@aeolus-fleet/gateway 0.33.0 → 0.35.0

package/dist/core/mcp-out/ports.d.ts

@@ -3,12 +3,12 @@
  * (interop 3.3, 5.2): its tools, and one call at a time.
  */
 import type { Result } from '../shared/result.js';
-import type { McpServerCredential } from '../vault/credential.js';
+import type { McpServerPartyCredential } from '../vault/credential.js';
 /** Where an outside MCP server is, and how the gateway signs in to it. */
 export interface McpServerConnection {
     /** Its Streamable HTTP endpoint. */
     readonly url: string;
-    readonly credential: McpServerCredential;
+    readonly credential: McpServerPartyCredential;
 }
 /** MCP's tool annotations (2026-07-28), as the server states them: hints, never trusted on their own. */
 export interface ToolAnnotations {
@@ -33,10 +33,13 @@ export interface ToolResult {
     readonly structuredContent?: Readonly<Record<string, unknown>>;
     readonly isError: boolean;
 }
+/** How a server refused the credential a call went with (RFC 6750 3.1): not taken (401), or lacking a scope the call needs (403 `insufficient_scope`). */
+export type CredentialRefusal = 'unauthorized' | 'insufficientScope';
 /**
  * How one `tools/call` ended (5.2):
  * - answered: the server's answer, which confirms the hand-over;
  * - notSent: the gateway never sent it (the server was unreachable, or refused the gateway's credential), so it did not run;
+ *   a refusal says how the server refused the credential: 401 (unauthorized), or 403 `insufficient_scope` for this call;
  * - unanswered: sent, and no answer came (a broken stream, a timeout): whether the server ran it is unknown.
  */
 export type ToolCallOutcome = {
@@ -45,6 +48,7 @@ export type ToolCallOutcome = {
 } | {
     readonly kind: 'notSent';
     readonly reason: string;
+    readonly refusal?: CredentialRefusal;
 } | {
     readonly kind: 'unanswered';
     readonly reason: string;

package/dist/core/mcp-out/state-party.d.ts

@@ -1,6 +1,7 @@
 import type { FleetId } from '@aeolus-fleet/common';
 import type { FleetRefusal } from '../connection/ports.js';
 import type { PartyStore, ScopeRequirementsStore } from '../parties/ports.js';
+import type { ListingConnectionOf } from '../party-grants/listing-connection.js';
 import { type DomainError } from '../shared/errors.js';
 import { type Result } from '../shared/result.js';
 import type { McpServers } from './ports.js';
@@ -24,17 +25,19 @@ export type StateParty = (input: {
     name: string;
 }) => Promise<Result<{
     capabilities: string[];
-}, DomainError<'NO_SUCH_PARTY' | 'NOT_CREWED' | 'SERVER_UNREACHABLE' | 'STATEMENT_REFUSED'>>>;
+}, DomainError<'NO_SUCH_PARTY' | 'NOT_CREWED' | 'NOT_SIGNED_IN' | 'SERVER_UNREACHABLE' | 'STATEMENT_REFUSED'>>>;
 /**
  * Use case: the gateway states what a party's proxy ship offers, as its
  * crew: the tools its server lists now that are switched on, with argo's
  * marks and the scopes each tool needs now. The whole statement replaces the one before, so a tool the server
  * dropped or an approver switched off is gone. A party with no switches kept
- * keeps every tool it lists on first (aeolus-fleet#1151).
+ * keeps every tool it lists on first (aeolus-fleet#1151). A server where each
+ * person signs in is listed under a person's grant (decision 0067).
  */
 export declare function createStateParty(deps: {
     parties: PartyStore;
     servers: McpServers;
+    connectionOf: ListingConnectionOf;
     door: StatementDoor;
     marks: ToolMarks;
     requirements: ScopeRequirementsStore;

package/dist/core/mcp-out/state-party.js

@@ -7,7 +7,8 @@ import { statementOf } from './statement.js';
  * crew: the tools its server lists now that are switched on, with argo's
  * marks and the scopes each tool needs now. The whole statement replaces the one before, so a tool the server
  * dropped or an approver switched off is gone. A party with no switches kept
- * keeps every tool it lists on first (aeolus-fleet#1151).
+ * keeps every tool it lists on first (aeolus-fleet#1151). A server where each
+ * person signs in is listed under a person's grant (decision 0067).
  */
 export function createStateParty(deps) {
     return async ({ fleetId, name }) => {
@@ -18,7 +19,11 @@ export function createStateParty(deps) {
         if (party.state !== 'crewed' || party.crewToken === null) {
             return refuse('NOT_CREWED', `The gateway does not crew the proxy ship of ${name} yet`);
         }
-        const listed = await deps.servers.listTools({ url: party.url, credential: party.credential });
+        const connection = await deps.connectionOf(party);
+        if (connection === undefined) {
+            return refuse('NOT_SIGNED_IN', `Nobody holds a usable sign-in to ${name}, so its tools cannot be listed`);
+        }
+        const listed = await deps.servers.listTools(connection);
         if (!listed.isOk) {
             return refuse('SERVER_UNREACHABLE', `The MCP server of ${name} could not be listed: ${listed.error.reason}`);
         }

package/dist/core/mcp-out/state-party.js.map

@@ -1 +1 @@
-{"version":3,"file":"state-party.js","sourceRoot":"","sources":["../../../src/core/mcp-out/state-party.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvD,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAmC,MAAM,gBAAgB,CAAC;AAkB9E;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAmJ;IAClL,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,IAAI,KAAK,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC,eAAe,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YACzD,OAAO,MAAM,CAAC,YAAY,EAAE,+CAA+C,IAAI,MAAM,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9F,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,oBAAoB,EAAE,qBAAqB,IAAI,yBAAyB,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QAC5H,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACrF,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAClM,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,mBAAmB,EAAE,oCAAoC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"state-party.js","sourceRoot":"","sources":["../../../src/core/mcp-out/state-party.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvD,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAmC,MAAM,gBAAgB,CAAC;AAkB9E;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAQhC;IACC,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,IAAI,KAAK,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC,eAAe,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YACzD,OAAO,MAAM,CAAC,YAAY,EAAE,+CAA+C,IAAI,MAAM,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC,eAAe,EAAE,oCAAoC,IAAI,iCAAiC,CAAC,CAAC;QAC5G,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,oBAAoB,EAAE,qBAAqB,IAAI,yBAAyB,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QAC5H,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACrF,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAClM,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,mBAAmB,EAAE,oCAAoC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/add-sign-in-server.d.ts

@@ -0,0 +1,25 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import { type DomainError } from '../shared/errors.js';
+import type { Result } from '../shared/result.js';
+import type { ApproveParty, ApprovePartyRefusal } from './approve-party.js';
+import type { AuthorizationServers, PartyStore } from './ports.js';
+import type { ShownParty } from './shown-party.js';
+export type AddSignInServerRefusal = ApprovePartyRefusal | DomainError<'SERVER_UNREACHABLE' | 'NO_AUTHORIZATION_SERVER' | 'SIGN_IN_CHECK_FAILED' | 'NO_DYNAMIC_REGISTRATION' | 'REGISTRATION_REFUSED'>;
+export type AddSignInServer = (input: Omit<Parameters<ApproveParty>[0], 'credential'>) => Promise<Result<ShownParty, AddSignInServerRefusal>>;
+/**
+ * Use case: an approver adds an outside MCP server that takes only an OAuth
+ * sign-in (decision 0067). The gateway finds its authorization server,
+ * checks it states PKCE S256 and offers dynamic registration, registers one
+ * client for the party, bound to its issuer, then approves the party with
+ * that client as its credential: its proxy ship is commissioned and crewed,
+ * unstated until a person signs in. A refused check keeps nothing. The same
+ * addition again finds the party it kept, and registers no second client.
+ */
+export declare function createAddSignInServer(deps: {
+    approveParty: ApproveParty;
+    parties: PartyStore;
+    servers: AuthorizationServers;
+    servesOutsideParties: (fleetId: FleetId) => Promise<boolean>;
+    /** Where the outside authorization server sends each person back after their sign-in. */
+    redirectUri: string;
+}): AddSignInServer;

package/dist/core/parties/add-sign-in-server.js

@@ -0,0 +1,70 @@
+import { refuse } from '../shared/errors.js';
+/** The PKCE method the gateway signs in with; an authorization server that does not state it is refused (MCP authorization). */
+const PKCE_METHOD = 'S256';
+/** The scopes a sign-in adds when the authorization server lists them: a refresh token, and the outside account's subject (Q8, Q13). */
+const ADDED_SCOPES = ['offline_access', 'openid'];
+/** The outside scopes each person's sign-in asks for (Q8): the 401's, else every scope the server lists, with offline_access and openid when the authorization server lists them. */
+function scopeOf(discovered) {
+    const asked = discovered.challengeScope === null ? [...discovered.resourceScopes] : discovered.challengeScope.split(' ');
+    const added = ADDED_SCOPES.filter((scope) => discovered.serverScopes.includes(scope) && !asked.includes(scope));
+    return [...asked, ...added].join(' ');
+}
+/**
+ * Use case: an approver adds an outside MCP server that takes only an OAuth
+ * sign-in (decision 0067). The gateway finds its authorization server,
+ * checks it states PKCE S256 and offers dynamic registration, registers one
+ * client for the party, bound to its issuer, then approves the party with
+ * that client as its credential: its proxy ship is commissioned and crewed,
+ * unstated until a person signs in. A refused check keeps nothing. The same
+ * addition again finds the party it kept, and registers no second client.
+ */
+export function createAddSignInServer(deps) {
+    return async (input) => {
+        const { operatorFleetId: fleetId, name, url, requestId } = input;
+        if (!(await deps.servesOutsideParties(fleetId))) {
+            return refuse('OUTSIDE_PARTIES_OFF', "This fleet's outside parties are off: turn them on first");
+        }
+        const earlier = await deps.parties.find(fleetId, name);
+        if (earlier) {
+            if (earlier.kind === 'mcpServer' && earlier.credential.kind === 'personSignIn' && earlier.requestId === requestId) {
+                return deps.approveParty({ ...input, credential: earlier.credential });
+            }
+            return refuse('PARTY_EXISTS', `A party named ${name} was approved already`);
+        }
+        const discovered = await deps.servers.discover(url);
+        if (!discovered.isOk) {
+            switch (discovered.error.kind) {
+                case 'unreachable':
+                    return refuse('SERVER_UNREACHABLE', `The MCP server could not be reached: ${discovered.error.reason}`);
+                case 'noAuthorizationServer':
+                    return refuse('NO_AUTHORIZATION_SERVER', `The server states no authorization server: ${discovered.error.reason}`);
+                case 'noServerMetadata':
+                    return refuse('SIGN_IN_CHECK_FAILED', `The authorization server failed its check: ${discovered.error.reason}`);
+            }
+        }
+        const signIn = discovered.value;
+        if (!signIn.codeChallengeMethods.includes(PKCE_METHOD)) {
+            return refuse('SIGN_IN_CHECK_FAILED', `The authorization server ${signIn.issuer} does not state PKCE ${PKCE_METHOD}`);
+        }
+        if (signIn.registrationEndpoint === null) {
+            return refuse('NO_DYNAMIC_REGISTRATION', `The authorization server ${signIn.issuer} offers no dynamic registration`);
+        }
+        const scope = scopeOf(signIn);
+        const registered = await deps.servers.register(signIn.registrationEndpoint, { clientName: `Aeolus: ${name}`, redirectUri: deps.redirectUri, scope });
+        if (!registered.isOk) {
+            return refuse('REGISTRATION_REFUSED', `The authorization server ${signIn.issuer} refused the registration: ${registered.error.reason}`);
+        }
+        const client = {
+            issuer: signIn.issuer,
+            authorizationEndpoint: signIn.authorizationEndpoint,
+            tokenEndpoint: signIn.tokenEndpoint,
+            revocationEndpoint: signIn.revocationEndpoint,
+            isIssuerInResponse: signIn.isIssuerInResponse,
+            ...registered.value,
+            resource: signIn.resource,
+            scope,
+        };
+        return deps.approveParty({ ...input, credential: { kind: 'personSignIn', client } });
+    };
+}
+//# sourceMappingURL=add-sign-in-server.js.map

package/dist/core/parties/add-sign-in-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-sign-in-server.js","sourceRoot":"","sources":["../../../src/core/parties/add-sign-in-server.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAO/D,gIAAgI;AAChI,MAAM,WAAW,GAAG,MAAM,CAAC;AAE3B,wIAAwI;AACxI,MAAM,YAAY,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;AAQlD,qLAAqL;AACrL,SAAS,OAAO,CAAC,UAA4B;IAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzH,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;IAChH,OAAO,CAAC,GAAG,KAAK,EAAE,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAOrC;IACC,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC;QACjE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAChD,OAAO,MAAM,CAAC,qBAAqB,EAAE,0DAA0D,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACvD,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,KAAK,cAAc,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBAClH,OAAO,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,MAAM,CAAC,cAAc,EAAE,iBAAiB,IAAI,uBAAuB,CAAC,CAAC;QAC9E,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpD,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACrB,QAAQ,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAC9B,KAAK,aAAa;oBAChB,OAAO,MAAM,CAAC,oBAAoB,EAAE,wCAAwC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;gBACzG,KAAK,uBAAuB;oBAC1B,OAAO,MAAM,CAAC,yBAAyB,EAAE,8CAA8C,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;gBACpH,KAAK,kBAAkB;oBACrB,OAAO,MAAM,CAAC,sBAAsB,EAAE,8CAA8C,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACnH,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC;QAChC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACvD,OAAO,MAAM,CAAC,sBAAsB,EAAE,4BAA4B,MAAM,CAAC,MAAM,wBAAwB,WAAW,EAAE,CAAC,CAAC;QACxH,CAAC;QACD,IAAI,MAAM,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;YACzC,OAAO,MAAM,CAAC,yBAAyB,EAAE,4BAA4B,MAAM,CAAC,MAAM,iCAAiC,CAAC,CAAC;QACvH,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,oBAAoB,EAAE,EAAE,UAAU,EAAE,WAAW,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACrJ,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC,sBAAsB,EAAE,4BAA4B,MAAM,CAAC,MAAM,8BAA8B,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1I,CAAC;QACD,MAAM,MAAM,GAAiB;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,qBAAqB,EAAE,MAAM,CAAC,qBAAqB;YACnD,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,GAAG,UAAU,CAAC,KAAK;YACnB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK;SACN,CAAC;QACF,OAAO,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IACvF,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/approve-party.d.ts

@@ -4,7 +4,7 @@ import type { RequestHasher } from '../installation/ports.js';
 import type { Clock } from '../shared/clock.js';
 import { type DomainError } from '../shared/errors.js';
 import { type Result } from '../shared/result.js';
-import type { McpServerCredential } from '../vault/credential.js';
+import type { McpServerPartyCredential } from '../vault/credential.js';
 import { type Party } from './party.js';
 import type { PartyStore, ProxyShipDoor } from './ports.js';
 import { type ShownParty } from './shown-party.js';
@@ -23,7 +23,7 @@ export type ApproveParty = (input: {
     requestId: string;
     name: string;
     url: string;
-    credential: McpServerCredential;
+    credential: McpServerPartyCredential;
     ownerShipId: ShipId;
     /** The scopes granted its proxy ship beside the ones every app ship gets (decision 0046). */
     scopes: readonly string[];

package/dist/core/parties/check-approving.d.ts

@@ -11,7 +11,7 @@ export type CheckApproving = (input: {
     as: ActorCredential;
     name: string;
 }) => Promise<Result<undefined, ApprovingRefusal>>;
-interface ApprovingDeps {
+export interface ApprovingDeps {
     parties: PartyStore;
     connections: Pick<ConnectionStore, 'find'>;
     fleet: Pick<ProxyShipsAsActor, 'checkManage'>;
@@ -19,13 +19,14 @@ interface ApprovingDeps {
 }
 /**
  * The outside MCP server or A2A agent an actor approves, with the gateway's
- * connection: the actor holds gateway:approve, and the fleet, asked as the
+ * connection and the actor's credential: the actor holds gateway:approve, and the fleet, asked as the
  * actor, answers that it manages the party's proxy ship (A2). The fleet
  * records a refusal.
  */
 export declare function approvedParty(deps: ApprovingDeps, { actor, as, name }: Parameters<CheckApproving>[0]): Promise<Result<{
     party: McpServerParty | A2aAgentParty;
     gateway: GatewayCrew;
+    credential: ActorCredential;
 }, ApprovingRefusal>>;
 /**
  * Use case: whether an actor approves an outside MCP server or A2A agent
@@ -33,4 +34,3 @@ export declare function approvedParty(deps: ApprovingDeps, { actor, as, name }:
  * the same table read-only otherwise.
  */
 export declare function createCheckApproving(deps: ApprovingDeps): CheckApproving;
-export {};

package/dist/core/parties/check-approving.js

@@ -3,7 +3,7 @@ import { ok } from '../shared/result.js';
 import { APPROVING_SCOPE } from './approver.js';
 /**
  * The outside MCP server or A2A agent an actor approves, with the gateway's
- * connection: the actor holds gateway:approve, and the fleet, asked as the
+ * connection and the actor's credential: the actor holds gateway:approve, and the fleet, asked as the
  * actor, answers that it manages the party's proxy ship (A2). The fleet
  * records a refusal.
  */
@@ -32,7 +32,7 @@ export async function approvedParty(deps, { actor, as, name }) {
             ? refuse('FLEET_UNAVAILABLE', `The fleet did not say whether you manage ${name}: ${managed.error.message}`)
             : refuse('NOT_REACHABLE', managed.error.message);
     }
-    return ok({ party, gateway });
+    return ok({ party, gateway, credential: credential.value });
 }
 /**
  * Use case: whether an actor approves an outside MCP server or A2A agent

package/dist/core/parties/check-approving.js.map

@@ -1 +1 @@
-{"version":3,"file":"check-approving.js","sourceRoot":"","sources":["../../../src/core/parties/check-approving.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAehD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAmB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAiC;IACzG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,iBAAiB,EAAE,mDAAmD,eAAe,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,KAAK,EAAE,IAAI,KAAK,WAAW,IAAI,KAAK,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;QAC9D,OAAO,MAAM,CAAC,eAAe,EAAE,+CAA+C,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,wBAAwB,EAAE,GAAG,IAAI,uCAAuC,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,eAAe,EAAE,2CAA2C,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACrB,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9F,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa;YACzC,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,4CAA4C,IAAI,KAAK,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAC3G,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAmB;IACtD,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAClD,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"check-approving.js","sourceRoot":"","sources":["../../../src/core/parties/check-approving.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAehD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAmB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAiC;IACzG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,iBAAiB,EAAE,mDAAmD,eAAe,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,KAAK,EAAE,IAAI,KAAK,WAAW,IAAI,KAAK,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;QAC9D,OAAO,MAAM,CAAC,eAAe,EAAE,+CAA+C,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,wBAAwB,EAAE,GAAG,IAAI,uCAAuC,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,eAAe,EAAE,2CAA2C,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACrB,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9F,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa;YACzC,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,4CAA4C,IAAI,KAAK,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAC3G,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAmB;IACtD,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAClD,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/party.d.ts

@@ -1,5 +1,5 @@
 import type { FleetId, ShipId, VerifiedFact } from '@aeolus-fleet/common';
-import type { McpServerCredential } from '../vault/credential.js';
+import type { McpServerCredential, McpServerPartyCredential } from '../vault/credential.js';
 import type { ToolSwitches } from './tool-switches.js';
 /**
  * Where an approved party's proxy ship stands (interop I-5):
@@ -32,7 +32,7 @@ export interface McpServerParty extends PartyBase {
     readonly kind: 'mcpServer';
     /** The server's Streamable HTTP endpoint. */
     readonly url: string;
-    readonly credential: McpServerCredential;
+    readonly credential: McpServerPartyCredential;
     /** The most calls the gateway has in flight to the server at once. */
     readonly concurrencyLimit: number;
     /** Which of its tools the fleet may call; none kept yet means every tool it lists (aeolus-fleet#1151). */
@@ -67,6 +67,7 @@ export type Party = McpServerParty | McpClientParty | A2aClientParty | A2aAgentP
  * 0059): the host it reached an MCP server at over TLS, and the domain of the
  * metadata document it read an MCP client's id from over TLS. A client argo
  * registered has no document, and an address without TLS proves no host.
+ * A server where each person signs in: the issuer of the party's client.
  * The domain an A2A agent's card was read from over TLS. The gateway checks
  * nothing about an A2A client: an approver names it.
  */

package/dist/core/parties/party.js

@@ -13,6 +13,7 @@ function tlsHostOf(address) {
  * 0059): the host it reached an MCP server at over TLS, and the domain of the
  * metadata document it read an MCP client's id from over TLS. A client argo
  * registered has no document, and an address without TLS proves no host.
+ * A server where each person signs in: the issuer of the party's client.
  * The domain an A2A agent's card was read from over TLS. The gateway checks
  * nothing about an A2A client: an approver names it.
  */
@@ -20,7 +21,9 @@ export function verifiedFactsOf(party) {
     switch (party.kind) {
         case 'mcpServer': {
             const host = tlsHostOf(party.url);
-            return host === undefined ? [] : [{ checked: 'tlsHost', value: host }];
+            const reached = host === undefined ? [] : [{ checked: 'tlsHost', value: host }];
+            // Where each person signs in, the issuer only (decision 0067): the subject it issued the party's client to, never a person's outside account.
+            return party.credential.kind === 'personSignIn' ? [...reached, { checked: 'oauthSubject', issuer: party.credential.client.issuer, value: party.credential.client.clientId }] : reached;
         }
         case 'mcpClient': {
             const host = tlsHostOf(party.clientId);

package/dist/core/parties/party.js.map

@@ -1 +1 @@
-{"version":3,"file":"party.js","sourceRoot":"","sources":["../../../src/core/parties/party.ts"],"names":[],"mappings":"AAyEA,oGAAoG;AACpG,SAAS,SAAS,CAAC,OAAe;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,KAAY;IAC1C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAClC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACvC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACtC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,KAAK,WAAW;YACd,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"party.js","sourceRoot":"","sources":["../../../src/core/parties/party.ts"],"names":[],"mappings":"AAyEA,oGAAoG;AACpG,SAAS,SAAS,CAAC,OAAe;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,KAAY;IAC1C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAClC,MAAM,OAAO,GAAmB,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAChG,8IAA8I;YAC9I,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACzL,CAAC;QACD,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACvC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,wBAAwB,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACtC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,KAAK,WAAW;YACd,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/core/parties/ports.d.ts

@@ -118,3 +118,52 @@ export interface FleetShip {
 export interface FleetShips {
     list(as: ActorCredential): Promise<Result<FleetShip[], FleetRefusal>>;
 }
+/** What an outside MCP server says about its sign-in: its protected resource metadata (RFC 9728) and its authorization server's metadata (RFC 8414 or OpenID Connect). */
+export interface DiscoveredSignIn {
+    /** The resource indicator the server names itself by. */
+    readonly resource: string;
+    /** The scope its 401 named, if it named one. */
+    readonly challengeScope: string | null;
+    /** The scopes its protected resource metadata lists. */
+    readonly resourceScopes: readonly string[];
+    /** The authorization server's issuer, matching the one the server named. */
+    readonly issuer: string;
+    readonly authorizationEndpoint: string;
+    readonly tokenEndpoint: string;
+    readonly registrationEndpoint: string | null;
+    readonly revocationEndpoint: string | null;
+    /** Whether it states its issuer in each authorization response (RFC 9207). */
+    readonly isIssuerInResponse: boolean;
+    readonly codeChallengeMethods: readonly string[];
+    /** The scopes the authorization server lists. */
+    readonly serverScopes: readonly string[];
+}
+/**
+ * Why a server's sign-in could not be found:
+ * - noAuthorizationServer: its 401 and its well-known address name no protected resource metadata;
+ * - noServerMetadata: the authorization server it names has no metadata, or metadata whose issuer is not the one named;
+ * - unreachable: the server or its authorization server did not answer.
+ */
+export interface DiscoveryFailure {
+    readonly kind: 'noAuthorizationServer' | 'noServerMetadata' | 'unreachable';
+    readonly reason: string;
+}
+/** What dynamic registration answered (RFC 7591, 7592). */
+export interface RegisteredClient {
+    readonly clientId: string;
+    readonly clientSecret: string | null;
+    readonly registrationClientUri: string | null;
+    readonly registrationAccessToken: string | null;
+}
+/** Outbound port: outside MCP servers' authorization servers, as the gateway, an OAuth client, reaches them. */
+export interface AuthorizationServers {
+    discover(serverUrl: string): Promise<Result<DiscoveredSignIn, DiscoveryFailure>>;
+    /** Registers a confidential client for the authorization code flow; the server's own error when it refuses or does not answer. */
+    register(registrationEndpoint: string, client: {
+        clientName: string;
+        redirectUri: string;
+        scope: string;
+    }): Promise<Result<RegisteredClient, {
+        readonly reason: string;
+    }>>;
+}

package/dist/core/parties/read-party-tools.d.ts

@@ -1,5 +1,6 @@
 import type { FleetId } from '@aeolus-fleet/common';
 import type { McpServers } from '../mcp-out/ports.js';
+import type { ListingConnectionOf } from '../party-grants/listing-connection.js';
 import { type DomainError } from '../shared/errors.js';
 import { type Result } from '../shared/result.js';
 import type { PartyStore } from './ports.js';
@@ -9,10 +10,11 @@ export type ReadPartyTools = (party: {
     name: string;
 }) => Promise<Result<{
     tools: SwitchedTool[];
-}, DomainError<'NO_SUCH_PARTY' | 'SERVER_UNREACHABLE'>>>;
+}, DomainError<'NO_SUCH_PARTY' | 'NOT_SIGNED_IN' | 'SERVER_UNREACHABLE'>>>;
 /**
  * Use case: an outside MCP server's tools, as the server lists them now,
- * asked with the credential the gateway keeps for it, each with its switch
+ * asked with the credential the gateway keeps for it, or under a person's
+ * grant where each person signs in (decision 0067), each with its switch
  * (aeolus-fleet#1151). It keeps nothing:
  * the proxy ship's statement in the fleet is where the tools live, and
  * core does not answer a statement to a reader yet, so the server is asked.
@@ -20,4 +22,5 @@ export type ReadPartyTools = (party: {
 export declare function createReadPartyTools(deps: {
     parties: PartyStore;
     servers: McpServers;
+    connectionOf: ListingConnectionOf;
 }): ReadPartyTools;

package/dist/core/parties/read-party-tools.js

@@ -3,7 +3,8 @@ import { ok } from '../shared/result.js';
 import { switchedToolsOf } from './tool-switches.js';
 /**
  * Use case: an outside MCP server's tools, as the server lists them now,
- * asked with the credential the gateway keeps for it, each with its switch
+ * asked with the credential the gateway keeps for it, or under a person's
+ * grant where each person signs in (decision 0067), each with its switch
  * (aeolus-fleet#1151). It keeps nothing:
  * the proxy ship's statement in the fleet is where the tools live, and
  * core does not answer a statement to a reader yet, so the server is asked.
@@ -14,7 +15,11 @@ export function createReadPartyTools(deps) {
         if (party?.kind !== 'mcpServer') {
             return refuse('NO_SUCH_PARTY', `There is no outside MCP server ${name}`);
         }
-        const listed = await deps.servers.listTools({ url: party.url, credential: party.credential });
+        const connection = await deps.connectionOf(party);
+        if (connection === undefined) {
+            return refuse('NOT_SIGNED_IN', `Nobody holds a usable sign-in to ${name}, so its tools cannot be listed`);
+        }
+        const listed = await deps.servers.listTools(connection);
         if (!listed.isOk) {
             return refuse('SERVER_UNREACHABLE', `The MCP server of ${name} could not be listed: ${listed.error.reason}`);
         }

package/dist/core/parties/read-party-tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"read-party-tools.js","sourceRoot":"","sources":["../../../src/core/parties/read-party-tools.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAqB,MAAM,oBAAoB,CAAC;AAIxE;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAkD;IACrF,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,IAAI,KAAK,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC,eAAe,EAAE,kCAAkC,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9F,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,oBAAoB,EAAE,qBAAqB,IAAI,yBAAyB,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"read-party-tools.js","sourceRoot":"","sources":["../../../src/core/parties/read-party-tools.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAqB,MAAM,oBAAoB,CAAC;AAIxE;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAqF;IACxH,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,IAAI,KAAK,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC,eAAe,EAAE,kCAAkC,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC,eAAe,EAAE,oCAAoC,IAAI,iCAAiC,CAAC,CAAC;QAC5G,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,oBAAoB,EAAE,qBAAqB,IAAI,yBAAyB,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/retire-party.d.ts

@@ -1,6 +1,7 @@
 import type { Actor } from '../actors/authenticate-actor.js';
 import type { ActorCredential, CredentialOf } from '../actors/credential-of.js';
 import type { IssuedTokens } from '../oauth/ports.js';
+import type { EndPartyGrants } from '../party-grants/end-party-grants.js';
 import { type DomainError } from '../shared/errors.js';
 import { type Result } from '../shared/result.js';
 import type { PartyStore, ProxyShipsAsActor } from './ports.js';
@@ -17,7 +18,9 @@ export type RetireParty = (input: {
  * 0056). Its proxy ship is retired in the fleet as the actor, so the fleet
  * checks its manage reach, and only then does the gateway forget the party
  * and revoke its client's tokens; its worker ends as the fleet ends the
- * proxy ship's crew. A proxy ship retired already is retired. A party whose
+ * proxy ship's crew. A server where each person signs in has every grant
+ * ended and its client deleted where offered (decision 0067) before it is
+ * forgotten. A proxy ship retired already is retired. A party whose
  * ship the gateway never learned asks the fleet nothing. Adding it again is
  * a new request.
  */
@@ -25,5 +28,6 @@ export declare function createRetireParty(deps: {
     parties: PartyStore;
     fleet: ProxyShipsAsActor;
     tokens: Pick<IssuedTokens, 'revokeParty'>;
+    endPartyGrants: EndPartyGrants;
     credentialOf: CredentialOf;
 }): RetireParty;

package/dist/core/parties/retire-party.js

@@ -9,7 +9,9 @@ const RETIRED_ALREADY = 'CONFLICT';
  * 0056). Its proxy ship is retired in the fleet as the actor, so the fleet
  * checks its manage reach, and only then does the gateway forget the party
  * and revoke its client's tokens; its worker ends as the fleet ends the
- * proxy ship's crew. A proxy ship retired already is retired. A party whose
+ * proxy ship's crew. A server where each person signs in has every grant
+ * ended and its client deleted where offered (decision 0067) before it is
+ * forgotten. A proxy ship retired already is retired. A party whose
  * ship the gateway never learned asks the fleet nothing. Adding it again is
  * a new request.
  */
@@ -35,6 +37,9 @@ export function createRetireParty(deps) {
                 return refuse('RETIRE_REFUSED', retired.error.message);
             }
         }
+        if (party.kind === 'mcpServer' && party.credential.kind === 'personSignIn') {
+            await deps.endPartyGrants({ fleetId: actor.fleetId, name, client: party.credential.client });
+        }
         await deps.parties.remove(actor.fleetId, name);
         await deps.tokens.revokeParty(actor.fleetId, name);
         return ok(undefined);

package/dist/core/parties/retire-party.js.map

@@ -1 +1 @@
-{"version":3,"file":"retire-party.js","sourceRoot":"","sources":["../../../src/core/parties/retire-party.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAGtD,uFAAuF;AACvF,MAAM,CAAC,MAAM,cAAc,GAAG,cAAc,CAAC;AAE7C,uFAAuF;AACvF,MAAM,eAAe,GAAG,UAAU,CAAC;AAMnC;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA8H;IAC9J,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;QACnC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC3C,OAAO,MAAM,CAAC,eAAe,EAAE,mCAAmC,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC3D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,MAAM,CAAC,eAAe,EAAE,6BAA6B,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACtD,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBACrB,OAAO,UAAU,CAAC;YACpB,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;YACzF,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAC1D,OAAO,MAAM,CAAC,mBAAmB,EAAE,4BAA4B,IAAI,kBAAkB,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChH,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gBAC5D,OAAO,MAAM,CAAC,gBAAgB,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC/C,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"retire-party.js","sourceRoot":"","sources":["../../../src/core/parties/retire-party.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAGtD,uFAAuF;AACvF,MAAM,CAAC,MAAM,cAAc,GAAG,cAAc,CAAC;AAE7C,uFAAuF;AACvF,MAAM,eAAe,GAAG,UAAU,CAAC;AAMnC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA8J;IAC9L,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;QACnC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC3C,OAAO,MAAM,CAAC,eAAe,EAAE,mCAAmC,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC3D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,MAAM,CAAC,eAAe,EAAE,6BAA6B,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACtD,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBACrB,OAAO,UAAU,CAAC;YACpB,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;YACzF,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAC1D,OAAO,MAAM,CAAC,mBAAmB,EAAE,4BAA4B,IAAI,kBAAkB,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAChH,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;gBAC5D,OAAO,MAAM,CAAC,gBAAgB,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YAC3E,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC/C,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/shown-party.d.ts

@@ -1,5 +1,5 @@
 import type { ShipId } from '@aeolus-fleet/common';
-import type { McpServerCredential } from '../vault/credential.js';
+import type { McpServerCredential, McpServerPartyCredential } from '../vault/credential.js';
 import type { Party, PartyState } from './party.js';
 interface ShownPartyBase {
     name: string;
@@ -10,7 +10,7 @@ interface ShownPartyBase {
 export type ShownParty = (ShownPartyBase & {
     kind: 'mcpServer';
     url: string;
-    credentialKind: McpServerCredential['kind'];
+    credentialKind: McpServerPartyCredential['kind'];
     concurrencyLimit: number;
 }) | (ShownPartyBase & {
     kind: 'mcpClient';

package/dist/core/parties/sign-in-servers.d.ts

@@ -0,0 +1,4 @@
+import type { SignInServers } from '../party-grants/ports.js';
+import type { PartyStore } from './ports.js';
+/** Parties published to Party Grants: an approved outside MCP server is a sign-in server, with its client where each person signs in. */
+export declare function signInServersOf(parties: Pick<PartyStore, 'find'>): SignInServers;

package/dist/core/parties/sign-in-servers.js

@@ -0,0 +1,13 @@
+/** Parties published to Party Grants: an approved outside MCP server is a sign-in server, with its client where each person signs in. */
+export function signInServersOf(parties) {
+    return {
+        async find(fleetId, name) {
+            const party = await parties.find(fleetId, name);
+            if (party?.kind !== 'mcpServer') {
+                return undefined;
+            }
+            return { fleetId: party.fleetId, name: party.name, client: party.credential.kind === 'personSignIn' ? party.credential.client : null };
+        },
+    };
+}
+//# sourceMappingURL=sign-in-servers.js.map

package/dist/core/parties/sign-in-servers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in-servers.js","sourceRoot":"","sources":["../../../src/core/parties/sign-in-servers.ts"],"names":[],"mappings":"AAGA,yIAAyI;AACzI,MAAM,UAAU,eAAe,CAAC,OAAiC;IAC/D,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI;YACtB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAChD,IAAI,KAAK,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;gBAChC,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzI,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/core/parties/switch-tools.d.ts

@@ -3,11 +3,12 @@ import type { ActorCredential, CredentialOf } from '../actors/credential-of.js';
 import type { ConnectionStore } from '../connection/ports.js';
 import type { McpServers } from '../mcp-out/ports.js';
 import type { StateParty } from '../mcp-out/state-party.js';
+import type { ListingConnectionOf } from '../party-grants/listing-connection.js';
 import { type DomainError } from '../shared/errors.js';
 import { type Result } from '../shared/result.js';
 import { type ApprovingRefusal } from './check-approving.js';
 import type { PartyStore, ProxyShipsAsActor } from './ports.js';
-export type SwitchToolsRefusal = ApprovingRefusal | DomainError<'SERVER_UNREACHABLE' | 'NO_SUCH_TOOL'>;
+export type SwitchToolsRefusal = ApprovingRefusal | DomainError<'NOT_SIGNED_IN' | 'SERVER_UNREACHABLE' | 'NO_SUCH_TOOL'>;
 export type SwitchTools = (input: {
     actor: Actor;
     as: ActorCredential;
@@ -32,6 +33,7 @@ export type SwitchTools = (input: {
 export declare function createSwitchTools(deps: {
     parties: PartyStore;
     servers: McpServers;
+    connectionOf: ListingConnectionOf;
     stateParty: StateParty;
     connections: Pick<ConnectionStore, 'find'>;
     fleet: Pick<ProxyShipsAsActor, 'checkManage'>;

package/dist/core/parties/switch-tools.js

@@ -21,7 +21,11 @@ export function createSwitchTools(deps) {
         if (party.kind !== 'mcpServer') {
             return refuse('NO_SUCH_PARTY', `There is no outside MCP server ${name}`);
         }
-        const listed = await deps.servers.listTools({ url: party.url, credential: party.credential });
+        const connection = await deps.connectionOf(party);
+        if (connection === undefined) {
+            return refuse('NOT_SIGNED_IN', `Nobody holds a usable sign-in to ${name}, so its tools cannot be listed`);
+        }
+        const listed = await deps.servers.listTools(connection);
         if (!listed.isOk) {
             return refuse('SERVER_UNREACHABLE', `The MCP server of ${name} could not be listed: ${listed.error.reason}`);
         }

package/dist/core/parties/switch-tools.js.map

@@ -1 +1 @@
-{"version":3,"file":"switch-tools.js","sourceRoot":"","sources":["../../../src/core/parties/switch-tools.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAyB,MAAM,sBAAsB,CAAC;AAS5E;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAOjC;IACC,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;QAChD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC;QACjC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC,eAAe,EAAE,kCAAkC,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9F,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,oBAAoB,EAAE,qBAAqB,IAAI,yBAAyB,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,MAAM,CAAC,cAAc,EAAE,qBAAqB,IAAI,kBAAkB,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxG,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1I,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACtG,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"switch-tools.js","sourceRoot":"","sources":["../../../src/core/parties/switch-tools.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAyB,MAAM,sBAAsB,CAAC;AAS5E;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAQjC;IACC,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;QAChD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC;QACjC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC,eAAe,EAAE,kCAAkC,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC,eAAe,EAAE,oCAAoC,IAAI,iCAAiC,CAAC,CAAC;QAC5G,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,oBAAoB,EAAE,qBAAqB,IAAI,yBAAyB,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,MAAM,CAAC,cAAc,EAAE,qBAAqB,IAAI,kBAAkB,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxG,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1I,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACtG,CAAC,CAAC;AACJ,CAAC"}