@aeolus-fleet/gateway 0.29.2 → 0.30.0

package/dist/core/mcp-out/statement.js.map

@@ -1 +1 @@
-{"version":3,"file":"statement.js","sourceRoot":"","sources":["../../../src/core/mcp-out/statement.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAgCnE,SAAS,YAAY,CAAC,IAAiB,EAAE,MAAqD;IAC5F,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1D,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5E,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/E,UAAU,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,WAAW,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5E,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;QAC5B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;KACrC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAAgH;IAC1I,OAAO;QACL,OAAO,EAAE,GAAG,KAAK,CAAC,SAAS,uMAAuM;QAClO,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;KACrI,CAAC;AACJ,CAAC"}
+{"version":3,"file":"statement.js","sourceRoot":"","sources":["../../../src/core/mcp-out/statement.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAiCnE,SAAS,YAAY,CAAC,IAAiB,EAAE,MAAqD;IAC5F,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1D,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5E,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/E,UAAU,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,WAAW,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5E,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;QAC5B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;KACrC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAAgH;IAC1I,OAAO;QACL,OAAO,EAAE,GAAG,KAAK,CAAC,SAAS,uMAAuM;QAClO,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;KACrI,CAAC;AACJ,CAAC"}

package/dist/core/oauth/exchange-id-jag.d.ts

@@ -0,0 +1,28 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { AccountGrants, Pagasae } from '../sign-in/ports.js';
+import type { Clock } from '../shared/clock.js';
+import { type ExchangeToken } from './exchange-token.js';
+import type { IssuedTokens, OAuthClients, OAuthSecrets } from './ports.js';
+/**
+ * Use case: a registered client posts the ID-JAG its person's company
+ * identity provider issued for the gateway, with the JWT bearer grant (RFC
+ * 7523; aeolus-fleet company sign-in design, slice 6, D7, flow 3.2). The
+ * gateway federates only through pagasae (decision 0054): it hands the
+ * ID-JAG over, and pagasae answers the account's grant in its one fleet,
+ * which must be the client's. The grant is kept as after a browser sign-in,
+ * and the client gets an access token acting as the account, with no refresh
+ * token: when it ends, the client asks its identity provider for a new
+ * ID-JAG. Only a client registered for the code flow, with its secret if it
+ * has one, posts one; there is no dynamic registration.
+ */
+export declare function createExchangeIdJag(deps: {
+    clients: OAuthClients;
+    tokens: IssuedTokens;
+    secrets: OAuthSecrets;
+    clock: Clock;
+    resource: string;
+    pagasae: Pick<Pagasae, 'exchangeIdJag'>;
+    grants: Pick<AccountGrants, 'save'>;
+    /** Whether the gateway serves the fleet: connected to it, and switched on where an installation switches fleets (decision 0021). */
+    servesFleet: (fleetId: FleetId) => Promise<boolean>;
+}): ExchangeToken;

package/dist/core/oauth/exchange-id-jag.js

@@ -0,0 +1,66 @@
+import { err, ok } from '../shared/result.js';
+import { ACCESS_TOKEN_LIFETIME_MS } from './exchange-token.js';
+const MS_PER_SECOND = 1000;
+/** What a client is told when pagasae refuses its ID-JAG: the one refusal it can act on is D9's. */
+const REFUSED_ID_JAG = 'The ID-JAG was refused. ID-JAG is only available for accounts in one fleet: an account in several signs in at the gateway’s address to choose one';
+function refusal(error, description) {
+    return err({ error, description });
+}
+/**
+ * Use case: a registered client posts the ID-JAG its person's company
+ * identity provider issued for the gateway, with the JWT bearer grant (RFC
+ * 7523; aeolus-fleet company sign-in design, slice 6, D7, flow 3.2). The
+ * gateway federates only through pagasae (decision 0054): it hands the
+ * ID-JAG over, and pagasae answers the account's grant in its one fleet,
+ * which must be the client's. The grant is kept as after a browser sign-in,
+ * and the client gets an access token acting as the account, with no refresh
+ * token: when it ends, the client asks its identity provider for a new
+ * ID-JAG. Only a client registered for the code flow, with its secret if it
+ * has one, posts one; there is no dynamic registration.
+ */
+export function createExchangeIdJag(deps) {
+    return async (request) => {
+        const client = request.client_id === undefined ? undefined : await deps.clients.find(request.client_id);
+        const isAuthentic = client !== undefined && (client.secretHash === null ? request.client_secret === undefined : request.client_secret !== undefined && deps.secrets.hashOf(request.client_secret) === client.secretHash);
+        if (client === undefined || !isAuthentic) {
+            return refusal('invalid_client', 'The client could not be authenticated: an ID-JAG needs a registered client');
+        }
+        if (client.grant !== 'authorizationCode') {
+            return refusal('unauthorized_client', 'This client signs in by client credentials');
+        }
+        if (request.assertion === undefined || request.assertion === '') {
+            return refusal('invalid_request', 'The ID-JAG is required as the assertion');
+        }
+        if (request.resource !== undefined && request.resource !== deps.resource) {
+            return refusal('invalid_target', `The resource must be ${deps.resource}`);
+        }
+        const handed = await deps.pagasae.exchangeIdJag({ idJag: request.assertion, clientId: client.clientId });
+        if (!handed.isOk) {
+            return handed.error.kind === 'unavailable' ? refusal('temporarily_unavailable', 'pagasae did not answer; try again') : refusal('invalid_grant', REFUSED_ID_JAG);
+        }
+        const { fleetId, accountId, personShipId, scopes, refreshToken, accountToken, accountTokenExpiresAt } = handed.value;
+        if (fleetId !== client.fleetId || !(await deps.servesFleet(fleetId))) {
+            return refusal('invalid_grant', `The account's fleet is not ${client.name}'s`);
+        }
+        const grantId = deps.secrets.newSecret();
+        await deps.grants.save({ grantId, fleetId, accountId, personShipId, scopes, refreshToken, accountToken, accountTokenExpiresAt });
+        const accessToken = deps.secrets.newSecret();
+        const accessHash = deps.secrets.hashOf(accessToken);
+        await deps.tokens.save({
+            familyId: accessHash,
+            codeHash: null,
+            fleetId,
+            clientId: client.clientId,
+            resource: deps.resource,
+            scope: null,
+            kind: 'account',
+            grantId,
+            accessHash,
+            accessExpiresAt: new Date(deps.clock.now().getTime() + ACCESS_TOKEN_LIFETIME_MS),
+            refreshHash: null,
+            refreshExpiresAt: null,
+        });
+        return ok({ accessToken, refreshToken: null, expiresInSeconds: ACCESS_TOKEN_LIFETIME_MS / MS_PER_SECOND, scope: null });
+    };
+}
+//# sourceMappingURL=exchange-id-jag.js.map

package/dist/core/oauth/exchange-id-jag.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exchange-id-jag.js","sourceRoot":"","sources":["../../../src/core/oauth/exchange-id-jag.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAA0D,MAAM,qBAAqB,CAAC;AAGvH,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B,oGAAoG;AACpG,MAAM,cAAc,GAAG,mJAAmJ,CAAC;AAE3K,SAAS,OAAO,CAAC,KAAqB,EAAE,WAAmB;IACzD,OAAO,GAAG,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAUnC;IACC,OAAO,KAAK,EAAE,OAAqB,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxG,MAAM,WAAW,GAAG,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC,CAAC;QACzN,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC;YACzC,OAAO,OAAO,CAAC,gBAAgB,EAAE,4EAA4E,CAAC,CAAC;QACjH,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,mBAAmB,EAAE,CAAC;YACzC,OAAO,OAAO,CAAC,qBAAqB,EAAE,4CAA4C,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;YAChE,OAAO,OAAO,CAAC,iBAAiB,EAAE,yCAAyC,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzE,OAAO,OAAO,CAAC,gBAAgB,EAAE,wBAAwB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,yBAAyB,EAAE,mCAAmC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;QAClK,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;QACrH,IAAI,OAAO,KAAK,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACrE,OAAO,OAAO,CAAC,eAAe,EAAE,8BAA8B,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjI,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACrB,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,IAAI;YACd,OAAO;YACP,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,SAAS;YACf,OAAO;YACP,UAAU;YACV,eAAe,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,wBAAwB,CAAC;YAChF,WAAW,EAAE,IAAI;YACjB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE,wBAAwB,GAAG,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1H,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/oauth/exchange-token.d.ts

@@ -1,32 +1,46 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { PartyStore } from '../parties/ports.js';
 import type { Clock } from '../shared/clock.js';
 import { type Result } from '../shared/result.js';
 import type { AuthorizationCodes, IssuedTokens, OAuthClients, OAuthError, OAuthSecrets } from './ports.js';
 /** An access token works one hour; its refresh token 30 days (orchestrator-1 on aeolus-fleet#877, Q13). */
 export declare const ACCESS_TOKEN_LIFETIME_MS: number;
 export declare const REFRESH_TOKEN_LIFETIME_MS: number;
-/** The tokens a client gets. */
+/** The JWT bearer grant (RFC 7523), with which a client posts an ID-JAG. */
+export declare const JWT_BEARER_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+/** The tokens a client gets: no refresh token for one signed in by client credentials, which asks again. */
 export interface IssuedPair {
     readonly accessToken: string;
-    readonly refreshToken: string;
+    readonly refreshToken: string | null;
     readonly expiresInSeconds: number;
     readonly scope: string | null;
 }
 /** A token request's parameters, the client's credentials among them, however it sent them. */
 export type TokenRequest = Readonly<Record<string, string | undefined>>;
 export type ExchangeToken = (request: TokenRequest) => Promise<Result<IssuedPair, OAuthError>>;
+interface ExchangeTokenDeps {
+    clients: OAuthClients;
+    codes: AuthorizationCodes;
+    tokens: IssuedTokens;
+    secrets: OAuthSecrets;
+    clock: Clock;
+    resource: string;
+    /** The parties argo's approvers added: a client signed in by client credentials is one. */
+    parties: Pick<PartyStore, 'findByClient'>;
+    /** Whether the fleet's outside parties are on (interop I-3). */
+    servesOutsideParties: (fleetId: FleetId) => Promise<boolean>;
+    /** A client's ID-JAG, the JWT bearer grant (company sign-in design, slice 6); absent where nobody signs in through pagasae. */
+    exchangeIdJag?: ExchangeToken;
+}
 /**
  * Use case: a client takes its code for tokens, or refreshes them (OAuth
  * 2.1). A confidential client proves its secret; a public one, or one known
  * by its metadata document, needs none, as PKCE binds the code to it. A code
  * is taken once: a second try revokes every token it gave. A refresh token
  * is taken once too: the pair rotates, and a rotated one coming again
- * revokes its whole family.
+ * revokes its whole family. A client party with no human at the authorize
+ * step signs in by its client credentials alone (vendor platforms V4): an
+ * access token for its party, and no refresh token, as it asks again.
  */
-export declare function createExchangeToken(deps: {
-    clients: OAuthClients;
-    codes: AuthorizationCodes;
-    tokens: IssuedTokens;
-    secrets: OAuthSecrets;
-    clock: Clock;
-    resource: string;
-}): ExchangeToken;
+export declare function createExchangeToken(deps: ExchangeTokenDeps): ExchangeToken;
+export {};

package/dist/core/oauth/exchange-token.js

@@ -3,6 +3,8 @@ import { holderOf } from './authenticate-access-token.js';
 /** An access token works one hour; its refresh token 30 days (orchestrator-1 on aeolus-fleet#877, Q13). */
 export const ACCESS_TOKEN_LIFETIME_MS = 60 * 60_000;
 export const REFRESH_TOKEN_LIFETIME_MS = 30 * 24 * 60 * 60_000;
+/** The JWT bearer grant (RFC 7523), with which a client posts an ID-JAG. */
+export const JWT_BEARER_GRANT = 'urn:ietf:params:oauth:grant-type:jwt-bearer';
 const MS_PER_SECOND = 1000;
 function refusal(error, description) {
     return err({ error, description });
@@ -13,7 +15,9 @@ function refusal(error, description) {
  * by its metadata document, needs none, as PKCE binds the code to it. A code
  * is taken once: a second try revokes every token it gave. A refresh token
  * is taken once too: the pair rotates, and a rotated one coming again
- * revokes its whole family.
+ * revokes its whole family. A client party with no human at the authorize
+ * step signs in by its client credentials alone (vendor platforms V4): an
+ * access token for its party, and no refresh token, as it asks again.
  */
 export function createExchangeToken(deps) {
     /** The client is who it says, as far as it has a secret. */
@@ -41,6 +45,43 @@ export function createExchangeToken(deps) {
         });
         return { accessToken, refreshToken, expiresInSeconds: ACCESS_TOKEN_LIFETIME_MS / MS_PER_SECOND, scope: from.scope };
     };
+    const fromClientCredentials = async (request) => {
+        const client = request.client_id === undefined ? undefined : await deps.clients.find(request.client_id);
+        const isAuthentic = client?.secretHash != null && request.client_secret !== undefined && deps.secrets.hashOf(request.client_secret) === client.secretHash;
+        if (client === undefined || !isAuthentic) {
+            return refusal('invalid_client', 'The client could not be authenticated');
+        }
+        if (client.grant !== 'clientCredentials') {
+            return refusal('unauthorized_client', 'This client signs in by authorization code');
+        }
+        const party = await deps.parties.findByClient(client.fleetId, client.clientId);
+        if (party === undefined) {
+            return refusal('invalid_client', 'The client could not be authenticated');
+        }
+        if (!(await deps.servesOutsideParties(client.fleetId))) {
+            return refusal('unauthorized_client', "This fleet's outside parties are off");
+        }
+        if (request.resource !== deps.resource) {
+            return refusal('invalid_target', `The resource must be ${deps.resource}`);
+        }
+        const accessToken = deps.secrets.newSecret();
+        const accessHash = deps.secrets.hashOf(accessToken);
+        await deps.tokens.save({
+            familyId: accessHash,
+            codeHash: null,
+            fleetId: client.fleetId,
+            clientId: client.clientId,
+            resource: deps.resource,
+            scope: null,
+            kind: 'party',
+            party: party.name,
+            accessHash,
+            accessExpiresAt: new Date(deps.clock.now().getTime() + ACCESS_TOKEN_LIFETIME_MS),
+            refreshHash: null,
+            refreshExpiresAt: null,
+        });
+        return ok({ accessToken, refreshToken: null, expiresInSeconds: ACCESS_TOKEN_LIFETIME_MS / MS_PER_SECOND, scope: null });
+    };
     const fromCode = async (request) => {
         const { code, code_verifier: verifier } = request;
         if (code === undefined || verifier === undefined) {
@@ -74,7 +115,7 @@ export function createExchangeToken(deps) {
         }
         const refreshHash = deps.secrets.hashOf(request.refresh_token);
         const pair = await deps.tokens.findByRefresh(refreshHash);
-        if (!pair || pair.clientId !== request.client_id || pair.refreshExpiresAt.getTime() <= deps.clock.now().getTime() || pair.state === 'revoked') {
+        if (!pair || pair.clientId !== request.client_id || pair.refreshExpiresAt === null || pair.refreshExpiresAt.getTime() <= deps.clock.now().getTime() || pair.state === 'revoked') {
             return refusal('invalid_grant', 'No such refresh token for this client, or it expired');
         }
         if (!(await deps.tokens.rotate(refreshHash))) {
@@ -86,8 +127,14 @@ export function createExchangeToken(deps) {
     };
     return async (request) => {
         const grantType = request.grant_type;
+        if (grantType === 'client_credentials') {
+            return fromClientCredentials(request);
+        }
+        if (grantType === JWT_BEARER_GRANT && deps.exchangeIdJag !== undefined) {
+            return deps.exchangeIdJag(request);
+        }
         if (grantType !== 'authorization_code' && grantType !== 'refresh_token') {
-            return refusal('unsupported_grant_type', 'Only authorization_code and refresh_token are served');
+            return refusal('unsupported_grant_type', 'Only authorization_code, refresh_token, client_credentials and, where people sign in, the JWT bearer grant are served');
         }
         if (!(await isAuthenticated(request))) {
             return refusal('invalid_client', 'The client could not be authenticated');

package/dist/core/oauth/exchange-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"exchange-token.js","sourceRoot":"","sources":["../../../src/core/oauth/exchange-token.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAG1D,2GAA2G;AAC3G,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,MAAM,CAAC;AACpD,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAe/D,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B,SAAS,OAAO,CAAC,KAAqB,EAAE,WAAmB;IACzD,OAAO,GAAG,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAuI;IACzK,4DAA4D;IAC5D,MAAM,eAAe,GAAG,KAAK,EAAE,OAAqB,EAAoB,EAAE;QACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,IAAI,IAAI,CAAC;QAC3E,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC;QAC7C,CAAC;QACD,OAAO,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,UAAU,CAAC;IAC1G,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,KAAK,EAAE,IAA4G,EAAuB,EAAE;QACxJ,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC7C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QACvC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACrB,GAAG,IAAI;YACP,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;YAC5C,eAAe,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,wBAAwB,CAAC;YACzD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;YAC9C,gBAAgB,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,yBAAyB,CAAC;SAC5D,CAAC,CAAC;QACH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,wBAAwB,GAAG,aAAa,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IACtH,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,EAAE,OAAqB,EAA2C,EAAE;QACxF,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;QAClD,IAAI,IAAI,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjD,OAAO,OAAO,CAAC,iBAAiB,EAAE,2CAA2C,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzE,OAAO,OAAO,CAAC,gBAAgB,EAAE,wBAAwB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,OAAO,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtD,OAAO,OAAO,CAAC,eAAe,EAAE,0DAA0D,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC;QAC1B,MAAM,OAAO,GACX,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE;YACvD,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,SAAS;YACrC,MAAM,CAAC,WAAW,KAAK,OAAO,CAAC,YAAY;YAC3C,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,aAAa,CAAC;QAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,OAAO,CAAC,eAAe,EAAE,gFAAgF,CAAC,CAAC;QACpH,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QAChE,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACpH,CAAC,CAAC;IAEF,MAAM,gBAAgB,GAAG,KAAK,EAAE,OAAqB,EAA2C,EAAE;QAChG,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,OAAO,CAAC,iBAAiB,EAAE,6BAA6B,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9I,OAAO,OAAO,CAAC,eAAe,EAAE,sDAAsD,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9C,OAAO,OAAO,CAAC,eAAe,EAAE,2DAA2D,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QACxE,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACxG,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,SAAS,KAAK,oBAAoB,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;YACxE,OAAO,OAAO,CAAC,wBAAwB,EAAE,sDAAsD,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACtC,OAAO,OAAO,CAAC,gBAAgB,EAAE,uCAAuC,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,SAAS,KAAK,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5F,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"exchange-token.js","sourceRoot":"","sources":["../../../src/core/oauth/exchange-token.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAG1D,2GAA2G;AAC3G,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,MAAM,CAAC;AACpD,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAE/D,4EAA4E;AAC5E,MAAM,CAAC,MAAM,gBAAgB,GAAG,6CAA6C,CAAC;AAe9E,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B,SAAS,OAAO,CAAC,KAAqB,EAAE,WAAmB;IACzD,OAAO,GAAG,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;AACrC,CAAC;AAiBD;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,4DAA4D;IAC5D,MAAM,eAAe,GAAG,KAAK,EAAE,OAAqB,EAAoB,EAAE;QACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,IAAI,IAAI,CAAC;QAC3E,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC;QAC7C,CAAC;QACD,OAAO,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,UAAU,CAAC;IAC1G,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,KAAK,EAAE,IAA4G,EAAuB,EAAE;QACxJ,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC7C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QACvC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACrB,GAAG,IAAI;YACP,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;YAC5C,eAAe,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,wBAAwB,CAAC;YACzD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;YAC9C,gBAAgB,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,yBAAyB,CAAC;SAC5D,CAAC,CAAC;QACH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,wBAAwB,GAAG,aAAa,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IACtH,CAAC,CAAC;IAEF,MAAM,qBAAqB,GAAG,KAAK,EAAE,OAAqB,EAA2C,EAAE;QACrG,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxG,MAAM,WAAW,GAAG,MAAM,EAAE,UAAU,IAAI,IAAI,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC;QAC1J,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC;YACzC,OAAO,OAAO,CAAC,gBAAgB,EAAE,uCAAuC,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,mBAAmB,EAAE,CAAC;YACzC,OAAO,OAAO,CAAC,qBAAqB,EAAE,4CAA4C,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,OAAO,CAAC,gBAAgB,EAAE,uCAAuC,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACvD,OAAO,OAAO,CAAC,qBAAqB,EAAE,sCAAsC,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvC,OAAO,OAAO,CAAC,gBAAgB,EAAE,wBAAwB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACrB,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,KAAK,CAAC,IAAI;YACjB,UAAU;YACV,eAAe,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,wBAAwB,CAAC;YAChF,WAAW,EAAE,IAAI;YACjB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE,wBAAwB,GAAG,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1H,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,EAAE,OAAqB,EAA2C,EAAE;QACxF,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;QAClD,IAAI,IAAI,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjD,OAAO,OAAO,CAAC,iBAAiB,EAAE,2CAA2C,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzE,OAAO,OAAO,CAAC,gBAAgB,EAAE,wBAAwB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,OAAO,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtD,OAAO,OAAO,CAAC,eAAe,EAAE,0DAA0D,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC;QAC1B,MAAM,OAAO,GACX,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE;YACvD,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,SAAS;YACrC,MAAM,CAAC,WAAW,KAAK,OAAO,CAAC,YAAY;YAC3C,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,aAAa,CAAC;QAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,OAAO,CAAC,eAAe,EAAE,gFAAgF,CAAC,CAAC;QACpH,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QAChE,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACpH,CAAC,CAAC;IAEF,MAAM,gBAAgB,GAAG,KAAK,EAAE,OAAqB,EAA2C,EAAE;QAChG,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,OAAO,CAAC,iBAAiB,EAAE,6BAA6B,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChL,OAAO,OAAO,CAAC,eAAe,EAAE,sDAAsD,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9C,OAAO,OAAO,CAAC,eAAe,EAAE,2DAA2D,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QACxE,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACxG,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;YACvC,OAAO,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,SAAS,KAAK,gBAAgB,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACvE,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,SAAS,KAAK,oBAAoB,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;YACxE,OAAO,OAAO,CAAC,wBAAwB,EAAE,uHAAuH,CAAC,CAAC;QACpK,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACtC,OAAO,OAAO,CAAC,gBAAgB,EAAE,uCAAuC,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,SAAS,KAAK,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5F,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/oauth/ports.d.ts

@@ -5,13 +5,20 @@
  */
 import type { FleetId } from '@aeolus-fleet/common';
 import type { Result } from '../shared/result.js';
-/** A client argo pre-registered for its fleet. A confidential one has a secret, kept only as its hash. */
+/**
+ * How a client signs in: by a code a person's approval issued, or, with no
+ * human at the authorize step, by its own client credentials (vendor
+ * platforms V4).
+ */
+export type ClientGrant = 'authorizationCode' | 'clientCredentials';
+/** A client registered for its fleet. A confidential one has a secret, kept only as its hash. */
 export interface OAuthClient {
     readonly clientId: string;
     readonly fleetId: FleetId;
     readonly name: string;
     readonly redirectUris: readonly string[];
     readonly secretHash: string | null;
+    readonly grant: ClientGrant;
 }
 export interface OAuthClients {
     find(clientId: string): Promise<OAuthClient | undefined>;
@@ -55,18 +62,22 @@ export interface AuthorizationCodes {
         wasUsed: boolean;
     } | undefined>;
 }
-/** An access token and its refresh token, issued together; a family is every pair one code led to. */
+/**
+ * An access token and its refresh token, issued together; a family is every
+ * pair one code led to. A client signed in by client credentials gets its
+ * access token alone, from no code.
+ */
 export type TokenPair = {
     readonly familyId: string;
-    readonly codeHash: string;
+    readonly codeHash: string | null;
     readonly fleetId: FleetId;
     readonly clientId: string;
     readonly resource: string;
     readonly scope: string | null;
     readonly accessHash: string;
     readonly accessExpiresAt: Date;
-    readonly refreshHash: string;
-    readonly refreshExpiresAt: Date;
+    readonly refreshHash: string | null;
+    readonly refreshExpiresAt: Date | null;
 } & TokenHolder;
 export interface IssuedTokens {
     /** A new pair, active. */
@@ -98,7 +109,7 @@ export interface OAuthSecrets {
     challengeOf(verifier: string): string;
 }
 /** OAuth's error codes the gateway answers (RFC 6749, RFC 8707). */
-export type OAuthErrorCode = 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unsupported_grant_type' | 'unsupported_response_type' | 'invalid_target' | 'access_denied';
+export type OAuthErrorCode = 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unauthorized_client' | 'unsupported_grant_type' | 'unsupported_response_type' | 'invalid_target' | 'access_denied' | 'temporarily_unavailable';
 export interface OAuthError {
     readonly error: OAuthErrorCode;
     readonly description: string;

package/dist/core/oauth/register-client.js

@@ -13,7 +13,7 @@ export function createRegisterClient(deps) {
         }
         const clientId = `client-${deps.secrets.newSecret()}`;
         const clientSecret = isConfidential ? deps.secrets.newSecret() : null;
-        await deps.clients.save({ clientId, fleetId, name, redirectUris: [...redirectUris], secretHash: clientSecret === null ? null : deps.secrets.hashOf(clientSecret) });
+        await deps.clients.save({ clientId, fleetId, name, redirectUris: [...redirectUris], secretHash: clientSecret === null ? null : deps.secrets.hashOf(clientSecret), grant: 'authorizationCode' });
         return ok({ clientId, clientSecret });
     };
 }

package/dist/core/oauth/register-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"register-client.js","sourceRoot":"","sources":["../../../src/core/oauth/register-client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AASrE;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAsD;IACzF,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,EAAE,EAAE;QAC/D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,iBAAiB,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/G,OAAO,MAAM,CAAC,uBAAuB,EAAE,2BAA2B,MAAM,CAAC,iBAAiB,CAAC,uEAAuE,CAAC,CAAC;QACtK,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;QACtD,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACtE,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,UAAU,EAAE,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACpK,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"register-client.js","sourceRoot":"","sources":["../../../src/core/oauth/register-client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AASrE;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAsD;IACzF,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,EAAE,EAAE;QAC/D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,iBAAiB,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/G,OAAO,MAAM,CAAC,uBAAuB,EAAE,2BAA2B,MAAM,CAAC,iBAAiB,CAAC,uEAAuE,CAAC,CAAC;QACtK,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;QACtD,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACtE,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,UAAU,EAAE,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChM,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/add-a2a-agent.d.ts

@@ -0,0 +1,34 @@
+import type { ShipId } from '@aeolus-fleet/common';
+import type { Actor } from '../actors/authenticate-actor.js';
+import type { AgentCards } from '../a2a-out/ports.js';
+import type { CallTiming } from '../mcp-out/statement.js';
+import { type DomainError } from '../shared/errors.js';
+import type { Result } from '../shared/result.js';
+import type { McpServerCredential } from '../vault/credential.js';
+import { type ApprovalDeps, type ApprovePartyRefusal } from './approve-party.js';
+import type { ShownParty } from './shown-party.js';
+export type AddA2aAgentRefusal = ApprovePartyRefusal | DomainError<'NOT_AN_APPROVER' | 'SCOPE_NOT_HELD' | 'CARD_UNREACHABLE' | 'CARD_INVALID'>;
+export type AddA2aAgent = (input: {
+    actor: Actor;
+    requestId: string;
+    name: string;
+    cardUrl: string;
+    credential: McpServerCredential;
+    concurrencyLimit: number;
+    ownerShipId: ShipId;
+    scopes: readonly string[];
+}) => Promise<Result<ShownParty, AddA2aAgentRefusal>>;
+/**
+ * Use case: an actor holding gateway:approve adds an outside A2A agent by
+ * its card address (slice 5). The gateway reads the card first: one that
+ * does not answer, is no AgentCard or makes no valid statement is not
+ * added, and nothing is commissioned. Then it commissions and crews an
+ * `a2a-agent` proxy ship with the owner and only scopes the approver holds,
+ * as every approval does, keeps the credential in the vault, and writes the
+ * card's domain as the fact it checked. The agent is repeatable, A2A's
+ * default (A9). Its statement is written once its worker starts.
+ */
+export declare function createAddA2aAgent(deps: ApprovalDeps & {
+    cards: AgentCards;
+    timing: CallTiming;
+}): AddA2aAgent;

package/dist/core/parties/add-a2a-agent.js

@@ -0,0 +1,45 @@
+import { readAgentStatement } from '../a2a-out/read-agent-statement.js';
+import { refuse } from '../shared/errors.js';
+import { APPROVING_SCOPE, EVERY_APP_SHIP_SCOPES, scopeNotHeld } from './approver.js';
+import { A2A_AGENT_SHIP_TYPE, approved, UNCOMMISSIONED } from './approve-party.js';
+/**
+ * Use case: an actor holding gateway:approve adds an outside A2A agent by
+ * its card address (slice 5). The gateway reads the card first: one that
+ * does not answer, is no AgentCard or makes no valid statement is not
+ * added, and nothing is commissioned. Then it commissions and crews an
+ * `a2a-agent` proxy ship with the owner and only scopes the approver holds,
+ * as every approval does, keeps the credential in the vault, and writes the
+ * card's domain as the fact it checked. The agent is repeatable, A2A's
+ * default (A9). Its statement is written once its worker starts.
+ */
+export function createAddA2aAgent(deps) {
+    return async ({ actor, requestId, name, cardUrl, credential, concurrencyLimit, ownerShipId, scopes }) => {
+        if (!actor.scopes.includes(APPROVING_SCOPE)) {
+            return refuse('NOT_AN_APPROVER', `Adding an outside A2A agent needs ${APPROVING_SCOPE}`);
+        }
+        const notHeld = scopeNotHeld(actor, scopes);
+        if (notHeld !== undefined) {
+            return refuse('SCOPE_NOT_HELD', `You may grant only scopes you hold: not ${notHeld}`);
+        }
+        const { fleetId } = actor;
+        if (!(await deps.servesOutsideParties(fleetId))) {
+            return refuse('OUTSIDE_PARTIES_OFF', "This fleet's outside parties are off: turn them on first");
+        }
+        const statement = await readAgentStatement(deps, { name, cardUrl, isRepeatable: true });
+        if (!statement.isOk) {
+            return statement;
+        }
+        const granted = scopes.filter((scope) => !EVERY_APP_SHIP_SCOPES.has(scope));
+        const requestHash = deps.hasher.hash(JSON.stringify([requestId, name, cardUrl, credential, concurrencyLimit, ownerShipId, granted]));
+        return approved(deps, {
+            fleetId,
+            type: A2A_AGENT_SHIP_TYPE,
+            scopes: granted,
+            requestHash,
+            owner: ownerShipId,
+            party: ({ approvedAt }) => ({ fleetId, name, kind: 'a2aAgent', cardUrl, credential, concurrencyLimit, isRepeatable: true, ...UNCOMMISSIONED, requestId, requestHash, approvedAt }),
+            isOwn: (earlier) => earlier.kind === 'a2aAgent',
+        });
+    };
+}
+//# sourceMappingURL=add-a2a-agent.js.map

package/dist/core/parties/add-a2a-agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-a2a-agent.js","sourceRoot":"","sources":["../../../src/core/parties/add-a2a-agent.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAExE,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAG/D,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,cAAc,EAA+C,MAAM,oBAAoB,CAAC;AAiBhI;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA8D;IAC9F,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE;QACtG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,iBAAiB,EAAE,qCAAqC,eAAe,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,gBAAgB,EAAE,2CAA2C,OAAO,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAC1B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAChD,OAAO,MAAM,CAAC,qBAAqB,EAAE,0DAA0D,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YACpB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACrI,OAAO,QAAQ,CAAgB,IAAI,EAAE;YACnC,OAAO;YACP,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,OAAO;YACf,WAAW;YACX,KAAK,EAAE,WAAW;YAClB,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;YAClL,KAAK,EAAE,CAAC,OAAO,EAA4B,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU;SAC1E,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/add-a2a-client.d.ts

@@ -0,0 +1,30 @@
+import type { ShipId } from '@aeolus-fleet/common';
+import type { Actor } from '../actors/authenticate-actor.js';
+import type { OAuthSecrets } from '../oauth/ports.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import { type ApprovalDeps, type ApprovePartyRefusal } from './approve-party.js';
+import type { ShownParty } from './shown-party.js';
+export type AddA2aClientRefusal = ApprovePartyRefusal | DomainError<'NOT_AN_APPROVER' | 'SCOPE_NOT_HELD'>;
+export type AddA2aClient = (input: {
+    actor: Actor;
+    requestId: string;
+    name: string;
+    ownerShipId: ShipId;
+    scopes: readonly string[];
+}) => Promise<Result<{
+    party: ShownParty;
+    bearer: string;
+}, AddA2aClientRefusal>>;
+/**
+ * Use case: an actor holding gateway:approve adds an outside A2A client
+ * (decision 0060). An A2A client is a machine with no browser, so nobody
+ * requests it: the approver names it, its owner and its scopes, only ones
+ * it holds. The gateway commissions and crews an `a2a-client` proxy ship as
+ * every approval does, then shows a new bearer once and keeps only its
+ * hash. The same request again, after an answer that was lost, shows a new
+ * bearer in place of the first, so the approver is never left without one.
+ */
+export declare function createAddA2aClient(deps: ApprovalDeps & {
+    secrets: Pick<OAuthSecrets, 'newSecret' | 'hashOf'>;
+}): AddA2aClient;

package/dist/core/parties/add-a2a-client.js

@@ -0,0 +1,47 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+import { APPROVING_SCOPE, EVERY_APP_SHIP_SCOPES, scopeNotHeld } from './approver.js';
+import { A2A_CLIENT_SHIP_TYPE, approved, UNCOMMISSIONED } from './approve-party.js';
+/**
+ * Use case: an actor holding gateway:approve adds an outside A2A client
+ * (decision 0060). An A2A client is a machine with no browser, so nobody
+ * requests it: the approver names it, its owner and its scopes, only ones
+ * it holds. The gateway commissions and crews an `a2a-client` proxy ship as
+ * every approval does, then shows a new bearer once and keeps only its
+ * hash. The same request again, after an answer that was lost, shows a new
+ * bearer in place of the first, so the approver is never left without one.
+ */
+export function createAddA2aClient(deps) {
+    return async ({ actor, requestId, name, ownerShipId, scopes }) => {
+        if (!actor.scopes.includes(APPROVING_SCOPE)) {
+            return refuse('NOT_AN_APPROVER', `Adding an outside A2A client needs ${APPROVING_SCOPE}`);
+        }
+        const notHeld = scopeNotHeld(actor, scopes);
+        if (notHeld !== undefined) {
+            return refuse('SCOPE_NOT_HELD', `You may grant only scopes you hold: not ${notHeld}`);
+        }
+        const granted = scopes.filter((scope) => !EVERY_APP_SHIP_SCOPES.has(scope));
+        const { fleetId } = actor;
+        const requestHash = deps.hasher.hash(JSON.stringify([requestId, name, ownerShipId, granted]));
+        const party = await approved(deps, {
+            fleetId,
+            type: A2A_CLIENT_SHIP_TYPE,
+            scopes: granted,
+            requestHash,
+            owner: ownerShipId,
+            party: ({ approvedAt }) => ({ fleetId, name, kind: 'a2aClient', bearerHash: null, ...UNCOMMISSIONED, requestId, requestHash, approvedAt }),
+            isOwn: (earlier) => earlier.kind === 'a2aClient',
+        });
+        if (!party.isOk) {
+            return party;
+        }
+        const kept = await deps.parties.find(fleetId, name);
+        if (kept?.kind !== 'a2aClient') {
+            return refuse('PARTY_EXISTS', `A party named ${name} was approved already`);
+        }
+        const bearer = deps.secrets.newSecret();
+        await deps.parties.save({ ...kept, bearerHash: deps.secrets.hashOf(bearer) });
+        return ok({ party: party.value, bearer });
+    };
+}
+//# sourceMappingURL=add-a2a-client.js.map

package/dist/core/parties/add-a2a-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-a2a-client.js","sourceRoot":"","sources":["../../../src/core/parties/add-a2a-client.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,cAAc,EAA+C,MAAM,oBAAoB,CAAC;AAcjI;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAA4E;IAC7G,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE;QAC/D,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,iBAAiB,EAAE,sCAAsC,eAAe,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,gBAAgB,EAAE,2CAA2C,OAAO,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC9F,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAiB,IAAI,EAAE;YACjD,OAAO;YACP,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,OAAO;YACf,WAAW;YACX,KAAK,EAAE,WAAW;YAClB,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;YAC1I,KAAK,EAAE,CAAC,OAAO,EAA6B,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW;SAC5E,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACpD,IAAI,IAAI,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC,cAAc,EAAE,iBAAiB,IAAI,uBAAuB,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9E,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/add-client-party.d.ts

@@ -0,0 +1,38 @@
+import type { ShipId } from '@aeolus-fleet/common';
+import type { Actor } from '../actors/authenticate-actor.js';
+import type { OAuthClients, OAuthSecrets } from '../oauth/ports.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { ApproveClientParty, ApprovePartyRefusal } from './approve-party.js';
+import type { PartyStore } from './ports.js';
+import type { ShownParty } from './shown-party.js';
+export type AddClientPartyRefusal = DomainError<'NOT_AN_APPROVER' | 'SCOPE_NOT_HELD' | 'CLIENT_HAS_PARTY'> | ApprovePartyRefusal;
+/** A client party as its approver reads it once: its client id, and its secret only when this call crewed its proxy ship. */
+export interface AddedClientParty {
+    readonly party: ShownParty;
+    readonly clientId: string;
+    readonly clientSecret: string | null;
+}
+export type AddClientParty = (input: {
+    actor: Actor;
+    requestId: string;
+    name: string;
+    ownerShipId: ShipId;
+    scopes: readonly string[];
+}) => Promise<Result<AddedClientParty, AddClientPartyRefusal>>;
+/**
+ * Use case: an actor holding gateway:approve adds a client party with no
+ * human at the authorize step (vendor platforms V4): its name, its owner and
+ * scopes, only scopes it holds. The gateway commissions and crews its
+ * mcp-client proxy ship as for any client party, the same request again
+ * picking up where the last one stopped. Its OAuth client signs in by client
+ * credentials, with no redirect URI. Its secret is answered once, when this
+ * call crews the proxy ship, and kept only as its hash; a party left
+ * awaiting crew gets its secret when parties.crew crews it.
+ */
+export declare function createAddClientParty(deps: {
+    parties: Pick<PartyStore, 'find'>;
+    approveClientParty: ApproveClientParty;
+    clients: OAuthClients;
+    secrets: OAuthSecrets;
+}): AddClientParty;

package/dist/core/parties/add-client-party.js

@@ -0,0 +1,40 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+import { APPROVING_SCOPE, EVERY_APP_SHIP_SCOPES, scopeNotHeld } from './approver.js';
+/**
+ * Use case: an actor holding gateway:approve adds a client party with no
+ * human at the authorize step (vendor platforms V4): its name, its owner and
+ * scopes, only scopes it holds. The gateway commissions and crews its
+ * mcp-client proxy ship as for any client party, the same request again
+ * picking up where the last one stopped. Its OAuth client signs in by client
+ * credentials, with no redirect URI. Its secret is answered once, when this
+ * call crews the proxy ship, and kept only as its hash; a party left
+ * awaiting crew gets its secret when parties.crew crews it.
+ */
+export function createAddClientParty(deps) {
+    return async ({ actor, requestId, name, ownerShipId, scopes }) => {
+        if (!actor.scopes.includes(APPROVING_SCOPE)) {
+            return refuse('NOT_AN_APPROVER', `Adding a client party needs ${APPROVING_SCOPE}`);
+        }
+        const notHeld = scopeNotHeld(actor, scopes);
+        if (notHeld !== undefined) {
+            return refuse('SCOPE_NOT_HELD', `You may grant only scopes you hold: not ${notHeld}`);
+        }
+        const earlier = await deps.parties.find(actor.fleetId, name);
+        // The same request again keeps its client id; a new one is told apart by its request id.
+        const clientId = earlier?.kind === 'mcpClient' ? earlier.clientId : `client-${deps.secrets.newSecret()}`;
+        const granted = scopes.filter((scope) => !EVERY_APP_SHIP_SCOPES.has(scope));
+        const approved = await deps.approveClientParty({ operatorFleetId: actor.fleetId, requestId, name, clientId, ownerShipId, scopes: granted });
+        if (!approved.isOk) {
+            return approved;
+        }
+        const party = approved.value;
+        if (earlier?.state === 'crewed') {
+            return ok({ party, clientId, clientSecret: null });
+        }
+        const clientSecret = party.state === 'crewed' ? deps.secrets.newSecret() : null;
+        await deps.clients.save({ clientId, fleetId: actor.fleetId, name, redirectUris: [], secretHash: clientSecret === null ? null : deps.secrets.hashOf(clientSecret), grant: 'clientCredentials' });
+        return ok({ party, clientId, clientSecret });
+    };
+}
+//# sourceMappingURL=add-client-party.js.map

package/dist/core/parties/add-client-party.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-client-party.js","sourceRoot":"","sources":["../../../src/core/parties/add-client-party.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAerF;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAKpC;IACC,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE;QAC/D,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,iBAAiB,EAAE,+BAA+B,eAAe,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,gBAAgB,EAAE,2CAA2C,OAAO,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7D,yFAAyF;QACzF,MAAM,QAAQ,GAAG,OAAO,EAAE,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;QACzG,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5I,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;QAC7B,IAAI,OAAO,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAChF,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChM,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC;AACJ,CAAC"}