@aeolus-fleet/core 0.27.1 → 0.28.1

package/src/adapters/prisma/migrations/20261020090000_argos_jobs_as_scopes/migration.sql

@@ -0,0 +1,65 @@
+-- The jobs that were argo's alone become scopes any actor can be granted (decision 0053): fleet:person,
+-- fleet:owner, fleet:explain, fleet:connect and labels:any join the core scopes (decision 0046).
+CREATE OR REPLACE FUNCTION "ships_scopes_are_known"("scopes" TEXT[]) RETURNS BOOLEAN IMMUTABLE LANGUAGE SQL AS $$
+  SELECT "scopes" IS NOT NULL AND NOT EXISTS (
+    SELECT 1 FROM unnest("scopes") AS "scope"
+    WHERE NOT (
+      "scope" = ANY(ARRAY['messages:send', 'messages:receive', 'messages:force', 'messages:resend', 'fleet:read', 'fleet:commission', 'fleet:manage', 'crew:assign', 'crew:run', 'labels:define', 'labels:assign', 'fleet:network', 'fleet:on-behalf', 'fleet:person', 'fleet:owner', 'fleet:explain', 'fleet:connect', 'labels:any', 'scopes:declare', 'scopes:grant']::TEXT[])
+      OR ("scope" ~ '^[a-z][a-z0-9-]{0,31}:[a-z][a-z0-9-]{0,31}$' AND split_part("scope", ':', 1) <> ALL(ARRAY['messages', 'fleet', 'crew', 'labels', 'scopes']::TEXT[]))
+    )
+  )
+$$;
+
+-- argo holds every scope: every argo gets the five, its scopes kept in catalogue order, a plugin's own after
+-- them. Every state change writes its event: each argo it changes gets ScopesChanged, by the system, taking
+-- the next number of its fleet's stream. Its id is an evt_ id as common/src/ids makes them: the time in
+-- milliseconds, then 80 random bits, in lowercase Crockford base32.
+DO $$
+DECLARE
+  alphabet CONSTANT text := '0123456789abcdefghjkmnpqrstvwxyz';
+  catalogue CONSTANT text[] := ARRAY['messages:send', 'messages:receive', 'messages:force', 'messages:resend', 'fleet:read', 'fleet:commission', 'fleet:manage', 'crew:assign', 'crew:run', 'labels:define', 'labels:assign', 'fleet:network', 'fleet:on-behalf', 'fleet:person', 'fleet:owner', 'fleet:explain', 'fleet:connect', 'labels:any', 'scopes:declare', 'scopes:grant'];
+  jobs CONSTANT text[] := ARRAY['fleet:person', 'fleet:owner', 'fleet:explain', 'fleet:connect', 'labels:any'];
+  changed record;
+  at timestamptz;
+  millis bigint;
+  body text;
+  next_seq bigint;
+BEGIN
+  FOR changed IN
+    WITH "before" AS (
+      SELECT "id", "scopes" FROM "ships" WHERE "kind" = 'operator' AND NOT ("scopes" @> jobs) FOR UPDATE
+    )
+    UPDATE "ships" SET "scopes" = (
+      SELECT array_agg("scope" ORDER BY coalesce(array_position(catalogue, "scope"), cardinality(catalogue) + 1), "place")
+      FROM unnest("ships"."scopes" || ARRAY(SELECT "job" FROM unnest(jobs) AS "job" WHERE NOT ("job" = ANY("ships"."scopes")))) WITH ORDINALITY AS u("scope", "place")
+    )
+    FROM "before"
+    WHERE "ships"."id" = "before"."id"
+    RETURNING "ships"."fleet_id", "ships"."id",
+      array_to_string(ARRAY(SELECT "job" FROM unnest(jobs) AS "job" WHERE NOT ("job" = ANY("before"."scopes"))), ' ') AS "added"
+  LOOP
+    at := clock_timestamp();
+    millis := floor(extract(epoch FROM at) * 1000)::bigint;
+    body := '';
+    FOR position IN REVERSE 9..0 LOOP
+      body := body || substr(alphabet, ((millis >> (position * 5)) & 31)::integer + 1, 1);
+    END LOOP;
+    FOR position IN 1..16 LOOP
+      body := body || substr(alphabet, floor(random() * 32)::integer + 1, 1);
+    END LOOP;
+
+    UPDATE "fleets" SET "last_event_seq" = "last_event_seq" + 1 WHERE "id" = changed."fleet_id"
+      RETURNING "last_event_seq" INTO next_seq;
+    INSERT INTO "events" ("id", "fleet_id", "type", "occurred_at", "ship_id", "details", "seq")
+    VALUES (
+      'evt_' || body,
+      changed."fleet_id",
+      'ScopesChanged',
+      at,
+      changed."id",
+      jsonb_build_object('added', changed."added", 'removed', ''),
+      next_seq
+    );
+  END LOOP;
+END;
+$$;

package/src/adapters/prisma/migrations/20261020100000_installation_labels/migration.sql

@@ -0,0 +1,7 @@
+-- A label belongs to the actor that defined it: a ship, or the installation (decision 0031), which defines
+-- the label group in each fleet (decision 0052). An installation's label names no owner ship.
+CREATE TYPE "label_owner_kind" AS ENUM ('ship', 'installation');
+
+ALTER TABLE "labels" ADD COLUMN "owner_kind" "label_owner_kind" NOT NULL DEFAULT 'ship';
+ALTER TABLE "labels" ALTER COLUMN "owner_ship_id" DROP NOT NULL;
+ALTER TABLE "labels" ADD CONSTRAINT "labels_owner_named" CHECK (("owner_ship_id" IS NOT NULL) = ("owner_kind" = 'ship'));

package/src/adapters/prisma/migrations/20261020110000_installation_declared_network_rules/migration.sql

@@ -0,0 +1,10 @@
+-- The network rules the installation declares on the labels it owns, such as group=# to group=# (decisions 0037, 0052):
+-- one row per fleet while it declares any, apart from the ships' declared rules, as it is no ship.
+CREATE TABLE "installation_declared_network_rules" (
+    "fleet_id" TEXT NOT NULL,
+    "rules" JSONB NOT NULL,
+
+    CONSTRAINT "installation_declared_network_rules_pkey" PRIMARY KEY ("fleet_id")
+);
+
+ALTER TABLE "installation_declared_network_rules" ADD CONSTRAINT "installation_declared_network_rules_fleet_id_fkey" FOREIGN KEY ("fleet_id") REFERENCES "fleets"("id") ON DELETE RESTRICT ON UPDATE CASCADE;

package/src/adapters/prisma/migrations/20261020120000_commissioning_actors/migration.sql

@@ -0,0 +1,14 @@
+-- A ship is commissioned by an actor (decisions 0053, 0057): a ship, an account by its id only, or the installation,
+-- which commissions person ships. commissioned_by names it: the ship's id, the account's id, or 'installation'.
+-- Every commission so far was a ship's. An idempotency key is used once per commissioning actor.
+CREATE TYPE "commissioner_kind" AS ENUM ('ship', 'account', 'installation');
+
+ALTER TABLE "ships" ADD COLUMN "commissioned_by_kind" "commissioner_kind";
+UPDATE "ships" SET "commissioned_by_kind" = 'ship' WHERE "commissioned_by" IS NOT NULL;
+ALTER TABLE "ships" ADD CONSTRAINT "ships_commissioner_named" CHECK (
+  ("commissioned_by" IS NULL) = ("commissioned_by_kind" IS NULL)
+  AND ("commissioned_by_kind" <> 'installation' OR "commissioned_by" = 'installation')
+);
+
+DROP INDEX "ships_fleet_id_commissioned_by_commission_key_key";
+CREATE UNIQUE INDEX "ships_commission_key_key" ON "ships"("fleet_id", "commissioned_by_kind", "commissioned_by", "commission_key");

package/src/adapters/prisma/migrations/20261020130000_console_sign_in_accounts/migration.sql

@@ -0,0 +1,4 @@
+-- A sign-in ticket from pagasae may name the account it signs in as argo, by its id only, never its email
+-- (decisions 0054, 0058); the console session it starts keeps that id. Null for argo's own sign-in and a viewer.
+ALTER TABLE "sign_in_tickets" ADD COLUMN "account_id" TEXT;
+ALTER TABLE "console_sessions" ADD COLUMN "account_id" TEXT;

package/src/adapters/prisma/migrations/20261020140000_event_signed_in_accounts/migration.sql

@@ -0,0 +1,4 @@
+-- An event argo writes names the account signed in to the console as it, by its id only (decision 0054).
+-- Earlier events name none.
+ALTER TABLE "events" ADD COLUMN "actor_signed_in_account_id" TEXT;
+ALTER TABLE "events" ADD CONSTRAINT "events_signed_in_account_by_a_ship" CHECK ("actor_signed_in_account_id" IS NULL OR "actor_kind" = 'ship');

package/src/adapters/prisma/migrations/20261020150000_account_cut_off_ends_console_sessions/migration.sql

@@ -0,0 +1,2 @@
+-- AlterEnum
+ALTER TYPE "console_session_end_reason" ADD VALUE 'accountCutOff';

package/src/adapters/prisma/migrations/20261020160000_network_in_core/migration.sql

@@ -0,0 +1,30 @@
+-- Network rules live in core (decision 0034): the networking plugin goes.
+-- A fleet's own rules are a list, or NULL while none are applied: all-to-all,
+-- open on. A fleet whose open was on for send had no rules in force beside
+-- the built-in ones, so it keeps none; any other keeps its list.
+UPDATE "network_settings" SET "rules" = NULL WHERE "built_in_open_send";
+ALTER TABLE "network_settings" ALTER COLUMN "rules" DROP NOT NULL, ALTER COLUMN "rules" DROP DEFAULT;
+
+ALTER TABLE "network_settings"
+  DROP CONSTRAINT IF EXISTS "network_settings_plugin_whole",
+  DROP COLUMN "built_in_open_send",
+  DROP COLUMN "built_in_open_read",
+  DROP COLUMN "built_in_open_manage",
+  DROP COLUMN "plugin_ship_id",
+  DROP COLUMN "plugin_while_unavailable",
+  DROP COLUMN "plugin_not_responding_after_seconds",
+  DROP COLUMN "plugin_registered_at";
+
+ALTER TABLE "reach_refusals" DROP COLUMN "while_plugin_unavailable";
+
+-- The draft of a fleet's own rules: one a fleet at most, never in force.
+CREATE TABLE "network_rules_drafts" (
+    "fleet_id" TEXT NOT NULL,
+    "rules" JSONB,
+    "saved_at" TIMESTAMPTZ(3) NOT NULL,
+    "saved_against_version" INTEGER NOT NULL,
+
+    CONSTRAINT "network_rules_drafts_pkey" PRIMARY KEY ("fleet_id")
+);
+
+ALTER TABLE "network_rules_drafts" ADD CONSTRAINT "network_rules_drafts_fleet_id_fkey" FOREIGN KEY ("fleet_id") REFERENCES "fleets"("id") ON DELETE RESTRICT ON UPDATE CASCADE;

package/src/adapters/prisma/migrations/20261020170000_verify_scope/migration.sql

@@ -0,0 +1,64 @@
+-- fleet:verify, writing verified facts about the ships an actor manages, joins the core scopes (decisions 0046, 0059).
+CREATE OR REPLACE FUNCTION "ships_scopes_are_known"("scopes" TEXT[]) RETURNS BOOLEAN IMMUTABLE LANGUAGE SQL AS $$
+  SELECT "scopes" IS NOT NULL AND NOT EXISTS (
+    SELECT 1 FROM unnest("scopes") AS "scope"
+    WHERE NOT (
+      "scope" = ANY(ARRAY['messages:send', 'messages:receive', 'messages:force', 'messages:resend', 'fleet:read', 'fleet:commission', 'fleet:manage', 'crew:assign', 'crew:run', 'labels:define', 'labels:assign', 'fleet:network', 'fleet:on-behalf', 'fleet:person', 'fleet:owner', 'fleet:explain', 'fleet:connect', 'labels:any', 'fleet:verify', 'scopes:declare', 'scopes:grant']::TEXT[])
+      OR ("scope" ~ '^[a-z][a-z0-9-]{0,31}:[a-z][a-z0-9-]{0,31}$' AND split_part("scope", ':', 1) <> ALL(ARRAY['messages', 'fleet', 'crew', 'labels', 'scopes']::TEXT[]))
+    )
+  )
+$$;
+
+-- argo holds every scope: every argo gets fleet:verify, its scopes kept in catalogue order, a plugin's own after
+-- them. Every state change writes its event: each argo it changes gets ScopesChanged, by the system, taking
+-- the next number of its fleet's stream. Its id is an evt_ id as common/src/ids makes them: the time in
+-- milliseconds, then 80 random bits, in lowercase Crockford base32.
+DO $$
+DECLARE
+  alphabet CONSTANT text := '0123456789abcdefghjkmnpqrstvwxyz';
+  catalogue CONSTANT text[] := ARRAY['messages:send', 'messages:receive', 'messages:force', 'messages:resend', 'fleet:read', 'fleet:commission', 'fleet:manage', 'crew:assign', 'crew:run', 'labels:define', 'labels:assign', 'fleet:network', 'fleet:on-behalf', 'fleet:person', 'fleet:owner', 'fleet:explain', 'fleet:connect', 'labels:any', 'fleet:verify', 'scopes:declare', 'scopes:grant'];
+  jobs CONSTANT text[] := ARRAY['fleet:verify'];
+  changed record;
+  at timestamptz;
+  millis bigint;
+  body text;
+  next_seq bigint;
+BEGIN
+  FOR changed IN
+    WITH "before" AS (
+      SELECT "id", "scopes" FROM "ships" WHERE "kind" = 'operator' AND NOT ("scopes" @> jobs) FOR UPDATE
+    )
+    UPDATE "ships" SET "scopes" = (
+      SELECT array_agg("scope" ORDER BY coalesce(array_position(catalogue, "scope"), cardinality(catalogue) + 1), "place")
+      FROM unnest("ships"."scopes" || ARRAY(SELECT "job" FROM unnest(jobs) AS "job" WHERE NOT ("job" = ANY("ships"."scopes")))) WITH ORDINALITY AS u("scope", "place")
+    )
+    FROM "before"
+    WHERE "ships"."id" = "before"."id"
+    RETURNING "ships"."fleet_id", "ships"."id",
+      array_to_string(ARRAY(SELECT "job" FROM unnest(jobs) AS "job" WHERE NOT ("job" = ANY("before"."scopes"))), ' ') AS "added"
+  LOOP
+    at := clock_timestamp();
+    millis := floor(extract(epoch FROM at) * 1000)::bigint;
+    body := '';
+    FOR position IN REVERSE 9..0 LOOP
+      body := body || substr(alphabet, ((millis >> (position * 5)) & 31)::integer + 1, 1);
+    END LOOP;
+    FOR position IN 1..16 LOOP
+      body := body || substr(alphabet, floor(random() * 32)::integer + 1, 1);
+    END LOOP;
+
+    UPDATE "fleets" SET "last_event_seq" = "last_event_seq" + 1 WHERE "id" = changed."fleet_id"
+      RETURNING "last_event_seq" INTO next_seq;
+    INSERT INTO "events" ("id", "fleet_id", "type", "occurred_at", "ship_id", "details", "seq")
+    VALUES (
+      'evt_' || body,
+      changed."fleet_id",
+      'ScopesChanged',
+      at,
+      changed."id",
+      jsonb_build_object('added', changed."added", 'removed', ''),
+      next_seq
+    );
+  END LOOP;
+END;
+$$;

package/src/adapters/prisma/migrations/20261020180000_verified_facts/migration.sql

@@ -0,0 +1,21 @@
+-- One writer's verified facts about a ship (decision 0059): what it checked, set whole and kept with the ship.
+-- CreateEnum
+CREATE TYPE "fact_writer_kind" AS ENUM ('ship', 'account', 'installation');
+
+-- CreateTable
+CREATE TABLE "verified_facts" (
+    "fleet_id" TEXT NOT NULL,
+    "ship_id" TEXT NOT NULL,
+    "writer_kind" "fact_writer_kind" NOT NULL,
+    "writer" TEXT NOT NULL,
+    "facts" JSONB NOT NULL,
+    "written_at" TIMESTAMPTZ(3) NOT NULL,
+
+    CONSTRAINT "verified_facts_pkey" PRIMARY KEY ("fleet_id","ship_id","writer_kind","writer")
+);
+
+-- AddForeignKey
+ALTER TABLE "verified_facts" ADD CONSTRAINT "verified_facts_fleet_id_fkey" FOREIGN KEY ("fleet_id") REFERENCES "fleets"("id") ON DELETE RESTRICT ON UPDATE CASCADE;
+
+-- AddForeignKey
+ALTER TABLE "verified_facts" ADD CONSTRAINT "verified_facts_fleet_id_ship_id_fkey" FOREIGN KEY ("fleet_id", "ship_id") REFERENCES "ships"("fleet_id", "id") ON DELETE RESTRICT ON UPDATE CASCADE;

package/src/adapters/prisma/migrations/20261020190000_verified_facts_by_writer/migration.sql

@@ -0,0 +1,3 @@
+-- A retiring writer finds its verified facts about every ship (decision 0059).
+-- CreateIndex
+CREATE INDEX "verified_facts_fleet_id_writer_kind_writer_idx" ON "verified_facts"("fleet_id", "writer_kind", "writer");

package/src/adapters/prisma/schema.prisma

@@ -52,9 +52,12 @@ model Fleet {
   labelValues      LabelValue[]
   shipLabels       ShipLabel[]
   networkSettings  NetworkSettings?
+  networkRulesDraft NetworkRulesDraft?
   declaredNetworkRules DeclaredNetworkRules[]
+  installationDeclaredNetworkRules InstallationDeclaredNetworkRules?
   scopeNamespaces  ScopeNamespace[]
   pluginConnections PluginConnection[]
+  verifiedFacts    VerifiedFacts[]
   reachRefusals    ReachRefusal[]
   credentials      Credential[]
   messages         Message[]
@@ -93,7 +96,9 @@ model Ship {
   note                  String?
   createdAt             DateTime  @map("created_at") @db.Timestamptz(3)
   retiredAt             DateTime? @map("retired_at") @db.Timestamptz(3)
-  /// The ship that commissioned it, its idempotency key and the request's hash; null for argo.
+  /// The actor that commissioned it, its idempotency key and the request's hash; null for argo.
+  /// commissioned_by names the actor: a ship's id, an account's id, or `installation`.
+  commissionedByKind    CommissionerKind? @map("commissioned_by_kind")
   commissionedBy        String?   @map("commissioned_by")
   commissionKey         String?   @map("commission_key")
   commissionRequestHash String?   @map("commission_request_hash")
@@ -112,6 +117,7 @@ model Ship {
   overdueDeliveries OverdueDelivery[]
   consoleSessions   ConsoleSession[]
   actorOfEvents     Event[]          @relation("EventActorShip")
+  actorThroughOfEvents Event[]       @relation("EventActorThroughShip")
   events            Event[]          @relation("EventShip")
   crewRequest       CrewRequest?     @relation("CrewRequestShip")
   assignedCrews     CrewRequest[]    @relation("CrewRequestAssignee")
@@ -124,10 +130,11 @@ model Ship {
   declaredNetworkRules DeclaredNetworkRules[]
   declaredNamespace ScopeNamespace?
   pluginConnection  PluginConnection?
+  verifiedFacts     VerifiedFacts[]
 
   @@unique([fleetId, id])
-  /// An idempotency key is used once per commissioning ship.
-  @@unique([fleetId, commissionedBy, commissionKey])
+  /// An idempotency key is used once per commissioning actor.
+  @@unique([fleetId, commissionedByKind, commissionedBy, commissionKey], map: "ships_commission_key_key")
   /// A name is unique among ships that are not retired, and reusable after retirement.
   @@unique([fleetId, name], map: "ships_fleet_id_name_active_key", where: { retiredAt: null })
   /// Exactly one operator ship per fleet.
@@ -318,10 +325,12 @@ model Label {
   id          String @id
   fleetId     String @map("fleet_id")
   key         String
-  ownerShipId String @map("owner_ship_id")
+  /// A ship or the installation (decision 0031); the installation's label names no owner ship.
+  ownerKind   LabelOwnerKind @default(ship) @map("owner_kind")
+  ownerShipId String?        @map("owner_ship_id")
 
   fleet    Fleet        @relation(fields: [fleetId], references: [id])
-  owner    Ship         @relation("LabelOwner", fields: [fleetId, ownerShipId], references: [fleetId, id])
+  owner    Ship?        @relation("LabelOwner", fields: [fleetId, ownerShipId], references: [fleetId, id])
   values   LabelValue[]
   carriers ShipLabel[]
 
@@ -376,27 +385,33 @@ model ShipLabel {
 /// rules as JSON, none (null) for all-to-all, and their version. A send and a
 /// set take turns on an advisory lock on them (network.ts).
 model NetworkSettings {
-  fleetId                         String  @id @map("fleet_id")
-  rules                           Json    @default("[]")
-  /// The built-in rules that can be off (decision 0034): the viewer reading,
-  /// argo's, and open per verb, the networking plugin's. On at fleet create.
-  builtInViewerRead               Boolean @default(true) @map("built_in_viewer_read")
-  builtInOpenSend                 Boolean @default(true) @map("built_in_open_send")
-  builtInOpenRead                 Boolean @default(true) @map("built_in_open_read")
-  builtInOpenManage               Boolean @default(true) @map("built_in_open_manage")
-  version                         Int
-  /// The fleet's networking plugin (decision 0035): its ship, what it
-  /// declared and when it first registered, all four set or none.
-  pluginShipId                    String?   @map("plugin_ship_id")
-  pluginWhileUnavailable          String?   @map("plugin_while_unavailable")
-  pluginNotRespondingAfterSeconds Int?      @map("plugin_not_responding_after_seconds")
-  pluginRegisteredAt              DateTime? @map("plugin_registered_at") @db.Timestamptz(3)
+  fleetId           String  @id @map("fleet_id")
+  /// The fleet's own rules as last applied (decision 0034); NULL while none
+  /// are, all-to-all with open on.
+  rules             Json?
+  /// The viewer reading every ship, the built-in rule an actor turns (decision 0034). On at fleet create.
+  builtInViewerRead Boolean @default(true) @map("built_in_viewer_read")
+  version           Int
 
   fleet Fleet @relation(fields: [fleetId], references: [id])
 
   @@map("network_settings")
 }
 
+/// The draft of a fleet's own rules (decision 0034): one a fleet at most, the
+/// rules as JSON or NULL for all-to-all. Nothing in force reads it; an apply
+/// moves it into network_settings and removes it.
+model NetworkRulesDraft {
+  fleetId             String   @id @map("fleet_id")
+  rules               Json?
+  savedAt             DateTime @map("saved_at") @db.Timestamptz(3)
+  savedAgainstVersion Int      @map("saved_against_version")
+
+  fleet Fleet @relation(fields: [fleetId], references: [id])
+
+  @@map("network_rules_drafts")
+}
+
 /// The network rules a ship declared on the labels it owns (decision 0037),
 /// its whole list as JSON, at most 20. No row while it declares none; a retire
 /// removes its row.
@@ -412,6 +427,18 @@ model DeclaredNetworkRules {
   @@map("declared_network_rules")
 }
 
+/// The network rules the installation declares on the labels it owns in one
+/// fleet (decisions 0037, 0052), its whole list as JSON; no row while it
+/// declares none.
+model InstallationDeclaredNetworkRules {
+  fleetId String @id @map("fleet_id")
+  rules   Json
+
+  fleet Fleet @relation(fields: [fleetId], references: [id])
+
+  @@map("installation_declared_network_rules")
+}
+
 /// A plugin's namespace (decision 0046): taken up for good by the ship that
 /// declared it, one per ship and unique in the fleet, with its whole list of
 /// scopes and their descriptions as JSON, in order. It goes when its declarer
@@ -444,6 +471,27 @@ model PluginConnection {
   @@map("plugin_connections")
 }
 
+/// One writer's verified facts about a ship (decision 0059): what it checked,
+/// as JSON in the shape common gives, set whole and kept with the ship. The
+/// writer is an actor: a ship or an account by its id, or the installation
+/// by its name, as a commissioning actor is.
+model VerifiedFacts {
+  fleetId    String         @map("fleet_id")
+  shipId     String         @map("ship_id")
+  writerKind FactWriterKind @map("writer_kind")
+  writer     String
+  facts      Json
+  writtenAt  DateTime       @map("written_at") @db.Timestamptz(3)
+
+  fleet Fleet @relation(fields: [fleetId], references: [id])
+  ship  Ship  @relation(fields: [fleetId, shipId], references: [fleetId, id])
+
+  @@id([fleetId, shipId, writerKind, writer])
+  /// A retiring writer finds its facts about every ship.
+  @@index([fleetId, writerKind, writer])
+  @@map("verified_facts")
+}
+
 /// A send the network rules refused (decision 0034), recorded in the
 /// transaction that refused it. Ids start with rfs_. Sender and recipient are
 /// as they were then: ids, names and the label values they carried, as JSON,
@@ -459,9 +507,6 @@ model ReachRefusal {
   /// What the sender tried to do: send, read or manage (decision 0034).
   verb            String
   settingsVersion Int      @map("settings_version")
-  /// What the networking plugin declared, when it refused while the plugin
-  /// was not responding (decision 0035): block-all or keep-latest.
-  whilePluginUnavailable String? @map("while_plugin_unavailable")
 
   fleet Fleet @relation(fields: [fleetId], references: [id])
 
@@ -658,7 +703,15 @@ model Event {
   fleetId     String   @map("fleet_id")
   type        String
   occurredAt  DateTime @map("occurred_at") @db.Timestamptz(3)
+  /// Who caused it (decision 0057): a ship, an account, the installation or the system.
+  actorKind   EventActorKind @default(system) @map("actor_kind")
   actorShipId String?  @map("actor_ship_id")
+  /// The account that caused it, by pagasae's id only: never an email.
+  actorAccountId String? @map("actor_account_id")
+  /// The ship that presented the account's token, a plugin's page or the gateway, if one did.
+  actorThroughShipId String? @map("actor_through_ship_id")
+  /// The account signed in to the console as argo when argo caused it, by its id only (decision 0054).
+  actorSignedInAccountId String? @map("actor_signed_in_account_id")
   shipId      String?  @map("ship_id")
   messageId   String?  @map("message_id")
   deliveryId  String?  @map("delivery_id")
@@ -670,6 +723,7 @@ model Event {
 
   fleet     Fleet     @relation(fields: [fleetId], references: [id])
   actorShip Ship?     @relation("EventActorShip", fields: [fleetId, actorShipId], references: [fleetId, id], onDelete: Restrict)
+  actorThroughShip Ship? @relation("EventActorThroughShip", fields: [fleetId, actorThroughShipId], references: [fleetId, id], onDelete: Restrict)
   ship      Ship?     @relation("EventShip", fields: [fleetId, shipId], references: [fleetId, id], onDelete: Restrict)
   message   Message?  @relation(fields: [fleetId, messageId], references: [fleetId, id], onDelete: Restrict)
   delivery  Delivery? @relation(fields: [fleetId, deliveryId], references: [fleetId, id], onDelete: Restrict)
@@ -678,6 +732,7 @@ model Event {
   /// Every foreign key has an index leading with its columns, so deleting a
   /// referenced row checks it with an index, not a scan (#331).
   @@index([fleetId, actorShipId])
+  @@index([actorThroughShipId, fleetId])
   @@index([fleetId, shipId])
   @@index([fleetId, messageId])
   @@index([fleetId, deliveryId])
@@ -692,6 +747,7 @@ enum ConsoleSessionEndReason {
   takenOver
   signedOut
   passwordReset
+  accountCutOff
 
   @@map("console_session_end_reason")
 }
@@ -738,6 +794,8 @@ model ConsoleSession {
   endsBy           DateTime?                @map("ends_by") @db.Timestamptz(3)
   /// The device it signed in from, as the browser told: "Mac · Chrome".
   device           String                   @default("Unknown device")
+  /// The account that signed in as argo, by its id only; null for argo's own sign-in and a viewer (decision 0054).
+  accountId        String?                  @map("account_id")
   tokenHash        String                   @unique @map("token_hash")
   createdAt        DateTime                 @map("created_at") @db.Timestamptz(3)
   lastUsedAt       DateTime                 @map("last_used_at") @db.Timestamptz(3)
@@ -770,6 +828,8 @@ model SignInTicket {
   fleetId   String    @map("fleet_id")
   /// Whom it signs in as: the operator or a viewer (decision 0022).
   signInAs  SignInAs  @map("sign_in_as")
+  /// The account it signs in as argo, by its id only; null for argo's own or a viewer's ticket (decision 0054).
+  accountId String?   @map("account_id")
   issuedAt  DateTime  @map("issued_at") @db.Timestamptz(3)
   expiresAt DateTime  @map("expires_at") @db.Timestamptz(3)
   /// When it signed in; null while unused.
@@ -899,3 +959,52 @@ model GuideProgress {
   @@index([fleetId])
   @@map("guide_progress")
 }
+
+/// An account pagasae cut off (decision 0058): its tokens issued before
+/// cut_off_at are refused in every fleet until forget_at, when the longest of
+/// them has ended. The installation's, not a fleet's: no fleet_id (ADR 0007).
+/// Never an email: the account by pagasae's id only.
+model AccountCutOff {
+  accountId String   @id @map("account_id")
+  cutOffAt  DateTime @map("cut_off_at") @db.Timestamptz(3)
+  forgetAt  DateTime @map("forget_at") @db.Timestamptz(3)
+
+  /// Forgetting finds the cut-offs that ended.
+  @@index([forgetAt])
+  @@map("account_cut_offs")
+}
+
+/// Who caused an event (decision 0057).
+enum EventActorKind {
+  ship
+  account
+  installation
+  system
+
+  @@map("event_actor_kind")
+}
+
+/// Who commissioned a ship (decision 0057).
+/// Who wrote a verified fact (decision 0059).
+enum FactWriterKind {
+  ship
+  account
+  installation
+
+  @@map("fact_writer_kind")
+}
+
+enum CommissionerKind {
+  ship
+  account
+  installation
+
+  @@map("commissioner_kind")
+}
+
+enum LabelOwnerKind {
+  ship
+  installation
+
+  @@map("label_owner_kind")
+}

package/dist/domain/registry/read-network-plugin.d.ts

@@ -1,23 +0,0 @@
-import type { ShipId } from '@aeolus-fleet/common';
-import type { Caller } from '../shared/caller.js';
-import { type Result } from '../shared/result.js';
-import type { UnitOfWork } from '../shared/unit-of-work.js';
-import type { NetworkSettingsRepository } from './ports.js';
-export interface ReadNetworkPluginTx {
-    networkSettings: Pick<NetworkSettingsRepository, 'findForShare'>;
-}
-export interface RegisteredNetworkPlugin {
-    shipId: ShipId;
-    registeredAt: Date;
-}
-export type ReadNetworkPlugin = (caller: Caller) => Promise<Result<RegisteredNetworkPlugin | null, never>>;
-/**
- * Use case: the caller's fleet's networking plugin, its ship and when it
- * registered, or none (decision 0035): the gateway switches on for a fleet
- * only while it has one (interop I-3). Its scope (fleet:read) is checked
- * before this runs. Read under the shared settings lock, so it answers one
- * version.
- */
-export declare function createReadNetworkPlugin(deps: {
-    uow: UnitOfWork<ReadNetworkPluginTx>;
-}): ReadNetworkPlugin;

package/dist/domain/registry/read-network-plugin.js

@@ -1,15 +0,0 @@
-import { ok } from '../shared/result.js';
-/**
- * Use case: the caller's fleet's networking plugin, its ship and when it
- * registered, or none (decision 0035): the gateway switches on for a fleet
- * only while it has one (interop I-3). Its scope (fleet:read) is checked
- * before this runs. Read under the shared settings lock, so it answers one
- * version.
- */
-export function createReadNetworkPlugin(deps) {
-    return (caller) => deps.uow.run(async (tx) => {
-        const { plugin } = await tx.networkSettings.findForShare(caller.fleetId);
-        return ok(plugin === null ? null : { shipId: plugin.shipId, registeredAt: plugin.registeredAt });
-    });
-}
-//# sourceMappingURL=read-network-plugin.js.map

package/dist/domain/registry/read-network-plugin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"read-network-plugin.js","sourceRoot":"","sources":["../../../src/domain/registry/read-network-plugin.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAetD;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAA8C;IACpF,OAAO,CAAC,MAAM,EAAE,EAAE,CAChB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAA0D,EAAE;QAChF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzE,OAAO,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;IACnG,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/domain/registry/register-network-plugin.d.ts

@@ -1,28 +0,0 @@
-import type { IdGenerator, NetworkPluginDeclaration } from '@aeolus-fleet/common';
-import type { Caller } from '../shared/caller.js';
-import type { Clock } from '../shared/clock.js';
-import { type EventLog } from '../shared/events.js';
-import { type Result } from '../shared/result.js';
-import type { UnitOfWork } from '../shared/unit-of-work.js';
-import { type RegisterNetworkPluginRefusal } from './network-settings.js';
-import type { NetworkSettingsRepository } from './ports.js';
-export interface RegisterNetworkPluginTx {
-    networkSettings: Pick<NetworkSettingsRepository, 'findForUpdate' | 'save'>;
-    events: EventLog;
-}
-export type RegisterNetworkPlugin = (caller: Caller, input: NetworkPluginDeclaration) => Promise<Result<{
-    version: number;
-}, RegisterNetworkPluginRefusal>>;
-/**
- * Use case: the caller's ship becomes the fleet's networking plugin, saying
- * what happens to sends while it is unavailable and after how long without a
- * call it is not responding (decision 0035). Its scope (fleet:network) is
- * checked before this runs. In one unit of work, holding the settings
- * exclusively as a set of rules does: the settings at their next version,
- * and NetworkPluginRegistered.
- */
-export declare function createRegisterNetworkPlugin(deps: {
-    uow: UnitOfWork<RegisterNetworkPluginTx>;
-    clock: Clock;
-    ids: IdGenerator;
-}): RegisterNetworkPlugin;

package/dist/domain/registry/register-network-plugin.js

@@ -1,26 +0,0 @@
-import { recordEvent, shipActor } from '../shared/events.js';
-import { ok } from '../shared/result.js';
-import { registerNetworkPlugin } from './network-settings.js';
-/**
- * Use case: the caller's ship becomes the fleet's networking plugin, saying
- * what happens to sends while it is unavailable and after how long without a
- * call it is not responding (decision 0035). Its scope (fleet:network) is
- * checked before this runs. In one unit of work, holding the settings
- * exclusively as a set of rules does: the settings at their next version,
- * and NetworkPluginRegistered.
- */
-export function createRegisterNetworkPlugin(deps) {
-    return (caller, declaration) => deps.uow.run(async (tx) => {
-        const current = await tx.networkSettings.findForUpdate(caller.fleetId);
-        const registered = registerNetworkPlugin(current, { shipId: caller.shipId, declaration, at: deps.clock.now(), actor: shipActor(caller.shipId) });
-        if (!registered.isOk) {
-            return registered;
-        }
-        await tx.networkSettings.save(registered.value.settings);
-        for (const event of registered.value.events) {
-            await recordEvent({ events: tx.events, ids: deps.ids }, event);
-        }
-        return ok({ version: registered.value.settings.version });
-    });
-}
-//# sourceMappingURL=register-network-plugin.js.map

package/dist/domain/registry/register-network-plugin.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"register-network-plugin.js","sourceRoot":"","sources":["../../../src/domain/registry/register-network-plugin.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAiB,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,EAAE,EAAe,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,qBAAqB,EAAqC,MAAM,uBAAuB,CAAC;AAUjG;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAkF;IAC5H,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,CAC7B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAsE,EAAE;QAC5F,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,eAAe,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvE,MAAM,UAAU,GAAG,qBAAqB,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACjJ,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACrB,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,MAAM,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACzD,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC5C,MAAM,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACP,CAAC"}