MEMBERS-DUES-001F: pure member/account status projection + renewal affordance (source only)

[daliu]

Closes #437. Child of #114 (MEMBERS-DUES-001 — "Build server-authoritative annual membership checkout and renewal"), tracker item 6. Parent #114 stays open and owner-gated.

What this adds (source only, unused)

One pure, deterministic, non-throwing frozen-verdict reducer for item 6's "minimum member/account status projection and renewal UX" — the member-facing DISPLAY read-model acceptance line 66 requires member pricing and protected content to consume ("the server-derived active-membership projection rather than Auth provider or raw profile fields") — plus its exhaustive test and a SYSTEM_DESIGN §8.0h section. Imported by nothing (no index, route, Rules, callable, or worker) → zero runtime behavior; nothing here awaits the owner-gated deploy.

projectMemberAccountStatus(input, policy) takes the §8.0a authority record, the signed-in uid the projection is FOR, a caller-supplied reference instant asOfMs, and an owner-configured renewalWindowMs, and returns exactly one frozen verdict:

• { decision: 'projected', status, entitlement, renewalOffered, activeThroughMs } where status ∈ { active | expiring_soon | upcoming | expired | suspended | ended | pending | none }, entitlement ∈ { current_member | not_entitled | decision_pending } taken verbatim from §8.0a, renewalOffered ∈ { true | false }, and activeThroughMs is the term-end instant to display (or null);
• { decision: 'denied', reason } — malformed_input | malformed_policy (all change nothing).

It never throws and imports only node:util and ./membershipAuthority.

Why it composes §8.0a (the one source-only core that imports a sibling)

§8.0a deriveMembershipEntitlement is the authorization gate: it returns current_member / not_entitled / decision_pending, collapsing every reason (near-expiry, elapsed, refund-suspended, offboarded, not-yet-started, unlinked) into the same not_entitled, and applies no renewal-window threshold. A member's account page and the member-pricing surface need those reasons disaggregated into display states plus a renewal affordance; that disaggregation is the ONLY thing this adds. §8.17 / §8.18 / §8.19 each forward-declare it unbuilt ("no member/account status projection or renewal UX (item 6) … remain with #114").

This is a projection OF §8.0a, which it composes rather than re-implements — a deliberate, documented departure from the node:util-only norm. The safety property that matters is display never over-states authorization: composing the real authority makes that TRUE BY CONSTRUCTION and robust to any future change in §8.0a's window logic, and re-implements NONE of §8.0a's record validation (revision math, enum / time / opaque-id checks) — re-implementing it would be the salami failure mode this project forbids. The imported sibling is itself pure and node:util-only, so purity/determinism/no-I/O hold transitively.

Safety invariants (all test-locked)

1. Display never over-states authorization. projection.entitlement === deriveMembershipEntitlement(...).entitlement, verbatim, so a status reads as entitled (active/expiring_soon) iff §8.0a returns current_member; { upcoming, expired, suspended, ended, none } ⟹ not_entitled; pending ⟺ decision_pending. Proven by composing the REAL §8.0a over every fixture and a swept range of instants — including an approved, in-window term linked to a different uid → none (never active) and an in-window suspended term → suspended (never active).
2. Renewal offered only where a safe self-serve re-purchase is correct. renewalOffered ⟺ status ∈ { expiring_soon, expired }. NEVER for a suspended term (clawback — re-purchase could re-grant disputed access or double-charge), an ended term (owner re-admits), a pending decision, an already-renewed upcoming term, a comfortably-active term, or a non-member (none is a join).
3. Invents no policy. The "expiring soon" lead time is policy.renewalWindowMs (owner configuration — the sole source; the reducer only compares endsAtMs - asOfMs <= renewalWindowMs). No hardcoded window (per the MEMBERS-DUES-001 — Build server-authoritative annual membership checkout and renewal #114 owner-decision rule).
4. Clockless. Consumes asOfMs; constructs no Date. Same instant → same projection.
5. Confers/mints nothing. The verdict carries a display status, a boolean, the authoritative entitlement, and one term-end instant — no code, token, role, price, amount, account reference, PII, or command. A read-model; access stays gated by §8.0a at the access point.
6. Hostile-input-safe & non-throwing. input/policy read through a descriptor-based closed-object read (getters never invoked; proxy / revoked proxy / foreign prototype / array / symbol key / extra / missing → malformed); the record is validated by the composed §8.0a, whose throw on any malformed record is caught and mapped to malformed_input; never throws for any value in either argument position.

Tests

functions/membershipAccountStatusProjection.test.js (77 cases): the full 8-status decision matrix with the complete expected verdict; the consistency seam proving invariant 1 against the real §8.0a over every row and a swept fuzz of instants; invariant 2 (renewal ⟺ expiring_soon/expired, incl. a suspended/ended term never offering renewal at any instant); invariant 3 (window boundary inclusive; renewalWindowMs === 0 never yields expiring_soon; a window wider than the term is perpetually expiring_soon; the same instant with different windows moves only the active/expiring_soon line); window/term boundaries (asOfMs === startsAtMs in-window; asOfMs === endsAtMs → expired, never expiring_soon/active); malformed-input and malformed-policy batteries (proxy/revoked/array/foreign-proto/inherited/extra-enumerable-and-non-enumerable/missing/symbol/accessor-never-invoked/bad-version/bad-uid/bad-time, both argument positions) plus a malformed-record battery asserting the projection denies and the composed authority also rejects the same record (the seam is honest); hostile-input never-throws (input/policy/record positions incl. cyclic + trap-throwing proxy); determinism/immutability/frozen-singleton denials with post-call input mutation; a frozen-surface + no-code/token/role/price/PII vocabulary check; and comment-stripped source-boundary checks (require set locked to exactly { node:util, ./membershipAuthority }, membershipAuthority's own require set locked to { node:util } for transitive purity, header §8.0h/MEMBERS-DUES-001F, imported-by-nothing).

Local pre-flight: ESLint 8.56.0 exit 0; jest 77/77 pass (secrets unset).

Distinct from every sibling

• §8.0a deriveMembershipEntitlement (MEMBERS-IDENTITY-001A — Define provider-neutral membership authority and entitlement contract #208) is the authorization gate this composes; this adds no authority and only disaggregates the reason §8.0a collapses.
• §8.13 projectMemberDiscounts is a consumer of membership status at a content/pricing surface; this is the producer of the display projection such a surface reads, and grants no discount.
• §8.0g MEMBERS-DUES-001E (MEMBERS-DUES-001E — Token-refresh/revocation disposition for entitlement reconciliation (source-only) #427) is item 4's token-refresh/revocation disposition — a session-lifecycle decision, not a display read-model.
• §8.17/§8.18/§8.19 (MEMBERS-DUES-001B/C/D) reconcile verified payment / reversal / checkout into term commands; this issues no command and reconciles no payment.
• §8.0c membershipClaimReconciliation derives the desired claim value; this writes and reads no claim.

Out of scope (stays with gated parent #114)

The "renewal UX" wiring around this read-model, the actual member-pricing and protected-content enforcement that would consume it, the Auth-claim read/write, any token action, renewal Checkout creation, persistence, route, or UI, and the owner-configured renewalWindowMs value itself. This contract performs none of them; it only decides the display disposition and returns it.

Not a deploy proof

Source change, tests, merge, and Firebase deployment are separate states. Merging this deploys nothing and changes no live behavior.

[netlify]

✅ Deploy Preview for luminous-fox-7c393f ready!

Name	Link
🔨 Latest commit	dc0781b
🔍 Latest deploy log	https://app.netlify.com/projects/luminous-fox-7c393f/deploys/6a5fc5c7458e6b0008153d0d
😎 Deploy Preview	https://deploy-preview-438--luminous-fox-7c393f.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.