@aeolus-fleet/core 0.20.3 → 0.20.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aeolus-fleet/core",
-  "version": "0.20.3",
+  "version": "0.20.4",
   "description": "Aeolus server: the tRPC API and the fleet domain on Postgres.",
   "license": "Apache-2.0",
   "type": "module",
@@ -42,7 +42,7 @@
     "postpack": "rm LICENSE"
   },
   "dependencies": {
-    "@aeolus-fleet/common": "0.20.3",
+    "@aeolus-fleet/common": "0.20.4",
     "@fastify/websocket": "^11.3.1",
     "@modelcontextprotocol/server": "^2.3.0",
     "@prisma/adapter-pg": "^7.10.0",

package/src/adapters/prisma/migrations/20261009200000_network_scope/migration.sql

@@ -0,0 +1,8 @@
+-- fleet:network (decision 0034): setting the fleet's network rules. argo
+-- holds every scope, so each fleet's argo gets it too.
+ALTER TABLE "ships" DROP CONSTRAINT "ships_scopes_known";
+ALTER TABLE "ships" ADD CONSTRAINT "ships_scopes_known" CHECK (
+  "scopes" IS NOT NULL AND "scopes" <@ ARRAY['messages:send', 'messages:receive', 'fleet:read', 'fleet:manage', 'crew:assign', 'crew:run', 'labels:define', 'labels:assign', 'fleet:network']::TEXT[]
+);
+
+UPDATE "ships" SET "scopes" = array_append("scopes", 'fleet:network') WHERE "kind" = 'operator' AND NOT ('fleet:network' = ANY("scopes"));

package/src/adapters/prisma/migrations/20261009210000_network_rules/migration.sql

@@ -0,0 +1,31 @@
+-- The fleet's network settings and the records of the sends they refused
+-- (decision 0034).
+-- CreateTable
+CREATE TABLE "network_settings" (
+    "fleet_id" TEXT NOT NULL,
+    "rules" JSONB,
+    "version" INTEGER NOT NULL,
+
+    CONSTRAINT "network_settings_pkey" PRIMARY KEY ("fleet_id")
+);
+
+-- CreateTable
+CREATE TABLE "reach_refusals" (
+    "id" TEXT NOT NULL,
+    "fleet_id" TEXT NOT NULL,
+    "at" TIMESTAMPTZ(3) NOT NULL,
+    "sender" JSONB NOT NULL,
+    "recipient" JSONB NOT NULL,
+    "settings_version" INTEGER NOT NULL,
+
+    CONSTRAINT "reach_refusals_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "reach_refusals_fleet_id_at_idx" ON "reach_refusals"("fleet_id", "at");
+
+-- AddForeignKey
+ALTER TABLE "network_settings" ADD CONSTRAINT "network_settings_fleet_id_fkey" FOREIGN KEY ("fleet_id") REFERENCES "fleets"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "reach_refusals" ADD CONSTRAINT "reach_refusals_fleet_id_fkey" FOREIGN KEY ("fleet_id") REFERENCES "fleets"("id") ON DELETE RESTRICT ON UPDATE CASCADE;

package/src/adapters/prisma/migrations/20261009220000_type_delivery_reachable_ships/migration.sql

@@ -0,0 +1,5 @@
+-- A type delivery under network rules keeps the ships of the type its sender
+-- may reach, fixed at send time (decision 0034); empty for any ship of the type,
+-- as every delivery stored before had.
+-- AlterTable
+ALTER TABLE "deliveries" ADD COLUMN     "reachable_ship_ids" TEXT[] DEFAULT ARRAY[]::TEXT[];

package/src/adapters/prisma/schema.prisma

@@ -51,6 +51,8 @@ model Fleet {
   labels           Label[]
   labelValues      LabelValue[]
   shipLabels       ShipLabel[]
+  networkSettings  NetworkSettings?
+  reachRefusals    ReachRefusal[]
   credentials      Credential[]
   messages         Message[]
   deliveries       Delivery[]
@@ -322,6 +324,38 @@ model ShipLabel {
   @@map("ship_labels")
 }
 
+/// A fleet's network settings (decision 0034), once it first set rules: its
+/// rules as JSON, none (null) for all-to-all, and their version. A send and a
+/// set take turns on an advisory lock on them (network.ts).
+model NetworkSettings {
+  fleetId String @id @map("fleet_id")
+  rules   Json?
+  version Int
+
+  fleet Fleet @relation(fields: [fleetId], references: [id])
+
+  @@map("network_settings")
+}
+
+/// A send the network rules refused (decision 0034), recorded in the
+/// transaction that refused it. Ids start with rfs_. Sender and recipient are
+/// as they were then: ids, names and the label values they carried, as JSON,
+/// so a later rename or relabelling keeps the record true. Only argo reads it.
+model ReachRefusal {
+  id              String   @id
+  fleetId         String   @map("fleet_id")
+  at              DateTime @db.Timestamptz(3)
+  sender          Json
+  recipient       Json
+  settingsVersion Int      @map("settings_version")
+
+  fleet Fleet @relation(fields: [fleetId], references: [id])
+
+  /// argo reads the latest first.
+  @@index([fleetId, at])
+  @@map("reach_refusals")
+}
+
 /// A ship secret, stored only as its hash. Ids start with crd_.
 /// The hash is unique across all fleets: finding a ship by its secret is one of the
 /// lookups not scoped by fleet (ADR 0007).
@@ -414,6 +448,9 @@ enum DeliveryState {
 /// is in flight, kept once acknowledged, none while it is pending. Attempts count the
 /// claims; the fifth makes it undeliverable.
 /// The read date is set when the operator opens a message to argo.
+/// For a type under network rules, the ships of the type its sender may reach,
+/// fixed at send time: only they claim it (decision 0034). Empty: any ship of
+/// the type, as a send no ship of the type may take is refused.
 model Delivery {
   id               String        @id
   fleetId          String        @map("fleet_id")
@@ -424,6 +461,7 @@ model Delivery {
   claimedByShipId  String?       @map("claimed_by_ship_id")
   claimedByLeaseId String?       @map("claimed_by_lease_id")
   attempts         Int           @default(0)
+  reachableShipIds String[]      @default([]) @map("reachable_ship_ids")
   readAt           DateTime?     @map("read_at") @db.Timestamptz(3)
   createdAt        DateTime      @map("created_at") @db.Timestamptz(3)