@aeolus-fleet/gateway 0.0.0-stage → 0.28.0

package/dist/config.js

@@ -0,0 +1,65 @@
+import { z } from 'zod';
+/** The shortest installation token the gateway takes, as the server does (decision 0020). */
+const INSTALLATION_TOKEN_MIN_LENGTH = 32;
+/** The shortest gateway secret: 32 characters, as long as the HMAC keys it makes. */
+const GATEWAY_SECRET_MIN_LENGTH = 32;
+/** How long an MCP client's call waits for its answer unless set (Q13). */
+const MCP_WAIT_MAX_MS_DEFAULT = 10_000;
+const environmentSchema = z.object({
+    DATABASE_URL: z.url({ protocol: /^postgres(ql)?$/, error: 'must be a postgres:// or postgresql:// URL' }),
+    FLEET_URL: z.url({ protocol: /^https?$/, error: 'must be an http:// or https:// URL' }),
+    GATEWAY_SECRET: z.string().min(GATEWAY_SECRET_MIN_LENGTH, { error: `must hold at least ${String(GATEWAY_SECRET_MIN_LENGTH)} characters` }),
+    HOST: z.string().min(1).default('127.0.0.1'),
+    PORT: z.coerce.number().int().min(0).max(65_535).default(4200),
+    LOG_LEVEL: z.enum(['fatal', 'error', 'warn', 'info', 'debug', 'trace', 'silent']).default('info'),
+    GATEWAY_PUBLIC_URL: z.url({ protocol: /^https?$/, error: 'must be an http:// or https:// URL' }).optional(),
+    MCP_WAIT_MAX_MS: z.coerce.number().int().min(0).default(MCP_WAIT_MAX_MS_DEFAULT),
+    INSTALLATION_TOKEN: z.string().min(INSTALLATION_TOKEN_MIN_LENGTH, { error: `must hold at least ${String(INSTALLATION_TOKEN_MIN_LENGTH)} characters` }).optional(),
+    PAGASAE_URL: z.url({ protocol: /^https?$/, error: 'must be an http:// or https:// URL' }).optional(),
+    PAGASAE_CLIENT_ID: z.string().min(1).optional(),
+    PAGASAE_CLIENT_SECRET: z.string().min(1).optional(),
+});
+/** What `aeolus-gateway migrate` reads: the database alone. */
+const databaseEnvironmentSchema = environmentSchema.pick({ DATABASE_URL: true });
+export class ConfigError extends Error {
+    name = 'ConfigError';
+}
+function parsed(schema, environment) {
+    const result = schema.safeParse(environment);
+    if (!result.success) {
+        throw new ConfigError(result.error.issues.map((issue) => `${issue.path.join('.')}: ${issue.message}`).join('\n'));
+    }
+    return result.data;
+}
+/** The configuration from the environment; throws a ConfigError naming every variable that is wrong. */
+export function loadConfig(environment) {
+    const variables = parsed(environmentSchema, environment);
+    return {
+        databaseUrl: variables.DATABASE_URL,
+        fleetUrl: variables.FLEET_URL.replace(/\/$/, ''),
+        host: variables.HOST,
+        port: variables.PORT,
+        logLevel: variables.LOG_LEVEL,
+        installationToken: variables.INSTALLATION_TOKEN,
+        publicUrl: (variables.GATEWAY_PUBLIC_URL ?? `http://127.0.0.1:${String(variables.PORT)}`).replace(/\/$/, ''),
+        gatewaySecret: variables.GATEWAY_SECRET,
+        mcpWaitMaxMs: variables.MCP_WAIT_MAX_MS,
+        pagasae: pagasaeOf(variables),
+    };
+}
+/** pagasae's three settings: all of them, or none. */
+function pagasaeOf(variables) {
+    const { PAGASAE_URL: url, PAGASAE_CLIENT_ID: clientId, PAGASAE_CLIENT_SECRET: clientSecret } = variables;
+    if (url === undefined && clientId === undefined && clientSecret === undefined) {
+        return undefined;
+    }
+    if (url === undefined || clientId === undefined || clientSecret === undefined) {
+        throw new ConfigError('PAGASAE_URL, PAGASAE_CLIENT_ID and PAGASAE_CLIENT_SECRET: set all three, or none');
+    }
+    return { url: url.replace(/\/$/, ''), clientId, clientSecret };
+}
+/** The database URL alone, for `aeolus-gateway migrate`. */
+export function loadDatabaseUrl(environment) {
+    return parsed(databaseEnvironmentSchema, environment).DATABASE_URL;
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,6FAA6F;AAC7F,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEzC,qFAAqF;AACrF,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC,2EAA2E;AAC3E,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAEvC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;IACzG,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;IACvF,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,sBAAsB,MAAM,CAAC,yBAAyB,CAAC,aAAa,EAAE,CAAC;IAC1I,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9D,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACjG,kBAAkB,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3G,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC;IAChF,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,sBAAsB,MAAM,CAAC,6BAA6B,CAAC,aAAa,EAAE,CAAC,CAAC,QAAQ,EAAE;IACjK,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpG,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAC/C,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC,CAAC;AAEH,+DAA+D;AAC/D,MAAM,yBAAyB,GAAG,iBAAiB,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;AAiCjF,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,IAAI,GAAG,aAAa,CAAC;CAC/B;AAED,SAAS,MAAM,CAAI,MAAoB,EAAE,WAA+C;IACtF,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACpH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,UAAU,CAAC,WAA+C;IACxE,MAAM,SAAS,GAAG,MAAM,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;IACzD,OAAO;QACL,WAAW,EAAE,SAAS,CAAC,YAAY;QACnC,QAAQ,EAAE,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAChD,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,IAAI,EAAE,SAAS,CAAC,IAAI;QACpB,QAAQ,EAAE,SAAS,CAAC,SAAS;QAC7B,iBAAiB,EAAE,SAAS,CAAC,kBAAkB;QAC/C,SAAS,EAAE,CAAC,SAAS,CAAC,kBAAkB,IAAI,oBAAoB,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAC5G,aAAa,EAAE,SAAS,CAAC,cAAc;QACvC,YAAY,EAAE,SAAS,CAAC,eAAe;QACvC,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED,sDAAsD;AACtD,SAAS,SAAS,CAAC,SAAmI;IACpJ,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,iBAAiB,EAAE,QAAQ,EAAE,qBAAqB,EAAE,YAAY,EAAE,GAAG,SAAS,CAAC;IACzG,IAAI,GAAG,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC9E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,GAAG,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC9E,MAAM,IAAI,WAAW,CAAC,kFAAkF,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;AACjE,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,eAAe,CAAC,WAA+C;IAC7E,OAAO,MAAM,CAAC,yBAAyB,EAAE,WAAW,CAAC,CAAC,YAAY,CAAC;AACrE,CAAC"}

package/dist/core/actors/authenticate-actor.d.ts

@@ -0,0 +1,54 @@
+import type { FleetId, ShipId } from '@aeolus-fleet/common';
+import type { ConnectionStore, FleetDoor } from '../connection/ports.js';
+import type { AuthenticateOperator } from '../operator/authenticate-operator.js';
+import type { AccountTokenOf } from '../sign-in/account-token.js';
+import type { PageSessions } from '../sign-in/ports.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+/**
+ * Who calls the gateway's API (decision 0057): an account by the page
+ * session it signed in to the gateway's pages with, argo or a viewer by the
+ * console session, or a ship by its own crew token. Its scopes are the
+ * fleet's or its account token's, never the request's, plugin scopes such
+ * as gateway:approve among them.
+ */
+export type Actor = {
+    readonly fleetId: FleetId;
+    readonly kind: 'operator' | 'viewer';
+    readonly scopes: readonly string[];
+} | {
+    readonly fleetId: FleetId;
+    readonly kind: 'ship';
+    readonly shipId: ShipId;
+    readonly scopes: readonly string[];
+} | AccountActor;
+/** An account on the gateway's pages, with the grant whose account token it acts by in the fleet. */
+export interface AccountActor {
+    readonly fleetId: FleetId;
+    readonly kind: 'account';
+    readonly accountId: string;
+    readonly personShipId: ShipId | null;
+    readonly grantId: string;
+    readonly scopes: readonly string[];
+}
+export type AuthenticateActor = (sent: {
+    cookie?: string | undefined;
+    crewToken?: string | undefined;
+}) => Promise<Result<Actor, DomainError<'NOT_AN_ACTOR'>>>;
+/**
+ * Use case: whom a call of the gateway's API is for. A crew token, sent
+ * deliberately, names its ship: the fleet says which ship it crews, and the
+ * gateway, as its own ship in that fleet, reads the ship's scopes. Else the
+ * console session cookie names argo or a viewer, as before. A ship of a
+ * fleet the gateway is not connected to is no actor here. The crew token is
+ * never kept. Else the gateway's own page session cookie names an account,
+ * with the scopes its account token carries, refreshed through pagasae when
+ * it is about to end; a session whose sign-in ended is no actor.
+ */
+export declare function createAuthenticateActor(deps: {
+    authenticateOperator: AuthenticateOperator;
+    door: Pick<FleetDoor, 'whoami' | 'getShip'>;
+    connections: Pick<ConnectionStore, 'find'>;
+    sessions: PageSessions;
+    accountTokenOf: AccountTokenOf;
+}): AuthenticateActor;

package/dist/core/actors/authenticate-actor.js

@@ -0,0 +1,42 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+/**
+ * Use case: whom a call of the gateway's API is for. A crew token, sent
+ * deliberately, names its ship: the fleet says which ship it crews, and the
+ * gateway, as its own ship in that fleet, reads the ship's scopes. Else the
+ * console session cookie names argo or a viewer, as before. A ship of a
+ * fleet the gateway is not connected to is no actor here. The crew token is
+ * never kept. Else the gateway's own page session cookie names an account,
+ * with the scopes its account token carries, refreshed through pagasae when
+ * it is about to end; a session whose sign-in ended is no actor.
+ */
+export function createAuthenticateActor(deps) {
+    const refusal = refuse('NOT_AN_ACTOR', 'Sign in to the console of your fleet, or call with your ship\'s crew token');
+    return async ({ cookie, crewToken }) => {
+        if (crewToken !== undefined) {
+            const who = await deps.door.whoami(crewToken);
+            if (!who.isOk) {
+                return refusal;
+            }
+            const gateway = await deps.connections.find(who.value.fleetId);
+            if (gateway === undefined) {
+                return refusal;
+            }
+            // On the ship's own behalf: its read reach holds itself, whatever the gateway's ship reaches (decision 0034).
+            const ship = await deps.door.getShip(gateway.crewToken, { shipId: who.value.shipId, onBehalfOf: who.value.shipId });
+            return ship.isOk ? ok({ fleetId: who.value.fleetId, kind: 'ship', shipId: who.value.shipId, scopes: ship.value.scopes }) : refusal;
+        }
+        const session = cookie === undefined ? undefined : deps.sessions.inCookie(cookie);
+        if (session !== undefined) {
+            const token = await deps.accountTokenOf(session);
+            if (!token.isOk) {
+                return refusal;
+            }
+            const { accountId, personShipId, scopes } = token.value;
+            return ok({ fleetId: session.fleetId, kind: 'account', accountId, personShipId, grantId: session.grantId, scopes });
+        }
+        const operator = await deps.authenticateOperator(cookie);
+        return operator.isOk ? ok(operator.value) : refusal;
+    };
+}
+//# sourceMappingURL=authenticate-actor.js.map

package/dist/core/actors/authenticate-actor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticate-actor.js","sourceRoot":"","sources":["../../../src/core/actors/authenticate-actor.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AA0BtD;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAMvC;IACC,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,EAAE,4EAA4E,CAAC,CAAC;IACrH,OAAO,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE;QACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9C,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC/D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,8GAA8G;YAC9G,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACpH,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACrI,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAClF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAChB,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC;YACxD,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACtH,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACzD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACtD,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/actors/credential-of.d.ts

@@ -0,0 +1,27 @@
+import type { ConnectionStore } from '../connection/ports.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { AccountTokenOf } from '../sign-in/account-token.js';
+import type { Actor } from './authenticate-actor.js';
+/**
+ * What the gateway calls the fleet with, so the fleet answers as the actor
+ * (decision 0057): argo's or a viewer's console session cookie, a ship's own
+ * crew token, or an account's token with the crew token of the gateway's
+ * ship presenting it.
+ */
+export interface ActorCredential {
+    cookie?: string;
+    crewToken?: string;
+    accountToken?: string;
+}
+export type CredentialOf = (actor: Actor, sent: ActorCredential) => Promise<Result<ActorCredential, DomainError<'NOT_AN_ACTOR' | 'FLEET_UNAVAILABLE'>>>;
+/**
+ * Use case: the credential to call the fleet with as the actor. A ship, argo
+ * or a viewer sent its own, which goes on as it came. An account on the
+ * gateway's pages sent only its page session: its grant's account token goes,
+ * refreshed when about to end, presented by the gateway's ship of its fleet.
+ */
+export declare function createCredentialOf(deps: {
+    connections: Pick<ConnectionStore, 'find'>;
+    accountTokenOf: AccountTokenOf;
+}): CredentialOf;

package/dist/core/actors/credential-of.js

@@ -0,0 +1,25 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+/**
+ * Use case: the credential to call the fleet with as the actor. A ship, argo
+ * or a viewer sent its own, which goes on as it came. An account on the
+ * gateway's pages sent only its page session: its grant's account token goes,
+ * refreshed when about to end, presented by the gateway's ship of its fleet.
+ */
+export function createCredentialOf(deps) {
+    return async (actor, sent) => {
+        if (actor.kind !== 'account') {
+            return ok(sent);
+        }
+        const gateway = await deps.connections.find(actor.fleetId);
+        if (gateway === undefined) {
+            return refuse('FLEET_UNAVAILABLE', 'The gateway is not connected to your fleet');
+        }
+        const token = await deps.accountTokenOf({ fleetId: actor.fleetId, grantId: actor.grantId });
+        if (!token.isOk) {
+            return token.error.kind === 'signedOut' ? refuse('NOT_AN_ACTOR', 'Your sign-in ended: sign in again') : refuse('FLEET_UNAVAILABLE', 'pagasae did not answer, so your account token could not be renewed');
+        }
+        return ok({ crewToken: gateway.crewToken, accountToken: token.value.accountToken });
+    };
+}
+//# sourceMappingURL=credential-of.js.map

package/dist/core/actors/credential-of.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-of.js","sourceRoot":"","sources":["../../../src/core/actors/credential-of.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAkBtD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAoF;IACrH,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,mBAAmB,EAAE,4CAA4C,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,mCAAmC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,oEAAoE,CAAC,CAAC;QAC5M,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;IACtF,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/connection/connect.d.ts

@@ -0,0 +1,26 @@
+import type { FleetId, ShipId } from '@aeolus-fleet/common';
+import type { Clock } from '../shared/clock.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { ConnectionStatus, ConnectionStore, FleetDoor } from './ports.js';
+export type ConnectRefusal = DomainError<'ALREADY_CONNECTED' | 'SECRET_REFUSED' | 'OTHER_FLEET' | 'MISSING_SCOPES' | 'SCOPE_REFUSED' | 'FLEET_UNAVAILABLE'>;
+export type Connect = (input: {
+    operatorFleetId: FleetId;
+    shipId: ShipId;
+    secret: string;
+}) => Promise<Result<ConnectionStatus, ConnectRefusal>>;
+/**
+ * Use case: argo connects the gateway, as the other plugins are connected.
+ * The console's server hands it its ship's secret, server to server; the
+ * gateway registers with it as a server and keeps only the crew token. The
+ * ship must be of argo's fleet and hold the gateway's scopes, and the fleet
+ * must take the gateway's declared scope, or the gateway lets
+ * the ship go again and keeps nothing. Each fleet has its own connection:
+ * connect works only while the gateway is not connected to argo's fleet,
+ * whatever other fleets it serves. The secret is never kept or logged.
+ */
+export declare function createConnect(deps: {
+    door: FleetDoor;
+    store: ConnectionStore;
+    clock: Clock;
+}): Connect;

package/dist/core/connection/connect.js

@@ -0,0 +1,58 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+/**
+ * What the gateway's ship does (decisions 0044 to 0046, 0059): read the
+ * fleet, commission an app proxy ship for each approved outside party, naming
+ * its owner, declare the gateway's own scope, and write what it checked about
+ * each proxy ship.
+ */
+const GATEWAY_SCOPES = ['fleet:read', 'fleet:commission', 'fleet:on-behalf', 'scopes:declare', 'fleet:verify'];
+/** The gateway's own scopes, under its namespace: approving is a scope any actor may hold (decision 0056). */
+const GATEWAY_NAMESPACE = {
+    namespace: 'gateway',
+    scopes: [{ scope: 'gateway:approve', description: 'Approve outside parties: outside MCP clients and servers, each acting in the fleet as its proxy ship' }],
+};
+/**
+ * Use case: argo connects the gateway, as the other plugins are connected.
+ * The console's server hands it its ship's secret, server to server; the
+ * gateway registers with it as a server and keeps only the crew token. The
+ * ship must be of argo's fleet and hold the gateway's scopes, and the fleet
+ * must take the gateway's declared scope, or the gateway lets
+ * the ship go again and keeps nothing. Each fleet has its own connection:
+ * connect works only while the gateway is not connected to argo's fleet,
+ * whatever other fleets it serves. The secret is never kept or logged.
+ */
+export function createConnect(deps) {
+    return async ({ operatorFleetId, shipId, secret }) => {
+        if (await deps.store.find(operatorFleetId)) {
+            return refuse('ALREADY_CONNECTED', 'The gateway is connected to this fleet already');
+        }
+        const registered = await deps.door.register({ shipId, secret });
+        if (!registered.isOk) {
+            return refuse('SECRET_REFUSED', `The fleet refused its ship's secret: ${registered.error.message}`);
+        }
+        const { crewToken } = registered.value;
+        const letGo = async (kind, message) => {
+            await deps.door.deregister(crewToken);
+            return refuse(kind, message);
+        };
+        const who = await deps.door.whoami(crewToken);
+        if (!who.isOk) {
+            return letGo('SECRET_REFUSED', `The fleet refused the new crew token: ${who.error.message}`);
+        }
+        if (who.value.fleetId !== operatorFleetId) {
+            return letGo('OTHER_FLEET', "The ship belongs to another fleet than the operator's");
+        }
+        const ship = await deps.door.getShip(crewToken, { shipId });
+        if (!ship.isOk || !GATEWAY_SCOPES.every((scope) => ship.value.scopes.includes(scope))) {
+            return letGo('MISSING_SCOPES', `The ship needs ${GATEWAY_SCOPES.join(', ')}`);
+        }
+        const declared = await deps.door.declareScopes(crewToken, GATEWAY_NAMESPACE);
+        if (!declared.isOk) {
+            return letGo('SCOPE_REFUSED', `The fleet did not take the gateway's scope gateway:approve: ${declared.error.message}`);
+        }
+        await deps.store.save({ fleetId: who.value.fleetId, shipId, name: who.value.name, crewToken, crewedAt: deps.clock.now() });
+        return ok({ state: 'connected', ship: { shipId, name: who.value.name }, lastShipId: shipId });
+    };
+}
+//# sourceMappingURL=connect.js.map

package/dist/core/connection/connect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect.js","sourceRoot":"","sources":["../../../src/core/connection/connect.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAOtD;;;;;GAKG;AACH,MAAM,cAAc,GAAG,CAAC,YAAY,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;AAE/G,8GAA8G;AAC9G,MAAM,iBAAiB,GAAG;IACxB,SAAS,EAAE,SAAS;IACpB,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,sGAAsG,EAAE,CAAC;CAC5J,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,IAA+D;IAC3F,OAAO,KAAK,EAAE,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE;QACnD,IAAI,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YAC3C,OAAO,MAAM,CAAC,mBAAmB,EAAE,gDAAgD,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC,gBAAgB,EAAE,wCAAwC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,MAAM,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC;QACvC,MAAM,KAAK,GAAG,KAAK,EAAoC,IAAO,EAAE,OAAe,EAAE,EAAE;YACjF,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACtC,OAAO,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC/B,CAAC,CAAC;QAEF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;YACd,OAAO,KAAK,CAAC,gBAAgB,EAAE,yCAAyC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,eAAe,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC,aAAa,EAAE,uDAAuD,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACtF,OAAO,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;QAC7E,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,OAAO,KAAK,CAAC,eAAe,EAAE,+DAA+D,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACzH,CAAC;QAED,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3H,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;IAChG,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/connection/ports.d.ts

@@ -0,0 +1,92 @@
+import type { FleetId, ShipId } from '@aeolus-fleet/common';
+import type { Result } from '../shared/result.js';
+/**
+ * Why the fleet refused a ship call: its code (CONFLICT, UNAUTHORIZED,
+ * LEASE_ENDED, ...) and its message. UNAVAILABLE: no answer came, so the call
+ * may or may not have been carried out.
+ */
+export interface FleetRefusal {
+    code: string;
+    message: string;
+}
+/** A ship as `fleet.ship` shows it: what the gateway reads of it. */
+export interface FleetShip {
+    status: 'awaitingCrew' | 'crewed' | 'retired';
+    scopes: string[];
+}
+/**
+ * Outbound port: the fleet's public ship calls, as the gateway makes them for
+ * its own ship. The gateway is a ship like any other.
+ */
+export interface FleetDoor {
+    register(claim: {
+        shipId: ShipId;
+        secret: string;
+    }): Promise<Result<{
+        crewToken: string;
+    }, FleetRefusal>>;
+    whoami(crewToken: string): Promise<Result<{
+        shipId: ShipId;
+        fleetId: FleetId;
+        name: string;
+        type: string;
+    }, FleetRefusal>>;
+    /**
+     * A ship of the fleet, retired ones included; needs fleet:read. Read on
+     * behalf of a ship (fleet:on-behalf), it answers within that ship's read
+     * reach; outside the reader's read reach it is refused.
+     */
+    getShip(crewToken: string, ship: {
+        shipId: ShipId;
+        onBehalfOf?: ShipId;
+    }): Promise<Result<FleetShip, FleetRefusal>>;
+    /** Ends this session's crew of its ship: the lease and the secret it claimed with. */
+    deregister(crewToken: string): Promise<Result<undefined, FleetRefusal>>;
+    /** Declares the ship's own namespace and its whole list of scopes; the fleet stores them, the gateway enforces them (decision 0046). */
+    declareScopes(crewToken: string, declaration: {
+        namespace: string;
+        scopes: {
+            scope: string;
+            description: string;
+        }[];
+    }): Promise<Result<undefined, FleetRefusal>>;
+}
+/** The crew token the gateway holds for its ship in a fleet, and when it got it. */
+export interface GatewayCrew {
+    /** The fleet the ship belongs to: the fleet the gateway serves. */
+    fleetId: FleetId;
+    shipId: ShipId;
+    /** The ship's name when the gateway connected, shown while the fleet does not answer. */
+    name: string;
+    crewToken: string;
+    crewedAt: Date;
+}
+/** The fleet and ship the gateway was last connected as; kept when its crew token is dropped. */
+export interface GatewayBinding {
+    fleetId: FleetId;
+    shipId: ShipId;
+}
+/**
+ * Outbound port: where the gateway keeps each fleet's crew token across
+ * restarts. One install serves many fleets, one connection each.
+ */
+export interface ConnectionStore {
+    /** The fleet's crew, while the gateway holds a crew token for it: while it is connected to that fleet. */
+    find(fleetId: FleetId): Promise<GatewayCrew | undefined>;
+    /** The fleet's last connection, with or without a crew token; none before its first. */
+    binding(fleetId: FleetId): Promise<GatewayBinding | undefined>;
+    /** Every fleet's crew the gateway holds a crew token for: the fleets it is connected to. */
+    connected(): Promise<GatewayCrew[]>;
+    save(crew: GatewayCrew): Promise<void>;
+    /** Forgets the fleet's crew token, keeping its binding: the gateway is not connected to that fleet. */
+    drop(fleetId: FleetId): Promise<void>;
+}
+/** Whether the gateway holds a working crew token for its ship, as which ship, and the ship it was last connected as. */
+export interface ConnectionStatus {
+    state: 'not-connected' | 'connected';
+    ship: {
+        shipId: ShipId;
+        name: string;
+    } | null;
+    lastShipId: ShipId | null;
+}

package/dist/core/connection/ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/core/connection/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../src/core/connection/ports.ts"],"names":[],"mappings":""}

package/dist/core/connection/read-connection.d.ts

@@ -0,0 +1,14 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { ConnectionStatus, ConnectionStore, FleetDoor } from './ports.js';
+export type ReadConnection = (fleetId: FleetId) => Promise<ConnectionStatus>;
+/**
+ * Use case: whether the gateway is connected to a fleet. The fleet's kept
+ * crew token is asked who it is: a token the fleet no longer takes (the ship
+ * was released, its session ended) is dropped, and the gateway is not
+ * connected to that fleet until argo connects it again. When the fleet does
+ * not answer, the token is kept.
+ */
+export declare function createReadConnection(deps: {
+    door: FleetDoor;
+    store: ConnectionStore;
+}): ReadConnection;

package/dist/core/connection/read-connection.js

@@ -0,0 +1,24 @@
+/** The codes with which the fleet says a crew token no longer crews its ship. */
+const GONE = new Set(['LEASE_ENDED', 'UNAUTHORIZED']);
+/**
+ * Use case: whether the gateway is connected to a fleet. The fleet's kept
+ * crew token is asked who it is: a token the fleet no longer takes (the ship
+ * was released, its session ended) is dropped, and the gateway is not
+ * connected to that fleet until argo connects it again. When the fleet does
+ * not answer, the token is kept.
+ */
+export function createReadConnection(deps) {
+    return async (fleetId) => {
+        const crew = await deps.store.find(fleetId);
+        if (crew) {
+            const who = await deps.door.whoami(crew.crewToken);
+            if (who.isOk || !GONE.has(who.error.code)) {
+                return { state: 'connected', ship: { shipId: crew.shipId, name: who.isOk ? who.value.name : crew.name }, lastShipId: crew.shipId };
+            }
+            await deps.store.drop(fleetId);
+        }
+        const binding = await deps.store.binding(fleetId);
+        return { state: 'not-connected', ship: null, lastShipId: binding?.shipId ?? null };
+    };
+}
+//# sourceMappingURL=read-connection.js.map

package/dist/core/connection/read-connection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-connection.js","sourceRoot":"","sources":["../../../src/core/connection/read-connection.ts"],"names":[],"mappings":"AAMA,iFAAiF;AACjF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC;AAEtD;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAiD;IACpF,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACnD,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1C,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;YACrI,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClD,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC;IACrF,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/installation/delete-fleet.d.ts

@@ -0,0 +1,21 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { Clock } from '../shared/clock.js';
+import type { DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { FleetForgetter, InstallationRequests, RequestHasher } from './ports.js';
+export type DeleteFleet = (input: {
+    requestId: string;
+    fleetId: FleetId;
+}) => Promise<Result<Record<string, never>, DomainError<'REQUEST_ID_USED'>>>;
+/**
+ * Use case: the hosting service deletes a fleet from the gateway (decision
+ * 0021): the gateway forgets everything it holds of the fleet and tells the
+ * fleet nothing; its ships stay there. The request is kept as its hash only,
+ * so nothing of the fleet stays; a replay answers the first answer.
+ */
+export declare function createDeleteFleet(deps: {
+    forgetter: FleetForgetter;
+    requests: InstallationRequests;
+    hasher: RequestHasher;
+    clock: Clock;
+}): DeleteFleet;

package/dist/core/installation/delete-fleet.js

@@ -0,0 +1,21 @@
+import { ok } from '../shared/result.js';
+import { earlierAnswer } from './request-id.js';
+/**
+ * Use case: the hosting service deletes a fleet from the gateway (decision
+ * 0021): the gateway forgets everything it holds of the fleet and tells the
+ * fleet nothing; its ships stay there. The request is kept as its hash only,
+ * so nothing of the fleet stays; a replay answers the first answer.
+ */
+export function createDeleteFleet(deps) {
+    return async ({ requestId, fleetId }) => {
+        const requestHash = deps.hasher.hash(`deleteFleet ${fleetId}`);
+        const earlier = await earlierAnswer(deps.requests, { requestId, requestHash });
+        if (earlier !== undefined) {
+            return 'isOk' in earlier ? earlier : ok({});
+        }
+        await deps.forgetter.forget(fleetId);
+        await deps.requests.record({ requestId, kind: 'deleteFleet', requestHash, fleetId: null, isEnabled: null, at: deps.clock.now() });
+        return ok({});
+    };
+}
+//# sourceMappingURL=delete-fleet.js.map

package/dist/core/installation/delete-fleet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete-fleet.js","sourceRoot":"","sources":["../../../src/core/installation/delete-fleet.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAIhD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAwG;IACxI,OAAO,KAAK,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE;QACtC,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,OAAO,EAAE,CAAC,CAAC;QAC/D,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;QAC/E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAClI,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/installation/ports.d.ts

@@ -0,0 +1,43 @@
+import type { FleetId } from '@aeolus-fleet/common';
+/**
+ * Whether the installation has an installation token (decision 0021): open
+ * without one, as a self-hosted gateway runs, and every fleet is served;
+ * enabled with one, and a fleet is served only once the hosting service
+ * switched it on.
+ */
+export type InstallationMode = 'open' | 'enabled';
+/** Outbound port: each fleet's switch, as the hosting service set it. */
+export interface FleetSwitches {
+    /** Whether the fleet was switched on; undefined when it never was switched. */
+    find(fleetId: FleetId): Promise<boolean | undefined>;
+    set(fleetId: FleetId, change: {
+        isEnabled: boolean;
+        at: Date;
+    }): Promise<void>;
+}
+/**
+ * A request the installation answered, by the caller's request id. A switch
+ * names its fleet and what it set, and goes with its fleet; a delete names
+ * nothing of the fleet, only the request's hash.
+ */
+export interface InstallationRequest {
+    requestId: string;
+    kind: 'setEnabled' | 'deleteFleet';
+    requestHash: string;
+    fleetId: FleetId | null;
+    isEnabled: boolean | null;
+    at: Date;
+}
+/** Outbound port: the installation's requests, so a replay answers what the first call answered. */
+export interface InstallationRequests {
+    find(requestId: string): Promise<InstallationRequest | undefined>;
+    record(request: InstallationRequest): Promise<void>;
+}
+/** Outbound port: forgets everything the gateway holds of a fleet, in one go: its connection, its switch, its parties with their vault, and the requests that name it. */
+export interface FleetForgetter {
+    forget(fleetId: FleetId): Promise<void>;
+}
+/** Outbound port: a one-way hash of a request's text, kept instead of the request. */
+export interface RequestHasher {
+    hash(text: string): string;
+}

package/dist/core/installation/ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/core/installation/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../src/core/installation/ports.ts"],"names":[],"mappings":""}

package/dist/core/installation/read-fleet.d.ts

@@ -0,0 +1,18 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { ConnectionStore } from '../connection/ports.js';
+import type { IsServed } from './served.js';
+export type ReadFleet = (input: {
+    fleetId: FleetId;
+}) => Promise<{
+    isEnabled: boolean;
+    isConnected: boolean;
+}>;
+/**
+ * Use case: a fleet as the hosting service reads it: whether the gateway
+ * serves it, and whether the gateway holds a crew token for it. Off and
+ * connected is a fleet whose connection waits for it to be on again.
+ */
+export declare function createReadFleet(deps: {
+    isServed: IsServed;
+    connections: ConnectionStore;
+}): ReadFleet;

package/dist/core/installation/read-fleet.js

@@ -0,0 +1,9 @@
+/**
+ * Use case: a fleet as the hosting service reads it: whether the gateway
+ * serves it, and whether the gateway holds a crew token for it. Off and
+ * connected is a fleet whose connection waits for it to be on again.
+ */
+export function createReadFleet(deps) {
+    return async ({ fleetId }) => ({ isEnabled: await deps.isServed(fleetId), isConnected: (await deps.connections.find(fleetId)) !== undefined });
+}
+//# sourceMappingURL=read-fleet.js.map

package/dist/core/installation/read-fleet.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-fleet.js","sourceRoot":"","sources":["../../../src/core/installation/read-fleet.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAA0D;IACxF,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC;AACjJ,CAAC"}

package/dist/core/installation/request-id.d.ts

@@ -0,0 +1,8 @@
+import { type DomainError } from '../shared/errors.js';
+import type { Err } from '../shared/result.js';
+import type { InstallationRequest, InstallationRequests } from './ports.js';
+/** What a request id already answered: the earlier request when it is the same one, a refusal when it was another. */
+export declare function earlierAnswer(requests: InstallationRequests, request: {
+    requestId: string;
+    requestHash: string;
+}): Promise<InstallationRequest | Err<DomainError<'REQUEST_ID_USED'>> | undefined>;

package/dist/core/installation/request-id.js

@@ -0,0 +1,10 @@
+import { refuse } from '../shared/errors.js';
+/** What a request id already answered: the earlier request when it is the same one, a refusal when it was another. */
+export async function earlierAnswer(requests, request) {
+    const earlier = await requests.find(request.requestId);
+    if (!earlier) {
+        return undefined;
+    }
+    return earlier.requestHash === request.requestHash ? earlier : refuse('REQUEST_ID_USED', `The request id ${request.requestId} was used for another request`);
+}
+//# sourceMappingURL=request-id.js.map