@aeolus-fleet/core 0.27.0 → 0.28.0

package/dist/domain/registry/network-settings.d.ts

@@ -2,118 +2,74 @@
  * The fleet's network settings (decision 0034): which ships may send to,
  * read or manage which. A rule names its verb and says that the ships
  * matching one selector may do it to the ships matching another; allow-only,
- * no deny rules, no precedence. Beside its rules a fleet holds the switches
- * of the built-in rules that can be off, with a version that moves on every
- * change, so a refusal names the settings that refused it.
+ * no deny rules, no precedence. The fleet holds its own rules, set whole by
+ * applying a draft, or none for all-to-all, beside the switch of the viewer
+ * reading, with a version that moves on every change of what is in force, so
+ * a refusal names the settings that refused it.
  */
-import { type FleetId, type LabelId, type LabelValueId, type BuiltInRule, type NetworkPluginDeclaration, type NetworkVerb, type SelectorTerm, type SetBuiltInRuleInput, type ShipId, type ShipKind, type WhileUnavailable } from '@aeolus-fleet/common';
+import { type FleetId, type LabelId, type LabelValueId, type BuiltInRule, type NetworkVerb, type SelectorTerm, type SetBuiltInRuleInput, type ShipId, type ShipKind } from '@aeolus-fleet/common';
 import { type DomainError } from '../shared/errors.js';
 import type { Actor, NewEvent } from '../shared/events.js';
 import { type Result } from '../shared/result.js';
+import type { DeclaredNetworkRules } from './declared-network-rules.js';
+import type { LabelOwner } from './label.js';
 /** The ships for which every term of `from` holds may do its verb to the ships for which every term of `to` holds. */
 export interface NetworkRule {
     verb: NetworkVerb;
     from: readonly SelectorTerm[];
     to: readonly SelectorTerm[];
 }
-/**
- * The fleet's networking plugin (decision 0035): the ship that alone sets the
- * rules while registered, with what it declared for while it is unavailable.
- */
-export interface NetworkPlugin extends NetworkPluginDeclaration {
-    shipId: ShipId;
-}
-/**
- * The built-in rules that can be off (decision 0034): the viewer reading
- * every ship, argo's to switch, and open, every ship to every ship, one per
- * verb, the networking plugin's to switch. A fleet starts with all on.
- */
-export interface BuiltInSwitches {
-    isViewerReadOn: boolean;
-    open: Readonly<Record<NetworkVerb, boolean>>;
-}
 export interface NetworkSettings {
     fleetId: FleetId;
-    /** The rules beside the built-in ones, the networking plugin's (decision 0035); none allows only the built-in rules. */
-    rules: readonly NetworkRule[];
-    builtIns: BuiltInSwitches;
-    /** 0 until the fleet first changes its settings; one more on every change. */
+    /** The fleet's own rules beside the built-in and the declared ones, as last applied; none while none are, all-to-all with open on. */
+    rules: readonly NetworkRule[] | null;
+    /** The viewer reading every ship, the one built-in rule an actor turns (decision 0034); on at fleet create. */
+    isViewerReadOn: boolean;
+    /** 0 until the fleet first changes its settings; one more on every change of what is in force. */
     version: number;
-    /** The fleet's networking plugin, or none: then the fleet has no rules, and nobody sets them. */
-    plugin: NetworkPlugin | null;
 }
-/** Every built-in rule on: what a fleet starts with, and what no networking plugin leaves. */
-export declare const BUILT_INS_ON: BuiltInSwitches;
-/** A fleet that never set rules: none, every built-in rule on, at version 0, without a plugin. */
+/** A fleet that never set rules: none applied, the viewer reading on, at version 0. */
 export declare function noNetworkSettings(fleetId: FleetId): NetworkSettings;
-export type NotTheNetworkPlugin = DomainError<'NOT_THE_NETWORK_PLUGIN'>;
-export type SetNetworkRulesRefusal = DomainError<'INVALID_NETWORK_RULES'> | NotTheNetworkPlugin;
-export type RegisterNetworkPluginRefusal = DomainError<'NETWORK_PLUGIN_REGISTERED'>;
+export type InvalidNetworkRules = DomainError<'INVALID_NETWORK_RULES'>;
 /**
- * The ship becomes the fleet's networking plugin, with what it declared, at
- * the next version, with NetworkPluginRegistered. A fleet without a plugin
- * has no rules, so the plugin starts from none until it supplies its own. The plugin may register again, replacing what it
- * declared; another ship is refused until it unregisters: one owner of the
- * rules, as a label has one.
+ * What breaks the decisions' limits on the fleet's own rules, said for the
+ * caller with its decision, or undefined when they keep them: at most 200,
+ * counted alone, beside the declared ones (decision 0037); each selector at
+ * most 20 terms, as a ship carries no more label values, each term once, and
+ * a term of the same value on a label on both sides of its rule, as it binds
+ * that label there. An id need not exist: an unknown one matches no ship, as
+ * in label selection. None, all-to-all, keeps them.
  */
-export declare function registerNetworkPlugin(current: NetworkSettings, change: {
-    shipId: ShipId;
-    declaration: NetworkPluginDeclaration;
-    at: Date;
-    actor: Actor;
-}): Result<{
-    settings: NetworkSettings;
-    events: NewEvent[];
-}, RegisterNetworkPluginRefusal>;
-/**
- * The fleet's plugin goes, and its rules with it, and the open rules are on
- * again: no plugin is all-to-all (decision 0035), at the next version, with
- * NetworkPluginUnregistered. The viewer reading stays as argo set it. Only
- * the plugin's own ship unregisters it; its retirement does too.
- */
-export declare function unregisterNetworkPlugin(current: NetworkSettings, change: {
-    shipId: ShipId;
-    at: Date;
-    actor: Actor;
-}): Result<{
-    settings: NetworkSettings;
-    events: NewEvent[];
-}, NotTheNetworkPlugin>;
+export declare function invalidRules(rules: readonly NetworkRule[] | null): string | undefined;
 /**
- * The fleet's rules from now on, replacing the ones it had, at the next
- * version, with NetworkRulesSet. The rules are within the decisions' limits:
- * at most 200 of argo's plus every rule the fleet's ships declared, which the
- * plugin adds to argo's when it supplies them (decision 0037); each selector
- * at most 20 terms, as a ship carries no more label values, each term once, and a term of the same value on a label on
- * both sides of its rule, as it binds that label there. An id need not
- * exist: an unknown one matches no ship, as in label selection. Only the
- * fleet's registered networking plugin sets them, argo included: rules exist
- * only through a plugin (decision 0035).
+ * The fleet's rules from now on, the draft's, replacing the ones it had, at
+ * the next version, with NetworkRulesSet naming how many, none for
+ * all-to-all. The caller saw the settings at `version`: once they moved, the
+ * draft's reach may differ from what the caller looked at, so the apply is
+ * refused and the draft kept.
  */
-export declare function setNetworkRules(current: NetworkSettings, change: {
-    rules: readonly NetworkRule[];
-    declaredRules: number;
-    shipId: ShipId;
+export declare function applyNetworkRules(current: NetworkSettings, change: {
+    rules: readonly NetworkRule[] | null;
+    version: number;
     at: Date;
     actor: Actor;
 }): Result<{
     settings: NetworkSettings;
     events: NewEvent[];
-}, SetNetworkRulesRefusal>;
-export type SetBuiltInRuleRefusal = DomainError<'BUILT_IN_RULE_FIXED' | 'NOT_THE_OPERATOR_SHIP'> | NotTheNetworkPlugin;
+}, DomainError<'NETWORK_SETTINGS_CHANGED'>>;
+/** The settings at the next version, as the declared rules in force changed with them (decision 0037). */
+export declare function withDeclaredRulesChanged(current: NetworkSettings): NetworkSettings;
+export type SetBuiltInRuleRefusal = DomainError<'BUILT_IN_RULE_FIXED'>;
 /**
  * A built-in rule turned on or off, as its own action (decision 0034): the
- * viewer reading by argo, open for one verb by the fleet's networking plugin.
- * argo, the owner and the answer are never off, so turning them is refused.
- * A change moves the version and writes BuiltInRuleChanged; a rule already
- * as asked changes nothing.
+ * viewer reading, by any actor holding fleet:network (decision 0053). argo,
+ * the owner, the answer, a connected plugin's reading and the installation's
+ * managing are never off, and open follows the applied rules, so turning them
+ * is refused. A change moves the version and writes BuiltInRuleChanged; a
+ * rule already as asked changes nothing.
  */
 export declare function setBuiltInRule(current: NetworkSettings, change: {
     input: SetBuiltInRuleInput;
-    caller: {
-        shipId: ShipId;
-        isOperator: boolean;
-    };
     at: Date;
     actor: Actor;
 }): Result<{
@@ -127,69 +83,94 @@ export declare function termText(term: SelectorTerm): string;
 /** A copy of the rule, so what is kept never changes with what was given. */
 export declare function copyOfRule(rule: NetworkRule): NetworkRule;
 /**
- * Whether the plugin responds at `now` (decision 0035): its ship holds a
- * lease whose crew called the fleet no longer ago than it declared. Its last
- * call is the lease's last seen; nothing else acts on it, and nothing here
- * ends the lease.
+ * What a check is made against (decisions 0034, 0037): open while the
+ * fleet's own rules are none, all-to-all; the viewer reading as it was
+ * turned; otherwise the fleet's own rules, then every declarer's, merged at
+ * check time, each named by its place in its own list.
  */
-export declare function isNetworkPluginResponding(plugin: NetworkPlugin, crew: {
-    lastSeenAt: Date | undefined;
-    now: Date;
-}): boolean;
-/** The rules and built-in switches a send is checked against, and what the plugin declared when it is the reason. */
 export interface RulesInForce {
+    isOpen: boolean;
+    isViewerReadOn: boolean;
     rules: readonly NetworkRule[];
-    builtIns: BuiltInSwitches;
-    whilePluginUnavailable: Exclude<WhileUnavailable, 'open-all'> | null;
+    declared: readonly DeclaredNetworkRules[];
 }
-/**
- * The rules in force: the settings' own, unless the fleet's networking plugin
- * is not responding. Then what it declared applies: block-all leaves only
- * the built-in rules that are never off and the viewer reading, open-all
- * open on for every verb (all-to-all), keep-latest the rules and switches it
- * left last.
- */
-export declare function rulesInForce(settings: NetworkSettings, isPluginResponding: boolean): RulesInForce;
+/** The rules in force for the fleet's own rules, applied or a draft's, beside the declared ones. */
+export declare function rulesInForce(own: {
+    rules: readonly NetworkRule[] | null;
+    isViewerReadOn: boolean;
+}, declared: readonly DeclaredNetworkRules[]): RulesInForce;
 /** A label value a ship carries, with the label it is of, so a term of any or the same value finds it. */
 export interface ReachingLabel {
     labelId: LabelId;
     valueId: LabelValueId;
 }
-/** A ship as a send's check sees it: its id and owner, for the owner exception, its kind, for the argo exception, and the label values it carries. */
+/**
+ * A ship as a send's check sees it: its id and owner, for the owner exception,
+ * its kind, for the argo exception, whether argo connected it as a plugin,
+ * whether its owner is a person ship, for the installation's rule, and the
+ * label values it carries.
+ */
 export interface ReachingShip {
     id: ShipId;
     owner: ShipId | null;
     kind: ShipKind;
+    isConnectedPlugin: boolean;
+    /** Whether it is owned by a person ship, a person ship owning itself (decision 0045). */
+    isOwnedByPerson: boolean;
     labels: readonly ReachingLabel[];
 }
+/**
+ * An account as a check sees it (decision 0057): the label values of `group`
+ * its token carries, and its person ship, which owns itself and through
+ * which the account owns: a selector's owner terms see the person ship as
+ * the account's owner.
+ */
+export interface ReachingAccount {
+    kind: 'account';
+    personShipId: ShipId | null;
+    labels: readonly ReachingLabel[];
+}
+/** The installation as a check sees it: no labels, no owner; it manages person ships and what they own by its built-in rule. */
+export interface ReachingInstallation {
+    kind: 'installation';
+}
+/** Whoever does the verb: a ship, an account or the installation (decision 0057). */
+export type ReachingActor = ReachingShip | ReachingAccount | ReachingInstallation;
 /**
  * The rule that lets the sender do the verb to the recipient, or undefined
  * when none does. The built-in rules that are never off hold whatever the
  * rules: argo reaches every ship and every ship reaches argo, but reads argo
  * only by a rule, so argo's messages are not every ship's to read; an owner's
- * ship reaches the ships it owns (decision 0045), and a ship answers the sender of
- * a message it received. The viewer reads every ship while that is on, and
- * every ship reaches every ship by a verb while open is on for it. Otherwise
- * a rule of the verb must match the sender with its `from` and the recipient
- * with its `to`, named by its place in the list. The built-in rules come
- * first, in that order, as the rule list shows them.
+ * ship reaches the ships it owns (decision 0045), and an account the ships
+ * its person ship owns; a ship answers the sender of a message it received;
+ * a plugin argo connected reads every ship; and the installation manages
+ * person ships and the ships they own (decision 0020). The viewer reads
+ * every ship while that is on, and every actor reaches every ship by every
+ * verb while open is. Otherwise a rule of the verb must match the sender
+ * with its `from` and the recipient with its `to`: one of the fleet's own,
+ * named by its place in that list, or a declared one, named by its declarer
+ * and its place in the declarer's list. The built-in rules come first, in
+ * that order, as the rule list shows them.
  */
-export declare function reachRuleOf(settings: Pick<RulesInForce, 'rules' | 'builtIns'>, send: {
+export declare function reachRuleOf(inForce: RulesInForce, send: {
     verb: NetworkVerb;
-    sender: ReachingShip;
+    sender: ReachingActor;
     recipient: ReachingShip;
     isAnswerToSender: boolean;
 }): ReachRule | undefined;
-/** A built-in rule, or one of the settings' rules by its place in the list. */
+/** A built-in rule, one of the fleet's own rules by its place in that list, or a declared rule by its declarer and its place in the declarer's list. */
 export type ReachRule = {
     builtIn: BuiltInRule;
 } | {
+    rule: number;
+} | {
+    declared: LabelOwner;
     index: number;
 };
-/** Whether the settings let the sender do the verb to the recipient: some rule does (see reachRuleOf). */
-export declare function allowsReach(settings: Pick<RulesInForce, 'rules' | 'builtIns'>, send: {
+/** Whether the rules in force let the sender do the verb to the recipient: some rule does (see reachRuleOf). */
+export declare function allowsReach(inForce: RulesInForce, send: {
     verb: NetworkVerb;
-    sender: ReachingShip;
+    sender: ReachingActor;
     recipient: ReachingShip;
     isAnswerToSender: boolean;
 }): boolean;

package/dist/domain/registry/network-settings.js

@@ -2,102 +2,50 @@
  * The fleet's network settings (decision 0034): which ships may send to,
  * read or manage which. A rule names its verb and says that the ships
  * matching one selector may do it to the ships matching another; allow-only,
- * no deny rules, no precedence. Beside its rules a fleet holds the switches
- * of the built-in rules that can be off, with a version that moves on every
- * change, so a refusal names the settings that refused it.
+ * no deny rules, no precedence. The fleet holds its own rules, set whole by
+ * applying a draft, or none for all-to-all, beside the switch of the viewer
+ * reading, with a version that moves on every change of what is in force, so
+ * a refusal names the settings that refused it.
  */
-import { ANY_LABEL_VALUE, NETWORK_RULES_MAX, NETWORK_VERBS, SAME_LABEL_VALUE, SHIP_LABELS_MAX, isOwnerTerm, } from '@aeolus-fleet/common';
+import { ANY_LABEL_VALUE, NETWORK_RULES_MAX, SAME_LABEL_VALUE, SHIP_LABELS_MAX, isOwnerTerm, } from '@aeolus-fleet/common';
 import { refuse } from '../shared/errors.js';
 import { ok } from '../shared/result.js';
-/** Every built-in rule on: what a fleet starts with, and what no networking plugin leaves. */
-export const BUILT_INS_ON = { isViewerReadOn: true, open: { send: true, read: true, manage: true } };
-/** A fleet that never set rules: none, every built-in rule on, at version 0, without a plugin. */
+/** A fleet that never set rules: none applied, the viewer reading on, at version 0. */
 export function noNetworkSettings(fleetId) {
-    return { fleetId, rules: [], builtIns: BUILT_INS_ON, version: 0, plugin: null };
-}
-function refuseNotThePlugin() {
-    return refuse('NOT_THE_NETWORK_PLUGIN', "Only the fleet's networking plugin does this (decision 0035)");
+    return { fleetId, rules: null, isViewerReadOn: true, version: 0 };
 }
 /**
- * The ship becomes the fleet's networking plugin, with what it declared, at
- * the next version, with NetworkPluginRegistered. A fleet without a plugin
- * has no rules, so the plugin starts from none until it supplies its own. The plugin may register again, replacing what it
- * declared; another ship is refused until it unregisters: one owner of the
- * rules, as a label has one.
+ * What breaks the decisions' limits on the fleet's own rules, said for the
+ * caller with its decision, or undefined when they keep them: at most 200,
+ * counted alone, beside the declared ones (decision 0037); each selector at
+ * most 20 terms, as a ship carries no more label values, each term once, and
+ * a term of the same value on a label on both sides of its rule, as it binds
+ * that label there. An id need not exist: an unknown one matches no ship, as
+ * in label selection. None, all-to-all, keeps them.
  */
-export function registerNetworkPlugin(current, change) {
-    const { shipId, declaration } = change;
-    if (current.plugin !== null && current.plugin.shipId !== shipId) {
-        return refuse('NETWORK_PLUGIN_REGISTERED', 'The fleet already has a networking plugin; it unregisters first (decision 0035)');
+export function invalidRules(rules) {
+    if (rules === null) {
+        return undefined;
     }
-    const settings = {
-        ...current,
-        version: current.version + 1,
-        plugin: { shipId, whileUnavailable: declaration.whileUnavailable, notRespondingAfterSeconds: declaration.notRespondingAfterSeconds },
-    };
-    return ok({
-        settings,
-        events: [
-            {
-                type: 'NetworkPluginRegistered',
-                fleetId: current.fleetId,
-                occurredAt: change.at,
-                actor: change.actor,
-                shipId,
-                details: { version: settings.version, whileUnavailable: declaration.whileUnavailable, notRespondingAfterSeconds: declaration.notRespondingAfterSeconds },
-            },
-        ],
-    });
-}
-/**
- * The fleet's plugin goes, and its rules with it, and the open rules are on
- * again: no plugin is all-to-all (decision 0035), at the next version, with
- * NetworkPluginUnregistered. The viewer reading stays as argo set it. Only
- * the plugin's own ship unregisters it; its retirement does too.
- */
-export function unregisterNetworkPlugin(current, change) {
-    if (current.plugin?.shipId !== change.shipId) {
-        return refuseNotThePlugin();
+    if (rules.length > NETWORK_RULES_MAX) {
+        return `A fleet holds at most ${String(NETWORK_RULES_MAX)} network rules of its own, beside the ones its ships declared (decision 0037)`;
     }
-    const settings = { fleetId: current.fleetId, rules: [], builtIns: { ...current.builtIns, open: BUILT_INS_ON.open }, version: current.version + 1, plugin: null };
-    return ok({
-        settings,
-        events: [
-            {
-                type: 'NetworkPluginUnregistered',
-                fleetId: current.fleetId,
-                occurredAt: change.at,
-                actor: change.actor,
-                shipId: change.shipId,
-                details: { version: settings.version },
-            },
-        ],
-    });
+    const invalid = rules.map(invalidRule).find((broken) => broken !== undefined);
+    return invalid === undefined ? undefined : `${invalid} (decision 0034)`;
 }
 /**
- * The fleet's rules from now on, replacing the ones it had, at the next
- * version, with NetworkRulesSet. The rules are within the decisions' limits:
- * at most 200 of argo's plus every rule the fleet's ships declared, which the
- * plugin adds to argo's when it supplies them (decision 0037); each selector
- * at most 20 terms, as a ship carries no more label values, each term once, and a term of the same value on a label on
- * both sides of its rule, as it binds that label there. An id need not
- * exist: an unknown one matches no ship, as in label selection. Only the
- * fleet's registered networking plugin sets them, argo included: rules exist
- * only through a plugin (decision 0035).
+ * The fleet's rules from now on, the draft's, replacing the ones it had, at
+ * the next version, with NetworkRulesSet naming how many, none for
+ * all-to-all. The caller saw the settings at `version`: once they moved, the
+ * draft's reach may differ from what the caller looked at, so the apply is
+ * refused and the draft kept.
  */
-export function setNetworkRules(current, change) {
-    const { rules, declaredRules } = change;
-    if (current.plugin?.shipId !== change.shipId) {
-        return refuseNotThePlugin();
-    }
-    if (rules.length > NETWORK_RULES_MAX + declaredRules) {
-        return refuse('INVALID_NETWORK_RULES', `A fleet holds at most ${String(NETWORK_RULES_MAX)} network rules of argo's plus the ${String(declaredRules)} its ships declared (decision 0037)`);
+export function applyNetworkRules(current, change) {
+    const { rules } = change;
+    if (change.version !== current.version) {
+        return refuse('NETWORK_SETTINGS_CHANGED', `The network settings are at version ${String(current.version)} now, not ${String(change.version)}: look at the draft again before applying it`);
     }
-    const invalid = rules.map(invalidRule).find((broken) => broken !== undefined);
-    if (invalid !== undefined) {
-        return refuse('INVALID_NETWORK_RULES', `${invalid} (decision 0034)`);
-    }
-    const settings = { ...current, rules: rules.map(copyOfRule), version: current.version + 1 };
+    const settings = { ...current, rules: rules === null ? null : rules.map(copyOfRule), version: current.version + 1 };
     return ok({
         settings,
         events: [
@@ -106,38 +54,35 @@ export function setNetworkRules(current, change) {
                 fleetId: current.fleetId,
                 occurredAt: change.at,
                 actor: change.actor,
-                details: { version: settings.version, rules: rules.length },
+                details: { version: settings.version, rules: rules === null ? null : rules.length },
             },
         ],
     });
 }
+/** The settings at the next version, as the declared rules in force changed with them (decision 0037). */
+export function withDeclaredRulesChanged(current) {
+    return { ...current, version: current.version + 1 };
+}
 /**
  * A built-in rule turned on or off, as its own action (decision 0034): the
- * viewer reading by argo, open for one verb by the fleet's networking plugin.
- * argo, the owner and the answer are never off, so turning them is refused.
- * A change moves the version and writes BuiltInRuleChanged; a rule already
- * as asked changes nothing.
+ * viewer reading, by any actor holding fleet:network (decision 0053). argo,
+ * the owner, the answer, a connected plugin's reading and the installation's
+ * managing are never off, and open follows the applied rules, so turning them
+ * is refused. A change moves the version and writes BuiltInRuleChanged; a
+ * rule already as asked changes nothing.
  */
 export function setBuiltInRule(current, change) {
-    const { input, caller } = change;
-    if (input.rule === 'argo' || input.rule === 'owner' || input.rule === 'answer') {
-        return refuse('BUILT_IN_RULE_FIXED', `The built-in rule ${input.rule} is never off (decision 0034)`);
+    const { input } = change;
+    if (input.rule === 'open') {
+        return refuse('BUILT_IN_RULE_FIXED', 'The built-in rule open is on exactly while the fleet has no rules applied (decision 0034)');
     }
-    if (input.rule === 'viewerRead' && !caller.isOperator) {
-        return refuse('NOT_THE_OPERATOR_SHIP', 'Only argo turns the viewer reading on or off (decision 0034)');
-    }
-    if (input.rule === 'open' && current.plugin?.shipId !== caller.shipId) {
-        return refuseNotThePlugin();
+    if (input.rule !== 'viewerRead') {
+        return refuse('BUILT_IN_RULE_FIXED', `The built-in rule ${input.rule} is never off (decision 0034)`);
     }
-    // The input names a verb for open and for open only (common's schema).
-    const { verb } = input;
-    const builtIns = input.rule === 'viewerRead' || verb === undefined
-        ? { ...current.builtIns, isViewerReadOn: input.rule === 'viewerRead' ? input.isOn : current.builtIns.isViewerReadOn }
-        : { ...current.builtIns, open: { ...current.builtIns.open, [verb]: input.isOn } };
-    if (builtIns.isViewerReadOn === current.builtIns.isViewerReadOn && NETWORK_VERBS.every((verb) => builtIns.open[verb] === current.builtIns.open[verb])) {
+    if (input.isOn === current.isViewerReadOn) {
         return ok({ settings: current, events: [] });
     }
-    const settings = { ...current, builtIns, version: current.version + 1 };
+    const settings = { ...current, isViewerReadOn: input.isOn, version: current.version + 1 };
     return ok({
         settings,
         events: [
@@ -146,7 +91,7 @@ export function setBuiltInRule(current, change) {
                 fleetId: current.fleetId,
                 occurredAt: change.at,
                 actor: change.actor,
-                details: { rule: input.rule, ...(verb === undefined ? {} : { verb }), isOn: input.isOn, version: settings.version },
+                details: { rule: input.rule, isOn: input.isOn, version: settings.version },
             },
         ],
     });
@@ -193,76 +138,82 @@ export function copyOfRule(rule) {
 function copyOfTerm(term) {
     return typeof term === 'string' ? term : { ...term };
 }
-const MILLISECONDS_PER_SECOND = 1000;
-/**
- * Whether the plugin responds at `now` (decision 0035): its ship holds a
- * lease whose crew called the fleet no longer ago than it declared. Its last
- * call is the lease's last seen; nothing else acts on it, and nothing here
- * ends the lease.
- */
-export function isNetworkPluginResponding(plugin, crew) {
-    const { lastSeenAt, now } = crew;
-    return lastSeenAt !== undefined && now.getTime() - lastSeenAt.getTime() <= plugin.notRespondingAfterSeconds * MILLISECONDS_PER_SECOND;
+/** The rules in force for the fleet's own rules, applied or a draft's, beside the declared ones. */
+export function rulesInForce(own, declared) {
+    return { isOpen: own.rules === null, isViewerReadOn: own.isViewerReadOn, rules: own.rules ?? [], declared };
 }
-/**
- * The rules in force: the settings' own, unless the fleet's networking plugin
- * is not responding. Then what it declared applies: block-all leaves only
- * the built-in rules that are never off and the viewer reading, open-all
- * open on for every verb (all-to-all), keep-latest the rules and switches it
- * left last.
- */
-export function rulesInForce(settings, isPluginResponding) {
-    const { plugin, rules, builtIns } = settings;
-    if (plugin === null || isPluginResponding) {
-        return { rules, builtIns, whilePluginUnavailable: null };
+function selectedOf(actor) {
+    if (actor.kind === 'account') {
+        return { owner: actor.personShipId, labels: actor.labels };
     }
-    switch (plugin.whileUnavailable) {
-        case 'block-all':
-            return { rules: [], builtIns: { ...builtIns, open: { send: false, read: false, manage: false } }, whilePluginUnavailable: 'block-all' };
-        case 'open-all':
-            return { rules, builtIns: { ...builtIns, open: BUILT_INS_ON.open }, whilePluginUnavailable: null };
-        case 'keep-latest':
-            return { rules, builtIns, whilePluginUnavailable: 'keep-latest' };
+    return actor.kind === 'installation' ? { owner: null, labels: [] } : { owner: actor.owner, labels: actor.labels };
+}
+/** The ship the actor owns ships as: a ship itself, an account its person ship; the installation none. */
+function owningShipOf(actor) {
+    if (actor.kind === 'account') {
+        return actor.personShipId;
     }
+    return actor.kind === 'installation' ? null : actor.id;
 }
 /**
  * The rule that lets the sender do the verb to the recipient, or undefined
  * when none does. The built-in rules that are never off hold whatever the
  * rules: argo reaches every ship and every ship reaches argo, but reads argo
  * only by a rule, so argo's messages are not every ship's to read; an owner's
- * ship reaches the ships it owns (decision 0045), and a ship answers the sender of
- * a message it received. The viewer reads every ship while that is on, and
- * every ship reaches every ship by a verb while open is on for it. Otherwise
- * a rule of the verb must match the sender with its `from` and the recipient
- * with its `to`, named by its place in the list. The built-in rules come
- * first, in that order, as the rule list shows them.
+ * ship reaches the ships it owns (decision 0045), and an account the ships
+ * its person ship owns; a ship answers the sender of a message it received;
+ * a plugin argo connected reads every ship; and the installation manages
+ * person ships and the ships they own (decision 0020). The viewer reads
+ * every ship while that is on, and every actor reaches every ship by every
+ * verb while open is. Otherwise a rule of the verb must match the sender
+ * with its `from` and the recipient with its `to`: one of the fleet's own,
+ * named by its place in that list, or a declared one, named by its declarer
+ * and its place in the declarer's list. The built-in rules come first, in
+ * that order, as the rule list shows them.
  */
-export function reachRuleOf(settings, send) {
+export function reachRuleOf(inForce, send) {
     const { verb, sender, recipient, isAnswerToSender } = send;
-    const { rules, builtIns } = settings;
     if (sender.kind === 'operator' || (recipient.kind === 'operator' && verb !== 'read')) {
         return { builtIn: 'argo' };
     }
-    if (recipient.owner === sender.id) {
+    const owningShip = owningShipOf(sender);
+    if (owningShip !== null && recipient.owner === owningShip) {
         return { builtIn: 'owner' };
     }
     if (verb === 'send' && isAnswerToSender) {
         return { builtIn: 'answer' };
     }
-    if (verb === 'read' && sender.kind === 'viewer' && builtIns.isViewerReadOn) {
+    if (verb === 'read' && sender.kind !== 'account' && sender.kind !== 'installation' && sender.isConnectedPlugin) {
+        return { builtIn: 'pluginRead' };
+    }
+    if (verb === 'read' && sender.kind === 'viewer' && inForce.isViewerReadOn) {
         return { builtIn: 'viewerRead' };
     }
-    if (builtIns.open[verb]) {
+    if (verb === 'manage' && sender.kind === 'installation' && (recipient.kind === 'person' || recipient.isOwnedByPerson)) {
+        return { builtIn: 'installation' };
+    }
+    if (inForce.isOpen) {
         return { builtIn: 'open' };
     }
-    const index = rules.findIndex((rule) => rule.verb === verb && matches(rule.from, { ship: sender, otherSide: recipient }) && matches(rule.to, { ship: recipient, otherSide: sender }));
-    return index === -1 ? undefined : { index };
+    const [from, to] = [selectedOf(sender), selectedOf(recipient)];
+    const allows = (rule) => rule.verb === verb && matches(rule.from, { actor: from, otherSide: to }) && matches(rule.to, { actor: to, otherSide: from });
+    const index = inForce.rules.findIndex(allows);
+    if (index !== -1) {
+        return { rule: index };
+    }
+    for (const { declarer, rules } of inForce.declared) {
+        const declaredIndex = rules.findIndex(allows);
+        if (declaredIndex !== -1) {
+            return { declared: declarer, index: declaredIndex };
+        }
+    }
+    return undefined;
 }
-/** Whether the settings let the sender do the verb to the recipient: some rule does (see reachRuleOf). */
-export function allowsReach(settings, send) {
-    return reachRuleOf(settings, send) !== undefined;
+/** Whether the rules in force let the sender do the verb to the recipient: some rule does (see reachRuleOf). */
+export function allowsReach(inForce, send) {
+    return reachRuleOf(inForce, send) !== undefined;
 }
-/** A ship matches a selector when every term of it holds, combined with AND. */
+/** An actor matches a selector when every term of it holds, combined with AND. */
 function matches(selector, sides) {
     return selector.every((term) => holds(term, sides));
 }
@@ -275,7 +226,7 @@ function matches(selector, sides) {
  * same owner as the other side.
  */
 function holds(term, sides) {
-    const { ship, otherSide } = sides;
+    const { actor: ship, otherSide } = sides;
     if (typeof term === 'string') {
         return ship.labels.some((label) => label.valueId === term);
     }