@aeolus-fleet/core 0.0.0 → 0.19.0

package/dist/domain/registry/ports.d.ts

@@ -0,0 +1,318 @@
+import type { DeliveryId, DeliveryState, FleetId, LeaseId, MessageId, ShipId } from '@aeolus-fleet/common';
+import type { Recipient } from '../shared/selector.js';
+import type { CrewRequest } from './crew-request.js';
+import type { Fleet } from './fleet.js';
+import type { InstallationRequest } from './installation-request.js';
+import type { FleetLimitSettings, InstallationSettings } from './limits.js';
+import type { Lease, Location } from './lease.js';
+import type { Ship } from './ship.js';
+import type { ShipReport } from './ship-report.js';
+/** The crew a report speaks for: its ship and lease, in its fleet. */
+export interface CrewOfLease {
+    fleetId: FleetId;
+    shipId: ShipId;
+    leaseId: LeaseId;
+}
+/** Outbound port: fleets. The only repository whose reads are not scoped to one fleet. */
+export interface FleetRepository {
+    /**
+     * Holds the installation-wide initialisation lock until the unit of work
+     * ends, so two initialisations never both see an installation without fleets.
+     */
+    lockInitialisation(): Promise<void>;
+    count(): Promise<number>;
+    list(): Promise<Fleet[]>;
+    create(fleet: Fleet): Promise<void>;
+    /** The fleet, locked until the unit of work ends, so two deletes of it never both run. */
+    findForUpdate(fleetId: FleetId): Promise<Fleet | undefined>;
+    /**
+     * Deletes the fleet and every record in it, for good: its ships, leases,
+     * secrets, operator account, console sessions and sign-in tickets, messages, deliveries,
+     * events, and the installation's record of the request that created it
+     * (decision 0020).
+     */
+    delete(fleetId: FleetId): Promise<void>;
+    /** How the fleet's limits are set; undefined when there is no such fleet. */
+    limitSettings(fleetId: FleetId): Promise<FleetLimitSettings | undefined>;
+    setLimitSettings(fleetId: FleetId, settings: FleetLimitSettings): Promise<void>;
+}
+/** Outbound port: the installation's settings, one set for the whole installation, not scoped to a fleet (decision 0020). */
+export interface InstallationSettingsRepository {
+    read(): Promise<InstallationSettings>;
+    write(settings: InstallationSettings): Promise<void>;
+}
+/** Outbound port: the installation's requests, by request id; not scoped to a fleet (decision 0020). */
+export interface InstallationRequestRepository {
+    /** Holds the lock on this request id until the unit of work ends, so a request and its replay never both run. */
+    lock(requestId: string): Promise<void>;
+    find(requestId: string): Promise<InstallationRequest | undefined>;
+    record(request: InstallationRequest): Promise<void>;
+}
+/** Outbound port: ships, always within one fleet. */
+export interface ShipRepository {
+    create(ship: Ship): Promise<void>;
+    findOperatorShip(fleetId: FleetId): Promise<Ship | undefined>;
+    /** The fleet's viewer ship, when it has one (decision 0022). */
+    findViewerShip(fleetId: FleetId): Promise<Ship | undefined>;
+    /**
+     * Holds the lock on this name in the fleet until the unit of work ends, so
+     * two commissions of one name never both find it free.
+     */
+    lockName(fleetId: FleetId, name: string): Promise<void>;
+    /** The ship, read without a lock. */
+    find(fleetId: FleetId, shipId: ShipId): Promise<Ship | undefined>;
+    /** The ship of the fleet that is not retired and has this name. */
+    findActiveByName(fleetId: FleetId, name: string): Promise<Ship | undefined>;
+    /**
+     * Holds the lock on this commissioning ship's idempotency key until the unit
+     * of work ends, so two commissions under one key never both find it unused.
+     */
+    lockCommissionKey(key: {
+        fleetId: FleetId;
+        by: ShipId;
+        idempotencyKey: string;
+    }): Promise<void>;
+    /**
+     * Holds the fleet's ship-count lock until the unit of work ends, so two
+     * commissions at the ship limit never both see room for one more.
+     */
+    lockShipCount(fleetId: FleetId): Promise<void>;
+    /** The fleet's ships that are not retired, argo included. */
+    countActive(fleetId: FleetId): Promise<number>;
+    /** The ship this commissioning ship commissioned under this idempotency key, retired or not. */
+    findByCommissionKey(key: {
+        fleetId: FleetId;
+        by: ShipId;
+        idempotencyKey: string;
+    }): Promise<Ship | undefined>;
+    /**
+     * The ship, locked against a second lock until the unit of work ends: a use
+     * case that locks it, such as a new starting prompt, locks it first. Lock
+     * order: the ship, then its credential, then console sessions, then leases.
+     * Rows that only point at the ship can still be written meanwhile. A claim
+     * never locks the ship: it holds the credential, which a prompt holding the
+     * ship waits for, so locking the ship there would deadlock.
+     */
+    findForUpdate(fleetId: FleetId, shipId: ShipId): Promise<Ship | undefined>;
+    /**
+     * The ship a message is addressed to, held until the unit of work ends
+     * against a use case that locks it to change it, such as a retire: that use
+     * case waits for the send and then sees its delivery, or the send waits for
+     * it and then reads the ship as it left it. Many sends to one ship hold it
+     * at once.
+     */
+    findForShare(fleetId: FleetId, shipId: ShipId): Promise<Ship | undefined>;
+    /** The ship of the fleet that is not retired and has this name, held as {@link findForShare} holds it. */
+    findActiveByNameForShare(fleetId: FleetId, name: string): Promise<Ship | undefined>;
+    /** Whether at least one ship of the fleet with this type is not retired and receives: the viewer ship receives nothing (decision 0022). */
+    hasActiveShipOfType(fleetId: FleetId, type: string): Promise<boolean>;
+    /** Gives the ship a new name. */
+    rename(change: {
+        fleetId: FleetId;
+        shipId: ShipId;
+        name: string;
+    }): Promise<void>;
+    /** Marks the ship retired at `at`: never claimed or addressed again, its name free. */
+    retire(change: {
+        fleetId: FleetId;
+        shipId: ShipId;
+        at: Date;
+    }): Promise<void>;
+}
+/** Outbound port: leases, always within one fleet. */
+export interface LeaseRepository {
+    /** The ship's open lease, locked until the unit of work ends. */
+    findOpenForUpdate(fleetId: FleetId, shipId: ShipId): Promise<Lease | undefined>;
+    /**
+     * The lease if it is still open, held until the unit of work ends against a
+     * use case that ends it, such as a release or a takeover: that one waits for
+     * this unit of work, then finds what it wrote. Many units of work hold one
+     * lease at once.
+     */
+    findOpenByIdForShare(fleetId: FleetId, leaseId: LeaseId): Promise<Lease | undefined>;
+    /** The ship's open lease, held as {@link findOpenByIdForShare} holds it. */
+    findOpenForShare(fleetId: FleetId, shipId: ShipId): Promise<Lease | undefined>;
+    open(lease: Lease): Promise<void>;
+    /**
+     * Marks the lease last seen `at`, as a call by its crew does, keeping a
+     * later mark: two overlapping writes never move it back.
+     */
+    markSeen(seen: {
+        fleetId: FleetId;
+        leaseId: LeaseId;
+        at: Date;
+    }): Promise<void>;
+    /** The lease's report, the lease locked until the unit of work ends; undefined once it has ended. */
+    findReportForUpdate(fleetId: FleetId, leaseId: LeaseId): Promise<{
+        report: ShipReport | null;
+    } | undefined>;
+    saveReport(change: {
+        fleetId: FleetId;
+        leaseId: LeaseId;
+        report: ShipReport;
+    }): Promise<void>;
+    /**
+     * The lease's report and the last report of the lease its ship held before
+     * it, the one that ended last; undefined once this lease has ended.
+     */
+    findReportLog(fleetId: FleetId, leaseId: LeaseId): Promise<{
+        report: ShipReport | null;
+        previousCrew: ShipReport | null;
+    } | undefined>;
+    /** Ends the lease if it is still open and returns it; undefined when it had already ended. */
+    end(change: {
+        fleetId: FleetId;
+        leaseId: LeaseId;
+        endedAt: Date;
+    }): Promise<Lease | undefined>;
+}
+/**
+ * Outbound port: crew requests, at most one per ship, always within one
+ * fleet. A use case that changes one locks its ship first.
+ */
+export interface CrewRequestRepository {
+    find(fleetId: FleetId, shipId: ShipId): Promise<CrewRequest | undefined>;
+    /** Stores the ship's request, replacing the one it held. */
+    save(request: CrewRequest): Promise<void>;
+    remove(fleetId: FleetId, shipId: ShipId): Promise<void>;
+    /** The requests assigned to this trierarch ship, oldest ship first. */
+    listAssignedTo(fleetId: FleetId, trierarchShipId: ShipId): Promise<CrewRequest[]>;
+}
+/** A delivery a lease held in flight, pending again: which one, the message it carries, who it is for and its claims so far. */
+export interface ReturnedDelivery {
+    deliveryId: DeliveryId;
+    messageId: MessageId;
+    /** The ship or the type it is pending for again. */
+    recipient: Recipient;
+    attempts: number;
+}
+/**
+ * Outbound port: the deliveries a lease holds in flight. Registry's need,
+ * stated in its own words, so it never reaches into Messaging.
+ */
+export interface InFlightDeliveries {
+    /**
+     * Returns every delivery the lease holds in flight to pending and lists
+     * them, oldest first. Only the claim is cleared: the recipient stays, so a
+     * delivery to the ship is back in its inbox and one to a type back in that
+     * type's queue, and its attempts stay, so the fifth claim still stops it.
+     */
+    returnToPending(fleetId: FleetId, leaseId: LeaseId): Promise<ReturnedDelivery[]>;
+    /**
+     * Abandons every delivery pending for the ship itself and lists them,
+     * oldest first. Deliveries to its type stay, for the other ships of the
+     * type; an undeliverable one stays for the operator.
+     */
+    abandonPendingTo(fleetId: FleetId, shipId: ShipId): Promise<AbandonedDelivery[]>;
+}
+/** A delivery to a ship that was retired before taking it. */
+export interface AbandonedDelivery {
+    deliveryId: DeliveryId;
+    messageId: MessageId;
+}
+/** What the fleet listing reads about one ship: the ship, the lease of the session crewing it, and its valid secret. */
+export interface ShipFacts {
+    ship: Ship;
+    /**
+     * Where the session holding the ship's open lease runs, since when, and its
+     * last call (its claim until it calls again); null while no session crews it.
+     */
+    openLease: {
+        location: Location;
+        harness: string | null;
+        startedAt: Date;
+        lastSeenAt: Date;
+        report: ShipReport | null;
+    } | null;
+    /** When the ship's valid secret was issued and claimed; null when it holds none. */
+    validSecret: {
+        issuedAt: Date;
+        claimedAt: Date | null;
+    } | null;
+    /** The ship's crew request; null when it holds none. */
+    crewRequest: CrewRequest | null;
+    /** The trierarch ship its crew request is assigned to, by id and name; null while unassigned or without a request. */
+    crewRequestAssignee: {
+        id: ShipId;
+        name: string;
+    } | null;
+    /**
+     * The ship that got the starting prompt the open lease claimed with, by id
+     * and name: the actor of the ship's last StartingPromptIssued before the
+     * lease started. Null while no session crews it, or when no prompt is known.
+     */
+    crewedBy: {
+        id: ShipId;
+        name: string;
+    } | null;
+    /**
+     * The newest ping to the ship: when it was sent, its delivery's state, and
+     * when pong answered it, if pong did; null before any ping.
+     */
+    lastPing: {
+        sentAt: Date;
+        deliveryState: DeliveryState;
+        answeredWithPongAt: Date | null;
+    } | null;
+    /** The last model the ship's sessions stated on a send, and when, resends left out; null before any. */
+    lastModel: {
+        id: string;
+        statedAt: Date;
+    } | null;
+    /** The viewer ship's: when one of its viewer sessions, which hold no lease, was last used; null before any (decision 0022). */
+    lastViewedAt: Date | null;
+    /** When the ship's last ended lease ended (a release, deregister or takeover); null before any. */
+    lastLeaseEndedAt: Date | null;
+}
+/**
+ * Outbound port: every ship of the fleet with its lease and secret, read in one
+ * query, oldest ship first. Registry's need for secret dates, stated in its own
+ * words, so it never reaches into Identity.
+ */
+/** A fleet as the installation sees it (docs/architecture.md, "Installation"). */
+export interface InstallationFleetFacts {
+    fleetId: FleetId;
+    name: string;
+    operatorEmail: string;
+    createdAt: Date;
+    /** Its ships that are not retired, argo included. */
+    shipCount: number;
+    /** Every message stored in the fleet at or after the given time, whatever its kind or sender. */
+    messagesSince: number;
+    /** The time of its newest event of any kind; null before any. */
+    lastActivityAt: Date | null;
+    /** The UTF-8 bytes of every message payload it ever stored. */
+    storage: number;
+    /** The messages it stored on each UTC day (YYYY-MM-DD) from the window's first day on; a day without any is left out. */
+    messagesPerUtcDay: {
+        date: string;
+        count: number;
+    }[];
+    /** How its limits are set. */
+    limitSettings: FleetLimitSettings;
+}
+/** What a read of the installation's fleets counts messages over: since a moment, and per UTC day from a first day. */
+export interface InstallationFleetWindow {
+    since: Date;
+    firstDay: Date;
+}
+/** Outbound port: the fleets read across the installation; reachable only with the installation token. */
+export interface InstallationFleets {
+    /** Every fleet, oldest first, counting its messages over the window. */
+    list(window: InstallationFleetWindow): Promise<InstallationFleetFacts[]>;
+    find(fleetId: FleetId, window: InstallationFleetWindow): Promise<InstallationFleetFacts | undefined>;
+}
+export interface FleetListing {
+    ships(fleetId: FleetId): Promise<ShipFacts[]>;
+    /** One ship of the fleet, read the same way; undefined when the fleet has no such ship. */
+    ship(fleetId: FleetId, shipId: ShipId): Promise<ShipFacts | undefined>;
+    /**
+     * The ship's deliveries as its page counts them: in flight with it (what a
+     * release returns) and its direct ones pending or in flight (what a retire
+     * abandons).
+     */
+    deliveryCounts(fleetId: FleetId, shipId: ShipId): Promise<{
+        inFlight: number;
+        open: number;
+    }>;
+}

package/dist/domain/registry/ports.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ports.js.map

package/dist/domain/registry/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.js","sourceRoot":"","sources":["../../../src/domain/registry/ports.ts"],"names":[],"mappings":""}

package/dist/domain/registry/public.d.ts

@@ -0,0 +1,8 @@
+export { location, refuseEndedLease, type Lease, type LeaseEnded, type LeaseEndReason, type Location } from './lease.js';
+export { endLease, holdLease, takeOverOperatorLease, type HoldLeaseTx, type LeaseTx } from './leases.js';
+export type { InFlightDeliveries, LeaseRepository, ShipRepository } from './ports.js';
+export { findPingableShip, type PingableShipTx, type UnpingableShip } from './pingable-ship.js';
+export { resolveSelector, type ResolveSelectorTx, type UnresolvableSelector } from './resolve-selector.js';
+export { findOperatorShip, findShip, findViewerShip, type FindShipTx, type ShipTx } from './ships.js';
+export { OPERATOR_SHIP_NAME, type Ship } from './ship.js';
+export { appliedLimits, type AppliedLimitsTx } from './applied-limits.js';

package/dist/domain/registry/public.js

@@ -0,0 +1,10 @@
+// Registry's published surface: what other contexts may use. Use cases are not
+// part of it; adapters import them from their own modules.
+export { location, refuseEndedLease } from './lease.js';
+export { endLease, holdLease, takeOverOperatorLease } from './leases.js';
+export { findPingableShip } from './pingable-ship.js';
+export { resolveSelector } from './resolve-selector.js';
+export { findOperatorShip, findShip, findViewerShip } from './ships.js';
+export { OPERATOR_SHIP_NAME } from './ship.js';
+export { appliedLimits } from './applied-limits.js';
+//# sourceMappingURL=public.js.map

package/dist/domain/registry/public.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public.js","sourceRoot":"","sources":["../../../src/domain/registry/public.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,2DAA2D;AAC3D,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAmE,MAAM,YAAY,CAAC;AACzH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,qBAAqB,EAAkC,MAAM,aAAa,CAAC;AAEzG,OAAO,EAAE,gBAAgB,EAA4C,MAAM,oBAAoB,CAAC;AAChG,OAAO,EAAE,eAAe,EAAqD,MAAM,uBAAuB,CAAC;AAC3G,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,cAAc,EAAgC,MAAM,YAAY,CAAC;AACtG,OAAO,EAAE,kBAAkB,EAAa,MAAM,WAAW,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAwB,MAAM,qBAAqB,CAAC"}

package/dist/domain/registry/read-assigned-crew-requests.d.ts

@@ -0,0 +1,14 @@
+import type { Caller } from '../shared/caller.js';
+import type { CrewRequest } from './crew-request.js';
+import type { CrewRequestRepository } from './ports.js';
+/** A crew request as its trierarch reads it: which ship, with what settings, and how it stands. */
+export type AssignedCrewRequest = Pick<CrewRequest, 'shipId' | 'settings' | 'settingsVersion' | 'requestedAt' | 'status'>;
+export type ReadAssignedCrewRequests = (caller: Caller) => Promise<AssignedCrewRequest[]>;
+/**
+ * Use case: a trierarch reads the crew requests assigned to its ship, oldest
+ * ship first: its ships are this query, never a list kept on its ship
+ * (decision 0029). Its scope (crew:run) is checked before this runs.
+ */
+export declare function createReadAssignedCrewRequests(deps: {
+    crewRequests: Pick<CrewRequestRepository, 'listAssignedTo'>;
+}): ReadAssignedCrewRequests;

package/dist/domain/registry/read-assigned-crew-requests.js

@@ -0,0 +1,15 @@
+/**
+ * Use case: a trierarch reads the crew requests assigned to its ship, oldest
+ * ship first: its ships are this query, never a list kept on its ship
+ * (decision 0029). Its scope (crew:run) is checked before this runs.
+ */
+export function createReadAssignedCrewRequests(deps) {
+    return async (caller) => (await deps.crewRequests.listAssignedTo(caller.fleetId, caller.shipId)).map(({ shipId, settings, settingsVersion, requestedAt, status }) => ({
+        shipId,
+        settings,
+        settingsVersion,
+        requestedAt,
+        status,
+    }));
+}
+//# sourceMappingURL=read-assigned-crew-requests.js.map

package/dist/domain/registry/read-assigned-crew-requests.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-assigned-crew-requests.js","sourceRoot":"","sources":["../../../src/domain/registry/read-assigned-crew-requests.ts"],"names":[],"mappings":"AASA;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAAC,IAAqE;IAClH,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE,CACtB,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3I,MAAM;QACN,QAAQ;QACR,eAAe;QACf,WAAW;QACX,MAAM;KACP,CAAC,CAAC,CAAC;AACR,CAAC"}

package/dist/domain/registry/recrew-ship.d.ts

@@ -0,0 +1,33 @@
+import type { IdGenerator, ShipId } from '@aeolus-fleet/common';
+import { type SecretTools } from '../identity/public.js';
+import type { Caller } from '../shared/caller.js';
+import type { Clock } from '../shared/clock.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { UnitOfWork } from '../shared/unit-of-work.js';
+import { type LeaseTx } from './leases.js';
+import type { ShipRepository } from './ports.js';
+import type { ReleaseShipTx } from './release-ship.js';
+import { type ReleaseRefusal } from './ship.js';
+import { type IssuedStartingPrompt, type StartingPromptTx } from './starting-prompt.js';
+export type RecrewShipTx = ReleaseShipTx & StartingPromptTx & LeaseTx & {
+    ships: ShipRepository;
+};
+export type RecrewShipRefusal = DomainError<'SHIP_NOT_FOUND'> | ReleaseRefusal;
+export type RecrewShip = (caller: Caller, input: {
+    shipId: ShipId;
+}) => Promise<Result<IssuedStartingPrompt, RecrewShipRefusal>>;
+/**
+ * Use case: a new crew for a crewed ship whose session is gone (Re-crew): a
+ * release, then a new starting prompt, in one unit of work. No rule of its
+ * own: the session crewing the ship loses it, its crew token and secret stop
+ * working, what it held in flight returns to pending, and a new secret is
+ * issued, shown once. Never half done: a refusal or a failure leaves the ship crewed as it was. The caller's scope
+ * (fleet:manage) is checked before this runs.
+ */
+export declare function createRecrewShip(deps: {
+    uow: UnitOfWork<RecrewShipTx>;
+    clock: Clock;
+    ids: IdGenerator;
+    secrets: Omit<SecretTools, 'ids'>;
+}): RecrewShip;

package/dist/domain/registry/recrew-ship.js

@@ -0,0 +1,34 @@
+import { revokeShipSecret } from '../identity/public.js';
+import { refuse } from '../shared/errors.js';
+import { shipActor } from '../shared/events.js';
+import { ok } from '../shared/result.js';
+import { endLease } from './leases.js';
+import { checkCanRelease } from './ship.js';
+import { issueStartingPrompt } from './starting-prompt.js';
+/**
+ * Use case: a new crew for a crewed ship whose session is gone (Re-crew): a
+ * release, then a new starting prompt, in one unit of work. No rule of its
+ * own: the session crewing the ship loses it, its crew token and secret stop
+ * working, what it held in flight returns to pending, and a new secret is
+ * issued, shown once. Never half done: a refusal or a failure leaves the ship crewed as it was. The caller's scope
+ * (fleet:manage) is checked before this runs.
+ */
+export function createRecrewShip(deps) {
+    return (caller, { shipId }) => deps.uow.run(async (tx) => {
+        const { fleetId } = caller;
+        const ship = await tx.ships.findForUpdate(fleetId, shipId);
+        if (!ship) {
+            return refuse('SHIP_NOT_FOUND', `Ship ${shipId} does not exist`);
+        }
+        const actor = shipActor(caller.shipId);
+        const at = deps.clock.now();
+        await revokeShipSecret({ tx, ids: deps.ids }, { fleetId, shipId, actor, at });
+        const lease = checkCanRelease(ship, await tx.leases.findOpenForUpdate(fleetId, shipId));
+        if (!lease.isOk) {
+            return lease;
+        }
+        await endLease({ tx, ids: deps.ids }, { fleetId, leaseId: lease.value.id, actor, at, reason: 'released' });
+        return ok(await issueStartingPrompt({ tx, secrets: { ...deps.secrets, ids: deps.ids } }, { fleetId, shipId, actor, at }));
+    });
+}
+//# sourceMappingURL=recrew-ship.js.map

package/dist/domain/registry/recrew-ship.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recrew-ship.js","sourceRoot":"","sources":["../../../src/domain/registry/recrew-ship.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAoB,MAAM,uBAAuB,CAAC;AAG3E,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,QAAQ,EAAgB,MAAM,aAAa,CAAC;AAGrD,OAAO,EAAE,eAAe,EAAuB,MAAM,WAAW,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAoD,MAAM,sBAAsB,CAAC;AAW7G;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAKhC;IACC,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAA4D,EAAE;QAClF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,MAAM,CAAC,gBAAgB,EAAE,QAAQ,MAAM,iBAAiB,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAE5B,MAAM,gBAAgB,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACxF,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3G,OAAO,EAAE,CACP,MAAM,mBAAmB,CACvB,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EACnD,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAC/B,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/domain/registry/release-ship.d.ts

@@ -0,0 +1,38 @@
+import type { IdGenerator, ShipId } from '@aeolus-fleet/common';
+import { type CredentialTx } from '../identity/public.js';
+import type { Caller } from '../shared/caller.js';
+import type { Clock } from '../shared/clock.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { UnitOfWork } from '../shared/unit-of-work.js';
+import { type LeaseTx } from './leases.js';
+import type { CrewRequestRepository, ShipRepository } from './ports.js';
+import { type ReleaseRefusal } from './ship.js';
+export interface ReleaseShipTx extends LeaseTx, CredentialTx {
+    ships: ShipRepository;
+    crewRequests: Pick<CrewRequestRepository, 'find'>;
+}
+export type ReleaseShipRefusal = DomainError<'SHIP_NOT_FOUND' | 'CREW_REQUEST_NOT_ASSIGNED_TO_CALLER'> | ReleaseRefusal;
+export type ReleaseShip = (caller: Caller, input: {
+    shipId: ShipId;
+}) => Promise<Result<undefined, ReleaseShipRefusal>>;
+/**
+ * Use case: the caller releases a crewed ship of its fleet (Release): the
+ * session crewing it loses it, and the ship awaits a new crew (ADR 0010). In
+ * one unit of work: the secret is invalidated, the lease ends and with it the
+ * crew token, and the deliveries the lease held in flight return to pending,
+ * their attempts kept. The next crew needs a new starting prompt. The caller's
+ * scope (fleet:manage or crew:run) is checked before this runs;
+ * crew:run reaches only the ships whose crew requests are assigned to the
+ * caller's ship.
+ *
+ * Locks in the fleet's order: the ship, then its secret, then its lease. A
+ * receive holding the lease makes the release wait, then the release returns
+ * what the receive claimed. The lease is read last, like a new starting
+ * prompt reads it, and a refusal rolls the revoked secret back.
+ */
+export declare function createReleaseShip(deps: {
+    uow: UnitOfWork<ReleaseShipTx>;
+    clock: Clock;
+    ids: IdGenerator;
+}): ReleaseShip;

package/dist/domain/registry/release-ship.js

@@ -0,0 +1,47 @@
+import { revokeShipSecret } from '../identity/public.js';
+import { refuse } from '../shared/errors.js';
+import { shipActor } from '../shared/events.js';
+import { ok } from '../shared/result.js';
+import { endLease } from './leases.js';
+import { checkReaches } from './crew-request.js';
+import { checkCanRelease } from './ship.js';
+/** The scopes that release every ship; crew:run releases only the ships assigned to the caller's ship. */
+const RELEASE_SCOPES = ['fleet:manage'];
+/**
+ * Use case: the caller releases a crewed ship of its fleet (Release): the
+ * session crewing it loses it, and the ship awaits a new crew (ADR 0010). In
+ * one unit of work: the secret is invalidated, the lease ends and with it the
+ * crew token, and the deliveries the lease held in flight return to pending,
+ * their attempts kept. The next crew needs a new starting prompt. The caller's
+ * scope (fleet:manage or crew:run) is checked before this runs;
+ * crew:run reaches only the ships whose crew requests are assigned to the
+ * caller's ship.
+ *
+ * Locks in the fleet's order: the ship, then its secret, then its lease. A
+ * receive holding the lease makes the release wait, then the release returns
+ * what the receive claimed. The lease is read last, like a new starting
+ * prompt reads it, and a refusal rolls the revoked secret back.
+ */
+export function createReleaseShip(deps) {
+    return (caller, { shipId }) => deps.uow.run(async (tx) => {
+        const { fleetId } = caller;
+        const ship = await tx.ships.findForUpdate(fleetId, shipId);
+        if (!ship) {
+            return refuse('SHIP_NOT_FOUND', `Ship ${shipId} does not exist`);
+        }
+        const reaches = checkReaches(caller, { ship, current: await tx.crewRequests.find(fleetId, shipId), broadScopes: RELEASE_SCOPES });
+        if (!reaches.isOk) {
+            return reaches;
+        }
+        const actor = shipActor(caller.shipId);
+        const at = deps.clock.now();
+        await revokeShipSecret({ tx, ids: deps.ids }, { fleetId, shipId, actor, at });
+        const lease = checkCanRelease(ship, await tx.leases.findOpenForUpdate(fleetId, shipId));
+        if (!lease.isOk) {
+            return lease;
+        }
+        await endLease({ tx, ids: deps.ids }, { fleetId, leaseId: lease.value.id, actor, at, reason: 'released' });
+        return ok(undefined);
+    });
+}
+//# sourceMappingURL=release-ship.js.map

package/dist/domain/registry/release-ship.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-ship.js","sourceRoot":"","sources":["../../../src/domain/registry/release-ship.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAqB,MAAM,uBAAuB,CAAC;AAG5E,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,QAAQ,EAAgB,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAuB,MAAM,WAAW,CAAC;AASjE,0GAA0G;AAC1G,MAAM,cAAc,GAAG,CAAC,cAAc,CAAU,CAAC;AAOjD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAIjC;IACC,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAkD,EAAE;QACxE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,MAAM,CAAC,gBAAgB,EAAE,QAAQ,MAAM,iBAAiB,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC;QAClI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAE5B,MAAM,gBAAgB,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACxF,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3G,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/domain/registry/remove-crew-request.d.ts

@@ -0,0 +1,28 @@
+import type { IdGenerator, ShipId } from '@aeolus-fleet/common';
+import type { Caller } from '../shared/caller.js';
+import type { Clock } from '../shared/clock.js';
+import { type DomainError } from '../shared/errors.js';
+import { type EventLog } from '../shared/events.js';
+import { type Result } from '../shared/result.js';
+import type { UnitOfWork } from '../shared/unit-of-work.js';
+import type { CrewRequestRepository, ShipRepository } from './ports.js';
+export interface RemoveCrewRequestTx {
+    ships: Pick<ShipRepository, 'findForUpdate'>;
+    crewRequests: CrewRequestRepository;
+    events: EventLog;
+}
+export type RemoveCrewRequest = (caller: Caller, input: {
+    shipId: ShipId;
+}) => Promise<Result<undefined, DomainError<'SHIP_NOT_FOUND' | 'CREW_REQUEST_NOT_FOUND'>>>;
+/**
+ * Use case: a requester removes a ship's crew request. Its scope
+ * (fleet:manage) is checked before this runs. In one unit of work, locking the
+ * ship first: an unassigned request goes, with CrewRequestRemoved; an
+ * assigned one is marked releasing, for its trierarch to release the ship and
+ * confirm. A crew aboard without a trierarch stays aboard.
+ */
+export declare function createRemoveCrewRequest(deps: {
+    uow: UnitOfWork<RemoveCrewRequestTx>;
+    clock: Clock;
+    ids: IdGenerator;
+}): RemoveCrewRequest;

package/dist/domain/registry/remove-crew-request.js

@@ -0,0 +1,36 @@
+import { refuse } from '../shared/errors.js';
+import { recordEvent, shipActor } from '../shared/events.js';
+import { ok } from '../shared/result.js';
+import { removeCrewRequest } from './crew-request.js';
+/**
+ * Use case: a requester removes a ship's crew request. Its scope
+ * (fleet:manage) is checked before this runs. In one unit of work, locking the
+ * ship first: an unassigned request goes, with CrewRequestRemoved; an
+ * assigned one is marked releasing, for its trierarch to release the ship and
+ * confirm. A crew aboard without a trierarch stays aboard.
+ */
+export function createRemoveCrewRequest(deps) {
+    return (caller, input) => deps.uow.run(async (tx) => {
+        const ship = await tx.ships.findForUpdate(caller.fleetId, input.shipId);
+        if (!ship) {
+            return refuse('SHIP_NOT_FOUND', `Ship ${input.shipId} does not exist`);
+        }
+        const current = await tx.crewRequests.find(caller.fleetId, ship.id);
+        const removed = removeCrewRequest({ ship, current }, { at: deps.clock.now(), actor: shipActor(caller.shipId) });
+        if (!removed.isOk) {
+            return removed;
+        }
+        const { request } = removed.value;
+        if (request) {
+            await tx.crewRequests.save(request);
+        }
+        else {
+            await tx.crewRequests.remove(caller.fleetId, ship.id);
+        }
+        for (const event of removed.value.events) {
+            await recordEvent({ events: tx.events, ids: deps.ids }, event);
+        }
+        return ok(undefined);
+    });
+}
+//# sourceMappingURL=remove-crew-request.js.map

package/dist/domain/registry/remove-crew-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remove-crew-request.js","sourceRoot":"","sources":["../../../src/domain/registry/remove-crew-request.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAiB,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AActD;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAA8E;IACpH,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CACvB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAwF,EAAE;QAC9G,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,MAAM,CAAC,gBAAgB,EAAE,QAAQ,KAAK,CAAC,MAAM,iBAAiB,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChH,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QAClC,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACzC,MAAM,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACP,CAAC"}