@carchalabs/seal-electron 0.6.2 → 0.7.0

package/README.md

@@ -1,6 +1,6 @@
 # @carchalabs/seal-electron
 
-The [Carcha Seal](https://seal.carchalabs.com) (formerly LicenseKit) SDK. It runs in the Electron main process or in plain Node. It activates a license key on this device, saves the signed lease, and verifies it offline with your public keys.
+The [Carcha Seal](https://seal.carchalabs.com) SDK. It runs in the Electron main process or in plain Node. It activates a license key on this device, saves the signed lease, and verifies it offline with your public keys.
 
 ```js
 const { Seal } = require('@carchalabs/seal-electron');

package/dist/index.d.ts

@@ -106,10 +106,16 @@ export declare class Seal {
     private emptyState;
     /**
      * The device's public key, sent with activation and check-ins so the server wraps feature keys for
-     * this machine only. Only when the native module verifies for this app (it then also decrypts, with
-     * the matching secret it derives itself) and hardware is not turned off. Never throws.
+     * this machine only. Sent when the native module can also decrypt what is wrapped for it, with the
+     * matching secret it derives itself: through the compiled-in keys when they verify for this app, or,
+     * with seal-hwid 0.5+, through this app's own keys (every hosted vendor, a self-hosted server). Not
+     * with hardware turned off. Never throws.
      */
     private deviceKey;
+    /** The native module's decryption with this app's own keys (seal-hwid 0.5+), or null: older module, none, or hardware off. */
+    private deviceDecrypter;
+    /** This app's public keys as SPKI PEM, for the native module. */
+    private keyPems;
     /**
      * The native verifier, used only when its compiled-in keys include every key this app was given:
      * an app that trusts other keys (a self-hosted server) is checked by the JavaScript verifier alone.
@@ -133,8 +139,9 @@ export declare class Seal {
      * Decrypts data you encrypted for a feature (encryptForFeature in @carchalabs/seal-core, with the
      * feature's content key from the console). Works offline: it uses the saved lease, which must be valid
      * (or in its offline grace period), grant the feature and carry its key, and the saved license key.
-     * The native module does the work when it trusts this app's keys, so the content key never reaches
-     * JavaScript; without it the JavaScript implementation is used. Throws a LicenseError:
+     * When the lease is wrapped for this machine's device key, the native module does the work (with its
+     * compiled-in keys or, seal-hwid 0.5+, this app's keys), so the device secret and the content key never
+     * reach JavaScript; a lease wrapped for the license key alone is opened in JavaScript. Throws a LicenseError:
      * `unlicensed`, a lease failure reason, `clock_suspect`, `feature_not_licensed` or `decrypt_failed`.
      */
     decrypt(feature: string, data: Uint8Array): Promise<Buffer>;

package/dist/index.js

@@ -311,17 +311,20 @@ class Seal {
     }
     /**
      * The device's public key, sent with activation and check-ins so the server wraps feature keys for
-     * this machine only. Only when the native module verifies for this app (it then also decrypts, with
-     * the matching secret it derives itself) and hardware is not turned off. Never throws.
+     * this machine only. Sent when the native module can also decrypt what is wrapped for it, with the
+     * matching secret it derives itself: through the compiled-in keys when they verify for this app, or,
+     * with seal-hwid 0.5+, through this app's own keys (every hosted vendor, a self-hosted server). Not
+     * with hardware turned off. Never throws.
      */
     deviceKey() {
         if (this.deviceKeyCache === undefined) {
             let key = null;
             try {
+                const hwid = this.opts.hardware === false ? null : loadHwid();
                 const native = this.opts.hardware === false ? null : this.native();
-                if (native && typeof native.devicePublicKey === 'function' && typeof native.decryptFeature === 'function') {
-                    key = native.devicePublicKey(`licensekit:${this.opts.product}`);
-                }
+                const decrypts = (native && typeof native.decryptFeature === 'function') || this.deviceDecrypter() !== null;
+                if (hwid && typeof hwid.devicePublicKey === 'function' && decrypts)
+                    key = hwid.devicePublicKey(`licensekit:${this.opts.product}`);
             }
             catch {
                 key = null;
@@ -330,6 +333,17 @@ class Seal {
         }
         return this.deviceKeyCache ? { devicePublicKey: this.deviceKeyCache } : {};
     }
+    /** The native module's decryption with this app's own keys (seal-hwid 0.5+), or null: older module, none, or hardware off. */
+    deviceDecrypter() {
+        if (this.opts.hardware === false)
+            return null;
+        const hwid = loadHwid();
+        return hwid && typeof hwid.decryptFeatureWithKeys === 'function' ? hwid : null;
+    }
+    /** This app's public keys as SPKI PEM, for the native module. */
+    keyPems() {
+        return [...this.keys.values()].map((key) => key.export({ type: 'spki', format: 'pem' }).toString());
+    }
     /**
      * The native verifier, used only when its compiled-in keys include every key this app was given:
      * an app that trusts other keys (a self-hosted server) is checked by the JavaScript verifier alone.
@@ -510,8 +524,9 @@ class Seal {
      * Decrypts data you encrypted for a feature (encryptForFeature in @carchalabs/seal-core, with the
      * feature's content key from the console). Works offline: it uses the saved lease, which must be valid
      * (or in its offline grace period), grant the feature and carry its key, and the saved license key.
-     * The native module does the work when it trusts this app's keys, so the content key never reaches
-     * JavaScript; without it the JavaScript implementation is used. Throws a LicenseError:
+     * When the lease is wrapped for this machine's device key, the native module does the work (with its
+     * compiled-in keys or, seal-hwid 0.5+, this app's keys), so the device secret and the content key never
+     * reach JavaScript; a lease wrapped for the license key alone is opened in JavaScript. Throws a LicenseError:
      * `unlicensed`, a lease failure reason, `clock_suspect`, `feature_not_licensed` or `decrypt_failed`.
      */
     async decrypt(feature, data) {
@@ -581,10 +596,27 @@ class Seal {
         const graceSeconds = state.status === 'grace' ? (claims?.grc ?? (this.opts.graceDays ?? DEFAULT_GRACE_DAYS) * 86400) : 0;
         const check = { product: this.opts.product, fingerprintHash, now: this.nowSec(), ...(graceSeconds ? { graceSeconds } : {}) };
         const native = this.native();
+        // A lease wrapped for this machine's device key (epk) opens only in the native module, which holds the device
+        // secret: through the compiled-in keys when they verify for this app, else through this app's keys (seal-hwid 0.5+).
+        const deviceBound = claims?.epk !== undefined;
+        const withKeys = deviceBound && !(native && typeof native.decryptFeature === 'function') ? this.deviceDecrypter() : null;
+        const pems = withKeys ? this.keyPems() : [];
         return (data) => {
-            const result = native && typeof native.decryptFeature === 'function'
-                ? native.decryptFeature(leased.token, check, leased.licenseKey, feature, Buffer.from(data))
-                : (0, seal_core_1.decryptFeature)(leased.token, { keys: this.keys, ...check }, leased.licenseKey, feature, Buffer.from(data));
+            let result;
+            if (native && typeof native.decryptFeature === 'function') {
+                result = native.decryptFeature(leased.token, check, leased.licenseKey, feature, Buffer.from(data));
+            }
+            else if (withKeys) {
+                try {
+                    result = withKeys.decryptFeatureWithKeys(leased.token, check, pems, leased.licenseKey, feature, Buffer.from(data));
+                }
+                catch {
+                    result = { ok: false, reason: 'decrypt_failed' };
+                }
+            }
+            else {
+                result = (0, seal_core_1.decryptFeature)(leased.token, { keys: this.keys, ...check }, leased.licenseKey, feature, Buffer.from(data));
+            }
             if (result.ok && result.data)
                 return Buffer.from(result.data);
             if (result.reason === 'not_licensed')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@carchalabs/seal-electron",
-  "version": "0.6.2",
+  "version": "0.7.0",
   "description": "Carcha Seal (formerly LicenseKit) SDK for the Electron main process and Node: activation, offline verification, grace period",
   "keywords": ["electron", "licensing", "license-key", "software-licensing", "offline-licensing", "node-locked", "ed25519", "jws", "carcha-seal"],
   "homepage": "https://seal.carchalabs.com/docs/",
@@ -18,7 +18,7 @@
     "@carchalabs/seal-core": "0.5.1"
   },
   "optionalDependencies": {
-    "@carchalabs/seal-hwid": "0.4.1"
+    "@carchalabs/seal-hwid": "0.5.0"
   },
   "engines": { "node": ">=22.13" },
   "publishConfig": { "access": "public" },