@opengeni/api-router 0.14.3 → 0.15.1

package/dist/{chunk-36PW33ND.js → chunk-UVL2KH56.js}

@@ -26,11 +26,11 @@ import { WebStandardStreamableHTTPServerTransport as WebStandardStreamableHTTPSe
 import { Hono } from "hono";
 import { bodyLimit } from "hono/body-limit";
 import { cors } from "hono/cors";
-import { HTTPException as HTTPException30 } from "hono/http-exception";
+import { HTTPException as HTTPException32 } from "hono/http-exception";
 import {
   CodexCompactionV2ProviderLockedError,
-  hasPermission as hasPermission13,
-  requireAccessGrant as requireAccessGrant22,
+  hasPermission as hasPermission14,
+  requireAccessGrant as requireAccessGrant24,
   requirePermission,
   requireSessionAuthorization as requireSessionAuthorization3,
   SessionAuthorizationDeniedError as SessionAuthorizationDeniedError2,
@@ -291,6 +291,7 @@ function makeResumeBoxById(client) {
 import { requireLimit as requireLimit8 } from "@opengeni/core";
 
 // src/mcp/server.ts
+import { createHash as createHash2 } from "crypto";
 import {
   CreateScheduledTaskRequest,
   DEFAULT_FIRST_PARTY_MCP_TOOLS,
@@ -308,7 +309,9 @@ import {
   sessionEventLatestClassToSemanticClass,
   SessionMcpCredentialUpdateInput,
   VariableSetVariableName,
-  UpdateScheduledTaskRequest
+  UpdateScheduledTaskRequest,
+  normalizeWorkspaceArtifactSlug,
+  WORKSPACE_ARTIFACT_HTML_MAX_UTF8_BYTES
 } from "@opengeni/contracts";
 import {
   correctWorkspaceMemory,
@@ -352,7 +355,13 @@ import {
   updateSessionGoalWithEvent,
   upsertSessionGoalWithEvent,
   RigChangeAlreadyVerifyingError,
-  RigChangeTransitionError
+  RigChangeTransitionError,
+  createWorkspaceArtifact,
+  getWorkspaceArtifact,
+  getWorkspaceArtifactContentRef,
+  listWorkspaceArtifacts,
+  publishWorkspaceArtifactVersion,
+  rollbackWorkspaceArtifact
 } from "@opengeni/db";
 import { appendAndPublishEvents as appendAndPublishEvents2, publishDurableSessionEvents } from "@opengeni/events";
 import {
@@ -2156,7 +2165,7 @@ var MAX_PROJECTED_TEXT = 4e3;
 var SLACK_POST_CLAIM_LEASE_MS = 3e4;
 var SLACK_DELETE_CLAIM_LEASE_MS = 3e4;
 async function exchangeOpenGeniSlackAuthorizationCode(input, fetchImpl = fetch) {
-  const body = new URLSearchParams({
+  const body2 = new URLSearchParams({
     code: input.code,
     client_id: input.clientId,
     client_secret: input.clientSecret,
@@ -2170,28 +2179,34 @@ async function exchangeOpenGeniSlackAuthorizationCode(input, fetchImpl = fetch)
         accept: "application/json",
         "content-type": "application/x-www-form-urlencoded"
       },
-      body: body.toString(),
+      body: body2.toString(),
       redirect: "error",
       signal: AbortSignal.timeout(SLACK_TIMEOUT_MS)
     });
   } catch {
-    throw new HTTPException2(502, { message: "Slack installation token exchange failed" });
+    throw new HTTPException2(502, {
+      message: "Slack installation token exchange failed"
+    });
   }
   if (!response.ok) {
-    throw new HTTPException2(502, { message: "Slack installation token exchange failed" });
+    throw new HTTPException2(502, {
+      message: "Slack installation token exchange failed"
+    });
   }
   const payload = await readResponseJsonBounded(
     response,
     SLACK_RESPONSE_MAX_BYTES,
     "Slack OAuth response"
   );
-  const record3 = slackRecord(payload);
-  if (!record3 || record3.ok !== true) {
-    throw new SlackBotProviderError(slackString(record3?.error) || "oauth_exchange_failed");
+  const record4 = slackRecord(payload);
+  if (!record4 || record4.ok !== true) {
+    throw new SlackBotProviderError(slackString(record4?.error) || "oauth_exchange_failed");
   }
-  const accessToken = slackString(record3.access_token);
+  const accessToken = slackString(record4.access_token);
   if (!accessToken?.startsWith("xoxb-")) {
-    throw new HTTPException2(502, { message: "Slack installation did not return a bot token" });
+    throw new HTTPException2(502, {
+      message: "Slack installation did not return a bot token"
+    });
   }
   return accessToken;
 }
@@ -2344,6 +2359,10 @@ var OpenGeniSlackBotClient = class {
       };
     });
   }
+  async verifyChannelAccess(channelId) {
+    const headers = await this.headersFor("channel_history.read");
+    return await this.requireMemberChannel(headers, channelId);
+  }
   async channelHistory(input) {
     return await this.withAudit("channel_history.read", async (headers) => {
       const info = await this.requireMemberChannel(headers, input.channelId);
@@ -2453,7 +2472,9 @@ var OpenGeniSlackBotClient = class {
       const headers = await this.headersFor(operation);
       let channelId = input.channelId;
       if (input.userId) {
-        const opened = await this.call(headers, "conversations.open", { users: input.userId });
+        const opened = await this.call(headers, "conversations.open", {
+          users: input.userId
+        });
         channelId = requiredSlackString(slackRecord(opened.channel)?.id, "channel.id");
       } else if (channelId) {
         await this.requireMemberChannel(headers, channelId);
@@ -2671,7 +2692,10 @@ var OpenGeniSlackBotClient = class {
       `${SLACK_API_BASE}chat.getPermalink`
     );
     try {
-      await this.call(headers, "chat.getPermalink", { channel: channelId, message_ts: timestamp });
+      await this.call(headers, "chat.getPermalink", {
+        channel: channelId,
+        message_ts: timestamp
+      });
       return true;
     } catch (error) {
       if (error instanceof SlackBotProviderError && error.code === "message_not_found") {
@@ -2681,7 +2705,9 @@ var OpenGeniSlackBotClient = class {
     }
   }
   async requireMemberChannel(headers, channelId) {
-    const payload = await this.call(headers, "conversations.info", { channel: channelId });
+    const payload = await this.call(headers, "conversations.info", {
+      channel: channelId
+    });
     const projected = projectChannel(payload.channel);
     if (!projected || projected.isMember !== true) {
       throw new SlackBotProviderError("not_in_channel");
@@ -2909,19 +2935,31 @@ var OpenGeniSlackBotClient = class {
       return { type: "subject", id: this.context.subjectId };
     }
     if (this.context.scheduledTaskId) {
-      return { type: "service", id: `scheduler:${this.context.scheduledTaskId}` };
+      return {
+        type: "service",
+        id: `scheduler:${this.context.scheduledTaskId}`
+      };
     }
-    return { type: "service", id: `session:${this.context.sessionId ?? "workspace"}` };
+    return {
+      type: "service",
+      id: `session:${this.context.sessionId ?? "workspace"}`
+    };
   }
   fileListPage(input) {
     const key = environmentsEncryptionKeyBytes(this.settings);
     if (!key) throw new Error("connection encryption is not configured");
-    return resolveSlackFilesListPage(input, { connectionId: this.connection.id, key });
+    return resolveSlackFilesListPage(input, {
+      connectionId: this.connection.id,
+      key
+    });
   }
   fileListCursor(input) {
     const key = environmentsEncryptionKeyBytes(this.settings);
     if (!key) throw new Error("connection encryption is not configured");
-    return createSlackFilesListCursor(input, { connectionId: this.connection.id, key });
+    return createSlackFilesListCursor(input, {
+      connectionId: this.connection.id,
+      key
+    });
   }
   async recordAudit(operation, outcome, failureCode, operationId) {
     await recordAuditEvent(this.db, {
@@ -2954,6 +2992,32 @@ function createOpenGeniSlackBotClient(deps, resolved) {
     deps.slackFetch
   );
 }
+async function createOpenGeniSlackBotInteractionClient(deps, input) {
+  const connection = await requireOpenGeniSlackBotConnection(
+    deps.db,
+    input.workspaceId,
+    input.connectionId
+  );
+  if (connection.accountId !== input.accountId) {
+    throw new Error("OpenGeni Slack bot connection tenant mismatch");
+  }
+  const metadata = openGeniSlackBotMetadata(connection.metadata);
+  if (!metadata) throw new Error("OpenGeni Slack bot connection metadata is invalid");
+  return new OpenGeniSlackBotClient(
+    deps.db,
+    deps.settings,
+    connection,
+    metadata,
+    {
+      accountId: input.accountId,
+      workspaceId: input.workspaceId,
+      subjectId: input.subjectId,
+      sessionId: input.sessionId ?? null,
+      scheduledTaskId: null
+    },
+    deps.slackFetch
+  );
+}
 async function slackApiFetch(fetchImpl, method, token, params) {
   return await slackApiFetchWithHeaders(
     fetchImpl,
@@ -2967,7 +3031,7 @@ async function slackApiFetchWithHeaders(fetchImpl, method, credentialHeaders, pa
     throw new Error("invalid Slack API method");
   }
   const url = new URL(method, SLACK_API_BASE);
-  const body = new URLSearchParams(params);
+  const body2 = new URLSearchParams(params);
   let response;
   try {
     response = await fetchImpl(url, {
@@ -2977,7 +3041,7 @@ async function slackApiFetchWithHeaders(fetchImpl, method, credentialHeaders, pa
         accept: "application/json",
         "content-type": "application/x-www-form-urlencoded"
       },
-      body,
+      body: body2,
       signal: AbortSignal.timeout(SLACK_TIMEOUT_MS)
     });
   } catch {
@@ -3121,9 +3185,9 @@ function isSupportedSlackTextContentType(value) {
   return value.startsWith("text/") || value === "application/json" || value === "application/xml" || value === "application/xhtml+xml" || value === "application/vnd.slack-docs" || value === "application/vnd.slack-huddle-transcript";
 }
 function embeddedHuddleTranscription(fileRecord, parentFileRecord) {
-  for (const record3 of [fileRecord, parentFileRecord]) {
-    if (!record3) continue;
-    const transcription = slackRecord(record3.huddle_transcription);
+  for (const record4 of [fileRecord, parentFileRecord]) {
+    if (!record4) continue;
+    const transcription = slackRecord(record4.huddle_transcription);
     if (!transcription) continue;
     const content = JSON.stringify(transcription);
     if (content !== "{}") {
@@ -3336,7 +3400,12 @@ var FIRST_PARTY_TOOL_AUTHORIZATION = {
   slack_bot_file_info: { allOf: ["connections:read"] },
   slack_bot_file_content: { allOf: ["connections:read"] },
   slack_bot_post_message: { allOf: ["connections:read"] },
-  slack_bot_delete_message: { allOf: ["connections:read"] }
+  slack_bot_delete_message: { allOf: ["connections:read"] },
+  artifacts_list: { sessionRequired: true, allOf: ["artifacts:read"] },
+  artifacts_get_source: { sessionRequired: true, allOf: ["artifacts:read"] },
+  artifacts_create: { sessionRequired: true, allOf: ["artifacts:publish"] },
+  artifacts_publish: { sessionRequired: true, allOf: ["artifacts:publish"] },
+  artifacts_rollback: { sessionRequired: true, allOf: ["artifacts:publish"] }
 };
 var FIRST_PARTY_MCP_TOOL_NAME_SET = new Set(FIRST_PARTY_MCP_TOOL_NAMES);
 var PolicyMcpServer = class extends McpServer {
@@ -3431,6 +3500,9 @@ function buildOpenGeniMcpServer(deps, grant, options = {}) {
   if (!toolspaceMode && sessionId !== null && preferenceAttemptClaims(grant) !== null) {
     registerPreferenceRegistryTools(server, deps, grant, json);
   }
+  if (!toolspaceMode && sessionId !== null && preferenceAttemptClaims(grant) !== null) {
+    registerWorkspaceArtifactTools(server, deps, grant, sessionId, json);
+  }
   if (!toolspaceMode && sessionId !== null && deps.settings.sandboxSelfhostedEnabled) {
     registerFleetTools(server, deps, grant, sessionId, json);
   }
@@ -4171,6 +4243,172 @@ async function authorizeFirstPartySession(deps, grant, sessionId, operation) {
     surface: "first_party_mcp"
   });
 }
+function registerWorkspaceArtifactTools(server, deps, grant, sessionId, json) {
+  const attempt = () => {
+    const claims = preferenceAttemptClaims(grant);
+    if (!claims) throw new Error("Exact signed artifact attempt authority is required.");
+    return claims;
+  };
+  const authorize = async () => {
+    await authorizeFirstPartySession(deps, grant, sessionId, "session.first_party_mcp.call");
+  };
+  const prepare = (html) => {
+    if (!deps.objectStorage) throw new Error("Object storage is not configured");
+    const bytes = new TextEncoder().encode(html);
+    if (bytes.byteLength < 1 || bytes.byteLength > WORKSPACE_ARTIFACT_HTML_MAX_UTF8_BYTES) {
+      throw new Error(
+        `Artifact HTML must be 1-${WORKSPACE_ARTIFACT_HTML_MAX_UTF8_BYTES} UTF-8 bytes`
+      );
+    }
+    const contentSha256 = createHash2("sha256").update(bytes).digest("hex");
+    const contentKey = `workspaces/${grant.workspaceId}/workspace-artifacts/blobs/${contentSha256}.html`;
+    return {
+      contentKey,
+      contentSha256,
+      sizeBytes: bytes.byteLength,
+      persistContent: async () => {
+        await deps.objectStorage.putObject({
+          key: contentKey,
+          contentType: "text/html; charset=utf-8",
+          body: bytes,
+          sha256: contentSha256
+        });
+      }
+    };
+  };
+  const provenance2 = (idempotencyKey, sourceToolName) => {
+    const claims = attempt();
+    return {
+      accountId: grant.accountId,
+      workspaceId: grant.workspaceId,
+      operationKey: `attempt:${createHash2("sha256").update(
+        `${claims.sessionId}:${claims.turnId}:${claims.attemptId}:${claims.executionGeneration}:${idempotencyKey}`
+      ).digest("hex")}`,
+      actorSubjectId: grant.subjectId,
+      sourceSessionId: claims.sessionId,
+      sourceTurnId: claims.turnId,
+      sourceAttemptId: claims.attemptId,
+      sourceExecutionGeneration: claims.executionGeneration,
+      sourceToolName
+    };
+  };
+  server.registerTool(
+    "artifacts_list",
+    {
+      description: "List the generic published artifacts in this workspace and their current versions.",
+      inputSchema: {}
+    },
+    async () => {
+      await authorize();
+      return json(await listWorkspaceArtifacts(deps.db, grant.workspaceId));
+    }
+  );
+  server.registerTool(
+    "artifacts_get_source",
+    {
+      description: "Read an artifact's metadata and exact HTML source. Omit versionId for the current version.",
+      inputSchema: {
+        artifactId: z4.string().uuid(),
+        versionId: z4.string().uuid().optional()
+      }
+    },
+    async ({ artifactId: artifactId2, versionId }) => {
+      await authorize();
+      if (!deps.objectStorage) throw new Error("Object storage is not configured");
+      const [detail, ref] = await Promise.all([
+        getWorkspaceArtifact(deps.db, grant.workspaceId, artifactId2),
+        getWorkspaceArtifactContentRef(deps.db, grant.workspaceId, artifactId2, versionId)
+      ]);
+      const object5 = await deps.objectStorage.getObjectBytes(ref.contentKey);
+      if (!object5) throw new Error("Artifact content is unavailable");
+      const actualHash = createHash2("sha256").update(object5.bytes).digest("hex");
+      if (actualHash !== ref.version.contentSha256)
+        throw new Error("Artifact content failed integrity verification");
+      return json({ detail, version: ref.version, html: new TextDecoder().decode(object5.bytes) });
+    }
+  );
+  server.registerTool(
+    "artifacts_create",
+    {
+      description: "Create and publish a generic static workspace artifact from a complete, self-contained HTML document with inline CSS. JavaScript and active or navigation-capable markup do not render in the MVP.",
+      inputSchema: {
+        title: z4.string().min(1).max(120),
+        description: z4.string().max(2e3).nullable().optional(),
+        slug: z4.string().regex(/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/).max(96).optional(),
+        html: z4.string().min(1).max(WORKSPACE_ARTIFACT_HTML_MAX_UTF8_BYTES),
+        idempotencyKey: z4.string().min(1).max(200)
+      }
+    },
+    async ({ title, description, slug, html, idempotencyKey }) => {
+      await authorize();
+      const artifactId2 = crypto.randomUUID();
+      const slugBase = slug ?? (normalizeWorkspaceArtifactSlug(title) || "artifact");
+      const resolvedSlug = slug ?? `${slugBase.slice(0, 87)}-${artifactId2.slice(0, 8)}`;
+      return json(
+        await createWorkspaceArtifact(deps.db, {
+          artifactId: artifactId2,
+          slug: resolvedSlug,
+          title,
+          description: description ?? null,
+          ...prepare(html),
+          ...provenance2(idempotencyKey, "artifacts_create")
+        })
+      );
+    }
+  );
+  server.registerTool(
+    "artifacts_publish",
+    {
+      description: "Publish a new immutable static HTML/CSS version. JavaScript and active or navigation-capable markup do not render in the MVP. First read the current source and pass its version id for optimistic concurrency.",
+      inputSchema: {
+        artifactId: z4.string().uuid(),
+        expectedCurrentVersionId: z4.string().uuid(),
+        title: z4.string().min(1).max(120).optional(),
+        description: z4.string().max(2e3).nullable().optional(),
+        html: z4.string().min(1).max(WORKSPACE_ARTIFACT_HTML_MAX_UTF8_BYTES),
+        idempotencyKey: z4.string().min(1).max(200)
+      }
+    },
+    async ({ artifactId: artifactId2, expectedCurrentVersionId, title, description, html, idempotencyKey }) => {
+      await authorize();
+      return json(
+        await publishWorkspaceArtifactVersion(deps.db, {
+          artifactId: artifactId2,
+          expectedCurrentVersionId,
+          ...title !== void 0 ? { title } : {},
+          ...description !== void 0 ? { description } : {},
+          ...prepare(html),
+          ...provenance2(idempotencyKey, "artifacts_publish")
+        })
+      );
+    }
+  );
+  server.registerTool(
+    "artifacts_rollback",
+    {
+      description: "Promote an existing immutable artifact version back to current without rewriting history.",
+      inputSchema: {
+        artifactId: z4.string().uuid(),
+        versionId: z4.string().uuid(),
+        expectedCurrentVersionId: z4.string().uuid(),
+        reason: z4.string().min(1).max(4096),
+        idempotencyKey: z4.string().min(1).max(200)
+      }
+    },
+    async ({ artifactId: artifactId2, versionId, expectedCurrentVersionId, reason, idempotencyKey }) => {
+      await authorize();
+      return json(
+        await rollbackWorkspaceArtifact(deps.db, {
+          artifactId: artifactId2,
+          versionId,
+          expectedCurrentVersionId,
+          reason,
+          ...provenance2(idempotencyKey, "artifacts_rollback")
+        })
+      );
+    }
+  );
+}
 function preferenceAttemptClaims(grant) {
   const metadata = grant.metadata ?? {};
   if (typeof metadata["sessionId"] !== "string" || typeof metadata["turnId"] !== "string" || typeof metadata["attemptId"] !== "string" || typeof metadata["executionGeneration"] !== "number" || !Number.isSafeInteger(metadata["executionGeneration"]) || metadata["executionGeneration"] < 1 || metadata["executionGeneration"] > 2147483647) {
@@ -5651,7 +5889,7 @@ import {
   mcpSerializedSizeBytes
 } from "@opengeni/runtime/mcp-network";
 import { Buffer as Buffer2 } from "buffer";
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 var APPROVAL_REQUIRED_MESSAGE = "requires approval - invoke via the agent";
 var TOOLSPACE_AUTH_NEEDED_ERROR = {
   // OpenGeni application-defined JSON-RPC code. Keep this positive so it cannot
@@ -6169,7 +6407,7 @@ function toolspaceAuditSummary(value) {
   return {
     redacted: true,
     sizeBytes: Buffer2.byteLength(serialized),
-    sha256: createHash2("sha256").update(serialized).digest("hex")
+    sha256: createHash3("sha256").update(serialized).digest("hex")
   };
 }
 function toolspaceErrorAttributes(error) {
@@ -6390,12 +6628,12 @@ async function authNeededFetchResponse(input, request, auth) {
   return new Response("Authentication required for MCP server connection", { status: 401 });
 }
 async function mcpRequestInfo(input, init) {
-  const body = typeof init?.body === "string" ? init.body : input instanceof Request && (init?.method ?? input.method).toUpperCase() === "POST" ? await input.clone().text().catch(() => "") : "";
-  if (!body) {
+  const body2 = typeof init?.body === "string" ? init.body : input instanceof Request && (init?.method ?? input.method).toUpperCase() === "POST" ? await input.clone().text().catch(() => "") : "";
+  if (!body2) {
     return {};
   }
   try {
-    const parsed = JSON.parse(body);
+    const parsed = JSON.parse(body2);
     const method = typeof parsed.method === "string" ? parsed.method : void 0;
     const id = typeof parsed.id === "string" || typeof parsed.id === "number" || parsed.id === null ? parsed.id : void 0;
     const toolName = method === "tools/call" && typeof parsed.params?.name === "string" ? parsed.params.name : void 0;
@@ -6451,9 +6689,9 @@ async function loadAsset(file) {
   if (cached !== void 0) {
     return cached;
   }
-  const body = await readFile(new URL(file, INSTALL_DIR), "utf8");
-  assetCache.set(file, body);
-  return body;
+  const body2 = await readFile(new URL(file, INSTALL_DIR), "utf8");
+  assetCache.set(file, body2);
+  return body2;
 }
 var DEFAULT_BASE_REWRITES = {
   "install.sh": (base) => ({
@@ -6465,16 +6703,16 @@ var DEFAULT_BASE_REWRITES = {
     to: `$OpengeniInstallDefaultBaseUrl = '${base}'`
   })
 };
-function rewriteDefaultBaseUrl(file, body, publicBaseUrl) {
+function rewriteDefaultBaseUrl(file, body2, publicBaseUrl) {
   if (!publicBaseUrl || !/^https?:\/\//.test(publicBaseUrl)) {
-    return body;
+    return body2;
   }
   const base = publicBaseUrl.replace(/\/+$/, "");
   const rule = DEFAULT_BASE_REWRITES[file]?.(base);
-  if (!rule || !body.includes(rule.from)) {
-    return body;
+  if (!rule || !body2.includes(rule.from)) {
+    return body2;
   }
-  return body.replace(rule.from, rule.to);
+  return body2.replace(rule.from, rule.to);
 }
 function bakedContentType(asset) {
   if (asset.endsWith(".sha256") || asset.endsWith(".minisig")) {
@@ -6502,8 +6740,8 @@ function registerInstallRoutes(app, deps) {
   const stableAgentTag = `agent-v${deps.settings.agentStableVersion}`;
   for (const [path, { file, contentType }] of Object.entries(TEXT_ASSETS)) {
     app.get(path, async (c) => {
-      const body = rewriteDefaultBaseUrl(file, await loadAsset(file), deps.settings.publicBaseUrl);
-      return c.text(body, 200, {
+      const body2 = rewriteDefaultBaseUrl(file, await loadAsset(file), deps.settings.publicBaseUrl);
+      return c.text(body2, 200, {
         "content-type": contentType,
         // Short cache: the edge serves the latest committed copy; new installs
         // should pick up script fixes promptly, but a brief cache absorbs bursts.
@@ -6582,7 +6820,7 @@ function isAuthExempt(c, settings) {
   if (path === "/v1/github/setup" || path === "/v1/github/install/callback" || path === "/v1/github/oauth/callback" || path === "/v1/github/app-manifest/callback") {
     return true;
   }
-  if (path === "/v1/integrations/oauth/callback" || path === "/v1/integrations/oauth/client-metadata.json" || path === "/v1/integrations/slack/callback") {
+  if (path === "/v1/integrations/oauth/callback" || path === "/v1/integrations/oauth/client-metadata.json" || path === "/v1/integrations/slack/callback" || path === "/v1/integrations/slack/events" || path === "/v1/integrations/slack/commands" || path === "/v1/integrations/slack/interactions") {
     return true;
   }
   if (path.startsWith("/v1/catalog-assets/")) {
@@ -7450,12 +7688,12 @@ function registerCodexRoutes(app, deps) {
   app.patch("/v1/workspaces/:workspaceId/codex/settings", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant2(c, deps, workspaceId, "workspace:admin");
-    const body = await c.req.json().catch(() => ({}));
+    const body2 = await c.req.json().catch(() => ({}));
     const patch = {};
-    if (typeof body.rotationEnabled === "boolean") {
-      patch.rotationEnabled = body.rotationEnabled;
+    if (typeof body2.rotationEnabled === "boolean") {
+      patch.rotationEnabled = body2.rotationEnabled;
     }
-    if (patch.rotationEnabled === void 0 && body.rotationStrategy === void 0) {
+    if (patch.rotationEnabled === void 0 && body2.rotationStrategy === void 0) {
       throw new HTTPException6(400, { message: "no settings to update" });
     }
     if (patch.rotationEnabled === void 0) {
@@ -7488,8 +7726,8 @@ function registerCodexRoutes(app, deps) {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant2(c, deps, workspaceId, "workspace:admin");
     const accountId = c.req.param("accountId");
-    const body = await c.req.json();
-    const label = typeof body.label === "string" ? body.label : null;
+    const body2 = await c.req.json();
+    const label = typeof body2.label === "string" ? body2.label : null;
     const renamed = await renameCodexAccount(db, workspaceId, accountId, label);
     if (!renamed) {
       throw new HTTPException6(404, { message: "codex account not found" });
@@ -8000,7 +8238,7 @@ function registerCodexRoutes(app, deps) {
 }
 
 // src/routes/connections.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 import {
   ConnectionResponse,
   CreateConnectionRequest,
@@ -8044,7 +8282,7 @@ import {
 import { HTTPException as HTTPException10 } from "hono/http-exception";
 
 // src/integrations/google-drive.ts
-import { createHash as createHash4, randomBytes as randomBytes2 } from "crypto";
+import { createHash as createHash5, randomBytes as randomBytes2 } from "crypto";
 import {
   GOOGLE_DRIVE_CREDENTIAL_LABEL,
   GOOGLE_DRIVE_CREDENTIAL_ROLE,
@@ -8105,7 +8343,7 @@ import {
   validateHttpUrl
 } from "@opengeni/network";
 import { Buffer as Buffer3 } from "buffer";
-import { createHash as createHash3, randomBytes } from "crypto";
+import { createHash as createHash4, randomBytes } from "crypto";
 import { HTTPException as HTTPException8 } from "hono/http-exception";
 
 // src/integrations/provider-domain.ts
@@ -8861,28 +9099,28 @@ async function clientForState(db, settings, state) {
   };
 }
 async function exchangeAuthorizationCode(settings, input) {
-  const body = new URLSearchParams();
-  body.set("grant_type", "authorization_code");
-  body.set("code", input.code);
-  body.set("redirect_uri", input.redirectUri);
-  body.set("code_verifier", input.verifier);
-  body.set("resource", input.resource);
+  const body2 = new URLSearchParams();
+  body2.set("grant_type", "authorization_code");
+  body2.set("code", input.code);
+  body2.set("redirect_uri", input.redirectUri);
+  body2.set("code_verifier", input.verifier);
+  body2.set("resource", input.resource);
   const headers = {
     "content-type": "application/x-www-form-urlencoded",
     accept: "application/json"
   };
   if (input.client.clientSecret && input.client.tokenEndpointAuthMethod === "client_secret_post") {
-    body.set("client_id", input.client.clientId);
-    body.set("client_secret", input.client.clientSecret);
+    body2.set("client_id", input.client.clientId);
+    body2.set("client_secret", input.client.clientSecret);
   } else if (input.client.clientSecret && input.client.tokenEndpointAuthMethod === "client_secret_basic") {
     headers.authorization = `Basic ${Buffer3.from(`${input.client.clientId}:${input.client.clientSecret}`).toString("base64")}`;
   } else {
-    body.set("client_id", input.client.clientId);
+    body2.set("client_id", input.client.clientId);
   }
   const response = await fetchOAuth(input.tokenEndpoint, settings, {
     method: "POST",
     headers,
-    body
+    body: body2
   });
   if (!response.ok) {
     const oauthError = await oauthErrorFromResponse(response);
@@ -9256,7 +9494,7 @@ function expiresAtFromTokenResponse(payload) {
   return null;
 }
 function pkceChallenge(verifier) {
-  return createHash3("sha256").update(verifier).digest("base64url");
+  return createHash4("sha256").update(verifier).digest("base64url");
 }
 function randomPkceVerifier() {
   return randomBytes(32).toString("base64url");
@@ -9328,7 +9566,7 @@ async function startGoogleDriveOAuth(deps, input) {
   authorizationUrl.searchParams.set("code_challenge_method", "S256");
   authorizationUrl.searchParams.set(
     "code_challenge",
-    createHash4("sha256").update(verifier).digest("base64url")
+    createHash5("sha256").update(verifier).digest("base64url")
   );
   return GoogleDriveOAuthStartResponse.parse({
     authorizationUrl: authorizationUrl.toString(),
@@ -9515,8 +9753,8 @@ async function browseGoogleDrive(deps, input) {
     url,
     label: "Google Drive file list"
   });
-  const record3 = objectRecord(payload);
-  const items = Array.isArray(record3.files) ? record3.files.map(parseDriveItem).filter((item) => item !== null) : [];
+  const record4 = objectRecord(payload);
+  const items = Array.isArray(record4.files) ? record4.files.map(parseDriveItem).filter((item) => item !== null) : [];
   const current = await getConnectionMetadata2(
     deps.db,
     input.workspaceId,
@@ -9528,8 +9766,8 @@ async function browseGoogleDrive(deps, input) {
     parentId,
     current: currentItem,
     items,
-    nextPageToken: optionalString(record3.nextPageToken),
-    incompleteSearch: record3.incompleteSearch === true
+    nextPageToken: optionalString(record4.nextPageToken),
+    incompleteSearch: record4.incompleteSearch === true
   });
 }
 async function saveGoogleDriveSource(deps, input) {
@@ -9724,7 +9962,7 @@ async function requireGoogleDriveCallbackGrant(deps, state) {
   }
 }
 async function exchangeGoogleAuthorizationCode(input, fetchImpl) {
-  const body = new URLSearchParams({
+  const body2 = new URLSearchParams({
     code: input.code,
     code_verifier: input.verifier,
     client_id: input.clientId,
@@ -9738,7 +9976,7 @@ async function exchangeGoogleAuthorizationCode(input, fetchImpl) {
       accept: "application/json",
       "content-type": "application/x-www-form-urlencoded"
     },
-    body
+    body: body2
   });
   if (!response.ok) {
     await response.body?.cancel().catch(() => void 0);
@@ -10087,7 +10325,7 @@ function registerConnectionRoutes(app, deps) {
             accountId: state.accountId,
             workspaceId: state.workspaceId,
             subjectId: state.subjectId,
-            callbackDigest: createHash5("sha256").update(state.nonce).digest("hex"),
+            callbackDigest: createHash6("sha256").update(state.nonce).digest("hex"),
             installMode: state.connectionId ? "reinstall" : "connect",
             ...failure
           });
@@ -11121,27 +11359,27 @@ function registerFileRoutes(app, deps) {
   app.get("/v1/workspaces/:workspaceId/artifacts/:artifactId", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant4(c, deps, workspaceId, "files:read");
-    const artifactId = retainedArtifactId(c.req.param("artifactId"));
-    const artifact = await getRetainedFileArtifact(db, workspaceId, artifactId);
+    const artifactId2 = retainedArtifactId(c.req.param("artifactId"));
+    const artifact = await getRetainedFileArtifact(db, workspaceId, artifactId2);
     if (!artifact) {
-      return c.json(retainedArtifactUnavailable(artifactId, "deleted"), 404);
+      return c.json(retainedArtifactUnavailable(artifactId2, "deleted"), 404);
     }
     return c.json(retainedArtifactMetadata(artifact));
   });
   app.get("/v1/workspaces/:workspaceId/artifacts/:artifactId/content", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     await requireAccessGrant4(c, deps, workspaceId, "files:read");
-    const artifactId = retainedArtifactId(c.req.param("artifactId"));
-    const artifact = await getRetainedFileArtifact(db, workspaceId, artifactId);
+    const artifactId2 = retainedArtifactId(c.req.param("artifactId"));
+    const artifact = await getRetainedFileArtifact(db, workspaceId, artifactId2);
     if (!artifact) {
-      return c.json(retainedArtifactUnavailable(artifactId, "deleted"), 404);
+      return c.json(retainedArtifactUnavailable(artifactId2, "deleted"), 404);
     }
     const metadata = retainedArtifactMetadata(artifact);
     if (!metadata.available) {
       return c.json(metadata, retainedArtifactUnavailableStatus(metadata.reason));
     }
     if (!objectStorage) {
-      return c.json(retainedArtifactUnavailable(artifactId, "missing_storage"), 503);
+      return c.json(retainedArtifactUnavailable(artifactId2, "missing_storage"), 503);
     }
     const rangeHeader = c.req.header("range");
     const range = resolveRetainedOutputRange(
@@ -11180,7 +11418,7 @@ function registerFileRoutes(app, deps) {
     };
     if (range.kind === "empty") {
       if (!await objectStorage.fileExists(artifact.file)) {
-        return c.json(retainedArtifactUnavailable(artifactId, "missing_storage"), 410);
+        return c.json(retainedArtifactUnavailable(artifactId2, "missing_storage"), 410);
       }
       return c.body(null, 200, headers);
     }
@@ -11189,7 +11427,7 @@ function registerFileRoutes(app, deps) {
       end: range.end
     });
     if (!bytes) {
-      return c.json(retainedArtifactUnavailable(artifactId, "missing_storage"), 410);
+      return c.json(retainedArtifactUnavailable(artifactId2, "missing_storage"), 410);
     }
     if (bytes.byteLength !== range.length) {
       throw new HTTPException11(502, { message: "object storage returned an invalid byte range" });
@@ -11233,8 +11471,8 @@ function retainedArtifactId(value) {
   }
   return parsed.data;
 }
-function retainedArtifactUnavailable(artifactId, reason) {
-  return RetainedArtifactMetadataSchema.parse({ available: false, artifactId, reason });
+function retainedArtifactUnavailable(artifactId2, reason) {
+  return RetainedArtifactMetadataSchema.parse({ available: false, artifactId: artifactId2, reason });
 }
 function retainedArtifactMetadata(artifact) {
   const reference = retainedArtifactReferenceFromFile(artifact.file);
@@ -11920,18 +12158,18 @@ async function lookupDeviceEnrollment(services, input) {
   const { db } = services;
   return await getPendingDeviceEnrollmentRequestByUserCodeGlobal(db, input.userCode);
 }
-function toLookupResponse(record3) {
+function toLookupResponse(record4) {
   return {
-    workspaceId: record3.workspaceId,
-    userCode: record3.userCode,
+    workspaceId: record4.workspaceId,
+    userCode: record4.userCode,
     machine: {
-      machineName: record3.machineName,
-      os: record3.os,
-      arch: record3.arch,
-      canOfferDisplay: record3.canOfferDisplay,
-      requestsScreenControl: record3.requestsScreenControl
+      machineName: record4.machineName,
+      os: record4.os,
+      arch: record4.arch,
+      canOfferDisplay: record4.canOfferDisplay,
+      requestsScreenControl: record4.requestsScreenControl
     },
-    expiresAt: record3.expiresAt
+    expiresAt: record4.expiresAt
   };
 }
 async function denyDeviceEnrollment(services, input) {
@@ -12114,8 +12352,8 @@ function registerEnrollmentRoutes(app, deps) {
     if (!parsed.success) {
       throw new HTTPException13(400, { message: "invalid device-start request" });
     }
-    const body = parsed.data;
-    const workspace = await getWorkspace(db, body.workspaceId);
+    const body2 = parsed.data;
+    const workspace = await getWorkspace(db, body2.workspaceId);
     if (!workspace) {
       throw new HTTPException13(404, { message: "workspace not found" });
     }
@@ -12124,12 +12362,12 @@ function registerEnrollmentRoutes(app, deps) {
       {
         accountId: workspace.accountId,
         workspaceId: workspace.id,
-        publicKey: body.publicKey,
-        os: body.os,
-        arch: body.arch,
-        machineName: body.machineName ?? null,
-        canOfferDisplay: body.canOfferDisplay,
-        requestsScreenControl: body.requestsScreenControl,
+        publicKey: body2.publicKey,
+        os: body2.os,
+        arch: body2.arch,
+        machineName: body2.machineName ?? null,
+        canOfferDisplay: body2.canOfferDisplay,
+        requestsScreenControl: body2.requestsScreenControl,
         // The approve page is served at the SAME origin as this request.
         verificationOrigin: new URL(c.req.url).origin
       }
@@ -12156,19 +12394,19 @@ function registerEnrollmentRoutes(app, deps) {
     if (!parsed.success) {
       throw new HTTPException13(400, { message: "invalid device-lookup request" });
     }
-    const record3 = await lookupDeviceEnrollment(
+    const record4 = await lookupDeviceEnrollment(
       { db, settings },
       { userCode: parsed.data.userCode }
     );
-    if (!record3) {
+    if (!record4) {
       throw new HTTPException13(404, { message: "no pending enrollment for that code" });
     }
     try {
-      await requireAccessGrant6(c, deps, record3.workspaceId, "enrollments:read");
+      await requireAccessGrant6(c, deps, record4.workspaceId, "enrollments:read");
     } catch {
       throw new HTTPException13(404, { message: "no pending enrollment for that code" });
     }
-    return c.json(DeviceEnrollmentLookupResponse.parse(toLookupResponse(record3)), 200);
+    return c.json(DeviceEnrollmentLookupResponse.parse(toLookupResponse(record4)), 200);
   });
   app.post("/v1/enrollments/token/exchange", async (c) => {
     assertSelfhostedEnabled();
@@ -12177,16 +12415,16 @@ function registerEnrollmentRoutes(app, deps) {
     if (!parsed.success) {
       throw new HTTPException13(400, { message: "invalid enroll-token-exchange request" });
     }
-    const body = parsed.data;
+    const body2 = parsed.data;
     const result = await exchangeEnrollToken(
       { db, settings },
       {
-        token: body.token,
-        publicKey: body.publicKey,
-        os: body.os,
-        arch: body.arch,
-        machineName: body.machineName ?? null,
-        canOfferDisplay: body.canOfferDisplay
+        token: body2.token,
+        publicKey: body2.publicKey,
+        os: body2.os,
+        arch: body2.arch,
+        machineName: body2.machineName ?? null,
+        canOfferDisplay: body2.canOfferDisplay
       }
     );
     if (!result.ok) {
@@ -12205,14 +12443,14 @@ function registerEnrollmentRoutes(app, deps) {
     if (!parsed.success) {
       throw new HTTPException13(400, { message: "invalid device-approve request" });
     }
-    const body = parsed.data;
+    const body2 = parsed.data;
     const approved = await approveDeviceEnrollment(
       { db, settings },
       {
         accountId: grant.accountId,
         workspaceId,
-        userCode: body.userCode,
-        allowScreenControl: body.allowScreenControl,
+        userCode: body2.userCode,
+        allowScreenControl: body2.allowScreenControl,
         // The LOUD consent record: WHO consented (the authenticated subject + label).
         approvedBySubjectId: grant.subjectId,
         approvedBySubjectLabel: grant.subjectLabel ?? null
@@ -12579,7 +12817,7 @@ function registerMachineRoutes(app, deps) {
     const grant = await requireAccessGrant7(c, deps, workspaceId, "sessions:control");
     assertSelfhostedEnabled();
     const sessionId = c.req.param("sessionId");
-    const body = SwapActiveSandboxRequest.parse(await c.req.json());
+    const body2 = SwapActiveSandboxRequest.parse(await c.req.json());
     const ctx = await buildFleetContextForSession2(deps, {
       accountId: grant.accountId,
       workspaceId,
@@ -12603,7 +12841,7 @@ function registerMachineRoutes(app, deps) {
         }
       },
       ctx,
-      body.target
+      body2.target
     );
     return c.json(SwapActiveSandboxResponse.parse(result));
   });
@@ -12858,8 +13096,8 @@ function registerApiKeyRoutes(app, deps) {
     async (c) => {
       const workspaceId = c.req.param("workspaceId");
       const grant = await requireAccessGrant9(c, deps, workspaceId, "api_keys:manage");
-      const body = c.req.valid("json");
-      const permissions = body.permissions.length > 0 ? body.permissions : ["workspace:read"];
+      const body2 = c.req.valid("json");
+      const permissions = body2.permissions.length > 0 ? body2.permissions : ["workspace:read"];
       ensureDelegablePermissions(grant.permissions, permissions);
       await requireLimit4(deps, {
         accountId: grant.accountId,
@@ -12872,11 +13110,11 @@ function registerApiKeyRoutes(app, deps) {
       const apiKey = await createApiKey(deps.db, {
         accountId: grant.accountId,
         workspaceId: grant.workspaceId,
-        name: body.name,
+        name: body2.name,
         prefix,
         keyHash: await sha256Hex(token),
         permissions,
-        expiresAt: body.expiresAt ? new Date(body.expiresAt) : null
+        expiresAt: body2.expiresAt ? new Date(body2.expiresAt) : null
       });
       return c.json(CreateApiKeyResponse.parse({ apiKey, token }), 201);
     }
@@ -12977,9 +13215,9 @@ function registerBillingRoutes(app, deps) {
         message: parsed.error.issues[0]?.message ?? "invalid checkout request"
       });
     }
-    const body = parsed.data;
-    const accountId = requireSelectedAccount(context, body.accountId, "billing:manage");
-    const amountCents = usdToCents(body.amountUsd);
+    const body2 = parsed.data;
+    const accountId = requireSelectedAccount(context, body2.accountId, "billing:manage");
+    const amountCents = usdToCents(body2.amountUsd);
     const amountMicros = centsToMicros(amountCents);
     const stripe = stripeClient(deps);
     const customerId = await getOrCreateStripeCustomer(deps, stripe, context, accountId);
@@ -12992,8 +13230,8 @@ function registerBillingRoutes(app, deps) {
         amountMicros,
         creditsProductId: deps.settings.stripeCreditsProductId,
         publicBaseUrl: deps.settings.publicBaseUrl,
-        successUrl: body.successUrl,
-        cancelUrl: body.cancelUrl,
+        successUrl: body2.successUrl,
+        cancelUrl: body2.cancelUrl,
         idempotencyKey
       }),
       { idempotencyKey }
@@ -14605,8 +14843,8 @@ function registerScheduledTaskRoutes(app, deps) {
       quantity: 1,
       model: task.agentConfig.model ?? deps.settings.openaiModel
     });
-    const body = await c.req.json().catch(() => ({}));
-    const { triggerId } = TriggerScheduledTaskRequest.parse(body ?? {});
+    const body2 = await c.req.json().catch(() => ({}));
+    const { triggerId } = TriggerScheduledTaskRequest.parse(body2 ?? {});
     const triggerToken = scheduledTaskTriggerToken2(triggerId);
     const agentRunUsageIdempotencyKey = manualScheduledTaskTriggerUsageKey2(
       workspaceId,
@@ -15103,7 +15341,7 @@ function createByteBoundedSseStream(options = {}) {
   if (!Number.isSafeInteger(stallTimeoutMs) || stallTimeoutMs <= 0) {
     throw new RangeError("SSE write stall timeout must be a positive safe integer");
   }
-  const encoder2 = new TextEncoder();
+  const encoder3 = new TextEncoder();
   let controller;
   let stopped = false;
   let capacityWake = null;
@@ -15149,7 +15387,7 @@ function createByteBoundedSseStream(options = {}) {
   return {
     stream,
     write: async (frame) => {
-      const chunk = encoder2.encode(frame);
+      const chunk = encoder3.encode(frame);
       if (chunk.byteLength > maxQueuedBytes) {
         const error = new RangeError(
           `SSE frame cannot fit in the configured queue (${chunk.byteLength} > ${maxQueuedBytes} bytes)`
@@ -15862,10 +16100,6 @@ function registerSessionRoutes(app, deps) {
     )
   });
   const authorizeSessionHttp = async (c, next) => {
-    if (!deps.sessionAuthorization) {
-      await next();
-      return;
-    }
     const workspaceId = c.req.param("workspaceId") ?? "";
     const sessionId = c.req.param("sessionId") ?? "";
     const operation = sessionAuthorizationOperationForHttp(
@@ -15880,6 +16114,10 @@ function registerSessionRoutes(app, deps) {
     if (!operation) {
       throw sessionAuthorizationHttpError(new SessionAuthorizationUnavailableError());
     }
+    if (operation === "session.codex_account.write" && !deps.sessionAuthorization) {
+      await next();
+      return;
+    }
     const grant = await requireAccessGrant14(c, deps, workspaceId);
     try {
       const authorization = await requireSessionAuthorization2(deps, grant, {
@@ -16112,15 +16350,26 @@ function registerSessionRoutes(app, deps) {
   });
   app.post("/v1/workspaces/:workspaceId/sessions/:sessionId/codex-account", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant14(c, deps, workspaceId, "sessions:control");
+    const grant = await requireAccessGrant14(c, deps, workspaceId, "sessions:control");
     const sessionId = c.req.param("sessionId");
-    const body = await c.req.json();
-    const target = typeof body.target === "string" ? body.target : "";
+    const body2 = await c.req.json();
+    const target = typeof body2.target === "string" ? body2.target : "";
     if (!target) {
       throw new HTTPException23(400, {
         message: 'target is required ("auto" or an account id)'
       });
     }
+    if (!deps.sessionAuthorization) {
+      try {
+        await requireSessionAuthorization2(deps, grant, {
+          sessionId,
+          operation: "session.codex_account.write",
+          surface: "http"
+        });
+      } catch (error) {
+        throw sessionAuthorizationHttpError(error);
+      }
+    }
     const pinned = target === "auto" ? null : target;
     const mutation = await withCodexCapacityMutation2(
       db,
@@ -19044,6 +19293,265 @@ function registerWorkspaceStateRoutes(app, deps) {
   });
 }
 
+// src/routes/workspace-artifacts.ts
+import { createHash as createHash7 } from "crypto";
+import {
+  CreateWorkspaceArtifactRequest,
+  PublishWorkspaceArtifactVersionRequest,
+  RollbackWorkspaceArtifactRequest,
+  WorkspaceArtifactContentResponse,
+  WorkspaceArtifactDetailResponse,
+  WorkspaceArtifactListQuery,
+  WorkspaceArtifactListResponse,
+  WorkspaceArtifactMutationResponse,
+  normalizeWorkspaceArtifactSlug as normalizeWorkspaceArtifactSlug2
+} from "@opengeni/contracts";
+import { requireAccessGrant as requireAccessGrant19 } from "@opengeni/core";
+import {
+  createWorkspaceArtifact as createWorkspaceArtifact2,
+  getWorkspaceArtifact as getWorkspaceArtifact2,
+  getWorkspaceArtifactContentRef as getWorkspaceArtifactContentRef2,
+  listWorkspaceArtifacts as listWorkspaceArtifacts2,
+  publishWorkspaceArtifactVersion as publishWorkspaceArtifactVersion2,
+  rollbackWorkspaceArtifact as rollbackWorkspaceArtifact2,
+  WorkspaceArtifactConflictError,
+  WorkspaceArtifactNotFoundError,
+  WorkspaceArtifactOperationError
+} from "@opengeni/db";
+import { HTTPException as HTTPException28 } from "hono/http-exception";
+import { z as z8 } from "zod";
+var ArtifactId = z8.string().uuid();
+var encoder2 = new TextEncoder();
+var decoder = new TextDecoder("utf-8", { fatal: true });
+async function body(context, schema) {
+  const parsed = schema.safeParse(await context.req.json().catch(() => null));
+  if (!parsed.success) throw new HTTPException28(422, { message: "Invalid artifact request" });
+  return parsed.data;
+}
+function artifactId(context) {
+  const parsed = ArtifactId.safeParse(context.req.param("artifactId"));
+  if (!parsed.success) throw new HTTPException28(422, { message: "Invalid artifact id" });
+  return parsed.data;
+}
+function errorResponse(context, error) {
+  if (error instanceof WorkspaceArtifactNotFoundError) {
+    return context.json({ code: "WORKSPACE_ARTIFACT_NOT_FOUND", message: error.message }, 404);
+  }
+  if (error instanceof WorkspaceArtifactConflictError) {
+    return context.json(
+      {
+        code: "WORKSPACE_ARTIFACT_CONFLICT",
+        message: error.message,
+        currentVersionId: error.currentVersionId
+      },
+      409
+    );
+  }
+  if (error instanceof WorkspaceArtifactOperationError) {
+    return context.json(
+      { code: "INVALID_WORKSPACE_ARTIFACT_OPERATION", message: error.message },
+      422
+    );
+  }
+  if (typeof error === "object" && error !== null && "code" in error && error.code === "23505") {
+    return context.json(
+      { code: "WORKSPACE_ARTIFACT_CONFLICT", message: "Artifact slug or operation already exists" },
+      409
+    );
+  }
+  throw error;
+}
+function contentMetadata(workspaceId, html) {
+  const bytes = encoder2.encode(html);
+  const sha256 = createHash7("sha256").update(bytes).digest("hex");
+  return {
+    bytes,
+    contentSha256: sha256,
+    sizeBytes: bytes.byteLength,
+    contentKey: `workspaces/${workspaceId}/workspace-artifacts/blobs/${sha256}.html`
+  };
+}
+function prepareHtml(deps, workspaceId, html) {
+  if (!deps.objectStorage)
+    throw new HTTPException28(503, { message: "Object storage is not configured" });
+  const content = contentMetadata(workspaceId, html);
+  return {
+    ...content,
+    persistContent: async () => {
+      await deps.objectStorage.putObject({
+        key: content.contentKey,
+        contentType: "text/html; charset=utf-8",
+        body: content.bytes,
+        sha256: content.contentSha256
+      });
+    }
+  };
+}
+function provenance(subjectId, idempotencyKey) {
+  return {
+    operationKey: `subject:${createHash7("sha256").update(`${subjectId}:${idempotencyKey}`).digest("hex")}`,
+    actorSubjectId: subjectId,
+    sourceSessionId: null,
+    sourceTurnId: null,
+    sourceAttemptId: null,
+    sourceExecutionGeneration: null,
+    sourceToolName: null
+  };
+}
+function registerWorkspaceArtifactRoutes(app, deps) {
+  const base = "/v1/workspaces/:workspaceId/published-artifacts";
+  app.get(base, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    await requireAccessGrant19(context, deps, workspaceId, "artifacts:read");
+    const query = WorkspaceArtifactListQuery.safeParse({
+      limit: context.req.query("limit"),
+      cursor: context.req.query("cursor")
+    });
+    if (!query.success) throw new HTTPException28(422, { message: "Invalid artifact list query" });
+    try {
+      return context.json(
+        WorkspaceArtifactListResponse.parse(
+          await listWorkspaceArtifacts2(deps.db, workspaceId, {
+            limit: query.data.limit,
+            ...query.data.cursor ? { cursor: query.data.cursor } : {}
+          })
+        )
+      );
+    } catch (error) {
+      return errorResponse(context, error);
+    }
+  });
+  app.post(base, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    const grant = await requireAccessGrant19(context, deps, workspaceId, "artifacts:publish");
+    const request = await body(context, CreateWorkspaceArtifactRequest);
+    const id = crypto.randomUUID();
+    const slugBase = request.slug ?? (normalizeWorkspaceArtifactSlug2(request.title) || "artifact");
+    const slug = request.slug ?? `${slugBase.slice(0, 87)}-${id.slice(0, 8)}`;
+    const content = prepareHtml(deps, workspaceId, request.html);
+    try {
+      return context.json(
+        WorkspaceArtifactMutationResponse.parse(
+          await createWorkspaceArtifact2(deps.db, {
+            accountId: grant.accountId,
+            workspaceId,
+            artifactId: id,
+            slug,
+            title: request.title,
+            description: request.description ?? null,
+            ...content,
+            ...provenance(grant.subjectId, request.idempotencyKey)
+          })
+        ),
+        201
+      );
+    } catch (error) {
+      return errorResponse(context, error);
+    }
+  });
+  app.get(`${base}/:artifactId`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    await requireAccessGrant19(context, deps, workspaceId, "artifacts:read");
+    try {
+      return context.json(
+        WorkspaceArtifactDetailResponse.parse(
+          await getWorkspaceArtifact2(deps.db, workspaceId, artifactId(context))
+        )
+      );
+    } catch (error) {
+      return errorResponse(context, error);
+    }
+  });
+  app.get(`${base}/:artifactId/content`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    await requireAccessGrant19(context, deps, workspaceId, "artifacts:read");
+    if (!deps.objectStorage)
+      throw new HTTPException28(503, { message: "Object storage is not configured" });
+    const parsedVersion = context.req.query("versionId");
+    if (parsedVersion && !ArtifactId.safeParse(parsedVersion).success) {
+      throw new HTTPException28(422, { message: "Invalid artifact version id" });
+    }
+    try {
+      const ref = await getWorkspaceArtifactContentRef2(
+        deps.db,
+        workspaceId,
+        artifactId(context),
+        parsedVersion
+      );
+      const object5 = await deps.objectStorage.getObjectBytes(ref.contentKey);
+      if (!object5) throw new HTTPException28(503, { message: "Artifact content is unavailable" });
+      const actualHash = createHash7("sha256").update(object5.bytes).digest("hex");
+      if (actualHash !== ref.version.contentSha256) {
+        throw new HTTPException28(503, { message: "Artifact content failed integrity verification" });
+      }
+      let html;
+      try {
+        html = decoder.decode(object5.bytes);
+      } catch {
+        throw new HTTPException28(503, { message: "Artifact content is not valid UTF-8" });
+      }
+      return context.json(
+        WorkspaceArtifactContentResponse.parse({
+          artifactId: ref.artifactId,
+          versionId: ref.version.id,
+          contentType: "text/html",
+          contentSha256: ref.version.contentSha256,
+          html
+        })
+      );
+    } catch (error) {
+      return errorResponse(context, error);
+    }
+  });
+  app.post(`${base}/:artifactId/versions`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    const grant = await requireAccessGrant19(context, deps, workspaceId, "artifacts:publish");
+    const request = await body(context, PublishWorkspaceArtifactVersionRequest);
+    const id = artifactId(context);
+    const content = prepareHtml(deps, workspaceId, request.html);
+    try {
+      return context.json(
+        WorkspaceArtifactMutationResponse.parse(
+          await publishWorkspaceArtifactVersion2(deps.db, {
+            accountId: grant.accountId,
+            workspaceId,
+            artifactId: id,
+            expectedCurrentVersionId: request.expectedCurrentVersionId,
+            ...request.title !== void 0 ? { title: request.title } : {},
+            ...request.description !== void 0 ? { description: request.description } : {},
+            ...content,
+            ...provenance(grant.subjectId, request.idempotencyKey)
+          })
+        )
+      );
+    } catch (error) {
+      return errorResponse(context, error);
+    }
+  });
+  app.post(`${base}/:artifactId/rollback`, async (context) => {
+    const workspaceId = context.req.param("workspaceId");
+    const grant = await requireAccessGrant19(context, deps, workspaceId, "artifacts:publish");
+    const request = await body(context, RollbackWorkspaceArtifactRequest);
+    try {
+      return context.json(
+        WorkspaceArtifactMutationResponse.parse(
+          await rollbackWorkspaceArtifact2(deps.db, {
+            accountId: grant.accountId,
+            workspaceId,
+            artifactId: artifactId(context),
+            versionId: request.versionId,
+            expectedCurrentVersionId: request.expectedCurrentVersionId,
+            reason: request.reason,
+            ...provenance(grant.subjectId, request.idempotencyKey)
+          })
+        )
+      );
+    } catch (error) {
+      return errorResponse(context, error);
+    }
+  });
+}
+
 // src/routes/preference-registry.ts
 import {
   ActivatePreferenceRegistryRevisionRequest,
@@ -19065,7 +19573,7 @@ import {
 } from "@opengeni/contracts";
 import {
   hasPermission as hasPermission12,
-  requireAccessGrant as requireAccessGrant19,
+  requireAccessGrant as requireAccessGrant20,
   requireAccessGrantAuthorization
 } from "@opengeni/core";
 import {
@@ -19088,13 +19596,13 @@ import {
   rejectPreferenceRegistryProposal,
   supersedePreferenceRegistry
 } from "@opengeni/db";
-import { HTTPException as HTTPException28 } from "hono/http-exception";
-import { z as z8 } from "zod";
-var Id = z8.string().uuid();
+import { HTTPException as HTTPException29 } from "hono/http-exception";
+import { z as z9 } from "zod";
+var Id = z9.string().uuid();
 async function parseBody2(context, schema) {
   const parsed = schema.safeParse(await context.req.json().catch(() => null));
   if (!parsed.success)
-    throw new HTTPException28(422, { message: "Invalid preference registry request" });
+    throw new HTTPException29(422, { message: "Invalid preference registry request" });
   return parsed.data;
 }
 function exactAttemptClaims(grant) {
@@ -19108,14 +19616,14 @@ function exactAttemptClaims(grant) {
   const present = Object.values(values).filter((value) => value !== void 0).length;
   if (present === 0) return null;
   if (typeof values.sessionId !== "string" || typeof values.turnId !== "string" || typeof values.attemptId !== "string" || typeof values.executionGeneration !== "number" || !Number.isSafeInteger(values.executionGeneration) || values.executionGeneration < 1 || values.executionGeneration > 2147483647) {
-    throw new HTTPException28(403, { message: "Incomplete signed preference attempt authority" });
+    throw new HTTPException29(403, { message: "Incomplete signed preference attempt authority" });
   }
   return values;
 }
 function requiredAttemptClaims(grant) {
   const claims = exactAttemptClaims(grant);
   if (!claims) {
-    throw new HTTPException28(403, {
+    throw new HTTPException29(403, {
       message: "Preference snapshot retrieval requires a signed session, turn, and attempt"
     });
   }
@@ -19128,7 +19636,7 @@ function requiredAttemptClaims(grant) {
 function requireHumanMutation(access) {
   const { grant } = access;
   if (!access.contextIntegrity || access.authenticatedSubjectId !== grant.subjectId || grant.principalKind !== "human_session" || exactAttemptClaims(grant) !== null || grant.serviceInitiator || grant.serviceInitiatorContext || grant.subjectId.startsWith("api_key:")) {
-    throw new HTTPException28(403, {
+    throw new HTTPException29(403, {
       message: "Preference activation and scope mutation require a direct human-authorized request"
     });
   }
@@ -19138,12 +19646,12 @@ function authorizePreferenceRegistryScopeMutation(access, scope) {
   requireHumanMutation(access);
   if (scope === "organization") {
     if (!access.accountGrant?.permissions.includes("account:admin")) {
-      throw new HTTPException28(403, { message: "missing permission: account:admin" });
+      throw new HTTPException29(403, { message: "missing permission: account:admin" });
     }
     return;
   }
   if (scope === "workspace" && !hasPermission12(grant.permissions, "workspace:admin")) {
-    throw new HTTPException28(403, { message: "missing permission: workspace:admin" });
+    throw new HTTPException29(403, { message: "missing permission: workspace:admin" });
   }
 }
 function preferenceError(context, error) {
@@ -19180,21 +19688,21 @@ function preferenceError(context, error) {
 }
 function preferenceId(context) {
   const parsed = Id.safeParse(context.req.param("preferenceId"));
-  if (!parsed.success) throw new HTTPException28(422, { message: "Invalid preference id" });
+  if (!parsed.success) throw new HTTPException29(422, { message: "Invalid preference id" });
   return parsed.data;
 }
 function registerPreferenceRegistryRoutes(app, deps) {
   const base = "/v1/workspaces/:workspaceId/preferences";
   app.get(base, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const grant = await requireAccessGrant19(context, deps, workspaceId, "workspace:read");
+    const grant = await requireAccessGrant20(context, deps, workspaceId, "workspace:read");
     const query = PreferenceRegistryListQuery.safeParse({
       scope: context.req.query("scope"),
       status: context.req.query("status"),
       limit: context.req.query("limit")
     });
     if (!query.success)
-      throw new HTTPException28(422, { message: "Invalid preference registry query" });
+      throw new HTTPException29(422, { message: "Invalid preference registry query" });
     try {
       const claims = exactAttemptClaims(grant);
       const result = claims ? await listPreferenceRegistryForAttempt(deps.db, {
@@ -19242,7 +19750,7 @@ function registerPreferenceRegistryRoutes(app, deps) {
   });
   app.get(`${base}/summary`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const grant = await requireAccessGrant19(context, deps, workspaceId, "workspace:read");
+    const grant = await requireAccessGrant20(context, deps, workspaceId, "workspace:read");
     try {
       return context.json(
         PreferenceRegistrySnapshot.parse(
@@ -19255,7 +19763,7 @@ function registerPreferenceRegistryRoutes(app, deps) {
   });
   app.post(`${base}/full-content`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const grant = await requireAccessGrant19(context, deps, workspaceId, "workspace:read");
+    const grant = await requireAccessGrant20(context, deps, workspaceId, "workspace:read");
     const request = await parseBody2(context, PreferenceRegistryFullContentRequest);
     try {
       return context.json(
@@ -19273,7 +19781,7 @@ function registerPreferenceRegistryRoutes(app, deps) {
   });
   app.get(`${base}/:preferenceId`, async (context) => {
     const workspaceId = context.req.param("workspaceId");
-    const grant = await requireAccessGrant19(context, deps, workspaceId, "workspace:read");
+    const grant = await requireAccessGrant20(context, deps, workspaceId, "workspace:read");
     try {
       const claims = exactAttemptClaims(grant);
       const id = preferenceId(context);
@@ -19470,16 +19978,16 @@ function registerPreferenceRegistryRoutes(app, deps) {
 
 // src/routes/insights.ts
 import { InsightsRange, WorkspaceInsightsResponse } from "@opengeni/contracts";
-import { getWorkspaceInsights, requireAccessGrant as requireAccessGrant20 } from "@opengeni/core";
-import { HTTPException as HTTPException29 } from "hono/http-exception";
+import { getWorkspaceInsights, requireAccessGrant as requireAccessGrant21 } from "@opengeni/core";
+import { HTTPException as HTTPException30 } from "hono/http-exception";
 function registerInsightsRoutes(app, deps) {
   app.get("/v1/workspaces/:workspaceId/insights", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    await requireAccessGrant20(c, deps, workspaceId, "workspace:admin");
+    await requireAccessGrant21(c, deps, workspaceId, "workspace:admin");
     const rangeRaw = c.req.query("range") ?? "week";
     const rangeParsed = InsightsRange.safeParse(rangeRaw);
     if (!rangeParsed.success) {
-      throw new HTTPException29(400, {
+      throw new HTTPException30(400, {
         message: "range must be one of today|week|month|ytd"
       });
     }
@@ -19500,12 +20008,12 @@ function registerInsightsRoutes(app, deps) {
 import {
   resolveWorkspaceVoiceInputEnabled
 } from "@opengeni/contracts";
-import { requireAccessGrant as requireAccessGrant21, TranscriptionServiceError } from "@opengeni/core";
+import { requireAccessGrant as requireAccessGrant22, TranscriptionServiceError } from "@opengeni/core";
 import { getWorkspace as getWorkspace3 } from "@opengeni/db";
 function registerTranscriptionRoutes(app, deps) {
   app.post("/v1/workspaces/:workspaceId/transcriptions", async (c) => {
     const workspaceId = c.req.param("workspaceId");
-    const grant = await requireAccessGrant21(c, deps, workspaceId, "sessions:create");
+    const grant = await requireAccessGrant22(c, deps, workspaceId, "sessions:create");
     const workspace = await getWorkspace3(deps.db, workspaceId);
     if (!workspace) return c.json({ code: "not_found" }, 404);
     if (resolveWorkspaceVoiceInputEnabled(workspace.settings) === false) {
@@ -19516,13 +20024,13 @@ function registerTranscriptionRoutes(app, deps) {
       return c.json({ code: "unavailable" }, 503);
     }
     try {
-      const body = await audioRequest(c.req.raw, service.limits().maxSizeBytes);
+      const body2 = await audioRequest(c.req.raw, service.limits().maxSizeBytes);
       const result = await service.transcribe({
         workspaceId,
         accountId: grant.accountId,
-        audio: body.audio,
-        mimeType: body.mimeType,
-        durationSeconds: body.durationSeconds,
+        audio: body2.audio,
+        mimeType: body2.mimeType,
+        durationSeconds: body2.durationSeconds,
         signal: c.req.raw.signal,
         requestId: c.req.header("x-opengeni-correlation-id") ?? crypto.randomUUID()
       });
@@ -19585,13 +20093,13 @@ async function audioRequest(request, maxSizeBytes) {
     ...durationSeconds === void 0 ? {} : { durationSeconds }
   };
 }
-async function readBounded(body, maxSizeBytes, signal) {
-  if (!body)
+async function readBounded(body2, maxSizeBytes, signal) {
+  if (!body2)
     throw new TranscriptionServiceError({
       code: "invalid_audio",
       message: "Audio is required."
     });
-  const reader = body.getReader();
+  const reader = body2.getReader();
   const chunks = [];
   let size = 0;
   try {
@@ -19671,16 +20179,16 @@ function createOpenAiTranscriptionProvider(input) {
         throw fetchError(error);
       }
       if (!response.ok) throw responseError(response.status);
-      const body = await response.json().catch(() => null);
-      if (!body || typeof body.text !== "string") {
+      const body2 = await response.json().catch(() => null);
+      if (!body2 || typeof body2.text !== "string") {
         throw new TranscriptionServiceError2({
           code: "provider",
           message: "Invalid transcription response."
         });
       }
       return {
-        text: body.text,
-        languages: typeof body.language === "string" && body.language ? [body.language] : []
+        text: body2.text,
+        languages: typeof body2.language === "string" && body2.language ? [body2.language] : []
       };
     }
   };
@@ -19757,13 +20265,13 @@ function createAzureOpenAiTranscriptionProvider(input) {
         throw fetchError(error);
       }
       if (!response.ok) throw responseError(response.status);
-      const body = await response.json().catch(() => null);
-      if (!body || typeof body.text !== "string") {
+      const body2 = await response.json().catch(() => null);
+      if (!body2 || typeof body2.text !== "string") {
         throw responseError(502);
       }
       return {
-        text: body.text,
-        languages: typeof body.language === "string" && body.language ? [body.language] : []
+        text: body2.text,
+        languages: typeof body2.language === "string" && body2.language ? [body2.language] : []
       };
     }
   };
@@ -19843,11 +20351,11 @@ function createCodexSubscriptionTranscriptionProvider(input) {
         throw fetchError(error);
       }
       if (!response.ok) throw responseError(response.status);
-      const body = await response.json().catch(() => null);
-      if (!body || typeof body.text !== "string") throw responseError(502);
+      const body2 = await response.json().catch(() => null);
+      if (!body2 || typeof body2.text !== "string") throw responseError(502);
       return {
-        text: body.text,
-        languages: typeof body.language === "string" && body.language ? [body.language] : []
+        text: body2.text,
+        languages: typeof body2.language === "string" && body2.language ? [body2.language] : []
       };
     }
   };
@@ -19945,6 +20453,738 @@ async function firstAvailable(providers, context) {
   return null;
 }
 
+// src/integrations/slack-interactions.ts
+import { createHash as createHash8, createHmac as createHmac2, timingSafeEqual as timingSafeEqual2 } from "crypto";
+import {
+  acceptSessionHumanInputResponse as acceptSessionHumanInputResponse2,
+  advanceSlackInteractionDelivery,
+  bindSlackInteractionSession,
+  claimSlackInteractionDelivery,
+  claimSlackInteractionProgressDelivery,
+  claimSlackInteractionInbox,
+  closeSlackInteractionDelivery,
+  deleteSlackBotUserLink,
+  enqueueSlackInteractionInbox,
+  getOrCreateSlackInteraction,
+  getSlackBotUserLink,
+  getSlackInteractionByRoute,
+  getWorkspaceGrant as getWorkspaceGrant4,
+  listSessionEventPage as listSessionEventPage3,
+  listSessionHumanInputRequests as listSessionHumanInputRequests2,
+  rekeySlackInteractionRoute,
+  reopenSlackInteractionDelivery,
+  releaseSlackInteractionDelivery,
+  releaseSlackInteractionInbox,
+  resolveSlackInstallationRoute,
+  saveSlackBotUserLink,
+  settleSlackInteractionInbox
+} from "@opengeni/db";
+import {
+  acceptSessionUserMessage as acceptSessionUserMessage3,
+  controlHumanSessionWorkstream as controlHumanSessionWorkstream3,
+  createSessionForRequest as createSessionForRequest3,
+  hasPermission as hasPermission13,
+  requireAccessGrant as requireAccessGrant23
+} from "@opengeni/core";
+import { publishDurableSessionEvents as publishDurableSessionEvents3 } from "@opengeni/events";
+import { HTTPException as HTTPException31 } from "hono/http-exception";
+var SLACK_INTERACTION_MAX_BODY_BYTES = 256 * 1024;
+var SLACK_SIGNATURE_REPLAY_WINDOW_SECONDS = 300;
+var SLACK_DELIVERY_EVENT_TYPES = [
+  "agent.message.completed",
+  "session.humanInput.requested",
+  "turn.completed",
+  "turn.failed",
+  "turn.cancelled",
+  "session.status.changed"
+];
+var MAX_SLACK_TEXT_CHARS = 3500;
+var MAX_SLACK_INPUT_CHARS = 8e3;
+var MAX_PROGRESS_MESSAGES = 3;
+var INBOX_LEASE_MS = 3e4;
+var DELIVERY_LEASE_MS = 3e4;
+var SLACK_TASK_INSTRUCTIONS = [
+  "This turn originated from Slack. Slack message and thread context is task-local only.",
+  "Do not write Slack context to Documents, Knowledge, Memory, preferences, Workspace Charter, instructions, or policy unless a separate explicit authorized user action requests it.",
+  "Never expose private reasoning, credentials, secrets, raw logs, or unbounded output.",
+  "Keep user-visible output concise, bounded, and safe to send back to Slack."
+].join(" ");
+function verifySlackRequestSignature(input, signingSecret, nowMs = Date.now()) {
+  if (!/^\d{1,16}$/.test(input.timestamp ?? "") || !/^v0=[0-9a-f]{64}$/.test(input.signature ?? "")) {
+    return false;
+  }
+  const timestamp = Number(input.timestamp);
+  if (!Number.isSafeInteger(timestamp)) return false;
+  const nowSeconds = Math.floor(nowMs / 1e3);
+  if (Math.abs(nowSeconds - timestamp) > SLACK_SIGNATURE_REPLAY_WINDOW_SECONDS) return false;
+  const expected = `v0=${createHmac2("sha256", signingSecret).update(`v0:${input.timestamp}:${input.rawBody}`).digest("hex")}`;
+  const actualBytes = Buffer.from(input.signature, "utf8");
+  const expectedBytes = Buffer.from(expected, "utf8");
+  return actualBytes.length === expectedBytes.length && timingSafeEqual2(actualBytes, expectedBytes);
+}
+function slackEventInboxEntry(payload, bot) {
+  const envelope = record3(payload);
+  if (!envelope || envelope.type !== "event_callback") return null;
+  const event = record3(envelope.event);
+  const teamId = boundedString(envelope.team_id, 64);
+  const eventId = boundedString(envelope.event_id, 256);
+  if (!event || !teamId || !eventId) return null;
+  if (event.bot_id || event.bot_profile || event.subtype || event.user === bot.botUserId)
+    return null;
+  const userId = boundedString(event.user, 64);
+  const channelId = boundedString(event.channel, 64);
+  const timestamp = boundedString(event.ts, 64);
+  const threadTimestamp = boundedString(event.thread_ts, 64);
+  const text = boundedText(event.text);
+  if (!userId || !channelId || !timestamp || !text) return null;
+  let triggerKind;
+  if (event.type === "app_mention") {
+    triggerKind = "app_mention";
+  } else if (event.type === "message" && threadTimestamp) {
+    triggerKind = "thread_reply";
+  } else if (event.type === "message" && event.channel_type === "im") {
+    triggerKind = "dm";
+  } else {
+    return null;
+  }
+  return {
+    providerEventId: eventId,
+    providerMessageId: `${teamId}:${channelId}:${timestamp}`,
+    slackTeamId: teamId,
+    slackUserId: userId,
+    slackChannelId: channelId,
+    slackMessageTs: timestamp,
+    slackThreadTs: threadTimestamp,
+    triggerKind,
+    text
+  };
+}
+function registerSlackInteractionRoutes(app, deps) {
+  app.post("/v1/integrations/slack/events", async (c) => {
+    const signed = await readSignedSlackRequest(c, deps);
+    const payload = parseJsonObject(signed.rawBody);
+    if (payload.type === "url_verification") {
+      const challenge = boundedString(payload.challenge, 512);
+      if (!challenge) throw new HTTPException31(400, { message: "invalid Slack challenge" });
+      return c.json({ challenge });
+    }
+    const teamId = boundedString(payload.team_id, 64);
+    if (!teamId) throw new HTTPException31(400, { message: "invalid Slack event" });
+    const installation = await resolveSlackInstallationRoute(deps.db, teamId);
+    if (!installation)
+      throw new HTTPException31(403, {
+        message: "Slack installation unavailable"
+      });
+    const entry = slackEventInboxEntry(payload, installation);
+    if (entry) await enqueueNormalizedSlackInteraction(deps, installation, entry);
+    return c.json({ ok: true });
+  });
+  app.post("/v1/integrations/slack/commands", async (c) => {
+    const signed = await readSignedSlackRequest(c, deps);
+    const form = new URLSearchParams(signed.rawBody);
+    if (form.get("command") !== "/opengeni") {
+      throw new HTTPException31(400, { message: "invalid Slack command" });
+    }
+    const entry = normalizedFormInteraction(form, "slash_command");
+    const installation = await resolveSlackInstallationRoute(deps.db, entry.slackTeamId);
+    if (!installation)
+      throw new HTTPException31(403, {
+        message: "Slack installation unavailable"
+      });
+    await enqueueNormalizedSlackInteraction(deps, installation, entry);
+    return c.text("OpenGeni accepted this task and will reply in a thread.", 200);
+  });
+  app.post("/v1/integrations/slack/interactions", async (c) => {
+    const signed = await readSignedSlackRequest(c, deps);
+    const form = new URLSearchParams(signed.rawBody);
+    const payload = parseJsonObject(form.get("payload") ?? "");
+    if (payload.type !== "message_action") {
+      throw new HTTPException31(400, {
+        message: "unsupported Slack interaction"
+      });
+    }
+    const team = record3(payload.team);
+    const user = record3(payload.user);
+    const channel = record3(payload.channel);
+    const message = record3(payload.message);
+    const triggerId = boundedString(payload.trigger_id, 256);
+    const teamId = boundedString(team?.id, 64);
+    const userId = boundedString(user?.id, 64);
+    const channelId = boundedString(channel?.id, 64);
+    const messageTs = boundedString(message?.ts, 64);
+    const threadTs = boundedString(message?.thread_ts, 64);
+    const text = boundedText(message?.text);
+    if (!triggerId || !teamId || !userId || !channelId || !messageTs || !text) {
+      throw new HTTPException31(400, {
+        message: "invalid Slack message shortcut"
+      });
+    }
+    const installation = await resolveSlackInstallationRoute(deps.db, teamId);
+    if (!installation)
+      throw new HTTPException31(403, {
+        message: "Slack installation unavailable"
+      });
+    await enqueueNormalizedSlackInteraction(deps, installation, {
+      providerEventId: `shortcut:${triggerId}`,
+      providerMessageId: `shortcut:${triggerId}`,
+      slackTeamId: teamId,
+      slackUserId: userId,
+      slackChannelId: channelId,
+      slackMessageTs: messageTs,
+      slackThreadTs: threadTs,
+      triggerKind: "message_shortcut",
+      text
+    });
+    return c.json({ ok: true });
+  });
+  app.post("/v1/workspaces/:workspaceId/integrations/slack/user-links", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant23(c, deps, workspaceId, "connections:write");
+    const body2 = record3(await c.req.json().catch(() => null));
+    const connectionId = boundedString(body2?.connectionId, 64);
+    const slackTeamId = boundedString(body2?.slackTeamId, 64);
+    const slackUserId = boundedString(body2?.slackUserId, 64);
+    if (!connectionId || !slackTeamId || !slackUserId) {
+      throw new HTTPException31(400, {
+        message: "invalid Slack identity link request"
+      });
+    }
+    const route = await resolveSlackInstallationRoute(deps.db, slackTeamId);
+    if (!route || route.workspaceId !== workspaceId || route.connectionId !== connectionId) {
+      throw new HTTPException31(404, {
+        message: "Slack installation not found"
+      });
+    }
+    return c.json(
+      await saveSlackBotUserLink(deps.db, {
+        accountId: grant.accountId,
+        workspaceId,
+        connectionId,
+        slackTeamId,
+        slackUserId,
+        subjectId: grant.subjectId,
+        linkedBySubjectId: grant.subjectId
+      }),
+      201
+    );
+  });
+  app.delete(
+    "/v1/workspaces/:workspaceId/integrations/slack/user-links/:slackUserId",
+    async (c) => {
+      const workspaceId = c.req.param("workspaceId");
+      await requireAccessGrant23(c, deps, workspaceId, "connections:write");
+      const connectionId = boundedString(c.req.query("connectionId"), 64);
+      if (!connectionId) throw new HTTPException31(400, { message: "connectionId is required" });
+      return c.json({
+        deleted: await deleteSlackBotUserLink(
+          deps.db,
+          workspaceId,
+          connectionId,
+          c.req.param("slackUserId")
+        )
+      });
+    }
+  );
+}
+async function drainSlackInteractionsOnce(deps) {
+  const holder = crypto.randomUUID();
+  const entry = await claimSlackInteractionInbox(deps.db, holder, INBOX_LEASE_MS);
+  if (entry) {
+    try {
+      await processSlackInboxEntry(deps, entry);
+      await settleSlackInteractionInbox(deps.db, {
+        entry,
+        claimHolderId: holder,
+        outcome: "processed"
+      });
+    } catch (error) {
+      const code = safeErrorCode(error);
+      if (entry.attemptCount >= 5 || permanentSlackInteractionError(error)) {
+        await settleSlackInteractionInbox(deps.db, {
+          entry,
+          claimHolderId: holder,
+          outcome: "failed",
+          errorCode: code
+        });
+      } else {
+        await releaseSlackInteractionInbox(deps.db, {
+          entry,
+          claimHolderId: holder,
+          errorCode: code
+        });
+      }
+    }
+    return true;
+  }
+  const deliveryHolder = crypto.randomUUID();
+  const interaction = await claimSlackInteractionDelivery(
+    deps.db,
+    deliveryHolder,
+    DELIVERY_LEASE_MS
+  );
+  if (!interaction) return false;
+  try {
+    await deliverSlackSessionEvents(deps, interaction, deliveryHolder);
+  } catch {
+    await releaseSlackInteractionDelivery(deps.db, {
+      ...interaction,
+      claimHolderId: deliveryHolder
+    }).catch(() => void 0);
+  }
+  return true;
+}
+function startSlackInteractionPump(deps, options = {}) {
+  let stopped = false;
+  let running = false;
+  const intervalMs = Math.max(250, options.intervalMs ?? 1e3);
+  const maxPerTick = Math.max(1, Math.min(50, options.maxPerTick ?? 10));
+  const tick = async () => {
+    if (stopped || running) return;
+    running = true;
+    try {
+      for (let index = 0; index < maxPerTick; index += 1) {
+        if (!await drainSlackInteractionsOnce(deps)) break;
+      }
+    } finally {
+      running = false;
+    }
+  };
+  const timer = setInterval(() => void tick(), intervalMs);
+  void tick();
+  return () => {
+    stopped = true;
+    clearInterval(timer);
+  };
+}
+async function processSlackInboxEntry(deps, entry) {
+  const routeKey = slackRouteKey(entry.slackChannelId, entry.slackThreadTs ?? entry.slackMessageTs);
+  const existing = await getSlackInteractionByRoute(
+    deps.db,
+    entry.workspaceId,
+    entry.connectionId,
+    routeKey
+  );
+  if (entry.triggerKind === "thread_reply" && !existing) return;
+  const link = await getSlackBotUserLink(
+    deps.db,
+    entry.workspaceId,
+    entry.connectionId,
+    entry.slackUserId
+  );
+  const client = await createOpenGeniSlackBotInteractionClient(deps, {
+    accountId: entry.accountId,
+    workspaceId: entry.workspaceId,
+    connectionId: entry.connectionId,
+    subjectId: link?.subjectId ?? "service:slack-interaction",
+    ...existing?.sessionId ? { sessionId: existing.sessionId } : {}
+  });
+  await client.verifyChannelAccess(entry.slackChannelId);
+  if (!link) {
+    await client.postMessage({
+      operationId: deterministicUuid(`slack-link:${entry.id}`),
+      channelId: entry.slackChannelId,
+      ...entry.slackThreadTs ? { threadTimestamp: entry.slackThreadTs } : {},
+      text: `Link your Slack identity to OpenGeni before starting work: ${linkUrl(deps, entry)}. No session was created.`
+    });
+    return;
+  }
+  const grant = await getWorkspaceGrant4(deps.db, link.subjectId, entry.workspaceId, {
+    principalKind: "human_session"
+  });
+  if (!grant || grant.accountId !== entry.accountId) {
+    throw new SlackInteractionPermanentError("identity_access_revoked");
+  }
+  if (existing?.sessionId) {
+    await continueSlackSession(deps, grant, existing, entry);
+    return;
+  }
+  if (!hasPermission13(grant.permissions, "sessions:create")) {
+    throw new SlackInteractionPermanentError("sessions_create_denied");
+  }
+  const { interaction } = await getOrCreateSlackInteraction(deps.db, {
+    accountId: entry.accountId,
+    workspaceId: entry.workspaceId,
+    connectionId: entry.connectionId,
+    slackTeamId: entry.slackTeamId,
+    slackChannelId: entry.slackChannelId,
+    slackThreadTs: entry.slackThreadTs ?? entry.slackMessageTs,
+    routeKey,
+    triggeringProviderEventId: entry.providerEventId,
+    owningSubjectId: grant.subjectId,
+    visibility: entry.triggerKind === "dm" ? "private" : "workspace"
+  });
+  if (interaction.sessionId) {
+    await continueSlackSession(deps, grant, interaction, entry);
+    return;
+  }
+  const session = await createSessionForRequest3(deps, grant, entry.workspaceId, {
+    requestedSessionId: interaction.sessionReservationId,
+    initialMessage: entry.text,
+    turnInstructions: SLACK_TASK_INSTRUCTIONS,
+    idempotencyKey: `slack:${entry.connectionId}:${entry.providerEventId}`,
+    clientEventId: `slack:${entry.providerEventId}`
+  });
+  const bound = await bindSlackInteractionSession(deps.db, {
+    ...interaction,
+    owningSubjectId: grant.subjectId,
+    sessionId: session.id
+  });
+  if (!bound) throw new Error("Slack route could not bind its durable session");
+  const ack = await client.postMessage({
+    operationId: deterministicUuid(`slack-ack:${interaction.id}`),
+    channelId: entry.slackChannelId,
+    ...entry.triggerKind === "slash_command" ? {} : { threadTimestamp: entry.slackThreadTs ?? entry.slackMessageTs },
+    text: `OpenGeni started this task. ${openSessionText(deps, entry.workspaceId, session.id)} Reply in this thread to continue, or reply \`stop\` to stop. Start a new top-level DM or invoke /opengeni again for a new session.`
+  });
+  if (entry.triggerKind === "slash_command") {
+    await rekeySlackInteractionRoute(deps.db, {
+      ...interaction,
+      routeKey: slackRouteKey(entry.slackChannelId, ack.timestamp),
+      slackThreadTs: ack.timestamp,
+      ackSlackMessageTs: ack.timestamp
+    });
+  }
+}
+async function continueSlackSession(deps, grant, interaction, entry) {
+  if (!interaction.sessionId || interaction.visibility === "private" && interaction.owningSubjectId !== grant.subjectId) {
+    throw new SlackInteractionPermanentError("session_owner_mismatch");
+  }
+  await reopenSlackInteractionDelivery(deps.db, interaction);
+  if (entry.text.trim().toLowerCase() === "stop") {
+    if (!hasPermission13(grant.permissions, "sessions:control")) {
+      throw new SlackInteractionPermanentError("sessions_control_denied");
+    }
+    await controlHumanSessionWorkstream3(
+      deps,
+      {
+        accountId: grant.accountId,
+        workspaceId: grant.workspaceId,
+        subjectId: grant.subjectId,
+        sessionId: interaction.sessionId
+      },
+      {
+        action: "pause",
+        clientEventId: deterministicUuid(`slack-stop:${entry.providerEventId}`),
+        reason: "Stopped from the originating Slack thread"
+      }
+    );
+    return;
+  }
+  const pending = await listSessionHumanInputRequests2(
+    deps.db,
+    entry.workspaceId,
+    interaction.sessionId,
+    { status: "pending", limit: 2 }
+  );
+  if (pending.length === 1) {
+    const response = humanInputResponse(pending[0].questions, entry.text);
+    if (response) {
+      const accepted = await acceptSessionHumanInputResponse2(deps.db, {
+        accountId: grant.accountId,
+        workspaceId: grant.workspaceId,
+        sessionId: interaction.sessionId,
+        requestId: pending[0].id,
+        response,
+        respondedBy: grant.subjectId,
+        clientEventId: `slack:${entry.providerEventId}`
+      });
+      if (accepted.action === "accepted") {
+        await publishDurableSessionEvents3(
+          deps.bus,
+          grant.workspaceId,
+          interaction.sessionId,
+          accepted.events
+        );
+        if (accepted.workflowWakeRevision !== null) {
+          await deps.workflowClient.signalApprovalDecision({
+            accountId: grant.accountId,
+            workspaceId: grant.workspaceId,
+            sessionId: interaction.sessionId,
+            eventId: accepted.events[0]?.id ?? pending[0].id,
+            workflowId: `session-${interaction.sessionId}`,
+            workflowWakeRevision: accepted.workflowWakeRevision
+          });
+        }
+        return;
+      }
+    }
+  }
+  if (!hasPermission13(grant.permissions, "sessions:control")) {
+    throw new SlackInteractionPermanentError("sessions_control_denied");
+  }
+  await acceptSessionUserMessage3(deps, grant, entry.workspaceId, interaction.sessionId, {
+    text: entry.text,
+    turnInstructions: SLACK_TASK_INSTRUCTIONS,
+    clientEventId: `slack:${entry.providerEventId}`
+  });
+}
+async function deliverSlackSessionEvents(deps, interaction, claimHolderId) {
+  if (!interaction.sessionId) return;
+  const page = await listSessionEventPage3(deps.db, interaction.workspaceId, interaction.sessionId, {
+    after: interaction.lastDeliveredSessionEventSequence,
+    limit: 100,
+    includeTypes: [...SLACK_DELIVERY_EVENT_TYPES],
+    authoritativeLatest: true,
+    maxBytes: 256 * 1024
+  });
+  if (page.events.length === 0) {
+    await releaseSlackInteractionDelivery(deps.db, {
+      ...interaction,
+      claimHolderId
+    });
+    return;
+  }
+  const client = await createOpenGeniSlackBotInteractionClient(deps, {
+    accountId: interaction.accountId,
+    workspaceId: interaction.workspaceId,
+    connectionId: interaction.connectionId,
+    subjectId: interaction.owningSubjectId,
+    sessionId: interaction.sessionId
+  });
+  let lastSequence = interaction.lastDeliveredSessionEventSequence;
+  let terminal = null;
+  let latestAssistantText = "";
+  for (const event of [...page.events].sort((left, right) => left.sequence - right.sequence)) {
+    lastSequence = Math.max(lastSequence, event.sequence);
+    if (event.type === "agent.message.completed") {
+      latestAssistantText = safePayloadText(event.payload, "text");
+      if (latestAssistantText) {
+        const progress = await claimSlackInteractionProgressDelivery(deps.db, {
+          accountId: interaction.accountId,
+          workspaceId: interaction.workspaceId,
+          interactionId: interaction.id,
+          claimHolderId,
+          sessionEventSequence: event.sequence,
+          maxProgress: MAX_PROGRESS_MESSAGES
+        });
+        if (progress.kind === "not_owned") {
+          throw new Error("Slack progress delivery lost its durable interaction claim");
+        }
+        if (progress.kind === "claimed") {
+          await postDelivery(
+            client,
+            interaction,
+            event,
+            latestAssistantText,
+            "progress",
+            progress.delivery.operationId
+          );
+        }
+      }
+    } else if (event.type === "session.humanInput.requested") {
+      const requests = await listSessionHumanInputRequests2(
+        deps.db,
+        interaction.workspaceId,
+        interaction.sessionId,
+        { status: "pending", limit: 1 }
+      );
+      const request = requests[0];
+      if (request) {
+        await postDelivery(
+          client,
+          interaction,
+          event,
+          `OpenGeni needs your input:
+${formatQuestions(request.questions)}
+Reply in this thread, or use ${openSessionText(deps, interaction.workspaceId, interaction.sessionId)}.`,
+          "human-input"
+        );
+      }
+    } else if (event.type === "turn.completed") {
+      const output = safePayloadText(event.payload, "output") || latestAssistantText;
+      await postDelivery(
+        client,
+        interaction,
+        event,
+        `${output || "OpenGeni finished this task."}
+
+${openSessionText(deps, interaction.workspaceId, interaction.sessionId)} Reply in this thread to continue.`,
+        "final"
+      );
+      terminal = "completed";
+    } else if (event.type === "turn.failed") {
+      await postDelivery(
+        client,
+        interaction,
+        event,
+        `OpenGeni could not complete this task. ${openSessionText(deps, interaction.workspaceId, interaction.sessionId)} for the bounded failure details.`,
+        "failed"
+      );
+      terminal = "failed";
+    } else if (event.type === "turn.cancelled") {
+      await postDelivery(client, interaction, event, "OpenGeni stopped this task.", "cancelled");
+      terminal = "cancelled";
+    }
+  }
+  if (terminal) {
+    await closeSlackInteractionDelivery(deps.db, {
+      ...interaction,
+      claimHolderId,
+      sequence: lastSequence,
+      state: terminal
+    });
+  } else {
+    await advanceSlackInteractionDelivery(deps.db, {
+      ...interaction,
+      claimHolderId,
+      sequence: lastSequence
+    });
+    await releaseSlackInteractionDelivery(deps.db, {
+      ...interaction,
+      claimHolderId
+    });
+  }
+}
+async function postDelivery(client, interaction, event, text, kind, operationId = deterministicUuid(`slack-delivery:${interaction.id}:${event.sequence}:${kind}`)) {
+  await client.postMessage({
+    operationId,
+    channelId: interaction.slackChannelId,
+    threadTimestamp: interaction.slackThreadTs,
+    text: boundedOutput(text)
+  });
+}
+async function enqueueNormalizedSlackInteraction(deps, route, entry) {
+  await enqueueSlackInteractionInbox(deps.db, {
+    accountId: route.accountId,
+    workspaceId: route.workspaceId,
+    connectionId: route.connectionId,
+    ...entry
+  });
+}
+async function readSignedSlackRequest(c, deps) {
+  const signingSecret = deps.settings.slackSigningSecret;
+  if (!signingSecret)
+    throw new HTTPException31(503, {
+      message: "Slack interactions are disabled"
+    });
+  const rawBytes = new Uint8Array(await c.req.raw.arrayBuffer());
+  if (rawBytes.byteLength === 0 || rawBytes.byteLength > SLACK_INTERACTION_MAX_BODY_BYTES) {
+    throw new HTTPException31(rawBytes.byteLength > SLACK_INTERACTION_MAX_BODY_BYTES ? 413 : 400, {
+      message: "invalid Slack request body"
+    });
+  }
+  const rawBody = new TextDecoder("utf-8", { fatal: true }).decode(rawBytes);
+  if (!verifySlackRequestSignature(
+    {
+      timestamp: c.req.header("x-slack-request-timestamp") ?? null,
+      signature: c.req.header("x-slack-signature") ?? null,
+      rawBody
+    },
+    signingSecret
+  )) {
+    throw new HTTPException31(401, { message: "invalid Slack signature" });
+  }
+  return { rawBody };
+}
+function normalizedFormInteraction(form, triggerKind) {
+  const teamId = boundedString(form.get("team_id"), 64);
+  const userId = boundedString(form.get("user_id"), 64);
+  const channelId = boundedString(form.get("channel_id"), 64);
+  const triggerId = boundedString(form.get("trigger_id"), 256);
+  const text = boundedText(form.get("text"));
+  if (!teamId || !userId || !channelId || !triggerId || !text) {
+    throw new HTTPException31(400, { message: "invalid Slack command payload" });
+  }
+  return {
+    providerEventId: `command:${triggerId}`,
+    providerMessageId: `command:${triggerId}`,
+    slackTeamId: teamId,
+    slackUserId: userId,
+    slackChannelId: channelId,
+    slackMessageTs: triggerId.slice(0, 64),
+    slackThreadTs: null,
+    triggerKind,
+    text
+  };
+}
+function humanInputResponse(questions, text) {
+  if (questions.length !== 1) return null;
+  const question = questions[0];
+  if (question.kind === "text") {
+    return {
+      outcome: "answered",
+      answers: [{ questionId: question.id, values: [text] }]
+    };
+  }
+  const normalized = text.trim().toLowerCase();
+  const matches = question.options.filter(
+    (option) => option.id.toLowerCase() === normalized || option.label.toLowerCase() === normalized
+  );
+  if (matches.length !== 1) return null;
+  return {
+    outcome: "answered",
+    answers: [{ questionId: question.id, values: [matches[0].id] }]
+  };
+}
+function formatQuestions(questions) {
+  return questions.slice(0, 5).map((question, index) => {
+    const options = question.options.slice(0, 10).map((option) => option.label).join(", ");
+    return `${index + 1}. ${boundedOutput(question.prompt)}${options ? ` (${options})` : ""}`;
+  }).join("\n");
+}
+function openSessionText(deps, workspaceId, sessionId) {
+  const base = deps.settings.webBaseUrl ?? deps.settings.publicBaseUrl;
+  return base ? `Open in OpenGeni: ${new URL(`/workspaces/${workspaceId}/sessions/${sessionId}`, base).toString()}` : "Open this session in OpenGeni";
+}
+function linkUrl(deps, entry) {
+  const base = deps.settings.webBaseUrl ?? deps.settings.publicBaseUrl;
+  if (!base) return "OpenGeni Settings \u2192 Integrations \u2192 Slack";
+  const url = new URL("/settings/integrations/slack", base);
+  url.searchParams.set("workspaceId", entry.workspaceId);
+  url.searchParams.set("connectionId", entry.connectionId);
+  url.searchParams.set("teamId", entry.slackTeamId);
+  url.searchParams.set("userId", entry.slackUserId);
+  return url.toString();
+}
+function slackRouteKey(channelId, threadTs) {
+  return `${channelId}:${threadTs}`;
+}
+function deterministicUuid(value) {
+  const bytes = createHash8("sha256").update(value).digest().subarray(0, 16);
+  bytes[6] = bytes[6] & 15 | 80;
+  bytes[8] = bytes[8] & 63 | 128;
+  const hex = bytes.toString("hex");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+function parseJsonObject(value) {
+  try {
+    const parsed = JSON.parse(value);
+    const result = record3(parsed);
+    if (result) return result;
+  } catch {
+  }
+  throw new HTTPException31(400, { message: "invalid Slack JSON payload" });
+}
+function record3(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function boundedString(value, max) {
+  return typeof value === "string" && value.length > 0 && Buffer.byteLength(value) <= max ? value : null;
+}
+function boundedText(value) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  if (!trimmed) return null;
+  return trimmed.slice(0, MAX_SLACK_INPUT_CHARS);
+}
+function boundedOutput(value) {
+  return value.length <= MAX_SLACK_TEXT_CHARS ? value : `${value.slice(0, MAX_SLACK_TEXT_CHARS - 20)}
+\u2026 output truncated`;
+}
+function safePayloadText(payload, field) {
+  const value = record3(payload)?.[field];
+  return typeof value === "string" ? boundedOutput(value) : "";
+}
+function safeErrorCode(error) {
+  const raw = error instanceof Error ? error.name : "slack_interaction_error";
+  return raw.toLowerCase().replace(/[^a-z0-9_-]/g, "_").slice(0, 128) || "error";
+}
+var SlackInteractionPermanentError = class extends Error {
+};
+function permanentSlackInteractionError(error) {
+  return error instanceof SlackInteractionPermanentError || error instanceof HTTPException31;
+}
+
 // src/app.ts
 import {
   mergeResourceRefs,
@@ -19964,6 +21204,9 @@ function apiRequestBodyLimitBytes(settings) {
 }
 var API_PUBLIC_ERROR_MESSAGE_MAX_BYTES = 512;
 function createApp(deps) {
+  return createAppComposition(deps).app;
+}
+function createAppComposition(deps) {
   const managedAuth = deps.managedAuth ?? createManagedAuth(deps.settings, deps.db);
   const objectStorage = deps.objectStorage === void 0 ? createObjectStorage(deps.settings) : deps.objectStorage;
   let documentServices = deps.documentServices ?? null;
@@ -19978,7 +21221,7 @@ function createApp(deps) {
       documentId
     }) => {
       if (!objectStorage) {
-        throw new HTTPException30(503, {
+        throw new HTTPException32(503, {
           message: "object storage is not configured"
         });
       }
@@ -20029,28 +21272,29 @@ function createApp(deps) {
     c.header(OPENGENI_CORRELATION_HEADER, correlationId);
     await next();
   });
-  app.use(
-    "*",
-    cors({
-      credentials: true,
-      allowHeaders: [
-        "Accept",
-        "Authorization",
-        "Content-Type",
-        "X-OpenGeni-Access-Key",
-        "X-OpenGeni-Api-Contract",
-        "X-OpenGeni-Correlation-Id",
-        "X-OpenGeni-Subject"
-      ],
-      exposeHeaders: ["X-OpenGeni-Api-Contract", "X-OpenGeni-Correlation-Id"],
-      origin: (origin) => {
-        if (!origin) {
-          return null;
-        }
-        return allowedCorsOrigin(deps.settings.corsAllowOriginRegex, origin) ? origin : null;
-      }
-    })
-  );
+  const corsHeaders = {
+    allowHeaders: [
+      "Accept",
+      "Authorization",
+      "Content-Type",
+      "X-OpenGeni-Access-Key",
+      "X-OpenGeni-Api-Contract",
+      "X-OpenGeni-Correlation-Id",
+      "X-OpenGeni-Subject"
+    ],
+    exposeHeaders: ["X-OpenGeni-Api-Contract", "X-OpenGeni-Correlation-Id"]
+  };
+  const publicApiCors = cors({ ...corsHeaders, credentials: false, origin: "*" });
+  const credentialedCors = cors({
+    ...corsHeaders,
+    credentials: true,
+    origin: (origin) => allowedCorsOrigin(deps.settings.corsAllowOriginRegex, origin) ? origin : null
+  });
+  app.use("*", (c, next) => {
+    const origin = c.req.header("origin");
+    const middleware = origin && allowedCorsOrigin(deps.settings.corsAllowOriginRegex, origin) ? credentialedCors : publicApiCors;
+    return middleware(c, next);
+  });
   app.use(
     "*",
     bodyLimit({
@@ -20219,7 +21463,9 @@ function createApp(deps) {
       boundedRequest = await boundedMcpRequest(c.req.raw);
     } catch (error) {
       if (error instanceof McpPayloadTooLargeError2) {
-        throw new HTTPException30(413, { message: "MCP request body exceeds the safety limit" });
+        throw new HTTPException32(413, {
+          message: "MCP request body exceeds the safety limit"
+        });
       }
       throw error;
     }
@@ -20228,7 +21474,7 @@ function createApp(deps) {
     const boundSessionId = grant.metadata?.sessionId;
     if (toolspaceGrant || typeof boundSessionId === "string") {
       if (typeof boundSessionId !== "string") {
-        throw new HTTPException30(404, { message: "session not found" });
+        throw new HTTPException32(404, { message: "session not found" });
       }
       try {
         await requireSessionAuthorization3(routeDeps, grant, {
@@ -20238,10 +21484,12 @@ function createApp(deps) {
         });
       } catch (error) {
         if (error instanceof SessionAuthorizationDeniedError2) {
-          throw new HTTPException30(404, { message: "session not found" });
+          throw new HTTPException32(404, { message: "session not found" });
         }
         if (error instanceof SessionAuthorizationUnavailableError2) {
-          throw new HTTPException30(503, { message: "session authorization is unavailable" });
+          throw new HTTPException32(503, {
+            message: "session authorization is unavailable"
+          });
         }
         throw error;
       }
@@ -20249,10 +21497,15 @@ function createApp(deps) {
     let toolspace = null;
     if (toolspaceGrant) {
       try {
-        toolspace = await prepareToolspaceMcpSurface({ deps: routeDeps, grant });
+        toolspace = await prepareToolspaceMcpSurface({
+          deps: routeDeps,
+          grant
+        });
       } catch (error) {
         if (error instanceof McpPayloadTooLargeError2) {
-          throw new HTTPException30(413, { message: "MCP tool list exceeds the safety limit" });
+          throw new HTTPException32(413, {
+            message: "MCP tool list exceeds the safety limit"
+          });
         }
         throw error;
       }
@@ -20284,6 +21537,7 @@ function createApp(deps) {
   registerInsightsRoutes(app, routeDeps);
   registerWorkspaceInstructionPolicyRoutes(app, routeDeps);
   registerWorkspaceStateRoutes(app, routeDeps);
+  registerWorkspaceArtifactRoutes(app, routeDeps);
   registerPreferenceRegistryRoutes(app, routeDeps);
   registerSocialRoutes(app, routeDeps);
   registerConnectionRoutes(app, routeDeps);
@@ -20298,6 +21552,7 @@ function createApp(deps) {
   registerScheduledTaskRoutes(app, routeDeps);
   registerCodexRoutes(app, routeDeps);
   registerTranscriptionRoutes(app, routeDeps);
+  registerSlackInteractionRoutes(app, routeDeps);
   app.notFound((c) => {
     if (!new URL(c.req.url).pathname.startsWith("/v1/")) return c.text("Not Found", 404);
     const requestId = correlationIds.get(c.req.raw) ?? crypto.randomUUID();
@@ -20334,11 +21589,11 @@ function createApp(deps) {
     });
     return c.json(envelope, status);
   });
-  return app;
+  return { app, routeDeps };
 }
 async function requireMcpAccessGrant(c, deps, workspaceId) {
-  const grant = await requireAccessGrant22(c, deps, workspaceId);
-  if (hasPermission13(grant.permissions, "workspace:read")) {
+  const grant = await requireAccessGrant24(c, deps, workspaceId);
+  if (hasPermission14(grant.permissions, "workspace:read")) {
     return grant;
   }
   if (isToolspaceGrant(deps.settings, grant)) {
@@ -20378,7 +21633,7 @@ function allowedCorsOrigin(pattern, origin) {
 }
 function codexCompactionV2ProviderLockedError(error) {
   if (error instanceof CodexCompactionV2ProviderLockedError) return error;
-  if (error instanceof HTTPException30 && error.cause instanceof CodexCompactionV2ProviderLockedError) {
+  if (error instanceof HTTPException32 && error.cause instanceof CodexCompactionV2ProviderLockedError) {
     return error.cause;
   }
   return null;
@@ -20387,7 +21642,7 @@ function httpStatusForError(error) {
   if (codexCompactionV2ProviderLockedError(error)) {
     return 422;
   }
-  if (error instanceof HTTPException30) {
+  if (error instanceof HTTPException32) {
     return error.status;
   }
   if (error instanceof McpPayloadTooLargeError2) {
@@ -20416,7 +21671,7 @@ function publicErrorMessage(error, status) {
   if (status >= 500) {
     return "OpenGeni could not complete the request.";
   }
-  if (error instanceof HTTPException30) {
+  if (error instanceof HTTPException32) {
     return boundedPublicMessage(error.message) ?? "Request failed.";
   }
   if (error instanceof McpPayloadTooLargeError2) {
@@ -20882,7 +22137,7 @@ function isApiContractProtectedMutation(method, pathname) {
   if (!pathname.startsWith("/v1/")) {
     return false;
   }
-  if (pathname.startsWith("/v1/auth/") || pathname.startsWith("/v1/webhooks/") || pathname.startsWith("/v1/integrations/oauth/") || pathname.startsWith("/v1/github/") || pathname === "/v1/enrollments/device/start" || pathname === "/v1/enrollments/device/poll" || pathname === "/v1/enrollments/token/exchange") {
+  if (pathname.startsWith("/v1/auth/") || pathname.startsWith("/v1/webhooks/") || pathname.startsWith("/v1/integrations/oauth/") || pathname === "/v1/integrations/slack/events" || pathname === "/v1/integrations/slack/commands" || pathname === "/v1/integrations/slack/interactions" || pathname.startsWith("/v1/github/") || pathname === "/v1/enrollments/device/start" || pathname === "/v1/enrollments/device/poll" || pathname === "/v1/enrollments/token/exchange") {
     return false;
   }
   return !pathname.split("/").includes("mcp");
@@ -20892,9 +22147,11 @@ export {
   sseSessionStream,
   replaySessionEvents,
   sseWorkspaceControlStream,
+  startSlackInteractionPump,
   API_MAX_REQUEST_BODY_BYTES,
   apiRequestBodyLimitBytes,
   createApp,
+  createAppComposition,
   allowedCorsOrigin,
   httpStatusForError,
   errorCodeForStatus,
@@ -20911,4 +22168,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession2 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-36PW33ND.js.map
+//# sourceMappingURL=chunk-UVL2KH56.js.map