@sidub-inc/licensing-client 1.3.43

package/dist/index.esm.js

@@ -0,0 +1,1657 @@
+import React, { createContext, useMemo, useContext } from 'react';
+
+/**
+ * Error class for licensing-related errors
+ */
+class LicensingError extends Error {
+    constructor(message, statusCode, response) {
+        super(message);
+        this.statusCode = statusCode;
+        this.response = response;
+        this.name = 'LicensingError';
+    }
+}
+
+/**
+ * License classification types
+ */
+var LicenseClassificationType;
+(function (LicenseClassificationType) {
+    /** Perpetual license with no expiration */
+    LicenseClassificationType["Perpetual"] = "Perpetual";
+    /** Subscription license with recurring billing */
+    LicenseClassificationType["Subscription"] = "Subscription";
+    /** Trial license with time-based expiration */
+    LicenseClassificationType["Trial"] = "Trial";
+})(LicenseClassificationType || (LicenseClassificationType = {}));
+const LICENSE_CLASSIFICATION_INT_MAP = {
+    0: LicenseClassificationType.Trial,
+    1: LicenseClassificationType.Subscription,
+    2: LicenseClassificationType.Perpetual,
+};
+/**
+ * Normalizes a license classification value from server integer or string to the TypeScript enum.
+ * The .NET server serializes enums as integers (0=Trial, 1=Subscription, 2=Perpetual).
+ */
+function normalizeLicenseClassificationType(value) {
+    if (value === null || value === undefined)
+        return undefined;
+    if (typeof value === 'number')
+        return LICENSE_CLASSIFICATION_INT_MAP[value];
+    const match = Object.values(LicenseClassificationType)
+        .find(v => v.toLowerCase() === String(value).toLowerCase());
+    return match;
+}
+/**
+ * Billing interval units for subscription licenses.
+ * Matches .NET BillingIntervalUnit enum with singular names.
+ */
+var BillingIntervalUnit;
+(function (BillingIntervalUnit) {
+    BillingIntervalUnit["Hour"] = "Hour";
+    BillingIntervalUnit["Day"] = "Day";
+    BillingIntervalUnit["Week"] = "Week";
+    BillingIntervalUnit["Month"] = "Month";
+    BillingIntervalUnit["Year"] = "Year";
+})(BillingIntervalUnit || (BillingIntervalUnit = {}));
+const BILLING_INTERVAL_INT_MAP = {
+    0: BillingIntervalUnit.Hour,
+    1: BillingIntervalUnit.Day,
+    2: BillingIntervalUnit.Week,
+    3: BillingIntervalUnit.Month,
+    4: BillingIntervalUnit.Year,
+};
+/**
+ * Normalizes a billing interval unit value from server integer or string to the TypeScript enum.
+ */
+function normalizeBillingIntervalUnit(value) {
+    if (value === null || value === undefined)
+        return undefined;
+    if (typeof value === 'number')
+        return BILLING_INTERVAL_INT_MAP[value];
+    const match = Object.values(BillingIntervalUnit)
+        .find(v => v.toLowerCase() === String(value).toLowerCase());
+    return match;
+}
+
+/**
+ * Encoding/decoding constants for credential strings
+ */
+const ENCODING_PREFIX = 'SIDUB_LIC_';
+const CURRENT_VERSION = 1;
+/**
+ * Encodes a licensing credential to a portable string.
+ * This matches the .NET LicensingCredential.ToEncodedString() format.
+ *
+ * @param credential The credential to encode
+ * @returns A portable encoded string prefixed with SIDUB_LIC_
+ */
+function encodeCredential(credential) {
+    const payload = {
+        Version: CURRENT_VERSION,
+        LicenseId: credential.licenseId,
+        ServiceKeyId: credential.serviceKeyId,
+        ServiceKeyPublicMember: credential.serviceKeyPublicMember,
+        ApiAccessKey: credential.apiAccessKey
+    };
+    const json = JSON.stringify(payload);
+    const base64 = btoa(json);
+    return `${ENCODING_PREFIX}${base64}`;
+}
+/**
+ * Decodes a licensing credential from an encoded string.
+ * This matches the .NET LicensingCredential.FromEncodedString() format.
+ *
+ * @param encodedString The encoded credential string
+ * @returns The decoded credential
+ * @throws {Error} If the format is invalid
+ */
+function decodeCredential(encodedString) {
+    if (!encodedString || typeof encodedString !== 'string') {
+        throw new Error('Encoded credential string cannot be null or empty.');
+    }
+    const trimmed = encodedString.trim();
+    if (!trimmed.startsWith(ENCODING_PREFIX)) {
+        throw new Error(`Invalid credential format. Expected prefix '${ENCODING_PREFIX}'.`);
+    }
+    const base64 = trimmed.substring(ENCODING_PREFIX.length);
+    let json;
+    try {
+        json = atob(base64);
+    }
+    catch {
+        throw new Error('Invalid credential format. Base64 decoding failed.');
+    }
+    let payload;
+    try {
+        payload = JSON.parse(json);
+    }
+    catch {
+        throw new Error('Invalid credential format. JSON deserialization failed.');
+    }
+    if (!payload) {
+        throw new Error('Invalid credential format. Payload deserialization returned null.');
+    }
+    if (payload.Version > CURRENT_VERSION) {
+        throw new Error(`Unsupported credential version ${payload.Version}. Maximum supported version is ${CURRENT_VERSION}.`);
+    }
+    return {
+        licenseId: payload.LicenseId,
+        serviceKeyId: payload.ServiceKeyId,
+        serviceKeyPublicMember: payload.ServiceKeyPublicMember ?? '',
+        apiAccessKey: payload.ApiAccessKey ?? ''
+    };
+}
+/**
+ * Attempts to parse an encoded credential string.
+ *
+ * @param encodedString The encoded credential string
+ * @returns The decoded credential, or null if parsing failed
+ */
+function tryDecodeCredential(encodedString) {
+    if (!encodedString) {
+        return null;
+    }
+    try {
+        return decodeCredential(encodedString);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Validates that a credential has all required fields for signature verification.
+ *
+ * @param credential The credential to validate
+ * @returns True if the credential has all required cryptography fields
+ */
+function hasValidCryptoConfig(credential) {
+    if (!credential) {
+        return false;
+    }
+    return !!(credential.serviceKeyId &&
+        credential.serviceKeyPublicMember &&
+        credential.serviceKeyId.length > 0 &&
+        credential.serviceKeyPublicMember.length > 0);
+}
+
+/**
+ * Gets the normalized feature key from a feature object.
+ * Handles both client-side (featureId) and server-side (FeatureKey) naming conventions.
+ *
+ * @param feature The feature object to extract the key from
+ * @returns The feature key, or empty string if not found
+ */
+function getFeatureKey(feature) {
+    if (!feature) {
+        return '';
+    }
+    // Check both camelCase (client) and PascalCase (server) conventions
+    return feature.featureId || feature.FeatureKey || '';
+}
+/**
+ * Checks if a feature matches the specified feature key.
+ * Handles both client-side (featureId) and server-side (FeatureKey) naming conventions.
+ *
+ * @param feature The feature to check
+ * @param featureKey The key to match against
+ * @returns True if the feature matches the key
+ */
+function matchesFeatureKey(feature, featureKey) {
+    if (!feature || !featureKey) {
+        return false;
+    }
+    const key = getFeatureKey(feature);
+    return key === featureKey;
+}
+/**
+ * Finds a feature by key in a feature array.
+ *
+ * @param features Array of features to search
+ * @param featureKey The key to find
+ * @returns The matching feature, or undefined if not found
+ */
+function findFeatureByKey(features, featureKey) {
+    if (!features || !Array.isArray(features)) {
+        return undefined;
+    }
+    return features.find(f => matchesFeatureKey(f, featureKey));
+}
+/**
+ * Checks if a feature with the specified key exists in the array.
+ *
+ * @param features Array of features to search
+ * @param featureKey The key to check for
+ * @returns True if a feature with the key exists
+ */
+function hasFeature(features, featureKey) {
+    return findFeatureByKey(features, featureKey) !== undefined;
+}
+
+/**
+ * Base class for implementing license assertions.
+ * Provides a foundation for creating custom assertion logic.
+ *
+ * @typeParam T The type of license feature this assertion operates on
+ */
+class LicenseAssertion {
+}
+
+/**
+ * Service access level types
+ */
+var ServiceAccessLevel;
+(function (ServiceAccessLevel) {
+    ServiceAccessLevel["Denied"] = "Denied";
+    ServiceAccessLevel["Allowed"] = "Allowed";
+})(ServiceAccessLevel || (ServiceAccessLevel = {}));
+const SERVICE_ACCESS_INT_MAP = {
+    0: ServiceAccessLevel.Denied,
+    1: ServiceAccessLevel.Allowed,
+};
+/**
+ * Normalizes a service access level value from server integer or string to the TypeScript enum.
+ * The .NET server serializes enums as integers (0=Denied, 1=Allowed).
+ */
+function normalizeServiceAccessLevel(value) {
+    if (value === null || value === undefined)
+        return undefined;
+    if (typeof value === 'number')
+        return SERVICE_ACCESS_INT_MAP[value];
+    const match = Object.values(ServiceAccessLevel)
+        .find(v => v.toLowerCase() === String(value).toLowerCase());
+    return match;
+}
+/**
+ * Gets the service access level from a feature, handling both casing conventions.
+ */
+function getServiceAccessLevel(feature) {
+    const raw = feature.serviceAccessLevel ?? feature.ServiceAccessLevel;
+    return normalizeServiceAccessLevel(raw);
+}
+/**
+ * Assertion that checks if a service/feature has the required access level.
+ *
+ * @example
+ * ```typescript
+ * // Check if 'premium-features' is allowed
+ * const assertion = ServiceAccessAssertion.create('premium-features', ServiceAccessLevel.Allowed);
+ * const hasAccess = assertion.isSatisfied(authorization);
+ * ```
+ */
+class ServiceAccessAssertion extends LicenseAssertion {
+    /**
+     * Creates a new service access assertion
+     * @param featureKey The feature key to check
+     * @param requiredAccessLevel The required access level (default: Allowed)
+     * @param serviceType Optional service type to filter by
+     */
+    constructor(featureKey, requiredAccessLevel = ServiceAccessLevel.Allowed, serviceType) {
+        super();
+        this.requiredAccessLevel = requiredAccessLevel;
+        this.serviceType = serviceType;
+        this.featureKey = featureKey;
+    }
+    /**
+     * Checks if the authorization contains the feature with the required access level
+     */
+    isSatisfied(authorization) {
+        if (!authorization?.features) {
+            return false;
+        }
+        return authorization.features.some((feature) => {
+            const serverFeature = feature;
+            // Check if this is the matching feature
+            if (!matchesFeatureKey(serverFeature, this.featureKey)) {
+                return false;
+            }
+            // Check service type if specified
+            if (this.serviceType && serverFeature.serviceType !== this.serviceType) {
+                return false;
+            }
+            // Check access level
+            const accessLevel = getServiceAccessLevel(serverFeature);
+            if (accessLevel) {
+                return accessLevel === this.requiredAccessLevel;
+            }
+            // If no access level specified, assume allowed if feature exists
+            return true;
+        });
+    }
+    /**
+     * Factory method to create a service access assertion
+     * @param featureKey The feature key to check
+     * @param requiredAccessLevel The required access level (default: Allowed)
+     * @param serviceType Optional service type to filter by
+     */
+    static create(featureKey, requiredAccessLevel = ServiceAccessLevel.Allowed, serviceType) {
+        return new ServiceAccessAssertion(featureKey, requiredAccessLevel, serviceType);
+    }
+}
+
+/**
+ * Assertion that checks if a rate-limited feature is within its limit.
+ *
+ * @example
+ * ```typescript
+ * // Key-based construction (preferred)
+ * const assertion = RateLimitAssertion.create('api-calls');
+ * const withinLimit = assertion.isSatisfied(authorization);
+ *
+ * // Feature-based construction (when you already have the feature)
+ * const assertion = RateLimitAssertion.create(feature);
+ * ```
+ */
+class RateLimitAssertion extends LicenseAssertion {
+    /**
+     * Creates a new rate limit assertion.
+     * @param featureKeyOrFeature A feature key string or a rate limit feature instance.
+     */
+    constructor(featureKeyOrFeature) {
+        super();
+        if (typeof featureKeyOrFeature === 'string') {
+            this.featureKey = featureKeyOrFeature;
+        }
+        else {
+            this.featureKey = featureKeyOrFeature.featureId;
+        }
+    }
+    /**
+     * Checks if the feature's consumption is within its rate limit.
+     * Prefers local feature state when available, falls back to server currentConsumption.
+     */
+    isSatisfied(authorization, featureStates) {
+        if (!authorization?.features) {
+            return false;
+        }
+        // Find the matching feature in the authorization
+        const authFeature = authorization.features.find((f) => matchesFeatureKey(f, this.featureKey));
+        if (!authFeature) {
+            return false;
+        }
+        // Get rate limit from the authoritative server feature
+        const rateLimit = authFeature.rateLimit;
+        // If no rate limit specified, assume unlimited
+        if (rateLimit === undefined || rateLimit === null) {
+            return true;
+        }
+        // Prefer local state if available
+        if (featureStates) {
+            const stateKey = `${authorization.licenseId}.${this.featureKey}`;
+            const localState = featureStates.get(stateKey);
+            if (localState) {
+                return localState.getConsumption() <= rateLimit;
+            }
+        }
+        // Fallback to server-reported currentConsumption
+        const consumption = authFeature.currentConsumption ?? 0;
+        return consumption <= rateLimit;
+    }
+    static create(featureKeyOrFeature) {
+        return new RateLimitAssertion(featureKeyOrFeature);
+    }
+}
+
+/**
+ * Cryptography service for license signature validation.
+ * Uses the Web Crypto API for cross-platform compatibility.
+ */
+/**
+ * Service for cryptographic operations on license entities.
+ * Implements signature verification using ECDSA with P-256 curve and SHA-256.
+ */
+class CryptoService {
+    constructor(config) {
+        this.publicKey = null;
+        this.config = config;
+    }
+    /**
+     * Gets the service key ID
+     */
+    get serviceKeyId() {
+        return this.config.serviceKeyId;
+    }
+    /**
+     * Initializes the public key from the configured base64 string.
+     * Must be called before verifying signatures.
+     */
+    async initialize() {
+        if (this.publicKey) {
+            return; // Already initialized
+        }
+        try {
+            // Decode the base64 public key
+            const publicKeyBytes = this.base64ToArrayBuffer(this.config.serviceKeyPublicMember);
+            // Import the public key for verification
+            // The .NET platform uses ECDSA with P-256 (secp256r1) curve and SHA-256
+            this.publicKey = await crypto.subtle.importKey('spki', // SubjectPublicKeyInfo format (DER)
+            publicKeyBytes, {
+                name: 'ECDSA',
+                namedCurve: 'P-256'
+            }, false, // Not extractable
+            ['verify'] // Only used for verification
+            );
+        }
+        catch (error) {
+            throw new CryptoError(`Failed to initialize public key: ${error instanceof Error ? error.message : 'Unknown error'}`, 'KEY_IMPORT_FAILED');
+        }
+    }
+    /**
+     * Verifies the signature of a signed entity.
+     *
+     * @param data The data that was signed (serialized entity without signature)
+     * @param signature The signature to verify (base64-encoded)
+     * @returns True if the signature is valid, false otherwise
+     */
+    async verifySignature(data, signature) {
+        if (!this.publicKey) {
+            throw new CryptoError('CryptoService not initialized. Call initialize() first.', 'NOT_INITIALIZED');
+        }
+        try {
+            const signatureBytes = this.base64ToArrayBuffer(signature);
+            return await crypto.subtle.verify({
+                name: 'ECDSA',
+                hash: 'SHA-256'
+            }, this.publicKey, signatureBytes, data);
+        }
+        catch (error) {
+            throw new CryptoError(`Signature verification failed: ${error instanceof Error ? error.message : 'Unknown error'}`, 'VERIFICATION_FAILED');
+        }
+    }
+    /**
+     * Converts a base64 string to an ArrayBuffer.
+     * Handles both standard base64 and base64url encoding.
+     */
+    base64ToArrayBuffer(base64) {
+        // Handle both standard base64 and base64url encoding
+        const normalizedBase64 = base64
+            .replace(/-/g, '+')
+            .replace(/_/g, '/');
+        // Add padding if necessary
+        const paddedBase64 = normalizedBase64 + '='.repeat((4 - normalizedBase64.length % 4) % 4);
+        const binaryString = atob(paddedBase64);
+        const bytes = new Uint8Array(binaryString.length);
+        for (let i = 0; i < binaryString.length; i++) {
+            bytes[i] = binaryString.charCodeAt(i);
+        }
+        return bytes.buffer;
+    }
+}
+/**
+ * Error class for cryptography-related errors
+ */
+class CryptoError extends Error {
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = 'CryptoError';
+    }
+}
+
+/**
+ * Signature validator for license authorization entities.
+ * Validates that the authorization returned from the server has not been tampered with.
+ */
+/**
+ * Validates license authorization signatures to ensure integrity.
+ *
+ * This class implements the client-side portion of the signature verification
+ * that mirrors the .NET LicensingService.GetAuthorization() validation logic.
+ */
+class SignatureValidator {
+    /**
+     * Creates a new SignatureValidator instance.
+     *
+     * @param config Cryptography configuration. If null, validation will be skipped.
+     */
+    constructor(config) {
+        this.cryptoService = null;
+        this.initialized = false;
+        if (config) {
+            this.cryptoService = new CryptoService(config);
+        }
+    }
+    /**
+     * Gets whether cryptographic validation is configured
+     */
+    get isConfigured() {
+        return this.cryptoService !== null;
+    }
+    /**
+     * Initializes the validator. Must be called before validating signatures.
+     */
+    async initialize() {
+        if (this.initialized || !this.cryptoService) {
+            return;
+        }
+        await this.cryptoService.initialize();
+        this.initialized = true;
+    }
+    /**
+     * Validates the signature of a license authorization using the raw server response.
+     *
+     * The validation process:
+     * 1. Extracts the signature from __sidub_entitySignature
+     * 2. Serializes the raw response data (excluding signature field)
+     * 3. Verifies the signature using the configured public key
+     *
+     * @param rawResponse The raw server response (before client mapping)
+     * @param options Validation options
+     * @returns Validation result
+     * @throws {CryptoError} If throwOnInvalid is true and validation fails
+     */
+    async validateRawResponse(rawResponse, options = {}) {
+        const { throwOnInvalid = true, required = this.isConfigured } = options;
+        // If no crypto service configured, skip validation
+        if (!this.cryptoService) {
+            if (required) {
+                const error = 'Signature validation is required but no cryptography configuration was provided.';
+                if (throwOnInvalid) {
+                    throw new CryptoError(error, 'NOT_INITIALIZED');
+                }
+                return { isValid: false, skipped: false, error };
+            }
+            return { isValid: true, skipped: true };
+        }
+        // Ensure initialized
+        await this.initialize();
+        // Check if response has a signature
+        const signature = rawResponse.__sidub_entitySignature;
+        if (!signature) {
+            if (required) {
+                const error = 'Authorization does not contain a signature.';
+                if (throwOnInvalid) {
+                    throw new CryptoError(error, 'INVALID_SIGNATURE');
+                }
+                return { isValid: false, skipped: false, error };
+            }
+            return { isValid: true, skipped: true };
+        }
+        try {
+            // Serialize the raw response data for verification (excluding signature)
+            const dataToVerify = this.serializeRawForVerification(rawResponse);
+            const dataBytes = new TextEncoder().encode(dataToVerify);
+            const isValid = await this.cryptoService.verifySignature(dataBytes.buffer, signature);
+            if (!isValid) {
+                const error = 'Authorization signature verification failed. The authorization may have been tampered with.';
+                if (throwOnInvalid) {
+                    throw new CryptoError(error, 'INVALID_SIGNATURE');
+                }
+                return { isValid: false, skipped: false, error };
+            }
+            return { isValid: true, skipped: false };
+        }
+        catch (error) {
+            if (error instanceof CryptoError) {
+                throw error;
+            }
+            const message = `Signature validation error: ${error instanceof Error ? error.message : 'Unknown error'}`;
+            if (throwOnInvalid) {
+                throw new CryptoError(message, 'VERIFICATION_FAILED');
+            }
+            return { isValid: false, skipped: false, error: message };
+        }
+    }
+    /**
+     * Serializes the raw server response for signature verification.
+     * Removes the __sidub_entitySignature field and serializes to JSON.
+     */
+    serializeRawForVerification(rawResponse) {
+        // Create a copy without the signature field
+        // eslint-disable-next-line @typescript-eslint/no-unused-vars
+        const { __sidub_entitySignature, ...dataWithoutSignature } = rawResponse;
+        return JSON.stringify(dataWithoutSignature);
+    }
+}
+
+/**
+ * In-memory authorization cache with TTL-based expiry and pseudo-LRU eviction.
+ * Cache key format: {licenseId}.{serviceKeyId}
+ * One cache instance per LicensingClient — no singletons.
+ */
+class AuthorizationCache {
+    constructor(maxSize = 100) {
+        this.cache = new Map();
+        this.maxSize = maxSize;
+    }
+    /**
+     * Gets a cached authorization if it exists and has not expired.
+     * On hit, re-inserts the entry to move it to the end (pseudo-LRU freshness).
+     */
+    get(licenseId, serviceKeyId) {
+        const key = `${licenseId}.${serviceKeyId}`;
+        const entry = this.cache.get(key);
+        if (!entry)
+            return null;
+        // Lazy TTL — delete expired entries on access
+        if (Date.now() >= entry.expiresAt) {
+            this.cache.delete(key);
+            return null;
+        }
+        // Move to end of Map for pseudo-LRU freshness
+        this.cache.delete(key);
+        this.cache.set(key, entry);
+        return entry.authorization;
+    }
+    /**
+     * Stores an authorization in the cache.
+     * Evicts the oldest entry if max size is reached.
+     */
+    set(licenseId, serviceKeyId, authorization) {
+        const key = `${licenseId}.${serviceKeyId}`;
+        // Compute expiresAt from authorization, default 1hr if no expiry
+        const expiresAt = authorization.expiresAt
+            ? authorization.expiresAt.getTime()
+            : Date.now() + 3600000;
+        // If key already exists, delete first (so re-insert goes to end)
+        if (this.cache.has(key)) {
+            this.cache.delete(key);
+        }
+        else if (this.cache.size >= this.maxSize) {
+            // Evict oldest entry (first key in Map insertion order)
+            const oldestKey = this.cache.keys().next().value;
+            if (oldestKey !== undefined) {
+                this.cache.delete(oldestKey);
+            }
+        }
+        this.cache.set(key, { authorization, expiresAt });
+    }
+    /** Removes all cached entries */
+    clearCache() {
+        this.cache.clear();
+    }
+    /** Removes all cached entries for a specific license across all service keys */
+    invalidate(licenseId) {
+        const prefix = `${licenseId}.`;
+        for (const key of Array.from(this.cache.keys())) {
+            if (key.startsWith(prefix)) {
+                this.cache.delete(key);
+            }
+        }
+    }
+}
+
+/**
+ * Tracks timestamped consumption metrics for a rate-limited feature.
+ * Mirrors the .NET RateLimitLicenseFeatureState pattern.
+ *
+ * Entries older than sampleSeconds are pruned on every getConsumption() call.
+ * Local state is additive/conservative — may over-count (safer than under-counting).
+ */
+class RateLimitFeatureState {
+    constructor(sampleSeconds) {
+        this.metrics = [];
+        this.sampleSeconds = sampleSeconds;
+    }
+    /** Records a consumption event with the current timestamp */
+    consumeRate(amount) {
+        this.metrics.push({ timestamp: Date.now(), amount });
+    }
+    /** Returns total consumption within the sample window, pruning stale entries */
+    getConsumption() {
+        const cutoff = Date.now() - (this.sampleSeconds * 1000);
+        this.metrics = this.metrics.filter(m => m.timestamp >= cutoff);
+        return this.metrics.reduce((sum, m) => sum + m.amount, 0);
+    }
+}
+
+class LicensingConfigurationException extends LicensingError {
+    constructor(message) {
+        super(message);
+        this.name = 'LicensingConfigurationException';
+    }
+}
+
+/**
+ * Main client for interacting with the Sidub Licensing service.
+ * Provides minimal API surface with only 3 core operations needed for runtime enforcement.
+ *
+ * Supports cryptographic signature validation to ensure authorization integrity.
+ */
+class LicensingClient {
+    /**
+     * Creates a new instance of the LicensingClient
+     * @param config Configuration for the licensing service
+     */
+    constructor(config) {
+        this.featureStates = new Map();
+        this.featureMetadata = new Map(); // stateKey -> sampleSeconds
+        this.contextResolved = false;
+        this.contextResolutionPromise = null;
+        // Decode credential if provided
+        this.credential = config.encodedCredential
+            ? decodeCredential(config.encodedCredential)
+            : null;
+        // Merge decoded credential with explicit config (explicit config takes precedence)
+        this.config = {
+            ...config,
+            timeout: config.timeout || 30000,
+            apiKey: config.apiKey || this.credential?.apiAccessKey,
+            licenseId: config.licenseId || this.credential?.licenseId,
+            serviceKeyId: config.serviceKeyId || this.credential?.serviceKeyId,
+            serviceKeyPublicMember: config.serviceKeyPublicMember || this.credential?.serviceKeyPublicMember
+        };
+        // Build crypto config if we have the required values
+        const cryptoConfig = this.buildCryptoConfig();
+        this.signatureValidator = new SignatureValidator(cryptoConfig);
+        // Determine if signature validation should be performed
+        this.validateSignatures = config.validateSignatures ?? (cryptoConfig !== null);
+        // Initialize authorization cache (enabled by default)
+        this.cacheEnabled = config.cacheEnabled !== false;
+        this.authorizationCache = this.cacheEnabled
+            ? new AuthorizationCache(config.cacheMaxSize ?? 100)
+            : null;
+    }
+    /**
+     * Ensures context provider has been resolved before making API calls.
+     * Called once per client lifetime; concurrent callers share the same promise.
+     */
+    async ensureContextResolved() {
+        if (this.contextResolved)
+            return;
+        if (this.contextResolutionPromise) {
+            await this.contextResolutionPromise;
+            return;
+        }
+        if (!this.config.contextProvider) {
+            this.contextResolved = true;
+            return;
+        }
+        this.contextResolutionPromise = (async () => {
+            const context = await this.config.contextProvider.resolveContext();
+            if (context) {
+                const hadCrypto = !!(this.config.serviceKeyId && this.config.serviceKeyPublicMember);
+                if (!this.config.licenseId && context.licenseId)
+                    this.config = { ...this.config, licenseId: context.licenseId };
+                if (!this.config.serviceKeyId && context.serviceKeyId)
+                    this.config = { ...this.config, serviceKeyId: context.serviceKeyId };
+                if (!this.config.serviceKeyPublicMember && context.serviceKeyPublicMember)
+                    this.config = { ...this.config, serviceKeyPublicMember: context.serviceKeyPublicMember };
+                if (!this.config.apiKey && context.apiAccessKey)
+                    this.config = { ...this.config, apiKey: context.apiAccessKey };
+                if (!this.config.billableResourceId && context.billableResourceId)
+                    this.config = { ...this.config, billableResourceId: context.billableResourceId };
+                if (!this.config.billablePlanId && context.billablePlanId)
+                    this.config = { ...this.config, billablePlanId: context.billablePlanId };
+                // Rebuild crypto if keys were newly resolved
+                const hasCryptoNow = !!(this.config.serviceKeyId && this.config.serviceKeyPublicMember);
+                if (!hadCrypto && hasCryptoNow) {
+                    const cryptoConfig = this.buildCryptoConfig();
+                    this.signatureValidator = new SignatureValidator(cryptoConfig);
+                    this.validateSignatures = this.config.validateSignatures ?? (cryptoConfig !== null);
+                }
+            }
+            this.contextResolved = true;
+        })();
+        await this.contextResolutionPromise;
+    }
+    /**
+     * Builds the cryptography configuration from the resolved config values
+     */
+    buildCryptoConfig() {
+        const { serviceKeyId, serviceKeyPublicMember } = this.config;
+        if (serviceKeyId && serviceKeyPublicMember) {
+            return {
+                serviceKeyId,
+                serviceKeyPublicMember
+            };
+        }
+        return null;
+    }
+    /**
+     * Gets whether cryptographic signature validation is enabled
+     */
+    get isSignatureValidationEnabled() {
+        return this.validateSignatures && this.signatureValidator.isConfigured;
+    }
+    /**
+     * Gets the configured license ID (from credential or explicit config)
+     */
+    get configuredLicenseId() {
+        return this.config.licenseId;
+    }
+    /**
+     * Retrieves a license authorization from the server.
+     * This is the primary method for validating and obtaining license information.
+     *
+     * If cryptographic configuration is provided, the authorization signature will be
+     * validated to ensure integrity. This mirrors the .NET LicensingService behavior.
+     *
+     * @param licenseId The unique identifier of the license (optional if configured via encodedCredential)
+     * @param apiKey Optional API key for authentication (overrides config default)
+     * @returns A promise resolving to the license authorization
+     * @throws {LicensingError} If the request fails or authorization is denied
+     * @throws {CryptoError} If signature validation fails (when crypto config is provided)
+     */
+    async getAuthorization(licenseId, apiKey) {
+        await this.ensureContextResolved();
+        // Use provided licenseId or fall back to configured value
+        const effectiveLicenseId = licenseId || this.config.licenseId;
+        if (!effectiveLicenseId) {
+            throw new LicensingConfigurationException('License ID is required. Provide it as a parameter or via configuration.');
+        }
+        // Check cache first
+        if (this.cacheEnabled && this.authorizationCache) {
+            const cached = this.authorizationCache.get(effectiveLicenseId, this.config.serviceKeyId ?? '');
+            if (cached)
+                return cached;
+        }
+        const url = `${this.config.licenseServiceUri}/GenerateLicenseAuthorization`;
+        const effectiveApiKey = apiKey || this.config.apiKey;
+        const headers = {
+            'Content-Type': 'application/json',
+        };
+        // Add authentication headers if API key is provided
+        if (effectiveApiKey) {
+            headers['dub-issuerKey'] = effectiveApiKey;
+        }
+        const parameters = {
+            RequestId: this.generateRequestId(),
+            LicenseId: effectiveLicenseId
+        };
+        // Add query parameters for API key if provided
+        const queryParams = effectiveApiKey
+            ? `?subscription-key=${encodeURIComponent(effectiveApiKey)}`
+            : '';
+        try {
+            const controller = new AbortController();
+            const timeoutId = setTimeout(() => controller.abort(), this.config.timeout);
+            const response = await fetch(`${url}${queryParams}`, {
+                method: 'POST',
+                headers,
+                body: JSON.stringify(parameters),
+                signal: controller.signal
+            });
+            clearTimeout(timeoutId);
+            if (!response.ok) {
+                const errorText = await response.text().catch(() => 'Unknown error');
+                throw new LicensingError(`Authorization failed: ${response.statusText}`, response.status, errorText);
+            }
+            const data = await response.json();
+            // Validate signature FIRST using raw server response (before any mapping)
+            // This ensures we verify against the exact bytes the server signed
+            let signatureValidated = false;
+            if (this.validateSignatures) {
+                const validationResult = await this.signatureValidator.validateRawResponse(data, { throwOnInvalid: true, required: this.signatureValidator.isConfigured });
+                signatureValidated = validationResult.isValid && !validationResult.skipped;
+            }
+            // Map server response to client model
+            // Note: Server uses PascalCase, we convert to camelCase
+            // Signature is returned as base64 string in __sidub_entitySignature from .NET
+            const rawSignature = data.__sidub_entitySignature ?? data.Signature ?? data.signature;
+            const signature = this.normalizeSignature(rawSignature);
+            const authorization = {
+                authorizationId: data.AuthorizationId || data.authorizationId,
+                licenseId: data.LicenseId || data.licenseId,
+                classification: normalizeLicenseClassificationType(data.LicenseClassification ?? data.classification) ?? LicenseClassificationType.Perpetual,
+                features: this.mapFeatures(data.Features || data.features || []),
+                issuedAt: new Date(data.IssueDate || data.issuedAt || data.IssuedAt),
+                expiresAt: (data.ExpiryDate || data.expiresAt || data.ExpiresAt)
+                    ? new Date(data.ExpiryDate || data.expiresAt || data.ExpiresAt)
+                    : undefined,
+                signature,
+                signatureValidated
+            };
+            // Cache feature sampleSeconds for auto-creating RateLimitFeatureState in performOperation
+            for (const f of authorization.features) {
+                const rf = f;
+                const ss = rf.sampleSeconds ?? rf.SampleSeconds;
+                if (ss !== undefined && typeof ss === 'number') {
+                    this.featureMetadata.set(`${authorization.licenseId}.${f.featureId}`, ss);
+                }
+            }
+            // Store in cache
+            if (this.cacheEnabled && this.authorizationCache) {
+                this.authorizationCache.set(effectiveLicenseId, this.config.serviceKeyId ?? '', authorization);
+            }
+            return authorization;
+        }
+        catch (error) {
+            if (error instanceof LicensingError) {
+                throw error;
+            }
+            // Re-throw CryptoError as-is
+            if (error instanceof Error && error.name === 'CryptoError') {
+                throw error;
+            }
+            if (error instanceof Error) {
+                if (error.name === 'AbortError') {
+                    throw new LicensingError('Request timeout', 408);
+                }
+                throw new LicensingError(`Network error: ${error.message}`);
+            }
+            throw new LicensingError('Unknown error occurred');
+        }
+    }
+    /**
+     * Maps server feature format to client format.
+     * Explicitly constructs camelCase feature objects instead of spreading server properties.
+     * This prevents PascalCase duplicates and ensures consistent property access.
+     */
+    mapFeatures(serverFeatures) {
+        if (!Array.isArray(serverFeatures)) {
+            return [];
+        }
+        return serverFeatures.map((f) => {
+            const sf = f;
+            // Normalize featureId from PascalCase server response
+            const featureId = String(sf.FeatureKey ?? sf.featureKey ?? sf.featureId ?? '');
+            // Build normalized feature with camelCase properties only
+            const feature = { featureId };
+            // ServiceAccessLevel (ServiceAccessLicenseFeature)
+            const rawAccess = sf.ServiceAccessLevel ?? sf.serviceAccessLevel;
+            if (rawAccess !== undefined) {
+                feature.serviceAccessLevel = normalizeServiceAccessLevel(rawAccess);
+            }
+            // SampleSeconds (RateLimitLicenseFeature)
+            const rawSampleSeconds = sf.SampleSeconds ?? sf.sampleSeconds;
+            if (rawSampleSeconds !== undefined) {
+                feature.sampleSeconds = rawSampleSeconds;
+            }
+            // RateLimit (RateLimitLicenseFeature)
+            const rawRateLimit = sf.RateLimit ?? sf.rateLimit;
+            if (rawRateLimit !== undefined) {
+                feature.rateLimit = rawRateLimit;
+            }
+            // CurrentConsumption (may come from server)
+            const rawConsumption = sf.CurrentConsumption ?? sf.currentConsumption;
+            if (rawConsumption !== undefined) {
+                feature.currentConsumption = rawConsumption;
+            }
+            return feature;
+        });
+    }
+    /**
+     * Normalizes the signature from server response.
+     * Handles both base64 string format (from .NET Convert.ToBase64String)
+     * and byte array format (JSON array of numbers).
+     *
+     * @param rawSignature The raw signature from server response
+     * @returns Normalized base64 string, or undefined if not present
+     */
+    normalizeSignature(rawSignature) {
+        if (rawSignature === null || rawSignature === undefined) {
+            return undefined;
+        }
+        // If it's already a string (base64 from .NET), use as-is
+        if (typeof rawSignature === 'string') {
+            return rawSignature.length > 0 ? rawSignature : undefined;
+        }
+        // If it's an array (JSON serialized byte[]), convert to base64
+        if (Array.isArray(rawSignature)) {
+            try {
+                const bytes = new Uint8Array(rawSignature);
+                let binary = '';
+                for (let i = 0; i < bytes.length; i++) {
+                    binary += String.fromCharCode(bytes[i]);
+                }
+                return btoa(binary);
+            }
+            catch {
+                return undefined;
+            }
+        }
+        return undefined;
+    }
+    /**
+     * Asserts whether a license condition is satisfied using the provided assertion.
+     * This evaluates the assertion against a license authorization.
+     *
+     * @param assertion The license assertion to evaluate
+     * @param authorization The license authorization to check against (if not provided, you must call getAuthorization first)
+     * @returns True if the assertion is satisfied, false otherwise
+     *
+     * @example
+     * ```typescript
+     * const authorization = await client.getAuthorization('license-id');
+     * const assertion = ServiceAccessAssertion.create('premium-features');
+     * const hasAccess = client.assertLicense(assertion, authorization);
+     * ```
+     */
+    assertLicense(assertion, authorization) {
+        // Auto-inject feature states for RateLimitAssertion
+        if (assertion instanceof RateLimitAssertion) {
+            return assertion.isSatisfied(authorization, this.featureStates);
+        }
+        return assertion.isSatisfied(authorization);
+    }
+    /** Clears all cached authorizations */
+    clearCache() {
+        this.authorizationCache?.clearCache();
+    }
+    /** Invalidates all cached authorizations for a specific license */
+    invalidateCache(licenseId) {
+        this.authorizationCache?.invalidate(licenseId);
+    }
+    /** Gets the local feature state for a license+feature combination */
+    getFeatureState(licenseId, featureKey) {
+        return this.featureStates.get(`${licenseId}.${featureKey}`);
+    }
+    /** Sets/replaces the local feature state for a license+feature combination */
+    setFeatureState(licenseId, featureKey, state) {
+        this.featureStates.set(`${licenseId}.${featureKey}`, state);
+    }
+    /**
+     * Reports license feature consumption/usage to the server.
+     * This is used for metering and billing purposes.
+     *
+     * @param operation The operation to report
+     * @returns A promise that resolves when the operation is reported
+     * @throws {LicensingError} If the request fails
+     */
+    async performOperation(operation) {
+        await this.ensureContextResolved();
+        // If no consumption service URI is configured, silently skip
+        if (!this.config.consumptionServiceUri) {
+            return;
+        }
+        const url = `${this.config.consumptionServiceUri}/messages`;
+        const apiKey = this.config.apiKey;
+        const headers = {
+            'Content-Type': 'application/json',
+        };
+        if (apiKey) {
+            headers['dub-apiKey'] = apiKey;
+        }
+        const queryParams = apiKey
+            ? `?subscription-key=${encodeURIComponent(apiKey)}`
+            : '';
+        try {
+            const controller = new AbortController();
+            const timeoutId = setTimeout(() => controller.abort(), this.config.timeout);
+            const response = await fetch(`${url}${queryParams}`, {
+                method: 'POST',
+                headers,
+                body: JSON.stringify({
+                    LicenseId: operation.licenseId,
+                    BillableResourceId: this.config.billableResourceId ?? '00000000-0000-0000-0000-000000000000',
+                    BillablePlanId: this.config.billablePlanId ?? '',
+                    IsBillable: true,
+                    LicenseOperation: {
+                        LicenseFeature: {
+                            FeatureKey: operation.feature.featureId
+                        },
+                        Amount: operation.quantity ?? 1
+                    }
+                }),
+                signal: controller.signal
+            });
+            clearTimeout(timeoutId);
+            if (!response.ok) {
+                const errorText = await response.text().catch(() => 'Unknown error');
+                throw new LicensingError(`Consumption report failed: ${response.statusText}`, response.status, errorText);
+            }
+            // Update local feature state after successful server report (auto-create if needed)
+            const stateKey = `${operation.licenseId}.${operation.feature.featureId}`;
+            let state = this.featureStates.get(stateKey);
+            if (!state) {
+                const sampleSeconds = this.featureMetadata.get(stateKey) ?? 3600;
+                state = new RateLimitFeatureState(sampleSeconds);
+                this.featureStates.set(stateKey, state);
+            }
+            state.consumeRate(operation.quantity ?? 1);
+        }
+        catch (error) {
+            if (error instanceof LicensingError) {
+                throw error;
+            }
+            if (error instanceof Error) {
+                if (error.name === 'AbortError') {
+                    throw new LicensingError('Request timeout', 408);
+                }
+                throw new LicensingError(`Network error: ${error.message}`);
+            }
+            throw new LicensingError('Unknown error occurred');
+        }
+    }
+    /**
+     * Reports a telemetry-only access check event to the server.
+     * This does not affect billing — IsBillable is always false.
+     * Used for tracking feature access patterns without metering costs.
+     *
+     * @param licenseId The license ID (optional if configured)
+     * @param featureKey The feature being accessed
+     * @param apiKey Optional API key override
+     */
+    async reportAccessCheck(licenseId, featureKey, apiKey) {
+        await this.ensureContextResolved();
+        if (!this.config.consumptionServiceUri) {
+            return;
+        }
+        const effectiveLicenseId = licenseId || this.config.licenseId;
+        if (!effectiveLicenseId || !featureKey) {
+            return;
+        }
+        const url = `${this.config.consumptionServiceUri}/messages`;
+        const effectiveApiKey = apiKey || this.config.apiKey;
+        const headers = {
+            'Content-Type': 'application/json',
+        };
+        if (effectiveApiKey) {
+            headers['dub-apiKey'] = effectiveApiKey;
+        }
+        const queryParams = effectiveApiKey
+            ? `?subscription-key=${encodeURIComponent(effectiveApiKey)}`
+            : '';
+        const body = JSON.stringify({
+            LicenseId: effectiveLicenseId,
+            BillableResourceId: this.config.billableResourceId ?? '00000000-0000-0000-0000-000000000000',
+            BillablePlanId: this.config.billablePlanId ?? '',
+            IsBillable: false,
+            LicenseOperation: {
+                LicenseFeature: {
+                    FeatureKey: featureKey
+                },
+                Amount: 0
+            }
+        });
+        try {
+            const controller = new AbortController();
+            const timeoutId = setTimeout(() => controller.abort(), this.config.timeout);
+            const response = await fetch(`${url}${queryParams}`, {
+                method: 'POST',
+                headers,
+                body,
+                signal: controller.signal
+            });
+            clearTimeout(timeoutId);
+            if (!response.ok) {
+                const errorText = await response.text().catch(() => 'Unknown error');
+                throw new LicensingError(`Access check report failed: ${response.statusText}`, response.status, errorText);
+            }
+        }
+        catch (error) {
+            if (error instanceof LicensingError)
+                throw error;
+            if (error instanceof Error) {
+                if (error.name === 'AbortError')
+                    throw new LicensingError('Request timeout', 408);
+                throw new LicensingError(`Network error: ${error.message}`);
+            }
+            throw new LicensingError('Unknown error occurred');
+        }
+    }
+    /**
+     * Creates an embedded checkout session for purchasing an offering.
+     * For free/trial offerings, the license is provisioned immediately (sessionUrl will be null).
+     * For paid offerings, sessionUrl will contain the payment provider URL.
+     *
+     * Uses licenseServiceUri (not consumptionServiceUri) — checkout is a licensing operation.
+     *
+     * @param request Checkout request parameters
+     * @param apiKey Optional API key override (reseller's API key)
+     * @returns The created checkout session with sessionId and optional sessionUrl
+     * @throws {LicensingError} If the request fails
+     */
+    async createCheckoutSession(request, apiKey) {
+        await this.ensureContextResolved();
+        const url = `${this.config.licenseServiceUri}/checkout/embedded`;
+        const effectiveApiKey = apiKey || this.config.apiKey;
+        const headers = {
+            'Content-Type': 'application/json',
+        };
+        if (effectiveApiKey) {
+            headers['dub-apiKey'] = effectiveApiKey;
+        }
+        const queryParams = effectiveApiKey
+            ? `?subscription-key=${encodeURIComponent(effectiveApiKey)}`
+            : '';
+        // Send PascalCase body matching CreateCheckoutSessionParameters.cs
+        const body = JSON.stringify({
+            RequestId: this.generateRequestId(),
+            OfferingId: request.offeringId,
+            IssuerClientId: request.issuerClientId,
+            CorrelationId: request.correlationId,
+            CustomerEmail: request.customerEmail,
+            SuccessUrl: request.successUrl,
+            CancelUrl: request.cancelUrl
+        });
+        try {
+            const controller = new AbortController();
+            const timeoutId = setTimeout(() => controller.abort(), this.config.timeout);
+            const response = await fetch(`${url}${queryParams}`, {
+                method: 'POST',
+                headers,
+                body,
+                signal: controller.signal
+            });
+            clearTimeout(timeoutId);
+            if (!response.ok) {
+                const errorText = await response.text().catch(() => 'Unknown error');
+                throw new LicensingError(`Checkout session creation failed: ${response.statusText}`, response.status, errorText);
+            }
+            const data = await response.json();
+            // Map PascalCase server response to camelCase DTO
+            return {
+                sessionId: data.SessionId ?? data.sessionId,
+                sessionUrl: data.SessionUrl ?? data.sessionUrl ?? null
+            };
+        }
+        catch (error) {
+            if (error instanceof LicensingError)
+                throw error;
+            if (error instanceof Error) {
+                if (error.name === 'AbortError')
+                    throw new LicensingError('Request timeout', 408);
+                throw new LicensingError(`Network error: ${error.message}`);
+            }
+            throw new LicensingError('Unknown error occurred');
+        }
+    }
+    /**
+     * Retrieves the result of a checkout session.
+     * Poll this method after creating a checkout session to check if the purchase is complete.
+     *
+     * For free/trial offerings, the result is immediately available (status = 'completed').
+     * For paid offerings, status will be 'pending' until the customer completes payment.
+     *
+     * @param sessionId The session ID from createCheckoutSession()
+     * @param apiKey Optional API key override
+     * @returns The checkout session result with status, credential, and error fields
+     * @throws {LicensingError} If the request fails
+     */
+    async getCheckoutResult(sessionId, apiKey) {
+        await this.ensureContextResolved();
+        const url = `${this.config.licenseServiceUri}/checkout/session/result`;
+        const effectiveApiKey = apiKey || this.config.apiKey;
+        const headers = {
+            'Content-Type': 'application/json',
+        };
+        if (effectiveApiKey) {
+            headers['dub-apiKey'] = effectiveApiKey;
+        }
+        const queryParams = effectiveApiKey
+            ? `?subscription-key=${encodeURIComponent(effectiveApiKey)}`
+            : '';
+        // Send PascalCase body matching GetCheckoutSessionResultParameters.cs
+        const body = JSON.stringify({
+            SessionId: sessionId
+        });
+        try {
+            const controller = new AbortController();
+            const timeoutId = setTimeout(() => controller.abort(), this.config.timeout);
+            const response = await fetch(`${url}${queryParams}`, {
+                method: 'POST',
+                headers,
+                body,
+                signal: controller.signal
+            });
+            clearTimeout(timeoutId);
+            if (!response.ok) {
+                const errorText = await response.text().catch(() => 'Unknown error');
+                throw new LicensingError(`Checkout result retrieval failed: ${response.statusText}`, response.status, errorText);
+            }
+            const data = await response.json();
+            // Map PascalCase server response to camelCase DTO
+            const status = (data.Status ?? data.status ?? 'pending').toLowerCase();
+            return {
+                status,
+                correlationId: data.CorrelationId ?? data.correlationId,
+                encodedCredential: data.EncodedCredential ?? data.encodedCredential,
+                licenseId: data.LicenseId ?? data.licenseId,
+                offeringId: data.OfferingId ?? data.offeringId,
+                error: data.Error ?? data.error
+            };
+        }
+        catch (error) {
+            if (error instanceof LicensingError)
+                throw error;
+            if (error instanceof Error) {
+                if (error.name === 'AbortError')
+                    throw new LicensingError('Request timeout', 408);
+                throw new LicensingError(`Network error: ${error.message}`);
+            }
+            throw new LicensingError('Unknown error occurred');
+        }
+    }
+    /**
+     * Generates a unique request ID for tracking
+     * @private
+     */
+    generateRequestId() {
+        // Use crypto.randomUUID if available (modern browsers and Node 16+)
+        if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+            return crypto.randomUUID();
+        }
+        // Fallback: Generate a simple UUID v4
+        return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, (c) => {
+            const r = (Math.random() * 16) | 0;
+            const v = c === 'x' ? r : (r & 0x3) | 0x8;
+            return v.toString(16);
+        });
+    }
+    /**
+     * Polls for a checkout session result with exponential backoff.
+     * Replaces the useCheckout hook pattern with an imperative API.
+     *
+     * @param sessionId The session ID from createCheckoutSession()
+     * @param options Optional: apiKey override, AbortSignal for cancellation, maxAttempts (default 60)
+     * @returns The completed or failed checkout session result
+     * @throws {LicensingError} If polling times out or the request fails
+     */
+    async pollCheckoutResult(sessionId, options) {
+        const maxAttempts = options?.maxAttempts ?? 60;
+        const signal = options?.signal;
+        let delay = 1000;
+        const maxDelay = 15000;
+        for (let attempt = 0; attempt < maxAttempts; attempt++) {
+            if (signal?.aborted) {
+                throw new LicensingError('Checkout polling cancelled');
+            }
+            const result = await this.getCheckoutResult(sessionId, options?.apiKey);
+            if (result.status === 'completed' || result.status === 'failed') {
+                return result;
+            }
+            // Wait with exponential backoff
+            await new Promise((resolve) => {
+                const timer = setTimeout(resolve, delay);
+                if (signal) {
+                    const onAbort = () => { clearTimeout(timer); resolve(); };
+                    signal.addEventListener('abort', onAbort, { once: true });
+                }
+            });
+            delay = Math.min(delay * 2, maxDelay);
+        }
+        throw new LicensingError('Checkout polling timed out');
+    }
+    /**
+     * Gets the current configuration
+     */
+    getConfig() {
+        return { ...this.config };
+    }
+}
+
+/**
+ * Assertion that checks if a feature with a specific key exists in the authorization.
+ * This is the simplest form of assertion for basic feature checking.
+ *
+ * @example
+ * ```typescript
+ * const assertion = FeatureExistsAssertion.create('premium-analytics');
+ * const hasFeature = assertion.isSatisfied(authorization);
+ * ```
+ */
+class FeatureExistsAssertion extends LicenseAssertion {
+    /**
+     * Creates a new feature exists assertion
+     * @param featureKey The feature key to check for
+     */
+    constructor(featureKey) {
+        super();
+        this.featureKey = featureKey;
+    }
+    /**
+     * Checks if the authorization contains a feature with the specified key
+     */
+    isSatisfied(authorization) {
+        if (!authorization?.features) {
+            return false;
+        }
+        return hasFeature(authorization.features, this.featureKey);
+    }
+    /**
+     * Factory method to create a feature exists assertion
+     * @param featureKey The feature key to check for
+     */
+    static create(featureKey) {
+        return new FeatureExistsAssertion(featureKey);
+    }
+}
+/**
+ * Assertion that combines multiple assertions with AND logic.
+ * All assertions must be satisfied for this to return true.
+ *
+ * @example
+ * ```typescript
+ * const assertion = CompositeAssertion.and(
+ *   FeatureExistsAssertion.create('feature1'),
+ *   FeatureExistsAssertion.create('feature2')
+ * );
+ * ```
+ */
+class CompositeAssertion extends LicenseAssertion {
+    /**
+     * Creates a new composite assertion
+     * @param assertions The assertions to combine
+     * @param logic The logic to apply ('and' or 'or')
+     */
+    constructor(assertions, logic = 'and') {
+        super();
+        this.assertions = assertions;
+        this.logic = logic;
+        this.featureKey = assertions.map(a => a.featureKey).join(logic === 'and' ? '&' : '|');
+    }
+    /**
+     * Evaluates all assertions according to the logic
+     */
+    isSatisfied(authorization) {
+        if (this.assertions.length === 0) {
+            return true;
+        }
+        if (this.logic === 'and') {
+            return this.assertions.every(a => a.isSatisfied(authorization));
+        }
+        else {
+            return this.assertions.some(a => a.isSatisfied(authorization));
+        }
+    }
+    /**
+     * Factory method to create an AND composite assertion
+     * @param assertions The assertions to combine with AND logic
+     */
+    static and(...assertions) {
+        return new CompositeAssertion(assertions, 'and');
+    }
+    /**
+     * Factory method to create an OR composite assertion
+     * @param assertions The assertions to combine with OR logic
+     */
+    static or(...assertions) {
+        return new CompositeAssertion(assertions, 'or');
+    }
+}
+/**
+ * Assertion that inverts another assertion's result.
+ *
+ * @example
+ * ```typescript
+ * const assertion = NotAssertion.create(
+ *   FeatureExistsAssertion.create('blocked-feature')
+ * );
+ * // Returns true if the feature does NOT exist
+ * ```
+ */
+class NotAssertion extends LicenseAssertion {
+    /**
+     * Creates a new NOT assertion
+     * @param assertion The assertion to invert
+     */
+    constructor(assertion) {
+        super();
+        this.assertion = assertion;
+        this.featureKey = assertion.featureKey;
+    }
+    /**
+     * Returns the opposite of the wrapped assertion's result
+     */
+    isSatisfied(authorization) {
+        return !this.assertion.isSatisfied(authorization);
+    }
+    /**
+     * Factory method to create a NOT assertion
+     * @param assertion The assertion to invert
+     */
+    static create(assertion) {
+        return new NotAssertion(assertion);
+    }
+}
+
+const LicensingContext = createContext(undefined);
+/**
+ * Provider component for the Sidub Licensing context.
+ * Wraps your application to provide licensing functionality to all child components.
+ *
+ * Supports cryptographic signature validation when configured with serviceKeyId
+ * and serviceKeyPublicMember (either directly or via encodedCredential).
+ *
+ * @example
+ * ```tsx
+ * // Basic usage (no signature validation)
+ * <LicensingProvider config={{
+ *   licenseServiceUri: 'https://api.example.com',
+ *   apiKey: 'your-api-key'
+ * }}>
+ *   <App />
+ * </LicensingProvider>
+ *
+ * // With encoded credential (includes signature validation)
+ * <LicensingProvider config={{
+ *   licenseServiceUri: 'https://api.example.com',
+ *   encodedCredential: 'SIDUB_LIC_...'
+ * }}>
+ *   <App />
+ * </LicensingProvider>
+ * ```
+ */
+const LicensingProvider = ({ config, children }) => {
+    // Create client with memoization - recreate only if config changes
+    const value = useMemo(() => {
+        const client = new LicensingClient(config);
+        return {
+            client,
+            isSignatureValidationEnabled: client.isSignatureValidationEnabled,
+            configuredLicenseId: client.configuredLicenseId
+        };
+    }, [
+        config.licenseServiceUri,
+        config.consumptionServiceUri,
+        config.apiKey,
+        config.timeout,
+        config.encodedCredential,
+        config.serviceKeyId,
+        config.serviceKeyPublicMember,
+        config.licenseId,
+        config.validateSignatures
+    ]);
+    return (React.createElement(LicensingContext.Provider, { value: value }, children));
+};
+/**
+ * Hook to access the LicensingClient from context.
+ * Must be used within a LicensingProvider.
+ *
+ * @throws {Error} If used outside of a LicensingProvider
+ * @returns The LicensingClient instance
+ *
+ * @example
+ * ```tsx
+ * function MyComponent() {
+ *   const client = useLicensingContext();
+ *   // Use client.getAuthorization(), etc.
+ * }
+ * ```
+ */
+const useLicensingContext = () => {
+    const context = useContext(LicensingContext);
+    if (!context) {
+        throw new Error('useLicensingContext must be used within a LicensingProvider');
+    }
+    return context.client;
+};
+/**
+ * Hook to access the full licensing context including metadata.
+ * Must be used within a LicensingProvider.
+ *
+ * @throws {Error} If used outside of a LicensingProvider
+ * @returns The full licensing context value
+ *
+ * @example
+ * ```tsx
+ * function MyComponent() {
+ *   const { client, isSignatureValidationEnabled, configuredLicenseId } = useLicensingContextValue();
+ *
+ *   if (!isSignatureValidationEnabled) {
+ *     console.warn('Signature validation is disabled');
+ *   }
+ * }
+ * ```
+ */
+const useLicensingContextValue = () => {
+    const context = useContext(LicensingContext);
+    if (!context) {
+        throw new Error('useLicensingContextValue must be used within a LicensingProvider');
+    }
+    return context;
+};
+
+/**
+ * Creates a LicensingContextType from an encoded credential string.
+ * Billable fields are NOT included in the encoding (per .NET behavior) and must be provided separately.
+ */
+function licensingContextFromEncodedString(encoded, billableResourceId, billablePlanId) {
+    const credential = decodeCredential(encoded);
+    return {
+        licenseId: credential.licenseId,
+        serviceKeyId: credential.serviceKeyId,
+        serviceKeyPublicMember: credential.serviceKeyPublicMember,
+        apiAccessKey: credential.apiAccessKey,
+        billableResourceId,
+        billablePlanId
+    };
+}
+/**
+ * Encodes a LicensingContextType to a portable string.
+ * Per .NET behavior: only the 4 credential fields are encoded, NOT billable fields.
+ */
+function licensingContextToEncodedString(context) {
+    return encodeCredential({
+        licenseId: context.licenseId,
+        serviceKeyId: context.serviceKeyId,
+        serviceKeyPublicMember: context.serviceKeyPublicMember,
+        apiAccessKey: context.apiAccessKey
+    });
+}
+
+/**
+ * Default context provider that builds a LicensingContextType from LicensingConfig.
+ * Returns null when no credentials are configured (user hasn't purchased a license yet).
+ * Caches the result after first resolution (lazy, one-shot).
+ */
+class ConfigurationContextProvider {
+    constructor(config) {
+        this.cached = undefined; // undefined = not yet resolved
+        this.config = config;
+    }
+    async resolveContext() {
+        // Return cached result if already resolved
+        if (this.cached !== undefined)
+            return this.cached;
+        let context = null;
+        if (this.config.encodedCredential) {
+            const credential = decodeCredential(this.config.encodedCredential);
+            context = {
+                licenseId: credential.licenseId,
+                serviceKeyId: credential.serviceKeyId,
+                serviceKeyPublicMember: credential.serviceKeyPublicMember,
+                apiAccessKey: credential.apiAccessKey,
+                billableResourceId: this.config.billableResourceId,
+                billablePlanId: this.config.billablePlanId
+            };
+        }
+        else if (this.config.licenseId && this.config.serviceKeyId && this.config.serviceKeyPublicMember && this.config.apiKey) {
+            context = {
+                licenseId: this.config.licenseId,
+                serviceKeyId: this.config.serviceKeyId,
+                serviceKeyPublicMember: this.config.serviceKeyPublicMember,
+                apiAccessKey: this.config.apiKey,
+                billableResourceId: this.config.billableResourceId,
+                billablePlanId: this.config.billablePlanId
+            };
+        }
+        this.cached = context;
+        return context;
+    }
+}
+
+export { AuthorizationCache, BillingIntervalUnit, CompositeAssertion, ConfigurationContextProvider, CryptoError, CryptoService, FeatureExistsAssertion, LicenseAssertion, LicenseClassificationType, LicensingClient, LicensingConfigurationException, LicensingError, LicensingProvider, NotAssertion, RateLimitAssertion, RateLimitFeatureState, ServiceAccessAssertion, ServiceAccessLevel, SignatureValidator, decodeCredential, encodeCredential, findFeatureByKey, getFeatureKey, hasFeature, hasValidCryptoConfig, licensingContextFromEncodedString, licensingContextToEncodedString, matchesFeatureKey, normalizeBillingIntervalUnit, normalizeLicenseClassificationType, normalizeServiceAccessLevel, tryDecodeCredential, useLicensingContext, useLicensingContextValue };
+//# sourceMappingURL=index.esm.js.map