npm - @aeolus-fleet/gateway - Versions diffs - 0.32.2 → 0.34.0 - Mend

@aeolus-fleet/gateway 0.32.2 → 0.34.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (880) hide show

package/dist/core/mcp-out/hand-call.js CHANGED Viewed

@@ -53,7 +53,10 @@ function notACallReply(party, delivery) {
  * marked its tool repeatable; otherwise it is reported not handled. A call
  * to a tool not switched on is answered an error and reaches no server
  * (aeolus-fleet#1151); so is a call from a ship that lacks a scope the
- * tool needs (design gateway-scopes, 4.2).
+ * tool needs (design gateway-scopes, 4.2). A call to a server where each
+ * person signs in goes out under its asking ship's owner's grant, read at
+ * hand-over (decision 0067); one with no grant to go under is answered its
+ * error result, kept first, and reaches no server.
  */
 export function createHandCall(deps) {
     return async ({ party, delivery }) => {
@@ -113,6 +116,24 @@ export function createHandCall(deps) {
             case 'holds':
                 break;
         }
+        // The grant as it is now, at hand-over: one removed while the call waited refuses it, one signed in lets it through.
+        let callTool = (call) => deps.servers.callTool({ url: party.url, credential: party.credential }, call);
+        const { credential } = party;
+        if (credential.kind === 'personSignIn') {
+            const found = await deps.grantCalls.grantOf({ server: { fleetId: party.fleetId, name: party.name, url: party.url, client: credential.client }, senderShipId: delivery.senderShipId });
+            switch (found.kind) {
+                case 'unread':
+                    return AGAIN;
+                case 'refused': {
+                    const reply = resultReply(delivery, { tool, result: found.result });
+                    await deps.calls.save({ ...kept, state: 'answered', reply });
+                    return finish(reply);
+                }
+                case 'granted':
+                    callTool = (call) => deps.grantCalls.callUnder(found.granted, call);
+                    break;
+            }
+        }
         const handed = await deps.crew.handed(crewToken, { deliveryId: delivery.deliveryId, handOverNumber: (delivery.handOverNumber ?? 0) + 1, channel: MCP_CHANNEL });
         if (!handed.isOk) {
             return AGAIN;
@@ -121,7 +142,7 @@ export function createHandCall(deps) {
             return { kind: 'undeliverable' };
         }
         await deps.calls.save({ ...kept, state: 'calling', reply: null });
-        const outcome = await deps.servers.callTool({ url: party.url, credential: party.credential }, { name: tool, arguments: args, timeoutMs: deps.timeoutMs });
+        const outcome = await callTool({ name: tool, arguments: args, timeoutMs: deps.timeoutMs });
         switch (outcome.kind) {
             case 'answered': {
                 const reply = resultReply(delivery, { tool, result: outcome.result });

package/dist/core/mcp-out/hand-call.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"hand-call.js","sourceRoot":"","sources":["../../../src/core/mcp-out/hand-call.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAA8D,MAAM,sBAAsB,CAAC;AAMnI,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEzE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;~~AAuEjF~~,2GAA2G;AAC3G,MAAM,WAAW,GAAG,KAAK,CAAC;AAE1B,uFAAuF;AACvF,MAAM,CAAC,MAAM,YAAY,GAAG,+FAA+F,CAAC;AAE5H,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,OAAO,EAAW,CAAC;AAEzC,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5C,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED,mHAAmH;AACnH,SAAS,WAAW,CAAC,QAAwB,EAAE,IAA0C;IACvF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,YAAY;QACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,WAAW,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QACtC,OAAO,EAAE,KAAK,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,sBAAsB,MAAM,CAAC,KAAK,CAAC,4BAA4B,MAAM,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO;QACvL,cAAc,EAAE,cAAc,QAAQ,CAAC,SAAS,EAAE;KACnD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAqB,EAAE,QAAwB;IACpE,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,YAAY;QACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,WAAW,EAAE,YAAY;QACzB,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,2DAA2D,aAAa,CAAC,QAAQ,CAAC,6CAA6C;QACrJ,cAAc,EAAE,cAAc,QAAQ,CAAC,SAAS,EAAE;KACnD,CAAC;AACJ,CAAC;AAED~~;;;;;;;;;;;GAWG~~;AACH,MAAM,UAAU,cAAc,CAAC,~~IAS9B~~;IACC,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE;QACnC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QAClC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QAE5F,MAAM,MAAM,GAAG,KAAK,EAAE,KAAY,EAAwB,EAAE;YAC1D,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;gBAC3K,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBACzB,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACzD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,CAAC,CAAC;QACF,MAAM,UAAU,GAAG,KAAK,IAA0B,EAAE;YAClD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACrE,4GAA4G;YAC5G,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YACjG,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAChC,CAAC,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACxD,IAAI,IAAI,EAAE,KAAK,KAAK,YAAY,EAAE,CAAC;YACjC,OAAO,UAAU,EAAE,CAAC;QACtB,CAAC;QACD,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;YAChB,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,2CAA2C,CAAC,EAAE,CAAC,CAAC,CAAC;QACnH,CAAC;QACD,MAAM,YAAY,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxF,6GAA6G;QAC7G,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,EAAE,KAAK,KAAK,SAAS,IAAI,CAAC,YAAY,EAAE,CAAC;YAC9E,OAAO,UAAU,EAAE,CAAC;QACtB,CAAC;QAED,oHAAoH;QACpH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC;YACvF,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;QACxF,CAAC;QACD,gHAAgH;QAChH,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/H,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,QAAQ;gBACX,OAAO,KAAK,CAAC;YACf,KAAK,OAAO;gBACV,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YACvF,KAAK,OAAO;gBACV,MAAM;QACV,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,cAAc,EAAE,CAAC,QAAQ,CAAC,cAAc,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;QAChK,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;YACrC,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,MAAM,~~IAAI,CAAC,OAAO,CAAC,~~QAAQ,CAAC,EAAE,~~GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,~~IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;~~QAC1J~~,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;gBACtE,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC7D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;YACD,KAAK,SAAS;gBACZ,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClE,OAAO,KAAK,CAAC;YACf,KAAK,YAAY;gBACf,OAAO,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
1	+ {"version":3,"file":"hand-call.js","sourceRoot":"","sources":["../../../src/core/mcp-out/hand-call.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAA8D,MAAM,sBAAsB,CAAC;AAMnI,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEzE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAwEjF,2GAA2G;AAC3G,MAAM,WAAW,GAAG,KAAK,CAAC;AAE1B,uFAAuF;AACvF,MAAM,CAAC,MAAM,YAAY,GAAG,+FAA+F,CAAC;AAE5H,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,OAAO,EAAW,CAAC;AAEzC,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5C,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED,mHAAmH;AACnH,SAAS,WAAW,CAAC,QAAwB,EAAE,IAA0C;IACvF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,YAAY;QACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,WAAW,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QACtC,OAAO,EAAE,KAAK,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,sBAAsB,MAAM,CAAC,KAAK,CAAC,4BAA4B,MAAM,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO;QACvL,cAAc,EAAE,cAAc,QAAQ,CAAC,SAAS,EAAE;KACnD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAqB,EAAE,QAAwB;IACpE,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,YAAY;QACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,WAAW,EAAE,YAAY;QACzB,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,2DAA2D,aAAa,CAAC,QAAQ,CAAC,6CAA6C;QACrJ,cAAc,EAAE,cAAc,QAAQ,CAAC,SAAS,EAAE;KACnD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,cAAc,CAAC,IAU9B;IACC,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE;QACnC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QAClC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QAE5F,MAAM,MAAM,GAAG,KAAK,EAAE,KAAY,EAAwB,EAAE;YAC1D,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;gBAC3K,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBACzB,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACzD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,CAAC,CAAC;QACF,MAAM,UAAU,GAAG,KAAK,IAA0B,EAAE;YAClD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACrE,4GAA4G;YAC5G,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YACjG,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAChC,CAAC,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACxD,IAAI,IAAI,EAAE,KAAK,KAAK,YAAY,EAAE,CAAC;YACjC,OAAO,UAAU,EAAE,CAAC;QACtB,CAAC;QACD,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;YAChB,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,2CAA2C,CAAC,EAAE,CAAC,CAAC,CAAC;QACnH,CAAC;QACD,MAAM,YAAY,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxF,6GAA6G;QAC7G,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,EAAE,KAAK,KAAK,SAAS,IAAI,CAAC,YAAY,EAAE,CAAC;YAC9E,OAAO,UAAU,EAAE,CAAC;QACtB,CAAC;QAED,oHAAoH;QACpH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC;YACvF,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;QACxF,CAAC;QACD,gHAAgH;QAChH,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/H,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,QAAQ;gBACX,OAAO,KAAK,CAAC;YACf,KAAK,OAAO;gBACV,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YACvF,KAAK,OAAO;gBACV,MAAM;QACV,CAAC;QACD,qHAAqH;QACrH,IAAI,QAAQ,GAAG,CAAC,IAAc,EAA4B,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,CAAC;QAC3I,MAAM,EAAE,UAAU,EAAE,GAAG,KAAK,CAAC;QAC7B,IAAI,UAAU,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;YACtL,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;gBACnB,KAAK,QAAQ;oBACX,OAAO,KAAK,CAAC;gBACf,KAAK,SAAS,CAAC,CAAC,CAAC;oBACf,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;oBACpE,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;oBAC7D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;gBACvB,CAAC;gBACD,KAAK,SAAS;oBACZ,QAAQ,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;oBACpE,MAAM;YACV,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,cAAc,EAAE,CAAC,QAAQ,CAAC,cAAc,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;QAChK,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;YACrC,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC3F,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;gBACtE,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC7D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;YACD,KAAK,SAAS;gBACZ,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClE,OAAO,KAAK,CAAC;YACf,KAAK,YAAY;gBACf,OAAO,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/mcp-out/ports.d.ts CHANGED Viewed

@@ -3,12 +3,12 @@
  * (interop 3.3, 5.2): its tools, and one call at a time.
  */
 import type { Result } from '../shared/result.js';
-import type { McpServerCredential } from '../vault/credential.js';
+import type { McpServerPartyCredential } from '../vault/credential.js';
 /** Where an outside MCP server is, and how the gateway signs in to it. */
 export interface McpServerConnection {
     /** Its Streamable HTTP endpoint. */
     readonly url: string;
-    readonly credential: McpServerCredential;
+    readonly credential: McpServerPartyCredential;
 }
 /** MCP's tool annotations (2026-07-28), as the server states them: hints, never trusted on their own. */
 export interface ToolAnnotations {
@@ -33,10 +33,13 @@ export interface ToolResult {
     readonly structuredContent?: Readonly<Record<string, unknown>>;
     readonly isError: boolean;
 }
+/** How a server refused the credential a call went with (RFC 6750 3.1): not taken (401), or lacking a scope the call needs (403 `insufficient_scope`). */
+export type CredentialRefusal = 'unauthorized' | 'insufficientScope';
 /**
  * How one `tools/call` ended (5.2):
  * - answered: the server's answer, which confirms the hand-over;
  * - notSent: the gateway never sent it (the server was unreachable, or refused the gateway's credential), so it did not run;
+ *   a refusal says how the server refused the credential: 401 (unauthorized), or 403 `insufficient_scope` for this call;
  * - unanswered: sent, and no answer came (a broken stream, a timeout): whether the server ran it is unknown.
  */
 export type ToolCallOutcome = {
@@ -45,6 +48,7 @@ export type ToolCallOutcome = {
 } | {
     readonly kind: 'notSent';
     readonly reason: string;
+    readonly refusal?: CredentialRefusal;
 } | {
     readonly kind: 'unanswered';
     readonly reason: string;

package/dist/core/mcp-out/state-party.d.ts CHANGED Viewed

@@ -1,6 +1,7 @@
 import type { FleetId } from '@aeolus-fleet/common';
 import type { FleetRefusal } from '../connection/ports.js';
 import type { PartyStore, ScopeRequirementsStore } from '../parties/ports.js';
+import type { ListingConnectionOf } from '../party-grants/listing-connection.js';
 import { type DomainError } from '../shared/errors.js';
 import { type Result } from '../shared/result.js';
 import type { McpServers } from './ports.js';
@@ -24,17 +25,19 @@ export type StateParty = (input: {
     name: string;
 }) => Promise<Result<{
     capabilities: string[];
-}, DomainError<'NO_SUCH_PARTY' | 'NOT_CREWED' | 'SERVER_UNREACHABLE' | 'STATEMENT_REFUSED'>>>;
+}, DomainError<'NO_SUCH_PARTY' | 'NOT_CREWED' | 'NOT_SIGNED_IN' | 'SERVER_UNREACHABLE' | 'STATEMENT_REFUSED'>>>;
 /**
  * Use case: the gateway states what a party's proxy ship offers, as its
  * crew: the tools its server lists now that are switched on, with argo's
  * marks and the scopes each tool needs now. The whole statement replaces the one before, so a tool the server
  * dropped or an approver switched off is gone. A party with no switches kept
- * keeps every tool it lists on first (aeolus-fleet#1151).
+ * keeps every tool it lists on first (aeolus-fleet#1151). A server where each
+ * person signs in is listed under a person's grant (decision 0067).
  */
 export declare function createStateParty(deps: {
     parties: PartyStore;
     servers: McpServers;
+    connectionOf: ListingConnectionOf;
     door: StatementDoor;
     marks: ToolMarks;
     requirements: ScopeRequirementsStore;

package/dist/core/mcp-out/state-party.js CHANGED Viewed

@@ -7,7 +7,8 @@ import { statementOf } from './statement.js';
  * crew: the tools its server lists now that are switched on, with argo's
  * marks and the scopes each tool needs now. The whole statement replaces the one before, so a tool the server
  * dropped or an approver switched off is gone. A party with no switches kept
- * keeps every tool it lists on first (aeolus-fleet#1151).
+ * keeps every tool it lists on first (aeolus-fleet#1151). A server where each
+ * person signs in is listed under a person's grant (decision 0067).
  */
 export function createStateParty(deps) {
     return async ({ fleetId, name }) => {
@@ -18,7 +19,11 @@ export function createStateParty(deps) {
         if (party.state !== 'crewed' || party.crewToken === null) {
             return refuse('NOT_CREWED', `The gateway does not crew the proxy ship of ${name} yet`);
         }
-        const listed = await deps.servers.listTools({ url: party.url, credential: party.credential });
+        const connection = await deps.connectionOf(party);
+        if (connection === undefined) {
+            return refuse('NOT_SIGNED_IN', `Nobody holds a usable sign-in to ${name}, so its tools cannot be listed`);
+        }
+        const listed = await deps.servers.listTools(connection);
         if (!listed.isOk) {
             return refuse('SERVER_UNREACHABLE', `The MCP server of ${name} could not be listed: ${listed.error.reason}`);
         }

package/dist/core/mcp-out/state-party.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"state-party.js","sourceRoot":"","sources":["../../../src/core/mcp-out/state-party.ts"],"names":[],"mappings":"~~AAIA~~,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvD,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAmC,MAAM,gBAAgB,CAAC;AAkB9E~~;;;;;;GAMG~~;AACH,MAAM,UAAU,gBAAgB,CAAC,~~IAAmJ~~;~~IAClL~~,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,IAAI,KAAK,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC,eAAe,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YACzD,OAAO,MAAM,CAAC,YAAY,EAAE,+CAA+C,IAAI,MAAM,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,~~MAAM~~,GAAG,MAAM,IAAI,CAAC,~~OAAO~~,CAAC,~~SAAS~~,CAAC,EAAE,~~GAAG~~,EAAE,~~KAAK~~,CAAC,GAAG,~~EAAE~~,~~UAAU~~,~~EAAE~~,~~KAAK~~,CAAC,UAAU,~~EAAE,~~CAAC,CAAC;~~QAC9F~~,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,oBAAoB,EAAE,qBAAqB,IAAI,yBAAyB,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QAC5H,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACrF,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAClM,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,mBAAmB,EAAE,oCAAoC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC;AACJ,CAAC"}
1	+ {"version":3,"file":"state-party.js","sourceRoot":"","sources":["../../../src/core/mcp-out/state-party.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvD,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAmC,MAAM,gBAAgB,CAAC;AAkB9E;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAQhC;IACC,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,IAAI,KAAK,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC,eAAe,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YACzD,OAAO,MAAM,CAAC,YAAY,EAAE,+CAA+C,IAAI,MAAM,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC,eAAe,EAAE,oCAAoC,IAAI,iCAAiC,CAAC,CAAC;QAC5G,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,oBAAoB,EAAE,qBAAqB,IAAI,yBAAyB,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QAC5H,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACrF,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAClM,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,mBAAmB,EAAE,oCAAoC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/oauth/exchange-token.d.ts CHANGED Viewed

@@ -24,6 +24,7 @@ interface ExchangeTokenDeps {
     tokens: IssuedTokens;
     secrets: OAuthSecrets;
     clock: Clock;
+    /** The MCP endpoint a client signed in by client credentials is bound to; a code keeps the resource it was issued for. */
     resource: string;
     /** The parties argo's approvers added: a client signed in by client credentials is one. */
     parties: Pick<PartyStore, 'findByClient'>;

package/dist/core/oauth/exchange-token.js CHANGED Viewed

@@ -87,9 +87,6 @@ export function createExchangeToken(deps) {
         if (code === undefined || verifier === undefined) {
             return refusal('invalid_request', 'A code and its PKCE verifier are required');
         }
-        if (request.resource !== undefined && request.resource !== deps.resource) {
-            return refusal('invalid_target', `The resource must be ${deps.resource}`);
-        }
         const taken = await deps.codes.take(deps.secrets.hashOf(code));
         if (!taken) {
             return refusal('invalid_grant', 'No such code');
@@ -99,6 +96,10 @@ export function createExchangeToken(deps) {
             return refusal('invalid_grant', 'The code was used before; the tokens it gave are revoked');
         }
         const issued = taken.code;
+        // A code is taken for the resource it was issued for, one of the gateway's addresses (RFC 8707).
+        if (request.resource !== undefined && request.resource !== issued.resource) {
+            return refusal('invalid_target', `The resource must be ${issued.resource}`);
+        }
         const isValid = issued.expiresAt.getTime() > deps.clock.now().getTime() &&
             issued.clientId === request.client_id &&
             issued.redirectUri === request.redirect_uri &&

package/dist/core/oauth/exchange-token.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"exchange-token.js","sourceRoot":"","sources":["../../../src/core/oauth/exchange-token.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAG1D,2GAA2G;AAC3G,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,MAAM,CAAC;AACpD,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAE/D,4EAA4E;AAC5E,MAAM,CAAC,MAAM,gBAAgB,GAAG,6CAA6C,CAAC;AAe9E,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B,SAAS,OAAO,CAAC,KAAqB,EAAE,WAAmB;IACzD,OAAO,GAAG,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;AACrC,CAAC;~~AAiBD~~;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,4DAA4D;IAC5D,MAAM,eAAe,GAAG,KAAK,EAAE,OAAqB,EAAoB,EAAE;QACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,IAAI,IAAI,CAAC;QAC3E,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC;QAC7C,CAAC;QACD,OAAO,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,UAAU,CAAC;IAC1G,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,KAAK,EAAE,IAA4G,EAAuB,EAAE;QACxJ,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC7C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QACvC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACrB,GAAG,IAAI;YACP,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;YAC5C,eAAe,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,wBAAwB,CAAC;YACzD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;YAC9C,gBAAgB,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,yBAAyB,CAAC;SAC5D,CAAC,CAAC;QACH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,wBAAwB,GAAG,aAAa,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IACtH,CAAC,CAAC;IAEF,MAAM,qBAAqB,GAAG,KAAK,EAAE,OAAqB,EAA2C,EAAE;QACrG,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxG,MAAM,WAAW,GAAG,MAAM,EAAE,UAAU,IAAI,IAAI,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC;QAC1J,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC;YACzC,OAAO,OAAO,CAAC,gBAAgB,EAAE,uCAAuC,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,mBAAmB,EAAE,CAAC;YACzC,OAAO,OAAO,CAAC,qBAAqB,EAAE,4CAA4C,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,OAAO,CAAC,gBAAgB,EAAE,uCAAuC,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACvD,OAAO,OAAO,CAAC,qBAAqB,EAAE,sCAAsC,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvC,OAAO,OAAO,CAAC,gBAAgB,EAAE,wBAAwB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACrB,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,KAAK,CAAC,IAAI;YACjB,UAAU;YACV,eAAe,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,wBAAwB,CAAC;YAChF,WAAW,EAAE,IAAI;YACjB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE,wBAAwB,GAAG,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1H,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,EAAE,OAAqB,EAA2C,EAAE;QACxF,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;QAClD,IAAI,IAAI,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjD,OAAO,OAAO,CAAC,iBAAiB,EAAE,2CAA2C,CAAC,CAAC;QACjF,CAAC;QACD,~~IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzE,OAAO,OAAO,CAAC,gBAAgB,EAAE,wBAAwB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,~~MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,OAAO,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtD,OAAO,OAAO,CAAC,eAAe,EAAE,0DAA0D,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC;QAC1B,MAAM,OAAO,GACX,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE;YACvD,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,SAAS;YACrC,MAAM,CAAC,WAAW,KAAK,OAAO,CAAC,YAAY;YAC3C,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,aAAa,CAAC;QAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,OAAO,CAAC,eAAe,EAAE,gFAAgF,CAAC,CAAC;QACpH,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QAChE,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACpH,CAAC,CAAC;IAEF,MAAM,gBAAgB,GAAG,KAAK,EAAE,OAAqB,EAA2C,EAAE;QAChG,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,OAAO,CAAC,iBAAiB,EAAE,6BAA6B,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChL,OAAO,OAAO,CAAC,eAAe,EAAE,sDAAsD,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9C,OAAO,OAAO,CAAC,eAAe,EAAE,2DAA2D,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QACxE,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACxG,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;YACvC,OAAO,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,SAAS,KAAK,gBAAgB,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACvE,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,SAAS,KAAK,oBAAoB,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;YACxE,OAAO,OAAO,CAAC,wBAAwB,EAAE,uHAAuH,CAAC,CAAC;QACpK,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACtC,OAAO,OAAO,CAAC,gBAAgB,EAAE,uCAAuC,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,SAAS,KAAK,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5F,CAAC,CAAC;AACJ,CAAC"}
1	+ {"version":3,"file":"exchange-token.js","sourceRoot":"","sources":["../../../src/core/oauth/exchange-token.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAG1D,2GAA2G;AAC3G,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,MAAM,CAAC;AACpD,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAE/D,4EAA4E;AAC5E,MAAM,CAAC,MAAM,gBAAgB,GAAG,6CAA6C,CAAC;AAe9E,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B,SAAS,OAAO,CAAC,KAAqB,EAAE,WAAmB;IACzD,OAAO,GAAG,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;AACrC,CAAC;AAkBD;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,4DAA4D;IAC5D,MAAM,eAAe,GAAG,KAAK,EAAE,OAAqB,EAAoB,EAAE;QACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,IAAI,IAAI,CAAC;QAC3E,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC;QAC7C,CAAC;QACD,OAAO,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,UAAU,CAAC;IAC1G,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,KAAK,EAAE,IAA4G,EAAuB,EAAE;QACxJ,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC7C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QACvC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACrB,GAAG,IAAI;YACP,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;YAC5C,eAAe,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,wBAAwB,CAAC;YACzD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;YAC9C,gBAAgB,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,yBAAyB,CAAC;SAC5D,CAAC,CAAC;QACH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,wBAAwB,GAAG,aAAa,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IACtH,CAAC,CAAC;IAEF,MAAM,qBAAqB,GAAG,KAAK,EAAE,OAAqB,EAA2C,EAAE;QACrG,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxG,MAAM,WAAW,GAAG,MAAM,EAAE,UAAU,IAAI,IAAI,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,MAAM,CAAC,UAAU,CAAC;QAC1J,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,WAAW,EAAE,CAAC;YACzC,OAAO,OAAO,CAAC,gBAAgB,EAAE,uCAAuC,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,mBAAmB,EAAE,CAAC;YACzC,OAAO,OAAO,CAAC,qBAAqB,EAAE,4CAA4C,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,OAAO,CAAC,gBAAgB,EAAE,uCAAuC,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACvD,OAAO,OAAO,CAAC,qBAAqB,EAAE,sCAAsC,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvC,OAAO,OAAO,CAAC,gBAAgB,EAAE,wBAAwB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC7C,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACrB,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,KAAK,CAAC,IAAI;YACjB,UAAU;YACV,eAAe,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,wBAAwB,CAAC;YAChF,WAAW,EAAE,IAAI;YACjB,gBAAgB,EAAE,IAAI;SACvB,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,EAAE,gBAAgB,EAAE,wBAAwB,GAAG,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1H,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,EAAE,OAAqB,EAA2C,EAAE;QACxF,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;QAClD,IAAI,IAAI,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjD,OAAO,OAAO,CAAC,iBAAiB,EAAE,2CAA2C,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,OAAO,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtD,OAAO,OAAO,CAAC,eAAe,EAAE,0DAA0D,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC;QAC1B,iGAAiG;QACjG,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC3E,OAAO,OAAO,CAAC,gBAAgB,EAAE,wBAAwB,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,OAAO,GACX,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE;YACvD,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,SAAS;YACrC,MAAM,CAAC,WAAW,KAAK,OAAO,CAAC,YAAY;YAC3C,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,aAAa,CAAC;QAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,OAAO,CAAC,eAAe,EAAE,gFAAgF,CAAC,CAAC;QACpH,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QAChE,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACpH,CAAC,CAAC;IAEF,MAAM,gBAAgB,GAAG,KAAK,EAAE,OAAqB,EAA2C,EAAE;QAChG,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,OAAO,CAAC,iBAAiB,EAAE,6BAA6B,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChL,OAAO,OAAO,CAAC,eAAe,EAAE,sDAAsD,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9C,OAAO,OAAO,CAAC,eAAe,EAAE,2DAA2D,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QACxE,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACxG,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;YACvC,OAAO,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,SAAS,KAAK,gBAAgB,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACvE,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,SAAS,KAAK,oBAAoB,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;YACxE,OAAO,OAAO,CAAC,wBAAwB,EAAE,uHAAuH,CAAC,CAAC;QACpK,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACtC,OAAO,OAAO,CAAC,gBAAgB,EAAE,uCAAuC,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,SAAS,KAAK,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5F,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/oauth/read-authorization.d.ts CHANGED Viewed

@@ -33,11 +33,11 @@ export type ReadAuthorization = (request: Readonly<Record<string, string | undef
  * Use case: the gateway reads an authorization request from an MCP client
  * (OAuth 2.1 with PKCE, MCP 2026-07-28). The client is pre-registered, or
  * known by its metadata document (CIMD), fetched from its client id. Only
- * the S256 challenge is taken, and the resource must be the gateway's MCP
- * endpoint (RFC 8707), so a token is bound to it.
+ * the S256 challenge is taken, and the resource must be one of the addresses
+ * the gateway serves its MCP tools at (RFC 8707), so a token is bound to it.
  */
 export declare function createReadAuthorization(deps: {
     clients: OAuthClients;
     documents: ClientMetadataDocuments;
-    resource: string;
+    resources: readonly string[];
 }): ReadAuthorization;

package/dist/core/oauth/read-authorization.js CHANGED Viewed

@@ -23,8 +23,8 @@ function metadataDocumentUrl(clientId) {
  * Use case: the gateway reads an authorization request from an MCP client
  * (OAuth 2.1 with PKCE, MCP 2026-07-28). The client is pre-registered, or
  * known by its metadata document (CIMD), fetched from its client id. Only
- * the S256 challenge is taken, and the resource must be the gateway's MCP
- * endpoint (RFC 8707), so a token is bound to it.
+ * the S256 challenge is taken, and the resource must be one of the addresses
+ * the gateway serves its MCP tools at (RFC 8707), so a token is bound to it.
  */
 export function createReadAuthorization(deps) {
     const knownClient = async (clientId) => {
@@ -65,10 +65,11 @@ export function createReadAuthorization(deps) {
         if (codeChallenge === undefined || codeChallenge === '' || request.code_challenge_method !== 'S256') {
             return sendBack('invalid_request', 'A PKCE code challenge with the S256 method is required');
         }
-        if (request.resource !== deps.resource) {
-            return sendBack('invalid_target', `The resource must be ${deps.resource}`);
+        const { resource } = request;
+        if (resource === undefined || !deps.resources.includes(resource)) {
+            return sendBack('invalid_target', `The resource must be one of ${deps.resources.join(', ')}`);
         }
-        return ok({ clientId, clientName: client.value.name, clientFleetId: client.value.fleetId, redirectUri, codeChallenge, resource: deps.resource, scope: request.scope ?? null, state });
+        return ok({ clientId, clientName: client.value.name, clientFleetId: client.value.fleetId, redirectUri, codeChallenge, resource, scope: request.scope ?? null, state });
     };
 }
 //# sourceMappingURL=read-authorization.js.map

package/dist/core/oauth/read-authorization.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"read-authorization.js","sourceRoot":"","sources":["../../../src/core/oauth/read-authorization.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AA0BvF,2EAA2E;AAC3E,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1C,CAAC,CAAC;AAEH,kGAAkG;AAClG,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5F,OAAO,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/E,CAAC;AAQD;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,~~IAAqF~~;~~IAC3H~~,MAAM,WAAW,GAAG,KAAK,EAAE,QAAgB,EAAwC,EAAE;QACnF,MAAM,GAAG,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjD,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,QAAQ,gBAAgB,CAAC,CAAC;QACrJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,GAAG,CAAC,qCAAqC,QAAQ,uBAAuB,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YACnH,OAAO,GAAG,CAAC,qCAAqC,QAAQ,mDAAmD,CAAC,CAAC;QAC/G,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IAC3H,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC9C,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,uBAAuB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;YACnI,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,kCAAkC,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC;QACpC,MAAM,QAAQ,GAAG,CAAC,KAAqB,EAAE,WAAmB,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,UAAmB,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5I,IAAI,OAAO,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;YACrC,OAAO,QAAQ,CAAC,2BAA2B,EAAE,4CAA4C,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,EAAE,IAAI,OAAO,CAAC,qBAAqB,KAAK,MAAM,EAAE,CAAC;YACpG,OAAO,QAAQ,CAAC,iBAAiB,EAAE,wDAAwD,CAAC,CAAC;QAC/F,CAAC;QACD,~~IAAI~~,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;~~YACvC~~,OAAO,QAAQ,CAAC,gBAAgB,EAAE,~~wBAAwB~~,IAAI,CAAC,~~QAAQ~~,EAAE,CAAC,CAAC;~~QAC7E~~,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,~~IAAI,CAAC,QAAQ,EAAE,~~KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;~~IACxL~~,CAAC,CAAC;AACJ,CAAC"}
1	+ {"version":3,"file":"read-authorization.js","sourceRoot":"","sources":["../../../src/core/oauth/read-authorization.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AA0BvF,2EAA2E;AAC3E,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1C,CAAC,CAAC;AAEH,kGAAkG;AAClG,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5F,OAAO,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/E,CAAC;AAQD;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAiG;IACvI,MAAM,WAAW,GAAG,KAAK,EAAE,QAAgB,EAAwC,EAAE;QACnF,MAAM,GAAG,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjD,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,QAAQ,gBAAgB,CAAC,CAAC;QACrJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,GAAG,CAAC,qCAAqC,QAAQ,uBAAuB,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YACnH,OAAO,GAAG,CAAC,qCAAqC,QAAQ,mDAAmD,CAAC,CAAC;QAC/G,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IAC3H,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC9C,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,uBAAuB,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,EAAE,CAAC;YACnI,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,kCAAkC,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC;QACpC,MAAM,QAAQ,GAAG,CAAC,KAAqB,EAAE,WAAmB,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,UAAmB,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5I,IAAI,OAAO,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;YACrC,OAAO,QAAQ,CAAC,2BAA2B,EAAE,4CAA4C,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,EAAE,IAAI,OAAO,CAAC,qBAAqB,KAAK,MAAM,EAAE,CAAC;YACpG,OAAO,QAAQ,CAAC,iBAAiB,EAAE,wDAAwD,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;QAC7B,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjE,OAAO,QAAQ,CAAC,gBAAgB,EAAE,+BAA+B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzK,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/add-sign-in-server.d.ts ADDED Viewed

@@ -0,0 +1,25 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import { type DomainError } from '../shared/errors.js';
+import type { Result } from '../shared/result.js';
+import type { ApproveParty, ApprovePartyRefusal } from './approve-party.js';
+import type { AuthorizationServers, PartyStore } from './ports.js';
+import type { ShownParty } from './shown-party.js';
+export type AddSignInServerRefusal = ApprovePartyRefusal | DomainError<'SERVER_UNREACHABLE' | 'NO_AUTHORIZATION_SERVER' | 'SIGN_IN_CHECK_FAILED' | 'NO_DYNAMIC_REGISTRATION' | 'REGISTRATION_REFUSED'>;
+export type AddSignInServer = (input: Omit<Parameters<ApproveParty>[0], 'credential'>) => Promise<Result<ShownParty, AddSignInServerRefusal>>;
+/**
+ * Use case: an approver adds an outside MCP server that takes only an OAuth
+ * sign-in (decision 0067). The gateway finds its authorization server,
+ * checks it states PKCE S256 and offers dynamic registration, registers one
+ * client for the party, bound to its issuer, then approves the party with
+ * that client as its credential: its proxy ship is commissioned and crewed,
+ * unstated until a person signs in. A refused check keeps nothing. The same
+ * addition again finds the party it kept, and registers no second client.
+ */
+export declare function createAddSignInServer(deps: {
+    approveParty: ApproveParty;
+    parties: PartyStore;
+    servers: AuthorizationServers;
+    servesOutsideParties: (fleetId: FleetId) => Promise<boolean>;
+    /** Where the outside authorization server sends each person back after their sign-in. */
+    redirectUri: string;
+}): AddSignInServer;

package/dist/core/parties/add-sign-in-server.js ADDED Viewed

@@ -0,0 +1,70 @@
+import { refuse } from '../shared/errors.js';
+/** The PKCE method the gateway signs in with; an authorization server that does not state it is refused (MCP authorization). */
+const PKCE_METHOD = 'S256';
+/** The scopes a sign-in adds when the authorization server lists them: a refresh token, and the outside account's subject (Q8, Q13). */
+const ADDED_SCOPES = ['offline_access', 'openid'];
+/** The outside scopes each person's sign-in asks for (Q8): the 401's, else every scope the server lists, with offline_access and openid when the authorization server lists them. */
+function scopeOf(discovered) {
+    const asked = discovered.challengeScope === null ? [...discovered.resourceScopes] : discovered.challengeScope.split(' ');
+    const added = ADDED_SCOPES.filter((scope) => discovered.serverScopes.includes(scope) && !asked.includes(scope));
+    return [...asked, ...added].join(' ');
+}
+/**
+ * Use case: an approver adds an outside MCP server that takes only an OAuth
+ * sign-in (decision 0067). The gateway finds its authorization server,
+ * checks it states PKCE S256 and offers dynamic registration, registers one
+ * client for the party, bound to its issuer, then approves the party with
+ * that client as its credential: its proxy ship is commissioned and crewed,
+ * unstated until a person signs in. A refused check keeps nothing. The same
+ * addition again finds the party it kept, and registers no second client.
+ */
+export function createAddSignInServer(deps) {
+    return async (input) => {
+        const { operatorFleetId: fleetId, name, url, requestId } = input;
+        if (!(await deps.servesOutsideParties(fleetId))) {
+            return refuse('OUTSIDE_PARTIES_OFF', "This fleet's outside parties are off: turn them on first");
+        }
+        const earlier = await deps.parties.find(fleetId, name);
+        if (earlier) {
+            if (earlier.kind === 'mcpServer' && earlier.credential.kind === 'personSignIn' && earlier.requestId === requestId) {
+                return deps.approveParty({ ...input, credential: earlier.credential });
+            }
+            return refuse('PARTY_EXISTS', `A party named ${name} was approved already`);
+        }
+        const discovered = await deps.servers.discover(url);
+        if (!discovered.isOk) {
+            switch (discovered.error.kind) {
+                case 'unreachable':
+                    return refuse('SERVER_UNREACHABLE', `The MCP server could not be reached: ${discovered.error.reason}`);
+                case 'noAuthorizationServer':
+                    return refuse('NO_AUTHORIZATION_SERVER', `The server states no authorization server: ${discovered.error.reason}`);
+                case 'noServerMetadata':
+                    return refuse('SIGN_IN_CHECK_FAILED', `The authorization server failed its check: ${discovered.error.reason}`);
+            }
+        }
+        const signIn = discovered.value;
+        if (!signIn.codeChallengeMethods.includes(PKCE_METHOD)) {
+            return refuse('SIGN_IN_CHECK_FAILED', `The authorization server ${signIn.issuer} does not state PKCE ${PKCE_METHOD}`);
+        }
+        if (signIn.registrationEndpoint === null) {
+            return refuse('NO_DYNAMIC_REGISTRATION', `The authorization server ${signIn.issuer} offers no dynamic registration`);
+        }
+        const scope = scopeOf(signIn);
+        const registered = await deps.servers.register(signIn.registrationEndpoint, { clientName: `Aeolus: ${name}`, redirectUri: deps.redirectUri, scope });
+        if (!registered.isOk) {
+            return refuse('REGISTRATION_REFUSED', `The authorization server ${signIn.issuer} refused the registration: ${registered.error.reason}`);
+        }
+        const client = {
+            issuer: signIn.issuer,
+            authorizationEndpoint: signIn.authorizationEndpoint,
+            tokenEndpoint: signIn.tokenEndpoint,
+            revocationEndpoint: signIn.revocationEndpoint,
+            isIssuerInResponse: signIn.isIssuerInResponse,
+            ...registered.value,
+            resource: signIn.resource,
+            scope,
+        };
+        return deps.approveParty({ ...input, credential: { kind: 'personSignIn', client } });
+    };
+}
+//# sourceMappingURL=add-sign-in-server.js.map

package/dist/core/parties/add-sign-in-server.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"add-sign-in-server.js","sourceRoot":"","sources":["../../../src/core/parties/add-sign-in-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAO/D,gIAAgI;AAChI,MAAM,WAAW,GAAG,MAAM,CAAC;AAE3B,wIAAwI;AACxI,MAAM,YAAY,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;AAQlD,qLAAqL;AACrL,SAAS,OAAO,CAAC,UAA4B;IAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzH,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAChH,OAAO,CAAC,GAAG,KAAK,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAOrC;IACC,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;QACjE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAChD,OAAO,MAAM,CAAC,qBAAqB,EAAE,0DAA0D,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACvD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,KAAK,cAAc,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAClH,OAAO,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,MAAM,CAAC,cAAc,EAAE,iBAAiB,IAAI,uBAAuB,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACrB,QAAQ,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC9B,KAAK,aAAa;oBAChB,OAAO,MAAM,CAAC,oBAAoB,EAAE,wCAAwC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;gBACzG,KAAK,uBAAuB;oBAC1B,OAAO,MAAM,CAAC,yBAAyB,EAAE,8CAA8C,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;gBACpH,KAAK,kBAAkB;oBACrB,OAAO,MAAM,CAAC,sBAAsB,EAAE,8CAA8C,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACnH,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACvD,OAAO,MAAM,CAAC,sBAAsB,EAAE,4BAA4B,MAAM,CAAC,MAAM,wBAAwB,WAAW,EAAE,CAAC,CAAC;QACxH,CAAC;QACD,IAAI,MAAM,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;YACzC,OAAO,MAAM,CAAC,yBAAyB,EAAE,4BAA4B,MAAM,CAAC,MAAM,iCAAiC,CAAC,CAAC;QACvH,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,oBAAoB,EAAE,EAAE,UAAU,EAAE,WAAW,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACrJ,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC,sBAAsB,EAAE,4BAA4B,MAAM,CAAC,MAAM,8BAA8B,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1I,CAAC;QACD,MAAM,MAAM,GAAiB;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;YACnD,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,GAAG,UAAU,CAAC,KAAK;YACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK;SACN,CAAC;QACF,OAAO,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACvF,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/approve-party.d.ts CHANGED Viewed

@@ -4,7 +4,7 @@ import type { RequestHasher } from '../installation/ports.js';
 import type { Clock } from '../shared/clock.js';
 import { type DomainError } from '../shared/errors.js';
 import { type Result } from '../shared/result.js';
-import type { McpServerCredential } from '../vault/credential.js';
+import type { McpServerPartyCredential } from '../vault/credential.js';
 import { type Party } from './party.js';
 import type { PartyStore, ProxyShipDoor } from './ports.js';
 import { type ShownParty } from './shown-party.js';
@@ -23,7 +23,7 @@ export type ApproveParty = (input: {
     requestId: string;
     name: string;
     url: string;
-    credential: McpServerCredential;
+    credential: McpServerPartyCredential;
     ownerShipId: ShipId;
     /** The scopes granted its proxy ship beside the ones every app ship gets (decision 0046). */
     scopes: readonly string[];

package/dist/core/parties/check-approving.d.ts CHANGED Viewed

@@ -11,7 +11,7 @@ export type CheckApproving = (input: {
     as: ActorCredential;
     name: string;
 }) => Promise<Result<undefined, ApprovingRefusal>>;
-interface ApprovingDeps {
+export interface ApprovingDeps {
     parties: PartyStore;
     connections: Pick<ConnectionStore, 'find'>;
     fleet: Pick<ProxyShipsAsActor, 'checkManage'>;
@@ -19,13 +19,14 @@ interface ApprovingDeps {
 }
 /**
  * The outside MCP server or A2A agent an actor approves, with the gateway's
- * connection: the actor holds gateway:approve, and the fleet, asked as the
+ * connection and the actor's credential: the actor holds gateway:approve, and the fleet, asked as the
  * actor, answers that it manages the party's proxy ship (A2). The fleet
  * records a refusal.
  */
 export declare function approvedParty(deps: ApprovingDeps, { actor, as, name }: Parameters<CheckApproving>[0]): Promise<Result<{
     party: McpServerParty | A2aAgentParty;
     gateway: GatewayCrew;
+    credential: ActorCredential;
 }, ApprovingRefusal>>;
 /**
  * Use case: whether an actor approves an outside MCP server or A2A agent
@@ -33,4 +34,3 @@ export declare function approvedParty(deps: ApprovingDeps, { actor, as, name }:
  * the same table read-only otherwise.
  */
 export declare function createCheckApproving(deps: ApprovingDeps): CheckApproving;
-export {};

package/dist/core/parties/check-approving.js CHANGED Viewed

@@ -3,7 +3,7 @@ import { ok } from '../shared/result.js';
 import { APPROVING_SCOPE } from './approver.js';
 /**
  * The outside MCP server or A2A agent an actor approves, with the gateway's
- * connection: the actor holds gateway:approve, and the fleet, asked as the
+ * connection and the actor's credential: the actor holds gateway:approve, and the fleet, asked as the
  * actor, answers that it manages the party's proxy ship (A2). The fleet
  * records a refusal.
  */
@@ -32,7 +32,7 @@ export async function approvedParty(deps, { actor, as, name }) {
             ? refuse('FLEET_UNAVAILABLE', `The fleet did not say whether you manage ${name}: ${managed.error.message}`)
             : refuse('NOT_REACHABLE', managed.error.message);
     }
-    return ok({ party, gateway });
+    return ok({ party, gateway, credential: credential.value });
 }
 /**
  * Use case: whether an actor approves an outside MCP server or A2A agent

package/dist/core/parties/check-approving.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"check-approving.js","sourceRoot":"","sources":["../../../src/core/parties/check-approving.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAehD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAmB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAiC;IACzG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,iBAAiB,EAAE,mDAAmD,eAAe,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,KAAK,EAAE,IAAI,KAAK,WAAW,IAAI,KAAK,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;QAC9D,OAAO,MAAM,CAAC,eAAe,EAAE,+CAA+C,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,wBAAwB,EAAE,GAAG,IAAI,uCAAuC,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,eAAe,EAAE,2CAA2C,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACrB,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9F,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa;YACzC,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,4CAA4C,IAAI,KAAK,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAC3G,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;~~AAChC~~,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAmB;IACtD,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAClD,CAAC,CAAC;AACJ,CAAC"}
1	+ {"version":3,"file":"check-approving.js","sourceRoot":"","sources":["../../../src/core/parties/check-approving.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAehD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAmB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAiC;IACzG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,iBAAiB,EAAE,mDAAmD,eAAe,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,KAAK,EAAE,IAAI,KAAK,WAAW,IAAI,KAAK,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;QAC9D,OAAO,MAAM,CAAC,eAAe,EAAE,+CAA+C,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,wBAAwB,EAAE,GAAG,IAAI,uCAAuC,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,eAAe,EAAE,2CAA2C,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACrB,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9F,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa;YACzC,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,4CAA4C,IAAI,KAAK,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAC3G,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAmB;IACtD,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAClD,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/party.d.ts CHANGED Viewed

@@ -1,5 +1,5 @@
 import type { FleetId, ShipId, VerifiedFact } from '@aeolus-fleet/common';
-import type { McpServerCredential } from '../vault/credential.js';
+import type { McpServerCredential, McpServerPartyCredential } from '../vault/credential.js';
 import type { ToolSwitches } from './tool-switches.js';
 /**
  * Where an approved party's proxy ship stands (interop I-5):
@@ -32,7 +32,7 @@ export interface McpServerParty extends PartyBase {
     readonly kind: 'mcpServer';
     /** The server's Streamable HTTP endpoint. */
     readonly url: string;
-    readonly credential: McpServerCredential;
+    readonly credential: McpServerPartyCredential;
     /** The most calls the gateway has in flight to the server at once. */
     readonly concurrencyLimit: number;
     /** Which of its tools the fleet may call; none kept yet means every tool it lists (aeolus-fleet#1151). */
@@ -67,6 +67,7 @@ export type Party = McpServerParty | McpClientParty | A2aClientParty | A2aAgentP
  * 0059): the host it reached an MCP server at over TLS, and the domain of the
  * metadata document it read an MCP client's id from over TLS. A client argo
  * registered has no document, and an address without TLS proves no host.
+ * A server where each person signs in: the issuer of the party's client.
  * The domain an A2A agent's card was read from over TLS. The gateway checks
  * nothing about an A2A client: an approver names it.
  */

package/dist/core/parties/party.js CHANGED Viewed

@@ -13,6 +13,7 @@ function tlsHostOf(address) {
  * 0059): the host it reached an MCP server at over TLS, and the domain of the
  * metadata document it read an MCP client's id from over TLS. A client argo
  * registered has no document, and an address without TLS proves no host.
+ * A server where each person signs in: the issuer of the party's client.
  * The domain an A2A agent's card was read from over TLS. The gateway checks
  * nothing about an A2A client: an approver names it.
  */
@@ -20,7 +21,9 @@ export function verifiedFactsOf(party) {
     switch (party.kind) {
         case 'mcpServer': {
             const host = tlsHostOf(party.url);
-            return host === undefined ? [] : [{ checked: 'tlsHost', value: host }];
+            const reached = host === undefined ? [] : [{ checked: 'tlsHost', value: host }];
+            // Where each person signs in, the issuer only (decision 0067): the subject it issued the party's client to, never a person's outside account.
+            return party.credential.kind === 'personSignIn' ? [...reached, { checked: 'oauthSubject', issuer: party.credential.client.issuer, value: party.credential.client.clientId }] : reached;
         }
         case 'mcpClient': {
             const host = tlsHostOf(party.clientId);

package/dist/core/parties/party.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"party.js","sourceRoot":"","sources":["../../../src/core/parties/party.ts"],"names":[],"mappings":"AAyEA,oGAAoG;AACpG,SAAS,SAAS,CAAC,OAAe;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED~~;;;;;;;GAOG~~;AACH,MAAM,UAAU,eAAe,CAAC,KAAY;IAC1C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAClC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;~~QACzE~~,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACvC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACtC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,KAAK,WAAW;YACd,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC"}
1	+ {"version":3,"file":"party.js","sourceRoot":"","sources":["../../../src/core/parties/party.ts"],"names":[],"mappings":"AAyEA,oGAAoG;AACpG,SAAS,SAAS,CAAC,OAAe;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,KAAY;IAC1C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,OAAO,GAAmB,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChG,8IAA8I;YAC9I,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACzL,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACvC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACtC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,KAAK,WAAW;YACd,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/core/parties/ports.d.ts CHANGED Viewed

@@ -118,3 +118,52 @@ export interface FleetShip {
 export interface FleetShips {
     list(as: ActorCredential): Promise<Result<FleetShip[], FleetRefusal>>;
 }
+/** What an outside MCP server says about its sign-in: its protected resource metadata (RFC 9728) and its authorization server's metadata (RFC 8414 or OpenID Connect). */
+export interface DiscoveredSignIn {
+    /** The resource indicator the server names itself by. */
+    readonly resource: string;
+    /** The scope its 401 named, if it named one. */
+    readonly challengeScope: string | null;
+    /** The scopes its protected resource metadata lists. */
+    readonly resourceScopes: readonly string[];
+    /** The authorization server's issuer, matching the one the server named. */
+    readonly issuer: string;
+    readonly authorizationEndpoint: string;
+    readonly tokenEndpoint: string;
+    readonly registrationEndpoint: string | null;
+    readonly revocationEndpoint: string | null;
+    /** Whether it states its issuer in each authorization response (RFC 9207). */
+    readonly isIssuerInResponse: boolean;
+    readonly codeChallengeMethods: readonly string[];
+    /** The scopes the authorization server lists. */
+    readonly serverScopes: readonly string[];
+}
+/**
+ * Why a server's sign-in could not be found:
+ * - noAuthorizationServer: its 401 and its well-known address name no protected resource metadata;
+ * - noServerMetadata: the authorization server it names has no metadata, or metadata whose issuer is not the one named;
+ * - unreachable: the server or its authorization server did not answer.
+ */
+export interface DiscoveryFailure {
+    readonly kind: 'noAuthorizationServer' | 'noServerMetadata' | 'unreachable';
+    readonly reason: string;
+}
+/** What dynamic registration answered (RFC 7591, 7592). */
+export interface RegisteredClient {
+    readonly clientId: string;
+    readonly clientSecret: string | null;
+    readonly registrationClientUri: string | null;
+    readonly registrationAccessToken: string | null;
+}
+/** Outbound port: outside MCP servers' authorization servers, as the gateway, an OAuth client, reaches them. */
+export interface AuthorizationServers {
+    discover(serverUrl: string): Promise<Result<DiscoveredSignIn, DiscoveryFailure>>;
+    /** Registers a confidential client for the authorization code flow; the server's own error when it refuses or does not answer. */
+    register(registrationEndpoint: string, client: {
+        clientName: string;
+        redirectUri: string;
+        scope: string;
+    }): Promise<Result<RegisteredClient, {
+        readonly reason: string;
+    }>>;
+}