How to use Bolt events with the newer Slack API manifests?

I'm building a Slack App using Bolt and I've got the basics working using Socket Mode. The docs say that socket mode apps are not allowed in the public directory, which I do want my App in when it's ready. I've now turned off socket mode and got ngrok working as described here. Slack was able to validate the url anyway.

But what's not working is a slash command. The manifest editor says the url is required for a slash command, but how does that line up with bolt? Are there better docs for non-socket-mode somewhere? It seems like every example of using bolt says "let's use socket mode, it's easy".

Manifest portion:

slash_commands:
  - command: /sb
   url: https://[my url].ngrok.io/slack/command

Sample code:

const { App } = require('@slack/bolt');
const express = require('express');

const app = express();

const boltApp = new App({
    signingSecret: config.slackApp.signingSecret,
    token: config.slackApp.token,
    endpoints = '/'
});

app.use('/slack/events', boltApp.receiver.router);

Bolt

Slack App Manifests

I got this working with a combination of the following:

• setting every url in the manifest (slash_commands, event_subscriptions, interactivity) to https://foo.ngrok.io/slack/
• attaching Bolt to an existing Express App, attempting to follow this PR to use app and/or router config prop on ExpressReceiver, but strangely what worked was putting the express app into the router
• setting up Bolt like below

Example Code:

const expressApp = express();
...
const boltReceiver = new ExpressReceiver({
  router: expressApp, 
  signingSecret: SLACK_SIGNING_SECRET,
  endpoints: '/slack'
});

const boltApp = new App({
  token: SLACK_BOT_TOKEN,
  receiver: boltReceiver,
  appToken: SLACK_APP_TOKEN,
  socketMode: false,
});