@aeolus-fleet/gateway 0.0.0-stage → 0.28.0

package/dist/core/requests/open-request.js

@@ -0,0 +1,26 @@
+/** How long a request is kept before it expires (decision 0056, Thomas). */
+export const REQUEST_LIFETIME_MS = 7 * 24 * 60 * 60_000;
+/**
+ * Use case: an account asks for an outside party (decision 0056). The one
+ * place a request opens, so who may ask is decided here alone (Thomas's
+ * question A): a signed-in account in the fleet, for now. A second request
+ * for the same client or server joins the one open.
+ */
+export function createOpenRequest(deps) {
+    return ({ fleetId, subject, requester }) => {
+        const now = deps.clock.now();
+        return deps.requests.open({
+            fleetId,
+            requestId: deps.ids.newRequestId(),
+            subject,
+            requesters: [requester],
+            askedAt: now,
+            expiresAt: new Date(now.getTime() + REQUEST_LIFETIME_MS),
+            state: 'pending',
+            decidedBy: null,
+            decidedAt: null,
+            now,
+        });
+    };
+}
+//# sourceMappingURL=open-request.js.map

package/dist/core/requests/open-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"open-request.js","sourceRoot":"","sources":["../../../src/core/requests/open-request.ts"],"names":[],"mappings":"AAKA,4EAA4E;AAC5E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAIxD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAkE;IAClG,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YACxB,OAAO;YACP,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE;YAClC,OAAO;YACP,UAAU,EAAE,CAAC,SAAS,CAAC;YACvB,OAAO,EAAE,GAAG;YACZ,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,mBAAmB,CAAC;YACxD,KAAK,EAAE,SAAS;YAChB,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,IAAI;YACf,GAAG;SACJ,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/requests/outcome-notice.d.ts

@@ -0,0 +1,13 @@
+import type { OutcomeNotice, PendingRequest } from './ports.js';
+/**
+ * The outcomes to tell for a request that ended: one per requester with a
+ * person ship, for a request for an outside MCP server only. A client's
+ * requester is told by its browser, and one with no person ship on the
+ * gateway's page (decision 0056).
+ */
+export declare function noticesOf(request: PendingRequest, ended: {
+    outcome: OutcomeNotice['outcome'];
+    partyName: string | null;
+}): OutcomeNotice[];
+/** What the message to the person says (P5-2 a). */
+export declare function textOf(notice: OutcomeNotice): string;

package/dist/core/requests/outcome-notice.js

@@ -0,0 +1,26 @@
+/**
+ * The outcomes to tell for a request that ended: one per requester with a
+ * person ship, for a request for an outside MCP server only. A client's
+ * requester is told by its browser, and one with no person ship on the
+ * gateway's page (decision 0056).
+ */
+export function noticesOf(request, ended) {
+    const { subject } = request;
+    if (subject.kind !== 'server') {
+        return [];
+    }
+    return request.requesters.flatMap(({ accountId, personShipId }) => personShipId === null ? [] : [{ fleetId: request.fleetId, requestId: request.requestId, accountId, personShipId, url: subject.url, outcome: ended.outcome, partyName: ended.partyName }]);
+}
+/** What the message to the person says (P5-2 a). */
+export function textOf(notice) {
+    const asked = `Your request for ${notice.url}`;
+    switch (notice.outcome) {
+        case 'approved':
+            return `${asked} was approved: it is the outside party ${notice.partyName ?? notice.url}.`;
+        case 'denied':
+            return `${asked} was denied.`;
+        case 'expired':
+            return `${asked} expired after 7 days with no decision: ask again to try anew.`;
+    }
+}
+//# sourceMappingURL=outcome-notice.js.map

package/dist/core/requests/outcome-notice.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outcome-notice.js","sourceRoot":"","sources":["../../../src/core/requests/outcome-notice.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,OAAuB,EAAE,KAAsE;IACvH,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,EAAE,CAChE,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CACzL,CAAC;AACJ,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,MAAM,CAAC,MAAqB;IAC1C,MAAM,KAAK,GAAG,oBAAoB,MAAM,CAAC,GAAG,EAAE,CAAC;IAC/C,QAAQ,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,KAAK,UAAU;YACb,OAAO,GAAG,KAAK,0CAA0C,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,GAAG,GAAG,CAAC;QAC7F,KAAK,QAAQ;YACX,OAAO,GAAG,KAAK,cAAc,CAAC;QAChC,KAAK,SAAS;YACZ,OAAO,GAAG,KAAK,gEAAgE,CAAC;IACpF,CAAC;AACH,CAAC"}

package/dist/core/requests/ports.d.ts

@@ -0,0 +1,191 @@
+/**
+ * The gateway's pending requests (decision 0056): an outside MCP client's
+ * authorize request, or a person's request for an outside MCP server, in one
+ * list, kept 7 days, decided once by an actor holding gateway:approve.
+ */
+import type { FleetId, ShipId } from '@aeolus-fleet/common';
+import type { FleetRefusal } from '../connection/ports.js';
+import type { Result } from '../shared/result.js';
+/** What a request is for: an outside MCP client, by its OAuth client id and name, or an outside MCP server, by its address. */
+export type RequestSubject = {
+    readonly kind: 'client';
+    readonly clientId: string;
+    readonly clientName: string;
+} | {
+    readonly kind: 'server';
+    readonly url: string;
+};
+/** An account that asked, and its person ship, which hears the outcome. */
+export interface Requester {
+    readonly accountId: string;
+    readonly personShipId: ShipId | null;
+}
+/**
+ * Where a request stands:
+ * - pending: it waits for a decision;
+ * - approving: an approver approved it, and its proxy ship is being commissioned; it still counts as open;
+ * - approved, denied: decided, the first decision counting;
+ * - expired: 7 days passed with no decision.
+ */
+export type RequestState = 'pending' | 'approving' | 'approved' | 'denied' | 'expired';
+/** Who decided: an actor (decision 0057), without its scopes. */
+export type DecidedBy = {
+    readonly kind: 'operator' | 'viewer';
+} | {
+    readonly kind: 'ship';
+    readonly shipId: ShipId;
+} | {
+    readonly kind: 'account';
+    readonly accountId: string;
+};
+export interface PendingRequest {
+    readonly fleetId: FleetId;
+    readonly requestId: string;
+    readonly subject: RequestSubject;
+    readonly requesters: readonly Requester[];
+    readonly askedAt: Date;
+    readonly expiresAt: Date;
+    readonly state: RequestState;
+    readonly decidedBy: DecidedBy | null;
+    readonly decidedAt: Date | null;
+}
+/** Outbound port: the pending requests, by fleet. */
+export interface PendingRequests {
+    /**
+     * Keeps a new request, or joins the one open for the same client or server
+     * in the fleet, adding its requester once. A pending one expired by now is
+     * marked expired first, so a new one opens.
+     */
+    open(request: PendingRequest & {
+        now: Date;
+    }): Promise<PendingRequest>;
+    find(fleetId: FleetId, requestId: string): Promise<PendingRequest | undefined>;
+    /** The latest request for the client or server the account asked for, in any state, and whether the account was told its end. */
+    latestAskedBy(fleetId: FleetId, asked: {
+        subject: RequestSubject;
+        accountId: string;
+    }): Promise<{
+        request: PendingRequest;
+        isTold: boolean;
+    } | undefined>;
+    /** Marks that the account was told the request ended, so its next try asks anew. */
+    markTold(fleetId: FleetId, told: {
+        requestId: string;
+        accountId: string;
+    }): Promise<void>;
+    /** The open requests not expired by now, the oldest first. */
+    listOpen(fleetId: FleetId, now: Date): Promise<PendingRequest[]>;
+    /** The requests an account asked in the fleet, in any state, the newest first. */
+    listMine(fleetId: FleetId, accountId: string): Promise<PendingRequest[]>;
+    /** Takes a pending request, not expired by now, for approving; false when it is not. */
+    claim(fleetId: FleetId, claim: {
+        requestId: string;
+        now: Date;
+    }): Promise<boolean>;
+    /** Gives an approving request back as pending, when its proxy ship was refused. */
+    release(fleetId: FleetId, requestId: string): Promise<void>;
+    /**
+     * Records the decision on a request in one of the states given, and the
+     * outcomes to tell, in one step; false when it was in none, so the first
+     * decision counts and only it is told.
+     */
+    decide(fleetId: FleetId, decided: {
+        requestId: string;
+        from: readonly RequestState[];
+        decision: {
+            outcome: 'approved' | 'denied';
+            decidedBy: DecidedBy;
+            decidedAt: Date;
+        };
+        notices: readonly OutcomeNotice[];
+    }): Promise<boolean>;
+    /** The requests still pending once their 7 days passed by now, in every fleet: the ones to expire. */
+    listDue(now: Date): Promise<PendingRequest[]>;
+    /** Expires a request still pending and due by now, with the outcomes to tell, in one step; false when it is not. */
+    expire(fleetId: FleetId, expired: {
+        requestId: string;
+        now: Date;
+        notices: readonly OutcomeNotice[];
+    }): Promise<boolean>;
+}
+/** Outbound port: new request ids, prefixed `req_` and time-ordered. */
+export interface RequestIds {
+    newRequestId(): string;
+}
+/** A browser waiting for a request for an outside MCP client: the request, the account that asked, and the client's request to answer once it is decided. */
+export interface Waiting {
+    readonly fleetId: FleetId;
+    readonly requestId: string;
+    readonly accountId: string;
+    /** The secret the browser that asked holds, so no other browser takes the client's code. */
+    readonly browserSecret: string;
+    readonly request: Readonly<Record<string, string | undefined>>;
+}
+/**
+ * Outbound port: seals a waiting into the waiting page's address, so the
+ * gateway stores nothing more than the request, and the browser's secret
+ * stays secret on the way.
+ */
+export interface WaitingSeals {
+    seal(waiting: Waiting): string;
+    /** The waiting a sealed address holds; none for one the gateway did not seal. */
+    open(sealed: string): Waiting | undefined;
+}
+/** An outcome of a request for an outside MCP server, to tell one requester by a message to their person ship (decision 0056). */
+export interface OutcomeNotice {
+    readonly fleetId: FleetId;
+    readonly requestId: string;
+    readonly accountId: string;
+    readonly personShipId: ShipId;
+    readonly url: string;
+    readonly outcome: 'approved' | 'denied' | 'expired';
+    /** The outside party the server is, once approved. */
+    readonly partyName: string | null;
+}
+/** Outbound port: the outcomes still to tell, kept until the fleet stored the message or refused it. */
+export interface OutcomeNotices {
+    /** The outcomes not ended yet, in every fleet, the oldest first. */
+    listUnended(limit: number): Promise<OutcomeNotice[]>;
+    /** Ends an outcome: told, or refused by the fleet. */
+    end(notice: Pick<OutcomeNotice, 'fleetId' | 'requestId' | 'accountId'>): Promise<void>;
+}
+/** The gateway's question to its owner about one request (decision 0056): asked once, withdrawn once the request ended. */
+export interface OwnerQuestion {
+    readonly fleetId: FleetId;
+    readonly requestId: string;
+    /** The question's own uuid (decision 0038), the same each time it is sent. */
+    readonly questionId: string;
+    /** The ship asked; null before it is asked, or when the fleet refused the question. */
+    readonly askedShipId: ShipId | null;
+    readonly askedAt: Date | null;
+    readonly withdrawnAt: Date | null;
+}
+/** Outbound port: the gateway's questions to its owner, beside the requests they are about. */
+export interface OwnerQuestions {
+    /** The open requests, not expired by now, in every fleet, whose question is not asked yet, with its id once kept. */
+    listToAsk(now: Date, limit: number): Promise<{
+        request: PendingRequest;
+        questionId: string | null;
+    }[]>;
+    /** Keeps the request's question with this id, unless it has one: the id it keeps. */
+    keep(fleetId: FleetId, question: {
+        requestId: string;
+        questionId: string;
+    }): Promise<string>;
+    /** Marks the question asked of a ship, or, with none, given up after the fleet refused it. */
+    markAsked(fleetId: FleetId, asked: {
+        requestId: string;
+        askedShipId: ShipId | null;
+        at: Date;
+    }): Promise<void>;
+    /** The questions asked of a ship and not withdrawn whose request ended by now, in every fleet. */
+    listToWithdraw(now: Date, limit: number): Promise<OwnerQuestion[]>;
+    markWithdrawn(fleetId: FleetId, withdrawn: {
+        requestId: string;
+        at: Date;
+    }): Promise<void>;
+}
+/** Outbound port: who owns a ship (decision 0045), as the fleet answers it. */
+export interface Owners {
+    ownerOf(crewToken: string, shipId: ShipId): Promise<Result<ShipId | null, FleetRefusal>>;
+}

package/dist/core/requests/ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/core/requests/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../src/core/requests/ports.ts"],"names":[],"mappings":""}

package/dist/core/requests/read-waiting.d.ts

@@ -0,0 +1,46 @@
+import type { AuthorizationCodes, OAuthSecrets } from '../oauth/ports.js';
+import type { AuthorizationRefusal, ReadAuthorization } from '../oauth/read-authorization.js';
+import type { PartyStore } from '../parties/ports.js';
+import type { Clock } from '../shared/clock.js';
+import { type Result } from '../shared/result.js';
+import type { PendingRequests, WaitingSeals } from './ports.js';
+/** What the waiting page shows: the client still waits, until its request expires, or where it is sent back now. */
+export type WaitingAnswer = {
+    readonly kind: 'waiting';
+    readonly clientName: string;
+    readonly expiresAt: Date;
+} | {
+    readonly kind: 'answered';
+    readonly redirectTo: string;
+};
+/**
+ * Why a waiting gives the client nothing, beside its request's own refusals:
+ * - unknownWaiting: the gateway sealed no such waiting, or its request is forgotten;
+ * - otherBrowser: the browser does not hold the secret of the one that asked.
+ */
+export type WaitingRefusal = AuthorizationRefusal | {
+    readonly kind: 'unknownWaiting';
+} | {
+    readonly kind: 'otherBrowser';
+};
+export type ReadWaiting = (opened: {
+    waiting: string;
+    browserSecret: string | undefined;
+}) => Promise<Result<WaitingAnswer, WaitingRefusal>>;
+/**
+ * Use case: the browser that asked for an outside MCP client looks again
+ * (decision 0056). The client's request is read again, so nothing changed on
+ * the way is taken. Approved, and its party crewed, the client is sent back
+ * with its party's code; denied or expired, with access_denied, the account
+ * told; otherwise it waits.
+ */
+export declare function createReadWaiting(deps: {
+    waitings: WaitingSeals;
+    readAuthorization: ReadAuthorization;
+    requests: PendingRequests;
+    parties: PartyStore;
+    codes: AuthorizationCodes;
+    secrets: OAuthSecrets;
+    clock: Clock;
+    issuer: string;
+}): ReadWaiting;

package/dist/core/requests/read-waiting.js

@@ -0,0 +1,41 @@
+import { issueCode, redirectWith } from '../oauth/issue-code.js';
+import { err, ok } from '../shared/result.js';
+import { isRefused } from './request-state.js';
+/**
+ * Use case: the browser that asked for an outside MCP client looks again
+ * (decision 0056). The client's request is read again, so nothing changed on
+ * the way is taken. Approved, and its party crewed, the client is sent back
+ * with its party's code; denied or expired, with access_denied, the account
+ * told; otherwise it waits.
+ */
+export function createReadWaiting(deps) {
+    return async ({ waiting: sealed, browserSecret }) => {
+        const waiting = deps.waitings.open(sealed);
+        if (waiting === undefined) {
+            return err({ kind: 'unknownWaiting' });
+        }
+        if (browserSecret !== waiting.browserSecret) {
+            return err({ kind: 'otherBrowser' });
+        }
+        const { fleetId, requestId, accountId } = waiting;
+        const request = await deps.requests.find(fleetId, requestId);
+        if (request === undefined) {
+            return err({ kind: 'unknownWaiting' });
+        }
+        const read = await deps.readAuthorization(waiting.request);
+        if (!read.isOk) {
+            return read;
+        }
+        const authorization = read.value;
+        if (isRefused(request, deps.clock.now())) {
+            await deps.requests.markTold(fleetId, { requestId, accountId });
+            return ok({ kind: 'answered', redirectTo: redirectWith(authorization.redirectUri, { error: 'access_denied', state: authorization.state, iss: deps.issuer }) });
+        }
+        const party = request.state === 'approved' ? await deps.parties.findByClient(fleetId, authorization.clientId) : undefined;
+        if (party?.state !== 'crewed') {
+            return ok({ kind: 'waiting', clientName: authorization.clientName, expiresAt: request.expiresAt });
+        }
+        return ok({ kind: 'answered', redirectTo: await issueCode(deps, { fleetId, authorization, holder: { kind: 'party', party: party.name } }) });
+    };
+}
+//# sourceMappingURL=read-waiting.js.map

package/dist/core/requests/read-waiting.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-waiting.js","sourceRoot":"","sources":["../../../src/core/requests/read-waiting.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAKjE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAE3D,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAc/C;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IASjC;IACC,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,EAAE;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,aAAa,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;YAC5C,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;QAClD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC7D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC;QACjC,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;YAChE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACjK,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1H,IAAI,KAAK,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QACrG,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/I,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/requests/request-state.d.ts

@@ -0,0 +1,5 @@
+import type { PendingRequest, RequestState } from './ports.js';
+/** Where a request stands by now: one still pending once its 7 days passed has expired, though the store marks it only when it is next opened. */
+export declare function stateAt(request: PendingRequest, now: Date): RequestState;
+/** Whether a request ended with no proxy ship: denied, or expired. */
+export declare function isRefused(request: PendingRequest, now: Date): boolean;

package/dist/core/requests/request-state.js

@@ -0,0 +1,10 @@
+/** Where a request stands by now: one still pending once its 7 days passed has expired, though the store marks it only when it is next opened. */
+export function stateAt(request, now) {
+    return request.state === 'pending' && request.expiresAt <= now ? 'expired' : request.state;
+}
+/** Whether a request ended with no proxy ship: denied, or expired. */
+export function isRefused(request, now) {
+    const state = stateAt(request, now);
+    return state === 'denied' || state === 'expired';
+}
+//# sourceMappingURL=request-state.js.map

package/dist/core/requests/request-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-state.js","sourceRoot":"","sources":["../../../src/core/requests/request-state.ts"],"names":[],"mappings":"AAEA,kJAAkJ;AAClJ,MAAM,UAAU,OAAO,CAAC,OAAuB,EAAE,GAAS;IACxD,OAAO,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,IAAI,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;AAC7F,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,SAAS,CAAC,OAAuB,EAAE,GAAS;IAC1D,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACpC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,SAAS,CAAC;AACnD,CAAC"}

package/dist/core/requests/tell-outcomes.d.ts

@@ -0,0 +1,24 @@
+import type { ConnectionStore } from '../connection/ports.js';
+import type { CallSender } from '../mcp-in/ports.js';
+import type { OutcomeNotices, PendingRequests } from './ports.js';
+/** Tells the outcomes still to tell: how many the fleet stored, kept for the next round, and refused. */
+export type TellOutcomes = () => Promise<{
+    told: number;
+    kept: number;
+    refused: number;
+}>;
+/**
+ * Use case: the gateway's ship tells each person the outcome of their
+ * request for an outside MCP server, by a text message to their person ship
+ * (decision 0056, P5-2 a). The key is the request and the account, so an
+ * outcome told again after the fleet did not answer is stored once (P5-3 a).
+ * An outcome the fleet stored is ended and the account told; one it refused
+ * is ended untold, so the gateway's page shows it; one it did not answer, or
+ * of a fleet the gateway is not connected to, is kept for the next round.
+ */
+export declare function createTellOutcomes(deps: {
+    notices: OutcomeNotices;
+    requests: PendingRequests;
+    connections: ConnectionStore;
+    sender: CallSender;
+}): TellOutcomes;

package/dist/core/requests/tell-outcomes.js

@@ -0,0 +1,39 @@
+import { textOf } from './outcome-notice.js';
+/** How many outcomes one round tells at most. */
+const OUTCOMES_PER_ROUND = 50;
+/**
+ * Use case: the gateway's ship tells each person the outcome of their
+ * request for an outside MCP server, by a text message to their person ship
+ * (decision 0056, P5-2 a). The key is the request and the account, so an
+ * outcome told again after the fleet did not answer is stored once (P5-3 a).
+ * An outcome the fleet stored is ended and the account told; one it refused
+ * is ended untold, so the gateway's page shows it; one it did not answer, or
+ * of a fleet the gateway is not connected to, is kept for the next round.
+ */
+export function createTellOutcomes(deps) {
+    return async () => {
+        const counted = { told: 0, kept: 0, refused: 0 };
+        for (const notice of await deps.notices.listUnended(OUTCOMES_PER_ROUND)) {
+            const gateway = await deps.connections.find(notice.fleetId);
+            if (gateway === undefined) {
+                counted.kept += 1;
+                continue;
+            }
+            const sent = await deps.sender.send(gateway.crewToken, { to: notice.personShipId, contentType: 'text/plain', payload: textOf(notice), idempotencyKey: `${notice.requestId}:${notice.accountId}` });
+            if (!sent.isOk && sent.error.code === 'UNAVAILABLE') {
+                counted.kept += 1;
+                continue;
+            }
+            if (sent.isOk) {
+                await deps.requests.markTold(notice.fleetId, { requestId: notice.requestId, accountId: notice.accountId });
+                counted.told += 1;
+            }
+            else {
+                counted.refused += 1;
+            }
+            await deps.notices.end(notice);
+        }
+        return counted;
+    };
+}
+//# sourceMappingURL=tell-outcomes.js.map

package/dist/core/requests/tell-outcomes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tell-outcomes.js","sourceRoot":"","sources":["../../../src/core/requests/tell-outcomes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAG7C,iDAAiD;AACjD,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAK9B;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAA8G;IAC/I,OAAO,KAAK,IAAI,EAAE;QAChB,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QACjD,KAAK,MAAM,MAAM,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACxE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC5D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;YACnM,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBACpD,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC3G,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC;YACpB,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC;YACvB,CAAC;YACD,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/requests/watch-waiting.d.ts

@@ -0,0 +1,32 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { PartyStore } from '../parties/ports.js';
+import type { Clock } from '../shared/clock.js';
+import { type Result } from '../shared/result.js';
+import type { PendingRequests, WaitingSeals } from './ports.js';
+/** Whether the browser that asked still waits, the fleet its request is in, and when the request expires. */
+export interface WatchedWaiting {
+    readonly fleetId: FleetId;
+    readonly isWaiting: boolean;
+    readonly expiresAt: Date;
+}
+export type WatchWaitingRefusal = {
+    readonly kind: 'unknownWaiting';
+} | {
+    readonly kind: 'otherBrowser';
+};
+export type WatchWaiting = (opened: {
+    waiting: string;
+    browserSecret: string | undefined;
+}) => Promise<Result<WatchedWaiting, WatchWaitingRefusal>>;
+/**
+ * Use case: the waiting page follows its request live (decision 0056). It
+ * reads whether the browser that asked still waits as readWaiting decides
+ * it, with no side effect: no code is issued and nobody is told, as the page
+ * then goes to its own address, where readWaiting answers.
+ */
+export declare function createWatchWaiting(deps: {
+    waitings: WaitingSeals;
+    requests: PendingRequests;
+    parties: PartyStore;
+    clock: Clock;
+}): WatchWaiting;

package/dist/core/requests/watch-waiting.js

@@ -0,0 +1,31 @@
+import { err, ok } from '../shared/result.js';
+import { isRefused } from './request-state.js';
+/**
+ * Use case: the waiting page follows its request live (decision 0056). It
+ * reads whether the browser that asked still waits as readWaiting decides
+ * it, with no side effect: no code is issued and nobody is told, as the page
+ * then goes to its own address, where readWaiting answers.
+ */
+export function createWatchWaiting(deps) {
+    return async ({ waiting: sealed, browserSecret }) => {
+        const waiting = deps.waitings.open(sealed);
+        if (waiting === undefined) {
+            return err({ kind: 'unknownWaiting' });
+        }
+        if (browserSecret !== waiting.browserSecret) {
+            return err({ kind: 'otherBrowser' });
+        }
+        const request = await deps.requests.find(waiting.fleetId, waiting.requestId);
+        if (request === undefined) {
+            return err({ kind: 'unknownWaiting' });
+        }
+        const watched = { fleetId: request.fleetId, expiresAt: request.expiresAt };
+        if (isRefused(request, deps.clock.now())) {
+            return ok({ ...watched, isWaiting: false });
+        }
+        const clientId = waiting.request.client_id ?? '';
+        const party = request.state === 'approved' ? await deps.parties.findByClient(request.fleetId, clientId) : undefined;
+        return ok({ ...watched, isWaiting: party?.state !== 'crewed' });
+    };
+}
+//# sourceMappingURL=watch-waiting.js.map

package/dist/core/requests/watch-waiting.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"watch-waiting.js","sourceRoot":"","sources":["../../../src/core/requests/watch-waiting.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAE3D,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAa/C;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAA8F;IAC/H,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,EAAE;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,aAAa,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;YAC5C,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,OAAO,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QAC3E,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACpH,OAAO,EAAE,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,KAAK,QAAQ,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/shared/clock.d.ts

@@ -0,0 +1,4 @@
+/** Outbound port: the time now. Tests hold their own clock. */
+export interface Clock {
+    now(): Date;
+}

package/dist/core/shared/clock.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=clock.js.map

package/dist/core/shared/clock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clock.js","sourceRoot":"","sources":["../../../src/core/shared/clock.ts"],"names":[],"mappings":""}

package/dist/core/shared/errors.d.ts

@@ -0,0 +1,10 @@
+import { type Err } from './result.js';
+/** Every reason the gateway's core refuses a request. */
+export type DomainErrorKind = 'ALREADY_CONNECTED' | 'SECRET_REFUSED' | 'OTHER_FLEET' | 'MISSING_SCOPES' | 'SCOPE_REFUSED' | 'NOT_THE_OPERATOR' | 'NOT_AN_ACTOR' | 'NOT_AN_APPROVER' | 'NO_SUCH_REQUEST' | 'ALREADY_DECIDED' | 'EXPIRED' | 'SCOPE_NOT_HELD' | 'SERVER_DETAILS_MISSING' | 'REQUEST_ID_USED' | 'FLEET_UNAVAILABLE' | 'NOT_CONNECTED' | 'PARTY_EXISTS' | 'COMMISSION_REFUSED' | 'NO_SUCH_PARTY' | 'NOT_AWAITING_CREW' | 'NOT_CREWED' | 'SERVER_UNREACHABLE' | 'STATEMENT_REFUSED' | 'INVALID_REDIRECT_URIS' | 'CLIENT_HAS_PARTY' | 'PARTY_NOT_CREWED' | 'NO_SUCH_TOOL' | 'INVALID_ARGUMENTS' | 'NOT_REACHABLE' | 'SEND_REFUSED' | 'NO_SUCH_CALL' | 'NOT_A_PERSON' | 'SIGNED_OUT' | 'NO_SUCH_DELIVERY' | 'NOT_A_NETWORKER' | 'OPEN_NETWORK' | 'OUTSIDE_PARTIES_OFF' | 'INVALID_SERVER_URL' | 'NOT_A_MANAGER' | 'RETIRE_REFUSED' | 'NOT_AN_ACCOUNT' | 'PARTY_NOT_COMMISSIONED' | 'CHANGE_REFUSED';
+/** Why the core refused a request. Adapters map the kind to their own error shape; the message is safe to show. */
+export interface DomainError<K extends DomainErrorKind = DomainErrorKind> {
+    readonly kind: K;
+    readonly message: string;
+}
+/** A refusal: the error result of the given kind. */
+export declare function refuse<K extends DomainErrorKind>(kind: K, message: string): Err<DomainError<K>>;

package/dist/core/shared/errors.js

@@ -0,0 +1,6 @@
+import { err } from './result.js';
+/** A refusal: the error result of the given kind. */
+export function refuse(kind, message) {
+    return err({ kind, message });
+}
+//# sourceMappingURL=errors.js.map

package/dist/core/shared/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/core/shared/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAY,MAAM,aAAa,CAAC;AAsD5C,qDAAqD;AACrD,MAAM,UAAU,MAAM,CAA4B,IAAO,EAAE,OAAe;IACxE,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAChC,CAAC"}

package/dist/core/shared/result.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The outcome of a domain operation: its value, or why the domain refused.
+ * The core never throws; only adapters throw, for system failures such as a
+ * lost database connection.
+ */
+export type Result<T, E> = Ok<T> | Err<E>;
+export interface Ok<T> {
+    readonly isOk: true;
+    readonly value: T;
+}
+export interface Err<E> {
+    readonly isOk: false;
+    readonly error: E;
+}
+export declare function ok<T>(value: T): Ok<T>;
+export declare function err<E>(error: E): Err<E>;

package/dist/core/shared/result.js

@@ -0,0 +1,7 @@
+export function ok(value) {
+    return { isOk: true, value };
+}
+export function err(error) {
+    return { isOk: false, error };
+}
+//# sourceMappingURL=result.js.map

package/dist/core/shared/result.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"result.js","sourceRoot":"","sources":["../../../src/core/shared/result.ts"],"names":[],"mappings":"AAiBA,MAAM,UAAU,EAAE,CAAI,KAAQ;IAC5B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,GAAG,CAAI,KAAQ;IAC7B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AAChC,CAAC"}