@arslankhan/doc-forge 0.0.0-stage → 0.1.0

package/dist/license/index.js

@@ -0,0 +1,9 @@
+export { inspectDocumentCapabilities } from "./capabilities.js";
+export { activateLicense, configureLicense, createLicenseClient, deactivateLicense, getEntitlements, getLicenseStatus, hasFeature, LicenseClient, LICENSE_STATUSES, resetLicenseConfiguration, } from "./client.js";
+export { LicenseError, LicenseNetworkError } from "./errors.js";
+export { entitlementsForPlan, isLicenseFeature, LICENSE_FEATURES } from "./features.js";
+export { createHttpLicenseProvider, createMockLicenseProvider } from "./provider.js";
+export { redactSecret } from "./redact.js";
+export { createBrowserLicenseStore, createMemoryLicenseStore, LICENSE_STORAGE_KEY } from "./store.js";
+export { verifyLicenseToken } from "./token.js";
+//# sourceMappingURL=index.js.map

package/dist/license/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/license/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAEhE,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,eAAe,EACf,gBAAgB,EAChB,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AASrB,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAExF,OAAO,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AASrF,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtG,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC"}

package/dist/license/provider.d.ts

@@ -0,0 +1,59 @@
+export declare const LICENSE_SERVICE_STATUSES: readonly ["unconfigured", "valid", "expired", "invalid", "revoked", "network_unavailable"];
+export type LicenseServiceStatus = (typeof LICENSE_SERVICE_STATUSES)[number];
+/**
+ * Response from a license service.
+ * `valid` is accepted only after this package verifies the signed token.
+ * A redirect to a payment success page is not a license result.
+ */
+export interface LicenseServiceResult {
+    status: LicenseServiceStatus;
+    token?: string;
+    message?: string;
+}
+export interface LicenseProviderContext {
+    productId: string;
+    signal?: AbortSignal;
+}
+export interface LicenseActivateRequest {
+    key: string;
+    productId: string;
+}
+export interface LicenseRefreshRequest {
+    token: string;
+    productId: string;
+}
+export interface LicenseDeactivateRequest {
+    token?: string;
+    productId: string;
+}
+/** Host-supplied license API. This package does not include a license-server admin client. */
+export interface LicenseProvider {
+    readonly name: string;
+    activate(request: LicenseActivateRequest, context: LicenseProviderContext): Promise<LicenseServiceResult>;
+    refresh?(request: LicenseRefreshRequest, context: LicenseProviderContext): Promise<LicenseServiceResult>;
+    deactivate?(request: LicenseDeactivateRequest, context: LicenseProviderContext): Promise<void>;
+}
+export interface MockLicenseHandlers {
+    activate?: (key: string) => Promise<LicenseServiceResult> | LicenseServiceResult;
+    refresh?: (token: string) => Promise<LicenseServiceResult> | LicenseServiceResult;
+    deactivate?: () => Promise<void> | void;
+}
+/**
+ * Test double. It does not contact a license service and cannot mint a trusted token.
+ * A `valid` result still has to carry a signature this package can verify.
+ */
+export declare function createMockLicenseProvider(handlers?: MockLicenseHandlers): LicenseProvider;
+export interface HttpLicenseProviderOptions {
+    /** Absolute HTTPS URL of the activation endpoint. There is no default. */
+    activateUrl: string;
+    refreshUrl?: string;
+    deactivateUrl?: string;
+    headers?: Readonly<Record<string, string>>;
+    fetchImpl?: typeof fetch;
+}
+/**
+ * Posts the license key to a host-configured HTTPS endpoint.
+ * The endpoint must return a signed token. This client does not grant entitlements from the HTTP status.
+ */
+export declare function createHttpLicenseProvider(options: HttpLicenseProviderOptions): LicenseProvider;
+//# sourceMappingURL=provider.d.ts.map

package/dist/license/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","sourceRoot":"","sources":["../../src/license/provider.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,wBAAwB,4FAO3B,CAAC;AAEX,MAAM,MAAM,oBAAoB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE7E;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,oBAAoB,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,8FAA8F;AAC9F,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC1G,OAAO,CAAC,CAAC,OAAO,EAAE,qBAAqB,EAAE,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACzG,UAAU,CAAC,CAAC,OAAO,EAAE,wBAAwB,EAAE,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChG;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,oBAAoB,CAAC,GAAG,oBAAoB,CAAC;IACjF,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,oBAAoB,CAAC,GAAG,oBAAoB,CAAC;IAClF,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACzC;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,GAAE,mBAAwB,GAAG,eAAe,CAyB7F;AAED,MAAM,WAAW,0BAA0B;IACzC,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3C,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,0BAA0B,GAAG,eAAe,CA+B9F"}

package/dist/license/provider.js

@@ -0,0 +1,150 @@
+import { LicenseError } from "./errors.js";
+import { messageWithoutSecret } from "./redact.js";
+export const LICENSE_SERVICE_STATUSES = [
+    "unconfigured",
+    "valid",
+    "expired",
+    "invalid",
+    "revoked",
+    "network_unavailable",
+];
+/**
+ * Test double. It does not contact a license service and cannot mint a trusted token.
+ * A `valid` result still has to carry a signature this package can verify.
+ */
+export function createMockLicenseProvider(handlers = {}) {
+    return {
+        name: "mock",
+        async activate(request) {
+            if (!handlers.activate) {
+                return {
+                    status: "unconfigured",
+                    message: "The mock license provider is not a license server. Activation is unconfigured.",
+                };
+            }
+            return handlers.activate(request.key);
+        },
+        async refresh(request) {
+            if (!handlers.refresh) {
+                return {
+                    status: "network_unavailable",
+                    message: "The mock license provider has no refresh handler.",
+                };
+            }
+            return handlers.refresh(request.token);
+        },
+        async deactivate() {
+            await handlers.deactivate?.();
+        },
+    };
+}
+/**
+ * Posts the license key to a host-configured HTTPS endpoint.
+ * The endpoint must return a signed token. This client does not grant entitlements from the HTTP status.
+ */
+export function createHttpLicenseProvider(options) {
+    const activateUrl = assertLicenseUrl(options.activateUrl, "activateUrl");
+    const refreshUrl = options.refreshUrl === undefined ? undefined : assertLicenseUrl(options.refreshUrl, "refreshUrl");
+    const deactivateUrl = options.deactivateUrl === undefined ? undefined : assertLicenseUrl(options.deactivateUrl, "deactivateUrl");
+    const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    const headers = options.headers;
+    return {
+        name: "http",
+        async activate(request, context) {
+            return postJson(fetchImpl, activateUrl, { key: request.key, productId: request.productId }, request.key, headers, context);
+        },
+        refresh: refreshUrl
+            ? async (request, context) => postJson(fetchImpl, refreshUrl, { token: request.token, productId: request.productId }, request.token, headers, context)
+            : undefined,
+        deactivate: deactivateUrl
+            ? async (request, context) => {
+                const result = await postJson(fetchImpl, deactivateUrl, { token: request.token, productId: request.productId }, request.token ?? "", headers, context);
+                if (result.status === "network_unavailable") {
+                    throw new LicenseError("unavailable_runtime", result.message ?? "The license service could not be reached.");
+                }
+            }
+            : undefined,
+    };
+}
+function assertLicenseUrl(value, label) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new LicenseError("invalid_input", `${label} must be an absolute URL.`);
+    }
+    if (url.protocol !== "https:") {
+        throw new LicenseError("invalid_input", `${label} must use HTTPS.`);
+    }
+    if (url.username.length > 0 || url.password.length > 0) {
+        throw new LicenseError("invalid_input", `${label} must not include credentials.`);
+    }
+    return url.toString();
+}
+async function postJson(fetchImpl, url, body, secret, headers, context) {
+    if (typeof fetchImpl !== "function") {
+        return { status: "network_unavailable", message: "This runtime cannot reach a license service." };
+    }
+    let response;
+    try {
+        response = await fetchImpl(url, {
+            method: "POST",
+            headers: {
+                accept: "application/json",
+                "content-type": "application/json",
+                ...headers,
+            },
+            body: JSON.stringify(body),
+            signal: context.signal,
+        });
+    }
+    catch {
+        return { status: "network_unavailable", message: "The license service could not be reached." };
+    }
+    if (response.status === 404) {
+        return { status: "unconfigured", message: "The license service endpoint was not found." };
+    }
+    if (response.status >= 500) {
+        return { status: "network_unavailable", message: "The license service could not be reached." };
+    }
+    let payload;
+    try {
+        payload = await response.json();
+    }
+    catch {
+        return { status: "invalid", message: "The license service returned an unreadable response." };
+    }
+    return parseServiceResult(payload, secret);
+}
+function parseServiceResult(payload, secret) {
+    const record = asRecord(payload);
+    if (!record) {
+        return { status: "invalid", message: "The license service returned an unreadable response." };
+    }
+    const status = record.status;
+    if (typeof status !== "string" || !isServiceStatus(status)) {
+        return { status: "invalid", message: "The license service returned an unknown status." };
+    }
+    const token = record.token;
+    if (token !== undefined && (typeof token !== "string" || token.length === 0 || token.length > 8192)) {
+        return { status: "invalid", message: "The license service returned an unreadable token." };
+    }
+    const message = record.message;
+    const safeMessage = typeof message === "string" ? messageWithoutSecret(message.slice(0, 300), secret) : undefined;
+    return {
+        status,
+        token: typeof token === "string" ? token : undefined,
+        message: safeMessage,
+    };
+}
+function asRecord(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return undefined;
+    }
+    return value;
+}
+function isServiceStatus(value) {
+    return LICENSE_SERVICE_STATUSES.includes(value);
+}
+//# sourceMappingURL=provider.js.map

package/dist/license/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","sourceRoot":"","sources":["../../src/license/provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEnD,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,cAAc;IACd,OAAO;IACP,SAAS;IACT,SAAS;IACT,SAAS;IACT,qBAAqB;CACb,CAAC;AAiDX;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,WAAgC,EAAE;IAC1E,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,KAAK,CAAC,QAAQ,CAAC,OAAO;YACpB,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACvB,OAAO;oBACL,MAAM,EAAE,cAAc;oBACtB,OAAO,EAAE,gFAAgF;iBAC1F,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,OAAO;YACnB,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtB,OAAO;oBACL,MAAM,EAAE,qBAAqB;oBAC7B,OAAO,EAAE,mDAAmD;iBAC7D,CAAC;YACJ,CAAC;YACD,OAAO,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,UAAU;YACd,MAAM,QAAQ,CAAC,UAAU,EAAE,EAAE,CAAC;QAChC,CAAC;KACF,CAAC;AACJ,CAAC;AAWD;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAmC;IAC3E,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IACzE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACrH,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;IACjI,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACxD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAEhC,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO;YAC7B,OAAO,QAAQ,CAAC,SAAS,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7H,CAAC;QACD,OAAO,EAAE,UAAU;YACjB,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC;YACtJ,CAAC,CAAC,SAAS;QACb,UAAU,EAAE,aAAa;YACvB,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;gBACzB,MAAM,MAAM,GAAG,MAAM,QAAQ,CAC3B,SAAS,EACT,aAAa,EACb,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,EACtD,OAAO,CAAC,KAAK,IAAI,EAAE,EACnB,OAAO,EACP,OAAO,CACR,CAAC;gBACF,IAAI,MAAM,CAAC,MAAM,KAAK,qBAAqB,EAAE,CAAC;oBAC5C,MAAM,IAAI,YAAY,CAAC,qBAAqB,EAAE,MAAM,CAAC,OAAO,IAAI,2CAA2C,CAAC,CAAC;gBAC/G,CAAC;YACH,CAAC;YACH,CAAC,CAAC,SAAS;KACd,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,KAAa;IACpD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,GAAG,KAAK,2BAA2B,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,GAAG,KAAK,kBAAkB,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,YAAY,CAAC,eAAe,EAAE,GAAG,KAAK,gCAAgC,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,SAAuB,EACvB,GAAW,EACX,IAAa,EACb,MAAc,EACd,OAAqD,EACrD,OAA+B;IAE/B,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC;IACpG,CAAC;IACD,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YAC9B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,cAAc,EAAE,kBAAkB;gBAClC,GAAG,OAAO;aACX;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;IACjG,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,6CAA6C,EAAE,CAAC;IAC5F,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;QAC3B,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,2CAA2C,EAAE,CAAC;IACjG,CAAC;IACD,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,sDAAsD,EAAE,CAAC;IAChG,CAAC;IACD,OAAO,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAgB,EAAE,MAAc;IAC1D,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,sDAAsD,EAAE,CAAC;IAChG,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC;IAC3F,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC;QACpG,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC;IAC7F,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,MAAM,WAAW,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClH,OAAO;QACL,MAAM;QACN,KAAK,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACpD,OAAO,EAAE,WAAW;KACrB,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,KAAgC,CAAC;AAC1C,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACpC,OAAQ,wBAA8C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzE,CAAC"}

package/dist/license/redact.d.ts

@@ -0,0 +1,4 @@
+/** Returns a log-safe hint. The full secret is never included. */
+export declare function redactSecret(value: string): string;
+export declare function messageWithoutSecret(message: string, secret: string): string;
+//# sourceMappingURL=redact.d.ts.map

package/dist/license/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/license/redact.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMlD;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAK5E"}

package/dist/license/redact.js

@@ -0,0 +1,15 @@
+/** Returns a log-safe hint. The full secret is never included. */
+export function redactSecret(value) {
+    const trimmed = value.trim();
+    if (trimmed.length <= 8) {
+        return "****";
+    }
+    return `****${trimmed.slice(-4)}`;
+}
+export function messageWithoutSecret(message, secret) {
+    if (secret.length === 0) {
+        return message;
+    }
+    return message.split(secret).join(redactSecret(secret));
+}
+//# sourceMappingURL=redact.js.map

package/dist/license/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/license/redact.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,MAAc;IAClE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;AAC1D,CAAC"}

package/dist/license/store.d.ts

@@ -0,0 +1,26 @@
+/** Local activation record. The license key itself is not stored. */
+export interface StoredLicense {
+    token: string;
+    /** ISO time of the last successful online verification. */
+    lastVerifiedAt?: string;
+}
+/**
+ * Persistence for one installation.
+ * Document templates are not a license store. Do not write this record into invoice or report JSON.
+ */
+export interface LicenseStore {
+    read(): Promise<StoredLicense | null>;
+    write(record: StoredLicense): Promise<void>;
+    clear(): Promise<void>;
+}
+export declare function createMemoryLicenseStore(initial?: StoredLicense | null): LicenseStore;
+/** Browser persistence key. It is separate from `doc-forge-theme` and from saved templates. */
+export declare const LICENSE_STORAGE_KEY = "doc-forge-license";
+type KeyValueStorage = Pick<Storage, "getItem" | "setItem" | "removeItem">;
+/**
+ * Stores the signed token in the supplied storage, or in `localStorage` when a browser is present.
+ * Calling this during server rendering does not touch `window`. A later write with no storage throws.
+ */
+export declare function createBrowserLicenseStore(storage?: KeyValueStorage | null): LicenseStore;
+export {};
+//# sourceMappingURL=store.d.ts.map

package/dist/license/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/license/store.ts"],"names":[],"mappings":"AAEA,qEAAqE;AACrE,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,2DAA2D;IAC3D,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,IAAI,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IACtC,KAAK,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,wBAAgB,wBAAwB,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,IAAI,GAAG,YAAY,CAarF;AAED,+FAA+F;AAC/F,eAAO,MAAM,mBAAmB,sBAAsB,CAAC;AAEvD,KAAK,eAAe,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,CAAC,CAAC;AAE3E;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,CAAC,EAAE,eAAe,GAAG,IAAI,GAAG,YAAY,CAmCxF"}

package/dist/license/store.js

@@ -0,0 +1,90 @@
+import { LicenseError } from "./errors.js";
+export function createMemoryLicenseStore(initial) {
+    let current = initial ?? null;
+    return {
+        async read() {
+            return current ? { ...current } : null;
+        },
+        async write(record) {
+            current = { token: record.token, lastVerifiedAt: record.lastVerifiedAt };
+        },
+        async clear() {
+            current = null;
+        },
+    };
+}
+/** Browser persistence key. It is separate from `doc-forge-theme` and from saved templates. */
+export const LICENSE_STORAGE_KEY = "doc-forge-license";
+/**
+ * Stores the signed token in the supplied storage, or in `localStorage` when a browser is present.
+ * Calling this during server rendering does not touch `window`. A later write with no storage throws.
+ */
+export function createBrowserLicenseStore(storage) {
+    const explicit = storage === undefined ? undefined : storage;
+    return {
+        async read() {
+            const target = resolveStorage(explicit);
+            if (!target) {
+                return null;
+            }
+            const raw = target.getItem(LICENSE_STORAGE_KEY);
+            if (!raw) {
+                return null;
+            }
+            return parseStoredLicense(raw);
+        },
+        async write(record) {
+            const target = resolveStorage(explicit);
+            if (!target) {
+                throw new LicenseError("persistence", "License storage is unavailable in this runtime. Provide a store that does not read browser APIs during server rendering.");
+            }
+            target.setItem(LICENSE_STORAGE_KEY, JSON.stringify({ token: record.token, lastVerifiedAt: record.lastVerifiedAt }));
+        },
+        async clear() {
+            const target = resolveStorage(explicit);
+            if (!target) {
+                throw new LicenseError("persistence", "License storage is unavailable in this runtime. Provide a store that does not read browser APIs during server rendering.");
+            }
+            target.removeItem(LICENSE_STORAGE_KEY);
+        },
+    };
+}
+function resolveStorage(explicit) {
+    if (explicit) {
+        return explicit;
+    }
+    if (explicit === null) {
+        return null;
+    }
+    if (typeof window === "undefined") {
+        return null;
+    }
+    try {
+        return window.localStorage;
+    }
+    catch {
+        return null;
+    }
+}
+function parseStoredLicense(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            return null;
+        }
+        const record = parsed;
+        const token = record.token;
+        if (typeof token !== "string" || token.length === 0 || token.length > 8192) {
+            return null;
+        }
+        const verified = record.lastVerifiedAt;
+        if (verified !== undefined && typeof verified !== "string") {
+            return null;
+        }
+        return { token, lastVerifiedAt: verified };
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/license/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/license/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAmB3C,MAAM,UAAU,wBAAwB,CAAC,OAA8B;IACrE,IAAI,OAAO,GAAG,OAAO,IAAI,IAAI,CAAC;IAC9B,OAAO;QACL,KAAK,CAAC,IAAI;YACR,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACzC,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,MAAM;YAChB,OAAO,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3E,CAAC;QACD,KAAK,CAAC,KAAK;YACT,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAIvD;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAgC;IACxE,MAAM,QAAQ,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IAC7D,OAAO;QACL,KAAK,CAAC,IAAI;YACR,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;YAChD,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,MAAM;YAChB,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,YAAY,CACpB,aAAa,EACb,0HAA0H,CAC3H,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,OAAO,CAAC,mBAAmB,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC;QACtH,CAAC;QACD,KAAK,CAAC,KAAK;YACT,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,YAAY,CACpB,aAAa,EACb,0HAA0H,CAC3H,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;QACzC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,QAA4C;IAClE,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,YAAY,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,MAAiC,CAAC;QACjD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,cAAc,CAAC;QACvC,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC3D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/license/token.d.ts

@@ -0,0 +1,45 @@
+import { type LicenseFeature } from "./features.js";
+export interface LicensePublicKey {
+    /** Key id carried in the token header. Required when more than one key is configured. */
+    kid: string;
+    /** SubjectPublicKeyInfo for a P-256 public key, base64 or base64url. */
+    spki: string;
+}
+export interface LicenseClaims {
+    issuer: string;
+    audience: readonly string[];
+    /** Unix seconds. */
+    expiresAt: number;
+    notBefore?: number;
+    product: string;
+    entitlements: readonly LicenseFeature[];
+    unrecognizedEntitlements: readonly string[];
+    plan?: string;
+    tokenId?: string;
+    subject?: string;
+}
+export interface LicenseVerifyOptions {
+    productId: string;
+    issuer: string;
+    audience: string;
+    keys: readonly LicensePublicKey[];
+    now: Date;
+    clockSkewSeconds: number;
+    revokedTokenIds: readonly string[];
+}
+export type TokenVerification = {
+    ok: true;
+    claims: LicenseClaims;
+} | {
+    ok: false;
+    reason: "malformed" | "signature" | "claims" | "expired" | "revoked";
+    message: string;
+    claims?: LicenseClaims;
+};
+/**
+ * Verifies a compact JWS signed with ES256.
+ * The private key is not present in this package. A token that fails this check
+ * cannot grant entitlements, including a token that only says `isPremium: true`.
+ */
+export declare function verifyLicenseToken(token: string, options: LicenseVerifyOptions): Promise<TokenVerification>;
+//# sourceMappingURL=token.d.ts.map

package/dist/license/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../../src/license/token.ts"],"names":[],"mappings":"AAEA,OAAO,EAAoB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAEtE,MAAM,WAAW,gBAAgB;IAC/B,yFAAyF;IACzF,GAAG,EAAE,MAAM,CAAC;IACZ,wEAAwE;IACxE,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,oBAAoB;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,SAAS,cAAc,EAAE,CAAC;IACxC,wBAAwB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAClC,GAAG,EAAE,IAAI,CAAC;IACV,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GACnC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,WAAW,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,aAAa,CAAA;CAAE,CAAC;AAIjI;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAoCjH"}

package/dist/license/token.js

@@ -0,0 +1,195 @@
+import { decodeBase64Url, utf8Bytes, utf8String } from "./codec.js";
+import { LicenseError } from "./errors.js";
+import { isLicenseFeature } from "./features.js";
+const keyCache = new Map();
+/**
+ * Verifies a compact JWS signed with ES256.
+ * The private key is not present in this package. A token that fails this check
+ * cannot grant entitlements, including a token that only says `isPremium: true`.
+ */
+export async function verifyLicenseToken(token, options) {
+    const parts = token.split(".");
+    if (parts.length !== 3 || parts.some((part) => part.length === 0)) {
+        return rejected("malformed", "The license token is not a signed token.");
+    }
+    const [encodedHeader, encodedPayload, encodedSignature] = parts;
+    let header;
+    let payload;
+    try {
+        header = JSON.parse(utf8String(decodeBase64Url(encodedHeader)));
+        payload = JSON.parse(utf8String(decodeBase64Url(encodedPayload)));
+    }
+    catch {
+        return rejected("malformed", "The license token is not a signed token.");
+    }
+    if (!isRecord(header) || !isRecord(payload)) {
+        return rejected("malformed", "The license token is not a signed token.");
+    }
+    if (header.alg !== "ES256" || Object.hasOwn(header, "crit")) {
+        return rejected("signature", "The license token algorithm is not accepted.");
+    }
+    const kid = typeof header.kid === "string" ? header.kid : undefined;
+    const key = selectKey(options.keys, kid);
+    if (!key) {
+        return rejected("signature", "The license token was not signed by a configured key.");
+    }
+    let signature;
+    try {
+        signature = decodeBase64Url(encodedSignature);
+    }
+    catch {
+        return rejected("malformed", "The license token is not a signed token.");
+    }
+    const verified = await signatureMatches(key.spki, utf8Bytes(`${encodedHeader}.${encodedPayload}`), signature);
+    if (!verified) {
+        return rejected("signature", "The license token signature is not valid.");
+    }
+    return readClaims(payload, options);
+}
+async function signatureMatches(spki, data, signature) {
+    const subtle = globalThis.crypto?.subtle;
+    if (!subtle) {
+        throw new LicenseError("unavailable_runtime", "This runtime cannot verify license signatures.");
+    }
+    let key;
+    try {
+        key = await importPublicKey(subtle, spki);
+    }
+    catch (error) {
+        if (error instanceof LicenseError) {
+            throw error;
+        }
+        return false;
+    }
+    try {
+        return await subtle.verify({ name: "ECDSA", hash: "SHA-256" }, key, arrayBuffer(signature), arrayBuffer(data));
+    }
+    catch {
+        return false;
+    }
+}
+async function importPublicKey(subtle, spki) {
+    const cached = keyCache.get(spki);
+    if (cached) {
+        return cached;
+    }
+    const bytes = decodeKeyBytes(spki);
+    const key = await subtle.importKey("spki", arrayBuffer(bytes), { name: "ECDSA", namedCurve: "P-256" }, false, ["verify"]);
+    keyCache.set(spki, key);
+    return key;
+}
+function arrayBuffer(bytes) {
+    const copy = new ArrayBuffer(bytes.byteLength);
+    new Uint8Array(copy).set(bytes);
+    return copy;
+}
+function decodeKeyBytes(value) {
+    const compact = value.replace(/\s+/gu, "").replace(/=+$/u, "").replaceAll("+", "-").replaceAll("/", "_");
+    return decodeBase64Url(compact);
+}
+function selectKey(keys, kid) {
+    if (kid) {
+        return keys.find((key) => key.kid === kid);
+    }
+    return keys.length === 1 ? keys[0] : undefined;
+}
+function readClaims(payload, options) {
+    const issuer = readString(payload, "iss");
+    const product = readString(payload, "product");
+    const expiresAt = readNumber(payload, "exp");
+    const audience = readAudience(payload);
+    if (!issuer || !product || expiresAt === undefined || audience.length === 0) {
+        return rejected("claims", "The license token is missing required claims.");
+    }
+    if (issuer !== options.issuer || product !== options.productId || !audience.includes(options.audience)) {
+        return rejected("claims", "The license token does not match this product.");
+    }
+    const entitlementResult = readEntitlements(payload);
+    if (!entitlementResult) {
+        return rejected("claims", "The license token entitlements are not a list of features.");
+    }
+    const notBefore = readOptionalNumber(payload, "nbf");
+    const claims = {
+        issuer,
+        audience,
+        expiresAt,
+        notBefore,
+        product,
+        entitlements: entitlementResult.features,
+        unrecognizedEntitlements: entitlementResult.unrecognized,
+        plan: readOptionalString(payload, "plan"),
+        tokenId: readOptionalString(payload, "jti"),
+        subject: readOptionalString(payload, "sub"),
+    };
+    const now = Math.floor(options.now.getTime() / 1000);
+    if (notBefore !== undefined && notBefore > now + options.clockSkewSeconds) {
+        return rejected("claims", "The license token is not valid yet.", claims);
+    }
+    if (expiresAt <= now - options.clockSkewSeconds) {
+        return rejected("expired", "The license token has expired.", claims);
+    }
+    if (claims.tokenId !== undefined && options.revokedTokenIds.includes(claims.tokenId)) {
+        return rejected("revoked", "The license token has been revoked.", claims);
+    }
+    return { ok: true, claims };
+}
+function readEntitlements(payload) {
+    if (!Object.hasOwn(payload, "entitlements")) {
+        return { features: [], unrecognized: [] };
+    }
+    const value = payload.entitlements;
+    if (!Array.isArray(value)) {
+        return undefined;
+    }
+    const features = [];
+    const unrecognized = [];
+    for (const entry of value) {
+        if (typeof entry !== "string") {
+            return undefined;
+        }
+        if (isLicenseFeature(entry)) {
+            features.push(entry);
+        }
+        else {
+            unrecognized.push(entry);
+        }
+    }
+    return { features, unrecognized };
+}
+function readAudience(payload) {
+    const value = payload.aud;
+    if (typeof value === "string" && value.length > 0) {
+        return [value];
+    }
+    if (!Array.isArray(value) || value.length === 0 || value.some((entry) => typeof entry !== "string" || entry.length === 0)) {
+        return [];
+    }
+    return value;
+}
+function readString(record, key) {
+    const value = record[key];
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+function readOptionalString(record, key) {
+    if (!Object.hasOwn(record, key)) {
+        return undefined;
+    }
+    return readString(record, key);
+}
+function readNumber(record, key) {
+    const value = record[key];
+    return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+}
+function readOptionalNumber(record, key) {
+    if (!Object.hasOwn(record, key)) {
+        return undefined;
+    }
+    return readNumber(record, key);
+}
+function rejected(reason, message, claims) {
+    return claims ? { ok: false, reason, message, claims } : { ok: false, reason, message };
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//# sourceMappingURL=token.js.map