@aeolus-fleet/gateway 0.0.0-stage → 0.0.0

package/dist/core/oauth/exchange-token.d.ts

@@ -0,0 +1,32 @@
+import type { Clock } from '../shared/clock.js';
+import { type Result } from '../shared/result.js';
+import type { AuthorizationCodes, IssuedTokens, OAuthClients, OAuthError, OAuthSecrets } from './ports.js';
+/** An access token works one hour; its refresh token 30 days (orchestrator-1 on aeolus-fleet#877, Q13). */
+export declare const ACCESS_TOKEN_LIFETIME_MS: number;
+export declare const REFRESH_TOKEN_LIFETIME_MS: number;
+/** The tokens a client gets. */
+export interface IssuedPair {
+    readonly accessToken: string;
+    readonly refreshToken: string;
+    readonly expiresInSeconds: number;
+    readonly scope: string | null;
+}
+/** A token request's parameters, the client's credentials among them, however it sent them. */
+export type TokenRequest = Readonly<Record<string, string | undefined>>;
+export type ExchangeToken = (request: TokenRequest) => Promise<Result<IssuedPair, OAuthError>>;
+/**
+ * Use case: a client takes its code for tokens, or refreshes them (OAuth
+ * 2.1). A confidential client proves its secret; a public one, or one known
+ * by its metadata document, needs none, as PKCE binds the code to it. A code
+ * is taken once: a second try revokes every token it gave. A refresh token
+ * is taken once too: the pair rotates, and a rotated one coming again
+ * revokes its whole family.
+ */
+export declare function createExchangeToken(deps: {
+    clients: OAuthClients;
+    codes: AuthorizationCodes;
+    tokens: IssuedTokens;
+    secrets: OAuthSecrets;
+    clock: Clock;
+    resource: string;
+}): ExchangeToken;

package/dist/core/oauth/exchange-token.js

@@ -0,0 +1,98 @@
+import { err, ok } from '../shared/result.js';
+import { holderOf } from './authenticate-access-token.js';
+/** An access token works one hour; its refresh token 30 days (orchestrator-1 on aeolus-fleet#877, Q13). */
+export const ACCESS_TOKEN_LIFETIME_MS = 60 * 60_000;
+export const REFRESH_TOKEN_LIFETIME_MS = 30 * 24 * 60 * 60_000;
+const MS_PER_SECOND = 1000;
+function refusal(error, description) {
+    return err({ error, description });
+}
+/**
+ * Use case: a client takes its code for tokens, or refreshes them (OAuth
+ * 2.1). A confidential client proves its secret; a public one, or one known
+ * by its metadata document, needs none, as PKCE binds the code to it. A code
+ * is taken once: a second try revokes every token it gave. A refresh token
+ * is taken once too: the pair rotates, and a rotated one coming again
+ * revokes its whole family.
+ */
+export function createExchangeToken(deps) {
+    /** The client is who it says, as far as it has a secret. */
+    const isAuthenticated = async (request) => {
+        const clientId = request.client_id;
+        if (clientId === undefined) {
+            return false;
+        }
+        const secretHash = (await deps.clients.find(clientId))?.secretHash ?? null;
+        if (secretHash === null) {
+            return request.client_secret === undefined;
+        }
+        return request.client_secret !== undefined && deps.secrets.hashOf(request.client_secret) === secretHash;
+    };
+    const issue = async (from) => {
+        const accessToken = deps.secrets.newSecret();
+        const refreshToken = deps.secrets.newSecret();
+        const now = deps.clock.now().getTime();
+        await deps.tokens.save({
+            ...from,
+            accessHash: deps.secrets.hashOf(accessToken),
+            accessExpiresAt: new Date(now + ACCESS_TOKEN_LIFETIME_MS),
+            refreshHash: deps.secrets.hashOf(refreshToken),
+            refreshExpiresAt: new Date(now + REFRESH_TOKEN_LIFETIME_MS),
+        });
+        return { accessToken, refreshToken, expiresInSeconds: ACCESS_TOKEN_LIFETIME_MS / MS_PER_SECOND, scope: from.scope };
+    };
+    const fromCode = async (request) => {
+        const { code, code_verifier: verifier } = request;
+        if (code === undefined || verifier === undefined) {
+            return refusal('invalid_request', 'A code and its PKCE verifier are required');
+        }
+        if (request.resource !== undefined && request.resource !== deps.resource) {
+            return refusal('invalid_target', `The resource must be ${deps.resource}`);
+        }
+        const taken = await deps.codes.take(deps.secrets.hashOf(code));
+        if (!taken) {
+            return refusal('invalid_grant', 'No such code');
+        }
+        if (taken.wasUsed) {
+            await deps.tokens.revokeIssuedBy(taken.code.codeHash);
+            return refusal('invalid_grant', 'The code was used before; the tokens it gave are revoked');
+        }
+        const issued = taken.code;
+        const isValid = issued.expiresAt.getTime() > deps.clock.now().getTime() &&
+            issued.clientId === request.client_id &&
+            issued.redirectUri === request.redirect_uri &&
+            deps.secrets.challengeOf(verifier) === issued.codeChallenge;
+        if (!isValid) {
+            return refusal('invalid_grant', 'The code is expired, or was issued to another client, redirect URI or verifier');
+        }
+        const { codeHash, fleetId, clientId, resource, scope } = issued;
+        return ok(await issue({ familyId: codeHash, codeHash, fleetId, clientId, resource, scope, ...holderOf(issued) }));
+    };
+    const fromRefreshToken = async (request) => {
+        if (request.refresh_token === undefined) {
+            return refusal('invalid_request', 'A refresh token is required');
+        }
+        const refreshHash = deps.secrets.hashOf(request.refresh_token);
+        const pair = await deps.tokens.findByRefresh(refreshHash);
+        if (!pair || pair.clientId !== request.client_id || pair.refreshExpiresAt.getTime() <= deps.clock.now().getTime() || pair.state === 'revoked') {
+            return refusal('invalid_grant', 'No such refresh token for this client, or it expired');
+        }
+        if (!(await deps.tokens.rotate(refreshHash))) {
+            await deps.tokens.revokeFamily(pair.familyId);
+            return refusal('invalid_grant', 'The refresh token was used before; its tokens are revoked');
+        }
+        const { familyId, codeHash, fleetId, clientId, resource, scope } = pair;
+        return ok(await issue({ familyId, codeHash, fleetId, clientId, resource, scope, ...holderOf(pair) }));
+    };
+    return async (request) => {
+        const grantType = request.grant_type;
+        if (grantType !== 'authorization_code' && grantType !== 'refresh_token') {
+            return refusal('unsupported_grant_type', 'Only authorization_code and refresh_token are served');
+        }
+        if (!(await isAuthenticated(request))) {
+            return refusal('invalid_client', 'The client could not be authenticated');
+        }
+        return grantType === 'authorization_code' ? fromCode(request) : fromRefreshToken(request);
+    };
+}
+//# sourceMappingURL=exchange-token.js.map

package/dist/core/oauth/exchange-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"exchange-token.js","sourceRoot":"","sources":["../../../src/core/oauth/exchange-token.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAG1D,2GAA2G;AAC3G,MAAM,CAAC,MAAM,wBAAwB,GAAG,EAAE,GAAG,MAAM,CAAC;AACpD,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAe/D,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B,SAAS,OAAO,CAAC,KAAqB,EAAE,WAAmB;IACzD,OAAO,GAAG,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAuI;IACzK,4DAA4D;IAC5D,MAAM,eAAe,GAAG,KAAK,EAAE,OAAqB,EAAoB,EAAE;QACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,UAAU,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,UAAU,IAAI,IAAI,CAAC;QAC3E,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC;QAC7C,CAAC;QACD,OAAO,OAAO,CAAC,aAAa,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,UAAU,CAAC;IAC1G,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,KAAK,EAAE,IAA4G,EAAuB,EAAE;QACxJ,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC7C,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QACvC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACrB,GAAG,IAAI;YACP,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;YAC5C,eAAe,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,wBAAwB,CAAC;YACzD,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;YAC9C,gBAAgB,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,yBAAyB,CAAC;SAC5D,CAAC,CAAC;QACH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,wBAAwB,GAAG,aAAa,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IACtH,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,KAAK,EAAE,OAAqB,EAA2C,EAAE;QACxF,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;QAClD,IAAI,IAAI,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACjD,OAAO,OAAO,CAAC,iBAAiB,EAAE,2CAA2C,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACzE,OAAO,OAAO,CAAC,gBAAgB,EAAE,wBAAwB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,OAAO,CAAC,eAAe,EAAE,cAAc,CAAC,CAAC;QAClD,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtD,OAAO,OAAO,CAAC,eAAe,EAAE,0DAA0D,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC;QAC1B,MAAM,OAAO,GACX,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE;YACvD,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,SAAS;YACrC,MAAM,CAAC,WAAW,KAAK,OAAO,CAAC,YAAY;YAC3C,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,aAAa,CAAC;QAC9D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,OAAO,CAAC,eAAe,EAAE,gFAAgF,CAAC,CAAC;QACpH,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QAChE,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACpH,CAAC,CAAC;IAEF,MAAM,gBAAgB,GAAG,KAAK,EAAE,OAAqB,EAA2C,EAAE;QAChG,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,OAAO,CAAC,iBAAiB,EAAE,6BAA6B,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC9I,OAAO,OAAO,CAAC,eAAe,EAAE,sDAAsD,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9C,OAAO,OAAO,CAAC,eAAe,EAAE,2DAA2D,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QACxE,OAAO,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACxG,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;QACrC,IAAI,SAAS,KAAK,oBAAoB,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;YACxE,OAAO,OAAO,CAAC,wBAAwB,EAAE,sDAAsD,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACtC,OAAO,OAAO,CAAC,gBAAgB,EAAE,uCAAuC,CAAC,CAAC;QAC5E,CAAC;QACD,OAAO,SAAS,KAAK,oBAAoB,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5F,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/oauth/issue-code.d.ts

@@ -0,0 +1,23 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { Clock } from '../shared/clock.js';
+import type { AuthorizationCodes, OAuthSecrets, TokenHolder } from './ports.js';
+import type { AuthorizationRequest } from './read-authorization.js';
+/** How long a code may be taken for tokens: one minute, within OAuth's ten (RFC 6749, 4.1.2). */
+export declare const CODE_LIFETIME_MS = 60000;
+/** The client's redirect URI with the answer's parameters added, its own query kept. */
+export declare function redirectWith(redirectUri: string, parameters: Record<string, string | null>): string;
+/**
+ * Issues a code bound to the client, its redirect URI, its PKCE challenge,
+ * the resource and whom it stands for, in the fleet; answers where the client
+ * is sent back with it and with the issuer (RFC 9207).
+ */
+export declare function issueCode(deps: {
+    codes: AuthorizationCodes;
+    secrets: OAuthSecrets;
+    clock: Clock;
+    issuer: string;
+}, issued: {
+    fleetId: FleetId;
+    authorization: AuthorizationRequest;
+    holder: TokenHolder;
+}): Promise<string>;

package/dist/core/oauth/issue-code.js

@@ -0,0 +1,34 @@
+/** How long a code may be taken for tokens: one minute, within OAuth's ten (RFC 6749, 4.1.2). */
+export const CODE_LIFETIME_MS = 60_000;
+/** The client's redirect URI with the answer's parameters added, its own query kept. */
+export function redirectWith(redirectUri, parameters) {
+    const url = new URL(redirectUri);
+    for (const [name, value] of Object.entries(parameters)) {
+        if (value !== null) {
+            url.searchParams.append(name, value);
+        }
+    }
+    return url.toString();
+}
+/**
+ * Issues a code bound to the client, its redirect URI, its PKCE challenge,
+ * the resource and whom it stands for, in the fleet; answers where the client
+ * is sent back with it and with the issuer (RFC 9207).
+ */
+export async function issueCode(deps, issued) {
+    const { fleetId, authorization, holder } = issued;
+    const code = deps.secrets.newSecret();
+    await deps.codes.save({
+        codeHash: deps.secrets.hashOf(code),
+        fleetId,
+        clientId: authorization.clientId,
+        redirectUri: authorization.redirectUri,
+        codeChallenge: authorization.codeChallenge,
+        resource: authorization.resource,
+        scope: authorization.scope,
+        expiresAt: new Date(deps.clock.now().getTime() + CODE_LIFETIME_MS),
+        ...holder,
+    });
+    return redirectWith(authorization.redirectUri, { code, state: authorization.state, iss: deps.issuer });
+}
+//# sourceMappingURL=issue-code.js.map

package/dist/core/oauth/issue-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue-code.js","sourceRoot":"","sources":["../../../src/core/oauth/issue-code.ts"],"names":[],"mappings":"AAMA,iGAAiG;AACjG,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEvC,wFAAwF;AACxF,MAAM,UAAU,YAAY,CAAC,WAAmB,EAAE,UAAyC;IACzF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACvD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAwF,EACxF,MAAsF;IAEtF,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;IACtC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;QACpB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QACnC,OAAO;QACP,QAAQ,EAAE,aAAa,CAAC,QAAQ;QAChC,WAAW,EAAE,aAAa,CAAC,WAAW;QACtC,aAAa,EAAE,aAAa,CAAC,aAAa;QAC1C,QAAQ,EAAE,aAAa,CAAC,QAAQ;QAChC,KAAK,EAAE,aAAa,CAAC,KAAK;QAC1B,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,gBAAgB,CAAC;QAClE,GAAG,MAAM;KACV,CAAC,CAAC;IACH,OAAO,YAAY,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AACzG,CAAC"}

package/dist/core/oauth/ports.d.ts

@@ -0,0 +1,103 @@
+/**
+ * The gateway's OAuth 2.1 authorization server for outside MCP clients
+ * (interop 3.1, MCP 2026-07-28 authorization): its clients, the codes it
+ * issues, the tokens it issues, and the secrets behind them.
+ */
+import type { FleetId } from '@aeolus-fleet/common';
+import type { Result } from '../shared/result.js';
+/** A client argo pre-registered for its fleet. A confidential one has a secret, kept only as its hash. */
+export interface OAuthClient {
+    readonly clientId: string;
+    readonly fleetId: FleetId;
+    readonly name: string;
+    readonly redirectUris: readonly string[];
+    readonly secretHash: string | null;
+}
+export interface OAuthClients {
+    find(clientId: string): Promise<OAuthClient | undefined>;
+    save(client: OAuthClient): Promise<void>;
+}
+/** Outbound port: a client's metadata document (CIMD), fetched from its client id URL, as JSON not yet read. */
+export interface ClientMetadataDocuments {
+    fetch(url: string): Promise<Result<unknown, {
+        reason: string;
+    }>>;
+}
+/** A code argo's approval issued: used once, within its minute, by the client and redirect URI it was issued to. */
+/**
+ * Whom a code and the tokens it leads to stand for: a party argo approved,
+ * the proxy ship its client calls the fleet as; or an account a person
+ * signed in as through pagasae, by its grant (decision 0054).
+ */
+export type TokenHolder = {
+    readonly kind: 'party';
+    readonly party: string;
+} | {
+    readonly kind: 'account';
+    readonly grantId: string;
+};
+export type AuthorizationCode = {
+    readonly codeHash: string;
+    readonly fleetId: FleetId;
+    readonly clientId: string;
+    readonly redirectUri: string;
+    /** The PKCE challenge, S256. */
+    readonly codeChallenge: string;
+    readonly resource: string;
+    readonly scope: string | null;
+    readonly expiresAt: Date;
+} & TokenHolder;
+export interface AuthorizationCodes {
+    save(code: AuthorizationCode): Promise<void>;
+    /** Marks the code used, at most once even under a race: the code, and whether it had been used before. */
+    take(codeHash: string): Promise<{
+        code: AuthorizationCode;
+        wasUsed: boolean;
+    } | undefined>;
+}
+/** An access token and its refresh token, issued together; a family is every pair one code led to. */
+export type TokenPair = {
+    readonly familyId: string;
+    readonly codeHash: string;
+    readonly fleetId: FleetId;
+    readonly clientId: string;
+    readonly resource: string;
+    readonly scope: string | null;
+    readonly accessHash: string;
+    readonly accessExpiresAt: Date;
+    readonly refreshHash: string;
+    readonly refreshExpiresAt: Date;
+} & TokenHolder;
+export interface IssuedTokens {
+    /** A new pair, active. */
+    save(pair: TokenPair): Promise<void>;
+    findByAccess(accessHash: string): Promise<(TokenPair & {
+        state: TokenState;
+    }) | undefined>;
+    findByRefresh(refreshHash: string): Promise<(TokenPair & {
+        state: TokenState;
+    }) | undefined>;
+    /** Marks an active pair rotated, at most once even under a race: whether this call did. */
+    rotate(refreshHash: string): Promise<boolean>;
+    revokeFamily(familyId: string): Promise<void>;
+    revokeIssuedBy(codeHash: string): Promise<void>;
+    /** Revokes every pair that stands for the account grant in the fleet: its person signs in again. */
+    revokeGrant(fleetId: FleetId, grantId: string): Promise<void>;
+}
+/** active: in use; rotated: its refresh token was traded for a new pair; revoked: refused for good. */
+export type TokenState = 'active' | 'rotated' | 'revoked';
+/** Outbound port: the secrets the server issues, how it keeps them, and PKCE's S256. */
+export interface OAuthSecrets {
+    /** A new random secret, safe in a URL. */
+    newSecret(): string;
+    /** The hash a secret is kept as, and looked up by. */
+    hashOf(secret: string): string;
+    /** PKCE S256: BASE64URL(SHA256(verifier)). */
+    challengeOf(verifier: string): string;
+}
+/** OAuth's error codes the gateway answers (RFC 6749, RFC 8707). */
+export type OAuthErrorCode = 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unsupported_grant_type' | 'unsupported_response_type' | 'invalid_target' | 'access_denied';
+export interface OAuthError {
+    readonly error: OAuthErrorCode;
+    readonly description: string;
+}

package/dist/core/oauth/ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/core/oauth/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../src/core/oauth/ports.ts"],"names":[],"mappings":""}

package/dist/core/oauth/read-authorization.d.ts

@@ -0,0 +1,43 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import { type Result } from '../shared/result.js';
+import type { ClientMetadataDocuments, OAuthClients, OAuthErrorCode } from './ports.js';
+/** An authorization request the gateway read and found valid, for argo to approve or deny. */
+export interface AuthorizationRequest {
+    readonly clientId: string;
+    readonly clientName: string;
+    /** The fleet a pre-registered client belongs to; null for a client known by its metadata document. */
+    readonly clientFleetId: FleetId | null;
+    readonly redirectUri: string;
+    readonly codeChallenge: string;
+    readonly resource: string;
+    readonly scope: string | null;
+    readonly state: string | null;
+}
+/**
+ * Why a request is refused:
+ * - invalidClient: the client or its redirect URI is not known, so the page says so and sends nobody anywhere (RFC 6749, 4.1.2.1);
+ * - redirect: the client is known, so it is sent back to its redirect URI with the error.
+ */
+export type AuthorizationRefusal = {
+    readonly kind: 'invalidClient';
+    readonly message: string;
+} | {
+    readonly kind: 'redirect';
+    readonly redirectUri: string;
+    readonly error: OAuthErrorCode;
+    readonly description: string;
+    readonly state: string | null;
+};
+export type ReadAuthorization = (request: Readonly<Record<string, string | undefined>>) => Promise<Result<AuthorizationRequest, AuthorizationRefusal>>;
+/**
+ * Use case: the gateway reads an authorization request from an MCP client
+ * (OAuth 2.1 with PKCE, MCP 2026-07-28). The client is pre-registered, or
+ * known by its metadata document (CIMD), fetched from its client id. Only
+ * the S256 challenge is taken, and the resource must be the gateway's MCP
+ * endpoint (RFC 8707), so a token is bound to it.
+ */
+export declare function createReadAuthorization(deps: {
+    clients: OAuthClients;
+    documents: ClientMetadataDocuments;
+    resource: string;
+}): ReadAuthorization;

package/dist/core/oauth/read-authorization.js

@@ -0,0 +1,74 @@
+import { z } from 'zod';
+import { err, ok } from '../shared/result.js';
+import { isLoopback, isRedirectUri } from './redirect-uri.js';
+/** A client's metadata document (CIMD), as far as the gateway reads it. */
+const metadataDocumentSchema = z.object({
+    client_id: z.string(),
+    client_name: z.string().min(1).optional(),
+    redirect_uris: z.array(z.string()).min(1),
+});
+/** A client id that is a metadata document's URL: https, or http on this machine, with a path. */
+function metadataDocumentUrl(clientId) {
+    let url;
+    try {
+        url = new URL(clientId);
+    }
+    catch {
+        return undefined;
+    }
+    const isSecure = url.protocol === 'https:' || (url.protocol === 'http:' && isLoopback(url));
+    return isSecure && url.pathname !== '/' && url.hash === '' ? url : undefined;
+}
+/**
+ * Use case: the gateway reads an authorization request from an MCP client
+ * (OAuth 2.1 with PKCE, MCP 2026-07-28). The client is pre-registered, or
+ * known by its metadata document (CIMD), fetched from its client id. Only
+ * the S256 challenge is taken, and the resource must be the gateway's MCP
+ * endpoint (RFC 8707), so a token is bound to it.
+ */
+export function createReadAuthorization(deps) {
+    const knownClient = async (clientId) => {
+        const url = metadataDocumentUrl(clientId);
+        if (url === undefined) {
+            const client = await deps.clients.find(clientId);
+            return client ? ok({ name: client.name, fleetId: client.fleetId, redirectUris: client.redirectUris }) : err(`No client ${clientId} is registered`);
+        }
+        const fetched = await deps.documents.fetch(url.toString());
+        if (!fetched.isOk) {
+            return err(`The client's metadata document at ${clientId} could not be read: ${fetched.error.reason}`);
+        }
+        const document = metadataDocumentSchema.safeParse(fetched.value);
+        if (!document.success || document.data.client_id !== clientId || !document.data.redirect_uris.every(isRedirectUri)) {
+            return err(`The client's metadata document at ${clientId} does not name it, or names no valid redirect URI`);
+        }
+        return ok({ name: document.data.client_name ?? url.hostname, fleetId: null, redirectUris: document.data.redirect_uris });
+    };
+    return async (request) => {
+        const clientId = request.client_id;
+        if (clientId === undefined || clientId === '') {
+            return err({ kind: 'invalidClient', message: 'The request names no client' });
+        }
+        const client = await knownClient(clientId);
+        if (!client.isOk) {
+            return err({ kind: 'invalidClient', message: client.error });
+        }
+        const redirectUri = request.redirect_uri;
+        if (redirectUri === undefined || !client.value.redirectUris.includes(redirectUri)) {
+            return err({ kind: 'invalidClient', message: `${client.value.name} registered no such redirect URI` });
+        }
+        const state = request.state ?? null;
+        const sendBack = (error, description) => err({ kind: 'redirect', redirectUri, error, description, state });
+        if (request.response_type !== 'code') {
+            return sendBack('unsupported_response_type', 'Only the authorization code flow is served');
+        }
+        const codeChallenge = request.code_challenge;
+        if (codeChallenge === undefined || codeChallenge === '' || request.code_challenge_method !== 'S256') {
+            return sendBack('invalid_request', 'A PKCE code challenge with the S256 method is required');
+        }
+        if (request.resource !== deps.resource) {
+            return sendBack('invalid_target', `The resource must be ${deps.resource}`);
+        }
+        return ok({ clientId, clientName: client.value.name, clientFleetId: client.value.fleetId, redirectUri, codeChallenge, resource: deps.resource, scope: request.scope ?? null, state });
+    };
+}
+//# sourceMappingURL=read-authorization.js.map

package/dist/core/oauth/read-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-authorization.js","sourceRoot":"","sources":["../../../src/core/oauth/read-authorization.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AA0B9D,2EAA2E;AAC3E,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1C,CAAC,CAAC;AAEH,kGAAkG;AAClG,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5F,OAAO,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/E,CAAC;AAQD;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAqF;IAC3H,MAAM,WAAW,GAAG,KAAK,EAAE,QAAgB,EAAwC,EAAE;QACnF,MAAM,GAAG,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjD,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,QAAQ,gBAAgB,CAAC,CAAC;QACrJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,GAAG,CAAC,qCAAqC,QAAQ,uBAAuB,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YACnH,OAAO,GAAG,CAAC,qCAAqC,QAAQ,mDAAmD,CAAC,CAAC;QAC/G,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IAC3H,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC9C,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAClF,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,kCAAkC,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC;QACpC,MAAM,QAAQ,GAAG,CAAC,KAAqB,EAAE,WAAmB,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,UAAmB,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5I,IAAI,OAAO,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;YACrC,OAAO,QAAQ,CAAC,2BAA2B,EAAE,4CAA4C,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,EAAE,IAAI,OAAO,CAAC,qBAAqB,KAAK,MAAM,EAAE,CAAC;YACpG,OAAO,QAAQ,CAAC,iBAAiB,EAAE,wDAAwD,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvC,OAAO,QAAQ,CAAC,gBAAgB,EAAE,wBAAwB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxL,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/oauth/redirect-uri.d.ts

@@ -0,0 +1,6 @@
+/** The most redirect URIs one client registers. */
+export declare const REDIRECT_URIS_MAX = 10;
+/** Whether a URL is served on this machine: plain http is allowed only there (OAuth 2.1, 8.4.2). */
+export declare function isLoopback(url: URL): boolean;
+/** A redirect URI a client may register: an absolute https URL, or http on loopback, with no fragment. */
+export declare function isRedirectUri(text: string): boolean;

package/dist/core/oauth/redirect-uri.js

@@ -0,0 +1,20 @@
+/** The most redirect URIs one client registers. */
+export const REDIRECT_URIS_MAX = 10;
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]']);
+/** Whether a URL is served on this machine: plain http is allowed only there (OAuth 2.1, 8.4.2). */
+export function isLoopback(url) {
+    return LOOPBACK_HOSTS.has(url.hostname);
+}
+/** A redirect URI a client may register: an absolute https URL, or http on loopback, with no fragment. */
+export function isRedirectUri(text) {
+    let url;
+    try {
+        url = new URL(text);
+    }
+    catch {
+        return false;
+    }
+    const isSecure = url.protocol === 'https:' || (url.protocol === 'http:' && isLoopback(url));
+    return isSecure && url.hash === '' && !text.includes('#');
+}
+//# sourceMappingURL=redirect-uri.js.map

package/dist/core/oauth/redirect-uri.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect-uri.js","sourceRoot":"","sources":["../../../src/core/oauth/redirect-uri.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE,oGAAoG;AACpG,MAAM,UAAU,UAAU,CAAC,GAAQ;IACjC,OAAO,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5F,OAAO,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC5D,CAAC"}

package/dist/core/oauth/register-client.d.ts

@@ -0,0 +1,22 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { OAuthClients, OAuthSecrets } from './ports.js';
+export type RegisterClient = (input: {
+    fleetId: FleetId;
+    name: string;
+    redirectUris: readonly string[];
+    isConfidential: boolean;
+}) => Promise<Result<{
+    clientId: string;
+    clientSecret: string | null;
+}, DomainError<'INVALID_REDIRECT_URIS'>>>;
+/**
+ * Use case: argo pre-registers an MCP client for its fleet, as MCP
+ * 2026-07-28 deprecates dynamic registration. A confidential client gets a
+ * secret, answered this once and kept only as its hash.
+ */
+export declare function createRegisterClient(deps: {
+    clients: OAuthClients;
+    secrets: OAuthSecrets;
+}): RegisterClient;

package/dist/core/oauth/register-client.js

@@ -0,0 +1,20 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+import { isRedirectUri, REDIRECT_URIS_MAX } from './redirect-uri.js';
+/**
+ * Use case: argo pre-registers an MCP client for its fleet, as MCP
+ * 2026-07-28 deprecates dynamic registration. A confidential client gets a
+ * secret, answered this once and kept only as its hash.
+ */
+export function createRegisterClient(deps) {
+    return async ({ fleetId, name, redirectUris, isConfidential }) => {
+        if (redirectUris.length === 0 || redirectUris.length > REDIRECT_URIS_MAX || !redirectUris.every(isRedirectUri)) {
+            return refuse('INVALID_REDIRECT_URIS', `A client registers 1 to ${String(REDIRECT_URIS_MAX)} redirect URIs, each https, or http on this machine, with no fragment`);
+        }
+        const clientId = `client-${deps.secrets.newSecret()}`;
+        const clientSecret = isConfidential ? deps.secrets.newSecret() : null;
+        await deps.clients.save({ clientId, fleetId, name, redirectUris: [...redirectUris], secretHash: clientSecret === null ? null : deps.secrets.hashOf(clientSecret) });
+        return ok({ clientId, clientSecret });
+    };
+}
+//# sourceMappingURL=register-client.js.map

package/dist/core/oauth/register-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-client.js","sourceRoot":"","sources":["../../../src/core/oauth/register-client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AASrE;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAsD;IACzF,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,EAAE,EAAE;QAC/D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,iBAAiB,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/G,OAAO,MAAM,CAAC,uBAAuB,EAAE,2BAA2B,MAAM,CAAC,iBAAiB,CAAC,uEAAuE,CAAC,CAAC;QACtK,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;QACtD,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACtE,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,UAAU,EAAE,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACpK,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/operator/authenticate-operator.d.ts

@@ -0,0 +1,22 @@
+import type { ConsoleSessionOutput, FleetId, Scope } from '@aeolus-fleet/common';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { ConsoleSessions } from './ports.js';
+export type AuthenticateOperator = (cookie: string | undefined) => Promise<Result<{
+    fleetId: FleetId;
+    kind: ConsoleSessionOutput['kind'];
+    scopes: readonly Scope[];
+}, DomainError<'NOT_THE_OPERATOR'>>>;
+/**
+ * Use case: whether a request comes from argo. The gateway has no login of
+ * its own: its page and the console's server forward the console session
+ * cookie, and the fleet says whose session it is (decision 0043). The gateway
+ * serves every fleet at its FLEET_URL, each with its own connection, so any
+ * signed-in operator there is let through as the operator of their own
+ * fleet. A viewer session is let through as a viewer, with the viewer ship's
+ * scopes, which the fleet answers; what each may call is the API's to check
+ * (decision 0022).
+ */
+export declare function createAuthenticateOperator(deps: {
+    sessions: ConsoleSessions;
+}): AuthenticateOperator;

package/dist/core/operator/authenticate-operator.js

@@ -0,0 +1,26 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+/**
+ * Use case: whether a request comes from argo. The gateway has no login of
+ * its own: its page and the console's server forward the console session
+ * cookie, and the fleet says whose session it is (decision 0043). The gateway
+ * serves every fleet at its FLEET_URL, each with its own connection, so any
+ * signed-in operator there is let through as the operator of their own
+ * fleet. A viewer session is let through as a viewer, with the viewer ship's
+ * scopes, which the fleet answers; what each may call is the API's to check
+ * (decision 0022).
+ */
+export function createAuthenticateOperator(deps) {
+    const refusal = refuse('NOT_THE_OPERATOR', 'Sign in to the console of your fleet');
+    return async (cookie) => {
+        if (cookie === undefined) {
+            return refusal;
+        }
+        const session = await deps.sessions.check(cookie);
+        if (!session.isOk) {
+            return refusal;
+        }
+        return ok(session.value);
+    };
+}
+//# sourceMappingURL=authenticate-operator.js.map

package/dist/core/operator/authenticate-operator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticate-operator.js","sourceRoot":"","sources":["../../../src/core/operator/authenticate-operator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAOtD;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAmC;IAC5E,MAAM,OAAO,GAAG,MAAM,CAAC,kBAAkB,EAAE,sCAAsC,CAAC,CAAC;IACnF,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE;QACtB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/operator/ports.d.ts

@@ -0,0 +1,15 @@
+import type { ConsoleSessionOutput, FleetId, Scope } from '@aeolus-fleet/common';
+import type { FleetRefusal } from '../connection/ports.js';
+import type { Result } from '../shared/result.js';
+/**
+ * Outbound port: asks the fleet whether a forwarded console session cookie is
+ * a signed-in operator's or a viewer's (`console.session`, decisions 0012,
+ * 0022 and 0043), with its ship's scopes.
+ */
+export interface ConsoleSessions {
+    check(cookie: string): Promise<Result<{
+        fleetId: FleetId;
+        kind: ConsoleSessionOutput['kind'];
+        scopes: readonly Scope[];
+    }, FleetRefusal>>;
+}

package/dist/core/operator/ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/core/operator/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../src/core/operator/ports.ts"],"names":[],"mappings":""}

package/dist/core/outside-parties/ports.d.ts

@@ -0,0 +1,21 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { FleetRefusal } from '../connection/ports.js';
+import type { Result } from '../shared/result.js';
+/** Whether a fleet's outside parties are on, and when it was last set; off for a fleet never set (interop I-3). */
+export interface OutsidePartySwitches {
+    isOn(fleetId: FleetId): Promise<boolean>;
+    set(fleetId: FleetId, switched: {
+        isOn: boolean;
+        at: Date;
+    }): Promise<void>;
+}
+/** The credential an actor called the gateway with, passed on so the fleet answers as that actor. */
+export interface ActorCredential {
+    cookie?: string;
+    crewToken?: string;
+}
+/** Outbound port: the fleet's network, as the actor reads it. */
+export interface FleetNetwork {
+    /** Whether the fleet applies no network rules, so every ship reaches every ship. */
+    isOpen(as: ActorCredential): Promise<Result<boolean, FleetRefusal>>;
+}

package/dist/core/outside-parties/ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/core/outside-parties/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../src/core/outside-parties/ports.ts"],"names":[],"mappings":""}