@openrig/cli 0.4.4 → 0.4.7

package/dist/slack/queue-bridge.js

@@ -0,0 +1,114 @@
+// Slice-11 slack-connector — fleet access via the `rig` CLI ONLY.
+//
+// The connector NEVER imports daemon internals; it shells out to `rig queue`
+// exactly like the reference relay (which ssh'd `rig queue` to the box). That
+// keeps it transport-agnostic (local daemon via OPENRIG_URL, a registered
+// remote via `--host`, or an ssh wrapper) and honors the secret-host axis
+// (item 10): connector-host may differ from the queue/alert host.
+//
+// Productization fix over the reference (proven firsthand): reads use `-A`
+// (all-rigs), because bare `rig queue list --json` is CURRENT-RIG only and
+// silently misses cross-rig human-destined alerts.
+import { execFile } from "node:child_process";
+import { isHumanSeatSessionRef } from "../session-name.js";
+/**
+ * Default runner: spawn the configured `rig` binary. `env` carries OPENRIG_URL
+ * (or nothing, letting rig resolve the local daemon); `baseArgs` can inject
+ * `--host <id>` for a registered remote queue. No shell — argv only.
+ */
+export function makeExecRunner(opts) {
+    return (args) => new Promise((resolve) => {
+        execFile(opts.rigBin, [...(opts.baseArgs ?? []), ...args], { timeout: opts.timeoutMs ?? 30000, env: opts.env ?? process.env, maxBuffer: 16 * 1024 * 1024 }, (err, stdout, stderr) => {
+            resolve({
+                ok: !err,
+                stdout: String(stdout ?? ""),
+                stderr: String(stderr ?? ""),
+                code: err && typeof err.code === "number" ? err.code : err ? 1 : 0,
+            });
+        });
+    });
+}
+function parseArray(stdout) {
+    let j;
+    try {
+        j = JSON.parse(stdout);
+    }
+    catch {
+        throw new Error("queue list: non-JSON output");
+    }
+    if (Array.isArray(j))
+        return j;
+    const o = j;
+    return o.qitems ?? o.items ?? [];
+}
+/**
+ * PURE: select the qitems that should alert a human. A qitem alerts iff it is
+ * active, carries the alert tag, AND targets a human — either an explicit
+ * configured destination, a human-seat session name, or tier `human-gate`.
+ */
+export function filterHumanAlerts(items, opts) {
+    const active = new Set(["pending", "in-progress", "blocked"]);
+    const allow = new Set(opts.destinations ?? []);
+    return items.filter((q) => {
+        if (q.state && !active.has(q.state))
+            return false;
+        if (!(q.tags ?? []).includes(opts.alertTag))
+            return false;
+        const dest = q.destinationSession ?? "";
+        const isHuman = allow.size > 0 ? allow.has(dest) : isHumanSeatSessionRef(dest) || q.tier === "human-gate";
+        return isHuman;
+    });
+}
+// Cross-host queue targeting is via OPENRIG_URL on the runner's env (supported
+// by ALL queue verbs), NOT `--host` — `queue list`/`queue show` reject `--host`
+// (only write/handoff verbs accept it). See makeExecRunner env / config.queueUrl.
+// `queue list` defaults to --limit 100 and ALWAYS sends it, so an unbounded read
+// silently truncates a large backlog (the B5 defect). Pass an explicit high
+// limit so enable-time seeding + outbound see the COMPLETE matching set.
+export const QUEUE_LIST_LIMIT = 100000;
+/** Read active human alerts across ALL rigs (the -A scope fix) with a full-backlog limit. */
+export async function listHumanAlerts(runner, opts) {
+    const r = await runner(["queue", "list", "-A", "--limit", String(QUEUE_LIST_LIMIT), "--json"]);
+    if (!r.ok)
+        throw new Error(`rig queue list failed (code ${r.code}): ${r.stderr.slice(0, 200)}`);
+    return filterHumanAlerts(parseArray(r.stdout), opts);
+}
+/** Full single-item read (list omits/bounds body — item 9 N+1). */
+export async function showFull(runner, qitemId) {
+    const r = await runner(["queue", "show", qitemId, "--full", "--json"]);
+    if (!r.ok)
+        return null;
+    try {
+        return JSON.parse(r.stdout);
+    }
+    catch {
+        return null;
+    }
+}
+/** Create a qitem (inbound landing). Returns the created qitem id, or throws. */
+export async function createQitem(runner, input) {
+    const args = [
+        "queue",
+        "create",
+        "--source",
+        input.source,
+        "--destination",
+        input.destination,
+        "--priority",
+        input.priority ?? "routine",
+        "--tags",
+        (input.tags ?? ["founder-slack", "inbound"]).join(","),
+        "--summary",
+        input.summary,
+        "--body",
+        input.body,
+    ];
+    const r = await runner(args);
+    if (!r.ok)
+        throw new Error(`rig queue create failed (code ${r.code}): ${r.stderr.slice(0, 200) || r.stdout.slice(0, 200)}`);
+    const id = (r.stdout.match(/qitem-[a-z0-9-]+/) ?? [])[0];
+    if (!id)
+        throw new Error("rig queue create: no qitem id in output");
+    return id;
+}
+//# sourceMappingURL=queue-bridge.js.map

package/dist/slack/queue-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"queue-bridge.js","sourceRoot":"","sources":["../../src/slack/queue-bridge.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,0EAA0E;AAC1E,0EAA0E;AAC1E,kEAAkE;AAClE,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,mDAAmD;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAY3D;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAK9B;IACC,OAAO,CAAC,IAAI,EAAE,EAAE,CACd,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACtB,QAAQ,CACN,IAAI,CAAC,MAAM,EACX,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,EACnC,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,IAAI,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,EAC/F,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACtB,OAAO,CAAC;gBACN,EAAE,EAAE,CAAC,GAAG;gBACR,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;gBAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;gBAC5B,IAAI,EAAE,GAAG,IAAI,OAAQ,GAAyB,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAE,GAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;aAChH,CAAC,CAAC;QACL,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC;AAaD,SAAS,UAAU,CAAC,MAAc;IAChC,IAAI,CAAU,CAAC;IACf,IAAI,CAAC;QACH,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAgB,CAAC;IAC9C,MAAM,CAAC,GAAG,CAAkD,CAAC;IAC7D,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;AACnC,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAkB,EAAE,IAAqB;IACzE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACxB,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAClD,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1D,MAAM,IAAI,GAAG,CAAC,CAAC,kBAAkB,IAAI,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,YAAY,CAAC;QAC1G,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,+EAA+E;AAC/E,gFAAgF;AAChF,kFAAkF;AAElF,iFAAiF;AACjF,4EAA4E;AAC5E,yEAAyE;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEvC,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAmB,EAAE,IAAqB;IAC9E,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/F,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAChG,OAAO,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAmB,EAAE,OAAe;IACjE,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAc,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAWD,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAmB,EAAE,KAAuB;IAC5E,MAAM,IAAI,GAAG;QACX,OAAO;QACP,QAAQ;QACR,UAAU;QACV,KAAK,CAAC,MAAM;QACZ,eAAe;QACf,KAAK,CAAC,WAAW;QACjB,YAAY;QACZ,KAAK,CAAC,QAAQ,IAAI,SAAS;QAC3B,QAAQ;QACR,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACtD,WAAW;QACX,KAAK,CAAC,OAAO;QACb,QAAQ;QACR,KAAK,CAAC,IAAI;KACX,CAAC;IACF,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5H,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IACpE,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/slack/secrets.d.ts

@@ -0,0 +1,21 @@
+export interface SecretFsOps {
+    readFileSync(p: string): string;
+    statMode(p: string): number | null;
+}
+export declare const nodeSecretFs: SecretFsOps;
+/** Parse KEY=VALUE lines (quotes trimmed). Blank lines / #comments ignored. */
+export declare function parseEnvFile(text: string): Record<string, string>;
+export interface SecretLookupOpts {
+    envFile?: string;
+    env?: NodeJS.ProcessEnv;
+    fsops?: SecretFsOps;
+}
+/** Warn if the env file is group/world readable (item 10 hygiene). Returns a warning string or null. */
+export declare function checkEnvFilePermissions(envFile: string, fsops?: SecretFsOps): string | null;
+/**
+ * Resolve a secret by logical name. Precedence: explicit env var (OPENRIG_SLACK_<NAME>
+ * or the raw name) → env-file key. Returns null when unresolved (honest: callers
+ * report "unconfigured", they do NOT fabricate). Never logs the value.
+ */
+export declare function resolveSecret(name: string, opts?: SecretLookupOpts): string | null;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/slack/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/slack/secrets.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,WAAW;IAC1B,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAChC,QAAQ,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;CACpC;AAED,eAAO,MAAM,YAAY,EAAE,WAS1B,CAAC;AAEF,+EAA+E;AAC/E,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAYjE;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,CAAC,EAAE,WAAW,CAAC;CACrB;AAED,wGAAwG;AACxG,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,GAAE,WAA0B,GAAG,MAAM,GAAG,IAAI,CAKzG;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,gBAAqB,GAAG,MAAM,GAAG,IAAI,CAmBtF"}

package/dist/slack/secrets.js

@@ -0,0 +1,73 @@
+// Slice-11 slack-connector — secret resolution (item 7 + 10).
+//
+// Secrets (Slack bot token / app-level token / incoming-webhook URL) resolve
+// from EITHER an OPENRIG_SLACK_* environment variable OR a 0600 env file, at
+// call time — NEVER stored in the connector config file, NEVER in the repo,
+// NEVER logged. Mirrors the daemon's bearer_file/activity-hook-token posture.
+// The env file lives on the TRUSTED host (item 10 secret-host axis); it may be
+// a different host from the queue/alert host.
+import fs from "node:fs";
+export const nodeSecretFs = {
+    readFileSync: (p) => fs.readFileSync(p, "utf8"),
+    statMode: (p) => {
+        try {
+            return fs.statSync(p).mode & 0o777;
+        }
+        catch {
+            return null;
+        }
+    },
+};
+/** Parse KEY=VALUE lines (quotes trimmed). Blank lines / #comments ignored. */
+export function parseEnvFile(text) {
+    const out = {};
+    for (const line of text.split("\n")) {
+        const t = line.trim();
+        if (!t || t.startsWith("#") || !t.includes("="))
+            continue;
+        const i = t.indexOf("=");
+        out[t.slice(0, i).trim()] = t
+            .slice(i + 1)
+            .trim()
+            .replace(/^"|"$/g, "");
+    }
+    return out;
+}
+/** Warn if the env file is group/world readable (item 10 hygiene). Returns a warning string or null. */
+export function checkEnvFilePermissions(envFile, fsops = nodeSecretFs) {
+    const mode = fsops.statMode(envFile);
+    if (mode === null)
+        return null; // absent — a separate "unconfigured" concern
+    if (mode & 0o077)
+        return `secret env file ${envFile} is mode ${mode.toString(8)} — should be 0600 (group/other must not read secrets)`;
+    return null;
+}
+/**
+ * Resolve a secret by logical name. Precedence: explicit env var (OPENRIG_SLACK_<NAME>
+ * or the raw name) → env-file key. Returns null when unresolved (honest: callers
+ * report "unconfigured", they do NOT fabricate). Never logs the value.
+ */
+export function resolveSecret(name, opts = {}) {
+    const env = opts.env ?? process.env;
+    const fsops = opts.fsops ?? nodeSecretFs;
+    // Aliases: the raw name (e.g. SLACK_WEBHOOK_URL) and the OPENRIG_-prefixed
+    // form (OPENRIG_SLACK_WEBHOOK_URL). NOT OPENRIG_SLACK_<name> — that would
+    // double the SLACK_ segment (the B4 defect).
+    const envKeys = [name, `OPENRIG_${name.replace(/[^A-Za-z0-9]/g, "_").toUpperCase()}`];
+    for (const k of envKeys) {
+        if (env[k])
+            return env[k];
+    }
+    if (opts.envFile) {
+        try {
+            const map = parseEnvFile(fsops.readFileSync(opts.envFile));
+            if (map[name])
+                return map[name];
+        }
+        catch {
+            /* absent/unreadable → null */
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=secrets.js.map

package/dist/slack/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/slack/secrets.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,4EAA4E;AAC5E,8EAA8E;AAC9E,+EAA+E;AAC/E,8CAA8C;AAC9C,OAAO,EAAE,MAAM,SAAS,CAAC;AAOzB,MAAM,CAAC,MAAM,YAAY,GAAgB;IACvC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC;IAC/C,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;QACd,IAAI,CAAC;YACH,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF,CAAC;AAEF,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QAC1D,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACzB,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC;aAC1B,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;aACZ,IAAI,EAAE;aACN,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAQD,wGAAwG;AACxG,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,QAAqB,YAAY;IACxF,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,6CAA6C;IAC7E,IAAI,IAAI,GAAG,KAAK;QAAE,OAAO,mBAAmB,OAAO,YAAY,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,uDAAuD,CAAC;IACvI,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAAyB,EAAE;IACrE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAC;IACzC,2EAA2E;IAC3E,0EAA0E;IAC1E,6CAA6C;IAC7C,MAAM,OAAO,GAAG,CAAC,IAAI,EAAE,WAAW,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACtF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC,CAAC,CAAE,CAAC;IAC7B,CAAC;IACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3D,IAAI,GAAG,CAAC,IAAI,CAAC;gBAAE,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,8BAA8B;QAChC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/slack/slack-api.d.ts

@@ -0,0 +1,49 @@
+export type FetchImpl = (url: string, init?: RequestInit) => Promise<Response>;
+export interface HttpResult {
+    ok: boolean;
+    status: number;
+    error?: string;
+}
+/**
+ * Post to a Slack incoming webhook. Fail-VISIBLE (item 3): any non-2xx or
+ * transport error returns ok:false with a bounded error string — the caller
+ * logs loudly and does NOT mark the alert seen (so it retries, never a silent drop).
+ */
+export declare function postWebhook(url: string, payload: unknown, fetchImpl?: FetchImpl, timeoutMs?: number): Promise<HttpResult>;
+export interface WebApiResult {
+    ok: boolean;
+    status: number;
+    grantedScopes: string[];
+    json: Record<string, unknown>;
+    error?: string;
+}
+/** Call a Slack Web API method (Bearer token) and surface the granted-scope header. */
+export declare function callWebApi(method: string, token: string, body: Record<string, unknown>, fetchImpl?: FetchImpl, timeoutMs?: number): Promise<WebApiResult>;
+/** Item 5: read the ACTUAL granted scopes from the response header (configured != granted). */
+export declare function getGrantedScopes(token: string, fetchImpl?: FetchImpl, timeoutMs?: number): Promise<{
+    ok: boolean;
+    granted: string[];
+    error?: string;
+}>;
+export interface ScopeVerdict {
+    ok: boolean;
+    granted: string[];
+    missing: string[];
+    error?: string;
+}
+/** Item 5: verify the token actually HAS the required scopes (from the header, not config). */
+export declare function verifyScopes(token: string, required: string[], fetchImpl?: FetchImpl, timeoutMs?: number): Promise<ScopeVerdict>;
+/** Item 5: verify the bot is actually a MEMBER of the channel before inbound-ready. */
+export declare function verifyChannelMembership(token: string, channel: string, fetchImpl?: FetchImpl, timeoutMs?: number): Promise<{
+    ok: boolean;
+    isMember: boolean;
+    name?: string;
+    error?: string;
+}>;
+/** Inbound Socket Mode: open a WebSocket URL via apps.connections.open (app-level xapp token). */
+export declare function openSocketConnection(appToken: string, fetchImpl?: FetchImpl, timeoutMs?: number): Promise<{
+    ok: boolean;
+    url?: string;
+    error?: string;
+}>;
+//# sourceMappingURL=slack-api.d.ts.map

package/dist/slack/slack-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-api.d.ts","sourceRoot":"","sources":["../../src/slack/slack-api.ts"],"names":[],"mappings":"AAcA,MAAM,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAK/E,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAYD;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,OAAO,EAChB,SAAS,GAAE,SAAwB,EACnC,SAAS,SAAqB,GAC7B,OAAO,CAAC,UAAU,CAAC,CAkBrB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,uFAAuF;AACvF,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,SAAS,GAAE,SAAwB,EACnC,SAAS,SAAqB,GAC7B,OAAO,CAAC,YAAY,CAAC,CA0BvB;AAED,+FAA+F;AAC/F,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,MAAM,EACb,SAAS,GAAE,SAAwB,EACnC,SAAS,SAAqB,GAC7B,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAG7D;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,+FAA+F;AAC/F,wBAAsB,YAAY,CAChC,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAAE,EAClB,SAAS,GAAE,SAAwB,EACnC,SAAS,SAAqB,GAC7B,OAAO,CAAC,YAAY,CAAC,CAMvB;AAED,uFAAuF;AACvF,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,SAAS,GAAE,SAAwB,EACnC,SAAS,SAAqB,GAC7B,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAK5E;AAED,kGAAkG;AAClG,wBAAsB,oBAAoB,CACxC,QAAQ,EAAE,MAAM,EAChB,SAAS,GAAE,SAAwB,EACnC,SAAS,SAAqB,GAC7B,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAIxD"}

package/dist/slack/slack-api.js

@@ -0,0 +1,110 @@
+// Slice-11 slack-connector — Slack HTTP client.
+//
+// `fetch`-based (http/https agnostic + injectable) matching the daemon's
+// WebhookNotificationAdapter + its fake-fetch test pattern; every call is
+// bounded by an explicit timeout with a structured failure result (never
+// throws past the boundary, never hangs) — the remote-daemon-http discipline.
+//
+// Item 5 (the setup-scope trap): Slack's "Add New Webhook" grants ONLY the
+// webhook scope; configured bot scopes are NOT granted until a full reinstall,
+// with no warning. The ONLY proof of granted scopes is the `x-oauth-scopes`
+// RESPONSE HEADER on a real API call — configured != granted. getGrantedScopes()
+// reads exactly that header. Channel membership is likewise verified live
+// (conversations.info.is_member) before declaring inbound ready.
+const defaultFetch = (url, init) => fetch(url, init);
+const DEFAULT_TIMEOUT_MS = 15000;
+async function withTimeout(timeoutMs, run) {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(new Error(`timeout after ${timeoutMs}ms`)), timeoutMs);
+    try {
+        return await run(ctrl.signal);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Post to a Slack incoming webhook. Fail-VISIBLE (item 3): any non-2xx or
+ * transport error returns ok:false with a bounded error string — the caller
+ * logs loudly and does NOT mark the alert seen (so it retries, never a silent drop).
+ */
+export async function postWebhook(url, payload, fetchImpl = defaultFetch, timeoutMs = DEFAULT_TIMEOUT_MS) {
+    try {
+        return await withTimeout(timeoutMs, async (signal) => {
+            const res = await fetchImpl(url, {
+                method: "POST",
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify(payload),
+                signal,
+            });
+            if (!res.ok) {
+                const text = await res.text().catch(() => "");
+                return { ok: false, status: res.status, error: `slack ${res.status}: ${text.slice(0, 160)}` };
+            }
+            return { ok: true, status: res.status };
+        });
+    }
+    catch (e) {
+        return { ok: false, status: 0, error: `webhook transport: ${e.message}` };
+    }
+}
+/** Call a Slack Web API method (Bearer token) and surface the granted-scope header. */
+export async function callWebApi(method, token, body, fetchImpl = defaultFetch, timeoutMs = DEFAULT_TIMEOUT_MS) {
+    try {
+        return await withTimeout(timeoutMs, async (signal) => {
+            const res = await fetchImpl(`https://slack.com/api/${method}`, {
+                method: "POST",
+                headers: { authorization: `Bearer ${token}`, "content-type": "application/json; charset=utf-8" },
+                body: JSON.stringify(body),
+                signal,
+            });
+            const scopeHeader = res.headers.get("x-oauth-scopes") ?? "";
+            const grantedScopes = scopeHeader
+                .split(",")
+                .map((s) => s.trim())
+                .filter(Boolean);
+            let json = {};
+            try {
+                json = (await res.json());
+            }
+            catch {
+                /* non-JSON */
+            }
+            const ok = res.ok && json.ok === true;
+            return { ok, status: res.status, grantedScopes, json, error: ok ? undefined : String(json.error ?? `http ${res.status}`) };
+        });
+    }
+    catch (e) {
+        return { ok: false, status: 0, grantedScopes: [], json: {}, error: `web-api transport: ${e.message}` };
+    }
+}
+/** Item 5: read the ACTUAL granted scopes from the response header (configured != granted). */
+export async function getGrantedScopes(token, fetchImpl = defaultFetch, timeoutMs = DEFAULT_TIMEOUT_MS) {
+    const r = await callWebApi("auth.test", token, {}, fetchImpl, timeoutMs);
+    return { ok: r.ok, granted: r.grantedScopes, error: r.error };
+}
+/** Item 5: verify the token actually HAS the required scopes (from the header, not config). */
+export async function verifyScopes(token, required, fetchImpl = defaultFetch, timeoutMs = DEFAULT_TIMEOUT_MS) {
+    const g = await getGrantedScopes(token, fetchImpl, timeoutMs);
+    if (!g.ok)
+        return { ok: false, granted: g.granted, missing: required, error: g.error };
+    const grantedSet = new Set(g.granted);
+    const missing = required.filter((s) => !grantedSet.has(s));
+    return { ok: missing.length === 0, granted: g.granted, missing };
+}
+/** Item 5: verify the bot is actually a MEMBER of the channel before inbound-ready. */
+export async function verifyChannelMembership(token, channel, fetchImpl = defaultFetch, timeoutMs = DEFAULT_TIMEOUT_MS) {
+    const r = await callWebApi("conversations.info", token, { channel }, fetchImpl, timeoutMs);
+    if (!r.ok)
+        return { ok: false, isMember: false, error: r.error };
+    const ch = (r.json.channel ?? {});
+    return { ok: true, isMember: ch.is_member === true, name: ch.name };
+}
+/** Inbound Socket Mode: open a WebSocket URL via apps.connections.open (app-level xapp token). */
+export async function openSocketConnection(appToken, fetchImpl = defaultFetch, timeoutMs = DEFAULT_TIMEOUT_MS) {
+    const r = await callWebApi("apps.connections.open", appToken, {}, fetchImpl, timeoutMs);
+    if (!r.ok)
+        return { ok: false, error: r.error };
+    return { ok: true, url: r.json.url };
+}
+//# sourceMappingURL=slack-api.js.map

package/dist/slack/slack-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-api.js","sourceRoot":"","sources":["../../src/slack/slack-api.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,yEAAyE;AACzE,0EAA0E;AAC1E,yEAAyE;AACzE,8EAA8E;AAC9E,EAAE;AACF,2EAA2E;AAC3E,+EAA+E;AAC/E,4EAA4E;AAC5E,iFAAiF;AACjF,0EAA0E;AAC1E,iEAAiE;AAIjE,MAAM,YAAY,GAAc,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAChE,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAQjC,KAAK,UAAU,WAAW,CAAI,SAAiB,EAAE,GAAwC;IACvF,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,iBAAiB,SAAS,IAAI,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACjG,IAAI,CAAC;QACH,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAW,EACX,OAAgB,EAChB,YAAuB,YAAY,EACnC,SAAS,GAAG,kBAAkB;IAE9B,IAAI,CAAC;QACH,OAAO,MAAM,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACnD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;gBAC/B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;gBAC7B,MAAM;aACP,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC;YAChG,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;QAC1C,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,sBAAuB,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC;IACvF,CAAC;AACH,CAAC;AAUD,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAc,EACd,KAAa,EACb,IAA6B,EAC7B,YAAuB,YAAY,EACnC,SAAS,GAAG,kBAAkB;IAE9B,IAAI,CAAC;QACH,OAAO,MAAM,WAAW,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACnD,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,yBAAyB,MAAM,EAAE,EAAE;gBAC7D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,cAAc,EAAE,iCAAiC,EAAE;gBAChG,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM;aACP,CAAC,CAAC;YACH,MAAM,WAAW,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;YAC5D,MAAM,aAAa,GAAG,WAAW;iBAC9B,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,MAAM,CAAC,OAAO,CAAC,CAAC;YACnB,IAAI,IAAI,GAA4B,EAAE,CAAC;YACvC,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;YACD,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC;YACtC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;QAC7H,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,aAAa,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,sBAAuB,CAAW,CAAC,OAAO,EAAE,EAAE,CAAC;IACpH,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,KAAa,EACb,YAAuB,YAAY,EACnC,SAAS,GAAG,kBAAkB;IAE9B,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IACzE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;AAChE,CAAC;AASD,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,KAAa,EACb,QAAkB,EAClB,YAAuB,YAAY,EACnC,SAAS,GAAG,kBAAkB;IAE9B,MAAM,CAAC,GAAG,MAAM,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACvF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3D,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;AACnE,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAa,EACb,OAAe,EACf,YAAuB,YAAY,EACnC,SAAS,GAAG,kBAAkB;IAE9B,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,oBAAoB,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAC3F,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IACjE,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAA2C,CAAC;IAC5E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC,SAAS,KAAK,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;AACtE,CAAC;AAED,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,QAAgB,EAChB,YAAuB,YAAY,EACnC,SAAS,GAAG,kBAAkB;IAE9B,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,uBAAuB,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IACxF,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;IAChD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,GAAa,EAAE,CAAC;AACjD,CAAC"}

package/dist/slack/state-store.d.ts

@@ -0,0 +1,62 @@
+export interface StateFsOps {
+    readFileSync(p: string): string;
+    appendFileSync(p: string, data: string): void;
+    writeFileSync(p: string, data: string): void;
+    rename(from: string, to: string): void;
+    mkdirp(dir: string): void;
+}
+export declare const nodeStateFs: StateFsOps;
+export interface SeenRecord {
+    id: string;
+    ts: string;
+    status: string;
+}
+/**
+ * Delivery-dedup log. `load()` reads the durable set from disk; `mark()` appends
+ * AFTER the guarded side effect. Idempotent on id: a repeated id collapses in
+ * `load()`'s Set, and callers gate the side effect on `!seen.has(id)` so a
+ * duplicate is never re-delivered within a run.
+ */
+export declare class SeenStore {
+    private readonly file;
+    private readonly fsops;
+    private readonly now;
+    constructor(file: string, fsops?: StateFsOps, now?: () => Date);
+    load(): Set<string>;
+    /** Append a seen record. MUST be called only after the guarded side effect succeeds. */
+    mark(id: string, status: string): void;
+    /**
+     * Seed existing ids as already-seen WITHOUT triggering the side effect
+     * (locked item 9: enable-time backlog seeds as history, zero replay storm).
+     */
+    seed(ids: string[], status?: string): number;
+}
+export interface DeadLetterEntry<T = unknown> {
+    ev: T;
+    at: string;
+    attempts: number;
+}
+/**
+ * Inbound never-drop net. Every event that fails to land is appended
+ * (attempt-counted) BEFORE the error path returns.
+ *
+ * INTERRUPTION-SAFE retry (the B2 fix): retry does NOT truncate first. The
+ * caller `readAll()`s (non-destructive), attempts each, then `replaceAll()`s the
+ * file with ONLY the still-failing entries via an atomic temp-write + rename. So
+ * the durable file always reflects the unrecovered set: a crash at ANY point
+ * before the rename leaves the ORIGINAL file fully intact (at-least-once — a
+ * since-landed event is skipped on re-read via the seen-set, so not even a dup).
+ * There is no truncate-before-success window.
+ */
+export declare class DeadLetterStore<T = unknown> {
+    private readonly file;
+    private readonly fsops;
+    private readonly now;
+    constructor(file: string, fsops?: StateFsOps, now?: () => Date);
+    append(ev: T, attempts: number): void;
+    /** Non-destructive read of all durable entries. */
+    readAll(): DeadLetterEntry<T>[];
+    /** Atomically replace the durable set (temp-write + rename). Used after a retry pass. */
+    replaceAll(entries: DeadLetterEntry<T>[]): void;
+}
+//# sourceMappingURL=state-store.d.ts.map

package/dist/slack/state-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-store.d.ts","sourceRoot":"","sources":["../../src/slack/state-store.ts"],"names":[],"mappings":"AAmBA,MAAM,WAAW,UAAU;IACzB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAChC,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9C,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7C,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,eAAO,MAAM,WAAW,EAAE,UAQzB,CAAC;AAiBF,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,qBAAa,SAAS;IAElB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAFH,IAAI,EAAE,MAAM,EACZ,KAAK,GAAE,UAAwB,EAC/B,GAAG,GAAE,MAAM,IAAuB;IAGrD,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC;IAUnB,wFAAwF;IACxF,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAKtC;;;OAGG;IACH,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,MAAM,SAAW,GAAG,MAAM;CAQ/C;AAED,MAAM,WAAW,eAAe,CAAC,CAAC,GAAG,OAAO;IAC1C,EAAE,EAAE,CAAC,CAAC;IACN,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,eAAe,CAAC,CAAC,GAAG,OAAO;IAEpC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAFH,IAAI,EAAE,MAAM,EACZ,KAAK,GAAE,UAAwB,EAC/B,GAAG,GAAE,MAAM,IAAuB;IAGrD,MAAM,CAAC,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;IAQrC,mDAAmD;IACnD,OAAO,IAAI,eAAe,CAAC,CAAC,CAAC,EAAE;IAU/B,yFAAyF;IACzF,UAAU,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI;CAOhD"}

package/dist/slack/state-store.js

@@ -0,0 +1,132 @@
+// Slice-11 slack-connector — durable, restart-surviving state.
+//
+// Two append-only JSONL stores, both written to disk so they survive BOTH a
+// connector restart AND a queue-daemon restart (locked item 2 + item 8):
+//   - SeenStore     : delivery-dedup by id; a line is appended ONLY AFTER the
+//                     side effect succeeds (outbound: after a 200 from Slack;
+//                     inbound: after the durable qitem exists). At-least-once —
+//                     a crash between success and append re-delivers a
+//                     BYTE-IDENTICAL duplicate next run, never a drop.
+//   - DeadLetterStore : the inbound never-drop net. An event that fails to land
+//                     in the queue is appended (attempt-counted) BEFORE the
+//                     failure path returns; drain() truncates and hands the
+//                     lines back so the caller re-appends any that fail again
+//                     ("zero-drop means zero, not zero-until-the-second-failure").
+//
+// FS + clock are injected so the whole thing is unit-testable with no real disk.
+import fs from "node:fs";
+import path from "node:path";
+export const nodeStateFs = {
+    readFileSync: (p) => fs.readFileSync(p, "utf8"),
+    appendFileSync: (p, d) => fs.appendFileSync(p, d),
+    writeFileSync: (p, d) => fs.writeFileSync(p, d),
+    rename: (from, to) => fs.renameSync(from, to),
+    mkdirp: (dir) => {
+        fs.mkdirSync(dir, { recursive: true });
+    },
+};
+function parseLines(raw) {
+    return raw
+        .trim()
+        .split("\n")
+        .filter(Boolean)
+        .map((l) => {
+        try {
+            return JSON.parse(l);
+        }
+        catch {
+            return null; // tolerate a torn final line from a crash mid-append
+        }
+    })
+        .filter((x) => x !== null);
+}
+/**
+ * Delivery-dedup log. `load()` reads the durable set from disk; `mark()` appends
+ * AFTER the guarded side effect. Idempotent on id: a repeated id collapses in
+ * `load()`'s Set, and callers gate the side effect on `!seen.has(id)` so a
+ * duplicate is never re-delivered within a run.
+ */
+export class SeenStore {
+    file;
+    fsops;
+    now;
+    constructor(file, fsops = nodeStateFs, now = () => new Date()) {
+        this.file = file;
+        this.fsops = fsops;
+        this.now = now;
+    }
+    load() {
+        let raw;
+        try {
+            raw = this.fsops.readFileSync(this.file);
+        }
+        catch {
+            return new Set();
+        }
+        return new Set(parseLines(raw).map((r) => r.id).filter((id) => typeof id === "string"));
+    }
+    /** Append a seen record. MUST be called only after the guarded side effect succeeds. */
+    mark(id, status) {
+        this.fsops.mkdirp(path.dirname(this.file));
+        this.fsops.appendFileSync(this.file, JSON.stringify({ id, ts: this.now().toISOString(), status }) + "\n");
+    }
+    /**
+     * Seed existing ids as already-seen WITHOUT triggering the side effect
+     * (locked item 9: enable-time backlog seeds as history, zero replay storm).
+     */
+    seed(ids, status = "seeded") {
+        if (ids.length === 0)
+            return 0;
+        this.fsops.mkdirp(path.dirname(this.file));
+        const at = this.now().toISOString();
+        const chunk = ids.map((id) => JSON.stringify({ id, ts: at, status })).join("\n") + "\n";
+        this.fsops.appendFileSync(this.file, chunk);
+        return ids.length;
+    }
+}
+/**
+ * Inbound never-drop net. Every event that fails to land is appended
+ * (attempt-counted) BEFORE the error path returns.
+ *
+ * INTERRUPTION-SAFE retry (the B2 fix): retry does NOT truncate first. The
+ * caller `readAll()`s (non-destructive), attempts each, then `replaceAll()`s the
+ * file with ONLY the still-failing entries via an atomic temp-write + rename. So
+ * the durable file always reflects the unrecovered set: a crash at ANY point
+ * before the rename leaves the ORIGINAL file fully intact (at-least-once — a
+ * since-landed event is skipped on re-read via the seen-set, so not even a dup).
+ * There is no truncate-before-success window.
+ */
+export class DeadLetterStore {
+    file;
+    fsops;
+    now;
+    constructor(file, fsops = nodeStateFs, now = () => new Date()) {
+        this.file = file;
+        this.fsops = fsops;
+        this.now = now;
+    }
+    append(ev, attempts) {
+        this.fsops.mkdirp(path.dirname(this.file));
+        this.fsops.appendFileSync(this.file, JSON.stringify({ ev, at: this.now().toISOString(), attempts }) + "\n");
+    }
+    /** Non-destructive read of all durable entries. */
+    readAll() {
+        let raw;
+        try {
+            raw = this.fsops.readFileSync(this.file);
+        }
+        catch {
+            return [];
+        }
+        return parseLines(raw);
+    }
+    /** Atomically replace the durable set (temp-write + rename). Used after a retry pass. */
+    replaceAll(entries) {
+        this.fsops.mkdirp(path.dirname(this.file));
+        const body = entries.map((e) => JSON.stringify(e)).join("\n") + (entries.length ? "\n" : "");
+        const tmp = `${this.file}.tmp`;
+        this.fsops.writeFileSync(tmp, body);
+        this.fsops.rename(tmp, this.file); // atomic: original intact until this instant
+    }
+}
+//# sourceMappingURL=state-store.js.map

package/dist/slack/state-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-store.js","sourceRoot":"","sources":["../../src/slack/state-store.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,EAAE;AACF,4EAA4E;AAC5E,yEAAyE;AACzE,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,uEAAuE;AACvE,uEAAuE;AACvE,gFAAgF;AAChF,4EAA4E;AAC5E,4EAA4E;AAC5E,8EAA8E;AAC9E,mFAAmF;AACnF,EAAE;AACF,iFAAiF;AACjF,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAU7B,MAAM,CAAC,MAAM,WAAW,GAAe;IACrC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC;IAC/C,cAAc,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC;IACjD,aAAa,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC;IAC/C,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;IAC7C,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE;QACd,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;CACF,CAAC;AAEF,SAAS,UAAU,CAAC,GAAW;IAC7B,OAAO,GAAG;SACP,IAAI,EAAE;SACN,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,qDAAqD;QACpE,CAAC;IACH,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAgB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AAC7C,CAAC;AAQD;;;;;GAKG;AACH,MAAM,OAAO,SAAS;IAED;IACA;IACA;IAHnB,YACmB,IAAY,EACZ,QAAoB,WAAW,EAC/B,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QAFlC,SAAI,GAAJ,IAAI,CAAQ;QACZ,UAAK,GAAL,KAAK,CAA0B;QAC/B,QAAG,GAAH,GAAG,CAA+B;IAClD,CAAC;IAEJ,IAAI;QACF,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,GAAG,EAAE,CAAC;QACnB,CAAC;QACD,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAgB,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC;IAC1G,CAAC;IAED,wFAAwF;IACxF,IAAI,CAAC,EAAU,EAAE,MAAc;QAC7B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5G,CAAC;IAED;;;OAGG;IACH,IAAI,CAAC,GAAa,EAAE,MAAM,GAAG,QAAQ;QACnC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACxF,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC5C,OAAO,GAAG,CAAC,MAAM,CAAC;IACpB,CAAC;CACF;AAQD;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,eAAe;IAEP;IACA;IACA;IAHnB,YACmB,IAAY,EACZ,QAAoB,WAAW,EAC/B,MAAkB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE;QAFlC,SAAI,GAAJ,IAAI,CAAQ;QACZ,UAAK,GAAL,KAAK,CAA0B;QAC/B,QAAG,GAAH,GAAG,CAA+B;IAClD,CAAC;IAEJ,MAAM,CAAC,EAAK,EAAE,QAAgB;QAC5B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,cAAc,CACvB,IAAI,CAAC,IAAI,EACT,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,EAAE,QAAQ,EAA+B,CAAC,GAAG,IAAI,CACnG,CAAC;IACJ,CAAC;IAED,mDAAmD;IACnD,OAAO;QACL,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO,UAAU,CAAC,GAAG,CAAyB,CAAC;IACjD,CAAC;IAED,yFAAyF;IACzF,UAAU,CAAC,OAA6B;QACtC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7F,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,MAAM,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,6CAA6C;IAClF,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openrig/cli",
-  "version": "0.4.4",
+  "version": "0.4.7",
   "type": "module",
   "description": "Local control plane for multi-agent coding topologies",
   "keywords": [