@opengeni/api-router 0.15.1 → 0.15.5

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   createAppComposition,
   startSlackInteractionPump
-} from "./chunk-UVL2KH56.js";
+} from "./chunk-ICRZC3JH.js";
 
 // src/index.ts
 import {

package/dist/integrations/slack-bot.d.ts

@@ -44,7 +44,8 @@ type SlackBotContext = {
 };
 export declare class SlackBotProviderError extends Error {
     readonly code: string;
-    constructor(code: string);
+    readonly retryAfterMs: number | null;
+    constructor(code: string, retryAfterMs?: number | null);
 }
 export type SlackBotCredentialVerificationFailureReason = "scope_mismatch" | "identity_mismatch";
 export declare class SlackBotCredentialVerificationError extends HTTPException {
@@ -86,6 +87,7 @@ export declare class OpenGeniSlackBotClient {
             name: string;
             isPrivate: boolean;
             isMember: boolean;
+            isDirectMessage: boolean;
             isArchived: boolean;
             topic: string;
             purpose: string;
@@ -100,6 +102,7 @@ export declare class OpenGeniSlackBotClient {
         name: string;
         isPrivate: boolean;
         isMember: boolean;
+        isDirectMessage: boolean;
         isArchived: boolean;
         topic: string;
         purpose: string;
@@ -115,6 +118,7 @@ export declare class OpenGeniSlackBotClient {
             name: string;
             isPrivate: boolean;
             isMember: boolean;
+            isDirectMessage: boolean;
             isArchived: boolean;
             topic: string;
             purpose: string;
@@ -153,6 +157,7 @@ export declare class OpenGeniSlackBotClient {
             name: string;
             isPrivate: boolean;
             isMember: boolean;
+            isDirectMessage: boolean;
             isArchived: boolean;
             topic: string;
             purpose: string;
@@ -207,6 +212,7 @@ export declare class OpenGeniSlackBotClient {
             name: string;
             isPrivate: boolean;
             isMember: boolean;
+            isDirectMessage: boolean;
             isArchived: boolean;
             topic: string;
             purpose: string;
@@ -237,6 +243,7 @@ export declare class OpenGeniSlackBotClient {
             name: string;
             isPrivate: boolean;
             isMember: boolean;
+            isDirectMessage: boolean;
             isArchived: boolean;
             topic: string;
             purpose: string;
@@ -267,6 +274,7 @@ export declare class OpenGeniSlackBotClient {
             name: string;
             isPrivate: boolean;
             isMember: boolean;
+            isDirectMessage: boolean;
             isArchived: boolean;
             topic: string;
             purpose: string;

package/dist/integrations/slack-interactions.d.ts

@@ -1,10 +1,17 @@
-import { type SlackInstallationRoute, type SlackInteractionTriggerKind } from "@opengeni/db";
+import { type SlackInstallationRoute, type SlackInteractionInboxEntry, type SlackInteractionTriggerKind } from "@opengeni/db";
 import { type ApiRouteDeps } from "@opengeni/core";
 import type { Hono } from "hono";
 export declare const SLACK_INTERACTION_MAX_BODY_BYTES: number;
 export declare const SLACK_SIGNATURE_REPLAY_WINDOW_SECONDS = 300;
 export declare const SLACK_DELIVERY_EVENT_TYPES: readonly ["agent.message.completed", "session.humanInput.requested", "turn.completed", "turn.failed", "turn.cancelled", "session.status.changed"];
 export declare const SLACK_TASK_INSTRUCTIONS: string;
+/**
+ * Slack-originated tasks may retrieve the workspace bot's bounded read surface
+ * on demand. Connector tools are explicit-only, so freeze that narrow context
+ * selection at session creation while keeping Slack mutations out of the model
+ * surface; interaction delivery remains owned by the durable delivery pump.
+ */
+export declare const SLACK_TASK_FIRST_PARTY_MCP_TOOLS: ("artifacts_create" | "artifacts_get_source" | "artifacts_list" | "artifacts_publish" | "artifacts_rollback" | "environment_list" | "environment_set_variable" | "github_connect_link" | "github_repositories_list" | "github_token" | "goal_complete" | "goal_pause" | "goal_set" | "goal_update" | "memory_correct" | "memory_save" | "memory_search" | "preference_registry_get" | "preference_registry_summary" | "rig_get" | "rig_list" | "rig_promote" | "rig_propose_change" | "rig_verify" | "run_on" | "sandbox_attach" | "sandbox_provision" | "sandbox_swap" | "sandboxes_list" | "scheduled_task_runs_list" | "scheduled_tasks_create" | "scheduled_tasks_delete" | "scheduled_tasks_get" | "scheduled_tasks_list" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_update" | "session_create" | "session_events" | "session_get" | "session_pause" | "session_resume" | "session_send_message" | "session_steer" | "sessions_list" | "set_other_session_title" | "set_session_title" | "slack_bot_channel_history" | "slack_bot_delete_message" | "slack_bot_file_content" | "slack_bot_file_info" | "slack_bot_list_channels" | "slack_bot_list_files" | "slack_bot_list_users" | "slack_bot_post_message" | "slack_bot_thread_replies" | "social_connections_list" | "social_daily_analysis_context" | "social_mentions_live" | "social_post_reply" | "social_posts_recent" | "social_posts_sync" | "social_search_live" | "social_thread_fetch" | "variable_set_list" | "variable_set_set_variable")[];
 export type NormalizedSlackInteraction = {
     providerEventId: string;
     providerMessageId: string;
@@ -28,3 +35,13 @@ export declare function startSlackInteractionPump(deps: ApiRouteDeps, options?:
     intervalMs?: number;
     maxPerTick?: number;
 }): () => void;
+type SlackUserLinkToken = {
+    workspaceId: string;
+    connectionId: string;
+    slackTeamId: string;
+    slackUserId: string;
+    expiresAt: number;
+};
+export declare function createSlackUserLinkToken(signingSecret: string, entry: Pick<SlackInteractionInboxEntry, "workspaceId" | "connectionId" | "slackTeamId" | "slackUserId">, nowMs?: number): string;
+export declare function verifySlackUserLinkToken(signingSecret: string, token: string, nowMs?: number): SlackUserLinkToken | null;
+export {};

package/dist/integrations/social-api.d.ts

@@ -0,0 +1,91 @@
+import type { Settings } from "@opengeni/config";
+import type { SocialConnection } from "@opengeni/contracts";
+import type { Observability } from "@opengeni/observability";
+import type { Database } from "@opengeni/db";
+import { type SocialProviderFetch } from "./social-oauth";
+export type SocialLivePost = {
+    id: string;
+    provider: "x" | "reddit";
+    url: string | null;
+    author: string | null;
+    text: string;
+    createdAt: string | null;
+    metrics: Record<string, number>;
+    context: Record<string, string>;
+};
+type SocialApiDeps = {
+    db: Database;
+    settings: Settings;
+    observability?: Observability | undefined;
+    providerFetch?: SocialProviderFetch | undefined;
+};
+type ConnectionRef = {
+    workspaceId: string;
+    connectionId: string;
+};
+export declare function socialSearchLive(deps: SocialApiDeps, ref: ConnectionRef, input: {
+    query: string;
+    limit?: number | undefined;
+    subreddit?: string | undefined;
+}): Promise<{
+    connection: SocialConnection;
+    posts: SocialLivePost[];
+}>;
+export declare function socialMentionsLive(deps: SocialApiDeps, ref: ConnectionRef, input: {
+    limit?: number | undefined;
+    sinceId?: string | undefined;
+}): Promise<{
+    connection: SocialConnection;
+    posts: SocialLivePost[];
+}>;
+export declare function socialThreadLive(deps: SocialApiDeps, ref: ConnectionRef, input: {
+    id: string;
+    limit?: number | undefined;
+}): Promise<{
+    connection: SocialConnection;
+    posts: SocialLivePost[];
+}>;
+export declare function socialOwnPostsLive(deps: SocialApiDeps, ref: ConnectionRef, input: {
+    limit?: number | undefined;
+}): Promise<{
+    connection: SocialConnection;
+    posts: SocialLivePost[];
+}>;
+export declare function socialPostReply(deps: SocialApiDeps, ref: ConnectionRef, input: {
+    inReplyToId: string;
+    text: string;
+}): Promise<{
+    connection: SocialConnection;
+    postedId: string | null;
+    url: string | null;
+}>;
+/**
+ * Reddit write endpoints address targets by fullname (t3_xxx post, t1_xxx
+ * comment). Bare ids are ambiguous, so require the caller to be explicit.
+ */
+export declare function redditThingId(id: string): string;
+/**
+ * Agent-controlled values that land in a provider URL PATH must be shape-
+ * validated: encodeURIComponent leaves `.` intact, so `..` would collapse a
+ * path segment and select a different endpoint on the same host.
+ */
+export declare function redditSubredditName(value: string): string;
+export declare function redditArticleId(value: string): string;
+/**
+ * Joins a provider-supplied path against the provider origin and refuses
+ * results that escape it (e.g. a hostile `@evil.com/x` or `//evil.com`
+ * permalink), so mapper output URLs can be trusted downstream.
+ */
+export declare function redditUrl(path: string): string | null;
+export declare function mapXTweets(payload: Record<string, unknown>, fallbackAuthor?: string): SocialLivePost[];
+export declare function mapRedditListing(payload: Record<string, unknown>): SocialLivePost[];
+/**
+ * /comments/{article} returns [post listing, comment listing]; flatten the
+ * submission first, then its comment tree in order.
+ */
+export declare function mapRedditThread(payload: Record<string, unknown>): SocialLivePost[];
+export declare function redditCommentFromApiJson(payload: Record<string, unknown>): {
+    id: string | null;
+    url: string | null;
+};
+export {};

package/dist/integrations/social-oauth.d.ts

@@ -0,0 +1,84 @@
+import { type Settings } from "@opengeni/config";
+import { OAuthStartResponse, type SocialConnection, type SocialOAuthProviderId, type SocialOAuthStartRequest } from "@opengeni/contracts";
+import type { Observability } from "@opengeni/observability";
+import { type Database } from "@opengeni/db";
+export declare const SOCIAL_USER_AGENT = "opengeni:social-connector:v0.1.0 (self-hosted)";
+export declare const SOCIAL_TIMEOUT_MS = 10000;
+/** Token-endpoint failure that carries enough to tell invalid_grant from a blip. */
+export declare class SocialTokenRequestError extends Error {
+    readonly status: number | null;
+    readonly oauthError: string | null;
+    constructor(message: string, status: number | null, oauthError: string | null);
+    /** True only for definitive authorization-server rejections of the grant. */
+    get definitive(): boolean;
+}
+type SocialProviderDefinition = {
+    id: SocialOAuthProviderId;
+    authorizationEndpoint: string;
+    tokenEndpoint: string;
+    defaultScopes: string[];
+    pkce: boolean;
+    extraAuthorizeParams: Record<string, string>;
+};
+export declare const SOCIAL_OAUTH_PROVIDERS: Record<SocialOAuthProviderId, SocialProviderDefinition>;
+export type SocialCredentialBundle = {
+    provider: SocialOAuthProviderId;
+    accessToken: string;
+    refreshToken?: string;
+    tokenType: string;
+    expiresAt?: string;
+    scope?: string;
+};
+/**
+ * Provider-transport seam (Slack-connector pattern): production always goes
+ * through pinnedFetch; tests inject an in-process provider to exercise the
+ * full callback/refresh/tool loop functionally.
+ */
+export type SocialProviderFetch = (url: string, init: RequestInit, label: string) => Promise<Response>;
+type SocialOAuthDeps = {
+    db: Database;
+    settings: Settings;
+    observability?: Observability | undefined;
+    providerFetch?: SocialProviderFetch | undefined;
+};
+export type SocialOAuthStartContext = {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    requestUrl: string;
+    payload: SocialOAuthStartRequest;
+};
+export declare function socialOAuthClientFor(settings: Settings, provider: SocialOAuthProviderId): {
+    clientId: string;
+    clientSecret?: string | undefined;
+};
+export declare function socialOAuthRedirectUri(settings: Settings, requestUrl: string): string;
+export declare function startSocialOAuth(deps: SocialOAuthDeps, context: SocialOAuthStartContext): Promise<OAuthStartResponse>;
+export declare function completeSocialOAuthCallback(deps: SocialOAuthDeps, input: {
+    code?: string | undefined;
+    state?: string | undefined;
+    error?: string | undefined;
+    requestUrl: string;
+}): Promise<{
+    redirectTo: string;
+}>;
+/**
+ * Resolves a usable access token for a social connection, refreshing (and
+ * persisting the rotated bundle) when the stored token is near expiry. Marks
+ * the connection needs_reauth and throws when refresh is impossible so agents
+ * surface an actionable error instead of opaque 401s.
+ */
+export declare function freshSocialAccessToken(deps: SocialOAuthDeps, ref: {
+    workspaceId: string;
+    connectionId: string;
+}): Promise<{
+    connection: SocialConnection;
+    bundle: SocialCredentialBundle;
+}>;
+export declare function markNeedsReauth(deps: SocialOAuthDeps, ref: {
+    workspaceId: string;
+    connectionId: string;
+}): Promise<void>;
+export declare function parseSocialCredentialBundle(raw: string): SocialCredentialBundle;
+export declare function socialTokenNeedsRefresh(bundle: SocialCredentialBundle, now: Date): boolean;
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/api-router",
-  "version": "0.15.1",
+  "version": "0.15.5",
   "description": "OpenGeni HTTP surface: the Hono adapter/router (createApp), routes, MCP HTTP transport, and HTTP access adapters over @opengeni/core. An engine-distribution surface — its runtime closure includes engine-internal packages.",
   "license": "Apache-2.0",
   "repository": {
@@ -44,17 +44,17 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@opengeni/agent-proto": "^0.3.0",
     "@opengeni/codex": "^0.2.9",
-    "@opengeni/config": "^0.8.1",
-    "@opengeni/contracts": "^0.27.0",
-    "@opengeni/core": "^0.15.1",
-    "@opengeni/db": "^0.17.1",
-    "@opengeni/documents": "^0.2.61",
-    "@opengeni/events": "^0.3.52",
-    "@opengeni/github": "^0.4.11",
+    "@opengeni/config": "^0.9.1",
+    "@opengeni/contracts": "^0.28.1",
+    "@opengeni/core": "^0.16.2",
+    "@opengeni/db": "^0.19.0",
+    "@opengeni/documents": "^0.2.64",
+    "@opengeni/events": "^0.3.55",
+    "@opengeni/github": "^0.4.13",
     "@opengeni/network": "^0.1.1",
     "@opengeni/observability": "^0.3.0",
-    "@opengeni/runtime": "^0.15.1",
-    "@opengeni/storage": "^0.2.48",
+    "@opengeni/runtime": "^0.15.3",
+    "@opengeni/storage": "^0.2.50",
     "@temporalio/client": "^1.17.0",
     "better-auth": "^1.6.14",
     "hono": "^4.12.18",

package/src/app.ts

@@ -27,6 +27,7 @@ import { createObjectStorage } from "@opengeni/storage";
 import { WebStandardStreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/webStandardStreamableHttp.js";
 import { Hono } from "hono";
 import { bodyLimit } from "hono/body-limit";
+import { compress } from "hono/compress";
 import { cors } from "hono/cors";
 import { HTTPException } from "hono/http-exception";
 import type { ContentfulStatusCode } from "hono/utils/http-status";
@@ -233,6 +234,20 @@ export function createAppComposition(deps: AppDependencies): {
     }),
   );
 
+  // Large catalog, capture, and session-list responses are on the browser's
+  // critical path. Compress JSON at the API boundary while leaving SSE and
+  // other streaming transports byte-for-byte unchanged.
+  const compressJson = compress({
+    encoding: "gzip",
+    contentTypeFilter: /^application\/json(?:;|$)/i,
+  });
+  app.use("/v1/*", async (c, next) => {
+    await compressJson(c, next);
+    if (/^application\/json(?:;|$)/i.test(c.res.headers.get("content-type") ?? "")) {
+      c.res.headers.set("vary", appendVary(c.res.headers.get("vary"), "Accept-Encoding"));
+    }
+  });
+
   app.use("*", async (c, next) => {
     const url = new URL(c.req.url);
     const route = routeLabel(url.pathname);
@@ -392,6 +407,7 @@ export function createAppComposition(deps: AppDependencies): {
         },
         productAccessMode: deps.settings.productAccessMode,
         auth: clientAuthConfig(deps.settings),
+        analytics: clientAnalyticsConfig(deps.settings),
         // Channel-A structured services (P4.4) ride exec/readFile/createEditor,
         // available on every real backend; `none` has no box so they are all off.
         // Per-session availability is still negotiated on /stream-capabilities.
@@ -542,6 +558,17 @@ export function createAppComposition(deps: AppDependencies): {
   return { app, routeDeps };
 }
 
+export function appendVary(current: string | null, value: string): string {
+  const values = (current ?? "")
+    .split(",")
+    .map((entry) => entry.trim())
+    .filter(Boolean);
+  if (!values.some((entry) => entry.toLowerCase() === value.toLowerCase())) {
+    values.push(value);
+  }
+  return values.join(", ");
+}
+
 async function requireMcpAccessGrant(
   c: Parameters<typeof requireAccessGrant>[0],
   deps: ApiRouteDeps,
@@ -585,6 +612,31 @@ function clientAuthConfig(settings: AppDependencies["settings"]) {
   return { mode: "none" as const };
 }
 
+function clientAnalyticsConfig(settings: AppDependencies["settings"]) {
+  if (!settings.analyticsEnabled) {
+    return { consentRequired: true, providers: {} };
+  }
+  return {
+    consentRequired: settings.analyticsConsentRequired,
+    providers: {
+      ...(settings.analyticsReoClientId
+        ? { reo: { clientId: settings.analyticsReoClientId } }
+        : {}),
+      ...(settings.analyticsPosthogProjectKey && settings.analyticsPosthogHost
+        ? {
+            posthog: {
+              projectKey: settings.analyticsPosthogProjectKey,
+              host: settings.analyticsPosthogHost,
+            },
+          }
+        : {}),
+      ...(settings.analyticsGa4MeasurementId
+        ? { ga4: { measurementId: settings.analyticsGa4MeasurementId } }
+        : {}),
+    },
+  };
+}
+
 function structuredServicesHint(backend: string): {
   fileSystem: boolean;
   git: boolean;
@@ -1083,6 +1135,10 @@ const routeLabelPatterns: Array<{ pattern: RegExp; label: string }> = [
     pattern: /^\/v1\/integrations\/slack\/callback$/,
     label: "/v1/integrations/slack/callback",
   },
+  {
+    pattern: /^\/v1\/social\/oauth\/callback$/,
+    label: "/v1/social/oauth/callback",
+  },
   {
     pattern: /^\/v1\/enrollments\/device\/start$/,
     label: "/v1/enrollments/device/start",

package/src/http/auth.ts

@@ -57,6 +57,11 @@ function isAuthExempt(c: Context, settings: Settings): boolean {
   ) {
     return true;
   }
+  // Social OAuth (X / Reddit) browser redirect: exact path only, protected by
+  // signed single-use state plus a callback-time grant recheck.
+  if (path === "/v1/social/oauth/callback") {
+    return true;
+  }
   // Catalog logos are rendered via bare <img> tags, which carry no credentials;
   // the images are public vendor logos, digest-keyed by content, and the route
   // itself enforces the catalog-assets/ prefix lock and extension whitelist.

package/src/integrations/oauth-client.ts

@@ -5,6 +5,7 @@ import { parseIntegrationsOauthClientsJson, type Settings } from "@opengeni/conf
 import {
   OPENGENI_PERSONAL_SLACK_MCP_URL,
   OAuthStartResponse,
+  selectCanonicalPersonalSlackConnection,
   type OAuthStartRequest,
 } from "@opengeni/contracts";
 import { hasPermission, requireEnvironmentEncryption } from "@opengeni/core";
@@ -161,6 +162,8 @@ export async function startMcpOAuth(
     workspaceId: context.workspaceId,
     subjectId: context.subjectId,
     providerDomain,
+    mcpUrl,
+    personalSlack,
     connectionId: context.payload.connectionId,
   });
   if (context.payload.connectionId && !existing) {
@@ -847,6 +850,8 @@ async function existingOAuthConnectionForStart(
     workspaceId: string;
     subjectId: string;
     providerDomain: string;
+    mcpUrl: string;
+    personalSlack: boolean;
     connectionId?: string | undefined;
   },
 ) {
@@ -859,20 +864,23 @@ async function existingOAuthConnectionForStart(
     );
     return connection?.subjectId === input.subjectId &&
       connection.kind === "oauth2" &&
-      connection.providerDomain === input.providerDomain
+      connection.providerDomain === input.providerDomain &&
+      (!input.personalSlack || connection.metadata.mcpUrl === input.mcpUrl)
       ? connection
       : null;
   }
   const visible = await listConnectionsMetadata(db, input.workspaceId, input.subjectId);
-  return (
-    visible.find(
-      (connection) =>
-        connection.subjectId === input.subjectId &&
-        connection.kind === "oauth2" &&
-        connection.status === "active" &&
-        connection.providerDomain === input.providerDomain,
-    ) ?? null
+  const matching = visible.filter(
+    (connection) =>
+      connection.subjectId === input.subjectId &&
+      connection.kind === "oauth2" &&
+      connection.providerDomain === input.providerDomain &&
+      (!input.personalSlack || connection.metadata.mcpUrl === input.mcpUrl),
   );
+  if (input.personalSlack) {
+    return selectCanonicalPersonalSlackConnection(matching);
+  }
+  return matching.find((connection) => connection.status === "active") ?? null;
 }
 
 function buildAuthorizationUrl(input: {
@@ -1300,6 +1308,13 @@ function callbackReturnPath(
   for (const [key, value] of Object.entries(params)) {
     url.searchParams.set(key, value);
   }
+  // Defense in depth: a `//host` pathname becomes a protocol-relative absolute
+  // Location — an open redirect from the unauthenticated callback.
+  if (url.pathname.startsWith("//")) {
+    const fallback = new URL("/integrations", "https://opengeni.local");
+    fallback.search = url.search;
+    return `${fallback.pathname}${fallback.search}`;
+  }
   return `${url.pathname}${url.search}${url.hash}`;
 }
 
@@ -1357,7 +1372,9 @@ function safeReturnPath(value: string): string {
     throw new HTTPException(400, { message: "OAuth returnPath must be a relative path" });
   }
   const parsed = new URL(value, "https://opengeni.local");
-  if (parsed.origin !== "https://opengeni.local") {
+  // `..` segments can normalize back into a `//host` prefix, which browsers
+  // resolve as a protocol-relative absolute URL. Reject the NORMALIZED path.
+  if (parsed.origin !== "https://opengeni.local" || parsed.pathname.startsWith("//")) {
     throw new HTTPException(400, { message: "OAuth returnPath must be a relative path" });
   }
   return `${parsed.pathname}${parsed.search}${parsed.hash}`;

package/src/integrations/slack-bot.ts

@@ -153,7 +153,10 @@ type SlackBotContext = {
 };
 
 export class SlackBotProviderError extends Error {
-  constructor(readonly code: string) {
+  constructor(
+    readonly code: string,
+    readonly retryAfterMs: number | null = null,
+  ) {
     super(`Slack bot request failed: ${safeSlackCode(code)}`);
     this.name = "SlackBotProviderError";
   }
@@ -735,7 +738,10 @@ export class OpenGeniSlackBotClient {
       channel: channelId,
     });
     const projected = projectChannel(payload.channel);
-    if (!projected || projected.isMember !== true) {
+    // Slack omits `is_member` for a bot's one-to-one App Home conversation.
+    // A successful conversations.info response with `is_im` is itself proof
+    // that this installation can address that direct conversation.
+    if (!projected || (projected.isMember !== true && projected.isDirectMessage !== true)) {
       throw new SlackBotProviderError("not_in_channel");
     }
     return projected;
@@ -1186,8 +1192,9 @@ async function slackApiFetchWithHeaders(
     throw new SlackBotProviderError("transport_error");
   }
   if (!response.ok) {
+    const retryAfterMs = slackRetryAfterMs(response);
     await response.body?.cancel().catch(() => undefined);
-    throw new SlackBotProviderError(`http_${response.status}`);
+    throw new SlackBotProviderError(`http_${response.status}`, retryAfterMs);
   }
   let payload: SlackPayload;
   try {
@@ -1205,6 +1212,15 @@ async function slackApiFetchWithHeaders(
   return { response, payload };
 }
 
+function slackRetryAfterMs(response: Response): number | null {
+  if (response.status !== 429) return null;
+  const raw = response.headers.get("retry-after");
+  if (!raw || !/^\d+$/.test(raw)) return null;
+  const seconds = Number(raw);
+  if (!Number.isSafeInteger(seconds) || seconds < 1) return null;
+  return Math.min(seconds, 3_600) * 1_000;
+}
+
 function assertOpenGeniSlackBotScopes(grantedScopes: string[]): void {
   const policy = evaluateOpenGeniSlackBotScopes(grantedScopes);
   if (!policy.accepted) {
@@ -1245,6 +1261,7 @@ function projectChannel(value: unknown) {
     name: boundedSlackString(channel.name, 256),
     isPrivate: channel.is_private === true,
     isMember: channel.is_member === true,
+    isDirectMessage: channel.is_im === true,
     isArchived: channel.is_archived === true,
     topic: boundedSlackString(slackRecord(channel.topic)?.value, 1_024),
     purpose: boundedSlackString(slackRecord(channel.purpose)?.value, 1_024),