sporades 0.8.6 → 0.9.0

package/CHANGES.md

@@ -1,103 +1,116 @@
 # Changes
 
-## Unreleased - 2026-08-17
+## Unreleased - 2026-08-21
 
-Changes since v0.8.5.
+Changes since v0.8.7.
 
 ### 🚀 Features
 
-- Migrate additive unique constraints atomically (2cf8381).
-- Add conflict-targeted idempotent table inserts (bd2aeaa).
-- Expose privileged Team inspections (16d784a).
-- Declare unique Capsule table constraints (f638b36).
-- Expose exact Team membership counts (6893db7).
+- Allow token-shaped Access-key metadata (7211528).
+- Implement verified Stripe event policy delivery (7a68cbe).
+- Implement signed Stripe callback admission (8721c85).
+- Add access key operator controls (08161a6).
+- Add durable Stripe Customer Portal sessions (8a3a604).
+- Preserve access key provenance in jobs (9d1cd62).
+- Add scoped access key file reads (a1033cf).
+- Add browser access key management (7859ecd).
+- Complete owner access key lifecycle (d9c72ab).
+- Implement durable one-time Stripe Checkout (79da915).
+- Add user-owned scoped access keys (2ede8b3).
+- Add declarative session auth admission (a62c566).
+- Preserve exact endpoint body bytes (0968c99).
 
 ### 🐛 Bug Fixes
 
-- Shut down rejected runtime candidates (5ec8198).
-- Preserve candidate on activation degradation (302268c).
-- Activate replacement jobs after teardown (ee4db9f).
-- Serialize job lease recovery (09dca55).
-- Refresh job leases after dev handoff (5961f77).
-- Recover jobs across runtime handoff (6d2b344).
-- Gate jobs on successful runtime initialization (3082aad).
-- Validate all schedule cursors (bf3dea0).
-- Arm schedule recovery after commit (da43e54).
-- Persist schedule upgrade lineage (54d664e).
-- Close schedule handoff and root reentry races (281029a).
-- Serialize legacy schedule upgrades (9e87fb1).
-- Publish schedule incarnations atomically (78da563).
-- Make schedule generations authoritative (9005b1e).
-- Bind schedules to declaration generations (b478ae7).
-- Make schedule claims transactional (960f2c6).
-- Seal retained job and libsql lifecycle (c5dc235).
-- Recover future leases and schedules safely (fa08688).
-- Bound job lifecycle time domains (89149c7).
-- Close pre-handler job shutdown races (ffdca81).
-- Make runtime shutdown failure atomic (1958f3b).
-- Harden transactional lifecycle cleanup (e408f2d).
-- Defer transactional job cancellation (2d3cf3e).
-- Linearize team reads and job claims (1aa5391).
-- Wake retained jobs on startup (0a66d61).
-- Settle transactional log writes (43e1b2b).
-- Revoke settled transaction adapters (bef9821).
-- Abort jobs through the root runtime (5a43040).
-- Settle jobs before lifecycle shutdown (51d1d9d).
-- Settle job shutdown safely (9d38300).
-- Await runtime closure during shutdown (ff688f1).
-- Settle scheduled Jobs before runtime shutdown (7e7204e).
-- Scope unique migration error translation (9af3b24).
-- Preserve non-unique migration errors (2cfb207).
-- Fix chained transaction release and async insert type (386ea84).
-- Fix async insertOrIgnore documentation (a41f2ac).
-- Guard privileged join-link reads (dea4ebc).
-- Close privileged Team inspection races (d53136c).
-- Redact privileged Team join metadata (ad77482).
-- Defer existing table unique changes (e49477d).
-
-### 🔧 Improvements
-
-- Ignore Macos fluff files (d4ae934).
+- Fix Stripe callback and Vanilla policy gaps (6b5792f).
+- Bound hosted inspection diagnostics (84977d0).
+- Preserve bounded host inspection failures (5ff9e59).
+- Bind privileged key work to run lifetime (1c201e4).
+- Close operator audit and output gaps (16669ee).
+- Harden access key operator boundaries (a8a6e99).
+- Reject malformed schedule provenance (04d5528).
+- Bind scheduled jobs to privileged actors (f0945a8).
+- Validate scheduled job actor provenance (5f984a4).
+- Harden durable job provenance (5023593).
+- Redact file scope denial provenance (9947213).
+- Correlate access key response loss (a9ed599).
+- Recover access key management failures (e3d42d1).
+- Require sessions for owner security changes (79e99ae).
+- Close first-key transition races (90472d8).
+- Serialize access key owner transitions (effce34).
+- Privatize access key runtime state (f091dd8).
+- Preserve middleware access key state (8d27903).
+- Isolate lifecycle audit delivery (ebc095a).
+- Commit access key lifecycle audits (e6b0a6d).
+- Preserve access key provenance (4f87ed6).
+- Isolate access key admission (48fe0a5).
+- Preserve guarded handler type safety (9496593).
+- Harden declarative auth admission (1d35da1).
 
 ### 📝 Documentation
 
-- Pin final platform contract evidence (65250af).
-- Align platform contracts after swarm amendments (8f64c4f).
-- Record swarm cleanup (7233572).
-- Close combined platform contract swarm (a1862c8).
-- Record final combined contract package proof (4c44bf8).
-- Record combined contract proof evidence (ac1c48c).
-- Record accepted unique migration contract (6c5e484).
-- Record accepted idempotent insert contract (19e7b63).
-- Align shipped Job lifecycle reference (9b7820f).
-- Document atomic Job enqueue lifecycle (9dbeb8a).
-- Reject nested database transaction scopes (3cc98b6).
-- Record accepted platform contract tickets (6ef6d1c).
-- Close unique constraint contract gaps (20baabb).
-- Prove unique constraint boundaries across adapters (f6d3517).
-- Cover immutable unique schema boundary (4fb81d9).
-- Initialize platform contracts swarm ledger (61816a1).
-- Add Team subscription platform tickets (494a086).
+- Preserve legacy auth profiles in job provenance (549542e).
+- Revalidate owner Sessions and trust Cloudflare clients (ca43887).
+- Keep Stripe event idempotency stable across renames (a86758e).
+- Normalize access key report metadata (95bec68).
+- Fix access key endpoint examples (d3098bd).
+- Publish scoped access key guide (0cf7f8e).
+- Define completed ticket state (b4c4dc8).
+- Normalize access key ticket evidence (491a042).
+- Record access key adapter identities (14277b7).
+- Correct access key proof attribution (a8eadaa).
+- Record access key release completion (779256b).
+- Prove and pack the built-in Stripe payment contract (655e656).
+- Publish access key authority contract (b6efd20).
+- Close access key operator ticket (27877d5).
+- Close durable job provenance ticket (14bcd01).
+- Close access key file reads ticket (7a94f2a).
+- Close browser access key management ticket (42a8520).
+- Extend Stripe Checkout to subscriptions (8d1c72c).
+- Close access key lifecycle ticket (6f06be7).
+- Close scoped access key tracer (c041fa8).
+- Close auth admission ticket (75c817f).
+- Build dormant blank Capsule Stripe foundation (6c0e683).
+- Specify user-owned scoped access keys (8325d69).
 
 ### 🧪 Tests
 
-- Reset native schedule clock before init (1153643).
-- Prove atomic Team Job enqueue failures (09265ab).
-- Preserve PostgreSQL quoting recorder transactions (85d2266).
-- Cover unrelated rebuild constraint failures (4605ec5).
-- Isolate Node 24 SQLite server tests (8542eb9).
-- Harden failed mutation cleanup (d43a5ab).
-- Bound transaction handler context lifetime (67dccb4).
-- Defer runtime Job dispatch until commit (0a04afb).
-- Persist Jobs inside handler transactions (b59004f).
-- Reject captured transaction reentry and drop rolled-back jobs (952309e).
-- Replace async-local transaction ownership (95cbb85).
-- Gate transaction connections and track mutation writes (20cda07).
-- Serialize shared database connection transactions (425e4f0).
-- Isolate composite unique conformance (75ace57).
-- Cover Team count membership lifecycle (80d6cd7).
-- Accept cross-realm query arrays (55b87a6).
-- Reject query argument array subclasses (2171b61).
+- Revalidate linked Access-key owners (751ee7f).
+- Bound escaped Access-key operator envelopes (099a5a1).
+- Revalidate Sessions during Access-key rotation (79d3e6c).
+- Make Privileged Access-key writes audit-atomic (1737023).
+- Timestamp Access-key revocation after locking (3b70301).
+- Preserve valid Schedule diagnostic names (a002b25).
+- Close Access-key authority and issuance races (f118728).
+- Recheck Access-key expiry inside rotation locks (70d4c0c).
+- Enforce no-store after endpoint header merging (bf50484).
+- Bind File Access-key tests to live Sessions (7e63a82).
+- Require live Session authority for Access-key management (155f154).
+- Revalidate Sessions during Access-key issuance (3a9288e).
+- Harden Access-key operator and Hosted limits (0d5f10c).
+- Make Access-key operator audits atomic (3e972ac).
+- Verify acceptance container cleanup (82ac350).
+- Gate raw container cleanup fallback (235ac72).
+- Bind acceptance cleanup to container id (0dff342).
+- Report suite failures before missing proof (27d8f62).
+- Reconcile JUnit suite outcomes (a19bb41).
+- Recognize required JUnit suites (1dace92).
+- Tokenize junit cases once (1951edd).
+- Prove admitted jobs survive key retirement (717da14).
+- Harden Stripe Checkout authority boundaries (c94fc74).
+
+### 📦 Packaging
+
+- Separate documentation validation from full suite (3863ac1).
+- Harden release acceptance cleanup (b431ab4).
+- Keep release failures opaque (9041772).
+- Report bounded release failure details (b869c92).
+- Report release suite failures (5dea6d8).
+- Reconcile release junit evidence (2f9f8fe).
+- Fail closed on release evidence (6f5b0a7).
+- Require access key release evidence (ddd3b47).
+- Close access key release proof gaps (62cc34b).
+- Prove access key release contract (c29c725).
 
 ## 0.8.5 - 2026-08-15
 

package/README.md

@@ -51,9 +51,14 @@ sporades host push --restart
   logs, database inspection, and non-interactive commands are first-class.
 - **Comprehensive SDK**: built-in authentication, database, user preferences,
   and storage.
+- **Named automation without fake users**: linked users can issue scoped Access
+  keys for API clients while Capsule code retains the real owner in `ctx.auth`
+  and distinguishes named API access through `ctx.credential`.
 - **Built-in collaboration, explicitly authorized**: runtime-owned Teams,
   email-bound Join links, membership application roles, and explicit Team ACL
   decisions—without a hidden current Team or automatic data partitioning.
+  Trusted `teams.admitJoin` policies may make atomic seat decisions from
+  read-only app state hidden by the joining user's ordinary row ACLs.
 - **Realtime everything**: configuration free - automatic notifications, even for Postgress and AWS-S3
 
 ## Documentation
@@ -64,6 +69,9 @@ sporades host push --restart
   command lookup, split into focused topic pages.
 - [Built-in Teams](https://mgscox.github.io/sporades/reference/teams): collaboration model, Join
   links, application roles, and explicit Team ACL decisions.
+- [Access-key server and operator reference](https://mgscox.github.io/sporades/reference/server-runtime#gate-handlers-with-requireauth):
+  scoped Bearer admission, user-owned lifecycle, Credential provenance, and
+  the bounded operator CLI.
 - [LLM documentation manifest](https://mgscox.github.io/sporades/llms.txt): release-matched Markdown
   sources for agents and other documentation tools.
 - [Architecture](https://mgscox.github.io/sporades/architecture): platform model, runtime modes, Host
@@ -144,6 +152,28 @@ Sporades currently includes:
 - Inferno scaffolds across the complete template set, using native class-component
   lifecycle and classic Inferno JSX without React compatibility packages. esbuild
   remains the default; Vite is available explicitly with full-page Dev refresh.
+- Every new blank Capsule includes a built-in but disabled Stripe payment
+  foundation: server-owned wiring, named Checkout and Customer Portal Jobs, shared Job state, an
+  empty Price catalogue, and no credentials, payment UI, active callback route, or
+  browser Stripe SDK. Complete activation supports an authorized, idempotent
+  one-time or recurring subscription Checkout through the same durable Job,
+  actor-scoped progress, safe retries, and validated Stripe-hosted redirects.
+  Portal remains linked-user-only: Capsule policy authorizes an opaque billing
+  holder and resolves its existing Customer before enqueue, then the Job repeats
+  both checks before provider access so revocation fails safely. No Customer
+  identity is stored in the Capsule intent or Job payload. It is the preferred
+  surface for ordinary customer-managed payment methods, invoices,
+  cancellations, and supported subscription changes. Complete activation also
+  registers one collision-checked callback path. Signed exact bytes are admitted
+  into one idempotent Privileged Job per Stripe Event before acknowledgment;
+  retries converge and no Capsule billing state changes automatically. The Job
+  delivers one Verified Stripe event to the blank Capsule's single
+  `stripeEvents: stripeEvent(...)` policy seam under the userless Privileged
+  audit lifecycle. Generated policy ignores unknown events and tells authors to
+  make deliberate consequences idempotent and order-independent, reject stale
+  later-arriving observations, and avoid logging or retaining raw provider data.
+  The catalogue owns each Price mode; browser input owns neither mode nor Stripe
+  identity. Existing and non-blank Capsules remain unchanged.
 - Local Dev sessions with rebuilds, WebSocket reconnects, SQLite persistence,
   logs, database inspection, auth helpers, and file storage. Every admitted
   esbuild/Vite pair uses the same acknowledged Sporades full-page refresh
@@ -154,6 +184,9 @@ Sporades currently includes:
 - Runtime-owned auth with anonymous sessions, email auth, Google OAuth,
   Microsoft OpenID Connect, Sign in with Apple, Facebook Login, and
   local identity simulation for tests and agents.
+- User-owned named Access keys with Capsule-declared scopes, explicit Custom
+  endpoint and private-File opt-in, one-time secret disclosure, Session-only
+  owner management, durable Job provenance, and audited operator retirement.
 - Runtime-owned current-user preferences exposed through `sporades/client`
   without app preference tables. Preferences follow the Sporades user identity,
   survive Anonymous account linking, and notify same-user connected clients when