@aeolus-fleet/gateway 0.0.0-stage → 0.0.0

package/dist/core/actors/authenticate-actor.d.ts

@@ -0,0 +1,38 @@
+import type { FleetId, ShipId } from '@aeolus-fleet/common';
+import type { ConnectionStore, FleetDoor } from '../connection/ports.js';
+import type { AuthenticateOperator } from '../operator/authenticate-operator.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+/**
+ * Who calls the gateway's API (decision 0057): argo or a viewer by the
+ * console session, or a ship by its own crew token. Its scopes are the
+ * fleet's answer, never the request's, plugin scopes such as
+ * gateway:approve among them.
+ */
+export type Actor = {
+    readonly fleetId: FleetId;
+    readonly kind: 'operator' | 'viewer';
+    readonly scopes: readonly string[];
+} | {
+    readonly fleetId: FleetId;
+    readonly kind: 'ship';
+    readonly shipId: ShipId;
+    readonly scopes: readonly string[];
+};
+export type AuthenticateActor = (sent: {
+    cookie?: string | undefined;
+    crewToken?: string | undefined;
+}) => Promise<Result<Actor, DomainError<'NOT_AN_ACTOR'>>>;
+/**
+ * Use case: whom a call of the gateway's API is for. A crew token, sent
+ * deliberately, names its ship: the fleet says which ship it crews, and the
+ * gateway, as its own ship in that fleet, reads the ship's scopes. Else the
+ * console session cookie names argo or a viewer, as before. A ship of a
+ * fleet the gateway is not connected to is no actor here. The crew token is
+ * never kept.
+ */
+export declare function createAuthenticateActor(deps: {
+    authenticateOperator: AuthenticateOperator;
+    door: Pick<FleetDoor, 'whoami' | 'getShip'>;
+    connections: Pick<ConnectionStore, 'find'>;
+}): AuthenticateActor;

package/dist/core/actors/authenticate-actor.js

@@ -0,0 +1,30 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+/**
+ * Use case: whom a call of the gateway's API is for. A crew token, sent
+ * deliberately, names its ship: the fleet says which ship it crews, and the
+ * gateway, as its own ship in that fleet, reads the ship's scopes. Else the
+ * console session cookie names argo or a viewer, as before. A ship of a
+ * fleet the gateway is not connected to is no actor here. The crew token is
+ * never kept.
+ */
+export function createAuthenticateActor(deps) {
+    const refusal = refuse('NOT_AN_ACTOR', 'Sign in to the console of your fleet, or call with your ship\'s crew token');
+    return async ({ cookie, crewToken }) => {
+        if (crewToken !== undefined) {
+            const who = await deps.door.whoami(crewToken);
+            if (!who.isOk) {
+                return refusal;
+            }
+            const gateway = await deps.connections.find(who.value.fleetId);
+            if (gateway === undefined) {
+                return refusal;
+            }
+            const ship = await deps.door.getShip(gateway.crewToken, { shipId: who.value.shipId });
+            return ship.isOk ? ok({ fleetId: who.value.fleetId, kind: 'ship', shipId: who.value.shipId, scopes: ship.value.scopes }) : refusal;
+        }
+        const operator = await deps.authenticateOperator(cookie);
+        return operator.isOk ? ok(operator.value) : refusal;
+    };
+}
+//# sourceMappingURL=authenticate-actor.js.map

package/dist/core/actors/authenticate-actor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticate-actor.js","sourceRoot":"","sources":["../../../src/core/actors/authenticate-actor.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AActD;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAIvC;IACC,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,EAAE,4EAA4E,CAAC,CAAC;IACrH,OAAO,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE;QACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9C,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC/D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACtF,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACrI,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACzD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACtD,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/connection/connect.d.ts

@@ -0,0 +1,26 @@
+import type { FleetId, ShipId } from '@aeolus-fleet/common';
+import type { Clock } from '../shared/clock.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { ConnectionStatus, ConnectionStore, FleetDoor } from './ports.js';
+export type ConnectRefusal = DomainError<'ALREADY_CONNECTED' | 'SECRET_REFUSED' | 'OTHER_FLEET' | 'MISSING_SCOPES' | 'SCOPE_REFUSED' | 'FLEET_UNAVAILABLE'>;
+export type Connect = (input: {
+    operatorFleetId: FleetId;
+    shipId: ShipId;
+    secret: string;
+}) => Promise<Result<ConnectionStatus, ConnectRefusal>>;
+/**
+ * Use case: argo connects the gateway, as the other plugins are connected.
+ * The console's server hands it its ship's secret, server to server; the
+ * gateway registers with it as a server and keeps only the crew token. The
+ * ship must be of argo's fleet and hold the gateway's scopes, and the fleet
+ * must take the gateway's declared scope, or the gateway lets
+ * the ship go again and keeps nothing. Each fleet has its own connection:
+ * connect works only while the gateway is not connected to argo's fleet,
+ * whatever other fleets it serves. The secret is never kept or logged.
+ */
+export declare function createConnect(deps: {
+    door: FleetDoor;
+    store: ConnectionStore;
+    clock: Clock;
+}): Connect;

package/dist/core/connection/connect.js

@@ -0,0 +1,57 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+/**
+ * What the gateway's ship does (decisions 0044 to 0046): read the fleet,
+ * commission an app proxy ship for each approved outside party, naming its
+ * owner, and declare the gateway's own scope.
+ */
+const GATEWAY_SCOPES = ['fleet:read', 'fleet:commission', 'fleet:on-behalf', 'scopes:declare'];
+/** The gateway's own scopes, under its namespace: approving is a scope any actor may hold (decision 0056). */
+const GATEWAY_NAMESPACE = {
+    namespace: 'gateway',
+    scopes: [{ scope: 'gateway:approve', description: 'Approve outside parties: outside MCP clients and servers, each acting in the fleet as its proxy ship' }],
+};
+/**
+ * Use case: argo connects the gateway, as the other plugins are connected.
+ * The console's server hands it its ship's secret, server to server; the
+ * gateway registers with it as a server and keeps only the crew token. The
+ * ship must be of argo's fleet and hold the gateway's scopes, and the fleet
+ * must take the gateway's declared scope, or the gateway lets
+ * the ship go again and keeps nothing. Each fleet has its own connection:
+ * connect works only while the gateway is not connected to argo's fleet,
+ * whatever other fleets it serves. The secret is never kept or logged.
+ */
+export function createConnect(deps) {
+    return async ({ operatorFleetId, shipId, secret }) => {
+        if (await deps.store.find(operatorFleetId)) {
+            return refuse('ALREADY_CONNECTED', 'The gateway is connected to this fleet already');
+        }
+        const registered = await deps.door.register({ shipId, secret });
+        if (!registered.isOk) {
+            return refuse('SECRET_REFUSED', `The fleet refused its ship's secret: ${registered.error.message}`);
+        }
+        const { crewToken } = registered.value;
+        const letGo = async (kind, message) => {
+            await deps.door.deregister(crewToken);
+            return refuse(kind, message);
+        };
+        const who = await deps.door.whoami(crewToken);
+        if (!who.isOk) {
+            return letGo('SECRET_REFUSED', `The fleet refused the new crew token: ${who.error.message}`);
+        }
+        if (who.value.fleetId !== operatorFleetId) {
+            return letGo('OTHER_FLEET', "The ship belongs to another fleet than the operator's");
+        }
+        const ship = await deps.door.getShip(crewToken, { shipId });
+        if (!ship.isOk || !GATEWAY_SCOPES.every((scope) => ship.value.scopes.includes(scope))) {
+            return letGo('MISSING_SCOPES', `The ship needs ${GATEWAY_SCOPES.join(', ')}`);
+        }
+        const declared = await deps.door.declareScopes(crewToken, GATEWAY_NAMESPACE);
+        if (!declared.isOk) {
+            return letGo('SCOPE_REFUSED', `The fleet did not take the gateway's scope gateway:approve: ${declared.error.message}`);
+        }
+        await deps.store.save({ fleetId: who.value.fleetId, shipId, name: who.value.name, crewToken, crewedAt: deps.clock.now() });
+        return ok({ state: 'connected', ship: { shipId, name: who.value.name }, lastShipId: shipId });
+    };
+}
+//# sourceMappingURL=connect.js.map

package/dist/core/connection/connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.js","sourceRoot":"","sources":["../../../src/core/connection/connect.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAOtD;;;;GAIG;AACH,MAAM,cAAc,GAAG,CAAC,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;AAE/F,8GAA8G;AAC9G,MAAM,iBAAiB,GAAG;IACxB,SAAS,EAAE,SAAS;IACpB,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,sGAAsG,EAAE,CAAC;CAC5J,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,IAA+D;IAC3F,OAAO,KAAK,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;QACnD,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YAC3C,OAAO,MAAM,CAAC,mBAAmB,EAAE,gDAAgD,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC,gBAAgB,EAAE,wCAAwC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,MAAM,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC;QACvC,MAAM,KAAK,GAAG,KAAK,EAAoC,IAAO,EAAE,OAAe,EAAE,EAAE;YACjF,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACtC,OAAO,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/B,CAAC,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,KAAK,CAAC,gBAAgB,EAAE,yCAAyC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC,aAAa,EAAE,uDAAuD,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACtF,OAAO,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;QAC7E,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,OAAO,KAAK,CAAC,eAAe,EAAE,+DAA+D,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACzH,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3H,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IAChG,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/connection/ports.d.ts

@@ -0,0 +1,87 @@
+import type { FleetId, ShipId } from '@aeolus-fleet/common';
+import type { Result } from '../shared/result.js';
+/**
+ * Why the fleet refused a ship call: its code (CONFLICT, UNAUTHORIZED,
+ * LEASE_ENDED, ...) and its message. UNAVAILABLE: no answer came, so the call
+ * may or may not have been carried out.
+ */
+export interface FleetRefusal {
+    code: string;
+    message: string;
+}
+/** A ship as `fleet.ship` shows it: what the gateway reads of it. */
+export interface FleetShip {
+    status: 'awaitingCrew' | 'crewed' | 'retired';
+    scopes: string[];
+}
+/**
+ * Outbound port: the fleet's public ship calls, as the gateway makes them for
+ * its own ship. The gateway is a ship like any other.
+ */
+export interface FleetDoor {
+    register(claim: {
+        shipId: ShipId;
+        secret: string;
+    }): Promise<Result<{
+        crewToken: string;
+    }, FleetRefusal>>;
+    whoami(crewToken: string): Promise<Result<{
+        shipId: ShipId;
+        fleetId: FleetId;
+        name: string;
+        type: string;
+    }, FleetRefusal>>;
+    /** A ship of the fleet, retired ones included; needs fleet:read. */
+    getShip(crewToken: string, ship: {
+        shipId: ShipId;
+    }): Promise<Result<FleetShip, FleetRefusal>>;
+    /** Ends this session's crew of its ship: the lease and the secret it claimed with. */
+    deregister(crewToken: string): Promise<Result<undefined, FleetRefusal>>;
+    /** Declares the ship's own namespace and its whole list of scopes; the fleet stores them, the gateway enforces them (decision 0046). */
+    declareScopes(crewToken: string, declaration: {
+        namespace: string;
+        scopes: {
+            scope: string;
+            description: string;
+        }[];
+    }): Promise<Result<undefined, FleetRefusal>>;
+}
+/** The crew token the gateway holds for its ship in a fleet, and when it got it. */
+export interface GatewayCrew {
+    /** The fleet the ship belongs to: the fleet the gateway serves. */
+    fleetId: FleetId;
+    shipId: ShipId;
+    /** The ship's name when the gateway connected, shown while the fleet does not answer. */
+    name: string;
+    crewToken: string;
+    crewedAt: Date;
+}
+/** The fleet and ship the gateway was last connected as; kept when its crew token is dropped. */
+export interface GatewayBinding {
+    fleetId: FleetId;
+    shipId: ShipId;
+}
+/**
+ * Outbound port: where the gateway keeps each fleet's crew token across
+ * restarts. One install serves many fleets, one connection each.
+ */
+export interface ConnectionStore {
+    /** The fleet's crew, while the gateway holds a crew token for it: while it is connected to that fleet. */
+    find(fleetId: FleetId): Promise<GatewayCrew | undefined>;
+    /** The fleet's last connection, with or without a crew token; none before its first. */
+    binding(fleetId: FleetId): Promise<GatewayBinding | undefined>;
+    /** Every fleet's crew the gateway holds a crew token for: the fleets it is connected to. */
+    connected(): Promise<GatewayCrew[]>;
+    save(crew: GatewayCrew): Promise<void>;
+    /** Forgets the fleet's crew token, keeping its binding: the gateway is not connected to that fleet. */
+    drop(fleetId: FleetId): Promise<void>;
+}
+/** Whether the gateway holds a working crew token for its ship, as which ship, and the ship it was last connected as. */
+export interface ConnectionStatus {
+    state: 'not-connected' | 'connected';
+    ship: {
+        shipId: ShipId;
+        name: string;
+    } | null;
+    lastShipId: ShipId | null;
+}

package/dist/core/connection/ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/core/connection/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../src/core/connection/ports.ts"],"names":[],"mappings":""}

package/dist/core/connection/read-connection.d.ts

@@ -0,0 +1,14 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { ConnectionStatus, ConnectionStore, FleetDoor } from './ports.js';
+export type ReadConnection = (fleetId: FleetId) => Promise<ConnectionStatus>;
+/**
+ * Use case: whether the gateway is connected to a fleet. The fleet's kept
+ * crew token is asked who it is: a token the fleet no longer takes (the ship
+ * was released, its session ended) is dropped, and the gateway is not
+ * connected to that fleet until argo connects it again. When the fleet does
+ * not answer, the token is kept.
+ */
+export declare function createReadConnection(deps: {
+    door: FleetDoor;
+    store: ConnectionStore;
+}): ReadConnection;

package/dist/core/connection/read-connection.js

@@ -0,0 +1,24 @@
+/** The codes with which the fleet says a crew token no longer crews its ship. */
+const GONE = new Set(['LEASE_ENDED', 'UNAUTHORIZED']);
+/**
+ * Use case: whether the gateway is connected to a fleet. The fleet's kept
+ * crew token is asked who it is: a token the fleet no longer takes (the ship
+ * was released, its session ended) is dropped, and the gateway is not
+ * connected to that fleet until argo connects it again. When the fleet does
+ * not answer, the token is kept.
+ */
+export function createReadConnection(deps) {
+    return async (fleetId) => {
+        const crew = await deps.store.find(fleetId);
+        if (crew) {
+            const who = await deps.door.whoami(crew.crewToken);
+            if (who.isOk || !GONE.has(who.error.code)) {
+                return { state: 'connected', ship: { shipId: crew.shipId, name: who.isOk ? who.value.name : crew.name }, lastShipId: crew.shipId };
+            }
+            await deps.store.drop(fleetId);
+        }
+        const binding = await deps.store.binding(fleetId);
+        return { state: 'not-connected', ship: null, lastShipId: binding?.shipId ?? null };
+    };
+}
+//# sourceMappingURL=read-connection.js.map

package/dist/core/connection/read-connection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-connection.js","sourceRoot":"","sources":["../../../src/core/connection/read-connection.ts"],"names":[],"mappings":"AAMA,iFAAiF;AACjF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC;AAEtD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAiD;IACpF,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACnD,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YACrI,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC;IACrF,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/installation/delete-fleet.d.ts

@@ -0,0 +1,21 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { Clock } from '../shared/clock.js';
+import type { DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { FleetForgetter, InstallationRequests, RequestHasher } from './ports.js';
+export type DeleteFleet = (input: {
+    requestId: string;
+    fleetId: FleetId;
+}) => Promise<Result<Record<string, never>, DomainError<'REQUEST_ID_USED'>>>;
+/**
+ * Use case: the hosting service deletes a fleet from the gateway (decision
+ * 0021): the gateway forgets everything it holds of the fleet and tells the
+ * fleet nothing; its ships stay there. The request is kept as its hash only,
+ * so nothing of the fleet stays; a replay answers the first answer.
+ */
+export declare function createDeleteFleet(deps: {
+    forgetter: FleetForgetter;
+    requests: InstallationRequests;
+    hasher: RequestHasher;
+    clock: Clock;
+}): DeleteFleet;

package/dist/core/installation/delete-fleet.js

@@ -0,0 +1,21 @@
+import { ok } from '../shared/result.js';
+import { earlierAnswer } from './request-id.js';
+/**
+ * Use case: the hosting service deletes a fleet from the gateway (decision
+ * 0021): the gateway forgets everything it holds of the fleet and tells the
+ * fleet nothing; its ships stay there. The request is kept as its hash only,
+ * so nothing of the fleet stays; a replay answers the first answer.
+ */
+export function createDeleteFleet(deps) {
+    return async ({ requestId, fleetId }) => {
+        const requestHash = deps.hasher.hash(`deleteFleet ${fleetId}`);
+        const earlier = await earlierAnswer(deps.requests, { requestId, requestHash });
+        if (earlier !== undefined) {
+            return 'isOk' in earlier ? earlier : ok({});
+        }
+        await deps.forgetter.forget(fleetId);
+        await deps.requests.record({ requestId, kind: 'deleteFleet', requestHash, fleetId: null, isEnabled: null, at: deps.clock.now() });
+        return ok({});
+    };
+}
+//# sourceMappingURL=delete-fleet.js.map

package/dist/core/installation/delete-fleet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete-fleet.js","sourceRoot":"","sources":["../../../src/core/installation/delete-fleet.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAIhD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAwG;IACxI,OAAO,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;QACtC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,OAAO,EAAE,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;QAC/E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAClI,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/installation/ports.d.ts

@@ -0,0 +1,43 @@
+import type { FleetId } from '@aeolus-fleet/common';
+/**
+ * Whether the installation has an installation token (decision 0021): open
+ * without one, as a self-hosted gateway runs, and every fleet is served;
+ * enabled with one, and a fleet is served only once the hosting service
+ * switched it on.
+ */
+export type InstallationMode = 'open' | 'enabled';
+/** Outbound port: each fleet's switch, as the hosting service set it. */
+export interface FleetSwitches {
+    /** Whether the fleet was switched on; undefined when it never was switched. */
+    find(fleetId: FleetId): Promise<boolean | undefined>;
+    set(fleetId: FleetId, change: {
+        isEnabled: boolean;
+        at: Date;
+    }): Promise<void>;
+}
+/**
+ * A request the installation answered, by the caller's request id. A switch
+ * names its fleet and what it set, and goes with its fleet; a delete names
+ * nothing of the fleet, only the request's hash.
+ */
+export interface InstallationRequest {
+    requestId: string;
+    kind: 'setEnabled' | 'deleteFleet';
+    requestHash: string;
+    fleetId: FleetId | null;
+    isEnabled: boolean | null;
+    at: Date;
+}
+/** Outbound port: the installation's requests, so a replay answers what the first call answered. */
+export interface InstallationRequests {
+    find(requestId: string): Promise<InstallationRequest | undefined>;
+    record(request: InstallationRequest): Promise<void>;
+}
+/** Outbound port: forgets everything the gateway holds of a fleet, in one go: its connection, its switch, its parties with their vault, and the requests that name it. */
+export interface FleetForgetter {
+    forget(fleetId: FleetId): Promise<void>;
+}
+/** Outbound port: a one-way hash of a request's text, kept instead of the request. */
+export interface RequestHasher {
+    hash(text: string): string;
+}

package/dist/core/installation/ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/core/installation/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../src/core/installation/ports.ts"],"names":[],"mappings":""}

package/dist/core/installation/read-fleet.d.ts

@@ -0,0 +1,18 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { ConnectionStore } from '../connection/ports.js';
+import type { IsServed } from './served.js';
+export type ReadFleet = (input: {
+    fleetId: FleetId;
+}) => Promise<{
+    isEnabled: boolean;
+    isConnected: boolean;
+}>;
+/**
+ * Use case: a fleet as the hosting service reads it: whether the gateway
+ * serves it, and whether the gateway holds a crew token for it. Off and
+ * connected is a fleet whose connection waits for it to be on again.
+ */
+export declare function createReadFleet(deps: {
+    isServed: IsServed;
+    connections: ConnectionStore;
+}): ReadFleet;

package/dist/core/installation/read-fleet.js

@@ -0,0 +1,9 @@
+/**
+ * Use case: a fleet as the hosting service reads it: whether the gateway
+ * serves it, and whether the gateway holds a crew token for it. Off and
+ * connected is a fleet whose connection waits for it to be on again.
+ */
+export function createReadFleet(deps) {
+    return async ({ fleetId }) => ({ isEnabled: await deps.isServed(fleetId), isConnected: (await deps.connections.find(fleetId)) !== undefined });
+}
+//# sourceMappingURL=read-fleet.js.map

package/dist/core/installation/read-fleet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-fleet.js","sourceRoot":"","sources":["../../../src/core/installation/read-fleet.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAA0D;IACxF,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC;AACjJ,CAAC"}

package/dist/core/installation/request-id.d.ts

@@ -0,0 +1,8 @@
+import { type DomainError } from '../shared/errors.js';
+import type { Err } from '../shared/result.js';
+import type { InstallationRequest, InstallationRequests } from './ports.js';
+/** What a request id already answered: the earlier request when it is the same one, a refusal when it was another. */
+export declare function earlierAnswer(requests: InstallationRequests, request: {
+    requestId: string;
+    requestHash: string;
+}): Promise<InstallationRequest | Err<DomainError<'REQUEST_ID_USED'>> | undefined>;

package/dist/core/installation/request-id.js

@@ -0,0 +1,10 @@
+import { refuse } from '../shared/errors.js';
+/** What a request id already answered: the earlier request when it is the same one, a refusal when it was another. */
+export async function earlierAnswer(requests, request) {
+    const earlier = await requests.find(request.requestId);
+    if (!earlier) {
+        return undefined;
+    }
+    return earlier.requestHash === request.requestHash ? earlier : refuse('REQUEST_ID_USED', `The request id ${request.requestId} was used for another request`);
+}
+//# sourceMappingURL=request-id.js.map

package/dist/core/installation/request-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-id.js","sourceRoot":"","sources":["../../../src/core/installation/request-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAI/D,sHAAsH;AACtH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAA8B,EAC9B,OAAmD;IAEnD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,EAAE,kBAAkB,OAAO,CAAC,SAAS,+BAA+B,CAAC,CAAC;AAC/J,CAAC"}

package/dist/core/installation/served.d.ts

@@ -0,0 +1,12 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { FleetSwitches, InstallationMode } from './ports.js';
+/** Whether the gateway serves the fleet now: off, it does nothing for that fleet. */
+export type IsServed = (fleetId: FleetId) => Promise<boolean>;
+/**
+ * Policy: the gateway serves every fleet of an open installation, and a fleet
+ * of an enabled one only once the hosting service switched it on (decision 0021).
+ */
+export declare function createIsServed(deps: {
+    installation: InstallationMode;
+    switches: FleetSwitches;
+}): IsServed;

package/dist/core/installation/served.js

@@ -0,0 +1,8 @@
+/**
+ * Policy: the gateway serves every fleet of an open installation, and a fleet
+ * of an enabled one only once the hosting service switched it on (decision 0021).
+ */
+export function createIsServed(deps) {
+    return async (fleetId) => deps.installation === 'open' || (await deps.switches.find(fleetId)) === true;
+}
+//# sourceMappingURL=served.js.map

package/dist/core/installation/served.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"served.js","sourceRoot":"","sources":["../../../src/core/installation/served.ts"],"names":[],"mappings":"AAOA;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAiE;IAC9F,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,KAAK,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC;AACzG,CAAC"}

package/dist/core/installation/set-fleet-enabled.d.ts

@@ -0,0 +1,25 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { Clock } from '../shared/clock.js';
+import type { DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { FleetSwitches, InstallationRequests, RequestHasher } from './ports.js';
+export type SetFleetEnabled = (input: {
+    requestId: string;
+    fleetId: FleetId;
+    isEnabled: boolean;
+}) => Promise<Result<{
+    fleetId: FleetId;
+    isEnabled: boolean;
+}, DomainError<'REQUEST_ID_USED'>>>;
+/**
+ * Use case: the hosting service switches the gateway on or off for a fleet
+ * (decision 0021). Off keeps everything of the fleet, so on again resumes,
+ * whatever network the fleet has (interop I-3). A replayed request id
+ * answers what it answered first and changes nothing.
+ */
+export declare function createSetFleetEnabled(deps: {
+    switches: FleetSwitches;
+    requests: InstallationRequests;
+    hasher: RequestHasher;
+    clock: Clock;
+}): SetFleetEnabled;

package/dist/core/installation/set-fleet-enabled.js

@@ -0,0 +1,22 @@
+import { ok } from '../shared/result.js';
+import { earlierAnswer } from './request-id.js';
+/**
+ * Use case: the hosting service switches the gateway on or off for a fleet
+ * (decision 0021). Off keeps everything of the fleet, so on again resumes,
+ * whatever network the fleet has (interop I-3). A replayed request id
+ * answers what it answered first and changes nothing.
+ */
+export function createSetFleetEnabled(deps) {
+    return async ({ requestId, fleetId, isEnabled }) => {
+        const requestHash = deps.hasher.hash(`setEnabled ${fleetId} ${String(isEnabled)}`);
+        const earlier = await earlierAnswer(deps.requests, { requestId, requestHash });
+        if (earlier !== undefined) {
+            return 'isOk' in earlier ? earlier : ok({ fleetId, isEnabled: earlier.isEnabled === true });
+        }
+        const at = deps.clock.now();
+        await deps.switches.set(fleetId, { isEnabled, at });
+        await deps.requests.record({ requestId, kind: 'setEnabled', requestHash, fleetId, isEnabled, at });
+        return ok({ fleetId, isEnabled });
+    };
+}
+//# sourceMappingURL=set-fleet-enabled.js.map

package/dist/core/installation/set-fleet-enabled.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-fleet-enabled.js","sourceRoot":"","sources":["../../../src/core/installation/set-fleet-enabled.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAQhD;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAKrC;IACC,OAAO,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE;QACjD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,OAAO,IAAI,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACnF,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;QAC/E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QACnG,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/mcp-in/call-tool.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Use case: an outside MCP client calls a tool (interop 3.3). The call is a
+ * message the party's proxy ship sends to the tool's ship, and the client is
+ * answered a handle only once the fleet's send answered OK: the message is
+ * stored before any answer, and the gateway never answers OK itself. It
+ * then waits a bounded time for the answer (interop 3.3): answered within
+ * it, the client gets the answer itself; else its handle and the state.
+ */
+import type { FleetId } from '@aeolus-fleet/common';
+import type { Sleep } from '../mcp-out/run-party.js';
+import type { PartyStore } from '../parties/ports.js';
+import type { Clock } from '../shared/clock.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import { type ListTools } from './list-tools.js';
+import type { CallKeys, CallSender, ClientCalls } from './ports.js';
+import { type ReadCall } from './read-client-call.js';
+export type CallToolRefusal = DomainError<'PARTY_NOT_CREWED' | 'FLEET_UNAVAILABLE' | 'NO_SUCH_TOOL' | 'INVALID_ARGUMENTS' | 'NOT_REACHABLE' | 'SEND_REFUSED'>;
+export type CallTool = (caller: {
+    fleetId: FleetId;
+    party: string;
+}, call: {
+    name: string;
+    arguments: Record<string, unknown>;
+}) => Promise<Result<ReadCall, CallToolRefusal>>;
+interface CallToolDeps {
+    parties: PartyStore;
+    listTools: ListTools;
+    sender: CallSender;
+    calls: ClientCalls;
+    keys: CallKeys;
+    clock: Clock;
+    /** How long a call waits for its answer before it fails: the gateway default, while statements state none. */
+    deadlineMs: number;
+    sleep: Sleep;
+    /** How long a call waits for its answer before it is answered its handle. */
+    waitMs: number;
+    /** How often it reads the call while it waits. */
+    waitPollMs: number;
+}
+export declare function createCallTool(deps: CallToolDeps): CallTool;
+export {};