@askexenow/exe-os 0.9.384 → 0.9.387

package/dist/{license-sync-BVSG3WMW.js → license-sync-AXGGCZSG.js}

@@ -1,17 +1,117 @@
 import {
   pgSslConfig
 } from "./chunk-EQSQ4HBW.js";
-import "./chunk-TNS63ATU.js";
+import "./chunk-5SPQBSKC.js";
 import {
   PLAN_LIMITS
 } from "./chunk-A7XLR3K7.js";
-import "./chunk-DZN7SDY2.js";
+import "./chunk-YBD3O77S.js";
 import "./chunk-MMS2HBRT.js";
 import "./chunk-RH4AH3YB.js";
 import "./chunk-HSGBZSCA.js";
 import "./chunk-JKKZGDLP.js";
 import "./chunk-MLKGABMK.js";
 
+// src/shared/gotrue-license.ts
+var GoTrueLicenseError = class extends Error {
+  constructor(status, code) {
+    super(code);
+    this.status = status;
+    this.code = code;
+    this.name = "GoTrueLicenseError";
+  }
+  status;
+  code;
+};
+var plans = /* @__PURE__ */ new Set(["free", "pro", "team", "agency", "enterprise"]);
+var states = /* @__PURE__ */ new Set(["active", "past_due", "cancelled", "revoked"]);
+var uuid = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function validExpiry(value) {
+  return value === null || typeof value === "string" && /^\d{4}-\d{2}-\d{2}T/.test(value) && Number.isFinite(Date.parse(value));
+}
+function hasExpired(expiry, now) {
+  if (expiry === null) return false;
+  const milliseconds = Date.parse(expiry);
+  if (!Number.isFinite(milliseconds)) return true;
+  return milliseconds <= now.getTime();
+}
+function object(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+async function request(env, path, data, method) {
+  const base = env.GOTRUE_LICENSE_URL?.replace(/\/+$/, "");
+  const token = env.GOTRUE_LICENSE_TOKEN;
+  if (!base || !token) throw new GoTrueLicenseError(503, "license_authority_not_configured");
+  let parsed;
+  try {
+    parsed = new URL(base);
+  } catch {
+    throw new GoTrueLicenseError(503, "license_authority_not_configured");
+  }
+  if (parsed.protocol !== "https:") throw new GoTrueLicenseError(503, "license_authority_requires_tls");
+  try {
+    const response = await fetch(`${base}${path}`, {
+      method: method ?? (data === void 0 ? "GET" : "PUT"),
+      headers: { Authorization: `Bearer ${token}`, "Content-Type": "application/json" },
+      body: data === void 0 ? void 0 : JSON.stringify(data),
+      signal: AbortSignal.timeout(1e4),
+      redirect: "error"
+    });
+    if (response.status === 403) throw new GoTrueLicenseError(403, "license_identity_disabled");
+    if (response.status === 404) throw new GoTrueLicenseError(403, "no_license_identity");
+    if (response.status === 409) throw new GoTrueLicenseError(409, "license_write_conflict");
+    if (!response.ok) throw new GoTrueLicenseError(503, "license_authority_unavailable");
+    return object(await response.json());
+  } catch (error) {
+    if (error instanceof GoTrueLicenseError) throw error;
+    throw new GoTrueLicenseError(503, "license_authority_unavailable");
+  }
+}
+async function fetchIdentity(env, identity) {
+  const subject = identity.gotrue_sub?.trim().toLowerCase();
+  if (subject) {
+    if (!uuid.test(subject)) throw new GoTrueLicenseError(403, "invalid_license_identity");
+    const user = await request(env, `/admin/users/${encodeURIComponent(subject)}`);
+    if (user.id !== subject) throw new GoTrueLicenseError(503, "license_identity_mismatch");
+    return user;
+  }
+  const email = identity.email?.trim().toLowerCase();
+  if (!email) throw new GoTrueLicenseError(403, "no_license_identity");
+  const result = await request(env, `/admin/users?filter=${encodeURIComponent(email)}&per_page=1`);
+  const users = Array.isArray(result.users) ? result.users.map(object) : [];
+  const matches = users.filter((user) => typeof user.email === "string" && user.email.toLowerCase() === email && Boolean(user.email_confirmed_at) && typeof user.id === "string" && uuid.test(user.id));
+  if (matches.length !== 1) throw new GoTrueLicenseError(403, "no_license_identity");
+  return matches[0];
+}
+function parseGoTrueLicense(user, now = /* @__PURE__ */ new Date()) {
+  const metadata = object(user.app_metadata);
+  const personalExpiry = metadata.license_expires_at === void 0 ? null : metadata.license_expires_at;
+  const valid = typeof metadata.plan === "string" && plans.has(metadata.plan) && typeof metadata.license_status === "string" && states.has(metadata.license_status) && validExpiry(personalExpiry);
+  const expiry = valid ? personalExpiry : null;
+  const status = !valid ? "missing" : metadata.license_status === "revoked" || metadata.license_status === "cancelled" ? metadata.license_status : hasExpired(expiry, now) ? "expired" : metadata.license_status;
+  const orgLicenses = /* @__PURE__ */ Object.create(null);
+  for (const [id, raw] of Object.entries(object(metadata.org_licenses))) {
+    const grant = object(raw);
+    if (typeof grant.plan !== "string" || !["team", "agency", "enterprise"].includes(grant.plan) || typeof grant.status !== "string" || !states.has(grant.status) || !validExpiry(grant.expires_at)) continue;
+    orgLicenses[id] = { plan: grant.plan, status: grant.status === "revoked" || grant.status === "cancelled" ? grant.status : hasExpired(grant.expires_at, now) ? "expired" : grant.status, expires_at: grant.expires_at };
+  }
+  const revision = Object.fromEntries(["plan", "license_status", "license_expires_at", "license_updated_at"].map((key) => [key, metadata[key] ?? null]));
+  return {
+    subject: String(user.id),
+    plan: valid ? metadata.plan : "free",
+    status,
+    expiresAt: expiry,
+    orgLicenses,
+    ...Object.values(revision).every((value) => value === null || typeof value === "string") ? { revision } : {}
+  };
+}
+async function readGoTrueLicense(env, identity, now = /* @__PURE__ */ new Date()) {
+  return parseGoTrueLicense(await fetchIdentity(env, identity), now);
+}
+function isGoTrueLicenseActive(license) {
+  return license.status === "active";
+}
+
 // src/lib/license-sync.ts
 import { randomBytes } from "crypto";
 var SYNCED_PLANS = ["pro", "team", "agency", "enterprise"];
@@ -19,15 +119,14 @@ var CLOUDFLARE_API_BASE_URL = "https://api.cloudflare.com/client/v4";
 var D1_REQUEST_TIMEOUT_MS = 15e3;
 async function fetchPaidUsersFromD1(config) {
   const url = `${CLOUDFLARE_API_BASE_URL}/accounts/${config.accountId}/d1/database/${config.databaseId}/query`;
-  const placeholders = SYNCED_PLANS.map(() => "?").join(", ");
-  const sql = `SELECT id, email, plan, api_key, org_id, parent_user_id FROM users WHERE plan IN (${placeholders})`;
+  const sql = `SELECT id, email, gotrue_sub, plan, api_key, org_id, parent_user_id FROM users`;
   const res = await fetch(url, {
     method: "POST",
     headers: {
       Authorization: `Bearer ${config.apiToken}`,
       "content-type": "application/json"
     },
-    body: JSON.stringify({ sql, params: [...SYNCED_PLANS] }),
+    body: JSON.stringify({ sql, params: [] }),
     signal: AbortSignal.timeout(D1_REQUEST_TIMEOUT_MS)
   });
   if (!res.ok) {
@@ -43,6 +142,7 @@ async function fetchPaidUsersFromD1(config) {
 }
 function normalizeSourceUser(row) {
   return {
+    gotrue_sub: row.gotrue_sub ? String(row.gotrue_sub) : null,
     id: String(row.id ?? ""),
     email: String(row.email ?? ""),
     plan: row.plan,
@@ -74,20 +174,30 @@ async function detectOrgColumns(pool) {
   );
   return r.rows.length === 2;
 }
-async function syncLicensesFromUsers(users, pool) {
+async function syncLicensesFromUsers(users, pool, authorityEnv = {
+  GOTRUE_LICENSE_URL: process.env.GOTRUE_LICENSE_URL,
+  GOTRUE_LICENSE_TOKEN: process.env.GOTRUE_LICENSE_TOKEN
+}) {
   const result = { inserted: 0, updated: 0, unchanged: 0, orphans: [], errors: [] };
   const hasOrgColumns = await detectOrgColumns(pool);
   const orgCols = hasOrgColumns ? ", org_id, parent_user_id" : "";
   for (const user of users) {
     if (!user.email) continue;
-    const desired = toDesiredLicense(user);
     try {
+      const grant = await readGoTrueLicense(authorityEnv, user);
+      if (!isGoTrueLicenseActive(grant)) {
+        await pool.query("UPDATE billing.licenses SET status = 'revoked' WHERE LOWER(email) = LOWER($1) AND status <> 'revoked'", [user.email]);
+        continue;
+      }
+      const desired = toDesiredLicense({ ...user, plan: grant.plan });
+      await pool.query("UPDATE billing.licenses SET expires_at = $1 WHERE LOWER(email) = LOWER($2) AND expires_at IS DISTINCT FROM $1::timestamp", [grant.expiresAt, user.email]);
       const existing = await pool.query(
         `SELECT id, key, plan, status, device_limit, employee_limit, memory_limit${orgCols}
          FROM billing.licenses WHERE LOWER(email) = LOWER($1) LIMIT 1`,
         [user.email]
       );
       if (existing.rows.length === 0) {
+        if (grant.plan === "free") continue;
         const key = user.api_key && user.api_key.startsWith("exe_sk_") ? user.api_key : generateKey();
         if (hasOrgColumns) {
           await pool.query(
@@ -104,6 +214,7 @@ async function syncLicensesFromUsers(users, pool) {
             [user.email, desired.plan, desired.deviceLimit, desired.employeeLimit, desired.memoryLimit, key]
           );
         }
+        await pool.query("UPDATE billing.licenses SET expires_at = $1 WHERE LOWER(email) = LOWER($2)", [grant.expiresAt, user.email]);
         result.inserted++;
         continue;
       }
@@ -180,7 +291,7 @@ async function reconcileLicenses(users, pool) {
   return report;
 }
 function licenseSyncConfigFromEnv(env = process.env) {
-  if (env.EXE_LICENSE_SYNC_ENABLED === "false") return null;
+  if (env.EXE_LICENSE_SYNC_ENABLED === "false" || !env.GOTRUE_LICENSE_URL || !env.GOTRUE_LICENSE_TOKEN) return null;
   const accountId = env.CLOUDFLARE_ACCOUNT_ID || env.EXE_D1_ACCOUNT_ID;
   const databaseId = env.EXE_D1_DATABASE_ID;
   const apiToken = env.CLOUDFLARE_API_TOKEN || env.EXE_D1_API_TOKEN;

package/dist/{local-secret-inventory-JWNBHZZ4.js → local-secret-inventory-MJT7NJLY.js}

@@ -4,8 +4,8 @@ import {
   inventoryLocalSecretResidue,
   redactLocalSecretResidue,
   redactResiduePathForDisplay
-} from "./chunk-AZSTIAVL.js";
-import "./chunk-ELEGH4DX.js";
+} from "./chunk-VBPYYJPC.js";
+import "./chunk-ZUGQPYUY.js";
 import "./chunk-MMS2HBRT.js";
 import "./chunk-RH4AH3YB.js";
 import "./chunk-HSGBZSCA.js";

package/dist/mcp/register-tools.js

@@ -1,95 +1,95 @@
 import {
   registerAllTools
-} from "../chunk-JJTPPAZY.js";
-import "../chunk-XSUALA32.js";
-import "../chunk-PL4CFSQ7.js";
+} from "../chunk-NR3NACEK.js";
+import "../chunk-PHH6LI6T.js";
+import "../chunk-DI4DONAA.js";
 import "../chunk-557C2IGL.js";
-import "../chunk-FVLNNNH6.js";
-import "../chunk-VF3BZOZK.js";
-import "../chunk-QFAFKEB5.js";
-import "../chunk-3B6FLNLV.js";
-import "../chunk-P3QQ52QK.js";
-import "../chunk-ZT4LFTUJ.js";
-import "../chunk-XUZK23V7.js";
-import "../chunk-I5XIW2BP.js";
-import "../chunk-E7C2WNR5.js";
-import "../chunk-DN3ZR3UE.js";
-import "../chunk-MB47DRF5.js";
+import "../chunk-I4HK2DHC.js";
+import "../chunk-JY6IU2XF.js";
+import "../chunk-BFOLGB4D.js";
+import "../chunk-EZH2LGJX.js";
+import "../chunk-CWWJEMJ5.js";
+import "../chunk-OH5D7YAO.js";
+import "../chunk-5R23LRUP.js";
+import "../chunk-4LGKDHPX.js";
+import "../chunk-7NBSOBWJ.js";
+import "../chunk-IVQGBWJI.js";
+import "../chunk-S6X2K77B.js";
 import "../chunk-PHUHIVD5.js";
-import "../chunk-APL7HUE3.js";
-import "../chunk-MKM6D7JM.js";
-import "../chunk-T5FEAQES.js";
-import "../chunk-U2D6PJ5T.js";
+import "../chunk-I6FI4VPQ.js";
+import "../chunk-H274T3MD.js";
+import "../chunk-BKYIWS2X.js";
+import "../chunk-DOKN63TW.js";
 import "../chunk-2KY7WZZF.js";
 import "../chunk-5MVKTNZP.js";
 import "../chunk-QPTSA4PP.js";
-import "../chunk-CH7BUBP3.js";
-import "../chunk-E3ZM32LF.js";
+import "../chunk-OONTCDVO.js";
+import "../chunk-CDBII52V.js";
 import "../chunk-X2X3IGZU.js";
 import "../chunk-XHU3KOKJ.js";
-import "../chunk-NVFNADTX.js";
+import "../chunk-OP376ITX.js";
 import "../chunk-BV2IET6B.js";
-import "../chunk-KILR4FBR.js";
-import "../chunk-IGJMS7C5.js";
-import "../chunk-VOVFUKEB.js";
+import "../chunk-PIDFJGTO.js";
+import "../chunk-NBRYSWMU.js";
+import "../chunk-GMKDUWTJ.js";
 import "../chunk-ZAEUEDTN.js";
-import "../chunk-AJK2PVQW.js";
-import "../chunk-LR5O2XWZ.js";
-import "../chunk-YLFCH3VA.js";
+import "../chunk-F47NNIP3.js";
+import "../chunk-FHSMIHLQ.js";
+import "../chunk-Q7QD323J.js";
 import "../chunk-DMUOTCDN.js";
 import "../chunk-6FIC57PH.js";
 import "../chunk-3FGBBJYM.js";
-import "../chunk-OBBO6EJR.js";
-import "../chunk-VF2KRROX.js";
-import "../chunk-KTKIFXIP.js";
-import "../chunk-NYLJQ2M2.js";
-import "../chunk-UXN4BICC.js";
-import "../chunk-PRDDPQLC.js";
-import "../chunk-LKTN22L6.js";
+import "../chunk-2ARLSZG4.js";
+import "../chunk-3MF6WQ4C.js";
+import "../chunk-OYDTMTRC.js";
+import "../chunk-NPJDYPEW.js";
+import "../chunk-RVRM6KW5.js";
+import "../chunk-RWN2YDZ4.js";
+import "../chunk-FH7WKTVF.js";
 import "../chunk-S2YTU74T.js";
-import "../chunk-EGOEB42T.js";
-import "../chunk-PWC3C5ME.js";
-import "../chunk-R5E7WNAC.js";
-import "../chunk-P4PIZOL2.js";
-import "../chunk-P3UX5EH4.js";
-import "../chunk-B7AMNZTC.js";
-import "../chunk-CM7N5MBY.js";
-import "../chunk-MROSARM5.js";
+import "../chunk-JIIWN637.js";
+import "../chunk-JW4K6FJA.js";
+import "../chunk-GFBEIPLT.js";
+import "../chunk-GXSDFCON.js";
+import "../chunk-YGSWRRFH.js";
+import "../chunk-OKVEJAZM.js";
+import "../chunk-XDU6WLTZ.js";
+import "../chunk-GIO43XOP.js";
 import "../chunk-3OEVDGIY.js";
-import "../chunk-4YNA3CM6.js";
-import "../chunk-YLB365YX.js";
-import "../chunk-3OX34OC3.js";
+import "../chunk-MEVMJZST.js";
+import "../chunk-UTJN3XEG.js";
+import "../chunk-LPMIQZDB.js";
 import "../chunk-VPHJ2LUI.js";
 import "../chunk-SNHYZYGZ.js";
 import "../chunk-KM6XSFHP.js";
 import "../chunk-YQGMSXT5.js";
-import "../chunk-MC4IM2CC.js";
+import "../chunk-HQFATN5L.js";
 import "../chunk-SSC7EKY2.js";
-import "../chunk-MPZ2AVNS.js";
-import "../chunk-AZSTIAVL.js";
+import "../chunk-AHVXVA46.js";
+import "../chunk-VBPYYJPC.js";
 import "../chunk-U4GMOT4M.js";
 import "../chunk-CBPNZFSU.js";
-import "../chunk-6YDY6ZTD.js";
+import "../chunk-IWRCPC65.js";
 import "../chunk-MMRUBN3I.js";
 import "../chunk-2XZ6X3PJ.js";
 import "../chunk-PMVVUIHH.js";
-import "../chunk-7J2ZQ4XN.js";
-import "../chunk-EYMFVITZ.js";
+import "../chunk-MGWAAKNL.js";
+import "../chunk-MCEUIG26.js";
 import "../chunk-BQEZPRUC.js";
-import "../chunk-GIRD7O5X.js";
-import "../chunk-KXYKSLW4.js";
-import "../chunk-VROK4X2L.js";
+import "../chunk-B7ACMQ2K.js";
+import "../chunk-AOQDY7HP.js";
+import "../chunk-GXQPJA76.js";
 import "../chunk-NEHOQ3P2.js";
-import "../chunk-JA3Y5TV6.js";
+import "../chunk-4K6GSRSY.js";
 import "../chunk-HU3VD4MQ.js";
 import "../chunk-NPXIS2RY.js";
 import "../chunk-SKTAZGFI.js";
 import "../chunk-X2Z5GT3V.js";
-import "../chunk-FMIYFHLE.js";
-import "../chunk-S26CV7BE.js";
+import "../chunk-OT5XROGM.js";
+import "../chunk-HTGSVQJP.js";
 import "../chunk-EIOGV75A.js";
-import "../chunk-3SUPEE6H.js";
-import "../chunk-46VSBDUW.js";
+import "../chunk-S4YBVRQW.js";
+import "../chunk-GN23NAD6.js";
 import "../chunk-Z6BZQHP5.js";
 import "../chunk-GUMRIUI5.js";
 import "../chunk-VGMACSEV.js";
@@ -101,45 +101,45 @@ import "../chunk-QGGH7LOU.js";
 import "../chunk-ZPP63JSQ.js";
 import "../chunk-TWMWHDOY.js";
 import "../chunk-4AR5XKCH.js";
-import "../chunk-3RGTLZNO.js";
-import "../chunk-M4XY4JRK.js";
+import "../chunk-MMHKSDG3.js";
+import "../chunk-YKTJBFWH.js";
 import "../chunk-VMHZSZQJ.js";
-import "../chunk-UOPCVFVR.js";
-import "../chunk-AWWDKF22.js";
+import "../chunk-ZAUHCQYK.js";
+import "../chunk-XK7JO45D.js";
 import "../chunk-CHCA3ZM2.js";
 import "../chunk-OTVEIJUQ.js";
-import "../chunk-VHHX4UCP.js";
-import "../chunk-2FKU4ZEO.js";
-import "../chunk-P2UY34XE.js";
-import "../chunk-XDVOGDBC.js";
-import "../chunk-CYCIX7AW.js";
+import "../chunk-2XCUUS4V.js";
+import "../chunk-6NS3DX36.js";
+import "../chunk-7MYX6M72.js";
+import "../chunk-P2XGESMD.js";
+import "../chunk-RSONCRBT.js";
 import "../chunk-OAFENIHN.js";
-import "../chunk-F4BBMIPG.js";
-import "../chunk-MUCNYSJP.js";
+import "../chunk-RBFPPNXS.js";
+import "../chunk-NRLJOV7M.js";
 import "../chunk-5MOYSU5A.js";
-import "../chunk-ELEGH4DX.js";
+import "../chunk-ZUGQPYUY.js";
 import "../chunk-76CJBM36.js";
 import "../chunk-QLZ46RCK.js";
-import "../chunk-7UHZBVP3.js";
-import "../chunk-6BJCDWSM.js";
-import "../chunk-JDDM6C57.js";
+import "../chunk-TU63ZMMS.js";
+import "../chunk-OH6B7ICF.js";
+import "../chunk-ORHX5E7L.js";
 import "../chunk-ZKGWHT56.js";
-import "../chunk-QNZ4562V.js";
+import "../chunk-VA47XBUX.js";
 import "../chunk-WT4RI36X.js";
 import "../chunk-E23LNUWJ.js";
 import "../chunk-TDF2XKLK.js";
 import "../chunk-EIKATSE4.js";
 import "../chunk-MJCSEIFI.js";
-import "../chunk-ALRHGEAJ.js";
-import "../chunk-PUBA5B4M.js";
+import "../chunk-CI5R7QV7.js";
+import "../chunk-OKQCTYLW.js";
 import "../chunk-VI4ATC6I.js";
 import "../chunk-A27Q27CT.js";
-import "../chunk-LSNBTGW4.js";
+import "../chunk-N5STNP44.js";
 import "../chunk-T5SM4RXY.js";
-import "../chunk-VJEJ7JNB.js";
+import "../chunk-OFCTRALK.js";
 import "../chunk-L5EPGGDP.js";
 import "../chunk-AM7S2TY6.js";
-import "../chunk-BPVFZ6Q4.js";
+import "../chunk-IOIBJY5D.js";
 import "../chunk-CVYC6DUW.js";
 import "../chunk-ANVHWV2X.js";
 import "../chunk-HME6ITKV.js";
@@ -151,19 +151,19 @@ import "../chunk-NLEW62VC.js";
 import "../chunk-IMYGYIAI.js";
 import "../chunk-3DAEZILW.js";
 import "../chunk-DRTJCG6B.js";
-import "../chunk-UX2EO653.js";
+import "../chunk-Z2RU4QH5.js";
 import "../chunk-HYZV25LY.js";
 import "../chunk-GJV3WDWM.js";
 import "../chunk-GL57PO3K.js";
-import "../chunk-P2VVMGMI.js";
+import "../chunk-H2N47OFR.js";
 import "../chunk-ML4S5SHZ.js";
 import "../chunk-MP2AFCGL.js";
 import "../chunk-YRUZK2QA.js";
-import "../chunk-GL47M7NY.js";
+import "../chunk-2GUT5CWI.js";
 import "../chunk-BBMTVAE3.js";
 import "../chunk-TKDITWDN.js";
 import "../chunk-5YEUPUV4.js";
-import "../chunk-72V3S44T.js";
+import "../chunk-QSYY4R6R.js";
 import "../chunk-YYB5PMTK.js";
 import "../chunk-L5CGXEZC.js";
 import "../chunk-QH5ZQ5SJ.js";
@@ -175,9 +175,9 @@ import "../chunk-5U2IJBFV.js";
 import "../chunk-F55P3H4S.js";
 import "../chunk-B6TI3TZT.js";
 import "../chunk-FTZET5YX.js";
-import "../chunk-TNS63ATU.js";
+import "../chunk-5SPQBSKC.js";
 import "../chunk-A7XLR3K7.js";
-import "../chunk-DZN7SDY2.js";
+import "../chunk-YBD3O77S.js";
 import "../chunk-A7JYF4RG.js";
 import "../chunk-ARX6TAGN.js";
 import "../chunk-MMS2HBRT.js";