@aeolus-fleet/gateway 0.32.2 → 0.34.0

package/dist/app.js

@@ -16,6 +16,8 @@ import { createPrismaConnectionStore } from './adapters/prisma/connection-store.
 import { createPrismaFleetForgetter } from './adapters/prisma/fleet-forgetter.js';
 import { createPrismaFleetSwitches } from './adapters/prisma/fleet-switches.js';
 import { createPrismaInstallationRequests } from './adapters/prisma/installation-requests.js';
+import { createPrismaPartyGrants } from './adapters/prisma/party-grants.js';
+import { createPrismaSignInNotices } from './adapters/prisma/sign-in-notices.js';
 import { createPrismaPartyStore } from './adapters/prisma/party-store.js';
 import { createPrismaScopeRequirements } from './adapters/prisma/scope-requirements.js';
 import { createPrismaToolMarks } from './adapters/prisma/tool-marks.js';
@@ -28,6 +30,20 @@ import { createCheckRequiredScopes } from './core/parties/check-required-scopes.
 import { createReadScopeRequirements } from './core/parties/read-scope-requirements.js';
 import { createSetScopeRequirements } from './core/parties/set-scope-requirements.js';
 import { createStateParty } from './core/mcp-out/state-party.js';
+import { createListingConnectionOf } from './core/party-grants/listing-connection.js';
+import { createCompletePartySignIn } from './core/party-grants/complete-party-sign-in.js';
+import { createReadOwnGrant } from './core/party-grants/read-own-grant.js';
+import { createRemoveOwnGrant } from './core/party-grants/remove-own-grant.js';
+import { createEndAccountGrants } from './core/party-grants/end-account-grants.js';
+import { createEndPartyGrants } from './core/party-grants/end-party-grants.js';
+import { createEndRetiredPersonsGrants } from './core/party-grants/end-retired-persons-grants.js';
+import { createListGrants } from './core/party-grants/list-grants.js';
+import { createRemoveGrant } from './core/party-grants/remove-grant.js';
+import { createStartPartySignIn } from './core/party-grants/start-party-sign-in.js';
+import { signInServersOf } from './core/parties/sign-in-servers.js';
+import { createPartySignIns } from './adapters/oauth/party-sign-ins.js';
+import { createPartySignInSeals } from './adapters/crypto/party-sign-in-seals.js';
+import { PARTY_SIGN_IN_DONE_PATH, partyPageUrlOf, registerPartySignInRoutes } from './adapters/http/party-sign-in-routes.js';
 import { createStateA2aAgent } from './core/a2a-out/state-a2a-agent.js';
 import { createFollowAgentTask } from './core/a2a-out/follow-agent-task.js';
 import { createHandA2aMessage } from './core/a2a-out/hand-a2a-message.js';
@@ -40,13 +56,19 @@ import { createAddA2aAgent } from './core/parties/add-a2a-agent.js';
 import { createHttpAgentCards } from './adapters/a2a/agent-cards.js';
 import { createCheckServer } from './core/parties/check-server.js';
 import { createReadPartyTools } from './core/parties/read-party-tools.js';
+import { createGrantCalls } from './core/mcp-out/grant-calls.js';
 import { createHandCall } from './core/mcp-out/hand-call.js';
+import { createCallGrantOf } from './core/party-grants/call-grant.js';
+import { createRefreshGrant } from './core/party-grants/refresh-grant.js';
+import { createKeepGrantsAlive } from './core/party-grants/keep-grants-alive.js';
+import { createTellSignInNeeded } from './core/party-grants/tell-sign-in-needed.js';
 import { createRunParty } from './core/mcp-out/run-party.js';
 import { createPrismaCalls } from './adapters/prisma/calls.js';
 import { sleep } from './adapters/timers/sleep.js';
 import { createPartyWorkers } from './party-workers.js';
 import { gatewayRouter, WAITING_SECRET_HEADER } from './adapters/trpc/router.js';
 import { registerFrontDoor } from './adapters/http/front-door.js';
+import { registerOpenAiAppsChallenge } from './adapters/http/openai-apps-challenge.js';
 import { createChangeHub } from './adapters/http/live.js';
 import { createPrismaInboxChanges, listenToChanges } from './adapters/prisma/changes.js';
 import { registerOAuthRoutes } from './adapters/http/oauth-routes.js';
@@ -83,6 +105,7 @@ import { createCallKeys } from './adapters/crypto/call-keys.js';
 import { createPrismaClientCalls } from './adapters/prisma/client-calls.js';
 import { createAuthenticateAccessToken } from './core/oauth/authenticate-access-token.js';
 import { oauthSecrets } from './adapters/crypto/oauth-secrets.js';
+import { createAuthorizationServers } from './adapters/oauth/authorization-servers.js';
 import { createClientMetadataDocuments } from './adapters/oauth/client-metadata-documents.js';
 import { createPrismaAuthorizationCodes, createPrismaIssuedTokens, createPrismaOAuthClients } from './adapters/prisma/oauth-stores.js';
 import { createExchangeToken } from './core/oauth/exchange-token.js';
@@ -99,6 +122,42 @@ import { createPrismaOutcomeNotices } from './adapters/prisma/outcome-notices.js
 import { createOutcomeWorker } from './outcome-worker.js';
 import { createPersonWaiters } from './person-waiters.js';
 import { createPingWorker } from './ping-worker.js';
+import { createSlackTokenWorker } from './slack-token-worker.js';
+import { createGrantWorker } from './grant-worker.js';
+import { createSlackEventWorker } from './slack-event-worker.js';
+import { createPrismaSlackEvents } from './adapters/prisma/slack-events.js';
+import { createSendSlackEvents } from './core/slack/send-slack-events.js';
+import { createSlackInstallSeals } from './adapters/crypto/slack-install-seals.js';
+import { createSlackLinkSeals } from './adapters/crypto/slack-link-seals.js';
+import { registerSlackRoutes, SLACK_ACTIONS_PATH, SLACK_EVENTS_PATH, SLACK_INSTALL_PATH, SLACK_LINK_PATH } from './adapters/http/slack-routes.js';
+import { createPrismaSlackPosts } from './adapters/prisma/slack-posts.js';
+import { createAnswerInSlack } from './core/slack/answer-in-slack.js';
+import { createShowAllInSlack } from './core/slack/show-all-in-slack.js';
+import { createShowInSlack } from './core/slack/show-in-slack.js';
+import { createPrismaSlackLinks } from './adapters/prisma/slack-links.js';
+import { createSlackMessages } from './adapters/slack/slack-messages.js';
+import { createSlackSignIn } from './adapters/slack/slack-sign-in.js';
+import { createCompleteLink } from './core/slack/complete-link.js';
+import { createReadSlackLink } from './core/slack/read-slack-link.js';
+import { createStartLink } from './core/slack/start-link.js';
+import { createStopSlackLink } from './core/slack/stop-slack-link.js';
+import { createUnlinkSlack } from './core/slack/unlink-slack.js';
+import { createSlackSignatures } from './adapters/crypto/slack-signatures.js';
+import { createSlackShips } from './adapters/fleet/slack-ships.js';
+import { createExposeShip } from './core/slack/expose-ship.js';
+import { createFollowExposedShips } from './core/slack/follow-exposed-ships.js';
+import { createListExposable } from './core/slack/list-exposable.js';
+import { createRemoveBot } from './core/slack/remove-bot.js';
+import { createTakeSlackEvent } from './core/slack/take-slack-event.js';
+import { createPrismaSlackApps, createPrismaSlackWorkspaces } from './adapters/prisma/slack-stores.js';
+import { createSlackTooling, SLACK_API_URL } from './adapters/slack/slack-tooling.js';
+import { createCompleteInstall } from './core/slack/complete-install.js';
+import { createConnectSlack } from './core/slack/connect-slack.js';
+import { createDisconnectSlack } from './core/slack/disconnect-slack.js';
+import { createReadSlack } from './core/slack/read-slack.js';
+import { createRotateConfigurationTokens } from './core/slack/rotate-configuration-tokens.js';
+import { createStartInstall } from './core/slack/start-install.js';
+import { createTakeAccessToken } from './core/slack/take-access-token.js';
 import { createOpenRequest } from './core/requests/open-request.js';
 import { createReadWaiting } from './core/requests/read-waiting.js';
 import { createWatchWaiting } from './core/requests/watch-waiting.js';
@@ -151,6 +210,7 @@ import { createFleetNetwork } from './adapters/fleet/fleet-network.js';
 import { createPrismaOutsidePartySwitches } from './adapters/prisma/outside-party-switches.js';
 import { createReadOutsideParties, createSetOutsideParties } from './core/outside-parties/set-outside-parties.js';
 import { createConnect } from './core/connection/connect.js';
+import { createDeclareGatewayScopes } from './core/connection/declare-gateway-scopes.js';
 import { createAnswerPings } from './core/connection/answer-pings.js';
 import { createReadConnection } from './core/connection/read-connection.js';
 import { createDeleteFleet } from './core/installation/delete-fleet.js';
@@ -158,6 +218,7 @@ import { createReadFleet } from './core/installation/read-fleet.js';
 import { createIsServed } from './core/installation/served.js';
 import { createSetFleetEnabled } from './core/installation/set-fleet-enabled.js';
 import { createAuthenticateOperator } from './core/operator/authenticate-operator.js';
+import { createAddSignInServer } from './core/parties/add-sign-in-server.js';
 import { createApproveClientParty, createApproveParty } from './core/parties/approve-party.js';
 import { createAddClientParty } from './core/parties/add-client-party.js';
 import { createCrewParty } from './core/parties/crew-party.js';
@@ -169,6 +230,7 @@ import { createChangePartyOwner, createChangePartyScopes } from './core/parties/
 import { logRefusedFacts } from './adapters/fleet/logged-verified-facts.js';
 import { createFleetShips } from './adapters/fleet/fleet-ships.js';
 import { createProxyShipReads } from './adapters/fleet/proxy-ship-reads.js';
+import { createShipNames } from './adapters/fleet/ship-names.js';
 import { createProxyShipsAsActor } from './adapters/fleet/proxy-ships-as-actor.js';
 import { createCredentialOf } from './core/actors/credential-of.js';
 import { createDecideRequest } from './core/requests/decide-request.js';
@@ -196,6 +258,12 @@ const EMAIL_WAKE_WINDOW_MS = 60 * 60_000;
 const BEARER = 'Bearer ';
 /** How often a proxy ship's worker looks again while the fleet hands it only what it holds, or does not answer. */
 const POLL_MS = 2_000;
+/** How often the gateway rotates the Slack configuration tokens due, well within the hour before one ends (gateway scopes 9.1). */
+const SLACK_TOKEN_ROUND_MS = 10 * 60_000;
+/** How often the gateway keeps grants alive unless told: well within the ten minutes a grant is refreshed ahead of its end. */
+const GRANT_ROUND_MS = 5 * 60_000;
+/** How often the gateway sends the kept Slack messages core has not taken, as while core does not answer (gateway scopes 9.4 step 7). */
+const SLACK_EVENT_ROUND_MS = 5_000;
 /** How often the gateway expires due requests and tells outcomes still to tell (P5-1 a). */
 const OUTCOME_ROUND_MS = 60_000;
 /** The most an outside MCP client's call waits for its answer, whatever its capability states (interop 5.3). */
@@ -257,6 +325,7 @@ export function createGatewayApp(options) {
     const readFleet = createReadFleet({ isServed, connections });
     const deleteFleet = createDeleteFleet({ forgetter: createPrismaFleetForgetter(prisma), requests, hasher: sha256RequestHasher, clock });
     const connect = createConnect({ door, store: connections, clock });
+    const declareGatewayScopes = createDeclareGatewayScopes({ door, store: connections });
     const authenticateOperator = createAuthenticateOperator({ sessions: createFleetConsoleSessions(options.fleetUrl) });
     const parties = createPrismaPartyStore(prisma);
     // The OAuth server's clients and tokens: a client party's secret and tokens change as its proxy ship's crew does.
@@ -267,15 +336,21 @@ export function createGatewayApp(options) {
     // A caller of a proxy ship waits and gives up as the gateway does with its server (interop 3.4, 5.3).
     const callTiming = { waitMs: options.mcpWaitMaxMs ?? MCP_WAIT_MAX_MS, deadlineMs: options.toolCallTimeoutMs ?? TOOL_CALL_TIMEOUT_MS };
     const requirements = createPrismaScopeRequirements(prisma);
-    const stateParty = createStateParty({ parties, servers, door, marks, requirements, timing: callTiming });
+    const partyGrants = createPrismaPartyGrants(prisma);
+    const signInNotices = createPrismaSignInNotices(prisma);
+    const partySignIns = createPartySignIns();
+    // A server where each person signs in is listed under a person's grant (decision 0067, Q15).
+    const connectionOf = createListingConnectionOf({ grants: partyGrants, clock });
+    const stateParty = createStateParty({ parties, servers, connectionOf, door, marks, requirements, timing: callTiming });
     const markTool = createMarkTool({ parties, marks, stateParty });
-    const switchTools = createSwitchTools({ parties, servers, stateParty, connections, fleet: createProxyShipsAsActor(options.fleetUrl), credentialOf: (actor, sent) => credentialOf(actor, sent) });
+    const switchTools = createSwitchTools({ parties, servers, connectionOf, stateParty, connections, fleet: createProxyShipsAsActor(options.fleetUrl), credentialOf: (actor, sent) => credentialOf(actor, sent) });
     const agentCards = createHttpAgentCards({ timeoutMs: AGENT_CARD_TIMEOUT_MS });
     const stateA2aAgent = createStateA2aAgent({ parties, cards: agentCards, door, requirements, timing: callTiming });
     const checkScopes = createCheckRequiredScopes({ connections, door });
     const readScopeRequirements = createReadScopeRequirements({ parties, requirements });
     const readListedScopes = createReadListedScopes({ connections, door });
-    const checkApproving = createCheckApproving({ parties, connections, fleet: createProxyShipsAsActor(options.fleetUrl), credentialOf: (actor, sent) => credentialOf(actor, sent) });
+    const approvingDeps = { parties, connections, fleet: createProxyShipsAsActor(options.fleetUrl), credentialOf: (actor, sent) => credentialOf(actor, sent) };
+    const checkApproving = createCheckApproving(approvingDeps);
     const setScopeRequirements = createSetScopeRequirements({
         parties,
         requirements,
@@ -286,12 +361,25 @@ export function createGatewayApp(options) {
         fleet: createProxyShipsAsActor(options.fleetUrl),
         credentialOf: (actor, sent) => credentialOf(actor, sent),
     });
-    const handCall = createHandCall({ crew: door, servers, calls: createPrismaCalls(prisma), marks, parties, requirements, checkScopes, timeoutMs: options.toolCallTimeoutMs ?? TOOL_CALL_TIMEOUT_MS });
+    // A call to a server where each person signs in goes out under its asking ship's owner's grant (decision 0067).
+    const partyPageUrl = partyPageUrlOf(options.publicUrl ?? DEFAULT_PUBLIC_URL);
+    const tellSignInNeeded = createTellSignInNeeded({ notices: signInNotices, connections, sender: door, newNoticeId: randomUUID, pageUrlOf: partyPageUrl });
+    const refreshGrant = createRefreshGrant({ signIns: partySignIns, grants: partyGrants, tellSignInNeeded, clock });
+    const grantCalls = createGrantCalls({
+        callGrantOf: createCallGrantOf({ connections, door, grants: partyGrants }),
+        refreshGrant,
+        tellSignInNeeded,
+        servers,
+        grants: partyGrants,
+        clock,
+        pageUrlOf: partyPageUrl,
+    });
+    const handCall = createHandCall({ crew: door, servers, calls: createPrismaCalls(prisma), marks, parties, requirements, checkScopes, grantCalls, timeoutMs: options.toolCallTimeoutMs ?? TOOL_CALL_TIMEOUT_MS });
     const clientCalls = createPrismaClientCalls(prisma);
     const outsidePartySwitches = createPrismaOutsidePartySwitches(prisma);
     const servesOutsideParties = (fleetId) => outsidePartySwitches.isOn(fleetId);
     const checkServer = createCheckServer({ servers, servesOutsideParties });
-    const readPartyTools = createReadPartyTools({ parties, servers });
+    const readPartyTools = createReadPartyTools({ parties, servers, connectionOf });
     const pushStore = createPrismaPushStore(prisma);
     // A webhook is reached only at a public address, as its name resolves at the moment of connecting (slice 4).
     const webhookPoster = createWebhookPoster({ addressesOf: (host) => systemHostResolver.addressesOf(host), isAllowedAddress: isPublicAddress, timeoutMs: WEBHOOK_TIMEOUT_MS });
@@ -386,7 +474,7 @@ export function createGatewayApp(options) {
     const proxyShipsAsActor = createProxyShipsAsActor(options.fleetUrl);
     // Calls as an account need its account token, set up with the sign-in below.
     const asActor = { parties, fleet: proxyShipsAsActor, credentialOf: (actor, sent) => credentialOf(actor, sent) };
-    const retireParty = createRetireParty({ ...asActor, tokens: issuedTokens });
+    const retireParty = createRetireParty({ ...asActor, tokens: issuedTokens, endPartyGrants: createEndPartyGrants({ grants: partyGrants, signIns: partySignIns }) });
     const changePartyOwner = createChangePartyOwner(asActor);
     const changePartyScopes = createChangePartyScopes(asActor);
     const proxyShipReads = createProxyShipReads(options.fleetUrl);
@@ -410,11 +498,13 @@ export function createGatewayApp(options) {
         }
         return set;
     };
-    // The OAuth server for outside MCP clients: the issuer is the public URL, and every token is bound to its MCP endpoint (RFC 8707).
+    // The OAuth server for outside MCP clients: the issuer is the public URL, and every token is bound to the MCP address it was asked for (RFC 8707).
+    // The plugin's address serves the same tools; a person signs in there as themselves with no pick (chatgpt-plugin design, 6).
     const issuer = options.publicUrl ?? DEFAULT_PUBLIC_URL;
     const resource = `${issuer}/mcp`;
+    const pluginResource = `${issuer}/plugin/mcp`;
     const authorizationCodes = createPrismaAuthorizationCodes(prisma);
-    const readAuthorization = createReadAuthorization({ clients: oauthClients, documents: createClientMetadataDocuments({ timeoutMs: CLIENT_METADATA_TIMEOUT_MS }), resource });
+    const readAuthorization = createReadAuthorization({ clients: oauthClients, documents: createClientMetadataDocuments({ timeoutMs: CLIENT_METADATA_TIMEOUT_MS }), resources: [resource, pluginResource] });
     const registerClient = createRegisterClient({ clients: oauthClients, secrets: oauthSecrets });
     const seals = createSignInSeals(options.gatewaySecret);
     // People sign in through pagasae where it is set (decision 0054); else no client connects, as only an account asks for one (A a).
@@ -435,7 +525,7 @@ export function createGatewayApp(options) {
     const signIn = pagasae === undefined
         ? undefined
         : {
-            start: createStartSignIn({ readAuthorization, seals, pagasae, secrets: oauthSecrets, clock }),
+            start: createStartSignIn({ readAuthorization, pluginResource, seals, pagasae, secrets: oauthSecrets, clock }),
             complete: createCompleteSignIn({
                 readAuthorization,
                 seals,
@@ -464,6 +554,7 @@ export function createGatewayApp(options) {
         ...(signIn === undefined ? {} : { signIn }),
         issuer,
         resource,
+        pluginResource,
         readAuthorization,
         exchangeToken: createExchangeToken({
             clients: oauthClients,
@@ -523,6 +614,14 @@ export function createGatewayApp(options) {
                 }),
             ]),
     ];
+    // What waits for a linked person shows in Slack before anything wakes them (gateway scopes 9.5).
+    const slackApiUrl = options.slackApiUrl ?? SLACK_API_URL;
+    const slackApps = createPrismaSlackApps(prisma);
+    const slackLinks = createPrismaSlackLinks(prisma);
+    const slackPosts = createPrismaSlackPosts(prisma);
+    const slackMessages = createSlackMessages({ apiUrl: slackApiUrl });
+    const overviewUrlOf = (fleetId) => `${issuer}/overview?fleet=${encodeURIComponent(fleetId)}`;
+    const showInSlack = createShowInSlack({ links: slackLinks, apps: slackApps, posts: slackPosts, slack: slackMessages, door: door.person, sleep, clock, overviewUrlOf });
     // The gateway waits on every person ship it crews, one waiter per ship across its instances (wake a person, W7, W9).
     const personCrews = createPrismaPersonCrews(prisma);
     // A person's pages in focus, on every instance: while one is, what arrives is handed through it (wake a person, W6).
@@ -536,7 +635,7 @@ export function createGatewayApp(options) {
             crews: personCrews,
             door: door.person,
             changes: inboxChanges,
-            wakePerson: createWakePerson({ door: door.person, channels: wakeChannels, wakesSent: createPrismaWakesSent(prisma), focused: focusedPages, focusFreshMs: FOCUS_FRESH_MS, clock, attemptEnded: (ended) => { server.log.error(ended, 'wake refused for good: the attempt ended'); } }),
+            wakePerson: createWakePerson({ door: door.person, shownElsewhere: { show: showInSlack }, channels: wakeChannels, wakesSent: createPrismaWakesSent(prisma), focused: focusedPages, focusFreshMs: FOCUS_FRESH_MS, clock, attemptEnded: (ended) => { server.log.error(ended, 'wake refused for good: the attempt ended'); } }),
             clock,
             sleep,
             againWaitsMs: WAITER_AGAIN_WAITS_MS,
@@ -580,20 +679,26 @@ export function createGatewayApp(options) {
             readMeeting: createReadMeeting({ ...asCrew, door: door.meetings }),
             changeOwnMic: createChangeOwnMic({ ...asCrew, door: door.meetings }),
             askForServer: createAskForServer({ grants, parties, openRequest, servesOutsideParties }),
+            crewPersonShip: asCrew.crewPersonShip,
         };
     };
     const person = pagasae === undefined ? undefined : personToolsOf();
     const aliases = createShipAliases(options.gatewaySecret);
     const listTools = createListTools({ parties, discovery: door, aliases });
-    registerMcpEndpoint(server, {
-        resource,
-        authenticateAccessToken: createAuthenticateAccessToken({ tokens: issuedTokens, secrets: oauthSecrets, clock, resource }),
-        listTools,
-        callTool: createCallTool({ parties, listTools, sender: door, calls: clientCalls, keys: createCallKeys(options.gatewaySecret), clock, sleep, waitMaxMs: options.mcpWaitMaxMs ?? MCP_WAIT_MAX_MS, waitPollMs: MCP_WAIT_POLL_MS }),
-        readClientCall: createReadClientCall({ calls: clientCalls, clock }),
-        servesOutsideParties,
-        ...(person === undefined ? {} : { person }),
-    });
+    const callTool = createCallTool({ parties, listTools, sender: door, calls: clientCalls, keys: createCallKeys(options.gatewaySecret), clock, sleep, waitMaxMs: options.mcpWaitMaxMs ?? MCP_WAIT_MAX_MS, waitPollMs: MCP_WAIT_POLL_MS });
+    const readClientCall = createReadClientCall({ calls: clientCalls, clock });
+    // The same tools at each address, each taking only the tokens issued for it.
+    for (const address of [resource, pluginResource]) {
+        registerMcpEndpoint(server, {
+            resource: address,
+            authenticateAccessToken: createAuthenticateAccessToken({ tokens: issuedTokens, secrets: oauthSecrets, clock, resource: address }),
+            listTools,
+            callTool,
+            readClientCall,
+            servesOutsideParties,
+            ...(person === undefined ? {} : { person }),
+        });
+    }
     // Outside A2A clients call the ships their proxy ship reaches, by alias, with the bearer they were shown (decision 0060).
     // A blocking send waits as its capability states, at most the gateway's own most, as an MCP call does (I-9).
     const listReachedShips = createListReachedShips({ parties, discovery: door, aliases });
@@ -639,6 +744,72 @@ export function createGatewayApp(options) {
         intervalMs: OUTCOME_ROUND_MS,
         log: server.log,
     });
+    const slackWorkspaces = createPrismaSlackWorkspaces(prisma);
+    const slackTooling = createSlackTooling({ apiUrl: slackApiUrl });
+    const slackInstallStates = createSlackInstallSeals(options.gatewaySecret);
+    const installRedirectUrl = `${issuer}${SLACK_INSTALL_PATH}`;
+    const linkRedirectUrl = `${issuer}${SLACK_LINK_PATH}`;
+    const slackSignIn = createSlackSignIn({ apiUrl: slackApiUrl });
+    const slackLinkStates = createSlackLinkSeals(options.gatewaySecret);
+    const takeAccessToken = createTakeAccessToken({ slack: slackTooling, workspaces: slackWorkspaces, clock });
+    const shipNames = {
+        nameOf: async (fleetId, shipId) => {
+            const crew = await connections.find(fleetId);
+            const ship = crew === undefined ? undefined : await door.getShip(crew.crewToken, { shipId });
+            return ship?.isOk === true ? ship.value.name : undefined;
+        },
+    };
+    const slackShips = createSlackShips({ fleetUrl: options.fleetUrl, crewTokenOf: async (fleetId) => (await connections.find(fleetId))?.crewToken, ships: createFleetShips(options.fleetUrl), asActor: createProxyShipsAsActor(options.fleetUrl) });
+    // Which outside party a ship is the proxy ship of: a fleet has few parties.
+    const proxyShips = { kindOf: async (fleetId, shipId) => (await parties.list(fleetId)).find((party) => party.proxyShipId === shipId)?.kind };
+    const slackAddresses = { installRedirectUrl, eventsUrl: `${issuer}${SLACK_EVENTS_PATH}`, actionsUrl: `${issuer}${SLACK_ACTIONS_PATH}`, linkRedirectUrl };
+    const slack = {
+        readSlack: createReadSlack({ workspaces: slackWorkspaces, apps: slackApps, ships: slackShips }),
+        connectSlack: createConnectSlack({ slack: slackTooling, workspaces: slackWorkspaces, apps: slackApps, shipNames, clock, addresses: slackAddresses }),
+        startInstall: createStartInstall({ slack: slackTooling, apps: slackApps, workspaces: slackWorkspaces, takeAccessToken, states: slackInstallStates, ships: slackShips, credentialOf: credentialOf, clock, addresses: slackAddresses }),
+        disconnectSlack: createDisconnectSlack({ slack: slackTooling, workspaces: slackWorkspaces, apps: slackApps, takeAccessToken }),
+        listExposable: createListExposable({ ships: slackShips, apps: slackApps, proxyShips, credentialOf: credentialOf }),
+        exposeShip: createExposeShip({ slack: slackTooling, apps: slackApps, ships: slackShips, proxyShips, takeAccessToken, credentialOf: credentialOf, clock, addresses: slackAddresses }),
+        removeBot: createRemoveBot({ slack: slackTooling, apps: slackApps, ships: slackShips, takeAccessToken, credentialOf: credentialOf }),
+        readSlackLink: createReadSlackLink({ workspaces: slackWorkspaces, apps: slackApps, links: slackLinks }),
+        // Where no pagasae is set no one signs in, so no account has a person ship to link.
+        startLink: createStartLink({ workspaces: slackWorkspaces, apps: slackApps, signIn: slackSignIn, states: slackLinkStates, crewPersonShip: person?.crewPersonShip ?? (() => Promise.resolve(err({ kind: 'noPersonShip' }))), clock, linkRedirectUrl }),
+        unlinkSlack: createUnlinkSlack({ links: slackLinks }),
+        showAllInSlack: createShowAllInSlack({ links: slackLinks }),
+    };
+    const slackEvents = createPrismaSlackEvents(prisma);
+    const slackSends = createSlackEventWorker({
+        send: createSendSlackEvents({ events: slackEvents, apps: slackApps, crews: personCrews, sender: door, door: door.person, posts: slackPosts, slack: slackMessages, clock }),
+        sleep,
+        intervalMs: SLACK_EVENT_ROUND_MS,
+        log: server.log,
+    });
+    registerSlackRoutes(server, {
+        completeInstall: createCompleteInstall({ slack: slackTooling, apps: slackApps, workspaces: slackWorkspaces, states: slackInstallStates, clock, installRedirectUrl }),
+        answerInSlack: createAnswerInSlack({ apps: slackApps, links: slackLinks, posts: slackPosts, crews: personCrews, door: door.person, slack: slackMessages, signatures: createSlackSignatures(), clock }),
+        completeLink: createCompleteLink({ workspaces: slackWorkspaces, apps: slackApps, links: slackLinks, signIn: slackSignIn, states: slackLinkStates, accountOf, shipNames, clock, linkRedirectUrl }),
+        takeSlackEvent: createTakeSlackEvent({ apps: slackApps, links: slackLinks, events: slackEvents, posts: slackPosts, sendNow: () => { slackSends.wake(); }, slack: slackMessages, signatures: createSlackSignatures(), clock, linkPageUrl: `${issuer}/slack/link` }),
+    });
+    const rotateConfigurationTokens = createRotateConfigurationTokens({ workspaces: slackWorkspaces, takeAccessToken });
+    const followExposedShips = createFollowExposedShips({ workspaces: slackWorkspaces, apps: slackApps, ships: slackShips, slack: slackTooling, takeAccessToken, addresses: slackAddresses });
+    const slackTokens = createSlackTokenWorker({
+        rotate: async () => {
+            await rotateConfigurationTokens();
+            await followExposedShips();
+        },
+        sleep, intervalMs: SLACK_TOKEN_ROUND_MS, log: server.log
+    });
+    const keepGrantsAlive = createKeepGrantsAlive({ grants: partyGrants, servers: signInServersOf(parties), refreshGrant, clock });
+    const endRetiredPersonsGrants = createEndRetiredPersonsGrants({ connections, door, servers: signInServersOf(parties), grants: partyGrants, signIns: partySignIns });
+    const grantKeeper = createGrantWorker({
+        round: async () => {
+            await keepGrantsAlive();
+            await endRetiredPersonsGrants();
+        },
+        sleep,
+        intervalMs: options.grantRoundMs ?? GRANT_ROUND_MS,
+        log: server.log,
+    });
     const pings = createPingWorker({ answerPings: createAnswerPings({ connections, inbox: door.gatewayInbox }), sleep, intervalMs: POLL_MS, log: server.log });
     const decideRequestOnly = createDecideRequest({ requests: pendingRequests, approveParty, approveClientParty, clock });
     // A decided request's outcomes are told at once, not at the next round.
@@ -649,9 +820,24 @@ export function createGatewayApp(options) {
         }
         return decided;
     };
+    // A person's own sign-in to a server where each person signs in (decision 0067), sent back to the redirect URI every party's client was registered with.
+    const partySignInRedirectUri = `${issuer}${PARTY_SIGN_IN_DONE_PATH}`;
+    const partySignInSeals = createPartySignInSeals(options.gatewaySecret);
+    const partySignIn = {
+        start: createStartPartySignIn({ servers: signInServersOf(parties), seals: partySignInSeals, signIns: partySignIns, secrets: oauthSecrets, clock, redirectUri: partySignInRedirectUri }),
+        readOwn: createReadOwnGrant({ servers: signInServersOf(parties), grants: partyGrants }),
+        removeOwn: createRemoveOwnGrant({ servers: signInServersOf(parties), grants: partyGrants, signIns: partySignIns }),
+        list: createListGrants({ ...approvingDeps, grants: partyGrants, ships: createShipNames(options.fleetUrl) }),
+        remove: createRemoveGrant({ ...approvingDeps, grants: partyGrants, signIns: partySignIns }),
+    };
+    registerPartySignInRoutes(server, {
+        complete: createCompletePartySignIn({ servers: signInServersOf(parties), grants: partyGrants, seals: partySignInSeals, signIns: partySignIns, notices: signInNotices, accountOf, stateParty, clock, redirectUri: partySignInRedirectUri }),
+        log: server.log,
+    });
     const contextFor = (sent) => ({
         ...sent,
         authenticateActor,
+        slack,
         changes: hub,
         accountInView,
         accountApps: signIns === undefined ? undefined : (signIn) => signIns.apps(signIn),
@@ -662,9 +848,13 @@ export function createGatewayApp(options) {
         readFleet,
         deleteFleet,
         endSignIns: createEndSignIns({ grants, tokens: issuedTokens }),
+        stopSlackLink: createStopSlackLink({ links: slackLinks, clock }),
+        endAccountGrants: createEndAccountGrants({ servers: signInServersOf(parties), grants: partyGrants, signIns: partySignIns }),
         readConnection,
         connect,
         approveParty,
+        partySignIn,
+        addSignInServer: createAddSignInServer({ approveParty, parties, servers: createAuthorizationServers(), servesOutsideParties, redirectUri: partySignInRedirectUri }),
         addClientParty: createAddClientParty({ parties, approveClientParty, clients: oauthClients, secrets: oauthSecrets }),
         addA2aClient,
         addA2aAgent,
@@ -717,6 +907,7 @@ export function createGatewayApp(options) {
         },
     };
     void server.register(fastifyTRPCPlugin, trpc);
+    registerOpenAiAppsChallenge(server, { challenge: options.openAiAppsChallenge });
     registerFrontDoor(server, options.web === undefined ? {} : { web: options.web });
     let changes;
     server.addHook('onReady', async () => {
@@ -732,11 +923,18 @@ export function createGatewayApp(options) {
         restoreConnections: async () => {
             const restored = [];
             for (const crew of await connections.connected()) {
-                // A fleet that is off is not read.
-                const connection = (await isServed(crew.fleetId)) ? await readConnection(crew.fleetId) : await heldConnection(crew.fleetId);
+                // A fleet that is off is not read, nor declared to.
+                const isOn = await isServed(crew.fleetId);
+                const connection = isOn ? await readConnection(crew.fleetId) : await heldConnection(crew.fleetId);
                 if (connection.state === 'connected') {
                     restored.push({ fleetId: crew.fleetId, ship: connection.ship?.name ?? crew.name });
                 }
+                if (isOn && connection.state === 'connected') {
+                    const declared = await declareGatewayScopes(crew.fleetId);
+                    if (!declared.isOk) {
+                        server.log.warn({ fleetId: crew.fleetId, reason: declared.error.message }, "the fleet did not take the gateway's scopes again");
+                    }
+                }
             }
             for (const party of await parties.crewed()) {
                 if (await isServed(party.fleetId)) {
@@ -746,12 +944,18 @@ export function createGatewayApp(options) {
             outcomes.start();
             pings.start();
             personWaiters.start();
+            slackTokens.start();
+            slackSends.start();
+            grantKeeper.start();
             return restored;
         },
         close: async () => {
             await outcomes.stop();
             await pings.stop();
             await personWaiters.stop();
+            await slackTokens.stop();
+            await slackSends.stop();
+            await grantKeeper.stop();
             await workers.stop();
             await server.close();
         },