@hasna/capacity 0.1.0

package/dist/storage/postgres.d.ts

@@ -0,0 +1,90 @@
+import { SQL } from "bun";
+import { type Counter } from "../domain/counter";
+import type { CredentialBinding, CredentialOperation, EntityKind, EntityMap } from "../domain/models";
+import { type PostgresConnectionInput } from "./postgres-config";
+import type { AccountEvent, AccountsRepository, AuthorityPromotionKind, CredentialHandleEnvelope, CredentialHandleVerifier, CredentialResolutionGrant, CredentialResolutionTransport, CredentialUseAuthorizer, EligibilitySnapshot, MutationContext, MutationResult, NativeRevocationRequest, NativeRevocationResult, OutboxAcknowledgeRequest, OutboxClaimRequest, OutboxRecord, RecoveryLedger, ResolvedCredentialHandle, VerifiedAuthorityEvidenceRecord, PostgresRepositoryDoctor as SharedPostgresRepositoryDoctor } from "./repository";
+export declare const POSTGRES_ADAPTER_STATUS_V1: Readonly<{
+    adapter: "postgres";
+    implemented: true;
+    conformanceClaim: true;
+    target: "self_hosted";
+}>;
+export type PostgresRepositoryDoctor = SharedPostgresRepositoryDoctor;
+export interface PostgresAccountsRepositoryContract extends AccountsRepository {
+}
+export interface PostgresRepositoryAuthority {
+    readonly principalRef: string;
+    readonly identityRealm: "hasna";
+    readonly organizationRef: string;
+    readonly catalogIncarnation: string;
+    readonly buildDigest: string;
+    readonly configurationAttestationDigest: string;
+    readonly recoveryLedger: RecoveryLedger;
+    readonly credentialVerifier?: CredentialHandleVerifier;
+    readonly credentialUseAuthorizer?: CredentialUseAuthorizer;
+}
+export interface ConnectPostgresAccountsOptions extends PostgresConnectionInput, PostgresRepositoryAuthority {
+    readonly maxConnections?: number;
+}
+/**
+ * Self-hosted Postgres repository core. Every runtime query executes under
+ * `SET LOCAL ROLE accounts_runtime` and transaction-local identity settings;
+ * no pooled connection carries an Accounts principal between transactions.
+ */
+export declare class PostgresAccountsRepository implements PostgresAccountsRepositoryContract {
+    private readonly client;
+    private readonly connectionSecurity;
+    private readonly ownsClient;
+    private readonly principalRef;
+    private readonly identityRealm;
+    private readonly organizationRef;
+    private readonly catalogIncarnation;
+    private readonly buildDigest;
+    private readonly configurationAttestationDigest;
+    private readonly recoveryLedger;
+    private readonly credentialVerifier;
+    private readonly credentialUseAuthorizer;
+    private closed;
+    constructor(client: SQL, authority: PostgresRepositoryAuthority, connectionSecurity?: "verify-full" | "loopback-test-only", ownsClient?: boolean);
+    static connect(options: ConnectPostgresAccountsOptions): PostgresAccountsRepository;
+    initialize(): Promise<void>;
+    get<K extends EntityKind>(kind: K, id: EntityMap[K]["id"]): Promise<EntityMap[K] | undefined>;
+    list<K extends EntityKind>(kind: K): Promise<readonly EntityMap[K][]>;
+    readEligibilitySnapshot(accessMethodId: EntityMap["access_method"]["id"]): Promise<EligibilitySnapshot>;
+    insert<K extends EntityKind>(kind: K, input: EntityMap[K], context: MutationContext): Promise<MutationResult<EntityMap[K]>>;
+    insertCapacityPoolWithAuthorityEvidence(input: EntityMap["capacity_pool"], inputEvidence: VerifiedAuthorityEvidenceRecord, context: MutationContext): Promise<MutationResult<EntityMap["capacity_pool"]>>;
+    insertCredentialBinding(input: CredentialBinding, inputHandle: CredentialHandleEnvelope, context: MutationContext): Promise<MutationResult<CredentialBinding>>;
+    promoteWithAuthorityEvidence<K extends AuthorityPromotionKind>(kind: K, input: EntityMap[K], expectedRevision: Counter, inputEvidence: readonly VerifiedAuthorityEvidenceRecord[], context: MutationContext): Promise<MutationResult<EntityMap[K]>>;
+    resolveCredentialHandle(bindingId: CredentialBinding["id"], grant: CredentialResolutionGrant, transport: CredentialResolutionTransport): Promise<ResolvedCredentialHandle>;
+    replace<K extends EntityKind>(kind: K, input: EntityMap[K], expectedRevision: Counter, context: MutationContext): Promise<MutationResult<EntityMap[K]>>;
+    findReplacementReplay<K extends EntityKind>(kind: K, id: EntityMap[K]["id"], to: EntityMap[K]["status"], expectedRevision: Counter, context: MutationContext): Promise<MutationResult<EntityMap[K]> | undefined>;
+    events(): Promise<readonly AccountEvent[]>;
+    credentialOperations(): Promise<readonly CredentialOperation[]>;
+    outbox(): Promise<readonly OutboxRecord[]>;
+    claimOutbox(request: OutboxClaimRequest): Promise<readonly OutboxRecord[]>;
+    acknowledgeOutbox(request: OutboxAcknowledgeRequest): Promise<OutboxRecord>;
+    revokeNativeGeneration(request: NativeRevocationRequest): Promise<NativeRevocationResult>;
+    doctor(): Promise<PostgresRepositoryDoctor>;
+    close(): Promise<void>;
+    private withPrincipal;
+    private ensureInstallation;
+    private readVerifiedLedgerFrontier;
+    private readRecoverySnapshot;
+    private appendRecovery;
+    private readOne;
+    private readOneForUpdate;
+    private insertRecord;
+    private updateRecord;
+    private requireParentOwner;
+    private buildHandleExpectedClaims;
+    private recordMutation;
+    private appendEventAndOutbox;
+    private appendCleanupOutbox;
+    private insertOperation;
+    private replay;
+    private readNativeRevocationResult;
+    private assertActor;
+    private assertOpen;
+}
+export declare function postgresSqlState(error: unknown): string | undefined;
+export declare const POSTGRES_ACCOUNTS_CONTRACT_SHA256: "0d2b45c286f56452312b251b7622e009c486e2fe71fe8f2a5a59c01472eb8b2a";

package/dist/storage/recovery.d.ts

@@ -0,0 +1,11 @@
+import type { RecoveryFrontier, RecoveryLedger, RecoveryLedgerEntry, RecoveryLedgerReceipt } from "./repository";
+export declare class InMemoryRecoveryLedger implements RecoveryLedger {
+    private frontier;
+    private readonly signingKey;
+    constructor(catalogIncarnation: string, signingKey?: Uint8Array);
+    readFreshFrontier(): RecoveryFrontier;
+    append(expected: RecoveryFrontier, entry: RecoveryLedgerEntry): RecoveryLedgerReceipt;
+    verifyFrontier(frontier: RecoveryFrontier): boolean;
+    private signFrontier;
+}
+export declare const UNAVAILABLE_RECOVERY_LEDGER: RecoveryLedger;

package/dist/storage/repository.d.ts

@@ -0,0 +1,310 @@
+import type { Counter } from "../domain/counter";
+import type { AccountEventId, AuthCapsuleId, CredentialBindingId, CredentialOperationId, EntityId, OutboxId } from "../domain/ids";
+import type { Account, AccessMethod, AuthCapsule, CapacityPool, CredentialBinding, CredentialOperation, EntityKind, EntityMap, Entitlement } from "../domain/models";
+export interface MutationContext {
+    readonly actorRef: string;
+    readonly idempotencyKey: string;
+    readonly reasonCode: string;
+}
+export interface AccountEvent {
+    readonly id: AccountEventId;
+    readonly aggregateKind: EntityKind;
+    readonly aggregateId: EntityId;
+    readonly aggregateRevision: Counter;
+    readonly actorRef: string;
+    readonly reasonCode: string;
+    readonly occurredAt: string;
+}
+export interface MutationResult<T> {
+    readonly record: T;
+    readonly eventId: AccountEventId;
+    readonly replayed: boolean;
+}
+export type AuthorityPromotionKind = "account" | "entitlement" | "capacity_pool" | "access_method";
+/**
+ * Canonical, already cryptographically verified authority evidence persisted with
+ * its aggregate promotion. Repositories still validate this closed storage shape
+ * and atomically fence every nonce; they never accept an unsigned projection.
+ */
+export interface VerifiedAuthorityEvidenceRecord {
+    readonly evidenceType: "provider_ownership" | "provider_capacity" | "entitlement_execution_policy" | "entitlement_terms" | "entitlement_data_policy" | "lane_isolation_policy" | "lane_execution_policy" | "lane_health";
+    readonly evidenceRef: string;
+    readonly subjectRef: string;
+    readonly aggregateKind: "provider_account" | "capacity_pool" | "entitlement" | "account_lane";
+    readonly aggregateId: string;
+    readonly aggregateRevision: Counter;
+    readonly identityRealm: string;
+    readonly issuerRef: string;
+    readonly issuerClass: "provider_ownership_verifier" | "provider_capacity_verifier" | "execution_policy_authority" | "terms_authority" | "adapter_health_reporter";
+    readonly issuerIncarnation: string;
+    readonly audience: string;
+    readonly keyId: string;
+    readonly issuedAt: string;
+    readonly expiresAt: string;
+    readonly nonce: string;
+    readonly evidenceGeneration: Counter;
+    readonly payloadDigest: string;
+    readonly envelopeDigest: string;
+    readonly envelopeJson: string;
+}
+export interface EmbeddedRepositoryDoctor {
+    readonly adapter: "memory" | "sqlite";
+    readonly schemaVersion: string;
+    readonly migrationChecksum: string;
+    readonly foreignKeys: boolean | "not_applicable";
+    readonly journalMode: "memory" | "wal";
+    readonly integrity: "ok";
+    readonly readiness: "ready" | "recovery_hold" | "metadata_only";
+    readonly recoveryFrontier: RecoveryFrontier | "unavailable";
+    readonly recoveryHold: boolean;
+    readonly positiveEligibility: boolean;
+}
+export interface PostgresRepositoryDoctor {
+    readonly adapter: "postgres";
+    readonly schemaVersion: string;
+    readonly migrationChecksum: string;
+    readonly foreignKeys: true;
+    readonly integrity: "ok";
+    readonly tls: "verify-full" | "loopback-test-only";
+    readonly rls: "forced";
+    readonly runtimeRole: "accounts_runtime";
+    readonly readiness: "ready" | "recovery_hold";
+    readonly recoveryFrontier: RecoveryFrontier | "unavailable";
+    readonly recoveryHold: boolean;
+    readonly positiveEligibility: boolean;
+}
+export type RepositoryDoctor = EmbeddedRepositoryDoctor | PostgresRepositoryDoctor;
+export interface RecoveryFrontier {
+    readonly catalogIncarnation: string;
+    readonly sequence: Counter;
+    readonly hash: string;
+    readonly signatureDigest: string;
+}
+export interface RecoveryLedgerEntry {
+    readonly kind: "catalog_mutation" | "native_revocation_barrier";
+    readonly aggregateKind: EntityKind | "credential_operation";
+    readonly aggregateId: string;
+    readonly mutationDigest: string;
+    readonly occurredAt: string;
+}
+export interface RecoveryLedgerReceipt extends RecoveryFrontier {
+    readonly previousHash: string;
+    readonly entryDigest: string;
+    readonly receiptDigest: string;
+}
+export interface RecoveryLedger {
+    readFreshFrontier(): RecoveryFrontier;
+    append(expected: RecoveryFrontier, entry: RecoveryLedgerEntry): RecoveryLedgerReceipt;
+    verifyFrontier(frontier: RecoveryFrontier): boolean;
+}
+export interface RecoverySnapshot {
+    readonly matched: boolean;
+    readonly hold: boolean;
+    readonly frontier?: RecoveryFrontier;
+}
+/** Internal issuer-to-storage envelope. It is deliberately absent from the public package exports. */
+export interface CredentialHandleEnvelope {
+    readonly opaqueHandle: string;
+    readonly issuerRef: string;
+    readonly audience: "accounts-local" | "accounts-self-hosted";
+    readonly catalogIncarnation: string;
+    readonly backendClass: "secrets_broker" | "workload_identity_broker" | "capsule_protected_state";
+    readonly ownerRef: string;
+    readonly providerAccountId: Account["id"];
+    readonly providerKey: string;
+    readonly capacityPoolId: CapacityPool["id"];
+    readonly capacityDomainRef: string;
+    readonly accessMethodId: AccessMethod["id"];
+    readonly credentialFamilyId: string;
+    readonly purpose: CredentialBinding["purpose"];
+    readonly resolver: CredentialBinding["resolver"];
+    readonly policyDigest: string;
+    readonly credentialGeneration: Counter;
+    readonly authCapsuleId?: AuthCapsule["id"];
+    readonly canonicalNodeId?: AuthCapsule["placementRef"];
+    readonly nodeGeneration?: Counter;
+    readonly placementGeneration?: Counter;
+    readonly issuedAt: string;
+    readonly expiresAt?: string;
+    readonly signature: string;
+}
+export type UnsignedCredentialHandleEnvelope = Omit<CredentialHandleEnvelope, "signature">;
+export interface CredentialHandleExpectedClaims {
+    readonly audience: CredentialHandleEnvelope["audience"];
+    readonly catalogIncarnation: string;
+    readonly backendClass: CredentialHandleEnvelope["backendClass"];
+    readonly ownerRef: string;
+    readonly providerAccountId: Account["id"];
+    readonly providerKey: string;
+    readonly capacityPoolId: CapacityPool["id"];
+    readonly capacityDomainRef: string;
+    readonly accessMethodId: AccessMethod["id"];
+    readonly credentialFamilyId: string;
+    readonly purpose: CredentialBinding["purpose"];
+    readonly resolver: CredentialBinding["resolver"];
+    readonly policyDigest: string;
+    readonly credentialGeneration: Counter;
+    readonly authCapsuleId?: AuthCapsule["id"];
+    readonly canonicalNodeId?: AuthCapsule["placementRef"];
+    readonly nodeGeneration?: Counter;
+    readonly placementGeneration?: Counter;
+}
+export interface CredentialHandleVerification {
+    readonly credentialHandleAuditDigest: string;
+}
+export interface CredentialHandleVerifier {
+    verify(envelope: CredentialHandleEnvelope, expected: CredentialHandleExpectedClaims): CredentialHandleVerification;
+}
+export interface CredentialResolutionGrant {
+    readonly schema_version: "accounts.handle-resolution.v1";
+    readonly issuer_ref: string;
+    readonly provider_account_id: Account["id"];
+    readonly account_lane_id: AccessMethod["id"];
+    readonly capacity_pool_id: CapacityPool["id"];
+    readonly credential_binding_id: CredentialBindingId;
+    readonly credential_family_id: string;
+    readonly credential_generation: Counter;
+    readonly purpose: CredentialBinding["purpose"];
+    readonly resolver: CredentialBinding["resolver"];
+    readonly run_id: string;
+    readonly attempt_id: string;
+    readonly resource_lease_id: string;
+    readonly resource_id: string;
+    readonly resource_generation: Counter;
+    readonly operation_id: string;
+    readonly operation_digest: string;
+    readonly execution_epoch: Counter;
+    readonly subject_principal: string;
+    readonly actor_principal: string;
+    readonly holder_principal: string;
+    readonly executor_principal: string;
+    readonly audience: string;
+    readonly sender_key_thumbprint: string;
+    readonly catalog_incarnation: string;
+    readonly recovery_frontier_sequence: Counter;
+    readonly recovery_frontier_hash: string;
+    readonly request_digest: string;
+    readonly issued_at: string;
+    readonly expires_at: string;
+    readonly signature: string;
+}
+export type UnsignedCredentialResolutionGrant = Omit<CredentialResolutionGrant, "signature">;
+export interface CredentialResolutionTransport {
+    readonly authenticatedActorPrincipal: string;
+    readonly authenticatedHolderPrincipal: string;
+    readonly authenticatedExecutorPrincipal: string;
+    readonly authenticatedSenderKeyThumbprint: string;
+    readonly audience: string;
+    readonly runId: string;
+    readonly attemptId: string;
+    readonly resourceLeaseId: string;
+    readonly resourceId: string;
+    readonly resourceGeneration: Counter;
+    readonly operationId: string;
+    readonly operationDigest: string;
+    readonly executionEpoch: Counter;
+    readonly requestDigest: string;
+    readonly now: string;
+}
+export interface CredentialResolutionExpected {
+    readonly providerAccountId: Account["id"];
+    readonly ownerRef: string;
+    readonly accessMethodId: AccessMethod["id"];
+    readonly capacityPoolId: CapacityPool["id"];
+    readonly bindingId: CredentialBindingId;
+    readonly credentialFamilyId: string;
+    readonly credentialGeneration: Counter;
+    readonly purpose: CredentialBinding["purpose"];
+    readonly resolver: CredentialBinding["resolver"];
+    readonly catalogIncarnation: string;
+    readonly recoveryFrontierSequence: Counter;
+    readonly recoveryFrontierHash: string;
+}
+export interface CredentialUseAuthorizer {
+    verify(grant: CredentialResolutionGrant, expected: CredentialResolutionExpected, transport: CredentialResolutionTransport): void;
+}
+export interface ResolvedCredentialHandle {
+    readonly bindingId: CredentialBindingId;
+    readonly opaqueHandle: string;
+    readonly issuerRef: string;
+    readonly audience: CredentialHandleEnvelope["audience"];
+    readonly backendClass: CredentialHandleEnvelope["backendClass"];
+    readonly expiresAt?: string;
+}
+export interface OutboxRecord {
+    readonly id: OutboxId;
+    readonly topic: "accounts.aggregate.changed" | "accounts.capsule.cleanup.requested";
+    readonly aggregateKind: EntityKind | "credential_operation";
+    readonly aggregateId: string;
+    readonly eventId?: AccountEventId;
+    readonly payloadDigest: string;
+    readonly payloadJson: string;
+    readonly status: "pending" | "in_flight" | "delivered" | "dead_letter";
+    readonly attemptCount: Counter;
+    readonly claimOwnerRef?: string;
+    readonly claimExpiresAt?: string;
+    readonly createdAt: string;
+}
+export interface OutboxClaimRequest {
+    readonly workerRef: string;
+    readonly limit: number;
+    readonly now: string;
+    readonly claimExpiresAt: string;
+}
+export interface OutboxAcknowledgeRequest {
+    readonly outboxId: OutboxId;
+    readonly workerRef: string;
+    readonly expectedAttemptCount: Counter;
+    readonly outcome: "delivered" | "retry" | "dead_letter";
+    readonly now: string;
+}
+export interface NativeRevocationRequest {
+    readonly capsuleId: AuthCapsuleId;
+    readonly bindingId: CredentialBindingId;
+    readonly barrierBindingId: CredentialBindingId;
+    readonly operationId: CredentialOperationId;
+    readonly expectedPoolRevision: Counter;
+    readonly expectedMethodRevision: Counter;
+    readonly expectedCapsuleRevision: Counter;
+    readonly expectedBindingRevision: Counter;
+    readonly occurredAt: string;
+    readonly context: MutationContext;
+}
+export interface NativeRevocationResult {
+    readonly pool: CapacityPool;
+    readonly method: AccessMethod;
+    readonly capsule: AuthCapsule;
+    readonly retiredBinding: CredentialBinding;
+    readonly barrierBinding: CredentialBinding;
+    readonly operation: CredentialOperation;
+    readonly replayed: boolean;
+}
+export interface EligibilitySnapshot {
+    readonly method?: AccessMethod;
+    readonly entitlement?: Entitlement;
+    readonly account?: Account;
+    readonly pool?: CapacityPool;
+    readonly capsules: readonly AuthCapsule[];
+    readonly bindings: readonly CredentialBinding[];
+    readonly recovery: RecoverySnapshot;
+}
+export interface AccountsRepository {
+    get<K extends EntityKind>(kind: K, id: EntityMap[K]["id"]): Promise<EntityMap[K] | undefined>;
+    list<K extends EntityKind>(kind: K): Promise<readonly EntityMap[K][]>;
+    readEligibilitySnapshot(accessMethodId: AccessMethod["id"]): Promise<EligibilitySnapshot>;
+    insert<K extends EntityKind>(kind: K, record: EntityMap[K], context: MutationContext): Promise<MutationResult<EntityMap[K]>>;
+    insertCredentialBinding(record: CredentialBinding, handle: CredentialHandleEnvelope, context: MutationContext): Promise<MutationResult<CredentialBinding>>;
+    insertCapacityPoolWithAuthorityEvidence(record: CapacityPool, evidence: VerifiedAuthorityEvidenceRecord, context: MutationContext): Promise<MutationResult<CapacityPool>>;
+    promoteWithAuthorityEvidence<K extends AuthorityPromotionKind>(kind: K, record: EntityMap[K], expectedRevision: Counter, evidence: readonly VerifiedAuthorityEvidenceRecord[], context: MutationContext): Promise<MutationResult<EntityMap[K]>>;
+    resolveCredentialHandle(bindingId: CredentialBindingId, grant: CredentialResolutionGrant, transport: CredentialResolutionTransport): Promise<ResolvedCredentialHandle>;
+    revokeNativeGeneration(request: NativeRevocationRequest): Promise<NativeRevocationResult>;
+    credentialOperations(): Promise<readonly CredentialOperation[]>;
+    outbox(): Promise<readonly OutboxRecord[]>;
+    claimOutbox(request: OutboxClaimRequest): Promise<readonly OutboxRecord[]>;
+    acknowledgeOutbox(request: OutboxAcknowledgeRequest): Promise<OutboxRecord>;
+    replace<K extends EntityKind>(kind: K, record: EntityMap[K], expectedRevision: Counter, context: MutationContext): Promise<MutationResult<EntityMap[K]>>;
+    findReplacementReplay<K extends EntityKind>(kind: K, id: EntityMap[K]["id"], to: EntityMap[K]["status"], expectedRevision: Counter, context: MutationContext): Promise<MutationResult<EntityMap[K]> | undefined>;
+    events(): Promise<readonly AccountEvent[]>;
+    doctor(): Promise<RepositoryDoctor>;
+    close(): Promise<void>;
+}

package/dist/storage/shared.d.ts

@@ -0,0 +1,18 @@
+import { type Counter } from "../domain/counter";
+import type { EntityKind, EntityMap } from "../domain/models";
+import type { CredentialBinding } from "../domain/models";
+import type { AccountsRepository, CredentialHandleEnvelope, CredentialHandleExpectedClaims, MutationContext, OutboxAcknowledgeRequest, OutboxClaimRequest, AuthorityPromotionKind, VerifiedAuthorityEvidenceRecord } from "./repository";
+export declare function validateMutationContext(context: MutationContext): void;
+export declare function validateOutboxClaimRequest(request: OutboxClaimRequest): void;
+export declare function validateOutboxAcknowledgeRequest(request: OutboxAcknowledgeRequest): void;
+export declare function validateCredentialHandleEnvelope(binding: CredentialBinding, handle: CredentialHandleEnvelope): void;
+export declare function buildCredentialHandleExpectedClaims(repository: Pick<AccountsRepository, "get">, binding: CredentialBinding, authority: Pick<CredentialHandleExpectedClaims, "audience" | "catalogIncarnation" | "backendClass">): Promise<CredentialHandleExpectedClaims>;
+export declare function cloneEntity<K extends EntityKind>(kind: K, record: EntityMap[K]): EntityMap[K];
+export declare function mutationHash<K extends EntityKind>(operation: "insert" | "replace", kind: K, record: EntityMap[K], context: MutationContext, expectedRevision?: Counter): string;
+export declare function isAuthorityPromotion<K extends EntityKind>(kind: K, previous: EntityMap[K], next: EntityMap[K]): boolean;
+export declare function validateVerifiedAuthorityEvidence(kind: AuthorityPromotionKind, aggregateId: string, expectedRevision: Counter, evidence: readonly VerifiedAuthorityEvidenceRecord[]): readonly VerifiedAuthorityEvidenceRecord[];
+export declare function authorityPromotionHash<K extends AuthorityPromotionKind>(kind: K, record: EntityMap[K], expectedRevision: Counter, evidence: readonly VerifiedAuthorityEvidenceRecord[], context: MutationContext): string;
+export declare function authorityEvidenceInsertHash(record: EntityMap["capacity_pool"], evidence: VerifiedAuthorityEvidenceRecord, context: MutationContext): string;
+export declare function credentialBindingInsertHash(record: CredentialBinding, handle: CredentialHandleEnvelope, context: MutationContext): string;
+export declare function idempotencyScope(operation: "insert" | "replace", kind: EntityKind, context: MutationContext): string;
+export declare function assertReplacement<K extends EntityKind>(kind: K, previous: EntityMap[K], next: EntityMap[K], expectedRevision: Counter): void;

package/dist/storage/sqlite-migrations.d.ts

@@ -0,0 +1,11 @@
+export declare const SQLITE_SCHEMA_VERSION = 2;
+export declare const SQLITE_MIGRATION_V1 = "\nCREATE TABLE provider_accounts (\n  id TEXT PRIMARY KEY,\n  provider_key TEXT NOT NULL,\n  owner_ref TEXT NOT NULL,\n  provider_subject_ref TEXT,\n  status TEXT NOT NULL CHECK (status IN ('pending','active','suspended','revoked')),\n  revision INTEGER NOT NULL CHECK (revision >= 0),\n  created_at TEXT NOT NULL,\n  updated_at TEXT NOT NULL,\n  payload_json TEXT NOT NULL\n);\nCREATE UNIQUE INDEX provider_accounts_active_subject\n  ON provider_accounts(provider_key, provider_subject_ref)\n  WHERE provider_subject_ref IS NOT NULL AND status <> 'pending';\n\nCREATE TABLE provider_subject_claims (\n  provider_key TEXT NOT NULL,\n  provider_subject_ref TEXT NOT NULL,\n  owner_ref TEXT NOT NULL,\n  provider_account_id TEXT NOT NULL REFERENCES provider_accounts(id) ON DELETE RESTRICT,\n  claimed_at TEXT NOT NULL,\n  PRIMARY KEY (provider_key, provider_subject_ref),\n  UNIQUE (provider_account_id)\n);\n\nCREATE TABLE entitlements (\n  id TEXT PRIMARY KEY,\n  account_id TEXT NOT NULL REFERENCES provider_accounts(id) ON DELETE RESTRICT,\n  status TEXT NOT NULL CHECK (status IN ('pending','active','paused','expired','revoked')),\n  revision INTEGER NOT NULL CHECK (revision >= 0),\n  created_at TEXT NOT NULL,\n  updated_at TEXT NOT NULL,\n  payload_json TEXT NOT NULL\n);\n\nCREATE TABLE capacity_pools (\n  id TEXT PRIMARY KEY,\n  account_id TEXT NOT NULL REFERENCES provider_accounts(id) ON DELETE RESTRICT,\n  provider_key TEXT NOT NULL,\n  capacity_domain_ref TEXT NOT NULL,\n  serialization_key TEXT NOT NULL UNIQUE,\n  status TEXT NOT NULL CHECK (status IN ('pending','active','draining','denied','retired')),\n  deny_state TEXT NOT NULL CHECK (deny_state IN ('allowed','denied')),\n  revision INTEGER NOT NULL CHECK (revision >= 0),\n  capacity_generation INTEGER NOT NULL CHECK (capacity_generation >= 0),\n  deny_generation INTEGER NOT NULL CHECK (deny_generation >= 0),\n  created_at TEXT NOT NULL,\n  updated_at TEXT NOT NULL,\n  payload_json TEXT NOT NULL\n);\nCREATE UNIQUE INDEX capacity_pools_provider_domain\n  ON capacity_pools(provider_key, capacity_domain_ref);\n\nCREATE TABLE capacity_domain_claims (\n  provider_key TEXT NOT NULL,\n  capacity_domain_ref TEXT NOT NULL,\n  serialization_key TEXT NOT NULL UNIQUE,\n  owner_ref TEXT NOT NULL,\n  capacity_pool_id TEXT NOT NULL REFERENCES capacity_pools(id) ON DELETE RESTRICT,\n  claimed_at TEXT NOT NULL,\n  PRIMARY KEY (provider_key, capacity_domain_ref),\n  UNIQUE (capacity_pool_id)\n);\n\nCREATE TABLE access_methods (\n  id TEXT PRIMARY KEY,\n  entitlement_id TEXT NOT NULL REFERENCES entitlements(id) ON DELETE RESTRICT,\n  capacity_pool_id TEXT NOT NULL REFERENCES capacity_pools(id) ON DELETE RESTRICT,\n  access_transport TEXT NOT NULL CHECK (access_transport IN ('native_session','api_key','workload_identity')),\n  status TEXT NOT NULL CHECK (status IN ('draft','ready','draining','disabled','retired')),\n  revision INTEGER NOT NULL CHECK (revision >= 0),\n  created_at TEXT NOT NULL,\n  updated_at TEXT NOT NULL,\n  payload_json TEXT NOT NULL\n);\n\nCREATE TABLE auth_capsules (\n  id TEXT PRIMARY KEY,\n  access_method_id TEXT NOT NULL REFERENCES access_methods(id) ON DELETE RESTRICT,\n  capacity_pool_id TEXT NOT NULL REFERENCES capacity_pools(id) ON DELETE RESTRICT,\n  owner_ref TEXT NOT NULL,\n  placement_ref TEXT NOT NULL,\n  status TEXT NOT NULL CHECK (status IN ('unprovisioned','bootstrapping','ready','degraded','revoked')),\n  auth_generation INTEGER NOT NULL CHECK (auth_generation >= 0),\n  auth_state_revision INTEGER NOT NULL CHECK (auth_state_revision >= 0),\n  revision INTEGER NOT NULL CHECK (revision >= 0),\n  created_at TEXT NOT NULL,\n  updated_at TEXT NOT NULL,\n  payload_json TEXT NOT NULL\n);\nCREATE UNIQUE INDEX auth_capsules_one_live_per_pool\n  ON auth_capsules(capacity_pool_id)\n  WHERE status <> 'revoked';\n\nCREATE TABLE credential_family_claims (\n  credential_family_id TEXT PRIMARY KEY,\n  capacity_pool_id TEXT NOT NULL REFERENCES capacity_pools(id) ON DELETE RESTRICT,\n  owner_ref TEXT NOT NULL,\n  purpose TEXT NOT NULL CHECK (purpose IN ('provider_session','api_key','workload_identity')),\n  resolver TEXT NOT NULL CHECK (resolver IN ('brokered_secret','workload_identity','capsule_local_native')),\n  claimed_at TEXT NOT NULL\n);\n\nCREATE TABLE credential_bindings (\n  id TEXT PRIMARY KEY,\n  access_method_id TEXT NOT NULL REFERENCES access_methods(id) ON DELETE RESTRICT,\n  capacity_pool_id TEXT NOT NULL REFERENCES capacity_pools(id) ON DELETE RESTRICT,\n  auth_capsule_id TEXT REFERENCES auth_capsules(id) ON DELETE RESTRICT,\n  credential_family_id TEXT NOT NULL,\n  resolver TEXT NOT NULL CHECK (resolver IN ('brokered_secret','workload_identity','capsule_local_native')),\n  purpose TEXT NOT NULL CHECK (purpose IN ('provider_session','api_key','workload_identity')),\n  status TEXT NOT NULL CHECK (status IN ('pending','active','retiring','revoked')),\n  credential_generation INTEGER NOT NULL CHECK (credential_generation >= 0),\n  auth_state_revision INTEGER CHECK (auth_state_revision IS NULL OR auth_state_revision >= 0),\n  revision INTEGER NOT NULL CHECK (revision >= 0),\n  created_at TEXT NOT NULL,\n  updated_at TEXT NOT NULL,\n  payload_json TEXT NOT NULL,\n  CHECK (\n    (resolver = 'capsule_local_native' AND purpose = 'provider_session' AND auth_capsule_id IS NOT NULL AND auth_state_revision IS NOT NULL)\n    OR (resolver = 'brokered_secret' AND purpose = 'api_key' AND auth_capsule_id IS NULL AND auth_state_revision IS NULL)\n    OR (resolver = 'workload_identity' AND purpose = 'workload_identity' AND auth_capsule_id IS NULL AND auth_state_revision IS NULL)\n  )\n);\nCREATE UNIQUE INDEX credential_bindings_family_generation\n  ON credential_bindings(credential_family_id, credential_generation);\nCREATE UNIQUE INDEX credential_bindings_one_active_native\n  ON credential_bindings(capacity_pool_id, purpose)\n  WHERE resolver = 'capsule_local_native' AND status = 'active';\n\nCREATE TABLE account_events (\n  id TEXT PRIMARY KEY,\n  aggregate_kind TEXT NOT NULL CHECK (aggregate_kind IN ('account','entitlement','capacity_pool','access_method','auth_capsule','credential_binding')),\n  aggregate_id TEXT NOT NULL,\n  aggregate_revision INTEGER NOT NULL CHECK (aggregate_revision >= 0),\n  actor_ref TEXT NOT NULL,\n  reason_code TEXT NOT NULL,\n  occurred_at TEXT NOT NULL\n);\n\nCREATE TABLE idempotency_records (\n  scope TEXT PRIMARY KEY,\n  request_hash TEXT NOT NULL,\n  aggregate_kind TEXT NOT NULL,\n  aggregate_id TEXT NOT NULL,\n  event_id TEXT NOT NULL REFERENCES account_events(id) ON DELETE RESTRICT,\n  response_json TEXT NOT NULL,\n  created_at TEXT NOT NULL\n);\n";
+export declare const SQLITE_MIGRATION_V1_CHECKSUM: string;
+export declare const SQLITE_MIGRATION_V2 = "\nALTER TABLE access_methods RENAME TO account_lanes;\n\nCREATE TABLE accounts_installation (\n  singleton INTEGER PRIMARY KEY CHECK (singleton = 1),\n  deployment_mode TEXT NOT NULL CHECK (deployment_mode IN ('local','self_hosted')),\n  identity_realm TEXT NOT NULL,\n  organization_ref TEXT NOT NULL,\n  schema_version TEXT NOT NULL,\n  build_digest TEXT NOT NULL,\n  configuration_attestation_digest TEXT NOT NULL,\n  catalog_incarnation TEXT NOT NULL UNIQUE,\n  recovery_frontier_sequence INTEGER NOT NULL CHECK (recovery_frontier_sequence >= 0),\n  recovery_frontier_hash TEXT NOT NULL,\n  recovery_frontier_signature_digest TEXT NOT NULL,\n  database_frontier_sequence INTEGER NOT NULL CHECK (database_frontier_sequence >= 0),\n  database_frontier_hash TEXT NOT NULL,\n  database_frontier_signature_digest TEXT NOT NULL,\n  recovery_hold INTEGER NOT NULL CHECK (recovery_hold IN (0,1)),\n  created_at TEXT NOT NULL,\n  updated_at TEXT NOT NULL\n);\n\nALTER TABLE credential_bindings ADD COLUMN terminal_kind TEXT\n  CHECK (terminal_kind IS NULL OR terminal_kind IN ('retired_handle_generation','revocation_barrier'));\nALTER TABLE credential_bindings ADD COLUMN credential_handle_audit_digest TEXT;\nALTER TABLE credential_bindings ADD COLUMN last_usable_credential_generation INTEGER\n  CHECK (last_usable_credential_generation IS NULL OR last_usable_credential_generation >= 0);\nALTER TABLE credential_bindings ADD COLUMN revocation_barrier_receipt_digest TEXT;\nALTER TABLE credential_bindings ADD COLUMN revoked_at TEXT;\n\nCREATE TRIGGER credential_bindings_terminal_shape_insert\nBEFORE INSERT ON credential_bindings BEGIN\n  SELECT CASE\n    WHEN NEW.status <> 'revoked' AND (\n      NEW.terminal_kind IS NOT NULL OR NEW.credential_handle_audit_digest IS NOT NULL OR\n      NEW.last_usable_credential_generation IS NOT NULL OR\n      NEW.revocation_barrier_receipt_digest IS NOT NULL OR NEW.revoked_at IS NOT NULL\n    ) THEN RAISE(ABORT, 'credential terminal fields on nonterminal row')\n    WHEN NEW.status = 'revoked' AND NEW.terminal_kind = 'retired_handle_generation' AND (\n      NEW.credential_handle_audit_digest IS NULL OR NEW.last_usable_credential_generation IS NOT NULL OR\n      NEW.revocation_barrier_receipt_digest IS NULL OR NEW.revoked_at IS NULL\n    ) THEN RAISE(ABORT, 'invalid retired handle terminal row')\n    WHEN NEW.status = 'revoked' AND NEW.terminal_kind = 'revocation_barrier' AND (\n      NEW.credential_handle_audit_digest IS NOT NULL OR NEW.last_usable_credential_generation IS NULL OR\n      NEW.revocation_barrier_receipt_digest IS NULL OR NEW.revoked_at IS NULL\n    ) THEN RAISE(ABORT, 'invalid revocation barrier row')\n    WHEN NEW.status = 'revoked' AND NEW.terminal_kind IS NULL\n      THEN RAISE(ABORT, 'missing credential terminal kind')\n  END;\nEND;\n\nCREATE TRIGGER credential_bindings_terminal_shape_update\nBEFORE UPDATE ON credential_bindings BEGIN\n  SELECT CASE\n    WHEN NEW.status <> 'revoked' AND (\n      NEW.terminal_kind IS NOT NULL OR NEW.credential_handle_audit_digest IS NOT NULL OR\n      NEW.last_usable_credential_generation IS NOT NULL OR\n      NEW.revocation_barrier_receipt_digest IS NOT NULL OR NEW.revoked_at IS NOT NULL\n    ) THEN RAISE(ABORT, 'credential terminal fields on nonterminal row')\n    WHEN NEW.status = 'revoked' AND NEW.terminal_kind = 'retired_handle_generation' AND (\n      NEW.credential_handle_audit_digest IS NULL OR NEW.last_usable_credential_generation IS NOT NULL OR\n      NEW.revocation_barrier_receipt_digest IS NULL OR NEW.revoked_at IS NULL\n    ) THEN RAISE(ABORT, 'invalid retired handle terminal row')\n    WHEN NEW.status = 'revoked' AND NEW.terminal_kind = 'revocation_barrier' AND (\n      NEW.credential_handle_audit_digest IS NOT NULL OR NEW.last_usable_credential_generation IS NULL OR\n      NEW.revocation_barrier_receipt_digest IS NULL OR NEW.revoked_at IS NULL\n    ) THEN RAISE(ABORT, 'invalid revocation barrier row')\n    WHEN NEW.status = 'revoked' AND NEW.terminal_kind IS NULL\n      THEN RAISE(ABORT, 'missing credential terminal kind')\n  END;\nEND;\n\nCREATE TABLE credential_binding_handles (\n  binding_id TEXT PRIMARY KEY REFERENCES credential_bindings(id) ON DELETE RESTRICT,\n  opaque_handle TEXT NOT NULL CHECK (length(opaque_handle) BETWEEN 64 AND 1024),\n  issuer_ref TEXT NOT NULL,\n  audience TEXT NOT NULL CHECK (audience IN ('accounts-local','accounts-self-hosted')),\n  catalog_incarnation TEXT NOT NULL,\n  backend_class TEXT NOT NULL CHECK (backend_class IN ('secrets_broker','workload_identity_broker','capsule_protected_state')),\n  audit_digest TEXT NOT NULL,\n  issued_at TEXT NOT NULL,\n  expires_at TEXT\n);\nCREATE TRIGGER credential_binding_handles_nonterminal\nBEFORE INSERT ON credential_binding_handles BEGIN\n  SELECT CASE WHEN (SELECT status FROM credential_bindings WHERE id = NEW.binding_id) = 'revoked'\n    THEN RAISE(ABORT, 'revoked binding cannot retain a handle') END;\nEND;\nCREATE TRIGGER credential_bindings_revoke_removes_handle\nBEFORE UPDATE OF status ON credential_bindings\nWHEN NEW.status = 'revoked' AND EXISTS (\n  SELECT 1 FROM credential_binding_handles WHERE binding_id = NEW.id\n)\nBEGIN\n  SELECT RAISE(ABORT, 'credential handle must be removed before terminal update');\nEND;\n\nCREATE TABLE credential_operations (\n  id TEXT PRIMARY KEY,\n  kind TEXT NOT NULL CHECK (kind IN ('refresh','reauthentication','rotation','revocation')),\n  source_binding_id TEXT REFERENCES credential_bindings(id) ON DELETE RESTRICT,\n  target_binding_id TEXT REFERENCES credential_bindings(id) ON DELETE RESTRICT,\n  credential_family_id TEXT NOT NULL,\n  capacity_pool_id TEXT NOT NULL REFERENCES capacity_pools(id) ON DELETE RESTRICT,\n  serialization_key TEXT NOT NULL,\n  expected_source_generation INTEGER NOT NULL CHECK (expected_source_generation >= 0),\n  expected_auth_state_revision INTEGER CHECK (expected_auth_state_revision IS NULL OR expected_auth_state_revision >= 0),\n  proposed_target_generation INTEGER NOT NULL CHECK (proposed_target_generation >= 0),\n  proposed_auth_state_revision INTEGER CHECK (proposed_auth_state_revision IS NULL OR proposed_auth_state_revision >= 0),\n  state TEXT NOT NULL CHECK (state IN ('requested','quiescing','applying','verifying','completed','failed_before_dispatch','failed','quarantined')),\n  idempotency_request_hash TEXT NOT NULL,\n  barrier_receipt_digest TEXT,\n  completion_receipt_digest TEXT,\n  revision INTEGER NOT NULL CHECK (revision >= 0),\n  created_at TEXT NOT NULL,\n  updated_at TEXT NOT NULL\n);\nCREATE UNIQUE INDEX credential_operations_one_active_family_domain\n  ON credential_operations(credential_family_id, serialization_key)\n  WHERE state IN ('requested','quiescing','applying','verifying','failed_before_dispatch','failed');\n\nCREATE TABLE import_candidates (\n  id TEXT PRIMARY KEY,\n  checksum TEXT NOT NULL,\n  redacted_metadata_json TEXT NOT NULL,\n  state TEXT NOT NULL CHECK (state IN ('pending','confirmed','cancelled','rejected')),\n  revision INTEGER NOT NULL CHECK (revision >= 0),\n  created_at TEXT NOT NULL,\n  updated_at TEXT NOT NULL\n);\n\nCREATE TABLE evidence_records (\n  id TEXT PRIMARY KEY,\n  evidence_type TEXT NOT NULL,\n  aggregate_kind TEXT NOT NULL CHECK (aggregate_kind IN ('provider_account','capacity_pool','entitlement','account_lane')),\n  aggregate_id TEXT NOT NULL,\n  aggregate_revision INTEGER NOT NULL CHECK (aggregate_revision >= 0),\n  evidence_generation INTEGER NOT NULL CHECK (evidence_generation > 0),\n  nonce TEXT NOT NULL UNIQUE,\n  issuer_ref TEXT NOT NULL,\n  issuer_class TEXT NOT NULL CHECK (issuer_class IN ('provider_ownership_verifier','provider_capacity_verifier','execution_policy_authority','terms_authority','adapter_health_reporter')),\n  issuer_incarnation TEXT NOT NULL,\n  audience TEXT NOT NULL,\n  identity_realm TEXT NOT NULL,\n  key_id TEXT NOT NULL,\n  subject_ref TEXT NOT NULL,\n  payload_digest TEXT NOT NULL,\n  envelope_digest TEXT NOT NULL UNIQUE,\n  envelope_json TEXT NOT NULL,\n  issued_at TEXT NOT NULL,\n  expires_at TEXT NOT NULL,\n  created_at TEXT NOT NULL\n);\nCREATE INDEX evidence_records_lookup\n  ON evidence_records(aggregate_kind, aggregate_id, aggregate_revision, evidence_type);\n\nCREATE TABLE recovery_ledger_receipts (\n  sequence INTEGER PRIMARY KEY CHECK (sequence >= 0),\n  frontier_hash TEXT NOT NULL UNIQUE,\n  frontier_signature_digest TEXT NOT NULL,\n  catalog_incarnation TEXT NOT NULL,\n  receipt_digest TEXT NOT NULL UNIQUE,\n  entry_kind TEXT NOT NULL,\n  aggregate_id TEXT,\n  created_at TEXT NOT NULL\n);\n\nCREATE TABLE slot_eligibility_audit (\n  id TEXT PRIMARY KEY,\n  access_method_id TEXT NOT NULL REFERENCES account_lanes(id) ON DELETE RESTRICT,\n  decision TEXT NOT NULL CHECK (decision IN ('eligible','ineligible')),\n  reason_codes_json TEXT NOT NULL,\n  request_digest TEXT NOT NULL,\n  record_revision_digest TEXT NOT NULL,\n  recovery_frontier_sequence INTEGER NOT NULL CHECK (recovery_frontier_sequence >= 0),\n  recovery_frontier_hash TEXT NOT NULL,\n  created_at TEXT NOT NULL\n);\n\nCREATE TABLE outbox (\n  id TEXT PRIMARY KEY,\n  topic TEXT NOT NULL CHECK (topic IN ('accounts.aggregate.changed','accounts.capsule.cleanup.requested')),\n  aggregate_kind TEXT NOT NULL,\n  aggregate_id TEXT NOT NULL,\n  event_id TEXT REFERENCES account_events(id) ON DELETE RESTRICT,\n  payload_digest TEXT NOT NULL,\n  payload_json TEXT NOT NULL,\n  status TEXT NOT NULL CHECK (status IN ('pending','in_flight','delivered','dead_letter')),\n  attempt_count INTEGER NOT NULL CHECK (attempt_count >= 0),\n  claim_owner_ref TEXT,\n  claim_expires_at TEXT,\n  created_at TEXT NOT NULL\n);\nCREATE INDEX outbox_pending_order ON outbox(status, created_at, id);\n";
+export declare const SQLITE_MIGRATION_V2_CHECKSUM: string;
+export declare const SQLITE_MIGRATION_CHECKSUM: string;
+export declare const SQLITE_MIGRATIONS: readonly {
+    version: number;
+    sql: string;
+    checksum: string;
+}[];

package/dist/storage/sqlite.d.ts

@@ -0,0 +1,51 @@
+import { type Counter } from "../domain/counter";
+import type { CredentialBinding, CredentialOperation, EntityKind, EntityMap } from "../domain/models";
+import type { AccountEvent, AccountsRepository, MutationContext, MutationResult, RepositoryDoctor, EligibilitySnapshot, CredentialHandleEnvelope, CredentialHandleVerifier, CredentialResolutionGrant, CredentialResolutionTransport, CredentialUseAuthorizer, NativeRevocationRequest, NativeRevocationResult, OutboxRecord, OutboxAcknowledgeRequest, OutboxClaimRequest, RecoveryLedger, ResolvedCredentialHandle, AuthorityPromotionKind, VerifiedAuthorityEvidenceRecord } from "./repository";
+export declare class SQLiteAccountsRepository implements AccountsRepository {
+    readonly filename: string;
+    private readonly database;
+    private readonly credentialVerifier;
+    private readonly recoveryLedger;
+    private readonly credentialUseAuthorizer;
+    private readonly configuredCatalogIncarnation;
+    private closed;
+    constructor(filename: string, options?: {
+        readonly credentialVerifier?: CredentialHandleVerifier;
+        readonly recoveryLedger?: RecoveryLedger;
+        readonly catalogIncarnation?: string;
+        readonly credentialUseAuthorizer?: CredentialUseAuthorizer;
+    });
+    get<K extends EntityKind>(kind: K, id: EntityMap[K]["id"]): Promise<EntityMap[K] | undefined>;
+    list<K extends EntityKind>(kind: K): Promise<readonly EntityMap[K][]>;
+    readEligibilitySnapshot(accessMethodId: EntityMap["access_method"]["id"]): Promise<EligibilitySnapshot>;
+    insert<K extends EntityKind>(kind: K, input: EntityMap[K], context: MutationContext): Promise<MutationResult<EntityMap[K]>>;
+    insertCapacityPoolWithAuthorityEvidence(input: EntityMap["capacity_pool"], inputEvidence: VerifiedAuthorityEvidenceRecord, context: MutationContext): Promise<MutationResult<EntityMap["capacity_pool"]>>;
+    insertCredentialBinding(input: CredentialBinding, inputHandle: CredentialHandleEnvelope, context: MutationContext): Promise<MutationResult<CredentialBinding>>;
+    resolveCredentialHandle(bindingId: CredentialBinding["id"], grant: CredentialResolutionGrant, transport: CredentialResolutionTransport): Promise<ResolvedCredentialHandle>;
+    replace<K extends EntityKind>(kind: K, input: EntityMap[K], expectedRevision: Counter, context: MutationContext): Promise<MutationResult<EntityMap[K]>>;
+    promoteWithAuthorityEvidence<K extends AuthorityPromotionKind>(kind: K, input: EntityMap[K], expectedRevision: Counter, inputEvidence: readonly VerifiedAuthorityEvidenceRecord[], context: MutationContext): Promise<MutationResult<EntityMap[K]>>;
+    events(): Promise<readonly AccountEvent[]>;
+    revokeNativeGeneration(request: NativeRevocationRequest): Promise<NativeRevocationResult>;
+    credentialOperations(): Promise<readonly CredentialOperation[]>;
+    outbox(): Promise<readonly OutboxRecord[]>;
+    claimOutbox(request: OutboxClaimRequest): Promise<readonly OutboxRecord[]>;
+    acknowledgeOutbox(request: OutboxAcknowledgeRequest): Promise<OutboxRecord>;
+    findReplacementReplay<K extends EntityKind>(kind: K, id: EntityMap[K]["id"], to: EntityMap[K]["status"], expectedRevision: Counter, context: MutationContext): Promise<MutationResult<EntityMap[K]> | undefined>;
+    doctor(): Promise<RepositoryDoctor>;
+    close(): Promise<void>;
+    private installationCatalogIncarnation;
+    private readRecoverySnapshot;
+    private appendRecovery;
+    private migrate;
+    private readOne;
+    private insertRecord;
+    private updateRecord;
+    private recordMutation;
+    private appendEventAndOutbox;
+    private appendCleanupOutbox;
+    private insertOperation;
+    private readNativeRevocationResult;
+    private replay;
+    private secureFiles;
+    private assertOpen;
+}

package/dist/version.d.ts

@@ -0,0 +1,2 @@
+export declare const PACKAGE_VERSION: "0.1.0";
+export declare const ACCOUNTS_V1_CONTRACT_SHA256: "0d2b45c286f56452312b251b7622e009c486e2fe71fe8f2a5a59c01472eb8b2a";

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@hasna/capacity",
+  "version": "0.1.0",
+  "description": "Fail-closed provider account capacity metadata for local and self-hosted Hasna deployments",
+  "type": "module",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/hasna/capacity.git"
+  },
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./capacity": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "bin": {
+    "capacity": "./dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "rm -rf dist && bun run build:js && bun run build:types",
+    "build:js": "bun build src/index.ts --outdir dist --target bun --format esm && bun build src/cli.ts --outfile dist/cli.js --target bun --format esm",
+    "build:types": "tsc -p tsconfig.build.json",
+    "test": "bun test",
+    "test:unit": "bun test test/unit",
+    "test:storage": "bun test test/storage",
+    "typecheck": "tsc --noEmit"
+  },
+  "devDependencies": {
+    "@types/bun": "1.3.5",
+    "typescript": "5.9.3"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "bun": ">=1.3.0"
+  }
+}