@aeolus-fleet/core 0.27.1 → 0.28.0

package/dist/config.js

@@ -30,6 +30,7 @@ const environmentSchema = z.object({
         .transform((origin) => new URL(origin).origin)
         .optional(),
     INSTALLATION_TOKEN: z.string().min(INSTALLATION_TOKEN_MIN_LENGTH, `must be at least ${String(INSTALLATION_TOKEN_MIN_LENGTH)} characters`).optional(),
+    ACCOUNT_TOKEN_ISSUER: z.url({ protocol: /^https$/, error: 'must be an https:// URL' }).optional(),
 });
 /** What `aeolus-core migrate` reads: the database alone. */
 const databaseEnvironmentSchema = environmentSchema.pick({ DATABASE_URL: true });
@@ -59,7 +60,7 @@ export function loadConfig(environment) {
     if (!result.success) {
         throw configErrorOf(result.error);
     }
-    const { DATABASE_URL, PUBLIC_URL, HOST, PORT, LOG_LEVEL, TRUST_PROXY, COOKIE_DOMAIN, CONSOLE_ORIGIN, INSTALLATION_TOKEN } = result.data;
+    const { DATABASE_URL, PUBLIC_URL, HOST, PORT, LOG_LEVEL, TRUST_PROXY, COOKIE_DOMAIN, CONSOLE_ORIGIN, INSTALLATION_TOKEN, ACCOUNT_TOKEN_ISSUER } = result.data;
     return {
         databaseUrl: DATABASE_URL,
         publicUrl: PUBLIC_URL,
@@ -70,6 +71,7 @@ export function loadConfig(environment) {
         cookieDomain: COOKIE_DOMAIN,
         consoleOrigin: CONSOLE_ORIGIN ?? new URL(PUBLIC_URL).origin,
         installationToken: INSTALLATION_TOKEN,
+        accountTokenIssuer: ACCOUNT_TOKEN_ISSUER,
     };
 }
 /**

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,sFAAsF;AACtF,MAAM,WAAW,GAAG,oEAAoE,CAAC;AAEzF,yGAAyG;AACzG,SAAS,QAAQ,CAAC,KAAa;IAC7B,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,CACL,GAAG,KAAK,IAAI;QACZ,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,GAAG;QACpB,GAAG,CAAC,MAAM,KAAK,EAAE;QACjB,GAAG,CAAC,IAAI,KAAK,EAAE;QACf,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QACpB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CACrB,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEzC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;IACzG,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;IACxF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9D,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACjG,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC3F,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,wCAAwC,CAAC,CAAC,QAAQ,EAAE;IACjG,cAAc,EAAE,CAAC;SACd,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC;SAC7E,MAAM,CAAC,QAAQ,EAAE,oEAAoE,CAAC;SACtF,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;SAC7C,QAAQ,EAAE;IACb,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,6BAA6B,EAAE,oBAAoB,MAAM,CAAC,6BAA6B,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;CACrJ,CAAC,CAAC;AAEH,4DAA4D;AAC5D,MAAM,yBAAyB,GAAG,iBAAiB,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;AA2BjF,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,IAAI,GAAG,aAAa,CAAC;CAC/B;AAED,8DAA8D;AAC9D,SAAS,aAAa,CAAC,KAAiB;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5F,OAAO,IAAI,WAAW,CAAC,2BAA2B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,gHAAgH;AAChH,MAAM,UAAU,eAAe,CAAC,WAA+C;IAC7E,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,WAA+C;IACxE,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IACxI,OAAO;QACL,WAAW,EAAE,YAAY;QACzB,SAAS,EAAE,UAAU;QACrB,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,SAAS;QACnB,gBAAgB,EAAE,WAAW,KAAK,MAAM;QACxC,YAAY,EAAE,aAAa;QAC3B,aAAa,EAAE,cAAc,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM;QAC3D,iBAAiB,EAAE,kBAAkB;KACtC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAmD;IACjF,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;IAC9E,OAAO;QACL,gBAAgB,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC;QAChD,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,MAAM,CAAC,aAAa,CAAC;KACnF,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC;AAC/C,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,sFAAsF;AACtF,MAAM,WAAW,GAAG,oEAAoE,CAAC;AAEzF,yGAAyG;AACzG,SAAS,QAAQ,CAAC,KAAa;IAC7B,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,CACL,GAAG,KAAK,IAAI;QACZ,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,EAAE;QACnB,GAAG,CAAC,QAAQ,KAAK,GAAG;QACpB,GAAG,CAAC,MAAM,KAAK,EAAE;QACjB,GAAG,CAAC,IAAI,KAAK,EAAE;QACf,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QACpB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CACrB,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEzC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,YAAY,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,4CAA4C,EAAE,CAAC;IACzG,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;IACxF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAC5C,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9D,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACjG,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC3F,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,wCAAwC,CAAC,CAAC,QAAQ,EAAE;IACjG,cAAc,EAAE,CAAC;SACd,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC;SAC7E,MAAM,CAAC,QAAQ,EAAE,oEAAoE,CAAC;SACtF,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;SAC7C,QAAQ,EAAE;IACb,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,6BAA6B,EAAE,oBAAoB,MAAM,CAAC,6BAA6B,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;IACpJ,oBAAoB,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC,QAAQ,EAAE;CAClG,CAAC,CAAC;AAEH,4DAA4D;AAC5D,MAAM,yBAAyB,GAAG,iBAAiB,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;AAgCjF,MAAM,OAAO,WAAY,SAAQ,KAAK;IAC3B,IAAI,GAAG,aAAa,CAAC;CAC/B;AAED,8DAA8D;AAC9D,SAAS,aAAa,CAAC,KAAiB;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5F,OAAO,IAAI,WAAW,CAAC,2BAA2B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,gHAAgH;AAChH,MAAM,UAAU,eAAe,CAAC,WAA+C;IAC7E,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,WAA+C;IACxE,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IAC9J,OAAO;QACL,WAAW,EAAE,YAAY;QACzB,SAAS,EAAE,UAAU;QACrB,IAAI,EAAE,IAAI;QACV,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE,SAAS;QACnB,gBAAgB,EAAE,WAAW,KAAK,MAAM;QACxC,YAAY,EAAE,aAAa;QAC3B,aAAa,EAAE,cAAc,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM;QAC3D,iBAAiB,EAAE,kBAAkB;QACrC,kBAAkB,EAAE,oBAAoB;KACzC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAmD;IACjF,MAAM,WAAW,GAAG,MAAM,CAAC,aAAa,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;IAC9E,OAAO;QACL,gBAAgB,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC;QAChD,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,MAAM,CAAC,aAAa,CAAC;KACnF,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC;AAC/C,CAAC"}

package/dist/domain/identity/authenticate-account.d.ts

@@ -0,0 +1,35 @@
+import type { AccountCaller, ShipCaller } from '../shared/caller.js';
+import type { Clock } from '../shared/clock.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { AccountCutOffLookup, AccountTokenSignatures, HostedFleets } from './ports.js';
+/** How long pagasae's account token lives (decision 0058). */
+export declare const ACCOUNT_TOKEN_LIFE_MS: number;
+/** The allowance between core's clock and pagasae's, on a token's end and issue (decision 0058). */
+export declare const ACCOUNT_TOKEN_CLOCK_ALLOWANCE_MS = 30000;
+/**
+ * Why an account token makes no caller: it ended, so whoever presented it
+ * fetches a fresh one; or it is not to be trusted here at all, one refusal
+ * that names no reason, so a forger learns nothing.
+ */
+export type AccountTokenRefusal = DomainError<'ACCOUNT_TOKEN_ENDED' | 'ACCOUNT_TOKEN_INVALID'>;
+export type AuthenticateAccount = (token: string, presented: {
+    through: ShipCaller | null;
+}) => Promise<Result<AccountCaller, AccountTokenRefusal>>;
+/**
+ * Use case: turns an account token into the account as the caller (decision
+ * 0058), checked on every call. pagasae's key signed it, naming pagasae (the
+ * signatures port); it is for this fleet: the fleet of the ship that
+ * presented it, or with none, a fleet this installation hosts; it has not
+ * ended, with 30 seconds of allowance; it lives no longer than the 10
+ * minutes pagasae gives one, so a misconfigured issuer cannot widen a
+ * leaver's window, and was not issued later than now, so it cannot outlive
+ * a cut-off; and its account was not cut off after it was issued. Core
+ * stores nothing of the account.
+ */
+export declare function createAuthenticateAccount(deps: {
+    signatures: AccountTokenSignatures;
+    cutOffs: AccountCutOffLookup;
+    fleets: HostedFleets;
+    clock: Clock;
+}): AuthenticateAccount;

package/dist/domain/identity/authenticate-account.js

@@ -0,0 +1,54 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+/** How long pagasae's account token lives (decision 0058). */
+export const ACCOUNT_TOKEN_LIFE_MS = 10 * 60_000;
+/** The allowance between core's clock and pagasae's, on a token's end and issue (decision 0058). */
+export const ACCOUNT_TOKEN_CLOCK_ALLOWANCE_MS = 30_000;
+/**
+ * Use case: turns an account token into the account as the caller (decision
+ * 0058), checked on every call. pagasae's key signed it, naming pagasae (the
+ * signatures port); it is for this fleet: the fleet of the ship that
+ * presented it, or with none, a fleet this installation hosts; it has not
+ * ended, with 30 seconds of allowance; it lives no longer than the 10
+ * minutes pagasae gives one, so a misconfigured issuer cannot widen a
+ * leaver's window, and was not issued later than now, so it cannot outlive
+ * a cut-off; and its account was not cut off after it was issued. Core
+ * stores nothing of the account.
+ */
+export function createAuthenticateAccount(deps) {
+    return async (token, { through }) => {
+        const claims = await deps.signatures.verify(token);
+        if (!claims || !(await isForThisFleet(deps.fleets, { claims, through }))) {
+            return refuseInvalid();
+        }
+        const now = deps.clock.now().getTime();
+        if (now > claims.endsAt.getTime() + ACCOUNT_TOKEN_CLOCK_ALLOWANCE_MS) {
+            return refuse('ACCOUNT_TOKEN_ENDED', 'This account token has ended; present a fresh one');
+        }
+        const life = claims.endsAt.getTime() - claims.issuedAt.getTime();
+        if (life > ACCOUNT_TOKEN_LIFE_MS + ACCOUNT_TOKEN_CLOCK_ALLOWANCE_MS || claims.issuedAt.getTime() > now + ACCOUNT_TOKEN_CLOCK_ALLOWANCE_MS) {
+            return refuseInvalid();
+        }
+        const cutOffAt = await deps.cutOffs.cutOffAt(claims.accountId, deps.clock.now());
+        if (cutOffAt !== undefined && claims.issuedAt < cutOffAt) {
+            return refuseInvalid();
+        }
+        return ok({
+            kind: 'account',
+            accountId: claims.accountId,
+            fleetId: claims.fleetId,
+            scopes: claims.scopes,
+            groupValues: claims.groupValues,
+            personShipId: claims.personShipId,
+            throughShipId: through?.shipId ?? null,
+        });
+    };
+}
+async function isForThisFleet(fleets, token) {
+    const { claims, through } = token;
+    return through === null ? fleets.isHosted(claims.fleetId) : claims.fleetId === through.fleetId;
+}
+function refuseInvalid() {
+    return refuse('ACCOUNT_TOKEN_INVALID', 'Present an account token pagasae signed for this fleet');
+}
+//# sourceMappingURL=authenticate-account.js.map

package/dist/domain/identity/authenticate-account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticate-account.js","sourceRoot":"","sources":["../../../src/domain/identity/authenticate-account.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAGtD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,MAAM,CAAC;AAEjD,oGAAoG;AACpG,MAAM,CAAC,MAAM,gCAAgC,GAAG,MAAM,CAAC;AAWvD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAKzC;IACC,OAAO,KAAK,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;QAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,CAAC;YACzE,OAAO,aAAa,EAAE,CAAC;QACzB,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,gCAAgC,EAAE,CAAC;YACrE,OAAO,MAAM,CAAC,qBAAqB,EAAE,mDAAmD,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACjE,IAAI,IAAI,GAAG,qBAAqB,GAAG,gCAAgC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,GAAG,GAAG,gCAAgC,EAAE,CAAC;YAC1I,OAAO,aAAa,EAAE,CAAC;QACzB,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QACjF,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,GAAG,QAAQ,EAAE,CAAC;YACzD,OAAO,aAAa,EAAE,CAAC;QACzB,CAAC;QACD,OAAO,EAAE,CAAC;YACR,IAAI,EAAE,SAAS;YACf,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,aAAa,EAAE,OAAO,EAAE,MAAM,IAAI,IAAI;SACvC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,MAAoB,EAAE,KAAiE;IACnH,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IAClC,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC;AACjG,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,MAAM,CAAC,uBAAuB,EAAE,wDAAwD,CAAC,CAAC;AACnG,CAAC"}

package/dist/domain/identity/authenticate-installation.d.ts

@@ -0,0 +1,23 @@
+import type { FleetId, Scope } from '@aeolus-fleet/common';
+import type { InstallationCaller } from '../shared/caller.js';
+import { type DomainError } from '../shared/errors.js';
+import { type Result } from '../shared/result.js';
+import type { HostedFleets } from './ports.js';
+/**
+ * The scopes the installation holds in every fleet it hosts (decision 0020):
+ * what its jobs need of the catalogue, in its order (decision 0053): reading
+ * the fleet, managing, defining and assigning labels, commissioning person
+ * ships. Until a call lets argo change them, they are the same in every fleet.
+ */
+export declare const INSTALLATION_SCOPES: readonly Scope[];
+export type AuthenticateInstallation = (call: {
+    fleetId: FleetId;
+}) => Promise<Result<InstallationCaller, DomainError<'FLEET_NOT_FOUND'>>>;
+/**
+ * Use case: the installation, whose token the API adapter checked, acts in
+ * one fleet it hosts through the same fleet calls as any actor (decision
+ * 0057), with its scopes there and its built-in manage rule.
+ */
+export declare function createAuthenticateInstallation(deps: {
+    fleets: HostedFleets;
+}): AuthenticateInstallation;

package/dist/domain/identity/authenticate-installation.js

@@ -0,0 +1,20 @@
+import { refuse } from '../shared/errors.js';
+import { ok } from '../shared/result.js';
+/**
+ * The scopes the installation holds in every fleet it hosts (decision 0020):
+ * what its jobs need of the catalogue, in its order (decision 0053): reading
+ * the fleet, managing, defining and assigning labels, commissioning person
+ * ships. Until a call lets argo change them, they are the same in every fleet.
+ */
+export const INSTALLATION_SCOPES = ['fleet:read', 'fleet:manage', 'labels:define', 'labels:assign', 'fleet:person', 'labels:any'];
+/**
+ * Use case: the installation, whose token the API adapter checked, acts in
+ * one fleet it hosts through the same fleet calls as any actor (decision
+ * 0057), with its scopes there and its built-in manage rule.
+ */
+export function createAuthenticateInstallation(deps) {
+    return async ({ fleetId }) => (await deps.fleets.isHosted(fleetId))
+        ? ok({ kind: 'installation', fleetId, scopes: INSTALLATION_SCOPES })
+        : refuse('FLEET_NOT_FOUND', `This installation hosts no fleet ${fleetId}`);
+}
+//# sourceMappingURL=authenticate-installation.js.map

package/dist/domain/identity/authenticate-installation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authenticate-installation.js","sourceRoot":"","sources":["../../../src/domain/identity/authenticate-installation.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAGtD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAqB,CAAC,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;AAIpJ;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAAC,IAA8B;IAC3E,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAC3B,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACpE,CAAC,CAAC,MAAM,CAAC,iBAAiB,EAAE,oCAAoC,OAAO,EAAE,CAAC,CAAC;AACjF,CAAC"}

package/dist/domain/identity/authenticate.d.ts

@@ -1,5 +1,5 @@
 import { type LeaseEnded } from '../registry/public.js';
-import type { Caller, Crew } from '../shared/caller.js';
+import type { ShipCaller, Crew } from '../shared/caller.js';
 import type { Clock } from '../shared/clock.js';
 import { type DomainError } from '../shared/errors.js';
 import { type Result } from '../shared/result.js';
@@ -8,7 +8,7 @@ import type { ConsoleSessionEndReason } from './console-session.js';
 import type { CallerLookup } from './ports.js';
 export interface ConsoleSessionUse {
     /** argo, crewed under the lease the session holds, or the viewer ship, holding none. */
-    caller: Caller | Crew;
+    caller: ShipCaller | Crew;
     /** The session's new expiry: its idle limit after this use, never past the moment it ends by. */
     expiresAt: Date;
 }

package/dist/domain/identity/console-session.d.ts

@@ -1,4 +1,4 @@
-import type { ConsoleSessionId, FleetId, LeaseId, ShipId } from '@aeolus-fleet/common';
+import type { AccountId, ConsoleSessionId, FleetId, LeaseId, ShipId } from '@aeolus-fleet/common';
 import type { Location } from '../registry/public.js';
 /**
  * A console session: the operator crewing `argo`, or a person viewing the
@@ -17,6 +17,8 @@ export interface ConsoleSession {
     endsBy: Date | null;
     /** The device it signed in from, as the browser told: "Mac · Chrome". */
     device: string;
+    /** The account that signed in as argo, by its id only; null for argo's own sign-in and a viewer (decision 0054). */
+    accountId: AccountId | null;
     tokenHash: string;
     createdAt: Date;
     lastUsedAt: Date;
@@ -27,10 +29,11 @@ export interface ConsoleSession {
 }
 /**
  * Why a console session ended: the operator signed in somewhere else and took
- * argo over, signed out, or the password was reset. An expired session never
+ * argo over, signed out, the password was reset, or the installation cut off
+ * the account it signed in as argo (decision 0055). An expired session never
  * ended; it simply stopped working.
  */
-export type ConsoleSessionEndReason = 'takenOver' | 'signedOut' | 'passwordReset';
+export type ConsoleSessionEndReason = 'takenOver' | 'signedOut' | 'passwordReset' | 'accountCutOff';
 /** The operator's console session stays valid this long after its last use. */
 export declare const CONSOLE_SESSION_IDLE_LIMIT_MS: number;
 /** A viewer session stays valid this long after its last use (decision 0022). */

package/dist/domain/identity/console-session.js.map

@@ -1 +1 @@
-{"version":3,"file":"console-session.js","sourceRoot":"","sources":["../../../src/domain/identity/console-session.ts"],"names":[],"mappings":"AAqCA,+EAA+E;AAC/E,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtE,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/B,iFAAiF;AACjF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,GAAG,OAAO,CAAC;AAExD,sFAAsF;AACtF,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,OAAO,CAAC;AAEvD,+CAA+C;AAC/C,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAE/C;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,oBAAoB,CAAC,MAAY;IAC/C,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,6BAA6B,CAAC,CAAC;AACpE,CAAC;AAED,uHAAuH;AACvH,MAAM,UAAU,kBAAkB,CAAC,EAAQ;IACzC,OAAO;QACL,WAAW,EAAE,4BAA4B;QACzC,MAAM,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,0BAA0B,CAAC;QAC3D,SAAS,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,4BAA4B,CAAC;KACjE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"console-session.js","sourceRoot":"","sources":["../../../src/domain/identity/console-session.ts"],"names":[],"mappings":"AAwCA,+EAA+E;AAC/E,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtE,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE/B,iFAAiF;AACjF,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,GAAG,OAAO,CAAC;AAExD,sFAAsF;AACtF,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,GAAG,OAAO,CAAC;AAEvD,+CAA+C;AAC/C,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAE/C;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,oBAAoB,CAAC,MAAY;IAC/C,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,6BAA6B,CAAC,CAAC;AACpE,CAAC;AAED,uHAAuH;AACvH,MAAM,UAAU,kBAAkB,CAAC,EAAQ;IACzC,OAAO;QACL,WAAW,EAAE,4BAA4B;QACzC,MAAM,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,0BAA0B,CAAC;QAC3D,SAAS,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,4BAA4B,CAAC;KACjE,CAAC;AACJ,CAAC"}

package/dist/domain/identity/cut-off-account.d.ts

@@ -0,0 +1,29 @@
+import type { AccountId, IdGenerator } from '@aeolus-fleet/common';
+import { type LeaseTx } from '../registry/public.js';
+import type { Clock } from '../shared/clock.js';
+import type { UnitOfWork } from '../shared/unit-of-work.js';
+import type { AccountCutOffRepository, ConsoleSessionRepository } from './ports.js';
+export interface CutOffAccountTx extends LeaseTx {
+    consoleSessions: ConsoleSessionRepository;
+}
+export type CutOffAccount = (input: {
+    accountId: AccountId;
+}) => Promise<void>;
+/**
+ * Use case: pagasae, as the installation, cuts off a disabled account
+ * (decisions 0055, 0058). Every token of it issued before now is refused in
+ * every fleet of the installation, until the longest of them has ended; then
+ * core forgets the account. Recording one forgets those that ended. The
+ * cut-off itself writes no event: it belongs to the installation, not to a
+ * fleet, and names no ship.
+ *
+ * Every console sign-in as argo by the account ends too, in every fleet, and
+ * with it the lease on argo it held, the installation the actor. pagasae calls
+ * again when a call fails: both halves are safe to repeat.
+ */
+export declare function createCutOffAccount(deps: {
+    cutOffs: AccountCutOffRepository;
+    uow: UnitOfWork<CutOffAccountTx>;
+    clock: Clock;
+    ids: IdGenerator;
+}): CutOffAccount;

package/dist/domain/identity/cut-off-account.js

@@ -0,0 +1,37 @@
+import { endLease } from '../registry/public.js';
+import { ok } from '../shared/result.js';
+import { ACCOUNT_TOKEN_CLOCK_ALLOWANCE_MS, ACCOUNT_TOKEN_LIFE_MS } from './authenticate-account.js';
+/**
+ * How long a cut-off is kept: the longest a token issued before it is
+ * accepted, its life and the allowance on it, and the allowance on its end.
+ */
+const CUT_OFF_KEPT_MS = ACCOUNT_TOKEN_LIFE_MS + 2 * ACCOUNT_TOKEN_CLOCK_ALLOWANCE_MS;
+const INSTALLATION = { kind: 'installation' };
+/**
+ * Use case: pagasae, as the installation, cuts off a disabled account
+ * (decisions 0055, 0058). Every token of it issued before now is refused in
+ * every fleet of the installation, until the longest of them has ended; then
+ * core forgets the account. Recording one forgets those that ended. The
+ * cut-off itself writes no event: it belongs to the installation, not to a
+ * fleet, and names no ship.
+ *
+ * Every console sign-in as argo by the account ends too, in every fleet, and
+ * with it the lease on argo it held, the installation the actor. pagasae calls
+ * again when a call fails: both halves are safe to repeat.
+ */
+export function createCutOffAccount(deps) {
+    return async ({ accountId }) => {
+        const now = deps.clock.now();
+        await deps.cutOffs.forget(now);
+        await deps.cutOffs.record({ accountId, cutOffAt: now, forgetAt: new Date(now.getTime() + CUT_OFF_KEPT_MS) });
+        await deps.uow.run(async (tx) => {
+            for (const session of await tx.consoleSessions.endAllOfAccount(accountId, { at: now, reason: 'accountCutOff' })) {
+                if (session.leaseId !== null) {
+                    await endLease({ tx, ids: deps.ids }, { fleetId: session.fleetId, leaseId: session.leaseId, actor: INSTALLATION, at: now, reason: 'accountCutOff' });
+                }
+            }
+            return ok(undefined);
+        });
+    };
+}
+//# sourceMappingURL=cut-off-account.js.map

package/dist/domain/identity/cut-off-account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cut-off-account.js","sourceRoot":"","sources":["../../../src/domain/identity/cut-off-account.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,QAAQ,EAAgB,MAAM,uBAAuB,CAAC;AAG/D,OAAO,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AAEzC,OAAO,EAAE,gCAAgC,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAGpG;;;GAGG;AACH,MAAM,eAAe,GAAG,qBAAqB,GAAG,CAAC,GAAG,gCAAgC,CAAC;AAErF,MAAM,YAAY,GAAU,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;AAQrD;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAKnC;IACC,OAAO,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,eAAe,CAAC,EAAE,CAAC,CAAC;QAE7G,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAC9B,KAAK,MAAM,OAAO,IAAI,MAAM,EAAE,CAAC,eAAe,CAAC,eAAe,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC;gBAChH,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;oBAC7B,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;gBACvJ,CAAC;YACH,CAAC;YACD,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/domain/identity/dismiss-notice.d.ts

@@ -1,10 +1,10 @@
-import type { Caller } from '../shared/caller.js';
+import type { ShipCaller } from '../shared/caller.js';
 import type { Clock } from '../shared/clock.js';
 import { type DomainError } from '../shared/errors.js';
 import { type Result } from '../shared/result.js';
 import type { NoticeDismissals, NoticeRepository } from './ports.js';
 export type DismissNoticeRefusal = DomainError<'NOTICE_NOT_FOUND' | 'NOTICE_NOT_DISMISSIBLE'>;
-export type DismissNotice = (caller: Caller, input: {
+export type DismissNotice = (caller: ShipCaller, input: {
     noticeId: string;
 }) => Promise<Result<undefined, DismissNoticeRefusal>>;
 /**

package/dist/domain/identity/issue-sign-in-ticket.d.ts

@@ -1,4 +1,4 @@
-import type { FleetId, IdGenerator } from '@aeolus-fleet/common';
+import type { AccountId, FleetId, IdGenerator } from '@aeolus-fleet/common';
 import { type ShipTx } from '../registry/public.js';
 import type { Clock } from '../shared/clock.js';
 import { type DomainError } from '../shared/errors.js';
@@ -13,11 +13,15 @@ export interface IssueSignInTicketTx extends ShipTx {
     signInTickets: SignInTicketRepository;
     events: EventLog;
 }
-export type IssueSignInTicketRefusal = DomainError<'FLEET_NOT_FOUND' | 'FLEET_HAS_NO_VIEWER'>;
+export type IssueSignInTicketRefusal = DomainError<'FLEET_NOT_FOUND' | 'FLEET_HAS_NO_VIEWER' | 'VIEWER_TICKET_NAMES_NO_ACCOUNT'>;
 export type IssueSignInTicket = (input: {
     fleetId: FleetId;
     /** Whom it signs in as: the operator when left out, or a viewer of a fleet with a viewer ship (decision 0022). */
     as?: SignInAs;
+    /** The account it signs in as argo, by its id only (decision 0054); argo's operator ticket when left out. */
+    account?: {
+        id: AccountId;
+    };
 }) => Promise<Result<{
     ticket: string;
 }, IssueSignInTicketRefusal>>;
@@ -26,7 +30,9 @@ export type IssueSignInTicket = (input: {
  * operator, or for a viewer of a fleet with a viewer ship (docs/blueprint.md,
  * "Installation"; decision 0022): the hosting service hands it to the
  * person's browser, and the console redeems it for a session. Only
- * its hash is stored; it is valid 2 minutes and signs in once. Each ticket
+ * its hash is stored; it is valid 2 minutes and signs in once. An operator's
+ * ticket may name the account it signs in as argo, by its id only, never
+ * a viewer's (decision 0054). Each ticket
  * stands alone: a new one leaves an earlier unused one to expire.
  */
 export declare function createIssueSignInTicket(deps: {

package/dist/domain/identity/issue-sign-in-ticket.js

@@ -8,14 +8,19 @@ import { SIGN_IN_TICKET_PREFIX, SIGN_IN_TICKET_VALID_MS } from './sign-in-ticket
  * operator, or for a viewer of a fleet with a viewer ship (docs/blueprint.md,
  * "Installation"; decision 0022): the hosting service hands it to the
  * person's browser, and the console redeems it for a session. Only
- * its hash is stored; it is valid 2 minutes and signs in once. Each ticket
+ * its hash is stored; it is valid 2 minutes and signs in once. An operator's
+ * ticket may name the account it signs in as argo, by its id only, never
+ * a viewer's (decision 0054). Each ticket
  * stands alone: a new one leaves an earlier unused one to expire.
  */
 export function createIssueSignInTicket(deps) {
-    return ({ fleetId, as = 'operator' }) => deps.uow.run(async (tx) => {
+    return ({ fleetId, as = 'operator', account }) => deps.uow.run(async (tx) => {
         if (!(await tx.operatorAccounts.findForFleet(fleetId))) {
             return refuse('FLEET_NOT_FOUND', `The installation hosts no fleet ${fleetId}`);
         }
+        if (as === 'viewer' && account !== undefined) {
+            return refuse('VIEWER_TICKET_NAMES_NO_ACCOUNT', 'A viewer ticket names no account: the viewer is no account');
+        }
         if (as === 'viewer') {
             const viewer = await findViewerShip(tx, fleetId);
             if (!viewer.isOk) {
@@ -27,6 +32,7 @@ export function createIssueSignInTicket(deps) {
         await tx.signInTickets.create({
             fleetId,
             as,
+            accountId: account?.id ?? null,
             tokenHash: deps.hasher.hash(ticket),
             issuedAt: at,
             expiresAt: new Date(at.getTime() + SIGN_IN_TICKET_VALID_MS),

package/dist/domain/identity/issue-sign-in-ticket.js.map

@@ -1 +1 @@
-{"version":3,"file":"issue-sign-in-ticket.js","sourceRoot":"","sources":["../../../src/domain/identity/issue-sign-in-ticket.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAe,MAAM,uBAAuB,CAAC;AAGpE,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,EAAiB,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAItD,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAiB,MAAM,qBAAqB,CAAC;AAgBpG;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAMvC;IACC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,UAAU,EAAE,EAAE,EAAE,CACtC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAiE,EAAE;QACvF,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,gBAAgB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACvD,OAAO,MAAM,CAAC,iBAAiB,EAAE,mCAAmC,OAAO,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjB,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,qBAAqB,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC;YAC5B,OAAO;YACP,EAAE;YACF,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YACnC,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,uBAAuB,CAAC;YAC3D,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,MAAM,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACjJ,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"issue-sign-in-ticket.js","sourceRoot":"","sources":["../../../src/domain/identity/issue-sign-in-ticket.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAe,MAAM,uBAAuB,CAAC;AAGpE,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAE,MAAM,EAAiB,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAItD,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAiB,MAAM,qBAAqB,CAAC;AAkBpG;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAMvC;IACC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,CAC/C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAiE,EAAE;QACvF,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,gBAAgB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;YACvD,OAAO,MAAM,CAAC,iBAAiB,EAAE,mCAAmC,OAAO,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,EAAE,KAAK,QAAQ,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC7C,OAAO,MAAM,CAAC,gCAAgC,EAAE,4DAA4D,CAAC,CAAC;QAChH,CAAC;QACD,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YACjD,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjB,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,qBAAqB,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC;YAC5B,OAAO;YACP,EAAE;YACF,SAAS,EAAE,OAAO,EAAE,EAAE,IAAI,IAAI;YAC9B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YACnC,QAAQ,EAAE,EAAE;YACZ,SAAS,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,uBAAuB,CAAC;YAC3D,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,MAAM,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACjJ,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/domain/identity/ports.d.ts

@@ -1,5 +1,5 @@
-import type { ConsoleSessionId, CredentialId, FleetId, LeaseId, OperatorId, ShipId, Theme } from '@aeolus-fleet/common';
-import type { Caller, Crew } from '../shared/caller.js';
+import type { AccountId, AccountTokenClaims, ConsoleSessionId, CredentialId, FleetId, LeaseId, OperatorId, ShipId, Theme } from '@aeolus-fleet/common';
+import type { ShipCaller, Crew } from '../shared/caller.js';
 import type { ConsoleSession, ConsoleSessionEndReason } from './console-session.js';
 import type { Credential } from './credential.js';
 import type { Guide, GuideProgress } from './guide.js';
@@ -7,7 +7,7 @@ import type { Notice } from './notice.js';
 import type { OperatorAccount } from './operator-account.js';
 import type { SignInAs, SignInTicket } from './sign-in-ticket.js';
 /** The ship a crew token or a console session token belongs to, as the caller it makes. */
-export type AuthenticatedShip = Omit<Caller, 'consoleSessionId'>;
+export type AuthenticatedShip = Omit<ShipCaller, 'consoleSessionId'>;
 /** The ship a crew token crews, and the open lease the token belongs to. */
 export type AuthenticatedCrew = AuthenticatedShip & {
     leaseId: LeaseId;
@@ -96,9 +96,10 @@ export interface SignInTicketRepository {
     redeem(tokenHash: string, at: Date): Promise<{
         fleetId: FleetId;
         as: SignInAs;
+        accountId: AccountId | null;
     } | undefined>;
 }
-/** Outbound port: console sessions, always within one fleet. */
+/** Outbound port: console sessions, within one fleet but for the account's, which spans the installation. */
 export interface ConsoleSessionRepository {
     create(session: ConsoleSession): Promise<void>;
     /** The session, read without a lock. */
@@ -118,6 +119,15 @@ export interface ConsoleSessionRepository {
         at: Date;
         reason: ConsoleSessionEndReason;
     }): Promise<ConsoleSession[]>;
+    /**
+     * Ends every session the account signed in to as argo that has not ended, in
+     * every fleet of the installation, and returns them: a cut-off belongs to the
+     * installation, not to a fleet (decision 0055).
+     */
+    endAllOfAccount(accountId: AccountId, ending: {
+        at: Date;
+        reason: ConsoleSessionEndReason;
+    }): Promise<ConsoleSession[]>;
 }
 /**
  * Outbound port: who is calling. Each lookup is one query that returns the
@@ -146,7 +156,7 @@ export interface CallerLookup {
         tokenHash: string;
         now: Date;
     }): Promise<{
-        caller: Caller | Crew;
+        caller: ShipCaller | Crew;
         expiresAt: Date;
     } | undefined>;
     /** Why the console session with this token hash ended; undefined when it has not, or no session has the hash. */
@@ -191,3 +201,40 @@ export interface GuideProgressRepository {
         at: Date;
     } & GuideProgress): Promise<void>;
 }
+/**
+ * Outbound port: pagasae's signature on an account token (decision 0058).
+ * Core trusts one issuer and its published keys.
+ */
+export interface AccountTokenSignatures {
+    /**
+     * The token's claims when a key the issuer publishes signed it as an
+     * access token naming that issuer; undefined for any other token. Says
+     * nothing of its fleet, its end or a cut-off: the use case checks those.
+     */
+    verify(token: string): Promise<AccountTokenClaims | undefined>;
+}
+/** An account pagasae cut off (decision 0058): its tokens issued before `cutOffAt` are refused until `forgetAt`. */
+export interface AccountCutOff {
+    accountId: AccountId;
+    cutOffAt: Date;
+    forgetAt: Date;
+}
+/**
+ * Outbound port: the accounts pagasae cut off (decision 0058), kept by the
+ * installation for every fleet it hosts, each until the longest token it
+ * refuses has ended. Not scoped by fleet: an account's tokens go to several
+ * fleets, and the cut-off holds in each (ADR 0007, the installation).
+ */
+export interface AccountCutOffRepository {
+    /** Keeps the cut-off; one kept for the account with a later cut-off stays as it was. */
+    record(cutOff: AccountCutOff): Promise<void>;
+    /** When the account was last cut off, while that cut-off is kept at `at`; undefined otherwise. */
+    cutOffAt(accountId: AccountId, at: Date): Promise<Date | undefined>;
+    /** Forgets every cut-off kept no longer than `at`. */
+    forget(at: Date): Promise<void>;
+}
+export type AccountCutOffLookup = Pick<AccountCutOffRepository, 'cutOffAt'>;
+/** Outbound port: whether this installation hosts a fleet, so a token for any other is refused. */
+export interface HostedFleets {
+    isHosted(fleetId: FleetId): Promise<boolean>;
+}

package/dist/domain/identity/read-account.d.ts

@@ -1,5 +1,5 @@
-import type { Theme } from '@aeolus-fleet/common';
-import type { Caller } from '../shared/caller.js';
+import type { AccountId, Theme } from '@aeolus-fleet/common';
+import type { ShipCaller } from '../shared/caller.js';
 import { type DomainError } from '../shared/errors.js';
 import { type Result } from '../shared/result.js';
 import type { UnitOfWork } from '../shared/unit-of-work.js';
@@ -13,17 +13,21 @@ interface SessionView {
     device: string;
     since: Date;
 }
+/** The operator's session, with the account that signed in as argo, by its id, or none for argo's own sign-in (decision 0054). */
+interface OperatorSessionView extends SessionView {
+    accountId: AccountId | null;
+}
 /** The operator's account with this session, or a viewer's session alone: a viewer has no email and no theme (decision 0022). */
 export type AccountView = {
     kind: 'operator';
     email: string;
     theme: Theme;
-    session: SessionView;
+    session: OperatorSessionView;
 } | {
     kind: 'viewer';
     session: SessionView;
 };
-export type ReadAccount = (caller: Caller) => Promise<Result<AccountView, DomainError<'NOT_THE_OPERATOR_SHIP'>>>;
+export type ReadAccount = (caller: ShipCaller) => Promise<Result<AccountView, DomainError<'NOT_THE_OPERATOR_SHIP'>>>;
 /**
  * Use case: the signed-in operator's account, for the AccountMenu: their
  * email, their theme, and this console session; for a viewer session, the

package/dist/domain/identity/read-account.js

@@ -20,7 +20,7 @@ export function createReadAccount(deps) {
             kind: 'operator',
             email: account.email,
             theme: account.theme,
-            session: { device: session.device, since: session.createdAt },
+            session: { device: session.device, since: session.createdAt, accountId: session.accountId },
         });
     });
 }

package/dist/domain/identity/read-account.js.map

@@ -1 +1 @@
-{"version":3,"file":"read-account.js","sourceRoot":"","sources":["../../../src/domain/identity/read-account.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAoBtD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAwC;IACxE,OAAO,CAAC,MAAM,EAAE,EAAE,CAChB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAsE,EAAE;QAC5F,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;QACpC,MAAM,OAAO,GAAG,gBAAgB,IAAI,CAAC,MAAM,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACtG,IAAI,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,gBAAgB,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC,uBAAuB,EAAE,6DAA6D,CAAC,CAAC;QACxG,CAAC;QACD,OAAO,EAAE,CAAC;YACR,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE;SAC9D,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"read-account.js","sourceRoot":"","sources":["../../../src/domain/identity/read-account.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,EAAoB,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAyBtD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAwC;IACxE,OAAO,CAAC,MAAM,EAAE,EAAE,CAChB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAsE,EAAE;QAC5F,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,CAAC;QACpC,MAAM,OAAO,GAAG,gBAAgB,IAAI,CAAC,MAAM,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACtG,IAAI,OAAO,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,gBAAgB,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC,uBAAuB,EAAE,6DAA6D,CAAC,CAAC;QACxG,CAAC;QACD,OAAO,EAAE,CAAC;YACR,IAAI,EAAE,UAAU;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;SAC5F,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/domain/identity/read-guide.d.ts

@@ -1,7 +1,7 @@
-import type { Caller } from '../shared/caller.js';
+import type { ShipCaller } from '../shared/caller.js';
 import { type GuideProgress, type GuideStep } from './guide.js';
 import type { GuideProgressRepository, GuideRepository } from './ports.js';
-export type ReadGuide = (caller: Caller) => Promise<{
+export type ReadGuide = (caller: ShipCaller) => Promise<{
     steps: readonly GuideStep[];
     progress: GuideProgress;
 } | null>;

package/dist/domain/identity/read-notices.d.ts

@@ -1,7 +1,7 @@
-import type { Caller } from '../shared/caller.js';
+import type { ShipCaller } from '../shared/caller.js';
 import { type Notice } from './notice.js';
 import type { NoticeDismissals, NoticeRepository } from './ports.js';
-export type ReadNotices = (caller: Caller) => Promise<Notice[]>;
+export type ReadNotices = (caller: ShipCaller) => Promise<Notice[]>;
 /**
  * Use case: the notices a console session shows above every page (decision
  * 0023): those of its audience, in the installation's order, less the

package/dist/domain/identity/record-guide-progress.d.ts

@@ -1,11 +1,11 @@
-import type { Caller } from '../shared/caller.js';
+import type { ShipCaller } from '../shared/caller.js';
 import type { Clock } from '../shared/clock.js';
 import { type DomainError } from '../shared/errors.js';
 import { type Result } from '../shared/result.js';
 import type { GuideProgress } from './guide.js';
 import type { GuideProgressRepository, GuideRepository } from './ports.js';
 export type RecordGuideProgressRefusal = DomainError<'GUIDE_NOT_FOUND' | 'GUIDE_STEP_NOT_FOUND'>;
-export type RecordGuideProgress = (caller: Caller, progress: GuideProgress) => Promise<Result<undefined, RecordGuideProgressRefusal>>;
+export type RecordGuideProgress = (caller: ShipCaller, progress: GuideProgress) => Promise<Result<undefined, RecordGuideProgressRefusal>>;
 /**
  * Use case: a console session records where it is in the guide, for itself
  * only (decision 0024): open at a step, skipped or finished; open at the

package/dist/domain/identity/redeem-sign-in-ticket.d.ts

@@ -19,7 +19,8 @@ export type RedeemSignInTicket = (input: {
 }) => Promise<Result<SignedIn, RedeemSignInTicketRefusal>>;
 /**
  * Use case: the console redeems a sign-in ticket the installation issued. An
- * operator's ticket starts the session exactly as after a password sign-in:
+ * operator's ticket starts the session exactly as after a password sign-in,
+ * keeping the account it names, if any (decision 0054):
  * it takes argo's lease over and ends any previous session. A viewer's starts
  * a viewer session beside any others (decision 0022). A ticket signs in once and
  * only before it expires; used, expired and unknown tickets are one refusal,

package/dist/domain/identity/redeem-sign-in-ticket.js

@@ -4,7 +4,8 @@ import { startConsoleSession } from './start-console-session.js';
 import { startViewerSession } from './start-viewer-session.js';
 /**
  * Use case: the console redeems a sign-in ticket the installation issued. An
- * operator's ticket starts the session exactly as after a password sign-in:
+ * operator's ticket starts the session exactly as after a password sign-in,
+ * keeping the account it names, if any (decision 0054):
  * it takes argo's lease over and ends any previous session. A viewer's starts
  * a viewer session beside any others (decision 0022). A ticket signs in once and
  * only before it expires; used, expired and unknown tickets are one refusal,
@@ -17,7 +18,7 @@ export function createRedeemSignInTicket(deps) {
         if (redeemed === undefined) {
             return refuse('SIGN_IN_TICKET_INVALID', 'This sign-in link is used or expired: sign in again');
         }
-        const session = { fleetId: redeemed.fleetId, device: input.device ?? UNKNOWN_DEVICE, at };
+        const session = { fleetId: redeemed.fleetId, device: input.device ?? UNKNOWN_DEVICE, accountId: redeemed.accountId, at };
         const starting = { tx, ids: deps.ids, hasher: deps.hasher, random: deps.random };
         return redeemed.as === 'viewer' ? startViewerSession(starting, session) : startConsoleSession(starting, session);
     });