@opengeni/api-router 2.1.0-canary.0 → 2.2.0-canary.0

package/dist/{chunk-QKDFBBUE.js → chunk-3TP54PPX.js}

@@ -26394,6 +26394,8 @@ import {
   DocumentAuthorityReclassification,
   DocumentBase,
   DocumentDefaultCollectionBackfill,
+  DocumentDefaultCollectionBackfillAudit,
+  GetDocumentDefaultCollectionBackfillAuditQuery,
   DocumentSearchRequest,
   DocumentSearchResponse,
   FileAsset as FileAsset2,
@@ -26402,6 +26404,9 @@ import {
   KnowledgeMemorySearchRequest,
   ListDocumentAuthorityReclassificationsQuery,
   ListDocumentAuthorityReclassificationsResponse,
+  ListDocumentDefaultCollectionBackfillRunsResponse,
+  ListDocumentMigrationAuditQuery,
+  ListOrganizationDocumentAuthorityReclassificationsResponse,
   MoveDocumentRequest,
   ReclassifyDocumentAuthorityRequest,
   RunDocumentDefaultCollectionBackfillRequest,
@@ -26427,10 +26432,13 @@ import {
   getDocument,
   getDocumentOriginalFile,
   getDocumentBase,
+  getDocumentDefaultCollectionBackfillAudit,
   listAccessibleDocuments,
   listDocumentAuthorityReclassifications,
+  listDocumentDefaultCollectionBackfillRuns,
   listDocumentBasesEnsuringDefault,
   listDocuments,
+  listOrganizationDocumentAuthorityReclassifications,
   moveDocumentToBase,
   queueDocumentForReindex,
   reclassifyDocumentAuthority,
@@ -26886,6 +26894,103 @@ function registerDocumentRoutes(app, deps) {
       throw documentHttpException(error);
     }
   });
+  app.get("/v1/workspaces/:workspaceId/document-default-collection-backfills", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const authorization = await requireAccessGrantAuthorization2(
+      c,
+      deps,
+      workspaceId,
+      "documents:manage"
+    );
+    if (!hasAccountAdminAuthority(authorization)) {
+      throw new HTTPException26(403, { message: "missing permission: account:admin" });
+    }
+    const query = ListDocumentMigrationAuditQuery.safeParse(c.req.query());
+    if (!query.success) {
+      throw new HTTPException26(400, { message: "invalid document migration audit query" });
+    }
+    try {
+      return c.json(
+        ListDocumentDefaultCollectionBackfillRunsResponse.parse(
+          await listDocumentDefaultCollectionBackfillRuns(db, {
+            accountId: authorization.grant.accountId,
+            workspaceId,
+            actorSubjectId: authorization.grant.subjectId,
+            accountAdminAuthorization: requireAccountAdminAuthorizationStamp(authorization),
+            ...query.data
+          })
+        )
+      );
+    } catch (error) {
+      throw documentHttpException(error);
+    }
+  });
+  app.get("/v1/workspaces/:workspaceId/document-default-collection-backfills/:runId", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const authorization = await requireAccessGrantAuthorization2(
+      c,
+      deps,
+      workspaceId,
+      "documents:manage"
+    );
+    if (!hasAccountAdminAuthority(authorization)) {
+      throw new HTTPException26(403, { message: "missing permission: account:admin" });
+    }
+    const runId = RunDocumentDefaultCollectionBackfillRequest.shape.runId.safeParse(
+      c.req.param("runId")
+    );
+    const query = GetDocumentDefaultCollectionBackfillAuditQuery.safeParse(c.req.query());
+    if (!runId.success || !query.success) {
+      throw new HTTPException26(400, { message: "invalid document migration audit query" });
+    }
+    try {
+      return c.json(
+        DocumentDefaultCollectionBackfillAudit.parse(
+          await getDocumentDefaultCollectionBackfillAudit(db, {
+            accountId: authorization.grant.accountId,
+            workspaceId,
+            actorSubjectId: authorization.grant.subjectId,
+            accountAdminAuthorization: requireAccountAdminAuthorizationStamp(authorization),
+            runId: runId.data,
+            ...query.data
+          })
+        )
+      );
+    } catch (error) {
+      throw documentHttpException(error);
+    }
+  });
+  app.get("/v1/workspaces/:workspaceId/document-authority-reclassifications", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const authorization = await requireAccessGrantAuthorization2(
+      c,
+      deps,
+      workspaceId,
+      "documents:manage"
+    );
+    if (!hasAccountAdminAuthority(authorization)) {
+      throw new HTTPException26(403, { message: "missing permission: account:admin" });
+    }
+    const query = ListDocumentMigrationAuditQuery.safeParse(c.req.query());
+    if (!query.success) {
+      throw new HTTPException26(400, { message: "invalid document migration audit query" });
+    }
+    try {
+      return c.json(
+        ListOrganizationDocumentAuthorityReclassificationsResponse.parse(
+          await listOrganizationDocumentAuthorityReclassifications(db, {
+            accountId: authorization.grant.accountId,
+            workspaceId,
+            actorSubjectId: authorization.grant.subjectId,
+            accountAdminAuthorization: requireAccountAdminAuthorizationStamp(authorization),
+            ...query.data
+          })
+        )
+      );
+    } catch (error) {
+      throw documentHttpException(error);
+    }
+  });
   app.post("/v1/workspaces/:workspaceId/document-bases/:baseId/documents", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const access = await requireAccessGrantAuthorization2(c, deps, workspaceId, "documents:manage");
@@ -27569,23 +27674,26 @@ function dropFilename(preferred) {
   return /\.[A-Za-z0-9]{1,8}$/.test(stem) ? stem : `${stem}.txt`;
 }
 function documentHttpException(error) {
-  const message = error instanceof Error ? error.message : String(error);
+  const message = documentDomainErrorMessage(error);
   if (message.includes("organization document") && message.includes("exact account authority")) {
     return new HTTPException26(403, { message: "missing permission: account:admin" });
   }
   if (message.includes("not found")) {
     return new HTTPException26(404, { message });
   }
+  if (message.includes("document Default collection backfill audit run is unavailable")) {
+    return new HTTPException26(404, { message });
+  }
   if (message.includes("already exists")) {
     return new HTTPException26(409, { message });
   }
   if (message.includes("operation id was reused") || message.includes("authority changed before reclassification") || message.includes("run identity mismatch")) {
     return new HTTPException26(409, { message });
   }
-  if (message.includes("reclassification requires") || message.includes("backfill requires organization administration")) {
+  if (message.includes("reclassification requires") || message.includes("backfill requires organization administration") || message.includes("document migration audit requires organization administration") || message.includes("document migration audit scope is invalid")) {
     return new HTTPException26(403, { message });
   }
-  if (message.includes("reclassification input is invalid") || message.includes("reclassification authority is invalid") || message.includes("invalid document authority receipt cursor") || message.includes("document authority receipt limit")) {
+  if (message.includes("reclassification input is invalid") || message.includes("reclassification authority is invalid") || message.includes("invalid document authority receipt cursor") || message.includes("document authority receipt limit") || message.includes("invalid document migration audit cursor") || message.includes("document migration audit cursor is invalid") || message.includes("document migration audit limit") || message.includes("document migration audit authority is incomplete") || message.includes("document Default collection backfill audit run id is required")) {
     return new HTTPException26(400, { message });
   }
   if (message.includes("no suggested base")) {
@@ -27599,6 +27707,18 @@ function documentHttpException(error) {
   }
   return new HTTPException26(500, { message });
 }
+function documentDomainErrorMessage(error) {
+  let current = error;
+  let message = error instanceof Error ? error.message : String(error);
+  const seen = /* @__PURE__ */ new Set();
+  while (current && typeof current === "object" && !seen.has(current) && seen.size < 8) {
+    seen.add(current);
+    const record7 = current;
+    if (typeof record7.message === "string") message = record7.message;
+    current = record7.cause;
+  }
+  return message;
+}
 function hasAccountAdminAuthority(authorization) {
   return authorization.accountGrant?.permissions.includes("account:admin") === true;
 }
@@ -55146,7 +55266,9 @@ import {
   evaluateSlackTaskPolicy,
   resolveWorkspaceSlackOrchestrationNoticeSettings,
   resolveWorkspaceSlackReactionSummonSettings,
+  SlackChannelRouteListResponse,
   SlackReactionChannelListResponse,
+  UpdateSlackChannelRoutesRequest,
   SlackUserLinkAccessMutationRequest,
   SlackUserLinkAccessRequest,
   workspaceSlackReactionChannelAllowed
@@ -55188,7 +55310,14 @@ import {
   getSlackInteractionById,
   getSlackInteractionByConnectionRoute,
   probeSlackActionHandleTenancy,
+  openSlackRoutePrompt,
+  getSlackRoutePromptByOption,
+  settleSlackRoutePrompt,
+  answerSlackRoutePrompt,
   getSlackChannelRoute,
+  listSlackChannelRoutes,
+  upsertSlackChannelRoute,
+  deleteSlackChannelRoute,
   getSlackUserDmRoute,
   listNamedSubjectSlackRoutableWorkspaces,
   getActiveSlackTaskPolicy,
@@ -55196,11 +55325,14 @@ import {
   getSessionEventByClientEventId,
   getWorkspace as getWorkspace6,
   getWorkspaceGrant as getWorkspaceGrant9,
+  namedSubjectPersonalWorkspaceId,
   resolveSlackTargetAuthority,
   listSlackInteractionProgressDeliveryEvidence,
   listSessionEventPage as listSessionEventPage3,
   listSessionHumanInputRequests as listSessionHumanInputRequests2,
   listPendingSlackUserLinkAccessRequests,
+  listSlackInstallationBindings as listSlackInstallationBindings2,
+  slackUserLinkAccessRequestTeam,
   rekeySlackInteractionRoute,
   reopenSlackInteractionDelivery,
   reserveSlackInteractionActionHandles,
@@ -55273,11 +55405,13 @@ function labelFor(candidates, workspaceId) {
   return candidates.find((candidate) => candidate.workspaceId === workspaceId)?.label ?? null;
 }
 function resolveSlackWorkspaceRoute(input) {
+  const directMessage = isSlackDirectMessageConversation(input.entry);
+  const candidates = directMessage ? input.candidates : input.candidates.filter((candidate) => !candidate.personal);
   const installation = {
     kind: "resolved",
     accountId: input.home.accountId,
     workspaceId: input.home.workspaceId,
-    label: labelFor(input.candidates, input.home.workspaceId),
+    label: labelFor(candidates, input.home.workspaceId),
     source: "installation"
   };
   if (!input.routingEnabled) {
@@ -55294,19 +55428,19 @@ function resolveSlackWorkspaceRoute(input) {
       kind: "resolved",
       accountId: input.threadTenancy.accountId,
       workspaceId: input.threadTenancy.workspaceId,
-      label: labelFor(input.candidates, input.threadTenancy.workspaceId),
+      label: labelFor(candidates, input.threadTenancy.workspaceId),
       source: "thread"
     };
   }
   const prefix = AUTHORED_BY_INVOKER.has(input.entry.triggerKind) ? parseSlackWorkspacePrefix(splitSlackLeadingMention(input.entry.text, input.botUserId).rest) : null;
   if (prefix) {
-    const named = matchCandidate(input.candidates, prefix.requested);
+    const named = matchCandidate(candidates, prefix.requested);
     if (named === "ambiguous" || !named) {
       return {
         kind: "denied",
         reason: "no_access_to_named",
         requested: prefix.requested,
-        candidates: input.candidates
+        candidates
       };
     }
     return {
@@ -55322,17 +55456,17 @@ function resolveSlackWorkspaceRoute(input) {
       kind: "resolved",
       accountId: input.channelRoute.targetAccountId,
       workspaceId: input.channelRoute.targetWorkspaceId,
-      label: labelFor(input.candidates, input.channelRoute.targetWorkspaceId),
+      label: labelFor(candidates, input.channelRoute.targetWorkspaceId),
       source: "channel"
     };
   }
-  if (isSlackDirectMessageConversation(input.entry)) {
+  if (directMessage) {
     if (input.dmRoute) {
       return {
         kind: "resolved",
         accountId: input.dmRoute.targetAccountId,
         workspaceId: input.dmRoute.targetWorkspaceId,
-        label: labelFor(input.candidates, input.dmRoute.targetWorkspaceId),
+        label: labelFor(candidates, input.dmRoute.targetWorkspaceId),
         source: "dm_route"
       };
     }
@@ -55341,13 +55475,13 @@ function resolveSlackWorkspaceRoute(input) {
         kind: "resolved",
         accountId: input.home.accountId,
         workspaceId: input.personalWorkspaceId,
-        label: labelFor(input.candidates, input.personalWorkspaceId),
+        label: labelFor(candidates, input.personalWorkspaceId),
         source: "dm_personal"
       };
     }
   }
-  const sole = input.candidates[0];
-  if (input.candidates.length === 1 && sole) {
+  const sole = candidates[0];
+  if (candidates.length === 1 && sole) {
     return {
       kind: "resolved",
       accountId: sole.accountId,
@@ -55356,10 +55490,10 @@ function resolveSlackWorkspaceRoute(input) {
       source: "sole_candidate"
     };
   }
-  if (input.candidates.length === 0) {
+  if (candidates.length === 0) {
     return { kind: "denied", reason: "no_candidates", requested: null, candidates: [] };
   }
-  return input.askEnabled ? { kind: "ask", candidates: input.candidates } : installation;
+  return input.askEnabled ? { kind: "ask", candidates } : installation;
 }
 function slackRoutedRequestText(text, resolution, botUserId) {
   if (resolution.kind !== "resolved" || resolution.source !== "prefix") return text;
@@ -55883,6 +56017,20 @@ function slackReactionInboxEntry(payload, bot, settings) {
     hasFiles: false
   };
 }
+async function resolveSlackLinkTargetInstallation(deps, link, workspaceId) {
+  const route = await resolveSlackInstallationRoute(deps.db, link.slackTeamId);
+  if (!route || route.connectionId !== link.connectionId || route.accountId.length === 0) {
+    return null;
+  }
+  const workspace = await getWorkspace6(deps.db, workspaceId);
+  if (!workspace || workspace.accountId !== route.accountId) return null;
+  return {
+    accountId: route.accountId,
+    connectionId: route.connectionId,
+    workspaceName: workspace.name,
+    identityHome: { accountId: route.accountId, workspaceId: route.workspaceId }
+  };
+}
 function registerSlackInteractionRoutes(app, deps) {
   app.post("/v1/integrations/slack/events", async (c) => {
     const signed = await readSignedSlackRequest(c, deps);
@@ -56035,17 +56183,13 @@ function registerSlackInteractionRoutes(app, deps) {
     if (!link || link.workspaceId !== workspaceId) {
       throw freshSlackLinkRequired();
     }
-    const route = await resolveSlackInstallationRoute(deps.db, link.slackTeamId);
-    if (!route || route.workspaceId !== workspaceId || route.connectionId !== link.connectionId || route.accountId.length === 0) {
-      throw freshSlackLinkRequired();
-    }
-    const workspace = await getWorkspace6(deps.db, workspaceId);
-    if (!workspace || workspace.accountId !== route.accountId) {
+    const installation = await resolveSlackLinkTargetInstallation(deps, link, workspaceId);
+    if (!installation) {
       throw freshSlackLinkRequired();
     }
     try {
       const prepared = await prepareSlackUserLinkAccessRequest(deps.db, {
-        accountId: route.accountId,
+        accountId: installation.accountId,
         workspaceId,
         tokenDigest: createHash22("sha256").update(payload.linkToken).digest("hex"),
         connectionId: link.connectionId,
@@ -56058,13 +56202,14 @@ function registerSlackInteractionRoutes(app, deps) {
       const completed = await completeSlackUserLinkAccessIfGranted(deps.db, {
         workspaceId,
         requestId: prepared.id,
-        subjectId: context.subjectId
+        subjectId: context.subjectId,
+        identityHome: installation.identityHome
       });
       if (!completed) throw freshSlackLinkRequired();
       return c.json(
         SlackUserLinkAccessRequest.parse({
           ...completed,
-          workspaceDisplayName: workspace.name
+          workspaceDisplayName: installation.workspaceName
         }),
         201
       );
@@ -56167,14 +56312,26 @@ function registerSlackInteractionRoutes(app, deps) {
       const workspaceId = c.req.param("workspaceId");
       const grant = await requireAccessGrant44(c, deps, workspaceId, "members:manage");
       const payload = ApproveSlackUserLinkAccessRequest.parse(await c.req.json());
+      const requestId = c.req.param("requestId");
+      const requestTeam = await slackUserLinkAccessRequestTeam(deps.db, {
+        workspaceId,
+        requestId
+      });
+      const installation = requestTeam ? await resolveSlackInstallationRoute(deps.db, requestTeam.slackTeamId) : null;
       try {
         const request = await approveSlackUserLinkAccessRequest(deps.db, {
           workspaceId,
-          requestId: c.req.param("requestId"),
+          requestId,
           actorSubjectId: grant.subjectId,
           expectedVersion: payload.expectedVersion,
           idempotencyKey: payload.idempotencyKey,
           permissions: payload.permissions,
+          ...installation ? {
+            identityHome: {
+              accountId: installation.accountId,
+              workspaceId: installation.workspaceId
+            }
+          } : {},
           ...payload.role !== void 0 ? { role: payload.role } : {}
         });
         const workspace = await getWorkspace6(deps.db, workspaceId);
@@ -56231,8 +56388,8 @@ function registerSlackInteractionRoutes(app, deps) {
         message: "invalid or expired Slack identity link"
       });
     }
-    const route = await resolveSlackInstallationRoute(deps.db, link.slackTeamId);
-    if (!route || route.workspaceId !== workspaceId || route.connectionId !== link.connectionId) {
+    const installation = await resolveSlackLinkTargetInstallation(deps, link, workspaceId);
+    if (!installation) {
       throw new HTTPException70(404, {
         message: "Slack installation not found"
       });
@@ -56252,7 +56409,8 @@ function registerSlackInteractionRoutes(app, deps) {
       const completed = await completeSlackUserLinkAccessIfGranted(deps.db, {
         workspaceId,
         requestId: prepared.id,
-        subjectId: grant.subjectId
+        subjectId: grant.subjectId,
+        identityHome: installation.identityHome
       });
       if (completed?.status !== "completed") throw freshSlackLinkRequired();
       const saved = await getSlackBotUserLink(
@@ -56284,6 +56442,92 @@ function registerSlackInteractionRoutes(app, deps) {
       });
     }
   );
+  app.get("/v1/workspaces/:workspaceId/integrations/slack/channel-routes", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant44(c, deps, workspaceId, "workspace:admin");
+    const connectionId = boundedString(c.req.query("connectionId"), 64);
+    if (!connectionId) throw new HTTPException70(400, { message: "connectionId is required" });
+    const routes = await listSlackChannelRoutes(
+      deps.db,
+      { accountId: grant.accountId, workspaceId },
+      { connectionId }
+    );
+    const names = /* @__PURE__ */ new Map();
+    for (const route of routes) {
+      if (names.has(route.targetWorkspaceId)) continue;
+      names.set(
+        route.targetWorkspaceId,
+        (await getWorkspace6(deps.db, route.targetWorkspaceId))?.name ?? null
+      );
+    }
+    return c.json(
+      SlackChannelRouteListResponse.parse({
+        routingEnabled: deps.settings.slackWorkspaceRoutingEnabled,
+        routes: routes.map((route) => ({
+          slackChannelId: route.slackChannelId,
+          targetWorkspaceId: route.targetWorkspaceId,
+          targetWorkspaceName: names.get(route.targetWorkspaceId) ?? null,
+          source: route.source,
+          updatedAt: route.updatedAt.toISOString()
+        }))
+      })
+    );
+  });
+  app.put("/v1/workspaces/:workspaceId/integrations/slack/channel-routes", async (c) => {
+    const workspaceId = c.req.param("workspaceId");
+    const grant = await requireAccessGrant44(c, deps, workspaceId, "workspace:admin");
+    const payload = UpdateSlackChannelRoutesRequest.parse(await c.req.json());
+    const home = { accountId: grant.accountId, workspaceId };
+    const installation = await listSlackInstallationBindings2(deps.db, home);
+    const binding = installation.find(
+      (candidate) => candidate.connectionId === payload.connectionId
+    );
+    if (!binding) {
+      throw new HTTPException70(404, { message: "Slack installation not found" });
+    }
+    const callerPersonalWorkspaceId = await namedSubjectPersonalWorkspaceId(deps.db, {
+      accountId: grant.accountId,
+      subjectId: grant.subjectId
+    });
+    for (const route of payload.routes) {
+      if (route.targetWorkspaceId === null) continue;
+      const authorized = await resolveSlackTargetAuthority(deps.db, {
+        subjectId: grant.subjectId,
+        targetAccountId: grant.accountId,
+        targetWorkspaceId: route.targetWorkspaceId
+      });
+      if (!authorized || !hasPermission22(authorized.permissions, "sessions:create")) {
+        throw new HTTPException70(403, {
+          message: `you cannot start work in the workspace chosen for ${route.slackChannelId}`
+        });
+      }
+      if (callerPersonalWorkspaceId !== null && route.targetWorkspaceId === callerPersonalWorkspaceId) {
+        throw new HTTPException70(422, {
+          message: `a channel cannot be routed to a personal workspace: work started in ${route.slackChannelId} would be invisible to everyone else in it`
+        });
+      }
+    }
+    for (const route of payload.routes) {
+      if (route.targetWorkspaceId === null) {
+        await deleteSlackChannelRoute(deps.db, home, {
+          connectionId: payload.connectionId,
+          slackChannelId: route.slackChannelId
+        });
+        continue;
+      }
+      await upsertSlackChannelRoute(deps.db, home, {
+        connectionId: payload.connectionId,
+        slackTeamId: binding.slackTeamId,
+        slackChannelId: route.slackChannelId,
+        targetAccountId: grant.accountId,
+        targetWorkspaceId: route.targetWorkspaceId,
+        decidedBySubjectId: grant.subjectId,
+        decidedBySlackUserId: "admin",
+        source: "admin"
+      });
+    }
+    return c.json({ ok: true });
+  });
   app.get("/v1/workspaces/:workspaceId/integrations/slack/reaction-channels", async (c) => {
     const workspaceId = c.req.param("workspaceId");
     const grant = await requireAccessGrant44(c, deps, workspaceId, "workspace:admin");
@@ -56680,13 +56924,222 @@ async function resolveSlackRouteForEntry(deps, home, entry2, subjectId, options)
 }
 async function postSlackRouteRefusal(deps, client, entry2, refusal) {
   const available = refusal.candidates.map((candidate) => candidate.label);
-  const text = refusal.reason === "no_access_to_named" ? `OpenGeni does not see a workspace named ${JSON.stringify(refusal.requested ?? "")} that you can start work in.${available.length > 0 ? ` You can use: ${available.join(", ")}.` : ""} No session was created.` : refusal.reason === "no_access_to_route" ? `OpenGeni starts work from this conversation in ${refusal.requested ?? "another workspace"}, and you do not have access to it. Ask an OpenGeni administrator for access to that workspace, or point this conversation somewhere else in OpenGeni under Capabilities, then Slack. No session was created.` : "OpenGeni has no workspace it can start this task in for you. Ask an OpenGeni administrator to give you access to one. No session was created.";
+  const text = refusal.reason === "no_access_to_named" ? `OpenGeni does not see a workspace named ${JSON.stringify(refusal.requested ?? "")} that you can start work in from here.${available.length > 0 ? ` You can use: ${available.join(", ")}.` : ""} No session was created.` : refusal.reason === "no_access_to_route" ? `OpenGeni starts work from this conversation in ${refusal.requested ?? "another workspace"}, and you do not have access to it. Request access: ${linkUrl(
+    deps,
+    {
+      // Minted for the workspace they actually need, not the
+      // installation's. The token only decides which workspace an
+      // access request may be raised for; approval is unchanged.
+      workspaceId: refusal.workspaceId ?? entry2.workspaceId,
+      connectionId: entry2.connectionId,
+      slackTeamId: entry2.slackTeamId,
+      slackUserId: entry2.slackUserId
+    },
+    entry2.createdAt.getTime()
+  )}. No session was created.` : (
+    // Deliberately "from this conversation" rather than "for you": in a
+    // channel this also fires for someone whose only workspace is their
+    // own personal one, and telling that person they have no workspace
+    // at all would be false. Their bot DM still works.
+    "OpenGeni has no workspace it can start this task in from this conversation. Ask an OpenGeni administrator to give you access to one, or message OpenGeni directly to work in your own workspace. No session was created."
+  );
   await client.postMessage({
     operationId: deterministicUuid2(`slack-route-denied:${entry2.id}:${refusal.reason}`),
     userId: entry2.slackUserId,
     text: boundedOutput(text)
   });
 }
+function boundedSlackRouteLabel(label) {
+  const encoder3 = new TextEncoder();
+  if (encoder3.encode(label).length <= 72) return label;
+  let bounded = label;
+  while (bounded.length > 0 && encoder3.encode(`${bounded}...`).length > 72) {
+    bounded = bounded.slice(0, -1);
+  }
+  return `${bounded}...`;
+}
+function withWorkspaceLine(label, text, blocks) {
+  if (!label) return blocks ? { text, blocks } : { text };
+  const suffix = `
+-> ${label}`;
+  const body4 = boundedOutput(text, MAX_SLACK_TEXT_CHARS - suffix.length);
+  const line = {
+    type: "context",
+    elements: [{ type: "mrkdwn", text: `-> ${label}` }]
+  };
+  return {
+    text: `${body4}${suffix}`,
+    ...blocks ? { blocks: [...blocks, line] } : {}
+  };
+}
+function slackPostSeed(interaction, seed) {
+  return interaction.routedWorkspaceLabel ? `${seed}:v2` : seed;
+}
+var SLACK_ROUTE_SOURCES_WORTH_NAMING = /* @__PURE__ */ new Set([
+  // Not "thread": a mapped thread reuses the interaction that already exists,
+  // so it inherits the label frozen when that interaction was created and never
+  // reaches the writer below.
+  "prefix",
+  "channel",
+  "dm_route",
+  "dm_personal"
+]);
+async function routedWorkspaceLabelFor(deps, resolution) {
+  if (!SLACK_ROUTE_SOURCES_WORTH_NAMING.has(resolution.source)) return null;
+  const label = resolution.label ?? (await getWorkspace6(deps.db, resolution.workspaceId))?.name;
+  if (!label) return null;
+  const bounded = boundedSlackRouteLabel(label);
+  return bounded.length > 0 ? bounded : null;
+}
+var SLACK_ROUTE_PROMPT_TTL_MS = 24 * 60 * 60 * 1e3;
+var MAX_SLACK_ROUTE_PROMPT_BUTTONS = 5;
+async function askSlackRouteChoice(deps, client, home, entry2, candidates) {
+  const offered = candidates.slice(0, MAX_SLACK_ROUTE_PROMPT_BUTTONS);
+  const bounded = offered.map((candidate) => ({
+    ...candidate,
+    label: boundedSlackRouteLabel(candidate.label)
+  }));
+  const opened = await openSlackRoutePrompt(deps.db, home, {
+    connectionId: entry2.connectionId,
+    inboxId: entry2.id,
+    slackTeamId: entry2.slackTeamId,
+    slackUserId: entry2.slackUserId,
+    slackChannelId: entry2.slackChannelId,
+    slackMessageTs: entry2.slackMessageTs,
+    providerEventId: entry2.providerEventId,
+    triggerKind: entry2.triggerKind,
+    requestText: entry2.text,
+    hasFiles: entry2.hasFiles,
+    slackThreadTs: entry2.slackThreadTs,
+    messageOperationId: deterministicUuid2(`slack-route-prompt:${entry2.id}`),
+    expiresAt: new Date(Date.now() + SLACK_ROUTE_PROMPT_TTL_MS),
+    candidates: bounded
+  });
+  if (!opened) return;
+  const where = opened.prompt.slackChannelId.startsWith("D") ? "your messages with OpenGeni" : `<#${opened.prompt.slackChannelId}>`;
+  const blocks = [
+    {
+      type: "section",
+      text: {
+        type: "mrkdwn",
+        text: `OpenGeni can start this task in more than one workspace. Pick where ${where} should work. This choice is remembered.`
+      }
+    },
+    {
+      type: "actions",
+      block_id: "opengeni-route-choice",
+      elements: [
+        ...opened.prompt.options.map((option) => ({
+          type: "button",
+          action_id: "opengeni.route.select",
+          value: option.id,
+          text: { type: "plain_text", text: option.candidateLabel }
+        })),
+        {
+          type: "button",
+          action_id: "opengeni.route.cancel",
+          value: opened.prompt.options[0]?.id ?? opened.prompt.id,
+          text: { type: "plain_text", text: "Not now" }
+        }
+      ]
+    }
+  ];
+  const url = slackWorkspaceUrl(deps, home.workspaceId);
+  blocks.push({
+    type: "section",
+    text: {
+      type: "mrkdwn",
+      text: url ? `You can change this later in <${url}|OpenGeni>, under Capabilities, then Slack.` : "You can change this later in OpenGeni, under Capabilities, then Slack."
+    }
+  });
+  await client.postMessage({
+    operationId: opened.prompt.messageOperationId,
+    userId: opened.prompt.slackUserId,
+    text: boundedOutput(
+      `OpenGeni can start this task in more than one workspace. Pick where ${where} should work.`
+    ),
+    blocks
+  });
+}
+async function handleSlackRouteChoice(deps, home, entry2, actionId, optionId) {
+  if (!deps.settings.slackWorkspaceRoutingEnabled) {
+    throw new SlackInteractionPermanentError("slack_route_choice_unavailable");
+  }
+  const found = await getSlackRoutePromptByOption(deps.db, home, optionId);
+  if (!found) throw new SlackInteractionPermanentError("slack_route_prompt_invalid");
+  const { prompt, chosen } = found;
+  if (prompt.slackUserId !== entry2.slackUserId) {
+    throw new SlackInteractionPermanentError("slack_route_prompt_user_mismatch");
+  }
+  const client = await createOpenGeniSlackBotInteractionClient(deps, {
+    ...home,
+    connectionId: entry2.connectionId,
+    subjectId: SLACK_INTERACTION_BOT_SUBJECT_ID
+  });
+  const replaceCard = async (outcome, text) => {
+    await client.updateMessage({
+      operationId: deterministicUuid2(
+        `slack-route-answered:${prompt.id}:${actionId}:${chosen.id}:${outcome}`
+      ),
+      channelId: entry2.slackChannelId,
+      timestamp: entry2.slackMessageTs,
+      text,
+      // Every button goes with the card, so a sibling option cannot be pressed
+      // after the question is settled.
+      blocks: [{ type: "section", text: { type: "mrkdwn", text } }]
+    });
+  };
+  if (actionId === "opengeni.route.cancel") {
+    const cancelled = await settleSlackRoutePrompt(deps.db, home, {
+      promptId: prompt.id,
+      status: "cancelled"
+    });
+    await replaceCard(
+      cancelled ? "cancelled" : "already_settled",
+      cancelled ? "OpenGeni did not start this task. No session was created." : "OpenGeni already settled this choice."
+    );
+    return;
+  }
+  const link = await getSlackBotUserLink(
+    deps.db,
+    home.workspaceId,
+    entry2.connectionId,
+    entry2.slackUserId
+  );
+  const grant = link ? await resolveSlackTargetAuthority(deps.db, {
+    subjectId: link.subjectId,
+    targetAccountId: chosen.candidateAccountId,
+    targetWorkspaceId: chosen.candidateWorkspaceId
+  }) : null;
+  if (!grant || !hasPermission22(grant.permissions, "sessions:create")) {
+    await client.postMessage({
+      operationId: deterministicUuid2(`slack-route-denied:${prompt.id}:${chosen.id}`),
+      userId: entry2.slackUserId,
+      text: boundedOutput(
+        `OpenGeni cannot start work in ${chosen.candidateLabel}: you do not have access to it. No session was created. Pick another workspace on the card, or ask an OpenGeni administrator for access.`
+      )
+    });
+    return;
+  }
+  const answered = await answerSlackRoutePrompt(deps.db, home, {
+    promptId: prompt.id,
+    targetAccountId: chosen.candidateAccountId,
+    targetWorkspaceId: chosen.candidateWorkspaceId,
+    answeredBySubjectId: grant.subjectId,
+    decidedBySlackUserId: entry2.slackUserId
+  });
+  if (!answered.answered) {
+    await replaceCard(
+      "settled",
+      "OpenGeni already settled this choice. No new session was created."
+    );
+    return;
+  }
+  await replaceCard(
+    "answered",
+    `OpenGeni will use *${chosen.candidateLabel}* here. You can change this in OpenGeni under Capabilities, then Slack.`
+  );
+}
 async function processSlackInboxEntry(deps, entry2) {
   if (entry2.triggerKind === "block_action") {
     await processSlackBlockAction(deps, entry2);
@@ -56743,19 +57196,18 @@ async function processSlackInboxEntry(deps, entry2) {
     await client.postMessage({
       operationId: deterministicUuid2(`slack-link:${entry2.id}`),
       userId: entry2.slackUserId,
-      text: `Link your Slack identity to OpenGeni before starting work: ${linkUrl(deps, entry2)}. No session was created.`
+      text: `Link your Slack identity to OpenGeni before starting work: ${linkUrl(deps, entry2, entry2.createdAt.getTime())}. No session was created.`
     });
     return;
   }
   const resolution = await resolveSlackRouteForEntry(deps, home, entry2, link.subjectId, {
     botUserId: installation.botUserId,
     threadTenancy: existing ? { accountId: existing.accountId, workspaceId: existing.workspaceId } : null,
-    // The first-use picker does not exist yet, so genuine ambiguity keeps the
-    // installation's workspace rather than inventing an answer.
-    askEnabled: false
+    askEnabled: true
   });
   if (resolution.kind === "ask") {
-    throw new SlackInteractionPermanentError("slack_route_choice_unavailable");
+    await askSlackRouteChoice(deps, client, home, entry2, resolution.candidates);
+    return;
   }
   if (resolution.kind === "denied") {
     await postSlackRouteRefusal(deps, client, entry2, resolution);
@@ -56862,6 +57314,11 @@ async function processSlackInboxEntry(deps, entry2) {
   }
   const { interaction } = await getOrCreateSlackInteraction(deps.db, {
     ...target,
+    // Frozen here, after authorization, so a workspace name is never shown to
+    // someone who could not reach it. Null when the routing decision was not a
+    // genuine choice, which is what keeps the line off every message in an
+    // install that only ever had one workspace.
+    routedWorkspaceLabel: await routedWorkspaceLabelFor(deps, resolution),
     connectionId: entry2.connectionId,
     slackTeamId: entry2.slackTeamId,
     slackChannelId: entry2.slackChannelId,
@@ -57087,7 +57544,7 @@ async function acknowledgeSlackSession(deps, client, interaction, entry2) {
   const directMessageShortcut = isDirectMessageShortcut(entry2);
   const privateHandoff = !directMessageShortcut && interaction.visibility === "private" && entry2.triggerKind !== "dm";
   const privateBotDm = directMessageShortcut || privateHandoff;
-  const operationId = deterministicUuid2(`slack-ack:${interaction.id}`);
+  const operationId = deterministicUuid2(slackPostSeed(interaction, `slack-ack:${interaction.id}`));
   const started = directMessageShortcut ? `OpenGeni started a private task from the selected DM message. ${openSessionText(deps, interaction.workspaceId, interaction.sessionId)} The source DM was not opened to the bot or made workspace-visible.` : privateHandoff ? `OpenGeni started a private task from the selected Slack conversation. ${openSessionText(deps, interaction.workspaceId, interaction.sessionId)} Results stay private unless a separate authorized publication is approved.` : `OpenGeni started this task. ${openSessionText(deps, interaction.workspaceId, interaction.sessionId)}`;
   const showHint = await resolveSlackInteractionFirstTaskHint(deps.db, {
     // The identity link is HOME; the interaction row is TARGET.
@@ -57103,19 +57560,19 @@ async function acknowledgeSlackSession(deps, client, interaction, entry2) {
     sessionEventSequence: 0,
     state: "active"
   });
+  const acknowledgement = withWorkspaceLine(
+    interaction.routedWorkspaceLabel,
+    text,
+    controls.length > 0 ? [{ type: "section", text: { type: "mrkdwn", text } }, ...controls] : void 0
+  );
   const ack = await client.postMessage({
     operationId,
     ...privateBotDm ? { userId: entry2.slackUserId } : {
       channelId: entry2.slackChannelId,
       ...entry2.triggerKind === "slash_command" ? {} : { threadTimestamp: entry2.slackThreadTs ?? entry2.slackMessageTs }
     },
-    text,
-    ...controls.length > 0 ? {
-      blocks: [
-        { type: "section", text: { type: "mrkdwn", text } },
-        ...controls
-      ]
-    } : {}
+    text: acknowledgement.text,
+    ...acknowledgement.blocks ? { blocks: acknowledgement.blocks } : {}
   });
   if (entry2.triggerKind === "slash_command" || privateBotDm) {
     const rekeyed = await rekeySlackInteractionRoute(deps.db, {
@@ -57283,6 +57740,10 @@ async function processSlackReactionInboxEntry(deps, entry2) {
   }
   const { interaction } = await getOrCreateSlackInteraction(deps.db, {
     ...target,
+    // A reaction routes exactly like a mention, so it names its workspace the
+    // same way. Resolved after `authorizeTarget`, so a name never reaches
+    // somebody who could not reach the workspace.
+    routedWorkspaceLabel: await routedWorkspaceLabelFor(deps, routeResolution),
     connectionId: entry2.connectionId,
     slackTeamId: entry2.slackTeamId,
     slackChannelId: entry2.slackChannelId,
@@ -57360,11 +57821,15 @@ async function acknowledgeSlackReactionSession(deps, client, interaction, emoji)
   if (!interaction.sessionId) {
     throw new Error("Slack reaction acknowledgement requires a bound session");
   }
+  const started = `OpenGeni started from the :${emoji}: reaction. ${openSessionText(deps, interaction.workspaceId, interaction.sessionId)} If the intended action is unclear, OpenGeni will ask in this thread. Reply here to continue, or reply \`stop\` to stop.`;
+  const rendered = withWorkspaceLine(interaction.routedWorkspaceLabel, started);
   await client.postMessage({
-    operationId: deterministicUuid2(`slack-reaction-ack:${interaction.id}`),
+    operationId: deterministicUuid2(
+      slackPostSeed(interaction, `slack-reaction-ack:${interaction.id}`)
+    ),
     channelId: interaction.slackChannelId,
     threadTimestamp: interaction.slackThreadTs,
-    text: `OpenGeni started from the :${emoji}: reaction. ${openSessionText(deps, interaction.workspaceId, interaction.sessionId)} If the intended action is unclear, OpenGeni will ask in this thread. Reply here to continue, or reply \`stop\` to stop.`
+    text: rendered.text
   });
 }
 function slackReactionPreparedEntry(entry2, context, prepared) {
@@ -57715,6 +58180,10 @@ async function processSlackBlockAction(deps, entry2) {
   if (!route || route.accountId !== entry2.accountId || route.workspaceId !== entry2.workspaceId || route.connectionId !== entry2.connectionId) {
     throw new SlackInteractionPermanentError("slack_action_installation_changed");
   }
+  if (actionId === "opengeni.route.select" || actionId === "opengeni.route.cancel") {
+    await handleSlackRouteChoice(deps, home, entry2, actionId, handleId);
+    return;
+  }
   const handleTenancy = await probeSlackActionHandleTenancy(deps.db, {
     accountId: home.accountId,
     connectionId: entry2.connectionId,
@@ -57774,14 +58243,21 @@ async function processSlackBlockAction(deps, entry2) {
     sessionId: handle.sessionId
   });
   const outcome = await executeSlackAction(deps, grant, interaction, handle);
-  const acknowledgementOperationId = deterministicUuid2(`slack-ack:${interaction.id}`);
+  const acknowledgementOperationId = deterministicUuid2(
+    slackPostSeed(interaction, `slack-ack:${interaction.id}`)
+  );
   const updateText = interaction.firstTaskHint === true && handle.messageOperationId === acknowledgementOperationId ? `${outcome.text}${slackFirstTaskHintText(deps)}` : outcome.text;
+  const rendered = withWorkspaceLine(interaction.routedWorkspaceLabel, updateText, [
+    { type: "section", text: { type: "mrkdwn", text: updateText } }
+  ]);
   await client.updateMessage({
-    operationId: deterministicUuid2(`slack-action-update:${handle.id}:${outcome.result}`),
+    operationId: deterministicUuid2(
+      slackPostSeed(interaction, `slack-action-update:${handle.id}:${outcome.result}`)
+    ),
     channelId: entry2.slackChannelId,
     timestamp: entry2.slackMessageTs,
-    text: updateText,
-    blocks: [{ type: "section", text: { type: "mrkdwn", text: updateText } }]
+    text: rendered.text,
+    ...rendered.blocks ? { blocks: rendered.blocks } : {}
   });
   await settleSlackInteractionActionHandles(deps.db, {
     ...target,
@@ -58125,7 +58601,7 @@ function slackApprovalSummaries(payload) {
 }
 async function slackApprovalCard(deps, interaction, event, mention, requesterAuthorized) {
   const operationId = deterministicUuid2(
-    `slack-delivery:${interaction.id}:${event.sequence}:approval`
+    slackPostSeed(interaction, `slack-delivery:${interaction.id}:${event.sequence}:approval`)
   );
   const approvals = slackApprovalSummaries(event.payload);
   const fallback = approvals.length ? `${mention}OpenGeni needs approval for ${approvals.map((approval) => approval.name).join(", ")}.` : `${mention}OpenGeni needs approval. Open the task to review it.`;
@@ -58253,7 +58729,7 @@ async function slackHumanInputCard(deps, interaction, event, mention, requesterA
   );
   if (!request || request.status !== "pending") return null;
   const operationId = deterministicUuid2(
-    `slack-delivery:${interaction.id}:${event.sequence}:human-input`
+    slackPostSeed(interaction, `slack-delivery:${interaction.id}:${event.sequence}:human-input`)
   );
   const text = `${mention}OpenGeni needs your input:
 ${formatQuestions(request.questions)}
@@ -58558,30 +59034,32 @@ async function deliverSlackSessionEvents(deps, interaction, claimHolderId) {
         );
         if (posted?.slackChannelId && posted.slackMessageTimestamp) {
           const text = boundedOutput(`${requester.mention}${existingProgress.text}`);
+          const rendered = withWorkspaceLine(
+            interaction.routedWorkspaceLabel,
+            text,
+            publicationBlocks.length > 0 ? [
+              { type: "section", text: { type: "mrkdwn", text } },
+              ...publicationBlocks
+            ] : void 0
+          );
           await client.updateMessage({
             operationId: deterministicUuid2(
-              `slack-terminal-update:${interaction.id}:${event.sequence}`
+              slackPostSeed(
+                interaction,
+                `slack-terminal-update:${interaction.id}:${event.sequence}`
+              )
             ),
             channelId: posted.slackChannelId,
             timestamp: posted.slackMessageTimestamp,
-            text,
-            ...publicationBlocks.length > 0 ? {
-              blocks: [
-                {
-                  type: "section",
-                  text: {
-                    type: "mrkdwn",
-                    text
-                  }
-                },
-                ...publicationBlocks
-              ]
+            text: rendered.text,
+            ...rendered.blocks ? {
+              blocks: rendered.blocks
             } : {}
           });
         }
       } else {
         const operationId = deterministicUuid2(
-          `slack-delivery:${interaction.id}:${event.sequence}:final`
+          slackPostSeed(interaction, `slack-delivery:${interaction.id}:${event.sequence}:final`)
         );
         const text = boundedOutput(
           `${requester.mention}${output || "OpenGeni finished this task."}`
@@ -58658,13 +59136,16 @@ function slackTerminalProgressSameTurn(event, delivery, interaction, samePageTer
   if (event.turnId || delivery.turnId) return false;
   return delivery.sessionEventSequence === interaction.lastDeliveredSessionEventSequence || samePageTerminalSequences.has(delivery.sessionEventSequence);
 }
-async function postDelivery(client, interaction, event, text, kind, operationId = deterministicUuid2(`slack-delivery:${interaction.id}:${event.sequence}:${kind}`), blocks) {
+async function postDelivery(client, interaction, event, text, kind, operationId = deterministicUuid2(
+  slackPostSeed(interaction, `slack-delivery:${interaction.id}:${event.sequence}:${kind}`)
+), blocks) {
+  const rendered = withWorkspaceLine(interaction.routedWorkspaceLabel, boundedOutput(text), blocks);
   await client.postMessage({
     operationId,
     channelId: interaction.slackChannelId,
     threadTimestamp: interaction.slackThreadTs,
-    text: boundedOutput(text),
-    ...blocks ? { blocks } : {}
+    text: rendered.text,
+    ...rendered.blocks ? { blocks: rendered.blocks } : {}
   });
 }
 async function enqueueNormalizedSlackInteraction(deps, route, entry2) {
@@ -58730,7 +59211,9 @@ var SLACK_BLOCK_ACTION_IDS = /* @__PURE__ */ new Set([
   "opengeni.session.status",
   "opengeni.session.pause",
   "opengeni.session.resume",
-  "opengeni.shared_result.publish"
+  "opengeni.shared_result.publish",
+  "opengeni.route.select",
+  "opengeni.route.cancel"
 ]);
 function normalizedBlockActionInteraction(payload) {
   const team = record6(payload.team);
@@ -58926,13 +59409,13 @@ function makeRecurringText(deps, workspaceId, sessionId) {
 function slackSchedulesUrl(deps, workspaceId) {
   return safeSlackActionUrl(deps, `/workspaces/${encodeURIComponent(workspaceId)}/schedules`);
 }
-function linkUrl(deps, entry2) {
+function linkUrl(deps, entry2, mintedAtMs) {
   const base = deps.settings.webBaseUrl ?? deps.settings.publicBaseUrl;
   const signingSecret = deps.settings.slackSigningSecret;
   if (!base || !signingSecret) return "OpenGeni Settings \u2192 Integrations \u2192 Slack";
   const url = new URL(`/workspaces/${entry2.workspaceId}/capabilities`, base);
   url.hash = new URLSearchParams({
-    slack_link: createSlackUserLinkToken(signingSecret, entry2)
+    slack_link: createSlackUserLinkToken(signingSecret, entry2, mintedAtMs)
   }).toString();
   return url.toString();
 }
@@ -59046,8 +59529,8 @@ function boundedSlackChildDetail(value) {
   const collapsed = value.replace(/\s+/gu, " ").trim();
   return collapsed.length <= MAX_SLACK_CHILD_DETAIL_CHARS ? collapsed : `${collapsed.slice(0, MAX_SLACK_CHILD_DETAIL_CHARS - 1)}\u2026`;
 }
-function boundedOutput(value) {
-  return value.length <= MAX_SLACK_TEXT_CHARS ? value : `${value.slice(0, MAX_SLACK_TEXT_CHARS - 20)}
+function boundedOutput(value, limit = MAX_SLACK_TEXT_CHARS) {
+  return value.length <= limit ? value : `${value.slice(0, limit - 20)}
 \u2026 output truncated`;
 }
 function safePayloadText(payload, field) {
@@ -60220,6 +60703,10 @@ var routeLabelPatterns = [
     pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/events$/,
     label: "/v1/workspaces/:workspaceId/sessions/:id/events"
   },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/turns$/,
+    label: "/v1/workspaces/:workspaceId/sessions/:id/turns"
+  },
   {
     pattern: /^\/v1\/workspaces\/[^/]+\/sessions\/[^/]+\/queue\/[^/]+\/(move|edit|steer|delete)$/,
     label: "/v1/workspaces/:workspaceId/sessions/:id/queue/:turnId/:action"
@@ -60673,6 +61160,10 @@ var routeLabelPatterns = [
   {
     pattern: /^\/v1\/github\/oauth\/callback$/,
     label: "/v1/github/oauth/callback"
+  },
+  {
+    pattern: /^\/v1\/workspaces\/[^/]+$/,
+    label: "/v1/workspaces/:workspaceId"
   }
 ];
 function routeLabel(pathname) {
@@ -60729,4 +61220,4 @@ export {
   withDefaultEnabledCapabilityMcpTools,
   workflowIdForSession3 as workflowIdForSession
 };
-//# sourceMappingURL=chunk-QKDFBBUE.js.map
+//# sourceMappingURL=chunk-3TP54PPX.js.map