The read surface: balances, statements, postings, sagas, entitlements, status, capacity,
the streamed enumerations, and the export. Reads never mutate; balance alone consults the
optional cache, every other reader goes to the store.
Every account that has a balance row, streamed. A real ledger can hold many, so iterate and stop when you've seen enough rather than collecting them all. Lets a reader enumerate accounts (and derive users) without tracking them itself. This is the prover's own enumeration.
Optionaloptions: CallOptionsThe account's current balance in its own currency, from the maintained running total — one read, not a sum over history; an account never posted to reads as zero. When a cache port is present this is a read-through, and any cache failure logs and falls back to the ledger, so a degraded cache can never fail the read. A bare sharded platform account resolves to its logical balance: the sum over its shard rows.
Optionaloptions: CallOptionsThe capacity gauges (see CapacityReport), with advisories as stated facts: the system measures, the host decides; nothing here flips any behavior.
Optionaloptions: CallOptionsThe latest signed checkpoint (the Merkle root over all account heads, its signature, and the
count it covers), or null before the worker has sealed one. The read side of the periodic
seal a UI verifies against the live heads. Delegates to CheckpointStore.latest.
Optionaloptions: CallOptionsWhether a user currently owns an entitlement (a SKU: an item or feature), true or false.
Ownership is a record, not a balance, so it has its own reader. This is the readable side of
grantEntitlement/revokeEntitlement that a UI gates access on.
Optionaloptions: CallOptionsStreams the ledger as canonical JSONL for offline verification: a header line, every
account's chain links in lineage order, then the latest checkpoint. scripts/ledger-verify.ts
re-proves the chain and checks the checkpoint signature from the file alone, with no
store access.
Optionaloptions: CallOptionsThe light in-process snapshot for health pages and consoles; its chain check is
shape-only. CI and audits run the thorough proveEconomy instead.
Optionaloptions: CallOptionsOne account's hash chain, oldest first: every posting that touched it, each carrying the
head hash before and after, so a reader can walk the tamper-evident chain a link at a time.
The first link's prevHash is the fixed genesis; each later prevHash equals the prior
hash. Delegates to Ledger.lineage.
Optionaloptions: CallOptionsEvery payout saga, newest first, streamed (a busy economy can have many). Includes settled
and failed payouts, not only the due ones the worker claims. Lets a UI
render payout status without tracking minted payout ids itself. Delegates to SagaStore.list.
Optionaloptions: CallOptions & {One committed posting by transaction id (its legs and meta), or null if unknown. Lets a reader
resolve a posting without reaching past read into the raw Store.
Optionaloptions: CallOptionsEvery committed posting, newest first, streamed (a busy ledger can have many). Includes user
and worker postings alike, every account touched, not only the ones a given reader
minted. Each posting carries its full legs, so a UI renders a row without a second lookup.
Delegates to Ledger.list.
Optionaloptions: CallOptionsOne payout saga by id (state, provider ref, attempts), or null if unknown. The background worker advances these; a UI reads them to render payout status.
Optionaloptions: CallOptionsOne page of the account's entries inside range (half-open, epoch milliseconds: from
included, to not). Paging is by narrowing the range window by window; the returned
cursor is reserved and always null.
Optionaloptions: CallOptionsThe economy's current pause state (see EconomyStatus). Derived from config + the clock, not stored, so it always reflects the live window.
Shuts the economy down by closing its store — the SQL engines close their connection pools; the memory store has nothing to release. The economy itself holds no other state. Call it once, after in-flight submits and the worker's sweeps have finished; a submit after close gets whatever the engine does on a closed pool.
Runs one operation through the full pipeline: validate, authorize, then one all-or-nothing
transaction that claims the idempotency key, screens risk and funds, posts the legs, and
queues the outbound event. Resolves committed, duplicate (the idempotency key was seen
before — the original transaction returns unchanged, nothing posts twice), or rejected (a
normal decline returned as data); a genuine fault throws an EconomyError instead. A
rejected operation commits nothing and leaves its idempotency key unclaimed, so a corrected
retry under the same key can still succeed.
Optionaloptions: CallOptionsSubmits several independent operations through the full pipeline for one database commit
(one fsync) on the clean path — the aggregate-throughput lever — while each operation keeps
exactly submit's semantics: a rejection or fault rolls back that operation alone, and its
batch-mates still commit. The isolation strategy is the store engine's own (see
Store.batchTransaction). Slots are index-aligned with the input. Operations in one
batch must carry distinct idempotency keys; a duplicate key's slot faults. On a store
without batch support, this degrades to sequential submits.
Optionaloptions: CallOptions
Public surface of a running economy: submit operations that change money, read balances and statements, run the integrity check, shut down. Built by
createEconomyineconomy.ts.See
The Economy for the submit/read/close surface and its construction.