Slack Channel for Constal

@constal/slack supplies a tenant-owned Slack app's Channel, AuthProvider, and declarative Web API Service configuration. The app's Events API Request URL is that tenant Channel's public URL. The AuthProvider returns Slack's HMAC declaration; Constal verifies it with the bound signing-secret Credential before Channel code runs. Slack event IDs deduplicate retries.

Install one Channel per Slack app. Set the same appId in both manifests and list its connected team_id values in the Channel configuration. The Channel treats each Slack workspace as a customer partition. The packaged slack-app-installation Credential Provider runs the tenant app's OAuth flow and rotates expiring workspace bot tokens; long-lived bot tokens remain valid without refresh. Its client secret is a bootstrap Credential and any refresh token stays provider-private. Bind the Service's bot-token Credential by customer so one app may serve multiple workspaces without sharing tokens. The Service uses the ordinary service Driver with SLACK_SERVICE_CONFIG and SLACK_SERVICE_EGRESS; chat.postMessage is declared non-idempotent because Slack's Web API does not document a replay-safe send contract. Declare the Service's authorization Credential as an optional customer-scoped binding. Slack's signed URL verification has no workspace customer and must run before any workspace installs a bot token. Add a workspace to the Channel's teams configuration only after its customer-scoped bot Credential is active.

The package's manifests are templates: fill their app ID and tenant namespace, bind a signing-secret Credential, and install the Service and Channel under the ordinary Resource and Channel APIs. The Slack app must subscribe to the events the Channel handles, including app_mention and message events. Agent deployments opt in through the channels.constal.ai/slack=enabled label. Import the app signing secret through the namespace's built-in static Credential Provider and bind it to the AuthProvider's signing-secret slot.

app-manifest.yaml provides the corresponding Slack scopes and events. Replace its Request URL with the deployed tenant Channel URL before saving it in Slack. Token rotation is optional; the Credential Provider accepts both long-lived and rotating bot tokens.

Slack requires a 2xx within three seconds. Verify signed production ingress latency before replacing any existing relay. A relay that answers before Constal durably accepts an event can lose messages.