@aeolus-fleet/gateway 0.0.0-stage → 0.0.0

package/dist/core/outside-parties/set-outside-parties.d.ts

@@ -0,0 +1,34 @@
+import type { Actor } from '../actors/authenticate-actor.js';
+import type { Clock } from '../shared/clock.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { ActorCredential, FleetNetwork, OutsidePartySwitches } from './ports.js';
+/** The scope that switches a fleet's outside parties, as it changes the fleet's network. */
+export declare const SWITCHING_SCOPE = "fleet:network";
+export type ReadOutsideParties = (actor: Actor) => Promise<{
+    isOn: boolean;
+}>;
+export type SetOutsideParties = (input: {
+    actor: Actor;
+    as: ActorCredential;
+    isOn: boolean;
+    isOpenNetworkConfirmed: boolean;
+}) => Promise<Result<{
+    isOn: boolean;
+}, DomainError<'NOT_A_NETWORKER' | 'OPEN_NETWORK' | 'FLEET_UNAVAILABLE'>>>;
+/** Use case: whether the actor's fleet's outside parties are on. */
+export declare function createReadOutsideParties(deps: {
+    switches: OutsidePartySwitches;
+}): ReadOutsideParties;
+/**
+ * Use case: an actor holding fleet:network turns the fleet's outside parties
+ * on or off (interop I-3). The gateway sets no policy but warns: turning
+ * them on while the fleet applies no network rules needs the warning
+ * confirmed. The rules are read as the actor, so the fleet answers what that
+ * actor may see. Turning off reads nothing.
+ */
+export declare function createSetOutsideParties(deps: {
+    switches: OutsidePartySwitches;
+    network: FleetNetwork;
+    clock: Clock;
+}): SetOutsideParties;

package/dist/core/outside-parties/set-outside-parties.js

@@ -0,0 +1,34 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+/** The scope that switches a fleet's outside parties, as it changes the fleet's network. */
+export const SWITCHING_SCOPE = 'fleet:network';
+/** Use case: whether the actor's fleet's outside parties are on. */
+export function createReadOutsideParties(deps) {
+    return async (actor) => ({ isOn: await deps.switches.isOn(actor.fleetId) });
+}
+/**
+ * Use case: an actor holding fleet:network turns the fleet's outside parties
+ * on or off (interop I-3). The gateway sets no policy but warns: turning
+ * them on while the fleet applies no network rules needs the warning
+ * confirmed. The rules are read as the actor, so the fleet answers what that
+ * actor may see. Turning off reads nothing.
+ */
+export function createSetOutsideParties(deps) {
+    return async ({ actor, as, isOn, isOpenNetworkConfirmed }) => {
+        if (!actor.scopes.includes(SWITCHING_SCOPE)) {
+            return refuse('NOT_A_NETWORKER', `Switching outside parties needs ${SWITCHING_SCOPE}`);
+        }
+        if (isOn && !isOpenNetworkConfirmed) {
+            const isOpen = await deps.network.isOpen(as);
+            if (!isOpen.isOk) {
+                return refuse('FLEET_UNAVAILABLE', `The fleet did not say its network rules: ${isOpen.error.message}`);
+            }
+            if (isOpen.value) {
+                return refuse('OPEN_NETWORK', 'This fleet applies no network rules, so every outside party would reach every ship. Confirm to turn outside parties on anyway.');
+            }
+        }
+        await deps.switches.set(actor.fleetId, { isOn, at: deps.clock.now() });
+        return ok({ isOn });
+    };
+}
+//# sourceMappingURL=set-outside-parties.js.map

package/dist/core/outside-parties/set-outside-parties.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-outside-parties.js","sourceRoot":"","sources":["../../../src/core/outside-parties/set-outside-parties.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAGtD,4FAA4F;AAC5F,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;AAW/C,oEAAoE;AACpE,MAAM,UAAU,wBAAwB,CAAC,IAAwC;IAC/E,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAA6E;IACnH,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,EAAE,EAAE;QAC3D,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,iBAAiB,EAAE,mCAAmC,eAAe,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjB,OAAO,MAAM,CAAC,mBAAmB,EAAE,4CAA4C,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACzG,CAAC;YACD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,OAAO,MAAM,CAAC,cAAc,EAAE,gIAAgI,CAAC,CAAC;YAClK,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACvE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACtB,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/approve-party.d.ts

@@ -0,0 +1,55 @@
+import type { FleetId, ShipId } from '@aeolus-fleet/common';
+import type { ConnectionStore } from '../connection/ports.js';
+import type { RequestHasher } from '../installation/ports.js';
+import type { Clock } from '../shared/clock.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { McpServerCredential } from '../vault/credential.js';
+import type { PartyStore, ProxyShipDoor } from './ports.js';
+import { type ShownParty } from './shown-party.js';
+/** The type of every outside MCP server's proxy ship. */
+export declare const MCP_SERVER_SHIP_TYPE = "mcp-server";
+/** The type of every outside MCP client's proxy ship. */
+export declare const MCP_CLIENT_SHIP_TYPE = "mcp-client";
+export type ApprovePartyRefusal = DomainError<'OUTSIDE_PARTIES_OFF' | 'NOT_CONNECTED' | 'PARTY_EXISTS' | 'COMMISSION_REFUSED' | 'FLEET_UNAVAILABLE'>;
+export type ApproveParty = (input: {
+    operatorFleetId: FleetId;
+    requestId: string;
+    name: string;
+    url: string;
+    credential: McpServerCredential;
+    ownerShipId: ShipId;
+    /** The scopes granted its proxy ship beside the ones every app ship gets (decision 0046). */
+    scopes: readonly string[];
+    concurrencyLimit: number;
+}) => Promise<Result<ShownParty, ApprovePartyRefusal>>;
+export type ApproveClientParty = (input: {
+    operatorFleetId: FleetId;
+    requestId: string;
+    name: string;
+    clientId: string;
+    ownerShipId: ShipId;
+    scopes: readonly string[];
+}) => Promise<Result<ShownParty, ApprovePartyRefusal | DomainError<'CLIENT_HAS_PARTY'>>>;
+interface ApprovalDeps {
+    connections: ConnectionStore;
+    parties: PartyStore;
+    door: ProxyShipDoor;
+    hasher: RequestHasher;
+    /** Whether the fleet's outside parties are on (interop I-3). */
+    servesOutsideParties: (fleetId: FleetId) => Promise<boolean>;
+    clock: Clock;
+}
+/**
+ * Use case: argo approves an outside MCP server as a party of its fleet: the
+ * gateway commissions and crews its proxy ship, and keeps the server's
+ * credential in its vault.
+ */
+export declare function createApproveParty(deps: ApprovalDeps): ApproveParty;
+/**
+ * Use case: argo approves an outside MCP client as a party, at its first
+ * authorization: the gateway commissions and crews its proxy ship, which
+ * the client then calls the fleet as. One party per client in a fleet.
+ */
+export declare function createApproveClientParty(deps: ApprovalDeps): ApproveClientParty;
+export {};

package/dist/core/parties/approve-party.js

@@ -0,0 +1,111 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+import { shownPartyOf } from './shown-party.js';
+/** The type of every outside MCP server's proxy ship. */
+export const MCP_SERVER_SHIP_TYPE = 'mcp-server';
+/** The type of every outside MCP client's proxy ship. */
+export const MCP_CLIENT_SHIP_TYPE = 'mcp-client';
+/**
+ * The approval flow every party shares (interop I-5). The gateway, as its
+ * own ship, commissions the party's app proxy ship owned by the owner argo
+ * picked (decisions 0044, 0045), under argo's request id as the idempotency
+ * key, then crews it with its secret and keeps the crew token. Each step is
+ * kept before the next, so the same approval again picks up where a crash or
+ * a fleet that did not answer left it, and commissions no second ship. A
+ * commission the fleet stored but whose answer was lost leaves the ship
+ * awaiting crew: its secret was shown once. A refused commission keeps
+ * nothing, so argo may approve again. While the fleet's outside parties are
+ * off, nothing is approved (interop I-3).
+ */
+async function approved(deps, approval) {
+    const crewed = async (party) => {
+        const registered = await deps.door.register({ shipId: party.proxyShipId, secret: party.secret });
+        if (!registered.isOk) {
+            return refuse('FLEET_UNAVAILABLE', `The fleet did not let the gateway crew the proxy ship: ${registered.error.message}`);
+        }
+        const done = { ...party, state: 'crewed', secret: null, crewToken: registered.value.crewToken };
+        await deps.parties.save(done);
+        return ok(shownPartyOf(done));
+    };
+    const { fleetId } = approval;
+    if (!(await deps.servesOutsideParties(fleetId))) {
+        return refuse('OUTSIDE_PARTIES_OFF', "This fleet's outside parties are off: turn them on first");
+    }
+    const gateway = await deps.connections.find(fleetId);
+    if (!gateway) {
+        return refuse('NOT_CONNECTED', 'The gateway is not connected to this fleet: connect it in the console');
+    }
+    const fresh = approval.party({ approvedAt: deps.clock.now() });
+    const earlier = await deps.parties.find(fleetId, fresh.name);
+    if (earlier && (!approval.isOwn(earlier) || earlier.requestHash !== approval.requestHash)) {
+        return refuse('PARTY_EXISTS', `A party named ${fresh.name} was approved already`);
+    }
+    const party = earlier ?? fresh;
+    if (party.state === 'crewed') {
+        return ok(shownPartyOf(party));
+    }
+    if (party.proxyShipId !== null && party.secret !== null) {
+        return crewed({ ...party, proxyShipId: party.proxyShipId, secret: party.secret });
+    }
+    if (party.proxyShipId !== null) {
+        return ok(shownPartyOf(party));
+    }
+    await deps.parties.save(party);
+    const commissioned = await deps.door.commissionAppShip(gateway.crewToken, { name: party.name, type: approval.type, owner: party.ownerShipId, idempotencyKey: party.requestId, scopes: approval.scopes });
+    if (!commissioned.isOk) {
+        if (commissioned.error.code === 'UNAVAILABLE') {
+            return refuse('FLEET_UNAVAILABLE', `The fleet did not answer the commission: ${commissioned.error.message}`);
+        }
+        await deps.parties.remove(fleetId, party.name);
+        return refuse('COMMISSION_REFUSED', `The fleet refused the proxy ship: ${commissioned.error.message}`);
+    }
+    const { shipId, secret } = commissioned.value;
+    const awaiting = { ...party, state: 'awaitingCrew', proxyShipId: shipId, secret };
+    await deps.parties.save(awaiting);
+    return secret === null ? ok(shownPartyOf(awaiting)) : crewed({ ...awaiting, proxyShipId: shipId, secret });
+}
+/** What a party is before its proxy ship is commissioned. */
+const UNCOMMISSIONED = { state: 'commissioning', proxyShipId: null, secret: null, crewToken: null };
+/**
+ * Use case: argo approves an outside MCP server as a party of its fleet: the
+ * gateway commissions and crews its proxy ship, and keeps the server's
+ * credential in its vault.
+ */
+export function createApproveParty(deps) {
+    return (input) => {
+        const { operatorFleetId: fleetId, requestId, name, url, credential, ownerShipId, scopes, concurrencyLimit } = input;
+        const requestHash = deps.hasher.hash(JSON.stringify([requestId, name, url, credential, ownerShipId, scopes, concurrencyLimit]));
+        return approved(deps, {
+            fleetId,
+            type: MCP_SERVER_SHIP_TYPE,
+            scopes,
+            requestHash,
+            party: ({ approvedAt }) => ({ fleetId, name, kind: 'mcpServer', url, credential, ownerShipId, concurrencyLimit, ...UNCOMMISSIONED, requestId, requestHash, approvedAt }),
+            isOwn: (earlier) => earlier.kind === 'mcpServer',
+        });
+    };
+}
+/**
+ * Use case: argo approves an outside MCP client as a party, at its first
+ * authorization: the gateway commissions and crews its proxy ship, which
+ * the client then calls the fleet as. One party per client in a fleet.
+ */
+export function createApproveClientParty(deps) {
+    return async (input) => {
+        const { operatorFleetId: fleetId, requestId, name, clientId, ownerShipId, scopes } = input;
+        const held = await deps.parties.findByClient(fleetId, clientId);
+        if (held && held.name !== name) {
+            return refuse('CLIENT_HAS_PARTY', `This client is the party ${held.name} already`);
+        }
+        const requestHash = deps.hasher.hash(JSON.stringify([requestId, name, clientId, ownerShipId, scopes]));
+        return approved(deps, {
+            fleetId,
+            type: MCP_CLIENT_SHIP_TYPE,
+            scopes,
+            requestHash,
+            party: ({ approvedAt }) => ({ fleetId, name, kind: 'mcpClient', clientId, ownerShipId, ...UNCOMMISSIONED, requestId, requestHash, approvedAt }),
+            isOwn: (earlier) => earlier.kind === 'mcpClient',
+        });
+    };
+}
+//# sourceMappingURL=approve-party.js.map

package/dist/core/parties/approve-party.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approve-party.js","sourceRoot":"","sources":["../../../src/core/parties/approve-party.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAItD,OAAO,EAAE,YAAY,EAAmB,MAAM,kBAAkB,CAAC;AAEjE,yDAAyD;AACzD,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAEjD,yDAAyD;AACzD,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AA8CjD;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,QAAQ,CAAkB,IAAkB,EAAE,QAAqB;IAChF,MAAM,MAAM,GAAG,KAAK,EAAE,KAAkD,EAAoD,EAAE;QAC5H,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACjG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC,mBAAmB,EAAE,0DAA0D,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3H,CAAC;QACD,MAAM,IAAI,GAAM,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACnG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC;IAEF,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;IAC7B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,qBAAqB,EAAE,0DAA0D,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,eAAe,EAAE,uEAAuE,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7D,IAAI,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1F,OAAO,MAAM,CAAC,cAAc,EAAE,iBAAiB,KAAK,CAAC,IAAI,uBAAuB,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,KAAK,GAAM,OAAO,IAAI,KAAK,CAAC;IAClC,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACxD,OAAO,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAE/B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,cAAc,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACzM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACvB,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAC9C,OAAO,MAAM,CAAC,mBAAmB,EAAE,4CAA4C,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC,oBAAoB,EAAE,qCAAqC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC;IAC9C,MAAM,QAAQ,GAAM,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACrF,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClC,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;AAC7G,CAAC;AAED,6DAA6D;AAC7D,MAAM,cAAc,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAW,CAAC;AAE7G;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAkB;IACnD,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC;QACpH,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;QAChI,OAAO,QAAQ,CAAiB,IAAI,EAAE;YACpC,OAAO;YACP,IAAI,EAAE,oBAAoB;YAC1B,MAAM;YACN,WAAW;YACX,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,GAAG,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;YACxK,KAAK,EAAE,CAAC,OAAO,EAA6B,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW;SAC5E,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAkB;IACzD,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;QAC3F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC,kBAAkB,EAAE,4BAA4B,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACvG,OAAO,QAAQ,CAAiB,IAAI,EAAE;YACpC,OAAO;YACP,IAAI,EAAE,oBAAoB;YAC1B,MAAM;YACN,WAAW;YACX,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;YAC/I,KAAK,EAAE,CAAC,OAAO,EAA6B,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW;SAC5E,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/crew-party.d.ts

@@ -0,0 +1,21 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import { type ShownParty } from './shown-party.js';
+import type { PartyStore, ProxyShipDoor } from './ports.js';
+export type CrewParty = (input: {
+    operatorFleetId: FleetId;
+    name: string;
+    secret: string;
+}) => Promise<Result<ShownParty, DomainError<'NO_SUCH_PARTY' | 'NOT_AWAITING_CREW' | 'SECRET_REFUSED'>>>;
+/**
+ * Use case: argo hands over a new secret for a party's proxy ship that awaits
+ * crew, taken from a new starting prompt in the console: the commission's
+ * answer was lost, and its secret with it, and the gateway's ship may not ask
+ * for a new one (orchestrator-1 on aeolus-fleet#876, Q6). The gateway crews
+ * the ship with it and keeps the crew token; the secret is never kept.
+ */
+export declare function createCrewParty(deps: {
+    parties: PartyStore;
+    door: ProxyShipDoor;
+}): CrewParty;

package/dist/core/parties/crew-party.js

@@ -0,0 +1,29 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+import { shownPartyOf } from './shown-party.js';
+/**
+ * Use case: argo hands over a new secret for a party's proxy ship that awaits
+ * crew, taken from a new starting prompt in the console: the commission's
+ * answer was lost, and its secret with it, and the gateway's ship may not ask
+ * for a new one (orchestrator-1 on aeolus-fleet#876, Q6). The gateway crews
+ * the ship with it and keeps the crew token; the secret is never kept.
+ */
+export function createCrewParty(deps) {
+    return async ({ operatorFleetId, name, secret }) => {
+        const party = await deps.parties.find(operatorFleetId, name);
+        if (!party) {
+            return refuse('NO_SUCH_PARTY', `No party named ${name}`);
+        }
+        if (party.state !== 'awaitingCrew' || party.proxyShipId === null) {
+            return refuse('NOT_AWAITING_CREW', `The proxy ship of ${name} does not await crew`);
+        }
+        const registered = await deps.door.register({ shipId: party.proxyShipId, secret });
+        if (!registered.isOk) {
+            return refuse('SECRET_REFUSED', `The fleet refused the secret: ${registered.error.message}`);
+        }
+        const crewed = { ...party, state: 'crewed', secret: null, crewToken: registered.value.crewToken };
+        await deps.parties.save(crewed);
+        return ok(shownPartyOf(crewed));
+    };
+}
+//# sourceMappingURL=crew-party.js.map

package/dist/core/parties/crew-party.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crew-party.js","sourceRoot":"","sources":["../../../src/core/parties/crew-party.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAmB,MAAM,kBAAkB,CAAC;AAQjE;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAkD;IAChF,OAAO,KAAK,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE;QACjD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;QAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,MAAM,CAAC,eAAe,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,cAAc,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YACjE,OAAO,MAAM,CAAC,mBAAmB,EAAE,qBAAqB,IAAI,sBAAsB,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC,gBAAgB,EAAE,iCAAiC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,MAAM,GAAU,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACzG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChC,OAAO,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/list-parties.d.ts

@@ -0,0 +1,8 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import { type ShownParty } from './shown-party.js';
+import type { PartyStore } from './ports.js';
+export type ListParties = (fleetId: FleetId) => Promise<ShownParty[]>;
+/** Use case: the parties argo approved for its fleet, by name, as argo reads them: never a credential or a crew token. */
+export declare function createListParties(deps: {
+    parties: PartyStore;
+}): ListParties;

package/dist/core/parties/list-parties.js

@@ -0,0 +1,8 @@
+import { shownPartyOf } from './shown-party.js';
+/** Use case: the parties argo approved for its fleet, by name, as argo reads them: never a credential or a crew token. */
+export function createListParties(deps) {
+    return async (fleetId) => (await deps.parties.list(fleetId))
+        .map(shownPartyOf)
+        .sort((left, right) => left.name.localeCompare(right.name));
+}
+//# sourceMappingURL=list-parties.js.map

package/dist/core/parties/list-parties.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-parties.js","sourceRoot":"","sources":["../../../src/core/parties/list-parties.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAmB,MAAM,kBAAkB,CAAC;AAKjE,0HAA0H;AAC1H,MAAM,UAAU,iBAAiB,CAAC,IAA6B;IAC7D,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE,CACvB,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;SAC/B,GAAG,CAAC,YAAY,CAAC;SACjB,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AAClE,CAAC"}

package/dist/core/parties/party.d.ts

@@ -0,0 +1,46 @@
+import type { FleetId, ShipId } from '@aeolus-fleet/common';
+import type { McpServerCredential } from '../vault/credential.js';
+/**
+ * Where an approved party's proxy ship stands (interop I-5):
+ * - commissioning: argo approved it; the gateway has not seen the fleet commission its ship yet;
+ * - awaitingCrew: its ship is commissioned, and the gateway does not hold its crew token;
+ * - crewed: the gateway crews its ship.
+ */
+export type PartyState = 'commissioning' | 'awaitingCrew' | 'crewed';
+/**
+ * What every party has: one app proxy ship (decision 0044), owned by the
+ * person inside who answers for it (0045), crewed by the gateway. Known by
+ * its ship's name, unique in the fleet.
+ */
+interface PartyBase {
+    readonly fleetId: FleetId;
+    readonly name: string;
+    /** The owner argo picked: a person's ship, or argo. */
+    readonly ownerShipId: ShipId;
+    readonly state: PartyState;
+    readonly proxyShipId: ShipId | null;
+    /** The proxy ship's secret, kept only from its commission until the gateway crews it, so a crash between them loses nothing. */
+    readonly secret: string | null;
+    readonly crewToken: string | null;
+    /** argo's request id for the approval: the commission's idempotency key, and how a repeat is told from another approval. */
+    readonly requestId: string;
+    readonly requestHash: string;
+    readonly approvedAt: Date;
+}
+/** An outside MCP server argo approved for its fleet: fleet ships call its tools through its proxy ship (MCP out). */
+export interface McpServerParty extends PartyBase {
+    readonly kind: 'mcpServer';
+    /** The server's Streamable HTTP endpoint. */
+    readonly url: string;
+    readonly credential: McpServerCredential;
+    /** The most calls the gateway has in flight to the server at once. */
+    readonly concurrencyLimit: number;
+}
+/** An outside MCP client argo approved at /authorize: it calls fleet ships as its proxy ship (MCP in). */
+export interface McpClientParty extends PartyBase {
+    readonly kind: 'mcpClient';
+    /** Its OAuth client id: pre-registered, or its metadata document's URL. */
+    readonly clientId: string;
+}
+export type Party = McpServerParty | McpClientParty;
+export {};

package/dist/core/parties/party.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=party.js.map

package/dist/core/parties/party.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"party.js","sourceRoot":"","sources":["../../../src/core/parties/party.ts"],"names":[],"mappings":""}

package/dist/core/parties/ports.d.ts

@@ -0,0 +1,39 @@
+import type { FleetId, ShipId } from '@aeolus-fleet/common';
+import type { FleetRefusal } from '../connection/ports.js';
+import type { Result } from '../shared/result.js';
+import type { Party } from './party.js';
+/** Outbound port: the parties argo approved, one per proxy ship name in a fleet. */
+export interface PartyStore {
+    find(fleetId: FleetId, name: string): Promise<Party | undefined>;
+    list(fleetId: FleetId): Promise<Party[]>;
+    /** The party an MCP client is in the fleet, if argo approved it. */
+    findByClient(fleetId: FleetId, clientId: string): Promise<Party | undefined>;
+    save(party: Party): Promise<void>;
+    remove(fleetId: FleetId, name: string): Promise<void>;
+}
+/** Outbound port: the fleet's calls the gateway makes for a party's proxy ship. */
+export interface ProxyShipDoor {
+    /**
+     * Commissions an app ship as the gateway's ship (fleet:commission and
+     * fleet:on-behalf, decision 0044), owned by the owner argo picked (0045),
+     * with the scopes granted, only ones the gateway's ship holds (0053),
+     * under the gateway's idempotency key: its id, and on the first commission
+     * its secret. A repeat under the same key answers the same ship without one.
+     */
+    commissionAppShip(crewToken: string, ship: {
+        name: string;
+        type: string;
+        owner: ShipId;
+        idempotencyKey: string;
+        scopes: readonly string[];
+    }): Promise<Result<{
+        shipId: ShipId;
+        secret: string | null;
+    }, FleetRefusal>>;
+    register(claim: {
+        shipId: ShipId;
+        secret: string;
+    }): Promise<Result<{
+        crewToken: string;
+    }, FleetRefusal>>;
+}

package/dist/core/parties/ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/core/parties/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../src/core/parties/ports.ts"],"names":[],"mappings":""}

package/dist/core/parties/shown-party.d.ts

@@ -0,0 +1,21 @@
+import type { ShipId } from '@aeolus-fleet/common';
+import type { McpServerCredential } from '../vault/credential.js';
+import type { Party, PartyState } from './party.js';
+interface ShownPartyBase {
+    name: string;
+    ownerShipId: ShipId;
+    state: PartyState;
+    proxyShipId: ShipId | null;
+}
+/** A party as argo reads it: never its credential, secret or crew token. */
+export type ShownParty = (ShownPartyBase & {
+    kind: 'mcpServer';
+    url: string;
+    credentialKind: McpServerCredential['kind'];
+    concurrencyLimit: number;
+}) | (ShownPartyBase & {
+    kind: 'mcpClient';
+    clientId: string;
+});
+export declare function shownPartyOf(party: Party): ShownParty;
+export {};

package/dist/core/parties/shown-party.js

@@ -0,0 +1,10 @@
+export function shownPartyOf(party) {
+    const { name, ownerShipId, state, proxyShipId } = party;
+    switch (party.kind) {
+        case 'mcpServer':
+            return { name, kind: party.kind, url: party.url, credentialKind: party.credential.kind, ownerShipId, concurrencyLimit: party.concurrencyLimit, state, proxyShipId };
+        case 'mcpClient':
+            return { name, kind: party.kind, clientId: party.clientId, ownerShipId, state, proxyShipId };
+    }
+}
+//# sourceMappingURL=shown-party.js.map

package/dist/core/parties/shown-party.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shown-party.js","sourceRoot":"","sources":["../../../src/core/parties/shown-party.ts"],"names":[],"mappings":"AAiBA,MAAM,UAAU,YAAY,CAAC,KAAY;IACvC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC;IACxD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,WAAW;YACd,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QACtK,KAAK,WAAW;YACd,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IACjG,CAAC;AACH,CAAC"}

package/dist/core/people/answer-delivery.d.ts

@@ -0,0 +1,24 @@
+import { type DomainError } from '../shared/errors.js';
+import type { Result } from '../shared/result.js';
+import type { CrewPersonShip } from './crew-person-ship.js';
+import { type Dealt, type DealtError } from './opened-of.js';
+import { type PersonCaller } from './person-crew.js';
+import type { OpenedDeliveries, PersonCrews, PersonShipDoor } from './ports.js';
+export type AnswerDelivery = (input: {
+    caller: PersonCaller;
+    deliveryId: string;
+    contentType: string;
+    payload: string;
+}) => Promise<Result<Dealt, DealtError | DomainError<'SEND_REFUSED'>>>;
+/**
+ * Use case: a person answers a delivery they opened (Q20): a reply to its
+ * sender, in reply to its message, then it is handled. The reply's key is
+ * the delivery's, so an answer tried again after the fleet did not take
+ * handled is sent once.
+ */
+export declare function createAnswerDelivery(deps: {
+    crewPersonShip: CrewPersonShip;
+    crews: PersonCrews;
+    door: PersonShipDoor;
+    opened: OpenedDeliveries;
+}): AnswerDelivery;

package/dist/core/people/answer-delivery.js

@@ -0,0 +1,28 @@
+import { refuse } from '../shared/errors.js';
+import { handledOf, openedOf } from './opened-of.js';
+import { asPersonCrew, withOwnRefusal } from './person-crew.js';
+/**
+ * Use case: a person answers a delivery they opened (Q20): a reply to its
+ * sender, in reply to its message, then it is handled. The reply's key is
+ * the delivery's, so an answer tried again after the fleet did not take
+ * handled is sent once.
+ */
+export function createAnswerDelivery(deps) {
+    return async ({ caller, deliveryId, contentType, payload }) => {
+        const opened = await openedOf(deps, { caller, deliveryId });
+        if (!opened.isOk) {
+            return opened;
+        }
+        const delivery = opened.value;
+        const reply = { to: delivery.senderShipId, inReplyTo: delivery.messageId, contentType, payload, idempotencyKey: `answer-${delivery.deliveryId}` };
+        const sent = await asPersonCrew(deps, { caller, run: (crew) => withOwnRefusal(deps.door.reply(crew.crewToken, reply)) });
+        if (!sent.isOk) {
+            return sent;
+        }
+        if (!sent.value.value.isOk) {
+            return refuse('SEND_REFUSED', `The fleet did not take your answer: ${sent.value.value.error.message}`);
+        }
+        return handledOf(deps, { caller, delivery });
+    };
+}
+//# sourceMappingURL=answer-delivery.js.map

package/dist/core/people/answer-delivery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"answer-delivery.js","sourceRoot":"","sources":["../../../src/core/people/answer-delivery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAG/D,OAAO,EAAE,SAAS,EAAE,QAAQ,EAA+B,MAAM,gBAAgB,CAAC;AAClF,OAAO,EAAE,YAAY,EAAE,cAAc,EAAqB,MAAM,kBAAkB,CAAC;AAKnF;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAA4G;IAC/I,OAAO,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE;QAC5D,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC;QAC9B,MAAM,KAAK,GAAG,EAAE,EAAE,EAAE,QAAQ,CAAC,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC;QAClJ,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACzH,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC,cAAc,EAAE,uCAAuC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,OAAO,SAAS,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/people/crew-person-ship.d.ts

@@ -0,0 +1,42 @@
+import type { FleetId, ShipId } from '@aeolus-fleet/common';
+import type { ConnectionStore, FleetDoor } from '../connection/ports.js';
+import type { Clock } from '../shared/clock.js';
+import { type Result } from '../shared/result.js';
+import type { AccountTokenOf, AccountTokenRefusal } from '../sign-in/account-token.js';
+import type { AccountDoor, PersonCrews } from './ports.js';
+/**
+ * Why the gateway has no crew for the person's ship, beside why it has no account token:
+ * - noPersonShip: the account has none in the fleet, as it may not message there (decision 0052);
+ * - notConnected: the gateway holds no crew token for its own ship in the fleet;
+ * - fleetRefused: the fleet refused a call, for the reason given.
+ */
+export type CrewPersonShipRefusal = AccountTokenRefusal | {
+    readonly kind: 'noPersonShip';
+} | {
+    readonly kind: 'notConnected';
+} | {
+    readonly kind: 'fleetRefused';
+    readonly message: string;
+};
+export type CrewPersonShip = (grant: {
+    fleetId: FleetId;
+    grantId: string;
+}) => Promise<Result<{
+    shipId: ShipId;
+    crewToken: string;
+}, CrewPersonShipRefusal>>;
+/**
+ * Use case: the crew of a signed-in person's person ship (decisions 0054,
+ * 0057). The gateway crews it once and every client of the person shares
+ * that crew, as a ship has one crew at a time (decision 0010). To crew it,
+ * the gateway acts as the account, with its token beside the gateway's crew
+ * token: it gets the ship's starting prompt, releasing the ship first when a
+ * crew the gateway does not hold has it, and registers with its secret.
+ */
+export declare function createCrewPersonShip(deps: {
+    accountTokenOf: AccountTokenOf;
+    connections: ConnectionStore;
+    door: AccountDoor & Pick<FleetDoor, 'register'>;
+    crews: PersonCrews;
+    clock: Clock;
+}): CrewPersonShip;

package/dist/core/people/crew-person-ship.js

@@ -0,0 +1,59 @@
+import { err, ok } from '../shared/result.js';
+/** The fleet's code for a ship that is crewed already: a starting prompt waits for its release. */
+const SHIP_CREWED = 'CONFLICT';
+/**
+ * Use case: the crew of a signed-in person's person ship (decisions 0054,
+ * 0057). The gateway crews it once and every client of the person shares
+ * that crew, as a ship has one crew at a time (decision 0010). To crew it,
+ * the gateway acts as the account, with its token beside the gateway's crew
+ * token: it gets the ship's starting prompt, releasing the ship first when a
+ * crew the gateway does not hold has it, and registers with its secret.
+ */
+export function createCrewPersonShip(deps) {
+    const crewing = new Map();
+    const crew = async (call) => {
+        const { fleetId, shipId, accountToken } = call;
+        const gateway = await deps.connections.find(fleetId);
+        if (gateway === undefined) {
+            return err({ kind: 'notConnected' });
+        }
+        const asAccount = { crewToken: gateway.crewToken, accountToken, shipId };
+        let prompt = await deps.door.startingPrompt(asAccount);
+        if (!prompt.isOk && prompt.error.code === SHIP_CREWED) {
+            const released = await deps.door.release(asAccount);
+            if (!released.isOk) {
+                return err({ kind: 'fleetRefused', message: released.error.message });
+            }
+            prompt = await deps.door.startingPrompt(asAccount);
+        }
+        if (!prompt.isOk) {
+            return err({ kind: 'fleetRefused', message: prompt.error.message });
+        }
+        const registered = await deps.door.register({ shipId, secret: prompt.value.secret });
+        if (!registered.isOk) {
+            return err({ kind: 'fleetRefused', message: registered.error.message });
+        }
+        await deps.crews.save({ fleetId, shipId, crewToken: registered.value.crewToken, crewedAt: deps.clock.now() });
+        return ok({ crewToken: registered.value.crewToken });
+    };
+    return async (grant) => {
+        const token = await deps.accountTokenOf(grant);
+        if (!token.isOk) {
+            return token;
+        }
+        const { accountToken, personShipId: shipId } = token.value;
+        if (shipId === null) {
+            return err({ kind: 'noPersonShip' });
+        }
+        const held = await deps.crews.find(grant.fleetId, shipId);
+        if (held !== undefined) {
+            return ok({ shipId, crewToken: held.crewToken });
+        }
+        const key = `${grant.fleetId}/${shipId}`;
+        const answer = crewing.get(key) ?? crew({ fleetId: grant.fleetId, shipId, accountToken }).finally(() => crewing.delete(key));
+        crewing.set(key, answer);
+        const crewed = await answer;
+        return crewed.isOk ? ok({ shipId, crewToken: crewed.value.crewToken }) : crewed;
+    };
+}
+//# sourceMappingURL=crew-person-ship.js.map