@aeolus-fleet/gateway 0.0.0-stage → 0.28.0

package/dist/core/sign-in/account-token.d.ts

@@ -0,0 +1,42 @@
+import type { FleetId, ShipId } from '@aeolus-fleet/common';
+import type { IssuedTokens } from '../oauth/ports.js';
+import type { Clock } from '../shared/clock.js';
+import { type Result } from '../shared/result.js';
+import type { AccountGrants, Pagasae } from './ports.js';
+/** An account token is refreshed when less than this is left of it, so a call never carries one that ends on the way. */
+export declare const ACCOUNT_TOKEN_MARGIN_MS = 60000;
+/**
+ * Why there is no account token to call with:
+ * - signedOut: the gateway holds no such grant, or pagasae ended it, so the person signs in again;
+ * - pagasaeUnavailable: pagasae did not answer; the grant stays.
+ */
+export type AccountTokenRefusal = {
+    readonly kind: 'signedOut';
+} | {
+    readonly kind: 'pagasaeUnavailable';
+};
+/** An account token to call with, and the account, person ship and scopes it names. */
+export interface AccountToken {
+    readonly accountToken: string;
+    readonly accountId: string;
+    readonly personShipId: ShipId | null;
+    readonly scopes: readonly string[];
+}
+export type AccountTokenOf = (grant: {
+    fleetId: FleetId;
+    grantId: string;
+}) => Promise<Result<AccountToken, AccountTokenRefusal>>;
+/**
+ * Use case: the account token a signed-in person's call carries to core
+ * (decisions 0054, 0058). It lasts 10 minutes; a minute before it ends the
+ * gateway refreshes it through pagasae, which replaces the refresh token. A
+ * grant's calls made together share one refresh, as pagasae ends a grant
+ * whose refresh token comes twice. pagasae refusing ends the grant here too,
+ * revoking its client's tokens, so the person signs in again.
+ */
+export declare function createAccountTokenOf(deps: {
+    grants: AccountGrants;
+    tokens: IssuedTokens;
+    pagasae: Pagasae;
+    clock: Clock;
+}): AccountTokenOf;

package/dist/core/sign-in/account-token.js

@@ -0,0 +1,46 @@
+import { err, ok } from '../shared/result.js';
+/** An account token is refreshed when less than this is left of it, so a call never carries one that ends on the way. */
+export const ACCOUNT_TOKEN_MARGIN_MS = 60_000;
+/**
+ * Use case: the account token a signed-in person's call carries to core
+ * (decisions 0054, 0058). It lasts 10 minutes; a minute before it ends the
+ * gateway refreshes it through pagasae, which replaces the refresh token. A
+ * grant's calls made together share one refresh, as pagasae ends a grant
+ * whose refresh token comes twice. pagasae refusing ends the grant here too,
+ * revoking its client's tokens, so the person signs in again.
+ */
+export function createAccountTokenOf(deps) {
+    const refreshing = new Map();
+    const fresh = async ({ fleetId, grantId }) => {
+        const grant = await deps.grants.find(fleetId, grantId);
+        if (grant === undefined) {
+            return err({ kind: 'signedOut' });
+        }
+        if (grant.accountTokenExpiresAt.getTime() - ACCOUNT_TOKEN_MARGIN_MS > deps.clock.now().getTime()) {
+            return ok({ accountToken: grant.accountToken, accountId: grant.accountId, personShipId: grant.personShipId, scopes: grant.scopes });
+        }
+        const refreshed = await deps.pagasae.refresh(grant.refreshToken);
+        if (!refreshed.isOk && refreshed.error.kind === 'unavailable') {
+            return err({ kind: 'pagasaeUnavailable' });
+        }
+        if (!refreshed.isOk || refreshed.value.fleetId !== fleetId) {
+            await deps.grants.end(fleetId, grantId);
+            await deps.tokens.revokeGrant(fleetId, grantId);
+            return err({ kind: 'signedOut' });
+        }
+        const { refreshToken, accountToken, accountTokenExpiresAt, personShipId, scopes } = refreshed.value;
+        await deps.grants.renew({ fleetId, grantId }, { refreshToken, accountToken, accountTokenExpiresAt, personShipId, scopes });
+        return ok({ accountToken, accountId: grant.accountId, personShipId, scopes });
+    };
+    return (grant) => {
+        const key = `${grant.fleetId}/${grant.grantId}`;
+        const held = refreshing.get(key);
+        if (held !== undefined) {
+            return held;
+        }
+        const answer = fresh(grant).finally(() => refreshing.delete(key));
+        refreshing.set(key, answer);
+        return answer;
+    };
+}
+//# sourceMappingURL=account-token.js.map

package/dist/core/sign-in/account-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-token.js","sourceRoot":"","sources":["../../../src/core/sign-in/account-token.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAG3D,yHAAyH;AACzH,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAmB9C;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAqF;IACxH,MAAM,UAAU,GAAG,IAAI,GAAG,EAAsC,CAAC;IAEjE,MAAM,KAAK,GAAmB,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;QAC3D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACvD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,KAAK,CAAC,qBAAqB,CAAC,OAAO,EAAE,GAAG,uBAAuB,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YACjG,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACtI,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACjE,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAC9D,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YAC3D,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACxC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAChD,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC;QACpG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3H,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;IAChF,CAAC,CAAC;IAEF,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAClE,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/sign-in/complete-sign-in.d.ts

@@ -0,0 +1,66 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { AuthorizationCodes, OAuthSecrets } from '../oauth/ports.js';
+import type { AuthorizationRefusal, ReadAuthorization } from '../oauth/read-authorization.js';
+import type { AskForClient, ClientAnswer } from '../requests/ask-for-client.js';
+import type { Clock } from '../shared/clock.js';
+import { type Result } from '../shared/result.js';
+import type { AccountGrants, Pagasae, PageSessions, SignInSeals } from './ports.js';
+/**
+ * Why a sign-in gave the client no code, beside the request's own refusals:
+ * - unknownSignIn: the gateway sealed no sign-in into this state, or its 10 minutes passed;
+ * - otherBrowser: the browser that came back does not hold the sign-in's secret, as when another site makes it finish its own;
+ * - pagasaeRefused: pagasae did not redeem its code, for the reason given;
+ * - fleetNotServed: the account's fleet is one this gateway does not serve;
+ * - outsidePartiesOff: the person asked for access for the client while the fleet's outside parties are off (interop I-3).
+ */
+export type SignInRefusal = AuthorizationRefusal | {
+    readonly kind: 'unknownSignIn';
+} | {
+    readonly kind: 'otherBrowser';
+} | {
+    readonly kind: 'pagasaeRefused';
+    readonly message: string;
+} | {
+    readonly kind: 'fleetNotServed';
+} | {
+    readonly kind: 'outsidePartiesOff';
+};
+/** What a sign-in answers: the client's answer, or, for the gateway's pages, the page session to hold and the page to go back to. */
+export type SignInAnswer = ClientAnswer | {
+    readonly kind: 'signedIn';
+    readonly session: string;
+    readonly redirectTo: string;
+};
+interface Back {
+    state?: string | undefined;
+    code?: string | undefined;
+    error?: string | undefined;
+    browserSecret?: string | undefined;
+}
+export type CompleteSignIn = (back: Back) => Promise<Result<SignInAnswer, SignInRefusal>>;
+/**
+ * Use case: pagasae sends the person back. Their sign-in is opened from its
+ * state, the client's request read again, and pagasae's code redeemed with
+ * the gateway's verifier; pagasae takes a code once. Then, as the person
+ * picked: the account's grant is kept, and the client is sent back with the
+ * gateway's own code for it, acting in the fleet as the account with no
+ * approval (orchestrator-1, slice 7 Q1); or the account asks for access for
+ * the client, as an outside party (decision 0056). A sign-in to the
+ * gateway's pages keeps the account's grant too, and answers a page session
+ * naming it, so the pages act as the account.
+ */
+export declare function createCompleteSignIn(deps: {
+    readAuthorization: ReadAuthorization;
+    seals: SignInSeals;
+    pagasae: Pagasae;
+    grants: AccountGrants;
+    codes: AuthorizationCodes;
+    secrets: OAuthSecrets;
+    clock: Clock;
+    issuer: string;
+    /** Whether the gateway serves the fleet: connected to it, and switched on where an installation switches fleets (decision 0021). */
+    servesFleet: (fleetId: FleetId) => Promise<boolean>;
+    askForClient: AskForClient;
+    sessions: PageSessions;
+}): CompleteSignIn;
+export {};

package/dist/core/sign-in/complete-sign-in.js

@@ -0,0 +1,73 @@
+import { issueCode, redirectWith } from '../oauth/issue-code.js';
+import { err, ok } from '../shared/result.js';
+/**
+ * Use case: pagasae sends the person back. Their sign-in is opened from its
+ * state, the client's request read again, and pagasae's code redeemed with
+ * the gateway's verifier; pagasae takes a code once. Then, as the person
+ * picked: the account's grant is kept, and the client is sent back with the
+ * gateway's own code for it, acting in the fleet as the account with no
+ * approval (orchestrator-1, slice 7 Q1); or the account asks for access for
+ * the client, as an outside party (decision 0056). A sign-in to the
+ * gateway's pages keeps the account's grant too, and answers a page session
+ * naming it, so the pages act as the account.
+ */
+export function createCompleteSignIn(deps) {
+    /** A sign-in to the pages: the grant kept, and the session naming it; no client to send back, so pagasae's error is said. */
+    const signInToPages = async (signIn, { code, error }) => {
+        if (error !== undefined || code === undefined) {
+            return err({ kind: 'pagasaeRefused', message: error ?? 'pagasae sent no code' });
+        }
+        const redeemed = await deps.pagasae.redeemCode({ code, verifier: signIn.verifier });
+        if (!redeemed.isOk) {
+            return err({ kind: 'pagasaeRefused', message: redeemed.error.reason });
+        }
+        const { fleetId, accountId, personShipId, scopes, refreshToken, accountToken, accountTokenExpiresAt } = redeemed.value;
+        if (!(await deps.servesFleet(fleetId))) {
+            return err({ kind: 'fleetNotServed' });
+        }
+        const grantId = deps.secrets.newSecret();
+        await deps.grants.save({ grantId, fleetId, accountId, personShipId, scopes, refreshToken, accountToken, accountTokenExpiresAt });
+        return ok({ kind: 'signedIn', session: deps.sessions.seal({ fleetId, grantId }), redirectTo: signIn.returnTo });
+    };
+    return async (back) => {
+        const { state, code, error, browserSecret } = back;
+        const signIn = state === undefined ? undefined : deps.seals.open(state);
+        if (signIn === undefined || signIn.expiresAt.getTime() <= deps.clock.now().getTime()) {
+            return err({ kind: 'unknownSignIn' });
+        }
+        if (browserSecret !== signIn.browserSecret) {
+            return err({ kind: 'otherBrowser' });
+        }
+        if (signIn.holder === 'page') {
+            return signInToPages(signIn, back);
+        }
+        const read = await deps.readAuthorization(signIn.request);
+        if (!read.isOk) {
+            return read;
+        }
+        const authorization = read.value;
+        if (error !== undefined || code === undefined) {
+            return ok({ kind: 'answered', redirectTo: redirectWith(authorization.redirectUri, { error: 'access_denied', state: authorization.state, iss: deps.issuer }) });
+        }
+        const redeemed = await deps.pagasae.redeemCode({ code, verifier: signIn.verifier });
+        if (!redeemed.isOk) {
+            return err({ kind: 'pagasaeRefused', message: redeemed.error.reason });
+        }
+        const tokens = redeemed.value;
+        if (!(await deps.servesFleet(tokens.fleetId))) {
+            return err({ kind: 'fleetNotServed' });
+        }
+        if (authorization.clientFleetId !== null && authorization.clientFleetId !== tokens.fleetId) {
+            return err({ kind: 'invalidClient', message: `${authorization.clientName} is registered for another fleet` });
+        }
+        const { fleetId, accountId, personShipId, scopes, refreshToken, accountToken, accountTokenExpiresAt } = tokens;
+        if (signIn.holder === 'party') {
+            const asked = await deps.askForClient({ fleetId, requester: { accountId, personShipId }, authorization, request: signIn.request, browserSecret: signIn.browserSecret });
+            return asked.isOk ? asked : err({ kind: 'outsidePartiesOff' });
+        }
+        const grantId = deps.secrets.newSecret();
+        await deps.grants.save({ grantId, fleetId, accountId, personShipId, scopes, refreshToken, accountToken, accountTokenExpiresAt });
+        return ok({ kind: 'answered', redirectTo: await issueCode(deps, { fleetId, authorization, holder: { kind: 'account', grantId } }) });
+    };
+}
+//# sourceMappingURL=complete-sign-in.js.map

package/dist/core/sign-in/complete-sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"complete-sign-in.js","sourceRoot":"","sources":["../../../src/core/sign-in/complete-sign-in.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAKjE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAyB3D;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAapC;IACC,6HAA6H;IAC7H,MAAM,aAAa,GAAG,KAAK,EAAE,MAAkB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAQ,EAAgD,EAAE;QACtH,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9C,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,IAAI,sBAAsB,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC;QACvH,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACvC,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjI,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClH,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,IAAI,EAAE,EAAE;QACpB,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;QACnD,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YACrF,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,aAAa,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;YAC3C,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC7B,OAAO,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC;QACjC,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9C,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,aAAa,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACjK,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QACpF,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC;QAC9B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAC9C,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,aAAa,CAAC,aAAa,KAAK,IAAI,IAAI,aAAa,CAAC,aAAa,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;YAC3F,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,UAAU,kCAAkC,EAAE,CAAC,CAAC;QAChH,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,GAAG,MAAM,CAAC;QAC/G,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;YACxK,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjI,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;IACvI,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/sign-in/end-sign-ins.d.ts

@@ -0,0 +1,19 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { IssuedTokens } from '../oauth/ports.js';
+import type { AccountGrants } from './ports.js';
+export type EndSignIns = (account: {
+    fleetId: FleetId;
+    accountId: string;
+}) => Promise<void>;
+/**
+ * Use case: pagasae disabled the account and tells the gateway, which ends
+ * its gateway tokens there (decision 0055): every sign-in of the account in
+ * the fleet ends, and its clients' tokens are revoked, so each client is
+ * refused at its next call. pagasae refuses the account a new sign-in. A
+ * grant is ended before its tokens are revoked, as when pagasae refuses a
+ * refresh: a call with a token whose grant is gone is signed out already.
+ */
+export declare function createEndSignIns(deps: {
+    grants: AccountGrants;
+    tokens: IssuedTokens;
+}): EndSignIns;

package/dist/core/sign-in/end-sign-ins.js

@@ -0,0 +1,17 @@
+/**
+ * Use case: pagasae disabled the account and tells the gateway, which ends
+ * its gateway tokens there (decision 0055): every sign-in of the account in
+ * the fleet ends, and its clients' tokens are revoked, so each client is
+ * refused at its next call. pagasae refuses the account a new sign-in. A
+ * grant is ended before its tokens are revoked, as when pagasae refuses a
+ * refresh: a call with a token whose grant is gone is signed out already.
+ */
+export function createEndSignIns(deps) {
+    return async ({ fleetId, accountId }) => {
+        for (const { grantId } of await deps.grants.ofAccount(fleetId, accountId)) {
+            await deps.grants.end(fleetId, grantId);
+            await deps.tokens.revokeGrant(fleetId, grantId);
+        }
+    };
+}
+//# sourceMappingURL=end-sign-ins.js.map

package/dist/core/sign-in/end-sign-ins.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"end-sign-ins.js","sourceRoot":"","sources":["../../../src/core/sign-in/end-sign-ins.ts"],"names":[],"mappings":"AAOA;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAqD;IACpF,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE;QACtC,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;YAC1E,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACxC,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/sign-in/ports.d.ts

@@ -0,0 +1,115 @@
+/**
+ * A person signs in to the gateway through pagasae, the one identity
+ * provider (decision 0054): the gateway is its OpenID Connect client, and
+ * the person acts in the fleet as their account, by its account token, from
+ * their MCP client or on the gateway's own pages.
+ */
+import type { FleetId, ShipId } from '@aeolus-fleet/common';
+import type { Result } from '../shared/result.js';
+/**
+ * A person's sign-in at pagasae under way, with the gateway's PKCE verifier:
+ * for an MCP client, its authorization request; for the gateway's pages, the
+ * page to go back to.
+ */
+export type PendingSignIn = ClientSignIn | PageSignIn;
+interface SignInUnderWay {
+    readonly verifier: string;
+    /** The secret the browser that started the sign-in holds, so no other browser finishes it (login CSRF). */
+    readonly browserSecret: string;
+    readonly expiresAt: Date;
+}
+export interface ClientSignIn extends SignInUnderWay {
+    readonly request: Readonly<Record<string, string | undefined>>;
+    /** What the person picked the client to act as: their account, or a party they ask access for (Q1 a). */
+    readonly holder: SignInHolder;
+}
+export interface PageSignIn extends SignInUnderWay {
+    readonly holder: 'page';
+    /** The gateway's own path the browser goes back to once signed in. */
+    readonly returnTo: string;
+}
+/** What a client acts as once its person signed in: the account itself, or an outside party (decision 0056). */
+export type SignInHolder = 'account' | 'party';
+/**
+ * Outbound port: seals a sign-in under way into the state pagasae carries
+ * back, so the gateway stores nothing before it knows the fleet, and the
+ * verifier stays secret on the way.
+ */
+export interface SignInSeals {
+    seal(signIn: PendingSignIn): string;
+    /** The sign-in a state seals; none for a state the gateway did not seal. */
+    open(state: string): PendingSignIn | undefined;
+}
+/** What pagasae answers for a redeemed code: the account token, what it names, and the refresh token behind it. */
+export interface PagasaeTokens {
+    readonly accountToken: string;
+    readonly accountTokenExpiresAt: Date;
+    readonly refreshToken: string;
+    /** The fleet pagasae signed the account token for: the one the person picked, or their only one. */
+    readonly fleetId: FleetId;
+    readonly accountId: string;
+    /** The account's person ship in the fleet, if it has one (decision 0052). */
+    readonly personShipId: ShipId | null;
+    /** The scopes the account token carries: what the account may do in the fleet. */
+    readonly scopes: readonly string[];
+}
+/** Outbound port: pagasae, where the gateway sends a person to sign in, and redeems the code they come back with. */
+export interface Pagasae {
+    /** pagasae's authorize address for the gateway, with the state and the PKCE challenge, naming no fleet. */
+    authorizeUrl(signIn: {
+        state: string;
+        codeChallenge: string;
+    }): string;
+    redeemCode(code: {
+        code: string;
+        verifier: string;
+    }): Promise<Result<PagasaeTokens, {
+        reason: string;
+    }>>;
+    /**
+     * New tokens for a refresh token, which pagasae replaces on use: refused
+     * when pagasae ended the grant (disabled, signed out, no right left, the
+     * token used twice), unavailable when it did not answer.
+     */
+    refresh(refreshToken: string): Promise<Result<PagasaeTokens, {
+        kind: 'refused' | 'unavailable';
+        reason: string;
+    }>>;
+}
+/** A person's sign-in kept for their MCP client or the gateway's pages: the account in the fleet, and pagasae's tokens to act as it. */
+export interface AccountGrant {
+    readonly grantId: string;
+    readonly fleetId: FleetId;
+    readonly accountId: string;
+    readonly personShipId: ShipId | null;
+    /** The scopes its account token carries. */
+    readonly scopes: readonly string[];
+    readonly refreshToken: string;
+    readonly accountToken: string;
+    readonly accountTokenExpiresAt: Date;
+}
+export interface AccountGrants {
+    save(grant: AccountGrant): Promise<void>;
+    find(fleetId: FleetId, grantId: string): Promise<AccountGrant | undefined>;
+    /** Every grant of the account in the fleet: one per client it signed in from. */
+    ofAccount(fleetId: FleetId, accountId: string): Promise<readonly AccountGrant[]>;
+    /** Keeps pagasae's new tokens for the grant, and the person ship and scopes they name. */
+    renew(grant: {
+        fleetId: FleetId;
+        grantId: string;
+    }, tokens: Partial<Pick<AccountGrant, 'refreshToken' | 'accountToken' | 'accountTokenExpiresAt' | 'personShipId' | 'scopes'>>): Promise<void>;
+    end(fleetId: FleetId, grantId: string): Promise<void>;
+}
+/** A browser signed in to the gateway's pages: the account's grant it acts by. */
+export interface PageSession {
+    readonly fleetId: FleetId;
+    readonly grantId: string;
+}
+/** Outbound port: the page session a browser holds in the gateway's own cookie, sealed so no one forges or reads it. */
+export interface PageSessions {
+    /** The cookie's value for the session. */
+    seal(session: PageSession): string;
+    /** The session a Cookie header carries; none when it carries none the gateway sealed. */
+    inCookie(cookie: string): PageSession | undefined;
+}
+export {};

package/dist/core/sign-in/ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/core/sign-in/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../src/core/sign-in/ports.ts"],"names":[],"mappings":""}

package/dist/core/sign-in/sign-out.d.ts

@@ -0,0 +1,10 @@
+import type { AccountGrants, PageSession } from './ports.js';
+export type SignOut = (session: PageSession) => Promise<void>;
+/**
+ * Use case: a person signs out of the gateway's pages. The session's grant
+ * ends, so a page session cookie kept after it is signed out; the account's
+ * sign-ins from its MCP clients go on.
+ */
+export declare function createSignOut(deps: {
+    grants: Pick<AccountGrants, 'end'>;
+}): SignOut;

package/dist/core/sign-in/sign-out.js

@@ -0,0 +1,9 @@
+/**
+ * Use case: a person signs out of the gateway's pages. The session's grant
+ * ends, so a page session cookie kept after it is signed out; the account's
+ * sign-ins from its MCP clients go on.
+ */
+export function createSignOut(deps) {
+    return ({ fleetId, grantId }) => deps.grants.end(fleetId, grantId);
+}
+//# sourceMappingURL=sign-out.js.map

package/dist/core/sign-in/sign-out.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-out.js","sourceRoot":"","sources":["../../../src/core/sign-in/sign-out.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAA4C;IACxE,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;AACrE,CAAC"}

package/dist/core/sign-in/start-page-sign-in.d.ts

@@ -0,0 +1,25 @@
+import type { OAuthSecrets } from '../oauth/ports.js';
+import type { Clock } from '../shared/clock.js';
+import type { Pagasae, SignInSeals } from './ports.js';
+/** Where a person lands once signed in, when they asked for no page of the gateway's own. */
+export declare const FIRST_PAGE = "/overview";
+export type StartPageSignIn = (asked: {
+    returnTo?: string | undefined;
+}) => {
+    redirectTo: string;
+    browserSecret: string;
+};
+/**
+ * Use case: a person signs in to the gateway's own pages through pagasae
+ * (decision 0054), as from an MCP client: the page to go back to is sealed
+ * with the gateway's PKCE verifier into the state, and the person is sent to
+ * pagasae naming no fleet. Only a path of the gateway's own is kept, so a
+ * sign-in never sends the browser to another site. The browser is given a
+ * secret of its own, sealed too, so only it finishes the sign-in.
+ */
+export declare function createStartPageSignIn(deps: {
+    seals: SignInSeals;
+    pagasae: Pagasae;
+    secrets: OAuthSecrets;
+    clock: Clock;
+}): StartPageSignIn;

package/dist/core/sign-in/start-page-sign-in.js

@@ -0,0 +1,30 @@
+import { SIGN_IN_LIFETIME_MS } from './start-sign-in.js';
+/** Where a person lands once signed in, when they asked for no page of the gateway's own. */
+export const FIRST_PAGE = '/overview';
+/** Whether the path is one of the gateway's own: one slash, then no second slash or backslash a browser reads as another site. */
+function isOwnPath(path) {
+    return path.startsWith('/') && !path.startsWith('//') && !path.startsWith('/\\');
+}
+/**
+ * Use case: a person signs in to the gateway's own pages through pagasae
+ * (decision 0054), as from an MCP client: the page to go back to is sealed
+ * with the gateway's PKCE verifier into the state, and the person is sent to
+ * pagasae naming no fleet. Only a path of the gateway's own is kept, so a
+ * sign-in never sends the browser to another site. The browser is given a
+ * secret of its own, sealed too, so only it finishes the sign-in.
+ */
+export function createStartPageSignIn(deps) {
+    return ({ returnTo }) => {
+        const verifier = deps.secrets.newSecret();
+        const browserSecret = deps.secrets.newSecret();
+        const state = deps.seals.seal({
+            holder: 'page',
+            returnTo: returnTo !== undefined && isOwnPath(returnTo) ? returnTo : FIRST_PAGE,
+            verifier,
+            browserSecret,
+            expiresAt: new Date(deps.clock.now().getTime() + SIGN_IN_LIFETIME_MS),
+        });
+        return { redirectTo: deps.pagasae.authorizeUrl({ state, codeChallenge: deps.secrets.challengeOf(verifier) }), browserSecret };
+    };
+}
+//# sourceMappingURL=start-page-sign-in.js.map

package/dist/core/sign-in/start-page-sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"start-page-sign-in.js","sourceRoot":"","sources":["../../../src/core/sign-in/start-page-sign-in.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,6FAA6F;AAC7F,MAAM,CAAC,MAAM,UAAU,GAAG,WAAW,CAAC;AAItC,kIAAkI;AAClI,SAAS,SAAS,CAAC,IAAY;IAC7B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;AACnF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAmF;IACvH,OAAO,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAC5B,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ,KAAK,SAAS,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU;YAC/E,QAAQ;YACR,aAAa;YACb,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,mBAAmB,CAAC;SACtE,CAAC,CAAC;QACH,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC;IAChI,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/sign-in/start-sign-in.d.ts

@@ -0,0 +1,30 @@
+import type { OAuthSecrets } from '../oauth/ports.js';
+import type { AuthorizationRefusal, ReadAuthorization } from '../oauth/read-authorization.js';
+import type { Clock } from '../shared/clock.js';
+import { type Result } from '../shared/result.js';
+import type { Pagasae, SignInHolder, SignInSeals } from './ports.js';
+/** How long a person has to sign in at pagasae and come back. */
+export declare const SIGN_IN_LIFETIME_MS: number;
+export type StartSignIn = (picked: {
+    request: Readonly<Record<string, string | undefined>>;
+    holder: SignInHolder;
+}) => Promise<Result<{
+    redirectTo: string;
+    browserSecret: string;
+}, AuthorizationRefusal>>;
+/**
+ * Use case: a person comes to /authorize from their MCP client (Q25) and
+ * picks what it acts as: their account, or a party they ask access for (Q1
+ * a). The client's request is read, then sealed, with that pick, with the
+ * gateway's own PKCE verifier into the state, and the person is sent to
+ * pagasae naming no fleet, so pagasae answers their only fleet or asks
+ * which (decision 0054). The browser is given a secret of its own, sealed
+ * too, so only it finishes the sign-in.
+ */
+export declare function createStartSignIn(deps: {
+    readAuthorization: ReadAuthorization;
+    seals: SignInSeals;
+    pagasae: Pagasae;
+    secrets: OAuthSecrets;
+    clock: Clock;
+}): StartSignIn;

package/dist/core/sign-in/start-sign-in.js

@@ -0,0 +1,25 @@
+import { ok } from '../shared/result.js';
+/** How long a person has to sign in at pagasae and come back. */
+export const SIGN_IN_LIFETIME_MS = 10 * 60_000;
+/**
+ * Use case: a person comes to /authorize from their MCP client (Q25) and
+ * picks what it acts as: their account, or a party they ask access for (Q1
+ * a). The client's request is read, then sealed, with that pick, with the
+ * gateway's own PKCE verifier into the state, and the person is sent to
+ * pagasae naming no fleet, so pagasae answers their only fleet or asks
+ * which (decision 0054). The browser is given a secret of its own, sealed
+ * too, so only it finishes the sign-in.
+ */
+export function createStartSignIn(deps) {
+    return async ({ request, holder }) => {
+        const read = await deps.readAuthorization(request);
+        if (!read.isOk) {
+            return read;
+        }
+        const verifier = deps.secrets.newSecret();
+        const browserSecret = deps.secrets.newSecret();
+        const state = deps.seals.seal({ verifier, browserSecret, request, holder, expiresAt: new Date(deps.clock.now().getTime() + SIGN_IN_LIFETIME_MS) });
+        return ok({ redirectTo: deps.pagasae.authorizeUrl({ state, codeChallenge: deps.secrets.challengeOf(verifier) }), browserSecret });
+    };
+}
+//# sourceMappingURL=start-sign-in.js.map

package/dist/core/sign-in/start-sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"start-sign-in.js","sourceRoot":"","sources":["../../../src/core/sign-in/start-sign-in.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAGtD,iEAAiE;AACjE,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,GAAG,MAAM,CAAC;AAI/C;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAyH;IACzJ,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;QACnC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,mBAAmB,CAAC,EAAE,CAAC,CAAC;QACnJ,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;IACpI,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/vault/credential.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The credential the gateway calls an outside MCP server with, kept in the
+ * vault, the gateway's own database (as squadrons keeps crew tokens). The
+ * server sees the gateway's credential, never the asker's: no rights travel
+ * with a message.
+ */
+export type McpServerCredential = {
+    readonly kind: 'bearer';
+    readonly token: string;
+} | {
+    readonly kind: 'clientCredentials';
+    readonly clientId: string;
+    readonly clientSecret: string;
+    /** The authorization server's issuer: the credential goes to no other. */
+    readonly issuer: string;
+    /** The OAuth scope to ask the authorization server for, if the server needs one. */
+    readonly scope?: string;
+};

package/dist/core/vault/credential.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=credential.js.map

package/dist/core/vault/credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.js","sourceRoot":"","sources":["../../../src/core/vault/credential.ts"],"names":[],"mappings":""}

package/dist/outcome-worker.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The gateway's round of request outcomes (decision 0056): each round
+ * expires the requests due, tells the outcomes still to tell, and asks the
+ * gateway's owner about new requests and withdraws the questions whose
+ * request ended. Rounds
+ * run one at a time, every interval, and at once when a request is decided;
+ * a round asked for while one runs runs right after it.
+ */
+import type { FastifyBaseLogger } from 'fastify';
+import type { Sleep } from './core/mcp-out/run-party.js';
+import type { AskOwners } from './core/requests/ask-owners.js';
+import type { ExpireRequests } from './core/requests/expire-requests.js';
+import type { TellOutcomes } from './core/requests/tell-outcomes.js';
+export interface OutcomeWorker {
+    /** Runs a round every interval until it stops. */
+    start(): void;
+    /** Runs a round now, as when a request was opened or decided. */
+    tellNow(): void;
+    /** Stops, once the round under way ended. */
+    stop(): Promise<void>;
+}
+export declare function createOutcomeWorker(deps: {
+    expireRequests: ExpireRequests;
+    tellOutcomes: TellOutcomes;
+    askOwners: AskOwners;
+    sleep: Sleep;
+    intervalMs: number;
+    log: FastifyBaseLogger;
+}): OutcomeWorker;