@fabricorg/experience-gateway 2.1.5 → 2.1.7

package/dist/index.d.ts

@@ -1,64 +1,64 @@
-import { SubmitActionResult, SubmitActionInput, GovernedActionHost } from '@fabricorg/platform-host';
-import { ProjectionHost } from '@fabricorg/projection-host';
-import { ActorClaims, IdentityPort } from '@fabricorg/ports';
-import { ExperienceIntentRequest, ExperienceReadRequest } from '@fabricorg/experience-runtime';
-import { ExperienceScope, ExperienceServerRuntime } from '@fabricorg/experience-runtime/server';
-
-interface TrustedExperienceRequestContext {
-    /** Presented only to IdentityPort and never persisted or forwarded. */
-    credential: string;
-    tenantId: string;
-    spaceId: string;
+import { GovernedActionHost, SubmitActionInput, SubmitActionResult } from "@fabricorg/platform-host";
+import { ActorClaims, IdentityPort } from "@fabricorg/ports";
+import { ProjectionHost } from "@fabricorg/projection-host";
+import { ExperienceIntentRequest, ExperienceReadRequest } from "@fabricorg/experience-runtime";
+import { ExperienceScope, ExperienceServerRuntime } from "@fabricorg/experience-runtime/server";
+//#region index.d.ts
+export interface TrustedExperienceRequestContext {
+  /** Presented only to IdentityPort and never persisted or forwarded. */
+  credential: string;
+  tenantId: string;
+  spaceId: string;
 }
-interface ExperienceGateway {
-    invoke(input: {
-        context: TrustedExperienceRequestContext;
-        request: ExperienceIntentRequest;
-        executionReason?: "initial" | "offline_replay";
-        /**
-         * When the operator acted, for a replay. Required whenever
-         * `executionReason` is `offline_replay`: reading it through an untyped
-         * cast made omitting it the easy mistake, and omitting it silently
-         * stamped receipt time into durable capture evidence.
-         */
-        capturedAt?: string;
-    }): Promise<SubmitActionResult>;
-    read(input: {
-        context: TrustedExperienceRequestContext;
-        request: ExperienceReadRequest;
-    }): Promise<{
-        data: unknown;
-        evidence: {
-            releaseDigest: string;
-            assemblyDigest: string;
-            eventCursor: string | null;
-            source: "cache" | "replay";
-        };
-    }>;
+export interface ExperienceGateway {
+  invoke(input: {
+    context: TrustedExperienceRequestContext;
+    request: ExperienceIntentRequest;
+    executionReason?: "initial" | "offline_replay";
+    /**
+     * When the operator acted, for a replay. Required whenever
+     * `executionReason` is `offline_replay`: reading it through an untyped
+     * cast made omitting it the easy mistake, and omitting it silently
+     * stamped receipt time into durable capture evidence.
+     */
+    capturedAt?: string;
+  }): Promise<SubmitActionResult>;
+  read(input: {
+    context: TrustedExperienceRequestContext;
+    request: ExperienceReadRequest;
+  }): Promise<{
+    data: unknown;
+    evidence: {
+      releaseDigest: string;
+      assemblyDigest: string;
+      eventCursor: string | null;
+      source: "cache" | "replay";
+    };
+  }>;
 }
-interface ExperienceAdmissionInput {
-    kind: "invoke" | "read";
-    scope: ExperienceScope;
-    claims: ActorClaims;
-    planId: string;
-    fragmentId: string;
-    /** The event or binding name the client named; the capability it resolves to is not yet known. */
-    name: string;
+export interface ExperienceAdmissionInput {
+  kind: "invoke" | "read";
+  scope: ExperienceScope;
+  claims: ActorClaims;
+  planId: string;
+  fragmentId: string;
+  /** The event or binding name the client named; the capability it resolves to is not yet known. */
+  name: string;
 }
-type ExperienceAdmissionDecision = {
-    allowed: true;
+export type ExperienceAdmissionDecision = {
+  allowed: true;
 } | {
-    allowed: false;
-    reason: string;
-    retryAfterMs?: number;
+  allowed: false;
+  reason: string;
+  retryAfterMs?: number;
 };
 /** A request the edge would not admit. `retryable` is true when a later attempt may be admitted. */
-declare class ExperienceAdmissionError extends Error {
-    readonly reason: string;
-    readonly retryAfterMs?: number | undefined;
-    readonly code: "EXPERIENCE_ADMISSION_REFUSED";
-    constructor(reason: string, retryAfterMs?: number | undefined);
-    get retryable(): boolean;
+export declare class ExperienceAdmissionError extends Error {
+  readonly reason: string;
+  readonly retryAfterMs?: number | undefined;
+  readonly code: "EXPERIENCE_ADMISSION_REFUSED";
+  constructor(reason: string, retryAfterMs?: number | undefined);
+  get retryable(): boolean;
 }
 /**
  * A reference admission policy: a token bucket per key, refilled over time.
@@ -66,101 +66,100 @@ declare class ExperienceAdmissionError extends Error {
  * Enough to throttle a tenant or an actor at the edge; a deployment with a
  * shared limiter puts it behind the same option. Keys default to the tenant.
  */
-declare function createTokenBucketAdmission(options: {
-    capacity: number;
-    refillPerSecond: number;
-    key?(input: ExperienceAdmissionInput): string;
-    now?(): number;
+export declare function createTokenBucketAdmission(options: {
+  capacity: number;
+  refillPerSecond: number;
+  key?(input: ExperienceAdmissionInput): string;
+  now?(): number;
 }): (input: ExperienceAdmissionInput) => ExperienceAdmissionDecision;
-interface ExperienceGatewayConformanceSubject {
-    gateway: ExperienceGateway;
-    validIntent: Parameters<ExperienceGateway["invoke"]>[0];
-    deniedIntent: Parameters<ExperienceGateway["invoke"]>[0];
-    validRead: Parameters<ExperienceGateway["read"]>[0];
-    /**
-     * What the governed hosts actually saw.
-     *
-     * A returned invocation id proves only that a string was produced. The
-     * point of a gateway is that mutations reach `PlatformHost.submitAction` and
-     * reads reach `ProjectionHost.project`; a replacement that fabricates an id
-     * and queries the database directly satisfies every observable contract
-     * except this one, so the subject has to report the calls.
-     */
-    observed: {
-        submitActionCount(): number;
-        projectionCount(): number;
-    };
-    /**
-     * An intent the deployment's admission policy refuses. Optional so an
-     * existing subject still compiles; without it the admission check reports
-     * `skipped` and says what was not proven, since a deployment that cannot
-     * show one refusal has not configured admission.
-     */
-    throttledIntent?: Parameters<ExperienceGateway["invoke"]>[0];
+export interface ExperienceGatewayConformanceSubject {
+  gateway: ExperienceGateway;
+  validIntent: Parameters<ExperienceGateway["invoke"]>[0];
+  deniedIntent: Parameters<ExperienceGateway["invoke"]>[0];
+  validRead: Parameters<ExperienceGateway["read"]>[0];
+  /**
+   * What the governed hosts actually saw.
+   *
+   * A returned invocation id proves only that a string was produced. The
+   * point of a gateway is that mutations reach `PlatformHost.submitAction` and
+   * reads reach `ProjectionHost.project`; a replacement that fabricates an id
+   * and queries the database directly satisfies every observable contract
+   * except this one, so the subject has to report the calls.
+   */
+  observed: {
+    submitActionCount(): number;
+    projectionCount(): number;
+  };
+  /**
+   * An intent the deployment's admission policy refuses. Optional so an
+   * existing subject still compiles; without it the admission check reports
+   * `skipped` and says what was not proven, since a deployment that cannot
+   * show one refusal has not configured admission.
+   */
+  throttledIntent?: Parameters<ExperienceGateway["invoke"]>[0];
 }
-interface ExperienceGatewayCheck {
-    id: "fabric.experience.gateway-host-routing.v1" | "fabric.experience.gateway-scope-denial.v1" | "fabric.experience.gateway-projection-routing.v1" | "fabric.experience.gateway-admission-refusal.v1";
-    run(subject: ExperienceGatewayConformanceSubject): Promise<string[]>;
+export interface ExperienceGatewayCheck {
+  id: "fabric.experience.gateway-host-routing.v1" | "fabric.experience.gateway-scope-denial.v1" | "fabric.experience.gateway-projection-routing.v1" | "fabric.experience.gateway-admission-refusal.v1";
+  run(subject: ExperienceGatewayConformanceSubject): Promise<string[]>;
 }
-declare function experienceGatewayChecks(): readonly ExperienceGatewayCheck[];
-declare function runExperienceGatewayChecks(subject: ExperienceGatewayConformanceSubject, checks?: readonly ExperienceGatewayCheck[]): Promise<{
-    passed: boolean;
-    checks: Array<{
-        id: ExperienceGatewayCheck["id"];
-        status: "passed" | "failed" | "skipped";
-        evidence: string[];
-        error?: string;
-    }>;
+export declare function experienceGatewayChecks(): readonly ExperienceGatewayCheck[];
+export declare function runExperienceGatewayChecks(subject: ExperienceGatewayConformanceSubject, checks?: readonly ExperienceGatewayCheck[]): Promise<{
+  passed: boolean;
+  checks: Array<{
+    id: ExperienceGatewayCheck["id"];
+    status: "passed" | "failed" | "skipped";
+    evidence: string[];
+    error?: string;
+  }>;
 }>;
-interface InitiatingReleaseEvidence {
-    bind(input: SubmitActionInput, releaseDigest: string): void;
-    resolve(input: SubmitActionInput): string | undefined;
-    release(input: SubmitActionInput): void;
+export interface InitiatingReleaseEvidence {
+  bind(input: SubmitActionInput, releaseDigest: string): void;
+  resolve(input: SubmitActionInput): string | undefined;
+  release(input: SubmitActionInput): void;
 }
 /**
  * Creates an instance-scoped, non-serializable evidence seam. The Host's
  * `composition.resolveInitiatingReleaseDigest` reads this WeakMap using the
  * exact submission object. A browser field cannot populate or forge it.
  */
-declare function createInitiatingReleaseEvidence(): InitiatingReleaseEvidence;
-declare function createExperienceGateway(options: {
-    identity: IdentityPort;
-    runtime: ExperienceServerRuntime;
-    host: Pick<GovernedActionHost, "submitAction">;
-    projectionHost: Pick<ProjectionHost, "project">;
-    evidence: InitiatingReleaseEvidence;
-    assemblyDigest: string;
-    actionVersion(actionId: `${string}.${string}`): number | undefined;
-    nextCorrelationId(): string;
-    /**
-     * How old an offline capture may be and still replay.
-     *
-     * Required to accept replay at all. The Host's own staleness check is
-     * conditional on the capture-authority adapter supplying an `expiresAt`, and
-     * is skipped entirely for actions governed at capture time, so without this
-     * a client-reported instant has no lower bound.
-     */
-    maxOfflineReplayAgeMs?: number;
-    /**
-     * Admission control at the edge, decided after the credential is verified
-     * and before anything governed is touched. Per-tenant request budgets,
-     * render-cost quotas, and abuse throttles live here, as a seam the
-     * deployment fills; the gateway itself imposes no policy. A refusal
-     * surfaces as `ExperienceAdmissionError`, carrying `retryAfterMs` when the
-     * caller should come back rather than give up.
-     */
-    admission?(input: ExperienceAdmissionInput): Promise<ExperienceAdmissionDecision> | ExperienceAdmissionDecision;
-    captureAuthority?(input: {
-        actionId: `${string}.${string}`;
-        scope: ExperienceScope;
-        parameters: Record<string, unknown>;
-        parameterDigest: string;
-        capturedAt: string;
-    }): Promise<{
-        id: string;
-        expiresAt?: string;
-    }>;
-    now?: () => Date;
+export declare function createInitiatingReleaseEvidence(): InitiatingReleaseEvidence;
+export declare function createExperienceGateway(options: {
+  identity: IdentityPort;
+  runtime: ExperienceServerRuntime;
+  host: Pick<GovernedActionHost, "submitAction">;
+  projectionHost: Pick<ProjectionHost, "project">;
+  evidence: InitiatingReleaseEvidence;
+  assemblyDigest: string;
+  actionVersion(actionId: `${string}.${string}`): number | undefined;
+  nextCorrelationId(): string;
+  /**
+   * How old an offline capture may be and still replay.
+   *
+   * Required to accept replay at all. The Host's own staleness check is
+   * conditional on the capture-authority adapter supplying an `expiresAt`, and
+   * is skipped entirely for actions governed at capture time, so without this
+   * a client-reported instant has no lower bound.
+   */
+  maxOfflineReplayAgeMs?: number;
+  /**
+   * Admission control at the edge, decided after the credential is verified
+   * and before anything governed is touched. Per-tenant request budgets,
+   * render-cost quotas, and abuse throttles live here, as a seam the
+   * deployment fills; the gateway itself imposes no policy. A refusal
+   * surfaces as `ExperienceAdmissionError`, carrying `retryAfterMs` when the
+   * caller should come back rather than give up.
+   */
+  admission?(input: ExperienceAdmissionInput): Promise<ExperienceAdmissionDecision> | ExperienceAdmissionDecision;
+  captureAuthority?(input: {
+    actionId: `${string}.${string}`;
+    scope: ExperienceScope;
+    parameters: Record<string, unknown>;
+    parameterDigest: string;
+    capturedAt: string;
+  }): Promise<{
+    id: string;
+    expiresAt?: string;
+  }>;
+  now?: () => Date;
 }): ExperienceGateway;
-
-export { type ExperienceAdmissionDecision, ExperienceAdmissionError, type ExperienceAdmissionInput, type ExperienceGateway, type ExperienceGatewayCheck, type ExperienceGatewayConformanceSubject, type InitiatingReleaseEvidence, type TrustedExperienceRequestContext, createExperienceGateway, createInitiatingReleaseEvidence, createTokenBucketAdmission, experienceGatewayChecks, runExperienceGatewayChecks };
+//#endregion