@antelopejs/dms-saas 0.0.1

package/dist/workspaces/free-workspace-guard.js

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isFreePlan = isFreePlan;
+exports.resolveMaxFreeWorkspacesPerCard = resolveMaxFreeWorkspacesPerCard;
+exports.findFreeWorkspaceIdsBackedByCard = findFreeWorkspaceIdsBackedByCard;
+exports.assertFreePlanAllowedForCard = assertFreePlanAllowedForCard;
+exports.resolveFreePlanAvailability = resolveFreePlanAvailability;
+exports.resolveFreePlanAvailabilityForUser = resolveFreePlanAvailabilityForUser;
+const interface_api_util_1 = require("@antelopejs/interface-api-util");
+const interface_database_1 = require("@antelopejs/interface-database");
+const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
+const db_1 = require("@antelopejs/interface-dms/db");
+const db_2 = require("../db");
+const utils_1 = require("../utils");
+const HTTP_CONFLICT = 409;
+const FREE_PLAN_PRICE = 0;
+function isFreePlan(plan) {
+    return plan.price <= FREE_PLAN_PRICE;
+}
+async function resolveMaxFreeWorkspacesPerCard() {
+    const settings = await (0, interface_database_decorators_1.GetModel)(db_2.BillingSettingsModel).get(db_2.BILLING_SETTINGS_SINGLETON_ID);
+    return (settings?.maxFreeWorkspacesPerCard ?? db_2.DEFAULT_MAX_FREE_WORKSPACES_PER_CARD);
+}
+async function keepFreeSubscriptions(subscriptions) {
+    const planIds = [
+        ...new Set(subscriptions
+            .map((sub) => sub.planId)
+            .filter((planId) => !!planId)),
+    ];
+    if (planIds.length === 0)
+        return [];
+    const planModel = (0, interface_database_decorators_1.GetModel)(db_2.PlanModel);
+    const plans = await Promise.all(planIds.map((planId) => planModel.get(planId)));
+    const freePlanIds = new Set(plans
+        .filter((plan) => !!plan && isFreePlan(plan))
+        .map((plan) => plan._id));
+    return subscriptions.filter((sub) => sub.planId && freePlanIds.has(sub.planId));
+}
+async function resolveWorkspaceNames(subscriptions) {
+    const tenantIds = subscriptions.map((sub) => (0, utils_1.getRowInstance)(sub));
+    const tenants = await (0, interface_database_decorators_1.GetModel)(db_1.TenantModel).getMany(tenantIds);
+    return tenants.map((tenant) => tenant.name);
+}
+async function findFreeWorkspacesBackedByCard(cardFingerprint) {
+    const subscriptions = await (0, interface_database_decorators_1.GetModel)(db_2.TenantSubscriptionModel, interface_database_1.CROSS_INSTANCE).findByCardFingerprint(cardFingerprint);
+    const freeSubscriptions = await keepFreeSubscriptions(subscriptions);
+    if (freeSubscriptions.length === 0)
+        return [];
+    return resolveWorkspaceNames(freeSubscriptions);
+}
+async function findFreeWorkspaceIdsBackedByCard(cardFingerprint) {
+    const subscriptions = await (0, interface_database_decorators_1.GetModel)(db_2.TenantSubscriptionModel, interface_database_1.CROSS_INSTANCE).findByCardFingerprint(cardFingerprint);
+    const freeSubscriptions = await keepFreeSubscriptions(subscriptions);
+    return [
+        ...new Set(freeSubscriptions.map((subscription) => (0, utils_1.getRowInstance)(subscription))),
+    ];
+}
+async function assertFreePlanAllowedForCard(plan, cardFingerprint) {
+    if (!isFreePlan(plan) || !cardFingerprint)
+        return;
+    const [limit, workspaceNames] = await Promise.all([
+        resolveMaxFreeWorkspacesPerCard(),
+        findFreeWorkspacesBackedByCard(cardFingerprint),
+    ]);
+    (0, interface_api_util_1.assert)(workspaceNames.length < limit, HTTP_CONFLICT, "saas.errors.workspace.free_limit_reached");
+}
+async function collectUserCardFingerprints(userId) {
+    const memberships = await (0, interface_database_decorators_1.GetModel)(db_1.TenantMemberModel, interface_database_1.CROSS_INSTANCE).listByUserWithTenantIds(userId);
+    const subscriptions = await Promise.all(memberships.map((membership) => (0, interface_database_decorators_1.GetModel)(db_2.TenantSubscriptionModel, membership.tenantId).findOne()));
+    const fingerprints = subscriptions
+        .map((subscription) => subscription?.cardFingerprint)
+        .filter((fingerprint) => !!fingerprint);
+    return new Set(fingerprints);
+}
+function resolveFreePlanAvailability(freeWorkspaceNamesPerCard, limit) {
+    if (freeWorkspaceNamesPerCard.length === 0) {
+        return { isAvailable: true, blockingWorkspaceName: null };
+    }
+    const hasCardWithRoom = freeWorkspaceNamesPerCard.some((workspaceNames) => workspaceNames.length < limit);
+    if (hasCardWithRoom) {
+        return { isAvailable: true, blockingWorkspaceName: null };
+    }
+    return {
+        isAvailable: false,
+        blockingWorkspaceName: freeWorkspaceNamesPerCard.flat()[0] ?? null,
+    };
+}
+async function resolveFreePlanAvailabilityForUser(userId) {
+    const fingerprints = await collectUserCardFingerprints(userId);
+    const [limit, usages] = await Promise.all([
+        resolveMaxFreeWorkspacesPerCard(),
+        Promise.all([...fingerprints].map((fingerprint) => findFreeWorkspacesBackedByCard(fingerprint))),
+    ]);
+    return resolveFreePlanAvailability(usages, limit);
+}
+//# sourceMappingURL=free-workspace-guard.js.map

package/dist/workspaces/free-workspace-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"free-workspace-guard.js","sourceRoot":"","sources":["../../src/workspaces/free-workspace-guard.ts"],"names":[],"mappings":";;AAsBA,gCAEC;AAED,0EAOC;AAgDD,4EAaC;AAOD,oEAcC;AAyBD,kEAiBC;AAED,gFAaC;AA5KD,uEAAwD;AACxD,uEAAgE;AAChE,6FAAqE;AACrE,qDAA8E;AAE9E,8BAMe;AACf,oCAA0C;AAE1C,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,eAAe,GAAG,CAAC,CAAC;AAO1B,SAAgB,UAAU,CAAC,IAAU;IACnC,OAAO,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC;AACvC,CAAC;AAEM,KAAK,UAAU,+BAA+B;IACnD,MAAM,QAAQ,GAAG,MAAM,IAAA,wCAAQ,EAAC,yBAAoB,CAAC,CAAC,GAAG,CACvD,kCAA6B,CAC9B,CAAC;IACF,OAAO,CACL,QAAQ,EAAE,wBAAwB,IAAI,yCAAoC,CAC3E,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,aAAmC;IAEnC,MAAM,OAAO,GAAG;QACd,GAAG,IAAI,GAAG,CACR,aAAa;aACV,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC;aACxB,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAClD;KACF,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,IAAA,wCAAQ,EAAC,cAAS,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAC/C,CAAC;IACF,MAAM,WAAW,GAAG,IAAI,GAAG,CACzB,KAAK;SACF,MAAM,CAAC,CAAC,IAAI,EAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;SAC1D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAC3B,CAAC;IACF,OAAO,aAAa,CAAC,MAAM,CACzB,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CACnD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,aAAmC;IAEnC,MAAM,SAAS,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,sBAAc,EAAC,GAAG,CAAC,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,MAAM,IAAA,wCAAQ,EAAC,gBAAW,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/D,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,KAAK,UAAU,8BAA8B,CAC3C,eAAuB;IAEvB,MAAM,aAAa,GAAG,MAAM,IAAA,wCAAQ,EAClC,4BAAuB,EACvB,mCAAc,CACf,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACzC,MAAM,iBAAiB,GAAG,MAAM,qBAAqB,CAAC,aAAa,CAAC,CAAC;IACrE,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9C,OAAO,qBAAqB,CAAC,iBAAiB,CAAC,CAAC;AAClD,CAAC;AAGM,KAAK,UAAU,gCAAgC,CACpD,eAAuB;IAEvB,MAAM,aAAa,GAAG,MAAM,IAAA,wCAAQ,EAClC,4BAAuB,EACvB,mCAAc,CACf,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACzC,MAAM,iBAAiB,GAAG,MAAM,qBAAqB,CAAC,aAAa,CAAC,CAAC;IACrE,OAAO;QACL,GAAG,IAAI,GAAG,CACR,iBAAiB,CAAC,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,IAAA,sBAAc,EAAC,YAAY,CAAC,CAAC,CACtE;KACF,CAAC;AACJ,CAAC;AAOM,KAAK,UAAU,4BAA4B,CAChD,IAAU,EACV,eAA8B;IAE9B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe;QAAE,OAAO;IAClD,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChD,+BAA+B,EAAE;QACjC,8BAA8B,CAAC,eAAe,CAAC;KAChD,CAAC,CAAC;IACH,IAAA,2BAAM,EACJ,cAAc,CAAC,MAAM,GAAG,KAAK,EAC7B,aAAa,EACb,0CAA0C,CAC3C,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,MAAc;IAEd,MAAM,WAAW,GAAG,MAAM,IAAA,wCAAQ,EAChC,sBAAiB,EACjB,mCAAc,CACf,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,GAAG,CACrC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAC7B,IAAA,wCAAQ,EAAC,4BAAuB,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CACjE,CACF,CAAC;IACF,MAAM,YAAY,GAAG,aAAa;SAC/B,GAAG,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,YAAY,EAAE,eAAe,CAAC;SACpD,MAAM,CAAC,CAAC,WAAW,EAAyB,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IACjE,OAAO,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;AAC/B,CAAC;AAOD,SAAgB,2BAA2B,CACzC,yBAAqC,EACrC,KAAa;IAEb,IAAI,yBAAyB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3C,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;IAC5D,CAAC;IACD,MAAM,eAAe,GAAG,yBAAyB,CAAC,IAAI,CACpD,CAAC,cAAc,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,GAAG,KAAK,CAClD,CAAC;IACF,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO;QACL,WAAW,EAAE,KAAK;QAClB,qBAAqB,EAAE,yBAAyB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI;KACnE,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,kCAAkC,CACtD,MAAc;IAEd,MAAM,YAAY,GAAG,MAAM,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAC/D,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACxC,+BAA+B,EAAE;QACjC,OAAO,CAAC,GAAG,CACT,CAAC,GAAG,YAAY,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CACpC,8BAA8B,CAAC,WAAW,CAAC,CAC5C,CACF;KACF,CAAC,CAAC;IACH,OAAO,2BAA2B,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AACpD,CAAC"}

package/dist/workspaces/index.d.ts

@@ -0,0 +1,6 @@
+export * from "./billing-profile";
+export * from "./deletion";
+export * from "./free-workspace-guard";
+export * from "./provisioning";
+export * from "./registration-extras";
+export * from "./suspension";

package/dist/workspaces/index.js

@@ -0,0 +1,23 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./billing-profile"), exports);
+__exportStar(require("./deletion"), exports);
+__exportStar(require("./free-workspace-guard"), exports);
+__exportStar(require("./provisioning"), exports);
+__exportStar(require("./registration-extras"), exports);
+__exportStar(require("./suspension"), exports);
+//# sourceMappingURL=index.js.map

package/dist/workspaces/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/workspaces/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAkC;AAClC,6CAA2B;AAC3B,yDAAuC;AACvC,iDAA+B;AAC/B,wDAAsC;AACtC,+CAA6B"}

package/dist/workspaces/provisioning-rollback.d.ts

@@ -0,0 +1,2 @@
+import type { WorkspaceProvisioningHandles } from "./provisioning";
+export declare function rollbackWorkspaceProvisioning(handles: WorkspaceProvisioningHandles): Promise<void>;

package/dist/workspaces/provisioning-rollback.js

@@ -0,0 +1,78 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rollbackWorkspaceProvisioning = rollbackWorkspaceProvisioning;
+const node_crypto_1 = require("node:crypto");
+const logging_1 = require("@antelopejs/interface-core/logging");
+const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
+const db_1 = require("@antelopejs/interface-dms/db");
+const hooks_1 = require("@antelopejs/interface-dms/hooks");
+const tenant_lifecycle_1 = require("@antelopejs/interface-dms/tenant-lifecycle");
+const db_2 = require("../db");
+const lifecycle_outbox_1 = require("../operator-actions/lifecycle-outbox");
+const stripe_1 = require("../stripe");
+const deletion_1 = require("./deletion");
+const provisioning_state_1 = require("./provisioning-state");
+async function rollbackWorkspaceProvisioning(handles) {
+    if (handles.mustPreserveWorkspace)
+        return;
+    handles.mustPreserveWorkspace = true;
+    try {
+        if (handles.tenantId)
+            await (0, tenant_lifecycle_1.closeTenantLifecycleAdmission)(handles.tenantId);
+        const finishCancellation = await admitRollbackCancellation(handles.tenantId);
+        if (handles.tenantId)
+            await (0, lifecycle_outbox_1.cancelWorkspaceCreated)(handles.tenantId);
+        const stripe = (0, stripe_1.getStripeClient)();
+        if (handles.stripeSubscriptionId)
+            await stripe.subscriptions.cancel(handles.stripeSubscriptionId);
+        if (handles.stripeCustomerId)
+            await stripe.customers.del(handles.stripeCustomerId);
+        const deletionOperationId = await finishCancellation();
+        if (handles.tenantId)
+            await deleteTenantRecords(handles.tenantId, deletionOperationId);
+        if (handles.trialConsumptionId)
+            await (0, interface_database_decorators_1.GetModel)(db_2.TrialConsumptionModel).delete(handles.trialConsumptionId);
+        if (handles.tenantId)
+            await (0, provisioning_state_1.recordProvisioningState)(handles, "cancelled");
+        handles.mustPreserveWorkspace = false;
+    }
+    catch (error) {
+        logging_1.Logging.Error(`[dms-saas:provisioning-rollback] ${handles.tenantId} requires reconciliation`, error);
+    }
+}
+async function admitRollbackCancellation(tenantId) {
+    if (!tenantId)
+        return async () => undefined;
+    const model = (0, interface_database_decorators_1.GetModel)(db_2.TenantSubscriptionModel, tenantId);
+    const subscription = await model.findOne();
+    if (!subscription)
+        return async () => undefined;
+    const operationId = (0, node_crypto_1.randomUUID)();
+    await model.beginTransition(subscription, {
+        operationId,
+        kind: "cancel",
+        targetPlanId: null,
+        requestedAt: new Date(),
+    });
+    return async () => {
+        const deletionStartedAt = new Date();
+        await model.completeTransition(subscription._id, operationId, {
+            deletionStartedAt,
+        });
+        return (0, deletion_1.getWorkspaceDeletionOperationId)(tenantId, {
+            _id: subscription._id,
+            deletionStartedAt,
+        });
+    };
+}
+async function deleteTenantRecords(tenantId, deletionOperationId) {
+    const tenantSubscriptionModel = (0, interface_database_decorators_1.GetModel)(db_2.TenantSubscriptionModel, tenantId);
+    await (0, hooks_1.ExecuteHooks)(hooks_1.Hook.TENANT_DELETED, tenantId, {
+        operationId: deletionOperationId ?? `provisioning-cancel:${tenantId}`,
+    });
+    const tenantBillingInfoModel = (0, interface_database_decorators_1.GetModel)(db_2.TenantBillingInfoModel, tenantId);
+    await (0, interface_database_decorators_1.GetModel)(db_1.TenantModel).delete(tenantId);
+    await tenantBillingInfoModel.deleteAll();
+    await tenantSubscriptionModel.deleteAll();
+}
+//# sourceMappingURL=provisioning-rollback.js.map

package/dist/workspaces/provisioning-rollback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioning-rollback.js","sourceRoot":"","sources":["../../src/workspaces/provisioning-rollback.ts"],"names":[],"mappings":";;AAkBA,sEA6BC;AA/CD,6CAAyC;AACzC,gEAA6D;AAC7D,6FAAqE;AACrE,qDAA2D;AAC3D,2DAAqE;AACrE,iFAA2F;AAC3F,8BAIe;AACf,2EAA8E;AAC9E,sCAA4C;AAC5C,yCAA6D;AAE7D,6DAA+D;AAGxD,KAAK,UAAU,6BAA6B,CACjD,OAAqC;IAErC,IAAI,OAAO,CAAC,qBAAqB;QAAE,OAAO;IAC1C,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IACrC,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAA,gDAA6B,EAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5E,MAAM,kBAAkB,GAAG,MAAM,yBAAyB,CACxD,OAAO,CAAC,QAAQ,CACjB,CAAC;QACF,IAAI,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAA,yCAAsB,EAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,IAAA,wBAAe,GAAE,CAAC;QACjC,IAAI,OAAO,CAAC,oBAAoB;YAC9B,MAAM,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAClE,IAAI,OAAO,CAAC,gBAAgB;YAC1B,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACvD,MAAM,mBAAmB,GAAG,MAAM,kBAAkB,EAAE,CAAC;QACvD,IAAI,OAAO,CAAC,QAAQ;YAClB,MAAM,mBAAmB,CAAC,OAAO,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;QACnE,IAAI,OAAO,CAAC,kBAAkB;YAC5B,MAAM,IAAA,wCAAQ,EAAC,0BAAqB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC3E,IAAI,OAAO,CAAC,QAAQ;YAAE,MAAM,IAAA,4CAAuB,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC1E,OAAO,CAAC,qBAAqB,GAAG,KAAK,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,iBAAO,CAAC,KAAK,CACX,oCAAoC,OAAO,CAAC,QAAQ,0BAA0B,EAC9E,KAAK,CACN,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,QAAiB;IAEjB,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;IAC5C,MAAM,KAAK,GAAG,IAAA,wCAAQ,EAAC,4BAAuB,EAAE,QAAQ,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;IAC3C,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;IAChD,MAAM,WAAW,GAAG,IAAA,wBAAU,GAAE,CAAC;IACjC,MAAM,KAAK,CAAC,eAAe,CAAC,YAAY,EAAE;QACxC,WAAW;QACX,IAAI,EAAE,QAAQ;QACd,YAAY,EAAE,IAAI;QAClB,WAAW,EAAE,IAAI,IAAI,EAAE;KACxB,CAAC,CAAC;IACH,OAAO,KAAK,IAAI,EAAE;QAChB,MAAM,iBAAiB,GAAG,IAAI,IAAI,EAAE,CAAC;QACrC,MAAM,KAAK,CAAC,kBAAkB,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE;YAC5D,iBAAiB;SAClB,CAAC,CAAC;QACH,OAAO,IAAA,0CAA+B,EAAC,QAAQ,EAAE;YAC/C,GAAG,EAAE,YAAY,CAAC,GAAG;YACrB,iBAAiB;SAClB,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,QAAgB,EAChB,mBAA4B;IAE5B,MAAM,uBAAuB,GAAG,IAAA,wCAAQ,EAAC,4BAAuB,EAAE,QAAQ,CAAC,CAAC;IAC5E,MAAM,IAAA,oBAAY,EAAC,YAAI,CAAC,cAAc,EAAE,QAAQ,EAAE;QAChD,WAAW,EAAE,mBAAmB,IAAI,uBAAuB,QAAQ,EAAE;KACtE,CAAC,CAAC;IACH,MAAM,sBAAsB,GAAG,IAAA,wCAAQ,EAAC,2BAAsB,EAAE,QAAQ,CAAC,CAAC;IAC1E,MAAM,IAAA,wCAAQ,EAAC,gBAAW,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,sBAAsB,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,uBAAuB,CAAC,SAAS,EAAE,CAAC;AAC5C,CAAC"}

package/dist/workspaces/provisioning-state.d.ts

@@ -0,0 +1,6 @@
+import type { Plan } from "../db";
+import type { ProvisioningAttemptState } from "./db/provisioning-attempt.table";
+import type { WorkspaceProvisioningHandles, WorkspaceProvisioningInput } from "./provisioning";
+export declare function beginProvisioningAttempt(input: WorkspaceProvisioningInput, plan: Plan): Promise<void>;
+export declare function recordProvisioningState(handles: WorkspaceProvisioningHandles, state?: ProvisioningAttemptState): Promise<void>;
+export declare function reserveTrialIdentities(handles: WorkspaceProvisioningHandles, emailHash: string, fingerprint: string | null): Promise<boolean>;

package/dist/workspaces/provisioning-state.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.beginProvisioningAttempt = beginProvisioningAttempt;
+exports.recordProvisioningState = recordProvisioningState;
+exports.reserveTrialIdentities = reserveTrialIdentities;
+const node_crypto_1 = require("node:crypto");
+const interface_api_util_1 = require("@antelopejs/interface-api-util");
+const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
+const card_capacity_model_1 = require("./db/card-capacity.model");
+const provisioning_attempt_model_1 = require("./db/provisioning-attempt.model");
+const trial_identity_model_1 = require("./db/trial-identity.model");
+const free_workspace_guard_1 = require("./free-workspace-guard");
+const HTTP_CONFLICT = 409;
+async function beginProvisioningAttempt(input, plan) {
+    const tenantId = (0, node_crypto_1.randomUUID)();
+    const fingerprint = input.card.fingerprint;
+    const capacityId = fingerprint && (0, free_workspace_guard_1.isFreePlan)(plan) ? (0, card_capacity_model_1.cardCapacityId)(fingerprint) : null;
+    input.handles.tenantId = tenantId;
+    input.handles.mustPreserveWorkspace = true;
+    await (0, interface_database_decorators_1.GetModel)(provisioning_attempt_model_1.ProvisioningAttemptModel).insert({
+        _id: tenantId,
+        revision: (0, node_crypto_1.randomUUID)(),
+        capacityId,
+        planId: plan._id,
+        userId: input.userId,
+        state: "preparing",
+        stripeCustomerId: null,
+        stripeSubscriptionId: null,
+        trialConsumptionId: null,
+        trialIdentityIds: [],
+        lastError: null,
+    });
+    if (capacityId && fingerprint) {
+        const admitted = await (0, interface_database_decorators_1.GetModel)(card_capacity_model_1.CardCapacityModel).reserve(capacityId, tenantId, await (0, free_workspace_guard_1.resolveMaxFreeWorkspacesPerCard)(), () => (0, free_workspace_guard_1.findFreeWorkspaceIdsBackedByCard)(fingerprint));
+        if (!admitted) {
+            await recordProvisioningState(input.handles, "cancelled");
+            input.handles.mustPreserveWorkspace = false;
+        }
+        (0, interface_api_util_1.assert)(admitted, HTTP_CONFLICT, "saas.errors.workspace.free_limit_reached");
+    }
+    input.handles.mustPreserveWorkspace = false;
+}
+async function recordProvisioningState(handles, state = "preparing") {
+    if (!handles.tenantId)
+        throw new Error("Provisioning identity is missing");
+    const model = (0, interface_database_decorators_1.GetModel)(provisioning_attempt_model_1.ProvisioningAttemptModel);
+    const current = await model.get(handles.tenantId);
+    if (!current)
+        throw new Error("Provisioning attempt is missing");
+    await model.advance(current, {
+        state,
+        stripeCustomerId: handles.stripeCustomerId ?? null,
+        stripeSubscriptionId: handles.stripeSubscriptionId ?? null,
+        trialConsumptionId: handles.trialConsumptionId ?? null,
+        trialIdentityIds: handles.trialIdentityIds ?? [],
+    });
+    if (state === "committed" && current.capacityId)
+        await (0, interface_database_decorators_1.GetModel)(card_capacity_model_1.CardCapacityModel).confirm(current.capacityId, current._id);
+    if (state === "cancelled") {
+        if (current.capacityId)
+            await (0, interface_database_decorators_1.GetModel)(card_capacity_model_1.CardCapacityModel).releaseCancelled(current.capacityId, current._id);
+        for (const id of current.trialIdentityIds)
+            await (0, interface_database_decorators_1.GetModel)(trial_identity_model_1.TrialIdentityModel).releaseUnused(id, current._id);
+    }
+}
+async function reserveTrialIdentities(handles, emailHash, fingerprint) {
+    if (!handles.tenantId)
+        throw new Error("Provisioning identity is missing");
+    const model = (0, interface_database_decorators_1.GetModel)(trial_identity_model_1.TrialIdentityModel);
+    const ids = [(0, trial_identity_model_1.trialIdentityId)("email", emailHash)];
+    if (fingerprint)
+        ids.push((0, trial_identity_model_1.trialIdentityId)("card", fingerprint));
+    handles.trialIdentityIds = ids;
+    handles.mustPreserveWorkspace = true;
+    await recordProvisioningState(handles);
+    const reserved = [];
+    for (const id of ids) {
+        if (!(await model.reserve(id, handles.tenantId))) {
+            for (const owned of reserved)
+                await model.releaseUnused(owned, handles.tenantId);
+            handles.trialIdentityIds = [];
+            await recordProvisioningState(handles);
+            return false;
+        }
+        reserved.push(id);
+    }
+    handles.trialIdentityIds = reserved;
+    await recordProvisioningState(handles);
+    return true;
+}
+//# sourceMappingURL=provisioning-state.js.map

package/dist/workspaces/provisioning-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provisioning-state.js","sourceRoot":"","sources":["../../src/workspaces/provisioning-state.ts"],"names":[],"mappings":";;AAqBA,4DAqCC;AAGD,0DA0BC;AAGD,wDA0BC;AApHD,6CAAyC;AACzC,uEAAwD;AACxD,6FAAqE;AAErE,kEAA6E;AAC7E,gFAA2E;AAE3E,oEAAgF;AAChF,iEAIgC;AAMhC,MAAM,aAAa,GAAG,GAAG,CAAC;AAGnB,KAAK,UAAU,wBAAwB,CAC5C,KAAiC,EACjC,IAAU;IAEV,MAAM,QAAQ,GAAG,IAAA,wBAAU,GAAE,CAAC;IAC9B,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC;IAC3C,MAAM,UAAU,GACd,WAAW,IAAI,IAAA,iCAAU,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAA,oCAAc,EAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,KAAK,CAAC,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAClC,KAAK,CAAC,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAC3C,MAAM,IAAA,wCAAQ,EAAC,qDAAwB,CAAC,CAAC,MAAM,CAAC;QAC9C,GAAG,EAAE,QAAQ;QACb,QAAQ,EAAE,IAAA,wBAAU,GAAE;QACtB,UAAU;QACV,MAAM,EAAE,IAAI,CAAC,GAAG;QAChB,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,WAAW;QAClB,gBAAgB,EAAE,IAAI;QACtB,oBAAoB,EAAE,IAAI;QAC1B,kBAAkB,EAAE,IAAI;QACxB,gBAAgB,EAAE,EAAE;QACpB,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;IACH,IAAI,UAAU,IAAI,WAAW,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,MAAM,IAAA,wCAAQ,EAAC,uCAAiB,CAAC,CAAC,OAAO,CACxD,UAAU,EACV,QAAQ,EACR,MAAM,IAAA,sDAA+B,GAAE,EACvC,GAAG,EAAE,CAAC,IAAA,uDAAgC,EAAC,WAAW,CAAC,CACpD,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,uBAAuB,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAC1D,KAAK,CAAC,OAAO,CAAC,qBAAqB,GAAG,KAAK,CAAC;QAC9C,CAAC;QACD,IAAA,2BAAM,EAAC,QAAQ,EAAE,aAAa,EAAE,0CAA0C,CAAC,CAAC;IAC9E,CAAC;IACD,KAAK,CAAC,OAAO,CAAC,qBAAqB,GAAG,KAAK,CAAC;AAC9C,CAAC;AAGM,KAAK,UAAU,uBAAuB,CAC3C,OAAqC,EACrC,QAAkC,WAAW;IAE7C,IAAI,CAAC,OAAO,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,IAAA,wCAAQ,EAAC,qDAAwB,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACjE,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE;QAC3B,KAAK;QACL,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,IAAI;QAClD,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,IAAI,IAAI;QAC1D,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,IAAI,IAAI;QACtD,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,EAAE;KACjD,CAAC,CAAC;IACH,IAAI,KAAK,KAAK,WAAW,IAAI,OAAO,CAAC,UAAU;QAC7C,MAAM,IAAA,wCAAQ,EAAC,uCAAiB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7E,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QAC1B,IAAI,OAAO,CAAC,UAAU;YACpB,MAAM,IAAA,wCAAQ,EAAC,uCAAiB,CAAC,CAAC,gBAAgB,CAChD,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,GAAG,CACZ,CAAC;QACJ,KAAK,MAAM,EAAE,IAAI,OAAO,CAAC,gBAAgB;YACvC,MAAM,IAAA,wCAAQ,EAAC,yCAAkB,CAAC,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAGM,KAAK,UAAU,sBAAsB,CAC1C,OAAqC,EACrC,SAAiB,EACjB,WAA0B;IAE1B,IAAI,CAAC,OAAO,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAG,IAAA,wCAAQ,EAAC,yCAAkB,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,CAAC,IAAA,sCAAe,EAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IAClD,IAAI,WAAW;QAAE,GAAG,CAAC,IAAI,CAAC,IAAA,sCAAe,EAAC,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;IAChE,OAAO,CAAC,gBAAgB,GAAG,GAAG,CAAC;IAC/B,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IACrC,MAAM,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YACjD,KAAK,MAAM,KAAK,IAAI,QAAQ;gBAC1B,MAAM,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YACrD,OAAO,CAAC,gBAAgB,GAAG,EAAE,CAAC;YAC9B,MAAM,uBAAuB,CAAC,OAAO,CAAC,CAAC;YACvC,OAAO,KAAK,CAAC;QACf,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,gBAAgB,GAAG,QAAQ,CAAC;IACpC,MAAM,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/workspaces/provisioning.d.ts

@@ -0,0 +1,49 @@
+import type { Plan, TenantBillingAddress } from "../db";
+export { rollbackWorkspaceProvisioning } from "./provisioning-rollback";
+export type WorkspaceCustomerType = "individual" | "business";
+export type WorkspaceAddressInput = Partial<Record<keyof TenantBillingAddress, string>>;
+export interface WorkspaceBillingProfile {
+    customerType: WorkspaceCustomerType;
+    companyName?: string;
+    vatNumber?: string;
+    address?: WorkspaceAddressInput;
+}
+export interface WorkspaceProvisioningPayload extends WorkspaceBillingProfile {
+    workspaceName: string;
+    planId: string;
+    paymentMethodId: string;
+    extras?: Record<string, unknown>;
+}
+export interface StripeCustomerProfile extends WorkspaceBillingProfile {
+    email: string;
+    fallbackName: string;
+    paymentMethodId: string;
+}
+export interface WorkspaceProvisioningHandles {
+    mustPreserveWorkspace?: boolean;
+    userId?: string;
+    tenantId?: string;
+    stripeCustomerId?: string;
+    stripeSubscriptionId?: string;
+    trialConsumptionId?: string;
+    trialIdentityIds?: string[];
+}
+export interface CardDetails {
+    fingerprint: string | null;
+    billingAddress: WorkspaceAddressInput | undefined;
+}
+export interface WorkspaceProvisioningInput {
+    userId: string;
+    payload: WorkspaceProvisioningPayload;
+    stripeCustomerProfile: StripeCustomerProfile;
+    card: CardDetails;
+    handles: WorkspaceProvisioningHandles;
+}
+export interface ProvisionedWorkspace {
+    tenantId: string;
+    isTrialing: boolean;
+}
+export declare function assertBillingCountry(address: WorkspaceAddressInput | undefined): void;
+export declare function ensurePlanIsAvailableForCustomer(planId: string, customerType: WorkspaceCustomerType): Promise<Plan>;
+export declare function resolveCardDetails(paymentMethodId: string): Promise<CardDetails>;
+export declare function provisionWorkspace(input: WorkspaceProvisioningInput): Promise<ProvisionedWorkspace>;

package/dist/workspaces/provisioning.js

@@ -0,0 +1,263 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rollbackWorkspaceProvisioning = void 0;
+exports.assertBillingCountry = assertBillingCountry;
+exports.ensurePlanIsAvailableForCustomer = ensurePlanIsAvailableForCustomer;
+exports.resolveCardDetails = resolveCardDetails;
+exports.provisionWorkspace = provisionWorkspace;
+const interface_api_util_1 = require("@antelopejs/interface-api-util");
+const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
+const db_1 = require("@antelopejs/interface-dms/db");
+const tenant_ownership_1 = require("@antelopejs/interface-dms/tenant-ownership");
+const tenant_lifecycle_1 = require("@antelopejs/interface-dms/tenant-lifecycle");
+const db_2 = require("@antelopejs/interface-dms/auth/db");
+const billing_state_1 = require("../billing-state");
+const db_3 = require("../db");
+const tenant_provisioning_1 = require("../hooks/tenant-provisioning");
+const lifecycle_outbox_1 = require("../operator-actions/lifecycle-outbox");
+const stripe_1 = require("../stripe");
+const utils_1 = require("../utils");
+const provisioning_state_1 = require("./provisioning-state");
+var provisioning_rollback_1 = require("./provisioning-rollback");
+Object.defineProperty(exports, "rollbackWorkspaceProvisioning", { enumerable: true, get: function () { return provisioning_rollback_1.rollbackWorkspaceProvisioning; } });
+const HTTP_BAD_REQUEST = 400;
+const HTTP_NOT_FOUND = 404;
+const ACTIVE_STATUS = "active";
+const TRIALING_STATUS = "trialing";
+const SEAT_BILLING_INITIAL_QUANTITY = 1;
+function assertBillingCountry(address) {
+    (0, interface_api_util_1.assert)(address?.country, HTTP_BAD_REQUEST, "saas.errors.billing.country_required");
+}
+async function ensurePlanIsAvailableForCustomer(planId, customerType) {
+    const plan = await (0, interface_database_decorators_1.GetModel)(db_3.PlanModel).get(planId);
+    (0, interface_api_util_1.assert)(plan && !plan.isDeleted && plan.isActive, HTTP_NOT_FOUND, "saas.errors.plan.not_available");
+    (0, interface_api_util_1.assert)(plan.audience === "any" || plan.audience === customerType, HTTP_BAD_REQUEST, "saas.errors.plan.not_available_for_customer_type");
+    return plan;
+}
+async function resolveCardDetails(paymentMethodId) {
+    const stripe = (0, stripe_1.getStripeClient)();
+    const paymentMethod = await stripe.paymentMethods.retrieve(paymentMethodId);
+    const address = paymentMethod.billing_details?.address;
+    return {
+        fingerprint: paymentMethod.card?.fingerprint ?? null,
+        billingAddress: address
+            ? {
+                line1: address.line1 ?? undefined,
+                line2: address.line2 ?? undefined,
+                postalCode: address.postal_code ?? undefined,
+                city: address.city ?? undefined,
+                state: address.state ?? undefined,
+                country: address.country ?? undefined,
+            }
+            : undefined,
+    };
+}
+async function createStripeCustomer(profile, handles) {
+    const stripe = (0, stripe_1.getStripeClient)();
+    const metadata = {
+        customerType: profile.customerType,
+    };
+    if (profile.vatNumber)
+        metadata.vatNumber = profile.vatNumber;
+    handles.mustPreserveWorkspace = true;
+    const customer = await stripe.customers.create({
+        email: profile.email,
+        name: profile.customerType === "business"
+            ? profile.companyName
+            : profile.fallbackName,
+        address: (0, stripe_1.toStripeAddress)(profile.address),
+        metadata: { ...metadata, provisioningAttempt: handles.tenantId ?? "" },
+    }, { idempotencyKey: `provisioning-customer:${handles.tenantId}` });
+    handles.stripeCustomerId = customer.id;
+    await (0, provisioning_state_1.recordProvisioningState)(handles);
+    await stripe.paymentMethods.attach(profile.paymentMethodId, {
+        customer: customer.id,
+    });
+    await stripe.customers.update(customer.id, {
+        invoice_settings: { default_payment_method: profile.paymentMethodId },
+    });
+    await (0, stripe_1.reconcileStripeTaxId)(customer.id, {
+        customerType: profile.customerType,
+        vatNumber: profile.vatNumber,
+        address: profile.address,
+    });
+    handles.mustPreserveWorkspace = false;
+    return customer.id;
+}
+function buildSubscriptionCreateParams(stripeCustomerId, stripePriceId, plan, grantTrial) {
+    const quantity = plan.billingMode === "seat" ? SEAT_BILLING_INITIAL_QUANTITY : undefined;
+    return {
+        customer: stripeCustomerId,
+        items: [{ price: stripePriceId, quantity }],
+        trial_period_days: grantTrial ? plan.trialDays : undefined,
+        automatic_tax: { enabled: true },
+        payment_behavior: "default_incomplete",
+    };
+}
+async function resolveTrialGrant(trialDays, emailHash, cardFingerprint, handles) {
+    if (trialDays <= 0)
+        return false;
+    const alreadyConsumed = await (0, interface_database_decorators_1.GetModel)(db_3.TrialConsumptionModel).existsForIdentity(emailHash, cardFingerprint);
+    return (!alreadyConsumed &&
+        (0, provisioning_state_1.reserveTrialIdentities)(handles, emailHash, cardFingerprint));
+}
+async function recordTrialConsumption(userId, emailHash, cardFingerprint, planId) {
+    const inserted = await (0, interface_database_decorators_1.GetModel)(db_3.TrialConsumptionModel).insert([
+        {
+            userId,
+            emailHash,
+            paymentFingerprint: cardFingerprint,
+            planId,
+            consumedAt: new Date(),
+        },
+    ]);
+    return inserted[0];
+}
+async function createSubscription(input) {
+    const { plan, handles } = input;
+    (0, interface_api_util_1.assert)(plan.paymentProviderRefs?.stripePriceId, HTTP_BAD_REQUEST, "saas.errors.plan.not_synced_with_stripe");
+    const emailHash = (0, utils_1.hashEmail)(input.email);
+    const grantTrial = await resolveTrialGrant(plan.trialDays, emailHash, input.cardFingerprint, handles);
+    handles.mustPreserveWorkspace = true;
+    const subscription = await (0, stripe_1.getStripeClient)().subscriptions.create(buildSubscriptionCreateParams(input.stripeCustomerId, plan.paymentProviderRefs.stripePriceId, plan, grantTrial), { idempotencyKey: `provisioning-subscription:${handles.tenantId}` });
+    handles.stripeSubscriptionId = subscription.id;
+    await (0, provisioning_state_1.recordProvisioningState)(handles);
+    if (grantTrial) {
+        handles.trialConsumptionId = await recordTrialConsumption(input.userId, emailHash, input.cardFingerprint, plan._id);
+        await (0, provisioning_state_1.recordProvisioningState)(handles);
+    }
+    handles.mustPreserveWorkspace = false;
+    return {
+        stripeSubscriptionId: subscription.id,
+        isTrialing: grantTrial,
+        currentPeriodEnd: (0, utils_1.stripeSecondsToDate)(subscription.current_period_end),
+        latestInvoiceId: typeof subscription.latest_invoice === "string"
+            ? subscription.latest_invoice
+            : (subscription.latest_invoice?.id ?? null),
+    };
+}
+async function settleSubscriptionPayment(subscription, tenantId, handles) {
+    const invoiceId = subscription.isTrialing
+        ? null
+        : subscription.latestInvoiceId;
+    handles.mustPreserveWorkspace = true;
+    await (0, provisioning_state_1.recordProvisioningState)(handles, "awaiting_payment");
+    await (0, lifecycle_outbox_1.prepareWorkspaceCreated)(tenantId, invoiceId);
+    if (!invoiceId)
+        return;
+    try {
+        const invoice = await (0, stripe_1.getStripeClient)().invoices.retrieve(invoiceId);
+        if (invoice.status === "paid")
+            return;
+        await (0, stripe_1.getStripeClient)().invoices.pay(invoiceId, { off_session: true }, {
+            idempotencyKey: `workspace-created:${tenantId}`,
+        });
+    }
+    catch (error) {
+        if (error instanceof Error &&
+            "type" in error &&
+            error.type === "StripeCardError") {
+            await (0, lifecycle_outbox_1.cancelWorkspaceCreated)(tenantId);
+            handles.mustPreserveWorkspace = false;
+        }
+        throw error;
+    }
+}
+async function insertTenantRecords(input) {
+    const { tenantId, payload, subscription } = input;
+    const tenantSubscriptionModel = (0, interface_database_decorators_1.GetModel)(db_3.TenantSubscriptionModel, tenantId);
+    const tenantBillingInfoModel = (0, interface_database_decorators_1.GetModel)(db_3.TenantBillingInfoModel, tenantId);
+    await tenantSubscriptionModel.insert([
+        {
+            planId: payload.planId,
+            status: subscription.isTrialing ? TRIALING_STATUS : ACTIVE_STATUS,
+            stripeCustomerId: input.stripeCustomerId,
+            stripeSubscriptionId: subscription.stripeSubscriptionId,
+            currentPeriodEnd: subscription.currentPeriodEnd,
+            cardFingerprint: input.cardFingerprint,
+            createdBy: input.userId,
+            createdAt: new Date(),
+            updatedAt: new Date(),
+        },
+    ]);
+    await tenantBillingInfoModel.insert([
+        {
+            customerType: payload.customerType,
+            companyName: payload.companyName ?? null,
+            vatNumber: payload.vatNumber ?? null,
+            billingEmail: input.billingEmail,
+            address: (0, stripe_1.toTenantBillingAddress)(payload.address),
+            updatedAt: new Date(),
+        },
+    ]);
+    await (0, billing_state_1.recomputeTenantBillingState)(tenantId);
+}
+async function createOwnedTenant(workspaceName, userId, handles) {
+    const tenantId = handles.tenantId;
+    if (!tenantId)
+        throw new Error("Provisioning intent must precede tenant creation");
+    return (0, tenant_lifecycle_1.runTenantLifecycleOperation)(tenantId, async () => {
+        await (0, lifecycle_outbox_1.beginWorkspaceCreation)(tenantId);
+        await (0, interface_database_decorators_1.GetModel)(db_1.TenantModel).insert([
+            {
+                _id: tenantId,
+                name: workspaceName,
+                createdAt: new Date(),
+                updatedAt: new Date(),
+            },
+        ]);
+        await (0, tenant_ownership_1.applyTenantOwnership)((0, interface_database_decorators_1.GetModel)(db_2.UserModel), userId, tenantId, {
+            roleIds: [],
+            isTenantOwner: true,
+        });
+        return tenantId;
+    });
+}
+async function provisionWorkspace(input) {
+    const plan = await (0, interface_database_decorators_1.GetModel)(db_3.PlanModel).get(input.payload.planId);
+    (0, interface_api_util_1.assert)(plan, HTTP_NOT_FOUND, "saas.errors.plan.not_available");
+    await (0, provisioning_state_1.beginProvisioningAttempt)(input, plan);
+    try {
+        const provisioned = await runProvisioning(input);
+        await (0, provisioning_state_1.recordProvisioningState)(input.handles, "committed");
+        return provisioned;
+    }
+    catch (error) {
+        await (0, provisioning_state_1.recordProvisioningState)(input.handles, "reconciliation_required").catch(() => { });
+        throw error;
+    }
+}
+async function runProvisioning(input) {
+    const { userId, payload, stripeCustomerProfile, card, handles } = input;
+    const plan = await (0, interface_database_decorators_1.GetModel)(db_3.PlanModel).get(payload.planId);
+    (0, interface_api_util_1.assert)(plan, HTTP_NOT_FOUND, "saas.errors.plan.not_available");
+    const stripeCustomerId = await createStripeCustomer(stripeCustomerProfile, handles);
+    const subscription = await createSubscription({
+        stripeCustomerId,
+        plan,
+        userId,
+        email: stripeCustomerProfile.email,
+        cardFingerprint: card.fingerprint,
+        handles,
+    });
+    handles.stripeSubscriptionId = subscription.stripeSubscriptionId;
+    const tenantId = await createOwnedTenant(payload.workspaceName, userId, handles);
+    await (0, tenant_lifecycle_1.runTenantLifecycleOperation)(tenantId, () => insertTenantRecords({
+        tenantId,
+        userId,
+        payload,
+        stripeCustomerId,
+        cardFingerprint: card.fingerprint,
+        subscription,
+        billingEmail: stripeCustomerProfile.email,
+    }));
+    await (0, tenant_provisioning_1.emitTenantBeingProvisioned)({
+        tenantId,
+        userId,
+        extras: payload.extras,
+    });
+    await settleSubscriptionPayment(subscription, tenantId, handles);
+    await (0, lifecycle_outbox_1.deliverWorkspaceCreated)(tenantId);
+    return { tenantId, isTrialing: subscription.isTrialing };
+}
+//# sourceMappingURL=provisioning.js.map