcut branch keys itself. */
         const notYetSeen = (env, ev) => notYetSeenKey(wakeKey(env, ev.channelId, ev.ts), ev);
-        // UNOWNED message dispatch (top-level, or in-thread but not engaged): today's default is the
-        // name-drop path (per-domain opt-in, fail-closed). When the channel's domain opts into
-        // ambientSupervisor, the SAME unowned traffic routes to the channel-supervisor session instead
+        // UNOWNED message dispatch (top-level, or in-thread but not engaged): the fallback is the
+        // name-drop path (per-domain opt-in, fail-closed). When the channel's domain has
+        // ambientSupervisor on (the default since OPE-2409), the SAME unowned traffic routes to the channel-supervisor session instead
         // (slack-events.ts routeSupervisorEvent) — the "always-on teammate" leg. `directMention` is the
         // SINGLE-WINDOW addressed-mention divert (an app_mention event routed here from the mention
         // branch): it forces the supervisor path (the only road into the unified window) and renders an
         // addressed `direct-mention` wake. The supervisor wake serializes on its OWN FIFO key (the
         // supervisor token), never shared with a thread FIFO. Fail-closed: any partition/config error,
         // or the flag off, falls through to the UNCHANGED name-drop dispatch — so ambientSupervisor-off
-        // is byte-identical to today. Parametrised on `ev` so both the app_mention divert and a plain
+        // is byte-identical to the pre-ambient path. Parametrised on `ev` so both the app_mention divert and a plain
         // message.channels wake feed one dispatcher.
         // `onWake` runs SYNCHRONOUSLY, once, immediately before a wake is scheduled — and never on the
         // addressed-drop path below. The shortcut route (OPE-1442) uses it to seed the attachment
@@ -1109,10 +1143,9 @@ export function buildFrontHandler(innerHandler, opts = {}) {
             // 🔴 A GROUP DM IS SUPPRESSIBLE ON THE AUTHOR GRAIN TOO (OPE-1486). It was not before, because
             // an mpim resolved no refutation at all — the limit the old note here recorded. The author leg
             // above now resolves one from the same probe a channel uses, so an operator who set
-            // `externalPolicy.authorGrain: "withhold"` gets that rule in a group DM as well. Nothing moves
-            // on the SUPPRESSION PATH for a default deployment: `withholdsBody` is inert under the shipped
-            // `taint` grain, so only a deployment that explicitly excluded refuted authors is suppressed
-            // here — which is the rule it asked for. That is a claim about SUPPRESSION alone: on `taint`
+            // `externalPolicy.authorGrain: "withhold"` (shipped since 2026-10-10) gets that rule in a group
+            // DM as well. `withholdsBody` is inert only under the `taint` opt-out, so a deployment that opted
+            // out is never suppressed here. That is a claim about SUPPRESSION alone: on `taint`
             // the same refutation still newly stamps `oe_chat_nonmember` and still newly fences the body,
             // which is the fix. The room leg stays off for the whole DM family by the note above: on a DM
             // the trust plane asks about the PARTNER, not about the room.
@@ -1617,7 +1650,7 @@ export function buildFrontHandler(innerHandler, opts = {}) {
             //
             // 🔴 IT COSTS A PROBE, SO IT IS SKIPPED WHEN IT CANNOT MATTER. Unlike the three routes, this
             // leg resolves no author facts of its own, so gating it means one `users.info` call. The inert
-            // check runs first: on the shipped `taint` / `engage` pair no evidence is resolved at all and
+            // check runs first: on the `taint` / `engage` opt-out pair no evidence is resolved at all and
             // this whole block is a single config read. The probe is TTL-cached per author on top of that.
             //
             // FAIL-OPEN on anything unreadable — an unparseable event, an unresolvable partition, a probe
@@ -1743,6 +1776,32 @@ export function buildFrontHandler(innerHandler, opts = {}) {
             }));
             return new Response(null, { status: 200 });
         }
+        if (decision.kind === "home-open" || decision.kind === "home-click" || decision.kind === "home-submit") {
+            // THE HOME TAB (OPE-2451). THE TENANT FENCE FIRST (OPE-1680), for the reason the approval branch
+            // states: the page reads and changes a person's memory, keyed to a bare per-workspace member id,
+            // so an unadmitted workspace reaching it is a foreign tenant reading our store.
+            const ids = decision.kind === "home-open" ? decision.open : decision.kind === "home-click" ? decision.click : decision.submission;
+            const fenceIds = {
+                ...(ids.teamId === undefined ? {} : { teamId: ids.teamId }),
+                ...(ids.enterpriseId === undefined ? {} : { enterpriseId: ids.enterpriseId }),
+                userId: ids.userId,
+            };
+            if (slackInteractivityTenantFenceDeclined(fenceIds, decision.kind, decision.kind === "home-open" ? "front-home-event-branch" : "front-interactivity-branch")) {
+                return fencedAck(new Response(null, { status: 200 }));
+            }
+            // ACK FIRST, WORK AFTER. Building the page reads memory and asks Slack who the person is and
+            // which channels they sit in, which can cross Slack's three-second budget. An empty 200 also
+            // CLOSES a submitted modal, which is what the person expects after Save or Forget; the page
+            // they return to is republished with a one-line notice saying what happened.
+            const run = decision.kind === "home-open" ? homeOpened(decision.open) : decision.kind === "home-click" ? homeClicked(decision.click) : homeSubmitted(decision.submission);
+            args.waitUntil(run
+                .then((handled) => {
+                if (!handled)
+                    console.log(`[open-everywhere:slack-front] ${decision.kind} for ${ids.userId} did not complete`);
+            })
+                .catch(() => console.warn(`[open-everywhere:slack-front] ${decision.kind} failed after acknowledgement`)));
+            return new Response(null, { status: 200 });
+        }
         if (decision.kind === "setkey-submit") {
             // THE TENANT FENCE (OPE-1680), above the handler — this is the branch that WRITES A SECRET into
             // this deployment's store, keyed to the intake the payload names. A `view_submission` carries
@@ -1764,6 +1823,34 @@ export function buildFrontHandler(innerHandler, opts = {}) {
             }
             return forwardNative();
         }
+        if (decision.kind === "channel-shared") {
+            // THE CHANNEL WAS SHARED (OPE-2451): re-run the memory canvas gate at once, which clears the app's
+            // own canvas there. The canvas reads the room verdict fresh, so the wake path's cached "internal"
+            // cannot carry a pre-share answer into this decision.
+            const ev = decision.env.event;
+            const channelId = typeof ev?.channel === "string" ? ev.channel : undefined;
+            const teamId = typeof decision.env.team_id === "string" ? decision.env.team_id : undefined;
+            if (!channelId || !teamId)
+                return OK();
+            const sharedEnterpriseId = slackEnterpriseIdFromEnvelope(decision.env);
+            if (slackInteractivityTenantFenceDeclined({ teamId, ...(sharedEnterpriseId === undefined ? {} : { enterpriseId: sharedEnterpriseId }), channelId }, "channel-shared", "front-channel-shared-branch")) {
+                return fencedAck(OK());
+            }
+            let sharedOrg;
+            try {
+                sharedOrg = resolvePartition({
+                    channel: { kind: "slack" },
+                    session: { auth: { current: { attributes: { team_id: teamId, channel_id: channelId }, principalId: "", principalType: "slack-user" } } },
+                }).org;
+            }
+            catch {
+                sharedOrg = undefined;
+            }
+            if (sharedOrg !== undefined) {
+                args.waitUntil(recheckCanvas({ org: sharedOrg, teamId, channelId, trigger: "channel-shared" }).catch(() => console.warn("[open-everywhere:slack-front] memory canvas recheck after a share failed")));
+            }
+            return OK();
+        }
         if (decision.kind === "join") {
             // Channel-join intro. Only the BOT's own join is an invitation — a human joining a
             // channel we're in fires the same event and must be dropped. Fail-CLOSED here, the
@@ -1774,8 +1861,30 @@ export function buildFrontHandler(innerHandler, opts = {}) {
             if (!jev)
                 return OK();
             const { userId: joinBotUserId } = await getBotIdentity();
-            if (!joinBotUserId || jev.userId !== joinBotUserId)
+            if (!joinBotUserId || jev.userId !== joinBotUserId) {
+                // A PERSON JOINED (OPE-2451). No intro, but the domain memory canvas re-runs its gate: the
+                // newcomer may be a guest, and a canvas written before they joined would show them every line
+                // of the domain's memory. The recheck can only CLEAR the app's own canvas, never write memory,
+                // so an unresolved bot identity rechecks too. Fenced like every other door: a foreign tenant
+                // never reaches this deployment's Slack calls.
+                if (jev.teamId === undefined)
+                    return OK();
+                if (slackInteractivityTenantFenceDeclined({ teamId: jev.teamId, ...(jev.enterpriseId === undefined ? {} : { enterpriseId: jev.enterpriseId }), channelId: jev.channelId, userId: jev.userId }, "member-joined", "front-join-branch")) {
+                    return fencedAck(OK());
+                }
+                let joinOrg;
+                try {
+                    joinOrg = resolvePartition(bindableForJoin(jev)).org;
+                }
+                catch {
+                    joinOrg = undefined;
+                }
+                if (joinOrg !== undefined) {
+                    const teamId = jev.teamId;
+                    args.waitUntil(recheckCanvas({ org: joinOrg, teamId, channelId: jev.channelId, trigger: "member-joined", joinedUserId: jev.userId }).catch(() => console.warn("[open-everywhere:slack-front] memory canvas recheck after a join failed")));
+                }
                 return OK();
+            }
             // Same two-layer idempotency as the message wake: Slack retries a slow ack, and a
             // double intro is exactly the annoyance the durable half exists to prevent.
             const joinKey = wakeKey(decision.env, jev.channelId, jev.ts);
@@ -1796,6 +1905,28 @@ export function buildFrontHandler(innerHandler, opts = {}) {
             args.waitUntil(routeChannelJoinEvent(jev, liveChannelJoinDeps(joinSend)).then(logOutcome("channel-join", jev.channelId, jev.ts)));
             return OK();
         }
+        if (decision.kind === "user-change") {
+            // AUTOMATIC OFFBOARDING (OPE-2423). The signature above has authenticated the envelope, so its
+            // `team_id` is the workspace that delivered this report. Every other decision — the
+            // same-workspace gate, the tenant fence, the live users.info re-read, the terminal revoke and
+            // its audit row — runs in core's offboardDeactivatedAccount, AFTER the ack: Slack wants a quick
+            // 200, and a revoke is idempotent, so a Slack retry that races it changes nothing.
+            const deactivation = parseSlackUserDeactivation(decision.env);
+            if (!deactivation)
+                return OK();
+            // THE TENANT FENCE (OPE-1680), the same front-door refusal every other deciding branch takes.
+            // Core's gate 2 ALSO requires a positive admission, because this fence is inert when config
+            // declares no tenant — and a terminal revoke must not run on an inert answer.
+            if (slackInteractivityTenantFenceDeclined({
+                teamId: deactivation.deliveringTeamId,
+                ...(deactivation.enterpriseId === undefined ? {} : { enterpriseId: deactivation.enterpriseId }),
+                userId: deactivation.userId,
+            }, "user-change", "front-user-change-branch")) {
+                return fencedAck(OK());
+            }
+            args.waitUntil(routeUserDeactivation(deactivation).then((outcome) => console.log(`[open-everywhere:slack-front] user_change ${deactivation.userId}: offboarding ${outcome.kind}${outcome.kind === "refused" ? ` (${outcome.reason})` : ""}`)));
+            return OK();
+        }
         if (decision.kind === "reaction") {
             // Inbound reaction (feedback signal). Parse it; an unusable envelope is a no-op 200.
             const rev = parseSlackReactionEvent(decision.env);