@aeolus-fleet/gateway 0.28.1 → 0.29.0

package/dist/core/account-sign-in/account-of-sign-in.d.ts

@@ -0,0 +1,23 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import type { Clock } from '../shared/clock.js';
+import { type Result } from '../shared/result.js';
+import type { SharedAccountToken, SharedSignIn, SharedSignInRefusal } from './ports.js';
+export type AccountOfSignIn = ((asked: {
+    signIn: string;
+    fleetId: FleetId;
+}) => Promise<Result<SharedAccountToken, SharedSignInRefusal>>) & {
+    /** Drops every token kept for the sign-in, as when it is signed out here. */
+    forget(signIn: string): void;
+};
+/**
+ * Use case: the account token a shared sign-in has in a fleet (header design
+ * H5, accounts design A3). pagasae answers a fresh one at every exchange; the
+ * gateway keeps it per sign-in and fleet until a minute before it ends, so a
+ * page's many calls make one exchange, and a sign-out anywhere or a change of
+ * rights lands at the next. A refusal is never kept, and a sign-out here
+ * drops what was kept at once.
+ */
+export declare function createAccountOfSignIn(deps: {
+    signIns: Pick<SharedSignIn, 'accountToken'>;
+    clock: Clock;
+}): AccountOfSignIn;

package/dist/core/account-sign-in/account-of-sign-in.js

@@ -0,0 +1,41 @@
+import { ok } from '../shared/result.js';
+import { ACCOUNT_TOKEN_MARGIN_MS } from '../sign-in/account-token.js';
+/**
+ * Use case: the account token a shared sign-in has in a fleet (header design
+ * H5, accounts design A3). pagasae answers a fresh one at every exchange; the
+ * gateway keeps it per sign-in and fleet until a minute before it ends, so a
+ * page's many calls make one exchange, and a sign-out anywhere or a change of
+ * rights lands at the next. A refusal is never kept, and a sign-out here
+ * drops what was kept at once.
+ */
+export function createAccountOfSignIn(deps) {
+    const kept = new Map();
+    const isFresh = (token) => token.endsAt.getTime() - ACCOUNT_TOKEN_MARGIN_MS > deps.clock.now().getTime();
+    const accountOf = async ({ signIn, fleetId }) => {
+        const key = `${fleetId} ${signIn}`;
+        const held = kept.get(key);
+        if (held !== undefined && isFresh(held)) {
+            return ok(held);
+        }
+        kept.delete(key);
+        const exchanged = await deps.signIns.accountToken({ signIn, fleetId });
+        if (exchanged.isOk) {
+            for (const [other, token] of kept) {
+                if (!isFresh(token)) {
+                    kept.delete(other);
+                }
+            }
+            kept.set(key, exchanged.value);
+        }
+        return exchanged;
+    };
+    const forget = (signIn) => {
+        for (const key of kept.keys()) {
+            if (key.endsWith(` ${signIn}`)) {
+                kept.delete(key);
+            }
+        }
+    };
+    return Object.assign(accountOf, { forget });
+}
+//# sourceMappingURL=account-of-sign-in.js.map

package/dist/core/account-sign-in/account-of-sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account-of-sign-in.js","sourceRoot":"","sources":["../../../src/core/account-sign-in/account-of-sign-in.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AAQtE;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAmE;IACvG,MAAM,IAAI,GAAG,IAAI,GAAG,EAA8B,CAAC;IACnD,MAAM,OAAO,GAAG,CAAC,KAAyB,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,uBAAuB,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAE7H,MAAM,SAAS,GAAG,KAAK,EAAE,EAAE,MAAM,EAAE,OAAO,EAAwC,EAAE,EAAE;QACpF,MAAM,GAAG,GAAG,GAAG,OAAO,IAAI,MAAM,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QACvE,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;gBAClC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBACpB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE;QAChC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YAC9B,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM,EAAE,CAAC,EAAE,CAAC;gBAC/B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;AAC9C,CAAC"}

package/dist/core/account-sign-in/complete-account-sign-in.d.ts

@@ -0,0 +1,37 @@
+import type { Clock } from '../shared/clock.js';
+import { type Result } from '../shared/result.js';
+import type { AccountSignInSeals, SharedSignIn } from './ports.js';
+/**
+ * Why a sign-in sent the person nowhere:
+ * - unknownSignIn: the gateway sealed no sign-in into this state, or its 10 minutes passed;
+ * - otherBrowser: the browser that came back does not hold the sign-in's secret, as when another site makes it finish its own;
+ * - pagasaeRefused: pagasae sent no code, or did not redeem it, for the reason given.
+ */
+export type AccountSignInRefusal = {
+    readonly kind: 'unknownSignIn';
+} | {
+    readonly kind: 'otherBrowser';
+} | {
+    readonly kind: 'pagasaeRefused';
+    readonly message: string;
+};
+export type CompleteAccountSignIn = (back: {
+    state?: string | undefined;
+    code?: string | undefined;
+    error?: string | undefined;
+    browserSecret?: string | undefined;
+}) => Promise<Result<{
+    redirectTo: string;
+}, AccountSignInRefusal>>;
+/**
+ * Use case: pagasae sends the person back. Their sign-in is opened from its
+ * state, and pagasae's code redeemed with the gateway's verifier, which
+ * proves the round trip; the shared sign-in is then the browser's, in
+ * pagasae's cookie, and the gateway keeps nothing. The person goes back to
+ * the page they asked for.
+ */
+export declare function createCompleteAccountSignIn(deps: {
+    seals: AccountSignInSeals;
+    signIns: SharedSignIn;
+    clock: Clock;
+}): CompleteAccountSignIn;

package/dist/core/account-sign-in/complete-account-sign-in.js

@@ -0,0 +1,25 @@
+import { err, ok } from '../shared/result.js';
+/**
+ * Use case: pagasae sends the person back. Their sign-in is opened from its
+ * state, and pagasae's code redeemed with the gateway's verifier, which
+ * proves the round trip; the shared sign-in is then the browser's, in
+ * pagasae's cookie, and the gateway keeps nothing. The person goes back to
+ * the page they asked for.
+ */
+export function createCompleteAccountSignIn(deps) {
+    return async ({ state, code, error, browserSecret }) => {
+        const signIn = state === undefined ? undefined : deps.seals.open(state);
+        if (signIn === undefined || signIn.expiresAt.getTime() <= deps.clock.now().getTime()) {
+            return err({ kind: 'unknownSignIn' });
+        }
+        if (browserSecret !== signIn.browserSecret) {
+            return err({ kind: 'otherBrowser' });
+        }
+        if (error !== undefined || code === undefined) {
+            return err({ kind: 'pagasaeRefused', message: error ?? 'pagasae sent no code' });
+        }
+        const redeemed = await deps.signIns.redeemCode({ code, verifier: signIn.verifier });
+        return redeemed.isOk ? ok({ redirectTo: signIn.returnTo }) : err({ kind: 'pagasaeRefused', message: redeemed.error.reason });
+    };
+}
+//# sourceMappingURL=complete-account-sign-in.js.map

package/dist/core/account-sign-in/complete-account-sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"complete-account-sign-in.js","sourceRoot":"","sources":["../../../src/core/account-sign-in/complete-account-sign-in.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAkB3D;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAwE;IAClH,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE;QACrD,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACxE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YACrF,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,aAAa,KAAK,MAAM,CAAC,aAAa,EAAE,CAAC;YAC3C,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9C,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,IAAI,sBAAsB,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QACpF,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/H,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/account-sign-in/ports.d.ts

@@ -0,0 +1,92 @@
+/**
+ * The account sign-in every Aeolus app shares (aeolus-fleet's header design,
+ * H5): pagasae keeps one sign-in per browser in its own cookie on the domain
+ * the apps share, and the gateway's pages, an app in pagasae's APP_CLIENTS,
+ * exchange it server to server for the account token of the fleet in view.
+ * The gateway keeps no grant for it: every token is that one exchange.
+ */
+import type { FleetId, ShipId } from '@aeolus-fleet/common';
+import type { Result } from '../shared/result.js';
+/** The cookie pagasae keeps the shared sign-in in, on the domain every Aeolus app shares. */
+export declare const SHARED_SIGN_IN_COOKIE = "aeolus_account_session";
+/** A sign-in to the gateway's pages under way at pagasae: its PKCE verifier, the browser's secret and the page to go back to. */
+export interface AccountSignInUnderWay {
+    readonly verifier: string;
+    /** The secret the browser that started the sign-in holds, so no other browser finishes it (login CSRF). */
+    readonly browserSecret: string;
+    /** The gateway's own path the browser goes back to once signed in. */
+    readonly returnTo: string;
+    readonly expiresAt: Date;
+}
+/** Outbound port: seals a sign-in under way into the state pagasae carries back, so the gateway stores nothing for it. */
+export interface AccountSignInSeals {
+    seal(signIn: AccountSignInUnderWay): string;
+    /** The sign-in a state seals; none for a state the gateway did not seal. */
+    open(state: string): AccountSignInUnderWay | undefined;
+}
+/** The account token pagasae exchanged the shared sign-in for, and what it names. */
+export interface SharedAccountToken {
+    readonly accountToken: string;
+    readonly endsAt: Date;
+    readonly accountId: string;
+    /** The account's person ship in the fleet, if it has one (decision 0052). */
+    readonly personShipId: ShipId | null;
+    readonly scopes: readonly string[];
+}
+/** An Aeolus app an account may open, and its address (header design H1). */
+export interface OpenableApp {
+    readonly app: string;
+    readonly url: string;
+}
+/** What the account may open (header design H1): the account, its apps beside the fleets, and per fleet its name and the apps it may open there. */
+export interface OpenableApps {
+    readonly account: {
+        readonly id: string;
+        readonly email: string;
+    };
+    readonly apps: readonly OpenableApp[];
+    readonly fleets: readonly {
+        readonly fleetId: FleetId;
+        readonly name: string;
+        readonly apps: readonly OpenableApp[];
+    }[];
+}
+/**
+ * Why there is no account token: the shared sign-in ended or never was
+ * (signedOut), the account holds no right in that fleet (noRights), or
+ * pagasae did not answer (unavailable).
+ */
+export type SharedSignInRefusal = {
+    readonly kind: 'signedOut';
+} | {
+    readonly kind: 'noRights';
+} | {
+    readonly kind: 'unavailable';
+};
+/** Outbound port: pagasae, for the gateway's pages as one of its apps. */
+export interface SharedSignIn {
+    /** pagasae's authorize address for the gateway's pages, with the state and the PKCE challenge, naming no fleet. */
+    authorizeUrl(signIn: {
+        state: string;
+        codeChallenge: string;
+    }): string;
+    /** Redeems the code pagasae sent the browser back with; its answer names the account, and the shared sign-in is then the browser's. */
+    redeemCode(code: {
+        code: string;
+        verifier: string;
+    }): Promise<Result<void, {
+        reason: string;
+    }>>;
+    /** The account token of the fleet for the shared sign-in, fresh at every call. */
+    accountToken(asked: {
+        signIn: string;
+        fleetId: FleetId;
+    }): Promise<Result<SharedAccountToken, SharedSignInRefusal>>;
+    apps(signIn: string): Promise<Result<OpenableApps, {
+        kind: 'signedOut' | 'unavailable';
+    }>>;
+    /** Ends the shared sign-in, in every app at once. */
+    revoke(signIn: string): Promise<Result<void, {
+        kind: 'unavailable';
+    }>>;
+}

package/dist/core/account-sign-in/ports.js

@@ -0,0 +1,3 @@
+/** The cookie pagasae keeps the shared sign-in in, on the domain every Aeolus app shares. */
+export const SHARED_SIGN_IN_COOKIE = 'aeolus_account_session';
+//# sourceMappingURL=ports.js.map

package/dist/core/account-sign-in/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../src/core/account-sign-in/ports.ts"],"names":[],"mappings":"AAWA,6FAA6F;AAC7F,MAAM,CAAC,MAAM,qBAAqB,GAAG,wBAAwB,CAAC"}

package/dist/core/account-sign-in/sign-out-account.d.ts

@@ -0,0 +1,15 @@
+import type { Result } from '../shared/result.js';
+import type { AccountOfSignIn } from './account-of-sign-in.js';
+import type { SharedSignIn } from './ports.js';
+export type SignOutAccount = (signIn: string) => Promise<Result<void, {
+    kind: 'unavailable';
+}>>;
+/**
+ * Use case: a person signs out of the gateway's pages, which ends the shared
+ * sign-in at pagasae, so every Aeolus app is signed out (header design H5).
+ * The tokens the gateway kept for it go at once.
+ */
+export declare function createSignOutAccount(deps: {
+    signIns: Pick<SharedSignIn, 'revoke'>;
+    accountOf: Pick<AccountOfSignIn, 'forget'>;
+}): SignOutAccount;

package/dist/core/account-sign-in/sign-out-account.js

@@ -0,0 +1,12 @@
+/**
+ * Use case: a person signs out of the gateway's pages, which ends the shared
+ * sign-in at pagasae, so every Aeolus app is signed out (header design H5).
+ * The tokens the gateway kept for it go at once.
+ */
+export function createSignOutAccount(deps) {
+    return (signIn) => {
+        deps.accountOf.forget(signIn);
+        return deps.signIns.revoke(signIn);
+    };
+}
+//# sourceMappingURL=sign-out-account.js.map

package/dist/core/account-sign-in/sign-out-account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-out-account.js","sourceRoot":"","sources":["../../../src/core/account-sign-in/sign-out-account.ts"],"names":[],"mappings":"AAMA;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAA2F;IAC9H,OAAO,CAAC,MAAM,EAAE,EAAE;QAChB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/account-sign-in/start-account-sign-in.d.ts

@@ -0,0 +1,25 @@
+import type { OAuthSecrets } from '../oauth/ports.js';
+import type { Clock } from '../shared/clock.js';
+import type { AccountSignInSeals, SharedSignIn } from './ports.js';
+/** Where a person lands once signed in, when they asked for no page of the gateway's own. */
+export declare const FIRST_PAGE = "/overview";
+export type StartAccountSignIn = (asked: {
+    returnTo?: string | undefined;
+}) => {
+    redirectTo: string;
+    browserSecret: string;
+};
+/**
+ * Use case: a person signs in to the gateway's pages with the shared account
+ * sign-in (header design H5). The page to go back to is sealed with the
+ * gateway's PKCE verifier into the state, and the person is sent to pagasae
+ * naming no fleet. Only a path of the gateway's own is kept, so a sign-in
+ * never sends the browser to another site. The browser is given a secret of
+ * its own, sealed too, so only it finishes the sign-in.
+ */
+export declare function createStartAccountSignIn(deps: {
+    seals: AccountSignInSeals;
+    signIns: SharedSignIn;
+    secrets: OAuthSecrets;
+    clock: Clock;
+}): StartAccountSignIn;

package/dist/core/account-sign-in/start-account-sign-in.js

@@ -0,0 +1,26 @@
+import { ownPageOf } from '../sign-in/own-page.js';
+import { SIGN_IN_LIFETIME_MS } from '../sign-in/start-sign-in.js';
+/** Where a person lands once signed in, when they asked for no page of the gateway's own. */
+export const FIRST_PAGE = '/overview';
+/**
+ * Use case: a person signs in to the gateway's pages with the shared account
+ * sign-in (header design H5). The page to go back to is sealed with the
+ * gateway's PKCE verifier into the state, and the person is sent to pagasae
+ * naming no fleet. Only a path of the gateway's own is kept, so a sign-in
+ * never sends the browser to another site. The browser is given a secret of
+ * its own, sealed too, so only it finishes the sign-in.
+ */
+export function createStartAccountSignIn(deps) {
+    return ({ returnTo }) => {
+        const verifier = deps.secrets.newSecret();
+        const browserSecret = deps.secrets.newSecret();
+        const state = deps.seals.seal({
+            returnTo: (returnTo === undefined ? undefined : ownPageOf(returnTo)) ?? FIRST_PAGE,
+            verifier,
+            browserSecret,
+            expiresAt: new Date(deps.clock.now().getTime() + SIGN_IN_LIFETIME_MS),
+        });
+        return { redirectTo: deps.signIns.authorizeUrl({ state, codeChallenge: deps.secrets.challengeOf(verifier) }), browserSecret };
+    };
+}
+//# sourceMappingURL=start-account-sign-in.js.map

package/dist/core/account-sign-in/start-account-sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"start-account-sign-in.js","sourceRoot":"","sources":["../../../src/core/account-sign-in/start-account-sign-in.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAGlE,6FAA6F;AAC7F,MAAM,CAAC,MAAM,UAAU,GAAG,WAAW,CAAC;AAItC;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAA+F;IACtI,OAAO,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAC5B,QAAQ,EAAE,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,IAAI,UAAU;YAClF,QAAQ;YACR,aAAa;YACb,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,mBAAmB,CAAC;SACtE,CAAC,CAAC;QACH,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC;IAChI,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/actors/authenticate-actor.d.ts

@@ -1,14 +1,13 @@
 import type { FleetId, ShipId } from '@aeolus-fleet/common';
+import type { AccountOfSignIn } from '../account-sign-in/account-of-sign-in.js';
 import type { ConnectionStore, FleetDoor } from '../connection/ports.js';
 import type { AuthenticateOperator } from '../operator/authenticate-operator.js';
-import type { AccountTokenOf } from '../sign-in/account-token.js';
-import type { PageSessions } from '../sign-in/ports.js';
 import { type DomainError } from '../shared/errors.js';
 import { type Result } from '../shared/result.js';
 /**
- * Who calls the gateway's API (decision 0057): an account by the page
- * session it signed in to the gateway's pages with, argo or a viewer by the
- * console session, or a ship by its own crew token. Its scopes are the
+ * Who calls the gateway's API (decision 0057): an account by the shared
+ * sign-in the web app's page forwarded (header design H5), argo or a viewer
+ * by the console session, or a ship by its own crew token. Its scopes are the
  * fleet's or its account token's, never the request's, plugin scopes such
  * as gateway:approve among them.
  */
@@ -22,33 +21,33 @@ export type Actor = {
     readonly shipId: ShipId;
     readonly scopes: readonly string[];
 } | AccountActor;
-/** An account on the gateway's pages, with the grant whose account token it acts by in the fleet. */
+/** An account on the gateway's pages, by the account token pagasae exchanged its shared sign-in for. */
 export interface AccountActor {
     readonly fleetId: FleetId;
     readonly kind: 'account';
     readonly accountId: string;
     readonly personShipId: ShipId | null;
-    readonly grantId: string;
+    readonly accountToken: string;
     readonly scopes: readonly string[];
 }
 export type AuthenticateActor = (sent: {
     cookie?: string | undefined;
     crewToken?: string | undefined;
+    signIn?: string | undefined;
+    fleetId?: FleetId | undefined;
 }) => Promise<Result<Actor, DomainError<'NOT_AN_ACTOR'>>>;
 /**
  * Use case: whom a call of the gateway's API is for. A crew token, sent
  * deliberately, names its ship: the fleet says which ship it crews, and the
- * gateway, as its own ship in that fleet, reads the ship's scopes. Else the
- * console session cookie names argo or a viewer, as before. A ship of a
- * fleet the gateway is not connected to is no actor here. The crew token is
- * never kept. Else the gateway's own page session cookie names an account,
- * with the scopes its account token carries, refreshed through pagasae when
- * it is about to end; a session whose sign-in ended is no actor.
+ * gateway, as its own ship in that fleet, reads the ship's scopes. A ship of
+ * a fleet the gateway is not connected to is no actor here. The crew token
+ * is never kept. Else the shared sign-in the page forwarded names an account
+ * in the fleet the page names, by the account token pagasae exchanges it
+ * for. Else the console session cookie names argo or a viewer.
  */
 export declare function createAuthenticateActor(deps: {
     authenticateOperator: AuthenticateOperator;
     door: Pick<FleetDoor, 'whoami' | 'getShip'>;
     connections: Pick<ConnectionStore, 'find'>;
-    sessions: PageSessions;
-    accountTokenOf: AccountTokenOf;
+    accountOf: AccountOfSignIn;
 }): AuthenticateActor;

package/dist/core/actors/authenticate-actor.js

@@ -3,16 +3,15 @@ import { ok } from '../shared/result.js';
 /**
  * Use case: whom a call of the gateway's API is for. A crew token, sent
  * deliberately, names its ship: the fleet says which ship it crews, and the
- * gateway, as its own ship in that fleet, reads the ship's scopes. Else the
- * console session cookie names argo or a viewer, as before. A ship of a
- * fleet the gateway is not connected to is no actor here. The crew token is
- * never kept. Else the gateway's own page session cookie names an account,
- * with the scopes its account token carries, refreshed through pagasae when
- * it is about to end; a session whose sign-in ended is no actor.
+ * gateway, as its own ship in that fleet, reads the ship's scopes. A ship of
+ * a fleet the gateway is not connected to is no actor here. The crew token
+ * is never kept. Else the shared sign-in the page forwarded names an account
+ * in the fleet the page names, by the account token pagasae exchanges it
+ * for. Else the console session cookie names argo or a viewer.
  */
 export function createAuthenticateActor(deps) {
     const refusal = refuse('NOT_AN_ACTOR', 'Sign in to the console of your fleet, or call with your ship\'s crew token');
-    return async ({ cookie, crewToken }) => {
+    return async ({ cookie, crewToken, signIn, fleetId }) => {
         if (crewToken !== undefined) {
             const who = await deps.door.whoami(crewToken);
             if (!who.isOk) {
@@ -26,14 +25,13 @@ export function createAuthenticateActor(deps) {
             const ship = await deps.door.getShip(gateway.crewToken, { shipId: who.value.shipId, onBehalfOf: who.value.shipId });
             return ship.isOk ? ok({ fleetId: who.value.fleetId, kind: 'ship', shipId: who.value.shipId, scopes: ship.value.scopes }) : refusal;
         }
-        const session = cookie === undefined ? undefined : deps.sessions.inCookie(cookie);
-        if (session !== undefined) {
-            const token = await deps.accountTokenOf(session);
+        if (signIn !== undefined && fleetId !== undefined) {
+            const token = await deps.accountOf({ signIn, fleetId });
             if (!token.isOk) {
                 return refusal;
             }
-            const { accountId, personShipId, scopes } = token.value;
-            return ok({ fleetId: session.fleetId, kind: 'account', accountId, personShipId, grantId: session.grantId, scopes });
+            const { accountId, personShipId, scopes, accountToken } = token.value;
+            return ok({ fleetId, kind: 'account', accountId, personShipId, accountToken, scopes });
         }
         const operator = await deps.authenticateOperator(cookie);
         return operator.isOk ? ok(operator.value) : refusal;

package/dist/core/actors/authenticate-actor.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticate-actor.js","sourceRoot":"","sources":["../../../src/core/actors/authenticate-actor.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AA0BtD;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAMvC;IACC,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,EAAE,4EAA4E,CAAC,CAAC;IACrH,OAAO,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE;QACrC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9C,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC/D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,8GAA8G;YAC9G,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACpH,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACrI,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAClF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAChB,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC;YACxD,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACtH,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACzD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACtD,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"authenticate-actor.js","sourceRoot":"","sources":["../../../src/core/actors/authenticate-actor.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AA0BtD;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAKvC;IACC,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,EAAE,4EAA4E,CAAC,CAAC;IACrH,OAAO,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE;QACtD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC9C,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC/D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,8GAA8G;YAC9G,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACpH,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QACrI,CAAC;QACD,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YACxD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAChB,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,MAAM,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC;YACtE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;QACzD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACtD,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/actors/credential-of.d.ts

@@ -1,7 +1,6 @@
 import type { ConnectionStore } from '../connection/ports.js';
 import { type DomainError } from '../shared/errors.js';
 import { type Result } from '../shared/result.js';
-import type { AccountTokenOf } from '../sign-in/account-token.js';
 import type { Actor } from './authenticate-actor.js';
 /**
  * What the gateway calls the fleet with, so the fleet answers as the actor
@@ -14,14 +13,13 @@ export interface ActorCredential {
     crewToken?: string;
     accountToken?: string;
 }
-export type CredentialOf = (actor: Actor, sent: ActorCredential) => Promise<Result<ActorCredential, DomainError<'NOT_AN_ACTOR' | 'FLEET_UNAVAILABLE'>>>;
+export type CredentialOf = (actor: Actor, sent: ActorCredential) => Promise<Result<ActorCredential, DomainError<'FLEET_UNAVAILABLE'>>>;
 /**
  * Use case: the credential to call the fleet with as the actor. A ship, argo
- * or a viewer sent its own, which goes on as it came. An account on the
- * gateway's pages sent only its page session: its grant's account token goes,
- * refreshed when about to end, presented by the gateway's ship of its fleet.
+ * or a viewer sent its own, which goes on as it came. An account signed in
+ * with the shared sign-in sent only that: the token pagasae exchanged it for
+ * goes, presented by the gateway's ship of its fleet.
  */
 export declare function createCredentialOf(deps: {
     connections: Pick<ConnectionStore, 'find'>;
-    accountTokenOf: AccountTokenOf;
 }): CredentialOf;

package/dist/core/actors/credential-of.js

@@ -2,9 +2,9 @@ import { refuse } from '../shared/errors.js';
 import { ok } from '../shared/result.js';
 /**
  * Use case: the credential to call the fleet with as the actor. A ship, argo
- * or a viewer sent its own, which goes on as it came. An account on the
- * gateway's pages sent only its page session: its grant's account token goes,
- * refreshed when about to end, presented by the gateway's ship of its fleet.
+ * or a viewer sent its own, which goes on as it came. An account signed in
+ * with the shared sign-in sent only that: the token pagasae exchanged it for
+ * goes, presented by the gateway's ship of its fleet.
  */
 export function createCredentialOf(deps) {
     return async (actor, sent) => {
@@ -15,11 +15,7 @@ export function createCredentialOf(deps) {
         if (gateway === undefined) {
             return refuse('FLEET_UNAVAILABLE', 'The gateway is not connected to your fleet');
         }
-        const token = await deps.accountTokenOf({ fleetId: actor.fleetId, grantId: actor.grantId });
-        if (!token.isOk) {
-            return token.error.kind === 'signedOut' ? refuse('NOT_AN_ACTOR', 'Your sign-in ended: sign in again') : refuse('FLEET_UNAVAILABLE', 'pagasae did not answer, so your account token could not be renewed');
-        }
-        return ok({ crewToken: gateway.crewToken, accountToken: token.value.accountToken });
+        return ok({ crewToken: gateway.crewToken, accountToken: actor.accountToken });
     };
 }
 //# sourceMappingURL=credential-of.js.map

package/dist/core/actors/credential-of.js.map

@@ -1 +1 @@
-{"version":3,"file":"credential-of.js","sourceRoot":"","sources":["../../../src/core/actors/credential-of.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAkBtD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAoF;IACrH,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,mBAAmB,EAAE,4CAA4C,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,mCAAmC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,oEAAoE,CAAC,CAAC;QAC5M,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;IACtF,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"credential-of.js","sourceRoot":"","sources":["../../../src/core/actors/credential-of.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAiBtD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAoD;IACrF,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,mBAAmB,EAAE,4CAA4C,CAAC,CAAC;QACnF,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;IAChF,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/connection/answer-pings.d.ts

@@ -0,0 +1,19 @@
+import type { ConnectionStore, GatewayDelivery, GatewayInbox } from './ports.js';
+/** What a round did: pings answered, other deliveries acked as kept by the fleet, and calls the fleet refused. */
+export interface PingRound {
+    ponged: number;
+    acked: GatewayDelivery[];
+    refused: number;
+}
+/** A round, ended early once the signal aborts. */
+export type AnswerPings = (signal: AbortSignal) => Promise<PingRound>;
+/**
+ * Use case: the gateway's own ship takes what waits for it in each fleet it
+ * is connected to, as any crewed ship does (blueprint, "Ping"): argo's ping
+ * is answered with pong; anything else is acked, as the gateway's ship
+ * handles no messages of its own, and the fleet keeps it in its history.
+ */
+export declare function createAnswerPings(deps: {
+    connections: ConnectionStore;
+    inbox: GatewayInbox;
+}): AnswerPings;

package/dist/core/connection/answer-pings.js

@@ -0,0 +1,34 @@
+import { isPingContentType, RECEIVE_MAX_UPPER_BOUND } from '@aeolus-fleet/common';
+/**
+ * Use case: the gateway's own ship takes what waits for it in each fleet it
+ * is connected to, as any crewed ship does (blueprint, "Ping"): argo's ping
+ * is answered with pong; anything else is acked, as the gateway's ship
+ * handles no messages of its own, and the fleet keeps it in its history.
+ */
+export function createAnswerPings(deps) {
+    return async (signal) => {
+        const round = { ponged: 0, acked: [], refused: 0 };
+        for (const crew of await deps.connections.connected()) {
+            const taken = await deps.inbox.receive(crew.crewToken, { max: RECEIVE_MAX_UPPER_BOUND, signal });
+            if (!taken.isOk) {
+                round.refused += 1;
+                continue;
+            }
+            for (const delivery of taken.value) {
+                const isPing = isPingContentType(delivery.contentType);
+                const answered = isPing ? await deps.inbox.pong(crew.crewToken, delivery.deliveryId) : await deps.inbox.ack(crew.crewToken, delivery.deliveryId);
+                if (!answered.isOk) {
+                    round.refused += 1;
+                }
+                else if (isPing) {
+                    round.ponged += 1;
+                }
+                else {
+                    round.acked.push(delivery);
+                }
+            }
+        }
+        return round;
+    };
+}
+//# sourceMappingURL=answer-pings.js.map

package/dist/core/connection/answer-pings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"answer-pings.js","sourceRoot":"","sources":["../../../src/core/connection/answer-pings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAclF;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA2D;IAC3F,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE;QACtB,MAAM,KAAK,GAAc,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;QAC9D,KAAK,MAAM,IAAI,IAAI,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,EAAE,CAAC;YACtD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAAC,CAAC;YACjG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAChB,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;YACD,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBACnC,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;gBACjJ,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;oBACnB,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;gBACrB,CAAC;qBAAM,IAAI,MAAM,EAAE,CAAC;oBAClB,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC;gBACpB,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/connection/ports.d.ts

@@ -1,4 +1,4 @@
-import type { FleetId, ShipId } from '@aeolus-fleet/common';
+import type { DeliveryId, FleetId, ShipId } from '@aeolus-fleet/common';
 import type { Result } from '../shared/result.js';
 /**
  * Why the fleet refused a ship call: its code (CONFLICT, UNAUTHORIZED,
@@ -51,6 +51,23 @@ export interface FleetDoor {
         }[];
     }): Promise<Result<undefined, FleetRefusal>>;
 }
+/** A delivery to the gateway's own ship: what tells a ping apart, and who sent it. */
+export interface GatewayDelivery {
+    deliveryId: DeliveryId;
+    contentType: string;
+    senderShipId: ShipId;
+}
+/** Outbound port: the deliveries to the gateway's own ship, as its crew takes, acks and pongs them. */
+export interface GatewayInbox {
+    /** Takes up to max deliveries for the ship, waiting while the fleet waits for one, until the signal aborts; none when none came. */
+    receive(crewToken: string, take: {
+        max: number;
+        signal: AbortSignal;
+    }): Promise<Result<GatewayDelivery[], FleetRefusal>>;
+    ack(crewToken: string, deliveryId: DeliveryId): Promise<Result<undefined, FleetRefusal>>;
+    /** Answers argo's ping, in place of the ack. */
+    pong(crewToken: string, deliveryId: DeliveryId): Promise<Result<undefined, FleetRefusal>>;
+}
 /** The crew token the gateway holds for its ship in a fleet, and when it got it. */
 export interface GatewayCrew {
     /** The fleet the ship belongs to: the fleet the gateway serves. */