@aeolus-fleet/gateway 0.0.0-stage → 0.0.0

package/dist/core/mcp-out/hand-call.d.ts

@@ -0,0 +1,103 @@
+import { type DeliveryId, type FleetId, type MessageId, type ShipId } from '@aeolus-fleet/common';
+import type { FleetRefusal } from '../connection/ports.js';
+import type { McpServerParty } from '../parties/party.js';
+import type { Result } from '../shared/result.js';
+import type { McpServers } from './ports.js';
+import type { ToolMarks } from './state-party.js';
+/** A delivery to a proxy ship, as its pushReceive hands it: received, or handed before under this lease with its last number. */
+export interface PushedDelivery {
+    readonly deliveryId: DeliveryId;
+    readonly messageId: MessageId;
+    readonly senderShipId: ShipId;
+    readonly contentType: string;
+    readonly payload: string;
+    readonly state: 'received' | 'handed';
+    readonly handOverNumber: number | null;
+    /** The message this one replies to, if any. */
+    readonly inReplyTo: MessageId | null;
+}
+/** A reply naming the request, sent as the proxy ship. */
+export interface Reply {
+    readonly to: ShipId;
+    readonly inReplyTo: MessageId;
+    readonly contentType: string;
+    readonly payload: string;
+    readonly idempotencyKey: string;
+}
+/** Outbound port: the fleet's calls a proxy ship's crew makes (decision 0040), each with its crew token. */
+export interface ProxyShipCrew {
+    /** Its deliveries, up to max: its own in flight first, then pending ones, each received; it waits a while for one, or less once the signal aborts. */
+    pushReceive(crewToken: string, take: {
+        max: number;
+        signal: AbortSignal;
+    }): Promise<Result<PushedDelivery[], FleetRefusal>>;
+    handed(crewToken: string, handOver: {
+        deliveryId: DeliveryId;
+        handOverNumber: number;
+    }): Promise<Result<'handed' | 'acknowledged' | 'undeliverable', FleetRefusal>>;
+    reply(crewToken: string, reply: Reply): Promise<Result<void, FleetRefusal>>;
+    ack(crewToken: string, deliveryId: DeliveryId): Promise<Result<void, FleetRefusal>>;
+    handled(crewToken: string, deliveryId: DeliveryId): Promise<Result<void, FleetRefusal>>;
+    notHandled(crewToken: string, report: {
+        deliveryId: DeliveryId;
+        reason: string;
+    }): Promise<Result<void, FleetRefusal>>;
+}
+/**
+ * What the gateway keeps of a call, so a restart never calls again what may have run:
+ * - calling: handed, and its `tools/call` sent or about to be;
+ * - notSent: the server was not reached, so nothing ran;
+ * - answered: the server answered, and its reply is kept until it is sent;
+ * - mayHaveRun: sent with no answer, and its tool is not marked repeatable;
+ * - done: replied, acknowledged and handled.
+ */
+export interface Call {
+    readonly deliveryId: DeliveryId;
+    readonly fleetId: FleetId;
+    readonly party: string;
+    readonly state: 'calling' | 'notSent' | 'answered' | 'mayHaveRun' | 'done';
+    readonly reply: Reply | null;
+}
+/** Outbound port: the gateway's calls, by delivery. */
+export interface CallStore {
+    find(deliveryId: DeliveryId): Promise<Call | undefined>;
+    save(call: Call): Promise<void>;
+}
+/**
+ * How handing one delivery ended:
+ * - handled: replied, acknowledged and handled;
+ * - again: nothing ran, or running it again is safe: the delivery comes again in flight, to be handed with the next number;
+ * - notHandled: the call may have run and its answer was lost, so a human decides (5.2, option a);
+ * - undeliverable: the fifth attempt; nothing is handed.
+ */
+export type HandOutcome = {
+    readonly kind: 'handled';
+} | {
+    readonly kind: 'again';
+} | {
+    readonly kind: 'notHandled';
+} | {
+    readonly kind: 'undeliverable';
+};
+export type HandCall = (input: {
+    party: McpServerParty;
+    delivery: PushedDelivery;
+}) => Promise<HandOutcome>;
+/** The reason a call that may have run is not handled, as Needs attention shows it. */
+export declare const MAY_HAVE_RUN = "The call may have run; its answer was lost. Check the outside system, then resend or dismiss.";
+/**
+ * Use case: the gateway hands one delivery of a party's proxy ship to its
+ * outside MCP server, as 0040 hands one to an agent (interop 5.2): handed
+ * with the next number, then `tools/call`; the server's answer confirms it,
+ * so it is replied, acknowledged and handled at once. The answer is kept
+ * before the reply, so a restart replies again under the same key and calls
+ * nothing. A call that died unanswered is handed again only where argo
+ * marked its tool repeatable; otherwise it is reported not handled.
+ */
+export declare function createHandCall(deps: {
+    crew: ProxyShipCrew;
+    servers: McpServers;
+    calls: CallStore;
+    marks: ToolMarks;
+    timeoutMs: number;
+}): HandCall;

package/dist/core/mcp-out/hand-call.js

@@ -0,0 +1,116 @@
+import { PAYLOAD_MAX_BYTES, payloadBytes } from '@aeolus-fleet/common';
+import { toolCalledBy, toolInputType, toolResultType } from './content-types.js';
+/** The reason a call that may have run is not handled, as Needs attention shows it. */
+export const MAY_HAVE_RUN = 'The call may have run; its answer was lost. Check the outside system, then resend or dismiss.';
+const AGAIN = { kind: 'again' };
+function isArguments(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function argumentsOf(payload) {
+    try {
+        const parsed = JSON.parse(payload);
+        return isArguments(parsed) ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function errorResult(text) {
+    return { content: [{ type: 'text', text }], isError: true };
+}
+/** The reply carrying a tool's result; one too large for a message is replaced by an error result that says so. */
+function resultReply(delivery, call) {
+    const payload = JSON.stringify(call.result);
+    const bytes = payloadBytes(payload);
+    return {
+        to: delivery.senderShipId,
+        inReplyTo: delivery.messageId,
+        contentType: toolResultType(call.tool),
+        payload: bytes > PAYLOAD_MAX_BYTES ? JSON.stringify(errorResult(`The tool result is ${String(bytes)} bytes as JSON, over the ${String(PAYLOAD_MAX_BYTES)} a message holds.`)) : payload,
+        idempotencyKey: `mcp-result:${delivery.messageId}`,
+    };
+}
+function notACallReply(party, delivery) {
+    return {
+        to: delivery.senderShipId,
+        inReplyTo: delivery.messageId,
+        contentType: 'text/plain',
+        payload: `${party.name} takes only tool calls: send a capability's input type, ${toolInputType('<tool>')}, with the tool arguments as a JSON object.`,
+        idempotencyKey: `mcp-result:${delivery.messageId}`,
+    };
+}
+/**
+ * Use case: the gateway hands one delivery of a party's proxy ship to its
+ * outside MCP server, as 0040 hands one to an agent (interop 5.2): handed
+ * with the next number, then `tools/call`; the server's answer confirms it,
+ * so it is replied, acknowledged and handled at once. The answer is kept
+ * before the reply, so a restart replies again under the same key and calls
+ * nothing. A call that died unanswered is handed again only where argo
+ * marked its tool repeatable; otherwise it is reported not handled.
+ */
+export function createHandCall(deps) {
+    return async ({ party, delivery }) => {
+        const crewToken = party.crewToken;
+        if (crewToken === null) {
+            return AGAIN;
+        }
+        const kept = { deliveryId: delivery.deliveryId, fleetId: party.fleetId, party: party.name };
+        const finish = async (reply) => {
+            for (const step of [() => deps.crew.reply(crewToken, reply), () => deps.crew.ack(crewToken, delivery.deliveryId), () => deps.crew.handled(crewToken, delivery.deliveryId)]) {
+                if (!(await step()).isOk) {
+                    return AGAIN;
+                }
+            }
+            await deps.calls.save({ ...kept, state: 'done', reply });
+            return { kind: 'handled' };
+        };
+        const mayHaveRun = async () => {
+            await deps.calls.save({ ...kept, state: 'mayHaveRun', reply: null });
+            // Core 0.27 refuses this for a delivery never handed once more (aeolus-fleet#955); the call stays judged, and is reported again each time it comes.
+            await deps.crew.notHandled(crewToken, { deliveryId: delivery.deliveryId, reason: MAY_HAVE_RUN });
+            return { kind: 'notHandled' };
+        };
+        const call = await deps.calls.find(delivery.deliveryId);
+        if (call?.state === 'mayHaveRun') {
+            return mayHaveRun();
+        }
+        if (call?.reply) {
+            return finish(call.reply);
+        }
+        const tool = toolCalledBy(delivery.contentType);
+        if (tool === undefined) {
+            return finish(notACallReply(party, delivery));
+        }
+        const args = argumentsOf(delivery.payload);
+        if (args === undefined) {
+            return finish(resultReply(delivery, { tool, result: errorResult('The tool arguments must be a JSON object.') }));
+        }
+        const isRepeatable = (await deps.marks.repeatable(party.fleetId, party.name)).has(tool);
+        // Handed before with no answer kept and not judged unsent: the gateway stopped mid call, so it may have run.
+        if (delivery.state === 'handed' && call?.state !== 'notSent' && !isRepeatable) {
+            return mayHaveRun();
+        }
+        const handed = await deps.crew.handed(crewToken, { deliveryId: delivery.deliveryId, handOverNumber: (delivery.handOverNumber ?? 0) + 1 });
+        if (!handed.isOk) {
+            return AGAIN;
+        }
+        if (handed.value === 'undeliverable') {
+            return { kind: 'undeliverable' };
+        }
+        await deps.calls.save({ ...kept, state: 'calling', reply: null });
+        const outcome = await deps.servers.callTool({ url: party.url, credential: party.credential }, { name: tool, arguments: args, timeoutMs: deps.timeoutMs });
+        switch (outcome.kind) {
+            case 'answered': {
+                const reply = resultReply(delivery, { tool, result: outcome.result });
+                await deps.calls.save({ ...kept, state: 'answered', reply });
+                return finish(reply);
+            }
+            case 'notSent':
+                await deps.calls.save({ ...kept, state: 'notSent', reply: null });
+                return AGAIN;
+            case 'unanswered':
+                return isRepeatable ? AGAIN : mayHaveRun();
+        }
+    };
+}
+//# sourceMappingURL=hand-call.js.map

package/dist/core/mcp-out/hand-call.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hand-call.js","sourceRoot":"","sources":["../../../src/core/mcp-out/hand-call.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAA8D,MAAM,sBAAsB,CAAC;AAKnI,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAsEjF,uFAAuF;AACvF,MAAM,CAAC,MAAM,YAAY,GAAG,+FAA+F,CAAC;AAE5H,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,OAAO,EAAW,CAAC;AAEzC,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5C,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED,mHAAmH;AACnH,SAAS,WAAW,CAAC,QAAwB,EAAE,IAA0C;IACvF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,YAAY;QACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,WAAW,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QACtC,OAAO,EAAE,KAAK,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,sBAAsB,MAAM,CAAC,KAAK,CAAC,4BAA4B,MAAM,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO;QACvL,cAAc,EAAE,cAAc,QAAQ,CAAC,SAAS,EAAE;KACnD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAqB,EAAE,QAAwB;IACpE,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,YAAY;QACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,WAAW,EAAE,YAAY;QACzB,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,2DAA2D,aAAa,CAAC,QAAQ,CAAC,6CAA6C;QACrJ,cAAc,EAAE,cAAc,QAAQ,CAAC,SAAS,EAAE;KACnD,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,IAAyG;IACtI,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE;QACnC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QAClC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QAE5F,MAAM,MAAM,GAAG,KAAK,EAAE,KAAY,EAAwB,EAAE;YAC1D,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;gBAC3K,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBACzB,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACzD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,CAAC,CAAC;QACF,MAAM,UAAU,GAAG,KAAK,IAA0B,EAAE;YAClD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACrE,oJAAoJ;YACpJ,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YACjG,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAChC,CAAC,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACxD,IAAI,IAAI,EAAE,KAAK,KAAK,YAAY,EAAE,CAAC;YACjC,OAAO,UAAU,EAAE,CAAC;QACtB,CAAC;QACD,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;YAChB,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,2CAA2C,CAAC,EAAE,CAAC,CAAC,CAAC;QACnH,CAAC;QACD,MAAM,YAAY,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxF,6GAA6G;QAC7G,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,EAAE,KAAK,KAAK,SAAS,IAAI,CAAC,YAAY,EAAE,CAAC;YAC9E,OAAO,UAAU,EAAE,CAAC;QACtB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,cAAc,EAAE,CAAC,QAAQ,CAAC,cAAc,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1I,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;YACrC,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1J,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;gBACtE,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC7D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;YACD,KAAK,SAAS;gBACZ,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClE,OAAO,KAAK,CAAC;YACf,KAAK,YAAY;gBACf,OAAO,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/mcp-out/mark-tool.d.ts

@@ -0,0 +1,20 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { PartyStore } from '../parties/ports.js';
+import type { StateParty, ToolMarks } from './state-party.js';
+export type MarkTool = (input: {
+    fleetId: FleetId;
+    name: string;
+    tool: string;
+    isRepeatable: boolean;
+}) => ReturnType<StateParty>;
+/**
+ * Use case: argo marks a party's tool repeatable, or takes the mark off
+ * (interop 5.2): a call to it that died unanswered may then be handed
+ * again. The mark is kept first and stated at once; while the statement
+ * cannot be made, the mark waits for the next.
+ */
+export declare function createMarkTool(deps: {
+    parties: PartyStore;
+    marks: ToolMarks;
+    stateParty: StateParty;
+}): MarkTool;

package/dist/core/mcp-out/mark-tool.js

@@ -0,0 +1,17 @@
+import { refuse } from '../shared/errors.js';
+/**
+ * Use case: argo marks a party's tool repeatable, or takes the mark off
+ * (interop 5.2): a call to it that died unanswered may then be handed
+ * again. The mark is kept first and stated at once; while the statement
+ * cannot be made, the mark waits for the next.
+ */
+export function createMarkTool(deps) {
+    return async ({ fleetId, name, tool, isRepeatable }) => {
+        if (!(await deps.parties.find(fleetId, name))) {
+            return refuse('NO_SUCH_PARTY', `No party named ${name}`);
+        }
+        await deps.marks.mark(fleetId, { party: name, tool, isRepeatable });
+        return deps.stateParty({ fleetId, name });
+    };
+}
+//# sourceMappingURL=mark-tool.js.map

package/dist/core/mcp-out/mark-tool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mark-tool.js","sourceRoot":"","sources":["../../../src/core/mcp-out/mark-tool.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAK7C;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAuE;IACpG,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE;QACrD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YAC9C,OAAO,MAAM,CAAC,eAAe,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/mcp-out/ports.d.ts

@@ -0,0 +1,66 @@
+/**
+ * The outside MCP server behind an app proxy ship, as MCP out sees it
+ * (interop 3.3, 5.2): its tools, and one call at a time.
+ */
+import type { Result } from '../shared/result.js';
+import type { McpServerCredential } from '../vault/credential.js';
+/** Where an outside MCP server is, and how the gateway signs in to it. */
+export interface McpServerConnection {
+    /** Its Streamable HTTP endpoint. */
+    readonly url: string;
+    readonly credential: McpServerCredential;
+}
+/** MCP's tool annotations (2026-07-28), as the server states them: hints, never trusted on their own. */
+export interface ToolAnnotations {
+    readonly title?: string;
+    readonly readOnlyHint?: boolean;
+    readonly destructiveHint?: boolean;
+    readonly idempotentHint?: boolean;
+    readonly openWorldHint?: boolean;
+}
+/** One tool of an outside MCP server, as its `tools/list` answers it. */
+export interface OutsideTool {
+    readonly name: string;
+    readonly title?: string;
+    readonly description?: string;
+    readonly inputSchema: Readonly<Record<string, unknown>>;
+    readonly outputSchema?: Readonly<Record<string, unknown>>;
+    readonly annotations?: ToolAnnotations;
+}
+/** A tool's answer: its result, an error result included (`isError`). */
+export interface ToolResult {
+    readonly content: readonly unknown[];
+    readonly structuredContent?: Readonly<Record<string, unknown>>;
+    readonly isError: boolean;
+}
+/**
+ * How one `tools/call` ended (5.2):
+ * - answered: the server's answer, which confirms the hand-over;
+ * - notSent: the gateway never sent it (the server was unreachable, or refused the gateway's credential), so it did not run;
+ * - unanswered: sent, and no answer came (a broken stream, a timeout): whether the server ran it is unknown.
+ */
+export type ToolCallOutcome = {
+    readonly kind: 'answered';
+    readonly result: ToolResult;
+} | {
+    readonly kind: 'notSent';
+    readonly reason: string;
+} | {
+    readonly kind: 'unanswered';
+    readonly reason: string;
+};
+export interface ToolCall {
+    readonly name: string;
+    readonly arguments: Readonly<Record<string, unknown>>;
+    /** How long the gateway waits for the answer before it counts the call as unanswered. */
+    readonly timeoutMs: number;
+}
+/** The outside MCP servers the gateway calls. */
+export interface McpServers {
+    /** The server's tools, every page of them; unreachable when it cannot be listed. */
+    listTools(connection: McpServerConnection): Promise<Result<readonly OutsideTool[], {
+        readonly kind: 'unreachable';
+        readonly reason: string;
+    }>>;
+    callTool(connection: McpServerConnection, call: ToolCall): Promise<ToolCallOutcome>;
+}

package/dist/core/mcp-out/ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/core/mcp-out/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../src/core/mcp-out/ports.ts"],"names":[],"mappings":""}

package/dist/core/mcp-out/run-party.d.ts

@@ -0,0 +1,26 @@
+import type { McpServerParty } from '../parties/party.js';
+import type { HandCall, ProxyShipCrew } from './hand-call.js';
+/** Outbound port: waits the given time, or less once the signal aborts. */
+export type Sleep = (ms: number, signal: AbortSignal) => Promise<void>;
+export type RunParty = (input: {
+    party: McpServerParty;
+    signal: AbortSignal;
+}) => Promise<{
+    ended: 'stopped' | 'crewRefused';
+}>;
+/**
+ * Use case: the gateway takes the calls of a party's proxy ship, as its
+ * crew, until it is stopped (interop 5.2). Each delivery pushReceive takes
+ * is handed to the server once while in flight, with no more calls at once
+ * than the party takes. A delivery answered again waits, longer each time,
+ * before it is handed with the next number; the fleet counts each an
+ * attempt and stops at the fifth. While the fleet answers only what the
+ * gateway already holds, or does not answer, it looks again after a while.
+ */
+export declare function createRunParty(deps: {
+    crew: ProxyShipCrew;
+    handCall: HandCall;
+    sleep: Sleep;
+    pollMs: number;
+    againWaitsMs: readonly number[];
+}): RunParty;

package/dist/core/mcp-out/run-party.js

@@ -0,0 +1,62 @@
+/** The fleet's codes for a crew token it no longer takes: the gateway does not crew the proxy ship any more. */
+const CREW_REFUSED = new Set(['UNAUTHORIZED', 'LEASE_ENDED']);
+/**
+ * Use case: the gateway takes the calls of a party's proxy ship, as its
+ * crew, until it is stopped (interop 5.2). Each delivery pushReceive takes
+ * is handed to the server once while in flight, with no more calls at once
+ * than the party takes. A delivery answered again waits, longer each time,
+ * before it is handed with the next number; the fleet counts each an
+ * attempt and stops at the fifth. While the fleet answers only what the
+ * gateway already holds, or does not answer, it looks again after a while.
+ */
+export function createRunParty(deps) {
+    return async ({ party, signal }) => {
+        const crewToken = party.crewToken;
+        if (crewToken === null) {
+            return { ended: 'crewRefused' };
+        }
+        const max = party.concurrencyLimit;
+        const inFlight = new Map();
+        const agains = new Map();
+        const hand = async (delivery) => {
+            let outcome;
+            try {
+                outcome = await deps.handCall({ party, delivery });
+            }
+            catch {
+                // A failure of the gateway's own (its database): nothing was decided, so the delivery comes again.
+                outcome = { kind: 'again' };
+            }
+            if (outcome.kind === 'again') {
+                const count = (agains.get(delivery.deliveryId) ?? 0) + 1;
+                agains.set(delivery.deliveryId, count);
+                await deps.sleep(deps.againWaitsMs[Math.min(count, deps.againWaitsMs.length) - 1] ?? deps.pollMs, signal);
+            }
+            else {
+                agains.delete(delivery.deliveryId);
+            }
+        };
+        const start = (delivery) => {
+            inFlight.set(delivery.deliveryId, hand(delivery).finally(() => inFlight.delete(delivery.deliveryId)));
+        };
+        while (!signal.aborted) {
+            if (inFlight.size >= max) {
+                await Promise.race(inFlight.values());
+                continue;
+            }
+            const received = await deps.crew.pushReceive(crewToken, { max, signal });
+            if (!received.isOk && CREW_REFUSED.has(received.error.code)) {
+                await Promise.all(inFlight.values());
+                return { ended: 'crewRefused' };
+            }
+            const fresh = received.isOk ? received.value.filter((delivery) => !inFlight.has(delivery.deliveryId)).slice(0, max - inFlight.size) : [];
+            fresh.forEach(start);
+            if (fresh.length === 0) {
+                await Promise.race([deps.sleep(deps.pollMs, signal), ...inFlight.values()]);
+            }
+        }
+        await Promise.all(inFlight.values());
+        return { ended: 'stopped' };
+    };
+}
+//# sourceMappingURL=run-party.js.map

package/dist/core/mcp-out/run-party.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-party.js","sourceRoot":"","sources":["../../../src/core/mcp-out/run-party.ts"],"names":[],"mappings":"AAQA,gHAAgH;AAChH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC,CAAC;AAI9D;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,IAAgH;IAC7I,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE;QACjC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QAClC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;QAClC,CAAC;QACD,MAAM,GAAG,GAAG,KAAK,CAAC,gBAAgB,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA6B,CAAC;QACtD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;QAE7C,MAAM,IAAI,GAAG,KAAK,EAAE,QAAwB,EAAiB,EAAE;YAC7D,IAAI,OAAoB,CAAC;YACzB,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,mGAAmG;gBACnG,OAAO,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAC9B,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;gBACzD,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;gBACvC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC5G,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACrC,CAAC;QACH,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,CAAC,QAAwB,EAAE,EAAE;YACzC,QAAQ,CAAC,GAAG,CACV,QAAQ,CAAC,UAAU,EACnB,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CACnE,CAAC;QACJ,CAAC,CAAC;QAEF,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACvB,IAAI,QAAQ,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC;gBACzB,MAAM,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;gBACtC,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;YACzE,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5D,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;gBACrC,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC;YAClC,CAAC;YACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACrB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/mcp-out/state-party.d.ts

@@ -0,0 +1,38 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { FleetRefusal } from '../connection/ports.js';
+import type { PartyStore } from '../parties/ports.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { McpServers } from './ports.js';
+import { type Statement } from './statement.js';
+/** Outbound port: the fleet's `setStatement`, called as a proxy ship's crew. */
+export interface StatementDoor {
+    setStatement(crewToken: string, statement: Statement): Promise<Result<void, FleetRefusal>>;
+}
+/** Outbound port: argo's repeatable marks, by party and tool. */
+export interface ToolMarks {
+    /** The tools of the party argo marked repeatable. */
+    repeatable(fleetId: FleetId, party: string): Promise<ReadonlySet<string>>;
+    mark(fleetId: FleetId, mark: {
+        party: string;
+        tool: string;
+        isRepeatable: boolean;
+    }): Promise<void>;
+}
+export type StateParty = (input: {
+    fleetId: FleetId;
+    name: string;
+}) => Promise<Result<{
+    capabilities: string[];
+}, DomainError<'NO_SUCH_PARTY' | 'NOT_CREWED' | 'SERVER_UNREACHABLE' | 'STATEMENT_REFUSED'>>>;
+/**
+ * Use case: the gateway states what a party's proxy ship offers, as its
+ * crew: the tools its server lists now, with argo's marks. The whole
+ * statement replaces the one before, so a tool the server dropped is gone.
+ */
+export declare function createStateParty(deps: {
+    parties: PartyStore;
+    servers: McpServers;
+    door: StatementDoor;
+    marks: ToolMarks;
+}): StateParty;

package/dist/core/mcp-out/state-party.js

@@ -0,0 +1,30 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+import { statementOf } from './statement.js';
+/**
+ * Use case: the gateway states what a party's proxy ship offers, as its
+ * crew: the tools its server lists now, with argo's marks. The whole
+ * statement replaces the one before, so a tool the server dropped is gone.
+ */
+export function createStateParty(deps) {
+    return async ({ fleetId, name }) => {
+        const party = await deps.parties.find(fleetId, name);
+        if (party?.kind !== 'mcpServer') {
+            return refuse('NO_SUCH_PARTY', `No party named ${name}`);
+        }
+        if (party.state !== 'crewed' || party.crewToken === null) {
+            return refuse('NOT_CREWED', `The gateway does not crew the proxy ship of ${name} yet`);
+        }
+        const listed = await deps.servers.listTools({ url: party.url, credential: party.credential });
+        if (!listed.isOk) {
+            return refuse('SERVER_UNREACHABLE', `The MCP server of ${name} could not be listed: ${listed.error.reason}`);
+        }
+        const statement = statementOf({ partyName: name, tools: listed.value, repeatable: await deps.marks.repeatable(fleetId, name) });
+        const stated = await deps.door.setStatement(party.crewToken, statement);
+        if (!stated.isOk) {
+            return refuse('STATEMENT_REFUSED', `The fleet refused the statement: ${stated.error.message}`);
+        }
+        return ok({ capabilities: statement.capabilities.map((capability) => capability.name) });
+    };
+}
+//# sourceMappingURL=state-party.js.map

package/dist/core/mcp-out/state-party.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-party.js","sourceRoot":"","sources":["../../../src/core/mcp-out/state-party.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAkB,MAAM,gBAAgB,CAAC;AAkB7D;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAyF;IACxH,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,IAAI,KAAK,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC,eAAe,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YACzD,OAAO,MAAM,CAAC,YAAY,EAAE,+CAA+C,IAAI,MAAM,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9F,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,oBAAoB,EAAE,qBAAqB,IAAI,yBAAyB,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAChI,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,mBAAmB,EAAE,oCAAoC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/mcp-out/statement.d.ts

@@ -0,0 +1,26 @@
+import type { OutsideTool, ToolAnnotations } from './ports.js';
+export interface Capability {
+    readonly name: string;
+    readonly title?: string;
+    readonly description?: string;
+    readonly inputSchema: Readonly<Record<string, unknown>>;
+    readonly outputSchema?: Readonly<Record<string, unknown>>;
+    readonly inputModes: readonly string[];
+    readonly outputModes: readonly string[];
+    readonly annotations?: ToolAnnotations;
+    /** argo's mark that a call may be handed again when it died unanswered; the server's hints never set it. */
+    readonly repeatable?: true;
+}
+export interface Statement {
+    readonly summary: string;
+    readonly capabilities: readonly Capability[];
+}
+/**
+ * The statement of a party's proxy ship. Its summary names the party only:
+ * the server's URL and credential stay in the gateway (NAT both ways).
+ */
+export declare function statementOf(input: {
+    partyName: string;
+    tools: readonly OutsideTool[];
+    repeatable: ReadonlySet<string>;
+}): Statement;

package/dist/core/mcp-out/statement.js

@@ -0,0 +1,32 @@
+/**
+ * A proxy ship's statement (decision 0047), written from its outside MCP
+ * server's `tools/list`: each tool is one capability, with MCP's fields as
+ * the server states them (decision 0048), the content types that call it
+ * and carry its result, and argo's repeatable mark (interop 5.2). The fields
+ * `annotations` and `repeatable` are core 0.28's (aeolus-fleet#956).
+ */
+import { toolInputType, toolResultType } from './content-types.js';
+function capabilityOf(tool, isRepeatable) {
+    return {
+        name: tool.name,
+        ...(tool.title === undefined ? {} : { title: tool.title }),
+        ...(tool.description === undefined ? {} : { description: tool.description }),
+        inputSchema: tool.inputSchema,
+        ...(tool.outputSchema === undefined ? {} : { outputSchema: tool.outputSchema }),
+        inputModes: [toolInputType(tool.name)],
+        outputModes: [toolResultType(tool.name)],
+        ...(tool.annotations === undefined ? {} : { annotations: tool.annotations }),
+        ...(isRepeatable ? { repeatable: true } : {}),
+    };
+}
+/**
+ * The statement of a party's proxy ship. Its summary names the party only:
+ * the server's URL and credential stay in the gateway (NAT both ways).
+ */
+export function statementOf(input) {
+    return {
+        summary: `${input.partyName}, an outside MCP server reached through the Aeolus gateway. Each capability is one of its tools: send its input type with the tool arguments as a JSON object, and the reply carries the tool result.`,
+        capabilities: input.tools.map((tool) => capabilityOf(tool, input.repeatable.has(tool.name))),
+    };
+}
+//# sourceMappingURL=statement.js.map

package/dist/core/mcp-out/statement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"statement.js","sourceRoot":"","sources":["../../../src/core/mcp-out/statement.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAsBnE,SAAS,YAAY,CAAC,IAAiB,EAAE,YAAqB;IAC5D,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1D,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5E,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/E,UAAU,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,WAAW,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5E,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAA4F;IACtH,OAAO;QACL,OAAO,EAAE,GAAG,KAAK,CAAC,SAAS,uMAAuM;QAClO,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;KAC7F,CAAC;AACJ,CAAC"}

package/dist/core/oauth/authenticate-access-token.d.ts

@@ -0,0 +1,25 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { Clock } from '../shared/clock.js';
+import { type Result } from '../shared/result.js';
+import type { IssuedTokens, OAuthSecrets, TokenHolder } from './ports.js';
+/** Who calls with an access token: the fleet and the client it was issued to, and whom it stands for. */
+export type AccessTokenHolder = {
+    readonly fleetId: FleetId;
+    readonly clientId: string;
+    readonly scope: string | null;
+} & TokenHolder;
+export type AuthenticateAccessToken = (accessToken: string) => Promise<Result<AccessTokenHolder, {
+    kind: 'invalidToken';
+}>>;
+/** Whom a code or a pair stands for, alone. */
+export declare function holderOf(held: TokenHolder): TokenHolder;
+/**
+ * Use case: the gateway knows an MCP client by its access token: active,
+ * not expired, and issued for the gateway's own MCP endpoint (RFC 8707).
+ */
+export declare function createAuthenticateAccessToken(deps: {
+    tokens: IssuedTokens;
+    secrets: OAuthSecrets;
+    clock: Clock;
+    resource: string;
+}): AuthenticateAccessToken;

package/dist/core/oauth/authenticate-access-token.js

@@ -0,0 +1,19 @@
+import { err, ok } from '../shared/result.js';
+/** Whom a code or a pair stands for, alone. */
+export function holderOf(held) {
+    return held.kind === 'party' ? { kind: 'party', party: held.party } : { kind: 'account', grantId: held.grantId };
+}
+/**
+ * Use case: the gateway knows an MCP client by its access token: active,
+ * not expired, and issued for the gateway's own MCP endpoint (RFC 8707).
+ */
+export function createAuthenticateAccessToken(deps) {
+    return async (accessToken) => {
+        const pair = await deps.tokens.findByAccess(deps.secrets.hashOf(accessToken));
+        if (pair?.state !== 'active' || pair.resource !== deps.resource || pair.accessExpiresAt.getTime() <= deps.clock.now().getTime()) {
+            return err({ kind: 'invalidToken' });
+        }
+        return ok({ fleetId: pair.fleetId, clientId: pair.clientId, scope: pair.scope, ...holderOf(pair) });
+    };
+}
+//# sourceMappingURL=authenticate-access-token.js.map

package/dist/core/oauth/authenticate-access-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticate-access-token.js","sourceRoot":"","sources":["../../../src/core/oauth/authenticate-access-token.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAY3D,+CAA+C;AAC/C,MAAM,UAAU,QAAQ,CAAC,IAAiB;IACxC,OAAO,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;AACnH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAAqF;IACjI,OAAO,KAAK,EAAE,WAAW,EAAE,EAAE;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;QAC9E,IAAI,IAAI,EAAE,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YAChI,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACtG,CAAC,CAAC;AACJ,CAAC"}