@amerged/ohmyhost-mcp 0.1.10

package/src/packages/contracts/billing.ts

@@ -0,0 +1,172 @@
+export type BillingTaxIssueCode =
+  | "billing_tax_location_required"
+  | "billing_tax_calculation_failed"
+  | "billing_tax_configuration_required";
+export interface BillingTaxIssue {
+  code: BillingTaxIssueCode;
+  invoice_id: string;
+  observed_at: string;
+  required_action: "open_billing_portal" | "contact_support";
+}
+
+export interface BillingCheckoutView {
+  organization_id: string;
+  checkout_id: string;
+  offer: "topup" | "paid";
+  state: "open" | "complete" | "expired";
+  payment_confirmed: boolean;
+  url: string | null;
+  expires_at: string;
+  packs: number;
+  credited_micros: string;
+  revoked_micros: string;
+  paid_until: string | null;
+  required_action: "none" | "complete_checkout" | "open_billing_portal" | "contact_support";
+  billing_issue: BillingTaxIssue | null;
+}
+export interface BillingPortalView {
+  organization_id: string;
+  url: string;
+  created_at: string;
+}
+export function assertBillingTaxIssue(value: unknown): asserts value is BillingTaxIssue | null {
+  if (value === null) return;
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("billing_response_invalid");
+  const v = value as Record<string, unknown>;
+  if (
+    Object.keys(v).sort().join(",") !== "code,invoice_id,observed_at,required_action" ||
+    ![
+      "billing_tax_location_required",
+      "billing_tax_calculation_failed",
+      "billing_tax_configuration_required",
+    ].includes(String(v["code"])) ||
+    typeof v["invoice_id"] !== "string" ||
+    !/^in_[A-Za-z0-9_]{1,253}$/u.test(v["invoice_id"]) ||
+    !timestamp(v["observed_at"]) ||
+    v["required_action"] !==
+      (v["code"] === "billing_tax_location_required" ? "open_billing_portal" : "contact_support")
+  )
+    throw new Error("billing_response_invalid");
+}
+const ulid = /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u;
+const timestamp = (v: unknown): v is string =>
+  typeof v === "string" && Number.isFinite(Date.parse(v)) && new Date(v).toISOString() === v;
+function stripeUrl(value: unknown, host: string): value is string {
+  if (typeof value !== "string" || value.length > 8192) return false;
+  try {
+    const u = new URL(value);
+    return u.protocol === "https:" && u.hostname === host && !u.username && !u.password && !u.port;
+  } catch {
+    return false;
+  }
+}
+export function assertBillingCheckout(value: unknown): asserts value is BillingCheckoutView {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("billing_response_invalid");
+  const v = value as Record<string, unknown>;
+  if (
+    Object.keys(v).sort().join(",") !==
+      "billing_issue,checkout_id,credited_micros,expires_at,offer,organization_id,packs,paid_until,payment_confirmed,required_action,revoked_micros,state,url" ||
+    typeof v["organization_id"] !== "string" ||
+    !ulid.test(v["organization_id"]) ||
+    typeof v["checkout_id"] !== "string" ||
+    !ulid.test(v["checkout_id"]) ||
+    typeof v["offer"] !== "string" ||
+    !["topup", "paid"].includes(v["offer"]) ||
+    typeof v["state"] !== "string" ||
+    !["open", "complete", "expired"].includes(v["state"]) ||
+    typeof v["payment_confirmed"] !== "boolean" ||
+    typeof v["required_action"] !== "string" ||
+    !["none", "complete_checkout", "open_billing_portal", "contact_support"].includes(
+      v["required_action"],
+    ) ||
+    (v["url"] !== null && !stripeUrl(v["url"], "checkout.stripe.com")) ||
+    !timestamp(v["expires_at"]) ||
+    (v["paid_until"] !== null && !timestamp(v["paid_until"])) ||
+    !Number.isInteger(v["packs"]) ||
+    Number(v["packs"]) < 1 ||
+    Number(v["packs"]) > 100 ||
+    (v["offer"] === "paid" && v["packs"] !== 1) ||
+    ![v["credited_micros"], v["revoked_micros"]].every(
+      (x) => typeof x === "string" && /^(0|[1-9][0-9]{0,18})$/u.test(x),
+    )
+  )
+    throw new Error("billing_response_invalid");
+  assertBillingTaxIssue(v["billing_issue"]);
+}
+export function assertBillingPortal(value: unknown): asserts value is BillingPortalView {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("billing_response_invalid");
+  const v = value as Record<string, unknown>;
+  if (
+    Object.keys(v).sort().join(",") !== "created_at,organization_id,url" ||
+    typeof v["organization_id"] !== "string" ||
+    !ulid.test(v["organization_id"]) ||
+    !timestamp(v["created_at"]) ||
+    !stripeUrl(v["url"], "billing.stripe.com")
+  )
+    throw new Error("billing_response_invalid");
+}
+
+export interface RechargeView {
+  organization_id: string;
+  portal_available: boolean;
+  enabled: boolean;
+  revision: number;
+  status:
+    | "off"
+    | "setup_required"
+    | "on"
+    | "payment_required"
+    | "monthly_limit"
+    | "needs_reconciliation"
+    | "tax_required";
+  monthly_limit_minor: number;
+  spent_minor: number;
+  currency: "usd";
+  amount_minor: 900;
+  credits: 1000;
+  threshold_credits: 100;
+  setup_url: string | null;
+  invoice_url: string | null;
+  billing_issue: BillingTaxIssue | null;
+}
+export function assertRecharge(value: unknown): asserts value is RechargeView {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("billing_response_invalid");
+  const v = value as Record<string, unknown>;
+  if (
+    Object.keys(v).sort().join(",") !==
+      "amount_minor,billing_issue,credits,currency,enabled,invoice_url,monthly_limit_minor,organization_id,portal_available,revision,setup_url,spent_minor,status,threshold_credits" ||
+    typeof v["organization_id"] !== "string" ||
+    !ulid.test(v["organization_id"]) ||
+    typeof v["portal_available"] !== "boolean" ||
+    typeof v["enabled"] !== "boolean" ||
+    !Number.isSafeInteger(v["revision"]) ||
+    Number(v["revision"]) < 0 ||
+    !Number.isSafeInteger(v["monthly_limit_minor"]) ||
+    Number(v["monthly_limit_minor"]) < 1000 ||
+    Number(v["monthly_limit_minor"]) > 100000 ||
+    !Number.isSafeInteger(v["spent_minor"]) ||
+    Number(v["spent_minor"]) < 0 ||
+    v["currency"] !== "usd" ||
+    v["amount_minor"] !== 900 ||
+    v["credits"] !== 1000 ||
+    v["threshold_credits"] !== 100 ||
+    typeof v["status"] !== "string" ||
+    ![
+      "off",
+      "setup_required",
+      "on",
+      "payment_required",
+      "monthly_limit",
+      "needs_reconciliation",
+      "tax_required",
+    ].includes(v["status"]) ||
+    (v["setup_url"] !== null && !stripeUrl(v["setup_url"], "checkout.stripe.com")) ||
+    (v["invoice_url"] !== null && !stripeUrl(v["invoice_url"], "invoice.stripe.com"))
+  )
+    throw new Error("billing_response_invalid");
+  assertBillingTaxIssue(v["billing_issue"]);
+}

package/src/packages/contracts/credit-pricing.ts

@@ -0,0 +1,214 @@
+export interface OrganizationCreditUsage {
+  organization_id: string;
+  month: string;
+  as_of: string;
+  unit: "microcredits";
+  data: {
+    project_id: string;
+    reserved_micros: string;
+    meters: {
+      environment_id: string | null;
+      meter: string;
+      unit: string;
+      rate_card_id: string;
+      quantity: string;
+      charged_micros: string;
+      funded_micros: string;
+      platform_overrun_micros: string;
+    }[];
+  }[];
+  next_cursor: string | null;
+}
+
+/** A bounded read model, not a new source of accounting or billing authorization. */
+export function assertOrganizationCreditUsage(
+  value: unknown,
+): asserts value is OrganizationCreditUsage {
+  const record = (input: unknown, keys: string) => {
+    if (
+      !input ||
+      typeof input !== "object" ||
+      Array.isArray(input) ||
+      Object.keys(input).sort().join() !== keys.split(",").sort().join()
+    )
+      throw new TypeError("Invalid usage fields");
+    return input as Record<string, unknown>;
+  };
+  const identifier = (input: unknown) =>
+    typeof input === "string" && /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u.test(input);
+  const amount = (input: unknown) =>
+    typeof input === "string" && /^(0|[1-9][0-9]{0,37})$/u.test(input);
+  const report = record(value, "organization_id,month,as_of,unit,data,next_cursor");
+  if (
+    !identifier(report["organization_id"]) ||
+    typeof report["month"] !== "string" ||
+    !/^20[0-9]{2}-(0[1-9]|1[0-2])$/u.test(report["month"]) ||
+    typeof report["as_of"] !== "string" ||
+    !Number.isFinite(Date.parse(report["as_of"])) ||
+    new Date(report["as_of"]).toISOString() !== report["as_of"] ||
+    report["unit"] !== "microcredits" ||
+    !Array.isArray(report["data"]) ||
+    report["data"].length > 20 ||
+    (report["next_cursor"] !== null && !identifier(report["next_cursor"]))
+  )
+    throw new TypeError("Invalid usage report");
+  let previous = "";
+  for (const input of report["data"]) {
+    const project = record(input, "project_id,reserved_micros,meters");
+    if (
+      !identifier(project["project_id"]) ||
+      String(project["project_id"]) <= previous ||
+      !amount(project["reserved_micros"]) ||
+      !Array.isArray(project["meters"]) ||
+      project["meters"].length > 1000
+    )
+      throw new TypeError("Invalid usage project");
+    previous = String(project["project_id"]);
+    for (const input of project["meters"]) {
+      const meter = record(
+        input,
+        "environment_id,meter,unit,rate_card_id,quantity,charged_micros,funded_micros,platform_overrun_micros",
+      );
+      if (meter["environment_id"] !== null && !identifier(meter["environment_id"]))
+        throw new TypeError("Invalid usage environment");
+      for (const key of ["meter", "unit", "rate_card_id"])
+        if (typeof meter[key] !== "string" || !/^[A-Za-z0-9_.:/-]{1,128}$/u.test(meter[key]))
+          throw new TypeError("Invalid usage meter");
+      for (const key of ["quantity", "charged_micros", "funded_micros", "platform_overrun_micros"])
+        if (!amount(meter[key])) throw new TypeError("Invalid usage amount");
+      if (
+        BigInt(String(meter["charged_micros"])) !==
+        BigInt(String(meter["funded_micros"])) + BigInt(String(meter["platform_overrun_micros"]))
+      )
+        throw new TypeError("Inconsistent usage charge");
+    }
+  }
+  if (report["next_cursor"] !== null && report["next_cursor"] !== previous)
+    throw new TypeError("Invalid usage cursor");
+}
+
+export interface PublishedCreditRateCard {
+  readonly id: string;
+  readonly currency: "USD";
+  readonly published_at: string;
+  readonly effective_from: string;
+  readonly rates: readonly {
+    readonly meter: string;
+    readonly unit: string;
+    readonly units_per_charge: string;
+    readonly provider_cost_micros: string;
+    readonly credit_micros: string;
+  }[];
+}
+
+/** Shared wire validation only; clients never recompute accounting decisions. */
+export function assertPublishedCreditRateCards(
+  value: unknown,
+): asserts value is readonly PublishedCreditRateCard[] {
+  if (!Array.isArray(value) || value.length > 4) throw new TypeError("Invalid published prices");
+  const ids = new Set<string>();
+  for (const input of value) {
+    if (
+      !input ||
+      typeof input !== "object" ||
+      Array.isArray(input) ||
+      Object.keys(input).sort().join() !== "currency,effective_from,id,published_at,rates"
+    )
+      throw new TypeError("Invalid published price fields");
+    const card = input as Record<string, unknown>;
+    if (
+      typeof card["id"] !== "string" ||
+      !/^[a-z0-9_.-]{1,128}$/u.test(card["id"]) ||
+      ids.has(card["id"]) ||
+      card["currency"] !== "USD"
+    )
+      throw new TypeError("Invalid price identity");
+    ids.add(card["id"]);
+    for (const key of ["published_at", "effective_from"]) {
+      const date = card[key];
+      if (
+        typeof date !== "string" ||
+        !Number.isFinite(Date.parse(date)) ||
+        new Date(date).toISOString() !== date
+      )
+        throw new TypeError("Invalid price dates");
+    }
+    if (
+      String(card["published_at"]) > String(card["effective_from"]) ||
+      !Array.isArray(card["rates"]) ||
+      card["rates"].length < 1 ||
+      card["rates"].length > 32
+    )
+      throw new TypeError("Invalid price publication");
+    const meters = new Set<string>();
+    for (const item of card["rates"]) {
+      if (
+        !item ||
+        typeof item !== "object" ||
+        Array.isArray(item) ||
+        Object.keys(item).sort().join() !==
+          "credit_micros,meter,provider_cost_micros,unit,units_per_charge"
+      )
+        throw new TypeError("Invalid rate fields");
+      const rate = item as Record<string, unknown>;
+      for (const key of ["meter", "unit"])
+        if (typeof rate[key] !== "string" || !/^[a-z0-9_.-]{1,128}$/u.test(String(rate[key])))
+          throw new TypeError("Invalid rate unit");
+      const identity = String(rate["meter"]) + "/" + String(rate["unit"]);
+      if (meters.has(identity)) throw new TypeError("Duplicate rate");
+      meters.add(identity);
+      for (const key of ["units_per_charge", "provider_cost_micros", "credit_micros"]) {
+        const amount = rate[key];
+        if (
+          typeof amount !== "string" ||
+          !/^(0|[1-9][0-9]{0,18})$/u.test(amount) ||
+          BigInt(amount) > 9223372036854775807n ||
+          (key === "units_per_charge" && amount === "0")
+        )
+          throw new TypeError("Invalid rate amount");
+      }
+    }
+  }
+}
+
+/** Effective feature access and credit buckets from the existing ledger. */
+export function assertOrganizationAccount(value: unknown): void {
+  if (
+    !value ||
+    typeof value !== "object" ||
+    Array.isArray(value) ||
+    Object.keys(value).sort().join(",") !==
+      "as_of,available_micros,monthly_micros,name,next_expiry,one_time_micros,organization_id,paid_until,plan,plan_source,reserved_micros,workos_organization_id"
+  )
+    throw new TypeError("Invalid account fields");
+  const v = value as Record<string, unknown>;
+  if (
+    typeof v["organization_id"] !== "string" ||
+    !/^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u.test(v["organization_id"]) ||
+    typeof v["name"] !== "string" ||
+    v["name"].length > 128 ||
+    typeof v["workos_organization_id"] !== "string" ||
+    !/^org_[A-Za-z0-9_]+$/u.test(v["workos_organization_id"]) ||
+    (v["plan"] !== "paid" && v["plan"] !== "free") ||
+    !["free", "stripe", "beta", "manual"].includes(String(v["plan_source"])) ||
+    (v["plan"] === "free") !== (v["plan_source"] === "free")
+  )
+    throw new TypeError("Invalid account scope");
+  for (const field of ["available_micros", "monthly_micros", "one_time_micros", "reserved_micros"])
+    if (typeof v[field] !== "string" || !/^(0|[1-9][0-9]{0,18})$/u.test(v[field] as string))
+      throw new TypeError("Invalid account credits");
+  if (
+    BigInt(String(v["monthly_micros"])) + BigInt(String(v["one_time_micros"])) !==
+    BigInt(String(v["available_micros"]))
+  )
+    throw new TypeError("Account credit buckets do not balance");
+  for (const field of ["as_of", "paid_until", "next_expiry"]) {
+    if (field !== "as_of" && v[field] === null) continue;
+    if (
+      typeof v[field] !== "string" ||
+      !Number.isFinite(Date.parse(v[field] as string)) ||
+      new Date(v[field] as string).toISOString() !== v[field]
+    )
+      throw new TypeError("Invalid account timestamp");
+  }
+}

package/src/packages/contracts/database-access.ts

@@ -0,0 +1,257 @@
+import { publicOperationFailure, type PublicOperationFailure } from "./operation-failure.js";
+
+export type DatabaseEnvironment = "dev" | "prod";
+export type DatabaseJson =
+  | null
+  | string
+  | number
+  | boolean
+  | readonly DatabaseJson[]
+  | { readonly [key: string]: DatabaseJson };
+export interface ProjectDatabaseWriteRequest {
+  readonly environment: DatabaseEnvironment;
+  readonly statement: string;
+  readonly parameters: readonly DatabaseJson[];
+}
+export interface ProjectDatabaseWriteReceipt {
+  readonly operation_id: string;
+  readonly environment: DatabaseEnvironment;
+  readonly state: "running" | "succeeded" | "failed";
+  readonly command: "INSERT" | "UPDATE" | "DELETE" | null;
+  readonly affected_rows: number | null;
+  readonly error: PublicOperationFailure | null;
+}
+/** These limits apply to one direct DML statement; PostgreSQL owns SQL grammar. */
+export function parseProjectDatabaseWrite(value: unknown): ProjectDatabaseWriteRequest {
+  if (
+    !record(value) ||
+    !exact(value, ["environment", "statement", "parameters"]) ||
+    !["dev", "prod"].includes(String(value["environment"])) ||
+    typeof value["statement"] !== "string" ||
+    !/^\s*(?:insert|update|delete)\b/iu.test(value["statement"]) ||
+    new TextEncoder().encode(value["statement"]).byteLength > 65_536 ||
+    value["statement"].includes("\0") ||
+    !Array.isArray(value["parameters"]) ||
+    value["parameters"].length > 100
+  )
+    throw new TypeError("Invalid database write");
+  const budget = { nodes: 0 };
+  for (const parameter of value["parameters"]) json(parameter, 0, budget);
+  if (new TextEncoder().encode(JSON.stringify(value["parameters"])).byteLength > 65_536)
+    throw new TypeError("Invalid database parameters");
+  return {
+    environment: value["environment"] as DatabaseEnvironment,
+    statement: value["statement"],
+    parameters: value["parameters"] as DatabaseJson[],
+  };
+}
+export function assertProjectDatabaseWriteReceipt(
+  value: unknown,
+): asserts value is ProjectDatabaseWriteReceipt {
+  if (
+    !record(value) ||
+    !exact(value, ["operation_id", "environment", "state", "command", "affected_rows", "error"]) ||
+    typeof value["operation_id"] !== "string" ||
+    !/^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u.test(value["operation_id"]) ||
+    !["dev", "prod"].includes(String(value["environment"])) ||
+    !["running", "succeeded", "failed"].includes(String(value["state"]))
+  )
+    throw new TypeError("Invalid database write receipt");
+  if (value["state"] === "succeeded") {
+    if (
+      !["INSERT", "UPDATE", "DELETE"].includes(String(value["command"])) ||
+      !Number.isSafeInteger(value["affected_rows"]) ||
+      Number(value["affected_rows"]) < 0 ||
+      Number(value["affected_rows"]) > 1000 ||
+      value["error"] !== null
+    )
+      throw new TypeError("Invalid database write result");
+  } else {
+    if (value["command"] !== null || value["affected_rows"] !== null)
+      throw new TypeError("Invalid database write result");
+    if (value["state"] === "running") {
+      if (value["error"] !== null) throw new TypeError("Invalid database write result");
+    } else {
+      const error = value["error"];
+      if (
+        !record(error) ||
+        typeof error["code"] !== "string" ||
+        !error["code"].startsWith("database_write_") ||
+        JSON.stringify(error) !== JSON.stringify(publicOperationFailure(error["code"]))
+      )
+        throw new TypeError("Invalid database write error");
+    }
+  }
+}
+export type DatabaseAccessMode = "read" | "write";
+export const DATABASE_ACCESS_MIN_TTL_SECONDS = 300;
+export const DATABASE_ACCESS_DEFAULT_TTL_SECONDS = 3600;
+export const DATABASE_ACCESS_MAX_TTL_SECONDS = 86_400;
+export interface ProjectDatabaseAccessRequest {
+  readonly environment: DatabaseEnvironment;
+  readonly mode: DatabaseAccessMode;
+  readonly ttl_seconds: number;
+  readonly label: string | null;
+}
+export interface ProjectDatabaseAccess {
+  readonly access_id: string;
+  readonly environment: DatabaseEnvironment;
+  readonly mode: DatabaseAccessMode;
+  readonly role_name: string;
+  readonly host: string;
+  readonly database: "neondb";
+  readonly label: string | null;
+  readonly state: "active" | "expired" | "revoked";
+  readonly issued_at: string;
+  readonly expires_at: string;
+  readonly revoked_at: string | null;
+  readonly revocation_reason: "principal" | "expired" | "budget" | "creation_failed" | null;
+}
+export interface ProjectDatabaseAccessCredential extends ProjectDatabaseAccess {
+  readonly connection_uri: string;
+  readonly psql_command: string;
+}
+export interface ProjectDatabaseAccessPage {
+  readonly items: readonly ProjectDatabaseAccess[];
+}
+const ACCESS_KEYS = [
+  "access_id",
+  "environment",
+  "mode",
+  "role_name",
+  "host",
+  "database",
+  "label",
+  "state",
+  "issued_at",
+  "expires_at",
+  "revoked_at",
+  "revocation_reason",
+] as const;
+const ACCESS_ROLE_PATTERN = /^ohmyho_da_[0-7][0-9a-hjkmnp-tv-z]{25}_[0-9a-z]{8}$/u;
+/** The customer chooses only the environment, the rights, the lifetime and a label. */
+export function parseProjectDatabaseAccessRequest(value: unknown): ProjectDatabaseAccessRequest {
+  if (
+    !record(value) ||
+    Object.keys(value).some(
+      (key) => !["environment", "mode", "ttl_seconds", "label"].includes(key),
+    ) ||
+    !["dev", "prod"].includes(String(value["environment"])) ||
+    (value["mode"] !== undefined && !["read", "write"].includes(String(value["mode"])))
+  )
+    throw new TypeError("Invalid database access request");
+  const ttl = value["ttl_seconds"] ?? DATABASE_ACCESS_DEFAULT_TTL_SECONDS;
+  if (
+    !Number.isSafeInteger(ttl) ||
+    Number(ttl) < DATABASE_ACCESS_MIN_TTL_SECONDS ||
+    Number(ttl) > DATABASE_ACCESS_MAX_TTL_SECONDS
+  )
+    throw new TypeError("Invalid database access lifetime");
+  return {
+    environment: value["environment"] as DatabaseEnvironment,
+    mode: (value["mode"] ?? "read") as DatabaseAccessMode,
+    ttl_seconds: Number(ttl),
+    label: accessLabel(value["label"]),
+  };
+}
+export function assertProjectDatabaseAccess(
+  value: unknown,
+): asserts value is ProjectDatabaseAccess {
+  if (!record(value) || !exact(value, ACCESS_KEYS)) throw new TypeError("Invalid database access");
+  assertAccessFields(value);
+}
+export function assertProjectDatabaseAccessCredential(
+  value: unknown,
+): asserts value is ProjectDatabaseAccessCredential {
+  if (!record(value) || !exact(value, [...ACCESS_KEYS, "connection_uri", "psql_command"]))
+    throw new TypeError("Invalid database access credential");
+  assertAccessFields(value);
+  const uri = value["connection_uri"];
+  if (typeof uri !== "string" || value["psql_command"] !== `psql '${uri}'`)
+    throw new TypeError("Invalid database access credential");
+  let parsed: URL;
+  try {
+    parsed = new URL(uri);
+  } catch {
+    throw new TypeError("Invalid database access credential");
+  }
+  if (
+    parsed.protocol !== "postgresql:" ||
+    decodeURIComponent(parsed.username) !== value["role_name"] ||
+    parsed.password === "" ||
+    parsed.hostname !== value["host"] ||
+    parsed.host !== value["host"] ||
+    decodeURIComponent(parsed.pathname.slice(1)) !== "neondb" ||
+    parsed.search !== "?sslmode=require"
+  )
+    throw new TypeError("Invalid database access credential");
+}
+export function assertProjectDatabaseAccessPage(
+  value: unknown,
+): asserts value is ProjectDatabaseAccessPage {
+  if (
+    !record(value) ||
+    !exact(value, ["items"]) ||
+    !Array.isArray(value["items"]) ||
+    value["items"].length > 50
+  )
+    throw new TypeError("Invalid database access page");
+  for (const item of value["items"]) assertProjectDatabaseAccess(item);
+}
+function assertAccessFields(value: Record<string, unknown>): void {
+  const revoked = value["revoked_at"],
+    reason = value["revocation_reason"];
+  if (
+    typeof value["access_id"] !== "string" ||
+    !/^[0-7][0-9A-HJKMNP-TV-Z]{25}$/u.test(value["access_id"]) ||
+    !["dev", "prod"].includes(String(value["environment"])) ||
+    !["read", "write"].includes(String(value["mode"])) ||
+    typeof value["role_name"] !== "string" ||
+    !ACCESS_ROLE_PATTERN.test(value["role_name"]) ||
+    typeof value["host"] !== "string" ||
+    !/^[a-z0-9]([a-z0-9.-]{0,251}[a-z0-9])?$/u.test(value["host"]) ||
+    value["database"] !== "neondb" ||
+    (value["label"] !== null && accessLabel(value["label"]) !== value["label"]) ||
+    !["active", "expired", "revoked"].includes(String(value["state"])) ||
+    !timestamp(value["issued_at"]) ||
+    !timestamp(value["expires_at"]) ||
+    Date.parse(String(value["expires_at"])) <= Date.parse(String(value["issued_at"])) ||
+    (revoked !== null && !timestamp(revoked)) ||
+    (revoked === null) !== (reason === null) ||
+    (reason !== null &&
+      !["principal", "expired", "budget", "creation_failed"].includes(String(reason))) ||
+    (value["state"] === "revoked") !== (revoked !== null)
+  )
+    throw new TypeError("Invalid database access");
+}
+function accessLabel(value: unknown): string | null {
+  if (value === undefined || value === null) return null;
+  if (typeof value !== "string") throw new TypeError("Invalid database access label");
+  const label = value.trim();
+  if (label.length < 1 || label.length > 64 || /\p{Cc}/u.test(label))
+    throw new TypeError("Invalid database access label");
+  return label;
+}
+function timestamp(value: unknown): boolean {
+  return typeof value === "string" && new Date(value).toISOString() === value;
+}
+function json(value: unknown, depth: number, budget: { nodes: number }): void {
+  if (++budget.nodes > 10_000 || depth > 8) throw new TypeError("Invalid database parameter");
+  if (value === null || typeof value === "string" || typeof value === "boolean") return;
+  if (typeof value === "number" && Number.isFinite(value)) return;
+  if (Array.isArray(value)) {
+    for (const entry of value) json(entry, depth + 1, budget);
+    return;
+  }
+  if (record(value)) {
+    for (const entry of Object.values(value)) json(entry, depth + 1, budget);
+    return;
+  }
+  throw new TypeError("Invalid database parameter");
+}
+function record(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function exact(value: Record<string, unknown>, keys: readonly string[]) {
+  return Object.keys(value).sort().join(",") === [...keys].sort().join(",");
+}