@hraness/suite-accounts 0.9.20

package/src/convex-url.ts

@@ -0,0 +1,74 @@
+export type ConvexDeployment =
+  | Readonly<{ kind: "missing" }>
+  | Readonly<{
+      input: string;
+      kind: "invalid";
+      message: string;
+      reason:
+        | "credentials"
+        | "insecure-remote"
+        | "not-a-url"
+        | "not-an-origin";
+    }>
+  | Readonly<{
+      kind: "ready";
+      origin: string;
+      transport: "cloud" | "local";
+      url: string;
+    }>;
+
+const LOCAL_HOSTNAMES = new Set(["127.0.0.1", "[::1]", "localhost"]);
+
+function invalid(
+  input: string,
+  reason: Extract<ConvexDeployment, { kind: "invalid" }>["reason"],
+  message: string,
+): ConvexDeployment {
+  return deepFreeze({ input, kind: "invalid", message, reason });
+}
+
+/** Parse untrusted public configuration into one safe Convex origin. */
+export function parseConvexDeployment(value: unknown): ConvexDeployment {
+  if (typeof value !== "string" || value.trim() === "") {
+    return deepFreeze({ kind: "missing" });
+  }
+
+  const input = value.trim();
+  let parsed: URL;
+  try {
+    parsed = new URL(input);
+  } catch {
+    return invalid(input, "not-a-url", "Use a complete Convex deployment URL.");
+  }
+
+  if (parsed.username !== "" || parsed.password !== "") {
+    return invalid(
+      input,
+      "credentials",
+      "Deployment URLs cannot contain credentials.",
+    );
+  }
+  if (parsed.pathname !== "/" || parsed.search !== "" || parsed.hash !== "") {
+    return invalid(
+      input,
+      "not-an-origin",
+      "Use the deployment origin without a path or query.",
+    );
+  }
+
+  const local = LOCAL_HOSTNAMES.has(parsed.hostname);
+  if (parsed.protocol !== "https:" && !(local && parsed.protocol === "http:")) {
+    return invalid(
+      input,
+      "insecure-remote",
+      "Remote Convex deployments must use HTTPS.",
+    );
+  }
+  return deepFreeze({
+    kind: "ready",
+    origin: parsed.origin,
+    transport: local ? "local" : "cloud",
+    url: parsed.origin,
+  });
+}
+import { deepFreeze } from "./immutable.js";

package/src/entitlements.ts

@@ -0,0 +1,317 @@
+import {
+  grantedSuiteFeatureSets,
+  parseSuiteCatalogRevision,
+  parseSuiteFeatureId,
+  SUITE_FEATURE_IDS,
+  type SuiteCatalogRevision,
+  type SuiteFeatureId,
+} from "./identity/catalog.js";
+import {
+  parseSuiteJwtClaims,
+  type SuiteJwtClaims,
+} from "./identity/principals.js";
+
+export const SUITE_ENTITLEMENTS_CLAIM_VERSION =
+  "suite-entitlements-v1" as const;
+/** Slightly exceeds the authority's canonical 24-hour refresh cadence. */
+export const SUITE_ENTITLEMENT_MAX_PROVIDER_AGE_MS = 26 * 60 * 60_000;
+
+export type SuiteEntitlementsClaim = Readonly<{
+  catalogRevision: SuiteCatalogRevision;
+  expiresAtMs: number;
+  features: readonly SuiteFeatureId[];
+  observedAtMs: number;
+  projectionRevision: number;
+  version: typeof SUITE_ENTITLEMENTS_CLAIM_VERSION;
+}>;
+
+export type VerifiedSuiteEntitlements =
+  | Readonly<{
+      claim: null;
+      features: readonly [];
+      kind: "legacy";
+    }>
+  | Readonly<{
+      claim: SuiteEntitlementsClaim;
+      features: readonly SuiteFeatureId[];
+      kind: "fresh";
+    }>
+  | Readonly<{
+      claim: SuiteEntitlementsClaim;
+      features: readonly [];
+      kind: "stale";
+    }>;
+
+export type SuiteEntitlementTokenResult =
+  | Readonly<{
+      claims: SuiteJwtClaims;
+      entitlements: VerifiedSuiteEntitlements;
+      kind: "verified";
+    }>
+  | Readonly<{
+      kind: "invalid";
+      reason:
+        | "claims"
+        | "entitlements"
+        | "issuer"
+        | "audience"
+        | "signature"
+        | "time";
+    }>;
+
+export type SuiteJwtCryptographicVerifier =
+  (compactToken: string) => Promise<unknown>;
+
+export type SuiteEntitlementReceiptProjection = Readonly<{
+  catalogRevision: SuiteCatalogRevision;
+  expiresAtMs: number;
+  features: readonly SuiteFeatureId[];
+  observedAtMs: number;
+  projectionRevision: number;
+  receiptDigest?: string;
+  receiptIssuedAtMs: number;
+  suiteAccountId: string;
+}>;
+
+export type SuiteEntitlementReceiptProjectionDecision =
+  | "conflict"
+  | "insert"
+  | "replace"
+  | "replay";
+
+export type VerifySuiteEntitlementTokenOptions = Readonly<{
+  clockSkewMs?: number;
+  expectedAudience: string;
+  expectedIssuer: string;
+  maxProjectionAgeMs?: number;
+  maxTokenLifetimeMs?: number;
+  nowMs?: number;
+  verify: SuiteJwtCryptographicVerifier;
+}>;
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function nonNegativeInteger(value: unknown): value is number {
+  return Number.isSafeInteger(value) && typeof value === "number" && value >= 0;
+}
+
+function canonicalFeatures(
+  revision: SuiteCatalogRevision,
+  features: readonly SuiteFeatureId[],
+): boolean {
+  return grantedSuiteFeatureSets(revision).some(set =>
+    set.length === features.length
+    && set.every((feature, index) => feature === features[index])
+  );
+}
+
+function validReceiptProjection(
+  projection: SuiteEntitlementReceiptProjection,
+): boolean {
+  const revision = parseSuiteCatalogRevision(projection.catalogRevision);
+  return revision.ok
+    && projection.suiteAccountId.length >= 1
+    && projection.suiteAccountId.length <= 128
+    && canonicalFeatures(revision.value, projection.features)
+    && nonNegativeInteger(projection.observedAtMs)
+    && nonNegativeInteger(projection.expiresAtMs)
+    && projection.expiresAtMs > projection.observedAtMs
+    && nonNegativeInteger(projection.projectionRevision)
+    && nonNegativeInteger(projection.receiptIssuedAtMs)
+    && projection.receiptIssuedAtMs < projection.expiresAtMs
+    && (
+      projection.receiptDigest === undefined
+      || /^[a-f0-9]{64}$/u.test(projection.receiptDigest)
+    );
+}
+
+function sameFeatures(
+  left: readonly SuiteFeatureId[],
+  right: readonly SuiteFeatureId[],
+): boolean {
+  return left.length === right.length
+    && left.every((feature, index) => feature === right[index]);
+}
+
+/**
+ * Orders signed entitlement receipts independently from the provider snapshot.
+ *
+ * A token refresh may reissue the same provider projection with a later
+ * token-bound expiry, or may turn an aged grant into an empty claim without a
+ * new provider event. The outer signed receipt issuance is therefore the
+ * secondary clock for one projection revision.
+ */
+export function decideSuiteEntitlementReceiptProjection(
+  current: SuiteEntitlementReceiptProjection | null,
+  incoming: SuiteEntitlementReceiptProjection,
+): SuiteEntitlementReceiptProjectionDecision {
+  if (!validReceiptProjection(incoming)) return "conflict";
+  if (current === null) return "insert";
+  if (
+    !validReceiptProjection(current)
+    || current.suiteAccountId !== incoming.suiteAccountId
+    || incoming.projectionRevision < current.projectionRevision
+    || incoming.observedAtMs < current.observedAtMs
+    || incoming.receiptIssuedAtMs < current.receiptIssuedAtMs
+  ) {
+    return "conflict";
+  }
+  if (
+    incoming.projectionRevision > current.projectionRevision
+    || incoming.receiptIssuedAtMs > current.receiptIssuedAtMs
+  ) {
+    return "replace";
+  }
+  return (
+      incoming.catalogRevision === current.catalogRevision
+      && incoming.expiresAtMs === current.expiresAtMs
+      && incoming.observedAtMs === current.observedAtMs
+      && sameFeatures(incoming.features, current.features)
+      && incoming.receiptDigest === current.receiptDigest
+    )
+    ? "replay"
+    : "conflict";
+}
+
+function parseEntitlements(
+  value: unknown,
+): SuiteEntitlementsClaim | null {
+  if (!isRecord(value)) return null;
+  const catalogRevision = parseSuiteCatalogRevision(value["catalogRevision"]);
+  if (
+    value["version"] !== SUITE_ENTITLEMENTS_CLAIM_VERSION
+    || !catalogRevision.ok
+    || !nonNegativeInteger(value["observedAtMs"])
+    || !nonNegativeInteger(value["expiresAtMs"])
+    || !nonNegativeInteger(value["projectionRevision"])
+    || !Array.isArray(value["features"])
+    || value["features"].length > SUITE_FEATURE_IDS.length
+  ) {
+    return null;
+  }
+  const features: SuiteFeatureId[] = [];
+  for (const valueFeature of value["features"]) {
+    const feature = parseSuiteFeatureId(valueFeature);
+    if (!feature.ok || features.includes(feature.value)) return null;
+    features.push(feature.value);
+  }
+  if (
+    value["expiresAtMs"] <= value["observedAtMs"]
+    || !canonicalFeatures(catalogRevision.value, features)
+  ) return null;
+  return {
+    catalogRevision: catalogRevision.value,
+    expiresAtMs: value["expiresAtMs"],
+    features,
+    observedAtMs: value["observedAtMs"],
+    projectionRevision: value["projectionRevision"],
+    version: SUITE_ENTITLEMENTS_CLAIM_VERSION,
+  };
+}
+
+function validExpectedString(value: string): boolean {
+  let hasControl = false;
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code <= 31 || code === 127) {
+      hasControl = true;
+      break;
+    }
+  }
+  return value.length >= 1
+    && value.length <= 2_048
+    && value.trim() === value
+    && !hasControl;
+}
+
+export async function verifySuiteEntitlementToken(
+  compactToken: string,
+  options: VerifySuiteEntitlementTokenOptions,
+): Promise<SuiteEntitlementTokenResult> {
+  if (
+    compactToken.length < 1
+    || compactToken.length > 16_384
+    || !validExpectedString(options.expectedAudience)
+    || !validExpectedString(options.expectedIssuer)
+  ) {
+    return { kind: "invalid", reason: "claims" };
+  }
+  let payload: unknown;
+  try {
+    payload = await options.verify(compactToken);
+  } catch {
+    return { kind: "invalid", reason: "signature" };
+  }
+  const parsed = parseSuiteJwtClaims(payload);
+  if (!parsed.ok) return { kind: "invalid", reason: "claims" };
+  const claims = parsed.value;
+  if (claims.principal.issuer !== options.expectedIssuer) {
+    return { kind: "invalid", reason: "issuer" };
+  }
+  if (!claims.audience.includes(options.expectedAudience)) {
+    return { kind: "invalid", reason: "audience" };
+  }
+
+  const nowMs = options.nowMs ?? Date.now();
+  const clockSkewMs = options.clockSkewMs ?? 30_000;
+  const maxTokenLifetimeMs = options.maxTokenLifetimeMs ?? 20 * 60_000;
+  const maxProjectionAgeMs =
+    options.maxProjectionAgeMs ?? SUITE_ENTITLEMENT_MAX_PROVIDER_AGE_MS;
+  if (
+    !nonNegativeInteger(nowMs)
+    || !nonNegativeInteger(clockSkewMs)
+    || !nonNegativeInteger(maxTokenLifetimeMs)
+    || !nonNegativeInteger(maxProjectionAgeMs)
+  ) {
+    return { kind: "invalid", reason: "time" };
+  }
+  const issuedAtMs = claims.issuedAtSeconds * 1_000;
+  const expiresAtMs = claims.expiresAtSeconds * 1_000;
+  const notBeforeMs = claims.notBeforeSeconds === undefined
+    ? issuedAtMs
+    : claims.notBeforeSeconds * 1_000;
+  if (
+    expiresAtMs - issuedAtMs > maxTokenLifetimeMs
+    || issuedAtMs > nowMs + clockSkewMs
+    || notBeforeMs > nowMs + clockSkewMs
+    || expiresAtMs <= nowMs - clockSkewMs
+  ) {
+    return { kind: "invalid", reason: "time" };
+  }
+  if (!isRecord(payload)) return { kind: "invalid", reason: "claims" };
+  const rawEntitlements = payload["suite_entitlements"];
+  if (rawEntitlements === undefined) {
+    return {
+      claims,
+      entitlements: { claim: null, features: [], kind: "legacy" },
+      kind: "verified",
+    };
+  }
+  const claim = parseEntitlements(rawEntitlements);
+  if (claim === null || claim.expiresAtMs > expiresAtMs) {
+    return { kind: "invalid", reason: "entitlements" };
+  }
+  const fresh = (
+    claim.observedAtMs <= nowMs + clockSkewMs
+    && claim.expiresAtMs > nowMs - clockSkewMs
+    && nowMs - claim.observedAtMs <= maxProjectionAgeMs
+  );
+  return {
+    claims,
+    entitlements: fresh
+      ? { claim, features: claim.features, kind: "fresh" }
+      : { claim, features: [], kind: "stale" },
+    kind: "verified",
+  };
+}
+
+export function suiteTokenGrantsFeature(
+  result: SuiteEntitlementTokenResult,
+  feature: SuiteFeatureId,
+): boolean {
+  return result.kind === "verified"
+    && result.entitlements.kind === "fresh"
+    && result.entitlements.features.includes(feature);
+}

package/src/identity/catalog.ts

@@ -0,0 +1,227 @@
+import { err, ok, type Result } from "@hraness/result";
+import { deepFreeze } from "../immutable.js";
+
+/**
+ * Protocol revisions accepted by identity and entitlement readers.
+ *
+ * Pricing, provider lookup keys, and customer-facing plan copy belong to the
+ * Accounts service. This module keeps only the finite values needed to parse
+ * signed protocol evidence and to fail closed on feature grants.
+ */
+export const SUITE_CATALOG_REVISION = "hraness-suite-v4" as const;
+export const PREVIOUS_SUITE_CATALOG_REVISION = "cclrte-suite-v3" as const;
+export const LEGACY_SUITE_CATALOG_REVISION = "cclrte-suite-v2" as const;
+export const ARCHIVED_SUITE_CATALOG_REVISION = "cclrte-suite-v1" as const;
+export const SUITE_CATALOG_REVISIONS = deepFreeze([
+  ARCHIVED_SUITE_CATALOG_REVISION,
+  LEGACY_SUITE_CATALOG_REVISION,
+  PREVIOUS_SUITE_CATALOG_REVISION,
+  SUITE_CATALOG_REVISION,
+] as const);
+
+export const SUITE_PLAN_IDS = deepFreeze(["community", "pro"] as const);
+export const SUITE_HISTORICAL_PLAN_IDS = deepFreeze([
+  "individual",
+  "business",
+] as const);
+export const SUITE_CURRENT_FEATURE_IDS = deepFreeze([
+  "suite.paid",
+  "suite.community",
+  "suite.pro",
+] as const);
+export const SUITE_PREVIOUS_FEATURE_IDS = deepFreeze([
+  "suite.paid",
+  "suite.believer",
+] as const);
+export const SUITE_LEGACY_FEATURE_IDS = deepFreeze([
+  "suite.paid",
+  "suite.business",
+] as const);
+export const SUITE_FEATURE_IDS = deepFreeze([
+  "suite.paid",
+  "suite.community",
+  "suite.pro",
+  "suite.believer",
+  "suite.business",
+] as const);
+
+export type CurrentSuiteCatalogRevision = typeof SUITE_CATALOG_REVISION;
+export type PreviousSuiteCatalogRevision =
+  typeof PREVIOUS_SUITE_CATALOG_REVISION;
+export type LegacySuiteCatalogRevision =
+  typeof LEGACY_SUITE_CATALOG_REVISION;
+export type ArchivedSuiteCatalogRevision =
+  typeof ARCHIVED_SUITE_CATALOG_REVISION;
+export type HistoricalSuiteCatalogRevision =
+  | ArchivedSuiteCatalogRevision
+  | LegacySuiteCatalogRevision
+  | PreviousSuiteCatalogRevision;
+export type SuiteCatalogRevision = (typeof SUITE_CATALOG_REVISIONS)[number];
+
+export type SuitePlanId = (typeof SUITE_PLAN_IDS)[number];
+export type HistoricalSuitePlanId = (typeof SUITE_HISTORICAL_PLAN_IDS)[number];
+export type AnySuitePlanId = HistoricalSuitePlanId | SuitePlanId;
+
+export type CurrentSuiteFeatureId =
+  (typeof SUITE_CURRENT_FEATURE_IDS)[number];
+export type PreviousSuiteFeatureId =
+  (typeof SUITE_PREVIOUS_FEATURE_IDS)[number];
+export type LegacySuiteFeatureId =
+  (typeof SUITE_LEGACY_FEATURE_IDS)[number];
+export type SuiteFeatureId = (typeof SUITE_FEATURE_IDS)[number];
+
+export type SuiteCatalogIssue =
+  | "invalid-catalog-revision"
+  | "invalid-feature"
+  | "invalid-plan";
+
+const CURRENT_PLAN_FEATURES = deepFreeze({
+  community: ["suite.paid", "suite.community"],
+  pro: ["suite.paid", "suite.community", "suite.pro"],
+} as const satisfies Readonly<
+  Record<SuitePlanId, readonly CurrentSuiteFeatureId[]>
+>);
+
+const PREVIOUS_PLAN_FEATURES = deepFreeze({
+  business: ["suite.paid", "suite.believer"],
+  individual: ["suite.paid"],
+} as const satisfies Readonly<
+  Record<HistoricalSuitePlanId, readonly PreviousSuiteFeatureId[]>
+>);
+
+const LEGACY_PLAN_FEATURES = deepFreeze({
+  business: ["suite.paid", "suite.business"],
+  individual: ["suite.paid"],
+} as const satisfies Readonly<
+  Record<HistoricalSuitePlanId, readonly LegacySuiteFeatureId[]>
+>);
+
+export function parseSuitePlanId(
+  value: unknown,
+): Result<SuitePlanId, "invalid-plan">;
+export function parseSuitePlanId(
+  value: unknown,
+  revision: CurrentSuiteCatalogRevision,
+): Result<SuitePlanId, "invalid-plan">;
+export function parseSuitePlanId(
+  value: unknown,
+  revision: HistoricalSuiteCatalogRevision,
+): Result<HistoricalSuitePlanId, "invalid-plan">;
+export function parseSuitePlanId(
+  value: unknown,
+  revision: SuiteCatalogRevision,
+): Result<AnySuitePlanId, "invalid-plan">;
+export function parseSuitePlanId(
+  value: unknown,
+  revision: SuiteCatalogRevision = SUITE_CATALOG_REVISION,
+): Result<AnySuitePlanId, "invalid-plan"> {
+  const ids: readonly string[] = revision === SUITE_CATALOG_REVISION
+    ? SUITE_PLAN_IDS
+    : SUITE_HISTORICAL_PLAN_IDS;
+  return typeof value === "string" && ids.includes(value)
+    ? ok(value as AnySuitePlanId)
+    : err("invalid-plan");
+}
+
+export function parseAnySuitePlanId(
+  value: unknown,
+): Result<AnySuitePlanId, "invalid-plan"> {
+  return typeof value === "string" &&
+      ([...SUITE_PLAN_IDS, ...SUITE_HISTORICAL_PLAN_IDS] as readonly string[])
+        .includes(value)
+    ? ok(value as AnySuitePlanId)
+    : err("invalid-plan");
+}
+
+export function parseCurrentSuiteFeatureId(
+  value: unknown,
+): Result<CurrentSuiteFeatureId, "invalid-feature"> {
+  return value === "suite.paid" || value === "suite.community"
+      || value === "suite.pro"
+    ? ok(value)
+    : err("invalid-feature");
+}
+
+export function parseSuiteFeatureId(
+  value: unknown,
+): Result<SuiteFeatureId, "invalid-feature"> {
+  return typeof value === "string"
+      && (SUITE_FEATURE_IDS as readonly string[]).includes(value)
+    ? ok(value as SuiteFeatureId)
+    : err("invalid-feature");
+}
+
+export function parseSuiteCatalogRevision(
+  value: unknown,
+): Result<SuiteCatalogRevision, "invalid-catalog-revision"> {
+  return typeof value === "string"
+      && (SUITE_CATALOG_REVISIONS as readonly string[]).includes(value)
+    ? ok(value as SuiteCatalogRevision)
+    : err("invalid-catalog-revision");
+}
+
+/** Return the exact feature order required by a signed protocol revision. */
+export function featuresForSuitePlan(
+  plan: SuitePlanId,
+): CurrentSuiteFeatureId[];
+export function featuresForSuitePlan(
+  plan: SuitePlanId,
+  revision: CurrentSuiteCatalogRevision,
+): CurrentSuiteFeatureId[];
+export function featuresForSuitePlan(
+  plan: HistoricalSuitePlanId,
+  revision: LegacySuiteCatalogRevision | PreviousSuiteCatalogRevision,
+): PreviousSuiteFeatureId[];
+export function featuresForSuitePlan(
+  plan: HistoricalSuitePlanId,
+  revision: ArchivedSuiteCatalogRevision,
+): LegacySuiteFeatureId[];
+export function featuresForSuitePlan(
+  plan: AnySuitePlanId,
+  revision: SuiteCatalogRevision,
+): SuiteFeatureId[];
+export function featuresForSuitePlan(
+  plan: AnySuitePlanId,
+  revision: SuiteCatalogRevision = SUITE_CATALOG_REVISION,
+): SuiteFeatureId[] {
+  const table: Readonly<Record<string, readonly SuiteFeatureId[]>> =
+    revision === SUITE_CATALOG_REVISION
+      ? CURRENT_PLAN_FEATURES
+      : revision === ARCHIVED_SUITE_CATALOG_REVISION
+        ? LEGACY_PLAN_FEATURES
+        : PREVIOUS_PLAN_FEATURES;
+  const features = table[plan];
+  return features === undefined ? [] : [...features];
+}
+
+/** Return every finite feature set a revision can grant, including the empty set. */
+export function grantedSuiteFeatureSets(
+  revision: SuiteCatalogRevision,
+): readonly (readonly SuiteFeatureId[])[] {
+  if (revision === SUITE_CATALOG_REVISION) {
+    return deepFreeze([
+      [],
+      CURRENT_PLAN_FEATURES.community,
+      CURRENT_PLAN_FEATURES.pro,
+    ] as const);
+  }
+  const table = revision === ARCHIVED_SUITE_CATALOG_REVISION
+    ? LEGACY_PLAN_FEATURES
+    : PREVIOUS_PLAN_FEATURES;
+  return deepFreeze([
+    [],
+    table.individual,
+    table.business,
+  ] as const);
+}
+
+/**
+ * Check the current entitlement protocol, not a user's authorization state.
+ * Authorization must consume a verified account or entitlement projection.
+ */
+export function suitePlanIncludesFeature(
+  plan: SuitePlanId | null,
+  feature: CurrentSuiteFeatureId,
+): boolean {
+  return plan !== null && featuresForSuitePlan(plan).includes(feature);
+}

package/src/identity/consumers.ts

@@ -0,0 +1,53 @@
+import { err, ok, type Result } from "@hraness/result";
+import { deepFreeze } from "../immutable.js";
+
+/**
+ * Consumer identities accepted by the released v1 protocol.
+ *
+ * This is intentionally distinct from both `SUITE_PRODUCTS` and the client
+ * registration authority. Accounts is a consumer but not a product principal,
+ * some product identities have no interactive authentication surface, and a
+ * retired consumer identity may remain parseable without retaining trust.
+ */
+export const SUITE_CONSUMER_IDS = deepFreeze([
+  "accounts",
+  "act60",
+  "elders",
+  "soundfish",
+  "oh-computer",
+  "draw-money",
+  "oprte",
+  "sponge",
+] as const);
+/**
+ * Earlier client identities accepted only while parsing bounded historical
+ * evidence. Registration authority is defined separately and may reject both
+ * these aliases and retired canonical identities.
+ */
+export const LEGACY_SUITE_CONSUMER_IDS = deepFreeze([
+  "kitchen",
+] as const);
+
+export type SuiteConsumerId = (typeof SUITE_CONSUMER_IDS)[number];
+export type LegacySuiteConsumerId =
+  (typeof LEGACY_SUITE_CONSUMER_IDS)[number];
+
+export function parseSuiteConsumerId(
+  value: unknown,
+): Result<SuiteConsumerId, "invalid-consumer"> {
+  switch (value) {
+    case "accounts":
+    case "act60":
+    case "elders":
+    case "soundfish":
+    case "oh-computer":
+    case "draw-money":
+    case "oprte":
+    case "sponge":
+      return ok(value);
+    case "kitchen":
+      return ok("oprte");
+    default:
+      return err("invalid-consumer");
+  }
+}