sporades 0.9.1 → 0.9.2

package/CHANGES.md

@@ -1,10 +1,64 @@
 # Changes
 
+- Expose the verified provider-free Team Billing projection to active Capsule
+  query and mutation contexts and to exact-Team Join admission. Current members
+  may be authorized for safe reads while all customer-directed commands remain
+  current-Team-admin operations; retained context handles are revoked.
+- Add an offline `sporades/server/team-billing-import` seam for exact,
+  provider-free import of verified legacy Subscription snapshots and replay
+  guards. Incomplete or conflicting evidence fails closed, including drift in
+  durable Event ordering, terminal-latch safety fields, and contradictory
+  Subscription Event/state tuples. The public adapter type now declares the
+  complete named-dialect, execution, prepared-statement, and transaction seam.
+
 ## Unreleased - 2026-08-24
 
 Changes since v0.9.0.
 
-No changes detected.
+### 🚀 Features
+
+- Expose verified billing state to capsule policy (946f0736).
+- Add safe legacy Team Billing import seam (dab78ad9).
+- Add provider-safe Team Billing erasure (9d334c0c).
+- Add managed Team Billing convergence (ebdfd265).
+- Add explicitly configured Team Customer Portal (760e5c4d).
+- Add durable headless Team Checkout (4738b0fb).
+- Add headless Team Billing foundation (57670d13).
+- Add atomic Stripe consequence handling (04274543).
+
+### 🐛 Bug Fixes
+
+- Prove Stripe test Team Billing lifecycle (2aedbbcb).
+- Fix packed blank Capsule typechecking (1662dd27).
+- Prevent Stripe retention repair starvation (671f9537).
+
+### 📝 Documentation
+
+- Clarify private Team billing retention (8db4f2f8).
+- Expose safe Team billing quarantine inspection (0dd71f85).
+- Harden Team billing evidence validation (7b91b311).
+- Converge verified Team billing state atomically (f962d06c).
+- Document unrepresentable Stripe retention (27a852f1).
+- Prove Stripe contention across runtimes (1ed35c38).
+- Preserve cancellation and exact Stripe retention (c8591c52).
+- Defer atomic Stripe fence contention durably (47e93072).
+- Expose Team counts to atomic Stripe consequences (9f43dbe7).
+- Periodically recheck Stripe retention repairs (9e5908e8).
+- Recover classified Stripe retention repairs (f6c853f9).
+- Harden Stripe payload retention cleanup (0b163187).
+- Bound Stripe Event Job payload retention (cf2cf6eb).
+- Harden atomic Stripe consequence recovery (92b55f5d).
+
+### 🧪 Tests
+
+- Preserve Team Portal capability across transient reads (7ffba828).
+- Revalidate Team Portal authority at every seam (fcb4380e).
+- Reconcile Checkout state after final lease expiry (c51ab5f7).
+- Terminally settle exhausted Team Checkout retries (6fcb803f).
+- Serialize Team Billing authority with Team lifecycle (987a4750).
+- Validate Team Billing projection semantics (e7f05b20).
+- Fail closed on Team Billing correlation drift (003e24af).
+- Classify near-ceiling Stripe settlement (92cba517).
 
 ## 0.8.5 - 2026-08-15
 
@@ -42,4 +96,3 @@ generated artifacts, and documentation.
   not select a current Team or automatically partition Capsule data; Sporades
   never sends Join-link email. See the [Built-in Teams reference](https://mgscox.github.io/sporades/reference/teams).
 
-

package/README.md

@@ -58,7 +58,32 @@ sporades host push --restart
   email-bound Join links, membership application roles, and explicit Team ACL
   decisions—without a hidden current Team or automatic data partitioning.
   Trusted `teams.admitJoin` policies may make atomic seat decisions from
-  read-only app state hidden by the joining user's ordinary row ACLs.
+  read-only app state hidden by the joining user's ordinary row ACLs and the
+  exact Team's provider-free verified billing projection.
+- **Headless Team Billing, app-rendered**: an optional `teamBilling` declaration
+  binds stable product keys to exact sandbox/live Stripe Prices and a fixed or
+  accepted-Team-member quantity policy. Sporades rechecks current Team-admin
+  authority plus the Capsule's transaction-bound policy on every operation and
+  exposes the closed, provider-free `teamBilling.get(teamId)` projection plus
+  durable `teamBilling.startCheckout(...)`, `teamBilling.openPortal(...)`, and
+  `teamBilling.requestPlanTransition(...)`. Portal owns compatible same-policy
+  switches; Sporades manages fixed-to-Team-counted transitions and keeps a
+  Team-counted Subscription converged after membership commits.
+  `teamBilling.prepareErasure(...)` durably expires or safely resolves every
+  issued Checkout and immediately cancels known or newly discovered live
+  Subscriptions before a transaction-bound server admission permits the app's
+  separate local deletion. Provider-free identity tombstones reject late
+  entitlement recreation; the Stripe Customer is not deleted.
+  Those commands may return only validated, short-lived Stripe-hosted URL
+  capabilities. Verified Checkout, Subscription, and failed-invoice evidence
+  converges through runtime-owned semantic ratchets and terminal latches;
+  malformed or ambiguous evidence fails closed without exposing provider
+  identifiers. The Capsule owns every component, route, message, and
+  entitlement decision.
+  Offline migration tools can import complete verified legacy snapshots and
+  provider-free replay guards through `sporades/server/team-billing-import`;
+  the seam performs no provider I/O and rejects incomplete or changed tuples,
+  including corrupted durable Event ordering or terminal-latch state.
 - **Realtime everything**: configuration free - automatic notifications, even for Postgress and AWS-S3
 
 ## Documentation
@@ -68,7 +93,8 @@ sporades host push --restart
 - [Feature reference](https://mgscox.github.io/sporades/guide/reference): exhaustive contracts and
   command lookup, split into focused topic pages.
 - [Built-in Teams](https://mgscox.github.io/sporades/reference/teams): collaboration model, Join
-  links, application roles, and explicit Team ACL decisions.
+  links, application roles, explicit Team ACL decisions, and the headless Team
+  Billing declaration and safe projection.
 - [Access-key server and operator reference](https://mgscox.github.io/sporades/reference/server-runtime#gate-handlers-with-requireauth):
   scoped Bearer admission, user-owned lifecycle, Credential provenance, and
   the bounded operator CLI.
@@ -169,9 +195,19 @@ Sporades currently includes:
   retries converge and no Capsule billing state changes automatically. The Job
   delivers one Verified Stripe event to the blank Capsule's single
   `stripeEvents: stripeEvent(...)` policy seam under the userless Privileged
-  audit lifecycle. Generated policy ignores unknown events and tells authors to
+  audit lifecycle. Capsules that need one serialized, all-or-nothing database
+  consequence can opt into `stripeEvent({ consequence: "atomic" }, handler)`;
+  the legacy declaration remains available for cooperative long-lived handlers.
+  Generated policy ignores unknown events and tells authors to
   make deliberate consequences idempotent and order-independent, reject stale
   later-arriving observations, and avoid logging or retaining raw provider data.
+  A successful reserved Stripe Event Job retains its verified payload for 30
+  days, then bounded runtime cleanup leaves only the digest-backed terminal
+  replay tombstone. Unresolved deliveries retain their retry/repair payload;
+  this includes legacy successes with absent or malformed completion timestamps,
+  plus canonical near-ceiling settlements whose exact deadline is
+  unrepresentable. Safe operator inspection distinguishes those cases without
+  exposing provider data.
   The catalogue owns each Price mode; browser input owns neither mode nor Stripe
   identity. Existing and non-blank Capsules remain unchanged.
 - Local Dev sessions with rebuilds, WebSocket reconnects, SQLite persistence,

package/bin/sporades-host-helper.js

@@ -177,8 +177,24 @@ var ACCESS_KEY_CLIENT_ADDRESS_HEADER = "x-sporades-client-address";
 // src/access-keys-runtime.ts
 var UNKNOWN_ACCESS_KEY_DIGEST = Buffer.from("4f7c77f7b9231094754542ed50fdfd62a2cf24a5e961b61f899b85b6fe33c72b", "hex");
 
+// src/team-billing-management.ts
+var CLAIM_TTL_MS = 5 * 60 * 1e3;
+
+// src/team-billing-convergence.ts
+var RANK = Object.freeze({ active: 20, cancelling: 30, "past-due": 40, cancelled: 50 });
+
+// src/team-billing-runtime.ts
+var CHECKOUT_CONTINUATION_TTL_DEFAULT_SECONDS = 10 * 60;
+var CHECKOUT_CONTINUATION_TTL_MAX_SECONDS = 30 * 60;
+
+// src/team-billing-erasure.ts
+var CLAIM_TTL_MS2 = 5 * 6e4;
+
 // src/jobs-runtime.ts
 var nodeCryptoModule = process.getBuiltinModule("node:crypto");
+var STRIPE_EVENT_PAYLOAD_RETENTION_MS = 30 * 24 * 60 * 60 * 1e3;
+var REDACTED_STRIPE_EVENT_PAYLOAD = JSON.stringify({ kind: "stripe-event", retained: false });
+var STRIPE_EVENT_PAYLOAD_SENTINEL_RECHECK_MS = 24 * 60 * 60 * 1e3;
 var JOB_AUTH_SNAPSHOT_MAX_BYTES = 8 * 1024;
 var MAX_JOB_TIMESTAMP_MS = Date.parse("9999-12-31T23:59:59.999Z");
 var MIN_JOB_TIMESTAMP_MS = Date.parse("0000-01-01T00:00:00.000Z");
@@ -440,6 +456,8 @@ var transactionBeforeCommitChecks2 = Symbol.for("sporades.database.transactionBe
 // src/server-runtime-source.ts
 var trustedReadTransactionAdapter = Symbol("sporades.trustedReadTransactionAdapter");
 var runtimeOwnedJobEnqueueHandler = Symbol("sporades.runtimeOwnedJobEnqueueHandler");
+var atomicStripeEventDefinitionBrand = Symbol.for("sporades.stripeEvent.atomicDefinition");
+var atomicStripeFenceContention = Symbol("sporades.atomicStripeFenceContention");
 function logPayloadMaxBytes(config = {}) {
   const configured = Number(config.logs?.payloadMaxBytes ?? config.logging?.payloadMaxBytes);
   return Number.isInteger(configured) && configured > 0 ? configured : 4096;
@@ -595,7 +613,7 @@ function writeEnvelope(result, failed = false) {
 }
 
 // src/cli/cli-version.ts
-var CLI_VERSION = "0.9.1";
+var CLI_VERSION = "0.9.2";
 
 // src/cli/schedule-inspection-envelope.ts
 var SCHEDULE_DIAGNOSTIC_FIELDS = /* @__PURE__ */ new Set([