@aeolus-fleet/gateway 0.33.0 → 0.35.0

package/dist/core/party-grants/approved-sign-in-party.d.ts

@@ -0,0 +1,17 @@
+import type { ActorCredential } from '../actors/credential-of.js';
+import type { ApprovingDeps, ApprovingRefusal, CheckApproving } from '../parties/check-approving.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { SignInClient } from '../vault/credential.js';
+export type ApprovedSignInPartyRefusal = ApprovingRefusal | DomainError<'NO_SIGN_IN'>;
+/**
+ * The outside MCP server where each person signs in whose grants an approver
+ * sees and removes (decision 0067, Q6, Q12): the actor holds gateway:approve
+ * within manage reach of its proxy ship, as the fleet answers; its name and
+ * client, and the actor's credential to read the fleet as.
+ */
+export declare function approvedSignInParty(deps: ApprovingDeps, asked: Parameters<CheckApproving>[0]): Promise<Result<{
+    name: string;
+    client: SignInClient;
+    credential: ActorCredential;
+}, ApprovedSignInPartyRefusal>>;

package/dist/core/party-grants/approved-sign-in-party.js

@@ -0,0 +1,21 @@
+import { approvedParty } from '../parties/check-approving.js';
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+/**
+ * The outside MCP server where each person signs in whose grants an approver
+ * sees and removes (decision 0067, Q6, Q12): the actor holds gateway:approve
+ * within manage reach of its proxy ship, as the fleet answers; its name and
+ * client, and the actor's credential to read the fleet as.
+ */
+export async function approvedSignInParty(deps, asked) {
+    const approved = await approvedParty(deps, asked);
+    if (!approved.isOk) {
+        return approved;
+    }
+    const { party, credential } = approved.value;
+    if (party.kind !== 'mcpServer' || party.credential.kind !== 'personSignIn') {
+        return refuse('NO_SIGN_IN', `Nobody signs in to ${party.name} for themselves: the gateway calls it with its own credential`);
+    }
+    return ok({ name: party.name, client: party.credential.client, credential });
+}
+//# sourceMappingURL=approved-sign-in-party.js.map

package/dist/core/party-grants/approved-sign-in-party.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approved-sign-in-party.js","sourceRoot":"","sources":["../../../src/core/party-grants/approved-sign-in-party.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAKtD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAmB,EAAE,KAAoC;IACjG,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC;IAC7C,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;QAC3E,OAAO,MAAM,CAAC,YAAY,EAAE,sBAAsB,KAAK,CAAC,IAAI,+DAA+D,CAAC,CAAC;IAC/H,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;AAC/E,CAAC"}

package/dist/core/party-grants/call-grant.d.ts

@@ -0,0 +1,46 @@
+import type { FleetId, ShipId } from '@aeolus-fleet/common';
+import type { ConnectionStore, FleetDoor } from '../connection/ports.js';
+import type { PartyGrant } from './party-grant.js';
+import type { PartyGrants } from './ports.js';
+/** A person a call is for: their person ship, by id and name. */
+export interface CallPerson {
+    readonly shipId: ShipId;
+    readonly name: string;
+}
+/**
+ * Whose grant a call goes out under:
+ * - grant: the person who owns the asking ship holds one for the party;
+ * - notSignedIn: they hold none, or a lost one (Q5);
+ * - noPerson: argo owns the asking ship, or it is argo, so no person can sign in for it (Q10);
+ * - unread: core did not answer the owner read, so the call waits and is tried again, never made without its person's grant.
+ */
+export type CallGrant = {
+    readonly kind: 'grant';
+    readonly grant: PartyGrant;
+    readonly person: CallPerson;
+} | {
+    readonly kind: 'notSignedIn';
+    readonly person: CallPerson;
+} | {
+    readonly kind: 'noPerson';
+    readonly shipName: string;
+} | {
+    readonly kind: 'unread';
+};
+export type CallGrantOf = (call: {
+    fleetId: FleetId;
+    party: string;
+    senderShipId: ShipId;
+}) => Promise<CallGrant>;
+/**
+ * The grant a call to a server where each person signs in goes out under
+ * (decision 0067, Q1, Q11): the grant of the person who owns the asking
+ * ship, a person ship owning itself. The owner is read from core at each
+ * hand-over, as the gateway's ship on the asking ship's behalf, as the scope
+ * check reads it: a change of owner holds from the next call.
+ */
+export declare function createCallGrantOf(deps: {
+    connections: Pick<ConnectionStore, 'find'>;
+    door: Pick<FleetDoor, 'getShip'>;
+    grants: Pick<PartyGrants, 'ofPerson'>;
+}): CallGrantOf;

package/dist/core/party-grants/call-grant.js

@@ -0,0 +1,30 @@
+/** argo's name, which core reserves for it: an owner of this name is argo, never a person (decision 0045). */
+const ARGO_NAME = 'argo';
+/**
+ * The grant a call to a server where each person signs in goes out under
+ * (decision 0067, Q1, Q11): the grant of the person who owns the asking
+ * ship, a person ship owning itself. The owner is read from core at each
+ * hand-over, as the gateway's ship on the asking ship's behalf, as the scope
+ * check reads it: a change of owner holds from the next call.
+ */
+export function createCallGrantOf(deps) {
+    return async ({ fleetId, party, senderShipId }) => {
+        const gateway = await deps.connections.find(fleetId);
+        if (gateway === undefined) {
+            return { kind: 'unread' };
+        }
+        const ship = await deps.door.getShip(gateway.crewToken, { shipId: senderShipId, onBehalfOf: senderShipId });
+        if (!ship.isOk) {
+            return { kind: 'unread' };
+        }
+        const { owner } = ship.value;
+        if (owner === null || owner.name === ARGO_NAME) {
+            return { kind: 'noPerson', shipName: ship.value.name };
+        }
+        const person = { shipId: owner.shipId, name: owner.name };
+        const grant = await deps.grants.ofPerson(fleetId, { party, personShipId: owner.shipId });
+        // None, or a lost one, alike.
+        return grant?.lost !== null ? { kind: 'notSignedIn', person } : { kind: 'grant', grant, person };
+    };
+}
+//# sourceMappingURL=call-grant.js.map

package/dist/core/party-grants/call-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"call-grant.js","sourceRoot":"","sources":["../../../src/core/party-grants/call-grant.ts"],"names":[],"mappings":"AAMA,8GAA8G;AAC9G,MAAM,SAAS,GAAG,MAAM,CAAC;AAuBzB;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA6H;IAC7J,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE;QAChD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC;QAC5G,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QAC7B,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/C,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACzD,CAAC;QACD,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACzF,8BAA8B;QAC9B,OAAO,KAAK,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACnG,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/party-grants/complete-party-sign-in.d.ts

@@ -0,0 +1,52 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { AccountOfSignIn } from '../account-sign-in/account-of-sign-in.js';
+import type { Clock } from '../shared/clock.js';
+import type { DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { PartyGrants, PartySignIns, PartySignInSeals, SignInNotices, SignInServers, StatesProxyShip } from './ports.js';
+/** The party's page a refusal goes back to: none when the state names no sign-in the gateway started. */
+export interface SignInPage {
+    readonly fleetId: FleetId;
+    readonly party: string;
+}
+export type CompletePartySignInRefusal = DomainError<'SIGN_IN_FAILED' | 'NOT_SIGNED_IN' | 'TURNED_AWAY' | 'AUTHORIZATION_SERVER_UNREACHABLE' | 'NO_SUCH_PARTY'> & {
+    readonly at: SignInPage | null;
+    /** The OAuth error code the authorization server answered, if it answered one. */
+    readonly serverError: string | null;
+};
+export type CompletePartySignIn = (back: {
+    state: string | undefined;
+    code: string | undefined;
+    error: string | undefined;
+    /** The issuer the authorization response names (RFC 9207), if it names one. */
+    iss: string | undefined;
+    /** The browser's shared sign-in, as pagasae's cookie carries it. */
+    signIn: string | undefined;
+}) => Promise<Result<SignInPage & {
+    statementRefusal: string | null;
+}, CompletePartySignInRefusal>>;
+/**
+ * Use case: the outside authorization server sends a person back from
+ * signing in to a party for themselves (decision 0067). Within the sign-in's
+ * ten minutes, in a browser whose shared sign-in names the account that
+ * started it, and with the party's issuer where the response names one or
+ * the server states it always does (RFC 9207), the code is redeemed with
+ * the party's client and the sign-in's PKCE verifier; else it is never
+ * redeemed. A person who denied consent is not signed in. Where the ID
+ * token names an outside account another person's grant already names, the
+ * person is turned away and the tokens are dropped (Q13). Else the grant is
+ * kept in place of the person's earlier one, the notice that told them a
+ * call needed it is closed, so a later loss tells them again (Q6), and the
+ * proxy ship is stated from it (Q15). Nothing is kept on any refusal.
+ */
+export declare function createCompletePartySignIn(deps: {
+    servers: SignInServers;
+    grants: Pick<PartyGrants, 'ofSubject' | 'keep'>;
+    seals: PartySignInSeals;
+    signIns: Pick<PartySignIns, 'redeemCode'>;
+    notices: Pick<SignInNotices, 'close'>;
+    accountOf: (asked: Parameters<AccountOfSignIn>[0]) => ReturnType<AccountOfSignIn>;
+    stateParty: StatesProxyShip;
+    clock: Clock;
+    redirectUri: string;
+}): CompletePartySignIn;

package/dist/core/party-grants/complete-party-sign-in.js

@@ -0,0 +1,95 @@
+import { err, ok } from '../shared/result.js';
+import { accessTokenEndsAtOf } from './party-grant.js';
+function refused(at, refusal) {
+    return err({ serverError: null, ...refusal, at });
+}
+/** The outside account an ID token names, once it is checked to be the party's issuer's, for the party's client; none when it is not. */
+function outsideAccountOf(idToken, client) {
+    if (idToken === null) {
+        return { subject: null, name: null };
+    }
+    // Redeemed over TLS straight from the token endpoint, so its issuer and audience are what is left to check (OpenID Connect Core 3.1.3.7).
+    if (idToken.issuer !== client.issuer || !idToken.audiences.includes(client.clientId)) {
+        return undefined;
+    }
+    return { subject: idToken.subject, name: idToken.name };
+}
+/**
+ * Use case: the outside authorization server sends a person back from
+ * signing in to a party for themselves (decision 0067). Within the sign-in's
+ * ten minutes, in a browser whose shared sign-in names the account that
+ * started it, and with the party's issuer where the response names one or
+ * the server states it always does (RFC 9207), the code is redeemed with
+ * the party's client and the sign-in's PKCE verifier; else it is never
+ * redeemed. A person who denied consent is not signed in. Where the ID
+ * token names an outside account another person's grant already names, the
+ * person is turned away and the tokens are dropped (Q13). Else the grant is
+ * kept in place of the person's earlier one, the notice that told them a
+ * call needed it is closed, so a later loss tells them again (Q6), and the
+ * proxy ship is stated from it (Q15). Nothing is kept on any refusal.
+ */
+export function createCompletePartySignIn(deps) {
+    return async ({ state, code, error, iss, signIn }) => {
+        const now = deps.clock.now();
+        const underWay = state === undefined ? undefined : deps.seals.open(state);
+        if (underWay === undefined || underWay.expiresAt <= now) {
+            return refused(null, { kind: 'SIGN_IN_FAILED', message: 'This sign-in did not start at the gateway, or took longer than ten minutes: press Sign in again' });
+        }
+        const { fleetId, party: name, accountId, personShipId, verifier } = underWay;
+        const at = { fleetId, party: name };
+        const signedIn = signIn === undefined ? undefined : await deps.accountOf({ signIn, fleetId });
+        if (signedIn === undefined || !signedIn.isOk || signedIn.value.accountId !== accountId) {
+            return refused(at, { kind: 'SIGN_IN_FAILED', message: 'This sign-in was started by another account or browser: sign in and press Sign in again' });
+        }
+        const server = await deps.servers.find(fleetId, name);
+        if (server === undefined || server.client === null) {
+            return refused(at, { kind: 'NO_SUCH_PARTY', message: `There is no outside MCP server ${name} to sign in to any more` });
+        }
+        const { client } = server;
+        if (error !== undefined || code === undefined) {
+            return refused(at, { kind: 'NOT_SIGNED_IN', message: `You are not signed in to ${name}: the sign-in was cancelled or refused there`, serverError: error ?? null });
+        }
+        if (iss === undefined ? client.isIssuerInResponse : iss !== client.issuer) {
+            return refused(at, { kind: 'SIGN_IN_FAILED', message: `The sign-in came back without the issuer of ${name}, ${client.issuer}: press Sign in again` });
+        }
+        const redeemed = await deps.signIns.redeemCode(client, { code, verifier, redirectUri: deps.redirectUri });
+        if (!redeemed.isOk) {
+            return redeemed.error.kind === 'refused'
+                ? refused(at, { kind: 'SIGN_IN_FAILED', message: `${client.issuer} refused the sign-in: ${redeemed.error.reason}`, serverError: redeemed.error.error })
+                : refused(at, { kind: 'AUTHORIZATION_SERVER_UNREACHABLE', message: `${client.issuer} did not answer: ${redeemed.error.reason}` });
+        }
+        const tokens = redeemed.value;
+        const outsideAccount = outsideAccountOf(tokens.idToken, client);
+        if (outsideAccount === undefined) {
+            return refused(at, { kind: 'SIGN_IN_FAILED', message: `${client.issuer} answered an ID token that is not its own for this server's client: press Sign in again` });
+        }
+        const turnedAway = () => refused(at, { kind: 'TURNED_AWAY', message: `That ${name} account is another person's sign-in in this fleet: sign in as your own` });
+        const { subject } = outsideAccount;
+        const holder = subject === null ? undefined : await deps.grants.ofSubject(fleetId, { party: name, subject });
+        if (holder !== undefined && holder.personShipId !== personShipId) {
+            return turnedAway();
+        }
+        const kept = await deps.grants.keep({
+            fleetId,
+            party: name,
+            personShipId,
+            accountId,
+            outsideAccount,
+            accessToken: tokens.accessToken,
+            refreshToken: tokens.refreshToken,
+            accessTokenEndsAt: accessTokenEndsAtOf(now, tokens.expiresInSeconds),
+            signedInAt: now,
+            refreshedAt: null,
+            lastUsedAt: null,
+            lost: null,
+        });
+        if (kept === 'subjectTaken') {
+            // Another person signed in as the same outside account meanwhile.
+            return turnedAway();
+        }
+        await deps.notices.close(fleetId, { party: name, personShipId });
+        const stated = await deps.stateParty({ fleetId, name });
+        return ok({ ...at, statementRefusal: stated.isOk ? null : stated.error.message });
+    };
+}
+//# sourceMappingURL=complete-party-sign-in.js.map

package/dist/core/party-grants/complete-party-sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"complete-party-sign-in.js","sourceRoot":"","sources":["../../../src/core/party-grants/complete-party-sign-in.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAE3D,OAAO,EAAE,mBAAmB,EAAuB,MAAM,kBAAkB,CAAC;AAyB5E,SAAS,OAAO,CAAC,EAAqB,EAAE,OAAqH;IAC3J,OAAO,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;AACpD,CAAC;AAED,yIAAyI;AACzI,SAAS,gBAAgB,CAAC,OAA6B,EAAE,MAAoB;IAC3E,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACvC,CAAC;IACD,0IAA0I;IAC1I,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAUzC;IACC,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1E,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;YACxD,OAAO,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,iGAAiG,EAAE,CAAC,CAAC;QAC/J,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,QAAQ,CAAC;QAC7E,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAC9F,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACvF,OAAO,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,yFAAyF,EAAE,CAAC,CAAC;QACrJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACtD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACnD,OAAO,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,kCAAkC,IAAI,yBAAyB,EAAE,CAAC,CAAC;QAC1H,CAAC;QACD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9C,OAAO,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,4BAA4B,IAAI,8CAA8C,EAAE,WAAW,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC;QACrK,CAAC;QACD,IAAI,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YAC1E,OAAO,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,+CAA+C,IAAI,KAAK,MAAM,CAAC,MAAM,uBAAuB,EAAE,CAAC,CAAC;QACxJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1G,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;gBACtC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,yBAAyB,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACvJ,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,kCAAkC,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,oBAAoB,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACtI,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC;QAC9B,MAAM,cAAc,GAAG,gBAAgB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAChE,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,yFAAyF,EAAE,CAAC,CAAC;QACrK,CAAC;QACD,MAAM,UAAU,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,QAAQ,IAAI,yEAAyE,EAAE,CAAC,CAAC;QAC9J,MAAM,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC;QACnC,MAAM,MAAM,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC7G,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;YACjE,OAAO,UAAU,EAAE,CAAC;QACtB,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YAClC,OAAO;YACP,KAAK,EAAE,IAAI;YACX,YAAY;YACZ,SAAS;YACT,cAAc;YACd,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,iBAAiB,EAAE,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,gBAAgB,CAAC;YACpE,UAAU,EAAE,GAAG;YACf,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,IAAI;YAChB,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QACH,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YAC5B,kEAAkE;YAClE,OAAO,UAAU,EAAE,CAAC;QACtB,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACpF,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/party-grants/end-account-grants.d.ts

@@ -0,0 +1,18 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { PartyGrants, PartySignIns, SignInServers } from './ports.js';
+export type EndAccountGrants = (account: {
+    fleetId: FleetId;
+    accountId: string;
+}) => Promise<void>;
+/**
+ * Use case: pagasae disabled the account and tells the gateway (decision
+ * 0067, Q14), so a leaver's outside accounts stop acting for the fleet when
+ * their access does: every grant of the account in the fleet ends, as every
+ * grant ends. Its ships then answer as Q5 until a new owner signs in. Told
+ * again, it ends nothing more.
+ */
+export declare function createEndAccountGrants(deps: {
+    servers: SignInServers;
+    grants: Pick<PartyGrants, 'ofAccount' | 'remove'>;
+    signIns: Pick<PartySignIns, 'revoke'>;
+}): EndAccountGrants;

package/dist/core/party-grants/end-account-grants.js

@@ -0,0 +1,16 @@
+import { endPartyGrant } from './end-grant.js';
+/**
+ * Use case: pagasae disabled the account and tells the gateway (decision
+ * 0067, Q14), so a leaver's outside accounts stop acting for the fleet when
+ * their access does: every grant of the account in the fleet ends, as every
+ * grant ends. Its ships then answer as Q5 until a new owner signs in. Told
+ * again, it ends nothing more.
+ */
+export function createEndAccountGrants(deps) {
+    return async ({ fleetId, accountId }) => {
+        for (const grant of await deps.grants.ofAccount(fleetId, accountId)) {
+            await endPartyGrant(deps, grant);
+        }
+    };
+}
+//# sourceMappingURL=end-account-grants.js.map

package/dist/core/party-grants/end-account-grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"end-account-grants.js","sourceRoot":"","sources":["../../../src/core/party-grants/end-account-grants.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAK/C;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAA0H;IAC/J,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE;QACtC,KAAK,MAAM,KAAK,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;YACpE,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/party-grants/end-grant.d.ts

@@ -0,0 +1,23 @@
+import type { SignInClient } from '../vault/credential.js';
+import type { PartyGrant } from './party-grant.js';
+import type { PartyGrants, PartySignIns, SignInServers } from './ports.js';
+/**
+ * Ends a person's grant of a party (decision 0067, Q6): where the
+ * authorization server offers revocation (RFC 7009), the refresh token is
+ * revoked, then the access token; the grant is dropped either way, so the
+ * person's ships call under it no more. Answers whether the server revoked
+ * its tokens: false where it offers no revocation or did not answer.
+ */
+export declare function endGrant(deps: {
+    grants: Pick<PartyGrants, 'remove'>;
+    signIns: Pick<PartySignIns, 'revoke'>;
+}, ending: {
+    client: SignInClient;
+    grant: PartyGrant;
+}): Promise<boolean>;
+/** Ends a grant with its party's client; a grant of a party the gateway no longer holds has no client left to revoke with, and is only dropped. */
+export declare function endPartyGrant(deps: {
+    servers: SignInServers;
+    grants: Pick<PartyGrants, 'remove'>;
+    signIns: Pick<PartySignIns, 'revoke'>;
+}, grant: PartyGrant): Promise<void>;

package/dist/core/party-grants/end-grant.js

@@ -0,0 +1,33 @@
+/**
+ * Ends a person's grant of a party (decision 0067, Q6): where the
+ * authorization server offers revocation (RFC 7009), the refresh token is
+ * revoked, then the access token; the grant is dropped either way, so the
+ * person's ships call under it no more. Answers whether the server revoked
+ * its tokens: false where it offers no revocation or did not answer.
+ */
+export async function endGrant(deps, ending) {
+    const { client, grant } = ending;
+    let isRevoked = false;
+    const { revocationEndpoint } = client;
+    if (revocationEndpoint !== null) {
+        const tokens = grant.refreshToken === null ? [grant.accessToken] : [grant.refreshToken, grant.accessToken];
+        const revoked = [];
+        for (const token of tokens) {
+            revoked.push(await deps.signIns.revoke({ ...client, revocationEndpoint }, token));
+        }
+        isRevoked = revoked.every((each) => each.isOk);
+    }
+    await deps.grants.remove(grant.fleetId, { party: grant.party, personShipId: grant.personShipId });
+    return isRevoked;
+}
+/** Ends a grant with its party's client; a grant of a party the gateway no longer holds has no client left to revoke with, and is only dropped. */
+export async function endPartyGrant(deps, grant) {
+    const server = await deps.servers.find(grant.fleetId, grant.party);
+    if (server?.client === null || server?.client === undefined) {
+        await deps.grants.remove(grant.fleetId, grant);
+    }
+    else {
+        await endGrant(deps, { client: server.client, grant });
+    }
+}
+//# sourceMappingURL=end-grant.js.map

package/dist/core/party-grants/end-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"end-grant.js","sourceRoot":"","sources":["../../../src/core/party-grants/end-grant.ts"],"names":[],"mappings":"AAIA;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAoF,EAAE,MAAmD;IACtK,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IACjC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC;IACtC,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAC3G,MAAM,OAAO,GAAG,EAAE,CAAC;QACnB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,EAAE,kBAAkB,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;QACpF,CAAC;QACD,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;IAClG,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,mJAAmJ;AACnJ,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAA4G,EAAE,KAAiB;IACjK,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACnE,IAAI,MAAM,EAAE,MAAM,KAAK,IAAI,IAAI,MAAM,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;QAC5D,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC"}

package/dist/core/party-grants/end-party-grants.d.ts

@@ -0,0 +1,19 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { SignInClient } from '../vault/credential.js';
+import type { PartyGrants, PartySignIns } from './ports.js';
+export type EndPartyGrants = (party: {
+    fleetId: FleetId;
+    name: string;
+    client: SignInClient;
+}) => Promise<void>;
+/**
+ * Use case: a party where each person signs in is retired (decision 0067,
+ * scenario 31). Every person's grant of it ends, as every grant ends, and
+ * the party's client is deleted where the authorization server answered its
+ * client configuration endpoint at registration (RFC 7592), so no grant
+ * outlives the party there.
+ */
+export declare function createEndPartyGrants(deps: {
+    grants: Pick<PartyGrants, 'ofParty' | 'remove'>;
+    signIns: Pick<PartySignIns, 'revoke' | 'deleteClient'>;
+}): EndPartyGrants;

package/dist/core/party-grants/end-party-grants.js

@@ -0,0 +1,31 @@
+import { endGrant } from './end-grant.js';
+/** How many grants are read at a time while a party's grants end. */
+const GRANTS_PER_READ = 100;
+/**
+ * Use case: a party where each person signs in is retired (decision 0067,
+ * scenario 31). Every person's grant of it ends, as every grant ends, and
+ * the party's client is deleted where the authorization server answered its
+ * client configuration endpoint at registration (RFC 7592), so no grant
+ * outlives the party there.
+ */
+export function createEndPartyGrants(deps) {
+    return async ({ fleetId, name, client }) => {
+        let after = null;
+        for (;;) {
+            const held = await deps.grants.ofParty(fleetId, { party: name, after, limit: GRANTS_PER_READ });
+            for (const grant of held) {
+                await endGrant(deps, { client, grant });
+            }
+            const last = held.at(-1);
+            if (last === undefined) {
+                break;
+            }
+            after = last.personShipId;
+        }
+        const { registrationClientUri, registrationAccessToken } = client;
+        if (registrationClientUri !== null && registrationAccessToken !== null) {
+            await deps.signIns.deleteClient({ ...client, registrationClientUri, registrationAccessToken });
+        }
+    };
+}
+//# sourceMappingURL=end-party-grants.js.map

package/dist/core/party-grants/end-party-grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"end-party-grants.js","sourceRoot":"","sources":["../../../src/core/party-grants/end-party-grants.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAG1C,qEAAqE;AACrE,MAAM,eAAe,GAAG,GAAG,CAAC;AAI5B;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAiH;IACpJ,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;QACzC,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YAChG,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;gBACzB,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM;YACR,CAAC;YACD,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC;QAC5B,CAAC;QACD,MAAM,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,GAAG,MAAM,CAAC;QAClE,IAAI,qBAAqB,KAAK,IAAI,IAAI,uBAAuB,KAAK,IAAI,EAAE,CAAC;YACvE,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,GAAG,MAAM,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/party-grants/end-retired-persons-grants.d.ts

@@ -0,0 +1,19 @@
+import type { ConnectionStore, FleetDoor } from '../connection/ports.js';
+import type { PartyGrants, PartySignIns, SignInServers } from './ports.js';
+export type EndRetiredPersonsGrants = () => Promise<void>;
+/**
+ * Use case: one round of the gateway following the persons who hold a grant
+ * (decision 0067, Q6), in every fleet it is connected to. Each person ship
+ * is read as the gateway's ship on its behalf, as a call's owner is read;
+ * every grant of a retired one ends, as every grant ends. The fleet answers
+ * no such ship on behalf of a retired one, and a person ship is never
+ * deleted, so that answer is a retired person ship too. What the fleet
+ * does not answer now is read again at the next round.
+ */
+export declare function createEndRetiredPersonsGrants(deps: {
+    connections: Pick<ConnectionStore, 'find'>;
+    door: Pick<FleetDoor, 'getShip'>;
+    servers: SignInServers;
+    grants: Pick<PartyGrants, 'persons' | 'ofPersonShip' | 'remove'>;
+    signIns: Pick<PartySignIns, 'revoke'>;
+}): EndRetiredPersonsGrants;

package/dist/core/party-grants/end-retired-persons-grants.js

@@ -0,0 +1,30 @@
+import { endPartyGrant } from './end-grant.js';
+/** The fleet's code for a ship it does not find: what a read on behalf of a retired ship answers, as core reads on behalf of live ships only. */
+const NO_SUCH_SHIP = 'NOT_FOUND';
+/**
+ * Use case: one round of the gateway following the persons who hold a grant
+ * (decision 0067, Q6), in every fleet it is connected to. Each person ship
+ * is read as the gateway's ship on its behalf, as a call's owner is read;
+ * every grant of a retired one ends, as every grant ends. The fleet answers
+ * no such ship on behalf of a retired one, and a person ship is never
+ * deleted, so that answer is a retired person ship too. What the fleet
+ * does not answer now is read again at the next round.
+ */
+export function createEndRetiredPersonsGrants(deps) {
+    return async () => {
+        for (const { fleetId, personShipId } of await deps.grants.persons()) {
+            const gateway = await deps.connections.find(fleetId);
+            if (gateway === undefined) {
+                continue;
+            }
+            const ship = await deps.door.getShip(gateway.crewToken, { shipId: personShipId, onBehalfOf: personShipId });
+            const isRetired = ship.isOk ? ship.value.status === 'retired' : ship.error.code === NO_SUCH_SHIP;
+            if (isRetired) {
+                for (const grant of await deps.grants.ofPersonShip(fleetId, personShipId)) {
+                    await endPartyGrant(deps, grant);
+                }
+            }
+        }
+    };
+}
+//# sourceMappingURL=end-retired-persons-grants.js.map

package/dist/core/party-grants/end-retired-persons-grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"end-retired-persons-grants.js","sourceRoot":"","sources":["../../../src/core/party-grants/end-retired-persons-grants.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAG/C,iJAAiJ;AACjJ,MAAM,YAAY,GAAG,WAAW,CAAC;AAIjC;;;;;;;;GAQG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAM7C;IACC,OAAO,KAAK,IAAI,EAAE;QAChB,KAAK,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;YACpE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC;YAC5G,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC;YACjG,IAAI,SAAS,EAAE,CAAC;gBACd,KAAK,MAAM,KAAK,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;oBAC1E,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBACnC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/party-grants/keep-grants-alive.d.ts

@@ -0,0 +1,18 @@
+import type { Clock } from '../shared/clock.js';
+import type { PartyGrants, SignInServers } from './ports.js';
+import type { RefreshGrant } from './refresh-grant.js';
+export type KeepGrantsAlive = () => Promise<void>;
+/**
+ * Use case: one round of the gateway keeping grants alive without a call
+ * (decision 0067, Q7): every grant idle for longer than the idle time, or
+ * whose access token is near its end, is refreshed with its party's client,
+ * so a person who calls rarely stays signed in, and a grant lost is found,
+ * and its person told, before a call needs it. A refresh not answered keeps
+ * the grant as it was, to be tried again at the next round.
+ */
+export declare function createKeepGrantsAlive(deps: {
+    grants: Pick<PartyGrants, 'due'>;
+    servers: SignInServers;
+    refreshGrant: RefreshGrant;
+    clock: Clock;
+}): KeepGrantsAlive;

package/dist/core/party-grants/keep-grants-alive.js

@@ -0,0 +1,19 @@
+/**
+ * Use case: one round of the gateway keeping grants alive without a call
+ * (decision 0067, Q7): every grant idle for longer than the idle time, or
+ * whose access token is near its end, is refreshed with its party's client,
+ * so a person who calls rarely stays signed in, and a grant lost is found,
+ * and its person told, before a call needs it. A refresh not answered keeps
+ * the grant as it was, to be tried again at the next round.
+ */
+export function createKeepGrantsAlive(deps) {
+    return async () => {
+        for (const grant of await deps.grants.due({ now: deps.clock.now() })) {
+            const server = await deps.servers.find(grant.fleetId, grant.party);
+            if (server?.client !== null && server?.client !== undefined) {
+                await deps.refreshGrant({ client: server.client, grant });
+            }
+        }
+    };
+}
+//# sourceMappingURL=keep-grants-alive.js.map

package/dist/core/party-grants/keep-grants-alive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keep-grants-alive.js","sourceRoot":"","sources":["../../../src/core/party-grants/keep-grants-alive.ts"],"names":[],"mappings":"AAMA;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAA4G;IAChJ,OAAO,KAAK,IAAI,EAAE;QAChB,KAAK,MAAM,KAAK,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;YACrE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACnE,IAAI,MAAM,EAAE,MAAM,KAAK,IAAI,IAAI,MAAM,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC5D,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/party-grants/list-grants.d.ts

@@ -0,0 +1,30 @@
+import type { ShipId } from '@aeolus-fleet/common';
+import type { ApprovingDeps, CheckApproving } from '../parties/check-approving.js';
+import { type Result } from '../shared/result.js';
+import { type ApprovedSignInPartyRefusal } from './approved-sign-in-party.js';
+import type { PartyGrants, ShipNames } from './ports.js';
+import { type OwnGrant } from './read-own-grant.js';
+/** A person's grant as an approver sees it: whose, by their person ship and its name where the fleet answers one, whether it is the approver's own, and what the person sees of it themselves. */
+export type PersonGrant = {
+    readonly personShipId: ShipId;
+    readonly personName: string | null;
+    readonly isYours: boolean;
+} & Exclude<OwnGrant, {
+    state: 'notSignedIn';
+}>;
+export type ListGrants = (input: Parameters<CheckApproving>[0] & {
+    after: ShipId | null;
+}) => Promise<Result<{
+    grants: PersonGrant[]; /** Where the next page starts; none on the last page. */
+    next: ShipId | null;
+}, ApprovedSignInPartyRefusal>>;
+/**
+ * Use case: an actor holding gateway:approve within manage reach of an
+ * outside MCP server's proxy ship lists every person's sign-in to it
+ * (decision 0067, Q12), a page at a time by person ship, never a token, so
+ * it sees whose grant to remove, each named by its person ship's name.
+ */
+export declare function createListGrants(deps: ApprovingDeps & {
+    grants: Pick<PartyGrants, 'ofParty'>;
+    ships: ShipNames;
+}): ListGrants;

package/dist/core/party-grants/list-grants.js

@@ -0,0 +1,34 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+import { approvedSignInParty } from './approved-sign-in-party.js';
+import { shownGrantOf } from './read-own-grant.js';
+/** The persons a page of everyone's sign-ins shows. */
+const GRANTS_PER_PAGE = 20;
+/**
+ * Use case: an actor holding gateway:approve within manage reach of an
+ * outside MCP server's proxy ship lists every person's sign-in to it
+ * (decision 0067, Q12), a page at a time by person ship, never a token, so
+ * it sees whose grant to remove, each named by its person ship's name.
+ */
+export function createListGrants(deps) {
+    return async ({ after, ...asked }) => {
+        const approved = await approvedSignInParty(deps, asked);
+        if (!approved.isOk) {
+            return approved;
+        }
+        // One more than a page tells whether a next page follows.
+        const held = await deps.grants.ofParty(asked.actor.fleetId, { party: approved.value.name, after, limit: GRANTS_PER_PAGE + 1 });
+        const page = held.slice(0, GRANTS_PER_PAGE);
+        // The page's person ships named in one read, so a page costs one fleet call however many it shows.
+        const names = page.length === 0 ? ok(new Map()) : await deps.ships.namesOf(approved.value.credential, page.map(({ personShipId }) => personShipId));
+        if (!names.isOk) {
+            return refuse('FLEET_UNAVAILABLE', 'The fleet did not answer: try again in a moment.');
+        }
+        const yours = asked.actor.kind === 'account' ? asked.actor.personShipId : null;
+        return ok({
+            grants: page.map((grant) => ({ personShipId: grant.personShipId, personName: names.value.get(grant.personShipId) ?? null, isYours: grant.personShipId === yours, ...shownGrantOf(grant) })),
+            next: held.length > GRANTS_PER_PAGE ? (page.at(-1)?.personShipId ?? null) : null,
+        });
+    };
+}
+//# sourceMappingURL=list-grants.js.map

package/dist/core/party-grants/list-grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-grants.js","sourceRoot":"","sources":["../../../src/core/party-grants/list-grants.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAmC,MAAM,6BAA6B,CAAC;AAEnG,OAAO,EAAE,YAAY,EAAiB,MAAM,qBAAqB,CAAC;AAElE,uDAAuD;AACvD,MAAM,eAAe,GAAG,EAAE,CAAC;AAS3B;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAgF;IAC/G,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE;QACnC,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACxD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,0DAA0D;QAC1D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/H,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;QAC5C,mGAAmG;QACnG,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,GAAG,EAAkB,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QACpK,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO,MAAM,CAAC,mBAAmB,EAAE,kDAAkD,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/E,OAAO,EAAE,CAAC;YACR,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,YAAY,KAAK,KAAK,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC3L,IAAI,EAAE,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;SACjF,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}