@eminuckan/spine 0.2.4 → 0.3.0

package/CHANGELOG.md

@@ -4,18 +4,31 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+No unreleased changes.
+
+## [0.3.0] - 2026-06-01
+
 ### Added
 
+- Added a public-surface check that blocks private project names and app-specific authorization hints from the public package.
+- Added per-login allowlists for app-specific OIDC authorization parameters and public state UI context.
 - Added Keycloak-compatible back-channel and front-channel logout handlers.
 - Added Redis session indexes by user, OIDC `sid`, and legacy `session_state`.
 - Added session listing and destroy primitives for current-user, all-user, `sid`, and `session_state` cleanup.
 - Added OIDC client authentication method configuration for public and confidential clients.
+- Added generic tenant, identity, permission, access, and API configuration surfaces for custom SaaS backend contracts.
+- Added Vitest coverage for authorization parameters, access evaluation, permissions, tenant state, identity state, and API header configuration.
+- Added React Router SaaS example app, installation docs, adapter docs, roadmap, maintainer notes, and Codex maintenance plan.
+- Added an adapter request issue template for framework and provider integrations.
 
 ### Changed
 
 - Switched server-side auth from direct `oauth4webapi` calls to `openid-client`.
+- Removed built-in product-flow redirects from route protection; consuming apps now own all setup, billing, and tenant workflow routing through `configureRouteProtection`.
+- Changed built-in package defaults from legacy project branding to Spine-oriented defaults.
 - Made default logout RP-Initiated Logout and kept app-local cleanup explicit with `logout=local`.
 - Removed `offline_access` from the default scope; apps can opt in explicitly if they need long-lived refresh tokens.
+- Updated CI and release validation to run the full `pnpm check` gate.
 
 ## [0.2.4] - 2026-04-25
 

package/CODE_OF_CONDUCT.md

@@ -0,0 +1,39 @@
+# Code of Conduct
+
+## Our Pledge
+
+We want Spine to be a welcoming project for contributors of all experience levels. We commit to making participation respectful, constructive, and harassment-free.
+
+## Our Standards
+
+Examples of behavior that help create a positive environment:
+
+- Being respectful in language and tone
+- Giving actionable, kind feedback
+- Accepting good-faith disagreement
+- Prioritizing shared understanding over ego
+- Helping newer contributors learn the codebase
+
+Examples of unacceptable behavior:
+
+- Harassment or discrimination
+- Personal attacks
+- Trolling or deliberately hostile behavior
+- Publishing private information without permission
+- Repeatedly derailing technical discussions
+
+## Enforcement
+
+Project maintainers are responsible for clarifying and enforcing this code of conduct. They may remove, edit, or reject comments, commits, issues, pull requests, and other contributions that violate these standards.
+
+## Reporting
+
+If you experience or witness unacceptable behavior, open a private report to the maintainer at `eminuckan@gmail.com`.
+
+## Scope
+
+This code of conduct applies within project spaces and in public spaces when someone is representing the project.
+
+## Attribution
+
+This document is inspired by the Contributor Covenant and adapted for this project.

package/CONTRIBUTING.md

@@ -0,0 +1,78 @@
+# Contributing to Spine
+
+Thanks for contributing.
+
+Spine is intended to be a reusable foundation for SaaS infrastructure, so changes should optimize for clarity, composability, and portability across products.
+
+## Before You Start
+
+- Read [README.md](README.md)
+- Read [docs/architecture.md](docs/architecture.md)
+- Read [docs/backend-adaptation.md](docs/backend-adaptation.md)
+- Check existing issues and pull requests first
+
+## Local Setup
+
+```bash
+pnpm install
+pnpm check
+```
+
+## Project Structure
+
+| Path | Purpose |
+| --- | --- |
+| `src/auth` | OAuth, sessions, token refresh, route protection |
+| `src/tenant` | Tenant store, provider, cookie, and server helpers |
+| `src/identity` | Identity cache, client store, and provider |
+| `src/permissions` | Permission store, hooks, components, and server protection |
+| `src/api-client` | API config factory, fetch middleware, and retry/error helpers |
+| `src/query-client` | TanStack Query defaults and utilities |
+| `src/signalr` | Realtime client primitives |
+| `src/logging` | Logging utilities |
+| `src/react-router` | React Router adapter entry points |
+| `docs` | Project documentation |
+
+## Contribution Rules
+
+- Keep core modules framework-agnostic unless the file is inside an adapter namespace
+- Prefer configuration hooks over hardcoded product behavior
+- Avoid shipping product-specific routes, claim names, endpoint paths, or UI assumptions into core
+- Keep public APIs small and explicit
+- Update documentation when behavior or public APIs change
+- Add or update changelog entries for user-visible changes
+
+## Adapter Philosophy
+
+When deciding where code should live:
+
+- Put it in core if it can work across multiple apps with configuration
+- Put it in an adapter if it depends on framework primitives
+- Keep it in the consuming app if it expresses product policy
+
+Examples:
+
+- Good for core: token refresh, tenant cookie utilities, permission checks, identity caching
+- Good for adapters: framework-specific redirects, loader wrappers, request helpers
+- Good for apps: setup redirects, entitlement gating, domain permission constants
+
+## Pull Request Checklist
+
+- `pnpm check` passes
+- Public API changes are documented
+- Changelog is updated when needed
+- No product-specific behavior leaked into core without a configuration escape hatch
+
+## Commit Messages
+
+Use concise, English commit messages.
+
+Examples:
+
+- `docs: rewrite README for open source release`
+- `feat: add configurable permission route protection`
+- `refactor: move tenant cookie policy into core config`
+
+## Release Notes
+
+Maintainers should also read [docs/releasing.md](docs/releasing.md).

package/MAINTAINERS.md

@@ -0,0 +1,43 @@
+# Maintainers
+
+## Current Maintainer
+
+- Muhammet Emin Uckan, primary maintainer
+
+## Maintainer Responsibilities
+
+The maintainer owns:
+
+- reviewing issues and pull requests
+- keeping the package installable and documented
+- preserving the boundary between Spine core, framework adapters, and consuming apps
+- coordinating security reports
+- preparing releases and changelog entries
+- validating changes with `pnpm check` and package dry runs
+
+## Review Policy
+
+Changes should be reviewed against these questions:
+
+- Does this solve a repeated SaaS infrastructure problem?
+- Can it work across multiple apps without product-specific naming?
+- Is the core still framework-agnostic?
+- Does this belong in core, a framework adapter, provider guidance, or the app?
+- Are public API changes documented and covered by tests?
+
+## Release Policy
+
+Spine follows semver. While the package is on a `0.x` line, breaking changes may still happen, but they must be documented and kept migration-friendly where practical.
+
+Before publishing:
+
+```bash
+pnpm check
+npm pack --dry-run
+```
+
+## Codex-Assisted Maintenance
+
+Codex may be used to help with issue triage, pull request review, release checks, documentation updates, and security hardening. The maintainer remains responsible for all final decisions, shipped code, and release artifacts.
+
+See [docs/codex-maintenance.md](docs/codex-maintenance.md) for the operating plan.

package/README.md

@@ -1,5 +1,9 @@
 # Spine
 
+[![CI](https://github.com/eminuckan/spine/actions/workflows/ci.yml/badge.svg)](https://github.com/eminuckan/spine/actions/workflows/ci.yml)
+[![npm version](https://img.shields.io/npm/v/%40eminuckan%2Fspine.svg)](https://www.npmjs.com/package/@eminuckan/spine)
+[![license: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
+
 Framework-agnostic SaaS primitives for authentication, identity, permissions, multi-tenancy, API access, realtime events, query configuration, and logging.
 
 Spine is designed around one idea: the reusable parts of a SaaS platform should live in a single package, while application policy and framework quirks should stay in thin adapters. Today the package ships a framework-agnostic core plus a React Router adapter surface. Future adapters can follow the same pattern.
@@ -10,6 +14,7 @@ Spine is designed around one idea: the reusable parts of a SaaS platform should
 - Current adapter: `@eminuckan/spine/react-router`
 - Server primitives use Web `Request`/`Response` objects, not framework-specific response helpers
 - React Router adapter is intentionally thin today so other adapters can be added without changing the core contract
+- Extracted from repeated production-facing SaaS frontend infrastructure needs, then rebooted as an independent OSS package
 
 ## Why Spine
 
@@ -28,7 +33,7 @@ Spine aims to be:
 - Core before adapter: framework-specific behavior belongs in dedicated adapter entry points
 - Configure, do not fork: backend claim names, cookie behavior, endpoints, and redirects should be configured first
 - Request/Response first: server modules should work anywhere a standard Web `Request` and `Response` exist
-- App policy stays local: onboarding flows, subscription gates, product-specific redirects, and permission taxonomies should live in the consuming app
+- App policy stays local: setup flows, entitlement gates, product-specific redirects, and permission taxonomies should live in the consuming app
 - Open for composition: apps should be able to wrap Spine primitives instead of rewriting them
 
 ## Package Surfaces
@@ -68,8 +73,8 @@ Spine aims to be:
 
 ## What Spine Does Not Include
 
-- Your product's onboarding rules
-- Your product's subscription rules
+- Your product's setup rules
+- Your product's billing or entitlement rules
 - Your product's permission vocabulary
 - Your backend DTOs or generated API clients
 - Your page structure, layouts, or UI system
@@ -108,6 +113,19 @@ If you use client-side React features, install peer dependencies too:
 pnpm add react @tanstack/react-query
 ```
 
+For a fuller setup path, see [docs/installation.md](docs/installation.md).
+
+## Try the Example App
+
+```bash
+cd examples/react-router-saas
+pnpm install
+cp .env.example .env
+pnpm dev
+```
+
+The example includes React Router auth routes, a protected dashboard loader, client provider wiring, and local app adapters for backend identity and tenant conventions.
+
 ## Environment Variables
 
 The built-in auth/session layer currently reads these environment variables:
@@ -126,7 +144,7 @@ The built-in auth/session layer currently reads these environment variables:
 | `OIDC_ALLOW_INSECURE_REQUESTS` | No | Allows non-HTTPS OIDC issuer calls only outside production |
 | `REDIS_URL` | No | Redis connection string for sessions and OAuth state |
 | `REDIS_KEY_PREFIX` | No | Prefix for Redis keys |
-| `API_BASE_URL` | No | Default API base URL for `createAPIConfigFactory` |
+| `API_BASE_URL` | No | Optional fallback API base URL for `createAPIConfigFactory` |
 
 ## OIDC Session Lifecycle
 
@@ -172,7 +190,7 @@ Back-channel logout verifies the signed `logout_token` against the provider JWKS
 Spine's server modules are generic, so your app should provide backend-specific fetchers once.
 
 ```ts
-// app/lib/mimir/identity.server.ts
+// app/lib/spine/identity.server.ts
 import {
   configureIdentityAPIFetcher,
   configurePermissionFetcher,
@@ -182,7 +200,6 @@ import {
 import { createAPIConfigFactory } from '@eminuckan/spine/api-client/server';
 import { getAccessToken } from '@eminuckan/spine/react-router/server';
 import { getCurrentTenant } from '@eminuckan/spine/tenant/server';
-import { Configuration, IdentityApi } from '~/lib/api-clients/api';
 
 const { createAPIConfig } = createAPIConfigFactory(getAccessToken, getCurrentTenant);
 
@@ -192,47 +209,38 @@ configureIdentityAPIFetcher(async (request) => {
     includeAuth: true,
   });
 
-  const api = new IdentityApi(
-    new Configuration({
-      basePath: config.basePath,
-      accessToken: config.accessToken,
-      baseOptions: { headers: config.headers },
-    })
-  );
+  const response = await fetch(`${config.basePath}/api/me/context`, {
+    headers: config.headers,
+  });
 
-  const response = await api.identityGetMyContext();
+  if (!response.ok) {
+    throw new Error(`Failed to load identity context: ${response.status}`);
+  }
 
-  return {
-    ...response.data,
-    contextVersion: Date.now(),
-    hasSubscription: Boolean(
-      response.data.onboarding?.subscription?.exists &&
-      ['active', 'trialing'].includes(response.data.onboarding?.subscription?.status || '')
-    ),
-  };
+  return response.json();
 });
 
 configurePermissionFetcher(async (request, tenantId) => {
   const config = await createAPIConfig(request, { requireTenant: false });
-  const api = new IdentityApi(
-    new Configuration({
-      basePath: config.basePath,
-      accessToken: config.accessToken,
-      baseOptions: { headers: config.headers },
-    })
-  );
+  const response = await fetch(`${config.basePath}/api/me/permissions?tenantId=${tenantId}`, {
+    headers: config.headers,
+  });
 
-  const response = await api.identityGetMyPermissions(tenantId);
-  return response.data.permissions || [];
+  if (!response.ok) {
+    return [];
+  }
+
+  const payload = await response.json();
+  return payload.permissions || [];
 });
 
 export { contextToUserInfo, getIdentityContext };
 ```
 
 ```ts
-// app/lib/mimir/tenant.server.ts
+// app/lib/spine/tenant.server.ts
 import {
-  configureIdentityContextFetcher,
+  configureTenantResolution,
   configureTenantCookie,
   getAvailableTenants,
   getCurrentTenant,
@@ -245,7 +253,9 @@ configureTenantCookie({
   sameSite: 'Lax',
 });
 
-configureIdentityContextFetcher(fetchIdentityContext);
+configureTenantResolution({
+  identityContextFetcher: fetchIdentityContext,
+});
 
 export {
   getAvailableTenants,
@@ -257,7 +267,7 @@ export {
 ### 2. Configure Server-Side Permission Protection
 
 ```ts
-// app/lib/mimir/permissions.server.ts
+// app/lib/spine/permissions.server.ts
 import {
   configurePermissionRouteProtection,
   requirePermission,
@@ -295,8 +305,8 @@ export { requirePermission };
 ```ts
 // app/routes/_protected.tsx
 import { authRoute, getAccessToken } from '@eminuckan/spine/react-router/server';
-import { getCurrentTenant, initializeTenant } from '~/lib/mimir/tenant.server';
-import { contextToUserInfo, getIdentityContext } from '~/lib/mimir/identity.server';
+import { getCurrentTenant, initializeTenant } from '~/lib/spine/tenant.server';
+import { contextToUserInfo, getIdentityContext } from '~/lib/spine/identity.server';
 
 export async function loader({ request }: { request: Request }) {
   return authRoute(request, async (user) => {
@@ -388,10 +398,10 @@ import {
 } from '@eminuckan/spine/server';
 
 configureAuthClaimMapping({
-  tenantIds: ['organizations', 'tenant_ids'],
-  tenantRoles: ['organization_roles', 'tenant_roles'],
+  tenantIds: ['tenant_ids'],
+  tenantRoles: ['tenant_roles'],
   permissions: ['permissions', 'scope'],
-  isOnboarded: ['profile_complete', 'is_onboarded'],
+  isOnboarded: ['is_onboarded'],
 });
 
 configureIdentityStore({
@@ -405,17 +415,24 @@ configureRouteProtection({
 });
 ```
 
+Client contracts are configurable too. Simple apps can use endpoint configuration; apps with workspace/account/customer-specific contracts can provide `fetchTenantData`, `switchTenant`, `fetchContext`, and `fetchPermissions` functions. API header names are configurable through `createAPIConfigFactory`.
+
 More adaptation examples live in [docs/backend-adaptation.md](docs/backend-adaptation.md).
 
 ## Module Guides
 
 - [Architecture](docs/architecture.md)
+- [Installation](docs/installation.md)
 - [Adapters](docs/adapters.md)
 - [Backend Adaptation](docs/backend-adaptation.md)
 - [Module Reference](docs/module-reference.md)
+- [Roadmap](ROADMAP.md)
+- [Codex Maintenance Plan](docs/codex-maintenance.md)
 - [Releasing](docs/releasing.md)
 - [Contributing](CONTRIBUTING.md)
+- [Maintainers](MAINTAINERS.md)
 - [Security](SECURITY.md)
+- [Code of Conduct](CODE_OF_CONDUCT.md)
 
 ## Current Boundaries
 
@@ -430,27 +447,27 @@ Spine already owns the reusable infrastructure for:
 
 Consuming apps should still own:
 
-- Product-specific onboarding pages and redirects
-- Product-specific subscription policies
+- Product-specific setup pages and redirects
+- Product-specific billing or entitlement policies
 - Permission constants and domain vocabulary
 - Generated API clients
 - UI-specific wrappers and design system components
 
 ## Roadmap
 
+The active roadmap lives in [ROADMAP.md](ROADMAP.md). Current tracks include:
+
 - First-class Next.js adapter surface
-- More adapter authoring guidance
-- Cleaner permission taxonomy extension story
-- More example apps
-- Broader runtime coverage tests
+- Clerk and Supabase integration guidance
+- More adapter authoring tests and examples
+- Cleaner migration from deprecated compatibility aliases
+- Public API stability review before `1.0`
 
 ## Development
 
 ```bash
 pnpm install
-pnpm typecheck
-pnpm build
-pnpm lint
+pnpm check
 ```
 
 Detailed contributor guidance lives in [CONTRIBUTING.md](CONTRIBUTING.md).

package/ROADMAP.md

@@ -0,0 +1,58 @@
+# Spine Roadmap
+
+Spine is a small, adapter-friendly foundation for SaaS frontend infrastructure. The roadmap favors reusable primitives, clear framework adapters, and backend-contract flexibility over product-specific features.
+
+## Current Focus
+
+- Keep the core framework-agnostic and based on Web `Request` and `Response` primitives.
+- Keep application policy, permission vocabularies, setup flows, and entitlement rules in consuming apps.
+- Make every backend convention configurable before adding a new abstraction.
+- Preserve compatibility for existing consumers while moving toward a cleaner `1.0` API.
+
+## Near-Term
+
+- Publish the `0.3.x` open source reboot with generic tenant, identity, permission, API, realtime, and adapter surfaces.
+- Expand the React Router example into a fuller SaaS shell with auth, tenant switching, permission gates, and API configuration.
+- Add adapter authoring tests that prove new adapters can stay thin.
+- Add more normalization examples for account, workspace, organization, and custom tenant contracts.
+- Document migration notes from deprecated organization and subscription aliases to tenant and entitlement terminology.
+
+## Adapter Track
+
+- First-class Next.js adapter entry points.
+- React Router adapter refinements where framework-specific helpers remove real boilerplate.
+- Research notes for Vue and Svelte adapter shapes.
+- Adapter request template and contribution checklist for community proposals.
+
+## Provider Track
+
+- Clerk identity/session adapter guidance.
+- Supabase auth and Postgres-backed tenant examples.
+- Auth0 and generic OpenID Connect recipes.
+- Optional examples for API clients generated from OpenAPI without making any generated client mandatory.
+
+## Core Hardening
+
+- Broader tests for route protection and OIDC/session lifecycle behavior.
+- More explicit storage abstraction boundaries for sessions and OAuth state.
+- Runtime compatibility notes for Node, edge-like runtimes, and serverless deployments.
+- Public API stability review before `1.0`.
+
+## Not Planned For Core
+
+- Product-specific route names.
+- Product-specific permission constants.
+- Billing plan vocabulary.
+- Backend DTOs or generated SDKs.
+- UI components tied to one design system.
+
+Those belong in consuming apps or app-specific adapter packages.
+
+## How To Propose Work
+
+Open an issue using the relevant template and describe:
+
+- the repeated SaaS infrastructure problem
+- whether it belongs in core, a framework adapter, provider guidance, or the consuming app
+- how the API can remain generic across multiple projects
+- what tests or docs would prove the behavior

package/SECURITY.md

@@ -0,0 +1,37 @@
+# Security Policy
+
+## Supported Versions
+
+Security fixes are applied to the latest published release line.
+
+## Reporting a Vulnerability
+
+Please do not open public GitHub issues for security problems.
+
+Instead, report vulnerabilities privately to:
+
+- Email: `eminuckan@gmail.com`
+
+When possible, include:
+
+- A clear description of the issue
+- Affected versions
+- Reproduction steps
+- Potential impact
+- Any suggested mitigation
+
+## Response Expectations
+
+The goal is to acknowledge reports quickly, validate impact, and coordinate a fix before public disclosure.
+
+## Scope Notes
+
+Spine provides infrastructure primitives, but consuming applications are still responsible for:
+
+- Backend authorization enforcement
+- Secure secret management
+- Correct adapter configuration
+- Safe redirect and cookie policies
+- Protecting product-specific APIs and workflows
+
+Frontend permission checks and route guards in Spine improve UX, but they are not a substitute for backend authorization.

package/dist/access/evaluator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../src/access/evaluator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,cAAc,EAGd,iBAAiB,EACjB,aAAa,EAEd,MAAM,SAAS,CAAC;AA0CjB,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,EACjD,OAAO,EAAE,aAAa,GACrB,cAAc,CAkDhB"}
+{"version":3,"file":"evaluator.d.ts","sourceRoot":"","sources":["../../src/access/evaluator.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,cAAc,EAGd,iBAAiB,EACjB,aAAa,EAEd,MAAM,SAAS,CAAC;AA0CjB,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,EACjD,OAAO,EAAE,aAAa,GACrB,cAAc,CAqDhB"}

package/dist/access/index.js

@@ -1,4 +1,4 @@
 import "../permission-service-CvGpwI0d.js";
-import { evaluateAccessRequirement } from "../access-DlAqsVGQ.js";
+import { evaluateAccessRequirement } from "../access-CGrsDMwu.js";
 
 export { evaluateAccessRequirement };

package/dist/access/types.d.ts

@@ -1,14 +1,18 @@
 import type { PermissionCode } from '../permissions/types';
 export type AccessOperator = 'AND' | 'OR';
-export interface SubscriptionAccessSnapshot {
+export interface EntitlementAccessSnapshot {
     exists?: boolean;
     status?: string | null;
     planCode?: string | null;
     featureKeys?: readonly string[] | null;
     limits?: Record<string, unknown> | null;
 }
+/** @deprecated Use EntitlementAccessSnapshot instead. */
+export type SubscriptionAccessSnapshot = EntitlementAccessSnapshot;
 export interface AccessSubject {
     permissions?: readonly PermissionCode[] | null;
+    entitlement?: EntitlementAccessSnapshot | null;
+    /** @deprecated Use entitlement instead. */
     subscription?: SubscriptionAccessSnapshot | null;
     isInternalUser?: boolean;
 }
@@ -17,10 +21,14 @@ export interface AccessRequirement {
     permissionOperator?: AccessOperator;
     features?: readonly string[];
     featureOperator?: AccessOperator;
+    requireActiveEntitlement?: boolean;
+    /** @deprecated Use requireActiveEntitlement instead. */
     requireActiveSubscription?: boolean;
     internalOnly?: boolean;
 }
-export type AccessDeniedReason = 'internal-only' | 'inactive-subscription' | 'missing-permissions' | 'missing-features';
+export type AccessDeniedReason = 'internal-only' | 'inactive-entitlement'
+/** @deprecated Use inactive-entitlement instead. */
+ | 'inactive-subscription' | 'missing-permissions' | 'missing-features';
 export interface AccessDecision {
     allowed: boolean;
     reasons: AccessDeniedReason[];

package/dist/access/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/access/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,IAAI,CAAC;AAE1C,MAAM,WAAW,0BAA0B;IACzC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACzC;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,CAAC,EAAE,SAAS,cAAc,EAAE,GAAG,IAAI,CAAC;IAC/C,YAAY,CAAC,EAAE,0BAA0B,GAAG,IAAI,CAAC;IACjD,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IACxC,kBAAkB,CAAC,EAAE,cAAc,CAAC;IACpC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,eAAe,CAAC,EAAE,cAAc,CAAC;IACjC,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,kBAAkB,GAC1B,eAAe,GACf,uBAAuB,GACvB,qBAAqB,GACrB,kBAAkB,CAAC;AAEvB,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,kBAAkB,EAAE,cAAc,EAAE,CAAC;IACrC,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/access/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,IAAI,CAAC;AAE1C,MAAM,WAAW,yBAAyB;IACxC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IACvC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACzC;AAED,yDAAyD;AACzD,MAAM,MAAM,0BAA0B,GAAG,yBAAyB,CAAC;AAEnE,MAAM,WAAW,aAAa;IAC5B,WAAW,CAAC,EAAE,SAAS,cAAc,EAAE,GAAG,IAAI,CAAC;IAC/C,WAAW,CAAC,EAAE,yBAAyB,GAAG,IAAI,CAAC;IAC/C,2CAA2C;IAC3C,YAAY,CAAC,EAAE,0BAA0B,GAAG,IAAI,CAAC;IACjD,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,WAAW,CAAC,EAAE,SAAS,cAAc,EAAE,CAAC;IACxC,kBAAkB,CAAC,EAAE,cAAc,CAAC;IACpC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,eAAe,CAAC,EAAE,cAAc,CAAC;IACjC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,wDAAwD;IACxD,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,kBAAkB,GAC1B,eAAe,GACf,sBAAsB;AACxB,oDAAoD;GAClD,uBAAuB,GACvB,qBAAqB,GACrB,kBAAkB,CAAC;AAEvB,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,kBAAkB,EAAE,CAAC;IAC9B,kBAAkB,EAAE,cAAc,EAAE,CAAC;IACrC,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B"}

package/dist/{access-DlAqsVGQ.js → access-CGrsDMwu.js}

@@ -1,7 +1,7 @@
 import { PermissionChecker } from "./permission-service-CvGpwI0d.js";
 
 //#region src/access/evaluator.ts
-const ACTIVE_SUBSCRIPTION_STATUSES = new Set(["active", "trialing"]);
+const ACTIVE_ENTITLEMENT_STATUSES = new Set(["active", "trialing"]);
 const EMPTY_DECISION = Object.freeze({
 	allowed: true,
 	reasons: [],
@@ -11,9 +11,9 @@ const EMPTY_DECISION = Object.freeze({
 function normalizeFeature(value) {
 	return value.trim().toLowerCase();
 }
-function hasActiveSubscription(subscription) {
-	if (!subscription?.exists) return false;
-	return ACTIVE_SUBSCRIPTION_STATUSES.has(subscription.status?.toLowerCase() ?? "");
+function hasActiveEntitlement(entitlement) {
+	if (!entitlement?.exists) return false;
+	return ACTIVE_ENTITLEMENT_STATUSES.has(entitlement.status?.toLowerCase() ?? "");
 }
 function checkFeatureSet(grantedFeatures, requiredFeatures, operator) {
 	if (requiredFeatures.length === 0) return [];
@@ -27,10 +27,12 @@ function evaluateAccessRequirement(requirement, subject) {
 	const reasons = [];
 	const permissions = requirement.permissions ?? [];
 	const features = requirement.features ?? [];
+	const entitlement = subject.entitlement ?? subject.subscription;
 	let missingPermissions = [];
 	let missingFeatures = [];
 	if (requirement.internalOnly && !subject.isInternalUser) reasons.push("internal-only");
-	if (requirement.requireActiveSubscription && !hasActiveSubscription(subject.subscription)) reasons.push("inactive-subscription");
+	if (requirement.requireActiveEntitlement && !hasActiveEntitlement(entitlement)) reasons.push("inactive-entitlement");
+	else if (requirement.requireActiveSubscription && !hasActiveEntitlement(entitlement)) reasons.push("inactive-subscription");
 	if (permissions.length > 0) {
 		const checker = new PermissionChecker([...subject.permissions ?? []]);
 		const result = checker.hasPermissions([...permissions], {
@@ -43,7 +45,7 @@ function evaluateAccessRequirement(requirement, subject) {
 		}
 	}
 	if (features.length > 0) {
-		missingFeatures = checkFeatureSet(subject.subscription?.featureKeys ?? [], features, requirement.featureOperator ?? "AND");
+		missingFeatures = checkFeatureSet(entitlement?.featureKeys ?? [], features, requirement.featureOperator ?? "AND");
 		if (missingFeatures.length > 0) reasons.push("missing-features");
 	}
 	return {
@@ -56,4 +58,4 @@ function evaluateAccessRequirement(requirement, subject) {
 
 //#endregion
 export { evaluateAccessRequirement };
-//# sourceMappingURL=access-DlAqsVGQ.js.map
+//# sourceMappingURL=access-CGrsDMwu.js.map

package/dist/access-CGrsDMwu.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-CGrsDMwu.js","names":["EMPTY_DECISION: AccessDecision","value: string","entitlement?: EntitlementAccessSnapshot | null","grantedFeatures: readonly string[]","requiredFeatures: readonly string[]","operator: AccessOperator","requirement: AccessRequirement | null | undefined","subject: AccessSubject","reasons: AccessDeniedReason[]","missingPermissions: string[]","missingFeatures: string[]"],"sources":["../src/access/evaluator.ts"],"sourcesContent":["import { PermissionChecker } from '../permissions/permission-service';\nimport type {\n  AccessDecision,\n  AccessDeniedReason,\n  AccessOperator,\n  AccessRequirement,\n  AccessSubject,\n  EntitlementAccessSnapshot,\n} from './types';\n\nconst ACTIVE_ENTITLEMENT_STATUSES = new Set(['active', 'trialing']);\n\nconst EMPTY_DECISION: AccessDecision = Object.freeze({\n  allowed: true,\n  reasons: [],\n  missingPermissions: [],\n  missingFeatures: [],\n});\n\nfunction normalizeFeature(value: string): string {\n  return value.trim().toLowerCase();\n}\n\nfunction hasActiveEntitlement(entitlement?: EntitlementAccessSnapshot | null): boolean {\n  if (!entitlement?.exists) {\n    return false;\n  }\n\n  return ACTIVE_ENTITLEMENT_STATUSES.has(entitlement.status?.toLowerCase() ?? '');\n}\n\nfunction checkFeatureSet(\n  grantedFeatures: readonly string[],\n  requiredFeatures: readonly string[],\n  operator: AccessOperator,\n): string[] {\n  if (requiredFeatures.length === 0) {\n    return [];\n  }\n\n  const granted = new Set(grantedFeatures.map(normalizeFeature));\n  const normalizedRequired = requiredFeatures.map(normalizeFeature).filter(Boolean);\n\n  if (operator === 'OR') {\n    return normalizedRequired.some((feature) => granted.has(feature)) ? [] : normalizedRequired;\n  }\n\n  return normalizedRequired.filter((feature) => !granted.has(feature));\n}\n\nexport function evaluateAccessRequirement(\n  requirement: AccessRequirement | null | undefined,\n  subject: AccessSubject,\n): AccessDecision {\n  if (!requirement) {\n    return EMPTY_DECISION;\n  }\n\n  const reasons: AccessDeniedReason[] = [];\n  const permissions = requirement.permissions ?? [];\n  const features = requirement.features ?? [];\n  const entitlement = subject.entitlement ?? subject.subscription;\n  let missingPermissions: string[] = [];\n  let missingFeatures: string[] = [];\n\n  if (requirement.internalOnly && !subject.isInternalUser) {\n    reasons.push('internal-only');\n  }\n\n  if (requirement.requireActiveEntitlement && !hasActiveEntitlement(entitlement)) {\n    reasons.push('inactive-entitlement');\n  } else if (requirement.requireActiveSubscription && !hasActiveEntitlement(entitlement)) {\n    reasons.push('inactive-subscription');\n  }\n\n  if (permissions.length > 0) {\n    const checker = new PermissionChecker([...(subject.permissions ?? [])]);\n    const result = checker.hasPermissions([...permissions], {\n      operator: requirement.permissionOperator ?? 'AND',\n      wildcard: true,\n    });\n\n    if (!result.hasPermission) {\n      missingPermissions = result.missingPermissions;\n      reasons.push('missing-permissions');\n    }\n  }\n\n  if (features.length > 0) {\n    missingFeatures = checkFeatureSet(\n      entitlement?.featureKeys ?? [],\n      features,\n      requirement.featureOperator ?? 'AND',\n    );\n\n    if (missingFeatures.length > 0) {\n      reasons.push('missing-features');\n    }\n  }\n\n  return {\n    allowed: reasons.length === 0,\n    reasons,\n    missingPermissions,\n    missingFeatures,\n  };\n}\n"],"mappings":";;;AAUA,MAAM,8BAA8B,IAAI,IAAI,CAAC,UAAU,UAAW;AAElE,MAAMA,iBAAiC,OAAO,OAAO;CACnD,SAAS;CACT,SAAS,CAAE;CACX,oBAAoB,CAAE;CACtB,iBAAiB,CAAE;AACpB,EAAC;AAEF,SAAS,iBAAiBC,OAAuB;AAC/C,QAAO,MAAM,MAAM,CAAC,aAAa;AAClC;AAED,SAAS,qBAAqBC,aAAyD;AACrF,MAAK,aAAa,OAChB,QAAO;AAGT,QAAO,4BAA4B,IAAI,YAAY,QAAQ,aAAa,IAAI,GAAG;AAChF;AAED,SAAS,gBACPC,iBACAC,kBACAC,UACU;AACV,KAAI,iBAAiB,WAAW,EAC9B,QAAO,CAAE;CAGX,MAAM,UAAU,IAAI,IAAI,gBAAgB,IAAI,iBAAiB;CAC7D,MAAM,qBAAqB,iBAAiB,IAAI,iBAAiB,CAAC,OAAO,QAAQ;AAEjF,KAAI,aAAa,KACf,QAAO,mBAAmB,KAAK,CAAC,YAAY,QAAQ,IAAI,QAAQ,CAAC,GAAG,CAAE,IAAG;AAG3E,QAAO,mBAAmB,OAAO,CAAC,aAAa,QAAQ,IAAI,QAAQ,CAAC;AACrE;AAED,SAAgB,0BACdC,aACAC,SACgB;AAChB,MAAK,YACH,QAAO;CAGT,MAAMC,UAAgC,CAAE;CACxC,MAAM,cAAc,YAAY,eAAe,CAAE;CACjD,MAAM,WAAW,YAAY,YAAY,CAAE;CAC3C,MAAM,cAAc,QAAQ,eAAe,QAAQ;CACnD,IAAIC,qBAA+B,CAAE;CACrC,IAAIC,kBAA4B,CAAE;AAElC,KAAI,YAAY,iBAAiB,QAAQ,eACvC,SAAQ,KAAK,gBAAgB;AAG/B,KAAI,YAAY,6BAA6B,qBAAqB,YAAY,CAC5E,SAAQ,KAAK,uBAAuB;UAC3B,YAAY,8BAA8B,qBAAqB,YAAY,CACpF,SAAQ,KAAK,wBAAwB;AAGvC,KAAI,YAAY,SAAS,GAAG;EAC1B,MAAM,UAAU,IAAI,kBAAkB,CAAC,GAAI,QAAQ,eAAe,CAAE,CAAE;EACtE,MAAM,SAAS,QAAQ,eAAe,CAAC,GAAG,WAAY,GAAE;GACtD,UAAU,YAAY,sBAAsB;GAC5C,UAAU;EACX,EAAC;AAEF,OAAK,OAAO,eAAe;AACzB,wBAAqB,OAAO;AAC5B,WAAQ,KAAK,sBAAsB;EACpC;CACF;AAED,KAAI,SAAS,SAAS,GAAG;AACvB,oBAAkB,gBAChB,aAAa,eAAe,CAAE,GAC9B,UACA,YAAY,mBAAmB,MAChC;AAED,MAAI,gBAAgB,SAAS,EAC3B,SAAQ,KAAK,mBAAmB;CAEnC;AAED,QAAO;EACL,SAAS,QAAQ,WAAW;EAC5B;EACA;EACA;CACD;AACF"}