@aeolus-fleet/core 0.27.0 → 0.28.0

package/dist/domain/identity/authenticate.d.ts

@@ -1,5 +1,5 @@
 import { type LeaseEnded } from '../registry/public.js';
-import type { Caller, Crew } from '../shared/caller.js';
+import type { ShipCaller, Crew } from '../shared/caller.js';
 import type { Clock } from '../shared/clock.js';
 import { type DomainError } from '../shared/errors.js';
 import { type Result } from '../shared/result.js';
@@ -8,7 +8,7 @@ import type { ConsoleSessionEndReason } from './console-session.js';
 import type { CallerLookup } from './ports.js';
 export interface ConsoleSessionUse {
     /** argo, crewed under the lease the session holds, or the viewer ship, holding none. */
-    caller: Caller | Crew;
+    caller: ShipCaller | Crew;
     /** The session's new expiry: its idle limit after this use, never past the moment it ends by. */
     expiresAt: Date;
 }

package/dist/domain/identity/console-session.d.ts

@@ -1,4 +1,4 @@
-import type { ConsoleSessionId, FleetId, LeaseId, ShipId } from '@aeolus-fleet/common';
+import type { AccountId, ConsoleSessionId, FleetId, LeaseId, ShipId } from '@aeolus-fleet/common';
 import type { Location } from '../registry/public.js';
 /**
  * A console session: the operator crewing `argo`, or a person viewing the
@@ -17,6 +17,8 @@ export interface ConsoleSession {
     endsBy: Date | null;
     /** The device it signed in from, as the browser told: "Mac · Chrome". */
     device: string;
+    /** The account that signed in as argo, by its id only; null for argo's own sign-in and a viewer (decision 0054). */
+    accountId: AccountId | null;
     tokenHash: string;
     createdAt: Date;
     lastUsedAt: Date;
@@ -27,10 +29,11 @@ export interface ConsoleSession {
 }
 /**
  * Why a console session ended: the operator signed in somewhere else and took
- * argo over, signed out, or the password was reset. An expired session never
+ * argo over, signed out, the password was reset, or the installation cut off
+ * the account it signed in as argo (decision 0055). An expired session never
  * ended; it simply stopped working.
  */
-export type ConsoleSessionEndReason = 'takenOver' | 'signedOut' | 'passwordReset';
+export type ConsoleSessionEndReason = 'takenOver' | 'signedOut' | 'passwordReset' | 'accountCutOff';
 /** The operator's console session stays valid this long after its last use. */
 export declare const CONSOLE_SESSION_IDLE_LIMIT_MS: number;
 /** A viewer session stays valid this long after its last use (decision 0022). */

package/dist/domain/identity/console-session.js.map

@@ -1 +1 @@
-{"version":3,"file":"console-session.js","sourceRoot":"","sources":["../../../src/domain/identity/console-session.ts"],"names":[],"mappings":"AAqCA,+EAA+E;AAC/E,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtE,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/B,iFAAiF;AACjF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,GAAG,OAAO,CAAC;AAExD,sFAAsF;AACtF,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,OAAO,CAAC;AAEvD,+CAA+C;AAC/C,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAE/C;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,oBAAoB,CAAC,MAAY;IAC/C,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,6BAA6B,CAAC,CAAC;AACpE,CAAC;AAED,uHAAuH;AACvH,MAAM,UAAU,kBAAkB,CAAC,EAAQ;IACzC,OAAO;QACL,WAAW,EAAE,4BAA4B;QACzC,MAAM,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,0BAA0B,CAAC;QAC3D,SAAS,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,4BAA4B,CAAC;KACjE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"console-session.js","sourceRoot":"","sources":["../../../src/domain/identity/console-session.ts"],"names":[],"mappings":"AAwCA,+EAA+E;AAC/E,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtE,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/B,iFAAiF;AACjF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,GAAG,OAAO,CAAC;AAExD,sFAAsF;AACtF,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,OAAO,CAAC;AAEvD,+CAA+C;AAC/C,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAE/C;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,oBAAoB,CAAC,MAAY;IAC/C,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,6BAA6B,CAAC,CAAC;AACpE,CAAC;AAED,uHAAuH;AACvH,MAAM,UAAU,kBAAkB,CAAC,EAAQ;IACzC,OAAO;QACL,WAAW,EAAE,4BAA4B;QACzC,MAAM,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,0BAA0B,CAAC;QAC3D,SAAS,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,4BAA4B,CAAC;KACjE,CAAC;AACJ,CAAC"}

package/dist/domain/identity/cut-off-account.d.ts

@@ -0,0 +1,29 @@
+import type { AccountId, IdGenerator } from '@aeolus-fleet/common';
+import { type LeaseTx } from '../registry/public.js';
+import type { Clock } from '../shared/clock.js';
+import type { UnitOfWork } from '../shared/unit-of-work.js';
+import type { AccountCutOffRepository, ConsoleSessionRepository } from './ports.js';
+export interface CutOffAccountTx extends LeaseTx {
+    consoleSessions: ConsoleSessionRepository;
+}
+export type CutOffAccount = (input: {
+    accountId: AccountId;
+}) => Promise<void>;
+/**
+ * Use case: pagasae, as the installation, cuts off a disabled account
+ * (decisions 0055, 0058). Every token of it issued before now is refused in
+ * every fleet of the installation, until the longest of them has ended; then
+ * core forgets the account. Recording one forgets those that ended. The
+ * cut-off itself writes no event: it belongs to the installation, not to a
+ * fleet, and names no ship.
+ *
+ * Every console sign-in as argo by the account ends too, in every fleet, and
+ * with it the lease on argo it held, the installation the actor. pagasae calls
+ * again when a call fails: both halves are safe to repeat.
+ */
+export declare function createCutOffAccount(deps: {
+    cutOffs: AccountCutOffRepository;
+    uow: UnitOfWork<CutOffAccountTx>;
+    clock: Clock;
+    ids: IdGenerator;
+}): CutOffAccount;

package/dist/domain/identity/cut-off-account.js

@@ -0,0 +1,37 @@
+import { endLease } from '../registry/public.js';
+import { ok } from '../shared/result.js';
+import { ACCOUNT_TOKEN_CLOCK_ALLOWANCE_MS, ACCOUNT_TOKEN_LIFE_MS } from './authenticate-account.js';
+/**
+ * How long a cut-off is kept: the longest a token issued before it is
+ * accepted, its life and the allowance on it, and the allowance on its end.
+ */
+const CUT_OFF_KEPT_MS = ACCOUNT_TOKEN_LIFE_MS + 2 * ACCOUNT_TOKEN_CLOCK_ALLOWANCE_MS;
+const INSTALLATION = { kind: 'installation' };
+/**
+ * Use case: pagasae, as the installation, cuts off a disabled account
+ * (decisions 0055, 0058). Every token of it issued before now is refused in
+ * every fleet of the installation, until the longest of them has ended; then
+ * core forgets the account. Recording one forgets those that ended. The
+ * cut-off itself writes no event: it belongs to the installation, not to a
+ * fleet, and names no ship.
+ *
+ * Every console sign-in as argo by the account ends too, in every fleet, and
+ * with it the lease on argo it held, the installation the actor. pagasae calls
+ * again when a call fails: both halves are safe to repeat.
+ */
+export function createCutOffAccount(deps) {
+    return async ({ accountId }) => {
+        const now = deps.clock.now();
+        await deps.cutOffs.forget(now);
+        await deps.cutOffs.record({ accountId, cutOffAt: now, forgetAt: new Date(now.getTime() + CUT_OFF_KEPT_MS) });
+        await deps.uow.run(async (tx) => {
+            for (const session of await tx.consoleSessions.endAllOfAccount(accountId, { at: now, reason: 'accountCutOff' })) {
+                if (session.leaseId !== null) {
+                    await endLease({ tx, ids: deps.ids }, { fleetId: session.fleetId, leaseId: session.leaseId, actor: INSTALLATION, at: now, reason: 'accountCutOff' });
+                }
+            }
+            return ok(undefined);
+        });
+    };
+}
+//# sourceMappingURL=cut-off-account.js.map

package/dist/domain/identity/cut-off-account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cut-off-account.js","sourceRoot":"","sources":["../../../src/domain/identity/cut-off-account.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAgB,MAAM,uBAAuB,CAAC;AAG/D,OAAO,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAEzC,OAAO,EAAE,gCAAgC,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAGpG;;;GAGG;AACH,MAAM,eAAe,GAAG,qBAAqB,GAAG,CAAC,GAAG,gCAAgC,CAAC;AAErF,MAAM,YAAY,GAAU,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;AAQrD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAKnC;IACC,OAAO,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC;QAE7G,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC9B,KAAK,MAAM,OAAO,IAAI,MAAM,EAAE,CAAC,eAAe,CAAC,eAAe,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;gBAChH,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;oBAC7B,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;gBACvJ,CAAC;YACH,CAAC;YACD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/domain/identity/dismiss-notice.d.ts

@@ -1,10 +1,10 @@
-import type { Caller } from '../shared/caller.js';
+import type { ShipCaller } from '../shared/caller.js';
 import type { Clock } from '../shared/clock.js';
 import { type DomainError } from '../shared/errors.js';
 import { type Result } from '../shared/result.js';
 import type { NoticeDismissals, NoticeRepository } from './ports.js';
 export type DismissNoticeRefusal = DomainError<'NOTICE_NOT_FOUND' | 'NOTICE_NOT_DISMISSIBLE'>;
-export type DismissNotice = (caller: Caller, input: {
+export type DismissNotice = (caller: ShipCaller, input: {
     noticeId: string;
 }) => Promise<Result<undefined, DismissNoticeRefusal>>;
 /**

package/dist/domain/identity/issue-sign-in-ticket.d.ts

@@ -1,4 +1,4 @@
-import type { FleetId, IdGenerator } from '@aeolus-fleet/common';
+import type { AccountId, FleetId, IdGenerator } from '@aeolus-fleet/common';
 import { type ShipTx } from '../registry/public.js';
 import type { Clock } from '../shared/clock.js';
 import { type DomainError } from '../shared/errors.js';
@@ -13,11 +13,15 @@ export interface IssueSignInTicketTx extends ShipTx {
     signInTickets: SignInTicketRepository;
     events: EventLog;
 }
-export type IssueSignInTicketRefusal = DomainError<'FLEET_NOT_FOUND' | 'FLEET_HAS_NO_VIEWER'>;
+export type IssueSignInTicketRefusal = DomainError<'FLEET_NOT_FOUND' | 'FLEET_HAS_NO_VIEWER' | 'VIEWER_TICKET_NAMES_NO_ACCOUNT'>;
 export type IssueSignInTicket = (input: {
     fleetId: FleetId;
     /** Whom it signs in as: the operator when left out, or a viewer of a fleet with a viewer ship (decision 0022). */
     as?: SignInAs;
+    /** The account it signs in as argo, by its id only (decision 0054); argo's operator ticket when left out. */
+    account?: {
+        id: AccountId;
+    };
 }) => Promise<Result<{
     ticket: string;
 }, IssueSignInTicketRefusal>>;
@@ -26,7 +30,9 @@ export type IssueSignInTicket = (input: {
  * operator, or for a viewer of a fleet with a viewer ship (docs/blueprint.md,
  * "Installation"; decision 0022): the hosting service hands it to the
  * person's browser, and the console redeems it for a session. Only
- * its hash is stored; it is valid 2 minutes and signs in once. Each ticket
+ * its hash is stored; it is valid 2 minutes and signs in once. An operator's
+ * ticket may name the account it signs in as argo, by its id only, never
+ * a viewer's (decision 0054). Each ticket
  * stands alone: a new one leaves an earlier unused one to expire.
  */
 export declare function createIssueSignInTicket(deps: {

package/dist/domain/identity/issue-sign-in-ticket.js

@@ -8,14 +8,19 @@ import { SIGN_IN_TICKET_PREFIX, SIGN_IN_TICKET_VALID_MS } from './sign-in-ticket
  * operator, or for a viewer of a fleet with a viewer ship (docs/blueprint.md,
  * "Installation"; decision 0022): the hosting service hands it to the
  * person's browser, and the console redeems it for a session. Only
- * its hash is stored; it is valid 2 minutes and signs in once. Each ticket
+ * its hash is stored; it is valid 2 minutes and signs in once. An operator's
+ * ticket may name the account it signs in as argo, by its id only, never
+ * a viewer's (decision 0054). Each ticket
  * stands alone: a new one leaves an earlier unused one to expire.
  */
 export function createIssueSignInTicket(deps) {
-    return ({ fleetId, as = 'operator' }) => deps.uow.run(async (tx) => {
+    return ({ fleetId, as = 'operator', account }) => deps.uow.run(async (tx) => {
         if (!(await tx.operatorAccounts.findForFleet(fleetId))) {
             return refuse('FLEET_NOT_FOUND', `The installation hosts no fleet ${fleetId}`);
         }
+        if (as === 'viewer' && account !== undefined) {
+            return refuse('VIEWER_TICKET_NAMES_NO_ACCOUNT', 'A viewer ticket names no account: the viewer is no account');
+        }
         if (as === 'viewer') {
             const viewer = await findViewerShip(tx, fleetId);
             if (!viewer.isOk) {
@@ -27,6 +32,7 @@ export function createIssueSignInTicket(deps) {
         await tx.signInTickets.create({
             fleetId,
             as,
+            accountId: account?.id ?? null,
             tokenHash: deps.hasher.hash(ticket),
             issuedAt: at,
             expiresAt: new Date(at.getTime() + SIGN_IN_TICKET_VALID_MS),

package/dist/domain/identity/issue-sign-in-ticket.js.map

@@ -1 +1 @@
-{"version":3,"file":"issue-sign-in-ticket.js","sourceRoot":"","sources":["../../../src/domain/identity/issue-sign-in-ticket.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAe,MAAM,uBAAuB,CAAC;AAGpE,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,EAAiB,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAItD,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAiB,MAAM,qBAAqB,CAAC;AAgBpG;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAMvC;IACC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,UAAU,EAAE,EAAE,EAAE,CACtC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAiE,EAAE;QACvF,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,gBAAgB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACvD,OAAO,MAAM,CAAC,iBAAiB,EAAE,mCAAmC,OAAO,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjB,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,qBAAqB,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC;YAC5B,OAAO;YACP,EAAE;YACF,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YACnC,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,uBAAuB,CAAC;YAC3D,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,MAAM,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACjJ,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"issue-sign-in-ticket.js","sourceRoot":"","sources":["../../../src/domain/identity/issue-sign-in-ticket.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAe,MAAM,uBAAuB,CAAC;AAGpE,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,EAAiB,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAItD,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAiB,MAAM,qBAAqB,CAAC;AAkBpG;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAMvC;IACC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,CAC/C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAiE,EAAE;QACvF,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,gBAAgB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACvD,OAAO,MAAM,CAAC,iBAAiB,EAAE,mCAAmC,OAAO,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,EAAE,KAAK,QAAQ,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC7C,OAAO,MAAM,CAAC,gCAAgC,EAAE,4DAA4D,CAAC,CAAC;QAChH,CAAC;QACD,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjB,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,qBAAqB,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC;YAC5B,OAAO;YACP,EAAE;YACF,SAAS,EAAE,OAAO,EAAE,EAAE,IAAI,IAAI;YAC9B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YACnC,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,uBAAuB,CAAC;YAC3D,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,MAAM,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACjJ,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/domain/identity/ports.d.ts

@@ -1,5 +1,5 @@
-import type { ConsoleSessionId, CredentialId, FleetId, LeaseId, OperatorId, ShipId, Theme } from '@aeolus-fleet/common';
-import type { Caller, Crew } from '../shared/caller.js';
+import type { AccountId, AccountTokenClaims, ConsoleSessionId, CredentialId, FleetId, LeaseId, OperatorId, ShipId, Theme } from '@aeolus-fleet/common';
+import type { ShipCaller, Crew } from '../shared/caller.js';
 import type { ConsoleSession, ConsoleSessionEndReason } from './console-session.js';
 import type { Credential } from './credential.js';
 import type { Guide, GuideProgress } from './guide.js';
@@ -7,7 +7,7 @@ import type { Notice } from './notice.js';
 import type { OperatorAccount } from './operator-account.js';
 import type { SignInAs, SignInTicket } from './sign-in-ticket.js';
 /** The ship a crew token or a console session token belongs to, as the caller it makes. */
-export type AuthenticatedShip = Omit<Caller, 'consoleSessionId'>;
+export type AuthenticatedShip = Omit<ShipCaller, 'consoleSessionId'>;
 /** The ship a crew token crews, and the open lease the token belongs to. */
 export type AuthenticatedCrew = AuthenticatedShip & {
     leaseId: LeaseId;
@@ -96,9 +96,10 @@ export interface SignInTicketRepository {
     redeem(tokenHash: string, at: Date): Promise<{
         fleetId: FleetId;
         as: SignInAs;
+        accountId: AccountId | null;
     } | undefined>;
 }
-/** Outbound port: console sessions, always within one fleet. */
+/** Outbound port: console sessions, within one fleet but for the account's, which spans the installation. */
 export interface ConsoleSessionRepository {
     create(session: ConsoleSession): Promise<void>;
     /** The session, read without a lock. */
@@ -118,6 +119,15 @@ export interface ConsoleSessionRepository {
         at: Date;
         reason: ConsoleSessionEndReason;
     }): Promise<ConsoleSession[]>;
+    /**
+     * Ends every session the account signed in to as argo that has not ended, in
+     * every fleet of the installation, and returns them: a cut-off belongs to the
+     * installation, not to a fleet (decision 0055).
+     */
+    endAllOfAccount(accountId: AccountId, ending: {
+        at: Date;
+        reason: ConsoleSessionEndReason;
+    }): Promise<ConsoleSession[]>;
 }
 /**
  * Outbound port: who is calling. Each lookup is one query that returns the
@@ -146,7 +156,7 @@ export interface CallerLookup {
         tokenHash: string;
         now: Date;
     }): Promise<{
-        caller: Caller | Crew;
+        caller: ShipCaller | Crew;
         expiresAt: Date;
     } | undefined>;
     /** Why the console session with this token hash ended; undefined when it has not, or no session has the hash. */
@@ -191,3 +201,40 @@ export interface GuideProgressRepository {
         at: Date;
     } & GuideProgress): Promise<void>;
 }
+/**
+ * Outbound port: pagasae's signature on an account token (decision 0058).
+ * Core trusts one issuer and its published keys.
+ */
+export interface AccountTokenSignatures {
+    /**
+     * The token's claims when a key the issuer publishes signed it as an
+     * access token naming that issuer; undefined for any other token. Says
+     * nothing of its fleet, its end or a cut-off: the use case checks those.
+     */
+    verify(token: string): Promise<AccountTokenClaims | undefined>;
+}
+/** An account pagasae cut off (decision 0058): its tokens issued before `cutOffAt` are refused until `forgetAt`. */
+export interface AccountCutOff {
+    accountId: AccountId;
+    cutOffAt: Date;
+    forgetAt: Date;
+}
+/**
+ * Outbound port: the accounts pagasae cut off (decision 0058), kept by the
+ * installation for every fleet it hosts, each until the longest token it
+ * refuses has ended. Not scoped by fleet: an account's tokens go to several
+ * fleets, and the cut-off holds in each (ADR 0007, the installation).
+ */
+export interface AccountCutOffRepository {
+    /** Keeps the cut-off; one kept for the account with a later cut-off stays as it was. */
+    record(cutOff: AccountCutOff): Promise<void>;
+    /** When the account was last cut off, while that cut-off is kept at `at`; undefined otherwise. */
+    cutOffAt(accountId: AccountId, at: Date): Promise<Date | undefined>;
+    /** Forgets every cut-off kept no longer than `at`. */
+    forget(at: Date): Promise<void>;
+}
+export type AccountCutOffLookup = Pick<AccountCutOffRepository, 'cutOffAt'>;
+/** Outbound port: whether this installation hosts a fleet, so a token for any other is refused. */
+export interface HostedFleets {
+    isHosted(fleetId: FleetId): Promise<boolean>;
+}

package/dist/domain/identity/read-account.d.ts

@@ -1,5 +1,5 @@
-import type { Theme } from '@aeolus-fleet/common';
-import type { Caller } from '../shared/caller.js';
+import type { AccountId, Theme } from '@aeolus-fleet/common';
+import type { ShipCaller } from '../shared/caller.js';
 import { type DomainError } from '../shared/errors.js';
 import { type Result } from '../shared/result.js';
 import type { UnitOfWork } from '../shared/unit-of-work.js';
@@ -13,17 +13,21 @@ interface SessionView {
     device: string;
     since: Date;
 }
+/** The operator's session, with the account that signed in as argo, by its id, or none for argo's own sign-in (decision 0054). */
+interface OperatorSessionView extends SessionView {
+    accountId: AccountId | null;
+}
 /** The operator's account with this session, or a viewer's session alone: a viewer has no email and no theme (decision 0022). */
 export type AccountView = {
     kind: 'operator';
     email: string;
     theme: Theme;
-    session: SessionView;
+    session: OperatorSessionView;
 } | {
     kind: 'viewer';
     session: SessionView;
 };
-export type ReadAccount = (caller: Caller) => Promise<Result<AccountView, DomainError<'NOT_THE_OPERATOR_SHIP'>>>;
+export type ReadAccount = (caller: ShipCaller) => Promise<Result<AccountView, DomainError<'NOT_THE_OPERATOR_SHIP'>>>;
 /**
  * Use case: the signed-in operator's account, for the AccountMenu: their
  * email, their theme, and this console session; for a viewer session, the

package/dist/domain/identity/read-account.js

@@ -20,7 +20,7 @@ export function createReadAccount(deps) {
             kind: 'operator',
             email: account.email,
             theme: account.theme,
-            session: { device: session.device, since: session.createdAt },
+            session: { device: session.device, since: session.createdAt, accountId: session.accountId },
         });
     });
 }

package/dist/domain/identity/read-account.js.map

@@ -1 +1 @@
-{"version":3,"file":"read-account.js","sourceRoot":"","sources":["../../../src/domain/identity/read-account.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAoBtD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAwC;IACxE,OAAO,CAAC,MAAM,EAAE,EAAE,CAChB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAsE,EAAE;QAC5F,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;QACpC,MAAM,OAAO,GAAG,gBAAgB,IAAI,CAAC,MAAM,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACtG,IAAI,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,gBAAgB,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC,uBAAuB,EAAE,6DAA6D,CAAC,CAAC;QACxG,CAAC;QACD,OAAO,EAAE,CAAC;YACR,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE;SAC9D,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"read-account.js","sourceRoot":"","sources":["../../../src/domain/identity/read-account.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAyBtD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAwC;IACxE,OAAO,CAAC,MAAM,EAAE,EAAE,CAChB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAsE,EAAE;QAC5F,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;QACpC,MAAM,OAAO,GAAG,gBAAgB,IAAI,CAAC,MAAM,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACtG,IAAI,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,gBAAgB,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC,uBAAuB,EAAE,6DAA6D,CAAC,CAAC;QACxG,CAAC;QACD,OAAO,EAAE,CAAC;YACR,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;SAC5F,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/domain/identity/read-guide.d.ts

@@ -1,7 +1,7 @@
-import type { Caller } from '../shared/caller.js';
+import type { ShipCaller } from '../shared/caller.js';
 import { type GuideProgress, type GuideStep } from './guide.js';
 import type { GuideProgressRepository, GuideRepository } from './ports.js';
-export type ReadGuide = (caller: Caller) => Promise<{
+export type ReadGuide = (caller: ShipCaller) => Promise<{
     steps: readonly GuideStep[];
     progress: GuideProgress;
 } | null>;

package/dist/domain/identity/read-notices.d.ts

@@ -1,7 +1,7 @@
-import type { Caller } from '../shared/caller.js';
+import type { ShipCaller } from '../shared/caller.js';
 import { type Notice } from './notice.js';
 import type { NoticeDismissals, NoticeRepository } from './ports.js';
-export type ReadNotices = (caller: Caller) => Promise<Notice[]>;
+export type ReadNotices = (caller: ShipCaller) => Promise<Notice[]>;
 /**
  * Use case: the notices a console session shows above every page (decision
  * 0023): those of its audience, in the installation's order, less the

package/dist/domain/identity/record-guide-progress.d.ts

@@ -1,11 +1,11 @@
-import type { Caller } from '../shared/caller.js';
+import type { ShipCaller } from '../shared/caller.js';
 import type { Clock } from '../shared/clock.js';
 import { type DomainError } from '../shared/errors.js';
 import { type Result } from '../shared/result.js';
 import type { GuideProgress } from './guide.js';
 import type { GuideProgressRepository, GuideRepository } from './ports.js';
 export type RecordGuideProgressRefusal = DomainError<'GUIDE_NOT_FOUND' | 'GUIDE_STEP_NOT_FOUND'>;
-export type RecordGuideProgress = (caller: Caller, progress: GuideProgress) => Promise<Result<undefined, RecordGuideProgressRefusal>>;
+export type RecordGuideProgress = (caller: ShipCaller, progress: GuideProgress) => Promise<Result<undefined, RecordGuideProgressRefusal>>;
 /**
  * Use case: a console session records where it is in the guide, for itself
  * only (decision 0024): open at a step, skipped or finished; open at the

package/dist/domain/identity/redeem-sign-in-ticket.d.ts

@@ -19,7 +19,8 @@ export type RedeemSignInTicket = (input: {
 }) => Promise<Result<SignedIn, RedeemSignInTicketRefusal>>;
 /**
  * Use case: the console redeems a sign-in ticket the installation issued. An
- * operator's ticket starts the session exactly as after a password sign-in:
+ * operator's ticket starts the session exactly as after a password sign-in,
+ * keeping the account it names, if any (decision 0054):
  * it takes argo's lease over and ends any previous session. A viewer's starts
  * a viewer session beside any others (decision 0022). A ticket signs in once and
  * only before it expires; used, expired and unknown tickets are one refusal,

package/dist/domain/identity/redeem-sign-in-ticket.js

@@ -4,7 +4,8 @@ import { startConsoleSession } from './start-console-session.js';
 import { startViewerSession } from './start-viewer-session.js';
 /**
  * Use case: the console redeems a sign-in ticket the installation issued. An
- * operator's ticket starts the session exactly as after a password sign-in:
+ * operator's ticket starts the session exactly as after a password sign-in,
+ * keeping the account it names, if any (decision 0054):
  * it takes argo's lease over and ends any previous session. A viewer's starts
  * a viewer session beside any others (decision 0022). A ticket signs in once and
  * only before it expires; used, expired and unknown tickets are one refusal,
@@ -17,7 +18,7 @@ export function createRedeemSignInTicket(deps) {
         if (redeemed === undefined) {
             return refuse('SIGN_IN_TICKET_INVALID', 'This sign-in link is used or expired: sign in again');
         }
-        const session = { fleetId: redeemed.fleetId, device: input.device ?? UNKNOWN_DEVICE, at };
+        const session = { fleetId: redeemed.fleetId, device: input.device ?? UNKNOWN_DEVICE, accountId: redeemed.accountId, at };
         const starting = { tx, ids: deps.ids, hasher: deps.hasher, random: deps.random };
         return redeemed.as === 'viewer' ? startViewerSession(starting, session) : startConsoleSession(starting, session);
     });

package/dist/domain/identity/redeem-sign-in-ticket.js.map

@@ -1 +1 @@
-{"version":3,"file":"redeem-sign-in-ticket.js","sourceRoot":"","sources":["../../../src/domain/identity/redeem-sign-in-ticket.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAI/D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD,OAAO,EAAE,mBAAmB,EAA8B,MAAM,4BAA4B,CAAC;AAC7F,OAAO,EAAE,kBAAkB,EAA6B,MAAM,2BAA2B,CAAC;AAc1F;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAMxC;IACC,OAAO,CAAC,KAAK,EAAE,EAAE,CACf,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAwD,EAAE;QAC9E,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACnF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC,wBAAwB,EAAE,qDAAqD,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,OAAO,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,cAAc,EAAE,EAAE,EAAE,CAAC;QAC1F,MAAM,QAAQ,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QACjF,OAAO,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnH,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"redeem-sign-in-ticket.js","sourceRoot":"","sources":["../../../src/domain/identity/redeem-sign-in-ticket.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAI/D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAGtD,OAAO,EAAE,mBAAmB,EAA8B,MAAM,4BAA4B,CAAC;AAC7F,OAAO,EAAE,kBAAkB,EAA6B,MAAM,2BAA2B,CAAC;AAc1F;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAMxC;IACC,OAAO,CAAC,KAAK,EAAE,EAAE,CACf,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAwD,EAAE;QAC9E,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACnF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,MAAM,CAAC,wBAAwB,EAAE,qDAAqD,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,OAAO,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,cAAc,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC;QACzH,MAAM,QAAQ,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QACjF,OAAO,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/domain/identity/set-theme.d.ts

@@ -1,5 +1,5 @@
 import type { Theme } from '@aeolus-fleet/common';
-import type { Caller } from '../shared/caller.js';
+import type { ShipCaller } from '../shared/caller.js';
 import { type DomainError } from '../shared/errors.js';
 import { type Result } from '../shared/result.js';
 import type { UnitOfWork } from '../shared/unit-of-work.js';
@@ -7,7 +7,7 @@ import type { OperatorAccountRepository } from './ports.js';
 export interface SetThemeTx {
     operatorAccounts: Pick<OperatorAccountRepository, 'findForFleetForUpdate' | 'setTheme'>;
 }
-export type SetTheme = (caller: Caller, input: {
+export type SetTheme = (caller: ShipCaller, input: {
     theme: Theme;
 }) => Promise<Result<undefined, DomainError<'NOT_THE_OPERATOR_SHIP'>>>;
 /**

package/dist/domain/identity/sign-in-ticket.d.ts

@@ -1,4 +1,4 @@
-import type { FleetId } from '@aeolus-fleet/common';
+import type { AccountId, FleetId } from '@aeolus-fleet/common';
 /** Every sign-in ticket starts so: it says what it is, as a ship secret and a crew token do. */
 export declare const SIGN_IN_TICKET_PREFIX = "aeolus_st_v1_";
 /** How long a sign-in ticket stays valid after it is issued. */
@@ -14,6 +14,8 @@ export type SignInAs = 'operator' | 'viewer';
 export interface SignInTicket {
     fleetId: FleetId;
     as: SignInAs;
+    /** The account it signs in as argo, by its id only; null for argo's own or a viewer's ticket (decision 0054). */
+    accountId: AccountId | null;
     tokenHash: string;
     issuedAt: Date;
     expiresAt: Date;

package/dist/domain/identity/sign-in.d.ts

@@ -1,5 +1,5 @@
 import type { ConsoleSessionId, IdGenerator } from '@aeolus-fleet/common';
-import type { Caller } from '../shared/caller.js';
+import type { ShipCaller } from '../shared/caller.js';
 import type { Clock } from '../shared/clock.js';
 import { type DomainError } from '../shared/errors.js';
 import type { Result } from '../shared/result.js';
@@ -15,7 +15,7 @@ export interface SignedIn {
     token: string;
     consoleSessionId: ConsoleSessionId;
     expiresAt: Date;
-    caller: Caller;
+    caller: ShipCaller;
 }
 /** Only a wrong email or password in practice: the account's fleet always has its argo. */
 export type SignInRefusal = DomainError<'WRONG_EMAIL_OR_PASSWORD' | 'FLEET_NOT_FOUND' | 'NOT_THE_OPERATOR_SHIP'>;

package/dist/domain/identity/sign-in.js

@@ -35,6 +35,8 @@ export function createSignIn(deps) {
             return startConsoleSession({ tx, ids: deps.ids, hasher: deps.hasher, random: deps.random }, {
                 fleetId: account.fleetId,
                 device: input.device ?? UNKNOWN_DEVICE,
+                // argo's own sign-in, by its email and password: no account (decision 0054).
+                accountId: null,
                 at: deps.clock.now(),
             });
         });

package/dist/domain/identity/sign-in.js.map

@@ -1 +1 @@
-{"version":3,"file":"sign-in.js","sourceRoot":"","sources":["../../../src/domain/identity/sign-in.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAI/D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAAE,mBAAmB,EAA8B,MAAM,4BAA4B,CAAC;AAwB7F,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAE1D;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,YAAY,CAAC,IAQ5B;IACC,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACnD,yGAAyG;QACzG,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,YAAY,IAAI,SAAS,CAAC,CAAC;QACxG,IAAI,CAAC,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC;YACjC,OAAO,MAAM,CAAC,yBAAyB,EAAE,uBAAuB,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAA4C,EAAE;YACzE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;YACrE,IAAI,MAAM,EAAE,EAAE,KAAK,OAAO,CAAC,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC;gBAC9E,OAAO,MAAM,CAAC,yBAAyB,EAAE,uBAAuB,CAAC,CAAC;YACpE,CAAC;YACD,OAAO,mBAAmB,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;gBAC1F,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,cAAc;gBACtC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;aACrB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sign-in.js","sourceRoot":"","sources":["../../../src/domain/identity/sign-in.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAI/D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,OAAO,EAAE,mBAAmB,EAA8B,MAAM,4BAA4B,CAAC;AAwB7F,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAE1D;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,YAAY,CAAC,IAQ5B;IACC,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACnD,yGAAyG;QACzG,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,YAAY,IAAI,SAAS,CAAC,CAAC;QACxG,IAAI,CAAC,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC;YACjC,OAAO,MAAM,CAAC,yBAAyB,EAAE,uBAAuB,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAA4C,EAAE;YACzE,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;YACrE,IAAI,MAAM,EAAE,EAAE,KAAK,OAAO,CAAC,EAAE,IAAI,MAAM,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY,EAAE,CAAC;gBAC9E,OAAO,MAAM,CAAC,yBAAyB,EAAE,uBAAuB,CAAC,CAAC;YACpE,CAAC;YACD,OAAO,mBAAmB,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;gBAC1F,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,cAAc;gBACtC,6EAA6E;gBAC7E,SAAS,EAAE,IAAI;gBACf,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;aACrB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/domain/identity/sign-out.d.ts

@@ -1,13 +1,13 @@
 import type { IdGenerator } from '@aeolus-fleet/common';
 import { type LeaseTx } from '../registry/public.js';
-import type { Caller } from '../shared/caller.js';
+import type { ShipCaller } from '../shared/caller.js';
 import type { Clock } from '../shared/clock.js';
 import type { UnitOfWork } from '../shared/unit-of-work.js';
 import type { ConsoleSessionRepository } from './ports.js';
 export interface SignOutTx extends LeaseTx {
     consoleSessions: ConsoleSessionRepository;
 }
-export type SignOut = (caller: Caller) => Promise<void>;
+export type SignOut = (caller: ShipCaller) => Promise<void>;
 /**
  * Use case: ends the caller's console session and releases the lease on `argo`
  * it holds; a viewer session holds none. Signing out twice, or without a

package/dist/domain/identity/sign-out.js

@@ -20,7 +20,7 @@ export function createSignOut(deps) {
                 await endLease({ tx, ids: deps.ids }, {
                     fleetId: session.fleetId,
                     leaseId: session.leaseId,
-                    actor: shipActor(session.shipId),
+                    actor: session.accountId === null ? shipActor(session.shipId) : { kind: 'ship', shipId: session.shipId, signedInAccountId: session.accountId },
                     at,
                     reason: 'signedOut',
                 });

package/dist/domain/identity/sign-out.js.map

@@ -1 +1 @@
-{"version":3,"file":"sign-out.js","sourceRoot":"","sources":["../../../src/domain/identity/sign-out.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAgB,MAAM,uBAAuB,CAAC;AAG/D,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAUzC;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAoE;IAChG,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE;QACtB,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;QACpC,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACrH,qEAAqE;YACrE,IAAI,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC7B,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE;oBACpC,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC;oBAChC,EAAE;oBACF,MAAM,EAAE,WAAW;iBACpB,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sign-out.js","sourceRoot":"","sources":["../../../src/domain/identity/sign-out.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAgB,MAAM,uBAAuB,CAAC;AAG/D,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAUzC;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAoE;IAChG,OAAO,KAAK,EAAE,MAAM,EAAE,EAAE;QACtB,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;QACpC,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,OAAO;QACT,CAAC;QAED,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC9B,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YAC5B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;YACrH,qEAAqE;YACrE,IAAI,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC;gBAC7B,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE;oBACpC,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,KAAK,EAAE,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,CAAC,SAAS,EAAE;oBAC9I,EAAE;oBACF,MAAM,EAAE,WAAW;iBACpB,CAAC,CAAC;YACL,CAAC;YACD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/domain/identity/start-console-session.d.ts

@@ -1,4 +1,4 @@
-import type { FleetId, IdGenerator } from '@aeolus-fleet/common';
+import type { AccountId, FleetId, IdGenerator } from '@aeolus-fleet/common';
 import { type LeaseTx, type ShipTx } from '../registry/public.js';
 import type { DomainError } from '../shared/errors.js';
 import { type Result } from '../shared/result.js';
@@ -13,7 +13,8 @@ export interface StartConsoleSessionTx extends LeaseTx, ShipTx {
  * in the caller's unit of work, however the operator proved who they are: a
  * password or a sign-in ticket. It ends the previous console session and
  * takes argo's lease over, so what argo held in flight returns to pending.
- * The session records the device it signed in from, also argo's location.
+ * The session records the device it signed in from, also argo's location,
+ * and the account that signed in as argo, if one did (decision 0054).
  */
 export declare function startConsoleSession(deps: {
     tx: StartConsoleSessionTx;
@@ -23,5 +24,6 @@ export declare function startConsoleSession(deps: {
 }, input: {
     fleetId: FleetId;
     device: string;
+    accountId: AccountId | null;
     at: Date;
 }): Promise<Result<SignedIn, DomainError<'FLEET_NOT_FOUND' | 'NOT_THE_OPERATOR_SHIP'>>>;

package/dist/domain/identity/start-console-session.js

@@ -7,11 +7,12 @@ import { CONSOLE_SESSION_IDLE_LIMIT_MS, consoleLocation, consoleSessionExpiry }
  * in the caller's unit of work, however the operator proved who they are: a
  * password or a sign-in ticket. It ends the previous console session and
  * takes argo's lease over, so what argo held in flight returns to pending.
- * The session records the device it signed in from, also argo's location.
+ * The session records the device it signed in from, also argo's location,
+ * and the account that signed in as argo, if one did (decision 0054).
  */
 export async function startConsoleSession(deps, input) {
     const { tx, ids } = deps;
-    const { fleetId, device, at } = input;
+    const { fleetId, device, accountId, at } = input;
     const found = await findOperatorShip(tx, fleetId);
     if (!found.isOk) {
         return found;
@@ -24,7 +25,7 @@ export async function startConsoleSession(deps, input) {
         shipId: argo.id,
         kind: argo.kind,
         location: consoleLocation(device),
-        actor: shipActor(argo.id),
+        actor: accountId === null ? shipActor(argo.id) : { kind: 'ship', shipId: argo.id, signedInAccountId: accountId },
         at,
     });
     if (!takenOver.isOk) {
@@ -41,6 +42,7 @@ export async function startConsoleSession(deps, input) {
         idleLimitMs: CONSOLE_SESSION_IDLE_LIMIT_MS,
         endsBy: null,
         device,
+        accountId,
         tokenHash: deps.hasher.hash(token),
         createdAt: at,
         lastUsedAt: at,
@@ -48,7 +50,7 @@ export async function startConsoleSession(deps, input) {
         endedAt: null,
         endReason: null,
     });
-    const caller = { shipId: argo.id, fleetId: argo.fleetId, kind: argo.kind, scopes: argo.scopes, consoleSessionId };
+    const caller = { shipId: argo.id, fleetId: argo.fleetId, kind: argo.kind, scopes: argo.scopes, consoleSessionId, ...(accountId === null ? {} : { signedInAccountId: accountId }) };
     return ok({ token, consoleSessionId, expiresAt, caller });
 }
 //# sourceMappingURL=start-console-session.js.map