mppx 0.6.18 → 0.6.20

package/dist/tempo/subscription/KeyAuthorization.js

@@ -0,0 +1,297 @@
+import { KeyAuthorization, SignatureEnvelope } from 'ox/tempo';
+import { isAddress, isAddressEqual } from 'viem';
+import { VerificationFailedError } from '../../Errors.js';
+/** 4-byte selector for TIP-20 `transfer(address,uint256)`. */
+export const transferSelector = '0xa9059cbb';
+/** 4-byte selector for TIP-20 `transferWithMemo(address,uint256,bytes)`. */
+export const transferWithMemoSelector = '0x95777d59';
+const uint64Max = (1n << 64n) - 1n;
+const secondsPerDay = 86400n;
+const secondsPerWeek = 604800n;
+/**
+ * Converts a subscription expiry timestamp into the Unix seconds value required by Tempo key
+ * authorizations.
+ */
+export function toSubscriptionExpiryDate(subscriptionExpires) {
+    return subscriptionExpires instanceof Date ? subscriptionExpires : new Date(subscriptionExpires);
+}
+export function toSubscriptionExpirySeconds(subscriptionExpires) {
+    const milliseconds = subscriptionExpires.getTime();
+    if (!Number.isFinite(milliseconds)) {
+        throw new VerificationFailedError({ reason: 'subscriptionExpires is invalid' });
+    }
+    if (milliseconds % 1_000 !== 0) {
+        throw new VerificationFailedError({
+            reason: 'subscriptionExpires must be representable as whole seconds',
+        });
+    }
+    const seconds = milliseconds / 1_000;
+    if (seconds <= 0 || !Number.isSafeInteger(seconds)) {
+        throw new VerificationFailedError({
+            reason: 'subscriptionExpires cannot be represented in a Tempo key authorization',
+        });
+    }
+    return seconds;
+}
+/**
+ * Converts the shared subscription period fields into the numeric period accepted by Tempo key
+ * authorizations.
+ */
+export function toSubscriptionPeriodSeconds(request) {
+    if (!/^[1-9]\d*$/.test(request.periodCount)) {
+        throw new VerificationFailedError({ reason: 'periodCount is invalid' });
+    }
+    if (request.periodUnit !== 'day' && request.periodUnit !== 'week') {
+        throw new VerificationFailedError({ reason: 'periodUnit is invalid' });
+    }
+    const unitSeconds = request.periodUnit === 'day' ? secondsPerDay : secondsPerWeek;
+    const value = BigInt(request.periodCount) * unitSeconds;
+    if (value > uint64Max) {
+        throw new VerificationFailedError({
+            reason: 'subscription period cannot be represented as an unsigned 64-bit integer',
+        });
+    }
+    if (value > BigInt(Number.MAX_SAFE_INTEGER)) {
+        throw new VerificationFailedError({
+            reason: 'subscription period cannot be represented exactly by this Tempo client',
+        });
+    }
+    return Number(value);
+}
+/**
+ * Verifies that the subscription duration is representable and lasts beyond the payment challenge.
+ */
+export function assertSubscriptionTiming(parameters) {
+    const { challengeExpires, request } = parameters;
+    toSubscriptionPeriodSeconds(request);
+    const subscriptionExpiry = toSubscriptionExpirySeconds(toSubscriptionExpiryDate(request.subscriptionExpires));
+    if (challengeExpires) {
+        const challengeExpiry = Math.floor(new Date(challengeExpires).getTime() / 1_000);
+        if (!Number.isFinite(challengeExpiry) || subscriptionExpiry <= challengeExpiry) {
+            throw new VerificationFailedError({
+                reason: 'subscriptionExpires must be strictly later than challenge expires',
+            });
+        }
+    }
+}
+/** Builds the Tempo access-key call scopes required for a subscription payment. */
+export function getSubscriptionScopes(request) {
+    const currency = normalizeAddress(request.currency, 'currency');
+    const recipient = normalizeAddress(request.recipient, 'recipient');
+    return [
+        {
+            address: currency,
+            selector: transferSelector,
+            recipients: [recipient],
+        },
+        {
+            address: currency,
+            selector: transferWithMemoSelector,
+            recipients: [recipient],
+        },
+    ];
+}
+/** Builds the RPC `allowedCalls` payload passed to `wallet_authorizeAccessKey`. */
+export function getSubscriptionRpcAllowedCalls(request) {
+    const [transfer, transferWithMemo] = getSubscriptionScopes(request);
+    return [
+        {
+            target: normalizeAddress(request.currency, 'currency'),
+            selectorRules: [
+                {
+                    selector: transfer.selector,
+                    recipients: transfer.recipients,
+                },
+                {
+                    selector: transferWithMemo.selector,
+                    recipients: transferWithMemo.recipients,
+                },
+            ],
+        },
+    ];
+}
+/**
+ * Creates and signs a Tempo key authorization for subscription payments when the account can sign
+ * arbitrary hashes locally.
+ */
+export async function signSubscriptionKeyAuthorization(parameters) {
+    const { accessKey, account, chainId, request } = parameters;
+    if (typeof account.sign !== 'function')
+        return undefined;
+    const authorization = createUnsignedAuthorization({
+        accessKey,
+        chainId,
+        request,
+    });
+    const signature = await account.sign({
+        hash: KeyAuthorization.getSignPayload(authorization),
+    });
+    return KeyAuthorization.from(authorization, {
+        signature: SignatureEnvelope.from(signature),
+    });
+}
+/**
+ * Verifies that a subscription credential contains a key authorization scoped to the requested
+ * token, recipient, amount, period, expiry, chain, and server-issued access key.
+ */
+export function verifySubscriptionKeyAuthorization(parameters) {
+    const { accessKey, chainId, payload, request } = parameters;
+    if (payload.type !== 'keyAuthorization') {
+        throw new VerificationFailedError({ reason: 'invalid keyAuthorization payload' });
+    }
+    const authorization = deserializeAuthorization(payload.signature);
+    const signature = getPrimitiveSignature(authorization);
+    assertAuthorizationKey({
+        accessKey,
+        authorization,
+        chainId,
+    });
+    assertAuthorizationExpiry(authorization, request);
+    assertAuthorizationLimit(getSingleTokenLimit(authorization), request);
+    assertAuthorizationScopes(authorization.scopes, request);
+    const source = recoverAuthorizationSource(authorization, signature);
+    return {
+        authorization,
+        source: {
+            address: source,
+            chainId,
+        },
+    };
+}
+function createUnsignedAuthorization(parameters) {
+    const { accessKey, chainId, request } = parameters;
+    return KeyAuthorization.from({
+        address: normalizeAddress(accessKey.accessKeyAddress, 'accessKeyAddress'),
+        chainId: BigInt(chainId),
+        expiry: toSubscriptionExpirySeconds(toSubscriptionExpiryDate(request.subscriptionExpires)),
+        limits: [
+            {
+                token: normalizeAddress(request.currency, 'currency'),
+                limit: BigInt(request.amount),
+                period: toSubscriptionPeriodSeconds(request),
+            },
+        ],
+        scopes: getSubscriptionScopes(request),
+        type: accessKey.keyType,
+    });
+}
+function deserializeAuthorization(signature) {
+    try {
+        return KeyAuthorization.deserialize(signature);
+    }
+    catch {
+        throw new VerificationFailedError({ reason: 'invalid keyAuthorization payload' });
+    }
+}
+function getPrimitiveSignature(authorization) {
+    const signature = authorization.signature;
+    if (!signature || signature.type === 'keychain') {
+        throw new VerificationFailedError({
+            reason: 'keyAuthorization must use a primitive signature',
+        });
+    }
+    return signature;
+}
+function assertAuthorizationKey(parameters) {
+    const { accessKey, authorization, chainId } = parameters;
+    if (authorization.chainId !== BigInt(chainId)) {
+        throw new VerificationFailedError({ reason: 'keyAuthorization chainId mismatch' });
+    }
+    if (!accessKey)
+        return;
+    if (!isAddressEqual(authorization.address, normalizeAddress(accessKey.accessKeyAddress, 'accessKeyAddress'))) {
+        throw new VerificationFailedError({ reason: 'keyAuthorization access key mismatch' });
+    }
+    if (authorization.type !== accessKey.keyType) {
+        throw new VerificationFailedError({ reason: 'keyAuthorization key type mismatch' });
+    }
+}
+function assertAuthorizationExpiry(authorization, request) {
+    assertSubscriptionTiming({ request });
+    if (authorization.expiry !==
+        toSubscriptionExpirySeconds(toSubscriptionExpiryDate(request.subscriptionExpires))) {
+        throw new VerificationFailedError({ reason: 'keyAuthorization expiry mismatch' });
+    }
+}
+function getSingleTokenLimit(authorization) {
+    const [limit] = authorization.limits ?? [];
+    if (!limit || authorization.limits?.length !== 1) {
+        throw new VerificationFailedError({
+            reason: 'keyAuthorization must contain exactly one token limit',
+        });
+    }
+    return limit;
+}
+function assertAuthorizationLimit(limit, request) {
+    if (!isAddressEqual(limit.token, normalizeAddress(request.currency, 'currency'))) {
+        throw new VerificationFailedError({ reason: 'keyAuthorization currency mismatch' });
+    }
+    if (limit.limit !== BigInt(request.amount)) {
+        throw new VerificationFailedError({ reason: 'keyAuthorization amount mismatch' });
+    }
+    if (limit.period !== toSubscriptionPeriodSeconds(request)) {
+        throw new VerificationFailedError({ reason: 'keyAuthorization period mismatch' });
+    }
+}
+function assertAuthorizationScopes(scopes, request) {
+    if (!scopes || scopes.length < 1 || scopes.length > 2) {
+        throw new VerificationFailedError({
+            reason: 'keyAuthorization must contain recipient-scoped transfer calls',
+        });
+    }
+    const currency = normalizeAddress(request.currency, 'currency');
+    const recipient = normalizeAddress(request.recipient, 'recipient');
+    const seen = new Set();
+    for (const scope of scopes) {
+        if (!isAddressEqual(scope.address, currency)) {
+            throw new VerificationFailedError({ reason: 'keyAuthorization call target mismatch' });
+        }
+        const selector = normalizeSelector(scope.selector);
+        if (selector !== transferSelector && selector !== transferWithMemoSelector) {
+            throw new VerificationFailedError({ reason: 'keyAuthorization selector not allowed' });
+        }
+        if (seen.has(selector)) {
+            throw new VerificationFailedError({ reason: 'keyAuthorization duplicate selector' });
+        }
+        seen.add(selector);
+        if (scope.recipients?.length !== 1 || !isAddressEqual(scope.recipients[0], recipient)) {
+            throw new VerificationFailedError({ reason: 'keyAuthorization recipient mismatch' });
+        }
+    }
+    if (!seen.has(transferSelector)) {
+        throw new VerificationFailedError({ reason: 'keyAuthorization must allow transfer' });
+    }
+    if (!seen.has(transferWithMemoSelector)) {
+        throw new VerificationFailedError({ reason: 'keyAuthorization must allow transferWithMemo' });
+    }
+}
+function recoverAuthorizationSource(authorization, signature) {
+    const signPayload = KeyAuthorization.getSignPayload(authorization);
+    try {
+        const source = SignatureEnvelope.extractAddress({
+            payload: signPayload,
+            signature,
+        });
+        if (!SignatureEnvelope.verify(signature, { address: source, payload: signPayload })) {
+            throw new VerificationFailedError({ reason: 'keyAuthorization signature is invalid' });
+        }
+        return source;
+    }
+    catch (error) {
+        if (error instanceof VerificationFailedError)
+            throw error;
+        throw new VerificationFailedError({ reason: 'keyAuthorization signature is invalid' });
+    }
+}
+function normalizeAddress(value, name) {
+    if (!isAddress(value)) {
+        throw new VerificationFailedError({ reason: `${name} must be an address` });
+    }
+    return value.toLowerCase();
+}
+function normalizeSelector(value) {
+    if (typeof value !== 'string')
+        return '';
+    return value.toLowerCase();
+}
+//# sourceMappingURL=KeyAuthorization.js.map

package/dist/tempo/subscription/KeyAuthorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeyAuthorization.js","sourceRoot":"","sources":["../../../src/tempo/subscription/KeyAuthorization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAA;AAC9D,OAAO,EAAE,SAAS,EAAE,cAAc,EAAgB,MAAM,MAAM,CAAA;AAE9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,iBAAiB,CAAA;AAQzD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAA;AAE5C,4EAA4E;AAC5E,MAAM,CAAC,MAAM,wBAAwB,GAAG,YAAY,CAAA;AAEpD,MAAM,SAAS,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,EAAE,CAAA;AAClC,MAAM,aAAa,GAAG,MAAO,CAAA;AAC7B,MAAM,cAAc,GAAG,OAAQ,CAAA;AAM/B;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,mBAAkC;IACzE,OAAO,mBAAmB,YAAY,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,mBAAmB,CAAC,CAAA;AAClG,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,mBAAyB;IACnE,MAAM,YAAY,GAAG,mBAAmB,CAAC,OAAO,EAAE,CAAA;IAClD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC,CAAA;IACjF,CAAC;IACD,IAAI,YAAY,GAAG,KAAK,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,uBAAuB,CAAC;YAChC,MAAM,EAAE,4DAA4D;SACrE,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,GAAG,KAAK,CAAA;IACpC,IAAI,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,uBAAuB,CAAC;YAChC,MAAM,EAAE,wEAAwE;SACjF,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAG3C;IACC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAA;IACzE,CAAC;IACD,IAAI,OAAO,CAAC,UAAU,KAAK,KAAK,IAAI,OAAO,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;QAClE,MAAM,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAA;IACjF,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,WAAW,CAAA;IACvD,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,uBAAuB,CAAC;YAChC,MAAM,EAAE,yEAAyE;SAClF,CAAC,CAAA;IACJ,CAAC;IACD,IAAI,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,uBAAuB,CAAC;YAChC,MAAM,EAAE,wEAAwE;SACjF,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,UAGxC;IACC,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,UAAU,CAAA;IAChD,2BAA2B,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,kBAAkB,GAAG,2BAA2B,CACpD,wBAAwB,CAAC,OAAO,CAAC,mBAAmB,CAAC,CACtD,CAAA;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,MAAM,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,CAAA;QAChF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,kBAAkB,IAAI,eAAe,EAAE,CAAC;YAC/E,MAAM,IAAI,uBAAuB,CAAC;gBAChC,MAAM,EAAE,mEAAmE;aAC5E,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,qBAAqB,CACnC,OAA4D;IAE5D,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;IAC/D,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IAClE,OAAO;QACL;YACE,OAAO,EAAE,QAAQ;YACjB,QAAQ,EAAE,gBAAgB;YAC1B,UAAU,EAAE,CAAC,SAAS,CAAC;SACxB;QACD;YACE,OAAO,EAAE,QAAQ;YACjB,QAAQ,EAAE,wBAAwB;YAClC,UAAU,EAAE,CAAC,SAAS,CAAC;SACxB;KACO,CAAA;AACZ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,8BAA8B,CAC5C,OAA4D;IAE5D,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAA;IACnE,OAAO;QACL;YACE,MAAM,EAAE,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC;YACtD,aAAa,EAAE;gBACb;oBACE,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oBAC3B,UAAU,EAAE,QAAQ,CAAC,UAAU;iBAChC;gBACD;oBACE,QAAQ,EAAE,gBAAgB,CAAC,QAAQ;oBACnC,UAAU,EAAE,gBAAgB,CAAC,UAAU;iBACxC;aACF;SACF;KACO,CAAA;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,UAUtD;IACC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,UAAU,CAAA;IAC3D,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU;QAAE,OAAO,SAAS,CAAA;IAExD,MAAM,aAAa,GAAG,2BAA2B,CAAC;QAChD,SAAS;QACT,OAAO;QACP,OAAO;KACR,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;QACnC,IAAI,EAAE,gBAAgB,CAAC,cAAc,CAAC,aAAa,CAAC;KACrD,CAAC,CAAA;IACF,OAAO,gBAAgB,CAAC,IAAI,CAAC,aAAa,EAAE;QAC1C,SAAS,EAAE,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC;KAC7C,CAAC,CAAA;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kCAAkC,CAAC,UAKlD;IACC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,UAAU,CAAA;IAC3D,IAAI,OAAO,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACxC,MAAM,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC,CAAA;IACnF,CAAC;IAED,MAAM,aAAa,GAAG,wBAAwB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACjE,MAAM,SAAS,GAAG,qBAAqB,CAAC,aAAa,CAAC,CAAA;IAEtD,sBAAsB,CAAC;QACrB,SAAS;QACT,aAAa;QACb,OAAO;KACR,CAAC,CAAA;IACF,yBAAyB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAA;IACjD,wBAAwB,CAAC,mBAAmB,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC,CAAA;IACrE,yBAAyB,CAAC,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACxD,MAAM,MAAM,GAAG,0BAA0B,CAAC,aAAa,EAAE,SAAS,CAAC,CAAA;IAEnE,OAAO;QACL,aAAa;QACb,MAAM,EAAE;YACN,OAAO,EAAE,MAAiB;YAC1B,OAAO;SACR;KACF,CAAA;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,UAOpC;IACC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,UAAU,CAAA;IAClD,OAAO,gBAAgB,CAAC,IAAI,CAAC;QAC3B,OAAO,EAAE,gBAAgB,CAAC,SAAS,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;QACzE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC;QACxB,MAAM,EAAE,2BAA2B,CAAC,wBAAwB,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;QAC1F,MAAM,EAAE;YACN;gBACE,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC;gBACrD,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;gBAC7B,MAAM,EAAE,2BAA2B,CAAC,OAAO,CAAC;aAC7C;SACF;QACD,MAAM,EAAE,qBAAqB,CAAC,OAAO,CAAC;QACtC,IAAI,EAAE,SAAS,CAAC,OAAO;KACxB,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,SAAwB;IACxD,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,WAAW,CAAC,SAAS,CAAC,CAAA;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC,CAAA;IACnF,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,aAA4B;IACzD,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CAAA;IACzC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAChD,MAAM,IAAI,uBAAuB,CAAC;YAChC,MAAM,EAAE,iDAAiD;SAC1D,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,sBAAsB,CAAC,UAI/B;IACC,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,UAAU,CAAA;IACxD,IAAI,aAAa,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAAC,CAAA;IACpF,CAAC;IACD,IAAI,CAAC,SAAS;QAAE,OAAM;IAEtB,IACE,CAAC,cAAc,CACb,aAAa,CAAC,OAAO,EACrB,gBAAgB,CAAC,SAAS,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CACjE,EACD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC,CAAA;IACvF,CAAC;IACD,IAAI,aAAa,CAAC,IAAI,KAAK,SAAS,CAAC,OAAO,EAAE,CAAC;QAC7C,MAAM,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC,CAAA;IACrF,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAChC,aAA4B,EAC5B,OAAwF;IAExF,wBAAwB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IACrC,IACE,aAAa,CAAC,MAAM;QACpB,2BAA2B,CAAC,wBAAwB,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,EAClF,CAAC;QACD,MAAM,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC,CAAA;IACnF,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAAC,aAA4B;IACvD,MAAM,CAAC,KAAK,CAAC,GAAG,aAAa,CAAC,MAAM,IAAI,EAAE,CAAA;IAC1C,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC,MAAM,EAAE,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,uBAAuB,CAAC;YAChC,MAAM,EAAE,uDAAuD;SAChE,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAAwB,EACxB,OAAwF;IAExF,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC,CAAA;IACrF,CAAC;IACD,IAAI,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC,CAAA;IACnF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,2BAA2B,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC,CAAA;IACnF,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAChC,MAAqD,EACrD,OAA4D;IAE5D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,uBAAuB,CAAC;YAChC,MAAM,EAAE,+DAA+D;SACxE,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;IAC/D,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IAClE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAE9B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC,CAAA;QACxF,CAAC;QACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QAClD,IAAI,QAAQ,KAAK,gBAAgB,IAAI,QAAQ,KAAK,wBAAwB,EAAE,CAAC;YAC3E,MAAM,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC,CAAA;QACxF,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC,CAAA;QACtF,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAElB,IAAI,KAAK,CAAC,UAAU,EAAE,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAE,EAAE,SAAS,CAAC,EAAE,CAAC;YACvF,MAAM,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC,CAAA;QACtF,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC,CAAA;IACvF,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC,CAAA;IAC/F,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CACjC,aAA4B,EAC5B,SAAkD;IAElD,MAAM,WAAW,GAAG,gBAAgB,CAAC,cAAc,CAAC,aAAa,CAAC,CAAA;IAClE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,iBAAiB,CAAC,cAAc,CAAC;YAC9C,OAAO,EAAE,WAAW;YACpB,SAAS;SACV,CAAC,CAAA;QACF,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;YACpF,MAAM,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC,CAAA;QACxF,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,uBAAuB;YAAE,MAAM,KAAK,CAAA;QACzD,MAAM,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC,CAAA;IACxF,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,IAAY;IACnD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,uBAAuB,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,qBAAqB,EAAE,CAAC,CAAA;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC,WAAW,EAAa,CAAA;AACvC,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAA;IACxC,OAAO,KAAK,CAAC,WAAW,EAAE,CAAA;AAC5B,CAAC"}

package/dist/tempo/subscription/Receipt.d.ts

@@ -0,0 +1,10 @@
+import type { SubscriptionRecord, SubscriptionReceipt } from './Types.js';
+/** Creates a subscription receipt from persisted subscription fields. */
+export declare function createSubscriptionReceipt(parameters: createSubscriptionReceipt.Parameters): SubscriptionReceipt;
+export declare namespace createSubscriptionReceipt {
+    /** Fields required to build a subscription receipt. */
+    type Parameters = Pick<SubscriptionRecord, 'externalId' | 'reference' | 'subscriptionId' | 'timestamp'>;
+}
+/** Converts a stored subscription record into a receipt. */
+export declare function fromRecord(record: SubscriptionRecord): SubscriptionReceipt;
+//# sourceMappingURL=Receipt.d.ts.map

package/dist/tempo/subscription/Receipt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Receipt.d.ts","sourceRoot":"","sources":["../../../src/tempo/subscription/Receipt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAEzE,yEAAyE;AACzE,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,yBAAyB,CAAC,UAAU,GAC/C,mBAAmB,CASrB;AAED,MAAM,CAAC,OAAO,WAAW,yBAAyB,CAAC;IACjD,uDAAuD;IACvD,KAAK,UAAU,GAAG,IAAI,CACpB,kBAAkB,EAClB,YAAY,GAAG,WAAW,GAAG,gBAAgB,GAAG,WAAW,CAC5D,CAAA;CACF;AAED,4DAA4D;AAC5D,wBAAgB,UAAU,CAAC,MAAM,EAAE,kBAAkB,GAAG,mBAAmB,CAE1E"}

package/dist/tempo/subscription/Receipt.js

@@ -0,0 +1,16 @@
+/** Creates a subscription receipt from persisted subscription fields. */
+export function createSubscriptionReceipt(parameters) {
+    return {
+        method: 'tempo',
+        reference: parameters.reference,
+        status: 'success',
+        subscriptionId: parameters.subscriptionId,
+        timestamp: parameters.timestamp,
+        ...(parameters.externalId ? { externalId: parameters.externalId } : {}),
+    };
+}
+/** Converts a stored subscription record into a receipt. */
+export function fromRecord(record) {
+    return createSubscriptionReceipt(record);
+}
+//# sourceMappingURL=Receipt.js.map

package/dist/tempo/subscription/Receipt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Receipt.js","sourceRoot":"","sources":["../../../src/tempo/subscription/Receipt.ts"],"names":[],"mappings":"AAEA,yEAAyE;AACzE,MAAM,UAAU,yBAAyB,CACvC,UAAgD;IAEhD,OAAO;QACL,MAAM,EAAE,OAAO;QACf,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,MAAM,EAAE,SAAS;QACjB,cAAc,EAAE,UAAU,CAAC,cAAc;QACzC,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxE,CAAA;AACH,CAAC;AAUD,4DAA4D;AAC5D,MAAM,UAAU,UAAU,CAAC,MAA0B;IACnD,OAAO,yBAAyB,CAAC,MAAM,CAAC,CAAA;AAC1C,CAAC"}

package/dist/tempo/subscription/Store.d.ts

@@ -0,0 +1,99 @@
+import * as Store from '../../Store.js';
+import type { SubscriptionAccessKeyRecord, SubscriptionRecord } from './Types.js';
+/** Subscription-aware wrapper around a generic key-value store. */
+export type SubscriptionStore = {
+    /** Runs activation once for a challenge and resolved lookup key. */
+    activate<result extends {
+        subscription: SubscriptionRecord;
+    }>(parameters: ActivateParameters<result>): Promise<ActivateResult<result>>;
+    /** Looks up a subscription by subscription ID. */
+    get(subscriptionId: string): Promise<SubscriptionRecord | null>;
+    /** Looks up a generated access key for a resolved request key. */
+    getAccessKey(key: string): Promise<SubscriptionAccessKeyRecord | null>;
+    /** Looks up the active subscription for a resolved request key. */
+    getByKey(key: string): Promise<SubscriptionRecord | null>;
+    /** Gets or creates the server-owned access key for a resolved request key. */
+    getOrCreateAccessKey(key: string): Promise<SubscriptionAccessKeyRecord>;
+    /** Upserts a subscription record and marks it as active for its lookup key. */
+    put(record: SubscriptionRecord): Promise<void>;
+    /** Runs renewal once for a subscription period. */
+    renew<result extends {
+        subscription: SubscriptionRecord;
+    }>(parameters: RenewParameters<result>): Promise<RenewResult<result>>;
+};
+type ActivateParameters<result extends {
+    subscription: SubscriptionRecord;
+}> = {
+    challengeId: string;
+    create: () => Promise<result>;
+    isReusable?: ((subscription: SubscriptionRecord) => boolean) | undefined;
+    lookupKey: string;
+};
+export type ActivateResult<result extends {
+    subscription: SubscriptionRecord;
+}> = {
+    status: 'activated';
+    result: result;
+} | {
+    status: 'claimMismatch';
+} | {
+    status: 'existing';
+    subscription: SubscriptionRecord;
+} | {
+    status: 'inFlight';
+} | {
+    status: 'replayed';
+};
+type RenewParameters<result extends {
+    subscription: SubscriptionRecord;
+}> = {
+    inFlightReference: string;
+    periodIndex: number;
+    renew: (parameters: {
+        inFlightReference: string;
+        periodIndex: number;
+        subscription: SubscriptionRecord;
+    }) => Promise<result>;
+    subscriptionId: string;
+};
+export type RenewResult<result extends {
+    subscription: SubscriptionRecord;
+}> = {
+    status: 'charged';
+    subscription: SubscriptionRecord;
+} | {
+    status: 'inFlight';
+    subscription: SubscriptionRecord;
+} | {
+    status: 'missing';
+} | {
+    status: 'renewed';
+    result: result;
+} | {
+    status: 'superseded';
+    subscription: SubscriptionRecord;
+} | {
+    status: 'claimMismatch';
+};
+/** Wraps a generic key-value {@link Store.Store} with subscription-specific accessors. */
+export declare function fromStore(store: Store.AtomicStore<Record<string, unknown>>, options?: fromStore.Options): SubscriptionStore;
+export declare namespace fromStore {
+    type Options = {
+        /** Key prefix for server-owned subscription access keys. @default `'tempo:subscription:access-key:'` */
+        accessKeyPrefix?: string | undefined;
+        /** Key prefix for resolved subscription activation locks. @default `'tempo:subscription:activation:'` */
+        activationPrefix?: string | undefined;
+        /** Milliseconds before a stuck activation lock can be replaced. @default `900000` */
+        activationTimeoutMs?: number | undefined;
+        /** Key prefix for single-use activation credential markers. @default `'tempo:subscription:credential:'` */
+        credentialPrefix?: string | undefined;
+        /** Key prefix for subscription records. @default `'tempo:subscription:record:'` */
+        recordPrefix?: string | undefined;
+        /** Milliseconds before a stuck renewal lock can be replaced. @default `900000` */
+        renewalTimeoutMs?: number | undefined;
+        /** Key prefix for resolved request keys. @default `'tempo:subscription:key:'` */
+        keyPrefix?: string | undefined;
+    };
+}
+export {};
+//# sourceMappingURL=Store.d.ts.map

package/dist/tempo/subscription/Store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Store.d.ts","sourceRoot":"","sources":["../../../src/tempo/subscription/Store.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,KAAK,MAAM,gBAAgB,CAAA;AACvC,OAAO,KAAK,EAAE,2BAA2B,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAUjF,mEAAmE;AACnE,MAAM,MAAM,iBAAiB,GAAG;IAC9B,oEAAoE;IACpE,QAAQ,CAAC,MAAM,SAAS;QAAE,YAAY,EAAE,kBAAkB,CAAA;KAAE,EAC1D,UAAU,EAAE,kBAAkB,CAAC,MAAM,CAAC,GACrC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAA;IAClC,kDAAkD;IAClD,GAAG,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAA;IAC/D,kEAAkE;IAClE,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,GAAG,IAAI,CAAC,CAAA;IACtE,mEAAmE;IACnE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAA;IACzD,8EAA8E;IAC9E,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAA;IACvE,+EAA+E;IAC/E,GAAG,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9C,mDAAmD;IACnD,KAAK,CAAC,MAAM,SAAS;QAAE,YAAY,EAAE,kBAAkB,CAAA;KAAE,EACvD,UAAU,EAAE,eAAe,CAAC,MAAM,CAAC,GAClC,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAA;CAChC,CAAA;AAED,KAAK,kBAAkB,CAAC,MAAM,SAAS;IAAE,YAAY,EAAE,kBAAkB,CAAA;CAAE,IAAI;IAC7E,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;IAC7B,UAAU,CAAC,EAAE,CAAC,CAAC,YAAY,EAAE,kBAAkB,KAAK,OAAO,CAAC,GAAG,SAAS,CAAA;IACxE,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,cAAc,CAAC,MAAM,SAAS;IAAE,YAAY,EAAE,kBAAkB,CAAA;CAAE,IAC1E;IAAE,MAAM,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,MAAM,EAAE,eAAe,CAAA;CAAE,GAC3B;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,YAAY,EAAE,kBAAkB,CAAA;CAAE,GACxD;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,GACtB;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,CAAA;AAE1B,KAAK,eAAe,CAAC,MAAM,SAAS;IAAE,YAAY,EAAE,kBAAkB,CAAA;CAAE,IAAI;IAC1E,iBAAiB,EAAE,MAAM,CAAA;IACzB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,CAAC,UAAU,EAAE;QAClB,iBAAiB,EAAE,MAAM,CAAA;QACzB,WAAW,EAAE,MAAM,CAAA;QACnB,YAAY,EAAE,kBAAkB,CAAA;KACjC,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IACrB,cAAc,EAAE,MAAM,CAAA;CACvB,CAAA;AAED,MAAM,MAAM,WAAW,CAAC,MAAM,SAAS;IAAE,YAAY,EAAE,kBAAkB,CAAA;CAAE,IACvE;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,YAAY,EAAE,kBAAkB,CAAA;CAAE,GACvD;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,YAAY,EAAE,kBAAkB,CAAA;CAAE,GACxD;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GACrB;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,YAAY,EAAE,kBAAkB,CAAA;CAAE,GAC1D;IAAE,MAAM,EAAE,eAAe,CAAA;CAAE,CAAA;AAQ/B,0FAA0F;AAC1F,wBAAgB,SAAS,CACvB,KAAK,EAAE,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACjD,OAAO,CAAC,EAAE,SAAS,CAAC,OAAO,GAC1B,iBAAiB,CA8SnB;AAED,MAAM,CAAC,OAAO,WAAW,SAAS,CAAC;IACjC,KAAK,OAAO,GAAG;QACb,wGAAwG;QACxG,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACpC,yGAAyG;QACzG,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACrC,qFAAqF;QACrF,mBAAmB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACxC,2GAA2G;QAC3G,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACrC,mFAAmF;QACnF,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACjC,kFAAkF;QAClF,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACrC,iFAAiF;QACjF,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAC/B,CAAA;CACF"}