@munchi_oy/license-sdk 0.8.0 → 0.10.0

package/README.md

@@ -1,6 +1,6 @@
 # @munchi_oy/license-sdk
 
-Asks the Munchi license service what a venue may use. Zero dependencies, Node 20+, ESM and CommonJS.
+Asks the Munchi license service what a venue may use. One dependency (`zod`, for the event schema), Node 20+, ESM and CommonJS.
 
 ```ts
 import { LicenseClient } from "@munchi_oy/license-sdk";
@@ -31,6 +31,8 @@ const snapshot = await license.entitlements(venueId); // full snapshot, null = u
 
 Call `invalidate(venueId)` when you receive a `license.changed` event.
 
+A service that runs a store's channels subscribes to `license.access_changed` (topic `one-license-<env>-access`) and validates each message with the exported `accessChangedEventSchema` (type `AccessChangedEvent`, kind `ACCESS_CHANGED`); drop an `id` already applied and a `snapshotVersion` older than the last one applied for the venue. `hasAccess(event)` is false when the store may use nothing (`suspended`, `terminated`, `canceled`: an unpaid store too), the same rule as `can()`; a feature is usable when it is true and the feature is in `features`.
+
 It also exports the shared names: `PRODUCTS` and `PLANS` (catalog codes), `USAGE_METRICS` (what usage can cost money) and `REQUESTABLE_PRODUCTS` (what a store asks Munchi for in the dashboard: `ari`, `business_account`, `capital`, `foodora`, `bolt`, `card_payments_pos`, `card_payments_kiosk`, `sevenrooms`, `tableonline`, `zenchef`), with `STORE_ONLY_PRODUCTS` and `isStoreOnlyProduct` for the ones only a store asks for, never the whole group (the delivery apps, card payments at the POS or kiosk, and the reservation systems).
 
-For a group's company (ADR 0025) it exports `companyIds(country, { businessId, vatId })` (the IDs to store by the company's country, or `{ invalid: "businessId" | "vatId" }`; any country is accepted, Finland's are checked), `finnishBusinessId(input)` (the Y-tunnus as `NNNNNNN-C`, or `null` when its format or check digit is wrong), `finnishVatId(businessId)` (`FI` and its digits), and the types `LegalEntityChange` (the body of `PATCH /v1/accounts/:accountId/legal-entities/:legalEntityId`) and `LegalEntity` (its response).
+For a group's company (ADR 0025) it exports `companyIds(country, { businessId, vatId })` (the IDs to store, as written and trimmed; nothing is refused, a well-formed Finnish Y-tunnus is written `NNNNNNN-C` and its VAT ID derived when none is given), `finnishBusinessId(input)` (the Y-tunnus as `NNNNNNN-C`, or `null` when its format or check digit is wrong), `finnishVatId(businessId)` (`FI` and its digits), and the types `LegalEntityChange` (the body of `PATCH /v1/accounts/:accountId/legal-entities/:legalEntityId`) and `LegalEntity` (its response).

package/dist/index.cjs

@@ -21,6 +21,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  ACCESS_CHANGED: () => ACCESS_CHANGED,
   LicenseClient: () => LicenseClient,
   PLANS: () => PLANS,
   PRODUCTS: () => PRODUCTS,
@@ -28,9 +29,11 @@ __export(index_exports, {
   STORE_ONLY_PRODUCTS: () => STORE_ONLY_PRODUCTS,
   USAGE_METRICS: () => USAGE_METRICS,
   USAGE_METRIC_NAMES: () => USAGE_METRIC_NAMES,
+  accessChangedEventSchema: () => accessChangedEventSchema,
   companyIds: () => companyIds,
   finnishBusinessId: () => finnishBusinessId,
   finnishVatId: () => finnishVatId,
+  hasAccess: () => hasAccess,
   isStoreOnlyProduct: () => isStoreOnlyProduct
 });
 module.exports = __toCommonJS(index_exports);
@@ -41,6 +44,9 @@ var PRODUCTS = {
   one: "MUN-ONE",
   kiosk: "MUN-ADD-KIOSK",
   mobileApp: "MUN-ADD-APP",
+  munchiOrder: "MUN-ADD-ORDER",
+  paymentTerminal: "MUN-ADD-TERMINAL",
+  hardware: "MUN-ADD-HARDWARE",
   mobileAppSetup: "MUN-SETUP-APP",
   sms: "MUN-SMS",
   loyaltyOverage: "MUN-OVR-LOYALTY"
@@ -50,6 +56,49 @@ var PLANS = [
   PRODUCTS.one
 ];
 
+// ../license-core/src/events/access-changed.ts
+var import_zod = require("zod");
+var ACCESS_CHANGED = "license.access_changed";
+var NO_ACCESS_STATES = /* @__PURE__ */ new Set([
+  "suspended",
+  "terminated",
+  "canceled"
+]);
+var accessChangedEventSchema = import_zod.z.object({
+  kind: import_zod.z.literal(ACCESS_CHANGED),
+  /** The event's own id: a redelivered message has the same one. */
+  id: import_zod.z.string().min(1),
+  venueId: import_zod.z.number().int(),
+  locationId: import_zod.z.string().min(1),
+  accountId: import_zod.z.string().min(1),
+  state: import_zod.z.enum([
+    "trial",
+    "active",
+    "grace",
+    "start",
+    "suspended",
+    "terminated",
+    "canceled"
+  ]),
+  /** As in the snapshot: empty when the store is closed or switched off. */
+  features: import_zod.z.array(import_zod.z.string().min(1)),
+  /** As in the snapshot: how many of something the store may have; `null` = unlimited. */
+  limits: import_zod.z.record(import_zod.z.string(), import_zod.z.number().int().min(0).nullable()),
+  suspension: import_zod.z.object({
+    reason: import_zod.z.string().min(1),
+    mode: import_zod.z.enum([
+      "read_only",
+      "off"
+    ])
+  }).nullable(),
+  /** The audit action that changed it, e.g. `license.close` or `license.payment.suspend`. */
+  reason: import_zod.z.string().min(1),
+  /** The snapshot's `v`: a consumer drops a message older than the last one it applied. */
+  snapshotVersion: import_zod.z.number().int().min(0),
+  at: import_zod.z.iso.datetime()
+});
+var hasAccess = /* @__PURE__ */ __name((event) => !NO_ACCESS_STATES.has(event.state), "hasAccess");
+
 // ../license-core/src/legal-entity.ts
 var Y_TUNNUS = /^(\d{6,7})-(\d)$/;
 var Y_TUNNUS_WEIGHTS = [
@@ -70,36 +119,24 @@ var finnishBusinessId = /* @__PURE__ */ __name((input) => {
   return Number(check) === expected ? `${digits}-${check}` : null;
 }, "finnishBusinessId");
 var finnishVatId = /* @__PURE__ */ __name((businessId) => `FI${businessId.replace("-", "")}`, "finnishVatId");
-var ANY_COUNTRY = {
-  businessId: /* @__PURE__ */ __name((input) => input.trim() || null, "businessId"),
-  vatId: /* @__PURE__ */ __name((_businessId, input) => input?.trim() || null, "vatId")
-};
-var COMPANY_IDS_BY_COUNTRY = {
-  FI: {
-    businessId: finnishBusinessId,
-    vatId: /* @__PURE__ */ __name((businessId, input) => {
-      const vatId = finnishVatId(businessId);
-      return input === null || input.replace(/\s/g, "").toUpperCase() === vatId ? vatId : void 0;
-    }, "vatId")
-  }
-};
 var companyIds = /* @__PURE__ */ __name((country, input) => {
-  const rules = COMPANY_IDS_BY_COUNTRY[country.toUpperCase()] ?? ANY_COUNTRY;
-  const businessId = rules.businessId(input.businessId);
-  if (businessId === null) return {
-    invalid: "businessId"
-  };
-  const vatId = rules.vatId(businessId, input.vatId ?? null);
-  if (vatId === void 0) return {
-    invalid: "vatId"
-  };
-  return {
+  const businessId = input.businessId.trim();
+  const vatId = input.vatId?.trim() || null;
+  const finnish = country.toUpperCase() === "FI" ? finnishBusinessId(businessId) : null;
+  if (finnish === null) return {
     businessId,
     vatId
   };
+  const derived = finnishVatId(finnish);
+  const matches = vatId === null || vatId.replace(/\s/g, "").toUpperCase() === derived;
+  return {
+    businessId: finnish,
+    vatId: matches ? derived : vatId
+  };
 }, "companyIds");
 
 // ../license-core/src/requestable-products.ts
+var import_zod2 = require("zod");
 var REQUESTABLE_PRODUCTS = [
   "ari",
   "business_account",
@@ -110,7 +147,9 @@ var REQUESTABLE_PRODUCTS = [
   "card_payments_kiosk",
   "sevenrooms",
   "tableonline",
-  "zenchef"
+  "zenchef",
+  "payment_terminal",
+  "hardware"
 ];
 var STORE_ONLY_PRODUCTS = [
   "foodora",
@@ -119,10 +158,18 @@ var STORE_ONLY_PRODUCTS = [
   "card_payments_kiosk",
   "sevenrooms",
   "tableonline",
-  "zenchef"
+  "zenchef",
+  "payment_terminal",
+  "hardware"
 ];
 var storeOnly = new Set(STORE_ONLY_PRODUCTS);
 var isStoreOnlyProduct = /* @__PURE__ */ __name((product) => storeOnly.has(product), "isStoreOnlyProduct");
+var MAX_DETAILS_BYTES = 1e4;
+var productRequestDetails = import_zod2.z.record(import_zod2.z.string(), import_zod2.z.json()).refine((details) => Buffer.byteLength(JSON.stringify(details)) <= MAX_DETAILS_BYTES, {
+  message: `details may be at most ${MAX_DETAILS_BYTES} bytes`
+}).refine((details) => !JSON.stringify(details).includes("\\u0000"), {
+  message: "details may not contain the null character"
+});
 
 // ../license-core/src/usage-metrics.ts
 var USAGE_METRICS = {
@@ -271,6 +318,7 @@ var LicenseClient = class {
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  ACCESS_CHANGED,
   LicenseClient,
   PLANS,
   PRODUCTS,
@@ -278,8 +326,10 @@ var LicenseClient = class {
   STORE_ONLY_PRODUCTS,
   USAGE_METRICS,
   USAGE_METRIC_NAMES,
+  accessChangedEventSchema,
   companyIds,
   finnishBusinessId,
   finnishVatId,
+  hasAccess,
   isStoreOnlyProduct
 });

package/dist/index.d.cts

@@ -1,3 +1,5 @@
+import { z } from 'zod';
+
 /**
  * Munchi's product codes, for code that names one (apps, the dashboard). Codes are immutable and
  * never reused; a catalog may still carry products added later, so this is not the full list.
@@ -7,6 +9,9 @@ declare const PRODUCTS: {
     readonly one: "MUN-ONE";
     readonly kiosk: "MUN-ADD-KIOSK";
     readonly mobileApp: "MUN-ADD-APP";
+    readonly munchiOrder: "MUN-ADD-ORDER";
+    readonly paymentTerminal: "MUN-ADD-TERMINAL";
+    readonly hardware: "MUN-ADD-HARDWARE";
     readonly mobileAppSetup: "MUN-SETUP-APP";
     readonly sms: "MUN-SMS";
     readonly loyaltyOverage: "MUN-OVR-LOYALTY";
@@ -16,6 +21,47 @@ type KnownProductCode = (typeof PRODUCTS)[keyof typeof PRODUCTS];
 declare const PLANS: readonly ["MUN-START", "MUN-ONE"];
 type PlanCode = (typeof PLANS)[number];
 
+declare const ACCESS_CHANGED = "license.access_changed";
+/**
+ * What a store may use, sent on `ACCESS_TOPIC` whenever it changes (closed, suspended, unpaid,
+ * paid again, an add-on bought or removed). Only zod, because the SDK ships it to consumers.
+ * Unknown fields are ignored, so fields added later don't break an older consumer.
+ */
+declare const accessChangedEventSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"license.access_changed">;
+    id: z.ZodString;
+    venueId: z.ZodNumber;
+    locationId: z.ZodString;
+    accountId: z.ZodString;
+    state: z.ZodEnum<{
+        start: "start";
+        suspended: "suspended";
+        terminated: "terminated";
+        canceled: "canceled";
+        trial: "trial";
+        active: "active";
+        grace: "grace";
+    }>;
+    features: z.ZodArray<z.ZodString>;
+    limits: z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodNumber>>;
+    suspension: z.ZodNullable<z.ZodObject<{
+        reason: z.ZodString;
+        mode: z.ZodEnum<{
+            read_only: "read_only";
+            off: "off";
+        }>;
+    }, z.core.$strip>>;
+    reason: z.ZodString;
+    snapshotVersion: z.ZodNumber;
+    at: z.ZodISODateTime;
+}, z.core.$strip>;
+type AccessChangedEvent = z.infer<typeof accessChangedEventSchema>;
+/**
+ * May the store use anything now? False when closed, suspended (an unpaid store too: everything
+ * off, owner 2026-11-04) or terminated. A feature is usable when this is true and it is in `features`.
+ */
+declare const hasAccess: (event: Pick<AccessChangedEvent, "state">) => boolean;
+
 /**
  * A group's company (legal entity), as the dashboard reads and changes it. One company can be the
  * company of several stores of the same group. Zero-dependency on purpose: the SDK ships it.
@@ -51,14 +97,16 @@ interface LegalEntityChange {
 declare const finnishBusinessId: (input: string) => string | null;
 /** A Finnish VAT ID is always `FI` and the business ID's eight digits. */
 declare const finnishVatId: (businessId: string) => string;
-/** The IDs to store, or the field that is wrong for the company's country. */
-type CompanyIds = {
+/** The IDs to store. Nothing is refused (owner, 2026-11-01: business IDs aren't validated). */
+interface CompanyIds {
     businessId: string;
     vatId: string | null;
-} | {
-    invalid: "businessId" | "vatId";
-};
-/** Checks and normalises a company's IDs by the rules of its country (ISO 3166-1 alpha-2). */
+}
+/**
+ * The company's IDs as written, trimmed. A Finnish company's well-formed Y-tunnus is written as
+ * `NNNNNNN-C`, and its VAT ID is derived when none is given or written like it in another case or
+ * spacing.
+ */
 declare const companyIds: (country: string, input: {
     businessId: string;
     vatId?: string | null;
@@ -69,13 +117,13 @@ declare const companyIds: (country: string, input: {
  * (ADR 0022). These are the dashboard's product ids, not catalog codes (`MUN-*`); the mobile app
  * has its own request flow (ADR 0021). A new one is added here first.
  */
-declare const REQUESTABLE_PRODUCTS: readonly ["ari", "business_account", "capital", "foodora", "bolt", "card_payments_pos", "card_payments_kiosk", "sevenrooms", "tableonline", "zenchef"];
+declare const REQUESTABLE_PRODUCTS: readonly ["ari", "business_account", "capital", "foodora", "bolt", "card_payments_pos", "card_payments_kiosk", "sevenrooms", "tableonline", "zenchef", "payment_terminal", "hardware"];
 type RequestableProduct = (typeof REQUESTABLE_PRODUCTS)[number];
 /**
- * Delivery apps, card payments at the POS or kiosk and reservation systems are set up one store at
- * a time, so only a store asks for them, never the whole group.
+ * Delivery apps, card payments at the POS or kiosk, reservation systems and hardware are set up one
+ * store at a time, so only a store asks for them, never the whole group.
  */
-declare const STORE_ONLY_PRODUCTS: readonly ["foodora", "bolt", "card_payments_pos", "card_payments_kiosk", "sevenrooms", "tableonline", "zenchef"];
+declare const STORE_ONLY_PRODUCTS: readonly ["foodora", "bolt", "card_payments_pos", "card_payments_kiosk", "sevenrooms", "tableonline", "zenchef", "payment_terminal", "hardware"];
 declare const isStoreOnlyProduct: (product: RequestableProduct) => boolean;
 
 /**
@@ -228,4 +276,4 @@ declare class LicenseClient {
     private report;
 }
 
-export { type CompanyIds, type DeniedEvent, type KnownProductCode, type LegalEntity, type LegalEntityChange, LicenseClient, type LicenseClientOptions, PLANS, PRODUCTS, type PlanCode, REQUESTABLE_PRODUCTS, type RequestableProduct, STORE_ONLY_PRODUCTS, type Snapshot, USAGE_METRICS, USAGE_METRIC_NAMES, type UsageMetric, companyIds, finnishBusinessId, finnishVatId, isStoreOnlyProduct };
+export { ACCESS_CHANGED, type AccessChangedEvent, type CompanyIds, type DeniedEvent, type KnownProductCode, type LegalEntity, type LegalEntityChange, LicenseClient, type LicenseClientOptions, PLANS, PRODUCTS, type PlanCode, REQUESTABLE_PRODUCTS, type RequestableProduct, STORE_ONLY_PRODUCTS, type Snapshot, USAGE_METRICS, USAGE_METRIC_NAMES, type UsageMetric, accessChangedEventSchema, companyIds, finnishBusinessId, finnishVatId, hasAccess, isStoreOnlyProduct };

package/dist/index.d.ts

@@ -1,3 +1,5 @@
+import { z } from 'zod';
+
 /**
  * Munchi's product codes, for code that names one (apps, the dashboard). Codes are immutable and
  * never reused; a catalog may still carry products added later, so this is not the full list.
@@ -7,6 +9,9 @@ declare const PRODUCTS: {
     readonly one: "MUN-ONE";
     readonly kiosk: "MUN-ADD-KIOSK";
     readonly mobileApp: "MUN-ADD-APP";
+    readonly munchiOrder: "MUN-ADD-ORDER";
+    readonly paymentTerminal: "MUN-ADD-TERMINAL";
+    readonly hardware: "MUN-ADD-HARDWARE";
     readonly mobileAppSetup: "MUN-SETUP-APP";
     readonly sms: "MUN-SMS";
     readonly loyaltyOverage: "MUN-OVR-LOYALTY";
@@ -16,6 +21,47 @@ type KnownProductCode = (typeof PRODUCTS)[keyof typeof PRODUCTS];
 declare const PLANS: readonly ["MUN-START", "MUN-ONE"];
 type PlanCode = (typeof PLANS)[number];
 
+declare const ACCESS_CHANGED = "license.access_changed";
+/**
+ * What a store may use, sent on `ACCESS_TOPIC` whenever it changes (closed, suspended, unpaid,
+ * paid again, an add-on bought or removed). Only zod, because the SDK ships it to consumers.
+ * Unknown fields are ignored, so fields added later don't break an older consumer.
+ */
+declare const accessChangedEventSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"license.access_changed">;
+    id: z.ZodString;
+    venueId: z.ZodNumber;
+    locationId: z.ZodString;
+    accountId: z.ZodString;
+    state: z.ZodEnum<{
+        start: "start";
+        suspended: "suspended";
+        terminated: "terminated";
+        canceled: "canceled";
+        trial: "trial";
+        active: "active";
+        grace: "grace";
+    }>;
+    features: z.ZodArray<z.ZodString>;
+    limits: z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodNumber>>;
+    suspension: z.ZodNullable<z.ZodObject<{
+        reason: z.ZodString;
+        mode: z.ZodEnum<{
+            read_only: "read_only";
+            off: "off";
+        }>;
+    }, z.core.$strip>>;
+    reason: z.ZodString;
+    snapshotVersion: z.ZodNumber;
+    at: z.ZodISODateTime;
+}, z.core.$strip>;
+type AccessChangedEvent = z.infer<typeof accessChangedEventSchema>;
+/**
+ * May the store use anything now? False when closed, suspended (an unpaid store too: everything
+ * off, owner 2026-11-04) or terminated. A feature is usable when this is true and it is in `features`.
+ */
+declare const hasAccess: (event: Pick<AccessChangedEvent, "state">) => boolean;
+
 /**
  * A group's company (legal entity), as the dashboard reads and changes it. One company can be the
  * company of several stores of the same group. Zero-dependency on purpose: the SDK ships it.
@@ -51,14 +97,16 @@ interface LegalEntityChange {
 declare const finnishBusinessId: (input: string) => string | null;
 /** A Finnish VAT ID is always `FI` and the business ID's eight digits. */
 declare const finnishVatId: (businessId: string) => string;
-/** The IDs to store, or the field that is wrong for the company's country. */
-type CompanyIds = {
+/** The IDs to store. Nothing is refused (owner, 2026-11-01: business IDs aren't validated). */
+interface CompanyIds {
     businessId: string;
     vatId: string | null;
-} | {
-    invalid: "businessId" | "vatId";
-};
-/** Checks and normalises a company's IDs by the rules of its country (ISO 3166-1 alpha-2). */
+}
+/**
+ * The company's IDs as written, trimmed. A Finnish company's well-formed Y-tunnus is written as
+ * `NNNNNNN-C`, and its VAT ID is derived when none is given or written like it in another case or
+ * spacing.
+ */
 declare const companyIds: (country: string, input: {
     businessId: string;
     vatId?: string | null;
@@ -69,13 +117,13 @@ declare const companyIds: (country: string, input: {
  * (ADR 0022). These are the dashboard's product ids, not catalog codes (`MUN-*`); the mobile app
  * has its own request flow (ADR 0021). A new one is added here first.
  */
-declare const REQUESTABLE_PRODUCTS: readonly ["ari", "business_account", "capital", "foodora", "bolt", "card_payments_pos", "card_payments_kiosk", "sevenrooms", "tableonline", "zenchef"];
+declare const REQUESTABLE_PRODUCTS: readonly ["ari", "business_account", "capital", "foodora", "bolt", "card_payments_pos", "card_payments_kiosk", "sevenrooms", "tableonline", "zenchef", "payment_terminal", "hardware"];
 type RequestableProduct = (typeof REQUESTABLE_PRODUCTS)[number];
 /**
- * Delivery apps, card payments at the POS or kiosk and reservation systems are set up one store at
- * a time, so only a store asks for them, never the whole group.
+ * Delivery apps, card payments at the POS or kiosk, reservation systems and hardware are set up one
+ * store at a time, so only a store asks for them, never the whole group.
  */
-declare const STORE_ONLY_PRODUCTS: readonly ["foodora", "bolt", "card_payments_pos", "card_payments_kiosk", "sevenrooms", "tableonline", "zenchef"];
+declare const STORE_ONLY_PRODUCTS: readonly ["foodora", "bolt", "card_payments_pos", "card_payments_kiosk", "sevenrooms", "tableonline", "zenchef", "payment_terminal", "hardware"];
 declare const isStoreOnlyProduct: (product: RequestableProduct) => boolean;
 
 /**
@@ -228,4 +276,4 @@ declare class LicenseClient {
     private report;
 }
 
-export { type CompanyIds, type DeniedEvent, type KnownProductCode, type LegalEntity, type LegalEntityChange, LicenseClient, type LicenseClientOptions, PLANS, PRODUCTS, type PlanCode, REQUESTABLE_PRODUCTS, type RequestableProduct, STORE_ONLY_PRODUCTS, type Snapshot, USAGE_METRICS, USAGE_METRIC_NAMES, type UsageMetric, companyIds, finnishBusinessId, finnishVatId, isStoreOnlyProduct };
+export { ACCESS_CHANGED, type AccessChangedEvent, type CompanyIds, type DeniedEvent, type KnownProductCode, type LegalEntity, type LegalEntityChange, LicenseClient, type LicenseClientOptions, PLANS, PRODUCTS, type PlanCode, REQUESTABLE_PRODUCTS, type RequestableProduct, STORE_ONLY_PRODUCTS, type Snapshot, USAGE_METRICS, USAGE_METRIC_NAMES, type UsageMetric, accessChangedEventSchema, companyIds, finnishBusinessId, finnishVatId, hasAccess, isStoreOnlyProduct };

package/dist/index.js

@@ -7,6 +7,9 @@ var PRODUCTS = {
   one: "MUN-ONE",
   kiosk: "MUN-ADD-KIOSK",
   mobileApp: "MUN-ADD-APP",
+  munchiOrder: "MUN-ADD-ORDER",
+  paymentTerminal: "MUN-ADD-TERMINAL",
+  hardware: "MUN-ADD-HARDWARE",
   mobileAppSetup: "MUN-SETUP-APP",
   sms: "MUN-SMS",
   loyaltyOverage: "MUN-OVR-LOYALTY"
@@ -16,6 +19,49 @@ var PLANS = [
   PRODUCTS.one
 ];
 
+// ../license-core/src/events/access-changed.ts
+import { z } from "zod";
+var ACCESS_CHANGED = "license.access_changed";
+var NO_ACCESS_STATES = /* @__PURE__ */ new Set([
+  "suspended",
+  "terminated",
+  "canceled"
+]);
+var accessChangedEventSchema = z.object({
+  kind: z.literal(ACCESS_CHANGED),
+  /** The event's own id: a redelivered message has the same one. */
+  id: z.string().min(1),
+  venueId: z.number().int(),
+  locationId: z.string().min(1),
+  accountId: z.string().min(1),
+  state: z.enum([
+    "trial",
+    "active",
+    "grace",
+    "start",
+    "suspended",
+    "terminated",
+    "canceled"
+  ]),
+  /** As in the snapshot: empty when the store is closed or switched off. */
+  features: z.array(z.string().min(1)),
+  /** As in the snapshot: how many of something the store may have; `null` = unlimited. */
+  limits: z.record(z.string(), z.number().int().min(0).nullable()),
+  suspension: z.object({
+    reason: z.string().min(1),
+    mode: z.enum([
+      "read_only",
+      "off"
+    ])
+  }).nullable(),
+  /** The audit action that changed it, e.g. `license.close` or `license.payment.suspend`. */
+  reason: z.string().min(1),
+  /** The snapshot's `v`: a consumer drops a message older than the last one it applied. */
+  snapshotVersion: z.number().int().min(0),
+  at: z.iso.datetime()
+});
+var hasAccess = /* @__PURE__ */ __name((event) => !NO_ACCESS_STATES.has(event.state), "hasAccess");
+
 // ../license-core/src/legal-entity.ts
 var Y_TUNNUS = /^(\d{6,7})-(\d)$/;
 var Y_TUNNUS_WEIGHTS = [
@@ -36,36 +82,24 @@ var finnishBusinessId = /* @__PURE__ */ __name((input) => {
   return Number(check) === expected ? `${digits}-${check}` : null;
 }, "finnishBusinessId");
 var finnishVatId = /* @__PURE__ */ __name((businessId) => `FI${businessId.replace("-", "")}`, "finnishVatId");
-var ANY_COUNTRY = {
-  businessId: /* @__PURE__ */ __name((input) => input.trim() || null, "businessId"),
-  vatId: /* @__PURE__ */ __name((_businessId, input) => input?.trim() || null, "vatId")
-};
-var COMPANY_IDS_BY_COUNTRY = {
-  FI: {
-    businessId: finnishBusinessId,
-    vatId: /* @__PURE__ */ __name((businessId, input) => {
-      const vatId = finnishVatId(businessId);
-      return input === null || input.replace(/\s/g, "").toUpperCase() === vatId ? vatId : void 0;
-    }, "vatId")
-  }
-};
 var companyIds = /* @__PURE__ */ __name((country, input) => {
-  const rules = COMPANY_IDS_BY_COUNTRY[country.toUpperCase()] ?? ANY_COUNTRY;
-  const businessId = rules.businessId(input.businessId);
-  if (businessId === null) return {
-    invalid: "businessId"
-  };
-  const vatId = rules.vatId(businessId, input.vatId ?? null);
-  if (vatId === void 0) return {
-    invalid: "vatId"
-  };
-  return {
+  const businessId = input.businessId.trim();
+  const vatId = input.vatId?.trim() || null;
+  const finnish = country.toUpperCase() === "FI" ? finnishBusinessId(businessId) : null;
+  if (finnish === null) return {
     businessId,
     vatId
   };
+  const derived = finnishVatId(finnish);
+  const matches = vatId === null || vatId.replace(/\s/g, "").toUpperCase() === derived;
+  return {
+    businessId: finnish,
+    vatId: matches ? derived : vatId
+  };
 }, "companyIds");
 
 // ../license-core/src/requestable-products.ts
+import { z as z2 } from "zod";
 var REQUESTABLE_PRODUCTS = [
   "ari",
   "business_account",
@@ -76,7 +110,9 @@ var REQUESTABLE_PRODUCTS = [
   "card_payments_kiosk",
   "sevenrooms",
   "tableonline",
-  "zenchef"
+  "zenchef",
+  "payment_terminal",
+  "hardware"
 ];
 var STORE_ONLY_PRODUCTS = [
   "foodora",
@@ -85,10 +121,18 @@ var STORE_ONLY_PRODUCTS = [
   "card_payments_kiosk",
   "sevenrooms",
   "tableonline",
-  "zenchef"
+  "zenchef",
+  "payment_terminal",
+  "hardware"
 ];
 var storeOnly = new Set(STORE_ONLY_PRODUCTS);
 var isStoreOnlyProduct = /* @__PURE__ */ __name((product) => storeOnly.has(product), "isStoreOnlyProduct");
+var MAX_DETAILS_BYTES = 1e4;
+var productRequestDetails = z2.record(z2.string(), z2.json()).refine((details) => Buffer.byteLength(JSON.stringify(details)) <= MAX_DETAILS_BYTES, {
+  message: `details may be at most ${MAX_DETAILS_BYTES} bytes`
+}).refine((details) => !JSON.stringify(details).includes("\\u0000"), {
+  message: "details may not contain the null character"
+});
 
 // ../license-core/src/usage-metrics.ts
 var USAGE_METRICS = {
@@ -236,6 +280,7 @@ var LicenseClient = class {
   }
 };
 export {
+  ACCESS_CHANGED,
   LicenseClient,
   PLANS,
   PRODUCTS,
@@ -243,8 +288,10 @@ export {
   STORE_ONLY_PRODUCTS,
   USAGE_METRICS,
   USAGE_METRIC_NAMES,
+  accessChangedEventSchema,
   companyIds,
   finnishBusinessId,
   finnishVatId,
+  hasAccess,
   isStoreOnlyProduct
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@munchi_oy/license-sdk",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "Client for the Munchi license service: cached entitlements and feature checks per venue",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -33,6 +33,9 @@
     "url": "git+https://github.com/gomunchi/one-license.git",
     "directory": "packages/license-sdk"
   },
+  "dependencies": {
+    "zod": "4.6.7"
+  },
   "devDependencies": {
     "@munchi_oy/license-core": "0.1.0",
     "@swc/core": "1.16.12",