@aeolus-fleet/gateway 0.32.2 → 0.34.0

package/dist/adapters/trpc/router.js

@@ -14,6 +14,7 @@ import { idempotencyKeySchema, idSchema, scopeNameSchema, shipHandleSchema } fro
 import { initTRPC, TRPCError } from '@trpc/server';
 import { z } from 'zod';
 import { APPROVING_SCOPE } from '../../core/parties/approver.js';
+import { SLACK_SCOPE } from '../../core/slack/connect-slack.js';
 /** The header the web app's waiting page sends its browser's secret in (web/lib/gateway-api/gateway-api.ts names the same). */
 export const WAITING_SECRET_HEADER = 'aeolus-waiting-secret';
 /** What a caller reads of a failure: nothing of it, so no crew token, secret or query ever leaves; the log holds it whole. */
@@ -164,6 +165,7 @@ const CREW_CODES = {
 /** The refusals of reading an outside MCP server's tools, as the API states them. */
 const TOOLS_CODES = {
     NO_SUCH_PARTY: 'NOT_FOUND',
+    NOT_SIGNED_IN: 'PRECONDITION_FAILED',
     SERVER_UNREACHABLE: 'BAD_GATEWAY',
 };
 /** The refusals of reading the scopes the fleet lists, as the API states them. */
@@ -180,6 +182,7 @@ const SWITCH_TOOLS_CODES = {
     NOT_REACHABLE: 'FORBIDDEN',
     NOT_CONNECTED: 'PRECONDITION_FAILED',
     FLEET_UNAVAILABLE: 'BAD_GATEWAY',
+    NOT_SIGNED_IN: 'PRECONDITION_FAILED',
     SERVER_UNREACHABLE: 'BAD_GATEWAY',
     NO_SUCH_TOOL: 'NOT_FOUND',
 };
@@ -201,6 +204,15 @@ function scopeRequirementsOutputOf(requirements) {
     return { version: requirements.version, party: [...requirements.party], tools: [...requirements.tools].map(([tool, scopes]) => ({ tool, scopes: [...scopes] })) };
 }
 /** The refusals of checking an outside MCP server, as the API states them. */
+/** The refusals of adding a server where each person signs in, as the API states them: a fleet that does not answer is tried again with the same request id. */
+const ADD_SIGN_IN_SERVER_CODES = {
+    ...APPROVE_CODES,
+    SERVER_UNREACHABLE: 'BAD_GATEWAY',
+    NO_AUTHORIZATION_SERVER: 'BAD_REQUEST',
+    SIGN_IN_CHECK_FAILED: 'BAD_REQUEST',
+    NO_DYNAMIC_REGISTRATION: 'BAD_REQUEST',
+    REGISTRATION_REFUSED: 'BAD_GATEWAY',
+};
 const CHECK_CODES = {
     OUTSIDE_PARTIES_OFF: 'PRECONDITION_FAILED',
     SERVER_UNREACHABLE: 'BAD_GATEWAY',
@@ -209,9 +221,45 @@ const CHECK_CODES = {
 const STATE_CODES = {
     NO_SUCH_PARTY: 'NOT_FOUND',
     NOT_CREWED: 'CONFLICT',
+    NOT_SIGNED_IN: 'PRECONDITION_FAILED',
     SERVER_UNREACHABLE: 'BAD_GATEWAY',
     STATEMENT_REFUSED: 'BAD_REQUEST',
 };
+/** The refusals of a person's own sign-in to an outside MCP server, as the API states them. */
+const PARTY_SIGN_IN_CODES = {
+    NOT_A_PERSON: 'FORBIDDEN',
+    NO_SUCH_PARTY: 'NOT_FOUND',
+    NO_SIGN_IN: 'BAD_REQUEST',
+    NOT_SIGNED_IN: 'NOT_FOUND',
+};
+/** The refusals of an approver's view and removal of everyone's sign-ins to a party, as the API states them. */
+const SIGN_INS_CODES = {
+    NOT_AN_APPROVER: 'FORBIDDEN',
+    NO_SUCH_PARTY: 'NOT_FOUND',
+    PARTY_NOT_COMMISSIONED: 'PRECONDITION_FAILED',
+    NOT_REACHABLE: 'FORBIDDEN',
+    NOT_CONNECTED: 'PRECONDITION_FAILED',
+    FLEET_UNAVAILABLE: 'BAD_GATEWAY',
+    NO_SIGN_IN: 'BAD_REQUEST',
+    NOT_SIGNED_IN: 'NOT_FOUND',
+};
+const heldGrantShape = { outsideAccount: z.object({ subject: z.string().nullable(), name: z.string().nullable() }), signedInAt: z.string(), lastUsedAt: z.string().nullable() };
+/** A person's own sign-in to a party, as their page shows it: never a token. A lost one says when and why. */
+const ownSignInOutputSchema = z.discriminatedUnion('state', [
+    z.object({ state: z.literal('notSignedIn') }),
+    z.object({ state: z.literal('signedIn'), ...heldGrantShape }),
+    z.object({ state: z.literal('lost'), ...heldGrantShape, lost: z.object({ at: z.string(), why: z.string() }) }),
+]);
+/** Whose sign-in an approver sees: the person ship, its name where the fleet answers one, and whether it is the approver's own. */
+const personShape = { personShipId: z.string(), personName: z.string().nullable(), isYours: z.boolean() };
+/** Everyone's sign-ins to a party, a page at a time, as an approver sees them: never a token. */
+const signInsOutputSchema = z.object({
+    grants: z.array(z.discriminatedUnion('state', [
+        z.object({ ...personShape, state: z.literal('signedIn'), ...heldGrantShape }),
+        z.object({ ...personShape, state: z.literal('lost'), ...heldGrantShape, lost: z.object({ at: z.string(), why: z.string() }) }),
+    ])),
+    next: z.string().nullable(),
+});
 /** The longest name argo gives an MCP client. */
 const CLIENT_NAME_MAX_LENGTH = 200;
 /** The longest tool name MCP allows (2026-07-28), as a capability's name is capped too. */
@@ -235,12 +283,18 @@ const credentialInputSchema = z.discriminatedUnion('kind', [
         scope: z.string().min(1).optional(),
     }),
 ]);
+/**
+ * An outside MCP server's credential as the approver gives it: one of the
+ * vault's, or each person signing in, for which the gateway registers the
+ * party's client itself (decision 0067).
+ */
+const serverCredentialInputSchema = z.discriminatedUnion('kind', [...credentialInputSchema.options, z.strictObject({ kind: z.literal('personSignIn') })]);
 /** A party as any actor reads it: never its credential or its crew token. */
 const shownPartyBase = { name: z.string(), state: z.enum(['commissioning', 'awaitingCrew', 'crewed']), proxyShipId: z.string().nullable() };
 /** An outside A2A agent's own fields: its card address, its credential's kind, its calls at once and its repeatable mark (A9). */
 const agentFields = { cardUrl: z.string(), credentialKind: z.enum(['none', 'bearer', 'clientCredentials']), concurrencyLimit: z.int(), isRepeatable: z.boolean() };
 const shownPartySchema = z.discriminatedUnion('kind', [
-    z.object({ ...shownPartyBase, kind: z.literal('mcpServer'), url: z.string(), credentialKind: z.enum(['none', 'bearer', 'clientCredentials']), concurrencyLimit: z.int() }),
+    z.object({ ...shownPartyBase, kind: z.literal('mcpServer'), url: z.string(), credentialKind: z.enum(['none', 'bearer', 'clientCredentials', 'personSignIn']), concurrencyLimit: z.int() }),
     z.object({ ...shownPartyBase, kind: z.literal('mcpClient'), clientId: z.string() }),
     z.object({ ...shownPartyBase, kind: z.literal('a2aClient') }),
     z.object({ ...shownPartyBase, kind: z.literal('a2aAgent'), ...agentFields }),
@@ -248,7 +302,7 @@ const shownPartySchema = z.discriminatedUnion('kind', [
 /** A party with its proxy ship's name, owner and scopes, read from the fleet (decision 0056): null while unknown. */
 const fromFleet = { proxyShipName: z.string().nullable(), ownerShipId: z.string().nullable(), ownerName: z.string().nullable(), scopes: z.array(z.string()).nullable() };
 const listedPartySchema = z.discriminatedUnion('kind', [
-    z.object({ ...shownPartyBase, ...fromFleet, kind: z.literal('mcpServer'), url: z.string(), credentialKind: z.enum(['none', 'bearer', 'clientCredentials']), concurrencyLimit: z.int() }),
+    z.object({ ...shownPartyBase, ...fromFleet, kind: z.literal('mcpServer'), url: z.string(), credentialKind: z.enum(['none', 'bearer', 'clientCredentials', 'personSignIn']), concurrencyLimit: z.int() }),
     z.object({ ...shownPartyBase, ...fromFleet, kind: z.literal('mcpClient'), clientId: z.string() }),
     z.object({ ...shownPartyBase, ...fromFleet, kind: z.literal('a2aClient') }),
     z.object({ ...shownPartyBase, ...fromFleet, kind: z.literal('a2aAgent'), ...agentFields }),
@@ -373,21 +427,58 @@ const webPushSubscriptionInputSchema = z.strictObject({
     keys: z.strictObject({ p256dh: z.string().min(1), auth: z.string().min(1) }),
     browser: z.string(),
 });
-/** The fleet's name as the person's shared sign-in states it, which their web push wakes say (wake a person, W4). */
-async function fleetNameOf(ctx) {
+/** The fleet's name as the account's shared sign-in states it, which their web push wakes say (wake a person, W4) and the gateway's Slack bot is named (gateway scopes B5). */
+async function fleetNameOf(ctx, asked) {
     if (ctx.accountApps === undefined || ctx.signIn === undefined) {
-        throw new TRPCError({ code: 'FORBIDDEN', message: "Open the gateway's pages, signed in with your account, to turn web push on" });
+        throw new TRPCError({ code: 'FORBIDDEN', message: `Open the gateway's pages, signed in with your account, to ${asked.toDo}` });
     }
     const apps = await ctx.accountApps(ctx.signIn);
     if (!apps.isOk) {
         throw apps.error.kind === 'signedOut' ? new TRPCError({ code: 'UNAUTHORIZED', message: 'Sign in with your account' }) : new TRPCError({ code: 'SERVICE_UNAVAILABLE', message: 'The sign-in service did not answer: try again' });
     }
-    const fleet = apps.value.fleets.find(({ fleetId }) => fleetId === ctx.caller.fleetId);
+    const fleet = apps.value.fleets.find(({ fleetId }) => fleetId === asked.fleetId);
     if (fleet === undefined) {
         throw new TRPCError({ code: 'FORBIDDEN', message: 'Your account may not open this fleet' });
     }
     return fleet.name;
 }
+/** The refusals of the fleet's Slack, as the API states them. */
+const SLACK_CODES = {
+    SLACK_SCOPE_NOT_HELD: 'FORBIDDEN',
+    NOT_AN_ACCOUNT: 'FORBIDDEN',
+    ALREADY_CONNECTED: 'CONFLICT',
+    OTHER_WORKSPACE: 'CONFLICT',
+    SLACK_NOT_CONNECTED: 'NOT_FOUND',
+    SLACK_TOKEN_REFUSED: 'BAD_REQUEST',
+    SLACK_UNAVAILABLE: 'SERVICE_UNAVAILABLE',
+    NO_SUCH_BOT: 'NOT_FOUND',
+    NOT_A_PERSON: 'FORBIDDEN',
+    NOT_LINKED: 'NOT_FOUND',
+    NOT_REACHABLE: 'FORBIDDEN',
+    NOT_EXPOSABLE: 'BAD_REQUEST',
+    CONFLICT: 'CONFLICT',
+    FLEET_UNAVAILABLE: 'SERVICE_UNAVAILABLE',
+};
+/** The Slack procedures' answer, or its refusal as the API states it. */
+function slackAnswerOf(answered) {
+    if (!answered.isOk) {
+        throw new TRPCError({ code: SLACK_CODES[answered.error.kind], message: answered.error.message });
+    }
+    return answered.value;
+}
+const slackViewOutputSchema = z.discriminatedUnion('state', [
+    z.object({ state: z.literal('notConnected'), canChange: z.boolean() }),
+    z.object({
+        state: z.literal('connected'),
+        workspace: z.object({ teamId: z.string(), name: z.string().nullable() }),
+        connectedBy: z.string(),
+        connectedAt: z.string(),
+        tokenState: z.enum(['fresh', 'refused']),
+        gatewayBot: z.enum(['notMade', 'made', 'installed']),
+        bots: z.array(z.object({ appId: z.string(), shipId: z.string(), shipName: z.string(), botName: z.string(), state: z.enum(['made', 'waitingForInstall', 'inSlack', 'removedInSlack']) })),
+        canChange: z.boolean(),
+    }),
+]);
 const accountInViewOutputSchema = z.discriminatedUnion('kind', [
     z.object({ kind: z.literal('signedIn'), fleetId: z.string(), accountId: z.string(), scopes: z.array(z.string()) }),
     z.object({ kind: z.literal('goTo'), fleetId: z.string() }),
@@ -523,7 +614,8 @@ export const gatewayRouter = t.router({
         /**
          * argo approves an outside MCP server as a party: the gateway commissions
          * its app proxy ship owned by the owner argo picked, crews it, and keeps
-         * the credential in its vault (interop I-5). A repeat with the same
+         * the credential in its vault (interop I-5); for a server where each
+         * person signs in, the client it registered for the party (0067). A repeat with the same
          * request id picks up where the last one stopped.
          */
         approve: managing(servedProcedure)
@@ -531,7 +623,7 @@ export const gatewayRouter = t.router({
             requestId: idempotencyKeySchema,
             name: shipHandleSchema,
             url: z.url({ protocol: /^https?$/ }),
-            credential: credentialInputSchema,
+            credential: serverCredentialInputSchema,
             ownerShipId: idSchema('ship'),
             concurrencyLimit: z.int().min(CONCURRENCY_LIMIT_MIN).max(CONCURRENCY_LIMIT_MAX).default(CONCURRENCY_LIMIT_DEFAULT),
             /** Each tool the check answered, switched on or off; none sent means every tool the server lists at its first statement is on. */
@@ -545,7 +637,15 @@ export const gatewayRouter = t.router({
                 throw new TRPCError({ code: 'FORBIDDEN', message: `Switching an outside party's tools needs ${APPROVING_SCOPE}` });
             }
             const toolSwitches = tools === undefined ? null : new Map(tools.map(({ name, isOn }) => [name, isOn]));
-            const approved = await ctx.approveParty({ operatorFleetId: ctx.fleetId, ...approval, scopes: [], toolSwitches });
+            const { credential, ...server } = approval;
+            if (credential.kind === 'personSignIn') {
+                const added = await ctx.addSignInServer({ operatorFleetId: ctx.fleetId, ...server, scopes: [], toolSwitches });
+                if (!added.isOk) {
+                    throw new TRPCError({ code: ADD_SIGN_IN_SERVER_CODES[added.error.kind], message: added.error.message });
+                }
+                return added.value;
+            }
+            const approved = await ctx.approveParty({ operatorFleetId: ctx.fleetId, ...server, credential, scopes: [], toolSwitches });
             if (!approved.isOk) {
                 throw new TRPCError({ code: APPROVE_CODES[approved.error.kind], message: approved.error.message });
             }
@@ -686,6 +786,84 @@ export const gatewayRouter = t.router({
             }
             return { ...crewed.value.party, clientSecret: crewed.value.clientSecret };
         }),
+        /**
+         * A person presses Sign in on an outside MCP server's page, for
+         * themselves (decision 0067): the address of the party's authorization
+         * server to send their browser to. Every account of the fleet with a
+         * person ship may.
+         */
+        startSignIn: servedProcedure
+            .input(z.strictObject({ name: shipHandleSchema }))
+            .output(z.object({ url: z.string() }))
+            .mutation(async ({ ctx, input }) => {
+            const started = await ctx.partySignIn.start({ actor: ctx.actor, ...input });
+            if (!started.isOk) {
+                throw new TRPCError({ code: PARTY_SIGN_IN_CODES[started.error.kind], message: started.error.message });
+            }
+            return started.value;
+        }),
+        /** A person's own sign-in to an outside MCP server where each person signs in: the outside account it names, when, last used, and whether it was lost (Q12). */
+        ownSignIn: servedProcedure
+            .input(z.strictObject({ name: shipHandleSchema }))
+            .output(ownSignInOutputSchema)
+            .query(async ({ ctx, input }) => {
+            const read = await ctx.partySignIn.readOwn({ actor: ctx.actor, ...input });
+            if (!read.isOk) {
+                throw new TRPCError({ code: PARTY_SIGN_IN_CODES[read.error.kind], message: read.error.message });
+            }
+            const own = read.value;
+            switch (own.state) {
+                case 'notSignedIn':
+                    return own;
+                case 'signedIn':
+                    return { ...own, signedInAt: own.signedInAt.toISOString(), lastUsedAt: own.lastUsedAt?.toISOString() ?? null };
+                case 'lost':
+                    return { ...own, signedInAt: own.signedInAt.toISOString(), lastUsedAt: own.lastUsedAt?.toISOString() ?? null, lost: { at: own.lost.at.toISOString(), why: own.lost.why } };
+            }
+        }),
+        /** A person removes their own sign-in to an outside MCP server: revoked where the server offers it, then dropped (Q6). */
+        removeOwnSignIn: servedProcedure
+            .input(z.strictObject({ name: shipHandleSchema }))
+            .output(z.object({ isRevoked: z.boolean() }))
+            .mutation(async ({ ctx, input }) => {
+            const removed = await ctx.partySignIn.removeOwn({ actor: ctx.actor, ...input });
+            if (!removed.isOk) {
+                throw new TRPCError({ code: PARTY_SIGN_IN_CODES[removed.error.kind], message: removed.error.message });
+            }
+            return removed.value;
+        }),
+        /**
+         * Every person's sign-in to an outside MCP server where each person
+         * signs in, 20 a page by person ship, for an actor holding
+         * gateway:approve within manage reach of its proxy ship (Q12).
+         */
+        signIns: servedProcedure
+            .input(z.strictObject({ name: shipHandleSchema, after: idSchema('ship').nullable() }))
+            .output(signInsOutputSchema)
+            .query(async ({ ctx, input }) => {
+            const listed = await ctx.partySignIn.list({ actor: ctx.actor, as: { cookie: ctx.cookie, crewToken: ctx.crewToken }, ...input });
+            if (!listed.isOk) {
+                throw new TRPCError({ code: SIGN_INS_CODES[listed.error.kind], message: listed.error.message });
+            }
+            return {
+                grants: listed.value.grants.map((grant) => {
+                    const shown = { ...grant, signedInAt: grant.signedInAt.toISOString(), lastUsedAt: grant.lastUsedAt?.toISOString() ?? null };
+                    return grant.state === 'lost' ? { ...shown, state: grant.state, lost: { at: grant.lost.at.toISOString(), why: grant.lost.why } } : { ...shown, state: grant.state };
+                }),
+                next: listed.value.next,
+            };
+        }),
+        /** An actor holding gateway:approve within manage reach of the proxy ship removes any person's sign-in: revoked where the server offers it, then dropped (Q6). */
+        removeSignIn: servedProcedure
+            .input(z.strictObject({ name: shipHandleSchema, personShipId: idSchema('ship') }))
+            .output(z.object({ isRevoked: z.boolean() }))
+            .mutation(async ({ ctx, input }) => {
+            const removed = await ctx.partySignIn.remove({ actor: ctx.actor, as: { cookie: ctx.cookie, crewToken: ctx.crewToken }, ...input });
+            if (!removed.isOk) {
+                throw new TRPCError({ code: SIGN_INS_CODES[removed.error.kind], message: removed.error.message });
+            }
+            return removed.value;
+        }),
         /** The gateway states the party's proxy ship anew, from what its server lists now, with argo's marks. */
         state: managing(servedProcedure)
             .input(z.strictObject({ name: shipHandleSchema }))
@@ -798,7 +976,7 @@ export const gatewayRouter = t.router({
         turnEmail: personProcedure.input(z.strictObject({ isOn: z.boolean() })).mutation(async ({ ctx, input }) => { personAnswerOf(await ctx.person.turnEmailChannel({ caller: ctx.caller, ...input })); }),
         /** Turns web push on for the browser that sent its subscription; its wakes name the fleet as the person's shared sign-in states it. */
         turnOnWebPush: personProcedure.input(webPushSubscriptionInputSchema).mutation(async ({ ctx, input }) => {
-            personAnswerOf(await ctx.person.turnOnWebPush({ caller: ctx.caller, fleetName: await fleetNameOf(ctx), ...input }));
+            personAnswerOf(await ctx.person.turnOnWebPush({ caller: ctx.caller, fleetName: await fleetNameOf(ctx, { fleetId: ctx.caller.fleetId, toDo: 'turn web push on' }), ...input }));
         }),
         /** Removes a browser the person turned web push on in. */
         turnOffWebPush: personProcedure.input(z.strictObject({ endpoint: z.string().min(1) })).mutation(async ({ ctx, input }) => {
@@ -912,6 +1090,78 @@ export const gatewayRouter = t.router({
             return decided.value;
         }),
     }),
+    slack: t.router({
+        /** The fleet's Slack as the Slack page shows it (gateway scopes 9.6), to any actor; canChange says whether it holds gateway:slack. */
+        view: servedProcedure.output(slackViewOutputSchema).query(async ({ ctx }) => {
+            const view = await ctx.slack.readSlack(ctx.actor);
+            return view.state === 'connected' ? { ...view, connectedAt: view.connectedAt.toISOString(), bots: [...view.bots] } : view;
+        }),
+        /** Connects the fleet to a workspace by an app configuration refresh token, and makes the gateway's bot, named after the fleet (9.1). */
+        connect: servedProcedure
+            .input(z.strictObject({ refreshToken: z.string().trim().min(1) }))
+            .output(z.object({ isGatewayBotMade: z.boolean() }))
+            .mutation(async ({ ctx, input }) => {
+            if (!ctx.scopes.includes(SLACK_SCOPE)) {
+                throw new TRPCError({ code: 'FORBIDDEN', message: `Connecting Slack needs ${SLACK_SCOPE}` });
+            }
+            const fleetName = await fleetNameOf(ctx, { fleetId: ctx.fleetId, toDo: 'connect Slack' });
+            return slackAnswerOf(await ctx.slack.connectSlack({ actor: ctx.actor, refreshToken: input.refreshToken, fleetName }));
+        }),
+        /** Slack's install screen for the gateway's bot, made first if Slack did not make it at connect; with an app id, for a ship's bot. */
+        install: servedProcedure
+            .input(z.strictObject({ appId: z.string().min(1).optional() }))
+            .output(z.object({ url: z.string() }))
+            .mutation(async ({ ctx, input }) => {
+            if (!ctx.scopes.includes(SLACK_SCOPE)) {
+                throw new TRPCError({ code: 'FORBIDDEN', message: `Installing a Slack bot needs ${SLACK_SCOPE}` });
+            }
+            const as = { cookie: ctx.cookie, crewToken: ctx.crewToken };
+            if (input.appId !== undefined) {
+                return slackAnswerOf(await ctx.slack.startInstall({ actor: ctx.actor, as, bot: { kind: 'ship', appId: input.appId } }));
+            }
+            const fleetName = await fleetNameOf(ctx, { fleetId: ctx.fleetId, toDo: "install the gateway's Slack bot" });
+            return slackAnswerOf(await ctx.slack.startInstall({ actor: ctx.actor, as, bot: { kind: 'gateway', fleetName } }));
+        }),
+        /** The agent ships and outside A2A agents' proxy ships Expose a ship… offers (9.2). */
+        exposable: servedProcedure.output(z.array(z.object({ shipId: z.string(), name: z.string() }))).query(async ({ ctx }) => slackAnswerOf(await ctx.slack.listExposable({ actor: ctx.actor, as: { cookie: ctx.cookie, crewToken: ctx.crewToken } }))),
+        /** Exposes a ship as a Slack bot, within manage reach of it: its app made from a manifest, to install next (9.2). */
+        expose: servedProcedure
+            .input(z.strictObject({ shipId: idSchema('ship') }))
+            .output(z.object({ appId: z.string() }))
+            .mutation(async ({ ctx, input }) => slackAnswerOf(await ctx.slack.exposeShip({ actor: ctx.actor, as: { cookie: ctx.cookie, crewToken: ctx.crewToken }, shipId: input.shipId }))),
+        /** Deletes a ship's bot in Slack, after the page's confirm (9.2). */
+        remove: servedProcedure
+            .input(z.strictObject({ appId: z.string().min(1) }))
+            .output(z.strictObject({}))
+            .mutation(async ({ ctx, input }) => {
+            slackAnswerOf(await ctx.slack.removeBot({ actor: ctx.actor, as: { cookie: ctx.cookie, crewToken: ctx.crewToken }, appId: input.appId }));
+            return {};
+        }),
+        /** The person's Slack link as the Overview shows it (9.6): the workspace and the Slack name linked; none while the fleet's own bot is not in Slack. */
+        link: servedProcedure
+            .output(z.object({ workspaceName: z.string(), link: z.object({ slackName: z.string(), isShowingAll: z.boolean() }).nullable() }).nullable())
+            .query(({ ctx }) => ctx.slack.readSlackLink({ actor: ctx.actor })),
+        /** Sign in with Slack to link the person's Slack account, from the Overview or Slack's answer to an unlinked person (9.3). */
+        startLink: servedProcedure.output(z.object({ url: z.string() })).mutation(async ({ ctx }) => slackAnswerOf(await ctx.slack.startLink({ actor: ctx.actor }))),
+        /** Turns Show everything that waits in Slack on or off for the person's own link (9.6, B5). */
+        showAll: servedProcedure
+            .input(z.strictObject({ isOn: z.boolean() }))
+            .output(z.strictObject({}))
+            .mutation(async ({ ctx, input }) => {
+            slackAnswerOf(await ctx.slack.showAllInSlack({ actor: ctx.actor, isOn: input.isOn }));
+            return {};
+        }),
+        /** Unlinks the person's own Slack account (9.3). */
+        unlink: servedProcedure.output(z.strictObject({})).mutation(async ({ ctx }) => {
+            await ctx.slack.unlinkSlack({ actor: ctx.actor });
+            return {};
+        }),
+        /** Removes every bot the gateway made in Slack, then forgets the workspace (after the page's confirm). */
+        disconnect: servedProcedure.output(z.strictObject({})).mutation(async ({ ctx }) => {
+            slackAnswerOf(await ctx.slack.disconnectSlack({ actor: ctx.actor }));
+            return {};
+        }),
+    }),
     outsideParties: t.router({
         /** Whether the fleet's outside parties are on (interop I-3). */
         status: servedProcedure.output(z.object({ isOn: z.boolean() })).query(({ ctx }) => ctx.readOutsideParties(ctx.actor)),
@@ -1002,12 +1252,14 @@ export const gatewayRouter = t.router({
             }
             return {};
         }),
-        /** pagasae disabled the account (decision 0055): every sign-in of it in the fleet ends, and its clients' tokens are revoked. Told again, it ends nothing more. */
+        /** pagasae disabled the account (decision 0055): every sign-in of it in the fleet ends, its clients' tokens are revoked, its Slack link stops, and its grants of outside servers end (decision 0067, Q14). Told again, it ends nothing more. */
         accountDisabled: installationProcedure
             .input(z.strictObject({ fleetId: idSchema('fleet'), accountId: z.string().min(1) }))
             .output(z.strictObject({}))
             .mutation(async ({ ctx, input }) => {
             await ctx.endSignIns(input);
+            await ctx.stopSlackLink(input);
+            await ctx.endAccountGrants(input);
             return {};
         }),
     }),