@aeolus-fleet/core 0.0.0 → 0.18.0

package/dist/domain/identity/ports.d.ts

@@ -0,0 +1,193 @@
+import type { ConsoleSessionId, CredentialId, FleetId, LeaseId, OperatorId, ShipId, Theme } from '@aeolus-fleet/common';
+import type { Caller, Crew } from '../shared/caller.js';
+import type { ConsoleSession, ConsoleSessionEndReason } from './console-session.js';
+import type { Credential } from './credential.js';
+import type { Guide, GuideProgress } from './guide.js';
+import type { Notice } from './notice.js';
+import type { OperatorAccount } from './operator-account.js';
+import type { SignInAs, SignInTicket } from './sign-in-ticket.js';
+/** The ship a crew token or a console session token belongs to, as the caller it makes. */
+export type AuthenticatedShip = Omit<Caller, 'consoleSessionId'>;
+/** The ship a crew token crews, and the open lease the token belongs to. */
+export type AuthenticatedCrew = AuthenticatedShip & {
+    leaseId: LeaseId;
+};
+/** The lease a crew token belongs to, as the lookup finds it: open, with the crew it makes the caller, or ended. */
+export type CrewTokenLease = {
+    isOpen: true;
+    crew: AuthenticatedCrew;
+} | {
+    isOpen: false;
+};
+/**
+ * Outbound port: ship secrets.
+ *
+ * Lock order, so concurrent sign-ins, sign-outs, claims, starting prompts and
+ * password resets never deadlock: the ship when the use case locks it, then a
+ * credential or the operator account, then console sessions, then leases.
+ */
+export interface CredentialRepository {
+    create(credential: Credential): Promise<void>;
+    /**
+     * The valid credential with this hash, locked until the unit of work ends.
+     * Not scoped by fleet: a secret carries no fleet, and its hash is unique
+     * across all fleets (ADR 0007).
+     */
+    findValidBySecretHashForUpdate(secretHash: string): Promise<Credential | undefined>;
+    /** The ship's valid credential, locked until the unit of work ends. */
+    findValidForShipForUpdate(fleetId: FleetId, shipId: ShipId): Promise<Credential | undefined>;
+    markClaimed(change: {
+        fleetId: FleetId;
+        credentialId: CredentialId;
+        at: Date;
+    }): Promise<void>;
+    invalidate(change: {
+        fleetId: FleetId;
+        credentialId: CredentialId;
+        at: Date;
+    }): Promise<void>;
+}
+/**
+ * Outbound port: finds the operator account by its normalised email outside
+ * any unit of work, so checking a password holds no row and no connection.
+ * One query, not scoped by fleet: signing in names no fleet (ADR 0007).
+ */
+export interface OperatorAccountLookup {
+    byEmail(email: string): Promise<OperatorAccount | undefined>;
+}
+/** Outbound port: the operator account. */
+export interface OperatorAccountRepository {
+    create(account: OperatorAccount): Promise<void>;
+    /**
+     * Holds the lock on this normalised email until the unit of work ends, so
+     * two fleets created at once never both take it.
+     */
+    lockEmail(email: string): Promise<void>;
+    /**
+     * The account with this normalised email, locked until the unit of work
+     * ends. Not scoped by fleet: signing in names no fleet, and the email is
+     * unique across all fleets (ADR 0007).
+     */
+    findByEmailForUpdate(email: string): Promise<OperatorAccount | undefined>;
+    /** The fleet's operator account, locked until the unit of work ends. */
+    findForFleetForUpdate(fleetId: FleetId): Promise<OperatorAccount | undefined>;
+    changePassword(change: {
+        fleetId: FleetId;
+        operatorId: OperatorId;
+        passwordHash: string;
+    }): Promise<void>;
+    /** The fleet's operator account, read without a lock. */
+    findForFleet(fleetId: FleetId): Promise<OperatorAccount | undefined>;
+    setTheme(change: {
+        fleetId: FleetId;
+        operatorId: OperatorId;
+        theme: Theme;
+    }): Promise<void>;
+}
+/** Outbound port: sign-in tickets, found by their hash before the fleet is known (ADR 0007). */
+export interface SignInTicketRepository {
+    create(ticket: SignInTicket): Promise<void>;
+    /**
+     * Marks the ticket with this hash used and answers its fleet and whom it
+     * signs in as, when it is unused and not expired at `at`; undefined
+     * otherwise. At most one redeem of a ticket ever answers, however many run
+     * at once.
+     */
+    redeem(tokenHash: string, at: Date): Promise<{
+        fleetId: FleetId;
+        as: SignInAs;
+    } | undefined>;
+}
+/** Outbound port: console sessions, always within one fleet. */
+export interface ConsoleSessionRepository {
+    create(session: ConsoleSession): Promise<void>;
+    /** The session, read without a lock. */
+    find(fleetId: FleetId, consoleSessionId: ConsoleSessionId): Promise<ConsoleSession | undefined>;
+    /** Ends the session if it has not ended and returns it; undefined when it had already ended. */
+    end(change: {
+        fleetId: FleetId;
+        consoleSessionId: ConsoleSessionId;
+        at: Date;
+        reason: ConsoleSessionEndReason;
+    }): Promise<ConsoleSession | undefined>;
+    /** Ends every session of the ship that has not ended, expired ones included, and returns them. */
+    endAll(of: {
+        fleetId: FleetId;
+        shipId: ShipId;
+    }, ending: {
+        at: Date;
+        reason: ConsoleSessionEndReason;
+    }): Promise<ConsoleSession[]>;
+}
+/**
+ * Outbound port: who is calling. Each lookup is one query that returns the
+ * ship, its fleet, kind and scopes, and is not scoped by fleet, because a
+ * token carries no fleet (ADR 0007).
+ */
+export interface CallerLookup {
+    /**
+     * The lease that holds this crew token hash, open or ended; undefined when
+     * no lease of a ship that is not retired ever held it. An open lease is
+     * marked seen `at`: every call by its crew shows the ship alive. Observation
+     * only (ADR 0016): nothing acts on it.
+     */
+    byCrewTokenHash(crewTokenHash: string, seen: {
+        at: Date;
+    }): Promise<CrewTokenLease | undefined>;
+    /**
+     * The caller of the console session with this token hash, when the session
+     * has not ended and expires after `now`: argo, crewed under the lease the
+     * session holds, or the viewer ship, without a lease. Using it moves its
+     * last use to `now` and its expiry to its idle limit after `now`, never
+     * past the moment it ends by, and marks argo's lease seen `now`. Answers
+     * the new expiry.
+     */
+    useConsoleSession(use: {
+        tokenHash: string;
+        now: Date;
+    }): Promise<{
+        caller: Caller | Crew;
+        expiresAt: Date;
+    } | undefined>;
+    /** Why the console session with this token hash ended; undefined when it has not, or no session has the hash. */
+    consoleSessionEnding(tokenHash: string): Promise<ConsoleSessionEndReason | undefined>;
+}
+/** Outbound port: the installation's notices (decision 0023), kept in its order; they belong to no fleet. */
+export interface NoticeRepository {
+    read(): Promise<Notice[]>;
+    /** Replaces every notice with these, in this order. */
+    replace(notices: readonly Notice[]): Promise<void>;
+}
+/** Outbound port: the notices each console session dismissed, by notice id; they go with the session's fleet. */
+export interface NoticeDismissals {
+    dismissed(of: {
+        fleetId: FleetId;
+        consoleSessionId: ConsoleSessionId;
+    }): Promise<string[]>;
+    /** Records the dismissal; one already recorded stays as it was. */
+    dismiss(dismissal: {
+        fleetId: FleetId;
+        consoleSessionId: ConsoleSessionId;
+        noticeId: string;
+        at: Date;
+    }): Promise<void>;
+}
+/** Outbound port: the installation's guide (decision 0024), one or none; it belongs to no fleet. */
+export interface GuideRepository {
+    read(): Promise<Guide | null>;
+    /** Replaces the guide with this one; null clears it. */
+    replace(guide: Guide | null): Promise<void>;
+}
+/** Outbound port: where each console session is in the guide; it goes with the session's fleet. */
+export interface GuideProgressRepository {
+    progress(of: {
+        fleetId: FleetId;
+        consoleSessionId: ConsoleSessionId;
+    }): Promise<GuideProgress | null>;
+    /** Records the session's progress over any it recorded before. */
+    record(progress: {
+        fleetId: FleetId;
+        consoleSessionId: ConsoleSessionId;
+        at: Date;
+    } & GuideProgress): Promise<void>;
+}

package/dist/domain/identity/ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/domain/identity/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../src/domain/identity/ports.ts"],"names":[],"mappings":""}

package/dist/domain/identity/public.d.ts

@@ -0,0 +1,3 @@
+export { findValidShipSecret, issueShipSecret, markShipSecretClaimed, revokeShipSecret, SHIP_SECRET_PREFIX, type Credential, type CredentialTx, type SecretTools, } from './credential.js';
+export { operatorEmail, operatorPassword } from './operator-account.js';
+export type { CredentialRepository, OperatorAccountRepository } from './ports.js';

package/dist/domain/identity/public.js

@@ -0,0 +1,5 @@
+// Identity's published surface: what other contexts may use. Use cases are not
+// part of it; adapters import them from their own modules.
+export { findValidShipSecret, issueShipSecret, markShipSecretClaimed, revokeShipSecret, SHIP_SECRET_PREFIX, } from './credential.js';
+export { operatorEmail, operatorPassword } from './operator-account.js';
+//# sourceMappingURL=public.js.map

package/dist/domain/identity/public.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public.js","sourceRoot":"","sources":["../../../src/domain/identity/public.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,2DAA2D;AAC3D,OAAO,EACL,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,gBAAgB,EAChB,kBAAkB,GAInB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/domain/identity/read-account.d.ts

@@ -0,0 +1,35 @@
+import type { Theme } from '@aeolus-fleet/common';
+import type { Caller } from '../shared/caller.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { UnitOfWork } from '../shared/unit-of-work.js';
+import type { ConsoleSessionRepository, OperatorAccountRepository } from './ports.js';
+export interface ReadAccountTx {
+    operatorAccounts: Pick<OperatorAccountRepository, 'findForFleet'>;
+    consoleSessions: Pick<ConsoleSessionRepository, 'find'>;
+}
+/** This console session: the device it signed in from, and since when. */
+interface SessionView {
+    device: string;
+    since: Date;
+}
+/** The operator's account with this session, or a viewer's session alone: a viewer has no email and no theme (decision 0022). */
+export type AccountView = {
+    kind: 'operator';
+    email: string;
+    theme: Theme;
+    session: SessionView;
+} | {
+    kind: 'viewer';
+    session: SessionView;
+};
+export type ReadAccount = (caller: Caller) => Promise<Result<AccountView, DomainError<'NOT_THE_OPERATOR_SHIP'>>>;
+/**
+ * Use case: the signed-in operator's account, for the AccountMenu: their
+ * email, their theme, and this console session; for a viewer session, the
+ * session alone. Only a console session has one; any other caller is refused.
+ */
+export declare function createReadAccount(deps: {
+    uow: UnitOfWork<ReadAccountTx>;
+}): ReadAccount;
+export {};

package/dist/domain/identity/read-account.js

@@ -0,0 +1,27 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+/**
+ * Use case: the signed-in operator's account, for the AccountMenu: their
+ * email, their theme, and this console session; for a viewer session, the
+ * session alone. Only a console session has one; any other caller is refused.
+ */
+export function createReadAccount(deps) {
+    return (caller) => deps.uow.run(async (tx) => {
+        const { consoleSessionId } = caller;
+        const session = consoleSessionId && (await tx.consoleSessions.find(caller.fleetId, consoleSessionId));
+        if (session && caller.kind === 'viewer') {
+            return ok({ kind: 'viewer', session: { device: session.device, since: session.createdAt } });
+        }
+        const account = session && (await tx.operatorAccounts.findForFleet(caller.fleetId));
+        if (!session || !account) {
+            return refuse('NOT_THE_OPERATOR_SHIP', 'Only the operator, signed in to the console, has an account');
+        }
+        return ok({
+            kind: 'operator',
+            email: account.email,
+            theme: account.theme,
+            session: { device: session.device, since: session.createdAt },
+        });
+    });
+}
+//# sourceMappingURL=read-account.js.map

package/dist/domain/identity/read-account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-account.js","sourceRoot":"","sources":["../../../src/domain/identity/read-account.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAoBtD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAwC;IACxE,OAAO,CAAC,MAAM,EAAE,EAAE,CAChB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAsE,EAAE;QAC5F,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;QACpC,MAAM,OAAO,GAAG,gBAAgB,IAAI,CAAC,MAAM,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACtG,IAAI,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,gBAAgB,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC,uBAAuB,EAAE,6DAA6D,CAAC,CAAC;QACxG,CAAC;QACD,OAAO,EAAE,CAAC;YACR,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE;SAC9D,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/domain/identity/read-guide.d.ts

@@ -0,0 +1,18 @@
+import type { Caller } from '../shared/caller.js';
+import { type GuideProgress, type GuideStep } from './guide.js';
+import type { GuideProgressRepository, GuideRepository } from './ports.js';
+export type ReadGuide = (caller: Caller) => Promise<{
+    steps: readonly GuideStep[];
+    progress: GuideProgress;
+} | null>;
+/**
+ * Use case: the guide a console session shows (decision 0024): the
+ * installation's, when it is for the session's audience, with where the
+ * session is in it; open at the first step until the session moves. A step
+ * past the end of a guide set shorter since reads as its last step. None
+ * without a console session.
+ */
+export declare function createReadGuide(deps: {
+    guide: GuideRepository;
+    progress: GuideProgressRepository;
+}): ReadGuide;

package/dist/domain/identity/read-guide.js

@@ -0,0 +1,21 @@
+import { NOT_STARTED } from './guide.js';
+import { isForSessionOf } from './notice.js';
+/**
+ * Use case: the guide a console session shows (decision 0024): the
+ * installation's, when it is for the session's audience, with where the
+ * session is in it; open at the first step until the session moves. A step
+ * past the end of a guide set shorter since reads as its last step. None
+ * without a console session.
+ */
+export function createReadGuide(deps) {
+    return async (caller) => {
+        const { consoleSessionId } = caller;
+        const guide = await deps.guide.read();
+        if (consoleSessionId === undefined || guide === null || !isForSessionOf(guide, caller.kind)) {
+            return null;
+        }
+        const progress = (await deps.progress.progress({ fleetId: caller.fleetId, consoleSessionId })) ?? NOT_STARTED;
+        return { steps: guide.steps, progress: { ...progress, step: Math.min(progress.step, guide.steps.length - 1) } };
+    };
+}
+//# sourceMappingURL=read-guide.js.map

package/dist/domain/identity/read-guide.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-guide.js","sourceRoot":"","sources":["../../../src/domain/identity/read-guide.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAsC,MAAM,YAAY,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAK7C;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,IAAmE;IACjG,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE;QACtB,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;QACpC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,gBAAgB,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5F,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC,IAAI,WAAW,CAAC;QAC9G,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC;IAClH,CAAC,CAAC;AACJ,CAAC"}

package/dist/domain/identity/read-notices.d.ts

@@ -0,0 +1,13 @@
+import type { Caller } from '../shared/caller.js';
+import { type Notice } from './notice.js';
+import type { NoticeDismissals, NoticeRepository } from './ports.js';
+export type ReadNotices = (caller: Caller) => Promise<Notice[]>;
+/**
+ * Use case: the notices a console session shows above every page (decision
+ * 0023): those of its audience, in the installation's order, less the
+ * dismissible ones it dismissed. A caller without a console session reads none.
+ */
+export declare function createReadNotices(deps: {
+    notices: NoticeRepository;
+    dismissals: NoticeDismissals;
+}): ReadNotices;

package/dist/domain/identity/read-notices.js

@@ -0,0 +1,17 @@
+import { isForSessionOf } from './notice.js';
+/**
+ * Use case: the notices a console session shows above every page (decision
+ * 0023): those of its audience, in the installation's order, less the
+ * dismissible ones it dismissed. A caller without a console session reads none.
+ */
+export function createReadNotices(deps) {
+    return async (caller) => {
+        const { consoleSessionId } = caller;
+        if (consoleSessionId === undefined) {
+            return [];
+        }
+        const [notices, dismissed] = await Promise.all([deps.notices.read(), deps.dismissals.dismissed({ fleetId: caller.fleetId, consoleSessionId })]);
+        return notices.filter((notice) => isForSessionOf(notice, caller.kind) && !(notice.isDismissible && dismissed.includes(notice.id)));
+    };
+}
+//# sourceMappingURL=read-notices.js.map

package/dist/domain/identity/read-notices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-notices.js","sourceRoot":"","sources":["../../../src/domain/identity/read-notices.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAe,MAAM,aAAa,CAAC;AAK1D;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAiE;IACjG,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE;QACtB,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;QACpC,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC;QAChJ,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrI,CAAC,CAAC;AACJ,CAAC"}

package/dist/domain/identity/record-guide-progress.d.ts

@@ -0,0 +1,19 @@
+import type { Caller } from '../shared/caller.js';
+import type { Clock } from '../shared/clock.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { GuideProgress } from './guide.js';
+import type { GuideProgressRepository, GuideRepository } from './ports.js';
+export type RecordGuideProgressRefusal = DomainError<'GUIDE_NOT_FOUND' | 'GUIDE_STEP_NOT_FOUND'>;
+export type RecordGuideProgress = (caller: Caller, progress: GuideProgress) => Promise<Result<undefined, RecordGuideProgressRefusal>>;
+/**
+ * Use case: a console session records where it is in the guide, for itself
+ * only (decision 0024): open at a step, skipped or finished; open at the
+ * first step again is Take the tour. No event: the guide is how the console
+ * looks, not a change to the fleet.
+ */
+export declare function createRecordGuideProgress(deps: {
+    guide: GuideRepository;
+    progress: GuideProgressRepository;
+    clock: Clock;
+}): RecordGuideProgress;

package/dist/domain/identity/record-guide-progress.js

@@ -0,0 +1,24 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+import { isForSessionOf } from './notice.js';
+/**
+ * Use case: a console session records where it is in the guide, for itself
+ * only (decision 0024): open at a step, skipped or finished; open at the
+ * first step again is Take the tour. No event: the guide is how the console
+ * looks, not a change to the fleet.
+ */
+export function createRecordGuideProgress(deps) {
+    return async (caller, { step, state }) => {
+        const { consoleSessionId } = caller;
+        const guide = await deps.guide.read();
+        if (consoleSessionId === undefined || guide === null || !isForSessionOf(guide, caller.kind)) {
+            return refuse('GUIDE_NOT_FOUND', 'No guide shows in this console session');
+        }
+        if (step >= guide.steps.length) {
+            return refuse('GUIDE_STEP_NOT_FOUND', `The guide has ${String(guide.steps.length)} steps, so no step ${String(step + 1)}`);
+        }
+        await deps.progress.record({ fleetId: caller.fleetId, consoleSessionId, step, state, at: deps.clock.now() });
+        return ok(undefined);
+    };
+}
+//# sourceMappingURL=record-guide-progress.js.map

package/dist/domain/identity/record-guide-progress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"record-guide-progress.js","sourceRoot":"","sources":["../../../src/domain/identity/record-guide-progress.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAO7C;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAiF;IACzH,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE;QACvC,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;QACpC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,gBAAgB,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5F,OAAO,MAAM,CAAC,iBAAiB,EAAE,wCAAwC,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC/B,OAAO,MAAM,CAAC,sBAAsB,EAAE,iBAAiB,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,sBAAsB,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7H,CAAC;QACD,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7G,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC"}

package/dist/domain/identity/redeem-sign-in-ticket.d.ts

@@ -0,0 +1,34 @@
+import type { IdGenerator } from '@aeolus-fleet/common';
+import type { Clock } from '../shared/clock.js';
+import { type DomainError } from '../shared/errors.js';
+import type { Result } from '../shared/result.js';
+import type { RandomTokens, SecretHasher } from '../shared/secrets.js';
+import type { UnitOfWork } from '../shared/unit-of-work.js';
+import type { SignInTicketRepository } from './ports.js';
+import type { SignedIn } from './sign-in.js';
+import { type StartConsoleSessionTx } from './start-console-session.js';
+import { type StartViewerSessionTx } from './start-viewer-session.js';
+export interface RedeemSignInTicketTx extends StartConsoleSessionTx, StartViewerSessionTx {
+    signInTickets: SignInTicketRepository;
+}
+export type RedeemSignInTicketRefusal = DomainError<'SIGN_IN_TICKET_INVALID' | 'FLEET_NOT_FOUND' | 'NOT_THE_OPERATOR_SHIP' | 'FLEET_HAS_NO_VIEWER'>;
+export type RedeemSignInTicket = (input: {
+    ticket: string;
+    /** The device it signs in from, as the console words it; an unknown device when not told. */
+    device?: string;
+}) => Promise<Result<SignedIn, RedeemSignInTicketRefusal>>;
+/**
+ * Use case: the console redeems a sign-in ticket the installation issued. An
+ * operator's ticket starts the session exactly as after a password sign-in:
+ * it takes argo's lease over and ends any previous session. A viewer's starts
+ * a viewer session beside any others (decision 0022). A ticket signs in once and
+ * only before it expires; used, expired and unknown tickets are one refusal,
+ * which says nothing about which it was.
+ */
+export declare function createRedeemSignInTicket(deps: {
+    uow: UnitOfWork<RedeemSignInTicketTx>;
+    clock: Clock;
+    ids: IdGenerator;
+    hasher: SecretHasher;
+    random: RandomTokens;
+}): RedeemSignInTicket;

package/dist/domain/identity/redeem-sign-in-ticket.js

@@ -0,0 +1,25 @@
+import { refuse } from '../shared/errors.js';
+import { UNKNOWN_DEVICE } from './console-session.js';
+import { startConsoleSession } from './start-console-session.js';
+import { startViewerSession } from './start-viewer-session.js';
+/**
+ * Use case: the console redeems a sign-in ticket the installation issued. An
+ * operator's ticket starts the session exactly as after a password sign-in:
+ * it takes argo's lease over and ends any previous session. A viewer's starts
+ * a viewer session beside any others (decision 0022). A ticket signs in once and
+ * only before it expires; used, expired and unknown tickets are one refusal,
+ * which says nothing about which it was.
+ */
+export function createRedeemSignInTicket(deps) {
+    return (input) => deps.uow.run(async (tx) => {
+        const at = deps.clock.now();
+        const redeemed = await tx.signInTickets.redeem(deps.hasher.hash(input.ticket), at);
+        if (redeemed === undefined) {
+            return refuse('SIGN_IN_TICKET_INVALID', 'This sign-in link is used or expired: sign in again');
+        }
+        const session = { fleetId: redeemed.fleetId, device: input.device ?? UNKNOWN_DEVICE, at };
+        const starting = { tx, ids: deps.ids, hasher: deps.hasher, random: deps.random };
+        return redeemed.as === 'viewer' ? startViewerSession(starting, session) : startConsoleSession(starting, session);
+    });
+}
+//# sourceMappingURL=redeem-sign-in-ticket.js.map

package/dist/domain/identity/redeem-sign-in-ticket.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redeem-sign-in-ticket.js","sourceRoot":"","sources":["../../../src/domain/identity/redeem-sign-in-ticket.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAI/D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD,OAAO,EAAE,mBAAmB,EAA8B,MAAM,4BAA4B,CAAC;AAC7F,OAAO,EAAE,kBAAkB,EAA6B,MAAM,2BAA2B,CAAC;AAc1F;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAMxC;IACC,OAAO,CAAC,KAAK,EAAE,EAAE,CACf,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAwD,EAAE;QAC9E,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACnF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC,wBAAwB,EAAE,qDAAqD,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,OAAO,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,cAAc,EAAE,EAAE,EAAE,CAAC;QAC1F,MAAM,QAAQ,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QACjF,OAAO,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/domain/identity/reset-operator-password.d.ts

@@ -0,0 +1,34 @@
+import type { FleetId, IdGenerator, OperatorId } from '@aeolus-fleet/common';
+import { type LeaseTx, type ShipTx } from '../registry/public.js';
+import type { Clock } from '../shared/clock.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { PasswordHasher } from '../shared/secrets.js';
+import type { UnitOfWork } from '../shared/unit-of-work.js';
+import type { ConsoleSessionRepository, OperatorAccountRepository } from './ports.js';
+export interface ResetOperatorPasswordTx extends LeaseTx, ShipTx {
+    operatorAccounts: OperatorAccountRepository;
+    consoleSessions: ConsoleSessionRepository;
+}
+export type ResetOperatorPassword = (input: {
+    fleetId: FleetId;
+    password: string;
+}) => Promise<Result<{
+    operatorId: OperatorId;
+}, DomainError<'INVALID_PASSWORD' | 'FLEET_NOT_FOUND' | 'OPERATOR_HAS_NO_PASSWORD'>>>;
+/**
+ * Use case: a forgotten operator password is reset from the server (ADR 0012).
+ * The old password stops working, and every console session ends, and with it
+ * the lease on argo it held. A server command: the system is the actor, and
+ * the event concerns argo, so it shows on argo's timeline.
+ *
+ * Locks the account first, like sign-in, so a sign-in with the old password
+ * either finishes before the reset, whose session then ends, or sees the new
+ * password.
+ */
+export declare function createResetOperatorPassword(deps: {
+    uow: UnitOfWork<ResetOperatorPasswordTx>;
+    clock: Clock;
+    ids: IdGenerator;
+    passwords: PasswordHasher;
+}): ResetOperatorPassword;

package/dist/domain/identity/reset-operator-password.js

@@ -0,0 +1,55 @@
+import { endLease, findOperatorShip } from '../registry/public.js';
+import { refuse } from '../shared/errors.js';
+import { recordEvent, SYSTEM } from '../shared/events.js';
+import { ok } from '../shared/result.js';
+import { operatorPassword } from './operator-account.js';
+/**
+ * Use case: a forgotten operator password is reset from the server (ADR 0012).
+ * The old password stops working, and every console session ends, and with it
+ * the lease on argo it held. A server command: the system is the actor, and
+ * the event concerns argo, so it shows on argo's timeline.
+ *
+ * Locks the account first, like sign-in, so a sign-in with the old password
+ * either finishes before the reset, whose session then ends, or sees the new
+ * password.
+ */
+export function createResetOperatorPassword(deps) {
+    return async ({ fleetId, password }) => {
+        const valid = operatorPassword(password);
+        if (!valid.isOk) {
+            return valid;
+        }
+        // Hashed before the transaction: Argon2 takes its time on purpose.
+        const passwordHash = await deps.passwords.hash(valid.value);
+        return deps.uow.run(async (tx) => {
+            const account = await tx.operatorAccounts.findForFleetForUpdate(fleetId);
+            if (!account) {
+                return refuse('FLEET_NOT_FOUND', `Fleet ${fleetId} does not exist`);
+            }
+            if (account.passwordHash === null) {
+                return refuse('OPERATOR_HAS_NO_PASSWORD', 'This operator has no password: they sign in only through the hosting service');
+            }
+            const argo = await findOperatorShip(tx, fleetId);
+            if (!argo.isOk) {
+                return argo;
+            }
+            const at = deps.clock.now();
+            await tx.operatorAccounts.changePassword({ fleetId, operatorId: account.id, passwordHash });
+            await recordEvent({ events: tx.events, ids: deps.ids }, {
+                fleetId,
+                type: 'OperatorPasswordReset',
+                occurredAt: at,
+                actor: SYSTEM,
+                shipId: argo.value.id,
+                details: { operatorId: account.id },
+            });
+            for (const session of await tx.consoleSessions.endAll({ fleetId, shipId: argo.value.id }, { at, reason: 'passwordReset' })) {
+                if (session.leaseId !== null) {
+                    await endLease({ tx, ids: deps.ids }, { fleetId, leaseId: session.leaseId, actor: SYSTEM, at, reason: 'passwordReset' });
+                }
+            }
+            return ok({ operatorId: account.id });
+        });
+    };
+}
+//# sourceMappingURL=reset-operator-password.js.map

package/dist/domain/identity/reset-operator-password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reset-operator-password.js","sourceRoot":"","sources":["../../../src/domain/identity/reset-operator-password.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAA6B,MAAM,uBAAuB,CAAC;AAE9F,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAGtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAazD;;;;;;;;;GASG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAK3C;IACC,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,mEAAmE;QACnE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAE5D,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAqC,EAAE;YAClE,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;YACzE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,MAAM,CAAC,iBAAiB,EAAE,SAAS,OAAO,iBAAiB,CAAC,CAAC;YACtE,CAAC;YACD,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;gBAClC,OAAO,MAAM,CAAC,0BAA0B,EAAE,8EAA8E,CAAC,CAAC;YAC5H,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YAE5B,MAAM,EAAE,CAAC,gBAAgB,CAAC,cAAc,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;YAC5F,MAAM,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE;gBACtD,OAAO;gBACP,IAAI,EAAE,uBAAuB;gBAC7B,UAAU,EAAE,EAAE;gBACd,KAAK,EAAE,MAAM;gBACb,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;gBACrB,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE;aACpC,CAAC,CAAC;YAEH,KAAK,MAAM,OAAO,IAAI,MAAM,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;gBAC3H,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;oBAC7B,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;gBAC3H,CAAC;YACH,CAAC;YACD,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/domain/identity/set-guide.d.ts

@@ -0,0 +1,13 @@
+import type { Guide } from './guide.js';
+import type { GuideRepository } from './ports.js';
+export type SetGuide = (input: {
+    guide: Guide | null;
+}) => Promise<Guide | null>;
+/**
+ * Use case: the installation sets the console's guide (decision 0024),
+ * replacing the one it set before; null clears it. No event: the guide
+ * belongs to the installation, not to a fleet.
+ */
+export declare function createSetGuide(deps: {
+    guide: GuideRepository;
+}): SetGuide;

package/dist/domain/identity/set-guide.js

@@ -0,0 +1,12 @@
+/**
+ * Use case: the installation sets the console's guide (decision 0024),
+ * replacing the one it set before; null clears it. No event: the guide
+ * belongs to the installation, not to a fleet.
+ */
+export function createSetGuide(deps) {
+    return async ({ guide }) => {
+        await deps.guide.replace(guide);
+        return guide;
+    };
+}
+//# sourceMappingURL=set-guide.js.map

package/dist/domain/identity/set-guide.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-guide.js","sourceRoot":"","sources":["../../../src/domain/identity/set-guide.ts"],"names":[],"mappings":"AAKA;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAgC;IAC7D,OAAO,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE;QACzB,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;AACJ,CAAC"}

package/dist/domain/identity/set-notices.d.ts

@@ -0,0 +1,13 @@
+import type { Notice } from './notice.js';
+import type { NoticeRepository } from './ports.js';
+export type SetNotices = (input: {
+    notices: readonly Notice[];
+}) => Promise<Notice[]>;
+/**
+ * Use case: the installation sets the console's notices (decision 0023),
+ * replacing those it set before, in its order; none clears them. No event:
+ * notices belong to the installation, not to a fleet.
+ */
+export declare function createSetNotices(deps: {
+    notices: NoticeRepository;
+}): SetNotices;