@arslankhan/doc-forge 0.0.0-stage → 0.1.1

package/CHANGELOG.md

@@ -0,0 +1,11 @@
+# Changelog
+
+## 0.1.0
+
+This version has not been published.
+
+- Prepare the library as an installable ESM package with typed entry points for the core API, the React designer, license checks, and Node.js PDF export.
+- Add a license client that stays unconfigured until a host supplies a public verification key and a license provider. Existing document features stay available while enforcement is off.
+- Document the commercial licensing boundary. The software license itself is still a placeholder.
+
+PDF export through `@arslankhan/doc-forge/pdf` is part of this version. It requires Playwright and Chromium in the host application.

package/LICENSE

@@ -0,0 +1,13 @@
+The software license for DocForge has not been selected.
+
+This file is a placeholder. It is not a grant of rights, and it is not legal advice. No open-source license, commercial license, or support agreement has been reviewed or approved for this package.
+
+Until the owner replaces this file:
+
+- Do not publish the package to npm.
+- Do not treat the package as open source.
+- Do not assume that a customer entitlement, a subscription, or a support agreement is included.
+
+The npm manifest uses the SPDX value `UNLICENSED` for the same reason. Distribution settings, such as the package name and whether the package is public, are separate from both this software license and a customer's purchased feature entitlement.
+
+See LICENSING.md for the technical license-client design and the payment boundary.

package/LICENSING.md

@@ -0,0 +1,80 @@
+# Commercial licensing
+
+This note describes how DocForge is meant to be licensed and sold. It is not legal advice, and it is not a statement that any license has been reviewed or approved. The owner must choose the software license, the commercial terms, and the support terms before publication.
+
+Three different things are easy to mix together:
+
+| Topic | What it controls | Where it lives |
+| --- | --- | --- |
+| Software license | Whether someone may copy, modify, or redistribute the DocForge source and package | `LICENSE`, chosen by the owner |
+| Package distribution | Whether the npm package is public or private, and which name it uses | `package.json` `name` and `npm publish` access |
+| Customer entitlement | Which paid features a customer may use | Signed license token from the license service |
+| Support agreement | Response times, consulting, or other services | A separate contract, not this package |
+
+`package.json` currently uses the SPDX value `UNLICENSED`. That means npm should not treat this package as open source. It does not by itself describe the commercial terms. Replace `LICENSE` and the SPDX value only after the owner has selected the terms.
+
+## What the package does
+
+The license client can activate a key, store a signed token, verify that token, and report feature entitlements. With the default `enforcement: "off"`, every registered feature still reports as available. Existing rendering, invoices, reports, the designer, and PDF export keep working. Nothing in the renderers consults the license client.
+
+Activation stays `unconfigured` until the host supplies all of the following:
+
+- `productId`
+- `issuer`
+- `audience`
+- one or more P-256 public keys (`spki`)
+- a `LicenseProvider` that talks to the real license service
+
+There is no built-in license server URL, payment provider, or private signing key. `createMockLicenseProvider()` is a test double. It cannot mint a token that this package will trust unless the test also produces a signature with a private key that stays outside the package.
+
+## Token verification
+
+Tokens are compact JWS values signed with ES256 (ECDSA P-256 and SHA-256). This package verifies them with Web Crypto and the public key the host configures. The matching private key stays on the license server.
+
+A token is accepted only when all of these checks pass:
+
+- `alg` is exactly `ES256`
+- the signature matches a configured `kid`
+- `iss`, `aud`, and `product` match the host configuration
+- `exp` has not passed, allowing the configured clock skew
+- `entitlements` is an array of feature names
+
+A field such as `isPremium: true` grants nothing. Entitlements that are not in `LICENSE_FEATURES` are reported as unrecognized and are not enabled. The client does not expand a `plan` name through a local table. The license server should put the feature list in the signed `entitlements` claim. `entitlementsForPlan()` is a helper for that server, not an authorization check.
+
+Key rotation: publish the new public key with a new `kid`, include both keys in the client configuration until old tokens expire, then remove the old key. An unknown `kid` is an invalid token.
+
+Revocation: the license service tells the client during activate or refresh. The host can also pass token ids it received from that service as `revokedTokenIds`. A browser-supplied list is only as trustworthy as the browser. Offline, a signature-valid token remains usable until `exp`, and `revocationUnknown` is true. A network failure sets status `network_unavailable`. It does not set `invalid`.
+
+Suggested refresh interval: 24 hours, which is the client default. The token's own `exp` is the hard stop. Choose both when the license server is built.
+
+## Browser and server trust
+
+Anyone can read the React designer bundle and skip a check that runs only in the browser. Client-side `hasFeature()` is a product signal, not source-code protection. Do not rely on it to hide premium algorithms.
+
+For PDF export, verify the license in the Node.js process that calls `@arslankhan/doc-forge/pdf`, or inside the license service that process calls. That process is the trust boundary. The designer bundle does not import Playwright, and browser builds of `@arslankhan/doc-forge/pdf` resolve to an entry that does not import Playwright either.
+
+License records use a host-supplied store. They are not written into template JSON. The browser store uses `localStorage` key `doc-forge-license` only when the host creates it in the browser. Server rendering does not touch `window`.
+
+Do not log license keys or signed tokens. `redactSecret()` keeps only the last four characters of a secret.
+
+## Payments
+
+This package does not collect or store card data, and it does not contain a checkout.
+
+A separate backend should:
+
+1. Receive a payment event from the payment provider.
+2. Verify the webhook signature with the provider's secret. That secret is not part of this npm package.
+3. Store the event id and ignore a duplicate delivery.
+4. Create or update the customer license only after the provider confirms the payment.
+5. Choose entitlements for the paid plan and sign a license token with the private key.
+6. On renewal, sign a new token with a later `exp`.
+7. On cancellation, refund, or chargeback, revoke the token id and stop renewing it. The next online refresh returns `revoked`. Offline copies remain valid until they expire, which is why `exp` and the refresh interval have to be short enough for the product.
+
+A browser redirect to a success page is not a payment confirmation. Do not activate a license from that redirect.
+
+## Feature names
+
+`report.grouping`, `report.aggregates`, `designer.premium`, `styling.premium`, `pdf.export`, `tables.advanced`, and `support.commercial`.
+
+Which plan includes which name is a product decision. Leave enforcement off until that decision is explicit. Turning enforcement on without a valid token makes `hasFeature()` return false. It still does not remove the underlying APIs.