@aeolus-fleet/gateway 0.33.0 → 0.35.0

package/dist/adapters/trpc/router.d.ts

@@ -16,6 +16,13 @@ import type { ListReachedShips } from '../../core/a2a-in/list-reached-ships.js';
 import type { AddA2aClient } from '../../core/parties/add-a2a-client.js';
 import type { AddA2aAgent } from '../../core/parties/add-a2a-agent.js';
 import type { MarkA2aAgent } from '../../core/a2a-out/mark-a2a-agent.js';
+import type { AddSignInServer } from '../../core/parties/add-sign-in-server.js';
+import type { EndAccountGrants } from '../../core/party-grants/end-account-grants.js';
+import type { ListGrants } from '../../core/party-grants/list-grants.js';
+import type { ReadOwnGrant } from '../../core/party-grants/read-own-grant.js';
+import type { RemoveGrant } from '../../core/party-grants/remove-grant.js';
+import type { RemoveOwnGrant } from '../../core/party-grants/remove-own-grant.js';
+import type { StartPartySignIn } from '../../core/party-grants/start-party-sign-in.js';
 import type { ApproveParty } from '../../core/parties/approve-party.js';
 import type { CrewParty } from '../../core/parties/crew-party.js';
 import type { ListOwnerChoices } from '../../core/parties/list-owner-choices.js';
@@ -93,10 +100,20 @@ export interface Context {
     readFleet: ReadFleet;
     deleteFleet: DeleteFleet;
     endSignIns: EndSignIns;
+    endAccountGrants: EndAccountGrants;
     stopSlackLink: StopSlackLink;
     readConnection: ReadConnection;
     connect: Connect;
     approveParty: ApproveParty;
+    addSignInServer: AddSignInServer;
+    /** A person's own sign-in to an outside MCP server where each person signs in (decision 0067). */
+    partySignIn: {
+        start: StartPartySignIn;
+        readOwn: ReadOwnGrant;
+        removeOwn: RemoveOwnGrant;
+        list: ListGrants;
+        remove: RemoveGrant;
+    };
     addClientParty: AddClientParty;
     crewParty: CrewParty;
     listParties: ListParties;
@@ -288,7 +305,7 @@ export declare const gatewayRouter: import("@trpc/server").TRPCBuiltRouter<{
             output: ({
                 kind: "mcpServer";
                 url: string;
-                credentialKind: "none" | "bearer" | "clientCredentials";
+                credentialKind: "none" | "bearer" | "clientCredentials" | "personSignIn";
                 concurrencyLimit: number;
                 proxyShipName: string | null;
                 ownerShipId: string | null;
@@ -349,7 +366,7 @@ export declare const gatewayRouter: import("@trpc/server").TRPCBuiltRouter<{
             output: {
                 kind: "mcpServer";
                 url: string;
-                credentialKind: "none" | "bearer" | "clientCredentials";
+                credentialKind: "none" | "bearer" | "clientCredentials" | "personSignIn";
                 concurrencyLimit: number;
                 proxyShipName: string | null;
                 ownerShipId: string | null;
@@ -444,7 +461,8 @@ export declare const gatewayRouter: import("@trpc/server").TRPCBuiltRouter<{
         /**
          * argo approves an outside MCP server as a party: the gateway commissions
          * its app proxy ship owned by the owner argo picked, crews it, and keeps
-         * the credential in its vault (interop I-5). A repeat with the same
+         * the credential in its vault (interop I-5); for a server where each
+         * person signs in, the client it registered for the party (0067). A repeat with the same
          * request id picks up where the last one stopped.
          */
         approve: import("@trpc/server").TRPCMutationProcedure<{
@@ -463,6 +481,8 @@ export declare const gatewayRouter: import("@trpc/server").TRPCBuiltRouter<{
                     clientSecret: string;
                     issuer: string;
                     scope?: string | undefined;
+                } | {
+                    kind: "personSignIn";
                 };
                 ownerShipId: unknown;
                 concurrencyLimit?: number | undefined;
@@ -474,7 +494,7 @@ export declare const gatewayRouter: import("@trpc/server").TRPCBuiltRouter<{
             output: {
                 kind: "mcpServer";
                 url: string;
-                credentialKind: "none" | "bearer" | "clientCredentials";
+                credentialKind: "none" | "bearer" | "clientCredentials" | "personSignIn";
                 concurrencyLimit: number;
                 name: string;
                 state: "awaitingCrew" | "crewed" | "commissioning";
@@ -521,7 +541,7 @@ export declare const gatewayRouter: import("@trpc/server").TRPCBuiltRouter<{
                 party: {
                     kind: "mcpServer";
                     url: string;
-                    credentialKind: "none" | "bearer" | "clientCredentials";
+                    credentialKind: "none" | "bearer" | "clientCredentials" | "personSignIn";
                     concurrencyLimit: number;
                     name: string;
                     state: "awaitingCrew" | "crewed" | "commissioning";
@@ -570,7 +590,7 @@ export declare const gatewayRouter: import("@trpc/server").TRPCBuiltRouter<{
                 party: {
                     kind: "mcpServer";
                     url: string;
-                    credentialKind: "none" | "bearer" | "clientCredentials";
+                    credentialKind: "none" | "bearer" | "clientCredentials" | "personSignIn";
                     concurrencyLimit: number;
                     name: string;
                     state: "awaitingCrew" | "crewed" | "commissioning";
@@ -631,7 +651,7 @@ export declare const gatewayRouter: import("@trpc/server").TRPCBuiltRouter<{
             output: {
                 kind: "mcpServer";
                 url: string;
-                credentialKind: "none" | "bearer" | "clientCredentials";
+                credentialKind: "none" | "bearer" | "clientCredentials" | "personSignIn";
                 concurrencyLimit: number;
                 name: string;
                 state: "awaitingCrew" | "crewed" | "commissioning";
@@ -728,7 +748,7 @@ export declare const gatewayRouter: import("@trpc/server").TRPCBuiltRouter<{
             output: ({
                 kind: "mcpServer";
                 url: string;
-                credentialKind: "none" | "bearer" | "clientCredentials";
+                credentialKind: "none" | "bearer" | "clientCredentials" | "personSignIn";
                 concurrencyLimit: number;
                 name: string;
                 state: "awaitingCrew" | "crewed" | "commissioning";
@@ -758,6 +778,114 @@ export declare const gatewayRouter: import("@trpc/server").TRPCBuiltRouter<{
             };
             meta: object;
         }>;
+        /**
+         * A person presses Sign in on an outside MCP server's page, for
+         * themselves (decision 0067): the address of the party's authorization
+         * server to send their browser to. Every account of the fleet with a
+         * person ship may.
+         */
+        startSignIn: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                name: string;
+            };
+            output: {
+                url: string;
+            };
+            meta: object;
+        }>;
+        /** A person's own sign-in to an outside MCP server where each person signs in: the outside account it names, when, last used, and whether it was lost (Q12). */
+        ownSignIn: import("@trpc/server").TRPCQueryProcedure<{
+            input: {
+                name: string;
+            };
+            output: {
+                state: "notSignedIn";
+            } | {
+                outsideAccount: {
+                    subject: string | null;
+                    name: string | null;
+                };
+                signedInAt: string;
+                lastUsedAt: string | null;
+                state: "signedIn";
+            } | {
+                lost: {
+                    at: string;
+                    why: string;
+                };
+                outsideAccount: {
+                    subject: string | null;
+                    name: string | null;
+                };
+                signedInAt: string;
+                lastUsedAt: string | null;
+                state: "lost";
+            };
+            meta: object;
+        }>;
+        /** A person removes their own sign-in to an outside MCP server: revoked where the server offers it, then dropped (Q6). */
+        removeOwnSignIn: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                name: string;
+            };
+            output: {
+                isRevoked: boolean;
+            };
+            meta: object;
+        }>;
+        /**
+         * Every person's sign-in to an outside MCP server where each person
+         * signs in, 20 a page by person ship, for an actor holding
+         * gateway:approve within manage reach of its proxy ship (Q12).
+         */
+        signIns: import("@trpc/server").TRPCQueryProcedure<{
+            input: {
+                name: string;
+                after: unknown;
+            };
+            output: {
+                grants: ({
+                    outsideAccount: {
+                        subject: string | null;
+                        name: string | null;
+                    };
+                    signedInAt: string;
+                    lastUsedAt: string | null;
+                    state: "signedIn";
+                    personShipId: string;
+                    personName: string | null;
+                    isYours: boolean;
+                } | {
+                    lost: {
+                        at: string;
+                        why: string;
+                    };
+                    outsideAccount: {
+                        subject: string | null;
+                        name: string | null;
+                    };
+                    signedInAt: string;
+                    lastUsedAt: string | null;
+                    state: "lost";
+                    personShipId: string;
+                    personName: string | null;
+                    isYours: boolean;
+                })[];
+                next: string | null;
+            };
+            meta: object;
+        }>;
+        /** An actor holding gateway:approve within manage reach of the proxy ship removes any person's sign-in: revoked where the server offers it, then dropped (Q6). */
+        removeSignIn: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                name: string;
+                personShipId: unknown;
+            };
+            output: {
+                isRevoked: boolean;
+            };
+            meta: object;
+        }>;
         /** The gateway states the party's proxy ship anew, from what its server lists now, with argo's marks. */
         state: import("@trpc/server").TRPCMutationProcedure<{
             input: {
@@ -1145,7 +1273,7 @@ export declare const gatewayRouter: import("@trpc/server").TRPCBuiltRouter<{
                 party: {
                     kind: "mcpServer";
                     url: string;
-                    credentialKind: "none" | "bearer" | "clientCredentials";
+                    credentialKind: "none" | "bearer" | "clientCredentials" | "personSignIn";
                     concurrencyLimit: number;
                     name: string;
                     state: "awaitingCrew" | "crewed" | "commissioning";
@@ -1413,7 +1541,7 @@ export declare const gatewayRouter: import("@trpc/server").TRPCBuiltRouter<{
             output: Record<string, never>;
             meta: object;
         }>;
-        /** pagasae disabled the account (decision 0055): every sign-in of it in the fleet ends, its clients' tokens are revoked, and its Slack link stops. Told again, it ends nothing more. */
+        /** pagasae disabled the account (decision 0055): every sign-in of it in the fleet ends, its clients' tokens are revoked, its Slack link stops, and its grants of outside servers end (decision 0067, Q14). Told again, it ends nothing more. */
         accountDisabled: import("@trpc/server").TRPCMutationProcedure<{
             input: {
                 fleetId: unknown;

package/dist/adapters/trpc/router.js

@@ -10,7 +10,7 @@
  * installation procedures take the installation token instead (decision 0021).
  */
 import { randomUUID, timingSafeEqual } from 'node:crypto';
-import { idempotencyKeySchema, idSchema, scopeNameSchema, shipHandleSchema } from '@aeolus-fleet/common';
+import { idempotencyKeySchema, idSchema, payloadSchema, scopeNameSchema, shipHandleSchema } from '@aeolus-fleet/common';
 import { initTRPC, TRPCError } from '@trpc/server';
 import { z } from 'zod';
 import { APPROVING_SCOPE } from '../../core/parties/approver.js';
@@ -165,6 +165,7 @@ const CREW_CODES = {
 /** The refusals of reading an outside MCP server's tools, as the API states them. */
 const TOOLS_CODES = {
     NO_SUCH_PARTY: 'NOT_FOUND',
+    NOT_SIGNED_IN: 'PRECONDITION_FAILED',
     SERVER_UNREACHABLE: 'BAD_GATEWAY',
 };
 /** The refusals of reading the scopes the fleet lists, as the API states them. */
@@ -181,6 +182,7 @@ const SWITCH_TOOLS_CODES = {
     NOT_REACHABLE: 'FORBIDDEN',
     NOT_CONNECTED: 'PRECONDITION_FAILED',
     FLEET_UNAVAILABLE: 'BAD_GATEWAY',
+    NOT_SIGNED_IN: 'PRECONDITION_FAILED',
     SERVER_UNREACHABLE: 'BAD_GATEWAY',
     NO_SUCH_TOOL: 'NOT_FOUND',
 };
@@ -202,6 +204,15 @@ function scopeRequirementsOutputOf(requirements) {
     return { version: requirements.version, party: [...requirements.party], tools: [...requirements.tools].map(([tool, scopes]) => ({ tool, scopes: [...scopes] })) };
 }
 /** The refusals of checking an outside MCP server, as the API states them. */
+/** The refusals of adding a server where each person signs in, as the API states them: a fleet that does not answer is tried again with the same request id. */
+const ADD_SIGN_IN_SERVER_CODES = {
+    ...APPROVE_CODES,
+    SERVER_UNREACHABLE: 'BAD_GATEWAY',
+    NO_AUTHORIZATION_SERVER: 'BAD_REQUEST',
+    SIGN_IN_CHECK_FAILED: 'BAD_REQUEST',
+    NO_DYNAMIC_REGISTRATION: 'BAD_REQUEST',
+    REGISTRATION_REFUSED: 'BAD_GATEWAY',
+};
 const CHECK_CODES = {
     OUTSIDE_PARTIES_OFF: 'PRECONDITION_FAILED',
     SERVER_UNREACHABLE: 'BAD_GATEWAY',
@@ -210,9 +221,45 @@ const CHECK_CODES = {
 const STATE_CODES = {
     NO_SUCH_PARTY: 'NOT_FOUND',
     NOT_CREWED: 'CONFLICT',
+    NOT_SIGNED_IN: 'PRECONDITION_FAILED',
     SERVER_UNREACHABLE: 'BAD_GATEWAY',
     STATEMENT_REFUSED: 'BAD_REQUEST',
 };
+/** The refusals of a person's own sign-in to an outside MCP server, as the API states them. */
+const PARTY_SIGN_IN_CODES = {
+    NOT_A_PERSON: 'FORBIDDEN',
+    NO_SUCH_PARTY: 'NOT_FOUND',
+    NO_SIGN_IN: 'BAD_REQUEST',
+    NOT_SIGNED_IN: 'NOT_FOUND',
+};
+/** The refusals of an approver's view and removal of everyone's sign-ins to a party, as the API states them. */
+const SIGN_INS_CODES = {
+    NOT_AN_APPROVER: 'FORBIDDEN',
+    NO_SUCH_PARTY: 'NOT_FOUND',
+    PARTY_NOT_COMMISSIONED: 'PRECONDITION_FAILED',
+    NOT_REACHABLE: 'FORBIDDEN',
+    NOT_CONNECTED: 'PRECONDITION_FAILED',
+    FLEET_UNAVAILABLE: 'BAD_GATEWAY',
+    NO_SIGN_IN: 'BAD_REQUEST',
+    NOT_SIGNED_IN: 'NOT_FOUND',
+};
+const heldGrantShape = { outsideAccount: z.object({ subject: z.string().nullable(), name: z.string().nullable() }), signedInAt: z.string(), lastUsedAt: z.string().nullable() };
+/** A person's own sign-in to a party, as their page shows it: never a token. A lost one says when and why. */
+const ownSignInOutputSchema = z.discriminatedUnion('state', [
+    z.object({ state: z.literal('notSignedIn') }),
+    z.object({ state: z.literal('signedIn'), ...heldGrantShape }),
+    z.object({ state: z.literal('lost'), ...heldGrantShape, lost: z.object({ at: z.string(), why: z.string() }) }),
+]);
+/** Whose sign-in an approver sees: the person ship, its name where the fleet answers one, and whether it is the approver's own. */
+const personShape = { personShipId: z.string(), personName: z.string().nullable(), isYours: z.boolean() };
+/** Everyone's sign-ins to a party, a page at a time, as an approver sees them: never a token. */
+const signInsOutputSchema = z.object({
+    grants: z.array(z.discriminatedUnion('state', [
+        z.object({ ...personShape, state: z.literal('signedIn'), ...heldGrantShape }),
+        z.object({ ...personShape, state: z.literal('lost'), ...heldGrantShape, lost: z.object({ at: z.string(), why: z.string() }) }),
+    ])),
+    next: z.string().nullable(),
+});
 /** The longest name argo gives an MCP client. */
 const CLIENT_NAME_MAX_LENGTH = 200;
 /** The longest tool name MCP allows (2026-07-28), as a capability's name is capped too. */
@@ -236,12 +283,18 @@ const credentialInputSchema = z.discriminatedUnion('kind', [
         scope: z.string().min(1).optional(),
     }),
 ]);
+/**
+ * An outside MCP server's credential as the approver gives it: one of the
+ * vault's, or each person signing in, for which the gateway registers the
+ * party's client itself (decision 0067).
+ */
+const serverCredentialInputSchema = z.discriminatedUnion('kind', [...credentialInputSchema.options, z.strictObject({ kind: z.literal('personSignIn') })]);
 /** A party as any actor reads it: never its credential or its crew token. */
 const shownPartyBase = { name: z.string(), state: z.enum(['commissioning', 'awaitingCrew', 'crewed']), proxyShipId: z.string().nullable() };
 /** An outside A2A agent's own fields: its card address, its credential's kind, its calls at once and its repeatable mark (A9). */
 const agentFields = { cardUrl: z.string(), credentialKind: z.enum(['none', 'bearer', 'clientCredentials']), concurrencyLimit: z.int(), isRepeatable: z.boolean() };
 const shownPartySchema = z.discriminatedUnion('kind', [
-    z.object({ ...shownPartyBase, kind: z.literal('mcpServer'), url: z.string(), credentialKind: z.enum(['none', 'bearer', 'clientCredentials']), concurrencyLimit: z.int() }),
+    z.object({ ...shownPartyBase, kind: z.literal('mcpServer'), url: z.string(), credentialKind: z.enum(['none', 'bearer', 'clientCredentials', 'personSignIn']), concurrencyLimit: z.int() }),
     z.object({ ...shownPartyBase, kind: z.literal('mcpClient'), clientId: z.string() }),
     z.object({ ...shownPartyBase, kind: z.literal('a2aClient') }),
     z.object({ ...shownPartyBase, kind: z.literal('a2aAgent'), ...agentFields }),
@@ -249,7 +302,7 @@ const shownPartySchema = z.discriminatedUnion('kind', [
 /** A party with its proxy ship's name, owner and scopes, read from the fleet (decision 0056): null while unknown. */
 const fromFleet = { proxyShipName: z.string().nullable(), ownerShipId: z.string().nullable(), ownerName: z.string().nullable(), scopes: z.array(z.string()).nullable() };
 const listedPartySchema = z.discriminatedUnion('kind', [
-    z.object({ ...shownPartyBase, ...fromFleet, kind: z.literal('mcpServer'), url: z.string(), credentialKind: z.enum(['none', 'bearer', 'clientCredentials']), concurrencyLimit: z.int() }),
+    z.object({ ...shownPartyBase, ...fromFleet, kind: z.literal('mcpServer'), url: z.string(), credentialKind: z.enum(['none', 'bearer', 'clientCredentials', 'personSignIn']), concurrencyLimit: z.int() }),
     z.object({ ...shownPartyBase, ...fromFleet, kind: z.literal('mcpClient'), clientId: z.string() }),
     z.object({ ...shownPartyBase, ...fromFleet, kind: z.literal('a2aClient') }),
     z.object({ ...shownPartyBase, ...fromFleet, kind: z.literal('a2aAgent'), ...agentFields }),
@@ -307,8 +360,6 @@ const decisionSchema = z.discriminatedUnion('kind', [
         server: z.strictObject({ credential: credentialInputSchema, concurrencyLimit: z.int().min(CONCURRENCY_LIMIT_MIN).max(CONCURRENCY_LIMIT_MAX) }).optional(),
     }),
 ]);
-/** The largest payload a message carries. */
-const PAYLOAD_MAX_BYTES = 64 * 1024;
 /** The refusals of a person's own deliveries, as the API states them. */
 const PERSON_CODES = {
     NOT_A_PERSON: 'FORBIDDEN',
@@ -561,7 +612,8 @@ export const gatewayRouter = t.router({
         /**
          * argo approves an outside MCP server as a party: the gateway commissions
          * its app proxy ship owned by the owner argo picked, crews it, and keeps
-         * the credential in its vault (interop I-5). A repeat with the same
+         * the credential in its vault (interop I-5); for a server where each
+         * person signs in, the client it registered for the party (0067). A repeat with the same
          * request id picks up where the last one stopped.
          */
         approve: managing(servedProcedure)
@@ -569,7 +621,7 @@ export const gatewayRouter = t.router({
             requestId: idempotencyKeySchema,
             name: shipHandleSchema,
             url: z.url({ protocol: /^https?$/ }),
-            credential: credentialInputSchema,
+            credential: serverCredentialInputSchema,
             ownerShipId: idSchema('ship'),
             concurrencyLimit: z.int().min(CONCURRENCY_LIMIT_MIN).max(CONCURRENCY_LIMIT_MAX).default(CONCURRENCY_LIMIT_DEFAULT),
             /** Each tool the check answered, switched on or off; none sent means every tool the server lists at its first statement is on. */
@@ -583,7 +635,15 @@ export const gatewayRouter = t.router({
                 throw new TRPCError({ code: 'FORBIDDEN', message: `Switching an outside party's tools needs ${APPROVING_SCOPE}` });
             }
             const toolSwitches = tools === undefined ? null : new Map(tools.map(({ name, isOn }) => [name, isOn]));
-            const approved = await ctx.approveParty({ operatorFleetId: ctx.fleetId, ...approval, scopes: [], toolSwitches });
+            const { credential, ...server } = approval;
+            if (credential.kind === 'personSignIn') {
+                const added = await ctx.addSignInServer({ operatorFleetId: ctx.fleetId, ...server, scopes: [], toolSwitches });
+                if (!added.isOk) {
+                    throw new TRPCError({ code: ADD_SIGN_IN_SERVER_CODES[added.error.kind], message: added.error.message });
+                }
+                return added.value;
+            }
+            const approved = await ctx.approveParty({ operatorFleetId: ctx.fleetId, ...server, credential, scopes: [], toolSwitches });
             if (!approved.isOk) {
                 throw new TRPCError({ code: APPROVE_CODES[approved.error.kind], message: approved.error.message });
             }
@@ -724,6 +784,84 @@ export const gatewayRouter = t.router({
             }
             return { ...crewed.value.party, clientSecret: crewed.value.clientSecret };
         }),
+        /**
+         * A person presses Sign in on an outside MCP server's page, for
+         * themselves (decision 0067): the address of the party's authorization
+         * server to send their browser to. Every account of the fleet with a
+         * person ship may.
+         */
+        startSignIn: servedProcedure
+            .input(z.strictObject({ name: shipHandleSchema }))
+            .output(z.object({ url: z.string() }))
+            .mutation(async ({ ctx, input }) => {
+            const started = await ctx.partySignIn.start({ actor: ctx.actor, ...input });
+            if (!started.isOk) {
+                throw new TRPCError({ code: PARTY_SIGN_IN_CODES[started.error.kind], message: started.error.message });
+            }
+            return started.value;
+        }),
+        /** A person's own sign-in to an outside MCP server where each person signs in: the outside account it names, when, last used, and whether it was lost (Q12). */
+        ownSignIn: servedProcedure
+            .input(z.strictObject({ name: shipHandleSchema }))
+            .output(ownSignInOutputSchema)
+            .query(async ({ ctx, input }) => {
+            const read = await ctx.partySignIn.readOwn({ actor: ctx.actor, ...input });
+            if (!read.isOk) {
+                throw new TRPCError({ code: PARTY_SIGN_IN_CODES[read.error.kind], message: read.error.message });
+            }
+            const own = read.value;
+            switch (own.state) {
+                case 'notSignedIn':
+                    return own;
+                case 'signedIn':
+                    return { ...own, signedInAt: own.signedInAt.toISOString(), lastUsedAt: own.lastUsedAt?.toISOString() ?? null };
+                case 'lost':
+                    return { ...own, signedInAt: own.signedInAt.toISOString(), lastUsedAt: own.lastUsedAt?.toISOString() ?? null, lost: { at: own.lost.at.toISOString(), why: own.lost.why } };
+            }
+        }),
+        /** A person removes their own sign-in to an outside MCP server: revoked where the server offers it, then dropped (Q6). */
+        removeOwnSignIn: servedProcedure
+            .input(z.strictObject({ name: shipHandleSchema }))
+            .output(z.object({ isRevoked: z.boolean() }))
+            .mutation(async ({ ctx, input }) => {
+            const removed = await ctx.partySignIn.removeOwn({ actor: ctx.actor, ...input });
+            if (!removed.isOk) {
+                throw new TRPCError({ code: PARTY_SIGN_IN_CODES[removed.error.kind], message: removed.error.message });
+            }
+            return removed.value;
+        }),
+        /**
+         * Every person's sign-in to an outside MCP server where each person
+         * signs in, 20 a page by person ship, for an actor holding
+         * gateway:approve within manage reach of its proxy ship (Q12).
+         */
+        signIns: servedProcedure
+            .input(z.strictObject({ name: shipHandleSchema, after: idSchema('ship').nullable() }))
+            .output(signInsOutputSchema)
+            .query(async ({ ctx, input }) => {
+            const listed = await ctx.partySignIn.list({ actor: ctx.actor, as: { cookie: ctx.cookie, crewToken: ctx.crewToken }, ...input });
+            if (!listed.isOk) {
+                throw new TRPCError({ code: SIGN_INS_CODES[listed.error.kind], message: listed.error.message });
+            }
+            return {
+                grants: listed.value.grants.map((grant) => {
+                    const shown = { ...grant, signedInAt: grant.signedInAt.toISOString(), lastUsedAt: grant.lastUsedAt?.toISOString() ?? null };
+                    return grant.state === 'lost' ? { ...shown, state: grant.state, lost: { at: grant.lost.at.toISOString(), why: grant.lost.why } } : { ...shown, state: grant.state };
+                }),
+                next: listed.value.next,
+            };
+        }),
+        /** An actor holding gateway:approve within manage reach of the proxy ship removes any person's sign-in: revoked where the server offers it, then dropped (Q6). */
+        removeSignIn: servedProcedure
+            .input(z.strictObject({ name: shipHandleSchema, personShipId: idSchema('ship') }))
+            .output(z.object({ isRevoked: z.boolean() }))
+            .mutation(async ({ ctx, input }) => {
+            const removed = await ctx.partySignIn.remove({ actor: ctx.actor, as: { cookie: ctx.cookie, crewToken: ctx.crewToken }, ...input });
+            if (!removed.isOk) {
+                throw new TRPCError({ code: SIGN_INS_CODES[removed.error.kind], message: removed.error.message });
+            }
+            return removed.value;
+        }),
         /** The gateway states the party's proxy ship anew, from what its server lists now, with argo's marks. */
         state: managing(servedProcedure)
             .input(z.strictObject({ name: shipHandleSchema }))
@@ -823,7 +961,7 @@ export const gatewayRouter = t.router({
         open: personProcedure.input(z.strictObject({ deliveryId: z.string().min(1) })).mutation(async ({ ctx, input }) => personAnswerOf(await ctx.person.openDelivery({ caller: ctx.caller, ...input }))),
         /** Answers a delivery they opened, to its sender. */
         answer: personProcedure
-            .input(z.strictObject({ deliveryId: z.string().min(1), contentType: z.string().min(1), payload: z.string().max(PAYLOAD_MAX_BYTES) }))
+            .input(z.strictObject({ deliveryId: z.string().min(1), contentType: z.string().min(1), payload: payloadSchema }))
             .mutation(async ({ ctx, input }) => personAnswerOf(await ctx.person.answerDelivery({ caller: ctx.caller, ...input }))),
         /** Is done with a delivery they opened, with no answer. */
         done: personProcedure.input(z.strictObject({ deliveryId: z.string().min(1) })).mutation(async ({ ctx, input }) => personAnswerOf(await ctx.person.doneDelivery({ caller: ctx.caller, ...input }))),
@@ -869,7 +1007,7 @@ export const gatewayRouter = t.router({
             .query(async ({ ctx, input: { meetingId, cursor } }) => meetingViewOf(personAnswerOf(await ctx.person.readMeeting({ caller: ctx.caller, meetingId, ...(cursor === undefined ? {} : { cursor }) })))),
         /** Contributes to a meeting, once under the page's key; the fleet takes it while they hold the mic or moderate. */
         contribute: personProcedure
-            .input(z.strictObject({ meetingId: idSchema('meeting'), payload: z.string().min(1).max(PAYLOAD_MAX_BYTES), idempotencyKey: z.string().min(1) }))
+            .input(z.strictObject({ meetingId: idSchema('meeting'), payload: payloadSchema.min(1), idempotencyKey: z.string().min(1) }))
             .mutation(async ({ ctx, input: { meetingId, payload, idempotencyKey } }) => personAnswerOf(await ctx.person.sendMessage({ caller: ctx.caller, to: { kind: 'meeting', meetingId }, contentType: CONTRIBUTION_CONTENT_TYPE, payload, idempotencyKey }))),
         /** Their own mic call: request it, withdraw the request, or release the mic they hold. */
         mic: personProcedure
@@ -1112,13 +1250,14 @@ export const gatewayRouter = t.router({
             }
             return {};
         }),
-        /** pagasae disabled the account (decision 0055): every sign-in of it in the fleet ends, its clients' tokens are revoked, and its Slack link stops. Told again, it ends nothing more. */
+        /** pagasae disabled the account (decision 0055): every sign-in of it in the fleet ends, its clients' tokens are revoked, its Slack link stops, and its grants of outside servers end (decision 0067, Q14). Told again, it ends nothing more. */
         accountDisabled: installationProcedure
             .input(z.strictObject({ fleetId: idSchema('fleet'), accountId: z.string().min(1) }))
             .output(z.strictObject({}))
             .mutation(async ({ ctx, input }) => {
             await ctx.endSignIns(input);
             await ctx.stopSlackLink(input);
+            await ctx.endAccountGrants(input);
             return {};
         }),
     }),