@aeolus-fleet/gateway 0.0.0-stage → 0.28.0

package/dist/core/people/read-inbox.js

@@ -0,0 +1,36 @@
+import { ok } from '../shared/result.js';
+import { inboxEntryOf } from './inbox-entry.js';
+import { asPersonCrew } from './person-crew.js';
+/** The most deliveries an inbox lists at once: as many as one receive takes. */
+export const INBOX_LIST_MAX = 10;
+/**
+ * What waits for the caller's person ship: how many, and up to the most an
+ * inbox lists, taken as received, the crew's own held ones again first. It
+ * asks how many wait first, so the person is never kept waiting while none
+ * does.
+ */
+export async function waitingFor(deps, caller) {
+    const counted = await asPersonCrew(deps, { caller, run: (crew) => deps.door.inbox(crew.crewToken) });
+    if (!counted.isOk) {
+        return counted;
+    }
+    const { crew, value } = counted.value;
+    if (value.waiting === 0) {
+        return ok({ crew, waiting: 0, deliveries: [] });
+    }
+    const taken = await asPersonCrew(deps, { caller, run: (held) => deps.door.pushReceive(held.crewToken, { max: INBOX_LIST_MAX }) });
+    return taken.isOk ? ok({ crew: taken.value.crew, waiting: value.waiting, deliveries: taken.value.value }) : taken;
+}
+/**
+ * Use case: a person reads their own person ship's inbox (Q20): what waits,
+ * by titles only. The gateway takes the waiting deliveries as the ship's
+ * crew, so nothing is stored in the gateway, and a delivery listed is listed
+ * again until the person deals with it.
+ */
+export function createReadInbox(deps) {
+    return async (caller) => {
+        const waiting = await waitingFor(deps, caller);
+        return waiting.isOk ? ok({ waiting: waiting.value.waiting, deliveries: waiting.value.deliveries.map(inboxEntryOf) }) : waiting;
+    };
+}
+//# sourceMappingURL=read-inbox.js.map

package/dist/core/people/read-inbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-inbox.js","sourceRoot":"","sources":["../../../src/core/people/read-inbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,YAAY,EAAmB,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAiE,MAAM,kBAAkB,CAAC;AAG/G,gFAAgF;AAChF,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAIjC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAkF,EAClF,MAAoB;IAEpB,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACrG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;IACtC,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,CAAC;IAClI,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACpH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAAkF;IAChH,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE;QACtB,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACjI,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/requests/ask-for-client.d.ts

@@ -0,0 +1,45 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { AuthorizationCodes, OAuthSecrets } from '../oauth/ports.js';
+import type { AuthorizationRequest } from '../oauth/read-authorization.js';
+import type { PartyStore } from '../parties/ports.js';
+import type { Clock } from '../shared/clock.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { OpenRequest } from './open-request.js';
+import type { PendingRequests, Requester, WaitingSeals } from './ports.js';
+/** What asking answers: where the client is sent back now, or the sealed waiting the browser waits on. */
+export type ClientAnswer = {
+    readonly kind: 'answered';
+    readonly redirectTo: string;
+} | {
+    readonly kind: 'waiting';
+    readonly waiting: string;
+};
+export type AskForClient = (asked: {
+    fleetId: FleetId;
+    requester: Requester;
+    authorization: AuthorizationRequest;
+    /** The client's request as it came, read again while the browser waits. */
+    request: Readonly<Record<string, string | undefined>>;
+    browserSecret: string;
+}) => Promise<Result<ClientAnswer, DomainError<'OUTSIDE_PARTIES_OFF'>>>;
+/**
+ * Use case: an account of the fleet, signed in, asks for access for an
+ * outside MCP client (decision 0056, Thomas's question A). A client that is
+ * a party already gets its party's code at once. A deny or an expired
+ * request the account asked for ends its next try with access_denied, once;
+ * otherwise the account opens a request, or joins the one pending, and its
+ * browser waits for the decision. While the fleet's outside parties are off,
+ * nobody asks (interop I-3).
+ */
+export declare function createAskForClient(deps: {
+    parties: PartyStore;
+    requests: PendingRequests;
+    openRequest: OpenRequest;
+    servesOutsideParties: (fleetId: FleetId) => Promise<boolean>;
+    waitings: WaitingSeals;
+    codes: AuthorizationCodes;
+    secrets: OAuthSecrets;
+    clock: Clock;
+    issuer: string;
+}): AskForClient;

package/dist/core/requests/ask-for-client.js

@@ -0,0 +1,33 @@
+import { issueCode, redirectWith } from '../oauth/issue-code.js';
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+import { isRefused } from './request-state.js';
+/**
+ * Use case: an account of the fleet, signed in, asks for access for an
+ * outside MCP client (decision 0056, Thomas's question A). A client that is
+ * a party already gets its party's code at once. A deny or an expired
+ * request the account asked for ends its next try with access_denied, once;
+ * otherwise the account opens a request, or joins the one pending, and its
+ * browser waits for the decision. While the fleet's outside parties are off,
+ * nobody asks (interop I-3).
+ */
+export function createAskForClient(deps) {
+    return async ({ fleetId, requester, authorization, request, browserSecret }) => {
+        if (!(await deps.servesOutsideParties(fleetId))) {
+            return refuse('OUTSIDE_PARTIES_OFF', "This fleet's outside parties are off: nobody asks for an outside MCP client");
+        }
+        const party = await deps.parties.findByClient(fleetId, authorization.clientId);
+        if (party?.state === 'crewed') {
+            return ok({ kind: 'answered', redirectTo: await issueCode(deps, { fleetId, authorization, holder: { kind: 'party', party: party.name } }) });
+        }
+        const subject = { kind: 'client', clientId: authorization.clientId, clientName: authorization.clientName };
+        const latest = await deps.requests.latestAskedBy(fleetId, { subject, accountId: requester.accountId });
+        if (latest !== undefined && !latest.isTold && isRefused(latest.request, deps.clock.now())) {
+            await deps.requests.markTold(fleetId, { requestId: latest.request.requestId, accountId: requester.accountId });
+            return ok({ kind: 'answered', redirectTo: redirectWith(authorization.redirectUri, { error: 'access_denied', state: authorization.state, iss: deps.issuer }) });
+        }
+        const opened = await deps.openRequest({ fleetId, subject, requester });
+        return ok({ kind: 'waiting', waiting: deps.waitings.seal({ fleetId, requestId: opened.requestId, accountId: requester.accountId, browserSecret, request }) });
+    };
+}
+//# sourceMappingURL=ask-for-client.js.map

package/dist/core/requests/ask-for-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ask-for-client.js","sourceRoot":"","sources":["../../../src/core/requests/ask-for-client.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAKjE,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAGtD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAc/C;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAUlC;IACC,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE;QAC7E,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAChD,OAAO,MAAM,CAAC,qBAAqB,EAAE,6EAA6E,CAAC,CAAC;QACtH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC/E,IAAI,KAAK,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/I,CAAC;QACD,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,UAAU,EAAE,aAAa,CAAC,UAAU,EAAW,CAAC;QACpH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;QACvG,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YAC1F,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;YAC/G,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACjK,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QACvE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChK,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/requests/ask-for-server.d.ts

@@ -0,0 +1,32 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { PartyStore } from '../parties/ports.js';
+import type { PersonCaller } from '../people/person-crew.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { AccountGrants } from '../sign-in/ports.js';
+import type { OpenRequest } from './open-request.js';
+import type { RequestState } from './ports.js';
+/** What asking answers the person: their request, by its id, and until when it waits. */
+export interface AskedServer {
+    readonly requestId: string;
+    readonly url: string;
+    readonly state: RequestState;
+    readonly expiresAt: Date;
+}
+export type AskForServer = (asked: {
+    caller: PersonCaller;
+    url: string;
+}) => Promise<Result<AskedServer, DomainError<'INVALID_SERVER_URL' | 'OUTSIDE_PARTIES_OFF' | 'SIGNED_OUT' | 'PARTY_EXISTS'>>>;
+/**
+ * Use case: a signed-in person asks for an outside MCP server, as their
+ * account (decision 0056). An outside MCP server never asks itself: an
+ * approver adds it, giving its credential. A second person asking for the
+ * same server joins the request pending. While the fleet's outside parties
+ * are off, nobody asks (interop I-3).
+ */
+export declare function createAskForServer(deps: {
+    grants: AccountGrants;
+    parties: PartyStore;
+    openRequest: OpenRequest;
+    servesOutsideParties: (fleetId: FleetId) => Promise<boolean>;
+}): AskForServer;

package/dist/core/requests/ask-for-server.js

@@ -0,0 +1,42 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+/** The server's address as a URL reads it, so one server written two ways is one request; none for an address that is not http or https. */
+function serverUrlOf(text) {
+    try {
+        const url = new URL(text);
+        return url.protocol === 'https:' || url.protocol === 'http:' ? url.toString() : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Use case: a signed-in person asks for an outside MCP server, as their
+ * account (decision 0056). An outside MCP server never asks itself: an
+ * approver adds it, giving its credential. A second person asking for the
+ * same server joins the request pending. While the fleet's outside parties
+ * are off, nobody asks (interop I-3).
+ */
+export function createAskForServer(deps) {
+    return async ({ caller, url: written }) => {
+        const url = serverUrlOf(written);
+        if (url === undefined) {
+            return refuse('INVALID_SERVER_URL', `${written} is no address of an MCP server: give its https URL`);
+        }
+        const { fleetId } = caller;
+        if (!(await deps.servesOutsideParties(fleetId))) {
+            return refuse('OUTSIDE_PARTIES_OFF', "This fleet's outside parties are off: nobody asks for an outside MCP server");
+        }
+        const grant = await deps.grants.find(fleetId, caller.grantId);
+        if (grant === undefined) {
+            return refuse('SIGNED_OUT', 'Your sign-in ended: sign in again from your MCP client');
+        }
+        const party = (await deps.parties.list(fleetId)).find((each) => each.kind === 'mcpServer' && each.url === url);
+        if (party !== undefined) {
+            return refuse('PARTY_EXISTS', `${url} is the outside party ${party.name} already`);
+        }
+        const request = await deps.openRequest({ fleetId, subject: { kind: 'server', url }, requester: { accountId: grant.accountId, personShipId: grant.personShipId } });
+        return ok({ requestId: request.requestId, url, state: request.state, expiresAt: request.expiresAt });
+    };
+}
+//# sourceMappingURL=ask-for-server.js.map

package/dist/core/requests/ask-for-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ask-for-server.js","sourceRoot":"","sources":["../../../src/core/requests/ask-for-server.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAiBtD,4IAA4I;AAC5I,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAA4I;IAC7K,OAAO,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE;QACxC,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,oBAAoB,EAAE,GAAG,OAAO,qDAAqD,CAAC,CAAC;QACvG,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;QAC3B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAChD,OAAO,MAAM,CAAC,qBAAqB,EAAE,6EAA6E,CAAC,CAAC;QACtH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,MAAM,CAAC,YAAY,EAAE,wDAAwD,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;QAC/G,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,MAAM,CAAC,cAAc,EAAE,GAAG,GAAG,yBAAyB,KAAK,CAAC,IAAI,UAAU,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACnK,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACvG,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/requests/ask-owners.d.ts

@@ -0,0 +1,28 @@
+import type { ConnectionStore } from '../connection/ports.js';
+import type { CallSender } from '../mcp-in/ports.js';
+import type { Clock } from '../shared/clock.js';
+import type { Owners, OwnerQuestions } from './ports.js';
+/** Asks the gateway's owner about the requests not asked yet, and withdraws the questions whose request ended: how it went. */
+export type AskOwners = () => Promise<{
+    asked: number;
+    withdrawn: number;
+    kept: number;
+    refused: number;
+}>;
+/**
+ * Use case: the gateway's ship asks its owner, read from the fleet, about
+ * each request that opened (decision 0056, 0038), argo too when argo owns it
+ * (P6-1 a), and withdraws the question once the request is decided or
+ * expired. Each goes under a key of the request, so one sent again after the
+ * fleet did not answer is stored once; one the fleet refused is not sent
+ * again. A fleet the gateway is not connected to waits.
+ */
+export declare function createAskOwners(deps: {
+    questions: OwnerQuestions;
+    connections: ConnectionStore;
+    owners: Owners;
+    sender: CallSender;
+    newQuestionId: () => string;
+    clock: Clock;
+    overviewUrl: string;
+}): AskOwners;

package/dist/core/requests/ask-owners.js

@@ -0,0 +1,85 @@
+import { QUESTION_CONTENT_TYPE, WITHDRAWAL_CONTENT_TYPE } from '@aeolus-fleet/common';
+/** How many requests one round asks about, and how many questions it withdraws, at most. */
+const QUESTIONS_PER_ROUND = 50;
+const dayOf = (at) => at.toISOString().slice(0, 'yyyy-mm-dd'.length);
+/** The question about one request: it points to the overview, where any approver decides (Q5 b, P6-2 b). */
+function questionOf(request, ids) {
+    const { subject } = request;
+    const people = request.requesters.length === 1 ? '1 person' : `${String(request.requesters.length)} people`;
+    const about = subject.kind === 'client'
+        ? { title: `${subject.clientName} asks for access to the fleet`, what: 'An MCP client asks to act in the fleet as an outside party.' }
+        : { title: `Someone asks to add ${subject.url} to the fleet`, what: 'A person asks for an outside MCP server, whose tools would reach the fleet.' };
+    return {
+        id: ids.questionId,
+        title: about.title,
+        context: `${about.what} Asked by ${people} on ${dayOf(request.askedAt)}; it waits until ${dayOf(request.expiresAt)}, then expires. Any holder of gateway:approve decides on ${ids.overviewUrl}.`,
+        options: [{ key: 1, label: "Decide on the gateway's page", detail: ids.overviewUrl }],
+        pick: { option: 1, why: 'Approving names the outside party, its owner and its scopes, which the page asks for.' },
+    };
+}
+/**
+ * Use case: the gateway's ship asks its owner, read from the fleet, about
+ * each request that opened (decision 0056, 0038), argo too when argo owns it
+ * (P6-1 a), and withdraws the question once the request is decided or
+ * expired. Each goes under a key of the request, so one sent again after the
+ * fleet did not answer is stored once; one the fleet refused is not sent
+ * again. A fleet the gateway is not connected to waits.
+ */
+export function createAskOwners(deps) {
+    return async () => {
+        const now = deps.clock.now();
+        const counted = { asked: 0, withdrawn: 0, kept: 0, refused: 0 };
+        for (const { request, questionId: held } of await deps.questions.listToAsk(now, QUESTIONS_PER_ROUND)) {
+            const gateway = await deps.connections.find(request.fleetId);
+            const owner = gateway === undefined ? undefined : await deps.owners.ownerOf(gateway.crewToken, gateway.shipId);
+            if (gateway === undefined || owner === undefined || (!owner.isOk && owner.error.code === 'UNAVAILABLE')) {
+                counted.kept += 1;
+                continue;
+            }
+            const questionId = await deps.questions.keep(request.fleetId, { requestId: request.requestId, questionId: held ?? deps.newQuestionId() });
+            const asked = owner.isOk && owner.value !== null ? owner.value : null;
+            const sent = asked === null
+                ? undefined
+                : await deps.sender.send(gateway.crewToken, {
+                    to: asked,
+                    contentType: QUESTION_CONTENT_TYPE,
+                    payload: JSON.stringify(questionOf(request, { questionId, overviewUrl: deps.overviewUrl })),
+                    idempotencyKey: `${request.requestId}:question`,
+                });
+            if (sent !== undefined && !sent.isOk && sent.error.code === 'UNAVAILABLE') {
+                counted.kept += 1;
+                continue;
+            }
+            const isAsked = sent?.isOk === true;
+            await deps.questions.markAsked(request.fleetId, { requestId: request.requestId, askedShipId: isAsked ? asked : null, at: now });
+            if (isAsked) {
+                counted.asked += 1;
+            }
+            else {
+                counted.refused += 1;
+            }
+        }
+        for (const question of await deps.questions.listToWithdraw(now, QUESTIONS_PER_ROUND)) {
+            const gateway = await deps.connections.find(question.fleetId);
+            if (gateway === undefined || question.askedShipId === null) {
+                counted.kept += 1;
+                continue;
+            }
+            const sent = await deps.sender.send(gateway.crewToken, {
+                to: question.askedShipId,
+                contentType: WITHDRAWAL_CONTENT_TYPE,
+                payload: JSON.stringify({ questionId: question.questionId }),
+                idempotencyKey: `${question.requestId}:withdrawal`,
+            });
+            if (!sent.isOk && sent.error.code === 'UNAVAILABLE') {
+                counted.kept += 1;
+                continue;
+            }
+            await deps.questions.markWithdrawn(question.fleetId, { requestId: question.requestId, at: now });
+            counted.withdrawn += sent.isOk ? 1 : 0;
+            counted.refused += sent.isOk ? 0 : 1;
+        }
+        return counted;
+    };
+}
+//# sourceMappingURL=ask-owners.js.map

package/dist/core/requests/ask-owners.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ask-owners.js","sourceRoot":"","sources":["../../../src/core/requests/ask-owners.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAOtF,4FAA4F;AAC5F,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAK/B,MAAM,KAAK,GAAG,CAAC,EAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;AAE3E,4GAA4G;AAC5G,SAAS,UAAU,CAAC,OAAuB,EAAE,GAAgD;IAC3F,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC;IAC5G,MAAM,KAAK,GACT,OAAO,CAAC,IAAI,KAAK,QAAQ;QACvB,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,UAAU,+BAA+B,EAAE,IAAI,EAAE,6DAA6D,EAAE;QACtI,CAAC,CAAC,EAAE,KAAK,EAAE,uBAAuB,OAAO,CAAC,GAAG,eAAe,EAAE,IAAI,EAAE,6EAA6E,EAAE,CAAC;IACxJ,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,UAAU;QAClB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,aAAa,MAAM,OAAO,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,4DAA4D,GAAG,CAAC,WAAW,GAAG;QAChM,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,MAAM,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC;QACrF,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,uFAAuF,EAAE;KAClH,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,IAQ/B;IACC,OAAO,KAAK,IAAI,EAAE;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAChE,KAAK,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,EAAE,mBAAmB,CAAC,EAAE,CAAC;YACrG,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC7D,MAAM,KAAK,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/G,IAAI,OAAO,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,CAAC,EAAE,CAAC;gBACxG,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,IAAI,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;YAC1I,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;YACtE,MAAM,IAAI,GACR,KAAK,KAAK,IAAI;gBACZ,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE;oBACxC,EAAE,EAAE,KAAK;oBACT,WAAW,EAAE,qBAAqB;oBAClC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;oBAC3F,cAAc,EAAE,GAAG,OAAO,CAAC,SAAS,WAAW;iBAChD,CAAC,CAAC;YACT,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBAC1E,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;YACpC,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YAChI,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC;YACrB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,GAAG,EAAE,mBAAmB,CAAC,EAAE,CAAC;YACrF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC9D,IAAI,OAAO,KAAK,SAAS,IAAI,QAAQ,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;gBAC3D,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE;gBACrD,EAAE,EAAE,QAAQ,CAAC,WAAW;gBACxB,WAAW,EAAE,uBAAuB;gBACpC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC;gBAC5D,cAAc,EAAE,GAAG,QAAQ,CAAC,SAAS,aAAa;aACnD,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBACpD,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,MAAM,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;YACjG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/requests/decide-request.d.ts

@@ -0,0 +1,53 @@
+import type { ShipId } from '@aeolus-fleet/common';
+import type { Actor } from '../actors/authenticate-actor.js';
+import type { ApproveClientParty, ApproveParty, ApprovePartyRefusal } from '../parties/approve-party.js';
+import type { ShownParty } from '../parties/shown-party.js';
+import type { Clock } from '../shared/clock.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { McpServerCredential } from '../vault/credential.js';
+import type { PendingRequests } from './ports.js';
+/** The scope the gateway declares for approving outside parties (decision 0056). */
+export declare const APPROVING_SCOPE = "gateway:approve";
+/** An approval: the proxy ship's name, its owner (a person ship) and its scopes; for a server, its credential and how many calls it takes at once. */
+export interface Approval {
+    readonly kind: 'approve';
+    readonly party: {
+        readonly name: string;
+        readonly ownerShipId: ShipId;
+        readonly scopes: readonly string[];
+    };
+    readonly server?: {
+        readonly credential: McpServerCredential;
+        readonly concurrencyLimit: number;
+    };
+}
+export type Decision = Approval | {
+    readonly kind: 'deny';
+};
+export type DecideRefusal = DomainError<'NOT_AN_APPROVER' | 'NO_SUCH_REQUEST' | 'ALREADY_DECIDED' | 'EXPIRED' | 'SCOPE_NOT_HELD' | 'SERVER_DETAILS_MISSING' | 'CLIENT_HAS_PARTY'> | ApprovePartyRefusal;
+export type DecideRequest = (input: {
+    actor: Actor;
+    requestId: string;
+    decision: Decision;
+}) => Promise<Result<{
+    state: 'approved' | 'denied';
+    party: ShownParty | null;
+}, DecideRefusal>>;
+/**
+ * Use case: an actor holding gateway:approve decides a pending request
+ * (decision 0056). The first decision counts. Approving grants only scopes
+ * the approver holds; the gateway, as its own ship, commissions the proxy
+ * ship with them, and the fleet refuses any its ship does not hold. While
+ * the proxy ship is commissioned the request is approving, under its id as
+ * the commission's key, so an approval tried again after the fleet did not
+ * answer commissions one ship; a refused commission gives the request back
+ * as pending, undecided. The decision is written with its outcomes to tell,
+ * so no requester's message is lost.
+ */
+export declare function createDecideRequest(deps: {
+    requests: PendingRequests;
+    approveParty: ApproveParty;
+    approveClientParty: ApproveClientParty;
+    clock: Clock;
+}): DecideRequest;

package/dist/core/requests/decide-request.js

@@ -0,0 +1,83 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+import { noticesOf } from './outcome-notice.js';
+/** The scope the gateway declares for approving outside parties (decision 0056). */
+export const APPROVING_SCOPE = 'gateway:approve';
+/** The scopes every app ship gets (decision 0046), so an approver need not hold them to grant them. */
+const EVERY_APP_SHIP_SCOPES = new Set(['messages:send', 'messages:receive']);
+function decidedByOf(actor) {
+    switch (actor.kind) {
+        case 'ship':
+            return { kind: 'ship', shipId: actor.shipId };
+        case 'account':
+            return { kind: 'account', accountId: actor.accountId };
+        case 'operator':
+        case 'viewer':
+            return { kind: actor.kind };
+    }
+}
+/**
+ * Use case: an actor holding gateway:approve decides a pending request
+ * (decision 0056). The first decision counts. Approving grants only scopes
+ * the approver holds; the gateway, as its own ship, commissions the proxy
+ * ship with them, and the fleet refuses any its ship does not hold. While
+ * the proxy ship is commissioned the request is approving, under its id as
+ * the commission's key, so an approval tried again after the fleet did not
+ * answer commissions one ship; a refused commission gives the request back
+ * as pending, undecided. The decision is written with its outcomes to tell,
+ * so no requester's message is lost.
+ */
+export function createDecideRequest(deps) {
+    const approve = (request, approval) => {
+        const { name, ownerShipId, scopes } = approval.party;
+        const granted = scopes.filter((scope) => !EVERY_APP_SHIP_SCOPES.has(scope));
+        const party = { operatorFleetId: request.fleetId, requestId: request.requestId, name, ownerShipId, scopes: granted };
+        if (request.subject.kind === 'client') {
+            return deps.approveClientParty({ ...party, clientId: request.subject.clientId });
+        }
+        return approval.server === undefined
+            ? Promise.resolve(refuse('SERVER_DETAILS_MISSING', 'Adding an outside MCP server needs its credential and how many calls it takes at once'))
+            : deps.approveParty({ ...party, url: request.subject.url, ...approval.server });
+    };
+    return async ({ actor, requestId, decision }) => {
+        if (!actor.scopes.includes(APPROVING_SCOPE)) {
+            return refuse('NOT_AN_APPROVER', `Deciding requests needs ${APPROVING_SCOPE}`);
+        }
+        const request = await deps.requests.find(actor.fleetId, requestId);
+        if (request === undefined) {
+            return refuse('NO_SUCH_REQUEST', `No request ${requestId} in this fleet`);
+        }
+        const now = deps.clock.now();
+        if (request.state === 'approved' || request.state === 'denied') {
+            return refuse('ALREADY_DECIDED', `This request was ${request.state} already`);
+        }
+        if (request.state === 'expired' || (request.state === 'pending' && request.expiresAt <= now)) {
+            return refuse('EXPIRED', 'This request expired after 7 days: a new request asks anew');
+        }
+        const decided = { outcome: decision.kind === 'deny' ? 'denied' : 'approved', decidedBy: decidedByOf(actor), decidedAt: now };
+        if (decision.kind === 'deny') {
+            const isDenied = await deps.requests.decide(actor.fleetId, { requestId, from: ['pending'], decision: decided, notices: noticesOf(request, { outcome: 'denied', partyName: null }) });
+            return isDenied ? ok({ state: 'denied', party: null }) : refuse('ALREADY_DECIDED', 'This request is decided already');
+        }
+        const notHeld = decision.party.scopes.find((scope) => !EVERY_APP_SHIP_SCOPES.has(scope) && !actor.scopes.includes(scope));
+        if (notHeld !== undefined) {
+            return refuse('SCOPE_NOT_HELD', `You may grant only scopes you hold: not ${notHeld}`);
+        }
+        if (request.subject.kind === 'server' && decision.server === undefined) {
+            return refuse('SERVER_DETAILS_MISSING', 'Adding an outside MCP server needs its credential and how many calls it takes at once');
+        }
+        if (request.state === 'pending' && !(await deps.requests.claim(actor.fleetId, { requestId, now }))) {
+            return refuse('ALREADY_DECIDED', 'This request is decided already');
+        }
+        const party = await approve(request, decision);
+        if (!party.isOk) {
+            if (party.error.kind !== 'FLEET_UNAVAILABLE') {
+                await deps.requests.release(actor.fleetId, requestId);
+            }
+            return party;
+        }
+        await deps.requests.decide(actor.fleetId, { requestId, from: ['approving'], decision: decided, notices: noticesOf(request, { outcome: 'approved', partyName: party.value.name }) });
+        return ok({ state: 'approved', party: party.value });
+    };
+}
+//# sourceMappingURL=decide-request.js.map

package/dist/core/requests/decide-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decide-request.js","sourceRoot":"","sources":["../../../src/core/requests/decide-request.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGhD,oFAAoF;AACpF,MAAM,CAAC,MAAM,eAAe,GAAG,iBAAiB,CAAC;AAEjD,uGAAuG;AACvG,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC,CAAC;AAiB7E,SAAS,WAAW,CAAC,KAAY;IAC/B,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,MAAM;YACT,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QAChD,KAAK,SAAS;YACZ,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;QACzD,KAAK,UAAU,CAAC;QAChB,KAAK,QAAQ;YACX,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAqH;IACvJ,MAAM,OAAO,GAAG,CAAC,OAAuB,EAAE,QAAkB,EAAE,EAAE;QAC9D,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAG,EAAE,eAAe,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QACrH,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC,kBAAkB,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,QAAQ,CAAC,MAAM,KAAK,SAAS;YAClC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,wBAAwB,EAAE,uFAAuF,CAAC,CAAC;YAC5I,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IACpF,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE;QAC9C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,iBAAiB,EAAE,2BAA2B,eAAe,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACnE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,iBAAiB,EAAE,cAAc,SAAS,gBAAgB,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC/D,OAAO,MAAM,CAAC,iBAAiB,EAAE,oBAAoB,OAAO,CAAC,KAAK,UAAU,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,IAAI,GAAG,CAAC,EAAE,CAAC;YAC7F,OAAO,MAAM,CAAC,SAAS,EAAE,4DAA4D,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,OAAO,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAE,QAAkB,CAAC,CAAC,CAAE,UAAoB,EAAE,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;QACnJ,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;YACrL,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;QACxH,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1H,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,gBAAgB,EAAE,2CAA2C,OAAO,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACvE,OAAO,MAAM,CAAC,wBAAwB,EAAE,uFAAuF,CAAC,CAAC;QACnI,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;YACnG,OAAO,MAAM,CAAC,iBAAiB,EAAE,iCAAiC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAChB,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;gBAC7C,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YACxD,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACpL,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;IACvD,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/requests/expire-requests.d.ts

@@ -0,0 +1,14 @@
+import type { Clock } from '../shared/clock.js';
+import type { PendingRequests } from './ports.js';
+/** Expires the requests due by now: how many it expired. */
+export type ExpireRequests = () => Promise<number>;
+/**
+ * Use case: a request no approver decided in 7 days expires (decision 0056),
+ * in every fleet, with its outcomes to tell in the same step, so a person who
+ * asked for a server hears it as they hear a decision (P5-1 a). A request
+ * decided meanwhile is not expired.
+ */
+export declare function createExpireRequests(deps: {
+    requests: PendingRequests;
+    clock: Clock;
+}): ExpireRequests;

package/dist/core/requests/expire-requests.js

@@ -0,0 +1,21 @@
+import { noticesOf } from './outcome-notice.js';
+/**
+ * Use case: a request no approver decided in 7 days expires (decision 0056),
+ * in every fleet, with its outcomes to tell in the same step, so a person who
+ * asked for a server hears it as they hear a decision (P5-1 a). A request
+ * decided meanwhile is not expired.
+ */
+export function createExpireRequests(deps) {
+    return async () => {
+        const now = deps.clock.now();
+        let expired = 0;
+        for (const request of await deps.requests.listDue(now)) {
+            const notices = noticesOf(request, { outcome: 'expired', partyName: null });
+            if (await deps.requests.expire(request.fleetId, { requestId: request.requestId, now, notices })) {
+                expired += 1;
+            }
+        }
+        return expired;
+    };
+}
+//# sourceMappingURL=expire-requests.js.map

package/dist/core/requests/expire-requests.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"expire-requests.js","sourceRoot":"","sources":["../../../src/core/requests/expire-requests.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAMhD;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAiD;IACpF,OAAO,KAAK,IAAI,EAAE;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,OAAO,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5E,IAAI,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;gBAChG,OAAO,IAAI,CAAC,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/requests/list-mine.d.ts

@@ -0,0 +1,16 @@
+import type { Actor } from '../actors/authenticate-actor.js';
+import type { Clock } from '../shared/clock.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { PendingRequest, PendingRequests } from './ports.js';
+export type ListMine = (actor: Actor) => Promise<Result<PendingRequest[], DomainError<'NOT_AN_ACCOUNT'>>>;
+/**
+ * Use case: the requests an account asked, in any state, the newest first
+ * (decision 0056: Your requests on the overview). One still pending past its
+ * 7 days reads as expired, as the store marks it only when it is next
+ * opened. Only an account asks, so any other actor has none.
+ */
+export declare function createListMine(deps: {
+    requests: PendingRequests;
+    clock: Clock;
+}): ListMine;

package/dist/core/requests/list-mine.js

@@ -0,0 +1,20 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+import { stateAt } from './request-state.js';
+/**
+ * Use case: the requests an account asked, in any state, the newest first
+ * (decision 0056: Your requests on the overview). One still pending past its
+ * 7 days reads as expired, as the store marks it only when it is next
+ * opened. Only an account asks, so any other actor has none.
+ */
+export function createListMine(deps) {
+    return async (actor) => {
+        if (actor.kind !== 'account') {
+            return refuse('NOT_AN_ACCOUNT', 'Only a person signed in to the gateway has requests of their own');
+        }
+        const now = deps.clock.now();
+        const mine = await deps.requests.listMine(actor.fleetId, actor.accountId);
+        return ok(mine.map((request) => ({ ...request, state: stateAt(request, now) })));
+    };
+}
+//# sourceMappingURL=list-mine.js.map

package/dist/core/requests/list-mine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-mine.js","sourceRoot":"","sources":["../../../src/core/requests/list-mine.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAI7C;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAiD;IAC9E,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC,gBAAgB,EAAE,kEAAkE,CAAC,CAAC;QACtG,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC1E,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACnF,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/requests/list-to-decide.d.ts

@@ -0,0 +1,11 @@
+import type { Actor } from '../actors/authenticate-actor.js';
+import type { Clock } from '../shared/clock.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { PendingRequest, PendingRequests } from './ports.js';
+export type ListToDecide = (actor: Actor) => Promise<Result<PendingRequest[], DomainError<'NOT_AN_APPROVER'>>>;
+/** Use case: every open request of the fleet, for an actor holding gateway:approve (decision 0056: To decide on the overview). */
+export declare function createListToDecide(deps: {
+    requests: PendingRequests;
+    clock: Clock;
+}): ListToDecide;

package/dist/core/requests/list-to-decide.js

@@ -0,0 +1,13 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+import { APPROVING_SCOPE } from './decide-request.js';
+/** Use case: every open request of the fleet, for an actor holding gateway:approve (decision 0056: To decide on the overview). */
+export function createListToDecide(deps) {
+    return async (actor) => {
+        if (!actor.scopes.includes(APPROVING_SCOPE)) {
+            return refuse('NOT_AN_APPROVER', `Deciding requests needs ${APPROVING_SCOPE}`);
+        }
+        return ok(await deps.requests.listOpen(actor.fleetId, deps.clock.now()));
+    };
+}
+//# sourceMappingURL=list-to-decide.js.map

package/dist/core/requests/list-to-decide.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-to-decide.js","sourceRoot":"","sources":["../../../src/core/requests/list-to-decide.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAKtD,kIAAkI;AAClI,MAAM,UAAU,kBAAkB,CAAC,IAAiD;IAClF,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,iBAAiB,EAAE,2BAA2B,eAAe,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,EAAE,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC3E,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/requests/open-request.d.ts

@@ -0,0 +1,21 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { Clock } from '../shared/clock.js';
+import type { PendingRequest, PendingRequests, RequestIds, Requester, RequestSubject } from './ports.js';
+/** How long a request is kept before it expires (decision 0056, Thomas). */
+export declare const REQUEST_LIFETIME_MS: number;
+export type OpenRequest = (asked: {
+    fleetId: FleetId;
+    subject: RequestSubject;
+    requester: Requester;
+}) => Promise<PendingRequest>;
+/**
+ * Use case: an account asks for an outside party (decision 0056). The one
+ * place a request opens, so who may ask is decided here alone (Thomas's
+ * question A): a signed-in account in the fleet, for now. A second request
+ * for the same client or server joins the one open.
+ */
+export declare function createOpenRequest(deps: {
+    requests: PendingRequests;
+    ids: RequestIds;
+    clock: Clock;
+}): OpenRequest;