@aeolus-fleet/gateway 0.32.2 → 0.34.0

package/dist/core/parties/read-party-tools.d.ts

@@ -1,5 +1,6 @@
 import type { FleetId } from '@aeolus-fleet/common';
 import type { McpServers } from '../mcp-out/ports.js';
+import type { ListingConnectionOf } from '../party-grants/listing-connection.js';
 import { type DomainError } from '../shared/errors.js';
 import { type Result } from '../shared/result.js';
 import type { PartyStore } from './ports.js';
@@ -9,10 +10,11 @@ export type ReadPartyTools = (party: {
     name: string;
 }) => Promise<Result<{
     tools: SwitchedTool[];
-}, DomainError<'NO_SUCH_PARTY' | 'SERVER_UNREACHABLE'>>>;
+}, DomainError<'NO_SUCH_PARTY' | 'NOT_SIGNED_IN' | 'SERVER_UNREACHABLE'>>>;
 /**
  * Use case: an outside MCP server's tools, as the server lists them now,
- * asked with the credential the gateway keeps for it, each with its switch
+ * asked with the credential the gateway keeps for it, or under a person's
+ * grant where each person signs in (decision 0067), each with its switch
  * (aeolus-fleet#1151). It keeps nothing:
  * the proxy ship's statement in the fleet is where the tools live, and
  * core does not answer a statement to a reader yet, so the server is asked.
@@ -20,4 +22,5 @@ export type ReadPartyTools = (party: {
 export declare function createReadPartyTools(deps: {
     parties: PartyStore;
     servers: McpServers;
+    connectionOf: ListingConnectionOf;
 }): ReadPartyTools;

package/dist/core/parties/read-party-tools.js

@@ -3,7 +3,8 @@ import { ok } from '../shared/result.js';
 import { switchedToolsOf } from './tool-switches.js';
 /**
  * Use case: an outside MCP server's tools, as the server lists them now,
- * asked with the credential the gateway keeps for it, each with its switch
+ * asked with the credential the gateway keeps for it, or under a person's
+ * grant where each person signs in (decision 0067), each with its switch
  * (aeolus-fleet#1151). It keeps nothing:
  * the proxy ship's statement in the fleet is where the tools live, and
  * core does not answer a statement to a reader yet, so the server is asked.
@@ -14,7 +15,11 @@ export function createReadPartyTools(deps) {
         if (party?.kind !== 'mcpServer') {
             return refuse('NO_SUCH_PARTY', `There is no outside MCP server ${name}`);
         }
-        const listed = await deps.servers.listTools({ url: party.url, credential: party.credential });
+        const connection = await deps.connectionOf(party);
+        if (connection === undefined) {
+            return refuse('NOT_SIGNED_IN', `Nobody holds a usable sign-in to ${name}, so its tools cannot be listed`);
+        }
+        const listed = await deps.servers.listTools(connection);
         if (!listed.isOk) {
             return refuse('SERVER_UNREACHABLE', `The MCP server of ${name} could not be listed: ${listed.error.reason}`);
         }

package/dist/core/parties/read-party-tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"read-party-tools.js","sourceRoot":"","sources":["../../../src/core/parties/read-party-tools.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAqB,MAAM,oBAAoB,CAAC;AAIxE;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAkD;IACrF,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,IAAI,KAAK,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC,eAAe,EAAE,kCAAkC,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9F,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,oBAAoB,EAAE,qBAAqB,IAAI,yBAAyB,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"read-party-tools.js","sourceRoot":"","sources":["../../../src/core/parties/read-party-tools.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAqB,MAAM,oBAAoB,CAAC;AAIxE;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAqF;IACxH,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,IAAI,KAAK,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC,eAAe,EAAE,kCAAkC,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC,eAAe,EAAE,oCAAoC,IAAI,iCAAiC,CAAC,CAAC;QAC5G,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,oBAAoB,EAAE,qBAAqB,IAAI,yBAAyB,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/retire-party.d.ts

@@ -1,6 +1,7 @@
 import type { Actor } from '../actors/authenticate-actor.js';
 import type { ActorCredential, CredentialOf } from '../actors/credential-of.js';
 import type { IssuedTokens } from '../oauth/ports.js';
+import type { EndPartyGrants } from '../party-grants/end-party-grants.js';
 import { type DomainError } from '../shared/errors.js';
 import { type Result } from '../shared/result.js';
 import type { PartyStore, ProxyShipsAsActor } from './ports.js';
@@ -17,7 +18,9 @@ export type RetireParty = (input: {
  * 0056). Its proxy ship is retired in the fleet as the actor, so the fleet
  * checks its manage reach, and only then does the gateway forget the party
  * and revoke its client's tokens; its worker ends as the fleet ends the
- * proxy ship's crew. A proxy ship retired already is retired. A party whose
+ * proxy ship's crew. A server where each person signs in has every grant
+ * ended and its client deleted where offered (decision 0067) before it is
+ * forgotten. A proxy ship retired already is retired. A party whose
  * ship the gateway never learned asks the fleet nothing. Adding it again is
  * a new request.
  */
@@ -25,5 +28,6 @@ export declare function createRetireParty(deps: {
     parties: PartyStore;
     fleet: ProxyShipsAsActor;
     tokens: Pick<IssuedTokens, 'revokeParty'>;
+    endPartyGrants: EndPartyGrants;
     credentialOf: CredentialOf;
 }): RetireParty;

package/dist/core/parties/retire-party.js

@@ -9,7 +9,9 @@ const RETIRED_ALREADY = 'CONFLICT';
  * 0056). Its proxy ship is retired in the fleet as the actor, so the fleet
  * checks its manage reach, and only then does the gateway forget the party
  * and revoke its client's tokens; its worker ends as the fleet ends the
- * proxy ship's crew. A proxy ship retired already is retired. A party whose
+ * proxy ship's crew. A server where each person signs in has every grant
+ * ended and its client deleted where offered (decision 0067) before it is
+ * forgotten. A proxy ship retired already is retired. A party whose
  * ship the gateway never learned asks the fleet nothing. Adding it again is
  * a new request.
  */
@@ -35,6 +37,9 @@ export function createRetireParty(deps) {
                 return refuse('RETIRE_REFUSED', retired.error.message);
             }
         }
+        if (party.kind === 'mcpServer' && party.credential.kind === 'personSignIn') {
+            await deps.endPartyGrants({ fleetId: actor.fleetId, name, client: party.credential.client });
+        }
         await deps.parties.remove(actor.fleetId, name);
         await deps.tokens.revokeParty(actor.fleetId, name);
         return ok(undefined);

package/dist/core/parties/retire-party.js.map

@@ -1 +1 @@
-{"version":3,"file":"retire-party.js","sourceRoot":"","sources":["../../../src/core/parties/retire-party.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAGtD,uFAAuF;AACvF,MAAM,CAAC,MAAM,cAAc,GAAG,cAAc,CAAC;AAE7C,uFAAuF;AACvF,MAAM,eAAe,GAAG,UAAU,CAAC;AAMnC;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA8H;IAC9J,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;QACnC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC3C,OAAO,MAAM,CAAC,eAAe,EAAE,mCAAmC,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC3D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,MAAM,CAAC,eAAe,EAAE,6BAA6B,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACtD,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBACrB,OAAO,UAAU,CAAC;YACpB,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;YACzF,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAC1D,OAAO,MAAM,CAAC,mBAAmB,EAAE,4BAA4B,IAAI,kBAAkB,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChH,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gBAC5D,OAAO,MAAM,CAAC,gBAAgB,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC/C,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"retire-party.js","sourceRoot":"","sources":["../../../src/core/parties/retire-party.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAGtD,uFAAuF;AACvF,MAAM,CAAC,MAAM,cAAc,GAAG,cAAc,CAAC;AAE7C,uFAAuF;AACvF,MAAM,eAAe,GAAG,UAAU,CAAC;AAMnC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA8J;IAC9L,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;QACnC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC3C,OAAO,MAAM,CAAC,eAAe,EAAE,mCAAmC,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC3D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,MAAM,CAAC,eAAe,EAAE,6BAA6B,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACtD,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBACrB,OAAO,UAAU,CAAC;YACpB,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;YACzF,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAC1D,OAAO,MAAM,CAAC,mBAAmB,EAAE,4BAA4B,IAAI,kBAAkB,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChH,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gBAC5D,OAAO,MAAM,CAAC,gBAAgB,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAC3E,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC/C,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/shown-party.d.ts

@@ -1,5 +1,5 @@
 import type { ShipId } from '@aeolus-fleet/common';
-import type { McpServerCredential } from '../vault/credential.js';
+import type { McpServerCredential, McpServerPartyCredential } from '../vault/credential.js';
 import type { Party, PartyState } from './party.js';
 interface ShownPartyBase {
     name: string;
@@ -10,7 +10,7 @@ interface ShownPartyBase {
 export type ShownParty = (ShownPartyBase & {
     kind: 'mcpServer';
     url: string;
-    credentialKind: McpServerCredential['kind'];
+    credentialKind: McpServerPartyCredential['kind'];
     concurrencyLimit: number;
 }) | (ShownPartyBase & {
     kind: 'mcpClient';

package/dist/core/parties/sign-in-servers.d.ts

@@ -0,0 +1,4 @@
+import type { SignInServers } from '../party-grants/ports.js';
+import type { PartyStore } from './ports.js';
+/** Parties published to Party Grants: an approved outside MCP server is a sign-in server, with its client where each person signs in. */
+export declare function signInServersOf(parties: Pick<PartyStore, 'find'>): SignInServers;

package/dist/core/parties/sign-in-servers.js

@@ -0,0 +1,13 @@
+/** Parties published to Party Grants: an approved outside MCP server is a sign-in server, with its client where each person signs in. */
+export function signInServersOf(parties) {
+    return {
+        async find(fleetId, name) {
+            const party = await parties.find(fleetId, name);
+            if (party?.kind !== 'mcpServer') {
+                return undefined;
+            }
+            return { fleetId: party.fleetId, name: party.name, client: party.credential.kind === 'personSignIn' ? party.credential.client : null };
+        },
+    };
+}
+//# sourceMappingURL=sign-in-servers.js.map

package/dist/core/parties/sign-in-servers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in-servers.js","sourceRoot":"","sources":["../../../src/core/parties/sign-in-servers.ts"],"names":[],"mappings":"AAGA,yIAAyI;AACzI,MAAM,UAAU,eAAe,CAAC,OAAiC;IAC/D,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI;YACtB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAChD,IAAI,KAAK,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;gBAChC,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzI,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/core/parties/switch-tools.d.ts

@@ -3,11 +3,12 @@ import type { ActorCredential, CredentialOf } from '../actors/credential-of.js';
 import type { ConnectionStore } from '../connection/ports.js';
 import type { McpServers } from '../mcp-out/ports.js';
 import type { StateParty } from '../mcp-out/state-party.js';
+import type { ListingConnectionOf } from '../party-grants/listing-connection.js';
 import { type DomainError } from '../shared/errors.js';
 import { type Result } from '../shared/result.js';
 import { type ApprovingRefusal } from './check-approving.js';
 import type { PartyStore, ProxyShipsAsActor } from './ports.js';
-export type SwitchToolsRefusal = ApprovingRefusal | DomainError<'SERVER_UNREACHABLE' | 'NO_SUCH_TOOL'>;
+export type SwitchToolsRefusal = ApprovingRefusal | DomainError<'NOT_SIGNED_IN' | 'SERVER_UNREACHABLE' | 'NO_SUCH_TOOL'>;
 export type SwitchTools = (input: {
     actor: Actor;
     as: ActorCredential;
@@ -32,6 +33,7 @@ export type SwitchTools = (input: {
 export declare function createSwitchTools(deps: {
     parties: PartyStore;
     servers: McpServers;
+    connectionOf: ListingConnectionOf;
     stateParty: StateParty;
     connections: Pick<ConnectionStore, 'find'>;
     fleet: Pick<ProxyShipsAsActor, 'checkManage'>;

package/dist/core/parties/switch-tools.js

@@ -21,7 +21,11 @@ export function createSwitchTools(deps) {
         if (party.kind !== 'mcpServer') {
             return refuse('NO_SUCH_PARTY', `There is no outside MCP server ${name}`);
         }
-        const listed = await deps.servers.listTools({ url: party.url, credential: party.credential });
+        const connection = await deps.connectionOf(party);
+        if (connection === undefined) {
+            return refuse('NOT_SIGNED_IN', `Nobody holds a usable sign-in to ${name}, so its tools cannot be listed`);
+        }
+        const listed = await deps.servers.listTools(connection);
         if (!listed.isOk) {
             return refuse('SERVER_UNREACHABLE', `The MCP server of ${name} could not be listed: ${listed.error.reason}`);
         }

package/dist/core/parties/switch-tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"switch-tools.js","sourceRoot":"","sources":["../../../src/core/parties/switch-tools.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAyB,MAAM,sBAAsB,CAAC;AAS5E;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAOjC;IACC,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;QAChD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC;QACjC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC,eAAe,EAAE,kCAAkC,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9F,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,oBAAoB,EAAE,qBAAqB,IAAI,yBAAyB,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,MAAM,CAAC,cAAc,EAAE,qBAAqB,IAAI,kBAAkB,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxG,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1I,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACtG,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"switch-tools.js","sourceRoot":"","sources":["../../../src/core/parties/switch-tools.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAyB,MAAM,sBAAsB,CAAC;AAS5E;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAQjC;IACC,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;QAChD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC;QACjC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC,eAAe,EAAE,kCAAkC,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC,eAAe,EAAE,oCAAoC,IAAI,iCAAiC,CAAC,CAAC;QAC5G,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,oBAAoB,EAAE,qBAAqB,IAAI,yBAAyB,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,MAAM,CAAC,cAAc,EAAE,qBAAqB,IAAI,kBAAkB,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxG,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1I,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACtG,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/party-grants/approved-sign-in-party.d.ts

@@ -0,0 +1,17 @@
+import type { ActorCredential } from '../actors/credential-of.js';
+import type { ApprovingDeps, ApprovingRefusal, CheckApproving } from '../parties/check-approving.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { SignInClient } from '../vault/credential.js';
+export type ApprovedSignInPartyRefusal = ApprovingRefusal | DomainError<'NO_SIGN_IN'>;
+/**
+ * The outside MCP server where each person signs in whose grants an approver
+ * sees and removes (decision 0067, Q6, Q12): the actor holds gateway:approve
+ * within manage reach of its proxy ship, as the fleet answers; its name and
+ * client, and the actor's credential to read the fleet as.
+ */
+export declare function approvedSignInParty(deps: ApprovingDeps, asked: Parameters<CheckApproving>[0]): Promise<Result<{
+    name: string;
+    client: SignInClient;
+    credential: ActorCredential;
+}, ApprovedSignInPartyRefusal>>;

package/dist/core/party-grants/approved-sign-in-party.js

@@ -0,0 +1,21 @@
+import { approvedParty } from '../parties/check-approving.js';
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+/**
+ * The outside MCP server where each person signs in whose grants an approver
+ * sees and removes (decision 0067, Q6, Q12): the actor holds gateway:approve
+ * within manage reach of its proxy ship, as the fleet answers; its name and
+ * client, and the actor's credential to read the fleet as.
+ */
+export async function approvedSignInParty(deps, asked) {
+    const approved = await approvedParty(deps, asked);
+    if (!approved.isOk) {
+        return approved;
+    }
+    const { party, credential } = approved.value;
+    if (party.kind !== 'mcpServer' || party.credential.kind !== 'personSignIn') {
+        return refuse('NO_SIGN_IN', `Nobody signs in to ${party.name} for themselves: the gateway calls it with its own credential`);
+    }
+    return ok({ name: party.name, client: party.credential.client, credential });
+}
+//# sourceMappingURL=approved-sign-in-party.js.map

package/dist/core/party-grants/approved-sign-in-party.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approved-sign-in-party.js","sourceRoot":"","sources":["../../../src/core/party-grants/approved-sign-in-party.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAKtD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAmB,EAAE,KAAoC;IACjG,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC7C,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAC3E,OAAO,MAAM,CAAC,YAAY,EAAE,sBAAsB,KAAK,CAAC,IAAI,+DAA+D,CAAC,CAAC;IAC/H,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;AAC/E,CAAC"}

package/dist/core/party-grants/call-grant.d.ts

@@ -0,0 +1,46 @@
+import type { FleetId, ShipId } from '@aeolus-fleet/common';
+import type { ConnectionStore, FleetDoor } from '../connection/ports.js';
+import type { PartyGrant } from './party-grant.js';
+import type { PartyGrants } from './ports.js';
+/** A person a call is for: their person ship, by id and name. */
+export interface CallPerson {
+    readonly shipId: ShipId;
+    readonly name: string;
+}
+/**
+ * Whose grant a call goes out under:
+ * - grant: the person who owns the asking ship holds one for the party;
+ * - notSignedIn: they hold none, or a lost one (Q5);
+ * - noPerson: argo owns the asking ship, or it is argo, so no person can sign in for it (Q10);
+ * - unread: core did not answer the owner read, so the call waits and is tried again, never made without its person's grant.
+ */
+export type CallGrant = {
+    readonly kind: 'grant';
+    readonly grant: PartyGrant;
+    readonly person: CallPerson;
+} | {
+    readonly kind: 'notSignedIn';
+    readonly person: CallPerson;
+} | {
+    readonly kind: 'noPerson';
+    readonly shipName: string;
+} | {
+    readonly kind: 'unread';
+};
+export type CallGrantOf = (call: {
+    fleetId: FleetId;
+    party: string;
+    senderShipId: ShipId;
+}) => Promise<CallGrant>;
+/**
+ * The grant a call to a server where each person signs in goes out under
+ * (decision 0067, Q1, Q11): the grant of the person who owns the asking
+ * ship, a person ship owning itself. The owner is read from core at each
+ * hand-over, as the gateway's ship on the asking ship's behalf, as the scope
+ * check reads it: a change of owner holds from the next call.
+ */
+export declare function createCallGrantOf(deps: {
+    connections: Pick<ConnectionStore, 'find'>;
+    door: Pick<FleetDoor, 'getShip'>;
+    grants: Pick<PartyGrants, 'ofPerson'>;
+}): CallGrantOf;

package/dist/core/party-grants/call-grant.js

@@ -0,0 +1,30 @@
+/** argo's name, which core reserves for it: an owner of this name is argo, never a person (decision 0045). */
+const ARGO_NAME = 'argo';
+/**
+ * The grant a call to a server where each person signs in goes out under
+ * (decision 0067, Q1, Q11): the grant of the person who owns the asking
+ * ship, a person ship owning itself. The owner is read from core at each
+ * hand-over, as the gateway's ship on the asking ship's behalf, as the scope
+ * check reads it: a change of owner holds from the next call.
+ */
+export function createCallGrantOf(deps) {
+    return async ({ fleetId, party, senderShipId }) => {
+        const gateway = await deps.connections.find(fleetId);
+        if (gateway === undefined) {
+            return { kind: 'unread' };
+        }
+        const ship = await deps.door.getShip(gateway.crewToken, { shipId: senderShipId, onBehalfOf: senderShipId });
+        if (!ship.isOk) {
+            return { kind: 'unread' };
+        }
+        const { owner } = ship.value;
+        if (owner === null || owner.name === ARGO_NAME) {
+            return { kind: 'noPerson', shipName: ship.value.name };
+        }
+        const person = { shipId: owner.shipId, name: owner.name };
+        const grant = await deps.grants.ofPerson(fleetId, { party, personShipId: owner.shipId });
+        // None, or a lost one, alike.
+        return grant?.lost !== null ? { kind: 'notSignedIn', person } : { kind: 'grant', grant, person };
+    };
+}
+//# sourceMappingURL=call-grant.js.map

package/dist/core/party-grants/call-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"call-grant.js","sourceRoot":"","sources":["../../../src/core/party-grants/call-grant.ts"],"names":[],"mappings":"AAMA,8GAA8G;AAC9G,MAAM,SAAS,GAAG,MAAM,CAAC;AAuBzB;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA6H;IAC7J,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE;QAChD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC;QAC5G,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAC7B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/C,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACzD,CAAC;QACD,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACzF,8BAA8B;QAC9B,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACnG,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/party-grants/complete-party-sign-in.d.ts

@@ -0,0 +1,52 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { AccountOfSignIn } from '../account-sign-in/account-of-sign-in.js';
+import type { Clock } from '../shared/clock.js';
+import type { DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { PartyGrants, PartySignIns, PartySignInSeals, SignInNotices, SignInServers, StatesProxyShip } from './ports.js';
+/** The party's page a refusal goes back to: none when the state names no sign-in the gateway started. */
+export interface SignInPage {
+    readonly fleetId: FleetId;
+    readonly party: string;
+}
+export type CompletePartySignInRefusal = DomainError<'SIGN_IN_FAILED' | 'NOT_SIGNED_IN' | 'TURNED_AWAY' | 'AUTHORIZATION_SERVER_UNREACHABLE' | 'NO_SUCH_PARTY'> & {
+    readonly at: SignInPage | null;
+    /** The OAuth error code the authorization server answered, if it answered one. */
+    readonly serverError: string | null;
+};
+export type CompletePartySignIn = (back: {
+    state: string | undefined;
+    code: string | undefined;
+    error: string | undefined;
+    /** The issuer the authorization response names (RFC 9207), if it names one. */
+    iss: string | undefined;
+    /** The browser's shared sign-in, as pagasae's cookie carries it. */
+    signIn: string | undefined;
+}) => Promise<Result<SignInPage & {
+    statementRefusal: string | null;
+}, CompletePartySignInRefusal>>;
+/**
+ * Use case: the outside authorization server sends a person back from
+ * signing in to a party for themselves (decision 0067). Within the sign-in's
+ * ten minutes, in a browser whose shared sign-in names the account that
+ * started it, and with the party's issuer where the response names one or
+ * the server states it always does (RFC 9207), the code is redeemed with
+ * the party's client and the sign-in's PKCE verifier; else it is never
+ * redeemed. A person who denied consent is not signed in. Where the ID
+ * token names an outside account another person's grant already names, the
+ * person is turned away and the tokens are dropped (Q13). Else the grant is
+ * kept in place of the person's earlier one, the notice that told them a
+ * call needed it is closed, so a later loss tells them again (Q6), and the
+ * proxy ship is stated from it (Q15). Nothing is kept on any refusal.
+ */
+export declare function createCompletePartySignIn(deps: {
+    servers: SignInServers;
+    grants: Pick<PartyGrants, 'ofSubject' | 'keep'>;
+    seals: PartySignInSeals;
+    signIns: Pick<PartySignIns, 'redeemCode'>;
+    notices: Pick<SignInNotices, 'close'>;
+    accountOf: (asked: Parameters<AccountOfSignIn>[0]) => ReturnType<AccountOfSignIn>;
+    stateParty: StatesProxyShip;
+    clock: Clock;
+    redirectUri: string;
+}): CompletePartySignIn;

package/dist/core/party-grants/complete-party-sign-in.js

@@ -0,0 +1,95 @@
+import { err, ok } from '../shared/result.js';
+import { accessTokenEndsAtOf } from './party-grant.js';
+function refused(at, refusal) {
+    return err({ serverError: null, ...refusal, at });
+}
+/** The outside account an ID token names, once it is checked to be the party's issuer's, for the party's client; none when it is not. */
+function outsideAccountOf(idToken, client) {
+    if (idToken === null) {
+        return { subject: null, name: null };
+    }
+    // Redeemed over TLS straight from the token endpoint, so its issuer and audience are what is left to check (OpenID Connect Core 3.1.3.7).
+    if (idToken.issuer !== client.issuer || !idToken.audiences.includes(client.clientId)) {
+        return undefined;
+    }
+    return { subject: idToken.subject, name: idToken.name };
+}
+/**
+ * Use case: the outside authorization server sends a person back from
+ * signing in to a party for themselves (decision 0067). Within the sign-in's
+ * ten minutes, in a browser whose shared sign-in names the account that
+ * started it, and with the party's issuer where the response names one or
+ * the server states it always does (RFC 9207), the code is redeemed with
+ * the party's client and the sign-in's PKCE verifier; else it is never
+ * redeemed. A person who denied consent is not signed in. Where the ID
+ * token names an outside account another person's grant already names, the
+ * person is turned away and the tokens are dropped (Q13). Else the grant is
+ * kept in place of the person's earlier one, the notice that told them a
+ * call needed it is closed, so a later loss tells them again (Q6), and the
+ * proxy ship is stated from it (Q15). Nothing is kept on any refusal.
+ */
+export function createCompletePartySignIn(deps) {
+    return async ({ state, code, error, iss, signIn }) => {
+        const now = deps.clock.now();
+        const underWay = state === undefined ? undefined : deps.seals.open(state);
+        if (underWay === undefined || underWay.expiresAt <= now) {
+            return refused(null, { kind: 'SIGN_IN_FAILED', message: 'This sign-in did not start at the gateway, or took longer than ten minutes: press Sign in again' });
+        }
+        const { fleetId, party: name, accountId, personShipId, verifier } = underWay;
+        const at = { fleetId, party: name };
+        const signedIn = signIn === undefined ? undefined : await deps.accountOf({ signIn, fleetId });
+        if (signedIn === undefined || !signedIn.isOk || signedIn.value.accountId !== accountId) {
+            return refused(at, { kind: 'SIGN_IN_FAILED', message: 'This sign-in was started by another account or browser: sign in and press Sign in again' });
+        }
+        const server = await deps.servers.find(fleetId, name);
+        if (server === undefined || server.client === null) {
+            return refused(at, { kind: 'NO_SUCH_PARTY', message: `There is no outside MCP server ${name} to sign in to any more` });
+        }
+        const { client } = server;
+        if (error !== undefined || code === undefined) {
+            return refused(at, { kind: 'NOT_SIGNED_IN', message: `You are not signed in to ${name}: the sign-in was cancelled or refused there`, serverError: error ?? null });
+        }
+        if (iss === undefined ? client.isIssuerInResponse : iss !== client.issuer) {
+            return refused(at, { kind: 'SIGN_IN_FAILED', message: `The sign-in came back without the issuer of ${name}, ${client.issuer}: press Sign in again` });
+        }
+        const redeemed = await deps.signIns.redeemCode(client, { code, verifier, redirectUri: deps.redirectUri });
+        if (!redeemed.isOk) {
+            return redeemed.error.kind === 'refused'
+                ? refused(at, { kind: 'SIGN_IN_FAILED', message: `${client.issuer} refused the sign-in: ${redeemed.error.reason}`, serverError: redeemed.error.error })
+                : refused(at, { kind: 'AUTHORIZATION_SERVER_UNREACHABLE', message: `${client.issuer} did not answer: ${redeemed.error.reason}` });
+        }
+        const tokens = redeemed.value;
+        const outsideAccount = outsideAccountOf(tokens.idToken, client);
+        if (outsideAccount === undefined) {
+            return refused(at, { kind: 'SIGN_IN_FAILED', message: `${client.issuer} answered an ID token that is not its own for this server's client: press Sign in again` });
+        }
+        const turnedAway = () => refused(at, { kind: 'TURNED_AWAY', message: `That ${name} account is another person's sign-in in this fleet: sign in as your own` });
+        const { subject } = outsideAccount;
+        const holder = subject === null ? undefined : await deps.grants.ofSubject(fleetId, { party: name, subject });
+        if (holder !== undefined && holder.personShipId !== personShipId) {
+            return turnedAway();
+        }
+        const kept = await deps.grants.keep({
+            fleetId,
+            party: name,
+            personShipId,
+            accountId,
+            outsideAccount,
+            accessToken: tokens.accessToken,
+            refreshToken: tokens.refreshToken,
+            accessTokenEndsAt: accessTokenEndsAtOf(now, tokens.expiresInSeconds),
+            signedInAt: now,
+            refreshedAt: null,
+            lastUsedAt: null,
+            lost: null,
+        });
+        if (kept === 'subjectTaken') {
+            // Another person signed in as the same outside account meanwhile.
+            return turnedAway();
+        }
+        await deps.notices.close(fleetId, { party: name, personShipId });
+        const stated = await deps.stateParty({ fleetId, name });
+        return ok({ ...at, statementRefusal: stated.isOk ? null : stated.error.message });
+    };
+}
+//# sourceMappingURL=complete-party-sign-in.js.map

package/dist/core/party-grants/complete-party-sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"complete-party-sign-in.js","sourceRoot":"","sources":["../../../src/core/party-grants/complete-party-sign-in.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAE3D,OAAO,EAAE,mBAAmB,EAAuB,MAAM,kBAAkB,CAAC;AAyB5E,SAAS,OAAO,CAAC,EAAqB,EAAE,OAAqH;IAC3J,OAAO,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,yIAAyI;AACzI,SAAS,gBAAgB,CAAC,OAA6B,EAAE,MAAoB;IAC3E,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;IACD,0IAA0I;IAC1I,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAUzC;IACC,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1E,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;YACxD,OAAO,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,iGAAiG,EAAE,CAAC,CAAC;QAC/J,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;QAC7E,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9F,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACvF,OAAO,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,yFAAyF,EAAE,CAAC,CAAC;QACrJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACtD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACnD,OAAO,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,kCAAkC,IAAI,yBAAyB,EAAE,CAAC,CAAC;QAC1H,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9C,OAAO,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,4BAA4B,IAAI,8CAA8C,EAAE,WAAW,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC;QACrK,CAAC;QACD,IAAI,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YAC1E,OAAO,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,+CAA+C,IAAI,KAAK,MAAM,CAAC,MAAM,uBAAuB,EAAE,CAAC,CAAC;QACxJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1G,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;gBACtC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,yBAAyB,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACvJ,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,kCAAkC,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,oBAAoB,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACtI,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC;QAC9B,MAAM,cAAc,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAChE,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,yFAAyF,EAAE,CAAC,CAAC;QACrK,CAAC;QACD,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,IAAI,yEAAyE,EAAE,CAAC,CAAC;QAC9J,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QACnC,MAAM,MAAM,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7G,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;YACjE,OAAO,UAAU,EAAE,CAAC;QACtB,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YAClC,OAAO;YACP,KAAK,EAAE,IAAI;YACX,YAAY;YACZ,SAAS;YACT,cAAc;YACd,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,iBAAiB,EAAE,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,gBAAgB,CAAC;YACpE,UAAU,EAAE,GAAG;YACf,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QACH,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YAC5B,kEAAkE;YAClE,OAAO,UAAU,EAAE,CAAC;QACtB,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACpF,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/party-grants/end-account-grants.d.ts

@@ -0,0 +1,18 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { PartyGrants, PartySignIns, SignInServers } from './ports.js';
+export type EndAccountGrants = (account: {
+    fleetId: FleetId;
+    accountId: string;
+}) => Promise<void>;
+/**
+ * Use case: pagasae disabled the account and tells the gateway (decision
+ * 0067, Q14), so a leaver's outside accounts stop acting for the fleet when
+ * their access does: every grant of the account in the fleet ends, as every
+ * grant ends. Its ships then answer as Q5 until a new owner signs in. Told
+ * again, it ends nothing more.
+ */
+export declare function createEndAccountGrants(deps: {
+    servers: SignInServers;
+    grants: Pick<PartyGrants, 'ofAccount' | 'remove'>;
+    signIns: Pick<PartySignIns, 'revoke'>;
+}): EndAccountGrants;

package/dist/core/party-grants/end-account-grants.js

@@ -0,0 +1,16 @@
+import { endPartyGrant } from './end-grant.js';
+/**
+ * Use case: pagasae disabled the account and tells the gateway (decision
+ * 0067, Q14), so a leaver's outside accounts stop acting for the fleet when
+ * their access does: every grant of the account in the fleet ends, as every
+ * grant ends. Its ships then answer as Q5 until a new owner signs in. Told
+ * again, it ends nothing more.
+ */
+export function createEndAccountGrants(deps) {
+    return async ({ fleetId, accountId }) => {
+        for (const grant of await deps.grants.ofAccount(fleetId, accountId)) {
+            await endPartyGrant(deps, grant);
+        }
+    };
+}
+//# sourceMappingURL=end-account-grants.js.map

package/dist/core/party-grants/end-account-grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"end-account-grants.js","sourceRoot":"","sources":["../../../src/core/party-grants/end-account-grants.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAK/C;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAA0H;IAC/J,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE;QACtC,KAAK,MAAM,KAAK,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;YACpE,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/party-grants/end-grant.d.ts

@@ -0,0 +1,23 @@
+import type { SignInClient } from '../vault/credential.js';
+import type { PartyGrant } from './party-grant.js';
+import type { PartyGrants, PartySignIns, SignInServers } from './ports.js';
+/**
+ * Ends a person's grant of a party (decision 0067, Q6): where the
+ * authorization server offers revocation (RFC 7009), the refresh token is
+ * revoked, then the access token; the grant is dropped either way, so the
+ * person's ships call under it no more. Answers whether the server revoked
+ * its tokens: false where it offers no revocation or did not answer.
+ */
+export declare function endGrant(deps: {
+    grants: Pick<PartyGrants, 'remove'>;
+    signIns: Pick<PartySignIns, 'revoke'>;
+}, ending: {
+    client: SignInClient;
+    grant: PartyGrant;
+}): Promise<boolean>;
+/** Ends a grant with its party's client; a grant of a party the gateway no longer holds has no client left to revoke with, and is only dropped. */
+export declare function endPartyGrant(deps: {
+    servers: SignInServers;
+    grants: Pick<PartyGrants, 'remove'>;
+    signIns: Pick<PartySignIns, 'revoke'>;
+}, grant: PartyGrant): Promise<void>;

package/dist/core/party-grants/end-grant.js

@@ -0,0 +1,33 @@
+/**
+ * Ends a person's grant of a party (decision 0067, Q6): where the
+ * authorization server offers revocation (RFC 7009), the refresh token is
+ * revoked, then the access token; the grant is dropped either way, so the
+ * person's ships call under it no more. Answers whether the server revoked
+ * its tokens: false where it offers no revocation or did not answer.
+ */
+export async function endGrant(deps, ending) {
+    const { client, grant } = ending;
+    let isRevoked = false;
+    const { revocationEndpoint } = client;
+    if (revocationEndpoint !== null) {
+        const tokens = grant.refreshToken === null ? [grant.accessToken] : [grant.refreshToken, grant.accessToken];
+        const revoked = [];
+        for (const token of tokens) {
+            revoked.push(await deps.signIns.revoke({ ...client, revocationEndpoint }, token));
+        }
+        isRevoked = revoked.every((each) => each.isOk);
+    }
+    await deps.grants.remove(grant.fleetId, { party: grant.party, personShipId: grant.personShipId });
+    return isRevoked;
+}
+/** Ends a grant with its party's client; a grant of a party the gateway no longer holds has no client left to revoke with, and is only dropped. */
+export async function endPartyGrant(deps, grant) {
+    const server = await deps.servers.find(grant.fleetId, grant.party);
+    if (server?.client === null || server?.client === undefined) {
+        await deps.grants.remove(grant.fleetId, grant);
+    }
+    else {
+        await endGrant(deps, { client: server.client, grant });
+    }
+}
+//# sourceMappingURL=end-grant.js.map

package/dist/core/party-grants/end-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"end-grant.js","sourceRoot":"","sources":["../../../src/core/party-grants/end-grant.ts"],"names":[],"mappings":"AAIA;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAoF,EAAE,MAAmD;IACtK,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IACjC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC;IACtC,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3G,MAAM,OAAO,GAAG,EAAE,CAAC;QACnB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,kBAAkB,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;QACpF,CAAC;QACD,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;IAClG,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,mJAAmJ;AACnJ,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAA4G,EAAE,KAAiB;IACjK,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACnE,IAAI,MAAM,EAAE,MAAM,KAAK,IAAI,IAAI,MAAM,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;QAC5D,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC"}

package/dist/core/party-grants/end-party-grants.d.ts

@@ -0,0 +1,19 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { SignInClient } from '../vault/credential.js';
+import type { PartyGrants, PartySignIns } from './ports.js';
+export type EndPartyGrants = (party: {
+    fleetId: FleetId;
+    name: string;
+    client: SignInClient;
+}) => Promise<void>;
+/**
+ * Use case: a party where each person signs in is retired (decision 0067,
+ * scenario 31). Every person's grant of it ends, as every grant ends, and
+ * the party's client is deleted where the authorization server answered its
+ * client configuration endpoint at registration (RFC 7592), so no grant
+ * outlives the party there.
+ */
+export declare function createEndPartyGrants(deps: {
+    grants: Pick<PartyGrants, 'ofParty' | 'remove'>;
+    signIns: Pick<PartySignIns, 'revoke' | 'deleteClient'>;
+}): EndPartyGrants;