@baruk/core 0.1.0 → 0.2.0

package/dist/cjs/db/seed.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * Seed do tenant fundador — SC Organização Contábil (tenant 0001).
+ *
+ * Princípio inegociável (01-multi-tenancy §6): a SC nasce como um tenant COMUM,
+ * SEM hardcode estrutural. Este script apenas materializa dados; nenhum `if
+ * (tenant === 'SC')` existe no código de produção.
+ *
+ * Dados legais não confirmados (CNPJ, CRC, sócios) permanecem NULOS — nunca
+ * inventados. Apenas um usuário administrador de DESENVOLVIMENTO é criado.
+ *
+ * Idempotente. Uso: `pnpm db:seed`.
+ */
+const index_js_1 = require("../index.js");
+async function main() {
+    (0, index_js_1.loadEnv)();
+    const ownerUrl = process.env.DATABASE_URL;
+    if (!ownerUrl)
+        throw new Error('DATABASE_URL (papel owner) não definida.');
+    const adminPassword = process.env.SEED_ADMIN_PASSWORD;
+    if (!adminPassword)
+        throw new Error('SEED_ADMIN_PASSWORD não definida.');
+    const db = (0, index_js_1.createDb)(ownerUrl, { role: 'owner', max: 1 });
+    try {
+        // 1) Catálogos globais: RBAC + produtos do ecossistema.
+        await (0, index_js_1.ensureRbacCatalog)(db);
+        await (0, index_js_1.ensureProductCatalog)(db);
+        console.log('✓ Catálogos garantidos (RBAC + produtos do ecossistema).');
+        // 2) Tenant fundador SC — dados legais não confirmados ficam NULOS.
+        const tenantId = await (0, index_js_1.ensureTenant)(db, {
+            code: 'sc',
+            displayName: 'SC Organização Contábil',
+            legalName: null, // Razão social/CNPJ não confirmados — jamais inventar.
+            status: 'active',
+            primaryProduct: 'contabil',
+        });
+        console.log(`✓ Tenant SC garantido: ${tenantId}`);
+        // 3) Organização/unidade default + entitlement do produto Contábil.
+        await (0, index_js_1.ensureOrganization)(db, tenantId, 'Matriz');
+        await (0, index_js_1.ensureTenantProduct)(db, tenantId, 'contabil');
+        console.log('✓ Entitlement do produto Baruk Contábil concedido à SC.');
+        // 4) Usuário administrador de DESENVOLVIMENTO (não é dado real de sócio).
+        const adminEmail = 'admin@sc.baruk.dev';
+        const admin = await (0, index_js_1.upsertUserWithPassword)(db, {
+            email: adminEmail,
+            fullName: 'Administrador SC (dev)',
+            password: adminPassword,
+            userType: 'staff',
+        });
+        console.log(`✓ Usuário admin (dev) garantido: ${admin.email}`);
+        // 5) Vínculo + papel Owner.
+        await (0, index_js_1.ensureMembership)(db, tenantId, admin.id);
+        await (0, index_js_1.assignSystemRole)(db, tenantId, admin.id, 'owner');
+        console.log('✓ Membership + papel Owner atribuídos ao admin no tenant SC.');
+        // 6) Catálogo de planos do SaaS (BILL-01) — idempotente.
+        await (0, index_js_1.seedSaasPlans)(db);
+        console.log('✓ Catálogo de planos SaaS garantido (starter/pro/enterprise/pro-anual).');
+        console.log('\n✓ Seed concluído. Login dev: admin@sc.baruk.dev / (SEED_ADMIN_PASSWORD)');
+    }
+    finally {
+        await db.end({ timeout: 5 });
+    }
+}
+main().catch((err) => {
+    console.error('✗ Falha no seed:', err instanceof Error ? err.message : err);
+    process.exit(1);
+});
+//# sourceMappingURL=seed.js.map

package/dist/cjs/db/seed.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed.js","sourceRoot":"","sources":["../../../src/db/seed.ts"],"names":[],"mappings":";;AAAA;;;;;;;;;;;GAWG;AACH,0CAYqB;AAErB,KAAK,UAAU,IAAI;IACjB,IAAA,kBAAO,GAAE,CAAC;IACV,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC1C,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC3E,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACtD,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAEzE,MAAM,EAAE,GAAG,IAAA,mBAAQ,EAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,wDAAwD;QACxD,MAAM,IAAA,4BAAiB,EAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,IAAA,+BAAoB,EAAC,EAAE,CAAC,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;QAExE,oEAAoE;QACpE,MAAM,QAAQ,GAAG,MAAM,IAAA,uBAAY,EAAC,EAAE,EAAE;YACtC,IAAI,EAAE,IAAI;YACV,WAAW,EAAE,yBAAyB;YACtC,SAAS,EAAE,IAAI,EAAE,uDAAuD;YACxE,MAAM,EAAE,QAAQ;YAChB,cAAc,EAAE,UAAU;SAC3B,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,0BAA0B,QAAQ,EAAE,CAAC,CAAC;QAElD,oEAAoE;QACpE,MAAM,IAAA,6BAAkB,EAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjD,MAAM,IAAA,8BAAmB,EAAC,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;QAEvE,0EAA0E;QAC1E,MAAM,UAAU,GAAG,oBAAoB,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,IAAA,iCAAsB,EAAC,EAAE,EAAE;YAC7C,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,wBAAwB;YAClC,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,oCAAoC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAE/D,4BAA4B;QAC5B,MAAM,IAAA,2BAAgB,EAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QAC/C,MAAM,IAAA,2BAAgB,EAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;QAE5E,yDAAyD;QACzD,MAAM,IAAA,wBAAa,EAAC,EAAE,CAAC,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;QAEvF,OAAO,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;IAC3F,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/cjs/entitlements/decision.js

@@ -0,0 +1,203 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ENTITLEMENTS_CONTRACT_VERSION = void 0;
+exports.getEffectiveEntitlements = getEffectiveEntitlements;
+exports.getLimits = getLimits;
+exports.explainDecision = explainDecision;
+exports.can = can;
+const sources_js_1 = require("./sources.js");
+const standing_js_1 = require("./standing.js");
+/**
+ * Decision API canônica (contrato 1.0.0 — ENTITLEMENTS_CONTRACT_SPEC_2026-07-27.md
+ * §8-§10, §14). EXTENSÃO/facade sobre `deriveEntitlements`/`hasActiveEntitlement`
+ * (`derive.ts`, intactas) — pura, determinística, sem DB/rede/NestJS/mvb. Todos
+ * os fatos externos (standing, limites, uso, flag operacional) são injetados
+ * pelo consumidor via `EntitlementContext` — nunca resolvidos aqui.
+ */
+exports.ENTITLEMENTS_CONTRACT_VERSION = '1.0.0';
+/** `moduleCode` normalizado para comparação (trim + lowercase) — §4. Não reescreve os dados persistidos. */
+function normalizeModuleCodeKey(moduleCode) {
+    return moduleCode.trim().toLowerCase();
+}
+function isValidModuleCode(moduleCode) {
+    return /^[a-z][a-z0-9_-]{1,63}$/i.test(moduleCode.trim());
+}
+function isRecordActiveNow(e, now) {
+    if (!e.active)
+        return false;
+    if (e.expiresAt != null && e.expiresAt < now)
+        return false;
+    return true;
+}
+function isExplicitDeny(e) {
+    // BETA é alias legado de MANUAL (§5). O deny explícito deve ser alias-invariante:
+    // avaliar a fonte NORMALIZADA (canonical), nunca o valor bruto persistido — do
+    // contrário um grant BETA + `metadata.deny` escaparia do deny e concederia acesso.
+    return (0, sources_js_1.normalizeEntitlementSource)(e.source).canonical === 'MANUAL' && e.metadata?.deny === true;
+}
+/** Entitlements ativos do subject, isolados por tenant (nunca vaza entre tenants) — §7/§11. */
+function getEffectiveEntitlements(subject, ctx) {
+    if (!subject.tenantId)
+        return [];
+    return ctx.entitlements.filter((e) => e.tenantId === subject.tenantId && isRecordActiveNow(e, ctx.now));
+}
+/** Composição pura de limite declarado + uso injetado — sem medir, sem enforcement (§14). */
+function getLimits(subject, moduleCode, ctx) {
+    if (!subject.tenantId || !ctx.grantedLimits?.length)
+        return [];
+    const key = normalizeModuleCodeKey(moduleCode);
+    return ctx.grantedLimits
+        .filter((g) => normalizeModuleCodeKey(g.moduleCode) === key)
+        .map((definition) => {
+        const usage = ctx.usage?.find((u) => normalizeModuleCodeKey(u.moduleCode) === key && u.limitKey === definition.limitKey);
+        if (definition.value == null) {
+            return { definition, usage, remaining: null };
+        }
+        if (!usage) {
+            return { definition, usage: undefined, remaining: undefined };
+        }
+        return { definition, usage, remaining: definition.value - usage.consumed };
+    });
+}
+/**
+ * Decisão completa e explicável (formaliza `AccessDecision{allowed,reason}` do
+ * mvb, adicionando `reasonCode` estável). Ordem de avaliação (§7/§10/§11):
+ * tenant context → deny explícito → entitlement (ativo/expirado/ausente) →
+ * standing → limite consumível esgotado → flag operacional → allow.
+ */
+function explainDecision(subject, moduleCode, ctx) {
+    const base = {
+        moduleCode,
+        tenantId: subject.tenantId,
+        standing: ctx.standing,
+        policyVersion: exports.ENTITLEMENTS_CONTRACT_VERSION,
+        evaluatedAt: ctx.now,
+    };
+    if (!subject.tenantId || !subject.tenantId.trim()) {
+        return {
+            ...base,
+            allowed: false,
+            reasonCode: 'TENANT_CONTEXT_MISSING',
+            reason: 'tenantId ausente ou vazio — decisão fina nunca cruza tenants',
+            sources: [],
+            effectiveUntil: null,
+        };
+    }
+    if (!isValidModuleCode(moduleCode)) {
+        return {
+            ...base,
+            allowed: false,
+            reasonCode: 'ENTITLEMENT_MISSING',
+            reason: `moduleCode inválido: "${moduleCode}"`,
+            sources: [],
+            effectiveUntil: null,
+        };
+    }
+    // Tenant isolation: só registros do próprio tenant influenciam a decisão (§11).
+    const key = normalizeModuleCodeKey(moduleCode);
+    const tenantRecords = ctx.entitlements.filter((e) => e.tenantId === subject.tenantId);
+    const matching = tenantRecords.filter((e) => normalizeModuleCodeKey(e.moduleCode) === key);
+    const deny = matching.find((e) => isExplicitDeny(e) && isRecordActiveNow(e, ctx.now));
+    if (deny) {
+        return {
+            ...base,
+            allowed: false,
+            reasonCode: 'EXPLICIT_DENY',
+            reason: 'override MANUAL nega explicitamente este módulo',
+            sources: ['MANUAL'],
+            effectiveUntil: deny.expiresAt,
+        };
+    }
+    // FAIL_OPEN_PRIVILEGED: fato explícito injetado (nunca inferido) — ainda assim
+    // respeita um deny explícito (checado acima), mas ignora ausência/expiração.
+    if (ctx.failOpenPrivileged) {
+        return {
+            ...base,
+            allowed: true,
+            reasonCode: 'FAIL_OPEN_PRIVILEGED',
+            reason: 'fail-open: subject privilegiado (fato injetado pelo consumidor)',
+            sources: [],
+            effectiveUntil: null,
+        };
+    }
+    const active = matching.filter((e) => isRecordActiveNow(e, ctx.now));
+    if (active.length === 0) {
+        const hadAnyRecord = matching.length > 0;
+        return {
+            ...base,
+            allowed: false,
+            reasonCode: hadAnyRecord ? 'ENTITLEMENT_EXPIRED' : 'ENTITLEMENT_MISSING',
+            reason: hadAnyRecord
+                ? 'entitlement encontrado mas expirado/inativo'
+                : 'nenhum entitlement para este módulo',
+            sources: [],
+            effectiveUntil: null,
+        };
+    }
+    const normalizedSources = active.map((e) => (0, sources_js_1.normalizeEntitlementSource)(e.source));
+    const winner = normalizedSources.reduce((best, cur) => (0, sources_js_1.sourcePrecedence)(cur) < (0, sources_js_1.sourcePrecedence)(best) ? cur : best);
+    const canonicalSources = Array.from(new Set(normalizedSources
+        .filter((s) => s.canonical != null)
+        .map((s) => s.canonical)));
+    const hasUnboundedGrant = active.some((e) => e.expiresAt == null);
+    const effectiveUntil = hasUnboundedGrant
+        ? null
+        : active.reduce((min, e) => (min == null || e.expiresAt < min ? e.expiresAt : min), null);
+    if (!(0, standing_js_1.isStandingOk)(ctx.standing)) {
+        return {
+            ...base,
+            allowed: false,
+            reasonCode: 'SUBSCRIPTION_BLOCKED',
+            reason: ctx.standing.reasonCode === 'SUBSCRIPTION_RESTRICTED'
+                ? 'standing restrito'
+                : 'standing bloqueado',
+            sources: canonicalSources,
+            effectiveUntil,
+        };
+    }
+    if (ctx.standing.accessLevel === 'RESTRICTED') {
+        return {
+            ...base,
+            allowed: false,
+            reasonCode: 'SUBSCRIPTION_RESTRICTED',
+            reason: 'standing restrito: módulo bloqueado para read/core-only',
+            sources: canonicalSources,
+            effectiveUntil,
+        };
+    }
+    const limits = getLimits(subject, moduleCode, ctx);
+    const exhausted = limits.find((l) => l.definition.value != null && l.remaining != null && l.remaining <= 0);
+    if (exhausted) {
+        return {
+            ...base,
+            allowed: false,
+            reasonCode: 'LIMIT_REACHED',
+            reason: `limite "${exhausted.definition.limitKey}" esgotado`,
+            sources: canonicalSources,
+            effectiveUntil,
+        };
+    }
+    if (ctx.operationalFlag === false) {
+        return {
+            ...base,
+            allowed: false,
+            reasonCode: 'FEATURE_DISABLED_OPERATIONALLY',
+            reason: 'kill-switch operacional desabilitado para este módulo',
+            sources: canonicalSources,
+            effectiveUntil,
+        };
+    }
+    return {
+        ...base,
+        allowed: true,
+        reasonCode: 'ENTITLEMENT_ACTIVE',
+        reason: `allowed via ${winner.canonical ?? 'unknown source'}`,
+        sources: canonicalSources,
+        effectiveUntil,
+    };
+}
+/** Facade booleana — composição de `explainDecision` (§8). */
+function can(subject, moduleCode, ctx) {
+    return explainDecision(subject, moduleCode, ctx).allowed;
+}
+//# sourceMappingURL=decision.js.map

package/dist/cjs/entitlements/decision.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decision.js","sourceRoot":"","sources":["../../../src/entitlements/decision.ts"],"names":[],"mappings":";;;AAsHA,4DAQC;AAGD,8BAqBC;AAQD,0CA6JC;AAGD,kBAMC;AAnUD,6CAA4E;AAC5E,+CAAwE;AAExE;;;;;;GAMG;AAEU,QAAA,6BAA6B,GAAG,OAAO,CAAC;AAmFrD,4GAA4G;AAC5G,SAAS,sBAAsB,CAAC,UAAkB;IAChD,OAAO,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,iBAAiB,CAAC,UAAkB;IAC3C,OAAO,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAoB,EAAE,GAAW;IAC1D,IAAI,CAAC,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5B,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC;IAC3D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc,CAAC,CAAoB;IAC1C,kFAAkF;IAClF,+EAA+E;IAC/E,mFAAmF;IACnF,OAAO,IAAA,uCAA0B,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,EAAE,IAAI,KAAK,IAAI,CAAC;AAClG,CAAC;AAED,+FAA+F;AAC/F,SAAgB,wBAAwB,CACtC,OAA2B,EAC3B,GAAuB;IAEvB,IAAI,CAAC,OAAO,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjC,OAAO,GAAG,CAAC,YAAY,CAAC,MAAM,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,IAAI,iBAAiB,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,6FAA6F;AAC7F,SAAgB,SAAS,CACvB,OAA2B,EAC3B,UAAkB,EAClB,GAAuB;IAEvB,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM;QAAE,OAAO,EAAE,CAAC;IAC/D,MAAM,GAAG,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAC/C,OAAO,GAAG,CAAC,aAAa;SACrB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC;SAC3D,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;QAClB,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,EAAE,IAAI,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ,CAC1F,CAAC;QACF,IAAI,UAAU,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;YAC7B,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAChD,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;QAChE,CAAC;QACD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC7E,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;;;GAKG;AACH,SAAgB,eAAe,CAC7B,OAA2B,EAC3B,UAAkB,EAClB,GAAuB;IAEvB,MAAM,IAAI,GAAG;QACX,UAAU;QACV,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,aAAa,EAAE,qCAA6B;QAC5C,WAAW,EAAE,GAAG,CAAC,GAAG;KACrB,CAAC;IAEF,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAClD,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,KAAK;YACd,UAAU,EAAE,wBAAwB;YACpC,MAAM,EAAE,8DAA8D;YACtE,OAAO,EAAE,EAAE;YACX,cAAc,EAAE,IAAI;SACrB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,EAAE,CAAC;QACnC,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,KAAK;YACd,UAAU,EAAE,qBAAqB;YACjC,MAAM,EAAE,yBAAyB,UAAU,GAAG;YAC9C,OAAO,EAAE,EAAE;YACX,cAAc,EAAE,IAAI;SACrB,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,MAAM,GAAG,GAAG,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAC/C,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC;IAE3F,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACtF,IAAI,IAAI,EAAE,CAAC;QACT,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,KAAK;YACd,UAAU,EAAE,eAAe;YAC3B,MAAM,EAAE,iDAAiD;YACzD,OAAO,EAAE,CAAC,QAAQ,CAAC;YACnB,cAAc,EAAE,IAAI,CAAC,SAAS;SAC/B,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,6EAA6E;IAC7E,IAAI,GAAG,CAAC,kBAAkB,EAAE,CAAC;QAC3B,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,IAAI;YACb,UAAU,EAAE,sBAAsB;YAClC,MAAM,EAAE,iEAAiE;YACzE,OAAO,EAAE,EAAE;YACX,cAAc,EAAE,IAAI;SACrB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QACzC,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,KAAK;YACd,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,qBAAqB;YACxE,MAAM,EAAE,YAAY;gBAClB,CAAC,CAAC,6CAA6C;gBAC/C,CAAC,CAAC,qCAAqC;YACzC,OAAO,EAAE,EAAE;YACX,cAAc,EAAE,IAAI;SACrB,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,uCAA0B,EAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CACpD,IAAA,6BAAgB,EAAC,GAAG,CAAC,GAAG,IAAA,6BAAgB,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAC5D,CAAC;IACF,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CACjC,IAAI,GAAG,CACL,iBAAiB;SACd,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC;SAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAA8B,CAAC,CAChD,CACF,CAAC;IACF,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;IAClE,MAAM,cAAc,GAAG,iBAAiB;QACtC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,MAAM,CAAC,MAAM,CACX,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,SAAU,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAU,CAAC,CAAC,CAAC,GAAG,CAAC,EACpE,IAAI,CACL,CAAC;IAEN,IAAI,CAAC,IAAA,0BAAY,EAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,KAAK;YACd,UAAU,EAAE,sBAAsB;YAClC,MAAM,EACJ,GAAG,CAAC,QAAQ,CAAC,UAAU,KAAK,yBAAyB;gBACnD,CAAC,CAAC,mBAAmB;gBACrB,CAAC,CAAC,oBAAoB;YAC1B,OAAO,EAAE,gBAAgB;YACzB,cAAc;SACf,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,KAAK,YAAY,EAAE,CAAC;QAC9C,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,KAAK;YACd,UAAU,EAAE,yBAAyB;YACrC,MAAM,EAAE,yDAAyD;YACjE,OAAO,EAAE,gBAAgB;YACzB,cAAc;SACf,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAC3B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC,CAC7E,CAAC;IACF,IAAI,SAAS,EAAE,CAAC;QACd,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,KAAK;YACd,UAAU,EAAE,eAAe;YAC3B,MAAM,EAAE,WAAW,SAAS,CAAC,UAAU,CAAC,QAAQ,YAAY;YAC5D,OAAO,EAAE,gBAAgB;YACzB,cAAc;SACf,CAAC;IACJ,CAAC;IAED,IAAI,GAAG,CAAC,eAAe,KAAK,KAAK,EAAE,CAAC;QAClC,OAAO;YACL,GAAG,IAAI;YACP,OAAO,EAAE,KAAK;YACd,UAAU,EAAE,gCAAgC;YAC5C,MAAM,EAAE,uDAAuD;YAC/D,OAAO,EAAE,gBAAgB;YACzB,cAAc;SACf,CAAC;IACJ,CAAC;IAED,OAAO;QACL,GAAG,IAAI;QACP,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,oBAAoB;QAChC,MAAM,EAAE,eAAe,MAAM,CAAC,SAAS,IAAI,gBAAgB,EAAE;QAC7D,OAAO,EAAE,gBAAgB;QACzB,cAAc;KACf,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,SAAgB,GAAG,CACjB,OAA2B,EAC3B,UAAkB,EAClB,GAAuB;IAEvB,OAAO,eAAe,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC;AAC3D,CAAC"}

package/dist/cjs/entitlements/derive.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deriveEntitlements = deriveEntitlements;
+exports.hasActiveEntitlement = hasActiveEntitlement;
+/**
+ * Resolve o próximo estado de entitlements: ativa o que está no alvo (preserva
+ * `grantedAt` original se já existia), desativa (soft-disable) o que não está
+ * mais no alvo. Concessões expiradas (`expiresAt < now`) nunca entram ativas.
+ */
+function deriveEntitlements(input) {
+    const { tenantId, subscriptionId, targetGrants, current, now } = input;
+    const currentByModule = new Map(current.map((e) => [e.moduleCode, e]));
+    const targetCodes = new Set(targetGrants.map((g) => g.moduleCode));
+    const next = [];
+    for (const grant of targetGrants) {
+        const isExpired = grant.expiresAt != null && grant.expiresAt < now;
+        const existing = currentByModule.get(grant.moduleCode);
+        next.push({
+            tenantId,
+            subscriptionId,
+            moduleCode: grant.moduleCode,
+            source: grant.source,
+            active: !isExpired,
+            expiresAt: grant.expiresAt,
+            grantedAt: existing?.grantedAt ?? now,
+            metadata: existing?.metadata,
+        });
+    }
+    // Módulos que o tenant tinha e não estão mais no alvo → soft-disable (nunca remove o registro).
+    for (const existing of current) {
+        if (!targetCodes.has(existing.moduleCode)) {
+            next.push({ ...existing, active: false });
+        }
+    }
+    return next;
+}
+/** True se o tenant tem o módulo ativo agora (lookup rápido, mesmo padrão do `manga-verde-bi/access`). */
+function hasActiveEntitlement(entitlements, moduleCode, now) {
+    const e = entitlements.find((x) => x.moduleCode === moduleCode);
+    if (!e || !e.active)
+        return false;
+    if (e.expiresAt != null && e.expiresAt < now)
+        return false;
+    return true;
+}
+//# sourceMappingURL=derive.js.map

package/dist/cjs/entitlements/derive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"derive.js","sourceRoot":"","sources":["../../../src/entitlements/derive.ts"],"names":[],"mappings":";;AA8BA,gDA8BC;AAGD,oDASC;AA/CD;;;;GAIG;AACH,SAAgB,kBAAkB,CAAC,KAA8B;IAC/D,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IACvE,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IAEnE,MAAM,IAAI,GAAwB,EAAE,CAAC;IAErC,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC;QACnE,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,CAAC;YACR,QAAQ;YACR,cAAc;YACd,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,MAAM,EAAE,CAAC,SAAS;YAClB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,GAAG;YACrC,QAAQ,EAAE,QAAQ,EAAE,QAAQ;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,gGAAgG;IAChG,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;QAC/B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0GAA0G;AAC1G,SAAgB,oBAAoB,CAClC,YAAiC,EACjC,UAAkB,EAClB,GAAW;IAEX,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,UAAU,CAAC,CAAC;IAChE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAClC,IAAI,CAAC,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG;QAAE,OAAO,KAAK,CAAC;IAC3D,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cjs/entitlements/index.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getLimits = exports.getEffectiveEntitlements = exports.explainDecision = exports.can = exports.ENTITLEMENTS_CONTRACT_VERSION = exports.isStandingOk = exports.normalizeSubscriptionStanding = exports.sourcePrecedence = exports.normalizeEntitlementSource = exports.LEGACY_SOURCE_ALIAS = exports.CANONICAL_ENTITLEMENT_SOURCES = exports.hasActiveEntitlement = exports.deriveEntitlements = void 0;
+var derive_js_1 = require("./derive.js");
+Object.defineProperty(exports, "deriveEntitlements", { enumerable: true, get: function () { return derive_js_1.deriveEntitlements; } });
+Object.defineProperty(exports, "hasActiveEntitlement", { enumerable: true, get: function () { return derive_js_1.hasActiveEntitlement; } });
+// Contrato canônico 1.0.0 (P2 — Core Contract Alignment, ENTITLEMENTS_CONTRACT_SPEC_2026-07-27.md).
+// Extensão aditiva: deriveEntitlements/hasActiveEntitlement acima permanecem intactas.
+var sources_js_1 = require("./sources.js");
+Object.defineProperty(exports, "CANONICAL_ENTITLEMENT_SOURCES", { enumerable: true, get: function () { return sources_js_1.CANONICAL_ENTITLEMENT_SOURCES; } });
+Object.defineProperty(exports, "LEGACY_SOURCE_ALIAS", { enumerable: true, get: function () { return sources_js_1.LEGACY_SOURCE_ALIAS; } });
+Object.defineProperty(exports, "normalizeEntitlementSource", { enumerable: true, get: function () { return sources_js_1.normalizeEntitlementSource; } });
+Object.defineProperty(exports, "sourcePrecedence", { enumerable: true, get: function () { return sources_js_1.sourcePrecedence; } });
+var standing_js_1 = require("./standing.js");
+Object.defineProperty(exports, "normalizeSubscriptionStanding", { enumerable: true, get: function () { return standing_js_1.normalizeSubscriptionStanding; } });
+Object.defineProperty(exports, "isStandingOk", { enumerable: true, get: function () { return standing_js_1.isStandingOk; } });
+var decision_js_1 = require("./decision.js");
+Object.defineProperty(exports, "ENTITLEMENTS_CONTRACT_VERSION", { enumerable: true, get: function () { return decision_js_1.ENTITLEMENTS_CONTRACT_VERSION; } });
+Object.defineProperty(exports, "can", { enumerable: true, get: function () { return decision_js_1.can; } });
+Object.defineProperty(exports, "explainDecision", { enumerable: true, get: function () { return decision_js_1.explainDecision; } });
+Object.defineProperty(exports, "getEffectiveEntitlements", { enumerable: true, get: function () { return decision_js_1.getEffectiveEntitlements; } });
+Object.defineProperty(exports, "getLimits", { enumerable: true, get: function () { return decision_js_1.getLimits; } });
+//# sourceMappingURL=index.js.map

package/dist/cjs/entitlements/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/entitlements/index.ts"],"names":[],"mappings":";;;AAIA,yCAAuE;AAA9D,+GAAA,kBAAkB,OAAA;AAAE,iHAAA,oBAAoB,OAAA;AAEjD,oGAAoG;AACpG,uFAAuF;AACvF,2CAKsB;AAJpB,2HAAA,6BAA6B,OAAA;AAC7B,iHAAA,mBAAmB,OAAA;AACnB,wHAAA,0BAA0B,OAAA;AAC1B,8GAAA,gBAAgB,OAAA;AAGlB,6CAA4E;AAAnE,4HAAA,6BAA6B,OAAA;AAAE,2GAAA,YAAY,OAAA;AAEpD,6CAMuB;AALrB,4HAAA,6BAA6B,OAAA;AAC7B,kGAAA,GAAG,OAAA;AACH,8GAAA,eAAe,OAAA;AACf,uHAAA,wBAAwB,OAAA;AACxB,wGAAA,SAAS,OAAA"}

package/dist/cjs/entitlements/sources.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LEGACY_SOURCE_ALIAS = exports.CANONICAL_ENTITLEMENT_SOURCES = void 0;
+exports.normalizeEntitlementSource = normalizeEntitlementSource;
+exports.sourcePrecedence = sourcePrecedence;
+/**
+ * Fontes canônicas (contrato 1.0.0 — ENTITLEMENTS_CONTRACT_SPEC_2026-07-27.md §5).
+ * Superset das 6 já existentes em `types.ts` — nenhuma removida, nenhuma renomeada.
+ */
+exports.CANONICAL_ENTITLEMENT_SOURCES = [
+    'PLAN',
+    'ADDON',
+    'COUPON',
+    'CAMPAIGN',
+    'MANUAL',
+    'FEATURE_FLAG',
+];
+/** Alias legado (mvb `Entitlement.source = 'BETA'`) — nunca reescrito em massa. */
+exports.LEGACY_SOURCE_ALIAS = 'BETA';
+/**
+ * Ordem de precedência canônica, maior→menor (§10): `MANUAL > FEATURE_FLAG >
+ * ADDON > CAMPAIGN/COUPON > PLAN`. `CAMPAIGN` e `COUPON` são o mesmo nível
+ * (grupo "CAMPAIGN/COUPON" no contrato) — nunca uma prevalece sobre a outra
+ * por precedência; ambas concedem, ambas aparecem em `sources`. Índice menor
+ * = mais forte.
+ */
+const PRECEDENCE_TIERS = [
+    ['MANUAL'],
+    ['FEATURE_FLAG'],
+    ['ADDON'],
+    ['CAMPAIGN', 'COUPON'],
+    ['PLAN'],
+];
+/** Fonte desconhecida (forward-compat) recebe esta precedência — mínima, abaixo de PLAN. */
+const UNKNOWN_SOURCE_PRECEDENCE = PRECEDENCE_TIERS.length;
+/**
+ * Normaliza uma fonte bruta (persistida) para o conjunto canônico.
+ * - `BETA` → `MANUAL` + `legacySource: "BETA"` (compat, sem migração destrutiva).
+ * - Valor canônico → passthrough.
+ * - Valor desconhecido (forward-compat) → `canonical: null`, `isUnknown: true`; o
+ *   grant continua sendo honrado se `active`, mas nunca finge ser uma fonte
+ *   canônica — evita ganhar autoridade por acidente (§5/§10 da Contract Spec).
+ */
+function normalizeEntitlementSource(raw) {
+    if (raw === exports.LEGACY_SOURCE_ALIAS) {
+        return { raw, canonical: 'MANUAL', isUnknown: false, legacySource: exports.LEGACY_SOURCE_ALIAS };
+    }
+    if (exports.CANONICAL_ENTITLEMENT_SOURCES.includes(raw)) {
+        return { raw, canonical: raw, isUnknown: false };
+    }
+    return { raw, canonical: null, isUnknown: true };
+}
+/** Precedência de uma fonte normalizada — menor valor = mais forte; desconhecida = mínima. */
+function sourcePrecedence(source) {
+    if (source.isUnknown || source.canonical == null)
+        return UNKNOWN_SOURCE_PRECEDENCE;
+    const tierIdx = PRECEDENCE_TIERS.findIndex((tier) => tier.includes(source.canonical));
+    return tierIdx === -1 ? UNKNOWN_SOURCE_PRECEDENCE : tierIdx;
+}
+//# sourceMappingURL=sources.js.map

package/dist/cjs/entitlements/sources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sources.js","sourceRoot":"","sources":["../../../src/entitlements/sources.ts"],"names":[],"mappings":";;;AAuDA,gEAQC;AAGD,4CAMC;AAtED;;;GAGG;AACU,QAAA,6BAA6B,GAAiC;IACzE,MAAM;IACN,OAAO;IACP,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,cAAc;CACf,CAAC;AAEF,mFAAmF;AACtE,QAAA,mBAAmB,GAAG,MAAM,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,gBAAgB,GAA8C;IAClE,CAAC,QAAQ,CAAC;IACV,CAAC,cAAc,CAAC;IAChB,CAAC,OAAO,CAAC;IACT,CAAC,UAAU,EAAE,QAAQ,CAAC;IACtB,CAAC,MAAM,CAAC;CACT,CAAC;AAEF,4FAA4F;AAC5F,MAAM,yBAAyB,GAAG,gBAAgB,CAAC,MAAM,CAAC;AAa1D;;;;;;;GAOG;AACH,SAAgB,0BAA0B,CAAC,GAAW;IACpD,IAAI,GAAG,KAAK,2BAAmB,EAAE,CAAC;QAChC,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,2BAAmB,EAAE,CAAC;IAC3F,CAAC;IACD,IAAK,qCAAmD,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,GAAwB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACxE,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACnD,CAAC;AAED,8FAA8F;AAC9F,SAAgB,gBAAgB,CAAC,MAAwB;IACvD,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI;QAAE,OAAO,yBAAyB,CAAC;IACnF,MAAM,OAAO,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CACjD,IAA0B,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAmB,CAAC,CACjE,CAAC;IACF,OAAO,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,OAAO,CAAC;AAC9D,CAAC"}

package/dist/cjs/entitlements/standing.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeSubscriptionStanding = normalizeSubscriptionStanding;
+exports.isStandingOk = isStandingOk;
+/**
+ * Mapeamento status → accessLevel (mvb 7 valores + core 5 valores).
+ * Desconhecido → BLOCKED (fail-closed — regra de segurança, nunca afrouxa por omissão).
+ */
+const STATUS_TO_STANDING = {
+    // mvb (SubscriptionStatus do Prisma) + core (subscription-billing) — case-sensitive, ambos os vocabulários.
+    TRIALING: { accessLevel: 'FULL', reasonCode: 'ENTITLEMENT_ACTIVE' },
+    trialing: { accessLevel: 'FULL', reasonCode: 'ENTITLEMENT_ACTIVE' },
+    ACTIVE: { accessLevel: 'FULL', reasonCode: 'ENTITLEMENT_ACTIVE' },
+    active: { accessLevel: 'FULL', reasonCode: 'ENTITLEMENT_ACTIVE' },
+    PAST_DUE: { accessLevel: 'FULL', reasonCode: 'ENTITLEMENT_ACTIVE' },
+    past_due: { accessLevel: 'FULL', reasonCode: 'ENTITLEMENT_ACTIVE' },
+    RESTRICTED: { accessLevel: 'RESTRICTED', reasonCode: 'SUBSCRIPTION_RESTRICTED' },
+    SUSPENDED: { accessLevel: 'BLOCKED', reasonCode: 'SUBSCRIPTION_BLOCKED' },
+    CANCELED: { accessLevel: 'BLOCKED', reasonCode: 'SUBSCRIPTION_BLOCKED' },
+    canceled: { accessLevel: 'BLOCKED', reasonCode: 'SUBSCRIPTION_BLOCKED' },
+    EXPIRED: { accessLevel: 'BLOCKED', reasonCode: 'SUBSCRIPTION_BLOCKED' },
+    paused: { accessLevel: 'BLOCKED', reasonCode: 'SUBSCRIPTION_BLOCKED' },
+    NONE: { accessLevel: 'BLOCKED', reasonCode: 'SUBSCRIPTION_BLOCKED' },
+};
+/**
+ * Normaliza um status de assinatura (mvb ou core) para o `SubscriptionStanding`
+ * canônico. Puro — nenhuma máquina de estados, nenhum I/O. Status desconhecido
+ * (incluindo ausente/vazio) → BLOCKED (fail-closed, §6 da Contract Spec).
+ */
+function normalizeSubscriptionStanding(status) {
+    const key = status ?? 'NONE';
+    const mapped = STATUS_TO_STANDING[key];
+    if (!mapped) {
+        return { accessLevel: 'BLOCKED', statusCanonical: key, reasonCode: 'SUBSCRIPTION_BLOCKED' };
+    }
+    return { accessLevel: mapped.accessLevel, statusCanonical: key, reasonCode: mapped.reasonCode };
+}
+/** `standingOk` — mesma regra já usada pelo mvb (`accessLevel !== 'BLOCKED'`), ratificada no contrato. */
+function isStandingOk(standing) {
+    return standing.accessLevel !== 'BLOCKED';
+}
+//# sourceMappingURL=standing.js.map

package/dist/cjs/entitlements/standing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"standing.js","sourceRoot":"","sources":["../../../src/entitlements/standing.ts"],"names":[],"mappings":";;AA0CA,sEASC;AAGD,oCAEC;AAxCD;;;GAGG;AACH,MAAM,kBAAkB,GAAyE;IAC/F,4GAA4G;IAC5G,QAAQ,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,EAAE;IACnE,QAAQ,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,EAAE;IACnE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,EAAE;IACjE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,EAAE;IACjE,QAAQ,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,EAAE;IACnE,QAAQ,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,oBAAoB,EAAE;IACnE,UAAU,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,yBAAyB,EAAE;IAChF,SAAS,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,sBAAsB,EAAE;IACzE,QAAQ,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,sBAAsB,EAAE;IACxE,QAAQ,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,sBAAsB,EAAE;IACxE,OAAO,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,sBAAsB,EAAE;IACvE,MAAM,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,sBAAsB,EAAE;IACtE,IAAI,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,sBAAsB,EAAE;CACrE,CAAC;AAEF;;;;GAIG;AACH,SAAgB,6BAA6B,CAC3C,MAAiC;IAEjC,MAAM,GAAG,GAAG,MAAM,IAAI,MAAM,CAAC;IAC7B,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,EAAE,UAAU,EAAE,sBAAsB,EAAE,CAAC;IAC9F,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,eAAe,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;AAClG,CAAC;AAED,0GAA0G;AAC1G,SAAgB,YAAY,CAAC,QAA8B;IACzD,OAAO,QAAQ,CAAC,WAAW,KAAK,SAAS,CAAC;AAC5C,CAAC"}

package/dist/cjs/entitlements/types.js

@@ -0,0 +1,16 @@
+"use strict";
+/**
+ * Entitlements (finos) — contrato canônico (Track A1, RFC-CAPABILITY-
+ * COMMERCIAL-CATALOG-001 §6). Domínio PURO — sem DB, sem `Date.now()` interno.
+ *
+ * Distinção dura (nunca confundir — achado Reality-First, §25 do modelo):
+ * - Entitlement FINO (este módulo) = "o tenant contratou o módulo X" — deriva
+ *   da Offer/Subscription, é o que este pacote resolve.
+ * - Entitlement GROSSO (`product`/`tenant_product`, já em produção no
+ *   `baruk-platform`, migração `0010_product_entitlements.sql`) = "o tenant
+ *   pode abrir este PRODUTO" (IAM). É uma camada DIFERENTE, anterior a esta —
+ *   o Hub bloqueia o produto pelo grosso; DENTRO do produto, o fino decide
+ *   quais módulos/capacidades aparecem. Este módulo nunca substitui aquele.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/cjs/entitlements/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/entitlements/types.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG"}

package/dist/cjs/import/clients-import.js

@@ -0,0 +1,147 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseClientsCsv = parseClientsCsv;
+exports.planImport = planImport;
+exports.commitImport = commitImport;
+const repository_js_1 = require("../clients/repository.js");
+const HEADER_ALIASES = {
+    nome: 'displayName',
+    display_name: 'displayName',
+    razao_social: 'displayName',
+    documento: 'documentNumber',
+    document_number: 'documentNumber',
+    cnpj: 'documentNumber',
+    cpf: 'documentNumber',
+    tipo: 'clientType',
+    client_type: 'clientType',
+    email: 'email',
+    telefone: 'phone',
+    phone: 'phone',
+};
+function parseCsvRaw(text) {
+    const rows = [];
+    let field = '';
+    let row = [];
+    let inQuotes = false;
+    const s = text.replace(/\r\n/g, '\n').replace(/\r/g, '\n');
+    for (let i = 0; i < s.length; i++) {
+        const c = s[i];
+        if (inQuotes) {
+            if (c === '"') {
+                if (s[i + 1] === '"') {
+                    field += '"';
+                    i++;
+                }
+                else
+                    inQuotes = false;
+            }
+            else
+                field += c;
+        }
+        else if (c === '"')
+            inQuotes = true;
+        else if (c === ',') {
+            row.push(field);
+            field = '';
+        }
+        else if (c === '\n') {
+            row.push(field);
+            rows.push(row);
+            row = [];
+            field = '';
+        }
+        else
+            field += c;
+    }
+    if (field.length > 0 || row.length > 0) {
+        row.push(field);
+        rows.push(row);
+    }
+    return rows.filter((r) => r.some((cell) => cell.trim() !== ''));
+}
+const onlyDigits = (v) => v.replace(/\D/g, '');
+function parseClientsCsv(text) {
+    const raw = parseCsvRaw(text);
+    const errors = [];
+    if (raw.length === 0)
+        return { rows: [], errors: [{ line: 0, message: 'CSV vazio' }] };
+    const header = raw[0].map((h) => h.trim().toLowerCase());
+    const colMap = header.map((h) => HEADER_ALIASES[h]);
+    if (!colMap.includes('displayName')) {
+        return { rows: [], errors: [{ line: 1, message: 'Cabeçalho sem coluna de nome (nome/display_name)' }] };
+    }
+    const rows = [];
+    for (let i = 1; i < raw.length; i++) {
+        const cells = raw[i];
+        const rec = { line: i + 1, clientType: 'pj' };
+        colMap.forEach((key, idx) => {
+            if (!key)
+                return;
+            const value = (cells[idx] ?? '').trim();
+            if (key === 'documentNumber')
+                rec.documentNumber = value ? onlyDigits(value) : null;
+            else if (key === 'clientType')
+                rec.clientType = value.toLowerCase() === 'pf' ? 'pf' : 'pj';
+            else if (key === 'email')
+                rec.email = value || null;
+            else if (key === 'phone')
+                rec.phone = value || null;
+            else if (key === 'displayName')
+                rec.displayName = value;
+        });
+        if (!rec.displayName) {
+            errors.push({ line: i + 1, message: 'Nome obrigatório ausente' });
+            continue;
+        }
+        if (rec.documentNumber && ![11, 14].includes(rec.documentNumber.length)) {
+            errors.push({ line: i + 1, message: `Documento inválido (${rec.documentNumber.length} dígitos)` });
+            continue;
+        }
+        rows.push({
+            line: i + 1,
+            displayName: rec.displayName,
+            documentNumber: rec.documentNumber ?? null,
+            clientType: rec.clientType ?? 'pj',
+            email: rec.email ?? null,
+            phone: rec.phone ?? null,
+        });
+    }
+    return { rows, errors };
+}
+async function planImport(tx, text) {
+    const { rows, errors } = parseClientsCsv(text);
+    const toCreate = [];
+    const duplicates = [];
+    const seen = new Set();
+    for (const row of rows) {
+        if (row.documentNumber) {
+            if (seen.has(row.documentNumber)) {
+                duplicates.push({ line: row.line, documentNumber: row.documentNumber });
+                continue;
+            }
+            seen.add(row.documentNumber);
+            const existing = await (0, repository_js_1.findClientIdByDocument)(tx, row.documentNumber);
+            if (existing) {
+                duplicates.push({ line: row.line, documentNumber: row.documentNumber });
+                continue;
+            }
+        }
+        toCreate.push(row);
+    }
+    return { total: rows.length, toCreate, duplicates, errors };
+}
+async function commitImport(tx, text, createdBy) {
+    const plan = await planImport(tx, text);
+    let created = 0;
+    for (const row of plan.toCreate) {
+        await (0, repository_js_1.createClient)(tx, {
+            displayName: row.displayName,
+            clientType: row.clientType,
+            documentNumber: row.documentNumber,
+            createdBy: createdBy ?? null,
+        });
+        created++;
+    }
+    return { created, skipped: plan.duplicates.length, errors: plan.errors };
+}
+//# sourceMappingURL=clients-import.js.map