sporades 0.9.1 → 0.9.3

package/CHANGES.md

@@ -1,10 +1,23 @@
 # Changes
 
-## Unreleased - 2026-08-24
+- Expose the verified provider-free Team Billing projection to active Capsule
+  query and mutation contexts and to exact-Team Join admission. Current members
+  may be authorized for safe reads while all customer-directed commands remain
+  current-Team-admin operations; retained context handles are revoked.
+- Add an offline `sporades/server/team-billing-import` seam for exact,
+  provider-free import of verified legacy Subscription snapshots and replay
+  guards. Incomplete or conflicting evidence fails closed, including drift in
+  durable Event ordering, terminal-latch safety fields, and contradictory
+  Subscription Event/state tuples. The public adapter type now declares the
+  complete named-dialect, execution, prepared-statement, and transaction seam.
 
-Changes since v0.9.0.
+## Unreleased - 2026-08-25
 
-No changes detected.
+Changes since v0.9.2.
+
+### 🐛 Bug Fixes
+
+- Wait for hosted capsule readiness (81c23604).
 
 ## 0.8.5 - 2026-08-15
 

package/README.md

@@ -58,7 +58,32 @@ sporades host push --restart
   email-bound Join links, membership application roles, and explicit Team ACL
   decisions—without a hidden current Team or automatic data partitioning.
   Trusted `teams.admitJoin` policies may make atomic seat decisions from
-  read-only app state hidden by the joining user's ordinary row ACLs.
+  read-only app state hidden by the joining user's ordinary row ACLs and the
+  exact Team's provider-free verified billing projection.
+- **Headless Team Billing, app-rendered**: an optional `teamBilling` declaration
+  binds stable product keys to exact sandbox/live Stripe Prices and a fixed or
+  accepted-Team-member quantity policy. Sporades rechecks current Team-admin
+  authority plus the Capsule's transaction-bound policy on every operation and
+  exposes the closed, provider-free `teamBilling.get(teamId)` projection plus
+  durable `teamBilling.startCheckout(...)`, `teamBilling.openPortal(...)`, and
+  `teamBilling.requestPlanTransition(...)`. Portal owns compatible same-policy
+  switches; Sporades manages fixed-to-Team-counted transitions and keeps a
+  Team-counted Subscription converged after membership commits.
+  `teamBilling.prepareErasure(...)` durably expires or safely resolves every
+  issued Checkout and immediately cancels known or newly discovered live
+  Subscriptions before a transaction-bound server admission permits the app's
+  separate local deletion. Provider-free identity tombstones reject late
+  entitlement recreation; the Stripe Customer is not deleted.
+  Those commands may return only validated, short-lived Stripe-hosted URL
+  capabilities. Verified Checkout, Subscription, and failed-invoice evidence
+  converges through runtime-owned semantic ratchets and terminal latches;
+  malformed or ambiguous evidence fails closed without exposing provider
+  identifiers. The Capsule owns every component, route, message, and
+  entitlement decision.
+  Offline migration tools can import complete verified legacy snapshots and
+  provider-free replay guards through `sporades/server/team-billing-import`;
+  the seam performs no provider I/O and rejects incomplete or changed tuples,
+  including corrupted durable Event ordering or terminal-latch state.
 - **Realtime everything**: configuration free - automatic notifications, even for Postgress and AWS-S3
 
 ## Documentation
@@ -68,7 +93,8 @@ sporades host push --restart
 - [Feature reference](https://mgscox.github.io/sporades/guide/reference): exhaustive contracts and
   command lookup, split into focused topic pages.
 - [Built-in Teams](https://mgscox.github.io/sporades/reference/teams): collaboration model, Join
-  links, application roles, and explicit Team ACL decisions.
+  links, application roles, explicit Team ACL decisions, and the headless Team
+  Billing declaration and safe projection.
 - [Access-key server and operator reference](https://mgscox.github.io/sporades/reference/server-runtime#gate-handlers-with-requireauth):
   scoped Bearer admission, user-owned lifecycle, Credential provenance, and
   the bounded operator CLI.
@@ -169,9 +195,19 @@ Sporades currently includes:
   retries converge and no Capsule billing state changes automatically. The Job
   delivers one Verified Stripe event to the blank Capsule's single
   `stripeEvents: stripeEvent(...)` policy seam under the userless Privileged
-  audit lifecycle. Generated policy ignores unknown events and tells authors to
+  audit lifecycle. Capsules that need one serialized, all-or-nothing database
+  consequence can opt into `stripeEvent({ consequence: "atomic" }, handler)`;
+  the legacy declaration remains available for cooperative long-lived handlers.
+  Generated policy ignores unknown events and tells authors to
   make deliberate consequences idempotent and order-independent, reject stale
   later-arriving observations, and avoid logging or retaining raw provider data.
+  A successful reserved Stripe Event Job retains its verified payload for 30
+  days, then bounded runtime cleanup leaves only the digest-backed terminal
+  replay tombstone. Unresolved deliveries retain their retry/repair payload;
+  this includes legacy successes with absent or malformed completion timestamps,
+  plus canonical near-ceiling settlements whose exact deadline is
+  unrepresentable. Safe operator inspection distinguishes those cases without
+  exposing provider data.
   The catalogue owns each Price mode; browser input owns neither mode nor Stripe
   identity. Existing and non-blank Capsules remain unchanged.
 - Local Dev sessions with rebuilds, WebSocket reconnects, SQLite persistence,

package/bin/sporades-host-helper.js

@@ -177,8 +177,24 @@ var ACCESS_KEY_CLIENT_ADDRESS_HEADER = "x-sporades-client-address";
 // src/access-keys-runtime.ts
 var UNKNOWN_ACCESS_KEY_DIGEST = Buffer.from("4f7c77f7b9231094754542ed50fdfd62a2cf24a5e961b61f899b85b6fe33c72b", "hex");
 
+// src/team-billing-management.ts
+var CLAIM_TTL_MS = 5 * 60 * 1e3;
+
+// src/team-billing-convergence.ts
+var RANK = Object.freeze({ active: 20, cancelling: 30, "past-due": 40, cancelled: 50 });
+
+// src/team-billing-runtime.ts
+var CHECKOUT_CONTINUATION_TTL_DEFAULT_SECONDS = 10 * 60;
+var CHECKOUT_CONTINUATION_TTL_MAX_SECONDS = 30 * 60;
+
+// src/team-billing-erasure.ts
+var CLAIM_TTL_MS2 = 5 * 6e4;
+
 // src/jobs-runtime.ts
 var nodeCryptoModule = process.getBuiltinModule("node:crypto");
+var STRIPE_EVENT_PAYLOAD_RETENTION_MS = 30 * 24 * 60 * 60 * 1e3;
+var REDACTED_STRIPE_EVENT_PAYLOAD = JSON.stringify({ kind: "stripe-event", retained: false });
+var STRIPE_EVENT_PAYLOAD_SENTINEL_RECHECK_MS = 24 * 60 * 60 * 1e3;
 var JOB_AUTH_SNAPSHOT_MAX_BYTES = 8 * 1024;
 var MAX_JOB_TIMESTAMP_MS = Date.parse("9999-12-31T23:59:59.999Z");
 var MIN_JOB_TIMESTAMP_MS = Date.parse("0000-01-01T00:00:00.000Z");
@@ -440,6 +456,8 @@ var transactionBeforeCommitChecks2 = Symbol.for("sporades.database.transactionBe
 // src/server-runtime-source.ts
 var trustedReadTransactionAdapter = Symbol("sporades.trustedReadTransactionAdapter");
 var runtimeOwnedJobEnqueueHandler = Symbol("sporades.runtimeOwnedJobEnqueueHandler");
+var atomicStripeEventDefinitionBrand = Symbol.for("sporades.stripeEvent.atomicDefinition");
+var atomicStripeFenceContention = Symbol("sporades.atomicStripeFenceContention");
 function logPayloadMaxBytes(config = {}) {
   const configured = Number(config.logs?.payloadMaxBytes ?? config.logging?.payloadMaxBytes);
   return Number.isInteger(configured) && configured > 0 ? configured : 4096;
@@ -595,7 +613,7 @@ function writeEnvelope(result, failed = false) {
 }
 
 // src/cli/cli-version.ts
-var CLI_VERSION = "0.9.1";
+var CLI_VERSION = "0.9.3";
 
 // src/cli/schedule-inspection-envelope.ts
 var SCHEDULE_DIAGNOSTIC_FIELDS = /* @__PURE__ */ new Set([
@@ -1955,25 +1973,42 @@ async function verifyInstalledRelease(request, release, installData, previousCur
 }
 async function verifyInstalledPublicTree(request, timeoutMs) {
   const url = new URL("/", `${request.host.scheme ?? "https"}://${request.capsule.subname}.${request.host.domain}`).toString();
-  try {
-    const response = await fetch(url, { headers: { accept: "text/html" }, signal: AbortSignal.timeout(timeoutMs) });
-    const contentType = response.headers.get("content-type") ?? "";
-    if (!response.ok || !contentType.toLowerCase().startsWith("text/html")) {
-      return {
+  const deadline = Date.now() + timeoutMs;
+  let lastFailure = {
+    ok: false,
+    data: { url, path: "/", responding: false, statusCode: null, html: false },
+    error: { message: "Hosted Capsule installed public tree did not respond." }
+  };
+  while (Date.now() < deadline) {
+    try {
+      const response = await fetch(url, {
+        headers: { accept: "text/html" },
+        signal: AbortSignal.timeout(Math.max(1, deadline - Date.now()))
+      });
+      const contentType = response.headers.get("content-type") ?? "";
+      if (response.ok && contentType.toLowerCase().startsWith("text/html")) {
+        await response.body?.cancel();
+        return { ok: true, data: { url, path: "/", responding: true, statusCode: response.status, html: true } };
+      }
+      await response.body?.cancel();
+      lastFailure = {
         ok: false,
         data: { url, path: "/", responding: response.ok, statusCode: response.status, html: false },
         error: { message: "Hosted Capsule installed public tree did not serve its HTML entry." }
       };
+    } catch {
+      lastFailure = {
+        ok: false,
+        data: { url, path: "/", responding: false, statusCode: null, html: false },
+        error: { message: "Hosted Capsule installed public tree did not respond." }
+      };
+    }
+    const remainingMs = deadline - Date.now();
+    if (remainingMs > 0) {
+      await delay(Math.min(100, remainingMs));
     }
-    await response.body?.cancel();
-    return { ok: true, data: { url, path: "/", responding: true, statusCode: response.status, html: true } };
-  } catch {
-    return {
-      ok: false,
-      data: { url, path: "/", responding: false, statusCode: null, html: false },
-      error: { message: "Hosted Capsule installed public tree did not respond." }
-    };
   }
+  return lastFailure;
 }
 function readVerificationHealthTimeoutMs(request) {
   const value = Number(request.verification?.healthTimeoutMs ?? 1e4);