@spinabot/brigade 1.5.0 → 1.6.1

package/dist/agents/channels/slack/account-config.d.ts

@@ -0,0 +1,172 @@
+/**
+ * Slack config-shape helpers (multi-WORKSPACE aware; mirrors Telegram's
+ * `account-config.ts`).
+ *
+ * Slack needs MORE than one secret per workspace, unlike Telegram's single bot
+ * token:
+ *   - `botToken`    (`xoxb-…`) — the bot user token; every Web API call uses it.
+ *   - `appToken`    (`xapp-…`) — the app-level token; REQUIRED for Socket Mode
+ *                                 (opens the events websocket via
+ *                                 `apps.connections.open`).
+ *   - `signingSecret`          — HMAC secret; REQUIRED for Events-API (HTTP)
+ *                                 mode to verify Slack's request signature.
+ *   - `userToken`   (`xoxp-…`) — OPTIONAL; user-scoped token for reads that the
+ *                                 bot token can't do (e.g. some file fetches).
+ *
+ * Two config shapes are recognised so the surface lines up with WhatsApp /
+ * Telegram:
+ *
+ *   Legacy (single-workspace):
+ *     channels.slack = { enabled: true, botToken: "xoxb-…", appToken: "xapp-…" }
+ *
+ *   Multi-workspace:
+ *     channels.slack = {
+ *       enabled: true,
+ *       accounts: [
+ *         { id: "acme", botToken: "xoxb-AAA", appToken: "xapp-AAA" },
+ *         { id: "labs", botToken: "xoxb-BBB", appToken: "xapp-BBB" },
+ *       ],
+ *     }
+ *
+ * A legacy config with no `accounts[]` reads as `[{ id: "default" }]`.
+ *
+ * Token resolution mirrors Telegram: a `${VAR}` ref expands against
+ * `process.env`; otherwise the literal passes through; then — for the bot token
+ * only — a DURABLE sealed token (written by `connect_channel`) is consulted so
+ * the channel survives a reboot; finally a per-secret env var is the last-resort
+ * fallback.
+ *
+ * Honesty note on sealing: `connect_channel` seals exactly ONE secret per
+ * channel, under `channel:slack` — that is the BOT token. The app-level token
+ * and signing secret are NOT durably sealed today; they must come from config
+ * (`${VAR}`/literal) or their per-secret env var (`SLACK_APP_TOKEN` /
+ * `SLACK_SIGNING_SECRET`). If a future `connect_channel` learns to seal those
+ * under `channel:slack:app` / `channel:slack:signing`, wire the sealed-read
+ * fallback back into `resolveSlackAppToken` / `resolveSlackSigningSecret`.
+ */
+import type { BrigadeConfig } from "../../../config/io.js";
+declare const CHANNEL_ID = "slack";
+declare const DEFAULT_ACCOUNT_ID = "default";
+/** Per-secret env vars consulted as a last-resort fallback. */
+declare const BOT_TOKEN_ENV_VAR = "SLACK_BOT_TOKEN";
+declare const APP_TOKEN_ENV_VAR = "SLACK_APP_TOKEN";
+declare const SIGNING_SECRET_ENV_VAR = "SLACK_SIGNING_SECRET";
+declare const USER_TOKEN_ENV_VAR = "SLACK_USER_TOKEN";
+/** Resolved per-account info — what the adapter runtime reads. */
+export interface ResolvedSlackAccount {
+    accountId: string;
+    enabled: boolean;
+    /** Bot user token (`xoxb-…`), fully resolved, or `""` when unset. */
+    botToken: string;
+    /** App-level token (`xapp-…`) for Socket Mode, fully resolved, or `""`. */
+    appToken: string;
+    /** HMAC signing secret for Events-API mode, fully resolved, or `""`. */
+    signingSecret: string;
+    /** Optional user token (`xoxp-…`) for user-scoped reads, or `""`. */
+    userToken: string;
+    /**
+     * Proxy URL all Slack API calls + the Socket Mode websocket route through,
+     * fully resolved (`${VAR}` + env fallback applied), or `""` for a direct
+     * connection (the default).
+     */
+    proxyUrl: string;
+    verbose: boolean;
+}
+/** Is the Slack channel switched on at all (any shape)? */
+export declare function slackChannelEnabled(cfg: BrigadeConfig): boolean;
+/** List configured account ids. Legacy single-account configs surface `["default"]`. */
+export declare function listSlackAccountIds(cfg: BrigadeConfig): string[];
+/** Resolve the bot user token (`xoxb-…`) for an account. */
+export declare function resolveSlackBotToken(cfg: BrigadeConfig, accountId?: string | null, env?: NodeJS.ProcessEnv): string;
+/**
+ * Resolve the app-level token (`xapp-…`, Socket Mode) for an account. NOT sealed
+ * by `connect_channel` today (sealKey `null`) — comes from config or
+ * `SLACK_APP_TOKEN`.
+ */
+export declare function resolveSlackAppToken(cfg: BrigadeConfig, accountId?: string | null, env?: NodeJS.ProcessEnv): string;
+/**
+ * Resolve the HMAC signing secret (Events-API mode) for an account. NOT sealed
+ * by `connect_channel` today (sealKey `null`) — comes from config or
+ * `SLACK_SIGNING_SECRET`.
+ */
+export declare function resolveSlackSigningSecret(cfg: BrigadeConfig, accountId?: string | null, env?: NodeJS.ProcessEnv): string;
+/** Resolve the optional user token (`xoxp-…`) for an account. */
+export declare function resolveSlackUserToken(cfg: BrigadeConfig, accountId?: string | null, env?: NodeJS.ProcessEnv): string;
+/**
+ * Resolve the proxy URL all Slack API calls (+ the Socket Mode websocket) should
+ * route through. Precedence (mirrors Telegram's `resolveTelegramProxyUrl`):
+ *   1. The per-account `accounts[].proxy` (multi-workspace shape), `${VAR}`-resolved.
+ *   2. The top-level `channels.slack.proxy`, `${VAR}`-resolved.
+ *   3. The first set standard proxy env var (`https_proxy` / `HTTPS_PROXY` /
+ *      `all_proxy` / `ALL_PROXY`) — last-resort fallback.
+ * Returns `""` when none is configured → a DIRECT connection (the default,
+ * byte-unchanged from before proxy support existed).
+ *
+ * `${VAR}` refs are resolved here the same way `botToken` is, so an operator can
+ * keep the proxy (which may carry `user:pass@` creds) out of the committed
+ * config as `channels.slack.proxy: "${SLACK_PROXY}"`.
+ */
+export declare function resolveSlackProxyUrl(cfg: BrigadeConfig, accountId?: string | null, env?: NodeJS.ProcessEnv): string;
+/**
+ * Mask a proxy URL down to `scheme://host:port` (creds + path dropped) so it is
+ * safe to log. A malformed URL is reduced to its scheme only; an empty input
+ * returns "". NEVER log a raw proxy URL — it may embed `user:pass@`.
+ */
+export declare function maskProxyUrl(proxyUrl: string): string;
+/** Resolve a per-account view of the config (defaults + token resolution filled in). */
+export declare function resolveSlackAccount(cfg: BrigadeConfig, accountId?: string | null, env?: NodeJS.ProcessEnv): ResolvedSlackAccount;
+/** Resolved Slack transport config (mode + events-API details). */
+export interface SlackEventsConfig {
+    /** `"socket"` (default) or `"events"`. */
+    mode: "socket" | "events";
+    /** Public base URL Slack POSTs to (events mode). `""` when unset. */
+    url: string;
+    /** Gateway route path (default `/slack/events`). */
+    path: string;
+}
+/**
+ * Resolve the Slack transport config. Defaults to `socket` (Brigade is
+ * local-first and Socket Mode needs no public URL); `events` is opt-in via
+ * `channels.slack.mode: "events"`.
+ */
+export declare function slackEventsConfig(cfg: BrigadeConfig): SlackEventsConfig;
+/**
+ * Resolve the events-mode gateway route path for ONE account. Multi-workspace
+ * installs need a DISTINCT path per workspace (Slack POSTs to a per-app URL, and
+ * the gateway routes by exact path):
+ *
+ *   - default account → the configured base events path (`channels.slack.events.
+ *     path`, default `/slack/events`) — byte-identical to the single-workspace
+ *     path so an existing default-only install is unchanged.
+ *   - a named account → its explicit `accounts[].webhookPath` when set
+ *     (`${VAR}`-resolved), else the derived `${basePath}/<accountId>` so two
+ *     workspaces can't collide on one route.
+ *
+ * The base path is read from `slackEventsConfig`, so a custom
+ * `channels.slack.events.path` propagates to every derived per-account path.
+ */
+export declare function resolveSlackEventsPath(cfg: BrigadeConfig, accountId?: string | null, env?: NodeJS.ProcessEnv): string;
+/**
+ * True when live reply-streaming is enabled (`channels.slack.liveStream`).
+ * Default OFF — the adapter delivers one final chunked message.
+ */
+export declare function slackLiveStreamEnabled(cfg: BrigadeConfig): boolean;
+/**
+ * Resolve the streaming edit throttle in ms. Reads
+ * `channels.slack.streamThrottleMs`; falls back to 1000ms (floored at 250ms by
+ * the draft-stream).
+ */
+export declare function slackStreamThrottleMs(cfg: BrigadeConfig): number;
+/**
+ * True when reasoning surfacing is enabled (`channels.slack.surfaceReasoning`).
+ * Default OFF — `<think>` reasoning is stripped from channel replies as today.
+ */
+export declare function slackSurfaceReasoning(cfg: BrigadeConfig): boolean;
+/**
+ * Resolve the idle-thread-session TTL in ms, or `null` when unset / disabled.
+ * Accepts a number (ms) or a duration string (`"6h"`, `"30m"`, …). The cron
+ * session-reaper uses this to age out idle Slack thread sessions.
+ */
+export declare function slackThreadIdleTtlMs(cfg: BrigadeConfig): number | null;
+export { CHANNEL_ID as SLACK_CHANNEL_ID, DEFAULT_ACCOUNT_ID as SLACK_DEFAULT_ACCOUNT_ID, BOT_TOKEN_ENV_VAR as SLACK_BOT_TOKEN_ENV_VAR, APP_TOKEN_ENV_VAR as SLACK_APP_TOKEN_ENV_VAR, SIGNING_SECRET_ENV_VAR as SLACK_SIGNING_SECRET_ENV_VAR, USER_TOKEN_ENV_VAR as SLACK_USER_TOKEN_ENV_VAR, };
+//# sourceMappingURL=account-config.d.ts.map

package/dist/agents/channels/slack/account-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-config.d.ts","sourceRoot":"","sources":["../../../../src/agents/channels/slack/account-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAG3D,QAAA,MAAM,UAAU,UAAU,CAAC;AAC3B,QAAA,MAAM,kBAAkB,YAAY,CAAC;AAErC,+DAA+D;AAC/D,QAAA,MAAM,iBAAiB,oBAAoB,CAAC;AAC5C,QAAA,MAAM,iBAAiB,oBAAoB,CAAC;AAC5C,QAAA,MAAM,sBAAsB,yBAAyB,CAAC;AACtD,QAAA,MAAM,kBAAkB,qBAAqB,CAAC;AA4F9C,kEAAkE;AAClE,MAAM,WAAW,oBAAoB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,qEAAqE;IACrE,QAAQ,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,aAAa,EAAE,MAAM,CAAC;IACtB,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;CACjB;AAqBD,2DAA2D;AAC3D,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAE/D;AAED,wFAAwF;AACxF,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,EAAE,CAgBhE;AA8CD,4DAA4D;AAC5D,wBAAgB,oBAAoB,CACnC,GAAG,EAAE,aAAa,EAClB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,GAClC,MAAM,CAER;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CACnC,GAAG,EAAE,aAAa,EAClB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,GAClC,MAAM,CAER;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CACxC,GAAG,EAAE,aAAa,EAClB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,GAClC,MAAM,CAER;AAED,iEAAiE;AACjE,wBAAgB,qBAAqB,CACpC,GAAG,EAAE,aAAa,EAClB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,GAClC,MAAM,CAER;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CACnC,GAAG,EAAE,aAAa,EAClB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,GAClC,MAAM,CAaR;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAUrD;AAED,wFAAwF;AACxF,wBAAgB,mBAAmB,CAClC,GAAG,EAAE,aAAa,EAClB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,GAClC,oBAAoB,CAetB;AAID,mEAAmE;AACnE,MAAM,WAAW,iBAAiB;IACjC,0CAA0C;IAC1C,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC1B,qEAAqE;IACrE,GAAG,EAAE,MAAM,CAAC;IACZ,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;CACb;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,GAAG,iBAAiB,CAWvE;AAYD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACrC,GAAG,EAAE,aAAa,EAClB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,EACzB,GAAG,GAAE,MAAM,CAAC,UAAwB,GAClC,MAAM,CAUR;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAElE;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,CAGhE;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAEjE;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,GAAG,IAAI,CActE;AAED,OAAO,EACN,UAAU,IAAI,gBAAgB,EAC9B,kBAAkB,IAAI,wBAAwB,EAC9C,iBAAiB,IAAI,uBAAuB,EAC5C,iBAAiB,IAAI,uBAAuB,EAC5C,sBAAsB,IAAI,4BAA4B,EACtD,kBAAkB,IAAI,wBAAwB,GAC9C,CAAC"}

package/dist/agents/channels/slack/account-config.js

@@ -0,0 +1,353 @@
+/**
+ * Slack config-shape helpers (multi-WORKSPACE aware; mirrors Telegram's
+ * `account-config.ts`).
+ *
+ * Slack needs MORE than one secret per workspace, unlike Telegram's single bot
+ * token:
+ *   - `botToken`    (`xoxb-…`) — the bot user token; every Web API call uses it.
+ *   - `appToken`    (`xapp-…`) — the app-level token; REQUIRED for Socket Mode
+ *                                 (opens the events websocket via
+ *                                 `apps.connections.open`).
+ *   - `signingSecret`          — HMAC secret; REQUIRED for Events-API (HTTP)
+ *                                 mode to verify Slack's request signature.
+ *   - `userToken`   (`xoxp-…`) — OPTIONAL; user-scoped token for reads that the
+ *                                 bot token can't do (e.g. some file fetches).
+ *
+ * Two config shapes are recognised so the surface lines up with WhatsApp /
+ * Telegram:
+ *
+ *   Legacy (single-workspace):
+ *     channels.slack = { enabled: true, botToken: "xoxb-…", appToken: "xapp-…" }
+ *
+ *   Multi-workspace:
+ *     channels.slack = {
+ *       enabled: true,
+ *       accounts: [
+ *         { id: "acme", botToken: "xoxb-AAA", appToken: "xapp-AAA" },
+ *         { id: "labs", botToken: "xoxb-BBB", appToken: "xapp-BBB" },
+ *       ],
+ *     }
+ *
+ * A legacy config with no `accounts[]` reads as `[{ id: "default" }]`.
+ *
+ * Token resolution mirrors Telegram: a `${VAR}` ref expands against
+ * `process.env`; otherwise the literal passes through; then — for the bot token
+ * only — a DURABLE sealed token (written by `connect_channel`) is consulted so
+ * the channel survives a reboot; finally a per-secret env var is the last-resort
+ * fallback.
+ *
+ * Honesty note on sealing: `connect_channel` seals exactly ONE secret per
+ * channel, under `channel:slack` — that is the BOT token. The app-level token
+ * and signing secret are NOT durably sealed today; they must come from config
+ * (`${VAR}`/literal) or their per-secret env var (`SLACK_APP_TOKEN` /
+ * `SLACK_SIGNING_SECRET`). If a future `connect_channel` learns to seal those
+ * under `channel:slack:app` / `channel:slack:signing`, wire the sealed-read
+ * fallback back into `resolveSlackAppToken` / `resolveSlackSigningSecret`.
+ */
+import { readSealedChannelToken } from "../channel-secrets.js";
+const CHANNEL_ID = "slack";
+const DEFAULT_ACCOUNT_ID = "default";
+/** Per-secret env vars consulted as a last-resort fallback. */
+const BOT_TOKEN_ENV_VAR = "SLACK_BOT_TOKEN";
+const APP_TOKEN_ENV_VAR = "SLACK_APP_TOKEN";
+const SIGNING_SECRET_ENV_VAR = "SLACK_SIGNING_SECRET";
+const USER_TOKEN_ENV_VAR = "SLACK_USER_TOKEN";
+/**
+ * Standard proxy env vars consulted as a last-resort proxy fallback, in
+ * precedence order. Lower-case wins over upper-case (curl/undici convention),
+ * and a TLS-oriented `https_proxy` outranks the catch-all `ALL_PROXY`. These
+ * mirror the keys undici's own `EnvHttpProxyAgent` honours (same set Telegram
+ * uses).
+ */
+const PROXY_ENV_VARS = ["https_proxy", "HTTPS_PROXY", "all_proxy", "ALL_PROXY"];
+/**
+ * Sealed-token key for the bot token (`channel:slack`) — the ONLY Slack secret
+ * `connect_channel` seals today. The app token + signing secret are not sealed
+ * (see the header note), so their resolvers pass `sealKey: null`.
+ */
+const SEAL_KEY_BOT = CHANNEL_ID; // `channel:slack`
+/** `${VAR}` secret-ref form — identical to `config/io.ts`'s SECRET_REF_PATTERN. */
+const SECRET_REF_PATTERN = /^\$\{([A-Z_][A-Z0-9_]*)\}$/;
+/** Default gateway path the Events-API transport registers + Slack POSTs to. */
+const DEFAULT_EVENTS_PATH = "/slack/events";
+/** Read `channels.slack` loosely (schema keeps it open). */
+function slackChannelConfig(cfg) {
+    return cfg.channels?.[CHANNEL_ID];
+}
+/**
+ * Resolve a single token-ish string: a `${VAR}` ref expands against
+ * `process.env`; any other non-empty string passes through verbatim; empty /
+ * missing returns "".
+ */
+function resolveTokenRef(raw, env) {
+    if (typeof raw !== "string")
+        return "";
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return "";
+    const m = SECRET_REF_PATTERN.exec(trimmed);
+    if (m && m[1])
+        return (env[m[1]] ?? "").trim();
+    return trimmed;
+}
+/** Is the Slack channel switched on at all (any shape)? */
+export function slackChannelEnabled(cfg) {
+    return slackChannelConfig(cfg)?.enabled === true;
+}
+/** List configured account ids. Legacy single-account configs surface `["default"]`. */
+export function listSlackAccountIds(cfg) {
+    const slot = slackChannelConfig(cfg);
+    if (!slot || slot.enabled !== true)
+        return [];
+    const accounts = Array.isArray(slot.accounts) ? slot.accounts : undefined;
+    if (!accounts || accounts.length === 0)
+        return [DEFAULT_ACCOUNT_ID];
+    const ids = [];
+    const seen = new Set();
+    for (const entry of accounts) {
+        const id = typeof entry?.id === "string" ? entry.id.trim() : "";
+        if (!id || seen.has(id))
+            continue;
+        seen.add(id);
+        ids.push(id);
+    }
+    // A half-typed `accounts:[]` still degrades to the default account so the
+    // channel isn't silently disabled.
+    return ids.length === 0 ? [DEFAULT_ACCOUNT_ID] : ids;
+}
+/** Look up the raw account entry from config (or null when missing). */
+function findAccountEntry(cfg, accountId) {
+    const slot = slackChannelConfig(cfg);
+    if (!slot)
+        return null;
+    const accounts = Array.isArray(slot.accounts) ? slot.accounts : undefined;
+    if (!accounts)
+        return null;
+    for (const entry of accounts) {
+        const id = typeof entry?.id === "string" ? entry.id.trim() : "";
+        if (id === accountId)
+            return entry;
+    }
+    return null;
+}
+/**
+ * Resolve one Slack secret for an account. Precedence (mirrors Telegram's token
+ * resolution): per-account config `${VAR}`/literal → top-level config → durable
+ * sealed token → per-secret env var. Returns `""` when nothing resolves.
+ */
+function resolveSecret(cfg, accountId, field, sealKey, envVar, env) {
+    const id = accountId?.trim() || DEFAULT_ACCOUNT_ID;
+    const slot = slackChannelConfig(cfg);
+    const entry = findAccountEntry(cfg, id);
+    const perAccount = resolveTokenRef(entry?.[field], env);
+    if (perAccount)
+        return perAccount;
+    const topLevel = resolveTokenRef(slot?.[field], env);
+    if (topLevel)
+        return topLevel;
+    if (sealKey) {
+        const sealed = readSealedChannelToken(sealKey);
+        if (sealed)
+            return sealed;
+    }
+    if (envVar) {
+        const fromEnv = (env[envVar] ?? "").trim();
+        if (fromEnv)
+            return fromEnv;
+    }
+    return "";
+}
+/** Resolve the bot user token (`xoxb-…`) for an account. */
+export function resolveSlackBotToken(cfg, accountId, env = process.env) {
+    return resolveSecret(cfg, accountId, "botToken", SEAL_KEY_BOT, BOT_TOKEN_ENV_VAR, env);
+}
+/**
+ * Resolve the app-level token (`xapp-…`, Socket Mode) for an account. NOT sealed
+ * by `connect_channel` today (sealKey `null`) — comes from config or
+ * `SLACK_APP_TOKEN`.
+ */
+export function resolveSlackAppToken(cfg, accountId, env = process.env) {
+    return resolveSecret(cfg, accountId, "appToken", null, APP_TOKEN_ENV_VAR, env);
+}
+/**
+ * Resolve the HMAC signing secret (Events-API mode) for an account. NOT sealed
+ * by `connect_channel` today (sealKey `null`) — comes from config or
+ * `SLACK_SIGNING_SECRET`.
+ */
+export function resolveSlackSigningSecret(cfg, accountId, env = process.env) {
+    return resolveSecret(cfg, accountId, "signingSecret", null, SIGNING_SECRET_ENV_VAR, env);
+}
+/** Resolve the optional user token (`xoxp-…`) for an account. */
+export function resolveSlackUserToken(cfg, accountId, env = process.env) {
+    return resolveSecret(cfg, accountId, "userToken", null, USER_TOKEN_ENV_VAR, env);
+}
+/**
+ * Resolve the proxy URL all Slack API calls (+ the Socket Mode websocket) should
+ * route through. Precedence (mirrors Telegram's `resolveTelegramProxyUrl`):
+ *   1. The per-account `accounts[].proxy` (multi-workspace shape), `${VAR}`-resolved.
+ *   2. The top-level `channels.slack.proxy`, `${VAR}`-resolved.
+ *   3. The first set standard proxy env var (`https_proxy` / `HTTPS_PROXY` /
+ *      `all_proxy` / `ALL_PROXY`) — last-resort fallback.
+ * Returns `""` when none is configured → a DIRECT connection (the default,
+ * byte-unchanged from before proxy support existed).
+ *
+ * `${VAR}` refs are resolved here the same way `botToken` is, so an operator can
+ * keep the proxy (which may carry `user:pass@` creds) out of the committed
+ * config as `channels.slack.proxy: "${SLACK_PROXY}"`.
+ */
+export function resolveSlackProxyUrl(cfg, accountId, env = process.env) {
+    const id = accountId?.trim() || DEFAULT_ACCOUNT_ID;
+    const slot = slackChannelConfig(cfg);
+    const entry = findAccountEntry(cfg, id);
+    const perAccount = resolveTokenRef(entry?.proxy, env);
+    if (perAccount)
+        return perAccount;
+    const topLevel = resolveTokenRef(slot?.proxy, env);
+    if (topLevel)
+        return topLevel;
+    for (const key of PROXY_ENV_VARS) {
+        const value = (env[key] ?? "").trim();
+        if (value)
+            return value;
+    }
+    return "";
+}
+/**
+ * Mask a proxy URL down to `scheme://host:port` (creds + path dropped) so it is
+ * safe to log. A malformed URL is reduced to its scheme only; an empty input
+ * returns "". NEVER log a raw proxy URL — it may embed `user:pass@`.
+ */
+export function maskProxyUrl(proxyUrl) {
+    const raw = (proxyUrl ?? "").trim();
+    if (!raw)
+        return "";
+    try {
+        const u = new URL(raw);
+        return `${u.protocol}//${u.host}`; // host includes :port; userinfo + path/query dropped
+    }
+    catch {
+        const scheme = /^([a-z][a-z0-9+.-]*):\/\//i.exec(raw)?.[1];
+        return scheme ? `${scheme}://<masked>` : "<masked>";
+    }
+}
+/** Resolve a per-account view of the config (defaults + token resolution filled in). */
+export function resolveSlackAccount(cfg, accountId, env = process.env) {
+    const slot = slackChannelConfig(cfg);
+    const id = accountId?.trim() || DEFAULT_ACCOUNT_ID;
+    const entry = findAccountEntry(cfg, id);
+    const enabled = entry?.enabled !== false && slot?.enabled === true;
+    return {
+        accountId: id,
+        enabled,
+        botToken: resolveSlackBotToken(cfg, id, env),
+        appToken: resolveSlackAppToken(cfg, id, env),
+        signingSecret: resolveSlackSigningSecret(cfg, id, env),
+        userToken: resolveSlackUserToken(cfg, id, env),
+        proxyUrl: resolveSlackProxyUrl(cfg, id, env),
+        verbose: slot?.verbose === true,
+    };
+}
+/**
+ * Resolve the Slack transport config. Defaults to `socket` (Brigade is
+ * local-first and Socket Mode needs no public URL); `events` is opt-in via
+ * `channels.slack.mode: "events"`.
+ */
+export function slackEventsConfig(cfg) {
+    const slot = slackChannelConfig(cfg);
+    const rawMode = typeof slot?.mode === "string" ? slot.mode.trim().toLowerCase() : "";
+    const mode = rawMode === "events" || rawMode === "http" ? "events" : "socket";
+    const ev = slot?.events ?? {};
+    const path = typeof ev.path === "string" && ev.path.trim() ? ev.path.trim() : DEFAULT_EVENTS_PATH;
+    return {
+        mode,
+        url: typeof ev.url === "string" ? ev.url.trim() : "",
+        path: path.startsWith("/") ? path : `/${path}`,
+    };
+}
+/**
+ * Normalize a path to a leading-slash, trailing-slash-stripped form so derived
+ * per-account paths concatenate cleanly. `"/slack/events/"` → `"/slack/events"`.
+ */
+function normalizeEventsPath(raw) {
+    const trimmed = (raw ?? "").trim();
+    const withSlash = trimmed.startsWith("/") ? trimmed : `/${trimmed}`;
+    return withSlash.length > 1 ? withSlash.replace(/\/+$/, "") : withSlash;
+}
+/**
+ * Resolve the events-mode gateway route path for ONE account. Multi-workspace
+ * installs need a DISTINCT path per workspace (Slack POSTs to a per-app URL, and
+ * the gateway routes by exact path):
+ *
+ *   - default account → the configured base events path (`channels.slack.events.
+ *     path`, default `/slack/events`) — byte-identical to the single-workspace
+ *     path so an existing default-only install is unchanged.
+ *   - a named account → its explicit `accounts[].webhookPath` when set
+ *     (`${VAR}`-resolved), else the derived `${basePath}/<accountId>` so two
+ *     workspaces can't collide on one route.
+ *
+ * The base path is read from `slackEventsConfig`, so a custom
+ * `channels.slack.events.path` propagates to every derived per-account path.
+ */
+export function resolveSlackEventsPath(cfg, accountId, env = process.env) {
+    const id = accountId?.trim() || DEFAULT_ACCOUNT_ID;
+    const basePath = normalizeEventsPath(slackEventsConfig(cfg).path);
+    if (id === DEFAULT_ACCOUNT_ID)
+        return basePath;
+    const entry = findAccountEntry(cfg, id);
+    const explicit = resolveTokenRef(entry?.webhookPath, env);
+    if (explicit)
+        return normalizeEventsPath(explicit);
+    // Derive a collision-free path from the account id (path-segment-safe slug).
+    const slug = id.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "") || id;
+    return `${basePath}/${slug}`;
+}
+/**
+ * True when live reply-streaming is enabled (`channels.slack.liveStream`).
+ * Default OFF — the adapter delivers one final chunked message.
+ */
+export function slackLiveStreamEnabled(cfg) {
+    return slackChannelConfig(cfg)?.liveStream === true;
+}
+/**
+ * Resolve the streaming edit throttle in ms. Reads
+ * `channels.slack.streamThrottleMs`; falls back to 1000ms (floored at 250ms by
+ * the draft-stream).
+ */
+export function slackStreamThrottleMs(cfg) {
+    const raw = slackChannelConfig(cfg)?.streamThrottleMs;
+    return typeof raw === "number" && raw > 0 ? raw : 1000;
+}
+/**
+ * True when reasoning surfacing is enabled (`channels.slack.surfaceReasoning`).
+ * Default OFF — `<think>` reasoning is stripped from channel replies as today.
+ */
+export function slackSurfaceReasoning(cfg) {
+    return slackChannelConfig(cfg)?.surfaceReasoning === true;
+}
+/**
+ * Resolve the idle-thread-session TTL in ms, or `null` when unset / disabled.
+ * Accepts a number (ms) or a duration string (`"6h"`, `"30m"`, …). The cron
+ * session-reaper uses this to age out idle Slack thread sessions.
+ */
+export function slackThreadIdleTtlMs(cfg) {
+    const raw = slackChannelConfig(cfg)?.threadIdleTtlMs;
+    if (typeof raw === "number")
+        return raw > 0 ? raw : null;
+    if (typeof raw !== "string")
+        return null;
+    const trimmed = raw.trim();
+    if (!trimmed)
+        return null;
+    const m = /^(\d+)\s*(s|m|h|d|w)?$/i.exec(trimmed);
+    if (!m)
+        return null;
+    const n = Number(m[1]);
+    if (!Number.isFinite(n) || n <= 0)
+        return null;
+    const unit = (m[2] ?? "ms").toLowerCase();
+    const mult = { s: 1_000, m: 60_000, h: 3_600_000, d: 86_400_000, w: 604_800_000, ms: 1 };
+    const factor = mult[unit] ?? 1;
+    return n * factor;
+}
+export { CHANNEL_ID as SLACK_CHANNEL_ID, DEFAULT_ACCOUNT_ID as SLACK_DEFAULT_ACCOUNT_ID, BOT_TOKEN_ENV_VAR as SLACK_BOT_TOKEN_ENV_VAR, APP_TOKEN_ENV_VAR as SLACK_APP_TOKEN_ENV_VAR, SIGNING_SECRET_ENV_VAR as SLACK_SIGNING_SECRET_ENV_VAR, USER_TOKEN_ENV_VAR as SLACK_USER_TOKEN_ENV_VAR, };
+//# sourceMappingURL=account-config.js.map

package/dist/agents/channels/slack/account-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-config.js","sourceRoot":"","sources":["../../../../src/agents/channels/slack/account-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAGH,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE/D,MAAM,UAAU,GAAG,OAAO,CAAC;AAC3B,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAErC,+DAA+D;AAC/D,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAC5C,MAAM,iBAAiB,GAAG,iBAAiB,CAAC;AAC5C,MAAM,sBAAsB,GAAG,sBAAsB,CAAC;AACtD,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,cAAc,GAAG,CAAC,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,CAAU,CAAC;AAEzF;;;;GAIG;AACH,MAAM,YAAY,GAAG,UAAU,CAAC,CAAC,kBAAkB;AAEnD,mFAAmF;AACnF,MAAM,kBAAkB,GAAG,4BAA4B,CAAC;AAExD,gFAAgF;AAChF,MAAM,mBAAmB,GAAG,eAAe,CAAC;AA2F5C,4DAA4D;AAC5D,SAAS,kBAAkB,CAAC,GAAkB;IAC7C,OAAQ,GAA6D,CAAC,QAAQ,EAAE,CAAC,UAAU,CAAC,CAAC;AAC9F,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,GAAuB,EAAE,GAAsB;IACvE,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,MAAM,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,mBAAmB,CAAC,GAAkB;IACrD,OAAO,kBAAkB,CAAC,GAAG,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;AAClD,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,mBAAmB,CAAC,GAAkB;IACrD,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACpE,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAG,OAAO,KAAK,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAClC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACd,CAAC;IACD,0EAA0E;IAC1E,mCAAmC;IACnC,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACtD,CAAC;AAED,wEAAwE;AACxE,SAAS,gBAAgB,CAAC,GAAkB,EAAE,SAAiB;IAC9D,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAG,OAAO,KAAK,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;IACpC,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CACrB,GAAkB,EAClB,SAAoC,EACpC,KAA8D,EAC9D,OAAsB,EACtB,MAAqB,EACrB,GAAsB;IAEtB,MAAM,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,IAAI,kBAAkB,CAAC;IACnD,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,EAAE,CAAC,KAAK,CAAuB,EAAE,GAAG,CAAC,CAAC;IAC9E,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC,KAAK,CAAuB,EAAE,GAAG,CAAC,CAAC;IAC3E,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,OAAO,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;IAC3B,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC7B,CAAC;IACD,OAAO,EAAE,CAAC;AACX,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,oBAAoB,CACnC,GAAkB,EAClB,SAAyB,EACzB,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,EAAE,GAAG,CAAC,CAAC;AACxF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CACnC,GAAkB,EAClB,SAAyB,EACzB,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,CAAC,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CACxC,GAAkB,EAClB,SAAyB,EACzB,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,sBAAsB,EAAE,GAAG,CAAC,CAAC;AAC1F,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,qBAAqB,CACpC,GAAkB,EAClB,SAAyB,EACzB,MAAyB,OAAO,CAAC,GAAG;IAEpC,OAAO,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC;AAClF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CACnC,GAAkB,EAClB,SAAyB,EACzB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,IAAI,kBAAkB,CAAC;IACnD,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,UAAU,GAAG,eAAe,CAAC,KAAK,EAAE,KAA2B,EAAE,GAAG,CAAC,CAAC;IAC5E,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,EAAE,KAA2B,EAAE,GAAG,CAAC,CAAC;IACzE,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,EAAE,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC5C,MAAM,GAAG,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,OAAO,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,qDAAqD;IACzF,CAAC;IAAC,MAAM,CAAC;QACR,MAAM,MAAM,GAAG,4BAA4B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3D,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC;IACrD,CAAC;AACF,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,mBAAmB,CAClC,GAAkB,EAClB,SAAyB,EACzB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,IAAI,kBAAkB,CAAC;IACnD,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,KAAK,EAAE,OAAO,KAAK,KAAK,IAAI,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;IACnE,OAAO;QACN,SAAS,EAAE,EAAE;QACb,OAAO;QACP,QAAQ,EAAE,oBAAoB,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC;QAC5C,QAAQ,EAAE,oBAAoB,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC;QAC5C,aAAa,EAAE,yBAAyB,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC;QACtD,SAAS,EAAE,qBAAqB,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC;QAC9C,QAAQ,EAAE,oBAAoB,CAAC,GAAG,EAAE,EAAE,EAAE,GAAG,CAAC;QAC5C,OAAO,EAAE,IAAI,EAAE,OAAO,KAAK,IAAI;KAC/B,CAAC;AACH,CAAC;AAcD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAkB;IACnD,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrF,MAAM,IAAI,GAAwB,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;IACnG,MAAM,EAAE,GAAG,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC,IAAI,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,mBAAmB,CAAC;IAClG,OAAO;QACN,IAAI;QACJ,GAAG,EAAE,OAAO,EAAE,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;QACpD,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE;KAC9C,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,GAAW;IACvC,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;IACpE,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,sBAAsB,CACrC,GAAkB,EAClB,SAAyB,EACzB,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,IAAI,kBAAkB,CAAC;IACnD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IAClE,IAAI,EAAE,KAAK,kBAAkB;QAAE,OAAO,QAAQ,CAAC;IAC/C,MAAM,KAAK,GAAG,gBAAgB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,EAAE,WAAiC,EAAE,GAAG,CAAC,CAAC;IAChF,IAAI,QAAQ;QAAE,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACnD,6EAA6E;IAC7E,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;IAChF,OAAO,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAkB;IACxD,OAAO,kBAAkB,CAAC,GAAG,CAAC,EAAE,UAAU,KAAK,IAAI,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAkB;IACvD,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,EAAE,gBAAgB,CAAC;IACtD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAkB;IACvD,OAAO,kBAAkB,CAAC,GAAG,CAAC,EAAE,gBAAgB,KAAK,IAAI,CAAC;AAC3D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAkB;IACtD,MAAM,GAAG,GAAG,kBAAkB,CAAC,GAAG,CAAC,EAAE,eAAe,CAAC;IACrD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,CAAC,GAAG,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1C,MAAM,IAAI,GAA2B,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;IACjH,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,OAAO,CAAC,GAAG,MAAM,CAAC;AACnB,CAAC;AAED,OAAO,EACN,UAAU,IAAI,gBAAgB,EAC9B,kBAAkB,IAAI,wBAAwB,EAC9C,iBAAiB,IAAI,uBAAuB,EAC5C,iBAAiB,IAAI,uBAAuB,EAC5C,sBAAsB,IAAI,4BAA4B,EACtD,kBAAkB,IAAI,wBAAwB,GAC9C,CAAC"}

package/dist/agents/channels/slack/account-registry.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Per-account Slack adapter registry — the cross-module bridge that lets the
+ * Events-API webhook routes (registered at module `register()` time in
+ * `module.ts`) find the per-account adapters that are STARTED later by
+ * `createSlackPlugin` (`plugin.ts`).
+ *
+ * Why this exists. In multi-workspace events mode each account has its OWN
+ * inbound webhook path (`/slack/events/<accountId>`). The gateway only accepts
+ * `b.httpRoute(...)` registrations during a module's `register()`, but the
+ * per-account adapters that those routes must feed are owned by the plugin's
+ * `startAccount` lifecycle, which runs AFTER `register()`. So the module
+ * registers one route per configured account up front, each route resolving its
+ * account's started adapter through THIS registry at request time (a thunk),
+ * and the plugin populates the registry on `startAccount` / clears it on
+ * `stopAccount`. Same shape + rationale as the channel approval-dispatcher
+ * registry (`approval-router.ts`): a process-wide singleton avoids threading the
+ * map through the gateway boot, and a single Slack workspace path is unaffected
+ * (the legacy single-adapter module owns its own route + adapter directly).
+ *
+ * Pinned via `resolveGlobalSingleton` so a hot reload / dual-build run shares
+ * one map (identical to the approval router).
+ */
+/** The minimal adapter surface a webhook route needs to feed inbound events. */
+export interface SlackAccountSink {
+    /** Feed a parsed Slack payload into the started adapter's inbound path. */
+    feedWebhookEvent(kind: "event" | "interactive" | "slash", payload: unknown): void;
+}
+/**
+ * Register a started per-account adapter so its events-mode webhook route can
+ * feed inbound into it. The plugin calls this on `startAccount`. Idempotent —
+ * re-registering replaces the previous entry (restart-friendly).
+ */
+export declare function registerSlackAccountSink(accountId: string, sink: SlackAccountSink): void;
+/**
+ * Drop a per-account adapter (the plugin calls this on `stopAccount`) so a
+ * torn-down workspace's route can't feed a dead adapter.
+ */
+export declare function removeSlackAccountSink(accountId: string): void;
+/** Look up a started per-account adapter (or undefined when not started). */
+export declare function getSlackAccountSink(accountId: string): SlackAccountSink | undefined;
+/** Diagnostic — the account ids with a live sink. */
+export declare function listSlackAccountSinks(): string[];
+/** Test-only — clear every registered sink. */
+export declare function resetSlackAccountSinksForTests(): void;
+//# sourceMappingURL=account-registry.d.ts.map

package/dist/agents/channels/slack/account-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-registry.d.ts","sourceRoot":"","sources":["../../../../src/agents/channels/slack/account-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAKH,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAChC,2EAA2E;IAC3E,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,aAAa,GAAG,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;CAClF;AAcD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAExF;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAE9D;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS,CAEnF;AAED,qDAAqD;AACrD,wBAAgB,qBAAqB,IAAI,MAAM,EAAE,CAEhD;AAED,+CAA+C;AAC/C,wBAAgB,8BAA8B,IAAI,IAAI,CAErD"}

package/dist/agents/channels/slack/account-registry.js

@@ -0,0 +1,58 @@
+/**
+ * Per-account Slack adapter registry — the cross-module bridge that lets the
+ * Events-API webhook routes (registered at module `register()` time in
+ * `module.ts`) find the per-account adapters that are STARTED later by
+ * `createSlackPlugin` (`plugin.ts`).
+ *
+ * Why this exists. In multi-workspace events mode each account has its OWN
+ * inbound webhook path (`/slack/events/<accountId>`). The gateway only accepts
+ * `b.httpRoute(...)` registrations during a module's `register()`, but the
+ * per-account adapters that those routes must feed are owned by the plugin's
+ * `startAccount` lifecycle, which runs AFTER `register()`. So the module
+ * registers one route per configured account up front, each route resolving its
+ * account's started adapter through THIS registry at request time (a thunk),
+ * and the plugin populates the registry on `startAccount` / clears it on
+ * `stopAccount`. Same shape + rationale as the channel approval-dispatcher
+ * registry (`approval-router.ts`): a process-wide singleton avoids threading the
+ * map through the gateway boot, and a single Slack workspace path is unaffected
+ * (the legacy single-adapter module owns its own route + adapter directly).
+ *
+ * Pinned via `resolveGlobalSingleton` so a hot reload / dual-build run shares
+ * one map (identical to the approval router).
+ */
+import { resolveGlobalSingleton } from "../../../shared/global-singleton.js";
+import { SLACK_DEFAULT_ACCOUNT_ID } from "./account-config.js";
+const SLACK_ACCOUNT_SINKS_KEY = Symbol.for("brigade.slack.accountSinks");
+/** Keyed by accountId — one started adapter per workspace. */
+const sinks = resolveGlobalSingleton(SLACK_ACCOUNT_SINKS_KEY, () => new Map());
+function normalizeAccountId(accountId) {
+    return accountId && accountId.trim() ? accountId.trim() : SLACK_DEFAULT_ACCOUNT_ID;
+}
+/**
+ * Register a started per-account adapter so its events-mode webhook route can
+ * feed inbound into it. The plugin calls this on `startAccount`. Idempotent —
+ * re-registering replaces the previous entry (restart-friendly).
+ */
+export function registerSlackAccountSink(accountId, sink) {
+    sinks.set(normalizeAccountId(accountId), sink);
+}
+/**
+ * Drop a per-account adapter (the plugin calls this on `stopAccount`) so a
+ * torn-down workspace's route can't feed a dead adapter.
+ */
+export function removeSlackAccountSink(accountId) {
+    sinks.delete(normalizeAccountId(accountId));
+}
+/** Look up a started per-account adapter (or undefined when not started). */
+export function getSlackAccountSink(accountId) {
+    return sinks.get(normalizeAccountId(accountId));
+}
+/** Diagnostic — the account ids with a live sink. */
+export function listSlackAccountSinks() {
+    return [...sinks.keys()];
+}
+/** Test-only — clear every registered sink. */
+export function resetSlackAccountSinksForTests() {
+    sinks.clear();
+}
+//# sourceMappingURL=account-registry.js.map