feat(api): advance capability and secure operations slices

apps/api/src/control-plane.ts

@@ -1,6 +1,10 @@
 import type Database from 'better-sqlite3';
 import { registerOperationRoutes } from './interface/http/operation-routes.js';
 import { operationCatalogRegistry } from './application/operations/operation-catalog-data.js';
+import {
+  SecureOperationExecution,
+  secureOperationRegistry,
+} from './application/operations/secure-operation-execution.js';
 import type { FastifyInstance } from 'fastify';
 import { buildApp, type BuildAppOptions } from './app.js';
 import {
@@ -21,6 +25,7 @@ import { registerInstanceRoutes } from './interface/http/instance-routes.js';
 
 export interface SafeControlPlaneUpstream extends ConnectionTransport {
   request: UpstreamSessionClientOptions['request'];
+  postNetworkRegisterAuto(origin: string): Promise<{ readonly status: number }>;
 }
 export interface ControlPlaneOptions {
   readonly db: Database.Database;
@@ -54,11 +59,29 @@ export function buildControlPlaneApp(options: ControlPlaneOptions): ControlPlane
     ? new DeleteInstanceOperation({ db: options.db, instances, now: options.now })
     : new DeleteInstanceOperation({ db: options.db, instances });
   deletion.reconcileInterruptedJobs();
+  const secureExecution = new SecureOperationExecution({
+    db: options.db,
+    registry: secureOperationRegistry,
+    transport: {
+      request: async ({ origin }) => {
+        const response = await options.upstream.postNetworkRegisterAuto(origin);
+        return { status: response.status };
+      },
+    },
+    ...(options.now ? { now: options.now } : {}),
+  });
+  secureExecution.reconcileInterruptedJobs();
   const app = buildApp({
     ...options.app,
     registerRoutes: (app) => {
-      registerInstanceRoutes(app, { instances, connections, login, deletion });
-      registerOperationRoutes(app, operationCatalogRegistry);
+      registerInstanceRoutes(app, {
+        instances,
+        connections,
+        login,
+        deletion,
+        registerDeletionPreparationRoute: false,
+      });
+      registerOperationRoutes(app, operationCatalogRegistry, secureExecution, deletion);
     },
   });
   Object.assign(app, {