@flow-industries/id 0.26.2 → 0.26.4

package/dist/sdk/types/atproto-resolver.d.ts

@@ -0,0 +1,46 @@
+import type { Context } from "hono";
+import type { Caller } from "../caller";
+import type { AtprotoResolution } from "./atproto";
+import type { ManagedPdsState } from "./managed-provisioning";
+export type AtprotoMapping = Pick<AtprotoResolution, "flowUserId" | "did" | "identityVersion" | "lifecycle">;
+export type DidDocumentInput = {
+    id: string;
+    service?: unknown[];
+};
+export type AtprotoResolverDeps = {
+    testOrigin?: string;
+    resolveIdentity: (did: string, options: {
+        noCache: boolean;
+        signal: AbortSignal;
+    }) => Promise<{
+        did: string;
+        didDoc: DidDocumentInput;
+        handle: string;
+    }>;
+    assertPublicEndpoint: (endpoint: string) => Promise<void>;
+    authorization: (did: string, endpoint: string, signal: AbortSignal) => Promise<AtprotoResolution["authorization"]>;
+    flowPdsOrigins: ReadonlySet<string>;
+    ttlMs: number;
+    now?: () => number;
+};
+export type ManagedResolverState = {
+    lifecycle: ManagedPdsState;
+    identityVersion: number;
+};
+export type AtprotoResolverRouteDeps = {
+    admit: (userId: string) => Promise<boolean>;
+    resolveCaller: (context: Context) => Promise<Caller | null>;
+    activeAccountOf?: (headers: Headers) => Promise<string | null | undefined>;
+    readMapping: (userId: string) => Promise<AtprotoMapping>;
+    resolve: (mapping: AtprotoMapping, freshness: "cached" | "refresh", signal?: AbortSignal) => Promise<AtprotoResolution>;
+};
+export type AtprotoResolverAdmissionCaps = {
+    userHourly: number;
+    globalHourly: number;
+};
+export type AtprotoStoredGrant = {
+    sub: string;
+    aud: string;
+    iss: string;
+    expires_at?: string;
+};

package/dist/sdk/types/atproto.d.ts

@@ -1,5 +1,6 @@
 export type AtprotoStartRequest = {
     identifier: string;
+    invitationCode?: string;
     intent: "login" | "link";
     transaction?: string;
     expectedUserId?: string;
@@ -23,3 +24,24 @@ export type AtprotoStatus = {
     canUnlink: boolean;
     unlinkBlockReason: string | null;
 };
+export type AtprotoResolutionFailure = "SIGN_IN_REQUIRED" | "NO_AT_IDENTITY" | "PROVISIONING_PENDING" | "PROVISIONING_FAILED" | "ACCOUNT_CHANGED" | "UNSUPPORTED_DID_METHOD" | "IDENTITY_INVALID" | "RESOLUTION_UNAVAILABLE";
+export type AtprotoResolution = {
+    flowUserId: string;
+    did: string;
+    handle: string | null;
+    pdsUrl: string;
+    hosting: "flow" | "external";
+    lifecycle: "active" | "suspended" | "migrated" | "deletion_pending";
+    authorization: "connected" | "reconnect_required";
+    resolvedAt: string;
+    expiresAt: string;
+    identityVersion: string;
+};
+export type AtprotoResolveOptions = {
+    freshness?: "cached" | "refresh";
+    signal?: AbortSignal;
+};
+export type AtprotoApi = {
+    resolve(options?: AtprotoResolveOptions): Promise<AtprotoResolution>;
+    invalidate(): void;
+};

package/dist/sdk/types/auth.d.ts

@@ -1,5 +1,6 @@
 import type { JWTPayload } from "jose";
 import type { AuthEventName } from "./events";
+import type { ManagedPdsEnrollment } from "./managed-provisioning";
 export type FlowUser = {
     id: string;
     username: string;
@@ -74,6 +75,7 @@ export type AuthResponse = {
     additionalSessions?: AdditionalSession[];
 };
 export type AuthConfig = {
+    managedPdsEnabled?: boolean;
     atprotoEnabled?: boolean;
     rpId: string;
     rpName: string;
@@ -96,6 +98,7 @@ export type AuthResponseWithWebAuthn = AuthResponse & {
 export type PasskeyPluginOptions = {
     rpId: string;
     rpName?: string;
+    enrollManagedPds?: ManagedPdsEnrollment;
 };
 export type VerifyOptions = {
     audience: string;
@@ -169,6 +172,7 @@ export type PasskeyEnrollment = {
     credential: FlowCredential;
 };
 export type AccountRegistration = {
+    invitationCode?: string;
     username: string;
     email: string;
     subscribedToNews: boolean;

package/dist/sdk/types/dialog.d.ts

@@ -90,6 +90,9 @@ export type DialogState = {
     customLabels?: DialogCustomLabels;
 };
 export type SignUpProps = {
+    managedPdsEnabled?: boolean;
+    invitationCode?: string;
+    invitation?: import("react").ReactNode;
     verifiedEmail?: {
         email: string;
         nonce: string;

package/dist/sdk/types/hosted-oauth.d.ts

@@ -0,0 +1,23 @@
+import type { AppDb } from "../db/handle";
+export interface HostedOAuthTransaction {
+    issuer: string;
+    pds: string;
+    requestUri: string;
+    deviceId: string;
+    clientId: string;
+}
+export interface HostedOAuthMapping {
+    did: string;
+    pds: string;
+    version: string;
+}
+/** Called under the canonical user lock; returns only active managed identities. */
+export type HostedOAuthMappingReader = (database: AppDb, userId: string) => Promise<HostedOAuthMapping | null>;
+export interface HostedOAuthProofOptions {
+    testOrigin?: string;
+    issuer: string;
+    pds: string;
+    lifetimeMs: number;
+    maximumPendingProofs: number;
+    readMapping: HostedOAuthMappingReader;
+}

package/dist/sdk/types/hosting-quota.d.ts

@@ -0,0 +1,28 @@
+export interface HostingQuotaPolicy {
+    totalBytes: number;
+    uploadBytes: number;
+    scratchBytes: number;
+    concurrentUploads: number;
+}
+export interface HostingQuotaReservation {
+    bytes: number;
+    fence: number;
+    expiresAt: number;
+    state: "active" | "cleanup";
+}
+export interface HostingQuotaLedger {
+    revision: number;
+    nextFence: number;
+    certain: boolean;
+    recordBytes: number;
+    blobs: Record<string, number>;
+    deletionDebt: Record<string, {
+        bytes: number;
+        fence: number;
+    }>;
+    reservations: Record<string, HostingQuotaReservation>;
+}
+export interface HostingQuotaAdmission {
+    ledger: HostingQuotaLedger;
+    fence: number;
+}

package/dist/sdk/types/index.d.ts

@@ -1,6 +1,7 @@
 export type { AccountDeleteRequest, AccountDeleteResponse, AccountErasureCounts, AccountErasureEntry, AccountErasureFeed, AccountErasureResult, AccountExport, AccountExportAccount, AccountExportActionEvent, AccountExportActionSession, AccountExportAttendance, AccountExportAuthoredEvent, AccountExportCharacterStateTime, AccountExportFollow, AccountExportGameEvent, AccountExportNotification, AccountExportOtherService, AccountExportOwnedRoom, AccountExportPasskey, AccountExportRoomEvents, AccountExportRoomMembership, AccountExportRoomPlayerState, AccountExportRoomPresence, AccountExportRoomRestriction, AccountExportRoomSettings, AccountExportRooms, AccountExportRsvp, AccountExportSettingsSurface, AccountExportStudySubject, AccountExportXpGrant, AccountExportXpSummary, } from "./account-data";
 export type { ActionCurve, ActionEventRequest, ActionEventResponse, ActionsApi, ActiveActionState, FinishActionRequest, ListStudySessionsOptions, ListStudySubjectsOptions, StartActionInput, StartActionResult, StudyApi, StudySubjectResponse, UseActiveActionOptions, XpEstimateContext, } from "./actions";
-export type { AtprotoCompletion, AtprotoStartRequest, AtprotoStatus, } from "./atproto";
+export type { AtprotoApi, AtprotoCompletion, AtprotoResolution, AtprotoResolutionFailure, AtprotoResolveOptions, AtprotoStartRequest, AtprotoStatus, } from "./atproto";
+export type { AtprotoMapping, AtprotoResolverAdmissionCaps, AtprotoResolverDeps, AtprotoResolverRouteDeps, AtprotoStoredGrant, DidDocumentInput, ManagedResolverState, } from "./atproto-resolver";
 export type { AccountRegistration, AccountSession, AccountSessionsResponse, AdditionalSession, AuthConfig, AuthorizationTransaction, AuthPageBootstrap, AuthResponse, AuthResponseWithWebAuthn, BioNormalization, BioRejection, BioWriteRefusal, BioWriteResult, FlowCredential, FlowUser, PasskeyEnrollment, PasskeyPluginOptions, RevokeAllSessionsResponse, RevokeSessionResponse, SecurityActivityEntry, SecurityActivityResponse, SessionUser, VerifiedFlowJWT, VerifyOptions, WebAuthnSignature, } from "./auth";
 export type { BrowserAccount, BrowserAccounts } from "./browser-accounts";
 export type { BodyRegion, CosmeticItem, CosmeticMaterial, CosmeticPaint, CosmeticSlot, EquipConflict, EquippedCosmetic, EquippedCosmetics, EquipRegion, PaintSlot, SettingsConflict, } from "./cosmetics";
@@ -10,7 +11,10 @@ export type { AuthErrorCode, AuthEventName, AuthEventRecord, AuthMode, AuthOutco
 export type { ActiveAction, CatalogFieldRef, ClockAnchor, FinishedSummary, FocusApi, FocusPhase, FocusSessionEvent, FocusSessionState, StartFocusRequest, StudySearchHit, } from "./focus";
 export type { GameEventReport, GameLifecycleEventName, GameLifecycleFeedEvent, GameLifecycleFeedPage, GamePlayerSession, } from "./game";
 export { GAME_LIFECYCLE_EVENT_NAMES } from "./game";
+export type { HostedOAuthMapping, HostedOAuthMappingReader, HostedOAuthProofOptions, HostedOAuthTransaction, } from "./hosted-oauth";
+export type { HostingQuotaAdmission, HostingQuotaLedger, HostingQuotaPolicy, HostingQuotaReservation, } from "./hosting-quota";
 export type { AccountProfileData } from "./landing";
+export type * from "./managed-provisioning";
 export type { Bridge, BridgeParameters, FlowAccount, FlowRemote, FlowRemoteConfig, FromWindowOptions, MessageResponse, Messenger, OneOf, Payload, QueuedRequest, ReadyOptions, RemoteFlowState, RemoteState, Schema, Storage, Topic, WithReady, } from "./messenger";
 export type { MarkNotificationsReadInput, NotificationCounts, NotificationEntry, NotificationPage, NotificationReadResult, NotificationRefusal, } from "./notifications";
 export type { OtpVerificationFailure, OtpVerificationResult, VerificationAdapter, } from "./otp";

package/dist/sdk/types/managed-provisioning.d.ts

@@ -0,0 +1,51 @@
+import type { AppDb } from "../db/handle";
+/** Queues a reservation in the enrollment transaction; remote provisioning runs after commit. */
+export type ManagedPdsEnrollment = (database: AppDb, userId: string) => Promise<void>;
+export type ManagedPdsState = "queued" | "provisioning" | "active" | "failed" | "suspended" | "migrated" | "deletion_pending";
+export interface ManagedPdsReservation {
+    operationId: string;
+    handle: string;
+    pdsEndpoint: string;
+    inviteReference: string;
+}
+export interface ManagedPdsIdentity {
+    did: string;
+    handle: string;
+    pdsEndpoint: string;
+}
+export type ManagedPdsRecovery = {
+    outcome: "committed";
+    identity: ManagedPdsIdentity;
+} | {
+    outcome: "absent";
+} | {
+    outcome: "pending";
+};
+/**
+ * Server-only adapter for an authenticated operator API. It must durably bind
+ * operationId to key material before PLC publication and replay the same DID
+ * through every crash boundary. Stock createAccount does not implement this.
+ */
+export interface ManagedPdsProvisioner {
+    contract: "durable-operation-idempotency-v1";
+    remove?(reservation: ManagedPdsReservation & {
+        did: string | null;
+    }): Promise<void>;
+    recover(reservation: ManagedPdsReservation): Promise<ManagedPdsRecovery>;
+    create(reservation: ManagedPdsReservation): Promise<ManagedPdsIdentity>;
+}
+export interface ManagedPdsWorkerLimits {
+    leaseMs: number;
+    maxAttempts: number;
+}
+export type ManagedPdsConfig = {
+    endpoint: string;
+    operatorEndpoint: string;
+    operatorToken: string;
+};
+export interface ManagedPdsTickReport {
+    active: number;
+    failed: number;
+    idle: number;
+    deleted?: number;
+}

package/dist/sdk/types/sdk.d.ts

@@ -2,6 +2,7 @@ import type { ReactNode } from "react";
 import type { Chain, Hex, PrepareTransactionRequestParameters, SendTransactionParameters, SignTypedDataParameters, Transport, WalletClient } from "viem";
 import type { SendCallsParameters } from "viem/actions";
 import type { RawValue } from "../json";
+import type { AtprotoApi } from "./atproto";
 import type { AdditionalSession, FlowCredential, FlowUser, WebAuthnSignature } from "./auth";
 import type { BrowserAccount, BrowserAccounts } from "./browser-accounts";
 import type { ConnectCapabilities } from "./protocol";
@@ -377,6 +378,7 @@ export type Flow = {
     }): Promise<WalletClient>;
     /** Typed client for the room registry (browse, membership, settings, moderation). */
     rooms: RoomsApi;
+    atproto: AtprotoApi;
     subscribe(listener: Listener<FlowState>): () => void;
     getState(): FlowState;
     dialog: DialogHost;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flow-industries/id",
-  "version": "0.26.2",
+  "version": "0.26.4",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -76,6 +76,7 @@
     "prepublishOnly": "bun run build:sdk",
     "start": "bun run src/index.ts",
     "worker": "bun run src/worker.ts",
+    "worker:managed-pds": "bun run src/managed-pds-worker.ts",
     "db:generate": "bunx @better-auth/cli generate",
     "db:migrate:gen": "bunx drizzle-kit generate",
     "db:migrate": "bun scripts/db-migrate.ts",
@@ -149,10 +150,11 @@
   ],
   "dependencies": {
     "@atproto-labs/handle-resolver": "^0.4.9",
+    "@atproto-labs/identity-resolver": "0.4.9",
     "@atproto/jwk-jose": "^0.2.4",
     "@atproto/oauth-client": "^0.8.7",
     "@aws-sdk/client-s3": "^3.1073.0",
-    "@flow-industries/ui": "^0.23.3",
+    "@flow-industries/ui": "0.23.4",
     "@hono/otel": "^1.1.2",
     "@openobserve/browser-logs": "^0.3.1",
     "@openobserve/browser-rum": "^0.3.1",