@hasna/capacity 0.1.0

package/dist/http/stores.d.ts

@@ -0,0 +1,20 @@
+import type { BootstrapIntent, BootstrapIntentCreateContext, BootstrapIntentStore, HttpIdempotencyRequest, HttpIdempotencyStore, StoredHttpResponse } from "./types";
+/**
+ * Process-local implementation for local/test use. Self-hosted multi-replica
+ * deployments must inject a durable store with the same conditional-insert
+ * behavior.
+ */
+export declare class MemoryHttpIdempotencyStore implements HttpIdempotencyStore {
+    private readonly entries;
+    execute(request: HttpIdempotencyRequest, operation: () => Promise<StoredHttpResponse>): Promise<StoredHttpResponse>;
+}
+/** Inert metadata only. There is intentionally no API-consumption method. */
+export declare class MemoryBootstrapIntentStore implements BootstrapIntentStore {
+    private readonly lifetimeMs;
+    private readonly intents;
+    private readonly replay;
+    constructor(lifetimeMs?: number);
+    create(context: BootstrapIntentCreateContext): Promise<BootstrapIntent>;
+    get(authCapsuleId: BootstrapIntent["authCapsuleId"], intentId: string): Promise<BootstrapIntent | undefined>;
+    private projectStatus;
+}

package/dist/http/types.d.ts

@@ -0,0 +1,141 @@
+import type { Counter } from "../domain/counter";
+import type { AuthCapsuleId, CredentialOperationId, EntityId } from "../domain/ids";
+import type { AuthCapsule, CredentialBinding, CredentialOperation, EligibilityRequest, EntityKind, EntityMap, SlotEligibilityMetadata } from "../domain/models";
+import type { MutationContext, MutationResult, RepositoryDoctor } from "../storage/repository";
+export declare const ACCOUNTS_HTTP_SCOPES: readonly ["accounts:read", "accounts:write", "accounts:provider-ownership:verify", "accounts:capacity-pools:attest", "accounts:terms:attest", "accounts:execution-policy:attest", "accounts:health:report", "accounts:placement:attest", "accounts:deployment:attest", "accounts:capsules:bootstrap-intent", "accounts:credentials:request", "accounts:credentials:issue", "accounts:credentials:handles:read", "accounts:eligibility:issue", "accounts:generation:check", "accounts:admin"];
+export type AccountsHttpScope = (typeof ACCOUNTS_HTTP_SCOPES)[number];
+/**
+ * The authenticator creates this value from verified transport credentials.
+ * No request JSON member or unverified header is ever projected into it.
+ */
+export interface AccountsAuthenticatedPrincipal {
+    readonly actorRef: string;
+    readonly subjectRef: string;
+    readonly issuer: string;
+    readonly audience: string;
+    readonly scopes: ReadonlySet<AccountsHttpScope>;
+    /** Exact owners the verified actor may act for. There is deliberately no wildcard. */
+    readonly authorizedOwnerRefs: ReadonlySet<string>;
+}
+export interface AccountsRequestAuthenticator {
+    authenticate(request: Request, expectedAudience: string): Promise<AccountsAuthenticatedPrincipal | undefined>;
+}
+export interface CatalogHttpService {
+    get<K extends EntityKind>(kind: K, id: EntityMap[K]["id"]): Promise<EntityMap[K]>;
+    list<K extends EntityKind>(kind: K): Promise<readonly EntityMap[K][]>;
+    eligibility(request: EligibilityRequest): Promise<SlotEligibilityMetadata>;
+    doctor(): Promise<RepositoryDoctor>;
+    add?<K extends EntityKind>(kind: K, record: EntityMap[K], context: MutationContext): Promise<MutationResult<EntityMap[K]>>;
+}
+export interface BootstrapIntent {
+    readonly schemaVersion: "accounts.bootstrap-intent.v1";
+    readonly id: string;
+    readonly authCapsuleId: AuthCapsuleId;
+    readonly ownerRef: string;
+    readonly canonicalNodeId: string;
+    readonly nodeGeneration: Counter;
+    readonly placementGeneration: Counter;
+    readonly authGeneration: Counter;
+    readonly capsuleRevision: Counter;
+    readonly status: "pending" | "expired";
+    readonly createdAt: string;
+    readonly expiresAt: string;
+}
+export interface BootstrapIntentCreateContext {
+    readonly principal: AccountsAuthenticatedPrincipal;
+    readonly capsule: AuthCapsule;
+    readonly idempotencyKey: string;
+    readonly reasonCode: string;
+    readonly requestDigest: string;
+    readonly now: string;
+}
+/**
+ * A store can only create or read inert intent metadata. It intentionally has
+ * no consume, provider-login, device-code, browser, or reauthentication method.
+ */
+export interface BootstrapIntentStore {
+    create(context: BootstrapIntentCreateContext): Promise<BootstrapIntent>;
+    get(authCapsuleId: AuthCapsuleId, intentId: string): Promise<BootstrapIntent | undefined>;
+}
+export interface CredentialOperationRequest {
+    readonly kind: "rotation" | "revocation";
+    readonly binding: Extract<CredentialBinding, {
+        readonly status: "pending" | "active" | "retiring";
+    }>;
+    readonly expectedRevision: Counter;
+    readonly principal: AccountsAuthenticatedPrincipal;
+    readonly idempotencyKey: string;
+    readonly reasonCode: string;
+    readonly requestDigest: string;
+}
+/** Public operations are intent/status only; execution is deliberately absent. */
+export interface CredentialOperationIntentService {
+    request(request: CredentialOperationRequest): Promise<CredentialOperation>;
+    get(id: CredentialOperationId): Promise<CredentialOperation | undefined>;
+    list(ownerRef: string): Promise<readonly CredentialOperation[]>;
+}
+export interface StoredHttpResponse {
+    readonly status: number;
+    readonly body: string;
+    readonly headers?: Readonly<Record<string, string>>;
+}
+export interface HttpIdempotencyRequest {
+    readonly actorRef: string;
+    readonly audience: string;
+    readonly method: string;
+    readonly route: string;
+    readonly key: string;
+    readonly requestDigest: string;
+}
+/** Production deployments must back this with the same durable authority as the API. */
+export interface HttpIdempotencyStore {
+    execute(request: HttpIdempotencyRequest, operation: () => Promise<StoredHttpResponse>): Promise<StoredHttpResponse>;
+}
+export interface InternalHttpService {
+    /** Credential- and network-free PROBE_NATIVE. It cannot mint or consume a grant. */
+    probeNativeSubscription?(body: unknown, principal: AccountsAuthenticatedPrincipal): Promise<Readonly<Record<string, unknown>>>;
+    /** Accounts-only closed maintenance reservation/grant issuance. */
+    issueCapsuleMaintenanceGrant?(body: unknown, principal: AccountsAuthenticatedPrincipal): Promise<Readonly<Record<string, unknown>>>;
+    /** Accounts-only atomic one-use maintenance grant consumption. */
+    consumeCapsuleMaintenanceGrant?(body: unknown, principal: AccountsAuthenticatedPrincipal): Promise<Readonly<Record<string, unknown>>>;
+    /** Accounts-owned atomic one-use capability ordinal consumption. */
+    consumeCapabilityUse?(body: unknown, principal: AccountsAuthenticatedPrincipal): Promise<Readonly<Record<string, unknown>>>;
+    /** Returns a verified, signed snake_case wire object or fails closed. */
+    issueSlotEligibility?(body: unknown, principal: AccountsAuthenticatedPrincipal): Promise<Readonly<Record<string, unknown>>>;
+    /** Returns a verified, signed closed online-generation receipt or fails closed. */
+    checkGeneration?(body: unknown, principal: AccountsAuthenticatedPrincipal): Promise<Readonly<Record<string, unknown>>>;
+    ingestCapacityPoolEvidence?(body: unknown, principal: AccountsAuthenticatedPrincipal): Promise<Readonly<Record<string, unknown>>>;
+    ingestExecutionPolicyEvidence?(body: unknown, principal: AccountsAuthenticatedPrincipal): Promise<Readonly<Record<string, unknown>>>;
+    ingestCredentialBindingReceipt?(body: unknown, principal: AccountsAuthenticatedPrincipal): Promise<Readonly<Record<string, unknown>>>;
+}
+export interface AccountsHttpDeploymentConfig {
+    readonly mode: "self_hosted";
+    readonly identityRealm: string;
+    readonly organizationRef: string;
+    readonly publicAudience: string;
+    readonly internalAudience: string;
+    readonly allowedIssuers: ReadonlySet<string>;
+}
+export interface AccountsHttpHandlerOptions {
+    readonly deployment: AccountsHttpDeploymentConfig;
+    readonly authenticator: AccountsRequestAuthenticator;
+    readonly catalog: CatalogHttpService;
+    readonly bootstrapIntents?: BootstrapIntentStore;
+    readonly credentialOperations?: CredentialOperationIntentService;
+    readonly internal?: InternalHttpService;
+    readonly idempotency?: HttpIdempotencyStore;
+    readonly packageVersion: string;
+    readonly contractSha256: string;
+    readonly openApiDocument: Readonly<Record<string, unknown>>;
+    readonly now?: () => Date;
+}
+export declare const HTTP_ENTITY_ROUTES: Readonly<{
+    readonly "provider-accounts": "account";
+    readonly entitlements: "entitlement";
+    readonly "capacity-pools": "capacity_pool";
+    readonly "account-lanes": "access_method";
+    readonly "auth-capsules": "auth_capsule";
+    readonly "credential-bindings": "credential_binding";
+}>;
+export type HttpEntityRoute = keyof typeof HTTP_ENTITY_ROUTES;
+export type AnyEntityIdentifier = EntityId;

package/dist/index.d.ts

@@ -0,0 +1,56 @@
+import type { AccountsCatalog as AccountsCatalogType } from "./domain/catalog";
+import { type ConnectPostgresAccountsOptions } from "./storage/postgres";
+export { ACCOUNT_ERROR_CODES, AccountsError, asAccountsError, exitCodeForError, toErrorEnvelope, } from "./errors";
+export type { AccountErrorCode, ErrorEnvelope, SafeErrorDetail, SafeErrorDetails, } from "./errors";
+export { MAX_COUNTER, compareCounters, counter, incrementCounter, parseCounter, } from "./domain/counter";
+export type { Counter } from "./domain/counter";
+export { isUuidV7, newAccessMethodId, newAccountEventId, newAccountId, newAccountLaneId, newAuthCapsuleId, newCapacityPoolId, newCredentialBindingId, newCredentialOperationId, newEligibilityEvidenceId, newEntitlementId, newProviderAccountId, parseAccessMethodId, parseAccountId, parseAccountLaneId, parseAuthCapsuleId, parseCanonicalNodeId, parseCapacityPoolId, parseCredentialBindingId, parseCredentialOperationId, parseEligibilityEvidenceId, parseEntitlementId, parseProviderAccountId, } from "./domain/ids";
+export type { AccessMethodId, AccountEventId, AccountId, AccountLaneId, AuthCapsuleId, CanonicalNodeId, CapacityPoolId, CredentialBindingId, CredentialOperationId, EligibilityEvidenceId, EntitlementId, ProviderAccountId, } from "./domain/ids";
+export { ACCOUNTS_CAPACITY_SCHEMA_VERSION, ELIGIBILITY_REASON_CODES, } from "./domain/models";
+export type { Account, AccountLane, AccountStatus, AccessMethod, AccessMethodStatus, AccessTransport, AnyEntity, AuthCapsule, AuthCapsuleStatus, CapabilitySet, CapacityPool, CapacityPoolStatus, CredentialBinding, CredentialBindingMetadata, CredentialBindingStatus, CredentialOperation, CredentialOperationKind, CredentialOperationState, NonterminalCredentialBinding, RetiredHandleCredentialBinding, RevocationBarrierCredentialBinding, CredentialPurpose, CredentialResolver, DataPolicy, DenyState, EligibleSlotEligibility, EligibilityAccessTarget, EligibilityReasonCode, EligibilityRequest, EntityKind, EntityMap, Entitlement, EntitlementStatus, FundingKind, HealthObservation, IneligibleSlotEligibility, ProviderAccount, SlotEligibility, SlotEligibilityMetadata, TermsDecision, } from "./domain/models";
+export { assertTransition, validateNativeReauthenticationCandidate, validateRoutineNativeRefreshCandidate, } from "./domain/state";
+export { decodeRecordEnvelope, deserializeRecordEnvelope, encodeRecordEnvelope, serializeRecordEnvelope, validateEntity, validateEligibilityRequest, validateSlotEligibility, } from "./serialization/dto";
+export type { RecordEnvelope } from "./serialization/dto";
+export { canonicalJson, parseClosedJson, parseClosedJsonBytes } from "./serialization/json";
+export { AUTHORITY_EVIDENCE_SCHEMA_VERSION, AUTHORITY_EVIDENCE_TYPES, AUTHORITY_ISSUER_CLASSES, verifyAuthorityEvidence, } from "./domain/authority-evidence";
+export type { AuthorityEvidenceBinding, AuthorityEvidenceEnvelope, AuthorityEvidenceExpectation, AuthorityEvidencePayload, AuthorityEvidenceTrustRoot, AuthorityEvidenceType, AuthorityIssuerClass, ProviderCapacityPayload, ProviderOwnershipPayload, } from "./domain/authority-evidence";
+export { ONLINE_GENERATION_CHECK_RECEIPT_SCHEMA_VERSION, ONLINE_GENERATION_RECEIPT_MAXIMUM_AGE_MS, ONLINE_GENERATION_RECEIPT_MAXIMUM_CLOCK_SKEW_MS, ONLINE_GENERATION_RECEIPT_MAXIMUM_LIFETIME_MS, ONLINE_GENERATION_RECEIPT_MAX_USES, consumeOnlineGenerationCheckReceiptUse, projectOnlineGenerationCheckReceipt, verifyAllowedOnlineGenerationCheckReceipt, verifyOnlineGenerationCheckReceipt, } from "./domain/online-generation-receipt";
+export type { ConsumedOnlineGenerationReceiptUse, OnlineGenerationCheckReceiptDraft, OnlineGenerationCheckReceiptExpectation, OnlineGenerationCheckReceiptTrustRoot, OnlineGenerationReceiptUseCasRequest, OnlineGenerationReceiptUseCasResult, OnlineGenerationReceiptUseGuard, OnlineGenerationReceiptUseStore, ProjectedOnlineGenerationCheckReceipt, ProviderDestinationPolicy, VerifiedAllowedOnlineGenerationCheckReceipt, VerifiedOnlineGenerationCheckReceipt, } from "./domain/online-generation-receipt";
+export { CAPSULE_MAINTENANCE_CONSUME_RECEIPT_SCHEMA_VERSION, CAPSULE_MAINTENANCE_CONSUME_REQUEST_SCHEMA_VERSION, CAPSULE_MAINTENANCE_GRANT_SCHEMA_VERSION, CAPSULE_MAINTENANCE_REQUEST_SCHEMA_VERSION, NATIVE_SUBSCRIPTION_PROBE_REQUEST_SCHEMA_VERSION, NATIVE_SUBSCRIPTION_PROBE_RESULT_SCHEMA_VERSION, CapsuleMaintenanceAuthority, InMemoryNativeCapabilityUseStore, StaticNativeSubscriptionSnapshotSource, evaluateNativeSubscriptionProbe, parseNativeSubscriptionProbeRequest, verifyCapsuleMaintenanceGrant, } from "./domain/native-subscription";
+export type { CapsuleMaintenanceAuthorityOptions, CapsuleMaintenanceCommand, CapsuleMaintenanceConsumeReceipt, CapsuleMaintenanceConsumeRequest, CapsuleMaintenanceGrant, CapsuleMaintenanceRequest, CapsuleMaintenanceTargetKind, CapsuleMaintenanceTransport, CapsuleMaintenanceTrust, InMemoryNativeCapabilityUseStoreOptions, NativeCapabilityUseCurrentState, NativeSubscriptionBindingSnapshot, NativeSubscriptionProbeRequest, NativeSubscriptionProbeResult, NativeSubscriptionSnapshotSource, } from "./domain/native-subscription";
+export { EffectDispatchJournal, effectOutcomeSigningBytes } from "./storage/effect-dispatch";
+export type { EffectDispatchAppend, EffectDispatchInput, EffectDispatchJournalOptions, EffectDispatchRecord, EffectDispatchState, EffectOutcomeKind, EffectOutcomeRecord, EffectOutcomeSigningInput, EffectPrepareInput, UnsignedEffectOutcomeRecord, } from "./storage/effect-dispatch";
+export { FileRecoveryLedger, OwnerOnlySignedAppendLog } from "./storage/file-recovery-ledger";
+export type { FileRecoveryLedgerOptions, OwnerOnlySignedAppendLogOptions, SignedLogFrontier, SignedLogRecord, SignedLogSnapshot, } from "./storage/file-recovery-ledger";
+export declare const POSTGRES_ADAPTER_STATUS: Readonly<{
+    adapter: "postgres";
+    implemented: true;
+    conformanceClaim: true;
+    target: "self_hosted";
+}>;
+export { runPostgresMigrations } from "./storage/postgres-migrator";
+export type { PostgresMigrationReport } from "./storage/postgres-migrator";
+export { ACCOUNTS_V1_CONTRACT_SHA256, PACKAGE_VERSION } from "./version";
+export { createAccountsCapacity } from "./sdk/index";
+export type { AccountLanesApi, AccountsAuthProvider, AccountsCapacity, AccountsDeployment, AuthCapsulesApi, BootstrapIntentInput, CallOptions, CapacityQueryApi, CreateAccountLaneInput, CreateEntitlementInput, CreateProviderAccountInput, EntitlementsApi, ListOptions, LocalRecoveryConfiguration, MutationOptions, Page, ProviderAccountsApi, ProviderAccountView, ReadonlyCapacityPoolsApi, ReadonlyCredentialBindingsApi, RevisionMutationOptions, } from "./sdk/index";
+export { createAccountsHttpHandler } from "./http/handler";
+export { ACCOUNTS_CAPACITY_OPENAPI, serializeAccountsCapacityOpenApi } from "./http/openapi";
+export { MemoryBootstrapIntentStore, MemoryHttpIdempotencyStore, } from "./http/stores";
+export type { AccountsAuthenticatedPrincipal, AccountsHttpDeploymentConfig, AccountsHttpHandlerOptions, AccountsHttpScope, AccountsRequestAuthenticator, BootstrapIntent, BootstrapIntentStore, CatalogHttpService, CredentialOperationIntentService, HttpIdempotencyStore, InternalHttpService, } from "./http/types";
+export interface CatalogFactoryOptions {
+    readonly clock?: () => Date;
+}
+export interface SQLiteCatalogFactoryOptions extends CatalogFactoryOptions {
+    readonly path: string;
+    readonly recovery?: {
+        readonly ledgerPath: string;
+        readonly catalogIncarnation: string;
+        readonly signingKey: Uint8Array;
+    };
+}
+export interface PostgresCatalogFactoryOptions extends CatalogFactoryOptions, ConnectPostgresAccountsOptions {
+}
+export type AccountsCapacityReader = Pick<AccountsCatalogType, "get" | "list" | "eligibility" | "checkCurrent" | "doctor" | "close">;
+export declare function createInMemoryAccounts(options?: CatalogFactoryOptions): AccountsCapacityReader;
+export declare function createSQLiteAccounts(options: SQLiteCatalogFactoryOptions): AccountsCapacityReader;
+export declare function createPostgresAccounts(options: PostgresCatalogFactoryOptions): Promise<AccountsCapacityReader>;