@openclaw/slack 2026.8.1-beta.2 → 2026.8.1

package/dist/{policy-TapwbeaT.js → policy-CtQVbde1.js}

@@ -1,4 +1,5 @@
-import { d as resolveSlackUserAllowListForTeam, l as normalizeSlackSlug, n as buildSlackChannelPolicyScope, t as buildSlackChannelIdCandidates } from "./group-policy-c4RP9bjc.js";
+import { n as buildSlackChannelPolicyScope, t as buildSlackChannelIdCandidates } from "./group-policy-BdwszjYn.js";
+import { d as normalizeSlackSlug, p as resolveSlackUserAllowListForTeam } from "./probe-0usmAb0i.js";
 import { applyChannelMatchMeta, buildChannelKeyCandidates } from "openclaw/plugin-sdk/channel-targets";
 import { mergePairLoopGuardConfig } from "openclaw/plugin-sdk/pair-loop-guard-runtime";
 //#region extensions/slack/src/monitor/channel-config.ts

package/dist/{probe-HoEg_WxB.js → probe-0usmAb0i.js}

@@ -1,32 +1,17 @@
 import { t as __exportAll } from "./rolldown-runtime-8H4AJuhK.js";
-import { u as formatSlackBotTokenIdentityWarning } from "./accounts-CK4AVI2_.js";
-import "./target-parsing-BnMD2ZqZ.js";
+import { u as formatSlackBotTokenIdentityWarning } from "./accounts-Dm_H77gH.js";
+import { a as parseSlackTarget } from "./target-parsing-BnMD2ZqZ.js";
 import { createRequire } from "node:module";
-import { DEFAULT_ACCOUNT_ID as DEFAULT_ACCOUNT_ID$1 } from "openclaw/plugin-sdk/account-id";
-import { isRecord } from "openclaw/plugin-sdk/string-coerce-runtime";
+import { isRecord, normalizeOptionalLowercaseString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import { runChannelProbe } from "openclaw/plugin-sdk/text-utility-runtime";
-import { PAIRING_APPROVED_MESSAGE, projectCredentialSnapshotFields, resolveConfiguredFromRequiredCredentialStatuses } from "openclaw/plugin-sdk/channel-status";
 import { createHash } from "node:crypto";
 import { WebClient } from "@slack/web-api";
 import { addActiveManagedProxyTlsOptions, resolveEnvHttpProxyAgentOptions, resolveFetch } from "openclaw/plugin-sdk/fetch-runtime";
 import { isDebugProxyGlobalFetchPatchInstalled } from "openclaw/plugin-sdk/proxy-capture";
+import { compileAllowlist, resolveCompiledAllowlistMatch } from "openclaw/plugin-sdk/allow-from";
+import { normalizeHyphenSlug, normalizeStringEntries as normalizeStringEntries$1, normalizeStringEntriesLower } from "openclaw/plugin-sdk/string-normalization-runtime";
 import { redactSensitiveText } from "openclaw/plugin-sdk/logging-core";
-//#region extensions/slack/src/channel-api.ts
-const SLACK_CHANNEL_META = {
-	id: "slack",
-	label: "Slack",
-	selectionLabel: "Slack",
-	docsPath: "/channels/slack",
-	docsLabel: "slack",
-	blurb: "supports bot + app tokens, channels, threads, and interactive replies.",
-	systemImage: "number.square",
-	markdownCapable: true
-};
-function getChatChannelMeta(id) {
-	if (id !== SLACK_CHANNEL_META.id) throw new Error(`Unsupported Slack channel meta lookup: ${id}`);
-	return SLACK_CHANNEL_META;
-}
-//#endregion
+import { defineStableChannelIngressIdentity } from "openclaw/plugin-sdk/channel-ingress-runtime";
 //#region extensions/slack/src/client-options.ts
 const requireFromSlackSocketMode = (() => {
 	return createRequire(createRequire(import.meta.url).resolve("@slack/socket-mode/package.json"));
@@ -194,6 +179,113 @@ function getSlackListenerUploadCompletionClient(params) {
 	return client;
 }
 //#endregion
+//#region extensions/slack/src/monitor/allow-list.ts
+const SLACK_SLUG_CACHE_MAX = 512;
+const SLACK_STABLE_USER_ID_RE = /^[ubw][a-z0-9]+$/;
+const slackSlugCache = /* @__PURE__ */ new Map();
+function normalizeSlackSlug(raw) {
+	const key = raw ?? "";
+	const cached = slackSlugCache.get(key);
+	if (cached !== void 0) return cached;
+	const normalized = normalizeHyphenSlug(raw);
+	slackSlugCache.set(key, normalized);
+	if (slackSlugCache.size > SLACK_SLUG_CACHE_MAX) {
+		const oldest = slackSlugCache.keys().next();
+		if (!oldest.done) slackSlugCache.delete(oldest.value);
+	}
+	return normalized;
+}
+function normalizeAllowList(list) {
+	return normalizeStringEntries$1(list);
+}
+function normalizeAllowListLower(list) {
+	return normalizeStringEntriesLower(list);
+}
+function normalizeSlackAllowOwnerEntry(entry) {
+	const trimmed = normalizeOptionalLowercaseString(entry);
+	if (!trimmed || trimmed === "*") return;
+	try {
+		const target = parseSlackTarget(trimmed);
+		if (target?.kind === "user" && target.teamId) return target.id.toLowerCase();
+	} catch {
+		return;
+	}
+	const withoutPrefix = trimmed.replace(/^(slack:|user:)/, "");
+	return SLACK_STABLE_USER_ID_RE.test(withoutPrefix) ? withoutPrefix : void 0;
+}
+function resolveSlackAllowListMatch(params) {
+	const compiledAllowList = compileAllowlist(params.allowList);
+	const teamId = normalizeOptionalLowercaseString(params.teamId);
+	const id = normalizeOptionalLowercaseString(params.id);
+	const name = normalizeOptionalLowercaseString(params.name);
+	const slug = normalizeSlackSlug(name);
+	const scopedCandidates = [{
+		value: teamId && id ? `team:${teamId}:user:${id}` : void 0,
+		source: "workspace-id"
+	}];
+	const unscopedCandidates = [
+		{
+			value: id,
+			source: "id"
+		},
+		{
+			value: id ? `slack:${id}` : void 0,
+			source: "prefixed-id"
+		},
+		{
+			value: id ? `user:${id}` : void 0,
+			source: "prefixed-user"
+		},
+		...params.allowNameMatching === true ? [
+			{
+				value: name,
+				source: "name"
+			},
+			{
+				value: name ? `slack:${name}` : void 0,
+				source: "prefixed-name"
+			},
+			{
+				value: slug,
+				source: "slug"
+			}
+		] : []
+	];
+	return resolveCompiledAllowlistMatch({
+		compiledAllowlist: compiledAllowList,
+		candidates: [...scopedCandidates, ...unscopedCandidates]
+	});
+}
+function allowListMatches(params) {
+	return resolveSlackAllowListMatch(params).allowed;
+}
+function resolveSlackUserAllowed(params) {
+	const allowList = normalizeAllowListLower(params.allowList);
+	if (allowList.length === 0) return true;
+	return allowListMatches({
+		allowList,
+		teamId: params.teamId,
+		id: params.userId,
+		name: params.userName,
+		allowNameMatching: params.allowNameMatching
+	});
+}
+function resolveSlackUserAllowListForTeam(params) {
+	const allowList = normalizeAllowListLower(params.allowList);
+	const teamId = normalizeOptionalLowercaseString(params.teamId);
+	return allowList.flatMap((entry) => {
+		if (entry === "*") return [entry];
+		if (!entry.startsWith("team:")) return [entry];
+		try {
+			const target = parseSlackTarget(entry);
+			if (target?.kind === "user" && target.teamId?.toLowerCase() === teamId) return [entry];
+			return params.preserveUnmatchedScopedEntries ? [entry] : [];
+		} catch {
+			return params.preserveUnmatchedScopedEntries ? [entry] : [];
+		}
+	});
+}
+//#endregion
 //#region extensions/slack/src/errors.ts
 const NO_ERROR_DETAIL = "no error detail";
 function redact(value) {
@@ -298,6 +390,101 @@ function formatSlackError(error, fallback = NO_ERROR_DETAIL) {
 	return safeStringify(error) ?? fallback;
 }
 //#endregion
+//#region extensions/slack/src/monitor/ingress-identity.ts
+const SLACK_USER_NAME_KIND = "plugin:slack-user-name";
+const SLACK_WORKSPACE_USER_ID_KIND = "plugin:slack-workspace-user-id";
+function normalizeSlackUserId(raw) {
+	const value = (raw ?? "").trim().toLowerCase();
+	if (!value) return "";
+	const mention = value.match(/^<@([a-z0-9_]+)>$/i);
+	if (mention?.[1]) return mention[1];
+	return value.replace(/^(slack:|user:)/, "");
+}
+function isSlackStableUserId(value) {
+	return /^[ubw][a-z0-9_]+$/i.test(value);
+}
+function normalizeSlackWorkspaceUserEntry(entry) {
+	const normalized = entry.trim().toLowerCase();
+	if (!normalized) return null;
+	try {
+		const target = parseSlackTarget(normalized);
+		if (target?.kind === "user" && target.teamId) return target.normalized;
+	} catch {
+		return null;
+	}
+	return null;
+}
+function normalizeSlackBareUserEntry(entry) {
+	const normalized = entry.trim().toLowerCase();
+	if (!normalized || normalizeSlackWorkspaceUserEntry(normalized)) return null;
+	const userId = normalizeSlackUserId(normalized);
+	return isSlackStableUserId(userId) ? userId : null;
+}
+function normalizeSlackStableEntry(entry) {
+	return normalizeSlackBareUserEntry(entry) ?? normalizeSlackWorkspaceUserEntry(entry);
+}
+function normalizeSlackNameEntry(entry) {
+	const normalized = entry.trim().toLowerCase();
+	if (!normalized || normalizeSlackStableEntry(normalized)) return null;
+	return normalized.replace(/^slack:/, "") || null;
+}
+function normalizeSlackNameSubject(value) {
+	return value.trim().toLowerCase() || null;
+}
+function normalizeSlackNameSlugEntry(entry) {
+	const name = normalizeSlackNameEntry(entry);
+	if (!name) return null;
+	return normalizeSlackSlug(name) || null;
+}
+const slackIngressIdentity = defineStableChannelIngressIdentity({
+	resolveParticipant: (subject) => {
+		const qualified = subject.aliases?.workspaceSenderId;
+		if (typeof qualified !== "string") return;
+		const normalized = normalizeSlackWorkspaceUserEntry(qualified);
+		const target = normalized ? parseSlackTarget(normalized) : void 0;
+		return target?.teamId ? {
+			domain: target.teamId,
+			idKind: target.id.startsWith("b") ? "bot-id" : "user-id",
+			id: target.id
+		} : void 0;
+	},
+	key: "senderId",
+	kind: "stable-id",
+	authentication: "asserted",
+	normalizeEntry: normalizeSlackBareUserEntry,
+	normalizeSubject: normalizeSlackUserId,
+	sensitivity: "pii",
+	aliases: [{
+		key: "workspaceSenderId",
+		kind: SLACK_WORKSPACE_USER_ID_KIND,
+		authentication: "asserted",
+		normalizeEntry: normalizeSlackWorkspaceUserEntry,
+		normalizeSubject: normalizeSlackWorkspaceUserEntry,
+		sensitivity: "pii"
+	}, ...[["senderName", normalizeSlackNameEntry], ["senderNameSlug", normalizeSlackNameSlugEntry]].map(([key, normalizeEntry]) => ({
+		key,
+		kind: SLACK_USER_NAME_KIND,
+		normalizeEntry,
+		normalizeSubject: normalizeSlackNameSubject,
+		authentication: "mutable",
+		sensitivity: "pii"
+	}))]
+});
+function createSlackIngressSubject(params) {
+	const senderId = normalizeSlackUserId(params.senderId);
+	const teamId = normalizeOptionalLowercaseString(params.teamId);
+	const senderName = params.senderName?.trim().toLowerCase();
+	const senderNameSlug = senderName ? normalizeSlackSlug(senderName) : void 0;
+	return {
+		stableId: senderId,
+		aliases: {
+			workspaceSenderId: teamId && senderId ? `team:${teamId}:user:${senderId}` : void 0,
+			senderName,
+			senderNameSlug
+		}
+	};
+}
+//#endregion
 //#region extensions/slack/src/probe.ts
 var probe_exports = /* @__PURE__ */ __exportAll({ probeSlack: () => probeSlack });
 async function probeSlack(token, timeoutMs = 2500, opts) {
@@ -362,4 +549,4 @@ async function probeSlack(token, timeoutMs = 2500, opts) {
 	}));
 }
 //#endregion
-export { resolveConfiguredFromRequiredCredentialStatuses as S, resolveSlackWriteClientOptions as _, createSlackReadClient as a, getChatChannelMeta as b, createSlackWebClient as c, getSlackWriteClient as d, SLACK_DEFAULT_RETRY_OPTIONS as f, resolveSlackWebClientOptions as g, resolveSlackProxyDispatcher as h, createSlackLookupClient as i, createSlackWriteClient as l, resolveSlackLookupClientOptions as m, probe_exports as n, createSlackStartupAuthClient as o, SLACK_WRITE_RETRY_OPTIONS as p, formatSlackError as r, createSlackTokenCacheKey as s, probeSlack as t, getSlackListenerUploadCompletionClient as u, DEFAULT_ACCOUNT_ID$1 as v, projectCredentialSnapshotFields as x, PAIRING_APPROVED_MESSAGE as y };
+export { SLACK_DEFAULT_RETRY_OPTIONS as C, resolveSlackWebClientOptions as D, resolveSlackProxyDispatcher as E, resolveSlackWriteClientOptions as O, getSlackWriteClient as S, resolveSlackLookupClientOptions as T, createSlackStartupAuthClient as _, slackIngressIdentity as a, createSlackWriteClient as b, normalizeAllowList as c, normalizeSlackSlug as d, resolveSlackAllowListMatch as f, createSlackReadClient as g, createSlackLookupClient as h, createSlackIngressSubject as i, normalizeAllowListLower as l, resolveSlackUserAllowed as m, probe_exports as n, formatSlackError as o, resolveSlackUserAllowListForTeam as p, SLACK_USER_NAME_KIND as r, allowListMatches as s, probeSlack as t, normalizeSlackAllowOwnerEntry as u, createSlackTokenCacheKey as v, SLACK_WRITE_RETRY_OPTIONS as w, getSlackListenerUploadCompletionClient as x, createSlackWebClient as y };