@voltro/plugin-licensing 0.85.0 → 0.87.0

package/dist/cloud.d.ts

@@ -0,0 +1,31 @@
+import { Effect } from 'effect';
+import { VoidIfEmpty } from 'effect/Types';
+import { YieldableError } from 'effect/Cause';
+
+/** Authenticated JSON retrieval from the existing Cloud /licenses route.
+ * HTTPS, or literal local loopback HTTP for private development/fixtures.
+ * Redirects refuse before credential forwarding. No issuer or verification key. */
+export declare const cloudLicenseSnapshot: (options: CloudLicenseSnapshotOptions) => LicenseSnapshotSource;
+
+export declare interface CloudLicenseSnapshotOptions {
+    readonly url: string;
+    /** Read the actual license:read credential at refresh time. Never a signing key. */
+    readonly bearerToken: () => Effect.Effect<string, LicenseSnapshotFetchError>;
+    readonly timeoutMs?: number;
+}
+
+/** Redacted transport refusal. No response body, URL, token or credential cause. */
+export declare class LicenseSnapshotFetchError extends LicenseSnapshotFetchError_base<{
+    readonly reason: 'credentials' | 'transport' | 'status' | 'response';
+    readonly status?: number;
+}> {
+}
+
+declare const LicenseSnapshotFetchError_base: new <A extends Record<string, any> = {}>(args: VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => YieldableError & {
+    readonly _tag: "LicenseSnapshotFetchError";
+} & Readonly<A>;
+
+/** Swappable server transport; verification and installation remain with Licensing. */
+export declare type LicenseSnapshotSource = () => Effect.Effect<string, LicenseSnapshotFetchError>;
+
+export { }

package/dist/cloud.js

@@ -0,0 +1,61 @@
+import { Data as e, Effect as t } from "effect";
+//#region src/cloud.ts
+var n = class extends e.TaggedError("LicenseSnapshotFetchError") {}, r = 131072, i = 65536, a = (e) => {
+	let a = new URL(e.url), o = a.hostname === "127.0.0.1" || a.hostname === "[::1]";
+	if (a.username !== "" || a.password !== "" || a.hash !== "" || a.protocol !== "https:" && !(a.protocol === "http:" && o)) throw Error("Cloud license retrieval requires HTTPS or literal local loopback HTTP, without URL credentials or fragments");
+	let s = a.href, c = e.bearerToken, l = e.timeoutMs ?? 3e4;
+	if (typeof c != "function" || !Number.isSafeInteger(l) || l <= 0 || l > 3e5) throw Error("Cloud license retrieval requires an actual credential port and bounded positive timeout");
+	return () => t.gen(function* () {
+		let e = yield* c();
+		return typeof e != "string" || e.length === 0 || e.length > i || !/^[\x21-\x7e]+$/.test(e) ? yield* t.fail(new n({ reason: "credentials" })) : yield* t.tryPromise({
+			try: async (t) => {
+				let a = new AbortController(), o = () => {
+					a.abort();
+				};
+				t.addEventListener("abort", o, { once: !0 }), t.aborted && a.abort();
+				let c = setTimeout(o, l);
+				try {
+					let t = await fetch(s, {
+						headers: { authorization: `Bearer ${e}` },
+						redirect: "error",
+						signal: a.signal
+					});
+					if (!t.ok) throw await t.body?.cancel(), new n({
+						reason: "status",
+						status: t.status
+					});
+					if (!/^application\/json(?:\s*;|\s*$)/i.test(t.headers.get("content-type") ?? "") || t.body === null) throw await t.body?.cancel(), new n({ reason: "response" });
+					let o = t.headers.get("content-length");
+					if (o !== null && (!/^\d+$/.test(o) || Number(o) > r)) throw await t.body.cancel(), new n({ reason: "response" });
+					let c = t.body.getReader(), l = [], u = 0;
+					try {
+						for (;;) {
+							let e = await c.read();
+							if (e.done) break;
+							if (u += e.value.byteLength, u > r) throw await c.cancel(), new n({ reason: "response" });
+							l.push(e.value);
+						}
+					} finally {
+						c.releaseLock();
+					}
+					let d = new Uint8Array(u), f = 0;
+					for (let e of l) d.set(e, f), f += e.byteLength;
+					let p;
+					try {
+						p = JSON.parse(new TextDecoder("utf-8", { fatal: !0 }).decode(d));
+					} catch {
+						throw new n({ reason: "response" });
+					}
+					let m = typeof p == "object" && p && !Array.isArray(p) && "token" in p ? p.token : void 0;
+					if (typeof m != "string" || m.length > i || !/^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(m)) throw new n({ reason: "response" });
+					return m;
+				} finally {
+					clearTimeout(c), t.removeEventListener("abort", o);
+				}
+			},
+			catch: (e) => e instanceof n ? e : new n({ reason: "transport" })
+		});
+	});
+};
+//#endregion
+export { n as LicenseSnapshotFetchError, a as cloudLicenseSnapshot };

package/dist/games.d.ts

@@ -0,0 +1,39 @@
+import { Schema } from 'effect';
+
+/** A numeric cap, or `'unlimited'` for no cap. */
+declare type EntitlementLimit = number | 'unlimited';
+
+/** License names, not package installation or accepted capability claims. */
+export declare const GAMES_PLUGIN_GRANTS: readonly ["rooms", "matchmaking", "leaderboards", "social", "chat", "guilds", "inventory", "economy", "progression", "liveops", "players", "saves", "sanctions", "gm"];
+
+export declare const GamesLicenseEdition: Schema.Literals<readonly ["games", "games-enterprise"]>;
+
+export declare type GamesLicenseEdition = typeof GamesLicenseEdition.Type;
+
+export declare interface GamesSignLicenseInput extends Omit<SignLicenseInput, 'edition'> {
+    readonly edition: GamesLicenseEdition;
+}
+
+declare interface SignLicenseInput {
+    /** Scope the license to one tenant id; omit for a deployment-wide license. */
+    readonly tenant?: string;
+    /** Edition label (e.g. `'pro'`, `'enterprise'`). */
+    readonly edition: string;
+    /** Per-key numeric limits (`'unlimited'` for no cap). */
+    readonly entitlements: Readonly<Record<string, EntitlementLimit>>;
+    /** Boolean feature flags to grant. */
+    readonly features?: ReadonlyArray<string>;
+    /** Plugins licensed for production use (names without the
+     *  `@voltro/plugin-` prefix, e.g. `['storage']`). */
+    readonly plugins?: ReadonlyArray<string>;
+    /** Seconds from `now` until the license expires. */
+    readonly ttlSeconds: number;
+    /** Key id stamped into the JWS header (public-key rotation). */
+    readonly kid?: string;
+}
+
+/** Issuer-side composition. Retains actual caller-owned base grants, limits,
+ * seats and TTL. It signs nothing and invents no price, key or entitlement. */
+export declare const withGamesPluginGrants: (input: GamesSignLicenseInput) => SignLicenseInput;
+
+export { }

package/dist/games.js

@@ -0,0 +1,65 @@
+import { Schema as e } from "effect";
+//#region src/games.ts
+var t = e.Literals(["games", "games-enterprise"]), n = Object.freeze([
+	"rooms",
+	"matchmaking",
+	"leaderboards",
+	"social",
+	"chat",
+	"guilds",
+	"inventory",
+	"economy",
+	"progression",
+	"liveops",
+	"players",
+	"saves",
+	"sanctions",
+	"gm"
+]), r = (r) => {
+	if (!r || Object.getPrototypeOf(r) !== Object.prototype || Object.getOwnPropertySymbols(r).length) throw TypeError("Invalid Games license input");
+	let i = Object.getOwnPropertyDescriptors(r);
+	if (Object.entries(i).some(([e, t]) => ![
+		"tenant",
+		"edition",
+		"entitlements",
+		"features",
+		"plugins",
+		"ttlSeconds",
+		"kid"
+	].includes(e) || !t.enumerable || !("value" in t))) throw TypeError("Invalid Games license input");
+	let a = Object.fromEntries(Object.entries(i).map(([e, t]) => [e, t.value]));
+	e.decodeUnknownSync(e.toType(t))(a.edition);
+	let o = (e) => typeof e == "string" && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$/.test(e);
+	if (a.tenant !== void 0 && !o(a.tenant) || a.kid !== void 0 && !o(a.kid) || !Number.isSafeInteger(a.ttlSeconds) || a.ttlSeconds <= 0) throw TypeError("Invalid Games license input");
+	let s = (e) => {
+		if (e === void 0) return Object.freeze([]);
+		if (!Array.isArray(e) || e.length > 256 || Reflect.ownKeys(e).length !== e.length + 1) throw TypeError("Invalid Games license grants");
+		let t = [];
+		for (let n = 0; n < e.length; n++) {
+			let r = Object.getOwnPropertyDescriptor(e, String(n));
+			if (!r?.enumerable || !("value" in r) || !o(r.value)) throw TypeError("Invalid Games license grants");
+			t.push(r.value);
+		}
+		return Object.freeze([...new Set(t)]);
+	}, c = a.entitlements;
+	if (!c || Object.getPrototypeOf(c) !== Object.prototype || Reflect.ownKeys(c).length > 256) throw TypeError("Invalid Games license limits");
+	let l = {};
+	for (let e of Reflect.ownKeys(c)) {
+		let t = Object.getOwnPropertyDescriptor(c, e);
+		if (!o(e) || !t?.enumerable || !("value" in t)) throw TypeError("Invalid Games license limits");
+		let n = t.value;
+		if (n !== "unlimited" && (typeof n != "number" || !Number.isFinite(n) || n < 0)) throw TypeError("Invalid Games license limits");
+		Object.defineProperty(l, e, {
+			value: n,
+			enumerable: !0
+		});
+	}
+	return Object.freeze({
+		...a,
+		entitlements: Object.freeze(l),
+		features: s(a.features),
+		plugins: Object.freeze([.../* @__PURE__ */ new Set([...s(a.plugins), ...n])])
+	});
+};
+//#endregion
+export { n as GAMES_PLUGIN_GRANTS, t as GamesLicenseEdition, r as withGamesPluginGrants };

package/dist/gate.d.ts

@@ -0,0 +1,7 @@
+import { VoltroPlugin } from '@voltro/protocol';
+
+/** Server-only factory admission. The ordinary lifecycle still owns order,
+ * hook execution and cleanup; no descriptor/transport/store/tick contribution. */
+export declare const defineLicensedGamePlugin: (descriptor: VoltroPlugin) => VoltroPlugin;
+
+export { }

package/dist/gate.js

@@ -0,0 +1,28 @@
+import { GAMES_PLUGIN_GRANTS as e } from "./games.js";
+import { PluginNotLicensed as t, licenseStatus as n, requireLicensedPlugin as r } from "./index.js";
+import { Effect as i } from "effect";
+import { definePlugin as a } from "@voltro/protocol";
+//#region src/gate.ts
+var o = (o) => {
+	let s = o.baseName ?? o.name, c = e.find((e) => s === `@voltro/plugin-${e}`);
+	if (c === void 0) throw TypeError("Game license admission requires an actual canonical Games plugin identity");
+	let l = o.onActivate;
+	return a({
+		...o,
+		onActivate: (e) => i.gen(function* () {
+			let a = (e.env.NODE_ENV ?? process.env.NODE_ENV ?? "production").toLowerCase();
+			if (a !== "development" && a !== "test") {
+				let e = n();
+				if (e.state !== "active" && e.state !== "grace" || e.tenant !== void 0) return yield* i.fail(new t({ plugin: c }));
+				yield* r(c);
+			}
+			let o = l?.(e);
+			i.isEffect(o) ? yield* o : o !== void 0 && (yield* i.tryPromise({
+				try: () => Promise.resolve(o),
+				catch: (e) => e
+			}));
+		})
+	});
+};
+//#endregion
+export { o as defineLicensedGamePlugin };

package/dist/index.d.ts

@@ -67,6 +67,20 @@ export declare interface LicenseSnapshot {
     readonly state: () => 'active' | 'grace' | 'expired';
 }
 
+/** Redacted transport refusal. No response body, URL, token or credential cause. */
+export declare class LicenseSnapshotFetchError extends LicenseSnapshotFetchError_base<{
+    readonly reason: 'credentials' | 'transport' | 'status' | 'response';
+    readonly status?: number;
+}> {
+}
+
+declare const LicenseSnapshotFetchError_base: new <A extends Record<string, any> = {}>(args: VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => YieldableError & {
+    readonly _tag: "LicenseSnapshotFetchError";
+} & Readonly<A>;
+
+/** Swappable server transport; verification and installation remain with Licensing. */
+export declare type LicenseSnapshotSource = () => Effect.Effect<string, LicenseSnapshotFetchError>;
+
 /** The service handlers can `yield*` to read the current license directly (for
  *  feature checks beyond billing's metered entitlements). */
 /**
@@ -111,6 +125,13 @@ declare const LicenseVerifyError_base: new <A extends Record<string, any> = {}>(
     readonly _tag: "LicenseVerifyError";
 } & Readonly<A>;
 
+export declare interface LicenseVerifyOptions {
+    /** Explicit expiry-only grace. Signature, not-before and claim checks remain strict. */
+    readonly graceSeconds?: number;
+    /** Trusted server/test clock in whole Unix seconds. Defaults to the actual clock. */
+    readonly nowSeconds?: number;
+}
+
 export declare const licensingPlugin: (options?: LicensingPluginOptions) => VoltroPlugin;
 
 export declare interface LicensingPluginOptions {
@@ -119,11 +140,10 @@ export declare interface LicensingPluginOptions {
     readonly publicKey?: string;
     /** The signed license token. Falls back to `VOLTRO_LICENSE_KEY`. */
     readonly licenseKey?: string;
-    /** URL to periodically re-fetch a fresh signed license (entitlement sync).
-     *  With `refreshMs`, a cluster-coordinated refresh re-verifies + re-installs
-     *  the snapshot. (The cloud endpoint that serves it ships in a later milestone.) */
-    readonly snapshotUrl?: string;
-    /** Refresh interval (ms) for `snapshotUrl`. Default 15 minutes. */
+    /** Actual server transport port for periodically retrieving a signed token.
+     * Verification remains offline; use ./cloud for authenticated JSON retrieval. */
+    readonly fetchSnapshot?: LicenseSnapshotSource;
+    /** Refresh interval (ms) for `fetchSnapshot`. Default 15 minutes. */
     readonly refreshMs?: number;
     /** Seconds an expired license is still honored (grace) before it goes dark.
      *  Default 0. */
@@ -150,8 +170,9 @@ export declare const requireLicensedPlugin: (plugin: string) => Effect.Effect<vo
 /**
  * Verify a license token against an Ed25519 public key (SPKI/PEM), OFFLINE.
  * Returns the decoded {@link LicenseClaims} or a typed {@link LicenseVerifyError}
- * (expiry is enforced by `jose`). No network access.
+ * (expiry is enforced by `jose`, with explicit authenticated expiry-only grace).
+ * No network access. Grace never changes the clock tolerance for other claims.
  */
-export declare const verifyLicense: (token: string, publicKeyPem: string) => Effect.Effect<LicenseClaims, LicenseVerifyError>;
+export declare const verifyLicense: (token: string, publicKeyPem: string, options?: LicenseVerifyOptions) => Effect.Effect<LicenseClaims, LicenseVerifyError>;
 
 export { }

package/dist/index.js

@@ -1,84 +1,20 @@
-import { Data as e, Effect as t } from "effect";
-import { definePlugin as n, definePluginService as r, pluginInstanceName as i } from "@voltro/protocol";
-import { pluginEnv as a } from "@voltro/env";
-import { importSPKI as o, jwtVerify as s } from "jose";
-//#region src/verify.ts
-var c = class extends e.TaggedError("LicenseVerifyError") {}, l = (e) => typeof e == "object" && e && "code" in e ? String(e.code) : "", u = (e) => {
-	let t = e instanceof Error ? e.message : String(e);
-	return l(e) === "ERR_JWT_EXPIRED" ? new c({
-		reason: "expired",
-		message: t
-	}) : new c({
-		reason: "invalid",
-		message: t
-	});
-}, d = (e) => e === "unlimited" || typeof e == "number" && Number.isFinite(e) && e >= 0, f = (e, n) => {
-	let r = e.edition, i = e.entitlements, a = e.features;
-	if (typeof r != "string" || typeof i != "object" || !i) return t.fail(new c({
-		reason: "malformed",
-		message: "missing edition/entitlements"
-	}));
-	let o = {};
-	for (let [e, n] of Object.entries(i)) {
-		if (!d(n)) return t.fail(new c({
-			reason: "malformed",
-			message: `bad entitlement '${e}'`
-		}));
-		o[e] = n;
-	}
-	let s = Array.isArray(a) ? a.filter((e) => typeof e == "string") : [], l = e.plugins, u = Array.isArray(l) ? l.filter((e) => typeof e == "string") : [];
-	return t.succeed({
-		...typeof e.tenant == "string" ? { tenant: e.tenant } : {},
-		edition: r,
-		entitlements: o,
-		features: s,
-		plugins: u,
-		exp: typeof e.exp == "number" ? e.exp : 0,
-		...typeof e.iat == "number" ? { iat: e.iat } : {},
-		...n === void 0 ? {} : { kid: n }
-	});
-}, p = (e, n) => t.tryPromise({
-	try: () => o(n, "EdDSA"),
-	catch: (e) => new c({
-		reason: "key",
-		message: e instanceof Error ? e.message : String(e)
-	})
-}).pipe(t.flatMap((n) => t.tryPromise({
-	try: async () => {
-		let { payload: t, protectedHeader: r } = await s(e, n, { algorithms: ["EdDSA"] });
-		return {
-			payload: t,
-			kid: r.kid
-		};
-	},
-	catch: u
-})), t.flatMap(({ payload: e, kid: t }) => f(e, t))), m = (e, t = {}) => {
-	let n = new Set(e.features), r = new Set(e.plugins), i = t.graceSeconds ?? 0, a = t.now ?? (() => Date.now() / 1e3), o = () => e.exp <= 0 || a() <= e.exp + i;
-	return {
-		claims: e,
-		state: () => e.exp <= 0 || a() <= e.exp ? "active" : o() ? "grace" : "expired",
-		limitFor: (t, n) => {
-			if (!o() || e.tenant !== void 0 && e.tenant !== t) return;
-			let r = e.entitlements[n];
-			if (r !== void 0) return r === "unlimited" ? Infinity : r;
-		},
-		hasFeature: (e) => o() && n.has(e),
-		allowsPlugin: (e) => o() && r.has(e)
-	};
-}, h, g = (e) => {
-	h = e;
-}, _ = () => h, v, y = (e) => {
-	v = e;
-}, b = () => v, x = (e, n) => t.sync(() => {
-	let t = _()?.limitFor(e, n);
-	return t === void 0 ? null : t;
-}), S = () => {
-	let e = _(), t = e === void 0 ? void 0 : {
+import { GAMES_PLUGIN_GRANTS as e } from "./games.js";
+import { LicensingStatusSchema as t } from "./inspect.js";
+import { LicenseVerifyError as n, verifyLicense as r } from "./verify.js";
+import { getRejection as i, getSnapshot as a, makeSnapshot as o, setRejection as s, setSnapshot as c } from "./snapshot.js";
+import { entitlementResolver as l } from "./resolver.js";
+import { LicenseSnapshotFetchError as u } from "./cloud.js";
+import { Data as d, Effect as f, Result as p, Schema as m } from "effect";
+import { definePlugin as h, definePluginService as g, pluginInstanceName as _ } from "@voltro/protocol";
+import { pluginEnv as v } from "@voltro/env";
+//#region src/index.ts
+var y = () => {
+	let e = a(), t = e === void 0 ? void 0 : {
 		state: e.state(),
 		edition: e.claims.edition,
 		expiresAt: e.claims.exp,
 		...e.claims.tenant === void 0 ? {} : { tenant: e.claims.tenant }
-	}, n = b();
+	}, n = i();
 	return n === void 0 ? t ?? { state: "none" } : {
 		state: "rejected",
 		reason: n.reason,
@@ -89,7 +25,7 @@ var c = class extends e.TaggedError("LicenseVerifyError") {}, l = (e) => typeof
 			expiresAt: t.expiresAt
 		} }
 	};
-}, C = a([{
+}, b = v([{
 	name: "VOLTRO_LICENSE_PUBLIC_KEY",
 	required: !1,
 	secret: !1,
@@ -97,68 +33,97 @@ var c = class extends e.TaggedError("LicenseVerifyError") {}, l = (e) => typeof
 }, {
 	name: "VOLTRO_LICENSE_KEY",
 	required: !1,
-	secret: !1,
-	description: "The signed EdDSA license token, verified offline at boot."
-}]), { Tag: w, Live: T } = r("@voltro/plugin-licensing/LicenseService", {
-	snapshot: () => _(),
-	status: () => S(),
-	limitFor: (e, t) => _()?.limitFor(e, t),
-	hasFeature: (e) => _()?.hasFeature(e) ?? !1,
-	allowsPlugin: (e) => _()?.allowsPlugin(e) ?? !1,
-	edition: () => _()?.claims.edition
-}), E = class extends e.TaggedError("PluginNotLicensed") {}, D = (e) => _()?.allowsPlugin(e) ?? !1, O = (e) => D(e) ? t.void : t.fail(new E({ plugin: e })), k = (e = {}) => {
-	let r = C.read("VOLTRO_LICENSE_PUBLIC_KEY", e.publicKey), a = C.read("VOLTRO_LICENSE_KEY", e.licenseKey), o = e.graceSeconds ?? 0, s = e.refreshMs ?? 9e5, c, l = (e, n) => p(e, n).pipe(t.match({
+	secret: !0,
+	description: "The signed EdDSA license token, verified offline at boot; private local custody."
+}]), { Tag: x, Live: S } = g("@voltro/plugin-licensing/LicenseService", {
+	snapshot: () => a(),
+	status: () => y(),
+	limitFor: (e, t) => a()?.limitFor(e, t),
+	hasFeature: (e) => a()?.hasFeature(e) ?? !1,
+	allowsPlugin: (e) => a()?.allowsPlugin(e) ?? !1,
+	edition: () => a()?.claims.edition
+}), C = class extends d.TaggedError("PluginNotLicensed") {}, w = (e) => a()?.allowsPlugin(e) ?? !1, T = (e) => w(e) ? f.void : f.fail(new C({ plugin: e })), E = (n = {}) => {
+	let l = b.read("VOLTRO_LICENSE_PUBLIC_KEY", n.publicKey), u = b.read("VOLTRO_LICENSE_KEY", n.licenseKey), d = n.graceSeconds ?? 0, g = n.refreshMs ?? 9e5, v = n.fetchSnapshot;
+	if (!Number.isSafeInteger(g) || g <= 0 || !Number.isSafeInteger(d) || d < 0 || v !== void 0 && typeof v != "function") throw Error("Licensing requires positive whole-millisecond refresh, nonnegative whole-second grace and a callable snapshot port");
+	let y, x = 0, C = !1, w = (e, t, n) => r(e, t, { graceSeconds: d }).pipe(f.match({
 		onSuccess: (e) => {
-			g(m(e, { graceSeconds: o })), y(void 0), c?.info("license active", {
+			C && x === n && (c(o(e, { graceSeconds: d })), s(void 0), y?.info("license active", {
 				edition: e.edition,
 				entitlements: Object.keys(e.entitlements).length,
 				exp: e.exp
-			});
+			}));
 		},
 		onFailure: (e) => {
-			y({
+			C && x === n && (s({
 				reason: e.reason,
 				message: e.message
-			}), c?.warn("license verification failed — entitlements fall back to static plan", {
+			}), y?.warn("license verification failed — entitlements fall back to static plan", {
 				reason: e.reason,
 				message: e.message
-			});
+			}));
 		}
 	}));
-	return n({
-		name: i({
+	return h({
+		name: _({
 			base: "@voltro/plugin-licensing",
-			instance: e.name
+			instance: n.name
 		}),
+		baseName: "@voltro/plugin-licensing",
+		permissions: ["inspect:read"],
+		inspectEndpoints: [{
+			method: "GET",
+			path: "/status",
+			scope: "process",
+			description: "Redacted current-process license status; no credentials, tenant IDs or entitlement values.",
+			handler: () => f.try({
+				try: () => {
+					let n = a(), r = i(), o = n?.state(), s = n === void 0 ? null : {
+						state: o,
+						edition: n.claims.edition,
+						expiresAt: n.claims.exp,
+						scope: n.claims.tenant === void 0 ? "deployment" : "tenant",
+						gamesGrants: o === "expired" ? [] : e.filter((e) => n.allowsPlugin(e))
+					};
+					return {
+						kind: "json",
+						data: m.decodeUnknownSync(t)({
+							observedAt: Date.now(),
+							activated: C,
+							state: r === void 0 ? o ?? "none" : "rejected",
+							installed: s,
+							rejection: r?.reason ?? null,
+							graceSeconds: d,
+							refreshIntervalMs: v === void 0 || l === void 0 ? null : g
+						})
+					};
+				},
+				catch: () => /* @__PURE__ */ Error("License inspection unavailable")
+			})
+		}],
 		description: "Offline-verified EdDSA license keys + entitlement snapshots; feeds @voltro/plugin-billing via entitlementResolver.",
-		declaredEnv: C.declared,
-		services: T,
-		onActivate: (e) => t.gen(function* () {
-			if (c = e.logger, r === void 0 || a === void 0) {
-				e.logger.debug("licensing: no license configured — static plan entitlements apply");
-				return;
-			}
-			yield* l(a, r);
+		declaredEnv: b.declared,
+		services: S,
+		onActivate: (e) => f.gen(function* () {
+			y = e.logger, C = !0;
+			let t = ++x;
+			c(void 0), s(void 0), l === void 0 || u === void 0 ? e.logger.debug("licensing: no license configured — static plan entitlements apply") : yield* w(u, l, t);
 		}),
-		bindDataStore: (n, i) => {
-			let a = e.snapshotUrl;
-			if (a === void 0 || r === void 0 || i?.scheduleCoordinated === void 0) return;
-			let o = r;
-			i.scheduleCoordinated("licensing.refresh", s, async () => {
-				try {
-					let e = await fetch(a);
-					if (!e.ok) return;
-					let n = (await e.text()).trim();
-					n.length > 0 && await t.runPromise(l(n, o));
-				} catch (e) {
-					c?.warn("license refresh failed", { message: e instanceof Error ? e.message : String(e) });
-				}
+		bindDataStore: (e, t) => {
+			if (v === void 0 || l === void 0 || t?.scheduleCoordinated === void 0) return;
+			let n = l;
+			t.scheduleCoordinated("licensing.refresh", g, async () => {
+				if (!C) return;
+				let e = x, t = await f.runPromise(f.result(v()));
+				C && x === e && (p.isFailure(t) ? y?.warn("license refresh failed — retaining the last verified snapshot", {
+					reason: t.failure.reason,
+					...t.failure.status === void 0 ? {} : { status: t.failure.status }
+				}) : await f.runPromise(w(t.success, n, e)));
 			});
 		},
-		onDeactivate: () => t.sync(() => {
-			g(void 0), y(void 0);
+		onDeactivate: () => f.sync(() => {
+			C = !1, x++, c(void 0), s(void 0);
 		})
 	});
 };
 //#endregion
-export { w as LicenseService, c as LicenseVerifyError, E as PluginNotLicensed, x as entitlementResolver, D as licenseAllowsPlugin, S as licenseStatus, k as licensingPlugin, O as requireLicensedPlugin, p as verifyLicense };
+export { x as LicenseService, u as LicenseSnapshotFetchError, n as LicenseVerifyError, C as PluginNotLicensed, l as entitlementResolver, w as licenseAllowsPlugin, y as licenseStatus, E as licensingPlugin, T as requireLicensedPlugin, r as verifyLicense };

package/dist/inspect.d.ts

@@ -0,0 +1,56 @@
+import { Schema } from 'effect';
+
+declare const base: Schema.Struct<{
+    observedAt: Schema.Number;
+    activated: Schema.Boolean;
+    state: Schema.Literals<readonly ["none", "active", "grace", "expired", "rejected"]>;
+    installed: Schema.NullOr<Schema.Struct<{
+        readonly state: Schema.Literals<readonly ["active", "grace", "expired"]>;
+        readonly edition: Schema.String;
+        readonly expiresAt: Schema.Number;
+        readonly scope: Schema.Literals<readonly ["deployment", "tenant"]>;
+        readonly gamesGrants: Schema.$Array<Schema.Literals<readonly ["rooms", "matchmaking", "leaderboards", "social", "chat", "guilds", "inventory", "economy", "progression", "liveops", "players", "saves", "sanctions", "gm"]>>;
+    }>>;
+    rejection: Schema.NullOr<Schema.Literals<readonly ["expired", "invalid", "key", "malformed"]>>;
+    graceSeconds: Schema.Number;
+    refreshIntervalMs: Schema.NullOr<Schema.Number>;
+}>;
+
+export declare const isLicensingStatusConsistent: (value: typeof base.Type) => boolean;
+
+export declare type LicensingStatus = typeof LicensingStatusSchema.Type;
+
+export declare const LicensingStatusFields: {
+    observedAt: Schema.Number;
+    activated: Schema.Boolean;
+    state: Schema.Literals<readonly ["none", "active", "grace", "expired", "rejected"]>;
+    installed: Schema.NullOr<Schema.Struct<{
+        readonly state: Schema.Literals<readonly ["active", "grace", "expired"]>;
+        readonly edition: Schema.String;
+        readonly expiresAt: Schema.Number;
+        readonly scope: Schema.Literals<readonly ["deployment", "tenant"]>;
+        readonly gamesGrants: Schema.$Array<Schema.Literals<readonly ["rooms", "matchmaking", "leaderboards", "social", "chat", "guilds", "inventory", "economy", "progression", "liveops", "players", "saves", "sanctions", "gm"]>>;
+    }>>;
+    rejection: Schema.NullOr<Schema.Literals<readonly ["expired", "invalid", "key", "malformed"]>>;
+    graceSeconds: Schema.Number;
+    refreshIntervalMs: Schema.NullOr<Schema.Number>;
+};
+
+/** Browser-safe redacted process observation, never a token or grant authority. */
+export declare const LicensingStatusSchema: Schema.Struct<{
+    observedAt: Schema.Number;
+    activated: Schema.Boolean;
+    state: Schema.Literals<readonly ["none", "active", "grace", "expired", "rejected"]>;
+    installed: Schema.NullOr<Schema.Struct<{
+        readonly state: Schema.Literals<readonly ["active", "grace", "expired"]>;
+        readonly edition: Schema.String;
+        readonly expiresAt: Schema.Number;
+        readonly scope: Schema.Literals<readonly ["deployment", "tenant"]>;
+        readonly gamesGrants: Schema.$Array<Schema.Literals<readonly ["rooms", "matchmaking", "leaderboards", "social", "chat", "guilds", "inventory", "economy", "progression", "liveops", "players", "saves", "sanctions", "gm"]>>;
+    }>>;
+    rejection: Schema.NullOr<Schema.Literals<readonly ["expired", "invalid", "key", "malformed"]>>;
+    graceSeconds: Schema.Number;
+    refreshIntervalMs: Schema.NullOr<Schema.Number>;
+}>;
+
+export { }

package/dist/inspect.js

@@ -0,0 +1,48 @@
+import { GAMES_PLUGIN_GRANTS as e } from "./games.js";
+import { Schema as t } from "effect";
+//#region src/inspect.ts
+var n = t.Number.pipe(t.check(t.isInt()), t.check(t.isBetween({
+	minimum: 0,
+	maximum: 2 ** 53 - 1
+}))), r = t.Literals([
+	"active",
+	"grace",
+	"expired"
+]), i = {
+	observedAt: t.Number.pipe(t.check(t.isInt()), t.check(t.isBetween({
+		minimum: 0,
+		maximum: 864e13
+	}))),
+	activated: t.Boolean,
+	state: t.Literals([
+		"none",
+		"active",
+		"grace",
+		"expired",
+		"rejected"
+	]),
+	installed: t.NullOr(t.Struct({
+		state: r,
+		edition: t.String.pipe(t.check(t.isMinLength(1)), t.check(t.isMaxLength(256))),
+		expiresAt: t.Number.pipe(t.check(t.isInt()), t.check(t.isBetween({
+			minimum: 0,
+			maximum: 864e10
+		}))),
+		scope: t.Literals(["deployment", "tenant"]),
+		gamesGrants: t.Array(t.Literals(e))
+	})),
+	rejection: t.NullOr(t.Literals([
+		"expired",
+		"invalid",
+		"key",
+		"malformed"
+	])),
+	graceSeconds: n,
+	refreshIntervalMs: t.NullOr(n.pipe(t.check(t.isGreaterThan(0))))
+}, a = t.Struct(i), o = (e) => {
+	if (e.state === "rejected" != (e.rejection !== null) || e.state === "none" && e.installed !== null || e.state !== "none" && e.state !== "rejected" && e.installed?.state !== e.state) return !1;
+	let t = e.installed;
+	return !(t !== null && (new Set(t.gamesGrants).size !== t.gamesGrants.length || t.state === "expired" && t.gamesGrants.length > 0 || t.state === "grace" && (e.graceSeconds === 0 || t.expiresAt === 0)));
+}, s = a.pipe(t.check(t.makeFilter(o)));
+//#endregion
+export { i as LicensingStatusFields, s as LicensingStatusSchema, o as isLicensingStatusConsistent };