@hasna/capacity 0.1.0

package/dist/sdk/index.d.ts

@@ -0,0 +1,8 @@
+import type { AccountsCapacity, AccountsDeployment } from "./types";
+export type { AccountLanesApi, AccountsAuthProvider, AccountsCapacity, AccountsDeployment, AuthCapsulesApi, BootstrapIntentInput, CallOptions, CapacityQueryApi, CreateAccountLaneInput, CreateEntitlementInput, CreateProviderAccountInput, EntitlementsApi, ListOptions, LocalRecoveryConfiguration, MutationOptions, Page, ProviderAccountsApi, ProviderAccountView, ReadonlyCapacityPoolsApi, ReadonlyCredentialBindingsApi, RevisionMutationOptions, } from "./types";
+export { createLocalAccountsCapacityFromCatalog } from "./local";
+/**
+ * Deployment choice is explicit and immutable. A self-hosted error is returned
+ * to the caller and never falls back to SQLite.
+ */
+export declare function createAccountsCapacity(config: AccountsDeployment): AccountsCapacity;

package/dist/sdk/local.d.ts

@@ -0,0 +1,5 @@
+import { AccountsCatalog } from "../domain/catalog";
+import type { AccountsCapacity, LocalRecoveryConfiguration } from "./types";
+export declare function createLocalAccountsCapacity(actorRef: string, sqlitePath?: string, recovery?: LocalRecoveryConfiguration): AccountsCapacity;
+/** Integration seam for a catalog configured with the package-owned persistent recovery ledger. */
+export declare function createLocalAccountsCapacityFromCatalog(catalog: AccountsCatalog, actorRef: string): AccountsCapacity;

package/dist/sdk/remote.d.ts

@@ -0,0 +1,2 @@
+import type { AccountsAuthProvider, AccountsCapacity } from "./types";
+export declare function createSelfHostedAccountsCapacity(baseUrl: string, authProvider: AccountsAuthProvider): AccountsCapacity;

package/dist/sdk/types.d.ts

@@ -0,0 +1,107 @@
+import type { Account, AccessMethod, AuthCapsule, CapacityPool, CredentialBindingMetadata, EligibilityRequest, Entitlement, FundingKind, SlotEligibilityMetadata } from "../domain/models";
+import type { Counter } from "../domain/counter";
+import type { AccountId, AccessMethodId, AuthCapsuleId, CapacityPoolId, CredentialBindingId, EntitlementId } from "../domain/ids";
+import type { BootstrapIntent } from "../http/types";
+export interface AccountsAuthProvider {
+    /** Adds a separately audienced capacity authorization header. */
+    authorize(headers: Headers, signal?: AbortSignal): Promise<void>;
+}
+export interface LocalRecoveryConfiguration {
+    readonly ledgerPath: string;
+    readonly catalogIncarnation: string;
+    readonly signingKey: Uint8Array;
+}
+export type AccountsDeployment = {
+    readonly mode: "local";
+    readonly sqlitePath?: string;
+    readonly actorRef: string;
+    readonly recovery?: LocalRecoveryConfiguration;
+} | {
+    readonly mode: "self_hosted";
+    readonly baseUrl: string;
+    readonly authProvider: AccountsAuthProvider;
+};
+export interface CallOptions {
+    readonly signal?: AbortSignal;
+}
+export interface ListOptions extends CallOptions {
+    readonly cursor?: string;
+    readonly limit?: number;
+}
+export interface MutationOptions extends CallOptions {
+    readonly idempotencyKey: string;
+}
+export interface RevisionMutationOptions extends MutationOptions {
+    readonly expectedRevision: Counter;
+}
+export interface Page<T> {
+    readonly records: readonly T[];
+    readonly nextCursor: string | null;
+}
+/** Normal readers never receive provider subject values or candidate fingerprints. */
+export type ProviderAccountView = Omit<Account, "providerSubjectRef" | "providerSubjectCandidateRef"> & {
+    readonly providerSubjectRefRedacted?: true;
+};
+export interface CreateProviderAccountInput {
+    readonly providerKey: string;
+    readonly ownerRef: string;
+    readonly displayLabel: string;
+    readonly providerSubjectCandidateRef?: string;
+    readonly providerDisplayHint?: string;
+}
+export interface CreateEntitlementInput {
+    readonly providerAccountId: AccountId;
+    readonly fundingKind: FundingKind;
+}
+export interface CreateAccountLaneInput {
+    readonly entitlementId: EntitlementId;
+    readonly capacityPoolId: CapacityPoolId;
+    readonly adapterKey: string;
+    readonly adapterVersion: string;
+    readonly accessTransport: AccessMethod["accessTransport"];
+}
+export interface BootstrapIntentInput {
+    readonly reasonCode: string;
+}
+export interface ProviderAccountsApi {
+    list(options?: ListOptions): Promise<Page<ProviderAccountView>>;
+    get(id: AccountId, options?: CallOptions): Promise<ProviderAccountView>;
+    create(input: CreateProviderAccountInput, options: MutationOptions): Promise<ProviderAccountView>;
+}
+export interface EntitlementsApi {
+    list(options?: ListOptions): Promise<Page<Entitlement>>;
+    get(id: EntitlementId, options?: CallOptions): Promise<Entitlement>;
+    create(input: CreateEntitlementInput, options: MutationOptions): Promise<Entitlement>;
+}
+export interface ReadonlyCapacityPoolsApi {
+    list(options?: ListOptions): Promise<Page<CapacityPool>>;
+    get(id: CapacityPoolId, options?: CallOptions): Promise<CapacityPool>;
+}
+export interface AccountLanesApi {
+    list(options?: ListOptions): Promise<Page<AccessMethod>>;
+    get(id: AccessMethodId, options?: CallOptions): Promise<AccessMethod>;
+    create(input: CreateAccountLaneInput, options: MutationOptions): Promise<AccessMethod>;
+}
+export interface AuthCapsulesApi {
+    list(options?: ListOptions): Promise<Page<AuthCapsule>>;
+    get(id: AuthCapsuleId, options?: CallOptions): Promise<AuthCapsule>;
+    createBootstrapIntent(id: AuthCapsuleId, input: BootstrapIntentInput, options: RevisionMutationOptions): Promise<BootstrapIntent>;
+    getBootstrapIntent(id: AuthCapsuleId, intentId: string, options?: CallOptions): Promise<BootstrapIntent>;
+}
+export interface ReadonlyCredentialBindingsApi {
+    list(options?: ListOptions): Promise<Page<CredentialBindingMetadata>>;
+    get(id: CredentialBindingId, options?: CallOptions): Promise<CredentialBindingMetadata>;
+}
+export interface CapacityQueryApi {
+    query(request: EligibilityRequest, options?: CallOptions): Promise<SlotEligibilityMetadata>;
+}
+export interface AccountsCapacity {
+    readonly providerAccounts: ProviderAccountsApi;
+    readonly entitlements: EntitlementsApi;
+    readonly capacityPools: ReadonlyCapacityPoolsApi;
+    readonly lanes: AccountLanesApi;
+    readonly capsules: AuthCapsulesApi;
+    readonly credentialBindings: ReadonlyCredentialBindingsApi;
+    readonly capacity: CapacityQueryApi;
+    close(options?: CallOptions): Promise<void>;
+}

package/dist/serialization/dto.d.ts

@@ -0,0 +1,13 @@
+import { ACCOUNTS_CAPACITY_SCHEMA_VERSION, type EntityKind, type EntityMap, type EligibilityRequest, type SlotEligibilityMetadata } from "../domain/models";
+export declare function validateEntity<K extends EntityKind>(kind: K, input: unknown): EntityMap[K];
+export declare function validateEligibilityRequest(input: unknown): EligibilityRequest;
+export interface RecordEnvelope<K extends EntityKind = EntityKind> {
+    readonly schemaVersion: typeof ACCOUNTS_CAPACITY_SCHEMA_VERSION;
+    readonly kind: K;
+    readonly data: EntityMap[K];
+}
+export declare function encodeRecordEnvelope<K extends EntityKind>(kind: K, data: EntityMap[K]): RecordEnvelope<K>;
+export declare function decodeRecordEnvelope(input: unknown): RecordEnvelope;
+export declare function serializeRecordEnvelope<K extends EntityKind>(kind: K, data: EntityMap[K]): string;
+export declare function deserializeRecordEnvelope(source: string): RecordEnvelope;
+export declare function validateSlotEligibility(input: unknown): SlotEligibilityMetadata;

package/dist/serialization/json.d.ts

@@ -0,0 +1,7 @@
+export declare function parseClosedJson(source: string): unknown;
+export declare function parseClosedJsonBytes(source: Uint8Array): unknown;
+export declare function canonicalJson(value: unknown): string;
+export declare function canonicalSha256(value: unknown): string;
+export declare function assertNoSensitiveFields(value: unknown, path?: string, seen?: Set<object>): void;
+export declare function isSensitiveFieldName(key: string): boolean;
+export declare function assertNoSecretLikeString(value: string): void;

package/dist/storage/credential-use-authorizer.d.ts

@@ -0,0 +1,9 @@
+import { KeyObject, type KeyLike } from "node:crypto";
+import type { CredentialResolutionExpected, CredentialResolutionGrant, CredentialResolutionTransport, CredentialUseAuthorizer, UnsignedCredentialResolutionGrant } from "./repository";
+export declare class Ed25519CredentialUseAuthorizer implements CredentialUseAuthorizer {
+    private readonly publicKeys;
+    constructor(issuerPublicKeys: ReadonlyMap<string, KeyObject | string | Buffer>);
+    verify(grant: CredentialResolutionGrant, expected: CredentialResolutionExpected, transport: CredentialResolutionTransport): void;
+}
+export declare const REJECTING_CREDENTIAL_USE_AUTHORIZER: CredentialUseAuthorizer;
+export declare function signCredentialResolutionGrant(unsigned: UnsignedCredentialResolutionGrant, privateKey: KeyLike): CredentialResolutionGrant;

package/dist/storage/credential-verifier.d.ts

@@ -0,0 +1,13 @@
+import { type KeyLike, KeyObject } from "node:crypto";
+import type { CredentialHandleEnvelope, CredentialHandleExpectedClaims, CredentialHandleVerification, CredentialHandleVerifier, UnsignedCredentialHandleEnvelope } from "./repository";
+export declare class Ed25519CredentialHandleVerifier implements CredentialHandleVerifier {
+    private readonly publicKeys;
+    private readonly auditKey;
+    constructor(input: {
+        readonly issuerPublicKeys: ReadonlyMap<string, KeyObject | string | Buffer>;
+        readonly auditKey: Uint8Array;
+    });
+    verify(envelope: CredentialHandleEnvelope, expected: CredentialHandleExpectedClaims): CredentialHandleVerification;
+}
+export declare const REJECTING_CREDENTIAL_HANDLE_VERIFIER: CredentialHandleVerifier;
+export declare function signCredentialHandleEnvelope(unsigned: UnsignedCredentialHandleEnvelope, privateKey: KeyLike): CredentialHandleEnvelope;

package/dist/storage/effect-dispatch.d.ts

@@ -0,0 +1,278 @@
+import { type KeyObject } from "node:crypto";
+import { type Counter } from "../domain/counter";
+import { type SignedLogFrontier } from "./file-recovery-ledger";
+declare const CLAIM_SCHEMA: "accounts.credential-effect-claim.v1";
+declare const PREPARED_SCHEMA: "accounts.credential-effect-prepared.v1";
+declare const DISPATCHED_SCHEMA: "accounts.credential-effect-dispatched.v1";
+declare const OUTCOME_SCHEMA: "infinity.effect-journal-outcome/v1";
+declare const OUTCOME_SCHEMA_DIGEST: "sha256:7ab380a0475ebf79d2ed925e20bcbb9303d78a56c358d09adbdce796e740bf20";
+declare const LOOKUP_SCHEMA: "accounts.provider-effect-lookup.v1";
+export type EffectOutcomeKind = "succeeded" | "failed_effect" | "failed_no_effect" | "reconciliation_blocked";
+export interface EffectClaimRecord {
+    readonly schema_version: typeof CLAIM_SCHEMA;
+    readonly record_kind: "CLAIMED";
+    readonly semantic_operation_key_digest: string;
+    readonly operation_id: string;
+    readonly operation_step_id: string;
+    readonly credential_family_id: string;
+    readonly serialization_key_digest: string;
+    readonly request_digest: string;
+    readonly source_fences_digest: string;
+    readonly claimed_at: string;
+}
+export interface EffectPreparedRecord {
+    readonly schema_version: typeof PREPARED_SCHEMA;
+    readonly record_kind: "PREPARED";
+    readonly semantic_operation_key_digest: string;
+    readonly operation_id: string;
+    readonly operation_step_id: string;
+    readonly operation_execution_epoch: Counter;
+    readonly credential_family_id: string;
+    readonly serialization_key_digest: string;
+    readonly operation_digest: string;
+    readonly request_digest: string;
+    readonly target_digest: string;
+    readonly source_fences_digest: string;
+    readonly maintenance_fence_digest: string;
+    readonly maintenance_grant_digest: string;
+    readonly effect_endpoint_ref: string;
+    readonly provider_key: string;
+    readonly prepared_at: string;
+    readonly prior_failed_no_effect_receipt_digest?: string;
+}
+interface EffectDispatchedCommon {
+    readonly schema_version: typeof DISPATCHED_SCHEMA;
+    readonly record_kind: "DISPATCHED";
+    readonly outcome_schema_version: typeof OUTCOME_SCHEMA;
+    readonly outcome_schema_digest: typeof OUTCOME_SCHEMA_DIGEST;
+    readonly semantic_operation_key_digest: string;
+    readonly operation_id: string;
+    readonly operation_step_id: string;
+    readonly operation_digest: string;
+    readonly request_digest: string;
+    readonly target_digest: string;
+    readonly source_fences_digest: string;
+    readonly maintenance_fence_digest: string;
+    readonly maintenance_grant_digest: string;
+    readonly operation_execution_epoch: Counter;
+    readonly provider_key: string;
+    readonly effect_endpoint_ref: string;
+    readonly provider_idempotency_token_sha256: string;
+    readonly prepared_receipt_digest: string;
+    readonly audience: string;
+    readonly dispatched_at: string;
+    readonly signer_ref: string;
+    readonly signer_incarnation: string;
+    readonly key_id: string;
+}
+export interface EffectDispatchedRecord extends EffectDispatchedCommon {
+    readonly signature: string;
+}
+export type UnsignedEffectDispatchedRecord = EffectDispatchedCommon;
+interface EffectOutcomeCommon {
+    readonly schema_version: typeof OUTCOME_SCHEMA;
+    readonly schema_digest: typeof OUTCOME_SCHEMA_DIGEST;
+    readonly record_kind: "OUTCOME";
+    readonly semantic_operation_key_digest: string;
+    readonly operation_id: string;
+    readonly operation_step_id: string;
+    readonly operation_digest: string;
+    readonly request_digest: string;
+    readonly target_digest: string;
+    readonly source_fences_digest: string;
+    readonly maintenance_grant_digest: string;
+    readonly maintenance_fence_digest: string;
+    readonly operation_execution_epoch: Counter;
+    readonly dispatched_receipt_digest: string;
+    readonly provider_idempotency_token_sha256: string;
+    readonly effect_endpoint_ref: string;
+    readonly effect_endpoint_incarnation: string;
+    readonly effect_endpoint_key_id: string;
+    readonly audience: string;
+    readonly observed_at: string;
+}
+export interface EffectSucceededOutcome extends EffectOutcomeCommon {
+    readonly outcome_kind: "succeeded";
+    readonly provider_result_receipt_digest: string;
+    readonly endpoint_signature: string;
+}
+export interface EffectFailedEffectOutcome extends EffectOutcomeCommon {
+    readonly outcome_kind: "failed_effect";
+    readonly provider_failure_receipt_digest: string;
+    readonly endpoint_signature: string;
+}
+export interface EffectFailedNoEffectOutcome extends EffectOutcomeCommon {
+    readonly outcome_kind: "failed_no_effect";
+    readonly provider_lookup_evidence_digest: string;
+    readonly endpoint_signature: string;
+}
+export interface EffectReconciliationBlockedOutcome extends EffectOutcomeCommon {
+    readonly outcome_kind: "reconciliation_blocked";
+    readonly reconciliation_evidence_digest: string;
+    readonly endpoint_signature: string;
+}
+export type EffectOutcomeRecord = EffectSucceededOutcome | EffectFailedEffectOutcome | EffectFailedNoEffectOutcome | EffectReconciliationBlockedOutcome;
+export type UnsignedEffectOutcomeRecord = Omit<EffectSucceededOutcome, "endpoint_signature"> | Omit<EffectFailedEffectOutcome, "endpoint_signature"> | Omit<EffectFailedNoEffectOutcome, "endpoint_signature"> | Omit<EffectReconciliationBlockedOutcome, "endpoint_signature">;
+export type EffectDispatchRecord = EffectDispatchedRecord | EffectOutcomeRecord;
+interface ProviderLookupEvidenceCommon {
+    readonly schema_version: typeof LOOKUP_SCHEMA;
+    readonly provider_key: string;
+    readonly provider_lookup_issuer_ref: string;
+    readonly provider_lookup_issuer_incarnation: string;
+    readonly provider_lookup_key_id: string;
+    readonly audience: string;
+    readonly effect_endpoint_ref: string;
+    readonly provider_idempotency_token_sha256: string;
+    readonly semantic_operation_key_digest: string;
+    readonly operation_id: string;
+    readonly operation_step_id: string;
+    readonly operation_digest: string;
+    readonly request_digest: string;
+    readonly target_digest: string;
+    readonly source_fences_digest: string;
+    readonly maintenance_fence_digest: string;
+    readonly maintenance_grant_digest: string;
+    readonly operation_execution_epoch: Counter;
+    readonly lookup_result: "rejected_not_accepted_no_state_change";
+    readonly provider_observation_id: string;
+    readonly issued_at: string;
+    readonly expires_at: string;
+}
+export interface ProviderLookupEvidence extends ProviderLookupEvidenceCommon {
+    readonly provider_signature: string;
+}
+export type UnsignedProviderLookupEvidence = ProviderLookupEvidenceCommon;
+export interface EffectPrepareInput {
+    readonly operation_id: string;
+    readonly operation_step_id: string;
+    readonly operation_execution_epoch: Counter;
+    readonly credential_family_id: string;
+    readonly serialization_key_digest: string;
+    readonly operation_digest: string;
+    readonly request_digest: string;
+    readonly target_digest: string;
+    readonly source_fences_digest: string;
+    readonly maintenance_fence_digest: string;
+    readonly maintenance_grant_digest: string;
+    readonly effect_endpoint_ref: string;
+    readonly provider_key: string;
+    readonly prior_failed_no_effect_receipt_digest?: string;
+}
+export interface EffectDispatchInput {
+    readonly operation_id: string;
+    readonly operation_step_id: string;
+    readonly operation_execution_epoch: Counter;
+    readonly prepared_receipt_digest: string;
+}
+interface OutcomeSigningCommonInput {
+    readonly operation_id: string;
+    readonly operation_step_id: string;
+    readonly operation_execution_epoch: Counter;
+    readonly dispatched_receipt_digest: string;
+    readonly observed_at: string;
+}
+export type EffectOutcomeSigningInput = (OutcomeSigningCommonInput & {
+    readonly outcome_kind: "succeeded";
+    readonly provider_result_receipt_digest: string;
+}) | (OutcomeSigningCommonInput & {
+    readonly outcome_kind: "failed_effect";
+    readonly provider_failure_receipt_digest: string;
+}) | (OutcomeSigningCommonInput & {
+    readonly outcome_kind: "failed_no_effect";
+    readonly provider_lookup_evidence_digest: string;
+}) | (OutcomeSigningCommonInput & {
+    readonly outcome_kind: "reconciliation_blocked";
+    readonly reconciliation_evidence_digest: string;
+});
+export interface EffectJournalAppend<T> {
+    readonly record: T;
+    readonly receipt_digest: string;
+    readonly frontier: SignedLogFrontier;
+    readonly replayed: boolean;
+}
+export interface EffectDispatchAppend extends EffectJournalAppend<EffectDispatchedRecord> {
+    /** The raw token is returned only to the caller that may invoke the endpoint. */
+    readonly provider_idempotency_token: string;
+    /** True only for the process that durably appended the first DISPATCHED record. */
+    readonly newly_appended: boolean;
+}
+export type EffectDispatchState = {
+    readonly phase: "PREPARED";
+    readonly operation_execution_epoch: Counter;
+    readonly prepared: EffectJournalAppend<EffectPreparedRecord>;
+} | {
+    readonly phase: "DISPATCHED";
+    readonly operation_execution_epoch: Counter;
+    readonly prepared: EffectJournalAppend<EffectPreparedRecord>;
+    readonly dispatched: EffectJournalAppend<EffectDispatchedRecord>;
+} | {
+    readonly phase: "OUTCOME";
+    readonly operation_execution_epoch: Counter;
+    readonly outcome_kind: EffectOutcomeKind;
+    readonly prepared: EffectJournalAppend<EffectPreparedRecord>;
+    readonly dispatched: EffectJournalAppend<EffectDispatchedRecord>;
+    readonly outcome: EffectJournalAppend<EffectOutcomeRecord>;
+};
+export interface EffectDispatchSigner {
+    readonly signerRef: string;
+    readonly signerIncarnation: string;
+    readonly keyId: string;
+    readonly audience: string;
+    readonly privateKey: KeyObject;
+}
+export interface EffectEndpointTrust {
+    readonly incarnation: string;
+    readonly keyId: string;
+    readonly audience: string;
+    readonly publicKey: KeyObject;
+}
+export interface ProviderLookupTrust {
+    readonly incarnation: string;
+    readonly keyId: string;
+    readonly audience: string;
+    readonly publicKey: KeyObject;
+}
+export interface EffectDispatchJournalOptions {
+    readonly path: string;
+    readonly catalogIncarnation: string;
+    readonly signingKey: Uint8Array;
+    readonly dispatchSigner: EffectDispatchSigner;
+    readonly effectEndpointTrust: ReadonlyMap<string, EffectEndpointTrust>;
+    readonly providerLookupTrust: ReadonlyMap<string, ProviderLookupTrust>;
+    readonly clock?: () => Date;
+}
+/** Exact RFC 8785 JCS bytes signed by the Accounts effect sink. */
+export declare function effectDispatchedSigningBytes(dispatched: UnsignedEffectDispatchedRecord): Uint8Array;
+/** Exact RFC 8785 JCS bytes an owning effect endpoint signs. */
+export declare function effectOutcomeSigningBytes(outcome: UnsignedEffectOutcomeRecord): Uint8Array;
+/** Exact RFC 8785 JCS bytes a provider lookup issuer signs. */
+export declare function providerLookupEvidenceSigningBytes(evidence: UnsignedProviderLookupEvidence): Uint8Array;
+export declare class EffectDispatchJournal {
+    private readonly claimLog;
+    private readonly preparedLog;
+    private readonly effectLog;
+    private readonly catalogIncarnation;
+    private readonly dispatchSigner;
+    private readonly endpointTrust;
+    private readonly lookupTrust;
+    private readonly clock;
+    constructor(options: EffectDispatchJournalOptions);
+    readState(operationId: string, operationStepId: string): EffectDispatchState | undefined;
+    prepare(input: EffectPrepareInput): EffectJournalAppend<EffectPreparedRecord>;
+    dispatch(input: EffectDispatchInput): EffectDispatchAppend;
+    outcomeForSigning(input: EffectOutcomeSigningInput): UnsignedEffectOutcomeRecord;
+    recordOutcome(outcome: EffectOutcomeRecord, providerLookupEvidence?: ProviderLookupEvidence): EffectJournalAppend<EffectOutcomeRecord>;
+    private now;
+    private validateStoredEffect;
+    private verifyDispatchSignature;
+    private verifyEndpointOutcome;
+    private verifyProviderLookupEvidence;
+    private assertFreshOutcome;
+    private verifiedSnapshots;
+    private validateHistory;
+    private operationEpochs;
+    private dispatchedMatchesPrepared;
+    private outcomeMatchesEpoch;
+    private providerIdempotencyToken;
+}
+export {};

package/dist/storage/file-recovery-ledger.d.ts

@@ -0,0 +1,66 @@
+import { type Counter } from "../domain/counter";
+import type { RecoveryFrontier, RecoveryLedger, RecoveryLedgerEntry, RecoveryLedgerReceipt } from "./repository";
+export interface SignedLogFrontier {
+    readonly catalogIncarnation: string;
+    readonly sequence: Counter;
+    readonly hash: string;
+    readonly signatureDigest: string;
+}
+export interface SignedLogRecord<T> extends SignedLogFrontier {
+    readonly previousHash: string;
+    readonly payload: T;
+    readonly payloadDigest: string;
+    readonly receiptDigest: string;
+}
+export interface SignedLogSnapshot<T> {
+    readonly frontier: SignedLogFrontier;
+    readonly records: readonly SignedLogRecord<T>[];
+}
+export interface OwnerOnlySignedAppendLogOptions<T> {
+    readonly path: string;
+    readonly catalogIncarnation: string;
+    readonly signingKey: Uint8Array;
+    readonly logKind: string;
+    readonly validatePayload: (value: unknown) => T;
+}
+/**
+ * A process-independent, owner-only, signed append log. The companion anchor is
+ * deliberately stored outside the append stream so truncating a valid prefix is
+ * detected. It is an internal building block, not an authorization source.
+ */
+export declare class OwnerOnlySignedAppendLog<T> {
+    readonly path: string;
+    readonly anchorPath: string;
+    private readonly parentPath;
+    private readonly lockPath;
+    private readonly signingKey;
+    private readonly catalogIncarnation;
+    private readonly logKind;
+    private readonly validatePayload;
+    private lastObserved?;
+    constructor(options: OwnerOnlySignedAppendLogOptions<T>);
+    readSnapshot(): SignedLogSnapshot<T>;
+    verifyFrontier(frontier: SignedLogFrontier): boolean;
+    append(expected: SignedLogFrontier, payload: T): SignedLogRecord<T>;
+    private initialize;
+    private scan;
+    private parseCanonicalLine;
+    private readAnchor;
+    private writeAnchor;
+    private signFrontier;
+    private hmac;
+    private withLock;
+}
+export interface FileRecoveryLedgerOptions {
+    readonly path: string;
+    readonly catalogIncarnation: string;
+    readonly signingKey: Uint8Array;
+}
+/** Owner-only, fsync-backed RecoveryLedger implementation for local deployments. */
+export declare class FileRecoveryLedger implements RecoveryLedger {
+    private readonly log;
+    constructor(options: FileRecoveryLedgerOptions);
+    readFreshFrontier(): RecoveryFrontier;
+    append(expected: RecoveryFrontier, entry: RecoveryLedgerEntry): RecoveryLedgerReceipt;
+    verifyFrontier(frontier: RecoveryFrontier): boolean;
+}

package/dist/storage/memory.d.ts

@@ -0,0 +1,47 @@
+import type { CredentialBinding, CredentialOperation, EntityKind, EntityMap } from "../domain/models";
+import type { AccountEvent, AccountsRepository, MutationContext, MutationResult, RepositoryDoctor, EligibilitySnapshot, CredentialHandleEnvelope, CredentialHandleVerifier, CredentialResolutionGrant, CredentialResolutionTransport, CredentialUseAuthorizer, NativeRevocationRequest, NativeRevocationResult, OutboxRecord, OutboxAcknowledgeRequest, OutboxClaimRequest, RecoveryLedger, ResolvedCredentialHandle, AuthorityPromotionKind, VerifiedAuthorityEvidenceRecord } from "./repository";
+import { type Counter } from "../domain/counter";
+export declare class InMemoryAccountsRepository implements AccountsRepository {
+    private readonly credentialVerifier;
+    private readonly recoveryLedger;
+    private readonly credentialUseAuthorizer;
+    private readonly records;
+    private readonly eventLog;
+    private readonly idempotency;
+    private readonly handles;
+    private readonly operationLog;
+    private readonly outboxLog;
+    private readonly nativeRevocationReplays;
+    private readonly authorityEvidenceByNonce;
+    private databaseFrontier?;
+    private recoveryHold;
+    private closed;
+    constructor(credentialVerifier?: CredentialHandleVerifier, recoveryLedger?: RecoveryLedger, credentialUseAuthorizer?: CredentialUseAuthorizer);
+    get<K extends EntityKind>(kind: K, id: EntityMap[K]["id"]): Promise<EntityMap[K] | undefined>;
+    list<K extends EntityKind>(kind: K): Promise<readonly EntityMap[K][]>;
+    readEligibilitySnapshot(accessMethodId: EntityMap["access_method"]["id"]): Promise<EligibilitySnapshot>;
+    insert<K extends EntityKind>(kind: K, input: EntityMap[K], context: MutationContext): Promise<MutationResult<EntityMap[K]>>;
+    insertCapacityPoolWithAuthorityEvidence(input: EntityMap["capacity_pool"], inputEvidence: VerifiedAuthorityEvidenceRecord, context: MutationContext): Promise<MutationResult<EntityMap["capacity_pool"]>>;
+    insertCredentialBinding(input: CredentialBinding, inputHandle: CredentialHandleEnvelope, context: MutationContext): Promise<MutationResult<CredentialBinding>>;
+    resolveCredentialHandle(bindingId: CredentialBinding["id"], grant: CredentialResolutionGrant, transport: CredentialResolutionTransport): Promise<ResolvedCredentialHandle>;
+    replace<K extends EntityKind>(kind: K, input: EntityMap[K], expectedRevision: Counter, context: MutationContext): Promise<MutationResult<EntityMap[K]>>;
+    promoteWithAuthorityEvidence<K extends AuthorityPromotionKind>(kind: K, input: EntityMap[K], expectedRevision: Counter, inputEvidence: readonly VerifiedAuthorityEvidenceRecord[], context: MutationContext): Promise<MutationResult<EntityMap[K]>>;
+    revokeNativeGeneration(request: NativeRevocationRequest): Promise<NativeRevocationResult>;
+    credentialOperations(): Promise<readonly CredentialOperation[]>;
+    outbox(): Promise<readonly OutboxRecord[]>;
+    claimOutbox(request: OutboxClaimRequest): Promise<readonly OutboxRecord[]>;
+    acknowledgeOutbox(request: OutboxAcknowledgeRequest): Promise<OutboxRecord>;
+    events(): Promise<readonly AccountEvent[]>;
+    findReplacementReplay<K extends EntityKind>(kind: K, id: EntityMap[K]["id"], to: EntityMap[K]["status"], expectedRevision: Counter, context: MutationContext): Promise<MutationResult<EntityMap[K]> | undefined>;
+    doctor(): Promise<RepositoryDoctor>;
+    close(): Promise<void>;
+    private readRecoverySnapshot;
+    private appendRecovery;
+    private commitRecovery;
+    private replay;
+    private makeEvent;
+    private appendAggregateOutbox;
+    private appendCleanupOutbox;
+    private assertUniqueness;
+    private assertOpen;
+}

package/dist/storage/native-revocation.d.ts

@@ -0,0 +1,10 @@
+import type { AccessMethod, AuthCapsule, CapacityPool, CredentialBinding } from "../domain/models";
+import type { NativeRevocationRequest, NativeRevocationResult } from "./repository";
+export interface NativeRevocationSource {
+    readonly pool: CapacityPool;
+    readonly method: AccessMethod;
+    readonly capsule: AuthCapsule;
+    readonly binding: CredentialBinding;
+    readonly credentialHandleAuditDigest: string;
+}
+export declare function deriveNativeRevocation(source: NativeRevocationSource, request: NativeRevocationRequest, revocationBarrierReceiptDigest: string): Omit<NativeRevocationResult, "replayed">;

package/dist/storage/postgres-config.d.ts

@@ -0,0 +1,25 @@
+export interface PostgresConnectionInput {
+    readonly url: string | URL;
+    /** Test-only escape hatch. It is accepted exclusively for a literal loopback host. */
+    readonly allowInsecureLoopback?: boolean;
+}
+export interface NormalizedPostgresConnection {
+    readonly url: URL;
+    readonly tls: false | Readonly<{
+        rejectUnauthorized: true;
+    }>;
+}
+export interface PostgresRuntimeContext {
+    readonly principalRef: string;
+    readonly identityRealm: "hasna";
+}
+/**
+ * Validates the connection without ever including the credential-bearing URL in
+ * an exception. Self-hosted Accounts only accepts hostname-verified TLS. The
+ * sole plaintext exception is an explicit literal-loopback test connection.
+ */
+export declare function normalizePostgresConnection(input: PostgresConnectionInput): NormalizedPostgresConnection;
+export declare function validatePostgresRuntimeContext(input: {
+    readonly principalRef: string;
+    readonly identityRealm: string;
+}): PostgresRuntimeContext;

package/dist/storage/postgres-migrations.d.ts

@@ -0,0 +1,10 @@
+export declare const POSTGRES_SCHEMA_VERSION = 1;
+export declare const POSTGRES_REQUIRED_TABLES: readonly ["schema_migrations", "accounts_installation", "provider_accounts", "provider_subject_claims", "entitlements", "capacity_pools", "capacity_domain_claims", "account_lanes", "auth_capsules", "credential_family_claims", "credential_bindings", "credential_binding_handles", "credential_operations", "import_candidates", "evidence_records", "recovery_ledger_receipts", "slot_eligibility_audit", "account_events", "outbox", "idempotency_records"];
+export declare const POSTGRES_MIGRATION_V1: string;
+export declare const POSTGRES_MIGRATION_V1_CHECKSUM: string;
+export declare const POSTGRES_MIGRATION_CHECKSUM: string;
+export declare const POSTGRES_MIGRATIONS: readonly Readonly<{
+    version: 1;
+    checksum: string;
+    sql: string;
+}>[];

package/dist/storage/postgres-migrator.d.ts

@@ -0,0 +1,12 @@
+import type { SQL } from "bun";
+export interface PostgresMigrationReport {
+    readonly schemaVersion: string;
+    readonly migrationChecksum: string;
+    readonly appliedVersions: readonly string[];
+}
+/**
+ * Applies only package-owned, checksummed SQL while holding a transaction-level
+ * advisory lock. This function must be called with the migration/admin client,
+ * never with the Accounts runtime role.
+ */
+export declare function runPostgresMigrations(client: SQL): Promise<PostgresMigrationReport>;