@tangle-network/agent-app 0.45.29 → 0.45.30

package/dist/chunk-COP2K4LF.js

@@ -0,0 +1,190 @@
+// src/alerting/slack.ts
+var SLACK_API = "https://slack.com/api";
+var DEFAULT_TIMEOUT_MS = 1e4;
+var DEFAULT_ATTEMPTS = 3;
+var CREDENTIAL_ERRORS = /* @__PURE__ */ new Set([
+  "invalid_auth",
+  "not_authed",
+  "account_inactive",
+  "token_revoked",
+  "token_expired",
+  "no_permission",
+  "missing_scope",
+  "ekm_access_denied"
+]);
+var CHANNEL_ERRORS = /* @__PURE__ */ new Set([
+  "channel_not_found",
+  "not_in_channel",
+  "is_archived",
+  "restricted_action",
+  "restricted_action_read_only_channel"
+]);
+function remedyFor(reason, error, channel) {
+  switch (reason) {
+    case "credential":
+      return `Slack rejected the bot token (${error}) \u2014 no alert can arrive until a human mints a new one. Reinstall the Slack app and update SLACK_BOT_TOKEN wherever it is stored.`;
+    case "channel":
+      return `Slack accepted the token but refused ${channel} (${error}) \u2014 invite the bot to ${channel}, or correct the channel name.`;
+    default:
+      return `Slack refused the post (${error}).`;
+  }
+}
+function classifySlackError(error, channel) {
+  const reason = CREDENTIAL_ERRORS.has(error) ? "credential" : CHANNEL_ERRORS.has(error) ? "channel" : "api";
+  return { delivered: false, reason, detail: remedyFor(reason, error, channel) };
+}
+function retryDelayMs(response, attempt) {
+  const header = Number(response.headers.get("retry-after"));
+  if (Number.isFinite(header) && header > 0) return Math.min(header * 1e3, 3e4);
+  return Math.min(500 * 2 ** (attempt - 1), 8e3);
+}
+var defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+async function postSlackAlert(options) {
+  const token = options.token?.trim();
+  const channel = options.channel?.trim();
+  const webhookUrl = options.webhookUrl?.trim();
+  if (!token && !webhookUrl) {
+    return {
+      delivered: false,
+      reason: "not-configured",
+      detail: "no Slack credential configured \u2014 set SLACK_BOT_TOKEN (preferred, verifiable) or SLACK_WEBHOOK_URL to route alerts to Slack"
+    };
+  }
+  if (token && !channel) {
+    return {
+      delivered: false,
+      reason: "not-configured",
+      detail: "a Slack bot token is set but no channel is \u2014 set the alert channel (e.g. #infra-alerts)"
+    };
+  }
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const sleep = options.sleepImpl ?? defaultSleep;
+  const attempts = Math.max(1, options.attempts ?? DEFAULT_ATTEMPTS);
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  const transport = token ? { kind: "token", token, channel } : { kind: "webhook", url: webhookUrl };
+  let lastTransient = {
+    delivered: false,
+    reason: "transport",
+    detail: "Slack was never reached"
+  };
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    let response;
+    try {
+      response = await fetchImpl(requestUrl(transport), {
+        method: "POST",
+        headers: requestHeaders(transport),
+        body: JSON.stringify(requestBody(transport, options.text)),
+        signal: controller.signal
+      });
+    } catch (error) {
+      lastTransient = {
+        delivered: false,
+        reason: "transport",
+        detail: `could not reach Slack: ${error instanceof Error ? error.message : String(error)}`
+      };
+      if (attempt < attempts) await sleep(Math.min(500 * 2 ** (attempt - 1), 8e3));
+      continue;
+    } finally {
+      clearTimeout(timer);
+    }
+    if (response.status === 429 || response.status >= 500) {
+      lastTransient = {
+        delivered: false,
+        reason: response.status === 429 ? "rate-limited" : "transport",
+        detail: `Slack returned ${response.status}`
+      };
+      if (attempt < attempts) await sleep(retryDelayMs(response, attempt));
+      continue;
+    }
+    return transport.kind === "token" ? await settleTokenResponse(response, transport.channel) : await settleWebhookResponse(response);
+  }
+  return lastTransient;
+}
+function requestUrl(transport) {
+  return transport.kind === "token" ? `${SLACK_API}/chat.postMessage` : transport.url;
+}
+function requestHeaders(transport) {
+  const headers = { "Content-Type": "application/json; charset=utf-8" };
+  if (transport.kind === "token") headers.Authorization = `Bearer ${transport.token}`;
+  return headers;
+}
+function requestBody(transport, text) {
+  return transport.kind === "token" ? { channel: transport.channel, text } : { text };
+}
+async function settleTokenResponse(response, channel) {
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    return {
+      delivered: false,
+      reason: "api",
+      detail: `Slack returned ${response.status} with an unreadable body`
+    };
+  }
+  if (body.ok === true) {
+    return { delivered: true, channel: body.channel ?? channel, ts: body.ts ?? "" };
+  }
+  return classifySlackError(body.error ?? `http_${response.status}`, channel);
+}
+async function settleWebhookResponse(response) {
+  const body = (await response.text().catch(() => "")).trim();
+  if (response.ok && body === "ok") {
+    return { delivered: true, channel: "(webhook)", ts: "" };
+  }
+  const error = body || `http_${response.status}`;
+  const reason = WEBHOOK_CREDENTIAL_ERRORS.has(error) ? "credential" : WEBHOOK_CHANNEL_ERRORS.has(error) ? "channel" : "api";
+  return {
+    delivered: false,
+    reason,
+    detail: reason === "credential" ? `the Slack webhook is revoked (${error}) \u2014 no alert can arrive until a human mints a new one. Prefer replacing it with a bot token, whose liveness can be checked before an alert needs it.` : reason === "channel" ? `Slack refused the webhook's channel (${error}) \u2014 the channel was archived, or the app lost access.` : `Slack refused the webhook post (${error}).`
+  };
+}
+var WEBHOOK_CREDENTIAL_ERRORS = /* @__PURE__ */ new Set(["no_service", "no_team", "invalid_token"]);
+var WEBHOOK_CHANNEL_ERRORS = /* @__PURE__ */ new Set(["channel_not_found", "channel_is_archived", "action_prohibited"]);
+async function checkSlackCredential(options) {
+  const token = options.token?.trim();
+  if (!token) {
+    return {
+      live: false,
+      reason: "not-configured",
+      detail: "no Slack bot token configured \u2014 set SLACK_BOT_TOKEN"
+    };
+  }
+  const fetchImpl = options.fetchImpl ?? fetch;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+  try {
+    const response = await fetchImpl(`${SLACK_API}/auth.test`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${token}` },
+      signal: controller.signal
+    });
+    const body = await response.json();
+    if (body.ok === true) {
+      return { live: true, team: body.team ?? "unknown", botId: body.bot_id ?? "unknown" };
+    }
+    const outcome = classifySlackError(body.error ?? `http_${response.status}`, "(auth.test)");
+    return {
+      live: false,
+      reason: outcome.reason === "channel" ? "credential" : outcome.reason,
+      detail: outcome.detail
+    };
+  } catch (error) {
+    return {
+      live: false,
+      reason: "transport",
+      detail: `could not reach Slack: ${error instanceof Error ? error.message : String(error)}`
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+export {
+  postSlackAlert,
+  checkSlackCredential
+};
+//# sourceMappingURL=chunk-COP2K4LF.js.map

package/dist/chunk-COP2K4LF.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/alerting/slack.ts"],"sourcesContent":["/**\n * `/alerting` — post an operational alert to Slack, and say honestly when it\n * did not arrive.\n *\n * WHY THIS EXISTS: on 2026-08-06 an audit of every Slack credential the org\n * held found three of four dead — the fleet incoming webhook 404ing\n * (`no_service`), a second company webhook likewise, and the bot token\n * answering `account_inactive`. One ops webhook was still live. Nobody knew\n * which was which until each was tested by hand, and that is the actual\n * problem: the credentials were indistinguishable from where the code stood.\n *\n * This failure has already been paid for once, with numbers: in\n * `agent-dev-container`, a revoked webhook let the CI healthcheck sit dead for\n * 18 days — 2,567 consecutive failures, 27 successes, zero alerts — because\n * fifteen call sites across six workflows posted with no body inspection and\n * then asserted delivery. That repo fixed the reporting (its `post-slack.sh`\n * confirms 2xx AND Slack's literal `ok` body, and fails closed otherwise) and\n * that half of the lesson is theirs, adopted here.\n *\n * What their fix cannot do, and this module can, is answer the question BEFORE\n * an alert needs to fire. A fail-closed post still only discovers a dead\n * credential at the moment a page is lost. That is the second half.\n *\n * Two design consequences, and they are the whole module:\n *\n * 1. **A bot token and `chat.postMessage` is the preferred transport; an\n *    incoming webhook is supported because one is usually what you already\n *    have.** A token reaches every channel (a webhook is bolted to one), is\n *    revocable and rotatable in place, and — the part that matters — is\n *    VERIFIABLE: `auth.test` answers whether the credential is alive without\n *    posting anything, which is what lets `/preflight` fail a deploy on a dead\n *    alerting channel instead of discovering it during an incident. A webhook\n *    can only be tested by posting to it, which is why the three dead\n *    credentials above went unnoticed. A token is never fallen back FROM: if\n *    one is configured and dead, delivering over a webhook instead would hide\n *    the very condition worth reporting.\n *\n * 2. **Slack answers `ok:false` under HTTP 200.** `invalid_auth`,\n *    `channel_not_found` and `not_in_channel` all arrive as a successful\n *    response with a failure inside it, so a status check reads a dead channel\n *    as a delivered page. The body is always parsed, and the outcome\n *    distinguishes a MISSING credential (configuration absent — not an\n *    incident) from a DEAD one (the alerting channel itself is broken — the\n *    loudest thing this module can report). A summary that calls those two the\n *    same thing is the defect wearing a different hat.\n *\n * The caller decides what to do with a non-delivery; this module never throws\n * on one, because an alerting path that can take down the thing it reports on\n * is worse than the outage it was watching for. It is also never the only\n * channel: a durable record (an issue, an audit row) is the caller's job, and\n * that is what survives the credential going dead again.\n *\n * Server-only: holds a bot token. This subpath must never reach a browser\n * bundle.\n */\n\nconst SLACK_API = 'https://slack.com/api'\nconst DEFAULT_TIMEOUT_MS = 10_000\nconst DEFAULT_ATTEMPTS = 3\n\n/**\n * Why an alert did not reach Slack. The split is by what a human must DO about\n * it, since that is the only distinction a caller can act on.\n */\nexport type SlackFailureReason =\n  /** No token or no channel configured. Configuration is absent, nothing is broken. */\n  | 'not-configured'\n  /**\n   * The token is dead — revoked, or its app removed from the workspace. No\n   * alert will EVER arrive until a human mints a new one. This is itself an\n   * incident and the caller should escalate it on a channel that does not\n   * depend on Slack.\n   */\n  | 'credential'\n  /**\n   * The credential is alive but cannot post HERE: the channel is wrong,\n   * archived, or the bot was never invited to it. One human action fixes it.\n   */\n  | 'channel'\n  /** Slack asked us to slow down. Transient; the alert is worth retrying. */\n  | 'rate-limited'\n  /** The request never got an answer — network, DNS, timeout. Transient. */\n  | 'transport'\n  /** Slack refused for some other reason; `detail` carries its error code. */\n  | 'api'\n\n/** An alert that did not arrive, and why. Named because the classifiers only ever produce this half. */\nexport interface SlackAlertFailure {\n  delivered: false\n  reason: SlackFailureReason\n  /** One line naming what is wrong and what fixes it. Safe to log; carries no token. */\n  detail: string\n}\n\n/** What one `postSlackAlert` call did. Never a bare boolean — the caller pages differently per reason. */\nexport type SlackAlertOutcome =\n  | {\n      delivered: true\n      /** The channel id Slack resolved (not necessarily the name that was passed). */\n      channel: string\n      /** Slack's message timestamp — the message's identity, for a later thread reply. */\n      ts: string\n    }\n  | SlackAlertFailure\n\n/** Define configuration options for posting an alert message to a Slack channel */\nexport interface SlackAlertOptions {\n  /**\n   * Slack bot token (`xoxb-…`) with `chat:write`. The PREFERRED transport,\n   * because it is the only one whose liveness can be checked before an alert\n   * needs it. An empty or absent value is `not-configured`, never an error — a\n   * product that has not adopted Slack yet must not fail its alerting path.\n   */\n  token?: string | undefined\n  /**\n   * Channel to post to: a name (`#infra-alerts`) or an id (`C01234567`). The\n   * bot must be a member; Slack answers `not_in_channel` otherwise. Required\n   * with `token`, meaningless with `webhookUrl` (a webhook carries its own\n   * channel, fixed when it was created).\n   */\n  channel?: string | undefined\n  /**\n   * Slack incoming-webhook URL, used only when no `token` is configured.\n   *\n   * It works and it needs no setup, which is why it is supported — but it\n   * cannot be verified without posting, cannot be pointed at a second channel,\n   * and gives back an error token instead of a code. Two of the three webhooks\n   * this org has held were found revoked. Treat it as the transport you have,\n   * not the one you want.\n   *\n   * When a `token` is also configured this is IGNORED rather than used as a\n   * fallback: a dead token must surface as the incident it is, and quietly\n   * succeeding over a second transport is how the last outage stayed invisible.\n   */\n  webhookUrl?: string | undefined\n  /** Message body as Slack mrkdwn. Newlines are preserved. */\n  text: string\n  /**\n   * Attempts for a TRANSIENT failure (429 / 5xx / transport). Default 3. A\n   * dead credential or a wrong channel is never retried — the answer will not\n   * change, and retrying an auth failure is how a token gets rate-limited.\n   */\n  attempts?: number\n  /** Per-request deadline. Default 10s. */\n  timeoutMs?: number\n  /** Injection seam for tests; defaults to global `fetch`. */\n  fetchImpl?: typeof fetch\n  /** Injection seam for tests; defaults to a real delay between retries. */\n  sleepImpl?: (ms: number) => Promise<void>\n}\n\n/** Slack error codes that mean the CREDENTIAL is dead, not the request. */\nconst CREDENTIAL_ERRORS = new Set([\n  'invalid_auth',\n  'not_authed',\n  'account_inactive',\n  'token_revoked',\n  'token_expired',\n  'no_permission',\n  'missing_scope',\n  'ekm_access_denied',\n])\n\n/** Slack error codes that mean the credential is fine but this CHANNEL is not reachable. */\nconst CHANNEL_ERRORS = new Set([\n  'channel_not_found',\n  'not_in_channel',\n  'is_archived',\n  'restricted_action',\n  'restricted_action_read_only_channel',\n])\n\nfunction remedyFor(reason: SlackFailureReason, error: string, channel: string): string {\n  switch (reason) {\n    case 'credential':\n      return (\n        `Slack rejected the bot token (${error}) — no alert can arrive until a human mints a new one. ` +\n        'Reinstall the Slack app and update SLACK_BOT_TOKEN wherever it is stored.'\n      )\n    case 'channel':\n      return (\n        `Slack accepted the token but refused ${channel} (${error}) — ` +\n        `invite the bot to ${channel}, or correct the channel name.`\n      )\n    default:\n      return `Slack refused the post (${error}).`\n  }\n}\n\nfunction classifySlackError(error: string, channel: string): SlackAlertFailure {\n  const reason: SlackFailureReason = CREDENTIAL_ERRORS.has(error)\n    ? 'credential'\n    : CHANNEL_ERRORS.has(error)\n      ? 'channel'\n      : 'api'\n  return { delivered: false, reason, detail: remedyFor(reason, error, channel) }\n}\n\n/** Slack's `Retry-After` is in SECONDS. Bounded so a hostile header cannot park the caller. */\nfunction retryDelayMs(response: Response, attempt: number): number {\n  const header = Number(response.headers.get('retry-after'))\n  if (Number.isFinite(header) && header > 0) return Math.min(header * 1000, 30_000)\n  return Math.min(500 * 2 ** (attempt - 1), 8_000)\n}\n\nconst defaultSleep = (ms: number): Promise<void> => new Promise((resolve) => setTimeout(resolve, ms))\n\n/**\n * Post one alert to a Slack channel.\n *\n * Never throws and never retries a failure whose answer cannot change. The\n * returned outcome is the whole result — a caller that ignores it has an\n * alerting path it cannot prove works, which is the failure this module was\n * written for.\n */\nexport async function postSlackAlert(options: SlackAlertOptions): Promise<SlackAlertOutcome> {\n  const token = options.token?.trim()\n  const channel = options.channel?.trim()\n  const webhookUrl = options.webhookUrl?.trim()\n\n  if (!token && !webhookUrl) {\n    return {\n      delivered: false,\n      reason: 'not-configured',\n      detail:\n        'no Slack credential configured — set SLACK_BOT_TOKEN (preferred, verifiable) ' +\n        'or SLACK_WEBHOOK_URL to route alerts to Slack',\n    }\n  }\n  if (token && !channel) {\n    return {\n      delivered: false,\n      reason: 'not-configured',\n      detail: 'a Slack bot token is set but no channel is — set the alert channel (e.g. #infra-alerts)',\n    }\n  }\n\n  const fetchImpl = options.fetchImpl ?? fetch\n  const sleep = options.sleepImpl ?? defaultSleep\n  const attempts = Math.max(1, options.attempts ?? DEFAULT_ATTEMPTS)\n  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS\n\n  // A token is never fallen back FROM. If one is configured and dead, that is\n  // the incident, and delivering over a webhook instead would hide exactly the\n  // condition this module exists to surface.\n  const transport: SlackTransport = token\n    ? { kind: 'token', token, channel: channel as string }\n    : { kind: 'webhook', url: webhookUrl as string }\n\n  let lastTransient: SlackAlertFailure = {\n    delivered: false,\n    reason: 'transport',\n    detail: 'Slack was never reached',\n  }\n\n  for (let attempt = 1; attempt <= attempts; attempt += 1) {\n    const controller = new AbortController()\n    const timer = setTimeout(() => controller.abort(), timeoutMs)\n    let response: Response\n    try {\n      response = await fetchImpl(requestUrl(transport), {\n        method: 'POST',\n        headers: requestHeaders(transport),\n        body: JSON.stringify(requestBody(transport, options.text)),\n        signal: controller.signal,\n      })\n    } catch (error) {\n      lastTransient = {\n        delivered: false,\n        reason: 'transport',\n        detail: `could not reach Slack: ${error instanceof Error ? error.message : String(error)}`,\n      }\n      if (attempt < attempts) await sleep(Math.min(500 * 2 ** (attempt - 1), 8_000))\n      continue\n    } finally {\n      clearTimeout(timer)\n    }\n\n    if (response.status === 429 || response.status >= 500) {\n      lastTransient = {\n        delivered: false,\n        reason: response.status === 429 ? 'rate-limited' : 'transport',\n        detail: `Slack returned ${response.status}`,\n      }\n      if (attempt < attempts) await sleep(retryDelayMs(response, attempt))\n      continue\n    }\n\n    // Everything below is a settled answer. BOTH transports put the verdict in\n    // the BODY under a 200 — the API as `{\"ok\":false,\"error\":…}`, a webhook as\n    // an error token where the literal `ok` should be — so a status check alone\n    // reads a revoked credential as a delivered page. That misreading is why\n    // this module exists.\n    return transport.kind === 'token'\n      ? await settleTokenResponse(response, transport.channel)\n      : await settleWebhookResponse(response)\n  }\n\n  return lastTransient\n}\n\ntype SlackTransport =\n  | { kind: 'token'; token: string; channel: string }\n  | { kind: 'webhook'; url: string }\n\nfunction requestUrl(transport: SlackTransport): string {\n  return transport.kind === 'token' ? `${SLACK_API}/chat.postMessage` : transport.url\n}\n\nfunction requestHeaders(transport: SlackTransport): Record<string, string> {\n  const headers: Record<string, string> = { 'Content-Type': 'application/json; charset=utf-8' }\n  // The token rides a header, never a query string: a URL is logged by proxies\n  // and retained in error messages; a header is not. (A webhook URL IS the\n  // credential and has no such option — one more reason to prefer a token.)\n  if (transport.kind === 'token') headers.Authorization = `Bearer ${transport.token}`\n  return headers\n}\n\nfunction requestBody(transport: SlackTransport, text: string): Record<string, string> {\n  // A webhook carries its own channel, fixed when it was created; naming one\n  // here would be ignored at best and rejected at worst.\n  return transport.kind === 'token' ? { channel: transport.channel, text } : { text }\n}\n\nasync function settleTokenResponse(\n  response: Response,\n  channel: string,\n): Promise<SlackAlertOutcome> {\n  let body: { ok?: boolean; error?: string; channel?: string; ts?: string }\n  try {\n    body = (await response.json()) as typeof body\n  } catch {\n    return {\n      delivered: false,\n      reason: 'api',\n      detail: `Slack returned ${response.status} with an unreadable body`,\n    }\n  }\n  if (body.ok === true) {\n    return { delivered: true, channel: body.channel ?? channel, ts: body.ts ?? '' }\n  }\n  return classifySlackError(body.error ?? `http_${response.status}`, channel)\n}\n\n/**\n * A webhook confirms delivery with a 2xx AND the literal three-byte body `ok`.\n * A revoked one answers `no_service` / `no_team`, sometimes under a 200. Both\n * halves are required: this is the shape `agent-dev-container` proved against a\n * stand-in webhook, where a healthy, a revoked and a deleted webhook produced\n * byte-identical output under a status-only check.\n */\nasync function settleWebhookResponse(response: Response): Promise<SlackAlertOutcome> {\n  const body = (await response.text().catch(() => '')).trim()\n  if (response.ok && body === 'ok') {\n    // A webhook reports neither the channel it posted to nor a message id.\n    return { delivered: true, channel: '(webhook)', ts: '' }\n  }\n  const error = body || `http_${response.status}`\n  const reason: SlackFailureReason = WEBHOOK_CREDENTIAL_ERRORS.has(error)\n    ? 'credential'\n    : WEBHOOK_CHANNEL_ERRORS.has(error)\n      ? 'channel'\n      : 'api'\n  return {\n    delivered: false,\n    reason,\n    detail:\n      reason === 'credential'\n        ? `the Slack webhook is revoked (${error}) — no alert can arrive until a human mints a new one. ` +\n          'Prefer replacing it with a bot token, whose liveness can be checked before an alert needs it.'\n        : reason === 'channel'\n          ? `Slack refused the webhook's channel (${error}) — the channel was archived, or the app lost access.`\n          : `Slack refused the webhook post (${error}).`,\n  }\n}\n\n/** Webhook error tokens that mean the webhook itself is gone. */\nconst WEBHOOK_CREDENTIAL_ERRORS = new Set(['no_service', 'no_team', 'invalid_token'])\n\n/** Webhook error tokens that mean the webhook is valid but its channel is not usable. */\nconst WEBHOOK_CHANNEL_ERRORS = new Set(['channel_not_found', 'channel_is_archived', 'action_prohibited'])\n\n/** Define configuration options for verifying that a Slack bot token is live */\nexport interface SlackCredentialCheckOptions {\n  token: string | undefined\n  /** Per-request deadline. Default 10s. */\n  timeoutMs?: number\n  /** Injection seam for tests; defaults to global `fetch`. */\n  fetchImpl?: typeof fetch\n}\n\n/** What `checkSlackCredential` concluded. `team`/`botId` are present only when live. */\nexport type SlackCredentialVerdict =\n  | { live: true; team: string; botId: string }\n  | { live: false; reason: SlackFailureReason; detail: string }\n\n/**\n * Ask Slack whether the bot token is alive, WITHOUT posting anything.\n *\n * This is the check that was missing. An incoming webhook offers no equivalent\n * — the only way to test one is to post to it — which is how a revoked webhook\n * sat in a repo secret for months looking configured. Wire it into `/preflight`\n * so a dead alerting channel fails a deploy rather than an incident.\n */\nexport async function checkSlackCredential(\n  options: SlackCredentialCheckOptions,\n): Promise<SlackCredentialVerdict> {\n  const token = options.token?.trim()\n  if (!token) {\n    return {\n      live: false,\n      reason: 'not-configured',\n      detail: 'no Slack bot token configured — set SLACK_BOT_TOKEN',\n    }\n  }\n  const fetchImpl = options.fetchImpl ?? fetch\n  const controller = new AbortController()\n  const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? DEFAULT_TIMEOUT_MS)\n  try {\n    const response = await fetchImpl(`${SLACK_API}/auth.test`, {\n      method: 'POST',\n      headers: { Authorization: `Bearer ${token}` },\n      signal: controller.signal,\n    })\n    const body = (await response.json()) as {\n      ok?: boolean\n      error?: string\n      team?: string\n      bot_id?: string\n    }\n    if (body.ok === true) {\n      return { live: true, team: body.team ?? 'unknown', botId: body.bot_id ?? 'unknown' }\n    }\n    const outcome = classifySlackError(body.error ?? `http_${response.status}`, '(auth.test)')\n    // `classifySlackError` is shaped for a post; auth.test only ever answers\n    // about the credential, so a non-credential code here still means the\n    // token cannot be used.\n    return {\n      live: false,\n      reason: outcome.reason === 'channel' ? 'credential' : outcome.reason,\n      detail: outcome.detail,\n    }\n  } catch (error) {\n    return {\n      live: false,\n      reason: 'transport',\n      detail: `could not reach Slack: ${error instanceof Error ? error.message : String(error)}`,\n    }\n  } finally {\n    clearTimeout(timer)\n  }\n}\n"],"mappings":";AAwDA,IAAM,YAAY;AAClB,IAAM,qBAAqB;AAC3B,IAAM,mBAAmB;AA8FzB,IAAM,oBAAoB,oBAAI,IAAI;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAGD,IAAM,iBAAiB,oBAAI,IAAI;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,UAAU,QAA4B,OAAe,SAAyB;AACrF,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aACE,iCAAiC,KAAK;AAAA,IAG1C,KAAK;AACH,aACE,wCAAwC,OAAO,KAAK,KAAK,8BACpC,OAAO;AAAA,IAEhC;AACE,aAAO,2BAA2B,KAAK;AAAA,EAC3C;AACF;AAEA,SAAS,mBAAmB,OAAe,SAAoC;AAC7E,QAAM,SAA6B,kBAAkB,IAAI,KAAK,IAC1D,eACA,eAAe,IAAI,KAAK,IACtB,YACA;AACN,SAAO,EAAE,WAAW,OAAO,QAAQ,QAAQ,UAAU,QAAQ,OAAO,OAAO,EAAE;AAC/E;AAGA,SAAS,aAAa,UAAoB,SAAyB;AACjE,QAAM,SAAS,OAAO,SAAS,QAAQ,IAAI,aAAa,CAAC;AACzD,MAAI,OAAO,SAAS,MAAM,KAAK,SAAS,EAAG,QAAO,KAAK,IAAI,SAAS,KAAM,GAAM;AAChF,SAAO,KAAK,IAAI,MAAM,MAAM,UAAU,IAAI,GAAK;AACjD;AAEA,IAAM,eAAe,CAAC,OAA8B,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAUpG,eAAsB,eAAe,SAAwD;AAC3F,QAAM,QAAQ,QAAQ,OAAO,KAAK;AAClC,QAAM,UAAU,QAAQ,SAAS,KAAK;AACtC,QAAM,aAAa,QAAQ,YAAY,KAAK;AAE5C,MAAI,CAAC,SAAS,CAAC,YAAY;AACzB,WAAO;AAAA,MACL,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,QACE;AAAA,IAEJ;AAAA,EACF;AACA,MAAI,SAAS,CAAC,SAAS;AACrB,WAAO;AAAA,MACL,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,EACF;AAEA,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,QAAQ,QAAQ,aAAa;AACnC,QAAM,WAAW,KAAK,IAAI,GAAG,QAAQ,YAAY,gBAAgB;AACjE,QAAM,YAAY,QAAQ,aAAa;AAKvC,QAAM,YAA4B,QAC9B,EAAE,MAAM,SAAS,OAAO,QAA2B,IACnD,EAAE,MAAM,WAAW,KAAK,WAAqB;AAEjD,MAAI,gBAAmC;AAAA,IACrC,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,QAAQ;AAAA,EACV;AAEA,WAAS,UAAU,GAAG,WAAW,UAAU,WAAW,GAAG;AACvD,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,SAAS;AAC5D,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,UAAU,WAAW,SAAS,GAAG;AAAA,QAChD,QAAQ;AAAA,QACR,SAAS,eAAe,SAAS;AAAA,QACjC,MAAM,KAAK,UAAU,YAAY,WAAW,QAAQ,IAAI,CAAC;AAAA,QACzD,QAAQ,WAAW;AAAA,MACrB,CAAC;AAAA,IACH,SAAS,OAAO;AACd,sBAAgB;AAAA,QACd,WAAW;AAAA,QACX,QAAQ;AAAA,QACR,QAAQ,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MAC1F;AACA,UAAI,UAAU,SAAU,OAAM,MAAM,KAAK,IAAI,MAAM,MAAM,UAAU,IAAI,GAAK,CAAC;AAC7E;AAAA,IACF,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAEA,QAAI,SAAS,WAAW,OAAO,SAAS,UAAU,KAAK;AACrD,sBAAgB;AAAA,QACd,WAAW;AAAA,QACX,QAAQ,SAAS,WAAW,MAAM,iBAAiB;AAAA,QACnD,QAAQ,kBAAkB,SAAS,MAAM;AAAA,MAC3C;AACA,UAAI,UAAU,SAAU,OAAM,MAAM,aAAa,UAAU,OAAO,CAAC;AACnE;AAAA,IACF;AAOA,WAAO,UAAU,SAAS,UACtB,MAAM,oBAAoB,UAAU,UAAU,OAAO,IACrD,MAAM,sBAAsB,QAAQ;AAAA,EAC1C;AAEA,SAAO;AACT;AAMA,SAAS,WAAW,WAAmC;AACrD,SAAO,UAAU,SAAS,UAAU,GAAG,SAAS,sBAAsB,UAAU;AAClF;AAEA,SAAS,eAAe,WAAmD;AACzE,QAAM,UAAkC,EAAE,gBAAgB,kCAAkC;AAI5F,MAAI,UAAU,SAAS,QAAS,SAAQ,gBAAgB,UAAU,UAAU,KAAK;AACjF,SAAO;AACT;AAEA,SAAS,YAAY,WAA2B,MAAsC;AAGpF,SAAO,UAAU,SAAS,UAAU,EAAE,SAAS,UAAU,SAAS,KAAK,IAAI,EAAE,KAAK;AACpF;AAEA,eAAe,oBACb,UACA,SAC4B;AAC5B,MAAI;AACJ,MAAI;AACF,WAAQ,MAAM,SAAS,KAAK;AAAA,EAC9B,QAAQ;AACN,WAAO;AAAA,MACL,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,QAAQ,kBAAkB,SAAS,MAAM;AAAA,IAC3C;AAAA,EACF;AACA,MAAI,KAAK,OAAO,MAAM;AACpB,WAAO,EAAE,WAAW,MAAM,SAAS,KAAK,WAAW,SAAS,IAAI,KAAK,MAAM,GAAG;AAAA,EAChF;AACA,SAAO,mBAAmB,KAAK,SAAS,QAAQ,SAAS,MAAM,IAAI,OAAO;AAC5E;AASA,eAAe,sBAAsB,UAAgD;AACnF,QAAM,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,EAAE,GAAG,KAAK;AAC1D,MAAI,SAAS,MAAM,SAAS,MAAM;AAEhC,WAAO,EAAE,WAAW,MAAM,SAAS,aAAa,IAAI,GAAG;AAAA,EACzD;AACA,QAAM,QAAQ,QAAQ,QAAQ,SAAS,MAAM;AAC7C,QAAM,SAA6B,0BAA0B,IAAI,KAAK,IAClE,eACA,uBAAuB,IAAI,KAAK,IAC9B,YACA;AACN,SAAO;AAAA,IACL,WAAW;AAAA,IACX;AAAA,IACA,QACE,WAAW,eACP,iCAAiC,KAAK,8JAEtC,WAAW,YACT,wCAAwC,KAAK,+DAC7C,mCAAmC,KAAK;AAAA,EAClD;AACF;AAGA,IAAM,4BAA4B,oBAAI,IAAI,CAAC,cAAc,WAAW,eAAe,CAAC;AAGpF,IAAM,yBAAyB,oBAAI,IAAI,CAAC,qBAAqB,uBAAuB,mBAAmB,CAAC;AAwBxG,eAAsB,qBACpB,SACiC;AACjC,QAAM,QAAQ,QAAQ,OAAO,KAAK;AAClC,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,EACF;AACA,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,QAAQ,aAAa,kBAAkB;AAC1F,MAAI;AACF,UAAM,WAAW,MAAM,UAAU,GAAG,SAAS,cAAc;AAAA,MACzD,QAAQ;AAAA,MACR,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,MAC5C,QAAQ,WAAW;AAAA,IACrB,CAAC;AACD,UAAM,OAAQ,MAAM,SAAS,KAAK;AAMlC,QAAI,KAAK,OAAO,MAAM;AACpB,aAAO,EAAE,MAAM,MAAM,MAAM,KAAK,QAAQ,WAAW,OAAO,KAAK,UAAU,UAAU;AAAA,IACrF;AACA,UAAM,UAAU,mBAAmB,KAAK,SAAS,QAAQ,SAAS,MAAM,IAAI,aAAa;AAIzF,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ,QAAQ,WAAW,YAAY,eAAe,QAAQ;AAAA,MAC9D,QAAQ,QAAQ;AAAA,IAClB;AAAA,EACF,SAAS,OAAO;AACd,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ,0BAA0B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IAC1F;AAAA,EACF,UAAE;AACA,iBAAa,KAAK;AAAA,EACpB;AACF;","names":[]}