@aeolus-fleet/gateway 0.32.2 → 0.34.0

package/dist/core/slack/take-access-token.d.ts

@@ -0,0 +1,25 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { Clock } from '../shared/clock.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { SlackRefusal, SlackTooling, SlackWorkspaces } from './ports.js';
+export type TakeAccessTokenRefusal = DomainError<'SLACK_NOT_CONNECTED' | 'SLACK_TOKEN_REFUSED' | 'SLACK_UNAVAILABLE'>;
+export type TakeAccessToken = (fleetId: FleetId) => Promise<Result<string, TakeAccessTokenRefusal>>;
+/** What a page says of a configuration token Slack refused (gateway scopes 9.1). */
+export declare const TOKEN_REFUSED_MESSAGE = "Slack refused the configuration token. Connect again to make or change bots; bots already installed keep working";
+/** What a page says when Slack did not do what was asked for now: rate limited, or no answer. */
+export declare function slackUnavailableMessage(refusal: Exclude<SlackRefusal, {
+    kind: 'refused';
+}>): string;
+/**
+ * Use case: the fleet's configuration access token, to make or remove an app
+ * with. Fresh, it is used as kept; within its last hour it is rotated first,
+ * holding the workspace, so its single-use refresh token is spent once.
+ * Slack refusing the refresh token marks it refused until someone connects
+ * again; Slack not answering keeps the old pair, to rotate again later.
+ */
+export declare function createTakeAccessToken(deps: {
+    slack: Pick<SlackTooling, 'rotateConfigurationToken'>;
+    workspaces: Pick<SlackWorkspaces, 'change'>;
+    clock: Clock;
+}): TakeAccessToken;

package/dist/core/slack/take-access-token.js

@@ -0,0 +1,45 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+import { isFresh } from './slack-workspace.js';
+/** What a page says of a configuration token Slack refused (gateway scopes 9.1). */
+export const TOKEN_REFUSED_MESSAGE = 'Slack refused the configuration token. Connect again to make or change bots; bots already installed keep working';
+/** What a page says when Slack did not do what was asked for now: rate limited, or no answer. */
+export function slackUnavailableMessage(refusal) {
+    return refusal.kind === 'rateLimited' ? `Slack asks to wait ${String(refusal.retryAfterSeconds)} seconds: try again then` : 'Slack did not answer: try again';
+}
+/**
+ * Use case: the fleet's configuration access token, to make or remove an app
+ * with. Fresh, it is used as kept; within its last hour it is rotated first,
+ * holding the workspace, so its single-use refresh token is spent once.
+ * Slack refusing the refresh token marks it refused until someone connects
+ * again; Slack not answering keeps the old pair, to rotate again later.
+ */
+export function createTakeAccessToken(deps) {
+    return async (fleetId) => {
+        let outcome;
+        const rotate = async (workspace) => {
+            if (workspace.isTokenRefused) {
+                outcome = refuse('SLACK_TOKEN_REFUSED', TOKEN_REFUSED_MESSAGE);
+                return workspace;
+            }
+            if (isFresh(workspace.token, deps.clock.now())) {
+                outcome = ok(workspace.token.accessToken);
+                return workspace;
+            }
+            const rotated = await deps.slack.rotateConfigurationToken(workspace.token.refreshToken);
+            if (rotated.isOk) {
+                outcome = ok(rotated.value.token.accessToken);
+                return { ...workspace, token: rotated.value.token };
+            }
+            if (rotated.error.kind === 'refused') {
+                outcome = refuse('SLACK_TOKEN_REFUSED', TOKEN_REFUSED_MESSAGE);
+                return { ...workspace, isTokenRefused: true };
+            }
+            outcome = refuse('SLACK_UNAVAILABLE', slackUnavailableMessage(rotated.error));
+            return workspace;
+        };
+        await deps.workspaces.change(fleetId, rotate);
+        return outcome ?? refuse('SLACK_NOT_CONNECTED', 'The fleet is connected to no Slack workspace');
+    };
+}
+//# sourceMappingURL=take-access-token.js.map

package/dist/core/slack/take-access-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"take-access-token.js","sourceRoot":"","sources":["../../../src/core/slack/take-access-token.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,OAAO,EAAuB,MAAM,sBAAsB,CAAC;AAMpE,oFAAoF;AACpF,MAAM,CAAC,MAAM,qBAAqB,GAAG,kHAAkH,CAAC;AAExJ,iGAAiG;AACjG,MAAM,UAAU,uBAAuB,CAAC,OAAmD;IACzF,OAAO,OAAO,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,sBAAsB,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,0BAA0B,CAAC,CAAC,CAAC,iCAAiC,CAAC;AAChK,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAA0H;IAC9J,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,IAAI,OAA2D,CAAC;QAChE,MAAM,MAAM,GAAG,KAAK,EAAE,SAAyB,EAA2B,EAAE;YAC1E,IAAI,SAAS,CAAC,cAAc,EAAE,CAAC;gBAC7B,OAAO,GAAG,MAAM,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC;gBAC/D,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IAAI,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;gBAC/C,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;gBAC1C,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACxF,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;gBAC9C,OAAO,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACtD,CAAC;YACD,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBACrC,OAAO,GAAG,MAAM,CAAC,qBAAqB,EAAE,qBAAqB,CAAC,CAAC;gBAC/D,OAAO,EAAE,GAAG,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;YAChD,CAAC;YACD,OAAO,GAAG,MAAM,CAAC,mBAAmB,EAAE,uBAAuB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9E,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QACF,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC9C,OAAO,OAAO,IAAI,MAAM,CAAC,qBAAqB,EAAE,8CAA8C,CAAC,CAAC;IAClG,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/slack/take-slack-event.d.ts

@@ -0,0 +1,49 @@
+import type { Clock } from '../shared/clock.js';
+import { type Result } from '../shared/result.js';
+import type { SlackApps, SlackEvents, SlackLinks, SlackMessages, SlackPosts, SlackSignatures } from './ports.js';
+import { type SlackEventFields } from './slack-event.js';
+/** What the gateway answers a person whose disabled account's link stopped (gateway scopes 9.3). */
+export declare const STOPPED_LINK_TEXT = "Your account cannot message the fleet now";
+export type TakeSlackEvent = (event: {
+    appId: string;
+    event: SlackEventFields;
+    /** Whether Slack sends the event again, as it does when no answer came within 3 seconds. */
+    isRetry: boolean;
+    body: string;
+    timestamp: string;
+    signature: string;
+}) => Promise<Result<{
+    kind: 'taken' | 'kept' | 'known' | 'notLinked' | 'ignored';
+}, {
+    kind: 'notSigned';
+}>>;
+/**
+ * Use case: an event Slack sends the gateway for one of its apps. It is
+ * taken only signed with that app's signing secret, its timestamp within 5
+ * minutes of now. An app uninstalled or its tokens revoked is Removed in
+ * Slack, its bot token forgotten. A person who messages or mentions a bot
+ * unlinked gets an answer only they see, with a button to link, and their
+ * message is not stored, since it has no sender yet (gateway scopes 9.3);
+ * a disabled account's Slack user is told it cannot message the fleet now.
+ * Slack's retry of an event is answered once, the first time. A linked
+ * person's message is kept by Slack's event id, as the Markdown it is sent
+ * as, and sent now (9.4 step 3); a retry of a kept one changes nothing.
+ * One in the thread under a delivery the gateway posted answers it: it goes
+ * to that delivery's sender in reply to its message (9.5 step 4). Through
+ * the gateway's own bot, only such an answer is sent. One in a thread that
+ * matches no post, while a delivery in that conversation is not yet in
+ * Slack, may be under it: it is kept, and matched as it is sent.
+ */
+export declare function createTakeSlackEvent(deps: {
+    apps: Pick<SlackApps, 'findByAppId' | 'save'>;
+    links: Pick<SlackLinks, 'find'>;
+    events: Pick<SlackEvents, 'keep'>;
+    posts: Pick<SlackPosts, 'lastInThread' | 'unfinished'>;
+    /** Sends the kept events now, not at the next round. */
+    sendNow: () => void;
+    slack: Pick<SlackMessages, 'postOnlyTo'>;
+    signatures: SlackSignatures;
+    clock: Clock;
+    /** The web app's page that starts a link, by the fleet named. */
+    linkPageUrl: string;
+}): TakeSlackEvent;

package/dist/core/slack/take-slack-event.js

@@ -0,0 +1,81 @@
+import { err, ok } from '../shared/result.js';
+import { isRemovedEvent, personMessageOf } from './slack-event.js';
+import { isAwaitingSlackIn } from './slack-post.js';
+import { markdownOf } from './slack-markdown.js';
+import { isSignedBy } from './slack-request.js';
+/** What the gateway answers a person whose disabled account's link stopped (gateway scopes 9.3). */
+export const STOPPED_LINK_TEXT = 'Your account cannot message the fleet now';
+/**
+ * Use case: an event Slack sends the gateway for one of its apps. It is
+ * taken only signed with that app's signing secret, its timestamp within 5
+ * minutes of now. An app uninstalled or its tokens revoked is Removed in
+ * Slack, its bot token forgotten. A person who messages or mentions a bot
+ * unlinked gets an answer only they see, with a button to link, and their
+ * message is not stored, since it has no sender yet (gateway scopes 9.3);
+ * a disabled account's Slack user is told it cannot message the fleet now.
+ * Slack's retry of an event is answered once, the first time. A linked
+ * person's message is kept by Slack's event id, as the Markdown it is sent
+ * as, and sent now (9.4 step 3); a retry of a kept one changes nothing.
+ * One in the thread under a delivery the gateway posted answers it: it goes
+ * to that delivery's sender in reply to its message (9.5 step 4). Through
+ * the gateway's own bot, only such an answer is sent. One in a thread that
+ * matches no post, while a delivery in that conversation is not yet in
+ * Slack, may be under it: it is kept, and matched as it is sent.
+ */
+export function createTakeSlackEvent(deps) {
+    return async ({ appId, event, isRetry, body, timestamp, signature }) => {
+        const app = await deps.apps.findByAppId(appId);
+        const now = deps.clock.now();
+        if (!isSignedBy(app, { request: { body, timestamp, signature }, signatures: deps.signatures, clock: deps.clock })) {
+            return err({ kind: 'notSigned' });
+        }
+        if (isRemovedEvent(event)) {
+            await deps.apps.save({ ...app, bot: null, removedInSlackAt: now });
+            return ok({ kind: 'taken' });
+        }
+        const message = personMessageOf(event);
+        if (message === undefined || app.bot === null) {
+            return ok({ kind: 'ignored' });
+        }
+        const link = await deps.links.find(app.fleetId, { teamId: message.teamId, userId: message.userId });
+        if (link?.stoppedAt === null) {
+            const { eventId, channel, ts, threadTs, text, files } = message;
+            // Awaiting is read before the thread: a post Slack answers between the two reads is then found in the thread, never missed by both.
+            const isAwaiting = threadTs !== null && (await deps.posts.unfinished(app.fleetId, link.personShipId)).some((post) => isAwaitingSlackIn(post, { appId, channel }));
+            const answered = threadTs === null ? undefined : await deps.posts.lastInThread(app.fleetId, { personShipId: link.personShipId, appId, channel, threadTs });
+            const shipId = answered?.senderShipId ?? app.shipId;
+            const isToMatch = isAwaiting && answered === undefined;
+            if (shipId === null && !isToMatch) {
+                return ok({ kind: 'ignored' });
+            }
+            const kept = await deps.events.keep({
+                fleetId: app.fleetId,
+                eventId,
+                appId,
+                shipId,
+                personShipId: link.personShipId,
+                inReplyTo: answered?.messageId ?? null,
+                deliveryId: answered?.deliveryId ?? null,
+                channel,
+                ts,
+                threadTs,
+                markdown: markdownOf({ text, botUserId: app.bot.userId, files }),
+                receivedAt: now,
+                takenAt: null,
+            });
+            if (kept === 'kept') {
+                deps.sendNow();
+            }
+            return ok({ kind: kept });
+        }
+        if (!isRetry) {
+            const answer = link === undefined
+                ? { text: `Link your Slack account to talk to ${app.name}. Your message was not kept: send it again once linked.`, button: { text: 'Link Slack', url: `${deps.linkPageUrl}?${new URLSearchParams({ fleet: app.fleetId }).toString()}` } }
+                : { text: STOPPED_LINK_TEXT };
+            // Slack's refusal leaves nothing to undo: the message was never kept, and the person may write again.
+            await deps.slack.postOnlyTo(app.bot.token, { channel: message.channel, user: message.userId, ...answer });
+        }
+        return ok({ kind: link === undefined ? 'notLinked' : 'ignored' });
+    };
+}
+//# sourceMappingURL=take-slack-event.js.map

package/dist/core/slack/take-slack-event.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"take-slack-event.js","sourceRoot":"","sources":["../../../src/core/slack/take-slack-event.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAE3D,OAAO,EAAE,cAAc,EAAE,eAAe,EAAyB,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEhD,oGAAoG;AACpG,MAAM,CAAC,MAAM,iBAAiB,GAAG,2CAA2C,CAAC;AAY7E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAYpC;IACC,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE;QACrE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;YAClH,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,CAAC,CAAC;YACnE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/B,CAAC;QACD,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;YAC9C,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QACpG,IAAI,IAAI,EAAE,SAAS,KAAK,IAAI,EAAE,CAAC;YAC7B,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;YAChE,oIAAoI;YACpI,MAAM,UAAU,GAAG,QAAQ,KAAK,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YAClK,MAAM,QAAQ,GAAG,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC3J,MAAM,MAAM,GAAG,QAAQ,EAAE,YAAY,IAAI,GAAG,CAAC,MAAM,CAAC;YACpD,MAAM,SAAS,GAAG,UAAU,IAAI,QAAQ,KAAK,SAAS,CAAC;YACvD,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBAClC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YACjC,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBAClC,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,OAAO;gBACP,KAAK;gBACL,MAAM;gBACN,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,IAAI;gBACtC,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,IAAI;gBACxC,OAAO;gBACP,EAAE;gBACF,QAAQ;gBACR,QAAQ,EAAE,UAAU,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;gBAChE,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,IAAI;aACd,CAAC,CAAC;YACH,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACpB,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,CAAC;YACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,IAAI,KAAK,SAAS;gBAC/B,CAAC,CAAC,EAAE,IAAI,EAAE,sCAAsC,GAAG,CAAC,IAAI,yDAAyD,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE;gBACzO,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;YAChC,sGAAsG;YACtG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IACpE,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/slack/unlink-slack.d.ts

@@ -0,0 +1,9 @@
+import type { Actor } from '../actors/authenticate-actor.js';
+import type { SlackLinks } from './ports.js';
+export type UnlinkSlack = (input: {
+    actor: Actor;
+}) => Promise<void>;
+/** Use case: Unlink on the Overview (gateway scopes 9.3): the account's own link goes, and its Slack user may link again. */
+export declare function createUnlinkSlack(deps: {
+    links: Pick<SlackLinks, 'remove'>;
+}): UnlinkSlack;

package/dist/core/slack/unlink-slack.js

@@ -0,0 +1,9 @@
+/** Use case: Unlink on the Overview (gateway scopes 9.3): the account's own link goes, and its Slack user may link again. */
+export function createUnlinkSlack(deps) {
+    return async ({ actor }) => {
+        if (actor.kind === 'account') {
+            await deps.links.remove(actor.fleetId, actor.accountId);
+        }
+    };
+}
+//# sourceMappingURL=unlink-slack.js.map

package/dist/core/slack/unlink-slack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unlink-slack.js","sourceRoot":"","sources":["../../../src/core/slack/unlink-slack.ts"],"names":[],"mappings":"AAKA,6HAA6H;AAC7H,MAAM,UAAU,iBAAiB,CAAC,IAA2C;IAC3E,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QACzB,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/vault/credential.d.ts

@@ -20,3 +20,37 @@ export type McpServerCredential =
     /** The OAuth scope to ask the authorization server for, if the server needs one. */
     readonly scope?: string;
 };
+/**
+ * The OAuth client the gateway registered for one party with the outside
+ * authorization server, by dynamic registration (decision 0067): every
+ * person's grant for the party is under it, and it goes to no issuer but its
+ * own.
+ */
+export interface SignInClient {
+    readonly issuer: string;
+    readonly authorizationEndpoint: string;
+    readonly tokenEndpoint: string;
+    /** Where a grant is revoked, when the authorization server offers it. */
+    readonly revocationEndpoint: string | null;
+    /** Whether the authorization server states its issuer in each authorization response (RFC 9207): a response without it is then refused. */
+    readonly isIssuerInResponse: boolean;
+    readonly clientId: string;
+    /** None when the authorization server registered a public client. */
+    readonly clientSecret: string | null;
+    /** Where the client is read or deleted, and with what (RFC 7592), when the authorization server answered them; only registration answers them. */
+    readonly registrationClientUri: string | null;
+    readonly registrationAccessToken: string | null;
+    /** The server's resource indicator (RFC 8707), as its protected resource metadata names it. */
+    readonly resource: string;
+    /** The outside scopes each person's sign-in asks for. */
+    readonly scope: string;
+}
+/**
+ * An outside MCP server's credential: one of the gateway's own, or, for a
+ * server that takes only an OAuth sign-in, the party's client, under which
+ * each person signs in for themselves (decision 0067).
+ */
+export type McpServerPartyCredential = McpServerCredential | {
+    readonly kind: 'personSignIn';
+    readonly client: SignInClient;
+};

package/dist/grant-worker.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The gateway's rounds over grants (decision 0067): every interval, until
+ * it stops, a round refreshes the grants that are idle or near their end
+ * (Q7) and ends the grants of retired person ships (Q6). Every gateway
+ * instance runs one; the grant's row lock keeps their refreshes of one
+ * grant one at a time.
+ */
+import type { FastifyBaseLogger } from 'fastify';
+import type { Sleep } from './core/mcp-out/run-party.js';
+export interface GrantWorker {
+    start(): void;
+    /** Stops, once the round under way ended. */
+    stop(): Promise<void>;
+}
+export declare function createGrantWorker(deps: {
+    round: () => Promise<void>;
+    sleep: Sleep;
+    intervalMs: number;
+    log: FastifyBaseLogger;
+}): GrantWorker;

package/dist/grant-worker.js

@@ -0,0 +1,24 @@
+export function createGrantWorker(deps) {
+    const stopping = new AbortController();
+    let running = Promise.resolve();
+    return {
+        start: () => {
+            running = (async () => {
+                while (!stopping.signal.aborted) {
+                    try {
+                        await deps.round();
+                    }
+                    catch (error) {
+                        deps.log.error({ err: error }, 'grant round failed');
+                    }
+                    await deps.sleep(deps.intervalMs, stopping.signal);
+                }
+            })();
+        },
+        stop: async () => {
+            stopping.abort();
+            await running;
+        },
+    };
+}
+//# sourceMappingURL=grant-worker.js.map

package/dist/grant-worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-worker.js","sourceRoot":"","sources":["../src/grant-worker.ts"],"names":[],"mappings":"AAiBA,MAAM,UAAU,iBAAiB,CAAC,IAA8F;IAC9H,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAC;IACvC,IAAI,OAAO,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC/C,OAAO;QACL,KAAK,EAAE,GAAG,EAAE;YACV,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;gBACpB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAChC,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;oBACrB,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,oBAAoB,CAAC,CAAC;oBACvD,CAAC;oBACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QACD,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,OAAO,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/slack-event-worker.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The gateway's sends from Slack into the fleet (gateway scopes 9.4): a
+ * round every interval, and one at once when a person's message is kept,
+ * one round at a time, until it stops.
+ */
+import type { FastifyBaseLogger } from 'fastify';
+import type { Sleep } from './core/mcp-out/run-party.js';
+import type { SendSlackEvents } from './core/slack/send-slack-events.js';
+export interface SlackEventWorker {
+    start(): void;
+    /** Runs the next round now, not at the next interval. */
+    wake(): void;
+    /** Stops, once the round under way ended. */
+    stop(): Promise<void>;
+}
+export declare function createSlackEventWorker(deps: {
+    send: SendSlackEvents;
+    sleep: Sleep;
+    intervalMs: number;
+    log: FastifyBaseLogger;
+}): SlackEventWorker;

package/dist/slack-event-worker.js

@@ -0,0 +1,38 @@
+export function createSlackEventWorker(deps) {
+    const stopping = new AbortController();
+    let waking = new AbortController();
+    /** Whether a wake came during a round: the next round runs at once. */
+    let isWoken = false;
+    let running = Promise.resolve();
+    // Read after a round: a wake or a stop may have come while it ran.
+    const isToGoOn = () => isWoken || stopping.signal.aborted;
+    return {
+        start: () => {
+            running = (async () => {
+                while (!stopping.signal.aborted) {
+                    isWoken = false;
+                    try {
+                        await deps.send();
+                    }
+                    catch (error) {
+                        deps.log.error({ err: error }, 'Slack event round failed');
+                    }
+                    if (isToGoOn()) {
+                        continue;
+                    }
+                    waking = new AbortController();
+                    await deps.sleep(deps.intervalMs, AbortSignal.any([stopping.signal, waking.signal]));
+                }
+            })();
+        },
+        wake: () => {
+            isWoken = true;
+            waking.abort();
+        },
+        stop: async () => {
+            stopping.abort();
+            await running;
+        },
+    };
+}
+//# sourceMappingURL=slack-event-worker.js.map

package/dist/slack-event-worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-event-worker.js","sourceRoot":"","sources":["../src/slack-event-worker.ts"],"names":[],"mappings":"AAkBA,MAAM,UAAU,sBAAsB,CAAC,IAAyF;IAC9H,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAC;IACvC,IAAI,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,uEAAuE;IACvE,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,OAAO,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC/C,mEAAmE;IACnE,MAAM,QAAQ,GAAG,GAAY,EAAE,CAAC,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;IACnE,OAAO;QACL,KAAK,EAAE,GAAG,EAAE;YACV,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;gBACpB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAChC,OAAO,GAAG,KAAK,CAAC;oBAChB,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;oBACpB,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,0BAA0B,CAAC,CAAC;oBAC7D,CAAC;oBACD,IAAI,QAAQ,EAAE,EAAE,CAAC;wBACf,SAAS;oBACX,CAAC;oBACD,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;oBAC/B,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gBACvF,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QACD,IAAI,EAAE,GAAG,EAAE;YACT,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC;QACD,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,OAAO,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/slack-token-worker.d.ts

@@ -0,0 +1,19 @@
+/**
+ * The gateway keeping each fleet's Slack configuration token alive (gateway
+ * scopes 9.1): a rotation pass every interval, well within the hour before
+ * a token ends, until it stops.
+ */
+import type { FastifyBaseLogger } from 'fastify';
+import type { Sleep } from './core/mcp-out/run-party.js';
+import type { RotateConfigurationTokens } from './core/slack/rotate-configuration-tokens.js';
+export interface SlackTokenWorker {
+    start(): void;
+    /** Stops, once the pass under way ended. */
+    stop(): Promise<void>;
+}
+export declare function createSlackTokenWorker(deps: {
+    rotate: RotateConfigurationTokens;
+    sleep: Sleep;
+    intervalMs: number;
+    log: FastifyBaseLogger;
+}): SlackTokenWorker;

package/dist/slack-token-worker.js

@@ -0,0 +1,24 @@
+export function createSlackTokenWorker(deps) {
+    const stopping = new AbortController();
+    let running = Promise.resolve();
+    return {
+        start: () => {
+            running = (async () => {
+                while (!stopping.signal.aborted) {
+                    try {
+                        await deps.rotate();
+                    }
+                    catch (error) {
+                        deps.log.error({ err: error }, 'Slack configuration token pass failed');
+                    }
+                    await deps.sleep(deps.intervalMs, stopping.signal);
+                }
+            })();
+        },
+        stop: async () => {
+            stopping.abort();
+            await running;
+        },
+    };
+}
+//# sourceMappingURL=slack-token-worker.js.map

package/dist/slack-token-worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-token-worker.js","sourceRoot":"","sources":["../src/slack-token-worker.ts"],"names":[],"mappings":"AAgBA,MAAM,UAAU,sBAAsB,CAAC,IAAqG;IAC1I,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAC;IACvC,IAAI,OAAO,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC/C,OAAO;QACL,KAAK,EAAE,GAAG,EAAE;YACV,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;gBACpB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAChC,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;oBACtB,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,uCAAuC,CAAC,CAAC;oBAC1E,CAAC;oBACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QACD,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,OAAO,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aeolus-fleet/gateway",
-  "version": "0.32.2",
+  "version": "0.34.0",
   "description": "Aeolus gateway: outside MCP servers and clients join a fleet as ships, through one gateway beside core.",
   "keywords": [
     "ai-agents",
@@ -42,7 +42,8 @@
     "test:unit": "vitest run --project '*:unit'",
     "test:integration": "vitest run --project '*:integration'",
     "start": "node dist/bin/aeolus-gateway.js start",
-    "db:migrate": "tsx --env-file-if-exists=.env src/bin/aeolus-gateway.ts migrate"
+    "db:migrate": "tsx --env-file-if-exists=.env src/bin/aeolus-gateway.ts migrate",
+    "plugin:build": "tsx scripts/plugin-build.ts"
   },
   "dependencies": {
     "@a2a-js/sdk": "1.3.0",

package/src/adapters/prisma/migrations/20261027090000_slack_workspaces/migration.sql

@@ -0,0 +1,30 @@
+-- Gateway scopes (9.1): each fleet's Slack workspace with its configuration token, and the apps the gateway made in it.
+CREATE TABLE "slack_workspaces" (
+    "fleet_id" TEXT NOT NULL,
+    "team_id" TEXT NOT NULL,
+    "team_name" TEXT,
+    "connected_by_ship_id" TEXT NOT NULL,
+    "connected_by_name" TEXT NOT NULL,
+    "connected_at" TIMESTAMPTZ(3) NOT NULL,
+    "config_access_token" TEXT NOT NULL,
+    "config_refresh_token" TEXT NOT NULL,
+    "config_expires_at" TIMESTAMPTZ(3) NOT NULL,
+    "is_config_refused" BOOLEAN NOT NULL,
+
+    CONSTRAINT "slack_workspaces_pkey" PRIMARY KEY ("fleet_id")
+);
+
+CREATE TABLE "slack_apps" (
+    "fleet_id" TEXT NOT NULL,
+    "app_id" TEXT NOT NULL,
+    "ship_id" TEXT,
+    "client_id" TEXT NOT NULL,
+    "client_secret" TEXT NOT NULL,
+    "signing_secret" TEXT NOT NULL,
+    "install_url" TEXT NOT NULL,
+    "made_at" TIMESTAMPTZ(3) NOT NULL,
+    "bot_token" TEXT,
+    "bot_user_id" TEXT,
+
+    CONSTRAINT "slack_apps_pkey" PRIMARY KEY ("fleet_id","app_id")
+);

package/src/adapters/prisma/migrations/20261027150000_slack_bots/migration.sql

@@ -0,0 +1,6 @@
+-- Gateway scopes (9.2): a Slack app's bot name, its install opened from the gateway, and its removal in Slack; an app id names one app across fleets.
+ALTER TABLE "slack_apps" ADD COLUMN "name" TEXT NOT NULL DEFAULT '';
+ALTER TABLE "slack_apps" ALTER COLUMN "name" DROP DEFAULT;
+ALTER TABLE "slack_apps" ADD COLUMN "install_started_at" TIMESTAMPTZ(3);
+ALTER TABLE "slack_apps" ADD COLUMN "removed_in_slack_at" TIMESTAMPTZ(3);
+CREATE UNIQUE INDEX "slack_apps_app_id_key" ON "slack_apps"("app_id");

package/src/adapters/prisma/migrations/20261027200000_slack_links/migration.sql

@@ -0,0 +1,15 @@
+-- Gateway scopes (9.3): a person's Slack account linked to their account in a fleet, one Slack user to one account and one Slack user per account in each fleet.
+CREATE TABLE "slack_links" (
+    "fleet_id" TEXT NOT NULL,
+    "team_id" TEXT NOT NULL,
+    "slack_user_id" TEXT NOT NULL,
+    "slack_name" TEXT NOT NULL,
+    "account_id" TEXT NOT NULL,
+    "person_ship_id" TEXT NOT NULL,
+    "linked_at" TIMESTAMPTZ(3) NOT NULL,
+    "stopped_at" TIMESTAMPTZ(3),
+
+    CONSTRAINT "slack_links_pkey" PRIMARY KEY ("fleet_id","team_id","slack_user_id")
+);
+
+CREATE UNIQUE INDEX "slack_links_fleet_id_account_id_key" ON "slack_links"("fleet_id", "account_id");

package/src/adapters/prisma/migrations/20261028090000_slack_events/migration.sql

@@ -0,0 +1,18 @@
+-- Gateway scopes (9.4 step 3, P-B2): a linked person's Slack message, kept by Slack's event id until core takes it; then only its id, for an hour.
+CREATE TABLE "slack_events" (
+    "fleet_id" TEXT NOT NULL,
+    "event_id" TEXT NOT NULL,
+    "app_id" TEXT NOT NULL,
+    "ship_id" TEXT NOT NULL,
+    "person_ship_id" TEXT NOT NULL,
+    "channel" TEXT NOT NULL,
+    "ts" TEXT NOT NULL,
+    "thread_ts" TEXT,
+    "markdown" TEXT NOT NULL,
+    "received_at" TIMESTAMPTZ(3) NOT NULL,
+    "taken_at" TIMESTAMPTZ(3),
+
+    CONSTRAINT "slack_events_pkey" PRIMARY KEY ("fleet_id","event_id")
+);
+
+CREATE INDEX "slack_events_taken_at_received_at_idx" ON "slack_events"("taken_at", "received_at");

package/src/adapters/prisma/migrations/20261028150000_slack_posts/migration.sql

@@ -0,0 +1,25 @@
+-- Gateway scopes (9.5): Show everything that waits in Slack per link; an answer in a thread kept with what it answers; the fleet messages in Slack, by person ship.
+ALTER TABLE "slack_links" ADD COLUMN "is_showing_all" BOOLEAN NOT NULL DEFAULT false;
+ALTER TABLE "slack_events" ADD COLUMN "in_reply_to" TEXT;
+ALTER TABLE "slack_events" ADD COLUMN "delivery_id" TEXT;
+
+CREATE TABLE "slack_posts" (
+    "fleet_id" TEXT NOT NULL,
+    "person_ship_id" TEXT NOT NULL,
+    "message_id" TEXT NOT NULL,
+    "delivery_id" TEXT,
+    "sender_ship_id" TEXT,
+    "app_id" TEXT NOT NULL,
+    "channel" TEXT NOT NULL,
+    "ts" TEXT,
+    "thread_ts" TEXT,
+    "is_link_only" BOOLEAN NOT NULL,
+    "acked_at" TIMESTAMPTZ(3),
+
+    CONSTRAINT "slack_posts_pkey" PRIMARY KEY ("fleet_id","person_ship_id","message_id")
+);
+
+CREATE INDEX "slack_posts_fleet_id_app_id_channel_ts_idx" ON "slack_posts"("fleet_id", "app_id", "channel", "ts");
+CREATE INDEX "slack_posts_fleet_id_app_id_channel_thread_ts_idx" ON "slack_posts"("fleet_id", "app_id", "channel", "thread_ts");
+
+CREATE INDEX "slack_links_fleet_id_person_ship_id_idx" ON "slack_links"("fleet_id", "person_ship_id");

package/src/adapters/prisma/migrations/20261028230000_party_grants/migration.sql

@@ -0,0 +1,18 @@
+-- Decision 0067: a person's grant of an outside MCP server where each person signs in, one per person and party, and one per outside account and party where the server named it.
+CREATE TABLE "party_grants" (
+    "fleet_id" TEXT NOT NULL,
+    "party" TEXT NOT NULL,
+    "person_ship_id" TEXT NOT NULL,
+    "account_id" TEXT NOT NULL,
+    "subject" TEXT,
+    "outside_account_name" TEXT,
+    "access_token" TEXT NOT NULL,
+    "refresh_token" TEXT,
+    "access_token_ends_at" TIMESTAMPTZ(3),
+    "signed_in_at" TIMESTAMPTZ(3) NOT NULL,
+    "last_used_at" TIMESTAMPTZ(3),
+
+    CONSTRAINT "party_grants_pkey" PRIMARY KEY ("fleet_id","party","person_ship_id")
+);
+
+CREATE UNIQUE INDEX "party_grants_fleet_id_party_subject_key" ON "party_grants"("fleet_id", "party", "subject");

package/src/adapters/prisma/migrations/20261029080000_party_sign_in_notices/migration.sql

@@ -0,0 +1,10 @@
+-- Decision 0067, Q6: the notice that told a person a call needed their sign-in to a party, one per person and party while open.
+CREATE TABLE "party_sign_in_notices" (
+    "fleet_id" TEXT NOT NULL,
+    "party" TEXT NOT NULL,
+    "person_ship_id" TEXT NOT NULL,
+    "notice_id" TEXT NOT NULL,
+    "is_told" BOOLEAN NOT NULL DEFAULT false,
+
+    CONSTRAINT "party_sign_in_notices_pkey" PRIMARY KEY ("fleet_id","party","person_ship_id")
+);

package/src/adapters/prisma/migrations/20261029120000_party_grants_lost/migration.sql

@@ -0,0 +1,3 @@
+-- Decision 0067, Q5: a grant a refresh answered invalid_grant is lost, kept with when and why until the person signs in again.
+ALTER TABLE "party_grants" ADD COLUMN "lost_at" TIMESTAMPTZ(3),
+ADD COLUMN "lost_why" TEXT;

package/src/adapters/prisma/migrations/20261029130000_party_grants_refreshed/migration.sql

@@ -0,0 +1,6 @@
+-- Decision 0067, Q7: when a grant was last refreshed, and the indexes of the schedule that refreshes grants near their end and idle ones.
+ALTER TABLE "party_grants" ADD COLUMN "refreshed_at" TIMESTAMPTZ(3);
+
+CREATE INDEX "party_grants_access_token_ends_at_idx" ON "party_grants"("access_token_ends_at");
+
+CREATE INDEX "party_grants_refreshed_at_signed_in_at_idx" ON "party_grants"("refreshed_at", "signed_in_at");

package/src/adapters/prisma/migrations/20261030090000_party_grants_of_account/migration.sql

@@ -0,0 +1,2 @@
+-- Decision 0067, Q14: a disabled account's grants, read by account.
+CREATE INDEX "party_grants_fleet_id_account_id_idx" ON "party_grants"("fleet_id", "account_id");

package/src/adapters/prisma/migrations/20261030100000_slack_events_unmatched_answers/migration.sql

@@ -0,0 +1,2 @@
+-- Gateway scopes 9.5 step 4: an answer in a thread through the gateway's own bot, kept before the delivery it answers is in Slack, goes to no ship until it is matched.
+ALTER TABLE "slack_events" ALTER COLUMN "ship_id" DROP NOT NULL;