@xemahq/entitlement-client 0.1.2 → 0.2.0

package/dist/lib/installation-license.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installation-license.d.ts","sourceRoot":"","sources":["../../src/lib/installation-license.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAEL,uBAAuB,EAGvB,aAAa,EACb,8BAA8B,EAG9B,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACrB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAIL,sBAAsB,EACtB,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAC;AAmC/B,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAG9C,MAAM,WAAW,yBAAyB;IAQxC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IAa7C,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAKvC,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC;CACzC;AAGD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAGD,oBAAY,kBAAkB;IAM5B,YAAY,iBAAiB;IAK7B,WAAW,iBAAiB;IAO5B,sBAAsB,4BAA4B;CACnD;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,YAAY,CAAC;IAC/C,QAAQ,CAAC,IAAI,EAAE,8BAA8B,CAAC;IAE9C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,WAAW,CAAC;IAC9C,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;CAC9B;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,sBAAsB,CAAC;IAEzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,MAAM,cAAc,GACtB,0BAA0B,GAC1B,yBAAyB,GACzB,oCAAoC,CAAC;AAGzC,eAAO,MAAM,+BAA+B,EAAE,oCAO3C,CAAC;AAEJ,MAAM,MAAM,kBAAkB,GAC1B;IACE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IAEvB,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;CAC9B,GACD;IAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC;AAGlE,MAAM,MAAM,cAAc,GACtB;IACE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IAErC,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;CAC9C,GACD;IACE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,8BAA8B,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,oBAAoB,EAAE,KAAK,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;CAC9C,CAAC;AAWN,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;IAYnD,OAAO,CAAC,YAAY,CAAyD;IAS7E,OAAO,CAAC,qBAAqB,CAAqB;gBAEtC,MAAM,EAAE,yBAAyB;IAa7C,QAAQ,CACN,KAAK,EAAE,gBAAgB,EACvB,OAAO,GAAE,wBAA6B,GACrC,kBAAkB;IA+CrB,cAAc,CAAC,OAAO,GAAE,wBAA6B,GAAG,cAAc;IA0BtE,YAAY,IAAI,gBAAgB,GAAG,IAAI;IAqBvC,WAAW,CAAC,OAAO,GAAE,wBAA6B,GAAG,kBAAkB;IAiBvE,gBAAgB,CACd,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,wBAA6B,GACrC,kBAAkB;IAgBrB,oBAAoB,CAAC,OAAO,GAAE,wBAA6B,GAAG,OAAO;IAKrE,OAAO,CAAC,OAAO,GAAE,wBAA6B,GAAG,cAAc;IAuE/D,eAAe,IAAI,eAAe,GAAG,SAAS;IAO9C,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,YAAY;IAYpB,OAAO,CAAC,OAAO;CAQhB;AAQD,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAClC,sBAAsB,GAAG,SAAS,CAWpC;AAaD,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAK5E"}

package/dist/lib/installation-license.js

@@ -0,0 +1,212 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InstallationLicense = exports.DISTRIBUTION_UNDECLARED_REFUSAL = exports.LicenseRefusalKind = exports.LICENSE_ENV_VAR = void 0;
+exports.worstWarningSeverity = worstWarningSeverity;
+exports.isUnprovisionedBuildRefusal = isUnprovisionedBuildRefusal;
+const entitlement_1 = require("@xemahq/kernel-contracts/entitlement");
+const license_verifier_1 = require("@xemahq/license-verifier");
+const license_warnings_ts_1 = require("./license-warnings.js");
+exports.LICENSE_ENV_VAR = 'XEMA_LICENSE';
+var LicenseRefusalKind;
+(function (LicenseRefusalKind) {
+    LicenseRefusalKind["Unverifiable"] = "unverifiable";
+    LicenseRefusalKind["NotEntitled"] = "not-entitled";
+    LicenseRefusalKind["DistributionUndeclared"] = "distribution-undeclared";
+})(LicenseRefusalKind || (exports.LicenseRefusalKind = LicenseRefusalKind = {}));
+exports.DISTRIBUTION_UNDECLARED_REFUSAL = {
+    kind: LicenseRefusalKind.DistributionUndeclared,
+    remediation: 'Mount the distribution lock (XEMA_DISTRIBUTION_LOCK_PATH) so this ' +
+        'deployment declares which Xema distribution it runs, or set ' +
+        'XEMA_DISTRIBUTION_ID explicitly.',
+};
+class InstallationLicense {
+    config;
+    verification;
+    highestObservedTimeMs;
+    constructor(config) {
+        this.config = config;
+    }
+    evaluate(query, options = {}) {
+        const effective = this.effective();
+        if (!effective.ok) {
+            return {
+                granted: false,
+                refusal: {
+                    kind: LicenseRefusalKind.Unverifiable,
+                    code: effective.code,
+                    message: effective.message,
+                    remediation: (0, license_warnings_ts_1.platformLicenseRemediation)(effective.code),
+                },
+            };
+        }
+        const decision = (0, license_verifier_1.evaluateEntitlement)(effective.license, query, this.stateOptions(options));
+        this.observe(decision.state.evaluatedAtMs);
+        if (decision.granted) {
+            return {
+                granted: true,
+                matched: decision.matched,
+                state: decision.state,
+            };
+        }
+        return {
+            granted: false,
+            refusal: {
+                kind: LicenseRefusalKind.NotEntitled,
+                reason: decision.reason,
+                state: decision.state,
+            },
+        };
+    }
+    entitlementSet(options = {}) {
+        if (!this.effective().ok) {
+            return entitlement_1.COMMUNITY_ENTITLEMENT;
+        }
+        return (0, entitlement_1.projectEntitlementSet)((capabilityClassId) => this.evaluate({
+            kind: license_verifier_1.EntitlementKind.CapabilityClass,
+            id: capabilityClassId,
+            action: license_verifier_1.EntitlementAction.RunExisting,
+        }, options).granted);
+    }
+    editionQuery() {
+        const { distributionId } = this.config;
+        if (distributionId === null) {
+            return null;
+        }
+        return {
+            kind: license_verifier_1.EntitlementKind.Distribution,
+            id: distributionId,
+            action: license_verifier_1.EntitlementAction.RunExisting,
+        };
+    }
+    editionGate(options = {}) {
+        const query = this.editionQuery();
+        if (query === null) {
+            return { granted: false, refusal: exports.DISTRIBUTION_UNDECLARED_REFUSAL };
+        }
+        return this.evaluate(query, options);
+    }
+    biomeInstallGate(biomeId, options = {}) {
+        const edition = this.editionGate(options);
+        if (!edition.granted) {
+            return edition;
+        }
+        return this.evaluate({
+            kind: license_verifier_1.EntitlementKind.Biome,
+            id: biomeId,
+            action: license_verifier_1.EntitlementAction.Install,
+        }, options);
+    }
+    distributionEntitled(options = {}) {
+        return this.editionGate(options).granted;
+    }
+    posture(options = {}) {
+        const effective = this.effective();
+        if (!effective.ok) {
+            return {
+                licensed: false,
+                source: effective.source,
+                code: effective.code,
+                message: effective.message,
+                remediation: (0, license_warnings_ts_1.platformLicenseRemediation)(effective.code),
+                entitlement: entitlement_1.COMMUNITY_ENTITLEMENT,
+                distributionId: this.config.distributionId,
+                distributionEntitled: false,
+                warnings: [
+                    {
+                        code: license_warnings_ts_1.LicenseWarningCode.Unverifiable,
+                        severity: license_warnings_ts_1.LicenseWarningSeverity.Critical,
+                        message: `No license could be verified (${effective.code}): ` +
+                            `${effective.message}. Enterprise features are off and new biome ` +
+                            'installs are refused. Existing workloads keep running.',
+                    },
+                ],
+            };
+        }
+        const state = (0, license_verifier_1.resolveLicenseState)(effective.license, this.stateOptions(options));
+        this.observe(state.evaluatedAtMs);
+        const distributionEntitled = this.distributionEntitled(options);
+        const warnings = (0, license_warnings_ts_1.licenseStateWarnings)(state);
+        if (this.config.distributionId === null) {
+            warnings.push({
+                code: license_warnings_ts_1.LicenseWarningCode.DistributionUndeclared,
+                severity: license_warnings_ts_1.LicenseWarningSeverity.Warning,
+                message: 'This deployment does not declare which distribution it is running ' +
+                    '(no distribution lock is mounted), so the license cannot be checked ' +
+                    'against an edition at all. Mount the distribution lock.',
+            });
+        }
+        else if (!distributionEntitled) {
+            warnings.push({
+                code: license_warnings_ts_1.LicenseWarningCode.DistributionNotEntitled,
+                severity: license_warnings_ts_1.LicenseWarningSeverity.Critical,
+                message: `The license does not entitle this installation to run the ` +
+                    `"${this.config.distributionId}" distribution. Mirroring the images ` +
+                    'does not confer the right to run them (decision D6). New biome ' +
+                    'installs and upgrades are refused; existing workloads keep running ' +
+                    'and no data is touched.',
+            });
+        }
+        const { claims } = effective.license;
+        return {
+            licensed: true,
+            source: effective.source,
+            licenseId: claims.licenseId,
+            customerId: claims.subject.customerId,
+            customerName: claims.subject.customerName,
+            tier: claims.tier,
+            state,
+            entitlement: this.entitlementSet(options),
+            distributionId: this.config.distributionId,
+            distributionEntitled,
+            warnings,
+        };
+    }
+    verifiedLicense() {
+        const effective = this.effective();
+        return effective.ok ? effective.license : undefined;
+    }
+    effective() {
+        this.verification ??= (0, license_verifier_1.resolveEffectiveLicense)({
+            customerLicense: this.config.customerLicense,
+            ...(this.config.trustStore !== undefined
+                ? { trustStore: this.config.trustStore }
+                : {}),
+        });
+        return this.verification;
+    }
+    stateOptions(options) {
+        return {
+            ...(options.now !== undefined ? { now: options.now } : {}),
+            ...(this.highestObservedTimeMs !== undefined
+                ? { highestObservedTimeMs: this.highestObservedTimeMs }
+                : {}),
+        };
+    }
+    observe(evaluatedAtMs) {
+        if (this.highestObservedTimeMs === undefined ||
+            evaluatedAtMs > this.highestObservedTimeMs) {
+            this.highestObservedTimeMs = evaluatedAtMs;
+        }
+    }
+}
+exports.InstallationLicense = InstallationLicense;
+function worstWarningSeverity(warnings) {
+    let worst;
+    for (const warning of warnings) {
+        if (worst === undefined ||
+            SEVERITY_ORDER[warning.severity] > SEVERITY_ORDER[worst]) {
+            worst = warning.severity;
+        }
+    }
+    return worst;
+}
+const SEVERITY_ORDER = {
+    [license_warnings_ts_1.LicenseWarningSeverity.Info]: 0,
+    [license_warnings_ts_1.LicenseWarningSeverity.Warning]: 1,
+    [license_warnings_ts_1.LicenseWarningSeverity.Critical]: 2,
+};
+function isUnprovisionedBuildRefusal(refusal) {
+    return (refusal.kind === LicenseRefusalKind.Unverifiable &&
+        refusal.code === license_verifier_1.LicenseVerificationFailureCode.TrustStoreEmpty);
+}
+//# sourceMappingURL=installation-license.js.map

package/dist/lib/installation-license.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installation-license.js","sourceRoot":"","sources":["../../src/lib/installation-license.ts"],"names":[],"mappings":";;;AAifA,oDAaC;AAaD,kEAKC;AAhhBD,sEAI8C;AAC9C,+DAekC;AAElC,+DAM+B;AAmClB,QAAA,eAAe,GAAG,cAAc,CAAC;AAsC9C,IAAY,kBAmBX;AAnBD,WAAY,kBAAkB;IAM5B,mDAA6B,CAAA;IAK7B,kDAA4B,CAAA;IAO5B,wEAAkD,CAAA;AACpD,CAAC,EAnBW,kBAAkB,kCAAlB,kBAAkB,QAmB7B;AA6BY,QAAA,+BAA+B,GAC1C;IACE,IAAI,EAAE,kBAAkB,CAAC,sBAAsB;IAC/C,WAAW,EACT,oEAAoE;QACpE,8DAA8D;QAC9D,kCAAkC;CACrC,CAAC;AAkDJ,MAAa,mBAAmB;IACb,MAAM,CAA4B;IAY3C,YAAY,CAAyD;IASrE,qBAAqB,CAAqB;IAElD,YAAY,MAAiC;QAC3C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAWD,QAAQ,CACN,KAAuB,EACvB,UAAoC,EAAE;QAEtC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE;oBACP,IAAI,EAAE,kBAAkB,CAAC,YAAY;oBACrC,IAAI,EAAE,SAAS,CAAC,IAAI;oBACpB,OAAO,EAAE,SAAS,CAAC,OAAO;oBAC1B,WAAW,EAAE,IAAA,gDAA0B,EAAC,SAAS,CAAC,IAAI,CAAC;iBACxD;aACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAA,sCAAmB,EAClC,SAAS,CAAC,OAAO,EACjB,KAAK,EACL,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAC3B,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC3C,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;aACtB,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE;gBACP,IAAI,EAAE,kBAAkB,CAAC,WAAW;gBACpC,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,KAAK,EAAE,QAAQ,CAAC,KAAK;aACtB;SACF,CAAC;IACJ,CAAC;IAYD,cAAc,CAAC,UAAoC,EAAE;QACnD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACzB,OAAO,mCAAqB,CAAC;QAC/B,CAAC;QACD,OAAO,IAAA,mCAAqB,EAC1B,CAAC,iBAAiB,EAAE,EAAE,CACpB,IAAI,CAAC,QAAQ,CACX;YACE,IAAI,EAAE,kCAAe,CAAC,eAAe;YACrC,EAAE,EAAE,iBAAiB;YACrB,MAAM,EAAE,oCAAiB,CAAC,WAAW;SACtC,EACD,OAAO,CACR,CAAC,OAAO,CACZ,CAAC;IACJ,CAAC;IAWD,YAAY;QACV,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QACvC,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,IAAI,EAAE,kCAAe,CAAC,YAAY;YAClC,EAAE,EAAE,cAAc;YAClB,MAAM,EAAE,oCAAiB,CAAC,WAAW;SACtC,CAAC;IACJ,CAAC;IAWD,WAAW,CAAC,UAAoC,EAAE;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uCAA+B,EAAE,CAAC;QACtE,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAWD,gBAAgB,CACd,OAAe,EACf,UAAoC,EAAE;QAEtC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAClB;YACE,IAAI,EAAE,kCAAe,CAAC,KAAK;YAC3B,EAAE,EAAE,OAAO;YACX,MAAM,EAAE,oCAAiB,CAAC,OAAO;SAClC,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAGD,oBAAoB,CAAC,UAAoC,EAAE;QACzD,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;IAC3C,CAAC;IAGD,OAAO,CAAC,UAAoC,EAAE;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,OAAO,EAAE,SAAS,CAAC,OAAO;gBAC1B,WAAW,EAAE,IAAA,gDAA0B,EAAC,SAAS,CAAC,IAAI,CAAC;gBACvD,WAAW,EAAE,mCAAqB;gBAClC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;gBAC1C,oBAAoB,EAAE,KAAK;gBAC3B,QAAQ,EAAE;oBACR;wBACE,IAAI,EAAE,wCAAkB,CAAC,YAAY;wBACrC,QAAQ,EAAE,4CAAsB,CAAC,QAAQ;wBACzC,OAAO,EACL,iCAAiC,SAAS,CAAC,IAAI,KAAK;4BACpD,GAAG,SAAS,CAAC,OAAO,8CAA8C;4BAClE,wDAAwD;qBAC3D;iBACF;aACF,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAA,sCAAmB,EAC/B,SAAS,CAAC,OAAO,EACjB,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAC3B,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAClC,MAAM,oBAAoB,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,IAAA,0CAAoB,EAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,wCAAkB,CAAC,sBAAsB;gBAC/C,QAAQ,EAAE,4CAAsB,CAAC,OAAO;gBACxC,OAAO,EACL,oEAAoE;oBACpE,sEAAsE;oBACtE,yDAAyD;aAC5D,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;YACjC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,wCAAkB,CAAC,uBAAuB;gBAChD,QAAQ,EAAE,4CAAsB,CAAC,QAAQ;gBACzC,OAAO,EACL,4DAA4D;oBAC5D,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,uCAAuC;oBACrE,iEAAiE;oBACjE,qEAAqE;oBACrE,yBAAyB;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC;QACrC,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;YACrC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY;YACzC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK;YACL,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;YACzC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;YAC1C,oBAAoB;YACpB,QAAQ;SACT,CAAC;IACJ,CAAC;IAGD,eAAe;QACb,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,CAAC;IAIO,SAAS;QACf,IAAI,CAAC,YAAY,KAAK,IAAA,0CAAuB,EAAC;YAC5C,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe;YAC5C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS;gBACtC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE;gBACxC,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAEO,YAAY,CAAC,OAAiC;QAIpD,OAAO;YACL,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,IAAI,CAAC,qBAAqB,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,CAAC,qBAAqB,EAAE;gBACvD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAEO,OAAO,CAAC,aAAqB;QACnC,IACE,IAAI,CAAC,qBAAqB,KAAK,SAAS;YACxC,aAAa,GAAG,IAAI,CAAC,qBAAqB,EAC1C,CAAC;YACD,IAAI,CAAC,qBAAqB,GAAG,aAAa,CAAC;QAC7C,CAAC;IACH,CAAC;CACF;AA3RD,kDA2RC;AAQD,SAAgB,oBAAoB,CAClC,QAAmC;IAEnC,IAAI,KAAyC,CAAC;IAC9C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IACE,KAAK,KAAK,SAAS;YACnB,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,EACxD,CAAC;YACD,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,cAAc,GAA2C;IAC7D,CAAC,4CAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;IAChC,CAAC,4CAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;IACnC,CAAC,4CAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC;CACrC,CAAC;AAOF,SAAgB,2BAA2B,CAAC,OAAuB;IACjE,OAAO,CACL,OAAO,CAAC,IAAI,KAAK,kBAAkB,CAAC,YAAY;QAChD,OAAO,CAAC,IAAI,KAAK,iDAA8B,CAAC,eAAe,CAChE,CAAC;AACJ,CAAC"}

package/dist/lib/installation-license.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=installation-license.test.d.ts.map

package/dist/lib/installation-license.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installation-license.test.d.ts","sourceRoot":"","sources":["../../src/lib/installation-license.test.ts"],"names":[],"mappings":""}

package/dist/lib/installation-license.test.js

@@ -0,0 +1,389 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_test_1 = require("node:test");
+const entitlement_1 = require("@xemahq/kernel-contracts/entitlement");
+const license_verifier_1 = require("@xemahq/license-verifier");
+const installation_license_ts_1 = require("./installation-license.ts");
+const license_refused_exception_ts_1 = require("./license-refused.exception.ts");
+const license_warnings_ts_1 = require("./license-warnings.ts");
+const license_testkit_ts_1 = require("./license.testkit.ts");
+const authority = (0, license_testkit_ts_1.createTestAuthority)();
+const DISTRIBUTION_ID = 'core';
+const GRANTED_BIOME = 'knowledge-base';
+const UNGRANTED_BIOME = 'managed-llm-economy';
+const IN_FORCE = (0, license_testkit_ts_1.at)('2026-06-01T00:00:00.000Z');
+const EXPIRED_IN_GRACE = (0, license_testkit_ts_1.at)('2027-02-10T00:00:00.000Z');
+const EXPIRED_RESTRICTED = (0, license_testkit_ts_1.at)('2027-02-01T00:00:00.000Z') + license_verifier_1.LICENSE_GRACE_PERIOD_MS + 24 * 60 * 60 * 1000;
+async function installationFor(overrides = {}) {
+    return new installation_license_ts_1.InstallationLicense({
+        customerLicense: await (0, license_testkit_ts_1.mint)(authority, overrides),
+        distributionId: DISTRIBUTION_ID,
+        trustStore: authority.trustStore,
+    });
+}
+function refusalOf(outcome) {
+    strict_1.default.equal(outcome.granted, false, 'expected the gate to refuse');
+    strict_1.default.ok(!outcome.granted);
+    return outcome.refusal;
+}
+function install(installation, biomeId, now) {
+    return installation.evaluate({
+        kind: license_verifier_1.EntitlementKind.Biome,
+        id: biomeId,
+        action: license_verifier_1.EntitlementAction.Install,
+    }, { now });
+}
+function runExisting(installation, biomeId, now) {
+    return installation.evaluate({
+        kind: license_verifier_1.EntitlementKind.Biome,
+        id: biomeId,
+        action: license_verifier_1.EntitlementAction.RunExisting,
+    }, { now });
+}
+(0, node_test_1.test)('an UNPROVISIONED build verifies nothing and grants nothing', async () => {
+    const installation = new installation_license_ts_1.InstallationLicense({
+        customerLicense: undefined,
+        distributionId: DISTRIBUTION_ID,
+    });
+    const posture = installation.posture({ now: IN_FORCE });
+    strict_1.default.equal(posture.licensed, false);
+    strict_1.default.ok(!posture.licensed);
+    strict_1.default.equal(posture.code, license_verifier_1.LicenseVerificationFailureCode.TrustStoreEmpty);
+    strict_1.default.equal(posture.source, license_verifier_1.LicenseSource.EmbeddedOpenSource);
+    strict_1.default.equal(posture.entitlement.edition, entitlement_1.Edition.Community);
+    strict_1.default.deepEqual(posture.entitlement.features, {});
+    strict_1.default.equal(posture.distributionEntitled, false);
+    strict_1.default.deepEqual(posture.warnings.map((w) => w.code), [license_warnings_ts_1.LicenseWarningCode.Unverifiable]);
+    strict_1.default.match(posture.remediation, /never provisioned/);
+    const refusal = refusalOf(install(installation, GRANTED_BIOME, IN_FORCE));
+    strict_1.default.equal(refusal.kind, installation_license_ts_1.LicenseRefusalKind.Unverifiable);
+    strict_1.default.equal((0, installation_license_ts_1.isUnprovisionedBuildRefusal)(refusal), true);
+});
+(0, node_test_1.test)('an unprovisioned build refuses even a CUSTOMER license — the build is the defect', async () => {
+    const installation = new installation_license_ts_1.InstallationLicense({
+        customerLicense: await (0, license_testkit_ts_1.mint)(authority),
+        distributionId: DISTRIBUTION_ID,
+    });
+    const refusal = refusalOf(install(installation, GRANTED_BIOME, IN_FORCE));
+    strict_1.default.equal(refusal.kind, installation_license_ts_1.LicenseRefusalKind.Unverifiable);
+    strict_1.default.ok(refusal.kind === installation_license_ts_1.LicenseRefusalKind.Unverifiable);
+    strict_1.default.equal(refusal.code, license_verifier_1.LicenseVerificationFailureCode.TrustStoreEmpty);
+});
+(0, node_test_1.test)('a license signed by an UNTRUSTED authority is refused', async () => {
+    const other = (0, license_testkit_ts_1.createTestAuthority)();
+    const installation = new installation_license_ts_1.InstallationLicense({
+        customerLicense: await (0, license_testkit_ts_1.mint)(other),
+        distributionId: DISTRIBUTION_ID,
+        trustStore: authority.trustStore,
+    });
+    const refusal = refusalOf(install(installation, GRANTED_BIOME, IN_FORCE));
+    strict_1.default.ok(refusal.kind === installation_license_ts_1.LicenseRefusalKind.Unverifiable);
+    strict_1.default.equal(refusal.code, license_verifier_1.LicenseVerificationFailureCode.UnknownKeyId);
+    strict_1.default.equal((0, installation_license_ts_1.isUnprovisionedBuildRefusal)(refusal), false);
+});
+(0, node_test_1.test)('a license in force grants its biome, its distribution and its edition', async () => {
+    const installation = await installationFor();
+    const outcome = install(installation, GRANTED_BIOME, IN_FORCE);
+    strict_1.default.equal(outcome.granted, true);
+    strict_1.default.ok(outcome.granted);
+    strict_1.default.deepEqual(outcome.matched, {
+        kind: license_verifier_1.EntitlementKind.Biome,
+        id: GRANTED_BIOME,
+    });
+    strict_1.default.equal(installation.distributionEntitled({ now: IN_FORCE }), true);
+    const posture = installation.posture({ now: IN_FORCE });
+    strict_1.default.ok(posture.licensed);
+    strict_1.default.equal(posture.source, license_verifier_1.LicenseSource.Customer);
+    strict_1.default.equal(posture.customerId, 'acme');
+    strict_1.default.equal(posture.state.status, license_verifier_1.LicenseStatus.Active);
+    strict_1.default.equal(posture.state.stage, license_verifier_1.LicenseLifecycleStage.Valid);
+    strict_1.default.equal(posture.entitlement.edition, entitlement_1.Edition.Enterprise);
+    strict_1.default.equal(posture.entitlement.features[entitlement_1.EntitlementKey.SsoOidcFederation], true);
+    strict_1.default.equal(posture.entitlement.features[entitlement_1.EntitlementKey.TeamsScim], undefined);
+    strict_1.default.deepEqual(posture.warnings, []);
+    strict_1.default.equal((0, installation_license_ts_1.worstWarningSeverity)(posture.warnings), undefined);
+});
+(0, node_test_1.test)('a license WITHOUT the enterprise-edition class is Community, whatever else it grants', async () => {
+    const installation = await installationFor({
+        entitlements: [
+            { kind: license_verifier_1.EntitlementKind.Distribution, id: DISTRIBUTION_ID },
+            { kind: license_verifier_1.EntitlementKind.Biome, id: GRANTED_BIOME },
+            { kind: license_verifier_1.EntitlementKind.CapabilityClass, id: 'sso.oidc-federation' },
+        ],
+    });
+    const posture = installation.posture({ now: IN_FORCE });
+    strict_1.default.ok(posture.licensed);
+    strict_1.default.equal(posture.entitlement.edition, entitlement_1.Edition.Community);
+    strict_1.default.deepEqual(posture.entitlement.features, {});
+    strict_1.default.equal(install(installation, GRANTED_BIOME, IN_FORCE).granted, true);
+});
+(0, node_test_1.test)('a capability-class WILDCARD grants the edition and every feature key', async () => {
+    const installation = await installationFor({
+        entitlements: [
+            { kind: license_verifier_1.EntitlementKind.Distribution, id: DISTRIBUTION_ID },
+            { kind: license_verifier_1.EntitlementKind.CapabilityClass, id: '*' },
+        ],
+    });
+    const posture = installation.posture({ now: IN_FORCE });
+    strict_1.default.ok(posture.licensed);
+    strict_1.default.equal(posture.entitlement.edition, entitlement_1.Edition.Enterprise);
+    for (const key of Object.values(entitlement_1.EntitlementKey)) {
+        strict_1.default.equal(posture.entitlement.features[key], true, `expected ${key}`);
+    }
+});
+(0, node_test_1.test)('a biome the license does not name is refused with a NAMED reason', async () => {
+    const installation = await installationFor();
+    const refusal = refusalOf(install(installation, UNGRANTED_BIOME, IN_FORCE));
+    strict_1.default.ok(refusal.kind === installation_license_ts_1.LicenseRefusalKind.NotEntitled);
+    strict_1.default.equal(refusal.reason, license_verifier_1.EntitlementDenialReason.NoMatchingEntitlement);
+    strict_1.default.equal(refusal.state.status, license_verifier_1.LicenseStatus.Active);
+    const exception = new license_refused_exception_ts_1.LicenseRefusedException(refusal, {
+        kind: license_verifier_1.EntitlementKind.Biome,
+        id: UNGRANTED_BIOME,
+        action: license_verifier_1.EntitlementAction.Install,
+    });
+    const body = exception.getResponse();
+    strict_1.default.equal(exception.getStatus(), 403);
+    strict_1.default.equal(body['code'], license_refused_exception_ts_1.LicenseEnforcementErrorCode.LicenseNotEntitled);
+    strict_1.default.match(String(body['message']), new RegExp(UNGRANTED_BIOME));
+    strict_1.default.deepEqual(body['resource'], {
+        kind: license_verifier_1.EntitlementKind.Biome,
+        id: UNGRANTED_BIOME,
+        action: license_verifier_1.EntitlementAction.Install,
+    });
+});
+(0, node_test_1.test)('a wildcard biome grant covers a biome the license never names individually', async () => {
+    const installation = await installationFor({
+        entitlements: [
+            { kind: license_verifier_1.EntitlementKind.Distribution, id: DISTRIBUTION_ID },
+            { kind: license_verifier_1.EntitlementKind.Biome, id: '*' },
+        ],
+    });
+    strict_1.default.equal(install(installation, UNGRANTED_BIOME, IN_FORCE).granted, true);
+});
+(0, node_test_1.test)('a grant never leaks across KINDS', async () => {
+    const installation = await installationFor({
+        entitlements: [{ kind: license_verifier_1.EntitlementKind.Biome, id: '*' }],
+    });
+    strict_1.default.equal(installation.distributionEntitled({ now: IN_FORCE }), false);
+});
+(0, node_test_1.test)('EXPIRED-IN-GRACE stays FULLY functional and warns', async () => {
+    const installation = await installationFor();
+    strict_1.default.equal(install(installation, GRANTED_BIOME, EXPIRED_IN_GRACE).granted, true);
+    strict_1.default.equal(runExisting(installation, GRANTED_BIOME, EXPIRED_IN_GRACE).granted, true);
+    const posture = installation.posture({ now: EXPIRED_IN_GRACE });
+    strict_1.default.ok(posture.licensed);
+    strict_1.default.equal(posture.state.status, license_verifier_1.LicenseStatus.Expired);
+    strict_1.default.equal(posture.state.stage, license_verifier_1.LicenseLifecycleStage.Grace);
+    strict_1.default.equal(posture.entitlement.edition, entitlement_1.Edition.Enterprise);
+    strict_1.default.deepEqual(posture.warnings.map((w) => w.code), [license_warnings_ts_1.LicenseWarningCode.InGracePeriod]);
+});
+(0, node_test_1.test)('grace warnings ESCALATE as the window closes', async () => {
+    const installation = await installationFor();
+    const graceEnd = (0, license_testkit_ts_1.at)('2027-02-01T00:00:00.000Z') + license_verifier_1.LICENSE_GRACE_PERIOD_MS;
+    const early = installation.posture({ now: EXPIRED_IN_GRACE }).warnings;
+    const late = installation.posture({
+        now: graceEnd - 2 * 24 * 60 * 60 * 1000,
+    }).warnings;
+    strict_1.default.equal(early[0]?.severity, license_warnings_ts_1.LicenseWarningSeverity.Warning);
+    strict_1.default.equal(late[0]?.severity, license_warnings_ts_1.LicenseWarningSeverity.Critical);
+    strict_1.default.equal((0, installation_license_ts_1.worstWarningSeverity)(late), license_warnings_ts_1.LicenseWarningSeverity.Critical);
+});
+(0, node_test_1.test)('EXPIRED-RESTRICTED refuses new installs, keeps existing workloads running', async () => {
+    const installation = await installationFor();
+    const refusal = refusalOf(install(installation, GRANTED_BIOME, EXPIRED_RESTRICTED));
+    strict_1.default.ok(refusal.kind === installation_license_ts_1.LicenseRefusalKind.NotEntitled);
+    strict_1.default.equal(refusal.reason, license_verifier_1.EntitlementDenialReason.LicenseRestricted);
+    strict_1.default.equal(runExisting(installation, GRANTED_BIOME, EXPIRED_RESTRICTED).granted, true);
+    strict_1.default.equal(installation.distributionEntitled({ now: EXPIRED_RESTRICTED }), true);
+    const posture = installation.posture({ now: EXPIRED_RESTRICTED });
+    strict_1.default.ok(posture.licensed);
+    strict_1.default.equal(posture.state.stage, license_verifier_1.LicenseLifecycleStage.Restricted);
+    strict_1.default.equal(posture.entitlement.edition, entitlement_1.Edition.Enterprise);
+    strict_1.default.deepEqual(posture.warnings.map((w) => w.code), [license_warnings_ts_1.LicenseWarningCode.Restricted]);
+    strict_1.default.match((0, license_refused_exception_ts_1.describeRefusal)(refusal, {
+        kind: license_verifier_1.EntitlementKind.Biome,
+        id: GRANTED_BIOME,
+        action: license_verifier_1.EntitlementAction.Install,
+    }), /Existing workloads keep running/);
+});
+(0, node_test_1.test)('UPGRADE is refused exactly where a new install is', async () => {
+    const installation = await installationFor();
+    const upgrade = (now) => installation.evaluate({
+        kind: license_verifier_1.EntitlementKind.Biome,
+        id: GRANTED_BIOME,
+        action: license_verifier_1.EntitlementAction.Upgrade,
+    }, { now });
+    strict_1.default.equal(upgrade(EXPIRED_IN_GRACE).granted, true);
+    strict_1.default.equal(upgrade(EXPIRED_RESTRICTED).granted, false);
+});
+(0, node_test_1.test)('REVOKED denies everything, including running what is already installed', async () => {
+    const installation = await installationFor({
+        status: license_verifier_1.LicenseStatus.Revoked,
+    });
+    for (const outcome of [
+        install(installation, GRANTED_BIOME, IN_FORCE),
+        runExisting(installation, GRANTED_BIOME, IN_FORCE),
+    ]) {
+        const refusal = refusalOf(outcome);
+        strict_1.default.ok(refusal.kind === installation_license_ts_1.LicenseRefusalKind.NotEntitled);
+        strict_1.default.equal(refusal.reason, license_verifier_1.EntitlementDenialReason.LicenseRevoked);
+    }
+    const posture = installation.posture({ now: IN_FORCE });
+    strict_1.default.ok(posture.licensed);
+    strict_1.default.equal(posture.entitlement.edition, entitlement_1.Edition.Community);
+    strict_1.default.equal(posture.distributionEntitled, false);
+    strict_1.default.deepEqual(posture.warnings.map((w) => w.code), [
+        license_warnings_ts_1.LicenseWarningCode.Revoked,
+        license_warnings_ts_1.LicenseWarningCode.DistributionNotEntitled,
+    ]);
+});
+(0, node_test_1.test)('SUSPENDED refuses new work but never stops running work', async () => {
+    const installation = await installationFor({
+        status: license_verifier_1.LicenseStatus.Suspended,
+    });
+    const refusal = refusalOf(install(installation, GRANTED_BIOME, IN_FORCE));
+    strict_1.default.ok(refusal.kind === installation_license_ts_1.LicenseRefusalKind.NotEntitled);
+    strict_1.default.equal(refusal.reason, license_verifier_1.EntitlementDenialReason.LicenseSuspended);
+    strict_1.default.equal(runExisting(installation, GRANTED_BIOME, IN_FORCE).granted, true);
+    strict_1.default.equal(installation.posture({ now: IN_FORCE }).warnings[0]?.code, license_warnings_ts_1.LicenseWarningCode.Suspended);
+});
+(0, node_test_1.test)('a license dated in the FUTURE is not yet in force', async () => {
+    const installation = await installationFor();
+    const beforeIssue = (0, license_testkit_ts_1.at)('2025-12-01T00:00:00.000Z');
+    const refusal = refusalOf(runExisting(installation, GRANTED_BIOME, beforeIssue));
+    strict_1.default.ok(refusal.kind === installation_license_ts_1.LicenseRefusalKind.NotEntitled);
+    strict_1.default.equal(refusal.reason, license_verifier_1.EntitlementDenialReason.LicenseNotYetValid);
+    strict_1.default.deepEqual(installation.posture({ now: beforeIssue }).warnings.map((w) => w.code), [
+        license_warnings_ts_1.LicenseWarningCode.NotYetValid,
+        license_warnings_ts_1.LicenseWarningCode.DistributionNotEntitled,
+    ]);
+});
+(0, node_test_1.test)('expiry is announced BEFORE it happens', async () => {
+    const installation = await installationFor();
+    const tenDaysOut = (0, license_testkit_ts_1.at)('2027-01-22T00:00:00.000Z');
+    const posture = installation.posture({ now: tenDaysOut });
+    strict_1.default.ok(posture.licensed);
+    strict_1.default.equal(posture.state.stage, license_verifier_1.LicenseLifecycleStage.Valid);
+    strict_1.default.deepEqual(posture.warnings.map((w) => w.code), [license_warnings_ts_1.LicenseWarningCode.ExpiringSoon]);
+    strict_1.default.equal(install(installation, GRANTED_BIOME, tenDaysOut).granted, true);
+});
+(0, node_test_1.test)('a perpetual license never warns about expiry', async () => {
+    const installation = await installationFor({ expiresAt: null });
+    const farFuture = (0, license_testkit_ts_1.at)('2099-01-01T00:00:00.000Z');
+    strict_1.default.deepEqual(installation.posture({ now: farFuture }).warnings, []);
+    strict_1.default.equal(install(installation, GRANTED_BIOME, farFuture).granted, true);
+});
+(0, node_test_1.test)('a license for ANOTHER distribution does not entitle running this one', async () => {
+    const installation = new installation_license_ts_1.InstallationLicense({
+        customerLicense: await (0, license_testkit_ts_1.mint)(authority, {
+            entitlements: [{ kind: license_verifier_1.EntitlementKind.Distribution, id: 'appliance-base' }],
+        }),
+        distributionId: DISTRIBUTION_ID,
+        trustStore: authority.trustStore,
+    });
+    strict_1.default.equal(installation.distributionEntitled({ now: IN_FORCE }), false);
+    const posture = installation.posture({ now: IN_FORCE });
+    strict_1.default.ok(posture.licensed);
+    strict_1.default.equal(posture.distributionEntitled, false);
+    strict_1.default.ok(posture.warnings.some((w) => w.code === license_warnings_ts_1.LicenseWarningCode.DistributionNotEntitled));
+    strict_1.default.match(posture.warnings.at(-1)?.message ?? '', /Mirroring the images does not confer the right to run them/);
+});
+(0, node_test_1.test)('the install gate is a CONJUNCTION — an unentitled edition blocks an entitled biome', async () => {
+    const installation = new installation_license_ts_1.InstallationLicense({
+        customerLicense: await (0, license_testkit_ts_1.mint)(authority, {
+            entitlements: [
+                { kind: license_verifier_1.EntitlementKind.Biome, id: '*' },
+                { kind: license_verifier_1.EntitlementKind.Distribution, id: 'appliance-base' },
+            ],
+        }),
+        distributionId: DISTRIBUTION_ID,
+        trustStore: authority.trustStore,
+    });
+    strict_1.default.equal(install(installation, GRANTED_BIOME, IN_FORCE).granted, true);
+    const refusal = refusalOf(installation.biomeInstallGate(GRANTED_BIOME, { now: IN_FORCE }));
+    strict_1.default.ok(refusal.kind === installation_license_ts_1.LicenseRefusalKind.NotEntitled);
+    strict_1.default.equal(refusal.reason, license_verifier_1.EntitlementDenialReason.NoMatchingEntitlement);
+});
+(0, node_test_1.test)('the install gate passes when BOTH the edition and the biome are entitled', async () => {
+    const installation = await installationFor();
+    strict_1.default.equal(installation.biomeInstallGate(GRANTED_BIOME, { now: IN_FORCE }).granted, true);
+    strict_1.default.equal(installation.biomeInstallGate(UNGRANTED_BIOME, { now: IN_FORCE }).granted, false);
+});
+(0, node_test_1.test)('an UNDECLARED distribution refuses installs and says how to fix the DEPLOYMENT', async () => {
+    const installation = new installation_license_ts_1.InstallationLicense({
+        customerLicense: await (0, license_testkit_ts_1.mint)(authority),
+        distributionId: null,
+        trustStore: authority.trustStore,
+    });
+    strict_1.default.equal(installation.distributionEntitled({ now: IN_FORCE }), false);
+    const refusal = refusalOf(installation.biomeInstallGate(GRANTED_BIOME, { now: IN_FORCE }));
+    strict_1.default.equal(refusal.kind, installation_license_ts_1.LicenseRefusalKind.DistributionUndeclared);
+    const body = new license_refused_exception_ts_1.LicenseRefusedException(refusal).getResponse();
+    strict_1.default.equal(body['code'], license_refused_exception_ts_1.LicenseEnforcementErrorCode.DistributionUndeclared);
+    strict_1.default.match(String(body['remediation']), /XEMA_DISTRIBUTION_LOCK_PATH/);
+    const posture = installation.posture({ now: IN_FORCE });
+    strict_1.default.ok(posture.licensed);
+    strict_1.default.deepEqual(posture.warnings.map((w) => w.code), [license_warnings_ts_1.LicenseWarningCode.DistributionUndeclared]);
+});
+(0, node_test_1.test)('a clock rollback is REPORTED and changes no decision', async () => {
+    const installation = await installationFor();
+    installation.posture({ now: IN_FORCE + 10_000 });
+    const posture = installation.posture({ now: IN_FORCE });
+    strict_1.default.ok(posture.licensed);
+    strict_1.default.equal(posture.state.clockRollbackDetected, true);
+    strict_1.default.ok(posture.warnings.some((w) => w.code === license_warnings_ts_1.LicenseWarningCode.ClockRollback));
+    strict_1.default.equal(install(installation, GRANTED_BIOME, IN_FORCE).granted, true);
+});
+(0, node_test_1.test)('a malformed resource id is refused rather than matched', async () => {
+    const installation = await installationFor();
+    const refusal = refusalOf(install(installation, 'not a valid id!', IN_FORCE));
+    strict_1.default.ok(refusal.kind === installation_license_ts_1.LicenseRefusalKind.NotEntitled);
+    strict_1.default.equal(refusal.reason, license_verifier_1.EntitlementDenialReason.MalformedQuery);
+});
+(0, node_test_1.test)('a wildcard cannot be QUERIED as if it were a resource', async () => {
+    const installation = await installationFor({
+        entitlements: [{ kind: license_verifier_1.EntitlementKind.Biome, id: '*' }],
+    });
+    const refusal = refusalOf(install(installation, '*', IN_FORCE));
+    strict_1.default.ok(refusal.kind === installation_license_ts_1.LicenseRefusalKind.NotEntitled);
+    strict_1.default.equal(refusal.reason, license_verifier_1.EntitlementDenialReason.MalformedQuery);
+});
+(0, node_test_1.test)('projectEntitlementSet grants NOTHING without the enterprise-edition class', () => {
+    const set = (0, entitlement_1.projectEntitlementSet)((id) => id !== entitlement_1.ENTERPRISE_EDITION_CAPABILITY_CLASS);
+    strict_1.default.equal(set.edition, entitlement_1.Edition.Community);
+    strict_1.default.deepEqual(set.features, {});
+});
+(0, node_test_1.test)('projectEntitlementSet honours only the classes the probe grants', () => {
+    const granted = new Set([
+        entitlement_1.ENTERPRISE_EDITION_CAPABILITY_CLASS,
+        entitlement_1.EntitlementKey.RolesCustom,
+    ]);
+    const set = (0, entitlement_1.projectEntitlementSet)((id) => granted.has(id));
+    strict_1.default.equal(set.edition, entitlement_1.Edition.Enterprise);
+    strict_1.default.deepEqual(set.features, { [entitlement_1.EntitlementKey.RolesCustom]: true });
+});
+(0, node_test_1.test)('an unverifiable refusal renders a remediation, not an opaque failure', async () => {
+    const installation = new installation_license_ts_1.InstallationLicense({
+        customerLicense: 'not-a-license',
+        distributionId: DISTRIBUTION_ID,
+        trustStore: authority.trustStore,
+    });
+    const refusal = refusalOf(install(installation, GRANTED_BIOME, IN_FORCE));
+    strict_1.default.ok(refusal.kind === installation_license_ts_1.LicenseRefusalKind.Unverifiable);
+    strict_1.default.equal(refusal.code, license_verifier_1.LicenseVerificationFailureCode.MalformedToken);
+    const exception = new license_refused_exception_ts_1.LicenseRefusedException(refusal, {
+        kind: license_verifier_1.EntitlementKind.Biome,
+        id: GRANTED_BIOME,
+        action: license_verifier_1.EntitlementAction.Install,
+    });
+    const body = exception.getResponse();
+    strict_1.default.equal(body['code'], license_refused_exception_ts_1.LicenseEnforcementErrorCode.LicenseUnverifiable);
+    strict_1.default.equal(body['verificationFailure'], license_verifier_1.LicenseVerificationFailureCode.MalformedToken);
+    strict_1.default.match(String(body['remediation']), /XEMA_LICENSE/);
+});
+//# sourceMappingURL=installation-license.test.js.map