portal-mojo 0.2.19 → 0.2.21

package/src/admin/fleet/FleetWorkspace.tsx

@@ -0,0 +1,82 @@
+import { useEffect, useRef, useState, useSyncExternalStore } from 'react';
+import { useQuery, useQueryClient } from '@tanstack/react-query';
+import { Link, useLocation } from 'react-router-dom';
+import { decodeJwt, getAccessToken, getAuthSessionRevision, subscribeAuth, useAuthSnapshot, useMe } from '../../client/runtime';
+import { modal } from '../../ui/modal';
+import { Tabs } from '../../ui/Tabs';
+import { datetime } from '../../ui/format';
+import { useAdminRouteContext } from '../core/route-context';
+import { backendGlobalCan, FLEET_CAPACITY_GRANTS, FLEET_DASHBOARD_GRANTS } from './access';
+import { readCapacity, readFleetDashboard } from './api';
+import { fleetOperations, fleetSessionScope } from './operations';
+import { FleetHelp } from './FleetHelp';
+import type { FleetLinks, FleetOverviewProps } from './FleetOverview';
+import type { CapacityReport, FleetFacts, FleetSource } from './types';
+const defaultLinks: FleetLinks = { last_deployment: { to: 'deployments', grants: ['view_platform', 'manage_platform', 'admin', 'view_dns', 'manage_dns', 'security'] }, framework: { to: 'maintenance', grants: ['manage_aws', 'view_platform', 'manage_platform', 'admin'] }, certificates: { to: 'dns/certificates', grants: ['view_dns', 'manage_dns', 'security'] }, incidents: { to: 'security/incidents?status=open', grants: ['view_security', 'manage_security', 'security'] }, tickets: { to: 'security/tickets', grants: ['view_security', 'manage_security', 'security'] }, jobs: { to: 'jobs/list', grants: ['view_jobs', 'manage_jobs', 'jobs'] }, email: { to: 'email/domains', grants: ['manage_aws', 'comms'] }, sms: { to: 'phonehub', grants: ['view_phone_config', 'manage_phone_config', 'view_sms', 'manage_sms', 'comms'] } };
+const labels: Record<string, string> = { load_balancer: 'Load balancer', compute: 'App nodes', database: 'Database', cache: 'Redis', certificates: 'Certificates', public_api: 'Public API', framework: 'Django-MOJO', last_deployment: 'Last deployment', jobs: 'Jobs', sanity: 'Node checks', incidents: 'Incidents', tickets: 'Tickets', sms: 'SMS', email: 'Email' };
+const fact = (v: unknown, fallback = 'Unknown') => typeof v === 'string' || typeof v === 'number' ? String(v) : fallback;
+const object = (v: unknown): FleetFacts => v && typeof v === 'object' && !Array.isArray(v) ? v as FleetFacts : {};
+const list = (v: unknown): unknown[] => Array.isArray(v) ? v : [];
+function age(value: string | null, now: number): string { const stamp = value ? Date.parse(value) : NaN; if (!Number.isFinite(stamp)) return 'Observation time unavailable'; const sec = Math.max(0, Math.floor((now - stamp) / 1000)); return sec < 60 ? `Observed ${sec}s ago` : sec < 3600 ? `Observed ${Math.floor(sec / 60)}m ago` : `Observed ${Math.floor(sec / 3600)}h ago`; }
+function concise(name: string, d: FleetFacts): string {
+    switch (name) {
+        case 'compute': return `${fact(d.up)} / ${fact(d.total)} up`;
+        case 'load_balancer': return d.configured === false ? 'Not configured' : `${fact(d.healthy)} / ${fact(d.registered)} healthy targets`;
+        case 'database': case 'cache': return `${d.reachable === true ? 'Reachable' : d.reachable === false ? 'Unreachable' : 'Reachability unknown'} · ${fact(d.engine)}`;
+        case 'certificates': return `${fact(d.active)} active · ${fact(d.expiring_within_30_days)} expiring soon`;
+        case 'public_api': return d.configured === false ? 'Not configured' : `HTTP ${fact(object(d.probe).http_status)} · ${object(d.probe).ok === true ? 'Passed' : object(d.probe).ok === false ? 'Failed' : 'Unknown'}`;
+        case 'framework': return `${fact(d.installed)}${d.update_available === true ? ' · update available' : ''}`;
+        case 'last_deployment': return `${fact(object(list(d.items)[0]).sha, 'No deployment').slice(0, 12)} · ${fact(object(list(d.items)[0]).status)}`;
+        case 'jobs': return `${fact(object(d.jobs).pending)} pending · ${fact(object(d.jobs).running)} running`;
+        case 'sanity': return list(d.checks).length ? `${list(d.checks).filter(v => object(v).ok === true).length} / ${list(d.checks).length} checks passed` : 'Check evidence unavailable';
+        case 'incidents': case 'tickets': return `${fact(d.open)} open`;
+        case 'sms': return `${fact(d.provider)} · ${d.test_mode === true ? 'Test mode' : 'Live mode'}`;
+        case 'email': return `${fact(d.domains)} domains`;
+        default: return 'Evidence available';
+    }
+}
+function SourceRow({ name, source, link, now }: { name: string; source: FleetSource; link?: string; now: number }) {
+    const restricted = source.status === 'permission_denied', stale = source.stale_after && Date.parse(source.stale_after) <= now;
+    return <article className="fp-source"><div className="fp-row"><strong>{link && !restricted ? <Link to={link}>{labels[name] ?? name}</Link> : labels[name] ?? name}</strong>{!restricted && <FleetHelp label={labels[name] ?? name}><div className="fp-stack"><strong>{labels[name] ?? name}</strong><p>{concise(name, source.data)}</p>{source.reason && <p>{source.reason.replaceAll('_', ' ')}</p>}<p>Observed {source.observed_at ? datetime(source.observed_at) : 'time unavailable'}{source.stale_after ? ` · stale after ${datetime(source.stale_after)}` : ''}</p>{name === 'compute' && <p>{source.data.source === 'target_group' ? 'Load-balancer target evidence' : source.data.source === 'ec2' ? 'EC2 inventory; serving health unknown' : 'Evidence source unknown'}</p>}{name === 'database' && source.data.drift != null && <p className="text-warn">Engine update: {fact(object(source.data.drift).available_major)} · {fact(object(source.data.drift).note)} · {fact(object(source.data.drift).deadline)}</p>}{name === 'certificates' && <p>{fact(source.data.failing)} failing · next expiry {fact(source.data.soonest_expiry)}</p>}{name === 'jobs' && <p>Scheduler: {source.data.scheduler_active === true ? 'Active' : source.data.scheduler_active === false ? 'Inactive' : 'Unknown'} · {fact(source.data.failed_recent)} recent failures</p>}</div></FleetHelp>}</div><p>{restricted ? 'Restricted' : concise(name, source.data)}</p><div className="fp-row fp-source-meta"><span className={`fp-state ${stale ? 'text-warn' : ''}`}>{restricted ? 'Restricted' : source.status.replaceAll('_', ' ')}{stale ? ' · stale' : ''}</span>{stale && <time className="text-warn" dateTime={source.observed_at ?? undefined} title={source.observed_at ?? undefined}>{age(source.observed_at, now)}</time>}</div></article>;
+}
+export function FleetWorkspace({ mount: explicitMount, links: customLinks, showConfigurationLink = true }: FleetOverviewProps = {}) {
+    const auth = useAuthSnapshot(), { data: me } = useMe(), queryClient = useQueryClient(), location = useLocation(), route = useAdminRouteContext();
+    const scope = auth.authenticated && auth.uid ? `${auth.uid}:${getAuthSessionRevision()}` : null, mount = (explicitMount ?? route?.mount ?? location.pathname.replace(/\/fleet\/?$/, '').replace(/\/$/, '')).replace(/\/$/, '');
+    const canDashboard = !!scope && backendGlobalCan(me, FLEET_DASHBOARD_GRANTS), canCapacity = !!scope && backendGlobalCan(me, FLEET_CAPACITY_GRANTS);
+    const fresh = useRef(false), owner = useRef<AbortController | null>(null), openKind = useRef<'inspect' | 'edit' | 'progress' | null>(null), dismissBusy = useRef(false), [refreshing, setRefreshing] = useState(false), [opening, setOpening] = useState(false), [error, setError] = useState(''), [now, setNow] = useState(Date.now());
+    const currentAuthority = useRef({ scope, canDashboard, canCapacity, eligible: false }); currentAuthority.current = { scope, canDashboard, canCapacity, eligible: false };
+    const assertRead = (kind: 'dashboard' | 'capacity') => { const current = currentAuthority.current; if (!scope || fleetSessionScope() !== scope || current.scope !== scope || !(kind === 'dashboard' ? current.canDashboard : current.canCapacity)) throw new Error('Fleet read authority changed. Refresh with your current session.'); };
+    const dashboard = useQuery({ queryKey: ['operational-fleet', 'dashboard', scope], queryFn: ({ signal }) => readFleetDashboard(fresh.current, { signal, beforeSend: () => assertRead('dashboard') }), enabled: canDashboard, retry: false, refetchOnWindowFocus: false });
+    const capacity = useQuery({ queryKey: ['operational-fleet', 'capacity', scope], queryFn: ({ signal }) => readCapacity(fresh.current, { signal, beforeSend: () => assertRead('capacity') }), enabled: canCapacity, retry: false, refetchOnWindowFocus: false });
+    const operation = useSyncExternalStore(fn => scope ? fleetOperations.subscribe(scope, fn) : () => {}, () => scope ? fleetOperations.get(scope) : null, () => null);
+    const jwt = decodeJwt(getAccessToken()), interactive = !!jwt && !['api_key', 'group_scoped_token'].includes(String(jwt.credential_kind ?? ''));
+    const eligible = canCapacity && me?.is_superuser === true && interactive && capacity.data?.mode === 'managed', blocked = !!operation && ['submitting', 'running', 'unknown'].includes(operation.status);
+    currentAuthority.current.eligible = eligible;
+    const assertActive = (mutate = false) => { const current = currentAuthority.current; if (!scope || fleetSessionScope() !== scope || current.scope !== scope || !current.canCapacity || mutate && !current.eligible) throw new Error('Capacity authority changed. Reopen with your current session.'); };
+    useEffect(() => { const expected = scope; const unsubscribe = subscribeAuth(() => { if (fleetSessionScope() !== expected) owner.current?.abort(); }); return () => { owner.current?.abort(); unsubscribe(); }; }, [scope]);
+    useEffect(() => { if (!canCapacity || openKind.current === 'edit' && !eligible) owner.current?.abort(); }, [canCapacity, eligible]);
+    useEffect(() => { const timer = setInterval(() => setNow(Date.now()), 10_000); return () => clearInterval(timer); }, []);
+    useEffect(() => { if (!scope || !canCapacity || !operation || !['done', 'failed', 'unknown'].includes(operation.status)) return; const expected = scope; const controller = new AbortController(); void readCapacity(true, { signal: controller.signal, beforeSend: () => assertActive() }).then(next => { if (fleetSessionScope() === expected && currentAuthority.current.canCapacity) queryClient.setQueryData(['operational-fleet', 'capacity', expected], next); }).catch(() => {}); return () => controller.abort(); }, [scope, canCapacity, operation?.status, operation?.planId, queryClient]);
+    const refresh = async () => { if (refreshing) return; setRefreshing(true); fresh.current = true; try { await Promise.all([...(canDashboard ? [dashboard.refetch()] : []), ...(canCapacity ? [capacity.refetch()] : [])]); } finally { fresh.current = false; setRefreshing(false); } };
+    const launch = async (kind: 'inspect' | 'edit' | 'progress') => {
+        if (opening || dismissBusy.current) return;
+        try { assertActive(kind === 'edit'); if (kind === 'edit' && (blocked || !capacity.data) || kind === 'inspect' && !capacity.data) return; owner.current?.abort(); const controller = new AbortController(); owner.current = controller; openKind.current = kind; setOpening(true); setError('');
+            const setBusy = (value: boolean) => { dismissBusy.current = value; };
+            if (kind === 'edit') { const { CapacityEditor } = await import('./CapacityEditor'); assertActive(true); if (controller.signal.aborted) return; setOpening(false); await modal.open(done => <CapacityEditor scope={scope!} initialReport={capacity.data!} close={() => done(null)} setBusy={setBusy} assertActive={() => assertActive(true)} signal={controller.signal} onRefresh={(next: CapacityReport) => queryClient.setQueryData(['operational-fleet', 'capacity', scope], next)} onProgress={() => { void launch('progress'); }}/>, { size: 'lg', signal: controller.signal, canDismiss: () => !dismissBusy.current && fleetOperations.get(scope!).status !== 'submitting' }); }
+            else if (kind === 'inspect') { const { CapacityInspector } = await import('./CapacityInspector'); assertActive(); if (controller.signal.aborted) return; setOpening(false); await modal.open(done => <CapacityInspector report={capacity.data!} ingress={dashboard.data?.sources.load_balancer} close={() => done(null)}/>, { size: 'lg', signal: controller.signal }); }
+            else { const { CapacityProgress } = await import('./CapacityProgress'); assertActive(); if (controller.signal.aborted) return; setOpening(false); await modal.open(done => <CapacityProgress scope={scope!} close={() => done(null)} setBusy={setBusy} assertActive={() => assertActive()}/>, { size: 'lg', signal: controller.signal, canDismiss: () => !dismissBusy.current && fleetOperations.get(scope!).status !== 'submitting' }); }
+        } catch (reason) { setError(reason instanceof Error ? reason.message : 'Fleet dialog could not open.'); } finally { setOpening(false); dismissBusy.current = false; }
+    };
+    const links = { ...defaultLinks, ...customLinks }, data = canDashboard ? dashboard.data : undefined;
+    const sections = [{ title: 'Infrastructure', names: ['load_balancer', 'compute', 'database', 'cache', 'public_api', 'certificates'] }, { title: 'Operations', names: ['framework', 'last_deployment', 'jobs', 'sanity', 'incidents', 'tickets', 'sms', 'email'] }];
+    const configMounted = !route || route.paths.includes(`${mount}/fleet-configuration`);
+    return <section className="fp-workspace" aria-label="Fleet workspace"><header className="fp-header"><div><div className="eyebrow">Operations</div><h1>Fleet</h1><p className="dim">Health and capacity</p></div><div className="fp-actions">{canCapacity && (blocked ? <button className="btn btn-primary" disabled={opening} onClick={() => void launch('progress')}>View capacity progress</button> : eligible ? <button className="btn btn-primary" disabled={opening} onClick={() => void launch('edit')}>Change capacity</button> : null)}<button className="btn" disabled={refreshing || dashboard.isFetching || capacity.isFetching || operation?.status === 'submitting'} onClick={() => void refresh()}>Refresh fleet</button>{canCapacity && <button className="btn" disabled={!capacity.data || opening} onClick={() => void launch('inspect')}>Inspect capacity</button>}{showConfigurationLink && configMounted && me?.is_superuser === true && <Link className="btn" to={`${mount}/fleet-configuration`}>Configuration</Link>}</div></header>
+        {data && <div className={`panel fp-health fp-health-${data.availability.state}`}><div><strong>{data.availability.message}</strong><p className="dim"><time dateTime={data.observed_at} title={datetime(data.observed_at)}>{age(data.observed_at, now)}</time></p></div><span className="fp-state">{data.availability.state === 'ok' ? 'Available' : data.availability.state === 'down' ? 'Unavailable' : 'Unknown'}</span></div>}
+        {canDashboard && !data && <div className="panel panel-pad" role={dashboard.error ? 'alert' : 'status'}>{dashboard.error?.message ?? 'Loading fleet health…'}</div>}{data && dashboard.error && <p className="form-alert" role="alert">Latest health observation failed: {dashboard.error.message}. Prior evidence retains its original age.</p>}
+        {canCapacity && capacity.data && <div className="fp-capacity-strip panel"><div><span className="dim">App nodes</span><strong>{capacity.data.nodes.inventory_available ? capacity.data.nodes.instances.length : 'Unknown'}</strong></div><div><span className="dim">Database</span><strong>{capacity.data.databases_available ? capacity.data.databases.length : 'Unknown'}</strong></div><div><span className="dim">Redis</span><strong>{capacity.data.caches_available ? capacity.data.caches.length : 'Unknown'}</strong></div><div className="fp-capacity-context"><span>{capacity.data.region} · {capacity.data.mode}</span><small className="dim">{age(capacity.data.generated_at, now)}</small></div></div>}
+        {canCapacity && capacity.error && <p className="form-alert" role="alert">Capacity observation unavailable: {capacity.error.message}</p>}
+        {operation && operation.status !== 'idle' && canCapacity && <div className="panel fp-operation"><div><strong>{operation.status === 'done' ? 'Capacity batch completed' : operation.status === 'failed' ? 'Capacity batch failed' : operation.status === 'unknown' ? 'Capacity progress unknown' : 'Capacity change in progress'}</strong><p className="dim">{operation.message}</p></div>{!blocked && <button className="btn" onClick={() => void launch('progress')}>View capacity progress</button>}</div>}
+        {data && <section className="panel fp-section"><Tabs ariaLabel="Fleet health" items={sections.map(section => { const names = section.names.filter(name => { const source = data.sources[name]; return source && !(['sms', 'email'].includes(name) && (source.status === 'unconfigured' || source.data.configured === false)) && !(name === 'tickets' && source.data.open === 0); }); return { key: section.title.toLowerCase(), label: section.title, panel: <div className="fp-evidence-grid">{names.every(name => data.sources[name]?.status === 'permission_denied') ? <p className="fp-restricted">Restricted — your account cannot read these sources.</p> : names.map(name => { const link = links[name], destination = link && (!link.superuser || me?.is_superuser === true) && backendGlobalCan(me, link.grants) && (!route || route.paths.includes(`${mount}/${link.to.replace(/^\//, '').split('?')[0]}`)) ? `${mount}/${link.to.replace(/^\//, '')}` : undefined; return <SourceRow key={name} name={name} source={data.sources[name]!} link={destination} now={now}/>; })}</div> }; })}/></section>}
+        {data?.attention.message && <p className="text-warn">{data.attention.message}</p>}{!eligible && <p className="dim fp-access-note">{!canCapacity ? 'Capacity details require global manage_aws access.' : me?.is_superuser !== true ? 'Capacity changes require a superuser account.' : !interactive ? 'Capacity changes require an interactive user session.' : capacity.data?.mode === 'external' ? 'Infrastructure is managed externally. Capacity is read-only.' : 'Capacity changes require an available managed inventory.'}</p>}{error && <p className="form-alert" role="alert">{error}</p>}
+    </section>;
+}

package/src/admin/fleet/ScaleFleetDialog.tsx

@@ -0,0 +1,169 @@
+import { useEffect, useMemo, useRef, useState, useSyncExternalStore } from 'react';
+import { decodeJwt, getAccessToken, getAuthSessionRevision, getAuthSnapshot, isReauthRequired, requestFreshAuth, subscribeAuth, useMe } from '../../client/runtime';
+import { backendGlobalCan } from './access';
+import { Tabs } from '../../ui/Tabs';
+import { datetime } from '../../ui/format';
+import { OperationsHelp } from '../core/OperationsHelp';
+import { readCapacity, requestCapacityPlan } from './api';
+import { actionReason, compileFleetSteps, drainedNodeReason, monthlyPrice, newFleetDraft, nodeRemovalReason, offered, type FleetDraft } from './data';
+import { fleetOperations, fleetSessionScope } from './operations';
+import type { CapacityPlan, CapacityReport, CapacitySize } from './types';
+export interface ScaleFleetDialogProps {
+    scope: string;
+    initialReport: CapacityReport;
+    close: () => void;
+    onRefresh?: () => void;
+    debounceMs?: number;
+}
+function SizeChoice({ label, value, onChange, sizes, disabled }: {
+    label: string;
+    value: string;
+    onChange: (v: string) => void;
+    sizes: CapacitySize[];
+    disabled?: boolean;
+}) {
+    return <label className="field"><span className="field-label">{label}</span><select className="input" value={value} disabled={disabled} onChange={e => onChange(e.target.value)}><option value="">Keep current sizes</option>{sizes.map(s => <option key={s.size} value={s.size}>{s.label} · {s.monthly_usd == null ? 'price unknown' : `$${s.monthly_usd.toFixed(2)}/mo`}</option>)}</select></label>;
+}
+export function ScaleFleetDialog({ scope, initialReport, close, onRefresh, debounceMs = 400 }: ScaleFleetDialogProps) {
+    const { data: me } = useMe();
+    const [report, setReport] = useState(initialReport), [draft, setDraft] = useState(() => newFleetDraft(initialReport)), [plan, setPlan] = useState<CapacityPlan | null>(null), [consent, setConsent] = useState<string | null>(null), [error, setError] = useState(''), [planning, setPlanning] = useState(false), [refreshing, setRefreshing] = useState(false), [needsRefresh, setNeedsRefresh] = useState(false), [batchInput, setBatchInput] = useState(''), [tick, setTick] = useState(Date.now());
+    const generation = useRef(0), alive = useRef(true), planBusy = useRef(false), applyBusy = useRef(false), readGeneration = useRef(0), readBusy = useRef(false), planAbort = useRef<AbortController | null>(null);
+    const operation = useSyncExternalStore(fn => fleetOperations.subscribe(scope, fn), () => fleetOperations.get(scope), () => fleetOperations.get(scope));
+    const blocked = ['submitting', 'running', 'unknown'].includes(operation.status);
+    const invalidate = () => { generation.current++; planAbort.current?.abort(); setPlan(null); setConsent(null); setPlanning(false); setError(''); };
+    const edit = (change: (d: FleetDraft) => FleetDraft) => { invalidate(); setDraft(change); };
+    const authorized = () => { const jwt = decodeJwt(getAccessToken()); if (!jwt || ['api_key', 'group_scoped_token'].includes(String(jwt.credential_kind ?? '')))
+        throw new Error('Scaling requires an interactive user session.'); if (fleetSessionScope() !== scope || !backendGlobalCan(me, 'manage_aws') || me?.is_superuser !== true || report.mode !== 'managed')
+        throw new Error('Capacity authority changed. Refresh and review again.'); };
+    const refresh = async () => { if (readBusy.current)
+        return; readBusy.current = true; invalidate(); setRefreshing(true); setNeedsRefresh(true); const gen = ++readGeneration.current; try {
+        authorized();
+        const next = await readCapacity(true, { beforeSend: authorized });
+        if (!alive.current || gen !== readGeneration.current || fleetSessionScope() !== scope)
+            return;
+        setReport(next);
+        setDraft(newFleetDraft(next));
+        setNeedsRefresh(false);
+        onRefresh?.();
+    }
+    catch (e) {
+        if (alive.current && fleetSessionScope() === scope)
+            setError(e instanceof Error ? e.message : 'Inventory observation unavailable.');
+    }
+    finally {
+        readBusy.current = false;
+        if (alive.current)
+            setRefreshing(false);
+    } };
+    useEffect(() => { alive.current = true; const startRevision = getAuthSessionRevision(); const unsubscribe = subscribeAuth(() => { if (!getAuthSnapshot().authenticated || getAuthSessionRevision() !== startRevision || fleetSessionScope() !== scope) {
+        generation.current++;
+        readGeneration.current++;
+        planAbort.current?.abort();
+        close();
+    } }); return () => { alive.current = false; generation.current++; readGeneration.current++; planAbort.current?.abort(); unsubscribe(); }; }, [scope, close]);
+    useEffect(() => { const timer = setTimeout(() => void refresh(), 0); return () => clearTimeout(timer); }, []);
+    useEffect(() => { if (operation.status === 'done' || operation.status === 'failed')
+        void refresh(); }, [operation.status]);
+    useEffect(() => { const timer = setInterval(() => setTick(Date.now()), 1000); return () => clearInterval(timer); }, []);
+    useEffect(() => { if (!backendGlobalCan(me, 'manage_aws') || me?.is_superuser !== true) {
+        invalidate();
+        close();
+    } }, [me, close]);
+    const compiled = useMemo(() => { try {
+        return { steps: compileFleetSteps(report, draft), error: '' };
+    }
+    catch (e) {
+        return { steps: [], error: e instanceof Error ? e.message : 'Invalid capacity proposal.' };
+    } }, [report, draft]);
+    useEffect(() => {
+        if (!compiled.steps.length || compiled.error || needsRefresh || refreshing || blocked)
+            return;
+        const gen = ++generation.current;
+        let timer: ReturnType<typeof setTimeout> | null = null, disposed = false;
+        const run = async () => {
+            if (disposed || gen !== generation.current)
+                return;
+            if (planBusy.current) {
+                timer = setTimeout(() => void run(), 50);
+                return;
+            }
+            planBusy.current = true;
+            setPlanning(true);
+            const abort = new AbortController();
+            planAbort.current = abort;
+            try {
+                authorized();
+                const next = await requestCapacityPlan(compiled.steps, { signal: abort.signal, beforeSend: () => { authorized(); if (disposed || gen !== generation.current)
+                        throw new Error('Proposal changed.'); } });
+                if (!alive.current || disposed || gen !== generation.current || fleetSessionScope() !== scope)
+                    return;
+                if (next.actor !== me?.id)
+                    throw new Error('Plan actor does not match your account.');
+                setPlan(next);
+                setConsent(null);
+                setError('');
+            }
+            catch (e) {
+                if (!alive.current || disposed || gen !== generation.current)
+                    return;
+                setPlan(null);
+                setConsent(null);
+                setNeedsRefresh(true);
+                setError(isReauthRequired(e) ? 'Authenticate again, refresh inventory, and review a new plan.' : e instanceof Error ? e.message : 'The plan could not be prepared.');
+                if (isReauthRequired(e))
+                    await requestFreshAuth();
+            }
+            finally {
+                planBusy.current = false;
+                if (alive.current && !disposed)
+                    setPlanning(false);
+            }
+        };
+        timer = setTimeout(() => void run(), debounceMs);
+        return () => { disposed = true; if (timer)
+            clearTimeout(timer); planAbort.current?.abort(); };
+    }, [compiled, needsRefresh, refreshing, blocked, scope, debounceMs, me]);
+    const apply = async () => { if (applyBusy.current || !plan || consent !== plan.id || blocked || needsRefresh || refreshing || Date.parse(plan.expires_at) <= Date.now())
+        return; applyBusy.current = true; const reviewed = plan; setConsent(null); generation.current++; setError(''); try {
+        authorized();
+        if (reviewed.actor !== me?.id)
+            throw new Error('Plan actor changed.');
+        await fleetOperations.submit(scope, reviewed);
+    }
+    catch (e) {
+        if (alive.current && fleetSessionScope() === scope)
+            setError(e instanceof Error ? e.message : 'Apply was refused.');
+    }
+    finally {
+        applyBusy.current = false;
+        if (alive.current && fleetSessionScope() === scope) {
+            setPlan(null);
+            setNeedsRefresh(true);
+            void refresh();
+        }
+        onRefresh?.();
+    } };
+    const expired = plan ? Date.parse(plan.expires_at) <= tick : false;
+    const setDb = (id: string, patch: Partial<FleetDraft['databases'][string]>) => edit(d => ({ ...d, databases: { ...d.databases, [id]: { ...d.databases[id]!, ...patch } } }));
+    const setCache = (id: string, patch: Partial<FleetDraft['caches'][string]>) => edit(d => ({ ...d, caches: { ...d.caches, [id]: { ...d.caches[id]!, ...patch } } }));
+    const toggle = (key: 'removeNodes' | 'terminateNodes', id: string) => edit(d => ({ ...d, [key]: d[key].includes(id) ? d[key].filter(v => v !== id) : [...d[key], id] }));
+    const sources = report.nodes.instances.filter(n => n.healthy && n.registered && n.instance_state === 'running');
+    return <div className="modal-pad fleet-scale"><h2 className="modal-title">Scale fleet</h2><p className="modal-message">Choose capacity, then review cost and interruptions before applying.</p><div className="fleet-scale-body">
+        <div className="fleet-buttons"><p className="dim">Inventory checked {datetime(report.generated_at)}</p><button className="btn" disabled={refreshing || operation.status === 'submitting'} onClick={() => void refresh()}>{refreshing ? 'Refreshing…' : 'Refresh inventory'}</button></div>
+        {blocked && <section className="panel panel-pad" aria-label="Capacity progress"><h3>{operation.status === 'unknown' ? 'Progress unknown' : 'Capacity change in progress'}</h3><p role="status">{operation.message}</p><p>Plan: {operation.planId}<br />Batch: {operation.batchId ?? 'Not acknowledged'}</p>{operation.batch?.steps.map(s => <div className="fleet-progress-step" key={s.index}><strong>{s.index + 1}. {s.description} · {s.state}</strong><p>{s.phase}{s.message ? ` · ${s.message}` : ''}{s.error_code ? ` · ${s.error_code}` : ''}</p>{s.operation && <small>Operation {s.operation}</small>}</div>)}{operation.status === 'unknown' && !operation.batchId && <label className="field"><span className="field-label">Batch ID from server logs for this plan</span><input className="input" value={batchInput} onChange={e => setBatchInput(e.target.value)}/><span className="field-help">Inspect capacity batch logs and AWS state. Only a matching batch’s terminal evidence resolves this block; refreshing inventory or closing this dialog does not.</span></label>}<button className="btn" disabled={operation.status === 'submitting' || (!operation.batchId && !batchInput.trim())} onClick={() => void fleetOperations.observe(scope, batchInput)}>Refresh observation</button></section>}
+        {!blocked && operation.status !== 'idle' && <section className="panel panel-pad" role="status"><h3>{operation.status === 'done' ? 'Batch completed' : 'Batch failed'}</h3><p>{operation.message}</p>{operation.status === 'failed' && <p>Completed steps remain applied. Nothing rolled back; refresh the actual inventory before planning recovery.</p>}{operation.batch?.steps.map(s => <p key={s.index}>{s.description} · {s.state}{s.error_code ? ` · ${s.error_code}` : ''}{s.operation ? ` · operation ${s.operation}` : ''}</p>)}</section>}
+        <fieldset disabled={blocked || refreshing || needsRefresh}><Tabs ariaLabel="Capacity type" items={[{ key: 'nodes', label: 'App nodes', panel: <div className="fleet-capacity-tab"><h3>App nodes <OperationsHelp label="app nodes">Node size is inherited from the source. Removal drains before terminating. At least one currently healthy target must remain.</OperationsHelp></h3>
+            <div className="fleet-scale-fields"><label className="field"><span className="field-label">Add app nodes</span><input className="input" type="number" min={0} max={20} step={1} value={draft.addNodes} disabled={!offered(report, 'add_node')} onChange={e => edit(d => ({ ...d, addNodes: Number(e.target.value) }))}/>{!offered(report, 'add_node') && <span className="field-help">{actionReason(report, 'add_node')}</span>}</label>
+            </div><details className="fleet-scale-disclosure"><summary>Advanced node placement</summary><div className="fleet-scale-fields"><label className="field"><span className="field-label">Clone source (optional)</span><select className="input" value={draft.source} onChange={e => edit(d => ({ ...d, source: e.target.value }))}><option value="">Automatic healthy source</option>{sources.map(n => <option key={n.id} value={n.id}>{n.name} · {n.instance_type} · {n.zone}</option>)}</select></label>
+            <label className="field"><span className="field-label">Subnet (optional)</span><input className="input" list="fleet-subnets" value={draft.subnet} placeholder={sources.find(n => n.id === draft.source)?.subnet_id ?? 'subnet-…'} onChange={e => edit(d => ({ ...d, subnet: e.target.value }))}/><datalist id="fleet-subnets">{[...new Set(sources.filter(n => !draft.source || n.zone === sources.find(s => s.id === draft.source)?.zone).map(n => n.subnet_id).filter(Boolean))].map(id => <option key={id} value={id!}/>)}</datalist><span className="field-help">AWS verifies VPC, same availability zone and address suitability. Empty fields are omitted.</span></label></div></details>
+            <details className="fleet-scale-disclosure"><summary>Remove nodes</summary>
+            {report.nodes.self_check !== 'matched' && <p className="text-warn">This serving node cannot identify itself. Node removal is unavailable until a fresh report identifies it.</p>}{report.nodes.instances.map(n => { const selected = draft.removeNodes.includes(n.id), reason = nodeRemovalReason(report, n, draft.removeNodes.filter(id => id !== n.id)); const recovery = drainedNodeReason(report, n); return <div key={n.id} className="fleet-node"><div><b>{n.name}</b><small>{n.id} · {n.instance_type ?? 'size unknown'} · {n.state} / {n.lifecycle_state}{n.self ? ' · serving this request' : ''}</small><small>{reason}</small></div>{!n.registered ? <label><input type="checkbox" checked={draft.terminateNodes.includes(n.id)} disabled={!!recovery} onChange={() => toggle('terminateNodes', n.id)}/> Terminate drained node<small>{recovery ?? 'Drain completed; server will re-prove ownership and drain before termination.'}</small></label> : <label><input type="checkbox" checked={selected} disabled={!!reason && !selected} onChange={() => toggle('removeNodes', n.id)}/> Remove node</label>}</div>; })}
+            </details></div> }, { key: 'database', label: 'Database', panel: <div className="fleet-capacity-tab"><h3>Database capacity</h3>{!report.databases_available && <p>Database inventory unavailable.</p>}{report.databases.map(row => { const d = draft.databases[row.identifier]!; const writer = row.kind === 'aurora' ? row.writer : row.identifier; return <section key={row.identifier} className="panel panel-pad"><h4>{row.identifier}</h4><p>{row.engine} · {row.status}{row.blocked_reason ? ` · ${row.blocked_reason}` : ''}</p><div className="fleet-scale-fields"><label className="field"><span className="field-label">Reader count for {row.identifier}</span><input className="input" type="number" min={0} max={20} step={1} value={d.readers} disabled={!!row.blocked_reason || (!offered(report, 'add_reader') && !offered(report, 'remove_reader'))} onChange={e => setDb(row.identifier, { readers: Number(e.target.value) })}/></label><SizeChoice label={`Writer size for ${row.identifier}`} value={d.writerSize} sizes={report.sizes.database} disabled={!!row.blocked_reason || !offered(report, 'resize_database') || !row.members.find(m => m.id === writer)?.can_resize} onChange={writerSize => setDb(row.identifier, { writerSize })}/><SizeChoice label={`Existing-reader size for ${row.identifier}`} value={d.readerSize} sizes={report.sizes.database} disabled={!!row.blocked_reason || !row.readers.length || !offered(report, 'resize_database') || row.members.some(m => row.readers.includes(m.id) && !m.can_resize)} onChange={readerSize => setDb(row.identifier, { readerSize })}/></div><details className="ops-details"><summary>Size and routing details</summary><p className="dim">Writer {writer ?? 'unknown'} · {row.writer_instance_class ?? row.instance_class ?? 'class unknown'}. Resizing the writer causes minutes offline. Existing-reader sizing changes each surviving reader independently; other readers and the writer keep serving.</p><p className="dim">New readers inherit the current writer/source class ({row.writer_instance_class ?? row.instance_class ?? 'unknown'}), even when the writer resizes in this plan. After creation, refresh their concrete IDs and review a separate resize.</p>{row.members.map(m => <small className="fleet-member" key={m.id}>{m.id} · {m.role} · {m.instance_class} · {m.status ?? 'status unknown'} / {m.lifecycle_state}</small>)}</details></section>; })}
+            </div> }, { key: 'redis', label: 'Redis', panel: <div className="fleet-capacity-tab"><h3>Redis capacity</h3>{!report.caches_available && <p>Redis inventory unavailable.</p>}{report.caches.map(row => { const d = draft.caches[row.identifier]!; return <section className="panel panel-pad" key={row.identifier}><h4>{row.identifier}</h4><p>{row.node_type} · {row.status}{row.blocked_reason ? ` · ${row.blocked_reason}` : ''}</p><div className="fleet-scale-fields"><label className="field"><span className="field-label">Replicas for {row.identifier}</span><input className="input" type="number" min={row.min_replicas} max={100} step={1} value={d.replicas} disabled={!!row.blocked_reason || !offered(report, 'set_cache_replicas')} onChange={e => setCache(row.identifier, { replicas: Number(e.target.value) })}/><span className="field-help">Server minimum: {row.min_replicas}. Replicas provide failover capacity; routing is a separate process setting.</span></label><SizeChoice label={`Group size for ${row.identifier}`} value={d.size} sizes={report.sizes.cache} disabled={!!row.blocked_reason || !offered(report, 'resize_cache')} onChange={size => setCache(row.identifier, { size })}/></div><p className="text-warn">{row.resize_impact === 'rolling' ? 'Rolling resize: replicas change first, followed by a brief primary failover interruption.' : 'Downtime resize: Redis is unavailable while its node is replaced.'} Size applies to the entire group. Downsizing risks eviction when the working set no longer fits.</p></section>; })}
+            </div> }]} />
+        </fieldset>
+        {compiled.error && <p className="form-alert" role="alert">{compiled.error}</p>}{error && <p className="form-alert" role="alert">{error}</p>}{needsRefresh && !blocked && <p className="text-warn">Refresh inventory before staging or reviewing another plan.</p>}
+        {planning && !blocked && <p role="status">Preparing the server plan…</p>}{!compiled.steps.length && !blocked && !compiled.error && <p className="dim">Choose a change to prepare a server plan.</p>}
+        {plan && !blocked && <section className="panel panel-pad" aria-label="Review capacity plan"><h3>Review server plan · {plan.steps.length} steps</h3><p className="text-warn">Creates billable resources. Removals cannot be undone; completed steps remain applied if a later step fails.</p><p>{plan.order_note}</p><ol className="fleet-plan-steps">{plan.steps.map(s => <li key={s.index}><strong>{s.description}</strong><p>{monthlyPrice(s.monthly_delta_usd)}</p>{s.warnings.map((w, i) => <p className="text-warn" key={i}>{w}</p>)}</li>)}</ol><p><b>{plan.estimate_complete ? 'Estimated monthly change' : 'Partial monthly estimate'}: {monthlyPrice(plan.total_monthly_delta_usd)}</b>{!plan.estimate_complete && ' · some prices are unknown'}</p><p className="dim">Plan {plan.id} · expires {datetime(plan.expires_at)}</p>{expired ? <p className="text-warn">This plan expired. Refresh inventory to prepare another review.</p> : <label><input type="checkbox" checked={consent === plan.id} onChange={e => setConsent(e.target.checked ? plan.id : null)}/> I reviewed this exact plan, its cost and interruptions, and understand removals cannot be undone.</label>}</section>}
+    </div><div className="modal-actions"><button className="btn" disabled={operation.status === 'submitting'} onClick={close}>{blocked ? 'Close progress' : 'Cancel'}</button><button className="btn btn-primary" disabled={!plan || consent !== plan.id || expired || blocked || refreshing || needsRefresh || planning} onClick={() => void apply()}>Apply reviewed plan</button></div></div>;
+}

package/src/admin/fleet/access.ts

@@ -0,0 +1,22 @@
+/** Exact global User.has_permission implication rule (django-mojo helpers/perms.py). */
+export interface BackendGlobalUser { is_superuser?: boolean; permissions?: Record<string, unknown> | null }
+const categories = new Set(['users', 'groups', 'security', 'comms', 'jobs', 'metrics', 'files']);
+export const FLEET_DASHBOARD_GRANTS = ['view_admin', 'manage_users', 'manage_settings', 'admin'] as const;
+export const FLEET_CAPACITY_GRANTS = ['manage_aws'] as const;
+export function backendGlobalCan(user: BackendGlobalUser | null | undefined, grants: string | readonly string[]): boolean {
+    if (!user) return false;
+    if (user.is_superuser === true) return true;
+    // Python bool(JSON value), including false for empty containers.
+    const granted = (key: string) => {
+        if (!user.permissions || !Object.hasOwn(user.permissions, key)) return false;
+        const value = user.permissions[key];
+        if (Array.isArray(value)) return value.length > 0;
+        if (value && typeof value === 'object') return Object.keys(value).length > 0;
+        return Boolean(value);
+    };
+    return (typeof grants === 'string' ? [grants] : grants).some((key) => {
+        if (granted(key)) return true;
+        const match = /^(?:view_|manage_)(.+)$/.exec(key);
+        return !!match && categories.has(match[1]!) && granted(match[1]!);
+    });
+}

package/src/admin/fleet/api.ts

@@ -0,0 +1,77 @@
+import { mojoCall, type FetchOpts } from '../../client/runtime';
+import type { FleetDashboard, CapacityReport, CapacityPlan, CapacityBatch, CapacityAction, FleetFacts } from './types';
+export const FLEET_DASHBOARD_ENDPOINT = '/api/account/admin/dashboard';
+export const CAPACITY_ENDPOINT = '/api/aws/capacity';
+const actions = new Set(['add_node', 'drain_node', 'terminate_node', 'add_reader', 'remove_reader', 'set_cache_replicas', 'resize_cache', 'resize_database']);
+export function object(value: unknown): FleetFacts { if (!value || typeof value !== 'object' || Array.isArray(value))
+    throw new Error('Fleet response is not an object.'); return value as FleetFacts; }
+const text = (v: unknown): string => { if (typeof v !== 'string' || !v.trim())
+    throw new Error('Fleet response is missing required text.'); return v; };
+const nullable = (v: unknown): string | null => typeof v === 'string' ? v : null;
+const bool = (v: unknown) => v === true;
+const number = (v: unknown): number => { if (typeof v !== 'number' || !Number.isFinite(v) || v < 0)
+    throw new Error('Fleet response has an invalid number.'); return v; };
+const price = (v: unknown): number | null => v === null ? null : typeof v === 'number' && Number.isFinite(v) ? v : (() => { throw new Error('Fleet response has an invalid price.'); })();
+const array = (v: unknown): unknown[] => { if (!Array.isArray(v))
+    throw new Error('Fleet response is missing a list.'); return v; };
+const strings = (v: unknown) => array(v).map(text);
+function schema(v: unknown): FleetFacts { const o = object(v); if (o.schema_version !== 2)
+    throw new Error('This fleet API requires schema version 2. Upgrade the backend and refresh.'); return o; }
+function action(v: unknown): CapacityAction { const a = text(v); if (!actions.has(a))
+    throw new Error('Fleet response contains an unsupported action.'); return a as CapacityAction; }
+const dashboardFields: Record<string, readonly string[]> = { load_balancer: ['configured', 'registered', 'healthy', 'balancer', 'elastic_ip_missing'], compute: ['total', 'up', 'source', 'instances'], database: ['reachable', 'vendor', 'engine', 'version', 'drift'], cache: ['reachable', 'engine', 'version', 'memory_used'], certificates: ['total', 'active', 'failing', 'expiring_within_30_days', 'soonest_renew', 'soonest_expiry'], public_api: ['configured', 'node_version', 'probe'], framework: ['installed', 'latest', 'update_available', 'pin'], last_deployment: ['items'], jobs: ['scheduler_active', 'jobs', 'failed_recent'], sanity: ['checks'], incidents: ['open', 'oldest_created', 'oldest_age_days'], tickets: ['open', 'oldest_created', 'oldest_age_days'], sms: ['configured', 'provider', 'test_mode', 'verified'], email: ['configured', 'domains', 'sendable_domains', 'default_sender', 'problems'] };
+const nestedFields = new Set(['name', 'type', 'scheme', 'state', 'elastic_ips', 'addresses', 'ip', 'address', 'zone', 'id', 'healthy', 'available_major', 'deadline', 'note', 'ok', 'status', 'http_status', 'version', 'mode', 'sha', 'created', 'finished', 'actor', 'pending', 'running', 'failed', 'checked_at', 'message']);
+function projectFacts(raw: FleetFacts, fields: readonly string[]): FleetFacts {
+    const safe = (v: unknown, depth: number): unknown => { if (v == null || typeof v === 'string' || typeof v === 'boolean' || typeof v === 'number' && Number.isFinite(v))
+        return v; if (depth > 4)
+        return null; if (Array.isArray(v))
+        return v.slice(0, 200).map(x => safe(x, depth + 1)); if (v && typeof v === 'object')
+        return Object.fromEntries(Object.entries(v).filter(([k]) => nestedFields.has(k)).map(([k, x]) => [k, safe(x, depth + 1)])); return null; };
+    return Object.fromEntries(Object.entries(raw).filter(([key]) => fields.includes(key)).map(([key, value]) => [key, safe(value, 0)]));
+}
+export function parseFleetDashboard(v: unknown): FleetDashboard {
+    const o = schema(v), availability = object(o.availability), sources = { ...object(o.sources) };
+    for (const name of Object.keys(dashboardFields))
+        if (!Object.hasOwn(sources, name))
+            sources[name] = { status: 'unknown', observed_at: null, stale_after: null, reason: 'source_missing', data: {} };
+    if (!['ok', 'down', 'unknown'].includes(String(availability.state)))
+        throw new Error('Fleet availability is unknown to this client.');
+    return { schema_version: 2, observed_at: text(o.observed_at), availability: { state: availability.state as 'ok' | 'down' | 'unknown', message: text(availability.message), down: strings(availability.down) }, attention: { message: nullable(object(o.attention).message) }, sources: Object.fromEntries(Object.entries(sources).map(([key, value]) => { const row = object(value); return [key, { status: text(row.status), observed_at: nullable(row.observed_at), stale_after: nullable(row.stale_after), reason: nullable(row.reason), data: projectFacts(object(row.data), dashboardFields[key] ?? []) }]; })) };
+}
+export function parseCapacity(v: unknown): CapacityReport {
+    const o = schema(v), n = object(o.nodes), sizes = object(o.sizes), e = object(o.egress), routing = object(o.reader_routing), dbRouting = object(routing.database), cacheRouting = object(routing.redis);
+    const ladder = (v: unknown) => array(v).map(value => { const r = object(value); return { size: text(r.size), label: text(r.label), type: text(r.type), monthly_usd: price(r.monthly_usd) }; });
+    const addresses = (v: unknown) => array(v).map(value => { const r = object(value); return { instance: text(r.instance), public_ip: text(r.public_ip), managed: bool(r.managed) }; });
+    return { schema_version: 2, mode: text(o.mode), region: text(o.region), generated_at: text(o.generated_at), identity_available: bool(o.identity_available), identity: o.identity == null ? null : { project: text(object(o.identity).project), environment: text(object(o.identity).environment) }, node_id_pinned: bool(o.node_id_pinned),
+        nodes: { self: nullable(n.self), self_check: text(n.self_check), serving_available: bool(n.serving_available), inventory_available: bool(n.inventory_available), instances: array(n.instances).map(value => { const r = object(value); return { id: text(r.id), name: text(r.name), state: text(r.state), instance_state: nullable(r.instance_state), lifecycle_state: text(r.lifecycle_state), instance_type: nullable(r.instance_type), zone: nullable(r.zone), subnet_id: nullable(r.subnet_id), public_ip: nullable(r.public_ip), healthy: bool(r.healthy), registered: bool(r.registered), can_drain: bool(r.can_drain), self: bool(r.self), primary: bool(r.primary), added_by_capacity: bool(r.added_by_capacity), stable_ip: bool(r.stable_ip), groups: strings(r.groups) }; }) },
+        databases_available: bool(o.databases_available), caches_available: bool(o.caches_available),
+        databases: array(o.databases).map(value => { const r = object(value); if (!['aurora', 'standalone'].includes(String(r.kind)))
+            throw new Error('Unsupported database kind.'); return { identifier: text(r.identifier), kind: r.kind as 'aurora' | 'standalone', engine: text(r.engine), status: text(r.status), writer: nullable(r.writer), readers: strings(r.readers), instance_class: nullable(r.instance_class), writer_instance_class: nullable(r.writer_instance_class), reader_instance_classes: Object.fromEntries(Object.entries(object(r.reader_instance_classes)).map(([k, v]) => [k, v === null ? null : text(v)])), blocked_reason: nullable(r.blocked_reason), members: array(r.members).map(value => { const m = object(value); return { id: text(m.id), role: text(m.role), status: m.status === null ? null : text(m.status), lifecycle_state: text(m.lifecycle_state), instance_class: nullable(m.instance_class), can_resize: bool(m.can_resize), can_remove: bool(m.can_remove) }; }) }; }),
+        caches: array(o.caches).map(value => { const r = object(value); if (!['rolling', 'downtime'].includes(String(r.resize_impact)))
+            throw new Error('Cache resize impact is unavailable.'); return { identifier: text(r.identifier), status: text(r.status), node_type: text(r.node_type), replica_count: number(r.replica_count), min_replicas: number(r.min_replicas), resize_impact: r.resize_impact as 'rolling' | 'downtime', blocked_reason: nullable(r.blocked_reason), members: array(r.members).map(value => { const m = object(value); return { id: text(m.id), role: text(m.role), status: text(m.status), lifecycle_state: text(m.lifecycle_state) }; }) }; }),
+        sizes: { database: ladder(sizes.database), cache: ladder(sizes.cache) }, actions: Object.fromEntries(Object.entries(object(o.actions)).map(([key, value]) => { const r = object(value); return [key, { offered: bool(r.offered), blocked_reason: nullable(r.blocked_reason) }]; })), warnings: array(o.warnings).map(value => { const r = object(value); return { code: text(r.code), message: text(r.message), iam_action: nullable(r.iam_action) }; }),
+        reader_routing: { database: { active: bool(dbRouting.active), host: nullable(dbRouting.host), skip_reason: nullable(dbRouting.skip_reason), matches_reader_endpoint: typeof dbRouting.matches_reader_endpoint === 'boolean' ? dbRouting.matches_reader_endpoint : null }, redis: { active: bool(cacheRouting.active) } },
+        egress: { available: bool(e.available), fleet_available: bool(e.fleet_available), addresses_available: bool(e.addresses_available), policy_available: bool(e.policy_available), enabled: bool(e.enabled), addresses: strings(e.addresses), attached: addresses(e.attached), fallback_attached: addresses(e.fallback_attached), reserved: array(e.reserved).map(value => ({ public_ip: text(object(value).public_ip) })), pending_nodes: strings(e.pending_nodes) } };
+}
+export function parseCapacityPlan(v: unknown): CapacityPlan {
+    const o = schema(v);
+    const expires_at = text(o.expires_at);
+    if (!Number.isFinite(Date.parse(expires_at)))
+        throw new Error('Plan expiry is unavailable.');
+    const steps = array(o.steps).map(value => { const r = object(value); return { index: number(r.index), action: action(r.action), resource: typeof r.resource === 'string' ? r.resource : '', description: text(r.description), kind: text(r.kind), params: object(r.params), warnings: strings(r.warnings), monthly_delta_usd: price(r.monthly_delta_usd) }; });
+    if (!steps.length || steps.length > 20)
+        throw new Error('Plan exceeds the supported 20 steps.');
+    return { schema_version: 2, id: text(o.id), actor: number(o.actor), created: typeof o.created === 'number' ? o.created : text(o.created), expires_at, expires_in: number(o.expires_in), steps, total_monthly_delta_usd: price(o.total_monthly_delta_usd), estimate_complete: bool(o.estimate_complete), order_note: text(o.order_note) };
+}
+export function parseCapacityBatch(v: unknown): CapacityBatch {
+    const o = schema(v);
+    const steps = array(o.steps).map(value => { const r = object(value); return { index: number(r.index), action: action(r.action), resource: typeof r.resource === 'string' ? r.resource : '', description: text(r.description), state: text(r.state), operation: nullable(r.operation), phase: nullable(r.phase), message: nullable(r.message), error_code: nullable(r.error_code) }; });
+    if (!steps.length || steps.length > 20)
+        throw new Error('Batch step count is invalid.');
+    return { schema_version: 2, id: text(o.id), plan_id: text(o.plan_id), actor: number(o.actor), state: text(o.state), started: typeof o.started === 'number' ? o.started : text(o.started), current_index: number(o.current_index), message: nullable(o.message), error_code: nullable(o.error_code), stalled: bool(o.stalled), steps };
+}
+export async function readFleetDashboard(refresh = false, opts: FetchOpts = {}) { return parseFleetDashboard((await mojoCall(FLEET_DASHBOARD_ENDPOINT, { ...opts, params: { refresh: refresh ? 1 : undefined } })).data); }
+export async function readCapacity(refresh = false, opts: FetchOpts = {}) { return parseCapacity((await mojoCall(CAPACITY_ENDPOINT, { ...opts, params: { refresh: refresh ? 1 : undefined } })).data); }
+export async function requestCapacityPlan(steps: unknown[], opts: FetchOpts = {}) { return parseCapacityPlan((await mojoCall(`${CAPACITY_ENDPOINT}/plan`, { ...opts, method: 'POST', body: { steps } })).data); }
+export async function applyCapacityPlan(planId: string, opts: FetchOpts = {}) { return parseCapacityBatch((await mojoCall(`${CAPACITY_ENDPOINT}/plan/apply`, { ...opts, method: 'POST', body: { plan_id: planId } })).data); }
+export async function readCapacityBatch(id: string, opts: FetchOpts = {}) { return parseCapacityBatch((await mojoCall(`${CAPACITY_ENDPOINT}/status`, { ...opts, params: { batch: id } })).data); }

package/src/admin/fleet/data.ts

@@ -0,0 +1,148 @@
+import type { CapacityAction, CapacityDatabase, CapacityNode, CapacityReport, CapacityStep } from './types';
+export interface FleetDraft {
+    addNodes: number;
+    source: string;
+    subnet: string;
+    removeNodes: string[];
+    terminateNodes: string[];
+    databases: Record<string, {
+        readers: number;
+        writerSize: string;
+        readerSize: string;
+    }>;
+    caches: Record<string, {
+        replicas: number;
+        size: string;
+    }>;
+}
+export function newFleetDraft(report: CapacityReport): FleetDraft { return { addNodes: 0, source: '', subnet: '', removeNodes: [], terminateNodes: [], databases: Object.fromEntries(report.databases.map(r => [r.identifier, { readers: r.readers.length, writerSize: '', readerSize: '' }])), caches: Object.fromEntries(report.caches.map(r => [r.identifier, { replicas: r.replica_count, size: '' }])) }; }
+export const offered = (r: CapacityReport, action: CapacityAction) => r.actions[action]?.offered === true;
+export const actionReason = (r: CapacityReport, action: CapacityAction) => r.actions[action]?.blocked_reason ?? 'Unavailable';
+export function nodeRemovalReason(report: CapacityReport, node: CapacityNode, selected: readonly string[] = []): string | null {
+    if (report.mode !== 'managed')
+        return 'Infrastructure is managed externally.';
+    if (!report.nodes.serving_available || !report.nodes.inventory_available)
+        return 'Node evidence is unavailable.';
+    if (report.nodes.self_check !== 'matched')
+        return 'The serving node could not identify itself. Refresh before removal.';
+    if (node.self || node.id === report.nodes.self)
+        return 'This node is answering your request.';
+    if (!offered(report, 'drain_node') || !offered(report, 'terminate_node'))
+        return actionReason(report, !offered(report, 'drain_node') ? 'drain_node' : 'terminate_node');
+    if (!node.can_drain)
+        return 'This node cannot currently be drained.';
+    const healthy = report.nodes.instances.filter(r => r.healthy);
+    if (node.healthy && healthy.filter(r => !selected.includes(r.id) && r.id !== node.id).length < 1)
+        return 'Keep at least one currently healthy target. New additions do not count yet.';
+    return null;
+}
+export function drainedNodeReason(report: CapacityReport, node: CapacityNode): string | null {
+    if (report.mode !== 'managed' || !offered(report, 'terminate_node'))
+        return actionReason(report, 'terminate_node');
+    if (!report.identity_available || !report.identity || !report.nodes.serving_available || !report.nodes.inventory_available)
+        return 'Fresh owned-node inventory is required.';
+    if (report.nodes.self_check !== 'matched' || node.self || node.id === report.nodes.self)
+        return 'The serving node must be identified and retained.';
+    if (node.registered || node.healthy || node.state !== 'unregistered' || node.lifecycle_state !== 'available' || node.instance_state !== 'running')
+        return 'Drain completion is not yet proved. Refresh and inspect.';
+    return null;
+}
+function integer(value: number, label: string, min = 0) { if (!Number.isSafeInteger(value) || value < min)
+    throw new Error(`${label} must be a whole number of at least ${min}.`); }
+export function databaseRemovals(row: CapacityDatabase, target: number): string[] {
+    integer(target, 'Reader count');
+    const needed = Math.max(0, row.readers.length - target);
+    const removable = row.members.filter(m => row.readers.includes(m.id) && m.can_remove).map(m => m.id).reverse();
+    if (removable.length < needed)
+        throw new Error(`${row.identifier}: a reader is still transitioning and cannot be removed.`);
+    return removable.slice(0, needed);
+}
+export function compileFleetSteps(report: CapacityReport, draft: FleetDraft): CapacityStep[] {
+    if (report.mode !== 'managed')
+        throw new Error('External infrastructure is read-only.');
+    const steps: CapacityStep[] = [];
+    const add = (step: CapacityStep) => { if (!offered(report, step.action))
+        throw new Error(`${step.action}: ${actionReason(report, step.action)}`); steps.push(step); };
+    integer(draft.addNodes, 'App additions');
+    if (draft.addNodes > 20)
+        throw new Error('A plan holds at most 20 steps.');
+    const source = draft.source.trim(), subnet = draft.subnet.trim();
+    if (draft.addNodes && subnet && !/^subnet-[A-Za-z0-9]+$/.test(subnet))
+        throw new Error('Subnet must be a subnet-… identifier.');
+    if (draft.addNodes && source && !report.nodes.instances.some(n => n.id === source && n.healthy && n.registered && n.instance_state === 'running'))
+        throw new Error('Choose a healthy serving source node.');
+    for (let i = 0; i < draft.addNodes; i++)
+        add({ action: 'add_node', ...(source ? { source_instance: source } : {}), ...(subnet ? { subnet_id: subnet } : {}) });
+    for (const id of draft.removeNodes) {
+        const node = report.nodes.instances.find(n => n.id === id);
+        if (!node)
+            throw new Error('Node inventory changed. Refresh.');
+        const reason = nodeRemovalReason(report, node, draft.removeNodes.filter(n => n !== id));
+        if (reason)
+            throw new Error(reason);
+        add({ action: 'drain_node', resource: id });
+        add({ action: 'terminate_node', resource: id });
+    }
+    for (const id of draft.terminateNodes) {
+        const node = report.nodes.instances.find(n => n.id === id);
+        if (!node)
+            throw new Error('Drained node is no longer in the inventory.');
+        const reason = drainedNodeReason(report, node);
+        if (reason)
+            throw new Error(reason);
+        add({ action: 'terminate_node', resource: id });
+    }
+    const resize = (resource: string, size: string, current: string | null, ladder: CapacityReport['sizes']['database'], action: 'resize_database' | 'resize_cache') => { if (!size)
+        return; const target = ladder.find(s => s.size === size); if (!target)
+        throw new Error('Choose a server-provided curated size.'); if (target.type !== current)
+        add({ action, resource, size, apply_immediately: true }); };
+    for (const row of report.databases) {
+        const d = draft.databases[row.identifier];
+        if (!d)
+            continue;
+        integer(d.readers, 'Reader count');
+        if (d.readers > 20)
+            throw new Error('A plan holds at most 20 steps.');
+        const changing = d.readers !== row.readers.length || !!d.writerSize || !!d.readerSize;
+        if (changing && (!report.databases_available || row.blocked_reason))
+            throw new Error(`${row.identifier}: ${row.blocked_reason ?? 'Database inventory unavailable'}`);
+        const removes = databaseRemovals(row, d.readers);
+        for (const id of removes)
+            add({ action: 'remove_reader', resource: id });
+        for (let i = row.readers.length; i < d.readers; i++)
+            add({ action: 'add_reader', resource: row.identifier });
+        const writer = row.kind === 'aurora' ? row.writer : row.identifier;
+        if (d.writerSize) {
+            if (!writer || !row.members.find(m => m.id === writer)?.can_resize)
+                throw new Error('Writer resizing is unavailable.');
+            resize(writer, d.writerSize, row.writer_instance_class ?? row.instance_class, report.sizes.database, 'resize_database');
+        }
+        if (d.readerSize) {
+            if (!row.readers.length)
+                throw new Error('Existing-reader sizing requires existing readers.');
+            for (const id of row.readers.filter(id => !removes.includes(id))) {
+                const member = row.members.find(m => m.id === id);
+                if (!member?.can_resize)
+                    throw new Error(`${id} cannot currently resize.`);
+                resize(id, d.readerSize, row.reader_instance_classes[id] ?? null, report.sizes.database, 'resize_database');
+            }
+        }
+    }
+    for (const row of report.caches) {
+        const d = draft.caches[row.identifier];
+        if (!d)
+            continue;
+        integer(d.replicas, 'Redis replica count', row.min_replicas);
+        if (d.replicas > 100)
+            throw new Error('Redis replica count exceeds the supported staging range.');
+        if ((d.replicas !== row.replica_count || d.size) && (!report.caches_available || row.blocked_reason))
+            throw new Error(`${row.identifier}: ${row.blocked_reason ?? 'Cache inventory unavailable'}`);
+        if (d.replicas !== row.replica_count)
+            add({ action: 'set_cache_replicas', resource: row.identifier, count: d.replicas, apply_immediately: true });
+        resize(row.identifier, d.size, row.node_type, report.sizes.cache, 'resize_cache');
+    }
+    if (steps.length > 20)
+        throw new Error(`A plan holds at most 20 steps; this proposal has ${steps.length}. Reduce the changes.`);
+    return steps;
+}
+export const monthlyPrice = (value: number | null) => value == null ? 'Price unknown' : `${value < 0 ? '−' : value > 0 ? '+' : ''}$${Math.abs(value).toFixed(2)}/month`;

package/src/admin/fleet/index.ts

@@ -0,0 +1,8 @@
+export * from './access';
+export * from './types';
+export * from './api';
+export * from './data';
+export * from './operations';
+export * from './FleetOverview';
+export * from './FleetPage';
+// The scale dialog is dynamically imported by FleetOverview to keep dashboard loading small.