@vellumai/assistant 0.6.4 → 0.6.5

package/src/runtime/agent-wake.ts

@@ -119,9 +119,19 @@ export interface WakeOptions {
   source: string;
 }
 
+/**
+ * Reason a wake returned `invoked: false`. Callers (CLI, update-bulletin
+ * job) need to distinguish "conversation doesn't exist" from "conversation
+ * exists but stayed busy past the wait-until-idle timeout" — the former is
+ * a user-visible error, the latter is an expected transient condition.
+ */
+export type WakeSkipReason = "not_found" | "timeout" | "no_resolver";
+
 export interface WakeResult {
   invoked: boolean;
   producedToolCalls: boolean;
+  /** Present only when `invoked: false`; identifies why the wake was skipped. */
+  reason?: WakeSkipReason;
 }
 
 /**
@@ -223,13 +233,12 @@ async function waitUntilIdle(
   target: WakeTarget,
   nowFn: () => number,
   timeoutMs = 30_000,
-): Promise<void> {
+): Promise<boolean> {
   const deadline = nowFn() + timeoutMs;
-  // 50ms backoff is fine — wakes are not latency-critical and a user turn
-  // typically completes on the order of seconds.
   while (target.isProcessing() && nowFn() < deadline) {
     await new Promise((resolve) => setTimeout(resolve, 50));
   }
+  return !target.isProcessing();
 }
 
 /**
@@ -300,7 +309,7 @@ export async function wakeAgentForOpportunity(
       { conversationId, source },
       "agent-wake: no resolver available (default resolver not registered and no deps passed); skipping",
     );
-    return { invoked: false, producedToolCalls: false };
+    return { invoked: false, producedToolCalls: false, reason: "no_resolver" };
   }
   const nowFn = deps?.now ?? Date.now;
   const startedAt = nowFn();
@@ -312,10 +321,17 @@ export async function wakeAgentForOpportunity(
         { conversationId, source },
         "agent-wake: conversation not found; skipping",
       );
-      return { invoked: false, producedToolCalls: false };
+      return { invoked: false, producedToolCalls: false, reason: "not_found" };
     }
 
-    await waitUntilIdle(target, nowFn);
+    const idle = await waitUntilIdle(target, nowFn);
+    if (!idle) {
+      log.warn(
+        { conversationId, source },
+        "agent-wake: conversation still processing after timeout; skipping",
+      );
+      return { invoked: false, producedToolCalls: false, reason: "timeout" };
+    }
 
     const baseline = target.getMessages();
     const hintContent = `[opportunity:${source}] ${hint}`;
@@ -346,6 +362,7 @@ export async function wakeAgentForOpportunity(
     let producedToolCalls = false;
     let toolUseNames: string[] = [];
     let tailMessageCount = 0;
+    let drainedInTry = false;
     try {
       let updatedHistory: Message[];
       try {
@@ -375,8 +392,11 @@ export async function wakeAgentForOpportunity(
       // `drainSingleMessage` reads `ctx.messages` mid-tail and writes a
       // DB row that lands out of chronological order (queued user msg
       // before the wake's just-produced assistant outputs).
-      const { tailMessages, hasVisibleText, toolUseNames: names } =
-        inspectWakeOutput(baseline.length, updatedHistory);
+      const {
+        tailMessages,
+        hasVisibleText,
+        toolUseNames: names,
+      } = inspectWakeOutput(baseline.length, updatedHistory);
       toolUseNames = names;
       producedToolCalls = names.length > 0;
       const producedOutput = producedToolCalls || hasVisibleText;
@@ -431,11 +451,12 @@ export async function wakeAgentForOpportunity(
         }
       }
 
-      return { invoked: true, producedToolCalls };
-    } finally {
-      // Release the processing marker regardless of success/failure so
-      // the next user turn (or wake) isn't blocked waiting on a stale
-      // flag.
+      // Drain queued messages AFTER tail is pushed + persisted so the
+      // next dequeued user message sees the complete, up-to-date
+      // history. markProcessing(false) must come first (the queue only
+      // accepts entries while processing === true, and drain expects
+      // processing to already be false). The finally block handles the
+      // error/early-return paths where no tail was produced.
       try {
         target.markProcessing(false);
       } catch (err) {
@@ -444,15 +465,6 @@ export async function wakeAgentForOpportunity(
           "agent-wake: markProcessing(false) threw; continuing",
         );
       }
-      // Drain any messages queued during the wake. Order matters:
-      // `enqueueMessage()` only queues when `processing === true`, so
-      // late sends arriving while the wake was running landed on the
-      // queue. The canonical user-turn finally calls drain after
-      // resetting `processing = false` AND after `ctx.messages` has
-      // been updated with the new tail; mirror that here so a queued
-      // message is picked up against an updated history rather than
-      // stranded behind an out-of-order DB row. Wrapped in try/catch
-      // so a drain failure can't propagate out of the wake.
       if (target.drainQueue) {
         try {
           await target.drainQueue();
@@ -463,6 +475,35 @@ export async function wakeAgentForOpportunity(
           );
         }
       }
+      drainedInTry = true;
+
+      return { invoked: true, producedToolCalls };
+    } finally {
+      // The success path (above) already called markProcessing(false)
+      // + drainQueue after tail persist. This catch-all handles the
+      // error and early-return paths where no tail was produced — those
+      // exit the try body before reaching the drain block, so
+      // `drainedInTry` is still false.
+      if (!drainedInTry) {
+        try {
+          target.markProcessing(false);
+        } catch (err) {
+          log.warn(
+            { conversationId, source, err },
+            "agent-wake: markProcessing(false) threw; continuing",
+          );
+        }
+        if (target.drainQueue) {
+          try {
+            await target.drainQueue();
+          } catch (err) {
+            log.warn(
+              { conversationId, source, err },
+              "agent-wake: drainQueue threw; continuing",
+            );
+          }
+        }
+      }
 
       const durationMs = nowFn() - startedAt;
       if (runError) {

package/src/runtime/auth/route-policy.ts

@@ -214,6 +214,10 @@ const ACTOR_ENDPOINTS: Array<{ endpoint: string; scopes: Scope[] }> = [
     endpoint: "integrations/slack/channel/config:DELETE",
     scopes: ["settings.write"],
   },
+  {
+    endpoint: "integrations/slack/channel/oauth-install:POST",
+    scopes: ["settings.write"],
+  },
   { endpoint: "channel-verification-sessions", scopes: ["settings.write"] },
   {
     endpoint: "channel-verification-sessions:DELETE",

package/src/runtime/btw-sidechain.ts

@@ -1,3 +1,4 @@
+import type { LLMCallSite } from "../config/schemas/llm.js";
 import { buildToolDefinitions } from "../daemon/conversation-tool-setup.js";
 import { buildSystemPrompt } from "../prompts/system-prompt.js";
 import {
@@ -7,7 +8,6 @@ import {
 } from "../providers/provider-send-message.js";
 import type {
   Message,
-  ModelIntent,
   Provider,
   ProviderEvent,
   ProviderResponse,
@@ -29,7 +29,15 @@ export interface RunBtwSidechainParams {
   systemPrompt?: string;
   tools?: ToolDefinition[];
   maxTokens?: number;
-  modelIntent?: ModelIntent;
+  /**
+   * Unified call-site identifier. The provider layer resolves
+   * provider/model/maxTokens/effort/speed/temperature/thinking/contextWindow
+   * via `resolveCallSiteConfig(callSite, config.llm)`. Defaults to
+   * `'identityIntro'` since this side-chain runner was originally introduced
+   * for the identity intro generation path; callers (greeting, title, etc.)
+   * override it with their own call-site ID.
+   */
+  callSite?: LLMCallSite;
   signal?: AbortSignal;
   timeoutMs?: number;
   onEvent?: (event: ProviderEvent) => void;
@@ -89,7 +97,9 @@ export async function runBtwSidechain(
       config: {
         max_tokens: params.maxTokens ?? 1024,
         tool_choice: { type: "none" },
-        modelIntent: params.modelIntent ?? "latency-optimized",
+        // Default call site is "identityIntro" — the original purpose of
+        // this side-chain runner. Callers may override per invocation.
+        callSite: params.callSite ?? ("identityIntro" as LLMCallSite),
       },
       onEvent: (event) => {
         if (event.type === "text_delta") {

package/src/runtime/channel-reply-delivery.ts

@@ -1,6 +1,12 @@
 import { renderHistoryContent } from "../daemon/handlers/shared.js";
 import * as attachmentsStore from "../memory/attachments-store.js";
-import { getMessages } from "../memory/conversation-crud.js";
+import {
+  getMessageById,
+  getMessages,
+  updateMessageMetadata,
+} from "../memory/conversation-crud.js";
+import { readSlackMetadata } from "../messaging/providers/slack/message-metadata.js";
+import { getLogger } from "../util/logger.js";
 import type { ChannelDeliveryResult } from "./gateway-client.js";
 import { deliverChannelReply } from "./gateway-client.js";
 import type { RuntimeAttachmentMetadata } from "./http-types.js";
@@ -9,6 +15,8 @@ import {
   textToSlackBlocks,
 } from "./slack-block-formatting.js";
 
+const log = getLogger("channel-reply-delivery");
+
 const INTER_SEGMENT_DELAY_MS = 150;
 
 type DeliverRenderedReplyParams = {
@@ -206,6 +214,22 @@ export async function deliverReplyViaCallback(
       kind: a.kind,
     }));
 
+    // Compose an `onMessageTs` that reconciles `slackMeta.channelTs` on the
+    // persisted assistant row once Slack returns the authoritative ts. The
+    // assistant row was written BEFORE the gateway POST in
+    // `handleMessageComplete`, so the partial `slackMeta` it carries is
+    // missing `channelTs` and would otherwise be rejected by
+    // `readSlackMetadata`, dropping the row out of chronological/thread-tag
+    // rendering. We only act on the FIRST ts (top-level segment); any
+    // subsequent split segments become independent Slack messages with
+    // their own ts and are not represented as separate DB rows.
+    const reconcileOnMessageTs = makeChannelTsReconciler(msgs[i].id);
+    const callerOnMessageTs = options?.onMessageTs;
+    const composedOnMessageTs = (ts: string): void => {
+      reconcileOnMessageTs(ts);
+      callerOnMessageTs?.(ts);
+    };
+
     await deliverRenderedReplyViaCallback({
       callbackUrl,
       chatId: externalChatId,
@@ -219,8 +243,88 @@ export async function deliverReplyViaCallback(
       ephemeral: options?.ephemeral,
       user: options?.user,
       messageTs: options?.messageTs,
-      onMessageTs: options?.onMessageTs,
+      onMessageTs: composedOnMessageTs,
     });
     break;
   }
 }
+
+/**
+ * Build a one-shot `onMessageTs` handler that reconciles the persisted
+ * assistant message's `slackMeta.channelTs` from Slack's authoritative `ts`.
+ *
+ * Behavior:
+ * - Acts only on the first invocation per delivery (subsequent segments
+ *   correspond to independent Slack messages with their own ts and are not
+ *   represented as separate DB rows).
+ * - No-op when the row was not persisted with a `slackMeta` envelope (the
+ *   channel was not Slack at write-time, e.g. vellum/telegram outbound).
+ * - No-op when the row's existing `slackMeta` already parses cleanly via
+ *   `readSlackMetadata` (channelTs already present, e.g. from a prior
+ *   reconciliation).
+ * - Failures are logged and swallowed so a transient DB error cannot break
+ *   the outbound delivery itself.
+ */
+function makeChannelTsReconciler(messageId: string): (ts: string) => void {
+  let applied = false;
+  return (ts: string): void => {
+    if (applied) return;
+    applied = true;
+    if (!ts) return;
+    try {
+      // Re-read the row's current metadata so a concurrent edit-propagation
+      // write (e.g. `editedAt`) is not clobbered. `updateMessageMetadata`
+      // shallow-merges into the top-level envelope, and the slackMeta
+      // sub-object is merged manually below so we can preserve fields on
+      // the partial pre-send envelope (`mergeSlackMetadata` would call
+      // `readSlackMetadata` which rejects the partial form for lacking
+      // channelTs — exactly the state we are reconciling).
+      const row = getMessageById(messageId);
+      if (row === null || row.metadata === null) return;
+      let envelope: Record<string, unknown>;
+      try {
+        envelope = JSON.parse(row.metadata) as Record<string, unknown>;
+      } catch {
+        return;
+      }
+      const slackMetaRaw =
+        typeof envelope.slackMeta === "string" ? envelope.slackMeta : null;
+      if (slackMetaRaw === null) return;
+      // If the existing slackMeta already parses cleanly via the strict
+      // reader, channelTs is already present (a prior reconciliation ran,
+      // or backfill stamped the field) — nothing to do.
+      if (readSlackMetadata(slackMetaRaw) !== null) return;
+      // Lenient parse of the partial slackMeta so we can preserve every
+      // field already written by `handleMessageComplete` (source,
+      // eventKind, channelId, threadTs, ...) while patching channelTs in.
+      let existingSlackMeta: Record<string, unknown>;
+      try {
+        const parsed = JSON.parse(slackMetaRaw) as unknown;
+        if (
+          parsed === null ||
+          typeof parsed !== "object" ||
+          Array.isArray(parsed)
+        ) {
+          return;
+        }
+        existingSlackMeta = parsed as Record<string, unknown>;
+      } catch {
+        return;
+      }
+      const mergedSlackMeta = JSON.stringify({
+        ...existingSlackMeta,
+        channelTs: ts,
+        // Force `source: "slack"` for parity with `mergeSlackMetadata`'s
+        // invariant — the reader rejects anything else and we never want a
+        // reconciled row to slip through with a stale source.
+        source: "slack",
+      });
+      updateMessageMetadata(messageId, { slackMeta: mergedSlackMeta });
+    } catch (err) {
+      log.warn(
+        { err, messageId },
+        "Failed to reconcile slackMeta.channelTs on outbound assistant row",
+      );
+    }
+  };
+}

package/src/runtime/decision-token.ts

@@ -0,0 +1,116 @@
+/**
+ * Lightweight informational decision token for interactive UI outcomes.
+ *
+ * Minted when a confirmation-style surface is `submitted`. The token is
+ * **non-authoritative** — it carries metadata about the decision for
+ * audit and correlation purposes only. It does not grant any capability
+ * and must not be used for enforcement or replay protection (that is
+ * explicitly out of scope for v1).
+ *
+ * Format: base64url-encoded JSON payload + `.` + random nonce.
+ * The nonce makes tokens unique even for identical payloads; the
+ * payload is readable by any consumer without a secret.
+ *
+ * This module is intentionally decoupled from the existing auth/token
+ * infrastructure in `runtime/auth/` — it serves a different purpose
+ * and should remain independent.
+ */
+
+import { randomBytes } from "node:crypto";
+
+// ── Token shape ──────────────────────────────────────────────────────
+
+export interface DecisionTokenPayload {
+  /** Conversation the decision belongs to. */
+  conversationId: string;
+  /** Surface identifier that was displayed. */
+  surfaceId: string;
+  /** The action ID the user selected (e.g. "confirm"). Only present on affirmative confirmation. */
+  action: string;
+  /** ISO-8601 timestamp when the decision was recorded. */
+  issuedAt: string;
+  /** ISO-8601 timestamp after which the token should be considered stale. */
+  expiresAt: string;
+}
+
+/** Default token lifetime: 5 minutes. */
+const DEFAULT_TTL_MS = 5 * 60 * 1000;
+
+// ── Minting ──────────────────────────────────────────────────────────
+
+/**
+ * Mint an informational decision token.
+ *
+ * The returned string is `<base64url-payload>.<random-nonce>`. It is
+ * short-lived (default 5 minutes) and non-authoritative.
+ *
+ * @param opts - Decision metadata.
+ * @param opts.conversationId - Conversation scope.
+ * @param opts.surfaceId - Surface that was displayed.
+ * @param opts.action - Terminal action taken by the user.
+ * @param opts.ttlMs - Token lifetime in milliseconds (default 5 min).
+ * @returns The minted token string.
+ */
+export function mintDecisionToken(opts: {
+  conversationId: string;
+  surfaceId: string;
+  action: string;
+  ttlMs?: number;
+}): string {
+  const now = new Date();
+  const ttl = opts.ttlMs ?? DEFAULT_TTL_MS;
+  const expiresAt = new Date(now.getTime() + ttl);
+
+  const payload: DecisionTokenPayload = {
+    conversationId: opts.conversationId,
+    surfaceId: opts.surfaceId,
+    action: opts.action,
+    issuedAt: now.toISOString(),
+    expiresAt: expiresAt.toISOString(),
+  };
+
+  const encoded = Buffer.from(JSON.stringify(payload)).toString("base64url");
+  const nonce = randomBytes(12).toString("hex");
+
+  return `${encoded}.${nonce}`;
+}
+
+// ── Decoding (informational only) ────────────────────────────────────
+
+/**
+ * Decode a decision token's payload.
+ *
+ * This is a pure decoding step — there is no signature verification
+ * because the token is non-authoritative. Consumers should treat the
+ * payload as informational metadata, not a trust assertion.
+ *
+ * @param token - The token string produced by {@link mintDecisionToken}.
+ * @returns The decoded payload, or `null` if the token is malformed.
+ */
+export function decodeDecisionToken(
+  token: string,
+): DecisionTokenPayload | null {
+  const dotIdx = token.indexOf(".");
+  if (dotIdx < 0) return null;
+
+  const encodedPayload = token.slice(0, dotIdx);
+  try {
+    const json = Buffer.from(encodedPayload, "base64url").toString("utf-8");
+    const parsed = JSON.parse(json) as Record<string, unknown>;
+
+    // Minimal structural validation
+    if (
+      typeof parsed.conversationId !== "string" ||
+      typeof parsed.surfaceId !== "string" ||
+      typeof parsed.action !== "string" ||
+      typeof parsed.issuedAt !== "string" ||
+      typeof parsed.expiresAt !== "string"
+    ) {
+      return null;
+    }
+
+    return parsed as unknown as DecisionTokenPayload;
+  } catch {
+    return null;
+  }
+}

package/src/runtime/gateway-client.ts

@@ -397,8 +397,8 @@ export async function deliverApprovalPrompt(
   approval: ApprovalUIMetadata,
   assistantId?: string,
   bearerToken?: string,
-): Promise<void> {
-  await deliverChannelReply(
+): Promise<ChannelDeliveryResult> {
+  return deliverChannelReply(
     callbackUrl,
     { chatId, text, approval, assistantId },
     bearerToken,

package/src/runtime/http-router.ts

@@ -48,6 +48,29 @@ export interface RouteQueryParam {
  * The generate-openapi script converts these to JSON Schema via z.toJSONSchema(). */
 export type RouteBodySchema = z.ZodType;
 
+/**
+ * Description for a non-200 response variant. Used when an endpoint has
+ * meaningful alternate response shapes that clients should handle (e.g.
+ * 502 `fetch_failed` on POST /v1/migrations/import when the URL body path
+ * can't reach the upstream bundle host).
+ */
+export interface RouteAdditionalResponse {
+  description: string;
+  /** Zod schema or plain JSON Schema fragment. */
+  schema?: RouteBodySchema | Record<string, unknown>;
+}
+
+/**
+ * Request-body variant keyed by Content-Type. Use this when an endpoint
+ * accepts multiple body shapes (e.g. `application/octet-stream` OR
+ * `application/json`). For the common single-JSON case, use `requestBody`.
+ */
+export interface RouteRequestBodyVariant {
+  contentType: string;
+  /** Zod schema or plain JSON Schema fragment. Plain objects are embedded verbatim. */
+  schema: RouteBodySchema | Record<string, unknown>;
+}
+
 /**
  * A single route entry in the declarative table.
  *
@@ -76,8 +99,17 @@ export interface RouteDefinition {
   queryParams?: RouteQueryParam[];
   /** Zod schema for the request body (POST/PUT/PATCH/DELETE). */
   requestBody?: RouteBodySchema;
+  /**
+   * Alternate request-body variants keyed by Content-Type. When set,
+   * overrides `requestBody` in the generated OpenAPI spec — use this for
+   * endpoints that accept multiple body shapes on the same URL (e.g.
+   * raw bytes OR JSON URL).
+   */
+  requestBodies?: RouteRequestBodyVariant[];
   /** Zod schema for the 200 response body. */
   responseBody?: RouteBodySchema;
+  /** Additional non-200 responses documented in the generated OpenAPI spec. */
+  additionalResponses?: Record<string, RouteAdditionalResponse>;
 }
 
 // ---------------------------------------------------------------------------

package/src/runtime/http-server.ts

@@ -1066,6 +1066,12 @@ export class RuntimeHttpServer {
     // tokens minted by a session manager).
     const skillMatch = matchSkillRoute(path, req.method);
     if (skillMatch) {
+      if (skillMatch.kind === "methodMismatch") {
+        return new Response("Method Not Allowed", {
+          status: 405,
+          headers: { Allow: skillMatch.allow.join(", ") },
+        });
+      }
       return await skillMatch.route.handler(req, skillMatch.match);
     }
 
@@ -1851,6 +1857,21 @@ export class RuntimeHttpServer {
               404,
             );
           try {
+            // Snapshot current state to detect whether the seen cursor
+            // actually advances (avoids emitting on no-op signals).
+            // Only consider a conversation "unseen" when a latest assistant
+            // message exists and the seen cursor is behind it — matching
+            // the hasUnseenLatestAssistantMessage logic in buildAssistantAttention.
+            const priorState = getAttentionStateByConversationIds([
+              conversationId,
+            ]).get(conversationId);
+            const wasUnseen =
+              priorState != null &&
+              priorState.latestAssistantMessageAt != null &&
+              (priorState.lastSeenAssistantMessageAt == null ||
+                priorState.lastSeenAssistantMessageAt <
+                  priorState.latestAssistantMessageAt);
+
             recordConversationSeenSignal({
               conversationId,
               sourceChannel: (body.sourceChannel as string) ?? "vellum",
@@ -1863,6 +1884,21 @@ export class RuntimeHttpServer {
               metadata: body.metadata as Record<string, unknown> | undefined,
               observedAt: body.observedAt as number | undefined,
             });
+            if (wasUnseen) {
+              assistantEventHub
+                .publish(
+                  buildAssistantEvent(DAEMON_INTERNAL_ASSISTANT_ID, {
+                    type: "conversation_list_invalidated",
+                    reason: "seen_changed",
+                  }),
+                )
+                .catch((err) => {
+                  log.warn(
+                    { err },
+                    "Failed to publish conversation_list_invalidated (seen_changed)",
+                  );
+                });
+            }
             return Response.json({ ok: true });
           } catch (err) {
             log.error(
@@ -1894,7 +1930,22 @@ export class RuntimeHttpServer {
               404,
             );
           try {
-            markConversationUnread(conversationId);
+            const changed = markConversationUnread(conversationId);
+            if (changed) {
+              assistantEventHub
+                .publish(
+                  buildAssistantEvent(DAEMON_INTERNAL_ASSISTANT_ID, {
+                    type: "conversation_list_invalidated",
+                    reason: "seen_changed",
+                  }),
+                )
+                .catch((err) => {
+                  log.warn(
+                    { err },
+                    "Failed to publish conversation_list_invalidated (seen_changed)",
+                  );
+                });
+            }
             return Response.json({ ok: true });
           } catch (err) {
             if (err instanceof UserError) {

package/src/runtime/http-types.ts

@@ -2,10 +2,18 @@
  * Shared types for the runtime HTTP server and its route handlers.
  */
 import type { ChannelId, InterfaceId } from "../channels/types.js";
+import type { LLMCallSite } from "../config/schemas/llm.js";
 import type { CesClient } from "../credential-execution/client.js";
 import type { Conversation } from "../daemon/conversation.js";
 import type { TrustContext } from "../daemon/conversation-runtime-assembly.js";
-import type { ConversationCreateOptions } from "../daemon/handlers/shared.js";
+import type {
+  ConversationCreateOptions,
+  SlackInboundMessageMetadata,
+} from "../daemon/handlers/shared.js";
+
+// Re-export so route modules (background-dispatch, etc.) can pull the type
+// from the runtime barrel without reaching into daemon internals.
+export type { SlackInboundMessageMetadata };
 import type { SkillOperationContext } from "../daemon/handlers/skills.js";
 import type { ServerMessage } from "../daemon/message-protocol.js";
 import type {
@@ -132,6 +140,20 @@ export interface RuntimeMessageConversationOptions {
   commandIntent?: { type: string; payload?: string; languageCode?: string };
   /** Optional callback to receive real-time agent loop events (text deltas, tool starts, etc.). */
   onEvent?: (msg: ServerMessage) => void;
+  /**
+   * Optional LLM call-site identifier. Channel ingress and other inbound paths
+   * may pass this so the daemon's per-call provider config picks up the right
+   * profile via `resolveCallSiteConfig`. PRs 7-11 wire individual call-site
+   * literals into specific call paths.
+   */
+  callSite?: LLMCallSite;
+  /**
+   * Slack inbound metadata captured at the channel ingress boundary. When
+   * present (and the turn channel resolves to Slack), persistence writes a
+   * `slackMeta` sub-object into the message's `metadata` JSON for the
+   * chronological renderer to consume.
+   */
+  slackInbound?: SlackInboundMessageMetadata;
 }
 
 export type MessageProcessor = (