@aeolus-fleet/gateway 0.31.0 → 0.32.1

package/dist/core/mcp-out/hand-call.js

@@ -1,4 +1,5 @@
 import { PAYLOAD_MAX_BYTES, payloadBytes } from '@aeolus-fleet/common';
+import { scopesNeeded } from '../parties/scope-requirements.js';
 import { isToolOn, TOOL_NOT_ENABLED } from '../parties/tool-switches.js';
 import { toolCalledBy, toolInputType, toolResultType } from './content-types.js';
 /** The channel the gateway hands a proxy ship's delivery through: its outside MCP server (interop 5.1). */
@@ -51,7 +52,8 @@ function notACallReply(party, delivery) {
  * nothing. A call that died unanswered is handed again only where argo
  * marked its tool repeatable; otherwise it is reported not handled. A call
  * to a tool not switched on is answered an error and reaches no server
- * (aeolus-fleet#1151).
+ * (aeolus-fleet#1151); so is a call from a ship that lacks a scope the
+ * tool needs (design gateway-scopes, 4.2).
  */
 export function createHandCall(deps) {
     return async ({ party, delivery }) => {
@@ -100,6 +102,17 @@ export function createHandCall(deps) {
         if (!isToolOn(now?.kind === 'mcpServer' ? now.toolSwitches : party.toolSwitches, tool)) {
             return finish(resultReply(delivery, { tool, result: errorResult(TOOL_NOT_ENABLED) }));
         }
+        // The requirements and the sender's scopes as they are now, at hand-over: either may change while a call waits.
+        const needed = scopesNeeded(await deps.requirements.find(party.fleetId, party.name), tool);
+        const checked = await deps.checkScopes({ fleetId: party.fleetId, senderShipId: delivery.senderShipId, needing: tool, needed });
+        switch (checked.kind) {
+            case 'unread':
+                return AGAIN;
+            case 'lacks':
+                return finish(resultReply(delivery, { tool, result: errorResult(checked.message) }));
+            case 'holds':
+                break;
+        }
         const handed = await deps.crew.handed(crewToken, { deliveryId: delivery.deliveryId, handOverNumber: (delivery.handOverNumber ?? 0) + 1, channel: MCP_CHANNEL });
         if (!handed.isOk) {
             return AGAIN;

package/dist/core/mcp-out/hand-call.js.map

@@ -1 +1 @@
-{"version":3,"file":"hand-call.js","sourceRoot":"","sources":["../../../src/core/mcp-out/hand-call.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAA8D,MAAM,sBAAsB,CAAC;AAKnI,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEzE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAuEjF,2GAA2G;AAC3G,MAAM,WAAW,GAAG,KAAK,CAAC;AAE1B,uFAAuF;AACvF,MAAM,CAAC,MAAM,YAAY,GAAG,+FAA+F,CAAC;AAE5H,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,OAAO,EAAW,CAAC;AAEzC,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5C,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED,mHAAmH;AACnH,SAAS,WAAW,CAAC,QAAwB,EAAE,IAA0C;IACvF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,YAAY;QACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,WAAW,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QACtC,OAAO,EAAE,KAAK,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,sBAAsB,MAAM,CAAC,KAAK,CAAC,4BAA4B,MAAM,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO;QACvL,cAAc,EAAE,cAAc,QAAQ,CAAC,SAAS,EAAE;KACnD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAqB,EAAE,QAAwB;IACpE,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,YAAY;QACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,WAAW,EAAE,YAAY;QACzB,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,2DAA2D,aAAa,CAAC,QAAQ,CAAC,6CAA6C;QACrJ,cAAc,EAAE,cAAc,QAAQ,CAAC,SAAS,EAAE;KACnD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,IAA8H;IAC3J,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE;QACnC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QAClC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QAE5F,MAAM,MAAM,GAAG,KAAK,EAAE,KAAY,EAAwB,EAAE;YAC1D,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;gBAC3K,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBACzB,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACzD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,CAAC,CAAC;QACF,MAAM,UAAU,GAAG,KAAK,IAA0B,EAAE;YAClD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACrE,4GAA4G;YAC5G,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YACjG,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAChC,CAAC,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACxD,IAAI,IAAI,EAAE,KAAK,KAAK,YAAY,EAAE,CAAC;YACjC,OAAO,UAAU,EAAE,CAAC;QACtB,CAAC;QACD,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;YAChB,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,2CAA2C,CAAC,EAAE,CAAC,CAAC,CAAC;QACnH,CAAC;QACD,MAAM,YAAY,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxF,6GAA6G;QAC7G,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,EAAE,KAAK,KAAK,SAAS,IAAI,CAAC,YAAY,EAAE,CAAC;YAC9E,OAAO,UAAU,EAAE,CAAC;QACtB,CAAC;QAED,oHAAoH;QACpH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC;YACvF,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,cAAc,EAAE,CAAC,QAAQ,CAAC,cAAc,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;QAChK,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;YACrC,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1J,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;gBACtE,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC7D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;YACD,KAAK,SAAS;gBACZ,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClE,OAAO,KAAK,CAAC;YACf,KAAK,YAAY;gBACf,OAAO,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"hand-call.js","sourceRoot":"","sources":["../../../src/core/mcp-out/hand-call.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAA8D,MAAM,sBAAsB,CAAC;AAMnI,OAAO,EAAE,YAAY,EAAE,MAAM,kCAAkC,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAEzE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAuEjF,2GAA2G;AAC3G,MAAM,WAAW,GAAG,KAAK,CAAC;AAE1B,uFAAuF;AACvF,MAAM,CAAC,MAAM,YAAY,GAAG,+FAA+F,CAAC;AAE5H,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,OAAO,EAAW,CAAC;AAEzC,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5C,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC9D,CAAC;AAED,mHAAmH;AACnH,SAAS,WAAW,CAAC,QAAwB,EAAE,IAA0C;IACvF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,YAAY;QACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,WAAW,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QACtC,OAAO,EAAE,KAAK,GAAG,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,sBAAsB,MAAM,CAAC,KAAK,CAAC,4BAA4B,MAAM,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO;QACvL,cAAc,EAAE,cAAc,QAAQ,CAAC,SAAS,EAAE;KACnD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAqB,EAAE,QAAwB;IACpE,OAAO;QACL,EAAE,EAAE,QAAQ,CAAC,YAAY;QACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,WAAW,EAAE,YAAY;QACzB,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,2DAA2D,aAAa,CAAC,QAAQ,CAAC,6CAA6C;QACrJ,cAAc,EAAE,cAAc,QAAQ,CAAC,SAAS,EAAE;KACnD,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAAC,IAS9B;IACC,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE;QACnC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QAClC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QAE5F,MAAM,MAAM,GAAG,KAAK,EAAE,KAAY,EAAwB,EAAE;YAC1D,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;gBAC3K,IAAI,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;oBACzB,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;YACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YACzD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,CAAC,CAAC;QACF,MAAM,UAAU,GAAG,KAAK,IAA0B,EAAE;YAClD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACrE,4GAA4G;YAC5G,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YACjG,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAChC,CAAC,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACxD,IAAI,IAAI,EAAE,KAAK,KAAK,YAAY,EAAE,CAAC;YACjC,OAAO,UAAU,EAAE,CAAC;QACtB,CAAC;QACD,IAAI,IAAI,EAAE,KAAK,EAAE,CAAC;YAChB,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,2CAA2C,CAAC,EAAE,CAAC,CAAC,CAAC;QACnH,CAAC;QACD,MAAM,YAAY,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxF,6GAA6G;QAC7G,IAAI,QAAQ,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,EAAE,KAAK,KAAK,SAAS,IAAI,CAAC,YAAY,EAAE,CAAC;YAC9E,OAAO,UAAU,EAAE,CAAC;QACtB,CAAC;QAED,oHAAoH;QACpH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC;YACvF,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC;QACxF,CAAC;QACD,gHAAgH;QAChH,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3F,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/H,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,QAAQ;gBACX,OAAO,KAAK,CAAC;YACf,KAAK,OAAO;gBACV,OAAO,MAAM,CAAC,WAAW,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YACvF,KAAK,OAAO;gBACV,MAAM;QACV,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,cAAc,EAAE,CAAC,QAAQ,CAAC,cAAc,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC;QAChK,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;YACrC,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;QACnC,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1J,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;gBACtE,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC7D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;YACD,KAAK,SAAS;gBACZ,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClE,OAAO,KAAK,CAAC;YACf,KAAK,YAAY;gBACf,OAAO,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/mcp-out/state-party.d.ts

@@ -1,6 +1,6 @@
 import type { FleetId } from '@aeolus-fleet/common';
 import type { FleetRefusal } from '../connection/ports.js';
-import type { PartyStore } from '../parties/ports.js';
+import type { PartyStore, ScopeRequirementsStore } from '../parties/ports.js';
 import { type DomainError } from '../shared/errors.js';
 import { type Result } from '../shared/result.js';
 import type { McpServers } from './ports.js';
@@ -28,7 +28,7 @@ export type StateParty = (input: {
 /**
  * Use case: the gateway states what a party's proxy ship offers, as its
  * crew: the tools its server lists now that are switched on, with argo's
- * marks. The whole statement replaces the one before, so a tool the server
+ * marks and the scopes each tool needs now. The whole statement replaces the one before, so a tool the server
  * dropped or an approver switched off is gone. A party with no switches kept
  * keeps every tool it lists on first (aeolus-fleet#1151).
  */
@@ -37,5 +37,6 @@ export declare function createStateParty(deps: {
     servers: McpServers;
     door: StatementDoor;
     marks: ToolMarks;
+    requirements: ScopeRequirementsStore;
     timing: CallTiming;
 }): StateParty;

package/dist/core/mcp-out/state-party.js

@@ -5,7 +5,7 @@ import { statementOf } from './statement.js';
 /**
  * Use case: the gateway states what a party's proxy ship offers, as its
  * crew: the tools its server lists now that are switched on, with argo's
- * marks. The whole statement replaces the one before, so a tool the server
+ * marks and the scopes each tool needs now. The whole statement replaces the one before, so a tool the server
  * dropped or an approver switched off is gone. A party with no switches kept
  * keeps every tool it lists on first (aeolus-fleet#1151).
  */
@@ -26,7 +26,7 @@ export function createStateParty(deps) {
             await deps.parties.switchTools({ fleetId, name }, { listed: listed.value.map((tool) => tool.name), switched: new Map() });
         }
         const tools = listed.value.filter((tool) => isToolOn(party.toolSwitches, tool.name));
-        const statement = statementOf({ partyName: name, tools, repeatable: await deps.marks.repeatable(fleetId, name), timing: deps.timing });
+        const statement = statementOf({ partyName: name, tools, repeatable: await deps.marks.repeatable(fleetId, name), timing: deps.timing, requirements: await deps.requirements.find(fleetId, name) });
         const stated = await deps.door.setStatement(party.crewToken, statement);
         if (!stated.isOk) {
             return refuse('STATEMENT_REFUSED', `The fleet refused the statement: ${stated.error.message}`);

package/dist/core/mcp-out/state-party.js.map

@@ -1 +1 @@
-{"version":3,"file":"state-party.js","sourceRoot":"","sources":["../../../src/core/mcp-out/state-party.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvD,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAmC,MAAM,gBAAgB,CAAC;AAkB9E;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAA6G;IAC5I,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,IAAI,KAAK,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC,eAAe,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YACzD,OAAO,MAAM,CAAC,YAAY,EAAE,+CAA+C,IAAI,MAAM,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9F,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,oBAAoB,EAAE,qBAAqB,IAAI,yBAAyB,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QAC5H,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACrF,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACvI,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,mBAAmB,EAAE,oCAAoC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"state-party.js","sourceRoot":"","sources":["../../../src/core/mcp-out/state-party.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAC;AACvD,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAmC,MAAM,gBAAgB,CAAC;AAkB9E;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAmJ;IAClL,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,IAAI,KAAK,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO,MAAM,CAAC,eAAe,EAAE,kBAAkB,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YACzD,OAAO,MAAM,CAAC,YAAY,EAAE,+CAA+C,IAAI,MAAM,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9F,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,oBAAoB,EAAE,qBAAqB,IAAI,yBAAyB,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,IAAI,KAAK,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;QAC5H,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACrF,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAClM,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,MAAM,CAAC,mBAAmB,EAAE,oCAAoC,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/mcp-out/statement.d.ts

@@ -1,3 +1,12 @@
+/**
+ * A proxy ship's statement (decision 0047), written from its outside MCP
+ * server's `tools/list`: each tool is one capability, with MCP's fields as
+ * the server states them (decision 0048), the content types that call it
+ * and carry its result, argo's repeatable mark (interop 5.2), the
+ * gateway's own wait and deadline for a call (interop 3.4, 5.3), and the
+ * scopes a calling ship needs (gateway scopes P1).
+ */
+import { type ScopeRequirements } from '../parties/scope-requirements.js';
 import type { OutsideTool, ToolAnnotations } from './ports.js';
 export interface Capability {
     readonly name: string;
@@ -15,6 +24,8 @@ export interface Capability {
     readonly deadlineMs: number;
     /** argo's mark that a call may be handed again when it died unanswered; the server's hints never set it. */
     readonly repeatable?: true;
+    /** The scopes a calling ship must hold, every one, so it sees them before it calls (gateway scopes P1); none when it needs none. */
+    readonly scopes?: readonly string[];
 }
 export interface Statement {
     readonly summary: string;
@@ -25,6 +36,10 @@ export interface CallTiming {
     readonly waitMs: number;
     readonly deadlineMs: number;
 }
+/** The scopes field of a capability: stated only when a calling ship needs any. */
+export declare function scopesFieldOf(scopes: readonly string[]): {
+    scopes?: readonly string[];
+};
 /**
  * The statement of a party's proxy ship. Its summary names the party only:
  * the server's URL and credential stay in the gateway (NAT both ways).
@@ -34,4 +49,5 @@ export declare function statementOf(input: {
     tools: readonly OutsideTool[];
     repeatable: ReadonlySet<string>;
     timing: CallTiming;
+    requirements: ScopeRequirements;
 }): Statement;

package/dist/core/mcp-out/statement.js

@@ -2,10 +2,16 @@
  * A proxy ship's statement (decision 0047), written from its outside MCP
  * server's `tools/list`: each tool is one capability, with MCP's fields as
  * the server states them (decision 0048), the content types that call it
- * and carry its result, argo's repeatable mark (interop 5.2), and the
- * gateway's own wait and deadline for a call (interop 3.4, 5.3).
+ * and carry its result, argo's repeatable mark (interop 5.2), the
+ * gateway's own wait and deadline for a call (interop 3.4, 5.3), and the
+ * scopes a calling ship needs (gateway scopes P1).
  */
+import { scopesNeeded } from '../parties/scope-requirements.js';
 import { toolInputType, toolResultType } from './content-types.js';
+/** The scopes field of a capability: stated only when a calling ship needs any. */
+export function scopesFieldOf(scopes) {
+    return scopes.length === 0 ? {} : { scopes };
+}
 function capabilityOf(tool, marked) {
     return {
         name: tool.name,
@@ -19,6 +25,7 @@ function capabilityOf(tool, marked) {
         ...(marked.isRepeatable ? { repeatable: true } : {}),
         waitMs: marked.timing.waitMs,
         deadlineMs: marked.timing.deadlineMs,
+        ...scopesFieldOf(marked.scopes),
     };
 }
 /**
@@ -28,7 +35,7 @@ function capabilityOf(tool, marked) {
 export function statementOf(input) {
     return {
         summary: `${input.partyName}, an outside MCP server reached through the Aeolus gateway. Each capability is one of its tools: send its input type with the tool arguments as a JSON object, and the reply carries the tool result.`,
-        capabilities: input.tools.map((tool) => capabilityOf(tool, { isRepeatable: input.repeatable.has(tool.name), timing: input.timing })),
+        capabilities: input.tools.map((tool) => capabilityOf(tool, { isRepeatable: input.repeatable.has(tool.name), timing: input.timing, scopes: scopesNeeded(input.requirements, tool.name) })),
     };
 }
 //# sourceMappingURL=statement.js.map

package/dist/core/mcp-out/statement.js.map

@@ -1 +1 @@
-{"version":3,"file":"statement.js","sourceRoot":"","sources":["../../../src/core/mcp-out/statement.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAiCnE,SAAS,YAAY,CAAC,IAAiB,EAAE,MAAqD;IAC5F,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1D,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5E,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/E,UAAU,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,WAAW,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5E,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;QAC5B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;KACrC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAAgH;IAC1I,OAAO;QACL,OAAO,EAAE,GAAG,KAAK,CAAC,SAAS,uMAAuM;QAClO,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;KACrI,CAAC;AACJ,CAAC"}
+{"version":3,"file":"statement.js","sourceRoot":"","sources":["../../../src/core/mcp-out/statement.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,YAAY,EAA0B,MAAM,kCAAkC,CAAC;AACxF,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAmCnE,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,MAAyB;IACrD,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,YAAY,CAAC,IAAiB,EAAE,MAAgF;IACvH,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1D,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5E,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,GAAG,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;QAC/E,UAAU,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,WAAW,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,GAAG,CAAC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QAC5E,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;QAC5B,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU;QACpC,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC;KAChC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAAiJ;IAC3K,OAAO;QACL,OAAO,EAAE,GAAG,KAAK,CAAC,SAAS,uMAAuM;QAClO,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;KAC1L,CAAC;AACJ,CAAC"}

package/dist/core/operator/ports.d.ts

@@ -1,16 +1,16 @@
-import type { FleetId, Scope } from '@aeolus-fleet/common';
+import type { FleetId, ScopeName } from '@aeolus-fleet/common';
 import type { FleetRefusal } from '../connection/ports.js';
 import type { Result } from '../shared/result.js';
-/** A signed-in console session: argo's or a viewer's, with its ship's scopes, or an account's, with its account token's. */
+/** A signed-in console session: argo's or a viewer's, with its ship's scopes, or an account's, with its account token's; the fleet's own scopes among them (gateway scopes 4.1). */
 export type ConsoleSession = {
     fleetId: FleetId;
     kind: 'operator' | 'viewer';
-    scopes: readonly Scope[];
+    scopes: readonly ScopeName[];
 } | {
     fleetId: FleetId;
     kind: 'account';
     accountId: string;
-    scopes: readonly Scope[];
+    scopes: readonly ScopeName[];
 };
 /**
  * Outbound port: asks the fleet whose a forwarded console session cookie is

package/dist/core/parties/add-a2a-agent.js

@@ -25,7 +25,7 @@ export function createAddA2aAgent(deps) {
         if (!(await deps.servesOutsideParties(fleetId))) {
             return refuse('OUTSIDE_PARTIES_OFF', "This fleet's outside parties are off: turn them on first");
         }
-        const statement = await readAgentStatement(deps, { name, cardUrl, isRepeatable: true });
+        const statement = await readAgentStatement(deps, { name, cardUrl, isRepeatable: true, scopes: [] });
         if (!statement.isOk) {
             return statement;
         }

package/dist/core/parties/add-a2a-agent.js.map

@@ -1 +1 @@
-{"version":3,"file":"add-a2a-agent.js","sourceRoot":"","sources":["../../../src/core/parties/add-a2a-agent.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAExE,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAG/D,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,cAAc,EAA+C,MAAM,oBAAoB,CAAC;AAiBhI;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA8D;IAC9F,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE;QACtG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,iBAAiB,EAAE,qCAAqC,eAAe,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,gBAAgB,EAAE,2CAA2C,OAAO,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAC1B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAChD,OAAO,MAAM,CAAC,qBAAqB,EAAE,0DAA0D,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YACpB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACrI,OAAO,QAAQ,CAAgB,IAAI,EAAE;YACnC,OAAO;YACP,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,OAAO;YACf,WAAW;YACX,KAAK,EAAE,WAAW;YAClB,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;YAClL,KAAK,EAAE,CAAC,OAAO,EAA4B,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU;SAC1E,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"add-a2a-agent.js","sourceRoot":"","sources":["../../../src/core/parties/add-a2a-agent.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kBAAkB,EAAE,MAAM,oCAAoC,CAAC;AAExE,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAG/D,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACrF,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,cAAc,EAA+C,MAAM,oBAAoB,CAAC;AAiBhI;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAA8D;IAC9F,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE;QACtG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,iBAAiB,EAAE,qCAAqC,eAAe,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,gBAAgB,EAAE,2CAA2C,OAAO,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QAC1B,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YAChD,OAAO,MAAM,CAAC,qBAAqB,EAAE,0DAA0D,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YACpB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAC5E,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACrI,OAAO,QAAQ,CAAgB,IAAI,EAAE;YACnC,OAAO;YACP,IAAI,EAAE,mBAAmB;YACzB,MAAM,EAAE,OAAO;YACf,WAAW;YACX,KAAK,EAAE,WAAW;YAClB,KAAK,EAAE,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,cAAc,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;YAClL,KAAK,EAAE,CAAC,OAAO,EAA4B,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU;SAC1E,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/check-approving.d.ts

@@ -0,0 +1,36 @@
+import type { Actor } from '../actors/authenticate-actor.js';
+import type { ActorCredential, CredentialOf } from '../actors/credential-of.js';
+import type { ConnectionStore, GatewayCrew } from '../connection/ports.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { A2aAgentParty, McpServerParty } from './party.js';
+import type { PartyStore, ProxyShipsAsActor } from './ports.js';
+export type ApprovingRefusal = DomainError<'NOT_AN_APPROVER' | 'NO_SUCH_PARTY' | 'PARTY_NOT_COMMISSIONED' | 'NOT_CONNECTED' | 'FLEET_UNAVAILABLE' | 'NOT_REACHABLE'>;
+export type CheckApproving = (input: {
+    actor: Actor;
+    as: ActorCredential;
+    name: string;
+}) => Promise<Result<undefined, ApprovingRefusal>>;
+interface ApprovingDeps {
+    parties: PartyStore;
+    connections: Pick<ConnectionStore, 'find'>;
+    fleet: Pick<ProxyShipsAsActor, 'checkManage'>;
+    credentialOf: CredentialOf;
+}
+/**
+ * The outside MCP server or A2A agent an actor approves, with the gateway's
+ * connection: the actor holds gateway:approve, and the fleet, asked as the
+ * actor, answers that it manages the party's proxy ship (A2). The fleet
+ * records a refusal.
+ */
+export declare function approvedParty(deps: ApprovingDeps, { actor, as, name }: Parameters<CheckApproving>[0]): Promise<Result<{
+    party: McpServerParty | A2aAgentParty;
+    gateway: GatewayCrew;
+}, ApprovingRefusal>>;
+/**
+ * Use case: whether an actor approves an outside MCP server or A2A agent
+ * (gateway scopes 4.3): the party's page shows its controls only then, and
+ * the same table read-only otherwise.
+ */
+export declare function createCheckApproving(deps: ApprovingDeps): CheckApproving;
+export {};

package/dist/core/parties/check-approving.js

@@ -0,0 +1,48 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+import { APPROVING_SCOPE } from './approver.js';
+/**
+ * The outside MCP server or A2A agent an actor approves, with the gateway's
+ * connection: the actor holds gateway:approve, and the fleet, asked as the
+ * actor, answers that it manages the party's proxy ship (A2). The fleet
+ * records a refusal.
+ */
+export async function approvedParty(deps, { actor, as, name }) {
+    if (!actor.scopes.includes(APPROVING_SCOPE)) {
+        return refuse('NOT_AN_APPROVER', `Setting the scopes an outside party needs takes ${APPROVING_SCOPE}`);
+    }
+    const party = await deps.parties.find(actor.fleetId, name);
+    if (party?.kind !== 'mcpServer' && party?.kind !== 'a2aAgent') {
+        return refuse('NO_SUCH_PARTY', `There is no outside MCP server or A2A agent ${name}`);
+    }
+    if (party.proxyShipId === null) {
+        return refuse('PARTY_NOT_COMMISSIONED', `${name}'s proxy ship is not commissioned yet`);
+    }
+    const gateway = await deps.connections.find(actor.fleetId);
+    if (gateway === undefined) {
+        return refuse('NOT_CONNECTED', 'The gateway is not connected to the fleet');
+    }
+    const credential = await deps.credentialOf(actor, as);
+    if (!credential.isOk) {
+        return credential;
+    }
+    const managed = await deps.fleet.checkManage(credential.value, { shipId: party.proxyShipId });
+    if (!managed.isOk) {
+        return managed.error.code === 'UNAVAILABLE'
+            ? refuse('FLEET_UNAVAILABLE', `The fleet did not say whether you manage ${name}: ${managed.error.message}`)
+            : refuse('NOT_REACHABLE', managed.error.message);
+    }
+    return ok({ party, gateway });
+}
+/**
+ * Use case: whether an actor approves an outside MCP server or A2A agent
+ * (gateway scopes 4.3): the party's page shows its controls only then, and
+ * the same table read-only otherwise.
+ */
+export function createCheckApproving(deps) {
+    return async (input) => {
+        const approved = await approvedParty(deps, input);
+        return approved.isOk ? ok(undefined) : approved;
+    };
+}
+//# sourceMappingURL=check-approving.js.map

package/dist/core/parties/check-approving.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-approving.js","sourceRoot":"","sources":["../../../src/core/parties/check-approving.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAehD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAmB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAiC;IACzG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QAC5C,OAAO,MAAM,CAAC,iBAAiB,EAAE,mDAAmD,eAAe,EAAE,CAAC,CAAC;IACzG,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC3D,IAAI,KAAK,EAAE,IAAI,KAAK,WAAW,IAAI,KAAK,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;QAC9D,OAAO,MAAM,CAAC,eAAe,EAAE,+CAA+C,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,wBAAwB,EAAE,GAAG,IAAI,uCAAuC,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,eAAe,EAAE,2CAA2C,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;QACrB,OAAO,UAAU,CAAC;IACpB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9F,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAClB,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,aAAa;YACzC,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,4CAA4C,IAAI,KAAK,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAC3G,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;AAChC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAmB;IACtD,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAClD,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/check-required-scopes.d.ts

@@ -0,0 +1,34 @@
+import type { FleetId, ShipId } from '@aeolus-fleet/common';
+import type { ConnectionStore, FleetDoor } from '../connection/ports.js';
+/**
+ * How checking a call's scopes ended:
+ * - holds: the calling ship holds every needed scope, so the call goes on;
+ * - lacks: it does not, and the message names what is missing (P2);
+ * - unread: core did not answer the read, so the call waits and is tried again, never made unchecked.
+ */
+export type ScopeCheck = {
+    readonly kind: 'holds';
+} | {
+    readonly kind: 'lacks';
+    readonly message: string;
+} | {
+    readonly kind: 'unread';
+};
+export type CheckRequiredScopes = (call: {
+    fleetId: FleetId;
+    senderShipId: ShipId;
+    needing: string;
+    needed: readonly string[];
+}) => Promise<ScopeCheck>;
+/**
+ * Use case: whether the ship calling an outside party holds every scope the
+ * call needs (design gateway-scopes, 4.2). The gateway reads the ship's
+ * scopes from core as its own ship, on the calling ship's behalf so its read
+ * reach holds it, on every call and never from the message (decision 0057):
+ * a scope revoked holds at the next call (0046). A call that needs nothing
+ * reads nothing.
+ */
+export declare function createCheckRequiredScopes(deps: {
+    connections: Pick<ConnectionStore, 'find'>;
+    door: Pick<FleetDoor, 'getShip'>;
+}): CheckRequiredScopes;

package/dist/core/parties/check-required-scopes.js

@@ -0,0 +1,27 @@
+import { lackingScopesMessage, scopesLacking } from './scope-requirements.js';
+/**
+ * Use case: whether the ship calling an outside party holds every scope the
+ * call needs (design gateway-scopes, 4.2). The gateway reads the ship's
+ * scopes from core as its own ship, on the calling ship's behalf so its read
+ * reach holds it, on every call and never from the message (decision 0057):
+ * a scope revoked holds at the next call (0046). A call that needs nothing
+ * reads nothing.
+ */
+export function createCheckRequiredScopes(deps) {
+    return async ({ fleetId, senderShipId, needing, needed }) => {
+        if (needed.length === 0) {
+            return { kind: 'holds' };
+        }
+        const gateway = await deps.connections.find(fleetId);
+        if (gateway === undefined) {
+            return { kind: 'unread' };
+        }
+        const ship = await deps.door.getShip(gateway.crewToken, { shipId: senderShipId, onBehalfOf: senderShipId });
+        if (!ship.isOk) {
+            return { kind: 'unread' };
+        }
+        const lacking = scopesLacking(needed, ship.value.scopes);
+        return lacking.length === 0 ? { kind: 'holds' } : { kind: 'lacks', message: lackingScopesMessage({ needing, lacking, shipName: ship.value.name }) };
+    };
+}
+//# sourceMappingURL=check-required-scopes.js.map

package/dist/core/parties/check-required-scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-required-scopes.js","sourceRoot":"","sources":["../../../src/core/parties/check-required-scopes.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,oBAAoB,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAY9E;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAsF;IAC9H,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE;QAC1D,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC,CAAC;QAC5G,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YACf,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACzD,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,oBAAoB,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;IACtJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/ports.d.ts

@@ -3,6 +3,7 @@ import type { ActorCredential } from '../actors/credential-of.js';
 import type { FleetRefusal } from '../connection/ports.js';
 import type { Result } from '../shared/result.js';
 import type { Party } from './party.js';
+import type { ScopeRequirements, ScopeRequirementsChange } from './scope-requirements.js';
 import type { FromFleet } from './shown-party.js';
 import type { ToolSwitches } from './tool-switches.js';
 /** Outbound port: the parties argo approved, one per proxy ship name in a fleet. */
@@ -29,6 +30,22 @@ export interface PartyStore {
     }): Promise<void>;
     remove(fleetId: FleetId, name: string): Promise<void>;
 }
+/** Outbound port: each party's required scopes (design gateway-scopes, 4.2), kept with the party and gone with it. */
+export interface ScopeRequirementsStore {
+    /** The party's requirements as they are now; none set yet is version 0, needing nothing. */
+    find(fleetId: FleetId, party: string): Promise<ScopeRequirements>;
+    /**
+     * Makes the change, all at once and only while the requirements are still
+     * at the version named: the requirements after, at the next version; none
+     * once another change moved them on.
+     */
+    change(party: {
+        fleetId: FleetId;
+        name: string;
+    }, change: ScopeRequirementsChange & {
+        version: number;
+    }): Promise<ScopeRequirements | undefined>;
+}
 /** Outbound port: the fleet's calls the gateway makes for a party's proxy ship. */
 export interface ProxyShipDoor {
     /**
@@ -79,6 +96,10 @@ export interface ProxyShipsAsActor {
     }): Promise<Result<{
         scopes: string[];
     }, FleetRefusal>>;
+    /** Whether the actor manages the proxy ship now (fleet.checkManage, no scope): OK, or the fleet's refusal, which it records. */
+    checkManage(as: ActorCredential, ship: {
+        shipId: ShipId;
+    }): Promise<Result<undefined, FleetRefusal>>;
 }
 /** Outbound port: what the fleet holds for a proxy ship, read as the actor (fleet:read): its name, owner and scopes, only its name outside the actor's read reach. */
 export interface ProxyShipReads {

package/dist/core/parties/read-listed-scopes.d.ts

@@ -0,0 +1,17 @@
+import type { Actor } from '../actors/authenticate-actor.js';
+import type { ConnectionStore, FleetDoor, ListedScope } from '../connection/ports.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+export type ReadListedScopes = (input: {
+    actor: Actor;
+}) => Promise<Result<ListedScope[], DomainError<'NOT_AN_APPROVER' | 'NOT_CONNECTED' | 'FLEET_UNAVAILABLE'>>>;
+/**
+ * Use case: the scopes an approver may require of a calling ship (gateway
+ * scopes 4.3), every one the fleet lists now with its description, read as
+ * the gateway's ship as the change itself checks them. Only an approver
+ * picks them, so only an approver reads them.
+ */
+export declare function createReadListedScopes(deps: {
+    connections: Pick<ConnectionStore, 'find'>;
+    door: Pick<FleetDoor, 'listScopes'>;
+}): ReadListedScopes;

package/dist/core/parties/read-listed-scopes.js

@@ -0,0 +1,23 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+import { APPROVING_SCOPE } from './approver.js';
+/**
+ * Use case: the scopes an approver may require of a calling ship (gateway
+ * scopes 4.3), every one the fleet lists now with its description, read as
+ * the gateway's ship as the change itself checks them. Only an approver
+ * picks them, so only an approver reads them.
+ */
+export function createReadListedScopes(deps) {
+    return async ({ actor }) => {
+        if (!actor.scopes.includes(APPROVING_SCOPE)) {
+            return refuse('NOT_AN_APPROVER', `Reading the scopes to require takes ${APPROVING_SCOPE}`);
+        }
+        const gateway = await deps.connections.find(actor.fleetId);
+        if (gateway === undefined) {
+            return refuse('NOT_CONNECTED', 'The gateway is not connected to the fleet');
+        }
+        const listed = await deps.door.listScopes(gateway.crewToken);
+        return listed.isOk ? ok(listed.value) : refuse('FLEET_UNAVAILABLE', `The fleet did not say which scopes it lists: ${listed.error.message}`);
+    };
+}
+//# sourceMappingURL=read-listed-scopes.js.map

package/dist/core/parties/read-listed-scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-listed-scopes.js","sourceRoot":"","sources":["../../../src/core/parties/read-listed-scopes.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAIhD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAyF;IAC9H,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QACzB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,iBAAiB,EAAE,uCAAuC,eAAe,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC3D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,eAAe,EAAE,2CAA2C,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,EAAE,gDAAgD,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9I,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/read-scope-requirements.d.ts

@@ -0,0 +1,18 @@
+import type { FleetId } from '@aeolus-fleet/common';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { PartyStore, ScopeRequirementsStore } from './ports.js';
+import type { ScopeRequirements } from './scope-requirements.js';
+export type ReadScopeRequirements = (input: {
+    fleetId: FleetId;
+    name: string;
+}) => Promise<Result<ScopeRequirements, DomainError<'NO_SUCH_PARTY'>>>;
+/**
+ * Use case: which scopes an outside MCP server or A2A agent needs, and the
+ * version an approver changes them on (design gateway-scopes, 4.2). Anyone
+ * in the fleet reads them, as its tools are read.
+ */
+export declare function createReadScopeRequirements(deps: {
+    parties: PartyStore;
+    requirements: ScopeRequirementsStore;
+}): ReadScopeRequirements;

package/dist/core/parties/read-scope-requirements.js

@@ -0,0 +1,17 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+/**
+ * Use case: which scopes an outside MCP server or A2A agent needs, and the
+ * version an approver changes them on (design gateway-scopes, 4.2). Anyone
+ * in the fleet reads them, as its tools are read.
+ */
+export function createReadScopeRequirements(deps) {
+    return async ({ fleetId, name }) => {
+        const party = await deps.parties.find(fleetId, name);
+        if (party?.kind !== 'mcpServer' && party?.kind !== 'a2aAgent') {
+            return refuse('NO_SUCH_PARTY', `There is no outside MCP server or A2A agent ${name}`);
+        }
+        return ok(await deps.requirements.find(fleetId, name));
+    };
+}
+//# sourceMappingURL=read-scope-requirements.js.map

package/dist/core/parties/read-scope-requirements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-scope-requirements.js","sourceRoot":"","sources":["../../../src/core/parties/read-scope-requirements.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAMtD;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAmE;IAC7G,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACrD,IAAI,KAAK,EAAE,IAAI,KAAK,WAAW,IAAI,KAAK,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9D,OAAO,MAAM,CAAC,eAAe,EAAE,+CAA+C,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,EAAE,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/parties/scope-requirements.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Which scopes a calling ship must hold to use an outside party (design
+ * gateway-scopes, 4.2): a set for the party as a whole, and for an outside
+ * MCP server a set per tool. A tool needs both sets, every scope in them
+ * (A5). A scope says what a ship may do; which party it reaches stays the
+ * network rules' (L1). Kept by scope text and tool name, never by a ship.
+ */
+/** A party's required scopes, and the version they were changed to last, so two approvers never overwrite each other unseen. */
+export interface ScopeRequirements {
+    readonly version: number;
+    /** What every call to the party needs; an A2A agent has only this set, as its messages name no tool (L26). */
+    readonly party: readonly string[];
+    /** What each tool needs beside the party's set, by tool name; a tool not named needs only the party's. */
+    readonly tools: ReadonlyMap<string, readonly string[]>;
+}
+/** A party with nothing required: every call needs only to reach it. */
+export declare const NO_SCOPE_REQUIREMENTS: ScopeRequirements;
+/** A change to a party's requirements: its own set when given, and each tool's set given, an empty one dropping the tool's. */
+export interface ScopeRequirementsChange {
+    readonly party?: readonly string[];
+    readonly tools: ReadonlyMap<string, readonly string[]>;
+}
+/** The requirements after a change, at the next version. */
+export declare function changedRequirements(kept: ScopeRequirements, change: ScopeRequirementsChange): ScopeRequirements;
+/** Every scope a call needs: the party's set and the tool's own, each once; a party called as a whole (no tool) needs its set alone. */
+export declare function scopesNeeded(requirements: ScopeRequirements, tool: string | null): string[];
+/** The needed scopes the calling ship does not hold. */
+export declare function scopesLacking(needed: readonly string[], held: readonly string[]): string[];
+/** A refusal naming what is missing (P2): "update_lead needs crm:write-leads, which lead-scout does not hold". */
+export declare function lackingScopesMessage(refused: {
+    needing: string;
+    lacking: readonly string[];
+    shipName: string;
+}): string;

package/dist/core/parties/scope-requirements.js

@@ -0,0 +1,37 @@
+/**
+ * Which scopes a calling ship must hold to use an outside party (design
+ * gateway-scopes, 4.2): a set for the party as a whole, and for an outside
+ * MCP server a set per tool. A tool needs both sets, every scope in them
+ * (A5). A scope says what a ship may do; which party it reaches stays the
+ * network rules' (L1). Kept by scope text and tool name, never by a ship.
+ */
+/** A party with nothing required: every call needs only to reach it. */
+export const NO_SCOPE_REQUIREMENTS = { version: 0, party: [], tools: new Map() };
+/** The requirements after a change, at the next version. */
+export function changedRequirements(kept, change) {
+    const tools = new Map(kept.tools);
+    for (const [tool, scopes] of change.tools) {
+        if (scopes.length === 0) {
+            tools.delete(tool);
+        }
+        else {
+            tools.set(tool, scopes);
+        }
+    }
+    return { version: kept.version + 1, party: change.party ?? kept.party, tools };
+}
+/** Every scope a call needs: the party's set and the tool's own, each once; a party called as a whole (no tool) needs its set alone. */
+export function scopesNeeded(requirements, tool) {
+    const own = tool === null ? [] : (requirements.tools.get(tool) ?? []);
+    return [...new Set([...requirements.party, ...own])];
+}
+/** The needed scopes the calling ship does not hold. */
+export function scopesLacking(needed, held) {
+    return needed.filter((scope) => !held.includes(scope));
+}
+/** A refusal naming what is missing (P2): "update_lead needs crm:write-leads, which lead-scout does not hold". */
+export function lackingScopesMessage(refused) {
+    const scopes = refused.lacking.length === 1 ? refused.lacking.join('') : `${refused.lacking.slice(0, -1).join(', ')} and ${refused.lacking.at(-1) ?? ''}`;
+    return `${refused.needing} needs ${scopes}, which ${refused.shipName} does not hold`;
+}
+//# sourceMappingURL=scope-requirements.js.map

package/dist/core/parties/scope-requirements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scope-requirements.js","sourceRoot":"","sources":["../../../src/core/parties/scope-requirements.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAWH,wEAAwE;AACxE,MAAM,CAAC,MAAM,qBAAqB,GAAsB,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;AAQpG,4DAA4D;AAC5D,MAAM,UAAU,mBAAmB,CAAC,IAAuB,EAAE,MAA+B;IAC1F,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAC1C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;AACjF,CAAC;AAED,wIAAwI;AACxI,MAAM,UAAU,YAAY,CAAC,YAA+B,EAAE,IAAmB;IAC/E,MAAM,GAAG,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACtE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,aAAa,CAAC,MAAyB,EAAE,IAAuB;IAC9E,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,kHAAkH;AAClH,MAAM,UAAU,oBAAoB,CAAC,OAA0E;IAC7G,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;IAC1J,OAAO,GAAG,OAAO,CAAC,OAAO,UAAU,MAAM,WAAW,OAAO,CAAC,QAAQ,gBAAgB,CAAC;AACvF,CAAC"}