@aeolus-fleet/core 0.0.0 → 0.19.0

package/dist/domain/identity/set-notices.js

@@ -0,0 +1,12 @@
+/**
+ * Use case: the installation sets the console's notices (decision 0023),
+ * replacing those it set before, in its order; none clears them. No event:
+ * notices belong to the installation, not to a fleet.
+ */
+export function createSetNotices(deps) {
+    return async ({ notices }) => {
+        await deps.notices.replace(notices);
+        return [...notices];
+    };
+}
+//# sourceMappingURL=set-notices.js.map

package/dist/domain/identity/set-notices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-notices.js","sourceRoot":"","sources":["../../../src/domain/identity/set-notices.ts"],"names":[],"mappings":"AAKA;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAmC;IAClE,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;QAC3B,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;IACtB,CAAC,CAAC;AACJ,CAAC"}

package/dist/domain/identity/set-theme.d.ts

@@ -0,0 +1,21 @@
+import type { Theme } from '@aeolus-fleet/common';
+import type { Caller } from '../shared/caller.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { UnitOfWork } from '../shared/unit-of-work.js';
+import type { OperatorAccountRepository } from './ports.js';
+export interface SetThemeTx {
+    operatorAccounts: Pick<OperatorAccountRepository, 'findForFleetForUpdate' | 'setTheme'>;
+}
+export type SetTheme = (caller: Caller, input: {
+    theme: Theme;
+}) => Promise<Result<undefined, DomainError<'NOT_THE_OPERATOR_SHIP'>>>;
+/**
+ * Use case: the operator chooses how the console looks (Light, Dark or
+ * System), stored on their account so it follows them to any browser. No
+ * event: a theme is how the console looks, not a change to the fleet. Only the
+ * operator's console session chooses it; a viewer's keeps its theme in the browser.
+ */
+export declare function createSetTheme(deps: {
+    uow: UnitOfWork<SetThemeTx>;
+}): SetTheme;

package/dist/domain/identity/set-theme.js

@@ -0,0 +1,19 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+/**
+ * Use case: the operator chooses how the console looks (Light, Dark or
+ * System), stored on their account so it follows them to any browser. No
+ * event: a theme is how the console looks, not a change to the fleet. Only the
+ * operator's console session chooses it; a viewer's keeps its theme in the browser.
+ */
+export function createSetTheme(deps) {
+    return (caller, input) => deps.uow.run(async (tx) => {
+        const account = caller.consoleSessionId && caller.kind === 'operator' && (await tx.operatorAccounts.findForFleetForUpdate(caller.fleetId));
+        if (!account) {
+            return refuse('NOT_THE_OPERATOR_SHIP', 'Only the operator, signed in to the console, chooses a theme');
+        }
+        await tx.operatorAccounts.setTheme({ fleetId: caller.fleetId, operatorId: account.id, theme: input.theme });
+        return ok(undefined);
+    });
+}
+//# sourceMappingURL=set-theme.js.map

package/dist/domain/identity/set-theme.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"set-theme.js","sourceRoot":"","sources":["../../../src/domain/identity/set-theme.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAUtD;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAqC;IAClE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CACvB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAoE,EAAE;QAC1F,MAAM,OAAO,GAAG,MAAM,CAAC,gBAAgB,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,MAAM,EAAE,CAAC,gBAAgB,CAAC,qBAAqB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3I,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,MAAM,CAAC,uBAAuB,EAAE,8DAA8D,CAAC,CAAC;QACzG,CAAC;QACD,MAAM,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAC5G,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/domain/identity/sign-in-ticket.d.ts

@@ -0,0 +1,21 @@
+import type { FleetId } from '@aeolus-fleet/common';
+/** Every sign-in ticket starts so: it says what it is, as a ship secret and a crew token do. */
+export declare const SIGN_IN_TICKET_PREFIX = "aeolus_st_v1_";
+/** How long a sign-in ticket stays valid after it is issued. */
+export declare const SIGN_IN_TICKET_VALID_MS: number;
+/** Whom a ticket signs in as: the operator, crewing argo, or a viewer, through the viewer ship (decision 0022). */
+export type SignInAs = 'operator' | 'viewer';
+/**
+ * A one-time sign-in ticket for a fleet's operator or for a viewer, issued by
+ * a hosting installation (docs/blueprint.md, "Installation") and redeemed in
+ * the console for a session. Only its hash is stored; it signs in once,
+ * before it expires.
+ */
+export interface SignInTicket {
+    fleetId: FleetId;
+    as: SignInAs;
+    tokenHash: string;
+    issuedAt: Date;
+    expiresAt: Date;
+    usedAt: Date | null;
+}

package/dist/domain/identity/sign-in-ticket.js

@@ -0,0 +1,5 @@
+/** Every sign-in ticket starts so: it says what it is, as a ship secret and a crew token do. */
+export const SIGN_IN_TICKET_PREFIX = 'aeolus_st_v1_';
+/** How long a sign-in ticket stays valid after it is issued. */
+export const SIGN_IN_TICKET_VALID_MS = 2 * 60 * 1000;
+//# sourceMappingURL=sign-in-ticket.js.map

package/dist/domain/identity/sign-in-ticket.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in-ticket.js","sourceRoot":"","sources":["../../../src/domain/identity/sign-in-ticket.ts"],"names":[],"mappings":"AAEA,gGAAgG;AAChG,MAAM,CAAC,MAAM,qBAAqB,GAAG,eAAe,CAAC;AAErD,gEAAgE;AAChE,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC"}

package/dist/domain/identity/sign-in.d.ts

@@ -0,0 +1,51 @@
+import type { ConsoleSessionId, IdGenerator } from '@aeolus-fleet/common';
+import type { Caller } from '../shared/caller.js';
+import type { Clock } from '../shared/clock.js';
+import { type DomainError } from '../shared/errors.js';
+import type { Result } from '../shared/result.js';
+import type { PasswordHasher, RandomTokens, SecretHasher } from '../shared/secrets.js';
+import type { UnitOfWork } from '../shared/unit-of-work.js';
+import type { OperatorAccountLookup, OperatorAccountRepository } from './ports.js';
+import { type StartConsoleSessionTx } from './start-console-session.js';
+export interface SignInTx extends StartConsoleSessionTx {
+    operatorAccounts: OperatorAccountRepository;
+}
+export interface SignedIn {
+    /** The session token for the cookie, in plain text only here. */
+    token: string;
+    consoleSessionId: ConsoleSessionId;
+    expiresAt: Date;
+    caller: Caller;
+}
+/** Only a wrong email or password in practice: the account's fleet always has its argo. */
+export type SignInRefusal = DomainError<'WRONG_EMAIL_OR_PASSWORD' | 'FLEET_NOT_FOUND' | 'NOT_THE_OPERATOR_SHIP'>;
+export type SignIn = (input: {
+    email: string;
+    password: string;
+    /** The device it signs in from, as the console words it; an unknown device when not told. */
+    device?: string;
+}) => Promise<Result<SignedIn, SignInRefusal>>;
+/**
+ * Use case: the operator signs in to the console with email and password, and
+ * the session crews `argo` (ADR 0012). Signing in ends the previous console
+ * session and takes argo's lease over, so its deliveries in flight return to
+ * pending. The session records the device it signed in from, which is also
+ * where argo's lease runs.
+ *
+ * A wrong email and a wrong password are one refusal, and both check a
+ * password, so neither the answer nor its timing says whether the email
+ * exists. The password is checked before the unit of work: Argon2 takes its
+ * time on purpose, and no account row or connection waits on it. The unit of
+ * work then locks the account and finds the same password hash, or refuses:
+ * a reset in between makes the checked password wrong, and a reset after
+ * waits for the lock, then ends the new session.
+ */
+export declare function createSignIn(deps: {
+    uow: UnitOfWork<SignInTx>;
+    accounts: OperatorAccountLookup;
+    clock: Clock;
+    ids: IdGenerator;
+    hasher: SecretHasher;
+    random: RandomTokens;
+    passwords: PasswordHasher;
+}): SignIn;

package/dist/domain/identity/sign-in.js

@@ -0,0 +1,43 @@
+import { refuse } from '../shared/errors.js';
+import { UNKNOWN_DEVICE } from './console-session.js';
+import { normaliseEmail } from './operator-account.js';
+import { startConsoleSession } from './start-console-session.js';
+const WRONG_EMAIL_OR_PASSWORD = 'Wrong email or password';
+/**
+ * Use case: the operator signs in to the console with email and password, and
+ * the session crews `argo` (ADR 0012). Signing in ends the previous console
+ * session and takes argo's lease over, so its deliveries in flight return to
+ * pending. The session records the device it signed in from, which is also
+ * where argo's lease runs.
+ *
+ * A wrong email and a wrong password are one refusal, and both check a
+ * password, so neither the answer nor its timing says whether the email
+ * exists. The password is checked before the unit of work: Argon2 takes its
+ * time on purpose, and no account row or connection waits on it. The unit of
+ * work then locks the account and finds the same password hash, or refuses:
+ * a reset in between makes the checked password wrong, and a reset after
+ * waits for the lock, then ends the new session.
+ */
+export function createSignIn(deps) {
+    return async (input) => {
+        const email = normaliseEmail(input.email);
+        const account = await deps.accounts.byEmail(email);
+        // An account without a password checks against none, as a missing account does: no password signs it in.
+        const isPasswordRight = await deps.passwords.verify(input.password, account?.passwordHash ?? undefined);
+        if (!account || !isPasswordRight) {
+            return refuse('WRONG_EMAIL_OR_PASSWORD', WRONG_EMAIL_OR_PASSWORD);
+        }
+        return deps.uow.run(async (tx) => {
+            const locked = await tx.operatorAccounts.findByEmailForUpdate(email);
+            if (locked?.id !== account.id || locked.passwordHash !== account.passwordHash) {
+                return refuse('WRONG_EMAIL_OR_PASSWORD', WRONG_EMAIL_OR_PASSWORD);
+            }
+            return startConsoleSession({ tx, ids: deps.ids, hasher: deps.hasher, random: deps.random }, {
+                fleetId: account.fleetId,
+                device: input.device ?? UNKNOWN_DEVICE,
+                at: deps.clock.now(),
+            });
+        });
+    };
+}
+//# sourceMappingURL=sign-in.js.map

package/dist/domain/identity/sign-in.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in.js","sourceRoot":"","sources":["../../../src/domain/identity/sign-in.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAI/D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAAE,mBAAmB,EAA8B,MAAM,4BAA4B,CAAC;AAwB7F,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAE1D;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,YAAY,CAAC,IAQ5B;IACC,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACnD,yGAAyG;QACzG,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,YAAY,IAAI,SAAS,CAAC,CAAC;QACxG,IAAI,CAAC,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC;YACjC,OAAO,MAAM,CAAC,yBAAyB,EAAE,uBAAuB,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAA4C,EAAE;YACzE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;YACrE,IAAI,MAAM,EAAE,EAAE,KAAK,OAAO,CAAC,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC;gBAC9E,OAAO,MAAM,CAAC,yBAAyB,EAAE,uBAAuB,CAAC,CAAC;YACpE,CAAC;YACD,OAAO,mBAAmB,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;gBAC1F,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,cAAc;gBACtC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;aACrB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/domain/identity/sign-out.d.ts

@@ -0,0 +1,20 @@
+import type { IdGenerator } from '@aeolus-fleet/common';
+import { type LeaseTx } from '../registry/public.js';
+import type { Caller } from '../shared/caller.js';
+import type { Clock } from '../shared/clock.js';
+import type { UnitOfWork } from '../shared/unit-of-work.js';
+import type { ConsoleSessionRepository } from './ports.js';
+export interface SignOutTx extends LeaseTx {
+    consoleSessions: ConsoleSessionRepository;
+}
+export type SignOut = (caller: Caller) => Promise<void>;
+/**
+ * Use case: ends the caller's console session and releases the lease on `argo`
+ * it holds; a viewer session holds none. Signing out twice, or without a
+ * console session, changes nothing.
+ */
+export declare function createSignOut(deps: {
+    uow: UnitOfWork<SignOutTx>;
+    clock: Clock;
+    ids: IdGenerator;
+}): SignOut;

package/dist/domain/identity/sign-out.js

@@ -0,0 +1,32 @@
+import { endLease } from '../registry/public.js';
+import { shipActor } from '../shared/events.js';
+import { ok } from '../shared/result.js';
+/**
+ * Use case: ends the caller's console session and releases the lease on `argo`
+ * it holds; a viewer session holds none. Signing out twice, or without a
+ * console session, changes nothing.
+ */
+export function createSignOut(deps) {
+    return async (caller) => {
+        const { consoleSessionId } = caller;
+        if (consoleSessionId === undefined) {
+            return;
+        }
+        await deps.uow.run(async (tx) => {
+            const at = deps.clock.now();
+            const session = await tx.consoleSessions.end({ fleetId: caller.fleetId, consoleSessionId, at, reason: 'signedOut' });
+            // A viewer session holds no lease (decision 0022): ending it is all.
+            if (session?.leaseId != null) {
+                await endLease({ tx, ids: deps.ids }, {
+                    fleetId: session.fleetId,
+                    leaseId: session.leaseId,
+                    actor: shipActor(session.shipId),
+                    at,
+                    reason: 'signedOut',
+                });
+            }
+            return ok(undefined);
+        });
+    };
+}
+//# sourceMappingURL=sign-out.js.map

package/dist/domain/identity/sign-out.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-out.js","sourceRoot":"","sources":["../../../src/domain/identity/sign-out.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAgB,MAAM,uBAAuB,CAAC;AAG/D,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAUzC;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAoE;IAChG,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE;QACtB,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;QACpC,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACrH,qEAAqE;YACrE,IAAI,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC7B,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE;oBACpC,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC;oBAChC,EAAE;oBACF,MAAM,EAAE,WAAW;iBACpB,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/domain/identity/start-console-session.d.ts

@@ -0,0 +1,27 @@
+import type { FleetId, IdGenerator } from '@aeolus-fleet/common';
+import { type LeaseTx, type ShipTx } from '../registry/public.js';
+import type { DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { RandomTokens, SecretHasher } from '../shared/secrets.js';
+import type { ConsoleSessionRepository } from './ports.js';
+import type { SignedIn } from './sign-in.js';
+export interface StartConsoleSessionTx extends LeaseTx, ShipTx {
+    consoleSessions: ConsoleSessionRepository;
+}
+/**
+ * Starts the operator's console session crewing the fleet's argo (ADR 0012),
+ * in the caller's unit of work, however the operator proved who they are: a
+ * password or a sign-in ticket. It ends the previous console session and
+ * takes argo's lease over, so what argo held in flight returns to pending.
+ * The session records the device it signed in from, also argo's location.
+ */
+export declare function startConsoleSession(deps: {
+    tx: StartConsoleSessionTx;
+    ids: IdGenerator;
+    hasher: SecretHasher;
+    random: RandomTokens;
+}, input: {
+    fleetId: FleetId;
+    device: string;
+    at: Date;
+}): Promise<Result<SignedIn, DomainError<'FLEET_NOT_FOUND' | 'NOT_THE_OPERATOR_SHIP'>>>;

package/dist/domain/identity/start-console-session.js

@@ -0,0 +1,54 @@
+import { findOperatorShip, takeOverOperatorLease } from '../registry/public.js';
+import { shipActor } from '../shared/events.js';
+import { ok } from '../shared/result.js';
+import { CONSOLE_SESSION_IDLE_LIMIT_MS, consoleLocation, consoleSessionExpiry } from './console-session.js';
+/**
+ * Starts the operator's console session crewing the fleet's argo (ADR 0012),
+ * in the caller's unit of work, however the operator proved who they are: a
+ * password or a sign-in ticket. It ends the previous console session and
+ * takes argo's lease over, so what argo held in flight returns to pending.
+ * The session records the device it signed in from, also argo's location.
+ */
+export async function startConsoleSession(deps, input) {
+    const { tx, ids } = deps;
+    const { fleetId, device, at } = input;
+    const found = await findOperatorShip(tx, fleetId);
+    if (!found.isOk) {
+        return found;
+    }
+    const argo = found.value;
+    // Only argo's sessions: viewer sessions run beside the operator's (decision 0022).
+    await tx.consoleSessions.endAll({ fleetId: argo.fleetId, shipId: argo.id }, { at, reason: 'takenOver' });
+    const takenOver = await takeOverOperatorLease({ tx, ids }, {
+        fleetId: argo.fleetId,
+        shipId: argo.id,
+        kind: argo.kind,
+        location: consoleLocation(device),
+        actor: shipActor(argo.id),
+        at,
+    });
+    if (!takenOver.isOk) {
+        return takenOver;
+    }
+    const token = deps.random.next();
+    const consoleSessionId = ids('consoleSession');
+    const expiresAt = consoleSessionExpiry(at);
+    await tx.consoleSessions.create({
+        id: consoleSessionId,
+        fleetId: argo.fleetId,
+        shipId: argo.id,
+        leaseId: takenOver.value,
+        idleLimitMs: CONSOLE_SESSION_IDLE_LIMIT_MS,
+        endsBy: null,
+        device,
+        tokenHash: deps.hasher.hash(token),
+        createdAt: at,
+        lastUsedAt: at,
+        expiresAt,
+        endedAt: null,
+        endReason: null,
+    });
+    const caller = { shipId: argo.id, fleetId: argo.fleetId, kind: argo.kind, scopes: argo.scopes, consoleSessionId };
+    return ok({ token, consoleSessionId, expiresAt, caller });
+}
+//# sourceMappingURL=start-console-session.js.map

package/dist/domain/identity/start-console-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"start-console-session.js","sourceRoot":"","sources":["../../../src/domain/identity/start-console-session.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAA6B,MAAM,uBAAuB,CAAC;AAG3G,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,6BAA6B,EAAE,eAAe,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAQ5G;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAiG,EACjG,KAAqD;IAErD,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;IAEzB,mFAAmF;IACnF,MAAM,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IACzG,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE;QACzD,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,eAAe,CAAC,MAAM,CAAC;QACjC,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,EAAE;KACH,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACjC,MAAM,gBAAgB,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC3C,MAAM,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC;QAC9B,EAAE,EAAE,gBAAgB;QACpB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,OAAO,EAAE,SAAS,CAAC,KAAK;QACxB,WAAW,EAAE,6BAA6B;QAC1C,MAAM,EAAE,IAAI;QACZ,MAAM;QACN,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAClC,SAAS,EAAE,EAAE;QACb,UAAU,EAAE,EAAE;QACd,SAAS;QACT,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAW,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC1H,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;AAC5D,CAAC"}

package/dist/domain/identity/start-viewer-session.d.ts

@@ -0,0 +1,29 @@
+import type { FleetId, IdGenerator } from '@aeolus-fleet/common';
+import { type ShipTx } from '../registry/public.js';
+import type { DomainError } from '../shared/errors.js';
+import { type EventLog } from '../shared/events.js';
+import { type Result } from '../shared/result.js';
+import type { RandomTokens, SecretHasher } from '../shared/secrets.js';
+import type { ConsoleSessionRepository } from './ports.js';
+import type { SignedIn } from './sign-in.js';
+export interface StartViewerSessionTx extends ShipTx {
+    consoleSessions: ConsoleSessionRepository;
+    events: EventLog;
+}
+/**
+ * Starts a viewer session on the fleet's viewer ship (decision 0022), in the
+ * caller's unit of work: it holds no lease and ends no other session, so many
+ * people view at once, and the operator's session is untouched. Valid 2 hours
+ * after its last use, never past 24 hours after it started. Writes
+ * ViewerSessionStarted, by the viewer ship, with the device.
+ */
+export declare function startViewerSession(deps: {
+    tx: StartViewerSessionTx;
+    ids: IdGenerator;
+    hasher: SecretHasher;
+    random: RandomTokens;
+}, input: {
+    fleetId: FleetId;
+    device: string;
+    at: Date;
+}): Promise<Result<SignedIn, DomainError<'FLEET_HAS_NO_VIEWER'>>>;

package/dist/domain/identity/start-viewer-session.js

@@ -0,0 +1,42 @@
+import { findViewerShip } from '../registry/public.js';
+import { recordEvent, shipActor } from '../shared/events.js';
+import { ok } from '../shared/result.js';
+import { viewerSessionTimes } from './console-session.js';
+/**
+ * Starts a viewer session on the fleet's viewer ship (decision 0022), in the
+ * caller's unit of work: it holds no lease and ends no other session, so many
+ * people view at once, and the operator's session is untouched. Valid 2 hours
+ * after its last use, never past 24 hours after it started. Writes
+ * ViewerSessionStarted, by the viewer ship, with the device.
+ */
+export async function startViewerSession(deps, input) {
+    const { tx, ids } = deps;
+    const { fleetId, device, at } = input;
+    const found = await findViewerShip(tx, fleetId);
+    if (!found.isOk) {
+        return found;
+    }
+    const viewer = found.value;
+    const token = deps.random.next();
+    const consoleSessionId = ids('consoleSession');
+    const { idleLimitMs, endsBy, expiresAt } = viewerSessionTimes(at);
+    await tx.consoleSessions.create({
+        id: consoleSessionId,
+        fleetId,
+        shipId: viewer.id,
+        leaseId: null,
+        idleLimitMs,
+        endsBy,
+        device,
+        tokenHash: deps.hasher.hash(token),
+        createdAt: at,
+        lastUsedAt: at,
+        expiresAt,
+        endedAt: null,
+        endReason: null,
+    });
+    await recordEvent({ events: tx.events, ids }, { fleetId, type: 'ViewerSessionStarted', occurredAt: at, actor: shipActor(viewer.id), shipId: viewer.id, details: { device } });
+    const caller = { shipId: viewer.id, fleetId, kind: viewer.kind, scopes: viewer.scopes, consoleSessionId };
+    return ok({ token, consoleSessionId, expiresAt, caller });
+}
+//# sourceMappingURL=start-viewer-session.js.map

package/dist/domain/identity/start-viewer-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"start-viewer-session.js","sourceRoot":"","sources":["../../../src/domain/identity/start-viewer-session.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAe,MAAM,uBAAuB,CAAC;AAGpE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAiB,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAS1D;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAgG,EAChG,KAAqD;IAErD,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAChB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC;IAE3B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACjC,MAAM,gBAAgB,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC;IAC/C,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAClE,MAAM,EAAE,CAAC,eAAe,CAAC,MAAM,CAAC;QAC9B,EAAE,EAAE,gBAAgB;QACpB,OAAO;QACP,MAAM,EAAE,MAAM,CAAC,EAAE;QACjB,OAAO,EAAE,IAAI;QACb,WAAW;QACX,MAAM;QACN,MAAM;QACN,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;QAClC,SAAS,EAAE,EAAE;QACb,UAAU,EAAE,EAAE;QACd,SAAS;QACT,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;IACH,MAAM,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAE9K,MAAM,MAAM,GAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAClH,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;AAC5D,CAAC"}

package/dist/domain/messaging/acknowledge-delivery.d.ts

@@ -0,0 +1,30 @@
+import type { DeliveryId, IdGenerator } from '@aeolus-fleet/common';
+import type { Crew } from '../shared/caller.js';
+import type { Clock } from '../shared/clock.js';
+import { type DomainError } from '../shared/errors.js';
+import { type EventLog } from '../shared/events.js';
+import { type Result } from '../shared/result.js';
+import type { UnitOfWork } from '../shared/unit-of-work.js';
+import { type AcknowledgeRefusal } from './delivery.js';
+import type { DeliveryRepository } from './ports.js';
+export interface AcknowledgeDeliveryTx {
+    deliveries: Pick<DeliveryRepository, 'findForUpdate' | 'update'>;
+    events: EventLog;
+}
+export type AcknowledgeDeliveryRefusal = DomainError<'DELIVERY_NOT_FOUND'> | AcknowledgeRefusal;
+export type AcknowledgeDelivery = (crew: Crew, input: {
+    deliveryId: DeliveryId;
+}) => Promise<Result<undefined, AcknowledgeDeliveryRefusal>>;
+/**
+ * Use case: the ship acknowledges a delivery it received (`ack`), as soon as
+ * it receives it (ADR 0001). Its scope (messages:receive) is checked before
+ * this runs. The delivery, locked, moves to acknowledged with
+ * DeliveryAcknowledged in one unit of work, only while it is in flight with
+ * the calling ship; a second ack by that ship is OK and changes nothing. The
+ * lock makes an ack and a receive of the same delivery take turns.
+ */
+export declare function createAcknowledgeDelivery(deps: {
+    uow: UnitOfWork<AcknowledgeDeliveryTx>;
+    clock: Clock;
+    ids: IdGenerator;
+}): AcknowledgeDelivery;

package/dist/domain/messaging/acknowledge-delivery.js

@@ -0,0 +1,31 @@
+import { refuse } from '../shared/errors.js';
+import { recordEvent } from '../shared/events.js';
+import { ok } from '../shared/result.js';
+import { acknowledgeDelivery } from './delivery.js';
+/**
+ * Use case: the ship acknowledges a delivery it received (`ack`), as soon as
+ * it receives it (ADR 0001). Its scope (messages:receive) is checked before
+ * this runs. The delivery, locked, moves to acknowledged with
+ * DeliveryAcknowledged in one unit of work, only while it is in flight with
+ * the calling ship; a second ack by that ship is OK and changes nothing. The
+ * lock makes an ack and a receive of the same delivery take turns.
+ */
+export function createAcknowledgeDelivery(deps) {
+    return (crew, input) => deps.uow.run(async (tx) => {
+        const delivery = await tx.deliveries.findForUpdate(crew.fleetId, input.deliveryId);
+        if (!delivery) {
+            return refuse('DELIVERY_NOT_FOUND', `Delivery ${input.deliveryId} does not exist`);
+        }
+        const acknowledged = acknowledgeDelivery(delivery, { crew, at: deps.clock.now() });
+        if (!acknowledged.isOk) {
+            return acknowledged;
+        }
+        const { delivery: changed, events } = acknowledged.value;
+        await tx.deliveries.update(changed);
+        for (const event of events) {
+            await recordEvent({ events: tx.events, ids: deps.ids }, event);
+        }
+        return ok(undefined);
+    });
+}
+//# sourceMappingURL=acknowledge-delivery.js.map

package/dist/domain/messaging/acknowledge-delivery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"acknowledge-delivery.js","sourceRoot":"","sources":["../../../src/domain/messaging/acknowledge-delivery.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAiB,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,mBAAmB,EAA2B,MAAM,eAAe,CAAC;AAe7E;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAIzC;IACC,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACrB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAA0D,EAAE;QAChF,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,MAAM,CAAC,oBAAoB,EAAE,YAAY,KAAK,CAAC,UAAU,iBAAiB,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,YAAY,GAAG,mBAAmB,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;YACvB,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC;QACzD,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/domain/messaging/answer-ping.d.ts

@@ -0,0 +1,33 @@
+import type { DeliveryId, IdGenerator } from '@aeolus-fleet/common';
+import type { LeaseRepository } from '../registry/public.js';
+import type { Crew } from '../shared/caller.js';
+import type { Clock } from '../shared/clock.js';
+import { type DomainError } from '../shared/errors.js';
+import { type EventLog } from '../shared/events.js';
+import { type Result } from '../shared/result.js';
+import type { UnitOfWork } from '../shared/unit-of-work.js';
+import { type AnswerPingRefusal } from './delivery.js';
+import type { DeliveryRepository, MessageRepository } from './ports.js';
+export interface AnswerPingTx {
+    deliveries: Pick<DeliveryRepository, 'findForUpdate' | 'update'>;
+    messages: Pick<MessageRepository, 'find'>;
+    leases: Pick<LeaseRepository, 'markSeen'>;
+    events: EventLog;
+}
+export type AnswerPingDeliveryRefusal = DomainError<'DELIVERY_NOT_FOUND'> | AnswerPingRefusal;
+export type AnswerPing = (crew: Crew, input: {
+    deliveryId: DeliveryId;
+}) => Promise<Result<undefined, AnswerPingDeliveryRefusal>>;
+/**
+ * Use case: the ship answers a ping (`pong`), proving its session's model
+ * read it. Its scope (messages:receive) is checked before this runs. The ping
+ * delivery, locked, is acknowledged with DeliveryAcknowledged saying pong
+ * answered it, and the crew's lease is marked last seen at that moment: one
+ * unit of work, so both are stored or neither. Answering again changes
+ * nothing.
+ */
+export declare function createAnswerPing(deps: {
+    uow: UnitOfWork<AnswerPingTx>;
+    clock: Clock;
+    ids: IdGenerator;
+}): AnswerPing;

package/dist/domain/messaging/answer-ping.js

@@ -0,0 +1,37 @@
+import { refuse } from '../shared/errors.js';
+import { recordEvent } from '../shared/events.js';
+import { ok } from '../shared/result.js';
+import { answerPing } from './delivery.js';
+/**
+ * Use case: the ship answers a ping (`pong`), proving its session's model
+ * read it. Its scope (messages:receive) is checked before this runs. The ping
+ * delivery, locked, is acknowledged with DeliveryAcknowledged saying pong
+ * answered it, and the crew's lease is marked last seen at that moment: one
+ * unit of work, so both are stored or neither. Answering again changes
+ * nothing.
+ */
+export function createAnswerPing(deps) {
+    return (crew, input) => deps.uow.run(async (tx) => {
+        const delivery = await tx.deliveries.findForUpdate(crew.fleetId, input.deliveryId);
+        const message = delivery && (await tx.messages.find(crew.fleetId, delivery.messageId));
+        if (!delivery || !message) {
+            return refuse('DELIVERY_NOT_FOUND', `Delivery ${input.deliveryId} does not exist`);
+        }
+        const at = deps.clock.now();
+        const answered = answerPing(delivery, { message, crew, at });
+        if (!answered.isOk) {
+            return answered;
+        }
+        const { delivery: changed, events } = answered.value;
+        if (events.length === 0) {
+            return ok(undefined);
+        }
+        await tx.deliveries.update(changed);
+        await tx.leases.markSeen({ fleetId: crew.fleetId, leaseId: crew.leaseId, at });
+        for (const event of events) {
+            await recordEvent({ events: tx.events, ids: deps.ids }, event);
+        }
+        return ok(undefined);
+    });
+}
+//# sourceMappingURL=answer-ping.js.map

package/dist/domain/messaging/answer-ping.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"answer-ping.js","sourceRoot":"","sources":["../../../src/domain/messaging/answer-ping.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAiB,MAAM,qBAAqB,CAAC;AACjE,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,UAAU,EAA0B,MAAM,eAAe,CAAC;AAiBnE;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAuE;IACtG,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACrB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAyD,EAAE;QAC/E,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACnF,MAAM,OAAO,GAAG,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QACvF,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1B,OAAO,MAAM,CAAC,oBAAoB,EAAE,YAAY,KAAK,CAAC,UAAU,iBAAiB,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC;QACrD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC;QACD,MAAM,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/E,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/domain/messaging/check-inbox.d.ts

@@ -0,0 +1,33 @@
+import { type HoldLeaseTx, type LeaseEnded } from '../registry/public.js';
+import type { Crew } from '../shared/caller.js';
+import type { Clock } from '../shared/clock.js';
+import type { DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { UnitOfWork } from '../shared/unit-of-work.js';
+import type { DeliveryRepository, ReceiverWakeups } from './ports.js';
+export interface CheckInboxTx extends HoldLeaseTx {
+    deliveries: Pick<DeliveryRepository, 'countReceivable'>;
+}
+export type CheckInboxRefusal = DomainError<'INVALID_INBOX_WAIT' | 'SHIP_NOT_FOUND'> | LeaseEnded;
+export type CheckInbox = (crew: Crew, input: {
+    waitSeconds?: number;
+}) => Promise<Result<{
+    waiting: number;
+}, CheckInboxRefusal>>;
+/**
+ * Use case: how many deliveries wait for the crew (`inbox`): what its next
+ * receive would hand it, its own in flight and those pending for its ship or
+ * its type. It claims nothing, so a watcher can ask as often as it likes and
+ * leave every delivery for the receive. Its scope (messages:receive) is
+ * checked before this runs.
+ *
+ * With a wait, and nothing waiting, it watches the same wake-ups as a
+ * receive and looks again on each, until something waits or the wait has
+ * passed. It starts watching before it looks a second time, so a delivery
+ * that commits in between is counted.
+ */
+export declare function createCheckInbox(deps: {
+    uow: UnitOfWork<CheckInboxTx>;
+    clock: Clock;
+    wakeups: ReceiverWakeups;
+}): CheckInbox;