@ansh-ui/license 0.2.0 → 0.3.0

package/dist/index.cjs

@@ -2,8 +2,118 @@
 
 var core = require('@ansh-ui/core');
 
-// src/index.ts
+// src/base64url.ts
+function base64UrlDecode(input) {
+  const normalised = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = normalised + "=".repeat((4 - normalised.length % 4) % 4);
+  if (typeof atob === "function") {
+    const binary = atob(padded);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+    return bytes;
+  }
+  return new Uint8Array(Buffer.from(padded, "base64"));
+}
+var PUBLIC_KEY_B64 = "ZnSy7P02L2gBSMrvugpEg0cuLMq1MIv2jMi6wnxgLZs" ;
 var KEY_PREFIX = "aur_";
+
+// src/verify.ts
+var LICENSING_URL = "https://ansh.techiesofepi.com";
+var EDITIONS = ["free", "pro", "enterprise"];
+function verifyLicense(key) {
+  return verifyLicenseWithPublicKey(key, PUBLIC_KEY_B64);
+}
+async function verifyLicenseWithPublicKey(key, publicKeyB64) {
+  const trimmed = key.trim();
+  if (!trimmed.startsWith(KEY_PREFIX)) {
+    return fail(`Key does not start with "${KEY_PREFIX}". Check for a copy-paste error.`);
+  }
+  const body = trimmed.slice(KEY_PREFIX.length);
+  const separator = body.lastIndexOf(".");
+  if (separator <= 0) {
+    return fail("Key is missing its signature separator. It may be truncated.");
+  }
+  const payloadPart = body.slice(0, separator);
+  const signaturePart = body.slice(separator + 1);
+  let payload;
+  let payloadBytes;
+  try {
+    payloadBytes = base64UrlDecode(payloadPart);
+    payload = JSON.parse(new TextDecoder().decode(payloadBytes));
+  } catch {
+    return fail("Key payload is not valid base64url-encoded JSON.");
+  }
+  let signatureValid;
+  try {
+    signatureValid = await verifySignature(
+      publicKeyB64,
+      payloadBytes,
+      base64UrlDecode(signaturePart)
+    );
+  } catch (error) {
+    return fail(
+      `Signature verification is unavailable in this runtime (${error instanceof Error ? error.message : "unknown error"}). Ed25519 via Web Crypto requires Node 18.4+, Chrome 137+, Firefox 129+ or Safari 17+. Verify at build time instead if you must support older runtimes.`
+    );
+  }
+  if (!signatureValid) {
+    return fail("Signature does not match. The key has been modified or is not genuine.");
+  }
+  if (!payload || typeof payload !== "object" || !EDITIONS.includes(payload.edition)) {
+    return fail("Key payload names an unknown edition. It may be from a newer release.");
+  }
+  if (payload.expires !== null) {
+    const expiresAt = new Date(payload.expires).getTime();
+    if (Number.isNaN(expiresAt)) {
+      return fail(`Key payload has an unreadable expiry date ("${String(payload.expires)}").`);
+    }
+    if (expiresAt < Date.now()) {
+      return {
+        valid: false,
+        payload,
+        edition: "free",
+        expired: true,
+        reason: `Licence expired on ${payload.expires}. Previously-installed versions continue to work; renew to access newer releases.`
+      };
+    }
+  }
+  return { valid: true, payload, edition: payload.edition };
+}
+function inspectLicense(key) {
+  try {
+    const body = key.trim().slice(KEY_PREFIX.length);
+    const separator = body.lastIndexOf(".");
+    if (separator <= 0) return null;
+    return JSON.parse(new TextDecoder().decode(base64UrlDecode(body.slice(0, separator))));
+  } catch {
+    return null;
+  }
+}
+var importedKeys = /* @__PURE__ */ new Map();
+async function verifySignature(publicKeyB64, payload, signature) {
+  const subtle = globalThis.crypto?.subtle;
+  if (!subtle) throw new Error("Web Crypto is unavailable");
+  let key = importedKeys.get(publicKeyB64);
+  if (!key) {
+    key = subtle.importKey(
+      "raw",
+      base64UrlDecode(publicKeyB64),
+      { name: "Ed25519" },
+      false,
+      ["verify"]
+    );
+    importedKeys.set(publicKeyB64, key);
+    key.catch(() => importedKeys.delete(publicKeyB64));
+  }
+  return subtle.verify(
+    { name: "Ed25519" },
+    await key,
+    signature,
+    payload
+  );
+}
+function fail(reason) {
+  return { valid: false, payload: null, edition: "free", reason };
+}
 var EDITION_CAPABILITIES = {
   free: ["effect:core", "behaviour:core", "renderer:canvas2d"],
   pro: [
@@ -28,37 +138,10 @@ var EDITION_CAPABILITIES = {
 };
 var activeEdition = "free";
 var activePayload = null;
-async function verifyLicense(key) {
-  const trimmed = key.trim();
-  if (!trimmed.startsWith(KEY_PREFIX)) {
-    return fail(`Key does not start with "${KEY_PREFIX}". Check for a copy-paste error.`);
-  }
-  const body = trimmed.slice(KEY_PREFIX.length);
-  const separator = body.lastIndexOf(".");
-  if (separator <= 0) {
-    return fail("Key is missing its signature separator. It may be truncated.");
-  }
-  const payloadPart = body.slice(0, separator);
-  body.slice(separator + 1);
-  let payload;
-  let payloadBytes;
-  try {
-    payloadBytes = base64UrlDecode(payloadPart);
-    payload = JSON.parse(new TextDecoder().decode(payloadBytes));
-  } catch {
-    return fail("Key payload is not valid base64url-encoded JSON.");
-  }
-  {
-    return {
-      valid: false,
-      payload,
-      edition: "free",
-      reason: "License verification is unconfigured in this build of @ansh-ui/license. This is not a problem with your key. See https://ansh.dev/docs/licensing"
-    };
-  }
-}
 async function activateLicense(key) {
-  const result = await verifyLicense(key);
+  return applyVerification(await verifyLicense(key));
+}
+function applyVerification(result) {
   if (!result.valid) {
     console.warn(`[ansh] Licence not activated: ${result.reason}`);
     return result;
@@ -85,7 +168,7 @@ function useFreeEdition() {
   for (const capability of paid) {
     registry.revoke(
       capability,
-      "This component requires Ansh Pro. See https://ansh.dev/pro to compare editions."
+      `This component requires Ansh Pro. See ${LICENSING_URL} to compare editions.`
     );
   }
 }
@@ -98,30 +181,6 @@ function currentLicense() {
 function hasCapability(capability) {
   return core.getRegistry().supports(capability);
 }
-function base64UrlDecode(input) {
-  const normalised = input.replace(/-/g, "+").replace(/_/g, "/");
-  const padded = normalised + "=".repeat((4 - normalised.length % 4) % 4);
-  if (typeof atob === "function") {
-    const binary = atob(padded);
-    const bytes = new Uint8Array(binary.length);
-    for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
-    return bytes;
-  }
-  return new Uint8Array(Buffer.from(padded, "base64"));
-}
-function fail(reason) {
-  return { valid: false, payload: null, edition: "free", reason };
-}
-function inspectLicense(key) {
-  try {
-    const body = key.trim().slice(KEY_PREFIX.length);
-    const separator = body.lastIndexOf(".");
-    if (separator <= 0) return null;
-    return JSON.parse(new TextDecoder().decode(base64UrlDecode(body.slice(0, separator))));
-  } catch {
-    return null;
-  }
-}
 
 exports.EDITION_CAPABILITIES = EDITION_CAPABILITIES;
 exports.activateLicense = activateLicense;

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":["getRegistry"],"mappings":";;;;;AAiFA,IAAM,UAAA,GAAa,MAAA;AAGnB,IAAM,oBAAA,GAA2D;AAAA,EAC/D,IAAA,EAAM,CAAC,aAAA,EAAe,gBAAA,EAAkB,mBAAmB,CAAA;AAAA,EAC3D,GAAA,EAAK;AAAA,IACH,aAAA;AAAA,IACA,YAAA;AAAA,IACA,gBAAA;AAAA,IACA,eAAA;AAAA,IACA,mBAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,UAAA,EAAY;AAAA,IACV,aAAA;AAAA,IACA,YAAA;AAAA,IACA,mBAAA;AAAA,IACA,gBAAA;AAAA,IACA,eAAA;AAAA,IACA,mBAAA;AAAA,IACA,gBAAA;AAAA,IACA,iBAAA;AAAA,IACA;AAAA;AAEJ;AAEA,IAAI,aAAA,GAAyB,MAAA;AAC7B,IAAI,aAAA,GAAuC,IAAA;AAa3C,eAAsB,cAAc,GAAA,EAA0C;AAC5E,EAAA,MAAM,OAAA,GAAU,IAAI,IAAA,EAAK;AAEzB,EAAA,IAAI,CAAC,OAAA,CAAQ,UAAA,CAAW,UAAU,CAAA,EAAG;AACnC,IAAA,OAAO,IAAA,CAAK,CAAA,yBAAA,EAA4B,UAAU,CAAA,gCAAA,CAAkC,CAAA;AAAA,EACtF;AAEA,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,KAAA,CAAM,UAAA,CAAW,MAAM,CAAA;AAC5C,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AACtC,EAAA,IAAI,aAAa,CAAA,EAAG;AAClB,IAAA,OAAO,KAAK,8DAA8D,CAAA;AAAA,EAC5E;AAEA,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,SAAS,CAAA;AAC3C,EAAsB,IAAA,CAAK,KAAA,CAAM,SAAA,GAAY,CAAC;AAE9C,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,YAAA;AACJ,EAAA,IAAI;AACF,IAAA,YAAA,GAAe,gBAAgB,WAAW,CAAA;AAC1C,IAAA,OAAA,GAAU,KAAK,KAAA,CAAM,IAAI,aAAY,CAAE,MAAA,CAAO,YAAY,CAAC,CAAA;AAAA,EAC7D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAK,kDAAkD,CAAA;AAAA,EAChE;AAEA,EAAsE;AAGpE,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,OAAA;AAAA,MACA,OAAA,EAAS,MAAA;AAAA,MACT,MAAA,EACE;AAAA,KAEJ;AAAA,EACF;AAgCF;AAaA,eAAsB,gBAAgB,GAAA,EAA0C;AAC9E,EAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAc,GAAG,CAAA;AAEtC,EAAA,IAAI,CAAC,OAAO,KAAA,EAAO;AACjB,IAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,8BAAA,EAAiC,MAAA,CAAO,MAAM,CAAA,CAAE,CAAA;AAC7D,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,aAAA,GAAgB,MAAA,CAAO,OAAA;AACvB,EAAA,aAAA,GAAgB,MAAA,CAAO,OAAA;AAEvB,EAAA,MAAM,WAAWA,gBAAA,EAAY;AAC7B,EAAA,KAAA,MAAW,UAAA,IAAc,oBAAA,CAAqB,MAAA,CAAO,OAAO,CAAA,EAAG;AAC7D,IAAA,QAAA,CAAS,QAAQ,UAAU,CAAA;AAAA,EAC7B;AACA,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,OAAA,EAAS,MAAA,IAAU,EAAC,EAAG;AAChD,IAAA,QAAA,CAAS,QAAQ,KAAK,CAAA;AAAA,EACxB;AAEA,EAAA,OAAO,MAAA;AACT;AAQO,SAAS,cAAA,GAAuB;AACrC,EAAA,aAAA,GAAgB,MAAA;AAChB,EAAA,aAAA,GAAgB,IAAA;AAEhB,EAAA,MAAM,WAAWA,gBAAA,EAAY;AAC7B,EAAA,KAAA,MAAW,UAAA,IAAc,oBAAA,CAAqB,IAAA,EAAM,QAAA,CAAS,QAAQ,UAAU,CAAA;AAI/E,EAAA,MAAM,IAAA,GAAO;AAAA,IACX,mBAAG,IAAI,GAAA,CAAI,CAAC,GAAG,qBAAqB,GAAA,EAAK,GAAG,oBAAA,CAAqB,UAAU,CAAC;AAAA,GAC9E,CAAE,OAAO,CAAC,UAAA,KAAe,CAAC,oBAAA,CAAqB,IAAA,CAAK,QAAA,CAAS,UAAU,CAAC,CAAA;AAExE,EAAA,KAAA,MAAW,cAAc,IAAA,EAAM;AAC7B,IAAA,QAAA,CAAS,MAAA;AAAA,MACP,UAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACF;AAGO,SAAS,cAAA,GAA0B;AACxC,EAAA,OAAO,aAAA;AACT;AAGO,SAAS,cAAA,GAAwC;AACtD,EAAA,OAAO,aAAA;AACT;AAGO,SAAS,cAAc,UAAA,EAA6B;AACzD,EAAA,OAAOA,gBAAA,EAAY,CAAE,QAAA,CAAS,UAAU,CAAA;AAC1C;AAoCA,SAAS,gBAAgB,KAAA,EAA2B;AAClD,EAAA,MAAM,UAAA,GAAa,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,aAAa,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,UAAA,CAAW,MAAA,GAAS,KAAM,CAAC,CAAA;AAExE,EAAA,IAAI,OAAO,SAAS,UAAA,EAAY;AAC9B,IAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,IAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AAC1C,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,MAAA,EAAQ,CAAA,EAAA,EAAK,KAAA,CAAM,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AACtE,IAAA,OAAO,KAAA;AAAA,EACT;AAGA,EAAA,OAAO,IAAI,UAAA,CAAW,MAAA,CAAO,IAAA,CAAK,MAAA,EAAQ,QAAQ,CAAC,CAAA;AACrD;AAEA,SAAS,KAAK,MAAA,EAAoC;AAChD,EAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,SAAS,IAAA,EAAM,OAAA,EAAS,QAAQ,MAAA,EAAO;AAChE;AAQO,SAAS,eAAe,GAAA,EAAoC;AACjE,EAAA,IAAI;AACF,IAAA,MAAM,OAAO,GAAA,CAAI,IAAA,EAAK,CAAE,KAAA,CAAM,WAAW,MAAM,CAAA;AAC/C,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AACtC,IAAA,IAAI,SAAA,IAAa,GAAG,OAAO,IAAA;AAC3B,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,eAAA,CAAgB,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,SAAS,CAAC,CAAC,CAAC,CAAA;AAAA,EACvF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF","file":"index.cjs","sourcesContent":["import { getRegistry } from '@ansh-ui/core'\n\n/**\n * Edition gating and license key verification.\n *\n * ## What this is, honestly\n *\n * This is **not DRM, and it cannot be.** Any check that runs in a browser can be removed by editing\n * the bundle, and any check that runs at build time can be removed by patching the package. Nothing\n * shipped as JavaScript to a client is enforceable. Pretending otherwise would mean building\n * obfuscation and phone-home telemetry that hurts paying customers — slower builds, offline CI\n * failures, privacy concerns — while stopping nobody who was determined.\n *\n * So the design goal is different: **make it easy and obvious to be correctly licensed.** Concretely:\n *\n *  - A signed key proves an entitlement without any network call, so CI works offline and no usage\n *    data leaves the customer's machine.\n *  - Pro components live behind a capability check that produces a clear, linkable error instead of\n *    a mysteriously blank canvas.\n *  - In development, an unlicensed Pro component renders a visible watermark and logs once. In\n *    production it throws at mount. Neither is a puzzle to diagnose.\n *  - Pro code lives in a separate entry point, so a Free-edition bundle never contains it. That is\n *    a genuine benefit for Free users — smaller bundles — rather than a restriction.\n *\n * Enforcement, where it matters, happens at the point of sale and in the license agreement. This\n * module's job is to keep honest customers out of trouble.\n *\n * ## Key format\n *\n * `aur_<base64url(payload)>.<base64url(signature)>`\n *\n * The payload is JSON, so a customer can inspect exactly what they were issued — expiry, seats,\n * edition — without a tool. The signature is Ed25519 over the payload bytes.\n */\n\nexport type Edition = 'free' | 'pro' | 'enterprise'\n\nexport interface LicensePayload {\n  /** Who the licence was issued to. Shown in diagnostics. */\n  licensee: string\n  edition: Edition\n  /** ISO 8601 issue date. */\n  issued: string\n  /**\n   * ISO 8601 expiry, or `null` for a perpetual licence.\n   *\n   * A perpetual licence for a version range is the honest model for a component library: the code a\n   * customer already installed keeps working forever, and the licence governs access to *new*\n   * versions. A licence that switches off working software is hostile.\n   */\n  expires: string | null\n  /** Number of developer seats. Informational — not enforced at runtime. */\n  seats?: number\n  /** Capabilities this key grants beyond the edition's defaults. */\n  grants?: string[]\n  /** Domains the licence covers. Informational. */\n  domains?: string[]\n}\n\nexport interface VerificationResult {\n  valid: boolean\n  payload: LicensePayload | null\n  edition: Edition\n  /** Human-readable explanation when `valid` is false. */\n  reason?: string\n  /** `true` when the signature verified but the licence has expired. */\n  expired?: boolean\n}\n\n/**\n * The Ansh public signing key, raw Ed25519 (32 bytes), base64url.\n *\n * Public by definition — it can only verify, never sign. Shipping it in the package is what makes\n * offline verification possible.\n *\n * This placeholder is the all-zero key, which verifies nothing. It is replaced at release time by\n * the real key; until then `verifyLicense` reports `unconfigured` rather than silently accepting or\n * rejecting everything, so an integration bug can't be mistaken for a licensing one.\n */\nconst PUBLIC_KEY_B64 = 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'\n\nconst KEY_PREFIX = 'aur_'\n\n/** Capabilities each edition grants. */\nconst EDITION_CAPABILITIES: Record<Edition, readonly string[]> = {\n  free: ['effect:core', 'behaviour:core', 'renderer:canvas2d'],\n  pro: [\n    'effect:core',\n    'effect:pro',\n    'behaviour:core',\n    'behaviour:pro',\n    'renderer:canvas2d',\n    'renderer:webgl',\n  ],\n  enterprise: [\n    'effect:core',\n    'effect:pro',\n    'effect:enterprise',\n    'behaviour:core',\n    'behaviour:pro',\n    'renderer:canvas2d',\n    'renderer:webgl',\n    'renderer:webgpu',\n    'worker',\n  ],\n}\n\nlet activeEdition: Edition = 'free'\nlet activePayload: LicensePayload | null = null\n\n/**\n * Verify a licence key.\n *\n * Async because Web Crypto is async. Call it once at application startup (or in a build plugin) and\n * `await` it — the result is cached in module state, so components check a boolean rather than\n * re-verifying.\n *\n * Never throws. A malformed key, an unsupported runtime and a genuinely invalid signature all\n * produce a `VerificationResult` with a `reason`, because a licence problem must not be able to\n * crash an application.\n */\nexport async function verifyLicense(key: string): Promise<VerificationResult> {\n  const trimmed = key.trim()\n\n  if (!trimmed.startsWith(KEY_PREFIX)) {\n    return fail(`Key does not start with \"${KEY_PREFIX}\". Check for a copy-paste error.`)\n  }\n\n  const body = trimmed.slice(KEY_PREFIX.length)\n  const separator = body.lastIndexOf('.')\n  if (separator <= 0) {\n    return fail('Key is missing its signature separator. It may be truncated.')\n  }\n\n  const payloadPart = body.slice(0, separator)\n  const signaturePart = body.slice(separator + 1)\n\n  let payload: LicensePayload\n  let payloadBytes: Uint8Array\n  try {\n    payloadBytes = base64UrlDecode(payloadPart)\n    payload = JSON.parse(new TextDecoder().decode(payloadBytes)) as LicensePayload\n  } catch {\n    return fail('Key payload is not valid base64url-encoded JSON.')\n  }\n\n  if (PUBLIC_KEY_B64 === 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA') {\n    // Distinguish \"we haven't shipped a signing key yet\" from \"your key is bad\". Conflating the two\n    // would send customers to support for a problem that is entirely ours.\n    return {\n      valid: false,\n      payload,\n      edition: 'free',\n      reason:\n        'License verification is unconfigured in this build of @ansh-ui/license. ' +\n        'This is not a problem with your key. See https://ansh.dev/docs/licensing',\n    }\n  }\n\n  let signatureValid: boolean\n  try {\n    signatureValid = await verifySignature(payloadBytes, base64UrlDecode(signaturePart))\n  } catch (error) {\n    return fail(\n      `Signature verification is unavailable in this runtime ` +\n        `(${error instanceof Error ? error.message : 'unknown error'}). ` +\n        `Ed25519 via Web Crypto requires Node 18.4+, Chrome 137+, Firefox 129+ or Safari 17+. ` +\n        `Verify at build time instead if you must support older runtimes.`,\n    )\n  }\n\n  if (!signatureValid) {\n    return fail('Signature does not match. The key has been modified or is not genuine.')\n  }\n\n  const expired = payload.expires !== null && new Date(payload.expires).getTime() < Date.now()\n  if (expired) {\n    return {\n      valid: false,\n      payload,\n      edition: 'free',\n      expired: true,\n      reason:\n        `Licence expired on ${payload.expires}. ` +\n        `Previously-installed versions continue to work; renew to access newer releases.`,\n    }\n  }\n\n  return { valid: true, payload, edition: payload.edition }\n}\n\n/**\n * Activate a licence, granting its capabilities in the registry.\n *\n * This is the single call an application makes. After it resolves, Pro components mount normally\n * and `registry.requireCapability('effect:pro')` succeeds.\n *\n * ```ts\n * import { activateLicense } from '@ansh-ui/license'\n * await activateLicense(process.env.ANSH_LICENSE_KEY!)\n * ```\n */\nexport async function activateLicense(key: string): Promise<VerificationResult> {\n  const result = await verifyLicense(key)\n\n  if (!result.valid) {\n    console.warn(`[ansh] Licence not activated: ${result.reason}`)\n    return result\n  }\n\n  activeEdition = result.edition\n  activePayload = result.payload\n\n  const registry = getRegistry()\n  for (const capability of EDITION_CAPABILITIES[result.edition]) {\n    registry.provide(capability)\n  }\n  for (const grant of result.payload?.grants ?? []) {\n    registry.provide(grant)\n  }\n\n  return result\n}\n\n/**\n * Apply the Free edition explicitly.\n *\n * Called automatically the first time a capability is checked without activation, so Free works with\n * no setup at all. Exposed for tests and for resetting between app instances.\n */\nexport function useFreeEdition(): void {\n  activeEdition = 'free'\n  activePayload = null\n\n  const registry = getRegistry()\n  for (const capability of EDITION_CAPABILITIES.free) registry.provide(capability)\n\n  // Revoke paid capabilities with a message that says what to do, rather than leaving the generic\n  // \"missing capability\" error to speak for itself.\n  const paid = [\n    ...new Set([...EDITION_CAPABILITIES.pro, ...EDITION_CAPABILITIES.enterprise]),\n  ].filter((capability) => !EDITION_CAPABILITIES.free.includes(capability))\n\n  for (const capability of paid) {\n    registry.revoke(\n      capability,\n      'This component requires Ansh Pro. See https://ansh.dev/pro to compare editions.',\n    )\n  }\n}\n\n/** The currently active edition. */\nexport function currentEdition(): Edition {\n  return activeEdition\n}\n\n/** The active licence payload, or `null` on Free. */\nexport function currentLicense(): LicensePayload | null {\n  return activePayload\n}\n\n/** Is a capability available under the active edition? */\nexport function hasCapability(capability: string): boolean {\n  return getRegistry().supports(capability)\n}\n\n// ---------------------------------------------------------------------------\n// Crypto\n// ---------------------------------------------------------------------------\n\nlet cachedKey: CryptoKey | null = null\n\nasync function verifySignature(payload: Uint8Array, signature: Uint8Array): Promise<boolean> {\n  const subtle = globalThis.crypto?.subtle\n  if (!subtle) throw new Error('Web Crypto is unavailable')\n\n  if (!cachedKey) {\n    cachedKey = await subtle.importKey(\n      'raw',\n      base64UrlDecode(PUBLIC_KEY_B64) as unknown as ArrayBuffer,\n      { name: 'Ed25519' },\n      false,\n      ['verify'],\n    )\n  }\n\n  return subtle.verify(\n    { name: 'Ed25519' },\n    cachedKey,\n    signature as unknown as ArrayBuffer,\n    payload as unknown as ArrayBuffer,\n  )\n}\n\n/**\n * base64url → bytes.\n *\n * Hand-rolled rather than using `atob` because base64url uses `-`/`_` instead of `+`/`/` and omits\n * padding, and because `atob` does not exist in every Node context we might run in.\n */\nfunction base64UrlDecode(input: string): Uint8Array {\n  const normalised = input.replace(/-/g, '+').replace(/_/g, '/')\n  const padded = normalised + '='.repeat((4 - (normalised.length % 4)) % 4)\n\n  if (typeof atob === 'function') {\n    const binary = atob(padded)\n    const bytes = new Uint8Array(binary.length)\n    for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i)\n    return bytes\n  }\n\n  // Node without a global `atob` (very old versions, or a stripped runtime).\n  return new Uint8Array(Buffer.from(padded, 'base64'))\n}\n\nfunction fail(reason: string): VerificationResult {\n  return { valid: false, payload: null, edition: 'free', reason }\n}\n\n/**\n * Decode a key's payload **without verifying it**.\n *\n * For diagnostics only — printing \"your licence expires on X\" in a CLI, for instance. Never gate on\n * this: the payload is unauthenticated and trivially forged.\n */\nexport function inspectLicense(key: string): LicensePayload | null {\n  try {\n    const body = key.trim().slice(KEY_PREFIX.length)\n    const separator = body.lastIndexOf('.')\n    if (separator <= 0) return null\n    return JSON.parse(new TextDecoder().decode(base64UrlDecode(body.slice(0, separator))))\n  } catch {\n    return null\n  }\n}\n\nexport { EDITION_CAPABILITIES }\n"]}
+{"version":3,"sources":["../src/base64url.ts","../src/public-key.ts","../src/verify.ts","../src/activation.ts"],"names":["getRegistry"],"mappings":";;;;;AAMO,SAAS,gBAAgB,KAAA,EAA2B;AACzD,EAAA,MAAM,UAAA,GAAa,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,aAAa,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,UAAA,CAAW,MAAA,GAAS,KAAM,CAAC,CAAA;AAExE,EAAA,IAAI,OAAO,SAAS,UAAA,EAAY;AAC9B,IAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,IAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AAC1C,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,MAAA,EAAQ,CAAA,EAAA,EAAK,KAAA,CAAM,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AACtE,IAAA,OAAO,KAAA;AAAA,EACT;AAGA,EAAA,OAAO,IAAI,UAAA,CAAW,MAAA,CAAO,IAAA,CAAK,MAAA,EAAQ,QAAQ,CAAC,CAAA;AACrD;ACAO,IAAM,cAAA,GAEP,6CAAA,CACA;AAEC,IAAM,UAAA,GAAa,MAAA;;;ACnBnB,IAAM,aAAA,GAAgB,+BAAA;AAE7B,IAAM,QAAA,GAA+B,CAAC,MAAA,EAAQ,KAAA,EAAO,YAAY,CAAA;AAa1D,SAAS,cAAc,GAAA,EAA0C;AACtE,EAAA,OAAO,0BAAA,CAA2B,KAAK,cAAc,CAAA;AACvD;AAQA,eAAsB,0BAAA,CACpB,KACA,YAAA,EAC6B;AAC7B,EAAA,MAAM,OAAA,GAAU,IAAI,IAAA,EAAK;AAEzB,EAAA,IAAI,CAAC,OAAA,CAAQ,UAAA,CAAW,UAAU,CAAA,EAAG;AACnC,IAAA,OAAO,IAAA,CAAK,CAAA,yBAAA,EAA4B,UAAU,CAAA,gCAAA,CAAkC,CAAA;AAAA,EACtF;AAEA,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,KAAA,CAAM,UAAA,CAAW,MAAM,CAAA;AAC5C,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AACtC,EAAA,IAAI,aAAa,CAAA,EAAG;AAClB,IAAA,OAAO,KAAK,8DAA8D,CAAA;AAAA,EAC5E;AAEA,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,SAAS,CAAA;AAC3C,EAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,KAAA,CAAM,SAAA,GAAY,CAAC,CAAA;AAE9C,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,YAAA;AACJ,EAAA,IAAI;AACF,IAAA,YAAA,GAAe,gBAAgB,WAAW,CAAA;AAC1C,IAAA,OAAA,GAAU,KAAK,KAAA,CAAM,IAAI,aAAY,CAAE,MAAA,CAAO,YAAY,CAAC,CAAA;AAAA,EAC7D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAK,kDAAkD,CAAA;AAAA,EAChE;AAeA,EAAA,IAAI,cAAA;AACJ,EAAA,IAAI;AACF,IAAA,cAAA,GAAiB,MAAM,eAAA;AAAA,MACrB,YAAA;AAAA,MACA,YAAA;AAAA,MACA,gBAAgB,aAAa;AAAA,KAC/B;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,OAAO,IAAA;AAAA,MACL,CAAA,uDAAA,EACM,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,UAAU,eAAe,CAAA,wJAAA;AAAA,KAGhE;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,IAAA,OAAO,KAAK,wEAAwE,CAAA;AAAA,EACtF;AAIA,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,IAAY,CAAC,QAAA,CAAS,QAAA,CAAS,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClF,IAAA,OAAO,KAAK,uEAAuE,CAAA;AAAA,EACrF;AAEA,EAAA,IAAI,OAAA,CAAQ,YAAY,IAAA,EAAM;AAC5B,IAAA,MAAM,YAAY,IAAI,IAAA,CAAK,OAAA,CAAQ,OAAO,EAAE,OAAA,EAAQ;AAEpD,IAAA,IAAI,MAAA,CAAO,KAAA,CAAM,SAAS,CAAA,EAAG;AAC3B,MAAA,OAAO,KAAK,CAAA,4CAAA,EAA+C,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAC,CAAA,GAAA,CAAK,CAAA;AAAA,IACzF;AACA,IAAA,IAAI,SAAA,GAAY,IAAA,CAAK,GAAA,EAAI,EAAG;AAC1B,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,OAAA;AAAA,QACA,OAAA,EAAS,MAAA;AAAA,QACT,OAAA,EAAS,IAAA;AAAA,QACT,MAAA,EACE,CAAA,mBAAA,EAAsB,OAAA,CAAQ,OAAO,CAAA,iFAAA;AAAA,OAEzC;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,KAAA,EAAO,IAAA,EAAM,OAAA,EAAS,OAAA,EAAS,QAAQ,OAAA,EAAQ;AAC1D;AAQO,SAAS,eAAe,GAAA,EAAoC;AACjE,EAAA,IAAI;AACF,IAAA,MAAM,OAAO,GAAA,CAAI,IAAA,EAAK,CAAE,KAAA,CAAM,WAAW,MAAM,CAAA;AAC/C,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AACtC,IAAA,IAAI,SAAA,IAAa,GAAG,OAAO,IAAA;AAC3B,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,eAAA,CAAgB,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,SAAS,CAAC,CAAC,CAAC,CAAA;AAAA,EACvF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAMA,IAAM,YAAA,uBAAmB,GAAA,EAAgC;AAEzD,eAAe,eAAA,CACb,YAAA,EACA,OAAA,EACA,SAAA,EACkB;AAClB,EAAA,MAAM,MAAA,GAAS,WAAW,MAAA,EAAQ,MAAA;AAClC,EAAA,IAAI,CAAC,MAAA,EAAQ,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAExD,EAAA,IAAI,GAAA,GAAM,YAAA,CAAa,GAAA,CAAI,YAAY,CAAA;AACvC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,GAAA,GAAM,MAAA,CAAO,SAAA;AAAA,MACX,KAAA;AAAA,MACA,gBAAgB,YAAY,CAAA;AAAA,MAC5B,EAAE,MAAM,SAAA,EAAU;AAAA,MAClB,KAAA;AAAA,MACA,CAAC,QAAQ;AAAA,KACX;AACA,IAAA,YAAA,CAAa,GAAA,CAAI,cAAc,GAAG,CAAA;AAElC,IAAA,GAAA,CAAI,KAAA,CAAM,MAAM,YAAA,CAAa,MAAA,CAAO,YAAY,CAAC,CAAA;AAAA,EACnD;AAEA,EAAA,OAAO,MAAA,CAAO,MAAA;AAAA,IACZ,EAAE,MAAM,SAAA,EAAU;AAAA,IAClB,MAAM,GAAA;AAAA,IACN,SAAA;AAAA,IACA;AAAA,GACF;AACF;AAEA,SAAS,KAAK,MAAA,EAAoC;AAChD,EAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,SAAS,IAAA,EAAM,OAAA,EAAS,QAAQ,MAAA,EAAO;AAChE;ACzKO,IAAM,oBAAA,GAA2D;AAAA,EACtE,IAAA,EAAM,CAAC,aAAA,EAAe,gBAAA,EAAkB,mBAAmB,CAAA;AAAA,EAC3D,GAAA,EAAK;AAAA,IACH,aAAA;AAAA,IACA,YAAA;AAAA,IACA,gBAAA;AAAA,IACA,eAAA;AAAA,IACA,mBAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,UAAA,EAAY;AAAA,IACV,aAAA;AAAA,IACA,YAAA;AAAA,IACA,mBAAA;AAAA,IACA,gBAAA;AAAA,IACA,eAAA;AAAA,IACA,mBAAA;AAAA,IACA,gBAAA;AAAA,IACA,iBAAA;AAAA,IACA;AAAA;AAEJ;AAEA,IAAI,aAAA,GAAyB,MAAA;AAC7B,IAAI,aAAA,GAAuC,IAAA;AAa3C,eAAsB,gBAAgB,GAAA,EAA0C;AAC9E,EAAA,OAAO,iBAAA,CAAkB,MAAM,aAAA,CAAc,GAAG,CAAC,CAAA;AACnD;AAGO,SAAS,kBAAkB,MAAA,EAAgD;AAChF,EAAA,IAAI,CAAC,OAAO,KAAA,EAAO;AACjB,IAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,8BAAA,EAAiC,MAAA,CAAO,MAAM,CAAA,CAAE,CAAA;AAC7D,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,aAAA,GAAgB,MAAA,CAAO,OAAA;AACvB,EAAA,aAAA,GAAgB,MAAA,CAAO,OAAA;AAEvB,EAAA,MAAM,WAAWA,gBAAA,EAAY;AAC7B,EAAA,KAAA,MAAW,UAAA,IAAc,oBAAA,CAAqB,MAAA,CAAO,OAAO,CAAA,EAAG;AAC7D,IAAA,QAAA,CAAS,QAAQ,UAAU,CAAA;AAAA,EAC7B;AACA,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,OAAA,EAAS,MAAA,IAAU,EAAC,EAAG;AAChD,IAAA,QAAA,CAAS,QAAQ,KAAK,CAAA;AAAA,EACxB;AAEA,EAAA,OAAO,MAAA;AACT;AAQO,SAAS,cAAA,GAAuB;AACrC,EAAA,aAAA,GAAgB,MAAA;AAChB,EAAA,aAAA,GAAgB,IAAA;AAEhB,EAAA,MAAM,WAAWA,gBAAA,EAAY;AAC7B,EAAA,KAAA,MAAW,UAAA,IAAc,oBAAA,CAAqB,IAAA,EAAM,QAAA,CAAS,QAAQ,UAAU,CAAA;AAI/E,EAAA,MAAM,IAAA,GAAO;AAAA,IACX,mBAAG,IAAI,GAAA,CAAI,CAAC,GAAG,qBAAqB,GAAA,EAAK,GAAG,oBAAA,CAAqB,UAAU,CAAC;AAAA,GAC9E,CAAE,OAAO,CAAC,UAAA,KAAe,CAAC,oBAAA,CAAqB,IAAA,CAAK,QAAA,CAAS,UAAU,CAAC,CAAA;AAExE,EAAA,KAAA,MAAW,cAAc,IAAA,EAAM;AAC7B,IAAA,QAAA,CAAS,MAAA;AAAA,MACP,UAAA;AAAA,MACA,yCAAyC,aAAa,CAAA,qBAAA;AAAA,KACxD;AAAA,EACF;AACF;AAGO,SAAS,cAAA,GAA0B;AACxC,EAAA,OAAO,aAAA;AACT;AAGO,SAAS,cAAA,GAAwC;AACtD,EAAA,OAAO,aAAA;AACT;AAGO,SAAS,cAAc,UAAA,EAA6B;AACzD,EAAA,OAAOA,gBAAA,EAAY,CAAE,QAAA,CAAS,UAAU,CAAA;AAC1C","file":"index.cjs","sourcesContent":["/**\n * base64url → bytes.\n *\n * Hand-rolled rather than using `atob` because base64url uses `-`/`_` instead of `+`/`/` and omits\n * padding, and because `atob` does not exist in every Node context we might run in.\n */\nexport function base64UrlDecode(input: string): Uint8Array {\n  const normalised = input.replace(/-/g, '+').replace(/_/g, '/')\n  const padded = normalised + '='.repeat((4 - (normalised.length % 4)) % 4)\n\n  if (typeof atob === 'function') {\n    const binary = atob(padded)\n    const bytes = new Uint8Array(binary.length)\n    for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i)\n    return bytes\n  }\n\n  // Node without a global `atob` (very old versions, or a stripped runtime).\n  return new Uint8Array(Buffer.from(padded, 'base64'))\n}\n","/**\n * The Ansh public signing key, raw Ed25519 (32 bytes), base64url.\n *\n * Public by definition — it can only verify, never sign. Shipping it in the package is what makes\n * offline verification possible.\n *\n * The real key is injected at build time: `tsup.config.ts` replaces `__ANSH_LICENSE_PUBLIC_KEY__`\n * with the `ANSH_LICENSE_PUBLIC_KEY` environment variable, which `release.yml` sets from a repository\n * secret. A build without it falls back to the all-zero placeholder, which verifies nothing, and\n * `verifyLicense` then reports `unconfigured` rather than silently accepting or rejecting everything,\n * so an integration bug can't be mistaken for a licensing one. `scripts/check-license-key.mjs`\n * refuses to publish a placeholder build.\n */\n\ndeclare const __ANSH_LICENSE_PUBLIC_KEY__: string | undefined\n\nexport const PLACEHOLDER_PUBLIC_KEY = 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'\n\n/** `typeof` guard so running from source (tests, the docs site) works without the define. */\nexport const PUBLIC_KEY_B64: string =\n  typeof __ANSH_LICENSE_PUBLIC_KEY__ === 'string' && __ANSH_LICENSE_PUBLIC_KEY__ !== ''\n    ? __ANSH_LICENSE_PUBLIC_KEY__\n    : PLACEHOLDER_PUBLIC_KEY\n\nexport const KEY_PREFIX = 'aur_'\n","import { base64UrlDecode } from './base64url'\nimport { KEY_PREFIX, PLACEHOLDER_PUBLIC_KEY, PUBLIC_KEY_B64 } from './public-key'\nimport type { Edition, LicensePayload, VerificationResult } from './types'\n\n/** Where licence problems send people. The pricing section lives on the landing page. */\nexport const LICENSING_URL = 'https://ansh.techiesofepi.com'\n\nconst EDITIONS: readonly Edition[] = ['free', 'pro', 'enterprise']\n\n/**\n * Verify a licence key.\n *\n * Async because Web Crypto is async. Call it once at application startup (or in a build plugin) and\n * `await` it — the result is cached in module state, so components check a boolean rather than\n * re-verifying.\n *\n * Never throws. A malformed key, an unsupported runtime and a genuinely invalid signature all\n * produce a `VerificationResult` with a `reason`, because a licence problem must not be able to\n * crash an application.\n */\nexport function verifyLicense(key: string): Promise<VerificationResult> {\n  return verifyLicenseWithPublicKey(key, PUBLIC_KEY_B64)\n}\n\n/**\n * {@link verifyLicense} against an explicit public key.\n *\n * Not re-exported from the package root: the shipped key is the only one a consumer should trust.\n * It exists so the test suite can sign with a throwaway keypair.\n */\nexport async function verifyLicenseWithPublicKey(\n  key: string,\n  publicKeyB64: string,\n): Promise<VerificationResult> {\n  const trimmed = key.trim()\n\n  if (!trimmed.startsWith(KEY_PREFIX)) {\n    return fail(`Key does not start with \"${KEY_PREFIX}\". Check for a copy-paste error.`)\n  }\n\n  const body = trimmed.slice(KEY_PREFIX.length)\n  const separator = body.lastIndexOf('.')\n  if (separator <= 0) {\n    return fail('Key is missing its signature separator. It may be truncated.')\n  }\n\n  const payloadPart = body.slice(0, separator)\n  const signaturePart = body.slice(separator + 1)\n\n  let payload: LicensePayload\n  let payloadBytes: Uint8Array\n  try {\n    payloadBytes = base64UrlDecode(payloadPart)\n    payload = JSON.parse(new TextDecoder().decode(payloadBytes)) as LicensePayload\n  } catch {\n    return fail('Key payload is not valid base64url-encoded JSON.')\n  }\n\n  if (publicKeyB64 === PLACEHOLDER_PUBLIC_KEY) {\n    // Distinguish \"we haven't shipped a signing key yet\" from \"your key is bad\". Conflating the two\n    // would send customers to support for a problem that is entirely ours.\n    return {\n      valid: false,\n      payload,\n      edition: 'free',\n      reason:\n        'License verification is unconfigured in this build of @ansh-ui/license. ' +\n        `This is not a problem with your key. See ${LICENSING_URL}`,\n    }\n  }\n\n  let signatureValid: boolean\n  try {\n    signatureValid = await verifySignature(\n      publicKeyB64,\n      payloadBytes,\n      base64UrlDecode(signaturePart),\n    )\n  } catch (error) {\n    return fail(\n      `Signature verification is unavailable in this runtime ` +\n        `(${error instanceof Error ? error.message : 'unknown error'}). ` +\n        `Ed25519 via Web Crypto requires Node 18.4+, Chrome 137+, Firefox 129+ or Safari 17+. ` +\n        `Verify at build time instead if you must support older runtimes.`,\n    )\n  }\n\n  if (!signatureValid) {\n    return fail('Signature does not match. The key has been modified or is not genuine.')\n  }\n\n  // The signature proves we issued these bytes, not that they're well-formed. Checked after\n  // verification so a forged payload can't probe which shapes we accept.\n  if (!payload || typeof payload !== 'object' || !EDITIONS.includes(payload.edition)) {\n    return fail('Key payload names an unknown edition. It may be from a newer release.')\n  }\n\n  if (payload.expires !== null) {\n    const expiresAt = new Date(payload.expires).getTime()\n    // An unparseable date would otherwise compare as NaN and silently never expire.\n    if (Number.isNaN(expiresAt)) {\n      return fail(`Key payload has an unreadable expiry date (\"${String(payload.expires)}\").`)\n    }\n    if (expiresAt < Date.now()) {\n      return {\n        valid: false,\n        payload,\n        edition: 'free',\n        expired: true,\n        reason:\n          `Licence expired on ${payload.expires}. ` +\n          `Previously-installed versions continue to work; renew to access newer releases.`,\n      }\n    }\n  }\n\n  return { valid: true, payload, edition: payload.edition }\n}\n\n/**\n * Decode a key's payload **without verifying it**.\n *\n * For diagnostics only — printing \"your licence expires on X\" in a CLI, for instance. Never gate on\n * this: the payload is unauthenticated and trivially forged.\n */\nexport function inspectLicense(key: string): LicensePayload | null {\n  try {\n    const body = key.trim().slice(KEY_PREFIX.length)\n    const separator = body.lastIndexOf('.')\n    if (separator <= 0) return null\n    return JSON.parse(new TextDecoder().decode(base64UrlDecode(body.slice(0, separator))))\n  } catch {\n    return null\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Crypto\n// ---------------------------------------------------------------------------\n\nconst importedKeys = new Map<string, Promise<CryptoKey>>()\n\nasync function verifySignature(\n  publicKeyB64: string,\n  payload: Uint8Array,\n  signature: Uint8Array,\n): Promise<boolean> {\n  const subtle = globalThis.crypto?.subtle\n  if (!subtle) throw new Error('Web Crypto is unavailable')\n\n  let key = importedKeys.get(publicKeyB64)\n  if (!key) {\n    key = subtle.importKey(\n      'raw',\n      base64UrlDecode(publicKeyB64) as unknown as ArrayBuffer,\n      { name: 'Ed25519' },\n      false,\n      ['verify'],\n    )\n    importedKeys.set(publicKeyB64, key)\n    // A failed import must not poison the cache for the next attempt.\n    key.catch(() => importedKeys.delete(publicKeyB64))\n  }\n\n  return subtle.verify(\n    { name: 'Ed25519' },\n    await key,\n    signature as unknown as ArrayBuffer,\n    payload as unknown as ArrayBuffer,\n  )\n}\n\nfunction fail(reason: string): VerificationResult {\n  return { valid: false, payload: null, edition: 'free', reason }\n}\n","import { getRegistry } from '@ansh-ui/core'\nimport type { Edition, LicensePayload, VerificationResult } from './types'\nimport { LICENSING_URL, verifyLicense } from './verify'\n\n/** Capabilities each edition grants. */\nexport const EDITION_CAPABILITIES: Record<Edition, readonly string[]> = {\n  free: ['effect:core', 'behaviour:core', 'renderer:canvas2d'],\n  pro: [\n    'effect:core',\n    'effect:pro',\n    'behaviour:core',\n    'behaviour:pro',\n    'renderer:canvas2d',\n    'renderer:webgl',\n  ],\n  enterprise: [\n    'effect:core',\n    'effect:pro',\n    'effect:enterprise',\n    'behaviour:core',\n    'behaviour:pro',\n    'renderer:canvas2d',\n    'renderer:webgl',\n    'renderer:webgpu',\n    'worker',\n  ],\n}\n\nlet activeEdition: Edition = 'free'\nlet activePayload: LicensePayload | null = null\n\n/**\n * Activate a licence, granting its capabilities in the registry.\n *\n * This is the single call an application makes. After it resolves, Pro components mount normally\n * and `registry.requireCapability('effect:pro')` succeeds.\n *\n * ```ts\n * import { activateLicense } from '@ansh-ui/license'\n * await activateLicense(process.env.ANSH_LICENSE_KEY!)\n * ```\n */\nexport async function activateLicense(key: string): Promise<VerificationResult> {\n  return applyVerification(await verifyLicense(key))\n}\n\n/** The registry half of {@link activateLicense}, split out so tests can feed it a result. */\nexport function applyVerification(result: VerificationResult): VerificationResult {\n  if (!result.valid) {\n    console.warn(`[ansh] Licence not activated: ${result.reason}`)\n    return result\n  }\n\n  activeEdition = result.edition\n  activePayload = result.payload\n\n  const registry = getRegistry()\n  for (const capability of EDITION_CAPABILITIES[result.edition]) {\n    registry.provide(capability)\n  }\n  for (const grant of result.payload?.grants ?? []) {\n    registry.provide(grant)\n  }\n\n  return result\n}\n\n/**\n * Apply the Free edition explicitly.\n *\n * Called automatically the first time a capability is checked without activation, so Free works with\n * no setup at all. Exposed for tests and for resetting between app instances.\n */\nexport function useFreeEdition(): void {\n  activeEdition = 'free'\n  activePayload = null\n\n  const registry = getRegistry()\n  for (const capability of EDITION_CAPABILITIES.free) registry.provide(capability)\n\n  // Revoke paid capabilities with a message that says what to do, rather than leaving the generic\n  // \"missing capability\" error to speak for itself.\n  const paid = [\n    ...new Set([...EDITION_CAPABILITIES.pro, ...EDITION_CAPABILITIES.enterprise]),\n  ].filter((capability) => !EDITION_CAPABILITIES.free.includes(capability))\n\n  for (const capability of paid) {\n    registry.revoke(\n      capability,\n      `This component requires Ansh Pro. See ${LICENSING_URL} to compare editions.`,\n    )\n  }\n}\n\n/** The currently active edition. */\nexport function currentEdition(): Edition {\n  return activeEdition\n}\n\n/** The active licence payload, or `null` on Free. */\nexport function currentLicense(): LicensePayload | null {\n  return activePayload\n}\n\n/** Is a capability available under the active edition? */\nexport function hasCapability(capability: string): boolean {\n  return getRegistry().supports(capability)\n}\n"]}

package/dist/index.d.cts

@@ -1,35 +1,3 @@
-/**
- * Edition gating and license key verification.
- *
- * ## What this is, honestly
- *
- * This is **not DRM, and it cannot be.** Any check that runs in a browser can be removed by editing
- * the bundle, and any check that runs at build time can be removed by patching the package. Nothing
- * shipped as JavaScript to a client is enforceable. Pretending otherwise would mean building
- * obfuscation and phone-home telemetry that hurts paying customers — slower builds, offline CI
- * failures, privacy concerns — while stopping nobody who was determined.
- *
- * So the design goal is different: **make it easy and obvious to be correctly licensed.** Concretely:
- *
- *  - A signed key proves an entitlement without any network call, so CI works offline and no usage
- *    data leaves the customer's machine.
- *  - Pro components live behind a capability check that produces a clear, linkable error instead of
- *    a mysteriously blank canvas.
- *  - In development, an unlicensed Pro component renders a visible watermark and logs once. In
- *    production it throws at mount. Neither is a puzzle to diagnose.
- *  - Pro code lives in a separate entry point, so a Free-edition bundle never contains it. That is
- *    a genuine benefit for Free users — smaller bundles — rather than a restriction.
- *
- * Enforcement, where it matters, happens at the point of sale and in the license agreement. This
- * module's job is to keep honest customers out of trouble.
- *
- * ## Key format
- *
- * `aur_<base64url(payload)>.<base64url(signature)>`
- *
- * The payload is JSON, so a customer can inspect exactly what they were issued — expiry, seats,
- * edition — without a tool. The signature is Ed25519 over the payload bytes.
- */
 type Edition = 'free' | 'pro' | 'enterprise';
 interface LicensePayload {
     /** Who the licence was issued to. Shown in diagnostics. */
@@ -61,8 +29,7 @@ interface VerificationResult {
     /** `true` when the signature verified but the licence has expired. */
     expired?: boolean;
 }
-/** Capabilities each edition grants. */
-declare const EDITION_CAPABILITIES: Record<Edition, readonly string[]>;
+
 /**
  * Verify a licence key.
  *
@@ -75,6 +42,16 @@ declare const EDITION_CAPABILITIES: Record<Edition, readonly string[]>;
  * crash an application.
  */
 declare function verifyLicense(key: string): Promise<VerificationResult>;
+/**
+ * Decode a key's payload **without verifying it**.
+ *
+ * For diagnostics only — printing "your licence expires on X" in a CLI, for instance. Never gate on
+ * this: the payload is unauthenticated and trivially forged.
+ */
+declare function inspectLicense(key: string): LicensePayload | null;
+
+/** Capabilities each edition grants. */
+declare const EDITION_CAPABILITIES: Record<Edition, readonly string[]>;
 /**
  * Activate a licence, granting its capabilities in the registry.
  *
@@ -100,12 +77,6 @@ declare function currentEdition(): Edition;
 declare function currentLicense(): LicensePayload | null;
 /** Is a capability available under the active edition? */
 declare function hasCapability(capability: string): boolean;
-/**
- * Decode a key's payload **without verifying it**.
- *
- * For diagnostics only — printing "your licence expires on X" in a CLI, for instance. Never gate on
- * this: the payload is unauthenticated and trivially forged.
- */
-declare function inspectLicense(key: string): LicensePayload | null;
 
-export { EDITION_CAPABILITIES, type Edition, type LicensePayload, type VerificationResult, activateLicense, currentEdition, currentLicense, hasCapability, inspectLicense, useFreeEdition, verifyLicense };
+export { EDITION_CAPABILITIES, activateLicense, currentEdition, currentLicense, hasCapability, inspectLicense, useFreeEdition, verifyLicense };
+export type { Edition, LicensePayload, VerificationResult };

package/dist/index.d.ts

@@ -1,35 +1,3 @@
-/**
- * Edition gating and license key verification.
- *
- * ## What this is, honestly
- *
- * This is **not DRM, and it cannot be.** Any check that runs in a browser can be removed by editing
- * the bundle, and any check that runs at build time can be removed by patching the package. Nothing
- * shipped as JavaScript to a client is enforceable. Pretending otherwise would mean building
- * obfuscation and phone-home telemetry that hurts paying customers — slower builds, offline CI
- * failures, privacy concerns — while stopping nobody who was determined.
- *
- * So the design goal is different: **make it easy and obvious to be correctly licensed.** Concretely:
- *
- *  - A signed key proves an entitlement without any network call, so CI works offline and no usage
- *    data leaves the customer's machine.
- *  - Pro components live behind a capability check that produces a clear, linkable error instead of
- *    a mysteriously blank canvas.
- *  - In development, an unlicensed Pro component renders a visible watermark and logs once. In
- *    production it throws at mount. Neither is a puzzle to diagnose.
- *  - Pro code lives in a separate entry point, so a Free-edition bundle never contains it. That is
- *    a genuine benefit for Free users — smaller bundles — rather than a restriction.
- *
- * Enforcement, where it matters, happens at the point of sale and in the license agreement. This
- * module's job is to keep honest customers out of trouble.
- *
- * ## Key format
- *
- * `aur_<base64url(payload)>.<base64url(signature)>`
- *
- * The payload is JSON, so a customer can inspect exactly what they were issued — expiry, seats,
- * edition — without a tool. The signature is Ed25519 over the payload bytes.
- */
 type Edition = 'free' | 'pro' | 'enterprise';
 interface LicensePayload {
     /** Who the licence was issued to. Shown in diagnostics. */
@@ -61,8 +29,7 @@ interface VerificationResult {
     /** `true` when the signature verified but the licence has expired. */
     expired?: boolean;
 }
-/** Capabilities each edition grants. */
-declare const EDITION_CAPABILITIES: Record<Edition, readonly string[]>;
+
 /**
  * Verify a licence key.
  *
@@ -75,6 +42,16 @@ declare const EDITION_CAPABILITIES: Record<Edition, readonly string[]>;
  * crash an application.
  */
 declare function verifyLicense(key: string): Promise<VerificationResult>;
+/**
+ * Decode a key's payload **without verifying it**.
+ *
+ * For diagnostics only — printing "your licence expires on X" in a CLI, for instance. Never gate on
+ * this: the payload is unauthenticated and trivially forged.
+ */
+declare function inspectLicense(key: string): LicensePayload | null;
+
+/** Capabilities each edition grants. */
+declare const EDITION_CAPABILITIES: Record<Edition, readonly string[]>;
 /**
  * Activate a licence, granting its capabilities in the registry.
  *
@@ -100,12 +77,6 @@ declare function currentEdition(): Edition;
 declare function currentLicense(): LicensePayload | null;
 /** Is a capability available under the active edition? */
 declare function hasCapability(capability: string): boolean;
-/**
- * Decode a key's payload **without verifying it**.
- *
- * For diagnostics only — printing "your licence expires on X" in a CLI, for instance. Never gate on
- * this: the payload is unauthenticated and trivially forged.
- */
-declare function inspectLicense(key: string): LicensePayload | null;
 
-export { EDITION_CAPABILITIES, type Edition, type LicensePayload, type VerificationResult, activateLicense, currentEdition, currentLicense, hasCapability, inspectLicense, useFreeEdition, verifyLicense };
+export { EDITION_CAPABILITIES, activateLicense, currentEdition, currentLicense, hasCapability, inspectLicense, useFreeEdition, verifyLicense };
+export type { Edition, LicensePayload, VerificationResult };

package/dist/index.js

@@ -1,7 +1,117 @@
 import { getRegistry } from '@ansh-ui/core';
 
-// src/index.ts
+// src/base64url.ts
+function base64UrlDecode(input) {
+  const normalised = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = normalised + "=".repeat((4 - normalised.length % 4) % 4);
+  if (typeof atob === "function") {
+    const binary = atob(padded);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+    return bytes;
+  }
+  return new Uint8Array(Buffer.from(padded, "base64"));
+}
+var PUBLIC_KEY_B64 = "ZnSy7P02L2gBSMrvugpEg0cuLMq1MIv2jMi6wnxgLZs" ;
 var KEY_PREFIX = "aur_";
+
+// src/verify.ts
+var LICENSING_URL = "https://ansh.techiesofepi.com";
+var EDITIONS = ["free", "pro", "enterprise"];
+function verifyLicense(key) {
+  return verifyLicenseWithPublicKey(key, PUBLIC_KEY_B64);
+}
+async function verifyLicenseWithPublicKey(key, publicKeyB64) {
+  const trimmed = key.trim();
+  if (!trimmed.startsWith(KEY_PREFIX)) {
+    return fail(`Key does not start with "${KEY_PREFIX}". Check for a copy-paste error.`);
+  }
+  const body = trimmed.slice(KEY_PREFIX.length);
+  const separator = body.lastIndexOf(".");
+  if (separator <= 0) {
+    return fail("Key is missing its signature separator. It may be truncated.");
+  }
+  const payloadPart = body.slice(0, separator);
+  const signaturePart = body.slice(separator + 1);
+  let payload;
+  let payloadBytes;
+  try {
+    payloadBytes = base64UrlDecode(payloadPart);
+    payload = JSON.parse(new TextDecoder().decode(payloadBytes));
+  } catch {
+    return fail("Key payload is not valid base64url-encoded JSON.");
+  }
+  let signatureValid;
+  try {
+    signatureValid = await verifySignature(
+      publicKeyB64,
+      payloadBytes,
+      base64UrlDecode(signaturePart)
+    );
+  } catch (error) {
+    return fail(
+      `Signature verification is unavailable in this runtime (${error instanceof Error ? error.message : "unknown error"}). Ed25519 via Web Crypto requires Node 18.4+, Chrome 137+, Firefox 129+ or Safari 17+. Verify at build time instead if you must support older runtimes.`
+    );
+  }
+  if (!signatureValid) {
+    return fail("Signature does not match. The key has been modified or is not genuine.");
+  }
+  if (!payload || typeof payload !== "object" || !EDITIONS.includes(payload.edition)) {
+    return fail("Key payload names an unknown edition. It may be from a newer release.");
+  }
+  if (payload.expires !== null) {
+    const expiresAt = new Date(payload.expires).getTime();
+    if (Number.isNaN(expiresAt)) {
+      return fail(`Key payload has an unreadable expiry date ("${String(payload.expires)}").`);
+    }
+    if (expiresAt < Date.now()) {
+      return {
+        valid: false,
+        payload,
+        edition: "free",
+        expired: true,
+        reason: `Licence expired on ${payload.expires}. Previously-installed versions continue to work; renew to access newer releases.`
+      };
+    }
+  }
+  return { valid: true, payload, edition: payload.edition };
+}
+function inspectLicense(key) {
+  try {
+    const body = key.trim().slice(KEY_PREFIX.length);
+    const separator = body.lastIndexOf(".");
+    if (separator <= 0) return null;
+    return JSON.parse(new TextDecoder().decode(base64UrlDecode(body.slice(0, separator))));
+  } catch {
+    return null;
+  }
+}
+var importedKeys = /* @__PURE__ */ new Map();
+async function verifySignature(publicKeyB64, payload, signature) {
+  const subtle = globalThis.crypto?.subtle;
+  if (!subtle) throw new Error("Web Crypto is unavailable");
+  let key = importedKeys.get(publicKeyB64);
+  if (!key) {
+    key = subtle.importKey(
+      "raw",
+      base64UrlDecode(publicKeyB64),
+      { name: "Ed25519" },
+      false,
+      ["verify"]
+    );
+    importedKeys.set(publicKeyB64, key);
+    key.catch(() => importedKeys.delete(publicKeyB64));
+  }
+  return subtle.verify(
+    { name: "Ed25519" },
+    await key,
+    signature,
+    payload
+  );
+}
+function fail(reason) {
+  return { valid: false, payload: null, edition: "free", reason };
+}
 var EDITION_CAPABILITIES = {
   free: ["effect:core", "behaviour:core", "renderer:canvas2d"],
   pro: [
@@ -26,37 +136,10 @@ var EDITION_CAPABILITIES = {
 };
 var activeEdition = "free";
 var activePayload = null;
-async function verifyLicense(key) {
-  const trimmed = key.trim();
-  if (!trimmed.startsWith(KEY_PREFIX)) {
-    return fail(`Key does not start with "${KEY_PREFIX}". Check for a copy-paste error.`);
-  }
-  const body = trimmed.slice(KEY_PREFIX.length);
-  const separator = body.lastIndexOf(".");
-  if (separator <= 0) {
-    return fail("Key is missing its signature separator. It may be truncated.");
-  }
-  const payloadPart = body.slice(0, separator);
-  body.slice(separator + 1);
-  let payload;
-  let payloadBytes;
-  try {
-    payloadBytes = base64UrlDecode(payloadPart);
-    payload = JSON.parse(new TextDecoder().decode(payloadBytes));
-  } catch {
-    return fail("Key payload is not valid base64url-encoded JSON.");
-  }
-  {
-    return {
-      valid: false,
-      payload,
-      edition: "free",
-      reason: "License verification is unconfigured in this build of @ansh-ui/license. This is not a problem with your key. See https://ansh.dev/docs/licensing"
-    };
-  }
-}
 async function activateLicense(key) {
-  const result = await verifyLicense(key);
+  return applyVerification(await verifyLicense(key));
+}
+function applyVerification(result) {
   if (!result.valid) {
     console.warn(`[ansh] Licence not activated: ${result.reason}`);
     return result;
@@ -83,7 +166,7 @@ function useFreeEdition() {
   for (const capability of paid) {
     registry.revoke(
       capability,
-      "This component requires Ansh Pro. See https://ansh.dev/pro to compare editions."
+      `This component requires Ansh Pro. See ${LICENSING_URL} to compare editions.`
     );
   }
 }
@@ -96,30 +179,6 @@ function currentLicense() {
 function hasCapability(capability) {
   return getRegistry().supports(capability);
 }
-function base64UrlDecode(input) {
-  const normalised = input.replace(/-/g, "+").replace(/_/g, "/");
-  const padded = normalised + "=".repeat((4 - normalised.length % 4) % 4);
-  if (typeof atob === "function") {
-    const binary = atob(padded);
-    const bytes = new Uint8Array(binary.length);
-    for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
-    return bytes;
-  }
-  return new Uint8Array(Buffer.from(padded, "base64"));
-}
-function fail(reason) {
-  return { valid: false, payload: null, edition: "free", reason };
-}
-function inspectLicense(key) {
-  try {
-    const body = key.trim().slice(KEY_PREFIX.length);
-    const separator = body.lastIndexOf(".");
-    if (separator <= 0) return null;
-    return JSON.parse(new TextDecoder().decode(base64UrlDecode(body.slice(0, separator))));
-  } catch {
-    return null;
-  }
-}
 
 export { EDITION_CAPABILITIES, activateLicense, currentEdition, currentLicense, hasCapability, inspectLicense, useFreeEdition, verifyLicense };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"names":[],"mappings":";;;AAiFA,IAAM,UAAA,GAAa,MAAA;AAGnB,IAAM,oBAAA,GAA2D;AAAA,EAC/D,IAAA,EAAM,CAAC,aAAA,EAAe,gBAAA,EAAkB,mBAAmB,CAAA;AAAA,EAC3D,GAAA,EAAK;AAAA,IACH,aAAA;AAAA,IACA,YAAA;AAAA,IACA,gBAAA;AAAA,IACA,eAAA;AAAA,IACA,mBAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,UAAA,EAAY;AAAA,IACV,aAAA;AAAA,IACA,YAAA;AAAA,IACA,mBAAA;AAAA,IACA,gBAAA;AAAA,IACA,eAAA;AAAA,IACA,mBAAA;AAAA,IACA,gBAAA;AAAA,IACA,iBAAA;AAAA,IACA;AAAA;AAEJ;AAEA,IAAI,aAAA,GAAyB,MAAA;AAC7B,IAAI,aAAA,GAAuC,IAAA;AAa3C,eAAsB,cAAc,GAAA,EAA0C;AAC5E,EAAA,MAAM,OAAA,GAAU,IAAI,IAAA,EAAK;AAEzB,EAAA,IAAI,CAAC,OAAA,CAAQ,UAAA,CAAW,UAAU,CAAA,EAAG;AACnC,IAAA,OAAO,IAAA,CAAK,CAAA,yBAAA,EAA4B,UAAU,CAAA,gCAAA,CAAkC,CAAA;AAAA,EACtF;AAEA,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,KAAA,CAAM,UAAA,CAAW,MAAM,CAAA;AAC5C,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AACtC,EAAA,IAAI,aAAa,CAAA,EAAG;AAClB,IAAA,OAAO,KAAK,8DAA8D,CAAA;AAAA,EAC5E;AAEA,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,SAAS,CAAA;AAC3C,EAAsB,IAAA,CAAK,KAAA,CAAM,SAAA,GAAY,CAAC;AAE9C,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,YAAA;AACJ,EAAA,IAAI;AACF,IAAA,YAAA,GAAe,gBAAgB,WAAW,CAAA;AAC1C,IAAA,OAAA,GAAU,KAAK,KAAA,CAAM,IAAI,aAAY,CAAE,MAAA,CAAO,YAAY,CAAC,CAAA;AAAA,EAC7D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAK,kDAAkD,CAAA;AAAA,EAChE;AAEA,EAAsE;AAGpE,IAAA,OAAO;AAAA,MACL,KAAA,EAAO,KAAA;AAAA,MACP,OAAA;AAAA,MACA,OAAA,EAAS,MAAA;AAAA,MACT,MAAA,EACE;AAAA,KAEJ;AAAA,EACF;AAgCF;AAaA,eAAsB,gBAAgB,GAAA,EAA0C;AAC9E,EAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAc,GAAG,CAAA;AAEtC,EAAA,IAAI,CAAC,OAAO,KAAA,EAAO;AACjB,IAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,8BAAA,EAAiC,MAAA,CAAO,MAAM,CAAA,CAAE,CAAA;AAC7D,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,aAAA,GAAgB,MAAA,CAAO,OAAA;AACvB,EAAA,aAAA,GAAgB,MAAA,CAAO,OAAA;AAEvB,EAAA,MAAM,WAAW,WAAA,EAAY;AAC7B,EAAA,KAAA,MAAW,UAAA,IAAc,oBAAA,CAAqB,MAAA,CAAO,OAAO,CAAA,EAAG;AAC7D,IAAA,QAAA,CAAS,QAAQ,UAAU,CAAA;AAAA,EAC7B;AACA,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,OAAA,EAAS,MAAA,IAAU,EAAC,EAAG;AAChD,IAAA,QAAA,CAAS,QAAQ,KAAK,CAAA;AAAA,EACxB;AAEA,EAAA,OAAO,MAAA;AACT;AAQO,SAAS,cAAA,GAAuB;AACrC,EAAA,aAAA,GAAgB,MAAA;AAChB,EAAA,aAAA,GAAgB,IAAA;AAEhB,EAAA,MAAM,WAAW,WAAA,EAAY;AAC7B,EAAA,KAAA,MAAW,UAAA,IAAc,oBAAA,CAAqB,IAAA,EAAM,QAAA,CAAS,QAAQ,UAAU,CAAA;AAI/E,EAAA,MAAM,IAAA,GAAO;AAAA,IACX,mBAAG,IAAI,GAAA,CAAI,CAAC,GAAG,qBAAqB,GAAA,EAAK,GAAG,oBAAA,CAAqB,UAAU,CAAC;AAAA,GAC9E,CAAE,OAAO,CAAC,UAAA,KAAe,CAAC,oBAAA,CAAqB,IAAA,CAAK,QAAA,CAAS,UAAU,CAAC,CAAA;AAExE,EAAA,KAAA,MAAW,cAAc,IAAA,EAAM;AAC7B,IAAA,QAAA,CAAS,MAAA;AAAA,MACP,UAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACF;AAGO,SAAS,cAAA,GAA0B;AACxC,EAAA,OAAO,aAAA;AACT;AAGO,SAAS,cAAA,GAAwC;AACtD,EAAA,OAAO,aAAA;AACT;AAGO,SAAS,cAAc,UAAA,EAA6B;AACzD,EAAA,OAAO,WAAA,EAAY,CAAE,QAAA,CAAS,UAAU,CAAA;AAC1C;AAoCA,SAAS,gBAAgB,KAAA,EAA2B;AAClD,EAAA,MAAM,UAAA,GAAa,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,aAAa,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,UAAA,CAAW,MAAA,GAAS,KAAM,CAAC,CAAA;AAExE,EAAA,IAAI,OAAO,SAAS,UAAA,EAAY;AAC9B,IAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,IAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AAC1C,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,MAAA,EAAQ,CAAA,EAAA,EAAK,KAAA,CAAM,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AACtE,IAAA,OAAO,KAAA;AAAA,EACT;AAGA,EAAA,OAAO,IAAI,UAAA,CAAW,MAAA,CAAO,IAAA,CAAK,MAAA,EAAQ,QAAQ,CAAC,CAAA;AACrD;AAEA,SAAS,KAAK,MAAA,EAAoC;AAChD,EAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,SAAS,IAAA,EAAM,OAAA,EAAS,QAAQ,MAAA,EAAO;AAChE;AAQO,SAAS,eAAe,GAAA,EAAoC;AACjE,EAAA,IAAI;AACF,IAAA,MAAM,OAAO,GAAA,CAAI,IAAA,EAAK,CAAE,KAAA,CAAM,WAAW,MAAM,CAAA;AAC/C,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AACtC,IAAA,IAAI,SAAA,IAAa,GAAG,OAAO,IAAA;AAC3B,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,eAAA,CAAgB,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,SAAS,CAAC,CAAC,CAAC,CAAA;AAAA,EACvF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF","file":"index.js","sourcesContent":["import { getRegistry } from '@ansh-ui/core'\n\n/**\n * Edition gating and license key verification.\n *\n * ## What this is, honestly\n *\n * This is **not DRM, and it cannot be.** Any check that runs in a browser can be removed by editing\n * the bundle, and any check that runs at build time can be removed by patching the package. Nothing\n * shipped as JavaScript to a client is enforceable. Pretending otherwise would mean building\n * obfuscation and phone-home telemetry that hurts paying customers — slower builds, offline CI\n * failures, privacy concerns — while stopping nobody who was determined.\n *\n * So the design goal is different: **make it easy and obvious to be correctly licensed.** Concretely:\n *\n *  - A signed key proves an entitlement without any network call, so CI works offline and no usage\n *    data leaves the customer's machine.\n *  - Pro components live behind a capability check that produces a clear, linkable error instead of\n *    a mysteriously blank canvas.\n *  - In development, an unlicensed Pro component renders a visible watermark and logs once. In\n *    production it throws at mount. Neither is a puzzle to diagnose.\n *  - Pro code lives in a separate entry point, so a Free-edition bundle never contains it. That is\n *    a genuine benefit for Free users — smaller bundles — rather than a restriction.\n *\n * Enforcement, where it matters, happens at the point of sale and in the license agreement. This\n * module's job is to keep honest customers out of trouble.\n *\n * ## Key format\n *\n * `aur_<base64url(payload)>.<base64url(signature)>`\n *\n * The payload is JSON, so a customer can inspect exactly what they were issued — expiry, seats,\n * edition — without a tool. The signature is Ed25519 over the payload bytes.\n */\n\nexport type Edition = 'free' | 'pro' | 'enterprise'\n\nexport interface LicensePayload {\n  /** Who the licence was issued to. Shown in diagnostics. */\n  licensee: string\n  edition: Edition\n  /** ISO 8601 issue date. */\n  issued: string\n  /**\n   * ISO 8601 expiry, or `null` for a perpetual licence.\n   *\n   * A perpetual licence for a version range is the honest model for a component library: the code a\n   * customer already installed keeps working forever, and the licence governs access to *new*\n   * versions. A licence that switches off working software is hostile.\n   */\n  expires: string | null\n  /** Number of developer seats. Informational — not enforced at runtime. */\n  seats?: number\n  /** Capabilities this key grants beyond the edition's defaults. */\n  grants?: string[]\n  /** Domains the licence covers. Informational. */\n  domains?: string[]\n}\n\nexport interface VerificationResult {\n  valid: boolean\n  payload: LicensePayload | null\n  edition: Edition\n  /** Human-readable explanation when `valid` is false. */\n  reason?: string\n  /** `true` when the signature verified but the licence has expired. */\n  expired?: boolean\n}\n\n/**\n * The Ansh public signing key, raw Ed25519 (32 bytes), base64url.\n *\n * Public by definition — it can only verify, never sign. Shipping it in the package is what makes\n * offline verification possible.\n *\n * This placeholder is the all-zero key, which verifies nothing. It is replaced at release time by\n * the real key; until then `verifyLicense` reports `unconfigured` rather than silently accepting or\n * rejecting everything, so an integration bug can't be mistaken for a licensing one.\n */\nconst PUBLIC_KEY_B64 = 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'\n\nconst KEY_PREFIX = 'aur_'\n\n/** Capabilities each edition grants. */\nconst EDITION_CAPABILITIES: Record<Edition, readonly string[]> = {\n  free: ['effect:core', 'behaviour:core', 'renderer:canvas2d'],\n  pro: [\n    'effect:core',\n    'effect:pro',\n    'behaviour:core',\n    'behaviour:pro',\n    'renderer:canvas2d',\n    'renderer:webgl',\n  ],\n  enterprise: [\n    'effect:core',\n    'effect:pro',\n    'effect:enterprise',\n    'behaviour:core',\n    'behaviour:pro',\n    'renderer:canvas2d',\n    'renderer:webgl',\n    'renderer:webgpu',\n    'worker',\n  ],\n}\n\nlet activeEdition: Edition = 'free'\nlet activePayload: LicensePayload | null = null\n\n/**\n * Verify a licence key.\n *\n * Async because Web Crypto is async. Call it once at application startup (or in a build plugin) and\n * `await` it — the result is cached in module state, so components check a boolean rather than\n * re-verifying.\n *\n * Never throws. A malformed key, an unsupported runtime and a genuinely invalid signature all\n * produce a `VerificationResult` with a `reason`, because a licence problem must not be able to\n * crash an application.\n */\nexport async function verifyLicense(key: string): Promise<VerificationResult> {\n  const trimmed = key.trim()\n\n  if (!trimmed.startsWith(KEY_PREFIX)) {\n    return fail(`Key does not start with \"${KEY_PREFIX}\". Check for a copy-paste error.`)\n  }\n\n  const body = trimmed.slice(KEY_PREFIX.length)\n  const separator = body.lastIndexOf('.')\n  if (separator <= 0) {\n    return fail('Key is missing its signature separator. It may be truncated.')\n  }\n\n  const payloadPart = body.slice(0, separator)\n  const signaturePart = body.slice(separator + 1)\n\n  let payload: LicensePayload\n  let payloadBytes: Uint8Array\n  try {\n    payloadBytes = base64UrlDecode(payloadPart)\n    payload = JSON.parse(new TextDecoder().decode(payloadBytes)) as LicensePayload\n  } catch {\n    return fail('Key payload is not valid base64url-encoded JSON.')\n  }\n\n  if (PUBLIC_KEY_B64 === 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA') {\n    // Distinguish \"we haven't shipped a signing key yet\" from \"your key is bad\". Conflating the two\n    // would send customers to support for a problem that is entirely ours.\n    return {\n      valid: false,\n      payload,\n      edition: 'free',\n      reason:\n        'License verification is unconfigured in this build of @ansh-ui/license. ' +\n        'This is not a problem with your key. See https://ansh.dev/docs/licensing',\n    }\n  }\n\n  let signatureValid: boolean\n  try {\n    signatureValid = await verifySignature(payloadBytes, base64UrlDecode(signaturePart))\n  } catch (error) {\n    return fail(\n      `Signature verification is unavailable in this runtime ` +\n        `(${error instanceof Error ? error.message : 'unknown error'}). ` +\n        `Ed25519 via Web Crypto requires Node 18.4+, Chrome 137+, Firefox 129+ or Safari 17+. ` +\n        `Verify at build time instead if you must support older runtimes.`,\n    )\n  }\n\n  if (!signatureValid) {\n    return fail('Signature does not match. The key has been modified or is not genuine.')\n  }\n\n  const expired = payload.expires !== null && new Date(payload.expires).getTime() < Date.now()\n  if (expired) {\n    return {\n      valid: false,\n      payload,\n      edition: 'free',\n      expired: true,\n      reason:\n        `Licence expired on ${payload.expires}. ` +\n        `Previously-installed versions continue to work; renew to access newer releases.`,\n    }\n  }\n\n  return { valid: true, payload, edition: payload.edition }\n}\n\n/**\n * Activate a licence, granting its capabilities in the registry.\n *\n * This is the single call an application makes. After it resolves, Pro components mount normally\n * and `registry.requireCapability('effect:pro')` succeeds.\n *\n * ```ts\n * import { activateLicense } from '@ansh-ui/license'\n * await activateLicense(process.env.ANSH_LICENSE_KEY!)\n * ```\n */\nexport async function activateLicense(key: string): Promise<VerificationResult> {\n  const result = await verifyLicense(key)\n\n  if (!result.valid) {\n    console.warn(`[ansh] Licence not activated: ${result.reason}`)\n    return result\n  }\n\n  activeEdition = result.edition\n  activePayload = result.payload\n\n  const registry = getRegistry()\n  for (const capability of EDITION_CAPABILITIES[result.edition]) {\n    registry.provide(capability)\n  }\n  for (const grant of result.payload?.grants ?? []) {\n    registry.provide(grant)\n  }\n\n  return result\n}\n\n/**\n * Apply the Free edition explicitly.\n *\n * Called automatically the first time a capability is checked without activation, so Free works with\n * no setup at all. Exposed for tests and for resetting between app instances.\n */\nexport function useFreeEdition(): void {\n  activeEdition = 'free'\n  activePayload = null\n\n  const registry = getRegistry()\n  for (const capability of EDITION_CAPABILITIES.free) registry.provide(capability)\n\n  // Revoke paid capabilities with a message that says what to do, rather than leaving the generic\n  // \"missing capability\" error to speak for itself.\n  const paid = [\n    ...new Set([...EDITION_CAPABILITIES.pro, ...EDITION_CAPABILITIES.enterprise]),\n  ].filter((capability) => !EDITION_CAPABILITIES.free.includes(capability))\n\n  for (const capability of paid) {\n    registry.revoke(\n      capability,\n      'This component requires Ansh Pro. See https://ansh.dev/pro to compare editions.',\n    )\n  }\n}\n\n/** The currently active edition. */\nexport function currentEdition(): Edition {\n  return activeEdition\n}\n\n/** The active licence payload, or `null` on Free. */\nexport function currentLicense(): LicensePayload | null {\n  return activePayload\n}\n\n/** Is a capability available under the active edition? */\nexport function hasCapability(capability: string): boolean {\n  return getRegistry().supports(capability)\n}\n\n// ---------------------------------------------------------------------------\n// Crypto\n// ---------------------------------------------------------------------------\n\nlet cachedKey: CryptoKey | null = null\n\nasync function verifySignature(payload: Uint8Array, signature: Uint8Array): Promise<boolean> {\n  const subtle = globalThis.crypto?.subtle\n  if (!subtle) throw new Error('Web Crypto is unavailable')\n\n  if (!cachedKey) {\n    cachedKey = await subtle.importKey(\n      'raw',\n      base64UrlDecode(PUBLIC_KEY_B64) as unknown as ArrayBuffer,\n      { name: 'Ed25519' },\n      false,\n      ['verify'],\n    )\n  }\n\n  return subtle.verify(\n    { name: 'Ed25519' },\n    cachedKey,\n    signature as unknown as ArrayBuffer,\n    payload as unknown as ArrayBuffer,\n  )\n}\n\n/**\n * base64url → bytes.\n *\n * Hand-rolled rather than using `atob` because base64url uses `-`/`_` instead of `+`/`/` and omits\n * padding, and because `atob` does not exist in every Node context we might run in.\n */\nfunction base64UrlDecode(input: string): Uint8Array {\n  const normalised = input.replace(/-/g, '+').replace(/_/g, '/')\n  const padded = normalised + '='.repeat((4 - (normalised.length % 4)) % 4)\n\n  if (typeof atob === 'function') {\n    const binary = atob(padded)\n    const bytes = new Uint8Array(binary.length)\n    for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i)\n    return bytes\n  }\n\n  // Node without a global `atob` (very old versions, or a stripped runtime).\n  return new Uint8Array(Buffer.from(padded, 'base64'))\n}\n\nfunction fail(reason: string): VerificationResult {\n  return { valid: false, payload: null, edition: 'free', reason }\n}\n\n/**\n * Decode a key's payload **without verifying it**.\n *\n * For diagnostics only — printing \"your licence expires on X\" in a CLI, for instance. Never gate on\n * this: the payload is unauthenticated and trivially forged.\n */\nexport function inspectLicense(key: string): LicensePayload | null {\n  try {\n    const body = key.trim().slice(KEY_PREFIX.length)\n    const separator = body.lastIndexOf('.')\n    if (separator <= 0) return null\n    return JSON.parse(new TextDecoder().decode(base64UrlDecode(body.slice(0, separator))))\n  } catch {\n    return null\n  }\n}\n\nexport { EDITION_CAPABILITIES }\n"]}
+{"version":3,"sources":["../src/base64url.ts","../src/public-key.ts","../src/verify.ts","../src/activation.ts"],"names":[],"mappings":";;;AAMO,SAAS,gBAAgB,KAAA,EAA2B;AACzD,EAAA,MAAM,UAAA,GAAa,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,MAAM,GAAG,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,aAAa,GAAA,CAAI,MAAA,CAAA,CAAQ,IAAK,UAAA,CAAW,MAAA,GAAS,KAAM,CAAC,CAAA;AAExE,EAAA,IAAI,OAAO,SAAS,UAAA,EAAY;AAC9B,IAAA,MAAM,MAAA,GAAS,KAAK,MAAM,CAAA;AAC1B,IAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,MAAA,CAAO,MAAM,CAAA;AAC1C,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,MAAA,EAAQ,CAAA,EAAA,EAAK,KAAA,CAAM,CAAC,CAAA,GAAI,MAAA,CAAO,UAAA,CAAW,CAAC,CAAA;AACtE,IAAA,OAAO,KAAA;AAAA,EACT;AAGA,EAAA,OAAO,IAAI,UAAA,CAAW,MAAA,CAAO,IAAA,CAAK,MAAA,EAAQ,QAAQ,CAAC,CAAA;AACrD;ACAO,IAAM,cAAA,GAEP,6CAAA,CACA;AAEC,IAAM,UAAA,GAAa,MAAA;;;ACnBnB,IAAM,aAAA,GAAgB,+BAAA;AAE7B,IAAM,QAAA,GAA+B,CAAC,MAAA,EAAQ,KAAA,EAAO,YAAY,CAAA;AAa1D,SAAS,cAAc,GAAA,EAA0C;AACtE,EAAA,OAAO,0BAAA,CAA2B,KAAK,cAAc,CAAA;AACvD;AAQA,eAAsB,0BAAA,CACpB,KACA,YAAA,EAC6B;AAC7B,EAAA,MAAM,OAAA,GAAU,IAAI,IAAA,EAAK;AAEzB,EAAA,IAAI,CAAC,OAAA,CAAQ,UAAA,CAAW,UAAU,CAAA,EAAG;AACnC,IAAA,OAAO,IAAA,CAAK,CAAA,yBAAA,EAA4B,UAAU,CAAA,gCAAA,CAAkC,CAAA;AAAA,EACtF;AAEA,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,KAAA,CAAM,UAAA,CAAW,MAAM,CAAA;AAC5C,EAAA,MAAM,SAAA,GAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AACtC,EAAA,IAAI,aAAa,CAAA,EAAG;AAClB,IAAA,OAAO,KAAK,8DAA8D,CAAA;AAAA,EAC5E;AAEA,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,SAAS,CAAA;AAC3C,EAAA,MAAM,aAAA,GAAgB,IAAA,CAAK,KAAA,CAAM,SAAA,GAAY,CAAC,CAAA;AAE9C,EAAA,IAAI,OAAA;AACJ,EAAA,IAAI,YAAA;AACJ,EAAA,IAAI;AACF,IAAA,YAAA,GAAe,gBAAgB,WAAW,CAAA;AAC1C,IAAA,OAAA,GAAU,KAAK,KAAA,CAAM,IAAI,aAAY,CAAE,MAAA,CAAO,YAAY,CAAC,CAAA;AAAA,EAC7D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAK,kDAAkD,CAAA;AAAA,EAChE;AAeA,EAAA,IAAI,cAAA;AACJ,EAAA,IAAI;AACF,IAAA,cAAA,GAAiB,MAAM,eAAA;AAAA,MACrB,YAAA;AAAA,MACA,YAAA;AAAA,MACA,gBAAgB,aAAa;AAAA,KAC/B;AAAA,EACF,SAAS,KAAA,EAAO;AACd,IAAA,OAAO,IAAA;AAAA,MACL,CAAA,uDAAA,EACM,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,UAAU,eAAe,CAAA,wJAAA;AAAA,KAGhE;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,IAAA,OAAO,KAAK,wEAAwE,CAAA;AAAA,EACtF;AAIA,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,IAAY,CAAC,QAAA,CAAS,QAAA,CAAS,OAAA,CAAQ,OAAO,CAAA,EAAG;AAClF,IAAA,OAAO,KAAK,uEAAuE,CAAA;AAAA,EACrF;AAEA,EAAA,IAAI,OAAA,CAAQ,YAAY,IAAA,EAAM;AAC5B,IAAA,MAAM,YAAY,IAAI,IAAA,CAAK,OAAA,CAAQ,OAAO,EAAE,OAAA,EAAQ;AAEpD,IAAA,IAAI,MAAA,CAAO,KAAA,CAAM,SAAS,CAAA,EAAG;AAC3B,MAAA,OAAO,KAAK,CAAA,4CAAA,EAA+C,MAAA,CAAO,OAAA,CAAQ,OAAO,CAAC,CAAA,GAAA,CAAK,CAAA;AAAA,IACzF;AACA,IAAA,IAAI,SAAA,GAAY,IAAA,CAAK,GAAA,EAAI,EAAG;AAC1B,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,KAAA;AAAA,QACP,OAAA;AAAA,QACA,OAAA,EAAS,MAAA;AAAA,QACT,OAAA,EAAS,IAAA;AAAA,QACT,MAAA,EACE,CAAA,mBAAA,EAAsB,OAAA,CAAQ,OAAO,CAAA,iFAAA;AAAA,OAEzC;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,EAAE,KAAA,EAAO,IAAA,EAAM,OAAA,EAAS,OAAA,EAAS,QAAQ,OAAA,EAAQ;AAC1D;AAQO,SAAS,eAAe,GAAA,EAAoC;AACjE,EAAA,IAAI;AACF,IAAA,MAAM,OAAO,GAAA,CAAI,IAAA,EAAK,CAAE,KAAA,CAAM,WAAW,MAAM,CAAA;AAC/C,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,WAAA,CAAY,GAAG,CAAA;AACtC,IAAA,IAAI,SAAA,IAAa,GAAG,OAAO,IAAA;AAC3B,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,eAAA,CAAgB,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,SAAS,CAAC,CAAC,CAAC,CAAA;AAAA,EACvF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAMA,IAAM,YAAA,uBAAmB,GAAA,EAAgC;AAEzD,eAAe,eAAA,CACb,YAAA,EACA,OAAA,EACA,SAAA,EACkB;AAClB,EAAA,MAAM,MAAA,GAAS,WAAW,MAAA,EAAQ,MAAA;AAClC,EAAA,IAAI,CAAC,MAAA,EAAQ,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAExD,EAAA,IAAI,GAAA,GAAM,YAAA,CAAa,GAAA,CAAI,YAAY,CAAA;AACvC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,GAAA,GAAM,MAAA,CAAO,SAAA;AAAA,MACX,KAAA;AAAA,MACA,gBAAgB,YAAY,CAAA;AAAA,MAC5B,EAAE,MAAM,SAAA,EAAU;AAAA,MAClB,KAAA;AAAA,MACA,CAAC,QAAQ;AAAA,KACX;AACA,IAAA,YAAA,CAAa,GAAA,CAAI,cAAc,GAAG,CAAA;AAElC,IAAA,GAAA,CAAI,KAAA,CAAM,MAAM,YAAA,CAAa,MAAA,CAAO,YAAY,CAAC,CAAA;AAAA,EACnD;AAEA,EAAA,OAAO,MAAA,CAAO,MAAA;AAAA,IACZ,EAAE,MAAM,SAAA,EAAU;AAAA,IAClB,MAAM,GAAA;AAAA,IACN,SAAA;AAAA,IACA;AAAA,GACF;AACF;AAEA,SAAS,KAAK,MAAA,EAAoC;AAChD,EAAA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,SAAS,IAAA,EAAM,OAAA,EAAS,QAAQ,MAAA,EAAO;AAChE;ACzKO,IAAM,oBAAA,GAA2D;AAAA,EACtE,IAAA,EAAM,CAAC,aAAA,EAAe,gBAAA,EAAkB,mBAAmB,CAAA;AAAA,EAC3D,GAAA,EAAK;AAAA,IACH,aAAA;AAAA,IACA,YAAA;AAAA,IACA,gBAAA;AAAA,IACA,eAAA;AAAA,IACA,mBAAA;AAAA,IACA;AAAA,GACF;AAAA,EACA,UAAA,EAAY;AAAA,IACV,aAAA;AAAA,IACA,YAAA;AAAA,IACA,mBAAA;AAAA,IACA,gBAAA;AAAA,IACA,eAAA;AAAA,IACA,mBAAA;AAAA,IACA,gBAAA;AAAA,IACA,iBAAA;AAAA,IACA;AAAA;AAEJ;AAEA,IAAI,aAAA,GAAyB,MAAA;AAC7B,IAAI,aAAA,GAAuC,IAAA;AAa3C,eAAsB,gBAAgB,GAAA,EAA0C;AAC9E,EAAA,OAAO,iBAAA,CAAkB,MAAM,aAAA,CAAc,GAAG,CAAC,CAAA;AACnD;AAGO,SAAS,kBAAkB,MAAA,EAAgD;AAChF,EAAA,IAAI,CAAC,OAAO,KAAA,EAAO;AACjB,IAAA,OAAA,CAAQ,IAAA,CAAK,CAAA,8BAAA,EAAiC,MAAA,CAAO,MAAM,CAAA,CAAE,CAAA;AAC7D,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,aAAA,GAAgB,MAAA,CAAO,OAAA;AACvB,EAAA,aAAA,GAAgB,MAAA,CAAO,OAAA;AAEvB,EAAA,MAAM,WAAW,WAAA,EAAY;AAC7B,EAAA,KAAA,MAAW,UAAA,IAAc,oBAAA,CAAqB,MAAA,CAAO,OAAO,CAAA,EAAG;AAC7D,IAAA,QAAA,CAAS,QAAQ,UAAU,CAAA;AAAA,EAC7B;AACA,EAAA,KAAA,MAAW,KAAA,IAAS,MAAA,CAAO,OAAA,EAAS,MAAA,IAAU,EAAC,EAAG;AAChD,IAAA,QAAA,CAAS,QAAQ,KAAK,CAAA;AAAA,EACxB;AAEA,EAAA,OAAO,MAAA;AACT;AAQO,SAAS,cAAA,GAAuB;AACrC,EAAA,aAAA,GAAgB,MAAA;AAChB,EAAA,aAAA,GAAgB,IAAA;AAEhB,EAAA,MAAM,WAAW,WAAA,EAAY;AAC7B,EAAA,KAAA,MAAW,UAAA,IAAc,oBAAA,CAAqB,IAAA,EAAM,QAAA,CAAS,QAAQ,UAAU,CAAA;AAI/E,EAAA,MAAM,IAAA,GAAO;AAAA,IACX,mBAAG,IAAI,GAAA,CAAI,CAAC,GAAG,qBAAqB,GAAA,EAAK,GAAG,oBAAA,CAAqB,UAAU,CAAC;AAAA,GAC9E,CAAE,OAAO,CAAC,UAAA,KAAe,CAAC,oBAAA,CAAqB,IAAA,CAAK,QAAA,CAAS,UAAU,CAAC,CAAA;AAExE,EAAA,KAAA,MAAW,cAAc,IAAA,EAAM;AAC7B,IAAA,QAAA,CAAS,MAAA;AAAA,MACP,UAAA;AAAA,MACA,yCAAyC,aAAa,CAAA,qBAAA;AAAA,KACxD;AAAA,EACF;AACF;AAGO,SAAS,cAAA,GAA0B;AACxC,EAAA,OAAO,aAAA;AACT;AAGO,SAAS,cAAA,GAAwC;AACtD,EAAA,OAAO,aAAA;AACT;AAGO,SAAS,cAAc,UAAA,EAA6B;AACzD,EAAA,OAAO,WAAA,EAAY,CAAE,QAAA,CAAS,UAAU,CAAA;AAC1C","file":"index.js","sourcesContent":["/**\n * base64url → bytes.\n *\n * Hand-rolled rather than using `atob` because base64url uses `-`/`_` instead of `+`/`/` and omits\n * padding, and because `atob` does not exist in every Node context we might run in.\n */\nexport function base64UrlDecode(input: string): Uint8Array {\n  const normalised = input.replace(/-/g, '+').replace(/_/g, '/')\n  const padded = normalised + '='.repeat((4 - (normalised.length % 4)) % 4)\n\n  if (typeof atob === 'function') {\n    const binary = atob(padded)\n    const bytes = new Uint8Array(binary.length)\n    for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i)\n    return bytes\n  }\n\n  // Node without a global `atob` (very old versions, or a stripped runtime).\n  return new Uint8Array(Buffer.from(padded, 'base64'))\n}\n","/**\n * The Ansh public signing key, raw Ed25519 (32 bytes), base64url.\n *\n * Public by definition — it can only verify, never sign. Shipping it in the package is what makes\n * offline verification possible.\n *\n * The real key is injected at build time: `tsup.config.ts` replaces `__ANSH_LICENSE_PUBLIC_KEY__`\n * with the `ANSH_LICENSE_PUBLIC_KEY` environment variable, which `release.yml` sets from a repository\n * secret. A build without it falls back to the all-zero placeholder, which verifies nothing, and\n * `verifyLicense` then reports `unconfigured` rather than silently accepting or rejecting everything,\n * so an integration bug can't be mistaken for a licensing one. `scripts/check-license-key.mjs`\n * refuses to publish a placeholder build.\n */\n\ndeclare const __ANSH_LICENSE_PUBLIC_KEY__: string | undefined\n\nexport const PLACEHOLDER_PUBLIC_KEY = 'AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA'\n\n/** `typeof` guard so running from source (tests, the docs site) works without the define. */\nexport const PUBLIC_KEY_B64: string =\n  typeof __ANSH_LICENSE_PUBLIC_KEY__ === 'string' && __ANSH_LICENSE_PUBLIC_KEY__ !== ''\n    ? __ANSH_LICENSE_PUBLIC_KEY__\n    : PLACEHOLDER_PUBLIC_KEY\n\nexport const KEY_PREFIX = 'aur_'\n","import { base64UrlDecode } from './base64url'\nimport { KEY_PREFIX, PLACEHOLDER_PUBLIC_KEY, PUBLIC_KEY_B64 } from './public-key'\nimport type { Edition, LicensePayload, VerificationResult } from './types'\n\n/** Where licence problems send people. The pricing section lives on the landing page. */\nexport const LICENSING_URL = 'https://ansh.techiesofepi.com'\n\nconst EDITIONS: readonly Edition[] = ['free', 'pro', 'enterprise']\n\n/**\n * Verify a licence key.\n *\n * Async because Web Crypto is async. Call it once at application startup (or in a build plugin) and\n * `await` it — the result is cached in module state, so components check a boolean rather than\n * re-verifying.\n *\n * Never throws. A malformed key, an unsupported runtime and a genuinely invalid signature all\n * produce a `VerificationResult` with a `reason`, because a licence problem must not be able to\n * crash an application.\n */\nexport function verifyLicense(key: string): Promise<VerificationResult> {\n  return verifyLicenseWithPublicKey(key, PUBLIC_KEY_B64)\n}\n\n/**\n * {@link verifyLicense} against an explicit public key.\n *\n * Not re-exported from the package root: the shipped key is the only one a consumer should trust.\n * It exists so the test suite can sign with a throwaway keypair.\n */\nexport async function verifyLicenseWithPublicKey(\n  key: string,\n  publicKeyB64: string,\n): Promise<VerificationResult> {\n  const trimmed = key.trim()\n\n  if (!trimmed.startsWith(KEY_PREFIX)) {\n    return fail(`Key does not start with \"${KEY_PREFIX}\". Check for a copy-paste error.`)\n  }\n\n  const body = trimmed.slice(KEY_PREFIX.length)\n  const separator = body.lastIndexOf('.')\n  if (separator <= 0) {\n    return fail('Key is missing its signature separator. It may be truncated.')\n  }\n\n  const payloadPart = body.slice(0, separator)\n  const signaturePart = body.slice(separator + 1)\n\n  let payload: LicensePayload\n  let payloadBytes: Uint8Array\n  try {\n    payloadBytes = base64UrlDecode(payloadPart)\n    payload = JSON.parse(new TextDecoder().decode(payloadBytes)) as LicensePayload\n  } catch {\n    return fail('Key payload is not valid base64url-encoded JSON.')\n  }\n\n  if (publicKeyB64 === PLACEHOLDER_PUBLIC_KEY) {\n    // Distinguish \"we haven't shipped a signing key yet\" from \"your key is bad\". Conflating the two\n    // would send customers to support for a problem that is entirely ours.\n    return {\n      valid: false,\n      payload,\n      edition: 'free',\n      reason:\n        'License verification is unconfigured in this build of @ansh-ui/license. ' +\n        `This is not a problem with your key. See ${LICENSING_URL}`,\n    }\n  }\n\n  let signatureValid: boolean\n  try {\n    signatureValid = await verifySignature(\n      publicKeyB64,\n      payloadBytes,\n      base64UrlDecode(signaturePart),\n    )\n  } catch (error) {\n    return fail(\n      `Signature verification is unavailable in this runtime ` +\n        `(${error instanceof Error ? error.message : 'unknown error'}). ` +\n        `Ed25519 via Web Crypto requires Node 18.4+, Chrome 137+, Firefox 129+ or Safari 17+. ` +\n        `Verify at build time instead if you must support older runtimes.`,\n    )\n  }\n\n  if (!signatureValid) {\n    return fail('Signature does not match. The key has been modified or is not genuine.')\n  }\n\n  // The signature proves we issued these bytes, not that they're well-formed. Checked after\n  // verification so a forged payload can't probe which shapes we accept.\n  if (!payload || typeof payload !== 'object' || !EDITIONS.includes(payload.edition)) {\n    return fail('Key payload names an unknown edition. It may be from a newer release.')\n  }\n\n  if (payload.expires !== null) {\n    const expiresAt = new Date(payload.expires).getTime()\n    // An unparseable date would otherwise compare as NaN and silently never expire.\n    if (Number.isNaN(expiresAt)) {\n      return fail(`Key payload has an unreadable expiry date (\"${String(payload.expires)}\").`)\n    }\n    if (expiresAt < Date.now()) {\n      return {\n        valid: false,\n        payload,\n        edition: 'free',\n        expired: true,\n        reason:\n          `Licence expired on ${payload.expires}. ` +\n          `Previously-installed versions continue to work; renew to access newer releases.`,\n      }\n    }\n  }\n\n  return { valid: true, payload, edition: payload.edition }\n}\n\n/**\n * Decode a key's payload **without verifying it**.\n *\n * For diagnostics only — printing \"your licence expires on X\" in a CLI, for instance. Never gate on\n * this: the payload is unauthenticated and trivially forged.\n */\nexport function inspectLicense(key: string): LicensePayload | null {\n  try {\n    const body = key.trim().slice(KEY_PREFIX.length)\n    const separator = body.lastIndexOf('.')\n    if (separator <= 0) return null\n    return JSON.parse(new TextDecoder().decode(base64UrlDecode(body.slice(0, separator))))\n  } catch {\n    return null\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Crypto\n// ---------------------------------------------------------------------------\n\nconst importedKeys = new Map<string, Promise<CryptoKey>>()\n\nasync function verifySignature(\n  publicKeyB64: string,\n  payload: Uint8Array,\n  signature: Uint8Array,\n): Promise<boolean> {\n  const subtle = globalThis.crypto?.subtle\n  if (!subtle) throw new Error('Web Crypto is unavailable')\n\n  let key = importedKeys.get(publicKeyB64)\n  if (!key) {\n    key = subtle.importKey(\n      'raw',\n      base64UrlDecode(publicKeyB64) as unknown as ArrayBuffer,\n      { name: 'Ed25519' },\n      false,\n      ['verify'],\n    )\n    importedKeys.set(publicKeyB64, key)\n    // A failed import must not poison the cache for the next attempt.\n    key.catch(() => importedKeys.delete(publicKeyB64))\n  }\n\n  return subtle.verify(\n    { name: 'Ed25519' },\n    await key,\n    signature as unknown as ArrayBuffer,\n    payload as unknown as ArrayBuffer,\n  )\n}\n\nfunction fail(reason: string): VerificationResult {\n  return { valid: false, payload: null, edition: 'free', reason }\n}\n","import { getRegistry } from '@ansh-ui/core'\nimport type { Edition, LicensePayload, VerificationResult } from './types'\nimport { LICENSING_URL, verifyLicense } from './verify'\n\n/** Capabilities each edition grants. */\nexport const EDITION_CAPABILITIES: Record<Edition, readonly string[]> = {\n  free: ['effect:core', 'behaviour:core', 'renderer:canvas2d'],\n  pro: [\n    'effect:core',\n    'effect:pro',\n    'behaviour:core',\n    'behaviour:pro',\n    'renderer:canvas2d',\n    'renderer:webgl',\n  ],\n  enterprise: [\n    'effect:core',\n    'effect:pro',\n    'effect:enterprise',\n    'behaviour:core',\n    'behaviour:pro',\n    'renderer:canvas2d',\n    'renderer:webgl',\n    'renderer:webgpu',\n    'worker',\n  ],\n}\n\nlet activeEdition: Edition = 'free'\nlet activePayload: LicensePayload | null = null\n\n/**\n * Activate a licence, granting its capabilities in the registry.\n *\n * This is the single call an application makes. After it resolves, Pro components mount normally\n * and `registry.requireCapability('effect:pro')` succeeds.\n *\n * ```ts\n * import { activateLicense } from '@ansh-ui/license'\n * await activateLicense(process.env.ANSH_LICENSE_KEY!)\n * ```\n */\nexport async function activateLicense(key: string): Promise<VerificationResult> {\n  return applyVerification(await verifyLicense(key))\n}\n\n/** The registry half of {@link activateLicense}, split out so tests can feed it a result. */\nexport function applyVerification(result: VerificationResult): VerificationResult {\n  if (!result.valid) {\n    console.warn(`[ansh] Licence not activated: ${result.reason}`)\n    return result\n  }\n\n  activeEdition = result.edition\n  activePayload = result.payload\n\n  const registry = getRegistry()\n  for (const capability of EDITION_CAPABILITIES[result.edition]) {\n    registry.provide(capability)\n  }\n  for (const grant of result.payload?.grants ?? []) {\n    registry.provide(grant)\n  }\n\n  return result\n}\n\n/**\n * Apply the Free edition explicitly.\n *\n * Called automatically the first time a capability is checked without activation, so Free works with\n * no setup at all. Exposed for tests and for resetting between app instances.\n */\nexport function useFreeEdition(): void {\n  activeEdition = 'free'\n  activePayload = null\n\n  const registry = getRegistry()\n  for (const capability of EDITION_CAPABILITIES.free) registry.provide(capability)\n\n  // Revoke paid capabilities with a message that says what to do, rather than leaving the generic\n  // \"missing capability\" error to speak for itself.\n  const paid = [\n    ...new Set([...EDITION_CAPABILITIES.pro, ...EDITION_CAPABILITIES.enterprise]),\n  ].filter((capability) => !EDITION_CAPABILITIES.free.includes(capability))\n\n  for (const capability of paid) {\n    registry.revoke(\n      capability,\n      `This component requires Ansh Pro. See ${LICENSING_URL} to compare editions.`,\n    )\n  }\n}\n\n/** The currently active edition. */\nexport function currentEdition(): Edition {\n  return activeEdition\n}\n\n/** The active licence payload, or `null` on Free. */\nexport function currentLicense(): LicensePayload | null {\n  return activePayload\n}\n\n/** Is a capability available under the active edition? */\nexport function hasCapability(capability: string): boolean {\n  return getRegistry().supports(capability)\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ansh-ui/license",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Ansh edition gating and license key verification.",
   "license": "MIT",
   "type": "module",
@@ -25,7 +25,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@ansh-ui/core": "0.2.0"
+    "@ansh-ui/core": "0.3.0"
   },
   "publishConfig": {
     "access": "public"