@aeolus-fleet/gateway 0.0.0 → 0.28.1

package/README.md

@@ -24,7 +24,7 @@ DATABASE_URL=postgresql://... FLEET_URL=https://fleet.example.com npm start
 
 | Command | Does |
 | --- | --- |
-| `aeolus-gateway start` | Reads core's version and exits 1 when core is older than it needs (core 0.27.0 or later), saying both versions; migrates its database; serves |
+| `aeolus-gateway start` | Reads core's version and exits 1 when core is older than it needs (core 0.28.0 or later), saying both versions; migrates its database; serves |
 | `aeolus-gateway migrate` | Migrates its database, and nothing else. Needs `DATABASE_URL` alone |
 
 `GET /api/version` answers the version it runs, and `GET /api/health` answers `{ "status": "ok" }` while its database answers, else 503.
@@ -33,17 +33,17 @@ DATABASE_URL=postgresql://... FLEET_URL=https://fleet.example.com npm start
 
 argo commissions the gateway's ship in the console as an app ship (decision 0044: it is software, so its messages state no model), with `fleet:read`, `fleet:commission`, `fleet:on-behalf` and `scopes:declare`, and connects the gateway with it; the gateway registers with the ship's secret, keeps only the crew token, and declares its own scope, `gateway:approve` (decision 0056): any actor the fleet grants it approves outside parties. A fleet that does not take the declaration, as when another ship holds the `gateway` namespace, is refused (CONFLICT). The gateway connects and is switched on whatever network the fleet has (interop I-3): the fleet decides its network. A fleet's outside parties (its outside MCP servers and clients) are a switch, off by default: while off, the gateway approves no party, takes no party's calls and refuses a client party's token at `/mcp` (403). `outsideParties.status` reads it; `outsideParties.set` needs `fleet:network`. Turning it on while the fleet applies no network rules (`fleet.networkRules`, read as the actor) answers PRECONDITION_FAILED with a warning until the call confirms it with `isOpenNetworkConfirmed`.
 
-The API is tRPC at `/trpc`. Its procedures take an actor (decision 0057): argo's or a viewer's console session cookie, checked with the fleet's `console.session`, or any ship's own crew token as a bearer token, for a fleet the gateway is connected to. What an actor may call is the scopes the fleet holds for it, read by the gateway's ship; a change needs `fleet:manage`. `requests.toDecide` and `requests.decide` need `gateway:approve` (decision 0056): every open pending request of the fleet, and a decision on one. Approving names the proxy ship's name, its owner (a person ship) and its scopes, only scopes the approver holds beside `messages:send` and `messages:receive`, and for an outside MCP server its credential and concurrency; the gateway commissions and crews the proxy ship as its own ship, and the fleet refuses a scope the gateway's ship does not hold. The first decision counts. A request is kept 7 days, then expires; a refused proxy ship leaves it pending. The outcome of a request for an outside MCP server is told to each requester with a person ship, as a text message from the gateway's ship: written with the decision or the expiry in one transaction, sent at once, and sent again every minute under the same idempotency key until the fleet stores it. One the fleet refuses is left for the gateway's page. Due requests expire in the same round. When a request opens, the gateway's ship asks its owner (read from the fleet; argo when argo owns it) a question (decision 0038) pointing to the gateway's `/overview`, where any holder of `gateway:approve` decides; it withdraws the question once the request is decided or expired. Both are kept and sent again under the same key until the fleet stores them. `installation.setEnabled`, `installation.get` and `installation.delete` take the installation token in `x-aeolus-installation-token`.
+The API is tRPC at `/trpc`. Its procedures take an actor (decision 0057): an account by the page session it signed in to the gateway's pages with, argo's or a viewer's console session cookie, checked with the fleet's `console.session`, or any ship's own crew token as a bearer token, for a fleet the gateway is connected to. What an actor may call is the scopes the fleet holds for it, read by the gateway's ship on the ship's own behalf (so its own read reach holds it), or for an account the scopes its account token carries; a change needs `fleet:manage`. `requests.toDecide` and `requests.decide` need `gateway:approve` (decision 0056): every open pending request of the fleet, and a decision on one. Approving names the proxy ship's name, its owner (a person ship) and its scopes, only scopes the approver holds beside `messages:send` and `messages:receive`, and for an outside MCP server its credential and concurrency; the gateway commissions and crews the proxy ship as its own ship, and the fleet refuses a scope the gateway's ship does not hold. The first decision counts. A request is kept 7 days, then expires; a refused proxy ship leaves it pending. The outcome of a request for an outside MCP server is told to each requester with a person ship, as a text message from the gateway's ship: written with the decision or the expiry in one transaction, sent at once, and sent again every minute under the same idempotency key until the fleet stores it. One the fleet refuses is left for the gateway's page. Due requests expire in the same round. When a request opens, the gateway's ship asks its owner (read from the fleet; argo when argo owns it) a question (decision 0038) pointing to the gateway's `/overview`, where any holder of `gateway:approve` decides; it withdraws the question once the request is decided or expired. Both are kept and sent again under the same key until the fleet stores them. `installation.setEnabled`, `installation.get` and `installation.delete` take the installation token in `x-aeolus-installation-token`.
 
 ## Parties
 
-argo approves an outside MCP server as a party with `parties.approve` (argo's console session): its name, its Streamable HTTP URL, the credential the gateway calls it with (a static bearer, or OAuth client credentials with their issuer), the owner argo picks for it (a person's ship or argo) and how many calls it takes at once (1 to 10, the most core's pushReceive hands at once; 4 by default). The gateway, as its own ship, commissions the party's app proxy ship of type `mcp-server` with that owner, crews it, and keeps its crew token. argo labels the proxy ship in the console, as any ship, for the network rules to select it. `parties.list` shows each party without its credential or crew token. A proxy ship left awaiting crew (the commission's answer was lost, and its secret with it) takes a new secret from a new starting prompt with `parties.crew`.
+argo approves an outside MCP server as a party with `parties.approve` (argo's console session): its name, its Streamable HTTP URL, the credential the gateway calls it with (a static bearer, or OAuth client credentials with their issuer), the owner argo picks for it (a person's ship or argo) and how many calls it takes at once (1 to 10, the most core's pushReceive hands at once; 4 by default). The gateway, as its own ship, commissions the party's app proxy ship of type `mcp-server` with that owner, crews it, and keeps its crew token. argo labels the proxy ship in the console, as any ship, for the network rules to select it. `parties.list` shows each party without its credential or crew token, with its proxy ship's owner and scopes as the fleet holds them, read as the actor who asked (decision 0056: the owner is core's, and the gateway keeps none of its own; null outside the actor's read reach, while there is no proxy ship, or while the fleet does not answer). `parties.get {name}` shows one. `parties.changeOwner {name, ownerShipId}` (needs `fleet:owner`) and `parties.changeScopes {name, grant, revoke}` (needs `scopes:grant`, only scopes the actor holds) change the proxy ship in the fleet as the actor, so the fleet checks its manage reach (decision 0056); the gateway keeps neither. `parties.retire` retires a party (decision 0056): it needs `fleet:manage`, and the gateway retires the proxy ship in the fleet as the actor who asked, so the fleet checks its manage reach; only then does the gateway forget the party and revoke its client's tokens. A proxy ship retired already counts as retired. Adding it again is a new request. A proxy ship left awaiting crew (the commission's answer was lost, and its secret with it) takes a new secret from a new starting prompt with `parties.crew`.
 
-The gateway keeps outside credentials and crew tokens as they are in its own database, as squadrons keeps crew tokens: a key on the same server would protect only backups. Guard the database and its backups accordingly.
+Once a proxy ship is crewed, the gateway's ship writes what the gateway checked about it as verified facts (`fleet:verify`, decision 0059), which discovery shows beside its statement: `tlsHost` for an MCP server reached over https, `clientIdDocumentDomain` for an MCP client known by an https metadata document. A write the fleet refuses is logged and leaves the approval as it is; in a fleet that applies its own network rules the gateway's ship has no manage reach over its proxy ships, so the fleet refuses them there. The gateway's ship needs `fleet:verify` to connect.
 
-`parties.state` states the proxy ship anew from the server's `tools/list`: each tool is one capability with its MCP fields and annotations, called with `application/vnd.aeolus.mcp-tool+json; name=<tool>` (the tool arguments as a JSON object) and answered with `application/vnd.aeolus.mcp-result+json; name=<tool>` (the tool result). The summary names the party only, never its URL or credential. `parties.markTool` marks a tool repeatable, or takes the mark off, and states it at once: only argo's mark lets the gateway hand a call that died unanswered again; the server's hints never do.
+The gateway keeps outside credentials and crew tokens as they are in its own database, as squadrons keeps crew tokens: a key on the same server would protect only backups. Guard the database and its backups accordingly.
 
-Commissioning an app ship with a named owner needs core 0.28 (aeolus-fleet#959), and so do the statement's `annotations` and `repeatable` fields (aeolus-fleet#956): core 0.27 refuses a statement that holds them.
+`parties.state` states the proxy ship anew from the server's `tools/list`: each tool is one capability with its MCP fields and annotations, called with `application/vnd.aeolus.mcp-tool+json; name=<tool>` (the tool arguments as a JSON object) and answered with `application/vnd.aeolus.mcp-result+json; name=<tool>` (the tool result). The summary names the party only, never its URL or credential. Each capability states the gateway's own timing: `waitMs`, how long an outside client waits for the answer (`MCP_WAIT_MAX_MS`), and `deadlineMs`, when the gateway gives up on the server's `tools/call` (`TOOL_CALL_TIMEOUT_MS`). `parties.markTool` marks a tool repeatable, or takes the mark off, and states it at once: only argo's mark lets the gateway hand a call that died unanswered again; the server's hints never do.
 
 ## The page of parties
 
@@ -57,7 +57,7 @@ From its start, and as soon as a party is crewed, the gateway takes the calls of
 - A call sent with no answer (a broken stream, no answer within 5 minutes) is handed again only when argo marked its tool repeatable. Otherwise the gateway reports it not handled: it may have run, and a human who can check the outside system resends or dismisses it.
 - A party takes at most its concurrency limit of calls at once.
 
-With core 0.27 the not handled report is refused (aeolus-fleet#955): the call is never made again, and its delivery stays handed until argo resends or dismisses it.
+Each hand-over names its channel, `mcp` (interop 5.1). A call reported not handled shows in the console's Needs attention with why, for argo to resend or dismiss; it is never called again.
 
 ## MCP clients sign in
 
@@ -67,6 +67,7 @@ The gateway is an OAuth 2.1 authorization server for outside MCP clients, such a
 - A client is pre-registered by argo with `oauth.registerClient` (its name, its redirect URIs, and whether it keeps a secret, answered once), or known by its client metadata document (CIMD): its client id is the https URL of that document. There is no dynamic registration.
 - `/authorize` shows the client and two picks (decision 0056, Q1 a): sign in as yourself, or ask for access for this client. Either sends the person to pagasae to sign in. Only the authorization code flow with PKCE S256 is served, and the `resource` must be the gateway's MCP endpoint (RFC 8707).
 - A person signs in through pagasae (decision 0054). pagasae answers their only fleet, or asks which, and sends them back to `/pagasae/callback`; signed in as themselves, the gateway keeps their account's grant (the account, its fleet, its person ship and pagasae's tokens) and sends their client back with its code, with no approval. The sign-in under way travels sealed in pagasae's `state`, so nothing is stored before the fleet is known. The browser that starts it holds a secret sealed with it, in an HttpOnly cookie sent only to `/pagasae/callback` for its 10 minutes, so no other browser finishes it (login CSRF). A fleet the gateway does not serve is refused. A person's client is served their person ship's tools: `aeolus_inbox` (what waits, by titles only, at most 10), `aeolus_open` (one delivery whole; opening it acknowledges it), `aeolus_answer` (a reply to its sender, then it is handled) and `aeolus_done` (handled with no answer). The gateway makes these calls as the crew of the account's own person ship, with the account's token (decision 0057): it crews the ship once, shared by every client of the person, and crews it again when its lease ended. An account with no person ship is told so, and the fleet is asked nothing. `aeolus_ask_for_server` asks for an outside MCP server by its http or https address, as the account (decision 0056): it opens a pending request, or joins the one pending for the same server, and an approver adds the server with its credential. A server that is a party already is said so. While the fleet's outside parties are off, nobody asks.
+- A person signs in to the gateway's own pages at `/sign-in?return_to=<a path of the gateway's>` through pagasae as well (decision 0054): back at `/pagasae/callback`, the gateway keeps the account's grant with the scopes its account token carries, and the browser holds a page session naming it in the HttpOnly cookie `aeolus_gateway_session` (path `/`, SameSite Lax, for the browser's session), not the console's `aeolus_session`, which reaches only the fleet's own domain. The pages then act as the account, its account token refreshed through pagasae when about to end; what the gateway asks the fleet for the account, such as the network rules when outside parties are turned on, it asks with that token, presented by the gateway's ship. A path that is not the gateway's own goes to `/overview`. A form posting to `/sign-out` from the gateway's own pages ends the session's grant and its cookie; the account's MCP clients stay signed in.
 - A person who asks for access for the client asks as their account. A client that is a party already is sent back with its party's code at once. Otherwise the account opens a pending request for the client, or joins the one pending, and its browser waits at `/authorize/waiting`, which reloads itself: approved and its proxy ship crewed, the client gets its party's code; denied or expired, `access_denied`. Closed meanwhile, the next try after a deny or expiry ends with `access_denied` once, and a later try asks anew. The waiting travels sealed in the page's address, and the browser holds the sign-in's secret in an HttpOnly cookie sent only to the waiting page, for the request's 7 days. While the fleet's outside parties are off, nobody asks. Each client party has its own app proxy ship, of type `mcp-client`; every token of a client party names its party, so every fleet call the client makes is its proxy ship's, within its reach; a person's token names their account's grant. `parties.list` shows client parties beside server parties.
 - `/token` takes a code once, within its minute, for an access token (one hour) and a refresh token (30 days). Refreshing rotates the pair; a code or a refresh token used twice revokes what it gave.
 
@@ -83,13 +84,13 @@ Serve the gateway at its own origin, such as `https://gateway.example.com`, with
 - Its description is the capability's, then the ship's summary. A capability that takes plain text first gets one `text` argument. Every tool takes an optional `aeolus_idempotency_key`.
 - Left out: argo, ships with no statement by their crew, capabilities whose first input type is neither JSON nor plain text or whose input schema is not an object, and tool names over 128 characters.
 - No tool states an output schema: a call may answer a handle, and MCP clients check every answer against it.
-- `tools/call` sends the arguments, without `aeolus_idempotency_key`, as a message from the client's proxy ship to the tool's ship, under the capability's first input type. The client is answered only once the fleet answered the send. The call then waits up to `MCP_WAIT_MAX_MS` for its answer: answered within it, the client gets the answer itself; else `{"handle": "...", "state": "submitted"}` (or `working`). A fleet that refuses the send gets a tool error, and one that cannot be reached gives no reason why.
+- `tools/call` sends the arguments, without `aeolus_idempotency_key`, as a message from the client's proxy ship to the tool's ship, under the capability's first input type. The client is answered only once the fleet answered the send. The call then waits for its answer as long as the capability's `waitMs` states, at most `MCP_WAIT_MAX_MS` (interop 5.3), and not at all when it states none: answered within it, the client gets the answer itself; else `{"handle": "...", "state": "submitted"}` (or `working`). A fleet that refuses the send gets a tool error, and one that cannot be reached gives no reason why.
 - The same `aeolus_idempotency_key` again sends no second message. The send's key is derived from it under `GATEWAY_SECRET`, and the handle from the message, so the client never sees a `msg_` id.
 - `aeolus_result({ handle })` reads the client's own call: `submitted`, `working` once a reply of another type came, its answer once completed, or a tool error once it failed (interop 3.4).
 - MCP Tasks (`io.modelcontextprotocol/tasks`, stated at `server/discover`): a client that declares the extension on its `tools/call` is answered a task in place of the handle, its `taskId` the handle. `tasks/get` reads it: `working` while submitted or working, `completed` with the answer as its `result`, or `failed` once its deadline passed. A task never expires (`ttlMs` null), as the gateway keeps every call. `tasks/cancel` and `tasks/update` are acknowledged and change nothing: a sent call cannot be unsent, and no call asks for input yet.
 - The first reply of the capability's first output type completes it; plain text completes a call to a ship that states no output type. An outside tool's result, as MCP out replies one, is answered as that result.
-- A call fails 10 minutes after it was sent without its answer: the gateway's default while statements state no deadline. A reply after that is kept and changes nothing.
-- Each client party's worker takes the replies of its proxy ship, keeps each on its call, then acknowledges and handles its delivery. With core 0.27 a message to the proxy ship that replies to no call stays unacknowledged, for a later slice's inbox. Ten of them would take every pushReceive answer and keep replies out, until core 0.28's `receiveReply` (aeolus-fleet#953) takes replies by message.
+- A call fails at its capability's `deadlineMs` after it was sent without its answer, and never by time when the capability states none (interop 3.4). A reply after the deadline is kept and changes nothing.
+- Each client party's worker takes the replies to its calls with `receiveReply` (aeolus-fleet#953) for each call neither completed nor past its deadline, at most 10 calls at once, each in its turn: it keeps each reply on its call, then acknowledges and handles its delivery. It never takes a delivery with `pushReceive`, so the proxy ship's lease stays plain, as `receiveReply` needs. A message to the proxy ship that replies to no call waits in the fleet and keeps no reply out.
 
 ## Develop
 

package/dist/adapters/crypto/page-sessions.d.ts

@@ -0,0 +1,15 @@
+import type { PageSessions } from '../../core/sign-in/ports.js';
+/** The cookie a browser signed in to the gateway's pages holds; not the console's aeolus_session, which the fleet reads. */
+export declare const PAGE_SESSION_COOKIE = "aeolus_gateway_session";
+/**
+ * The page session's own pair in a Cookie header, and nothing else: the
+ * pages are accounts only (Thomas, 20 Oct), so no other cookie the browser
+ * sends, such as the console's, reaches them.
+ */
+export declare function pageCookieOf(header: string | undefined): string | undefined;
+/**
+ * Seals a page session into the gateway's own cookie under a key derived
+ * from the gateway's secret, and finds it in a Cookie header. A value
+ * changed on the way, or sealed under another secret or label, is none.
+ */
+export declare function createPageSessions(secret: string): PageSessions;

package/dist/adapters/crypto/page-sessions.js

@@ -0,0 +1,40 @@
+import { idSchema } from '@aeolus-fleet/common';
+import { z } from 'zod';
+import { createSealer } from './sealer.js';
+/** The cookie a browser signed in to the gateway's pages holds; not the console's aeolus_session, which the fleet reads. */
+export const PAGE_SESSION_COOKIE = 'aeolus_gateway_session';
+const PREFIX = `${PAGE_SESSION_COOKIE}=`;
+/**
+ * The page session's own pair in a Cookie header, and nothing else: the
+ * pages are accounts only (Thomas, 20 Oct), so no other cookie the browser
+ * sends, such as the console's, reaches them.
+ */
+export function pageCookieOf(header) {
+    return header
+        ?.split(';')
+        .map((pair) => pair.trim())
+        .find((pair) => pair.startsWith(PREFIX) && pair.length > PREFIX.length);
+}
+/** Its own label, so the sealing key is never also a key the gateway derives elsewhere. */
+const SEAL_LABEL = 'page-session';
+const sealedSchema = z.object({ fleetId: idSchema('fleet'), grantId: z.string().min(1) });
+/**
+ * Seals a page session into the gateway's own cookie under a key derived
+ * from the gateway's secret, and finds it in a Cookie header. A value
+ * changed on the way, or sealed under another secret or label, is none.
+ */
+export function createPageSessions(secret) {
+    const sealer = createSealer(secret, SEAL_LABEL);
+    return {
+        seal: ({ fleetId, grantId }) => sealer.seal({ fleetId, grantId }),
+        inCookie: (cookie) => {
+            const sealed = pageCookieOf(cookie)?.slice(PREFIX.length);
+            if (sealed === undefined) {
+                return undefined;
+            }
+            const session = sealedSchema.safeParse(sealer.open(sealed));
+            return session.success ? session.data : undefined;
+        },
+    };
+}
+//# sourceMappingURL=page-sessions.js.map

package/dist/adapters/crypto/page-sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"page-sessions.js","sourceRoot":"","sources":["../../../src/adapters/crypto/page-sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,4HAA4H;AAC5H,MAAM,CAAC,MAAM,mBAAmB,GAAG,wBAAwB,CAAC;AAE5D,MAAM,MAAM,GAAG,GAAG,mBAAmB,GAAG,CAAC;AAEzC;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,MAA0B;IACrD,OAAO,MAAM;QACX,EAAE,KAAK,CAAC,GAAG,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;AAC5E,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,GAAG,cAAc,CAAC;AAElC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAE1F;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAChD,OAAO;QACL,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QACjE,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE;YACnB,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC1D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,MAAM,OAAO,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5D,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACpD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/adapters/crypto/request-ids.d.ts

@@ -1,4 +1,4 @@
 import { createIdGenerator } from '@aeolus-fleet/common';
 import type { RequestIds } from '../../core/requests/ports.js';
-/** New request ids: a common id's time-ordered body under the request prefix. */
+/** New request ids: common's time-ordered ids of kind request (`req_`). */
 export declare function createRequestIds(options?: Parameters<typeof createIdGenerator>[0]): RequestIds;

package/dist/adapters/crypto/request-ids.js

@@ -1,14 +1,7 @@
 import { createIdGenerator } from '@aeolus-fleet/common';
-/** The prefix common gives a pending request from 0.28.0 (`ID_PREFIXES.request`); until then its time-ordered body is drawn here (aeolus-fleet#991). */
-const REQUEST_PREFIX = 'req_';
-/** New request ids: a common id's time-ordered body under the request prefix. */
+/** New request ids: common's time-ordered ids of kind request (`req_`). */
 export function createRequestIds(options = {}) {
     const generate = createIdGenerator(options);
-    return {
-        newRequestId: () => {
-            const id = generate('event');
-            return `${REQUEST_PREFIX}${id.slice(id.indexOf('_') + 1)}`;
-        },
-    };
+    return { newRequestId: () => generate('request') };
 }
 //# sourceMappingURL=request-ids.js.map

package/dist/adapters/crypto/request-ids.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-ids.js","sourceRoot":"","sources":["../../../src/adapters/crypto/request-ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAIzD,wJAAwJ;AACxJ,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,UAAmD,EAAE;IACpF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO;QACL,YAAY,EAAE,GAAG,EAAE;YACjB,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC7B,OAAO,GAAG,cAAc,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC7D,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"request-ids.js","sourceRoot":"","sources":["../../../src/adapters/crypto/request-ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAIzD,2EAA2E;AAC3E,MAAM,UAAU,gBAAgB,CAAC,UAAmD,EAAE;IACpF,MAAM,QAAQ,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;AACrD,CAAC"}

package/dist/adapters/crypto/sign-in-seals.d.ts

@@ -1,6 +1,6 @@
 import type { SignInSeals } from '../../core/sign-in/ports.js';
 /**
- * Seals a sign-in under way into the state pagasae carries back, under a key
+ * Seals a sign-in under way, a client's or the pages', into the state pagasae carries back, under a key
  * derived from the gateway's secret. A state changed on the way, or sealed
  * under another secret, opens to nothing.
  */

package/dist/adapters/crypto/sign-in-seals.js

@@ -2,22 +2,20 @@ import { z } from 'zod';
 import { createSealer, setParameters } from './sealer.js';
 /** Its own label, so the sealing key is never also a key the gateway derives elsewhere. */
 const SEAL_LABEL = 'sign-in-seal';
-const sealedSchema = z.object({
-    verifier: z.string(),
-    browserSecret: z.string(),
-    request: z.record(z.string(), z.string()),
-    holder: z.enum(['account', 'party']),
-    expiresAt: z.iso.datetime(),
-});
+const underWay = { verifier: z.string(), browserSecret: z.string(), expiresAt: z.iso.datetime() };
+const sealedSchema = z.discriminatedUnion('holder', [
+    z.object({ ...underWay, holder: z.enum(['account', 'party']), request: z.record(z.string(), z.string()) }),
+    z.object({ ...underWay, holder: z.literal('page'), returnTo: z.string() }),
+]);
 /**
- * Seals a sign-in under way into the state pagasae carries back, under a key
+ * Seals a sign-in under way, a client's or the pages', into the state pagasae carries back, under a key
  * derived from the gateway's secret. A state changed on the way, or sealed
  * under another secret, opens to nothing.
  */
 export function createSignInSeals(secret) {
     const sealer = createSealer(secret, SEAL_LABEL);
     return {
-        seal: ({ verifier, browserSecret, request, holder, expiresAt }) => sealer.seal({ verifier, browserSecret, request: setParameters(request), holder, expiresAt: expiresAt.toISOString() }),
+        seal: (signIn) => sealer.seal(signIn.holder === 'page' ? { ...signIn, expiresAt: signIn.expiresAt.toISOString() } : { ...signIn, request: setParameters(signIn.request), expiresAt: signIn.expiresAt.toISOString() }),
         open: (state) => {
             const signIn = sealedSchema.safeParse(sealer.open(state));
             return signIn.success ? { ...signIn.data, expiresAt: new Date(signIn.data.expiresAt) } : undefined;

package/dist/adapters/crypto/sign-in-seals.js.map

@@ -1 +1 @@
-{"version":3,"file":"sign-in-seals.js","sourceRoot":"","sources":["../../../src/adapters/crypto/sign-in-seals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE1D,2FAA2F;AAC3F,MAAM,UAAU,GAAG,cAAc,CAAC;AAElC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACzC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACpC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;CAC5B,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAChD,OAAO;QACL,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QACxL,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;YACd,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1D,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACrG,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sign-in-seals.js","sourceRoot":"","sources":["../../../src/adapters/crypto/sign-in-seals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE1D,2FAA2F;AAC3F,MAAM,UAAU,GAAG,cAAc,CAAC;AAElC,MAAM,QAAQ,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;AAClG,MAAM,YAAY,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IAClD,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;IAC1G,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CAC3E,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAChD,OAAO;QACL,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,CACf,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QACrM,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;YACd,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1D,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QACrG,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/adapters/fleet/actor-door.d.ts

@@ -0,0 +1,20 @@
+import type { ActorCredential } from '../../core/actors/credential-of.js';
+import type { FleetRefusal } from '../../core/connection/ports.js';
+import { type Result } from '../../core/shared/result.js';
+/** The fleet's refusal as its code and message, whichever door answered it. */
+export declare function refusalOf(status: number, body: unknown): FleetRefusal;
+/** The headers a REST call carries as the actor: its crew token, and the account's token it presents. */
+export declare function restHeaders(as: ActorCredential): Record<string, string>;
+/** One fleet mutation as the actor, by the door its credential goes through: what the fleet answered, unparsed. */
+export declare function mutateAs(fleetUrl: string, call: {
+    as: ActorCredential;
+    procedure: string;
+    input: unknown;
+    isTrpcOnly?: boolean;
+}): Promise<Result<unknown, FleetRefusal>>;
+/** One fleet read as the actor: a ship or an account over REST, argo or a viewer over tRPC as a query; what the fleet answered, unparsed. */
+export declare function readAs(fleetUrl: string, call: {
+    as: ActorCredential;
+    procedure: string;
+    input: unknown;
+}): Promise<Result<unknown, FleetRefusal>>;

package/dist/adapters/fleet/actor-door.js

@@ -0,0 +1,75 @@
+/**
+ * The fleet's two doors for a call made as the actor (decision 0057): a crew
+ * token, alone or presenting an account's token, over REST; argo's or a
+ * viewer's console session over tRPC, as the console calls it. Each answers
+ * the fleet's refusal as its code and message.
+ */
+import { ACCOUNT_TOKEN_HEADER } from '@aeolus-fleet/common';
+import { z } from 'zod';
+import { err, ok } from '../../core/shared/result.js';
+const refusalSchema = z.object({ code: z.string(), message: z.string() });
+const trpcRefusalSchema = z.object({ error: z.object({ message: z.string(), data: z.object({ code: z.string() }) }) });
+const trpcAnswerSchema = z.object({ result: z.object({ data: z.unknown() }) });
+/** The fleet's refusal as its code and message, whichever door answered it. */
+export function refusalOf(status, body) {
+    const rest = refusalSchema.safeParse(body);
+    if (rest.success) {
+        return rest.data;
+    }
+    const trpc = trpcRefusalSchema.safeParse(body);
+    return trpc.success ? { code: trpc.data.error.data.code, message: trpc.data.error.message } : { code: 'UNAVAILABLE', message: `The fleet answered ${String(status)}` };
+}
+/** The headers a REST call carries as the actor: its crew token, and the account's token it presents. */
+export function restHeaders(as) {
+    return { authorization: `Bearer ${as.crewToken ?? ''}`, ...(as.accountToken === undefined ? {} : { [ACCOUNT_TOKEN_HEADER]: as.accountToken }) };
+}
+/** One fleet mutation as the actor, by the door its credential goes through: what the fleet answered, unparsed. */
+export async function mutateAs(fleetUrl, call) {
+    const { as, procedure, input } = call;
+    const isConsole = as.crewToken === undefined;
+    // A call with no REST door goes over tRPC with the same headers a REST call carries.
+    const isTrpc = isConsole || call.isTrpcOnly === true;
+    const request = isConsole
+        ? { url: `${fleetUrl}/trpc/fleet.${procedure}`, headers: { cookie: as.cookie ?? '' } }
+        : { url: isTrpc ? `${fleetUrl}/trpc/fleet.${procedure}` : `${fleetUrl}/api/v1/fleet/${procedure}`, headers: restHeaders(as) };
+    let response;
+    try {
+        response = await fetch(request.url, { method: 'POST', headers: { 'content-type': 'application/json', ...request.headers }, body: JSON.stringify(input) });
+    }
+    catch (error) {
+        return err({ code: 'UNAVAILABLE', message: error instanceof Error ? error.message : 'The fleet did not answer' });
+    }
+    const body = await response.json().catch(() => null);
+    if (!response.ok) {
+        return err(refusalOf(response.status, body));
+    }
+    if (!isTrpc) {
+        return ok(body);
+    }
+    const answer = trpcAnswerSchema.safeParse(body);
+    return answer.success ? ok(answer.data.result.data) : err({ code: 'UNAVAILABLE', message: 'The fleet answered no result' });
+}
+/** One fleet read as the actor: a ship or an account over REST, argo or a viewer over tRPC as a query; what the fleet answered, unparsed. */
+export async function readAs(fleetUrl, call) {
+    const { as, procedure, input } = call;
+    const isConsole = as.crewToken === undefined;
+    let response;
+    try {
+        response = isConsole
+            ? await fetch(`${fleetUrl}/trpc/fleet.${procedure}?input=${encodeURIComponent(JSON.stringify(input))}`, { headers: { cookie: as.cookie ?? '' } })
+            : await fetch(`${fleetUrl}/api/v1/fleet/${procedure}`, { method: 'POST', headers: { 'content-type': 'application/json', ...restHeaders(as) }, body: JSON.stringify(input) });
+    }
+    catch (error) {
+        return err({ code: 'UNAVAILABLE', message: error instanceof Error ? error.message : 'The fleet did not answer' });
+    }
+    const body = await response.json().catch(() => null);
+    if (!response.ok) {
+        return err(refusalOf(response.status, body));
+    }
+    if (!isConsole) {
+        return ok(body);
+    }
+    const answer = trpcAnswerSchema.safeParse(body);
+    return answer.success ? ok(answer.data.result.data) : err({ code: 'UNAVAILABLE', message: 'The fleet answered no result' });
+}
+//# sourceMappingURL=actor-door.js.map

package/dist/adapters/fleet/actor-door.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor-door.js","sourceRoot":"","sources":["../../../src/adapters/fleet/actor-door.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,6BAA6B,CAAC;AAEnE,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC1E,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AACvH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;AAE/E,+EAA+E;AAC/E,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,IAAa;IACrD,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,sBAAsB,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;AACzK,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,WAAW,CAAC,EAAmB;IAC7C,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,SAAS,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,oBAAoB,CAAC,EAAE,EAAE,CAAC,YAAY,EAAE,CAAC,EAAE,CAAC;AAClJ,CAAC;AAED,mHAAmH;AACnH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,QAAgB,EAAE,IAAsF;IACrI,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACtC,MAAM,SAAS,GAAG,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC;IAC7C,qFAAqF;IACrF,MAAM,MAAM,GAAG,SAAS,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC;IACrD,MAAM,OAAO,GAAG,SAAS;QACvB,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,QAAQ,eAAe,SAAS,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE;QACtF,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,QAAQ,eAAe,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,QAAQ,iBAAiB,SAAS,EAAE,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;IAChI,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5J,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,EAAE,CAAC,CAAC;IACpH,CAAC;IACD,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;AAC9H,CAAC;AAED,6IAA6I;AAC7I,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,QAAgB,EAAE,IAAgE;IAC7G,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;IACtC,MAAM,SAAS,GAAG,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC;IAC7C,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,SAAS;YAClB,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,QAAQ,eAAe,SAAS,UAAU,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE,CAAC;YACjJ,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,QAAQ,iBAAiB,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACjL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,EAAE,CAAC,CAAC;IACpH,CAAC;IACD,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;AAC9H,CAAC"}

package/dist/adapters/fleet/core-version.d.ts

@@ -1,11 +1,11 @@
+/**
+ * The minimum core version check (decision 0049, docs/compatibility.md): the
+ * gateway reads core's version at start and refuses to run against an older
+ * core, saying both versions, as common's coreVersionRefusal words it.
+ */
+import { type VersionFetch } from '@aeolus-fleet/common';
+export type { VersionFetch };
 /** The oldest core the gateway runs against: the ship contract it calls (docs/compatibility.md). */
-export declare const MINIMUM_CORE_VERSION = "0.27.0";
-/** The part of `fetch` the check uses, so a test hands in its own core. */
-export type VersionFetch = (url: string, init: {
-    signal: AbortSignal;
-}) => Promise<{
-    status: number;
-    json(): Promise<unknown>;
-}>;
+export declare const MINIMUM_CORE_VERSION = "0.28.0";
 /** Stops the start when the fleet's core is older than the gateway needs, or does not say its version. */
 export declare function requireCoreVersion(fleetUrl: string, fetch?: VersionFetch): Promise<void>;

package/dist/adapters/fleet/core-version.js

@@ -1,59 +1,18 @@
 /**
  * The minimum core version check (decision 0049, docs/compatibility.md): the
  * gateway reads core's version at start and refuses to run against an older
- * core, saying both versions. It follows @aeolus-fleet/common's
- * coreVersionRefusal, which no released common carries yet; the gateway
- * takes common's once it is on npm.
+ * core, saying both versions, as common's coreVersionRefusal words it.
  */
-import { z } from 'zod';
+import { coreVersionRefusal } from '@aeolus-fleet/common';
 import { ConfigError } from '../../config.js';
 import { runningVersion } from '../http/version.js';
 /** The oldest core the gateway runs against: the ship contract it calls (docs/compatibility.md). */
-export const MINIMUM_CORE_VERSION = '0.27.0';
-/** Where core says its version, without authentication. */
-const CORE_VERSION_PATH = '/api/version';
-/** How long the gateway waits for core's version before it counts the fleet as not answering. */
-const CORE_VERSION_TIMEOUT_MS = 10_000;
-/** The HTTP statuses that answer a version. */
-const HTTP_OK_FIRST = 200;
-const HTTP_OK_LAST = 299;
-/** A plain release version; core `0.0.0` is a build from main. */
-const VERSION_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
-const coreVersionAnswerSchema = z.object({ server: z.string() });
-function versionOf(text) {
-    const match = VERSION_PATTERN.exec(text);
-    return match === null ? undefined : [Number(match[1]), Number(match[2]), Number(match[3])];
-}
-function isOlder(version, than) {
-    const differing = version.findIndex((part, index) => part !== than[index]);
-    return differing !== -1 && (version[differing] ?? 0) < (than[differing] ?? 0);
-}
-/** Core's version, or why it could not be read. */
-async function readCoreVersion(fleetUrl, fetch) {
-    try {
-        const response = await fetch(`${fleetUrl.replace(/\/+$/, '')}${CORE_VERSION_PATH}`, { signal: AbortSignal.timeout(CORE_VERSION_TIMEOUT_MS) });
-        if (response.status < HTTP_OK_FIRST || response.status > HTTP_OK_LAST) {
-            return { unread: `HTTP ${String(response.status)}` };
-        }
-        const answer = coreVersionAnswerSchema.safeParse(await response.json());
-        const parsed = answer.success ? versionOf(answer.data.server) : undefined;
-        return answer.success && parsed !== undefined ? { core: answer.data.server, parsed } : { unread: `its ${CORE_VERSION_PATH} answered no core version` };
-    }
-    catch (error) {
-        return { unread: error instanceof Error ? error.message : String(error) };
-    }
-}
+export const MINIMUM_CORE_VERSION = '0.28.0';
 /** Stops the start when the fleet's core is older than the gateway needs, or does not say its version. */
 export async function requireCoreVersion(fleetUrl, fetch = globalThis.fetch) {
-    const needs = `gateway ${runningVersion()} needs core ${MINIMUM_CORE_VERSION} or later`;
-    const minimum = versionOf(MINIMUM_CORE_VERSION) ?? [0, 0, 0];
-    const read = await readCoreVersion(fleetUrl, fetch);
-    if ('unread' in read) {
-        throw new ConfigError(`${needs}, and could not read the version of the fleet at ${fleetUrl}: ${read.unread}`);
-    }
-    const isMainBuild = read.parsed.every((part) => part === 0);
-    if (!isMainBuild && isOlder(read.parsed, minimum)) {
-        throw new ConfigError(`${needs}; the fleet at ${fleetUrl} runs core ${read.core}: upgrade core first`);
+    const refusal = await coreVersionRefusal({ packageName: 'gateway', version: runningVersion(), minimum: MINIMUM_CORE_VERSION, fleetUrl, fetch });
+    if (refusal !== undefined) {
+        throw new ConfigError(refusal);
     }
 }
 //# sourceMappingURL=core-version.js.map

package/dist/adapters/fleet/core-version.js.map

@@ -1 +1 @@
-{"version":3,"file":"core-version.js","sourceRoot":"","sources":["../../../src/adapters/fleet/core-version.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,oGAAoG;AACpG,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAE7C,2DAA2D;AAC3D,MAAM,iBAAiB,GAAG,cAAc,CAAC;AAEzC,iGAAiG;AACjG,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAEvC,+CAA+C;AAC/C,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,YAAY,GAAG,GAAG,CAAC;AAEzB,kEAAkE;AAClE,MAAM,eAAe,GAAG,4CAA4C,CAAC;AAErE,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAOjE,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,OAAO,CAAC,OAAgB,EAAE,IAAa;IAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,OAAO,SAAS,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,mDAAmD;AACnD,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,KAAmB;IAClE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,iBAAiB,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;QAC9I,IAAI,QAAQ,CAAC,MAAM,GAAG,aAAa,IAAI,QAAQ,CAAC,MAAM,GAAG,YAAY,EAAE,CAAC;YACtE,OAAO,EAAE,MAAM,EAAE,QAAQ,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACvD,CAAC;QACD,MAAM,MAAM,GAAG,uBAAuB,CAAC,SAAS,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACxE,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1E,OAAO,MAAM,CAAC,OAAO,IAAI,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,iBAAiB,2BAA2B,EAAE,CAAC;IACzJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,0GAA0G;AAC1G,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAgB,EAAE,QAAsB,UAAU,CAAC,KAAK;IAC/F,MAAM,KAAK,GAAG,WAAW,cAAc,EAAE,eAAe,oBAAoB,WAAW,CAAC;IACxF,MAAM,OAAO,GAAY,SAAS,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACtE,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACpD,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,WAAW,CAAC,GAAG,KAAK,oDAAoD,QAAQ,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAChH,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC;IAC5D,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,WAAW,CAAC,GAAG,KAAK,kBAAkB,QAAQ,cAAc,IAAI,CAAC,IAAI,sBAAsB,CAAC,CAAC;IACzG,CAAC;AACH,CAAC"}
+{"version":3,"file":"core-version.js","sourceRoot":"","sources":["../../../src/adapters/fleet/core-version.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,kBAAkB,EAAqB,MAAM,sBAAsB,CAAC;AAE7E,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAIpD,oGAAoG;AACpG,MAAM,CAAC,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AAE7C,0GAA0G;AAC1G,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAgB,EAAE,QAAsB,UAAU,CAAC,KAAK;IAC/F,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAChJ,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;AACH,CAAC"}

package/dist/adapters/fleet/fleet-network.js

@@ -1,30 +1,20 @@
 /**
  * Reads whether the fleet applies network rules with `fleet.networkRules`
  * (aeolus-fleet #997), as the actor who asked (decision 0057): a ship with its
- * crew token over REST, argo with the console session over tRPC. The answer's
- * schema stands in for common's until core 0.28 publishes it (aeolus-fleet#991).
+ * crew token over REST, an account with its account token presented by the
+ * gateway's ship over REST, argo with the console session over tRPC.
  */
+import { networkRulesOutputSchema } from '@aeolus-fleet/common';
 import { z } from 'zod';
 import { err, ok } from '../../core/shared/result.js';
-const networkRulesSchema = z.object({ applied: z.object({ rules: z.array(z.unknown()).nullable() }) });
-const trpcAnswerSchema = z.object({ result: z.object({ data: networkRulesSchema }) }).transform(({ result }) => result.data);
-const refusalSchema = z.object({ code: z.string(), message: z.string() });
-const trpcRefusalSchema = z.object({ error: z.object({ message: z.string(), data: z.object({ code: z.string() }) }) });
-/** The fleet's refusal as its code and message, whichever door answered it. */
-function refusalOf(status, body) {
-    const rest = refusalSchema.safeParse(body);
-    if (rest.success) {
-        return rest.data;
-    }
-    const trpc = trpcRefusalSchema.safeParse(body);
-    return trpc.success ? { code: trpc.data.error.data.code, message: trpc.data.error.message } : { code: 'UNAVAILABLE', message: `The fleet answered ${String(status)}` };
-}
+import { refusalOf, restHeaders } from './actor-door.js';
+const trpcAnswerSchema = z.object({ result: z.object({ data: networkRulesOutputSchema }) }).transform(({ result }) => result.data);
 export function createFleetNetwork(fleetUrl) {
     return {
         isOpen: async (as) => {
             const request = as.crewToken === undefined
                 ? { url: `${fleetUrl}/trpc/fleet.networkRules`, headers: { cookie: as.cookie ?? '' } }
-                : { url: `${fleetUrl}/api/v1/fleet/networkRules`, headers: { authorization: `Bearer ${as.crewToken}` } };
+                : { url: `${fleetUrl}/api/v1/fleet/networkRules`, headers: restHeaders(as) };
             let response;
             try {
                 response = await fetch(request.url, { headers: request.headers });
@@ -36,7 +26,7 @@ export function createFleetNetwork(fleetUrl) {
             if (!response.ok) {
                 return err(refusalOf(response.status, body));
             }
-            const rules = (as.crewToken === undefined ? trpcAnswerSchema : networkRulesSchema).safeParse(body);
+            const rules = (as.crewToken === undefined ? trpcAnswerSchema : networkRulesOutputSchema).safeParse(body);
             return rules.success ? ok(rules.data.applied.rules === null) : err({ code: 'UNAVAILABLE', message: 'The fleet answered no network rules' });
         },
     };

package/dist/adapters/fleet/fleet-network.js.map

@@ -1 +1 @@
-{"version":3,"file":"fleet-network.js","sourceRoot":"","sources":["../../../src/adapters/fleet/fleet-network.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,6BAA6B,CAAC;AAEnE,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;AACvG,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC7H,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC1E,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAEvH,+EAA+E;AAC/E,SAAS,SAAS,CAAC,MAAc,EAAE,IAAa;IAC9C,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,sBAAsB,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;AACzK,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,OAAO;QACL,MAAM,EAAE,KAAK,EAAE,EAAmB,EAA0C,EAAE;YAC5E,MAAM,OAAO,GACX,EAAE,CAAC,SAAS,KAAK,SAAS;gBACxB,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,QAAQ,0BAA0B,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE;gBACtF,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,QAAQ,4BAA4B,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC;YAC7G,IAAI,QAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YACpE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,EAAE,CAAC,CAAC;YACpH,CAAC;YACD,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC9D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;YAC/C,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACnG,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;QAC9I,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"fleet-network.js","sourceRoot":"","sources":["../../../src/adapters/fleet/fleet-network.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAKxB,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEzD,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAEnI,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,OAAO;QACL,MAAM,EAAE,KAAK,EAAE,EAAmB,EAA0C,EAAE;YAC5E,MAAM,OAAO,GACX,EAAE,CAAC,SAAS,KAAK,SAAS;gBACxB,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,QAAQ,0BAA0B,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE;gBACtF,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,QAAQ,4BAA4B,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC,EAAE,CAAC;YACjF,IAAI,QAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YACpE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,0BAA0B,EAAE,CAAC,CAAC;YACpH,CAAC;YACD,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAC9D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;YAC/C,CAAC;YACD,MAAM,KAAK,GAAG,CAAC,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACzG,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC,CAAC;QAC9I,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/adapters/fleet/logged-verified-facts.d.ts

@@ -0,0 +1,13 @@
+import type { ProxyShipDoor } from '../../core/parties/ports.js';
+/** The part of a logger this needs: a warning with its fields. */
+interface WarningLog {
+    warn(fields: Record<string, unknown>, message: string): void;
+}
+/**
+ * The fleet's verified facts write, with a refusal logged as a warning: the
+ * approval goes on without it (decision 0059), so the log is where a refused
+ * write shows, as in a fleet whose own network rules give the gateway's ship
+ * no manage reach over its proxy ships.
+ */
+export declare function logRefusedFacts(door: Pick<ProxyShipDoor, 'setVerifiedFacts'>, log: WarningLog): Pick<ProxyShipDoor, 'setVerifiedFacts'>;
+export {};

package/dist/adapters/fleet/logged-verified-facts.js

@@ -0,0 +1,18 @@
+/**
+ * The fleet's verified facts write, with a refusal logged as a warning: the
+ * approval goes on without it (decision 0059), so the log is where a refused
+ * write shows, as in a fleet whose own network rules give the gateway's ship
+ * no manage reach over its proxy ships.
+ */
+export function logRefusedFacts(door, log) {
+    return {
+        setVerifiedFacts: async (crewToken, written) => {
+            const set = await door.setVerifiedFacts(crewToken, written);
+            if (!set.isOk) {
+                log.warn({ shipId: written.shipId, code: set.error.code, reason: set.error.message }, 'the fleet refused the verified facts about a proxy ship');
+            }
+            return set;
+        },
+    };
+}
+//# sourceMappingURL=logged-verified-facts.js.map

package/dist/adapters/fleet/logged-verified-facts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logged-verified-facts.js","sourceRoot":"","sources":["../../../src/adapters/fleet/logged-verified-facts.ts"],"names":[],"mappings":"AAOA;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAA6C,EAAE,GAAe;IAC5F,OAAO;QACL,gBAAgB,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE;YAC7C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC5D,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACd,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,yDAAyD,CAAC,CAAC;YACnJ,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/adapters/fleet/proxy-ship-reads.d.ts

@@ -0,0 +1,7 @@
+import type { ProxyShipReads } from '../../core/parties/ports.js';
+/**
+ * A party's proxy ship as the actor reads it (fleet.ship, decision 0057): its
+ * owner and scopes within the actor's read reach, and neither outside it,
+ * where the fleet answers only the ship's name, type and status.
+ */
+export declare function createProxyShipReads(fleetUrl: string): ProxyShipReads;

package/dist/adapters/fleet/proxy-ship-reads.js

@@ -0,0 +1,24 @@
+import { shipOutputSchema } from '@aeolus-fleet/common';
+import { err, ok } from '../../core/shared/result.js';
+import { readAs } from './actor-door.js';
+/**
+ * A party's proxy ship as the actor reads it (fleet.ship, decision 0057): its
+ * owner and scopes within the actor's read reach, and neither outside it,
+ * where the fleet answers only the ship's name, type and status.
+ */
+export function createProxyShipReads(fleetUrl) {
+    return {
+        read: async (as, { shipId }) => {
+            const read = await readAs(fleetUrl, { as, procedure: 'ship', input: { shipId } });
+            if (!read.isOk) {
+                return read;
+            }
+            const ship = shipOutputSchema.safeParse(read.value);
+            if (!ship.success) {
+                return err({ code: 'UNAVAILABLE', message: 'The fleet answered no ship' });
+            }
+            return 'isInReadReach' in ship.data ? ok({ ownerShipId: null, scopes: null }) : ok({ ownerShipId: ship.data.owner?.id ?? null, scopes: [...ship.data.scopes] });
+        },
+    };
+}
+//# sourceMappingURL=proxy-ship-reads.js.map

package/dist/adapters/fleet/proxy-ship-reads.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-ship-reads.js","sourceRoot":"","sources":["../../../src/adapters/fleet/proxy-ship-reads.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGxD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,6BAA6B,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEzC;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,OAAO;QACL,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;YAC7B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAClF,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClB,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO,eAAe,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClK,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/adapters/fleet/proxy-ships-as-actor.d.ts

@@ -0,0 +1,3 @@
+import type { ProxyShipsAsActor } from '../../core/parties/ports.js';
+/** A party's proxy ship, as the actor calls the fleet on it (decision 0057). */
+export declare function createProxyShipsAsActor(fleetUrl: string): ProxyShipsAsActor;