@flow-industries/id 0.26.3 → 0.26.4

package/dist/sdk/db/invitations.js

@@ -0,0 +1,42 @@
+import { sql } from "drizzle-orm";
+import { boolean, check, index, integer, pgTable, text, timestamp, } from "drizzle-orm/pg-core";
+import { user } from "./schema";
+export const signupPolicy = pgTable("signup_policy", {
+    id: integer("id").primaryKey(),
+    invitationOnly: boolean("invitation_only").notNull().default(false),
+    updatedBy: text("updated_by").references(() => user.id, {
+        onDelete: "set null",
+    }),
+    updatedAt: timestamp("updated_at").notNull().defaultNow(),
+}, (table) => [check("signup_policy_singleton", sql `${table.id} = 1`)]);
+export const invitation = pgTable("invitation", {
+    id: text("id").primaryKey(),
+    codeHash: text("code_hash").notNull().unique(),
+    inviterId: text("inviter_id").references(() => user.id, {
+        onDelete: "set null",
+    }),
+    createdBy: text("created_by").references(() => user.id, {
+        onDelete: "set null",
+    }),
+    maxUses: integer("max_uses").notNull().default(1),
+    usedCount: integer("used_count").notNull().default(0),
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+    expiresAt: timestamp("expires_at").notNull(),
+    revokedAt: timestamp("revoked_at"),
+}, (table) => [
+    check("invitation_capacity", sql `${table.maxUses} between 1 and 100 and ${table.usedCount} between 0 and ${table.maxUses}`),
+]);
+export const invitationRedemption = pgTable("invitation_redemption", {
+    userId: text("user_id")
+        .primaryKey()
+        .references(() => user.id, { onDelete: "cascade" }),
+    invitationId: text("invitation_id")
+        .notNull()
+        .references(() => invitation.id),
+    inviterId: text("inviter_id").references(() => user.id, {
+        onDelete: "set null",
+    }),
+    redeemedAt: timestamp("redeemed_at").notNull().defaultNow(),
+}, (table) => [
+    index("invitation_redemption_invitation_idx").on(table.invitationId),
+]);

package/dist/sdk/db/schema.d.ts

@@ -4951,3 +4951,251 @@ export declare const oauthState: import("drizzle-orm/pg-core").PgTableWithColumn
     };
     dialect: "pg";
 }>;
+export declare const managedPdsOperation: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "managed_pds_operation";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "managed_pds_operation";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        userId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "user_id";
+            tableName: "managed_pds_operation";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        handle: import("drizzle-orm/pg-core").PgColumn<{
+            name: "handle";
+            tableName: "managed_pds_operation";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        inviteReference: import("drizzle-orm/pg-core").PgColumn<{
+            name: "invite_reference";
+            tableName: "managed_pds_operation";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        state: import("drizzle-orm/pg-core").PgColumn<{
+            name: "state";
+            tableName: "managed_pds_operation";
+            dataType: "string";
+            columnType: "PgText";
+            data: import("../types").ManagedPdsState;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: import("../types").ManagedPdsState;
+        }>;
+        did: import("drizzle-orm/pg-core").PgColumn<{
+            name: "did";
+            tableName: "managed_pds_operation";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        pdsEndpoint: import("drizzle-orm/pg-core").PgColumn<{
+            name: "pds_endpoint";
+            tableName: "managed_pds_operation";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        identityVersion: import("drizzle-orm/pg-core").PgColumn<{
+            name: "identity_version";
+            tableName: "managed_pds_operation";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        fence: import("drizzle-orm/pg-core").PgColumn<{
+            name: "fence";
+            tableName: "managed_pds_operation";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        attempts: import("drizzle-orm/pg-core").PgColumn<{
+            name: "attempts";
+            tableName: "managed_pds_operation";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        leaseUntil: import("drizzle-orm/pg-core").PgColumn<{
+            name: "lease_until";
+            tableName: "managed_pds_operation";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        failureCode: import("drizzle-orm/pg-core").PgColumn<{
+            name: "failure_code";
+            tableName: "managed_pds_operation";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "managed_pds_operation";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_at";
+            tableName: "managed_pds_operation";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+export { invitation, invitationRedemption, signupPolicy } from "./invitations";

package/dist/sdk/db/schema.js

@@ -876,3 +876,28 @@ export const oauthState = pgTable("oauth_state", {
     data: text("data").notNull(),
     expiresAt: timestamp("expires_at").notNull(),
 }, (table) => [primaryKey({ columns: [table.providerId, table.id] })]);
+export const managedPdsOperation = pgTable("managed_pds_operation", {
+    id: text("id").primaryKey(),
+    userId: text("user_id").references(() => user.id, { onDelete: "set null" }),
+    handle: text("handle").notNull(),
+    inviteReference: text("invite_reference").notNull(),
+    state: text("state")
+        .$type()
+        .notNull()
+        .default("queued"),
+    did: text("did"),
+    pdsEndpoint: text("pds_endpoint").notNull(),
+    identityVersion: integer("identity_version").notNull().default(1),
+    fence: integer("fence").notNull().default(0),
+    attempts: integer("attempts").notNull().default(0),
+    leaseUntil: timestamp("lease_until"),
+    failureCode: text("failure_code"),
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+    updatedAt: timestamp("updated_at").notNull().defaultNow(),
+}, (table) => [
+    uniqueIndex("managed_pds_user_idx").on(table.userId),
+    uniqueIndex("managed_pds_handle_idx").on(table.handle),
+    uniqueIndex("managed_pds_did_idx").on(table.did),
+    index("managed_pds_work_idx").on(table.state, table.leaseUntil),
+]);
+export { invitation, invitationRedemption, signupPolicy } from "./invitations";

package/dist/sdk/session-view.d.ts

@@ -0,0 +1,15 @@
+import type { SessionUser } from "./types";
+/** The audience a session was minted for. */
+export declare const audienceOf: <T>(session: T) => string | undefined;
+/** A session's own id. */
+export declare const sessionIdOf: <T>(session: T) => string | undefined;
+/** Whether the account is a guest. Absent means "not a guest". */
+export declare const isGuestOf: <T>(user: T) => boolean;
+/** The account's username. */
+export declare const usernameOf: <T>(user: T) => string | undefined;
+/**
+ * better-auth types `session.user` from its own base schema. Flow declares the extra columns
+ * through `additionalFields`, so every user row this server reads or writes carries them; the
+ * assertion names that configured shape rather than guessing at one.
+ */
+export declare function sessionUserOf<T>(user: T): SessionUser;

package/dist/sdk/session-view.js

@@ -0,0 +1,32 @@
+/**
+ * better-auth types `User` and `Session` from its own schema, so the fields Flow adds through
+ * `additionalFields` (audience, isGuest, username, walletAddress) are absent from those types.
+ *
+ * These read the added fields off the value without asserting a shape onto it, so a missing or
+ * wrongly-typed field answers `undefined` rather than becoming a lie the compiler believes.
+ * `String(x) === x` holds only for string primitives, which is the check without a `typeof`.
+ */
+function textField(value, key) {
+    const found = Object.entries(Object(value)).find(([k]) => k === key)?.[1];
+    return String(found) === found ? found : undefined;
+}
+function boolField(value, key) {
+    return Object.entries(Object(value)).find(([k]) => k === key)?.[1] === true;
+}
+/** The audience a session was minted for. */
+export const audienceOf = (session) => textField(session, "audience");
+/** A session's own id. */
+export const sessionIdOf = (session) => textField(session, "id");
+/** Whether the account is a guest. Absent means "not a guest". */
+export const isGuestOf = (user) => boolField(user, "isGuest");
+/** The account's username. */
+export const usernameOf = (user) => textField(user, "username");
+/**
+ * better-auth types `session.user` from its own base schema. Flow declares the extra columns
+ * through `additionalFields`, so every user row this server reads or writes carries them; the
+ * assertion names that configured shape rather than guessing at one.
+ */
+export function sessionUserOf(user) {
+    // SAFETY: the fields are declared in the plugin config; see the doc comment.
+    return user;
+}

package/dist/sdk/types/atproto-resolver.d.ts

@@ -0,0 +1,46 @@
+import type { Context } from "hono";
+import type { Caller } from "../caller";
+import type { AtprotoResolution } from "./atproto";
+import type { ManagedPdsState } from "./managed-provisioning";
+export type AtprotoMapping = Pick<AtprotoResolution, "flowUserId" | "did" | "identityVersion" | "lifecycle">;
+export type DidDocumentInput = {
+    id: string;
+    service?: unknown[];
+};
+export type AtprotoResolverDeps = {
+    testOrigin?: string;
+    resolveIdentity: (did: string, options: {
+        noCache: boolean;
+        signal: AbortSignal;
+    }) => Promise<{
+        did: string;
+        didDoc: DidDocumentInput;
+        handle: string;
+    }>;
+    assertPublicEndpoint: (endpoint: string) => Promise<void>;
+    authorization: (did: string, endpoint: string, signal: AbortSignal) => Promise<AtprotoResolution["authorization"]>;
+    flowPdsOrigins: ReadonlySet<string>;
+    ttlMs: number;
+    now?: () => number;
+};
+export type ManagedResolverState = {
+    lifecycle: ManagedPdsState;
+    identityVersion: number;
+};
+export type AtprotoResolverRouteDeps = {
+    admit: (userId: string) => Promise<boolean>;
+    resolveCaller: (context: Context) => Promise<Caller | null>;
+    activeAccountOf?: (headers: Headers) => Promise<string | null | undefined>;
+    readMapping: (userId: string) => Promise<AtprotoMapping>;
+    resolve: (mapping: AtprotoMapping, freshness: "cached" | "refresh", signal?: AbortSignal) => Promise<AtprotoResolution>;
+};
+export type AtprotoResolverAdmissionCaps = {
+    userHourly: number;
+    globalHourly: number;
+};
+export type AtprotoStoredGrant = {
+    sub: string;
+    aud: string;
+    iss: string;
+    expires_at?: string;
+};

package/dist/sdk/types/atproto.d.ts

@@ -1,5 +1,6 @@
 export type AtprotoStartRequest = {
     identifier: string;
+    invitationCode?: string;
     intent: "login" | "link";
     transaction?: string;
     expectedUserId?: string;
@@ -23,3 +24,24 @@ export type AtprotoStatus = {
     canUnlink: boolean;
     unlinkBlockReason: string | null;
 };
+export type AtprotoResolutionFailure = "SIGN_IN_REQUIRED" | "NO_AT_IDENTITY" | "PROVISIONING_PENDING" | "PROVISIONING_FAILED" | "ACCOUNT_CHANGED" | "UNSUPPORTED_DID_METHOD" | "IDENTITY_INVALID" | "RESOLUTION_UNAVAILABLE";
+export type AtprotoResolution = {
+    flowUserId: string;
+    did: string;
+    handle: string | null;
+    pdsUrl: string;
+    hosting: "flow" | "external";
+    lifecycle: "active" | "suspended" | "migrated" | "deletion_pending";
+    authorization: "connected" | "reconnect_required";
+    resolvedAt: string;
+    expiresAt: string;
+    identityVersion: string;
+};
+export type AtprotoResolveOptions = {
+    freshness?: "cached" | "refresh";
+    signal?: AbortSignal;
+};
+export type AtprotoApi = {
+    resolve(options?: AtprotoResolveOptions): Promise<AtprotoResolution>;
+    invalidate(): void;
+};

package/dist/sdk/types/auth.d.ts

@@ -1,5 +1,6 @@
 import type { JWTPayload } from "jose";
 import type { AuthEventName } from "./events";
+import type { ManagedPdsEnrollment } from "./managed-provisioning";
 export type FlowUser = {
     id: string;
     username: string;
@@ -74,6 +75,7 @@ export type AuthResponse = {
     additionalSessions?: AdditionalSession[];
 };
 export type AuthConfig = {
+    managedPdsEnabled?: boolean;
     atprotoEnabled?: boolean;
     rpId: string;
     rpName: string;
@@ -96,6 +98,7 @@ export type AuthResponseWithWebAuthn = AuthResponse & {
 export type PasskeyPluginOptions = {
     rpId: string;
     rpName?: string;
+    enrollManagedPds?: ManagedPdsEnrollment;
 };
 export type VerifyOptions = {
     audience: string;
@@ -169,6 +172,7 @@ export type PasskeyEnrollment = {
     credential: FlowCredential;
 };
 export type AccountRegistration = {
+    invitationCode?: string;
     username: string;
     email: string;
     subscribedToNews: boolean;

package/dist/sdk/types/dialog.d.ts

@@ -90,6 +90,9 @@ export type DialogState = {
     customLabels?: DialogCustomLabels;
 };
 export type SignUpProps = {
+    managedPdsEnabled?: boolean;
+    invitationCode?: string;
+    invitation?: import("react").ReactNode;
     verifiedEmail?: {
         email: string;
         nonce: string;

package/dist/sdk/types/hosted-oauth.d.ts

@@ -0,0 +1,23 @@
+import type { AppDb } from "../db/handle";
+export interface HostedOAuthTransaction {
+    issuer: string;
+    pds: string;
+    requestUri: string;
+    deviceId: string;
+    clientId: string;
+}
+export interface HostedOAuthMapping {
+    did: string;
+    pds: string;
+    version: string;
+}
+/** Called under the canonical user lock; returns only active managed identities. */
+export type HostedOAuthMappingReader = (database: AppDb, userId: string) => Promise<HostedOAuthMapping | null>;
+export interface HostedOAuthProofOptions {
+    testOrigin?: string;
+    issuer: string;
+    pds: string;
+    lifetimeMs: number;
+    maximumPendingProofs: number;
+    readMapping: HostedOAuthMappingReader;
+}

package/dist/sdk/types/hosting-quota.d.ts

@@ -0,0 +1,28 @@
+export interface HostingQuotaPolicy {
+    totalBytes: number;
+    uploadBytes: number;
+    scratchBytes: number;
+    concurrentUploads: number;
+}
+export interface HostingQuotaReservation {
+    bytes: number;
+    fence: number;
+    expiresAt: number;
+    state: "active" | "cleanup";
+}
+export interface HostingQuotaLedger {
+    revision: number;
+    nextFence: number;
+    certain: boolean;
+    recordBytes: number;
+    blobs: Record<string, number>;
+    deletionDebt: Record<string, {
+        bytes: number;
+        fence: number;
+    }>;
+    reservations: Record<string, HostingQuotaReservation>;
+}
+export interface HostingQuotaAdmission {
+    ledger: HostingQuotaLedger;
+    fence: number;
+}

package/dist/sdk/types/index.d.ts

@@ -1,6 +1,7 @@
 export type { AccountDeleteRequest, AccountDeleteResponse, AccountErasureCounts, AccountErasureEntry, AccountErasureFeed, AccountErasureResult, AccountExport, AccountExportAccount, AccountExportActionEvent, AccountExportActionSession, AccountExportAttendance, AccountExportAuthoredEvent, AccountExportCharacterStateTime, AccountExportFollow, AccountExportGameEvent, AccountExportNotification, AccountExportOtherService, AccountExportOwnedRoom, AccountExportPasskey, AccountExportRoomEvents, AccountExportRoomMembership, AccountExportRoomPlayerState, AccountExportRoomPresence, AccountExportRoomRestriction, AccountExportRoomSettings, AccountExportRooms, AccountExportRsvp, AccountExportSettingsSurface, AccountExportStudySubject, AccountExportXpGrant, AccountExportXpSummary, } from "./account-data";
 export type { ActionCurve, ActionEventRequest, ActionEventResponse, ActionsApi, ActiveActionState, FinishActionRequest, ListStudySessionsOptions, ListStudySubjectsOptions, StartActionInput, StartActionResult, StudyApi, StudySubjectResponse, UseActiveActionOptions, XpEstimateContext, } from "./actions";
-export type { AtprotoCompletion, AtprotoStartRequest, AtprotoStatus, } from "./atproto";
+export type { AtprotoApi, AtprotoCompletion, AtprotoResolution, AtprotoResolutionFailure, AtprotoResolveOptions, AtprotoStartRequest, AtprotoStatus, } from "./atproto";
+export type { AtprotoMapping, AtprotoResolverAdmissionCaps, AtprotoResolverDeps, AtprotoResolverRouteDeps, AtprotoStoredGrant, DidDocumentInput, ManagedResolverState, } from "./atproto-resolver";
 export type { AccountRegistration, AccountSession, AccountSessionsResponse, AdditionalSession, AuthConfig, AuthorizationTransaction, AuthPageBootstrap, AuthResponse, AuthResponseWithWebAuthn, BioNormalization, BioRejection, BioWriteRefusal, BioWriteResult, FlowCredential, FlowUser, PasskeyEnrollment, PasskeyPluginOptions, RevokeAllSessionsResponse, RevokeSessionResponse, SecurityActivityEntry, SecurityActivityResponse, SessionUser, VerifiedFlowJWT, VerifyOptions, WebAuthnSignature, } from "./auth";
 export type { BrowserAccount, BrowserAccounts } from "./browser-accounts";
 export type { BodyRegion, CosmeticItem, CosmeticMaterial, CosmeticPaint, CosmeticSlot, EquipConflict, EquippedCosmetic, EquippedCosmetics, EquipRegion, PaintSlot, SettingsConflict, } from "./cosmetics";
@@ -10,7 +11,10 @@ export type { AuthErrorCode, AuthEventName, AuthEventRecord, AuthMode, AuthOutco
 export type { ActiveAction, CatalogFieldRef, ClockAnchor, FinishedSummary, FocusApi, FocusPhase, FocusSessionEvent, FocusSessionState, StartFocusRequest, StudySearchHit, } from "./focus";
 export type { GameEventReport, GameLifecycleEventName, GameLifecycleFeedEvent, GameLifecycleFeedPage, GamePlayerSession, } from "./game";
 export { GAME_LIFECYCLE_EVENT_NAMES } from "./game";
+export type { HostedOAuthMapping, HostedOAuthMappingReader, HostedOAuthProofOptions, HostedOAuthTransaction, } from "./hosted-oauth";
+export type { HostingQuotaAdmission, HostingQuotaLedger, HostingQuotaPolicy, HostingQuotaReservation, } from "./hosting-quota";
 export type { AccountProfileData } from "./landing";
+export type * from "./managed-provisioning";
 export type { Bridge, BridgeParameters, FlowAccount, FlowRemote, FlowRemoteConfig, FromWindowOptions, MessageResponse, Messenger, OneOf, Payload, QueuedRequest, ReadyOptions, RemoteFlowState, RemoteState, Schema, Storage, Topic, WithReady, } from "./messenger";
 export type { MarkNotificationsReadInput, NotificationCounts, NotificationEntry, NotificationPage, NotificationReadResult, NotificationRefusal, } from "./notifications";
 export type { OtpVerificationFailure, OtpVerificationResult, VerificationAdapter, } from "./otp";

package/dist/sdk/types/managed-provisioning.d.ts

@@ -0,0 +1,51 @@
+import type { AppDb } from "../db/handle";
+/** Queues a reservation in the enrollment transaction; remote provisioning runs after commit. */
+export type ManagedPdsEnrollment = (database: AppDb, userId: string) => Promise<void>;
+export type ManagedPdsState = "queued" | "provisioning" | "active" | "failed" | "suspended" | "migrated" | "deletion_pending";
+export interface ManagedPdsReservation {
+    operationId: string;
+    handle: string;
+    pdsEndpoint: string;
+    inviteReference: string;
+}
+export interface ManagedPdsIdentity {
+    did: string;
+    handle: string;
+    pdsEndpoint: string;
+}
+export type ManagedPdsRecovery = {
+    outcome: "committed";
+    identity: ManagedPdsIdentity;
+} | {
+    outcome: "absent";
+} | {
+    outcome: "pending";
+};
+/**
+ * Server-only adapter for an authenticated operator API. It must durably bind
+ * operationId to key material before PLC publication and replay the same DID
+ * through every crash boundary. Stock createAccount does not implement this.
+ */
+export interface ManagedPdsProvisioner {
+    contract: "durable-operation-idempotency-v1";
+    remove?(reservation: ManagedPdsReservation & {
+        did: string | null;
+    }): Promise<void>;
+    recover(reservation: ManagedPdsReservation): Promise<ManagedPdsRecovery>;
+    create(reservation: ManagedPdsReservation): Promise<ManagedPdsIdentity>;
+}
+export interface ManagedPdsWorkerLimits {
+    leaseMs: number;
+    maxAttempts: number;
+}
+export type ManagedPdsConfig = {
+    endpoint: string;
+    operatorEndpoint: string;
+    operatorToken: string;
+};
+export interface ManagedPdsTickReport {
+    active: number;
+    failed: number;
+    idle: number;
+    deleted?: number;
+}

package/dist/sdk/types/sdk.d.ts

@@ -2,6 +2,7 @@ import type { ReactNode } from "react";
 import type { Chain, Hex, PrepareTransactionRequestParameters, SendTransactionParameters, SignTypedDataParameters, Transport, WalletClient } from "viem";
 import type { SendCallsParameters } from "viem/actions";
 import type { RawValue } from "../json";
+import type { AtprotoApi } from "./atproto";
 import type { AdditionalSession, FlowCredential, FlowUser, WebAuthnSignature } from "./auth";
 import type { BrowserAccount, BrowserAccounts } from "./browser-accounts";
 import type { ConnectCapabilities } from "./protocol";
@@ -377,6 +378,7 @@ export type Flow = {
     }): Promise<WalletClient>;
     /** Typed client for the room registry (browse, membership, settings, moderation). */
     rooms: RoomsApi;
+    atproto: AtprotoApi;
     subscribe(listener: Listener<FlowState>): () => void;
     getState(): FlowState;
     dialog: DialogHost;