@aeolus-fleet/core 0.0.0 → 0.19.0

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,sFAAsF;AACtF,MAAM,WAAW,GAAG,oEAAoE,CAAC;AAEzF,yGAAyG;AACzG,SAAS,QAAQ,CAAC,KAAa;IAC7B,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,CACL,GAAG,KAAK,IAAI;QACZ,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,GAAG;QACpB,GAAG,CAAC,MAAM,KAAK,EAAE;QACjB,GAAG,CAAC,IAAI,KAAK,EAAE;QACf,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QACpB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CACrB,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEzC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;IACzG,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;IACxF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9D,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACjG,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC3F,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,wCAAwC,CAAC,CAAC,QAAQ,EAAE;IACjG,cAAc,EAAE,CAAC;SACd,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC;SAC7E,MAAM,CAAC,QAAQ,EAAE,oEAAoE,CAAC;SACtF,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;SAC7C,QAAQ,EAAE;IACb,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,6BAA6B,EAAE,oBAAoB,MAAM,CAAC,6BAA6B,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;CACrJ,CAAC,CAAC;AAEH,4DAA4D;AAC5D,MAAM,yBAAyB,GAAG,iBAAiB,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;AA2BjF,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,IAAI,GAAG,aAAa,CAAC;CAC/B;AAED,8DAA8D;AAC9D,SAAS,aAAa,CAAC,KAAiB;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5F,OAAO,IAAI,WAAW,CAAC,2BAA2B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,gHAAgH;AAChH,MAAM,UAAU,eAAe,CAAC,WAA+C;IAC7E,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,WAA+C;IACxE,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IACxI,OAAO;QACL,WAAW,EAAE,YAAY;QACzB,SAAS,EAAE,UAAU;QACrB,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,SAAS;QACnB,gBAAgB,EAAE,WAAW,KAAK,MAAM;QACxC,YAAY,EAAE,aAAa;QAC3B,aAAa,EAAE,cAAc,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM;QAC3D,iBAAiB,EAAE,kBAAkB;KACtC,CAAC;AACJ,CAAC"}

package/dist/domain/identity/authenticate.d.ts

@@ -0,0 +1,46 @@
+import { type LeaseEnded } from '../registry/public.js';
+import type { Caller, Crew } from '../shared/caller.js';
+import type { Clock } from '../shared/clock.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { SecretHasher } from '../shared/secrets.js';
+import type { ConsoleSessionEndReason } from './console-session.js';
+import type { CallerLookup } from './ports.js';
+export interface ConsoleSessionUse {
+    /** argo, crewed under the lease the session holds, or the viewer ship, holding none. */
+    caller: Caller | Crew;
+    /** The session's new expiry: its idle limit after this use, never past the moment it ends by. */
+    expiresAt: Date;
+}
+/**
+ * Why a crew token makes no caller: it never crewed a ship, or its lease has
+ * ended, so its session learns that the ship was released rather than that its
+ * token is wrong.
+ */
+export type CrewTokenRefusal = DomainError<'UNKNOWN_CREW_TOKEN'> | LeaseEnded;
+export interface Authenticate {
+    /**
+     * The crew this token belongs to, while its lease is open: the ship and the
+     * lease. The ship secret is no crew token: it works only for `register`
+     * (ADR 0015).
+     */
+    byCrewToken(crewToken: string): Promise<Result<Crew, CrewTokenRefusal>>;
+    /**
+     * The caller of this live console session, or undefined. Each use keeps the
+     * session valid for another 30 days, or a viewer's for another 2 hours and
+     * never past 24 hours after it started.
+     */
+    byConsoleSession(token: string): Promise<ConsoleSessionUse | undefined>;
+    /**
+     * Why the console session of this token ended, so the console can say so:
+     * "You signed in somewhere else" is no failure. Undefined while it has not
+     * ended, once it has merely expired, or for a token no session has.
+     */
+    endOfConsoleSession(token: string): Promise<ConsoleSessionEndReason | undefined>;
+}
+/** Use case: turns a crew token or a console session token into the caller. */
+export declare function createAuthenticate(deps: {
+    callers: CallerLookup;
+    hasher: SecretHasher;
+    clock: Clock;
+}): Authenticate;

package/dist/domain/identity/authenticate.js

@@ -0,0 +1,18 @@
+import { refuseEndedLease } from '../registry/public.js';
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+/** Use case: turns a crew token or a console session token into the caller. */
+export function createAuthenticate(deps) {
+    return {
+        byCrewToken: async (crewToken) => {
+            const lease = await deps.callers.byCrewTokenHash(deps.hasher.hash(crewToken), { at: deps.clock.now() });
+            if (!lease) {
+                return refuse('UNKNOWN_CREW_TOKEN', 'Call with the crew token register gave you');
+            }
+            return lease.isOpen ? ok(lease.crew) : refuseEndedLease();
+        },
+        byConsoleSession: (token) => deps.callers.useConsoleSession({ tokenHash: deps.hasher.hash(token), now: deps.clock.now() }),
+        endOfConsoleSession: (token) => deps.callers.consoleSessionEnding(deps.hasher.hash(token)),
+    };
+}
+//# sourceMappingURL=authenticate.js.map

package/dist/domain/identity/authenticate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticate.js","sourceRoot":"","sources":["../../../src/domain/identity/authenticate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAmB,MAAM,uBAAuB,CAAC;AAG1E,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAwCtD,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,IAAmE;IACpG,OAAO;QACL,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;YAC/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACxG,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,MAAM,CAAC,oBAAoB,EAAE,4CAA4C,CAAC,CAAC;YACpF,CAAC;YACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC5D,CAAC;QACD,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC;QAC1H,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;KAC3F,CAAC;AACJ,CAAC"}

package/dist/domain/identity/console-session.d.ts

@@ -0,0 +1,54 @@
+import type { ConsoleSessionId, FleetId, LeaseId, ShipId } from '@aeolus-fleet/common';
+import type { Location } from '../registry/public.js';
+/**
+ * A console session: the operator crewing `argo`, or a person viewing the
+ * fleet through its viewer ship (decision 0022). Only the hash of the
+ * session token is stored; the token lives in the browser's cookie.
+ */
+export interface ConsoleSession {
+    id: ConsoleSessionId;
+    fleetId: FleetId;
+    shipId: ShipId;
+    /** The lease on `argo` this session holds; null for a viewer session, which holds none. */
+    leaseId: LeaseId | null;
+    /** How long after its last use the session stays valid. */
+    idleLimitMs: number;
+    /** The moment no use renews it past; null when only idleness ends it. */
+    endsBy: Date | null;
+    /** The device it signed in from, as the browser told: "Mac · Chrome". */
+    device: string;
+    tokenHash: string;
+    createdAt: Date;
+    lastUsedAt: Date;
+    expiresAt: Date;
+    endedAt: Date | null;
+    /** Why the session ended; null while it has not. */
+    endReason: ConsoleSessionEndReason | null;
+}
+/**
+ * Why a console session ended: the operator signed in somewhere else and took
+ * argo over, signed out, or the password was reset. An expired session never
+ * ended; it simply stopped working.
+ */
+export type ConsoleSessionEndReason = 'takenOver' | 'signedOut' | 'passwordReset';
+/** The operator's console session stays valid this long after its last use. */
+export declare const CONSOLE_SESSION_IDLE_LIMIT_MS: number;
+/** A viewer session stays valid this long after its last use (decision 0022). */
+export declare const VIEWER_SESSION_IDLE_LIMIT_MS: number;
+/** No use renews a viewer session past this long after it started (decision 0022). */
+export declare const VIEWER_SESSION_LIFETIME_MS: number;
+/** The device of a sign-in that named none. */
+export declare const UNKNOWN_DEVICE = "Unknown device";
+/**
+ * Where a console session crews `argo` from: the device it signed in from, as
+ * the description of an OTHER location, the one kind that carries words.
+ */
+export declare function consoleLocation(device: string): Location;
+/** When an operator's session used at `usedAt` expires: it is valid strictly before that moment. */
+export declare function consoleSessionExpiry(usedAt: Date): Date;
+/** A viewer session started at `at`: how long it lasts idle, when it ends at the latest, and when it first expires. */
+export declare function viewerSessionTimes(at: Date): {
+    idleLimitMs: number;
+    endsBy: Date;
+    expiresAt: Date;
+};

package/dist/domain/identity/console-session.js

@@ -0,0 +1,29 @@
+/** The operator's console session stays valid this long after its last use. */
+export const CONSOLE_SESSION_IDLE_LIMIT_MS = 30 * 24 * 60 * 60 * 1000;
+const HOUR_MS = 60 * 60 * 1000;
+/** A viewer session stays valid this long after its last use (decision 0022). */
+export const VIEWER_SESSION_IDLE_LIMIT_MS = 2 * HOUR_MS;
+/** No use renews a viewer session past this long after it started (decision 0022). */
+export const VIEWER_SESSION_LIFETIME_MS = 24 * HOUR_MS;
+/** The device of a sign-in that named none. */
+export const UNKNOWN_DEVICE = 'Unknown device';
+/**
+ * Where a console session crews `argo` from: the device it signed in from, as
+ * the description of an OTHER location, the one kind that carries words.
+ */
+export function consoleLocation(device) {
+    return { kind: 'OTHER', description: device };
+}
+/** When an operator's session used at `usedAt` expires: it is valid strictly before that moment. */
+export function consoleSessionExpiry(usedAt) {
+    return new Date(usedAt.getTime() + CONSOLE_SESSION_IDLE_LIMIT_MS);
+}
+/** A viewer session started at `at`: how long it lasts idle, when it ends at the latest, and when it first expires. */
+export function viewerSessionTimes(at) {
+    return {
+        idleLimitMs: VIEWER_SESSION_IDLE_LIMIT_MS,
+        endsBy: new Date(at.getTime() + VIEWER_SESSION_LIFETIME_MS),
+        expiresAt: new Date(at.getTime() + VIEWER_SESSION_IDLE_LIMIT_MS),
+    };
+}
+//# sourceMappingURL=console-session.js.map

package/dist/domain/identity/console-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"console-session.js","sourceRoot":"","sources":["../../../src/domain/identity/console-session.ts"],"names":[],"mappings":"AAqCA,+EAA+E;AAC/E,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtE,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/B,iFAAiF;AACjF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,GAAG,OAAO,CAAC;AAExD,sFAAsF;AACtF,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,OAAO,CAAC;AAEvD,+CAA+C;AAC/C,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAE/C;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,oBAAoB,CAAC,MAAY;IAC/C,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,6BAA6B,CAAC,CAAC;AACpE,CAAC;AAED,uHAAuH;AACvH,MAAM,UAAU,kBAAkB,CAAC,EAAQ;IACzC,OAAO;QACL,WAAW,EAAE,4BAA4B;QACzC,MAAM,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,0BAA0B,CAAC;QAC3D,SAAS,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,4BAA4B,CAAC;KACjE,CAAC;AACJ,CAAC"}

package/dist/domain/identity/credential.d.ts

@@ -0,0 +1,76 @@
+import type { CredentialId, FleetId, IdGenerator, ShipId } from '@aeolus-fleet/common';
+import { type DomainError } from '../shared/errors.js';
+import { type Actor, type EventLog } from '../shared/events.js';
+import { type Result } from '../shared/result.js';
+import type { RandomTokens, SecretHasher } from '../shared/secrets.js';
+import type { CredentialRepository } from './ports.js';
+/** Versioned prefix of every ship secret (ADR 0002). */
+export declare const SHIP_SECRET_PREFIX = "aeolus_sk_v1_";
+/** A ship secret, stored only as its hash. At most one valid secret per ship. */
+export interface Credential {
+    id: CredentialId;
+    fleetId: FleetId;
+    shipId: ShipId;
+    secretHash: string;
+    issuedAt: Date;
+    claimedAt: Date | null;
+    invalidatedAt: Date | null;
+}
+export interface CredentialTx {
+    credentials: CredentialRepository;
+}
+export interface SecretTools {
+    hasher: SecretHasher;
+    random: RandomTokens;
+    ids: IdGenerator;
+}
+export interface IssuedShipSecret {
+    /** The secret in plain text: the one moment it exists. */
+    secret: string;
+    credentialId: CredentialId;
+}
+/**
+ * Issues a new secret for a ship and stores only its hash. The caller
+ * invalidates any earlier secret first.
+ */
+export declare function issueShipSecret(deps: SecretTools & {
+    tx: CredentialTx;
+}, input: {
+    fleetId: FleetId;
+    shipId: ShipId;
+    at: Date;
+}): Promise<IssuedShipSecret>;
+/**
+ * Invalidates the ship's valid secret, if it has one, and writes
+ * CredentialRevoked. The secret fails on the very next call.
+ */
+export declare function revokeShipSecret(deps: {
+    tx: CredentialTx & {
+        events: EventLog;
+    };
+    ids: IdGenerator;
+}, input: {
+    fleetId: FleetId;
+    shipId: ShipId;
+    actor: Actor;
+    at: Date;
+}): Promise<void>;
+/**
+ * The given ship's valid secret, locked until the unit of work ends: a claim
+ * locks it before it opens the lease, so it serialises with a new starting
+ * prompt, which locks the same row before it replaces the secret. One refusal
+ * for an unknown secret, an invalidated one, another ship's and an unknown
+ * ship id, so the answer says nothing about which ids or secrets exist.
+ */
+export declare function findValidShipSecret(deps: {
+    tx: CredentialTx;
+    hasher: SecretHasher;
+}, input: {
+    shipId: ShipId;
+    secret: string;
+}): Promise<Result<Credential, DomainError<'WRONG_SHIP_ID_OR_SECRET'>>>;
+/** Marks the secret claimed: a session crews the ship with it. The first claim's date stays. */
+export declare function markShipSecretClaimed(tx: CredentialTx, claim: {
+    credential: Credential;
+    at: Date;
+}): Promise<void>;

package/dist/domain/identity/credential.js

@@ -0,0 +1,63 @@
+import { refuse } from '../shared/errors.js';
+import { recordEvent } from '../shared/events.js';
+import { ok } from '../shared/result.js';
+/** Versioned prefix of every ship secret (ADR 0002). */
+export const SHIP_SECRET_PREFIX = 'aeolus_sk_v1_';
+/**
+ * Issues a new secret for a ship and stores only its hash. The caller
+ * invalidates any earlier secret first.
+ */
+export async function issueShipSecret(deps, input) {
+    const secret = SHIP_SECRET_PREFIX + deps.random.next();
+    const credentialId = deps.ids('credential');
+    await deps.tx.credentials.create({
+        id: credentialId,
+        fleetId: input.fleetId,
+        shipId: input.shipId,
+        secretHash: deps.hasher.hash(secret),
+        issuedAt: input.at,
+        claimedAt: null,
+        invalidatedAt: null,
+    });
+    return { secret, credentialId };
+}
+/**
+ * Invalidates the ship's valid secret, if it has one, and writes
+ * CredentialRevoked. The secret fails on the very next call.
+ */
+export async function revokeShipSecret(deps, input) {
+    const { tx, ids } = deps;
+    const { fleetId, shipId, actor, at } = input;
+    const valid = await tx.credentials.findValidForShipForUpdate(fleetId, shipId);
+    if (!valid) {
+        return;
+    }
+    await tx.credentials.invalidate({ fleetId, credentialId: valid.id, at });
+    await recordEvent({ events: tx.events, ids }, {
+        fleetId,
+        type: 'CredentialRevoked',
+        occurredAt: at,
+        actor,
+        shipId,
+        details: { credentialId: valid.id },
+    });
+}
+/**
+ * The given ship's valid secret, locked until the unit of work ends: a claim
+ * locks it before it opens the lease, so it serialises with a new starting
+ * prompt, which locks the same row before it replaces the secret. One refusal
+ * for an unknown secret, an invalidated one, another ship's and an unknown
+ * ship id, so the answer says nothing about which ids or secrets exist.
+ */
+export async function findValidShipSecret(deps, input) {
+    const credential = await deps.tx.credentials.findValidBySecretHashForUpdate(deps.hasher.hash(input.secret));
+    return credential?.shipId === input.shipId
+        ? ok(credential)
+        : refuse('WRONG_SHIP_ID_OR_SECRET', 'Wrong ship id or secret');
+}
+/** Marks the secret claimed: a session crews the ship with it. The first claim's date stays. */
+export async function markShipSecretClaimed(tx, claim) {
+    const { credential, at } = claim;
+    await tx.credentials.markClaimed({ fleetId: credential.fleetId, credentialId: credential.id, at });
+}
+//# sourceMappingURL=credential.js.map

package/dist/domain/identity/credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential.js","sourceRoot":"","sources":["../../../src/domain/identity/credential.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAA6B,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAItD,wDAAwD;AACxD,MAAM,CAAC,MAAM,kBAAkB,GAAG,eAAe,CAAC;AA6BlD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAwC,EACxC,KAAqD;IAErD,MAAM,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACvD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC5C,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;QAC/B,EAAE,EAAE,YAAY;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;QACpC,QAAQ,EAAE,KAAK,CAAC,EAAE;QAClB,SAAS,EAAE,IAAI;QACf,aAAa,EAAE,IAAI;KACpB,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAmE,EACnE,KAAmE;IAEnE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IAE7C,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,yBAAyB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC9E,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;IACT,CAAC;IACD,MAAM,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IACzE,MAAM,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;QAC5C,OAAO;QACP,IAAI,EAAE,mBAAmB;QACzB,UAAU,EAAE,EAAE;QACd,KAAK;QACL,MAAM;QACN,OAAO,EAAE,EAAE,YAAY,EAAE,KAAK,CAAC,EAAE,EAAE;KACpC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAgD,EAChD,KAAyC;IAEzC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,8BAA8B,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5G,OAAO,UAAU,EAAE,MAAM,KAAK,KAAK,CAAC,MAAM;QACxC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC;QAChB,CAAC,CAAC,MAAM,CAAC,yBAAyB,EAAE,yBAAyB,CAAC,CAAC;AACnE,CAAC;AAED,gGAAgG;AAChG,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,EAAgB,EAAE,KAA2C;IACvG,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IACjC,MAAM,EAAE,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;AACrG,CAAC"}

package/dist/domain/identity/dismiss-notice.d.ts

@@ -0,0 +1,19 @@
+import type { Caller } from '../shared/caller.js';
+import type { Clock } from '../shared/clock.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { NoticeDismissals, NoticeRepository } from './ports.js';
+export type DismissNoticeRefusal = DomainError<'NOTICE_NOT_FOUND' | 'NOTICE_NOT_DISMISSIBLE'>;
+export type DismissNotice = (caller: Caller, input: {
+    noticeId: string;
+}) => Promise<Result<undefined, DismissNoticeRefusal>>;
+/**
+ * Use case: a console session dismisses a dismissible notice it sees, for
+ * itself only (decision 0023); again is OK and changes nothing. No event: a
+ * notice is how the console looks, not a change to the fleet.
+ */
+export declare function createDismissNotice(deps: {
+    notices: NoticeRepository;
+    dismissals: NoticeDismissals;
+    clock: Clock;
+}): DismissNotice;

package/dist/domain/identity/dismiss-notice.js

@@ -0,0 +1,23 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+import { isForSessionOf } from './notice.js';
+/**
+ * Use case: a console session dismisses a dismissible notice it sees, for
+ * itself only (decision 0023); again is OK and changes nothing. No event: a
+ * notice is how the console looks, not a change to the fleet.
+ */
+export function createDismissNotice(deps) {
+    return async (caller, { noticeId }) => {
+        const { consoleSessionId } = caller;
+        const notice = (await deps.notices.read()).find((each) => each.id === noticeId && isForSessionOf(each, caller.kind));
+        if (consoleSessionId === undefined || notice === undefined) {
+            return refuse('NOTICE_NOT_FOUND', `No notice ${noticeId} shows in this console session`);
+        }
+        if (!notice.isDismissible) {
+            return refuse('NOTICE_NOT_DISMISSIBLE', `Notice ${noticeId} stays: the installation made it not dismissible`);
+        }
+        await deps.dismissals.dismiss({ fleetId: caller.fleetId, consoleSessionId, noticeId, at: deps.clock.now() });
+        return ok(undefined);
+    };
+}
+//# sourceMappingURL=dismiss-notice.js.map

package/dist/domain/identity/dismiss-notice.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dismiss-notice.js","sourceRoot":"","sources":["../../../src/domain/identity/dismiss-notice.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAO7C;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAA+E;IACjH,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;QACpC,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;QACpC,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,QAAQ,IAAI,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QACrH,IAAI,gBAAgB,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC3D,OAAO,MAAM,CAAC,kBAAkB,EAAE,aAAa,QAAQ,gCAAgC,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,wBAAwB,EAAE,UAAU,QAAQ,kDAAkD,CAAC,CAAC;QAChH,CAAC;QACD,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7G,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC"}

package/dist/domain/identity/get-guide.d.ts

@@ -0,0 +1,7 @@
+import type { Guide } from './guide.js';
+import type { GuideRepository } from './ports.js';
+export type GetGuide = () => Promise<Guide | null>;
+/** Use case: the guide the installation set (decision 0024); none before it sets one. */
+export declare function createGetGuide(deps: {
+    guide: GuideRepository;
+}): GetGuide;

package/dist/domain/identity/get-guide.js

@@ -0,0 +1,5 @@
+/** Use case: the guide the installation set (decision 0024); none before it sets one. */
+export function createGetGuide(deps) {
+    return () => deps.guide.read();
+}
+//# sourceMappingURL=get-guide.js.map

package/dist/domain/identity/get-guide.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-guide.js","sourceRoot":"","sources":["../../../src/domain/identity/get-guide.ts"],"names":[],"mappings":"AAKA,yFAAyF;AACzF,MAAM,UAAU,cAAc,CAAC,IAAgC;IAC7D,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;AACjC,CAAC"}

package/dist/domain/identity/get-notices.d.ts

@@ -0,0 +1,7 @@
+import type { Notice } from './notice.js';
+import type { NoticeRepository } from './ports.js';
+export type GetNotices = () => Promise<Notice[]>;
+/** Use case: the notices the installation set (decision 0023), in its order; none before it sets any. */
+export declare function createGetNotices(deps: {
+    notices: NoticeRepository;
+}): GetNotices;

package/dist/domain/identity/get-notices.js

@@ -0,0 +1,5 @@
+/** Use case: the notices the installation set (decision 0023), in its order; none before it sets any. */
+export function createGetNotices(deps) {
+    return () => deps.notices.read();
+}
+//# sourceMappingURL=get-notices.js.map

package/dist/domain/identity/get-notices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-notices.js","sourceRoot":"","sources":["../../../src/domain/identity/get-notices.ts"],"names":[],"mappings":"AAKA,yGAAyG;AACzG,MAAM,UAAU,gBAAgB,CAAC,IAAmC;IAClE,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;AACnC,CAAC"}

package/dist/domain/identity/guide.d.ts

@@ -0,0 +1,24 @@
+import type { GuideProgressState, NoticeAudience } from '@aeolus-fleet/common';
+/** A guide's step (decision 0024): a console page, the element it points at (centred without one), a title and a text. */
+export interface GuideStep {
+    path: string;
+    anchor?: string;
+    title: string;
+    text: string;
+}
+/**
+ * The guide (decision 0024): steps the installation sets for the console
+ * sessions of one audience. Its shape is checked where the installation sets
+ * it (`setGuideInputSchema`); here it is trusted.
+ */
+export interface Guide {
+    audience: NoticeAudience;
+    steps: readonly GuideStep[];
+}
+/** Where a console session is in the guide: open at a step, counted from 0, or skipped or finished. */
+export interface GuideProgress {
+    step: number;
+    state: GuideProgressState;
+}
+/** A session that has not moved in the guide yet: open at its first step, so the guide opens by itself. */
+export declare const NOT_STARTED: GuideProgress;

package/dist/domain/identity/guide.js

@@ -0,0 +1,3 @@
+/** A session that has not moved in the guide yet: open at its first step, so the guide opens by itself. */
+export const NOT_STARTED = { step: 0, state: 'open' };
+//# sourceMappingURL=guide.js.map

package/dist/domain/identity/guide.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guide.js","sourceRoot":"","sources":["../../../src/domain/identity/guide.ts"],"names":[],"mappings":"AA0BA,2GAA2G;AAC3G,MAAM,CAAC,MAAM,WAAW,GAAkB,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC"}

package/dist/domain/identity/issue-sign-in-ticket.d.ts

@@ -0,0 +1,38 @@
+import type { FleetId, IdGenerator } from '@aeolus-fleet/common';
+import { type ShipTx } from '../registry/public.js';
+import type { Clock } from '../shared/clock.js';
+import { type DomainError } from '../shared/errors.js';
+import { type EventLog } from '../shared/events.js';
+import { type Result } from '../shared/result.js';
+import type { RandomTokens, SecretHasher } from '../shared/secrets.js';
+import type { UnitOfWork } from '../shared/unit-of-work.js';
+import type { OperatorAccountRepository, SignInTicketRepository } from './ports.js';
+import { type SignInAs } from './sign-in-ticket.js';
+export interface IssueSignInTicketTx extends ShipTx {
+    operatorAccounts: OperatorAccountRepository;
+    signInTickets: SignInTicketRepository;
+    events: EventLog;
+}
+export type IssueSignInTicketRefusal = DomainError<'FLEET_NOT_FOUND' | 'FLEET_HAS_NO_VIEWER'>;
+export type IssueSignInTicket = (input: {
+    fleetId: FleetId;
+    /** Whom it signs in as: the operator when left out, or a viewer of a fleet with a viewer ship (decision 0022). */
+    as?: SignInAs;
+}) => Promise<Result<{
+    ticket: string;
+}, IssueSignInTicketRefusal>>;
+/**
+ * Use case: the installation issues a one-time sign-in ticket for a fleet's
+ * operator, or for a viewer of a fleet with a viewer ship (docs/blueprint.md,
+ * "Installation"; decision 0022): the hosting service hands it to the
+ * person's browser, and the console redeems it for a session. Only
+ * its hash is stored; it is valid 2 minutes and signs in once. Each ticket
+ * stands alone: a new one leaves an earlier unused one to expire.
+ */
+export declare function createIssueSignInTicket(deps: {
+    uow: UnitOfWork<IssueSignInTicketTx>;
+    clock: Clock;
+    ids: IdGenerator;
+    hasher: SecretHasher;
+    random: RandomTokens;
+}): IssueSignInTicket;

package/dist/domain/identity/issue-sign-in-ticket.js

@@ -0,0 +1,39 @@
+import { findViewerShip } from '../registry/public.js';
+import { refuse } from '../shared/errors.js';
+import { recordEvent, SYSTEM } from '../shared/events.js';
+import { ok } from '../shared/result.js';
+import { SIGN_IN_TICKET_PREFIX, SIGN_IN_TICKET_VALID_MS } from './sign-in-ticket.js';
+/**
+ * Use case: the installation issues a one-time sign-in ticket for a fleet's
+ * operator, or for a viewer of a fleet with a viewer ship (docs/blueprint.md,
+ * "Installation"; decision 0022): the hosting service hands it to the
+ * person's browser, and the console redeems it for a session. Only
+ * its hash is stored; it is valid 2 minutes and signs in once. Each ticket
+ * stands alone: a new one leaves an earlier unused one to expire.
+ */
+export function createIssueSignInTicket(deps) {
+    return ({ fleetId, as = 'operator' }) => deps.uow.run(async (tx) => {
+        if (!(await tx.operatorAccounts.findForFleet(fleetId))) {
+            return refuse('FLEET_NOT_FOUND', `The installation hosts no fleet ${fleetId}`);
+        }
+        if (as === 'viewer') {
+            const viewer = await findViewerShip(tx, fleetId);
+            if (!viewer.isOk) {
+                return viewer;
+            }
+        }
+        const at = deps.clock.now();
+        const ticket = SIGN_IN_TICKET_PREFIX + deps.random.next();
+        await tx.signInTickets.create({
+            fleetId,
+            as,
+            tokenHash: deps.hasher.hash(ticket),
+            issuedAt: at,
+            expiresAt: new Date(at.getTime() + SIGN_IN_TICKET_VALID_MS),
+            usedAt: null,
+        });
+        await recordEvent({ events: tx.events, ids: deps.ids }, { fleetId, type: 'SignInTicketIssued', occurredAt: at, actor: SYSTEM, details: { as } });
+        return ok({ ticket });
+    });
+}
+//# sourceMappingURL=issue-sign-in-ticket.js.map

package/dist/domain/identity/issue-sign-in-ticket.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue-sign-in-ticket.js","sourceRoot":"","sources":["../../../src/domain/identity/issue-sign-in-ticket.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAe,MAAM,uBAAuB,CAAC;AAGpE,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,EAAiB,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAItD,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAiB,MAAM,qBAAqB,CAAC;AAgBpG;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAMvC;IACC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,UAAU,EAAE,EAAE,EAAE,CACtC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAiE,EAAE;QACvF,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,gBAAgB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACvD,OAAO,MAAM,CAAC,iBAAiB,EAAE,mCAAmC,OAAO,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjB,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,qBAAqB,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC;YAC5B,OAAO;YACP,EAAE;YACF,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YACnC,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,uBAAuB,CAAC;YAC3D,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,MAAM,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACjJ,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/domain/identity/notice.d.ts

@@ -0,0 +1,16 @@
+import type { NoticeAudience, NoticeLink, ShipKind } from '@aeolus-fleet/common';
+/**
+ * A notice (decision 0023): plain text the installation shows above every
+ * console page to the sessions of its audience, with optional links, and
+ * dismissible or not. Its shape is checked where the installation sets it
+ * (`setNoticesInputSchema`); here it is trusted.
+ */
+export interface Notice {
+    id: string;
+    audience: NoticeAudience;
+    text: string;
+    links: readonly NoticeLink[];
+    isDismissible: boolean;
+}
+/** Whether a console session of a ship of this kind sees the notice (or the guide, decision 0024): everyone's always, the operators' on argo, the viewers' on the viewer ship. */
+export declare function isForSessionOf(notice: Pick<Notice, 'audience'>, kind: ShipKind): boolean;

package/dist/domain/identity/notice.js

@@ -0,0 +1,12 @@
+/** Whether a console session of a ship of this kind sees the notice (or the guide, decision 0024): everyone's always, the operators' on argo, the viewers' on the viewer ship. */
+export function isForSessionOf(notice, kind) {
+    switch (notice.audience) {
+        case 'everyone':
+            return true;
+        case 'operators':
+            return kind === 'operator';
+        case 'viewers':
+            return kind === 'viewer';
+    }
+}
+//# sourceMappingURL=notice.js.map

package/dist/domain/identity/notice.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"notice.js","sourceRoot":"","sources":["../../../src/domain/identity/notice.ts"],"names":[],"mappings":"AAgBA,kLAAkL;AAClL,MAAM,UAAU,cAAc,CAAC,MAAgC,EAAE,IAAc;IAC7E,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;QACxB,KAAK,UAAU;YACb,OAAO,IAAI,CAAC;QACd,KAAK,WAAW;YACd,OAAO,IAAI,KAAK,UAAU,CAAC;QAC7B,KAAK,SAAS;YACZ,OAAO,IAAI,KAAK,QAAQ,CAAC;IAC7B,CAAC;AACH,CAAC"}

package/dist/domain/identity/operator-account.d.ts

@@ -0,0 +1,28 @@
+import { type FleetId, type OperatorId, type Theme } from '@aeolus-fleet/common';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+/**
+ * The operator's login (ADR 0012): signing in with its email and password
+ * crews `argo`. One account per fleet in v1. Only the Argon2id hash of the
+ * password is stored, and an operator may have no password at all.
+ */
+export interface OperatorAccount {
+    id: OperatorId;
+    fleetId: FleetId;
+    /** Normalised: unique across the installation, found before the fleet is known (ADR 0007). */
+    email: string;
+    /**
+     * The Argon2id hash of the password; null for an operator who has none,
+     * such as one a hosting installation created, who signs in another way.
+     */
+    passwordHash: string | null;
+    /** How the console looks for this operator; System until they choose. */
+    theme: Theme;
+    createdAt: Date;
+}
+/** The form an email is stored and found in: without the spaces around it, in lowercase. */
+export declare function normaliseEmail(raw: string): string;
+/** An operator email, normalised: one @ with something on each side, no whitespace, at most 254 characters. */
+export declare function operatorEmail(raw: string): Result<string, DomainError<'INVALID_EMAIL'>>;
+/** Any password of 1 to 1024 characters, kept exactly as typed: no strength rules (ADR 0016). */
+export declare function operatorPassword(raw: string): Result<string, DomainError<'INVALID_PASSWORD'>>;

package/dist/domain/identity/operator-account.js

@@ -0,0 +1,21 @@
+import { OPERATOR_EMAIL_MAX_LENGTH, OPERATOR_EMAIL_PATTERN, OPERATOR_PASSWORD_MAX_LENGTH, } from '@aeolus-fleet/common';
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+/** The form an email is stored and found in: without the spaces around it, in lowercase. */
+export function normaliseEmail(raw) {
+    return raw.trim().toLowerCase();
+}
+/** An operator email, normalised: one @ with something on each side, no whitespace, at most 254 characters. */
+export function operatorEmail(raw) {
+    const email = normaliseEmail(raw);
+    return email.length <= OPERATOR_EMAIL_MAX_LENGTH && OPERATOR_EMAIL_PATTERN.test(email)
+        ? ok(email)
+        : refuse('INVALID_EMAIL', `An operator email is an address like name@example.com, at most ${String(OPERATOR_EMAIL_MAX_LENGTH)} characters`);
+}
+/** Any password of 1 to 1024 characters, kept exactly as typed: no strength rules (ADR 0016). */
+export function operatorPassword(raw) {
+    return raw.length > 0 && raw.length <= OPERATOR_PASSWORD_MAX_LENGTH
+        ? ok(raw)
+        : refuse('INVALID_PASSWORD', `A password is 1 to ${String(OPERATOR_PASSWORD_MAX_LENGTH)} characters`);
+}
+//# sourceMappingURL=operator-account.js.map

package/dist/domain/identity/operator-account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operator-account.js","sourceRoot":"","sources":["../../../src/domain/identity/operator-account.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,4BAA4B,GAI7B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAsBtD,4FAA4F;AAC5F,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAClC,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC,MAAM,IAAI,yBAAyB,IAAI,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC;QACpF,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC;QACX,CAAC,CAAC,MAAM,CACJ,eAAe,EACf,kEAAkE,MAAM,CAAC,yBAAyB,CAAC,aAAa,CACjH,CAAC;AACR,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,IAAI,4BAA4B;QACjE,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC;QACT,CAAC,CAAC,MAAM,CAAC,kBAAkB,EAAE,sBAAsB,MAAM,CAAC,4BAA4B,CAAC,aAAa,CAAC,CAAC;AAC1G,CAAC"}