@opengeni/api-router 0.12.2 → 0.12.5

package/dist/{chunk-3JR6L6NJ.js → chunk-3BHOMOSD.js}

@@ -27,7 +27,7 @@ import { bodyLimit } from "hono/body-limit";
 import { cors } from "hono/cors";
 import { HTTPException as HTTPException26 } from "hono/http-exception";
 import {
-  hasPermission as hasPermission7,
+  hasPermission as hasPermission9,
   requireAccessGrant as requireAccessGrant18,
   requirePermission,
   requireSessionAuthorization as requireSessionAuthorization3,
@@ -2019,7 +2019,8 @@ import {
   completeSlackBotPostOperation,
   getSession,
   recordAuditEvent,
-  releaseSlackBotPostOperationClaim
+  releaseSlackBotPostOperationClaim,
+  setConnectionStatus
 } from "@opengeni/db";
 import { readResponseJsonBounded } from "@opengeni/network";
 import { HTTPException as HTTPException2 } from "hono/http-exception";
@@ -2031,6 +2032,46 @@ var MAX_HISTORY_PAGE = 100;
 var MAX_USER_PAGE = 200;
 var MAX_PROJECTED_TEXT = 4e3;
 var SLACK_POST_CLAIM_LEASE_MS = 3e4;
+async function exchangeOpenGeniSlackAuthorizationCode(input, fetchImpl = fetch) {
+  const body = new URLSearchParams({
+    code: input.code,
+    client_id: input.clientId,
+    client_secret: input.clientSecret,
+    redirect_uri: input.redirectUri
+  });
+  let response;
+  try {
+    response = await fetchImpl(`${SLACK_API_BASE}oauth.v2.access`, {
+      method: "POST",
+      headers: {
+        accept: "application/json",
+        "content-type": "application/x-www-form-urlencoded"
+      },
+      body: body.toString(),
+      redirect: "error",
+      signal: AbortSignal.timeout(SLACK_TIMEOUT_MS)
+    });
+  } catch {
+    throw new HTTPException2(502, { message: "Slack installation token exchange failed" });
+  }
+  if (!response.ok) {
+    throw new HTTPException2(502, { message: "Slack installation token exchange failed" });
+  }
+  const payload = await readResponseJsonBounded(
+    response,
+    SLACK_RESPONSE_MAX_BYTES,
+    "Slack OAuth response"
+  );
+  const record3 = slackRecord(payload);
+  if (!record3 || record3.ok !== true) {
+    throw new SlackBotProviderError(slackString(record3?.error) || "oauth_exchange_failed");
+  }
+  const accessToken = slackString(record3.access_token);
+  if (!accessToken?.startsWith("xoxb-")) {
+    throw new HTTPException2(502, { message: "Slack installation did not return a bot token" });
+  }
+  return accessToken;
+}
 var SlackBotProviderError = class extends Error {
   constructor(code) {
     super(`Slack bot request failed: ${safeSlackCode(code)}`);
@@ -2038,6 +2079,23 @@ var SlackBotProviderError = class extends Error {
     this.name = "SlackBotProviderError";
   }
 };
+var SLACK_CREDENTIAL_REJECTION_CODES = /* @__PURE__ */ new Set([
+  "account_inactive",
+  "invalid_auth",
+  "not_authed",
+  "token_expired",
+  "token_revoked"
+]);
+function slackCredentialRejected(error) {
+  return error instanceof SlackBotProviderError && SLACK_CREDENTIAL_REJECTION_CODES.has(error.code);
+}
+var SlackBotCredentialVerificationError = class extends HTTPException2 {
+  constructor(failureReason, message) {
+    super(422, { message });
+    this.failureReason = failureReason;
+    this.name = "SlackBotCredentialVerificationError";
+  }
+};
 async function verifyOpenGeniSlackBotCredential(token, fetchImpl = fetch, now = /* @__PURE__ */ new Date()) {
   const authResponse = await slackApiFetch(fetchImpl, "auth.test", token, {});
   const grantedScopes2 = parseGrantedScopes(authResponse.response.headers.get("x-oauth-scopes"));
@@ -2052,14 +2110,18 @@ async function verifyOpenGeniSlackBotCredential(token, fetchImpl = fetch, now =
   });
   const user = slackRecord(userResponse.payload.user);
   if (!user || user.is_bot !== true || user.deleted === true) {
-    throw new HTTPException2(422, { message: "Slack credential must identify an active bot user" });
+    throw new SlackBotCredentialVerificationError(
+      "identity_mismatch",
+      "Slack credential must identify an active bot user"
+    );
   }
   const profile = slackRecord(user.profile);
   const displayName = slackString(profile?.display_name) || slackString(profile?.real_name);
   if (displayName !== "OpenGeni") {
-    throw new HTTPException2(422, {
-      message: 'Slack bot display name must be exactly "OpenGeni"'
-    });
+    throw new SlackBotCredentialVerificationError(
+      "identity_mismatch",
+      'Slack bot display name must be exactly "OpenGeni"'
+    );
   }
   return {
     grantedScopes: grantedScopes2,
@@ -2270,7 +2332,18 @@ var OpenGeniSlackBotClient = class {
     return projected;
   }
   async call(headers, method, params) {
-    return (await slackApiFetchWithHeaders(this.fetchImpl, method, headers, params)).payload;
+    try {
+      return (await slackApiFetchWithHeaders(this.fetchImpl, method, headers, params)).payload;
+    } catch (error) {
+      if (slackCredentialRejected(error)) {
+        await setConnectionStatus(this.db, this.context.workspaceId, "needs_reauth", error.code, {
+          id: this.connection.id,
+          version: this.connection.version,
+          subjectId: null
+        }).catch(() => false);
+      }
+      throw error;
+    }
   }
   async withAudit(operation, run) {
     try {
@@ -2426,14 +2499,18 @@ function assertExactOpenGeniSlackBotScopes(grantedScopes2) {
       ...forbidden.length ? [`forbidden: ${forbidden.join(", ")}`] : [],
       ...unsupported.length ? [`unsupported: ${unsupported.join(", ")}`] : []
     ];
-    throw new HTTPException2(422, {
-      message: `Slack bot scopes must exactly match the OpenGeni manifest (${facts.join("; ")})`
-    });
+    throw new SlackBotCredentialVerificationError(
+      "scope_mismatch",
+      `Slack bot scopes must exactly match the OpenGeni manifest (${facts.join("; ")})`
+    );
   }
 }
 function parseGrantedScopes(header) {
   if (!header) {
-    throw new HTTPException2(422, { message: "Slack did not report granted bot scopes" });
+    throw new SlackBotCredentialVerificationError(
+      "scope_mismatch",
+      "Slack did not report granted bot scopes"
+    );
   }
   return [
     ...new Set(
@@ -5290,7 +5367,15 @@ function connectionBrokerFetch(baseFetch, input) {
   if (!connectionRef) {
     return baseFetch;
   }
-  const resolveCredential = input.deps.connectionCredentials?.mcpCredentials ? buildHostConnectionTokenResolver(input.deps.connectionCredentials.mcpCredentials, {
+  const credentialSubjectId = input.turn.initiator.kind === "subject" ? input.turn.initiator.subjectId : void 0;
+  if (connectionRef.subjectScope === "subject" && !credentialSubjectId) {
+    throw new Error(
+      `subject-owned connection for MCP server ${input.config.id} requires a human turn initiator`
+    );
+  }
+  const hostCredentialPort = input.deps.connectionCredentials?.mcpCredentials;
+  const resolverSubjectId = hostCredentialPort ? input.grant.subjectId : credentialSubjectId;
+  const resolveCredential = hostCredentialPort ? buildHostConnectionTokenResolver(hostCredentialPort, {
     accountId: input.grant.accountId,
     workspaceId: input.grant.workspaceId,
     sessionId: input.sessionId,
@@ -5312,7 +5397,7 @@ function connectionBrokerFetch(baseFetch, input) {
       destinationUrl,
       forceRefresh: false,
       ...request.toolName ? { toolName: request.toolName } : {},
-      subjectId: input.grant.subjectId
+      ...resolverSubjectId ? { subjectId: resolverSubjectId } : {}
     });
     if (first.status === "auth_needed") {
       return await authNeededFetchResponse(input, request, first);
@@ -5330,7 +5415,7 @@ function connectionBrokerFetch(baseFetch, input) {
         destinationUrl,
         forceRefresh: true,
         ...request.toolName ? { toolName: request.toolName } : {},
-        subjectId: input.grant.subjectId
+        ...resolverSubjectId ? { subjectId: resolverSubjectId } : {}
       });
       if (refreshed.status === "auth_needed") {
         return await authNeededFetchResponse(input, request, refreshed);
@@ -5614,7 +5699,7 @@ function isAuthExempt(c, settings) {
   if (path === "/v1/github/setup" || path === "/v1/github/install/callback" || path === "/v1/github/oauth/callback" || path === "/v1/github/app-manifest/callback") {
     return true;
   }
-  if (path === "/v1/integrations/oauth/callback" || path === "/v1/integrations/oauth/client-metadata.json") {
+  if (path === "/v1/integrations/oauth/callback" || path === "/v1/integrations/oauth/client-metadata.json" || path === "/v1/integrations/slack/callback") {
     return true;
   }
   if (path.startsWith("/v1/catalog-assets/")) {
@@ -7032,17 +7117,20 @@ function registerCodexRoutes(app, deps) {
 }
 
 // src/routes/connections.ts
+import { createHash as createHash4 } from "crypto";
 import {
-  ConnectOpenGeniSlackBotRequest,
   ConnectionResponse,
   CreateConnectionRequest,
   IntegrationClientMetadata,
   ListConnectionsResponse,
+  OpenGeniSlackBotInstallRequest,
+  OpenGeniSlackBotInstallStart,
   OAuthStartRequest,
   OAuthStartResponse as OAuthStartResponse2,
   UpdateConnectionRequest
 } from "@opengeni/contracts";
 import {
+  hasPermission as hasPermission6,
   hasReservedOpenGeniSlackBotMetadata,
   isOpenGeniSlackBotConnection,
   openGeniSlackBotMetadata as openGeniSlackBotMetadata2,
@@ -7050,13 +7138,19 @@ import {
   requireEnvironmentEncryption as requireEnvironmentEncryption2
 } from "@opengeni/core";
 import {
+  consumeIntegrationOAuthStateNonce as consumeIntegrationOAuthStateNonce2,
   createConnection as createConnection2,
+  createConnectionWithSlackBotSuccessAudit,
   encryptEnvironmentValue as encryptEnvironmentValue3,
   getConnectionMetadata as getConnectionMetadata2,
+  getWorkspaceGrant as getWorkspaceGrant2,
   listConnectionsMetadata as listConnectionsMetadata2,
-  recordAuditEvent as recordAuditEvent2,
+  recordSlackBotInstallCallbackFailure,
   revokeConnection,
-  updateConnection as updateConnection2
+  revokeConnectionWithSlackBotSuccessAudit,
+  SlackBotLifecycleSuccessAuditError,
+  updateConnection as updateConnection2,
+  updateConnectionWithSlackBotSuccessAudit
 } from "@opengeni/db";
 import { HTTPException as HTTPException9 } from "hono/http-exception";
 
@@ -7065,13 +7159,14 @@ import { Client as Client2 } from "@modelcontextprotocol/sdk/client/index.js";
 import { StreamableHTTPClientTransport as StreamableHTTPClientTransport2 } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 import { parseIntegrationsOauthClientsJson } from "@opengeni/config";
 import { OAuthStartResponse } from "@opengeni/contracts";
-import { requireEnvironmentEncryption } from "@opengeni/core";
+import { hasPermission as hasPermission5, requireEnvironmentEncryption } from "@opengeni/core";
 import {
   consumeIntegrationOAuthStateNonce,
   createConnection,
   decryptEnvironmentValue,
   encryptEnvironmentValue as encryptEnvironmentValue2,
   getConnectionMetadata,
+  getWorkspaceGrant,
   listConnectionsMetadata,
   loadIntegrationOAuthClient,
   normalizeBearerScheme,
@@ -7104,6 +7199,8 @@ function canonicalProviderDomain(value) {
 // src/integrations/oauth-client.ts
 import { OAUTH_MAX_RESPONSE_BYTES as OAUTH_MAX_RESPONSE_BYTES2 } from "@opengeni/network";
 var oauthStateTtlMs = 10 * 60 * 1e3;
+var OFFICIAL_SLACK_MCP_URL = "https://mcp.slack.com/mcp";
+var SLACK_OAUTH_ORIGIN = "https://slack.com";
 var OAuthCallbackStageError = class extends Error {
   constructor(stage, reason, cause) {
     super(errorMessage(cause));
@@ -7116,9 +7213,10 @@ var OAuthCallbackStageError = class extends Error {
 async function startMcpOAuth(deps, context) {
   const { db, settings } = deps;
   const mcpUrl = canonicalMcpResource(context.payload.mcpUrl ?? context.payload.resource);
-  const providerDomain = canonicalProviderDomain(
-    context.payload.providerDomain ?? new URL(mcpUrl).hostname
-  );
+  const officialSlackResource = mcpUrl === OFFICIAL_SLACK_MCP_URL;
+  const providerDomain = officialSlackResource ? "slack.com" : canonicalProviderDomain(context.payload.providerDomain ?? new URL(mcpUrl).hostname);
+  const personalSlack = officialSlackResource || providerDomain === "slack.com";
+  assertPersonalSlackOAuthStart(settings, context.payload, mcpUrl, personalSlack);
   const returnPath = safeReturnPath(context.payload.returnPath ?? "/integrations");
   const baseUrl = integrationBaseUrl(settings.publicBaseUrl, context.requestUrl);
   const redirectUri = `${baseUrl}/v1/integrations/oauth/callback`;
@@ -7133,6 +7231,9 @@ async function startMcpOAuth(deps, context) {
     throw new HTTPException8(404, { message: "connection not found" });
   }
   const discovery = await discoverMcpOAuth(mcpUrl, settings);
+  if (personalSlack && !isLocalTestEnvironment(settings.environment)) {
+    assertSlackAuthorizationServer(discovery.as);
+  }
   const resource = discovery.prm.resource ? canonicalOAuthResource(discovery.prm.resource) : mcpUrl;
   const verifier = randomPkceVerifier();
   const authorizeScopes = chooseAuthorizeScopes(
@@ -7200,6 +7301,7 @@ async function completeMcpOAuthCallback(deps, input) {
   }
   try {
     state = readOAuthState(input.state, settings);
+    await requireOAuthCallbackGrant(db, state);
     if (!input.code) {
       return {
         redirectTo: callbackReturnPath(state.returnPath, "error", { reason: "missing_code" })
@@ -7258,6 +7360,7 @@ async function completeMcpOAuthCallback(deps, input) {
       ...verification.tools ? { mcpTools: verification.tools } : {}
     };
     const credentialEncrypted = encryptEnvironmentValue2(key, JSON.stringify(credential));
+    await requireOAuthCallbackGrant(db, state);
     const connection = await runCallbackStage(
       "persist",
       "persist_failed",
@@ -7266,6 +7369,7 @@ async function completeMcpOAuthCallback(deps, input) {
         connectionId: state.connectionId,
         visibleToSubjectId: state.subjectId,
         expectedVersion: state.connectionVersion,
+        subjectId: state.subjectId,
         providerDomain: state.providerDomain,
         kind: "oauth2",
         status: "active",
@@ -7277,7 +7381,7 @@ async function completeMcpOAuthCallback(deps, input) {
       }) : createConnection(db, {
         accountId: state.accountId,
         workspaceId: state.workspaceId,
-        subjectId: null,
+        subjectId: state.subjectId,
         providerDomain: state.providerDomain,
         kind: "oauth2",
         credentialEncrypted,
@@ -7317,6 +7421,43 @@ function requireIntegrationsStateSecret(settings) {
   }
   return secret;
 }
+async function requireOAuthCallbackGrant(db, state) {
+  const grant = await getWorkspaceGrant(db, state.subjectId, state.workspaceId);
+  if (!grant || grant.accountId !== state.accountId || !hasPermission5(grant.permissions, "connections:write")) {
+    throw new HTTPException8(403, {
+      message: "OAuth subject no longer has permission to write this workspace connection"
+    });
+  }
+}
+function assertPersonalSlackOAuthStart(settings, payload, mcpUrl, personalSlack) {
+  if (!personalSlack) return;
+  if (payload.oauthClient) {
+    throw new HTTPException8(422, {
+      message: "Slack OAuth client credentials are deployment-managed"
+    });
+  }
+  if (payload.providerDomain && canonicalProviderDomain(payload.providerDomain) !== "slack.com") {
+    throw new HTTPException8(422, { message: "Slack provider identity does not match slack.com" });
+  }
+  if (!isLocalTestEnvironment(settings.environment) && mcpUrl !== OFFICIAL_SLACK_MCP_URL) {
+    throw new HTTPException8(422, {
+      message: `personal Slack OAuth must use ${OFFICIAL_SLACK_MCP_URL}`
+    });
+  }
+  if (!settings.slackClientId?.trim() || !settings.slackClientSecret?.trim()) {
+    throw new HTTPException8(503, {
+      message: "personal Slack OAuth requires OPENGENI_SLACK_CLIENT_ID and OPENGENI_SLACK_CLIENT_SECRET"
+    });
+  }
+}
+function assertSlackAuthorizationServer(as) {
+  const urls = [as.issuer, as.authorizationServer, as.authorizationEndpoint, as.tokenEndpoint];
+  if (urls.some((value) => new URL(value).origin !== SLACK_OAUTH_ORIGIN)) {
+    throw new HTTPException8(422, {
+      message: "Slack MCP authorization metadata did not remain bound to slack.com"
+    });
+  }
+}
 async function discoverMcpOAuth(resource, settings) {
   const challenge = await probeMcpChallenge(resource, settings);
   const prm = await discoverProtectedResourceMetadata(
@@ -7553,6 +7694,14 @@ function operatorClientForAs(settings, as) {
   };
 }
 function operatorClientEntryFor(settings, candidates) {
+  const normalizedCandidates = new Set(candidates.map(normalizedIssuerKey));
+  if (normalizedCandidates.has(SLACK_OAUTH_ORIGIN) && settings.slackClientId?.trim() && settings.slackClientSecret?.trim()) {
+    return {
+      clientId: settings.slackClientId.trim(),
+      clientSecret: settings.slackClientSecret.trim(),
+      tokenEndpointAuthMethod: "client_secret_post"
+    };
+  }
   const configured = parseIntegrationsOauthClientsJson(settings.integrationsOauthClientsJson);
   const exactKeys = uniqueStrings(
     candidates.flatMap((candidate) => [candidate, normalizedIssuerKey(candidate)])
@@ -7563,7 +7712,6 @@ function operatorClientEntryFor(settings, candidates) {
       return entry;
     }
   }
-  const normalizedCandidates = new Set(candidates.map(normalizedIssuerKey));
   for (const [key, entry] of Object.entries(configured)) {
     if (normalizedCandidates.has(normalizedIssuerKey(key))) {
       return entry;
@@ -7624,11 +7772,17 @@ async function dynamicClientRegistration(settings, as, redirectUri, scopes) {
 }
 async function existingOAuthConnectionForStart(db, input) {
   if (input.connectionId) {
-    return await getConnectionMetadata(db, input.workspaceId, input.connectionId, input.subjectId);
+    const connection = await getConnectionMetadata(
+      db,
+      input.workspaceId,
+      input.connectionId,
+      input.subjectId
+    );
+    return connection?.subjectId === input.subjectId && connection.kind === "oauth2" && connection.providerDomain === input.providerDomain ? connection : null;
   }
   const visible = await listConnectionsMetadata(db, input.workspaceId, input.subjectId);
   return visible.find(
-    (connection) => connection.subjectId === null && connection.kind === "oauth2" && connection.status === "active" && connection.providerDomain === input.providerDomain
+    (connection) => connection.subjectId === input.subjectId && connection.kind === "oauth2" && connection.status === "active" && connection.providerDomain === input.providerDomain
   ) ?? null;
 }
 function buildAuthorizationUrl(input) {
@@ -7695,6 +7849,9 @@ function readOAuthState(state, settings) {
   };
   const connectionId = stringValue(payload.connectionId);
   const connectionVersion = numberValue(payload.connectionVersion);
+  if (Boolean(connectionId) !== Boolean(connectionVersion)) {
+    throw new HTTPException8(400, { message: "invalid OAuth reconnect state" });
+  }
   return {
     ...parsed,
     ...connectionId ? { connectionId } : {},
@@ -8181,8 +8338,10 @@ function requiredString(value, field) {
 // src/routes/connections.ts
 import {
   OPENGENI_SLACK_BOT_CREDENTIAL_LABEL as OPENGENI_SLACK_BOT_CREDENTIAL_LABEL2,
-  OPENGENI_SLACK_BOT_CREDENTIAL_ROLE as OPENGENI_SLACK_BOT_CREDENTIAL_ROLE2
+  OPENGENI_SLACK_BOT_CREDENTIAL_ROLE as OPENGENI_SLACK_BOT_CREDENTIAL_ROLE2,
+  OPENGENI_SLACK_BOT_REQUIRED_SCOPES as OPENGENI_SLACK_BOT_REQUIRED_SCOPES2
 } from "@opengeni/contracts";
+import { createSignedState as createSignedState4, readSignedState as readSignedState3 } from "@opengeni/github";
 function registerConnectionRoutes(app, deps) {
   const { db, settings, observability } = deps;
   function assertIntegrationsEnabled() {
@@ -8206,11 +8365,13 @@ function registerConnectionRoutes(app, deps) {
     assertNotReservedSlackBotMetadata(payload.metadata);
     const key = requireEnvironmentEncryption2(settings);
     const subjectId = writableSubjectId(payload.subjectId, grant.subjectId);
+    const providerDomain = canonicalProviderDomain(payload.providerDomain);
+    assertNotDirectPersonalSlackOAuth(providerDomain, payload.kind);
     const connection = await createConnection2(db, {
       accountId: grant.accountId,
       workspaceId,
       subjectId,
-      providerDomain: canonicalProviderDomain(payload.providerDomain),
+      providerDomain,
       kind: payload.kind,
       credentialEncrypted: encryptCredentialBundle(key, payload.credential),
       grantedScopes: payload.grantedScopes,
@@ -8220,19 +8381,11 @@ function registerConnectionRoutes(app, deps) {
     });
     return c.json(ConnectionResponse.parse({ connection }), 201);
   });
-  app.post("/v1/workspaces/:workspaceId/connections/slack-bot", async (c) => {
+  app.post("/v1/workspaces/:workspaceId/connections/slack-bot/install", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant3(c, deps, workspaceId, "connections:write");
-    const payload = ConnectOpenGeniSlackBotRequest.parse(await c.req.json());
-    const verified = await verifyOpenGeniSlackBotCredential(
-      payload.token,
-      deps.slackFetch ?? fetch
-    );
-    const key = requireEnvironmentEncryption2(settings);
-    const credentialEncrypted = encryptCredentialBundle(
-      key,
-      slackBotCredentialBundle(payload.token)
-    );
+    const payload = OpenGeniSlackBotInstallRequest.parse(await c.req.json());
+    const slack = requireOpenGeniSlackOAuthSettings(settings);
     const existing = payload.connectionId ? await getConnectionMetadata2(db, workspaceId, payload.connectionId, grant.subjectId) : null;
     if (payload.connectionId && !existing) {
       throw new HTTPException9(404, { message: "connection not found" });
@@ -8242,69 +8395,119 @@ function registerConnectionRoutes(app, deps) {
         message: "connectionId is not an OpenGeni Slack bot connection"
       });
     }
-    const existingMetadata = existing ? openGeniSlackBotMetadata2(existing.metadata) : null;
-    if (existingMetadata && existingMetadata.slackTeamId !== verified.metadata.slackTeamId) {
-      throw new HTTPException9(409, {
-        message: "a Slack bot connection can only be reinstalled for its original Slack workspace"
-      });
-    }
-    if (existingMetadata && (existingMetadata.botId !== verified.metadata.botId || existingMetadata.botUserId !== verified.metadata.botUserId)) {
-      throw new HTTPException9(409, {
-        message: "a different Slack bot requires a new connection and explicit scheduled-task rebinding"
-      });
-    }
-    const verifiedInstallAt = new Date(verified.metadata.verifiedAt);
-    const connection = existing ? await updateConnection2(db, {
-      workspaceId,
-      connectionId: existing.id,
-      visibleToSubjectId: grant.subjectId,
-      expectedVersion: existing.version,
-      subjectId: null,
-      providerDomain: "slack.com",
-      kind: "app_install",
-      status: "active",
-      credentialEncrypted,
-      grantedScopes: verified.grantedScopes,
-      expiresAt: null,
-      verifiedInstallAt,
-      verifiedInstallVersion: existing.version + 1,
-      metadata: verified.metadata,
-      updatedBySubjectId: grant.subjectId
-    }) : await createConnection2(db, {
+    const baseUrl = integrationBaseUrl(settings.publicBaseUrl, c.req.url);
+    const redirectUri = `${baseUrl}/v1/integrations/slack/callback`;
+    const returnPath = `/workspaces/${workspaceId}/capabilities`;
+    const state = createSignedState4(requireIntegrationsStateSecret(settings), {
       accountId: grant.accountId,
       workspaceId,
-      subjectId: null,
-      providerDomain: "slack.com",
-      kind: "app_install",
-      credentialEncrypted,
-      grantedScopes: verified.grantedScopes,
-      expiresAt: null,
-      verifiedInstallAt,
-      verifiedInstallVersion: 1,
-      metadata: verified.metadata,
-      createdBySubjectId: grant.subjectId
+      subjectId: grant.subjectId,
+      returnPath,
+      ...existing ? { connectionId: existing.id, connectionVersion: existing.version } : {}
     });
-    if (!connection) {
-      throw new HTTPException9(409, {
-        message: "Slack bot connection changed during reinstall; retry with the current connection"
+    const authorizationUrl = new URL("https://slack.com/oauth/v2/authorize");
+    authorizationUrl.searchParams.set("client_id", slack.clientId);
+    authorizationUrl.searchParams.set("scope", OPENGENI_SLACK_BOT_REQUIRED_SCOPES2.join(","));
+    authorizationUrl.searchParams.set("redirect_uri", redirectUri);
+    authorizationUrl.searchParams.set("state", state);
+    return c.json(
+      OpenGeniSlackBotInstallStart.parse({
+        authorizationUrl: authorizationUrl.toString(),
+        expiresAt: new Date(Date.now() + oauthStateTtlMs).toISOString()
+      })
+    );
+  });
+  app.get("/v1/integrations/slack/callback", async (c) => {
+    const baseUrl = integrationBaseUrl(settings.publicBaseUrl, c.req.url);
+    let state = null;
+    let stage = "permission_check";
+    try {
+      state = readOpenGeniSlackInstallState(c.req.query("state"), settings);
+      await requireSlackInstallCallbackGrant(db, state);
+      stage = "nonce_consume";
+      const consumed = await consumeIntegrationOAuthStateNonce2(db, {
+        accountId: state.accountId,
+        workspaceId: state.workspaceId,
+        subjectId: state.subjectId,
+        nonce: state.nonce,
+        expiresAt: new Date(state.iat * 1e3 + oauthStateTtlMs),
+        now: /* @__PURE__ */ new Date()
       });
-    }
-    await recordAuditEvent2(db, {
-      accountId: grant.accountId,
-      workspaceId,
-      subjectId: grant.subjectId,
-      action: existing ? "slack_bot.reinstalled" : "slack_bot.connected",
-      targetType: "connection",
-      targetId: connection.id,
-      metadata: {
-        credentialRole: OPENGENI_SLACK_BOT_CREDENTIAL_ROLE2,
-        credentialLabel: OPENGENI_SLACK_BOT_CREDENTIAL_LABEL2,
-        connectionId: connection.id,
-        slackTeamId: verified.metadata.slackTeamId,
-        outcome: "succeeded"
+      if (!consumed) {
+        throw new SlackInstallCallbackError(
+          400,
+          "state_replayed",
+          "Slack installation state has already been used"
+        );
       }
-    });
-    return c.json(ConnectionResponse.parse({ connection }), existing ? 200 : 201);
+      if (c.req.query("error")) {
+        stage = "provider_denial";
+        throw new SlackInstallCallbackError(
+          400,
+          "provider_denied",
+          "Slack installation authorization was denied"
+        );
+      }
+      stage = "code_exchange";
+      const code = c.req.query("code");
+      if (!code) {
+        throw new SlackInstallCallbackError(
+          400,
+          "missing_code",
+          "Slack installation callback is missing code"
+        );
+      }
+      const slack = requireOpenGeniSlackOAuthSettings(settings);
+      const redirectUri = `${baseUrl}/v1/integrations/slack/callback`;
+      const token = await exchangeOpenGeniSlackAuthorizationCode(
+        {
+          code,
+          clientId: slack.clientId,
+          clientSecret: slack.clientSecret,
+          redirectUri
+        },
+        deps.slackFetch ?? fetch
+      );
+      stage = "credential_verification";
+      const verified = await verifyOpenGeniSlackBotCredential(token, deps.slackFetch ?? fetch);
+      stage = "permission_recheck";
+      await requireSlackInstallCallbackGrant(db, state);
+      stage = "persistence";
+      const connection = await persistOpenGeniSlackBotConnection({
+        deps,
+        state,
+        token,
+        verified
+      });
+      return c.redirect(
+        slackInstallReturnUrl(baseUrl, state.returnPath, "connected", connection.id),
+        302
+      );
+    } catch (error) {
+      if (state) {
+        const failure = slackInstallCallbackFailure(stage, error);
+        try {
+          await recordSlackBotInstallCallbackFailure(db, {
+            accountId: state.accountId,
+            workspaceId: state.workspaceId,
+            subjectId: state.subjectId,
+            callbackDigest: createHash4("sha256").update(state.nonce).digest("hex"),
+            installMode: state.connectionId ? "reinstall" : "connect",
+            ...failure
+          });
+        } catch {
+          return c.redirect(
+            slackInstallReturnUrl(baseUrl, state.returnPath, "error", "installation_failed"),
+            302
+          );
+        }
+      }
+      const reason = slackInstallErrorReason(error);
+      return c.redirect(
+        slackInstallReturnUrl(baseUrl, state?.returnPath ?? "/integrations", "error", reason),
+        302
+      );
+    }
   });
   app.get("/v1/workspaces/:workspaceId/connections/:connectionId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
@@ -8336,6 +8539,12 @@ function registerConnectionRoutes(app, deps) {
         message: "use the dedicated OpenGeni Slack bot reinstall flow to update this connection"
       });
     }
+    if (existing) {
+      assertNotDirectPersonalSlackOAuth(
+        canonicalProviderDomain(payload.providerDomain ?? existing.providerDomain),
+        payload.kind ?? existing.kind
+      );
+    }
     if (payload.status !== void 0) {
       if (payload.status !== "active") {
         throw new HTTPException9(400, {
@@ -8371,33 +8580,24 @@ function registerConnectionRoutes(app, deps) {
   });
   app.delete("/v1/workspaces/:workspaceId/connections/:connectionId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
+    const connectionId = c.req.param("connectionId");
     const grant = await requireAccessGrant3(c, deps, workspaceId, "connections:write");
-    const connection = await revokeConnection(
-      db,
-      workspaceId,
-      c.req.param("connectionId"),
-      grant.subjectId
-    );
-    if (!connection) {
+    const existing = await getConnectionMetadata2(db, workspaceId, connectionId, grant.subjectId);
+    if (!existing) {
       throw new HTTPException9(404, { message: "connection not found" });
     }
-    if (isOpenGeniSlackBotConnection(connection)) {
-      const metadata = openGeniSlackBotMetadata2(connection.metadata);
-      await recordAuditEvent2(db, {
-        accountId: grant.accountId,
-        workspaceId,
-        subjectId: grant.subjectId,
-        action: "slack_bot.disconnected",
-        targetType: "connection",
-        targetId: connection.id,
-        metadata: {
-          credentialRole: OPENGENI_SLACK_BOT_CREDENTIAL_ROLE2,
-          credentialLabel: OPENGENI_SLACK_BOT_CREDENTIAL_LABEL2,
-          connectionId: connection.id,
-          slackTeamId: metadata.slackTeamId,
-          outcome: "succeeded"
-        }
-      });
+    const connection = isOpenGeniSlackBotConnection(existing) ? await revokeConnectionWithSlackBotSuccessAudit(db, {
+      accountId: grant.accountId,
+      workspaceId,
+      subjectId: grant.subjectId,
+      connectionId,
+      expectedVersion: existing.version,
+      credentialRole: OPENGENI_SLACK_BOT_CREDENTIAL_ROLE2,
+      credentialLabel: OPENGENI_SLACK_BOT_CREDENTIAL_LABEL2,
+      slackTeamId: openGeniSlackBotMetadata2(existing.metadata).slackTeamId
+    }) : await revokeConnection(db, workspaceId, connectionId, grant.subjectId);
+    if (!connection) {
+      throw new HTTPException9(409, { message: "connection changed during disconnect; try again" });
     }
     return c.json(ConnectionResponse.parse({ connection }));
   });
@@ -8451,6 +8651,222 @@ function registerConnectionRoutes(app, deps) {
     );
   });
 }
+async function persistOpenGeniSlackBotConnection(input) {
+  const { db, settings } = input.deps;
+  const key = requireEnvironmentEncryption2(settings);
+  const credentialEncrypted = encryptCredentialBundle(key, slackBotCredentialBundle(input.token));
+  const existing = input.state.connectionId ? await getConnectionMetadata2(
+    db,
+    input.state.workspaceId,
+    input.state.connectionId,
+    input.state.subjectId
+  ) : null;
+  if (input.state.connectionId && !existing) {
+    throw new SlackInstallCallbackError(
+      404,
+      "connection_conflict",
+      "connection not found",
+      "principal_validation"
+    );
+  }
+  if (existing && !isOpenGeniSlackBotConnection(existing)) {
+    throw new SlackInstallCallbackError(
+      422,
+      "connection_conflict",
+      "connectionId is not an OpenGeni Slack bot connection",
+      "principal_validation"
+    );
+  }
+  if (existing?.version !== input.state.connectionVersion) {
+    throw new SlackInstallCallbackError(
+      409,
+      "connection_conflict",
+      "Slack bot connection changed during reinstall; start again",
+      "principal_validation"
+    );
+  }
+  const existingMetadata = existing ? openGeniSlackBotMetadata2(existing.metadata) : null;
+  if (existingMetadata && existingMetadata.slackTeamId !== input.verified.metadata.slackTeamId) {
+    throw new SlackInstallCallbackError(
+      409,
+      "principal_mismatch",
+      "a Slack bot connection can only be reinstalled for its original Slack workspace",
+      "principal_validation"
+    );
+  }
+  if (existingMetadata && (existingMetadata.botId !== input.verified.metadata.botId || existingMetadata.botUserId !== input.verified.metadata.botUserId)) {
+    throw new SlackInstallCallbackError(
+      409,
+      "principal_mismatch",
+      "a different Slack bot requires a new connection and explicit scheduled-task rebinding",
+      "principal_validation"
+    );
+  }
+  const verifiedInstallAt = new Date(input.verified.metadata.verifiedAt);
+  const lifecycleAudit = {
+    accountId: input.state.accountId,
+    workspaceId: input.state.workspaceId,
+    subjectId: input.state.subjectId,
+    credentialRole: OPENGENI_SLACK_BOT_CREDENTIAL_ROLE2,
+    credentialLabel: OPENGENI_SLACK_BOT_CREDENTIAL_LABEL2,
+    slackTeamId: input.verified.metadata.slackTeamId
+  };
+  const connection = existing ? await updateConnectionWithSlackBotSuccessAudit(db, {
+    ...lifecycleAudit,
+    connection: {
+      workspaceId: input.state.workspaceId,
+      connectionId: existing.id,
+      visibleToSubjectId: input.state.subjectId,
+      expectedVersion: existing.version,
+      subjectId: null,
+      providerDomain: "slack.com",
+      kind: "app_install",
+      status: "active",
+      credentialEncrypted,
+      grantedScopes: input.verified.grantedScopes,
+      expiresAt: null,
+      verifiedInstallAt,
+      verifiedInstallVersion: existing.version + 1,
+      metadata: input.verified.metadata,
+      updatedBySubjectId: input.state.subjectId
+    }
+  }) : await createConnectionWithSlackBotSuccessAudit(db, {
+    ...lifecycleAudit,
+    connection: {
+      accountId: input.state.accountId,
+      workspaceId: input.state.workspaceId,
+      subjectId: null,
+      providerDomain: "slack.com",
+      kind: "app_install",
+      credentialEncrypted,
+      grantedScopes: input.verified.grantedScopes,
+      expiresAt: null,
+      verifiedInstallAt,
+      verifiedInstallVersion: 1,
+      metadata: input.verified.metadata,
+      createdBySubjectId: input.state.subjectId
+    }
+  });
+  if (!connection) {
+    throw new SlackInstallCallbackError(
+      409,
+      "connection_conflict",
+      "Slack bot connection changed during reinstall; start again",
+      "principal_validation"
+    );
+  }
+  return connection;
+}
+function requireOpenGeniSlackOAuthSettings(settings) {
+  const clientId = settings.slackClientId?.trim();
+  const clientSecret = settings.slackClientSecret?.trim();
+  if (!clientId || !clientSecret) {
+    throw new HTTPException9(503, {
+      message: "OpenGeni Slack installation requires OPENGENI_SLACK_CLIENT_ID and OPENGENI_SLACK_CLIENT_SECRET"
+    });
+  }
+  return { clientId, clientSecret };
+}
+function readOpenGeniSlackInstallState(rawState, settings) {
+  if (!rawState) {
+    throw new HTTPException9(400, { message: "missing Slack installation state" });
+  }
+  const payload = readSignedState3(rawState, requireIntegrationsStateSecret(settings));
+  if (!payload) {
+    throw new HTTPException9(400, { message: "invalid or expired Slack installation state" });
+  }
+  const requiredString2 = (value, label) => {
+    if (typeof value !== "string" || value.length === 0) {
+      throw new HTTPException9(400, { message: `invalid Slack installation ${label}` });
+    }
+    return value;
+  };
+  const nowSeconds = Math.floor(Date.now() / 1e3);
+  if (typeof payload.iat !== "number" || nowSeconds < payload.iat || nowSeconds - payload.iat > oauthStateTtlMs / 1e3) {
+    throw new HTTPException9(400, { message: "invalid or expired Slack installation state" });
+  }
+  const accountId = requiredString2(payload.accountId, "account");
+  const workspaceId = requiredString2(payload.workspaceId, "workspace");
+  const subjectId = requiredString2(payload.subjectId, "subject");
+  const returnPath = requiredString2(payload.returnPath, "return path");
+  if (returnPath !== `/workspaces/${workspaceId}/capabilities`) {
+    throw new HTTPException9(400, { message: "invalid Slack installation return path" });
+  }
+  const connectionId = typeof payload.connectionId === "string" ? payload.connectionId : void 0;
+  const connectionVersion = typeof payload.connectionVersion === "number" && Number.isInteger(payload.connectionVersion) ? payload.connectionVersion : void 0;
+  if (Boolean(connectionId) !== Boolean(connectionVersion)) {
+    throw new HTTPException9(400, { message: "invalid Slack reinstall state" });
+  }
+  return {
+    accountId,
+    workspaceId,
+    subjectId,
+    returnPath,
+    ...connectionId ? { connectionId, connectionVersion } : {},
+    nonce: requiredString2(payload.nonce, "nonce"),
+    iat: typeof payload.iat === "number" ? payload.iat : (() => {
+      throw new HTTPException9(400, { message: "invalid Slack installation timestamp" });
+    })()
+  };
+}
+function slackInstallReturnUrl(baseUrl, returnPath, status, detail) {
+  const url = new URL(returnPath, `${baseUrl}/`);
+  url.searchParams.set("slack", status);
+  url.searchParams.set(status === "connected" ? "connectionId" : "reason", detail.slice(0, 128));
+  return url.toString();
+}
+var SlackInstallCallbackError = class extends HTTPException9 {
+  constructor(status, failureReason, message, failureStage) {
+    super(status, { message });
+    this.failureReason = failureReason;
+    this.failureStage = failureStage;
+    this.name = "SlackInstallCallbackError";
+  }
+};
+function slackInstallCallbackFailure(stage, error) {
+  if (error instanceof SlackInstallCallbackError) {
+    return { stage: error.failureStage ?? stage, reason: error.failureReason };
+  }
+  if (error instanceof SlackBotCredentialVerificationError) {
+    return { stage: "credential_verification", reason: error.failureReason };
+  }
+  if (error instanceof SlackBotLifecycleSuccessAuditError) {
+    return { stage: "persistence", reason: "success_audit_failed" };
+  }
+  if (stage === "code_exchange") {
+    return { stage, reason: "exchange_failed" };
+  }
+  if (stage === "credential_verification") {
+    return { stage, reason: "credential_verification_failed" };
+  }
+  return { stage, reason: "persistence_failed" };
+}
+function slackInstallErrorReason(error) {
+  if (error instanceof SlackInstallCallbackError && error.failureReason === "provider_denied") {
+    return "provider_denied";
+  }
+  if (error instanceof HTTPException9) {
+    return `http_${error.status}`;
+  }
+  return "installation_failed";
+}
+async function requireSlackInstallCallbackGrant(db, state) {
+  const grant = await getWorkspaceGrant2(db, state.subjectId, state.workspaceId);
+  if (!grant || grant.accountId !== state.accountId || !hasPermission6(grant.permissions, "connections:write")) {
+    throw new SlackInstallCallbackError(
+      403,
+      "permission_lost",
+      "Slack installation subject no longer has permission for this workspace"
+    );
+  }
+}
+function assertNotDirectPersonalSlackOAuth(providerDomain, kind) {
+  if (providerDomain === "slack.com" && kind === "oauth2") {
+    throw new HTTPException9(422, {
+      message: "personal Slack credentials must use the hosted MCP OAuth flow"
+    });
+  }
+}
 function assertNotReservedSlackBotMetadata(metadata) {
   if (hasReservedOpenGeniSlackBotMetadata(metadata)) {
     throw new HTTPException9(422, {
@@ -11236,7 +11652,7 @@ import {
   authorizeGitHubInstallationBinding,
   buildGitHubAppManifest,
   convertGitHubAppManifest,
-  createSignedState as createSignedState4,
+  createSignedState as createSignedState5,
   envLinesFromGitHubManifestConversion,
   GitHubAppApiError,
   GitHubAppConfigurationError as GitHubAppConfigurationError2,
@@ -11245,13 +11661,13 @@ import {
   githubOAuthAuthorizeUrl,
   organizationAppManifestUrl,
   personalAppManifestUrl,
-  readSignedState as readSignedState3,
+  readSignedState as readSignedState4,
   stateMaxAgeSeconds,
   verifySignedState
 } from "@opengeni/github";
 import { deleteCookie, setCookie } from "hono/cookie";
 import { HTTPException as HTTPException17 } from "hono/http-exception";
-import { hasPermission as hasPermission5, requireAccessGrant as requireAccessGrant10 } from "@opengeni/core";
+import { hasPermission as hasPermission7, requireAccessGrant as requireAccessGrant10 } from "@opengeni/core";
 var githubStateCookie = "opengeni_github_state";
 var githubBindingStateMaxAgeSeconds = 10 * 60;
 var legacyInstallationChooserDisabledMessage = "The legacy repository-admin GitHub installation chooser is disabled; use the GitHub owner-consent connect flow";
@@ -11264,8 +11680,8 @@ function registerGitHubRoutes(app, deps) {
     const slug = settings.githubAppSlug?.trim() || null;
     const installations = missing.length === 0 ? await listWorkspaceGitHubInstallationBindings(deps, grant.workspaceId) : [];
     const status = githubBindingStatus(missing.length === 0, installations);
-    const canManage = hasPermission5(grant.permissions, "github:manage");
-    const connectState = missing.length === 0 && slug && canManage ? createSignedState4(githubStateSecret, {
+    const canManage = hasPermission7(grant.permissions, "github:manage");
+    const connectState = missing.length === 0 && slug && canManage ? createSignedState5(githubStateSecret, {
       accountId: grant.accountId,
       workspaceId: grant.workspaceId,
       intent: "installation_authority",
@@ -11290,7 +11706,7 @@ function registerGitHubRoutes(app, deps) {
     if (!state) {
       throw new HTTPException17(400, { message: "missing GitHub installation state" });
     }
-    const statePayload = readSignedState3(state, githubStateSecret);
+    const statePayload = readSignedState4(state, githubStateSecret);
     if (!statePayload || statePayload.intent !== "installation_authority" || statePayload.workspaceId !== workspaceId || typeof statePayload.accountId !== "string" || !isFreshGitHubBindingState(statePayload)) {
       throw new HTTPException17(400, { message: "invalid or expired GitHub installation state" });
     }
@@ -11365,7 +11781,7 @@ function registerGitHubRoutes(app, deps) {
       /\/+$/,
       ""
     );
-    const state = createSignedState4(githubStateSecret, {
+    const state = createSignedState5(githubStateSecret, {
       accountId: grant.accountId,
       workspaceId: grant.workspaceId
     });
@@ -11409,7 +11825,7 @@ function registerGitHubRoutes(app, deps) {
     if (!state) {
       throw new HTTPException17(400, { message: "missing GitHub installation state" });
     }
-    const statePayload = readSignedState3(state, githubStateSecret);
+    const statePayload = readSignedState4(state, githubStateSecret);
     if (!statePayload || statePayload.intent !== "installation_authority" || typeof statePayload.accountId !== "string" || typeof statePayload.workspaceId !== "string" || !isFreshGitHubBindingState(statePayload)) {
       throw new HTTPException17(400, { message: "invalid or expired GitHub installation state" });
     }
@@ -11440,7 +11856,7 @@ function registerGitHubRoutes(app, deps) {
         })
       });
     }
-    const oauthState = createSignedState4(githubStateSecret, {
+    const oauthState = createSignedState5(githubStateSecret, {
       accountId: grant.accountId,
       workspaceId: grant.workspaceId,
       installationId,
@@ -11467,7 +11883,7 @@ function registerGitHubRoutes(app, deps) {
     if (!state) {
       throw new HTTPException17(400, { message: "missing GitHub OAuth state" });
     }
-    const statePayload = readSignedState3(state, githubStateSecret);
+    const statePayload = readSignedState4(state, githubStateSecret);
     if (!statePayload || statePayload.intent !== "installation_authority_oauth" || typeof statePayload.accountId !== "string" || typeof statePayload.workspaceId !== "string" || !isFreshGitHubBindingState(statePayload)) {
       throw new HTTPException17(400, { message: "invalid or expired GitHub OAuth state" });
     }
@@ -11546,7 +11962,7 @@ function registerGitHubRoutes(app, deps) {
     if (!state) {
       throw new HTTPException17(400, { message: "missing GitHub OAuth state" });
     }
-    const statePayload = readSignedState3(state, githubStateSecret);
+    const statePayload = readSignedState4(state, githubStateSecret);
     if (!statePayload || typeof statePayload.accountId !== "string" || statePayload.accountId.length === 0 || statePayload.workspaceId !== workspaceId) {
       throw new HTTPException17(400, { message: "invalid or expired GitHub OAuth state" });
     }
@@ -15572,7 +15988,7 @@ import {
 } from "@opengeni/db";
 import { boundWorkspaceControlHttpPage } from "@opengeni/events";
 import { HTTPException as HTTPException24 } from "hono/http-exception";
-import { hasPermission as hasPermission6, requireAccessContext as requireAccessContext2, requireAccessGrant as requireAccessGrant16 } from "@opengeni/core";
+import { hasPermission as hasPermission8, requireAccessContext as requireAccessContext2, requireAccessGrant as requireAccessGrant16 } from "@opengeni/core";
 import { requireLimit as requireLimit7 } from "@opengeni/core";
 import {
   assertWorkspaceDeletable,
@@ -15819,7 +16235,7 @@ function registerWorkspaceRoutes(app, deps) {
     const context = await requireAccessContext2(c, deps);
     const readableWorkspaceIds = [
       ...new Set(
-        context.workspaceGrants.filter((grant) => hasPermission6(grant.permissions, "workspace:read")).map((grant) => grant.workspaceId)
+        context.workspaceGrants.filter((grant) => hasPermission8(grant.permissions, "workspace:read")).map((grant) => grant.workspaceId)
       )
     ];
     if (readableWorkspaceIds.length > 0) {
@@ -16683,7 +17099,7 @@ function createApp(deps) {
 }
 async function requireMcpAccessGrant(c, deps, workspaceId) {
   const grant = await requireAccessGrant18(c, deps, workspaceId);
-  if (hasPermission7(grant.permissions, "workspace:read")) {
+  if (hasPermission9(grant.permissions, "workspace:read")) {
     return grant;
   }
   if (isToolspaceGrant(deps.settings, grant)) {
@@ -17121,8 +17537,8 @@ var routeLabelPatterns = [
     label: "/v1/workspaces/:workspaceId/connections/oauth/start"
   },
   {
-    pattern: /^\/v1\/workspaces\/[^/]+\/connections\/slack-bot$/,
-    label: "/v1/workspaces/:workspaceId/connections/slack-bot"
+    pattern: /^\/v1\/workspaces\/[^/]+\/connections\/slack-bot\/install$/,
+    label: "/v1/workspaces/:workspaceId/connections/slack-bot/install"
   },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/connections\/[^/]+$/,
@@ -17137,6 +17553,10 @@ var routeLabelPatterns = [
     pattern: /^\/v1\/integrations\/oauth\/client-metadata\.json$/,
     label: "/v1/integrations/oauth/client-metadata.json"
   },
+  {
+    pattern: /^\/v1\/integrations\/slack\/callback$/,
+    label: "/v1/integrations/slack/callback"
+  },
   {
     pattern: /^\/v1\/enrollments\/device\/start$/,
     label: "/v1/enrollments/device/start"
@@ -17221,4 +17641,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession2 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-3JR6L6NJ.js.map
+//# sourceMappingURL=chunk-3BHOMOSD.js.map