experimental-ash 0.8.2 → 0.8.3

package/CHANGELOG.md

@@ -1,5 +1,31 @@
 # experimental-ash
 
+## 0.8.3
+
+### Patch Changes
+
+- e35a562: fix(slack): forward `webhookVerifier` credential to the underlying Slack adapter so Connex-issued credentials (`slackChannelCredentials` from `@vercel/connex/ash`) authenticate inbound webhooks via Vercel OIDC instead of HMAC.
+
+  Previously `SlackChannelCredentials` declared only `botToken` and `signingSecret`, and `slackChannel()` never passed `webhookVerifier` to `createSlackAdapter`. When Connex supplied `{ botToken, webhookVerifier }` and `SLACK_SIGNING_SECRET` was not set in the environment (the whole point of Connex), the adapter threw `ValidationError: signingSecret or webhookVerifier is required.` because the verifier was silently dropped on the ash side before reaching the adapter.
+
+  Concretely:
+
+  - `SlackChannelCredentials` now exposes `webhookVerifier?: SlackWebhookVerifier`. The verifier signature `(request: Request, body: string) => unknown | Promise<unknown>` is published as an ash-owned `SlackWebhookVerifier` type so we don't leak the third-party adapter type.
+  - `slackChannel()` forwards `webhookVerifier` to `createSlackAdapter` alongside `botToken` / `signingSecret` / `userName`.
+  - When a `webhookVerifier` is supplied, the resolver skips the `SLACK_SIGNING_SECRET` env-var fallback so Connex deployments don't accidentally pick up a stale env-var secret. An explicit `credentials.signingSecret` still wins if both are provided.
+
+  Public agent code is unchanged:
+
+  ```ts
+  import { slackChannelCredentials } from "@vercel/connex/ash";
+  import { slack } from "experimental-ash/channels/slack";
+
+  export default slack({
+    botName: "help-ash",
+    credentials: slackChannelCredentials("slack/help-ash"),
+  });
+  ```
+
 ## 0.8.2
 
 ### Patch Changes

package/dist/src/internal/application/package.js

@@ -6,7 +6,7 @@ import { ASH_PACKAGE_NAME } from "#package-name.js";
 let cachedPackageInfo;
 // The package build stamps the published version into `dist` so bundled
 // deployments can still report package metadata without resolving package.json.
-const BUNDLED_FALLBACK_PACKAGE_VERSION = "0.8.2";
+const BUNDLED_FALLBACK_PACKAGE_VERSION = "0.8.3";
 const BUNDLED_FALLBACK_PACKAGE_VERSION_PLACEHOLDER = "__ASH_PACKAGE_VERSION_PLACEHOLDER__";
 const WORKFLOW_MODULE_ALIASES = {
     "workflow/api": "src/compiled/@workflow/core/runtime.js",

package/dist/src/public/channels/slack/index.d.ts

@@ -1,4 +1,4 @@
 export { slack, type SlackOptions } from "#public/channels/slack/slack.js";
-export { slackChannel, type SlackApiHandle, type SlackApiResponse, type SlackChannel, type SlackChannelConfig, type SlackChannelEvents, type SlackChannelCredentials, type SlackChannelState, type SlackContext, type SlackInteractionAction, type SlackReceiveArgs, } from "#public/channels/slack/slackChannel.js";
+export { slackChannel, type SlackApiHandle, type SlackApiResponse, type SlackChannel, type SlackChannelConfig, type SlackChannelEvents, type SlackChannelCredentials, type SlackChannelState, type SlackContext, type SlackInteractionAction, type SlackReceiveArgs, type SlackWebhookVerifier, } from "#public/channels/slack/slackChannel.js";
 export { Actions, Button, Card, CardText, Divider, Fields, Image, LinkButton, Modal, RadioSelect, Section, Select, SelectOption, Table, TextInput, } from "#compiled/chat/index.js";
 export type { AdapterPostableMessage, Attachment, Author, CardElement, FileUpload, Message, PostableMessage, SentMessage, Thread, } from "#compiled/chat/index.js";

package/dist/src/public/channels/slack/slackChannel.d.ts

@@ -28,9 +28,29 @@ export interface SlackChannelState {
     serializedThread: SerializedThread | null;
     teamId: string | null;
 }
+/**
+ * Verifies an inbound Slack webhook request. Returns when the request
+ * is authentic, throws otherwise. Used as an alternative to HMAC
+ * verification with `signingSecret` — for example, the Connex SDK
+ * supplies a verifier that authenticates Connex-forwarded webhooks
+ * with Vercel OIDC instead of Slack's signing secret.
+ */
+export type SlackWebhookVerifier = (request: Request, body: string) => unknown | Promise<unknown>;
 export interface SlackChannelCredentials {
     readonly botToken?: SlackBotToken;
+    /**
+     * Slack signing secret used to HMAC-verify inbound webhook requests.
+     * Falls back to `process.env.SLACK_SIGNING_SECRET` when neither this
+     * nor `webhookVerifier` is supplied.
+     */
     readonly signingSecret?: string;
+    /**
+     * Custom inbound webhook verifier. When supplied, ash skips the
+     * `SLACK_SIGNING_SECRET` fallback and delegates verification to this
+     * function. Typically populated by integrations (e.g. Connex) that
+     * authenticate webhooks out-of-band.
+     */
+    readonly webhookVerifier?: SlackWebhookVerifier;
 }
 export interface SlackReceiveArgs {
     readonly channelId: string;

package/dist/src/public/channels/slack/slackChannel.js

@@ -123,7 +123,12 @@ export function slackChannel(config = {}) {
             return chatPromise;
         const promise = (async () => {
             const botToken = config.credentials?.botToken ?? process.env.SLACK_BOT_TOKEN;
-            const signingSecret = config.credentials?.signingSecret ?? process.env.SLACK_SIGNING_SECRET;
+            const webhookVerifier = config.credentials?.webhookVerifier;
+            // Skip the SLACK_SIGNING_SECRET env-var fallback when a webhook
+            // verifier is supplied, so integrations like Connex don't need
+            // the signing secret set in the environment at all.
+            const signingSecret = config.credentials?.signingSecret ??
+                (webhookVerifier ? undefined : process.env.SLACK_SIGNING_SECRET);
             if (!botToken) {
                 throw new Error("slackChannel requires a bot token. Pass credentials.botToken or set SLACK_BOT_TOKEN.");
             }
@@ -135,6 +140,7 @@ export function slackChannel(config = {}) {
             const slackAdapter = slackModule.createSlackAdapter({
                 botToken,
                 signingSecret,
+                webhookVerifier,
                 userName: config.botName,
             });
             const chat = new chatModule.Chat({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "experimental-ash",
-  "version": "0.8.2",
+  "version": "0.8.3",
   "bin": {
     "ash": "./bin/ash.js",
     "experimental-ash": "./bin/ash.js"