spur-board 0.4.1 → 0.6.0

package/dist/cli.mjs

@@ -1,6 +1,6 @@
-import { I as configSchema, L as SLACK_BOT_SCOPES, s as OPERATIONS } from "./src-BEo3mvRC.mjs";
-import { a as renderCliError, i as errorExitCode, n as requestTokenEnrollment, o as escapeTerminalControls, r as CliError, t as requestOperation } from "./client-CHohYNxa.mjs";
-import { i as resolveDaemonAddress, n as loadClientConfig, r as loadEnrollmentConfig, t as configFile } from "./config-BuxxS_er.mjs";
+import { B as SLACK_BOT_SCOPES, R as configSchema, s as OPERATIONS, z as requiredSecretKeys } from "./src-Cy74ZQfR.mjs";
+import { a as renderCliError, i as errorExitCode, n as requestTokenEnrollment, o as escapeTerminalControls, r as CliError, t as requestOperation } from "./client-Dw9ZovyI.mjs";
+import { i as resolveDaemonAddress, n as loadClientConfig, r as loadEnrollmentConfig, t as configFile } from "./config-CeDZQlvy.mjs";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { chmodSync, closeSync, constants, existsSync, lstatSync, mkdirSync, openSync, readFileSync, readdirSync, readlinkSync, realpathSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir, hostname, userInfo } from "node:os";
@@ -13,6 +13,23 @@ import { parseEnv } from "node:util";
 import { access, cp, lstat, mkdir, readFile, readdir, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 //#region src/manifest.ts
+function loadSlackManifestDefaults(env, home) {
+	let contents;
+	try {
+		contents = readFileSync(configFile(env, home), "utf8");
+	} catch (error) {
+		if (error !== null && typeof error === "object" && "code" in error && error.code === "ENOENT") return {};
+		throw new CliError("config", void 0, void 0, "Read config.yaml before generating a manifest.");
+	}
+	const document = YAML.parseDocument(contents);
+	if (document.errors.length > 0) throw new CliError("config", void 0, void 0, "Fix the YAML in config.yaml.");
+	const parsed = configSchema.safeParse(document.toJS());
+	if (!parsed.success) throw new CliError("config", void 0, void 0, `Fix ${parsed.error.issues[0]?.path.map(String).join(".") || "config.yaml"} in config.yaml.`);
+	return {
+		appName: parsed.data.slack.appName,
+		command: parsed.data.slack.command
+	};
+}
 function renderSlackManifest(options = {}) {
 	const appName = (options.appName ?? "spur-board").trim();
 	const command = options.command ?? "/board";
@@ -173,12 +190,7 @@ function localSecrets(config, path, ports) {
 	} catch {
 		names = {};
 	}
-	const slackConfigured = Boolean(config.slack.channels.feed || config.slack.channels.orchestrators);
-	const required = [
-		"GITHUB_TOKEN",
-		...config.projects.some((project) => project.tracker.type === "jira") ? ["JIRA_EMAIL", "JIRA_API_TOKEN"] : [],
-		...slackConfigured ? ["SLACK_BOT_TOKEN", "SLACK_APP_TOKEN"] : []
-	];
+	const required = requiredSecretKeys(config);
 	const missing = required.filter((name) => !names[name]);
 	return {
 		...result("secrets", missing.length === 0, `Add ${missing.join(", ")} to the private secrets.env file.`),
@@ -988,7 +1000,9 @@ function registerSetupCommands(program, options, io, env) {
 		const appName = manifest.opts()["appName"];
 		const command = manifest.opts()["command"];
 		if (appName !== void 0 && typeof appName !== "string" || command !== void 0 && typeof command !== "string") throw new CliError("usage");
+		const defaults = appName === void 0 || command === void 0 ? loadSlackManifestDefaults(env, options.home ?? homedir()) : {};
 		io.stdout(renderSlackManifest({
+			...defaults,
 			...appName === void 0 ? {} : { appName },
 			...command === void 0 ? {} : { command }
 		}));

package/dist/{client-CHohYNxa.mjs → client-Dw9ZovyI.mjs}

@@ -1,4 +1,4 @@
-import { M as errorContextSchema, N as errorEnvelopeSchema, P as successEnvelopeSchema, j as ERRORS, l as renderJsonError } from "./src-BEo3mvRC.mjs";
+import { M as errorContextSchema, N as errorEnvelopeSchema, P as successEnvelopeSchema, j as ERRORS, l as renderJsonError } from "./src-Cy74ZQfR.mjs";
 import { randomUUID } from "node:crypto";
 import { z } from "zod";
 import { request } from "node:http";

package/dist/client.mjs

@@ -1,2 +1,2 @@
-import { n as requestTokenEnrollment, t as requestOperation } from "./client-CHohYNxa.mjs";
+import { n as requestTokenEnrollment, t as requestOperation } from "./client-Dw9ZovyI.mjs";
 export { requestOperation, requestTokenEnrollment };

package/dist/{config-BuxxS_er.mjs → config-CeDZQlvy.mjs}

@@ -1,5 +1,5 @@
-import { I as configSchema } from "./src-BEo3mvRC.mjs";
-import { r as CliError } from "./client-CHohYNxa.mjs";
+import { R as configSchema } from "./src-Cy74ZQfR.mjs";
+import { r as CliError } from "./client-Dw9ZovyI.mjs";
 import { closeSync, constants, fstatSync, lstatSync, openSync, readFileSync, realpathSync, statSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";

package/dist/daemon.mjs

@@ -1,4 +1,4 @@
-import { A as taskKeySchema, C as sessionFactsSchema, D as errorCodeOf, E as encodeActorId, I as configSchema, L as SLACK_BOT_SCOPES, O as parseActorId, P as successEnvelopeSchema, S as prRefSchema, T as actorIdSchema, _ as EVENT_KINDS, a as buildCatalogSnapshot, b as SESSION_STATUSES, c as renderHttpProblem, d as SPACE_IDS, f as conversationRefSchema, g as userIdSchema, h as messageRefSchema, i as sourceCursorSchema, j as ERRORS, k as parseRef$1, m as interactionRefSchema, n as batchSchema, o as roleCanUseOperation, p as inboundEventSchema, r as entityRefSchema, s as OPERATIONS, t as AdapterError, v as eventPayloadSchemas, w as ticketFactsSchema, x as prFactsSchema, y as SESSION_HEALTH_STATES } from "./src-BEo3mvRC.mjs";
+import { A as taskKeySchema, B as SLACK_BOT_SCOPES, C as sessionFactsSchema, D as errorCodeOf, E as encodeActorId, L as DEFAULT_SLACK_COMMAND, O as parseActorId, P as successEnvelopeSchema, R as configSchema, S as prRefSchema, T as actorIdSchema, _ as EVENT_KINDS, a as buildCatalogSnapshot, b as SESSION_STATUSES, c as renderHttpProblem, d as SPACE_IDS, f as conversationRefSchema, g as userIdSchema, h as messageRefSchema, i as sourceCursorSchema, j as ERRORS, k as parseRef$1, m as interactionRefSchema, n as batchSchema, o as roleCanUseOperation, p as inboundEventSchema, r as entityRefSchema, s as OPERATIONS, t as AdapterError, v as eventPayloadSchemas, w as ticketFactsSchema, x as prFactsSchema, y as SESSION_HEALTH_STATES, z as requiredSecretKeys } from "./src-Cy74ZQfR.mjs";
 import { createRequire } from "node:module";
 import { createHash, randomUUID } from "node:crypto";
 import { closeSync, existsSync, fstatSync, ftruncateSync, mkdirSync, openSync, readFileSync, readdirSync, writeSync } from "node:fs";
@@ -11546,6 +11546,13 @@ function createInbound(input) {
 		await clearItem(trx, item.id, new Date(at));
 	}
 	async function runUser(trx, event, at) {
+		if (event.kind === "command" && event.name !== void 0 && event.name !== config.slack.command) return deny(trx, {
+			event,
+			reason: "Command name does not match the configured command.",
+			actor: "system",
+			gateway: gateway.kind,
+			at
+		});
 		if (event.kind !== "message_deleted" && event.author !== config.operator.slack) return deny(trx, {
 			event,
 			reason: "Only the configured operator may act.",
@@ -11731,7 +11738,7 @@ function createInbound(input) {
 		} catch {}
 	}
 	async function applyUser(event) {
-		if ((event.kind === "command" || event.kind === "action") && event.author === config.operator.slack && (event.kind === "command" || event.sourceSpace !== null)) {
+		if ((event.kind === "command" || event.kind === "action") && event.author === config.operator.slack && (event.kind !== "command" || event.name === void 0 || event.name === config.slack.command) && (event.kind === "command" || event.sourceSpace !== null)) {
 			await dispatchInteraction(event);
 			return;
 		}
@@ -11811,6 +11818,7 @@ function createInbound(input) {
 				const item = await store.db.selectFrom("operator_item").select(["cleared_at", "inbound_event_json"]).where("id", "=", itemId).executeTakeFirst();
 				if (item === void 0 || item.cleared_at !== null || item.inbound_event_json === null) throw new CommandError("retry_not_applicable", "This item has no stored event to retry.");
 				let event = inboundEventSchema.parse(JSON.parse(item.inbound_event_json));
+				if (event.kind === "command" && event.name !== void 0 && event.name !== config.slack.command) throw new CommandError("retry_not_applicable", "This interaction cannot be retried.");
 				if (event.kind === "command" && event.command === void 0) {
 					const command = legacyCommand(event.text);
 					if (command === null) throw new CommandError("retry_not_applicable", "This interaction cannot be retried.");
@@ -12728,6 +12736,11 @@ function retryAt(headers, now) {
 }
 //#endregion
 //#region ../adapters/src/github/client.ts
+function teamNameScopeDenied(error, query) {
+	if (error.type !== "INSUFFICIENT_SCOPES" || !query.includes("... on Team { name }")) return false;
+	if (error.path !== void 0) return error.path.includes("reviewRequests") && error.path.includes("requestedReviewer") && error.path.at(-1) === "name";
+	return /\bname\b/i.test(error.message) && /\bread:(?:org|discussion)\b/i.test(error.message);
+}
 function record$2(value) {
 	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new AdapterError("transient", "Malformed GitHub response");
 	return value;
@@ -12816,6 +12829,8 @@ var GithubClient = class {
 			status: 429,
 			headers: response.headers
 		}, Date.now());
+		if (errors.some((error) => teamNameScopeDenied(error, query))) throw new AdapterError("auth", "GitHub token needs read:org for team review requests");
+		if (errors.some((error) => error.type === "INSUFFICIENT_SCOPES")) throw new AdapterError("auth", "GitHub token lacks a required GraphQL read scope");
 		const data = record$2(wire.data);
 		const rate = record$2(data.rateLimit);
 		const remaining = rate.remaining;
@@ -13048,6 +13063,12 @@ function githubSources(config, options) {
 function scoped(errors, root) {
 	return errors.filter((error) => error.path?.[0] === root);
 }
+function checkAccessDenied(errors) {
+	return errors.some((error) => error.type === "FORBIDDEN" && error.path?.includes("statusCheckRollup") === true && error.path.includes("contexts"));
+}
+function requireCheckAccess(errors) {
+	if (checkAccessDenied(errors)) throw new AdapterError("auth", "GitHub token lacks Checks read permission");
+}
 function rejectUnscoped(errors, roots) {
 	if (errors.some((error) => error.path === void 0 || !roots.includes(String(error.path[0])))) throw new AdapterError("transient", "Unscoped GitHub GraphQL error");
 }
@@ -13089,6 +13110,7 @@ async function fullPr(client, pr, owner, name, number, signal, budget) {
 			}, signal);
 			budget(response.budget);
 			rejectUnscoped(response.errors, ["repository"]);
+			requireCheckAccess(response.errors);
 			if (response.errors.length > 0) return void 0;
 			const pagePr = record$2(nested(response.data, "repository", "pullRequest"));
 			const page = field === "contexts" ? contexts(pagePr) : record$2(pagePr[field]);
@@ -13146,6 +13168,7 @@ async function pollRepository({ id, repo, login, prefixes, client, ctx }) {
 	const found = discover(nodes, ctx.cursor, login);
 	const bootstrapCursor = bootstrap && discoveryOk ? latestUpdatedAt(connectionNodes(nested(response.data, "repository", "mergedBaseline")), found.cursor) ?? sourceCursorSchema.parse("1970-01-01T00:00:00.000Z") : void 0;
 	const process = async (number, wire, errors, ref) => {
+		requireCheckAccess(errors);
 		const error = errors[0];
 		if (error !== void 0) {
 			const direct = error.path === void 0 || error.path.length <= 2;
@@ -13449,6 +13472,7 @@ function createGithubIssuesAdapter(options) {
 //#endregion
 //#region ../adapters/src/jira/jira.ts
 const SEARCH_PAGE_LIMIT = 20;
+const MAX_GET_SEARCH_URL_LENGTH = 2e3;
 const OUTSIDE_BATCH_SIZE = 50;
 const FALLBACK_REQUEST_LIMIT = 100;
 const SPRINT_SCHEMA = "com.pyxis.greenhopper.jira:gh-sprint";
@@ -13563,6 +13587,7 @@ function createJiraAdapter(options) {
 			if (signal.aborted) throw new AdapterError("transient", "Jira poll aborted");
 			throw new AdapterError("transient", "Jira request failed");
 		}
+		if (response.status === 414 && options.searchMethod === "GET") throw new AdapterError("config", "Jira GET search URL is too long");
 		if (!response.ok) throw new JiraHttpError(response.status, classifyHttpFailure({
 			status: response.status,
 			headers: response.headers
@@ -13604,19 +13629,28 @@ function createJiraAdapter(options) {
 		const seen = /* @__PURE__ */ new Set();
 		for (let page = 0; page < SEARCH_PAGE_LIMIT; page += 1) {
 			beforePage?.();
-			const result = object$1(await request(tracker.baseUrl, "/rest/api/3/search/jql", signal, {
+			const fields = [
+				"summary",
+				"status",
+				"assignee",
+				"labels",
+				"updated",
+				...sprintField === null ? [] : [sprintField]
+			];
+			const body = {
 				jql,
 				maxResults: 100,
-				fields: [
-					"summary",
-					"status",
-					"assignee",
-					"labels",
-					"updated",
-					...sprintField === null ? [] : [sprintField]
-				],
+				fields,
 				...token === void 0 ? {} : { nextPageToken: token }
-			}));
+			};
+			const path = options.searchMethod === "GET" ? `/rest/api/3/search/jql?${new URLSearchParams({
+				jql,
+				maxResults: "100",
+				fields: fields.join(","),
+				...token === void 0 ? {} : { nextPageToken: token }
+			}).toString()}` : "/rest/api/3/search/jql";
+			if (options.searchMethod === "GET" && new URL(path, tracker.baseUrl).href.length > MAX_GET_SEARCH_URL_LENGTH) throw new AdapterError("config", `Jira GET search URL is too long (over ${String(MAX_GET_SEARCH_URL_LENGTH)} characters)`);
+			const result = object$1(await request(tracker.baseUrl, path, signal, options.searchMethod === "GET" ? void 0 : body));
 			issues.push(...array(result["issues"]));
 			const next = result["nextPageToken"];
 			if (next == null || next === "") {
@@ -13870,9 +13904,15 @@ function applyEntityOutcomes(input) {
 function startRunner(options) {
 	const startedAt = (options.now ?? Date.now)();
 	const sources = options.entries.map((entry) => runSource(entry, options, startedAt));
-	return { async stop() {
-		await Promise.all(sources.map((source) => source.stop()));
-	} };
+	return {
+		firstAttempts: Promise.all(sources.map(async (source) => ({
+			source: source.id,
+			outcome: await source.firstAttempt
+		}))),
+		async stop() {
+			await Promise.all(sources.map((source) => source.stop()));
+		}
+	};
 }
 function runSource(entry, options, runnerStartMs) {
 	const { adapter, reserveRemaining } = entry;
@@ -13946,7 +13986,7 @@ function runSource(entry, options, runnerStartMs) {
 		if (stopping) return;
 		pollTimer = setTimeout(() => {
 			pollTimer = void 0;
-			current = poll();
+			current = poll().then(() => void 0);
 		}, delayMs);
 	}
 	async function poll() {
@@ -14042,22 +14082,28 @@ function runSource(entry, options, runnerStartMs) {
 			now: now()
 		});
 		failures = delay.failures;
-		armDeadline();
+		if (!options.oneShot) armDeadline();
 		await report();
-		schedule(delay.delayMs);
+		if (!options.oneShot) schedule(delay.delayMs);
+		return outcome;
 	}
-	armDeadline();
-	current = poll();
-	return { async stop() {
-		stopping = true;
-		clearTimeout(pollTimer);
-		clearTimeout(deadlineTimer);
-		clearTimeout(hardBoundTimer);
-		pollTimer = deadlineTimer = hardBoundTimer = void 0;
-		controller?.abort();
-		await current;
-		await reports;
-	} };
+	if (!options.oneShot) armDeadline();
+	const firstAttempt = poll();
+	current = firstAttempt.then(() => void 0);
+	return {
+		id: source,
+		firstAttempt,
+		async stop() {
+			stopping = true;
+			clearTimeout(pollTimer);
+			clearTimeout(deadlineTimer);
+			clearTimeout(hardBoundTimer);
+			pollTimer = deadlineTimer = hardBoundTimer = void 0;
+			controller?.abort();
+			await current;
+			await reports;
+		}
+	};
 }
 /**
 * Settles with `work`, or with undefined as soon as `signal` aborts, so `stop()` never waits
@@ -14317,7 +14363,8 @@ function startAdapters(config, core, options = {}) {
 			},
 			intervalMs: config.adapters.jira.intervalMs,
 			...options.fetch === void 0 ? {} : { fetch: options.fetch },
-			warn: options.warn ?? (() => void 0)
+			warn: options.warn ?? (() => void 0),
+			...options.jiraSearchMethod === void 0 ? {} : { searchMethod: options.jiraSearchMethod }
 		}) : blindSource(id, config.adapters.jira.intervalMs, "Jira credential is missing") });
 	} else {
 		const id = `github-issues:${project.id}:${project.tracker.repo.toLowerCase()}`;
@@ -14354,12 +14401,16 @@ function startAdapters(config, core, options = {}) {
 		}) }],
 		core,
 		config,
-		...options.now === void 0 ? {} : { now: options.now }
+		...options.now === void 0 ? {} : { now: options.now },
+		...options.oneShot === void 0 ? {} : { oneShot: options.oneShot }
 	});
-	return { async stop() {
-		await runner.stop();
-		await Promise.allSettled([...notices]);
-	} };
+	return {
+		firstAttempts: runner.firstAttempts,
+		async stop() {
+			await runner.stop();
+			await Promise.allSettled([...notices]);
+		}
+	};
 }
 //#endregion
 //#region ../gateway-slack/src/api.ts
@@ -14896,7 +14947,7 @@ function createDeliveryGateway(client, channels) {
 function descriptors(commandName) {
 	return OPERATIONS.filter((operation) => operation.kind === "query" && operation.slack?.kind === "slash-command").map((operation) => ({
 		operation,
-		usage: operation.slack?.kind === "slash-command" ? operation.slack.usage.replace(/^\/board\b/, commandName) : ""
+		usage: operation.slack?.kind === "slash-command" ? operation.slack.usage.replace(/^\/\S+/, commandName) : ""
 	}));
 }
 function commandUsage(commandName) {
@@ -15071,7 +15122,7 @@ function normalizeMessage(channel, payload, context) {
 	return events;
 }
 /** Actions and commands share the same stable trigger identity as their Slack retry. */
-function normalizeInteraction(type, payload, channels, root, commandName = "/board") {
+function normalizeInteraction(type, payload, channels, root, commandName = DEFAULT_SLACK_COMMAND) {
 	const body = record$1(payload);
 	if (body === null) return [];
 	const triggerId = string$1(body.trigger_id);
@@ -15080,16 +15131,18 @@ function normalizeInteraction(type, payload, channels, root, commandName = "/boa
 	if (user === void 0) return [];
 	const author = userIdSchema.parse(user);
 	if (type === "slash_commands") {
-		if (body.command !== commandName) return [];
+		const name = string$1(body.command);
+		if (name === void 0) return [];
 		const channel = string$1(body.channel_id);
 		if (channel === void 0) return [];
 		return [{
 			kind: "command",
+			name,
 			dedupeKey: `slack:${triggerId}`,
 			interaction: interactionRef(channel, user, triggerId),
 			author,
 			text: text(body.text) ?? "",
-			command: parseCommand(text(body.text) ?? "", commandName),
+			...name === commandName ? { command: parseCommand(text(body.text) ?? "", commandName) } : {},
 			sourceUrl: sourceUrl(channel),
 			sourceSpace: sourceSpace(channel, channels)
 		}];
@@ -15508,11 +15561,7 @@ async function runDaemonDoctor(ctx, productVersion, fetcher = fetch) {
 	const checks = [];
 	const jiraTrackers = config.projects.flatMap((project) => project.tracker.type === "jira" ? [project.tracker] : []);
 	const slackConfigured = Boolean(config.slack.channels.feed || config.slack.channels.orchestrators);
-	const missing = [
-		"GITHUB_TOKEN",
-		...jiraTrackers.length > 0 ? ["JIRA_EMAIL", "JIRA_API_TOKEN"] : [],
-		...slackConfigured ? ["SLACK_BOT_TOKEN", "SLACK_APP_TOKEN"] : []
-	].filter((name) => !secrets[name]);
+	const missing = requiredSecretKeys(config).filter((name) => !secrets[name]);
 	checks.push(check("secrets", missing.length === 0, `Add ${missing.join(", ")} to the private secrets.env file.`));
 	const jiraEmail = secrets["JIRA_EMAIL"];
 	const jiraToken = secrets["JIRA_API_TOKEN"];

package/dist/mcp.mjs

@@ -1,6 +1,6 @@
-import { j as ERRORS, s as OPERATIONS, u as renderMcpError } from "./src-BEo3mvRC.mjs";
-import { r as CliError, t as requestOperation } from "./client-CHohYNxa.mjs";
-import { n as loadClientConfig } from "./config-BuxxS_er.mjs";
+import { j as ERRORS, s as OPERATIONS, u as renderMcpError } from "./src-Cy74ZQfR.mjs";
+import { r as CliError, t as requestOperation } from "./client-Dw9ZovyI.mjs";
+import { n as loadClientConfig } from "./config-CeDZQlvy.mjs";
 import { randomUUID } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { z } from "zod";

package/dist/{src-BEo3mvRC.mjs → src-Cy74ZQfR.mjs}

@@ -111,6 +111,8 @@ const SLACK_BOT_SCOPES = [
 //#endregion
 //#region ../contracts/src/config.ts
 const DEFAULT_HTTP_PORT = 4311;
+const DEFAULT_SLACK_APP_NAME = "spur-board";
+const DEFAULT_SLACK_COMMAND = "/board";
 const WEEKDAYS = [
 	"monday",
 	"tuesday",
@@ -247,7 +249,8 @@ const configSchema = z.strictObject({
 	}),
 	operator: z.strictObject({ slack: nonEmpty }),
 	slack: z.strictObject({
-		command: z.string().regex(/^\/[a-z0-9_-]+$/, "Expected a slash command such as /board").default("/board"),
+		appName: z.string().trim().min(1).default(DEFAULT_SLACK_APP_NAME),
+		command: z.string().regex(/^\/[a-z0-9_-]+$/, "Expected a slash command such as /board").default(DEFAULT_SLACK_COMMAND),
 		appId: z.string().regex(/^A[A-Z0-9]+$/, "Expected a Slack app ID").optional(),
 		channels: z.strictObject({
 			orchestrators: nonEmpty.optional(),
@@ -300,6 +303,49 @@ const configSchema = z.strictObject({
 		}).prefault({})
 	}).prefault({})
 });
+/** Recognized names in the private secrets.env file; values never belong in config.yaml. */
+const SECRET_ENV_KEYS = [
+	{
+		name: "GITHUB_TOKEN",
+		requiredWhen: "always",
+		purpose: "Read GitHub repositories and check runs."
+	},
+	{
+		name: "JIRA_EMAIL",
+		requiredWhen: "jira",
+		purpose: "Jira account email."
+	},
+	{
+		name: "JIRA_API_TOKEN",
+		requiredWhen: "jira",
+		purpose: "Jira API token."
+	},
+	{
+		name: "SLACK_BOT_TOKEN",
+		requiredWhen: "slack",
+		purpose: "Slack bot Web API token."
+	},
+	{
+		name: "SLACK_APP_TOKEN",
+		requiredWhen: "slack",
+		purpose: "Slack app-level Socket Mode token."
+	},
+	{
+		name: "SLACK_APP_CONFIG_TOKEN",
+		requiredWhen: "optional",
+		purpose: "Verify the installed slash command through the Slack app manifest API."
+	},
+	{
+		name: "SLACK_API_URL",
+		requiredWhen: "optional",
+		purpose: "Override the Slack API URL for local testing."
+	}
+];
+function requiredSecretKeys(config) {
+	const jira = config.projects.some((project) => project.tracker.type === "jira");
+	const slack = Boolean(config.slack.channels.feed || config.slack.channels.orchestrators);
+	return SECRET_ENV_KEYS.filter(({ requiredWhen }) => requiredWhen === "always" || requiredWhen === "jira" && jira || requiredWhen === "slack" && slack).map(({ name }) => name);
+}
 //#endregion
 //#region ../contracts/src/errors.ts
 /**
@@ -1114,6 +1160,7 @@ const actionEventSchema = z.strictObject({
 /** `text` is the command's argument text. */
 const commandEventSchema = z.strictObject({
 	kind: z.literal("command"),
+	name: z.string().min(1).optional(),
 	dedupeKey,
 	interaction: interactionRefSchema,
 	author: userIdSchema,
@@ -2631,4 +2678,4 @@ var AdapterError = class extends Error {
 	}
 };
 //#endregion
-export { taskKeySchema as A, sessionFactsSchema as C, errorCodeOf as D, encodeActorId as E, DEFAULT_HTTP_PORT as F, configSchema as I, SLACK_BOT_SCOPES as L, errorContextSchema as M, errorEnvelopeSchema as N, parseActorId as O, successEnvelopeSchema as P, prRefSchema as S, actorIdSchema as T, EVENT_KINDS as _, buildCatalogSnapshot as a, SESSION_STATUSES as b, renderHttpProblem as c, SPACE_IDS as d, conversationRefSchema as f, userIdSchema as g, messageRefSchema as h, sourceCursorSchema as i, ERRORS as j, parseRef as k, renderJsonError as l, interactionRefSchema as m, batchSchema as n, roleCanUseOperation as o, inboundEventSchema as p, entityRefSchema as r, OPERATIONS as s, AdapterError as t, renderMcpError as u, eventPayloadSchemas as v, ticketFactsSchema as w, prFactsSchema as x, SESSION_HEALTH_STATES as y };
+export { taskKeySchema as A, SLACK_BOT_SCOPES as B, sessionFactsSchema as C, errorCodeOf as D, encodeActorId as E, DEFAULT_HTTP_PORT as F, DEFAULT_SLACK_APP_NAME as I, DEFAULT_SLACK_COMMAND as L, errorContextSchema as M, errorEnvelopeSchema as N, parseActorId as O, successEnvelopeSchema as P, configSchema as R, prRefSchema as S, actorIdSchema as T, EVENT_KINDS as _, buildCatalogSnapshot as a, SESSION_STATUSES as b, renderHttpProblem as c, SPACE_IDS as d, conversationRefSchema as f, userIdSchema as g, messageRefSchema as h, sourceCursorSchema as i, ERRORS as j, parseRef as k, renderJsonError as l, interactionRefSchema as m, batchSchema as n, roleCanUseOperation as o, inboundEventSchema as p, entityRefSchema as r, OPERATIONS as s, AdapterError as t, renderMcpError as u, eventPayloadSchemas as v, ticketFactsSchema as w, prFactsSchema as x, SESSION_HEALTH_STATES as y, requiredSecretKeys as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spur-board",
-  "version": "0.4.1",
+  "version": "0.6.0",
   "license": "MIT",
   "engines": {
     "node": "^24.12.0 || ^26.0.0"

package/skills/setup/references/slack.md

@@ -4,6 +4,6 @@ Use this when the orchestrators or feed channel is not configured, or the app-le
 
 1. Check the bot's current channel membership. List the private channels it can see and ask the operator, one choice at a time, which should serve orchestrators and feed. An empty list does not prove no channels exist: the bot sees only private channels to which it was invited. Store channel IDs in config, never guessed names.
 2. If no channel fits, ask for an operator-chosen prefix and suggest available names using it. The operator creates or invites the app to channels; ask before any app or channel change.
-3. Check whether an app and slash command already exist. If either is missing, use `board slack manifest --app-name <name> --command <slash-command>` to prepare a manifest with operator-chosen names. The operator creates the Slack app; do not claim the manifest creates it.
-4. The manifest cannot create the app-level token with `connections:write`. Guide the operator through creating that token in Slack, then use the private entry procedure in [secret files](secrets.md). Never ask for a token value in chat.
+3. Check whether an app and slash command already exist. If either is missing, use `board slack manifest --app-name <name> --command <slash-command>` to prepare a manifest with operator-chosen names. The operator creates the Slack app; do not claim the manifest creates it. Set `slack.appName` and `slack.command` in config to the selected names.
+4. The manifest cannot create the app-level token with `connections:write`. In the Slack app settings, open **Basic Information → App-Level Tokens** and create a token with that scope. Then use the private entry procedure in [secret files](secrets.md). Never ask for a token value in chat.
 5. Check channel membership and command configuration with online doctor. If a check fails, apply its reported fix after inspecting state.