@buoy-gg/license 7.0.44 → 7.0.46

package/lib/module/sessionManager.js

@@ -0,0 +1,6 @@
+"use strict";/*!
+* PROPRIETARY — Buoy license enforcement. NOT open source.
+*
+* Copyright (c) Buoy. All rights reserved. Licensed under the Buoy EULA
+* (https://buoy.gg/terms), not an OSS license.
+*/import{getLicenseStorage as p}from"./storage";import{base64urlEncode as f,verifySessionToken as m,SESSION_CLOCK_SKEW_SECONDS as g}from"./sessionToken.js";import{realNow as w}from"./realNow.js";export const SESSION_STORAGE_PREFIX="@buoy/session:";export const SESSION_OFFLINE_GRACE_MS=7*24*60*60*1e3;export const SESSION_REFRESH_LEAD_MS=6*60*60*1e3;export const SESSION_RETRY_MS=5*60*1e3;export const SESSION_CALL_TIMEOUT_MS=15e3;export const DEFAULT_SIGNIN_ORIGIN="https://buoy.gg";const y="buoy:signin";const T=10*60*1e3;export class SessionError extends Error{constructor(e,t){super(t);this.code=e;this.name="SessionError"}}function S(){const s=globalThis;return{fetch:(e,t)=>fetch(e,t),storage:p,now:w,random:e=>{const t=new Uint8Array(e);if(!s.crypto?.getRandomValues)throw new SessionError("not_configured","This platform has no secure random source.");return s.crypto.getRandomValues(t)},sha256:async e=>{if(!s.crypto?.subtle)throw new SessionError("not_configured","Sign-in needs a secure page (https or localhost).");return new Uint8Array(await s.crypto.subtle.digest("SHA-256",e))},openPopup:()=>{if(!s.window?.open)return null;const e=480;const t=640;const i=Math.max(0,(s.window.screenX??0)+((s.window.outerWidth??e)-e)/2);const n=Math.max(0,(s.window.screenY??0)+((s.window.outerHeight??t)-t)/2);return s.window.open("about:blank","buoy-signin",`popup,width=${e},height=${t},left=${i},top=${n}`)},onMessage:e=>{if(!s.window?.addEventListener)return()=>{};const t=i=>e({origin:i.origin,data:i.data});s.window.addEventListener("message",t);return()=>s.window?.removeEventListener("message",t)},withLock:(e,t)=>s.navigator?.locks?s.navigator.locks.request(e,t):t(),watch:e=>{const t=s.window;if(!t?.addEventListener)return()=>{};const i=r=>e.storage(r.key);const n=()=>{if(t.document?.visibilityState!=="hidden")e.wake()};t.addEventListener("storage",i);t.addEventListener("online",e.wake);t.document?.addEventListener?.("visibilitychange",n);return()=>{t.removeEventListener("storage",i);t.removeEventListener("online",e.wake);t.document?.removeEventListener?.("visibilitychange",n)}},setTimer:(e,t)=>setTimeout(e,Math.min(t,2147483647)),clearTimer:e=>clearTimeout(e)}}function k(){const s=globalThis.location;if(!s?.origin||!/^https?:$/.test(s.protocol??""))return void 0;return s.origin}export class SessionManagerImpl{signinOrigin=DEFAULT_SIGNIN_ORIGIN;current=null;claims=null;listeners=new Set;timer=null;refreshing=null;loaded=null;unwatch=null;limitTimer=null;epoch=0;constructor(e){this.deps=e??S();this.audience=k()}get origin(){return this.signinOrigin}configure(e){if(e.audience!==void 0)this.audience=e.audience;if(e.signinOrigin!==void 0)this.signinOrigin=e.signinOrigin.replace(/\/$/,"");this.reset()}__setDeps(e){this.deps=e;this.reset()}reset(){this.unwatch?.();this.unwatch=null;this.epoch+=1;if(this.limitTimer!==null)this.deps.clearTimer(this.limitTimer);this.limitTimer=null;if(this.timer!==null)this.deps.clearTimer(this.timer);this.timer=null;this.current=null;this.claims=null;this.loaded=null;this.refreshing=null}get storageKey(){return SESSION_STORAGE_PREFIX+(this.audience??"")}subscribe(e){this.listeners.add(e);return()=>this.listeners.delete(e)}notify(){for(const e of[...this.listeners]){try{e()}catch(t){console.warn("[Buoy] sign-in listener error:",t)}}}getAccessToken(){const e=this.getStatus();return e.state==="active"&&!e.grace?this.current?.accessToken??null:null}getStatus(){const e=this.claims;if(!e)return{state:"signed_out"};const t=e.exp*1e3;const i=this.deps.now();if(i<(e.iat-g)*1e3)return{state:"signed_out"};if(i<t)return{state:"active",claims:e,grace:false,validUntil:t};if(i<t+SESSION_OFFLINE_GRACE_MS){return{state:"active",claims:e,grace:true,validUntil:t+SESSION_OFFLINE_GRACE_MS}}return{state:"signed_out"}}load(){if(!this.loaded)this.loaded=this.loadOnce();return this.loaded}async loadOnce(){if(!this.audience)return;this.unwatch??=this.deps.watch?.({storage:t=>{if(t===null||t===this.storageKey)void this.sync()},wake:()=>{if(this.claims)void this.refresh()}})??null;const e=await this.read();if(e&&this.adopt(e)){this.notify();this.schedule()}}async sync(){if(!this.audience)return;const e=await this.read();if(!e){if(this.current)this.clearLocal();return}if(e.refreshToken!==this.current?.refreshToken&&this.adopt(e)){this.notify();this.schedule()}}async read(){try{const e=await(await this.deps.storage()).getItem(this.storageKey);if(!e)return null;const t=JSON.parse(e);return t?.v===1&&typeof t.accessToken==="string"&&typeof t.refreshToken==="string"?t:null}catch{return null}}async write(e){const t=await this.deps.storage();if(e)await t.setItem(this.storageKey,JSON.stringify(e));else await t.removeItem(this.storageKey)}adopt(e){if(!this.audience)return false;const t=m(e.accessToken,{audience:this.audience,ignoreTime:true,publicKeyHex:this.deps.publicKeyHex});const i=t.ok?t.claims:null;if(!i)return false;this.current=e;this.claims=i;return true}armLimit(){if(this.limitTimer!==null)this.deps.clearTimer(this.limitTimer);this.limitTimer=null;if(!this.claims)return;const e=this.claims.exp*1e3;const t=this.deps.now();const i=t<e?e:t<e+SESSION_OFFLINE_GRACE_MS?e+SESSION_OFFLINE_GRACE_MS:null;if(i===null)return;this.limitTimer=this.deps.setTimer(()=>{this.limitTimer=null;this.notify();this.armLimit()},i-t)}call(e,t){return new Promise((i,n)=>{const r=this.deps.setTimer(()=>n(new Error("timeout")),SESSION_CALL_TIMEOUT_MS);this.deps.fetch(e,t).then(o=>{this.deps.clearTimer(r);i(o)},o=>{this.deps.clearTimer(r);n(o)})})}schedule(){this.armLimit();if(this.timer!==null)this.deps.clearTimer(this.timer);this.timer=null;if(!this.claims)return;const e=this.claims.exp*1e3-SESSION_REFRESH_LEAD_MS-this.deps.now();this.timer=this.deps.setTimer(()=>{this.timer=null;void this.refresh()},Math.max(0,e))}refresh(e=false){if(!this.refreshing){this.refreshing=this.deps.withLock(this.lockName,()=>this.refreshLocked(e)).catch(()=>this.retryLater()).finally(()=>{this.refreshing=null})}return this.refreshing}get lockName(){return`buoy-session:${this.audience??""}`}async refreshLocked(e){const t=this.epoch;const i=await this.read();if(!i){if(this.current)this.clearLocal();return}if(i.refreshToken!==this.current?.refreshToken){if(this.adopt(i)){this.notify();this.schedule();return}}if(!this.claims)return;if(!e&&this.claims.exp*1e3-this.deps.now()>SESSION_REFRESH_LEAD_MS){this.schedule();return}let n;let r;try{const o=await this.call(`${this.signinOrigin}/api/auth/refresh`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({refresh_token:i.refreshToken,audience:this.audience})});n=o.status;r=await o.json().catch(()=>null)}catch{this.retryLater();return}if(t!==this.epoch)return;if(n===200&&r&&typeof r.access_token==="string"&&typeof r.refresh_token==="string"){const o={v:1,accessToken:r.access_token,refreshToken:r.refresh_token};if(this.adopt(o)){await this.write(o);this.notify();this.schedule();return}}if(n===400||n===401||n===403){await this.write(null);this.clearLocal();return}this.retryLater()}retryLater(){this.armLimit();if(this.timer!==null)this.deps.clearTimer(this.timer);this.timer=this.deps.setTimer(()=>{this.timer=null;void this.refresh(true)},SESSION_RETRY_MS);this.notify()}clearLocal(){if(this.timer!==null)this.deps.clearTimer(this.timer);this.timer=null;if(this.limitTimer!==null)this.deps.clearTimer(this.limitTimer);this.limitTimer=null;this.current=null;this.claims=null;this.notify()}async signIn(){if(!this.audience)throw new SessionError("not_configured","Sign-in needs a web page or a configured app id.");const e=this.deps.openPopup();if(!e)throw new SessionError("popup_blocked","The browser blocked the sign-in window. Allow pop-ups for this site and try again.");try{return await this.signInWith((t,i)=>new Promise((n,r)=>{e.location.href=t;const o=this.deps.now();let c=null;const h=l=>{if(c!==null)this.deps.clearTimer(c);a();l()};const a=this.deps.onMessage(l=>{if(l.origin!==this.signinOrigin)return;const d=l.data;if(!d||d.type!==y||d.state!==i)return;if(typeof d.code==="string")h(()=>n(d.code));else h(()=>r(new SessionError("access_denied","Sign-in was cancelled.")))});const u=()=>{if(e.closed)return h(()=>r(new SessionError("popup_closed","The sign-in window was closed.")));if(this.deps.now()-o>T)return h(()=>r(new SessionError("timeout","Sign-in took too long.")));c=this.deps.setTimer(u,500)};c=this.deps.setTimer(u,500)}))}finally{try{if(!e.closed)e.close()}catch{}}}async signInWith(e){const t=this.audience;if(!t)throw new SessionError("not_configured","Sign-in needs a web page or a configured app id.");const i=f(this.deps.random(32));const n=f(this.deps.random(16));const r=f(await this.deps.sha256(new TextEncoder().encode(i)));const o=`${this.signinOrigin}/auth/authorize?audience=${encodeURIComponent(t)}&code_challenge=${r}&code_challenge_method=S256&state=${n}`;const c=await e(o,n);let h;try{h=await this.call(`${this.signinOrigin}/api/auth/token`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({code:c,code_verifier:i,audience:t})})}catch{throw new SessionError("network","Buoy could not be reached. Check your connection and try again.")}const a=await h.json().catch(()=>null);if(h.status!==200||!a||typeof a.access_token!=="string"||typeof a.refresh_token!=="string"){const l=a&&typeof a.error_description==="string"?a.error_description:"Buoy did not accept this sign-in.";throw new SessionError(h.status===503?"unavailable":"rejected",l)}const u={v:1,accessToken:a.access_token,refreshToken:a.refresh_token};this.epoch+=1;if(!this.adopt(u))throw new SessionError("rejected","Buoy sent a sign-in this app could not check.");await this.write(u);await this.load();this.notify();this.schedule();return this.getStatus()}async signOut(){this.epoch+=1;const e=this.current;this.clearLocal();let t=e;try{await this.deps.withLock(this.lockName,async()=>{t=await this.read()??e;await this.write(null)})}catch{await this.write(null).catch(()=>{})}if(!t)return;try{await this.call(`${this.signinOrigin}/api/auth/revoke`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({refresh_token:t.refreshToken})})}catch{}}}export const SessionManager=new SessionManagerImpl;

package/lib/module/sessionToken.js

@@ -0,0 +1,6 @@
+"use strict";/*!
+* PROPRIETARY — Buoy Pro license enforcement. NOT open source.
+*
+* Copyright (c) Buoy. All rights reserved. Licensed under the Buoy EULA
+* (https://buoy.gg/terms), not an OSS license.
+*/import c from"tweetnacl";import{SESSION_TOKEN_PUBLIC_KEY as m}from"./config.js";import{realNow as T}from"./realNow.js";export const SESSION_TOKEN_PREFIX="buoys1";const v="buoy-session-v1:";const y=1;export const SESSION_CLOCK_SKEW_SECONDS=60;const _=64;const N=["free","pro","business"];const s="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";export function base64urlEncode(t){let e="";let r=0;for(;r+2<t.length;r+=3){const n=t[r]<<16|t[r+1]<<8|t[r+2];e+=s[n>>>18&63]+s[n>>>12&63]+s[n>>>6&63]+s[n&63]}const o=t.length-r;if(o===1){const n=t[r]<<16;e+=s[n>>>18&63]+s[n>>>12&63]}else if(o===2){const n=t[r]<<16|t[r+1]<<8;e+=s[n>>>18&63]+s[n>>>12&63]+s[n>>>6&63]}return e}function g(t){if(!/^[A-Za-z0-9_-]*$/.test(t)||t.length%4===1)return null;const e=[];let r=0;let o=0;for(const n of t){o=o<<6|s.indexOf(n);r+=6;if(r>=8){e.push(o>>>r-8&255);r-=8}}return new Uint8Array(e)}function h(t){if(typeof TextEncoder!=="undefined")return new TextEncoder().encode(t);const e=unescape(encodeURIComponent(t));const r=new Uint8Array(e.length);for(let o=0;o<e.length;o+=1)r[o]=e.charCodeAt(o);return r}function O(t){try{if(typeof TextDecoder!=="undefined")return new TextDecoder("utf-8",{fatal:true}).decode(t);let e="";for(const r of t)e+=String.fromCharCode(r);return decodeURIComponent(escape(e))}catch{return null}}function S(t){const e=t.trim().toLowerCase();const r=new Uint8Array(e.length/2);for(let o=0;o<r.length;o+=1)r[o]=parseInt(e.slice(o*2,o*2+2),16);return r}function k(t){return h(v+t)}function l(t,e=256){return typeof t==="string"&&t.length>0&&t.length<=e}function x(t){return typeof t==="number"&&Number.isInteger(t)&&t>0}function C(t){if(!t||typeof t!=="object"||Array.isArray(t))return null;const e=t;if(!l(e.sid)||!l(e.sub)||!l(e.aud,512))return null;if(e.team!==null&&!l(e.team))return null;if(!N.includes(e.tier))return null;if(e.role!==void 0&&!l(e.role,64))return null;if(e.tools!==void 0&&(!Array.isArray(e.tools)||e.tools.length>256||!e.tools.every(r=>l(r,64)))){return null}if(!x(e.iat)||!x(e.exp)||e.exp<=e.iat)return null;return{v:y,sid:e.sid,sub:e.sub,team:e.team,tier:e.tier,...e.role!==void 0?{role:e.role}:{},...e.tools!==void 0?{tools:[...e.tools]}:{},aud:e.aud,iat:e.iat,exp:e.exp}}export function mintSessionToken(t,e){const r=base64urlEncode(h(JSON.stringify(t)));const{secretKey:o}=c.sign.keyPair.fromSeed(S(e));const n=c.sign.detached(k(r),o);return`${SESSION_TOKEN_PREFIX}.${r}.${base64urlEncode(n)}`}let b=m;export function __setSessionTokenPublicKeyForTests(t){b=t??m}export function isSessionToken(t){return t.startsWith(`${SESSION_TOKEN_PREFIX}.`)}export function verifySessionToken(t,e){const r=e.publicKeyHex??b;if(!r)return{ok:false,reason:"no-key"};const o=typeof t==="string"?t.split("."):[];if(o.length!==3||o[0]!==SESSION_TOKEN_PREFIX)return{ok:false,reason:"malformed"};const[,n,E]=o;const a=g(n);const f=g(E);if(!a||!f||f.length!==_)return{ok:false,reason:"malformed"};try{if(!c.sign.detached.verify(k(n),f,S(r))){return{ok:false,reason:"signature"}}}catch{return{ok:false,reason:"signature"}}const d=O(a);let i;try{i=d===null?null:JSON.parse(d)}catch{return{ok:false,reason:"malformed"}}if(!i||typeof i!=="object"||i.v!==y){return{ok:false,reason:i&&typeof i==="object"?"version":"malformed"}}const u=C(i);if(!u)return{ok:false,reason:"claims"};if(u.aud!==e.audience)return{ok:false,reason:"audience"};if(e.ignoreTime)return{ok:true,claims:u};const p=Math.floor((e.nowMs??T())/1e3);if(p>=u.exp+SESSION_CLOCK_SKEW_SECONDS)return{ok:false,reason:"expired"};if(u.iat>p+SESSION_CLOCK_SKEW_SECONDS)return{ok:false,reason:"not-yet-valid"};return{ok:true,claims:u}}

package/lib/module/syncCredential.js

@@ -0,0 +1,6 @@
+"use strict";/*!
+* PROPRIETARY — Buoy license enforcement. NOT open source.
+*
+* Copyright (c) Buoy. All rights reserved. Licensed under the Buoy EULA
+* (https://buoy.gg/terms), not an OSS license.
+*/import{LicenseManager as r}from"./LicenseManager.js";import{SessionManager as n}from"./sessionManager.js";import{checkDevToken as t,isDevToken as i}from"./devToken.js";export function getSyncCredential(){const o=n.getAccessToken();if(o)return{token:o,origin:n.origin};const e=r.getState().licenseKey;if(e&&i(e)&&r.hasAccountAccess()&&t(e).ok){return{token:e,origin:n.origin}}return null}

package/lib/typescript/commonjs/LicenseManager.d.ts

@@ -14,7 +14,7 @@
  * including a free one (`npx buoy login`). Buy a key at
  * https://buoy.gg or use it free on Saturday and Sunday.
  */
-import type { BuoyTier, LicenseListener } from "./types";
+import type { BuoyTier, TierSource, LicenseListener } from "./types";
 /** Info passed to device registration callback */
 export interface DeviceRegistrationInfo {
     fingerprint: string;
@@ -47,6 +47,7 @@ declare class LicenseManagerImpl {
     private verifiedAt;
     private expiryTimer;
     private removeForegroundListener;
+    private sessionUnsubscribe;
     /**
      * Pending backoff retry after a transient failure (see
      * LICENSE_TRANSIENT_RETRY_DELAYS). At most one is ever outstanding, and it
@@ -101,6 +102,18 @@ declare class LicenseManagerImpl {
      * launch and the account-admission clock see a validated key, and marked
      * quiet so nothing ever revalidates it against a server.
      */
+    /**
+     * A Business team's bot key (serviceKey.ts). Admits as Pro until the token
+     * runs out and trades again an hour before; a deleted key locks at the next
+     * trade. Not cached on disk: CI machines start fresh anyway.
+     */
+    private admitServiceKey;
+    /**
+     * A dev token (devToken.ts). Admits until it runs out: the account-check
+     * clock starts at its issue time, and both last 30 days. A shipped build
+     * refuses it, so a token that slips into one opens nothing.
+     */
+    private admitDevToken;
     private admitToken;
     /**
      * "Don't ask right now": serve the trusted cache if it vouches for this
@@ -134,6 +147,15 @@ declare class LicenseManagerImpl {
      * usable at all is `getAccountAccess()`.
      */
     getTier(): BuoyTier;
+    /**
+     * Which credential decides: the sign-in when there's no admitted key, or
+     * when it grants Pro and the key doesn't; otherwise the key.
+     */
+    private credential;
+    /** What the key alone grants. */
+    private keyTier;
+    /** What the sign-in alone grants, or null when signed out. Business reads as Pro here. */
+    private sessionTier;
     /**
      * Check if the user has Pro features
      */
@@ -147,18 +169,20 @@ declare class LicenseManagerImpl {
      */
     getState(): {
         tier: BuoyTier;
+        tierSource: TierSource;
         isPro: boolean;
         access: import("./accountAccess").AccountAccess;
         isInitialized: boolean;
         isValidating: boolean;
-        tierSource: import("./types").TierSource;
         licenseKey: string | null;
         error: string | null;
         errorKind: "transport" | "verdict" | null;
         expiresAt: Date | null;
     };
     getAccountAccess(): import("./accountAccess").AccountAccess;
+    private getKeyAccess;
     hasAccountAccess(): boolean;
+    private hasKeyAccess;
     private setVerifiedAt;
     /**
      * Subscribe to license events

package/lib/typescript/commonjs/config.d.ts

@@ -47,6 +47,13 @@ export declare const KEYGEN_CONFIG: {
  * Rotating it means a new SDK release, since this ships in the bundle.
  */
 export declare const FREE_TOKEN_PUBLIC_KEY = "3b546fc717a62683f3236c70167899a271bee3ffc04df6ec1eea60a394a2f1e9";
+/**
+ * Ed25519 public key that sign-in access tokens, dev tokens and bot tokens
+ * are verified against (see sessionToken.ts and BUOY_SIGN_IN_PLAN.md). Not a
+ * secret. The private half lives only in the website Worker, as the secret
+ * BUOY_SESSION_PRIVATE_KEY (made 2026-10-02).
+ */
+export declare const SESSION_TOKEN_PUBLIC_KEY = "36abba0267f7f379d992a5b6df641daab4190bcc9e639e36f1378e3c1ac52746";
 /**
  * Keygen policy IDs, which are what decide a key's tier.
  *

package/lib/typescript/commonjs/devToken.d.ts

@@ -0,0 +1,27 @@
+/*!
+ * PROPRIETARY — Buoy license enforcement. NOT open source.
+ *
+ * Copyright (c) Buoy. All rights reserved. Licensed under the Buoy EULA
+ * (https://buoy.gg/terms), not an OSS license.
+ */
+/**
+ * Dev tokens (BUOY_SIGN_IN_PLAN.md 2.3): what `npx buoy login` writes into a
+ * project for dev builds and sims. A sign-in token for the audience "dev",
+ * good for 30 days, checked offline. Only dev builds take it, so one that
+ * slips into a shipped app opens nothing there.
+ */
+import { type SessionClaims } from "./sessionToken";
+/** Keep in step with apps/website signin.server.ts DEV_AUDIENCE. */
+export declare const DEV_AUDIENCE = "dev";
+export declare function isDevToken(key: string): boolean;
+export type DevTokenCheck = {
+    ok: true;
+    claims: SessionClaims;
+} | {
+    ok: false;
+    reason: "invalid" | "expired";
+    message: string;
+};
+export declare function checkDevToken(token: string, now?: number): DevTokenCheck;
+export declare const DEV_TOKEN_IN_RELEASE = "This is a dev token. It only works in dev builds. A live build turns on Buoy with Sign in with Buoy.";
+//# sourceMappingURL=devToken.d.ts.map

package/lib/typescript/commonjs/headless.d.ts

@@ -7,4 +7,13 @@ export { resolveAccountAccess } from "./accountAccess";
 export { signCache, verifyCacheSignature } from "./cacheSignature";
 export { LICENSE_CACHE_DURATION, LICENSE_REVALIDATION_INTERVAL, LICENSE_LAUNCH_VALIDATION_TTL, LICENSE_TRANSIENT_RETRY_DELAYS, KEYGEN_CONFIG } from "./config";
 export type { CachedLicense, BuoyTier, KeygenValidationResponse } from "./types";
+export { createNodeSession, fileSessionStorage, fileLock, receiveCodeOnLoopback, defaultSessionFile, DESKTOP_AUDIENCE, CLI_AUDIENCE, } from "./nodeSession";
+export type { NodeSession, NodeSessionOptions, NodeSessionStorage } from "./nodeSession";
+export { SessionError, SessionManagerImpl, SESSION_OFFLINE_GRACE_MS } from "./sessionManager";
+export type { SessionStatus, SessionErrorCode } from "./sessionManager";
+export { verifySessionToken, mintSessionToken, __setSessionTokenPublicKeyForTests } from "./sessionToken";
+export type { SessionClaims } from "./sessionToken";
+export { exchangeServiceKey, isServiceKey, normalizeLicenseKey, sameLicenseKey, SERVICE_KEY_PREFIX, SERVICE_AUDIENCE } from "./serviceKey";
+export type { ServiceTokenResult } from "./serviceKey";
+export { checkDevToken, isDevToken, DEV_AUDIENCE } from "./devToken";
 //# sourceMappingURL=headless.d.ts.map

package/lib/typescript/commonjs/hooks.d.ts

@@ -17,6 +17,7 @@
  */
 import { LicenseManager } from "./LicenseManager";
 import type { BuoyTier, LicenseState } from "./types";
+import { type SessionStatus } from "./sessionManager";
 /**
  * Why the user currently has Pro access:
  *   - "licensed" → a real, validated license key
@@ -87,4 +88,14 @@ export declare function useProAccess(): {
     isWeekendFree: boolean;
     reason: ProAccessReason;
 };
+/**
+ * The "Sign in with Buoy" state for this site, plus the actions a sign-in
+ * button needs. Call `signIn` straight from a click handler: the popup must
+ * open before anything awaits, or the browser blocks it.
+ */
+export declare function useBuoySession(): {
+    status: SessionStatus;
+    signIn: () => Promise<SessionStatus>;
+    signOut: () => Promise<void>;
+};
 //# sourceMappingURL=hooks.d.ts.map

package/lib/typescript/commonjs/index.d.ts

@@ -33,6 +33,13 @@ export type { ProAccessReason } from "./hooks";
 export { useAccountAccess } from "./hooks";
 export { resolveAccountAccess, type AccountAccess } from "./accountAccess";
 export { LicenseTransportError, isTransientLicenseError } from "./api";
+export { SessionManager, SessionError } from "./sessionManager";
+export type { SessionStatus, SessionErrorCode, SessionConfig } from "./sessionManager";
+export type { SessionClaims, SessionTier } from "./sessionToken";
+export { useBuoySession } from "./hooks";
+export { isServiceKey, normalizeLicenseKey, sameLicenseKey } from "./serviceKey";
+export { isDevToken } from "./devToken";
+export { getSyncCredential } from "./syncCredential";
 export { isBuoyToken } from "./freeToken";
 export { isWeekendFreePro, useWeekendFreePro } from "./weekendPro";
 export type { BuoyTier, TierSource, LicenseState, LicenseEvent, LicenseListener, LicenseValidationResult, CachedLicense, } from "./types";

package/lib/typescript/commonjs/index.web.d.ts

@@ -22,6 +22,13 @@ export type { ProAccessReason } from "./hooks";
 export { useAccountAccess } from "./hooks";
 export { resolveAccountAccess, type AccountAccess } from "./accountAccess";
 export { LicenseTransportError, isTransientLicenseError } from "./api";
+export { SessionManager, SessionError } from "./sessionManager";
+export type { SessionStatus, SessionErrorCode, SessionConfig } from "./sessionManager";
+export type { SessionClaims, SessionTier } from "./sessionToken";
+export { useBuoySession } from "./hooks";
+export { isServiceKey, normalizeLicenseKey, sameLicenseKey } from "./serviceKey";
+export { isDevToken } from "./devToken";
+export { getSyncCredential } from "./syncCredential";
 export { isBuoyToken } from "./freeToken";
 export { isWeekendFreePro, useWeekendFreePro } from "./weekendPro";
 export type { BuoyTier, TierSource, LicenseState, LicenseEvent, LicenseListener, LicenseValidationResult, CachedLicense, } from "./types";

package/lib/typescript/commonjs/nodeSession.d.ts

@@ -0,0 +1,86 @@
+/*!
+ * PROPRIETARY — Buoy license enforcement. NOT open source.
+ *
+ * Copyright (c) Buoy. All rights reserved. Licensed under the Buoy EULA
+ * (https://buoy.gg/terms), not an OSS license.
+ */
+import { SessionManagerImpl, type SessionDeps, type SessionStatus } from "./sessionManager";
+/** First-party app ids buoy.gg signs in without a site list. Keep in step with apps/website signin.server.ts. */
+export declare const DESKTOP_AUDIENCE = "app:gg.buoy.desktop";
+export declare const CLI_AUDIENCE = "app:gg.buoy.cli";
+export interface NodeSessionStorage {
+    getItem(key: string): Promise<string | null>;
+    setItem(key: string, value: string): Promise<void>;
+    removeItem(key: string): Promise<void>;
+}
+/** The default session file for the CLI and the MCP. */
+export declare function defaultSessionFile(): string;
+/** One JSON file holding every audience's pair, written 0600 via a temp file + rename. */
+export declare function fileSessionStorage(file: string): NodeSessionStorage;
+/**
+ * A cross-process lock: an O_EXCL lock file holding its owner's token.
+ *
+ * Only a lock older than LOCK_STALE_MS is taken over (its owner died: a
+ * refresh holds it for one web call, capped at 15 s). Waiting too long gives
+ * up instead, and the caller retries later. Only the owner removes the file,
+ * so a slow owner never deletes someone else's lock.
+ */
+export declare function fileLock(lockFile: string, limits?: {
+    staleMs?: number;
+    waitMs?: number;
+}): SessionDeps["withLock"];
+/**
+ * Waits on 127.0.0.1 for buoy.gg's consent page to POST the code. Resolves
+ * with the URL to open (with `&port=`) and a promise for the code.
+ */
+export declare function receiveCodeOnLoopback(baseUrl: string, state: string, signinOrigin: string, options?: {
+    timeoutMs?: number;
+    signal?: AbortSignal;
+}): Promise<{
+    url: string;
+    code: Promise<string>;
+}>;
+export interface NodeSessionOptions {
+    audience: string;
+    /** Opens the sign-in page in the person's browser. */
+    openBrowser: (url: string) => void | Promise<void>;
+    storage?: NodeSessionStorage;
+    /** Lock file for refreshes. Default: next to the session file. */
+    lockFile?: string;
+    signinOrigin?: string;
+    fetch?: SessionDeps["fetch"];
+    now?: () => number;
+    /** Test seam for the verifier's key. */
+    publicKeyHex?: string;
+}
+export interface NodeSession {
+    manager: SessionManagerImpl;
+    load(): Promise<SessionStatus>;
+    getStatus(): SessionStatus;
+    /** Opens the browser and waits for the person to approve. */
+    signIn(options?: {
+        signal?: AbortSignal;
+        timeoutMs?: number;
+    }): Promise<SessionStatus>;
+    /**
+     * Trades the sign-in for a 30-day dev token, what `buoy login` writes into
+     * a project for dev builds (devToken.ts).
+     */
+    devToken(): Promise<{
+        ok: true;
+        token: string;
+        tier: string;
+    } | {
+        ok: false;
+        detail: string;
+    }>;
+    signOut(): Promise<void>;
+    refresh(force?: boolean): Promise<void>;
+    /** Re-read the session file (another process may have signed in or out). */
+    sync(): Promise<void>;
+    /** Whether buoy.gg has sign-in turned on. False when it can't be reached. */
+    isAvailable(): Promise<boolean>;
+    subscribe(listener: () => void): () => void;
+}
+export declare function createNodeSession(options: NodeSessionOptions): NodeSession;
+//# sourceMappingURL=nodeSession.d.ts.map

package/lib/typescript/commonjs/serviceKey.d.ts

@@ -0,0 +1,55 @@
+/*!
+ * PROPRIETARY — Buoy license enforcement. NOT open source.
+ *
+ * Copyright (c) Buoy. All rights reserved. Licensed under the Buoy EULA
+ * (https://buoy.gg/terms), not an OSS license.
+ */
+/**
+ * Team keys for bots and CI (BUOY_SIGN_IN_PLAN.md 4.4).
+ *
+ * A Business team admin makes a `bsk1_…` key on buoy.gg. A CI build passes
+ * it where a license key goes. It is traded at buoy.gg for a token that lasts
+ * a day and is checked offline like any sign-in token; deleting the key on
+ * buoy.gg stops the next trade, so a bot stops within a day.
+ */
+import { type SessionClaims } from "./sessionToken";
+export declare const SERVICE_KEY_PREFIX = "bsk1_";
+/** Keep in step with apps/website signin.server.ts SERVICE_AUDIENCE. */
+export declare const SERVICE_AUDIENCE = "service";
+export declare function isServiceKey(key: string): boolean;
+/**
+ * A license key as typed: trimmed, and upper-cased unless it is a bot key or
+ * a dev token (`buoys1.…`), whose letters are case-sensitive.
+ */
+export declare function normalizeLicenseKey(key: string): string;
+/**
+ * Whether two typed keys are the same key, compared the way LicenseManager
+ * stores them. Use this, never a plain toUpperCase(): bot keys and dev tokens
+ * are case-sensitive.
+ */
+export declare function sameLicenseKey(a: string | null | undefined, b: string | null | undefined): boolean;
+export type ServiceTokenResult = {
+    ok: true;
+    claims: SessionClaims;
+} | {
+    ok: false;
+    reason: "network" | "rejected";
+    detail: string;
+};
+type FetchLike = (url: string, init: {
+    method: string;
+    headers: Record<string, string>;
+    body: string;
+    signal?: AbortSignal;
+}) => Promise<{
+    status: number;
+    json(): Promise<unknown>;
+}>;
+/** Trades a bot key for a token and checks it. Never throws. */
+export declare function exchangeServiceKey(key: string, options: {
+    origin: string;
+    fetch?: FetchLike;
+    publicKeyHex?: string;
+}): Promise<ServiceTokenResult>;
+export {};
+//# sourceMappingURL=serviceKey.d.ts.map

package/lib/typescript/commonjs/sessionManager.d.ts

@@ -0,0 +1,170 @@
+/*!
+ * PROPRIETARY — Buoy license enforcement. NOT open source.
+ *
+ * Copyright (c) Buoy. All rights reserved. Licensed under the Buoy EULA
+ * (https://buoy.gg/terms), not an OSS license.
+ */
+import { type SessionClaims } from "./sessionToken";
+export declare const SESSION_STORAGE_PREFIX = "@buoy/session:";
+/** How long an expired access token still counts while buoy.gg is unreachable. */
+export declare const SESSION_OFFLINE_GRACE_MS: number;
+/** Refresh once less than this is left on the access token (they last 12 h). */
+export declare const SESSION_REFRESH_LEAD_MS: number;
+/** Retry delay after buoy.gg could not be reached. */
+export declare const SESSION_RETRY_MS: number;
+/** A web call to buoy.gg that takes longer than this counts as offline. */
+export declare const SESSION_CALL_TIMEOUT_MS = 15000;
+export declare const DEFAULT_SIGNIN_ORIGIN = "https://buoy.gg";
+export type SessionStatus = {
+    state: "signed_out";
+} | {
+    state: "active";
+    claims: SessionClaims;
+    /** True when the access token has run out and buoy.gg could not be reached to renew it. */
+    grace: boolean;
+    /** ms; when access stops unless a refresh lands first. */
+    validUntil: number;
+};
+export type SessionErrorCode = "not_configured" | "popup_blocked" | "popup_closed" | "access_denied" | "timeout" | "rejected" | "unavailable" | "network";
+export declare class SessionError extends Error {
+    code: SessionErrorCode;
+    constructor(code: SessionErrorCode, message: string);
+}
+interface StorageLike {
+    getItem(key: string): Promise<string | null>;
+    setItem(key: string, value: string): Promise<void>;
+    removeItem(key: string): Promise<void>;
+}
+interface PopupLike {
+    closed: boolean;
+    close(): void;
+    location: {
+        href: string;
+    };
+}
+/** Everything platform-specific, injectable for tests. */
+export interface SessionDeps {
+    fetch: (url: string, init: {
+        method: string;
+        headers: Record<string, string>;
+        body?: string;
+    }) => Promise<{
+        status: number;
+        json(): Promise<unknown>;
+    }>;
+    storage: () => Promise<StorageLike>;
+    now: () => number;
+    random: (length: number) => Uint8Array;
+    sha256: (bytes: Uint8Array) => Promise<Uint8Array>;
+    /** Opens a blank popup; null when blocked or not a browser. */
+    openPopup: () => PopupLike | null;
+    /** Subscribes to window messages. */
+    onMessage: (handler: (event: {
+        origin: string;
+        data: unknown;
+    }) => void) => () => void;
+    /** Runs `task` while holding a lock shared by every tab of this site. */
+    withLock: <T>(name: string, task: () => Promise<T>) => Promise<T>;
+    setTimer: (fn: () => void, ms: number) => unknown;
+    clearTimer: (handle: unknown) => void;
+    /** Test seam for the verifier's key. */
+    publicKeyHex?: string;
+    /**
+     * Browser only: `storage` when another tab changed saved data (key, or
+     * null for "all cleared"), `wake` when the page is shown again or comes
+     * back online. Node hosts poll `sync()` instead.
+     */
+    watch?: (on: {
+        storage: (key: string | null) => void;
+        wake: () => void;
+    }) => () => void;
+}
+export interface SessionConfig {
+    /** Origin ("https://app.acme.com") or app id ("app:com.acme.app"). Web default: this page's origin. */
+    audience?: string;
+    /** Where buoy.gg lives. Only tests and local development change this. */
+    signinOrigin?: string;
+}
+type Listener = () => void;
+export declare class SessionManagerImpl {
+    private deps;
+    private audience;
+    private signinOrigin;
+    private current;
+    private claims;
+    private listeners;
+    private timer;
+    private refreshing;
+    private loaded;
+    private unwatch;
+    /** Fires when access or the offline grace runs out, so the UI hears it. */
+    private limitTimer;
+    /**
+     * Bumped by sign-in and sign-out. A refresh that started before either
+     * drops its result: a late reply must not sign a signed-out person back in.
+     */
+    private epoch;
+    constructor(deps?: SessionDeps);
+    /** Where buoy.gg is. Bot keys (serviceKey.ts) are traded there too. */
+    get origin(): string;
+    /** Change the audience or buoy.gg origin. Drops what is loaded; call load() again. */
+    configure(config: SessionConfig): void;
+    /** @internal tests */
+    __setDeps(deps: SessionDeps): void;
+    private reset;
+    private get storageKey();
+    subscribe(listener: Listener): () => void;
+    private notify;
+    /**
+     * The current access token, for trading at buoy.gg (the CLI gets a dev
+     * token with it). Null when signed out or past the token's end.
+     */
+    getAccessToken(): string | null;
+    getStatus(): SessionStatus;
+    /** Reads the saved sign-in, if any, and starts keeping it fresh. Safe to call often. */
+    load(): Promise<void>;
+    private loadOnce;
+    /**
+     * Pick up a sign-in or sign-out another process or tab wrote. Cheap: one
+     * storage read, no web call, no lock.
+     */
+    sync(): Promise<void>;
+    private read;
+    private write;
+    /**
+     * Take a stored pair as the current one when its access token is genuine
+     * and for this audience. Its time is judged by getStatus(), not here, so an
+     * expired token still loads and can be refreshed or used in grace.
+     */
+    private adopt;
+    /** Re-arms the timer that tells listeners when access or grace ends. */
+    private armLimit;
+    /** deps.fetch with a time limit; a call that hangs counts as offline. */
+    private call;
+    private schedule;
+    /**
+     * Swap the refresh token for a new pair when it's due (or `force`).
+     * Never throws: failures land in getStatus().
+     */
+    refresh(force?: boolean): Promise<void>;
+    private get lockName();
+    private refreshLocked;
+    private retryLater;
+    private clearLocal;
+    /**
+     * Open the buoy.gg popup and sign in. Call it straight from a click
+     * handler: the popup opens before the first await.
+     */
+    signIn(): Promise<SessionStatus>;
+    /**
+     * The sign-in flow with the code delivery left to the caller: a popup on
+     * the web (signIn above), a loopback port in Node (nodeSession.ts).
+     * `getCode` gets the buoy.gg URL to open and the state it must echo.
+     */
+    signInWith(getCode: (url: string, state: string) => Promise<string>): Promise<SessionStatus>;
+    /** Sign out here and end the sign-in on buoy.gg. */
+    signOut(): Promise<void>;
+}
+export declare const SessionManager: SessionManagerImpl;
+export {};
+//# sourceMappingURL=sessionManager.d.ts.map

package/lib/typescript/commonjs/sessionToken.d.ts

@@ -0,0 +1,64 @@
+/*!
+ * PROPRIETARY — Buoy Pro license enforcement. NOT open source.
+ *
+ * Copyright (c) Buoy. All rights reserved. Licensed under the Buoy EULA
+ * (https://buoy.gg/terms), not an OSS license.
+ */
+export declare const SESSION_TOKEN_PREFIX = "buoys1";
+/** Tolerated difference between the device clock and buoy.gg's, in seconds. */
+export declare const SESSION_CLOCK_SKEW_SECONDS = 60;
+declare const TIERS: readonly ["free", "pro", "business"];
+export type SessionTier = (typeof TIERS)[number];
+export interface SessionClaims {
+    /** Format version. */
+    v: 1;
+    /** Sign-in id: every token from one sign-in shares it, so it can be revoked as one. */
+    sid: string;
+    /** The Buoy account. */
+    sub: string;
+    /** The team, or null for a personal account. */
+    team: string | null;
+    tier: SessionTier;
+    /** Team role, when the team assigns one. */
+    role?: string;
+    /** Tools this person may use, when the team limits them. */
+    tools?: string[];
+    /** The site origin (e.g. "https://app.acme.com") or app id ("app:com.acme.app") it was issued for. */
+    aud: string;
+    /** Issued at, seconds. */
+    iat: number;
+    /** Expires at, seconds. */
+    exp: number;
+}
+export type SessionVerifyFailure = "malformed" | "no-key" | "signature" | "version" | "claims" | "audience" | "expired" | "not-yet-valid";
+export type SessionVerifyResult = {
+    ok: true;
+    claims: SessionClaims;
+} | {
+    ok: false;
+    reason: SessionVerifyFailure;
+};
+export declare function base64urlEncode(bytes: Uint8Array): string;
+/**
+ * Issue a token. Server-side only: needs the private key (32-byte seed, hex).
+ * buoy.gg has its own copy (sessionToken.server.ts); this one is for tests.
+ */
+export declare function mintSessionToken(claims: SessionClaims, privateKeyHex: string): string;
+/** @internal test seam: tests sign with a key they hold the private half of. */
+export declare function __setSessionTokenPublicKeyForTests(hex: string | null): void;
+/** Whether a string has the shape of a sign-in token (not whether it is valid). */
+export declare function isSessionToken(value: string): boolean;
+/**
+ * Check a token offline: signature, shape, audience and time. The clock is
+ * the device's real one (realNow), so @buoy-gg/clock moving the app's time
+ * can't expire or revive a sign-in.
+ */
+export declare function verifySessionToken(token: string, options: {
+    audience: string;
+    nowMs?: number;
+    publicKeyHex?: string;
+    /** Check signature, shape and audience only. For callers that judge time themselves (sessionManager.ts offline grace). */
+    ignoreTime?: boolean;
+}): SessionVerifyResult;
+export {};
+//# sourceMappingURL=sessionToken.d.ts.map

package/lib/typescript/commonjs/syncCredential.d.ts

@@ -0,0 +1,11 @@
+/*!
+ * PROPRIETARY — Buoy license enforcement. NOT open source.
+ *
+ * Copyright (c) Buoy. All rights reserved. Licensed under the Buoy EULA
+ * (https://buoy.gg/terms), not an OSS license.
+ */
+export declare function getSyncCredential(): {
+    token: string;
+    origin: string;
+} | null;
+//# sourceMappingURL=syncCredential.d.ts.map