From d0a8300e638bb00eb207b0e1960b2c6a71bead90 Mon Sep 17 00:00:00 2001
From: JeremyFunk <jeremy@kombo.dev>
Date: Tue, 21 Jul 2026 13:23:29 +0200
Subject: [PATCH 1/8] feat(slack-agent): eve-based Slack agent with Railway
 self-deploy

Adds apps/slack-agent, a standalone eve-framework Slack agent that
deploys itself to Railway (Docker) rather than Cloudflare Workers:

- Workers AI (REST) as the model backend, self-managed Slack app
  (bot token + signing secret) instead of a Connect integration
- @workflow/world-postgres for durable runs; EVE_WORKFLOW_WORLD is
  baked in at build time via the Dockerfile
- excluded from the bun workspace ("!apps/slack-agent") so its own
  bun.lock and eve toolchain resolve independently

Also adds scripts/ingest-dummy.ts for pushing dummy OTLP traces/logs
at the local ingest gateway, drops turbo concurrency to 15, and
gitignores the .eve model-catalog cache.
---
 .gitignore                               |   2 +
 apps/slack-agent/.dockerignore           |   8 +
 apps/slack-agent/.env.local.example      |  38 ++
 apps/slack-agent/.gitignore              |  11 +
 apps/slack-agent/Dockerfile              |  39 ++
 apps/slack-agent/README.md               | 150 ++++++
 apps/slack-agent/agent/agent.ts          |  48 ++
 apps/slack-agent/agent/channels/eve.ts   |  27 ++
 apps/slack-agent/agent/channels/slack.ts |  17 +
 apps/slack-agent/agent/instructions.md   |  18 +
 apps/slack-agent/agent/tools/get_time.ts |  37 ++
 apps/slack-agent/bun.lock                | 412 +++++++++++++++++
 apps/slack-agent/docker-entrypoint.sh    |  19 +
 apps/slack-agent/package.json            |  34 ++
 apps/slack-agent/railway.json            |  13 +
 apps/slack-agent/tsconfig.json           |  13 +
 package.json                             |   1 +
 scripts/ingest-dummy.ts                  | 561 +++++++++++++++++++++++
 turbo.json                               |   2 +-
 19 files changed, 1449 insertions(+), 1 deletion(-)
 create mode 100644 apps/slack-agent/.dockerignore
 create mode 100644 apps/slack-agent/.env.local.example
 create mode 100644 apps/slack-agent/.gitignore
 create mode 100644 apps/slack-agent/Dockerfile
 create mode 100644 apps/slack-agent/README.md
 create mode 100644 apps/slack-agent/agent/agent.ts
 create mode 100644 apps/slack-agent/agent/channels/eve.ts
 create mode 100644 apps/slack-agent/agent/channels/slack.ts
 create mode 100644 apps/slack-agent/agent/instructions.md
 create mode 100644 apps/slack-agent/agent/tools/get_time.ts
 create mode 100644 apps/slack-agent/bun.lock
 create mode 100644 apps/slack-agent/docker-entrypoint.sh
 create mode 100644 apps/slack-agent/package.json
 create mode 100644 apps/slack-agent/railway.json
 create mode 100644 apps/slack-agent/tsconfig.json
 create mode 100644 scripts/ingest-dummy.ts

diff --git a/.gitignore b/.gitignore
index a15ba75ba..91bcd4d40 100644
--- a/.gitignore
+++ b/.gitignore
@@ -32,6 +32,8 @@ apps/api/.data/
 apps/api/scripts/.bench/
 
 .alchemy
+# eve agent build/model-catalog cache
+.eve
 .mcp.json
 .dev.vars
 apps/chat-agent/.dev.vars
diff --git a/apps/slack-agent/.dockerignore b/apps/slack-agent/.dockerignore
new file mode 100644
index 000000000..f3e61e1e1
--- /dev/null
+++ b/apps/slack-agent/.dockerignore
@@ -0,0 +1,8 @@
+node_modules
+.eve
+.output
+.nitro
+.env*
+!.env.local.example
+*.tsbuildinfo
+.DS_Store
diff --git a/apps/slack-agent/.env.local.example b/apps/slack-agent/.env.local.example
new file mode 100644
index 000000000..436f5ad34
--- /dev/null
+++ b/apps/slack-agent/.env.local.example
@@ -0,0 +1,38 @@
+# Copy to .env.local (gitignored) for local dev, and set the same values as
+# service variables on Railway. eve auto-loads .env.local from the app root.
+
+# ── Model: Cloudflare Workers AI (REST) ─────────────────────────────────────
+# Dashboard → AI → Workers AI, and an API token scoped to "Workers AI".
+CLOUDFLARE_ACCOUNT_ID=
+CLOUDFLARE_API_TOKEN=
+# Optional overrides (defaults live in agent/agent.ts):
+# WORKERS_AI_MODEL=@cf/meta/llama-3.3-70b-instruct-fp8-fast   # must support tool calling
+# WORKERS_AI_CONTEXT_WINDOW=128000
+
+# ── Slack (self-managed app — no Vercel Connect) ────────────────────────────
+# From your Slack app: OAuth & Permissions → Bot User OAuth Token (xoxb-...),
+# and Basic Information → Signing Secret.
+SLACK_BOT_TOKEN=
+SLACK_SIGNING_SECRET=
+
+# ── Durability: @workflow/world-postgres ────────────────────────────────────
+# NOTE: EVE_WORKFLOW_WORLD is read at BUILD time (eve compiles agent.ts), so it
+# must be set before `bun run build` / `bun run dev` — a runtime-only value is
+# silently ignored and you stay on the on-disk world. The Dockerfile bakes it in
+# for production, so you do NOT need to set it on Railway.
+# Leave it unset locally to use eve's zero-config on-disk world (no Postgres).
+# EVE_WORKFLOW_WORLD=@workflow/world-postgres
+# Railway's Postgres plugin provides DATABASE_URL automatically.
+# DATABASE_URL=postgres://user:pass@host:5432/db        # or WORKFLOW_POSTGRES_URL
+# Public base URL of THIS service, so durable-run callbacks reach
+# /.well-known/workflow/v1/flow. On Railway: https://<your-service>.up.railway.app
+# WORKFLOW_LOCAL_BASE_URL=
+# Tuning (silences the graphile-worker pool<concurrency warning):
+# WORKFLOW_POSTGRES_MAX_POOL_SIZE=10
+# WORKFLOW_POSTGRES_WORKER_CONCURRENCY=10
+
+# ── eve HTTP route auth (browser/API surface; NOT the Slack webhook) ─────────
+# If set, eve's session/stream routes require HTTP Basic. Unset = public (demo).
+# The Slack webhook (/eve/v1/slack) is always verified via SLACK_SIGNING_SECRET.
+# ROUTE_AUTH_BASIC_USER=admin
+# ROUTE_AUTH_BASIC_PASSWORD=
diff --git a/apps/slack-agent/.gitignore b/apps/slack-agent/.gitignore
new file mode 100644
index 000000000..5eeb72c68
--- /dev/null
+++ b/apps/slack-agent/.gitignore
@@ -0,0 +1,11 @@
+node_modules
+.env*
+!.env.local.example
+.eve
+.vercel
+.next
+.output
+.nitro
+dist
+.DS_Store
+*.tsbuildinfo
diff --git a/apps/slack-agent/Dockerfile b/apps/slack-agent/Dockerfile
new file mode 100644
index 000000000..bc84a9140
--- /dev/null
+++ b/apps/slack-agent/Dockerfile
@@ -0,0 +1,39 @@
+# Node runtime + bun for dependency management.
+#
+# eve runs on Node, not bun: its dev server uses crossws' Node adapter, which
+# refuses non-Node runtimes ("Using Node.js adapter in an incompatible
+# environment"), and eve hard-requires Node >=24. Bun is used only as the
+# package manager (fast installs + bun.lock), matching the rest of the repo.
+# Keeping Node here means local and container run the same runtime.
+#
+# The Railway service's root directory is apps/slack-agent, so the build
+# context is this folder (no monorepo involvement).
+FROM node:24-slim
+
+# Bun, for `bun install` only.
+COPY --from=oven/bun:1.3-slim /usr/local/bin/bun /usr/local/bin/bun
+
+WORKDIR /app
+
+# Install deps first for layer caching, from the committed bun.lock.
+COPY package.json bun.lock ./
+RUN bun install --frozen-lockfile
+
+COPY tsconfig.json ./
+COPY agent ./agent
+
+# IMPORTANT: eve resolves `experimental.workflow.world` at BUILD time (agent.ts is
+# compiled into eve's manifest), not at runtime. This must be set before the build
+# or the image silently falls back to the ephemeral on-disk local world.
+ENV EVE_WORKFLOW_WORLD=@workflow/world-postgres
+RUN npm run build
+
+COPY docker-entrypoint.sh ./
+RUN chmod +x docker-entrypoint.sh
+
+ENV NODE_ENV=production
+# Railway injects PORT; default for local `docker run`.
+ENV PORT=3000
+EXPOSE 3000
+
+CMD ["./docker-entrypoint.sh"]
diff --git a/apps/slack-agent/README.md b/apps/slack-agent/README.md
new file mode 100644
index 000000000..f1a2afd93
--- /dev/null
+++ b/apps/slack-agent/README.md
@@ -0,0 +1,150 @@
+# @maple/slack-agent
+
+A general-purpose Slack agent built on the [eve](https://eve.dev) framework, **self-deployed to
+Railway** (no Vercel). It answers `@mentions` and DMs, runs tools, and keeps durable multi-turn
+sessions.
+
+This is intentionally **generic** — no Maple domain logic yet. Get the loop working end-to-end
+first, then layer domain tools/instructions on top.
+
+## Architecture
+
+| Concern | Choice | Why |
+| --- | --- | --- |
+| Framework | eve `0.25.x` (durable agent runtime, Nitro HTTP host) | filesystem-first agents |
+| Host | **Railway** container running `eve start` (long-running Node) | eve's supported self-host model; edge Workers is blocked today by a workflow-world protocol gap |
+| Model | **Cloudflare Workers AI** via REST (`workers-ai-provider`) | `createWorkersAI({ accountId, apiKey })` → an AI-SDK model, no Workers runtime needed |
+| Durability | **`@workflow/world-postgres`** (`5.0.0-beta.27`) + Railway Postgres | protocol-compatible with eve's vendored `@workflow/*` 5.0.0-beta line |
+| Slack | **self-managed** (`slackChannel()` + bot token + signing secret) | Vercel Connect is optional; eve verifies webhooks from the signing secret natively |
+
+Key routes (all served by the one container): `POST /eve/v1/session`, `GET /eve/v1/session/:id/stream`,
+`POST /eve/v1/slack` (Slack webhook), `GET /eve/v1/health`, and workflow callbacks under
+`/.well-known/workflow/v1/flow`.
+
+## Project layout
+
+```
+agent/
+  agent.ts            # model (Workers AI) + workflow world selection
+  instructions.md     # system prompt
+  channels/slack.ts   # self-managed Slack channel
+  channels/eve.ts     # auth policy for the browser/API routes
+  tools/get_time.ts   # sample tool proving the tool loop
+Dockerfile            # node:24-slim (+bun for installs), eve build, entrypoint
+docker-entrypoint.sh  # runs the Postgres-world migration, then `eve start`
+railway.json          # DOCKERFILE builder, /eve/v1/health healthcheck
+```
+
+> **Monorepo note:** this app uses **bun** (like the rest of the repo) but is deliberately a
+> **standalone bun project, excluded from the bun workspace** (`"!apps/slack-agent"` in the root
+> `package.json`). That keeps `eve dev`'s interactive TUI out of `bun dev`/`turbo`, and keeps the
+> Docker build hermetic (context = this folder only). It has its own `bun.lock`.
+
+> **Runtime: Node, package manager: bun.** eve runs on **Node ≥24** (it hard-fails below that), and
+> **cannot run on bun** — `eve dev`'s HMR server uses `crossws`' Node adapter, which throws
+> `[crossws] Using Node.js adapter in an incompatible environment` under bun. Production `.output`
+> *does* happen to run on bun, but we deliberately use Node in both places so local and container
+> match. Bun is still the package manager (`bun install`, `bun.lock`), and `bun run <script>` is fine
+> — it honors the `#!/usr/bin/env node` shebang and hands off to Node.
+
+## Local development
+
+```bash
+cd apps/slack-agent
+cp .env.local.example .env.local   # fill in CLOUDFLARE_ACCOUNT_ID + CLOUDFLARE_API_TOKEN
+bun install
+bun run dev                        # eve terminal UI — chat with the agent, test tools
+```
+
+Leaving `EVE_WORKFLOW_WORLD` unset locally uses eve's zero-config on-disk world, so you don't need
+Postgres to iterate on model + tools. To exercise the Postgres world locally: run a Postgres, set
+`DATABASE_URL` **and** `EVE_WORKFLOW_WORLD=@workflow/world-postgres` in `.env.local`, run
+`bun run db:setup` once, then `bun run dev`.
+
+> ⚠️ **`EVE_WORKFLOW_WORLD` is resolved at build time**, not runtime — eve compiles `agent.ts` into
+> its manifest. It must be set when `eve build` runs. Setting it only as a runtime variable leaves
+> you silently on the ephemeral on-disk world. The Dockerfile sets it before `bun run build`.
+
+Drive the HTTP contract without the UI:
+
+```bash
+bunx eve dev --no-ui
+curl -X POST localhost:<port>/eve/v1/session -H 'content-type: application/json' -d '{"message":"hi"}'
+```
+
+## Deploy — external steps (you perform these)
+
+### 1. Create the Slack app
+
+Create an app at <https://api.slack.com/apps> **From an app manifest** and paste this (swap the two
+`request_url`s for your Railway URL after step 2, then reinstall):
+
+```yaml
+display_information:
+  name: Eve Agent
+features:
+  bot_user:
+    display_name: eve-agent
+    always_online: true
+oauth_config:
+  scopes:
+    bot:
+      - app_mentions:read   # receive @mentions
+      - chat:write          # post replies
+      - im:history          # read DMs (message.im)
+      - im:write            # DM the user (auth challenges)
+      - users:read          # attribute speakers
+settings:
+  event_subscriptions:
+    request_url: https://<your-service>.up.railway.app/eve/v1/slack
+    bot_events:
+      - app_mention
+      - message.im
+  interactivity:
+    is_enabled: true
+    request_url: https://<your-service>.up.railway.app/eve/v1/slack
+  socket_mode_enabled: false
+```
+
+Install to your workspace, then copy the **Bot User OAuth Token** (`xoxb-…`) and the **Signing
+Secret** (Basic Information).
+
+### 2. Create the Railway service
+
+- New service → deploy from this repo; set the service **Root Directory** to `apps/slack-agent`
+  (so the Docker build context is this folder). `railway.json` handles builder + healthcheck.
+- Add the **Postgres** plugin (provides `DATABASE_URL`).
+- Set service variables:
+  - `CLOUDFLARE_ACCOUNT_ID`, `CLOUDFLARE_API_TOKEN`
+  - `SLACK_BOT_TOKEN`, `SLACK_SIGNING_SECRET`
+  - `WORKFLOW_LOCAL_BASE_URL=https://<your-service>.up.railway.app` (so durable-run callbacks reach
+    `/.well-known/workflow/v1/flow`)
+  - (`EVE_WORKFLOW_WORLD` is already baked into the image at build time — no need to set it.)
+  - optional: `ROUTE_AUTH_BASIC_PASSWORD` to lock the non-Slack HTTP routes.
+
+Deploy. The entrypoint applies the Postgres-world schema, then starts eve. Check
+`https://<your-service>.up.railway.app/eve/v1/health`.
+
+### 3. Point Slack at the deployment
+
+Set both `request_url`s in the Slack app to `https://<your-service>.up.railway.app/eve/v1/slack`.
+Slack sends a one-time `url_verification` challenge that eve answers automatically. Invite the bot
+to a channel and `@mention` it.
+
+## Verification
+
+- `curl https://<host>/eve/v1/health` → `{"ok":true,"status":"ready",...}`
+- `@mention` the bot → threaded reply with a typing indicator; ask "what time is it in Tokyo?" to
+  exercise the `get_time` tool.
+- A follow-up mention in the same thread resumes the same durable session.
+
+## Notes
+
+- **Model must support tool calling** — eve's default harness is tool-driven. The default
+  `@cf/meta/llama-3.3-70b-instruct-fp8-fast` does; if you switch models, keep that constraint and
+  set `WORKERS_AI_CONTEXT_WINDOW` to the new window.
+- **Auth:** `agent/channels/eve.ts` leaves the browser/API routes public unless
+  `ROUTE_AUTH_BASIC_PASSWORD` is set. The Slack webhook is always signature-verified independently.
+- Edge Cloudflare Workers isn't used because the only Cloudflare Durable-Objects workflow world is
+  built against an older `@workflow` protocol than eve 0.25 requires. Revisit when a `5.0.0-beta`
+  Cloudflare world ships.
diff --git a/apps/slack-agent/agent/agent.ts b/apps/slack-agent/agent/agent.ts
new file mode 100644
index 000000000..5dda618ac
--- /dev/null
+++ b/apps/slack-agent/agent/agent.ts
@@ -0,0 +1,48 @@
+import { defineAgent } from "eve";
+import { createWorkersAI } from "workers-ai-provider";
+
+/**
+ * Cloudflare Workers AI over its REST API (no Workers runtime / AI binding
+ * required), so it works from a plain long-running Node process on Railway.
+ * Credentials are read at request time; missing values here do not break
+ * `eve build`, only live model calls.
+ */
+const workersai = createWorkersAI({
+  accountId: process.env.CLOUDFLARE_ACCOUNT_ID ?? "",
+  apiKey: process.env.CLOUDFLARE_API_TOKEN ?? "",
+});
+
+/**
+ * Must support function/tool calling — eve's default harness is tool-driven.
+ * Override with WORKERS_AI_MODEL without editing code.
+ */
+const modelId = process.env.WORKERS_AI_MODEL ?? "@cf/meta/llama-3.3-70b-instruct-fp8-fast";
+
+/**
+ * Direct (non-Gateway) models carry no AI Gateway context-window metadata, which
+ * eve's compaction needs — so declare it here. Llama 3.3 70B is 128K; override
+ * with WORKERS_AI_CONTEXT_WINDOW if you switch models.
+ */
+const contextWindowTokens = Number(process.env.WORKERS_AI_CONTEXT_WINDOW ?? 128_000);
+
+/**
+ * Durable workflow state ("world").
+ *
+ * NOTE: eve resolves this at BUILD time — agent.ts is compiled into eve's
+ * manifest, so EVE_WORKFLOW_WORLD must be set when `eve build` runs, not just at
+ * runtime. The Dockerfile sets it before building; setting it only as a runtime
+ * variable silently leaves you on the ephemeral on-disk local world.
+ *
+ * - Production (Railway): baked in as @workflow/world-postgres by the Dockerfile.
+ * - Local dev: leave it unset to use eve's zero-config on-disk local world, so
+ *   you can exercise the model + Slack loop without standing up Postgres.
+ */
+const workflowWorld = process.env.EVE_WORKFLOW_WORLD;
+
+export default defineAgent({
+  model: workersai(modelId),
+  modelContextWindowTokens: contextWindowTokens,
+  ...(workflowWorld
+    ? { experimental: { workflow: { world: workflowWorld } } }
+    : {}),
+});
diff --git a/apps/slack-agent/agent/channels/eve.ts b/apps/slack-agent/agent/channels/eve.ts
new file mode 100644
index 000000000..e03efdda1
--- /dev/null
+++ b/apps/slack-agent/agent/channels/eve.ts
@@ -0,0 +1,27 @@
+import { eveChannel } from "eve/channels/eve";
+import { httpBasic, localDev, none } from "eve/channels/auth";
+
+/**
+ * Auth for eve's own HTTP routes (session/stream/health/etc.).
+ *
+ * The Slack webhook route (/eve/v1/slack) is verified independently via the
+ * Slack signing secret, so this policy only governs the browser/API surface.
+ *
+ * - localDev(): opens the routes for `eve dev` and the local REPL.
+ * - If ROUTE_AUTH_BASIC_PASSWORD is set, the deployed routes require HTTP Basic.
+ *   Otherwise they are public (none()) — fine for a general demo, but set the
+ *   password (or swap in jwt/oidc) before exposing anything sensitive.
+ */
+const basicPassword = process.env.ROUTE_AUTH_BASIC_PASSWORD;
+
+export default eveChannel({
+  auth: [
+    localDev(),
+    basicPassword
+      ? httpBasic({
+          username: process.env.ROUTE_AUTH_BASIC_USER ?? "admin",
+          password: basicPassword,
+        })
+      : none(),
+  ],
+});
diff --git a/apps/slack-agent/agent/channels/slack.ts b/apps/slack-agent/agent/channels/slack.ts
new file mode 100644
index 000000000..6314c6080
--- /dev/null
+++ b/apps/slack-agent/agent/channels/slack.ts
@@ -0,0 +1,17 @@
+import { slackChannel } from "eve/channels/slack";
+
+/**
+ * Self-managed Slack app — no Vercel Connect.
+ *
+ * Credentials fall back to env vars (see .env.local.example):
+ *   - botToken       -> SLACK_BOT_TOKEN     (outbound Web API calls)
+ *   - signingSecret  -> SLACK_SIGNING_SECRET (HMAC-verifies inbound webhooks)
+ *
+ * Slack delivers events to POST /eve/v1/slack. Point your Slack app's
+ * Event Subscriptions "Request URL" at https://<host>/eve/v1/slack.
+ */
+export default slackChannel({
+  // Repeated mentions in a thread only inject what's new since the agent's
+  // last reply, instead of re-reading the whole thread each time.
+  threadContext: { since: "last-agent-reply" },
+});
diff --git a/apps/slack-agent/agent/instructions.md b/apps/slack-agent/agent/instructions.md
new file mode 100644
index 000000000..0ee762332
--- /dev/null
+++ b/apps/slack-agent/agent/instructions.md
@@ -0,0 +1,18 @@
+# Assistant
+
+You are a helpful assistant that lives in Slack. You answer questions, help people
+think through problems, and use your tools when they let you give a better answer.
+
+## Style
+
+- Be concise and direct. Slack is a chat surface — prefer short paragraphs and lists
+  over long prose.
+- When you don't know something, say so plainly rather than guessing.
+- Use a tool when it gives a more accurate or up-to-date answer than reasoning alone.
+  Explain what you did in a sentence, not a play-by-play.
+
+## Behavior
+
+- You are replying inside a Slack thread. Stay on topic for that thread.
+- When several people are in a thread, pay attention to who is asking.
+- Never invent facts, links, or credentials.
diff --git a/apps/slack-agent/agent/tools/get_time.ts b/apps/slack-agent/agent/tools/get_time.ts
new file mode 100644
index 000000000..3132bf243
--- /dev/null
+++ b/apps/slack-agent/agent/tools/get_time.ts
@@ -0,0 +1,37 @@
+import { defineTool } from "eve/tools";
+import { z } from "zod";
+
+/**
+ * Sample tool that proves the tool loop end-to-end. Returns the current time,
+ * optionally in a given IANA timezone (e.g. "America/New_York", "UTC").
+ */
+export default defineTool({
+  description:
+    "Get the current date and time. Optionally pass an IANA timezone (e.g. 'America/New_York', 'Europe/Berlin', 'UTC').",
+  inputSchema: z.object({
+    timezone: z
+      .string()
+      .optional()
+      .describe("IANA timezone name. Defaults to UTC."),
+  }),
+  async execute({ timezone }) {
+    const now = new Date();
+    const tz = timezone ?? "UTC";
+    try {
+      const formatted = new Intl.DateTimeFormat("en-US", {
+        timeZone: tz,
+        dateStyle: "full",
+        timeStyle: "long",
+      }).format(now);
+      return { timezone: tz, iso: now.toISOString(), formatted };
+    } catch {
+      // Invalid timezone — fall back to UTC ISO rather than throwing.
+      return {
+        timezone: "UTC",
+        iso: now.toISOString(),
+        formatted: now.toISOString(),
+        note: `Unknown timezone "${tz}", returned UTC instead.`,
+      };
+    }
+  },
+});
diff --git a/apps/slack-agent/bun.lock b/apps/slack-agent/bun.lock
new file mode 100644
index 000000000..6b9d8d5ba
--- /dev/null
+++ b/apps/slack-agent/bun.lock
@@ -0,0 +1,412 @@
+{
+  "lockfileVersion": 1,
+  "configVersion": 1,
+  "workspaces": {
+    "": {
+      "name": "@maple/slack-agent",
+      "dependencies": {
+        "@workflow/world-postgres": "5.0.0-beta.27",
+        "ai": "^7.0.26",
+        "eve": "^0.25.2",
+        "workers-ai-provider": "^3.3.1",
+        "zod": "4.4.3",
+      },
+      "devDependencies": {
+        "@types/node": "24.x",
+        "typescript": "7.0.2",
+      },
+    },
+  },
+  "overrides": {
+    "ai": "^7.0.26",
+  },
+  "packages": {
+    "@ai-sdk/gateway": ["@ai-sdk/gateway@4.0.24", "", { "dependencies": { "@ai-sdk/provider": "4.0.3", "@ai-sdk/provider-utils": "5.0.11", "@vercel/oidc": "3.2.0" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-RRNCwwYSMxN1SOskxqjyA9LZMuOs3J/fjP8jiB/akWG21jRdUkCcnO9paoiTFVjqnoJMIazrcqbeRfbSGG/PSQ=="],
+
+    "@ai-sdk/provider": ["@ai-sdk/provider@4.0.3", "", { "dependencies": { "json-schema": "^0.4.0" } }, "sha512-e0CpNWJUY7OxAFAnCZkw+ri9QOHWwTs1tXP42782KFGCU07qt8NiXCrCVowyCB5dP2r5/Uls+g2oPd8kOJn9dw=="],
+
+    "@ai-sdk/provider-utils": ["@ai-sdk/provider-utils@5.0.11", "", { "dependencies": { "@ai-sdk/provider": "4.0.3", "@standard-schema/spec": "^1.1.0", "@workflow/serde": "4.1.0", "eventsource-parser": "^3.0.8" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-7/96wE+ZsKB35iS9ASyllrE4Ym/EolXEB7AkuJ5FI++fmS85BVTAs77890C+1Z2jwHfBKjBQSBmsliOsAh0iFQ=="],
+
+    "@babel/code-frame": ["@babel/code-frame@7.29.7", "", { "dependencies": { "@babel/helper-validator-identifier": "^7.29.7", "js-tokens": "^4.0.0", "picocolors": "^1.1.1" } }, "sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw=="],
+
+    "@babel/helper-validator-identifier": ["@babel/helper-validator-identifier@7.29.7", "", {}, "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg=="],
+
+    "@cbor-extract/cbor-extract-darwin-arm64": ["@cbor-extract/cbor-extract-darwin-arm64@2.2.2", "", { "os": "darwin", "cpu": "arm64" }, "sha512-ZKZ/F8US7JR92J4DMct6cLW/Y66o2K576+zjlEN/MevH70bFIsB10wkZEQPLzl2oNh2SMGy55xpJ9JoBRl5DOA=="],
+
+    "@cbor-extract/cbor-extract-darwin-x64": ["@cbor-extract/cbor-extract-darwin-x64@2.2.2", "", { "os": "darwin", "cpu": "x64" }, "sha512-32b1mgc+P61Js+KW9VZv/c+xRw5EfmOcPx990JbCBSkYJFY0l25VinvyyWfl+3KjibQmAcYwmyzKF9J4DyKP/Q=="],
+
+    "@cbor-extract/cbor-extract-linux-arm": ["@cbor-extract/cbor-extract-linux-arm@2.2.2", "", { "os": "linux", "cpu": "arm" }, "sha512-tNg0za41TpQfkhWjptD+0gSD2fggMiDCSacuIeELyb2xZhr7PrhPe5h66Jc67B/5dmpIhI2QOUtv4SBsricyYQ=="],
+
+    "@cbor-extract/cbor-extract-linux-arm64": ["@cbor-extract/cbor-extract-linux-arm64@2.2.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-wfqgzqCAy/Vn8i6WVIh7qZd0DdBFaWBjPdB6ma+Wihcjv0gHqD/mw3ouVv7kbbUNrab6dKEx/w3xQZEdeXIlzg=="],
+
+    "@cbor-extract/cbor-extract-linux-x64": ["@cbor-extract/cbor-extract-linux-x64@2.2.2", "", { "os": "linux", "cpu": "x64" }, "sha512-rpiLnVEsqtPJ+mXTdx1rfz4RtUGYIUg2rUAZgd1KjiC1SehYUSkJN7Yh+aVfSjvCGtVP0/bfkQkXpPXKbmSUaA=="],
+
+    "@cbor-extract/cbor-extract-win32-x64": ["@cbor-extract/cbor-extract-win32-x64@2.2.2", "", { "os": "win32", "cpu": "x64" }, "sha512-dI+9P7cfWxkTQ+oE+7Aa6onEn92PHgfWXZivjNheCRmTBDBf2fx6RyTi0cmgpYLnD1KLZK9ZYrMxaPZ4oiXhGA=="],
+
+    "@emnapi/core": ["@emnapi/core@1.11.2", "", { "dependencies": { "@emnapi/wasi-threads": "1.2.2", "tslib": "^2.4.0" } }, "sha512-TC8MkTuZUtcTSiFeuC0ksCh9QIJ5+F21MvZ4Wn4ORfYaFJ/0dsiudv5tVkejgwZlwQ39jL9WWDe2lz8x0WglOA=="],
+
+    "@emnapi/runtime": ["@emnapi/runtime@1.11.2", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-kyOl3X0DuTiT1h2ft8r2fYO8JYtU9a9Xis/zBSiGArNaagCOWx90N1k2wxp18czFDH+OgcWGb5ZP/XMt3dcyPA=="],
+
+    "@emnapi/wasi-threads": ["@emnapi/wasi-threads@1.2.2", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-c95qOXkHdydNKhscBTebqEC1CVAZpyqOfVfBzQ1qgzyl3gfeldUjIggDbIZgDKsHLgnsM+igH7TJ/eAasaVuMA=="],
+
+    "@graphile/logger": ["@graphile/logger@0.2.0", "", {}, "sha512-jjcWBokl9eb1gVJ85QmoaQ73CQ52xAaOCF29ukRbYNl6lY+ts0ErTaDYOBlejcbUs2OpaiqYLO5uDhyLFzWw4w=="],
+
+    "@napi-rs/wasm-runtime": ["@napi-rs/wasm-runtime@1.1.6", "", { "dependencies": { "@tybys/wasm-util": "^0.10.3" }, "peerDependencies": { "@emnapi/core": "^1.7.1", "@emnapi/runtime": "^1.7.1" } }, "sha512-ZLv/JdUfkvOy9eCnnBaGfiO+XimbjebAeO+MRQqD/B+FR1tnRN0tpKSJHRbE8sFfS6aqsXZ67TQjfwfsxULVbg=="],
+
+    "@oxc-project/types": ["@oxc-project/types@0.140.0", "", {}, "sha512-h5LUOzGArYemnW1NMz/DuuQhBi96J6JL2Bk8zE4kvqxB5Sg3jxmCiH4uyOWHDkiKSt5vWlG4FIwCR/DbstcNRQ=="],
+
+    "@rolldown/binding-android-arm64": ["@rolldown/binding-android-arm64@1.2.0", "", { "os": "android", "cpu": "arm64" }, "sha512-9yB1l95IrJuNGDFdOYe79vdApdz6WWBCObE+rQ2LUliYUlcyFwSYIb2xb5/Ifw7dAtMy2ZqNyd8QTSOc7duAKw=="],
+
+    "@rolldown/binding-darwin-arm64": ["@rolldown/binding-darwin-arm64@1.2.0", "", { "os": "darwin", "cpu": "arm64" }, "sha512-pexNaW9ACLUOaBITOpU6qVu4VrsOFIjTv6bzgu0YUATo4eUJx0V605PxwZfndpPOn0ilqGqvGQ0M8UW0IE24jg=="],
+
+    "@rolldown/binding-darwin-x64": ["@rolldown/binding-darwin-x64@1.2.0", "", { "os": "darwin", "cpu": "x64" }, "sha512-NqKYaq0355ZmNMG4QGpxtEDxsc7tGDhjhCm4PpE0cwnBW+5Il95LJyq414niEiaKLVjnVHBEjSo1wngKxJNiFw=="],
+
+    "@rolldown/binding-freebsd-x64": ["@rolldown/binding-freebsd-x64@1.2.0", "", { "os": "freebsd", "cpu": "x64" }, "sha512-3vPoHzh6eBTz9IbB0/qZdSr0Qeks2echn+I4cHu2joV74VriPDdldswksEDzrl1mBB+oPRi+67+3Ib59paxIPQ=="],
+
+    "@rolldown/binding-linux-arm-gnueabihf": ["@rolldown/binding-linux-arm-gnueabihf@1.2.0", "", { "os": "linux", "cpu": "arm" }, "sha512-E6NNefZ1bUVmKJq2tJkf45J4Zyczj7qm9rUT7NY+Xo2474Y13qWAwc2tvBt0BAVbmtXR1llkxXg0Ou1jbDf2SQ=="],
+
+    "@rolldown/binding-linux-arm64-gnu": ["@rolldown/binding-linux-arm64-gnu@1.2.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-D+TgkdgM1vu+7/Fpf8+v0ARW+RXEP9Ccazgm8zQ4JFFd9Q7SrYQ2TakU5S5ihazQDgpKyAgZDOcIFsvoHmTZ8w=="],
+
+    "@rolldown/binding-linux-arm64-musl": ["@rolldown/binding-linux-arm64-musl@1.2.0", "", { "os": "linux", "cpu": "arm64" }, "sha512-wUqdwJBbAv0APN87GecstdMUtLjjNTs0hBALpxETD73mccFxdmt/XeizXDtN5RAlBwNKmI+Tg+blect2G+8IeQ=="],
+
+    "@rolldown/binding-linux-ppc64-gnu": ["@rolldown/binding-linux-ppc64-gnu@1.2.0", "", { "os": "linux", "cpu": "ppc64" }, "sha512-9DtF35qR9/NrfhM4oxLplCzVVjE+KKm8Pjemi0i/sdhAWkUasjmSo8WTTubNJClhSHCfyk2yeyoXDQEDPtDAAw=="],
+
+    "@rolldown/binding-linux-s390x-gnu": ["@rolldown/binding-linux-s390x-gnu@1.2.0", "", { "os": "linux", "cpu": "s390x" }, "sha512-RzuHrBh8X8Hntd2N4VR02QGEciq/9JhcZoTpR/Cee6otRrlILGCf3cg2ygHuih+ZebUnWmMrDX6ITI85btO6rQ=="],
+
+    "@rolldown/binding-linux-x64-gnu": ["@rolldown/binding-linux-x64-gnu@1.2.0", "", { "os": "linux", "cpu": "x64" }, "sha512-MK7L0018jjh1jR3mh21G2j1zAVcpscJBlPo2z19pRjv2XOYGRhaV4LyiD8HO6nCDdZln9IFgCMIV5yt4E3klGQ=="],
+
+    "@rolldown/binding-linux-x64-musl": ["@rolldown/binding-linux-x64-musl@1.2.0", "", { "os": "linux", "cpu": "x64" }, "sha512-gyrxLQ9NfGb/9LoVnC4kb9miUghw1mghnkfYvNHSnVIXriabnfgGPUP4RLcJm87q3KgYz4FYUG8IDiWUT+CpSw=="],
+
+    "@rolldown/binding-openharmony-arm64": ["@rolldown/binding-openharmony-arm64@1.2.0", "", { "os": "none", "cpu": "arm64" }, "sha512-/6VFMQGRmrhP77KXDC+StIxGzcNp5JOIyYtw0CQ8gPlzhpiIRucYfoM5FaFamHd5BJYIdH86yfP46l1p3WdrFA=="],
+
+    "@rolldown/binding-wasm32-wasi": ["@rolldown/binding-wasm32-wasi@1.2.0", "", { "dependencies": { "@emnapi/core": "1.11.2", "@emnapi/runtime": "1.11.2", "@napi-rs/wasm-runtime": "^1.1.6" }, "cpu": "none" }, "sha512-rwdbUL465kisF24WEJLvP3JrEG6E5GRuIHt5wpMwHGERtHe4Wm2CIvtf5gTBgr2tGOHKh5NdKEAFS2VkOPE91g=="],
+
+    "@rolldown/binding-win32-arm64-msvc": ["@rolldown/binding-win32-arm64-msvc@1.2.0", "", { "os": "win32", "cpu": "arm64" }, "sha512-+5suHwRiKGmhwyUaNT8a5QbrBvLFh2DbO910TEmGRH1aSxwrCezodvGQnulv4uiWEIv1Kq4ypRsJ5+O+ry1DiA=="],
+
+    "@rolldown/binding-win32-x64-msvc": ["@rolldown/binding-win32-x64-msvc@1.2.0", "", { "os": "win32", "cpu": "x64" }, "sha512-WfFv6/qGufotqBSBzBYwgpCkJBk8Nj7697LL9vTz/XWc67e0r3oewu8iMRwQj3AUL45GVD7wVsPjCsAAtW66Wg=="],
+
+    "@rolldown/pluginutils": ["@rolldown/pluginutils@1.0.1", "", {}, "sha512-2j9bGt5Jh8hj+vPtgzPtl72j0yRxHAyumoo6TNfAjsLB04UtpSvPbPcDcBMxz7n+9CYB0c1GxQFxYRg2jimqGw=="],
+
+    "@standard-schema/spec": ["@standard-schema/spec@1.1.0", "", {}, "sha512-l2aFy5jALhniG5HgqrD6jXLi/rUWrKvqN/qJx6yoJsgKhblVd+iqqU4RCXavm/jPityDo5TCvKMnpjKnOriy0w=="],
+
+    "@tybys/wasm-util": ["@tybys/wasm-util@0.10.3", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-F3fo1MYrRJYL3zER0OUOmkutjr1Vp23m7OsSgp7nq4SP6OqX6C/56XFIPAl5bt3zaBRjmW7SGz3u/6LwFpYcOg=="],
+
+    "@types/debug": ["@types/debug@4.1.13", "", { "dependencies": { "@types/ms": "*" } }, "sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw=="],
+
+    "@types/interpret": ["@types/interpret@1.1.4", "", { "dependencies": { "@types/node": "*" } }, "sha512-r+tPKWHYqaxJOYA3Eik0mMi+SEREqOXLmsooRFmc6GHv7nWUDixFtKN+cegvsPlDcEZd9wxsdp041v2imQuvag=="],
+
+    "@types/ms": ["@types/ms@2.1.0", "", {}, "sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA=="],
+
+    "@types/node": ["@types/node@24.13.3", "", { "dependencies": { "undici-types": "~7.18.0" } }, "sha512-Dh8vAsV36ig5wa9OX4pXvMc9D3Veibfw2wix0CUwYODLD8nkj9UsLjASr49nPg+2eKzxhBV+v7L8pXvT4e639Q=="],
+
+    "@types/pg": ["@types/pg@8.20.0", "", { "dependencies": { "@types/node": "*", "pg-protocol": "*", "pg-types": "^2.2.0" } }, "sha512-bEPFOaMAHTEP1EzpvHTbmwR8UsFyHSKsRisLIHVMXnpNefSbGA1bD6CVy+qKjGSqmZqNqBDV2azOBo8TgkcVow=="],
+
+    "@types/semver": ["@types/semver@7.7.1", "", {}, "sha512-FmgJfu+MOcQ370SD0ev7EI8TlCAfKYU+B4m5T3yXc1CiRN94g/SZPtsCkk506aUDtlMnFZvasDwHHUcZUEaYuA=="],
+
+    "@typescript/typescript-aix-ppc64": ["@typescript/typescript-aix-ppc64@7.0.2", "", { "os": "aix", "cpu": "ppc64" }, "sha512-MTKKkWB7p/0E9xi1d1tHtZ5PiLkGEMIq88pK2CubZjOsLtYTLqhgIgi6zepFa+9GHZ6h05NMCkQxGKiPXMxXtQ=="],
+
+    "@typescript/typescript-darwin-arm64": ["@typescript/typescript-darwin-arm64@7.0.2", "", { "os": "darwin", "cpu": "arm64" }, "sha512-gowzar9MwS/aRWp6f3a4KUqzRjAZjOsmGNCM6LcTgXum+dBfgsBVMN+AgvOCCbguXyick6LJhpBszxMebJ8syA=="],
+
+    "@typescript/typescript-darwin-x64": ["@typescript/typescript-darwin-x64@7.0.2", "", { "os": "darwin", "cpu": "x64" }, "sha512-SZ9xZInqApNlNGc9s0W1VSsktYSOe9cFqNOIqmN1Gs8SmkjKZYFt017G4VwPxASInODuAdbTW7sXiFUf893RgA=="],
+
+    "@typescript/typescript-freebsd-arm64": ["@typescript/typescript-freebsd-arm64@7.0.2", "", { "os": "freebsd", "cpu": "arm64" }, "sha512-W5NH4y/J0plIIS5b2xvTEkU7JFxyqdMAOgf+Ilhl0vHQXKO5dZoxd+C/jEtq56c4F3wk71RB4BMRQ2XdI+bwYQ=="],
+
+    "@typescript/typescript-freebsd-x64": ["@typescript/typescript-freebsd-x64@7.0.2", "", { "os": "freebsd", "cpu": "x64" }, "sha512-UMGDx5sTpzNw3WiPebH7l90IWfJggEd+egHt/q6p7/Cm3zqoV7VxkGXt+3DxPIw8CcmvAB0j3sVVfbhX+M4Tpw=="],
+
+    "@typescript/typescript-linux-arm": ["@typescript/typescript-linux-arm@7.0.2", "", { "os": "linux", "cpu": "arm" }, "sha512-gffT3xPz9sR7j/YJExkyPntrI0P2EP9XbOyWzth2/Gs0RstK+90RBcO0ncXoXy/beYll1SXw846Nf2zdnEz0QQ=="],
+
+    "@typescript/typescript-linux-arm64": ["@typescript/typescript-linux-arm64@7.0.2", "", { "os": "linux", "cpu": "arm64" }, "sha512-Qh4eU4/y3yDjnfjjyPYihMj5/ODIlmt+Bzu17OI+fiSRDW57QmU5SiN63exPRNJPKUzcc1INa1NXdrJ+MqHjUQ=="],
+
+    "@typescript/typescript-linux-loong64": ["@typescript/typescript-linux-loong64@7.0.2", "", { "os": "linux", "cpu": "none" }, "sha512-uEHck9i8hoAzXPiYRib1O7miOnz23SxIeVl6F4LXox+qov1K35jHcEW6VHKvZI+pyvl7fZEP4MCU5LYvIq1GuQ=="],
+
+    "@typescript/typescript-linux-mips64el": ["@typescript/typescript-linux-mips64el@7.0.2", "", { "os": "linux", "cpu": "none" }, "sha512-R4KvAMnE43W5Qeqb0Ly56O3mWMWIAgsMyz36DCaycd5nbg/9kzm0liw3JocfRqyJY0KPmzFjbswozXyW0DnIYA=="],
+
+    "@typescript/typescript-linux-ppc64": ["@typescript/typescript-linux-ppc64@7.0.2", "", { "os": "linux", "cpu": "ppc64" }, "sha512-DORx5b3sd/4S7eayxm4FQv+A7CrkUIGRaHiwI8oiHTAI1fAPWhF4J0vAlkC8biAlHSVVwxMQ3tjZ2/DVbnQiiA=="],
+
+    "@typescript/typescript-linux-riscv64": ["@typescript/typescript-linux-riscv64@7.0.2", "", { "os": "linux", "cpu": "none" }, "sha512-wf0jqEDOjrPRnKwYRyyJDRo11KMbvMFrU+q4zqKyChODBzvlkbhNQfKvLxQCcwTpdDaXSHZTVuh0JoCrKCUMHQ=="],
+
+    "@typescript/typescript-linux-s390x": ["@typescript/typescript-linux-s390x@7.0.2", "", { "os": "linux", "cpu": "s390x" }, "sha512-IkwJc3L7yhytWd/ewjyxNDfOmswCm9GWMJT/ue/dU4aZNbwZeYAetq42VyLmsmSjvoX7z74X6ZaYCtzAr0EuGw=="],
+
+    "@typescript/typescript-linux-x64": ["@typescript/typescript-linux-x64@7.0.2", "", { "os": "linux", "cpu": "x64" }, "sha512-EYdf2cNg7rgCWJnxCdJ+F3V39O8ihb37eHAu1LK8oAFizgTQbPOK7zHHXbPt8rX24COqODXeI3sIf0fCXG7H/A=="],
+
+    "@typescript/typescript-netbsd-arm64": ["@typescript/typescript-netbsd-arm64@7.0.2", "", { "os": "none", "cpu": "arm64" }, "sha512-+polYF4MF04aPpO5FTkHran9yUQDSXqy5GiSDKpsll5jy3l3+g9QLhpf39T+ePtefhXLOGrLl0QIjkQP6VnelA=="],
+
+    "@typescript/typescript-netbsd-x64": ["@typescript/typescript-netbsd-x64@7.0.2", "", { "os": "none", "cpu": "x64" }, "sha512-8YIT0EHM/3dq10ZOVF/A7pc/YSMtbcecct4rWtexrnSCHOPcpC2KTLXfTCR6vDpnSiY12heNb1GiN/wu+T/FyA=="],
+
+    "@typescript/typescript-openbsd-arm64": ["@typescript/typescript-openbsd-arm64@7.0.2", "", { "os": "openbsd", "cpu": "arm64" }, "sha512-APT8+ClYnuYm1u9+kgGXoMj2VzWzcymwh2gNSQVySHfkRDGOTVkoWLjCmOQSaO+PoqQ57B0flRp9SA+7GnnkzQ=="],
+
+    "@typescript/typescript-openbsd-x64": ["@typescript/typescript-openbsd-x64@7.0.2", "", { "os": "openbsd", "cpu": "x64" }, "sha512-yX7s+Q0Dln0Dt9tEzZsAjXXR/+ytBM7AlglaqyeMPxQszJ1JhlJdZ6jLA+IzldHtflX81em7lDao1xXu+aRRkg=="],
+
+    "@typescript/typescript-sunos-x64": ["@typescript/typescript-sunos-x64@7.0.2", "", { "os": "sunos", "cpu": "x64" }, "sha512-dLJDGaLZ1D4HPQn62u1n8mBDkJREwMsAkCdkwd4Ieqw+x3TUyTsqY0YiBCtE6H6OzzgGk3iuZ3vFWRS+E8/d1g=="],
+
+    "@typescript/typescript-win32-arm64": ["@typescript/typescript-win32-arm64@7.0.2", "", { "os": "win32", "cpu": "arm64" }, "sha512-Gyl1Vy6OsWesLzmq+EP0Fb7b4Nid5232AvcA2SFcdYreldpNtYFFofPjnt62y9hQy7VTaZp65ICJjuAQRaVcIQ=="],
+
+    "@typescript/typescript-win32-x64": ["@typescript/typescript-win32-x64@7.0.2", "", { "os": "win32", "cpu": "x64" }, "sha512-0BQ3HkAHHlKLSp1qRvf3SUhGpGsDuhB/jgFw75guyqbxJqEaS0Cw/VFO8i2nHglJUzQCRtMMR/IBAKE3ETMC4g=="],
+
+    "@vercel/cli-config": ["@vercel/cli-config@0.2.0", "", { "dependencies": { "xdg-app-paths": "5", "zod": "4.1.11" } }, "sha512-fJRRRB7734BDuXZ89yBEaA2ncYhH7bWX30mk04W80J6VAfQc+4iB8lyzAdaGpFV3/vNlkt9VZt+/uoQoWX6UsQ=="],
+
+    "@vercel/cli-exec": ["@vercel/cli-exec@1.0.0", "", { "dependencies": { "execa": "5.1.1" } }, "sha512-kQF8LGie/Hbdq9/psJxLE7owRTcqMQMhgybU04gCeR7cbQAr5t8OrjefDNColJv1QSSucFt4pLwRiARVmlOnug=="],
+
+    "@vercel/oidc": ["@vercel/oidc@3.8.0", "", { "dependencies": { "@vercel/cli-config": "0.2.0", "@vercel/cli-exec": "1.0.0", "jose": "^5.9.6" } }, "sha512-r00laGW6Pv778RoR6M2NxX91ycSj+PBwVo+fOb9Bif+F0IyUKt25zrvBzfEzQpeAzbqOgPZyQibEWDdDFApd+A=="],
+
+    "@vercel/queue": ["@vercel/queue@0.4.0", "", { "dependencies": { "@vercel/oidc": "^3.0.5", "minimatch": "^10.2.4", "mixpart": "0.0.6", "picocolors": "^1.1.1" }, "peerDependencies": { "@opentelemetry/api": "^1.0.0" }, "optionalPeers": ["@opentelemetry/api"] }, "sha512-2HctPb2+6Pj1DMxbPohMq574rE9OP3fUAGhwV0R4Qv1FHQIR+qti92G8FGjFMJGUSFxVlWdNwVfgHU2hZlM6Dw=="],
+
+    "@workflow/errors": ["@workflow/errors@5.0.0-beta.11", "", { "dependencies": { "@workflow/utils": "5.0.0-beta.6", "ms": "2.1.3" } }, "sha512-m8SFeLrckiWnefE5FmmCcrPiLsZM+qWM/f1MUmIoUbu2DUp280Cc5zV4yW22wyd2//CN4MJBklArwSKcFS6JxQ=="],
+
+    "@workflow/serde": ["@workflow/serde@4.1.0", "", {}, "sha512-pav4F2BoirECWR7Nf1TKt+2eETcBj7jj4cBefQ8VXQCA6NPkaKeLfj/zMgi+3zYV5ZIBT4GuUiphsj0/b9hPQQ=="],
+
+    "@workflow/utils": ["@workflow/utils@5.0.0-beta.6", "", { "dependencies": { "ms": "2.1.3" } }, "sha512-YMZqvtRMzlmWkgshURp4ilvcY8VMrNxwXxDEXQ/gkppKWhJ1xdJBpq3plZLf8LWS7JHXd32Wqll/UvQeARu93Q=="],
+
+    "@workflow/world": ["@workflow/world@5.0.0-beta.21", "", { "dependencies": { "ulid": "~3.0.1", "zod": "~4.3.6" } }, "sha512-XAOtSr7CGL/81EqEvUuDSWzil12sRJwQfU7ymVZlui33BKK8vbtgqzuY5vI6/OWt6NiAqPMeJVeahD9oMkii/A=="],
+
+    "@workflow/world-local": ["@workflow/world-local@5.0.0-beta.29", "", { "dependencies": { "@vercel/queue": "0.4.0", "@workflow/errors": "5.0.0-beta.11", "@workflow/utils": "5.0.0-beta.6", "@workflow/world": "5.0.0-beta.21", "async-sema": "3.1.1", "ulid": "~3.0.1", "undici": "7.28.0", "zod": "~4.3.6" }, "peerDependencies": { "@opentelemetry/api": "1" }, "optionalPeers": ["@opentelemetry/api"] }, "sha512-TWJraKv6ObjutNHY0qmwquOWwYBzHAOlrpp1PPdhbM21U6VgvPCgmZ/D2+BjLsNIMLuofUY2j0L7KyQcG1WnXw=="],
+
+    "@workflow/world-postgres": ["@workflow/world-postgres@5.0.0-beta.27", "", { "dependencies": { "@vercel/queue": "0.4.0", "@workflow/errors": "5.0.0-beta.11", "@workflow/utils": "5.0.0-beta.6", "@workflow/world": "5.0.0-beta.21", "@workflow/world-local": "5.0.0-beta.29", "cbor-x": "1.6.0", "dotenv": "17.3.1", "drizzle-orm": "0.45.2", "graphile-worker": "0.16.6", "pg": "8.20.0", "ulid": "~3.0.1", "zod": "~4.3.6" }, "bin": { "bootstrap": "bin/setup.js", "workflow-postgres-setup": "bin/setup-deprecated.js" } }, "sha512-TMIJTewCSrCRvsiT4dp2fLwInWelj9sDRWiLN3/ZviPn60ZKPEc6f+y+CjgGGL+oH92hG1WPkvcVdypAlZQl6w=="],
+
+    "ai": ["ai@7.0.32", "", { "dependencies": { "@ai-sdk/gateway": "4.0.24", "@ai-sdk/provider": "4.0.3", "@ai-sdk/provider-utils": "5.0.11" }, "peerDependencies": { "zod": "^3.25.76 || ^4.1.8" } }, "sha512-EO2a9fv/a9upaabhgFNeoOzOzbWQufhG4Edl6bsVXlftO6Tens+Q/vijEIf6AP1mQMNaAJXxmSX1xR3Su+2jXw=="],
+
+    "ansi-regex": ["ansi-regex@5.0.1", "", {}, "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ=="],
+
+    "ansi-styles": ["ansi-styles@4.3.0", "", { "dependencies": { "color-convert": "^2.0.1" } }, "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg=="],
+
+    "argparse": ["argparse@2.0.1", "", {}, "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q=="],
+
+    "async-sema": ["async-sema@3.1.1", "", {}, "sha512-tLRNUXati5MFePdAk8dw7Qt7DpxPB60ofAgn8WRhW6a2rcimZnYBP9oxHiv0OHy+Wz7kPMG+t4LGdt31+4EmGg=="],
+
+    "balanced-match": ["balanced-match@4.0.4", "", {}, "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA=="],
+
+    "brace-expansion": ["brace-expansion@5.0.7", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA=="],
+
+    "callsites": ["callsites@3.1.0", "", {}, "sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ=="],
+
+    "cbor-extract": ["cbor-extract@2.2.2", "", { "dependencies": { "node-gyp-build-optional-packages": "5.1.1" }, "optionalDependencies": { "@cbor-extract/cbor-extract-darwin-arm64": "2.2.2", "@cbor-extract/cbor-extract-darwin-x64": "2.2.2", "@cbor-extract/cbor-extract-linux-arm": "2.2.2", "@cbor-extract/cbor-extract-linux-arm64": "2.2.2", "@cbor-extract/cbor-extract-linux-x64": "2.2.2", "@cbor-extract/cbor-extract-win32-x64": "2.2.2" }, "bin": { "download-cbor-prebuilds": "bin/download-prebuilds.js" } }, "sha512-hlSxxI9XO2yQfe9g6msd3g4xCfDqK5T5P0fRMLuaLHhxn4ViPrm+a+MUfhrvH2W962RGxcBwEGzLQyjbDG1gng=="],
+
+    "cbor-x": ["cbor-x@1.6.0", "", { "optionalDependencies": { "cbor-extract": "^2.2.0" } }, "sha512-0kareyRwHSkL6ws5VXHEf8uY1liitysCVJjlmhaLG+IXLqhSaOO+t63coaso7yjwEzWZzLy8fJo06gZDVQM9Qg=="],
+
+    "chalk": ["chalk@4.1.2", "", { "dependencies": { "ansi-styles": "^4.1.0", "supports-color": "^7.1.0" } }, "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA=="],
+
+    "cliui": ["cliui@8.0.1", "", { "dependencies": { "string-width": "^4.2.0", "strip-ansi": "^6.0.1", "wrap-ansi": "^7.0.0" } }, "sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ=="],
+
+    "color-convert": ["color-convert@2.0.1", "", { "dependencies": { "color-name": "~1.1.4" } }, "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ=="],
+
+    "color-name": ["color-name@1.1.4", "", {}, "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA=="],
+
+    "consola": ["consola@3.4.2", "", {}, "sha512-5IKcdX0nnYavi6G7TtOhwkYzyjfJlatbjMjuLSfE2kYT5pMDOilZ4OvMhi637CcDICTmz3wARPoyhqyX1Y+XvA=="],
+
+    "cosmiconfig": ["cosmiconfig@8.3.6", "", { "dependencies": { "import-fresh": "^3.3.0", "js-yaml": "^4.1.0", "parse-json": "^5.2.0", "path-type": "^4.0.0" }, "peerDependencies": { "typescript": ">=4.9.5" }, "optionalPeers": ["typescript"] }, "sha512-kcZ6+W5QzcJ3P1Mt+83OUv/oHFqZHIx8DuxG6eZ5RGMERoLqp4BuGjhHLYGK+Kf5XVkQvqBSmAy/nGWN3qDgEA=="],
+
+    "cross-spawn": ["cross-spawn@7.0.6", "", { "dependencies": { "path-key": "^3.1.0", "shebang-command": "^2.0.0", "which": "^2.0.1" } }, "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA=="],
+
+    "crossws": ["crossws@0.4.10", "", { "peerDependencies": { "srvx": ">=0.11.5" }, "optionalPeers": ["srvx"] }, "sha512-pz3oubH/dt12KjqsUB0IuXW4nwRDQ583iDsP4555Cpdqx0NoU7pGlWBcayyFI8f/l/idRpgjMEfwuOxSWJYlIA=="],
+
+    "db0": ["db0@0.3.4", "", { "peerDependencies": { "@electric-sql/pglite": "*", "@libsql/client": "*", "better-sqlite3": "*", "drizzle-orm": "*", "mysql2": "*", "sqlite3": "*" }, "optionalPeers": ["@electric-sql/pglite", "@libsql/client", "better-sqlite3", "drizzle-orm", "mysql2", "sqlite3"] }, "sha512-RiXXi4WaNzPTHEOu8UPQKMooIbqOEyqA1t7Z6MsdxSCeb8iUC9ko3LcmsLmeUt2SM5bctfArZKkRQggKZz7JNw=="],
+
+    "debug": ["debug@4.4.3", "", { "dependencies": { "ms": "^2.1.3" } }, "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA=="],
+
+    "detect-libc": ["detect-libc@2.1.2", "", {}, "sha512-Btj2BOOO83o3WyH59e8MgXsxEQVcarkUOpEYrubB0urwnN10yQ364rsiByU11nZlqWYZm05i/of7io4mzihBtQ=="],
+
+    "dotenv": ["dotenv@17.3.1", "", {}, "sha512-IO8C/dzEb6O3F9/twg6ZLXz164a2fhTnEWb95H23Dm4OuN+92NmEAlTrupP9VW6Jm3sO26tQlqyvyi4CsnY9GA=="],
+
+    "drizzle-orm": ["drizzle-orm@0.45.2", "", { "peerDependencies": { "@aws-sdk/client-rds-data": ">=3", "@cloudflare/workers-types": ">=4", "@electric-sql/pglite": ">=0.2.0", "@libsql/client": ">=0.10.0", "@libsql/client-wasm": ">=0.10.0", "@neondatabase/serverless": ">=0.10.0", "@op-engineering/op-sqlite": ">=2", "@opentelemetry/api": "^1.4.1", "@planetscale/database": ">=1.13", "@prisma/client": "*", "@tidbcloud/serverless": "*", "@types/better-sqlite3": "*", "@types/pg": "*", "@types/sql.js": "*", "@upstash/redis": ">=1.34.7", "@vercel/postgres": ">=0.8.0", "@xata.io/client": "*", "better-sqlite3": ">=7", "bun-types": "*", "expo-sqlite": ">=14.0.0", "gel": ">=2", "knex": "*", "kysely": "*", "mysql2": ">=2", "pg": ">=8", "postgres": ">=3", "sql.js": ">=1", "sqlite3": ">=5" }, "optionalPeers": ["@aws-sdk/client-rds-data", "@cloudflare/workers-types", "@electric-sql/pglite", "@libsql/client", "@libsql/client-wasm", "@neondatabase/serverless", "@op-engineering/op-sqlite", "@opentelemetry/api", "@planetscale/database", "@prisma/client", "@tidbcloud/serverless", "@types/better-sqlite3", "@types/pg", "@types/sql.js", "@upstash/redis", "@vercel/postgres", "@xata.io/client", "better-sqlite3", "bun-types", "expo-sqlite", "gel", "knex", "kysely", "mysql2", "pg", "postgres", "sql.js", "sqlite3"] }, "sha512-kY0BSaTNYWnoDMVoyY8uxmyHjpJW1geOmBMdSSicKo9CIIWkSxMIj2rkeSR51b8KAPB7m+qysjuHme5nKP+E5Q=="],
+
+    "emoji-regex": ["emoji-regex@8.0.0", "", {}, "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="],
+
+    "env-runner": ["env-runner@0.1.16", "", { "dependencies": { "crossws": "^0.4.8", "exsolve": "^1.1.0", "httpxy": "^0.5.4", "srvx": "^0.11.19" }, "peerDependencies": { "@netlify/runtime": "^4.1.23", "@vercel/queue": ">=0.2.0", "miniflare": "^4.20260515.0", "wrangler": "^4.0.0" }, "optionalPeers": ["@netlify/runtime", "@vercel/queue", "miniflare", "wrangler"], "bin": { "env-runner": "dist/cli.mjs" } }, "sha512-2LRJM4P2KLX6J83QZZrMqvgCDt/D5ea7wPcI3yYiy5cG/9rX5QwdwZFx0D7ktWnjdRyZxYjttGGorb5nFqb1CA=="],
+
+    "error-ex": ["error-ex@1.3.4", "", { "dependencies": { "is-arrayish": "^0.2.1" } }, "sha512-sqQamAnR14VgCr1A618A3sGrygcpK+HEbenA/HiEAkkUwcZIIB/tgWqHFxWgOyDh4nB4JCRimh79dR5Ywc9MDQ=="],
+
+    "escalade": ["escalade@3.2.0", "", {}, "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA=="],
+
+    "eve": ["eve@0.25.3", "", { "dependencies": { "nitro": "3.0.260610-beta" }, "peerDependencies": { "@opentelemetry/api": "^1.0.0", "ai": "^7.0.26", "braintrust": "^3.0.0", "just-bash": "^3.0.0", "microsandbox": "^0.5.0" }, "optionalPeers": ["@opentelemetry/api", "braintrust", "just-bash", "microsandbox"], "bin": { "eve": "./bin/eve.js" } }, "sha512-uySORtwV3I15ipyPFAGzeOhYs7HraEfvWg4e2yAum2nSwWMi8KZ1ctj8IHl7ueZ11pOK49Z6Hy5SS9HcsiR7QA=="],
+
+    "eventsource-parser": ["eventsource-parser@3.1.0", "", {}, "sha512-kJezFj9YFAMLeORyi7aCLxLbD5/qWMQnoMVlVPyHIll7lgRJCc3JVln9Vgl9nwQi0YkMnhdGTMNn7CkRRAptMg=="],
+
+    "execa": ["execa@5.1.1", "", { "dependencies": { "cross-spawn": "^7.0.3", "get-stream": "^6.0.0", "human-signals": "^2.1.0", "is-stream": "^2.0.0", "merge-stream": "^2.0.0", "npm-run-path": "^4.0.1", "onetime": "^5.1.2", "signal-exit": "^3.0.3", "strip-final-newline": "^2.0.0" } }, "sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg=="],
+
+    "exsolve": ["exsolve@1.1.0", "", {}, "sha512-D+42+T12DdIlJM3uepa55qGiL3sYdLBOxIl2ifQCzCHz4c7eiolaHsi3BIqEr7JxBzxv2pYZQX9kw16ziMcEmw=="],
+
+    "get-caller-file": ["get-caller-file@2.0.5", "", {}, "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg=="],
+
+    "get-stream": ["get-stream@6.0.1", "", {}, "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg=="],
+
+    "graphile-config": ["graphile-config@0.0.1-beta.18", "", { "dependencies": { "@types/interpret": "^1.1.3", "@types/node": "^22.16.3", "@types/semver": "^7.7.0", "chalk": "^4.1.2", "debug": "^4.4.1", "interpret": "^3.1.1", "semver": "^7.7.2", "tslib": "^2.8.1", "yargs": "^17.7.2" } }, "sha512-uMdF9Rt8/NwT1wVXNleYgM5ro2hHDodHiKA3efJhgdU8iP+r/hksnghOHreMva0sF5tV73f4TpiELPUR0g7O9w=="],
+
+    "graphile-worker": ["graphile-worker@0.16.6", "", { "dependencies": { "@graphile/logger": "^0.2.0", "@types/debug": "^4.1.10", "@types/pg": "^8.10.5", "cosmiconfig": "^8.3.6", "graphile-config": "^0.0.1-beta.4", "json5": "^2.2.3", "pg": "^8.11.3", "tslib": "^2.6.2", "yargs": "^17.7.2" }, "bin": { "graphile-worker": "dist/cli.js" } }, "sha512-e7gGYDmGqzju2l83MpzX8vNG/lOtVJiSzI3eZpAFubSxh/cxs7sRrRGBGjzBP1kNG0H+c95etPpNRNlH65PYhw=="],
+
+    "h3": ["h3@2.0.1-rc.22", "", { "dependencies": { "rou3": "^0.8.1", "srvx": "^0.11.15" }, "peerDependencies": { "crossws": "^0.4.1" }, "optionalPeers": ["crossws"], "bin": { "h3": "bin/h3.mjs" } }, "sha512-Esv0DMIuPkCTSWCA0vO73vcTqwzH1wjSrAO1TXNu/K3up1sZHa9EKMapbmxCDYBeymC3fVTk4qxp7ogQWQ+KgA=="],
+
+    "has-flag": ["has-flag@4.0.0", "", {}, "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ=="],
+
+    "hookable": ["hookable@6.1.1", "", {}, "sha512-U9LYDy1CwhMCnprUfeAZWZGByVbhd54hwepegYTK7Pi5NvqEj63ifz5z+xukznehT7i6NIZRu89Ay1AZmRsLEQ=="],
+
+    "httpxy": ["httpxy@0.5.5", "", {}, "sha512-uDjmnPyp1q4Sgzf3w+J/Fc6UqcCEj0x4Wjp7OqK5dGhNeDgpyrAmnS6ey8QWrX3SWDon2DMKf9sBa5X9+CVyMA=="],
+
+    "human-signals": ["human-signals@2.1.0", "", {}, "sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw=="],
+
+    "import-fresh": ["import-fresh@3.3.1", "", { "dependencies": { "parent-module": "^1.0.0", "resolve-from": "^4.0.0" } }, "sha512-TR3KfrTZTYLPB6jUjfx6MF9WcWrHL9su5TObK4ZkYgBdWKPOFoSoQIdEuTuR82pmtxH2spWG9h6etwfr1pLBqQ=="],
+
+    "interpret": ["interpret@3.1.1", "", {}, "sha512-6xwYfHbajpoF0xLW+iwLkhwgvLoZDfjYfoFNu8ftMoXINzwuymNLd9u/KmwtdT2GbR+/Cz66otEGEVVUHX9QLQ=="],
+
+    "is-arrayish": ["is-arrayish@0.2.1", "", {}, "sha512-zz06S8t0ozoDXMG+ube26zeCTNXcKIPJZJi8hBrF4idCLms4CG9QtK7qBl1boi5ODzFpjswb5JPmHCbMpjaYzg=="],
+
+    "is-fullwidth-code-point": ["is-fullwidth-code-point@3.0.0", "", {}, "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg=="],
+
+    "is-stream": ["is-stream@2.0.1", "", {}, "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg=="],
+
+    "isexe": ["isexe@2.0.0", "", {}, "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw=="],
+
+    "jose": ["jose@5.10.0", "", {}, "sha512-s+3Al/p9g32Iq+oqXxkW//7jk2Vig6FF1CFqzVXoTUXt2qz89YWbL+OwS17NFYEvxC35n0FKeGO2LGYSxeM2Gg=="],
+
+    "js-tokens": ["js-tokens@4.0.0", "", {}, "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="],
+
+    "js-yaml": ["js-yaml@4.3.0", "", { "dependencies": { "argparse": "^2.0.1" }, "bin": { "js-yaml": "bin/js-yaml.js" } }, "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q=="],
+
+    "json-parse-even-better-errors": ["json-parse-even-better-errors@2.3.1", "", {}, "sha512-xyFwyhro/JEof6Ghe2iz2NcXoj2sloNsWr/XsERDK/oiPCfaNhl5ONfp+jQdAZRQQ0IJWNzH9zIZF7li91kh2w=="],
+
+    "json-schema": ["json-schema@0.4.0", "", {}, "sha512-es94M3nTIfsEPisRafak+HDLfHXnKBhV3vU5eqPcS3flIWqcxJWgXHXiey3YrpaNsanY5ei1VoYEbOzijuq9BA=="],
+
+    "json5": ["json5@2.2.3", "", { "bin": { "json5": "lib/cli.js" } }, "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg=="],
+
+    "lines-and-columns": ["lines-and-columns@1.2.4", "", {}, "sha512-7ylylesZQ/PV29jhEDl3Ufjo6ZX7gCqJr5F7PKrqc93v7fzSymt1BpwEU8nAUXs8qzzvqhbjhK5QZg6Mt/HkBg=="],
+
+    "merge-stream": ["merge-stream@2.0.0", "", {}, "sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w=="],
+
+    "mimic-fn": ["mimic-fn@2.1.0", "", {}, "sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg=="],
+
+    "minimatch": ["minimatch@10.2.5", "", { "dependencies": { "brace-expansion": "^5.0.5" } }, "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg=="],
+
+    "mixpart": ["mixpart@0.0.6", "", {}, "sha512-CRdXtgfQH2jARmtNmPR0Q7jL20fiESbaYk1b0KvLD0jCdUuemepREtsbd8nbiY6BHV9OGGddAZITNXklupUPUQ=="],
+
+    "ms": ["ms@2.1.3", "", {}, "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="],
+
+    "nf3": ["nf3@0.3.22", "", {}, "sha512-NOcqlHu22X1rUakd0SrqllP8kb3LWFmSAi1svTxaKxz+yB604xlaOmUfI3oO+RkODvaocKDDy8bgthnZL8hrkw=="],
+
+    "nitro": ["nitro@3.0.260610-beta", "", { "dependencies": { "consola": "^3.4.2", "crossws": "^0.4.6", "db0": "^0.3.4", "env-runner": "^0.1.12", "h3": "2.0.1-rc.22", "hookable": "^6.1.1", "nf3": "^0.3.17", "ocache": "^0.1.5", "ofetch": "2.0.0-alpha.3", "ohash": "^2.0.11", "rolldown": "^1.1.0", "srvx": "^0.11.16", "unenv": "2.0.0-rc.24", "unstorage": "2.0.0-alpha.7" }, "peerDependencies": { "@vercel/queue": "^0.3.0", "dotenv": "*", "giget": "*", "jiti": "^2.7.0", "rollup": "^4.61.1", "vite": "^7 || ^8", "xml2js": "^0.6.2", "zephyr-agent": "^0.2.0" }, "optionalPeers": ["@vercel/queue", "dotenv", "giget", "jiti", "rollup", "vite", "xml2js", "zephyr-agent"], "bin": { "nitro": "dist/cli/index.mjs" } }, "sha512-KPb4L5yaF/Rx/xoGMpgHRJvZhbhGiqbRKOwwPLCH9jKTKTsEUHLjnJas85AeCzaswqa8Wi52eQBtRsODC4PS0Q=="],
+
+    "node-gyp-build-optional-packages": ["node-gyp-build-optional-packages@5.1.1", "", { "dependencies": { "detect-libc": "^2.0.1" }, "bin": { "node-gyp-build-optional-packages": "bin.js", "node-gyp-build-optional-packages-test": "build-test.js", "node-gyp-build-optional-packages-optional": "optional.js" } }, "sha512-+P72GAjVAbTxjjwUmwjVrqrdZROD4nf8KgpBoDxqXXTiYZZt/ud60dE5yvCSr9lRO8e8yv6kgJIC0K0PfZFVQw=="],
+
+    "npm-run-path": ["npm-run-path@4.0.1", "", { "dependencies": { "path-key": "^3.0.0" } }, "sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw=="],
+
+    "ocache": ["ocache@0.1.5", "", { "dependencies": { "ohash": "^2.0.11" } }, "sha512-kNNnkkVQup/QDvmTz8Q84wc2ntiyoVHDxa6eHWKt5qdGAmFRBIxy83rxgCYEjW0x06UJ9E3P6VgM2yY4rOBH4w=="],
+
+    "ofetch": ["ofetch@2.0.0-alpha.3", "", {}, "sha512-zpYTCs2byOuft65vI3z43Dd6iSdFbOZZLb9/d21aCpx2rGastVU9dOCv0lu4ykc1Ur1anAYjDi3SUvR0vq50JA=="],
+
+    "ohash": ["ohash@2.0.11", "", {}, "sha512-RdR9FQrFwNBNXAr4GixM8YaRZRJ5PUWbKYbE5eOsrwAjJW0q2REGcf79oYPsLyskQCZG1PLN+S/K1V00joZAoQ=="],
+
+    "onetime": ["onetime@5.1.2", "", { "dependencies": { "mimic-fn": "^2.1.0" } }, "sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg=="],
+
+    "os-paths": ["os-paths@4.4.0", "", {}, "sha512-wrAwOeXp1RRMFfQY8Sy7VaGVmPocaLwSFOYCGKSyo8qmJ+/yaafCl5BCA1IQZWqFSRBrKDYFeR9d/VyQzfH/jg=="],
+
+    "parent-module": ["parent-module@1.0.1", "", { "dependencies": { "callsites": "^3.0.0" } }, "sha512-GQ2EWRpQV8/o+Aw8YqtfZZPfNRWZYkbidE9k5rpl/hC3vtHHBfGm2Ifi6qWV+coDGkrUKZAxE3Lot5kcsRlh+g=="],
+
+    "parse-json": ["parse-json@5.2.0", "", { "dependencies": { "@babel/code-frame": "^7.0.0", "error-ex": "^1.3.1", "json-parse-even-better-errors": "^2.3.0", "lines-and-columns": "^1.1.6" } }, "sha512-ayCKvm/phCGxOkYRSCM82iDwct8/EonSEgCSxWxD7ve6jHggsFl4fZVQBPRNgQoKiuV/odhFrGzQXZwbifC8Rg=="],
+
+    "path-key": ["path-key@3.1.1", "", {}, "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q=="],
+
+    "path-type": ["path-type@4.0.0", "", {}, "sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw=="],
+
+    "pathe": ["pathe@2.0.3", "", {}, "sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w=="],
+
+    "pg": ["pg@8.20.0", "", { "dependencies": { "pg-connection-string": "^2.12.0", "pg-pool": "^3.13.0", "pg-protocol": "^1.13.0", "pg-types": "2.2.0", "pgpass": "1.0.5" }, "optionalDependencies": { "pg-cloudflare": "^1.3.0" }, "peerDependencies": { "pg-native": ">=3.0.1" }, "optionalPeers": ["pg-native"] }, "sha512-ldhMxz2r8fl/6QkXnBD3CR9/xg694oT6DZQ2s6c/RI28OjtSOpxnPrUCGOBJ46RCUxcWdx3p6kw/xnDHjKvaRA=="],
+
+    "pg-cloudflare": ["pg-cloudflare@1.4.0", "", {}, "sha512-Vo7z/6rrQYxpNRylp4Tlob2elzbh+N/MOQbxFVWCxS7oEx6jF53GTJFxK2WWpKuBRkmiin4Mt+xofFDjx09R0A=="],
+
+    "pg-connection-string": ["pg-connection-string@2.14.0", "", {}, "sha512-XwWDGcLRGCXAR8F/AM5bG7Q+A3Wm2s6QeEjlOKZLlH3UYcguiqCWKyWXVag5TLTIjR7oOJUY8kcADaZgWPyLeg=="],
+
+    "pg-int8": ["pg-int8@1.0.1", "", {}, "sha512-WCtabS6t3c8SkpDBUlb1kjOs7l66xsGdKpIPZsg4wR+B3+u9UAum2odSsF9tnvxg80h4ZxLWMy4pRjOsFIqQpw=="],
+
+    "pg-pool": ["pg-pool@3.14.0", "", { "peerDependencies": { "pg": ">=8.0" } }, "sha512-gKtPkFdQPU3DksooVLi9LsjZxrsBUZIpa+7aVx+LV5pNh0KzP4Zleud2po+ConrxbuXGBJ6Hfer6hdgpIBpBaw=="],
+
+    "pg-protocol": ["pg-protocol@1.15.0", "", {}, "sha512-cq9sECI5s0+uPUXjbz8ioyPJni6RzsRib0US67i5IoTZKw8fNeYlVE7u8F4dG7vEJJtc5wdD1K189lCCUwqWTQ=="],
+
+    "pg-types": ["pg-types@2.2.0", "", { "dependencies": { "pg-int8": "1.0.1", "postgres-array": "~2.0.0", "postgres-bytea": "~1.0.0", "postgres-date": "~1.0.4", "postgres-interval": "^1.1.0" } }, "sha512-qTAAlrEsl8s4OiEQY69wDvcMIdQN6wdz5ojQiOy6YRMuynxenON0O5oCpJI6lshc6scgAY8qvJ2On/p+CXY0GA=="],
+
+    "pgpass": ["pgpass@1.0.5", "", { "dependencies": { "split2": "^4.1.0" } }, "sha512-FdW9r/jQZhSeohs1Z3sI1yxFQNFvMcnmfuj4WBMUTxOrAyLMaTcE1aAMBiTlbMNaXvBCQuVi0R7hd8udDSP7ug=="],
+
+    "picocolors": ["picocolors@1.1.1", "", {}, "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA=="],
+
+    "postgres-array": ["postgres-array@2.0.0", "", {}, "sha512-VpZrUqU5A69eQyW2c5CA1jtLecCsN2U/bD6VilrFDWq5+5UIEVO7nazS3TEcHf1zuPYO/sqGvUvW62g86RXZuA=="],
+
+    "postgres-bytea": ["postgres-bytea@1.0.1", "", {}, "sha512-5+5HqXnsZPE65IJZSMkZtURARZelel2oXUEO8rH83VS/hxH5vv1uHquPg5wZs8yMAfdv971IU+kcPUczi7NVBQ=="],
+
+    "postgres-date": ["postgres-date@1.0.7", "", {}, "sha512-suDmjLVQg78nMK2UZ454hAG+OAW+HQPZ6n++TNDUX+L0+uUlLywnoxJKDou51Zm+zTCjrCl0Nq6J9C5hP9vK/Q=="],
+
+    "postgres-interval": ["postgres-interval@1.2.0", "", { "dependencies": { "xtend": "^4.0.0" } }, "sha512-9ZhXKM/rw350N1ovuWHbGxnGh/SNJ4cnxHiM0rxE4VN41wsg8P8zWn9hv/buK00RP4WvlOyr/RBDiptyxVbkZQ=="],
+
+    "require-directory": ["require-directory@2.1.1", "", {}, "sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q=="],
+
+    "resolve-from": ["resolve-from@4.0.0", "", {}, "sha512-pb/MYmXstAkysRFx8piNI1tGFNQIFA3vkE3Gq4EuA1dF6gHp/+vgZqsCGJapvy8N3Q+4o7FwvquPJcnZ7RYy4g=="],
+
+    "rolldown": ["rolldown@1.2.0", "", { "dependencies": { "@oxc-project/types": "=0.140.0", "@rolldown/pluginutils": "^1.0.0" }, "optionalDependencies": { "@rolldown/binding-android-arm64": "1.2.0", "@rolldown/binding-darwin-arm64": "1.2.0", "@rolldown/binding-darwin-x64": "1.2.0", "@rolldown/binding-freebsd-x64": "1.2.0", "@rolldown/binding-linux-arm-gnueabihf": "1.2.0", "@rolldown/binding-linux-arm64-gnu": "1.2.0", "@rolldown/binding-linux-arm64-musl": "1.2.0", "@rolldown/binding-linux-ppc64-gnu": "1.2.0", "@rolldown/binding-linux-s390x-gnu": "1.2.0", "@rolldown/binding-linux-x64-gnu": "1.2.0", "@rolldown/binding-linux-x64-musl": "1.2.0", "@rolldown/binding-openharmony-arm64": "1.2.0", "@rolldown/binding-wasm32-wasi": "1.2.0", "@rolldown/binding-win32-arm64-msvc": "1.2.0", "@rolldown/binding-win32-x64-msvc": "1.2.0" }, "bin": { "rolldown": "./bin/cli.mjs" } }, "sha512-u7tgm5l4Yw1iTqUL4EcYOAt7fFvCgQMLeidrnD4GALlC6aOznCjezYajgxeyKw27u0Q5N7fwgCzjVyPIWzwuBA=="],
+
+    "rou3": ["rou3@0.8.1", "", {}, "sha512-ePa+XGk00/3HuCqrEnK3LxJW7I0SdNg6EFzKUJG73hMAdDcOUC/i/aSz7LSDwLrGr33kal/rqOGydzwl6U7zBA=="],
+
+    "semver": ["semver@7.8.5", "", { "bin": { "semver": "bin/semver.js" } }, "sha512-Y7/KDsb8LjooZpwaqGyulO6DQlksgCncchHGk+sZIY4SBvUocMBEFH5Ur1fI4dV+Jvl0w6cjvucaIi40puRioA=="],
+
+    "shebang-command": ["shebang-command@2.0.0", "", { "dependencies": { "shebang-regex": "^3.0.0" } }, "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA=="],
+
+    "shebang-regex": ["shebang-regex@3.0.0", "", {}, "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A=="],
+
+    "signal-exit": ["signal-exit@3.0.7", "", {}, "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ=="],
+
+    "split2": ["split2@4.2.0", "", {}, "sha512-UcjcJOWknrNkF6PLX83qcHM6KHgVKNkV62Y8a5uYDVv9ydGQVwAHMKqHdJje1VTWpljG0WYpCDhrCdAOYH4TWg=="],
+
+    "srvx": ["srvx@0.11.22", "", { "bin": { "srvx": "bin/srvx.mjs" } }, "sha512-LqZxxBDMKuMAZzFzJnDCkFOrs9MZQZr0LvHiO/SuSZVdQaXD7xQ5UWTUxheJrQPve1qk9MG2B/yttUvJxw8egQ=="],
+
+    "string-width": ["string-width@4.2.3", "", { "dependencies": { "emoji-regex": "^8.0.0", "is-fullwidth-code-point": "^3.0.0", "strip-ansi": "^6.0.1" } }, "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g=="],
+
+    "strip-ansi": ["strip-ansi@6.0.1", "", { "dependencies": { "ansi-regex": "^5.0.1" } }, "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A=="],
+
+    "strip-final-newline": ["strip-final-newline@2.0.0", "", {}, "sha512-BrpvfNAE3dcvq7ll3xVumzjKjZQ5tI1sEUIKr3Uoks0XUl45St3FlatVqef9prk4jRDzhW6WZg+3bk93y6pLjA=="],
+
+    "supports-color": ["supports-color@7.2.0", "", { "dependencies": { "has-flag": "^4.0.0" } }, "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw=="],
+
+    "tslib": ["tslib@2.8.1", "", {}, "sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w=="],
+
+    "typescript": ["typescript@7.0.2", "", { "optionalDependencies": { "@typescript/typescript-aix-ppc64": "7.0.2", "@typescript/typescript-darwin-arm64": "7.0.2", "@typescript/typescript-darwin-x64": "7.0.2", "@typescript/typescript-freebsd-arm64": "7.0.2", "@typescript/typescript-freebsd-x64": "7.0.2", "@typescript/typescript-linux-arm": "7.0.2", "@typescript/typescript-linux-arm64": "7.0.2", "@typescript/typescript-linux-loong64": "7.0.2", "@typescript/typescript-linux-mips64el": "7.0.2", "@typescript/typescript-linux-ppc64": "7.0.2", "@typescript/typescript-linux-riscv64": "7.0.2", "@typescript/typescript-linux-s390x": "7.0.2", "@typescript/typescript-linux-x64": "7.0.2", "@typescript/typescript-netbsd-arm64": "7.0.2", "@typescript/typescript-netbsd-x64": "7.0.2", "@typescript/typescript-openbsd-arm64": "7.0.2", "@typescript/typescript-openbsd-x64": "7.0.2", "@typescript/typescript-sunos-x64": "7.0.2", "@typescript/typescript-win32-arm64": "7.0.2", "@typescript/typescript-win32-x64": "7.0.2" }, "bin": { "tsc": "bin/tsc" } }, "sha512-8FYau96o3NKOhbjKi/qNvG/W5jhzxkbdm5sj9AbZ/5T5sWqn3hJgLfGx27sRKZWTvyzCP8dLRBTf5tBTSRVUNA=="],
+
+    "ulid": ["ulid@3.0.2", "", { "bin": { "ulid": "dist/cli.js" } }, "sha512-yu26mwteFYzBAot7KVMqFGCVpsF6g8wXfJzQUHvu1no3+rRRSFcSV2nKeYvNPLD2J4b08jYBDhHUjeH0ygIl9w=="],
+
+    "undici": ["undici@7.28.0", "", {}, "sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA=="],
+
+    "undici-types": ["undici-types@7.18.2", "", {}, "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w=="],
+
+    "unenv": ["unenv@2.0.0-rc.24", "", { "dependencies": { "pathe": "^2.0.3" } }, "sha512-i7qRCmY42zmCwnYlh9H2SvLEypEFGye5iRmEMKjcGi7zk9UquigRjFtTLz0TYqr0ZGLZhaMHl/foy1bZR+Cwlw=="],
+
+    "unstorage": ["unstorage@2.0.0-alpha.7", "", { "peerDependencies": { "@azure/app-configuration": "^1.11.0", "@azure/cosmos": "^4.9.1", "@azure/data-tables": "^13.3.2", "@azure/identity": "^4.13.0", "@azure/keyvault-secrets": "^4.10.0", "@azure/storage-blob": "^12.31.0", "@capacitor/preferences": "^6 || ^7 || ^8", "@deno/kv": ">=0.13.0", "@netlify/blobs": "^6.5.0 || ^7.0.0 || ^8.1.0 || ^9.0.0 || ^10.0.0", "@planetscale/database": "^1.19.0", "@upstash/redis": "^1.36.2", "@vercel/blob": ">=0.27.3", "@vercel/functions": "^2.2.12 || ^3.0.0", "@vercel/kv": "^1.0.1", "aws4fetch": "^1.0.20", "chokidar": "^4 || ^5", "db0": ">=0.3.4", "idb-keyval": "^6.2.2", "ioredis": "^5.9.3", "lru-cache": "^11.2.6", "mongodb": "^6 || ^7", "ofetch": "*", "uploadthing": "^7.7.4" }, "optionalPeers": ["@azure/app-configuration", "@azure/cosmos", "@azure/data-tables", "@azure/identity", "@azure/keyvault-secrets", "@azure/storage-blob", "@capacitor/preferences", "@deno/kv", "@netlify/blobs", "@planetscale/database", "@upstash/redis", "@vercel/blob", "@vercel/functions", "@vercel/kv", "aws4fetch", "chokidar", "db0", "idb-keyval", "ioredis", "lru-cache", "mongodb", "ofetch", "uploadthing"] }, "sha512-ELPztchk2zgFJnakyodVY3vJWGW9jy//keJ32IOJVGUMyaPydwcA1FtVvWqT0TNRch9H+cMNEGllfVFfScImog=="],
+
+    "which": ["which@2.0.2", "", { "dependencies": { "isexe": "^2.0.0" }, "bin": { "node-which": "./bin/node-which" } }, "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA=="],
+
+    "workers-ai-provider": ["workers-ai-provider@3.3.1", "", { "peerDependencies": { "@ai-sdk/anthropic": "^3.0.0", "@ai-sdk/google": "^3.0.0", "@ai-sdk/openai": "^3.0.0", "@ai-sdk/provider": "^3.0.0", "ai": "^6.0.0" }, "optionalPeers": ["@ai-sdk/anthropic", "@ai-sdk/google", "@ai-sdk/openai"] }, "sha512-vArwnmiAxQQF1clsXJd9ADn1xK9YUZVxE4umaMhrdsxM2kucxP430LfaoH4rn0AfoqtnuH3bfRhW1ak0r1x/8A=="],
+
+    "wrap-ansi": ["wrap-ansi@7.0.0", "", { "dependencies": { "ansi-styles": "^4.0.0", "string-width": "^4.1.0", "strip-ansi": "^6.0.0" } }, "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q=="],
+
+    "xdg-app-paths": ["xdg-app-paths@5.5.1", "", { "dependencies": { "os-paths": "^4.0.1", "xdg-portable": "^7.2.0" } }, "sha512-hI3flOB4PLZIy5prbtTpirobtPE2ZtZ52szO+2mM9Efp6ErM398La+C1lIpNWDfNoQk+6Lsi6nMcCwVB7pxeMQ=="],
+
+    "xdg-portable": ["xdg-portable@7.3.0", "", { "dependencies": { "os-paths": "^4.0.1" } }, "sha512-sqMMuL1rc0FmMBOzCpd0yuy9trqF2yTTVe+E9ogwCSWQCdDEtQUwrZPT6AxqtsFGRNxycgncbP/xmOOSPw5ZUw=="],
+
+    "xtend": ["xtend@4.0.2", "", {}, "sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ=="],
+
+    "y18n": ["y18n@5.0.8", "", {}, "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA=="],
+
+    "yargs": ["yargs@17.7.3", "", { "dependencies": { "cliui": "^8.0.1", "escalade": "^3.1.1", "get-caller-file": "^2.0.5", "require-directory": "^2.1.1", "string-width": "^4.2.3", "y18n": "^5.0.5", "yargs-parser": "^21.1.1" } }, "sha512-GZtjxm/J/4TSxuL3FNYjCmLktBTnIw/rVmKSIyKeYAZpmJB2ig9VauCC5xsa82GNKVKDAqpOn3KVzNt0zmrU0g=="],
+
+    "yargs-parser": ["yargs-parser@21.1.1", "", {}, "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw=="],
+
+    "zod": ["zod@4.4.3", "", {}, "sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ=="],
+
+    "@ai-sdk/gateway/@vercel/oidc": ["@vercel/oidc@3.2.0", "", {}, "sha512-UycprH3T6n3jH0k44NHMa7pnFHGu/N05MjojYr+Mc6I7obkoLIJujSWwin1pCvdy/eOxrI/l3uDLQsmcrOb4ug=="],
+
+    "@vercel/cli-config/zod": ["zod@4.1.11", "", {}, "sha512-WPsqwxITS2tzx1bzhIKsEs19ABD5vmCVa4xBo2tq/SrV4RNZtfws1EnCWQXM6yh8bD08a1idvkB5MZSBiZsjwg=="],
+
+    "@workflow/world/zod": ["zod@4.3.6", "", {}, "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg=="],
+
+    "@workflow/world-local/zod": ["zod@4.3.6", "", {}, "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg=="],
+
+    "@workflow/world-postgres/zod": ["zod@4.3.6", "", {}, "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg=="],
+
+    "graphile-config/@types/node": ["@types/node@22.20.1", "", { "dependencies": { "undici-types": "~6.21.0" } }, "sha512-EANqOCF9QFyra+4pfxUcX9STKJpCLjMbObVzljIJomAWSnuSIEAvyzEU53GaajbXJEgdh0iEcPL+DGvpUd4k1Q=="],
+
+    "graphile-config/@types/node/undici-types": ["undici-types@6.21.0", "", {}, "sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ=="],
+  }
+}
diff --git a/apps/slack-agent/docker-entrypoint.sh b/apps/slack-agent/docker-entrypoint.sh
new file mode 100644
index 000000000..2d423f2f9
--- /dev/null
+++ b/apps/slack-agent/docker-entrypoint.sh
@@ -0,0 +1,19 @@
+#!/usr/bin/env sh
+set -e
+
+: "${PORT:=3000}"
+export PORT
+
+# When the durable Postgres world is compiled in (see Dockerfile), apply its
+# schema before starting. The migration is idempotent (drizzle tracks applied
+# migrations), so running it on every boot is safe. Requires WORKFLOW_POSTGRES_URL
+# or DATABASE_URL to be set.
+case "${EVE_WORKFLOW_WORLD:-}" in
+  *world-postgres*)
+    echo "[entrypoint] Applying @workflow/world-postgres schema..."
+    node ./node_modules/@workflow/world-postgres/bin/setup.js
+    ;;
+esac
+
+echo "[entrypoint] Starting eve on port ${PORT}..."
+exec node .output/server/index.mjs
diff --git a/apps/slack-agent/package.json b/apps/slack-agent/package.json
new file mode 100644
index 000000000..58332809c
--- /dev/null
+++ b/apps/slack-agent/package.json
@@ -0,0 +1,34 @@
+{
+  "name": "@maple/slack-agent",
+  "version": "0.0.0",
+  "private": true,
+  "type": "module",
+  "imports": {
+    "#*": "./agent/*",
+    "#evals/*": "./evals/*"
+  },
+  "scripts": {
+    "build": "eve build",
+    "dev": "eve dev",
+    "start": "eve start",
+    "db:setup": "node ./node_modules/@workflow/world-postgres/bin/setup.js",
+    "typecheck": "tsc"
+  },
+  "dependencies": {
+    "@workflow/world-postgres": "5.0.0-beta.27",
+    "ai": "^7.0.26",
+    "eve": "^0.25.2",
+    "workers-ai-provider": "^3.3.1",
+    "zod": "4.4.3"
+  },
+  "devDependencies": {
+    "@types/node": "24.x",
+    "typescript": "7.0.2"
+  },
+  "overrides": {
+    "ai": "^7.0.26"
+  },
+  "engines": {
+    "node": ">=24"
+  }
+}
diff --git a/apps/slack-agent/railway.json b/apps/slack-agent/railway.json
new file mode 100644
index 000000000..904286fad
--- /dev/null
+++ b/apps/slack-agent/railway.json
@@ -0,0 +1,13 @@
+{
+	"$schema": "https://railway.com/railway.schema.json",
+	"build": {
+		"builder": "DOCKERFILE",
+		"dockerfilePath": "Dockerfile",
+		"watchPatterns": ["**"]
+	},
+	"deploy": {
+		"healthcheckPath": "/eve/v1/health",
+		"restartPolicyType": "ON_FAILURE",
+		"restartPolicyMaxRetries": 5
+	}
+}
diff --git a/apps/slack-agent/tsconfig.json b/apps/slack-agent/tsconfig.json
new file mode 100644
index 000000000..37df95497
--- /dev/null
+++ b/apps/slack-agent/tsconfig.json
@@ -0,0 +1,13 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "types": ["node"],
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "noEmit": true
+  },
+  "include": ["agent/**/*.ts", "evals/**/*.ts"]
+}
diff --git a/package.json b/package.json
index d9b6c35d8..fbeeb5e23 100644
--- a/package.json
+++ b/package.json
@@ -3,6 +3,7 @@
 	"private": true,
 	"workspaces": [
 		"apps/*",
+		"!apps/slack-agent",
 		"packages/*",
 		"lib/*",
 		"examples/*"
diff --git a/scripts/ingest-dummy.ts b/scripts/ingest-dummy.ts
new file mode 100644
index 000000000..09bf0806d
--- /dev/null
+++ b/scripts/ingest-dummy.ts
@@ -0,0 +1,561 @@
+#!/usr/bin/env bun
+/**
+ * Push dummy OTLP traces + logs to the local ingest gateway for UI development.
+ *
+ *   bun scripts/ingest-dummy.ts [options]
+ *   bun run ingest:dummy -- [options]
+ *
+ * This is a dev-only convenience: it hand-rolls OTLP/JSON and POSTs it straight at
+ * the Rust ingest gateway (https://ingest.localhost → http://localhost:3474), the
+ * same path real telemetry takes. The gateway stamps every span/log with your org
+ * (MAPLE_ORG_ID_OVERRIDE in single-tenant mode), so the data shows up for the
+ * test user at https://web.localhost. No metrics / dashboards — traces + logs only.
+ *
+ * The headline use case is the commit-SHA UI: each generated trace carries a
+ * `deployment.commit_sha` *resource* attribute, which the `service_overview_spans`
+ * materialized view extracts into the `CommitSha` column (per service, per deploy).
+ * Pass real 40-char SHAs (`--shas`) — or let it pull recent ones from `git log` —
+ * so the hover card can resolve them to actual commit messages via the GitHub app.
+ *
+ * Examples:
+ *   # The "improve the commit-SHAs UI" scenario: 3 SHAs 10 min apart, each with a
+ *   # varying number of traces, anchored at now.
+ *   bun scripts/ingest-dummy.ts \
+ *     --shas ea0466fa99642d7633860b2079debf30562a58a0,a24daf481e65f0c333073b5bf8a39583a972910d,d9f88a8518437a85ac88d4a36bf55e72962e7365 \
+ *     --sha-interval 10m --traces-per-sha 3-9 --service checkout-api
+ *
+ *   # No SHAs given → use the 3 most recent commits from `git log`:
+ *   bun scripts/ingest-dummy.ts --num-shas 3 --sha-interval 10m
+ *
+ *   # Inspect the payload without sending anything:
+ *   bun scripts/ingest-dummy.ts --traces-per-sha 2 --dry-run
+ *
+ * Wire format (verified against opentelemetry-proto 0.31 `with-serde`, the crate
+ * the gateway decodes JSON with): camelCase keys, trace/span ids are lowercase
+ * hex strings, *UnixNano fields are decimal-nanosecond *strings*, structs carry
+ * `#[serde(default)]` so omitted fields (e.g. a root span's parentSpanId) are fine.
+ */
+import { randomBytes } from "node:crypto"
+import { execFileSync } from "node:child_process"
+import { parseArgs } from "node:util"
+
+const FAILURE = 1
+
+// ── OTLP enums ──────────────────────────────────────────────────────────────
+const SPAN_KIND_INTERNAL = 1
+const SPAN_KIND_SERVER = 2
+const SPAN_KIND_CLIENT = 3
+const STATUS_OK = 1
+const STATUS_ERROR = 2
+const SEVERITY_INFO = 9
+const SEVERITY_WARN = 13
+const SEVERITY_ERROR = 17
+
+// ── defaults ────────────────────────────────────────────────────────────────
+// Hit the raw gateway port over plain HTTP by default: portless terminates TLS at
+// https://ingest.localhost and proxies to :3474, but Bun's fetch would reject the
+// portless self-signed cert. :3474 sidesteps that. Override with --endpoint.
+const DEFAULT_ENDPOINT = process.env.MAPLE_INGEST_URL?.trim() || "http://localhost:3474"
+// Any maple_pk_*/maple_sk_* string resolves to MAPLE_ORG_ID_OVERRIDE in single-tenant dev.
+const DEFAULT_KEY = process.env.MAPLE_INGEST_KEY?.trim() || "maple_pk_local"
+const DEFAULT_SERVICE = "checkout-api"
+const DEFAULT_ENV = "production"
+const MAX_SPANS_PER_REQUEST = 3000 // keep bodies well under INGEST_MAX_REQUEST_BODY_BYTES (20 MB)
+
+const HEX40 = /^[0-9a-f]{40}$/
+
+interface Range {
+	readonly min: number
+	readonly max: number
+}
+
+const fail = (message: string): never => {
+	console.error(`✗ ${message}`)
+	process.exit(FAILURE)
+}
+
+// ── tiny seeded RNG (mulberry32) for reproducible *shape* (counts/latencies/etc).
+// Span & trace ids always use crypto randomness so they stay globally unique. ──
+let rngState = 0
+const seedRng = (seed: number): void => {
+	rngState = seed >>> 0
+}
+const rng = (): number => {
+	rngState |= 0
+	rngState = (rngState + 0x6d2b79f5) | 0
+	let t = Math.imul(rngState ^ (rngState >>> 15), 1 | rngState)
+	t = (t + Math.imul(t ^ (t >>> 7), 61 | t)) ^ t
+	return ((t ^ (t >>> 14)) >>> 0) / 4294967296
+}
+const randInt = (min: number, max: number): number => min + Math.floor(rng() * (max - min + 1))
+const randIn = (r: Range): number => randInt(r.min, r.max)
+const pick = <T>(xs: readonly T[]): T => xs[Math.floor(rng() * xs.length)] as T
+const chance = (p: number): boolean => rng() < p
+
+// ── parsing helpers ─────────────────────────────────────────────────────────
+const parseRange = (raw: string, label: string): Range => {
+	const m = raw.match(/^(\d+)(?:-(\d+))?$/)
+	if (!m) fail(`${label}: expected N or MIN-MAX, got "${raw}"`)
+	const min = Number(m![1])
+	const max = m![2] === undefined ? min : Number(m![2])
+	if (max < min) fail(`${label}: min (${min}) > max (${max})`)
+	return { min, max }
+}
+
+const parseDurationMs = (raw: string, label: string): number => {
+	const m = raw.match(/^(\d+)(ms|s|m|h)?$/)
+	if (!m) fail(`${label}: expected a duration like 30s/10m/2h, got "${raw}"`)
+	const n = Number(m![1])
+	switch (m![2]) {
+		case "h":
+			return n * 3_600_000
+		case "m":
+			return n * 60_000
+		case "s":
+			return n * 1000
+		default:
+			return n // bare number = ms
+	}
+}
+
+// ── encoding helpers ────────────────────────────────────────────────────────
+const traceId = (): string => randomBytes(16).toString("hex")
+const spanId = (): string => randomBytes(8).toString("hex")
+const nano = (ms: number): string => (BigInt(Math.round(ms)) * 1_000_000n).toString()
+const attr = (key: string, value: string | number): Record<string, unknown> =>
+	typeof value === "number"
+		? { key, value: { intValue: String(value) } }
+		: { key, value: { stringValue: value } }
+
+// ── realistic-ish content ───────────────────────────────────────────────────
+const ROUTES: ReadonlyArray<{ method: string; route: string }> = [
+	{ method: "GET", route: "/api/checkout" },
+	{ method: "POST", route: "/api/orders" },
+	{ method: "GET", route: "/api/products" },
+	{ method: "POST", route: "/api/payments" },
+	{ method: "GET", route: "/api/cart" },
+	{ method: "GET", route: "/api/users/{id}" },
+]
+const DB_CALLS = ["SELECT orders", "INSERT payments", "UPDATE inventory", "SELECT users"]
+const CLIENT_CALLS = ["GET payments-gateway", "POST email-service", "GET pricing-service"]
+const CACHE_CALLS = ["redis GET session", "redis SET cart"]
+const EXCEPTIONS: ReadonlyArray<{ type: string; message: string }> = [
+	{ type: "TimeoutError", message: "upstream timed out after 5000ms" },
+	{ type: "ConnectionResetError", message: "connection reset by peer" },
+	{ type: "ValidationError", message: "missing required field: amount" },
+	{ type: "PaymentDeclinedError", message: "card declined (insufficient_funds)" },
+]
+
+interface Options {
+	endpoint: string
+	key: string
+	service: string
+	env: string
+	shas: string[]
+	shaInterval: number
+	tracesPerSha: Range
+	children: Range
+	logsPerTrace: Range
+	errorRate: number
+	spread: number
+	anchor: number
+	dryRun: boolean
+	quiet: boolean
+}
+
+interface GeneratedSha {
+	sha: string
+	at: number
+	spans: Record<string, unknown>[]
+	logs: Record<string, unknown>[]
+	traceCount: number
+	errorCount: number
+}
+
+const recentGitShas = (n: number): string[] => {
+	try {
+		const out = execFileSync("git", ["log", `-n${n}`, "--pretty=%H"], {
+			cwd: new URL("..", import.meta.url).pathname,
+			encoding: "utf8",
+		})
+		return out
+			.split("\n")
+			.map((s) => s.trim())
+			.filter(Boolean)
+	} catch {
+		return []
+	}
+}
+
+/** Build all spans + correlated logs for one commit SHA. */
+const generateForSha = (sha: string, at: number, opts: Options): GeneratedSha => {
+	const spans: Record<string, unknown>[] = []
+	const logs: Record<string, unknown>[] = []
+	const traceCount = randIn(opts.tracesPerSha)
+	let errorCount = 0
+
+	for (let i = 0; i < traceCount; i++) {
+		const tid = traceId()
+		const rootId = spanId()
+		// Scatter this trace within [at - spread, at] so everything stays in the past.
+		const startMs = at - Math.floor(rng() * opts.spread)
+		const isError = chance(opts.errorRate)
+		if (isError) errorCount++
+
+		const { method, route } = pick(ROUTES)
+		const baseLatency = randInt(20, 400) + (isError ? randInt(100, 1200) : 0)
+		const status = isError ? 500 : 200
+
+		const rootAttrs = [
+			attr("http.request.method", method),
+			attr("http.route", route),
+			attr("url.path", route.replace("{id}", String(randInt(1000, 9999)))),
+			attr("http.response.status_code", status),
+			attr("server.address", `${opts.service}.internal`),
+		]
+
+		const root: Record<string, unknown> = {
+			traceId: tid,
+			spanId: rootId,
+			name: `${method} ${route}`,
+			kind: SPAN_KIND_SERVER,
+			startTimeUnixNano: nano(startMs),
+			endTimeUnixNano: nano(startMs + baseLatency),
+			attributes: rootAttrs,
+			status: isError ? { code: STATUS_ERROR, message: "internal server error" } : { code: STATUS_OK },
+		}
+
+		// Child spans, all parented to the root (flat tree — plenty for the UI).
+		const childCount = randIn(opts.children)
+		const childSpans: Record<string, unknown>[] = []
+		for (let c = 0; c < childCount; c++) {
+			const childDur = Math.max(1, Math.floor(baseLatency * (0.1 + rng() * 0.6)))
+			const childStart = startMs + randInt(0, Math.max(0, baseLatency - childDur))
+			// The last child of a failing request is the thing that failed.
+			const childErrored = isError && c === childCount - 1
+
+			// Pick a child flavor (weighted), which decides kind + name + attributes.
+			let kind: number
+			let name: string
+			let childAttrs: Record<string, unknown>[]
+			switch (pick(["db", "db", "http", "http", "cache", "internal"] as const)) {
+				case "db": {
+					kind = SPAN_KIND_CLIENT
+					name = pick(DB_CALLS)
+					childAttrs = [
+						attr("db.system", "postgresql"),
+						attr("db.statement", `${name} WHERE org_id = $1`),
+					]
+					break
+				}
+				case "http": {
+					kind = SPAN_KIND_CLIENT
+					name = pick(CLIENT_CALLS)
+					childAttrs = [
+						attr("http.request.method", name.split(" ")[0]!),
+						attr("url.full", `https://${name.split(" ")[1]}/v1`),
+					]
+					break
+				}
+				case "cache": {
+					kind = SPAN_KIND_CLIENT
+					name = pick(CACHE_CALLS)
+					childAttrs = [attr("db.system", "redis")]
+					break
+				}
+				default: {
+					kind = SPAN_KIND_INTERNAL
+					name = "validate request"
+					childAttrs = [attr("code.function", "validateOrder")]
+				}
+			}
+
+			childSpans.push({
+				traceId: tid,
+				spanId: spanId(),
+				parentSpanId: rootId,
+				name,
+				kind,
+				startTimeUnixNano: nano(childStart),
+				endTimeUnixNano: nano(childStart + childDur),
+				attributes: childAttrs,
+				status: childErrored ? { code: STATUS_ERROR } : { code: STATUS_OK },
+			})
+		}
+
+		if (isError) {
+			const ex = pick(EXCEPTIONS)
+			const failing = (childSpans[childSpans.length - 1] ?? root) as Record<string, unknown>
+			failing.events = [
+				{
+					timeUnixNano: nano(startMs + baseLatency - 1),
+					name: "exception",
+					attributes: [
+						attr("exception.type", ex.type),
+						attr("exception.message", ex.message),
+						attr(
+							"exception.stacktrace",
+							`${ex.type}: ${ex.message}\n    at handler (${opts.service}.ts:42)`,
+						),
+					],
+				},
+			]
+		}
+
+		spans.push(root, ...childSpans)
+
+		// Correlated logs for this trace.
+		const logCount = randIn(opts.logsPerTrace)
+		for (let l = 0; l < logCount; l++) {
+			const errLog = isError && l === 0
+			logs.push({
+				timeUnixNano: nano(startMs + randInt(0, baseLatency)),
+				severityNumber: errLog ? SEVERITY_ERROR : chance(0.15) ? SEVERITY_WARN : SEVERITY_INFO,
+				severityText: errLog ? "ERROR" : chance(0.15) ? "WARN" : "INFO",
+				body: {
+					stringValue: errLog
+						? `${pick(EXCEPTIONS).type} handling ${method} ${route}`
+						: `${method} ${route} -> ${status}`,
+				},
+				traceId: tid,
+				spanId: rootId,
+				attributes: [attr("http.route", route)],
+			})
+		}
+	}
+
+	return { sha, at, spans, logs, traceCount, errorCount }
+}
+
+const resourceAttrs = (opts: Options, sha: string): Record<string, unknown>[] => [
+	attr("service.name", opts.service),
+	attr("deployment.environment", opts.env),
+	attr("deployment.commit_sha", sha),
+]
+
+const chunk = <T>(xs: T[], size: number): T[][] => {
+	const out: T[][] = []
+	for (let i = 0; i < xs.length; i += size) out.push(xs.slice(i, i + size))
+	return out
+}
+
+const postOtlp = async (opts: Options, path: string, body: unknown): Promise<void> => {
+	let res: Response
+	try {
+		res = await fetch(`${opts.endpoint}${path}`, {
+			method: "POST",
+			headers: { "content-type": "application/json", authorization: `Bearer ${opts.key}` },
+			body: JSON.stringify(body),
+		})
+	} catch (err) {
+		fail(
+			`could not reach the ingest gateway at ${opts.endpoint}${path}: ${(err as Error).message}\n` +
+				`  Is it running? Start the dev stack (\`bun dev\`) and make sure the otel-collector\n` +
+				`  is up (it's the gateway's forward target on :4318). Or override with --endpoint.`,
+		)
+	}
+	if (!res!.ok) {
+		const text = await res!.text().catch(() => "")
+		fail(`ingest gateway returned ${res!.status} ${res!.statusText} for ${path}: ${text.slice(0, 500)}`)
+	}
+}
+
+const shortSha = (sha: string): string => (HEX40.test(sha) ? sha.slice(0, 7) : sha.slice(0, 10))
+
+const summarize = (generated: GeneratedSha[], opts: Options): void => {
+	const totalSpans = generated.reduce((n, g) => n + g.spans.length, 0)
+	const totalLogs = generated.reduce((n, g) => n + g.logs.length, 0)
+	const totalTraces = generated.reduce((n, g) => n + g.traceCount, 0)
+	const totalErrors = generated.reduce((n, g) => n + g.errorCount, 0)
+
+	console.log(`\n  service: ${opts.service}   env: ${opts.env}   endpoint: ${opts.endpoint}`)
+	console.log(
+		`  ${"commit".padEnd(12)} ${"when".padEnd(20)} ${"traces".padStart(6)} ${"spans".padStart(6)} ${"logs".padStart(5)} ${"err".padStart(4)}`,
+	)
+	for (const g of generated) {
+		console.log(
+			`  ${shortSha(g.sha).padEnd(12)} ${new Date(g.at).toISOString().slice(0, 19).replace("T", " ").padEnd(20)} ` +
+				`${String(g.traceCount).padStart(6)} ${String(g.spans.length).padStart(6)} ${String(g.logs.length).padStart(5)} ${String(g.errorCount).padStart(4)}`,
+		)
+	}
+	console.log(`  ${"─".repeat(58)}`)
+	console.log(
+		`  ${"total".padEnd(12)} ${"".padEnd(20)} ${String(totalTraces).padStart(6)} ${String(totalSpans).padStart(6)} ${String(totalLogs).padStart(5)} ${String(totalErrors).padStart(4)}`,
+	)
+}
+
+const HELP = `
+ingest-dummy — push dummy OTLP traces + logs to the local ingest gateway
+
+Usage: bun scripts/ingest-dummy.ts [options]
+
+Target:
+  --endpoint <url>        Ingest base URL          (default ${DEFAULT_ENDPOINT})
+  --key <ingest-key>      Bearer ingest key        (default ${DEFAULT_KEY})
+
+Shape:
+  --service <name>        service.name             (default ${DEFAULT_SERVICE})
+  --env <name>            deployment.environment   (default ${DEFAULT_ENV})
+  --shas <a,b,c>          commit SHAs (40-hex resolve in the UI). Omit → recent git log.
+  --num-shas <n>          how many recent commits to pull when --shas is omitted (default 3)
+  --sha-interval <dur>    spacing between consecutive SHAs, s/m/h (default 10m)
+  --traces-per-sha <N|A-B>  traces per SHA, fixed or range (default 3-9)
+  --children <N|A-B>      child spans per trace    (default 1-3)
+  --logs-per-trace <N|A-B>  correlated logs per trace (default 1-2)
+  --error-rate <0..1>     fraction of traces that error (default 0.08)
+  --spread <dur>          scatter window per SHA, s/m/h (default 90s)
+  --anchor <when>         time of the newest SHA: "now" or ISO-8601 (default now)
+
+Control:
+  --seed <n>              seed the shape RNG for reproducible counts/latencies
+  --dry-run               print the plan + a sample span, send nothing
+  --quiet                 only print errors
+  -h, --help
+`
+
+const main = async (): Promise<void> => {
+	const { values } = parseArgs({
+		options: {
+			endpoint: { type: "string" },
+			key: { type: "string" },
+			service: { type: "string" },
+			env: { type: "string" },
+			shas: { type: "string" },
+			"num-shas": { type: "string" },
+			"sha-interval": { type: "string" },
+			"traces-per-sha": { type: "string" },
+			children: { type: "string" },
+			"logs-per-trace": { type: "string" },
+			"error-rate": { type: "string" },
+			spread: { type: "string" },
+			anchor: { type: "string" },
+			seed: { type: "string" },
+			"dry-run": { type: "boolean" },
+			quiet: { type: "boolean" },
+			help: { type: "boolean", short: "h" },
+		},
+		allowPositionals: false,
+	})
+
+	if (values.help) {
+		console.log(HELP)
+		return
+	}
+
+	seedRng(values.seed ? Number(values.seed) : randomBytes(4).readUInt32LE() >>> 0)
+
+	const numShas = values["num-shas"] ? Number(values["num-shas"]) : 3
+	let shas: string[]
+	if (values.shas) {
+		shas = values.shas
+			.split(",")
+			.map((s) => s.trim().toLowerCase())
+			.filter(Boolean)
+	} else {
+		shas = recentGitShas(numShas)
+		if (shas.length === 0) {
+			// No git history reachable — fabricate SHAs (won't resolve to commit messages).
+			shas = Array.from({ length: numShas }, () => randomBytes(20).toString("hex"))
+			console.warn("⚠ no git log available; using random SHAs (they won't resolve in the hover card)")
+		}
+	}
+	if (shas.length === 0) fail("no commit SHAs to ingest")
+	for (const s of shas) {
+		if (!HEX40.test(s))
+			console.warn(
+				`⚠ "${shortSha(s)}" is not a 40-char hex SHA — it'll render as plain text, not a resolvable commit`,
+			)
+	}
+
+	const anchorRaw = values.anchor?.trim()
+	const anchor = !anchorRaw || anchorRaw === "now" ? Date.now() : Date.parse(anchorRaw)
+	if (Number.isNaN(anchor))
+		fail(`--anchor: could not parse "${anchorRaw}" (use "now" or an ISO-8601 timestamp)`)
+
+	const opts: Options = {
+		endpoint: (values.endpoint?.trim() || DEFAULT_ENDPOINT).replace(/\/$/, ""),
+		key: values.key?.trim() || DEFAULT_KEY,
+		service: values.service?.trim() || DEFAULT_SERVICE,
+		env: values.env?.trim() || DEFAULT_ENV,
+		shas,
+		shaInterval: parseDurationMs(values["sha-interval"] ?? "10m", "--sha-interval"),
+		tracesPerSha: parseRange(values["traces-per-sha"] ?? "3-9", "--traces-per-sha"),
+		children: parseRange(values.children ?? "1-3", "--children"),
+		logsPerTrace: parseRange(values["logs-per-trace"] ?? "1-2", "--logs-per-trace"),
+		errorRate: values["error-rate"] ? Number(values["error-rate"]) : 0.08,
+		spread: parseDurationMs(values.spread ?? "90s", "--spread"),
+		anchor,
+		dryRun: Boolean(values["dry-run"]),
+		quiet: Boolean(values.quiet),
+	}
+
+	// SHA i sits at anchor - (N-1-i)*interval, so the newest SHA lands on the anchor
+	// and earlier ones march back in time.
+	const generated = opts.shas.map((sha, i) =>
+		generateForSha(sha, opts.anchor - (opts.shas.length - 1 - i) * opts.shaInterval, opts),
+	)
+
+	if (!opts.quiet) summarize(generated, opts)
+
+	if (opts.dryRun) {
+		const sample = generated.find((g) => g.spans.length > 0)
+		if (sample) {
+			console.log("\n  ── sample resourceSpans (dry-run, nothing sent) ──")
+			console.log(
+				JSON.stringify(
+					{
+						resource: { attributes: resourceAttrs(opts, sample.sha) },
+						scopeSpans: [{ scope: { name: "ingest-dummy" }, spans: sample.spans.slice(0, 4) }],
+					},
+					null,
+					2,
+				)
+					.split("\n")
+					.map((l) => `  ${l}`)
+					.join("\n"),
+			)
+		}
+		console.log("\n  (dry run — re-run without --dry-run to send)\n")
+		return
+	}
+
+	// Build + send trace requests, chunked by span count to stay under the body cap.
+	let traceReqs = 0
+	for (const g of generated) {
+		if (g.spans.length === 0) continue
+		for (const batch of chunk(g.spans, MAX_SPANS_PER_REQUEST)) {
+			await postOtlp(opts, "/v1/traces", {
+				resourceSpans: [
+					{
+						resource: { attributes: resourceAttrs(opts, g.sha) },
+						scopeSpans: [{ scope: { name: "ingest-dummy" }, spans: batch }],
+					},
+				],
+			})
+			traceReqs++
+		}
+	}
+
+	// Logs: one request carrying all SHAs' resourceLogs (logs are small).
+	const resourceLogs = generated
+		.filter((g) => g.logs.length > 0)
+		.map((g) => ({
+			resource: { attributes: resourceAttrs(opts, g.sha) },
+			scopeLogs: [{ scope: { name: "ingest-dummy" }, logRecords: g.logs }],
+		}))
+	if (resourceLogs.length > 0) await postOtlp(opts, "/v1/logs", { resourceLogs })
+
+	if (!opts.quiet) {
+		const totalSpans = generated.reduce((n, g) => n + g.spans.length, 0)
+		const totalLogs = generated.reduce((n, g) => n + g.logs.length, 0)
+		console.log(
+			`\n✓ sent ${totalSpans} spans (${traceReqs} request(s)) + ${totalLogs} logs to ${opts.endpoint}`,
+		)
+		console.log(
+			`  View at https://web.localhost → service "${opts.service}" (last ~${Math.ceil((opts.shaInterval * (opts.shas.length - 1) + opts.spread) / 60000)}m).`,
+		)
+		console.log("  Data lands async via the collector → Tinybird; give it a few seconds to appear.\n")
+	}
+}
+
+main().catch((err) => fail((err as Error).stack ?? String(err)))
diff --git a/turbo.json b/turbo.json
index 668880957..fc2298e37 100644
--- a/turbo.json
+++ b/turbo.json
@@ -2,7 +2,7 @@
 	"$schema": "https://turborepo.com/schema.json",
 	"ui": "tui",
 	"globalPassThroughEnv": ["*"],
-	"concurrency": "100%",
+	"concurrency": "15",
 	"tasks": {
 		"build": {
 			"dependsOn": ["^build"],

From a30abe85411b026f89c73caddb97940cd27675f6 Mon Sep 17 00:00:00 2001
From: JeremyFunk <jeremy@kombo.dev>
Date: Tue, 21 Jul 2026 14:17:11 +0200
Subject: [PATCH 2/8] fix(slack-agent): use a model that streams structured
 tool calls
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The agent was posting raw tool-call JSON into Slack:

  {"type": "function", "name": "ask_question", "parameters": {…}}

Not a formatting bug — a leaked tool call. @cf/meta/llama-3.3-70b-instruct-fp8-fast
only parses tool calls on non-streaming requests; eve's harness always streams, and
in streaming mode Workers AI returns that model's raw tool-call JSON as ordinary
`response` text deltas, which eve has no reason to treat as anything but assistant
text. (Even non-streaming it stringifies non-string args: "allowFreeform": "true".)

workers-ai-provider has a salvage path for leaked tool calls, but it's gated on a
forced tool choice — eve uses auto, so it never engages.

Switch to @cf/zai-org/glm-5.2, which streams OpenAI-shaped incremental
delta.tool_calls (name + id first, argument fragments keyed by index after) ending
in finish_reason: "tool_calls", and emits chain-of-thought on reasoning_content so
it maps to reasoning parts instead of message text. Bump the declared context
window to its 256K.

Verified through a live eve session: modelId workersai/@cf/zai-org/glm-5.2,
actions.requested → action.result, correct Tokyo time in prose.

Also documents the streaming-tool-call constraint, a curl to check any replacement
model's SSE shape, and the price trade-off vs gpt-oss-120b (also verified good, and
~5x cheaper on output if spend beats capability).

Includes the pending PORT 3000 -> 8080 alignment with the documented Railway setup.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 apps/slack-agent/.env.local.example   |   4 +-
 apps/slack-agent/Dockerfile           |   9 +-
 apps/slack-agent/README.md            | 148 +++++++++++++++++++++++---
 apps/slack-agent/agent/agent.ts       |  26 ++++-
 apps/slack-agent/docker-entrypoint.sh |   2 +-
 5 files changed, 163 insertions(+), 26 deletions(-)

diff --git a/apps/slack-agent/.env.local.example b/apps/slack-agent/.env.local.example
index 436f5ad34..f2322e0d7 100644
--- a/apps/slack-agent/.env.local.example
+++ b/apps/slack-agent/.env.local.example
@@ -6,8 +6,8 @@
 CLOUDFLARE_ACCOUNT_ID=
 CLOUDFLARE_API_TOKEN=
 # Optional overrides (defaults live in agent/agent.ts):
-# WORKERS_AI_MODEL=@cf/meta/llama-3.3-70b-instruct-fp8-fast   # must support tool calling
-# WORKERS_AI_CONTEXT_WINDOW=128000
+# WORKERS_AI_MODEL=@cf/zai-org/glm-5.2   # must stream structured tool calls — see README Notes
+# WORKERS_AI_CONTEXT_WINDOW=262144
 
 # ── Slack (self-managed app — no Vercel Connect) ────────────────────────────
 # From your Slack app: OAuth & Permissions → Bot User OAuth Token (xoxb-...),
diff --git a/apps/slack-agent/Dockerfile b/apps/slack-agent/Dockerfile
index bc84a9140..786780bb5 100644
--- a/apps/slack-agent/Dockerfile
+++ b/apps/slack-agent/Dockerfile
@@ -32,8 +32,11 @@ COPY docker-entrypoint.sh ./
 RUN chmod +x docker-entrypoint.sh
 
 ENV NODE_ENV=production
-# Railway injects PORT; default for local `docker run`.
-ENV PORT=3000
-EXPOSE 3000
+# 8080 everywhere: matches the PORT Railway injects at runtime (which would otherwise
+# silently override a different value here), and keeps local `docker run` identical to prod.
+# If you change this, change it in all four places: here, EXPOSE, docker-entrypoint.sh's
+# fallback, and WORKFLOW_LOCAL_BASE_URL / the generated domain's port in README step 2.
+ENV PORT=8080
+EXPOSE 8080
 
 CMD ["./docker-entrypoint.sh"]
diff --git a/apps/slack-agent/README.md b/apps/slack-agent/README.md
index f1a2afd93..afe1a9c33 100644
--- a/apps/slack-agent/README.md
+++ b/apps/slack-agent/README.md
@@ -13,7 +13,7 @@ first, then layer domain tools/instructions on top.
 | --- | --- | --- |
 | Framework | eve `0.25.x` (durable agent runtime, Nitro HTTP host) | filesystem-first agents |
 | Host | **Railway** container running `eve start` (long-running Node) | eve's supported self-host model; edge Workers is blocked today by a workflow-world protocol gap |
-| Model | **Cloudflare Workers AI** via REST (`workers-ai-provider`) | `createWorkersAI({ accountId, apiKey })` → an AI-SDK model, no Workers runtime needed |
+| Model | **Cloudflare Workers AI** via REST (`workers-ai-provider`), `@cf/zai-org/glm-5.2` | `createWorkersAI({ accountId, apiKey })` → an AI-SDK model, no Workers runtime needed; streams structured tool calls, 256K window (see Notes) |
 | Durability | **`@workflow/world-postgres`** (`5.0.0-beta.27`) + Railway Postgres | protocol-compatible with eve's vendored `@workflow/*` 5.0.0-beta line |
 | Slack | **self-managed** (`slackChannel()` + bot token + signing secret) | Vercel Connect is optional; eve verifies webhooks from the signing secret natively |
 
@@ -76,8 +76,9 @@ curl -X POST localhost:<port>/eve/v1/session -H 'content-type: application/json'
 
 ### 1. Create the Slack app
 
-Create an app at <https://api.slack.com/apps> **From an app manifest** and paste this (swap the two
-`request_url`s for your Railway URL after step 2, then reinstall):
+Create an app at <https://api.slack.com/apps> **From an app manifest** and paste this. Leave the two
+`request_url` placeholders as-is for now — you can't verify them until the service is deployed, so
+step 3 comes back and fills them in:
 
 ```yaml
 display_information:
@@ -111,25 +112,101 @@ Secret** (Basic Information).
 
 ### 2. Create the Railway service
 
-- New service → deploy from this repo; set the service **Root Directory** to `apps/slack-agent`
-  (so the Docker build context is this folder). `railway.json` handles builder + healthcheck.
-- Add the **Postgres** plugin (provides `DATABASE_URL`).
-- Set service variables:
+**a. Create the service.** New service → deploy from this repo; set the service **Root Directory**
+to `apps/slack-agent` (so the Docker build context is this folder). `railway.json` handles builder
++ healthcheck.
+
+**b. Add Postgres and reference it.** `Cmd+K` (or right-click the canvas) → **Database** →
+**Add PostgreSQL**. This creates a *separate service* — its `DATABASE_URL` is **not** automatically
+visible to the agent. On the agent service, add a variable reference:
+
+```
+DATABASE_URL = ${{Postgres.DATABASE_URL}}
+```
+
+(Substitute the Postgres service's name if you renamed it; the Variables UI's "Add Reference" picker
+builds this for you.) Use `DATABASE_URL` — the private-network URL — not `DATABASE_PUBLIC_URL`,
+which routes over the internet and bills egress. The entrypoint accepts either this or
+`WORKFLOW_POSTGRES_URL`.
+
+**c. Generate a public domain.** Railway does **not** expose a service by default — without this,
+deploys go healthy but nothing external (including Slack) can reach them. Service → **Settings** →
+**Networking** → **Generate Domain**, and give it the port the container listens on — **8080**
+(`ENV PORT` in the Dockerfile; also set it as a service variable in (d) so Railway doesn't pick its
+own). You get `https://<service>-<hash>.up.railway.app`; that host is what
+every `<your-service>.up.railway.app` placeholder below refers to. Do this before setting the
+variables in (d), since two of them embed the URL.
+
+**d. Set service variables:**
   - `CLOUDFLARE_ACCOUNT_ID`, `CLOUDFLARE_API_TOKEN`
   - `SLACK_BOT_TOKEN`, `SLACK_SIGNING_SECRET`
-  - `WORKFLOW_LOCAL_BASE_URL=https://<your-service>.up.railway.app` (so durable-run callbacks reach
-    `/.well-known/workflow/v1/flow`)
+  - `PORT=8080` — set it explicitly. Railway injects a `PORT` of its own that overrides the image's
+    `ENV PORT`, so pinning it here is what makes the value deterministic rather than assigned.
+  - `WORKFLOW_LOCAL_BASE_URL=http://localhost:8080` — the durable-run callback target. See the note
+    below for why this is loopback and not the public host.
   - (`EVE_WORKFLOW_WORLD` is already baked into the image at build time — no need to set it.)
   - optional: `ROUTE_AUTH_BASIC_PASSWORD` to lock the non-Slack HTTP routes.
 
 Deploy. The entrypoint applies the Postgres-world schema, then starts eve. Check
 `https://<your-service>.up.railway.app/eve/v1/health`.
 
+> **`WORKFLOW_LOCAL_BASE_URL` should stay loopback.** `@workflow/world-postgres` runs its Graphile
+> Worker *in-process*: when a durable step comes off the queue, `executeMessageOverHttp` POSTs it to
+> `getExecutionBaseUrl()` — the service calling itself. Pointing it at the public
+> `up.railway.app` host sends every durable step out to Railway's edge and back for no reason —
+> billed egress plus a round-trip of latency. `<service>.railway.internal` avoids the egress but is
+> still a needless hop and requires binding to `::`. The public domain from step (c) is for *inbound*
+> traffic (Slack, health checks); it is not part of the workflow callback path.
+>
+> Leaving the variable unset also works — `getExecutionBaseUrl` falls back to `http://localhost:${PORT}`,
+> and failing that probes for the port over the health endpoint. We set it explicitly anyway: with
+> `PORT` pinned there's nothing to discover, and an explicit value is one less thing to reason about
+> when a durable step doesn't fire.
+
+The same setup from the CLI:
+
+```bash
+railway link                       # pick the project
+railway add --database postgres
+railway variables --service slack-agent --set 'DATABASE_URL=${{Postgres.DATABASE_URL}}'
+railway domain --service slack-agent --port 8080
+```
+
+Quote the `${{...}}` — it's Railway template syntax, and an unquoted `$` is shell expansion.
+
 ### 3. Point Slack at the deployment
 
-Set both `request_url`s in the Slack app to `https://<your-service>.up.railway.app/eve/v1/slack`.
-Slack sends a one-time `url_verification` challenge that eve answers automatically. Invite the bot
-to a channel and `@mention` it.
+The app you created in step 1 still has placeholder `request_url`s. Both must now point at
+`https://<your-service>.up.railway.app/eve/v1/slack` (the host from step 2c).
+
+> **The deployment has to be live before you paste the URL.** Slack verifies the endpoint
+> *synchronously* when you save: it POSTs a `url_verification` challenge and expects the echoed
+> `challenge` value back within ~3s. eve answers this automatically — but only if it's running.
+> Confirm `/eve/v1/health` returns `{"ok":true}` first, or the save will just fail with
+> "Your request URL didn't respond with the correct challenge value."
+
+Go to <https://api.slack.com/apps> and select your app. Then either:
+
+**Fastest — edit the manifest.** Left sidebar → **Features** → **App Manifest**. It's the same YAML
+from step 1 in an editor; replace both `request_url` values and hit **Save Changes**. Slack runs the
+challenge against the new URL on save.
+
+**Or the individual pages** (same result, two screens):
+
+| Setting | Where | Field |
+| --- | --- | --- |
+| Events | Sidebar → **Features** → **Event Subscriptions** | **Request URL** (toggle *Enable Events* on first) |
+| Interactivity | Sidebar → **Features** → **Interactivity & Shortcuts** | **Request URL** (toggle on first) |
+
+Both should show a green **Verified ✓** next to the field once saved. Event Subscriptions also needs
+`app_mention` and `message.im` listed under *Subscribe to bot events* — the manifest from step 1 sets
+these, so they should already be there.
+
+Changing a request URL does **not** require reinstalling the app; only changing *scopes* does. (If
+you did edit scopes, the sidebar shows a yellow reinstall banner — follow it, and note that
+reinstalling issues a **new** `SLACK_BOT_TOKEN` that you must copy back into Railway.)
+
+Finally, invite the bot to a channel — `/invite @eve-agent` — and `@mention` it.
 
 ## Verification
 
@@ -140,9 +217,50 @@ to a channel and `@mention` it.
 
 ## Notes
 
-- **Model must support tool calling** — eve's default harness is tool-driven. The default
-  `@cf/meta/llama-3.3-70b-instruct-fp8-fast` does; if you switch models, keep that constraint and
-  set `WORKERS_AI_CONTEXT_WINDOW` to the new window.
+- **Model must support tool calling _while streaming_.** eve's harness is tool-driven and always
+  streams, and that second half is the constraint that actually bites. Several Workers AI models
+  parse tool calls only on non-streaming requests; streamed, they emit the model's raw tool-call
+  JSON as ordinary text deltas, which the agent then posts into Slack verbatim:
+
+  ```
+  {"type": "function", "name": "ask_question", "parameters": {"prompt": "…", "allowFreeform": "true"}}
+  ```
+
+  `@cf/meta/llama-3.3-70b-instruct-fp8-fast` (the previous default) has exactly this bug — it
+  returns a proper `tool_calls` array non-streaming, but streams the JSON as text. It also
+  stringifies non-string arguments (`"allowFreeform": "true"`) even in the structured form.
+  `@cf/zai-org/glm-5.2` (the current default) streams OpenAI-shaped incremental `delta.tool_calls`
+  chunks — name and id on the first, argument fragments keyed by `index` after — terminated by
+  `finish_reason: "tool_calls"`, which `workers-ai-provider` maps correctly. (The provider does have
+  a text-salvage path for leaked tool calls, but it only engages for a *forced* tool choice — eve
+  uses auto, so it never fires here.)
+
+  Both `@cf/zai-org/glm-5.2` and `@cf/openai/gpt-oss-120b` are verified good. Workers AI prices
+  them very differently, so the choice is a real trade-off:
+
+  | Model | Context | $/M in | $/M out |
+  | --- | --- | --- | --- |
+  | `@cf/zai-org/glm-5.2` | 256K | 1.40 | 4.40 |
+  | `@cf/openai/gpt-oss-120b` | 128K | 0.35 | 0.75 |
+  | `@cf/zai-org/glm-4.7-flash` | 128K | 0.06 | 0.40 |
+
+  We're on GLM-5.2 for headroom as Maple domain tools land — reasoning over traces and spans is a
+  harder job than the generic tools here, and long Slack threads benefit from the 256K window. If
+  spend becomes the concern before the tools get hard, gpt-oss-120b handled the current toolset
+  identically at roughly a fifth the output cost.
+
+  Before switching `WORKERS_AI_MODEL`, check the streaming shape directly:
+
+  ```bash
+  curl "https://api.cloudflare.com/client/v4/accounts/$CLOUDFLARE_ACCOUNT_ID/ai/run/<model>" \
+    -H "authorization: Bearer $CLOUDFLARE_API_TOKEN" -H 'content-type: application/json' \
+    -d '{"stream":true,"messages":[{"role":"user","content":"what time is it in Tokyo?"}],
+         "tools":[{"type":"function","function":{"name":"get_time","description":"Get the time in a timezone.",
+         "parameters":{"type":"object","properties":{"timezone":{"type":"string"}},"required":["timezone"]}}}]}'
+  ```
+
+  The SSE must carry `delta.tool_calls`, not a JSON blob inside `response`. Also set
+  `WORKERS_AI_CONTEXT_WINDOW` to the new model's window.
 - **Auth:** `agent/channels/eve.ts` leaves the browser/API routes public unless
   `ROUTE_AUTH_BASIC_PASSWORD` is set. The Slack webhook is always signature-verified independently.
 - Edge Cloudflare Workers isn't used because the only Cloudflare Durable-Objects workflow world is
diff --git a/apps/slack-agent/agent/agent.ts b/apps/slack-agent/agent/agent.ts
index 5dda618ac..c8372ee43 100644
--- a/apps/slack-agent/agent/agent.ts
+++ b/apps/slack-agent/agent/agent.ts
@@ -13,17 +13,33 @@ const workersai = createWorkersAI({
 });
 
 /**
- * Must support function/tool calling — eve's default harness is tool-driven.
- * Override with WORKERS_AI_MODEL without editing code.
+ * Must support tool calling **while streaming** — eve's harness is tool-driven and
+ * always streams. That second half is the real constraint: several Workers AI
+ * models parse tool calls only on non-streaming requests and, when streamed, emit
+ * the model's raw tool-call JSON as ordinary text deltas. The agent then posts
+ * `{"type":"function","name":"ask_question",...}` into Slack verbatim.
+ *
+ * `@cf/meta/llama-3.3-70b-instruct-fp8-fast` has exactly that bug — non-streaming
+ * returns a proper `tool_calls` array, streaming returns the JSON as text (and
+ * even in the structured form it stringifies booleans: `"allowFreeform": "true"`).
+ * `@cf/zai-org/glm-5.2` streams OpenAI-shaped incremental `delta.tool_calls`
+ * chunks (name + id on the first, argument fragments keyed by `index` after) and
+ * finishes with `finish_reason: "tool_calls"`, which workers-ai-provider maps
+ * correctly. It also emits chain-of-thought on `reasoning_content`, which the
+ * provider routes to reasoning parts rather than message text.
+ *
+ * If you override WORKERS_AI_MODEL, verify streaming tool calls first — hit
+ * `/ai/run/<model>` with `stream: true` plus a `tools` array and confirm the SSE
+ * carries `delta.tool_calls`, not a JSON blob inside `response`.
  */
-const modelId = process.env.WORKERS_AI_MODEL ?? "@cf/meta/llama-3.3-70b-instruct-fp8-fast";
+const modelId = process.env.WORKERS_AI_MODEL ?? "@cf/zai-org/glm-5.2";
 
 /**
  * Direct (non-Gateway) models carry no AI Gateway context-window metadata, which
- * eve's compaction needs — so declare it here. Llama 3.3 70B is 128K; override
+ * eve's compaction needs — so declare it here. glm-5.2 is 256K; override
  * with WORKERS_AI_CONTEXT_WINDOW if you switch models.
  */
-const contextWindowTokens = Number(process.env.WORKERS_AI_CONTEXT_WINDOW ?? 128_000);
+const contextWindowTokens = Number(process.env.WORKERS_AI_CONTEXT_WINDOW ?? 262_144);
 
 /**
  * Durable workflow state ("world").
diff --git a/apps/slack-agent/docker-entrypoint.sh b/apps/slack-agent/docker-entrypoint.sh
index 2d423f2f9..3874edccc 100644
--- a/apps/slack-agent/docker-entrypoint.sh
+++ b/apps/slack-agent/docker-entrypoint.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env sh
 set -e
 
-: "${PORT:=3000}"
+: "${PORT:=8080}"
 export PORT
 
 # When the durable Postgres world is compiled in (see Dockerfile), apply its

From 966dea707efb3ccd0ff41e1e7732e15a6d1f34b0 Mon Sep 17 00:00:00 2001
From: JeremyFunk <jeremy@kombo.dev>
Date: Tue, 21 Jul 2026 20:14:57 +0200
Subject: [PATCH 3/8] Implement basic slack agent

---
 .env.example                                  |    8 +
 apps/api/alchemy.run.ts                       |    3 +
 apps/api/src/app.ts                           |   14 +
 apps/api/src/lib/Env.ts                       |    4 +
 apps/api/src/routes/slack-integration.http.ts |  159 +
 .../src/routes/v2/alert-destinations.http.ts  |   16 +
 apps/api/src/routes/v2/integrations.http.ts   |  132 +
 apps/api/src/routes/v2/v2-test-support.ts     |   20 +
 .../services/AlertDeliveryDispatch.test.ts    |   99 +
 .../api/src/services/AlertDeliveryDispatch.ts |   72 +
 .../src/services/AlertDestinationHydration.ts |    7 +
 apps/api/src/services/AlertsService.ts        |   43 +-
 .../src/services/NotificationDispatcher.ts    |    7 +-
 .../services/SlackIntegrationService.test.ts  |  405 ++
 .../src/services/SlackIntegrationService.ts   |  699 ++
 apps/slack-agent/.env.local.example           |   28 +-
 apps/slack-agent/Dockerfile                   |    9 +
 apps/slack-agent/README.md                    |  120 +-
 apps/slack-agent/agent/channels/slack.ts      |   54 +-
 apps/slack-agent/agent/connections/maple.ts   |   49 +
 apps/slack-agent/agent/instructions.md        |   54 +-
 apps/slack-agent/agent/lib/maple.ts           |  289 +
 .../components/alerts/destination-dialog.tsx  |  174 +-
 .../alerts/destination-provider.tsx           |   14 +-
 apps/web/src/components/icons/index.ts        |    1 +
 apps/web/src/components/icons/slack.tsx       |   38 +
 .../integrations/integration-catalog.tsx      |   37 +-
 .../integrations/slack-integration-card.tsx   |  228 +
 apps/web/src/lib/alerts/form-utils.test.ts    |   43 +
 apps/web/src/lib/alerts/form-utils.ts         |   36 +
 apps/web/src/routes/integrations.tsx          |   34 +-
 package.json                                  |  203 +-
 packages/db/drizzle/0017_fair_mandarin.sql    |   23 +
 packages/db/drizzle/meta/0017_snapshot.json   | 6462 +++++++++++++++++
 packages/db/drizzle/meta/_journal.json        |    7 +
 packages/db/src/schema/index.ts               |    1 +
 packages/db/src/schema/slack-workspaces.ts    |   57 +
 packages/domain/src/http/alerts.ts            |   27 +
 .../domain/src/http/v2/alert-destinations.ts  |   26 +-
 packages/domain/src/http/v2/api.ts            |    2 +
 packages/domain/src/http/v2/index.ts          |    1 +
 packages/domain/src/http/v2/integrations.ts   |  194 +
 packages/domain/src/http/v2/openapi.test.ts   |    4 +
 43 files changed, 9759 insertions(+), 144 deletions(-)
 create mode 100644 apps/api/src/routes/slack-integration.http.ts
 create mode 100644 apps/api/src/routes/v2/integrations.http.ts
 create mode 100644 apps/api/src/services/SlackIntegrationService.test.ts
 create mode 100644 apps/api/src/services/SlackIntegrationService.ts
 create mode 100644 apps/slack-agent/agent/connections/maple.ts
 create mode 100644 apps/slack-agent/agent/lib/maple.ts
 create mode 100644 apps/web/src/components/icons/slack.tsx
 create mode 100644 apps/web/src/components/integrations/slack-integration-card.tsx
 create mode 100644 packages/db/drizzle/0017_fair_mandarin.sql
 create mode 100644 packages/db/drizzle/meta/0017_snapshot.json
 create mode 100644 packages/db/src/schema/slack-workspaces.ts
 create mode 100644 packages/domain/src/http/v2/integrations.ts

diff --git a/.env.example b/.env.example
index 86c22df3a..513d6da85 100644
--- a/.env.example
+++ b/.env.example
@@ -121,6 +121,14 @@ INGEST_REQUIRE_TLS=false
 # HAZEL_OAUTH_CLIENT_SECRET=
 # HAZEL_OAUTH_SCOPES=openid email profile organizations:read channels:read channel-webhooks:write
 
+# Slack integration (bot install via OAuth v2)
+# Maple installs a Slack app into a workspace via OAuth. Create a Slack app at
+# https://api.slack.com/apps, add the bot scopes, and set the redirect URL to
+# <API_BASE>/oauth/slack/callback. Both values are optional — the integration
+# stays disabled until they are set.
+# SLACK_CLIENT_ID=
+# SLACK_CLIENT_SECRET=
+
 # GitHub integration (GitHub App)
 # Maple connects to GitHub via a GitHub App for repo access, OAuth sign-in, and
 # webhooks. Create one at https://github.com/settings/apps (or your org's
diff --git a/apps/api/alchemy.run.ts b/apps/api/alchemy.run.ts
index a4507c8dd..862726d6f 100644
--- a/apps/api/alchemy.run.ts
+++ b/apps/api/alchemy.run.ts
@@ -199,6 +199,9 @@ export const createMapleApi = ({ stage, domains }: CreateMapleApiOptions) =>
 				...optionalPlain("HAZEL_OAUTH_CLIENT_ID"),
 				...optionalSecret("HAZEL_OAUTH_CLIENT_SECRET"),
 				...optionalPlain("HAZEL_OAUTH_SCOPES"),
+				// Slack integration (bot install via OAuth v2)
+				...optionalPlain("SLACK_CLIENT_ID"),
+				...optionalSecret("SLACK_CLIENT_SECRET"),
 				...optionalPlain("GITHUB_APP_ID"),
 				...optionalPlain("GITHUB_APP_SLUG"),
 				...optionalSecret("GITHUB_APP_PRIVATE_KEY"),
diff --git a/apps/api/src/app.ts b/apps/api/src/app.ts
index dc3aefd53..f25f01e95 100644
--- a/apps/api/src/app.ts
+++ b/apps/api/src/app.ts
@@ -17,6 +17,7 @@ import { HttpV2ApiKeysLive } from "./routes/v2/api-keys.http"
 import { HttpV2AttributeMappingsLive } from "./routes/v2/attribute-mappings.http"
 import { HttpV2DashboardsLive } from "./routes/v2/dashboards.http"
 import { HttpV2IngestKeysLive } from "./routes/v2/ingest-keys.http"
+import { HttpV2SlackIntegrationsLive } from "./routes/v2/integrations.http"
 import { HttpV2ErrorIssuesLive } from "./routes/v2/error-issues.http"
 import { HttpV2AnomaliesLive } from "./routes/v2/anomalies.http"
 import { HttpV2InvestigationsLive } from "./routes/v2/investigations.http"
@@ -47,6 +48,7 @@ import { OAuthDiscoveryRouter } from "./routes/oauth-discovery.http"
 import { HttpOrgClickHouseSettingsLive } from "./routes/org-clickhouse-settings.http"
 import { HttpOrganizationsLive } from "./routes/organizations.http"
 import { PlanetScaleWebhookRouter } from "./routes/planetscale-webhook.http"
+import { SlackCallbackRouter, SlackInternalRouter } from "./routes/slack-integration.http"
 import { PrometheusScrapeProxyRouter } from "./routes/prometheus-scrape-proxy.http"
 import { ScraperInternalRouter } from "./routes/scraper-internal.http"
 import { VcsWebhookRouter } from "./routes/vcs-webhook.http"
@@ -90,6 +92,7 @@ import { PlanetScaleDiscoveryService } from "./services/PlanetScaleDiscoveryServ
 import { PlanetScaleOAuthService } from "./services/PlanetScaleOAuthService"
 import { PlanetScaleService } from "./services/PlanetScaleService"
 import { ScrapeTargetsService } from "./services/ScrapeTargetsService"
+import { SlackIntegrationService } from "./services/SlackIntegrationService"
 import { WarehouseQueryService } from "./lib/WarehouseQueryService"
 import { OAuthStateRepository } from "./services/OAuthStateRepository"
 import { GithubAppClient } from "./services/vcs/vendor/github/GithubAppClient"
@@ -201,6 +204,13 @@ const NotificationDispatcherLive = NotificationDispatcher.layer.pipe(
 	Layer.provideMerge(Layer.mergeAll(CoreServicesLive, EmailServiceLive)),
 )
 
+// Slack integration: OAuth install/callback, status, channels, uninstall, and
+// the internal bot-resolve endpoint. Needs ApiKeysService (mint the bot key) +
+// OAuthStateRepository (CSRF state) on top of the core services.
+const SlackIntegrationServiceLive = SlackIntegrationService.layer.pipe(
+	Layer.provideMerge(Layer.mergeAll(CoreServicesLive, OAuthStateRepository.layer)),
+)
+
 const ErrorsServiceLive = ErrorsService.layer.pipe(
 	Layer.provideMerge(
 		Layer.mergeAll(
@@ -268,6 +278,7 @@ export const MainLive = Layer.mergeAll(
 	DigestServiceLive,
 	DemoServiceLive,
 	VcsServicesLive,
+	SlackIntegrationServiceLive,
 )
 
 const ApiRoutes = HttpApiBuilder.layer(MapleApi).pipe(
@@ -308,6 +319,7 @@ const ApiV2Routes = HttpApiBuilder.layer(MapleApiV2).pipe(
 			HttpV2AlertDestinationsLive,
 			HttpV2AlertIncidentsLive,
 			HttpV2IngestKeysLive,
+			HttpV2SlackIntegrationsLive,
 			HttpV2ErrorIssuesLive,
 			HttpV2AttributeMappingsLive,
 			HttpV2ScrapeTargetsLive,
@@ -330,6 +342,8 @@ export const AllRoutes = Layer.mergeAll(
 	ApiRoutes,
 	ApiV2Routes,
 	IntegrationsCallbackRouter,
+	SlackCallbackRouter,
+	SlackInternalRouter,
 	OAuthDiscoveryRouter,
 	PlanetScaleWebhookRouter,
 	PrometheusScrapeProxyRouter,
diff --git a/apps/api/src/lib/Env.ts b/apps/api/src/lib/Env.ts
index 26052e0b1..bb914adf5 100644
--- a/apps/api/src/lib/Env.ts
+++ b/apps/api/src/lib/Env.ts
@@ -44,6 +44,8 @@ export interface EnvShape {
 	readonly HAZEL_OAUTH_CLIENT_ID: Option.Option<string>
 	readonly HAZEL_OAUTH_CLIENT_SECRET: Option.Option<Redacted.Redacted<string>>
 	readonly HAZEL_OAUTH_SCOPES: string
+	readonly SLACK_CLIENT_ID: Option.Option<string>
+	readonly SLACK_CLIENT_SECRET: Option.Option<Redacted.Redacted<string>>
 	readonly GITHUB_APP_ID: Option.Option<string>
 	readonly GITHUB_APP_SLUG: Option.Option<string>
 	readonly GITHUB_APP_PRIVATE_KEY: Option.Option<Redacted.Redacted<string>>
@@ -126,6 +128,8 @@ const envConfig = Config.all({
 		"HAZEL_OAUTH_SCOPES",
 		"openid email profile organizations:read channels:read channel-webhooks:write",
 	),
+	SLACK_CLIENT_ID: optionalString("SLACK_CLIENT_ID"),
+	SLACK_CLIENT_SECRET: optionalRedacted("SLACK_CLIENT_SECRET"),
 	GITHUB_APP_ID: optionalString("GITHUB_APP_ID"),
 	GITHUB_APP_SLUG: optionalString("GITHUB_APP_SLUG"),
 	GITHUB_APP_PRIVATE_KEY: optionalRedacted("GITHUB_APP_PRIVATE_KEY"),
diff --git a/apps/api/src/routes/slack-integration.http.ts b/apps/api/src/routes/slack-integration.http.ts
new file mode 100644
index 000000000..92e7030c9
--- /dev/null
+++ b/apps/api/src/routes/slack-integration.http.ts
@@ -0,0 +1,159 @@
+import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http"
+import { Effect, Option, Redacted } from "effect"
+import { timingSafeEqual } from "node:crypto"
+import { Env } from "../lib/Env"
+import { SlackIntegrationService, SLACK_CALLBACK_PATH } from "../services/SlackIntegrationService"
+
+const INTERNAL_SERVICE_PREFIX = "maple_svc_"
+
+/** Redirect target on the web app after an install attempt. */
+const buildAppRedirect = (appBaseUrl: string, params: Record<string, string>): string => {
+	const base = appBaseUrl.replace(/\/$/, "")
+	// Land on the Slack integration card (route `/integrations`, search `integration`),
+	// carrying the `slack=connected|error` return params the card surfaces as a toast.
+	const search = new URLSearchParams({ integration: "slack", ...params }).toString()
+	return `${base}/integrations?${search}`
+}
+
+/**
+ * Public Slack OAuth callback (`GET /oauth/slack/callback`). Slack redirects the
+ * browser here after the user approves (or denies) the install; we exchange the
+ * code, persist the workspace, then redirect the browser back to the web app's
+ * integrations page with a success/error query param.
+ */
+export const SlackCallbackRouter = HttpRouter.use((router) =>
+	Effect.gen(function* () {
+		const slack = yield* SlackIntegrationService
+		const env = yield* Env
+
+		const redirect = (params: Record<string, string>) =>
+			HttpServerResponse.redirect(buildAppRedirect(env.MAPLE_APP_BASE_URL, params))
+
+		const handle = Effect.fn("slack.oauthCallback")(function* (
+			req: HttpServerRequest.HttpServerRequest,
+		) {
+			const urlOption = Option.liftThrowable(() => new URL(req.url, "http://localhost"))()
+			if (Option.isNone(urlOption)) {
+				return redirect({ slack: "error", message: "Malformed callback URL" })
+			}
+			const url = urlOption.value
+			const code = url.searchParams.get("code")
+			const state = url.searchParams.get("state")
+			const oauthError = url.searchParams.get("error")
+
+			if (oauthError) {
+				return redirect({ slack: "error", message: oauthError })
+			}
+			if (!code || !state) {
+				return redirect({ slack: "error", message: "Missing code or state in callback" })
+			}
+
+			return yield* slack.completeInstall(code, state).pipe(
+				Effect.tapError((error) =>
+					Effect.logError("Slack OAuth completeInstall failed", {
+						tag: error._tag,
+						message: error.message,
+					}),
+				),
+				Effect.map((result) =>
+					redirect({
+						slack: "connected",
+						...(result.teamName ? { team: result.teamName } : {}),
+					}),
+				),
+				Effect.catchTags({
+					"@maple/http/errors/IntegrationsValidationError": (error) =>
+						Effect.succeed(redirect({ slack: "error", message: error.message })),
+					"@maple/http/errors/IntegrationsForbiddenError": (error) =>
+						Effect.succeed(redirect({ slack: "error", message: error.message })),
+					"@maple/http/errors/IntegrationsUpstreamError": () =>
+						Effect.succeed(
+							redirect({ slack: "error", message: "Failed to complete the Slack connection" }),
+						),
+					"@maple/http/errors/IntegrationsPersistenceError": () =>
+						Effect.succeed(
+							redirect({ slack: "error", message: "Failed to complete the Slack connection" }),
+						),
+				}),
+			)
+		})
+
+		yield* router.add("GET", SLACK_CALLBACK_PATH, handle)
+	}),
+)
+
+const errorText = (message: string, status: number) =>
+	HttpServerResponse.text(message, { status, headers: { "content-type": "text/plain; charset=utf-8" } })
+
+/**
+ * Constant-time check of an `Authorization: Bearer maple_svc_<token>` header
+ * against the configured `INTERNAL_SERVICE_TOKEN`. Mirrors
+ * `resolveMcpTenantContext`'s internal-service auth.
+ */
+const isValidServiceBearer = (
+	authorization: string | undefined,
+	internalToken: string | undefined,
+): boolean => {
+	if (!internalToken) return false
+	if (!authorization) return false
+	const [scheme, token] = authorization.split(" ")
+	if (!scheme || !token || scheme.toLowerCase() !== "bearer") return false
+	if (!token.startsWith(INTERNAL_SERVICE_PREFIX)) return false
+	const provided = token.slice(INTERNAL_SERVICE_PREFIX.length)
+	return (
+		provided.length === internalToken.length &&
+		timingSafeEqual(Buffer.from(provided), Buffer.from(internalToken))
+	)
+}
+
+/**
+ * Internal endpoint for the Railway-hosted Slack bot. Given a Slack `teamId`,
+ * returns the bound org's decrypted bot token + minted Maple API key so the bot
+ * can act on the org's behalf. Guarded by the shared internal-service token
+ * (`Authorization: Bearer maple_svc_<INTERNAL_SERVICE_TOKEN>`).
+ *
+ * Response contract (FIXED — the bot is built against it):
+ *   200 → { orgId, teamId, teamName, botToken, mapleApiKey }
+ *   404 → unknown or revoked team
+ */
+export const SlackInternalRouter = HttpRouter.use((router) =>
+	Effect.gen(function* () {
+		const slack = yield* SlackIntegrationService
+		const env = yield* Env
+		const internalToken = Option.match(env.INTERNAL_SERVICE_TOKEN, {
+			onNone: () => undefined,
+			onSome: Redacted.value,
+		})
+
+		const handle = Effect.fn("slack.internalResolve")(function* (
+			req: HttpServerRequest.HttpServerRequest,
+		) {
+			if (!internalToken) return errorText("Internal service token is not configured", 401)
+			if (!isValidServiceBearer(req.headers.authorization, internalToken)) {
+				return errorText("Unauthorized", 401)
+			}
+			const url = Option.liftThrowable(() => new URL(req.url, "http://localhost"))()
+			const pathname = Option.match(url, { onNone: () => "", onSome: (u) => u.pathname })
+			const teamId = decodeURIComponent(pathname.split("/").pop() ?? "")
+			if (!teamId) return errorText("Missing teamId", 400)
+
+			const resolution = yield* slack.resolveForBot(teamId).pipe(
+				Effect.catchTag("@maple/http/errors/IntegrationsNotConnectedError", () =>
+					Effect.succeed(null),
+				),
+			)
+			if (resolution === null) {
+				return errorText("No active Slack installation for this team", 404)
+			}
+			return yield* HttpServerResponse.json({
+				orgId: resolution.orgId,
+				teamId: resolution.teamId,
+				teamName: resolution.teamName,
+				botToken: resolution.botToken,
+				mapleApiKey: resolution.mapleApiKey,
+			})
+		})
+
+		yield* router.add("GET", "/internal/slack/workspaces/:teamId", handle)
+	}),
+)
diff --git a/apps/api/src/routes/v2/alert-destinations.http.ts b/apps/api/src/routes/v2/alert-destinations.http.ts
index d61d38d7c..81ac0e6c8 100644
--- a/apps/api/src/routes/v2/alert-destinations.http.ts
+++ b/apps/api/src/routes/v2/alert-destinations.http.ts
@@ -8,6 +8,7 @@ import {
 	HazelOAuthAlertDestinationConfig,
 	PagerDutyAlertDestinationConfig,
 	SlackAlertDestinationConfig,
+	SlackBotAlertDestinationConfig,
 	WebhookAlertDestinationConfig,
 } from "@maple/domain/http"
 import type {
@@ -51,6 +52,14 @@ const toCreateRequest = (params: V2AlertDestinationCreateParams) => {
 				...(params.channel_label !== undefined ? { channelLabel: params.channel_label } : {}),
 				...(params.enabled !== undefined ? { enabled: params.enabled } : {}),
 			})
+		case "slack-bot":
+			return new SlackBotAlertDestinationConfig({
+				type: "slack-bot",
+				name: params.name,
+				channelId: params.channel_id,
+				...(params.channel_name !== undefined ? { channelName: params.channel_name } : {}),
+				...(params.enabled !== undefined ? { enabled: params.enabled } : {}),
+			})
 		case "pagerduty":
 			return new PagerDutyAlertDestinationConfig({
 				type: "pagerduty",
@@ -117,6 +126,13 @@ const toUpdateRequest = (params: V2AlertDestinationUpdateParams): AlertDestinati
 				...(params.webhook_url !== undefined ? { webhookUrl: params.webhook_url } : {}),
 				...(params.channel_label !== undefined ? { channelLabel: params.channel_label } : {}),
 			}
+		case "slack-bot":
+			return {
+				type: "slack-bot",
+				...shared,
+				...(params.channel_id !== undefined ? { channelId: params.channel_id } : {}),
+				...(params.channel_name !== undefined ? { channelName: params.channel_name } : {}),
+			}
 		case "pagerduty":
 			return {
 				type: "pagerduty",
diff --git a/apps/api/src/routes/v2/integrations.http.ts b/apps/api/src/routes/v2/integrations.http.ts
new file mode 100644
index 000000000..72beb2cc2
--- /dev/null
+++ b/apps/api/src/routes/v2/integrations.http.ts
@@ -0,0 +1,132 @@
+import { HttpServerRequest } from "effect/unstable/http"
+import { HttpApiBuilder } from "effect/unstable/httpapi"
+import { CurrentTenant } from "@maple/domain/http"
+import type {
+	V2SlackChannelList,
+	V2SlackIntegrationStatus,
+	V2SlackInstallResponse,
+	V2SlackUninstallResponse,
+} from "@maple/domain/http/v2"
+import {
+	MapleApiV2,
+	notFound,
+	permissionError,
+	serviceUnavailable,
+	upstreamError,
+} from "@maple/domain/http/v2"
+import { Effect, Option } from "effect"
+import { requireAdmin } from "../../lib/auth"
+import type { SlackChannelSummary, SlackInstallStatus } from "../../services/SlackIntegrationService"
+import { SLACK_CALLBACK_PATH, SlackIntegrationService } from "../../services/SlackIntegrationService"
+
+const resolveRequestOrigin = (req: HttpServerRequest.HttpServerRequest): string => {
+	const headers = req.headers as Record<string, string | undefined>
+	const forwardedHost = headers["x-forwarded-host"]
+	const forwardedProto = headers["x-forwarded-proto"]
+	const host = forwardedHost ?? headers.host
+	if (host) {
+		const proto =
+			forwardedProto ?? (host.startsWith("localhost") || host.startsWith("127.") ? "http" : "https")
+		return `${proto}://${host}`
+	}
+	return Option.match(Option.liftThrowable(() => new URL(req.url))(), {
+		onNone: () => "",
+		onSome: (parsed) => `${parsed.protocol}//${parsed.host}`,
+	})
+}
+
+const toStatus = (status: SlackInstallStatus): V2SlackIntegrationStatus => ({
+	object: "slack_integration",
+	installed: status.installed,
+	team_id: status.teamId,
+	team_name: status.teamName,
+	bot_user_id: status.botUserId,
+	installed_at: status.installedAt != null ? new Date(status.installedAt).toISOString() : null,
+})
+
+const toChannelList = (channels: ReadonlyArray<SlackChannelSummary>): V2SlackChannelList => ({
+	object: "slack_integration.channel_list",
+	channels: channels.map((channel) => ({
+		id: channel.id,
+		name: channel.name,
+		is_private: channel.isPrivate,
+		is_member: channel.isMember,
+	})),
+})
+
+export const HttpV2SlackIntegrationsLive = HttpApiBuilder.group(MapleApiV2, "slackIntegration", (handlers) =>
+	Effect.gen(function* () {
+		const slack = yield* SlackIntegrationService
+
+		return handlers
+			.handle("status", () =>
+				Effect.gen(function* () {
+					const tenant = yield* CurrentTenant.Context
+					const status = yield* slack.getStatus(tenant.orgId).pipe(
+						Effect.mapError(() => serviceUnavailable("Slack integration status is unavailable")),
+					)
+					return toStatus(status)
+				}),
+			)
+			.handle("install", () =>
+				Effect.gen(function* () {
+					const tenant = yield* CurrentTenant.Context
+					yield* requireAdmin(tenant.roles, () =>
+						permissionError(
+							"insufficient_permissions",
+							"Only org admins can install the Slack app",
+						),
+					)
+					const req = yield* HttpServerRequest.HttpServerRequest
+					const callbackUrl = `${resolveRequestOrigin(req)}${SLACK_CALLBACK_PATH}`
+					const result = yield* slack
+						.startInstall(tenant.orgId, tenant.userId, callbackUrl)
+						.pipe(
+							Effect.catchTags({
+								"@maple/http/errors/IntegrationsValidationError": (error) =>
+									Effect.fail(serviceUnavailable(error.message)),
+								"@maple/http/errors/IntegrationsPersistenceError": (error) =>
+									Effect.fail(serviceUnavailable(error.message)),
+							}),
+						)
+					return { object: "slack_integration.install" as const, url: result.url } satisfies V2SlackInstallResponse
+				}),
+			)
+			.handle("uninstall", () =>
+				Effect.gen(function* () {
+					const tenant = yield* CurrentTenant.Context
+					yield* requireAdmin(tenant.roles, () =>
+						permissionError(
+							"insufficient_permissions",
+							"Only org admins can uninstall the Slack app",
+						),
+					)
+					yield* slack.uninstall(tenant.orgId).pipe(
+						Effect.mapError(() => serviceUnavailable("Failed to uninstall the Slack app")),
+					)
+					return {
+						object: "slack_integration" as const,
+						installed: false as const,
+					} satisfies V2SlackUninstallResponse
+				}),
+			)
+			.handle("channels", () =>
+				Effect.gen(function* () {
+					const tenant = yield* CurrentTenant.Context
+					const channels = yield* slack.listChannels(tenant.orgId).pipe(
+						Effect.catchTags({
+							"@maple/http/errors/IntegrationsNotConnectedError": (error) =>
+								Effect.fail(notFound(error.message)),
+							"@maple/http/errors/IntegrationsUpstreamError": (error) =>
+								Effect.fail(upstreamError("slack_upstream_error", error.message)),
+							"@maple/http/errors/IntegrationsValidationError": (error) =>
+								Effect.fail(serviceUnavailable(error.message)),
+							"@maple/http/errors/IntegrationsPersistenceError": (error) =>
+								Effect.fail(serviceUnavailable(error.message)),
+						}),
+					)
+					return toChannelList(channels)
+				}),
+			)
+	}),
+)
diff --git a/apps/api/src/routes/v2/v2-test-support.ts b/apps/api/src/routes/v2/v2-test-support.ts
index 2f56ba842..f48621861 100644
--- a/apps/api/src/routes/v2/v2-test-support.ts
+++ b/apps/api/src/routes/v2/v2-test-support.ts
@@ -8,6 +8,7 @@ import { OrganizationService } from "../../services/OrganizationService"
 import { OrgIngestKeysService } from "../../services/OrgIngestKeysService"
 import { RecommendationIssueService } from "../../services/RecommendationIssueService"
 import { ScrapeTargetsService } from "../../services/ScrapeTargetsService"
+import { SlackIntegrationService } from "../../services/SlackIntegrationService"
 import { ApiV2RateLimiter } from "../../services/ApiV2RateLimiter"
 import { WarehouseQueryService } from "../../lib/WarehouseQueryService"
 import { QueryEngineService } from "../../services/QueryEngineService"
@@ -18,6 +19,7 @@ import { HttpV2ApiKeysLive } from "./api-keys.http"
 import { HttpV2AttributeMappingsLive } from "./attribute-mappings.http"
 import { HttpV2DashboardsLive } from "./dashboards.http"
 import { HttpV2IngestKeysLive } from "./ingest-keys.http"
+import { HttpV2SlackIntegrationsLive } from "./integrations.http"
 import { HttpV2ErrorIssuesLive } from "./error-issues.http"
 import { HttpV2AnomaliesLive } from "./anomalies.http"
 import { HttpV2InvestigationsLive } from "./investigations.http"
@@ -40,8 +42,26 @@ import {
  * the groups it does not exercise.
  */
 
+/**
+ * Inert SlackIntegrationService — the slack integration group is registered on
+ * MapleApiV2, so the full-API harnesses must satisfy it even when they don't
+ * exercise it. Provided directly onto the group layer below so it leaks no
+ * requirement into the harnesses.
+ */
+const SlackIntegrationServiceStubLayer = Layer.succeed(SlackIntegrationService, {
+	startInstall: () => Effect.die(new Error("SlackIntegrationService is not available in this test harness")),
+	completeInstall: () =>
+		Effect.die(new Error("SlackIntegrationService is not available in this test harness")),
+	getStatus: () => Effect.die(new Error("SlackIntegrationService is not available in this test harness")),
+	uninstall: () => Effect.die(new Error("SlackIntegrationService is not available in this test harness")),
+	listChannels: () => Effect.die(new Error("SlackIntegrationService is not available in this test harness")),
+	resolveForBot: () =>
+		Effect.die(new Error("SlackIntegrationService is not available in this test harness")),
+})
+
 export const AllV2GroupLayersLive = Layer.mergeAll(
 	HttpV2ApiKeysLive,
+	HttpV2SlackIntegrationsLive.pipe(Layer.provide(SlackIntegrationServiceStubLayer)),
 	HttpV2DashboardsLive,
 	HttpV2AlertRulesLive,
 	HttpV2AlertDestinationsLive,
diff --git a/apps/api/src/services/AlertDeliveryDispatch.test.ts b/apps/api/src/services/AlertDeliveryDispatch.test.ts
index 69bfed125..9af41a5c3 100644
--- a/apps/api/src/services/AlertDeliveryDispatch.test.ts
+++ b/apps/api/src/services/AlertDeliveryDispatch.test.ts
@@ -39,10 +39,17 @@ const LINK = "https://web.localhost/alerts"
 const CHAT = "https://web.localhost/chat?mode=alert"
 const DESTINATION_ID = Schema.decodeUnknownSync(AlertDestinationId)("7c6b5a49-3821-4e0f-9d8c-7b6a59483726")
 
+/** Slack-token resolver that must not be invoked for non-slack-bot destinations. */
+const failingSlackToken = () =>
+	Effect.fail(
+		new AlertDeliveryError({ message: "unexpected resolveSlackBotToken", destinationType: "slack-bot" }),
+	)
+
 /** Dispatch deps for non-email destinations — email sends must not happen. */
 const noEmailDeps: DispatchDeps = {
 	sendEmail: () =>
 		Effect.fail(new AlertDeliveryError({ message: "unexpected sendEmail", destinationType: "email" })),
+	resolveSlackBotToken: failingSlackToken,
 }
 
 describe("buildAlertChatUrl (Ask Maple AI link)", () => {
@@ -198,6 +205,95 @@ describe("dispatchDelivery", () => {
 		}),
 	)
 
+	const slackBotContext: DispatchContext = {
+		...pagerdutyContext,
+		destination: { ...destinationRow, name: "Slack bot", type: "slack-bot" },
+		publicConfig: { summary: "#incidents", channelLabel: "#incidents" },
+		secretConfig: { type: "slack-bot", channelId: "C0789CHAN", channelName: "incidents" },
+	}
+
+	const slackTokenDeps = (token = "xoxb-test-token"): DispatchDeps => ({
+		sendEmail: () =>
+			Effect.fail(new AlertDeliveryError({ message: "unexpected sendEmail", destinationType: "email" })),
+		resolveSlackBotToken: () => Effect.succeed(token),
+	})
+
+	it.effect("slack-bot: posts to chat.postMessage with the resolved bot token + channel", () =>
+		Effect.gen(function* () {
+			const calls: Array<{ url: string; auth: string | null; body: unknown }> = []
+			const fetchFn: typeof fetch = async (input, init) => {
+				calls.push({
+					url: String(input),
+					auth: new Headers(init?.headers).get("authorization"),
+					body: JSON.parse(String(init?.body)),
+				})
+				return new Response(JSON.stringify({ ok: true, ts: "1700000000.000100" }), { status: 200 })
+			}
+
+			const result = yield* dispatchDelivery(
+				slackBotContext,
+				"{}",
+				fetchFn,
+				5_000,
+				LINK,
+				CHAT,
+				slackTokenDeps(),
+			)
+
+			assert.strictEqual(calls.length, 1)
+			assert.strictEqual(calls[0]!.url, "https://slack.com/api/chat.postMessage")
+			assert.strictEqual(calls[0]!.auth, "Bearer xoxb-test-token")
+			assert.strictEqual((calls[0]!.body as { channel: string }).channel, "C0789CHAN")
+			assert.isArray((calls[0]!.body as { blocks: unknown[] }).blocks)
+			assert.strictEqual(result.providerReference, "1700000000.000100")
+			assert.strictEqual(result.responseCode, 200)
+		}),
+	)
+
+	it.effect("slack-bot: surfaces a not_in_channel logical error with an actionable message", () =>
+		Effect.gen(function* () {
+			const fetchFn: typeof fetch = async () =>
+				new Response(JSON.stringify({ ok: false, error: "not_in_channel" }), { status: 200 })
+
+			const error = yield* Effect.flip(
+				dispatchDelivery(slackBotContext, "{}", fetchFn, 5_000, LINK, CHAT, slackTokenDeps()),
+			)
+
+			assert.instanceOf(error, AlertDeliveryError)
+			assert.strictEqual(error.destinationType, "slack-bot")
+			assert.include(error.message, "not_in_channel")
+			assert.include(error.message, "invite the Maple bot")
+		}),
+	)
+
+	it.effect("slack-bot: fails when the org has no active Slack installation", () =>
+		Effect.gen(function* () {
+			const fetchFn: typeof fetch = async () => {
+				throw new Error("fetch must not be called when token resolution fails")
+			}
+			const deps: DispatchDeps = {
+				sendEmail: () =>
+					Effect.fail(
+						new AlertDeliveryError({ message: "unexpected sendEmail", destinationType: "email" }),
+					),
+				resolveSlackBotToken: () =>
+					Effect.fail(
+						new AlertDeliveryError({
+							message: "Slack is not connected for this organization",
+							destinationType: "slack-bot",
+						}),
+					),
+			}
+
+			const error = yield* Effect.flip(
+				dispatchDelivery(slackBotContext, "{}", fetchFn, 5_000, LINK, CHAT, deps),
+			)
+
+			assert.instanceOf(error, AlertDeliveryError)
+			assert.include(error.message, "Slack is not connected")
+		}),
+	)
+
 	const failingFetch: typeof fetch = async () => {
 		throw new Error("fetch must not be called for email dispatch")
 	}
@@ -250,6 +346,7 @@ describe("dispatchDelivery", () => {
 							destinationType: "email",
 						}),
 					),
+				resolveSlackBotToken: failingSlackToken,
 			}
 
 			const error = yield* Effect.flip(
@@ -277,6 +374,7 @@ describe("dispatchDelivery", () => {
 						: Effect.sync(() => {
 								sent.push(to)
 							}),
+				resolveSlackBotToken: failingSlackToken,
 			}
 
 			const result = yield* dispatchDelivery(emailContext, "{}", failingFetch, 5_000, LINK, CHAT, deps)
@@ -298,6 +396,7 @@ describe("dispatchDelivery", () => {
 							destinationType: "email",
 						}),
 					),
+				resolveSlackBotToken: failingSlackToken,
 			}
 
 			const error = yield* Effect.flip(
diff --git a/apps/api/src/services/AlertDeliveryDispatch.ts b/apps/api/src/services/AlertDeliveryDispatch.ts
index 25d82127e..d500bfaf1 100644
--- a/apps/api/src/services/AlertDeliveryDispatch.ts
+++ b/apps/api/src/services/AlertDeliveryDispatch.ts
@@ -572,6 +572,13 @@ export interface DispatchDeps {
 	 * binding). Injected like `fetchFn` so this module stays dependency-free.
 	 */
 	readonly sendEmail: (to: string, subject: string, html: string) => Effect.Effect<void, AlertDeliveryError>
+	/**
+	 * Resolves the decrypted Slack bot token for an org from its
+	 * `slack_workspaces` row. Injected like `sendEmail` so this module stays
+	 * dependency-free — only the `slack-bot` destination arm invokes it. Fails
+	 * (AlertDeliveryError) when the org has no active Slack installation.
+	 */
+	readonly resolveSlackBotToken: (orgId: string) => Effect.Effect<string, AlertDeliveryError>
 }
 
 export const dispatchDelivery = (
@@ -631,6 +638,71 @@ export const dispatchDelivery = (
 							responseCode: response.status,
 						} as DispatchResult
 					}),
+				"slack-bot": (config) =>
+					Effect.gen(function* () {
+						const botToken = yield* deps.resolveSlackBotToken(context.destination.orgId)
+						const templated = renderTitleBody(context, "slack", linkUrl, chatUrl)
+						const blocks = templated
+							? buildSlackBlocksFromTemplate(
+									templated.title,
+									templated.body,
+									context,
+									linkUrl,
+									chatUrl,
+								)
+							: buildSlackBlocks(context, linkUrl, chatUrl)
+						const response = yield* runTimedFetch(
+							"slack-bot",
+							"Slack",
+							fetchFn,
+							timeoutMs,
+							() =>
+								fetchFn("https://slack.com/api/chat.postMessage", {
+									method: "POST",
+									headers: {
+										"content-type": "application/json; charset=utf-8",
+										authorization: `Bearer ${botToken}`,
+									},
+									body: JSON.stringify({
+										channel: config.channelId,
+										text:
+											templated?.title ??
+											`${context.ruleName}: ${formatEventTypeLabel(context.eventType)}`,
+										blocks,
+									}),
+								}),
+						)
+						if (!response.ok) {
+							const detail = yield* readErrorBody(response)
+							return yield* Effect.fail(
+								makeDeliveryError(
+									`Slack delivery failed with ${response.status}${detail ? `: ${detail}` : ""}`,
+									"slack-bot",
+								),
+							)
+						}
+						// Slack Web API returns HTTP 200 with `{ ok: false, error }` on
+						// logical failures, so the JSON body — not the status — is the
+						// source of truth.
+						const payload = yield* Effect.tryPromise({
+							try: () => response.json() as Promise<{ ok?: boolean; error?: string; ts?: string }>,
+							catch: () =>
+								makeDeliveryError("Slack returned a non-JSON response", "slack-bot"),
+						})
+						if (!payload.ok) {
+							const error = payload.error ?? "unknown_error"
+							const message =
+								error === "not_in_channel" || error === "channel_not_found"
+									? `Slack rejected the message (${error}) — invite the Maple bot to the channel and try again`
+									: `Slack rejected the message: ${error}`
+							return yield* Effect.fail(makeDeliveryError(message, "slack-bot"))
+						}
+						return {
+							providerMessage: `Delivered to Slack #${config.channelName ?? config.channelId}`,
+							providerReference: payload.ts ?? null,
+							responseCode: response.status,
+						} as DispatchResult
+					}),
 				pagerduty: (config) =>
 					Effect.gen(function* () {
 						const templated = renderTitleBody(context, "pagerduty", linkUrl, chatUrl)
diff --git a/apps/api/src/services/AlertDestinationHydration.ts b/apps/api/src/services/AlertDestinationHydration.ts
index 6679c9e5d..1b366486e 100644
--- a/apps/api/src/services/AlertDestinationHydration.ts
+++ b/apps/api/src/services/AlertDestinationHydration.ts
@@ -18,6 +18,13 @@ const DestinationSecretConfigSchema = Schema.Union([
 		type: Schema.Literal("slack"),
 		webhookUrl: Schema.String,
 	}),
+	Schema.Struct({
+		type: Schema.Literal("slack-bot"),
+		// No secret token here — the bot token is resolved from the org's
+		// slack_workspaces row at dispatch time. Only the target channel is stored.
+		channelId: Schema.String,
+		channelName: Schema.NullOr(Schema.String),
+	}),
 	Schema.Struct({
 		type: Schema.Literal("pagerduty"),
 		integrationKey: Schema.String,
diff --git a/apps/api/src/services/AlertsService.ts b/apps/api/src/services/AlertsService.ts
index 255f1af07..ac2448960 100644
--- a/apps/api/src/services/AlertsService.ts
+++ b/apps/api/src/services/AlertsService.ts
@@ -138,6 +138,7 @@ import {
 	type DestinationSecretConfig,
 	type EnrichedDestinationSecretConfig,
 } from "./AlertDestinationHydration"
+import { resolveSlackBotTokenForDispatch } from "./SlackIntegrationService"
 import { dateToMs } from "../lib/time"
 
 interface NormalizedRule {
@@ -579,6 +580,10 @@ const buildPublicConfig = (
 				summary: r.channelLabel?.trim() || "Slack incoming webhook",
 				channelLabel: normalizeOptionalString(r.channelLabel),
 			}),
+			"slack-bot": (r) => ({
+				summary: r.channelName?.trim() ? `#${r.channelName.trim()}` : "Slack channel",
+				channelLabel: r.channelName?.trim() ? `#${r.channelName.trim()}` : null,
+			}),
 			pagerduty: () => ({
 				summary: "PagerDuty Events API v2" as string,
 				channelLabel: null,
@@ -619,6 +624,11 @@ const buildSecretConfig = (
 				type: "slack" as const,
 				webhookUrl: r.webhookUrl.trim(),
 			}),
+			"slack-bot": (r) => ({
+				type: "slack-bot" as const,
+				channelId: r.channelId.trim(),
+				channelName: normalizeOptionalString(r.channelName) ?? null,
+			}),
 			pagerduty: (r) => ({
 				type: "pagerduty" as const,
 				integrationKey: r.integrationKey.trim(),
@@ -1789,7 +1799,11 @@ export class AlertsService extends Context.Service<AlertsService, AlertsServiceS
 					deliveryTimeoutMs(),
 					context.linkUrl,
 					composeChatUrl(context),
-					{ sendEmail },
+					{
+						sendEmail,
+						resolveSlackBotToken: (orgId) =>
+							resolveSlackBotTokenForDispatch(database, encryptionKey, orgId),
+					},
 				)
 
 			const buildPayload = (context: DeliveryPayloadContext) => ({
@@ -2144,6 +2158,33 @@ export class AlertsService extends Context.Service<AlertsService, AlertsServiceS
 											: ""),
 								} satisfies DestinationSecretConfig,
 							}),
+						"slack-bot": (r) =>
+							Effect.succeed({
+								nextPublicConfig: {
+									summary:
+										normalizeOptionalString(r.channelName) != null
+											? `#${normalizeOptionalString(r.channelName)}`
+											: hydrated.publicConfig.summary,
+									channelLabel:
+										normalizeOptionalString(r.channelName) != null
+											? `#${normalizeOptionalString(r.channelName)}`
+											: hydrated.publicConfig.channelLabel,
+								} satisfies DestinationPublicConfig,
+								nextSecretConfig: {
+									type: "slack-bot" as const,
+									channelId:
+										normalizeOptionalString(r.channelId) ??
+										(hydrated.secretConfig.type === "slack-bot"
+											? hydrated.secretConfig.channelId
+											: ""),
+									channelName:
+										r.channelName === undefined
+											? hydrated.secretConfig.type === "slack-bot"
+												? hydrated.secretConfig.channelName
+												: null
+											: normalizeOptionalString(r.channelName) ?? null,
+								} satisfies DestinationSecretConfig,
+							}),
 						pagerduty: (r) =>
 							Effect.succeed({
 								nextPublicConfig: hydrated.publicConfig,
diff --git a/apps/api/src/services/NotificationDispatcher.ts b/apps/api/src/services/NotificationDispatcher.ts
index 6b14852c0..4d3053fe1 100644
--- a/apps/api/src/services/NotificationDispatcher.ts
+++ b/apps/api/src/services/NotificationDispatcher.ts
@@ -22,6 +22,7 @@ import {
 	type EnrichedDestinationSecretConfig,
 } from "./AlertDestinationHydration"
 import { parseBase64Aes256GcmKey } from "../lib/Crypto"
+import { resolveSlackBotTokenForDispatch } from "./SlackIntegrationService"
 import { Database } from "../lib/DatabaseLive"
 import { EmailService } from "../lib/EmailService"
 import { Env } from "../lib/Env"
@@ -187,7 +188,11 @@ const make: Effect.Effect<
 			DELIVERY_TIMEOUT_MS,
 			request.linkUrl,
 			chatUrl,
-			{ sendEmail },
+			{
+				sendEmail,
+				resolveSlackBotToken: (orgId) =>
+					resolveSlackBotTokenForDispatch(database, encryptionKey, orgId),
+			},
 		).pipe(Effect.tapError(() => Effect.annotateCurrentSpan({ "maple.delivery.outcome": "failed" })))
 		yield* Effect.annotateCurrentSpan({
 			"maple.delivery.outcome": "delivered",
diff --git a/apps/api/src/services/SlackIntegrationService.test.ts b/apps/api/src/services/SlackIntegrationService.test.ts
new file mode 100644
index 000000000..38c246a14
--- /dev/null
+++ b/apps/api/src/services/SlackIntegrationService.test.ts
@@ -0,0 +1,405 @@
+import { createCipheriv, randomBytes } from "node:crypto"
+import { afterEach, assert, describe, it } from "@effect/vitest"
+import { ConfigProvider, Effect, Layer, Schema } from "effect"
+import { FetchHttpClient } from "effect/unstable/http"
+import { OrgId, UserId } from "@maple/domain/http"
+import { Env } from "../lib/Env"
+import {
+	resolveSlackBotTokenForDispatch,
+	SlackIntegrationService,
+} from "./SlackIntegrationService"
+import { ApiKeysService } from "./ApiKeysService"
+import { OAuthStateRepository } from "./OAuthStateRepository"
+import { Database } from "../lib/DatabaseLive"
+import { cleanupTestDbs, createTestDb, executeSql, queryFirstRow, type TestDb } from "../lib/test-pglite"
+
+const ENCRYPTION_KEY = Buffer.alloc(32, 7)
+const ENCRYPTION_KEY_B64 = ENCRYPTION_KEY.toString("base64")
+
+/** AES-256-GCM encrypt matching Crypto.ts's format (12-byte iv, base64 fields). */
+const encryptField = (plaintext: string, key: Buffer) => {
+	const iv = randomBytes(12)
+	const cipher = createCipheriv("aes-256-gcm", key, iv)
+	const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()])
+	return {
+		ciphertext: ciphertext.toString("base64"),
+		iv: iv.toString("base64"),
+		tag: cipher.getAuthTag().toString("base64"),
+	}
+}
+
+const makeConfig = (slackConfigured = true) =>
+	ConfigProvider.layer(
+		ConfigProvider.fromUnknown({
+			PORT: "3472",
+			TINYBIRD_HOST: "https://api.tinybird.co",
+			TINYBIRD_TOKEN: "test-token",
+			MAPLE_AUTH_MODE: "self_hosted",
+			MAPLE_ROOT_PASSWORD: "test-root-password",
+			MAPLE_DEFAULT_ORG_ID: "default",
+			MAPLE_INGEST_KEY_ENCRYPTION_KEY: ENCRYPTION_KEY_B64,
+			MAPLE_INGEST_KEY_LOOKUP_HMAC_KEY: "maple-test-lookup-secret",
+			MAPLE_APP_BASE_URL: "https://web.localhost",
+			...(slackConfigured
+				? { SLACK_CLIENT_ID: "123.abc", SLACK_CLIENT_SECRET: "shhh" }
+				: {}),
+		}),
+	)
+
+const makeLayer = (testDb: TestDb, slackConfigured = true) =>
+	SlackIntegrationService.layer.pipe(
+		Layer.provide(Layer.mergeAll(ApiKeysService.layer, OAuthStateRepository.layer)),
+		Layer.provide(testDb.layer),
+		Layer.provide(Env.layer),
+		Layer.provide(makeConfig(slackConfigured)),
+	)
+
+/** The pure dispatch helper needs only Database — build a minimal layer for it. */
+const databaseLayer = (testDb: TestDb) => testDb.layer
+
+const asOrgId = Schema.decodeUnknownSync(OrgId)
+const asUserId = Schema.decodeUnknownSync(UserId)
+
+const jsonResponse = (body: unknown, status = 200) =>
+	new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } })
+
+/** A mocked `fetch` that answers Slack's `oauth.v2.access` with the current team. */
+const slackOAuthFetch = (teamRef: { current: { id: string; name: string } }): typeof globalThis.fetch =>
+	((input: RequestInfo | URL) => {
+		const url = String(input)
+		if (url.startsWith("https://slack.com/api/oauth.v2.access")) {
+			return Promise.resolve(
+				jsonResponse({
+					ok: true,
+					access_token: `xoxb-${teamRef.current.id}`,
+					token_type: "bot",
+					scope: "chat:write",
+					bot_user_id: "U0BOT",
+					team: teamRef.current,
+				}),
+			)
+		}
+		return Promise.reject(new Error(`unexpected fetch: ${url}`))
+	}) as typeof globalThis.fetch
+
+const stateFromInstallUrl = (url: string): string => {
+	const state = new URL(url).searchParams.get("state")
+	if (!state) throw new Error("install url missing state")
+	return state
+}
+
+const trackedDbs: TestDb[] = []
+afterEach(() => cleanupTestDbs(trackedDbs))
+
+/** Insert an active, encrypted slack_workspaces row directly (bypasses OAuth). */
+const insertWorkspace = async (
+	testDb: TestDb,
+	opts: { id: string; orgId: string; teamId: string; teamName: string; botToken: string; apiKey: string },
+) => {
+	const bot = encryptField(opts.botToken, ENCRYPTION_KEY)
+	const key = encryptField(opts.apiKey, ENCRYPTION_KEY)
+	await executeSql(
+		testDb,
+		`INSERT INTO slack_workspaces (
+			id, org_id, team_id, team_name, bot_user_id, scope,
+			bot_token_ciphertext, bot_token_iv, bot_token_tag,
+			api_key_id, api_key_secret_ciphertext, api_key_secret_iv, api_key_secret_tag,
+			installed_by_user_id, created_at, updated_at, revoked_at
+		) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14, now(), now(), NULL)`,
+		[
+			opts.id,
+			opts.orgId,
+			opts.teamId,
+			opts.teamName,
+			"U0BOT",
+			"chat:write",
+			bot.ciphertext,
+			bot.iv,
+			bot.tag,
+			"11111111-2222-4333-8444-555555555555",
+			key.ciphertext,
+			key.iv,
+			key.tag,
+			"user_installer",
+		],
+	)
+}
+
+describe("SlackIntegrationService", () => {
+	it.effect("startInstall persists a single-use state and returns a Slack authorize URL", () => {
+		const testDb = createTestDb(trackedDbs)
+		return Effect.gen(function* () {
+			const slack = yield* SlackIntegrationService
+			const result = yield* slack.startInstall(
+				asOrgId("org_a"),
+				asUserId("user_a"),
+				"https://api.localhost/oauth/slack/callback",
+			)
+			assert.isTrue(result.url.startsWith("https://slack.com/oauth/v2/authorize?"))
+			const parsed = new URL(result.url)
+			assert.strictEqual(parsed.searchParams.get("client_id"), "123.abc")
+			assert.include(parsed.searchParams.get("scope") ?? "", "chat:write")
+			const state = parsed.searchParams.get("state")
+			assert.isString(state)
+
+			const row = yield* Effect.promise(() =>
+				queryFirstRow<{ org_id: string; provider: string }>(
+					testDb,
+					"SELECT org_id, provider FROM oauth_auth_states WHERE state = $1",
+					[state],
+				),
+			)
+			assert.strictEqual(row?.org_id, "org_a")
+			assert.strictEqual(row?.provider, "slack")
+		}).pipe(Effect.provide(makeLayer(testDb)))
+	})
+
+	it.effect("startInstall fails when Slack is not configured", () => {
+		const testDb = createTestDb(trackedDbs)
+		return Effect.gen(function* () {
+			const slack = yield* SlackIntegrationService
+			const error = yield* Effect.flip(
+				slack.startInstall(asOrgId("org_a"), asUserId("user_a"), "https://cb"),
+			)
+			assert.strictEqual(error._tag, "@maple/http/errors/IntegrationsValidationError")
+		}).pipe(Effect.provide(makeLayer(testDb, false)))
+	})
+
+	it.effect("completeInstall rejects an unknown state", () => {
+		const testDb = createTestDb(trackedDbs)
+		return Effect.gen(function* () {
+			const slack = yield* SlackIntegrationService
+			const error = yield* Effect.flip(slack.completeInstall("code_1", "nonexistent-state"))
+			assert.strictEqual(error._tag, "@maple/http/errors/IntegrationsValidationError")
+			assert.include(error.message, "not recognized")
+		}).pipe(Effect.provide(makeLayer(testDb)))
+	})
+
+	it.effect("completeInstall rejects an expired state (and burns it)", () => {
+		const testDb = createTestDb(trackedDbs)
+		return Effect.gen(function* () {
+			yield* Effect.promise(() =>
+				executeSql(
+					testDb,
+					// @effect/vitest it.effect freezes the Clock at epoch 0 (1970), so an
+					// "expired" state must sit before that — use a pre-1970 timestamp.
+					`INSERT INTO oauth_auth_states (state, org_id, provider, initiated_by_user_id, redirect_uri, created_at, expires_at)
+					 VALUES ($1,$2,$3,$4,$5, timestamptz '1969-01-01 00:00:00+00', timestamptz '1969-06-01 00:00:00+00')`,
+					["expired-state", "org_a", "slack", "user_a", "https://cb"],
+				),
+			)
+			const slack = yield* SlackIntegrationService
+			const error = yield* Effect.flip(slack.completeInstall("code_1", "expired-state"))
+			assert.strictEqual(error._tag, "@maple/http/errors/IntegrationsValidationError")
+			assert.include(error.message, "expired")
+			const remaining = yield* Effect.promise(() =>
+				queryFirstRow(testDb, "SELECT state FROM oauth_auth_states WHERE state = $1", [
+					"expired-state",
+				]),
+			)
+			assert.isUndefined(remaining)
+		}).pipe(Effect.provide(makeLayer(testDb)))
+	})
+
+	it.effect("getStatus reports not-installed for an org with no workspace", () => {
+		const testDb = createTestDb(trackedDbs)
+		return Effect.gen(function* () {
+			const slack = yield* SlackIntegrationService
+			const status = yield* slack.getStatus(asOrgId("org_none"))
+			assert.strictEqual(status.installed, false)
+			assert.isNull(status.teamId)
+		}).pipe(Effect.provide(makeLayer(testDb)))
+	})
+
+	it.effect("getStatus + resolveForBot read back an installed workspace", () => {
+		const testDb = createTestDb(trackedDbs)
+		return Effect.gen(function* () {
+			yield* Effect.promise(() =>
+				insertWorkspace(testDb, {
+					id: "sw_1",
+					orgId: "org_a",
+					teamId: "T0123",
+					teamName: "Acme",
+					botToken: "xoxb-secret-token",
+					apiKey: "maple_ak_secret",
+				}),
+			)
+			const slack = yield* SlackIntegrationService
+
+			const status = yield* slack.getStatus(asOrgId("org_a"))
+			assert.strictEqual(status.installed, true)
+			assert.strictEqual(status.teamId, "T0123")
+			assert.strictEqual(status.teamName, "Acme")
+
+			const resolution = yield* slack.resolveForBot("T0123")
+			assert.strictEqual(resolution.orgId, "org_a")
+			assert.strictEqual(resolution.botToken, "xoxb-secret-token")
+			assert.strictEqual(resolution.mapleApiKey, "maple_ak_secret")
+		}).pipe(Effect.provide(makeLayer(testDb)))
+	})
+
+	it.effect("resolveForBot fails for an unknown team", () => {
+		const testDb = createTestDb(trackedDbs)
+		return Effect.gen(function* () {
+			const slack = yield* SlackIntegrationService
+			const error = yield* Effect.flip(slack.resolveForBot("T-unknown"))
+			assert.strictEqual(error._tag, "@maple/http/errors/IntegrationsNotConnectedError")
+		}).pipe(Effect.provide(makeLayer(testDb)))
+	})
+
+	it.effect("uninstall revokes the workspace so it reads as not-installed", () => {
+		const testDb = createTestDb(trackedDbs)
+		return Effect.gen(function* () {
+			yield* Effect.promise(() =>
+				insertWorkspace(testDb, {
+					id: "sw_2",
+					orgId: "org_b",
+					teamId: "T0999",
+					teamName: "Beta",
+					botToken: "xoxb-b",
+					apiKey: "maple_ak_b",
+				}),
+			)
+			const slack = yield* SlackIntegrationService
+			const result = yield* slack.uninstall(asOrgId("org_b"))
+			assert.strictEqual(result.uninstalled, true)
+
+			const status = yield* slack.getStatus(asOrgId("org_b"))
+			assert.strictEqual(status.installed, false)
+			// resolveForBot skips revoked rows too
+			const error = yield* Effect.flip(slack.resolveForBot("T0999"))
+			assert.strictEqual(error._tag, "@maple/http/errors/IntegrationsNotConnectedError")
+		}).pipe(Effect.provide(makeLayer(testDb)))
+	})
+
+	it.effect("resolveSlackBotTokenForDispatch decrypts the active workspace bot token", () => {
+		const testDb = createTestDb(trackedDbs)
+		return Effect.gen(function* () {
+			yield* Effect.promise(() =>
+				insertWorkspace(testDb, {
+					id: "sw_3",
+					orgId: "org_c",
+					teamId: "T0777",
+					teamName: "Gamma",
+					botToken: "xoxb-dispatch-token",
+					apiKey: "maple_ak_c",
+				}),
+			)
+			const database = yield* Database
+			const token = yield* resolveSlackBotTokenForDispatch(database, ENCRYPTION_KEY, "org_c")
+			assert.strictEqual(token, "xoxb-dispatch-token")
+		}).pipe(Effect.provide(databaseLayer(testDb)))
+	})
+
+	it.effect("resolveSlackBotTokenForDispatch fails when no active install exists", () => {
+		const testDb = createTestDb(trackedDbs)
+		return Effect.gen(function* () {
+			const database = yield* Database
+			const error = yield* Effect.flip(
+				resolveSlackBotTokenForDispatch(database, ENCRYPTION_KEY, "org_missing"),
+			)
+			assert.strictEqual(error.destinationType, "slack-bot")
+			assert.include(error.message, "not connected")
+		}).pipe(Effect.provide(databaseLayer(testDb)))
+	})
+
+	it.effect("a same-org install of a second workspace replaces (revokes) the first", () => {
+		const testDb = createTestDb(trackedDbs)
+		const teamRef = { current: { id: "T1", name: "TeamOne" } }
+		return Effect.gen(function* () {
+			const slack = yield* SlackIntegrationService
+
+			// First install → workspace T1 becomes active.
+			const start1 = yield* slack.startInstall(asOrgId("org_a"), asUserId("user_a"), "https://cb")
+			yield* slack.completeInstall("code_1", stateFromInstallUrl(start1.url))
+			const firstKey = yield* Effect.promise(() =>
+				queryFirstRow<{ api_key_id: string }>(
+					testDb,
+					"SELECT api_key_id FROM slack_workspaces WHERE team_id = 'T1'",
+				),
+			)
+			assert.isString(firstKey?.api_key_id)
+
+			// Second install of a DIFFERENT team on the SAME org → replaces T1.
+			teamRef.current = { id: "T2", name: "TeamTwo" }
+			const start2 = yield* slack.startInstall(asOrgId("org_a"), asUserId("user_a"), "https://cb")
+			yield* slack.completeInstall("code_2", stateFromInstallUrl(start2.url))
+
+			// Status + dispatch resolve the NEW workspace, and exactly one row is active.
+			const status = yield* slack.getStatus(asOrgId("org_a"))
+			assert.strictEqual(status.teamId, "T2")
+
+			const activeCount = yield* Effect.promise(() =>
+				queryFirstRow<{ n: number }>(
+					testDb,
+					"SELECT count(*)::int AS n FROM slack_workspaces WHERE org_id = 'org_a' AND revoked_at IS NULL",
+				),
+			)
+			assert.strictEqual(activeCount?.n, 1)
+
+			const t1Row = yield* Effect.promise(() =>
+				queryFirstRow<{ revoked_at: string | null }>(
+					testDb,
+					"SELECT revoked_at FROM slack_workspaces WHERE team_id = 'T1'",
+				),
+			)
+			assert.isNotNull(t1Row?.revoked_at)
+
+			const database = yield* Database
+			const token = yield* resolveSlackBotTokenForDispatch(database, ENCRYPTION_KEY, "org_a")
+			assert.strictEqual(token, "xoxb-T2")
+
+			const t1Resolve = yield* Effect.flip(slack.resolveForBot("T1"))
+			assert.strictEqual(t1Resolve._tag, "@maple/http/errors/IntegrationsNotConnectedError")
+
+			// The first workspace's minted API key was revoked.
+			const keyRow = yield* Effect.promise(() =>
+				queryFirstRow<{ revoked: boolean }>(testDb, "SELECT revoked FROM api_keys WHERE id = $1", [
+					firstKey!.api_key_id,
+				]),
+			)
+			assert.strictEqual(keyRow?.revoked, true)
+		}).pipe(
+			Effect.provide(
+				Layer.mergeAll(
+					makeLayer(testDb),
+					testDb.layer,
+					Layer.succeed(FetchHttpClient.Fetch, slackOAuthFetch(teamRef)),
+				),
+			),
+		)
+	})
+
+	it.effect("the partial unique index rejects a second active row for the same org", () => {
+		const testDb = createTestDb(trackedDbs)
+		return Effect.gen(function* () {
+			yield* Effect.promise(() =>
+				insertWorkspace(testDb, {
+					id: "sw_a1",
+					orgId: "org_z",
+					teamId: "TX",
+					teamName: "X",
+					botToken: "b1",
+					apiKey: "k1",
+				}),
+			)
+			let rejected = false
+			yield* Effect.promise(() =>
+				insertWorkspace(testDb, {
+					id: "sw_a2",
+					orgId: "org_z",
+					teamId: "TY",
+					teamName: "Y",
+					botToken: "b2",
+					apiKey: "k2",
+				}).then(
+					() => {},
+					() => {
+						rejected = true
+					},
+				),
+			)
+			assert.isTrue(rejected, "second active row for the same org should violate the unique index")
+		}).pipe(Effect.provide(databaseLayer(testDb)))
+	})
+})
diff --git a/apps/api/src/services/SlackIntegrationService.ts b/apps/api/src/services/SlackIntegrationService.ts
new file mode 100644
index 000000000..6f89fea54
--- /dev/null
+++ b/apps/api/src/services/SlackIntegrationService.ts
@@ -0,0 +1,699 @@
+import { randomBytes, randomUUID } from "node:crypto"
+import {
+	AlertDeliveryError,
+	ApiKeyId,
+	IntegrationsForbiddenError,
+	IntegrationsNotConnectedError,
+	IntegrationsPersistenceError,
+	IntegrationsUpstreamError,
+	IntegrationsValidationError,
+	OrgId,
+	UserId,
+} from "@maple/domain/http"
+import { slackWorkspaces, type SlackWorkspaceRow } from "@maple/db"
+import { and, eq, isNotNull, isNull, ne, or } from "drizzle-orm"
+import { Clock, Context, Effect, Layer, Option, Redacted, Schema } from "effect"
+import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/unstable/http"
+import {
+	decryptAes256Gcm,
+	encryptAes256Gcm,
+	parseBase64Aes256GcmKey,
+	type EncryptedValue,
+} from "../lib/Crypto"
+import { Database, type DatabaseShape } from "../lib/DatabaseLive"
+import { Env } from "../lib/Env"
+import { ApiKeysService } from "./ApiKeysService"
+import { OAuthStateRepository } from "./OAuthStateRepository"
+
+const SLACK_PROVIDER = "slack"
+const SLACK_STATE_TTL_MS = 10 * 60_000 // 10 minutes
+const SLACK_OAUTH_ACCESS_URL = "https://slack.com/api/oauth.v2.access"
+const SLACK_CONVERSATIONS_LIST_URL = "https://slack.com/api/conversations.list"
+const SLACK_MAX_CHANNEL_PAGES = 3
+
+/** Public callback path Slack redirects to after an install (mounted in app.ts). */
+export const SLACK_CALLBACK_PATH = "/oauth/slack/callback"
+
+/**
+ * The bot scopes Maple requests at install time. `chat:write.public` lets the
+ * bot post to public channels it hasn't been invited to; `im:*` power the DM
+ * agent surface. Keep in sync with the Slack app manifest.
+ */
+export const SLACK_BOT_SCOPES = [
+	"app_mentions:read",
+	"chat:write",
+	"chat:write.public",
+	"channels:read",
+	"groups:read",
+	"im:history",
+	"im:read",
+	"im:write",
+	"users:read",
+].join(",")
+
+const decodeApiKeyIdOption = Schema.decodeUnknownOption(ApiKeyId)
+const decodeOrgIdSync = Schema.decodeUnknownSync(OrgId)
+const decodeUserIdSync = Schema.decodeUnknownSync(UserId)
+
+// --- Slack API response shapes ---------------------------------------------
+
+const SlackOAuthAccessSchema = Schema.Struct({
+	ok: Schema.Boolean,
+	error: Schema.optionalKey(Schema.String),
+	access_token: Schema.optionalKey(Schema.String),
+	token_type: Schema.optionalKey(Schema.String),
+	scope: Schema.optionalKey(Schema.String),
+	bot_user_id: Schema.optionalKey(Schema.String),
+	team: Schema.optionalKey(
+		Schema.Struct({
+			id: Schema.String,
+			name: Schema.optionalKey(Schema.String),
+		}),
+	),
+})
+const decodeOAuthAccess = Schema.decodeUnknownEffect(SlackOAuthAccessSchema)
+
+const SlackConversationsListSchema = Schema.Struct({
+	ok: Schema.Boolean,
+	error: Schema.optionalKey(Schema.String),
+	channels: Schema.optionalKey(
+		Schema.Array(
+			Schema.Struct({
+				id: Schema.String,
+				name: Schema.optionalKey(Schema.String),
+				is_private: Schema.optionalKey(Schema.Boolean),
+				is_member: Schema.optionalKey(Schema.Boolean),
+			}),
+		),
+	),
+	response_metadata: Schema.optionalKey(
+		Schema.Struct({ next_cursor: Schema.optionalKey(Schema.String) }),
+	),
+})
+const decodeConversationsList = Schema.decodeUnknownEffect(SlackConversationsListSchema)
+
+// --- Public types -----------------------------------------------------------
+
+export interface SlackInstallStatus {
+	readonly installed: boolean
+	readonly teamId: string | null
+	readonly teamName: string | null
+	readonly botUserId: string | null
+	readonly installedAt: number | null
+}
+
+export interface SlackChannelSummary {
+	readonly id: string
+	readonly name: string
+	readonly isPrivate: boolean
+	readonly isMember: boolean
+}
+
+export interface SlackBotResolution {
+	readonly orgId: string
+	readonly teamId: string
+	readonly teamName: string | null
+	readonly botToken: string
+	readonly mapleApiKey: string
+}
+
+// --- Shared decrypt helper (also used by the alert dispatch path) -----------
+
+const loadActiveWorkspaceByOrg = (database: DatabaseShape, orgId: string) =>
+	database
+		.execute((db) =>
+			db
+				.select()
+				.from(slackWorkspaces)
+				.where(and(eq(slackWorkspaces.orgId, orgId), isNull(slackWorkspaces.revokedAt)))
+				.limit(1),
+		)
+		.pipe(Effect.map((rows) => rows[0] ?? null))
+
+/**
+ * Resolve the decrypted Slack bot token for an org's active installation.
+ * Shared by the alert-delivery `slack-bot` arm (both apps/api and the alerting
+ * worker) so those dispatchers do not need the full SlackIntegrationService.
+ * Fails with an {@link AlertDeliveryError} when there is no active install.
+ */
+export const resolveSlackBotTokenForDispatch = (
+	database: DatabaseShape,
+	encryptionKey: Buffer,
+	orgId: string,
+): Effect.Effect<string, AlertDeliveryError> =>
+	Effect.gen(function* () {
+		const row = yield* loadActiveWorkspaceByOrg(database, orgId).pipe(
+			Effect.mapError(
+				(error) =>
+					new AlertDeliveryError({
+						message: `Failed to load Slack installation: ${error.message}`,
+						destinationType: "slack-bot",
+					}),
+			),
+		)
+		if (!row) {
+			return yield* Effect.fail(
+				new AlertDeliveryError({
+					message: "Slack is not connected for this organization — install the Maple Slack app",
+					destinationType: "slack-bot",
+				}),
+			)
+		}
+		return yield* decryptAes256Gcm(
+			{ ciphertext: row.botTokenCiphertext, iv: row.botTokenIv, tag: row.botTokenTag },
+			encryptionKey,
+			() =>
+				new AlertDeliveryError({
+					message: "Failed to decrypt stored Slack bot token",
+					destinationType: "slack-bot",
+				}),
+		)
+	})
+
+// --- Service ----------------------------------------------------------------
+
+export interface SlackIntegrationServiceShape {
+	readonly startInstall: (
+		orgId: OrgId,
+		userId: UserId,
+		callbackUrl: string,
+	) => Effect.Effect<
+		{ readonly url: string },
+		IntegrationsValidationError | IntegrationsPersistenceError
+	>
+	readonly completeInstall: (
+		code: string,
+		state: string,
+	) => Effect.Effect<
+		{ readonly orgId: OrgId; readonly teamName: string | null },
+		| IntegrationsValidationError
+		| IntegrationsForbiddenError
+		| IntegrationsUpstreamError
+		| IntegrationsPersistenceError
+	>
+	readonly getStatus: (
+		orgId: OrgId,
+	) => Effect.Effect<SlackInstallStatus, IntegrationsPersistenceError>
+	readonly uninstall: (
+		orgId: OrgId,
+	) => Effect.Effect<{ readonly uninstalled: boolean }, IntegrationsPersistenceError>
+	readonly listChannels: (
+		orgId: OrgId,
+	) => Effect.Effect<
+		ReadonlyArray<SlackChannelSummary>,
+		| IntegrationsNotConnectedError
+		| IntegrationsUpstreamError
+		| IntegrationsPersistenceError
+		| IntegrationsValidationError
+	>
+	readonly resolveForBot: (
+		teamId: string,
+	) => Effect.Effect<SlackBotResolution, IntegrationsNotConnectedError | IntegrationsPersistenceError>
+}
+
+export class SlackIntegrationService extends Context.Service<
+	SlackIntegrationService,
+	SlackIntegrationServiceShape
+>()("@maple/api/services/SlackIntegrationService", {
+	make: Effect.gen(function* () {
+		const database = yield* Database
+		const env = yield* Env
+		const apiKeys = yield* ApiKeysService
+		const states = yield* OAuthStateRepository
+		const httpClient = yield* HttpClient.HttpClient
+
+		const encryptionKey = yield* parseBase64Aes256GcmKey(
+			Redacted.value(env.MAPLE_INGEST_KEY_ENCRYPTION_KEY),
+			(message) =>
+				new IntegrationsValidationError({
+					message:
+						message === "Expected a non-empty base64 encryption key"
+							? "MAPLE_INGEST_KEY_ENCRYPTION_KEY is required"
+							: message === "Expected base64 for exactly 32 bytes"
+								? "MAPLE_INGEST_KEY_ENCRYPTION_KEY must be base64 for exactly 32 bytes"
+								: message,
+				}),
+		)
+
+		const toPersistenceError = (error: { readonly message: string }) =>
+			new IntegrationsPersistenceError({ message: error.message })
+
+		const encryptValue = (plaintext: string): Effect.Effect<EncryptedValue, IntegrationsPersistenceError> =>
+			encryptAes256Gcm(
+				plaintext,
+				encryptionKey,
+				(message) => new IntegrationsPersistenceError({ message: `Encryption failed: ${message}` }),
+			)
+
+		const decryptValue = (
+			encrypted: EncryptedValue,
+		): Effect.Effect<string, IntegrationsPersistenceError> =>
+			decryptAes256Gcm(
+				encrypted,
+				encryptionKey,
+				() => new IntegrationsPersistenceError({ message: "Failed to decrypt stored Slack secret" }),
+			)
+
+		const requireOAuthClient = Effect.gen(function* () {
+			const clientId = Option.getOrUndefined(env.SLACK_CLIENT_ID)
+			const clientSecret = Option.match(env.SLACK_CLIENT_SECRET, {
+				onNone: () => undefined,
+				onSome: (value) => Redacted.value(value),
+			})
+			if (!clientId || !clientSecret) {
+				return yield* Effect.fail(
+					new IntegrationsValidationError({
+						message: "Slack integration is not configured (SLACK_CLIENT_ID / SLACK_CLIENT_SECRET)",
+					}),
+				)
+			}
+			return { clientId, clientSecret }
+		})
+
+		const startInstall = Effect.fn("SlackIntegrationService.startInstall")(function* (
+			orgId: OrgId,
+			userId: UserId,
+			callbackUrl: string,
+		) {
+			const { clientId } = yield* requireOAuthClient
+			const state = randomBytes(24).toString("base64url")
+			const now = yield* Clock.currentTimeMillis
+			yield* states.purgeExpired(now).pipe(Effect.mapError(toPersistenceError))
+			yield* states
+				.insert({
+					state,
+					orgId,
+					provider: SLACK_PROVIDER,
+					initiatedByUserId: userId,
+					redirectUri: callbackUrl,
+					returnTo: null,
+					createdAt: new Date(now),
+					expiresAt: new Date(now + SLACK_STATE_TTL_MS),
+				})
+				.pipe(Effect.mapError(toPersistenceError))
+
+			const params = new URLSearchParams({
+				client_id: clientId,
+				scope: SLACK_BOT_SCOPES,
+				state,
+				redirect_uri: callbackUrl,
+			})
+			return { url: `https://slack.com/oauth/v2/authorize?${params.toString()}` }
+		})
+
+		const exchangeCode = Effect.fn("SlackIntegrationService.exchangeCode")(function* (
+			code: string,
+			redirectUri: string,
+			clientId: string,
+			clientSecret: string,
+		) {
+			const request = HttpClientRequest.post(SLACK_OAUTH_ACCESS_URL, {
+				headers: { accept: "application/json" },
+			}).pipe(
+				HttpClientRequest.bodyUrlParams({
+					client_id: clientId,
+					client_secret: clientSecret,
+					code,
+					redirect_uri: redirectUri,
+				}),
+			)
+			const response = yield* httpClient.execute(request).pipe(
+				Effect.mapError(
+					(error) => new IntegrationsUpstreamError({ message: `Slack OAuth request failed: ${error.message}` }),
+				),
+			)
+			const json = yield* response.json.pipe(
+				Effect.mapError(
+					() => new IntegrationsUpstreamError({ message: "Slack OAuth returned a non-JSON response" }),
+				),
+			)
+			const decoded = yield* decodeOAuthAccess(json).pipe(
+				Effect.mapError(
+					() => new IntegrationsUpstreamError({ message: "Slack OAuth returned an unexpected payload" }),
+				),
+			)
+			if (!decoded.ok || !decoded.access_token || !decoded.team?.id) {
+				return yield* Effect.fail(
+					new IntegrationsValidationError({
+						message: `Slack authorization failed: ${decoded.error ?? "missing token or team"}`,
+					}),
+				)
+			}
+			return decoded as typeof decoded & {
+				access_token: string
+				team: { id: string; name?: string }
+			}
+		})
+
+		const completeInstall = Effect.fn("SlackIntegrationService.completeInstall")(function* (
+			code: string,
+			state: string,
+		) {
+			const { clientId, clientSecret } = yield* requireOAuthClient
+			const stateRow = yield* states.findByState(state).pipe(Effect.mapError(toPersistenceError))
+			if (Option.isNone(stateRow) || stateRow.value.provider !== SLACK_PROVIDER) {
+				return yield* Effect.fail(
+					new IntegrationsValidationError({
+						message: "Slack state not recognized — restart the install flow",
+					}),
+				)
+			}
+			const row = stateRow.value
+			const now = yield* Clock.currentTimeMillis
+			if (row.expiresAt.getTime() < now) {
+				yield* states.deleteByState(state).pipe(Effect.mapError(toPersistenceError))
+				return yield* Effect.fail(
+					new IntegrationsValidationError({
+						message: "Slack state expired — restart the install flow",
+					}),
+				)
+			}
+			// Single-use: burn the state before doing any side effects.
+			yield* states.deleteByState(state).pipe(Effect.mapError(toPersistenceError))
+
+			const orgId = decodeOrgIdSync(row.orgId)
+			const access = yield* exchangeCode(code, row.redirectUri, clientId, clientSecret)
+			const teamId = access.team.id
+			const teamName = access.team.name ?? null
+
+			// Reject re-binding a team that is actively installed on a different org.
+			const existingByTeam = yield* database
+				.execute((db) =>
+					db.select().from(slackWorkspaces).where(eq(slackWorkspaces.teamId, teamId)).limit(1),
+				)
+				.pipe(Effect.mapError(toPersistenceError))
+			const priorRow = existingByTeam[0] ?? null
+			if (priorRow && priorRow.orgId !== orgId && priorRow.revokedAt === null) {
+				return yield* Effect.fail(
+					new IntegrationsForbiddenError({
+						message:
+							"This Slack workspace is already connected to a different Maple organization. Uninstall it there first.",
+					}),
+				)
+			}
+
+			// Mint a full-access MCP-kind API key for the bot; capture the plaintext.
+			const created = yield* apiKeys
+				.create(orgId, decodeUserIdSync(row.initiatedByUserId), {
+					name: `Slack bot (${teamName ?? teamId})`,
+					kind: "mcp",
+					scopes: null,
+				})
+				.pipe(
+					Effect.mapError(
+						(error) =>
+							new IntegrationsPersistenceError({
+								message: `Failed to mint Slack API key: ${error.message}`,
+							}),
+					),
+				)
+
+			const botTokenEnc = yield* encryptValue(access.access_token)
+			const apiKeyEnc = yield* encryptValue(created.secret)
+
+			const values = {
+				id: priorRow?.id ?? randomUUID(),
+				orgId,
+				teamId,
+				teamName,
+				botUserId: access.bot_user_id ?? null,
+				scope: access.scope ?? SLACK_BOT_SCOPES,
+				botTokenCiphertext: botTokenEnc.ciphertext,
+				botTokenIv: botTokenEnc.iv,
+				botTokenTag: botTokenEnc.tag,
+				apiKeyId: created.id,
+				apiKeySecretCiphertext: apiKeyEnc.ciphertext,
+				apiKeySecretIv: apiKeyEnc.iv,
+				apiKeySecretTag: apiKeyEnc.tag,
+				installedByUserId: row.initiatedByUserId,
+				createdAt: new Date(priorRow ? priorRow.createdAt.getTime() : now),
+				updatedAt: new Date(now),
+				revokedAt: null,
+			}
+
+			// Invariant: at most one active (revoked_at IS NULL) row per org. In one
+			// transaction, first revoke any OTHER active workspace for this org (a
+			// same-org install of a different team replaces the old one), then upsert
+			// the new/refreshed row. The `setWhere` guard makes the cross-org rejection
+			// race-safe: a concurrent install of the same team by a different org can't
+			// clobber the existing binding — the update is skipped and we roll back with
+			// a recognizable sentinel. The partial unique index on (org_id) is the
+			// backstop that ultimately enforces the single-active-row invariant.
+			const CROSS_ORG_SENTINEL = "SLACK_CROSS_ORG_CONFLICT"
+			const writeResult = yield* database
+				.execute<{ revokedOtherKeyIds: Array<string | null> }>((db) =>
+					db.transaction(async (tx) => {
+						const revokedOthers = await tx
+							.update(slackWorkspaces)
+							.set({ revokedAt: new Date(now), updatedAt: new Date(now) })
+							.where(
+								and(
+									eq(slackWorkspaces.orgId, orgId),
+									isNull(slackWorkspaces.revokedAt),
+									ne(slackWorkspaces.teamId, teamId),
+								),
+							)
+							.returning({ apiKeyId: slackWorkspaces.apiKeyId })
+
+						const upserted = await tx
+							.insert(slackWorkspaces)
+							.values(values)
+							.onConflictDoUpdate({
+								target: slackWorkspaces.teamId,
+								// Only allow overwriting a same-team row that belongs to this
+								// org or has already been revoked — never an active binding
+								// owned by another org.
+								setWhere: or(
+									eq(slackWorkspaces.orgId, orgId),
+									isNotNull(slackWorkspaces.revokedAt),
+								),
+								set: {
+									orgId: values.orgId,
+									teamName: values.teamName,
+									botUserId: values.botUserId,
+									scope: values.scope,
+									botTokenCiphertext: values.botTokenCiphertext,
+									botTokenIv: values.botTokenIv,
+									botTokenTag: values.botTokenTag,
+									apiKeyId: values.apiKeyId,
+									apiKeySecretCiphertext: values.apiKeySecretCiphertext,
+									apiKeySecretIv: values.apiKeySecretIv,
+									apiKeySecretTag: values.apiKeySecretTag,
+									installedByUserId: values.installedByUserId,
+									createdAt: values.createdAt,
+									updatedAt: values.updatedAt,
+									revokedAt: null,
+								},
+							})
+							.returning({ id: slackWorkspaces.id })
+
+						// Zero rows means the same-team conflict hit an active row owned by a
+						// different org (the setWhere blocked it) — abort so revoke-others
+						// rolls back too.
+						if (upserted.length === 0) throw new Error(CROSS_ORG_SENTINEL)
+
+						return {
+							revokedOtherKeyIds: revokedOthers.map((r) => r.apiKeyId),
+						}
+					}),
+				)
+				.pipe(
+					Effect.catchTag("@maple/api/lib/DatabaseError", (error) =>
+						Effect.fail(
+							error.message.includes(CROSS_ORG_SENTINEL)
+								? new IntegrationsForbiddenError({
+										message:
+											"This Slack workspace is already connected to a different Maple organization. Uninstall it there first.",
+									})
+								: toPersistenceError(error),
+						),
+					),
+				)
+
+			// Best-effort: revoke the API keys of every workspace this install
+			// replaced — the prior same-team row (whose key we just rotated) and any
+			// other-team rows we deactivated above. Bookkeeping must not fail the
+			// install now that the DB write has committed.
+			const keyIdsToRevoke = [priorRow?.apiKeyId ?? null, ...writeResult.revokedOtherKeyIds]
+			yield* Effect.forEach(keyIdsToRevoke, (rawKeyId) => {
+				if (!rawKeyId) return Effect.void
+				const keyId = decodeApiKeyIdOption(rawKeyId)
+				return Option.isSome(keyId)
+					? apiKeys.revoke(orgId, keyId.value).pipe(Effect.ignore)
+					: Effect.void
+			})
+
+			return { orgId, teamName }
+		})
+
+		const getStatus = Effect.fn("SlackIntegrationService.getStatus")(function* (orgId: OrgId) {
+			const row = yield* loadActiveWorkspaceByOrg(database, orgId).pipe(
+				Effect.mapError(toPersistenceError),
+			)
+			if (!row) {
+				return {
+					installed: false,
+					teamId: null,
+					teamName: null,
+					botUserId: null,
+					installedAt: null,
+				} satisfies SlackInstallStatus
+			}
+			return {
+				installed: true,
+				teamId: row.teamId,
+				teamName: row.teamName,
+				botUserId: row.botUserId,
+				installedAt: row.createdAt.getTime(),
+			} satisfies SlackInstallStatus
+		})
+
+		const uninstall = Effect.fn("SlackIntegrationService.uninstall")(function* (orgId: OrgId) {
+			const row = yield* loadActiveWorkspaceByOrg(database, orgId).pipe(
+				Effect.mapError(toPersistenceError),
+			)
+			if (!row) return { uninstalled: false }
+			const now = yield* Clock.currentTimeMillis
+			// Revoke the minted API key (best-effort — bookkeeping must not fail the uninstall).
+			if (row.apiKeyId) {
+				const keyId = decodeApiKeyIdOption(row.apiKeyId)
+				if (Option.isSome(keyId)) {
+					yield* apiKeys.revoke(orgId, keyId.value).pipe(Effect.ignore)
+				}
+			}
+			yield* database
+				.execute((db) =>
+					db
+						.update(slackWorkspaces)
+						.set({ revokedAt: new Date(now), updatedAt: new Date(now) })
+						.where(eq(slackWorkspaces.id, row.id)),
+				)
+				.pipe(Effect.mapError(toPersistenceError))
+			return { uninstalled: true }
+		})
+
+		const listChannels = Effect.fn("SlackIntegrationService.listChannels")(function* (orgId: OrgId) {
+			const row = yield* loadActiveWorkspaceByOrg(database, orgId).pipe(
+				Effect.mapError(toPersistenceError),
+			)
+			if (!row) {
+				return yield* Effect.fail(
+					new IntegrationsNotConnectedError({
+						message: "Slack is not connected for this organization",
+					}),
+				)
+			}
+			const botToken = yield* decryptValue({
+				ciphertext: row.botTokenCiphertext,
+				iv: row.botTokenIv,
+				tag: row.botTokenTag,
+			})
+
+			const channels: Array<SlackChannelSummary> = []
+			let cursor: string | undefined
+			for (let page = 0; page < SLACK_MAX_CHANNEL_PAGES; page++) {
+				const params = new URLSearchParams({
+					types: "public_channel,private_channel",
+					exclude_archived: "true",
+					limit: "200",
+				})
+				if (cursor) params.set("cursor", cursor)
+				const response = yield* httpClient
+					.get(`${SLACK_CONVERSATIONS_LIST_URL}?${params.toString()}`, {
+						headers: { authorization: `Bearer ${botToken}`, accept: "application/json" },
+					})
+					.pipe(
+						Effect.mapError(
+							(error) =>
+								new IntegrationsUpstreamError({
+									message: `Slack conversations.list failed: ${error.message}`,
+								}),
+						),
+					)
+				const json = yield* response.json.pipe(
+					Effect.mapError(
+						() =>
+							new IntegrationsUpstreamError({
+								message: "Slack conversations.list returned a non-JSON response",
+							}),
+					),
+				)
+				const decoded = yield* decodeConversationsList(json).pipe(
+					Effect.mapError(
+						() =>
+							new IntegrationsUpstreamError({
+								message: "Slack conversations.list returned an unexpected payload",
+							}),
+					),
+				)
+				if (!decoded.ok) {
+					return yield* Effect.fail(
+						new IntegrationsUpstreamError({
+							message: `Slack conversations.list error: ${decoded.error ?? "unknown"}`,
+						}),
+					)
+				}
+				for (const channel of decoded.channels ?? []) {
+					channels.push({
+						id: channel.id,
+						name: channel.name ?? channel.id,
+						isPrivate: channel.is_private ?? false,
+						isMember: channel.is_member ?? false,
+					})
+				}
+				const next = decoded.response_metadata?.next_cursor
+				if (!next) break
+				cursor = next
+			}
+			return channels
+		})
+
+		const resolveForBot = Effect.fn("SlackIntegrationService.resolveForBot")(function* (teamId: string) {
+			const rows = yield* database
+				.execute((db) =>
+					db
+						.select()
+						.from(slackWorkspaces)
+						.where(and(eq(slackWorkspaces.teamId, teamId), isNull(slackWorkspaces.revokedAt)))
+						.limit(1),
+				)
+				.pipe(Effect.mapError(toPersistenceError))
+			const row: SlackWorkspaceRow | undefined = rows[0]
+			if (!row) {
+				return yield* Effect.fail(
+					new IntegrationsNotConnectedError({
+						message: "No active Slack installation for this team",
+					}),
+				)
+			}
+			const botToken = yield* decryptValue({
+				ciphertext: row.botTokenCiphertext,
+				iv: row.botTokenIv,
+				tag: row.botTokenTag,
+			})
+			const mapleApiKey = yield* decryptValue({
+				ciphertext: row.apiKeySecretCiphertext,
+				iv: row.apiKeySecretIv,
+				tag: row.apiKeySecretTag,
+			})
+			return {
+				orgId: row.orgId,
+				teamId: row.teamId,
+				teamName: row.teamName,
+				botToken,
+				mapleApiKey,
+			} satisfies SlackBotResolution
+		})
+
+		return {
+			startInstall,
+			completeInstall,
+			getStatus,
+			uninstall,
+			listChannels,
+			resolveForBot,
+		} satisfies SlackIntegrationServiceShape
+	}),
+}) {
+	static readonly layer = Layer.effect(this, this.make).pipe(Layer.provide(FetchHttpClient.layer))
+}
diff --git a/apps/slack-agent/.env.local.example b/apps/slack-agent/.env.local.example
index f2322e0d7..479094862 100644
--- a/apps/slack-agent/.env.local.example
+++ b/apps/slack-agent/.env.local.example
@@ -9,11 +9,29 @@ CLOUDFLARE_API_TOKEN=
 # WORKERS_AI_MODEL=@cf/zai-org/glm-5.2   # must stream structured tool calls — see README Notes
 # WORKERS_AI_CONTEXT_WINDOW=262144
 
-# ── Slack (self-managed app — no Vercel Connect) ────────────────────────────
-# From your Slack app: OAuth & Permissions → Bot User OAuth Token (xoxb-...),
-# and Basic Information → Signing Secret.
-SLACK_BOT_TOKEN=
+# ── Slack (self-managed, multi-workspace app — no Vercel Connect) ───────────
+# Signing secret is per-app/static: it HMAC-verifies every inbound webhook.
+# From your Slack app: Basic Information → Signing Secret.
 SLACK_SIGNING_SECRET=
+# SLACK_BOT_TOKEN is the single-workspace DEV fallback only. In multi-workspace
+# mode the bot token is resolved per team from the Maple API (below); leave this
+# unset in production. Set it to a xoxb-... token to run against one workspace
+# without a Maple mapping (e.g. local iteration on the model + tool loop).
+# SLACK_BOT_TOKEN=
+
+# ── Maple API (multi-workspace resolve + MCP) ───────────────────────────────
+# Per-team installs live in Maple's API. The agent resolves each Slack team's
+# bot token + Maple API key from an internal endpoint, and connects to Maple's
+# MCP server for observability tools.
+#
+# NOTE: MAPLE_API_BASE_URL is used to build the MCP connection URL, which eve
+# BAKES INTO its compiled manifest at build time (like EVE_WORKFLOW_WORLD). It
+# must be set when `eve build` runs for the production URL to bake correctly — a
+# runtime-only value is too late for the connection URL. The Dockerfile passes it
+# at build. Unset locally → defaults to https://api.localhost.
+# MAPLE_API_BASE_URL=https://api.maple.dev
+# Internal service token (the code sends it as `Bearer maple_svc_<token>`).
+MAPLE_INTERNAL_SERVICE_TOKEN=
 
 # ── Durability: @workflow/world-postgres ────────────────────────────────────
 # NOTE: EVE_WORKFLOW_WORLD is read at BUILD time (eve compiles agent.ts), so it
@@ -33,6 +51,6 @@ SLACK_SIGNING_SECRET=
 
 # ── eve HTTP route auth (browser/API surface; NOT the Slack webhook) ─────────
 # If set, eve's session/stream routes require HTTP Basic. Unset = public (demo).
-# The Slack webhook (/eve/v1/slack) is always verified via SLACK_SIGNING_SECRET.
+# The Slack webhook (/eve/v1/slack) is always signature-verified independently.
 # ROUTE_AUTH_BASIC_USER=admin
 # ROUTE_AUTH_BASIC_PASSWORD=
diff --git a/apps/slack-agent/Dockerfile b/apps/slack-agent/Dockerfile
index 786780bb5..e3df6a3bc 100644
--- a/apps/slack-agent/Dockerfile
+++ b/apps/slack-agent/Dockerfile
@@ -26,6 +26,15 @@ COPY agent ./agent
 # compiled into eve's manifest), not at runtime. This must be set before the build
 # or the image silently falls back to the ephemeral on-disk local world.
 ENV EVE_WORKFLOW_WORLD=@workflow/world-postgres
+
+# IMPORTANT: the Maple MCP connection URL is built from MAPLE_API_BASE_URL and is
+# also baked into eve's manifest at BUILD time. Railway exposes service variables
+# as Docker build args when they are declared with ARG, so set MAPLE_API_BASE_URL
+# as a service variable and it becomes available here. If unset at build, the URL
+# silently bakes to the local-dev default (https://api.localhost).
+ARG MAPLE_API_BASE_URL
+ENV MAPLE_API_BASE_URL=${MAPLE_API_BASE_URL}
+
 RUN npm run build
 
 COPY docker-entrypoint.sh ./
diff --git a/apps/slack-agent/README.md b/apps/slack-agent/README.md
index afe1a9c33..e1713e05f 100644
--- a/apps/slack-agent/README.md
+++ b/apps/slack-agent/README.md
@@ -4,8 +4,10 @@ A general-purpose Slack agent built on the [eve](https://eve.dev) framework, **s
 Railway** (no Vercel). It answers `@mentions` and DMs, runs tools, and keeps durable multi-turn
 sessions.
 
-This is intentionally **generic** — no Maple domain logic yet. Get the loop working end-to-end
-first, then layer domain tools/instructions on top.
+It is **multi-workspace**: a single Slack app is distributed to many workspaces, and each
+workspace is linked to one Maple organization. Per-team installs (bot token + Maple API key) live
+in Maple's API; the agent resolves them per request and talks to Maple's MCP server for
+observability tools. See [Multi-workspace architecture](#multi-workspace-architecture).
 
 ## Architecture
 
@@ -15,7 +17,8 @@ first, then layer domain tools/instructions on top.
 | Host | **Railway** container running `eve start` (long-running Node) | eve's supported self-host model; edge Workers is blocked today by a workflow-world protocol gap |
 | Model | **Cloudflare Workers AI** via REST (`workers-ai-provider`), `@cf/zai-org/glm-5.2` | `createWorkersAI({ accountId, apiKey })` → an AI-SDK model, no Workers runtime needed; streams structured tool calls, 256K window (see Notes) |
 | Durability | **`@workflow/world-postgres`** (`5.0.0-beta.27`) + Railway Postgres | protocol-compatible with eve's vendored `@workflow/*` 5.0.0-beta line |
-| Slack | **self-managed** (`slackChannel()` + bot token + signing secret) | Vercel Connect is optional; eve verifies webhooks from the signing secret natively |
+| Slack | **self-managed, multi-workspace** (`slackChannel()` + custom `webhookVerifier` + per-team `botToken`) | one public app across many workspaces; static signing secret verifies inbound, per-team bot token resolved from the Maple API — see [Multi-workspace architecture](#multi-workspace-architecture) |
+| Maple | **resolve endpoint** (`/internal/slack/workspaces/:teamId`) + **MCP** (`/mcp`) | per-team install lookup (TTL-cached) and observability tools scoped per org |
 
 Key routes (all served by the one container): `POST /eve/v1/session`, `GET /eve/v1/session/:id/stream`,
 `POST /eve/v1/slack` (Slack webhook), `GET /eve/v1/health`, and workflow callbacks under
@@ -26,9 +29,11 @@ Key routes (all served by the one container): `POST /eve/v1/session`, `GET /eve/
 ```
 agent/
   agent.ts            # model (Workers AI) + workflow world selection
-  instructions.md     # system prompt
-  channels/slack.ts   # self-managed Slack channel
+  instructions.md     # system prompt (Maple domain guidance)
+  lib/maple.ts        # Maple resolve client (TTL cache), Slack sig verify, team→token bridge
+  channels/slack.ts   # multi-workspace Slack channel (webhookVerifier + per-team botToken)
   channels/eve.ts     # auth policy for the browser/API routes
+  connections/maple.ts # Maple MCP connection (per-workspace API key auth)
   tools/get_time.ts   # sample tool proving the tool loop
 Dockerfile            # node:24-slim (+bun for installs), eve build, entrypoint
 docker-entrypoint.sh  # runs the Postgres-world migration, then `eve start`
@@ -82,18 +87,26 @@ step 3 comes back and fills them in:
 
 ```yaml
 display_information:
-  name: Eve Agent
+  name: Maple
 features:
   bot_user:
-    display_name: eve-agent
+    display_name: maple
     always_online: true
 oauth_config:
+  # OAuth completes at the MAPLE API (not this agent). Maple stores the per-team
+  # install (bot token + Maple API key) that this agent later resolves.
+  redirect_urls:
+    - https://<your-maple-api-host>/oauth/slack/callback
   scopes:
     bot:
       - app_mentions:read   # receive @mentions
       - chat:write          # post replies
-      - im:history          # read DMs (message.im)
-      - im:write            # DM the user (auth challenges)
+      - chat:write.public   # post in channels the bot isn't a member of
+      - channels:read       # resolve public channel metadata
+      - groups:read         # resolve private channel metadata
+      - im:history          # read DM history (message.im)
+      - im:read             # resolve DM conversation metadata
+      - im:write            # open/DM the user
       - users:read          # attribute speakers
 settings:
   event_subscriptions:
@@ -105,10 +118,17 @@ settings:
     is_enabled: true
     request_url: https://<your-service>.up.railway.app/eve/v1/slack
   socket_mode_enabled: false
+  # Enable public distribution so multiple workspaces can install the app.
+  # (Slack → Manage Distribution → Activate Public Distribution; requires the
+  # redirect URL above and passing Slack's "Remove Hard Coded Information" check.)
+  org_deploy_enabled: false
 ```
 
-Install to your workspace, then copy the **Bot User OAuth Token** (`xoxb-…`) and the **Signing
-Secret** (Basic Information).
+Two request URLs point at **this agent** (Event Subscriptions + Interactivity → the Railway host);
+the OAuth **redirect URL** points at the **Maple API** — that is where install/OAuth completes and
+where the per-team bot token + Maple API key are stored for this agent to resolve. In
+single-workspace dev you can skip distribution: install to one workspace and set `SLACK_BOT_TOKEN`.
+Copy the **Signing Secret** (Basic Information) in all cases.
 
 ### 2. Create the Railway service
 
@@ -139,7 +159,16 @@ variables in (d), since two of them embed the URL.
 
 **d. Set service variables:**
   - `CLOUDFLARE_ACCOUNT_ID`, `CLOUDFLARE_API_TOKEN`
-  - `SLACK_BOT_TOKEN`, `SLACK_SIGNING_SECRET`
+  - `SLACK_SIGNING_SECRET` — per-app/static; HMAC-verifies every inbound webhook.
+  - `MAPLE_API_BASE_URL` — the Maple API base (e.g. `https://api.maple.dev`). **Also needed at build
+    time**: it forms the Maple MCP connection URL, which eve bakes into its manifest at build (like
+    `EVE_WORKFLOW_WORLD`). Railway exposes service variables as Docker build args (the Dockerfile
+    declares `ARG MAPLE_API_BASE_URL`), so setting it as a service variable covers both build and
+    runtime. If it is missing at build, the URL silently bakes to `https://api.localhost`.
+  - `MAPLE_INTERNAL_SERVICE_TOKEN` — the internal service token; the agent sends it as
+    `Authorization: Bearer maple_svc_<token>` to the resolve endpoint. Runtime-only.
+  - `SLACK_BOT_TOKEN` — **omit in multi-workspace production** (the bot token is resolved per team
+    from Maple). Set it only to run against a single workspace with no Maple mapping (dev).
   - `PORT=8080` — set it explicitly. Railway injects a `PORT` of its own that overrides the image's
     `ENV PORT`, so pinning it here is what makes the value deterministic rather than assigned.
   - `WORKFLOW_LOCAL_BASE_URL=http://localhost:8080` — the durable-run callback target. See the note
@@ -215,6 +244,73 @@ Finally, invite the bot to a channel — `/invite @eve-agent` — and `@mention`
   exercise the `get_time` tool.
 - A follow-up mention in the same thread resumes the same durable session.
 
+## Multi-workspace architecture
+
+One Slack app, distributed publicly, installed into many workspaces. Each Slack **team** is linked
+to one Maple **organization**. The install (bot token + Maple API key) is created and stored by the
+**Maple API** during OAuth; this agent only ever *resolves* it.
+
+**Resolve endpoint (fixed contract, owned by the Maple API):**
+
+```
+GET {MAPLE_API_BASE_URL}/internal/slack/workspaces/{teamId}
+Authorization: Bearer maple_svc_{MAPLE_INTERNAL_SERVICE_TOKEN}
+
+200 → { "orgId": "...", "teamId": "...", "teamName": "..."|null,
+        "botToken": "xoxb-...", "mapleApiKey": "maple_ak_..." }
+404 → team not installed / revoked
+```
+
+`agent/lib/maple.ts` wraps this in `resolveWorkspace(teamId)` with an in-memory TTL cache (5 min
+positive, 30 s negative, in-flight de-dupe). It never caches 5xx/network errors as "not installed".
+
+**Inbound (webhook → which team):** `agent/channels/slack.ts` installs a custom `webhookVerifier`.
+Because a `webhookVerifier` is set, eve skips its built-in signing-secret check and this verifier
+owns verification: it HMAC-verifies the Slack **v0** signature (`v0:{timestamp}:{rawBody}`, SHA-256,
+5-minute skew reject, constant-time compare) against the static `SLACK_SIGNING_SECRET`, then parses
+`team_id` from the payload (top-level, `authorizations[]`, or `event.team`; absent for
+`url_verification`, which needs no token).
+
+**Outbound bot token (which team → token):** eve's `botToken` credential is **arg-less**
+(`() => Promise<string>`), so it receives no request context. Verified against eve@0.25.3
+(`node_modules/eve/dist/src`):
+
+- The webhook route runs the verifier, then dispatches the mention via
+  `waitUntil(dispatchInboundMessage(...))`; `botToken` is resolved *lazily inside that detached
+  dispatch* and again inside durable workflow steps when the reply is posted.
+- An `AsyncLocalStorage` established in the verifier via `enterWith` **does not survive** into that
+  detached dispatch — `await` restores the caller's context snapshot, so the store is gone by the
+  time `waitUntil` runs (reproduced with a faithful `enterWith → await → waitUntil` harness). eve's
+  own `runtimeSessionStorage` ALS carries only bundle-cache state, not `team_id`.
+
+So the token bridge is a **module-level record populated at verify time** (`agent/lib/maple.ts`):
+`enterTeam` (ALS, best-effort — harmless when it doesn't survive, and forward-compatible if a future
+eve preserves context) plus `recordTeam` (a most-recently-verified fallback read by
+`currentTeamId`). `resolveBotToken()` resolves current team → install token → else `SLACK_BOT_TOKEN`
+→ throw. **Caveat:** under genuinely concurrent inbound events from *different* teams the fallback
+can name the wrong team for a given outbound call. This fails **closed**, not cross-tenant — team A's
+bot token cannot post to team B's channel (Slack returns `invalid_auth` / `channel_not_found`), so a
+mis-resolution drops a reply rather than leaking one workspace's message into another. The clean fix
+belongs upstream (eve threading `team_id` into the credential resolver). `resolveWorkspace` itself is
+always correctly keyed by team.
+
+**MCP tools (per-workspace API key):** `agent/connections/maple.ts` connects to
+`{MAPLE_API_BASE_URL}/mcp` (streamable HTTP). Unlike `botToken`, the connection `auth` resolver
+receives the session context, and the Slack auth context carries `team_id` in
+`ctx.session.auth.current.attributes` (persisted with the session by eve's `buildSlackAuthContext`).
+So this path resolves the right org's `mapleApiKey` reliably — including in durable reply steps. If
+the workspace isn't linked, the resolver throws a clear message and the model (per
+`instructions.md`) tells the user to connect from the Maple dashboard → Integrations → Slack. The
+tool list is left **unfiltered**: the Maple MCP tool names are resolved at runtime from the live
+server, not known at authoring time, so an allow/block list would be a guess — restrict mutating
+tools server-side (or add a `tools.allow` here once the concrete names are confirmed).
+
+**Slack app manifest changes for multi-workspace** (see the manifest in
+[Deploy → step 1](#1-create-the-slack-app)): add the OAuth **redirect URL** pointing at the Maple
+API callback (`/oauth/slack/callback`), broaden the bot scopes to
+`app_mentions:read,chat:write,chat:write.public,channels:read,groups:read,im:history,im:read,im:write,users:read`,
+and **activate public distribution** so the app can be installed into any workspace.
+
 ## Notes
 
 - **Model must support tool calling _while streaming_.** eve's harness is tool-driven and always
diff --git a/apps/slack-agent/agent/channels/slack.ts b/apps/slack-agent/agent/channels/slack.ts
index 6314c6080..6a8b568bd 100644
--- a/apps/slack-agent/agent/channels/slack.ts
+++ b/apps/slack-agent/agent/channels/slack.ts
@@ -1,16 +1,58 @@
 import { slackChannel } from "eve/channels/slack";
+import type { SlackWebhookVerifier } from "eve/channels/slack";
+import {
+  enterTeam,
+  parseSlackTeamId,
+  recordTeam,
+  resolveBotToken,
+  verifySlackV0Signature,
+} from "#lib/maple.js";
 
 /**
- * Self-managed Slack app — no Vercel Connect.
+ * Multi-workspace, self-managed Slack app — no Vercel Connect.
  *
- * Credentials fall back to env vars (see .env.local.example):
- *   - botToken       -> SLACK_BOT_TOKEN     (outbound Web API calls)
- *   - signingSecret  -> SLACK_SIGNING_SECRET (HMAC-verifies inbound webhooks)
+ * The Slack signing secret is per-app/static (`SLACK_SIGNING_SECRET`); only the
+ * *bot token* varies per workspace. So we:
+ *   1. Verify every inbound webhook's v0 signature with the static secret in a
+ *      custom `webhookVerifier`, and record the request's `team_id` for the
+ *      arg-less `botToken` resolver (see agent/lib/maple.ts for how that bridge
+ *      works and its concurrency caveat).
+ *   2. Resolve the outbound bot token per team via Maple's resolve endpoint,
+ *      falling back to `SLACK_BOT_TOKEN` for single-workspace dev.
  *
- * Slack delivers events to POST /eve/v1/slack. Point your Slack app's
- * Event Subscriptions "Request URL" at https://<host>/eve/v1/slack.
+ * Slack delivers events to POST /eve/v1/slack.
  */
+
+const webhookVerifier: SlackWebhookVerifier = async (request, body) => {
+  const signingSecret = process.env.SLACK_SIGNING_SECRET;
+  if (!signingSecret) {
+    // No secret → cannot verify anything. Reject (returning falsy rejects).
+    return false;
+  }
+  if (!verifySlackV0Signature(body, request.headers, signingSecret)) {
+    return false;
+  }
+
+  // Signature is good. Record the team so the arg-less botToken can resolve it.
+  // (`url_verification` challenges carry no team_id and need no token — the
+  // channel answers the challenge before any outbound call.)
+  const teamId = parseSlackTeamId(body);
+  if (teamId) {
+    recordTeam(teamId);
+    enterTeam(teamId);
+  }
+
+  // Return the verified body so eve uses it downstream.
+  return body;
+};
+
 export default slackChannel({
+  credentials: {
+    webhookVerifier,
+    // Per-team bot token. Arg-less by eve's contract; resolves the current
+    // team's token (or SLACK_BOT_TOKEN in single-workspace dev mode).
+    botToken: async () => resolveBotToken(),
+  },
   // Repeated mentions in a thread only inject what's new since the agent's
   // last reply, instead of re-reading the whole thread each time.
   threadContext: { since: "last-agent-reply" },
diff --git a/apps/slack-agent/agent/connections/maple.ts b/apps/slack-agent/agent/connections/maple.ts
new file mode 100644
index 000000000..37a3d5066
--- /dev/null
+++ b/apps/slack-agent/agent/connections/maple.ts
@@ -0,0 +1,49 @@
+import { defineMcpClientConnection } from "eve/connections";
+import type { ConnectionAuthResolver } from "eve/connections";
+import { mapleApiBaseUrl, resolveWorkspace } from "#lib/maple.js";
+
+/**
+ * Maple observability MCP server (streamable HTTP), authenticated per Slack
+ * workspace.
+ *
+ * Unlike the channel's arg-less `botToken`, the MCP `auth` resolver receives
+ * the active session context, and the Slack auth context carries `team_id` in
+ * `ctx.session.auth.current.attributes` (set by eve's buildSlackAuthContext and
+ * persisted with the session). So this path resolves the correct org's Maple
+ * API key reliably, including in durable reply steps.
+ *
+ * If the workspace isn't linked, the resolver throws a clear message; the model
+ * is instructed (agent/instructions.md) to explain that this Slack workspace is
+ * not connected to a Maple organization and to point the user at the Maple
+ * dashboard → Integrations → Slack.
+ *
+ * tools filter: left unfiltered. The tool names exposed by the Maple MCP server
+ * are resolved at runtime from the live server, not known at authoring time, so
+ * an allow/block list would be a guess. Blocking mutations should be enforced
+ * server-side (or added here once the concrete tool names are confirmed).
+ */
+
+const NOT_LINKED_MESSAGE =
+  "This Slack workspace is not connected to a Maple organization. " +
+  "Install the integration from the Maple dashboard → Integrations → Slack.";
+
+const resolveAuth: ConnectionAuthResolver = async (ctx) => {
+  const team = ctx.session.auth.current?.attributes?.team_id;
+  const teamId = typeof team === "string" && team.length > 0 ? team : undefined;
+  if (!teamId) throw new Error(NOT_LINKED_MESSAGE);
+  return {
+    getToken: async () => {
+      const ws = await resolveWorkspace(teamId);
+      if (!ws) throw new Error(NOT_LINKED_MESSAGE);
+      return { token: ws.mapleApiKey };
+    },
+  };
+};
+
+export default defineMcpClientConnection({
+  url: `${mapleApiBaseUrl()}/mcp`,
+  description:
+    "Maple observability platform: query the connected organization's " +
+    "OpenTelemetry services, traces, spans, errors, logs and metrics.",
+  auth: resolveAuth,
+});
diff --git a/apps/slack-agent/agent/instructions.md b/apps/slack-agent/agent/instructions.md
index 0ee762332..548099d54 100644
--- a/apps/slack-agent/agent/instructions.md
+++ b/apps/slack-agent/agent/instructions.md
@@ -1,18 +1,46 @@
-# Assistant
+# Maple assistant
 
-You are a helpful assistant that lives in Slack. You answer questions, help people
-think through problems, and use your tools when they let you give a better answer.
+You are Maple's assistant in Slack. Maple is an OpenTelemetry observability
+platform: it ingests traces, spans, logs, and metrics from distributed systems
+and lets teams explore their services' health, errors, and performance.
 
-## Style
+Each Slack workspace is connected to exactly one Maple organization. You act on
+behalf of the workspace that mentioned you, and your Maple tools are already
+scoped to that organization — you never need to ask which org or pass an org id.
 
-- Be concise and direct. Slack is a chat surface — prefer short paragraphs and lists
-  over long prose.
-- When you don't know something, say so plainly rather than guessing.
-- Use a tool when it gives a more accurate or up-to-date answer than reasoning alone.
-  Explain what you did in a sentence, not a play-by-play.
+## What you can do
+
+- Answer questions about the connected organization's telemetry using your Maple
+  tools: list and inspect services, find slow or failing traces, surface errors,
+  search logs, and read metrics.
+- Answer general questions about Maple and about OpenTelemetry concepts (traces,
+  spans, span status, resources, semantic conventions, sampling, etc.).
+- Help people reason through an incident or a performance question, then use a
+  tool to ground the answer in real data when that gives a better answer than
+  reasoning alone.
+
+## Using tools
+
+- Prefer a Maple tool over guessing whenever the answer depends on the org's
+  actual data (which services exist, what's erroring right now, a specific
+  trace). Reason first about *which* query answers the question, then run it.
+- Summarize what you found in plain language. Explain what you looked at in a
+  sentence — not a play-by-play of each tool call.
+- Never invent service names, trace ids, error messages, metric values, or
+  links. If a query returns nothing, say so.
 
-## Behavior
+## When the workspace isn't connected
 
-- You are replying inside a Slack thread. Stay on topic for that thread.
-- When several people are in a thread, pay attention to who is asking.
-- Never invent facts, links, or credentials.
+If a Maple tool fails because this Slack workspace is not connected to a Maple
+organization, do not retry. Tell the user plainly that this workspace isn't
+linked to Maple yet, and that an admin can connect it from the **Maple dashboard
+→ Integrations → Slack**. You can still answer general Maple / OpenTelemetry
+questions in that state.
+
+## Style
+
+- Be concise and direct. Slack is a chat surface — prefer short paragraphs and
+  lists over long prose.
+- You are replying inside a Slack thread; stay on topic for that thread, and
+  when several people are involved, pay attention to who is asking.
+- When you don't know something, say so plainly rather than guessing.
diff --git a/apps/slack-agent/agent/lib/maple.ts b/apps/slack-agent/agent/lib/maple.ts
new file mode 100644
index 000000000..d2d3ed79a
--- /dev/null
+++ b/apps/slack-agent/agent/lib/maple.ts
@@ -0,0 +1,289 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { createHmac, timingSafeEqual } from "node:crypto";
+
+/**
+ * Maple API integration for the multi-workspace Slack agent.
+ *
+ * This module owns three concerns:
+ *   1. Resolving per-Slack-team install credentials from Maple's internal
+ *      resolve endpoint, with an in-memory TTL cache (`resolveWorkspace`).
+ *   2. Verifying inbound Slack webhook signatures (`verifySlackV0Signature`)
+ *      and extracting the `team_id` (`parseSlackTeamId`).
+ *   3. Bridging "which Slack team is this?" to eve's *arg-less* `botToken`
+ *      credential function (`resolveBotToken`), which receives no request
+ *      context of its own. See the "Team-context bridging" note below.
+ */
+
+// ── Env ─────────────────────────────────────────────────────────────────────
+
+/**
+ * Local-dev default for the Maple API base. Overridden by MAPLE_API_BASE_URL.
+ */
+const MAPLE_API_BASE_URL_DEFAULT = "https://api.localhost";
+
+/**
+ * Base URL of the Maple API (e.g. https://api.maple.dev). No trailing slash.
+ *
+ * NOTE: the Maple MCP connection's `url` is built from this and is **baked into
+ * eve's compiled manifest at build time** (like `EVE_WORKFLOW_WORLD`). So
+ * `MAPLE_API_BASE_URL` must be set when `eve build` runs for the production URL
+ * to bake correctly — a runtime-only value is too late for the connection URL.
+ * This helper never throws (it falls back to the local-dev default) so `eve
+ * build` / `eve dev` work out of the box; the runtime `fetch` path still fails
+ * loudly on a genuinely-missing service token.
+ */
+export function mapleApiBaseUrl(): string {
+  const raw = process.env.MAPLE_API_BASE_URL;
+  return (raw && raw.length > 0 ? raw : MAPLE_API_BASE_URL_DEFAULT).replace(
+    /\/+$/u,
+    "",
+  );
+}
+
+function mapleServiceToken(): string {
+  const raw = process.env.MAPLE_INTERNAL_SERVICE_TOKEN;
+  if (!raw) throw new Error("MAPLE_INTERNAL_SERVICE_TOKEN is not set.");
+  return raw;
+}
+
+// ── resolveWorkspace: TTL-cached team → credentials ─────────────────────────
+
+/** A resolved Maple workspace install for one Slack team. */
+export interface MapleWorkspace {
+  readonly orgId: string;
+  readonly teamId: string;
+  readonly teamName: string | null;
+  /** Slack bot token (xoxb-…) for outbound Web API calls to this team. */
+  readonly botToken: string;
+  /** Maple API key (maple_ak_…) authorizing MCP calls for this org. */
+  readonly mapleApiKey: string;
+}
+
+interface CacheEntry {
+  /** Resolved workspace, or null for a negative (404) result. */
+  readonly value: MapleWorkspace | null;
+  readonly expiresAt: number;
+}
+
+const POSITIVE_TTL_MS = 5 * 60_000; // 5 minutes
+const NEGATIVE_TTL_MS = 30_000; // 30 seconds
+
+const cache = new Map<string, CacheEntry>();
+/** De-dupe concurrent resolves for the same team into one in-flight request. */
+const inFlight = new Map<string, Promise<MapleWorkspace | null>>();
+
+/**
+ * Resolves the Maple install for a Slack team, cached in-memory.
+ *
+ * Returns `null` when the team is not installed / has been revoked (the
+ * endpoint returns 404). Positive results are cached for 5 minutes, negative
+ * results for 30 seconds so a fresh install is picked up quickly.
+ *
+ * Throws only on transport / server errors (5xx, network) so a transient Maple
+ * outage surfaces rather than being cached as "not installed".
+ */
+export async function resolveWorkspace(
+  teamId: string,
+): Promise<MapleWorkspace | null> {
+  const cached = cache.get(teamId);
+  if (cached && cached.expiresAt > Date.now()) return cached.value;
+
+  const existing = inFlight.get(teamId);
+  if (existing) return existing;
+
+  const promise = fetchWorkspace(teamId)
+    .then((value) => {
+      cache.set(teamId, {
+        value,
+        expiresAt:
+          Date.now() + (value === null ? NEGATIVE_TTL_MS : POSITIVE_TTL_MS),
+      });
+      return value;
+    })
+    .finally(() => {
+      inFlight.delete(teamId);
+    });
+
+  inFlight.set(teamId, promise);
+  return promise;
+}
+
+async function fetchWorkspace(teamId: string): Promise<MapleWorkspace | null> {
+  const url = `${mapleApiBaseUrl()}/internal/slack/workspaces/${encodeURIComponent(teamId)}`;
+  const res = await fetch(url, {
+    headers: { authorization: `Bearer maple_svc_${mapleServiceToken()}` },
+  });
+
+  if (res.status === 404) return null;
+  if (!res.ok) {
+    // Do not cache transport/server errors as "not installed".
+    throw new Error(
+      `Maple workspace resolve failed for team ${teamId}: HTTP ${res.status}`,
+    );
+  }
+
+  const body = (await res.json()) as Partial<MapleWorkspace>;
+  if (!body.botToken || !body.mapleApiKey || !body.orgId) {
+    throw new Error(
+      `Maple workspace resolve for team ${teamId} returned an incomplete payload.`,
+    );
+  }
+  return {
+    orgId: body.orgId,
+    teamId: body.teamId ?? teamId,
+    teamName: body.teamName ?? null,
+    botToken: body.botToken,
+    mapleApiKey: body.mapleApiKey,
+  };
+}
+
+// ── Team-context bridging (verifier → arg-less botToken) ─────────────────────
+//
+// eve's `botToken` credential is `() => Promise<string> | string` — arg-less,
+// so it cannot be told which Slack team the current outbound call is for.
+//
+// What we verified in eve@0.25.3 (node_modules/eve/dist/src):
+//   * The webhook route reads the raw body, runs our `webhookVerifier`, then
+//     dispatches the mention via `waitUntil(dispatchInboundMessage(...))`
+//     (slackChannel.js). `botToken` is resolved lazily *inside* that detached
+//     dispatch (api.js `resolveSlackBotToken`), and again later inside durable
+//     workflow steps when the reply is posted.
+//   * We tested whether an AsyncLocalStorage established in the verifier via
+//     `enterWith` survives into that detached dispatch. It does NOT: `await`
+//     restores the caller's context snapshot, so a store entered inside the
+//     awaited verifier is lost by the time `waitUntil` runs. (Reproduced with a
+//     faithful enterWith→await→waitUntil harness — the token read returned the
+//     fallback.)
+//   * eve's own `runtimeSessionStorage` ALS carries only bundle-cache state
+//     (RuntimeSession), not the Slack `team_id`, so it can't carry it either.
+//
+// Therefore the arg-less `botToken` cannot see `team_id` through any ambient
+// eve channel. We bridge with a module-level record populated at verify time:
+//   * `enterTeam` is still called (via ALS) as the most-precise signal — it is
+//     harmless when it doesn't survive, and makes this forward-compatible if a
+//     future eve version preserves context into dispatch.
+//   * `recordTeam` sets a module-level most-recently-verified team as the
+//     fallback read by `currentTeamId`.
+//
+// Caveat (documented in the README): under genuinely concurrent inbound events
+// from *different* teams, the module fallback can name the wrong team for a
+// given outbound call. This fails *closed*, not silently cross-tenant: a bot
+// token for team A cannot post to team B's channel — Slack rejects it
+// (`channel_not_found` / `invalid_auth`) — so a mis-resolution drops a reply
+// rather than leaking one workspace's messages into another. `resolveWorkspace`
+// itself is fully keyed by team and always correct. The clean fix belongs
+// upstream (eve threading `team_id` into the credential resolver).
+
+interface TeamStore {
+  readonly teamId: string;
+}
+
+const teamStorage = new AsyncLocalStorage<TeamStore>();
+let lastVerifiedTeamId: string | undefined;
+
+/** Best-effort ALS marker for the current team (see note above). */
+export function enterTeam(teamId: string): void {
+  teamStorage.enterWith({ teamId });
+}
+
+/** Module-level fallback record of the most-recently-verified team. */
+export function recordTeam(teamId: string): void {
+  lastVerifiedTeamId = teamId;
+}
+
+/** The team for the current outbound call: ALS first, then module fallback. */
+export function currentTeamId(): string | undefined {
+  return teamStorage.getStore()?.teamId ?? lastVerifiedTeamId;
+}
+
+/**
+ * Resolves the Slack bot token for eve's arg-less `botToken` credential.
+ *
+ * Order: current team's install token → `SLACK_BOT_TOKEN` env (single-workspace
+ * dev fallback) → throw.
+ */
+export async function resolveBotToken(): Promise<string> {
+  const teamId = currentTeamId();
+  if (teamId) {
+    const ws = await resolveWorkspace(teamId);
+    if (ws) return ws.botToken;
+  }
+  const envToken = process.env.SLACK_BOT_TOKEN;
+  if (envToken) return envToken;
+  throw new Error(
+    teamId
+      ? `Slack team ${teamId} is not linked to a Maple workspace, and SLACK_BOT_TOKEN is not set.`
+      : `No current Slack team context and SLACK_BOT_TOKEN is not set.`,
+  );
+}
+
+// ── Inbound webhook verification ────────────────────────────────────────────
+
+const MAX_SKEW_SECONDS = 60 * 5; // reject timestamps older than 5 minutes
+
+/**
+ * Verifies a Slack request signature (v0 scheme) against a static signing
+ * secret. Returns true on success, false on any failure (missing headers,
+ * stale timestamp, mismatch). The signing secret stays per-app/static — only
+ * the *bot token* is per-workspace.
+ */
+export function verifySlackV0Signature(
+  rawBody: string,
+  headers: Headers,
+  signingSecret: string,
+): boolean {
+  const signature = headers.get("x-slack-signature");
+  const timestamp = headers.get("x-slack-request-timestamp");
+  if (!signature || !timestamp) return false;
+
+  const ts = Number(timestamp);
+  if (!Number.isFinite(ts)) return false;
+  if (Math.abs(Date.now() / 1000 - ts) > MAX_SKEW_SECONDS) return false;
+
+  const expected =
+    "v0=" +
+    createHmac("sha256", signingSecret)
+      .update(`v0:${timestamp}:${rawBody}`)
+      .digest("hex");
+
+  // Constant-time compare; length guard first (timingSafeEqual throws on
+  // differing lengths).
+  const a = Buffer.from(signature);
+  const b = Buffer.from(expected);
+  if (a.length !== b.length) return false;
+  return timingSafeEqual(a, b);
+}
+
+/**
+ * Extracts the Slack `team_id` from a raw webhook body. Handles the standard
+ * event-callback top-level field, the `authorizations[]` fallback (Enterprise
+ * Grid), and the `event.team` fallback. Returns undefined for payloads without
+ * one (e.g. `url_verification`).
+ */
+export function parseSlackTeamId(rawBody: string): string | undefined {
+  let payload: unknown;
+  try {
+    payload = JSON.parse(rawBody);
+  } catch {
+    return undefined;
+  }
+  if (typeof payload !== "object" || payload === null) return undefined;
+  const p = payload as Record<string, unknown>;
+
+  if (typeof p.team_id === "string" && p.team_id.length > 0) return p.team_id;
+
+  const auths = p.authorizations;
+  if (Array.isArray(auths) && auths.length > 0) {
+    const first = auths[0] as Record<string, unknown> | undefined;
+    if (first && typeof first.team_id === "string" && first.team_id.length > 0) {
+      return first.team_id;
+    }
+  }
+
+  const event = p.event;
+  if (typeof event === "object" && event !== null) {
+    const team = (event as Record<string, unknown>).team;
+    if (typeof team === "string" && team.length > 0) return team;
+  }
+  return undefined;
+}
diff --git a/apps/web/src/components/alerts/destination-dialog.tsx b/apps/web/src/components/alerts/destination-dialog.tsx
index 9e33f33fe..c2cee6477 100644
--- a/apps/web/src/components/alerts/destination-dialog.tsx
+++ b/apps/web/src/components/alerts/destination-dialog.tsx
@@ -10,12 +10,15 @@ import {
 	ProviderLogo,
 	type DestinationProvider,
 } from "@/components/alerts/destination-provider"
-import { HazelIcon, LoaderIcon } from "@/components/icons"
+import { CircleInfoIcon, HazelIcon, LoaderIcon } from "@/components/icons"
 import { MapleApiAtomClient } from "@/lib/services/common/atom-client"
+import { MapleApiV2AtomClient } from "@/lib/services/common/v2-atom-client"
 import { disabledResultAtom } from "@/lib/services/atoms/disabled-result-atom"
 import { Result, useAtomSet, useAtomValue } from "@/lib/effect-atom"
 import type { HazelChannelsListResponse } from "@maple/domain/http"
+import type { V2SlackChannelList } from "@maple/domain/http/v2"
 import { Exit } from "effect"
+import { Link } from "@tanstack/react-router"
 import { useEffect, useState } from "react"
 import { Button } from "@maple/ui/components/ui/button"
 import {
@@ -36,6 +39,14 @@ import {
 	SelectTrigger,
 	SelectValue,
 } from "@maple/ui/components/ui/select"
+import {
+	Combobox,
+	ComboboxContent,
+	ComboboxEmpty,
+	ComboboxInput,
+	ComboboxItem,
+	ComboboxList,
+} from "@maple/ui/components/ui/combobox"
 import { Switch } from "@maple/ui/components/ui/switch"
 import { Avatar, AvatarFallback, AvatarImage } from "@maple/ui/components/ui/avatar"
 import { Checkbox } from "@maple/ui/components/ui/checkbox"
@@ -65,6 +76,9 @@ function isFormReady(form: DestinationFormState, isEditing: boolean): boolean {
 	switch (form.type) {
 		case "hazel-oauth":
 			return form.hazelOrganizationId.trim().length > 0 && form.hazelChannelId.trim().length > 0
+		case "slack-bot":
+			// Editing keeps the stored channel when left untouched; creating requires a pick.
+			return isEditing || form.slackChannelId.trim().length > 0
 		// On create the secret is required; when editing, a blank value keeps the
 		// stored one.
 		case "discord":
@@ -526,6 +540,156 @@ function HazelOAuthFields({
 	)
 }
 
+/**
+ * Slack (bot) destination fields. Requires the org-level Slack app install (the
+ * bot token is resolved from the org's workspace at dispatch — no per-destination
+ * secret). When the app isn't installed we point the user at the integrations
+ * page; when it is, we let them pick a channel the bot can see.
+ */
+function SlackBotFields({
+	form,
+	onFormChange,
+	isEditing,
+}: {
+	form: DestinationFormState
+	onFormChange: (updater: (current: DestinationFormState) => DestinationFormState) => void
+	isEditing: boolean
+}) {
+	const statusResult = useAtomValue(
+		MapleApiV2AtomClient.query("slackIntegration", "status", {
+			reactivityKeys: ["slackIntegration"],
+		}),
+	)
+
+	const installed = Result.builder(statusResult)
+		.onSuccess((s) => s.installed)
+		.orElse(() => false)
+
+	const channelsAtom = installed
+		? MapleApiV2AtomClient.query("slackIntegration", "channels", {
+				reactivityKeys: ["slackIntegration", "slackChannels"],
+			})
+		: disabledResultAtom<V2SlackChannelList>()
+	const channelsResult = useAtomValue(channelsAtom)
+
+	const channels = Result.builder(channelsResult)
+		.onSuccess((c) => [...c.channels])
+		.orElse(() => [] as V2SlackChannelList["channels"][number][])
+	const channelsLoading = installed && channelsResult.waiting
+	const channelsFailed = Result.isFailure(channelsResult)
+
+	const statusPending = Result.isInitial(statusResult)
+	const statusFailed = Result.isFailure(statusResult)
+
+	if (statusPending) {
+		return <p className="text-[11px] text-muted-foreground">Checking your Slack connection…</p>
+	}
+
+	if (statusFailed) {
+		return (
+			<p className="text-xs text-destructive">
+				Couldn&apos;t check your Slack connection. This may be a temporary issue — try again.
+			</p>
+		)
+	}
+
+	if (!installed) {
+		return (
+			<div className="space-y-2 rounded-md border border-dashed border-border/60 p-3">
+				<p className="text-xs text-muted-foreground">
+					The Maple Slack app isn&apos;t installed for this organization yet. Install it from the
+					integrations page, then come back to pick a channel.
+				</p>
+				<Link
+					to="/integrations"
+					search={{ integration: "slack" }}
+					className="inline-flex items-center gap-1 text-xs font-medium text-primary underline-offset-2 hover:underline"
+				>
+					Go to Slack integration →
+				</Link>
+			</div>
+		)
+	}
+
+	const label = (id: string): string => {
+		const channel = channels.find((c) => c.id === id)
+		if (!channel) return form.slackChannelName ? `#${form.slackChannelName}` : ""
+		return channel.is_private ? `#${channel.name} (private)` : `#${channel.name}`
+	}
+
+	const selectedChannel = channels.find((c) => c.id === form.slackChannelId)
+
+	return (
+		<div className="space-y-1.5">
+			<Label htmlFor="destination-slack-channel" className="text-xs">
+				Channel
+			</Label>
+			<Combobox
+				value={form.slackChannelId || null}
+				itemToStringLabel={(value: string) => label(value)}
+				onValueChange={(value) => {
+					if (value == null) return
+					const channel = channels.find((c) => c.id === value)
+					onFormChange((current) => ({
+						...current,
+						slackChannelId: value,
+						slackChannelName: channel?.name ?? current.slackChannelName,
+					}))
+				}}
+			>
+				<ComboboxInput
+					id="destination-slack-channel"
+					placeholder={
+						channelsLoading
+							? "Loading channels…"
+							: isEditing && form.slackChannelName
+								? `#${form.slackChannelName}`
+								: "Search channels…"
+					}
+					className="w-full"
+				/>
+				<ComboboxContent>
+					<ComboboxEmpty>No matching channels.</ComboboxEmpty>
+					<ComboboxList>
+						{channels.map((channel) => (
+							<ComboboxItem key={channel.id} value={channel.id}>
+								<span className="flex items-center gap-2">
+									<span className="truncate">#{channel.name}</span>
+									{channel.is_private ? (
+										<span className="text-[10px] text-muted-foreground">private</span>
+									) : null}
+									{!channel.is_member ? (
+										<span className="text-[10px] text-warning">bot not in channel</span>
+									) : null}
+								</span>
+							</ComboboxItem>
+						))}
+					</ComboboxList>
+				</ComboboxContent>
+			</Combobox>
+			{channelsFailed ? (
+				<p className="text-[11px] text-destructive">
+					Couldn&apos;t load Slack channels. Try reopening this dialog.
+				</p>
+			) : channels.length === 0 && !channelsLoading ? (
+				<p className="text-[11px] text-muted-foreground">
+					No channels returned. Make sure the Maple bot has been added to at least one channel.
+				</p>
+			) : null}
+			<p className="flex items-start gap-1.5 text-[11px] text-muted-foreground">
+				<CircleInfoIcon size={12} className="mt-0.5 shrink-0" />
+				<span>
+					For private channels — and public ones if posting fails — invite the bot with{" "}
+					<code className="rounded bg-muted px-1">/invite @Maple</code> in that channel.
+					{selectedChannel && !selectedChannel.is_member
+						? " The bot isn't in the selected channel yet."
+						: ""}
+				</span>
+			</p>
+		</div>
+	)
+}
+
 function FieldHelper({ provider }: { provider: DestinationProvider }) {
 	if (!provider.docsUrl) return null
 	return (
@@ -651,6 +815,14 @@ export function DestinationDialog({
 								</>
 							)}
 
+							{form.type === "slack-bot" && (
+								<SlackBotFields
+									form={form}
+									onFormChange={onFormChange}
+									isEditing={isEditing}
+								/>
+							)}
+
 							{form.type === "pagerduty" && (
 								<div className="space-y-1.5">
 									<Label htmlFor="destination-integration" className="text-xs">
diff --git a/apps/web/src/components/alerts/destination-provider.tsx b/apps/web/src/components/alerts/destination-provider.tsx
index 97560f868..99ba58309 100644
--- a/apps/web/src/components/alerts/destination-provider.tsx
+++ b/apps/web/src/components/alerts/destination-provider.tsx
@@ -1,6 +1,6 @@
 import type { AlertDestinationType } from "@maple/domain/http"
 import { useState, type ReactNode } from "react"
-import { CodeIcon, DiscordIcon, EnvelopeIcon, HazelIcon } from "@/components/icons"
+import { CodeIcon, DiscordIcon, EnvelopeIcon, HazelIcon, SlackIcon } from "@/components/icons"
 import { cn } from "@maple/ui/utils"
 
 const BRANDFETCH_CLIENT_ID = "1id0IQ-4i8Z46-n-DfQ"
@@ -38,6 +38,17 @@ export const PROVIDERS: Record<AlertDestinationType, DestinationProvider> = {
 		docsUrl: "https://api.slack.com/messaging/webhooks",
 		docsLabel: "Slack webhook docs",
 	},
+	"slack-bot": {
+		type: "slack-bot",
+		label: "Slack (bot)",
+		description: "Post alerts to a channel via the installed Maple Slack app — no webhook to manage.",
+		accent: "#4A154B",
+		accentBg: "rgba(74,21,75,0.30)",
+		accentText: "#E8C5EA",
+		fallbackIcon: ({ size = 22, className }) => <SlackIcon size={size} className={className} />,
+		docsUrl: "https://maple.dev/docs/integrations/slack",
+		docsLabel: "Slack integration guide",
+	},
 	pagerduty: {
 		type: "pagerduty",
 		label: "PagerDuty",
@@ -99,6 +110,7 @@ export const PROVIDERS: Record<AlertDestinationType, DestinationProvider> = {
 
 export const DESTINATION_TYPES: ReadonlyArray<AlertDestinationType> = [
 	"slack",
+	"slack-bot",
 	"discord",
 	"email",
 	"pagerduty",
diff --git a/apps/web/src/components/icons/index.ts b/apps/web/src/components/icons/index.ts
index 2a0068afb..6b04b1f36 100644
--- a/apps/web/src/components/icons/index.ts
+++ b/apps/web/src/components/icons/index.ts
@@ -127,6 +127,7 @@ export { RocketIcon } from "./rocket"
 export { SafariIcon } from "./safari"
 export { ServerIcon } from "./server"
 export { ShieldIcon } from "./shield"
+export { SlackIcon } from "./slack"
 export { SlidersIcon } from "./sliders"
 export { SquareIcon } from "./square"
 export { SquareTerminalIcon } from "./square-terminal"
diff --git a/apps/web/src/components/icons/slack.tsx b/apps/web/src/components/icons/slack.tsx
new file mode 100644
index 000000000..d4a670fc1
--- /dev/null
+++ b/apps/web/src/components/icons/slack.tsx
@@ -0,0 +1,38 @@
+import type { IconProps } from "./icon"
+
+/**
+ * The Slack mark, rendered in its four brand hues. Uses fixed brand colors
+ * rather than `currentColor` because the logo is unmistakable only in color;
+ * consumers that need a monochrome glyph should tint via `className`/`color`.
+ */
+function SlackIcon({ size = 24, className, ...props }: IconProps) {
+	return (
+		<svg
+			xmlns="http://www.w3.org/2000/svg"
+			viewBox="0 0 24 24"
+			width={size}
+			height={size}
+			className={className}
+			aria-hidden="true"
+			{...props}
+		>
+			<path
+				fill="#36C5F0"
+				d="M9.04 2.5A2.04 2.04 0 0 0 7 4.54a2.04 2.04 0 0 0 2.04 2.04h2.04V4.54A2.04 2.04 0 0 0 9.04 2.5m0 5.44H3.6a2.04 2.04 0 0 0-2.04 2.04a2.04 2.04 0 0 0 2.04 2.04h5.44a2.04 2.04 0 0 0 2.04-2.04a2.04 2.04 0 0 0-2.04-2.04"
+			/>
+			<path
+				fill="#2EB67D"
+				d="M21.5 9.98a2.04 2.04 0 0 0-2.04-2.04a2.04 2.04 0 0 0-2.04 2.04v2.04h2.04a2.04 2.04 0 0 0 2.04-2.04m-5.44 0V4.54A2.04 2.04 0 0 0 14.02 2.5a2.04 2.04 0 0 0-2.04 2.04v5.44a2.04 2.04 0 0 0 2.04 2.04a2.04 2.04 0 0 0 2.04-2.04"
+			/>
+			<path
+				fill="#ECB22E"
+				d="M14.02 21.5a2.04 2.04 0 0 0 2.04-2.04a2.04 2.04 0 0 0-2.04-2.04h-2.04v2.04a2.04 2.04 0 0 0 2.04 2.04m0-5.44h5.44a2.04 2.04 0 0 0 2.04-2.04a2.04 2.04 0 0 0-2.04-2.04h-5.44a2.04 2.04 0 0 0-2.04 2.04a2.04 2.04 0 0 0 2.04 2.04"
+			/>
+			<path
+				fill="#E01E5A"
+				d="M1.56 14.02a2.04 2.04 0 0 0 2.04 2.04a2.04 2.04 0 0 0 2.04-2.04v-2.04H3.6a2.04 2.04 0 0 0-2.04 2.04m5.44 0v5.44a2.04 2.04 0 0 0 2.04 2.04a2.04 2.04 0 0 0 2.04-2.04v-5.44a2.04 2.04 0 0 0-2.04-2.04a2.04 2.04 0 0 0-2.04 2.04"
+			/>
+		</svg>
+	)
+}
+export { SlackIcon }
diff --git a/apps/web/src/components/integrations/integration-catalog.tsx b/apps/web/src/components/integrations/integration-catalog.tsx
index abe7ac348..78551d0f2 100644
--- a/apps/web/src/components/integrations/integration-catalog.tsx
+++ b/apps/web/src/components/integrations/integration-catalog.tsx
@@ -9,13 +9,22 @@ import {
 	HazelIcon,
 	PlanetScaleIcon,
 	PrometheusIcon,
+	SlackIcon,
 	WarpStreamIcon,
 } from "@/components/icons"
 import { Result, useAtomValue } from "@/lib/effect-atom"
 import { MapleApiAtomClient } from "@/lib/services/common/atom-client"
+import { MapleApiV2AtomClient } from "@/lib/services/common/v2-atom-client"
 import { scrapeTargetsListAtom } from "@/lib/services/atoms/scrape-target-atoms"
 
-export type IntegrationId = "cloudflare" | "prometheus" | "planetscale" | "warpstream" | "hazel" | "github"
+export type IntegrationId =
+	| "cloudflare"
+	| "prometheus"
+	| "planetscale"
+	| "warpstream"
+	| "hazel"
+	| "github"
+	| "slack"
 
 /**
  * Third-party brand accents for the icon-plate wash — no app token applies.
@@ -24,6 +33,7 @@ export type IntegrationId = "cloudflare" | "prometheus" | "planetscale" | "warps
 export const GITHUB_ACCENT = "#181717"
 export const HAZEL_ACCENT = "#F46F0F"
 export const CLOUDFLARE_ACCENT = "#F38020"
+export const SLACK_ACCENT = "#4A154B"
 
 export interface CatalogEntry {
 	readonly id: IntegrationId
@@ -95,6 +105,15 @@ const CATALOG: ReadonlyArray<CatalogEntry> = [
 		iconClassName: "text-foreground",
 		docsUrl: "https://maple.dev/docs/integrations/github",
 	},
+	{
+		id: "slack",
+		name: "Slack",
+		description:
+			"Install the Maple Slack app — ask Maple questions in Slack and route alerts to channels.",
+		icon: SlackIcon,
+		accent: SLACK_ACCENT,
+		docsUrl: "https://maple.dev/docs/integrations/slack",
+	},
 ]
 
 export const catalogEntry = (id: IntegrationId): CatalogEntry => CATALOG.find((entry) => entry.id === id)!
@@ -135,6 +154,11 @@ export function useIntegrationStatuses(): Partial<Record<IntegrationId, CardStat
 			reactivityKeys: ["githubIntegrationStatus"],
 		}),
 	)
+	const slackResult = useAtomValue(
+		MapleApiV2AtomClient.query("slackIntegration", "status", {
+			reactivityKeys: ["slackIntegration"],
+		}),
+	)
 
 	const cloudflare: CardStatus | null = Result.builder(cloudflareAccountResult)
 		.onSuccess(
@@ -200,6 +224,16 @@ export function useIntegrationStatuses(): Partial<Record<IntegrationId, CardStat
 		.onInitial(() => null)
 		.orElse(() => STATUS_UNAVAILABLE)
 
+	const slack: CardStatus | null = Result.builder(slackResult)
+		.onSuccess(
+			(status): CardStatus =>
+				status.installed
+					? { label: status.team_name ?? "Connected", variant: "success" }
+					: NOT_CONNECTED,
+		)
+		.onInitial(() => null)
+		.orElse(() => STATUS_UNAVAILABLE)
+
 	return {
 		cloudflare,
 		prometheus: scrapeStatus("prometheus"),
@@ -208,6 +242,7 @@ export function useIntegrationStatuses(): Partial<Record<IntegrationId, CardStat
 		warpstream: { label: "Via Prometheus", variant: "outline" },
 		hazel,
 		github,
+		slack,
 	}
 }
 
diff --git a/apps/web/src/components/integrations/slack-integration-card.tsx b/apps/web/src/components/integrations/slack-integration-card.tsx
new file mode 100644
index 000000000..70726778b
--- /dev/null
+++ b/apps/web/src/components/integrations/slack-integration-card.tsx
@@ -0,0 +1,228 @@
+import { useState } from "react"
+import { Exit, Option } from "effect"
+
+import {
+	AlertDialog,
+	AlertDialogAction,
+	AlertDialogCancel,
+	AlertDialogContent,
+	AlertDialogDescription,
+	AlertDialogFooter,
+	AlertDialogHeader,
+	AlertDialogTitle,
+} from "@maple/ui/components/ui/alert-dialog"
+import { Badge } from "@maple/ui/components/ui/badge"
+import { Button } from "@maple/ui/components/ui/button"
+import { Skeleton } from "@maple/ui/components/ui/skeleton"
+import { toast } from "sonner"
+
+import { ErrorState } from "@/components/common/error-state"
+import {
+	BellIcon,
+	ChatBubbleSparkleIcon,
+	ConnectionIcon,
+	LoaderIcon,
+	SlackIcon,
+} from "@/components/icons"
+import { Result, useAtomRefresh, useAtomSet, useAtomValue } from "@/lib/effect-atom"
+import { MapleApiAtomClient } from "@/lib/services/common/atom-client"
+import { MapleApiV2AtomClient } from "@/lib/services/common/v2-atom-client"
+import { formatAlertDateTime, getExitErrorMessage } from "@/lib/alerts/form-utils"
+import { IntegrationIconPlate, SLACK_ACCENT } from "./integration-catalog"
+import { IntegrationEmptyState } from "./integration-empty-state"
+
+/**
+ * First-class Slack connection card: install the Maple Slack app via OAuth (a
+ * full-page redirect to Slack's consent screen; on approval Slack redirects back
+ * to `/integrations?slack=connected`). Once installed, the bot answers Maple
+ * questions in Slack and alert rules can post to channels via a `slack-bot`
+ * destination. Install/uninstall are org-admin only — the backend also enforces
+ * this, so a non-admin only ever sees a disabled affordance.
+ */
+export function SlackIntegrationCard() {
+	const statusAtom = MapleApiV2AtomClient.query("slackIntegration", "status", {
+		reactivityKeys: ["slackIntegration"],
+	})
+	const statusResult = useAtomValue(statusAtom)
+	const refreshStatus = useAtomRefresh(statusAtom)
+
+	const sessionResult = useAtomValue(MapleApiAtomClient.query("auth", "session", {}))
+	const isAdmin = Result.builder(sessionResult)
+		.onSuccess((session) => session.roles.some((role) => role === "root" || role === "org:admin"))
+		.orElse(() => false)
+
+	const install = useAtomSet(MapleApiV2AtomClient.mutation("slackIntegration", "install"), {
+		mode: "promiseExit",
+	})
+	const uninstall = useAtomSet(MapleApiV2AtomClient.mutation("slackIntegration", "uninstall"), {
+		mode: "promiseExit",
+	})
+
+	const [busy, setBusy] = useState<"install" | "uninstall" | null>(null)
+	const [confirmOpen, setConfirmOpen] = useState(false)
+
+	const status = Result.builder(statusResult)
+		.onSuccess((s) => s)
+		.orElse(() =>
+			Result.isFailure(statusResult)
+				? Option.getOrNull(Option.map(statusResult.previousSuccess, (previous) => previous.value))
+				: null,
+		)
+	const isLoading = Result.isInitial(statusResult) && status === null
+	const loadFailed = Result.isFailure(statusResult) && status === null
+
+	async function handleInstall() {
+		setBusy("install")
+		const result = await install({ reactivityKeys: ["slackIntegration"] })
+		if (Exit.isSuccess(result)) {
+			// Full-page redirect to Slack's consent screen; the callback returns the
+			// browser to /integrations?slack=connected.
+			window.location.href = result.value.url
+			return
+		}
+		setBusy(null)
+		toast.error(getExitErrorMessage(result, "Failed to start the Slack install"))
+	}
+
+	async function handleUninstall() {
+		setBusy("uninstall")
+		const result = await uninstall({ reactivityKeys: ["slackIntegration"] })
+		setBusy(null)
+		setConfirmOpen(false)
+		if (Exit.isSuccess(result)) {
+			toast.success("Slack disconnected")
+		} else {
+			toast.error(getExitErrorMessage(result, "Failed to disconnect Slack"))
+		}
+	}
+
+	if (isLoading) {
+		return <Skeleton className="h-32 w-full rounded-lg" />
+	}
+	if (loadFailed) {
+		return (
+			<ErrorState
+				error={statusResult.cause}
+				title="Failed to load the Slack integration"
+				onRetry={refreshStatus}
+			/>
+		)
+	}
+
+	const isInstalled = status?.installed === true
+
+	if (!isInstalled) {
+		return (
+			<IntegrationEmptyState
+				icon={SlackIcon}
+				accent={SLACK_ACCENT}
+				title="Add Maple to Slack"
+				description="Install the Maple Slack app so your team can ask Maple about their services, traces, and errors right in Slack — and route fired alerts into channels."
+				features={[
+					{
+						icon: ChatBubbleSparkleIcon,
+						title: "Ask Maple",
+						description: "Mention the bot to query services, traces, and errors from Slack.",
+					},
+					{
+						icon: BellIcon,
+						title: "Alert delivery",
+						description: "Route alert rules to any channel the bot can post to.",
+					},
+					{
+						icon: ConnectionIcon,
+						title: "Channel routing",
+						description: "Each alert destination picks the channel that gets notified.",
+					},
+				]}
+				footer={
+					isAdmin
+						? "You'll approve the install in your Slack workspace."
+						: "Only organization admins can install the Slack app."
+				}
+			>
+				<Button onClick={handleInstall} disabled={!isAdmin || busy !== null}>
+					{busy === "install" ? (
+						<LoaderIcon size={16} className="animate-spin" />
+					) : (
+						<SlackIcon size={16} />
+					)}
+					Add to Slack
+				</Button>
+			</IntegrationEmptyState>
+		)
+	}
+
+	return (
+		<>
+			<div className="flex items-start gap-4 rounded-lg border border-border/60 bg-card p-4">
+				<IntegrationIconPlate icon={SlackIcon} accent={SLACK_ACCENT} />
+
+				<div className="flex flex-1 flex-col gap-2">
+					<div>
+						<div className="flex items-center gap-2">
+							<h3 className="text-sm font-semibold">Slack</h3>
+							<Badge variant="success">Connected</Badge>
+						</div>
+						<p className="mt-1 text-xs text-muted-foreground">
+							The Maple bot answers questions in Slack and delivers alerts to channels. Create a
+							Slack (bot) destination on an alert rule to route notifications.
+						</p>
+					</div>
+
+					<div className="flex flex-col gap-1 rounded-md bg-muted/40 px-3 py-2 text-[11px] text-muted-foreground">
+						{status?.team_name ? (
+							<div>
+								Workspace: <span className="text-foreground">{status.team_name}</span>
+							</div>
+						) : null}
+						{status?.installed_at ? (
+							<div>Installed {formatAlertDateTime(status.installed_at)}</div>
+						) : null}
+					</div>
+
+					<div className="flex flex-wrap gap-2">
+						<Button
+							size="sm"
+							onClick={() => setConfirmOpen(true)}
+							disabled={!isAdmin || busy !== null}
+							variant="outline"
+						>
+							{busy === "uninstall" ? <LoaderIcon size={14} className="animate-spin" /> : null}
+							Disconnect
+						</Button>
+					</div>
+					{!isAdmin ? (
+						<p className="text-[11px] text-muted-foreground">
+							Only organization admins can disconnect the Slack app.
+						</p>
+					) : null}
+				</div>
+			</div>
+
+			<AlertDialog open={confirmOpen} onOpenChange={setConfirmOpen}>
+				<AlertDialogContent>
+					<AlertDialogHeader>
+						<AlertDialogTitle>Disconnect Slack</AlertDialogTitle>
+						<AlertDialogDescription>
+							This uninstalls the Maple Slack app and revokes the API key minted for the bot. Alert
+							rules using Slack (bot) destinations will stop delivering to Slack. You can reinstall
+							at any time.
+						</AlertDialogDescription>
+					</AlertDialogHeader>
+					<AlertDialogFooter>
+						<AlertDialogCancel>Cancel</AlertDialogCancel>
+						<AlertDialogAction
+							onClick={handleUninstall}
+							disabled={busy !== null}
+							className="bg-destructive text-destructive-foreground hover:bg-destructive/90"
+						>
+							{busy === "uninstall" ? <LoaderIcon size={14} className="animate-spin" /> : null}
+							Disconnect
+						</AlertDialogAction>
+					</AlertDialogFooter>
+				</AlertDialogContent>
+			</AlertDialog>
+		</>
+	)
+}
diff --git a/apps/web/src/lib/alerts/form-utils.test.ts b/apps/web/src/lib/alerts/form-utils.test.ts
index 908f0c09d..216e0155f 100644
--- a/apps/web/src/lib/alerts/form-utils.test.ts
+++ b/apps/web/src/lib/alerts/form-utils.test.ts
@@ -1,6 +1,9 @@
 import { describe, expect, it } from "vitest"
 import {
+	buildDestinationCreateParamsV2,
+	buildDestinationUpdateParamsV2,
 	buildRuleCreateParamsV2,
+	defaultDestinationForm,
 	defaultRuleForm,
 	deriveRuleQueryIssues,
 	domainThresholdToForm,
@@ -96,6 +99,46 @@ describe("buildRuleCreateParamsV2", () => {
 	})
 })
 
+describe("slack-bot destination params", () => {
+	it("builds create params with channel id and trimmed name/channel name", () => {
+		const params = buildDestinationCreateParamsV2({
+			...defaultDestinationForm("slack-bot"),
+			name: "  Prod incidents  ",
+			slackChannelId: "C0789CHAN",
+			slackChannelName: "  incidents  ",
+		})
+		expect(params).toEqual({
+			type: "slack-bot",
+			name: "Prod incidents",
+			enabled: true,
+			channel_id: "C0789CHAN",
+			channel_name: "incidents",
+		})
+	})
+
+	it("omits channel_name when blank on create", () => {
+		const params = buildDestinationCreateParamsV2({
+			...defaultDestinationForm("slack-bot"),
+			name: "Prod",
+			slackChannelId: "C0789CHAN",
+			slackChannelName: "   ",
+		})
+		expect(params).not.toHaveProperty("channel_name")
+		expect(params).toMatchObject({ type: "slack-bot", channel_id: "C0789CHAN" })
+	})
+
+	it("drops omitted fields on update so a blank channel keeps the stored one", () => {
+		const params = buildDestinationUpdateParamsV2({
+			...defaultDestinationForm("slack-bot"),
+			name: "",
+			slackChannelId: "",
+			slackChannelName: "",
+			enabled: false,
+		})
+		expect(params).toEqual({ type: "slack-bot", enabled: false })
+	})
+})
+
 describe("raw SQL alert query validation", () => {
 	it("recognizes explicit value aliases and value columns", () => {
 		expect(rawSqlHasValueColumn("SELECT count() AS value FROM traces WHERE $__orgFilter")).toBe(true)
diff --git a/apps/web/src/lib/alerts/form-utils.ts b/apps/web/src/lib/alerts/form-utils.ts
index a1e661c89..a64114605 100644
--- a/apps/web/src/lib/alerts/form-utils.ts
+++ b/apps/web/src/lib/alerts/form-utils.ts
@@ -468,6 +468,14 @@ export type DestinationFormState = {
 	channelLabel: string
 	/** Slack and Discord both use this incoming-webhook URL field. */
 	webhookUrl: string
+	/**
+	 * Slack (bot) destination: the channel the installed Maple bot posts to.
+	 * `slackChannelId` is the Slack channel id (`C0789CHAN`), `slackChannelName`
+	 * its display name (`incidents`). No webhook/secret — the bot token is
+	 * resolved from the org's Slack workspace at dispatch.
+	 */
+	slackChannelId: string
+	slackChannelName: string
 	integrationKey: string
 	url: string
 	signingSecret: string
@@ -490,6 +498,8 @@ export function defaultDestinationForm(type: AlertDestinationType = "slack"): De
 		enabled: true,
 		channelLabel: "",
 		webhookUrl: "",
+		slackChannelId: "",
+		slackChannelName: "",
 		integrationKey: "",
 		url: "",
 		signingSecret: "",
@@ -510,6 +520,11 @@ export function destinationToFormState(destination: AlertDestinationDocument): D
 		enabled: destination.enabled,
 		channelLabel: destination.channelLabel ?? "",
 		webhookUrl: "",
+		// slack-bot hydrates `channelLabel` as `#name`; keep the current channel
+		// visible on edit (its id isn't returned — an empty id keeps the stored one).
+		slackChannelId: "",
+		slackChannelName:
+			destination.type === "slack-bot" ? (destination.channelLabel?.replace(/^#/, "") ?? "") : "",
 		integrationKey: "",
 		url: "",
 		signingSecret: "",
@@ -535,6 +550,16 @@ export function buildDestinationCreateParamsV2(form: DestinationFormState): V2Al
 				...(channelLabel ? { channel_label: channelLabel } : {}),
 			}
 		}
+		case "slack-bot": {
+			const channelName = form.slackChannelName.trim()
+			return {
+				type: "slack-bot",
+				name: form.name.trim(),
+				enabled: form.enabled,
+				channel_id: form.slackChannelId.trim(),
+				...(channelName ? { channel_name: channelName } : {}),
+			}
+		}
 		case "pagerduty":
 			return {
 				type: "pagerduty",
@@ -612,6 +637,17 @@ export function buildDestinationUpdateParamsV2(form: DestinationFormState): V2Al
 				...(webhookUrl ? { webhook_url: webhookUrl } : {}),
 			}
 		}
+		case "slack-bot": {
+			const channelId = form.slackChannelId.trim()
+			const channelName = form.slackChannelName.trim()
+			return {
+				type: "slack-bot",
+				enabled: form.enabled,
+				...(name ? { name } : {}),
+				...(channelId ? { channel_id: channelId } : {}),
+				...(channelName ? { channel_name: channelName } : {}),
+			}
+		}
 		case "pagerduty": {
 			const integrationKey = form.integrationKey.trim()
 			return {
diff --git a/apps/web/src/routes/integrations.tsx b/apps/web/src/routes/integrations.tsx
index 05dcadaab..386ef91ac 100644
--- a/apps/web/src/routes/integrations.tsx
+++ b/apps/web/src/routes/integrations.tsx
@@ -1,11 +1,14 @@
+import { useEffect } from "react"
 import { useNavigate, createFileRoute } from "@tanstack/react-router"
 import { Schema } from "effect"
+import { toast } from "sonner"
 
 import { DashboardLayout } from "@/components/layout/dashboard-layout"
 import { CloudflareAccountCard } from "@/components/integrations/cloudflare-account-card"
 import { GithubIntegrationCard } from "@/components/integrations/github-integration-card"
 import { HazelIntegrationCard } from "@/components/integrations/hazel-integration-card"
 import { PlanetScaleIntegrationCard } from "@/components/integrations/planetscale-integration-card"
+import { SlackIntegrationCard } from "@/components/integrations/slack-integration-card"
 import {
 	IntegrationCatalog,
 	IntegrationIconPlate,
@@ -22,8 +25,20 @@ import { ArrowLeftIcon, CircleInfoIcon, ExternalLinkIcon } from "@/components/ic
 
 const IntegrationsSearch = Schema.Struct({
 	integration: Schema.optional(
-		Schema.Literals(["cloudflare", "prometheus", "planetscale", "warpstream", "hazel", "github"]),
+		Schema.Literals([
+			"cloudflare",
+			"prometheus",
+			"planetscale",
+			"warpstream",
+			"hazel",
+			"github",
+			"slack",
+		]),
 	),
+	// Post-OAuth return params set by the Slack install callback redirect.
+	slack: Schema.optional(Schema.Literals(["connected", "error"])),
+	message: Schema.optional(Schema.String),
+	team: Schema.optional(Schema.String),
 })
 
 export const Route = createFileRoute("/integrations")({
@@ -37,6 +52,21 @@ function IntegrationsPage() {
 	const { visibleSections } = useVisibleSettingsSections()
 	const integration = search.integration
 
+	// Surface the Slack OAuth callback result once, then strip the return params
+	// from the URL so a refresh doesn't re-toast.
+	const slackReturn = search.slack
+	const slackMessage = search.message
+	const slackTeam = search.team
+	useEffect(() => {
+		if (!slackReturn) return
+		if (slackReturn === "connected") {
+			toast.success(slackTeam ? `Slack connected to ${slackTeam}` : "Slack connected")
+		} else {
+			toast.error(slackMessage ?? "Slack connection failed")
+		}
+		navigate({ search: { integration: "slack" }, replace: true })
+	}, [slackReturn, slackMessage, slackTeam, navigate])
+
 	// The hub shares the settings shell: same sidebar, "Integrations" highlighted.
 	const settingsSidebar = (
 		<SettingsNav
@@ -98,6 +128,8 @@ function IntegrationsPage() {
 					<GithubIntegrationCard />
 				) : integration === "planetscale" ? (
 					<PlanetScaleIntegrationCard />
+				) : integration === "slack" ? (
+					<SlackIntegrationCard />
 				) : (
 					// prometheus + warpstream share the generic scrape-target flow
 					<ScrapeTargetsSection sourceFilter="prometheus" />
diff --git a/package.json b/package.json
index fbeeb5e23..ee6379f42 100644
--- a/package.json
+++ b/package.json
@@ -1,103 +1,104 @@
 {
-	"name": "maple",
-	"private": true,
-	"workspaces": [
-		"apps/*",
-		"!apps/slack-agent",
-		"packages/*",
-		"lib/*",
-		"examples/*"
-	],
-	"scripts": {
-		"build": "turbo build",
-		"dev": "turbo dev",
-		"docker:build": "COMPOSE_PARALLEL_LIMIT=1 docker compose build",
-		"docker:up": "COMPOSE_PARALLEL_LIMIT=1 docker compose up --build",
-		"db:up": "docker compose up -d postgres electric",
-		"db:migrate:local": "DATABASE_URL=postgres://maple:maple@localhost:5499/maple bun run --cwd packages/db db:migrate",
-		"migrate:prod": "bun run --cwd packages/db ps:apply-schema main",
-		"dev:alerting": "bun --filter=@maple/alerting dev",
-		"format": "oxfmt && oxlint --ignore-pattern '.context/**' --fix",
-		"alchemy:build-deps": "turbo build --filter=@maple-dev/effect-sdk --filter=@maple-dev/browser --filter=@maple-dev/clickhouse-builder",
-		"alchemy:deploy": "bun run alchemy:build-deps && alchemy deploy --yes",
-		"alchemy:deploy:prd": "bun run alchemy:build-deps && alchemy deploy --yes --adopt --stage prd",
-		"alchemy:deploy:stg": "bun run alchemy:build-deps && alchemy deploy --yes --adopt --stage stg",
-		"alchemy:deploy:pr": "bun run alchemy:build-deps && alchemy deploy --yes --adopt --stage pr-${PR_NUMBER}",
-		"alchemy:destroy": "alchemy destroy --yes",
-		"alchemy:destroy:stg": "alchemy destroy --yes --stage stg",
-		"alchemy:destroy:pr": "alchemy destroy --yes --stage pr-${PR_NUMBER}",
-		"test": "turbo test",
-		"tinybird:manifest": "bun run ./scripts/generate-tinybird-project-manifest.ts",
-		"tinybird:manifest:check": "bun run ./scripts/generate-tinybird-project-manifest.ts --check",
-		"clickhouse:schema": "bun run ./scripts/generate-clickhouse-schema.ts && bun run ./scripts/generate-clickhouse-schema-sql.ts && bun run ./scripts/generate-clickhouse-insert-mappings.ts && bun run ./scripts/lint-clickhouse-schema.ts",
-		"clickhouse:schema:check": "bun run ./scripts/generate-clickhouse-schema.ts --check && bun run ./scripts/generate-clickhouse-schema-sql.ts --check && bun run ./scripts/generate-clickhouse-insert-mappings.ts --check && bun run ./scripts/lint-clickhouse-schema.ts",
-		"clickhouse:schema:lint": "bun run ./scripts/lint-clickhouse-schema.ts",
-		"check:tokens": "bun run ./scripts/check-token-drift.ts",
-		"knip": "knip",
-		"knip:fix": "knip --fix --allow-remove-files",
-		"typecheck": "turbo typecheck && tsc -p tsconfig.alchemy.json"
-	},
-	"dependencies": {},
-	"devDependencies": {
-		"@cloudflare/workers-types": "4.20260603.1",
-		"@effect/platform-node": "4.0.0-beta.93",
-		"@effect/vitest": "4.0.0-beta.93",
-		"@maple/infra": "workspace:*",
-		"@tinybirdco/sdk": "catalog:tinybird",
-		"@types/node": "catalog:tooling",
-		"alchemy": "2.0.0-beta.61",
-		"effect": "catalog:effect",
-		"knip": "^6.17.1",
-		"oxfmt": "^0.55.0",
-		"oxlint": "^1.70.0",
-		"portless": "^0.14.0",
-		"turbo": "^2.9.18",
-		"typescript": "catalog:tooling"
-	},
-	"packageManager": "bun@1.3.11",
-	"catalog": {
-		"vite": "^8.0.16",
-		"vitest": "^4.1.9"
-	},
-	"catalogs": {
-		"clickhouse": {
-			"@clickhouse/client-web": "^1.21.0"
-		},
-		"effect": {
-			"@effect/atom-react": "4.0.0-beta.93",
-			"@effect/language-service": "^0.86.2",
-			"@effect/platform-bun": "4.0.0-beta.93",
-			"effect": "4.0.0-beta.93"
-		},
-		"react": {
-			"@types/react": "^19.2.14",
-			"@types/react-dom": "^19.2.3",
-			"react": "^19.2.4",
-			"react-dom": "^19.2.4"
-		},
-		"tailwind": {
-			"@tailwindcss/vite": "^4.3.1",
-			"tailwind-merge": "^3.6.0",
-			"tailwindcss": "^4.3.1",
-			"tw-animate-css": "^1.4.0"
-		},
-		"tinybird": {
-			"@tinybirdco/sdk": "0.0.78"
-		},
-		"tooling": {
-			"@types/node": "^22.10.2",
-			"typescript": "^6.0.2"
-		},
-		"ui": {
-			"@base-ui/react": "^1.6.0",
-			"@xyflow/react": "^12.11.0",
-			"class-variance-authority": "^0.7.1",
-			"clsx": "^2.1.1",
-			"recharts": "^3.9.0"
-		}
-	},
-	"patchedDependencies": {
-		"effect@4.0.0-beta.93": "patches/effect@4.0.0-beta.93.patch",
-		"@distilled.cloud/cloudflare@0.28.2": "patches/@distilled.cloud%2Fcloudflare@0.28.2.patch"
-	}
+  "name": "maple",
+  "private": true,
+  "workspaces": [
+    "apps/*",
+    "!apps/slack-agent",
+    "packages/*",
+    "lib/*",
+    "examples/*"
+  ],
+  "scripts": {
+    "build": "turbo build",
+    "dev": "turbo dev",
+    "dev:essentials": "turbo dev --filter=@maple/api --filter=@maple/ingest --filter=@maple/web --filter=@maple/scraper --filter=@maple/electric-sync",
+    "docker:build": "COMPOSE_PARALLEL_LIMIT=1 docker compose build",
+    "docker:up": "COMPOSE_PARALLEL_LIMIT=1 docker compose up --build",
+    "db:up": "docker compose up -d postgres electric",
+    "db:migrate:local": "DATABASE_URL=postgres://maple:maple@localhost:5499/maple bun run --cwd packages/db db:migrate",
+    "migrate:prod": "bun run --cwd packages/db ps:apply-schema main",
+    "dev:alerting": "bun --filter=@maple/alerting dev",
+    "format": "oxfmt && oxlint --ignore-pattern '.context/**' --fix",
+    "alchemy:build-deps": "turbo build --filter=@maple-dev/effect-sdk --filter=@maple-dev/browser --filter=@maple-dev/clickhouse-builder",
+    "alchemy:deploy": "bun run alchemy:build-deps && alchemy deploy --yes",
+    "alchemy:deploy:prd": "bun run alchemy:build-deps && alchemy deploy --yes --adopt --stage prd",
+    "alchemy:deploy:stg": "bun run alchemy:build-deps && alchemy deploy --yes --adopt --stage stg",
+    "alchemy:deploy:pr": "bun run alchemy:build-deps && alchemy deploy --yes --adopt --stage pr-${PR_NUMBER}",
+    "alchemy:destroy": "alchemy destroy --yes",
+    "alchemy:destroy:stg": "alchemy destroy --yes --stage stg",
+    "alchemy:destroy:pr": "alchemy destroy --yes --stage pr-${PR_NUMBER}",
+    "test": "turbo test",
+    "tinybird:manifest": "bun run ./scripts/generate-tinybird-project-manifest.ts",
+    "tinybird:manifest:check": "bun run ./scripts/generate-tinybird-project-manifest.ts --check",
+    "clickhouse:schema": "bun run ./scripts/generate-clickhouse-schema.ts && bun run ./scripts/generate-clickhouse-schema-sql.ts && bun run ./scripts/generate-clickhouse-insert-mappings.ts && bun run ./scripts/lint-clickhouse-schema.ts",
+    "clickhouse:schema:check": "bun run ./scripts/generate-clickhouse-schema.ts --check && bun run ./scripts/generate-clickhouse-schema-sql.ts --check && bun run ./scripts/generate-clickhouse-insert-mappings.ts --check && bun run ./scripts/lint-clickhouse-schema.ts",
+    "clickhouse:schema:lint": "bun run ./scripts/lint-clickhouse-schema.ts",
+    "check:tokens": "bun run ./scripts/check-token-drift.ts",
+    "knip": "knip",
+    "knip:fix": "knip --fix --allow-remove-files",
+    "typecheck": "turbo typecheck && tsc -p tsconfig.alchemy.json"
+  },
+  "dependencies": {},
+  "devDependencies": {
+    "@cloudflare/workers-types": "4.20260603.1",
+    "@effect/platform-node": "4.0.0-beta.93",
+    "@effect/vitest": "4.0.0-beta.93",
+    "@maple/infra": "workspace:*",
+    "@tinybirdco/sdk": "catalog:tinybird",
+    "@types/node": "catalog:tooling",
+    "alchemy": "2.0.0-beta.61",
+    "effect": "catalog:effect",
+    "knip": "^6.17.1",
+    "oxfmt": "^0.55.0",
+    "oxlint": "^1.70.0",
+    "portless": "^0.14.0",
+    "turbo": "^2.9.18",
+    "typescript": "catalog:tooling"
+  },
+  "packageManager": "bun@1.3.11",
+  "catalog": {
+    "vite": "^8.0.16",
+    "vitest": "^4.1.9"
+  },
+  "catalogs": {
+    "clickhouse": {
+      "@clickhouse/client-web": "^1.21.0"
+    },
+    "effect": {
+      "@effect/atom-react": "4.0.0-beta.93",
+      "@effect/language-service": "^0.86.2",
+      "@effect/platform-bun": "4.0.0-beta.93",
+      "effect": "4.0.0-beta.93"
+    },
+    "react": {
+      "@types/react": "^19.2.14",
+      "@types/react-dom": "^19.2.3",
+      "react": "^19.2.4",
+      "react-dom": "^19.2.4"
+    },
+    "tailwind": {
+      "@tailwindcss/vite": "^4.3.1",
+      "tailwind-merge": "^3.6.0",
+      "tailwindcss": "^4.3.1",
+      "tw-animate-css": "^1.4.0"
+    },
+    "tinybird": {
+      "@tinybirdco/sdk": "0.0.78"
+    },
+    "tooling": {
+      "@types/node": "^22.10.2",
+      "typescript": "^6.0.2"
+    },
+    "ui": {
+      "@base-ui/react": "^1.6.0",
+      "@xyflow/react": "^12.11.0",
+      "class-variance-authority": "^0.7.1",
+      "clsx": "^2.1.1",
+      "recharts": "^3.9.0"
+    }
+  },
+  "patchedDependencies": {
+    "effect@4.0.0-beta.93": "patches/effect@4.0.0-beta.93.patch",
+    "@distilled.cloud/cloudflare@0.28.2": "patches/@distilled.cloud%2Fcloudflare@0.28.2.patch"
+  }
 }
diff --git a/packages/db/drizzle/0017_fair_mandarin.sql b/packages/db/drizzle/0017_fair_mandarin.sql
new file mode 100644
index 000000000..9ce7bf2a7
--- /dev/null
+++ b/packages/db/drizzle/0017_fair_mandarin.sql
@@ -0,0 +1,23 @@
+CREATE TABLE "slack_workspaces" (
+	"id" text PRIMARY KEY NOT NULL,
+	"org_id" text NOT NULL,
+	"team_id" text NOT NULL,
+	"team_name" text,
+	"bot_user_id" text,
+	"scope" text,
+	"bot_token_ciphertext" text NOT NULL,
+	"bot_token_iv" text NOT NULL,
+	"bot_token_tag" text NOT NULL,
+	"api_key_id" text,
+	"api_key_secret_ciphertext" text NOT NULL,
+	"api_key_secret_iv" text NOT NULL,
+	"api_key_secret_tag" text NOT NULL,
+	"installed_by_user_id" text,
+	"created_at" timestamp with time zone NOT NULL,
+	"updated_at" timestamp with time zone NOT NULL,
+	"revoked_at" timestamp with time zone
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX "slack_workspaces_team_id_idx" ON "slack_workspaces" USING btree ("team_id");--> statement-breakpoint
+CREATE INDEX "slack_workspaces_org_idx" ON "slack_workspaces" USING btree ("org_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "slack_workspaces_active_org_idx" ON "slack_workspaces" USING btree ("org_id") WHERE "slack_workspaces"."revoked_at" IS NULL;
\ No newline at end of file
diff --git a/packages/db/drizzle/meta/0017_snapshot.json b/packages/db/drizzle/meta/0017_snapshot.json
new file mode 100644
index 000000000..b7fe2489b
--- /dev/null
+++ b/packages/db/drizzle/meta/0017_snapshot.json
@@ -0,0 +1,6462 @@
+{
+  "id": "d2eb3c19-f3da-4699-909a-c7b03ed2e6bd",
+  "prevId": "641d5c00-6783-4702-8a85-761b0a28db3f",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.ai_triage_runs": {
+      "name": "ai_triage_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "incident_kind": {
+          "name": "incident_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "incident_id": {
+          "name": "incident_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'queued'"
+        },
+        "context_json": {
+          "name": "context_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "result_json": {
+          "name": "result_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "model": {
+          "name": "model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "input_tokens": {
+          "name": "input_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "output_tokens": {
+          "name": "output_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "ai_triage_runs_incident_idx": {
+          "name": "ai_triage_runs_incident_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "incident_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "incident_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "ai_triage_runs_org_issue_idx": {
+          "name": "ai_triage_runs_org_issue_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "ai_triage_runs_org_created_idx": {
+          "name": "ai_triage_runs_org_created_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.ai_triage_settings": {
+      "name": "ai_triage_settings",
+      "schema": "",
+      "columns": {
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "max_runs_per_day": {
+          "name": "max_runs_per_day",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 20
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_by": {
+          "name": "updated_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.alert_delivery_events": {
+      "name": "alert_delivery_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "incident_id": {
+          "name": "incident_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rule_id": {
+          "name": "rule_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "destination_id": {
+          "name": "destination_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "delivery_key": {
+          "name": "delivery_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "event_type": {
+          "name": "event_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "attempt_number": {
+          "name": "attempt_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scheduled_at": {
+          "name": "scheduled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "claimed_at": {
+          "name": "claimed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claim_expires_at": {
+          "name": "claim_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claimed_by": {
+          "name": "claimed_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "attempted_at": {
+          "name": "attempted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_message": {
+          "name": "provider_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_reference": {
+          "name": "provider_reference",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "response_code": {
+          "name": "response_code",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload_json": {
+          "name": "payload_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "alert_delivery_events_org_idx": {
+          "name": "alert_delivery_events_org_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "alert_delivery_events_org_incident_idx": {
+          "name": "alert_delivery_events_org_incident_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "incident_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "alert_delivery_events_due_idx": {
+          "name": "alert_delivery_events_due_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scheduled_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "alert_delivery_events_claim_idx": {
+          "name": "alert_delivery_events_claim_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "claim_expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scheduled_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "alert_delivery_events_delivery_attempt_idx": {
+          "name": "alert_delivery_events_delivery_attempt_idx",
+          "columns": [
+            {
+              "expression": "delivery_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "attempt_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.alert_destinations": {
+      "name": "alert_destinations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "config_json": {
+          "name": "config_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "secret_ciphertext": {
+          "name": "secret_ciphertext",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "secret_iv": {
+          "name": "secret_iv",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "secret_tag": {
+          "name": "secret_tag",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_tested_at": {
+          "name": "last_tested_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_test_error": {
+          "name": "last_test_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_by": {
+          "name": "updated_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "alert_destinations_org_idx": {
+          "name": "alert_destinations_org_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "alert_destinations_org_enabled_idx": {
+          "name": "alert_destinations_org_enabled_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "enabled",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "alert_destinations_org_name_idx": {
+          "name": "alert_destinations_org_name_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.alert_incidents": {
+      "name": "alert_incidents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "rule_id": {
+          "name": "rule_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "incident_key": {
+          "name": "incident_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "rule_name": {
+          "name": "rule_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "group_key": {
+          "name": "group_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "signal_type": {
+          "name": "signal_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "severity": {
+          "name": "severity",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "comparator": {
+          "name": "comparator",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "threshold": {
+          "name": "threshold",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "threshold_upper": {
+          "name": "threshold_upper",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "first_triggered_at": {
+          "name": "first_triggered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_triggered_at": {
+          "name": "last_triggered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_observed_value": {
+          "name": "last_observed_value",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_sample_count": {
+          "name": "last_sample_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_evaluated_at": {
+          "name": "last_evaluated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "dedupe_key": {
+          "name": "dedupe_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_delivered_event_type": {
+          "name": "last_delivered_event_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_notified_at": {
+          "name": "last_notified_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_issue_id": {
+          "name": "error_issue_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "alert_incidents_org_idx": {
+          "name": "alert_incidents_org_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "alert_incidents_org_status_idx": {
+          "name": "alert_incidents_org_status_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "alert_incidents_org_rule_idx": {
+          "name": "alert_incidents_org_rule_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "rule_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "alert_incidents_org_issue_idx": {
+          "name": "alert_incidents_org_issue_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "error_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "alert_incidents_incident_key_idx": {
+          "name": "alert_incidents_incident_key_idx",
+          "columns": [
+            {
+              "expression": "incident_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.alert_rule_states": {
+      "name": "alert_rule_states",
+      "schema": "",
+      "columns": {
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "rule_id": {
+          "name": "rule_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "group_key": {
+          "name": "group_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'__total__'"
+        },
+        "consecutive_breaches": {
+          "name": "consecutive_breaches",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "consecutive_healthy": {
+          "name": "consecutive_healthy",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_status": {
+          "name": "last_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_value": {
+          "name": "last_value",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_sample_count": {
+          "name": "last_sample_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_evaluated_at": {
+          "name": "last_evaluated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "alert_rule_states_org_idx": {
+          "name": "alert_rule_states_org_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "alert_rule_states_org_id_rule_id_group_key_pk": {
+          "name": "alert_rule_states_org_id_rule_id_group_key_pk",
+          "columns": [
+            "org_id",
+            "rule_id",
+            "group_key"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.alert_rules": {
+      "name": "alert_rules",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "notes": {
+          "name": "notes",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "notification_template_json": {
+          "name": "notification_template_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "severity": {
+          "name": "severity",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "service_names_json": {
+          "name": "service_names_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "exclude_service_names_json": {
+          "name": "exclude_service_names_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tags_json": {
+          "name": "tags_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "signal_type": {
+          "name": "signal_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "comparator": {
+          "name": "comparator",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "threshold": {
+          "name": "threshold",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "threshold_upper": {
+          "name": "threshold_upper",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "window_minutes": {
+          "name": "window_minutes",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "minimum_sample_count": {
+          "name": "minimum_sample_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "consecutive_breaches_required": {
+          "name": "consecutive_breaches_required",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 2
+        },
+        "consecutive_healthy_required": {
+          "name": "consecutive_healthy_required",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 2
+        },
+        "renotify_interval_minutes": {
+          "name": "renotify_interval_minutes",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 30
+        },
+        "metric_name": {
+          "name": "metric_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metric_type": {
+          "name": "metric_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metric_aggregation": {
+          "name": "metric_aggregation",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "apdex_threshold_ms": {
+          "name": "apdex_threshold_ms",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "query_builder_draft_json": {
+          "name": "query_builder_draft_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "raw_query_sql": {
+          "name": "raw_query_sql",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "group_by": {
+          "name": "group_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "destination_ids_json": {
+          "name": "destination_ids_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "query_spec_json": {
+          "name": "query_spec_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reducer": {
+          "name": "reducer",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sample_count_strategy": {
+          "name": "sample_count_strategy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "no_data_behavior": {
+          "name": "no_data_behavior",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_scheduled_at": {
+          "name": "last_scheduled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_by": {
+          "name": "updated_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "alert_rules_org_idx": {
+          "name": "alert_rules_org_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "alert_rules_org_enabled_idx": {
+          "name": "alert_rules_org_enabled_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "enabled",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "alert_rules_org_name_idx": {
+          "name": "alert_rules_org_name_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.anomaly_detector_settings": {
+      "name": "anomaly_detector_settings",
+      "schema": "",
+      "columns": {
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "sensitivity": {
+          "name": "sensitivity",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'normal'"
+        },
+        "muted_signals_json": {
+          "name": "muted_signals_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "last_tick_at": {
+          "name": "last_tick_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_by": {
+          "name": "updated_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.anomaly_detector_states": {
+      "name": "anomaly_detector_states",
+      "schema": "",
+      "columns": {
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "detector_key": {
+          "name": "detector_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "signal_type": {
+          "name": "signal_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "service_name": {
+          "name": "service_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deployment_env": {
+          "name": "deployment_env",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "fingerprint_hash": {
+          "name": "fingerprint_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "consecutive_breaches": {
+          "name": "consecutive_breaches",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "consecutive_healthy": {
+          "name": "consecutive_healthy",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_status": {
+          "name": "last_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_value": {
+          "name": "last_value",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "baseline_median": {
+          "name": "baseline_median",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_sample_count": {
+          "name": "last_sample_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_evaluated_at": {
+          "name": "last_evaluated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "open_incident_id": {
+          "name": "open_incident_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_resolved_at": {
+          "name": "last_resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_incident_id": {
+          "name": "last_incident_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "anomaly_detector_states_org_idx": {
+          "name": "anomaly_detector_states_org_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "anomaly_detector_states_open_incident_idx": {
+          "name": "anomaly_detector_states_open_incident_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "open_incident_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "anomaly_detector_states_evaluated_idx": {
+          "name": "anomaly_detector_states_evaluated_idx",
+          "columns": [
+            {
+              "expression": "last_evaluated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "anomaly_detector_states_org_id_detector_key_pk": {
+          "name": "anomaly_detector_states_org_id_detector_key_pk",
+          "columns": [
+            "org_id",
+            "detector_key"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.anomaly_incidents": {
+      "name": "anomaly_incidents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "detector_key": {
+          "name": "detector_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "signal_type": {
+          "name": "signal_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "service_name": {
+          "name": "service_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deployment_env": {
+          "name": "deployment_env",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "fingerprint_hash": {
+          "name": "fingerprint_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_issue_id": {
+          "name": "error_issue_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "severity": {
+          "name": "severity",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "opened_value": {
+          "name": "opened_value",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "baseline_median": {
+          "name": "baseline_median",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "baseline_sigma": {
+          "name": "baseline_sigma",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "threshold_value": {
+          "name": "threshold_value",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_observed_value": {
+          "name": "last_observed_value",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_sample_count": {
+          "name": "last_sample_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "first_triggered_at": {
+          "name": "first_triggered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_triggered_at": {
+          "name": "last_triggered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolve_reason": {
+          "name": "resolve_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "triage_status": {
+          "name": "triage_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'none'"
+        },
+        "dedupe_key": {
+          "name": "dedupe_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "fingerprints_json": {
+          "name": "fingerprints_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "reopen_count": {
+          "name": "reopen_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_reopened_at": {
+          "name": "last_reopened_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "anomaly_incidents_org_status_idx": {
+          "name": "anomaly_incidents_org_status_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "anomaly_incidents_org_triggered_idx": {
+          "name": "anomaly_incidents_org_triggered_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_triggered_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "anomaly_incidents_org_detector_idx": {
+          "name": "anomaly_incidents_org_detector_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "detector_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "anomaly_incidents_org_issue_idx": {
+          "name": "anomaly_incidents_org_issue_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "error_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.api_keys": {
+      "name": "api_keys",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "key_hash": {
+          "name": "key_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key_prefix": {
+          "name": "key_prefix",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revoked": {
+          "name": "revoked",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata_json": {
+          "name": "metadata_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scopes": {
+          "name": "scopes",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'standard'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_email": {
+          "name": "created_by_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "api_keys_key_hash_unique": {
+          "name": "api_keys_key_hash_unique",
+          "columns": [
+            {
+              "expression": "key_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "api_keys_org_id_idx": {
+          "name": "api_keys_org_id_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.cloudflare_analytics_state": {
+      "name": "cloudflare_analytics_state",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "dataset": {
+          "name": "dataset",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "zone_id": {
+          "name": "zone_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "zone_name": {
+          "name": "zone_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "watermark_at": {
+          "name": "watermark_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "backfill_at": {
+          "name": "backfill_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "settings_json": {
+          "name": "settings_json",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "settings_fetched_at": {
+          "name": "settings_fetched_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "quantiles_available": {
+          "name": "quantiles_available",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "discovered_at": {
+          "name": "discovered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "live_scripts_json": {
+          "name": "live_scripts_json",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_success_at": {
+          "name": "last_success_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error_at": {
+          "name": "last_error_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_until": {
+          "name": "lease_until",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "cf_analytics_state_org_dataset_zone_idx": {
+          "name": "cf_analytics_state_org_dataset_zone_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "dataset",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "zone_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cf_analytics_state_org_idx": {
+          "name": "cf_analytics_state_org_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.cloudflare_hyperdrive_configs": {
+      "name": "cloudflare_hyperdrive_configs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config_id": {
+          "name": "config_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_host": {
+          "name": "origin_host",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_port": {
+          "name": "origin_port",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_scheme": {
+          "name": "origin_scheme",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_database": {
+          "name": "origin_database",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_user": {
+          "name": "origin_user",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "cloudflare_hyperdrive_configs_org_config_idx": {
+          "name": "cloudflare_hyperdrive_configs_org_config_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "config_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cloudflare_hyperdrive_configs_org_idx": {
+          "name": "cloudflare_hyperdrive_configs_org_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.cloudflare_logpush_connectors": {
+      "name": "cloudflare_logpush_connectors",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "zone_name": {
+          "name": "zone_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "service_name": {
+          "name": "service_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "dataset": {
+          "name": "dataset",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'http_requests'"
+        },
+        "secret_ciphertext": {
+          "name": "secret_ciphertext",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "secret_iv": {
+          "name": "secret_iv",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "secret_tag": {
+          "name": "secret_tag",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "secret_hash": {
+          "name": "secret_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "last_received_at": {
+          "name": "last_received_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secret_rotated_at": {
+          "name": "secret_rotated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_by": {
+          "name": "updated_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "cloudflare_logpush_connectors_org_idx": {
+          "name": "cloudflare_logpush_connectors_org_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cloudflare_logpush_connectors_org_enabled_idx": {
+          "name": "cloudflare_logpush_connectors_org_enabled_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "enabled",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cloudflare_logpush_connectors_secret_hash_unique": {
+          "name": "cloudflare_logpush_connectors_secret_hash_unique",
+          "columns": [
+            {
+              "expression": "secret_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.dashboard_versions": {
+      "name": "dashboard_versions",
+      "schema": "",
+      "columns": {
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "dashboard_id": {
+          "name": "dashboard_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version_number": {
+          "name": "version_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "snapshot_json": {
+          "name": "snapshot_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "change_kind": {
+          "name": "change_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "change_summary": {
+          "name": "change_summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_version_id": {
+          "name": "source_version_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "dashboard_versions_org_dashboard_idx": {
+          "name": "dashboard_versions_org_dashboard_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "dashboard_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "version_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "dashboard_versions_org_dashboard_version_unq": {
+          "name": "dashboard_versions_org_dashboard_version_unq",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "dashboard_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "version_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "dashboard_versions_org_id_id_pk": {
+          "name": "dashboard_versions_org_id_id_pk",
+          "columns": [
+            "org_id",
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.dashboards": {
+      "name": "dashboards",
+      "schema": "",
+      "columns": {
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "payload_json": {
+          "name": "payload_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_by": {
+          "name": "updated_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        }
+      },
+      "indexes": {
+        "dashboards_org_updated_idx": {
+          "name": "dashboards_org_updated_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "dashboards_org_name_idx": {
+          "name": "dashboards_org_name_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "dashboards_org_id_id_pk": {
+          "name": "dashboards_org_id_id_pk",
+          "columns": [
+            "org_id",
+            "id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.digest_subscriptions": {
+      "name": "digest_subscriptions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "day_of_week": {
+          "name": "day_of_week",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "timezone": {
+          "name": "timezone",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'UTC'"
+        },
+        "last_sent_at": {
+          "name": "last_sent_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_attempted_at": {
+          "name": "last_attempted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "digest_subscriptions_org_user_idx": {
+          "name": "digest_subscriptions_org_user_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "digest_subscriptions_org_enabled_idx": {
+          "name": "digest_subscriptions_org_enabled_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "enabled",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.actors": {
+      "name": "actors",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_name": {
+          "name": "agent_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "model": {
+          "name": "model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "capabilities_json": {
+          "name": "capabilities_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_active_at": {
+          "name": "last_active_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "actors_org_user_idx": {
+          "name": "actors_org_user_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "actors_org_agent_name_idx": {
+          "name": "actors_org_agent_name_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "actors_org_type_idx": {
+          "name": "actors_org_type_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.error_incidents": {
+      "name": "error_incidents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "first_triggered_at": {
+          "name": "first_triggered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_triggered_at": {
+          "name": "last_triggered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "occurrence_count": {
+          "name": "occurrence_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "error_incidents_org_issue_idx": {
+          "name": "error_incidents_org_issue_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "error_incidents_org_status_idx": {
+          "name": "error_incidents_org_status_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.error_issue_events": {
+      "name": "error_issue_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "from_state": {
+          "name": "from_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "to_state": {
+          "name": "to_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload_json": {
+          "name": "payload_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "error_issue_events_issue_idx": {
+          "name": "error_issue_events_issue_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "error_issue_events_actor_idx": {
+          "name": "error_issue_events_actor_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "actor_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "error_issue_events_type_idx": {
+          "name": "error_issue_events_type_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.error_issue_states": {
+      "name": "error_issue_states",
+      "schema": "",
+      "columns": {
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_observed_occurrence_at": {
+          "name": "last_observed_occurrence_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_evaluated_at": {
+          "name": "last_evaluated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "open_incident_id": {
+          "name": "open_incident_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "error_issue_states_org_idx": {
+          "name": "error_issue_states_org_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "error_issue_states_org_id_issue_id_pk": {
+          "name": "error_issue_states_org_id_issue_id_pk",
+          "columns": [
+            "org_id",
+            "issue_id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.error_issues": {
+      "name": "error_issues",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'error'"
+        },
+        "source_ref_json": {
+          "name": "source_ref_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "fingerprint_hash": {
+          "name": "fingerprint_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "service_name": {
+          "name": "service_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "exception_type": {
+          "name": "exception_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "exception_message": {
+          "name": "exception_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error_label": {
+          "name": "error_label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "top_frame": {
+          "name": "top_frame",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workflow_state": {
+          "name": "workflow_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'triage'"
+        },
+        "priority": {
+          "name": "priority",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 3
+        },
+        "severity": {
+          "name": "severity",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "severity_source": {
+          "name": "severity_source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assigned_actor_id": {
+          "name": "assigned_actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_holder_actor_id": {
+          "name": "lease_holder_actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_expires_at": {
+          "name": "lease_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claimed_at": {
+          "name": "claimed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "notes": {
+          "name": "notes",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "first_seen_at": {
+          "name": "first_seen_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_seen_at": {
+          "name": "last_seen_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "occurrence_count": {
+          "name": "occurrence_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_actor_id": {
+          "name": "resolved_by_actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snooze_until": {
+          "name": "snooze_until",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "error_issues_org_fp_idx": {
+          "name": "error_issues_org_fp_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "fingerprint_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "error_issues_org_workflow_idx": {
+          "name": "error_issues_org_workflow_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "workflow_state",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "error_issues_org_severity_idx": {
+          "name": "error_issues_org_severity_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "severity",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "error_issues_org_last_seen_idx": {
+          "name": "error_issues_org_last_seen_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_seen_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "error_issues_org_assignee_idx": {
+          "name": "error_issues_org_assignee_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "assigned_actor_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "error_issues_lease_expiry_idx": {
+          "name": "error_issues_lease_expiry_idx",
+          "columns": [
+            {
+              "expression": "lease_expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.error_notification_policies": {
+      "name": "error_notification_policies",
+      "schema": "",
+      "columns": {
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "destination_ids_json": {
+          "name": "destination_ids_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "notify_on_first_seen": {
+          "name": "notify_on_first_seen",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "notify_on_regression": {
+          "name": "notify_on_regression",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "notify_on_resolve": {
+          "name": "notify_on_resolve",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "notify_on_transition_in_review": {
+          "name": "notify_on_transition_in_review",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "notify_on_transition_done": {
+          "name": "notify_on_transition_done",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "notify_on_claim": {
+          "name": "notify_on_claim",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "min_occurrence_count": {
+          "name": "min_occurrence_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "severity": {
+          "name": "severity",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'warning'"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_by": {
+          "name": "updated_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_escalation_policies": {
+      "name": "issue_escalation_policies",
+      "schema": "",
+      "columns": {
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "rules_json": {
+          "name": "rules_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_by": {
+          "name": "updated_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_escalations": {
+      "name": "issue_escalations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "severity": {
+          "name": "severity",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source": {
+          "name": "source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload_json": {
+          "name": "payload_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'queued'"
+        },
+        "attempts": {
+          "name": "attempts",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "dedupe_key": {
+          "name": "dedupe_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "processed_at": {
+          "name": "processed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "issue_escalations_dedupe_idx": {
+          "name": "issue_escalations_dedupe_idx",
+          "columns": [
+            {
+              "expression": "dedupe_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_escalations_due_idx": {
+          "name": "issue_escalations_due_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_escalations_org_issue_idx": {
+          "name": "issue_escalations_org_issue_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.investigations": {
+      "name": "investigations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'investigating'"
+        },
+        "seeded_by": {
+          "name": "seeded_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'user'"
+        },
+        "subject_json": {
+          "name": "subject_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "incident_kind": {
+          "name": "incident_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "incident_id": {
+          "name": "incident_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "report_json": {
+          "name": "report_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "severity": {
+          "name": "severity",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "confidence": {
+          "name": "confidence",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "model": {
+          "name": "model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "input_tokens": {
+          "name": "input_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "output_tokens": {
+          "name": "output_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "diagnosed_at": {
+          "name": "diagnosed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "investigations_incident_idx": {
+          "name": "investigations_incident_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "incident_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "incident_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"investigations\".\"incident_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "investigations_org_created_idx": {
+          "name": "investigations_org_created_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "investigations_org_issue_idx": {
+          "name": "investigations_org_issue_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "investigations_org_status_idx": {
+          "name": "investigations_org_status_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.oauth_auth_states": {
+      "name": "oauth_auth_states",
+      "schema": "",
+      "columns": {
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "initiated_by_user_id": {
+          "name": "initiated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "redirect_uri": {
+          "name": "redirect_uri",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "return_to": {
+          "name": "return_to",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "code_verifier": {
+          "name": "code_verifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "oauth_auth_states_expires_idx": {
+          "name": "oauth_auth_states_expires_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.oauth_connections": {
+      "name": "oauth_connections",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "external_user_id": {
+          "name": "external_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "external_user_email": {
+          "name": "external_user_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "external_account_name": {
+          "name": "external_account_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connected_by_user_id": {
+          "name": "connected_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "access_token_ciphertext": {
+          "name": "access_token_ciphertext",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "access_token_iv": {
+          "name": "access_token_iv",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "access_token_tag": {
+          "name": "access_token_tag",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "refresh_token_ciphertext": {
+          "name": "refresh_token_ciphertext",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token_iv": {
+          "name": "refresh_token_iv",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token_tag": {
+          "name": "refresh_token_tag",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "oauth_connections_org_provider_idx": {
+          "name": "oauth_connections_org_provider_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "oauth_connections_org_idx": {
+          "name": "oauth_connections_org_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.org_onboarding_state": {
+      "name": "org_onboarding_state",
+      "schema": "",
+      "columns": {
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "demo_data_requested": {
+          "name": "demo_data_requested",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "onboarding_completed_at": {
+          "name": "onboarding_completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "checklist_dismissed_at": {
+          "name": "checklist_dismissed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "first_data_received_at": {
+          "name": "first_data_received_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "welcome_email_sent_at": {
+          "name": "welcome_email_sent_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connect_nudge_email_sent_at": {
+          "name": "connect_nudge_email_sent_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stalled_email_sent_at": {
+          "name": "stalled_email_sent_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "activation_email_sent_at": {
+          "name": "activation_email_sent_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.org_ingest_attribute_mappings": {
+      "name": "org_ingest_attribute_mappings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_context": {
+          "name": "source_context",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_key": {
+          "name": "source_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_key": {
+          "name": "target_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "operation": {
+          "name": "operation",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "org_ingest_attribute_mappings_org_idx": {
+          "name": "org_ingest_attribute_mappings_org_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.org_recommendation_issues": {
+      "name": "org_recommendation_issues",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "number": {
+          "name": "number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recommendation_key": {
+          "name": "recommendation_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_key": {
+          "name": "source_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "canonical_key": {
+          "name": "canonical_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'open'"
+        },
+        "usage_count": {
+          "name": "usage_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "opened_at": {
+          "name": "opened_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "org_recommendation_issues_org_idx": {
+          "name": "org_recommendation_issues_org_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "org_recommendation_issues_org_key_idx": {
+          "name": "org_recommendation_issues_org_key_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "recommendation_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.org_ingest_keys": {
+      "name": "org_ingest_keys",
+      "schema": "",
+      "columns": {
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "public_key": {
+          "name": "public_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "public_key_hash": {
+          "name": "public_key_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "private_key_ciphertext": {
+          "name": "private_key_ciphertext",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "private_key_iv": {
+          "name": "private_key_iv",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "private_key_tag": {
+          "name": "private_key_tag",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "private_key_hash": {
+          "name": "private_key_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "public_rotated_at": {
+          "name": "public_rotated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "private_rotated_at": {
+          "name": "private_rotated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_by": {
+          "name": "updated_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "org_ingest_keys_public_key_unique": {
+          "name": "org_ingest_keys_public_key_unique",
+          "columns": [
+            {
+              "expression": "public_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "org_ingest_keys_public_key_hash_unique": {
+          "name": "org_ingest_keys_public_key_hash_unique",
+          "columns": [
+            {
+              "expression": "public_key_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "org_ingest_keys_private_key_hash_unique": {
+          "name": "org_ingest_keys_private_key_hash_unique",
+          "columns": [
+            {
+              "expression": "private_key_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "org_ingest_keys_org_id_pk": {
+          "name": "org_ingest_keys_org_id_pk",
+          "columns": [
+            "org_id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.org_ingest_sampling_policies": {
+      "name": "org_ingest_sampling_policies",
+      "schema": "",
+      "columns": {
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "trace_sample_ratio": {
+          "name": "trace_sample_ratio",
+          "type": "double precision",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "always_keep_error_spans": {
+          "name": "always_keep_error_spans",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "always_keep_slow_spans_ms": {
+          "name": "always_keep_slow_spans_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.org_clickhouse_settings": {
+      "name": "org_clickhouse_settings",
+      "schema": "",
+      "columns": {
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ch_url": {
+          "name": "ch_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ch_user": {
+          "name": "ch_user",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ch_password_ciphertext": {
+          "name": "ch_password_ciphertext",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "ch_password_iv": {
+          "name": "ch_password_iv",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "ch_password_tag": {
+          "name": "ch_password_tag",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "ch_database": {
+          "name": "ch_database",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sync_status": {
+          "name": "sync_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_sync_at": {
+          "name": "last_sync_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_sync_error": {
+          "name": "last_sync_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "schema_version": {
+          "name": "schema_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_by": {
+          "name": "updated_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "org_clickhouse_settings_org_id_pk": {
+          "name": "org_clickhouse_settings_org_id_pk",
+          "columns": [
+            "org_id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.org_clickhouse_schema_apply_runs": {
+      "name": "org_clickhouse_schema_apply_runs",
+      "schema": "",
+      "columns": {
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "workflow_instance_id": {
+          "name": "workflow_instance_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "phase": {
+          "name": "phase",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "current_migration": {
+          "name": "current_migration",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "steps_total": {
+          "name": "steps_total",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "steps_done": {
+          "name": "steps_done",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "applied_versions": {
+          "name": "applied_versions",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "skipped": {
+          "name": "skipped",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {
+        "org_clickhouse_schema_apply_runs_org_id_pk": {
+          "name": "org_clickhouse_schema_apply_runs_org_id_pk",
+          "columns": [
+            "org_id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.planetscale_connections": {
+      "name": "planetscale_connections",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ps_organization": {
+          "name": "ps_organization",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connected_by_user_id": {
+          "name": "connected_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scrape_target_id": {
+          "name": "scrape_target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "webhook_secret_ciphertext": {
+          "name": "webhook_secret_ciphertext",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "webhook_secret_iv": {
+          "name": "webhook_secret_iv",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "webhook_secret_tag": {
+          "name": "webhook_secret_tag",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "detected_permissions_json": {
+          "name": "detected_permissions_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_inventory_at": {
+          "name": "last_inventory_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_inventory_error": {
+          "name": "last_inventory_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "planetscale_connections_org_idx": {
+          "name": "planetscale_connections_org_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.planetscale_databases": {
+      "name": "planetscale_databases",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "database_id": {
+          "name": "database_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'mysql'"
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "region": {
+          "name": "region",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "plan": {
+          "name": "plan",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "branches_json": {
+          "name": "branches_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "planetscale_databases_org_db_idx": {
+          "name": "planetscale_databases_org_db_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "database_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "planetscale_databases_org_idx": {
+          "name": "planetscale_databases_org_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.planetscale_poll_state": {
+      "name": "planetscale_poll_state",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "dataset": {
+          "name": "dataset",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "database_id": {
+          "name": "database_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "watermark_at": {
+          "name": "watermark_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_success_at": {
+          "name": "last_success_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error_at": {
+          "name": "last_error_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_until": {
+          "name": "lease_until",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "planetscale_poll_state_org_dataset_db_idx": {
+          "name": "planetscale_poll_state_org_dataset_db_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "dataset",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "database_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "planetscale_poll_state_org_idx": {
+          "name": "planetscale_poll_state_org_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.scrape_target_checks": {
+      "name": "scrape_target_checks",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "integer",
+          "primaryKey": true,
+          "notNull": true,
+          "identity": {
+            "type": "byDefault",
+            "name": "scrape_target_checks_id_seq",
+            "schema": "public",
+            "increment": "1",
+            "startWith": "1",
+            "minValue": "1",
+            "maxValue": "2147483647",
+            "cache": "1",
+            "cycle": false
+          }
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sub_target_key": {
+          "name": "sub_target_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "checked_at": {
+          "name": "checked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "duration_ms": {
+          "name": "duration_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "samples_scraped": {
+          "name": "samples_scraped",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "samples_post_relabel": {
+          "name": "samples_post_relabel",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "scrape_target_checks_target_checked_idx": {
+          "name": "scrape_target_checks_target_checked_idx",
+          "columns": [
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "checked_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "scrape_target_checks_target_id_scrape_targets_id_fk": {
+          "name": "scrape_target_checks_target_id_scrape_targets_id_fk",
+          "tableFrom": "scrape_target_checks",
+          "tableTo": "scrape_targets",
+          "columnsFrom": [
+            "target_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.scrape_targets": {
+      "name": "scrape_targets",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "service_name": {
+          "name": "service_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "url": {
+          "name": "url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'prometheus'"
+        },
+        "discovery_config_json": {
+          "name": "discovery_config_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scrape_interval_seconds": {
+          "name": "scrape_interval_seconds",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 15
+        },
+        "labels_json": {
+          "name": "labels_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "auth_type": {
+          "name": "auth_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'none'"
+        },
+        "managed_by": {
+          "name": "managed_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "auth_credentials_ciphertext": {
+          "name": "auth_credentials_ciphertext",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "auth_credentials_iv": {
+          "name": "auth_credentials_iv",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "auth_credentials_tag": {
+          "name": "auth_credentials_tag",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "last_scrape_at": {
+          "name": "last_scrape_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_scrape_error": {
+          "name": "last_scrape_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "scrape_targets_org_idx": {
+          "name": "scrape_targets_org_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "scrape_targets_org_enabled_idx": {
+          "name": "scrape_targets_org_enabled_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "enabled",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.slack_workspaces": {
+      "name": "slack_workspaces",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "team_id": {
+          "name": "team_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "team_name": {
+          "name": "team_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "bot_user_id": {
+          "name": "bot_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "bot_token_ciphertext": {
+          "name": "bot_token_ciphertext",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "bot_token_iv": {
+          "name": "bot_token_iv",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "bot_token_tag": {
+          "name": "bot_token_tag",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "api_key_id": {
+          "name": "api_key_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "api_key_secret_ciphertext": {
+          "name": "api_key_secret_ciphertext",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "api_key_secret_iv": {
+          "name": "api_key_secret_iv",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "api_key_secret_tag": {
+          "name": "api_key_secret_tag",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "installed_by_user_id": {
+          "name": "installed_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "slack_workspaces_team_id_idx": {
+          "name": "slack_workspaces_team_id_idx",
+          "columns": [
+            {
+              "expression": "team_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "slack_workspaces_org_idx": {
+          "name": "slack_workspaces_org_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "slack_workspaces_active_org_idx": {
+          "name": "slack_workspaces_active_org_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"slack_workspaces\".\"revoked_at\" IS NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.vcs_commits": {
+      "name": "vcs_commits",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "repository_id": {
+          "name": "repository_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sha": {
+          "name": "sha",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_name": {
+          "name": "author_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_email": {
+          "name": "author_email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_login": {
+          "name": "author_login",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_avatar_url": {
+          "name": "author_avatar_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "authored_at": {
+          "name": "authored_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "committed_at": {
+          "name": "committed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "html_url": {
+          "name": "html_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "vcs_commits_repo_sha_idx": {
+          "name": "vcs_commits_repo_sha_idx",
+          "columns": [
+            {
+              "expression": "repository_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "sha",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "vcs_commits_org_sha_idx": {
+          "name": "vcs_commits_org_sha_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "sha",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.vcs_installations": {
+      "name": "vcs_installations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "external_installation_id": {
+          "name": "external_installation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "account_login": {
+          "name": "account_login",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "account_type": {
+          "name": "account_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "external_account_id": {
+          "name": "external_account_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "account_avatar_url": {
+          "name": "account_avatar_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "repository_selection": {
+          "name": "repository_selection",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'all'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "suspended_at": {
+          "name": "suspended_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "installed_by_user_id": {
+          "name": "installed_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "vcs_installations_provider_external_idx": {
+          "name": "vcs_installations_provider_external_idx",
+          "columns": [
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "external_installation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "vcs_installations_org_idx": {
+          "name": "vcs_installations_org_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.vcs_repositories": {
+      "name": "vcs_repositories",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "installation_id": {
+          "name": "installation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "external_repo_id": {
+          "name": "external_repo_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "owner": {
+          "name": "owner",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "full_name": {
+          "name": "full_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "default_branch": {
+          "name": "default_branch",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'main'"
+        },
+        "tracked_branch": {
+          "name": "tracked_branch",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "html_url": {
+          "name": "html_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "is_private": {
+          "name": "is_private",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "is_archived": {
+          "name": "is_archived",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "sync_status": {
+          "name": "sync_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "last_synced_at": {
+          "name": "last_synced_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_sync_error": {
+          "name": "last_sync_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "vcs_repositories_org_repo_idx": {
+          "name": "vcs_repositories_org_repo_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "external_repo_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "vcs_repositories_org_idx": {
+          "name": "vcs_repositories_org_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "vcs_repositories_installation_idx": {
+          "name": "vcs_repositories_installation_idx",
+          "columns": [
+            {
+              "expression": "installation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.vcs_repository_branches": {
+      "name": "vcs_repository_branches",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "org_id": {
+          "name": "org_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "repository_id": {
+          "name": "repository_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "is_default": {
+          "name": "is_default",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "head_sha": {
+          "name": "head_sha",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "vcs_repository_branches_repo_name_idx": {
+          "name": "vcs_repository_branches_repo_name_idx",
+          "columns": [
+            {
+              "expression": "repository_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "vcs_repository_branches_org_idx": {
+          "name": "vcs_repository_branches_org_idx",
+          "columns": [
+            {
+              "expression": "org_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {},
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}
\ No newline at end of file
diff --git a/packages/db/drizzle/meta/_journal.json b/packages/db/drizzle/meta/_journal.json
index b2fdf3be2..0efcdaa2e 100644
--- a/packages/db/drizzle/meta/_journal.json
+++ b/packages/db/drizzle/meta/_journal.json
@@ -120,6 +120,13 @@
       "when": 1784586724571,
       "tag": "0016_lowly_famine",
       "breakpoints": true
+    },
+    {
+      "idx": 17,
+      "version": "7",
+      "when": 1784643744458,
+      "tag": "0017_fair_mandarin",
+      "breakpoints": true
     }
   ]
 }
\ No newline at end of file
diff --git a/packages/db/src/schema/index.ts b/packages/db/src/schema/index.ts
index 7bb2f63f9..15605e0cf 100644
--- a/packages/db/src/schema/index.ts
+++ b/packages/db/src/schema/index.ts
@@ -21,4 +21,5 @@ export * from "./org-clickhouse-schema-apply-runs"
 export * from "./planetscale-connections"
 export * from "./planetscale-inventory"
 export * from "./scrape-targets"
+export * from "./slack-workspaces"
 export * from "./vcs"
diff --git a/packages/db/src/schema/slack-workspaces.ts b/packages/db/src/schema/slack-workspaces.ts
new file mode 100644
index 000000000..af6c69092
--- /dev/null
+++ b/packages/db/src/schema/slack-workspaces.ts
@@ -0,0 +1,57 @@
+import { sql } from "drizzle-orm"
+import { index, pgTable, text, timestamp, uniqueIndex } from "drizzle-orm/pg-core"
+
+// ---------------------------------------------------------------------------
+// Slack workspace installations. One row per Slack team (workspace) that has
+// installed the Maple Slack app via OAuth. A row binds a Slack `teamId` to a
+// Maple org and stores, encrypted, both the Slack bot token (used to post
+// messages / list channels) and a minted Maple API key secret (handed to the
+// Railway-hosted bot so it can call Maple's MCP server on the org's behalf).
+//
+// Unlike normal API keys — which are stored hash-only — the bot needs the raw
+// `maple_ak_…` secret at runtime, so we keep it encrypted (AES-256-GCM, same
+// column pattern as `alert_destinations`) alongside the key id.
+// ---------------------------------------------------------------------------
+
+export const slackWorkspaces = pgTable(
+	"slack_workspaces",
+	{
+		id: text("id").notNull().primaryKey(),
+		orgId: text("org_id").notNull(),
+		/** Slack workspace (team) id, e.g. `T0123ABCD`. Unique across all orgs. */
+		teamId: text("team_id").notNull(),
+		teamName: text("team_name"),
+		botUserId: text("bot_user_id"),
+		scope: text("scope"),
+		// Encrypted Slack bot token (`xoxb-…`).
+		botTokenCiphertext: text("bot_token_ciphertext").notNull(),
+		botTokenIv: text("bot_token_iv").notNull(),
+		botTokenTag: text("bot_token_tag").notNull(),
+		// Minted Maple API key handed to the bot. `apiKeyId` references the
+		// `api_keys` row (for revocation); the encrypted columns hold the raw
+		// `maple_ak_…` secret so we can decrypt and forward it to the bot.
+		apiKeyId: text("api_key_id"),
+		apiKeySecretCiphertext: text("api_key_secret_ciphertext").notNull(),
+		apiKeySecretIv: text("api_key_secret_iv").notNull(),
+		apiKeySecretTag: text("api_key_secret_tag").notNull(),
+		installedByUserId: text("installed_by_user_id"),
+		createdAt: timestamp("created_at", { withTimezone: true, mode: "date" }).notNull(),
+		updatedAt: timestamp("updated_at", { withTimezone: true, mode: "date" }).notNull(),
+		// Set when the install is uninstalled/revoked. Revoked rows read as "not
+		// installed" and are skipped by the bot-resolve + dispatch lookups.
+		revokedAt: timestamp("revoked_at", { withTimezone: true, mode: "date" }),
+	},
+	(table) => [
+		uniqueIndex("slack_workspaces_team_id_idx").on(table.teamId),
+		index("slack_workspaces_org_idx").on(table.orgId),
+		// Enforce at most one ACTIVE installation per org. Revoked rows are exempt so
+		// history (and re-installs) can coexist. Consumers select the single active
+		// row per org, so this invariant keeps that lookup unambiguous.
+		uniqueIndex("slack_workspaces_active_org_idx")
+			.on(table.orgId)
+			.where(sql`${table.revokedAt} IS NULL`),
+	],
+)
+
+export type SlackWorkspaceRow = typeof slackWorkspaces.$inferSelect
+export type SlackWorkspaceInsert = typeof slackWorkspaces.$inferInsert
diff --git a/packages/domain/src/http/alerts.ts b/packages/domain/src/http/alerts.ts
index 1ced0fa80..30d91a503 100644
--- a/packages/domain/src/http/alerts.ts
+++ b/packages/domain/src/http/alerts.ts
@@ -20,6 +20,7 @@ import { warehouseHttpErrors } from "./warehouse"
 
 export const AlertDestinationType = Schema.Literals([
 	"slack",
+	"slack-bot",
 	"pagerduty",
 	"webhook",
 	"hazel",
@@ -172,6 +173,18 @@ export class SlackAlertDestinationConfig extends Schema.Class<SlackAlertDestinat
 	enabled: Schema.optionalKey(Schema.Boolean),
 }) {}
 
+export class SlackBotAlertDestinationConfig extends Schema.Class<SlackBotAlertDestinationConfig>(
+	"SlackBotAlertDestinationConfig",
+)({
+	type: Schema.Literal("slack-bot"),
+	name: ChannelLabel,
+	// The Slack channel the installed bot posts to. No per-destination token —
+	// the bot token is resolved from the org's slack_workspaces row at dispatch.
+	channelId: NonEmptyString,
+	channelName: OptionalNonEmptyString,
+	enabled: Schema.optionalKey(Schema.Boolean),
+}) {}
+
 export class PagerDutyAlertDestinationConfig extends Schema.Class<PagerDutyAlertDestinationConfig>(
 	"PagerDutyAlertDestinationConfig",
 )({
@@ -246,6 +259,7 @@ export class EmailAlertDestinationConfig extends Schema.Class<EmailAlertDestinat
 
 export const AlertDestinationCreateRequest = Schema.Union([
 	SlackAlertDestinationConfig,
+	SlackBotAlertDestinationConfig,
 	PagerDutyAlertDestinationConfig,
 	WebhookAlertDestinationConfig,
 	HazelAlertDestinationConfig,
@@ -264,6 +278,15 @@ export class UpdateSlackAlertDestinationConfig extends Schema.Class<UpdateSlackA
 	enabled: Schema.optionalKey(Schema.Boolean),
 }) {}
 
+export class UpdateSlackBotAlertDestinationConfig extends Schema.Class<UpdateSlackBotAlertDestinationConfig>(
+	"UpdateSlackBotAlertDestinationConfig",
+)({
+	name: OptionalNonEmptyString,
+	channelId: Schema.optionalKey(Schema.String),
+	channelName: OptionalNonEmptyString,
+	enabled: Schema.optionalKey(Schema.Boolean),
+}) {}
+
 export class UpdatePagerDutyAlertDestinationConfig extends Schema.Class<UpdatePagerDutyAlertDestinationConfig>(
 	"UpdatePagerDutyAlertDestinationConfig",
 )({
@@ -323,6 +346,10 @@ export const AlertDestinationUpdateRequest = Schema.Union([
 		type: Schema.Literal("slack"),
 		...UpdateSlackAlertDestinationConfig.fields,
 	}),
+	Schema.Struct({
+		type: Schema.Literal("slack-bot"),
+		...UpdateSlackBotAlertDestinationConfig.fields,
+	}),
 	Schema.Struct({
 		type: Schema.Literal("pagerduty"),
 		...UpdatePagerDutyAlertDestinationConfig.fields,
diff --git a/packages/domain/src/http/v2/alert-destinations.ts b/packages/domain/src/http/v2/alert-destinations.ts
index 145fc02a6..f616aafeb 100644
--- a/packages/domain/src/http/v2/alert-destinations.ts
+++ b/packages/domain/src/http/v2/alert-destinations.ts
@@ -69,7 +69,7 @@ export const V2AlertDestination = Schema.Struct({
 	}),
 	type: AlertDestinationType.annotate({
 		description:
-			"The delivery channel: `slack`, `pagerduty`, `webhook`, `hazel`, `hazel-oauth`, `discord`, or `email`. Immutable after creation.",
+			"The delivery channel: `slack`, `slack-bot`, `pagerduty`, `webhook`, `hazel`, `hazel-oauth`, `discord`, or `email`. Immutable after creation.",
 		examples: ["slack"],
 	}),
 	enabled: Schema.Boolean.annotate({
@@ -149,6 +149,22 @@ const V2SlackDestinationCreateParams = Schema.Struct({
 	enabled: enabledField,
 }).annotate({ identifier: "AlertDestinationCreateSlack", title: "Slack destination" })
 
+const V2SlackBotDestinationCreateParams = Schema.Struct({
+	type: Schema.Literal("slack-bot"),
+	name: nameField,
+	channel_id: NonEmptyString.annotate({
+		description: "The Slack channel id the bot posts to (e.g. `C0789CHAN`).",
+		examples: ["C0789CHAN"],
+	}),
+	channel_name: Schema.optionalKey(
+		NonEmptyString.annotate({
+			description: "Optional display name for the channel, e.g. `incidents`.",
+			examples: ["incidents"],
+		}),
+	),
+	enabled: enabledField,
+}).annotate({ identifier: "AlertDestinationCreateSlackBot", title: "Slack (bot) destination" })
+
 const V2PagerDutyDestinationCreateParams = Schema.Struct({
 	type: Schema.Literal("pagerduty"),
 	name: nameField,
@@ -230,6 +246,7 @@ const V2EmailDestinationCreateParams = Schema.Struct({
 
 export const V2AlertDestinationCreateParams = Schema.Union([
 	V2SlackDestinationCreateParams,
+	V2SlackBotDestinationCreateParams,
 	V2PagerDutyDestinationCreateParams,
 	V2WebhookDestinationCreateParams,
 	V2HazelDestinationCreateParams,
@@ -267,6 +284,13 @@ export const V2AlertDestinationUpdateParams = Schema.Union([
 		channel_label: OptionalNonEmptyString,
 		enabled: Schema.optionalKey(Schema.Boolean),
 	}).annotate({ identifier: "AlertDestinationUpdateSlack", title: "Slack destination update" }),
+	Schema.Struct({
+		type: Schema.Literal("slack-bot"),
+		name: optionalNameField,
+		channel_id: Schema.optionalKey(Schema.String),
+		channel_name: OptionalNonEmptyString,
+		enabled: Schema.optionalKey(Schema.Boolean),
+	}).annotate({ identifier: "AlertDestinationUpdateSlackBot", title: "Slack (bot) destination update" }),
 	Schema.Struct({
 		type: Schema.Literal("pagerduty"),
 		name: optionalNameField,
diff --git a/packages/domain/src/http/v2/api.ts b/packages/domain/src/http/v2/api.ts
index b09a27862..b69474d13 100644
--- a/packages/domain/src/http/v2/api.ts
+++ b/packages/domain/src/http/v2/api.ts
@@ -7,6 +7,7 @@ import { V2ApiKeysApiGroup } from "./api-keys"
 import { V2AttributeMappingsApiGroup } from "./attribute-mappings"
 import { V2DashboardsApiGroup } from "./dashboards"
 import { V2IngestKeysApiGroup } from "./ingest-keys"
+import { V2SlackIntegrationsApiGroup } from "./integrations"
 import { V2ErrorIssuesApiGroup } from "./error-issues"
 import { V2InvestigationsApiGroup } from "./investigations"
 import { V2OrganizationApiGroup } from "./organization"
@@ -65,6 +66,7 @@ export class MapleApiV2 extends HttpApi.make("MapleApiV2")
 	.add(V2AlertDestinationsApiGroup)
 	.add(V2AlertIncidentsApiGroup)
 	.add(V2IngestKeysApiGroup)
+	.add(V2SlackIntegrationsApiGroup)
 	.add(V2ErrorIssuesApiGroup)
 	.add(V2AttributeMappingsApiGroup)
 	.add(V2ScrapeTargetsApiGroup)
diff --git a/packages/domain/src/http/v2/index.ts b/packages/domain/src/http/v2/index.ts
index 572aab89d..3b2bb3e61 100644
--- a/packages/domain/src/http/v2/index.ts
+++ b/packages/domain/src/http/v2/index.ts
@@ -11,6 +11,7 @@ export * from "./envelopes"
 export * from "./errors"
 export * from "./error-issues"
 export * from "./ingest-keys"
+export * from "./integrations"
 export * from "./investigations"
 export * from "./organization"
 export * from "./public-id"
diff --git a/packages/domain/src/http/v2/integrations.ts b/packages/domain/src/http/v2/integrations.ts
new file mode 100644
index 000000000..f1cf4546d
--- /dev/null
+++ b/packages/domain/src/http/v2/integrations.ts
@@ -0,0 +1,194 @@
+import { HttpApiEndpoint, HttpApiGroup, OpenApi } from "effect/unstable/httpapi"
+import { Schema } from "effect"
+import { AuthorizationV2, V2SchemaErrors } from "./auth"
+import { Timestamp } from "./envelopes"
+import {
+	V2InvalidRequestError,
+	V2NotFoundError,
+	V2PermissionError,
+	V2ServiceUnavailableError,
+	V2UpstreamError,
+} from "./errors"
+
+/** See api-keys.ts: examples are authored in wire (encoded) shape. */
+const wireExample = <A>(example: object): A => example as A
+
+// ---------------------------------------------------------------------------
+// Slack integration. A workspace installs the Maple Slack app via OAuth; the
+// resulting bot token + minted Maple API key are stored server-side (see the
+// `slack_workspaces` table). These endpoints drive the dashboard's Slack
+// integration card: kick off the install, read status, uninstall, and list
+// channels the bot can post to.
+// ---------------------------------------------------------------------------
+
+export const V2SlackIntegrationStatus = Schema.Struct({
+	object: Schema.Literal("slack_integration").annotate({
+		description: 'The object type — always `"slack_integration"`.',
+		examples: ["slack_integration"],
+	}),
+	installed: Schema.Boolean.annotate({
+		description: "Whether the Maple Slack app is currently installed for this organization.",
+		examples: [true],
+	}),
+	team_id: Schema.NullOr(Schema.String).annotate({
+		description: "The connected Slack workspace (team) id, or `null` when not installed.",
+		examples: ["T0123ABCD"],
+	}),
+	team_name: Schema.NullOr(Schema.String).annotate({
+		description: "The connected Slack workspace name, or `null`.",
+		examples: ["Acme"],
+	}),
+	bot_user_id: Schema.NullOr(Schema.String).annotate({
+		description: "The Slack user id of the installed bot, or `null`.",
+		examples: ["U0456BOT"],
+	}),
+	installed_at: Schema.NullOr(Timestamp).annotate({
+		description: "When the app was installed, or `null` when not installed.",
+	}),
+}).annotate({
+	identifier: "SlackIntegration",
+	title: "Slack integration status",
+	description: "The Slack app installation state for the authenticated organization.",
+	examples: [
+		wireExample({
+			object: "slack_integration",
+			installed: true,
+			team_id: "T0123ABCD",
+			team_name: "Acme",
+			bot_user_id: "U0456BOT",
+			installed_at: "2026-07-01T12:00:00.000Z",
+		}),
+	],
+})
+export type V2SlackIntegrationStatus = Schema.Schema.Type<typeof V2SlackIntegrationStatus>
+
+export const V2SlackInstallResponse = Schema.Struct({
+	object: Schema.Literal("slack_integration.install").annotate({
+		description: 'The object type — always `"slack_integration.install"`.',
+	}),
+	url: Schema.String.annotate({
+		description:
+			"The Slack authorize URL to redirect the user to. Opens the Slack consent screen; on approval Slack redirects back to Maple's callback.",
+		examples: ["https://slack.com/oauth/v2/authorize?client_id=..."],
+	}),
+}).annotate({
+	identifier: "SlackInstall",
+	title: "Slack install response",
+	description: "The Slack OAuth authorize URL to begin an installation.",
+	examples: [
+		wireExample({
+			object: "slack_integration.install",
+			url: "https://slack.com/oauth/v2/authorize?client_id=123&scope=chat:write&state=abc",
+		}),
+	],
+})
+export type V2SlackInstallResponse = Schema.Schema.Type<typeof V2SlackInstallResponse>
+
+export const V2SlackUninstallResponse = Schema.Struct({
+	object: Schema.Literal("slack_integration").annotate({
+		description: 'The object type — always `"slack_integration"`.',
+	}),
+	installed: Schema.Literal(false).annotate({
+		description: "Always `false` — the app is no longer installed.",
+	}),
+}).annotate({
+	identifier: "SlackUninstall",
+	title: "Slack uninstall response",
+	description: "Confirmation that the Slack app was uninstalled.",
+	examples: [wireExample({ object: "slack_integration", installed: false })],
+})
+export type V2SlackUninstallResponse = Schema.Schema.Type<typeof V2SlackUninstallResponse>
+
+export const V2SlackChannel = Schema.Struct({
+	id: Schema.String.annotate({ description: "The Slack channel id.", examples: ["C0789CHAN"] }),
+	name: Schema.String.annotate({ description: "The channel name (without `#`).", examples: ["incidents"] }),
+	is_private: Schema.Boolean.annotate({
+		description: "Whether the channel is private.",
+		examples: [false],
+	}),
+	is_member: Schema.Boolean.annotate({
+		description: "Whether the Maple bot is a member of the channel (required to post to private channels).",
+		examples: [true],
+	}),
+}).annotate({ identifier: "SlackChannel", title: "Slack channel" })
+export type V2SlackChannel = Schema.Schema.Type<typeof V2SlackChannel>
+
+export const V2SlackChannelList = Schema.Struct({
+	object: Schema.Literal("slack_integration.channel_list").annotate({
+		description: 'The object type — always `"slack_integration.channel_list"`.',
+	}),
+	channels: Schema.Array(V2SlackChannel).annotate({
+		description: "The channels the installed bot can see, most recently listed first.",
+	}),
+}).annotate({
+	identifier: "SlackChannelList",
+	title: "Slack channel list",
+	description: "The channels visible to the installed Slack bot.",
+})
+export type V2SlackChannelList = Schema.Schema.Type<typeof V2SlackChannelList>
+
+const commonErrors = [V2InvalidRequestError, V2ServiceUnavailableError, V2UpstreamError] as const
+
+export class V2SlackIntegrationsApiGroup extends HttpApiGroup.make("slackIntegration")
+	.add(
+		HttpApiEndpoint.get("status", "/", {
+			success: V2SlackIntegrationStatus,
+			error: [...commonErrors],
+		}).annotateMerge(
+			OpenApi.annotations({
+				identifier: "getSlackIntegration",
+				summary: "Retrieve Slack integration status",
+				description:
+					"Returns whether the Maple Slack app is installed for your organization. Requires the `integrations:read` scope.",
+			}),
+		),
+	)
+	.add(
+		HttpApiEndpoint.post("install", "/install", {
+			success: V2SlackInstallResponse,
+			error: [...commonErrors, V2PermissionError],
+		}).annotateMerge(
+			OpenApi.annotations({
+				identifier: "installSlackIntegration",
+				summary: "Begin a Slack installation",
+				description:
+					"Returns a Slack OAuth authorize URL to redirect the user to. Requires an org-admin role and the `integrations:write` scope.",
+			}),
+		),
+	)
+	.add(
+		HttpApiEndpoint.delete("uninstall", "/", {
+			success: V2SlackUninstallResponse,
+			error: [...commonErrors, V2PermissionError, V2NotFoundError],
+		}).annotateMerge(
+			OpenApi.annotations({
+				identifier: "uninstallSlackIntegration",
+				summary: "Uninstall the Slack app",
+				description:
+					"Revokes the Slack installation and the API key minted for the bot. Requires an org-admin role and the `integrations:write` scope.",
+			}),
+		),
+	)
+	.add(
+		HttpApiEndpoint.get("channels", "/channels", {
+			success: V2SlackChannelList,
+			error: [...commonErrors, V2NotFoundError],
+		}).annotateMerge(
+			OpenApi.annotations({
+				identifier: "listSlackChannels",
+				summary: "List Slack channels",
+				description:
+					"Lists the channels the installed Maple bot can see. Requires the `integrations:read` scope.",
+			}),
+		),
+	)
+	.prefix("/v2/integrations/slack")
+	.middleware(AuthorizationV2)
+	.middleware(V2SchemaErrors)
+	.annotateMerge(
+		OpenApi.annotations({
+			title: "Slack Integration",
+			description:
+				"Install and manage the Maple Slack app for your organization: begin an OAuth install, read installation status, list channels, and uninstall.",
+		}),
+	) {}
diff --git a/packages/domain/src/http/v2/openapi.test.ts b/packages/domain/src/http/v2/openapi.test.ts
index e5d420977..aa38bf173 100644
--- a/packages/domain/src/http/v2/openapi.test.ts
+++ b/packages/domain/src/http/v2/openapi.test.ts
@@ -62,6 +62,7 @@ describe("MapleApiV2 OpenAPI", () => {
 			"DELETE /v2/api_keys/{id}",
 			"DELETE /v2/attribute_mappings/{id}",
 			"DELETE /v2/dashboards/{id}",
+			"DELETE /v2/integrations/slack",
 			"DELETE /v2/scrape_targets/{id}",
 			"GET /v2/alerts/destinations",
 			"GET /v2/alerts/destinations/{id}",
@@ -87,6 +88,8 @@ describe("MapleApiV2 OpenAPI", () => {
 			"GET /v2/error_issues/{id}",
 			"GET /v2/ingest_keys",
 			"GET /v2/instrumentation/recommendations",
+			"GET /v2/integrations/slack",
+			"GET /v2/integrations/slack/channels",
 			"GET /v2/investigations",
 			"GET /v2/investigations/{id}",
 			"GET /v2/logs/{id}",
@@ -126,6 +129,7 @@ describe("MapleApiV2 OpenAPI", () => {
 			"POST /v2/ingest_keys/public/roll",
 			"POST /v2/instrumentation/recommendations/{id}/dismiss",
 			"POST /v2/instrumentation/recommendations/{id}/reopen",
+			"POST /v2/integrations/slack/install",
 			"POST /v2/investigations",
 			"POST /v2/investigations/{id}/status",
 			"POST /v2/logs/breakdown",

From 13f7f434feb90fe1de00bbbc4ab6eebe35137ad1 Mon Sep 17 00:00:00 2001
From: JeremyFunk <jeremy@kombo.dev>
Date: Tue, 21 Jul 2026 20:33:53 +0200
Subject: [PATCH 4/8] chore: include alerting worker in dev:essentials

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index ee6379f42..115d5b684 100644
--- a/package.json
+++ b/package.json
@@ -11,7 +11,7 @@
   "scripts": {
     "build": "turbo build",
     "dev": "turbo dev",
-    "dev:essentials": "turbo dev --filter=@maple/api --filter=@maple/ingest --filter=@maple/web --filter=@maple/scraper --filter=@maple/electric-sync",
+    "dev:essentials": "turbo dev --filter=@maple/api --filter=@maple/alerting --filter=@maple/ingest --filter=@maple/web --filter=@maple/scraper --filter=@maple/electric-sync",
     "docker:build": "COMPOSE_PARALLEL_LIMIT=1 docker compose build",
     "docker:up": "COMPOSE_PARALLEL_LIMIT=1 docker compose up --build",
     "db:up": "docker compose up -d postgres electric",

From 995a7db7bdf32eb6eaeeaa16e9f83be16fbfa7b4 Mon Sep 17 00:00:00 2001
From: JeremyFunk <jeremy@kombo.dev>
Date: Wed, 22 Jul 2026 10:41:26 +0200
Subject: [PATCH 5/8] Refactor

---
 .env.example                                  |   5 +
 apps/api/src/lib/Env.ts                       |   7 +
 .../src/routes/slack-integration.http.test.ts | 263 +++++++++
 apps/api/src/routes/slack-integration.http.ts |  92 +--
 .../src/routes/v2/integrations-origin.test.ts |  62 ++
 apps/api/src/routes/v2/integrations.http.ts   |  29 +-
 apps/api/src/routes/v2/v2-test-support.ts     |  27 +-
 .../services/AlertDeliveryDispatch.test.ts    |  75 ++-
 .../api/src/services/AlertDeliveryDispatch.ts |  26 +-
 apps/api/src/services/AlertsService.test.ts   |  93 +++
 apps/api/src/services/AlertsService.ts        |  18 +-
 .../services/SlackIntegrationService.test.ts  | 466 ++++++++++++++-
 .../src/services/SlackIntegrationService.ts   | 538 +++++++++++-------
 apps/slack-agent/.env.local.example           |  10 +-
 apps/slack-agent/README.md                    |  24 +-
 apps/slack-agent/agent/agent.ts               |  21 +
 apps/slack-agent/agent/channels/eve.ts        |  52 +-
 apps/slack-agent/agent/channels/slack.ts      |   9 +
 apps/slack-agent/agent/lib/maple.test.ts      | 328 +++++++++++
 apps/slack-agent/agent/lib/maple.ts           |   9 +
 apps/slack-agent/bun.lock                     |   5 +
 apps/slack-agent/package.json                 |   2 +
 apps/slack-agent/tsconfig.json                |   2 +-
 .../components/alerts/destination-card.tsx    |   3 +-
 .../components/alerts/destination-dialog.tsx  |  78 ++-
 .../alerts/destination-provider.tsx           |  18 +-
 .../integrations/slack-integration-card.tsx   |  32 +-
 apps/web/src/routes/integrations.tsx          |  16 +-
 packages/domain/src/http/alerts.ts            |   2 +-
 .../domain/src/http/v2/alert-destinations.ts  |   2 +-
 packages/domain/src/http/v2/openapi.test.ts   |  94 ++-
 31 files changed, 2048 insertions(+), 360 deletions(-)
 create mode 100644 apps/api/src/routes/slack-integration.http.test.ts
 create mode 100644 apps/api/src/routes/v2/integrations-origin.test.ts
 create mode 100644 apps/slack-agent/agent/lib/maple.test.ts

diff --git a/.env.example b/.env.example
index 513d6da85..b8b2eb60f 100644
--- a/.env.example
+++ b/.env.example
@@ -128,6 +128,11 @@ INGEST_REQUIRE_TLS=false
 # stays disabled until they are set.
 # SLACK_CLIENT_ID=
 # SLACK_CLIENT_SECRET=
+# Optional dedicated bearer secret for the internal Slack-bot resolve endpoint
+# (`GET /internal/slack/workspaces/:teamId`), so the Railway-hosted Slack agent
+# can be given a secret distinct from INTERNAL_SERVICE_TOKEN. Falls back to
+# INTERNAL_SERVICE_TOKEN when unset.
+# SLACK_INTERNAL_SERVICE_TOKEN=
 
 # GitHub integration (GitHub App)
 # Maple connects to GitHub via a GitHub App for repo access, OAuth sign-in, and
diff --git a/apps/api/src/lib/Env.ts b/apps/api/src/lib/Env.ts
index bb914adf5..c7338bdc1 100644
--- a/apps/api/src/lib/Env.ts
+++ b/apps/api/src/lib/Env.ts
@@ -46,6 +46,12 @@ export interface EnvShape {
 	readonly HAZEL_OAUTH_SCOPES: string
 	readonly SLACK_CLIENT_ID: Option.Option<string>
 	readonly SLACK_CLIENT_SECRET: Option.Option<Redacted.Redacted<string>>
+	/**
+	 * Optional dedicated bearer secret for the internal Slack-bot resolve
+	 * endpoint, so the Railway bot can hold a token distinct from the
+	 * MCP-internal `INTERNAL_SERVICE_TOKEN`. Falls back to that token when unset.
+	 */
+	readonly SLACK_INTERNAL_SERVICE_TOKEN: Option.Option<Redacted.Redacted<string>>
 	readonly GITHUB_APP_ID: Option.Option<string>
 	readonly GITHUB_APP_SLUG: Option.Option<string>
 	readonly GITHUB_APP_PRIVATE_KEY: Option.Option<Redacted.Redacted<string>>
@@ -130,6 +136,7 @@ const envConfig = Config.all({
 	),
 	SLACK_CLIENT_ID: optionalString("SLACK_CLIENT_ID"),
 	SLACK_CLIENT_SECRET: optionalRedacted("SLACK_CLIENT_SECRET"),
+	SLACK_INTERNAL_SERVICE_TOKEN: optionalRedacted("SLACK_INTERNAL_SERVICE_TOKEN"),
 	GITHUB_APP_ID: optionalString("GITHUB_APP_ID"),
 	GITHUB_APP_SLUG: optionalString("GITHUB_APP_SLUG"),
 	GITHUB_APP_PRIVATE_KEY: optionalRedacted("GITHUB_APP_PRIVATE_KEY"),
diff --git a/apps/api/src/routes/slack-integration.http.test.ts b/apps/api/src/routes/slack-integration.http.test.ts
new file mode 100644
index 000000000..cd902a6e5
--- /dev/null
+++ b/apps/api/src/routes/slack-integration.http.test.ts
@@ -0,0 +1,263 @@
+import { createCipheriv, randomBytes } from "node:crypto"
+import { afterEach, assert, describe, it } from "@effect/vitest"
+import { ConfigProvider, Effect, Layer } from "effect"
+import { HttpRouter } from "effect/unstable/http"
+import { Env } from "../lib/Env"
+import { cleanupTestDbs, createTestDb, executeSql, type TestDb } from "../lib/test-pglite"
+import { ApiKeysService } from "../services/ApiKeysService"
+import { OAuthStateRepository } from "../services/OAuthStateRepository"
+import { SlackIntegrationService } from "../services/SlackIntegrationService"
+import { SlackInternalRouter } from "./slack-integration.http"
+
+const trackedDbs: TestDb[] = []
+afterEach(() => cleanupTestDbs(trackedDbs))
+
+const ENCRYPTION_KEY = Buffer.alloc(32, 7)
+
+/** AES-256-GCM encrypt matching Crypto.ts's format (12-byte iv, base64 fields). */
+const encryptField = (plaintext: string, key: Buffer) => {
+	const iv = randomBytes(12)
+	const cipher = createCipheriv("aes-256-gcm", key, iv)
+	const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()])
+	return {
+		ciphertext: ciphertext.toString("base64"),
+		iv: iv.toString("base64"),
+		tag: cipher.getAuthTag().toString("base64"),
+	}
+}
+
+/** Insert an encrypted slack_workspaces row directly (bypasses OAuth). */
+const insertWorkspace = async (
+	testDb: TestDb,
+	opts: {
+		id: string
+		orgId: string
+		teamId: string
+		teamName: string
+		botToken: string
+		apiKey: string
+		revoked?: boolean
+	},
+) => {
+	const bot = encryptField(opts.botToken, ENCRYPTION_KEY)
+	const key = encryptField(opts.apiKey, ENCRYPTION_KEY)
+	await executeSql(
+		testDb,
+		`INSERT INTO slack_workspaces (
+			id, org_id, team_id, team_name, bot_user_id, scope,
+			bot_token_ciphertext, bot_token_iv, bot_token_tag,
+			api_key_id, api_key_secret_ciphertext, api_key_secret_iv, api_key_secret_tag,
+			installed_by_user_id, created_at, updated_at, revoked_at
+		) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14, now(), now(), ${opts.revoked ? "now()" : "NULL"})`,
+		[
+			opts.id,
+			opts.orgId,
+			opts.teamId,
+			opts.teamName,
+			"U0BOT",
+			"chat:write",
+			bot.ciphertext,
+			bot.iv,
+			bot.tag,
+			"11111111-2222-4333-8444-555555555555",
+			key.ciphertext,
+			key.iv,
+			key.tag,
+			"user_installer",
+		],
+	)
+}
+
+const makeConfig = (tokens: { slack?: string; shared?: string } = {}) =>
+	ConfigProvider.layer(
+		ConfigProvider.fromUnknown({
+			PORT: "3472",
+			TINYBIRD_HOST: "https://api.tinybird.co",
+			TINYBIRD_TOKEN: "test-token",
+			MAPLE_AUTH_MODE: "self_hosted",
+			MAPLE_ROOT_PASSWORD: "test-root-password",
+			MAPLE_DEFAULT_ORG_ID: "default",
+			MAPLE_INGEST_KEY_ENCRYPTION_KEY: ENCRYPTION_KEY.toString("base64"),
+			MAPLE_INGEST_KEY_LOOKUP_HMAC_KEY: "maple-test-lookup-secret",
+			MAPLE_APP_BASE_URL: "https://web.localhost",
+			...(tokens.slack !== undefined ? { SLACK_INTERNAL_SERVICE_TOKEN: tokens.slack } : {}),
+			...(tokens.shared !== undefined ? { INTERNAL_SERVICE_TOKEN: tokens.shared } : {}),
+		}),
+	)
+
+const makeRouterLayer = (testDb: TestDb, tokens: { slack?: string; shared?: string } = {}) =>
+	SlackInternalRouter.pipe(
+		Layer.provide(SlackIntegrationService.layer),
+		Layer.provide(Layer.mergeAll(ApiKeysService.layer, OAuthStateRepository.layer)),
+		Layer.provide(testDb.layer),
+		Layer.provide(Env.layer),
+		Layer.provide(makeConfig(tokens)),
+	)
+
+const TEAM_PATH = "/internal/slack/workspaces"
+
+const get = (
+	handler: (request: Request) => Promise<Response>,
+	teamId: string,
+	bearer?: string,
+) =>
+	Effect.promise(() =>
+		handler(
+			new Request(`http://api.localhost${TEAM_PATH}/${teamId}`, {
+				headers: bearer !== undefined ? { authorization: bearer } : {},
+			}),
+		),
+	)
+
+/** Run `body` against a web handler for the internal router, disposing after. */
+const withHandler = (
+	testDb: TestDb,
+	tokens: { slack?: string; shared?: string },
+	body: (handler: (request: Request) => Promise<Response>) => Effect.Effect<void>,
+) => {
+	const { handler, dispose } = HttpRouter.toWebHandler(makeRouterLayer(testDb, tokens), {
+		disableLogger: true,
+	})
+	return body((request) => handler(request)).pipe(Effect.ensuring(Effect.promise(dispose)))
+}
+
+describe("SlackInternalRouter", () => {
+	it.effect("resolves a team with the dedicated token and returns the fixed contract", () => {
+		const testDb = createTestDb(trackedDbs)
+		return Effect.gen(function* () {
+			yield* Effect.promise(() =>
+				insertWorkspace(testDb, {
+					id: "sw_1",
+					orgId: "org_a",
+					teamId: "T0123",
+					teamName: "Acme",
+					botToken: "xoxb-secret-token",
+					apiKey: "maple_ak_secret",
+				}),
+			)
+			yield* withHandler(
+				testDb,
+				{ slack: "slack-secret-token", shared: "shared-secret-token" },
+				Effect.fnUntraced(function* (handler) {
+					const ok = yield* get(handler, "T0123", "Bearer maple_svc_slack-secret-token")
+					assert.strictEqual(ok.status, 200)
+					const body = yield* Effect.promise(() => ok.json())
+					// FIXED response contract — the Railway bot is built against exactly
+					// these keys (SlackBotResolutionResponseSchema).
+					assert.deepStrictEqual(body, {
+						orgId: "org_a",
+						teamId: "T0123",
+						teamName: "Acme",
+						botToken: "xoxb-secret-token",
+						mapleApiKey: "maple_ak_secret",
+					})
+
+					// When the dedicated token is set, the shared token is NOT accepted.
+					const shared = yield* get(handler, "T0123", "Bearer maple_svc_shared-secret-token")
+					assert.strictEqual(shared.status, 401)
+				}),
+			)
+			// Building testDb.layer (provided below) applies the migrations before
+			// the raw-SQL insert above runs.
+		}).pipe(Effect.provide(testDb.layer))
+	})
+
+	it.effect("falls back to INTERNAL_SERVICE_TOKEN when the Slack-specific token is unset", () => {
+		const testDb = createTestDb(trackedDbs)
+		return Effect.gen(function* () {
+			yield* Effect.promise(() =>
+				insertWorkspace(testDb, {
+					id: "sw_2",
+					orgId: "org_b",
+					teamId: "T0999",
+					teamName: "Beta",
+					botToken: "xoxb-b",
+					apiKey: "maple_ak_b",
+				}),
+			)
+			yield* withHandler(
+				testDb,
+				{ shared: "shared-only-token" },
+				Effect.fnUntraced(function* (handler) {
+					const ok = yield* get(handler, "T0999", "Bearer maple_svc_shared-only-token")
+					assert.strictEqual(ok.status, 200)
+				}),
+			)
+		}).pipe(Effect.provide(testDb.layer))
+	})
+
+	it.effect("rejects bad or missing credentials with 401", () => {
+		const testDb = createTestDb(trackedDbs)
+		return withHandler(
+			testDb,
+			{ slack: "slack-secret-token" },
+			Effect.fnUntraced(function* (handler) {
+				// Wrong token of the SAME length (timingSafeEqual path).
+				const wrong = yield* get(handler, "T0123", `Bearer maple_svc_${"x".repeat("slack-secret-token".length)}`)
+				assert.strictEqual(wrong.status, 401)
+
+				// Length mismatch must 401 cleanly, not throw out of timingSafeEqual.
+				const short = yield* get(handler, "T0123", "Bearer maple_svc_nope")
+				assert.strictEqual(short.status, 401)
+
+				// Missing the maple_svc_ prefix.
+				const unprefixed = yield* get(handler, "T0123", "Bearer slack-secret-token")
+				assert.strictEqual(unprefixed.status, 401)
+
+				// Wrong scheme / missing header.
+				const basic = yield* get(handler, "T0123", "Basic maple_svc_slack-secret-token")
+				assert.strictEqual(basic.status, 401)
+				const missing = yield* get(handler, "T0123")
+				assert.strictEqual(missing.status, 401)
+			}),
+		)
+	})
+
+	it.effect("rejects every request with 401 when no internal token is configured", () => {
+		const testDb = createTestDb(trackedDbs)
+		return withHandler(
+			testDb,
+			{},
+			Effect.fnUntraced(function* (handler) {
+				const response = yield* get(handler, "T0123", "Bearer maple_svc_anything")
+				assert.strictEqual(response.status, 401)
+				const text = yield* Effect.promise(() => response.text())
+				assert.include(text, "not configured")
+			}),
+		)
+	})
+
+	it.effect("returns 404 for unknown or revoked teams and 400 for an invalid teamId", () => {
+		const testDb = createTestDb(trackedDbs)
+		return Effect.gen(function* () {
+			yield* Effect.promise(() =>
+				insertWorkspace(testDb, {
+					id: "sw_3",
+					orgId: "org_c",
+					teamId: "T-revoked",
+					teamName: "Gone",
+					botToken: "xoxb-c",
+					apiKey: "maple_ak_c",
+					revoked: true,
+				}),
+			)
+			yield* withHandler(
+				testDb,
+				{ slack: "slack-secret-token" },
+				Effect.fnUntraced(function* (handler) {
+					const bearer = "Bearer maple_svc_slack-secret-token"
+
+					const unknown = yield* get(handler, "T-unknown", bearer)
+					assert.strictEqual(unknown.status, 404)
+
+					const revoked = yield* get(handler, "T-revoked", bearer)
+					assert.strictEqual(revoked.status, 404)
+
+					// "%20" decodes to a lone space — fails the trimmed/non-empty check.
+					const invalid = yield* get(handler, "%20", bearer)
+					assert.strictEqual(invalid.status, 400)
+				}),
+			)
+		}).pipe(Effect.provide(testDb.layer))
+	})
+})
diff --git a/apps/api/src/routes/slack-integration.http.ts b/apps/api/src/routes/slack-integration.http.ts
index 92e7030c9..d32bdb86b 100644
--- a/apps/api/src/routes/slack-integration.http.ts
+++ b/apps/api/src/routes/slack-integration.http.ts
@@ -1,8 +1,12 @@
 import { HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/unstable/http"
-import { Effect, Option, Redacted } from "effect"
+import { Effect, Option, Redacted, Schema } from "effect"
 import { timingSafeEqual } from "node:crypto"
 import { Env } from "../lib/Env"
-import { SlackIntegrationService, SLACK_CALLBACK_PATH } from "../services/SlackIntegrationService"
+import {
+	SlackIntegrationService,
+	SlackBotResolutionResponseSchema,
+	SLACK_CALLBACK_PATH,
+} from "../services/SlackIntegrationService"
 
 const INTERNAL_SERVICE_PREFIX = "maple_svc_"
 
@@ -34,7 +38,7 @@ export const SlackCallbackRouter = HttpRouter.use((router) =>
 		) {
 			const urlOption = Option.liftThrowable(() => new URL(req.url, "http://localhost"))()
 			if (Option.isNone(urlOption)) {
-				return redirect({ slack: "error", message: "Malformed callback URL" })
+				return redirect({ slack: "error", slack_message: "Malformed callback URL" })
 			}
 			const url = urlOption.value
 			const code = url.searchParams.get("code")
@@ -42,10 +46,10 @@ export const SlackCallbackRouter = HttpRouter.use((router) =>
 			const oauthError = url.searchParams.get("error")
 
 			if (oauthError) {
-				return redirect({ slack: "error", message: oauthError })
+				return redirect({ slack: "error", slack_message: oauthError })
 			}
 			if (!code || !state) {
-				return redirect({ slack: "error", message: "Missing code or state in callback" })
+				return redirect({ slack: "error", slack_message: "Missing code or state in callback" })
 			}
 
 			return yield* slack.completeInstall(code, state).pipe(
@@ -58,21 +62,21 @@ export const SlackCallbackRouter = HttpRouter.use((router) =>
 				Effect.map((result) =>
 					redirect({
 						slack: "connected",
-						...(result.teamName ? { team: result.teamName } : {}),
+						...(result.teamName ? { slack_team: result.teamName } : {}),
 					}),
 				),
 				Effect.catchTags({
 					"@maple/http/errors/IntegrationsValidationError": (error) =>
-						Effect.succeed(redirect({ slack: "error", message: error.message })),
+						Effect.succeed(redirect({ slack: "error", slack_message: error.message })),
 					"@maple/http/errors/IntegrationsForbiddenError": (error) =>
-						Effect.succeed(redirect({ slack: "error", message: error.message })),
+						Effect.succeed(redirect({ slack: "error", slack_message: error.message })),
 					"@maple/http/errors/IntegrationsUpstreamError": () =>
 						Effect.succeed(
-							redirect({ slack: "error", message: "Failed to complete the Slack connection" }),
+							redirect({ slack: "error", slack_message: "Failed to complete the Slack connection" }),
 						),
 					"@maple/http/errors/IntegrationsPersistenceError": () =>
 						Effect.succeed(
-							redirect({ slack: "error", message: "Failed to complete the Slack connection" }),
+							redirect({ slack: "error", slack_message: "Failed to complete the Slack connection" }),
 						),
 				}),
 			)
@@ -106,11 +110,19 @@ const isValidServiceBearer = (
 	)
 }
 
+/** Non-empty, trimmed `:teamId` path param. */
+const decodeTeamIdParam = Schema.decodeUnknownOption(
+	Schema.String.pipe(Schema.check(Schema.isMinLength(1), Schema.isTrimmed())),
+)
+
+const encodeBotResolution = Schema.encodeUnknownEffect(SlackBotResolutionResponseSchema)
+
 /**
  * Internal endpoint for the Railway-hosted Slack bot. Given a Slack `teamId`,
  * returns the bound org's decrypted bot token + minted Maple API key so the bot
- * can act on the org's behalf. Guarded by the shared internal-service token
- * (`Authorization: Bearer maple_svc_<INTERNAL_SERVICE_TOKEN>`).
+ * can act on the org's behalf. Guarded by a dedicated internal-service token
+ * (`Authorization: Bearer maple_svc_<SLACK_INTERNAL_SERVICE_TOKEN>`), falling
+ * back to the shared `INTERNAL_SERVICE_TOKEN` when the dedicated one is unset.
  *
  * Response contract (FIXED — the bot is built against it):
  *   200 → { orgId, teamId, teamName, botToken, mapleApiKey }
@@ -120,37 +132,53 @@ export const SlackInternalRouter = HttpRouter.use((router) =>
 	Effect.gen(function* () {
 		const slack = yield* SlackIntegrationService
 		const env = yield* Env
-		const internalToken = Option.match(env.INTERNAL_SERVICE_TOKEN, {
-			onNone: () => undefined,
-			onSome: Redacted.value,
-		})
+		// Prefer the Slack-bot-specific secret so the Railway bot can hold a token
+		// distinct from the MCP-internal one; fall back to the shared token.
+		const internalToken = Option.match(
+			Option.orElse(env.SLACK_INTERNAL_SERVICE_TOKEN, () => env.INTERNAL_SERVICE_TOKEN),
+			{
+				onNone: () => undefined,
+				onSome: Redacted.value,
+			},
+		)
+
+		const logAccess = (teamId: string, outcome: "found" | "not-found" | "unauthorized") =>
+			Effect.logInfo("Slack internal resolve access", { teamId, outcome })
 
 		const handle = Effect.fn("slack.internalResolve")(function* (
 			req: HttpServerRequest.HttpServerRequest,
 		) {
-			if (!internalToken) return errorText("Internal service token is not configured", 401)
+			const params = yield* HttpRouter.params
+			const teamIdOption = decodeTeamIdParam(
+				typeof params.teamId === "string" ? decodeURIComponent(params.teamId) : undefined,
+			)
+			const teamId = Option.getOrElse(teamIdOption, () => "")
+			if (!internalToken) {
+				yield* logAccess(teamId, "unauthorized")
+				return errorText("Internal service token is not configured", 401)
+			}
 			if (!isValidServiceBearer(req.headers.authorization, internalToken)) {
+				yield* logAccess(teamId, "unauthorized")
 				return errorText("Unauthorized", 401)
 			}
-			const url = Option.liftThrowable(() => new URL(req.url, "http://localhost"))()
-			const pathname = Option.match(url, { onNone: () => "", onSome: (u) => u.pathname })
-			const teamId = decodeURIComponent(pathname.split("/").pop() ?? "")
-			if (!teamId) return errorText("Missing teamId", 400)
+			if (Option.isNone(teamIdOption)) return errorText("Missing teamId", 400)
 
-			const resolution = yield* slack.resolveForBot(teamId).pipe(
+			const resolution = yield* slack.resolveForBot(teamIdOption.value).pipe(
+				Effect.map(Option.some),
 				Effect.catchTag("@maple/http/errors/IntegrationsNotConnectedError", () =>
-					Effect.succeed(null),
+					Effect.succeedNone,
 				),
 			)
-			if (resolution === null) {
-				return errorText("No active Slack installation for this team", 404)
-			}
-			return yield* HttpServerResponse.json({
-				orgId: resolution.orgId,
-				teamId: resolution.teamId,
-				teamName: resolution.teamName,
-				botToken: resolution.botToken,
-				mapleApiKey: resolution.mapleApiKey,
+			return yield* Option.match(resolution, {
+				onNone: () =>
+					logAccess(teamId, "not-found").pipe(
+						Effect.as(errorText("No active Slack installation for this team", 404)),
+					),
+				onSome: (resolved) =>
+					logAccess(teamId, "found").pipe(
+						Effect.andThen(encodeBotResolution(resolved).pipe(Effect.orDie)),
+						Effect.flatMap((encoded) => HttpServerResponse.json(encoded)),
+					),
 			})
 		})
 
diff --git a/apps/api/src/routes/v2/integrations-origin.test.ts b/apps/api/src/routes/v2/integrations-origin.test.ts
new file mode 100644
index 000000000..18d8ad29c
--- /dev/null
+++ b/apps/api/src/routes/v2/integrations-origin.test.ts
@@ -0,0 +1,62 @@
+import type { HttpServerRequest } from "effect/unstable/http"
+import { assert, describe, it } from "@effect/vitest"
+import { resolveRequestOrigin } from "./integrations.http"
+
+/**
+ * `resolveRequestOrigin` is a pure header/url function, so it is tested with a
+ * minimal structural fake — it only reads `headers` and `url`.
+ */
+const fakeRequest = (
+	headers: Record<string, string | undefined>,
+	url = "/v2/integrations/slack/install",
+): HttpServerRequest.HttpServerRequest =>
+	({ headers, url }) as unknown as HttpServerRequest.HttpServerRequest
+
+describe("resolveRequestOrigin", () => {
+	it("uses x-forwarded-host and x-forwarded-proto when both are present", () => {
+		const origin = resolveRequestOrigin(
+			fakeRequest({ "x-forwarded-host": "api.maple.dev", "x-forwarded-proto": "https", host: "internal:8787" }),
+		)
+		assert.strictEqual(origin, "https://api.maple.dev")
+	})
+
+	it("prefers the forwarded host over the direct host header", () => {
+		const origin = resolveRequestOrigin(
+			fakeRequest({ "x-forwarded-host": "public.example.com", host: "10.0.0.5:8080" }),
+		)
+		assert.strictEqual(origin, "https://public.example.com")
+	})
+
+	it("respects a forwarded proto of http even for a non-localhost host", () => {
+		const origin = resolveRequestOrigin(
+			fakeRequest({ "x-forwarded-host": "api.maple.dev", "x-forwarded-proto": "http" }),
+		)
+		assert.strictEqual(origin, "http://api.maple.dev")
+	})
+
+	it("falls back to the host header and defaults to https for non-local hosts", () => {
+		const origin = resolveRequestOrigin(fakeRequest({ host: "api.maple.dev" }))
+		assert.strictEqual(origin, "https://api.maple.dev")
+	})
+
+	it("defaults to http for localhost and 127.* hosts, preserving the port", () => {
+		assert.strictEqual(resolveRequestOrigin(fakeRequest({ host: "localhost:3472" })), "http://localhost:3472")
+		assert.strictEqual(resolveRequestOrigin(fakeRequest({ host: "127.0.0.1:3472" })), "http://127.0.0.1:3472")
+		assert.strictEqual(resolveRequestOrigin(fakeRequest({ host: "localhost" })), "http://localhost")
+	})
+
+	it("preserves an explicit port on a non-local host", () => {
+		const origin = resolveRequestOrigin(fakeRequest({ host: "api.staging.maple.dev:8443" }))
+		assert.strictEqual(origin, "https://api.staging.maple.dev:8443")
+	})
+
+	it("falls back to parsing an absolute request url when no host headers exist", () => {
+		const origin = resolveRequestOrigin(fakeRequest({}, "https://api.example.com:8443/v2/integrations/slack"))
+		assert.strictEqual(origin, "https://api.example.com:8443")
+	})
+
+	it("returns an empty origin when no host is known and the url is relative", () => {
+		const origin = resolveRequestOrigin(fakeRequest({}, "/v2/integrations/slack/install"))
+		assert.strictEqual(origin, "")
+	})
+})
diff --git a/apps/api/src/routes/v2/integrations.http.ts b/apps/api/src/routes/v2/integrations.http.ts
index 72beb2cc2..27b4c5153 100644
--- a/apps/api/src/routes/v2/integrations.http.ts
+++ b/apps/api/src/routes/v2/integrations.http.ts
@@ -9,6 +9,7 @@ import type {
 } from "@maple/domain/http/v2"
 import {
 	MapleApiV2,
+	isoTimestampOrNull,
 	notFound,
 	permissionError,
 	serviceUnavailable,
@@ -19,7 +20,7 @@ import { requireAdmin } from "../../lib/auth"
 import type { SlackChannelSummary, SlackInstallStatus } from "../../services/SlackIntegrationService"
 import { SLACK_CALLBACK_PATH, SlackIntegrationService } from "../../services/SlackIntegrationService"
 
-const resolveRequestOrigin = (req: HttpServerRequest.HttpServerRequest): string => {
+export const resolveRequestOrigin = (req: HttpServerRequest.HttpServerRequest): string => {
 	const headers = req.headers as Record<string, string | undefined>
 	const forwardedHost = headers["x-forwarded-host"]
 	const forwardedProto = headers["x-forwarded-proto"]
@@ -41,7 +42,7 @@ const toStatus = (status: SlackInstallStatus): V2SlackIntegrationStatus => ({
 	team_id: status.teamId,
 	team_name: status.teamName,
 	bot_user_id: status.botUserId,
-	installed_at: status.installedAt != null ? new Date(status.installedAt).toISOString() : null,
+	installed_at: isoTimestampOrNull(status.installedAt),
 })
 
 const toChannelList = (channels: ReadonlyArray<SlackChannelSummary>): V2SlackChannelList => ({
@@ -63,7 +64,16 @@ export const HttpV2SlackIntegrationsLive = HttpApiBuilder.group(MapleApiV2, "sla
 				Effect.gen(function* () {
 					const tenant = yield* CurrentTenant.Context
 					const status = yield* slack.getStatus(tenant.orgId).pipe(
-						Effect.mapError(() => serviceUnavailable("Slack integration status is unavailable")),
+						Effect.tapError((error) =>
+							Effect.logError("Slack integration status failed", {
+								tag: error._tag,
+								message: error.message,
+							}),
+						),
+						Effect.catchTags({
+							"@maple/http/errors/IntegrationsPersistenceError": (error) =>
+								Effect.fail(serviceUnavailable(error.message)),
+						}),
 					)
 					return toStatus(status)
 				}),
@@ -102,7 +112,16 @@ export const HttpV2SlackIntegrationsLive = HttpApiBuilder.group(MapleApiV2, "sla
 						),
 					)
 					yield* slack.uninstall(tenant.orgId).pipe(
-						Effect.mapError(() => serviceUnavailable("Failed to uninstall the Slack app")),
+						Effect.tapError((error) =>
+							Effect.logError("Slack integration uninstall failed", {
+								tag: error._tag,
+								message: error.message,
+							}),
+						),
+						Effect.catchTags({
+							"@maple/http/errors/IntegrationsPersistenceError": (error) =>
+								Effect.fail(serviceUnavailable(error.message)),
+						}),
 					)
 					return {
 						object: "slack_integration" as const,
@@ -119,8 +138,6 @@ export const HttpV2SlackIntegrationsLive = HttpApiBuilder.group(MapleApiV2, "sla
 								Effect.fail(notFound(error.message)),
 							"@maple/http/errors/IntegrationsUpstreamError": (error) =>
 								Effect.fail(upstreamError("slack_upstream_error", error.message)),
-							"@maple/http/errors/IntegrationsValidationError": (error) =>
-								Effect.fail(serviceUnavailable(error.message)),
 							"@maple/http/errors/IntegrationsPersistenceError": (error) =>
 								Effect.fail(serviceUnavailable(error.message)),
 						}),
diff --git a/apps/api/src/routes/v2/v2-test-support.ts b/apps/api/src/routes/v2/v2-test-support.ts
index f48621861..c94e557d7 100644
--- a/apps/api/src/routes/v2/v2-test-support.ts
+++ b/apps/api/src/routes/v2/v2-test-support.ts
@@ -48,16 +48,23 @@ import {
  * exercise it. Provided directly onto the group layer below so it leaks no
  * requirement into the harnesses.
  */
-const SlackIntegrationServiceStubLayer = Layer.succeed(SlackIntegrationService, {
-	startInstall: () => Effect.die(new Error("SlackIntegrationService is not available in this test harness")),
-	completeInstall: () =>
-		Effect.die(new Error("SlackIntegrationService is not available in this test harness")),
-	getStatus: () => Effect.die(new Error("SlackIntegrationService is not available in this test harness")),
-	uninstall: () => Effect.die(new Error("SlackIntegrationService is not available in this test harness")),
-	listChannels: () => Effect.die(new Error("SlackIntegrationService is not available in this test harness")),
-	resolveForBot: () =>
-		Effect.die(new Error("SlackIntegrationService is not available in this test harness")),
-})
+const SlackIntegrationServiceStubLayer = Layer.succeed(
+	SlackIntegrationService,
+	SlackIntegrationService.of({
+		startInstall: () =>
+			Effect.die(new Error("SlackIntegrationService is not available in this test harness")),
+		completeInstall: () =>
+			Effect.die(new Error("SlackIntegrationService is not available in this test harness")),
+		getStatus: () =>
+			Effect.die(new Error("SlackIntegrationService is not available in this test harness")),
+		uninstall: () =>
+			Effect.die(new Error("SlackIntegrationService is not available in this test harness")),
+		listChannels: () =>
+			Effect.die(new Error("SlackIntegrationService is not available in this test harness")),
+		resolveForBot: () =>
+			Effect.die(new Error("SlackIntegrationService is not available in this test harness")),
+	}),
+)
 
 export const AllV2GroupLayersLive = Layer.mergeAll(
 	HttpV2ApiKeysLive,
diff --git a/apps/api/src/services/AlertDeliveryDispatch.test.ts b/apps/api/src/services/AlertDeliveryDispatch.test.ts
index 9af41a5c3..c140b59fb 100644
--- a/apps/api/src/services/AlertDeliveryDispatch.test.ts
+++ b/apps/api/src/services/AlertDeliveryDispatch.test.ts
@@ -1,7 +1,8 @@
 import type { AlertDestinationRow } from "@maple/db"
 import { AlertDeliveryError, AlertDestinationId } from "@maple/domain/http"
 import { assert, describe, it } from "@effect/vitest"
-import { Effect, Schema } from "effect"
+import { Effect, Fiber, Schema } from "effect"
+import { TestClock } from "effect/testing"
 import {
 	buildAlertChatUrl,
 	buildDiscordEmbedsFromTemplate,
@@ -266,6 +267,71 @@ describe("dispatchDelivery", () => {
 		}),
 	)
 
+	it.effect("slack-bot: a hung fetch times out via the Clock and fails typed", () =>
+		Effect.gen(function* () {
+			// Never settles — only the Clock-driven timeoutOrElse can end this.
+			const fetchFn: typeof fetch = () => new Promise<Response>(() => {})
+
+			const fiber = yield* Effect.forkChild(
+				Effect.flip(
+					dispatchDelivery(slackBotContext, "{}", fetchFn, 5_000, LINK, CHAT, slackTokenDeps()),
+				),
+				{ startImmediately: true },
+			)
+			yield* TestClock.adjust("6 seconds")
+			const error = yield* Fiber.join(fiber)
+
+			assert.instanceOf(error, AlertDeliveryError)
+			assert.strictEqual(error.destinationType, "slack-bot")
+			assert.include(error.message, "timed out after 5000ms")
+		}),
+	)
+
+	it.effect("slack-bot: a non-JSON 200 response fails typed", () =>
+		Effect.gen(function* () {
+			const fetchFn: typeof fetch = async () => new Response("gateway says hi", { status: 200 })
+
+			const error = yield* Effect.flip(
+				dispatchDelivery(slackBotContext, "{}", fetchFn, 5_000, LINK, CHAT, slackTokenDeps()),
+			)
+
+			assert.instanceOf(error, AlertDeliveryError)
+			assert.strictEqual(error.destinationType, "slack-bot")
+			assert.include(error.message, "non-JSON response")
+		}),
+	)
+
+	it.effect("slack-bot: a JSON payload that fails the response schema fails typed", () =>
+		Effect.gen(function* () {
+			// Valid JSON, but `ok` is a string — SlackPostMessageResponseSchema rejects it.
+			const fetchFn: typeof fetch = async () =>
+				new Response(JSON.stringify({ ok: "yes", ts: 123 }), { status: 200 })
+
+			const error = yield* Effect.flip(
+				dispatchDelivery(slackBotContext, "{}", fetchFn, 5_000, LINK, CHAT, slackTokenDeps()),
+			)
+
+			assert.instanceOf(error, AlertDeliveryError)
+			assert.strictEqual(error.destinationType, "slack-bot")
+			assert.include(error.message, "unexpected response payload")
+		}),
+	)
+
+	it.effect("slack-bot: an HTTP-level failure surfaces the status and body", () =>
+		Effect.gen(function* () {
+			const fetchFn: typeof fetch = async () => new Response("upstream exploded", { status: 500 })
+
+			const error = yield* Effect.flip(
+				dispatchDelivery(slackBotContext, "{}", fetchFn, 5_000, LINK, CHAT, slackTokenDeps()),
+			)
+
+			assert.instanceOf(error, AlertDeliveryError)
+			assert.strictEqual(error.destinationType, "slack-bot")
+			assert.include(error.message, "Slack delivery failed with 500")
+			assert.include(error.message, "upstream exploded")
+		}),
+	)
+
 	it.effect("slack-bot: fails when the org has no active Slack installation", () =>
 		Effect.gen(function* () {
 			const fetchFn: typeof fetch = async () => {
@@ -318,6 +384,13 @@ describe("dispatchDelivery", () => {
 					Effect.sync(() => {
 						sent.push({ to, subject, html })
 					}),
+				resolveSlackBotToken: () =>
+					Effect.fail(
+						new AlertDeliveryError({
+							message: "resolveSlackBotToken not available in this test",
+							destinationType: "slack-bot",
+						}),
+					),
 			}
 
 			const result = yield* dispatchDelivery(emailContext, "{}", failingFetch, 5_000, LINK, CHAT, deps)
diff --git a/apps/api/src/services/AlertDeliveryDispatch.ts b/apps/api/src/services/AlertDeliveryDispatch.ts
index d500bfaf1..b2bbdad02 100644
--- a/apps/api/src/services/AlertDeliveryDispatch.ts
+++ b/apps/api/src/services/AlertDeliveryDispatch.ts
@@ -8,7 +8,7 @@ import {
 	type AlertSignalType,
 } from "@maple/domain/http"
 import type { AlertDestinationRow } from "@maple/db"
-import { Clock, Duration, Effect, Match, Option } from "effect"
+import { Clock, Duration, Effect, Match, Option, Schema } from "effect"
 import type { EnrichedDestinationSecretConfig } from "./AlertDestinationHydration"
 import { safeFetch } from "../lib/url-validator"
 // Circular with ./alert-email (it imports our formatting helpers); safe — both
@@ -247,6 +247,18 @@ export const formatObservedSummary = (context: ObservedContext): string => {
 const makeDeliveryError = (message: string, destinationType?: AlertDestinationType) =>
 	new AlertDeliveryError({ message, destinationType })
 
+/**
+ * Slack Web API `chat.postMessage` response envelope. Slack returns HTTP 200
+ * with `{ ok: false, error }` on logical failures, so the body is the source
+ * of truth.
+ */
+const SlackPostMessageResponseSchema = Schema.Struct({
+	ok: Schema.optionalKey(Schema.Boolean),
+	error: Schema.optionalKey(Schema.String),
+	ts: Schema.optionalKey(Schema.String),
+})
+const decodeSlackPostMessageResponse = Schema.decodeUnknownEffect(SlackPostMessageResponseSchema)
+
 const runTimedFetch = <A>(
 	destinationType: AlertDestinationType,
 	label: string,
@@ -684,11 +696,19 @@ export const dispatchDelivery = (
 						// Slack Web API returns HTTP 200 with `{ ok: false, error }` on
 						// logical failures, so the JSON body — not the status — is the
 						// source of truth.
-						const payload = yield* Effect.tryPromise({
-							try: () => response.json() as Promise<{ ok?: boolean; error?: string; ts?: string }>,
+						const rawPayload = yield* Effect.tryPromise({
+							try: () => response.json(),
 							catch: () =>
 								makeDeliveryError("Slack returned a non-JSON response", "slack-bot"),
 						})
+						const payload = yield* decodeSlackPostMessageResponse(rawPayload).pipe(
+							Effect.mapError((error) =>
+								makeDeliveryError(
+									`Slack returned an unexpected response payload: ${error.message}`,
+									"slack-bot",
+								),
+							),
+						)
 						if (!payload.ok) {
 							const error = payload.error ?? "unknown_error"
 							const message =
diff --git a/apps/api/src/services/AlertsService.test.ts b/apps/api/src/services/AlertsService.test.ts
index fb6f84495..7947cdbab 100644
--- a/apps/api/src/services/AlertsService.test.ts
+++ b/apps/api/src/services/AlertsService.test.ts
@@ -30,6 +30,7 @@ import { EmailService } from "../lib/EmailService"
 import { OrgMembersError, OrgMembersService, type OrgMember } from "./OrgMembersService"
 import { QueryEngineService } from "./QueryEngineService"
 import { cleanupTestDbs, createTestDb, executeSql, queryFirstRow, type TestDb } from "../lib/test-pglite"
+import { decryptAes256Gcm } from "../lib/Crypto"
 
 const trackedDbs: TestDb[] = []
 
@@ -1824,6 +1825,98 @@ describe("AlertsService", () => {
 		)
 	})
 
+	it.effect("slack-bot update merges channel fields into the stored secret config", () => {
+		const testDb = createTestDb(trackedDbs)
+		// Mirrors MAPLE_INGEST_KEY_ENCRYPTION_KEY in makeConfig() above.
+		const secretKey = Buffer.alloc(32, 5)
+		return Effect.gen(function* () {
+			const alerts = yield* AlertsService
+			const orgId = asOrgId("org_slackbot_update")
+			const userId = asUserId("user_slackbot_update")
+
+			const created = yield* alerts.createDestination(orgId, userId, adminRoles, {
+				type: "slack-bot",
+				name: "Slack bot",
+				enabled: true,
+				channelId: "C111ORIG",
+				channelName: "alerts",
+			})
+			assert.strictEqual(created.type, "slack-bot")
+			assert.strictEqual(created.summary, "#alerts")
+
+			const readSecret = Effect.fn(function* () {
+				const row = yield* Effect.promise(() =>
+					queryFirstRow<{ secret_ciphertext: string; secret_iv: string; secret_tag: string }>(
+						testDb,
+						"select secret_ciphertext, secret_iv, secret_tag from alert_destinations where id = $1",
+						[created.id],
+					),
+				)
+				assert.isDefined(row)
+				const json = yield* decryptAes256Gcm(
+					{ ciphertext: row!.secret_ciphertext, iv: row!.secret_iv, tag: row!.secret_tag },
+					secretKey,
+					(message) => new Error(message),
+				)
+				return JSON.parse(json) as { type: string; channelId: string; channelName: string | null }
+			})
+
+			// A name-only update (channelId + channelName undefined) keeps both
+			// stored channel fields untouched.
+			const renamed = yield* alerts.updateDestination(orgId, userId, adminRoles, created.id, {
+				type: "slack-bot",
+				name: "Renamed bot",
+			})
+			assert.strictEqual(renamed.name, "Renamed bot")
+			assert.strictEqual(renamed.summary, "#alerts")
+			assert.deepStrictEqual(yield* readSecret(), {
+				type: "slack-bot",
+				channelId: "C111ORIG",
+				channelName: "alerts",
+			})
+
+			// A provided channelName replaces the stored one; the omitted channelId
+			// survives.
+			const relabeled = yield* alerts.updateDestination(orgId, userId, adminRoles, created.id, {
+				type: "slack-bot",
+				channelName: "incidents",
+			})
+			assert.strictEqual(relabeled.summary, "#incidents")
+			assert.strictEqual(relabeled.channelLabel, "#incidents")
+			assert.deepStrictEqual(yield* readSecret(), {
+				type: "slack-bot",
+				channelId: "C111ORIG",
+				channelName: "incidents",
+			})
+
+			// A blank channelId falls back to the stored value instead of wiping it.
+			yield* alerts.updateDestination(orgId, userId, adminRoles, created.id, {
+				type: "slack-bot",
+				channelId: "   ",
+			})
+			assert.deepStrictEqual(yield* readSecret(), {
+				type: "slack-bot",
+				channelId: "C111ORIG",
+				channelName: "incidents",
+			})
+
+			// A real channelId replaces the stored one; channelName stays.
+			yield* alerts.updateDestination(orgId, userId, adminRoles, created.id, {
+				type: "slack-bot",
+				channelId: "C222NEXT",
+			})
+			assert.deepStrictEqual(yield* readSecret(), {
+				type: "slack-bot",
+				channelId: "C222NEXT",
+				channelName: "incidents",
+			})
+		}).pipe(
+			Effect.provide(
+				makeLayer(testDb, makeWarehouseStub({ tracesAggregateRows: emptyWarehouseRows })),
+			),
+		)
+	})
+
 	it.effect("creates an email destination and delivers a test email to every member", () => {
 		const testDb = createTestDb(trackedDbs)
 		const sent: Array<{ to: string; subject: string; html: string }> = []
diff --git a/apps/api/src/services/AlertsService.ts b/apps/api/src/services/AlertsService.ts
index ac2448960..b78924772 100644
--- a/apps/api/src/services/AlertsService.ts
+++ b/apps/api/src/services/AlertsService.ts
@@ -2158,16 +2158,17 @@ export class AlertsService extends Context.Service<AlertsService, AlertsServiceS
 											: ""),
 								} satisfies DestinationSecretConfig,
 							}),
-						"slack-bot": (r) =>
-							Effect.succeed({
+						"slack-bot": (r) => {
+							const channelName = normalizeOptionalString(r.channelName)
+							return Effect.succeed({
 								nextPublicConfig: {
 									summary:
-										normalizeOptionalString(r.channelName) != null
-											? `#${normalizeOptionalString(r.channelName)}`
+										channelName != null
+											? `#${channelName}`
 											: hydrated.publicConfig.summary,
 									channelLabel:
-										normalizeOptionalString(r.channelName) != null
-											? `#${normalizeOptionalString(r.channelName)}`
+										channelName != null
+											? `#${channelName}`
 											: hydrated.publicConfig.channelLabel,
 								} satisfies DestinationPublicConfig,
 								nextSecretConfig: {
@@ -2182,9 +2183,10 @@ export class AlertsService extends Context.Service<AlertsService, AlertsServiceS
 											? hydrated.secretConfig.type === "slack-bot"
 												? hydrated.secretConfig.channelName
 												: null
-											: normalizeOptionalString(r.channelName) ?? null,
+											: channelName ?? null,
 								} satisfies DestinationSecretConfig,
-							}),
+							})
+						},
 						pagerduty: (r) =>
 							Effect.succeed({
 								nextPublicConfig: hydrated.publicConfig,
diff --git a/apps/api/src/services/SlackIntegrationService.test.ts b/apps/api/src/services/SlackIntegrationService.test.ts
index 38c246a14..cb8eed515 100644
--- a/apps/api/src/services/SlackIntegrationService.test.ts
+++ b/apps/api/src/services/SlackIntegrationService.test.ts
@@ -1,6 +1,7 @@
 import { createCipheriv, randomBytes } from "node:crypto"
 import { afterEach, assert, describe, it } from "@effect/vitest"
 import { ConfigProvider, Effect, Layer, Schema } from "effect"
+import { TestClock } from "effect/testing"
 import { FetchHttpClient } from "effect/unstable/http"
 import { OrgId, UserId } from "@maple/domain/http"
 import { Env } from "../lib/Env"
@@ -46,14 +47,38 @@ const makeConfig = (slackConfigured = true) =>
 		}),
 	)
 
-const makeLayer = (testDb: TestDb, slackConfigured = true) =>
+const makeLayer = (
+	testDb: TestDb,
+	slackConfigured = true,
+	apiKeysLayer: typeof ApiKeysService.layer = ApiKeysService.layer,
+) =>
 	SlackIntegrationService.layer.pipe(
-		Layer.provide(Layer.mergeAll(ApiKeysService.layer, OAuthStateRepository.layer)),
+		Layer.provide(Layer.mergeAll(apiKeysLayer, OAuthStateRepository.layer)),
 		Layer.provide(testDb.layer),
 		Layer.provide(Env.layer),
 		Layer.provide(makeConfig(slackConfigured)),
 	)
 
+/** Mirror of the service's (unexported) `SLACK_STATE_TTL_MS` — 10 minutes. */
+const SLACK_STATE_TTL_MS = 10 * 60_000
+
+/**
+ * Wrap the real ApiKeysService so `create` runs `inject` first. `apiKeys.create`
+ * is the only seam between completeInstall's cross-org pre-check and its
+ * transaction, so this lets a test interleave a "concurrent" write there and
+ * exercise the transactional (setWhere) race path.
+ */
+const apiKeysWithInjectedCreate = (inject: () => Promise<void>) =>
+	Layer.effect(
+		ApiKeysService,
+		Effect.gen(function* () {
+			const real = yield* ApiKeysService
+			const create: typeof real.create = (...args) =>
+				Effect.promise(inject).pipe(Effect.flatMap(() => real.create(...args)))
+			return { ...real, create } as typeof real
+		}),
+	).pipe(Layer.provide(ApiKeysService.layer)) as typeof ApiKeysService.layer
+
 /** The pure dispatch helper needs only Database — build a minimal layer for it. */
 const databaseLayer = (testDb: TestDb) => testDb.layer
 
@@ -82,6 +107,28 @@ const slackOAuthFetch = (teamRef: { current: { id: string; name: string } }): ty
 		return Promise.reject(new Error(`unexpected fetch: ${url}`))
 	}) as typeof globalThis.fetch
 
+const OAUTH_URL = "https://slack.com/api/oauth.v2.access"
+const CONVERSATIONS_URL = "https://slack.com/api/conversations.list"
+
+/** A fetch stub scoped to one Slack endpoint; anything else rejects. */
+const slackApiFetch = (
+	prefix: string,
+	respond: (url: string, call: number) => Response | Promise<Response>,
+): typeof globalThis.fetch => {
+	let call = 0
+	return ((input: RequestInfo | URL) => {
+		const url = String(input)
+		if (!url.startsWith(prefix)) return Promise.reject(new Error(`unexpected fetch: ${url}`))
+		return Promise.resolve(respond(url, call++))
+	}) as typeof globalThis.fetch
+}
+
+const withFetch = (
+	testDb: TestDb,
+	fetchImpl: typeof globalThis.fetch,
+	apiKeysLayer?: typeof ApiKeysService.layer,
+) => Layer.mergeAll(makeLayer(testDb, true, apiKeysLayer), Layer.succeed(FetchHttpClient.Fetch, fetchImpl))
+
 const stateFromInstallUrl = (url: string): string => {
 	const state = new URL(url).searchParams.get("state")
 	if (!state) throw new Error("install url missing state")
@@ -175,27 +222,21 @@ describe("SlackIntegrationService", () => {
 		}).pipe(Effect.provide(makeLayer(testDb)))
 	})
 
-	it.effect("completeInstall rejects an expired state (and burns it)", () => {
+	it.effect("completeInstall rejects a state past SLACK_STATE_TTL_MS (and burns it)", () => {
 		const testDb = createTestDb(trackedDbs)
 		return Effect.gen(function* () {
-			yield* Effect.promise(() =>
-				executeSql(
-					testDb,
-					// @effect/vitest it.effect freezes the Clock at epoch 0 (1970), so an
-					// "expired" state must sit before that — use a pre-1970 timestamp.
-					`INSERT INTO oauth_auth_states (state, org_id, provider, initiated_by_user_id, redirect_uri, created_at, expires_at)
-					 VALUES ($1,$2,$3,$4,$5, timestamptz '1969-01-01 00:00:00+00', timestamptz '1969-06-01 00:00:00+00')`,
-					["expired-state", "org_a", "slack", "user_a", "https://cb"],
-				),
-			)
 			const slack = yield* SlackIntegrationService
-			const error = yield* Effect.flip(slack.completeInstall("code_1", "expired-state"))
+			// Create the state through the real flow at the frozen TestClock time,
+			// then advance the clock just past the TTL — the service reads
+			// Clock.currentTimeMillis, so this verifies the actual expiry window.
+			const start = yield* slack.startInstall(asOrgId("org_a"), asUserId("user_a"), "https://cb")
+			const state = stateFromInstallUrl(start.url)
+			yield* TestClock.adjust(SLACK_STATE_TTL_MS + 1)
+			const error = yield* Effect.flip(slack.completeInstall("code_1", state))
 			assert.strictEqual(error._tag, "@maple/http/errors/IntegrationsValidationError")
 			assert.include(error.message, "expired")
 			const remaining = yield* Effect.promise(() =>
-				queryFirstRow(testDb, "SELECT state FROM oauth_auth_states WHERE state = $1", [
-					"expired-state",
-				]),
+				queryFirstRow(testDb, "SELECT state FROM oauth_auth_states WHERE state = $1", [state]),
 			)
 			assert.isUndefined(remaining)
 		}).pipe(Effect.provide(makeLayer(testDb)))
@@ -402,4 +443,395 @@ describe("SlackIntegrationService", () => {
 			assert.isTrue(rejected, "second active row for the same org should violate the unique index")
 		}).pipe(Effect.provide(databaseLayer(testDb)))
 	})
+
+	// --- Cross-org rebind rejection -----------------------------------------
+
+	it.effect("completeInstall rejects binding a team actively installed on another org (pre-check)", () => {
+		const testDb = createTestDb(trackedDbs)
+		const teamRef = { current: { id: "T-shared", name: "Shared" } }
+		return Effect.gen(function* () {
+			const slack = yield* SlackIntegrationService
+
+			// org_a installs T-shared.
+			const s1 = yield* slack.startInstall(asOrgId("org_a"), asUserId("user_a"), "https://cb")
+			yield* slack.completeInstall("code_1", stateFromInstallUrl(s1.url))
+
+			// org_b tries to install the SAME team → forbidden.
+			const s2 = yield* slack.startInstall(asOrgId("org_b"), asUserId("user_b"), "https://cb")
+			const error = yield* Effect.flip(slack.completeInstall("code_2", stateFromInstallUrl(s2.url)))
+			assert.strictEqual(error._tag, "@maple/http/errors/IntegrationsForbiddenError")
+			assert.include(error.message, "different Maple organization")
+
+			// org_a's binding is untouched...
+			const bound = yield* Effect.promise(() =>
+				queryFirstRow<{ org_id: string; revoked_at: string | null }>(
+					testDb,
+					"SELECT org_id, revoked_at FROM slack_workspaces WHERE team_id = 'T-shared'",
+				),
+			)
+			assert.strictEqual(bound?.org_id, "org_a")
+			assert.isNull(bound?.revoked_at)
+
+			// ...and org_b ends up with no active workspace at all.
+			const orgBActive = yield* Effect.promise(() =>
+				queryFirstRow<{ n: number }>(
+					testDb,
+					"SELECT count(*)::int AS n FROM slack_workspaces WHERE org_id = 'org_b' AND revoked_at IS NULL",
+				),
+			)
+			assert.strictEqual(orgBActive?.n, 0)
+			const status = yield* slack.getStatus(asOrgId("org_b"))
+			assert.strictEqual(status.installed, false)
+		}).pipe(Effect.provide(withFetch(testDb, slackOAuthFetch(teamRef))))
+	})
+
+	it.effect("completeInstall rejects a cross-org rebind that lands after the pre-check (transactional race)", () => {
+		const testDb = createTestDb(trackedDbs)
+		const teamRef = { current: { id: "T-race", name: "Race" } }
+		// Injected between the pre-check and the transaction (apiKeys.create is the
+		// only seam in between): a "concurrent" install binds T-race to org_victim.
+		let injected = false
+		const inject = async () => {
+			if (injected) return
+			injected = true
+			await insertWorkspace(testDb, {
+				id: "sw_victim",
+				orgId: "org_victim",
+				teamId: "T-race",
+				teamName: "Victim",
+				botToken: "xoxb-victim",
+				apiKey: "maple_ak_victim",
+			})
+		}
+		return Effect.gen(function* () {
+			// org_b already has an active workspace for a different team — the
+			// aborted transaction must roll back the revoke-others step for it.
+			yield* Effect.promise(() =>
+				insertWorkspace(testDb, {
+					id: "sw_b_old",
+					orgId: "org_b",
+					teamId: "T-old",
+					teamName: "Old",
+					botToken: "xoxb-old",
+					apiKey: "maple_ak_old",
+				}),
+			)
+			const slack = yield* SlackIntegrationService
+			const start = yield* slack.startInstall(asOrgId("org_b"), asUserId("user_b"), "https://cb")
+			const error = yield* Effect.flip(slack.completeInstall("code_r", stateFromInstallUrl(start.url)))
+			assert.strictEqual(error._tag, "@maple/http/errors/IntegrationsForbiddenError")
+			assert.isTrue(injected, "the conflicting row must have been injected mid-install")
+
+			// The victim org's binding is unchanged.
+			const victim = yield* Effect.promise(() =>
+				queryFirstRow<{ org_id: string; revoked_at: string | null }>(
+					testDb,
+					"SELECT org_id, revoked_at FROM slack_workspaces WHERE team_id = 'T-race'",
+				),
+			)
+			assert.strictEqual(victim?.org_id, "org_victim")
+			assert.isNull(victim?.revoked_at)
+
+			// org_b's prior workspace is still active — the in-transaction
+			// revocation rolled back with the aborted upsert.
+			const oldRow = yield* Effect.promise(() =>
+				queryFirstRow<{ revoked_at: string | null }>(
+					testDb,
+					"SELECT revoked_at FROM slack_workspaces WHERE team_id = 'T-old'",
+				),
+			)
+			assert.isNull(oldRow?.revoked_at)
+		}).pipe(Effect.provide(withFetch(testDb, slackOAuthFetch(teamRef), apiKeysWithInjectedCreate(inject))))
+	})
+
+	// --- exchangeCode failure paths (via completeInstall) ---------------------
+
+	it.effect("completeInstall surfaces Slack's ok:false as a validation error carrying Slack's error string", () => {
+		const testDb = createTestDb(trackedDbs)
+		return Effect.gen(function* () {
+			const slack = yield* SlackIntegrationService
+			const start = yield* slack.startInstall(asOrgId("org_a"), asUserId("user_a"), "https://cb")
+			const state = stateFromInstallUrl(start.url)
+			// Boundary check: at exactly the TTL the state is still valid, so the
+			// flow proceeds past expiry and into the (failing) code exchange.
+			yield* TestClock.adjust(SLACK_STATE_TTL_MS)
+			const error = yield* Effect.flip(slack.completeInstall("code_bad", state))
+			assert.strictEqual(error._tag, "@maple/http/errors/IntegrationsValidationError")
+			assert.include(error.message, "invalid_code")
+		}).pipe(
+			Effect.provide(
+				withFetch(
+					testDb,
+					slackApiFetch(OAUTH_URL, () => jsonResponse({ ok: false, error: "invalid_code" })),
+				),
+			),
+		)
+	})
+
+	it.effect("completeInstall maps a non-JSON OAuth response to an upstream error", () => {
+		const testDb = createTestDb(trackedDbs)
+		return Effect.gen(function* () {
+			const slack = yield* SlackIntegrationService
+			const start = yield* slack.startInstall(asOrgId("org_a"), asUserId("user_a"), "https://cb")
+			const error = yield* Effect.flip(slack.completeInstall("code_1", stateFromInstallUrl(start.url)))
+			assert.strictEqual(error._tag, "@maple/http/errors/IntegrationsUpstreamError")
+		}).pipe(
+			Effect.provide(
+				withFetch(
+					testDb,
+					slackApiFetch(
+						OAUTH_URL,
+						() =>
+							new Response("<html>maintenance</html>", {
+								status: 200,
+								headers: { "content-type": "text/html" },
+							}),
+					),
+				),
+			),
+		)
+	})
+
+	it.effect("completeInstall maps an undecodable OAuth payload to an upstream error", () => {
+		const testDb = createTestDb(trackedDbs)
+		return Effect.gen(function* () {
+			const slack = yield* SlackIntegrationService
+			const start = yield* slack.startInstall(asOrgId("org_a"), asUserId("user_a"), "https://cb")
+			const error = yield* Effect.flip(slack.completeInstall("code_1", stateFromInstallUrl(start.url)))
+			assert.strictEqual(error._tag, "@maple/http/errors/IntegrationsUpstreamError")
+		}).pipe(
+			// `ok` must be a boolean — a JSON payload with the wrong shape fails decode.
+			Effect.provide(
+				withFetch(testDb, slackApiFetch(OAUTH_URL, () => jsonResponse({ ok: "yes", team: 42 }))),
+			),
+		)
+	})
+
+	// --- listChannels ----------------------------------------------------------
+
+	it.effect("listChannels fails not-connected when the org has no active workspace", () => {
+		const testDb = createTestDb(trackedDbs)
+		return Effect.gen(function* () {
+			const slack = yield* SlackIntegrationService
+			const error = yield* Effect.flip(slack.listChannels(asOrgId("org_none")))
+			assert.strictEqual(error._tag, "@maple/http/errors/IntegrationsNotConnectedError")
+		}).pipe(Effect.provide(makeLayer(testDb)))
+	})
+
+	it.effect("listChannels returns a single page with field defaulting", () => {
+		const testDb = createTestDb(trackedDbs)
+		const urls: string[] = []
+		return Effect.gen(function* () {
+			yield* Effect.promise(() =>
+				insertWorkspace(testDb, {
+					id: "sw_lc1",
+					orgId: "org_lc",
+					teamId: "T-LC",
+					teamName: "LC",
+					botToken: "xoxb-lc-token",
+					apiKey: "maple_ak_lc",
+				}),
+			)
+			const slack = yield* SlackIntegrationService
+			const channels = yield* slack.listChannels(asOrgId("org_lc"))
+			assert.deepStrictEqual(channels, [
+				{ id: "C1", name: "general", isPrivate: true, isMember: true },
+				// Missing name/is_private/is_member default to id/false/false.
+				{ id: "C2", name: "C2", isPrivate: false, isMember: false },
+			])
+			assert.strictEqual(urls.length, 1)
+			const first = new URL(urls[0]!)
+			assert.isNull(first.searchParams.get("cursor"))
+		}).pipe(
+			Effect.provide(
+				withFetch(
+					testDb,
+					slackApiFetch(CONVERSATIONS_URL, (url) => {
+						urls.push(url)
+						return jsonResponse({
+							ok: true,
+							channels: [
+								{ id: "C1", name: "general", is_private: true, is_member: true },
+								{ id: "C2" },
+							],
+						})
+					}),
+				),
+			),
+		)
+	})
+
+	it.effect("listChannels follows next_cursor across pages and stops on an empty cursor", () => {
+		const testDb = createTestDb(trackedDbs)
+		const urls: string[] = []
+		return Effect.gen(function* () {
+			yield* Effect.promise(() =>
+				insertWorkspace(testDb, {
+					id: "sw_lc2",
+					orgId: "org_lc",
+					teamId: "T-LC",
+					teamName: "LC",
+					botToken: "xoxb-lc-token",
+					apiKey: "maple_ak_lc",
+				}),
+			)
+			const slack = yield* SlackIntegrationService
+			const channels = yield* slack.listChannels(asOrgId("org_lc"))
+			assert.deepStrictEqual(
+				channels.map((c) => c.id),
+				["C1", "C2"],
+			)
+			assert.strictEqual(urls.length, 2)
+			assert.isNull(new URL(urls[0]!).searchParams.get("cursor"))
+			assert.strictEqual(new URL(urls[1]!).searchParams.get("cursor"), "cursor-2")
+		}).pipe(
+			Effect.provide(
+				withFetch(
+					testDb,
+					slackApiFetch(CONVERSATIONS_URL, (url, call) => {
+						urls.push(url)
+						return call === 0
+							? jsonResponse({
+									ok: true,
+									channels: [{ id: "C1", name: "one" }],
+									response_metadata: { next_cursor: "cursor-2" },
+								})
+							: // Slack signals "done" with an empty next_cursor.
+								jsonResponse({
+									ok: true,
+									channels: [{ id: "C2", name: "two" }],
+									response_metadata: { next_cursor: "" },
+								})
+					}),
+				),
+			),
+		)
+	})
+
+	it.effect("listChannels caps pagination at SLACK_MAX_CHANNEL_PAGES pages", () => {
+		const testDb = createTestDb(trackedDbs)
+		let calls = 0
+		return Effect.gen(function* () {
+			yield* Effect.promise(() =>
+				insertWorkspace(testDb, {
+					id: "sw_lc3",
+					orgId: "org_lc",
+					teamId: "T-LC",
+					teamName: "LC",
+					botToken: "xoxb-lc-token",
+					apiKey: "maple_ak_lc",
+				}),
+			)
+			const slack = yield* SlackIntegrationService
+			const channels = yield* slack.listChannels(asOrgId("org_lc"))
+			// The mock ALWAYS hands back a next_cursor — the walk must stop at the
+			// page cap (SLACK_MAX_CHANNEL_PAGES = 3) instead of looping forever.
+			assert.strictEqual(calls, 3)
+			assert.deepStrictEqual(
+				channels.map((c) => c.id),
+				["C-page-0", "C-page-1", "C-page-2"],
+			)
+		}).pipe(
+			Effect.provide(
+				withFetch(
+					testDb,
+					slackApiFetch(CONVERSATIONS_URL, (_url, call) => {
+						calls++
+						return jsonResponse({
+							ok: true,
+							channels: [{ id: `C-page-${call}` }],
+							response_metadata: { next_cursor: "more" },
+						})
+					}),
+				),
+			),
+		)
+	})
+
+	it.effect("listChannels maps Slack ok:false to an upstream error", () => {
+		const testDb = createTestDb(trackedDbs)
+		return Effect.gen(function* () {
+			yield* Effect.promise(() =>
+				insertWorkspace(testDb, {
+					id: "sw_lc4",
+					orgId: "org_lc",
+					teamId: "T-LC",
+					teamName: "LC",
+					botToken: "xoxb-lc-token",
+					apiKey: "maple_ak_lc",
+				}),
+			)
+			const slack = yield* SlackIntegrationService
+			const error = yield* Effect.flip(slack.listChannels(asOrgId("org_lc")))
+			assert.strictEqual(error._tag, "@maple/http/errors/IntegrationsUpstreamError")
+			assert.include(error.message, "invalid_auth")
+		}).pipe(
+			Effect.provide(
+				withFetch(
+					testDb,
+					slackApiFetch(CONVERSATIONS_URL, () => jsonResponse({ ok: false, error: "invalid_auth" })),
+				),
+			),
+		)
+	})
+
+	it.effect("listChannels maps a non-JSON response to an upstream error", () => {
+		const testDb = createTestDb(trackedDbs)
+		return Effect.gen(function* () {
+			yield* Effect.promise(() =>
+				insertWorkspace(testDb, {
+					id: "sw_lc5",
+					orgId: "org_lc",
+					teamId: "T-LC",
+					teamName: "LC",
+					botToken: "xoxb-lc-token",
+					apiKey: "maple_ak_lc",
+				}),
+			)
+			const slack = yield* SlackIntegrationService
+			const error = yield* Effect.flip(slack.listChannels(asOrgId("org_lc")))
+			assert.strictEqual(error._tag, "@maple/http/errors/IntegrationsUpstreamError")
+		}).pipe(
+			Effect.provide(
+				withFetch(
+					testDb,
+					slackApiFetch(
+						CONVERSATIONS_URL,
+						() =>
+							new Response("gateway timeout", {
+								status: 200,
+								headers: { "content-type": "text/plain" },
+							}),
+					),
+				),
+			),
+		)
+	})
+
+	it.effect("listChannels maps an undecodable payload to an upstream error", () => {
+		const testDb = createTestDb(trackedDbs)
+		return Effect.gen(function* () {
+			yield* Effect.promise(() =>
+				insertWorkspace(testDb, {
+					id: "sw_lc6",
+					orgId: "org_lc",
+					teamId: "T-LC",
+					teamName: "LC",
+					botToken: "xoxb-lc-token",
+					apiKey: "maple_ak_lc",
+				}),
+			)
+			const slack = yield* SlackIntegrationService
+			const error = yield* Effect.flip(slack.listChannels(asOrgId("org_lc")))
+			assert.strictEqual(error._tag, "@maple/http/errors/IntegrationsUpstreamError")
+		}).pipe(
+			// channels must be an array of objects with a string id.
+			Effect.provide(
+				withFetch(
+					testDb,
+					slackApiFetch(CONVERSATIONS_URL, () => jsonResponse({ ok: true, channels: [{ id: 42 }] })),
+				),
+			),
+		)
+	})
 })
diff --git a/apps/api/src/services/SlackIntegrationService.ts b/apps/api/src/services/SlackIntegrationService.ts
index 6f89fea54..eee0fee2b 100644
--- a/apps/api/src/services/SlackIntegrationService.ts
+++ b/apps/api/src/services/SlackIntegrationService.ts
@@ -51,9 +51,23 @@ export const SLACK_BOT_SCOPES = [
 	"users:read",
 ].join(",")
 
+/**
+ * Thrown inside the install transaction (throwing is the only way to make a
+ * drizzle transaction roll back) when the same-team upsert is blocked by an
+ * active binding owned by another org. Caught by `instanceof` immediately
+ * around the transaction and converted into a discriminated result — it never
+ * escapes `completeInstall`.
+ */
+class SlackCrossOrgConflict extends Error {
+	constructor() {
+		super("Slack workspace is actively bound to a different organization")
+		this.name = "SlackCrossOrgConflict"
+	}
+}
+
 const decodeApiKeyIdOption = Schema.decodeUnknownOption(ApiKeyId)
-const decodeOrgIdSync = Schema.decodeUnknownSync(OrgId)
-const decodeUserIdSync = Schema.decodeUnknownSync(UserId)
+const decodeOrgId = Schema.decodeUnknownEffect(OrgId)
+const decodeUserId = Schema.decodeUnknownEffect(UserId)
 
 // --- Slack API response shapes ---------------------------------------------
 
@@ -117,18 +131,34 @@ export interface SlackBotResolution {
 	readonly mapleApiKey: string
 }
 
+/**
+ * Wire schema for the FIXED internal resolve response contract
+ * (`GET /internal/slack/workspaces/:teamId`). The Railway-hosted bot is built
+ * against exactly these keys — do not rename or drop fields.
+ */
+export const SlackBotResolutionResponseSchema = Schema.Struct({
+	orgId: Schema.String,
+	teamId: Schema.String,
+	teamName: Schema.NullOr(Schema.String),
+	botToken: Schema.String,
+	mapleApiKey: Schema.String,
+})
+
 // --- Shared decrypt helper (also used by the alert dispatch path) -----------
 
-const loadActiveWorkspaceByOrg = (database: DatabaseShape, orgId: string) =>
-	database
-		.execute((db) =>
-			db
-				.select()
-				.from(slackWorkspaces)
-				.where(and(eq(slackWorkspaces.orgId, orgId), isNull(slackWorkspaces.revokedAt)))
-				.limit(1),
-		)
-		.pipe(Effect.map((rows) => rows[0] ?? null))
+const loadActiveWorkspaceByOrg = Effect.fnUntraced(function* (
+	database: DatabaseShape,
+	orgId: string,
+) {
+	const rows = yield* database.execute((db) =>
+		db
+			.select()
+			.from(slackWorkspaces)
+			.where(and(eq(slackWorkspaces.orgId, orgId), isNull(slackWorkspaces.revokedAt)))
+			.limit(1),
+	)
+	return Option.fromNullishOr(rows[0])
+})
 
 /**
  * Resolve the decrypted Slack bot token for an org's active installation.
@@ -136,39 +166,41 @@ const loadActiveWorkspaceByOrg = (database: DatabaseShape, orgId: string) =>
  * worker) so those dispatchers do not need the full SlackIntegrationService.
  * Fails with an {@link AlertDeliveryError} when there is no active install.
  */
-export const resolveSlackBotTokenForDispatch = (
-	database: DatabaseShape,
-	encryptionKey: Buffer,
-	orgId: string,
-): Effect.Effect<string, AlertDeliveryError> =>
-	Effect.gen(function* () {
-		const row = yield* loadActiveWorkspaceByOrg(database, orgId).pipe(
-			Effect.mapError(
-				(error) =>
-					new AlertDeliveryError({
-						message: `Failed to load Slack installation: ${error.message}`,
-						destinationType: "slack-bot",
-					}),
-			),
-		)
-		if (!row) {
-			return yield* Effect.fail(
+export const resolveSlackBotTokenForDispatch = Effect.fn(
+	"SlackIntegrationService.resolveSlackBotTokenForDispatch",
+)(function* (database: DatabaseShape, encryptionKey: Buffer, orgId: string) {
+	yield* Effect.annotateCurrentSpan({ orgId })
+	const row = yield* loadActiveWorkspaceByOrg(database, orgId).pipe(
+		Effect.mapError(
+			(error) =>
 				new AlertDeliveryError({
-					message: "Slack is not connected for this organization — install the Maple Slack app",
-					destinationType: "slack-bot",
-				}),
-			)
-		}
-		return yield* decryptAes256Gcm(
-			{ ciphertext: row.botTokenCiphertext, iv: row.botTokenIv, tag: row.botTokenTag },
-			encryptionKey,
-			() =>
-				new AlertDeliveryError({
-					message: "Failed to decrypt stored Slack bot token",
+					message: `Failed to load Slack installation: ${error.message}`,
 					destinationType: "slack-bot",
 				}),
+		),
+	)
+	if (Option.isNone(row)) {
+		return yield* Effect.fail(
+			new AlertDeliveryError({
+				message: "Slack is not connected for this organization — install the Maple Slack app",
+				destinationType: "slack-bot",
+			}),
 		)
-	})
+	}
+	return yield* decryptAes256Gcm(
+		{
+			ciphertext: row.value.botTokenCiphertext,
+			iv: row.value.botTokenIv,
+			tag: row.value.botTokenTag,
+		},
+		encryptionKey,
+		() =>
+			new AlertDeliveryError({
+				message: "Failed to decrypt stored Slack bot token",
+				destinationType: "slack-bot",
+			}),
+	)
+})
 
 // --- Service ----------------------------------------------------------------
 
@@ -201,10 +233,7 @@ export interface SlackIntegrationServiceShape {
 		orgId: OrgId,
 	) => Effect.Effect<
 		ReadonlyArray<SlackChannelSummary>,
-		| IntegrationsNotConnectedError
-		| IntegrationsUpstreamError
-		| IntegrationsPersistenceError
-		| IntegrationsValidationError
+		IntegrationsNotConnectedError | IntegrationsUpstreamError | IntegrationsPersistenceError
 	>
 	readonly resolveForBot: (
 		teamId: string,
@@ -275,6 +304,7 @@ export class SlackIntegrationService extends Context.Service<
 			userId: UserId,
 			callbackUrl: string,
 		) {
+			yield* Effect.annotateCurrentSpan({ orgId })
 			const { clientId } = yield* requireOAuthClient
 			const state = randomBytes(24).toString("base64url")
 			const now = yield* Clock.currentTimeMillis
@@ -324,24 +354,35 @@ export class SlackIntegrationService extends Context.Service<
 			)
 			const json = yield* response.json.pipe(
 				Effect.mapError(
-					() => new IntegrationsUpstreamError({ message: "Slack OAuth returned a non-JSON response" }),
+					(error) =>
+						new IntegrationsUpstreamError({
+							message: `Slack OAuth returned a non-JSON response: ${error.message}`,
+						}),
 				),
 			)
 			const decoded = yield* decodeOAuthAccess(json).pipe(
 				Effect.mapError(
-					() => new IntegrationsUpstreamError({ message: "Slack OAuth returned an unexpected payload" }),
+					(error) =>
+						new IntegrationsUpstreamError({
+							message: `Slack OAuth returned an unexpected payload: ${error.message}`,
+						}),
 				),
 			)
-			if (!decoded.ok || !decoded.access_token || !decoded.team?.id) {
+			const accessToken = decoded.access_token
+			const team = decoded.team
+			if (!decoded.ok || !accessToken || !team?.id) {
 				return yield* Effect.fail(
 					new IntegrationsValidationError({
 						message: `Slack authorization failed: ${decoded.error ?? "missing token or team"}`,
 					}),
 				)
 			}
-			return decoded as typeof decoded & {
-				access_token: string
-				team: { id: string; name?: string }
+			return {
+				accessToken,
+				teamId: team.id,
+				teamName: team.name ?? null,
+				botUserId: decoded.bot_user_id ?? null,
+				scope: decoded.scope ?? null,
 			}
 		})
 
@@ -371,19 +412,41 @@ export class SlackIntegrationService extends Context.Service<
 			// Single-use: burn the state before doing any side effects.
 			yield* states.deleteByState(state).pipe(Effect.mapError(toPersistenceError))
 
-			const orgId = decodeOrgIdSync(row.orgId)
+			const orgId = yield* decodeOrgId(row.orgId).pipe(
+				Effect.mapError(
+					(error) =>
+						new IntegrationsPersistenceError({
+							message: `Stored Slack OAuth state has an invalid orgId: ${error.message}`,
+						}),
+				),
+			)
+			yield* Effect.annotateCurrentSpan({ orgId })
+			const initiatedByUserId = yield* decodeUserId(row.initiatedByUserId).pipe(
+				Effect.mapError(
+					(error) =>
+						new IntegrationsPersistenceError({
+							message: `Stored Slack OAuth state has an invalid userId: ${error.message}`,
+						}),
+				),
+			)
 			const access = yield* exchangeCode(code, row.redirectUri, clientId, clientSecret)
-			const teamId = access.team.id
-			const teamName = access.team.name ?? null
+			const teamId = access.teamId
+			const teamName = access.teamName
 
 			// Reject re-binding a team that is actively installed on a different org.
 			const existingByTeam = yield* database
 				.execute((db) =>
 					db.select().from(slackWorkspaces).where(eq(slackWorkspaces.teamId, teamId)).limit(1),
 				)
-				.pipe(Effect.mapError(toPersistenceError))
-			const priorRow = existingByTeam[0] ?? null
-			if (priorRow && priorRow.orgId !== orgId && priorRow.revokedAt === null) {
+				.pipe(
+					Effect.mapError(toPersistenceError),
+					Effect.map((rows) => Option.fromNullishOr(rows[0])),
+				)
+			if (
+				Option.isSome(existingByTeam) &&
+				existingByTeam.value.orgId !== orgId &&
+				existingByTeam.value.revokedAt === null
+			) {
 				return yield* Effect.fail(
 					new IntegrationsForbiddenError({
 						message:
@@ -391,10 +454,11 @@ export class SlackIntegrationService extends Context.Service<
 					}),
 				)
 			}
+			const priorRow = Option.getOrUndefined(existingByTeam)
 
 			// Mint a full-access MCP-kind API key for the bot; capture the plaintext.
 			const created = yield* apiKeys
-				.create(orgId, decodeUserIdSync(row.initiatedByUserId), {
+				.create(orgId, initiatedByUserId, {
 					name: `Slack bot (${teamName ?? teamId})`,
 					kind: "mcp",
 					scopes: null,
@@ -408,7 +472,7 @@ export class SlackIntegrationService extends Context.Service<
 					),
 				)
 
-			const botTokenEnc = yield* encryptValue(access.access_token)
+			const botTokenEnc = yield* encryptValue(access.accessToken)
 			const apiKeyEnc = yield* encryptValue(created.secret)
 
 			const values = {
@@ -416,7 +480,7 @@ export class SlackIntegrationService extends Context.Service<
 				orgId,
 				teamId,
 				teamName,
-				botUserId: access.bot_user_id ?? null,
+				botUserId: access.botUserId,
 				scope: access.scope ?? SLACK_BOT_SCOPES,
 				botTokenCiphertext: botTokenEnc.ciphertext,
 				botTokenIv: botTokenEnc.iv,
@@ -436,79 +500,88 @@ export class SlackIntegrationService extends Context.Service<
 			// same-org install of a different team replaces the old one), then upsert
 			// the new/refreshed row. The `setWhere` guard makes the cross-org rejection
 			// race-safe: a concurrent install of the same team by a different org can't
-			// clobber the existing binding — the update is skipped and we roll back with
-			// a recognizable sentinel. The partial unique index on (org_id) is the
-			// backstop that ultimately enforces the single-active-row invariant.
-			const CROSS_ORG_SENTINEL = "SLACK_CROSS_ORG_CONFLICT"
+			// clobber the existing binding — the update is skipped and we abort the
+			// transaction (throwing is the only way to make drizzle roll back), then
+			// convert the abort into a discriminated `crossOrgConflict` result. The
+			// partial unique index on (org_id) is the backstop that ultimately enforces
+			// the single-active-row invariant.
 			const writeResult = yield* database
-				.execute<{ revokedOtherKeyIds: Array<string | null> }>((db) =>
-					db.transaction(async (tx) => {
-						const revokedOthers = await tx
-							.update(slackWorkspaces)
-							.set({ revokedAt: new Date(now), updatedAt: new Date(now) })
-							.where(
-								and(
-									eq(slackWorkspaces.orgId, orgId),
-									isNull(slackWorkspaces.revokedAt),
-									ne(slackWorkspaces.teamId, teamId),
-								),
-							)
-							.returning({ apiKeyId: slackWorkspaces.apiKeyId })
-
-						const upserted = await tx
-							.insert(slackWorkspaces)
-							.values(values)
-							.onConflictDoUpdate({
-								target: slackWorkspaces.teamId,
-								// Only allow overwriting a same-team row that belongs to this
-								// org or has already been revoked — never an active binding
-								// owned by another org.
-								setWhere: or(
-									eq(slackWorkspaces.orgId, orgId),
-									isNotNull(slackWorkspaces.revokedAt),
-								),
-								set: {
-									orgId: values.orgId,
-									teamName: values.teamName,
-									botUserId: values.botUserId,
-									scope: values.scope,
-									botTokenCiphertext: values.botTokenCiphertext,
-									botTokenIv: values.botTokenIv,
-									botTokenTag: values.botTokenTag,
-									apiKeyId: values.apiKeyId,
-									apiKeySecretCiphertext: values.apiKeySecretCiphertext,
-									apiKeySecretIv: values.apiKeySecretIv,
-									apiKeySecretTag: values.apiKeySecretTag,
-									installedByUserId: values.installedByUserId,
-									createdAt: values.createdAt,
-									updatedAt: values.updatedAt,
-									revokedAt: null,
-								},
-							})
-							.returning({ id: slackWorkspaces.id })
-
-						// Zero rows means the same-team conflict hit an active row owned by a
-						// different org (the setWhere blocked it) — abort so revoke-others
-						// rolls back too.
-						if (upserted.length === 0) throw new Error(CROSS_ORG_SENTINEL)
-
-						return {
-							revokedOtherKeyIds: revokedOthers.map((r) => r.apiKeyId),
+				.execute<
+					| { readonly _tag: "ok"; readonly revokedOtherKeyIds: Array<string | null> }
+					| { readonly _tag: "crossOrgConflict" }
+				>(async (db) => {
+					try {
+						return await db.transaction(async (tx) => {
+							const revokedOthers = await tx
+								.update(slackWorkspaces)
+								.set({ revokedAt: new Date(now), updatedAt: new Date(now) })
+								.where(
+									and(
+										eq(slackWorkspaces.orgId, orgId),
+										isNull(slackWorkspaces.revokedAt),
+										ne(slackWorkspaces.teamId, teamId),
+									),
+								)
+								.returning({ apiKeyId: slackWorkspaces.apiKeyId })
+
+							const upserted = await tx
+								.insert(slackWorkspaces)
+								.values(values)
+								.onConflictDoUpdate({
+									target: slackWorkspaces.teamId,
+									// Only allow overwriting a same-team row that belongs to this
+									// org or has already been revoked — never an active binding
+									// owned by another org.
+									setWhere: or(
+										eq(slackWorkspaces.orgId, orgId),
+										isNotNull(slackWorkspaces.revokedAt),
+									),
+									set: {
+										orgId: values.orgId,
+										teamName: values.teamName,
+										botUserId: values.botUserId,
+										scope: values.scope,
+										botTokenCiphertext: values.botTokenCiphertext,
+										botTokenIv: values.botTokenIv,
+										botTokenTag: values.botTokenTag,
+										apiKeyId: values.apiKeyId,
+										apiKeySecretCiphertext: values.apiKeySecretCiphertext,
+										apiKeySecretIv: values.apiKeySecretIv,
+										apiKeySecretTag: values.apiKeySecretTag,
+										installedByUserId: values.installedByUserId,
+										createdAt: values.createdAt,
+										updatedAt: values.updatedAt,
+										revokedAt: null,
+									},
+								})
+								.returning({ id: slackWorkspaces.id })
+
+							// Zero rows means the same-team conflict hit an active row owned by a
+							// different org (the setWhere blocked it) — abort so revoke-others
+							// rolls back too.
+							if (upserted.length === 0) throw new SlackCrossOrgConflict()
+
+							return {
+								_tag: "ok" as const,
+								revokedOtherKeyIds: revokedOthers.map((r) => r.apiKeyId),
+							}
+						})
+					} catch (error) {
+						if (error instanceof SlackCrossOrgConflict) {
+							return { _tag: "crossOrgConflict" as const }
 						}
+						throw error
+					}
+				})
+				.pipe(Effect.mapError(toPersistenceError))
+			if (writeResult._tag === "crossOrgConflict") {
+				return yield* Effect.fail(
+					new IntegrationsForbiddenError({
+						message:
+							"This Slack workspace is already connected to a different Maple organization. Uninstall it there first.",
 					}),
 				)
-				.pipe(
-					Effect.catchTag("@maple/api/lib/DatabaseError", (error) =>
-						Effect.fail(
-							error.message.includes(CROSS_ORG_SENTINEL)
-								? new IntegrationsForbiddenError({
-										message:
-											"This Slack workspace is already connected to a different Maple organization. Uninstall it there first.",
-									})
-								: toPersistenceError(error),
-						),
-					),
-				)
+			}
 
 			// Best-effort: revoke the API keys of every workspace this install
 			// replaced — the prior same-team row (whose key we just rotated) and any
@@ -527,32 +600,37 @@ export class SlackIntegrationService extends Context.Service<
 		})
 
 		const getStatus = Effect.fn("SlackIntegrationService.getStatus")(function* (orgId: OrgId) {
-			const row = yield* loadActiveWorkspaceByOrg(database, orgId).pipe(
+			yield* Effect.annotateCurrentSpan({ orgId })
+			const rowOption = yield* loadActiveWorkspaceByOrg(database, orgId).pipe(
 				Effect.mapError(toPersistenceError),
 			)
-			if (!row) {
-				return {
-					installed: false,
-					teamId: null,
-					teamName: null,
-					botUserId: null,
-					installedAt: null,
-				} satisfies SlackInstallStatus
-			}
-			return {
-				installed: true,
-				teamId: row.teamId,
-				teamName: row.teamName,
-				botUserId: row.botUserId,
-				installedAt: row.createdAt.getTime(),
-			} satisfies SlackInstallStatus
+			return Option.match(rowOption, {
+				onNone: () =>
+					({
+						installed: false,
+						teamId: null,
+						teamName: null,
+						botUserId: null,
+						installedAt: null,
+					}) satisfies SlackInstallStatus,
+				onSome: (row) =>
+					({
+						installed: true,
+						teamId: row.teamId,
+						teamName: row.teamName,
+						botUserId: row.botUserId,
+						installedAt: row.createdAt.getTime(),
+					}) satisfies SlackInstallStatus,
+			})
 		})
 
 		const uninstall = Effect.fn("SlackIntegrationService.uninstall")(function* (orgId: OrgId) {
-			const row = yield* loadActiveWorkspaceByOrg(database, orgId).pipe(
+			yield* Effect.annotateCurrentSpan({ orgId })
+			const rowOption = yield* loadActiveWorkspaceByOrg(database, orgId).pipe(
 				Effect.mapError(toPersistenceError),
 			)
-			if (!row) return { uninstalled: false }
+			if (Option.isNone(rowOption)) return { uninstalled: false }
+			const row = rowOption.value
 			const now = yield* Clock.currentTimeMillis
 			// Revoke the minted API key (best-effort — bookkeeping must not fail the uninstall).
 			if (row.apiKeyId) {
@@ -572,84 +650,117 @@ export class SlackIntegrationService extends Context.Service<
 			return { uninstalled: true }
 		})
 
+		/** Fetch one `conversations.list` page; returns the page's channels + next cursor. */
+		const fetchChannelPage = Effect.fnUntraced(function* (
+			botToken: string,
+			cursor: Option.Option<string>,
+		) {
+			const params = new URLSearchParams({
+				types: "public_channel,private_channel",
+				exclude_archived: "true",
+				limit: "200",
+			})
+			Option.map(cursor, (value) => params.set("cursor", value))
+			const response = yield* httpClient
+				.get(`${SLACK_CONVERSATIONS_LIST_URL}?${params.toString()}`, {
+					headers: { authorization: `Bearer ${botToken}`, accept: "application/json" },
+				})
+				.pipe(
+					Effect.mapError(
+						(error) =>
+							new IntegrationsUpstreamError({
+								message: `Slack conversations.list failed: ${error.message}`,
+							}),
+					),
+				)
+			const json = yield* response.json.pipe(
+				Effect.mapError(
+					(error) =>
+						new IntegrationsUpstreamError({
+							message: `Slack conversations.list returned a non-JSON response: ${error.message}`,
+						}),
+				),
+			)
+			const decoded = yield* decodeConversationsList(json).pipe(
+				Effect.mapError(
+					(error) =>
+						new IntegrationsUpstreamError({
+							message: `Slack conversations.list returned an unexpected payload: ${error.message}`,
+						}),
+				),
+			)
+			if (!decoded.ok) {
+				return yield* Effect.fail(
+					new IntegrationsUpstreamError({
+						message: `Slack conversations.list error: ${decoded.error ?? "unknown"}`,
+					}),
+				)
+			}
+			const channels: ReadonlyArray<SlackChannelSummary> = (decoded.channels ?? []).map(
+				(channel) => ({
+					id: channel.id,
+					name: channel.name ?? channel.id,
+					isPrivate: channel.is_private ?? false,
+					isMember: channel.is_member ?? false,
+				}),
+			)
+			// Slack signals "no more pages" with a missing or empty next_cursor.
+			const next = decoded.response_metadata?.next_cursor
+			return { channels, next: next ? Option.some(next) : Option.none<string>() }
+		})
+
+		/**
+		 * Cursor-driven page walk with pure accumulation, capped at
+		 * {@link SLACK_MAX_CHANNEL_PAGES} pages.
+		 */
+		const collectChannelPages = (
+			botToken: string,
+			cursor: Option.Option<string>,
+			page: number,
+			acc: ReadonlyArray<SlackChannelSummary>,
+		): Effect.Effect<
+			ReadonlyArray<SlackChannelSummary>,
+			IntegrationsUpstreamError | IntegrationsPersistenceError
+		> =>
+			page >= SLACK_MAX_CHANNEL_PAGES
+				? Effect.succeed(acc)
+				: fetchChannelPage(botToken, cursor).pipe(
+						Effect.flatMap(({ channels, next }) =>
+							Option.match(next, {
+								onNone: () => Effect.succeed([...acc, ...channels]),
+								onSome: (nextCursor) =>
+									collectChannelPages(botToken, Option.some(nextCursor), page + 1, [
+										...acc,
+										...channels,
+									]),
+							}),
+						),
+					)
+
 		const listChannels = Effect.fn("SlackIntegrationService.listChannels")(function* (orgId: OrgId) {
-			const row = yield* loadActiveWorkspaceByOrg(database, orgId).pipe(
+			yield* Effect.annotateCurrentSpan({ orgId })
+			const rowOption = yield* loadActiveWorkspaceByOrg(database, orgId).pipe(
 				Effect.mapError(toPersistenceError),
 			)
-			if (!row) {
+			if (Option.isNone(rowOption)) {
 				return yield* Effect.fail(
 					new IntegrationsNotConnectedError({
 						message: "Slack is not connected for this organization",
 					}),
 				)
 			}
+			const row = rowOption.value
 			const botToken = yield* decryptValue({
 				ciphertext: row.botTokenCiphertext,
 				iv: row.botTokenIv,
 				tag: row.botTokenTag,
 			})
-
-			const channels: Array<SlackChannelSummary> = []
-			let cursor: string | undefined
-			for (let page = 0; page < SLACK_MAX_CHANNEL_PAGES; page++) {
-				const params = new URLSearchParams({
-					types: "public_channel,private_channel",
-					exclude_archived: "true",
-					limit: "200",
-				})
-				if (cursor) params.set("cursor", cursor)
-				const response = yield* httpClient
-					.get(`${SLACK_CONVERSATIONS_LIST_URL}?${params.toString()}`, {
-						headers: { authorization: `Bearer ${botToken}`, accept: "application/json" },
-					})
-					.pipe(
-						Effect.mapError(
-							(error) =>
-								new IntegrationsUpstreamError({
-									message: `Slack conversations.list failed: ${error.message}`,
-								}),
-						),
-					)
-				const json = yield* response.json.pipe(
-					Effect.mapError(
-						() =>
-							new IntegrationsUpstreamError({
-								message: "Slack conversations.list returned a non-JSON response",
-							}),
-					),
-				)
-				const decoded = yield* decodeConversationsList(json).pipe(
-					Effect.mapError(
-						() =>
-							new IntegrationsUpstreamError({
-								message: "Slack conversations.list returned an unexpected payload",
-							}),
-					),
-				)
-				if (!decoded.ok) {
-					return yield* Effect.fail(
-						new IntegrationsUpstreamError({
-							message: `Slack conversations.list error: ${decoded.error ?? "unknown"}`,
-						}),
-					)
-				}
-				for (const channel of decoded.channels ?? []) {
-					channels.push({
-						id: channel.id,
-						name: channel.name ?? channel.id,
-						isPrivate: channel.is_private ?? false,
-						isMember: channel.is_member ?? false,
-					})
-				}
-				const next = decoded.response_metadata?.next_cursor
-				if (!next) break
-				cursor = next
-			}
-			return channels
+			return yield* collectChannelPages(botToken, Option.none(), 0, [])
 		})
 
 		const resolveForBot = Effect.fn("SlackIntegrationService.resolveForBot")(function* (teamId: string) {
-			const rows = yield* database
+			yield* Effect.annotateCurrentSpan({ teamId })
+			const rowOption: Option.Option<SlackWorkspaceRow> = yield* database
 				.execute((db) =>
 					db
 						.select()
@@ -657,15 +768,18 @@ export class SlackIntegrationService extends Context.Service<
 						.where(and(eq(slackWorkspaces.teamId, teamId), isNull(slackWorkspaces.revokedAt)))
 						.limit(1),
 				)
-				.pipe(Effect.mapError(toPersistenceError))
-			const row: SlackWorkspaceRow | undefined = rows[0]
-			if (!row) {
+				.pipe(
+					Effect.mapError(toPersistenceError),
+					Effect.map((rows) => Option.fromNullishOr(rows[0])),
+				)
+			if (Option.isNone(rowOption)) {
 				return yield* Effect.fail(
 					new IntegrationsNotConnectedError({
 						message: "No active Slack installation for this team",
 					}),
 				)
 			}
+			const row = rowOption.value
 			const botToken = yield* decryptValue({
 				ciphertext: row.botTokenCiphertext,
 				iv: row.botTokenIv,
diff --git a/apps/slack-agent/.env.local.example b/apps/slack-agent/.env.local.example
index 479094862..1f6a8e149 100644
--- a/apps/slack-agent/.env.local.example
+++ b/apps/slack-agent/.env.local.example
@@ -50,7 +50,13 @@ MAPLE_INTERNAL_SERVICE_TOKEN=
 # WORKFLOW_POSTGRES_WORKER_CONCURRENCY=10
 
 # ── eve HTTP route auth (browser/API surface; NOT the Slack webhook) ─────────
-# If set, eve's session/stream routes require HTTP Basic. Unset = public (demo).
-# The Slack webhook (/eve/v1/slack) is always signature-verified independently.
+# eve's session/stream routes require HTTP Basic with these credentials.
+# REQUIRED in deployed environments (Railway / NODE_ENV=production): auth fails
+# closed there — if ROUTE_AUTH_BASIC_PASSWORD is unset at boot, the service
+# generates a random one-boot password and logs it once instead of serving the
+# routes publicly. Set a stable password as a Railway service variable.
+# Local dev is unaffected: loopback requests are always allowed, and non-
+# loopback local requests stay open only while no password is set.
+# The Slack webhook (/eve/v1/slack) and /eve/v1/health are independent of this.
 # ROUTE_AUTH_BASIC_USER=admin
 # ROUTE_AUTH_BASIC_PASSWORD=
diff --git a/apps/slack-agent/README.md b/apps/slack-agent/README.md
index e1713e05f..401958cee 100644
--- a/apps/slack-agent/README.md
+++ b/apps/slack-agent/README.md
@@ -70,6 +70,13 @@ Postgres to iterate on model + tools. To exercise the Postgres world locally: ru
 > its manifest. It must be set when `eve build` runs. Setting it only as a runtime variable leaves
 > you silently on the ephemeral on-disk world. The Dockerfile sets it before `bun run build`.
 
+Run the tests (bun's native runner; covers the signature verification, `team_id` parsing, and the
+resolve cache in `agent/lib/maple.ts` — no network, fetch is stubbed):
+
+```bash
+bun test
+```
+
 Drive the HTTP contract without the UI:
 
 ```bash
@@ -174,7 +181,13 @@ variables in (d), since two of them embed the URL.
   - `WORKFLOW_LOCAL_BASE_URL=http://localhost:8080` — the durable-run callback target. See the note
     below for why this is loopback and not the public host.
   - (`EVE_WORKFLOW_WORLD` is already baked into the image at build time — no need to set it.)
-  - optional: `ROUTE_AUTH_BASIC_PASSWORD` to lock the non-Slack HTTP routes.
+  - `ROUTE_AUTH_BASIC_PASSWORD` (+ optional `ROUTE_AUTH_BASIC_USER`, default `admin`) — locks the
+    non-Slack HTTP routes (session/stream) behind HTTP Basic. **Effectively required in
+    production**: route auth fails closed on Railway — if the password is unset at boot, the
+    service generates a random one-boot password and logs it once (`[route-auth]` in the deploy
+    logs) rather than serving those routes publicly. The Slack webhook and `/eve/v1/health` are
+    unaffected either way. (`railway.json` has no mechanism to declare required variables, so this
+    is enforced at boot instead.)
 
 Deploy. The entrypoint applies the Postgres-world schema, then starts eve. Check
 `https://<your-service>.up.railway.app/eve/v1/health`.
@@ -357,8 +370,13 @@ and **activate public distribution** so the app can be installed into any worksp
 
   The SSE must carry `delta.tool_calls`, not a JSON blob inside `response`. Also set
   `WORKERS_AI_CONTEXT_WINDOW` to the new model's window.
-- **Auth:** `agent/channels/eve.ts` leaves the browser/API routes public unless
-  `ROUTE_AUTH_BASIC_PASSWORD` is set. The Slack webhook is always signature-verified independently.
+- **Auth:** `agent/channels/eve.ts` fails closed in deployed environments (`RAILWAY_ENVIRONMENT_NAME`
+  set, or `NODE_ENV=production`): the browser/API routes always require HTTP Basic there. With
+  `ROUTE_AUTH_BASIC_PASSWORD` set that's your stable credential; without it, a random per-boot
+  password is generated and logged once at startup (`[route-auth]`), so the routes are never
+  public in production. Purely local runs without a password keep the old open-demo behavior.
+  The Slack webhook is always signature-verified independently, and `/eve/v1/health` is a separate
+  unauthenticated route (Railway's healthcheck is unaffected).
 - Edge Cloudflare Workers isn't used because the only Cloudflare Durable-Objects workflow world is
   built against an older `@workflow` protocol than eve 0.25 requires. Revisit when a `5.0.0-beta`
   Cloudflare world ships.
diff --git a/apps/slack-agent/agent/agent.ts b/apps/slack-agent/agent/agent.ts
index c8372ee43..baf0f0d10 100644
--- a/apps/slack-agent/agent/agent.ts
+++ b/apps/slack-agent/agent/agent.ts
@@ -12,6 +12,27 @@ const workersai = createWorkersAI({
   apiKey: process.env.CLOUDFLARE_API_TOKEN ?? "",
 });
 
+/**
+ * Surface missing model credentials at boot instead of only at the first model
+ * call. This module is evaluated both by `eve build` (where the credentials
+ * are legitimately absent — the Docker build only passes MAPLE_API_BASE_URL)
+ * and again when the compiled server boots, so we suppress the warning when
+ * the process is an `eve build` invocation (argv carries "build"; the runtime
+ * server is `node .output/server/index.mjs`, and `eve dev` — where the warning
+ * is useful — carries "dev"). A warn, never a throw: build-time safety of the
+ * empty-string fallback above is intentional.
+ */
+const missingModelEnv = ["CLOUDFLARE_ACCOUNT_ID", "CLOUDFLARE_API_TOKEN"].filter(
+  (name) => !process.env[name],
+);
+const isEveBuildInvocation = process.argv.includes("build");
+if (missingModelEnv.length > 0 && !isEveBuildInvocation) {
+  console.warn(
+    `[startup] ${missingModelEnv.join(" and ")} ${missingModelEnv.length === 1 ? "is" : "are"} not set. ` +
+      `The service will start, but every Workers AI model call will fail until ${missingModelEnv.length === 1 ? "it is" : "they are"} configured.`,
+  );
+}
+
 /**
  * Must support tool calling **while streaming** — eve's harness is tool-driven and
  * always streams. That second half is the real constraint: several Workers AI
diff --git a/apps/slack-agent/agent/channels/eve.ts b/apps/slack-agent/agent/channels/eve.ts
index e03efdda1..2233ac70b 100644
--- a/apps/slack-agent/agent/channels/eve.ts
+++ b/apps/slack-agent/agent/channels/eve.ts
@@ -1,27 +1,57 @@
+import { randomBytes } from "node:crypto";
 import { eveChannel } from "eve/channels/eve";
 import { httpBasic, localDev, none } from "eve/channels/auth";
 
 /**
- * Auth for eve's own HTTP routes (session/stream/health/etc.).
+ * Auth for eve's own HTTP routes (session/stream/info).
  *
  * The Slack webhook route (/eve/v1/slack) is verified independently via the
- * Slack signing secret, so this policy only governs the browser/API surface.
+ * Slack signing secret, and /eve/v1/health is a separate unauthenticated nitro
+ * route (verified in eve@0.25.3 internal/nitro/routes/health.js — Railway's
+ * healthcheck keeps working under fail-closed auth). This policy only governs
+ * the browser/API surface.
  *
  * - localDev(): opens the routes for `eve dev` and the local REPL.
- * - If ROUTE_AUTH_BASIC_PASSWORD is set, the deployed routes require HTTP Basic.
- *   Otherwise they are public (none()) — fine for a general demo, but set the
- *   password (or swap in jwt/oidc) before exposing anything sensitive.
+ * - Deployed (RAILWAY_ENVIRONMENT_NAME set, or NODE_ENV=production): the routes
+ *   ALWAYS require HTTP Basic — fail closed. If ROUTE_AUTH_BASIC_PASSWORD is
+ *   unset we generate a random per-boot password and log it once so the service
+ *   still comes up (the Slack webhook keeps working regardless), but the
+ *   browser/API surface is never public. Set ROUTE_AUTH_BASIC_PASSWORD for a
+ *   stable credential (or swap in jwt/oidc).
+ * - Local non-loopback without a password: none() keeps the old open-demo
+ *   behavior for local-only setups.
+ *
+ * Note on timing: this module is evaluated by `eve build` too, but in the
+ * Docker build neither RAILWAY_ENVIRONMENT_NAME nor NODE_ENV=production is set
+ * yet (NODE_ENV is exported after the build step), so generation happens at
+ * runtime boot, once per process.
  */
-const basicPassword = process.env.ROUTE_AUTH_BASIC_PASSWORD;
+const isDeployed =
+  Boolean(process.env.RAILWAY_ENVIRONMENT_NAME) ||
+  process.env.NODE_ENV === "production";
+
+const configuredPassword = process.env.ROUTE_AUTH_BASIC_PASSWORD;
+const basicUser = process.env.ROUTE_AUTH_BASIC_USER ?? "admin";
+
+let basicPassword = configuredPassword;
+if (!basicPassword && isDeployed) {
+  basicPassword = randomBytes(24).toString("base64url");
+  console.warn(
+    `[route-auth] ROUTE_AUTH_BASIC_PASSWORD is not set in a deployed environment. ` +
+      `Refusing to serve the browser/API routes publicly; generated a one-boot HTTP Basic credential instead: ` +
+      `user="${basicUser}" password="${basicPassword}". ` +
+      `Set ROUTE_AUTH_BASIC_PASSWORD as a service variable for a stable credential. ` +
+      `(The Slack webhook is unaffected — it is signature-verified independently.)`,
+  );
+}
 
 export default eveChannel({
   auth: [
     localDev(),
     basicPassword
-      ? httpBasic({
-          username: process.env.ROUTE_AUTH_BASIC_USER ?? "admin",
-          password: basicPassword,
-        })
-      : none(),
+      ? httpBasic({ username: basicUser, password: basicPassword })
+      : // Local dev only (isDeployed is false here): keep the open-demo
+        // behavior. Deployed environments never reach this branch.
+        none(),
   ],
 });
diff --git a/apps/slack-agent/agent/channels/slack.ts b/apps/slack-agent/agent/channels/slack.ts
index 6a8b568bd..ed1190f3e 100644
--- a/apps/slack-agent/agent/channels/slack.ts
+++ b/apps/slack-agent/agent/channels/slack.ts
@@ -27,9 +27,18 @@ const webhookVerifier: SlackWebhookVerifier = async (request, body) => {
   const signingSecret = process.env.SLACK_SIGNING_SECRET;
   if (!signingSecret) {
     // No secret → cannot verify anything. Reject (returning falsy rejects).
+    // Slack disables event subscriptions after repeated delivery failures, so
+    // make the two rejection causes distinguishable in Railway logs. Never log
+    // the secret or signature values themselves.
+    console.warn(
+      "[slack-webhook] Rejected inbound Slack webhook: SLACK_SIGNING_SECRET is not set, so no request can be verified.",
+    );
     return false;
   }
   if (!verifySlackV0Signature(body, request.headers, signingSecret)) {
+    console.warn(
+      "[slack-webhook] Rejected inbound Slack webhook: v0 signature verification failed (missing headers, stale timestamp, or signature mismatch — check that SLACK_SIGNING_SECRET matches the Slack app).",
+    );
     return false;
   }
 
diff --git a/apps/slack-agent/agent/lib/maple.test.ts b/apps/slack-agent/agent/lib/maple.test.ts
new file mode 100644
index 000000000..2f2cc1bda
--- /dev/null
+++ b/apps/slack-agent/agent/lib/maple.test.ts
@@ -0,0 +1,328 @@
+import {
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  setSystemTime,
+  test,
+} from "bun:test";
+import { createHmac } from "node:crypto";
+
+// maple.ts reads its env vars lazily (inside functions), but set dummies up
+// front anyway so no test can accidentally depend on the developer's shell or
+// .env.local values.
+process.env.MAPLE_API_BASE_URL = "https://maple-api.test";
+process.env.MAPLE_INTERNAL_SERVICE_TOKEN = "test-service-token";
+delete process.env.SLACK_BOT_TOKEN;
+
+import {
+  parseSlackTeamId,
+  resetWorkspaceCacheForTests,
+  resolveWorkspace,
+  verifySlackV0Signature,
+} from "./maple.js";
+
+// ── verifySlackV0Signature ──────────────────────────────────────────────────
+
+const SIGNING_SECRET = "8f742231b10e8888abcd99yyyzzz85a5";
+
+function sign(body: string, timestamp: string, secret = SIGNING_SECRET): string {
+  return (
+    "v0=" +
+    createHmac("sha256", secret).update(`v0:${timestamp}:${body}`).digest("hex")
+  );
+}
+
+function slackHeaders(signature: string | null, timestamp: string | null): Headers {
+  const headers = new Headers();
+  if (signature !== null) headers.set("x-slack-signature", signature);
+  if (timestamp !== null) headers.set("x-slack-request-timestamp", timestamp);
+  return headers;
+}
+
+describe("verifySlackV0Signature", () => {
+  afterEach(() => {
+    setSystemTime(); // restore real clock
+  });
+
+  test("accepts a valid signature", () => {
+    const body = JSON.stringify({ type: "event_callback", team_id: "T123" });
+    const ts = String(Math.floor(Date.now() / 1000));
+    expect(
+      verifySlackV0Signature(body, slackHeaders(sign(body, ts), ts), SIGNING_SECRET),
+    ).toBe(true);
+  });
+
+  test("rejects a wrong signature (tampered body)", () => {
+    const body = JSON.stringify({ type: "event_callback", team_id: "T123" });
+    const ts = String(Math.floor(Date.now() / 1000));
+    const signatureForOtherBody = sign(`${body} `, ts);
+    expect(
+      verifySlackV0Signature(
+        body,
+        slackHeaders(signatureForOtherBody, ts),
+        SIGNING_SECRET,
+      ),
+    ).toBe(false);
+  });
+
+  test("rejects a signature made with a different secret", () => {
+    const body = "payload";
+    const ts = String(Math.floor(Date.now() / 1000));
+    expect(
+      verifySlackV0Signature(
+        body,
+        slackHeaders(sign(body, ts, "another-secret"), ts),
+        SIGNING_SECRET,
+      ),
+    ).toBe(false);
+  });
+
+  test("rejects a timestamp outside the 5-minute skew window", () => {
+    const body = "payload";
+    const staleTs = String(Math.floor(Date.now() / 1000) - (5 * 60 + 1));
+    expect(
+      verifySlackV0Signature(body, slackHeaders(sign(body, staleTs), staleTs), SIGNING_SECRET),
+    ).toBe(false);
+  });
+
+  test("accepts a timestamp just inside the skew window", () => {
+    const body = "payload";
+    const ts = String(Math.floor(Date.now() / 1000) - (5 * 60 - 5));
+    expect(
+      verifySlackV0Signature(body, slackHeaders(sign(body, ts), ts), SIGNING_SECRET),
+    ).toBe(true);
+  });
+
+  test("rejects when the signature header is missing", () => {
+    const body = "payload";
+    const ts = String(Math.floor(Date.now() / 1000));
+    expect(verifySlackV0Signature(body, slackHeaders(null, ts), SIGNING_SECRET)).toBe(
+      false,
+    );
+  });
+
+  test("rejects when the timestamp header is missing", () => {
+    const body = "payload";
+    const sig = sign(body, "12345");
+    expect(verifySlackV0Signature(body, slackHeaders(sig, null), SIGNING_SECRET)).toBe(
+      false,
+    );
+  });
+
+  test("rejects a non-numeric timestamp", () => {
+    const body = "payload";
+    const ts = "not-a-number";
+    expect(
+      verifySlackV0Signature(body, slackHeaders(sign(body, ts), ts), SIGNING_SECRET),
+    ).toBe(false);
+  });
+});
+
+// ── parseSlackTeamId ────────────────────────────────────────────────────────
+
+describe("parseSlackTeamId", () => {
+  test("reads the top-level team_id (standard event callback)", () => {
+    const body = JSON.stringify({
+      type: "event_callback",
+      team_id: "T0TOP",
+      event: { type: "app_mention", team: "T0EVENT" },
+    });
+    expect(parseSlackTeamId(body)).toBe("T0TOP");
+  });
+
+  test("falls back to authorizations[0].team_id (Enterprise Grid)", () => {
+    const body = JSON.stringify({
+      type: "event_callback",
+      authorizations: [{ team_id: "T0AUTH", user_id: "U1" }],
+    });
+    expect(parseSlackTeamId(body)).toBe("T0AUTH");
+  });
+
+  test("falls back to event.team", () => {
+    const body = JSON.stringify({
+      type: "event_callback",
+      event: { type: "message", team: "T0EVENT" },
+    });
+    expect(parseSlackTeamId(body)).toBe("T0EVENT");
+  });
+
+  test("returns undefined for url_verification payloads", () => {
+    const body = JSON.stringify({
+      type: "url_verification",
+      challenge: "abc",
+      token: "tok",
+    });
+    expect(parseSlackTeamId(body)).toBeUndefined();
+  });
+
+  test("ignores empty-string team ids", () => {
+    const body = JSON.stringify({ team_id: "", event: { team: "" } });
+    expect(parseSlackTeamId(body)).toBeUndefined();
+  });
+
+  test("returns undefined for invalid JSON and non-object payloads", () => {
+    expect(parseSlackTeamId("not json {")).toBeUndefined();
+    expect(parseSlackTeamId('"a string"')).toBeUndefined();
+    expect(parseSlackTeamId("null")).toBeUndefined();
+  });
+});
+
+// ── resolveWorkspace: TTL cache + in-flight de-dupe ─────────────────────────
+
+const WORKSPACE_PAYLOAD = {
+  orgId: "org_1",
+  teamId: "T1",
+  teamName: "Acme",
+  botToken: "xoxb-test",
+  mapleApiKey: "maple_ak_test",
+};
+
+interface FetchStub {
+  calls: { url: string; headers: Record<string, string> }[];
+  respond: (url: string) => Response | Promise<Response>;
+}
+
+const realFetch = globalThis.fetch;
+
+function installFetchStub(
+  respond: (url: string) => Response | Promise<Response>,
+): FetchStub {
+  const stub: FetchStub = { calls: [], respond };
+  globalThis.fetch = (async (input: string | URL | Request, init?: RequestInit) => {
+    const url = String(input instanceof Request ? input.url : input);
+    const headers: Record<string, string> = {};
+    new Headers(init?.headers).forEach((v, k) => {
+      headers[k] = v;
+    });
+    stub.calls.push({ url, headers });
+    return stub.respond(url);
+  }) as typeof fetch;
+  return stub;
+}
+
+describe("resolveWorkspace", () => {
+  const T0 = new Date("2026-07-21T12:00:00Z");
+
+  beforeAll(() => {
+    process.env.MAPLE_API_BASE_URL = "https://maple-api.test";
+    process.env.MAPLE_INTERNAL_SERVICE_TOKEN = "test-service-token";
+  });
+
+  beforeEach(() => {
+    resetWorkspaceCacheForTests();
+    setSystemTime(T0);
+  });
+
+  afterEach(() => {
+    globalThis.fetch = realFetch;
+    setSystemTime();
+  });
+
+  test("resolves and caches a positive result for ~5 minutes", async () => {
+    const stub = installFetchStub(() => Response.json(WORKSPACE_PAYLOAD));
+
+    const first = await resolveWorkspace("T1");
+    expect(first).toEqual(WORKSPACE_PAYLOAD);
+    expect(stub.calls.length).toBe(1);
+    expect(stub.calls[0]?.url).toBe(
+      "https://maple-api.test/internal/slack/workspaces/T1",
+    );
+    expect(stub.calls[0]?.headers.authorization).toBe(
+      "Bearer maple_svc_test-service-token",
+    );
+
+    // Still cached just before the 5-minute TTL.
+    setSystemTime(new Date(T0.getTime() + 5 * 60_000 - 1000));
+    expect(await resolveWorkspace("T1")).toEqual(WORKSPACE_PAYLOAD);
+    expect(stub.calls.length).toBe(1);
+
+    // Expired after the TTL → refetches.
+    setSystemTime(new Date(T0.getTime() + 5 * 60_000 + 1000));
+    expect(await resolveWorkspace("T1")).toEqual(WORKSPACE_PAYLOAD);
+    expect(stub.calls.length).toBe(2);
+  });
+
+  test("caches a negative (404) result for ~30 seconds", async () => {
+    const stub = installFetchStub(() => new Response(null, { status: 404 }));
+
+    expect(await resolveWorkspace("T404")).toBeNull();
+    expect(stub.calls.length).toBe(1);
+
+    // Still cached just before the 30-second negative TTL.
+    setSystemTime(new Date(T0.getTime() + 29_000));
+    expect(await resolveWorkspace("T404")).toBeNull();
+    expect(stub.calls.length).toBe(1);
+
+    // Expired → refetches, picking up a fresh install quickly.
+    setSystemTime(new Date(T0.getTime() + 31_000));
+    stub.respond = () => Response.json(WORKSPACE_PAYLOAD);
+    expect(await resolveWorkspace("T404")).toEqual({
+      ...WORKSPACE_PAYLOAD,
+      teamId: "T1",
+    });
+    expect(stub.calls.length).toBe(2);
+  });
+
+  test("negative TTL is shorter than positive TTL", async () => {
+    const stub = installFetchStub(() => new Response(null, { status: 404 }));
+    await resolveWorkspace("T404");
+
+    // At +1 minute a positive entry would still be cached; the negative one
+    // must already be gone.
+    setSystemTime(new Date(T0.getTime() + 60_000));
+    await resolveWorkspace("T404");
+    expect(stub.calls.length).toBe(2);
+  });
+
+  test("does not cache 5xx errors as 'not installed'", async () => {
+    const stub = installFetchStub(() => new Response(null, { status: 503 }));
+
+    await expect(resolveWorkspace("T1")).rejects.toThrow(/HTTP 503/);
+
+    // Next call retries immediately instead of serving a cached failure.
+    stub.respond = () => Response.json(WORKSPACE_PAYLOAD);
+    expect(await resolveWorkspace("T1")).toEqual(WORKSPACE_PAYLOAD);
+    expect(stub.calls.length).toBe(2);
+  });
+
+  test("de-dupes concurrent resolves for the same team into one fetch", async () => {
+    let release!: (response: Response) => void;
+    const gate = new Promise<Response>((resolve) => {
+      release = resolve;
+    });
+    const stub = installFetchStub(() => gate);
+
+    const a = resolveWorkspace("T1");
+    const b = resolveWorkspace("T1");
+    // Both calls issued while the first fetch is still in flight.
+    expect(stub.calls.length).toBe(1);
+
+    release(Response.json(WORKSPACE_PAYLOAD));
+    const [resultA, resultB] = await Promise.all([a, b]);
+    expect(resultA).toEqual(WORKSPACE_PAYLOAD);
+    expect(resultB).toEqual(WORKSPACE_PAYLOAD);
+    expect(stub.calls.length).toBe(1);
+
+    // After settling, the in-flight entry is cleared and the cache serves.
+    expect(await resolveWorkspace("T1")).toEqual(WORKSPACE_PAYLOAD);
+    expect(stub.calls.length).toBe(1);
+  });
+
+  test("does not de-dupe across different teams", async () => {
+    const stub = installFetchStub((url) =>
+      Response.json({ ...WORKSPACE_PAYLOAD, teamId: url.split("/").at(-1) }),
+    );
+
+    const [a, b] = await Promise.all([resolveWorkspace("T1"), resolveWorkspace("T2")]);
+    expect(stub.calls.length).toBe(2);
+    expect(a?.teamId).toBe("T1");
+    expect(b?.teamId).toBe("T2");
+  });
+
+  test("rejects incomplete resolve payloads", async () => {
+    installFetchStub(() => Response.json({ orgId: "org_1" }));
+    await expect(resolveWorkspace("T1")).rejects.toThrow(/incomplete payload/);
+  });
+});
diff --git a/apps/slack-agent/agent/lib/maple.ts b/apps/slack-agent/agent/lib/maple.ts
index d2d3ed79a..0cd0b0941 100644
--- a/apps/slack-agent/agent/lib/maple.ts
+++ b/apps/slack-agent/agent/lib/maple.ts
@@ -72,6 +72,15 @@ const cache = new Map<string, CacheEntry>();
 /** De-dupe concurrent resolves for the same team into one in-flight request. */
 const inFlight = new Map<string, Promise<MapleWorkspace | null>>();
 
+/**
+ * Test-only: clears the module-level TTL cache and in-flight de-dupe map so
+ * each test starts from a cold cache. Not used by production code.
+ */
+export function resetWorkspaceCacheForTests(): void {
+  cache.clear();
+  inFlight.clear();
+}
+
 /**
  * Resolves the Maple install for a Slack team, cached in-memory.
  *
diff --git a/apps/slack-agent/bun.lock b/apps/slack-agent/bun.lock
index 6b9d8d5ba..5353b1934 100644
--- a/apps/slack-agent/bun.lock
+++ b/apps/slack-agent/bun.lock
@@ -12,6 +12,7 @@
         "zod": "4.4.3",
       },
       "devDependencies": {
+        "@types/bun": "^1.3.14",
         "@types/node": "24.x",
         "typescript": "7.0.2",
       },
@@ -91,6 +92,8 @@
 
     "@tybys/wasm-util": ["@tybys/wasm-util@0.10.3", "", { "dependencies": { "tslib": "^2.4.0" } }, "sha512-F3fo1MYrRJYL3zER0OUOmkutjr1Vp23m7OsSgp7nq4SP6OqX6C/56XFIPAl5bt3zaBRjmW7SGz3u/6LwFpYcOg=="],
 
+    "@types/bun": ["@types/bun@1.3.14", "", { "dependencies": { "bun-types": "1.3.14" } }, "sha512-h1hFqFVcvAvD9j9K7ZW7vd82aSA+rTdznZa+5bwvCwqSB1jmmfLcbIWhOLx1/+boy/xmjgCs/OMUL8hRJSmnPw=="],
+
     "@types/debug": ["@types/debug@4.1.13", "", { "dependencies": { "@types/ms": "*" } }, "sha512-KSVgmQmzMwPlmtljOomayoR89W4FynCAi3E8PPs7vmDVPe84hT+vGPKkJfThkmXs0x0jAaa9U8uW8bbfyS2fWw=="],
 
     "@types/interpret": ["@types/interpret@1.1.4", "", { "dependencies": { "@types/node": "*" } }, "sha512-r+tPKWHYqaxJOYA3Eik0mMi+SEREqOXLmsooRFmc6GHv7nWUDixFtKN+cegvsPlDcEZd9wxsdp041v2imQuvag=="],
@@ -177,6 +180,8 @@
 
     "brace-expansion": ["brace-expansion@5.0.7", "", { "dependencies": { "balanced-match": "^4.0.2" } }, "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA=="],
 
+    "bun-types": ["bun-types@1.3.14", "", { "dependencies": { "@types/node": "*" } }, "sha512-4N0ig0fEomHt5R0KCFWjovxow98rIoRwKolrYdCcknNwMekCXRnWEUvgu5soYV8QXtVsrUD8B95MBOZGPvr6KQ=="],
+
     "callsites": ["callsites@3.1.0", "", {}, "sha512-P8BjAsXvZS+VIDUI11hHCQEv74YT67YUi5JJFNWIqL235sBmjX4+qx9Muvls5ivyNENctx46xQLQ3aTuE7ssaQ=="],
 
     "cbor-extract": ["cbor-extract@2.2.2", "", { "dependencies": { "node-gyp-build-optional-packages": "5.1.1" }, "optionalDependencies": { "@cbor-extract/cbor-extract-darwin-arm64": "2.2.2", "@cbor-extract/cbor-extract-darwin-x64": "2.2.2", "@cbor-extract/cbor-extract-linux-arm": "2.2.2", "@cbor-extract/cbor-extract-linux-arm64": "2.2.2", "@cbor-extract/cbor-extract-linux-x64": "2.2.2", "@cbor-extract/cbor-extract-win32-x64": "2.2.2" }, "bin": { "download-cbor-prebuilds": "bin/download-prebuilds.js" } }, "sha512-hlSxxI9XO2yQfe9g6msd3g4xCfDqK5T5P0fRMLuaLHhxn4ViPrm+a+MUfhrvH2W962RGxcBwEGzLQyjbDG1gng=="],
diff --git a/apps/slack-agent/package.json b/apps/slack-agent/package.json
index 58332809c..5715d2069 100644
--- a/apps/slack-agent/package.json
+++ b/apps/slack-agent/package.json
@@ -12,6 +12,7 @@
     "dev": "eve dev",
     "start": "eve start",
     "db:setup": "node ./node_modules/@workflow/world-postgres/bin/setup.js",
+    "test": "bun test",
     "typecheck": "tsc"
   },
   "dependencies": {
@@ -22,6 +23,7 @@
     "zod": "4.4.3"
   },
   "devDependencies": {
+    "@types/bun": "^1.3.14",
     "@types/node": "24.x",
     "typescript": "7.0.2"
   },
diff --git a/apps/slack-agent/tsconfig.json b/apps/slack-agent/tsconfig.json
index 37df95497..ff7483854 100644
--- a/apps/slack-agent/tsconfig.json
+++ b/apps/slack-agent/tsconfig.json
@@ -3,7 +3,7 @@
     "target": "ES2022",
     "module": "esnext",
     "moduleResolution": "bundler",
-    "types": ["node"],
+    "types": ["node", "bun"],
     "strict": true,
     "esModuleInterop": true,
     "skipLibCheck": true,
diff --git a/apps/web/src/components/alerts/destination-card.tsx b/apps/web/src/components/alerts/destination-card.tsx
index 3cb358b64..e12ac8871 100644
--- a/apps/web/src/components/alerts/destination-card.tsx
+++ b/apps/web/src/components/alerts/destination-card.tsx
@@ -65,7 +65,8 @@ export function DestinationCard({
 							<span
 								className="rounded-md border px-1.5 py-0.5 text-[10px] font-medium uppercase tracking-wider"
 								style={{
-									borderColor: `${provider.accentText ?? provider.accent}55`,
+									// color-mix (not hex-alpha concat) so `light-dark()` accentText values work.
+									borderColor: `color-mix(in srgb, ${provider.accentText ?? provider.accent} 33%, transparent)`,
 									color: provider.accentText ?? provider.accent,
 									backgroundColor: provider.accentBg,
 								}}
diff --git a/apps/web/src/components/alerts/destination-dialog.tsx b/apps/web/src/components/alerts/destination-dialog.tsx
index c2cee6477..fc247590a 100644
--- a/apps/web/src/components/alerts/destination-dialog.tsx
+++ b/apps/web/src/components/alerts/destination-dialog.tsx
@@ -10,14 +10,14 @@ import {
 	ProviderLogo,
 	type DestinationProvider,
 } from "@/components/alerts/destination-provider"
-import { CircleInfoIcon, HazelIcon, LoaderIcon } from "@/components/icons"
+import { CircleInfoIcon, ExternalLinkIcon, HazelIcon, LoaderIcon } from "@/components/icons"
 import { MapleApiAtomClient } from "@/lib/services/common/atom-client"
 import { MapleApiV2AtomClient } from "@/lib/services/common/v2-atom-client"
 import { disabledResultAtom } from "@/lib/services/atoms/disabled-result-atom"
-import { Result, useAtomSet, useAtomValue } from "@/lib/effect-atom"
+import { Result, useAtomRefresh, useAtomSet, useAtomValue } from "@/lib/effect-atom"
 import type { HazelChannelsListResponse } from "@maple/domain/http"
 import type { V2SlackChannelList } from "@maple/domain/http/v2"
-import { Exit } from "effect"
+import { Exit, Option } from "effect"
 import { Link } from "@tanstack/react-router"
 import { useEffect, useState } from "react"
 import { Button } from "@maple/ui/components/ui/button"
@@ -561,9 +561,16 @@ function SlackBotFields({
 		}),
 	)
 
-	const installed = Result.builder(statusResult)
-		.onSuccess((s) => s.installed)
-		.orElse(() => false)
+	// Fall back to the last good status on a failed refetch so an already-valid
+	// form isn't hard-swapped to an error paragraph mid-edit.
+	const status = Result.builder(statusResult)
+		.onSuccess((s) => s)
+		.orElse(() =>
+			Result.isFailure(statusResult)
+				? Option.getOrNull(Option.map(statusResult.previousSuccess, (previous) => previous.value))
+				: null,
+		)
+	const installed = status?.installed === true
 
 	const channelsAtom = installed
 		? MapleApiV2AtomClient.query("slackIntegration", "channels", {
@@ -571,6 +578,7 @@ function SlackBotFields({
 			})
 		: disabledResultAtom<V2SlackChannelList>()
 	const channelsResult = useAtomValue(channelsAtom)
+	const refreshChannels = useAtomRefresh(channelsAtom)
 
 	const channels = Result.builder(channelsResult)
 		.onSuccess((c) => [...c.channels])
@@ -578,18 +586,24 @@ function SlackBotFields({
 	const channelsLoading = installed && channelsResult.waiting
 	const channelsFailed = Result.isFailure(channelsResult)
 
-	const statusPending = Result.isInitial(statusResult)
-	const statusFailed = Result.isFailure(statusResult)
+	const statusPending = Result.isInitial(statusResult) && status === null
+	const statusFailed = Result.isFailure(statusResult) && status === null
 
 	if (statusPending) {
-		return <p className="text-[11px] text-muted-foreground">Checking your Slack connection…</p>
+		return (
+			<div className="space-y-2 rounded-md border border-dashed border-border/60 p-3">
+				<p className="text-xs text-muted-foreground">Checking your Slack connection…</p>
+			</div>
+		)
 	}
 
 	if (statusFailed) {
 		return (
-			<p className="text-xs text-destructive">
-				Couldn&apos;t check your Slack connection. This may be a temporary issue — try again.
-			</p>
+			<div className="space-y-2 rounded-md border border-dashed border-border/60 p-3">
+				<p className="text-xs text-destructive">
+					Couldn&apos;t check your Slack connection. This may be a temporary issue — try again.
+				</p>
+			</div>
 		)
 	}
 
@@ -598,22 +612,33 @@ function SlackBotFields({
 			<div className="space-y-2 rounded-md border border-dashed border-border/60 p-3">
 				<p className="text-xs text-muted-foreground">
 					The Maple Slack app isn&apos;t installed for this organization yet. Install it from the
-					integrations page, then come back to pick a channel.
+					integrations page (opens in a new tab), then come back to pick a channel.
 				</p>
-				<Link
-					to="/integrations"
-					search={{ integration: "slack" }}
-					className="inline-flex items-center gap-1 text-xs font-medium text-primary underline-offset-2 hover:underline"
+				<Button
+					type="button"
+					size="sm"
+					variant="outline"
+					render={
+						<Link
+							to="/integrations"
+							search={{ integration: "slack" }}
+							target="_blank"
+							rel="noreferrer"
+						/>
+					}
 				>
-					Go to Slack integration →
-				</Link>
+					Open Slack integration
+					<ExternalLinkIcon size={14} />
+				</Button>
 			</div>
 		)
 	}
 
 	const label = (id: string): string => {
 		const channel = channels.find((c) => c.id === id)
-		if (!channel) return form.slackChannelName ? `#${form.slackChannelName}` : ""
+		// Unknown id (stale/stored channel not in the fetched list): prefer the
+		// stored name, but never render an empty label — show the raw id.
+		if (!channel) return form.slackChannelName ? `#${form.slackChannelName}` : id
 		return channel.is_private ? `#${channel.name} (private)` : `#${channel.name}`
 	}
 
@@ -659,7 +684,9 @@ function SlackBotFields({
 										<span className="text-[10px] text-muted-foreground">private</span>
 									) : null}
 									{!channel.is_member ? (
-										<span className="text-[10px] text-warning">bot not in channel</span>
+										<span className="text-[11px] text-warning-foreground">
+											bot not in channel
+										</span>
 									) : null}
 								</span>
 							</ComboboxItem>
@@ -668,9 +695,12 @@ function SlackBotFields({
 				</ComboboxContent>
 			</Combobox>
 			{channelsFailed ? (
-				<p className="text-[11px] text-destructive">
-					Couldn&apos;t load Slack channels. Try reopening this dialog.
-				</p>
+				<div className="flex items-center gap-2">
+					<p className="text-[11px] text-destructive">Couldn&apos;t load Slack channels.</p>
+					<Button type="button" size="xs" variant="ghost" onClick={refreshChannels}>
+						Retry
+					</Button>
+				</div>
 			) : channels.length === 0 && !channelsLoading ? (
 				<p className="text-[11px] text-muted-foreground">
 					No channels returned. Make sure the Maple bot has been added to at least one channel.
diff --git a/apps/web/src/components/alerts/destination-provider.tsx b/apps/web/src/components/alerts/destination-provider.tsx
index 99ba58309..e2c59f877 100644
--- a/apps/web/src/components/alerts/destination-provider.tsx
+++ b/apps/web/src/components/alerts/destination-provider.tsx
@@ -17,7 +17,11 @@ export type DestinationProvider = {
 	accent: string
 	/** subtle background tint for the logo tile */
 	accentBg: string
-	/** readable brand color for text/borders on dark surfaces — falls back to `accent` if omitted */
+	/**
+	 * Readable brand color for text/borders — falls back to `accent` if omitted.
+	 * Use a `light-dark()` value when the brand color only reads on one theme;
+	 * consumers must combine it with `color-mix()` (not hex-alpha concatenation).
+	 */
 	accentText?: string
 	brandfetchDomain?: string
 	monogram?: { letter: string; gradient: [string, string] }
@@ -29,11 +33,12 @@ export type DestinationProvider = {
 export const PROVIDERS: Record<AlertDestinationType, DestinationProvider> = {
 	slack: {
 		type: "slack",
-		label: "Slack",
-		description: "Post alerts to a Slack channel via incoming webhook.",
+		label: "Slack (webhook)",
+		description: "Post alerts to a Slack channel via an incoming webhook you manage.",
 		accent: "#4A154B",
 		accentBg: "rgba(74,21,75,0.30)",
-		accentText: "#E8C5EA",
+		// Slack's pale-lilac only reads on dark; aubergine holds AA on light.
+		accentText: "light-dark(#4A154B, #E8C5EA)",
 		brandfetchDomain: "slack.com",
 		docsUrl: "https://api.slack.com/messaging/webhooks",
 		docsLabel: "Slack webhook docs",
@@ -44,7 +49,7 @@ export const PROVIDERS: Record<AlertDestinationType, DestinationProvider> = {
 		description: "Post alerts to a channel via the installed Maple Slack app — no webhook to manage.",
 		accent: "#4A154B",
 		accentBg: "rgba(74,21,75,0.30)",
-		accentText: "#E8C5EA",
+		accentText: "light-dark(#4A154B, #E8C5EA)",
 		fallbackIcon: ({ size = 22, className }) => <SlackIcon size={size} className={className} />,
 		docsUrl: "https://maple.dev/docs/integrations/slack",
 		docsLabel: "Slack integration guide",
@@ -108,9 +113,10 @@ export const PROVIDERS: Record<AlertDestinationType, DestinationProvider> = {
 	},
 }
 
+// The recommended bot flow leads; the legacy webhook entry trails it.
 export const DESTINATION_TYPES: ReadonlyArray<AlertDestinationType> = [
-	"slack",
 	"slack-bot",
+	"slack",
 	"discord",
 	"email",
 	"pagerduty",
diff --git a/apps/web/src/components/integrations/slack-integration-card.tsx b/apps/web/src/components/integrations/slack-integration-card.tsx
index 70726778b..5cd39e275 100644
--- a/apps/web/src/components/integrations/slack-integration-card.tsx
+++ b/apps/web/src/components/integrations/slack-integration-card.tsx
@@ -11,7 +11,6 @@ import {
 	AlertDialogHeader,
 	AlertDialogTitle,
 } from "@maple/ui/components/ui/alert-dialog"
-import { Badge } from "@maple/ui/components/ui/badge"
 import { Button } from "@maple/ui/components/ui/button"
 import { Skeleton } from "@maple/ui/components/ui/skeleton"
 import { toast } from "sonner"
@@ -117,7 +116,7 @@ export function SlackIntegrationCard() {
 				icon={SlackIcon}
 				accent={SLACK_ACCENT}
 				title="Add Maple to Slack"
-				description="Install the Maple Slack app so your team can ask Maple about their services, traces, and errors right in Slack — and route fired alerts into channels."
+				description="Install the Maple Slack app so your team can ask Maple about services, traces, and errors from Slack — and route fired alerts into channels."
 				features={[
 					{
 						icon: ChatBubbleSparkleIcon,
@@ -162,7 +161,10 @@ export function SlackIntegrationCard() {
 					<div>
 						<div className="flex items-center gap-2">
 							<h3 className="text-sm font-semibold">Slack</h3>
-							<Badge variant="success">Connected</Badge>
+							<span className="flex items-center gap-1.5 text-xs text-muted-foreground">
+								<span className="size-2 shrink-0 rounded-full bg-success" aria-hidden />
+								Connected
+							</span>
 						</div>
 						<p className="mt-1 text-xs text-muted-foreground">
 							The Maple bot answers questions in Slack and delivers alerts to channels. Create a
@@ -170,16 +172,18 @@ export function SlackIntegrationCard() {
 						</p>
 					</div>
 
-					<div className="flex flex-col gap-1 rounded-md bg-muted/40 px-3 py-2 text-[11px] text-muted-foreground">
-						{status?.team_name ? (
-							<div>
-								Workspace: <span className="text-foreground">{status.team_name}</span>
-							</div>
-						) : null}
-						{status?.installed_at ? (
-							<div>Installed {formatAlertDateTime(status.installed_at)}</div>
-						) : null}
-					</div>
+					{status?.team_name || status?.installed_at ? (
+						<div className="flex flex-col gap-1 border-t border-border/60 pt-2 text-[11px] text-muted-foreground">
+							{status?.team_name ? (
+								<div>
+									Workspace: <span className="text-foreground">{status.team_name}</span>
+								</div>
+							) : null}
+							{status?.installed_at ? (
+								<div>Installed {formatAlertDateTime(status.installed_at)}</div>
+							) : null}
+						</div>
+					) : null}
 
 					<div className="flex flex-wrap gap-2">
 						<Button
@@ -213,9 +217,9 @@ export function SlackIntegrationCard() {
 					<AlertDialogFooter>
 						<AlertDialogCancel>Cancel</AlertDialogCancel>
 						<AlertDialogAction
+							variant="destructive"
 							onClick={handleUninstall}
 							disabled={busy !== null}
-							className="bg-destructive text-destructive-foreground hover:bg-destructive/90"
 						>
 							{busy === "uninstall" ? <LoaderIcon size={14} className="animate-spin" /> : null}
 							Disconnect
diff --git a/apps/web/src/routes/integrations.tsx b/apps/web/src/routes/integrations.tsx
index 386ef91ac..d3d810cfb 100644
--- a/apps/web/src/routes/integrations.tsx
+++ b/apps/web/src/routes/integrations.tsx
@@ -37,8 +37,8 @@ const IntegrationsSearch = Schema.Struct({
 	),
 	// Post-OAuth return params set by the Slack install callback redirect.
 	slack: Schema.optional(Schema.Literals(["connected", "error"])),
-	message: Schema.optional(Schema.String),
-	team: Schema.optional(Schema.String),
+	slack_message: Schema.optional(Schema.String),
+	slack_team: Schema.optional(Schema.String),
 })
 
 export const Route = createFileRoute("/integrations")({
@@ -55,14 +55,18 @@ function IntegrationsPage() {
 	// Surface the Slack OAuth callback result once, then strip the return params
 	// from the URL so a refresh doesn't re-toast.
 	const slackReturn = search.slack
-	const slackMessage = search.message
-	const slackTeam = search.team
+	const slackMessage = search.slack_message
+	const slackTeam = search.slack_team
 	useEffect(() => {
 		if (!slackReturn) return
+		// Keyed toast: StrictMode double-invokes effects, and the navigate below can
+		// re-run the effect before the params are stripped — the id dedupes both.
 		if (slackReturn === "connected") {
-			toast.success(slackTeam ? `Slack connected to ${slackTeam}` : "Slack connected")
+			toast.success(slackTeam ? `Slack connected to ${slackTeam}` : "Slack connected", {
+				id: "slack-oauth",
+			})
 		} else {
-			toast.error(slackMessage ?? "Slack connection failed")
+			toast.error(slackMessage ?? "Slack connection failed", { id: "slack-oauth" })
 		}
 		navigate({ search: { integration: "slack" }, replace: true })
 	}, [slackReturn, slackMessage, slackTeam, navigate])
diff --git a/packages/domain/src/http/alerts.ts b/packages/domain/src/http/alerts.ts
index 30d91a503..57722b074 100644
--- a/packages/domain/src/http/alerts.ts
+++ b/packages/domain/src/http/alerts.ts
@@ -282,7 +282,7 @@ export class UpdateSlackBotAlertDestinationConfig extends Schema.Class<UpdateSla
 	"UpdateSlackBotAlertDestinationConfig",
 )({
 	name: OptionalNonEmptyString,
-	channelId: Schema.optionalKey(Schema.String),
+	channelId: OptionalNonEmptyString,
 	channelName: OptionalNonEmptyString,
 	enabled: Schema.optionalKey(Schema.Boolean),
 }) {}
diff --git a/packages/domain/src/http/v2/alert-destinations.ts b/packages/domain/src/http/v2/alert-destinations.ts
index f616aafeb..e06f09f63 100644
--- a/packages/domain/src/http/v2/alert-destinations.ts
+++ b/packages/domain/src/http/v2/alert-destinations.ts
@@ -287,7 +287,7 @@ export const V2AlertDestinationUpdateParams = Schema.Union([
 	Schema.Struct({
 		type: Schema.Literal("slack-bot"),
 		name: optionalNameField,
-		channel_id: Schema.optionalKey(Schema.String),
+		channel_id: OptionalNonEmptyString,
 		channel_name: OptionalNonEmptyString,
 		enabled: Schema.optionalKey(Schema.Boolean),
 	}).annotate({ identifier: "AlertDestinationUpdateSlackBot", title: "Slack (bot) destination update" }),
diff --git a/packages/domain/src/http/v2/openapi.test.ts b/packages/domain/src/http/v2/openapi.test.ts
index aa38bf173..e415c0bca 100644
--- a/packages/domain/src/http/v2/openapi.test.ts
+++ b/packages/domain/src/http/v2/openapi.test.ts
@@ -1,8 +1,17 @@
 import { describe, expect, it } from "@effect/vitest"
 import { Schema } from "effect"
 import { OpenApi } from "effect/unstable/httpapi"
+import {
+	SlackBotAlertDestinationConfig,
+	UpdateSlackBotAlertDestinationConfig,
+} from "../alerts"
 import { MapleApiV2 } from "./api"
-import { V2AlertDestinationMutationResponse } from "./alert-destinations"
+import {
+	V2AlertDestinationCreateParams,
+	V2AlertDestinationMutationResponse,
+	V2AlertDestinationUpdateParams,
+} from "./alert-destinations"
+import { V2SlackChannelList, V2SlackIntegrationStatus } from "./integrations"
 import { V2AnomalyIncident, V2AnomalyIncidentTimeseries, V2AnomalySettings } from "./anomalies"
 import { V2ApiKey, V2ApiKeyCreateParams, V2ApiKeyMutationResponse, V2ApiKeyWithSecret } from "./api-keys"
 import { V2Investigation } from "./investigations"
@@ -311,6 +320,89 @@ describe("MapleApiV2 OpenAPI", () => {
 		expect(operation("post", "/v2/alerts/destinations").responses["200"]).toBeDefined()
 	})
 
+	it("documents the Slack integration schemas with decodable wire examples", () => {
+		const status = schemas["SlackIntegration"]
+		expect(status, "SlackIntegration component present").toBeDefined()
+		expect(status.examples).toHaveLength(1)
+		const decodedStatus = Schema.decodeUnknownSync(V2SlackIntegrationStatus)(status.examples[0])
+		expect(decodedStatus.object).toBe("slack_integration")
+		expect(decodedStatus.installed).toBe(true)
+		expect(decodedStatus.team_id).toBe("T0123ABCD")
+
+		// The channel list carries no authored example — freeze a wire-shape one here.
+		expect(schemas["SlackChannelList"], "SlackChannelList component present").toBeDefined()
+		const channelList = Schema.decodeUnknownSync(V2SlackChannelList)({
+			object: "slack_integration.channel_list",
+			channels: [{ id: "C0789CHAN", name: "incidents", is_private: false, is_member: true }],
+		})
+		expect(channelList.object).toBe("slack_integration.channel_list")
+		expect(channelList.channels[0]?.id).toBe("C0789CHAN")
+	})
+
+	it("decodes slack-bot destination create/update params and rejects a blank channel_id", () => {
+		expect(schemas["AlertDestinationCreateSlackBot"], "create component present").toBeDefined()
+		expect(schemas["AlertDestinationUpdateSlackBot"], "update component present").toBeDefined()
+
+		const created = Schema.decodeUnknownSync(V2AlertDestinationCreateParams)({
+			type: "slack-bot",
+			name: "On-call Slack",
+			channel_id: "C0789CHAN",
+			channel_name: "incidents",
+			enabled: true,
+		})
+		expect(created.type).toBe("slack-bot")
+
+		// channel_name is optional on create.
+		const minimal = Schema.decodeUnknownSync(V2AlertDestinationCreateParams)({
+			type: "slack-bot",
+			name: "On-call Slack",
+			channel_id: "C0789CHAN",
+			enabled: true,
+		})
+		expect(minimal.type).toBe("slack-bot")
+
+		const updated = Schema.decodeUnknownSync(V2AlertDestinationUpdateParams)({
+			type: "slack-bot",
+			channel_name: "alerts",
+		})
+		expect(updated.type).toBe("slack-bot")
+
+		// channel_id was tightened to a non-empty optional string — an explicit
+		// blank must fail decoding instead of silently wiping the stored channel.
+		expect(() =>
+			Schema.decodeUnknownSync(V2AlertDestinationUpdateParams)({
+				type: "slack-bot",
+				channel_id: "",
+			}),
+		).toThrow()
+	})
+
+	it("decodes the internal slack-bot destination config schemas", () => {
+		const config = Schema.decodeUnknownSync(SlackBotAlertDestinationConfig)({
+			type: "slack-bot",
+			name: "Slack bot",
+			channelId: "C0789CHAN",
+			channelName: "incidents",
+			enabled: true,
+		})
+		expect(config.channelId).toBe("C0789CHAN")
+
+		const update = Schema.decodeUnknownSync(UpdateSlackBotAlertDestinationConfig)({
+			channelName: "alerts",
+		})
+		expect(update.channelName).toBe("alerts")
+
+		// Same tightening as the v2 params: a blank channelId must fail decoding.
+		expect(() => Schema.decodeUnknownSync(UpdateSlackBotAlertDestinationConfig)({ channelId: "" })).toThrow()
+		expect(() =>
+			Schema.decodeUnknownSync(SlackBotAlertDestinationConfig)({
+				type: "slack-bot",
+				name: "Slack bot",
+				channelId: "",
+			}),
+		).toThrow()
+	})
+
 	it("documents the public-ID and Scope primitives with examples", () => {
 		expect(schemas["_maple_ApiKeyId"].description).toContain("public object ID")
 		expect(schemas["_maple_ApiKeyId"].examples?.[0]).toMatch(/^key_/)

From 0c2d931b71d12eed1f4057f8f714000aae6eeed2 Mon Sep 17 00:00:00 2001
From: JeremyFunk <jeremy@kombo.dev>
Date: Wed, 22 Jul 2026 11:38:59 +0200
Subject: [PATCH 6/8] fix(mcp): emit object-typed inputSchema for no-param
 tools
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

An empty Schema.Struct({}) compiles to `{ anyOf: [{type:object},{type:array}] }`
in effect 4.0.0-beta.93, with no top-level `type: "object"`. Strict MCP clients
(the Vercel AI SDK used by the eve Slack agent) validate each tool's
inputSchema.type against z.literal("object"), so list_source_repositories (tool
#40) fails to parse and aborts the ENTIRE tools/list response — dropping every
Maple tool from the connection.

Normalize a no-property struct to an explicit empty object schema centrally in
toInputSchema so all current and future no-param tools stay MCP-compliant. Add a
test asserting every registered tool emits inputSchema.type === "object".

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 apps/api/src/mcp/dispatcher.test.ts |  7 +++++++
 apps/api/src/mcp/tools/registry.ts  | 22 +++++++++++++++++++---
 2 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/apps/api/src/mcp/dispatcher.test.ts b/apps/api/src/mcp/dispatcher.test.ts
index e7eaad0b7..922bf78c6 100644
--- a/apps/api/src/mcp/dispatcher.test.ts
+++ b/apps/api/src/mcp/dispatcher.test.ts
@@ -18,6 +18,13 @@ describe("MCP dispatcher", () => {
 		}),
 	)
 
+	it("emits an object-typed inputSchema for every tool (strict MCP clients require it)", () => {
+		for (const definition of mapleToolDefinitions) {
+			const inputSchema = toInputSchema(definition.schema)
+			expect(inputSchema.type, `${definition.name} inputSchema.type`).toBe("object")
+		}
+	})
+
 	it.effect("returns MCP validation feedback for invalid model tool input", () =>
 		Effect.gen(function* () {
 			const result = yield* callMcpTool("inspect_trace", {}) as unknown as Effect.Effect<
diff --git a/apps/api/src/mcp/tools/registry.ts b/apps/api/src/mcp/tools/registry.ts
index 8563953b1..18c870c7d 100644
--- a/apps/api/src/mcp/tools/registry.ts
+++ b/apps/api/src/mcp/tools/registry.ts
@@ -69,9 +69,25 @@ export interface MapleToolDefinition {
 
 export const toInputSchema = (schema: Schema.Top): Record<string, unknown> => {
 	const document = Schema.toJsonSchemaDocument(schema)
-	return Object.keys(document.definitions).length > 0
-		? { ...document.schema, $defs: document.definitions }
-		: document.schema
+	const base =
+		Object.keys(document.definitions).length > 0
+			? { ...document.schema, $defs: document.definitions }
+			: document.schema
+	// MCP requires the top-level inputSchema to be an object schema (`type: "object"`).
+	// Effect emits `{ anyOf: [{ type: "object" }, { type: "array" }] }` for an empty
+	// `Struct({})` (a no-parameter tool), which strict MCP clients reject — the Vercel
+	// AI SDK's `tools/list` Zod validator fails on `inputSchema.type` and drops EVERY
+	// tool from the connection. Normalize a no-property struct to an explicit empty
+	// object schema. `$ref` roots (hoisted schemas) already carry a valid object type.
+	if (base.type !== "object" && !("$ref" in base)) {
+		return {
+			type: "object",
+			properties: {},
+			additionalProperties: false,
+			...("$defs" in base ? { $defs: base.$defs } : {}),
+		}
+	}
+	return base
 }
 
 const collectMapleToolDefinitions = (): ReadonlyArray<MapleToolDefinition> => {

From 7781b519ae31407785f0e1c88c4b680debf0c62a Mon Sep 17 00:00:00 2001
From: JeremyFunk <jeremy@kombo.dev>
Date: Wed, 22 Jul 2026 11:40:59 +0200
Subject: [PATCH 7/8] fix(web): purge foreign Clerk instance cookies to stop
 cross-env 403s
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All deployed stages share the maple.dev registrable domain, but PR
previews/staging run the dev Clerk instance while prod runs the
production one. Both write __client_uat cookies on Domain=maple.dev, so
browsing multiple environments makes the instances overwrite each
other's session hints and ClerkJS handshakes against the wrong frontend
API — surfacing as transient 403s on app-pr-N/api-pr-N and prod.

Purge foreign-instance parent-domain __client_uat* cookies (suffix
derived from the publishable key, mirroring @clerk/shared) before
ClerkJS initializes. Mitigation until preview/staging move to their own
registrable domain, per Clerk's same-domain limitation.

Also document the channels:history Slack bot scope in the slack-agent
README.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 apps/slack-agent/README.md                    |   1 +
 .../common/clerk-cookie-guard.test.ts         |  53 +++++++++
 .../lib/services/common/clerk-cookie-guard.ts | 103 ++++++++++++++++++
 apps/web/src/main.tsx                         |  23 +++-
 4 files changed, 175 insertions(+), 5 deletions(-)
 create mode 100644 apps/web/src/lib/services/common/clerk-cookie-guard.test.ts
 create mode 100644 apps/web/src/lib/services/common/clerk-cookie-guard.ts

diff --git a/apps/slack-agent/README.md b/apps/slack-agent/README.md
index 401958cee..d7805fd9e 100644
--- a/apps/slack-agent/README.md
+++ b/apps/slack-agent/README.md
@@ -110,6 +110,7 @@ oauth_config:
       - chat:write          # post replies
       - chat:write.public   # post in channels the bot isn't a member of
       - channels:read       # resolve public channel metadata
+      - channels:history
       - groups:read         # resolve private channel metadata
       - im:history          # read DM history (message.im)
       - im:read             # resolve DM conversation metadata
diff --git a/apps/web/src/lib/services/common/clerk-cookie-guard.test.ts b/apps/web/src/lib/services/common/clerk-cookie-guard.test.ts
new file mode 100644
index 000000000..2cf2a07ba
--- /dev/null
+++ b/apps/web/src/lib/services/common/clerk-cookie-guard.test.ts
@@ -0,0 +1,53 @@
+import { describe, expect, it } from "vitest"
+import {
+	computeClerkCookieSuffix,
+	cookieDomainCandidates,
+	foreignClientUatCookieNames,
+} from "./clerk-cookie-guard"
+
+describe("computeClerkCookieSuffix", () => {
+	it("matches ClerkJS's suffix for the production publishable key", async () => {
+		// Observed in the wild: prod (`pk_live_Y2xlcmsubWFwbGUuZGV2JA`, FAPI
+		// clerk.maple.dev) writes `__client_uat_Gu_OZvPU` on Domain=maple.dev.
+		await expect(computeClerkCookieSuffix("pk_live_Y2xlcmsubWFwbGUuZGV2JA")).resolves.toBe(
+			"Gu_OZvPU",
+		)
+	})
+})
+
+describe("foreignClientUatCookieNames", () => {
+	it("keeps the own-instance suffixed cookie, drops foreign and legacy ones", () => {
+		const names = [
+			"__client_uat",
+			"__client_uat_Gu_OZvPU",
+			"__client_uat_lpBWIqOU",
+			"__session",
+			"__clerk_db_jwt",
+			"clerk_active_context",
+		]
+		expect(foreignClientUatCookieNames(names, "lpBWIqOU")).toEqual([
+			"__client_uat",
+			"__client_uat_Gu_OZvPU",
+		])
+	})
+
+	it("returns nothing when only own-instance cookies exist", () => {
+		expect(foreignClientUatCookieNames(["__client_uat_lpBWIqOU", "__session"], "lpBWIqOU")).toEqual(
+			[],
+		)
+	})
+})
+
+describe("cookieDomainCandidates", () => {
+	it("walks from the host up to the two-label parent", () => {
+		expect(cookieDomainCandidates("app-pr-246.maple.dev")).toEqual([
+			"app-pr-246.maple.dev",
+			"maple.dev",
+		])
+		expect(cookieDomainCandidates("app.maple.dev")).toEqual(["app.maple.dev", "maple.dev"])
+	})
+
+	it("handles single-label hosts", () => {
+		expect(cookieDomainCandidates("localhost")).toEqual(["localhost"])
+	})
+})
diff --git a/apps/web/src/lib/services/common/clerk-cookie-guard.ts b/apps/web/src/lib/services/common/clerk-cookie-guard.ts
new file mode 100644
index 000000000..00f1d3fdd
--- /dev/null
+++ b/apps/web/src/lib/services/common/clerk-cookie-guard.ts
@@ -0,0 +1,103 @@
+/**
+ * Guard against cross-environment Clerk cookie collisions.
+ *
+ * Every deployed Maple environment lives on a subdomain of the same
+ * registrable domain (`app.maple.dev`, `staging.maple.dev`,
+ * `app-pr-<n>.maple.dev`, …), but they do NOT share one Clerk instance:
+ * production runs the production Clerk instance (FAPI at `clerk.maple.dev`)
+ * while PR previews and staging run the development instance. ClerkJS writes
+ * its `__client_uat` cookies (both the shared legacy name and the
+ * per-instance `__client_uat_<suffix>` variant) on the eTLD+1 —
+ * `Domain=maple.dev` — so each instance sees, and fights over, the other
+ * instance's session-state hint. When the hint disagrees with the local
+ * session, ClerkJS starts a handshake against its Frontend API, which the
+ * "wrong" instance answers with transient 403s / redirect loops. Clerk
+ * documents this limitation: independent environments must not share the
+ * production application's domain, even on separate subdomains.
+ *
+ * Until preview/staging move to their own registrable domain, this guard
+ * runs before ClerkJS initializes and deletes any parent-domain
+ * `__client_uat*` cookie that does not belong to the current deployment's
+ * Clerk instance (plus the un-suffixed legacy cookie, which the instances
+ * overwrite with conflicting values — ClerkJS re-syncs it for the active
+ * instance on its next write). Host-only cookies (`__session`,
+ * `__clerk_db_jwt`) never leak across environments and are left alone.
+ */
+
+const CLIENT_UAT_PREFIX = "__client_uat"
+
+/**
+ * Clerk's per-instance cookie suffix: base64url(sha1(publishableKey)),
+ * first 8 chars — mirrors `getCookieSuffix` in @clerk/shared.
+ */
+export async function computeClerkCookieSuffix(
+	publishableKey: string,
+	subtle: SubtleCrypto = globalThis.crypto.subtle,
+): Promise<string> {
+	const digest = await subtle.digest("SHA-1", new TextEncoder().encode(publishableKey))
+	const bytes = Array.from(new Uint8Array(digest))
+	return btoa(String.fromCharCode(...bytes))
+		.replace(/\+/g, "-")
+		.replace(/\//g, "_")
+		.substring(0, 8)
+}
+
+/**
+ * Given all visible cookie names, return the `__client_uat*` cookies that do
+ * not belong to the instance identified by `ownSuffix`: every foreign
+ * `__client_uat_<other>` plus the shared legacy `__client_uat`.
+ */
+export function foreignClientUatCookieNames(cookieNames: readonly string[], ownSuffix: string): string[] {
+	return cookieNames.filter((name) => {
+		if (name === CLIENT_UAT_PREFIX) return true
+		if (!name.startsWith(`${CLIENT_UAT_PREFIX}_`)) return false
+		return name.slice(CLIENT_UAT_PREFIX.length + 1) !== ownSuffix
+	})
+}
+
+/**
+ * Candidate `Domain=` attributes a parent-domain cookie could have been set
+ * with: the host itself and every parent with at least two labels
+ * (`app-pr-1.maple.dev` → [`app-pr-1.maple.dev`, `maple.dev`]). Deleting a
+ * cookie requires matching its domain attribute, and we cannot read it, so
+ * we expire the name across all candidates.
+ */
+export function cookieDomainCandidates(hostname: string): string[] {
+	const labels = hostname.split(".")
+	const candidates: string[] = []
+	for (let i = 0; i < labels.length - 1; i++) {
+		candidates.push(labels.slice(i).join("."))
+	}
+	return candidates.length > 0 ? candidates : [hostname]
+}
+
+function parseCookieNames(cookieHeader: string): string[] {
+	return cookieHeader
+		.split(";")
+		.map((part) => part.split("=")[0]?.trim() ?? "")
+		.filter((name) => name.length > 0)
+}
+
+/**
+ * Delete foreign-instance `__client_uat*` cookies before ClerkJS boots.
+ * Never throws — auth must not be blocked by the cleanup.
+ */
+export async function purgeForeignClerkCookies(publishableKey: string): Promise<void> {
+	try {
+		if (typeof document === "undefined") return
+		const ownSuffix = await computeClerkCookieSuffix(publishableKey)
+		const stale = foreignClientUatCookieNames(parseCookieNames(document.cookie), ownSuffix)
+		if (stale.length === 0) return
+		const expiry = "expires=Thu, 01 Jan 1970 00:00:00 GMT"
+		for (const name of stale) {
+			// Host-only variant plus every possible Domain= attribute.
+			document.cookie = `${name}=;path=/;${expiry}`
+			for (const domain of cookieDomainCandidates(window.location.hostname)) {
+				document.cookie = `${name}=;path=/;domain=${domain};${expiry}`
+			}
+		}
+	} catch {
+		// Best-effort: a failed purge just means the pre-existing (broken)
+		// behavior — never block app boot on it.
+	}
+}
diff --git a/apps/web/src/main.tsx b/apps/web/src/main.tsx
index f186486bc..96a00a2ef 100644
--- a/apps/web/src/main.tsx
+++ b/apps/web/src/main.tsx
@@ -4,6 +4,7 @@ import ReactDOM from "react-dom/client"
 import { EffectRouterProvider } from "@effect-router/core/react"
 import { apiBaseUrl } from "./lib/services/common/api-base-url"
 import { ClerkAuthBridge } from "./lib/services/common/clerk-auth-bridge"
+import { purgeForeignClerkCookies } from "./lib/services/common/clerk-cookie-guard"
 import { isClerkAuthEnabled } from "./lib/services/common/auth-mode"
 import {
 	installSelfHostedAuthHeadersProvider,
@@ -191,8 +192,20 @@ const app = isClerkAuthEnabled ? (
 	<SelfHostedInnerApp />
 )
 
-ReactDOM.createRoot(root).render(
-	<StrictMode>
-		<AppErrorBoundary>{app}</AppErrorBoundary>
-	</StrictMode>,
-)
+const renderApp = () => {
+	ReactDOM.createRoot(root).render(
+		<StrictMode>
+			<AppErrorBoundary>{app}</AppErrorBoundary>
+		</StrictMode>,
+	)
+}
+
+// All deployed environments share the `maple.dev` parent domain but not the
+// same Clerk instance; purge the other instances' parent-domain cookies
+// BEFORE ClerkJS reads them, or it handshakes against the wrong instance and
+// intermittently 403s (see clerk-cookie-guard.ts). The purge never rejects.
+if (isClerkAuthEnabled && clerkPublishableKey) {
+	void purgeForeignClerkCookies(clerkPublishableKey).then(renderApp)
+} else {
+	renderApp()
+}

From a159e6744a4f4f0e37d64f406e7512d878abf187 Mon Sep 17 00:00:00 2001
From: JeremyFunk <jeremy@kombo.dev>
Date: Wed, 22 Jul 2026 13:34:10 +0200
Subject: [PATCH 8/8] fix(electric-sync): 503 on half-configured Electric Cloud
 creds
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The shape proxy only treated a missing ELECTRIC_URL as "not configured".
A deploy with ELECTRIC_URL + ELECTRIC_SOURCE_ID but no ELECTRIC_SECRET
(e.g. a PR preview inheriting shared Infisical Electric config while its
per-PR source step is skipped) forwarded an unauthenticated request to
Electric Cloud, which returns 401 MISSING_SECRET — surfacing as a hard-
broken shape stream in the browser instead of graceful degradation.

Treat incoherent Cloud credentials (exactly one of source_id/secret) as
not-configured and take the existing 503 path, and log the misconfig for
telemetry. Adds isElectricConfigCoherent + unit tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 apps/electric-sync/src/routes/shape.http.ts | 43 +++++++++++++++++++--
 apps/electric-sync/src/routes/shape.test.ts | 25 +++++++++++-
 2 files changed, 63 insertions(+), 5 deletions(-)

diff --git a/apps/electric-sync/src/routes/shape.http.ts b/apps/electric-sync/src/routes/shape.http.ts
index 7c9080fe2..0e39b2b83 100644
--- a/apps/electric-sync/src/routes/shape.http.ts
+++ b/apps/electric-sync/src/routes/shape.http.ts
@@ -215,6 +215,23 @@ export const buildUpstreamShapeUrl = (args: {
 	return url.toString()
 }
 
+/**
+ * Electric Cloud authenticates every shape request with a source `secret`
+ * (paired with `source_id`); self-hosted Electric (local docker) needs neither.
+ * A config carrying exactly ONE of the two is incoherent — most commonly a
+ * deploy that inherited a shared `ELECTRIC_URL` + `ELECTRIC_SOURCE_ID` from the
+ * secret store but no matching `ELECTRIC_SECRET` (e.g. a PR preview whose per-PR
+ * Electric source step was skipped because the CLI token isn't provisioned).
+ * Forwarding that upstream is a guaranteed 401 `MISSING_SECRET` from Electric
+ * Cloud, which surfaces as a hard-broken shape stream in the browser. Instead we
+ * treat it as "not configured" and take the same 503 graceful-degrade path as a
+ * missing `ELECTRIC_URL`. Pure + exported so the coherence rule is unit-tested.
+ */
+export const isElectricConfigCoherent = (creds: {
+	readonly sourceId: string | undefined
+	readonly secret: string | undefined
+}): boolean => (creds.sourceId === undefined) === (creds.secret === undefined)
+
 const errorText = (message: string, status: number) =>
 	HttpServerResponse.text(message, {
 		status,
@@ -233,13 +250,31 @@ export const ElectricSyncRouter = HttpRouter.use((router) =>
 			onNone: () => undefined,
 			onSome: Redacted.value,
 		})
+		// Electric Cloud needs `source_id` + `secret` together; a half-configured
+		// deploy would forward a doomed unauthenticated request (401 MISSING_SECRET).
+		// Detect it once at isolate startup and disable sync (503 below) rather than
+		// per-request, and log so the misconfiguration is discoverable in telemetry.
+		const configCoherent = isElectricConfigCoherent({ sourceId, secret })
+		if (electricUrl && !configCoherent) {
+			yield* Effect.logWarning(
+				"Electric sync disabled: incoherent Cloud credentials — set both ELECTRIC_SOURCE_ID and ELECTRIC_SECRET, or neither",
+			).pipe(
+				Effect.annotateLogs({
+					hasSourceId: sourceId !== undefined,
+					hasSecret: secret !== undefined,
+				}),
+			)
+		}
 
 		const handle = (req: HttpServerRequest.HttpServerRequest) =>
 			Effect.gen(function* () {
-				// Not configured (e.g. self-hosted without an Electric container) →
-				// 503; the web app's collections degrade and it keeps using its
-				// existing effect-atom fetches.
-				if (!electricUrl) return errorText("Electric sync is not configured", 503)
+				// Not configured (self-hosted without an Electric container, or a
+				// half-configured Cloud deploy missing its source secret) → 503; the
+				// web app's collections degrade and it keeps using its existing
+				// effect-atom fetches.
+				if (!electricUrl || !configCoherent) {
+					return errorText("Electric sync is not configured", 503)
+				}
 
 				const requestUrl = new URL(req.url, "http://internal")
 				const shapeParam = requestUrl.searchParams.get("shape")
diff --git a/apps/electric-sync/src/routes/shape.test.ts b/apps/electric-sync/src/routes/shape.test.ts
index 5bfe10cba..617dc495f 100644
--- a/apps/electric-sync/src/routes/shape.test.ts
+++ b/apps/electric-sync/src/routes/shape.test.ts
@@ -1,5 +1,10 @@
 import { assert, describe, it } from "@effect/vitest"
-import { buildUpstreamShapeUrl, isShapeName, shapeResponseHeaders } from "./shape.http"
+import {
+	buildUpstreamShapeUrl,
+	isElectricConfigCoherent,
+	isShapeName,
+	shapeResponseHeaders,
+} from "./shape.http"
 
 const parse = (raw: string) => {
 	const url = new URL(raw)
@@ -23,6 +28,24 @@ describe("isShapeName", () => {
 	})
 })
 
+describe("isElectricConfigCoherent", () => {
+	it("accepts self-hosted (neither source id nor secret)", () => {
+		assert.isTrue(isElectricConfigCoherent({ sourceId: undefined, secret: undefined }))
+	})
+
+	it("accepts Electric Cloud (both source id and secret)", () => {
+		assert.isTrue(isElectricConfigCoherent({ sourceId: "src_1", secret: "sh_secret" }))
+	})
+
+	it("rejects a source id without a secret (the skipped-per-PR-source case)", () => {
+		assert.isFalse(isElectricConfigCoherent({ sourceId: "src_1", secret: undefined }))
+	})
+
+	it("rejects a secret without a source id", () => {
+		assert.isFalse(isElectricConfigCoherent({ sourceId: undefined, secret: "sh_secret" }))
+	})
+})
+
 describe("buildUpstreamShapeUrl", () => {
 	const base = {
 		electricUrl: "http://electric:3000",