@aeolus-fleet/gateway 0.0.0-stage → 0.28.0

package/dist/core/oauth/read-authorization.js

@@ -0,0 +1,74 @@
+import { z } from 'zod';
+import { err, ok } from '../shared/result.js';
+import { isLoopback, isRedirectUri } from './redirect-uri.js';
+/** A client's metadata document (CIMD), as far as the gateway reads it. */
+const metadataDocumentSchema = z.object({
+    client_id: z.string(),
+    client_name: z.string().min(1).optional(),
+    redirect_uris: z.array(z.string()).min(1),
+});
+/** A client id that is a metadata document's URL: https, or http on this machine, with a path. */
+function metadataDocumentUrl(clientId) {
+    let url;
+    try {
+        url = new URL(clientId);
+    }
+    catch {
+        return undefined;
+    }
+    const isSecure = url.protocol === 'https:' || (url.protocol === 'http:' && isLoopback(url));
+    return isSecure && url.pathname !== '/' && url.hash === '' ? url : undefined;
+}
+/**
+ * Use case: the gateway reads an authorization request from an MCP client
+ * (OAuth 2.1 with PKCE, MCP 2026-07-28). The client is pre-registered, or
+ * known by its metadata document (CIMD), fetched from its client id. Only
+ * the S256 challenge is taken, and the resource must be the gateway's MCP
+ * endpoint (RFC 8707), so a token is bound to it.
+ */
+export function createReadAuthorization(deps) {
+    const knownClient = async (clientId) => {
+        const url = metadataDocumentUrl(clientId);
+        if (url === undefined) {
+            const client = await deps.clients.find(clientId);
+            return client ? ok({ name: client.name, fleetId: client.fleetId, redirectUris: client.redirectUris }) : err(`No client ${clientId} is registered`);
+        }
+        const fetched = await deps.documents.fetch(url.toString());
+        if (!fetched.isOk) {
+            return err(`The client's metadata document at ${clientId} could not be read: ${fetched.error.reason}`);
+        }
+        const document = metadataDocumentSchema.safeParse(fetched.value);
+        if (!document.success || document.data.client_id !== clientId || !document.data.redirect_uris.every(isRedirectUri)) {
+            return err(`The client's metadata document at ${clientId} does not name it, or names no valid redirect URI`);
+        }
+        return ok({ name: document.data.client_name ?? url.hostname, fleetId: null, redirectUris: document.data.redirect_uris });
+    };
+    return async (request) => {
+        const clientId = request.client_id;
+        if (clientId === undefined || clientId === '') {
+            return err({ kind: 'invalidClient', message: 'The request names no client' });
+        }
+        const client = await knownClient(clientId);
+        if (!client.isOk) {
+            return err({ kind: 'invalidClient', message: client.error });
+        }
+        const redirectUri = request.redirect_uri;
+        if (redirectUri === undefined || !client.value.redirectUris.includes(redirectUri)) {
+            return err({ kind: 'invalidClient', message: `${client.value.name} registered no such redirect URI` });
+        }
+        const state = request.state ?? null;
+        const sendBack = (error, description) => err({ kind: 'redirect', redirectUri, error, description, state });
+        if (request.response_type !== 'code') {
+            return sendBack('unsupported_response_type', 'Only the authorization code flow is served');
+        }
+        const codeChallenge = request.code_challenge;
+        if (codeChallenge === undefined || codeChallenge === '' || request.code_challenge_method !== 'S256') {
+            return sendBack('invalid_request', 'A PKCE code challenge with the S256 method is required');
+        }
+        if (request.resource !== deps.resource) {
+            return sendBack('invalid_target', `The resource must be ${deps.resource}`);
+        }
+        return ok({ clientId, clientName: client.value.name, clientFleetId: client.value.fleetId, redirectUri, codeChallenge, resource: deps.resource, scope: request.scope ?? null, state });
+    };
+}
+//# sourceMappingURL=read-authorization.js.map

package/dist/core/oauth/read-authorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-authorization.js","sourceRoot":"","sources":["../../../src/core/oauth/read-authorization.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AA0B9D,2EAA2E;AAC3E,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACzC,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;CAC1C,CAAC,CAAC;AAEH,kGAAkG;AAClG,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5F,OAAO,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/E,CAAC;AAQD;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAqF;IAC3H,MAAM,WAAW,GAAG,KAAK,EAAE,QAAgB,EAAwC,EAAE;QACnF,MAAM,GAAG,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjD,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,QAAQ,gBAAgB,CAAC,CAAC;QACrJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,GAAG,CAAC,qCAAqC,QAAQ,uBAAuB,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACjE,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YACnH,OAAO,GAAG,CAAC,qCAAqC,QAAQ,mDAAmD,CAAC,CAAC;QAC/G,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IAC3H,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC;QACnC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC9C,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,WAAW,GAAG,OAAO,CAAC,YAAY,CAAC;QACzC,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAClF,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,kCAAkC,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC;QACpC,MAAM,QAAQ,GAAG,CAAC,KAAqB,EAAE,WAAmB,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,UAAmB,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5I,IAAI,OAAO,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;YACrC,OAAO,QAAQ,CAAC,2BAA2B,EAAE,4CAA4C,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,aAAa,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,aAAa,KAAK,SAAS,IAAI,aAAa,KAAK,EAAE,IAAI,OAAO,CAAC,qBAAqB,KAAK,MAAM,EAAE,CAAC;YACpG,OAAO,QAAQ,CAAC,iBAAiB,EAAE,wDAAwD,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvC,OAAO,QAAQ,CAAC,gBAAgB,EAAE,wBAAwB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxL,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/oauth/redirect-uri.d.ts

@@ -0,0 +1,6 @@
+/** The most redirect URIs one client registers. */
+export declare const REDIRECT_URIS_MAX = 10;
+/** Whether a URL is served on this machine: plain http is allowed only there (OAuth 2.1, 8.4.2). */
+export declare function isLoopback(url: URL): boolean;
+/** A redirect URI a client may register: an absolute https URL, or http on loopback, with no fragment. */
+export declare function isRedirectUri(text: string): boolean;

package/dist/core/oauth/redirect-uri.js

@@ -0,0 +1,20 @@
+/** The most redirect URIs one client registers. */
+export const REDIRECT_URIS_MAX = 10;
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]']);
+/** Whether a URL is served on this machine: plain http is allowed only there (OAuth 2.1, 8.4.2). */
+export function isLoopback(url) {
+    return LOOPBACK_HOSTS.has(url.hostname);
+}
+/** A redirect URI a client may register: an absolute https URL, or http on loopback, with no fragment. */
+export function isRedirectUri(text) {
+    let url;
+    try {
+        url = new URL(text);
+    }
+    catch {
+        return false;
+    }
+    const isSecure = url.protocol === 'https:' || (url.protocol === 'http:' && isLoopback(url));
+    return isSecure && url.hash === '' && !text.includes('#');
+}
+//# sourceMappingURL=redirect-uri.js.map

package/dist/core/oauth/redirect-uri.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect-uri.js","sourceRoot":"","sources":["../../../src/core/oauth/redirect-uri.ts"],"names":[],"mappings":"AAAA,mDAAmD;AACnD,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpE,oGAAoG;AACpG,MAAM,UAAU,UAAU,CAAC,GAAQ;IACjC,OAAO,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5F,OAAO,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC5D,CAAC"}

package/dist/core/oauth/register-client.d.ts

@@ -0,0 +1,22 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { OAuthClients, OAuthSecrets } from './ports.js';
+export type RegisterClient = (input: {
+    fleetId: FleetId;
+    name: string;
+    redirectUris: readonly string[];
+    isConfidential: boolean;
+}) => Promise<Result<{
+    clientId: string;
+    clientSecret: string | null;
+}, DomainError<'INVALID_REDIRECT_URIS'>>>;
+/**
+ * Use case: argo pre-registers an MCP client for its fleet, as MCP
+ * 2026-07-28 deprecates dynamic registration. A confidential client gets a
+ * secret, answered this once and kept only as its hash.
+ */
+export declare function createRegisterClient(deps: {
+    clients: OAuthClients;
+    secrets: OAuthSecrets;
+}): RegisterClient;

package/dist/core/oauth/register-client.js

@@ -0,0 +1,20 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+import { isRedirectUri, REDIRECT_URIS_MAX } from './redirect-uri.js';
+/**
+ * Use case: argo pre-registers an MCP client for its fleet, as MCP
+ * 2026-07-28 deprecates dynamic registration. A confidential client gets a
+ * secret, answered this once and kept only as its hash.
+ */
+export function createRegisterClient(deps) {
+    return async ({ fleetId, name, redirectUris, isConfidential }) => {
+        if (redirectUris.length === 0 || redirectUris.length > REDIRECT_URIS_MAX || !redirectUris.every(isRedirectUri)) {
+            return refuse('INVALID_REDIRECT_URIS', `A client registers 1 to ${String(REDIRECT_URIS_MAX)} redirect URIs, each https, or http on this machine, with no fragment`);
+        }
+        const clientId = `client-${deps.secrets.newSecret()}`;
+        const clientSecret = isConfidential ? deps.secrets.newSecret() : null;
+        await deps.clients.save({ clientId, fleetId, name, redirectUris: [...redirectUris], secretHash: clientSecret === null ? null : deps.secrets.hashOf(clientSecret) });
+        return ok({ clientId, clientSecret });
+    };
+}
+//# sourceMappingURL=register-client.js.map

package/dist/core/oauth/register-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register-client.js","sourceRoot":"","sources":["../../../src/core/oauth/register-client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AASrE;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAsD;IACzF,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,cAAc,EAAE,EAAE,EAAE;QAC/D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,iBAAiB,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;YAC/G,OAAO,MAAM,CAAC,uBAAuB,EAAE,2BAA2B,MAAM,CAAC,iBAAiB,CAAC,uEAAuE,CAAC,CAAC;QACtK,CAAC;QACD,MAAM,QAAQ,GAAG,UAAU,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;QACtD,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACtE,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,EAAE,UAAU,EAAE,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACpK,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/operator/authenticate-operator.d.ts

@@ -0,0 +1,22 @@
+import type { ConsoleSessionOutput, FleetId, Scope } from '@aeolus-fleet/common';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { ConsoleSessions } from './ports.js';
+export type AuthenticateOperator = (cookie: string | undefined) => Promise<Result<{
+    fleetId: FleetId;
+    kind: ConsoleSessionOutput['kind'];
+    scopes: readonly Scope[];
+}, DomainError<'NOT_THE_OPERATOR'>>>;
+/**
+ * Use case: whether a request comes from argo. The gateway has no login of
+ * its own: its page and the console's server forward the console session
+ * cookie, and the fleet says whose session it is (decision 0043). The gateway
+ * serves every fleet at its FLEET_URL, each with its own connection, so any
+ * signed-in operator there is let through as the operator of their own
+ * fleet. A viewer session is let through as a viewer, with the viewer ship's
+ * scopes, which the fleet answers; what each may call is the API's to check
+ * (decision 0022).
+ */
+export declare function createAuthenticateOperator(deps: {
+    sessions: ConsoleSessions;
+}): AuthenticateOperator;

package/dist/core/operator/authenticate-operator.js

@@ -0,0 +1,26 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+/**
+ * Use case: whether a request comes from argo. The gateway has no login of
+ * its own: its page and the console's server forward the console session
+ * cookie, and the fleet says whose session it is (decision 0043). The gateway
+ * serves every fleet at its FLEET_URL, each with its own connection, so any
+ * signed-in operator there is let through as the operator of their own
+ * fleet. A viewer session is let through as a viewer, with the viewer ship's
+ * scopes, which the fleet answers; what each may call is the API's to check
+ * (decision 0022).
+ */
+export function createAuthenticateOperator(deps) {
+    const refusal = refuse('NOT_THE_OPERATOR', 'Sign in to the console of your fleet');
+    return async (cookie) => {
+        if (cookie === undefined) {
+            return refusal;
+        }
+        const session = await deps.sessions.check(cookie);
+        if (!session.isOk) {
+            return refusal;
+        }
+        return ok(session.value);
+    };
+}
+//# sourceMappingURL=authenticate-operator.js.map

package/dist/core/operator/authenticate-operator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticate-operator.js","sourceRoot":"","sources":["../../../src/core/operator/authenticate-operator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAOtD;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAmC;IAC5E,MAAM,OAAO,GAAG,MAAM,CAAC,kBAAkB,EAAE,sCAAsC,CAAC,CAAC;IACnF,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE;QACtB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/operator/ports.d.ts

@@ -0,0 +1,15 @@
+import type { ConsoleSessionOutput, FleetId, Scope } from '@aeolus-fleet/common';
+import type { FleetRefusal } from '../connection/ports.js';
+import type { Result } from '../shared/result.js';
+/**
+ * Outbound port: asks the fleet whether a forwarded console session cookie is
+ * a signed-in operator's or a viewer's (`console.session`, decisions 0012,
+ * 0022 and 0043), with its ship's scopes.
+ */
+export interface ConsoleSessions {
+    check(cookie: string): Promise<Result<{
+        fleetId: FleetId;
+        kind: ConsoleSessionOutput['kind'];
+        scopes: readonly Scope[];
+    }, FleetRefusal>>;
+}

package/dist/core/operator/ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/core/operator/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../src/core/operator/ports.ts"],"names":[],"mappings":""}

package/dist/core/outside-parties/ports.d.ts

@@ -0,0 +1,17 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { ActorCredential } from '../actors/credential-of.js';
+import type { FleetRefusal } from '../connection/ports.js';
+import type { Result } from '../shared/result.js';
+/** Whether a fleet's outside parties are on, and when it was last set; off for a fleet never set (interop I-3). */
+export interface OutsidePartySwitches {
+    isOn(fleetId: FleetId): Promise<boolean>;
+    set(fleetId: FleetId, switched: {
+        isOn: boolean;
+        at: Date;
+    }): Promise<void>;
+}
+/** Outbound port: the fleet's network, as the actor reads it. */
+export interface FleetNetwork {
+    /** Whether the fleet applies no network rules, so every ship reaches every ship. */
+    isOpen(as: ActorCredential): Promise<Result<boolean, FleetRefusal>>;
+}

package/dist/core/outside-parties/ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/core/outside-parties/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../src/core/outside-parties/ports.ts"],"names":[],"mappings":""}

package/dist/core/outside-parties/set-outside-parties.d.ts

@@ -0,0 +1,36 @@
+import type { Actor } from '../actors/authenticate-actor.js';
+import type { ActorCredential, CredentialOf } from '../actors/credential-of.js';
+import type { Clock } from '../shared/clock.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { FleetNetwork, OutsidePartySwitches } from './ports.js';
+/** The scope that switches a fleet's outside parties, as it changes the fleet's network. */
+export declare const SWITCHING_SCOPE = "fleet:network";
+export type ReadOutsideParties = (actor: Actor) => Promise<{
+    isOn: boolean;
+}>;
+export type SetOutsideParties = (input: {
+    actor: Actor;
+    as: ActorCredential;
+    isOn: boolean;
+    isOpenNetworkConfirmed: boolean;
+}) => Promise<Result<{
+    isOn: boolean;
+}, DomainError<'NOT_A_NETWORKER' | 'OPEN_NETWORK' | 'FLEET_UNAVAILABLE' | 'NOT_AN_ACTOR'>>>;
+/** Use case: whether the actor's fleet's outside parties are on. */
+export declare function createReadOutsideParties(deps: {
+    switches: OutsidePartySwitches;
+}): ReadOutsideParties;
+/**
+ * Use case: an actor holding fleet:network turns the fleet's outside parties
+ * on or off (interop I-3). The gateway sets no policy but warns: turning
+ * them on while the fleet applies no network rules needs the warning
+ * confirmed. The rules are read as the actor, so the fleet answers what that
+ * actor may see, an account by its account token. Turning off reads nothing.
+ */
+export declare function createSetOutsideParties(deps: {
+    switches: OutsidePartySwitches;
+    network: FleetNetwork;
+    clock: Clock;
+    credentialOf: CredentialOf;
+}): SetOutsideParties;

package/dist/core/outside-parties/set-outside-parties.js

@@ -0,0 +1,38 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+/** The scope that switches a fleet's outside parties, as it changes the fleet's network. */
+export const SWITCHING_SCOPE = 'fleet:network';
+/** Use case: whether the actor's fleet's outside parties are on. */
+export function createReadOutsideParties(deps) {
+    return async (actor) => ({ isOn: await deps.switches.isOn(actor.fleetId) });
+}
+/**
+ * Use case: an actor holding fleet:network turns the fleet's outside parties
+ * on or off (interop I-3). The gateway sets no policy but warns: turning
+ * them on while the fleet applies no network rules needs the warning
+ * confirmed. The rules are read as the actor, so the fleet answers what that
+ * actor may see, an account by its account token. Turning off reads nothing.
+ */
+export function createSetOutsideParties(deps) {
+    return async ({ actor, as, isOn, isOpenNetworkConfirmed }) => {
+        if (!actor.scopes.includes(SWITCHING_SCOPE)) {
+            return refuse('NOT_A_NETWORKER', `Switching outside parties needs ${SWITCHING_SCOPE}`);
+        }
+        if (isOn && !isOpenNetworkConfirmed) {
+            const credential = await deps.credentialOf(actor, as);
+            if (!credential.isOk) {
+                return credential;
+            }
+            const isOpen = await deps.network.isOpen(credential.value);
+            if (!isOpen.isOk) {
+                return refuse('FLEET_UNAVAILABLE', `The fleet did not say its network rules: ${isOpen.error.message}`);
+            }
+            if (isOpen.value) {
+                return refuse('OPEN_NETWORK', 'This fleet applies no network rules, so every outside party would reach every ship. Confirm to turn outside parties on anyway.');
+            }
+        }
+        await deps.switches.set(actor.fleetId, { isOn, at: deps.clock.now() });
+        return ok({ isOn });
+    };
+}
+//# sourceMappingURL=set-outside-parties.js.map

package/dist/core/outside-parties/set-outside-parties.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-outside-parties.js","sourceRoot":"","sources":["../../../src/core/outside-parties/set-outside-parties.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAGtD,4FAA4F;AAC5F,MAAM,CAAC,MAAM,eAAe,GAAG,eAAe,CAAC;AAW/C,oEAAoE;AACpE,MAAM,UAAU,wBAAwB,CAAC,IAAwC;IAC/E,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAyG;IAC/I,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,EAAE,EAAE;QAC3D,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,iBAAiB,EAAE,mCAAmC,eAAe,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;YACpC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACtD,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBACrB,OAAO,UAAU,CAAC;YACpB,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjB,OAAO,MAAM,CAAC,mBAAmB,EAAE,4CAA4C,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACzG,CAAC;YACD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,OAAO,MAAM,CAAC,cAAc,EAAE,gIAAgI,CAAC,CAAC;YAClK,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACvE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACtB,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/approve-party.d.ts

@@ -0,0 +1,55 @@
+import type { FleetId, ShipId } from '@aeolus-fleet/common';
+import type { ConnectionStore } from '../connection/ports.js';
+import type { RequestHasher } from '../installation/ports.js';
+import type { Clock } from '../shared/clock.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { McpServerCredential } from '../vault/credential.js';
+import type { PartyStore, ProxyShipDoor } from './ports.js';
+import { type ShownParty } from './shown-party.js';
+/** The type of every outside MCP server's proxy ship. */
+export declare const MCP_SERVER_SHIP_TYPE = "mcp-server";
+/** The type of every outside MCP client's proxy ship. */
+export declare const MCP_CLIENT_SHIP_TYPE = "mcp-client";
+export type ApprovePartyRefusal = DomainError<'OUTSIDE_PARTIES_OFF' | 'NOT_CONNECTED' | 'PARTY_EXISTS' | 'COMMISSION_REFUSED' | 'FLEET_UNAVAILABLE'>;
+export type ApproveParty = (input: {
+    operatorFleetId: FleetId;
+    requestId: string;
+    name: string;
+    url: string;
+    credential: McpServerCredential;
+    ownerShipId: ShipId;
+    /** The scopes granted its proxy ship beside the ones every app ship gets (decision 0046). */
+    scopes: readonly string[];
+    concurrencyLimit: number;
+}) => Promise<Result<ShownParty, ApprovePartyRefusal>>;
+export type ApproveClientParty = (input: {
+    operatorFleetId: FleetId;
+    requestId: string;
+    name: string;
+    clientId: string;
+    ownerShipId: ShipId;
+    scopes: readonly string[];
+}) => Promise<Result<ShownParty, ApprovePartyRefusal | DomainError<'CLIENT_HAS_PARTY'>>>;
+interface ApprovalDeps {
+    connections: ConnectionStore;
+    parties: PartyStore;
+    door: ProxyShipDoor;
+    hasher: RequestHasher;
+    /** Whether the fleet's outside parties are on (interop I-3). */
+    servesOutsideParties: (fleetId: FleetId) => Promise<boolean>;
+    clock: Clock;
+}
+/**
+ * Use case: argo approves an outside MCP server as a party of its fleet: the
+ * gateway commissions and crews its proxy ship, and keeps the server's
+ * credential in its vault.
+ */
+export declare function createApproveParty(deps: ApprovalDeps): ApproveParty;
+/**
+ * Use case: argo approves an outside MCP client as a party, at its first
+ * authorization: the gateway commissions and crews its proxy ship, which
+ * the client then calls the fleet as. One party per client in a fleet.
+ */
+export declare function createApproveClientParty(deps: ApprovalDeps): ApproveClientParty;
+export {};

package/dist/core/parties/approve-party.js

@@ -0,0 +1,127 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+import { verifiedFactsOf } from './party.js';
+import { shownPartyOf } from './shown-party.js';
+/** The type of every outside MCP server's proxy ship. */
+export const MCP_SERVER_SHIP_TYPE = 'mcp-server';
+/** The type of every outside MCP client's proxy ship. */
+export const MCP_CLIENT_SHIP_TYPE = 'mcp-client';
+/**
+ * The approval flow every party shares (interop I-5). The gateway, as its
+ * own ship, commissions the party's app proxy ship owned by the owner argo
+ * picked (decisions 0044, 0045), under argo's request id as the idempotency
+ * key, then crews it with its secret and keeps the crew token. Each step is
+ * kept before the next, so the same approval again picks up where a crash or
+ * a fleet that did not answer left it, and commissions no second ship. A
+ * commission the fleet stored but whose answer was lost leaves the ship
+ * awaiting crew: its secret was shown once. A refused commission keeps
+ * nothing, so argo may approve again. While the fleet's outside parties are
+ * off, nothing is approved (interop I-3).
+ */
+async function approved(deps, approval) {
+    /**
+     * The crewed party, once the gateway wrote what it checked about it
+     * (decision 0059). A fact the fleet refuses takes nothing from the
+     * approval: the facts are a claim beside it, written again when the same
+     * approval comes again.
+     */
+    const verified = async (party, gatewayCrewToken) => {
+        const facts = verifiedFactsOf(party);
+        if (party.proxyShipId !== null && facts.length > 0) {
+            await deps.door.setVerifiedFacts(gatewayCrewToken, { shipId: party.proxyShipId, facts });
+        }
+        return ok(shownPartyOf(party));
+    };
+    const crewed = async (party, gatewayCrewToken) => {
+        const registered = await deps.door.register({ shipId: party.proxyShipId, secret: party.secret });
+        if (!registered.isOk) {
+            return refuse('FLEET_UNAVAILABLE', `The fleet did not let the gateway crew the proxy ship: ${registered.error.message}`);
+        }
+        const done = { ...party, state: 'crewed', secret: null, crewToken: registered.value.crewToken };
+        await deps.parties.save(done);
+        return verified(done, gatewayCrewToken);
+    };
+    const { fleetId } = approval;
+    if (!(await deps.servesOutsideParties(fleetId))) {
+        return refuse('OUTSIDE_PARTIES_OFF', "This fleet's outside parties are off: turn them on first");
+    }
+    const gateway = await deps.connections.find(fleetId);
+    if (!gateway) {
+        return refuse('NOT_CONNECTED', 'The gateway is not connected to this fleet: connect it in the console');
+    }
+    const fresh = approval.party({ approvedAt: deps.clock.now() });
+    const earlier = await deps.parties.find(fleetId, fresh.name);
+    if (earlier && (!approval.isOwn(earlier) || earlier.requestHash !== approval.requestHash)) {
+        return refuse('PARTY_EXISTS', `A party named ${fresh.name} was approved already`);
+    }
+    const party = earlier ?? fresh;
+    if (party.state === 'crewed') {
+        return verified(party, gateway.crewToken);
+    }
+    if (party.proxyShipId !== null && party.secret !== null) {
+        return crewed({ ...party, proxyShipId: party.proxyShipId, secret: party.secret }, gateway.crewToken);
+    }
+    if (party.proxyShipId !== null) {
+        return ok(shownPartyOf(party));
+    }
+    await deps.parties.save(party);
+    const commissioned = await deps.door.commissionAppShip(gateway.crewToken, { name: party.name, type: approval.type, owner: approval.owner, idempotencyKey: party.requestId, scopes: approval.scopes });
+    if (!commissioned.isOk) {
+        if (commissioned.error.code === 'UNAVAILABLE') {
+            return refuse('FLEET_UNAVAILABLE', `The fleet did not answer the commission: ${commissioned.error.message}`);
+        }
+        await deps.parties.remove(fleetId, party.name);
+        return refuse('COMMISSION_REFUSED', `The fleet refused the proxy ship: ${commissioned.error.message}`);
+    }
+    const { shipId, secret } = commissioned.value;
+    const awaiting = { ...party, state: 'awaitingCrew', proxyShipId: shipId, secret };
+    await deps.parties.save(awaiting);
+    return secret === null ? ok(shownPartyOf(awaiting)) : crewed({ ...awaiting, proxyShipId: shipId, secret }, gateway.crewToken);
+}
+/** What a party is before its proxy ship is commissioned. */
+const UNCOMMISSIONED = { state: 'commissioning', proxyShipId: null, secret: null, crewToken: null };
+/**
+ * Use case: argo approves an outside MCP server as a party of its fleet: the
+ * gateway commissions and crews its proxy ship, and keeps the server's
+ * credential in its vault.
+ */
+export function createApproveParty(deps) {
+    return (input) => {
+        const { operatorFleetId: fleetId, requestId, name, url, credential, ownerShipId, scopes, concurrencyLimit } = input;
+        const requestHash = deps.hasher.hash(JSON.stringify([requestId, name, url, credential, ownerShipId, scopes, concurrencyLimit]));
+        return approved(deps, {
+            fleetId,
+            type: MCP_SERVER_SHIP_TYPE,
+            scopes,
+            requestHash,
+            owner: ownerShipId,
+            party: ({ approvedAt }) => ({ fleetId, name, kind: 'mcpServer', url, credential, concurrencyLimit, ...UNCOMMISSIONED, requestId, requestHash, approvedAt }),
+            isOwn: (earlier) => earlier.kind === 'mcpServer',
+        });
+    };
+}
+/**
+ * Use case: argo approves an outside MCP client as a party, at its first
+ * authorization: the gateway commissions and crews its proxy ship, which
+ * the client then calls the fleet as. One party per client in a fleet.
+ */
+export function createApproveClientParty(deps) {
+    return async (input) => {
+        const { operatorFleetId: fleetId, requestId, name, clientId, ownerShipId, scopes } = input;
+        const held = await deps.parties.findByClient(fleetId, clientId);
+        if (held && held.name !== name) {
+            return refuse('CLIENT_HAS_PARTY', `This client is the party ${held.name} already`);
+        }
+        const requestHash = deps.hasher.hash(JSON.stringify([requestId, name, clientId, ownerShipId, scopes]));
+        return approved(deps, {
+            fleetId,
+            type: MCP_CLIENT_SHIP_TYPE,
+            scopes,
+            requestHash,
+            owner: ownerShipId,
+            party: ({ approvedAt }) => ({ fleetId, name, kind: 'mcpClient', clientId, ...UNCOMMISSIONED, requestId, requestHash, approvedAt }),
+            isOwn: (earlier) => earlier.kind === 'mcpClient',
+        });
+    };
+}
+//# sourceMappingURL=approve-party.js.map

package/dist/core/parties/approve-party.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approve-party.js","sourceRoot":"","sources":["../../../src/core/parties/approve-party.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAwD,MAAM,YAAY,CAAC;AAEnG,OAAO,EAAE,YAAY,EAAmB,MAAM,kBAAkB,CAAC;AAEjE,yDAAyD;AACzD,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAEjD,yDAAyD;AACzD,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AAgDjD;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,QAAQ,CAAkB,IAAkB,EAAE,QAAqB;IAChF;;;;;OAKG;IACH,MAAM,QAAQ,GAAG,KAAK,EAAE,KAAQ,EAAE,gBAAwB,EAAoD,EAAE;QAC9G,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,EAAE,KAAkD,EAAE,gBAAwB,EAAoD,EAAE;QACtJ,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACjG,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACrB,OAAO,MAAM,CAAC,mBAAmB,EAAE,0DAA0D,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3H,CAAC;QACD,MAAM,IAAI,GAAM,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACnG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,OAAO,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC1C,CAAC,CAAC;IAEF,MAAM,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;IAC7B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,qBAAqB,EAAE,0DAA0D,CAAC,CAAC;IACnG,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,MAAM,CAAC,eAAe,EAAE,uEAAuE,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7D,IAAI,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,WAAW,KAAK,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1F,OAAO,MAAM,CAAC,cAAc,EAAE,iBAAiB,KAAK,CAAC,IAAI,uBAAuB,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,KAAK,GAAM,OAAO,IAAI,KAAK,CAAC;IAClC,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACxD,OAAO,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACvG,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAE/B,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,cAAc,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACtM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACvB,IAAI,YAAY,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAC9C,OAAO,MAAM,CAAC,mBAAmB,EAAE,4CAA4C,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,MAAM,CAAC,oBAAoB,EAAE,qCAAqC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC;IAC9C,MAAM,QAAQ,GAAM,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACrF,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClC,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;AAChI,CAAC;AAED,6DAA6D;AAC7D,MAAM,cAAc,GAAG,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAW,CAAC;AAE7G;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAkB;IACnD,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC;QACpH,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;QAChI,OAAO,QAAQ,CAAiB,IAAI,EAAE;YACpC,OAAO;YACP,IAAI,EAAE,oBAAoB;YAC1B,MAAM;YACN,WAAW;YACX,KAAK,EAAE,WAAW;YAClB,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,gBAAgB,EAAE,GAAG,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;YAC3J,KAAK,EAAE,CAAC,OAAO,EAA6B,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW;SAC5E,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAkB;IACzD,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;QAC3F,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAChE,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC,kBAAkB,EAAE,4BAA4B,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACvG,OAAO,QAAQ,CAAiB,IAAI,EAAE;YACpC,OAAO;YACP,IAAI,EAAE,oBAAoB;YAC1B,MAAM;YACN,WAAW;YACX,KAAK,EAAE,WAAW;YAClB,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;YAClI,KAAK,EAAE,CAAC,OAAO,EAA6B,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW;SAC5E,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/change-party.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Changing an outside party (decision 0056): the usual scopes on its proxy
+ * ship, within manage reach. fleet:owner changes its owner, scopes:grant its
+ * scopes, only scopes the actor holds. The gateway checks the actor holds
+ * the call's scope, then asks the fleet as the actor, which checks the rest;
+ * the gateway keeps nothing of either, as the fleet's are the answer.
+ */
+import type { ShipId } from '@aeolus-fleet/common';
+import type { Actor } from '../actors/authenticate-actor.js';
+import type { ActorCredential, CredentialOf } from '../actors/credential-of.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { PartyStore, ProxyShipsAsActor } from './ports.js';
+/** The scope that changes an outside party's owner (0053). */
+export declare const OWNING_SCOPE = "fleet:owner";
+/** The scope that grants and revokes an outside party's scopes (0046). */
+export declare const GRANTING_SCOPE = "scopes:grant";
+export type ChangePartyRefusal = DomainError<'SCOPE_NOT_HELD' | 'NO_SUCH_PARTY' | 'PARTY_NOT_COMMISSIONED' | 'CHANGE_REFUSED' | 'FLEET_UNAVAILABLE' | 'NOT_AN_ACTOR'>;
+interface ChangeDeps {
+    parties: PartyStore;
+    fleet: ProxyShipsAsActor;
+    credentialOf: CredentialOf;
+}
+interface ChangeCall {
+    actor: Actor;
+    as: ActorCredential;
+    name: string;
+}
+export type ChangePartyOwner = (input: ChangeCall & {
+    ownerShipId: ShipId;
+}) => Promise<Result<undefined, ChangePartyRefusal>>;
+export type ChangePartyScopes = (input: ChangeCall & {
+    grant: readonly string[];
+    revoke: readonly string[];
+}) => Promise<Result<{
+    scopes: string[];
+}, ChangePartyRefusal>>;
+/** Use case: an actor holding fleet:owner sets the owner of an outside party's proxy ship, as itself. */
+export declare function createChangePartyOwner(deps: ChangeDeps): ChangePartyOwner;
+/** Use case: an actor holding scopes:grant grants and revokes scopes on an outside party's proxy ship, as itself: every scope it holds now. */
+export declare function createChangePartyScopes(deps: ChangeDeps): ChangePartyScopes;
+export {};