@xemahq/entitlement-client 0.1.3 → 0.2.1

package/dist/lib/installation-license.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installation-license.d.ts","sourceRoot":"","sources":["../../src/lib/installation-license.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAEL,uBAAuB,EAGvB,aAAa,EACb,8BAA8B,EAG9B,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACrB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAIL,sBAAsB,EACtB,KAAK,cAAc,EACpB,MAAM,uBAAuB,CAAC;AAmC/B,eAAO,MAAM,eAAe,iBAAiB,CAAC;AAG9C,MAAM,WAAW,yBAAyB;IAQxC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IAa7C,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAKvC,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC;CACzC;AAGD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAGD,oBAAY,kBAAkB;IAM5B,YAAY,iBAAiB;IAK7B,WAAW,iBAAiB;IAO5B,sBAAsB,4BAA4B;CACnD;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,YAAY,CAAC;IAC/C,QAAQ,CAAC,IAAI,EAAE,8BAA8B,CAAC;IAE9C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,WAAW,CAAC;IAC9C,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;CAC9B;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,sBAAsB,CAAC;IAEzD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,MAAM,cAAc,GACtB,0BAA0B,GAC1B,yBAAyB,GACzB,oCAAoC,CAAC;AAGzC,eAAO,MAAM,+BAA+B,EAAE,oCAO3C,CAAC;AAEJ,MAAM,MAAM,kBAAkB,GAC1B;IACE,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC;IAEvB,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;CAC9B,GACD;IAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;CAAE,CAAC;AAGlE,MAAM,MAAM,cAAc,GACtB;IACE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IAErC,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;CAC9C,GACD;IACE,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,8BAA8B,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAE7B,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,oBAAoB,EAAE,KAAK,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,SAAS,cAAc,EAAE,CAAC;CAC9C,CAAC;AAWN,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;IAYnD,OAAO,CAAC,YAAY,CAAyD;IAS7E,OAAO,CAAC,qBAAqB,CAAqB;gBAEtC,MAAM,EAAE,yBAAyB;IAa7C,QAAQ,CACN,KAAK,EAAE,gBAAgB,EACvB,OAAO,GAAE,wBAA6B,GACrC,kBAAkB;IA+CrB,cAAc,CAAC,OAAO,GAAE,wBAA6B,GAAG,cAAc;IA0BtE,YAAY,IAAI,gBAAgB,GAAG,IAAI;IAqBvC,WAAW,CAAC,OAAO,GAAE,wBAA6B,GAAG,kBAAkB;IAiBvE,gBAAgB,CACd,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,wBAA6B,GACrC,kBAAkB;IAgBrB,oBAAoB,CAAC,OAAO,GAAE,wBAA6B,GAAG,OAAO;IAKrE,OAAO,CAAC,OAAO,GAAE,wBAA6B,GAAG,cAAc;IAuE/D,eAAe,IAAI,eAAe,GAAG,SAAS;IAO9C,OAAO,CAAC,SAAS;IAUjB,OAAO,CAAC,YAAY;IAYpB,OAAO,CAAC,OAAO;CAQhB;AAQD,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,SAAS,cAAc,EAAE,GAClC,sBAAsB,GAAG,SAAS,CAWpC;AAaD,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAK5E"}

package/dist/lib/installation-license.js

@@ -0,0 +1,212 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.InstallationLicense = exports.DISTRIBUTION_UNDECLARED_REFUSAL = exports.LicenseRefusalKind = exports.LICENSE_ENV_VAR = void 0;
+exports.worstWarningSeverity = worstWarningSeverity;
+exports.isUnprovisionedBuildRefusal = isUnprovisionedBuildRefusal;
+const entitlement_1 = require("@xemahq/kernel-contracts/entitlement");
+const license_verifier_1 = require("@xemahq/license-verifier");
+const license_warnings_ts_1 = require("./license-warnings.js");
+exports.LICENSE_ENV_VAR = 'XEMA_LICENSE';
+var LicenseRefusalKind;
+(function (LicenseRefusalKind) {
+    LicenseRefusalKind["Unverifiable"] = "unverifiable";
+    LicenseRefusalKind["NotEntitled"] = "not-entitled";
+    LicenseRefusalKind["DistributionUndeclared"] = "distribution-undeclared";
+})(LicenseRefusalKind || (exports.LicenseRefusalKind = LicenseRefusalKind = {}));
+exports.DISTRIBUTION_UNDECLARED_REFUSAL = {
+    kind: LicenseRefusalKind.DistributionUndeclared,
+    remediation: 'Mount the distribution lock (XEMA_DISTRIBUTION_LOCK_PATH) so this ' +
+        'deployment declares which Xema distribution it runs, or set ' +
+        'XEMA_DISTRIBUTION_ID explicitly.',
+};
+class InstallationLicense {
+    config;
+    verification;
+    highestObservedTimeMs;
+    constructor(config) {
+        this.config = config;
+    }
+    evaluate(query, options = {}) {
+        const effective = this.effective();
+        if (!effective.ok) {
+            return {
+                granted: false,
+                refusal: {
+                    kind: LicenseRefusalKind.Unverifiable,
+                    code: effective.code,
+                    message: effective.message,
+                    remediation: (0, license_warnings_ts_1.platformLicenseRemediation)(effective.code),
+                },
+            };
+        }
+        const decision = (0, license_verifier_1.evaluateEntitlement)(effective.license, query, this.stateOptions(options));
+        this.observe(decision.state.evaluatedAtMs);
+        if (decision.granted) {
+            return {
+                granted: true,
+                matched: decision.matched,
+                state: decision.state,
+            };
+        }
+        return {
+            granted: false,
+            refusal: {
+                kind: LicenseRefusalKind.NotEntitled,
+                reason: decision.reason,
+                state: decision.state,
+            },
+        };
+    }
+    entitlementSet(options = {}) {
+        if (!this.effective().ok) {
+            return entitlement_1.COMMUNITY_ENTITLEMENT;
+        }
+        return (0, entitlement_1.projectEntitlementSet)((capabilityClassId) => this.evaluate({
+            kind: license_verifier_1.EntitlementKind.CapabilityClass,
+            id: capabilityClassId,
+            action: license_verifier_1.EntitlementAction.RunExisting,
+        }, options).granted);
+    }
+    editionQuery() {
+        const { distributionId } = this.config;
+        if (distributionId === null) {
+            return null;
+        }
+        return {
+            kind: license_verifier_1.EntitlementKind.Distribution,
+            id: distributionId,
+            action: license_verifier_1.EntitlementAction.RunExisting,
+        };
+    }
+    editionGate(options = {}) {
+        const query = this.editionQuery();
+        if (query === null) {
+            return { granted: false, refusal: exports.DISTRIBUTION_UNDECLARED_REFUSAL };
+        }
+        return this.evaluate(query, options);
+    }
+    biomeInstallGate(biomeId, options = {}) {
+        const edition = this.editionGate(options);
+        if (!edition.granted) {
+            return edition;
+        }
+        return this.evaluate({
+            kind: license_verifier_1.EntitlementKind.Biome,
+            id: biomeId,
+            action: license_verifier_1.EntitlementAction.Install,
+        }, options);
+    }
+    distributionEntitled(options = {}) {
+        return this.editionGate(options).granted;
+    }
+    posture(options = {}) {
+        const effective = this.effective();
+        if (!effective.ok) {
+            return {
+                licensed: false,
+                source: effective.source,
+                code: effective.code,
+                message: effective.message,
+                remediation: (0, license_warnings_ts_1.platformLicenseRemediation)(effective.code),
+                entitlement: entitlement_1.COMMUNITY_ENTITLEMENT,
+                distributionId: this.config.distributionId,
+                distributionEntitled: false,
+                warnings: [
+                    {
+                        code: license_warnings_ts_1.LicenseWarningCode.Unverifiable,
+                        severity: license_warnings_ts_1.LicenseWarningSeverity.Critical,
+                        message: `No license could be verified (${effective.code}): ` +
+                            `${effective.message}. Enterprise features are off and new biome ` +
+                            'installs are refused. Existing workloads keep running.',
+                    },
+                ],
+            };
+        }
+        const state = (0, license_verifier_1.resolveLicenseState)(effective.license, this.stateOptions(options));
+        this.observe(state.evaluatedAtMs);
+        const distributionEntitled = this.distributionEntitled(options);
+        const warnings = (0, license_warnings_ts_1.licenseStateWarnings)(state);
+        if (this.config.distributionId === null) {
+            warnings.push({
+                code: license_warnings_ts_1.LicenseWarningCode.DistributionUndeclared,
+                severity: license_warnings_ts_1.LicenseWarningSeverity.Warning,
+                message: 'This deployment does not declare which distribution it is running ' +
+                    '(no distribution lock is mounted), so the license cannot be checked ' +
+                    'against an edition at all. Mount the distribution lock.',
+            });
+        }
+        else if (!distributionEntitled) {
+            warnings.push({
+                code: license_warnings_ts_1.LicenseWarningCode.DistributionNotEntitled,
+                severity: license_warnings_ts_1.LicenseWarningSeverity.Critical,
+                message: `The license does not entitle this installation to run the ` +
+                    `"${this.config.distributionId}" distribution. Mirroring the images ` +
+                    'does not confer the right to run them (decision D6). New biome ' +
+                    'installs and upgrades are refused; existing workloads keep running ' +
+                    'and no data is touched.',
+            });
+        }
+        const { claims } = effective.license;
+        return {
+            licensed: true,
+            source: effective.source,
+            licenseId: claims.licenseId,
+            customerId: claims.subject.customerId,
+            customerName: claims.subject.customerName,
+            tier: claims.tier,
+            state,
+            entitlement: this.entitlementSet(options),
+            distributionId: this.config.distributionId,
+            distributionEntitled,
+            warnings,
+        };
+    }
+    verifiedLicense() {
+        const effective = this.effective();
+        return effective.ok ? effective.license : undefined;
+    }
+    effective() {
+        this.verification ??= (0, license_verifier_1.resolveEffectiveLicense)({
+            customerLicense: this.config.customerLicense,
+            ...(this.config.trustStore !== undefined
+                ? { trustStore: this.config.trustStore }
+                : {}),
+        });
+        return this.verification;
+    }
+    stateOptions(options) {
+        return {
+            ...(options.now !== undefined ? { now: options.now } : {}),
+            ...(this.highestObservedTimeMs !== undefined
+                ? { highestObservedTimeMs: this.highestObservedTimeMs }
+                : {}),
+        };
+    }
+    observe(evaluatedAtMs) {
+        if (this.highestObservedTimeMs === undefined ||
+            evaluatedAtMs > this.highestObservedTimeMs) {
+            this.highestObservedTimeMs = evaluatedAtMs;
+        }
+    }
+}
+exports.InstallationLicense = InstallationLicense;
+function worstWarningSeverity(warnings) {
+    let worst;
+    for (const warning of warnings) {
+        if (worst === undefined ||
+            SEVERITY_ORDER[warning.severity] > SEVERITY_ORDER[worst]) {
+            worst = warning.severity;
+        }
+    }
+    return worst;
+}
+const SEVERITY_ORDER = {
+    [license_warnings_ts_1.LicenseWarningSeverity.Info]: 0,
+    [license_warnings_ts_1.LicenseWarningSeverity.Warning]: 1,
+    [license_warnings_ts_1.LicenseWarningSeverity.Critical]: 2,
+};
+function isUnprovisionedBuildRefusal(refusal) {
+    return (refusal.kind === LicenseRefusalKind.Unverifiable &&
+        refusal.code === license_verifier_1.LicenseVerificationFailureCode.TrustStoreEmpty);
+}
+//# sourceMappingURL=installation-license.js.map

package/dist/lib/installation-license.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installation-license.js","sourceRoot":"","sources":["../../src/lib/installation-license.ts"],"names":[],"mappings":";;;AAifA,oDAaC;AAaD,kEAKC;AAhhBD,sEAI8C;AAC9C,+DAekC;AAElC,+DAM+B;AAmClB,QAAA,eAAe,GAAG,cAAc,CAAC;AAsC9C,IAAY,kBAmBX;AAnBD,WAAY,kBAAkB;IAM5B,mDAA6B,CAAA;IAK7B,kDAA4B,CAAA;IAO5B,wEAAkD,CAAA;AACpD,CAAC,EAnBW,kBAAkB,kCAAlB,kBAAkB,QAmB7B;AA6BY,QAAA,+BAA+B,GAC1C;IACE,IAAI,EAAE,kBAAkB,CAAC,sBAAsB;IAC/C,WAAW,EACT,oEAAoE;QACpE,8DAA8D;QAC9D,kCAAkC;CACrC,CAAC;AAkDJ,MAAa,mBAAmB;IACb,MAAM,CAA4B;IAY3C,YAAY,CAAyD;IASrE,qBAAqB,CAAqB;IAElD,YAAY,MAAiC;QAC3C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAWD,QAAQ,CACN,KAAuB,EACvB,UAAoC,EAAE;QAEtC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,OAAO,EAAE;oBACP,IAAI,EAAE,kBAAkB,CAAC,YAAY;oBACrC,IAAI,EAAE,SAAS,CAAC,IAAI;oBACpB,OAAO,EAAE,SAAS,CAAC,OAAO;oBAC1B,WAAW,EAAE,IAAA,gDAA0B,EAAC,SAAS,CAAC,IAAI,CAAC;iBACxD;aACF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAA,sCAAmB,EAClC,SAAS,CAAC,OAAO,EACjB,KAAK,EACL,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAC3B,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC3C,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;aACtB,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE;gBACP,IAAI,EAAE,kBAAkB,CAAC,WAAW;gBACpC,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,KAAK,EAAE,QAAQ,CAAC,KAAK;aACtB;SACF,CAAC;IACJ,CAAC;IAYD,cAAc,CAAC,UAAoC,EAAE;QACnD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACzB,OAAO,mCAAqB,CAAC;QAC/B,CAAC;QACD,OAAO,IAAA,mCAAqB,EAC1B,CAAC,iBAAiB,EAAE,EAAE,CACpB,IAAI,CAAC,QAAQ,CACX;YACE,IAAI,EAAE,kCAAe,CAAC,eAAe;YACrC,EAAE,EAAE,iBAAiB;YACrB,MAAM,EAAE,oCAAiB,CAAC,WAAW;SACtC,EACD,OAAO,CACR,CAAC,OAAO,CACZ,CAAC;IACJ,CAAC;IAWD,YAAY;QACV,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QACvC,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,IAAI,EAAE,kCAAe,CAAC,YAAY;YAClC,EAAE,EAAE,cAAc;YAClB,MAAM,EAAE,oCAAiB,CAAC,WAAW;SACtC,CAAC;IACJ,CAAC;IAWD,WAAW,CAAC,UAAoC,EAAE;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uCAA+B,EAAE,CAAC;QACtE,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACvC,CAAC;IAWD,gBAAgB,CACd,OAAe,EACf,UAAoC,EAAE;QAEtC,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACrB,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAClB;YACE,IAAI,EAAE,kCAAe,CAAC,KAAK;YAC3B,EAAE,EAAE,OAAO;YACX,MAAM,EAAE,oCAAiB,CAAC,OAAO;SAClC,EACD,OAAO,CACR,CAAC;IACJ,CAAC;IAGD,oBAAoB,CAAC,UAAoC,EAAE;QACzD,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;IAC3C,CAAC;IAGD,OAAO,CAAC,UAAoC,EAAE;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAClB,OAAO;gBACL,QAAQ,EAAE,KAAK;gBACf,MAAM,EAAE,SAAS,CAAC,MAAM;gBACxB,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,OAAO,EAAE,SAAS,CAAC,OAAO;gBAC1B,WAAW,EAAE,IAAA,gDAA0B,EAAC,SAAS,CAAC,IAAI,CAAC;gBACvD,WAAW,EAAE,mCAAqB;gBAClC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;gBAC1C,oBAAoB,EAAE,KAAK;gBAC3B,QAAQ,EAAE;oBACR;wBACE,IAAI,EAAE,wCAAkB,CAAC,YAAY;wBACrC,QAAQ,EAAE,4CAAsB,CAAC,QAAQ;wBACzC,OAAO,EACL,iCAAiC,SAAS,CAAC,IAAI,KAAK;4BACpD,GAAG,SAAS,CAAC,OAAO,8CAA8C;4BAClE,wDAAwD;qBAC3D;iBACF;aACF,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,IAAA,sCAAmB,EAC/B,SAAS,CAAC,OAAO,EACjB,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAC3B,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAClC,MAAM,oBAAoB,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,IAAA,0CAAoB,EAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,wCAAkB,CAAC,sBAAsB;gBAC/C,QAAQ,EAAE,4CAAsB,CAAC,OAAO;gBACxC,OAAO,EACL,oEAAoE;oBACpE,sEAAsE;oBACtE,yDAAyD;aAC5D,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;YACjC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,wCAAkB,CAAC,uBAAuB;gBAChD,QAAQ,EAAE,4CAAsB,CAAC,QAAQ;gBACzC,OAAO,EACL,4DAA4D;oBAC5D,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,uCAAuC;oBACrE,iEAAiE;oBACjE,qEAAqE;oBACrE,yBAAyB;aAC5B,CAAC,CAAC;QACL,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC;QACrC,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU;YACrC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,YAAY;YACzC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,KAAK;YACL,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;YACzC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,cAAc;YAC1C,oBAAoB;YACpB,QAAQ;SACT,CAAC;IACJ,CAAC;IAGD,eAAe;QACb,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,CAAC;IAIO,SAAS;QACf,IAAI,CAAC,YAAY,KAAK,IAAA,0CAAuB,EAAC;YAC5C,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,eAAe;YAC5C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS;gBACtC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE;gBACxC,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAEO,YAAY,CAAC,OAAiC;QAIpD,OAAO;YACL,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,GAAG,CAAC,IAAI,CAAC,qBAAqB,KAAK,SAAS;gBAC1C,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,CAAC,qBAAqB,EAAE;gBACvD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAEO,OAAO,CAAC,aAAqB;QACnC,IACE,IAAI,CAAC,qBAAqB,KAAK,SAAS;YACxC,aAAa,GAAG,IAAI,CAAC,qBAAqB,EAC1C,CAAC;YACD,IAAI,CAAC,qBAAqB,GAAG,aAAa,CAAC;QAC7C,CAAC;IACH,CAAC;CACF;AA3RD,kDA2RC;AAQD,SAAgB,oBAAoB,CAClC,QAAmC;IAEnC,IAAI,KAAyC,CAAC;IAC9C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IACE,KAAK,KAAK,SAAS;YACnB,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,EACxD,CAAC;YACD,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,cAAc,GAA2C;IAC7D,CAAC,4CAAsB,CAAC,IAAI,CAAC,EAAE,CAAC;IAChC,CAAC,4CAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;IACnC,CAAC,4CAAsB,CAAC,QAAQ,CAAC,EAAE,CAAC;CACrC,CAAC;AAOF,SAAgB,2BAA2B,CAAC,OAAuB;IACjE,OAAO,CACL,OAAO,CAAC,IAAI,KAAK,kBAAkB,CAAC,YAAY;QAChD,OAAO,CAAC,IAAI,KAAK,iDAA8B,CAAC,eAAe,CAChE,CAAC;AACJ,CAAC"}

package/dist/lib/license-refused.exception.d.ts

@@ -0,0 +1,16 @@
+import { ForbiddenException } from '@nestjs/common';
+import { type EntitlementQuery } from '@xemahq/license-verifier';
+import { type LicenseRefusal } from './installation-license.ts';
+export declare enum LicenseEnforcementErrorCode {
+    LicenseUnverifiable = "LICENSE_UNVERIFIABLE",
+    LicenseNotEntitled = "LICENSE_NOT_ENTITLED",
+    DistributionUndeclared = "LICENSE_DISTRIBUTION_UNDECLARED"
+}
+export declare function errorCodeFor(refusal: LicenseRefusal): LicenseEnforcementErrorCode;
+export declare class LicenseRefusedException extends ForbiddenException {
+    readonly refusal: LicenseRefusal;
+    readonly query?: EntitlementQuery | undefined;
+    constructor(refusal: LicenseRefusal, query?: EntitlementQuery | undefined);
+}
+export declare function describeRefusal(refusal: LicenseRefusal, query?: EntitlementQuery): string;
+//# sourceMappingURL=license-refused.exception.d.ts.map

package/dist/lib/license-refused.exception.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"license-refused.exception.d.ts","sourceRoot":"","sources":["../../src/lib/license-refused.exception.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAEL,KAAK,gBAAgB,EACtB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,2BAA2B,CAAC;AAanC,oBAAY,2BAA2B;IAErC,mBAAmB,yBAAyB;IAE5C,kBAAkB,yBAAyB;IAO3C,sBAAsB,oCAAoC;CAC3D;AAMD,wBAAgB,YAAY,CAC1B,OAAO,EAAE,cAAc,GACtB,2BAA2B,CAa7B;AAUD,qBAAa,uBAAwB,SAAQ,kBAAkB;IAE3D,QAAQ,CAAC,OAAO,EAAE,cAAc;IAMhC,QAAQ,CAAC,KAAK,CAAC,EAAE,gBAAgB;gBANxB,OAAO,EAAE,cAAc,EAMvB,KAAK,CAAC,EAAE,gBAAgB,YAAA;CAapC;AAkCD,wBAAgB,eAAe,CAC7B,OAAO,EAAE,cAAc,EACvB,KAAK,CAAC,EAAE,gBAAgB,GACvB,MAAM,CAkER"}

package/dist/lib/license-refused.exception.js

@@ -0,0 +1,121 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LicenseRefusedException = exports.LicenseEnforcementErrorCode = void 0;
+exports.errorCodeFor = errorCodeFor;
+exports.describeRefusal = describeRefusal;
+const common_1 = require("@nestjs/common");
+const license_verifier_1 = require("@xemahq/license-verifier");
+const installation_license_ts_1 = require("./installation-license.js");
+var LicenseEnforcementErrorCode;
+(function (LicenseEnforcementErrorCode) {
+    LicenseEnforcementErrorCode["LicenseUnverifiable"] = "LICENSE_UNVERIFIABLE";
+    LicenseEnforcementErrorCode["LicenseNotEntitled"] = "LICENSE_NOT_ENTITLED";
+    LicenseEnforcementErrorCode["DistributionUndeclared"] = "LICENSE_DISTRIBUTION_UNDECLARED";
+})(LicenseEnforcementErrorCode || (exports.LicenseEnforcementErrorCode = LicenseEnforcementErrorCode = {}));
+function errorCodeFor(refusal) {
+    switch (refusal.kind) {
+        case installation_license_ts_1.LicenseRefusalKind.Unverifiable:
+            return LicenseEnforcementErrorCode.LicenseUnverifiable;
+        case installation_license_ts_1.LicenseRefusalKind.NotEntitled:
+            return LicenseEnforcementErrorCode.LicenseNotEntitled;
+        case installation_license_ts_1.LicenseRefusalKind.DistributionUndeclared:
+            return LicenseEnforcementErrorCode.DistributionUndeclared;
+        default: {
+            const exhaustive = refusal;
+            throw new TypeError(`unhandled refusal kind ${String(exhaustive)}`);
+        }
+    }
+}
+class LicenseRefusedException extends common_1.ForbiddenException {
+    refusal;
+    query;
+    constructor(refusal, query) {
+        super({
+            code: errorCodeFor(refusal),
+            message: describeRefusal(refusal, query),
+            ...(query === undefined
+                ? {}
+                : {
+                    resource: { kind: query.kind, id: query.id, action: query.action },
+                }),
+            ...detailFor(refusal),
+        });
+        this.refusal = refusal;
+        this.query = query;
+    }
+}
+exports.LicenseRefusedException = LicenseRefusedException;
+function detailFor(refusal) {
+    switch (refusal.kind) {
+        case installation_license_ts_1.LicenseRefusalKind.Unverifiable:
+            return {
+                verificationFailure: refusal.code,
+                remediation: refusal.remediation,
+            };
+        case installation_license_ts_1.LicenseRefusalKind.NotEntitled:
+            return {
+                denialReason: refusal.reason,
+                licenseStatus: refusal.state.status,
+                lifecycleStage: refusal.state.stage,
+                expiresAt: instantOrNull(refusal.state.expiresAtMs),
+                graceEndsAt: instantOrNull(refusal.state.graceEndsAtMs),
+            };
+        case installation_license_ts_1.LicenseRefusalKind.DistributionUndeclared:
+            return { remediation: refusal.remediation };
+        default: {
+            const exhaustive = refusal;
+            throw new TypeError(`unhandled refusal kind ${String(exhaustive)}`);
+        }
+    }
+}
+function describeRefusal(refusal, query) {
+    const subject = query === undefined
+        ? 'proceed'
+        : `${query.action} ${query.kind} "${query.id}"`;
+    if (refusal.kind === installation_license_ts_1.LicenseRefusalKind.Unverifiable) {
+        return (`Refused to ${subject}: no Xema license could be verified ` +
+            `(${refusal.code}). ${refusal.message}. ${refusal.remediation}`);
+    }
+    if (refusal.kind === installation_license_ts_1.LicenseRefusalKind.DistributionUndeclared) {
+        return (`Refused to ${subject}: this deployment does not declare which Xema ` +
+            'distribution it is running, so its license cannot be checked against an ' +
+            `edition. ${refusal.remediation}`);
+    }
+    switch (refusal.reason) {
+        case license_verifier_1.EntitlementDenialReason.MalformedQuery:
+            return (`Refused to ${subject}: the resource identifier is not well-formed, ` +
+                'so no entitlement could be checked against it. This is a ' +
+                'defect in the caller, not in the license.');
+        case license_verifier_1.EntitlementDenialReason.LicenseNotYetValid:
+            return (`Refused to ${subject}: the license is dated in the future and is not ` +
+                'yet in force. Either a renewal was applied early, or this machine’s ' +
+                'clock is wrong — check NTP before replacing the license.');
+        case license_verifier_1.EntitlementDenialReason.LicenseRevoked:
+            return (`Refused to ${subject}: the Xema license for this installation has ` +
+                'been revoked. Contact Xema.');
+        case license_verifier_1.EntitlementDenialReason.LicenseSuspended:
+            return (`Refused to ${subject}: the Xema license for this installation is ` +
+                'suspended. Existing workloads keep running; nothing new is permitted ' +
+                'until the hold is lifted.');
+        case license_verifier_1.EntitlementDenialReason.LicenseRestricted:
+            return (`Refused to ${subject}: the Xema license expired on ` +
+                `${instantOrNull(refusal.state.expiresAtMs) ?? 'an unknown date'} and ` +
+                `its 30-day grace period ended on ` +
+                `${instantOrNull(refusal.state.graceEndsAtMs) ?? 'an unknown date'}. ` +
+                'Upgrades, new biome installs and new projects or organizations are ' +
+                'refused. Existing workloads keep running and no data is affected — ' +
+                'apply a renewed license to restore them.');
+        case license_verifier_1.EntitlementDenialReason.NoMatchingEntitlement:
+            return (`Refused to ${subject}: the Xema license for this installation is in ` +
+                'force but grants nothing that covers it. Ask Xema to extend the ' +
+                'license, then apply the reissued token.');
+        default: {
+            const exhaustive = refusal.reason;
+            throw new TypeError(`unhandled denial reason ${String(exhaustive)}`);
+        }
+    }
+}
+function instantOrNull(epochMs) {
+    return epochMs === null ? null : new Date(epochMs).toISOString();
+}
+//# sourceMappingURL=license-refused.exception.js.map

package/dist/lib/license-refused.exception.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"license-refused.exception.js","sourceRoot":"","sources":["../../src/lib/license-refused.exception.ts"],"names":[],"mappings":";;;AAwCA,oCAeC;AAiED,0CAqEC;AA7LD,2CAAoD;AACpD,+DAGkC;AAElC,uEAGmC;AAanC,IAAY,2BAYX;AAZD,WAAY,2BAA2B;IAErC,2EAA4C,CAAA;IAE5C,0EAA2C,CAAA;IAO3C,yFAA0D,CAAA;AAC5D,CAAC,EAZW,2BAA2B,2CAA3B,2BAA2B,QAYtC;AAMD,SAAgB,YAAY,CAC1B,OAAuB;IAEvB,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,4CAAkB,CAAC,YAAY;YAClC,OAAO,2BAA2B,CAAC,mBAAmB,CAAC;QACzD,KAAK,4CAAkB,CAAC,WAAW;YACjC,OAAO,2BAA2B,CAAC,kBAAkB,CAAC;QACxD,KAAK,4CAAkB,CAAC,sBAAsB;YAC5C,OAAO,2BAA2B,CAAC,sBAAsB,CAAC;QAC5D,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,OAAO,CAAC;YAClC,MAAM,IAAI,SAAS,CAAC,0BAA0B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;AACH,CAAC;AAUD,MAAa,uBAAwB,SAAQ,2BAAkB;IAElD;IAMA;IAPX,YACW,OAAuB,EAMvB,KAAwB;QAEjC,KAAK,CAAC;YACJ,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC;YAC3B,OAAO,EAAE,eAAe,CAAC,OAAO,EAAE,KAAK,CAAC;YACxC,GAAG,CAAC,KAAK,KAAK,SAAS;gBACrB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC;oBACE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;iBACnE,CAAC;YACN,GAAG,SAAS,CAAC,OAAO,CAAC;SACtB,CAAC,CAAC;QAjBM,YAAO,GAAP,OAAO,CAAgB;QAMvB,UAAK,GAAL,KAAK,CAAmB;IAYnC,CAAC;CACF;AArBD,0DAqBC;AAED,SAAS,SAAS,CAAC,OAAuB;IACxC,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,4CAAkB,CAAC,YAAY;YAClC,OAAO;gBACL,mBAAmB,EAAE,OAAO,CAAC,IAAI;gBACjC,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC,CAAC;QACJ,KAAK,4CAAkB,CAAC,WAAW;YACjC,OAAO;gBACL,YAAY,EAAE,OAAO,CAAC,MAAM;gBAC5B,aAAa,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;gBACnC,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK;gBACnC,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;gBACnD,WAAW,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC;aACxD,CAAC;QACJ,KAAK,4CAAkB,CAAC,sBAAsB;YAC5C,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAC9C,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,OAAO,CAAC;YAClC,MAAM,IAAI,SAAS,CAAC,0BAA0B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;AACH,CAAC;AAUD,SAAgB,eAAe,CAC7B,OAAuB,EACvB,KAAwB;IAExB,MAAM,OAAO,GACX,KAAK,KAAK,SAAS;QACjB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,EAAE,GAAG,CAAC;IAEpD,IAAI,OAAO,CAAC,IAAI,KAAK,4CAAkB,CAAC,YAAY,EAAE,CAAC;QACrD,OAAO,CACL,cAAc,OAAO,sCAAsC;YAC3D,IAAI,OAAO,CAAC,IAAI,MAAM,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,WAAW,EAAE,CAChE,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,IAAI,KAAK,4CAAkB,CAAC,sBAAsB,EAAE,CAAC;QAC/D,OAAO,CACL,cAAc,OAAO,gDAAgD;YACrE,0EAA0E;YAC1E,YAAY,OAAO,CAAC,WAAW,EAAE,CAClC,CAAC;IACJ,CAAC;IAED,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,0CAAuB,CAAC,cAAc;YACzC,OAAO,CACL,cAAc,OAAO,gDAAgD;gBACrE,2DAA2D;gBAC3D,2CAA2C,CAC5C,CAAC;QACJ,KAAK,0CAAuB,CAAC,kBAAkB;YAC7C,OAAO,CACL,cAAc,OAAO,kDAAkD;gBACvE,sEAAsE;gBACtE,0DAA0D,CAC3D,CAAC;QACJ,KAAK,0CAAuB,CAAC,cAAc;YACzC,OAAO,CACL,cAAc,OAAO,+CAA+C;gBACpE,6BAA6B,CAC9B,CAAC;QACJ,KAAK,0CAAuB,CAAC,gBAAgB;YAC3C,OAAO,CACL,cAAc,OAAO,8CAA8C;gBACnE,uEAAuE;gBACvE,2BAA2B,CAC5B,CAAC;QACJ,KAAK,0CAAuB,CAAC,iBAAiB;YAC5C,OAAO,CACL,cAAc,OAAO,gCAAgC;gBACrD,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,iBAAiB,OAAO;gBACvE,mCAAmC;gBACnC,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI,iBAAiB,IAAI;gBACtE,qEAAqE;gBACrE,qEAAqE;gBACrE,0CAA0C,CAC3C,CAAC;QACJ,KAAK,0CAAuB,CAAC,qBAAqB;YAChD,OAAO,CACL,cAAc,OAAO,iDAAiD;gBACtE,kEAAkE;gBAClE,yCAAyC,CAC1C,CAAC;QACJ,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,OAAO,CAAC,MAAM,CAAC;YACzC,MAAM,IAAI,SAAS,CAAC,2BAA2B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAAsB;IAC3C,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;AACnE,CAAC"}

package/dist/lib/license-warnings.d.ts

@@ -0,0 +1,28 @@
+import { LicenseVerificationFailureCode, type LicenseState } from '@xemahq/license-verifier';
+export declare enum LicenseWarningSeverity {
+    Info = "info",
+    Warning = "warning",
+    Critical = "critical"
+}
+export declare enum LicenseWarningCode {
+    ExpiringSoon = "license-expiring-soon",
+    InGracePeriod = "license-in-grace-period",
+    Restricted = "license-restricted",
+    Suspended = "license-suspended",
+    Revoked = "license-revoked",
+    NotYetValid = "license-not-yet-valid",
+    ClockRollback = "license-clock-rollback",
+    Unverifiable = "license-unverifiable",
+    DistributionNotEntitled = "license-distribution-not-entitled",
+    DistributionUndeclared = "license-distribution-undeclared"
+}
+export interface LicenseWarning {
+    readonly code: LicenseWarningCode;
+    readonly severity: LicenseWarningSeverity;
+    readonly message: string;
+}
+export declare const LICENSE_EXPIRY_NOTICE_WINDOW_MS: number;
+export declare const LICENSE_CRITICAL_WINDOW_MS: number;
+export declare function licenseStateWarnings(state: LicenseState): LicenseWarning[];
+export declare function platformLicenseRemediation(code: LicenseVerificationFailureCode): string;
+//# sourceMappingURL=license-warnings.d.ts.map

package/dist/lib/license-warnings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"license-warnings.d.ts","sourceRoot":"","sources":["../../src/lib/license-warnings.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,8BAA8B,EAC9B,KAAK,YAAY,EAClB,MAAM,0BAA0B,CAAC;AAalC,oBAAY,sBAAsB;IAChC,IAAI,SAAS;IACb,OAAO,YAAY;IACnB,QAAQ,aAAa;CACtB;AAGD,oBAAY,kBAAkB;IAE5B,YAAY,0BAA0B;IAEtC,aAAa,4BAA4B;IAEzC,UAAU,uBAAuB;IAEjC,SAAS,sBAAsB;IAE/B,OAAO,oBAAoB;IAE3B,WAAW,0BAA0B;IAErC,aAAa,2BAA2B;IAExC,YAAY,yBAAyB;IAErC,uBAAuB,sCAAsC;IAM7D,sBAAsB,oCAAoC;CAC3D;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC;IAE1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AASD,eAAO,MAAM,+BAA+B,QAAkB,CAAC;AAO/D,eAAO,MAAM,0BAA0B,QAAiB,CAAC;AASzD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,YAAY,GAAG,cAAc,EAAE,CA+G1E;AAYD,wBAAgB,0BAA0B,CACxC,IAAI,EAAE,8BAA8B,GACnC,MAAM,CAgDR"}

package/dist/lib/license-warnings.js

@@ -0,0 +1,173 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LICENSE_CRITICAL_WINDOW_MS = exports.LICENSE_EXPIRY_NOTICE_WINDOW_MS = exports.LicenseWarningCode = exports.LicenseWarningSeverity = void 0;
+exports.licenseStateWarnings = licenseStateWarnings;
+exports.platformLicenseRemediation = platformLicenseRemediation;
+const license_verifier_1 = require("@xemahq/license-verifier");
+var LicenseWarningSeverity;
+(function (LicenseWarningSeverity) {
+    LicenseWarningSeverity["Info"] = "info";
+    LicenseWarningSeverity["Warning"] = "warning";
+    LicenseWarningSeverity["Critical"] = "critical";
+})(LicenseWarningSeverity || (exports.LicenseWarningSeverity = LicenseWarningSeverity = {}));
+var LicenseWarningCode;
+(function (LicenseWarningCode) {
+    LicenseWarningCode["ExpiringSoon"] = "license-expiring-soon";
+    LicenseWarningCode["InGracePeriod"] = "license-in-grace-period";
+    LicenseWarningCode["Restricted"] = "license-restricted";
+    LicenseWarningCode["Suspended"] = "license-suspended";
+    LicenseWarningCode["Revoked"] = "license-revoked";
+    LicenseWarningCode["NotYetValid"] = "license-not-yet-valid";
+    LicenseWarningCode["ClockRollback"] = "license-clock-rollback";
+    LicenseWarningCode["Unverifiable"] = "license-unverifiable";
+    LicenseWarningCode["DistributionNotEntitled"] = "license-distribution-not-entitled";
+    LicenseWarningCode["DistributionUndeclared"] = "license-distribution-undeclared";
+})(LicenseWarningCode || (exports.LicenseWarningCode = LicenseWarningCode = {}));
+const MS_PER_DAY = 24 * 60 * 60 * 1000;
+exports.LICENSE_EXPIRY_NOTICE_WINDOW_MS = 30 * MS_PER_DAY;
+exports.LICENSE_CRITICAL_WINDOW_MS = 7 * MS_PER_DAY;
+function licenseStateWarnings(state) {
+    const warnings = [];
+    if (state.clockRollbackDetected) {
+        warnings.push({
+            code: LicenseWarningCode.ClockRollback,
+            severity: LicenseWarningSeverity.Warning,
+            message: 'The system clock is behind the latest instant this installation has ' +
+                'observed. License dates are being evaluated against a clock that may ' +
+                'be wrong. Nothing has been denied because of it — check NTP.',
+        });
+    }
+    if (state.notYetValid) {
+        warnings.push({
+            code: LicenseWarningCode.NotYetValid,
+            severity: LicenseWarningSeverity.Critical,
+            message: 'The license is dated in the future and is not yet in force, so it ' +
+                'grants nothing. Either a renewal was applied early or this machine’s ' +
+                'clock is wrong.',
+        });
+        return warnings;
+    }
+    switch (state.status) {
+        case license_verifier_1.LicenseStatus.Active: {
+            if (state.expiresAtMs === null) {
+                return warnings;
+            }
+            const remaining = state.expiresAtMs - state.evaluatedAtMs;
+            if (remaining > exports.LICENSE_EXPIRY_NOTICE_WINDOW_MS) {
+                return warnings;
+            }
+            warnings.push({
+                code: LicenseWarningCode.ExpiringSoon,
+                severity: remaining <= exports.LICENSE_CRITICAL_WINDOW_MS
+                    ? LicenseWarningSeverity.Critical
+                    : LicenseWarningSeverity.Warning,
+                message: `The license expires in ${describeDuration(remaining)} ` +
+                    `(${formatInstant(state.expiresAtMs)}). Nothing is degraded yet: a ` +
+                    '30-day grace period follows expiry during which the platform stays ' +
+                    'fully functional.',
+            });
+            return warnings;
+        }
+        case license_verifier_1.LicenseStatus.Expired: {
+            if (state.stage === license_verifier_1.LicenseLifecycleStage.Grace) {
+                const remaining = state.graceEndsAtMs === null
+                    ? null
+                    : state.graceEndsAtMs - state.evaluatedAtMs;
+                warnings.push({
+                    code: LicenseWarningCode.InGracePeriod,
+                    severity: remaining !== null && remaining <= exports.LICENSE_CRITICAL_WINDOW_MS
+                        ? LicenseWarningSeverity.Critical
+                        : LicenseWarningSeverity.Warning,
+                    message: `The license expired on ${formatInstant(state.expiresAtMs)} and is ` +
+                        'in its grace period — the platform remains FULLY functional. ' +
+                        (remaining === null
+                            ? ''
+                            : `In ${describeDuration(remaining)} `) +
+                        'upgrades, new biome installs and new projects or organizations ' +
+                        'will be refused. Running workloads are never stopped.',
+                });
+                return warnings;
+            }
+            warnings.push({
+                code: LicenseWarningCode.Restricted,
+                severity: LicenseWarningSeverity.Critical,
+                message: `The license expired on ${formatInstant(state.expiresAtMs)} and its ` +
+                    `grace period ended on ${formatInstant(state.graceEndsAtMs)}. ` +
+                    'Upgrades, new biome installs and new projects or organizations are ' +
+                    'refused. Existing workloads keep running, no data is touched and no ' +
+                    'reads are blocked — apply a renewed license to restore them.',
+            });
+            return warnings;
+        }
+        case license_verifier_1.LicenseStatus.Suspended:
+            warnings.push({
+                code: LicenseWarningCode.Suspended,
+                severity: LicenseWarningSeverity.Critical,
+                message: 'The license is suspended. Upgrades, new biome installs and new ' +
+                    'projects or organizations are refused. Existing workloads keep ' +
+                    'running — contact Xema to lift the hold.',
+            });
+            return warnings;
+        case license_verifier_1.LicenseStatus.Revoked:
+            warnings.push({
+                code: LicenseWarningCode.Revoked,
+                severity: LicenseWarningSeverity.Critical,
+                message: 'The license has been revoked. It grants nothing, including the ' +
+                    'right to run what is already installed. Contact Xema.',
+            });
+            return warnings;
+        default: {
+            const exhaustive = state.status;
+            throw new TypeError(`unhandled license status ${String(exhaustive)}`);
+        }
+    }
+}
+function platformLicenseRemediation(code) {
+    switch (code) {
+        case license_verifier_1.LicenseVerificationFailureCode.TrustStoreEmpty:
+            return ('This BUILD carries no license verification keys — its license material ' +
+                'was never provisioned, so it can verify no license at all, including ' +
+                'the open-source one it ships with. This is a defect in the build, not ' +
+                'in the license: deploy a released image, or run the signing ceremony ' +
+                'documented in @xemahq/license-verifier before building one.');
+        case license_verifier_1.LicenseVerificationFailureCode.UnknownKeyId:
+            return ('The license was signed by a key this build does not trust — it was ' +
+                'issued after this image shipped, or it is not a Xema license. Upgrade ' +
+                'the platform image.');
+        case license_verifier_1.LicenseVerificationFailureCode.InvalidSignature:
+            return ('The license signature does not verify: the token was altered in ' +
+                'transit or in storage. Re-copy it verbatim into the deployment secret ' +
+                'that supplies XEMA_LICENSE.');
+        case license_verifier_1.LicenseVerificationFailureCode.MalformedToken:
+        case license_verifier_1.LicenseVerificationFailureCode.MalformedHeader:
+        case license_verifier_1.LicenseVerificationFailureCode.MalformedClaims:
+            return ('The value supplied as XEMA_LICENSE is not a well-formed Xema license. ' +
+                'Store the whole single-line token with no wrapping, quoting or ' +
+                'truncation — a base64-encoded Secret value must decode to exactly the ' +
+                'token.');
+        case license_verifier_1.LicenseVerificationFailureCode.UnsupportedClaimsVersion:
+            return ('The license uses a claim format newer than this build understands. ' +
+                'Upgrade the platform image.');
+        case license_verifier_1.LicenseVerificationFailureCode.IssuerMismatch:
+            return ('The license names an issuer that is not the Xema licensing authority, ' +
+                'so it is refused.');
+        default: {
+            const exhaustive = code;
+            throw new TypeError(`unhandled license verification failure ${String(exhaustive)}`);
+        }
+    }
+}
+function formatInstant(epochMs) {
+    return epochMs === null ? 'an unknown date' : new Date(epochMs).toISOString();
+}
+function describeDuration(ms) {
+    if (ms <= 0) {
+        return 'less than a day';
+    }
+    const days = Math.floor(ms / MS_PER_DAY);
+    if (days === 0) {
+        return 'less than a day';
+    }
+    return days === 1 ? '1 day' : `${days} days`;
+}
+//# sourceMappingURL=license-warnings.js.map

package/dist/lib/license-warnings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"license-warnings.js","sourceRoot":"","sources":["../../src/lib/license-warnings.ts"],"names":[],"mappings":";;;AAkFA,oDA+GC;AAYD,gEAkDC;AA/PD,+DAKkC;AAalC,IAAY,sBAIX;AAJD,WAAY,sBAAsB;IAChC,uCAAa,CAAA;IACb,6CAAmB,CAAA;IACnB,+CAAqB,CAAA;AACvB,CAAC,EAJW,sBAAsB,sCAAtB,sBAAsB,QAIjC;AAGD,IAAY,kBAyBX;AAzBD,WAAY,kBAAkB;IAE5B,4DAAsC,CAAA;IAEtC,+DAAyC,CAAA;IAEzC,uDAAiC,CAAA;IAEjC,qDAA+B,CAAA;IAE/B,iDAA2B,CAAA;IAE3B,2DAAqC,CAAA;IAErC,8DAAwC,CAAA;IAExC,2DAAqC,CAAA;IAErC,mFAA6D,CAAA;IAM7D,gFAA0D,CAAA;AAC5D,CAAC,EAzBW,kBAAkB,kCAAlB,kBAAkB,QAyB7B;AASD,MAAM,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAO1B,QAAA,+BAA+B,GAAG,EAAE,GAAG,UAAU,CAAC;AAOlD,QAAA,0BAA0B,GAAG,CAAC,GAAG,UAAU,CAAC;AASzD,SAAgB,oBAAoB,CAAC,KAAmB;IACtD,MAAM,QAAQ,GAAqB,EAAE,CAAC;IAEtC,IAAI,KAAK,CAAC,qBAAqB,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,kBAAkB,CAAC,aAAa;YACtC,QAAQ,EAAE,sBAAsB,CAAC,OAAO;YAIxC,OAAO,EACL,sEAAsE;gBACtE,uEAAuE;gBACvE,8DAA8D;SACjE,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,kBAAkB,CAAC,WAAW;YACpC,QAAQ,EAAE,sBAAsB,CAAC,QAAQ;YACzC,OAAO,EACL,oEAAoE;gBACpE,uEAAuE;gBACvE,iBAAiB;SACpB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;QACrB,KAAK,gCAAa,CAAC,MAAM,CAAC,CAAC,CAAC;YAC1B,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;gBAC/B,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC,aAAa,CAAC;YAC1D,IAAI,SAAS,GAAG,uCAA+B,EAAE,CAAC;gBAChD,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,kBAAkB,CAAC,YAAY;gBACrC,QAAQ,EACN,SAAS,IAAI,kCAA0B;oBACrC,CAAC,CAAC,sBAAsB,CAAC,QAAQ;oBACjC,CAAC,CAAC,sBAAsB,CAAC,OAAO;gBACpC,OAAO,EACL,0BAA0B,gBAAgB,CAAC,SAAS,CAAC,GAAG;oBACxD,IAAI,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,gCAAgC;oBACpE,qEAAqE;oBACrE,mBAAmB;aACtB,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,KAAK,gCAAa,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3B,IAAI,KAAK,CAAC,KAAK,KAAK,wCAAqB,CAAC,KAAK,EAAE,CAAC;gBAChD,MAAM,SAAS,GACb,KAAK,CAAC,aAAa,KAAK,IAAI;oBAC1B,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,KAAK,CAAC,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;gBAChD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,kBAAkB,CAAC,aAAa;oBACtC,QAAQ,EACN,SAAS,KAAK,IAAI,IAAI,SAAS,IAAI,kCAA0B;wBAC3D,CAAC,CAAC,sBAAsB,CAAC,QAAQ;wBACjC,CAAC,CAAC,sBAAsB,CAAC,OAAO;oBACpC,OAAO,EACL,0BAA0B,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,UAAU;wBACpE,+DAA+D;wBAC/D,CAAC,SAAS,KAAK,IAAI;4BACjB,CAAC,CAAC,EAAE;4BACJ,CAAC,CAAC,MAAM,gBAAgB,CAAC,SAAS,CAAC,GAAG,CAAC;wBACzC,iEAAiE;wBACjE,uDAAuD;iBAC1D,CAAC,CAAC;gBACH,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,kBAAkB,CAAC,UAAU;gBACnC,QAAQ,EAAE,sBAAsB,CAAC,QAAQ;gBACzC,OAAO,EACL,0BAA0B,aAAa,CAAC,KAAK,CAAC,WAAW,CAAC,WAAW;oBACrE,yBAAyB,aAAa,CAAC,KAAK,CAAC,aAAa,CAAC,IAAI;oBAC/D,qEAAqE;oBACrE,sEAAsE;oBACtE,8DAA8D;aACjE,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,KAAK,gCAAa,CAAC,SAAS;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,kBAAkB,CAAC,SAAS;gBAClC,QAAQ,EAAE,sBAAsB,CAAC,QAAQ;gBACzC,OAAO,EACL,iEAAiE;oBACjE,iEAAiE;oBACjE,0CAA0C;aAC7C,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,KAAK,gCAAa,CAAC,OAAO;YACxB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,kBAAkB,CAAC,OAAO;gBAChC,QAAQ,EAAE,sBAAsB,CAAC,QAAQ;gBACzC,OAAO,EACL,iEAAiE;oBACjE,uDAAuD;aAC1D,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QAClB,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,KAAK,CAAC,MAAM,CAAC;YACvC,MAAM,IAAI,SAAS,CAAC,4BAA4B,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;AACH,CAAC;AAYD,SAAgB,0BAA0B,CACxC,IAAoC;IAEpC,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,iDAA8B,CAAC,eAAe;YACjD,OAAO,CACL,yEAAyE;gBACzE,uEAAuE;gBACvE,wEAAwE;gBACxE,uEAAuE;gBACvE,6DAA6D,CAC9D,CAAC;QACJ,KAAK,iDAA8B,CAAC,YAAY;YAC9C,OAAO,CACL,qEAAqE;gBACrE,wEAAwE;gBACxE,qBAAqB,CACtB,CAAC;QACJ,KAAK,iDAA8B,CAAC,gBAAgB;YAClD,OAAO,CACL,kEAAkE;gBAClE,wEAAwE;gBACxE,6BAA6B,CAC9B,CAAC;QACJ,KAAK,iDAA8B,CAAC,cAAc,CAAC;QACnD,KAAK,iDAA8B,CAAC,eAAe,CAAC;QACpD,KAAK,iDAA8B,CAAC,eAAe;YACjD,OAAO,CACL,wEAAwE;gBACxE,iEAAiE;gBACjE,wEAAwE;gBACxE,QAAQ,CACT,CAAC;QACJ,KAAK,iDAA8B,CAAC,wBAAwB;YAC1D,OAAO,CACL,qEAAqE;gBACrE,6BAA6B,CAC9B,CAAC;QACJ,KAAK,iDAA8B,CAAC,cAAc;YAChD,OAAO,CACL,wEAAwE;gBACxE,mBAAmB,CACpB,CAAC;QACJ,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,IAAI,CAAC;YAC/B,MAAM,IAAI,SAAS,CACjB,0CAA0C,MAAM,CAAC,UAAU,CAAC,EAAE,CAC/D,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,OAAsB;IAC3C,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;AAChF,CAAC;AAMD,SAAS,gBAAgB,CAAC,EAAU;IAClC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACZ,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,UAAU,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC;AAC/C,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@xemahq/entitlement-client",
-  "version": "0.1.3",
-  "description": "NestJS client for the Xema edition/entitlement primitive. Resolves per-org entitlement, applies a client-side deployment ceiling, and fails closed to the community edition on any error.",
+  "version": "0.2.1",
+  "description": "NestJS enforcement point for Xema entitlement. Resolves the installation license offline via @xemahq/license-verifier, gates biome installation and the running edition against it, and projects it onto the platform Edition + feature-flag axis. Fails closed.",
   "license": "Apache-2.0",
   "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
   "homepage": "https://xema.dev",
@@ -24,7 +24,8 @@
     "@nestjs/common": ">=10",
     "@nestjs/core": ">=10",
     "reflect-metadata": ">=0.1.12",
-    "@xemahq/kernel-contracts": ">=0.57.0"
+    "@xemahq/kernel-contracts": ">=1.2.0",
+    "@xemahq/license-verifier": ">=0.1.0"
   },
   "peerDependenciesMeta": {
     "@nestjs/common": {
@@ -38,7 +39,7 @@
     }
   },
   "dependencies": {
-    "@xemahq/platform-common": "^0.5.0"
+    "@xemahq/platform-common": "^0.7.4"
   },
   "devDependencies": {
     "@nestjs/common": "11.1.13",
@@ -48,7 +49,8 @@
     "prettier": "3.6.2",
     "reflect-metadata": "0.2.2",
     "typescript": "5.9.3",
-    "@xemahq/kernel-contracts": "^0.57.0"
+    "@xemahq/license-verifier": "0.1.3",
+    "@xemahq/kernel-contracts": "^8.0.1"
   },
   "exports": {
     ".": {
@@ -65,6 +67,7 @@
     "clean": "rm -rf dist",
     "build": "tsc -p tsconfig.json",
     "format": "prettier --write \"src/**/*.ts\"",
-    "typecheck": "tsc -p tsconfig.json --noEmit"
+    "typecheck": "tsc -p tsconfig.typecheck.json",
+    "test": "node --experimental-transform-types --test \"src/lib/*.test.ts\""
   }
 }