@quickchatai/quickreview 0.0.0-stage → 1.1.0

package/dist/src/slack/policy.js

@@ -0,0 +1,225 @@
+import { zoneDateString, zoneDayBounds, zonedParts } from "../eod.js";
+/**
+ * The local calendar day containing `now`, as a half-open instant window.
+ * Built from eod.ts's zone helpers so the 23h/25h DST days are exact.
+ */
+export function dayWindow(now, timeZone) {
+    const p = zonedParts(now, timeZone);
+    const { start, end } = zoneDayBounds(p.year, p.month, p.day, timeZone);
+    return {
+        day: zoneDateString(now, timeZone),
+        startIso: start.toISOString(),
+        endIso: end.toISOString(),
+    };
+}
+/** The policy-timezone day window in force for this config. */
+export function policyWindow(cfg, now) {
+    return dayWindow(now, cfg.slack.policy.timezone);
+}
+/**
+ * May this inbound Slack message become a model turn? Counts `injected`
+ * events in the policy day, channel-wide and (when the sender is known) for
+ * that one person. An unknown sender is only subject to the channel cap.
+ */
+export function decideTurn(store, cfg, input, now = new Date()) {
+    const { daily_turns, per_user_daily_turns } = cfg.slack.policy;
+    const w = policyWindow(cfg, now);
+    const used = store.slackTurnsBetween(w.startIso, w.endIso);
+    const user = input.slackUser ?? null;
+    const userUsed = user ? store.slackTurnsBetween(w.startIso, w.endIso, user) : 0;
+    const base = { day: w.day, used, userUsed };
+    if (used >= daily_turns) {
+        return {
+            ...base,
+            allow: false,
+            cap: "daily_turns",
+            reason: `Slack daily turn cap reached (${used}/${daily_turns})`,
+        };
+    }
+    if (user && userUsed >= per_user_daily_turns) {
+        return {
+            ...base,
+            allow: false,
+            cap: "per_user_daily_turns",
+            reason: `Slack per-user daily turn cap reached for ${user} (${userUsed}/${per_user_daily_turns})`,
+        };
+    }
+    return { ...base, allow: true };
+}
+/**
+ * The budget a turn refusal announces in the channel, or null when it
+ * announces none. Only the channel-wide budget is channel news: a per-user
+ * cap leaves everyone else free to ask, so telling the channel "questions
+ * resume at midnight" — and spending the day's one cap announcement on it —
+ * would be false.
+ */
+export function announcedCap(cfg, decision) {
+    return decision.cap === "daily_turns" ? cfg.slack.policy.daily_turns : null;
+}
+// The post taxonomy, in one place: `kind = 'reply'` is the ONLY conversational
+// post (a model turn stands behind it) and the only one the reply budgets
+// count. `pickup` / `verdict` / `announce` are daemon-authored and cost
+// nothing; an unprompted `announce` is bounded by `announcements_per_hour`,
+// while the thread-lifecycle posts (pickup, verdict, re-round, superseded)
+// answer one PR's real event and are bounded only by their idem key.
+/**
+ * Successful `kind = 'reply'` posts into one thread inside the window — the
+ * per-thread conversational cap.
+ *
+ * StateStore.slackThreadPostsBetween cannot express the kind filter (and
+ * src/state.ts is owned elsewhere), so this reads the same table directly, the
+ * way slack/reply.ts's `threadIsKnown` already does. It stays a pure read.
+ */
+export function threadReplyCount(store, threadTs, sinceIso, untilIso) {
+    return store.db
+        .prepare("SELECT COUNT(*) AS c FROM slack_posts WHERE ok = 1 AND kind = 'reply' AND thread_ts = ? AND posted_at >= ? AND posted_at < ?")
+        .get(threadTs, sinceIso, untilIso).c;
+}
+/**
+ * May the daemon post this reply? Three guards, cheapest first: the shared
+ * post ledger (a spent `idem_key` means the message is already in the channel
+ * — a retry must never double-post), the channel-wide daily post ceiling
+ * (`daily_turns`, since every conversational post follows a turn), and the
+ * per-thread `thread_replies_per_day`.
+ *
+ * BOTH budgets count `kind = 'reply'` ONLY. Lifecycle posts are labelled
+ * `pickup` / `verdict` / `announce`; letting them in would mean a PR that runs
+ * `thread_replies_per_day` rounds silently loses the ability to answer a human
+ * in its own thread for the rest of the day. Unprompted daemon announcements
+ * are bounded by `announcements_per_hour` instead (see decideAnnouncement);
+ * the thread-lifecycle posts by their idem key alone.
+ */
+export function decideReply(store, cfg, input, now = new Date()) {
+    const { daily_turns, thread_replies_per_day } = cfg.slack.policy;
+    const w = policyWindow(cfg, now);
+    const used = store.slackPostsBetween(w.startIso, w.endIso, "reply");
+    const threadUsed = input.threadTs
+        ? threadReplyCount(store, input.threadTs, w.startIso, w.endIso)
+        : 0;
+    const base = { day: w.day, used, threadUsed };
+    if (input.idemKey && store.slackPost(input.idemKey)) {
+        return {
+            ...base,
+            allow: false,
+            cap: "idempotent",
+            reason: `already posted (idem_key ${input.idemKey})`,
+        };
+    }
+    if (used >= daily_turns) {
+        return {
+            ...base,
+            allow: false,
+            cap: "daily_posts",
+            reason: `Slack daily post cap reached (${used}/${daily_turns})`,
+        };
+    }
+    if (input.threadTs && threadUsed >= thread_replies_per_day) {
+        return {
+            ...base,
+            allow: false,
+            cap: "thread_replies_per_day",
+            reason: `thread reply cap reached (${threadUsed}/${thread_replies_per_day})`,
+        };
+    }
+    return { ...base, allow: true };
+}
+// ---- announcement admission (cause switch + cooldown + hourly limiter) ---
+/** Per-PR cause key: one stuck PR must never silence another. */
+export function announcementKey(cause, pr) {
+    return pr === null || pr === undefined ? cause : `${cause}:${pr}`;
+}
+/** The cause's own switch + cooldown; unlisted causes take the default. */
+export function causePolicy(cfg, cause) {
+    return (cfg.slack.policy.causes[cause] ?? {
+        enabled: true,
+        cooldown_min: cfg.slack.policy.default_cooldown_min,
+    });
+}
+/**
+ * The rolling-hour announcement ceiling, read from the claimed `slack_posts`
+ * rows. EVERY daemon-authored post COUNTS here — `pickup` and `verdict` are as
+ * visible in the channel as an `announce` — but only an unprompted
+ * announcement is REFUSED by it: the thread-lifecycle posts answer one PR's
+ * real event and are never held back (announce.ts header). Expressed as "all
+ * posts minus replies" so a kind added later is counted by default rather
+ * than silently exempt. Read at admission (decideAnnouncement)
+ * AND again when an admitted announcement claims its row (announce.ts
+ * postNow): admission does not reserve a slot, so two announcements admitted
+ * before either claims would otherwise both post at cap-1.
+ */
+export function hourlyCeiling(store, cfg, now) {
+    const perHour = cfg.slack.policy.announcements_per_hour;
+    const hourAgo = new Date(now.getTime() - 3_600_000).toISOString();
+    const recent = store.slackPostsSince(hourAgo) - store.slackPostsSince(hourAgo, "reply");
+    return {
+        reached: recent >= perHour,
+        reason: `announcement rate cap reached (${recent}/${perHour} in the last hour)`,
+    };
+}
+/**
+ * Decide *and record*: on a fire the cooldown row is stamped, on a suppressed
+ * repeat the fold counter grows — the same mutate-on-decide contract as
+ * AlertPolicy.decide, so a caller can never fire without paying the cooldown.
+ * A disabled cause and an hour-limiter refusal write nothing: neither is a
+ * "we already told you", so the cause stays free to speak later.
+ */
+export function decideAnnouncement(store, cfg, input, now = new Date()) {
+    const key = announcementKey(input.cause, input.pr);
+    const policy = causePolicy(cfg, input.cause);
+    if (!policy.enabled) {
+        return {
+            allow: false,
+            key,
+            bypass: false,
+            block: "disabled",
+            reason: `cause '${input.cause}' is disabled`,
+        };
+    }
+    const ceiling = hourlyCeiling(store, cfg, now);
+    if (ceiling.reached) {
+        return {
+            allow: false,
+            key,
+            bypass: false,
+            block: "per_hour",
+            reason: ceiling.reason,
+        };
+    }
+    const w = policyWindow(cfg, now);
+    const prev = store.slackCooldown(key);
+    // A row from an earlier policy day is not "already told you today": the day
+    // rollover resets the fold counter and the escalation bypass with it.
+    const sameDay = prev !== undefined && prev.day === w.day;
+    if (!sameDay) {
+        store.recordSlackCooldownFire(key, w.day);
+        return { allow: true, key, bypass: false, folds: 0 };
+    }
+    const elapsedMin = (now.getTime() - Date.parse(prev.last_fired_at)) / 60_000;
+    if (elapsedMin >= policy.cooldown_min) {
+        store.recordSlackCooldownFire(key, w.day);
+        return { allow: true, key, bypass: false, folds: 0 };
+    }
+    if (input.escalated && prev.bypassed === 0) {
+        store.recordSlackCooldownFire(key, w.day, true);
+        return { allow: true, key, bypass: true, folds: 0 };
+    }
+    const folds = store.foldSlackCooldown(key);
+    return {
+        allow: false,
+        key,
+        bypass: false,
+        block: "cooldown",
+        reason: `cooldown for '${key}' (${elapsedMin.toFixed(1)}/${policy.cooldown_min} min, folded ×${folds})`,
+        folds,
+    };
+}
+// ---- ledger helper --------------------------------------------------------
+/**
+ * Claim an idempotence key before posting. Returns false when the key was
+ * already spent — the caller must then NOT call Slack. The row is settled with
+ * the Slack-assigned ts (or the failure) via StateStore.settleSlackPost.
+ */
+export function claimPost(store, claim) {
+    return store.recordSlackPost(claim);
+}
+//# sourceMappingURL=policy.js.map

package/dist/src/slack/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/slack/policy.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAWtE;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,GAAS,EAAE,QAAgB;IACnD,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACpC,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACvE,OAAO;QACL,GAAG,EAAE,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC;QAClC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE;QAC7B,MAAM,EAAE,GAAG,CAAC,WAAW,EAAE;KAC1B,CAAC;AACJ,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,GAAS;IACjD,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AACnD,CAAC;AAkBD;;;;GAIG;AACH,MAAM,UAAU,UAAU,CACxB,KAAiB,EACjB,GAAW,EACX,KAAoC,EACpC,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,EAAE,WAAW,EAAE,oBAAoB,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;IAC/D,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5C,IAAI,IAAI,IAAI,WAAW,EAAE,CAAC;QACxB,OAAO;YACL,GAAG,IAAI;YACP,KAAK,EAAE,KAAK;YACZ,GAAG,EAAE,aAAa;YAClB,MAAM,EAAE,iCAAiC,IAAI,IAAI,WAAW,GAAG;SAChE,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,IAAI,QAAQ,IAAI,oBAAoB,EAAE,CAAC;QAC7C,OAAO;YACL,GAAG,IAAI;YACP,KAAK,EAAE,KAAK;YACZ,GAAG,EAAE,sBAAsB;YAC3B,MAAM,EAAE,6CAA6C,IAAI,KAAK,QAAQ,IAAI,oBAAoB,GAAG;SAClG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,QAAsB;IAC9D,OAAO,QAAQ,CAAC,GAAG,KAAK,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9E,CAAC;AAMD,+EAA+E;AAC/E,0EAA0E;AAC1E,wEAAwE;AACxE,4EAA4E;AAC5E,2EAA2E;AAC3E,qEAAqE;AAErE;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAiB,EACjB,QAAgB,EAChB,QAAgB,EAChB,QAAgB;IAEhB,OACE,KAAK,CAAC,EAAE;SACL,OAAO,CACN,8HAA8H,CAC/H;SACA,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CACpC,CAAC,CAAC,CAAC;AACN,CAAC;AAaD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,WAAW,CACzB,KAAiB,EACjB,GAAW,EACX,KAAqD,EACrD,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,EAAE,WAAW,EAAE,sBAAsB,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;IACjE,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,KAAK,CAAC,QAAQ;QAC/B,CAAC,CAAC,gBAAgB,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC;QAC/D,CAAC,CAAC,CAAC,CAAC;IACN,MAAM,IAAI,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC9C,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,OAAO;YACL,GAAG,IAAI;YACP,KAAK,EAAE,KAAK;YACZ,GAAG,EAAE,YAAY;YACjB,MAAM,EAAE,4BAA4B,KAAK,CAAC,OAAO,GAAG;SACrD,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,IAAI,WAAW,EAAE,CAAC;QACxB,OAAO;YACL,GAAG,IAAI;YACP,KAAK,EAAE,KAAK;YACZ,GAAG,EAAE,aAAa;YAClB,MAAM,EAAE,iCAAiC,IAAI,IAAI,WAAW,GAAG;SAChE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,IAAI,UAAU,IAAI,sBAAsB,EAAE,CAAC;QAC3D,OAAO;YACL,GAAG,IAAI;YACP,KAAK,EAAE,KAAK;YACZ,GAAG,EAAE,wBAAwB;YAC7B,MAAM,EAAE,6BAA6B,UAAU,IAAI,sBAAsB,GAAG;SAC7E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC;AAED,6EAA6E;AAE7E,iEAAiE;AACjE,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,EAAkB;IAC/D,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,EAAE,EAAE,CAAC;AACpE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,KAAa;IACpD,OAAO,CACL,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI;QAChC,OAAO,EAAE,IAAI;QACb,YAAY,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,oBAAoB;KACpD,CACF,CAAC;AACJ,CAAC;AAgBD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAC3B,KAAiB,EACjB,GAAW,EACX,GAAS;IAET,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,CAAC;IACxD,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IAClE,MAAM,MAAM,GAAG,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxF,OAAO;QACL,OAAO,EAAE,MAAM,IAAI,OAAO;QAC1B,MAAM,EAAE,kCAAkC,MAAM,IAAI,OAAO,oBAAoB;KAChF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAiB,EACjB,GAAW,EACX,KAAiE,EACjE,MAAY,IAAI,IAAI,EAAE;IAEtB,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,GAAG;YACH,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,UAAU;YACjB,MAAM,EAAE,UAAU,KAAK,CAAC,KAAK,eAAe;SAC7C,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,GAAG;YACH,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,UAAU;YACjB,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,GAAG,YAAY,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;IACtC,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,OAAO,GAAG,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC;IACzD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,KAAK,CAAC,uBAAuB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,GAAG,MAAM,CAAC;IAC7E,IAAI,UAAU,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACtC,KAAK,CAAC,uBAAuB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC3C,KAAK,CAAC,uBAAuB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAChD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACtD,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO;QACL,KAAK,EAAE,KAAK;QACZ,GAAG;QACH,MAAM,EAAE,KAAK;QACb,KAAK,EAAE,UAAU;QACjB,MAAM,EAAE,iBAAiB,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,YAAY,iBAAiB,KAAK,GAAG;QACvG,KAAK;KACN,CAAC;AACJ,CAAC;AAED,8EAA8E;AAE9E;;;;GAIG;AACH,MAAM,UAAU,SAAS,CACvB,KAAiB,EACjB,KAMC;IAED,OAAO,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;AACtC,CAAC"}

package/dist/src/slack/reply.js

@@ -0,0 +1,153 @@
+// src/slack/messages.ts is the declared wording owner and owns the ONE
+// escaping implementation (`&` first, or the other two double-escape).
+import { escapeMrkdwn } from "./messages.js";
+import { claimPost, decideReply } from "./policy.js";
+/** Slack message ts, always "1712345678.123456". */
+export const SLACK_TS_RE = /^\d{10}\.\d{6}$/;
+export const TRUNCATION_SUFFIX = "…(truncated)";
+/**
+ * Escape + truncate RAW model text into a Slack-safe string of at most `max`
+ * characters.
+ *
+ * ORDER IS LOAD-BEARING: escaping first and slicing after can cut a `&` in
+ * half and leave a literal `&am` in the channel, so the raw text is sliced
+ * first and escaped after — an entity is therefore always whole.
+ *
+ * PRECEDENCE, when escaping inflates the text back over the limit (a text of
+ * all `&` grows 5×): `max` WINS. `cfg.slack.max_reply_chars` is a hard channel
+ * budget, so the slice point is chosen against the ESCAPED length — the longest
+ * raw prefix whose escaped form plus the marker still fits. That costs
+ * characters of content, never correctness of the limit.
+ */
+export function truncateReply(text, max) {
+    if (max <= 0)
+        return "";
+    const whole = escapeMrkdwn(text);
+    if (whole.length <= max)
+        return whole;
+    // A limit too small for the marker keeps the marker off entirely rather than
+    // spending the whole budget saying "truncated".
+    const budget = max <= TRUNCATION_SUFFIX.length ? max : max - TRUNCATION_SUFFIX.length;
+    const suffix = max <= TRUNCATION_SUFFIX.length ? "" : TRUNCATION_SUFFIX;
+    // Longest raw prefix that fits AFTER escaping. Escaping is monotonic in the
+    // prefix length, so a binary search is exact.
+    let lo = 0;
+    let hi = text.length;
+    while (lo < hi) {
+        const mid = Math.ceil((lo + hi) / 2);
+        if (escapeMrkdwn(text.slice(0, mid)).length <= budget)
+            lo = mid;
+        else
+            hi = mid - 1;
+    }
+    // Never cut a surrogate pair in half either — half an emoji is a mojibake
+    // box, for the same reason half an entity is a stray `&am`.
+    const cut = lo > 0 &&
+        lo < text.length &&
+        text.charCodeAt(lo - 1) >= 0xd800 &&
+        text.charCodeAt(lo - 1) <= 0xdbff
+        ? lo - 1
+        : lo;
+    return escapeMrkdwn(text.slice(0, cut)) + suffix;
+}
+/**
+ * Has the daemon ever seen this thread? Either it opened the thread for a PR,
+ * or a PERSON spoke to it there (the message's own ts, or the parent it
+ * replied under). A bot's message or a user-less one (`dropped_echo`) is no
+ * person speaking, so it never makes a thread known. `slack_events` has no
+ * by-ts accessor on StateStore — this is a read-only probe over the table the
+ * router owns.
+ */
+export function threadIsKnown(store, channel, threadTs) {
+    if (store.slackThreadByRoot(channel, threadTs))
+        return true;
+    const row = store.db
+        .prepare("SELECT 1 AS hit FROM slack_events WHERE channel = ? AND (ts = ? OR thread_ts = ?) " +
+        "AND disposition != 'dropped_echo' LIMIT 1")
+        .get(channel, threadTs, threadTs);
+    return row !== undefined;
+}
+/** FNV-1a, so a direct (file-less) call still gets a stable idem key. */
+function shortHash(s) {
+    let h = 0x811c9dc5;
+    for (let i = 0; i < s.length; i++) {
+        h ^= s.charCodeAt(i);
+        h = Math.imul(h, 0x01000193) >>> 0;
+    }
+    return h.toString(16).padStart(8, "0");
+}
+/** `reply:<context file>` — one post per command delivery, forever. */
+export function replyIdemKey(input) {
+    const scope = input.file && input.file.length > 0 ? input.file : `${input.thread}:${shortHash(input.text)}`;
+    return `reply:${scope}`;
+}
+/**
+ * Build the `CommandDeps.slackReply` handler. Returns a FileOutcome so every
+ * refusal lands in the command's result file, which is the overseer's only
+ * feedback channel.
+ */
+export function makeSlackReply(deps) {
+    const now = deps.now ?? (() => new Date());
+    const log = deps.log ?? (() => { });
+    return async (input) => {
+        const cfg = deps.cfg;
+        const store = deps.store;
+        if (!cfg.slack.enabled || !cfg.slack.channel) {
+            return { ok: false, reason: "slack is disabled — no channel to reply in" };
+        }
+        const channel = cfg.slack.channel; // never from the command: unrepresentable
+        const thread = input.thread;
+        if (!SLACK_TS_RE.test(thread))
+            return { ok: false, reason: `'thread' ${JSON.stringify(thread)} is not a Slack ts` };
+        if (!threadIsKnown(store, channel, thread)) {
+            return {
+                ok: false,
+                reason: `unknown thread ${thread} — the daemon only replies where it was spoken to`,
+            };
+        }
+        const idemKey = replyIdemKey(input);
+        const decision = decideReply(store, cfg, { threadTs: thread, idemKey }, now());
+        if (!decision.allow) {
+            return {
+                ok: false,
+                reason: decision.reason ?? "slack reply refused",
+                cap: decision.cap ?? null,
+            };
+        }
+        const text = truncateReply(input.text, cfg.slack.max_reply_chars);
+        if (!claimPost(store, { idem_key: idemKey, kind: "reply", thread_ts: thread, chars: text.length })) {
+            return { ok: false, reason: `already replied for this command (idem_key ${idemKey})` };
+        }
+        let result;
+        try {
+            result = await deps.api.postMessage({ channel, text, thread_ts: thread });
+        }
+        catch (err) {
+            result = { ok: false, error: err.message };
+        }
+        store.settleSlackPost(idemKey, {
+            ts: result.ts ?? null,
+            ok: result.ok,
+            error: result.error ?? null,
+        });
+        if (!result.ok) {
+            // A failed post is recorded and never blocks anything else.
+            log(`[slack] reply to ${thread} failed: ${result.error ?? "unknown"}`);
+            return { ok: false, reason: `slack post failed: ${result.error ?? "unknown"}` };
+        }
+        const pr = store.slackThreadByRoot(channel, thread)?.pr;
+        if (pr !== undefined)
+            store.touchSlackThread(pr);
+        store.logEvent("slack_reply_posted", pr ?? null, { thread, ts: result.ts, chars: text.length });
+        return {
+            ok: true,
+            thread,
+            ts: result.ts,
+            chars: text.length,
+            // Whether content was cut, never whether the text ends like the marker
+            // (a reply may end so naturally; a tiny limit cuts with no marker).
+            truncated: text !== escapeMrkdwn(input.text),
+        };
+    };
+}
+//# sourceMappingURL=reply.js.map

package/dist/src/slack/reply.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reply.js","sourceRoot":"","sources":["../../../src/slack/reply.ts"],"names":[],"mappings":"AAqBA,uEAAuE;AACvE,uEAAuE;AACvE,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAGrD,oDAAoD;AACpD,MAAM,CAAC,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAE7C,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEhD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,GAAW;IACrD,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACxB,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC;IACtC,6EAA6E;IAC7E,gDAAgD;IAChD,MAAM,MAAM,GAAG,GAAG,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,iBAAiB,CAAC,MAAM,CAAC;IACtF,MAAM,MAAM,GAAG,GAAG,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC;IACxE,4EAA4E;IAC5E,8CAA8C;IAC9C,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;IACrB,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,IAAI,MAAM;YAAE,EAAE,GAAG,GAAG,CAAC;;YAC3D,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;IACpB,CAAC;IACD,0EAA0E;IAC1E,4DAA4D;IAC5D,MAAM,GAAG,GACP,EAAE,GAAG,CAAC;QACN,EAAE,GAAG,IAAI,CAAC,MAAM;QAChB,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,MAAM;QACjC,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,MAAM;QAC/B,CAAC,CAAC,EAAE,GAAG,CAAC;QACR,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC;AACnD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,KAAiB,EAAE,OAAe,EAAE,QAAgB;IAChF,IAAI,KAAK,CAAC,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE;SACjB,OAAO,CACN,oFAAoF;QAClF,2CAA2C,CAC9C;SACA,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAgC,CAAC;IACnE,OAAO,GAAG,KAAK,SAAS,CAAC;AAC3B,CAAC;AAkBD,yEAAyE;AACzE,SAAS,SAAS,CAAC,CAAS;IAC1B,IAAI,CAAC,GAAG,UAAU,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,YAAY,CAAC,KAAsB;IACjD,MAAM,KAAK,GACT,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;IAChG,OAAO,SAAS,KAAK,EAAE,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAoB;IAEpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACnC,OAAO,KAAK,EAAE,KAAsB,EAAwB,EAAE;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAC7C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;QAC7E,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,0CAA0C;QAC7E,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC5B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC;YAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,oBAAoB,EAAE,CAAC;QACvF,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;YAC3C,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,kBAAkB,MAAM,mDAAmD;aACpF,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACpB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,qBAAqB;gBAChD,GAAG,EAAE,QAAQ,CAAC,GAAG,IAAI,IAAI;aAC1B,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAClE,IACE,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EAC9F,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8CAA8C,OAAO,GAAG,EAAE,CAAC;QACzF,CAAC;QAED,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;QACxD,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,OAAO,EAAE;YAC7B,EAAE,EAAE,MAAM,CAAC,EAAE,IAAI,IAAI;YACrB,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;SAC5B,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,4DAA4D;YAC5D,GAAG,CAAC,oBAAoB,MAAM,YAAY,MAAM,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC;YACvE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,MAAM,CAAC,KAAK,IAAI,SAAS,EAAE,EAAE,CAAC;QAClF,CAAC;QACD,MAAM,EAAE,GAAG,KAAK,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC;QACxD,IAAI,EAAE,KAAK,SAAS;YAAE,KAAK,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;QACjD,KAAK,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,IAAI,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAChG,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM;YACN,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,KAAK,EAAE,IAAI,CAAC,MAAM;YAClB,uEAAuE;YACvE,oEAAoE;YACpE,SAAS,EAAE,IAAI,KAAK,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;SAC7C,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/src/slack/router.js

@@ -0,0 +1,189 @@
+import { isoSeconds } from "./messages.js";
+/** The header marker the overseer's appendix keys the Slack envelope off. */
+export const SLACK_INJECT_MARKER = "<!-- qcr:slack v1 -->";
+/**
+ * The only inbound shape the router treats as a plain message: one with no
+ * subtype (inbound turns are retired, so it ends as dropped_no_overseer).
+ * `message_changed` is the important one — an EDIT NEVER RE-TRIGGERS an answer, otherwise a user could rewrite history under an answer already
+ * given (and a bot editing its own message would loop).
+ */
+function isPlainMessage(ev) {
+    return (ev.type === "message" && (ev.subtype === undefined || ev.subtype === null || ev.subtype === ""));
+}
+/** Has the daemon itself posted a message with this ts? (echo layer b) */
+function isOwnPostedTs(store, ts) {
+    // slack_posts has no by-ts accessor on StateStore; this is a read-only probe
+    // over the same table the post ledger owns.
+    const row = store.db.prepare("SELECT 1 AS hit FROM slack_posts WHERE ts = ? LIMIT 1").get(ts);
+    return row !== undefined;
+}
+/** Rights tier of a Slack member id. Config is the ONLY input besides the id. */
+export function computeTier(cfg, slackUser) {
+    if (!slackUser)
+        return "ignored";
+    // The configured owner (`[owner] slack_id`) gets the top rights tier.
+    // Persisted records carrying a legacy spelling of this tier are folded to
+    // "owner" on read (`foldSlackTier`); `system` is never computed here — it is
+    // stamped only by OriginStore.writeLocal for daemon turns.
+    if (cfg.owner.slack_id && slackUser === cfg.owner.slack_id)
+        return "owner";
+    if (Object.prototype.hasOwnProperty.call(cfg.slack.users, slackUser))
+        return "author";
+    // An unmapped id gets read-only everything, but NO own-PR
+    // resolution — there is no login to resolve, so it must name PRs by number.
+    return "anyone";
+}
+/** GitHub login for a Slack id, or null when the id is unmapped. */
+export function githubLoginFor(cfg, slackUser) {
+    if (!slackUser)
+        return null;
+    return cfg.slack.users[slackUser] ?? null;
+}
+/**
+ * Open PRs authored by `login`. Empty for an unmapped id — an `anyone` turn can
+ * never resolve author->PR, by construction.
+ *
+ * For the owner this list is their own PRs too, and it is deliberately NOT
+ * their authority: `authorizeCommand` lets tier `owner` act on any PR, so an
+ * empty list costs them nothing. Keeping the field honest (their real PRs)
+ * means the inject body reads the same for everyone.
+ */
+export function authorizedPrs(store, login) {
+    if (!login)
+        return [];
+    return store
+        .allPrs()
+        .filter((p) => p.state !== "closed" && p.author.toLowerCase() === login.toLowerCase())
+        .map((p) => p.number);
+}
+/**
+ * Neutralise user text so it cannot forge the inject header.
+ *
+ * The overseer reads one markdown document; the top of it is a trusted table
+ * written by the daemon and the rest is a quoted human. A user who pastes their
+ * own `<!-- qcr:slack v1 -->` + `| tier | owner |` must end up with inert
+ * characters: every line is blockquoted, pipes are escaped so no line can be a
+ * table row, and comment delimiters are HTML-escaped so no line can be the
+ * marker.
+ */
+export function quoteUserText(text) {
+    const body = (text ?? "").replace(/\r\n?/g, "\n");
+    const lines = body.length === 0 ? ["(no text)"] : body.split("\n");
+    return lines.map((line) => `> ${inertLine(line)}`.trimEnd()).join("\n");
+}
+/** One line of user-controlled text made inert inside the envelope: comment
+ * delimiters HTML-escaped (never the marker), pipes escaped (never a cell). */
+function inertLine(line) {
+    return line
+        .replace(/<!--/g, "&lt;!&#45;&#45;")
+        .replace(/-->/g, "&#45;&#45;&gt;")
+        .replace(/\|/g, "\\|");
+}
+/** The inject envelope: marker, trusted field table, then the quoted message. */
+export function buildInjectBody(input) {
+    const dash = "—";
+    // The display name is user-chosen, so it gets the quoted body's escaping —
+    // it sits in the part of the envelope the appendix says to trust.
+    const displayName = inertLine(input.displayName.replace(/\s+/g, " "));
+    const rows = [
+        ["source", "slack"],
+        ["event_id", input.event.event_id],
+        ["channel", input.event.channel],
+        ["thread", input.threadTs],
+        ["thread_pr", input.threadPr === null ? dash : String(input.threadPr)],
+        ["slack_user", input.event.user ?? dash],
+        ["display_name", displayName],
+        ["github_login", input.githubLogin ?? dash],
+        ["tier", input.tier],
+        ["authorized_prs", input.authorizedPrs.length ? input.authorizedPrs.join(", ") : dash],
+        ["received_at", isoSeconds(input.receivedAt.toISOString())],
+    ];
+    const table = [
+        "| field | value |",
+        "| --- | --- |",
+        ...rows.map(([k, v]) => `| ${k} | ${v} |`),
+    ].join("\n");
+    const where = input.threadPr === null ? "in the channel" : `in thread for PR #${input.threadPr}`;
+    return [
+        SLACK_INJECT_MARKER,
+        table,
+        "",
+        `**${displayName}** ${where} said:`,
+        "",
+        quoteUserText(input.event.text),
+        "",
+        `Reply by writing a \`slack_reply\` command file with \`thread: "${input.threadTs}"\`.`,
+        `Your tier for this turn is **${input.tier}** — see the Slack appendix in your system prompt.`,
+        "",
+    ].join("\n");
+}
+export class SlackRouter {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** Route one inbound event: one row, and never a turn. */
+    async handle(event) {
+        const cfg = this.deps.cfg;
+        const store = this.deps.store;
+        const tier = computeTier(cfg, event.user);
+        // (1) channel allowlist — a message from anywhere else is not our business.
+        if (event.channel !== cfg.slack.channel) {
+            return this.record(event, "ignored", "dropped_channel", `channel ${event.channel} is not the concierge channel`);
+        }
+        // (2) echo, three layers. (a) it is a bot / it is us, (b) we posted this ts.
+        const ownUserId = this.deps.identity?.user_id;
+        const ownBotId = this.deps.identity?.bot_id;
+        const looksLikeUs = event.bot_id !== undefined ||
+            event.subtype === "bot_message" ||
+            (ownUserId !== undefined && event.user === ownUserId) ||
+            (ownBotId !== undefined && event.bot_id === ownBotId);
+        if (looksLikeUs || isOwnPostedTs(store, event.ts)) {
+            return this.record(event, "ignored", "dropped_echo", "message was posted by a bot (or by us)");
+        }
+        // (2b) no Slack user id ⇒ nobody asked anything. Such an event has no tier
+        //      (`computeTier` says `ignored`). It is machine-emitted text, which is
+        //      exactly what `dropped_echo` means.
+        if (tier === "ignored") {
+            return this.record(event, "ignored", "dropped_echo", "message carries no Slack user — not a person asking");
+        }
+        // (3) subtype allowlist — edits, deletions, joins and broadcasts are logged,
+        //     never answered.
+        if (!isPlainMessage(event)) {
+            return this.record(event, tier, "dropped_subtype", `subtype '${event.subtype ?? event.type}' is not answerable`);
+        }
+        // (4) dedupe, then (5) refuse. The row is written with its final
+        //     disposition in one insert, so a redelivery loses the race and reports
+        //     `dropped_dupe` while the original row stands. Nothing past this point
+        //     exists: the overseer a turn would have gone to is retired, so a plain
+        //     message from a person is recorded and goes no further.
+        return this.record(event, tier, "dropped_no_overseer", "Slack inbound turns are retired: there is no overseer to hand a message to");
+    }
+    /** Record a pre-dedupe drop. A redelivered drop reports `dropped_dupe` and
+     * leaves the original row (and its disposition) untouched. */
+    record(event, tier, disposition, reason) {
+        if (!this.insertRow(event, tier, disposition))
+            return this.dupe(event, tier);
+        return { disposition, tier, reason };
+    }
+    /** Insert the event's dedupe row; false when the event id already has one. */
+    insertRow(event, tier, disposition) {
+        return this.deps.store.recordSlackEvent({
+            event_id: event.event_id,
+            channel: event.channel,
+            ts: event.ts,
+            thread_ts: event.thread_ts ?? null,
+            slack_user: event.user ?? null,
+            tier,
+            disposition,
+        });
+    }
+    dupe(event, tier) {
+        return {
+            disposition: "dropped_dupe",
+            tier,
+            reason: `event ${event.event_id} was already handled`,
+        };
+    }
+}
+//# sourceMappingURL=router.js.map

package/dist/src/slack/router.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"router.js","sourceRoot":"","sources":["../../../src/slack/router.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAG3C,6EAA6E;AAC7E,MAAM,CAAC,MAAM,mBAAmB,GAAG,uBAAuB,CAAC;AAE3D;;;;;GAKG;AACH,SAAS,cAAc,CAAC,EAAqB;IAC3C,OAAO,CACL,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,EAAE,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,CAAC,OAAO,KAAK,IAAI,IAAI,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CAChG,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,SAAS,aAAa,CAAC,KAAiB,EAAE,EAAU;IAClD,6EAA6E;IAC7E,4CAA4C;IAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,uDAAuD,CAAC,CAAC,GAAG,CAAC,EAAE,CAC/D,CAAC;IAC9B,OAAO,GAAG,KAAK,SAAS,CAAC;AAC3B,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,SAAoC;IAC3E,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,sEAAsE;IACtE,0EAA0E;IAC1E,6EAA6E;IAC7E,2DAA2D;IAC3D,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,SAAS,KAAK,GAAG,CAAC,KAAK,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC3E,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC;QAAE,OAAO,QAAQ,CAAC;IACtF,0DAA0D;IAC1D,4EAA4E;IAC5E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,SAAoC;IAC9E,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;AAC5C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,KAAiB,EAAE,KAAoB;IACnE,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,OAAO,KAAK;SACT,MAAM,EAAE;SACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;SACrF,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1E,CAAC;AAED;+EAC+E;AAC/E,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,IAAI;SACR,OAAO,CAAC,OAAO,EAAE,iBAAiB,CAAC;SACnC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC;SACjC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AAC3B,CAAC;AAeD,iFAAiF;AACjF,MAAM,UAAU,eAAe,CAAC,KAAsB;IACpD,MAAM,IAAI,GAAG,GAAG,CAAC;IACjB,2EAA2E;IAC3E,kEAAkE;IAClE,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IACtE,MAAM,IAAI,GAA4B;QACpC,CAAC,QAAQ,EAAE,OAAO,CAAC;QACnB,CAAC,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC;QAClC,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC;QAChC,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC;QAC1B,CAAC,WAAW,EAAE,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACtE,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC;QACxC,CAAC,cAAc,EAAE,WAAW,CAAC;QAC7B,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI,CAAC;QAC3C,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC;QACpB,CAAC,gBAAgB,EAAE,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtF,CAAC,aAAa,EAAE,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;KAC5D,CAAC;IACF,MAAM,KAAK,GAAG;QACZ,mBAAmB;QACnB,eAAe;QACf,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC;KAC3C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,qBAAqB,KAAK,CAAC,QAAQ,EAAE,CAAC;IACjG,OAAO;QACL,mBAAmB;QACnB,KAAK;QACL,EAAE;QACF,KAAK,WAAW,MAAM,KAAK,QAAQ;QACnC,EAAE;QACF,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;QAC/B,EAAE;QACF,mEAAmE,KAAK,CAAC,QAAQ,MAAM;QACvF,gCAAgC,KAAK,CAAC,IAAI,oDAAoD;QAC9F,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAeD,MAAM,OAAO,WAAW;IACO;IAA7B,YAA6B,IAAqB;QAArB,SAAI,GAAJ,IAAI,CAAiB;IAAG,CAAC;IAEtD,0DAA0D;IAC1D,KAAK,CAAC,MAAM,CAAC,KAAwB;QACnC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAC9B,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAE1C,4EAA4E;QAC5E,IAAI,KAAK,CAAC,OAAO,KAAK,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACxC,OAAO,IAAI,CAAC,MAAM,CAChB,KAAK,EACL,SAAS,EACT,iBAAiB,EACjB,WAAW,KAAK,CAAC,OAAO,+BAA+B,CACxD,CAAC;QACJ,CAAC;QAED,6EAA6E;QAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC5C,MAAM,WAAW,GACf,KAAK,CAAC,MAAM,KAAK,SAAS;YAC1B,KAAK,CAAC,OAAO,KAAK,aAAa;YAC/B,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;YACrD,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;QACxD,IAAI,WAAW,IAAI,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC,MAAM,CAChB,KAAK,EACL,SAAS,EACT,cAAc,EACd,wCAAwC,CACzC,CAAC;QACJ,CAAC;QAED,2EAA2E;QAC3E,4EAA4E;QAC5E,0CAA0C;QAC1C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,MAAM,CAChB,KAAK,EACL,SAAS,EACT,cAAc,EACd,qDAAqD,CACtD,CAAC;QACJ,CAAC;QAED,6EAA6E;QAC7E,sBAAsB;QACtB,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC,MAAM,CAChB,KAAK,EACL,IAAI,EACJ,iBAAiB,EACjB,YAAY,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,qBAAqB,CAC7D,CAAC;QACJ,CAAC;QAED,iEAAiE;QACjE,4EAA4E;QAC5E,4EAA4E;QAC5E,4EAA4E;QAC5E,6DAA6D;QAC7D,OAAO,IAAI,CAAC,MAAM,CAChB,KAAK,EACL,IAAI,EACJ,qBAAqB,EACrB,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IAED;kEAC8D;IACtD,MAAM,CACZ,KAAwB,EACxB,IAAe,EACf,WAA6B,EAC7B,MAAc;QAEd,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC7E,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACvC,CAAC;IAED,8EAA8E;IACtE,SAAS,CACf,KAAwB,EACxB,IAAe,EACf,WAA6B;QAE7B,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;YACtC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,UAAU,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;YAC9B,IAAI;YACJ,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IAEO,IAAI,CAAC,KAAwB,EAAE,IAAe;QACpD,OAAO;YACL,WAAW,EAAE,cAAc;YAC3B,IAAI;YACJ,MAAM,EAAE,SAAS,KAAK,CAAC,QAAQ,sBAAsB;SACtD,CAAC;IACJ,CAAC;CACF"}