@aeolus-fleet/gateway 0.0.0-stage → 0.0.0

package/dist/core/sign-in/complete-sign-in.d.ts

@@ -0,0 +1,55 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { AuthorizationCodes, OAuthSecrets } from '../oauth/ports.js';
+import type { AuthorizationRefusal, ReadAuthorization } from '../oauth/read-authorization.js';
+import type { AskForClient, ClientAnswer } from '../requests/ask-for-client.js';
+import type { Clock } from '../shared/clock.js';
+import { type Result } from '../shared/result.js';
+import type { AccountGrants, Pagasae, SignInSeals } from './ports.js';
+/**
+ * Why a sign-in gave the client no code, beside the request's own refusals:
+ * - unknownSignIn: the gateway sealed no sign-in into this state, or its 10 minutes passed;
+ * - otherBrowser: the browser that came back does not hold the sign-in's secret, as when another site makes it finish its own;
+ * - pagasaeRefused: pagasae did not redeem its code, for the reason given;
+ * - fleetNotServed: the account's fleet is one this gateway does not serve;
+ * - outsidePartiesOff: the person asked for access for the client while the fleet's outside parties are off (interop I-3).
+ */
+export type SignInRefusal = AuthorizationRefusal | {
+    readonly kind: 'unknownSignIn';
+} | {
+    readonly kind: 'otherBrowser';
+} | {
+    readonly kind: 'pagasaeRefused';
+    readonly message: string;
+} | {
+    readonly kind: 'fleetNotServed';
+} | {
+    readonly kind: 'outsidePartiesOff';
+};
+export type CompleteSignIn = (back: {
+    state?: string | undefined;
+    code?: string | undefined;
+    error?: string | undefined;
+    browserSecret?: string | undefined;
+}) => Promise<Result<ClientAnswer, SignInRefusal>>;
+/**
+ * Use case: pagasae sends the person back. Their sign-in is opened from its
+ * state, the client's request read again, and pagasae's code redeemed with
+ * the gateway's verifier; pagasae takes a code once. Then, as the person
+ * picked: the account's grant is kept, and the client is sent back with the
+ * gateway's own code for it, acting in the fleet as the account with no
+ * approval (orchestrator-1, slice 7 Q1); or the account asks for access for
+ * the client, as an outside party (decision 0056).
+ */
+export declare function createCompleteSignIn(deps: {
+    readAuthorization: ReadAuthorization;
+    seals: SignInSeals;
+    pagasae: Pagasae;
+    grants: AccountGrants;
+    codes: AuthorizationCodes;
+    secrets: OAuthSecrets;
+    clock: Clock;
+    issuer: string;
+    /** Whether the gateway serves the fleet: connected to it, and switched on where an installation switches fleets (decision 0021). */
+    servesFleet: (fleetId: FleetId) => Promise<boolean>;
+    askForClient: AskForClient;
+}): CompleteSignIn;

package/dist/core/sign-in/complete-sign-in.js

@@ -0,0 +1,50 @@
+import { issueCode, redirectWith } from '../oauth/issue-code.js';
+import { err, ok } from '../shared/result.js';
+/**
+ * Use case: pagasae sends the person back. Their sign-in is opened from its
+ * state, the client's request read again, and pagasae's code redeemed with
+ * the gateway's verifier; pagasae takes a code once. Then, as the person
+ * picked: the account's grant is kept, and the client is sent back with the
+ * gateway's own code for it, acting in the fleet as the account with no
+ * approval (orchestrator-1, slice 7 Q1); or the account asks for access for
+ * the client, as an outside party (decision 0056).
+ */
+export function createCompleteSignIn(deps) {
+    return async ({ state, code, error, browserSecret }) => {
+        const signIn = state === undefined ? undefined : deps.seals.open(state);
+        if (signIn === undefined || signIn.expiresAt.getTime() <= deps.clock.now().getTime()) {
+            return err({ kind: 'unknownSignIn' });
+        }
+        if (browserSecret !== signIn.browserSecret) {
+            return err({ kind: 'otherBrowser' });
+        }
+        const read = await deps.readAuthorization(signIn.request);
+        if (!read.isOk) {
+            return read;
+        }
+        const authorization = read.value;
+        if (error !== undefined || code === undefined) {
+            return ok({ kind: 'answered', redirectTo: redirectWith(authorization.redirectUri, { error: 'access_denied', state: authorization.state, iss: deps.issuer }) });
+        }
+        const redeemed = await deps.pagasae.redeemCode({ code, verifier: signIn.verifier });
+        if (!redeemed.isOk) {
+            return err({ kind: 'pagasaeRefused', message: redeemed.error.reason });
+        }
+        const tokens = redeemed.value;
+        if (!(await deps.servesFleet(tokens.fleetId))) {
+            return err({ kind: 'fleetNotServed' });
+        }
+        if (authorization.clientFleetId !== null && authorization.clientFleetId !== tokens.fleetId) {
+            return err({ kind: 'invalidClient', message: `${authorization.clientName} is registered for another fleet` });
+        }
+        const { fleetId, accountId, personShipId, refreshToken, accountToken, accountTokenExpiresAt } = tokens;
+        if (signIn.holder === 'party') {
+            const asked = await deps.askForClient({ fleetId, requester: { accountId, personShipId }, authorization, request: signIn.request, browserSecret: signIn.browserSecret });
+            return asked.isOk ? asked : err({ kind: 'outsidePartiesOff' });
+        }
+        const grantId = deps.secrets.newSecret();
+        await deps.grants.save({ grantId, fleetId, accountId, personShipId, refreshToken, accountToken, accountTokenExpiresAt });
+        return ok({ kind: 'answered', redirectTo: await issueCode(deps, { fleetId, authorization, holder: { kind: 'account', grantId } }) });
+    };
+}
+//# sourceMappingURL=complete-sign-in.js.map

package/dist/core/sign-in/complete-sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"complete-sign-in.js","sourceRoot":"","sources":["../../../src/core/sign-in/complete-sign-in.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAKjE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAe3D;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAYpC;IACC,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE;QACrD,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YACrF,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,aAAa,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;YAC3C,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC;QACjC,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9C,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACjK,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC9C,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,aAAa,CAAC,aAAa,KAAK,IAAI,IAAI,aAAa,CAAC,aAAa,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;YAC3F,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,UAAU,kCAAkC,EAAE,CAAC,CAAC;QAChH,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,GAAG,MAAM,CAAC;QACvG,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;YACxK,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACzH,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACvI,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/sign-in/end-sign-ins.d.ts

@@ -0,0 +1,19 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { IssuedTokens } from '../oauth/ports.js';
+import type { AccountGrants } from './ports.js';
+export type EndSignIns = (account: {
+    fleetId: FleetId;
+    accountId: string;
+}) => Promise<void>;
+/**
+ * Use case: pagasae disabled the account and tells the gateway, which ends
+ * its gateway tokens there (decision 0055): every sign-in of the account in
+ * the fleet ends, and its clients' tokens are revoked, so each client is
+ * refused at its next call. pagasae refuses the account a new sign-in. A
+ * grant is ended before its tokens are revoked, as when pagasae refuses a
+ * refresh: a call with a token whose grant is gone is signed out already.
+ */
+export declare function createEndSignIns(deps: {
+    grants: AccountGrants;
+    tokens: IssuedTokens;
+}): EndSignIns;

package/dist/core/sign-in/end-sign-ins.js

@@ -0,0 +1,17 @@
+/**
+ * Use case: pagasae disabled the account and tells the gateway, which ends
+ * its gateway tokens there (decision 0055): every sign-in of the account in
+ * the fleet ends, and its clients' tokens are revoked, so each client is
+ * refused at its next call. pagasae refuses the account a new sign-in. A
+ * grant is ended before its tokens are revoked, as when pagasae refuses a
+ * refresh: a call with a token whose grant is gone is signed out already.
+ */
+export function createEndSignIns(deps) {
+    return async ({ fleetId, accountId }) => {
+        for (const { grantId } of await deps.grants.ofAccount(fleetId, accountId)) {
+            await deps.grants.end(fleetId, grantId);
+            await deps.tokens.revokeGrant(fleetId, grantId);
+        }
+    };
+}
+//# sourceMappingURL=end-sign-ins.js.map

package/dist/core/sign-in/end-sign-ins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"end-sign-ins.js","sourceRoot":"","sources":["../../../src/core/sign-in/end-sign-ins.ts"],"names":[],"mappings":"AAOA;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAqD;IACpF,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE;QACtC,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACxC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/sign-in/ports.d.ts

@@ -0,0 +1,85 @@
+/**
+ * A person signs in to the gateway through pagasae, the one identity
+ * provider (decision 0054): the gateway is its OpenID Connect client, and
+ * the person acts in the fleet as their account, by its account token.
+ */
+import type { FleetId, ShipId } from '@aeolus-fleet/common';
+import type { Result } from '../shared/result.js';
+/** A person's sign-in at pagasae under way: the client's authorization request, with the gateway's PKCE verifier. */
+export interface PendingSignIn {
+    readonly verifier: string;
+    /** The secret the browser that started the sign-in holds, so no other browser finishes it (login CSRF). */
+    readonly browserSecret: string;
+    readonly request: Readonly<Record<string, string | undefined>>;
+    /** What the person picked the client to act as: their account, or a party they ask access for (Q1 a). */
+    readonly holder: SignInHolder;
+    readonly expiresAt: Date;
+}
+/** What a client acts as once its person signed in: the account itself, or an outside party (decision 0056). */
+export type SignInHolder = 'account' | 'party';
+/**
+ * Outbound port: seals a sign-in under way into the state pagasae carries
+ * back, so the gateway stores nothing before it knows the fleet, and the
+ * verifier stays secret on the way.
+ */
+export interface SignInSeals {
+    seal(signIn: PendingSignIn): string;
+    /** The sign-in a state seals; none for a state the gateway did not seal. */
+    open(state: string): PendingSignIn | undefined;
+}
+/** What pagasae answers for a redeemed code: the account token, what it names, and the refresh token behind it. */
+export interface PagasaeTokens {
+    readonly accountToken: string;
+    readonly accountTokenExpiresAt: Date;
+    readonly refreshToken: string;
+    /** The fleet pagasae signed the account token for: the one the person picked, or their only one. */
+    readonly fleetId: FleetId;
+    readonly accountId: string;
+    /** The account's person ship in the fleet, if it has one (decision 0052). */
+    readonly personShipId: ShipId | null;
+}
+/** Outbound port: pagasae, where the gateway sends a person to sign in, and redeems the code they come back with. */
+export interface Pagasae {
+    /** pagasae's authorize address for the gateway, with the state and the PKCE challenge, naming no fleet. */
+    authorizeUrl(signIn: {
+        state: string;
+        codeChallenge: string;
+    }): string;
+    redeemCode(code: {
+        code: string;
+        verifier: string;
+    }): Promise<Result<PagasaeTokens, {
+        reason: string;
+    }>>;
+    /**
+     * New tokens for a refresh token, which pagasae replaces on use: refused
+     * when pagasae ended the grant (disabled, signed out, no right left, the
+     * token used twice), unavailable when it did not answer.
+     */
+    refresh(refreshToken: string): Promise<Result<PagasaeTokens, {
+        kind: 'refused' | 'unavailable';
+        reason: string;
+    }>>;
+}
+/** A person's sign-in kept for their MCP client: the account in the fleet, and pagasae's tokens to act as it. */
+export interface AccountGrant {
+    readonly grantId: string;
+    readonly fleetId: FleetId;
+    readonly accountId: string;
+    readonly personShipId: ShipId | null;
+    readonly refreshToken: string;
+    readonly accountToken: string;
+    readonly accountTokenExpiresAt: Date;
+}
+export interface AccountGrants {
+    save(grant: AccountGrant): Promise<void>;
+    find(fleetId: FleetId, grantId: string): Promise<AccountGrant | undefined>;
+    /** Every grant of the account in the fleet: one per client it signed in from. */
+    ofAccount(fleetId: FleetId, accountId: string): Promise<readonly AccountGrant[]>;
+    /** Keeps pagasae's new tokens for the grant, and the person ship they name. */
+    renew(grant: {
+        fleetId: FleetId;
+        grantId: string;
+    }, tokens: Partial<Pick<AccountGrant, 'refreshToken' | 'accountToken' | 'accountTokenExpiresAt' | 'personShipId'>>): Promise<void>;
+    end(fleetId: FleetId, grantId: string): Promise<void>;
+}

package/dist/core/sign-in/ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/core/sign-in/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../src/core/sign-in/ports.ts"],"names":[],"mappings":""}

package/dist/core/sign-in/start-sign-in.d.ts

@@ -0,0 +1,30 @@
+import type { OAuthSecrets } from '../oauth/ports.js';
+import type { AuthorizationRefusal, ReadAuthorization } from '../oauth/read-authorization.js';
+import type { Clock } from '../shared/clock.js';
+import { type Result } from '../shared/result.js';
+import type { Pagasae, SignInHolder, SignInSeals } from './ports.js';
+/** How long a person has to sign in at pagasae and come back. */
+export declare const SIGN_IN_LIFETIME_MS: number;
+export type StartSignIn = (picked: {
+    request: Readonly<Record<string, string | undefined>>;
+    holder: SignInHolder;
+}) => Promise<Result<{
+    redirectTo: string;
+    browserSecret: string;
+}, AuthorizationRefusal>>;
+/**
+ * Use case: a person comes to /authorize from their MCP client (Q25) and
+ * picks what it acts as: their account, or a party they ask access for (Q1
+ * a). The client's request is read, then sealed, with that pick, with the
+ * gateway's own PKCE verifier into the state, and the person is sent to
+ * pagasae naming no fleet, so pagasae answers their only fleet or asks
+ * which (decision 0054). The browser is given a secret of its own, sealed
+ * too, so only it finishes the sign-in.
+ */
+export declare function createStartSignIn(deps: {
+    readAuthorization: ReadAuthorization;
+    seals: SignInSeals;
+    pagasae: Pagasae;
+    secrets: OAuthSecrets;
+    clock: Clock;
+}): StartSignIn;

package/dist/core/sign-in/start-sign-in.js

@@ -0,0 +1,25 @@
+import { ok } from '../shared/result.js';
+/** How long a person has to sign in at pagasae and come back. */
+export const SIGN_IN_LIFETIME_MS = 10 * 60_000;
+/**
+ * Use case: a person comes to /authorize from their MCP client (Q25) and
+ * picks what it acts as: their account, or a party they ask access for (Q1
+ * a). The client's request is read, then sealed, with that pick, with the
+ * gateway's own PKCE verifier into the state, and the person is sent to
+ * pagasae naming no fleet, so pagasae answers their only fleet or asks
+ * which (decision 0054). The browser is given a secret of its own, sealed
+ * too, so only it finishes the sign-in.
+ */
+export function createStartSignIn(deps) {
+    return async ({ request, holder }) => {
+        const read = await deps.readAuthorization(request);
+        if (!read.isOk) {
+            return read;
+        }
+        const verifier = deps.secrets.newSecret();
+        const browserSecret = deps.secrets.newSecret();
+        const state = deps.seals.seal({ verifier, browserSecret, request, holder, expiresAt: new Date(deps.clock.now().getTime() + SIGN_IN_LIFETIME_MS) });
+        return ok({ redirectTo: deps.pagasae.authorizeUrl({ state, codeChallenge: deps.secrets.challengeOf(verifier) }), browserSecret });
+    };
+}
+//# sourceMappingURL=start-sign-in.js.map

package/dist/core/sign-in/start-sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"start-sign-in.js","sourceRoot":"","sources":["../../../src/core/sign-in/start-sign-in.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAGtD,iEAAiE;AACjE,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,MAAM,CAAC;AAI/C;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAyH;IACzJ,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;QACnC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;QACnJ,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;IACpI,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/vault/credential.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The credential the gateway calls an outside MCP server with, kept in the
+ * vault, the gateway's own database (as squadrons keeps crew tokens). The
+ * server sees the gateway's credential, never the asker's: no rights travel
+ * with a message.
+ */
+export type McpServerCredential = {
+    readonly kind: 'bearer';
+    readonly token: string;
+} | {
+    readonly kind: 'clientCredentials';
+    readonly clientId: string;
+    readonly clientSecret: string;
+    /** The authorization server's issuer: the credential goes to no other. */
+    readonly issuer: string;
+    /** The OAuth scope to ask the authorization server for, if the server needs one. */
+    readonly scope?: string;
+};

package/dist/core/vault/credential.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=credential.js.map

package/dist/core/vault/credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.js","sourceRoot":"","sources":["../../../src/core/vault/credential.ts"],"names":[],"mappings":""}

package/dist/outcome-worker.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The gateway's round of request outcomes (decision 0056): each round
+ * expires the requests due, tells the outcomes still to tell, and asks the
+ * gateway's owner about new requests and withdraws the questions whose
+ * request ended. Rounds
+ * run one at a time, every interval, and at once when a request is decided;
+ * a round asked for while one runs runs right after it.
+ */
+import type { FastifyBaseLogger } from 'fastify';
+import type { Sleep } from './core/mcp-out/run-party.js';
+import type { AskOwners } from './core/requests/ask-owners.js';
+import type { ExpireRequests } from './core/requests/expire-requests.js';
+import type { TellOutcomes } from './core/requests/tell-outcomes.js';
+export interface OutcomeWorker {
+    /** Runs a round every interval until it stops. */
+    start(): void;
+    /** Runs a round now, as when a request was opened or decided. */
+    tellNow(): void;
+    /** Stops, once the round under way ended. */
+    stop(): Promise<void>;
+}
+export declare function createOutcomeWorker(deps: {
+    expireRequests: ExpireRequests;
+    tellOutcomes: TellOutcomes;
+    askOwners: AskOwners;
+    sleep: Sleep;
+    intervalMs: number;
+    log: FastifyBaseLogger;
+}): OutcomeWorker;

package/dist/outcome-worker.js

@@ -0,0 +1,60 @@
+export function createOutcomeWorker(deps) {
+    const stopping = new AbortController();
+    let running = Promise.resolve();
+    /** Whether a round runs, and how many were asked for since it started. */
+    const rounds = { isRunning: false, asked: 0 };
+    const round = async () => {
+        try {
+            const expired = await deps.expireRequests();
+            const { told, kept, refused } = await deps.tellOutcomes();
+            if (refused > 0) {
+                deps.log.warn({ refused }, "the fleet refused some request outcomes: their people see them on the gateway's page");
+            }
+            if (expired + told + kept > 0) {
+                deps.log.info({ expired, told, kept }, 'request outcomes');
+            }
+            const questions = await deps.askOwners();
+            if (questions.refused > 0) {
+                deps.log.warn({ refused: questions.refused }, "the fleet refused some questions to the gateway's owner");
+            }
+        }
+        catch (error) {
+            deps.log.error({ err: error }, 'request outcomes round failed');
+        }
+    };
+    const runRound = () => {
+        rounds.asked += 1;
+        if (rounds.isRunning) {
+            return;
+        }
+        rounds.isRunning = true;
+        running = (async () => {
+            while (rounds.asked > 0 && !stopping.signal.aborted) {
+                rounds.asked = 0;
+                await round();
+            }
+            rounds.isRunning = false;
+        })();
+    };
+    return {
+        start: () => {
+            void (async () => {
+                while (!stopping.signal.aborted) {
+                    runRound();
+                    await running;
+                    await deps.sleep(deps.intervalMs, stopping.signal);
+                }
+            })();
+        },
+        tellNow: () => {
+            if (!stopping.signal.aborted) {
+                runRound();
+            }
+        },
+        stop: async () => {
+            stopping.abort();
+            await running;
+        },
+    };
+}
+//# sourceMappingURL=outcome-worker.js.map

package/dist/outcome-worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outcome-worker.js","sourceRoot":"","sources":["../src/outcome-worker.ts"],"names":[],"mappings":"AAwBA,MAAM,UAAU,mBAAmB,CAAC,IAAoJ;IACtL,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAC;IACvC,IAAI,OAAO,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;IAC/C,0EAA0E;IAC1E,MAAM,MAAM,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAE9C,MAAM,KAAK,GAAG,KAAK,IAAmB,EAAE;QACtC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YAC5C,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAC1D,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;gBAChB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,sFAAsF,CAAC,CAAC;YACrH,CAAC;YACD,IAAI,OAAO,GAAG,IAAI,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC;gBAC9B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;YACzC,IAAI,SAAS,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;gBAC1B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,EAAE,yDAAyD,CAAC,CAAC;YAC3G,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,+BAA+B,CAAC,CAAC;QAClE,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,GAAS,EAAE;QAC1B,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;QAClB,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO;QACT,CAAC;QACD,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;QACxB,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YACpB,OAAO,MAAM,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpD,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC;gBACjB,MAAM,KAAK,EAAE,CAAC;YAChB,CAAC;YACD,MAAM,CAAC,SAAS,GAAG,KAAK,CAAC;QAC3B,CAAC,CAAC,EAAE,CAAC;IACP,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,GAAG,EAAE;YACV,KAAK,CAAC,KAAK,IAAI,EAAE;gBACf,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;oBAChC,QAAQ,EAAE,CAAC;oBACX,MAAM,OAAO,CAAC;oBACd,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QACD,OAAO,EAAE,GAAG,EAAE;YACZ,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC7B,QAAQ,EAAE,CAAC;YACb,CAAC;QACH,CAAC;QACD,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,MAAM,OAAO,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/party-workers.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The gateway's workers, one per crewed party, each until the gateway stops
+ * or the fleet refuses its crew token: an outside server's states its proxy
+ * ship, then takes its calls (interop 5.2); an outside client's takes the
+ * replies to its calls (Q9 a). A fleet's workers work only while its outside
+ * parties are on (interop I-3).
+ */
+import type { FleetId } from '@aeolus-fleet/common';
+import type { FastifyBaseLogger } from 'fastify';
+import type { CollectReplies } from './core/mcp-in/collect-replies.js';
+import type { RunParty } from './core/mcp-out/run-party.js';
+import type { StateParty } from './core/mcp-out/state-party.js';
+import type { PartyStore } from './core/parties/ports.js';
+export interface PartyWorkers {
+    /** Starts the party's worker, unless it is not crewed or its worker runs already. */
+    start(party: {
+        fleetId: FleetId;
+        name: string;
+    }): Promise<void>;
+    /** Stops the fleet's workers, once their calls in flight ended, as when its outside parties go off. */
+    stopFleet(fleetId: FleetId): Promise<void>;
+    /** Stops every worker, once its calls in flight ended. */
+    stop(): Promise<void>;
+}
+export declare function createPartyWorkers(deps: {
+    parties: PartyStore;
+    stateParty: StateParty;
+    runParty: RunParty;
+    collectReplies: CollectReplies;
+    servesOutsideParties: (fleetId: FleetId) => Promise<boolean>;
+    log: FastifyBaseLogger;
+}): PartyWorkers;

package/dist/party-workers.js

@@ -0,0 +1,57 @@
+export function createPartyWorkers(deps) {
+    const stop = new AbortController();
+    /** Each running worker, by fleet and party, with what stops it. */
+    const running = new Map();
+    const work = async ({ fleetId, name }, signal) => {
+        if (!(await deps.servesOutsideParties(fleetId))) {
+            return;
+        }
+        const party = await deps.parties.find(fleetId, name);
+        if (party?.state !== 'crewed' || signal.aborted) {
+            return;
+        }
+        if (party.kind === 'mcpClient') {
+            const { ended } = await deps.collectReplies({ party, signal });
+            if (ended === 'crewRefused') {
+                deps.log.warn({ fleetId, party: name }, "the fleet refused the proxy ship's crew token: its calls get no replies");
+            }
+            return;
+        }
+        const stated = await deps.stateParty({ fleetId, name });
+        if (!stated.isOk) {
+            // Its calls are taken all the same; the next statement states it.
+            deps.log.warn({ fleetId, party: name, reason: stated.error.message }, 'proxy ship not stated');
+        }
+        const { ended } = await deps.runParty({ party, signal });
+        if (ended === 'crewRefused') {
+            deps.log.warn({ fleetId, party: name }, 'the fleet refused the proxy ship\'s crew token: its calls are not taken');
+        }
+    };
+    return {
+        start: (party) => {
+            const key = JSON.stringify([party.fleetId, party.name]);
+            if (!running.has(key) && !stop.signal.aborted) {
+                const stopFleet = new AbortController();
+                const done = work(party, AbortSignal.any([stop.signal, stopFleet.signal]))
+                    .catch((error) => {
+                    deps.log.error({ err: error, fleetId: party.fleetId, party: party.name }, 'party worker failed');
+                })
+                    .finally(() => running.delete(key));
+                running.set(key, { fleetId: party.fleetId, done, stopFleet });
+            }
+            return Promise.resolve();
+        },
+        stopFleet: async (fleetId) => {
+            const fleetWorkers = [...running.values()].filter((worker) => worker.fleetId === fleetId);
+            for (const worker of fleetWorkers) {
+                worker.stopFleet.abort();
+            }
+            await Promise.all(fleetWorkers.map((worker) => worker.done));
+        },
+        stop: async () => {
+            stop.abort();
+            await Promise.all([...running.values()].map((worker) => worker.done));
+        },
+    };
+}
+//# sourceMappingURL=party-workers.js.map

package/dist/party-workers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"party-workers.js","sourceRoot":"","sources":["../src/party-workers.ts"],"names":[],"mappings":"AAwBA,MAAM,UAAU,kBAAkB,CAAC,IAOlC;IACC,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,mEAAmE;IACnE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAiF,CAAC;IAEzG,MAAM,IAAI,GAAG,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAsC,EAAE,MAAmB,EAAiB,EAAE;QAC/G,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAChD,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,IAAI,KAAK,EAAE,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YAChD,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/B,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;YAC/D,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;gBAC5B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,yEAAyE,CAAC,CAAC;YACrH,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,kEAAkE;YAClE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,uBAAuB,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACzD,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;YAC5B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,yEAAyE,CAAC,CAAC;QACrH,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE;YACf,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YACxD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9C,MAAM,SAAS,GAAG,IAAI,eAAe,EAAE,CAAC;gBACxC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;qBACvE,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;oBACxB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,qBAAqB,CAAC,CAAC;gBACnG,CAAC,CAAC;qBACD,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBACtC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC3B,CAAC;QACD,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YAC3B,MAAM,YAAY,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;YAC1F,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;gBAClC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAC3B,CAAC;YACD,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,IAAI,CAAC,KAAK,EAAE,CAAC;YACb,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,72 @@
 {
   "name": "@aeolus-fleet/gateway",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.0.0",
+  "description": "Aeolus gateway: outside MCP servers and clients join a fleet as ships, through one gateway beside core.",
+  "keywords": [
+    "ai-agents",
+    "mcp",
+    "model-context-protocol",
+    "gateway"
+  ],
+  "license": "Apache-2.0",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ThomasHendrickx/aeolus-fleet-gateway.git"
+  },
+  "packageManager": "npm@11.19.1",
+  "engines": {
+    "node": ">=26"
+  },
+  "bin": {
+    "aeolus-gateway": "dist/bin/aeolus-gateway.js"
+  },
+  "files": [
+    "dist",
+    "prisma.config.ts",
+    "src/adapters/prisma/schema.prisma",
+    "src/adapters/prisma/migrations"
+  ],
+  "scripts": {
+    "postinstall": "prisma generate",
+    "generate": "prisma generate",
+    "build": "tsc --project tsconfig.build.json",
+    "typecheck": "tsc --project tsconfig.json",
+    "lint": "eslint --max-warnings 0 .",
+    "test": "vitest run",
+    "test:unit": "vitest run --project '*:unit'",
+    "test:integration": "vitest run --project '*:integration'",
+    "start": "node dist/bin/aeolus-gateway.js start",
+    "db:migrate": "tsx --env-file-if-exists=.env src/bin/aeolus-gateway.ts migrate"
+  },
+  "dependencies": {
+    "@aeolus-fleet/common": "^0.27.0",
+    "@fastify/websocket": "^11.3.4",
+    "@modelcontextprotocol/client": "^2.3.1",
+    "@modelcontextprotocol/server": "^2.3.1",
+    "@prisma/adapter-pg": "^7.10.1",
+    "@prisma/client": "^7.10.1",
+    "@trpc/server": "^11.19.0",
+    "fastify": "^5.12.7",
+    "pg": "^8.23.1",
+    "prisma": "^7.10.1",
+    "zod": "^4.6.5"
+  },
+  "devDependencies": {
+    "@aeolus-fleet/core": "0.27.0",
+    "@eslint/js": "^10.0.1",
+    "@modelcontextprotocol/ext-tasks": "0.2.2",
+    "@testcontainers/postgresql": "^12.2.0",
+    "@types/node": "^26.6.3",
+    "@types/pg": "^8.23.1",
+    "@types/ws": "^8.18.2",
+    "eslint": "^10.11.0",
+    "eslint-plugin-check-file": "^3.3.2",
+    "testcontainers": "^12.2.0",
+    "tsx": "^4.23.15",
+    "typescript": "~6.0.3",
+    "typescript-eslint": "^8.71.0",
+    "vitest": "^5.0.3",
+    "ws": "^8.22.0"
+  }
+}

package/prisma.config.ts

@@ -0,0 +1,18 @@
+import { existsSync } from 'node:fs';
+
+import { defineConfig } from 'prisma/config';
+
+if (existsSync('.env')) {
+  process.loadEnvFile('.env');
+}
+
+export default defineConfig({
+  schema: 'src/adapters/prisma/schema.prisma',
+  migrations: {
+    path: 'src/adapters/prisma/migrations',
+  },
+  datasource: {
+    // Only migrate commands need the URL; `prisma generate` runs without one.
+    url: process.env.DATABASE_URL,
+  },
+});