@allbluecn/web-app 0.3.0

package/src/server/builtin-project.ts

@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { prisma } from "@allbluecn/database"
+import {
+  BUILTIN_INDEPENDENT_DISPLAY_ID,
+  BUILTIN_INDEPENDENT_NAME,
+  BUILTIN_INDEPENDENT_ICON,
+} from "@/lib/builtin-project"
+
+export async function ensureBuiltinIndependentProject(userId: string): Promise<string> {
+  const existing = await prisma.project.findFirst({
+    where: { ownerId: userId, displayId: BUILTIN_INDEPENDENT_DISPLAY_ID },
+    select: { id: true },
+  })
+  if (existing) return existing.id
+
+  try {
+    const project = await prisma.project.create({
+      data: {
+        displayId: BUILTIN_INDEPENDENT_DISPLAY_ID,
+        name: BUILTIN_INDEPENDENT_NAME,
+        icon: BUILTIN_INDEPENDENT_ICON,
+        ownerId: userId,
+        members: { create: { userId, role: "owner", status: "active" } },
+      },
+      select: { id: true },
+    })
+    return project.id
+  } catch (err) {
+    if (
+      (err as { code: string })?.code === "P2002"
+    ) {
+      const race = await prisma.project.findFirst({
+        where: { ownerId: userId, displayId: BUILTIN_INDEPENDENT_DISPLAY_ID },
+        select: { id: true },
+      })
+      if (race) return race.id
+    }
+    throw err
+  }
+}

package/src/server/design/sketch/annotation-parser.ts

@@ -0,0 +1,160 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+export interface LayerFrame {
+  x: number
+  y: number
+  width: number
+  height: number
+}
+
+export interface LayerStyle {
+  fills?: { color: string; fillType: string; opacity: number }[]
+  borders?: { color: string; thickness: number; position: string }[]
+  shadows?: { color: string; blur: number; x: number; y: number; spread: number }[]
+  innerShadows?: { color: string; blur: number; x: number; y: number; spread: number }[]
+  corners?: { radii: number | number[]; smoothing?: number }
+  opacity?: number
+  fontFamily?: string
+  fontSize?: number
+  fontWeight?: number
+  textColor?: string
+  alignment?: string
+  lineHeight?: number | null
+  letterSpacing?: number | null
+}
+
+export interface AnnotationLayer {
+  id: string
+  name: string
+  type: string
+  frame: LayerFrame
+  text?: string
+  style?: LayerStyle
+  layers?: AnnotationLayer[]
+}
+
+export interface AnnotationArtboard {
+  id: string
+  name: string
+  frame: LayerFrame
+  layers: AnnotationLayer[]
+  exportableLayers?: {
+    name: string
+    id: string
+    type: string
+    frame: LayerFrame
+  }[]
+  meaxureData?: {
+    notes: any[]
+    layers: any[]
+    width: number
+    height: number
+    slug?: string
+    objectID?: string
+  }
+}
+
+export interface AnnotationData {
+  version: number
+  source?: string
+  document: { name: string; id: string; appVersion?: string }
+  pages: {
+    id: string
+    name: string
+    artboards: AnnotationArtboard[]
+  }[]
+}
+
+export function parseAnnotationJson(raw: unknown): AnnotationData {
+  if (!raw || typeof raw !== "object") {
+    throw new Error("Invalid annotation JSON")
+  }
+  return raw as AnnotationData
+}
+
+export function findLayerById(
+  layers: AnnotationLayer[],
+  id: string,
+): AnnotationLayer | null {
+  for (const layer of layers) {
+    if (layer.id === id) return layer
+    if (layer.layers) {
+      const found = findLayerById(layer.layers, id)
+      if (found) return found
+    }
+  }
+  return null
+}
+
+export function flattenLayers(layers: AnnotationLayer[]): AnnotationLayer[] {
+  const result: AnnotationLayer[] = []
+  for (const layer of layers) {
+    result.push(layer)
+    if (layer.layers) {
+      result.push(...flattenLayers(layer.layers))
+    }
+  }
+  return result
+}
+
+export interface SpacingInfo {
+  top: { layer: AnnotationLayer; distance: number } | null
+  bottom: { layer: AnnotationLayer; distance: number } | null
+  left: { layer: AnnotationLayer; distance: number } | null
+  right: { layer: AnnotationLayer; distance: number } | null
+}
+
+export function calculateSpacings(
+  target: AnnotationLayer,
+  siblings: AnnotationLayer[],
+): SpacingInfo {
+  const t = target.frame
+  const spacings: SpacingInfo = { top: null, bottom: null, left: null, right: null }
+
+  for (const sibling of siblings) {
+    if (sibling.id === target.id) continue
+    const s = sibling.frame
+
+    const overlapX = s.x < t.x + t.width && s.x + s.width > t.x
+    const overlapY = s.y < t.y + t.height && s.y + s.height > t.y
+
+    if (overlapY) {
+      const distLeft = t.x - (s.x + s.width)
+      if (distLeft > 0 && (!spacings.left || distLeft < spacings.left.distance)) {
+        spacings.left = { layer: sibling, distance: distLeft }
+      }
+      const distRight = s.x - (t.x + t.width)
+      if (distRight > 0 && (!spacings.right || distRight < spacings.right.distance)) {
+        spacings.right = { layer: sibling, distance: distRight }
+      }
+    }
+
+    if (overlapX) {
+      const distTop = t.y - (s.y + s.height)
+      if (distTop > 0 && (!spacings.top || distTop < spacings.top.distance)) {
+        spacings.top = { layer: sibling, distance: distTop }
+      }
+      const distBottom = s.y - (t.y + t.height)
+      if (distBottom > 0 && (!spacings.bottom || distBottom < spacings.bottom.distance)) {
+        spacings.bottom = { layer: sibling, distance: distBottom }
+      }
+    }
+  }
+
+  return spacings
+}

package/src/server/design/sketch/code-generator.ts

@@ -0,0 +1,180 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import type { AnnotationLayer, LayerStyle } from "@/server/design/sketch/annotation-parser"
+
+export type CodeFormat = "html" | "react-tailwind" | "swift-uikit"
+
+export interface CodeResult {
+  code: string
+  language: string
+}
+
+export function generateCode(
+  layer: AnnotationLayer,
+  format: CodeFormat,
+  depth = 0,
+): CodeResult {
+  const generators: Record<CodeFormat, (l: AnnotationLayer, d: number) => string> = {
+    html: generateHtml,
+    "react-tailwind": generateReactTailwind,
+    "swift-uikit": generateSwift,
+  }
+
+  const code = generators[format](layer, depth)
+  const language = format === "swift-uikit" ? "swift" : format === "react-tailwind" ? "jsx" : "html"
+
+  return { code, language }
+}
+
+function indent(depth: number): string {
+  return "  ".repeat(depth)
+}
+
+function generateHtml(layer: AnnotationLayer, depth: number): string {
+  const style = layerToCssStyle(layer)
+  const tag = layer.type === "Text" ? "span" : "div"
+
+  if (layer.type === "Text" && layer.text) {
+    return `${indent(depth)}<${tag} style="${style}">${layer.text}</${tag}>`
+  }
+
+  let html = `${indent(depth)}<${tag} style="${style}">`
+  if (layer.layers?.length) {
+    html += "\n"
+    for (const child of layer.layers) {
+      html += generateHtml(child, depth + 1) + "\n"
+    }
+    html += `${indent(depth)}</${tag}>`
+  } else {
+    html += `</${tag}>`
+  }
+  return html
+}
+
+function generateReactTailwind(layer: AnnotationLayer, depth: number): string {
+  const cls = layerToTailwindClasses(layer)
+  const tag = layer.type === "Text" ? "span" : "div"
+
+  if (layer.type === "Text" && layer.text) {
+    return `${indent(depth)}<${tag} className="${cls}">${layer.text}</${tag}>`
+  }
+
+  let html = `${indent(depth)}<${tag} className="${cls}">`
+  if (layer.layers?.length) {
+    html += "\n"
+    for (const child of layer.layers) {
+      html += generateReactTailwind(child, depth + 1) + "\n"
+    }
+    html += `${indent(depth)}</${tag}>`
+  } else {
+    html += `</${tag}>`
+  }
+  return html
+}
+
+function generateSwift(layer: AnnotationLayer, depth: number): string {
+  const d = indent(depth)
+  const f = layer.frame
+  let code = `${d}let ${camelCase(layer.name)} = UIView(frame: CGRect(x: ${Math.round(f.x)}, y: ${Math.round(f.y)}, width: ${Math.round(f.width)}, height: ${Math.round(f.height)}))\n`
+
+  if (layer.style?.fills?.[0]?.color) {
+    code += `${d}${camelCase(layer.name)}.backgroundColor = UIColor(hex: "${layer.style.fills[0].color.slice(0, 7)}").cgColor\n`
+  }
+  if (layer.style?.corners?.radii) {
+    code += `${d}${camelCase(layer.name)}.layer.cornerRadius = ${layer.style.corners.radii}\n`
+  }
+  if (layer.style?.shadows?.[0]) {
+    const s = layer.style.shadows[0]
+    code += `${d}${camelCase(layer.name)}.layer.shadowColor = UIColor(hex: "${s.color.slice(0, 7)}").cgColor\n`
+    code += `${d}${camelCase(layer.name)}.layer.shadowOffset = CGSize(width: ${s.x}, height: ${s.y})\n`
+    code += `${d}${camelCase(layer.name)}.layer.shadowRadius = ${s.blur}\n`
+    code += `${d}${camelCase(layer.name)}.layer.shadowOpacity = 1\n`
+  }
+  if (layer.layers?.length) {
+    for (const child of layer.layers) {
+      code += generateSwift(child, depth) + "\n"
+      code += `${d}${camelCase(layer.name)}.addSubview(${camelCase(child.name)})\n`
+    }
+  }
+  return code.trimEnd()
+}
+
+function camelCase(str: string): string {
+  return str.replace(/[^a-zA-Z0-9]+(.)/g, (_, c) => c.toUpperCase()).replace(/^[A-Z]/, (c) => c.toLowerCase()) || "view"
+}
+
+function layerToCssStyle(layer: AnnotationLayer): string {
+  const parts: string[] = []
+  const f = layer.frame
+  parts.push(`width: ${Math.round(f.width)}px`)
+  parts.push(`height: ${Math.round(f.height)}px`)
+
+  const style = layer.style
+  if (style?.fills?.[0]?.color) {
+    parts.push(`background: ${style.fills[0].color.slice(0, 7)}`)
+  }
+  if (style?.borders?.[0]) {
+    const b = style.borders[0]
+    parts.push(`border: ${b.thickness}px solid ${b.color.slice(0, 7)}`)
+  }
+  if (style?.shadows?.[0]) {
+    const s = style.shadows[0]
+    parts.push(`box-shadow: ${s.x}px ${s.y}px ${s.blur}px ${s.color.slice(0, 7)}`)
+  }
+  if (style?.corners?.radii) {
+    parts.push(`border-radius: ${style.corners.radii}px`)
+  }
+  if (style?.fontFamily) {
+    parts.push(`font-family: ${style.fontFamily}`)
+    parts.push(`font-size: ${style.fontSize}px`)
+  }
+  if (style?.textColor) {
+    parts.push(`color: ${style.textColor.slice(0, 7)}`)
+  }
+  if (style?.opacity !== undefined && style.opacity < 1) {
+    parts.push(`opacity: ${style.opacity}`)
+  }
+  return parts.join("; ")
+}
+
+function layerToTailwindClasses(layer: AnnotationLayer): string {
+  const parts: string[] = []
+  const style = layer.style
+
+  if (style?.fills?.[0]?.color) {
+    parts.push(`bg-[${style.fills[0].color.slice(0, 7)}]`)
+  }
+  if (style?.corners?.radii) {
+    parts.push(`rounded-[${style.corners.radii}px]`)
+  }
+  if (style?.shadows?.[0]) {
+    const s = style.shadows[0]
+    parts.push(`shadow-[${s.x}px_${s.y}px_${s.blur}px_${s.color.slice(0, 7)}]`)
+  }
+  if (style?.fontFamily) {
+    parts.push(`font-[${style.fontFamily}]`)
+    parts.push(`text-[${style.fontSize}px]`)
+  }
+  if (style?.textColor) {
+    parts.push(`text-[${style.textColor.slice(0, 7)}]`)
+  }
+  if (style?.opacity !== undefined && style.opacity < 1) {
+    parts.push(`opacity-${Math.round(style.opacity * 100)}`)
+  }
+  return parts.join(" ")
+}

package/src/server/design/sketch/file-storage.ts

@@ -0,0 +1,71 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+import { writeFile, mkdir, unlink, readFile } from "node:fs/promises"
+import { join } from "node:path"
+import { existsSync } from "node:fs"
+
+const UPLOAD_ROOT = process.env.DESIGN_UPLOAD_DIR || "uploads/design"
+
+export async function saveFile(
+  projectId: string,
+  artboardId: string,
+  filename: string,
+  buffer: Buffer,
+): Promise<string> {
+  const dir = join(UPLOAD_ROOT, projectId, artboardId)
+  if (!existsSync(dir)) {
+    await mkdir(dir, { recursive: true })
+  }
+  const filePath = join(dir, filename)
+  await writeFile(filePath, buffer)
+  return filePath
+}
+
+export async function saveExport(
+  projectId: string,
+  artboardId: string,
+  layerName: string,
+  scale: number,
+  buffer: Buffer,
+): Promise<string> {
+  const dir = join(UPLOAD_ROOT, projectId, artboardId, "exports")
+  if (!existsSync(dir)) {
+    await mkdir(dir, { recursive: true })
+  }
+  const safeName = layerName.replace(/[^a-zA-Z0-9_-]/g, "_")
+  const filename = `${safeName}_${scale}x.png`
+  const filePath = join(dir, filename)
+  await writeFile(filePath, buffer)
+  return filePath
+}
+
+export async function deleteProjectFiles(projectId: string): Promise<void> {
+  const dir = join(UPLOAD_ROOT, projectId)
+  if (existsSync(dir)) {
+    const { rm } = await import("node:fs/promises")
+    await rm(dir, { recursive: true, force: true })
+  }
+}
+
+export function getFileUrl(projectId: string, artboardId: string, filename: string): string {
+  return `/design-files/${projectId}/${artboardId}/${filename}`
+}
+
+export function getExportUrl(projectId: string, artboardId: string, filename: string): string {
+  return `/design-files/${projectId}/${artboardId}/exports/${filename}`
+}

package/src/server/desktop-guest.ts

@@ -0,0 +1,29 @@
+import type { Session } from '@/lib/session'
+
+export const GUEST_USER_ID = 'local-guest'
+export const GUEST_USERNAME = '本地用户'
+export const GUEST_EMAIL = 'guest@localhost'
+
+export function isGuestSession(session: Session | null): boolean {
+  return !!(session?.user?.id === GUEST_USER_ID)
+}
+
+export function buildGuestSession(): Session {
+  return {
+    user: {
+      id: GUEST_USER_ID,
+      name: GUEST_USERNAME,
+      email: GUEST_EMAIL,
+      role: 'USER',
+      isGuest: true,
+      aiProvider: 'openrouter',
+      aiModel: 'openai/gpt-4o-mini',
+      hasAiKey: false,
+    },
+    expires: 'never',
+  }
+}
+
+export function isDesktopServer(): boolean {
+  return process.env.DEPLOY_TARGET === 'desktop'
+}

package/src/server/email/sender.ts

@@ -0,0 +1,21 @@
+export interface EmailParams {
+  to: string
+  subject: string
+  html?: string
+  text?: string
+}
+
+export interface EmailSender {
+  send(params: EmailParams): Promise<void>
+}
+
+export function getEmailSender(): EmailSender {
+  return {
+    send: async (params) => {
+      console.log(`[email] To: ${params.to}, Subject: ${params.subject}`)
+      if (params.text) {
+        console.log(`[email] Text: ${params.text}`)
+      }
+    },
+  }
+}

package/src/server/entitlements-token-client.ts

@@ -0,0 +1,32 @@
+import { FeatureRegistry, type FeatureKey } from '@allbluecn/shared'
+import { readRemoteAuth } from './remote-auth'
+
+/**
+ * 读取已验签的权益数据。
+ * 验签在 Rust 侧 read_remote_auth 每次调用时完成——此处直接采信返回值。
+ * 验签失败 / token 过期超 72h → Rust 返回 None → 本函数返回 null（降级 OSS 白名单）。
+ */
+export async function readVerifiedEntitlements(): Promise<{
+  enabled: Record<FeatureKey, boolean>
+  tokenExpired?: boolean
+  inGracePeriod?: boolean
+} | null> {
+  const remoteAuth = await readRemoteAuth()
+  if (!remoteAuth) return null
+
+  const enabled: Record<FeatureKey, boolean> = {} as Record<FeatureKey, boolean>
+  for (const key of Object.keys(FeatureRegistry) as FeatureKey[]) {
+    enabled[key] = false
+  }
+  for (const [key, value] of Object.entries(remoteAuth.features)) {
+    if (key in FeatureRegistry) {
+      enabled[key as FeatureKey] = value === true
+    }
+  }
+
+  return {
+    enabled,
+    tokenExpired: remoteAuth.tokenExpired,
+    inGracePeriod: remoteAuth.inGracePeriod,
+  }
+}

package/src/server/entitlements-token.ts

@@ -0,0 +1,137 @@
+import { randomUUID } from 'crypto'
+import type { FeatureKey } from '@allbluecn/shared'
+
+export interface EntitlementsTokenPayload {
+  sub: string
+  plan: string
+  feats: Record<FeatureKey, boolean>
+  username?: string
+  email?: string | null
+  role?: string
+  iat: number
+  exp: number
+  jti: string
+}
+
+export interface EntitlementsToken {
+  header: { alg: 'EdDSA'; typ: 'ENT' }
+  payload: EntitlementsTokenPayload
+  signature: string
+}
+
+export const TOKEN_TTL_MS = 24 * 60 * 60 * 1000
+export const TOKEN_GRACE_MS = 72 * 60 * 60 * 1000
+
+function base64urlEncode(data: Uint8Array): string {
+  return Buffer.from(data)
+    .toString('base64')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=/g, '')
+}
+
+function base64urlDecode(str: string): Uint8Array {
+  const base64 = str
+    .replace(/-/g, '+')
+    .replace(/_/g, '/')
+    .padEnd(str.length + ((4 - str.length % 4) % 4), '=')
+  return new Uint8Array(Buffer.from(base64, 'base64'))
+}
+
+async function getSigningKey(): Promise<CryptoKey | null> {
+  const secret = process.env.ENTITLEMENTS_SIGNING_SECRET
+  if (!secret) {
+    return null
+  }
+  if (!secret.startsWith('ed25519-pair-')) {
+    throw new Error('Invalid ENTITLEMENTS_SIGNING_SECRET format: must start with ed25519-pair-')
+  }
+  const encoded = secret.slice('ed25519-pair-'.length)
+  const parts = encoded.split('.')
+  if (parts.length < 1 || !parts[0]) {
+    throw new Error('Invalid ENTITLEMENTS_SIGNING_SECRET: missing private key')
+  }
+  const privBytes = base64urlDecode(parts[0])
+  return crypto.subtle.importKey(
+    'pkcs8',
+    privBytes as BufferSource,
+    { name: 'Ed25519', namedCurve: 'Ed25519' },
+    false,
+    ['sign'],
+  )
+}
+
+export async function generateKeyPairForEnv(): Promise<string> {
+  const keyPair = await crypto.subtle.generateKey(
+    { name: 'Ed25519', namedCurve: 'Ed25519' },
+    true,
+    ['sign', 'verify'],
+  )
+  const privDer = await crypto.subtle.exportKey('pkcs8', keyPair.privateKey)
+  const pubRaw = await crypto.subtle.exportKey('raw', keyPair.publicKey)
+  const privB64 = base64urlEncode(new Uint8Array(privDer))
+  const pubB64 = base64urlEncode(new Uint8Array(pubRaw))
+  return `ed25519-pair-${privB64}.${pubB64}`
+}
+
+export function extractPublicKeyFromEnv(): string {
+  const secret = process.env.ENTITLEMENTS_SIGNING_SECRET
+  if (!secret || !secret.startsWith('ed25519-pair-')) {
+    throw new Error('ENTITLEMENTS_SIGNING_SECRET not configured')
+  }
+  const encoded = secret.slice('ed25519-pair-'.length)
+  const parts = encoded.split('.')
+  if (parts.length < 2 || !parts[1]) {
+    throw new Error('Invalid ENTITLEMENTS_SIGNING_SECRET: missing public key')
+  }
+  return parts[1]
+}
+
+export async function generateEntitlementsToken(
+  payload: Omit<EntitlementsTokenPayload, 'iat' | 'exp' | 'jti'>,
+): Promise<string | null> {
+  const privateKey = await getSigningKey()
+  if (!privateKey) {
+    return null
+  }
+  const now = Math.floor(Date.now() / 1000)
+
+  const tokenPayload: EntitlementsTokenPayload = {
+    ...payload,
+    iat: now,
+    exp: now + Math.floor(TOKEN_TTL_MS / 1000),
+    jti: randomUUID(),
+  }
+
+  const header = { alg: 'EdDSA', typ: 'ENT' }
+  const headerEncoded = base64urlEncode(new TextEncoder().encode(JSON.stringify(header)))
+  const payloadEncoded = base64urlEncode(new TextEncoder().encode(JSON.stringify(tokenPayload)))
+  const signingInput = `${headerEncoded}.${payloadEncoded}`
+
+  const signature = await crypto.subtle.sign(
+    'EdDSA',
+    privateKey,
+    new TextEncoder().encode(signingInput),
+  )
+  const signatureEncoded = base64urlEncode(new Uint8Array(signature))
+
+  return `${headerEncoded}.${payloadEncoded}.${signatureEncoded}`
+}
+
+export function parseEntitlementsToken(token: string): EntitlementsToken | null {
+  try {
+    const parts = token.split('.')
+    if (parts.length !== 3) return null
+    const header = JSON.parse(new TextDecoder().decode(base64urlDecode(parts[0])))
+    const payload = JSON.parse(new TextDecoder().decode(base64urlDecode(parts[1])))
+    return {
+      header,
+      payload,
+      signature: parts[2],
+    }
+  } catch {
+    return null
+  }
+}
+
+export { base64urlEncode, base64urlDecode }