v0.2.0 — Authenticated Slack webhooks and inbound threads

Security

• Slack webhooks are authenticated before any event is handled. The plugin verifies the original request bytes with the signing secret (HMAC-SHA256, constant-time compare), checks timestamp freshness and signature shape, and returns real HTTP errors. Challenges are answered only after authentication (#1).

Added

• Inbound message delivery to a durable host processor: a configured workspace/channel allowlist, bot, hidden and unsupported-subtype events ignored, the full signed envelope preserved for host re-verification, and a matching acceptance receipt required (#1).
• Public replies on Slack-origin tickets go back to the recorded workspace/channel/thread, and only while that origin is still allowlisted. Imported Slack tickets and replies are not echoed back to Slack; internal notes are never sent (#2).

Fixed

• Authenticated events outside workspace_id / inbound_channels (including direct messages) and whitespace-only messages are acknowledged with 200 {"ignored": true} instead of 403/400, so Slack stops retrying them. A host receipt of {ignored: true} is acknowledged with 200 instead of a retryable 503 (#3).
• The 65,535 UTF-16 unit text limit is removed; text is bounded by the 1 MiB signed-body limit (#3).

Upgrading

• A signing secret is now required, and the host must support plugin HTTP contract version 1 (send rawBodyBase64). Requests without the raw bytes are rejected. Use @escalated-dev/plugin-runtime v0.2.0 and a host bridge with contract v1 support (escalated-laravel 1.9.0).
• Inbound delivery needs an explicit allowlist (workspace_id, inbound_channels); messages from anywhere else are acknowledged and ignored.
• A host with no inbound subscriber gets a retryable 503 rather than a silent acknowledgement.
• The package is built as ESM. It depends on the plugin SDK at the HTTP-contract commit (6053134, included in SDK v0.2.0).