@aeolus-fleet/gateway 0.30.0 → 0.32.0

package/dist/adapters/trpc/router.d.ts

@@ -26,7 +26,11 @@ import type { MarkTool } from '../../core/mcp-out/mark-tool.js';
 import type { StateParty } from '../../core/mcp-out/state-party.js';
 import type { CheckServer } from '../../core/parties/check-server.js';
 import type { ReadPartyTools } from '../../core/parties/read-party-tools.js';
-import type { SwitchTool } from '../../core/parties/switch-tool.js';
+import type { SwitchTools } from '../../core/parties/switch-tools.js';
+import type { CheckApproving } from '../../core/parties/check-approving.js';
+import type { ReadListedScopes } from '../../core/parties/read-listed-scopes.js';
+import type { ReadScopeRequirements } from '../../core/parties/read-scope-requirements.js';
+import type { SetScopeRequirements } from '../../core/parties/set-scope-requirements.js';
 import type { RegisterClient } from '../../core/oauth/register-client.js';
 import type { DecideRequest } from '../../core/requests/decide-request.js';
 import type { ListMine } from '../../core/requests/list-mine.js';
@@ -35,6 +39,9 @@ import type { EndSignIns } from '../../core/sign-in/end-sign-ins.js';
 import type { AnswerDelivery } from '../../core/people/answer-delivery.js';
 import type { DoneDelivery } from '../../core/people/done-delivery.js';
 import type { OpenDelivery } from '../../core/people/open-delivery.js';
+import type { ChangeOwnMic } from '../../core/meetings/change-own-mic.js';
+import type { ReadMeeting } from '../../core/meetings/read-meeting.js';
+import type { SendMessage } from '../../core/people/send-message.js';
 import type { ReadInbox } from '../../core/people/read-inbox.js';
 import type { ReadWakeChannels } from '../../core/people/read-wake-channels.js';
 import type { FocusPage } from '../../core/people/focus-page.js';
@@ -96,7 +103,11 @@ export interface Context {
     cardAddressOf: (alias: string) => string;
     stateParty: StateParty;
     markTool: MarkTool;
-    switchTool: SwitchTool;
+    switchTools: SwitchTools;
+    readScopeRequirements: ReadScopeRequirements;
+    readListedScopes: ReadListedScopes;
+    checkApproving: CheckApproving;
+    setScopeRequirements: SetScopeRequirements;
     registerClient: RegisterClient;
     /** An MCP client's authorization request, as the gateway reads it before it signs the person in. */
     readAuthorization?: ReadAuthorization;
@@ -118,6 +129,9 @@ export interface Context {
         turnOnWebPush: TurnOnWebPush;
         turnOffWebPush: TurnOffWebPush;
         focusPage: FocusPage;
+        sendMessage: SendMessage;
+        readMeeting: ReadMeeting;
+        changeOwnMic: ChangeOwnMic;
     };
     readOutsideParties: ReadOutsideParties;
     setOutsideParties: SetOutsideParties;
@@ -140,7 +154,8 @@ export declare const gatewayRouter: import("@trpc/server").TRPCBuiltRouter<{
          * The account a page of the web app shows the fleet in its address as,
          * by the shared sign-in its server forwarded (header design H5): signed
          * in, with its scopes and never its token; the fleet to go to when the
-         * page names none; or the app to go to where the account may not open
+         * page names none; that the gateway is off for the account's fleet when
+         * it may open the gateway in none; or the app to go to where the account may not open
          * the gateway (H9). No shared sign-in, or one that ended, is UNAUTHORIZED.
          */
         inView: import("@trpc/server").TRPCQueryProcedure<{
@@ -153,6 +168,10 @@ export declare const gatewayRouter: import("@trpc/server").TRPCBuiltRouter<{
             } | {
                 kind: "goTo";
                 fleetId: string;
+            } | {
+                kind: "off";
+                fleetName: string;
+                accountUrl: string;
             } | {
                 kind: "elsewhere";
                 url: string;
@@ -355,10 +374,11 @@ export declare const gatewayRouter: import("@trpc/server").TRPCBuiltRouter<{
             output: {
                 tools: {
                     name: string;
-                    isReadOnly: boolean;
                     isOn: boolean;
                     isNew: boolean;
                     description?: string | undefined;
+                    isReadOnly?: boolean | undefined;
+                    isDestructive?: boolean | undefined;
                 }[];
             };
             meta: object;
@@ -721,20 +741,89 @@ export declare const gatewayRouter: import("@trpc/server").TRPCBuiltRouter<{
             };
             meta: object;
         }>;
-        /** An actor holding gateway:approve switches one tool of an outside MCP server on or off for the party (aeolus-fleet#1151): kept, then stated at once. */
-        switchTool: import("@trpc/server").TRPCMutationProcedure<{
+        /** An actor holding gateway:approve within manage reach of the proxy ship switches tools of an outside MCP server on or off for the party (aeolus-fleet#1151), one or a selection (gateway scopes 4.3): kept in one change, then stated at once. */
+        switchTools: import("@trpc/server").TRPCMutationProcedure<{
             input: {
                 name: string;
-                tool: string;
+                tools: string[];
                 isOn: boolean;
             };
             output: {
-                tool: string;
+                tools: string[];
                 isOn: boolean;
                 statementRefusal: string | null;
             };
             meta: object;
         }>;
+        /** Every scope the fleet lists now, with its description: the scopes an approver may require (gateway scopes 4.3). Only an approver reads them. */
+        listedScopes: import("@trpc/server").TRPCQueryProcedure<{
+            input: void;
+            output: {
+                scopes: {
+                    scope: string;
+                    description: string;
+                }[];
+            };
+            meta: object;
+        }>;
+        /**
+         * Whether the actor approves the party: gateway:approve within manage
+         * reach of its proxy ship (gateway scopes 4.3, A2). Its page shows the
+         * controls then, and otherwise the same table read-only, saying why.
+         */
+        approving: import("@trpc/server").TRPCQueryProcedure<{
+            input: {
+                name: string;
+            };
+            output: {
+                isApproving: boolean;
+                reason: string | null;
+            };
+            meta: object;
+        }>;
+        /** Which scopes a calling ship needs for an outside MCP server or A2A agent, and the version to change them on (gateway scopes 4.2). Any actor reads them. */
+        scopeRequirements: import("@trpc/server").TRPCQueryProcedure<{
+            input: {
+                name: string;
+            };
+            output: {
+                version: number;
+                party: string[];
+                tools: {
+                    tool: string;
+                    scopes: string[];
+                }[];
+            };
+            meta: object;
+        }>;
+        /**
+         * An actor holding gateway:approve sets the scopes a calling ship needs
+         * (gateway scopes 4.2, A2): the party's set when sent, and each tool's
+         * sent, an empty one dropping it, all at once on the version it read;
+         * then stated at once, as a tool switch is.
+         */
+        setScopeRequirements: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                name: string;
+                version: number;
+                tools: {
+                    tool: string;
+                    scopes: string[];
+                }[];
+                party?: string[] | undefined;
+            };
+            output: {
+                version: number;
+                party: string[];
+                tools: {
+                    tool: string;
+                    scopes: string[];
+                }[];
+            } & {
+                statementRefusal: string | null;
+            };
+            meta: object;
+        }>;
         /** argo marks a party's tool repeatable, or takes the mark off (interop 5.2): kept, then stated at once. */
         markTool: import("@trpc/server").TRPCMutationProcedure<{
             input: {
@@ -848,6 +937,63 @@ export declare const gatewayRouter: import("@trpc/server").TRPCBuiltRouter<{
             }, void, any>;
             meta: object;
         }>;
+        /** A meeting they take part in, with a page of its contributions, newest first, and where they stand on its mic (decision 0061). */
+        meeting: import("@trpc/server").TRPCQueryProcedure<{
+            input: {
+                meetingId: unknown;
+                cursor?: unknown;
+            };
+            output: {
+                openedAt: string;
+                endedAt: string | null;
+                mic: {
+                    requests: {
+                        ship: import("../../core/meetings/ports.js").MeetingShip;
+                        requestedAt: string;
+                    }[];
+                    holder: import("../../core/meetings/ports.js").MeetingShip | null;
+                    pattern: import("../../core/meetings/ports.js").MicPattern;
+                };
+                contributions: {
+                    items: {
+                        sentAt: string;
+                        messageId: import("@aeolus-fleet/common").MessageId;
+                        sender: import("../../core/meetings/ports.js").MeetingShip;
+                        contentType: string;
+                        payload: string;
+                    }[];
+                    nextCursor: `msg_${string}` | null;
+                };
+                yourMic: import("../../core/meetings/mic-standing.js").MicStanding;
+                meetingId: import("@aeolus-fleet/common").MeetingId;
+                title: string | null;
+                owner: import("../../core/meetings/ports.js").MeetingShip;
+                moderator: import("../../core/meetings/ports.js").MeetingShip;
+                participants: readonly import("../../core/meetings/ports.js").MeetingParticipant[];
+            };
+            meta: object;
+        }>;
+        /** Contributes to a meeting, once under the page's key; the fleet takes it while they hold the mic or moderate. */
+        contribute: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                meetingId: unknown;
+                payload: string;
+                idempotencyKey: string;
+            };
+            output: {
+                messageId: import("@aeolus-fleet/common").MessageId;
+            };
+            meta: object;
+        }>;
+        /** Their own mic call: request it, withdraw the request, or release the mic they hold. */
+        mic: import("@trpc/server").TRPCMutationProcedure<{
+            input: {
+                meetingId: unknown;
+                change: "request" | "withdraw" | "release";
+            };
+            output: {};
+            meta: object;
+        }>;
     }>>;
     requests: import("@trpc/server").TRPCBuiltRouter<{
         ctx: Context;

package/dist/adapters/trpc/router.js

@@ -10,7 +10,7 @@
  * installation procedures take the installation token instead (decision 0021).
  */
 import { randomUUID, timingSafeEqual } from 'node:crypto';
-import { idempotencyKeySchema, idSchema, shipHandleSchema } from '@aeolus-fleet/common';
+import { idempotencyKeySchema, idSchema, scopeNameSchema, shipHandleSchema } from '@aeolus-fleet/common';
 import { initTRPC, TRPCError } from '@trpc/server';
 import { z } from 'zod';
 import { APPROVING_SCOPE } from '../../core/parties/approver.js';
@@ -166,13 +166,40 @@ const TOOLS_CODES = {
     NO_SUCH_PARTY: 'NOT_FOUND',
     SERVER_UNREACHABLE: 'BAD_GATEWAY',
 };
-/** The refusals of switching an outside MCP server's tool, as the API states them. */
-const SWITCH_TOOL_CODES = {
+/** The refusals of reading the scopes the fleet lists, as the API states them. */
+const LISTED_SCOPES_CODES = {
+    NOT_AN_APPROVER: 'FORBIDDEN',
+    NOT_CONNECTED: 'PRECONDITION_FAILED',
+    FLEET_UNAVAILABLE: 'BAD_GATEWAY',
+};
+/** The refusals of switching an outside MCP server's tools, as the API states them. */
+const SWITCH_TOOLS_CODES = {
     NOT_AN_APPROVER: 'FORBIDDEN',
     NO_SUCH_PARTY: 'NOT_FOUND',
+    PARTY_NOT_COMMISSIONED: 'PRECONDITION_FAILED',
+    NOT_REACHABLE: 'FORBIDDEN',
+    NOT_CONNECTED: 'PRECONDITION_FAILED',
+    FLEET_UNAVAILABLE: 'BAD_GATEWAY',
     SERVER_UNREACHABLE: 'BAD_GATEWAY',
     NO_SUCH_TOOL: 'NOT_FOUND',
 };
+/** The refusals of setting the scopes an outside party needs, as the API states them. */
+const SET_SCOPE_REQUIREMENTS_CODES = {
+    NOT_AN_APPROVER: 'FORBIDDEN',
+    NO_SUCH_PARTY: 'NOT_FOUND',
+    PARTY_NOT_COMMISSIONED: 'PRECONDITION_FAILED',
+    NOT_REACHABLE: 'FORBIDDEN',
+    NO_SUCH_TOOL: 'BAD_REQUEST',
+    NOT_CONNECTED: 'PRECONDITION_FAILED',
+    FLEET_UNAVAILABLE: 'BAD_GATEWAY',
+    SCOPE_NOT_LISTED: 'BAD_REQUEST',
+    CONFLICT: 'CONFLICT',
+};
+/** A party's required scopes as the API states them: its own set, and each tool's set by name. */
+const scopeRequirementsSchema = z.object({ version: z.int().min(0), party: z.array(z.string()), tools: z.array(z.object({ tool: z.string(), scopes: z.array(z.string()) })) });
+function scopeRequirementsOutputOf(requirements) {
+    return { version: requirements.version, party: [...requirements.party], tools: [...requirements.tools].map(([tool, scopes]) => ({ tool, scopes: [...scopes] })) };
+}
 /** The refusals of checking an outside MCP server, as the API states them. */
 const CHECK_CODES = {
     OUTSIDE_PARTIES_OFF: 'PRECONDITION_FAILED',
@@ -290,7 +317,24 @@ const PERSON_CODES = {
     SEND_REFUSED: 'BAD_REQUEST',
     CHANNEL_NOT_OFFERED: 'PRECONDITION_FAILED',
     INVALID_SUBSCRIPTION: 'BAD_REQUEST',
+    NO_SUCH_MEETING: 'NOT_FOUND',
+    MIC_REFUSED: 'CONFLICT',
 };
+/** A contribution a person writes on the pages: plain text. */
+const CONTRIBUTION_CONTENT_TYPE = 'text/plain';
+/** A meeting as the pages read it, its times in ISO 8601 as every answer of the API states them. */
+function meetingViewOf({ meeting, mic }) {
+    const at = (time) => time.toISOString();
+    const { openedAt, endedAt, contributions, ...rest } = meeting;
+    return {
+        ...rest,
+        openedAt: at(openedAt),
+        endedAt: endedAt === null ? null : at(endedAt),
+        mic: { ...meeting.mic, requests: meeting.mic.requests.map(({ ship, requestedAt }) => ({ ship, requestedAt: at(requestedAt) })) },
+        contributions: { items: contributions.items.map(({ sentAt, ...contribution }) => ({ ...contribution, sentAt: at(sentAt) })), nextCursor: contributions.nextCursor },
+        yourMic: mic,
+    };
+}
 function personAnswerOf(answered) {
     if (!answered.isOk) {
         throw new TRPCError({ code: PERSON_CODES[answered.error.kind], message: answered.error.message });
@@ -347,6 +391,7 @@ async function fleetNameOf(ctx) {
 const accountInViewOutputSchema = z.discriminatedUnion('kind', [
     z.object({ kind: z.literal('signedIn'), fleetId: z.string(), accountId: z.string(), scopes: z.array(z.string()) }),
     z.object({ kind: z.literal('goTo'), fleetId: z.string() }),
+    z.object({ kind: z.literal('off'), fleetName: z.string(), accountUrl: z.string() }),
     z.object({ kind: z.literal('elsewhere'), url: z.string() }),
 ]);
 const appLinkOutputSchema = z.object({ app: z.string(), url: z.string() });
@@ -361,7 +406,8 @@ export const gatewayRouter = t.router({
          * The account a page of the web app shows the fleet in its address as,
          * by the shared sign-in its server forwarded (header design H5): signed
          * in, with its scopes and never its token; the fleet to go to when the
-         * page names none; or the app to go to where the account may not open
+         * page names none; that the gateway is off for the account's fleet when
+         * it may open the gateway in none; or the app to go to where the account may not open
          * the gateway (H9). No shared sign-in, or one that ended, is UNAUTHORIZED.
          */
         inView: t.procedure.output(accountInViewOutputSchema).query(async ({ ctx }) => {
@@ -450,7 +496,7 @@ export const gatewayRouter = t.router({
         /** An outside MCP server's tools, as the server lists them now, asked with the credential the gateway keeps, each with its switch. Any actor reads them. */
         tools: servedProcedure
             .input(z.strictObject({ name: shipHandleSchema }))
-            .output(z.object({ tools: z.array(z.object({ name: z.string(), description: z.string().optional(), isReadOnly: z.boolean(), isOn: z.boolean(), isNew: z.boolean() })) }))
+            .output(z.object({ tools: z.array(z.object({ name: z.string(), description: z.string().optional(), isReadOnly: z.boolean().optional(), isDestructive: z.boolean().optional(), isOn: z.boolean(), isNew: z.boolean() })) }))
             .query(async ({ ctx, input }) => {
             const read = await ctx.readPartyTools({ fleetId: ctx.fleetId, ...input });
             if (!read.isOk) {
@@ -651,17 +697,75 @@ export const gatewayRouter = t.router({
             }
             return stated.value;
         }),
-        /** An actor holding gateway:approve switches one tool of an outside MCP server on or off for the party (aeolus-fleet#1151): kept, then stated at once. */
-        switchTool: servedProcedure
-            .input(z.strictObject({ name: shipHandleSchema, tool: z.string().min(1).max(TOOL_NAME_MAX_LENGTH), isOn: z.boolean() }))
-            .output(z.object({ tool: z.string(), isOn: z.boolean(), statementRefusal: z.string().nullable() }))
+        /** An actor holding gateway:approve within manage reach of the proxy ship switches tools of an outside MCP server on or off for the party (aeolus-fleet#1151), one or a selection (gateway scopes 4.3): kept in one change, then stated at once. */
+        switchTools: servedProcedure
+            .input(z.strictObject({ name: shipHandleSchema, tools: z.array(z.string().min(1).max(TOOL_NAME_MAX_LENGTH)).min(1), isOn: z.boolean() }))
+            .output(z.object({ tools: z.array(z.string()), isOn: z.boolean(), statementRefusal: z.string().nullable() }))
             .mutation(async ({ ctx, input }) => {
-            const switched = await ctx.switchTool({ actor: ctx.actor, ...input });
+            const switched = await ctx.switchTools({ actor: ctx.actor, as: { cookie: ctx.cookie, crewToken: ctx.crewToken }, ...input });
             if (!switched.isOk) {
-                throw new TRPCError({ code: SWITCH_TOOL_CODES[switched.error.kind], message: switched.error.message });
+                throw new TRPCError({ code: SWITCH_TOOLS_CODES[switched.error.kind], message: switched.error.message });
             }
             return switched.value;
         }),
+        /** Every scope the fleet lists now, with its description: the scopes an approver may require (gateway scopes 4.3). Only an approver reads them. */
+        listedScopes: servedProcedure.output(z.object({ scopes: z.array(z.object({ scope: z.string(), description: z.string() })) })).query(async ({ ctx }) => {
+            const read = await ctx.readListedScopes({ actor: ctx.actor });
+            if (!read.isOk) {
+                throw new TRPCError({ code: LISTED_SCOPES_CODES[read.error.kind], message: read.error.message });
+            }
+            return { scopes: read.value };
+        }),
+        /**
+         * Whether the actor approves the party: gateway:approve within manage
+         * reach of its proxy ship (gateway scopes 4.3, A2). Its page shows the
+         * controls then, and otherwise the same table read-only, saying why.
+         */
+        approving: servedProcedure
+            .input(z.strictObject({ name: shipHandleSchema }))
+            .output(z.object({ isApproving: z.boolean(), reason: z.string().nullable() }))
+            .query(async ({ ctx, input }) => {
+            const checked = await ctx.checkApproving({ actor: ctx.actor, as: { cookie: ctx.cookie, crewToken: ctx.crewToken }, ...input });
+            if (checked.isOk) {
+                return { isApproving: true, reason: null };
+            }
+            if (checked.error.kind === 'NO_SUCH_PARTY') {
+                throw new TRPCError({ code: 'NOT_FOUND', message: checked.error.message });
+            }
+            return { isApproving: false, reason: checked.error.message };
+        }),
+        /** Which scopes a calling ship needs for an outside MCP server or A2A agent, and the version to change them on (gateway scopes 4.2). Any actor reads them. */
+        scopeRequirements: servedProcedure
+            .input(z.strictObject({ name: shipHandleSchema }))
+            .output(scopeRequirementsSchema)
+            .query(async ({ ctx, input }) => {
+            const read = await ctx.readScopeRequirements({ fleetId: ctx.fleetId, ...input });
+            if (!read.isOk) {
+                throw new TRPCError({ code: 'NOT_FOUND', message: read.error.message });
+            }
+            return scopeRequirementsOutputOf(read.value);
+        }),
+        /**
+         * An actor holding gateway:approve sets the scopes a calling ship needs
+         * (gateway scopes 4.2, A2): the party's set when sent, and each tool's
+         * sent, an empty one dropping it, all at once on the version it read;
+         * then stated at once, as a tool switch is.
+         */
+        setScopeRequirements: servedProcedure
+            .input(z.strictObject({
+            name: shipHandleSchema,
+            version: z.int().min(0),
+            party: z.array(scopeNameSchema).optional(),
+            tools: z.array(z.strictObject({ tool: z.string().min(1).max(TOOL_NAME_MAX_LENGTH), scopes: z.array(scopeNameSchema) })),
+        }))
+            .output(z.intersection(scopeRequirementsSchema, z.object({ statementRefusal: z.string().nullable() })))
+            .mutation(async ({ ctx, input }) => {
+            const set = await ctx.setScopeRequirements({ actor: ctx.actor, as: { cookie: ctx.cookie, crewToken: ctx.crewToken }, name: input.name, version: input.version, ...(input.party === undefined ? {} : { party: input.party }), tools: new Map(input.tools.map(({ tool, scopes }) => [tool, scopes])) });
+            if (!set.isOk) {
+                throw new TRPCError({ code: SET_SCOPE_REQUIREMENTS_CODES[set.error.kind], message: set.error.message });
+            }
+            return { ...scopeRequirementsOutputOf(set.value.requirements), statementRefusal: set.value.statementRefusal };
+        }),
         /** argo marks a party's tool repeatable, or takes the mark off (interop 5.2): kept, then stated at once. */
         markTool: managing(servedProcedure)
             .input(z.strictObject({ name: shipHandleSchema, tool: z.string().min(1).max(TOOL_NAME_MAX_LENGTH), isRepeatable: z.boolean() }))
@@ -721,6 +825,21 @@ export const gatewayRouter = t.router({
                 await held;
             }
         }),
+        /** A meeting they take part in, with a page of its contributions, newest first, and where they stand on its mic (decision 0061). */
+        meeting: personProcedure
+            .input(z.strictObject({ meetingId: idSchema('meeting'), cursor: idSchema('message').optional() }))
+            .query(async ({ ctx, input: { meetingId, cursor } }) => meetingViewOf(personAnswerOf(await ctx.person.readMeeting({ caller: ctx.caller, meetingId, ...(cursor === undefined ? {} : { cursor }) })))),
+        /** Contributes to a meeting, once under the page's key; the fleet takes it while they hold the mic or moderate. */
+        contribute: personProcedure
+            .input(z.strictObject({ meetingId: idSchema('meeting'), payload: z.string().min(1).max(PAYLOAD_MAX_BYTES), idempotencyKey: z.string().min(1) }))
+            .mutation(async ({ ctx, input: { meetingId, payload, idempotencyKey } }) => personAnswerOf(await ctx.person.sendMessage({ caller: ctx.caller, to: { kind: 'meeting', meetingId }, contentType: CONTRIBUTION_CONTENT_TYPE, payload, idempotencyKey }))),
+        /** Their own mic call: request it, withdraw the request, or release the mic they hold. */
+        mic: personProcedure
+            .input(z.strictObject({ meetingId: idSchema('meeting'), change: z.enum(['request', 'withdraw', 'release']) }))
+            .mutation(async ({ ctx, input }) => {
+            personAnswerOf(await ctx.person.changeOwnMic({ caller: ctx.caller, ...input }));
+            return {};
+        }),
     }),
     requests: t.router({
         /** The requests the account asked, in any state, the newest first (decision 0056: Your requests). */