@open-nodo/cli 0.6.0

package/src/project-files.js

@@ -0,0 +1,87 @@
+/** Reading and writing the files a scaffolded app owns: .env, .npmrc, .gitignore, nodo.modules.json. */
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { die } from "./console.js";
+
+const GH_PACKAGES = "https://npm.pkg.github.com";
+
+/** Upsert a KEY=value line in a dotenv string (preserves other lines / comments). */
+export function setEnvLine(envText, key, value) {
+  const line = `${key}=${value}`;
+  const re = new RegExp(`^${key}=.*$`, "m");
+  if (re.test(envText)) return envText.replace(re, line);
+  const base = envText.endsWith("\n") || envText === "" ? envText : `${envText}\n`;
+  return `${base}${line}\n`;
+}
+
+export function parseModuleSpec(spec) {
+  const at = spec.lastIndexOf("@");
+  if (at > 0) {
+    const version = spec.slice(at + 1);
+    return { key: spec.slice(0, at), version: version || null };
+  }
+  return { key: spec, version: null };
+}
+
+export function readModulesJson(dir) {
+  const p = join(dir, "nodo.modules.json");
+  if (!existsSync(p)) return { modules: [] };
+  try {
+    const j = JSON.parse(readFileSync(p, "utf8"));
+    return { ...j, modules: Array.isArray(j.modules) ? j.modules : [] };
+  } catch {
+    return die(`nodo.modules.json is not valid JSON — fix or remove it, then re-run.`);
+  }
+}
+
+export function writeModulesJson(dir, modules) {
+  const existing = readModulesJson(dir);
+  writeFileSync(
+    join(dir, "nodo.modules.json"),
+    JSON.stringify({ ...existing, modules }, null, 2) + "\n",
+  );
+}
+
+/** Write project .npmrc for GitHub Packages; use env token expansion (no secret in git). */
+export function writeProjectNpmrc(dir) {
+  const lines = [
+    "# @open-nodo/* — GitHub Packages. Auth required even for reads.",
+    "# Set NODE_AUTH_TOKEN (GitHub PAT with read:packages) in your environment.",
+    "#   export NODE_AUTH_TOKEN=$(gh auth token)",
+    `@open-nodo:registry=${GH_PACKAGES}`,
+    `//npm.pkg.github.com/:_authToken=\${NODE_AUTH_TOKEN}`,
+    "",
+  ];
+  writeFileSync(join(dir, ".npmrc"), lines.join("\n"));
+}
+
+/**
+ * Guarantee the scaffold ignores its own .env before the first commit — it holds
+ * NODO_SELECTION_TOKEN, a one-shot registration credential.
+ *
+ * The check is LINE-ANCHORED on purpose: a substring test for ".env" is already
+ * satisfied by the template's `.env*.local` pattern, which does not match a bare
+ * `.env`, so the token used to land in the initial commit.
+ *
+ * .npmrc deliberately stays tracked (it is the registry map, and auth comes from
+ * env expansion, not a committed secret).
+ */
+export function ensureGitignoreHidesEnv(dir) {
+  const gi = join(dir, ".gitignore");
+  const lines = existsSync(gi) ? readFileSync(gi, "utf8") : "";
+  const missing = [".env", ".env.local"].filter((p) => !new RegExp(`^${p}$`, "m").test(lines));
+  if (missing.length === 0) return;
+  const base = lines === "" || lines.endsWith("\n") ? lines : `${lines}\n`;
+  writeFileSync(gi, `${base}${missing.join("\n")}\n`);
+}
+
+/** Decode a selection token's payload. Unverified by design — the rail re-validates on register. */
+export function decodeToken(token) {
+  const parts = token.split(".");
+  if (parts.length < 2) die("That doesn't look like a selection token.");
+  try {
+    return JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+  } catch {
+    return die("Could not read the selection token.");
+  }
+}

package/src/versions.generated.json

@@ -0,0 +1,28 @@
+{
+  "@open-nodo/cli": "0.6.0",
+  "@open-nodo/codec-501c3-us": "0.1.1",
+  "@open-nodo/codec-anbi-nl": "0.1.1",
+  "@open-nodo/codec-asociacion-es": "0.1.1",
+  "@open-nodo/codec-assoc-fr": "0.1.1",
+  "@open-nodo/codec-charity-ie": "0.1.1",
+  "@open-nodo/codec-charity-uk": "0.1.1",
+  "@open-nodo/codec-onlus": "0.1.1",
+  "@open-nodo/codec-verein-de": "0.1.1",
+  "@open-nodo/compliance-core": "0.1.1",
+  "@open-nodo/core-db": "0.1.1",
+  "@open-nodo/format": "0.2.0",
+  "@open-nodo/module-accounting": "0.4.0",
+  "@open-nodo/module-beneficiaries": "0.1.2",
+  "@open-nodo/module-donors": "0.1.2",
+  "@open-nodo/module-members": "0.1.1",
+  "@open-nodo/module-patrimony": "0.6.0",
+  "@open-nodo/money": "0.1.1",
+  "@open-nodo/onlus-compliance": "1.0.1",
+  "@open-nodo/org-navigation": "0.2.0",
+  "@open-nodo/org-profile": "0.3.0",
+  "@open-nodo/pii-crypto": "0.2.0",
+  "@open-nodo/protocol": "0.3.0",
+  "@open-nodo/rendiconto": "0.1.1",
+  "@open-nodo/role-catalog": "0.2.0",
+  "@open-nodo/sdk": "0.1.3"
+}

package/template/.env.example

@@ -0,0 +1,15 @@
+# Connect this app to the Nodo rail. Unset → runs standalone (no rail, no check-in).
+NODO_RAIL_URL=https://nodo-rail.vercel.app/v1
+
+# One-time selection token from the /join flow (carries the modules you picked in the
+# catalog). Preferred over NODO_REGISTRATION_TOKEN when both are set. Needed only until
+# the first successful registration (the instance id is then persisted in the keystore).
+NODO_SELECTION_TOKEN=
+
+# One-time bootstrap token from the rail operator/console. Used when NODO_SELECTION_TOKEN
+# is unset; still supported.
+NODO_REGISTRATION_TOKEN=
+
+# Where to persist the Ed25519 instance keypair + cached check-in. Must be a
+# writable, durable path (a mounted volume in a container).
+NODO_KEYSTORE_PATH=./.nodo/keystore.json

package/template/README.md

@@ -0,0 +1,35 @@
+# Open Nodo app template
+
+This starter is bundled into `@open-nodo/cli`. A scaffolded repository owns its
+application and data while the SDK handles registration, signed check-in, and
+module entitlements.
+
+## Run
+
+1. Copy `.env.example` to `.env.local` and set the rail URL and one-time
+   registration or selection token.
+2. Set `NODE_AUTH_TOKEN` with `read:packages` while packages resolve from GitHub
+   Packages.
+3. Run `npm install` and `npm run dev`.
+
+With no rail URL, the starter runs in standalone mode.
+
+## Integration points
+
+- `src/lib/keystore.ts` stores the Ed25519 key, instance ID, and cached check-in
+  at `NODO_KEYSTORE_PATH`.
+- `src/lib/nodo.ts` integrates `@open-nodo/sdk`.
+- `instrumentation.ts` performs a time-boxed best-effort boot check-in.
+- `isNodoModuleEnabled("<module-key>")` gates each optional module mount point.
+
+The file keystore requires a durable writable volume. A stateless serverless
+deployment needs a persistent keystore adapter and is not supported by this
+starter.
+
+```bash
+npm run build
+NODO_RAIL_URL=… NODO_REGISTRATION_TOKEN=… NODO_KEYSTORE_PATH=/data/keystore.json \
+  node .next/standalone/templates/app/server.js
+```
+
+Raw books stay in the instance. Licensed under AGPL-3.0-or-later.

package/template/app/api/health/route.ts

@@ -0,0 +1,7 @@
+import { NextResponse } from "next/server";
+
+export const dynamic = "force-dynamic";
+
+export function GET(): NextResponse {
+  return NextResponse.json({ status: "ok", service: "nodo-app" });
+}

package/template/app/globals.css

@@ -0,0 +1,107 @@
+/* ─────────────────────────────────────────────────────────────────────────
+   Nodo design tokens — the same palette the Nodo platform ships (neutral
+   slate + emerald primary), stated as HSL channels and consumed via
+   hsl(var(--token)). Light is :root, dark follows the OS: a starter app
+   should not need a theme library to look right at 2am.
+
+   These are yours to edit. Every value below is a token, so restyling the
+   whole app means changing this block, not hunting inline colours.
+   ───────────────────────────────────────────────────────────────────────── */
+:root {
+  --background: 210 20% 99%;
+  --foreground: 222 24% 12%;
+  --card: 0 0% 100%;
+  --muted: 210 16% 95%;
+  --muted-foreground: 215 14% 40%;
+  --primary: 158 66% 30%;
+  --primary-text: 158 72% 27%;
+  --accent: 158 60% 94%;
+  --border: 214 20% 89%;
+  /* Control boundaries clear 3:1 against every surface (WCAG 1.4.11). */
+  --input: 214 16% 56%;
+  --ring: 158 64% 37%;
+  --radius: 0.85rem;
+  --radius-sm: 0.6rem;
+  color-scheme: light;
+}
+
+@media (prefers-color-scheme: dark) {
+  :root {
+    --background: 222 26% 6%;
+    --foreground: 210 22% 92%;
+    --card: 222 22% 9%;
+    --muted: 222 16% 14%;
+    --muted-foreground: 215 16% 60%;
+    --primary: 158 64% 45%;
+    --primary-text: 158 64% 56%;
+    --accent: 158 48% 14%;
+    --border: 222 14% 18%;
+    --input: 222 12% 45%;
+    --ring: 158 64% 46%;
+    color-scheme: dark;
+  }
+}
+
+* { box-sizing: border-box; }
+html { -webkit-text-size-adjust: 100%; }
+body {
+  margin: 0;
+  background: hsl(var(--background));
+  color: hsl(var(--foreground));
+  font-family: ui-sans-serif, system-ui, -apple-system, "Segoe UI", Roboto, Helvetica, Arial, sans-serif;
+  line-height: 1.55;
+  -webkit-font-smoothing: antialiased;
+}
+h1, h2 { line-height: 1.15; letter-spacing: -0.02em; margin: 0; }
+p { margin: 0; }
+code, .mono { font-family: ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; }
+
+:where(a[href], button, [tabindex]:not([tabindex="-1"])):focus-visible {
+  outline: 2px solid hsl(var(--ring));
+  outline-offset: 2px;
+  border-radius: var(--radius-sm);
+}
+
+.shell { max-width: 720px; margin: 0 auto; padding: 64px 24px; }
+
+.brand { display: flex; align-items: center; gap: 10px; margin-bottom: 8px; }
+.brand-dot {
+  width: 12px; height: 12px; border-radius: 50%;
+  background: hsl(var(--primary)); box-shadow: 0 0 0 4px hsl(var(--primary) / 0.18);
+}
+.brand h1 { font-size: 28px; }
+.lead { color: hsl(var(--muted-foreground)); margin-bottom: 28px; }
+
+.card {
+  background: hsl(var(--card));
+  border: 1px solid hsl(var(--border));
+  border-radius: var(--radius);
+  padding: 24px;
+  margin-bottom: 16px;
+}
+.card h2 { font-size: 16px; margin-bottom: 4px; }
+.muted { color: hsl(var(--muted-foreground)); }
+
+.row {
+  display: flex; justify-content: space-between; gap: 16px;
+  padding: 8px 0; border-bottom: 1px solid hsl(var(--border));
+}
+.row:last-child { border-bottom: 0; }
+.row .value { font-weight: 600; }
+.row .value code { font-size: 12px; }
+.yes { color: hsl(var(--primary-text)); }
+
+.modules { display: flex; flex-wrap: wrap; gap: 8px; }
+.module {
+  font-size: 13px; font-family: ui-monospace, Menlo, monospace;
+  border: 1px solid hsl(var(--border)); color: hsl(var(--muted-foreground));
+  border-radius: 8px; padding: 4px 10px;
+}
+.module.active { border-color: hsl(var(--primary) / 0.35); color: hsl(var(--primary-text)); }
+
+.hint { font-size: 13px; margin-top: 16px; }
+
+@media (max-width: 560px) {
+  .shell { padding: 40px 18px; }
+  .row { flex-direction: column; gap: 2px; }
+}

package/template/app/layout.tsx

@@ -0,0 +1,16 @@
+import type { ReactNode } from "react";
+import type { Metadata } from "next";
+import "./globals.css";
+
+export const metadata: Metadata = {
+  title: "Nodo app",
+  description: "A Nodo starter app connected to the rail.",
+};
+
+export default function RootLayout({ children }: { children: ReactNode }) {
+  return (
+    <html lang="en">
+      <body>{children}</body>
+    </html>
+  );
+}

package/template/app/page.tsx

@@ -0,0 +1,87 @@
+import { nodoStatus } from "@/src/lib/nodo";
+
+export const dynamic = "force-dynamic";
+
+function Row({ label, value }: { label: string; value: React.ReactNode }) {
+  return (
+    <div className="row">
+      <span className="muted">{label}</span>
+      <span className="value">{value}</span>
+    </div>
+  );
+}
+
+export default async function Home() {
+  const status = await nodoStatus();
+  const profile = status.enabled
+    ? (status.profile as { name?: string; legalForm?: string; hierarchy?: string } | null)
+    : null;
+
+  return (
+    <main className="shell">
+      <div className="brand">
+        <span className="brand-dot" aria-hidden />
+        <h1>Nodo app</h1>
+      </div>
+      <p className="lead">
+        An app you own, connected to the Nodo rail. Accounting, registers and day-to-day
+        operations switch on according to your entitlements.
+      </p>
+
+      {!status.enabled ? (
+        <div className="card">
+          <p className="muted">
+            Rail not configured. Set <code>NODO_RAIL_URL</code> (and{" "}
+            <code>NODO_REGISTRATION_TOKEN</code> on first boot) to connect this app.
+          </p>
+        </div>
+      ) : (
+        <>
+          <div className="card">
+            <h2>Connection</h2>
+            <Row label="Rail" value={<code>{status.railUrl}</code>} />
+            <Row
+              label="Registered"
+              value={status.registered ? <span className="yes">yes</span> : "no"}
+            />
+            {status.instanceId && <Row label="Instance" value={<code>{status.instanceId}</code>} />}
+            <Row
+              label="Last check-in"
+              value={
+                status.lastCheckinAtMs ? new Date(status.lastCheckinAtMs).toLocaleString() : "never"
+              }
+            />
+          </div>
+
+          {profile && (
+            <div className="card">
+              <h2>Profile</h2>
+              <Row label="Organisation" value={profile.name ?? "—"} />
+              <Row label="Legal form" value={profile.legalForm ?? "—"} />
+              <Row label="Hierarchy" value={profile.hierarchy ?? "—"} />
+            </div>
+          )}
+
+          <div className="card">
+            <h2>Active modules ({status.entitlements.filter((e) => e.active).length})</h2>
+            {status.entitlements.length === 0 ? (
+              <p className="muted">No modules enabled. Your operator turns them on from the rail.</p>
+            ) : (
+              <div className="modules">
+                {status.entitlements.map((e) => (
+                  <span key={e.module} className={`module${e.active ? " active" : ""}`}>
+                    {e.module}
+                  </span>
+                ))}
+              </div>
+            )}
+            <p className="muted hint">
+              {/* Each optional mount point is gated by isNodoModuleEnabled("<module-key>"). */}
+              Enabled packages mount here once their entitlement is active.
+            </p>
+          </div>
+        </>
+      )}
+    </main>
+  );
+}

package/template/gitignore

@@ -0,0 +1,12 @@
+/node_modules
+/.next/
+/out/
+*.tsbuildinfo
+next-env.d.ts
+# `nodo init` writes .env with NODO_SELECTION_TOKEN — a one-shot registration
+# credential. It must never reach the first commit. `.env*.local` alone does
+# NOT cover a bare `.env`.
+.env
+.env*.local
+.vercel
+/.nodo/

package/template/instrumentation.ts

@@ -0,0 +1,10 @@
+// Next.js instrumentation — runs once on server boot. Registers + checks into the
+// rail (best-effort, time-boxed so a rail outage never blocks startup).
+export async function register(): Promise<void> {
+  if (process.env["NEXT_RUNTIME"] !== "nodejs") return;
+  const { nodoCheckinOnBoot } = await import("./src/lib/nodo");
+  await Promise.race([
+    nodoCheckinOnBoot(),
+    new Promise<void>((resolve) => setTimeout(resolve, 3000)),
+  ]);
+}

package/template/next-env.d.ts

@@ -0,0 +1,6 @@
+/// <reference types="next" />
+/// <reference types="next/image-types/global" />
+import "./.next/types/routes.d.ts";
+
+// NOTE: This file should not be edited
+// see https://nextjs.org/docs/app/api-reference/config/typescript for more information.

package/template/next.config.ts

@@ -0,0 +1,12 @@
+import type { NextConfig } from "next";
+
+// Host-portable: `output: "standalone"` emits a self-contained .next/standalone
+// (server.js + bundled deps incl. @open-nodo/sdk) that runs as `node server.js` in any
+// container — the right home for the file keystore (mount a volume at NODO_KEYSTORE_PATH).
+// Vercel serverless's read-only FS doesn't suit the file keystore; use a container.
+const nextConfig: NextConfig = {
+  poweredByHeader: false,
+  output: "standalone",
+};
+
+export default nextConfig;

package/template/package.json

@@ -0,0 +1,29 @@
+{
+  "name": "@open-nodo/app-template",
+  "version": "0.1.0",
+  "private": true,
+  "description": "Self-hosted Open Nodo starter with signed registration and module entitlement checks.",
+  "license": "AGPL-3.0-or-later",
+  "scripts": {
+    "dev": "next dev -p 3200",
+    "build": "next build",
+    "start": "next start -p 3200",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "next": "^16.2.12",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
+    "@open-nodo/sdk": "^0.1.3"
+  },
+  "devDependencies": {
+    "@types/node": "^20.17.0",
+    "@types/react": "^19.2.0",
+    "@types/react-dom": "^19.2.0",
+    "typescript": "^5.7.2"
+  },
+  "overrides": {
+    "postcss": "^8.5.24",
+    "sharp": "^0.35.3"
+  }
+}

package/template/src/lib/keystore.ts

@@ -0,0 +1,71 @@
+import { mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { dirname } from "node:path";
+import type { KeyStore, Jwk, CachedCheckin } from "@open-nodo/sdk";
+
+// A durable KeyStore backed by a single JSON file (NODO_KEYSTORE_PATH). Keeps the
+// template dependency-free (no DB). Persists the Ed25519 private key, the instance
+// id, and the cached check-in so identity + entitlements survive restarts. Swap for
+// a DB-backed store at scale.
+
+type Persisted = {
+  privateKeyJwk?: Jwk;
+  instanceId?: string;
+  cachedCheckin?: CachedCheckin;
+};
+
+const PATH = process.env["NODO_KEYSTORE_PATH"] ?? "./.nodo/keystore.json";
+
+async function load(): Promise<Persisted> {
+  try {
+    return JSON.parse(
+      await readFile(/* turbopackIgnore: true */ PATH, "utf8"),
+    ) as Persisted;
+  } catch {
+    return {};
+  }
+}
+
+async function save(patch: Partial<Persisted>): Promise<void> {
+  const next = { ...(await load()), ...patch };
+  // The file holds a raw Ed25519 PRIVATE key: owner-only permissions, explicitly —
+  // the process umask must not get a vote (0755/0644 defaults leave it world-readable).
+  await mkdir(dirname(/* turbopackIgnore: true */ PATH), { recursive: true, mode: 0o700 });
+  // Atomic write: writeFile alone isn't atomic, so a crash mid-write would
+  // truncate the keystore and lose the Ed25519 private key (unrecoverable —
+  // re-registration needs a fresh token). Write a temp file then rename; a
+  // rename on the same filesystem is atomic, so any reader/crash sees either
+  // the intact old file or the fully-written new one. (Concurrent writers from
+  // separate processes can still last-write-wins; that's out of scope for this
+  // single-instance dev keystore — swap in a DB-backed store at scale.)
+  const tmp = `${PATH}.${process.pid}.tmp`;
+  await writeFile(
+    /* turbopackIgnore: true */ tmp,
+    JSON.stringify(next, null, 2),
+    { encoding: "utf8", mode: 0o600 },
+  );
+  await rename(
+    /* turbopackIgnore: true */ tmp,
+    /* turbopackIgnore: true */ PATH,
+  );
+}
+
+export const fileKeyStore: KeyStore = {
+  async getPrivateKeyJwk() {
+    return (await load()).privateKeyJwk ?? null;
+  },
+  async setPrivateKeyJwk(jwk) {
+    await save({ privateKeyJwk: jwk });
+  },
+  async getInstanceId() {
+    return (await load()).instanceId ?? null;
+  },
+  async setInstanceId(id) {
+    await save({ instanceId: id });
+  },
+  async getCachedCheckin() {
+    return (await load()).cachedCheckin ?? null;
+  },
+  async setCachedCheckin(cached) {
+    await save({ cachedCheckin: cached });
+  },
+};

package/template/src/lib/nodo.ts

@@ -0,0 +1,94 @@
+import { createNodoInstance, type NodoInstance } from "@open-nodo/sdk";
+import { fileKeyStore } from "./keystore";
+
+// Rail integration for the starter app. Entirely OPT-IN: with NODO_RAIL_URL unset,
+// every function is a no-op and the app runs standalone. When set, the app registers
+// as a `self` instance and checks in (identity + module entitlements). Best-effort —
+// the rail is non-critical and never throws into a request path.
+
+const railUrl = process.env["NODO_RAIL_URL"];
+const regToken = process.env["NODO_REGISTRATION_TOKEN"];
+const selectionToken = process.env["NODO_SELECTION_TOKEN"];
+const APP_VERSION = process.env["npm_package_version"] ?? "0.1.0";
+
+export function isNodoEnabled(): boolean {
+  return Boolean(railUrl);
+}
+
+const g = globalThis as unknown as { __nodoInstance?: NodoInstance };
+
+function getInstance(): NodoInstance {
+  if (!railUrl) throw new Error("NODO_RAIL_URL is not set");
+  g.__nodoInstance ??= createNodoInstance({ railUrl, storage: fileKeyStore });
+  return g.__nodoInstance;
+}
+
+/** Register on first boot (idempotent) + check in. Best-effort; swallows errors. */
+export async function nodoCheckinOnBoot(): Promise<void> {
+  if (!railUrl) return;
+  try {
+    const nodo = getInstance();
+    if (!(await fileKeyStore.getInstanceId())) {
+      try {
+        if (selectionToken) {
+          // Preferred: one-time selection token from the /join flow.
+          await nodo.registerWithSelectionToken(selectionToken);
+        } else if (regToken) {
+          await nodo.registerOnce(regToken, {
+            kind: "self",
+            hostname: process.env["VERCEL_URL"] ?? "nodo-app",
+          });
+        }
+      } catch {
+        // token already used / instance already registered — fine.
+      }
+    }
+    await nodo.checkin({ appVersion: APP_VERSION, modulesRunning: [] });
+  } catch (err) {
+    console.error(
+      JSON.stringify({
+        level: "warn",
+        msg: "nodo_checkin_failed",
+        error: err instanceof Error ? err.message : String(err),
+      }),
+    );
+  }
+}
+
+/** Offline-grace-aware module gate — use it to mount feature modules on entitlement. */
+export function isNodoModuleEnabled(key: string): boolean {
+  if (!railUrl || !g.__nodoInstance) return false;
+  return g.__nodoInstance.isModuleEnabled(key);
+}
+
+export type NodoStatus =
+  | { enabled: false }
+  | {
+      enabled: true;
+      railUrl: string;
+      registered: boolean;
+      instanceId: string | null;
+      profile: unknown;
+      entitlements: Array<{ module: string; plan: string; active: boolean }>;
+      lastCheckinAtMs: number | null;
+    };
+
+/** Non-sensitive status for the dashboard, read from the cached check-in. */
+export async function nodoStatus(): Promise<NodoStatus> {
+  if (!railUrl) return { enabled: false };
+  const [instanceId, cached] = await Promise.all([
+    fileKeyStore.getInstanceId(),
+    fileKeyStore.getCachedCheckin(),
+  ]);
+  return {
+    enabled: true,
+    railUrl,
+    registered: Boolean(instanceId),
+    instanceId,
+    profile:
+      ((cached?.response as { identity?: { profile?: unknown } } | undefined)?.identity)?.profile ?? null,
+    entitlements:
+      cached?.response.entitlements.map((e) => ({ module: e.module_key, plan: e.plan, active: e.active })) ?? [],
+    lastCheckinAtMs: cached?.fetchedAtMs ?? null,
+  };
+}

package/template/tsconfig.json

@@ -0,0 +1,41 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "lib": [
+      "dom",
+      "dom.iterable",
+      "esnext"
+    ],
+    "allowJs": true,
+    "skipLibCheck": true,
+    "strict": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "resolveJsonModule": true,
+    "isolatedModules": true,
+    "jsx": "react-jsx",
+    "incremental": true,
+    "plugins": [
+      {
+        "name": "next"
+      }
+    ],
+    "paths": {
+      "@/*": [
+        "./*"
+      ]
+    }
+  },
+  "include": [
+    "next-env.d.ts",
+    "**/*.ts",
+    "**/*.tsx",
+    ".next/types/**/*.ts",
+    ".next/dev/types/**/*.ts"
+  ],
+  "exclude": [
+    "node_modules"
+  ]
+}