@askexenow/exe-os 0.9.227 → 0.9.229

package/dist/chunk-D4IVTUNN.js

@@ -0,0 +1,377 @@
+import {
+  EXE_AI_DIR
+} from "./chunk-TNTFEWU5.js";
+
+// src/lib/license.ts
+import { readFileSync, writeFileSync, existsSync, mkdirSync, statSync } from "fs";
+import { randomUUID } from "crypto";
+import path from "path";
+import { jwtVerify, importSPKI } from "jose";
+var LICENSE_PATH = path.join(EXE_AI_DIR, "license.key");
+var CACHE_PATH = path.join(EXE_AI_DIR, "license-cache.json");
+var DEVICE_ID_PATH = path.join(EXE_AI_DIR, "device-id");
+var API_BASE = process.env.EXE_CLOUD_ENDPOINT ?? "https://api.askexe.com";
+var RETRY_DELAY_MS = 500;
+async function fetchRetry(url, init) {
+  try {
+    return await fetch(url, init);
+  } catch {
+    await new Promise((r) => setTimeout(r, RETRY_DELAY_MS));
+    return fetch(url, { ...init, signal: AbortSignal.timeout(1e4) });
+  }
+}
+var LICENSE_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEeHztAMOpR/ZMh+rWuOASjEZ54CGY
+4uj+UqeKCcvtgNHKmOK278HJaJcANe9xAeji8AFYu27q3WtzCi04pHudow==
+-----END PUBLIC KEY-----`;
+var LICENSE_JWT_ALG = "ES256";
+var PLAN_LIMITS = {
+  free: { devices: 1, employees: 1, memories: 5e3 },
+  pro: { devices: 3, employees: 5, memories: 1e5 },
+  team: { devices: 10, employees: 20, memories: 1e6 },
+  agency: { devices: 50, employees: 100, memories: 1e7 },
+  enterprise: { devices: -1, employees: -1, memories: -1 }
+};
+var FREE_LICENSE = {
+  valid: true,
+  plan: "free",
+  email: "",
+  expiresAt: null,
+  deviceLimit: 1,
+  employeeLimit: 1,
+  memoryLimit: 5e3
+};
+function loadDeviceId() {
+  const deviceJsonPath = path.join(EXE_AI_DIR, "device.json");
+  try {
+    if (existsSync(deviceJsonPath)) {
+      const data = JSON.parse(readFileSync(deviceJsonPath, "utf8"));
+      if (data.deviceId) return data.deviceId;
+    }
+  } catch {
+  }
+  try {
+    if (existsSync(DEVICE_ID_PATH)) {
+      const id2 = readFileSync(DEVICE_ID_PATH, "utf8").trim();
+      if (id2) return id2;
+    }
+  } catch {
+  }
+  const id = randomUUID();
+  mkdirSync(EXE_AI_DIR, { recursive: true });
+  writeFileSync(DEVICE_ID_PATH, id, "utf8");
+  return id;
+}
+function loadLicense() {
+  try {
+    if (!existsSync(LICENSE_PATH)) return null;
+    return readFileSync(LICENSE_PATH, "utf8").trim();
+  } catch {
+    return null;
+  }
+}
+function saveLicense(apiKey) {
+  mkdirSync(EXE_AI_DIR, { recursive: true });
+  writeFileSync(LICENSE_PATH, apiKey.trim(), { encoding: "utf8", mode: 384 });
+}
+async function verifyLicenseJwt(token) {
+  try {
+    const key = await importSPKI(LICENSE_PUBLIC_KEY_PEM, LICENSE_JWT_ALG);
+    const { payload } = await jwtVerify(token, key, {
+      algorithms: [LICENSE_JWT_ALG]
+    });
+    const plan = payload.plan ?? "free";
+    const email = payload.sub ?? "";
+    const limits = PLAN_LIMITS[plan] ?? PLAN_LIMITS.free;
+    return {
+      valid: true,
+      plan,
+      email,
+      expiresAt: payload.exp ? new Date(payload.exp * 1e3).toISOString() : null,
+      deviceLimit: limits.devices,
+      employeeLimit: limits.employees,
+      memoryLimit: limits.memories
+    };
+  } catch {
+    return null;
+  }
+}
+async function getCachedLicense() {
+  try {
+    if (!existsSync(CACHE_PATH)) return null;
+    const raw = JSON.parse(readFileSync(CACHE_PATH, "utf8"));
+    if (!raw.token || typeof raw.token !== "string") return null;
+    return await verifyLicenseJwt(raw.token);
+  } catch {
+    return null;
+  }
+}
+function readCachedLicenseToken() {
+  try {
+    if (!existsSync(CACHE_PATH)) return null;
+    const raw = JSON.parse(readFileSync(CACHE_PATH, "utf8"));
+    return typeof raw.token === "string" ? raw.token : null;
+  } catch {
+    return null;
+  }
+}
+function getRawCachedPlan() {
+  try {
+    const token = readCachedLicenseToken();
+    if (!token) return null;
+    const parts = token.split(".");
+    if (parts.length !== 3) return null;
+    const payload = JSON.parse(Buffer.from(parts[1], "base64url").toString());
+    const plan = payload.plan ?? "free";
+    const limits = PLAN_LIMITS[plan] ?? PLAN_LIMITS.free;
+    process.stderr.write(
+      `[license] WARN: using unverified cached plan (API unreachable, JWT expired). Plan: ${plan}
+`
+    );
+    return {
+      valid: true,
+      plan,
+      email: payload.sub ?? "",
+      expiresAt: payload.exp ? new Date(payload.exp * 1e3).toISOString() : null,
+      deviceLimit: limits.devices,
+      employeeLimit: limits.employees,
+      memoryLimit: limits.memories
+    };
+  } catch {
+    return null;
+  }
+}
+function cacheResponse(token) {
+  try {
+    writeFileSync(CACHE_PATH, JSON.stringify({ token }), "utf8");
+  } catch {
+  }
+}
+async function validateViaCFWorker(apiKey, deviceId) {
+  try {
+    const res = await fetchRetry(`${API_BASE}/auth/activate`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ apiKey, deviceId }),
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (!res.ok) return null;
+    const data = await res.json();
+    if (data.error === "device_limit_exceeded") return null;
+    if (!data.valid) return null;
+    if (data.token) {
+      cacheResponse(data.token);
+      const verified = await verifyLicenseJwt(data.token);
+      if (verified) return verified;
+    }
+    const limits = PLAN_LIMITS[data.plan] ?? PLAN_LIMITS.free;
+    return {
+      valid: data.valid,
+      plan: data.plan,
+      email: data.email,
+      expiresAt: data.expiresAt,
+      deviceLimit: limits.devices,
+      employeeLimit: limits.employees,
+      memoryLimit: limits.memories
+    };
+  } catch {
+    return null;
+  }
+}
+async function validateLicense(apiKey, deviceId) {
+  const did = deviceId ?? loadDeviceId();
+  const cfResult = await validateViaCFWorker(apiKey, did);
+  if (cfResult) return cfResult;
+  const cached = await getCachedLicense();
+  if (cached) return cached;
+  const rawFallback = getRawCachedPlan();
+  if (rawFallback) return rawFallback;
+  return { ...FREE_LICENSE, valid: false };
+}
+var CACHE_MAX_AGE_MS = 36e5;
+function getCacheAgeMs() {
+  try {
+    const s = statSync(CACHE_PATH);
+    return Date.now() - s.mtimeMs;
+  } catch {
+    return Infinity;
+  }
+}
+async function checkLicense() {
+  let key = loadLicense();
+  if (!key) {
+    try {
+      const configPath = path.join(EXE_AI_DIR, "config.json");
+      if (existsSync(configPath)) {
+        const raw = JSON.parse(readFileSync(configPath, "utf8"));
+        const cloud = raw.cloud;
+        if (cloud?.apiKey) {
+          key = cloud.apiKey;
+          saveLicense(key);
+        }
+      }
+    } catch {
+    }
+  }
+  if (!key) return FREE_LICENSE;
+  const cached = await getCachedLicense();
+  if (cached && getCacheAgeMs() < CACHE_MAX_AGE_MS) return cached;
+  const deviceId = loadDeviceId();
+  return validateLicense(key, deviceId);
+}
+function isFeatureAllowed(license, feature) {
+  switch (feature) {
+    case "cloud_sync":
+    case "external_agents":
+    case "wiki":
+      return license.plan !== "free";
+    case "unlimited_employees":
+      return license.plan === "team" || license.plan === "agency" || license.plan === "enterprise";
+  }
+}
+function mirrorLicenseKey(apiKey) {
+  const trimmed = apiKey.trim();
+  if (!trimmed) return;
+  saveLicense(trimmed);
+}
+async function assertVpsLicense(opts) {
+  const env = opts?.env ?? process.env;
+  const inProduction = env.NODE_ENV === "production";
+  if (!opts?.force && !inProduction) {
+    return { ...FREE_LICENSE, plan: "free" };
+  }
+  const envKey = env.EXE_LICENSE_KEY?.trim();
+  if (envKey) {
+    saveLicense(envKey);
+  }
+  const apiKey = envKey ?? loadLicense();
+  if (!apiKey) {
+    throw new Error(
+      "License required: set EXE_LICENSE_KEY env var with your exe_sk_* key. Purchase at https://askexe.com. This VPS image refuses to boot without a valid license."
+    );
+  }
+  const deviceId = loadDeviceId();
+  let backendResponse = null;
+  let explicitRejection = false;
+  let transientFailure = false;
+  try {
+    const res = await fetchRetry(`${API_BASE}/auth/activate`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ apiKey, deviceId }),
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (res.ok) {
+      backendResponse = await res.json();
+      if (!backendResponse.valid) explicitRejection = true;
+    } else if (res.status === 401 || res.status === 403) {
+      explicitRejection = true;
+    } else {
+      transientFailure = true;
+    }
+  } catch {
+    transientFailure = true;
+  }
+  if (backendResponse?.valid) {
+    if (backendResponse.token) {
+      cacheResponse(backendResponse.token);
+      const verified = await verifyLicenseJwt(backendResponse.token);
+      if (verified) return verified;
+    }
+    const limits = PLAN_LIMITS[backendResponse.plan] ?? PLAN_LIMITS.free;
+    return {
+      valid: true,
+      plan: backendResponse.plan,
+      email: backendResponse.email,
+      expiresAt: backendResponse.expiresAt,
+      deviceLimit: limits.devices,
+      employeeLimit: limits.employees,
+      memoryLimit: limits.memories
+    };
+  }
+  if (explicitRejection) {
+    throw new Error(
+      `License invalid or expired. Renew at https://askexe.com, then restart. Backend rejected key ending in ...${apiKey.slice(-4)}.`
+    );
+  }
+  if (!transientFailure) {
+    throw new Error(
+      "License validation failed: unknown backend state. Restore network connectivity to https://api.askexe.com and retry."
+    );
+  }
+  const fresh = await getCachedLicense();
+  if (fresh && fresh.valid) return fresh;
+  const graceDays = opts?.offlineGraceDays ?? 7;
+  const graceMs = graceDays * 24 * 60 * 60 * 1e3;
+  try {
+    const token = readCachedLicenseToken();
+    if (token) {
+      const payloadB64 = token.split(".")[1];
+      if (payloadB64) {
+        const payload = JSON.parse(Buffer.from(payloadB64, "base64url").toString());
+        const expMs = (payload.exp ?? 0) * 1e3;
+        if (Date.now() < expMs + graceMs) {
+          const key = await importSPKI(LICENSE_PUBLIC_KEY_PEM, LICENSE_JWT_ALG);
+          const { payload: verified } = await jwtVerify(token, key, {
+            algorithms: [LICENSE_JWT_ALG],
+            clockTolerance: graceDays * 24 * 60 * 60
+          });
+          const plan = verified.plan ?? "free";
+          const limits = PLAN_LIMITS[plan] ?? PLAN_LIMITS.free;
+          return {
+            valid: true,
+            plan,
+            email: verified.sub ?? "",
+            expiresAt: verified.exp ? new Date(verified.exp * 1e3).toISOString() : null,
+            deviceLimit: limits.devices,
+            employeeLimit: limits.employees,
+            memoryLimit: limits.memories
+          };
+        }
+      }
+    }
+  } catch {
+  }
+  throw new Error(
+    `License validation unreachable for more than ${graceDays} days. Restore network connectivity to https://api.askexe.com and retry. This VPS image refuses to boot after the offline grace window.`
+  );
+}
+var _revalTimer = null;
+function startLicenseRevalidation(intervalMs = 36e5) {
+  if (_revalTimer) return;
+  _revalTimer = setInterval(async () => {
+    try {
+      const license = await checkLicense();
+      if (!license.valid) {
+        process.stderr.write("[exe-os] License expired or invalid \u2014 features may be restricted\n");
+      }
+    } catch {
+    }
+  }, intervalMs);
+  if (_revalTimer && typeof _revalTimer === "object" && "unref" in _revalTimer) {
+    _revalTimer.unref();
+  }
+}
+function stopLicenseRevalidation() {
+  if (_revalTimer) {
+    clearInterval(_revalTimer);
+    _revalTimer = null;
+  }
+}
+
+export {
+  LICENSE_PUBLIC_KEY_PEM,
+  PLAN_LIMITS,
+  loadDeviceId,
+  loadLicense,
+  saveLicense,
+  getCachedLicense,
+  readCachedLicenseToken,
+  validateLicense,
+  checkLicense,
+  isFeatureAllowed,
+  mirrorLicenseKey,
+  assertVpsLicense,
+  startLicenseRevalidation,
+  stopLicenseRevalidation
+};