@aeolus-fleet/core 0.26.0 → 0.27.0

package/dist/domain/registry/read-clear-requests.js

@@ -1,14 +1,16 @@
 import { hasScope } from '../shared/caller.js';
+import { readsShip } from './read-reach.js';
 /**
  * Use case: the pending clear requests (decision 0032). A caller with
- * fleet:read reads every trierarch's, so the console shows a worktree
- * clearing; a trierarch with crew:run reads its own. One of the two scopes is
- * checked before this runs.
+ * fleet:read reads every trierarch's for the ships it reads (decision 0034),
+ * so the console shows a worktree clearing; a trierarch with crew:run reads
+ * its own. One of the two scopes is checked before this runs.
  */
 export function createReadClearRequests(deps) {
     return async (caller) => {
-        const requests = hasScope(caller, 'fleet:read')
-            ? await deps.clearRequests.list(caller.fleetId)
+        const reach = hasScope(caller, 'fleet:read') ? await deps.readReach(caller) : undefined;
+        const requests = reach
+            ? (await deps.clearRequests.list(caller.fleetId)).filter((request) => readsShip(reach, request.shipId))
             : await deps.clearRequests.listFor(caller.fleetId, caller.shipId);
         return requests.map(({ trierarchShipId, shipId, repository, requestedBy, requestedAt }) => ({ trierarchShipId, shipId, repository, requestedBy, requestedAt }));
     };

package/dist/domain/registry/read-clear-requests.js.map

@@ -1 +1 @@
-{"version":3,"file":"read-clear-requests.js","sourceRoot":"","sources":["../../../src/domain/registry/read-clear-requests.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAe,MAAM,qBAAqB,CAAC;AAS5D;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAyE;IAC/G,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE;QACtB,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;YAC7C,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;YAC/C,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACpE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IAClK,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"read-clear-requests.js","sourceRoot":"","sources":["../../../src/domain/registry/read-clear-requests.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAe,MAAM,qBAAqB,CAAC;AAG5D,OAAO,EAAE,SAAS,EAAoB,MAAM,iBAAiB,CAAC;AAO9D;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAiG;IACvI,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE;QACtB,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxF,MAAM,QAAQ,GAAG,KAAK;YACpB,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACvG,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QACpE,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;IAClK,CAAC,CAAC;AACJ,CAAC"}

package/dist/domain/registry/read-on-behalf.d.ts

@@ -0,0 +1,20 @@
+import type { ShipId } from '@aeolus-fleet/common';
+import { type Caller } from '../shared/caller.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { ShipRepository } from './ports.js';
+export type ReadOnBehalf = (caller: Caller, input: {
+    shipId: ShipId;
+}) => Promise<Result<Caller, DomainError<'SCOPE_NOT_HELD' | 'SHIP_NOT_FOUND' | 'SHIP_NOT_READ_ON_BEHALF'>>>;
+/**
+ * Use case: the reader a plugin ship reads as on behalf of a named ship
+ * (decision 0034): the named ship with fleet:read only, so every fleet:read
+ * read filters by that ship's read reach whatever its own scopes, with the
+ * plugin kept as the one that asked. The plugin needs fleet:read and
+ * fleet:on-behalf itself: fleet:read alone reads only as its own ship. argo
+ * and the viewer are never named: their read is the whole fleet, which a
+ * plugin would gain by naming them.
+ */
+export declare function createReadOnBehalf(deps: {
+    ships: Pick<ShipRepository, 'find'>;
+}): ReadOnBehalf;

package/dist/domain/registry/read-on-behalf.js

@@ -0,0 +1,31 @@
+import { hasScope } from '../shared/caller.js';
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+/**
+ * Use case: the reader a plugin ship reads as on behalf of a named ship
+ * (decision 0034): the named ship with fleet:read only, so every fleet:read
+ * read filters by that ship's read reach whatever its own scopes, with the
+ * plugin kept as the one that asked. The plugin needs fleet:read and
+ * fleet:on-behalf itself: fleet:read alone reads only as its own ship. argo
+ * and the viewer are never named: their read is the whole fleet, which a
+ * plugin would gain by naming them.
+ */
+export function createReadOnBehalf(deps) {
+    return async (caller, { shipId }) => {
+        if (!hasScope(caller, 'fleet:read')) {
+            return refuse('SCOPE_NOT_HELD', 'Reading on behalf of a ship needs the fleet:read scope');
+        }
+        if (!hasScope(caller, 'fleet:on-behalf')) {
+            return refuse('SCOPE_NOT_HELD', 'Reading on behalf of a ship needs the fleet:on-behalf scope');
+        }
+        const ship = await deps.ships.find(caller.fleetId, shipId);
+        if (ship?.retiredAt !== null) {
+            return refuse('SHIP_NOT_FOUND', `No ship ${shipId} in this fleet`);
+        }
+        if (ship.kind === 'operator' || ship.kind === 'viewer') {
+            return refuse('SHIP_NOT_READ_ON_BEHALF', `A plugin reads on behalf of no ${ship.kind === 'operator' ? 'argo' : 'viewer'}: its read is the whole fleet`);
+        }
+        return ok({ fleetId: caller.fleetId, shipId: ship.id, kind: ship.kind, scopes: ['fleet:read'], askedBy: caller.shipId });
+    };
+}
+//# sourceMappingURL=read-on-behalf.js.map

package/dist/domain/registry/read-on-behalf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-on-behalf.js","sourceRoot":"","sources":["../../../src/domain/registry/read-on-behalf.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAe,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAQtD;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAA6C;IAC9E,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE;QAClC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC;YACpC,OAAO,MAAM,CAAC,gBAAgB,EAAE,wDAAwD,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC,EAAE,CAAC;YACzC,OAAO,MAAM,CAAC,gBAAgB,EAAE,6DAA6D,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3D,IAAI,IAAI,EAAE,SAAS,KAAK,IAAI,EAAE,CAAC;YAC7B,OAAO,MAAM,CAAC,gBAAgB,EAAE,WAAW,MAAM,gBAAgB,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,OAAO,MAAM,CAAC,yBAAyB,EAAE,kCAAkC,IAAI,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,+BAA+B,CAAC,CAAC;QAC1J,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3H,CAAC,CAAC;AACJ,CAAC"}

package/dist/domain/registry/read-reach.d.ts

@@ -0,0 +1,62 @@
+import type { EventType, ShipId } from '@aeolus-fleet/common';
+import type { Caller } from '../shared/caller.js';
+import type { Clock } from '../shared/clock.js';
+import type { Recipient } from '../shared/selector.js';
+import type { UnitOfWork } from '../shared/unit-of-work.js';
+import { type CheckReachTx } from './check-reach.js';
+import type { ShipRepository } from './ports.js';
+/**
+ * The ships a caller reads (decision 0034): every ship, or some by id, with
+ * the types of the active ones among them, by which an unclaimed message to a
+ * type is read.
+ */
+export type ReadReach = {
+    kind: 'every';
+} | {
+    kind: 'some';
+    shipIds: ReadonlySet<ShipId>;
+    types: ReadonlySet<string>;
+};
+/** The ports read reach is worked out from, in one unit of work so it reads one version of the rules. */
+export interface ReadReachTx {
+    networkSettings: CheckReachTx['networkSettings'];
+    ships: Pick<ShipRepository, 'find' | 'list'>;
+    labels: Pick<CheckReachTx['labels'], 'carriedBy'>;
+    leases: CheckReachTx['leases'];
+}
+/** A message as read reach sees it: its sender, its recipient, and for a type the ship that claimed it, if one has. */
+export interface MessageParties {
+    senderId: ShipId;
+    recipient: Recipient;
+    claimedBy: ShipId | null;
+}
+export type ReadReachOf = (caller: Caller) => Promise<ReadReach>;
+/**
+ * Works out what a caller reads now, as a send is checked: the rules in
+ * force, what the networking plugin declared while it does not respond, the
+ * built-in rules, read rules only. A ship always reads itself. argo reads
+ * every ship, as does every ship while open is on for read and the viewer
+ * while its reading is on; otherwise each ship of the fleet, retired ones
+ * too, is read when a rule lets the caller read it.
+ */
+export declare function createReadReachOf(deps: {
+    uow: UnitOfWork<ReadReachTx>;
+    clock: Clock;
+}): ReadReachOf;
+export declare function readsShip(reach: ReadReach, shipId: ShipId): boolean;
+/**
+ * Whether the reach reads the message: through its sender or its recipient.
+ * A message to a type is read through the ship that claimed it, or while none
+ * has, through any active ship of the type the reach reads.
+ */
+export declare function readsMessage(reach: ReadReach, message: MessageParties): boolean;
+/**
+ * Whether the reach reads an event: through the message it concerns, else
+ * through the ship it concerns. One that concerns neither, such as a label's,
+ * or a rules event, every reader reads. Who caused it does not count.
+ */
+export declare function readsEvent(reach: ReadReach, event: {
+    type: EventType;
+    shipId: ShipId | null;
+    message: MessageParties | null;
+}): boolean;

package/dist/domain/registry/read-reach.js

@@ -0,0 +1,78 @@
+import { ok } from '../shared/result.js';
+import { rulesInForceAt } from './check-reach.js';
+import { allowsReach } from './network-settings.js';
+const EVERY = { kind: 'every' };
+/**
+ * Works out what a caller reads now, as a send is checked: the rules in
+ * force, what the networking plugin declared while it does not respond, the
+ * built-in rules, read rules only. A ship always reads itself. argo reads
+ * every ship, as does every ship while open is on for read and the viewer
+ * while its reading is on; otherwise each ship of the fleet, retired ones
+ * too, is read when a rule lets the caller read it.
+ */
+export function createReadReachOf(deps) {
+    return async (caller) => {
+        const worked = await deps.uow.run(async (tx) => {
+            if (caller.kind === 'operator') {
+                return ok(EVERY);
+            }
+            const { fleetId } = caller;
+            const settings = await tx.networkSettings.findForShare(fleetId);
+            const inForce = await rulesInForceAt(tx, { settings, now: deps.clock.now() });
+            if (inForce.builtIns.open.read || (caller.kind === 'viewer' && inForce.builtIns.isViewerReadOn)) {
+                return ok(EVERY);
+            }
+            const readerShip = await tx.ships.find(fleetId, caller.shipId);
+            const reader = readerShip && (await reachingOf(tx, readerShip));
+            const read = [];
+            for (const ship of await tx.ships.list(fleetId)) {
+                if (ship.id === caller.shipId || (reader && allowsReach(inForce, { verb: 'read', sender: reader, recipient: await reachingOf(tx, ship), isAnswerToSender: false }))) {
+                    read.push(ship);
+                }
+            }
+            return ok({
+                kind: 'some',
+                shipIds: new Set(read.map((ship) => ship.id)),
+                types: new Set(read.filter((ship) => ship.retiredAt === null && ship.kind !== 'viewer').map((ship) => ship.type)),
+            });
+        });
+        // The work refuses nothing; were it to, the caller reads only itself.
+        return worked.isOk ? worked.value : { kind: 'some', shipIds: new Set([caller.shipId]), types: new Set() };
+    };
+}
+async function reachingOf(tx, ship) {
+    const labels = (await tx.labels.carriedBy(ship.fleetId, ship.id)).map(({ labelId, valueId }) => ({ labelId, valueId }));
+    return { id: ship.id, owner: ship.owner, kind: ship.kind, labels };
+}
+export function readsShip(reach, shipId) {
+    return reach.kind === 'every' || reach.shipIds.has(shipId);
+}
+/**
+ * Whether the reach reads the message: through its sender or its recipient.
+ * A message to a type is read through the ship that claimed it, or while none
+ * has, through any active ship of the type the reach reads.
+ */
+export function readsMessage(reach, message) {
+    if (reach.kind === 'every' || readsShip(reach, message.senderId)) {
+        return true;
+    }
+    const { recipient, claimedBy } = message;
+    if (recipient.kind === 'ship') {
+        return readsShip(reach, recipient.shipId);
+    }
+    return claimedBy === null ? reach.types.has(recipient.type) : readsShip(reach, claimedBy);
+}
+/** The events about the rules: they concern no ship, whichever ship set or declared them, so every reader reads them. */
+const RULES_EVENTS = new Set(['NetworkRulesDeclared', 'NetworkRulesSet', 'BuiltInRuleChanged']);
+/**
+ * Whether the reach reads an event: through the message it concerns, else
+ * through the ship it concerns. One that concerns neither, such as a label's,
+ * or a rules event, every reader reads. Who caused it does not count.
+ */
+export function readsEvent(reach, event) {
+    if (event.message !== null) {
+        return readsMessage(reach, event.message);
+    }
+    return event.shipId === null || RULES_EVENTS.has(event.type) || readsShip(reach, event.shipId);
+}
+//# sourceMappingURL=read-reach.js.map

package/dist/domain/registry/read-reach.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-reach.js","sourceRoot":"","sources":["../../../src/domain/registry/read-reach.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAGtD,OAAO,EAAE,cAAc,EAAqB,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAqB,MAAM,uBAAuB,CAAC;AA4BvE,MAAM,KAAK,GAAc,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAoD;IACpF,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE;QACtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAqC,EAAE;YAChF,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAC/B,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC;YACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;YAC3B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAChE,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC9E,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;gBAChG,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;YACnB,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YAC/D,MAAM,MAAM,GAAG,UAAU,IAAI,CAAC,MAAM,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC;YAChE,MAAM,IAAI,GAAW,EAAE,CAAC;YACxB,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChD,IAAI,IAAI,CAAC,EAAE,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;oBACpK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClB,CAAC;YACH,CAAC;YACD,OAAO,EAAE,CAAC;gBACR,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAC7C,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;aAClH,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,sEAAsE;QACtE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,CAAC;IAC5G,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,EAA+B,EAAE,IAAU;IACnE,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACxH,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAgB,EAAE,MAAc;IACxD,OAAO,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC7D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,KAAgB,EAAE,OAAuB;IACpE,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,OAAO,CAAC;IACzC,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;AAC5F,CAAC;AAED,yHAAyH;AACzH,MAAM,YAAY,GAA2B,IAAI,GAAG,CAAC,CAAC,sBAAsB,EAAE,iBAAiB,EAAE,oBAAoB,CAAC,CAAC,CAAC;AAExH;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAgB,EAAE,KAAiF;IAC5H,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;AACjG,CAAC"}

package/dist/domain/registry/recrew-ship.d.ts

@@ -6,14 +6,15 @@ import { type DomainError } from '../shared/errors.js';
 import { type Result } from '../shared/result.js';
 import type { UnitOfWork } from '../shared/unit-of-work.js';
 import { type LeaseTx } from './leases.js';
+import { type CheckManageTx, type NotReachable } from './check-reach.js';
 import type { ShipRepository } from './ports.js';
 import type { ReleaseShipTx } from './release-ship.js';
 import { type ReleaseRefusal } from './ship.js';
 import { type IssuedStartingPrompt, type StartingPromptTx } from './starting-prompt.js';
-export type RecrewShipTx = ReleaseShipTx & StartingPromptTx & LeaseTx & {
+export type RecrewShipTx = ReleaseShipTx & StartingPromptTx & LeaseTx & CheckManageTx & {
     ships: ShipRepository;
 };
-export type RecrewShipRefusal = DomainError<'SHIP_NOT_FOUND'> | ReleaseRefusal;
+export type RecrewShipRefusal = DomainError<'SHIP_NOT_FOUND'> | NotReachable | ReleaseRefusal;
 export type RecrewShip = (caller: Caller, input: {
     shipId: ShipId;
 }) => Promise<Result<IssuedStartingPrompt, RecrewShipRefusal>>;

package/dist/domain/registry/recrew-ship.js

@@ -3,6 +3,7 @@ import { refuse } from '../shared/errors.js';
 import { shipActor } from '../shared/events.js';
 import { ok } from '../shared/result.js';
 import { endLease } from './leases.js';
+import { checkManage, keepingReachRefusal } from './check-reach.js';
 import { checkCanRelease } from './ship.js';
 import { issueStartingPrompt } from './starting-prompt.js';
 /**
@@ -14,12 +15,16 @@ import { issueStartingPrompt } from './starting-prompt.js';
  * (fleet:manage) is checked before this runs.
  */
 export function createRecrewShip(deps) {
-    return (caller, { shipId }) => deps.uow.run(async (tx) => {
+    return (caller, { shipId }) => keepingReachRefusal(deps.uow, async (tx) => {
         const { fleetId } = caller;
         const ship = await tx.ships.findForUpdate(fleetId, shipId);
         if (!ship) {
             return refuse('SHIP_NOT_FOUND', `Ship ${shipId} does not exist`);
         }
+        const managed = await checkManage({ tx, ids: deps.ids }, { fleetId: fleetId, managerShipId: caller.shipId, shipId: ship.id, at: deps.clock.now() });
+        if (!managed.isOk) {
+            return managed;
+        }
         const actor = shipActor(caller.shipId);
         const at = deps.clock.now();
         await revokeShipSecret({ tx, ids: deps.ids }, { fleetId, shipId, actor, at });

package/dist/domain/registry/recrew-ship.js.map

@@ -1 +1 @@
-{"version":3,"file":"recrew-ship.js","sourceRoot":"","sources":["../../../src/domain/registry/recrew-ship.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAoB,MAAM,uBAAuB,CAAC;AAG3E,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,QAAQ,EAAgB,MAAM,aAAa,CAAC;AAGrD,OAAO,EAAE,eAAe,EAAuB,MAAM,WAAW,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAoD,MAAM,sBAAsB,CAAC;AAW7G;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAKhC;IACC,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAA4D,EAAE;QAClF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,MAAM,CAAC,gBAAgB,EAAE,QAAQ,MAAM,iBAAiB,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAE5B,MAAM,gBAAgB,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACxF,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3G,OAAO,EAAE,CACP,MAAM,mBAAmB,CACvB,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EACnD,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAC/B,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"recrew-ship.js","sourceRoot":"","sources":["../../../src/domain/registry/recrew-ship.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAoB,MAAM,uBAAuB,CAAC;AAG3E,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,QAAQ,EAAgB,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAyC,MAAM,kBAAkB,CAAC;AAG3G,OAAO,EAAE,eAAe,EAAuB,MAAM,WAAW,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAoD,MAAM,sBAAsB,CAAC;AAW7G;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAKhC;IACC,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAC5B,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAA4D,EAAE;QACnG,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,MAAM,CAAC,gBAAgB,EAAE,QAAQ,MAAM,iBAAiB,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACpJ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAE5B,MAAM,gBAAgB,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACxF,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3G,OAAO,EAAE,CACP,MAAM,mBAAmB,CACvB,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EACnD,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAC/B,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/domain/registry/release-ship.d.ts

@@ -6,13 +6,15 @@ import { type DomainError } from '../shared/errors.js';
 import { type Result } from '../shared/result.js';
 import type { UnitOfWork } from '../shared/unit-of-work.js';
 import { type LeaseTx } from './leases.js';
+import { type NotReachable } from './check-reach.js';
+import { type ManagedOrAssignedTx } from './managed-or-assigned.js';
 import type { CrewRequestRepository, ShipRepository } from './ports.js';
 import { type ReleaseRefusal } from './ship.js';
-export interface ReleaseShipTx extends LeaseTx, CredentialTx {
+export interface ReleaseShipTx extends LeaseTx, CredentialTx, Omit<ManagedOrAssignedTx, 'ships' | 'leases' | 'crewRequests'> {
     ships: ShipRepository;
     crewRequests: Pick<CrewRequestRepository, 'find'>;
 }
-export type ReleaseShipRefusal = DomainError<'SHIP_NOT_FOUND' | 'CREW_REQUEST_NOT_ASSIGNED_TO_CALLER'> | ReleaseRefusal;
+export type ReleaseShipRefusal = DomainError<'SHIP_NOT_FOUND' | 'CREW_REQUEST_NOT_ASSIGNED_TO_CALLER'> | NotReachable | ReleaseRefusal;
 export type ReleaseShip = (caller: Caller, input: {
     shipId: ShipId;
 }) => Promise<Result<undefined, ReleaseShipRefusal>>;
@@ -24,7 +26,8 @@ export type ReleaseShip = (caller: Caller, input: {
  * their attempts kept. The next crew needs a new starting prompt. The caller's
  * scope (fleet:manage or crew:run) is checked before this runs;
  * crew:run reaches only the ships whose crew requests are assigned to the
- * caller's ship.
+ * caller's ship, and fleet:manage the ships in its manage reach (decision
+ * 0034).
  *
  * Locks in the fleet's order: the ship, then its secret, then its lease. A
  * receive holding the lease makes the release wait, then the release returns

package/dist/domain/registry/release-ship.js

@@ -3,10 +3,9 @@ import { refuse } from '../shared/errors.js';
 import { shipActor } from '../shared/events.js';
 import { ok } from '../shared/result.js';
 import { endLease } from './leases.js';
-import { checkReaches } from './crew-request.js';
+import { keepingReachRefusal } from './check-reach.js';
+import { checkManagedOrAssigned } from './managed-or-assigned.js';
 import { checkCanRelease } from './ship.js';
-/** The scopes that release every ship; crew:run releases only the ships assigned to the caller's ship. */
-const RELEASE_SCOPES = ['fleet:manage'];
 /**
  * Use case: the caller releases a crewed ship of its fleet (Release): the
  * session crewing it loses it, and the ship awaits a new crew (ADR 0010). In
@@ -15,7 +14,8 @@ const RELEASE_SCOPES = ['fleet:manage'];
  * their attempts kept. The next crew needs a new starting prompt. The caller's
  * scope (fleet:manage or crew:run) is checked before this runs;
  * crew:run reaches only the ships whose crew requests are assigned to the
- * caller's ship.
+ * caller's ship, and fleet:manage the ships in its manage reach (decision
+ * 0034).
  *
  * Locks in the fleet's order: the ship, then its secret, then its lease. A
  * receive holding the lease makes the release wait, then the release returns
@@ -23,18 +23,18 @@ const RELEASE_SCOPES = ['fleet:manage'];
  * prompt reads it, and a refusal rolls the revoked secret back.
  */
 export function createReleaseShip(deps) {
-    return (caller, { shipId }) => deps.uow.run(async (tx) => {
+    return (caller, { shipId }) => keepingReachRefusal(deps.uow, async (tx) => {
         const { fleetId } = caller;
         const ship = await tx.ships.findForUpdate(fleetId, shipId);
         if (!ship) {
             return refuse('SHIP_NOT_FOUND', `Ship ${shipId} does not exist`);
         }
-        const reaches = checkReaches(caller, { ship, current: await tx.crewRequests.find(fleetId, shipId), broadScopes: RELEASE_SCOPES });
+        const at = deps.clock.now();
+        const reaches = await checkManagedOrAssigned({ tx, ids: deps.ids }, { caller, ship, at });
         if (!reaches.isOk) {
             return reaches;
         }
         const actor = shipActor(caller.shipId);
-        const at = deps.clock.now();
         await revokeShipSecret({ tx, ids: deps.ids }, { fleetId, shipId, actor, at });
         const lease = checkCanRelease(ship, await tx.leases.findOpenForUpdate(fleetId, shipId));
         if (!lease.isOk) {

package/dist/domain/registry/release-ship.js.map

@@ -1 +1 @@
-{"version":3,"file":"release-ship.js","sourceRoot":"","sources":["../../../src/domain/registry/release-ship.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAqB,MAAM,uBAAuB,CAAC;AAG5E,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,QAAQ,EAAgB,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,OAAO,EAAE,eAAe,EAAuB,MAAM,WAAW,CAAC;AASjE,0GAA0G;AAC1G,MAAM,cAAc,GAAG,CAAC,cAAc,CAAU,CAAC;AAOjD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAIjC;IACC,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAkD,EAAE;QACxE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,MAAM,CAAC,gBAAgB,EAAE,QAAQ,MAAM,iBAAiB,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC,CAAC;QAClI,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAE5B,MAAM,gBAAgB,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACxF,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3G,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"release-ship.js","sourceRoot":"","sources":["../../../src/domain/registry/release-ship.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAqB,MAAM,uBAAuB,CAAC;AAG5E,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,QAAQ,EAAgB,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAqB,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAA4B,MAAM,0BAA0B,CAAC;AAE5F,OAAO,EAAE,eAAe,EAAuB,MAAM,WAAW,CAAC;AAcjE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAIjC;IACC,OAAO,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAC5B,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAkD,EAAE;QACzF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,MAAM,CAAC,gBAAgB,EAAE,QAAQ,MAAM,iBAAiB,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAEvC,MAAM,gBAAgB,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QACxF,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3G,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/domain/registry/remove-crew-request.d.ts

@@ -5,15 +5,16 @@ import { type DomainError } from '../shared/errors.js';
 import { type EventLog } from '../shared/events.js';
 import { type Result } from '../shared/result.js';
 import type { UnitOfWork } from '../shared/unit-of-work.js';
+import { type CheckManageTx, type NotReachable } from './check-reach.js';
 import type { CrewRequestRepository, ShipRepository } from './ports.js';
-export interface RemoveCrewRequestTx {
-    ships: Pick<ShipRepository, 'findForUpdate'>;
+export interface RemoveCrewRequestTx extends Omit<CheckManageTx, 'ships'> {
+    ships: Pick<ShipRepository, 'find' | 'findForUpdate'>;
     crewRequests: CrewRequestRepository;
     events: EventLog;
 }
 export type RemoveCrewRequest = (caller: Caller, input: {
     shipId: ShipId;
-}) => Promise<Result<undefined, DomainError<'SHIP_NOT_FOUND' | 'CREW_REQUEST_NOT_FOUND'>>>;
+}) => Promise<Result<undefined, DomainError<'SHIP_NOT_FOUND' | 'CREW_REQUEST_NOT_FOUND'> | NotReachable>>;
 /**
  * Use case: a requester removes a ship's crew request. Its scope
  * (fleet:manage) is checked before this runs. In one unit of work, locking the

package/dist/domain/registry/remove-crew-request.js

@@ -2,6 +2,7 @@ import { refuse } from '../shared/errors.js';
 import { recordEvent, shipActor } from '../shared/events.js';
 import { ok } from '../shared/result.js';
 import { removeCrewRequest } from './crew-request.js';
+import { checkManage, keepingReachRefusal } from './check-reach.js';
 /**
  * Use case: a requester removes a ship's crew request. Its scope
  * (fleet:manage) is checked before this runs. In one unit of work, locking the
@@ -10,11 +11,15 @@ import { removeCrewRequest } from './crew-request.js';
  * confirm. A crew aboard without a trierarch stays aboard.
  */
 export function createRemoveCrewRequest(deps) {
-    return (caller, input) => deps.uow.run(async (tx) => {
+    return (caller, input) => keepingReachRefusal(deps.uow, async (tx) => {
         const ship = await tx.ships.findForUpdate(caller.fleetId, input.shipId);
         if (!ship) {
             return refuse('SHIP_NOT_FOUND', `Ship ${input.shipId} does not exist`);
         }
+        const managed = await checkManage({ tx, ids: deps.ids }, { fleetId: caller.fleetId, managerShipId: caller.shipId, shipId: ship.id, at: deps.clock.now() });
+        if (!managed.isOk) {
+            return managed;
+        }
         const current = await tx.crewRequests.find(caller.fleetId, ship.id);
         const removed = removeCrewRequest({ ship, current }, { at: deps.clock.now(), actor: shipActor(caller.shipId) });
         if (!removed.isOk) {

package/dist/domain/registry/remove-crew-request.js.map

@@ -1 +1 @@
-{"version":3,"file":"remove-crew-request.js","sourceRoot":"","sources":["../../../src/domain/registry/remove-crew-request.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAiB,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AActD;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAA8E;IACpH,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CACvB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAwF,EAAE;QAC9G,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,MAAM,CAAC,gBAAgB,EAAE,QAAQ,KAAK,CAAC,MAAM,iBAAiB,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChH,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QAClC,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACzC,MAAM,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"remove-crew-request.js","sourceRoot":"","sources":["../../../src/domain/registry/remove-crew-request.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAiB,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAyC,MAAM,kBAAkB,CAAC;AAc3G;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAA8E;IACpH,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CACvB,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAuG,EAAE;QAC9I,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,MAAM,CAAC,gBAAgB,EAAE,QAAQ,KAAK,CAAC,MAAM,iBAAiB,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3J,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChH,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QAClC,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACzC,MAAM,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/domain/registry/rename-ship.d.ts

@@ -5,20 +5,22 @@ import { type DomainError } from '../shared/errors.js';
 import { type EventLog } from '../shared/events.js';
 import { type Result } from '../shared/result.js';
 import type { UnitOfWork } from '../shared/unit-of-work.js';
+import { type CheckManageTx, type NotReachable } from './check-reach.js';
 import type { ShipRepository } from './ports.js';
 import { type RenameRefusal } from './ship.js';
-export interface RenameShipTx {
-    ships: Pick<ShipRepository, 'findForUpdate' | 'lockName' | 'findActiveByName' | 'rename'>;
+export interface RenameShipTx extends Omit<CheckManageTx, 'ships'> {
+    ships: Pick<ShipRepository, 'find' | 'findForUpdate' | 'lockName' | 'findActiveByName' | 'rename'>;
     events: EventLog;
 }
-export type RenameShipRefusal = DomainError<'SHIP_NOT_FOUND'> | RenameRefusal;
+export type RenameShipRefusal = DomainError<'SHIP_NOT_FOUND'> | NotReachable | RenameRefusal;
 export type RenameShip = (caller: Caller, input: {
     shipId: ShipId;
     name: string;
 }) => Promise<Result<undefined, RenameShipRefusal>>;
 /**
- * Use case: the operator renames a ship. Its scope (fleet:manage) is checked
- * before this runs. In one unit of work, locking the ship, then the new name
+ * Use case: the caller renames a ship it manages: its scope (fleet:manage)
+ * is checked before this runs, and manage reach on the ship here (decision
+ * 0034), a refusal storing only its record. In one unit of work, locking the ship, then the new name
  * (as a commission does), so two renames or a commission to one name never
  * both find it free: the new name and ShipRenamed. Its id, history and
  * session stay; a sender addressing the old name no longer reaches it.

package/dist/domain/registry/rename-ship.js

@@ -1,21 +1,27 @@
 import { refuse } from '../shared/errors.js';
 import { recordEvent, shipActor } from '../shared/events.js';
 import { ok } from '../shared/result.js';
+import { checkManage, keepingReachRefusal } from './check-reach.js';
 import { renameShip } from './ship.js';
 /**
- * Use case: the operator renames a ship. Its scope (fleet:manage) is checked
- * before this runs. In one unit of work, locking the ship, then the new name
+ * Use case: the caller renames a ship it manages: its scope (fleet:manage)
+ * is checked before this runs, and manage reach on the ship here (decision
+ * 0034), a refusal storing only its record. In one unit of work, locking the ship, then the new name
  * (as a commission does), so two renames or a commission to one name never
  * both find it free: the new name and ShipRenamed. Its id, history and
  * session stay; a sender addressing the old name no longer reaches it.
  */
 export function createRenameShip(deps) {
-    return (caller, input) => deps.uow.run(async (tx) => {
+    return (caller, input) => keepingReachRefusal(deps.uow, async (tx) => {
         const { fleetId } = caller;
         const ship = await tx.ships.findForUpdate(fleetId, input.shipId);
         if (!ship) {
             return refuse('SHIP_NOT_FOUND', `Ship ${input.shipId} does not exist`);
         }
+        const managed = await checkManage({ tx, ids: deps.ids }, { fleetId, managerShipId: caller.shipId, shipId: ship.id, at: deps.clock.now() });
+        if (!managed.isOk) {
+            return managed;
+        }
         await tx.ships.lockName(fleetId, input.name);
         const renamed = renameShip(ship, {
             name: input.name,

package/dist/domain/registry/rename-ship.js.map

@@ -1 +1 @@
-{"version":3,"file":"rename-ship.js","sourceRoot":"","sources":["../../../src/domain/registry/rename-ship.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAiB,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAGtD,OAAO,EAAE,UAAU,EAAsB,MAAM,WAAW,CAAC;AAc3D;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAuE;IACtG,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CACvB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAiD,EAAE;QACvE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,MAAM,CAAC,gBAAgB,EAAE,QAAQ,KAAK,CAAC,MAAM,iBAAiB,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE;YAC/B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YACpB,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;YAC/B,eAAe,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC;SACtE,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QAChD,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YAC/B,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"rename-ship.js","sourceRoot":"","sources":["../../../src/domain/registry/rename-ship.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAiB,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAyC,MAAM,kBAAkB,CAAC;AAE3G,OAAO,EAAE,UAAU,EAAsB,MAAM,WAAW,CAAC;AAc3D;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAuE;IACtG,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CACvB,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAiD,EAAE;QACxF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,MAAM,CAAC,gBAAgB,EAAE,QAAQ,KAAK,CAAC,MAAM,iBAAiB,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3I,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE;YAC/B,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;YACpB,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;YAC/B,eAAe,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC;SACtE,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QAChD,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;YAC/B,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/domain/registry/request-crew.d.ts

@@ -6,12 +6,13 @@ import { type EventLog } from '../shared/events.js';
 import { type Result } from '../shared/result.js';
 import type { UnitOfWork } from '../shared/unit-of-work.js';
 import { type RequestCrewRefusal } from './crew-request.js';
+import { type CheckManageTx, type NotReachable } from './check-reach.js';
 import type { CrewRequestRepository, LabelRepository, ShipRepository } from './ports.js';
 import type { JsonObject } from './report-details.js';
-export interface RequestCrewTx {
-    ships: Pick<ShipRepository, 'findForUpdate'>;
+export interface RequestCrewTx extends Omit<CheckManageTx, 'ships' | 'labels'> {
+    ships: Pick<ShipRepository, 'find' | 'findForUpdate'>;
     crewRequests: CrewRequestRepository;
-    labels: Pick<LabelRepository, 'findByValueForShare'>;
+    labels: Pick<LabelRepository, 'findByValueForShare' | 'carriedBy' | 'find'>;
     events: EventLog;
 }
 export type RequestCrew = (caller: Caller, input: {
@@ -19,7 +20,7 @@ export type RequestCrew = (caller: Caller, input: {
     settings: JsonObject;
 }) => Promise<Result<{
     settingsVersion: number;
-}, DomainError<'SHIP_NOT_FOUND'> | RequestCrewRefusal>>;
+}, DomainError<'SHIP_NOT_FOUND'> | NotReachable | RequestCrewRefusal>>;
 /**
  * Use case: a requester asks that a ship be kept crewed, with these settings,
  * replacing any request the ship holds. Its scope (fleet:manage) is checked

package/dist/domain/registry/request-crew.js

@@ -2,6 +2,7 @@ import { refuse } from '../shared/errors.js';
 import { recordEvent, shipActor } from '../shared/events.js';
 import { ok } from '../shared/result.js';
 import { machineLabelsOf, requestCrew } from './crew-request.js';
+import { checkManage, keepingReachRefusal } from './check-reach.js';
 /**
  * Use case: a requester asks that a ship be kept crewed, with these settings,
  * replacing any request the ship holds. Its scope (fleet:manage) is checked
@@ -12,11 +13,15 @@ import { machineLabelsOf, requestCrew } from './crew-request.js';
  * CrewRequested.
  */
 export function createRequestCrew(deps) {
-    return (caller, input) => deps.uow.run(async (tx) => {
+    return (caller, input) => keepingReachRefusal(deps.uow, async (tx) => {
         const ship = await tx.ships.findForUpdate(caller.fleetId, input.shipId);
         if (!ship) {
             return refuse('SHIP_NOT_FOUND', `Ship ${input.shipId} does not exist`);
         }
+        const managed = await checkManage({ tx, ids: deps.ids }, { fleetId: caller.fleetId, managerShipId: caller.shipId, shipId: ship.id, at: deps.clock.now() });
+        if (!managed.isOk) {
+            return managed;
+        }
         const current = await tx.crewRequests.find(caller.fleetId, ship.id);
         const labelValues = new Set();
         for (const valueId of machineLabelsOf(input.settings)) {

package/dist/domain/registry/request-crew.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-crew.js","sourceRoot":"","sources":["../../../src/domain/registry/request-crew.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAiB,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAE,WAAW,EAA2B,MAAM,mBAAmB,CAAC;AAgB1F;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAwE;IACxG,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CACvB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAoG,EAAE;QAC1H,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,MAAM,CAAC,gBAAgB,EAAE,QAAQ,KAAK,CAAC,MAAM,iBAAiB,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACpE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAgB,CAAC;QAC5C,KAAK,MAAM,OAAO,IAAI,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC3E,sFAAsF;YACtF,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC;gBACxD,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnJ,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YACpB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpD,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3C,MAAM,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,eAAe,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"request-crew.js","sourceRoot":"","sources":["../../../src/domain/registry/request-crew.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,SAAS,EAAiB,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,eAAe,EAAE,WAAW,EAA2B,MAAM,mBAAmB,CAAC;AAC1F,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAyC,MAAM,kBAAkB,CAAC;AAgB3G;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAwE;IACxG,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CACvB,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,EAAmH,EAAE;QAC1J,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACxE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,MAAM,CAAC,gBAAgB,EAAE,QAAQ,KAAK,CAAC,MAAM,iBAAiB,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3J,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QACpE,MAAM,WAAW,GAAG,IAAI,GAAG,EAAgB,CAAC;QAC5C,KAAK,MAAM,OAAO,IAAI,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC3E,sFAAsF;YACtF,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC;gBACxD,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnJ,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YACpB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpD,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3C,MAAM,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,eAAe,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/domain/registry/request-worktree-clear.d.ts

@@ -6,13 +6,14 @@ import { type EventLog } from '../shared/events.js';
 import { type Result } from '../shared/result.js';
 import type { UnitOfWork } from '../shared/unit-of-work.js';
 import { type RequestWorktreeClearRefusal } from './clear-request.js';
+import { type CheckManageTx, type NotReachable } from './check-reach.js';
 import type { ClearRequestRepository, ShipRepository } from './ports.js';
-export interface RequestWorktreeClearTx {
+export interface RequestWorktreeClearTx extends Omit<CheckManageTx, 'ships'> {
     ships: Pick<ShipRepository, 'find' | 'findForUpdate'>;
     clearRequests: ClearRequestRepository;
     events: EventLog;
 }
-export type RequestWorktreeClearUseCaseRefusal = DomainError<'SHIP_NOT_FOUND'> | RequestWorktreeClearRefusal;
+export type RequestWorktreeClearUseCaseRefusal = DomainError<'SHIP_NOT_FOUND'> | NotReachable | RequestWorktreeClearRefusal;
 export type RequestWorktreeClear = (caller: Caller, input: {
     trierarchShipId: ShipId;
     shipId: ShipId;