@open-everywhere/provider-slack 0.7.0 → 0.8.1

package/dist/agent/channels/slack-agent-session.js

@@ -0,0 +1,282 @@
+// THE SLACK AGENT SESSION (OPE-2519) — Slack's native Stop, the session title, and the "needs you" state.
+//
+// Slack's agent experience shows each conversation with the app as an AGENT SESSION, keyed by the
+// channel and the thread root (docs.slack.dev/ai/agent-sessions, re-read 2026-10-14). A session has a
+// lifecycle status (`processing`, `active`, `suspended`, `closed`) and a title. This file owns the three
+// things OE does with it:
+//
+//   • STOP. While a session is `processing`, Slack shows a Stop button, but only to an app that
+//     subscribes to `agent_session_stopped`. A press arrives as that event. It takes the SAME cancel
+//     path as the ✋ reaction and `/oe stop` (`cancelAnchoredTurn`): no session is minted, no model is
+//     called, nothing is spent. Slack does not move the status itself, so the route sets `active`.
+//   • TITLE. A top-level message the person sends in their DM with the app opens a new conversation,
+//     and gets a short title from the words the person TYPED (`authoredText`). The lines of a
+//     forwarded or quoted message are another conversation's words, so they never title it. The host
+//     derives the title in code: no model writes it. Slack applies a `title` only when the call
+//     CREATES the session, so a title the person typed over ours is never overwritten. A thread reply,
+//     a shortcut and a group DM get no title.
+//   • STATE. Core's turn-anchor hook sets the session `processing` when a turn starts, and at the park
+//     `suspended` when the turn reported through `update_status` that it waits on a person
+//     (`needs_input` or `blocked`), else `active` (channels/surface-session-state.ts). This file
+//     registers the Slack setter: it names the session from the delivery's auth attributes. The
+//     person's next message sets `processing`, then parks `active` unless it reports again that it
+//     waits on the person. A job's result wake names no session, so its turn sets no state.
+//   • THE WORKING SIGNS (OPE-2629). The same setter shows the 👀 and the status line on the session's
+//     root while a turn works, and clears both at the park. See `setSlackDmWorkingSigns`.
+//   • A FORWARDED JOB's WAIT (OPE-2536). A job the DM seat forwards to the work session can end waiting
+//     on the person: it asked a question in the room (`ask_room`), or it needs their own sign-in. The
+//     work session has no `update_status`, so the host sets the session `suspended` at the job's
+//     settlement (core channels/work-surface-wait.ts). This file registers the PIN for that: the
+//     session's id and the three attributes that name it again, kept on the job.
+//
+// WHICH SESSIONS. Only the person's 1:1 DM with the app (the Messages tab and the side panel), where
+// Slack lists the person's agent sessions. The DM door stamps the session's thread root on the wake's
+// auth (`agent_session_ts`): a top-level message opens its own session, keyed by its own `ts`, and a
+// thread reply belongs to its thread's session. A channel thread gets no state from OE.
+//
+// Every call here is best-effort. A workspace without Slack's agent features answers an error, which
+// is logged and changes nothing else.
+import { cancelAnchoredTurn, resolvePartition, STATUS_REACTION, swallowRoomOp, turnAnchorKey, turnChannelKey, } from "@open-everywhere/core/agent/adapter-api.js";
+import { bindableForSlackIds, slackForm } from "./slack-events.js";
+/** Slack's event for a press of the session's Stop button. */
+export const AGENT_SESSION_STOPPED_EVENT = "agent_session_stopped";
+/** The longest title OE sets. Slack accepts 200 characters; a session list shows far fewer. */
+export const SLACK_SESSION_TITLE_MAX = 60;
+/** The auth attribute the DM door stamps with the session's thread root (slack-front.ts `scheduleDmWake`). */
+const AGENT_SESSION_TS_ATTRIBUTE = "agent_session_ts";
+/**
+ * The mark a PINNED bag carries (OPE-2629). A forwarded job's settlement sets the session's state from
+ * its pin, not from a turn, so the setter must not touch the turn's working signs for it: a turn of the
+ * same session can be running at that moment, and its 👀 must stay until its own park.
+ */
+const SESSION_PIN_ATTRIBUTE = "oe_session_pin";
+// --- the title ------------------------------------------------------------------------------------
+/** Slack's three escaped characters, decoded. */
+function decodeSlackEntities(text) {
+    return text.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
+}
+/**
+ * The session title for a conversation that opens with `text`, or undefined when nothing readable is
+ * left. Pure. It keeps the first non-empty line, renders a link as its label, a channel as `#name`, and
+ * drops a member or group mention (no raw id reaches the title). It strips `*`, `~` and backticks, and
+ * keeps `_`, so an identifier such as `oe_config` stays intact. A long line is cut at a word and ends
+ * with `…`.
+ */
+export function slackSessionTitle(text) {
+    if (typeof text !== "string")
+        return undefined;
+    const rendered = text
+        // A member mention, with or without a label: dropped.
+        .replace(/<@[A-Z0-9]+(?:\|[^>]*)?>/g, " ")
+        // A channel mention: its name when Slack sent one, else dropped.
+        .replace(/<#[A-Z0-9]+\|([^>]+)>/g, "#$1")
+        .replace(/<#[A-Z0-9]+>/g, " ")
+        // A special or group mention (`<!here>`, `<!subteam^S1|@team>`): dropped.
+        .replace(/<![^>]*>/g, " ")
+        // A link: its label, else the address.
+        .replace(/<[^>|]+\|([^>]+)>/g, "$1")
+        .replace(/<([^>]+)>/g, "$1");
+    const line = decodeSlackEntities(rendered)
+        .split(/\r?\n/)
+        .map((l) => l.replace(/[*~`]+/g, "").replace(/\s+/g, " ").trim())
+        .find((l) => l.length > 0);
+    if (line === undefined)
+        return undefined;
+    if (line.length <= SLACK_SESSION_TITLE_MAX)
+        return line;
+    const head = line.slice(0, SLACK_SESSION_TITLE_MAX - 1);
+    const cut = head.lastIndexOf(" ");
+    return `${(cut >= SLACK_SESSION_TITLE_MAX / 2 ? head.slice(0, cut) : head).trimEnd()}…`;
+}
+/** The form body of {@link SlackSessionStatusCall}. Pure. */
+export function slackSessionStatusForm(call) {
+    const body = new URLSearchParams({ channel_id: call.channelId, thread_ts: call.threadTs, status: call.status });
+    if (call.title !== undefined && call.title.length > 0)
+        body.set("title", call.title);
+    return body.toString();
+}
+/** Set a session's status (and, on creation, its title). True when Slack answered `ok`. Never throws. */
+export async function setSlackSessionStatus(call, form = slackForm) {
+    try {
+        const res = await form("agents.sessions.setStatus", slackSessionStatusForm(call));
+        if (res?.ok === true)
+            return true;
+        console.warn(`[open-everywhere:slack-session] agents.sessions.setStatus ${call.status} was not applied (${call.channelId}/${call.threadTs}): ${String(res?.error ?? "no answer")}`);
+        return false;
+    }
+    catch (err) {
+        console.warn(`[open-everywhere:slack-session] agents.sessions.setStatus ${call.status} failed (${call.channelId}/${call.threadTs}): ${String(err)}`);
+        return false;
+    }
+}
+/**
+ * The session a delivery's auth attributes name, or undefined for none. Only a delivery the DM door
+ * stamped (`agent_session_ts`) names one: a shortcut, a group DM and every channel carry no stamp, so
+ * they never set a session's state, even on a threaded message. Pure.
+ */
+export function slackAgentSessionOf(attributes) {
+    if (attributes.channel_type !== "im")
+        return undefined;
+    const channelId = attributes.channel_id;
+    const stamped = attributes[AGENT_SESSION_TS_ATTRIBUTE];
+    if (typeof channelId !== "string" || channelId.length === 0 || typeof stamped !== "string" || stamped.length === 0)
+        return undefined;
+    return { channelId, threadTs: stamped };
+}
+/**
+ * The Slack pinner (OPE-2536): the session a delivery names, as the setter's own id and the three
+ * attributes that name it again. A forwarded job keeps this, so its settlement can set the session
+ * `suspended` long after the delivery's auth is gone. Ids only, never text. Pure.
+ */
+export const slackSurfaceSessionPin = (attributes) => {
+    const session = slackAgentSessionOf(attributes);
+    if (!session)
+        return undefined;
+    return {
+        id: `${session.channelId}:${session.threadTs}`,
+        attributes: { channel_id: session.channelId, channel_type: "im", [AGENT_SESSION_TS_ATTRIBUTE]: session.threadTs, [SESSION_PIN_ATTRIBUTE]: "1" },
+    };
+};
+// --- the working signs ------------------------------------------------------------------------------
+//
+// 🔴 THE DM SEAT'S 👀 AND STATUS LINE LIVE HERE (OPE-2629). A 1:1 DM runs on the `unified` channel, so
+// none of the Slack channel's own handlers reach it: `onInbound` (the 👀) and the `turn.started`
+// renderer (the status line) serve only eve's native mention door. Before this, a person who DMed
+// the app saw neither during the turn. Core's turn-anchor hook calls this setter at every DM turn's
+// start (`processing`) and park (`active` or `suspended`), so the signs ride the same two calls:
+//   • 👀 on the session's thread root — the message itself when it is top-level, the same root the
+//     mention door's 👀 uses for a threaded one. Added at `processing`, removed at the park.
+//   • Slack's assistant status (`assistant.threads.setStatus`) on that root: `Working...` at
+//     `processing`, cleared at the park. The flat DM reply does not clear it, so the park must.
+// A forwarded job's settlement (OPE-2536) also calls this setter, from the job's PIN. A turn of the
+// same session can run at that moment, so a pinned bag (`SESSION_PIN_ATTRIBUTE`) moves the session
+// state only and leaves the signs to the turn's own park.
+// A turn that fails for good emits `session.failed` and never parks, so its signs stay: the 👀 until
+// the session's next turn parks, and the status line until Slack expires it.
+/** The status line a DM turn shows while it works — the same words the mention door's `turn.started` shows. */
+export const SLACK_DM_WORKING_STATUS = "Working...";
+/** The 👀 the bot sets while it works (core status/status.ts `STATUS_REACTION.working`). */
+const WORKING_REACTION = STATUS_REACTION.working;
+/**
+ * What an operator does when one sign call fails with a setup error (`SIGN_SETUP_ERRORS`). The sign
+ * needs a scope or the agent view, and both come from the app manifest, so the fix is the manifest
+ * paste. Logged once per method and error, so a workspace without the feature does not log it on
+ * every turn.
+ */
+const SIGN_SETUP_FIX = {
+    "reactions.add": "the 👀 needs the reactions:write bot scope",
+    "reactions.remove": "the 👀 needs the reactions:write bot scope",
+    "assistant.threads.setStatus": "the DM status line needs the assistant:write bot scope and the agent view (features.agent_view)",
+};
+/** Slack's answers that mean the app lacks a scope or a feature: a setup gap, not a passing fault. */
+const SIGN_SETUP_ERRORS = new Set(["missing_scope", "feature_disabled", "not_allowed_token_type", "not_allowed", "access_denied"]);
+/** Slack's answers that say the sign is already in the state asked for. */
+const SIGN_NO_OP_ERRORS = new Set(["already_reacted", "no_reaction"]);
+const warnedSignErrors = new Set();
+/** One sign call. Never throws; a failure is logged once per method and error, with the setup fix. */
+async function sendSign(form, method, body) {
+    let error;
+    try {
+        const res = await form(method, body.toString());
+        if (res?.ok === true)
+            return;
+        error = String(res?.error ?? "no answer");
+    }
+    catch (err) {
+        error = String(err);
+    }
+    if (SIGN_NO_OP_ERRORS.has(error))
+        return;
+    const key = `${method}:${error}`;
+    if (warnedSignErrors.has(key))
+        return;
+    warnedSignErrors.add(key);
+    const fix = SIGN_SETUP_ERRORS.has(error)
+        ? `${SIGN_SETUP_FIX[method] ?? "this sign needs a manifest scope"}. Fix: paste the app manifest again (App Manifest → Save Changes) and reinstall if Slack asks`
+        : "the sign is best-effort and the turn goes on";
+    console.warn(`[open-everywhere:slack-session] ${method} failed (${error}) — ${fix}. Logged once per process.`);
+}
+/** Test-only: forget which sign failures were already logged. */
+export function _resetSignWarningsForTest() {
+    warnedSignErrors.clear();
+}
+/**
+ * Show or clear the DM turn's working signs on the session's root: the 👀 and the status line. The
+ * two calls run in parallel, because the turn waits on this setter. A swallowed room op (the egress
+ * spoof) sends neither. Never throws.
+ */
+async function setSlackDmWorkingSigns(session, working, form = slackForm) {
+    if (swallowRoomOp(`a slack DM working sign ${working ? "add" : "remove"}`))
+        return;
+    const reaction = new URLSearchParams({ channel: session.channelId, name: WORKING_REACTION, timestamp: session.threadTs });
+    const status = new URLSearchParams({ channel_id: session.channelId, thread_ts: session.threadTs, status: working ? SLACK_DM_WORKING_STATUS : "" });
+    await Promise.all([sendSign(form, working ? "reactions.add" : "reactions.remove", reaction), sendSign(form, "assistant.threads.setStatus", status)]);
+}
+/** The Slack setter core's turn-anchor hook calls (registered in register.ts). */
+export function slackSurfaceSessionSetter(form = slackForm) {
+    return async (attributes, status) => {
+        const session = slackAgentSessionOf(attributes);
+        if (!session)
+            return undefined;
+        const fromTurn = attributes[SESSION_PIN_ATTRIBUTE] === undefined;
+        await Promise.all([setSlackSessionStatus({ ...session, status }, form), ...(fromTurn ? [setSlackDmWorkingSigns(session, status === "processing", form)] : [])]);
+        return `${session.channelId}:${session.threadTs}`;
+    };
+}
+/** Parse an `agent_session_stopped` envelope, or null for anything else. Pure. */
+export function parseAgentSessionStopped(envelope) {
+    if (envelope?.type !== "event_callback")
+        return null;
+    const e = envelope.event;
+    if (!e || e.type !== AGENT_SESSION_STOPPED_EVENT)
+        return null;
+    const channelId = typeof e.channel === "string" ? e.channel : "";
+    const threadTs = typeof e.thread_ts === "string" ? e.thread_ts : "";
+    const userId = typeof e.user === "string" ? e.user : "";
+    if (!channelId || !threadTs || !userId)
+        return null;
+    const teamId = typeof envelope.team_id === "string" && envelope.team_id.length > 0 ? envelope.team_id : undefined;
+    return {
+        channelId,
+        threadTs,
+        userId,
+        ...(teamId ? { teamId } : {}),
+        ...(typeof e.event_ts === "string" ? { eventTs: e.event_ts } : {}),
+    };
+}
+/** A 1:1 DM channel id. Only there does the stop fall back to the channel's newest turn. */
+function isDmChannel(channelId) {
+    return channelId.startsWith("D");
+}
+/**
+ * Stop the turn a Stop press names, then set the session `active`.
+ *
+ * The turn is found by the session's thread first (the key the ✋ arm uses for a thread root). In the
+ * person's 1:1 DM it falls back to the DM's newest turn, because a top-level DM message keys its turn by
+ * the channel alone. In a shared channel it does not fall back: there the newest turn can belong to
+ * another thread, and cancelling nothing beats cancelling a guess. The status is set whatever the
+ * cancel answers, because a session left `processing` keeps its spinner for an hour. Never throws.
+ */
+export async function routeAgentSessionStop(ev, deps) {
+    const p = resolvePartition(bindableForSlackIds({ teamId: ev.teamId, channelId: ev.channelId, userId: ev.userId }));
+    const anchorKey = turnAnchorKey("slack", ev.channelId, ev.threadTs);
+    const channelKey = isDmChannel(ev.channelId) ? turnChannelKey("slack", ev.channelId) : undefined;
+    let result;
+    try {
+        result = await (deps.cancel ?? cancelAnchoredTurn)({
+            org: p.org,
+            platform: "slack",
+            workspace: p.workspace,
+            requestedBy: ev.userId,
+            via: "stop-button",
+            query: { ...(anchorKey ? { anchorKey } : {}), ...(channelKey ? { channelKey } : {}) },
+            attachSession: deps.attachSession,
+        });
+    }
+    catch (err) {
+        result = { outcome: "error", message: `stop failed: ${String(err)}` };
+    }
+    await (deps.setStatus ?? setSlackSessionStatus)({ channelId: ev.channelId, threadTs: ev.threadTs, status: "active" }).catch(() => false);
+    return result;
+}
+//# sourceMappingURL=slack-agent-session.js.map

package/dist/agent/channels/slack-agent-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-agent-session.js","sourceRoot":"","sources":["../../../agent/channels/slack-agent-session.ts"],"names":[],"mappings":"AAAA,0GAA0G;AAC1G,EAAE;AACF,kGAAkG;AAClG,sGAAsG;AACtG,yGAAyG;AACzG,0BAA0B;AAC1B,EAAE;AACF,gGAAgG;AAChG,qGAAqG;AACrG,sGAAsG;AACtG,mGAAmG;AACnG,qGAAqG;AACrG,8FAA8F;AAC9F,qGAAqG;AACrG,gGAAgG;AAChG,uGAAuG;AACvG,8CAA8C;AAC9C,uGAAuG;AACvG,2FAA2F;AAC3F,iGAAiG;AACjG,gGAAgG;AAChG,mGAAmG;AACnG,4FAA4F;AAC5F,sGAAsG;AACtG,0FAA0F;AAC1F,wGAAwG;AACxG,sGAAsG;AACtG,iGAAiG;AACjG,iGAAiG;AACjG,iFAAiF;AACjF,EAAE;AACF,qGAAqG;AACrG,sGAAsG;AACtG,qGAAqG;AACrG,wFAAwF;AACxF,EAAE;AACF,qGAAqG;AACrG,sCAAsC;AAEtC,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,eAAe,EACf,aAAa,EACb,aAAa,EACb,cAAc,GAKf,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAA2B,MAAM,mBAAmB,CAAC;AAE5F,8DAA8D;AAC9D,MAAM,CAAC,MAAM,2BAA2B,GAAG,uBAAuB,CAAC;AAEnE,+FAA+F;AAC/F,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAK1C,8GAA8G;AAC9G,MAAM,0BAA0B,GAAG,kBAAkB,CAAC;AAEtD;;;;GAIG;AACH,MAAM,qBAAqB,GAAG,gBAAgB,CAAC;AAK/C,qGAAqG;AAErG,iDAAiD;AACjD,SAAS,mBAAmB,CAAC,IAAY;IACvC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AACjF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAwB;IACxD,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI;QACnB,sDAAsD;SACrD,OAAO,CAAC,2BAA2B,EAAE,GAAG,CAAC;QAC1C,iEAAiE;SAChE,OAAO,CAAC,wBAAwB,EAAE,KAAK,CAAC;SACxC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;QAC9B,0EAA0E;SACzE,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC;QAC1B,uCAAuC;SACtC,OAAO,CAAC,oBAAoB,EAAE,IAAI,CAAC;SACnC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,mBAAmB,CAAC,QAAQ,CAAC;SACvC,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;SAChE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,IAAI,CAAC,MAAM,IAAI,uBAAuB;QAAE,OAAO,IAAI,CAAC;IACxD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAuB,GAAG,CAAC,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,GAAG,CAAC,GAAG,IAAI,uBAAuB,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC;AAC1F,CAAC;AAcD,6DAA6D;AAC7D,MAAM,UAAU,sBAAsB,CAAC,IAA4B;IACjE,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAChH,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACrF,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;AACzB,CAAC;AAED,yGAAyG;AACzG,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAA4B,EAAE,IAAI,GAAkB,SAAS;IACvG,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;QAClF,IAAI,GAAG,EAAE,EAAE,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,6DAA6D,IAAI,CAAC,MAAM,qBAAqB,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,MAAM,MAAM,CAAC,GAAG,EAAE,KAAK,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;QACpL,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,6DAA6D,IAAI,CAAC,MAAM,YAAY,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrJ,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAA6C;IAC/E,IAAI,UAAU,CAAC,YAAY,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACvD,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC;IACxC,MAAM,OAAO,GAAG,UAAU,CAAC,0BAA0B,CAAC,CAAC;IACvD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACrI,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAyB,CAAC,UAAU,EAAE,EAAE;IACzE,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO;QACL,EAAE,EAAE,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE;QAC9C,UAAU,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,0BAA0B,CAAC,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,qBAAqB,CAAC,EAAE,GAAG,EAAE;KAChJ,CAAC;AACJ,CAAC,CAAC;AAEF,uGAAuG;AACvG,EAAE;AACF,uGAAuG;AACvG,iGAAiG;AACjG,kGAAkG;AAClG,oGAAoG;AACpG,iGAAiG;AACjG,mGAAmG;AACnG,6FAA6F;AAC7F,6FAA6F;AAC7F,gGAAgG;AAChG,oGAAoG;AACpG,mGAAmG;AACnG,0DAA0D;AAC1D,qGAAqG;AACrG,6EAA6E;AAE7E,+GAA+G;AAC/G,MAAM,CAAC,MAAM,uBAAuB,GAAG,YAAY,CAAC;AAEpD,4FAA4F;AAC5F,MAAM,gBAAgB,GAAG,eAAe,CAAC,OAAO,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,cAAc,GAAqC;IACvD,eAAe,EAAE,4CAA4C;IAC7D,kBAAkB,EAAE,4CAA4C;IAChE,6BAA6B,EAAE,iGAAiG;CACjI,CAAC;AACF,sGAAsG;AACtG,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC,CAAC;AACnI,2EAA2E;AAC3E,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,aAAa,CAAC,CAAC,CAAC;AACtE,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;AAE3C,sGAAsG;AACtG,KAAK,UAAU,QAAQ,CAAC,IAAmB,EAAE,MAAc,EAAE,IAAqB;IAChF,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChD,IAAI,GAAG,EAAE,EAAE,KAAK,IAAI;YAAE,OAAO;QAC7B,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,KAAK,IAAI,WAAW,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO;IACzC,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC;IACjC,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO;IACtC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1B,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC;QACtC,CAAC,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,kCAAkC,+FAA+F;QAChK,CAAC,CAAC,8CAA8C,CAAC;IACnD,OAAO,CAAC,IAAI,CAAC,mCAAmC,MAAM,YAAY,KAAK,OAAO,GAAG,4BAA4B,CAAC,CAAC;AACjH,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,yBAAyB;IACvC,gBAAgB,CAAC,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,sBAAsB,CAAC,OAAkE,EAAE,OAAgB,EAAE,IAAI,GAAkB,SAAS;IACzJ,IAAI,aAAa,CAAC,2BAA2B,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAAE,OAAO;IACnF,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1H,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnJ,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,kBAAkB,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,IAAI,EAAE,6BAA6B,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACvJ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,yBAAyB,CAAC,IAAI,GAAkB,SAAS;IACvE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE;QAClC,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,MAAM,QAAQ,GAAG,UAAU,CAAC,qBAAqB,CAAC,KAAK,SAAS,CAAC;QACjE,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,qBAAqB,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,OAAO,EAAE,MAAM,KAAK,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAChK,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;IACpD,CAAC,CAAC;AACJ,CAAC;AAgBD,kFAAkF;AAClF,MAAM,UAAU,wBAAwB,CAAC,QAA4B;IACnE,IAAI,QAAQ,EAAE,IAAI,KAAK,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,CAAC,GAAG,QAAQ,CAAC,KAA4C,CAAC;IAChE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,2BAA2B;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,SAAS,GAAG,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IACjE,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACpD,MAAM,MAAM,GAAG,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAClH,OAAO;QACL,SAAS;QACT,QAAQ;QACR,MAAM;QACN,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnE,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,SAAS,WAAW,CAAC,SAAiB;IACpC,OAAO,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AACnC,CAAC;AAYD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAAqB,EAAE,IAAqB;IACtF,MAAM,CAAC,GAAG,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACnH,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjG,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,IAAI,kBAAkB,CAAC,CAAC;YACjD,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,QAAQ,EAAE,OAAO;YACjB,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,WAAW,EAAE,EAAE,CAAC,MAAM;YACtB,GAAG,EAAE,aAAa;YAClB,KAAK,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YACrF,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;IACxE,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,qBAAqB,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;IACzI,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/agent/channels/slack-attachments.d.ts

@@ -1,3 +1,4 @@
+import { type BindableContext } from "@open-everywhere/core/agent/adapter-api.js";
 /** A resolved attachment record — its `urlPrivate` came from a Slack event's `files[].url_private`
  *  (trusted provenance), never a model-supplied string. */
 export interface SlackAttachmentRecord {
@@ -48,6 +49,16 @@ export declare function persistSlackAttachment(fileId: string | undefined, rec:
  * defaults to the deployment org (single-tenant) when omitted.
  */
 export declare function resolveSlackAttachmentDurable(fileId: string, org?: string): Promise<SlackAttachmentRecord | undefined>;
+/**
+ * The size-guarded byte pull over a TRUSTED `url_private`: the bot-token, host-pinned fetch, then the Content-Length
+ * pre-check (rejects with {@link AttachmentOversizeError} phase "declared" BEFORE the body is read), then the post-read
+ * cap (phase "actual"). Two callers: the guarded resolver below, and the voice-clip loader (slack-voice-clips.ts),
+ * which reads a clip off the event that woke the agent. Both pass an event-supplied URL, never a model string.
+ */
+export declare function pullSlackAttachmentBytes(ctx: BindableContext, ref: {
+    readonly urlPrivate: string;
+    readonly id?: string;
+}, maxBytes: number): Promise<Uint8Array>;
 /**
  * Register Slack as an attachment-plane resolver (channels/attachments.ts) — the neutral seam
  * describe_image consults so its contract carries no per-platform union arm. The resolver wraps the

package/dist/agent/channels/slack-attachments.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"slack-attachments.d.ts","sourceRoot":"","sources":["../../../agent/channels/slack-attachments.ts"],"names":[],"mappings":"AAsCA;2DAC2D;AAC3D,MAAM,WAAW,qBAAqB;IACpC,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;gFAC4E;IAC5E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;wEACoE;IACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,oFAAoF;IACpF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;2GACuG;IACvG,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAUD;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,qBAAqB,GAAG,IAAI,CASpG;AAED;;oFAEoF;AACpF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAExF;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,qBAAqB,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAahI;AAED;;;;;GAKG;AACH,wBAAsB,6BAA6B,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAY5H;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,+BAA+B,IAAI,IAAI,CAoCtD;AAMD,2EAA2E;AAC3E,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD"}
+{"version":3,"file":"slack-attachments.d.ts","sourceRoot":"","sources":["../../../agent/channels/slack-attachments.ts"],"names":[],"mappings":"AA4BA,OAAO,EAOL,KAAK,eAAe,EACrB,MAAM,4CAA4C,CAAC;AAGpD;2DAC2D;AAC3D,MAAM,WAAW,qBAAqB;IACpC,uEAAuE;IACvE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;gFAC4E;IAC5E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;wEACoE;IACpE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,oFAAoF;IACpF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;2GACuG;IACvG,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAUD;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,qBAAqB,GAAG,IAAI,CASpG;AAED;;oFAEoF;AACpF,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,qBAAqB,GAAG,SAAS,CAExF;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,qBAAqB,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAahI;AAED;;;;;GAKG;AACH,wBAAsB,6BAA6B,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAY5H;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;CAAE,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAUtK;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,+BAA+B,IAAI,IAAI,CA0BtD;AAMD,2EAA2E;AAC3E,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD"}

package/dist/agent/channels/slack-attachments.js

@@ -109,6 +109,26 @@ export async function resolveSlackAttachmentDurable(fileId, org) {
         return undefined;
     }
 }
+/**
+ * The size-guarded byte pull over a TRUSTED `url_private`: the bot-token, host-pinned fetch, then the Content-Length
+ * pre-check (rejects with {@link AttachmentOversizeError} phase "declared" BEFORE the body is read), then the post-read
+ * cap (phase "actual"). Two callers: the guarded resolver below, and the voice-clip loader (slack-voice-clips.ts),
+ * which reads a clip off the event that woke the agent. Both pass an event-supplied URL, never a model string.
+ */
+export async function pullSlackAttachmentBytes(ctx, ref, maxBytes) {
+    const res = await fetchSlackAttachment(ctx, ref);
+    if (!res.ok)
+        throw new Error(`fetching the upload failed (HTTP ${res.status})`);
+    // Content-Length pre-check off the declared length — reject before reading the body.
+    const declared = Number.parseInt(res.headers.get("content-length") ?? "", 10);
+    if (Number.isFinite(declared) && declared > maxBytes)
+        throw new AttachmentOversizeError(declared, "declared", maxBytes);
+    const bytes = new Uint8Array(await res.arrayBuffer());
+    // Post-read cap — a chunked response can exceed the (possibly-absent) Content-Length.
+    if (bytes.byteLength > maxBytes)
+        throw new AttachmentOversizeError(bytes.byteLength, "actual", maxBytes);
+    return bytes;
+}
 /**
  * Register Slack as an attachment-plane resolver (channels/attachments.ts) — the neutral seam
  * describe_image consults so its contract carries no per-platform union arm. The resolver wraps the
@@ -146,20 +166,7 @@ export function registerSlackAttachmentResolver() {
                 ref: `slack-file:${attachmentId}`,
                 mimeType: rec.mimeType,
                 name: rec.name,
-                async pull({ maxBytes }) {
-                    const res = await fetchSlackAttachment(ctx, { urlPrivate: rec.urlPrivate, id: attachmentId });
-                    if (!res.ok)
-                        throw new Error(`fetching the upload failed (HTTP ${res.status})`);
-                    // Content-Length pre-check off the declared length — reject before reading the body.
-                    const declared = Number.parseInt(res.headers.get("content-length") ?? "", 10);
-                    if (Number.isFinite(declared) && declared > maxBytes)
-                        throw new AttachmentOversizeError(declared, "declared", maxBytes);
-                    const bytes = new Uint8Array(await res.arrayBuffer());
-                    // Post-read cap — a chunked response can exceed the (possibly-absent) Content-Length.
-                    if (bytes.byteLength > maxBytes)
-                        throw new AttachmentOversizeError(bytes.byteLength, "actual", maxBytes);
-                    return bytes;
-                },
+                pull: ({ maxBytes }) => pullSlackAttachmentBytes(ctx, { urlPrivate: rec.urlPrivate, id: attachmentId }, maxBytes),
             };
         },
     });

package/dist/agent/channels/slack-attachments.js.map

@@ -1 +1 @@
-{"version":3,"file":"slack-attachments.js","sourceRoot":"","sources":["../../../agent/channels/slack-attachments.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,uDAAuD;AACvD,EAAE;AACF,+FAA+F;AAC/F,gGAAgG;AAChG,iGAAiG;AACjG,iGAAiG;AACjG,gGAAgG;AAChG,iGAAiG;AACjG,kGAAkG;AAClG,mGAAmG;AACnG,gGAAgG;AAChG,EAAE;AACF,kGAAkG;AAClG,gGAAgG;AAChG,+FAA+F;AAC/F,sFAAsF;AACtF,EAAE;AACF,gGAAgG;AAChG,qGAAqG;AACrG,iGAAiG;AACjG,iGAAiG;AACjG,kGAAkG;AAClG,qGAAqG;AACrG,gGAAgG;AAChG,mGAAmG;AACnG,4FAA4F;AAE5F,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,0BAA0B,EAC1B,uBAAuB,GAExB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAoB3E;;kDAEkD;AAClD,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpD,MAAM,WAAW,GAAG,IAAI,CAAC;AACzB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAiC,CAAC;AAE1D;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAA0B,EAAE,GAA0B;IAC5F,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU;QAAE,OAAO;IACvC,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,oCAAoC;IACvF,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,4CAA4C;IACjG,OAAO,QAAQ,CAAC,IAAI,GAAG,WAAW,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QAC5C,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM;QAChC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;oFAEoF;AACpF,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,OAAO,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,MAA0B,EAAE,GAA0B,EAAE,GAAY;IAC/G,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU;QAAE,OAAO;IACvC,MAAM,GAAG,GAAuB;QAC9B,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC;IACF,IAAI,CAAC;QACH,MAAM,mBAAmB,EAAE,CAAC,kBAAkB,CAAC,GAAG,IAAI,aAAa,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,uBAAuB,CAAC,CAAC;IACzI,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,6EAA6E,MAAM,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,MAAc,EAAE,GAAY;IAC9E,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,mBAAmB,EAAE,CAAC,kBAAkB,CAAC,GAAG,IAAI,aAAa,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3F,2FAA2F;QAC3F,oEAAoE;QACpE,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,sEAAsE,MAAM,aAAa,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrH,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,+BAA+B;IAC7C,0BAA0B,CAAC;QACzB,QAAQ,EAAE,OAAO;QACjB,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG;YAC7B,MAAM,GAAG,GAAG,MAAM,6BAA6B,CAAC,YAAY,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;YACzF,IAAI,CAAC,GAAG;gBAAE,OAAO,SAAS,CAAC,CAAC,oDAAoD;YAChF,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;YAC9F,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,YAAY,kBAAkB,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;YACxG,OAAO,EAAE,KAAK,EAAE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,GAAG,EAAE,cAAc,YAAY,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;QACvH,CAAC;QACD,+FAA+F;QAC/F,+FAA+F;QAC/F,yFAAyF;QACzF,6FAA6F;QAC7F,8FAA8F;QAC9F,KAAK,CAAC,cAAc,CAAC,YAAY,EAAE,GAAG;YACpC,MAAM,GAAG,GAAG,MAAM,6BAA6B,CAAC,YAAY,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;YACzF,IAAI,CAAC,GAAG;gBAAE,OAAO,SAAS,CAAC,CAAC,oDAAoD;YAChF,OAAO;gBACL,GAAG,EAAE,cAAc,YAAY,EAAE;gBACjC,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE;oBACrB,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;oBAC9F,IAAI,CAAC,GAAG,CAAC,EAAE;wBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;oBAChF,qFAAqF;oBACrF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;oBAC9E,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,QAAQ;wBAAE,MAAM,IAAI,uBAAuB,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;oBACxH,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;oBACtD,sFAAsF;oBACtF,IAAI,KAAK,CAAC,UAAU,GAAG,QAAQ;wBAAE,MAAM,IAAI,uBAAuB,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;oBACzG,OAAO,KAAK,CAAC;gBACf,CAAC;aACF,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,mGAAmG;AACnG,mGAAmG;AACnG,iGAAiG;AAEjG,2EAA2E;AAC3E,MAAM,UAAU,6BAA6B;IAC3C,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC"}
+{"version":3,"file":"slack-attachments.js","sourceRoot":"","sources":["../../../agent/channels/slack-attachments.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,uDAAuD;AACvD,EAAE;AACF,+FAA+F;AAC/F,gGAAgG;AAChG,iGAAiG;AACjG,iGAAiG;AACjG,gGAAgG;AAChG,iGAAiG;AACjG,kGAAkG;AAClG,mGAAmG;AACnG,gGAAgG;AAChG,EAAE;AACF,kGAAkG;AAClG,gGAAgG;AAChG,+FAA+F;AAC/F,sFAAsF;AACtF,EAAE;AACF,gGAAgG;AAChG,qGAAqG;AACrG,iGAAiG;AACjG,iGAAiG;AACjG,kGAAkG;AAClG,qGAAqG;AACrG,gGAAgG;AAChG,mGAAmG;AACnG,4FAA4F;AAE5F,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,0BAA0B,EAC1B,uBAAuB,GAGxB,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAoB3E;;kDAEkD;AAClD,MAAM,uBAAuB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEpD,MAAM,WAAW,GAAG,IAAI,CAAC;AACzB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAiC,CAAC;AAE1D;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAA0B,EAAE,GAA0B;IAC5F,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU;QAAE,OAAO;IACvC,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,oCAAoC;IACvF,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,4CAA4C;IACjG,OAAO,QAAQ,CAAC,IAAI,GAAG,WAAW,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QAC5C,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM;QAChC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED;;oFAEoF;AACpF,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,OAAO,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,MAA0B,EAAE,GAA0B,EAAE,GAAY;IAC/G,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU;QAAE,OAAO;IACvC,MAAM,GAAG,GAAuB;QAC9B,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC;IACF,IAAI,CAAC;QACH,MAAM,mBAAmB,EAAE,CAAC,kBAAkB,CAAC,GAAG,IAAI,aAAa,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,uBAAuB,CAAC,CAAC;IACzI,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,6EAA6E,MAAM,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvH,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,MAAc,EAAE,GAAY;IAC9E,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,mBAAmB,EAAE,CAAC,kBAAkB,CAAC,GAAG,IAAI,aAAa,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3F,2FAA2F;QAC3F,oEAAoE;QACpE,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACzD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,sEAAsE,MAAM,aAAa,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrH,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,GAAoB,EAAE,GAA0D,EAAE,QAAgB;IAC/I,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAChF,qFAAqF;IACrF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9E,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,QAAQ;QAAE,MAAM,IAAI,uBAAuB,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IACxH,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;IACtD,sFAAsF;IACtF,IAAI,KAAK,CAAC,UAAU,GAAG,QAAQ;QAAE,MAAM,IAAI,uBAAuB,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACzG,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,+BAA+B;IAC7C,0BAA0B,CAAC;QACzB,QAAQ,EAAE,OAAO;QACjB,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG;YAC7B,MAAM,GAAG,GAAG,MAAM,6BAA6B,CAAC,YAAY,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;YACzF,IAAI,CAAC,GAAG;gBAAE,OAAO,SAAS,CAAC,CAAC,oDAAoD;YAChF,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;YAC9F,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,YAAY,kBAAkB,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;YACxG,OAAO,EAAE,KAAK,EAAE,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,GAAG,EAAE,cAAc,YAAY,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;QACvH,CAAC;QACD,+FAA+F;QAC/F,+FAA+F;QAC/F,yFAAyF;QACzF,6FAA6F;QAC7F,8FAA8F;QAC9F,KAAK,CAAC,cAAc,CAAC,YAAY,EAAE,GAAG;YACpC,MAAM,GAAG,GAAG,MAAM,6BAA6B,CAAC,YAAY,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;YACzF,IAAI,CAAC,GAAG;gBAAE,OAAO,SAAS,CAAC,CAAC,oDAAoD;YAChF,OAAO;gBACL,GAAG,EAAE,cAAc,YAAY,EAAE;gBACjC,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,wBAAwB,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,QAAQ,CAAC;aAClH,CAAC;QACJ,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,mGAAmG;AACnG,mGAAmG;AACnG,iGAAiG;AAEjG,2EAA2E;AAC3E,MAAM,UAAU,6BAA6B;IAC3C,QAAQ,CAAC,KAAK,EAAE,CAAC;AACnB,CAAC"}

package/dist/agent/channels/slack-commands.d.ts

@@ -1,6 +1,21 @@
-import { type BindableContext } from "@open-everywhere/core/agent/adapter-api.js";
+import { type BindableContext, type SurfaceBinding } from "@open-everywhere/core/agent/adapter-api.js";
 /** The public URL Slack POSTs the "/oe" slash command to (the app's Slash Command Request URL). */
 export declare const SLACK_COMMANDS_ROUTE = "/eve/v1/slack/commands";
+/** What the route learned about a command's trust before it binds. `dmPartnerTrust` is the invoker's own
+ *  verdict in a 1:1 DM. `room` is a channel's `conversations.info` verdict, present whenever Slack answered
+ *  it, whoever typed the command. `invokerMember` is present only when `users.info` CONFIRMED the invoker a
+ *  member (see {@link slashRoomVerdict}). The person's binding stamps `room` only beside `invokerMember`;
+ *  the room's binding stamps it alone (OPE-2588). */
+export interface SlashTrustFacts {
+    readonly dmPartnerTrust?: "internal" | "external";
+    readonly room?: {
+        readonly extShared: boolean;
+    };
+    readonly invokerMember?: true;
+}
+/** Which verdict a slash binding resolves: the PERSON's (the room's verdict folded with the invoker
+ *  check, which every member gate reads) or the ROOM's alone (which the room's budget reads). */
+export type SlashTrustLeg = "person" | "room";
 /** Build the BindableContext the identity seam (bindFrom/bindSlack) expects from Slack's
  *  slash-command form fields. Slack's slash-command payload carries no `channel_type` /
  *  `is_private` bit (unlike an app_mention/message event) — `bindSlack`'s existing fallbacks
@@ -13,15 +28,103 @@ export declare const SLACK_COMMANDS_ROUTE = "/eve/v1/slack/commands";
  *  reads — so a Grid declared once now answers here the same way it answers at every other door,
  *  instead of resolving as though the line were absent.
  *
- *  🔴 STATE ITS REACH EXACTLY, because this door is narrower than the wake doors. For a CHANNEL
- *  command it does NOT change `binding.trust`: this payload carries no `conversations.info` verdict,
- *  so `slackTrust(undefined, undefined, "channel")` fails closed to `external`, and `bindFrom` takes
- *  that raw verdict ahead of any vouch. So a channel `/oe` stays `trust: "external"` with the rung
- *  and without it, and the budget scope `domainNameForScope` picks is unchanged. The rung reaches
- *  `binding.trust` only on a DM-shaped `/oe` (a `D…` channel id), where the mapper leaves trust
- *  undefined and the vouch is what answers. Spread conditionally, like every other door: a
- *  single-workspace install stamps nothing. */
-export declare function bindableForSlashCommand(params: URLSearchParams): BindableContext;
+ *  🔴 STATE ITS REACH EXACTLY. For a CHANNEL command the rung does NOT change `binding.trust`: the
+ *  room's own verdict answers there (see below), and `bindFrom` takes that raw verdict ahead of any
+ *  vouch. The rung reaches `binding.trust` only on a DM-shaped `/oe` (a `D…` channel id), and only
+ *  when the invoker probe gave no verdict: the mapper then leaves trust undefined and the vouch
+ *  answers (see below). Spread conditionally, like every other door: a single-workspace install
+ *  stamps nothing.
+ *
+ *  🔴 A CHANNEL COMMAND CARRIES THE ROOM'S OWN VERDICT (OPE-2579). Slack's slash payload carries no
+ *  sharing bit, so before this every channel `/oe` bound `slackTrust(undefined, undefined,
+ *  "channel")`, which fails closed to `external`. A member in an internal channel was then refused
+ *  `/oe suggest on` as an outsider. The route now passes {@link slashRoomVerdict}'s answer as
+ *  `is_ext_shared` + `trust_checked`, the two attributes a channel message stamps from the same
+ *  TTL-cached `conversations.info`. So a channel command reads the room's `internal` or `external` as a
+ *  message in that room does. On the `person` leg (the default) the verdict is stamped only for an
+ *  invoker `users.info` confirms a member. On the `room` leg it is stamped for anybody, because that
+ *  leg answers the room's budget, not a member gate (OPE-2588, {@link bindSlashCommand}). No verdict
+ *  stamps nothing, and the command stays fail-closed `external`.
+ *
+ *  🔴 A DM COMMAND CARRIES THE INVOKER'S OWN VERDICT (OPE-2579). In a 1:1 DM the invoker IS the
+ *  partner, and the route passes {@link slashInvokerDmTrust}'s answer as `dm_partner_trust`, the
+ *  attribute the chat DM leg stamps from the same `users.info` probe. Before this, a workspace vouch
+ *  alone answered a DM command, so a guest or a Connect stranger in their DM with the app read
+ *  `internal` here while the same person read `external` in a DM turn. A verdict outranks the vouch
+ *  in both directions, exactly as in a DM turn: a guest reads `external` under a workspace vouch, and
+ *  a confirmed member reads `internal` with no declaration at all. No verdict leaves the attribute
+ *  unset and the binding resolves as before. This reaches every `/oe` command typed in a DM, not
+ *  only `watch`. */
+export declare function bindableForSlashCommand(params: URLSearchParams, invoker?: SlashTrustFacts, leg?: SlashTrustLeg): BindableContext;
+/**
+ * The invoker's own membership verdict for a 1:1 DM command, in `dm_partner_trust`'s vocabulary, or
+ * `{}` when there is none to give (OPE-2579). It is the chat DM leg's reading of the same probe
+ * (slack-front.ts `liveDmPartnerTrust`): `slackAuthorIsMember` decides, so the two doors cannot
+ * drift on what a guest is. A channel or group DM asks nothing here: there the ROOM's verdict is the
+ * binding's trust, and {@link slashRoomVerdict} reads it.
+ *
+ * 🔴 NO VERDICT IS NOT A VERDICT. No user id, no bot token, a refused `users.info`, a transport
+ * failure or a probe slower than {@link INVOKER_PROBE_MS} all answer `{}`, which leaves the binding
+ * exactly as it resolved before this probe existed. An unanswered probe never invents a guest, and
+ * never invents a member.
+ */
+export declare function slashInvokerDmTrust(params: URLSearchParams, probe?: (userId: string, teamId: string | undefined) => Promise<boolean | undefined>): Promise<{
+    readonly dmPartnerTrust?: "internal" | "external";
+}>;
+/** The room facts {@link slashRoomVerdict} reads: `slackChannelFactsFor`'s shape, which every channel wake reads. */
+export type SlashRoomFacts = (channelId: string) => Promise<{
+    readonly channelType?: string;
+    readonly extShared?: boolean;
+    readonly trustChecked?: boolean;
+}>;
+/**
+ * A CHANNEL command's room verdict and invoker check, or `{}` when there is no room verdict to give
+ * (OPE-2579). The room read is `slackChannelFactsFor`, the TTL-cached `conversations.info` every
+ * channel wake reads, so the command door and the message door cannot disagree about one room.
+ *
+ * 🔴 THE INVOKER LEG, AND IT FAILS CLOSED. A channel message keeps the room's verdict on the auth and marks
+ * a guest author on the side (slack-events.ts `slackWakeAuthorFacts`), because one guest's message must not
+ * demote the channel's memory for everybody. A command has no session to protect: its binding exists for
+ * one answer, and `/oe suggest on` and `/oe watch more|less` read `binding.trust` as "is this person a
+ * member". So the route folds the author leg into the binding's `trust`, the composition Discord and
+ * Teams make: `invokerMember` is set only when `users.info` CONFIRMS the invoker a member, and the
+ * person's binding stamps the room's verdict only beside it. A guest, a Slack Connect stranger, and a
+ * person the probe could not check (no `users:read`, a refusal, a timeout) all leave `trust` fail-closed
+ * `external`. The message door fails OPEN on an unanswered probe because it marks a turn. Here `trust`
+ * IS the member gate, and a channel has no declaration to fall back to the way a DM command does.
+ *
+ * 🔴 THE ROOM'S VERDICT IS RETURNED FOR EVERY INVOKER (OPE-2588). `/oe budget` names the room's budget,
+ * and a channel's turns are charged under the room's domain, whoever typed them. So {@link bindSlashCommand}
+ * binds the room's verdict alone into `roomTrust`, and the budget reads that. A guest's `trust` is
+ * unchanged, and `/oe budget` reads both to refuse a guest in an internal channel (commands/core.ts
+ * `budgetWithheldFrom`). `/oe cover on` refuses outside a DM before it reads trust.
+ *
+ * 🔴 ONLY A ROOM IN THE CHANNEL MODE IS STAMPED. A 1:1 DM has its own leg ({@link slashInvokerDmTrust}).
+ * A group DM, or a room whose type Slack did not report, stamps nothing, so its binding is unchanged.
+ * Stamping a sharing verdict on a group DM the binding still calls a channel would mix two modes' rules.
+ *
+ * 🔴 NO VERDICT IS NOT A VERDICT. A failed or refused `conversations.info`, a response without the check,
+ * or a read slower than {@link INVOKER_PROBE_MS} answers `{}`. The command then binds `external`, as
+ * before this read existed. The room read and the invoker probe run in parallel inside one ack budget.
+ */
+export declare function slashRoomVerdict(params: URLSearchParams, roomFacts?: SlashRoomFacts, probe?: (userId: string, teamId: string | undefined) => Promise<boolean | undefined>): Promise<SlashTrustFacts>;
+/** Both legs, for whichever kind of room the command came from. Never throws. */
+export declare function slashTrustFacts(params: URLSearchParams): Promise<SlashTrustFacts>;
+/**
+ * The slash command's binding, with the room's trust and the person's trust kept apart (OPE-2588).
+ *
+ * `trust` is the PERSON leg: the member gate `/oe suggest on`, `/oe watch more|less` and `/oe cover on`
+ * read. `roomTrust` is the ROOM leg: the same `bindFrom` walk over the room's verdict alone, so the
+ * declarations and the fail-closed default apply to it unchanged. `/oe budget` and the caps behind
+ * `raise` and `clear` read it through `roomTrustOf`. Before this the binding carried one value, so a
+ * guest in an internal channel read the external domain's budget while that channel's turns were
+ * charged under the internal domain. Now `/oe budget` refuses that guest, because a guest must not read
+ * an internal room's caps and spend (Tommy's ruling on #1431).
+ *
+ * In a DM both legs bind the same context, so the two values are equal. Every other field comes from
+ * the person's binding. The two bindings differ only in the two trust attributes, which move no key.
+ */
+export declare function bindSlashCommand(params: URLSearchParams, facts: SlashTrustFacts): SurfaceBinding;
 declare const _default: import("eve/channels").Channel<undefined, Record<string, unknown>, Record<string, unknown>>;
 export default _default;
 //# sourceMappingURL=slack-commands.d.ts.map

package/dist/agent/channels/slack-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"slack-commands.d.ts","sourceRoot":"","sources":["../../../agent/channels/slack-commands.ts"],"names":[],"mappings":"AAqCA,OAAO,EAWL,KAAK,eAAe,EACrB,MAAM,4CAA4C,CAAC;AAOpD,mGAAmG;AACnG,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAS7D;;;;;;;;;;;;;;;;;;;+CAmB+C;AAC/C,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,eAAe,GAAG,eAAe,CAkBhF"}
+{"version":3,"file":"slack-commands.d.ts","sourceRoot":"","sources":["../../../agent/channels/slack-commands.ts"],"names":[],"mappings":"AAqCA,OAAO,EAYL,KAAK,eAAe,EACpB,KAAK,cAAc,EACpB,MAAM,4CAA4C,CAAC;AASpD,mGAAmG;AACnG,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAS7D;;;;qDAIqD;AACrD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,GAAG,UAAU,CAAC;IAClD,QAAQ,CAAC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;IAChD,QAAQ,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC;CAC/B;AAED;iGACiG;AACjG,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,MAAM,CAAC;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAsCoB;AACpB,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,eAAe,EAAE,GAAG,GAAE,aAAwB,GAAG,eAAe,CAqB1I;AAMD;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,eAAe,EACvB,KAAK,GAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,OAAO,GAAG,SAAS,CAAuB,GACxG,OAAO,CAAC;IAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,UAAU,GAAG,UAAU,CAAA;CAAE,CAAC,CAKhE;AAED,qHAAqH;AACrH,MAAM,MAAM,cAAc,GAAG,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC;AAE9J;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,eAAe,EACvB,SAAS,GAAE,cAAqC,EAChD,KAAK,GAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,KAAK,OAAO,CAAC,OAAO,GAAG,SAAS,CAAuB,GACxG,OAAO,CAAC,eAAe,CAAC,CAW1B;AAED,iFAAiF;AACjF,wBAAsB,eAAe,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAEvF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,eAAe,GAAG,cAAc,CAIhG"}