@aeolus-fleet/gateway 0.30.0 → 0.32.0

package/dist/core/meetings/mic-standing.js

@@ -0,0 +1,11 @@
+export function micStandingOf(meeting, shipId) {
+    if (meeting.moderator.shipId === shipId) {
+        return { kind: 'moderating' };
+    }
+    if (meeting.mic.holder?.shipId === shipId) {
+        return { kind: 'holding' };
+    }
+    const index = meeting.mic.requests.findIndex(({ ship }) => ship.shipId === shipId);
+    return index < 0 ? { kind: 'none' } : { kind: 'requested', place: index + 1 };
+}
+//# sourceMappingURL=mic-standing.js.map

package/dist/core/meetings/mic-standing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mic-standing.js","sourceRoot":"","sources":["../../../src/core/meetings/mic-standing.ts"],"names":[],"mappings":"AAWA,MAAM,UAAU,aAAa,CAAC,OAAoB,EAAE,MAAc;IAChE,IAAI,OAAO,CAAC,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACxC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAChC,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC;IACnF,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC;AAChF,CAAC"}

package/dist/core/meetings/ports.d.ts

@@ -0,0 +1,70 @@
+/**
+ * The meetings a person takes part in as their person ship (decision 0061,
+ * M19): the fleet's meeting calls the gateway makes as the ship's crew. Core
+ * holds the meeting and decides every call; the gateway reads and asks.
+ */
+import type { MeetingId, MessageId, ShipId, ShipKind, ShipStatus } from '@aeolus-fleet/common';
+import type { FleetRefusal } from '../connection/ports.js';
+import type { Result } from '../shared/result.js';
+/** A ship as a meeting names it. */
+export interface MeetingShip {
+    readonly shipId: ShipId;
+    readonly name: string;
+}
+/** Whether a participant is in the meeting now, left it keeping its right to rejoin, or was revoked by the owner (M13). */
+export type ParticipantState = 'present' | 'left' | 'revoked';
+/** A participant: who it is, whether it is crewed now (M14), and whether it is in the meeting now. */
+export interface MeetingParticipant extends MeetingShip {
+    readonly kind: ShipKind;
+    readonly status: ShipStatus;
+    readonly state: ParticipantState;
+}
+/** How the mic passes when it is free (M9): by the moderator's pick, or to the oldest request. */
+export type MicPattern = 'moderator' | 'fifo';
+/** The mic: who holds it, none while free; its pattern; and the requests, oldest first (M8). */
+export interface MeetingMic {
+    readonly holder: MeetingShip | null;
+    readonly pattern: MicPattern;
+    readonly requests: readonly {
+        readonly ship: MeetingShip;
+        readonly requestedAt: Date;
+    }[];
+}
+/** One contribution, whole. */
+export interface Contribution {
+    readonly messageId: MessageId;
+    readonly sender: MeetingShip;
+    readonly contentType: string;
+    readonly payload: string;
+    readonly sentAt: Date;
+}
+/** A meeting as the fleet reads it to a participant, with a page of its contributions, newest first. */
+export interface MeetingRead {
+    readonly meetingId: MeetingId;
+    readonly title: string | null;
+    readonly owner: MeetingShip;
+    readonly moderator: MeetingShip;
+    readonly openedAt: Date;
+    readonly endedAt: Date | null;
+    readonly participants: readonly MeetingParticipant[];
+    readonly mic: MeetingMic;
+    readonly contributions: {
+        readonly items: readonly Contribution[];
+        readonly nextCursor: MessageId | null;
+    };
+}
+/** A participant's own mic calls (M8, M10): to request it, withdraw its request, and release the mic it holds. */
+export type OwnMicChange = 'request' | 'withdraw' | 'release';
+/** Outbound port: the fleet's meeting calls as the crew of a person ship. */
+export interface PersonMeetingDoor {
+    /** The meeting and a page of its contributions after the cursor, newest first; refused for a meeting the ship takes no part in. */
+    meeting(crewToken: string, asked: {
+        meetingId: MeetingId;
+        cursor?: MessageId;
+    }): Promise<Result<MeetingRead, FleetRefusal>>;
+    /** Makes one of the ship's own mic calls; the fleet refuses one the meeting does not allow now and says why. */
+    changeMic(crewToken: string, asked: {
+        meetingId: MeetingId;
+        change: OwnMicChange;
+    }): Promise<Result<undefined, FleetRefusal>>;
+}

package/dist/core/meetings/ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/core/meetings/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../src/core/meetings/ports.ts"],"names":[],"mappings":""}

package/dist/core/meetings/read-meeting.d.ts

@@ -0,0 +1,30 @@
+import type { MeetingId, MessageId } from '@aeolus-fleet/common';
+import type { CrewPersonShip } from '../people/crew-person-ship.js';
+import { type PersonCaller, type PersonCrewError } from '../people/person-crew.js';
+import type { PersonCrews } from '../people/ports.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import { type MicStanding } from './mic-standing.js';
+import type { MeetingRead, PersonMeetingDoor } from './ports.js';
+/** A meeting as a person reads it: the fleet's read, and where they stand on its mic. */
+export interface PersonMeeting {
+    readonly meeting: MeetingRead;
+    readonly mic: MicStanding;
+}
+export type ReadMeeting = (input: {
+    caller: PersonCaller;
+    meetingId: MeetingId;
+    cursor?: MessageId;
+}) => Promise<Result<PersonMeeting, PersonCrewError | DomainError<'NO_SUCH_MEETING'>>>;
+/**
+ * Use case: a person reads a meeting they take part in, as their person ship
+ * (decision 0061, M12, M19), with a page of its contributions, newest first.
+ * The fleet decides who reads it, so its refusal is passed on in its words.
+ * Reading acknowledges nothing: a contribution waits in the inbox until the
+ * person opens it.
+ */
+export declare function createReadMeeting(deps: {
+    crewPersonShip: CrewPersonShip;
+    crews: PersonCrews;
+    door: PersonMeetingDoor;
+}): ReadMeeting;

package/dist/core/meetings/read-meeting.js

@@ -0,0 +1,26 @@
+import { asPersonCrew, withOwnRefusal } from '../people/person-crew.js';
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+import { micStandingOf } from './mic-standing.js';
+/**
+ * Use case: a person reads a meeting they take part in, as their person ship
+ * (decision 0061, M12, M19), with a page of its contributions, newest first.
+ * The fleet decides who reads it, so its refusal is passed on in its words.
+ * Reading acknowledges nothing: a contribution waits in the inbox until the
+ * person opens it.
+ */
+export function createReadMeeting(deps) {
+    return async ({ caller, meetingId, cursor }) => {
+        const asked = cursor === undefined ? { meetingId } : { meetingId, cursor };
+        const read = await asPersonCrew(deps, { caller, run: (crew) => withOwnRefusal(deps.door.meeting(crew.crewToken, asked)) });
+        if (!read.isOk) {
+            return read;
+        }
+        const meeting = read.value.value;
+        if (!meeting.isOk) {
+            return refuse('NO_SUCH_MEETING', `The fleet did not read the meeting to you: ${meeting.error.message}`);
+        }
+        return ok({ meeting: meeting.value, mic: micStandingOf(meeting.value, read.value.crew.shipId) });
+    };
+}
+//# sourceMappingURL=read-meeting.js.map

package/dist/core/meetings/read-meeting.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-meeting.js","sourceRoot":"","sources":["../../../src/core/meetings/read-meeting.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,cAAc,EAA2C,MAAM,0BAA0B,CAAC;AAEjH,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,aAAa,EAAoB,MAAM,mBAAmB,CAAC;AAWpE;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAqF;IACrH,OAAO,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE;QAC7C,MAAM,KAAK,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QAC3E,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QAC3H,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,MAAM,CAAC,iBAAiB,EAAE,8CAA8C,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1G,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnG,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/operator/ports.d.ts

@@ -1,16 +1,16 @@
-import type { FleetId, Scope } from '@aeolus-fleet/common';
+import type { FleetId, ScopeName } from '@aeolus-fleet/common';
 import type { FleetRefusal } from '../connection/ports.js';
 import type { Result } from '../shared/result.js';
-/** A signed-in console session: argo's or a viewer's, with its ship's scopes, or an account's, with its account token's. */
+/** A signed-in console session: argo's or a viewer's, with its ship's scopes, or an account's, with its account token's; the fleet's own scopes among them (gateway scopes 4.1). */
 export type ConsoleSession = {
     fleetId: FleetId;
     kind: 'operator' | 'viewer';
-    scopes: readonly Scope[];
+    scopes: readonly ScopeName[];
 } | {
     fleetId: FleetId;
     kind: 'account';
     accountId: string;
-    scopes: readonly Scope[];
+    scopes: readonly ScopeName[];
 };
 /**
  * Outbound port: asks the fleet whose a forwarded console session cookie is

package/dist/core/parties/add-a2a-agent.js

@@ -25,7 +25,7 @@ export function createAddA2aAgent(deps) {
         if (!(await deps.servesOutsideParties(fleetId))) {
             return refuse('OUTSIDE_PARTIES_OFF', "This fleet's outside parties are off: turn them on first");
         }
-        const statement = await readAgentStatement(deps, { name, cardUrl, isRepeatable: true });
+        const statement = await readAgentStatement(deps, { name, cardUrl, isRepeatable: true, scopes: [] });
         if (!statement.isOk) {
             return statement;
         }

package/dist/core/parties/add-a2a-agent.js.map

@@ -1 +1 @@
-{"version":3,"file":"add-a2a-agent.js","sourceRoot":"","sources":["../../../src/core/parties/add-a2a-agent.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAExE,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAG/D,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,cAAc,EAA+C,MAAM,oBAAoB,CAAC;AAiBhI;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA8D;IAC9F,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE;QACtG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,iBAAiB,EAAE,qCAAqC,eAAe,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,gBAAgB,EAAE,2CAA2C,OAAO,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAC1B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAChD,OAAO,MAAM,CAAC,qBAAqB,EAAE,0DAA0D,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YACpB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACrI,OAAO,QAAQ,CAAgB,IAAI,EAAE;YACnC,OAAO;YACP,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,OAAO;YACf,WAAW;YACX,KAAK,EAAE,WAAW;YAClB,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;YAClL,KAAK,EAAE,CAAC,OAAO,EAA4B,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU;SAC1E,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"add-a2a-agent.js","sourceRoot":"","sources":["../../../src/core/parties/add-a2a-agent.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAExE,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAG/D,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,cAAc,EAA+C,MAAM,oBAAoB,CAAC;AAiBhI;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA8D;IAC9F,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE;QACtG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,iBAAiB,EAAE,qCAAqC,eAAe,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,gBAAgB,EAAE,2CAA2C,OAAO,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAC1B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAChD,OAAO,MAAM,CAAC,qBAAqB,EAAE,0DAA0D,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YACpB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACrI,OAAO,QAAQ,CAAgB,IAAI,EAAE;YACnC,OAAO;YACP,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,OAAO;YACf,WAAW;YACX,KAAK,EAAE,WAAW;YAClB,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;YAClL,KAAK,EAAE,CAAC,OAAO,EAA4B,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU;SAC1E,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/check-approving.d.ts

@@ -0,0 +1,36 @@
+import type { Actor } from '../actors/authenticate-actor.js';
+import type { ActorCredential, CredentialOf } from '../actors/credential-of.js';
+import type { ConnectionStore, GatewayCrew } from '../connection/ports.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { A2aAgentParty, McpServerParty } from './party.js';
+import type { PartyStore, ProxyShipsAsActor } from './ports.js';
+export type ApprovingRefusal = DomainError<'NOT_AN_APPROVER' | 'NO_SUCH_PARTY' | 'PARTY_NOT_COMMISSIONED' | 'NOT_CONNECTED' | 'FLEET_UNAVAILABLE' | 'NOT_REACHABLE'>;
+export type CheckApproving = (input: {
+    actor: Actor;
+    as: ActorCredential;
+    name: string;
+}) => Promise<Result<undefined, ApprovingRefusal>>;
+interface ApprovingDeps {
+    parties: PartyStore;
+    connections: Pick<ConnectionStore, 'find'>;
+    fleet: Pick<ProxyShipsAsActor, 'checkManage'>;
+    credentialOf: CredentialOf;
+}
+/**
+ * The outside MCP server or A2A agent an actor approves, with the gateway's
+ * connection: the actor holds gateway:approve, and the fleet, asked as the
+ * actor, answers that it manages the party's proxy ship (A2). The fleet
+ * records a refusal.
+ */
+export declare function approvedParty(deps: ApprovingDeps, { actor, as, name }: Parameters<CheckApproving>[0]): Promise<Result<{
+    party: McpServerParty | A2aAgentParty;
+    gateway: GatewayCrew;
+}, ApprovingRefusal>>;
+/**
+ * Use case: whether an actor approves an outside MCP server or A2A agent
+ * (gateway scopes 4.3): the party's page shows its controls only then, and
+ * the same table read-only otherwise.
+ */
+export declare function createCheckApproving(deps: ApprovingDeps): CheckApproving;
+export {};

package/dist/core/parties/check-approving.js

@@ -0,0 +1,48 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+import { APPROVING_SCOPE } from './approver.js';
+/**
+ * The outside MCP server or A2A agent an actor approves, with the gateway's
+ * connection: the actor holds gateway:approve, and the fleet, asked as the
+ * actor, answers that it manages the party's proxy ship (A2). The fleet
+ * records a refusal.
+ */
+export async function approvedParty(deps, { actor, as, name }) {
+    if (!actor.scopes.includes(APPROVING_SCOPE)) {
+        return refuse('NOT_AN_APPROVER', `Setting the scopes an outside party needs takes ${APPROVING_SCOPE}`);
+    }
+    const party = await deps.parties.find(actor.fleetId, name);
+    if (party?.kind !== 'mcpServer' && party?.kind !== 'a2aAgent') {
+        return refuse('NO_SUCH_PARTY', `There is no outside MCP server or A2A agent ${name}`);
+    }
+    if (party.proxyShipId === null) {
+        return refuse('PARTY_NOT_COMMISSIONED', `${name}'s proxy ship is not commissioned yet`);
+    }
+    const gateway = await deps.connections.find(actor.fleetId);
+    if (gateway === undefined) {
+        return refuse('NOT_CONNECTED', 'The gateway is not connected to the fleet');
+    }
+    const credential = await deps.credentialOf(actor, as);
+    if (!credential.isOk) {
+        return credential;
+    }
+    const managed = await deps.fleet.checkManage(credential.value, { shipId: party.proxyShipId });
+    if (!managed.isOk) {
+        return managed.error.code === 'UNAVAILABLE'
+            ? refuse('FLEET_UNAVAILABLE', `The fleet did not say whether you manage ${name}: ${managed.error.message}`)
+            : refuse('NOT_REACHABLE', managed.error.message);
+    }
+    return ok({ party, gateway });
+}
+/**
+ * Use case: whether an actor approves an outside MCP server or A2A agent
+ * (gateway scopes 4.3): the party's page shows its controls only then, and
+ * the same table read-only otherwise.
+ */
+export function createCheckApproving(deps) {
+    return async (input) => {
+        const approved = await approvedParty(deps, input);
+        return approved.isOk ? ok(undefined) : approved;
+    };
+}
+//# sourceMappingURL=check-approving.js.map

package/dist/core/parties/check-approving.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-approving.js","sourceRoot":"","sources":["../../../src/core/parties/check-approving.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAehD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAmB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAiC;IACzG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,iBAAiB,EAAE,mDAAmD,eAAe,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,KAAK,EAAE,IAAI,KAAK,WAAW,IAAI,KAAK,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;QAC9D,OAAO,MAAM,CAAC,eAAe,EAAE,+CAA+C,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,wBAAwB,EAAE,GAAG,IAAI,uCAAuC,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,eAAe,EAAE,2CAA2C,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACrB,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9F,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa;YACzC,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,4CAA4C,IAAI,KAAK,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAC3G,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAmB;IACtD,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAClD,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/check-required-scopes.d.ts

@@ -0,0 +1,34 @@
+import type { FleetId, ShipId } from '@aeolus-fleet/common';
+import type { ConnectionStore, FleetDoor } from '../connection/ports.js';
+/**
+ * How checking a call's scopes ended:
+ * - holds: the calling ship holds every needed scope, so the call goes on;
+ * - lacks: it does not, and the message names what is missing (P2);
+ * - unread: core did not answer the read, so the call waits and is tried again, never made unchecked.
+ */
+export type ScopeCheck = {
+    readonly kind: 'holds';
+} | {
+    readonly kind: 'lacks';
+    readonly message: string;
+} | {
+    readonly kind: 'unread';
+};
+export type CheckRequiredScopes = (call: {
+    fleetId: FleetId;
+    senderShipId: ShipId;
+    needing: string;
+    needed: readonly string[];
+}) => Promise<ScopeCheck>;
+/**
+ * Use case: whether the ship calling an outside party holds every scope the
+ * call needs (design gateway-scopes, 4.2). The gateway reads the ship's
+ * scopes from core as its own ship, on the calling ship's behalf so its read
+ * reach holds it, on every call and never from the message (decision 0057):
+ * a scope revoked holds at the next call (0046). A call that needs nothing
+ * reads nothing.
+ */
+export declare function createCheckRequiredScopes(deps: {
+    connections: Pick<ConnectionStore, 'find'>;
+    door: Pick<FleetDoor, 'getShip'>;
+}): CheckRequiredScopes;

package/dist/core/parties/check-required-scopes.js

@@ -0,0 +1,27 @@
+import { lackingScopesMessage, scopesLacking } from './scope-requirements.js';
+/**
+ * Use case: whether the ship calling an outside party holds every scope the
+ * call needs (design gateway-scopes, 4.2). The gateway reads the ship's
+ * scopes from core as its own ship, on the calling ship's behalf so its read
+ * reach holds it, on every call and never from the message (decision 0057):
+ * a scope revoked holds at the next call (0046). A call that needs nothing
+ * reads nothing.
+ */
+export function createCheckRequiredScopes(deps) {
+    return async ({ fleetId, senderShipId, needing, needed }) => {
+        if (needed.length === 0) {
+            return { kind: 'holds' };
+        }
+        const gateway = await deps.connections.find(fleetId);
+        if (gateway === undefined) {
+            return { kind: 'unread' };
+        }
+        const ship = await deps.door.getShip(gateway.crewToken, { shipId: senderShipId, onBehalfOf: senderShipId });
+        if (!ship.isOk) {
+            return { kind: 'unread' };
+        }
+        const lacking = scopesLacking(needed, ship.value.scopes);
+        return lacking.length === 0 ? { kind: 'holds' } : { kind: 'lacks', message: lackingScopesMessage({ needing, lacking, shipName: ship.value.name }) };
+    };
+}
+//# sourceMappingURL=check-required-scopes.js.map

package/dist/core/parties/check-required-scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-required-scopes.js","sourceRoot":"","sources":["../../../src/core/parties/check-required-scopes.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAY9E;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAsF;IAC9H,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;QAC1D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC;QAC5G,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACzD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,oBAAoB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;IACtJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/ports.d.ts

@@ -3,6 +3,7 @@ import type { ActorCredential } from '../actors/credential-of.js';
 import type { FleetRefusal } from '../connection/ports.js';
 import type { Result } from '../shared/result.js';
 import type { Party } from './party.js';
+import type { ScopeRequirements, ScopeRequirementsChange } from './scope-requirements.js';
 import type { FromFleet } from './shown-party.js';
 import type { ToolSwitches } from './tool-switches.js';
 /** Outbound port: the parties argo approved, one per proxy ship name in a fleet. */
@@ -29,6 +30,22 @@ export interface PartyStore {
     }): Promise<void>;
     remove(fleetId: FleetId, name: string): Promise<void>;
 }
+/** Outbound port: each party's required scopes (design gateway-scopes, 4.2), kept with the party and gone with it. */
+export interface ScopeRequirementsStore {
+    /** The party's requirements as they are now; none set yet is version 0, needing nothing. */
+    find(fleetId: FleetId, party: string): Promise<ScopeRequirements>;
+    /**
+     * Makes the change, all at once and only while the requirements are still
+     * at the version named: the requirements after, at the next version; none
+     * once another change moved them on.
+     */
+    change(party: {
+        fleetId: FleetId;
+        name: string;
+    }, change: ScopeRequirementsChange & {
+        version: number;
+    }): Promise<ScopeRequirements | undefined>;
+}
 /** Outbound port: the fleet's calls the gateway makes for a party's proxy ship. */
 export interface ProxyShipDoor {
     /**
@@ -79,6 +96,10 @@ export interface ProxyShipsAsActor {
     }): Promise<Result<{
         scopes: string[];
     }, FleetRefusal>>;
+    /** Whether the actor manages the proxy ship now (fleet.checkManage, no scope): OK, or the fleet's refusal, which it records. */
+    checkManage(as: ActorCredential, ship: {
+        shipId: ShipId;
+    }): Promise<Result<undefined, FleetRefusal>>;
 }
 /** Outbound port: what the fleet holds for a proxy ship, read as the actor (fleet:read): its name, owner and scopes, only its name outside the actor's read reach. */
 export interface ProxyShipReads {

package/dist/core/parties/read-listed-scopes.d.ts

@@ -0,0 +1,17 @@
+import type { Actor } from '../actors/authenticate-actor.js';
+import type { ConnectionStore, FleetDoor, ListedScope } from '../connection/ports.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+export type ReadListedScopes = (input: {
+    actor: Actor;
+}) => Promise<Result<ListedScope[], DomainError<'NOT_AN_APPROVER' | 'NOT_CONNECTED' | 'FLEET_UNAVAILABLE'>>>;
+/**
+ * Use case: the scopes an approver may require of a calling ship (gateway
+ * scopes 4.3), every one the fleet lists now with its description, read as
+ * the gateway's ship as the change itself checks them. Only an approver
+ * picks them, so only an approver reads them.
+ */
+export declare function createReadListedScopes(deps: {
+    connections: Pick<ConnectionStore, 'find'>;
+    door: Pick<FleetDoor, 'listScopes'>;
+}): ReadListedScopes;

package/dist/core/parties/read-listed-scopes.js

@@ -0,0 +1,23 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+import { APPROVING_SCOPE } from './approver.js';
+/**
+ * Use case: the scopes an approver may require of a calling ship (gateway
+ * scopes 4.3), every one the fleet lists now with its description, read as
+ * the gateway's ship as the change itself checks them. Only an approver
+ * picks them, so only an approver reads them.
+ */
+export function createReadListedScopes(deps) {
+    return async ({ actor }) => {
+        if (!actor.scopes.includes(APPROVING_SCOPE)) {
+            return refuse('NOT_AN_APPROVER', `Reading the scopes to require takes ${APPROVING_SCOPE}`);
+        }
+        const gateway = await deps.connections.find(actor.fleetId);
+        if (gateway === undefined) {
+            return refuse('NOT_CONNECTED', 'The gateway is not connected to the fleet');
+        }
+        const listed = await deps.door.listScopes(gateway.crewToken);
+        return listed.isOk ? ok(listed.value) : refuse('FLEET_UNAVAILABLE', `The fleet did not say which scopes it lists: ${listed.error.message}`);
+    };
+}
+//# sourceMappingURL=read-listed-scopes.js.map

package/dist/core/parties/read-listed-scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-listed-scopes.js","sourceRoot":"","sources":["../../../src/core/parties/read-listed-scopes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAIhD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAyF;IAC9H,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QACzB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,iBAAiB,EAAE,uCAAuC,eAAe,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,eAAe,EAAE,2CAA2C,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,gDAAgD,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9I,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/read-scope-requirements.d.ts

@@ -0,0 +1,18 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { PartyStore, ScopeRequirementsStore } from './ports.js';
+import type { ScopeRequirements } from './scope-requirements.js';
+export type ReadScopeRequirements = (input: {
+    fleetId: FleetId;
+    name: string;
+}) => Promise<Result<ScopeRequirements, DomainError<'NO_SUCH_PARTY'>>>;
+/**
+ * Use case: which scopes an outside MCP server or A2A agent needs, and the
+ * version an approver changes them on (design gateway-scopes, 4.2). Anyone
+ * in the fleet reads them, as its tools are read.
+ */
+export declare function createReadScopeRequirements(deps: {
+    parties: PartyStore;
+    requirements: ScopeRequirementsStore;
+}): ReadScopeRequirements;

package/dist/core/parties/read-scope-requirements.js

@@ -0,0 +1,17 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+/**
+ * Use case: which scopes an outside MCP server or A2A agent needs, and the
+ * version an approver changes them on (design gateway-scopes, 4.2). Anyone
+ * in the fleet reads them, as its tools are read.
+ */
+export function createReadScopeRequirements(deps) {
+    return async ({ fleetId, name }) => {
+        const party = await deps.parties.find(fleetId, name);
+        if (party?.kind !== 'mcpServer' && party?.kind !== 'a2aAgent') {
+            return refuse('NO_SUCH_PARTY', `There is no outside MCP server or A2A agent ${name}`);
+        }
+        return ok(await deps.requirements.find(fleetId, name));
+    };
+}
+//# sourceMappingURL=read-scope-requirements.js.map

package/dist/core/parties/read-scope-requirements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-scope-requirements.js","sourceRoot":"","sources":["../../../src/core/parties/read-scope-requirements.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAMtD;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAmE;IAC7G,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,IAAI,KAAK,EAAE,IAAI,KAAK,WAAW,IAAI,KAAK,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9D,OAAO,MAAM,CAAC,eAAe,EAAE,+CAA+C,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,EAAE,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/scope-requirements.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Which scopes a calling ship must hold to use an outside party (design
+ * gateway-scopes, 4.2): a set for the party as a whole, and for an outside
+ * MCP server a set per tool. A tool needs both sets, every scope in them
+ * (A5). A scope says what a ship may do; which party it reaches stays the
+ * network rules' (L1). Kept by scope text and tool name, never by a ship.
+ */
+/** A party's required scopes, and the version they were changed to last, so two approvers never overwrite each other unseen. */
+export interface ScopeRequirements {
+    readonly version: number;
+    /** What every call to the party needs; an A2A agent has only this set, as its messages name no tool (L26). */
+    readonly party: readonly string[];
+    /** What each tool needs beside the party's set, by tool name; a tool not named needs only the party's. */
+    readonly tools: ReadonlyMap<string, readonly string[]>;
+}
+/** A party with nothing required: every call needs only to reach it. */
+export declare const NO_SCOPE_REQUIREMENTS: ScopeRequirements;
+/** A change to a party's requirements: its own set when given, and each tool's set given, an empty one dropping the tool's. */
+export interface ScopeRequirementsChange {
+    readonly party?: readonly string[];
+    readonly tools: ReadonlyMap<string, readonly string[]>;
+}
+/** The requirements after a change, at the next version. */
+export declare function changedRequirements(kept: ScopeRequirements, change: ScopeRequirementsChange): ScopeRequirements;
+/** Every scope a call needs: the party's set and the tool's own, each once; a party called as a whole (no tool) needs its set alone. */
+export declare function scopesNeeded(requirements: ScopeRequirements, tool: string | null): string[];
+/** The needed scopes the calling ship does not hold. */
+export declare function scopesLacking(needed: readonly string[], held: readonly string[]): string[];
+/** A refusal naming what is missing (P2): "update_lead needs crm:write-leads, which lead-scout does not hold". */
+export declare function lackingScopesMessage(refused: {
+    needing: string;
+    lacking: readonly string[];
+    shipName: string;
+}): string;

package/dist/core/parties/scope-requirements.js

@@ -0,0 +1,37 @@
+/**
+ * Which scopes a calling ship must hold to use an outside party (design
+ * gateway-scopes, 4.2): a set for the party as a whole, and for an outside
+ * MCP server a set per tool. A tool needs both sets, every scope in them
+ * (A5). A scope says what a ship may do; which party it reaches stays the
+ * network rules' (L1). Kept by scope text and tool name, never by a ship.
+ */
+/** A party with nothing required: every call needs only to reach it. */
+export const NO_SCOPE_REQUIREMENTS = { version: 0, party: [], tools: new Map() };
+/** The requirements after a change, at the next version. */
+export function changedRequirements(kept, change) {
+    const tools = new Map(kept.tools);
+    for (const [tool, scopes] of change.tools) {
+        if (scopes.length === 0) {
+            tools.delete(tool);
+        }
+        else {
+            tools.set(tool, scopes);
+        }
+    }
+    return { version: kept.version + 1, party: change.party ?? kept.party, tools };
+}
+/** Every scope a call needs: the party's set and the tool's own, each once; a party called as a whole (no tool) needs its set alone. */
+export function scopesNeeded(requirements, tool) {
+    const own = tool === null ? [] : (requirements.tools.get(tool) ?? []);
+    return [...new Set([...requirements.party, ...own])];
+}
+/** The needed scopes the calling ship does not hold. */
+export function scopesLacking(needed, held) {
+    return needed.filter((scope) => !held.includes(scope));
+}
+/** A refusal naming what is missing (P2): "update_lead needs crm:write-leads, which lead-scout does not hold". */
+export function lackingScopesMessage(refused) {
+    const scopes = refused.lacking.length === 1 ? refused.lacking.join('') : `${refused.lacking.slice(0, -1).join(', ')} and ${refused.lacking.at(-1) ?? ''}`;
+    return `${refused.needing} needs ${scopes}, which ${refused.shipName} does not hold`;
+}
+//# sourceMappingURL=scope-requirements.js.map

package/dist/core/parties/scope-requirements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-requirements.js","sourceRoot":"","sources":["../../../src/core/parties/scope-requirements.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAWH,wEAAwE;AACxE,MAAM,CAAC,MAAM,qBAAqB,GAAsB,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;AAQpG,4DAA4D;AAC5D,MAAM,UAAU,mBAAmB,CAAC,IAAuB,EAAE,MAA+B;IAC1F,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;AACjF,CAAC;AAED,wIAAwI;AACxI,MAAM,UAAU,YAAY,CAAC,YAA+B,EAAE,IAAmB;IAC/E,MAAM,GAAG,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,aAAa,CAAC,MAAyB,EAAE,IAAuB;IAC9E,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,kHAAkH;AAClH,MAAM,UAAU,oBAAoB,CAAC,OAA0E;IAC7G,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAC1J,OAAO,GAAG,OAAO,CAAC,OAAO,UAAU,MAAM,WAAW,OAAO,CAAC,QAAQ,gBAAgB,CAAC;AACvF,CAAC"}

package/dist/core/parties/set-scope-requirements.d.ts

@@ -0,0 +1,45 @@
+import type { StateA2aAgent } from '../a2a-out/state-a2a-agent.js';
+import type { Actor } from '../actors/authenticate-actor.js';
+import type { ActorCredential, CredentialOf } from '../actors/credential-of.js';
+import type { ConnectionStore, FleetDoor } from '../connection/ports.js';
+import type { StateParty } from '../mcp-out/state-party.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { PartyStore, ProxyShipsAsActor, ScopeRequirementsStore } from './ports.js';
+import type { ScopeRequirements } from './scope-requirements.js';
+export type SetScopeRequirementsRefusal = DomainError<'NOT_AN_APPROVER' | 'NO_SUCH_PARTY' | 'PARTY_NOT_COMMISSIONED' | 'NOT_REACHABLE' | 'NO_SUCH_TOOL' | 'NOT_CONNECTED' | 'FLEET_UNAVAILABLE' | 'SCOPE_NOT_LISTED' | 'CONFLICT'>;
+export type SetScopeRequirements = (input: {
+    actor: Actor;
+    as: ActorCredential;
+    name: string;
+    /** The requirements' version the change was made on, as the approver read them. */
+    version: number;
+    party?: readonly string[];
+    tools: ReadonlyMap<string, readonly string[]>;
+}) => Promise<Result<{
+    requirements: ScopeRequirements; /** Why the proxy ship's statement waits for its next one; none when the fleet sees the change now. */
+    statementRefusal: string | null;
+}, SetScopeRequirementsRefusal>>;
+/**
+ * Use case: an approver sets which scopes a calling ship needs (design
+ * gateway-scopes, 4.2, A2): for an outside MCP server the party's set and
+ * any tool's, for an outside A2A agent its set as a whole. The fleet, asked
+ * as the approver, must answer that it manages the proxy ship before
+ * anything changes, clearing included; it records a refusal. Every scope must
+ * be one the fleet lists now, core's, a plugin's or the fleet's own: any may
+ * be required (0016). The change is made only on the version the approver
+ * read, so two approvers never overwrite each other unseen. The change is
+ * kept first, so the check holds at once, then the proxy ship is stated
+ * anew with what each capability needs (P1); while it cannot be, the
+ * statement waits for its next one.
+ */
+export declare function createSetScopeRequirements(deps: {
+    parties: PartyStore;
+    requirements: ScopeRequirementsStore;
+    connections: Pick<ConnectionStore, 'find'>;
+    door: Pick<FleetDoor, 'listScopes'>;
+    stateParty: StateParty;
+    stateA2aAgent: StateA2aAgent;
+    fleet: Pick<ProxyShipsAsActor, 'checkManage'>;
+    credentialOf: CredentialOf;
+}): SetScopeRequirements;