@aeolus-fleet/gateway 0.32.2 → 0.34.0

package/dist/adapters/http/slack-routes.js

@@ -0,0 +1,188 @@
+/**
+ * Slack's doors at the gateway (gateway scopes, part B): `/gw/slack/install`
+ * is where Slack's install screen sends the person back with a code and the
+ * state the gateway sealed. The person goes on to the Slack page, which says
+ * how the install went by its outcome in the address, never by a text the
+ * address carries. `/gw/slack/link` is where Sign in with Slack sends them
+ * back to link, with the browser's shared sign-in so the link binds to the
+ * account that started it, going on to the Overview the same way; a link refused for
+ * one kept already carries the first link's name. `/gw/slack/events` takes
+ * the events of the apps the gateway made, and `/gw/slack/actions` a press
+ * of a button under a question it posted, each read as its raw body so its
+ * signature can be checked.
+ */
+import { idSchema } from '@aeolus-fleet/common';
+import { z } from 'zod';
+import { SHARED_SIGN_IN_COOKIE } from '../../core/account-sign-in/ports.js';
+import { cookieValueOf } from './account-sign-in-routes.js';
+export const SLACK_INSTALL_PATH = '/gw/slack/install';
+export const SLACK_EVENTS_PATH = '/gw/slack/events';
+export const SLACK_LINK_PATH = '/gw/slack/link';
+export const SLACK_ACTIONS_PATH = '/gw/slack/actions';
+/** Form posts, as Slack sends a press of a button. */
+const FORM_TYPE = 'application/x-www-form-urlencoded';
+/** A press of a button under a question the gateway posted: the app, who pressed it, the Slack message it is under, the fleet message its buttons name, and the option. */
+const blockActionsSchema = z.object({
+    type: z.literal('block_actions'),
+    api_app_id: z.string(),
+    team: z.object({ id: z.string() }),
+    user: z.object({ id: z.string() }),
+    container: z.object({ channel_id: z.string(), message_ts: z.string() }),
+    actions: z.tuple([z.object({ block_id: idSchema('message'), value: z.string().regex(/^\d+$/) })]).rest(z.unknown()),
+});
+/** The Slack page of the web app (web/features/slack/paths.ts names the same). */
+const SLACK_PAGE_PATH = '/slack';
+/** The Overview of the web app, where a person's Slack link shows. */
+const OVERVIEW_PATH = '/overview';
+const HTTP_FOUND = 302;
+const HTTP_UNAUTHORIZED = 401;
+const HTTP_BAD_REQUEST = 400;
+/** Slack's address check as it makes an app, before the gateway knows the app's signing secret: it carries nothing to act on. */
+const urlVerificationSchema = z.object({ type: z.literal('url_verification'), challenge: z.string() });
+const eventCallbackSchema = z.object({
+    type: z.literal('event_callback'),
+    api_app_id: z.string(),
+    team_id: z.string(),
+    event_id: z.string(),
+    event: z.object({
+        type: z.string(),
+        user: z.string().optional(),
+        channel: z.string().optional(),
+        channel_type: z.string().optional(),
+        subtype: z.string().optional(),
+        bot_id: z.string().optional(),
+        text: z.string().optional(),
+        ts: z.string().optional(),
+        thread_ts: z.string().optional(),
+        files: z.array(z.object({ name: z.string(), permalink: z.string() })).optional(),
+    }),
+});
+function headerOf(value) {
+    return typeof value === 'string' ? value : '';
+}
+const installQuerySchema = z.object({ code: z.string().optional(), state: z.string().optional(), error: z.string().optional() });
+/** What the Overview says of a link, by its outcome (web/features/overview/services/slack-link-outcomes.ts). */
+const LINK_OUTCOMES = {
+    LINK_REFUSED: 'refused',
+    SLACK_NOT_CONNECTED: 'not-connected',
+    NO_SUCH_BOT: 'not-connected',
+    OTHER_WORKSPACE: 'other-workspace',
+    SLACK_UNAVAILABLE: 'unavailable',
+    SLACK_USER_LINKED: 'slack-user-linked',
+    ACCOUNT_LINKED: 'account-linked',
+};
+/** What the Slack page says of an install, by its outcome (web/features/slack/install-outcomes.ts). */
+const OUTCOMES = {
+    INSTALL_REFUSED: 'refused',
+    SLACK_NOT_CONNECTED: 'not-connected',
+    OTHER_WORKSPACE: 'other-workspace',
+    SLACK_UNAVAILABLE: 'unavailable',
+};
+export function registerSlackRoutes(server, deps) {
+    server.get(SLACK_INSTALL_PATH, async (request, reply) => {
+        const query = installQuerySchema.safeParse(request.query);
+        const { code, state, error } = query.success ? query.data : {};
+        const goTo = (outcome, fleetId) => reply.code(HTTP_FOUND).header('location', `${SLACK_PAGE_PATH}?${new URLSearchParams({ ...(fleetId === undefined ? {} : { fleet: fleetId }), install: outcome }).toString()}`).send();
+        if (error !== undefined || code === undefined || state === undefined) {
+            // The person cancelled on Slack's screen, or Slack sent nothing to take.
+            return goTo('cancelled');
+        }
+        const completed = await deps.completeInstall({ code, state });
+        return completed.isOk ? goTo('installed', completed.value.fleetId) : goTo(OUTCOMES[completed.error.kind]);
+    });
+    server.get(SLACK_LINK_PATH, async (request, reply) => {
+        const query = installQuerySchema.safeParse(request.query);
+        const { code, state, error } = query.success ? query.data : {};
+        const goTo = (said) => reply.code(HTTP_FOUND).header('location', `${OVERVIEW_PATH}?${new URLSearchParams(said).toString()}`).send();
+        if (error !== undefined || code === undefined || state === undefined) {
+            // The person cancelled on Slack's screen, or Slack sent nothing to take.
+            return goTo({ slack: 'cancelled' });
+        }
+        const completed = await deps.completeLink({ code, state, signIn: cookieValueOf(SHARED_SIGN_IN_COOKIE, request.headers.cookie) });
+        if (completed.isOk) {
+            return goTo({ fleet: completed.value.fleetId, slack: 'linked' });
+        }
+        const refusal = completed.error;
+        return 'name' in refusal ? goTo({ fleet: refusal.fleetId, slack: LINK_OUTCOMES[refusal.kind], name: refusal.name }) : goTo({ slack: LINK_OUTCOMES[refusal.kind] });
+    });
+    void server.register(async (scope) => {
+        // The raw body, as Slack signed it.
+        scope.addContentTypeParser('application/json', { parseAs: 'string' }, async (_request, body) => Promise.resolve(body.toString()));
+        if (scope.hasContentTypeParser(FORM_TYPE)) {
+            scope.removeContentTypeParser(FORM_TYPE);
+        }
+        scope.addContentTypeParser(FORM_TYPE, { parseAs: 'string' }, async (_request, body) => Promise.resolve(body.toString()));
+        scope.post(SLACK_ACTIONS_PATH, async (request, reply) => {
+            const body = typeof request.body === 'string' ? request.body : '';
+            let sent;
+            try {
+                sent = JSON.parse(new URLSearchParams(body).get('payload') ?? '');
+            }
+            catch {
+                return reply.code(HTTP_BAD_REQUEST).send();
+            }
+            const press = blockActionsSchema.safeParse(sent);
+            if (!press.success) {
+                // Another interaction the gateway does not take: answered, so Slack shows no error.
+                return reply.send();
+            }
+            const { api_app_id: appId, team, user, container, actions: [action] } = press.data;
+            const answered = await deps.answerInSlack({
+                appId,
+                teamId: team.id,
+                userId: user.id,
+                channel: container.channel_id,
+                messageTs: container.message_ts,
+                messageId: action.block_id,
+                option: Number(action.value),
+                body,
+                timestamp: headerOf(request.headers['x-slack-request-timestamp']),
+                signature: headerOf(request.headers['x-slack-signature']),
+            });
+            return answered.isOk ? reply.send() : reply.code(HTTP_UNAUTHORIZED).send();
+        });
+        scope.post(SLACK_EVENTS_PATH, async (request, reply) => {
+            const body = typeof request.body === 'string' ? request.body : '';
+            let sent;
+            try {
+                sent = JSON.parse(body);
+            }
+            catch {
+                return reply.code(HTTP_BAD_REQUEST).send();
+            }
+            const check = urlVerificationSchema.safeParse(sent);
+            if (check.success) {
+                return reply.send({ challenge: check.data.challenge });
+            }
+            const event = eventCallbackSchema.safeParse(sent);
+            if (!event.success) {
+                return reply.code(HTTP_BAD_REQUEST).send();
+            }
+            const { api_app_id: appId, team_id: teamId, event_id: eventId, event: fields } = event.data;
+            const taken = await deps.takeSlackEvent({
+                appId,
+                event: {
+                    eventId,
+                    type: fields.type,
+                    teamId,
+                    userId: fields.user ?? null,
+                    channel: fields.channel ?? null,
+                    channelType: fields.channel_type ?? null,
+                    subtype: fields.subtype ?? null,
+                    botId: fields.bot_id ?? null,
+                    text: fields.text ?? '',
+                    ts: fields.ts ?? null,
+                    threadTs: fields.thread_ts ?? null,
+                    files: fields.files ?? [],
+                },
+                isRetry: request.headers['x-slack-retry-num'] !== undefined,
+                body,
+                timestamp: headerOf(request.headers['x-slack-request-timestamp']),
+                signature: headerOf(request.headers['x-slack-signature']),
+            });
+            return taken.isOk ? reply.send() : reply.code(HTTP_UNAUTHORIZED).send();
+        });
+        return Promise.resolve();
+    });
+}
+//# sourceMappingURL=slack-routes.js.map

package/dist/adapters/http/slack-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-routes.js","sourceRoot":"","sources":["../../../src/adapters/http/slack-routes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAK5E,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE5D,MAAM,CAAC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AAEtD,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAEpD,MAAM,CAAC,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAEhD,MAAM,CAAC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AAEtD,sDAAsD;AACtD,MAAM,SAAS,GAAG,mCAAmC,CAAC;AAEtD,2KAA2K;AAC3K,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAClC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IAClC,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;IACvE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;CACpH,CAAC,CAAC;AAEH,kFAAkF;AAClF,MAAM,eAAe,GAAG,QAAQ,CAAC;AAEjC,sEAAsE;AACtE,MAAM,aAAa,GAAG,WAAW,CAAC;AAElC,MAAM,UAAU,GAAG,GAAG,CAAC;AACvB,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B,iIAAiI;AACjI,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEvG,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC;QACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACnC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAChC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;KACjF,CAAC;CACH,CAAC,CAAC;AAEH,SAAS,QAAQ,CAAC,KAAoC;IACpD,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAEjI,gHAAgH;AAChH,MAAM,aAAa,GAAG;IACpB,YAAY,EAAE,SAAS;IACvB,mBAAmB,EAAE,eAAe;IACpC,WAAW,EAAE,eAAe;IAC5B,eAAe,EAAE,iBAAiB;IAClC,iBAAiB,EAAE,aAAa;IAChC,iBAAiB,EAAE,mBAAmB;IACtC,cAAc,EAAE,gBAAgB;CACxB,CAAC;AAEX,uGAAuG;AACvG,MAAM,QAAQ,GAAG;IACf,eAAe,EAAE,SAAS;IAC1B,mBAAmB,EAAE,eAAe;IACpC,eAAe,EAAE,iBAAiB;IAClC,iBAAiB,EAAE,aAAa;CACxB,CAAC;AAEX,MAAM,UAAU,mBAAmB,CAAC,MAAuB,EAAE,IAAoI;IAC/L,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACtD,MAAM,KAAK,GAAG,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,OAAgB,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,eAAe,IAAI,IAAI,eAAe,CAAC,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzO,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACrE,yEAAyE;YACzE,OAAO,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5G,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACnD,MAAM,KAAK,GAAG,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC1D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,GAAG,CAAC,IAA4B,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,aAAa,IAAI,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5J,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACrE,yEAAyE;YACzE,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,qBAAqB,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjI,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC;QAChC,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrK,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACnC,oCAAoC;QACpC,KAAK,CAAC,oBAAoB,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,QAAiB,EAAE,IAAqB,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAC5J,IAAI,KAAK,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,KAAK,CAAC,uBAAuB,CAAC,SAAS,CAAC,CAAC;QAC3C,CAAC;QACD,KAAK,CAAC,oBAAoB,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,QAAiB,EAAE,IAAqB,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACnJ,KAAK,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACtD,MAAM,IAAI,GAAG,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;YACpE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7C,CAAC;YACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACjD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBACnB,oFAAoF;gBACpF,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;YACtB,CAAC;YACD,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC;YACnF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;gBACxC,KAAK;gBACL,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,OAAO,EAAE,SAAS,CAAC,UAAU;gBAC7B,SAAS,EAAE,SAAS,CAAC,UAAU;gBAC/B,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC5B,IAAI;gBACJ,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;gBACjE,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;aAC1D,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7E,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;YACrD,MAAM,IAAI,GAAG,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAClE,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7C,CAAC;YACD,MAAM,KAAK,GAAG,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACpD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;gBAClB,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAClD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;gBACnB,OAAO,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,EAAE,CAAC;YAC7C,CAAC;YACD,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC;YAC5F,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;gBACtC,KAAK;gBACL,KAAK,EAAE;oBACL,OAAO;oBACP,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,MAAM;oBACN,MAAM,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI;oBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;oBAC/B,WAAW,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;oBACxC,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;oBAC/B,KAAK,EAAE,MAAM,CAAC,MAAM,IAAI,IAAI;oBAC5B,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;oBACvB,EAAE,EAAE,MAAM,CAAC,EAAE,IAAI,IAAI;oBACrB,QAAQ,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;oBAClC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;iBAC1B;gBACD,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,KAAK,SAAS;gBAC3D,IAAI;gBACJ,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;gBACjE,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;aAC1D,CAAC,CAAC;YACH,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1E,CAAC,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/adapters/mcp/mcp-servers.js

@@ -5,7 +5,7 @@
  * (notSent, nothing ran) or after (unanswered, it may have run), so the core
  * decides whether it may hand the call again (interop 5.2).
  */
-import { Client, ClientCredentialsProvider, ProtocolError, SdkError, SdkErrorCode, SdkHttpError, StreamableHTTPClientTransport, UnauthorizedError, } from '@modelcontextprotocol/client';
+import { Client, ClientCredentialsProvider, InsufficientScopeError, ProtocolError, SdkError, SdkErrorCode, SdkHttpError, StreamableHTTPClientTransport, UnauthorizedError, } from '@modelcontextprotocol/client';
 import { z } from 'zod';
 import { err, ok } from '../../core/shared/result.js';
 /** How the gateway names itself to outside MCP servers. */
@@ -51,6 +51,9 @@ function transportFor(connection) {
                     ...(credential.scope === undefined ? {} : { scope: credential.scope }),
                 }),
             });
+        case 'personSignIn':
+            // Each person's own grant goes with the call; the party's client alone signs nobody in, so the server refuses the call unsent.
+            return new StreamableHTTPClientTransport(url);
     }
 }
 async function connected(connection) {
@@ -63,7 +66,7 @@ function reasonOf(error) {
 }
 /** The server refused the gateway's credential, or could not be reached: the request did not run. */
 function isNotSent(error) {
-    if (error instanceof UnauthorizedError) {
+    if (error instanceof UnauthorizedError || error instanceof InsufficientScopeError) {
         return true;
     }
     if (error instanceof SdkHttpError) {
@@ -74,6 +77,21 @@ function isNotSent(error) {
     }
     return error instanceof TypeError && isConnectionRefused(error.cause);
 }
+/** How the server refused the credential, where it did. */
+function refusalOf(error) {
+    if (error instanceof InsufficientScopeError) {
+        return 'insufficientScope';
+    }
+    if (error instanceof UnauthorizedError || (error instanceof SdkHttpError && error.status === HTTP_UNAUTHORIZED)) {
+        return 'unauthorized';
+    }
+    return undefined;
+}
+/** A call the gateway never sent, saying how the server refused its credential where it did. */
+function notSentOf(error) {
+    const refusal = refusalOf(error);
+    return { kind: 'notSent', reason: reasonOf(error), ...(refusal === undefined ? {} : { refusal }) };
+}
 const systemError = z.object({ code: z.string() });
 /** No connection was made, so nothing was sent. */
 function isConnectionRefused(cause) {
@@ -136,7 +154,7 @@ export function createMcpServers() {
                 client = await connected(connection);
             }
             catch (error) {
-                return { kind: 'notSent', reason: reasonOf(error) };
+                return notSentOf(error);
             }
             try {
                 return await callOnce(client, call);
@@ -145,7 +163,7 @@ export function createMcpServers() {
                 if (error instanceof ProtocolError) {
                     return { kind: 'answered', result: protocolErrorResult(error) };
                 }
-                return isNotSent(error) ? { kind: 'notSent', reason: reasonOf(error) } : { kind: 'unanswered', reason: reasonOf(error) };
+                return isNotSent(error) ? notSentOf(error) : { kind: 'unanswered', reason: reasonOf(error) };
             }
             finally {
                 await client.close();

package/dist/adapters/mcp/mcp-servers.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-servers.js","sourceRoot":"","sources":["../../../src/adapters/mcp/mcp-servers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,MAAM,EACN,yBAAyB,EACzB,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,6BAA6B,EAC7B,iBAAiB,GAClB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,6BAA6B,CAAC;AAEtD,2DAA2D;AAC3D,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAE7D,kFAAkF;AAClF,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAErD,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACpC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACvC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACtC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,WAAW,EAAE,UAAU;IACvB,YAAY,EAAE,UAAU,CAAC,QAAQ,EAAE;IACnC,WAAW,EAAE,eAAe,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzC,iBAAiB,EAAE,UAAU,CAAC,QAAQ,EAAE;IACxC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAEH,SAAS,YAAY,CAAC,UAA+B;IACnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC;IAClC,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC;QACxB,KAAK,MAAM;YACT,OAAO,IAAI,6BAA6B,CAAC,GAAG,CAAC,CAAC;QAChD,KAAK,QAAQ;YACX,OAAO,IAAI,6BAA6B,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,UAAU,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/H,KAAK,mBAAmB;YACtB,OAAO,IAAI,6BAA6B,CAAC,GAAG,EAAE;gBAC5C,YAAY,EAAE,IAAI,yBAAyB,CAAC;oBAC1C,QAAQ,EAAE,UAAU,CAAC,QAAQ;oBAC7B,YAAY,EAAE,UAAU,CAAC,YAAY;oBACrC,cAAc,EAAE,UAAU,CAAC,MAAM;oBACjC,GAAG,CAAC,UAAU,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;iBACvE,CAAC;aACH,CAAC,CAAC;IACP,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,UAA+B;IACtD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACjF,MAAM,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,qGAAqG;AACrG,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,YAAY,iBAAiB,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC,MAAM,KAAK,iBAAiB,IAAI,KAAK,CAAC,MAAM,KAAK,cAAc,CAAC;IAC/E,CAAC;IACD,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,UAAU,IAAI,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,KAAK,YAAY,SAAS,IAAI,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEnD,mDAAmD;AACnD,SAAS,mBAAmB,CAAC,KAAc;IACzC,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,OAAO,CAAC,OAAO,IAAI,CAAC,cAAc,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtG,CAAC;AAED,qGAAqG;AACrG,SAAS,mBAAmB,CAAC,KAAoB;IAC/C,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACnH,CAAC;AAED,SAAS,MAAM,CAAC,IAAgC;IAC9C,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1D,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5E,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/E,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;KAC7E,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,MAAc;IACzC,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,IAAI,MAA0B,CAAC;IAC/B,GAAG,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5E,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;IAC3B,CAAC,QAAQ,MAAM,KAAK,SAAS,EAAE;IAC/B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,MAAc,EAAE,IAAc;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAC3I,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE;YACN,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,GAAG,CAAC,MAAM,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAClG,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,KAAK;SACjC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL,KAAK,CAAC,SAAS,CAAC,UAAU;YACxB,IAAI,MAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;gBACrC,OAAO,EAAE,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC/D,CAAC;oBAAS,CAAC;gBACT,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC;YACxB,CAAC;QACH,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI;YAC7B,IAAI,MAAc,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACtD,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,MAAM,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACtC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,aAAa,EAAE,CAAC;oBACnC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClE,CAAC;gBACD,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3H,CAAC;oBAAS,CAAC;gBACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"mcp-servers.js","sourceRoot":"","sources":["../../../src/adapters/mcp/mcp-servers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,MAAM,EACN,yBAAyB,EACzB,sBAAsB,EACtB,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,6BAA6B,EAC7B,iBAAiB,GAClB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,6BAA6B,CAAC;AAEtD,2DAA2D;AAC3D,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAE7D,kFAAkF;AAClF,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAC9B,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;AAErD,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACpC,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACvC,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACtC,aAAa,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAClC,WAAW,EAAE,UAAU;IACvB,YAAY,EAAE,UAAU,CAAC,QAAQ,EAAE;IACnC,WAAW,EAAE,eAAe,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzC,iBAAiB,EAAE,UAAU,CAAC,QAAQ,EAAE;IACxC,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AAEH,SAAS,YAAY,CAAC,UAA+B;IACnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC;IAClC,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC;QACxB,KAAK,MAAM;YACT,OAAO,IAAI,6BAA6B,CAAC,GAAG,CAAC,CAAC;QAChD,KAAK,QAAQ;YACX,OAAO,IAAI,6BAA6B,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,UAAU,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/H,KAAK,mBAAmB;YACtB,OAAO,IAAI,6BAA6B,CAAC,GAAG,EAAE;gBAC5C,YAAY,EAAE,IAAI,yBAAyB,CAAC;oBAC1C,QAAQ,EAAE,UAAU,CAAC,QAAQ;oBAC7B,YAAY,EAAE,UAAU,CAAC,YAAY;oBACrC,cAAc,EAAE,UAAU,CAAC,MAAM;oBACjC,GAAG,CAAC,UAAU,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;iBACvE,CAAC;aACH,CAAC,CAAC;QACL,KAAK,cAAc;YACjB,+HAA+H;YAC/H,OAAO,IAAI,6BAA6B,CAAC,GAAG,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,UAA+B;IACtD,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,WAAW,EAAE,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACjF,MAAM,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;IAC/C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,qGAAqG;AACrG,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,YAAY,iBAAiB,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;QAClF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;QAClC,OAAO,KAAK,CAAC,MAAM,KAAK,iBAAiB,IAAI,KAAK,CAAC,MAAM,KAAK,cAAc,CAAC;IAC/E,CAAC;IACD,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC,UAAU,IAAI,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,KAAK,YAAY,SAAS,IAAI,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AACxE,CAAC;AAED,2DAA2D;AAC3D,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,YAAY,sBAAsB,EAAE,CAAC;QAC5C,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IACD,IAAI,KAAK,YAAY,iBAAiB,IAAI,CAAC,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,MAAM,KAAK,iBAAiB,CAAC,EAAE,CAAC;QAChH,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,gGAAgG;AAChG,SAAS,SAAS,CAAC,KAAc;IAC/B,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AACrG,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEnD,mDAAmD;AACnD,SAAS,mBAAmB,CAAC,KAAc;IACzC,MAAM,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO,OAAO,CAAC,OAAO,IAAI,CAAC,cAAc,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACtG,CAAC;AAED,qGAAqG;AACrG,SAAS,mBAAmB,CAAC,KAAoB;IAC/C,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACnH,CAAC;AAED,SAAS,MAAM,CAAC,IAAgC;IAC9C,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1D,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5E,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/E,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;KAC7E,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,MAAc;IACzC,MAAM,KAAK,GAAkB,EAAE,CAAC;IAChC,IAAI,MAA0B,CAAC;IAC/B,GAAG,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5E,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;IAC3B,CAAC,QAAQ,MAAM,KAAK,SAAS,EAAE;IAC/B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,MAAc,EAAE,IAAc;IACpD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAC3I,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE;YACN,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,GAAG,CAAC,MAAM,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAClG,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,KAAK;SACjC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL,KAAK,CAAC,SAAS,CAAC,UAAU;YACxB,IAAI,MAA0B,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;gBACrC,OAAO,EAAE,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC/D,CAAC;oBAAS,CAAC;gBACT,MAAM,MAAM,EAAE,KAAK,EAAE,CAAC;YACxB,CAAC;QACH,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI;YAC7B,IAAI,MAAc,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;YACD,IAAI,CAAC;gBACH,OAAO,MAAM,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACtC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,aAAa,EAAE,CAAC;oBACnC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClE,CAAC;gBACD,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/F,CAAC;oBAAS,CAAC;gBACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/adapters/oauth/authorization-servers.d.ts

@@ -0,0 +1,2 @@
+import type { AuthorizationServers } from '../../core/parties/ports.js';
+export declare function createAuthorizationServers(): AuthorizationServers;

package/dist/adapters/oauth/authorization-servers.js

@@ -0,0 +1,127 @@
+/**
+ * Outside MCP servers' authorization servers, as the gateway, an OAuth
+ * client, reaches them (MCP authorization 2026-07-28, decision 0067). It
+ * finds a server's authorization server from its 401's `resource_metadata`,
+ * else its well-known protected resource metadata (RFC 9728), then the
+ * authorization server's metadata (RFC 8414, else OpenID Connect), whose
+ * issuer must be the one named; and registers a client by dynamic
+ * registration (RFC 7591). The core decides what the answers allow.
+ */
+import { discoverAuthorizationServerMetadata, discoverOAuthProtectedResourceMetadata, extractWWWAuthenticateParams, IssuerMismatchError } from '@modelcontextprotocol/client';
+import { z } from 'zod';
+import { err, ok } from '../../core/shared/result.js';
+/** How long the gateway waits for each answer while it adds a server. */
+const ANSWER_WAIT_MS = 10_000;
+const HTTP_UNAUTHORIZED = 401;
+/** The MCP request the gateway sends to find whether a server asks for a sign-in: an initialize, as any client's first. */
+const INITIALIZE = { jsonrpc: '2.0', id: 1, method: 'initialize', params: { protocolVersion: '2026-07-28', capabilities: {}, clientInfo: { name: 'aeolus-gateway', version: '1' } } };
+/** RFC 7591's answer, by its own field names. */
+const registeredSchema = z.object({
+    client_id: z.string().min(1),
+    client_secret: z.string().min(1).optional(),
+    registration_client_uri: z.string().optional(),
+    registration_access_token: z.string().optional(),
+});
+const registrationErrorSchema = z.object({ error: z.string(), error_description: z.string().optional() });
+const timedFetch = (url, init) => fetch(url, { ...init, signal: AbortSignal.timeout(ANSWER_WAIT_MS) });
+function reasonOf(error) {
+    if (error instanceof Error) {
+        return error.cause instanceof Error ? `${error.message}: ${error.cause.message}` : error.message;
+    }
+    return String(error);
+}
+/** What the server's 401 names, if it answers one: where its protected resource metadata is, and the scope it asks. */
+async function challengeOf(serverUrl) {
+    const response = await timedFetch(serverUrl, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', accept: 'application/json, text/event-stream' },
+        body: JSON.stringify(INITIALIZE),
+    });
+    await response.body?.cancel();
+    if (response.status !== HTTP_UNAUTHORIZED) {
+        return {};
+    }
+    const { resourceMetadataUrl, scope } = extractWWWAuthenticateParams(response);
+    return { ...(resourceMetadataUrl === undefined ? {} : { resourceMetadataUrl }), ...(scope === undefined ? {} : { scope }) };
+}
+export function createAuthorizationServers() {
+    return {
+        async discover(serverUrl) {
+            let challenge;
+            try {
+                challenge = await challengeOf(serverUrl);
+            }
+            catch (error) {
+                return err({ kind: 'unreachable', reason: reasonOf(error) });
+            }
+            let resourceMetadata;
+            try {
+                resourceMetadata = await discoverOAuthProtectedResourceMetadata(serverUrl, challenge.resourceMetadataUrl === undefined ? {} : { resourceMetadataUrl: challenge.resourceMetadataUrl }, timedFetch);
+            }
+            catch (error) {
+                return err({ kind: 'noAuthorizationServer', reason: `no protected resource metadata: ${reasonOf(error)}` });
+            }
+            const named = resourceMetadata.authorization_servers?.[0];
+            if (named === undefined) {
+                return err({ kind: 'noAuthorizationServer', reason: 'its protected resource metadata names no authorization server' });
+            }
+            let serverMetadata;
+            try {
+                serverMetadata = await discoverAuthorizationServerMetadata(named, { fetchFn: timedFetch });
+            }
+            catch (error) {
+                return error instanceof IssuerMismatchError ? err({ kind: 'noServerMetadata', reason: reasonOf(error) }) : err({ kind: 'unreachable', reason: reasonOf(error) });
+            }
+            if (serverMetadata === undefined) {
+                return err({ kind: 'noServerMetadata', reason: `${named} has no authorization server metadata` });
+            }
+            const discovered = {
+                resource: resourceMetadata.resource,
+                challengeScope: challenge.scope ?? null,
+                resourceScopes: resourceMetadata.scopes_supported ?? [],
+                issuer: serverMetadata.issuer,
+                authorizationEndpoint: serverMetadata.authorization_endpoint,
+                tokenEndpoint: serverMetadata.token_endpoint,
+                registrationEndpoint: serverMetadata.registration_endpoint ?? null,
+                revocationEndpoint: 'revocation_endpoint' in serverMetadata ? (serverMetadata.revocation_endpoint ?? null) : null,
+                isIssuerInResponse: serverMetadata.authorization_response_iss_parameter_supported === true,
+                codeChallengeMethods: serverMetadata.code_challenge_methods_supported ?? [],
+                serverScopes: serverMetadata.scopes_supported ?? [],
+            };
+            return ok(discovered);
+        },
+        async register(registrationEndpoint, { clientName, redirectUri, scope }) {
+            let response;
+            try {
+                response = await timedFetch(registrationEndpoint, {
+                    method: 'POST',
+                    headers: { 'content-type': 'application/json', accept: 'application/json' },
+                    // A confidential client (RFC 9700 2.2.2): its refresh tokens are bound to its secret.
+                    body: JSON.stringify({
+                        client_name: clientName,
+                        redirect_uris: [redirectUri],
+                        grant_types: ['authorization_code', 'refresh_token'],
+                        response_types: ['code'],
+                        token_endpoint_auth_method: 'client_secret_post',
+                        scope,
+                    }),
+                });
+            }
+            catch (error) {
+                return err({ reason: reasonOf(error) });
+            }
+            const body = await response.json().catch(() => undefined);
+            if (!response.ok) {
+                const refusal = registrationErrorSchema.safeParse(body);
+                return err({ reason: refusal.success ? [refusal.data.error, refusal.data.error_description].filter((part) => part !== undefined).join(': ') : `HTTP ${String(response.status)}` });
+            }
+            const registered = registeredSchema.safeParse(body);
+            if (!registered.success) {
+                return err({ reason: 'the registration answered no client id' });
+            }
+            const { client_id: clientId, client_secret: clientSecret, registration_client_uri: registrationClientUri, registration_access_token: registrationAccessToken } = registered.data;
+            return ok({ clientId, clientSecret: clientSecret ?? null, registrationClientUri: registrationClientUri ?? null, registrationAccessToken: registrationAccessToken ?? null });
+        },
+    };
+}
+//# sourceMappingURL=authorization-servers.js.map

package/dist/adapters/oauth/authorization-servers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorization-servers.js","sourceRoot":"","sources":["../../../src/adapters/oauth/authorization-servers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,mCAAmC,EAAE,sCAAsC,EAAE,4BAA4B,EAAE,mBAAmB,EAAkB,MAAM,8BAA8B,CAAC;AAC9L,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,6BAA6B,CAAC;AAEtD,yEAAyE;AACzE,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B,2HAA2H;AAC3H,MAAM,UAAU,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC;AAEtL,iDAAiD;AACjD,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,uBAAuB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9C,yBAAyB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACjD,CAAC,CAAC;AACH,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AAE1G,MAAM,UAAU,GAAc,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;AAElH,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;IACnG,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,uHAAuH;AACvH,KAAK,UAAU,WAAW,CAAC,SAAiB;IAC1C,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,SAAS,EAAE;QAC3C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,qCAAqC,EAAE;QAC9F,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;KACjC,CAAC,CAAC;IACH,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9B,IAAI,QAAQ,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,EAAE,mBAAmB,EAAE,KAAK,EAAE,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAC9E,OAAO,EAAE,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;AAC9H,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,SAAS;YACtB,IAAI,SAAkD,CAAC;YACvD,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,WAAW,CAAC,SAAS,CAAC,CAAC;YAC3C,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,gBAAoF,CAAC;YACzF,IAAI,CAAC;gBACH,gBAAgB,GAAG,MAAM,sCAAsC,CAAC,SAAS,EAAE,SAAS,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,SAAS,CAAC,mBAAmB,EAAE,EAAE,UAAU,CAAC,CAAC;YACpM,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,mCAAmC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9G,CAAC;YACD,MAAM,KAAK,GAAG,gBAAgB,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,CAAC;YAC1D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,+DAA+D,EAAE,CAAC,CAAC;YACzH,CAAC;YACD,IAAI,cAA+E,CAAC;YACpF,IAAI,CAAC;gBACH,cAAc,GAAG,MAAM,mCAAmC,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YAC7F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,KAAK,YAAY,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACnK,CAAC;YACD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;gBACjC,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAAG,KAAK,uCAAuC,EAAE,CAAC,CAAC;YACpG,CAAC;YACD,MAAM,UAAU,GAAqB;gBACnC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;gBACnC,cAAc,EAAE,SAAS,CAAC,KAAK,IAAI,IAAI;gBACvC,cAAc,EAAE,gBAAgB,CAAC,gBAAgB,IAAI,EAAE;gBACvD,MAAM,EAAE,cAAc,CAAC,MAAM;gBAC7B,qBAAqB,EAAE,cAAc,CAAC,sBAAsB;gBAC5D,aAAa,EAAE,cAAc,CAAC,cAAc;gBAC5C,oBAAoB,EAAE,cAAc,CAAC,qBAAqB,IAAI,IAAI;gBAClE,kBAAkB,EAAE,qBAAqB,IAAI,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,mBAAmB,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;gBACjH,kBAAkB,EAAE,cAAc,CAAC,8CAA8C,KAAK,IAAI;gBAC1F,oBAAoB,EAAE,cAAc,CAAC,gCAAgC,IAAI,EAAE;gBAC3E,YAAY,EAAE,cAAc,CAAC,gBAAgB,IAAI,EAAE;aACpD,CAAC;YACF,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;QACxB,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,oBAAoB,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE;YACrE,IAAI,QAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,UAAU,CAAC,oBAAoB,EAAE;oBAChD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;oBAC3E,sFAAsF;oBACtF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACnB,WAAW,EAAE,UAAU;wBACvB,aAAa,EAAE,CAAC,WAAW,CAAC;wBAC5B,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;wBACpD,cAAc,EAAE,CAAC,MAAM,CAAC;wBACxB,0BAA0B,EAAE,oBAAoB;wBAChD,KAAK;qBACN,CAAC;iBACH,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACnE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,OAAO,GAAG,uBAAuB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBACxD,OAAO,GAAG,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;YACrL,CAAC;YACD,MAAM,UAAU,GAAG,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACpD,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;gBACxB,OAAO,GAAG,CAAC,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC;YACjL,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,IAAI,IAAI,EAAE,qBAAqB,EAAE,qBAAqB,IAAI,IAAI,EAAE,uBAAuB,EAAE,uBAAuB,IAAI,IAAI,EAAE,CAAC,CAAC;QAC9K,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/adapters/oauth/party-sign-ins.d.ts

@@ -0,0 +1,2 @@
+import type { PartySignIns } from '../../core/party-grants/ports.js';
+export declare function createPartySignIns(): PartySignIns;

package/dist/adapters/oauth/party-sign-ins.js

@@ -0,0 +1,152 @@
+/**
+ * A party's outside authorization server, as the gateway, a confidential
+ * OAuth client, reaches it for each person's sign-in (MCP authorization
+ * 2026-07-28, decision 0067): the authorize address of the code flow with
+ * PKCE S256 and the resource (RFC 8707), the code redeemed at the token
+ * endpoint with the client's secret (client_secret_post, as the client was
+ * registered), a grant refreshed (RFC 6749 6) with the same client and
+ * resource, a token revoked (RFC 7009), and the client deleted (RFC 7592).
+ * The ID token's claims are
+ * read, not checked: the core checks they name the party's issuer and
+ * client.
+ */
+import { z } from 'zod';
+import { err, ok } from '../../core/shared/result.js';
+/** How long the gateway waits for each answer of the authorization server. */
+const ANSWER_WAIT_MS = 10_000;
+/** A token response (RFC 6749 5.1), by its own field names; an ID token where OpenID Connect answers one. */
+const tokensSchema = z.object({
+    access_token: z.string().min(1),
+    token_type: z.string().regex(/^bearer$/i),
+    refresh_token: z.string().min(1).optional(),
+    expires_in: z.number().int().positive().optional(),
+    id_token: z.string().optional(),
+});
+const tokenErrorSchema = z.object({ error: z.string(), error_description: z.string().optional() });
+const idTokenSchema = z.object({
+    iss: z.string(),
+    aud: z.union([z.string(), z.array(z.string())]),
+    sub: z.string().min(1),
+    email: z.string().optional(),
+    preferred_username: z.string().optional(),
+    name: z.string().optional(),
+});
+/** The parts of a JWT: its header, its claims and its signature. */
+const JWT_PARTS = 3;
+function reasonOf(error) {
+    if (error instanceof Error) {
+        return error.cause instanceof Error ? `${error.message}: ${error.cause.message}` : error.message;
+    }
+    return String(error);
+}
+/** The claims of an ID token, read from its payload; none when it is no JWT with OpenID Connect's claims. */
+function idTokenClaimsOf(idToken) {
+    const parts = idToken.split('.');
+    if (parts.length !== JWT_PARTS) {
+        return undefined;
+    }
+    let claims;
+    try {
+        claims = JSON.parse(Buffer.from(parts[1] ?? '', 'base64url').toString('utf8'));
+    }
+    catch {
+        return undefined;
+    }
+    const read = idTokenSchema.safeParse(claims);
+    if (!read.success) {
+        return undefined;
+    }
+    const { iss, aud, sub, email, preferred_username: username, name } = read.data;
+    return { issuer: iss, audiences: typeof aud === 'string' ? [aud] : aud, subject: sub, name: email ?? username ?? name ?? null };
+}
+/** The client's own credentials, as it authenticates at the token and revocation endpoints. */
+function clientAuthenticationOf(client) {
+    return client.clientSecret === null ? { client_id: client.clientId } : { client_id: client.clientId, client_secret: client.clientSecret };
+}
+/** The token endpoint's answer to a token request: the tokens it issued, its OAuth error, or no answer. */
+async function tokensOf(response) {
+    const body = await response.json().catch(() => undefined);
+    if (!response.ok) {
+        const refusal = tokenErrorSchema.safeParse(body);
+        return refusal.success
+            ? err({ kind: 'refused', error: refusal.data.error, reason: [refusal.data.error, refusal.data.error_description].filter((part) => part !== undefined).join(': ') })
+            : err({ kind: 'unreachable', reason: `HTTP ${String(response.status)}` });
+    }
+    const tokens = tokensSchema.safeParse(body);
+    return tokens.success ? ok(tokens.data) : err({ kind: 'refused', error: 'invalid_response', reason: 'the token endpoint answered no bearer access token' });
+}
+async function posted(url, form) {
+    try {
+        return ok(await fetch(url, { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' }, body: new URLSearchParams(form), signal: AbortSignal.timeout(ANSWER_WAIT_MS) }));
+    }
+    catch (error) {
+        return err({ kind: 'unreachable', reason: reasonOf(error) });
+    }
+}
+export function createPartySignIns() {
+    return {
+        authorizeUrl(client, { state, codeChallenge, redirectUri }) {
+            const url = new URL(client.authorizationEndpoint);
+            for (const [name, value] of Object.entries({
+                response_type: 'code',
+                client_id: client.clientId,
+                redirect_uri: redirectUri,
+                scope: client.scope,
+                state,
+                code_challenge: codeChallenge,
+                code_challenge_method: 'S256',
+                resource: client.resource,
+            })) {
+                url.searchParams.set(name, value);
+            }
+            return url.toString();
+        },
+        async redeemCode(client, { code, verifier, redirectUri }) {
+            const answered = await posted(client.tokenEndpoint, { grant_type: 'authorization_code', code, redirect_uri: redirectUri, code_verifier: verifier, resource: client.resource, ...clientAuthenticationOf(client) });
+            if (!answered.isOk) {
+                return answered;
+            }
+            const tokens = await tokensOf(answered.value);
+            if (!tokens.isOk) {
+                return tokens;
+            }
+            const { access_token: accessToken, refresh_token: refreshToken, expires_in: expiresInSeconds, id_token: idToken } = tokens.value;
+            const claims = idToken === undefined ? null : idTokenClaimsOf(idToken);
+            if (claims === undefined) {
+                return err({ kind: 'refused', error: 'invalid_response', reason: 'the token endpoint answered an ID token that could not be read' });
+            }
+            return ok({ accessToken, refreshToken: refreshToken ?? null, expiresInSeconds: expiresInSeconds ?? null, idToken: claims });
+        },
+        async refresh(client, refreshToken) {
+            const answered = await posted(client.tokenEndpoint, { grant_type: 'refresh_token', refresh_token: refreshToken, resource: client.resource, ...clientAuthenticationOf(client) });
+            if (!answered.isOk) {
+                return answered;
+            }
+            const tokens = await tokensOf(answered.value);
+            if (!tokens.isOk) {
+                return tokens;
+            }
+            const { access_token: accessToken, refresh_token: rotated, expires_in: expiresInSeconds } = tokens.value;
+            return ok({ accessToken, refreshToken: rotated ?? null, expiresInSeconds: expiresInSeconds ?? null });
+        },
+        async revoke(client, token) {
+            const answered = await posted(client.revocationEndpoint, { token, ...clientAuthenticationOf(client) });
+            if (!answered.isOk) {
+                return err({ reason: answered.error.reason });
+            }
+            await answered.value.body?.cancel();
+            return answered.value.ok ? ok(undefined) : err({ reason: `HTTP ${String(answered.value.status)}` });
+        },
+        async deleteClient({ registrationClientUri, registrationAccessToken }) {
+            try {
+                const answered = await fetch(registrationClientUri, { method: 'DELETE', headers: { authorization: `Bearer ${registrationAccessToken}` }, signal: AbortSignal.timeout(ANSWER_WAIT_MS) });
+                await answered.body?.cancel();
+                return answered.ok ? ok(undefined) : err({ reason: `HTTP ${String(answered.status)}` });
+            }
+            catch (error) {
+                return err({ reason: reasonOf(error) });
+            }
+        },
+    };
+}
+//# sourceMappingURL=party-sign-ins.js.map

package/dist/adapters/oauth/party-sign-ins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"party-sign-ins.js","sourceRoot":"","sources":["../../../src/adapters/oauth/party-sign-ins.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,6BAA6B,CAAC;AAGnE,8EAA8E;AAC9E,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,6GAA6G;AAC7G,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC;IACzC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC3C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;IAClD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC,CAAC;AACH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACnG,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH,oEAAoE;AACpE,MAAM,SAAS,GAAG,CAAC,CAAC;AAEpB,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC;IACnG,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,6GAA6G;AAC7G,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;IAC/E,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,IAAI,QAAQ,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC;AAClI,CAAC;AAED,+FAA+F;AAC/F,SAAS,sBAAsB,CAAC,MAAoB;IAClD,OAAO,MAAM,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;AAC5I,CAAC;AAED,2GAA2G;AAC3G,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACxC,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACnE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,OAAO,GAAG,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACjD,OAAO,OAAO,CAAC,OAAO;YACpB,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACnK,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,oDAAoD,EAAE,CAAC,CAAC;AAC9J,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,GAAW,EAAE,IAA4B;IAC7D,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9N,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO;QACL,YAAY,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE;YACxD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;YAClD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC;gBACzC,aAAa,EAAE,MAAM;gBACrB,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,YAAY,EAAE,WAAW;gBACzB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,KAAK;gBACL,cAAc,EAAE,aAAa;gBAC7B,qBAAqB,EAAE,MAAM;gBAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,EAAE,CAAC;gBACH,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;YACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxB,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE;YACtD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,UAAU,EAAE,oBAAoB,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAClN,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnB,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjB,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;YACjI,MAAM,MAAM,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YACvE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,gEAAgE,EAAE,CAAC,CAAC;YACvI,CAAC;YACD,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,IAAI,IAAI,EAAE,gBAAgB,EAAE,gBAAgB,IAAI,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9H,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,YAAY;YAChC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAChL,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnB,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjB,OAAO,MAAM,CAAC;YAChB,CAAC;YACD,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;YACzG,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,IAAI,IAAI,EAAE,gBAAgB,EAAE,gBAAgB,IAAI,IAAI,EAAE,CAAC,CAAC;QACxG,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK;YACxB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,GAAG,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACvG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnB,OAAO,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAChD,CAAC;YACD,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YACpC,OAAO,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACtG,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,EAAE,qBAAqB,EAAE,uBAAuB,EAAE;YACnE,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,uBAAuB,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;gBACxL,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;gBAC9B,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/adapters/prisma/fleet-forgetter.d.ts

@@ -1,4 +1,4 @@
 import type { FleetForgetter } from '../../core/installation/ports.js';
 import type { PrismaClient } from './client.js';
-/** Forgets every record the gateway holds of a fleet, in one transaction: its connection, its switch, its outside parties switch, its parties with their vault, argo's marks, its calls, its outside clients' calls with their replies and A2A tasks with their push configs and pushes, its messages to outside A2A agents with their replies, its OAuth clients, codes and tokens, its signed-in accounts' grants and their person ships' crews, the email channels they turned on, the wakes sent, their pages in focus and the browsers they turned web push on in, and the requests that name it with their outcomes still to tell and the questions to the gateway's owner about them. */
+/** Forgets every record the gateway holds of a fleet, in one transaction: its connection, its switch, its outside parties switch, its parties with their vault, argo's marks, its calls, its outside clients' calls with their replies and A2A tasks with their push configs and pushes, its messages to outside A2A agents with their replies, its OAuth clients, codes and tokens, its signed-in accounts' grants and their person ships' crews, the email channels they turned on, the wakes sent, their pages in focus and the browsers they turned web push on in, and the requests that name it with their outcomes still to tell and the questions to the gateway's owner about them, and its Slack workspace with the apps made in it, and its people's grants of its outside parties with the notices of their missing sign-ins. */
 export declare function createPrismaFleetForgetter(db: PrismaClient): FleetForgetter;