@shipfox/api-integration-slack 4.0.0

package/dist/core/agent-tools.js

@@ -0,0 +1,177 @@
+const channelSchema = stringSchema('Slack channel ID');
+const cursorSchema = stringSchema('Next page cursor');
+const limitSchema = numberSchema('Maximum number of results to return');
+export const slackAgentToolCatalog = [
+    tool({
+        id: 'conversations_history',
+        description: 'List messages in a Slack channel or direct message.',
+        sensitivity: 'read',
+        sensitive: false,
+        requiredScope: 'read',
+        inputSchema: objectSchema({
+            channel: channelSchema,
+            cursor: cursorSchema,
+            limit: limitSchema,
+            oldest: stringSchema('Only messages after this Slack timestamp'),
+            latest: stringSchema('Only messages before this Slack timestamp'),
+            inclusive: booleanSchema('Include messages at the oldest or latest timestamp')
+        }, [
+            'channel'
+        ])
+    }),
+    tool({
+        id: 'conversations_replies',
+        description: 'List replies in a Slack message thread.',
+        sensitivity: 'read',
+        sensitive: false,
+        requiredScope: 'read',
+        inputSchema: objectSchema({
+            channel: channelSchema,
+            ts: stringSchema('Slack timestamp of the parent message'),
+            cursor: cursorSchema,
+            limit: limitSchema
+        }, [
+            'channel',
+            'ts'
+        ])
+    }),
+    tool({
+        id: 'conversations_list',
+        description: 'List Slack channels visible to the bot.',
+        sensitivity: 'read',
+        sensitive: false,
+        requiredScope: 'read',
+        inputSchema: objectSchema({
+            cursor: cursorSchema,
+            limit: limitSchema,
+            types: stringSchema('Comma-separated channel types, such as public_channel,private_channel'),
+            exclude_archived: booleanSchema('Exclude archived channels')
+        })
+    }),
+    tool({
+        id: 'users_info',
+        description: 'Look up a Slack user and profile by user ID.',
+        sensitivity: 'read',
+        sensitive: false,
+        requiredScope: 'read',
+        inputSchema: objectSchema({
+            user: stringSchema('Slack user ID')
+        }, [
+            'user'
+        ])
+    }),
+    tool({
+        id: 'chat_postMessage',
+        description: 'Post a Slack message to a channel or thread. Provide text, blocks, or both.',
+        sensitivity: 'write',
+        sensitive: false,
+        requiredScope: 'write',
+        inputSchema: objectSchema({
+            channel: channelSchema,
+            text: stringSchema('Message text'),
+            thread_ts: stringSchema('Slack timestamp of the parent message when replying in a thread'),
+            blocks: arraySchema({
+                type: 'object'
+            })
+        }, [
+            'channel'
+        ])
+    }),
+    tool({
+        id: 'chat_update',
+        description: 'Update a Slack message with text, blocks, or both.',
+        sensitivity: 'write',
+        sensitive: false,
+        requiredScope: 'write',
+        inputSchema: objectSchema({
+            channel: channelSchema,
+            ts: stringSchema('Slack timestamp of the message to update'),
+            text: stringSchema('Updated message text'),
+            blocks: arraySchema({
+                type: 'object'
+            })
+        }, [
+            'channel',
+            'ts'
+        ])
+    }),
+    tool({
+        id: 'reactions_add',
+        description: 'Add an emoji reaction to a Slack message.',
+        sensitivity: 'write',
+        sensitive: false,
+        requiredScope: 'write',
+        inputSchema: objectSchema({
+            channel: channelSchema,
+            timestamp: stringSchema('Slack timestamp of the message'),
+            name: stringSchema('Emoji name without surrounding colons')
+        }, [
+            'channel',
+            'timestamp',
+            'name'
+        ])
+    })
+];
+export const SLACK_TOOL_METHODS = {
+    conversations_history: 'conversations.history',
+    conversations_replies: 'conversations.replies',
+    conversations_list: 'conversations.list',
+    users_info: 'users.info',
+    chat_postMessage: 'chat.postMessage',
+    chat_update: 'chat.update',
+    reactions_add: 'reactions.add'
+};
+export const slackAgentToolSelectionCatalog = buildSlackAgentToolSelectionCatalog(slackAgentToolCatalog);
+function buildSlackAgentToolSelectionCatalog(catalog) {
+    return {
+        selectors: catalog.map((entry)=>({
+                token: entry.id,
+                kind: 'standalone',
+                sensitivity: entry.sensitivity,
+                sensitive: entry.sensitive
+            }))
+    };
+}
+function tool(input) {
+    return input;
+}
+function objectSchema(properties, required = []) {
+    return {
+        type: 'object',
+        additionalProperties: false,
+        properties,
+        ...required.length > 0 ? {
+            required
+        } : {}
+    };
+}
+function stringSchema(description) {
+    return {
+        type: 'string',
+        ...description ? {
+            description
+        } : {}
+    };
+}
+function numberSchema(description) {
+    return {
+        type: 'number',
+        ...description ? {
+            description
+        } : {}
+    };
+}
+function booleanSchema(description) {
+    return {
+        type: 'boolean',
+        description
+    };
+}
+function arraySchema(items) {
+    return {
+        type: 'array',
+        items
+    };
+}
+
+//# sourceMappingURL=agent-tools.js.map

package/dist/core/agent-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/agent-tools.ts"],"sourcesContent":["import type {\n  AgentToolCatalogEntry,\n  AgentToolJsonSchema,\n  AgentToolSelectionCatalog,\n  AgentToolSelector,\n} from '@shipfox/api-integration-core-dto';\n\nexport type SlackAgentToolRequiredScope = 'read' | 'write';\nexport type SlackAgentToolCatalogEntry = AgentToolCatalogEntry<SlackAgentToolRequiredScope>;\n\ninterface SlackAgentToolCatalogInput {\n  id: string;\n  description: string;\n  sensitivity: 'read' | 'write';\n  sensitive: boolean;\n  requiredScope: SlackAgentToolRequiredScope;\n  inputSchema: AgentToolJsonSchema;\n}\n\nconst channelSchema = stringSchema('Slack channel ID');\nconst cursorSchema = stringSchema('Next page cursor');\nconst limitSchema = numberSchema('Maximum number of results to return');\n\nexport const slackAgentToolCatalog = [\n  tool({\n    id: 'conversations_history',\n    description: 'List messages in a Slack channel or direct message.',\n    sensitivity: 'read',\n    sensitive: false,\n    requiredScope: 'read',\n    inputSchema: objectSchema(\n      {\n        channel: channelSchema,\n        cursor: cursorSchema,\n        limit: limitSchema,\n        oldest: stringSchema('Only messages after this Slack timestamp'),\n        latest: stringSchema('Only messages before this Slack timestamp'),\n        inclusive: booleanSchema('Include messages at the oldest or latest timestamp'),\n      },\n      ['channel'],\n    ),\n  }),\n  tool({\n    id: 'conversations_replies',\n    description: 'List replies in a Slack message thread.',\n    sensitivity: 'read',\n    sensitive: false,\n    requiredScope: 'read',\n    inputSchema: objectSchema(\n      {\n        channel: channelSchema,\n        ts: stringSchema('Slack timestamp of the parent message'),\n        cursor: cursorSchema,\n        limit: limitSchema,\n      },\n      ['channel', 'ts'],\n    ),\n  }),\n  tool({\n    id: 'conversations_list',\n    description: 'List Slack channels visible to the bot.',\n    sensitivity: 'read',\n    sensitive: false,\n    requiredScope: 'read',\n    inputSchema: objectSchema({\n      cursor: cursorSchema,\n      limit: limitSchema,\n      types: stringSchema('Comma-separated channel types, such as public_channel,private_channel'),\n      exclude_archived: booleanSchema('Exclude archived channels'),\n    }),\n  }),\n  tool({\n    id: 'users_info',\n    description: 'Look up a Slack user and profile by user ID.',\n    sensitivity: 'read',\n    sensitive: false,\n    requiredScope: 'read',\n    inputSchema: objectSchema({user: stringSchema('Slack user ID')}, ['user']),\n  }),\n  tool({\n    id: 'chat_postMessage',\n    description: 'Post a Slack message to a channel or thread. Provide text, blocks, or both.',\n    sensitivity: 'write',\n    sensitive: false,\n    requiredScope: 'write',\n    inputSchema: objectSchema(\n      {\n        channel: channelSchema,\n        text: stringSchema('Message text'),\n        thread_ts: stringSchema('Slack timestamp of the parent message when replying in a thread'),\n        blocks: arraySchema({type: 'object'}),\n      },\n      ['channel'],\n    ),\n  }),\n  tool({\n    id: 'chat_update',\n    description: 'Update a Slack message with text, blocks, or both.',\n    sensitivity: 'write',\n    sensitive: false,\n    requiredScope: 'write',\n    inputSchema: objectSchema(\n      {\n        channel: channelSchema,\n        ts: stringSchema('Slack timestamp of the message to update'),\n        text: stringSchema('Updated message text'),\n        blocks: arraySchema({type: 'object'}),\n      },\n      ['channel', 'ts'],\n    ),\n  }),\n  tool({\n    id: 'reactions_add',\n    description: 'Add an emoji reaction to a Slack message.',\n    sensitivity: 'write',\n    sensitive: false,\n    requiredScope: 'write',\n    inputSchema: objectSchema(\n      {\n        channel: channelSchema,\n        timestamp: stringSchema('Slack timestamp of the message'),\n        name: stringSchema('Emoji name without surrounding colons'),\n      },\n      ['channel', 'timestamp', 'name'],\n    ),\n  }),\n] as const satisfies readonly SlackAgentToolCatalogEntry[];\n\nexport type SlackAgentToolId = (typeof slackAgentToolCatalog)[number]['id'];\n\nexport const SLACK_TOOL_METHODS = {\n  conversations_history: 'conversations.history',\n  conversations_replies: 'conversations.replies',\n  conversations_list: 'conversations.list',\n  users_info: 'users.info',\n  chat_postMessage: 'chat.postMessage',\n  chat_update: 'chat.update',\n  reactions_add: 'reactions.add',\n} as const satisfies Record<SlackAgentToolId, string>;\n\nexport const slackAgentToolSelectionCatalog =\n  buildSlackAgentToolSelectionCatalog(slackAgentToolCatalog);\n\nfunction buildSlackAgentToolSelectionCatalog(\n  catalog: readonly SlackAgentToolCatalogEntry[],\n): AgentToolSelectionCatalog {\n  return {\n    selectors: catalog.map(\n      (entry): AgentToolSelector => ({\n        token: entry.id,\n        kind: 'standalone',\n        sensitivity: entry.sensitivity,\n        sensitive: entry.sensitive,\n      }),\n    ),\n  };\n}\n\nfunction tool<const Entry extends SlackAgentToolCatalogInput>(input: Entry): Entry {\n  return input;\n}\n\nfunction objectSchema(\n  properties: Record<string, AgentToolJsonSchema>,\n  required: string[] = [],\n): AgentToolJsonSchema {\n  return {\n    type: 'object',\n    additionalProperties: false,\n    properties,\n    ...(required.length > 0 ? {required} : {}),\n  };\n}\n\nfunction stringSchema(description?: string): AgentToolJsonSchema {\n  return {type: 'string', ...(description ? {description} : {})};\n}\n\nfunction numberSchema(description?: string): AgentToolJsonSchema {\n  return {type: 'number', ...(description ? {description} : {})};\n}\n\nfunction booleanSchema(description: string): AgentToolJsonSchema {\n  return {type: 'boolean', description};\n}\n\nfunction arraySchema(items: AgentToolJsonSchema): AgentToolJsonSchema {\n  return {type: 'array', items};\n}\n"],"names":["channelSchema","stringSchema","cursorSchema","limitSchema","numberSchema","slackAgentToolCatalog","tool","id","description","sensitivity","sensitive","requiredScope","inputSchema","objectSchema","channel","cursor","limit","oldest","latest","inclusive","booleanSchema","ts","types","exclude_archived","user","text","thread_ts","blocks","arraySchema","type","timestamp","name","SLACK_TOOL_METHODS","conversations_history","conversations_replies","conversations_list","users_info","chat_postMessage","chat_update","reactions_add","slackAgentToolSelectionCatalog","buildSlackAgentToolSelectionCatalog","catalog","selectors","map","entry","token","kind","input","properties","required","additionalProperties","length","items"],"mappings":"AAmBA,MAAMA,gBAAgBC,aAAa;AACnC,MAAMC,eAAeD,aAAa;AAClC,MAAME,cAAcC,aAAa;AAEjC,OAAO,MAAMC,wBAAwB;IACnCC,KAAK;QACHC,IAAI;QACJC,aAAa;QACbC,aAAa;QACbC,WAAW;QACXC,eAAe;QACfC,aAAaC,aACX;YACEC,SAASd;YACTe,QAAQb;YACRc,OAAOb;YACPc,QAAQhB,aAAa;YACrBiB,QAAQjB,aAAa;YACrBkB,WAAWC,cAAc;QAC3B,GACA;YAAC;SAAU;IAEf;IACAd,KAAK;QACHC,IAAI;QACJC,aAAa;QACbC,aAAa;QACbC,WAAW;QACXC,eAAe;QACfC,aAAaC,aACX;YACEC,SAASd;YACTqB,IAAIpB,aAAa;YACjBc,QAAQb;YACRc,OAAOb;QACT,GACA;YAAC;YAAW;SAAK;IAErB;IACAG,KAAK;QACHC,IAAI;QACJC,aAAa;QACbC,aAAa;QACbC,WAAW;QACXC,eAAe;QACfC,aAAaC,aAAa;YACxBE,QAAQb;YACRc,OAAOb;YACPmB,OAAOrB,aAAa;YACpBsB,kBAAkBH,cAAc;QAClC;IACF;IACAd,KAAK;QACHC,IAAI;QACJC,aAAa;QACbC,aAAa;QACbC,WAAW;QACXC,eAAe;QACfC,aAAaC,aAAa;YAACW,MAAMvB,aAAa;QAAgB,GAAG;YAAC;SAAO;IAC3E;IACAK,KAAK;QACHC,IAAI;QACJC,aAAa;QACbC,aAAa;QACbC,WAAW;QACXC,eAAe;QACfC,aAAaC,aACX;YACEC,SAASd;YACTyB,MAAMxB,aAAa;YACnByB,WAAWzB,aAAa;YACxB0B,QAAQC,YAAY;gBAACC,MAAM;YAAQ;QACrC,GACA;YAAC;SAAU;IAEf;IACAvB,KAAK;QACHC,IAAI;QACJC,aAAa;QACbC,aAAa;QACbC,WAAW;QACXC,eAAe;QACfC,aAAaC,aACX;YACEC,SAASd;YACTqB,IAAIpB,aAAa;YACjBwB,MAAMxB,aAAa;YACnB0B,QAAQC,YAAY;gBAACC,MAAM;YAAQ;QACrC,GACA;YAAC;YAAW;SAAK;IAErB;IACAvB,KAAK;QACHC,IAAI;QACJC,aAAa;QACbC,aAAa;QACbC,WAAW;QACXC,eAAe;QACfC,aAAaC,aACX;YACEC,SAASd;YACT8B,WAAW7B,aAAa;YACxB8B,MAAM9B,aAAa;QACrB,GACA;YAAC;YAAW;YAAa;SAAO;IAEpC;CACD,CAA0D;AAI3D,OAAO,MAAM+B,qBAAqB;IAChCC,uBAAuB;IACvBC,uBAAuB;IACvBC,oBAAoB;IACpBC,YAAY;IACZC,kBAAkB;IAClBC,aAAa;IACbC,eAAe;AACjB,EAAsD;AAEtD,OAAO,MAAMC,iCACXC,oCAAoCpC,uBAAuB;AAE7D,SAASoC,oCACPC,OAA8C;IAE9C,OAAO;QACLC,WAAWD,QAAQE,GAAG,CACpB,CAACC,QAA8B,CAAA;gBAC7BC,OAAOD,MAAMtC,EAAE;gBACfwC,MAAM;gBACNtC,aAAaoC,MAAMpC,WAAW;gBAC9BC,WAAWmC,MAAMnC,SAAS;YAC5B,CAAA;IAEJ;AACF;AAEA,SAASJ,KAAqD0C,KAAY;IACxE,OAAOA;AACT;AAEA,SAASnC,aACPoC,UAA+C,EAC/CC,WAAqB,EAAE;IAEvB,OAAO;QACLrB,MAAM;QACNsB,sBAAsB;QACtBF;QACA,GAAIC,SAASE,MAAM,GAAG,IAAI;YAACF;QAAQ,IAAI,CAAC,CAAC;IAC3C;AACF;AAEA,SAASjD,aAAaO,WAAoB;IACxC,OAAO;QAACqB,MAAM;QAAU,GAAIrB,cAAc;YAACA;QAAW,IAAI,CAAC,CAAC;IAAC;AAC/D;AAEA,SAASJ,aAAaI,WAAoB;IACxC,OAAO;QAACqB,MAAM;QAAU,GAAIrB,cAAc;YAACA;QAAW,IAAI,CAAC,CAAC;IAAC;AAC/D;AAEA,SAASY,cAAcZ,WAAmB;IACxC,OAAO;QAACqB,MAAM;QAAWrB;IAAW;AACtC;AAEA,SAASoB,YAAYyB,KAA0B;IAC7C,OAAO;QAACxB,MAAM;QAASwB;IAAK;AAC9B"}

package/dist/core/disconnect.d.ts

@@ -0,0 +1,18 @@
+export interface DisconnectSlackInstallationParams<Tx = unknown> {
+    connectionId: string;
+    getConnection(connectionId: string): Promise<{
+        workspaceId: string;
+    } | undefined>;
+    deleteSecrets(params: {
+        workspaceId: string;
+        namespace: string;
+    }): Promise<number>;
+    transaction<T>(fn: (tx: Tx) => Promise<T>): Promise<T>;
+    deleteConnection(params: {
+        connectionId: string;
+    }, options: {
+        tx: Tx;
+    }): Promise<boolean>;
+}
+export declare function disconnectSlackInstallation<Tx = unknown>(params: DisconnectSlackInstallationParams<Tx>): Promise<void>;
+//# sourceMappingURL=disconnect.d.ts.map

package/dist/core/disconnect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"disconnect.d.ts","sourceRoot":"","sources":["../../src/core/disconnect.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,iCAAiC,CAAC,EAAE,GAAG,OAAO;IAC7D,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAC,GAAG,SAAS,CAAC,CAAC;IAChF,aAAa,CAAC,MAAM,EAAE;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjF,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACvD,gBAAgB,CAAC,MAAM,EAAE;QAAC,YAAY,EAAE,MAAM,CAAA;KAAC,EAAE,OAAO,EAAE;QAAC,EAAE,EAAE,EAAE,CAAA;KAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACvF;AAED,wBAAsB,2BAA2B,CAAC,EAAE,GAAG,OAAO,EAC5D,MAAM,EAAE,iCAAiC,CAAC,EAAE,CAAC,GAC5C,OAAO,CAAC,IAAI,CAAC,CAYf"}

package/dist/core/disconnect.js

@@ -0,0 +1,23 @@
+import { deleteSlackInstallationByConnectionId } from '#db/installations.js';
+import { slackSecretsNamespace } from './tokens.js';
+export async function disconnectSlackInstallation(params) {
+    const connection = await params.getConnection(params.connectionId);
+    if (connection) {
+        await params.deleteSecrets({
+            workspaceId: connection.workspaceId,
+            namespace: slackSecretsNamespace(params.connectionId)
+        });
+    }
+    await params.transaction(async (tx)=>{
+        await deleteSlackInstallationByConnectionId(params.connectionId, {
+            tx
+        });
+        await params.deleteConnection({
+            connectionId: params.connectionId
+        }, {
+            tx
+        });
+    });
+}
+
+//# sourceMappingURL=disconnect.js.map

package/dist/core/disconnect.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/disconnect.ts"],"sourcesContent":["import {deleteSlackInstallationByConnectionId} from '#db/installations.js';\nimport {slackSecretsNamespace} from './tokens.js';\n\nexport interface DisconnectSlackInstallationParams<Tx = unknown> {\n  connectionId: string;\n  getConnection(connectionId: string): Promise<{workspaceId: string} | undefined>;\n  deleteSecrets(params: {workspaceId: string; namespace: string}): Promise<number>;\n  transaction<T>(fn: (tx: Tx) => Promise<T>): Promise<T>;\n  deleteConnection(params: {connectionId: string}, options: {tx: Tx}): Promise<boolean>;\n}\n\nexport async function disconnectSlackInstallation<Tx = unknown>(\n  params: DisconnectSlackInstallationParams<Tx>,\n): Promise<void> {\n  const connection = await params.getConnection(params.connectionId);\n  if (connection) {\n    await params.deleteSecrets({\n      workspaceId: connection.workspaceId,\n      namespace: slackSecretsNamespace(params.connectionId),\n    });\n  }\n  await params.transaction(async (tx) => {\n    await deleteSlackInstallationByConnectionId(params.connectionId, {tx});\n    await params.deleteConnection({connectionId: params.connectionId}, {tx});\n  });\n}\n"],"names":["deleteSlackInstallationByConnectionId","slackSecretsNamespace","disconnectSlackInstallation","params","connection","getConnection","connectionId","deleteSecrets","workspaceId","namespace","transaction","tx","deleteConnection"],"mappings":"AAAA,SAAQA,qCAAqC,QAAO,uBAAuB;AAC3E,SAAQC,qBAAqB,QAAO,cAAc;AAUlD,OAAO,eAAeC,4BACpBC,MAA6C;IAE7C,MAAMC,aAAa,MAAMD,OAAOE,aAAa,CAACF,OAAOG,YAAY;IACjE,IAAIF,YAAY;QACd,MAAMD,OAAOI,aAAa,CAAC;YACzBC,aAAaJ,WAAWI,WAAW;YACnCC,WAAWR,sBAAsBE,OAAOG,YAAY;QACtD;IACF;IACA,MAAMH,OAAOO,WAAW,CAAC,OAAOC;QAC9B,MAAMX,sCAAsCG,OAAOG,YAAY,EAAE;YAACK;QAAE;QACpE,MAAMR,OAAOS,gBAAgB,CAAC;YAACN,cAAcH,OAAOG,YAAY;QAAA,GAAG;YAACK;QAAE;IACxE;AACF"}

package/dist/core/errors.d.ts

@@ -0,0 +1,44 @@
+import { IntegrationProviderError } from '@shipfox/api-integration-core-dto';
+export declare class SlackIntegrationProviderError extends IntegrationProviderError {
+}
+export declare class SlackInstallStateError extends Error {
+    constructor(message?: string);
+}
+export declare class SlackInstallStateActorMismatchError extends Error {
+    constructor();
+}
+export declare class SlackOAuthCallbackError extends Error {
+    readonly providerError: string;
+    readonly providerDescription: string | undefined;
+    constructor(providerError: string, providerDescription: string | undefined);
+}
+export declare class SlackAuthorizationScopeMismatchError extends Error {
+    readonly missingScopes: string[];
+    constructor(missingScopes: string[]);
+}
+export declare class SlackEnterpriseInstallUnsupportedError extends Error {
+    constructor();
+}
+export declare class SlackTokenRotationUnsupportedError extends Error {
+    constructor();
+}
+export declare class SlackInstallationAlreadyLinkedError extends Error {
+    constructor(teamId: string);
+}
+export declare class SlackConnectionAlreadyLinkedError extends Error {
+    constructor(connectionId: string);
+}
+export declare class SlackConnectionNotFoundError extends Error {
+    constructor(connectionId: string);
+}
+export declare class SlackBotTokenMissingError extends Error {
+    constructor(connectionId: string);
+}
+export type SlackAccessTokenUnavailableReason = 'installation-not-found' | 'not-installed' | 'expired';
+export declare class SlackAccessTokenUnavailableError extends Error {
+    readonly connectionId: string;
+    readonly reason: SlackAccessTokenUnavailableReason;
+    readonly expiresAt?: Date | undefined;
+    constructor(connectionId: string, reason: SlackAccessTokenUnavailableReason, expiresAt?: Date | undefined);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/core/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,wBAAwB,EAAC,MAAM,mCAAmC,CAAC;AAE3E,qBAAa,6BAA8B,SAAQ,wBAAwB;CAAG;AAE9E,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,SAAgC;CAIpD;AAED,qBAAa,mCAAoC,SAAQ,KAAK;;CAK7D;AAED,qBAAa,uBAAwB,SAAQ,KAAK;aAE9B,aAAa,EAAE,MAAM;aACrB,mBAAmB,EAAE,MAAM,GAAG,SAAS;gBADvC,aAAa,EAAE,MAAM,EACrB,mBAAmB,EAAE,MAAM,GAAG,SAAS;CAK1D;AAED,qBAAa,oCAAqC,SAAQ,KAAK;aACjC,aAAa,EAAE,MAAM,EAAE;gBAAvB,aAAa,EAAE,MAAM,EAAE;CAIpD;AAED,qBAAa,sCAAuC,SAAQ,KAAK;;CAKhE;AAED,qBAAa,kCAAmC,SAAQ,KAAK;;CAK5D;AAED,qBAAa,mCAAoC,SAAQ,KAAK;gBAChD,MAAM,EAAE,MAAM;CAI3B;AAED,qBAAa,iCAAkC,SAAQ,KAAK;gBAC9C,YAAY,EAAE,MAAM;CAIjC;AAED,qBAAa,4BAA6B,SAAQ,KAAK;gBACzC,YAAY,EAAE,MAAM;CAIjC;AAED,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,YAAY,EAAE,MAAM;CAIjC;AAED,MAAM,MAAM,iCAAiC,GACzC,wBAAwB,GACxB,eAAe,GACf,SAAS,CAAC;AAEd,qBAAa,gCAAiC,SAAQ,KAAK;aAEvC,YAAY,EAAE,MAAM;aACpB,MAAM,EAAE,iCAAiC;aACzC,SAAS,CAAC,EAAE,IAAI;gBAFhB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,iCAAiC,EACzC,SAAS,CAAC,EAAE,IAAI,YAAA;CAKnC"}

package/dist/core/errors.js

@@ -0,0 +1,71 @@
+import { IntegrationProviderError } from '@shipfox/api-integration-core-dto';
+export class SlackIntegrationProviderError extends IntegrationProviderError {
+}
+export class SlackInstallStateError extends Error {
+    constructor(message = 'Invalid Slack install state'){
+        super(message);
+        this.name = 'SlackInstallStateError';
+    }
+}
+export class SlackInstallStateActorMismatchError extends Error {
+    constructor(){
+        super('Slack install state was created by a different user');
+        this.name = 'SlackInstallStateActorMismatchError';
+    }
+}
+export class SlackOAuthCallbackError extends Error {
+    constructor(providerError, providerDescription){
+        super(providerDescription ?? `Slack OAuth callback failed: ${providerError}`), this.providerError = providerError, this.providerDescription = providerDescription;
+        this.name = 'SlackOAuthCallbackError';
+    }
+}
+export class SlackAuthorizationScopeMismatchError extends Error {
+    constructor(missingScopes){
+        super(`Slack authorization is missing required scopes: ${missingScopes.join(', ')}`), this.missingScopes = missingScopes;
+        this.name = 'SlackAuthorizationScopeMismatchError';
+    }
+}
+export class SlackEnterpriseInstallUnsupportedError extends Error {
+    constructor(){
+        super('Slack Enterprise Grid installations are not supported');
+        this.name = 'SlackEnterpriseInstallUnsupportedError';
+    }
+}
+export class SlackTokenRotationUnsupportedError extends Error {
+    constructor(){
+        super('Slack token rotation is not supported');
+        this.name = 'SlackTokenRotationUnsupportedError';
+    }
+}
+export class SlackInstallationAlreadyLinkedError extends Error {
+    constructor(teamId){
+        super(`Slack team is already linked to another Shipfox workspace: ${teamId}`);
+        this.name = 'SlackInstallationAlreadyLinkedError';
+    }
+}
+export class SlackConnectionAlreadyLinkedError extends Error {
+    constructor(connectionId){
+        super(`Integration connection is already linked to another Slack team: ${connectionId}`);
+        this.name = 'SlackConnectionAlreadyLinkedError';
+    }
+}
+export class SlackConnectionNotFoundError extends Error {
+    constructor(connectionId){
+        super(`Slack integration connection was not found: ${connectionId}`);
+        this.name = 'SlackConnectionNotFoundError';
+    }
+}
+export class SlackBotTokenMissingError extends Error {
+    constructor(connectionId){
+        super(`Slack bot token is missing for connection: ${connectionId}`);
+        this.name = 'SlackBotTokenMissingError';
+    }
+}
+export class SlackAccessTokenUnavailableError extends Error {
+    constructor(connectionId, reason, expiresAt){
+        super(`Slack access token is unavailable for connection: ${connectionId} (${reason})`), this.connectionId = connectionId, this.reason = reason, this.expiresAt = expiresAt;
+        this.name = 'SlackAccessTokenUnavailableError';
+    }
+}
+
+//# sourceMappingURL=errors.js.map

package/dist/core/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/errors.ts"],"sourcesContent":["import {IntegrationProviderError} from '@shipfox/api-integration-core-dto';\n\nexport class SlackIntegrationProviderError extends IntegrationProviderError {}\n\nexport class SlackInstallStateError extends Error {\n  constructor(message = 'Invalid Slack install state') {\n    super(message);\n    this.name = 'SlackInstallStateError';\n  }\n}\n\nexport class SlackInstallStateActorMismatchError extends Error {\n  constructor() {\n    super('Slack install state was created by a different user');\n    this.name = 'SlackInstallStateActorMismatchError';\n  }\n}\n\nexport class SlackOAuthCallbackError extends Error {\n  constructor(\n    public readonly providerError: string,\n    public readonly providerDescription: string | undefined,\n  ) {\n    super(providerDescription ?? `Slack OAuth callback failed: ${providerError}`);\n    this.name = 'SlackOAuthCallbackError';\n  }\n}\n\nexport class SlackAuthorizationScopeMismatchError extends Error {\n  constructor(public readonly missingScopes: string[]) {\n    super(`Slack authorization is missing required scopes: ${missingScopes.join(', ')}`);\n    this.name = 'SlackAuthorizationScopeMismatchError';\n  }\n}\n\nexport class SlackEnterpriseInstallUnsupportedError extends Error {\n  constructor() {\n    super('Slack Enterprise Grid installations are not supported');\n    this.name = 'SlackEnterpriseInstallUnsupportedError';\n  }\n}\n\nexport class SlackTokenRotationUnsupportedError extends Error {\n  constructor() {\n    super('Slack token rotation is not supported');\n    this.name = 'SlackTokenRotationUnsupportedError';\n  }\n}\n\nexport class SlackInstallationAlreadyLinkedError extends Error {\n  constructor(teamId: string) {\n    super(`Slack team is already linked to another Shipfox workspace: ${teamId}`);\n    this.name = 'SlackInstallationAlreadyLinkedError';\n  }\n}\n\nexport class SlackConnectionAlreadyLinkedError extends Error {\n  constructor(connectionId: string) {\n    super(`Integration connection is already linked to another Slack team: ${connectionId}`);\n    this.name = 'SlackConnectionAlreadyLinkedError';\n  }\n}\n\nexport class SlackConnectionNotFoundError extends Error {\n  constructor(connectionId: string) {\n    super(`Slack integration connection was not found: ${connectionId}`);\n    this.name = 'SlackConnectionNotFoundError';\n  }\n}\n\nexport class SlackBotTokenMissingError extends Error {\n  constructor(connectionId: string) {\n    super(`Slack bot token is missing for connection: ${connectionId}`);\n    this.name = 'SlackBotTokenMissingError';\n  }\n}\n\nexport type SlackAccessTokenUnavailableReason =\n  | 'installation-not-found'\n  | 'not-installed'\n  | 'expired';\n\nexport class SlackAccessTokenUnavailableError extends Error {\n  constructor(\n    public readonly connectionId: string,\n    public readonly reason: SlackAccessTokenUnavailableReason,\n    public readonly expiresAt?: Date,\n  ) {\n    super(`Slack access token is unavailable for connection: ${connectionId} (${reason})`);\n    this.name = 'SlackAccessTokenUnavailableError';\n  }\n}\n"],"names":["IntegrationProviderError","SlackIntegrationProviderError","SlackInstallStateError","Error","message","name","SlackInstallStateActorMismatchError","SlackOAuthCallbackError","providerError","providerDescription","SlackAuthorizationScopeMismatchError","missingScopes","join","SlackEnterpriseInstallUnsupportedError","SlackTokenRotationUnsupportedError","SlackInstallationAlreadyLinkedError","teamId","SlackConnectionAlreadyLinkedError","connectionId","SlackConnectionNotFoundError","SlackBotTokenMissingError","SlackAccessTokenUnavailableError","reason","expiresAt"],"mappings":"AAAA,SAAQA,wBAAwB,QAAO,oCAAoC;AAE3E,OAAO,MAAMC,sCAAsCD;AAA0B;AAE7E,OAAO,MAAME,+BAA+BC;IAC1C,YAAYC,UAAU,6BAA6B,CAAE;QACnD,KAAK,CAACA;QACN,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMC,4CAA4CH;IACvD,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAME,gCAAgCJ;IAC3C,YACE,AAAgBK,aAAqB,EACrC,AAAgBC,mBAAuC,CACvD;QACA,KAAK,CAACA,uBAAuB,CAAC,6BAA6B,EAAED,eAAe,QAH5DA,gBAAAA,oBACAC,sBAAAA;QAGhB,IAAI,CAACJ,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMK,6CAA6CP;IACxD,YAAY,AAAgBQ,aAAuB,CAAE;QACnD,KAAK,CAAC,CAAC,gDAAgD,EAAEA,cAAcC,IAAI,CAAC,OAAO,QADzDD,gBAAAA;QAE1B,IAAI,CAACN,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMQ,+CAA+CV;IAC1D,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMS,2CAA2CX;IACtD,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMU,4CAA4CZ;IACvD,YAAYa,MAAc,CAAE;QAC1B,KAAK,CAAC,CAAC,2DAA2D,EAAEA,QAAQ;QAC5E,IAAI,CAACX,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMY,0CAA0Cd;IACrD,YAAYe,YAAoB,CAAE;QAChC,KAAK,CAAC,CAAC,gEAAgE,EAAEA,cAAc;QACvF,IAAI,CAACb,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMc,qCAAqChB;IAChD,YAAYe,YAAoB,CAAE;QAChC,KAAK,CAAC,CAAC,4CAA4C,EAAEA,cAAc;QACnE,IAAI,CAACb,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMe,kCAAkCjB;IAC7C,YAAYe,YAAoB,CAAE;QAChC,KAAK,CAAC,CAAC,2CAA2C,EAAEA,cAAc;QAClE,IAAI,CAACb,IAAI,GAAG;IACd;AACF;AAOA,OAAO,MAAMgB,yCAAyClB;IACpD,YACE,AAAgBe,YAAoB,EACpC,AAAgBI,MAAyC,EACzD,AAAgBC,SAAgB,CAChC;QACA,KAAK,CAAC,CAAC,kDAAkD,EAAEL,aAAa,EAAE,EAAEI,OAAO,CAAC,CAAC,QAJrEJ,eAAAA,mBACAI,SAAAA,aACAC,YAAAA;QAGhB,IAAI,CAAClB,IAAI,GAAG;IACd;AACF"}

package/dist/core/install.d.ts

@@ -0,0 +1,48 @@
+import type { UserContextMembership } from '@shipfox/api-auth-context';
+import type { IntegrationConnection } from '@shipfox/api-integration-core-dto';
+import type { SlackApiClient } from '#api/client.js';
+import type { SlackTokenStore } from '#core/tokens.js';
+export interface ConnectSlackInstallationInput {
+    workspaceId: string;
+    teamId: string;
+    teamName: string;
+    appId: string;
+    botUserId: string;
+    scopes: string[];
+    tokenExpiresAt: Date | null;
+    displayName: string;
+}
+export interface HandleSlackCallbackParams {
+    slack: SlackApiClient;
+    tokenStore: Pick<SlackTokenStore, 'storeTokens'>;
+    code: string;
+    state: string;
+    sessionUserId: string;
+    sessionMemberships: ReadonlyArray<UserContextMembership>;
+    requireWorkspaceMembership: (params: {
+        workspaceId: string;
+        userId: string;
+        memberships: ReadonlyArray<UserContextMembership>;
+    }) => Promise<unknown>;
+    getExistingSlackConnection: (input: {
+        teamId: string;
+    }) => Promise<IntegrationConnection<'slack'> | undefined>;
+    connectSlackInstallation: (input: ConnectSlackInstallationInput) => Promise<IntegrationConnection<'slack'>>;
+    disconnectSlackInstallation: (input: {
+        connectionId: string;
+    }) => Promise<void>;
+}
+export declare function handleSlackCallback(params: HandleSlackCallbackParams): Promise<IntegrationConnection<'slack'>>;
+export declare function handleSlackOAuthCallbackError(params: {
+    state: string;
+    error: string;
+    errorDescription?: string | undefined;
+    sessionUserId: string;
+    sessionMemberships: ReadonlyArray<UserContextMembership>;
+    requireWorkspaceMembership: (input: {
+        workspaceId: string;
+        userId: string;
+        memberships: ReadonlyArray<UserContextMembership>;
+    }) => Promise<unknown>;
+}): Promise<never>;
+//# sourceMappingURL=install.d.ts.map

package/dist/core/install.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.d.ts","sourceRoot":"","sources":["../../src/core/install.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,qBAAqB,EAAC,MAAM,2BAA2B,CAAC;AACrE,OAAO,KAAK,EAAC,qBAAqB,EAAC,MAAM,mCAAmC,CAAC;AAE7E,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,gBAAgB,CAAC;AACnD,OAAO,KAAK,EAAC,eAAe,EAAC,MAAM,iBAAiB,CAAC;AASrD,MAAM,WAAW,6BAA6B;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,cAAc,EAAE,IAAI,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,cAAc,CAAC;IACtB,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;IACzD,0BAA0B,EAAE,CAAC,MAAM,EAAE;QACnC,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;KACnD,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACvB,0BAA0B,EAAE,CAAC,KAAK,EAAE;QAClC,MAAM,EAAE,MAAM,CAAC;KAChB,KAAK,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC;IAC1D,wBAAwB,EAAE,CACxB,KAAK,EAAE,6BAA6B,KACjC,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7C,2BAA2B,EAAE,CAAC,KAAK,EAAE;QAAC,YAAY,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/E;AAED,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CA6CzC;AAED,wBAAsB,6BAA6B,CAAC,MAAM,EAAE;IAC1D,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;IACzD,0BAA0B,EAAE,CAAC,KAAK,EAAE;QAClC,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,WAAW,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;KACnD,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACxB,GAAG,OAAO,CAAC,KAAK,CAAC,CASjB"}

package/dist/core/install.js

@@ -0,0 +1,88 @@
+import { logger } from '@shipfox/node-opentelemetry';
+import { SlackInstallationAlreadyLinkedError, SlackInstallStateActorMismatchError, SlackOAuthCallbackError } from './errors.js';
+import { assertSlackAuthorizationScopes } from './scopes.js';
+import { verifySlackInstallState } from './state.js';
+export async function handleSlackCallback(params) {
+    const claims = verifySlackInstallState(params.state);
+    if (claims.userId !== params.sessionUserId) throw new SlackInstallStateActorMismatchError();
+    await params.requireWorkspaceMembership({
+        workspaceId: claims.workspaceId,
+        userId: claims.userId,
+        memberships: params.sessionMemberships
+    });
+    const authorization = await params.slack.exchangeAuthorizationCode({
+        code: params.code
+    });
+    let connectedConnectionId;
+    let shouldDisconnectConnection = false;
+    let shouldRevokeToken = false;
+    try {
+        const existing = await params.getExistingSlackConnection({
+            teamId: authorization.teamId
+        });
+        if (existing && existing.workspaceId !== claims.workspaceId) {
+            throw new SlackInstallationAlreadyLinkedError(authorization.teamId);
+        }
+        shouldRevokeToken = !existing;
+        assertSlackAuthorizationScopes(authorization.scopes);
+        const connection = await params.connectSlackInstallation({
+            workspaceId: claims.workspaceId,
+            teamId: authorization.teamId,
+            teamName: authorization.teamName,
+            appId: authorization.appId,
+            botUserId: authorization.botUserId,
+            scopes: authorization.scopes,
+            tokenExpiresAt: null,
+            displayName: `Slack ${authorization.teamName}`
+        });
+        connectedConnectionId = connection.id;
+        shouldDisconnectConnection = !existing;
+        await params.tokenStore.storeTokens({
+            connectionId: connection.id,
+            botToken: authorization.accessToken,
+            editedBy: claims.userId
+        });
+        return connection;
+    } catch (error) {
+        if (shouldRevokeToken) await bestEffortRevokeToken(params.slack, authorization.accessToken);
+        if (connectedConnectionId && shouldDisconnectConnection) {
+            await bestEffortDisconnectSlackInstallation(params, connectedConnectionId);
+        }
+        throw error;
+    }
+}
+export async function handleSlackOAuthCallbackError(params) {
+    const claims = verifySlackInstallState(params.state);
+    if (claims.userId !== params.sessionUserId) throw new SlackInstallStateActorMismatchError();
+    await params.requireWorkspaceMembership({
+        workspaceId: claims.workspaceId,
+        userId: claims.userId,
+        memberships: params.sessionMemberships
+    });
+    throw new SlackOAuthCallbackError(params.error, params.errorDescription);
+}
+async function bestEffortRevokeToken(slack, token) {
+    try {
+        await slack.revokeToken({
+            token
+        });
+    } catch (error) {
+        logger().warn({
+            err: error
+        }, 'Slack OAuth token revocation failed');
+    }
+}
+async function bestEffortDisconnectSlackInstallation(params, connectionId) {
+    try {
+        await params.disconnectSlackInstallation({
+            connectionId
+        });
+    } catch (error) {
+        logger().warn({
+            err: error,
+            connectionId
+        }, 'Slack connect compensation failed after token storage rejection');
+    }
+}
+
+//# sourceMappingURL=install.js.map

package/dist/core/install.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/install.ts"],"sourcesContent":["import type {UserContextMembership} from '@shipfox/api-auth-context';\nimport type {IntegrationConnection} from '@shipfox/api-integration-core-dto';\nimport {logger} from '@shipfox/node-opentelemetry';\nimport type {SlackApiClient} from '#api/client.js';\nimport type {SlackTokenStore} from '#core/tokens.js';\nimport {\n  SlackInstallationAlreadyLinkedError,\n  SlackInstallStateActorMismatchError,\n  SlackOAuthCallbackError,\n} from './errors.js';\nimport {assertSlackAuthorizationScopes} from './scopes.js';\nimport {verifySlackInstallState} from './state.js';\n\nexport interface ConnectSlackInstallationInput {\n  workspaceId: string;\n  teamId: string;\n  teamName: string;\n  appId: string;\n  botUserId: string;\n  scopes: string[];\n  tokenExpiresAt: Date | null;\n  displayName: string;\n}\n\nexport interface HandleSlackCallbackParams {\n  slack: SlackApiClient;\n  tokenStore: Pick<SlackTokenStore, 'storeTokens'>;\n  code: string;\n  state: string;\n  sessionUserId: string;\n  sessionMemberships: ReadonlyArray<UserContextMembership>;\n  requireWorkspaceMembership: (params: {\n    workspaceId: string;\n    userId: string;\n    memberships: ReadonlyArray<UserContextMembership>;\n  }) => Promise<unknown>;\n  getExistingSlackConnection: (input: {\n    teamId: string;\n  }) => Promise<IntegrationConnection<'slack'> | undefined>;\n  connectSlackInstallation: (\n    input: ConnectSlackInstallationInput,\n  ) => Promise<IntegrationConnection<'slack'>>;\n  disconnectSlackInstallation: (input: {connectionId: string}) => Promise<void>;\n}\n\nexport async function handleSlackCallback(\n  params: HandleSlackCallbackParams,\n): Promise<IntegrationConnection<'slack'>> {\n  const claims = verifySlackInstallState(params.state);\n  if (claims.userId !== params.sessionUserId) throw new SlackInstallStateActorMismatchError();\n  await params.requireWorkspaceMembership({\n    workspaceId: claims.workspaceId,\n    userId: claims.userId,\n    memberships: params.sessionMemberships,\n  });\n\n  const authorization = await params.slack.exchangeAuthorizationCode({code: params.code});\n  let connectedConnectionId: string | undefined;\n  let shouldDisconnectConnection = false;\n  let shouldRevokeToken = false;\n  try {\n    const existing = await params.getExistingSlackConnection({teamId: authorization.teamId});\n    if (existing && existing.workspaceId !== claims.workspaceId) {\n      throw new SlackInstallationAlreadyLinkedError(authorization.teamId);\n    }\n    shouldRevokeToken = !existing;\n    assertSlackAuthorizationScopes(authorization.scopes);\n    const connection = await params.connectSlackInstallation({\n      workspaceId: claims.workspaceId,\n      teamId: authorization.teamId,\n      teamName: authorization.teamName,\n      appId: authorization.appId,\n      botUserId: authorization.botUserId,\n      scopes: authorization.scopes,\n      tokenExpiresAt: null,\n      displayName: `Slack ${authorization.teamName}`,\n    });\n    connectedConnectionId = connection.id;\n    shouldDisconnectConnection = !existing;\n    await params.tokenStore.storeTokens({\n      connectionId: connection.id,\n      botToken: authorization.accessToken,\n      editedBy: claims.userId,\n    });\n    return connection;\n  } catch (error) {\n    if (shouldRevokeToken) await bestEffortRevokeToken(params.slack, authorization.accessToken);\n    if (connectedConnectionId && shouldDisconnectConnection) {\n      await bestEffortDisconnectSlackInstallation(params, connectedConnectionId);\n    }\n    throw error;\n  }\n}\n\nexport async function handleSlackOAuthCallbackError(params: {\n  state: string;\n  error: string;\n  errorDescription?: string | undefined;\n  sessionUserId: string;\n  sessionMemberships: ReadonlyArray<UserContextMembership>;\n  requireWorkspaceMembership: (input: {\n    workspaceId: string;\n    userId: string;\n    memberships: ReadonlyArray<UserContextMembership>;\n  }) => Promise<unknown>;\n}): Promise<never> {\n  const claims = verifySlackInstallState(params.state);\n  if (claims.userId !== params.sessionUserId) throw new SlackInstallStateActorMismatchError();\n  await params.requireWorkspaceMembership({\n    workspaceId: claims.workspaceId,\n    userId: claims.userId,\n    memberships: params.sessionMemberships,\n  });\n  throw new SlackOAuthCallbackError(params.error, params.errorDescription);\n}\n\nasync function bestEffortRevokeToken(slack: SlackApiClient, token: string): Promise<void> {\n  try {\n    await slack.revokeToken({token});\n  } catch (error) {\n    logger().warn({err: error}, 'Slack OAuth token revocation failed');\n  }\n}\n\nasync function bestEffortDisconnectSlackInstallation(\n  params: HandleSlackCallbackParams,\n  connectionId: string,\n): Promise<void> {\n  try {\n    await params.disconnectSlackInstallation({connectionId});\n  } catch (error) {\n    logger().warn(\n      {err: error, connectionId},\n      'Slack connect compensation failed after token storage rejection',\n    );\n  }\n}\n"],"names":["logger","SlackInstallationAlreadyLinkedError","SlackInstallStateActorMismatchError","SlackOAuthCallbackError","assertSlackAuthorizationScopes","verifySlackInstallState","handleSlackCallback","params","claims","state","userId","sessionUserId","requireWorkspaceMembership","workspaceId","memberships","sessionMemberships","authorization","slack","exchangeAuthorizationCode","code","connectedConnectionId","shouldDisconnectConnection","shouldRevokeToken","existing","getExistingSlackConnection","teamId","scopes","connection","connectSlackInstallation","teamName","appId","botUserId","tokenExpiresAt","displayName","id","tokenStore","storeTokens","connectionId","botToken","accessToken","editedBy","error","bestEffortRevokeToken","bestEffortDisconnectSlackInstallation","handleSlackOAuthCallbackError","errorDescription","token","revokeToken","warn","err","disconnectSlackInstallation"],"mappings":"AAEA,SAAQA,MAAM,QAAO,8BAA8B;AAGnD,SACEC,mCAAmC,EACnCC,mCAAmC,EACnCC,uBAAuB,QAClB,cAAc;AACrB,SAAQC,8BAA8B,QAAO,cAAc;AAC3D,SAAQC,uBAAuB,QAAO,aAAa;AAkCnD,OAAO,eAAeC,oBACpBC,MAAiC;IAEjC,MAAMC,SAASH,wBAAwBE,OAAOE,KAAK;IACnD,IAAID,OAAOE,MAAM,KAAKH,OAAOI,aAAa,EAAE,MAAM,IAAIT;IACtD,MAAMK,OAAOK,0BAA0B,CAAC;QACtCC,aAAaL,OAAOK,WAAW;QAC/BH,QAAQF,OAAOE,MAAM;QACrBI,aAAaP,OAAOQ,kBAAkB;IACxC;IAEA,MAAMC,gBAAgB,MAAMT,OAAOU,KAAK,CAACC,yBAAyB,CAAC;QAACC,MAAMZ,OAAOY,IAAI;IAAA;IACrF,IAAIC;IACJ,IAAIC,6BAA6B;IACjC,IAAIC,oBAAoB;IACxB,IAAI;QACF,MAAMC,WAAW,MAAMhB,OAAOiB,0BAA0B,CAAC;YAACC,QAAQT,cAAcS,MAAM;QAAA;QACtF,IAAIF,YAAYA,SAASV,WAAW,KAAKL,OAAOK,WAAW,EAAE;YAC3D,MAAM,IAAIZ,oCAAoCe,cAAcS,MAAM;QACpE;QACAH,oBAAoB,CAACC;QACrBnB,+BAA+BY,cAAcU,MAAM;QACnD,MAAMC,aAAa,MAAMpB,OAAOqB,wBAAwB,CAAC;YACvDf,aAAaL,OAAOK,WAAW;YAC/BY,QAAQT,cAAcS,MAAM;YAC5BI,UAAUb,cAAca,QAAQ;YAChCC,OAAOd,cAAcc,KAAK;YAC1BC,WAAWf,cAAce,SAAS;YAClCL,QAAQV,cAAcU,MAAM;YAC5BM,gBAAgB;YAChBC,aAAa,CAAC,MAAM,EAAEjB,cAAca,QAAQ,EAAE;QAChD;QACAT,wBAAwBO,WAAWO,EAAE;QACrCb,6BAA6B,CAACE;QAC9B,MAAMhB,OAAO4B,UAAU,CAACC,WAAW,CAAC;YAClCC,cAAcV,WAAWO,EAAE;YAC3BI,UAAUtB,cAAcuB,WAAW;YACnCC,UAAUhC,OAAOE,MAAM;QACzB;QACA,OAAOiB;IACT,EAAE,OAAOc,OAAO;QACd,IAAInB,mBAAmB,MAAMoB,sBAAsBnC,OAAOU,KAAK,EAAED,cAAcuB,WAAW;QAC1F,IAAInB,yBAAyBC,4BAA4B;YACvD,MAAMsB,sCAAsCpC,QAAQa;QACtD;QACA,MAAMqB;IACR;AACF;AAEA,OAAO,eAAeG,8BAA8BrC,MAWnD;IACC,MAAMC,SAASH,wBAAwBE,OAAOE,KAAK;IACnD,IAAID,OAAOE,MAAM,KAAKH,OAAOI,aAAa,EAAE,MAAM,IAAIT;IACtD,MAAMK,OAAOK,0BAA0B,CAAC;QACtCC,aAAaL,OAAOK,WAAW;QAC/BH,QAAQF,OAAOE,MAAM;QACrBI,aAAaP,OAAOQ,kBAAkB;IACxC;IACA,MAAM,IAAIZ,wBAAwBI,OAAOkC,KAAK,EAAElC,OAAOsC,gBAAgB;AACzE;AAEA,eAAeH,sBAAsBzB,KAAqB,EAAE6B,KAAa;IACvE,IAAI;QACF,MAAM7B,MAAM8B,WAAW,CAAC;YAACD;QAAK;IAChC,EAAE,OAAOL,OAAO;QACdzC,SAASgD,IAAI,CAAC;YAACC,KAAKR;QAAK,GAAG;IAC9B;AACF;AAEA,eAAeE,sCACbpC,MAAiC,EACjC8B,YAAoB;IAEpB,IAAI;QACF,MAAM9B,OAAO2C,2BAA2B,CAAC;YAACb;QAAY;IACxD,EAAE,OAAOI,OAAO;QACdzC,SAASgD,IAAI,CACX;YAACC,KAAKR;YAAOJ;QAAY,GACzB;IAEJ;AACF"}

package/dist/core/scopes.d.ts

@@ -0,0 +1,4 @@
+export declare const SLACK_BOT_SCOPES: readonly string[];
+export declare function formatSlackBotScopes(scopes?: readonly string[]): string;
+export declare function assertSlackAuthorizationScopes(scopes: string[]): void;
+//# sourceMappingURL=scopes.d.ts.map

package/dist/core/scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scopes.d.ts","sourceRoot":"","sources":["../../src/core/scopes.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,gBAAgB,mBAY3B,CAAC;AAEH,wBAAgB,oBAAoB,CAAC,MAAM,oBAAmB,GAAG,MAAM,CAEtE;AAED,wBAAgB,8BAA8B,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAIrE"}

package/dist/core/scopes.js

@@ -0,0 +1,24 @@
+import { SlackAuthorizationScopeMismatchError } from './errors.js';
+export const SLACK_BOT_SCOPES = Object.freeze([
+    'app_mentions:read',
+    'im:history',
+    'chat:write',
+    'channels:history',
+    'groups:history',
+    'channels:read',
+    'groups:read',
+    'users:read',
+    'reactions:read',
+    'reactions:write',
+    'commands'
+]);
+export function formatSlackBotScopes(scopes = SLACK_BOT_SCOPES) {
+    return scopes.join(',');
+}
+export function assertSlackAuthorizationScopes(scopes) {
+    const grantedScopes = new Set(scopes);
+    const missingScopes = SLACK_BOT_SCOPES.filter((scope)=>!grantedScopes.has(scope));
+    if (missingScopes.length > 0) throw new SlackAuthorizationScopeMismatchError(missingScopes);
+}
+
+//# sourceMappingURL=scopes.js.map

package/dist/core/scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/scopes.ts"],"sourcesContent":["import {SlackAuthorizationScopeMismatchError} from './errors.js';\n\nexport const SLACK_BOT_SCOPES = Object.freeze([\n  'app_mentions:read',\n  'im:history',\n  'chat:write',\n  'channels:history',\n  'groups:history',\n  'channels:read',\n  'groups:read',\n  'users:read',\n  'reactions:read',\n  'reactions:write',\n  'commands',\n]);\n\nexport function formatSlackBotScopes(scopes = SLACK_BOT_SCOPES): string {\n  return scopes.join(',');\n}\n\nexport function assertSlackAuthorizationScopes(scopes: string[]): void {\n  const grantedScopes = new Set(scopes);\n  const missingScopes = SLACK_BOT_SCOPES.filter((scope) => !grantedScopes.has(scope));\n  if (missingScopes.length > 0) throw new SlackAuthorizationScopeMismatchError(missingScopes);\n}\n"],"names":["SlackAuthorizationScopeMismatchError","SLACK_BOT_SCOPES","Object","freeze","formatSlackBotScopes","scopes","join","assertSlackAuthorizationScopes","grantedScopes","Set","missingScopes","filter","scope","has","length"],"mappings":"AAAA,SAAQA,oCAAoC,QAAO,cAAc;AAEjE,OAAO,MAAMC,mBAAmBC,OAAOC,MAAM,CAAC;IAC5C;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD,EAAE;AAEH,OAAO,SAASC,qBAAqBC,SAASJ,gBAAgB;IAC5D,OAAOI,OAAOC,IAAI,CAAC;AACrB;AAEA,OAAO,SAASC,+BAA+BF,MAAgB;IAC7D,MAAMG,gBAAgB,IAAIC,IAAIJ;IAC9B,MAAMK,gBAAgBT,iBAAiBU,MAAM,CAAC,CAACC,QAAU,CAACJ,cAAcK,GAAG,CAACD;IAC5E,IAAIF,cAAcI,MAAM,GAAG,GAAG,MAAM,IAAId,qCAAqCU;AAC/E"}

package/dist/core/signature.d.ts

@@ -0,0 +1,10 @@
+export interface VerifySlackSignatureParams {
+    signingSecret: string;
+    signature: string | undefined;
+    timestamp: string | undefined;
+    rawBody: string;
+    now?: number | undefined;
+    replayWindowMs?: number | undefined;
+}
+export declare function verifySlackSignature({ signingSecret, signature, timestamp, rawBody, now, replayWindowMs, }: VerifySlackSignatureParams): boolean;
+//# sourceMappingURL=signature.d.ts.map

package/dist/core/signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.d.ts","sourceRoot":"","sources":["../../src/core/signature.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,0BAA0B;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrC;AAED,wBAAgB,oBAAoB,CAAC,EACnC,aAAa,EACb,SAAS,EACT,SAAS,EACT,OAAO,EACP,GAAgB,EAChB,cAAwB,GACzB,EAAE,0BAA0B,GAAG,OAAO,CAoBtC"}

package/dist/core/signature.js

@@ -0,0 +1,18 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+const unixTimestampPattern = /^\d+$/;
+export function verifySlackSignature({ signingSecret, signature, timestamp, rawBody, now = Date.now(), replayWindowMs = 300_000 }) {
+    if (!signingSecret || !signature || !timestamp || !unixTimestampPattern.test(timestamp)) {
+        return false;
+    }
+    const timestampSeconds = Number(timestamp);
+    if (!Number.isSafeInteger(timestampSeconds)) return false;
+    const timestampMilliseconds = timestampSeconds * 1000;
+    if (!Number.isSafeInteger(timestampMilliseconds)) return false;
+    if (Math.abs(now - timestampMilliseconds) > replayWindowMs) return false;
+    const expected = `v0=${createHmac('sha256', signingSecret).update(`v0:${timestamp}:${rawBody}`).digest('hex')}`;
+    const expectedBuffer = Buffer.from(expected, 'utf8');
+    const receivedBuffer = Buffer.from(signature, 'utf8');
+    return expectedBuffer.length === receivedBuffer.length && timingSafeEqual(expectedBuffer, receivedBuffer);
+}
+
+//# sourceMappingURL=signature.js.map

package/dist/core/signature.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/signature.ts"],"sourcesContent":["import {createHmac, timingSafeEqual} from 'node:crypto';\n\nconst unixTimestampPattern = /^\\d+$/;\n\nexport interface VerifySlackSignatureParams {\n  signingSecret: string;\n  signature: string | undefined;\n  timestamp: string | undefined;\n  rawBody: string;\n  now?: number | undefined;\n  replayWindowMs?: number | undefined;\n}\n\nexport function verifySlackSignature({\n  signingSecret,\n  signature,\n  timestamp,\n  rawBody,\n  now = Date.now(),\n  replayWindowMs = 300_000,\n}: VerifySlackSignatureParams): boolean {\n  if (!signingSecret || !signature || !timestamp || !unixTimestampPattern.test(timestamp)) {\n    return false;\n  }\n\n  const timestampSeconds = Number(timestamp);\n  if (!Number.isSafeInteger(timestampSeconds)) return false;\n  const timestampMilliseconds = timestampSeconds * 1000;\n  if (!Number.isSafeInteger(timestampMilliseconds)) return false;\n  if (Math.abs(now - timestampMilliseconds) > replayWindowMs) return false;\n\n  const expected = `v0=${createHmac('sha256', signingSecret)\n    .update(`v0:${timestamp}:${rawBody}`)\n    .digest('hex')}`;\n  const expectedBuffer = Buffer.from(expected, 'utf8');\n  const receivedBuffer = Buffer.from(signature, 'utf8');\n  return (\n    expectedBuffer.length === receivedBuffer.length &&\n    timingSafeEqual(expectedBuffer, receivedBuffer)\n  );\n}\n"],"names":["createHmac","timingSafeEqual","unixTimestampPattern","verifySlackSignature","signingSecret","signature","timestamp","rawBody","now","Date","replayWindowMs","test","timestampSeconds","Number","isSafeInteger","timestampMilliseconds","Math","abs","expected","update","digest","expectedBuffer","Buffer","from","receivedBuffer","length"],"mappings":"AAAA,SAAQA,UAAU,EAAEC,eAAe,QAAO,cAAc;AAExD,MAAMC,uBAAuB;AAW7B,OAAO,SAASC,qBAAqB,EACnCC,aAAa,EACbC,SAAS,EACTC,SAAS,EACTC,OAAO,EACPC,MAAMC,KAAKD,GAAG,EAAE,EAChBE,iBAAiB,OAAO,EACG;IAC3B,IAAI,CAACN,iBAAiB,CAACC,aAAa,CAACC,aAAa,CAACJ,qBAAqBS,IAAI,CAACL,YAAY;QACvF,OAAO;IACT;IAEA,MAAMM,mBAAmBC,OAAOP;IAChC,IAAI,CAACO,OAAOC,aAAa,CAACF,mBAAmB,OAAO;IACpD,MAAMG,wBAAwBH,mBAAmB;IACjD,IAAI,CAACC,OAAOC,aAAa,CAACC,wBAAwB,OAAO;IACzD,IAAIC,KAAKC,GAAG,CAACT,MAAMO,yBAAyBL,gBAAgB,OAAO;IAEnE,MAAMQ,WAAW,CAAC,GAAG,EAAElB,WAAW,UAAUI,eACzCe,MAAM,CAAC,CAAC,GAAG,EAAEb,UAAU,CAAC,EAAEC,SAAS,EACnCa,MAAM,CAAC,QAAQ;IAClB,MAAMC,iBAAiBC,OAAOC,IAAI,CAACL,UAAU;IAC7C,MAAMM,iBAAiBF,OAAOC,IAAI,CAAClB,WAAW;IAC9C,OACEgB,eAAeI,MAAM,KAAKD,eAAeC,MAAM,IAC/CxB,gBAAgBoB,gBAAgBG;AAEpC"}