@aeolus-fleet/gateway 0.29.2 → 0.31.0

package/dist/core/mcp-out/statement.js.map

@@ -1 +1 @@
-{"version":3,"file":"statement.js","sourceRoot":"","sources":["../../../src/core/mcp-out/statement.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAgCnE,SAAS,YAAY,CAAC,IAAiB,EAAE,MAAqD;IAC5F,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1D,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5E,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/E,UAAU,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,WAAW,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5E,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;QAC5B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;KACrC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAAgH;IAC1I,OAAO;QACL,OAAO,EAAE,GAAG,KAAK,CAAC,SAAS,uMAAuM;QAClO,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;KACrI,CAAC;AACJ,CAAC"}
+{"version":3,"file":"statement.js","sourceRoot":"","sources":["../../../src/core/mcp-out/statement.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAiCnE,SAAS,YAAY,CAAC,IAAiB,EAAE,MAAqD;IAC5F,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1D,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5E,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/E,UAAU,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,WAAW,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5E,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;QAC5B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;KACrC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAAgH;IAC1I,OAAO;QACL,OAAO,EAAE,GAAG,KAAK,CAAC,SAAS,uMAAuM;QAClO,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;KACrI,CAAC;AACJ,CAAC"}

package/dist/core/meetings/change-own-mic.d.ts

@@ -0,0 +1,24 @@
+import type { MeetingId } from '@aeolus-fleet/common';
+import type { CrewPersonShip } from '../people/crew-person-ship.js';
+import { type PersonCaller, type PersonCrewError } from '../people/person-crew.js';
+import type { PersonCrews } from '../people/ports.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { OwnMicChange, PersonMeetingDoor } from './ports.js';
+export type ChangeOwnMic = (input: {
+    caller: PersonCaller;
+    meetingId: MeetingId;
+    change: OwnMicChange;
+}) => Promise<Result<undefined, PersonCrewError | DomainError<'MIC_REFUSED'>>>;
+/**
+ * Use case: a person requests a meeting's mic, withdraws their request, or
+ * releases the mic they hold, as their person ship (decision 0061, M8, M10,
+ * M19). The mic is core's state: the gateway adds no rule of its own and
+ * passes the fleet's reason on when it refuses. A request stays on the list
+ * until it is served or withdrawn, so a person who reads slowly loses no place.
+ */
+export declare function createChangeOwnMic(deps: {
+    crewPersonShip: CrewPersonShip;
+    crews: PersonCrews;
+    door: PersonMeetingDoor;
+}): ChangeOwnMic;

package/dist/core/meetings/change-own-mic.js

@@ -0,0 +1,21 @@
+import { asPersonCrew, withOwnRefusal } from '../people/person-crew.js';
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+/**
+ * Use case: a person requests a meeting's mic, withdraws their request, or
+ * releases the mic they hold, as their person ship (decision 0061, M8, M10,
+ * M19). The mic is core's state: the gateway adds no rule of its own and
+ * passes the fleet's reason on when it refuses. A request stays on the list
+ * until it is served or withdrawn, so a person who reads slowly loses no place.
+ */
+export function createChangeOwnMic(deps) {
+    return async ({ caller, meetingId, change }) => {
+        const changed = await asPersonCrew(deps, { caller, run: (crew) => withOwnRefusal(deps.door.changeMic(crew.crewToken, { meetingId, change })) });
+        if (!changed.isOk) {
+            return changed;
+        }
+        const taken = changed.value.value;
+        return taken.isOk ? ok(undefined) : refuse('MIC_REFUSED', `The fleet did not change the mic: ${taken.error.message}`);
+    };
+}
+//# sourceMappingURL=change-own-mic.js.map

package/dist/core/meetings/change-own-mic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"change-own-mic.js","sourceRoot":"","sources":["../../../src/core/meetings/change-own-mic.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,cAAc,EAA2C,MAAM,0BAA0B,CAAC;AAEjH,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAKtD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAqF;IACtH,OAAO,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE;QAC7C,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAChJ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;QAClC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,qCAAqC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACxH,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/meetings/mic-standing.d.ts

@@ -0,0 +1,18 @@
+import type { ShipId } from '@aeolus-fleet/common';
+import type { MeetingRead } from './ports.js';
+/**
+ * Where a participant stands on a meeting's mic (M7, M8): it moderates, so it
+ * contributes without the mic; it holds the mic; it waits in line, at its
+ * place counted from 1; or none of these, so it requests the mic first.
+ */
+export type MicStanding = {
+    readonly kind: 'moderating';
+} | {
+    readonly kind: 'holding';
+} | {
+    readonly kind: 'requested';
+    readonly place: number;
+} | {
+    readonly kind: 'none';
+};
+export declare function micStandingOf(meeting: MeetingRead, shipId: ShipId): MicStanding;

package/dist/core/meetings/mic-standing.js

@@ -0,0 +1,11 @@
+export function micStandingOf(meeting, shipId) {
+    if (meeting.moderator.shipId === shipId) {
+        return { kind: 'moderating' };
+    }
+    if (meeting.mic.holder?.shipId === shipId) {
+        return { kind: 'holding' };
+    }
+    const index = meeting.mic.requests.findIndex(({ ship }) => ship.shipId === shipId);
+    return index < 0 ? { kind: 'none' } : { kind: 'requested', place: index + 1 };
+}
+//# sourceMappingURL=mic-standing.js.map

package/dist/core/meetings/mic-standing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mic-standing.js","sourceRoot":"","sources":["../../../src/core/meetings/mic-standing.ts"],"names":[],"mappings":"AAWA,MAAM,UAAU,aAAa,CAAC,OAAoB,EAAE,MAAc;IAChE,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACxC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACnF,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;AAChF,CAAC"}

package/dist/core/meetings/ports.d.ts

@@ -0,0 +1,70 @@
+/**
+ * The meetings a person takes part in as their person ship (decision 0061,
+ * M19): the fleet's meeting calls the gateway makes as the ship's crew. Core
+ * holds the meeting and decides every call; the gateway reads and asks.
+ */
+import type { MeetingId, MessageId, ShipId, ShipKind, ShipStatus } from '@aeolus-fleet/common';
+import type { FleetRefusal } from '../connection/ports.js';
+import type { Result } from '../shared/result.js';
+/** A ship as a meeting names it. */
+export interface MeetingShip {
+    readonly shipId: ShipId;
+    readonly name: string;
+}
+/** Whether a participant is in the meeting now, left it keeping its right to rejoin, or was revoked by the owner (M13). */
+export type ParticipantState = 'present' | 'left' | 'revoked';
+/** A participant: who it is, whether it is crewed now (M14), and whether it is in the meeting now. */
+export interface MeetingParticipant extends MeetingShip {
+    readonly kind: ShipKind;
+    readonly status: ShipStatus;
+    readonly state: ParticipantState;
+}
+/** How the mic passes when it is free (M9): by the moderator's pick, or to the oldest request. */
+export type MicPattern = 'moderator' | 'fifo';
+/** The mic: who holds it, none while free; its pattern; and the requests, oldest first (M8). */
+export interface MeetingMic {
+    readonly holder: MeetingShip | null;
+    readonly pattern: MicPattern;
+    readonly requests: readonly {
+        readonly ship: MeetingShip;
+        readonly requestedAt: Date;
+    }[];
+}
+/** One contribution, whole. */
+export interface Contribution {
+    readonly messageId: MessageId;
+    readonly sender: MeetingShip;
+    readonly contentType: string;
+    readonly payload: string;
+    readonly sentAt: Date;
+}
+/** A meeting as the fleet reads it to a participant, with a page of its contributions, newest first. */
+export interface MeetingRead {
+    readonly meetingId: MeetingId;
+    readonly title: string | null;
+    readonly owner: MeetingShip;
+    readonly moderator: MeetingShip;
+    readonly openedAt: Date;
+    readonly endedAt: Date | null;
+    readonly participants: readonly MeetingParticipant[];
+    readonly mic: MeetingMic;
+    readonly contributions: {
+        readonly items: readonly Contribution[];
+        readonly nextCursor: MessageId | null;
+    };
+}
+/** A participant's own mic calls (M8, M10): to request it, withdraw its request, and release the mic it holds. */
+export type OwnMicChange = 'request' | 'withdraw' | 'release';
+/** Outbound port: the fleet's meeting calls as the crew of a person ship. */
+export interface PersonMeetingDoor {
+    /** The meeting and a page of its contributions after the cursor, newest first; refused for a meeting the ship takes no part in. */
+    meeting(crewToken: string, asked: {
+        meetingId: MeetingId;
+        cursor?: MessageId;
+    }): Promise<Result<MeetingRead, FleetRefusal>>;
+    /** Makes one of the ship's own mic calls; the fleet refuses one the meeting does not allow now and says why. */
+    changeMic(crewToken: string, asked: {
+        meetingId: MeetingId;
+        change: OwnMicChange;
+    }): Promise<Result<undefined, FleetRefusal>>;
+}

package/dist/core/meetings/ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/core/meetings/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../src/core/meetings/ports.ts"],"names":[],"mappings":""}

package/dist/core/meetings/read-meeting.d.ts

@@ -0,0 +1,30 @@
+import type { MeetingId, MessageId } from '@aeolus-fleet/common';
+import type { CrewPersonShip } from '../people/crew-person-ship.js';
+import { type PersonCaller, type PersonCrewError } from '../people/person-crew.js';
+import type { PersonCrews } from '../people/ports.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import { type MicStanding } from './mic-standing.js';
+import type { MeetingRead, PersonMeetingDoor } from './ports.js';
+/** A meeting as a person reads it: the fleet's read, and where they stand on its mic. */
+export interface PersonMeeting {
+    readonly meeting: MeetingRead;
+    readonly mic: MicStanding;
+}
+export type ReadMeeting = (input: {
+    caller: PersonCaller;
+    meetingId: MeetingId;
+    cursor?: MessageId;
+}) => Promise<Result<PersonMeeting, PersonCrewError | DomainError<'NO_SUCH_MEETING'>>>;
+/**
+ * Use case: a person reads a meeting they take part in, as their person ship
+ * (decision 0061, M12, M19), with a page of its contributions, newest first.
+ * The fleet decides who reads it, so its refusal is passed on in its words.
+ * Reading acknowledges nothing: a contribution waits in the inbox until the
+ * person opens it.
+ */
+export declare function createReadMeeting(deps: {
+    crewPersonShip: CrewPersonShip;
+    crews: PersonCrews;
+    door: PersonMeetingDoor;
+}): ReadMeeting;

package/dist/core/meetings/read-meeting.js

@@ -0,0 +1,26 @@
+import { asPersonCrew, withOwnRefusal } from '../people/person-crew.js';
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+import { micStandingOf } from './mic-standing.js';
+/**
+ * Use case: a person reads a meeting they take part in, as their person ship
+ * (decision 0061, M12, M19), with a page of its contributions, newest first.
+ * The fleet decides who reads it, so its refusal is passed on in its words.
+ * Reading acknowledges nothing: a contribution waits in the inbox until the
+ * person opens it.
+ */
+export function createReadMeeting(deps) {
+    return async ({ caller, meetingId, cursor }) => {
+        const asked = cursor === undefined ? { meetingId } : { meetingId, cursor };
+        const read = await asPersonCrew(deps, { caller, run: (crew) => withOwnRefusal(deps.door.meeting(crew.crewToken, asked)) });
+        if (!read.isOk) {
+            return read;
+        }
+        const meeting = read.value.value;
+        if (!meeting.isOk) {
+            return refuse('NO_SUCH_MEETING', `The fleet did not read the meeting to you: ${meeting.error.message}`);
+        }
+        return ok({ meeting: meeting.value, mic: micStandingOf(meeting.value, read.value.crew.shipId) });
+    };
+}
+//# sourceMappingURL=read-meeting.js.map

package/dist/core/meetings/read-meeting.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-meeting.js","sourceRoot":"","sources":["../../../src/core/meetings/read-meeting.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,cAAc,EAA2C,MAAM,0BAA0B,CAAC;AAEjH,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAoB,MAAM,mBAAmB,CAAC;AAWpE;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAqF;IACrH,OAAO,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE;QAC7C,MAAM,KAAK,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAC3E,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3H,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,MAAM,CAAC,iBAAiB,EAAE,8CAA8C,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/oauth/exchange-id-jag.d.ts

@@ -0,0 +1,28 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { AccountGrants, Pagasae } from '../sign-in/ports.js';
+import type { Clock } from '../shared/clock.js';
+import { type ExchangeToken } from './exchange-token.js';
+import type { IssuedTokens, OAuthClients, OAuthSecrets } from './ports.js';
+/**
+ * Use case: a registered client posts the ID-JAG its person's company
+ * identity provider issued for the gateway, with the JWT bearer grant (RFC
+ * 7523; aeolus-fleet company sign-in design, slice 6, D7, flow 3.2). The
+ * gateway federates only through pagasae (decision 0054): it hands the
+ * ID-JAG over, and pagasae answers the account's grant in its one fleet,
+ * which must be the client's. The grant is kept as after a browser sign-in,
+ * and the client gets an access token acting as the account, with no refresh
+ * token: when it ends, the client asks its identity provider for a new
+ * ID-JAG. Only a client registered for the code flow, with its secret if it
+ * has one, posts one; there is no dynamic registration.
+ */
+export declare function createExchangeIdJag(deps: {
+    clients: OAuthClients;
+    tokens: IssuedTokens;
+    secrets: OAuthSecrets;
+    clock: Clock;
+    resource: string;
+    pagasae: Pick<Pagasae, 'exchangeIdJag'>;
+    grants: Pick<AccountGrants, 'save'>;
+    /** Whether the gateway serves the fleet: connected to it, and switched on where an installation switches fleets (decision 0021). */
+    servesFleet: (fleetId: FleetId) => Promise<boolean>;
+}): ExchangeToken;

package/dist/core/oauth/exchange-id-jag.js

@@ -0,0 +1,66 @@
+import { err, ok } from '../shared/result.js';
+import { ACCESS_TOKEN_LIFETIME_MS } from './exchange-token.js';
+const MS_PER_SECOND = 1000;
+/** What a client is told when pagasae refuses its ID-JAG: the one refusal it can act on is D9's. */
+const REFUSED_ID_JAG = 'The ID-JAG was refused. ID-JAG is only available for accounts in one fleet: an account in several signs in at the gateway’s address to choose one';
+function refusal(error, description) {
+    return err({ error, description });
+}
+/**
+ * Use case: a registered client posts the ID-JAG its person's company
+ * identity provider issued for the gateway, with the JWT bearer grant (RFC
+ * 7523; aeolus-fleet company sign-in design, slice 6, D7, flow 3.2). The
+ * gateway federates only through pagasae (decision 0054): it hands the
+ * ID-JAG over, and pagasae answers the account's grant in its one fleet,
+ * which must be the client's. The grant is kept as after a browser sign-in,
+ * and the client gets an access token acting as the account, with no refresh
+ * token: when it ends, the client asks its identity provider for a new
+ * ID-JAG. Only a client registered for the code flow, with its secret if it
+ * has one, posts one; there is no dynamic registration.
+ */
+export function createExchangeIdJag(deps) {
+    return async (request) => {
+        const client = request.client_id === undefined ? undefined : await deps.clients.find(request.client_id);
+        const isAuthentic = client !== undefined && (client.secretHash === null ? request.client_secret === undefined : request.client_secret !== undefined && deps.secrets.hashOf(request.client_secret) === client.secretHash);
+        if (client === undefined || !isAuthentic) {
+            return refusal('invalid_client', 'The client could not be authenticated: an ID-JAG needs a registered client');
+        }
+        if (client.grant !== 'authorizationCode') {
+            return refusal('unauthorized_client', 'This client signs in by client credentials');
+        }
+        if (request.assertion === undefined || request.assertion === '') {
+            return refusal('invalid_request', 'The ID-JAG is required as the assertion');
+        }
+        if (request.resource !== undefined && request.resource !== deps.resource) {
+            return refusal('invalid_target', `The resource must be ${deps.resource}`);
+        }
+        const handed = await deps.pagasae.exchangeIdJag({ idJag: request.assertion, clientId: client.clientId });
+        if (!handed.isOk) {
+            return handed.error.kind === 'unavailable' ? refusal('temporarily_unavailable', 'pagasae did not answer; try again') : refusal('invalid_grant', REFUSED_ID_JAG);
+        }
+        const { fleetId, accountId, personShipId, scopes, refreshToken, accountToken, accountTokenExpiresAt } = handed.value;
+        if (fleetId !== client.fleetId || !(await deps.servesFleet(fleetId))) {
+            return refusal('invalid_grant', `The account's fleet is not ${client.name}'s`);
+        }
+        const grantId = deps.secrets.newSecret();
+        await deps.grants.save({ grantId, fleetId, accountId, personShipId, scopes, refreshToken, accountToken, accountTokenExpiresAt });
+        const accessToken = deps.secrets.newSecret();
+        const accessHash = deps.secrets.hashOf(accessToken);
+        await deps.tokens.save({
+            familyId: accessHash,
+            codeHash: null,
+            fleetId,
+            clientId: client.clientId,
+            resource: deps.resource,
+            scope: null,
+            kind: 'account',
+            grantId,
+            accessHash,
+            accessExpiresAt: new Date(deps.clock.now().getTime() + ACCESS_TOKEN_LIFETIME_MS),
+            refreshHash: null,
+            refreshExpiresAt: null,
+        });
+        return ok({ accessToken, refreshToken: null, expiresInSeconds: ACCESS_TOKEN_LIFETIME_MS / MS_PER_SECOND, scope: null });
+    };
+}
+//# sourceMappingURL=exchange-id-jag.js.map

package/dist/core/oauth/exchange-id-jag.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exchange-id-jag.js","sourceRoot":"","sources":["../../../src/core/oauth/exchange-id-jag.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAA0D,MAAM,qBAAqB,CAAC;AAGvH,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B,oGAAoG;AACpG,MAAM,cAAc,GAAG,mJAAmJ,CAAC;AAE3K,SAAS,OAAO,CAAC,KAAqB,EAAE,WAAmB;IACzD,OAAO,GAAG,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAUnC;IACC,OAAO,KAAK,EAAE,OAAqB,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxG,MAAM,WAAW,GAAG,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC,CAAC;QACzN,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC;YACzC,OAAO,OAAO,CAAC,gBAAgB,EAAE,4EAA4E,CAAC,CAAC;QACjH,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,mBAAmB,EAAE,CAAC;YACzC,OAAO,OAAO,CAAC,qBAAqB,EAAE,4CAA4C,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;YAChE,OAAO,OAAO,CAAC,iBAAiB,EAAE,yCAAyC,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzE,OAAO,OAAO,CAAC,gBAAgB,EAAE,wBAAwB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,yBAAyB,EAAE,mCAAmC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;QAClK,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;QACrH,IAAI,OAAO,KAAK,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACrE,OAAO,OAAO,CAAC,eAAe,EAAE,8BAA8B,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjI,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACrB,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,IAAI;YACd,OAAO;YACP,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,SAAS;YACf,OAAO;YACP,UAAU;YACV,eAAe,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,wBAAwB,CAAC;YAChF,WAAW,EAAE,IAAI;YACjB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE,wBAAwB,GAAG,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1H,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/oauth/exchange-token.d.ts

@@ -1,32 +1,46 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { PartyStore } from '../parties/ports.js';
 import type { Clock } from '../shared/clock.js';
 import { type Result } from '../shared/result.js';
 import type { AuthorizationCodes, IssuedTokens, OAuthClients, OAuthError, OAuthSecrets } from './ports.js';
 /** An access token works one hour; its refresh token 30 days (orchestrator-1 on aeolus-fleet#877, Q13). */
 export declare const ACCESS_TOKEN_LIFETIME_MS: number;
 export declare const REFRESH_TOKEN_LIFETIME_MS: number;
-/** The tokens a client gets. */
+/** The JWT bearer grant (RFC 7523), with which a client posts an ID-JAG. */
+export declare const JWT_BEARER_GRANT = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+/** The tokens a client gets: no refresh token for one signed in by client credentials, which asks again. */
 export interface IssuedPair {
     readonly accessToken: string;
-    readonly refreshToken: string;
+    readonly refreshToken: string | null;
     readonly expiresInSeconds: number;
     readonly scope: string | null;
 }
 /** A token request's parameters, the client's credentials among them, however it sent them. */
 export type TokenRequest = Readonly<Record<string, string | undefined>>;
 export type ExchangeToken = (request: TokenRequest) => Promise<Result<IssuedPair, OAuthError>>;
+interface ExchangeTokenDeps {
+    clients: OAuthClients;
+    codes: AuthorizationCodes;
+    tokens: IssuedTokens;
+    secrets: OAuthSecrets;
+    clock: Clock;
+    resource: string;
+    /** The parties argo's approvers added: a client signed in by client credentials is one. */
+    parties: Pick<PartyStore, 'findByClient'>;
+    /** Whether the fleet's outside parties are on (interop I-3). */
+    servesOutsideParties: (fleetId: FleetId) => Promise<boolean>;
+    /** A client's ID-JAG, the JWT bearer grant (company sign-in design, slice 6); absent where nobody signs in through pagasae. */
+    exchangeIdJag?: ExchangeToken;
+}
 /**
  * Use case: a client takes its code for tokens, or refreshes them (OAuth
  * 2.1). A confidential client proves its secret; a public one, or one known
  * by its metadata document, needs none, as PKCE binds the code to it. A code
  * is taken once: a second try revokes every token it gave. A refresh token
  * is taken once too: the pair rotates, and a rotated one coming again
- * revokes its whole family.
+ * revokes its whole family. A client party with no human at the authorize
+ * step signs in by its client credentials alone (vendor platforms V4): an
+ * access token for its party, and no refresh token, as it asks again.
  */
-export declare function createExchangeToken(deps: {
-    clients: OAuthClients;
-    codes: AuthorizationCodes;
-    tokens: IssuedTokens;
-    secrets: OAuthSecrets;
-    clock: Clock;
-    resource: string;
-}): ExchangeToken;
+export declare function createExchangeToken(deps: ExchangeTokenDeps): ExchangeToken;
+export {};

package/dist/core/oauth/exchange-token.js

@@ -3,6 +3,8 @@ import { holderOf } from './authenticate-access-token.js';
 /** An access token works one hour; its refresh token 30 days (orchestrator-1 on aeolus-fleet#877, Q13). */
 export const ACCESS_TOKEN_LIFETIME_MS = 60 * 60_000;
 export const REFRESH_TOKEN_LIFETIME_MS = 30 * 24 * 60 * 60_000;
+/** The JWT bearer grant (RFC 7523), with which a client posts an ID-JAG. */
+export const JWT_BEARER_GRANT = 'urn:ietf:params:oauth:grant-type:jwt-bearer';
 const MS_PER_SECOND = 1000;
 function refusal(error, description) {
     return err({ error, description });
@@ -13,7 +15,9 @@ function refusal(error, description) {
  * by its metadata document, needs none, as PKCE binds the code to it. A code
  * is taken once: a second try revokes every token it gave. A refresh token
  * is taken once too: the pair rotates, and a rotated one coming again
- * revokes its whole family.
+ * revokes its whole family. A client party with no human at the authorize
+ * step signs in by its client credentials alone (vendor platforms V4): an
+ * access token for its party, and no refresh token, as it asks again.
  */
 export function createExchangeToken(deps) {
     /** The client is who it says, as far as it has a secret. */
@@ -41,6 +45,43 @@ export function createExchangeToken(deps) {
         });
         return { accessToken, refreshToken, expiresInSeconds: ACCESS_TOKEN_LIFETIME_MS / MS_PER_SECOND, scope: from.scope };
     };
+    const fromClientCredentials = async (request) => {
+        const client = request.client_id === undefined ? undefined : await deps.clients.find(request.client_id);
+        const isAuthentic = client?.secretHash != null && request.client_secret !== undefined && deps.secrets.hashOf(request.client_secret) === client.secretHash;
+        if (client === undefined || !isAuthentic) {
+            return refusal('invalid_client', 'The client could not be authenticated');
+        }
+        if (client.grant !== 'clientCredentials') {
+            return refusal('unauthorized_client', 'This client signs in by authorization code');
+        }
+        const party = await deps.parties.findByClient(client.fleetId, client.clientId);
+        if (party === undefined) {
+            return refusal('invalid_client', 'The client could not be authenticated');
+        }
+        if (!(await deps.servesOutsideParties(client.fleetId))) {
+            return refusal('unauthorized_client', "This fleet's outside parties are off");
+        }
+        if (request.resource !== deps.resource) {
+            return refusal('invalid_target', `The resource must be ${deps.resource}`);
+        }
+        const accessToken = deps.secrets.newSecret();
+        const accessHash = deps.secrets.hashOf(accessToken);
+        await deps.tokens.save({
+            familyId: accessHash,
+            codeHash: null,
+            fleetId: client.fleetId,
+            clientId: client.clientId,
+            resource: deps.resource,
+            scope: null,
+            kind: 'party',
+            party: party.name,
+            accessHash,
+            accessExpiresAt: new Date(deps.clock.now().getTime() + ACCESS_TOKEN_LIFETIME_MS),
+            refreshHash: null,
+            refreshExpiresAt: null,
+        });
+        return ok({ accessToken, refreshToken: null, expiresInSeconds: ACCESS_TOKEN_LIFETIME_MS / MS_PER_SECOND, scope: null });
+    };
     const fromCode = async (request) => {
         const { code, code_verifier: verifier } = request;
         if (code === undefined || verifier === undefined) {
@@ -74,7 +115,7 @@ export function createExchangeToken(deps) {
         }
         const refreshHash = deps.secrets.hashOf(request.refresh_token);
         const pair = await deps.tokens.findByRefresh(refreshHash);
-        if (!pair || pair.clientId !== request.client_id || pair.refreshExpiresAt.getTime() <= deps.clock.now().getTime() || pair.state === 'revoked') {
+        if (!pair || pair.clientId !== request.client_id || pair.refreshExpiresAt === null || pair.refreshExpiresAt.getTime() <= deps.clock.now().getTime() || pair.state === 'revoked') {
             return refusal('invalid_grant', 'No such refresh token for this client, or it expired');
         }
         if (!(await deps.tokens.rotate(refreshHash))) {
@@ -86,8 +127,14 @@ export function createExchangeToken(deps) {
     };
     return async (request) => {
         const grantType = request.grant_type;
+        if (grantType === 'client_credentials') {
+            return fromClientCredentials(request);
+        }
+        if (grantType === JWT_BEARER_GRANT && deps.exchangeIdJag !== undefined) {
+            return deps.exchangeIdJag(request);
+        }
         if (grantType !== 'authorization_code' && grantType !== 'refresh_token') {
-            return refusal('unsupported_grant_type', 'Only authorization_code and refresh_token are served');
+            return refusal('unsupported_grant_type', 'Only authorization_code, refresh_token, client_credentials and, where people sign in, the JWT bearer grant are served');
         }
         if (!(await isAuthenticated(request))) {
             return refusal('invalid_client', 'The client could not be authenticated');

package/dist/core/oauth/exchange-token.js.map

@@ -1 +1 @@
-{"version":3,"file":"exchange-token.js","sourceRoot":"","sources":["../../../src/core/oauth/exchange-token.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAG1D,2GAA2G;AAC3G,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,MAAM,CAAC;AACpD,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAe/D,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B,SAAS,OAAO,CAAC,KAAqB,EAAE,WAAmB;IACzD,OAAO,GAAG,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAuI;IACzK,4DAA4D;IAC5D,MAAM,eAAe,GAAG,KAAK,EAAE,OAAqB,EAAoB,EAAE;QACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,IAAI,IAAI,CAAC;QAC3E,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC;QAC7C,CAAC;QACD,OAAO,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,UAAU,CAAC;IAC1G,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,KAAK,EAAE,IAA4G,EAAuB,EAAE;QACxJ,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC7C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QACvC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACrB,GAAG,IAAI;YACP,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;YAC5C,eAAe,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,wBAAwB,CAAC;YACzD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;YAC9C,gBAAgB,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,yBAAyB,CAAC;SAC5D,CAAC,CAAC;QACH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,wBAAwB,GAAG,aAAa,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IACtH,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,EAAE,OAAqB,EAA2C,EAAE;QACxF,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;QAClD,IAAI,IAAI,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjD,OAAO,OAAO,CAAC,iBAAiB,EAAE,2CAA2C,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzE,OAAO,OAAO,CAAC,gBAAgB,EAAE,wBAAwB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,OAAO,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtD,OAAO,OAAO,CAAC,eAAe,EAAE,0DAA0D,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC;QAC1B,MAAM,OAAO,GACX,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE;YACvD,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,SAAS;YACrC,MAAM,CAAC,WAAW,KAAK,OAAO,CAAC,YAAY;YAC3C,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,aAAa,CAAC;QAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,OAAO,CAAC,eAAe,EAAE,gFAAgF,CAAC,CAAC;QACpH,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QAChE,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACpH,CAAC,CAAC;IAEF,MAAM,gBAAgB,GAAG,KAAK,EAAE,OAAqB,EAA2C,EAAE;QAChG,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,OAAO,CAAC,iBAAiB,EAAE,6BAA6B,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9I,OAAO,OAAO,CAAC,eAAe,EAAE,sDAAsD,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9C,OAAO,OAAO,CAAC,eAAe,EAAE,2DAA2D,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QACxE,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACxG,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,SAAS,KAAK,oBAAoB,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;YACxE,OAAO,OAAO,CAAC,wBAAwB,EAAE,sDAAsD,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACtC,OAAO,OAAO,CAAC,gBAAgB,EAAE,uCAAuC,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,SAAS,KAAK,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5F,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"exchange-token.js","sourceRoot":"","sources":["../../../src/core/oauth/exchange-token.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAG1D,2GAA2G;AAC3G,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,MAAM,CAAC;AACpD,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAE/D,4EAA4E;AAC5E,MAAM,CAAC,MAAM,gBAAgB,GAAG,6CAA6C,CAAC;AAe9E,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B,SAAS,OAAO,CAAC,KAAqB,EAAE,WAAmB;IACzD,OAAO,GAAG,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;AACrC,CAAC;AAiBD;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,4DAA4D;IAC5D,MAAM,eAAe,GAAG,KAAK,EAAE,OAAqB,EAAoB,EAAE;QACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,IAAI,IAAI,CAAC;QAC3E,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC;QAC7C,CAAC;QACD,OAAO,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,UAAU,CAAC;IAC1G,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,KAAK,EAAE,IAA4G,EAAuB,EAAE;QACxJ,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC7C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QACvC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACrB,GAAG,IAAI;YACP,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;YAC5C,eAAe,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,wBAAwB,CAAC;YACzD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;YAC9C,gBAAgB,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,yBAAyB,CAAC;SAC5D,CAAC,CAAC;QACH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,wBAAwB,GAAG,aAAa,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IACtH,CAAC,CAAC;IAEF,MAAM,qBAAqB,GAAG,KAAK,EAAE,OAAqB,EAA2C,EAAE;QACrG,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxG,MAAM,WAAW,GAAG,MAAM,EAAE,UAAU,IAAI,IAAI,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC;QAC1J,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC;YACzC,OAAO,OAAO,CAAC,gBAAgB,EAAE,uCAAuC,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,mBAAmB,EAAE,CAAC;YACzC,OAAO,OAAO,CAAC,qBAAqB,EAAE,4CAA4C,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,OAAO,CAAC,gBAAgB,EAAE,uCAAuC,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACvD,OAAO,OAAO,CAAC,qBAAqB,EAAE,sCAAsC,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvC,OAAO,OAAO,CAAC,gBAAgB,EAAE,wBAAwB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACrB,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,KAAK,CAAC,IAAI;YACjB,UAAU;YACV,eAAe,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,wBAAwB,CAAC;YAChF,WAAW,EAAE,IAAI;YACjB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE,wBAAwB,GAAG,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1H,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,EAAE,OAAqB,EAA2C,EAAE;QACxF,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;QAClD,IAAI,IAAI,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjD,OAAO,OAAO,CAAC,iBAAiB,EAAE,2CAA2C,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzE,OAAO,OAAO,CAAC,gBAAgB,EAAE,wBAAwB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,OAAO,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtD,OAAO,OAAO,CAAC,eAAe,EAAE,0DAA0D,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC;QAC1B,MAAM,OAAO,GACX,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE;YACvD,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,SAAS;YACrC,MAAM,CAAC,WAAW,KAAK,OAAO,CAAC,YAAY;YAC3C,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,aAAa,CAAC;QAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,OAAO,CAAC,eAAe,EAAE,gFAAgF,CAAC,CAAC;QACpH,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QAChE,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACpH,CAAC,CAAC;IAEF,MAAM,gBAAgB,GAAG,KAAK,EAAE,OAAqB,EAA2C,EAAE;QAChG,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,OAAO,CAAC,iBAAiB,EAAE,6BAA6B,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChL,OAAO,OAAO,CAAC,eAAe,EAAE,sDAAsD,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9C,OAAO,OAAO,CAAC,eAAe,EAAE,2DAA2D,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QACxE,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACxG,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;YACvC,OAAO,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,SAAS,KAAK,gBAAgB,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACvE,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,SAAS,KAAK,oBAAoB,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;YACxE,OAAO,OAAO,CAAC,wBAAwB,EAAE,uHAAuH,CAAC,CAAC;QACpK,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACtC,OAAO,OAAO,CAAC,gBAAgB,EAAE,uCAAuC,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,SAAS,KAAK,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5F,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/oauth/ports.d.ts

@@ -5,13 +5,20 @@
  */
 import type { FleetId } from '@aeolus-fleet/common';
 import type { Result } from '../shared/result.js';
-/** A client argo pre-registered for its fleet. A confidential one has a secret, kept only as its hash. */
+/**
+ * How a client signs in: by a code a person's approval issued, or, with no
+ * human at the authorize step, by its own client credentials (vendor
+ * platforms V4).
+ */
+export type ClientGrant = 'authorizationCode' | 'clientCredentials';
+/** A client registered for its fleet. A confidential one has a secret, kept only as its hash. */
 export interface OAuthClient {
     readonly clientId: string;
     readonly fleetId: FleetId;
     readonly name: string;
     readonly redirectUris: readonly string[];
     readonly secretHash: string | null;
+    readonly grant: ClientGrant;
 }
 export interface OAuthClients {
     find(clientId: string): Promise<OAuthClient | undefined>;
@@ -55,18 +62,22 @@ export interface AuthorizationCodes {
         wasUsed: boolean;
     } | undefined>;
 }
-/** An access token and its refresh token, issued together; a family is every pair one code led to. */
+/**
+ * An access token and its refresh token, issued together; a family is every
+ * pair one code led to. A client signed in by client credentials gets its
+ * access token alone, from no code.
+ */
 export type TokenPair = {
     readonly familyId: string;
-    readonly codeHash: string;
+    readonly codeHash: string | null;
     readonly fleetId: FleetId;
     readonly clientId: string;
     readonly resource: string;
     readonly scope: string | null;
     readonly accessHash: string;
     readonly accessExpiresAt: Date;
-    readonly refreshHash: string;
-    readonly refreshExpiresAt: Date;
+    readonly refreshHash: string | null;
+    readonly refreshExpiresAt: Date | null;
 } & TokenHolder;
 export interface IssuedTokens {
     /** A new pair, active. */
@@ -98,7 +109,7 @@ export interface OAuthSecrets {
     challengeOf(verifier: string): string;
 }
 /** OAuth's error codes the gateway answers (RFC 6749, RFC 8707). */
-export type OAuthErrorCode = 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unsupported_grant_type' | 'unsupported_response_type' | 'invalid_target' | 'access_denied';
+export type OAuthErrorCode = 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unauthorized_client' | 'unsupported_grant_type' | 'unsupported_response_type' | 'invalid_target' | 'access_denied' | 'temporarily_unavailable';
 export interface OAuthError {
     readonly error: OAuthErrorCode;
     readonly description: string;

package/dist/core/oauth/register-client.js

@@ -13,7 +13,7 @@ export function createRegisterClient(deps) {
         }
         const clientId = `client-${deps.secrets.newSecret()}`;
         const clientSecret = isConfidential ? deps.secrets.newSecret() : null;
-        await deps.clients.save({ clientId, fleetId, name, redirectUris: [...redirectUris], secretHash: clientSecret === null ? null : deps.secrets.hashOf(clientSecret) });
+        await deps.clients.save({ clientId, fleetId, name, redirectUris: [...redirectUris], secretHash: clientSecret === null ? null : deps.secrets.hashOf(clientSecret), grant: 'authorizationCode' });
         return ok({ clientId, clientSecret });
     };
 }

package/dist/core/oauth/register-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"register-client.js","sourceRoot":"","sources":["../../../src/core/oauth/register-client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AASrE;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAsD;IACzF,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,EAAE,EAAE;QAC/D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,iBAAiB,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/G,OAAO,MAAM,CAAC,uBAAuB,EAAE,2BAA2B,MAAM,CAAC,iBAAiB,CAAC,uEAAuE,CAAC,CAAC;QACtK,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;QACtD,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACtE,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,UAAU,EAAE,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACpK,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"register-client.js","sourceRoot":"","sources":["../../../src/core/oauth/register-client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AASrE;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAsD;IACzF,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,EAAE,EAAE;QAC/D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,iBAAiB,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/G,OAAO,MAAM,CAAC,uBAAuB,EAAE,2BAA2B,MAAM,CAAC,iBAAiB,CAAC,uEAAuE,CAAC,CAAC;QACtK,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;QACtD,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACtE,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,UAAU,EAAE,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChM,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/add-a2a-agent.d.ts

@@ -0,0 +1,34 @@
+import type { ShipId } from '@aeolus-fleet/common';
+import type { Actor } from '../actors/authenticate-actor.js';
+import type { AgentCards } from '../a2a-out/ports.js';
+import type { CallTiming } from '../mcp-out/statement.js';
+import { type DomainError } from '../shared/errors.js';
+import type { Result } from '../shared/result.js';
+import type { McpServerCredential } from '../vault/credential.js';
+import { type ApprovalDeps, type ApprovePartyRefusal } from './approve-party.js';
+import type { ShownParty } from './shown-party.js';
+export type AddA2aAgentRefusal = ApprovePartyRefusal | DomainError<'NOT_AN_APPROVER' | 'SCOPE_NOT_HELD' | 'CARD_UNREACHABLE' | 'CARD_INVALID'>;
+export type AddA2aAgent = (input: {
+    actor: Actor;
+    requestId: string;
+    name: string;
+    cardUrl: string;
+    credential: McpServerCredential;
+    concurrencyLimit: number;
+    ownerShipId: ShipId;
+    scopes: readonly string[];
+}) => Promise<Result<ShownParty, AddA2aAgentRefusal>>;
+/**
+ * Use case: an actor holding gateway:approve adds an outside A2A agent by
+ * its card address (slice 5). The gateway reads the card first: one that
+ * does not answer, is no AgentCard or makes no valid statement is not
+ * added, and nothing is commissioned. Then it commissions and crews an
+ * `a2a-agent` proxy ship with the owner and only scopes the approver holds,
+ * as every approval does, keeps the credential in the vault, and writes the
+ * card's domain as the fact it checked. The agent is repeatable, A2A's
+ * default (A9). Its statement is written once its worker starts.
+ */
+export declare function createAddA2aAgent(deps: ApprovalDeps & {
+    cards: AgentCards;
+    timing: CallTiming;
+}): AddA2aAgent;