@bhooai/nexus-core 2.0.15 → 2.0.16

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@bhooai/nexus-core",
-    "version": "2.0.15",
+    "version": "2.0.16",
     "publishConfig": {
         "access": "public"
     },
@@ -20,6 +20,7 @@
     "dependencies": {
         "@bhooai/nexus-ai-client": "^2.0.1",
         "@bhooai/nexus-auth": "^2.0.1",
+        "@bhooai/nexus-crypto": "^2.0.15",
         "@bhooai/nexus-data": "^2.0.1",
         "selfsigned": "^5.5.0",
         "zod": "^3.23.8"

package/src/app/createNexusApp.ts

@@ -40,6 +40,7 @@ import { createLazyDb, registerAdminRoutes, RequestLogBuffer } from './adminModu
 import { registerAuthRoutes } from './authModule.js';
 import { issueCsrfToken, getCsrfToken, csrf, authToken, requireRole } from '@bhooai/nexus-auth';
 import { connect } from '@bhooai/nexus-data';
+import { ensureLicense } from '@bhooai/nexus-crypto';
 import { createGateway, createFederatedGateway, graphqlHttpHandler, getExplorerHtml, helloSubgraph, SubscriptionServer } from '@bhooai/nexus-graphql';
 import type { Subgraph, GraphQLContext } from '@bhooai/nexus-graphql';
 
@@ -103,6 +104,19 @@ export async function createNexusApp(opts: CreateNexusAppOptions = {}): Promise<
   const projectRoot = resolve(opts.projectRoot ?? dirname(srcRoot));
   let config = opts.config ?? (await loadConfigAuto({ root: projectRoot }));
 
+  // License check at project start — verify the token (signature via fetched
+  // JWKS + online status) with the authority. On failure the app still boots,
+  // but every request is answered with 402 LICENSE_REQUIRED (middleware below)
+  // instead of crashing — a crashed backend surfaces as an opaque HTTP 500
+  // through dev proxies.
+  let licenseError: string | null = null;
+  try {
+    await ensureLicense({ projectDir: projectRoot });
+  } catch (err) {
+    licenseError = (err as Error).message;
+    console.error(`[${name}] license check failed: ${licenseError}`);
+  }
+
   // ------------------------------------------------------------------
   // Per-app ports: nexus.config.ts `apps[]` is authoritative. The app's own
   // entry (matched by `opts.name`) wins over `server.port`. NEXUS_PORT (set
@@ -516,6 +530,17 @@ export async function createNexusApp(opts: CreateNexusAppOptions = {}): Promise<
     },
   });
 
+  // License gate — when the project-start check failed, answer every request
+  // (except /health) with 402 so the UI can show the license error rather than
+  // an opaque 500 from a crashed backend.
+  if (licenseError) {
+    const message = licenseError;
+    server.use(async (ctx, next) => {
+      if (ctx.path === '/health') return next();
+      ctx.json({ error: { code: 'LICENSE_REQUIRED', message } }, 402);
+    });
+  }
+
   // ------------------------------------------------------------------
   // Realtime WS server — mount discovered ws/*.room.ts handlers (chat lobby)
   // React stack only — future uses live canvas

package/src/errors.ts

@@ -54,9 +54,30 @@ export class PaymentError extends NexusError {
   }
 }
 
+/**
+ * A license failure surfaced by `@bhooai/nexus-crypto` (a plain Error carrying
+ * `code: 'LICENSE_REQUIRED'`). Kept shape-based so core need not import crypto.
+ */
+export class LicenseRequiredError extends NexusError {
+  constructor(message: string, details?: unknown) {
+    super(message, { code: 'LICENSE_REQUIRED', statusCode: 402, details });
+  }
+}
+
+function licenseCodeOf(err: Error): string | undefined {
+  const code = (err as { code?: unknown }).code;
+  return typeof code === 'string' ? code : undefined;
+}
+
 /** Normalize an unknown thrown value into a NexusError. */
 export function toNexusError(err: unknown): NexusError {
   if (err instanceof NexusError) return err;
-  if (err instanceof Error) return new NexusError(err.message, { code: 'NEXUS_ERROR' });
+  if (err instanceof Error) {
+    if (licenseCodeOf(err) === 'LICENSE_REQUIRED') {
+      const hint = (err as { hint?: unknown }).hint;
+      return new LicenseRequiredError(err.message, typeof hint === 'string' ? hint : undefined);
+    }
+    return new NexusError(err.message, { code: 'NEXUS_ERROR' });
+  }
   return new NexusError(String(err));
 }

package/vitest.config.ts

@@ -4,6 +4,7 @@ export default defineProject({
   test: {
     environment: 'node',
     include: ['tests/**/*.test.ts'],
+    env: { NEXUS_LICENSE_KEY: 'nxl_test_master_key_001' },
     globals: false,
   },
 });