@hasna/capacity 0.1.0

package/dist/domain/online-generation-receipt.d.ts

@@ -0,0 +1,497 @@
+import { type KeyObject } from "node:crypto";
+import { type Counter } from "./counter";
+export declare const ONLINE_GENERATION_CHECK_RECEIPT_SCHEMA_VERSION: "accounts.online-generation-check-receipt.v1";
+export declare const ONLINE_GENERATION_RECEIPT_MAXIMUM_AGE_MS: 60000;
+export declare const ONLINE_GENERATION_RECEIPT_MAXIMUM_LIFETIME_MS: 120000;
+export declare const ONLINE_GENERATION_RECEIPT_MAXIMUM_CLOCK_SKEW_MS: 5000;
+export declare const ONLINE_GENERATION_RECEIPT_MAX_USES: 1n;
+export declare const CAPABILITY_USE_CONSUME_REQUEST_SCHEMA_VERSION: "accounts.capability-use-consume-request.v1";
+export declare const CAPABILITY_USE_CONSUME_REQUEST_SCHEMA_DIGEST: "sha256:a7cdc1dfbebeaea3bad6a5014cfb5189be40fb010f57161b46437458492cd1bc";
+export declare const CAPABILITY_USE_CONSUME_RECEIPT_SCHEMA_VERSION: "accounts.capability-use-consume-receipt.v1";
+export declare const CAPABILITY_USE_CONSUME_RECEIPT_SCHEMA_DIGEST: "sha256:a0999ffabc197f46f6fdeb8a6b78521364b0f2153d52a0e6e63ee360bb408bce";
+export type OnlineGenerationAccessTransport = "native_session" | "api_key" | "workload_identity";
+export type OnlineGenerationAllowedChannelClass = "capsule_remote_tool" | "brokered_provider_proxy";
+export interface ProviderDestinationPolicy {
+    readonly scheme: "https";
+    readonly normalized_host: string;
+    readonly port: string;
+    readonly operation_path: string;
+    readonly model: string;
+    readonly request_body_digest: string;
+    readonly tls_server_name: string;
+    readonly resolved_address_class: string;
+    readonly egress_policy_digest: string;
+}
+interface OnlineGenerationReceiptBaseDraft {
+    readonly schema_version: typeof ONLINE_GENERATION_CHECK_RECEIPT_SCHEMA_VERSION;
+    readonly schema_digest: string;
+    readonly receipt_id: string;
+    readonly issuer: string;
+    readonly issuer_incarnation: string;
+    readonly key_id: string;
+    readonly audience: string;
+    readonly nonce: string;
+    readonly issued_at: string;
+    readonly not_before: string;
+    readonly expires_at: string;
+    readonly capability_id: string;
+    readonly capability_digest: string;
+    readonly authority_epoch: Counter;
+    readonly route_lineage_id: string;
+    readonly route_id: string;
+    readonly route_epoch: Counter;
+    readonly run_id: string;
+    readonly attempt_id: string;
+    readonly attempt_lease_id: string;
+    readonly lease_epoch: Counter;
+    readonly resource_lease_id: string;
+    readonly resource_id: string;
+    readonly resource_lifecycle_generation: Counter;
+    readonly lease_expires_at: string;
+    readonly operation_id: string;
+    readonly operation_digest: string;
+    readonly operation_execution_epoch: Counter;
+    readonly operation_execution_expires_at: string;
+    readonly subject: string;
+    readonly actor_principal: string;
+    readonly lease_holder_principal: string;
+    readonly operation_executor_principal: string;
+    readonly sender_key_thumbprint: string;
+    readonly provider_account_id: string;
+    readonly account_lane_id: string;
+    readonly capacity_pool_id: string;
+    readonly capacity_domain_ref: string;
+    readonly access_transport: OnlineGenerationAccessTransport;
+    readonly credential_family_id: string;
+    readonly capacity_generation: Counter;
+    readonly deny_generation: Counter;
+    readonly credential_generation: Counter;
+    readonly accounts_revision_set_digest: string;
+    readonly allowed_channel_class: OnlineGenerationAllowedChannelClass;
+    readonly slot_eligibility_digest: string;
+    readonly approval_ref: string;
+    readonly policy_digest: string;
+    readonly canonical_request_digest: string;
+    readonly provider_destination_policy: ProviderDestinationPolicy;
+    readonly provider_destination_policy_digest: string;
+    readonly sender_constraint_confirmation: string;
+    readonly max_uses: Counter;
+    readonly use_count: Counter;
+    readonly catalog_incarnation: string;
+    readonly recovery_frontier_sequence: Counter;
+    readonly recovery_frontier_hash: string;
+}
+export type OnlineGenerationReceiptDecision = {
+    readonly allowed: true;
+    readonly deny_state: "allowed";
+    readonly reason_codes: readonly [];
+    readonly current_deny?: never;
+} | {
+    readonly allowed: false;
+    readonly deny_state: "allowed";
+    readonly reason_codes: readonly string[];
+    readonly current_deny?: never;
+} | {
+    readonly allowed: false;
+    readonly deny_state: "denied";
+    readonly reason_codes: readonly string[];
+    readonly current_deny: true;
+};
+export interface NativeOnlineGenerationReceiptTarget {
+    readonly access_transport: "native_session";
+    readonly allowed_channel_class: "capsule_remote_tool";
+    readonly auth_capsule_id: string;
+    readonly canonical_node_id: string;
+    readonly node_key_thumbprint: string;
+    readonly node_generation: Counter;
+    readonly placement_generation: Counter;
+    readonly auth_generation: Counter;
+    readonly auth_state_revision: Counter;
+}
+export interface BrokeredOnlineGenerationReceiptTarget {
+    readonly access_transport: "api_key" | "workload_identity";
+    readonly allowed_channel_class: "brokered_provider_proxy";
+    readonly credential_binding_id: string;
+    readonly broker_ref: string;
+}
+export type OnlineGenerationCheckReceiptDraft = OnlineGenerationReceiptBaseDraft & OnlineGenerationReceiptDecision & (NativeOnlineGenerationReceiptTarget | BrokeredOnlineGenerationReceiptTarget);
+type OnlineGenerationCheckReceipt = OnlineGenerationCheckReceiptDraft & {
+    readonly signature: string;
+};
+declare const verifiedReceiptBrand: unique symbol;
+declare const allowedReceiptBrand: unique symbol;
+declare const projectedReceiptBrand: unique symbol;
+declare const consumedReceiptUseBrand: unique symbol;
+declare const verifiedConsumeReceiptBrand: unique symbol;
+export type VerifiedOnlineGenerationCheckReceipt = OnlineGenerationCheckReceipt & {
+    readonly [verifiedReceiptBrand]: true;
+};
+export type VerifiedAllowedOnlineGenerationCheckReceipt = VerifiedOnlineGenerationCheckReceipt & {
+    readonly allowed: true;
+    readonly [allowedReceiptBrand]: true;
+};
+export interface OnlineGenerationCheckReceiptTrustRoot {
+    readonly schemaDigest: string;
+    readonly issuer: string;
+    readonly issuerIncarnation: string;
+    readonly keyId: string;
+    readonly audience: string;
+    readonly publicKey: KeyObject;
+    readonly revoked: boolean;
+}
+export type OnlineGenerationDecisionExpectation = {
+    readonly allowed: true;
+    readonly denyState: "allowed";
+    readonly reasonCodes: readonly [];
+    readonly currentDeny?: never;
+} | {
+    readonly allowed: false;
+    readonly denyState: "allowed";
+    readonly reasonCodes: readonly string[];
+    readonly currentDeny?: never;
+} | {
+    readonly allowed: false;
+    readonly denyState: "denied";
+    readonly reasonCodes: readonly string[];
+    readonly currentDeny: true;
+};
+export type OnlineGenerationTargetExpectation = {
+    readonly kind: "native";
+    readonly authCapsuleId: string;
+    readonly canonicalNodeId: string;
+    readonly nodeKeyThumbprint: string;
+    readonly nodeGeneration: Counter;
+    readonly placementGeneration: Counter;
+    readonly authGeneration: Counter;
+    readonly authStateRevision: Counter;
+} | {
+    readonly kind: "brokered";
+    readonly credentialBindingId: string;
+    readonly brokerRef: string;
+};
+/**
+ * The caller supplies the coherent live Infinity/Accounts tuple it is about to
+ * use. Verification compares every security-significant receipt member to this
+ * tuple; there is no partial/four-epoch verification mode.
+ */
+export interface OnlineGenerationCheckReceiptExpectation {
+    readonly now: Date;
+    readonly maximumAgeMs: number;
+    readonly maximumLifetimeMs: number;
+    readonly allowedClockSkewMs?: number;
+    /** Independently derived from the authenticated transport, never the receipt. */
+    readonly authenticatedActorPrincipal: string;
+    readonly receipt: {
+        readonly receiptId: string;
+        readonly nonce: string;
+        readonly issuedAt: string;
+        readonly notBefore: string;
+        readonly expiresAt: string;
+    };
+    readonly capability: {
+        readonly capabilityId: string;
+        readonly capabilityDigest: string;
+    };
+    readonly route: {
+        readonly authorityEpoch: Counter;
+        readonly routeLineageId: string;
+        readonly routeId: string;
+        readonly routeEpoch: Counter;
+    };
+    readonly attempt: {
+        readonly runId: string;
+        readonly attemptId: string;
+        readonly attemptLeaseId: string;
+        readonly leaseEpoch: Counter;
+    };
+    readonly resourceLease: {
+        readonly resourceLeaseId: string;
+        readonly resourceId: string;
+        readonly resourceLifecycleGeneration: Counter;
+        readonly leaseExpiresAt: string;
+    };
+    readonly operation: {
+        readonly operationId: string;
+        readonly operationDigest: string;
+        readonly operationExecutionEpoch: Counter;
+        readonly operationExecutionExpiresAt: string;
+    };
+    readonly principals: {
+        readonly subject: string;
+        readonly actorPrincipal: string;
+        readonly leaseHolderPrincipal: string;
+        readonly operationExecutorPrincipal: string;
+        readonly senderKeyThumbprint: string;
+    };
+    readonly account: {
+        readonly providerAccountId: string;
+        readonly accountLaneId: string;
+        readonly capacityPoolId: string;
+        readonly capacityDomainRef: string;
+        readonly accessTransport: OnlineGenerationAccessTransport;
+        readonly credentialFamilyId: string;
+        readonly allowedChannelClass: OnlineGenerationAllowedChannelClass;
+    };
+    readonly decision: OnlineGenerationDecisionExpectation;
+    readonly generations: {
+        readonly capacityGeneration: Counter;
+        readonly denyGeneration: Counter;
+        readonly credentialGeneration: Counter;
+        readonly accountsRevisionSetDigest: string;
+    };
+    readonly authorization: {
+        readonly slotEligibilityDigest: string;
+        readonly approvalRef: string;
+        readonly policyDigest: string;
+        readonly canonicalRequestDigest: string;
+        readonly senderConstraintConfirmation: string;
+        readonly maxUses: Counter;
+        readonly useCount: Counter;
+    };
+    readonly destination: {
+        readonly policy: ProviderDestinationPolicy;
+        readonly policyDigest: string;
+    };
+    readonly recovery: {
+        readonly catalogIncarnation: string;
+        readonly recoveryFrontierSequence: Counter;
+        readonly recoveryFrontierHash: string;
+    };
+    readonly target: OnlineGenerationTargetExpectation;
+}
+export interface ProviderDestinationPolicySdk {
+    readonly scheme: "https";
+    readonly normalizedHost: string;
+    readonly port: string;
+    readonly operationPath: string;
+    readonly model: string;
+    readonly requestBodyDigest: string;
+    readonly tlsServerName: string;
+    readonly resolvedAddressClass: string;
+    readonly egressPolicyDigest: string;
+}
+export type OnlineGenerationReceiptTargetSdk = {
+    readonly kind: "native";
+    readonly authCapsuleId: string;
+    readonly canonicalNodeId: string;
+    readonly nodeKeyThumbprint: string;
+    readonly nodeGeneration: Counter;
+    readonly placementGeneration: Counter;
+    readonly authGeneration: Counter;
+    readonly authStateRevision: Counter;
+} | {
+    readonly kind: "brokered";
+    readonly credentialBindingId: string;
+    readonly brokerRef: string;
+};
+interface OnlineGenerationCheckReceiptSdk {
+    readonly schemaVersion: typeof ONLINE_GENERATION_CHECK_RECEIPT_SCHEMA_VERSION;
+    readonly schemaDigest: string;
+    readonly receiptId: string;
+    readonly issuer: string;
+    readonly issuerIncarnation: string;
+    readonly keyId: string;
+    readonly audience: string;
+    readonly nonce: string;
+    readonly issuedAt: string;
+    readonly notBefore: string;
+    readonly expiresAt: string;
+    readonly signature: string;
+    readonly capabilityId: string;
+    readonly capabilityDigest: string;
+    readonly authorityEpoch: Counter;
+    readonly routeLineageId: string;
+    readonly routeId: string;
+    readonly routeEpoch: Counter;
+    readonly runId: string;
+    readonly attemptId: string;
+    readonly attemptLeaseId: string;
+    readonly leaseEpoch: Counter;
+    readonly resourceLeaseId: string;
+    readonly resourceId: string;
+    readonly resourceLifecycleGeneration: Counter;
+    readonly leaseExpiresAt: string;
+    readonly operationId: string;
+    readonly operationDigest: string;
+    readonly operationExecutionEpoch: Counter;
+    readonly operationExecutionExpiresAt: string;
+    readonly subject: string;
+    readonly actorPrincipal: string;
+    readonly leaseHolderPrincipal: string;
+    readonly operationExecutorPrincipal: string;
+    readonly senderKeyThumbprint: string;
+    readonly providerAccountId: string;
+    readonly accountLaneId: string;
+    readonly capacityPoolId: string;
+    readonly capacityDomainRef: string;
+    readonly accessTransport: OnlineGenerationAccessTransport;
+    readonly credentialFamilyId: string;
+    readonly allowed: boolean;
+    readonly denyState: "allowed" | "denied";
+    readonly reasonCodes: readonly string[];
+    readonly currentDeny?: true;
+    readonly capacityGeneration: Counter;
+    readonly denyGeneration: Counter;
+    readonly credentialGeneration: Counter;
+    readonly accountsRevisionSetDigest: string;
+    readonly allowedChannelClass: OnlineGenerationAllowedChannelClass;
+    readonly slotEligibilityDigest: string;
+    readonly approvalRef: string;
+    readonly policyDigest: string;
+    readonly canonicalRequestDigest: string;
+    readonly providerDestinationPolicy: ProviderDestinationPolicySdk;
+    readonly providerDestinationPolicyDigest: string;
+    readonly senderConstraintConfirmation: string;
+    readonly maxUses: Counter;
+    readonly useCount: Counter;
+    readonly catalogIncarnation: string;
+    readonly recoveryFrontierSequence: Counter;
+    readonly recoveryFrontierHash: string;
+    readonly target: OnlineGenerationReceiptTargetSdk;
+}
+export type ProjectedOnlineGenerationCheckReceipt = OnlineGenerationCheckReceiptSdk & {
+    readonly [projectedReceiptBrand]: true;
+};
+export interface OnlineGenerationReceiptUseCasRequest {
+    readonly schema_version: typeof CAPABILITY_USE_CONSUME_REQUEST_SCHEMA_VERSION;
+    readonly schema_digest: typeof CAPABILITY_USE_CONSUME_REQUEST_SCHEMA_DIGEST;
+    readonly consume_request_id: string;
+    readonly capability_id: string;
+    readonly capability_digest: string;
+    readonly nonce: string;
+    readonly subject: string;
+    readonly actor_principal: string;
+    readonly account_lane_id: string;
+    readonly capacity_pool_id: string;
+    readonly capacity_domain_ref: string;
+    readonly credential_family_id: string;
+    readonly resource_lease_id: string;
+    readonly resource_id: string;
+    readonly resource_lifecycle_generation: Counter;
+    readonly operation_id: string;
+    readonly operation_digest: string;
+    readonly operation_execution_epoch: Counter;
+    readonly sender_key_thumbprint: string;
+    readonly channel_binding_digest: string;
+    readonly canonical_request_digest: string;
+    readonly provider_destination_policy_digest: string;
+    readonly online_receipt_id: string;
+    readonly online_receipt_digest: string;
+    readonly model_call_anchor_digest: string;
+    readonly expected_use_count: Counter;
+    readonly max_uses: Counter;
+    /** Earliest online-receipt, resource-lease, or operation-execution expiry. */
+    readonly not_after: string;
+    readonly idempotency_key_digest: string;
+}
+export type OnlineGenerationReceiptUseCasResult = {
+    readonly status: "consumed" | "replayed";
+    /** Canonical UTF-8 bytes of the exact signed consume receipt. */
+    readonly signedReceipt: Uint8Array;
+} | {
+    readonly status: "idempotency_conflict" | "conflict" | "exhausted";
+};
+/**
+ * Accounts-owned durable adapter. compareAndConsume MUST verify the coherent
+ * current Accounts tuple and atomically insert the one-use tombstone before it
+ * returns a signed receipt. The tombstone and idempotency record MUST survive
+ * database restore. An exact request replay returns the original receipt bytes;
+ * changed bytes under the same consume_request_id return idempotency_conflict.
+ * A restorable in-memory/request-local set is insufficient.
+ */
+export interface OnlineGenerationReceiptUseStore {
+    compareAndConsume(request: OnlineGenerationReceiptUseCasRequest): OnlineGenerationReceiptUseCasResult | Promise<OnlineGenerationReceiptUseCasResult>;
+}
+/**
+ * Effect-bound refresh hooks. The clock must be trusted process/deployment
+ * time, and refreshExpectation must directly re-read the coherent current
+ * Accounts deny/generation tuple; it must not return cached success.
+ */
+export interface OnlineGenerationReceiptUseGuard {
+    readonly clock: () => Date;
+    /** Independently derived from the authenticated sender channel. */
+    readonly authenticatedChannelBindingDigest: string;
+    readonly consumeRequestId: string;
+    /** Digest of the already durable PREPARED model-call anchor. */
+    readonly modelCallAnchorDigest: string;
+    readonly idempotencyKeyDigest: string;
+    readonly refreshExpectation: (receipt: VerifiedAllowedOnlineGenerationCheckReceipt, checkedAt: Date) => OnlineGenerationCheckReceiptExpectation | Promise<OnlineGenerationCheckReceiptExpectation>;
+}
+interface CapabilityUseConsumeReceipt {
+    readonly schema_version: typeof CAPABILITY_USE_CONSUME_RECEIPT_SCHEMA_VERSION;
+    readonly schema_digest: typeof CAPABILITY_USE_CONSUME_RECEIPT_SCHEMA_DIGEST;
+    readonly consume_request_id: string;
+    readonly consume_receipt_id: string;
+    readonly issuer: string;
+    readonly issuer_incarnation: string;
+    readonly key_id: string;
+    readonly audience: string;
+    readonly capability_id: string;
+    readonly capability_digest: string;
+    readonly nonce: string;
+    readonly subject: string;
+    readonly actor_principal: string;
+    readonly account_lane_id: string;
+    readonly capacity_pool_id: string;
+    readonly resource_lease_id: string;
+    readonly operation_id: string;
+    readonly operation_execution_epoch: Counter;
+    readonly sender_key_thumbprint: string;
+    readonly channel_binding_digest: string;
+    readonly canonical_request_digest: string;
+    readonly online_receipt_digest: string;
+    readonly model_call_anchor_digest: string;
+    readonly max_uses: Counter;
+    readonly prior_use_count: Counter;
+    readonly next_use_count: Counter;
+    readonly use_ordinal: Counter;
+    readonly use_id: string;
+    readonly committed_at: string;
+    readonly expires_at: string;
+    readonly catalog_incarnation: string;
+    readonly recovery_frontier_sequence: Counter;
+    readonly recovery_frontier_hash: string;
+    readonly signature: string;
+}
+export type VerifiedCapabilityUseConsumeReceipt = CapabilityUseConsumeReceipt & {
+    readonly [verifiedConsumeReceiptBrand]: true;
+};
+export interface ConsumedOnlineGenerationReceiptUse {
+    readonly receipt: VerifiedAllowedOnlineGenerationCheckReceipt;
+    readonly use: {
+        readonly request: OnlineGenerationReceiptUseCasRequest;
+        readonly consumeReceipt: VerifiedCapabilityUseConsumeReceipt;
+        readonly consumeReceiptDigest: string;
+        readonly useId: string;
+        readonly priorUseCount: Counter;
+        readonly nextUseCount: Counter;
+        readonly useOrdinal: Counter;
+        readonly committedAt: string;
+        readonly expiresAt: string;
+        readonly replayed: boolean;
+    };
+    readonly [consumedReceiptUseBrand]: true;
+}
+/**
+ * Parses canonical UTF-8/JCS bytes, validates the closed variant, verifies its
+ * Ed25519 signature and configured Accounts trust root, checks freshness using
+ * only the caller's trusted clock, and binds the complete live tuple.
+ */
+export declare function verifyOnlineGenerationCheckReceipt(source: Uint8Array, trust: OnlineGenerationCheckReceiptTrustRoot, expectation: OnlineGenerationCheckReceiptExpectation): VerifiedOnlineGenerationCheckReceipt;
+/**
+ * Pure cryptographic/decision verification. It never returns negative evidence
+ * as allowed evidence, but it deliberately does not consume the nonce. Before
+ * any effect, call consumeOnlineGenerationCheckReceiptUse with the Accounts
+ * durable CAS store and compose that result with the execution-ledger protocol.
+ */
+export declare function verifyAllowedOnlineGenerationCheckReceipt(source: Uint8Array, trust: OnlineGenerationCheckReceiptTrustRoot, expectation: OnlineGenerationCheckReceiptExpectation): VerifiedAllowedOnlineGenerationCheckReceipt;
+/**
+ * Atomically consumes the sole V1 use through the Accounts-owned durable CAS.
+ * Exact idempotent replay returns the original signed receipt; changed replay,
+ * exhaustion, adapter errors, and malformed or forged receipts fail closed
+ * before an external DISPATCHED anchor or provider effect can begin.
+ */
+export declare function consumeOnlineGenerationCheckReceiptUse(source: Uint8Array, trust: OnlineGenerationCheckReceiptTrustRoot, expectation: OnlineGenerationCheckReceiptExpectation, store: OnlineGenerationReceiptUseStore, guard: OnlineGenerationReceiptUseGuard): Promise<ConsumedOnlineGenerationReceiptUse>;
+/** Explicit snake_case wire to camelCase SDK projection, after verification. */
+export declare function projectOnlineGenerationCheckReceipt(receipt: VerifiedOnlineGenerationCheckReceipt): ProjectedOnlineGenerationCheckReceipt;
+export {};

package/dist/domain/state.d.ts

@@ -0,0 +1,19 @@
+import type { AccessMethod, AnyEntity, AuthCapsule, CapacityPool, CredentialBinding, EntityKind, EntityMap } from "./models";
+type EntityStatus<K extends EntityKind> = EntityMap[K]["status"];
+export declare function assertTransition<K extends EntityKind>(kind: K, from: EntityStatus<K>, to: EntityStatus<K>): void;
+export declare function transitionEntity<K extends EntityKind>(kind: K, entity: EntityMap[K], to: EntityStatus<K>, now: string): EntityMap[K];
+export declare function assertBindingMayRetire(binding: CredentialBinding, method: AccessMethod, pool: CapacityPool): void;
+/** Validates a proposed metadata update only. It does not prove zero live leases or authorize I/O. */
+export declare function validateRoutineNativeRefreshCandidate(method: AccessMethod, pool: CapacityPool, beforeCapsule: AuthCapsule, afterCapsule: AuthCapsule, beforeBinding: Extract<CredentialBinding, {
+    readonly status: "pending" | "active" | "retiring";
+}>, afterBinding: Extract<CredentialBinding, {
+    readonly status: "pending" | "active" | "retiring";
+}>): void;
+/** Validates a proposed metadata lineage only. Native execution remains unavailable in this slice. */
+export declare function validateNativeReauthenticationCandidate(method: AccessMethod, pool: CapacityPool, beforeCapsule: AuthCapsule, afterCapsule: AuthCapsule, retiringBinding: Extract<CredentialBinding, {
+    readonly status: "pending" | "active" | "retiring";
+}>, replacementBinding: Extract<CredentialBinding, {
+    readonly status: "pending" | "active" | "retiring";
+}>): void;
+export declare function entityStatus(entity: AnyEntity): string;
+export {};

package/dist/errors.d.ts

@@ -0,0 +1,26 @@
+export declare const ACCOUNT_ERROR_CODES: readonly ["VALIDATION_FAILED", "NOT_FOUND", "FORBIDDEN", "IDEMPOTENCY_CONFLICT", "CONFLICT", "STALE_REVISION", "INVALID_TRANSITION", "TERMS_NOT_ALLOWED", "POLICY_DENIED", "CAPSULE_NOT_READY", "STALE_ATTESTATION", "STALE_CREDENTIAL_GENERATION", "STALE_AUTH_STATE_REVISION", "CAPACITY_DOMAIN_CONFLICT", "CURRENT_DENY", "INVALID_ACCESS_TARGET", "DEPENDENCY_UNAVAILABLE", "RECOVERY_HOLD", "COUNTER_EXHAUSTED", "SCHEMA_VERSION_UNSUPPORTED", "SCHEMA_CHECKSUM_MISMATCH", "DATABASE_PATH_UNSAFE", "NOT_IMPLEMENTED"];
+export type AccountErrorCode = (typeof ACCOUNT_ERROR_CODES)[number];
+export type SafeErrorDetail = string | boolean | readonly string[];
+export type SafeErrorDetails = Readonly<Record<string, SafeErrorDetail>>;
+export declare class AccountsError extends Error {
+    readonly code: AccountErrorCode;
+    readonly retryable: boolean;
+    readonly details: SafeErrorDetails;
+    constructor(code: AccountErrorCode, message: string, options?: {
+        retryable?: boolean;
+        details?: SafeErrorDetails;
+    });
+}
+export interface ErrorEnvelope {
+    readonly schemaVersion: "accounts.error.v1";
+    readonly error: {
+        readonly code: AccountErrorCode;
+        readonly message: string;
+        readonly requestId: string;
+        readonly retryable: boolean;
+        readonly details: SafeErrorDetails;
+    };
+}
+export declare function asAccountsError(error: unknown): AccountsError;
+export declare function toErrorEnvelope(error: unknown, requestId: string): ErrorEnvelope;
+export declare function exitCodeForError(error: AccountsError): number;

package/dist/http/handler.d.ts

@@ -0,0 +1,3 @@
+import { type AccountsHttpHandlerOptions } from "./types";
+export type AccountsHttpHandler = (request: Request) => Promise<Response>;
+export declare function createAccountsHttpHandler(options: AccountsHttpHandlerOptions): AccountsHttpHandler;