@aeolus-fleet/gateway 0.29.2 → 0.31.0

package/dist/core/parties/add-a2a-agent.js

@@ -0,0 +1,45 @@
+import { readAgentStatement } from '../a2a-out/read-agent-statement.js';
+import { refuse } from '../shared/errors.js';
+import { APPROVING_SCOPE, EVERY_APP_SHIP_SCOPES, scopeNotHeld } from './approver.js';
+import { A2A_AGENT_SHIP_TYPE, approved, UNCOMMISSIONED } from './approve-party.js';
+/**
+ * Use case: an actor holding gateway:approve adds an outside A2A agent by
+ * its card address (slice 5). The gateway reads the card first: one that
+ * does not answer, is no AgentCard or makes no valid statement is not
+ * added, and nothing is commissioned. Then it commissions and crews an
+ * `a2a-agent` proxy ship with the owner and only scopes the approver holds,
+ * as every approval does, keeps the credential in the vault, and writes the
+ * card's domain as the fact it checked. The agent is repeatable, A2A's
+ * default (A9). Its statement is written once its worker starts.
+ */
+export function createAddA2aAgent(deps) {
+    return async ({ actor, requestId, name, cardUrl, credential, concurrencyLimit, ownerShipId, scopes }) => {
+        if (!actor.scopes.includes(APPROVING_SCOPE)) {
+            return refuse('NOT_AN_APPROVER', `Adding an outside A2A agent needs ${APPROVING_SCOPE}`);
+        }
+        const notHeld = scopeNotHeld(actor, scopes);
+        if (notHeld !== undefined) {
+            return refuse('SCOPE_NOT_HELD', `You may grant only scopes you hold: not ${notHeld}`);
+        }
+        const { fleetId } = actor;
+        if (!(await deps.servesOutsideParties(fleetId))) {
+            return refuse('OUTSIDE_PARTIES_OFF', "This fleet's outside parties are off: turn them on first");
+        }
+        const statement = await readAgentStatement(deps, { name, cardUrl, isRepeatable: true });
+        if (!statement.isOk) {
+            return statement;
+        }
+        const granted = scopes.filter((scope) => !EVERY_APP_SHIP_SCOPES.has(scope));
+        const requestHash = deps.hasher.hash(JSON.stringify([requestId, name, cardUrl, credential, concurrencyLimit, ownerShipId, granted]));
+        return approved(deps, {
+            fleetId,
+            type: A2A_AGENT_SHIP_TYPE,
+            scopes: granted,
+            requestHash,
+            owner: ownerShipId,
+            party: ({ approvedAt }) => ({ fleetId, name, kind: 'a2aAgent', cardUrl, credential, concurrencyLimit, isRepeatable: true, ...UNCOMMISSIONED, requestId, requestHash, approvedAt }),
+            isOwn: (earlier) => earlier.kind === 'a2aAgent',
+        });
+    };
+}
+//# sourceMappingURL=add-a2a-agent.js.map

package/dist/core/parties/add-a2a-agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-a2a-agent.js","sourceRoot":"","sources":["../../../src/core/parties/add-a2a-agent.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAExE,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAG/D,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,cAAc,EAA+C,MAAM,oBAAoB,CAAC;AAiBhI;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA8D;IAC9F,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE;QACtG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,iBAAiB,EAAE,qCAAqC,eAAe,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,gBAAgB,EAAE,2CAA2C,OAAO,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAC1B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAChD,OAAO,MAAM,CAAC,qBAAqB,EAAE,0DAA0D,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YACpB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACrI,OAAO,QAAQ,CAAgB,IAAI,EAAE;YACnC,OAAO;YACP,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,OAAO;YACf,WAAW;YACX,KAAK,EAAE,WAAW;YAClB,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;YAClL,KAAK,EAAE,CAAC,OAAO,EAA4B,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU;SAC1E,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/add-a2a-client.d.ts

@@ -0,0 +1,30 @@
+import type { ShipId } from '@aeolus-fleet/common';
+import type { Actor } from '../actors/authenticate-actor.js';
+import type { OAuthSecrets } from '../oauth/ports.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import { type ApprovalDeps, type ApprovePartyRefusal } from './approve-party.js';
+import type { ShownParty } from './shown-party.js';
+export type AddA2aClientRefusal = ApprovePartyRefusal | DomainError<'NOT_AN_APPROVER' | 'SCOPE_NOT_HELD'>;
+export type AddA2aClient = (input: {
+    actor: Actor;
+    requestId: string;
+    name: string;
+    ownerShipId: ShipId;
+    scopes: readonly string[];
+}) => Promise<Result<{
+    party: ShownParty;
+    bearer: string;
+}, AddA2aClientRefusal>>;
+/**
+ * Use case: an actor holding gateway:approve adds an outside A2A client
+ * (decision 0060). An A2A client is a machine with no browser, so nobody
+ * requests it: the approver names it, its owner and its scopes, only ones
+ * it holds. The gateway commissions and crews an `a2a-client` proxy ship as
+ * every approval does, then shows a new bearer once and keeps only its
+ * hash. The same request again, after an answer that was lost, shows a new
+ * bearer in place of the first, so the approver is never left without one.
+ */
+export declare function createAddA2aClient(deps: ApprovalDeps & {
+    secrets: Pick<OAuthSecrets, 'newSecret' | 'hashOf'>;
+}): AddA2aClient;

package/dist/core/parties/add-a2a-client.js

@@ -0,0 +1,47 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+import { APPROVING_SCOPE, EVERY_APP_SHIP_SCOPES, scopeNotHeld } from './approver.js';
+import { A2A_CLIENT_SHIP_TYPE, approved, UNCOMMISSIONED } from './approve-party.js';
+/**
+ * Use case: an actor holding gateway:approve adds an outside A2A client
+ * (decision 0060). An A2A client is a machine with no browser, so nobody
+ * requests it: the approver names it, its owner and its scopes, only ones
+ * it holds. The gateway commissions and crews an `a2a-client` proxy ship as
+ * every approval does, then shows a new bearer once and keeps only its
+ * hash. The same request again, after an answer that was lost, shows a new
+ * bearer in place of the first, so the approver is never left without one.
+ */
+export function createAddA2aClient(deps) {
+    return async ({ actor, requestId, name, ownerShipId, scopes }) => {
+        if (!actor.scopes.includes(APPROVING_SCOPE)) {
+            return refuse('NOT_AN_APPROVER', `Adding an outside A2A client needs ${APPROVING_SCOPE}`);
+        }
+        const notHeld = scopeNotHeld(actor, scopes);
+        if (notHeld !== undefined) {
+            return refuse('SCOPE_NOT_HELD', `You may grant only scopes you hold: not ${notHeld}`);
+        }
+        const granted = scopes.filter((scope) => !EVERY_APP_SHIP_SCOPES.has(scope));
+        const { fleetId } = actor;
+        const requestHash = deps.hasher.hash(JSON.stringify([requestId, name, ownerShipId, granted]));
+        const party = await approved(deps, {
+            fleetId,
+            type: A2A_CLIENT_SHIP_TYPE,
+            scopes: granted,
+            requestHash,
+            owner: ownerShipId,
+            party: ({ approvedAt }) => ({ fleetId, name, kind: 'a2aClient', bearerHash: null, ...UNCOMMISSIONED, requestId, requestHash, approvedAt }),
+            isOwn: (earlier) => earlier.kind === 'a2aClient',
+        });
+        if (!party.isOk) {
+            return party;
+        }
+        const kept = await deps.parties.find(fleetId, name);
+        if (kept?.kind !== 'a2aClient') {
+            return refuse('PARTY_EXISTS', `A party named ${name} was approved already`);
+        }
+        const bearer = deps.secrets.newSecret();
+        await deps.parties.save({ ...kept, bearerHash: deps.secrets.hashOf(bearer) });
+        return ok({ party: party.value, bearer });
+    };
+}
+//# sourceMappingURL=add-a2a-client.js.map

package/dist/core/parties/add-a2a-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-a2a-client.js","sourceRoot":"","sources":["../../../src/core/parties/add-a2a-client.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,cAAc,EAA+C,MAAM,oBAAoB,CAAC;AAcjI;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAA4E;IAC7G,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE;QAC/D,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,iBAAiB,EAAE,sCAAsC,eAAe,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,gBAAgB,EAAE,2CAA2C,OAAO,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC9F,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAiB,IAAI,EAAE;YACjD,OAAO;YACP,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,OAAO;YACf,WAAW;YACX,KAAK,EAAE,WAAW;YAClB,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;YAC1I,KAAK,EAAE,CAAC,OAAO,EAA6B,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW;SAC5E,CAAC,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACpD,IAAI,IAAI,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC,cAAc,EAAE,iBAAiB,IAAI,uBAAuB,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC9E,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/add-client-party.d.ts

@@ -0,0 +1,38 @@
+import type { ShipId } from '@aeolus-fleet/common';
+import type { Actor } from '../actors/authenticate-actor.js';
+import type { OAuthClients, OAuthSecrets } from '../oauth/ports.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { ApproveClientParty, ApprovePartyRefusal } from './approve-party.js';
+import type { PartyStore } from './ports.js';
+import type { ShownParty } from './shown-party.js';
+export type AddClientPartyRefusal = DomainError<'NOT_AN_APPROVER' | 'SCOPE_NOT_HELD' | 'CLIENT_HAS_PARTY'> | ApprovePartyRefusal;
+/** A client party as its approver reads it once: its client id, and its secret only when this call crewed its proxy ship. */
+export interface AddedClientParty {
+    readonly party: ShownParty;
+    readonly clientId: string;
+    readonly clientSecret: string | null;
+}
+export type AddClientParty = (input: {
+    actor: Actor;
+    requestId: string;
+    name: string;
+    ownerShipId: ShipId;
+    scopes: readonly string[];
+}) => Promise<Result<AddedClientParty, AddClientPartyRefusal>>;
+/**
+ * Use case: an actor holding gateway:approve adds a client party with no
+ * human at the authorize step (vendor platforms V4): its name, its owner and
+ * scopes, only scopes it holds. The gateway commissions and crews its
+ * mcp-client proxy ship as for any client party, the same request again
+ * picking up where the last one stopped. Its OAuth client signs in by client
+ * credentials, with no redirect URI. Its secret is answered once, when this
+ * call crews the proxy ship, and kept only as its hash; a party left
+ * awaiting crew gets its secret when parties.crew crews it.
+ */
+export declare function createAddClientParty(deps: {
+    parties: Pick<PartyStore, 'find'>;
+    approveClientParty: ApproveClientParty;
+    clients: OAuthClients;
+    secrets: OAuthSecrets;
+}): AddClientParty;

package/dist/core/parties/add-client-party.js

@@ -0,0 +1,40 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+import { APPROVING_SCOPE, EVERY_APP_SHIP_SCOPES, scopeNotHeld } from './approver.js';
+/**
+ * Use case: an actor holding gateway:approve adds a client party with no
+ * human at the authorize step (vendor platforms V4): its name, its owner and
+ * scopes, only scopes it holds. The gateway commissions and crews its
+ * mcp-client proxy ship as for any client party, the same request again
+ * picking up where the last one stopped. Its OAuth client signs in by client
+ * credentials, with no redirect URI. Its secret is answered once, when this
+ * call crews the proxy ship, and kept only as its hash; a party left
+ * awaiting crew gets its secret when parties.crew crews it.
+ */
+export function createAddClientParty(deps) {
+    return async ({ actor, requestId, name, ownerShipId, scopes }) => {
+        if (!actor.scopes.includes(APPROVING_SCOPE)) {
+            return refuse('NOT_AN_APPROVER', `Adding a client party needs ${APPROVING_SCOPE}`);
+        }
+        const notHeld = scopeNotHeld(actor, scopes);
+        if (notHeld !== undefined) {
+            return refuse('SCOPE_NOT_HELD', `You may grant only scopes you hold: not ${notHeld}`);
+        }
+        const earlier = await deps.parties.find(actor.fleetId, name);
+        // The same request again keeps its client id; a new one is told apart by its request id.
+        const clientId = earlier?.kind === 'mcpClient' ? earlier.clientId : `client-${deps.secrets.newSecret()}`;
+        const granted = scopes.filter((scope) => !EVERY_APP_SHIP_SCOPES.has(scope));
+        const approved = await deps.approveClientParty({ operatorFleetId: actor.fleetId, requestId, name, clientId, ownerShipId, scopes: granted });
+        if (!approved.isOk) {
+            return approved;
+        }
+        const party = approved.value;
+        if (earlier?.state === 'crewed') {
+            return ok({ party, clientId, clientSecret: null });
+        }
+        const clientSecret = party.state === 'crewed' ? deps.secrets.newSecret() : null;
+        await deps.clients.save({ clientId, fleetId: actor.fleetId, name, redirectUris: [], secretHash: clientSecret === null ? null : deps.secrets.hashOf(clientSecret), grant: 'clientCredentials' });
+        return ok({ party, clientId, clientSecret });
+    };
+}
+//# sourceMappingURL=add-client-party.js.map

package/dist/core/parties/add-client-party.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-client-party.js","sourceRoot":"","sources":["../../../src/core/parties/add-client-party.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAerF;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAKpC;IACC,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE;QAC/D,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,iBAAiB,EAAE,+BAA+B,eAAe,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,gBAAgB,EAAE,2CAA2C,OAAO,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC7D,yFAAyF;QACzF,MAAM,QAAQ,GAAG,OAAO,EAAE,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;QACzG,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5I,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;QAC7B,IAAI,OAAO,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAChF,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAChM,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/approve-party.d.ts

@@ -5,12 +5,18 @@ import type { Clock } from '../shared/clock.js';
 import { type DomainError } from '../shared/errors.js';
 import { type Result } from '../shared/result.js';
 import type { McpServerCredential } from '../vault/credential.js';
+import { type Party } from './party.js';
 import type { PartyStore, ProxyShipDoor } from './ports.js';
 import { type ShownParty } from './shown-party.js';
+import type { ToolSwitches } from './tool-switches.js';
 /** The type of every outside MCP server's proxy ship. */
 export declare const MCP_SERVER_SHIP_TYPE = "mcp-server";
 /** The type of every outside MCP client's proxy ship. */
 export declare const MCP_CLIENT_SHIP_TYPE = "mcp-client";
+/** The type of every outside A2A client's proxy ship (decision 0060). */
+export declare const A2A_CLIENT_SHIP_TYPE = "a2a-client";
+/** The type of every outside A2A agent's proxy ship (slice 5). */
+export declare const A2A_AGENT_SHIP_TYPE = "a2a-agent";
 export type ApprovePartyRefusal = DomainError<'OUTSIDE_PARTIES_OFF' | 'NOT_CONNECTED' | 'PARTY_EXISTS' | 'COMMISSION_REFUSED' | 'FLEET_UNAVAILABLE'>;
 export type ApproveParty = (input: {
     operatorFleetId: FleetId;
@@ -22,6 +28,8 @@ export type ApproveParty = (input: {
     /** The scopes granted its proxy ship beside the ones every app ship gets (decision 0046). */
     scopes: readonly string[];
     concurrencyLimit: number;
+    /** The tools the approver switched on and off; none chosen means every tool the server lists at its first statement is on. */
+    toolSwitches: ToolSwitches | null;
 }) => Promise<Result<ShownParty, ApprovePartyRefusal>>;
 export type ApproveClientParty = (input: {
     operatorFleetId: FleetId;
@@ -31,7 +39,7 @@ export type ApproveClientParty = (input: {
     ownerShipId: ShipId;
     scopes: readonly string[];
 }) => Promise<Result<ShownParty, ApprovePartyRefusal | DomainError<'CLIENT_HAS_PARTY'>>>;
-interface ApprovalDeps {
+export interface ApprovalDeps {
     connections: ConnectionStore;
     parties: PartyStore;
     door: ProxyShipDoor;
@@ -40,6 +48,40 @@ interface ApprovalDeps {
     servesOutsideParties: (fleetId: FleetId) => Promise<boolean>;
     clock: Clock;
 }
+/** What one approval asks for: the party it keeps, as it is before its proxy ship is commissioned, under its request's hash. */
+export interface Approval<P extends Party> {
+    fleetId: FleetId;
+    type: string;
+    /** The owner the approver picked: named at the commission, then the fleet's alone (decision 0056). */
+    owner: ShipId;
+    scopes: readonly string[];
+    requestHash: string;
+    party: (fields: {
+        approvedAt: Date;
+    }) => P;
+    /** Whether a party kept under the name is this approval's own kind, so a repeat finds it. */
+    isOwn: (earlier: Party) => earlier is P;
+}
+/**
+ * The approval flow every party shares (interop I-5). The gateway, as its
+ * own ship, commissions the party's app proxy ship owned by the owner argo
+ * picked (decisions 0044, 0045), under argo's request id as the idempotency
+ * key, then crews it with its secret and keeps the crew token. Each step is
+ * kept before the next, so the same approval again picks up where a crash or
+ * a fleet that did not answer left it, and commissions no second ship. A
+ * commission the fleet stored but whose answer was lost leaves the ship
+ * awaiting crew: its secret was shown once. A refused commission keeps
+ * nothing, so argo may approve again. While the fleet's outside parties are
+ * off, nothing is approved (interop I-3).
+ */
+export declare function approved<P extends Party>(deps: ApprovalDeps, approval: Approval<P>): Promise<Result<ShownParty, ApprovePartyRefusal>>;
+/** What a party is before its proxy ship is commissioned. */
+export declare const UNCOMMISSIONED: {
+    readonly state: "commissioning";
+    readonly proxyShipId: null;
+    readonly secret: null;
+    readonly crewToken: null;
+};
 /**
  * Use case: argo approves an outside MCP server as a party of its fleet: the
  * gateway commissions and crews its proxy ship, and keeps the server's
@@ -52,4 +94,3 @@ export declare function createApproveParty(deps: ApprovalDeps): ApproveParty;
  * the client then calls the fleet as. One party per client in a fleet.
  */
 export declare function createApproveClientParty(deps: ApprovalDeps): ApproveClientParty;
-export {};

package/dist/core/parties/approve-party.js

@@ -6,6 +6,10 @@ import { shownPartyOf } from './shown-party.js';
 export const MCP_SERVER_SHIP_TYPE = 'mcp-server';
 /** The type of every outside MCP client's proxy ship. */
 export const MCP_CLIENT_SHIP_TYPE = 'mcp-client';
+/** The type of every outside A2A client's proxy ship (decision 0060). */
+export const A2A_CLIENT_SHIP_TYPE = 'a2a-client';
+/** The type of every outside A2A agent's proxy ship (slice 5). */
+export const A2A_AGENT_SHIP_TYPE = 'a2a-agent';
 /**
  * The approval flow every party shares (interop I-5). The gateway, as its
  * own ship, commissions the party's app proxy ship owned by the owner argo
@@ -18,7 +22,7 @@ export const MCP_CLIENT_SHIP_TYPE = 'mcp-client';
  * nothing, so argo may approve again. While the fleet's outside parties are
  * off, nothing is approved (interop I-3).
  */
-async function approved(deps, approval) {
+export async function approved(deps, approval) {
     /**
      * The crewed party, once the gateway wrote what it checked about it
      * (decision 0059). A fact the fleet refuses takes nothing from the
@@ -79,7 +83,7 @@ async function approved(deps, approval) {
     return secret === null ? ok(shownPartyOf(awaiting)) : crewed({ ...awaiting, proxyShipId: shipId, secret }, gateway.crewToken);
 }
 /** What a party is before its proxy ship is commissioned. */
-const UNCOMMISSIONED = { state: 'commissioning', proxyShipId: null, secret: null, crewToken: null };
+export const UNCOMMISSIONED = { state: 'commissioning', proxyShipId: null, secret: null, crewToken: null };
 /**
  * Use case: argo approves an outside MCP server as a party of its fleet: the
  * gateway commissions and crews its proxy ship, and keeps the server's
@@ -87,15 +91,15 @@ const UNCOMMISSIONED = { state: 'commissioning', proxyShipId: null, secret: null
  */
 export function createApproveParty(deps) {
     return (input) => {
-        const { operatorFleetId: fleetId, requestId, name, url, credential, ownerShipId, scopes, concurrencyLimit } = input;
-        const requestHash = deps.hasher.hash(JSON.stringify([requestId, name, url, credential, ownerShipId, scopes, concurrencyLimit]));
+        const { operatorFleetId: fleetId, requestId, name, url, credential, ownerShipId, scopes, concurrencyLimit, toolSwitches } = input;
+        const requestHash = deps.hasher.hash(JSON.stringify([requestId, name, url, credential, ownerShipId, scopes, concurrencyLimit, toolSwitches === null ? null : [...toolSwitches]]));
         return approved(deps, {
             fleetId,
             type: MCP_SERVER_SHIP_TYPE,
             scopes,
             requestHash,
             owner: ownerShipId,
-            party: ({ approvedAt }) => ({ fleetId, name, kind: 'mcpServer', url, credential, concurrencyLimit, ...UNCOMMISSIONED, requestId, requestHash, approvedAt }),
+            party: ({ approvedAt }) => ({ fleetId, name, kind: 'mcpServer', url, credential, concurrencyLimit, toolSwitches, ...UNCOMMISSIONED, requestId, requestHash, approvedAt }),
             isOwn: (earlier) => earlier.kind === 'mcpServer',
         });
     };

package/dist/core/parties/approve-party.js.map

@@ -1 +1 @@
-{"version":3,"file":"approve-party.js","sourceRoot":"","sources":["../../../src/core/parties/approve-party.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAwD,MAAM,YAAY,CAAC;AAEnG,OAAO,EAAE,YAAY,EAAmB,MAAM,kBAAkB,CAAC;AAEjE,yDAAyD;AACzD,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAEjD,yDAAyD;AACzD,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAgDjD;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,QAAQ,CAAkB,IAAkB,EAAE,QAAqB;IAChF;;;;;OAKG;IACH,MAAM,QAAQ,GAAG,KAAK,EAAE,KAAQ,EAAE,gBAAwB,EAAoD,EAAE;QAC9G,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,EAAE,KAAkD,EAAE,gBAAwB,EAAoD,EAAE;QACtJ,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACjG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC,mBAAmB,EAAE,0DAA0D,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3H,CAAC;QACD,MAAM,IAAI,GAAM,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACnG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,OAAO,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC1C,CAAC,CAAC;IAEF,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;IAC7B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,qBAAqB,EAAE,0DAA0D,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,eAAe,EAAE,uEAAuE,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7D,IAAI,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1F,OAAO,MAAM,CAAC,cAAc,EAAE,iBAAiB,KAAK,CAAC,IAAI,uBAAuB,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,KAAK,GAAM,OAAO,IAAI,KAAK,CAAC;IAClC,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACxD,OAAO,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAE/B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,cAAc,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACtM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACvB,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAC9C,OAAO,MAAM,CAAC,mBAAmB,EAAE,4CAA4C,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC,oBAAoB,EAAE,qCAAqC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC;IAC9C,MAAM,QAAQ,GAAM,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACrF,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClC,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;AAChI,CAAC;AAED,6DAA6D;AAC7D,MAAM,cAAc,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAW,CAAC;AAE7G;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAkB;IACnD,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC;QACpH,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;QAChI,OAAO,QAAQ,CAAiB,IAAI,EAAE;YACpC,OAAO;YACP,IAAI,EAAE,oBAAoB;YAC1B,MAAM;YACN,WAAW;YACX,KAAK,EAAE,WAAW;YAClB,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,gBAAgB,EAAE,GAAG,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;YAC3J,KAAK,EAAE,CAAC,OAAO,EAA6B,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW;SAC5E,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAkB;IACzD,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;QAC3F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC,kBAAkB,EAAE,4BAA4B,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACvG,OAAO,QAAQ,CAAiB,IAAI,EAAE;YACpC,OAAO;YACP,IAAI,EAAE,oBAAoB;YAC1B,MAAM;YACN,WAAW;YACX,KAAK,EAAE,WAAW;YAClB,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;YAClI,KAAK,EAAE,CAAC,OAAO,EAA6B,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW;SAC5E,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"approve-party.js","sourceRoot":"","sources":["../../../src/core/parties/approve-party.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAwD,MAAM,YAAY,CAAC;AAEnG,OAAO,EAAE,YAAY,EAAmB,MAAM,kBAAkB,CAAC;AAGjE,yDAAyD;AACzD,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAEjD,yDAAyD;AACzD,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAEjD,yEAAyE;AACzE,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAEjD,kEAAkE;AAClE,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAkD/C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAkB,IAAkB,EAAE,QAAqB;IACvF;;;;;OAKG;IACH,MAAM,QAAQ,GAAG,KAAK,EAAE,KAAQ,EAAE,gBAAwB,EAAoD,EAAE;QAC9G,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,EAAE,KAAkD,EAAE,gBAAwB,EAAoD,EAAE;QACtJ,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACjG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC,mBAAmB,EAAE,0DAA0D,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3H,CAAC;QACD,MAAM,IAAI,GAAM,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACnG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,OAAO,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC1C,CAAC,CAAC;IAEF,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;IAC7B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,qBAAqB,EAAE,0DAA0D,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,eAAe,EAAE,uEAAuE,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7D,IAAI,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1F,OAAO,MAAM,CAAC,cAAc,EAAE,iBAAiB,KAAK,CAAC,IAAI,uBAAuB,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,KAAK,GAAM,OAAO,IAAI,KAAK,CAAC;IAClC,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACxD,OAAO,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAE/B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,cAAc,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACtM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACvB,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAC9C,OAAO,MAAM,CAAC,mBAAmB,EAAE,4CAA4C,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC,oBAAoB,EAAE,qCAAqC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC;IAC9C,MAAM,QAAQ,GAAM,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACrF,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClC,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;AAChI,CAAC;AAED,6DAA6D;AAC7D,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAW,CAAC;AAEpH;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAkB;IACnD,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;QAClI,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,EAAE,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;QAClL,OAAO,QAAQ,CAAiB,IAAI,EAAE;YACpC,OAAO;YACP,IAAI,EAAE,oBAAoB;YAC1B,MAAM;YACN,WAAW;YACX,KAAK,EAAE,WAAW;YAClB,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,gBAAgB,EAAE,YAAY,EAAE,GAAG,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;YACzK,KAAK,EAAE,CAAC,OAAO,EAA6B,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW;SAC5E,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAkB;IACzD,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;QAC3F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC,kBAAkB,EAAE,4BAA4B,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACvG,OAAO,QAAQ,CAAiB,IAAI,EAAE;YACpC,OAAO;YACP,IAAI,EAAE,oBAAoB;YAC1B,MAAM;YACN,WAAW;YACX,KAAK,EAAE,WAAW;YAClB,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;YAClI,KAAK,EAAE,CAAC,OAAO,EAA6B,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW;SAC5E,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/approver.d.ts

@@ -0,0 +1,7 @@
+import type { Actor } from '../actors/authenticate-actor.js';
+/** The scope the gateway declares for approving outside parties (decision 0056). */
+export declare const APPROVING_SCOPE = "gateway:approve";
+/** The scopes every app ship gets (decision 0046), so an approver need not hold them to grant them. */
+export declare const EVERY_APP_SHIP_SCOPES: ReadonlySet<string>;
+/** The first scope an approver grants a party but does not hold itself, if any: an approver grants only scopes it holds. */
+export declare function scopeNotHeld(approver: Actor, scopes: readonly string[]): string | undefined;

package/dist/core/parties/approver.js

@@ -0,0 +1,9 @@
+/** The scope the gateway declares for approving outside parties (decision 0056). */
+export const APPROVING_SCOPE = 'gateway:approve';
+/** The scopes every app ship gets (decision 0046), so an approver need not hold them to grant them. */
+export const EVERY_APP_SHIP_SCOPES = new Set(['messages:send', 'messages:receive']);
+/** The first scope an approver grants a party but does not hold itself, if any: an approver grants only scopes it holds. */
+export function scopeNotHeld(approver, scopes) {
+    return scopes.find((scope) => !EVERY_APP_SHIP_SCOPES.has(scope) && !approver.scopes.includes(scope));
+}
+//# sourceMappingURL=approver.js.map

package/dist/core/parties/approver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approver.js","sourceRoot":"","sources":["../../../src/core/parties/approver.ts"],"names":[],"mappings":"AAEA,oFAAoF;AACpF,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAEjD,uGAAuG;AACvG,MAAM,CAAC,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAEzG,4HAA4H;AAC5H,MAAM,UAAU,YAAY,CAAC,QAAe,EAAE,MAAyB;IACrE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACvG,CAAC"}

package/dist/core/parties/check-server.d.ts

@@ -2,10 +2,11 @@ import type { FleetId } from '@aeolus-fleet/common';
 import type { McpServerConnection, McpServers } from '../mcp-out/ports.js';
 import { type DomainError } from '../shared/errors.js';
 import { type Result } from '../shared/result.js';
-/** A tool as the check shows it: its name, and its short description when the server gives one. */
+/** A tool as the check shows it: its name, its short description when the server gives one, and whether the server says it reads only. */
 export interface CheckedTool {
     name: string;
     description?: string;
+    isReadOnly: boolean;
 }
 export type CheckServer = (input: {
     fleetId: FleetId;

package/dist/core/parties/check-server.js

@@ -15,7 +15,7 @@ export function createCheckServer(deps) {
         if (!listed.isOk) {
             return refuse('SERVER_UNREACHABLE', `The MCP server could not be listed: ${listed.error.reason}`);
         }
-        return ok({ tools: listed.value.map(({ name, description }) => ({ name, ...(description === undefined ? {} : { description }) })) });
+        return ok({ tools: listed.value.map(({ name, description, annotations }) => ({ name, ...(description === undefined ? {} : { description }), isReadOnly: annotations?.readOnlyHint === true })) });
     };
 }
 //# sourceMappingURL=check-server.js.map

package/dist/core/parties/check-server.js.map

@@ -1 +1 @@
-{"version":3,"file":"check-server.js","sourceRoot":"","sources":["../../../src/core/parties/check-server.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAUtD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA2F;IAC3H,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE;QAC5C,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAChD,OAAO,MAAM,CAAC,qBAAqB,EAAE,0DAA0D,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,oBAAoB,EAAE,uCAAuC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACvI,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"check-server.js","sourceRoot":"","sources":["../../../src/core/parties/check-server.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAWtD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA2F;IAC3H,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,EAAE;QAC5C,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAChD,OAAO,MAAM,CAAC,qBAAqB,EAAE,0DAA0D,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,oBAAoB,EAAE,uCAAuC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACpM,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/crew-party.d.ts

@@ -1,21 +1,35 @@
 import type { FleetId } from '@aeolus-fleet/common';
+import type { FleetDoor } from '../connection/ports.js';
+import type { IssuedTokens, OAuthClients, OAuthSecrets } from '../oauth/ports.js';
 import { type DomainError } from '../shared/errors.js';
 import { type Result } from '../shared/result.js';
 import { type ShownParty } from './shown-party.js';
 import type { PartyStore, ProxyShipDoor } from './ports.js';
+/** A party crewed again, with its new client secret, answered once, where its client signs in by client credentials. */
+export interface CrewedParty {
+    readonly party: ShownParty;
+    readonly clientSecret: string | null;
+}
 export type CrewParty = (input: {
     operatorFleetId: FleetId;
     name: string;
     secret: string;
-}) => Promise<Result<ShownParty, DomainError<'NO_SUCH_PARTY' | 'NOT_AWAITING_CREW' | 'SECRET_REFUSED'>>>;
+}) => Promise<Result<CrewedParty, DomainError<'NO_SUCH_PARTY' | 'NOT_AWAITING_CREW' | 'SECRET_REFUSED' | 'FLEET_UNAVAILABLE'>>>;
 /**
  * Use case: argo hands over a new secret for a party's proxy ship that awaits
  * crew, taken from a new starting prompt in the console: the commission's
  * answer was lost, and its secret with it, and the gateway's ship may not ask
- * for a new one (orchestrator-1 on aeolus-fleet#876, Q6). The gateway crews
- * the ship with it and keeps the crew token; the secret is never kept.
+ * for a new one (orchestrator-1 on aeolus-fleet#876, Q6); or its crew was
+ * released, which the fleet tells by no longer taking the party's crew token
+ * (vendor platforms V8). The gateway crews the same ship with it and keeps
+ * the crew token; the secret is never kept. A client that signs in by client
+ * credentials gets a new client secret, answered once, in place of the old
+ * one, and the tokens the old one gave are revoked.
  */
 export declare function createCrewParty(deps: {
     parties: PartyStore;
-    door: ProxyShipDoor;
+    door: ProxyShipDoor & Pick<FleetDoor, 'whoami'>;
+    clients: OAuthClients;
+    secrets: OAuthSecrets;
+    tokens: Pick<IssuedTokens, 'revokeParty'>;
 }): CrewParty;

package/dist/core/parties/crew-party.js

@@ -1,20 +1,52 @@
 import { refuse } from '../shared/errors.js';
 import { ok } from '../shared/result.js';
 import { shownPartyOf } from './shown-party.js';
+/** The fleet's codes for a crew token it no longer takes: the ship's crew was released. */
+const CREW_ENDED = new Set(['LEASE_ENDED', 'UNAUTHORIZED']);
 /**
  * Use case: argo hands over a new secret for a party's proxy ship that awaits
  * crew, taken from a new starting prompt in the console: the commission's
  * answer was lost, and its secret with it, and the gateway's ship may not ask
- * for a new one (orchestrator-1 on aeolus-fleet#876, Q6). The gateway crews
- * the ship with it and keeps the crew token; the secret is never kept.
+ * for a new one (orchestrator-1 on aeolus-fleet#876, Q6); or its crew was
+ * released, which the fleet tells by no longer taking the party's crew token
+ * (vendor platforms V8). The gateway crews the same ship with it and keeps
+ * the crew token; the secret is never kept. A client that signs in by client
+ * credentials gets a new client secret, answered once, in place of the old
+ * one, and the tokens the old one gave are revoked.
  */
 export function createCrewParty(deps) {
+    /** Whether the ship awaits crew: never crewed by the gateway, or the fleet no longer takes its crew token. */
+    const isAwaitingCrew = async (party) => {
+        if (party.state !== 'crewed' || party.crewToken === null) {
+            return ok(party.state === 'awaitingCrew');
+        }
+        const who = await deps.door.whoami(party.crewToken);
+        if (!who.isOk && who.error.code === 'UNAVAILABLE') {
+            return refuse('FLEET_UNAVAILABLE', `The fleet did not answer: ${who.error.message}`);
+        }
+        return ok(!who.isOk && CREW_ENDED.has(who.error.code));
+    };
+    /** The client's new secret, if it signs in by client credentials, kept only as its hash. */
+    const newClientSecret = async (party) => {
+        const client = party.kind === 'mcpClient' ? await deps.clients.find(party.clientId) : undefined;
+        if (client?.grant !== 'clientCredentials') {
+            return null;
+        }
+        const clientSecret = deps.secrets.newSecret();
+        await deps.clients.save({ ...client, secretHash: deps.secrets.hashOf(clientSecret) });
+        await deps.tokens.revokeParty(party.fleetId, party.name);
+        return clientSecret;
+    };
     return async ({ operatorFleetId, name, secret }) => {
         const party = await deps.parties.find(operatorFleetId, name);
         if (!party) {
             return refuse('NO_SUCH_PARTY', `No party named ${name}`);
         }
-        if (party.state !== 'awaitingCrew' || party.proxyShipId === null) {
+        const awaiting = await isAwaitingCrew(party);
+        if (!awaiting.isOk) {
+            return awaiting;
+        }
+        if (!awaiting.value || party.proxyShipId === null) {
             return refuse('NOT_AWAITING_CREW', `The proxy ship of ${name} does not await crew`);
         }
         const registered = await deps.door.register({ shipId: party.proxyShipId, secret });
@@ -23,7 +55,7 @@ export function createCrewParty(deps) {
         }
         const crewed = { ...party, state: 'crewed', secret: null, crewToken: registered.value.crewToken };
         await deps.parties.save(crewed);
-        return ok(shownPartyOf(crewed));
+        return ok({ party: shownPartyOf(crewed), clientSecret: await newClientSecret(crewed) });
     };
 }
 //# sourceMappingURL=crew-party.js.map

package/dist/core/parties/crew-party.js.map

@@ -1 +1 @@
-{"version":3,"file":"crew-party.js","sourceRoot":"","sources":["../../../src/core/parties/crew-party.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAmB,MAAM,kBAAkB,CAAC;AAQjE;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAkD;IAChF,OAAO,KAAK,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;QACjD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;QAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,MAAM,CAAC,eAAe,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,cAAc,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YACjE,OAAO,MAAM,CAAC,mBAAmB,EAAE,qBAAqB,IAAI,sBAAsB,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC,gBAAgB,EAAE,iCAAiC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,MAAM,GAAU,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACzG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChC,OAAO,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"crew-party.js","sourceRoot":"","sources":["../../../src/core/parties/crew-party.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAmB,MAAM,kBAAkB,CAAC;AAIjE,2FAA2F;AAC3F,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC;AAY5D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAAC,IAM/B;IACC,8GAA8G;IAC9G,MAAM,cAAc,GAAG,KAAK,EAAE,KAAY,EAA8D,EAAE;QACxG,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YACzD,OAAO,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,cAAc,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAClD,OAAO,MAAM,CAAC,mBAAmB,EAAE,6BAA6B,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC;IAEF,4FAA4F;IAC5F,MAAM,eAAe,GAAG,KAAK,EAAE,KAAY,EAA0B,EAAE;QACrE,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChG,IAAI,MAAM,EAAE,KAAK,KAAK,mBAAmB,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9C,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACtF,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACzD,OAAO,YAAY,CAAC;IACtB,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;QACjD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;QAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,MAAM,CAAC,eAAe,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAClD,OAAO,MAAM,CAAC,mBAAmB,EAAE,qBAAqB,IAAI,sBAAsB,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC,gBAAgB,EAAE,iCAAiC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,MAAM,GAAU,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACzG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChC,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/party.d.ts

@@ -1,5 +1,6 @@
 import type { FleetId, ShipId, VerifiedFact } from '@aeolus-fleet/common';
 import type { McpServerCredential } from '../vault/credential.js';
+import type { ToolSwitches } from './tool-switches.js';
 /**
  * Where an approved party's proxy ship stands (interop I-5):
  * - commissioning: argo approved it; the gateway has not seen the fleet commission its ship yet;
@@ -34,6 +35,8 @@ export interface McpServerParty extends PartyBase {
     readonly credential: McpServerCredential;
     /** The most calls the gateway has in flight to the server at once. */
     readonly concurrencyLimit: number;
+    /** Which of its tools the fleet may call; none kept yet means every tool it lists (aeolus-fleet#1151). */
+    readonly toolSwitches: ToolSwitches | null;
 }
 /** An outside MCP client argo approved at /authorize: it calls fleet ships as its proxy ship (MCP in). */
 export interface McpClientParty extends PartyBase {
@@ -41,12 +44,31 @@ export interface McpClientParty extends PartyBase {
     /** Its OAuth client id: pre-registered, or its metadata document's URL. */
     readonly clientId: string;
 }
-export type Party = McpServerParty | McpClientParty;
+/** An outside A2A client an approver added (decision 0060): it calls fleet ships as its proxy ship, with the bearer it was shown once (A2A in). */
+export interface A2aClientParty extends PartyBase {
+    readonly kind: 'a2aClient';
+    /** The hash of the bearer it was shown, which names it on every call; none until one is shown. */
+    readonly bearerHash: string | null;
+}
+/** An outside A2A agent an approver added by its card address (slice 5): fleet ships send it messages through its proxy ship (A2A out). */
+export interface A2aAgentParty extends PartyBase {
+    readonly kind: 'a2aAgent';
+    /** Where its public card is read. */
+    readonly cardUrl: string;
+    readonly credential: McpServerCredential;
+    /** The most messages the gateway has in flight to the agent at once. */
+    readonly concurrencyLimit: number;
+    /** Whether a message that died before the agent confirmed it may be handed again: A2A's default, until an approver marks it not (A9). */
+    readonly isRepeatable: boolean;
+}
+export type Party = McpServerParty | McpClientParty | A2aClientParty | A2aAgentParty;
 /**
  * What the gateway checked about the party behind a proxy ship (decision
  * 0059): the host it reached an MCP server at over TLS, and the domain of the
  * metadata document it read an MCP client's id from over TLS. A client argo
  * registered has no document, and an address without TLS proves no host.
+ * The domain an A2A agent's card was read from over TLS. The gateway checks
+ * nothing about an A2A client: an approver names it.
  */
 export declare function verifiedFactsOf(party: Party): VerifiedFact[];
 export {};