@agent-custody/receipts 0.5.9 → 0.6.1

package/dist/log-store.js

@@ -170,6 +170,8 @@ export class PostgresLog {
         return this.cache.subproof(oldSize, 0, n, true).map((b) => b.toString("hex"));
     }
 }
+export const PLANS = ["free", "team", "enterprise"];
+export const PLAN_QUOTAS = { free: 10_000, team: 1_000_000, enterprise: null };
 const sha256hex = (s) => createHash("sha256").update(s).digest("hex");
 /** Tenants and their tokens, in Postgres. Tokens are stored hashed; a lookup hashes what the caller presented. */
 export class PostgresTenancy {
@@ -178,10 +180,13 @@ export class PostgresTenancy {
     logs = new Map();
     tenantCache = new Map();
     tokenCache = new Map();
+    quotaCache = new Map();
+    quotas;
     ready = null;
     constructor(client, opts = {}) {
         this.client = client;
         this.prefix = ident(opts.prefix ?? "log_", "prefix");
+        this.quotas = { ...PLAN_QUOTAS, ...(opts.quotas ?? {}) };
     }
     init() {
         if (!this.ready) {
@@ -189,6 +194,7 @@ export class PostgresTenancy {
             this.ready = (async () => {
                 await PostgresLog.ensureSchema(this.client, p);
                 await this.client.query(`CREATE TABLE IF NOT EXISTS ${p}tenants (id TEXT PRIMARY KEY, log_id TEXT NOT NULL, created_at TIMESTAMPTZ NOT NULL DEFAULT now(), disabled_at TIMESTAMPTZ)`);
+                await this.client.query(`ALTER TABLE ${p}tenants ADD COLUMN IF NOT EXISTS plan TEXT NOT NULL DEFAULT 'free'`);
                 await this.client.query(`CREATE TABLE IF NOT EXISTS ${p}tokens (token_hash TEXT PRIMARY KEY, tenant_id TEXT NOT NULL REFERENCES ${p}tenants(id), label TEXT NOT NULL, created_at TIMESTAMPTZ NOT NULL DEFAULT now(), revoked_at TIMESTAMPTZ)`);
                 await this.client.query(`CREATE TABLE IF NOT EXISTS ${p}audit (id BIGSERIAL PRIMARY KEY, at TIMESTAMPTZ NOT NULL DEFAULT now(), actor TEXT NOT NULL, action TEXT NOT NULL, tenant_id TEXT, detail JSONB NOT NULL DEFAULT '{}')`);
             })();
@@ -208,7 +214,7 @@ export class PostgresTenancy {
         return rows.map((r) => ({ id: Number(r.id), at: new Date(r.at).toISOString(), actor: String(r.actor), action: r.action, tenantId: r.tenant_id === null || r.tenant_id === undefined ? null : String(r.tenant_id), detail: (typeof r.detail === "string" ? JSON.parse(r.detail) : r.detail) }));
     }
     row(r) {
-        return { id: String(r.id), logId: String(r.log_id), createdAt: new Date(r.created_at).toISOString(), disabledAt: r.disabled_at ? new Date(r.disabled_at).toISOString() : null };
+        return { id: String(r.id), logId: String(r.log_id), plan: PLANS.includes(String(r.plan)) ? String(r.plan) : "free", createdAt: new Date(r.created_at).toISOString(), disabledAt: r.disabled_at ? new Date(r.disabled_at).toISOString() : null };
     }
     /** The tenant, or null. Answers from a ten-second cache, so a disabled tenant is refused within that. */
     async tenant(id) {
@@ -216,7 +222,7 @@ export class PostgresTenancy {
         const hit = this.tenantCache.get(id);
         if (hit && Date.now() - hit.at < 10_000)
             return hit.tenant;
-        const rows = (await this.client.query(`SELECT id, log_id, created_at, disabled_at FROM ${this.prefix}tenants WHERE id = $1`, [id])).rows;
+        const rows = (await this.client.query(`SELECT id, log_id, plan, created_at, disabled_at FROM ${this.prefix}tenants WHERE id = $1`, [id])).rows;
         const tenant = rows[0] ? this.row(rows[0]) : null;
         this.tenantCache.set(id, { at: Date.now(), tenant });
         return tenant;
@@ -251,11 +257,47 @@ export class PostgresTenancy {
         if (!/^[A-Za-z0-9_.-]+$/.test(id))
             throw new Error(`tenant id must be a plain identifier; got "${id}"`);
         await this.init();
-        const rows = (await this.client.query(`INSERT INTO ${this.prefix}tenants (id, log_id) VALUES ($1, $2) ON CONFLICT (id) DO UPDATE SET log_id = EXCLUDED.log_id RETURNING id, log_id, created_at, disabled_at`, [id, logId])).rows;
+        const rows = (await this.client.query(`INSERT INTO ${this.prefix}tenants (id, log_id) VALUES ($1, $2) ON CONFLICT (id) DO UPDATE SET log_id = EXCLUDED.log_id RETURNING id, log_id, plan, created_at, disabled_at`, [id, logId])).rows;
         this.tenantCache.delete(id);
         await this.record(by, "tenant.add", id, { logId });
         return this.row(rows[0]);
     }
+    /** Moves a tenant to a plan; the quota applies from the next append. */
+    async setPlan(id, plan, by) {
+        if (!PLANS.includes(plan))
+            throw new Error(`unknown plan ${plan}; one of ${PLANS.join(", ")}`);
+        await this.init();
+        const rows = (await this.client.query(`UPDATE ${this.prefix}tenants SET plan = $2 WHERE id = $1 RETURNING id, log_id, plan, created_at, disabled_at`, [id, plan])).rows;
+        if (!rows[0])
+            throw new Error(`unknown tenant ${id}`);
+        this.tenantCache.delete(id);
+        await this.record(by, "tenant.plan", id, { plan });
+        return this.row(rows[0]);
+    }
+    /** The tenant's plan, appends this month, and the plan's quota. Cached ten seconds, so a burst may overshoot slightly. */
+    async quota(id) {
+        const t = await this.tenant(id);
+        if (!t)
+            throw new Error(`unknown tenant ${id}`);
+        const cached = this.quotaCache.get(id);
+        let used;
+        if (cached && Date.now() - cached.at < 10_000) {
+            used = cached.used;
+        }
+        else {
+            const start = `${new Date().toISOString().slice(0, 7)}-01T00:00:00Z`;
+            const rows = (await this.client.query(`SELECT COUNT(*) AS n FROM ${this.prefix}leaves WHERE tenant_id = $1 AND appended_at >= $2::timestamptz`, [id, start])).rows;
+            used = Number(rows[0]?.n ?? 0);
+            this.quotaCache.set(id, { at: Date.now(), used });
+        }
+        return { plan: t.plan, used, quota: this.quotas[t.plan] };
+    }
+    /** Called after an append lands, so the cached count stays honest between refreshes. */
+    noteAppend(id) {
+        const c = this.quotaCache.get(id);
+        if (c)
+            c.used += 1;
+    }
     async disableTenant(id, by) {
         await this.init();
         await this.client.query(`UPDATE ${this.prefix}tenants SET disabled_at = now() WHERE id = $1 AND disabled_at IS NULL`, [id]);
@@ -264,7 +306,7 @@ export class PostgresTenancy {
     }
     async listTenants() {
         await this.init();
-        return (await this.client.query(`SELECT id, log_id, created_at, disabled_at FROM ${this.prefix}tenants ORDER BY created_at`)).rows.map((r) => this.row(r));
+        return (await this.client.query(`SELECT id, log_id, plan, created_at, disabled_at FROM ${this.prefix}tenants ORDER BY created_at`)).rows.map((r) => this.row(r));
     }
     /** Mints a token for a tenant. The token is returned once and stored only as its hash. */
     async addToken(tenantId, label, by) {
@@ -301,12 +343,12 @@ export class PostgresTenancy {
         const [y, m] = month.split("-").map(Number);
         const end = `${m === 12 ? y + 1 : y}-${String(m === 12 ? 1 : m + 1).padStart(2, "0")}-01T00:00:00Z`;
         const p = this.prefix;
-        const rows = (await this.client.query(`SELECT t.id, t.log_id, t.disabled_at,
+        const rows = (await this.client.query(`SELECT t.id, t.log_id, t.plan, t.disabled_at,
               (SELECT COUNT(*) FROM ${p}leaves l WHERE l.tenant_id = t.id AND l.appended_at >= $1::timestamptz AND l.appended_at < $2::timestamptz) AS appends,
               (SELECT COUNT(*) FROM ${p}leaves l WHERE l.tenant_id = t.id) AS total,
               (SELECT COUNT(*) FROM ${p}tokens k WHERE k.tenant_id = t.id AND k.revoked_at IS NULL) AS live
        FROM ${p}tenants t ORDER BY t.created_at`, [start, end])).rows;
-        return { month, tenants: rows.map((r) => ({ id: String(r.id), logId: String(r.log_id), appends: Number(r.appends), totalLeaves: Number(r.total), liveTokens: Number(r.live), disabled: !!r.disabled_at })) };
+        return { month, tenants: rows.map((r) => { const plan = PLANS.includes(String(r.plan)) ? String(r.plan) : "free"; return { id: String(r.id), logId: String(r.log_id), plan, quota: this.quotas[plan], appends: Number(r.appends), totalLeaves: Number(r.total), liveTokens: Number(r.live), disabled: !!r.disabled_at }; }) };
     }
     async listTokens(tenantId) {
         await this.init();

package/dist/portal.d.ts

@@ -0,0 +1,75 @@
+import { type IncomingMessage, type ServerResponse } from "node:http";
+import { type PostgresLike, type PostgresTenancy } from "./log-store.ts";
+export interface StripeOptions {
+    secretKey: string;
+    webhookSecret: string;
+    /** the Stripe price id of the team plan's monthly subscription */
+    priceTeam: string;
+    fetch?: typeof fetch;
+}
+export interface PortalOptions {
+    tenancy: PostgresTenancy;
+    /** the Postgres client the tenancy uses; the portal's own tables live beside the log's */
+    client: PostgresLike;
+    /** signs session cookies; rotate to sign everyone out */
+    secret: string;
+    /** the log's public base URL, for the welcome sheet and the export command */
+    publicUrl: string;
+    checkpointsUrl?: string;
+    /** the log's current signing keyid, for the sheet */
+    keyid?: string;
+    /** the portal's own public URL, for Stripe's return addresses */
+    portalUrl?: string;
+    stripe?: StripeOptions;
+    /** key throttles by X-Forwarded-For; only behind a proxy you run. Also marks cookies Secure. */
+    trustProxy?: boolean;
+    /** table prefix; default portal_ */
+    prefix?: string;
+    log?: (message: string) => void;
+}
+export interface PortalUser {
+    id: string;
+    email: string;
+    createdAt: string;
+}
+/** Users, memberships, and billing records, beside the log's tables. */
+export declare class PortalStore {
+    private readonly client;
+    private readonly p;
+    private ready;
+    constructor(client: PostgresLike, prefix?: string);
+    private init;
+    static hashPassword(password: string): string;
+    static checkPassword(password: string, stored: string): boolean;
+    createUser(email: string, password: string): Promise<PortalUser>;
+    authenticate(email: string, password: string): Promise<PortalUser | null>;
+    user(id: string): Promise<PortalUser | null>;
+    addMember(userId: string, tenantId: string): Promise<void>;
+    /** the user's tenant; one per account today */
+    tenantOf(userId: string): Promise<string | null>;
+    setBilling(tenantId: string, b: {
+        customerId?: string | null;
+        subscriptionId?: string | null;
+        status: string;
+    }): Promise<void>;
+    billing(tenantId: string): Promise<{
+        customerId: string | null;
+        subscriptionId: string | null;
+        status: string;
+    } | null>;
+    tenantBySubscription(subscriptionId: string): Promise<string | null>;
+}
+export declare function signSession(secret: string, userId: string, ttlMs?: number): string;
+export declare function readSession(secret: string, cookie: string | undefined): string | null;
+export declare function stripeRequest(s: StripeOptions, path: string, body: Record<string, string>): Promise<Record<string, unknown>>;
+/** Stripe-Signature: t=<unix>,v1=<hmac>; the mac is over `${t}.${rawBody}` with the endpoint secret. */
+export declare function verifyStripeSignature(header: string | undefined, rawBody: string, secret: string, now?: number, toleranceMs?: number): boolean;
+export interface RunningPortal {
+    url: string;
+    close(): Promise<void>;
+}
+export declare function portalHandler(o: PortalOptions): (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+export declare function servePortal(o: PortalOptions, opts: {
+    port: number;
+    host?: string;
+}): Promise<RunningPortal>;