@open-everywhere/provider-slack 0.8.1 → 0.9.0

package/agent/setup/credentials.ts

@@ -1,32 +1,30 @@
 // WHERE THE SLACK BUNDLE'S TWO SECRETS COME FROM (OPE-2231) — the signing secret that verifies
 // Slack's requests, and the bot token that signs ours.
 //
-// Before this module there was one answer: `process.env.SLACK_SIGNING_SECRET` and
-// `process.env.SLACK_BOT_TOKEN`, read inline at each call site. A `/setup` run now captures both
-// into the credential store, so there are two homes and an order is needed.
+// Before this module there was one answer: the SLACK_SIGNING_SECRET and SLACK_BOT_TOKEN env vars,
+// read inline at each call site. A `/setup` run now captures both into the credential store, so there
+// are two homes and an order is needed.
 //
-// 🔴 THE ORDER IS ENV-FIRST, AND IT IS THE OPPOSITE OF `getOperatorSecret`'s. Core's operator-secret
-// resolver puts the db store first and treats env as a fallback on its way out (OPE-408: "db-over-env
-// is the DEFAULT home for secrets"). This module inverts that, deliberately, on the OPE-2231 ruling
-// ("env as fallback (env wins if set, for existing installs)"). The reason is the migration, not a
-// disagreement about where secrets belong:
+// THE OPERATOR SECRET COMES FIRST (OPE-2650). The first home is the operator secret of the same name
+// — `oe secret set SLACK_BOT_TOKEN`, read through core's `operatorSecret`, which takes the db store
+// first and the env var as its warned on-ramp. The second home is the value `/setup` stored under the
+// `slack-app:` refs. Before OPE-2650 the first home was the env var alone (the OPE-2231 ruling: "env
+// as fallback (env wins if set, for existing installs)"). The reason for that order holds unchanged:
 //
 //   • EVERY deployment that exists today holds these two in env and works. This change must not be
-//     able to alter which Slack app a working deployment speaks as. Store-first could: a `/setup` run
-//     somebody started and abandoned, or a second workspace's install, would silently take over a
-//     live deployment's Slack identity at the next cold start, with a 401 loop as the symptom and
+//     able to alter which Slack app a working deployment speaks as. `/setup`-first could: a `/setup`
+//     run somebody started and abandoned, or a second workspace's install, would silently take over
+//     a live deployment's Slack identity at the next cold start, with a 401 loop as the symptom and
 //     nothing in the logs saying a different secret had been picked.
-//   • Env-first cannot do that. A deployment with the env vars set resolves to exactly the value it
-//     resolved to before this commit, every time. It reads the store AT MOST ONCE PER NAME PER
-//     PROCESS — only to decide whether to warn that the env var is shadowing something — and never
-//     again, so the per-request hot path for an existing install costs the same property read it
-//     always did.
-//   • A fresh hosted install sets neither env var (the deploy button asks for one value, the
-//     credential encryption key), so it reads the store, which is where `/setup` put them.
+//   • Operator-secret-first cannot do that. A deployment with the env vars set and no stored operator
+//     secret resolves to exactly the value it resolved to before, every time. An operator who stores
+//     the value with `oe secret set` chose it on purpose, so it wins the same way the env var did.
+//   • A fresh hosted install sets neither (the deploy button asks for one value, the credential
+//     encryption key), so it reads the `/setup` value.
 //
-// The cost, stated plainly: an operator who runs `/setup` on a deployment that still has the env vars
-// set will find the stored credentials ignored. {@link slackCredentialSourceNotice} is what makes that
-// visible instead of mysterious — the page says it before the run, and the resolver logs it once.
+// The cost, stated plainly: an operator who runs `/setup` on a deployment that still holds the
+// operator secrets will find the `/setup` credentials ignored. {@link slackCredentialSourceNotice} is
+// what makes that visible instead of mysterious — the resolver logs it once per name.
 //
 // MEMOISED PER PROCESS WITH A SHORT TTL, store reads only. The signature check runs on every inbound
 // Slack request and the bot token on every outbound call, so a vault round trip per request is not
@@ -44,26 +42,30 @@
 //
 // A TTL bounds that to {@link HIT_TTL_MS} without giving up the per-request cost, which is what the
 // memo was for. It is deliberately not a cache invalidated by the reopen path: a reopen runs in ONE
-// process and these memos live in all of them, so nothing a reopen does can reach them. Only time can. An env hit is not memoised because it is already a
-// property read. A MISS is remembered only BRIEFLY ({@link MISS_TTL_MS}) — long enough that an
+// process and these memos live in all of them, so nothing a reopen does can reach them. Only time can. The operator-secret
+// arm has its own thirty-second memo in core (`operatorSecret`). A MISS is remembered only BRIEFLY ({@link MISS_TTL_MS}) — long enough that an
 // unauthenticated POST to the public Slack route cannot drive one database query per request, short
 // enough that a process which booted before `/setup` finished still picks the credentials up without a
 // restart.
 
-import { encryptedKvVault, type EncryptedKvVault } from "@open-everywhere/core/agent/adapter-api.js";
+import { encryptedKvVault, operatorSecret, type EncryptedKvVault } from "@open-everywhere/core/agent/adapter-api.js";
 import { SLACK_BOT_TOKEN_REF, SLACK_SIGNING_SECRET_REF } from "./install-state.js";
 
-/** The env var holding the app's request-signing secret — the pre-OPE-2231 home, still first. */
-const SLACK_SIGNING_SECRET_ENV = "SLACK_SIGNING_SECRET";
-/** The env var holding the workspace bot token — the pre-OPE-2231 home, still first. */
-const SLACK_BOT_TOKEN_ENV = "SLACK_BOT_TOKEN";
+/** The operator secret holding the app's request-signing secret — the pre-OPE-2231 home, still first. */
+const SLACK_SIGNING_SECRET_NAME = "SLACK_SIGNING_SECRET";
+/** The operator secret holding the workspace bot token — the pre-OPE-2231 home, still first. */
+const SLACK_BOT_TOKEN_NAME = "SLACK_BOT_TOKEN";
 
-/** Which home answered. Reported by {@link resolveSlackSecret} for the suite and the notice. */
-export type SlackSecretSource = "env" | "store";
+/** Which home answered. Reported by {@link resolveSlackSecret} for the suite and the notice.
+ *  `operator` is the operator secret (`oe secret set`, with env as its on-ramp, OPE-2650); `store` is
+ *  the value a `/setup` run captured. */
+export type SlackSecretSource = "operator" | "store";
 
-/** Injectable seams for tests — the live defaults are the real vault and `process.env`. */
+/** Injectable seams for tests — the live defaults are the real vault and {@link operatorSecret}. */
 export interface SlackCredentialDeps {
   readonly vault?: EncryptedKvVault;
+  /** TEST SEAM: a synthetic stand-in for the operator-secret answer, read by name. Absent on the live
+   *  path, which resolves through {@link operatorSecret} (the db store, then env as the on-ramp). */
   readonly env?: NodeJS.ProcessEnv;
   /** The clock the hit and miss TTLs are read against. Tests advance it to prove a cached value stops
    *  being reused; the live default is `Date.now`. */
@@ -140,35 +142,31 @@ export function resetSlackCredentialNotices(): void {
  * say. The `/setup` page renders this before a run so the operator learns it BEFORE capturing
  * credentials the deployment will ignore, and {@link resolveSlackSecret} logs it once per name.
  */
-function slackCredentialSourceNotice(envName: string): string {
+function slackCredentialSourceNotice(name: string): string {
   return (
-    `[open-everywhere:slack-setup] ${envName} is set in the environment, so this deployment uses the environment value and ` +
-    `IGNORES the one in the credential store. That is the documented order (OPE-2231): env wins, so landing this change cannot ` +
-    `alter which Slack app an existing deployment speaks as. To use the stored value instead, unset ${envName} and redeploy.`
+    `[open-everywhere:slack-setup] ${name} is set as an operator secret (or as its env on-ramp), so this deployment uses that ` +
+    `value and IGNORES the one /setup stored. That is the documented order (OPE-2231, OPE-2650): the operator secret wins, so ` +
+    `landing this change cannot alter which Slack app an existing deployment speaks as. To use the /setup value instead, run ` +
+    `\`oe secret rm ${name}\`, unset the env var of the same name, and redeploy.`
   );
 }
 
 /**
- * Resolve one Slack secret: env if set, else the credential store, else `undefined`.
+ * Resolve one Slack secret: the operator secret if set, else the `/setup` value, else `undefined`.
  *
  * `undefined` is a real answer, not an error — it means this deployment has not been through `/setup`
- * and holds no env var either. Each caller fails in its own way (the front route 401s; an outbound
+ * and holds no operator secret either. Each caller fails in its own way (the front route 401s; an outbound
  * call throws the message eve's primitive always threw), which is what keeps this function free of
  * any opinion about what a missing credential should do.
  */
 export async function resolveSlackSecret(
-  envName: string,
-  fromEnv: string,
+  name: string,
+  fromOperator: string,
   ref: string,
   deps: SlackCredentialDeps = {},
 ): Promise<ResolvedSlackSecret | undefined> {
-  // 🔴 THE ENV VALUE IS PASSED IN, NOT READ HERE, and that is a gate's requirement rather than a
-  // style choice. `lint:env-docs` resolves `env[SOME_CONST]` through the const so every variable the
-  // runtime reads can be named in `scripts/env-read-allowlist.ts`; a read through a PARAMETER
-  // (`env[envName]`) resolves to nothing, so the gate cannot tell which variable it reaches and
-  // refuses the site. The two public helpers below each do their own read with a module-level const
-  // as the key, which keeps both names visible to the allowlist — and leaves this function with no
-  // environment access at all.
+  // The operator-secret value is passed in, not read here, so a suite drives this function with no
+  // store and no environment. The two public helpers below do the read.
 
   // An injected vault means a test driving a specific store state — bypass the memo entirely, so a
   // test can rewrite a row and see the effect without reaching for a reset.
@@ -180,10 +178,10 @@ export async function resolveSlackSecret(
   const cached = memoApplies ? memo.get(ref) : undefined;
   const memoised = cached !== undefined && cached.until > now ? cached.value : undefined;
 
-  if (fromEnv.length > 0) {
-    // Only say the env is shadowing a stored value when one is ACTUALLY stored — the notice is for
-    // the operator who ran `/setup` and is about to wonder why nothing changed, not for every
-    // deployment that has always used env.
+  if (fromOperator.length > 0) {
+    // Only say the operator secret is shadowing a `/setup` value when one is ACTUALLY stored — the
+    // notice is for the operator who ran `/setup` and is about to wonder why nothing changed, not for
+    // every deployment that has always used env.
     //
     // 🔴 THE CHECK IS MARKED DONE WHETHER OR NOT IT WARNED, and that is the whole reason this is a
     // separate set from `noticed`. Keying the guard off "have I warned?" meant a deployment with the
@@ -191,15 +189,15 @@ export async function resolveSlackSecret(
     // that it had looked, so it re-read the vault on EVERY resolution: one store round trip per
     // inbound Slack request, for an answer that was always going to be the env value. One read per
     // name per process, then never again.
-    if (!shadowChecked.has(envName)) {
-      shadowChecked.add(envName);
+    if (!shadowChecked.has(name)) {
+      shadowChecked.add(name);
       const stored = memoised ?? (await readStored(ref, vault)); // best-effort; a store failure says nothing
       if (stored !== undefined) {
-        noticed.add(envName);
-        console.warn(slackCredentialSourceNotice(envName));
+        noticed.add(name);
+        console.warn(slackCredentialSourceNotice(name));
       }
     }
-    return { value: fromEnv, source: "env" };
+    return { value: fromOperator, source: "operator" };
   }
 
   if (memoised !== undefined) return { value: memoised, source: "store" };
@@ -235,48 +233,53 @@ async function readStored(ref: string, injected: EncryptedKvVault | undefined):
   }
 }
 
+/**
+ * The operator-secret answer for `name`, trimmed, or `""` when it is set nowhere. A test passes
+ * `deps.env` as a synthetic stand-in; the live path reads {@link operatorSecret} (the db store, then
+ * env as the on-ramp).
+ */
+async function fromOperatorSecret(name: string, deps: SlackCredentialDeps): Promise<string> {
+  const value = deps.env !== undefined ? deps.env[name] : await operatorSecret(name);
+  return (value ?? "").trim();
+}
+
 /** The app's request-signing secret, or `undefined` when this deployment holds none. */
 export async function slackSigningSecret(deps: SlackCredentialDeps = {}): Promise<string | undefined> {
-  const env = deps.env ?? process.env;
-  const fromEnv = (env[SLACK_SIGNING_SECRET_ENV] ?? "").trim();
-  return (await resolveSlackSecret(SLACK_SIGNING_SECRET_ENV, fromEnv, SLACK_SIGNING_SECRET_REF, deps))?.value;
+  const fromOperator = await fromOperatorSecret(SLACK_SIGNING_SECRET_NAME, deps);
+  return (await resolveSlackSecret(SLACK_SIGNING_SECRET_NAME, fromOperator, SLACK_SIGNING_SECRET_REF, deps))?.value;
 }
 
 /** The workspace bot token, or `undefined` when this deployment holds none. */
 export async function slackBotToken(deps: SlackCredentialDeps = {}): Promise<string | undefined> {
-  const env = deps.env ?? process.env;
-  const fromEnv = (env[SLACK_BOT_TOKEN_ENV] ?? "").trim();
-  return (await resolveSlackSecret(SLACK_BOT_TOKEN_ENV, fromEnv, SLACK_BOT_TOKEN_REF, deps))?.value;
+  const fromOperator = await fromOperatorSecret(SLACK_BOT_TOKEN_NAME, deps);
+  return (await resolveSlackSecret(SLACK_BOT_TOKEN_NAME, fromOperator, SLACK_BOT_TOKEN_REF, deps))?.value;
 }
 
 /**
  * Does this deployment hold a Slack bot token in EITHER home? The telemetry heartbeat's
- * credential-presence probe (OPE-2241). Same order as {@link slackBotToken}: env first, then the store.
+ * credential-presence probe (OPE-2241). Same order as {@link slackBotToken}: the operator secret
+ * first, then the `/setup` value.
  *
- * 🔴 A SET ENV VAR ANSWERS WITHOUT THE STORE. `slackBotToken` reads the store once per process even
- * when the env var is set, for the env-shadows-store notice. On the heartbeat path that read would cost
- * a process that does no Slack work a store round trip, and a slow store would lose the census's
- * two-second race: an env-configured deployment, which reported `slack` before OPE-2241, would then
- * report it absent. So the env home is checked here first, and only an empty env var reads the store,
- * through the same memo as every outbound call.
+ * 🔴 A SET OPERATOR SECRET ANSWERS WITHOUT THE `/setup` READ. `slackBotToken` reads the `/setup` value
+ * once per process even when the operator secret is set, for the shadow notice. On the heartbeat path
+ * that read would cost a process that does no Slack work a second store round trip. So the operator
+ * secret is checked here first, and only an empty one reads the `/setup` value, through the same memo
+ * as every outbound call.
  */
 export async function slackCredentialsConfigured(deps: SlackCredentialDeps = {}): Promise<boolean> {
-  const env = deps.env ?? process.env;
-  if ((env[SLACK_BOT_TOKEN_ENV] ?? "").trim().length > 0) return true;
+  if ((await fromOperatorSecret(SLACK_BOT_TOKEN_NAME, deps)).length > 0) return true;
   return (await slackBotToken(deps)) !== undefined;
 }
 
 /**
- * Is `name`'s env var set, for the ONE caller that needs to ask without resolving — the `/setup`
- * page's "this env var will shadow what you are about to store" notice.
- *
- * Unrolled rather than looped over the two names for the same reason {@link resolveSlackSecret} takes
- * its env value as a parameter: the gate resolves a const key and nothing else.
+ * Is each operator secret set, for the ONE caller that needs to ask without resolving — the `/setup`
+ * page's "this operator secret will shadow what you are about to store" notice.
  */
-export function slackSecretEnvPresent(deps: SlackCredentialDeps = {}): { readonly signingSecret: boolean; readonly botToken: boolean } {
-  const env = deps.env ?? process.env;
+export async function slackOperatorSecretPresent(
+  deps: SlackCredentialDeps = {},
+): Promise<{ readonly signingSecret: boolean; readonly botToken: boolean }> {
   return {
-    signingSecret: (env[SLACK_SIGNING_SECRET_ENV] ?? "").trim().length > 0,
-    botToken: (env[SLACK_BOT_TOKEN_ENV] ?? "").trim().length > 0,
+    signingSecret: (await fromOperatorSecret(SLACK_SIGNING_SECRET_NAME, deps)).length > 0,
+    botToken: (await fromOperatorSecret(SLACK_BOT_TOKEN_NAME, deps)).length > 0,
   };
 }

package/agent/setup/eve-credentials.ts

@@ -5,7 +5,7 @@
 // handler, and eve verifies AGAIN — `verifyInbound` in eve's `slackChannel.js`:
 //
 //     signingSecret: credentials?.signingSecret ?? (credentials?.webhookVerifier ? undefined
-//                                                                               : process.env.SLACK_SIGNING_SECRET)
+//                                                                               : <the SLACK_SIGNING_SECRET env var>)
 //
 // `channels/slack.ts` passed NO `credentials`, so eve resolved the secret from `process.env` and
 // nowhere else. Moving OE's own read to the credential store therefore produced a deployment where
@@ -21,7 +21,7 @@
 //
 // `webhookVerifier` rather than `signingSecret`: eve takes `signingSecret` as a plain string, which
 // means reading it once at module load. Supplying the verifier instead also makes eve SKIP its
-// `process.env.SLACK_SIGNING_SECRET` fallback entirely (see the expression above), so there is no path
+// env fallback for SLACK_SIGNING_SECRET entirely (see the expression above), so there is no path
 // left on which eve and OE can disagree about which secret this request is held to.
 
 import { slackSignatureMatches, SLACK_SIGNATURE_HEADER, SLACK_TIMESTAMP_HEADER } from "../channels/slack-signature.js";

package/agent/setup/page.ts

@@ -384,9 +384,9 @@ function manifestBotScopes(): string {
 //
 // An earlier draft warned on screen 2 that a set `SLACK_BOT_TOKEN` / `SLACK_SIGNING_SECRET` would
 // shadow whatever the run was about to store. That warning is now unreachable, and it was the wrong
-// remedy anyway: `slackSetupOpen` (claim.ts) CLOSES the page entirely when either variable is set,
-// because the resolver is env-first and a run on such a deployment would write credentials nothing
-// would ever read. A warning the operator can click past is worse than a page that refuses — it ends
+// remedy anyway: `slackSetupOpen` (claim.ts) CLOSES the page entirely when either operator secret is
+// set (stored, or as its env var on-ramp), because the resolver puts the operator secret first and a
+// run on such a deployment would write credentials nothing would ever read. A warning the operator can click past is worse than a page that refuses — it ends
 // with a Slack app created, credentials stored, the page locked, and no behaviour change at all.
 //
 // The resolver still carries the warning for the case this page cannot cover: a var set AFTER a

package/agent/status.ts

@@ -19,6 +19,7 @@ import {
   unifiedDomainSessionKey,
   type SurfaceStatus,
 } from "@open-everywhere/core/agent/adapter-api.js";
+import { slackBotToken, slackSigningSecret, type SlackCredentialDeps } from "./setup/credentials.js";
 
 const set = (v: string | undefined): boolean => v !== undefined && v.trim() !== "";
 
@@ -80,11 +81,18 @@ async function eventsVerified(): Promise<SurfaceStatus["eventsVerified"]> {
   }
 }
 
-/** The bundle's answer for `surfaces.slack`. */
-export async function slackSurfaceStatus(env: NodeJS.ProcessEnv = process.env): Promise<Partial<SurfaceStatus>> {
-  const token = set(env.SLACK_BOT_TOKEN);
+/**
+ * The bundle's answer for `surfaces.slack`.
+ *
+ * The two credentials resolve through the bundle's own resolver (`setup/credentials.ts`): the
+ * operator secret first (OPE-2650, with env as its on-ramp), then the value a `/setup` run stored. So
+ * a deployment configured by `/setup` alone reports `credentials: "yes"`. Before OPE-2650 this read
+ * the two env vars only and reported such a deployment as `no`.
+ */
+export async function slackSurfaceStatus(deps: SlackCredentialDeps = {}): Promise<Partial<SurfaceStatus>> {
+  const token = set(await slackBotToken(deps));
   return {
-    credentials: token && set(env.SLACK_SIGNING_SECRET) ? "yes" : "no",
+    credentials: token && set(await slackSigningSecret(deps)) ? "yes" : "no",
     // Slack issues a bot token only when the app is installed to a workspace, so holding one is
     // evidence of an install. It is NOT evidence that the install is still live — a revoked app
     // leaves the stale token in place — and the detail in the contract page says so.

package/dist/agent/channels/slack-agent-session.d.ts

@@ -1,4 +1,4 @@
-import { cancelAnchoredTurn, type AttachSessionForCancel, type CancelResult, type SurfaceSessionPinner, type SurfaceSessionSetter } from "@open-everywhere/core/agent/adapter-api.js";
+import { cancelAnchoredTurn, type AttachSessionForCancel, type CancelResult, type SurfaceSessionPinner, type SurfaceSessionSetter, type SurfaceSessionStepper } from "@open-everywhere/core/agent/adapter-api.js";
 import { type SlackEventEnvelope } from "./slack-events.js";
 /** Slack's event for a press of the session's Stop button. */
 export declare const AGENT_SESSION_STOPPED_EVENT = "agent_session_stopped";
@@ -44,12 +44,28 @@ export declare function slackAgentSessionOf(attributes: Readonly<Record<string,
  * `suspended` long after the delivery's auth is gone. Ids only, never text. Pure.
  */
 export declare const slackSurfaceSessionPin: SurfaceSessionPinner;
-/** The status line a DM turn shows while it works — the same words the mention door's `turn.started` shows. */
+/** The status line a DM turn shows at its start — the mention door's own words (slack-working-signs.ts). */
 export declare const SLACK_DM_WORKING_STATUS = "Working...";
 /** Test-only: forget which sign failures were already logged. */
 export declare function _resetSignWarningsForTest(): void;
-/** The Slack setter core's turn-anchor hook calls (registered in register.ts). */
+/** The message a DM-door delivery's signs ride, or undefined when the door stamped none. Pure. */
+export declare function slackWorkingSignsOf(attributes: Readonly<Record<string, unknown>>): {
+    readonly channelId: string;
+    readonly threadTs: string;
+    readonly teamId?: string;
+} | undefined;
+/**
+ * The Slack setter core's turn-anchor hook calls (registered in register.ts). It sets the agent
+ * session's state for a 1:1 DM, and the working signs for every DM-door delivery. It answers the id
+ * of the conversation it named: the agent session, else the message the signs ride.
+ */
 export declare function slackSurfaceSessionSetter(form?: SlackFormCall): SurfaceSessionSetter;
+/**
+ * The Slack stepper (OPE-2632): each step of a DM-door turn shows its code-owned label on the status
+ * line, or a status verb — the mention door's own `actions.requested` text (slack-working-signs.ts
+ * `slackStepStatus`). A delivery with no sign stamp shows nothing here.
+ */
+export declare function slackSurfaceSessionStepper(form?: SlackFormCall): SurfaceSessionStepper;
 /** One press of the Stop button, as the route reads it. */
 export interface ParsedSessionStop {
     readonly channelId: string;

package/dist/agent/channels/slack-agent-session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"slack-agent-session.d.ts","sourceRoot":"","sources":["../../../agent/channels/slack-agent-session.ts"],"names":[],"mappings":"AAuCA,OAAO,EACL,kBAAkB,EAMlB,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EAC1B,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAkC,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5F,8DAA8D;AAC9D,eAAO,MAAM,2BAA2B,0BAA0B,CAAC;AAEnE,+FAA+F;AAC/F,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C,kCAAkC;AAClC,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG,QAAQ,GAAG,WAAW,CAAC;AAYvE,8EAA8E;AAC9E,MAAM,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC;AAS3G;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAsB9E;AAID,4CAA4C;AAC5C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iCAAiC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,uDAAuD;IACvD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,6DAA6D;AAC7D,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,sBAAsB,GAAG,MAAM,CAI3E;AAED,yGAAyG;AACzG,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,EAAE,IAAI,GAAE,aAAyB,GAAG,OAAO,CAAC,OAAO,CAAC,CAU3H;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAMxJ;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,oBAOpC,CAAC;AAmBF,+GAA+G;AAC/G,eAAO,MAAM,uBAAuB,eAAe,CAAC;AA0CpD,iEAAiE;AACjE,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAcD,kFAAkF;AAClF,wBAAgB,yBAAyB,CAAC,IAAI,GAAE,aAAyB,GAAG,oBAAoB,CAQ/F;AAID,2DAA2D;AAC3D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iCAAiC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,wBAAwB;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,kFAAkF;AAClF,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,iBAAiB,GAAG,IAAI,CAgB/F;AAOD,iCAAiC;AACjC,MAAM,WAAW,eAAe;IAC9B,+DAA+D;IAC/D,QAAQ,CAAC,aAAa,EAAE,sBAAsB,CAAC;IAC/C,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,kBAAkB,CAAC;IAC5C,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,sBAAsB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACzE;AAED;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CAAC,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CAoB/G"}
+{"version":3,"file":"slack-agent-session.d.ts","sourceRoot":"","sources":["../../../agent/channels/slack-agent-session.ts"],"names":[],"mappings":"AAwCA,OAAO,EACL,kBAAkB,EAKlB,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EAEzB,KAAK,qBAAqB,EAE3B,MAAM,4CAA4C,CAAC;AACpD,OAAO,EAAkC,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAI5F,8DAA8D;AAC9D,eAAO,MAAM,2BAA2B,0BAA0B,CAAC;AAEnE,+FAA+F;AAC/F,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C,kCAAkC;AAClC,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG,QAAQ,GAAG,WAAW,CAAC;AAKvE,8EAA8E;AAC9E,MAAM,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC;AAS3G;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAsB9E;AAID,4CAA4C;AAC5C,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iCAAiC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,uDAAuD;IACvD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,6DAA6D;AAC7D,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,sBAAsB,GAAG,MAAM,CAI3E;AAED,yGAAyG;AACzG,wBAAsB,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,EAAE,IAAI,GAAE,aAAyB,GAAG,OAAO,CAAC,OAAO,CAAC,CAU3H;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAMxJ;AAED;;;;GAIG;AACH,eAAO,MAAM,sBAAsB,EAAE,oBAOpC,CAAC;AAqBF,4GAA4G;AAC5G,eAAO,MAAM,uBAAuB,eAAuB,CAAC;AA4C5D,iEAAiE;AACjE,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAED,kGAAkG;AAClG,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAMlL;AAgBD;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,GAAE,aAAyB,GAAG,oBAAoB,CAa/F;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,GAAE,aAAyB,GAAG,qBAAqB,CAQjG;AAID,2DAA2D;AAC3D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,iCAAiC;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,wBAAwB;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,kFAAkF;AAClF,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,kBAAkB,GAAG,iBAAiB,GAAG,IAAI,CAgB/F;AAOD,iCAAiC;AACjC,MAAM,WAAW,eAAe;IAC9B,+DAA+D;IAC/D,QAAQ,CAAC,aAAa,EAAE,sBAAsB,CAAC;IAC/C,mEAAmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,kBAAkB,CAAC;IAC5C,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,sBAAsB,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACzE;AAED;;;;;;;;GAQG;AACH,wBAAsB,qBAAqB,CAAC,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CAoB/G"}