Subscription license

import {
  Access,
  Billing,
  LicenseCredentialIssuance,
  Licensing,
  Offer,
  Purchase,
  activateLicenseCredential,
  createCheckout,
  issueLicenseCredential,
  processPaymentNotification,
  registerOffers,
  validateLicenseCredential,
} from "@byfungsi/sapa";

const desktopAccess =
  yield *
  Access.entitlements({
    entitlements: ["desktop.use"],
    duration: "purchased_period",
  });
const desktopLicense =
  yield *
  Licensing.eligibility({
    entitlement: "desktop.use",
    activationLimit: 3,
  });
const desktopPurchase =
  yield *
  Purchase.parse({
    key: "desktop.subscription-license",
    revision: 1,
    provides: [desktopAccess, desktopLicense],
  });
const desktopBilling =
  yield *
  Billing.subscription({
    family: "desktop",
    interval: "month",
    price: { currency: "IDR", amount: 149_000n },
  });
const desktopMonthly =
  yield *
  Offer.parse({
    key: "desktop.monthly",
    revision: 1,
    purchase: desktopPurchase,
    billing: desktopBilling,
  });

yield * registerOffers([desktopMonthly]);
yield *
  createCheckout({
    type: "offer",
    offerKey: desktopMonthly.key,
    offerRevision: desktopMonthly.revision,
    quantity: null,
    provider: "midtrans",
    customer,
    successUrl,
    cancelUrl,
    clientIp: null,
    idempotencyKey: "desktop-monthly-42",
  });
const settlement =
  yield *
  processPaymentNotification({
    provider: "midtrans",
    payload: rawProviderPayload,
  });

// Run the fulfillment worker, then issue explicitly from an authenticated route.
const issued =
  yield *
  issueLicenseCredential({
    idempotencyKey: "desktop-license-42",
    externalCustomerId: "customer-42",
    entitlement: "desktop.use",
  });
if (!LicenseCredentialIssuance.guards.issued(issued)) return;

const activationId = "lact-00000000-0000-4000-8000-000000000042";
yield * activateLicenseCredential({ key: issued.key, activationId });
const current =
  yield * validateLicenseCredential({ key: issued.key, activationId });

if (settlement.status === "settled" && settlement.subscriptionId !== null) {
  yield *
    createCheckout({
      type: "subscription_renewal",
      subscriptionId: settlement.subscriptionId,
      provider: "midtrans",
      customer,
      successUrl,
      cancelUrl,
      clientIp: null,
      idempotencyKey: "desktop-renewal-42-2026-10",
    });
}

The raw key exists only on the first issued result. Persist it on the customer device or deliver it through an appropriately protected channel; SAPA stores only a one-way hash. A retry returns already_issued without the key. Renewal extends entitlement validity without issuing a second credential. Validation fails closed when the subscription expires or its supporting payment is refunded.