@xemahq/entitlement-client 0.1.3 → 0.2.1

package/README.md

@@ -6,7 +6,7 @@
     <path d="M26 12 L41 21 L41 39 L26 48 L11 39 L11 21 Z" fill="#8B5CF6"/>
   </g>
   <text x="92" y="52" font-family="ui-monospace,SFMono-Regular,Menlo,monospace" font-size="22" fill="#F8FAFC" font-weight="700">@xemahq/entitlement-client</text>
-  <text x="92" y="80" font-family="ui-sans-serif,system-ui,sans-serif" font-size="15" fill="#94A3B8">NestJS client that resolves per-org entitlements.</text>
+  <text x="92" y="80" font-family="ui-sans-serif,system-ui,sans-serif" font-size="15" fill="#94A3B8">NestJS enforcement point for Xema entitlement, resolved offline from a license.</text>
   <text x="652" y="105" text-anchor="end" font-family="ui-sans-serif,system-ui,sans-serif" font-size="12" fill="#475569">xema.dev</text>
 </svg>
 </p>
@@ -24,23 +24,33 @@
 
 # @xemahq/entitlement-client
 
-> NestJS client that resolves per-org entitlements.
+> NestJS enforcement point for Xema entitlement, resolved offline from a license.
 
 ## Overview
 
-A NestJS module and injectable service that resolves an organization's
-effective entitlement at runtime. It fetches the per-org entitlement, applies
-the deployment ceiling client-side so a stale upstream can never grant more
-than the build allows, and caches results with a short TTL and in-flight
-de-duplication. It is fail-closed: any error, timeout, or unknown state
-resolves to the most restrictive edition.
+The platform's enforcement point for entitlement. It resolves the installation's
+Xema license **offline** with `@xemahq/license-verifier` — no network call, no
+service to be reachable, identical behaviour on a connected control plane and on
+an air-gapped appliance — and answers both entitlement faces from that one
+source:
+
+- **the license axis** — `requireEntitled` / `requireBiomeInstallEntitled` /
+  `requireEditionEntitled`, gating biome installation and the running edition
+  over `{ distribution | biome | capability-class }`;
+- **the platform axis** — `isEntitled` / `getEffective`, the `Edition` plus the
+  closed `EntitlementKey` feature flags, projected from the same license by
+  `@xemahq/kernel-contracts/entitlement`.
+
+It is fail-closed: an unverifiable license grants nothing, and a license in
+force grants only what it enumerates. It never fails *fast* at boot — expiry
+degrades what may be done next and never stops a running workload.
 
 ## When to use it
 
-- Use it inside a NestJS service that needs to gate a feature on an
-  organization's effective entitlement.
-- Reach for `@xemahq/entitlement-contracts` instead when you only need the pure
-  types and resolvers without a NestJS client.
+- Use it inside a NestJS service that gates a NEW action (installing a biome,
+  an upgrade, provisioning an org) or an enterprise-only feature.
+- Reach for `@xemahq/license-verifier` directly when you need offline license
+  verification with no NestJS container at all.
 
 ## Installation
 
@@ -51,12 +61,21 @@ pnpm add @xemahq/entitlement-client
 ## Usage
 
 ```ts
-import { EntitlementService } from '@xemahq/entitlement-client';
+import {
+  EntitlementClientModule,
+  EntitlementService,
+  readLicenseFromEnv,
+} from '@xemahq/entitlement-client';
+
+EntitlementClientModule.forRoot({
+  customerLicense: readLicenseFromEnv(), // XEMA_LICENSE; undefined ⇒ the OSS license
+  distributionId: 'core',                // what this deployment actually runs
+});
 
 constructor(private readonly entitlements: EntitlementService) {}
 
-async canUse(orgId: string, key: EntitlementKey): Promise<boolean> {
-  return this.entitlements.isEntitled(orgId, key);
+installBiome(biomeId: string): void {
+  this.entitlements.requireBiomeInstallEntitled(biomeId); // 403 when unentitled
 }
 ```
 
@@ -64,6 +83,7 @@ async canUse(orgId: string, key: EntitlementKey): Promise<boolean> {
 
 - `@nestjs/common` and `@nestjs/core` >= 10
 - `reflect-metadata` >= 0.1.12
+- `@xemahq/kernel-contracts` and `@xemahq/license-verifier`
 
 ## License
 

package/dist/index.d.ts

@@ -1,4 +1,8 @@
-export * from './lib/entitlement.service';
-export * from './lib/entitlement-client.module';
-export * from './lib/entitlement.guard';
+export * from './lib/entitlement.service.ts';
+export * from './lib/entitlement-client.module.ts';
+export * from './lib/entitlement.guard.ts';
+export * from './lib/installation-license.ts';
+export * from './lib/license-refused.exception.ts';
+export * from './lib/license-warnings.ts';
+export { EntitlementAction, EntitlementDenialReason, EntitlementKind, LicenseLifecycleStage, LicenseSource, LicenseStatus, LicenseTier, LicenseVerificationFailureCode, LICENSE_GRACE_PERIOD_MS, type EntitlementQuery, type LicenseEntitlement, type LicenseState, type LicenseTrustStore, type VerifiedLicense, } from '@xemahq/license-verifier';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,8BAA8B,CAAC;AAC7C,cAAc,oCAAoC,CAAC;AACnD,cAAc,4BAA4B,CAAC;AAC3C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,oCAAoC,CAAC;AACnD,cAAc,2BAA2B,CAAC;AAQ1C,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,eAAe,EACf,qBAAqB,EACrB,aAAa,EACb,aAAa,EACb,WAAW,EACX,8BAA8B,EAC9B,uBAAuB,EACvB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,eAAe,GACrB,MAAM,0BAA0B,CAAC"}

package/dist/index.js

@@ -14,7 +14,21 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./lib/entitlement.service"), exports);
-__exportStar(require("./lib/entitlement-client.module"), exports);
-__exportStar(require("./lib/entitlement.guard"), exports);
+exports.LICENSE_GRACE_PERIOD_MS = exports.LicenseVerificationFailureCode = exports.LicenseTier = exports.LicenseStatus = exports.LicenseSource = exports.LicenseLifecycleStage = exports.EntitlementKind = exports.EntitlementDenialReason = exports.EntitlementAction = void 0;
+__exportStar(require("./lib/entitlement.service.js"), exports);
+__exportStar(require("./lib/entitlement-client.module.js"), exports);
+__exportStar(require("./lib/entitlement.guard.js"), exports);
+__exportStar(require("./lib/installation-license.js"), exports);
+__exportStar(require("./lib/license-refused.exception.js"), exports);
+__exportStar(require("./lib/license-warnings.js"), exports);
+var license_verifier_1 = require("@xemahq/license-verifier");
+Object.defineProperty(exports, "EntitlementAction", { enumerable: true, get: function () { return license_verifier_1.EntitlementAction; } });
+Object.defineProperty(exports, "EntitlementDenialReason", { enumerable: true, get: function () { return license_verifier_1.EntitlementDenialReason; } });
+Object.defineProperty(exports, "EntitlementKind", { enumerable: true, get: function () { return license_verifier_1.EntitlementKind; } });
+Object.defineProperty(exports, "LicenseLifecycleStage", { enumerable: true, get: function () { return license_verifier_1.LicenseLifecycleStage; } });
+Object.defineProperty(exports, "LicenseSource", { enumerable: true, get: function () { return license_verifier_1.LicenseSource; } });
+Object.defineProperty(exports, "LicenseStatus", { enumerable: true, get: function () { return license_verifier_1.LicenseStatus; } });
+Object.defineProperty(exports, "LicenseTier", { enumerable: true, get: function () { return license_verifier_1.LicenseTier; } });
+Object.defineProperty(exports, "LicenseVerificationFailureCode", { enumerable: true, get: function () { return license_verifier_1.LicenseVerificationFailureCode; } });
+Object.defineProperty(exports, "LICENSE_GRACE_PERIOD_MS", { enumerable: true, get: function () { return license_verifier_1.LICENSE_GRACE_PERIOD_MS; } });
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4DAA0C;AAC1C,kEAAgD;AAChD,0DAAwC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,+DAA6C;AAC7C,qEAAmD;AACnD,6DAA2C;AAC3C,gEAA8C;AAC9C,qEAAmD;AACnD,4DAA0C;AAQ1C,6DAekC;AAdhC,qHAAA,iBAAiB,OAAA;AACjB,2HAAA,uBAAuB,OAAA;AACvB,mHAAA,eAAe,OAAA;AACf,yHAAA,qBAAqB,OAAA;AACrB,iHAAA,aAAa,OAAA;AACb,iHAAA,aAAa,OAAA;AACb,+GAAA,WAAW,OAAA;AACX,kIAAA,8BAA8B,OAAA;AAC9B,2HAAA,uBAAuB,OAAA"}

package/dist/lib/entitlement-client.module.d.ts

@@ -1,5 +1,5 @@
 import { type DynamicModule, type ForwardReference, type InjectionToken, type Type } from '@nestjs/common';
-import { type EntitlementClientConfig } from './entitlement.service';
+import { type EntitlementClientConfig } from './entitlement.service.ts';
 type ModuleImport = Type<unknown> | ForwardReference<unknown> | DynamicModule | Promise<DynamicModule>;
 export interface EntitlementClientModuleAsyncOptions {
     imports?: ModuleImport[];

package/dist/lib/entitlement-client.module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entitlement-client.module.d.ts","sourceRoot":"","sources":["../../src/lib/entitlement-client.module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EAGnB,KAAK,IAAI,EACV,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,KAAK,uBAAuB,EAG7B,MAAM,uBAAuB,CAAC;AAE/B,KAAK,YAAY,GACb,IAAI,CAAC,OAAO,CAAC,GACb,gBAAgB,CAAC,OAAO,CAAC,GACzB,aAAa,GACb,OAAO,CAAC,aAAa,CAAC,CAAC;AAU3B,MAAM,WAAW,mCAAmC;IAClD,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;IACzB,UAAU,EAAE,CAEV,GAAG,IAAI,EAAE,GAAG,EAAE,KACX,OAAO,CAAC,uBAAuB,CAAC,GAAG,uBAAuB,CAAC;IAChE,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;CAC3B;AAgCD,qBACa,uBAAuB;IAElC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,uBAAuB,GAAG,aAAa;IAe9D,MAAM,CAAC,YAAY,CACjB,OAAO,EAAE,mCAAmC,GAC3C,aAAa;CAejB"}
+{"version":3,"file":"entitlement-client.module.d.ts","sourceRoot":"","sources":["../../src/lib/entitlement-client.module.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EAGnB,KAAK,IAAI,EACV,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,KAAK,uBAAuB,EAG7B,MAAM,0BAA0B,CAAC;AAElC,KAAK,YAAY,GACb,IAAI,CAAC,OAAO,CAAC,GACb,gBAAgB,CAAC,OAAO,CAAC,GACzB,aAAa,GACb,OAAO,CAAC,aAAa,CAAC,CAAC;AAU3B,MAAM,WAAW,mCAAmC;IAClD,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;IACzB,UAAU,EAAE,CAEV,GAAG,IAAI,EAAE,GAAG,EAAE,KACX,OAAO,CAAC,uBAAuB,CAAC,GAAG,uBAAuB,CAAC;IAChE,MAAM,CAAC,EAAE,cAAc,EAAE,CAAC;CAC3B;AA+BD,qBACa,uBAAuB;IAElC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,uBAAuB,GAAG,aAAa;IAe9D,MAAM,CAAC,YAAY,CACjB,OAAO,EAAE,mCAAmC,GAC3C,aAAa;CAejB"}

package/dist/lib/entitlement-client.module.js

@@ -9,23 +9,23 @@ var EntitlementClientModule_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EntitlementClientModule = void 0;
 const common_1 = require("@nestjs/common");
-const entitlement_service_1 = require("./entitlement.service");
+const entitlement_service_ts_1 = require("./entitlement.service.js");
 let EntitlementClientModule = EntitlementClientModule_1 = class EntitlementClientModule {
     static forRoot(config) {
         const configProvider = {
-            provide: entitlement_service_1.ENTITLEMENT_CLIENT_CONFIG,
+            provide: entitlement_service_ts_1.ENTITLEMENT_CLIENT_CONFIG,
             useValue: config,
         };
         return {
             module: EntitlementClientModule_1,
             global: true,
-            providers: [configProvider, entitlement_service_1.EntitlementService],
-            exports: [entitlement_service_1.EntitlementService],
+            providers: [configProvider, entitlement_service_ts_1.EntitlementService],
+            exports: [entitlement_service_ts_1.EntitlementService],
         };
     }
     static forRootAsync(options) {
         const configProvider = {
-            provide: entitlement_service_1.ENTITLEMENT_CLIENT_CONFIG,
+            provide: entitlement_service_ts_1.ENTITLEMENT_CLIENT_CONFIG,
             useFactory: options.useFactory,
             inject: options.inject ?? [],
         };
@@ -33,8 +33,8 @@ let EntitlementClientModule = EntitlementClientModule_1 = class EntitlementClien
             module: EntitlementClientModule_1,
             global: true,
             imports: options.imports ?? [],
-            providers: [configProvider, entitlement_service_1.EntitlementService],
-            exports: [entitlement_service_1.EntitlementService],
+            providers: [configProvider, entitlement_service_ts_1.EntitlementService],
+            exports: [entitlement_service_ts_1.EntitlementService],
         };
     }
 };

package/dist/lib/entitlement-client.module.js.map

@@ -1 +1 @@
-{"version":3,"file":"entitlement-client.module.js","sourceRoot":"","sources":["../../src/lib/entitlement-client.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAOwB;AACxB,+DAI+B;AAwDxB,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAElC,MAAM,CAAC,OAAO,CAAC,MAA+B;QAC5C,MAAM,cAAc,GAAa;YAC/B,OAAO,EAAE,+CAAyB;YAClC,QAAQ,EAAE,MAAM;SACjB,CAAC;QAEF,OAAO;YACL,MAAM,EAAE,yBAAuB;YAC/B,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,CAAC,cAAc,EAAE,wCAAkB,CAAC;YAC/C,OAAO,EAAE,CAAC,wCAAkB,CAAC;SAC9B,CAAC;IACJ,CAAC;IAGD,MAAM,CAAC,YAAY,CACjB,OAA4C;QAE5C,MAAM,cAAc,GAAa;YAC/B,OAAO,EAAE,+CAAyB;YAClC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;SAC7B,CAAC;QAEF,OAAO;YACL,MAAM,EAAE,yBAAuB;YAC/B,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;YAC9B,SAAS,EAAE,CAAC,cAAc,EAAE,wCAAkB,CAAC;YAC/C,OAAO,EAAE,CAAC,wCAAkB,CAAC;SAC9B,CAAC;IACJ,CAAC;CACF,CAAA;AAlCY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,uBAAuB,CAkCnC"}
+{"version":3,"file":"entitlement-client.module.js","sourceRoot":"","sources":["../../src/lib/entitlement-client.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAOwB;AACxB,qEAIkC;AAuD3B,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAElC,MAAM,CAAC,OAAO,CAAC,MAA+B;QAC5C,MAAM,cAAc,GAAa;YAC/B,OAAO,EAAE,kDAAyB;YAClC,QAAQ,EAAE,MAAM;SACjB,CAAC;QAEF,OAAO;YACL,MAAM,EAAE,yBAAuB;YAC/B,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,CAAC,cAAc,EAAE,2CAAkB,CAAC;YAC/C,OAAO,EAAE,CAAC,2CAAkB,CAAC;SAC9B,CAAC;IACJ,CAAC;IAGD,MAAM,CAAC,YAAY,CACjB,OAA4C;QAE5C,MAAM,cAAc,GAAa;YAC/B,OAAO,EAAE,kDAAyB;YAClC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,EAAE;SAC7B,CAAC;QAEF,OAAO;YACL,MAAM,EAAE,yBAAuB;YAC/B,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,EAAE;YAC9B,SAAS,EAAE,CAAC,cAAc,EAAE,2CAAkB,CAAC;YAC/C,OAAO,EAAE,CAAC,2CAAkB,CAAC;SAC9B,CAAC;IACJ,CAAC;CACF,CAAA;AAlCY,0DAAuB;kCAAvB,uBAAuB;IADnC,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,uBAAuB,CAkCnC"}

package/dist/lib/entitlement.guard.d.ts

@@ -1,7 +1,7 @@
 import { type CanActivate, type ExecutionContext } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
 import { EntitlementKey } from '@xemahq/kernel-contracts/entitlement';
-import { EntitlementService } from './entitlement.service';
+import { EntitlementService } from './entitlement.service.ts';
 export declare const REQUIRE_ENTITLEMENT = "xema:require-entitlement";
 export declare const RequireEntitlement: (key: EntitlementKey) => MethodDecorator & ClassDecorator;
 export declare class EntitlementGuard implements CanActivate {

package/dist/lib/entitlement.guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entitlement.guard.d.ts","sourceRoot":"","sources":["../../src/lib/entitlement.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,gBAAgB,EAMtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AAItE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAG3D,eAAO,MAAM,mBAAmB,6BAA6B,CAAC;AAmB9D,eAAO,MAAM,kBAAkB,GAC7B,KAAK,cAAc,KAClB,eAAe,GAAG,cAAuD,CAAC;AAW7E,qBACa,gBAAiB,YAAW,WAAW;IAIhD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAJ/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqC;gBAGzC,SAAS,EAAE,SAAS,EACpB,YAAY,EAAE,kBAAkB;IAG7C,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CA0C/D"}
+{"version":3,"file":"entitlement.guard.d.ts","sourceRoot":"","sources":["../../src/lib/entitlement.guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,gBAAgB,EAMtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AAItE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAG9D,eAAO,MAAM,mBAAmB,6BAA6B,CAAC;AAmB9D,eAAO,MAAM,kBAAkB,GAC7B,KAAK,cAAc,KAClB,eAAe,GAAG,cAAuD,CAAC;AAkB7E,qBACa,gBAAiB,YAAW,WAAW;IAIhD,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAJ/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqC;gBAGzC,SAAS,EAAE,SAAS,EACpB,YAAY,EAAE,kBAAkB;IAG7C,WAAW,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC;CA0C/D"}

package/dist/lib/entitlement.guard.js

@@ -14,7 +14,7 @@ exports.EntitlementGuard = exports.RequireEntitlement = exports.REQUIRE_ENTITLEM
 const common_1 = require("@nestjs/common");
 const core_1 = require("@nestjs/core");
 const platform_common_1 = require("@xemahq/platform-common");
-const entitlement_service_1 = require("./entitlement.service");
+const entitlement_service_ts_1 = require("./entitlement.service.js");
 exports.REQUIRE_ENTITLEMENT = 'xema:require-entitlement';
 const RequireEntitlement = (key) => (0, common_1.SetMetadata)(exports.REQUIRE_ENTITLEMENT, key);
 exports.RequireEntitlement = RequireEntitlement;
@@ -62,6 +62,6 @@ exports.EntitlementGuard = EntitlementGuard;
 exports.EntitlementGuard = EntitlementGuard = EntitlementGuard_1 = __decorate([
     (0, common_1.Injectable)(),
     __metadata("design:paramtypes", [core_1.Reflector,
-        entitlement_service_1.EntitlementService])
+        entitlement_service_ts_1.EntitlementService])
 ], EntitlementGuard);
 //# sourceMappingURL=entitlement.guard.js.map

package/dist/lib/entitlement.guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"entitlement.guard.js","sourceRoot":"","sources":["../../src/lib/entitlement.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAQwB;AACxB,uCAAyC;AAEzC,6DAA0D;AAG1D,+DAA2D;AAG9C,QAAA,mBAAmB,GAAG,0BAA0B,CAAC;AAmBvD,MAAM,kBAAkB,GAAG,CAChC,GAAmB,EACe,EAAE,CAAC,IAAA,oBAAW,EAAC,2BAAmB,EAAE,GAAG,CAAC,CAAC;AAFhE,QAAA,kBAAkB,sBAE8C;AAYtE,IAAM,gBAAgB,wBAAtB,MAAM,gBAAgB;IAIR;IACA;IAJF,MAAM,GAAG,IAAI,eAAM,CAAC,kBAAgB,CAAC,IAAI,CAAC,CAAC;IAE5D,YACmB,SAAoB,EACpB,YAAgC;QADhC,cAAS,GAAT,SAAS,CAAW;QACpB,iBAAY,GAAZ,YAAY,CAAoB;IAChD,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC1C,2BAAmB,EACnB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QACF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;QAC7D,MAAM,GAAG,GAAI,OAA8C,CACzD,iCAAe,CACc,CAAC;QAEhC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,qDAAqD;gBACnD,qDAAqD,CACxD,CAAC;YACF,MAAM,IAAI,qCAA4B,CAAC;gBACrC,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,wDAAwD;aAClE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,oBAAoB;gBAC7B,KAAK,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE;gBACjD,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,mBAAmB,EAAE,GAAG;aACzB,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAAC;gBAC3B,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,8BAA8B,GAAG,gBAAgB;aAC3D,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAlDY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;qCAKmB,gBAAS;QACN,wCAAkB;GALxC,gBAAgB,CAkD5B"}
+{"version":3,"file":"entitlement.guard.js","sourceRoot":"","sources":["../../src/lib/entitlement.guard.ts"],"names":[],"mappings":";;;;;;;;;;;;;AAAA,2CAQwB;AACxB,uCAAyC;AAEzC,6DAA0D;AAG1D,qEAA8D;AAGjD,QAAA,mBAAmB,GAAG,0BAA0B,CAAC;AAmBvD,MAAM,kBAAkB,GAAG,CAChC,GAAmB,EACe,EAAE,CAAC,IAAA,oBAAW,EAAC,2BAAmB,EAAE,GAAG,CAAC,CAAC;AAFhE,QAAA,kBAAkB,sBAE8C;AAmBtE,IAAM,gBAAgB,wBAAtB,MAAM,gBAAgB;IAIR;IACA;IAJF,MAAM,GAAG,IAAI,eAAM,CAAC,kBAAgB,CAAC,IAAI,CAAC,CAAC;IAE5D,YACmB,SAAoB,EACpB,YAAgC;QADhC,cAAS,GAAT,SAAS,CAAW;QACpB,iBAAY,GAAZ,YAAY,CAAoB;IAChD,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,OAAyB;QACzC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAC1C,2BAAmB,EACnB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAC3C,CAAC;QACF,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;QAC7D,MAAM,GAAG,GAAI,OAA8C,CACzD,iCAAe,CACc,CAAC;QAEhC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,qDAAqD;gBACnD,qDAAqD,CACxD,CAAC;YACF,MAAM,IAAI,qCAA4B,CAAC;gBACrC,IAAI,EAAE,yBAAyB;gBAC/B,OAAO,EAAE,wDAAwD;aAClE,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACpE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EAAE,oBAAoB;gBAC7B,KAAK,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,WAAW,EAAE;gBACjD,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,mBAAmB,EAAE,GAAG;aACzB,CAAC,CAAC;YACH,MAAM,IAAI,2BAAkB,CAAC;gBAC3B,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,8BAA8B,GAAG,gBAAgB;aAC3D,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AAlDY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;qCAKmB,gBAAS;QACN,2CAAkB;GALxC,gBAAgB,CAkD5B"}

package/dist/lib/entitlement.service.d.ts

@@ -1,24 +1,23 @@
-import { Edition, EntitlementKey, type EntitlementSet } from '@xemahq/kernel-contracts/entitlement';
+import { type OnModuleInit } from '@nestjs/common';
+import { type EntitlementKey, type EntitlementSet } from '@xemahq/kernel-contracts/entitlement';
+import { type EntitlementQuery } from '@xemahq/license-verifier';
+import { type InstallationLicenseConfig, type LicenseEvaluationOptions, type LicenseGateOutcome, type LicensePosture } from './installation-license.ts';
 export declare const ENTITLEMENT_CLIENT_CONFIG: unique symbol;
-export interface EntitlementClientConfig {
-    deploymentCeiling: Edition;
-    identityApiUrl: string;
-    tokenProvider: () => Promise<string>;
-    cacheTtlMs?: number;
-    requestTimeoutMs?: number;
-}
-export declare class EntitlementService {
-    private readonly config;
+export type EntitlementClientConfig = InstallationLicenseConfig;
+export declare class EntitlementService implements OnModuleInit {
     private readonly logger;
-    private readonly cacheTtlMs;
-    private readonly requestTimeoutMs;
-    private readonly cache;
-    private readonly inflight;
+    private readonly installation;
     constructor(config: EntitlementClientConfig);
+    onModuleInit(): void;
+    evaluate(query: EntitlementQuery, options?: LicenseEvaluationOptions): LicenseGateOutcome;
+    requireEntitled(query: EntitlementQuery, options?: LicenseEvaluationOptions): void;
+    biomeInstallGate(biomeId: string, options?: LicenseEvaluationOptions): LicenseGateOutcome;
+    requireEditionEntitled(options?: LicenseEvaluationOptions): void;
+    requireBiomeInstallEntitled(biomeId: string, options?: LicenseEvaluationOptions): void;
+    private enforce;
+    getPosture(options?: LicenseEvaluationOptions): LicensePosture;
     isEntitled(orgId: string, key: EntitlementKey): Promise<boolean>;
-    getEffective(orgId: string): Promise<EntitlementSet>;
-    private resolve;
-    private fetchOrgEntitlement;
+    getEffective(orgId: string, options?: LicenseEvaluationOptions): EntitlementSet;
 }
-export declare function resolveDeploymentCeiling(rawEdition: string | undefined): Edition;
+export declare function readLicenseFromEnv(env?: NodeJS.ProcessEnv): string | undefined;
 //# sourceMappingURL=entitlement.service.d.ts.map

package/dist/lib/entitlement.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entitlement.service.d.ts","sourceRoot":"","sources":["../../src/lib/entitlement.service.ts"],"names":[],"mappings":"AACA,OAAO,EACL,OAAO,EAEP,cAAc,EACd,KAAK,cAAc,EAIpB,MAAM,sCAAsC,CAAC;AAI9C,eAAO,MAAM,yBAAyB,eAAsC,CAAC;AAQ7E,MAAM,WAAW,uBAAuB;IAOtC,iBAAiB,EAAE,OAAO,CAAC;IAG3B,cAAc,EAAE,MAAM,CAAC;IAOvB,aAAa,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAMrC,UAAU,CAAC,EAAE,MAAM,CAAC;IAMpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAsBD,qBACa,kBAAkB;IAa3B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAZzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuC;IAC9D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAI1C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;IAEvD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA8C;gBAIpD,MAAM,EAAE,uBAAuB;IAY5C,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IAUhE,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;YAyB5C,OAAO;YAyBP,mBAAmB;CAsDlC;AAOD,wBAAgB,wBAAwB,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAGhF"}
+{"version":3,"file":"entitlement.service.d.ts","sourceRoot":"","sources":["../../src/lib/entitlement.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8B,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,cAAc,EACpB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAIL,KAAK,yBAAyB,EAC9B,KAAK,wBAAwB,EAC7B,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACpB,MAAM,2BAA2B,CAAC;AAMnC,eAAO,MAAM,yBAAyB,eAAsC,CAAC;AAa7E,MAAM,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAwBhE,qBACa,kBAAmB,YAAW,YAAY;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAuC;IAC9D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAsB;gBAIjD,MAAM,EAAE,uBAAuB;IAsBjC,YAAY,IAAI,IAAI;IAkDpB,QAAQ,CACN,KAAK,EAAE,gBAAgB,EACvB,OAAO,GAAE,wBAA6B,GACrC,kBAAkB;IAarB,eAAe,CACb,KAAK,EAAE,gBAAgB,EACvB,OAAO,GAAE,wBAA6B,GACrC,IAAI;IAaP,gBAAgB,CACd,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,wBAA6B,GACrC,kBAAkB;IAarB,sBAAsB,CAAC,OAAO,GAAE,wBAA6B,GAAG,IAAI;IAiBpE,2BAA2B,CACzB,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,wBAA6B,GACrC,IAAI;IASP,OAAO,CAAC,OAAO;IAef,UAAU,CAAC,OAAO,GAAE,wBAA6B,GAAG,cAAc;IAiB5D,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC;IAkBtE,YAAY,CACV,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,wBAA6B,GACrC,cAAc;CASlB;AAUD,wBAAgB,kBAAkB,CAChC,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,SAAS,CAGpB"}

package/dist/lib/entitlement.service.js

@@ -14,93 +14,117 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 var EntitlementService_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EntitlementService = exports.ENTITLEMENT_CLIENT_CONFIG = void 0;
-exports.resolveDeploymentCeiling = resolveDeploymentCeiling;
+exports.readLicenseFromEnv = readLicenseFromEnv;
 const common_1 = require("@nestjs/common");
 const entitlement_1 = require("@xemahq/kernel-contracts/entitlement");
+const license_verifier_1 = require("@xemahq/license-verifier");
+const installation_license_ts_1 = require("./installation-license.js");
+const license_refused_exception_ts_1 = require("./license-refused.exception.js");
+const license_warnings_ts_1 = require("./license-warnings.js");
 exports.ENTITLEMENT_CLIENT_CONFIG = Symbol('ENTITLEMENT_CLIENT_CONFIG');
 let EntitlementService = EntitlementService_1 = class EntitlementService {
-    config;
     logger = new common_1.Logger(EntitlementService_1.name);
-    cacheTtlMs;
-    requestTimeoutMs;
-    cache = new Map();
-    inflight = new Map();
+    installation;
     constructor(config) {
-        this.config = config;
-        this.cacheTtlMs = config.cacheTtlMs ?? 60_000;
-        this.requestTimeoutMs = config.requestTimeoutMs ?? 5_000;
+        this.installation = new installation_license_ts_1.InstallationLicense(config);
     }
-    async isEntitled(orgId, key) {
-        const effective = await this.getEffective(orgId);
-        return (0, entitlement_1.isFeatureEntitled)(effective, key);
-    }
-    async getEffective(orgId) {
-        const cached = this.cache.get(orgId);
-        if (cached && Date.now() < cached.expiresAt) {
-            return cached.value;
+    onModuleInit() {
+        const posture = this.getPosture();
+        const severity = (0, installation_license_ts_1.worstWarningSeverity)(posture.warnings);
+        if (posture.licensed) {
+            this.logger.log({
+                message: 'license resolved',
+                source: posture.source,
+                licenseId: posture.licenseId,
+                customerId: posture.customerId,
+                tier: posture.tier,
+                status: posture.state.status,
+                stage: posture.state.stage,
+                edition: posture.entitlement.edition,
+                distributionId: posture.distributionId,
+                distributionEntitled: posture.distributionEntitled,
+            });
         }
-        const existing = this.inflight.get(orgId);
-        if (existing) {
-            return existing;
+        else {
+            this.logger.error({
+                message: `no Xema license could be verified — enterprise features are off ` +
+                    `and new biome installs will be refused. Supply one via the ` +
+                    `${installation_license_ts_1.LICENSE_ENV_VAR} environment variable.`,
+                source: posture.source,
+                code: posture.code,
+                detail: posture.message,
+                remediation: posture.remediation,
+            });
         }
-        const promise = this.resolve(orgId).finally(() => {
-            this.inflight.delete(orgId);
-        });
-        this.inflight.set(orgId, promise);
-        return promise;
+        for (const warning of posture.warnings) {
+            const line = { message: warning.message, code: warning.code };
+            if (warning.severity === license_warnings_ts_1.LicenseWarningSeverity.Critical) {
+                this.logger.error(line);
+            }
+            else {
+                this.logger.warn(line);
+            }
+        }
+        if (severity === undefined && posture.licensed) {
+            this.logger.log('license posture: healthy');
+        }
+    }
+    evaluate(query, options = {}) {
+        return this.installation.evaluate(query, options);
+    }
+    requireEntitled(query, options = {}) {
+        this.enforce(this.evaluate(query, options), query);
+    }
+    biomeInstallGate(biomeId, options = {}) {
+        return this.installation.biomeInstallGate(biomeId, options);
+    }
+    requireEditionEntitled(options = {}) {
+        this.enforce(this.installation.editionGate(options), this.installation.editionQuery() ?? undefined);
     }
-    async resolve(orgId) {
-        const orgEntitlement = await this.fetchOrgEntitlement(orgId);
-        const effective = (0, entitlement_1.resolveEffectiveEntitlement)(this.config.deploymentCeiling, orgEntitlement);
-        this.cache.set(orgId, {
-            value: effective,
-            expiresAt: Date.now() + this.cacheTtlMs,
+    requireBiomeInstallEntitled(biomeId, options = {}) {
+        this.enforce(this.installation.biomeInstallGate(biomeId, options), {
+            kind: license_verifier_1.EntitlementKind.Biome,
+            id: biomeId,
+            action: license_verifier_1.EntitlementAction.Install,
         });
-        return effective;
     }
-    async fetchOrgEntitlement(orgId) {
-        const controller = new AbortController();
-        const timer = setTimeout(() => controller.abort(), this.requestTimeoutMs);
-        try {
-            const token = await this.config.tokenProvider();
-            const url = `${this.config.identityApiUrl}/internal/orgs/${encodeURIComponent(orgId)}/entitlements`;
-            const response = await fetch(url, {
-                method: 'GET',
-                headers: { Authorization: `Bearer ${token}` },
-                signal: controller.signal,
-            });
-            if (!response.ok) {
-                if (response.status !== 404) {
-                    this.logger.warn({
-                        message: 'identity-api entitlement fetch returned non-2xx — failing closed to community',
-                        orgId,
-                        status: response.status,
-                    });
-                }
-                return undefined;
-            }
-            const body = await response.json();
-            const parsed = entitlement_1.EntitlementSetSchema.safeParse(body);
-            if (!parsed.success) {
-                this.logger.warn({
-                    message: 'identity-api entitlement payload failed schema validation — failing closed to community',
-                    orgId,
-                });
-                return undefined;
-            }
-            return parsed.data;
+    enforce(outcome, query) {
+        if (outcome.granted) {
+            return;
         }
-        catch (error) {
-            this.logger.warn({
-                message: 'identity-api entitlement fetch failed — failing closed to community',
+        this.logger.warn({
+            message: 'license-refused',
+            ...(query === undefined
+                ? {}
+                : { kind: query.kind, id: query.id, action: query.action }),
+            refusal: outcome.refusal,
+        });
+        throw new license_refused_exception_ts_1.LicenseRefusedException(outcome.refusal, query);
+    }
+    getPosture(options = {}) {
+        return this.installation.posture(options);
+    }
+    async isEntitled(orgId, key) {
+        const effective = this.getEffective(orgId);
+        const entitled = (0, entitlement_1.isFeatureEntitled)(effective, key);
+        if (!entitled) {
+            this.logger.debug({
+                message: 'feature-not-entitled',
                 orgId,
-                error: error instanceof Error ? error.message : String(error),
+                key,
+                edition: effective.edition,
             });
-            return undefined;
-        }
-        finally {
-            clearTimeout(timer);
         }
+        return entitled;
+    }
+    getEffective(orgId, options = {}) {
+        const effective = this.installation.entitlementSet(options);
+        this.logger.debug({
+            message: 'entitlement-resolved',
+            orgId,
+            edition: effective.edition,
+        });
+        return effective;
     }
 };
 exports.EntitlementService = EntitlementService;
@@ -109,8 +133,8 @@ exports.EntitlementService = EntitlementService = EntitlementService_1 = __decor
     __param(0, (0, common_1.Inject)(exports.ENTITLEMENT_CLIENT_CONFIG)),
     __metadata("design:paramtypes", [Object])
 ], EntitlementService);
-function resolveDeploymentCeiling(rawEdition) {
-    const parsed = entitlement_1.EditionSchema.safeParse(rawEdition);
-    return parsed.success ? parsed.data : entitlement_1.Edition.Community;
+function readLicenseFromEnv(env = process.env) {
+    const raw = env[installation_license_ts_1.LICENSE_ENV_VAR]?.trim();
+    return raw === undefined || raw.length === 0 ? undefined : raw;
 }
 //# sourceMappingURL=entitlement.service.js.map

package/dist/lib/entitlement.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"entitlement.service.js","sourceRoot":"","sources":["../../src/lib/entitlement.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AA4NA,4DAGC;AA/ND,2CAA4D;AAC5D,sEAQ8C;AAIjC,QAAA,yBAAyB,GAAG,MAAM,CAAC,2BAA2B,CAAC,CAAC;AA6DtE,IAAM,kBAAkB,0BAAxB,MAAM,kBAAkB;IAaV;IAZF,MAAM,GAAG,IAAI,eAAM,CAAC,oBAAkB,CAAC,IAAI,CAAC,CAAC;IAC7C,UAAU,CAAS;IACnB,gBAAgB,CAAS;IAIzB,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEtC,QAAQ,GAAG,IAAI,GAAG,EAAmC,CAAC;IAEvE,YAEmB,MAA+B;QAA/B,WAAM,GAAN,MAAM,CAAyB;QAEhD,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC;QAC9C,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC3D,CAAC;IAQD,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,GAAmB;QACjD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACjD,OAAO,IAAA,+BAAiB,EAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IAOD,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,KAAK,CAAC;QACtB,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAC/C,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9B,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAClC,OAAO,OAAO,CAAC;IACjB,CAAC;IASO,KAAK,CAAC,OAAO,CAAC,KAAa;QACjC,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,IAAA,yCAA2B,EAC3C,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAC7B,cAAc,CACf,CAAC;QACF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE;YACpB,KAAK,EAAE,SAAS;YAChB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU;SACxC,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IAcO,KAAK,CAAC,mBAAmB,CAC/B,KAAa;QAEb,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC1E,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;YAChD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,kBAAkB,kBAAkB,CAC3E,KAAK,CACN,eAAe,CAAC;YACjB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAChC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;gBAC7C,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAGjB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;wBACf,OAAO,EACL,+EAA+E;wBACjF,KAAK;wBACL,MAAM,EAAE,QAAQ,CAAC,MAAM;qBACxB,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC5C,MAAM,MAAM,GAAG,kCAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACpD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;oBACf,OAAO,EACL,yFAAyF;oBAC3F,KAAK;iBACN,CAAC,CAAC;gBACH,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAEf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;gBACf,OAAO,EACL,qEAAqE;gBACvE,KAAK;gBACL,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,OAAO,SAAS,CAAC;QACnB,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;CACF,CAAA;AA3IY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;IAaR,WAAA,IAAA,eAAM,EAAC,iCAAyB,CAAC,CAAA;;GAZzB,kBAAkB,CA2I9B;AAOD,SAAgB,wBAAwB,CAAC,UAA8B;IACrE,MAAM,MAAM,GAAG,2BAAa,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,qBAAO,CAAC,SAAS,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"entitlement.service.js","sourceRoot":"","sources":["../../src/lib/entitlement.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAmSA,gDAKC;AAxSD,2CAA+E;AAC/E,sEAI8C;AAC9C,+DAIkC;AAElC,uEAQmC;AACnC,iFAAyE;AACzE,+DAA+D;AAIlD,QAAA,yBAAyB,GAAG,MAAM,CAAC,2BAA2B,CAAC,CAAC;AAsCtE,IAAM,kBAAkB,0BAAxB,MAAM,kBAAkB;IACZ,MAAM,GAAG,IAAI,eAAM,CAAC,oBAAkB,CAAC,IAAI,CAAC,CAAC;IAC7C,YAAY,CAAsB;IAEnD,YAEE,MAA+B;QAE/B,IAAI,CAAC,YAAY,GAAG,IAAI,6CAAmB,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;IAmBD,YAAY;QACV,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAA,8CAAoB,EAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAExD,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;gBACd,OAAO,EAAE,kBAAkB;gBAC3B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;gBAC5B,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK;gBAC1B,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,OAAO;gBACpC,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;aACnD,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBAChB,OAAO,EACL,kEAAkE;oBAClE,6DAA6D;oBAC7D,GAAG,yCAAe,wBAAwB;gBAC5C,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,OAAO,CAAC,OAAO;gBACvB,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACvC,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;YAC9D,IAAI,OAAO,CAAC,QAAQ,KAAK,4CAAsB,CAAC,QAAQ,EAAE,CAAC;gBACzD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC/C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAQD,QAAQ,CACN,KAAuB,EACvB,UAAoC,EAAE;QAEtC,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IAWD,eAAe,CACb,KAAuB,EACvB,UAAoC,EAAE;QAEtC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC;IACrD,CAAC;IAWD,gBAAgB,CACd,OAAe,EACf,UAAoC,EAAE;QAEtC,OAAO,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAWD,sBAAsB,CAAC,UAAoC,EAAE;QAC3D,IAAI,CAAC,OAAO,CACV,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,OAAO,CAAC,EACtC,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,IAAI,SAAS,CAC9C,CAAC;IACJ,CAAC;IAYD,2BAA2B,CACzB,OAAe,EACf,UAAoC,EAAE;QAEtC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE;YACjE,IAAI,EAAE,kCAAe,CAAC,KAAK;YAC3B,EAAE,EAAE,OAAO;YACX,MAAM,EAAE,oCAAiB,CAAC,OAAO;SAClC,CAAC,CAAC;IACL,CAAC;IAGO,OAAO,CAAC,OAA2B,EAAE,KAAwB;QACnE,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YACf,OAAO,EAAE,iBAAiB;YAC1B,GAAG,CAAC,KAAK,KAAK,SAAS;gBACrB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YAC7D,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QACH,MAAM,IAAI,sDAAuB,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5D,CAAC;IAGD,UAAU,CAAC,UAAoC,EAAE;QAC/C,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAeD,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,GAAmB;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,IAAA,+BAAiB,EAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBAChB,OAAO,EAAE,sBAAsB;gBAC/B,KAAK;gBACL,GAAG;gBACH,OAAO,EAAE,SAAS,CAAC,OAAO;aAC3B,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAMD,YAAY,CACV,KAAa,EACb,UAAoC,EAAE;QAEtC,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAChB,OAAO,EAAE,sBAAsB;YAC/B,KAAK;YACL,OAAO,EAAE,SAAS,CAAC,OAAO;SAC3B,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;CACF,CAAA;AAzNY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,eAAM,EAAC,iCAAyB,CAAC,CAAA;;GALzB,kBAAkB,CAyN9B;AAUD,SAAgB,kBAAkB,CAChC,MAAyB,OAAO,CAAC,GAAG;IAEpC,MAAM,GAAG,GAAG,GAAG,CAAC,yCAAe,CAAC,EAAE,IAAI,EAAE,CAAC;IACzC,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC;AACjE,CAAC"}

package/dist/lib/installation-license.d.ts

@@ -0,0 +1,85 @@
+import { type EntitlementSet } from '@xemahq/kernel-contracts/entitlement';
+import { EntitlementDenialReason, LicenseSource, LicenseVerificationFailureCode, type EntitlementQuery, type LicenseEntitlement, type LicenseState, type LicenseTier, type LicenseTrustStore, type VerifiedLicense } from '@xemahq/license-verifier';
+import { LicenseWarningSeverity, type LicenseWarning } from './license-warnings.ts';
+export declare const LICENSE_ENV_VAR = "XEMA_LICENSE";
+export interface InstallationLicenseConfig {
+    readonly customerLicense: string | undefined;
+    readonly distributionId: string | null;
+    readonly trustStore?: LicenseTrustStore;
+}
+export interface LicenseEvaluationOptions {
+    readonly now?: number;
+}
+export declare enum LicenseRefusalKind {
+    Unverifiable = "unverifiable",
+    NotEntitled = "not-entitled",
+    DistributionUndeclared = "distribution-undeclared"
+}
+export interface LicenseUnverifiableRefusal {
+    readonly kind: LicenseRefusalKind.Unverifiable;
+    readonly code: LicenseVerificationFailureCode;
+    readonly message: string;
+    readonly remediation: string;
+}
+export interface LicenseNotEntitledRefusal {
+    readonly kind: LicenseRefusalKind.NotEntitled;
+    readonly reason: EntitlementDenialReason;
+    readonly state: LicenseState;
+}
+export interface LicenseDistributionUndeclaredRefusal {
+    readonly kind: LicenseRefusalKind.DistributionUndeclared;
+    readonly remediation: string;
+}
+export type LicenseRefusal = LicenseUnverifiableRefusal | LicenseNotEntitledRefusal | LicenseDistributionUndeclaredRefusal;
+export declare const DISTRIBUTION_UNDECLARED_REFUSAL: LicenseDistributionUndeclaredRefusal;
+export type LicenseGateOutcome = {
+    readonly granted: true;
+    readonly matched: LicenseEntitlement;
+    readonly state: LicenseState;
+} | {
+    readonly granted: false;
+    readonly refusal: LicenseRefusal;
+};
+export type LicensePosture = {
+    readonly licensed: true;
+    readonly source: LicenseSource;
+    readonly licenseId: string;
+    readonly customerId: string;
+    readonly customerName: string;
+    readonly tier: LicenseTier;
+    readonly state: LicenseState;
+    readonly entitlement: EntitlementSet;
+    readonly distributionId: string | null;
+    readonly distributionEntitled: boolean;
+    readonly warnings: readonly LicenseWarning[];
+} | {
+    readonly licensed: false;
+    readonly source: LicenseSource;
+    readonly code: LicenseVerificationFailureCode;
+    readonly message: string;
+    readonly remediation: string;
+    readonly entitlement: EntitlementSet;
+    readonly distributionId: string | null;
+    readonly distributionEntitled: false;
+    readonly warnings: readonly LicenseWarning[];
+};
+export declare class InstallationLicense {
+    private readonly config;
+    private verification;
+    private highestObservedTimeMs;
+    constructor(config: InstallationLicenseConfig);
+    evaluate(query: EntitlementQuery, options?: LicenseEvaluationOptions): LicenseGateOutcome;
+    entitlementSet(options?: LicenseEvaluationOptions): EntitlementSet;
+    editionQuery(): EntitlementQuery | null;
+    editionGate(options?: LicenseEvaluationOptions): LicenseGateOutcome;
+    biomeInstallGate(biomeId: string, options?: LicenseEvaluationOptions): LicenseGateOutcome;
+    distributionEntitled(options?: LicenseEvaluationOptions): boolean;
+    posture(options?: LicenseEvaluationOptions): LicensePosture;
+    verifiedLicense(): VerifiedLicense | undefined;
+    private effective;
+    private stateOptions;
+    private observe;
+}
+export declare function worstWarningSeverity(warnings: readonly LicenseWarning[]): LicenseWarningSeverity | undefined;
+export declare function isUnprovisionedBuildRefusal(refusal: LicenseRefusal): boolean;
+//# sourceMappingURL=installation-license.d.ts.map