@ansh-ui/license 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ansh contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/index.cjs

@@ -0,0 +1,135 @@
+'use strict';
+
+var core = require('@ansh-ui/core');
+
+// src/index.ts
+var KEY_PREFIX = "aur_";
+var EDITION_CAPABILITIES = {
+  free: ["effect:core", "behaviour:core", "renderer:canvas2d"],
+  pro: [
+    "effect:core",
+    "effect:pro",
+    "behaviour:core",
+    "behaviour:pro",
+    "renderer:canvas2d",
+    "renderer:webgl"
+  ],
+  enterprise: [
+    "effect:core",
+    "effect:pro",
+    "effect:enterprise",
+    "behaviour:core",
+    "behaviour:pro",
+    "renderer:canvas2d",
+    "renderer:webgl",
+    "renderer:webgpu",
+    "worker"
+  ]
+};
+var activeEdition = "free";
+var activePayload = null;
+async function verifyLicense(key) {
+  const trimmed = key.trim();
+  if (!trimmed.startsWith(KEY_PREFIX)) {
+    return fail(`Key does not start with "${KEY_PREFIX}". Check for a copy-paste error.`);
+  }
+  const body = trimmed.slice(KEY_PREFIX.length);
+  const separator = body.lastIndexOf(".");
+  if (separator <= 0) {
+    return fail("Key is missing its signature separator. It may be truncated.");
+  }
+  const payloadPart = body.slice(0, separator);
+  body.slice(separator + 1);
+  let payload;
+  let payloadBytes;
+  try {
+    payloadBytes = base64UrlDecode(payloadPart);
+    payload = JSON.parse(new TextDecoder().decode(payloadBytes));
+  } catch {
+    return fail("Key payload is not valid base64url-encoded JSON.");
+  }
+  {
+    return {
+      valid: false,
+      payload,
+      edition: "free",
+      reason: "License verification is unconfigured in this build of @ansh-ui/license. This is not a problem with your key. See https://ansh.dev/docs/licensing"
+    };
+  }
+}
+async function activateLicense(key) {
+  const result = await verifyLicense(key);
+  if (!result.valid) {
+    console.warn(`[ansh] Licence not activated: ${result.reason}`);
+    return result;
+  }
+  activeEdition = result.edition;
+  activePayload = result.payload;
+  const registry = core.getRegistry();
+  for (const capability of EDITION_CAPABILITIES[result.edition]) {
+    registry.provide(capability);
+  }
+  for (const grant of result.payload?.grants ?? []) {
+    registry.provide(grant);
+  }
+  return result;
+}
+function useFreeEdition() {
+  activeEdition = "free";
+  activePayload = null;
+  const registry = core.getRegistry();
+  for (const capability of EDITION_CAPABILITIES.free) registry.provide(capability);
+  const paid = [
+    .../* @__PURE__ */ new Set([...EDITION_CAPABILITIES.pro, ...EDITION_CAPABILITIES.enterprise])
+  ].filter((capability) => !EDITION_CAPABILITIES.free.includes(capability));
+  for (const capability of paid) {
+    registry.revoke(
+      capability,
+      "This component requires Ansh Pro. See https://ansh.dev/pro to compare editions."
+    );
+  }
+}
+function currentEdition() {
+  return activeEdition;
+}
+function currentLicense() {
+  return activePayload;
+}
+function hasCapability(capability) {
+  return core.getRegistry().supports(capability);
+}
+function base64UrlDecode(input) {
+  const normalised = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = normalised + "=".repeat((4 - normalised.length % 4) % 4);
+  if (typeof atob === "function") {
+    const binary = atob(padded);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+    return bytes;
+  }
+  return new Uint8Array(Buffer.from(padded, "base64"));
+}
+function fail(reason) {
+  return { valid: false, payload: null, edition: "free", reason };
+}
+function inspectLicense(key) {
+  try {
+    const body = key.trim().slice(KEY_PREFIX.length);
+    const separator = body.lastIndexOf(".");
+    if (separator <= 0) return null;
+    return JSON.parse(new TextDecoder().decode(base64UrlDecode(body.slice(0, separator))));
+  } catch {
+    return null;
+  }
+}
+
+exports.EDITION_CAPABILITIES = EDITION_CAPABILITIES;
+exports.activateLicense = activateLicense;
+exports.currentEdition = currentEdition;
+exports.currentLicense = currentLicense;
+exports.hasCapability = hasCapability;
+exports.inspectLicense = inspectLicense;
+exports.useFreeEdition = useFreeEdition;
+exports.verifyLicense = verifyLicense;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"names":["getRegistry"],"mappings":";;;;;AAiFA,IAAM,UAAA,GAAa,MAAA;AAGnB,IAAM,oBAAA,GAA2D;AAAA,EAC/D,IAAA,EAAM,CAAC,aAAA,EAAe,gBAAA,EAAkB,mBAAmB,CAAA;AAAA,EAC3D,GAAA,EAAK;AAAA,IACH,aAAA;AAAA,IACA,YAAA;AAAA,IACA,gBAAA;AAAA,IACA,eAAA;AAAA,IACA,mBAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,UAAA,EAAY;AAAA,IACV,aAAA;AAAA,IACA,YAAA;AAAA,IACA,mBAAA;AAAA,IACA,gBAAA;AAAA,IACA,eAAA;AAAA,IACA,mBAAA;AAAA,IACA,gBAAA;AAAA,IACA,iBAAA;AAAA,IACA;AAAA;AAEJ;AAEA,IAAI,aAAA,GAAyB,MAAA;AAC7B,IAAI,aAAA,GAAuC,IAAA;AAa3C,eAAsB,cAAc,GAAA,EAA0C;AAC5E,EAAA,MAAM,OAAA,GAAU,IAAI,IAAA,EAAK;AAEzB,EAAA,IAAI,CAAC,OAAA,CAAQ,UAAA,CAAW,UAAU,CAAA,EAAG;AACnC,IAAA,OAAO,IAAA,CAAK,CAAA,yBAAA,EAA4B,UAAU,CAAA,gCAAA,CAAkC,CAAA;AAAA,EACtF;AAEA,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,KAAA,CAAM,UAAA,CAAW,MAAM,CAAA;AAC5C,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AACtC,EAAA,IAAI,aAAa,CAAA,EAAG;AAClB,IAAA,OAAO,KAAK,8DAA8D,CAAA;AAAA,EAC5E;AAEA,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,SAAS,CAAA;AAC3C,EAAsB,IAAA,CAAK,KAAA,CAAM,SAAA,GAAY,CAAC;AAE9C,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,YAAA;AACJ,EAAA,IAAI;AACF,IAAA,YAAA,GAAe,gBAAgB,WAAW,CAAA;AAC1C,IAAA,OAAA,GAAU,KAAK,KAAA,CAAM,IAAI,aAAY,CAAE,MAAA,CAAO,YAAY,CAAC,CAAA;AAAA,EAC7D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAK,kDAAkD,CAAA;AAAA,EAChE;AAEA,EAAsE;AAGpE,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,OAAA;AAAA,MACA,OAAA,EAAS,MAAA;AAAA,MACT,MAAA,EACE;AAAA,KAEJ;AAAA,EACF;AAgCF;AAaA,eAAsB,gBAAgB,GAAA,EAA0C;AAC9E,EAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAc,GAAG,CAAA;AAEtC,EAAA,IAAI,CAAC,OAAO,KAAA,EAAO;AACjB,IAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,8BAAA,EAAiC,MAAA,CAAO,MAAM,CAAA,CAAE,CAAA;AAC7D,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,aAAA,GAAgB,MAAA,CAAO,OAAA;AACvB,EAAA,aAAA,GAAgB,MAAA,CAAO,OAAA;AAEvB,EAAA,MAAM,WAAWA,gBAAA,EAAY;AAC7B,EAAA,KAAA,MAAW,UAAA,IAAc,oBAAA,CAAqB,MAAA,CAAO,OAAO,CAAA,EAAG;AAC7D,IAAA,QAAA,CAAS,QAAQ,UAAU,CAAA;AAAA,EAC7B;AACA,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,OAAA,EAAS,MAAA,IAAU,EAAC,EAAG;AAChD,IAAA,QAAA,CAAS,QAAQ,KAAK,CAAA;AAAA,EACxB;AAEA,EAAA,OAAO,MAAA;AACT;AAQO,SAAS,cAAA,GAAuB;AACrC,EAAA,aAAA,GAAgB,MAAA;AAChB,EAAA,aAAA,GAAgB,IAAA;AAEhB,EAAA,MAAM,WAAWA,gBAAA,EAAY;AAC7B,EAAA,KAAA,MAAW,UAAA,IAAc,oBAAA,CAAqB,IAAA,EAAM,QAAA,CAAS,QAAQ,UAAU,CAAA;AAI/E,EAAA,MAAM,IAAA,GAAO;AAAA,IACX,mBAAG,IAAI,GAAA,CAAI,CAAC,GAAG,qBAAqB,GAAA,EAAK,GAAG,oBAAA,CAAqB,UAAU,CAAC;AAAA,GAC9E,CAAE,OAAO,CAAC,UAAA,KAAe,CAAC,oBAAA,CAAqB,IAAA,CAAK,QAAA,CAAS,UAAU,CAAC,CAAA;AAExE,EAAA,KAAA,MAAW,cAAc,IAAA,EAAM;AAC7B,IAAA,QAAA,CAAS,MAAA;AAAA,MACP,UAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACF;AAGO,SAAS,cAAA,GAA0B;AACxC,EAAA,OAAO,aAAA;AACT;AAGO,SAAS,cAAA,GAAwC;AACtD,EAAA,OAAO,aAAA;AACT;AAGO,SAAS,cAAc,UAAA,EAA6B;AACzD,EAAA,OAAOA,gBAAA,EAAY,CAAE,QAAA,CAAS,UAAU,CAAA;AAC1C;AAoCA,SAAS,gBAAgB,KAAA,EAA2B;AAClD,EAAA,MAAM,UAAA,GAAa,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,aAAa,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,UAAA,CAAW,MAAA,GAAS,KAAM,CAAC,CAAA;AAExE,EAAA,IAAI,OAAO,SAAS,UAAA,EAAY;AAC9B,IAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,IAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AAC1C,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,MAAA,EAAQ,CAAA,EAAA,EAAK,KAAA,CAAM,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AACtE,IAAA,OAAO,KAAA;AAAA,EACT;AAGA,EAAA,OAAO,IAAI,UAAA,CAAW,MAAA,CAAO,IAAA,CAAK,MAAA,EAAQ,QAAQ,CAAC,CAAA;AACrD;AAEA,SAAS,KAAK,MAAA,EAAoC;AAChD,EAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,SAAS,IAAA,EAAM,OAAA,EAAS,QAAQ,MAAA,EAAO;AAChE;AAQO,SAAS,eAAe,GAAA,EAAoC;AACjE,EAAA,IAAI;AACF,IAAA,MAAM,OAAO,GAAA,CAAI,IAAA,EAAK,CAAE,KAAA,CAAM,WAAW,MAAM,CAAA;AAC/C,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AACtC,IAAA,IAAI,SAAA,IAAa,GAAG,OAAO,IAAA;AAC3B,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,eAAA,CAAgB,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,SAAS,CAAC,CAAC,CAAC,CAAA;AAAA,EACvF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF","file":"index.cjs","sourcesContent":["import { getRegistry } from '@ansh-ui/core'\n\n/**\n * Edition gating and license key verification.\n *\n * ## What this is, honestly\n *\n * This is **not DRM, and it cannot be.** Any check that runs in a browser can be removed by editing\n * the bundle, and any check that runs at build time can be removed by patching the package. Nothing\n * shipped as JavaScript to a client is enforceable. Pretending otherwise would mean building\n * obfuscation and phone-home telemetry that hurts paying customers — slower builds, offline CI\n * failures, privacy concerns — while stopping nobody who was determined.\n *\n * So the design goal is different: **make it easy and obvious to be correctly licensed.** Concretely:\n *\n *  - A signed key proves an entitlement without any network call, so CI works offline and no usage\n *    data leaves the customer's machine.\n *  - Pro components live behind a capability check that produces a clear, linkable error instead of\n *    a mysteriously blank canvas.\n *  - In development, an unlicensed Pro component renders a visible watermark and logs once. In\n *    production it throws at mount. Neither is a puzzle to diagnose.\n *  - Pro code lives in a separate entry point, so a Free-edition bundle never contains it. That is\n *    a genuine benefit for Free users — smaller bundles — rather than a restriction.\n *\n * Enforcement, where it matters, happens at the point of sale and in the license agreement. This\n * module's job is to keep honest customers out of trouble.\n *\n * ## Key format\n *\n * `aur_<base64url(payload)>.<base64url(signature)>`\n *\n * The payload is JSON, so a customer can inspect exactly what they were issued — expiry, seats,\n * edition — without a tool. The signature is Ed25519 over the payload bytes.\n */\n\nexport type Edition = 'free' | 'pro' | 'enterprise'\n\nexport interface LicensePayload {\n  /** Who the licence was issued to. Shown in diagnostics. */\n  licensee: string\n  edition: Edition\n  /** ISO 8601 issue date. */\n  issued: string\n  /**\n   * ISO 8601 expiry, or `null` for a perpetual licence.\n   *\n   * A perpetual licence for a version range is the honest model for a component library: the code a\n   * customer already installed keeps working forever, and the licence governs access to *new*\n   * versions. A licence that switches off working software is hostile.\n   */\n  expires: string | null\n  /** Number of developer seats. Informational — not enforced at runtime. */\n  seats?: number\n  /** Capabilities this key grants beyond the edition's defaults. */\n  grants?: string[]\n  /** Domains the licence covers. Informational. */\n  domains?: string[]\n}\n\nexport interface VerificationResult {\n  valid: boolean\n  payload: LicensePayload | null\n  edition: Edition\n  /** Human-readable explanation when `valid` is false. */\n  reason?: string\n  /** `true` when the signature verified but the licence has expired. */\n  expired?: boolean\n}\n\n/**\n * The Ansh public signing key, raw Ed25519 (32 bytes), base64url.\n *\n * Public by definition — it can only verify, never sign. Shipping it in the package is what makes\n * offline verification possible.\n *\n * This placeholder is the all-zero key, which verifies nothing. It is replaced at release time by\n * the real key; until then `verifyLicense` reports `unconfigured` rather than silently accepting or\n * rejecting everything, so an integration bug can't be mistaken for a licensing one.\n */\nconst PUBLIC_KEY_B64 = 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'\n\nconst KEY_PREFIX = 'aur_'\n\n/** Capabilities each edition grants. */\nconst EDITION_CAPABILITIES: Record<Edition, readonly string[]> = {\n  free: ['effect:core', 'behaviour:core', 'renderer:canvas2d'],\n  pro: [\n    'effect:core',\n    'effect:pro',\n    'behaviour:core',\n    'behaviour:pro',\n    'renderer:canvas2d',\n    'renderer:webgl',\n  ],\n  enterprise: [\n    'effect:core',\n    'effect:pro',\n    'effect:enterprise',\n    'behaviour:core',\n    'behaviour:pro',\n    'renderer:canvas2d',\n    'renderer:webgl',\n    'renderer:webgpu',\n    'worker',\n  ],\n}\n\nlet activeEdition: Edition = 'free'\nlet activePayload: LicensePayload | null = null\n\n/**\n * Verify a licence key.\n *\n * Async because Web Crypto is async. Call it once at application startup (or in a build plugin) and\n * `await` it — the result is cached in module state, so components check a boolean rather than\n * re-verifying.\n *\n * Never throws. A malformed key, an unsupported runtime and a genuinely invalid signature all\n * produce a `VerificationResult` with a `reason`, because a licence problem must not be able to\n * crash an application.\n */\nexport async function verifyLicense(key: string): Promise<VerificationResult> {\n  const trimmed = key.trim()\n\n  if (!trimmed.startsWith(KEY_PREFIX)) {\n    return fail(`Key does not start with \"${KEY_PREFIX}\". Check for a copy-paste error.`)\n  }\n\n  const body = trimmed.slice(KEY_PREFIX.length)\n  const separator = body.lastIndexOf('.')\n  if (separator <= 0) {\n    return fail('Key is missing its signature separator. It may be truncated.')\n  }\n\n  const payloadPart = body.slice(0, separator)\n  const signaturePart = body.slice(separator + 1)\n\n  let payload: LicensePayload\n  let payloadBytes: Uint8Array\n  try {\n    payloadBytes = base64UrlDecode(payloadPart)\n    payload = JSON.parse(new TextDecoder().decode(payloadBytes)) as LicensePayload\n  } catch {\n    return fail('Key payload is not valid base64url-encoded JSON.')\n  }\n\n  if (PUBLIC_KEY_B64 === 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA') {\n    // Distinguish \"we haven't shipped a signing key yet\" from \"your key is bad\". Conflating the two\n    // would send customers to support for a problem that is entirely ours.\n    return {\n      valid: false,\n      payload,\n      edition: 'free',\n      reason:\n        'License verification is unconfigured in this build of @ansh-ui/license. ' +\n        'This is not a problem with your key. See https://ansh.dev/docs/licensing',\n    }\n  }\n\n  let signatureValid: boolean\n  try {\n    signatureValid = await verifySignature(payloadBytes, base64UrlDecode(signaturePart))\n  } catch (error) {\n    return fail(\n      `Signature verification is unavailable in this runtime ` +\n        `(${error instanceof Error ? error.message : 'unknown error'}). ` +\n        `Ed25519 via Web Crypto requires Node 18.4+, Chrome 137+, Firefox 129+ or Safari 17+. ` +\n        `Verify at build time instead if you must support older runtimes.`,\n    )\n  }\n\n  if (!signatureValid) {\n    return fail('Signature does not match. The key has been modified or is not genuine.')\n  }\n\n  const expired = payload.expires !== null && new Date(payload.expires).getTime() < Date.now()\n  if (expired) {\n    return {\n      valid: false,\n      payload,\n      edition: 'free',\n      expired: true,\n      reason:\n        `Licence expired on ${payload.expires}. ` +\n        `Previously-installed versions continue to work; renew to access newer releases.`,\n    }\n  }\n\n  return { valid: true, payload, edition: payload.edition }\n}\n\n/**\n * Activate a licence, granting its capabilities in the registry.\n *\n * This is the single call an application makes. After it resolves, Pro components mount normally\n * and `registry.requireCapability('effect:pro')` succeeds.\n *\n * ```ts\n * import { activateLicense } from '@ansh-ui/license'\n * await activateLicense(process.env.ANSH_LICENSE_KEY!)\n * ```\n */\nexport async function activateLicense(key: string): Promise<VerificationResult> {\n  const result = await verifyLicense(key)\n\n  if (!result.valid) {\n    console.warn(`[ansh] Licence not activated: ${result.reason}`)\n    return result\n  }\n\n  activeEdition = result.edition\n  activePayload = result.payload\n\n  const registry = getRegistry()\n  for (const capability of EDITION_CAPABILITIES[result.edition]) {\n    registry.provide(capability)\n  }\n  for (const grant of result.payload?.grants ?? []) {\n    registry.provide(grant)\n  }\n\n  return result\n}\n\n/**\n * Apply the Free edition explicitly.\n *\n * Called automatically the first time a capability is checked without activation, so Free works with\n * no setup at all. Exposed for tests and for resetting between app instances.\n */\nexport function useFreeEdition(): void {\n  activeEdition = 'free'\n  activePayload = null\n\n  const registry = getRegistry()\n  for (const capability of EDITION_CAPABILITIES.free) registry.provide(capability)\n\n  // Revoke paid capabilities with a message that says what to do, rather than leaving the generic\n  // \"missing capability\" error to speak for itself.\n  const paid = [\n    ...new Set([...EDITION_CAPABILITIES.pro, ...EDITION_CAPABILITIES.enterprise]),\n  ].filter((capability) => !EDITION_CAPABILITIES.free.includes(capability))\n\n  for (const capability of paid) {\n    registry.revoke(\n      capability,\n      'This component requires Ansh Pro. See https://ansh.dev/pro to compare editions.',\n    )\n  }\n}\n\n/** The currently active edition. */\nexport function currentEdition(): Edition {\n  return activeEdition\n}\n\n/** The active licence payload, or `null` on Free. */\nexport function currentLicense(): LicensePayload | null {\n  return activePayload\n}\n\n/** Is a capability available under the active edition? */\nexport function hasCapability(capability: string): boolean {\n  return getRegistry().supports(capability)\n}\n\n// ---------------------------------------------------------------------------\n// Crypto\n// ---------------------------------------------------------------------------\n\nlet cachedKey: CryptoKey | null = null\n\nasync function verifySignature(payload: Uint8Array, signature: Uint8Array): Promise<boolean> {\n  const subtle = globalThis.crypto?.subtle\n  if (!subtle) throw new Error('Web Crypto is unavailable')\n\n  if (!cachedKey) {\n    cachedKey = await subtle.importKey(\n      'raw',\n      base64UrlDecode(PUBLIC_KEY_B64) as unknown as ArrayBuffer,\n      { name: 'Ed25519' },\n      false,\n      ['verify'],\n    )\n  }\n\n  return subtle.verify(\n    { name: 'Ed25519' },\n    cachedKey,\n    signature as unknown as ArrayBuffer,\n    payload as unknown as ArrayBuffer,\n  )\n}\n\n/**\n * base64url → bytes.\n *\n * Hand-rolled rather than using `atob` because base64url uses `-`/`_` instead of `+`/`/` and omits\n * padding, and because `atob` does not exist in every Node context we might run in.\n */\nfunction base64UrlDecode(input: string): Uint8Array {\n  const normalised = input.replace(/-/g, '+').replace(/_/g, '/')\n  const padded = normalised + '='.repeat((4 - (normalised.length % 4)) % 4)\n\n  if (typeof atob === 'function') {\n    const binary = atob(padded)\n    const bytes = new Uint8Array(binary.length)\n    for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i)\n    return bytes\n  }\n\n  // Node without a global `atob` (very old versions, or a stripped runtime).\n  return new Uint8Array(Buffer.from(padded, 'base64'))\n}\n\nfunction fail(reason: string): VerificationResult {\n  return { valid: false, payload: null, edition: 'free', reason }\n}\n\n/**\n * Decode a key's payload **without verifying it**.\n *\n * For diagnostics only — printing \"your licence expires on X\" in a CLI, for instance. Never gate on\n * this: the payload is unauthenticated and trivially forged.\n */\nexport function inspectLicense(key: string): LicensePayload | null {\n  try {\n    const body = key.trim().slice(KEY_PREFIX.length)\n    const separator = body.lastIndexOf('.')\n    if (separator <= 0) return null\n    return JSON.parse(new TextDecoder().decode(base64UrlDecode(body.slice(0, separator))))\n  } catch {\n    return null\n  }\n}\n\nexport { EDITION_CAPABILITIES }\n"]}

package/dist/index.d.cts

@@ -0,0 +1,111 @@
+/**
+ * Edition gating and license key verification.
+ *
+ * ## What this is, honestly
+ *
+ * This is **not DRM, and it cannot be.** Any check that runs in a browser can be removed by editing
+ * the bundle, and any check that runs at build time can be removed by patching the package. Nothing
+ * shipped as JavaScript to a client is enforceable. Pretending otherwise would mean building
+ * obfuscation and phone-home telemetry that hurts paying customers — slower builds, offline CI
+ * failures, privacy concerns — while stopping nobody who was determined.
+ *
+ * So the design goal is different: **make it easy and obvious to be correctly licensed.** Concretely:
+ *
+ *  - A signed key proves an entitlement without any network call, so CI works offline and no usage
+ *    data leaves the customer's machine.
+ *  - Pro components live behind a capability check that produces a clear, linkable error instead of
+ *    a mysteriously blank canvas.
+ *  - In development, an unlicensed Pro component renders a visible watermark and logs once. In
+ *    production it throws at mount. Neither is a puzzle to diagnose.
+ *  - Pro code lives in a separate entry point, so a Free-edition bundle never contains it. That is
+ *    a genuine benefit for Free users — smaller bundles — rather than a restriction.
+ *
+ * Enforcement, where it matters, happens at the point of sale and in the license agreement. This
+ * module's job is to keep honest customers out of trouble.
+ *
+ * ## Key format
+ *
+ * `aur_<base64url(payload)>.<base64url(signature)>`
+ *
+ * The payload is JSON, so a customer can inspect exactly what they were issued — expiry, seats,
+ * edition — without a tool. The signature is Ed25519 over the payload bytes.
+ */
+type Edition = 'free' | 'pro' | 'enterprise';
+interface LicensePayload {
+    /** Who the licence was issued to. Shown in diagnostics. */
+    licensee: string;
+    edition: Edition;
+    /** ISO 8601 issue date. */
+    issued: string;
+    /**
+     * ISO 8601 expiry, or `null` for a perpetual licence.
+     *
+     * A perpetual licence for a version range is the honest model for a component library: the code a
+     * customer already installed keeps working forever, and the licence governs access to *new*
+     * versions. A licence that switches off working software is hostile.
+     */
+    expires: string | null;
+    /** Number of developer seats. Informational — not enforced at runtime. */
+    seats?: number;
+    /** Capabilities this key grants beyond the edition's defaults. */
+    grants?: string[];
+    /** Domains the licence covers. Informational. */
+    domains?: string[];
+}
+interface VerificationResult {
+    valid: boolean;
+    payload: LicensePayload | null;
+    edition: Edition;
+    /** Human-readable explanation when `valid` is false. */
+    reason?: string;
+    /** `true` when the signature verified but the licence has expired. */
+    expired?: boolean;
+}
+/** Capabilities each edition grants. */
+declare const EDITION_CAPABILITIES: Record<Edition, readonly string[]>;
+/**
+ * Verify a licence key.
+ *
+ * Async because Web Crypto is async. Call it once at application startup (or in a build plugin) and
+ * `await` it — the result is cached in module state, so components check a boolean rather than
+ * re-verifying.
+ *
+ * Never throws. A malformed key, an unsupported runtime and a genuinely invalid signature all
+ * produce a `VerificationResult` with a `reason`, because a licence problem must not be able to
+ * crash an application.
+ */
+declare function verifyLicense(key: string): Promise<VerificationResult>;
+/**
+ * Activate a licence, granting its capabilities in the registry.
+ *
+ * This is the single call an application makes. After it resolves, Pro components mount normally
+ * and `registry.requireCapability('effect:pro')` succeeds.
+ *
+ * ```ts
+ * import { activateLicense } from '@ansh-ui/license'
+ * await activateLicense(process.env.ANSH_LICENSE_KEY!)
+ * ```
+ */
+declare function activateLicense(key: string): Promise<VerificationResult>;
+/**
+ * Apply the Free edition explicitly.
+ *
+ * Called automatically the first time a capability is checked without activation, so Free works with
+ * no setup at all. Exposed for tests and for resetting between app instances.
+ */
+declare function useFreeEdition(): void;
+/** The currently active edition. */
+declare function currentEdition(): Edition;
+/** The active licence payload, or `null` on Free. */
+declare function currentLicense(): LicensePayload | null;
+/** Is a capability available under the active edition? */
+declare function hasCapability(capability: string): boolean;
+/**
+ * Decode a key's payload **without verifying it**.
+ *
+ * For diagnostics only — printing "your licence expires on X" in a CLI, for instance. Never gate on
+ * this: the payload is unauthenticated and trivially forged.
+ */
+declare function inspectLicense(key: string): LicensePayload | null;
+
+export { EDITION_CAPABILITIES, type Edition, type LicensePayload, type VerificationResult, activateLicense, currentEdition, currentLicense, hasCapability, inspectLicense, useFreeEdition, verifyLicense };

package/dist/index.d.ts

@@ -0,0 +1,111 @@
+/**
+ * Edition gating and license key verification.
+ *
+ * ## What this is, honestly
+ *
+ * This is **not DRM, and it cannot be.** Any check that runs in a browser can be removed by editing
+ * the bundle, and any check that runs at build time can be removed by patching the package. Nothing
+ * shipped as JavaScript to a client is enforceable. Pretending otherwise would mean building
+ * obfuscation and phone-home telemetry that hurts paying customers — slower builds, offline CI
+ * failures, privacy concerns — while stopping nobody who was determined.
+ *
+ * So the design goal is different: **make it easy and obvious to be correctly licensed.** Concretely:
+ *
+ *  - A signed key proves an entitlement without any network call, so CI works offline and no usage
+ *    data leaves the customer's machine.
+ *  - Pro components live behind a capability check that produces a clear, linkable error instead of
+ *    a mysteriously blank canvas.
+ *  - In development, an unlicensed Pro component renders a visible watermark and logs once. In
+ *    production it throws at mount. Neither is a puzzle to diagnose.
+ *  - Pro code lives in a separate entry point, so a Free-edition bundle never contains it. That is
+ *    a genuine benefit for Free users — smaller bundles — rather than a restriction.
+ *
+ * Enforcement, where it matters, happens at the point of sale and in the license agreement. This
+ * module's job is to keep honest customers out of trouble.
+ *
+ * ## Key format
+ *
+ * `aur_<base64url(payload)>.<base64url(signature)>`
+ *
+ * The payload is JSON, so a customer can inspect exactly what they were issued — expiry, seats,
+ * edition — without a tool. The signature is Ed25519 over the payload bytes.
+ */
+type Edition = 'free' | 'pro' | 'enterprise';
+interface LicensePayload {
+    /** Who the licence was issued to. Shown in diagnostics. */
+    licensee: string;
+    edition: Edition;
+    /** ISO 8601 issue date. */
+    issued: string;
+    /**
+     * ISO 8601 expiry, or `null` for a perpetual licence.
+     *
+     * A perpetual licence for a version range is the honest model for a component library: the code a
+     * customer already installed keeps working forever, and the licence governs access to *new*
+     * versions. A licence that switches off working software is hostile.
+     */
+    expires: string | null;
+    /** Number of developer seats. Informational — not enforced at runtime. */
+    seats?: number;
+    /** Capabilities this key grants beyond the edition's defaults. */
+    grants?: string[];
+    /** Domains the licence covers. Informational. */
+    domains?: string[];
+}
+interface VerificationResult {
+    valid: boolean;
+    payload: LicensePayload | null;
+    edition: Edition;
+    /** Human-readable explanation when `valid` is false. */
+    reason?: string;
+    /** `true` when the signature verified but the licence has expired. */
+    expired?: boolean;
+}
+/** Capabilities each edition grants. */
+declare const EDITION_CAPABILITIES: Record<Edition, readonly string[]>;
+/**
+ * Verify a licence key.
+ *
+ * Async because Web Crypto is async. Call it once at application startup (or in a build plugin) and
+ * `await` it — the result is cached in module state, so components check a boolean rather than
+ * re-verifying.
+ *
+ * Never throws. A malformed key, an unsupported runtime and a genuinely invalid signature all
+ * produce a `VerificationResult` with a `reason`, because a licence problem must not be able to
+ * crash an application.
+ */
+declare function verifyLicense(key: string): Promise<VerificationResult>;
+/**
+ * Activate a licence, granting its capabilities in the registry.
+ *
+ * This is the single call an application makes. After it resolves, Pro components mount normally
+ * and `registry.requireCapability('effect:pro')` succeeds.
+ *
+ * ```ts
+ * import { activateLicense } from '@ansh-ui/license'
+ * await activateLicense(process.env.ANSH_LICENSE_KEY!)
+ * ```
+ */
+declare function activateLicense(key: string): Promise<VerificationResult>;
+/**
+ * Apply the Free edition explicitly.
+ *
+ * Called automatically the first time a capability is checked without activation, so Free works with
+ * no setup at all. Exposed for tests and for resetting between app instances.
+ */
+declare function useFreeEdition(): void;
+/** The currently active edition. */
+declare function currentEdition(): Edition;
+/** The active licence payload, or `null` on Free. */
+declare function currentLicense(): LicensePayload | null;
+/** Is a capability available under the active edition? */
+declare function hasCapability(capability: string): boolean;
+/**
+ * Decode a key's payload **without verifying it**.
+ *
+ * For diagnostics only — printing "your licence expires on X" in a CLI, for instance. Never gate on
+ * this: the payload is unauthenticated and trivially forged.
+ */
+declare function inspectLicense(key: string): LicensePayload | null;
+
+export { EDITION_CAPABILITIES, type Edition, type LicensePayload, type VerificationResult, activateLicense, currentEdition, currentLicense, hasCapability, inspectLicense, useFreeEdition, verifyLicense };

package/dist/index.js

@@ -0,0 +1,126 @@
+import { getRegistry } from '@ansh-ui/core';
+
+// src/index.ts
+var KEY_PREFIX = "aur_";
+var EDITION_CAPABILITIES = {
+  free: ["effect:core", "behaviour:core", "renderer:canvas2d"],
+  pro: [
+    "effect:core",
+    "effect:pro",
+    "behaviour:core",
+    "behaviour:pro",
+    "renderer:canvas2d",
+    "renderer:webgl"
+  ],
+  enterprise: [
+    "effect:core",
+    "effect:pro",
+    "effect:enterprise",
+    "behaviour:core",
+    "behaviour:pro",
+    "renderer:canvas2d",
+    "renderer:webgl",
+    "renderer:webgpu",
+    "worker"
+  ]
+};
+var activeEdition = "free";
+var activePayload = null;
+async function verifyLicense(key) {
+  const trimmed = key.trim();
+  if (!trimmed.startsWith(KEY_PREFIX)) {
+    return fail(`Key does not start with "${KEY_PREFIX}". Check for a copy-paste error.`);
+  }
+  const body = trimmed.slice(KEY_PREFIX.length);
+  const separator = body.lastIndexOf(".");
+  if (separator <= 0) {
+    return fail("Key is missing its signature separator. It may be truncated.");
+  }
+  const payloadPart = body.slice(0, separator);
+  body.slice(separator + 1);
+  let payload;
+  let payloadBytes;
+  try {
+    payloadBytes = base64UrlDecode(payloadPart);
+    payload = JSON.parse(new TextDecoder().decode(payloadBytes));
+  } catch {
+    return fail("Key payload is not valid base64url-encoded JSON.");
+  }
+  {
+    return {
+      valid: false,
+      payload,
+      edition: "free",
+      reason: "License verification is unconfigured in this build of @ansh-ui/license. This is not a problem with your key. See https://ansh.dev/docs/licensing"
+    };
+  }
+}
+async function activateLicense(key) {
+  const result = await verifyLicense(key);
+  if (!result.valid) {
+    console.warn(`[ansh] Licence not activated: ${result.reason}`);
+    return result;
+  }
+  activeEdition = result.edition;
+  activePayload = result.payload;
+  const registry = getRegistry();
+  for (const capability of EDITION_CAPABILITIES[result.edition]) {
+    registry.provide(capability);
+  }
+  for (const grant of result.payload?.grants ?? []) {
+    registry.provide(grant);
+  }
+  return result;
+}
+function useFreeEdition() {
+  activeEdition = "free";
+  activePayload = null;
+  const registry = getRegistry();
+  for (const capability of EDITION_CAPABILITIES.free) registry.provide(capability);
+  const paid = [
+    .../* @__PURE__ */ new Set([...EDITION_CAPABILITIES.pro, ...EDITION_CAPABILITIES.enterprise])
+  ].filter((capability) => !EDITION_CAPABILITIES.free.includes(capability));
+  for (const capability of paid) {
+    registry.revoke(
+      capability,
+      "This component requires Ansh Pro. See https://ansh.dev/pro to compare editions."
+    );
+  }
+}
+function currentEdition() {
+  return activeEdition;
+}
+function currentLicense() {
+  return activePayload;
+}
+function hasCapability(capability) {
+  return getRegistry().supports(capability);
+}
+function base64UrlDecode(input) {
+  const normalised = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = normalised + "=".repeat((4 - normalised.length % 4) % 4);
+  if (typeof atob === "function") {
+    const binary = atob(padded);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+    return bytes;
+  }
+  return new Uint8Array(Buffer.from(padded, "base64"));
+}
+function fail(reason) {
+  return { valid: false, payload: null, edition: "free", reason };
+}
+function inspectLicense(key) {
+  try {
+    const body = key.trim().slice(KEY_PREFIX.length);
+    const separator = body.lastIndexOf(".");
+    if (separator <= 0) return null;
+    return JSON.parse(new TextDecoder().decode(base64UrlDecode(body.slice(0, separator))));
+  } catch {
+    return null;
+  }
+}
+
+export { EDITION_CAPABILITIES, activateLicense, currentEdition, currentLicense, hasCapability, inspectLicense, useFreeEdition, verifyLicense };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;AAiFA,IAAM,UAAA,GAAa,MAAA;AAGnB,IAAM,oBAAA,GAA2D;AAAA,EAC/D,IAAA,EAAM,CAAC,aAAA,EAAe,gBAAA,EAAkB,mBAAmB,CAAA;AAAA,EAC3D,GAAA,EAAK;AAAA,IACH,aAAA;AAAA,IACA,YAAA;AAAA,IACA,gBAAA;AAAA,IACA,eAAA;AAAA,IACA,mBAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,UAAA,EAAY;AAAA,IACV,aAAA;AAAA,IACA,YAAA;AAAA,IACA,mBAAA;AAAA,IACA,gBAAA;AAAA,IACA,eAAA;AAAA,IACA,mBAAA;AAAA,IACA,gBAAA;AAAA,IACA,iBAAA;AAAA,IACA;AAAA;AAEJ;AAEA,IAAI,aAAA,GAAyB,MAAA;AAC7B,IAAI,aAAA,GAAuC,IAAA;AAa3C,eAAsB,cAAc,GAAA,EAA0C;AAC5E,EAAA,MAAM,OAAA,GAAU,IAAI,IAAA,EAAK;AAEzB,EAAA,IAAI,CAAC,OAAA,CAAQ,UAAA,CAAW,UAAU,CAAA,EAAG;AACnC,IAAA,OAAO,IAAA,CAAK,CAAA,yBAAA,EAA4B,UAAU,CAAA,gCAAA,CAAkC,CAAA;AAAA,EACtF;AAEA,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,KAAA,CAAM,UAAA,CAAW,MAAM,CAAA;AAC5C,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AACtC,EAAA,IAAI,aAAa,CAAA,EAAG;AAClB,IAAA,OAAO,KAAK,8DAA8D,CAAA;AAAA,EAC5E;AAEA,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,SAAS,CAAA;AAC3C,EAAsB,IAAA,CAAK,KAAA,CAAM,SAAA,GAAY,CAAC;AAE9C,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,YAAA;AACJ,EAAA,IAAI;AACF,IAAA,YAAA,GAAe,gBAAgB,WAAW,CAAA;AAC1C,IAAA,OAAA,GAAU,KAAK,KAAA,CAAM,IAAI,aAAY,CAAE,MAAA,CAAO,YAAY,CAAC,CAAA;AAAA,EAC7D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAK,kDAAkD,CAAA;AAAA,EAChE;AAEA,EAAsE;AAGpE,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,OAAA;AAAA,MACA,OAAA,EAAS,MAAA;AAAA,MACT,MAAA,EACE;AAAA,KAEJ;AAAA,EACF;AAgCF;AAaA,eAAsB,gBAAgB,GAAA,EAA0C;AAC9E,EAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAc,GAAG,CAAA;AAEtC,EAAA,IAAI,CAAC,OAAO,KAAA,EAAO;AACjB,IAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,8BAAA,EAAiC,MAAA,CAAO,MAAM,CAAA,CAAE,CAAA;AAC7D,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,aAAA,GAAgB,MAAA,CAAO,OAAA;AACvB,EAAA,aAAA,GAAgB,MAAA,CAAO,OAAA;AAEvB,EAAA,MAAM,WAAW,WAAA,EAAY;AAC7B,EAAA,KAAA,MAAW,UAAA,IAAc,oBAAA,CAAqB,MAAA,CAAO,OAAO,CAAA,EAAG;AAC7D,IAAA,QAAA,CAAS,QAAQ,UAAU,CAAA;AAAA,EAC7B;AACA,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,OAAA,EAAS,MAAA,IAAU,EAAC,EAAG;AAChD,IAAA,QAAA,CAAS,QAAQ,KAAK,CAAA;AAAA,EACxB;AAEA,EAAA,OAAO,MAAA;AACT;AAQO,SAAS,cAAA,GAAuB;AACrC,EAAA,aAAA,GAAgB,MAAA;AAChB,EAAA,aAAA,GAAgB,IAAA;AAEhB,EAAA,MAAM,WAAW,WAAA,EAAY;AAC7B,EAAA,KAAA,MAAW,UAAA,IAAc,oBAAA,CAAqB,IAAA,EAAM,QAAA,CAAS,QAAQ,UAAU,CAAA;AAI/E,EAAA,MAAM,IAAA,GAAO;AAAA,IACX,mBAAG,IAAI,GAAA,CAAI,CAAC,GAAG,qBAAqB,GAAA,EAAK,GAAG,oBAAA,CAAqB,UAAU,CAAC;AAAA,GAC9E,CAAE,OAAO,CAAC,UAAA,KAAe,CAAC,oBAAA,CAAqB,IAAA,CAAK,QAAA,CAAS,UAAU,CAAC,CAAA;AAExE,EAAA,KAAA,MAAW,cAAc,IAAA,EAAM;AAC7B,IAAA,QAAA,CAAS,MAAA;AAAA,MACP,UAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACF;AAGO,SAAS,cAAA,GAA0B;AACxC,EAAA,OAAO,aAAA;AACT;AAGO,SAAS,cAAA,GAAwC;AACtD,EAAA,OAAO,aAAA;AACT;AAGO,SAAS,cAAc,UAAA,EAA6B;AACzD,EAAA,OAAO,WAAA,EAAY,CAAE,QAAA,CAAS,UAAU,CAAA;AAC1C;AAoCA,SAAS,gBAAgB,KAAA,EAA2B;AAClD,EAAA,MAAM,UAAA,GAAa,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,aAAa,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,UAAA,CAAW,MAAA,GAAS,KAAM,CAAC,CAAA;AAExE,EAAA,IAAI,OAAO,SAAS,UAAA,EAAY;AAC9B,IAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,IAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AAC1C,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,MAAA,EAAQ,CAAA,EAAA,EAAK,KAAA,CAAM,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AACtE,IAAA,OAAO,KAAA;AAAA,EACT;AAGA,EAAA,OAAO,IAAI,UAAA,CAAW,MAAA,CAAO,IAAA,CAAK,MAAA,EAAQ,QAAQ,CAAC,CAAA;AACrD;AAEA,SAAS,KAAK,MAAA,EAAoC;AAChD,EAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,SAAS,IAAA,EAAM,OAAA,EAAS,QAAQ,MAAA,EAAO;AAChE;AAQO,SAAS,eAAe,GAAA,EAAoC;AACjE,EAAA,IAAI;AACF,IAAA,MAAM,OAAO,GAAA,CAAI,IAAA,EAAK,CAAE,KAAA,CAAM,WAAW,MAAM,CAAA;AAC/C,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AACtC,IAAA,IAAI,SAAA,IAAa,GAAG,OAAO,IAAA;AAC3B,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,eAAA,CAAgB,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,SAAS,CAAC,CAAC,CAAC,CAAA;AAAA,EACvF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF","file":"index.js","sourcesContent":["import { getRegistry } from '@ansh-ui/core'\n\n/**\n * Edition gating and license key verification.\n *\n * ## What this is, honestly\n *\n * This is **not DRM, and it cannot be.** Any check that runs in a browser can be removed by editing\n * the bundle, and any check that runs at build time can be removed by patching the package. Nothing\n * shipped as JavaScript to a client is enforceable. Pretending otherwise would mean building\n * obfuscation and phone-home telemetry that hurts paying customers — slower builds, offline CI\n * failures, privacy concerns — while stopping nobody who was determined.\n *\n * So the design goal is different: **make it easy and obvious to be correctly licensed.** Concretely:\n *\n *  - A signed key proves an entitlement without any network call, so CI works offline and no usage\n *    data leaves the customer's machine.\n *  - Pro components live behind a capability check that produces a clear, linkable error instead of\n *    a mysteriously blank canvas.\n *  - In development, an unlicensed Pro component renders a visible watermark and logs once. In\n *    production it throws at mount. Neither is a puzzle to diagnose.\n *  - Pro code lives in a separate entry point, so a Free-edition bundle never contains it. That is\n *    a genuine benefit for Free users — smaller bundles — rather than a restriction.\n *\n * Enforcement, where it matters, happens at the point of sale and in the license agreement. This\n * module's job is to keep honest customers out of trouble.\n *\n * ## Key format\n *\n * `aur_<base64url(payload)>.<base64url(signature)>`\n *\n * The payload is JSON, so a customer can inspect exactly what they were issued — expiry, seats,\n * edition — without a tool. The signature is Ed25519 over the payload bytes.\n */\n\nexport type Edition = 'free' | 'pro' | 'enterprise'\n\nexport interface LicensePayload {\n  /** Who the licence was issued to. Shown in diagnostics. */\n  licensee: string\n  edition: Edition\n  /** ISO 8601 issue date. */\n  issued: string\n  /**\n   * ISO 8601 expiry, or `null` for a perpetual licence.\n   *\n   * A perpetual licence for a version range is the honest model for a component library: the code a\n   * customer already installed keeps working forever, and the licence governs access to *new*\n   * versions. A licence that switches off working software is hostile.\n   */\n  expires: string | null\n  /** Number of developer seats. Informational — not enforced at runtime. */\n  seats?: number\n  /** Capabilities this key grants beyond the edition's defaults. */\n  grants?: string[]\n  /** Domains the licence covers. Informational. */\n  domains?: string[]\n}\n\nexport interface VerificationResult {\n  valid: boolean\n  payload: LicensePayload | null\n  edition: Edition\n  /** Human-readable explanation when `valid` is false. */\n  reason?: string\n  /** `true` when the signature verified but the licence has expired. */\n  expired?: boolean\n}\n\n/**\n * The Ansh public signing key, raw Ed25519 (32 bytes), base64url.\n *\n * Public by definition — it can only verify, never sign. Shipping it in the package is what makes\n * offline verification possible.\n *\n * This placeholder is the all-zero key, which verifies nothing. It is replaced at release time by\n * the real key; until then `verifyLicense` reports `unconfigured` rather than silently accepting or\n * rejecting everything, so an integration bug can't be mistaken for a licensing one.\n */\nconst PUBLIC_KEY_B64 = 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'\n\nconst KEY_PREFIX = 'aur_'\n\n/** Capabilities each edition grants. */\nconst EDITION_CAPABILITIES: Record<Edition, readonly string[]> = {\n  free: ['effect:core', 'behaviour:core', 'renderer:canvas2d'],\n  pro: [\n    'effect:core',\n    'effect:pro',\n    'behaviour:core',\n    'behaviour:pro',\n    'renderer:canvas2d',\n    'renderer:webgl',\n  ],\n  enterprise: [\n    'effect:core',\n    'effect:pro',\n    'effect:enterprise',\n    'behaviour:core',\n    'behaviour:pro',\n    'renderer:canvas2d',\n    'renderer:webgl',\n    'renderer:webgpu',\n    'worker',\n  ],\n}\n\nlet activeEdition: Edition = 'free'\nlet activePayload: LicensePayload | null = null\n\n/**\n * Verify a licence key.\n *\n * Async because Web Crypto is async. Call it once at application startup (or in a build plugin) and\n * `await` it — the result is cached in module state, so components check a boolean rather than\n * re-verifying.\n *\n * Never throws. A malformed key, an unsupported runtime and a genuinely invalid signature all\n * produce a `VerificationResult` with a `reason`, because a licence problem must not be able to\n * crash an application.\n */\nexport async function verifyLicense(key: string): Promise<VerificationResult> {\n  const trimmed = key.trim()\n\n  if (!trimmed.startsWith(KEY_PREFIX)) {\n    return fail(`Key does not start with \"${KEY_PREFIX}\". Check for a copy-paste error.`)\n  }\n\n  const body = trimmed.slice(KEY_PREFIX.length)\n  const separator = body.lastIndexOf('.')\n  if (separator <= 0) {\n    return fail('Key is missing its signature separator. It may be truncated.')\n  }\n\n  const payloadPart = body.slice(0, separator)\n  const signaturePart = body.slice(separator + 1)\n\n  let payload: LicensePayload\n  let payloadBytes: Uint8Array\n  try {\n    payloadBytes = base64UrlDecode(payloadPart)\n    payload = JSON.parse(new TextDecoder().decode(payloadBytes)) as LicensePayload\n  } catch {\n    return fail('Key payload is not valid base64url-encoded JSON.')\n  }\n\n  if (PUBLIC_KEY_B64 === 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA') {\n    // Distinguish \"we haven't shipped a signing key yet\" from \"your key is bad\". Conflating the two\n    // would send customers to support for a problem that is entirely ours.\n    return {\n      valid: false,\n      payload,\n      edition: 'free',\n      reason:\n        'License verification is unconfigured in this build of @ansh-ui/license. ' +\n        'This is not a problem with your key. See https://ansh.dev/docs/licensing',\n    }\n  }\n\n  let signatureValid: boolean\n  try {\n    signatureValid = await verifySignature(payloadBytes, base64UrlDecode(signaturePart))\n  } catch (error) {\n    return fail(\n      `Signature verification is unavailable in this runtime ` +\n        `(${error instanceof Error ? error.message : 'unknown error'}). ` +\n        `Ed25519 via Web Crypto requires Node 18.4+, Chrome 137+, Firefox 129+ or Safari 17+. ` +\n        `Verify at build time instead if you must support older runtimes.`,\n    )\n  }\n\n  if (!signatureValid) {\n    return fail('Signature does not match. The key has been modified or is not genuine.')\n  }\n\n  const expired = payload.expires !== null && new Date(payload.expires).getTime() < Date.now()\n  if (expired) {\n    return {\n      valid: false,\n      payload,\n      edition: 'free',\n      expired: true,\n      reason:\n        `Licence expired on ${payload.expires}. ` +\n        `Previously-installed versions continue to work; renew to access newer releases.`,\n    }\n  }\n\n  return { valid: true, payload, edition: payload.edition }\n}\n\n/**\n * Activate a licence, granting its capabilities in the registry.\n *\n * This is the single call an application makes. After it resolves, Pro components mount normally\n * and `registry.requireCapability('effect:pro')` succeeds.\n *\n * ```ts\n * import { activateLicense } from '@ansh-ui/license'\n * await activateLicense(process.env.ANSH_LICENSE_KEY!)\n * ```\n */\nexport async function activateLicense(key: string): Promise<VerificationResult> {\n  const result = await verifyLicense(key)\n\n  if (!result.valid) {\n    console.warn(`[ansh] Licence not activated: ${result.reason}`)\n    return result\n  }\n\n  activeEdition = result.edition\n  activePayload = result.payload\n\n  const registry = getRegistry()\n  for (const capability of EDITION_CAPABILITIES[result.edition]) {\n    registry.provide(capability)\n  }\n  for (const grant of result.payload?.grants ?? []) {\n    registry.provide(grant)\n  }\n\n  return result\n}\n\n/**\n * Apply the Free edition explicitly.\n *\n * Called automatically the first time a capability is checked without activation, so Free works with\n * no setup at all. Exposed for tests and for resetting between app instances.\n */\nexport function useFreeEdition(): void {\n  activeEdition = 'free'\n  activePayload = null\n\n  const registry = getRegistry()\n  for (const capability of EDITION_CAPABILITIES.free) registry.provide(capability)\n\n  // Revoke paid capabilities with a message that says what to do, rather than leaving the generic\n  // \"missing capability\" error to speak for itself.\n  const paid = [\n    ...new Set([...EDITION_CAPABILITIES.pro, ...EDITION_CAPABILITIES.enterprise]),\n  ].filter((capability) => !EDITION_CAPABILITIES.free.includes(capability))\n\n  for (const capability of paid) {\n    registry.revoke(\n      capability,\n      'This component requires Ansh Pro. See https://ansh.dev/pro to compare editions.',\n    )\n  }\n}\n\n/** The currently active edition. */\nexport function currentEdition(): Edition {\n  return activeEdition\n}\n\n/** The active licence payload, or `null` on Free. */\nexport function currentLicense(): LicensePayload | null {\n  return activePayload\n}\n\n/** Is a capability available under the active edition? */\nexport function hasCapability(capability: string): boolean {\n  return getRegistry().supports(capability)\n}\n\n// ---------------------------------------------------------------------------\n// Crypto\n// ---------------------------------------------------------------------------\n\nlet cachedKey: CryptoKey | null = null\n\nasync function verifySignature(payload: Uint8Array, signature: Uint8Array): Promise<boolean> {\n  const subtle = globalThis.crypto?.subtle\n  if (!subtle) throw new Error('Web Crypto is unavailable')\n\n  if (!cachedKey) {\n    cachedKey = await subtle.importKey(\n      'raw',\n      base64UrlDecode(PUBLIC_KEY_B64) as unknown as ArrayBuffer,\n      { name: 'Ed25519' },\n      false,\n      ['verify'],\n    )\n  }\n\n  return subtle.verify(\n    { name: 'Ed25519' },\n    cachedKey,\n    signature as unknown as ArrayBuffer,\n    payload as unknown as ArrayBuffer,\n  )\n}\n\n/**\n * base64url → bytes.\n *\n * Hand-rolled rather than using `atob` because base64url uses `-`/`_` instead of `+`/`/` and omits\n * padding, and because `atob` does not exist in every Node context we might run in.\n */\nfunction base64UrlDecode(input: string): Uint8Array {\n  const normalised = input.replace(/-/g, '+').replace(/_/g, '/')\n  const padded = normalised + '='.repeat((4 - (normalised.length % 4)) % 4)\n\n  if (typeof atob === 'function') {\n    const binary = atob(padded)\n    const bytes = new Uint8Array(binary.length)\n    for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i)\n    return bytes\n  }\n\n  // Node without a global `atob` (very old versions, or a stripped runtime).\n  return new Uint8Array(Buffer.from(padded, 'base64'))\n}\n\nfunction fail(reason: string): VerificationResult {\n  return { valid: false, payload: null, edition: 'free', reason }\n}\n\n/**\n * Decode a key's payload **without verifying it**.\n *\n * For diagnostics only — printing \"your licence expires on X\" in a CLI, for instance. Never gate on\n * this: the payload is unauthenticated and trivially forged.\n */\nexport function inspectLicense(key: string): LicensePayload | null {\n  try {\n    const body = key.trim().slice(KEY_PREFIX.length)\n    const separator = body.lastIndexOf('.')\n    if (separator <= 0) return null\n    return JSON.parse(new TextDecoder().decode(base64UrlDecode(body.slice(0, separator))))\n  } catch {\n    return null\n  }\n}\n\nexport { EDITION_CAPABILITIES }\n"]}

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "@ansh-ui/license",
+  "version": "0.2.0",
+  "description": "Ansh edition gating and license key verification.",
+  "license": "MIT",
+  "type": "module",
+  "sideEffects": false,
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jithin003/ui-library.git",
+    "directory": "packages/license"
+  },
+  "files": [
+    "dist"
+  ],
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    },
+    "./package.json": "./package.json"
+  },
+  "dependencies": {
+    "@ansh-ui/core": "0.2.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  }
+}