@happyvertical/smrt-subscriptions 0.60.15 → 0.60.16

package/dist/smrt-knowledge.okf.md

@@ -5,10 +5,10 @@ description: "Tenant subscriptions, entitlement resolution, usage thresholds, an
 status: "stable"
 generated:
   by: "smrt/scripts/generate-knowledge-okf.ts"
-  at: "2026-11-08T23:20:26Z"
+  at: "2026-11-09T23:09:38Z"
 audience: "internal"
 evidence_level: "source-inspected"
-source_revision: "sha256:7c2168e5c5217ff6f6d7073b39f02053dadab3070527ce4c41698152a0ed878b"
+source_revision: "sha256:48d3599db9578e435280b3dd42751090babf37fc1f9fc84da681314f14dc5579"
 sources:
   - id: "manifest"
     resource: "https://github.com/happyvertical/smrt/blob/main/packages/subscriptions/package.json"
@@ -37,6 +37,7 @@ sources:
 - [smrt-features](/components/smrt-features.md)
 - [smrt-tenancy](/components/smrt-tenancy.md)
 - [smrt-ui](/components/smrt-ui.md)
+- [smrt-users](/components/smrt-users.md)
 - [smrt-vitest](/components/smrt-vitest.md)
 
 ## SDK dependencies
@@ -54,6 +55,8 @@ sources:
 
 - `BillingAdjustment` (collection `billingadjustments`, extends `SmrtObject`)
 - `BillingAdjustmentCollection` (collection `billingadjustments`, extends `SmrtCollection`)
+- `BillingCheckoutSession` (collection `billingcheckoutsessions`, extends `SmrtObject`)
+- `BillingCheckoutSessionCollection` (collection `billingcheckoutsessions`, extends `SmrtCollection`)
 - `ClientCharge` (collection `clientcharges`, extends `SmrtObject`)
 - `ClientChargeCollection` (collection `clientcharges`, extends `SmrtCollection`)
 - `CreditGrant` (collection `creditgrants`, extends `SmrtObject`)

package/dist/vault-account/actions.d.ts

@@ -0,0 +1,24 @@
+import type { ProvisionRestartAccountInput, ProvisionRestartAccountResult, SupersedeVaultAccountInput, UnsupersedeVaultAccountInput } from './types.js';
+/**
+ * Replace `oldAccount` by `newAccount` (relay admin `PUT
+ * .../superseded-by`). The new account must already hold an active device
+ * (see {@link provisionRestartAccount}); the relay enforces that, and no
+ * chains or loops. Idempotent for the same target.
+ */
+export declare function supersedeVaultAccount(input: SupersedeVaultAccountInput): Promise<'superseded' | 'unchanged'>;
+/**
+ * Undo a supersession (relay admin `DELETE .../superseded-by`), for an
+ * operator mistake or a restart that never reached the working device. Returns
+ * false when `oldAccount` was not superseded.
+ */
+export declare function unsupersedeVaultAccount(input: UnsupersedeVaultAccountInput): Promise<boolean>;
+/**
+ * Step 1 of the restart flow (app-runtime README, "Restarting when the
+ * recovery secret is lost"), before the supersede: allocate a fresh vault
+ * account id, link it to the caller's tenant (so `backup.vault` resolves for
+ * it), and register the working device's relay signing key in it (relay admin
+ * `PUT .../devices/:device`). The id is minted per call, so a retry after a
+ * crash makes another empty account unless `newAccountId` is pinned.
+ */
+export declare function provisionRestartAccount(input: ProvisionRestartAccountInput): Promise<ProvisionRestartAccountResult>;
+//# sourceMappingURL=actions.d.ts.map

package/dist/vault-account/actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/vault-account/actions.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,EACV,4BAA4B,EAC5B,6BAA6B,EAC7B,0BAA0B,EAC1B,4BAA4B,EAI7B,MAAM,YAAY,CAAC;AA2KpB;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,0BAA0B,GAChC,OAAO,CAAC,YAAY,GAAG,WAAW,CAAC,CAYrC;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,OAAO,CAAC,CAOlB;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,6BAA6B,CAAC,CA6CxC"}

package/dist/vault-account/errors.d.ts

@@ -0,0 +1,20 @@
+import { StepUpRequiredError } from '@happyvertical/smrt-users/step-up';
+export { StepUpRequiredError };
+/** Stable machine code of {@link NotOwnerError}. */
+export declare const NOT_OWNER_CODE = "not_owner";
+/**
+ * The caller is not the owner of the tenant that holds the account: a member,
+ * a device-only or layered session, no session, or another tenant's account.
+ * One message and code for all of them, so nothing about the account or the
+ * tenant leaks.
+ */
+export declare class NotOwnerError extends Error {
+    readonly code = "not_owner";
+    constructor(message?: string);
+}
+/** A refusal after both checks passed (the relay or directory said no). */
+export declare class VaultAccountAdminError extends Error {
+    readonly code: string;
+    constructor(code: string, message?: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/vault-account/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/vault-account/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAExE,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAE/B,oDAAoD;AACpD,eAAO,MAAM,cAAc,cAAc,CAAC;AAE1C;;;;;GAKG;AACH,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,IAAI,eAAkB;gBAEnB,OAAO,SAAwC;CAI5D;AAED,2EAA2E;AAC3E,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,IAAI,EAAE,MAAM,EAAE,OAAO,SAAqC;CAKvE"}

package/dist/vault-account/index.d.ts

@@ -0,0 +1,5 @@
+export { provisionRestartAccount, supersedeVaultAccount, unsupersedeVaultAccount, } from './actions.js';
+export { NOT_OWNER_CODE, NotOwnerError, StepUpRequiredError, VaultAccountAdminError, } from './errors.js';
+export { createVaultRelayAdminClient, type VaultRelayAdminClientOptions, } from './relay-admin-client.js';
+export type { ProvisionRestartAccountInput, ProvisionRestartAccountResult, SupersedeVaultAccountInput, UnsupersedeVaultAccountInput, VaultAccountAction, VaultAccountAdminDeps, VaultAccountAuditEntry, VaultAccountAuditSink, VaultAccountDenial, VaultAccountDirectory, VaultRelayAdminPort, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/vault-account/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/vault-account/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,cAAc,EACd,aAAa,EACb,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,2BAA2B,EAC3B,KAAK,4BAA4B,GAClC,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,4BAA4B,EAC5B,6BAA6B,EAC7B,0BAA0B,EAC1B,4BAA4B,EAC5B,kBAAkB,EAClB,qBAAqB,EACrB,sBAAsB,EACtB,qBAAqB,EACrB,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,YAAY,CAAC"}

package/dist/vault-account/relay-admin-client.d.ts

@@ -0,0 +1,10 @@
+import type { VaultRelayAdminPort } from './types.js';
+export interface VaultRelayAdminClientOptions {
+    /** Admin listener origin, e.g. `http://vault-relay-admin:8081`. */
+    baseUrl: string;
+    /** `VAULT_RELAY_ADMIN_TOKEN`. */
+    adminToken: string;
+    fetch?: typeof fetch;
+}
+export declare function createVaultRelayAdminClient(options: VaultRelayAdminClientOptions): VaultRelayAdminPort;
+//# sourceMappingURL=relay-admin-client.d.ts.map

package/dist/vault-account/relay-admin-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-admin-client.d.ts","sourceRoot":"","sources":["../../src/vault-account/relay-admin-client.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,WAAW,4BAA4B;IAC3C,mEAAmE;IACnE,OAAO,EAAE,MAAM,CAAC;IAChB,iCAAiC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAWD,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,4BAA4B,GACpC,mBAAmB,CA8ErB"}

package/dist/vault-account/types.d.ts

@@ -0,0 +1,115 @@
+/**
+ * Types for the hosted vault-account admin surface (#4841).
+ *
+ * Everything the gated actions touch is an injected port, so no HTTP server or
+ * real relay is needed to run or test them. `VaultRelay` from
+ * `@happyvertical/smrt-vault-relay` satisfies {@link VaultRelayAdminPort}
+ * structurally (this package cannot depend on it: the relay depends on this
+ * package), and {@link createVaultRelayAdminClient} implements it over the
+ * relay's admin HTTP API.
+ */
+import type { StepUpSession } from '@happyvertical/smrt-users/step-up';
+/** The three gated actions. */
+export type VaultAccountAction = 'supersede' | 'unsupersede' | 'provision_restart_account';
+/** Why an attempt was refused. The caller sees only the error code. */
+export type VaultAccountDenial = 'not_owner' | 'step_up_required';
+/**
+ * The relay admin operations the actions use: the account-layer hooks of
+ * `VaultRelay` (`registerDevice`, `supersedeAccount`, `clearSupersession`).
+ */
+export interface VaultRelayAdminPort {
+    /** Register a device's raw Ed25519 public key (base64url) in an account. */
+    registerDevice(accountId: string, deviceId: string, publicKey: string): Promise<'registered' | 'unchanged' | 'conflict'>;
+    /** Replace `accountId` by `supersededBy`. Idempotent for the same target. */
+    supersedeAccount(accountId: string, supersededBy: string): Promise<'superseded' | 'unchanged'>;
+    /** Undo a supersession; false when there was none. */
+    clearSupersession(accountId: string): Promise<boolean>;
+}
+/**
+ * The host's account directory: which tenant a vault account belongs to (the
+ * same mapping the relay's `tenantForAccount` entitlement lookup reads, so
+ * `backup.vault` resolves for a linked account).
+ */
+export interface VaultAccountDirectory {
+    /** The tenant that owns `accountId`, or null when unknown. */
+    tenantForAccount(accountId: string): string | null | Promise<string | null>;
+    /** Record that `accountId` belongs to `tenantId`. Idempotent. */
+    linkAccount(tenantId: string, accountId: string): void | Promise<void>;
+}
+/**
+ * One audit record. Carries ids, codes and times only: never a password, a
+ * session id, a token, a key or a recovery secret.
+ */
+export interface VaultAccountAuditEntry {
+    /** ISO time. */
+    at: string;
+    action: VaultAccountAction;
+    /**
+     * `denied`: refused before any relay call. `authorized`: both checks
+     * passed, written before the relay call. `succeeded` / `failed`: the relay
+     * call's outcome.
+     */
+    outcome: 'denied' | 'authorized' | 'succeeded' | 'failed';
+    /** The caller's user id; null when there was no usable session. */
+    actorUserId: string | null;
+    tenantId: string | null;
+    oldAccountId?: string;
+    newAccountId?: string;
+    deviceId?: string;
+    /** Set when `outcome` is `denied`. */
+    denial?: VaultAccountDenial;
+    /** Set when `outcome` is `failed`: an error name or code, never a message. */
+    errorCode?: string;
+    /** The relay's result word, when the call returned one. */
+    result?: string;
+}
+export interface VaultAccountAuditSink {
+    record(entry: VaultAccountAuditEntry): void | Promise<void>;
+}
+/** Collaborators and policy shared by every gated action. */
+export interface VaultAccountAdminDeps {
+    relay: VaultRelayAdminPort;
+    directory: VaultAccountDirectory;
+    audit: VaultAccountAuditSink;
+    /**
+     * Longest age of the owner's last authentication, in seconds. Default 300
+     * (5 minutes); at most one hour.
+     */
+    stepUpMaxAgeSeconds?: number;
+    /**
+     * Replaces the default owner test (`isTenantOwnerSession`) for hosts with a
+     * custom owner role. It must still refuse device-only and layered sessions.
+     */
+    isOwner?: (session: StepUpSession) => boolean;
+    /** Clock, injectable for tests. */
+    now?: () => Date;
+}
+export interface SupersedeVaultAccountInput extends VaultAccountAdminDeps {
+    /** The caller's session context, from `SessionService.loadSessionContext`. */
+    session: StepUpSession | null | undefined;
+    oldAccount: string;
+    newAccount: string;
+}
+export interface UnsupersedeVaultAccountInput extends VaultAccountAdminDeps {
+    session: StepUpSession | null | undefined;
+    oldAccount: string;
+}
+export interface ProvisionRestartAccountInput extends VaultAccountAdminDeps {
+    session: StepUpSession | null | undefined;
+    /** The account being replaced; must belong to the caller's tenant. */
+    oldAccount: string;
+    /** The working device's relay signing key id. */
+    deviceId: string;
+    /** Its raw Ed25519 public key, base64url. */
+    devicePublicKey: string;
+    /** Mints the new account id. Default `crypto.randomUUID()`. */
+    newAccountId?: () => string | Promise<string>;
+}
+export interface ProvisionRestartAccountResult {
+    /** The new vault account, linked to the caller's tenant. */
+    accountId: string;
+    deviceId: string;
+    /** `registered` the first time, `unchanged` on a retry. */
+    device: 'registered' | 'unchanged';
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/vault-account/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/vault-account/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAEvE,+BAA+B;AAC/B,MAAM,MAAM,kBAAkB,GAC1B,WAAW,GACX,aAAa,GACb,2BAA2B,CAAC;AAEhC,uEAAuE;AACvE,MAAM,MAAM,kBAAkB,GAAG,WAAW,GAAG,kBAAkB,CAAC;AAElE;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,4EAA4E;IAC5E,cAAc,CACZ,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,YAAY,GAAG,WAAW,GAAG,UAAU,CAAC,CAAC;IACpD,6EAA6E;IAC7E,gBAAgB,CACd,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,YAAY,GAAG,WAAW,CAAC,CAAC;IACvC,sDAAsD;IACtD,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACxD;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,8DAA8D;IAC9D,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5E,iEAAiE;IACjE,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxE;AAED;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC,gBAAgB;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,kBAAkB,CAAC;IAC3B;;;;OAIG;IACH,OAAO,EAAE,QAAQ,GAAG,YAAY,GAAG,WAAW,GAAG,QAAQ,CAAC;IAC1D,mEAAmE;IACnE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sCAAsC;IACtC,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,KAAK,EAAE,sBAAsB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7D;AAED,6DAA6D;AAC7D,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,mBAAmB,CAAC;IAC3B,SAAS,EAAE,qBAAqB,CAAC;IACjC,KAAK,EAAE,qBAAqB,CAAC;IAC7B;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC;IAC9C,mCAAmC;IACnC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,MAAM,WAAW,0BAA2B,SAAQ,qBAAqB;IACvE,8EAA8E;IAC9E,OAAO,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,CAAC;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,4BAA6B,SAAQ,qBAAqB;IACzE,OAAO,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,CAAC;IAC1C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,4BAA6B,SAAQ,qBAAqB;IACzE,OAAO,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,CAAC;IAC1C,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAC;IACnB,iDAAiD;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,eAAe,EAAE,MAAM,CAAC;IACxB,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,6BAA6B;IAC5C,4DAA4D;IAC5D,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,2DAA2D;IAC3D,MAAM,EAAE,YAAY,GAAG,WAAW,CAAC;CACpC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyvertical/smrt-subscriptions",
-  "version": "0.60.15",
+  "version": "0.60.16",
   "description": "Tenant subscriptions, entitlement resolution, usage thresholds, and subscription UI for SMRT",
   "type": "module",
   "smrtRawPrimitives": "strict",
@@ -26,10 +26,11 @@
     }
   },
   "dependencies": {
-    "@happyvertical/smrt-core": "0.60.15",
-    "@happyvertical/smrt-tenancy": "0.60.15",
-    "@happyvertical/smrt-ui": "0.60.15",
-    "@happyvertical/sql": "^0.111.6"
+    "@happyvertical/smrt-core": "0.60.16",
+    "@happyvertical/smrt-tenancy": "0.60.16",
+    "@happyvertical/smrt-ui": "0.60.16",
+    "@happyvertical/smrt-users": "0.60.16",
+    "@happyvertical/sql": "^0.111.8"
   },
   "peerDependencies": {
     "svelte": "^5.57.0"
@@ -40,8 +41,9 @@
     }
   },
   "devDependencies": {
-    "@happyvertical/smrt-features": "0.60.15",
-    "@happyvertical/smrt-vitest": "0.60.15",
+    "@happyvertical/accounting": "^0.111.8",
+    "@happyvertical/smrt-features": "0.60.16",
+    "@happyvertical/smrt-vitest": "0.60.16",
     "@sveltejs/package": "^2.5.8",
     "@types/node": "24.13.6",
     "svelte": "^5.57.1",