@chatpanel/events 0.102.0 → 0.104.0

package/engine.js

@@ -1,131 +1 @@
-// An ENGINE — what actually runs an agent's turns — as a declaration, and its one-line label.
-//
-// The model is a variable, not a constant (architecture-pillars.md §13). An agent card names
-// the engine it runs on, and there are four ways to say it:
-//
-//   { kind: 'model',     providerId?, model }   an endpoint the client calls; `providerId` is
-//                                               the endpoint / gateway destination, because the
-//                                               same model at two providers is two engines
-//   { kind: 'harness',   harnessId, model? }    a CLI coding agent the bridge runs (Claude
-//                                               Code, Codex, …) — ChatPanel delegates a whole
-//                                               task to it; `model` is what it was asked to run
-//   { kind: 'auto',      policy }               the recruiter picks, by policy, from the
-//                                               engine cards (§13.4) — the default
-//   { kind: 'assistant' }                       the built-in Assistant: whatever model the chat
-//                                               is on right now (`engineOf` resolves it)
-//
-// The RECORD keeps a flatter shape — `{ kind: 'model'|'harness', id, model? }`, see
-// scorecard.js `normalizeEngine` — because a record says what DID run, and `auto` and
-// `assistant` never run anything themselves. `engineRef` maps a spec to that shape once a
-// choice was made, so the scorecard's `byEngine` and the model ledger key the same way.
-//
-// Pure, dependency-free; team.js and agent.js both import from here, never from each other.
-
-export const ENGINE_KINDS = Object.freeze(['model', 'harness', 'auto', 'assistant']);
-export const ROUTE_PREFERS = Object.freeze(['cheapest-that-clears', 'best-quality', 'fastest', 'balanced']);
-export const HARNESS_ID_RE = /^[a-zA-Z0-9_.:@+-]{1,120}$/;
-
-const isRecord = (v) => v !== null && typeof v === 'object' && !Array.isArray(v);
-const str = (v, n = 200) => (v == null || v === '' ? undefined : String(v).trim().slice(0, n) || undefined);
-const num = (v) => { const n = Number(v); return v === '' || v == null || !Number.isFinite(n) ? undefined : n; };
-const refs = (xs) => (Array.isArray(xs) ? [...new Set(xs.map((x) => str(typeof x === 'string' ? x : engineKeyOf(x), 200)).filter(Boolean))] : undefined);
-
-/** A routing policy, normalized: an unknown preference is `balanced`; floors and ceilings are numbers or absent. */
-export function normalizePolicy(p) {
-  const src = isRecord(p) ? p : {};
-  const floor = {}; const ceiling = {};
-  const q = num(src.floor?.quality); if (q !== undefined) floor.quality = Math.max(0, Math.min(1, q));
-  const av = num(src.floor?.availability); if (av !== undefined) floor.availability = Math.max(0, Math.min(1, av));
-  const c = num(src.ceiling?.costPerTask); if (c !== undefined && c >= 0) ceiling.costPerTask = c;
-  const l = num(src.ceiling?.latencyMs); if (l !== undefined && l >= 0) ceiling.latencyMs = Math.round(l);
-  const allow = refs(src.allow); const deny = refs(src.deny);
-  return {
-    prefer: ROUTE_PREFERS.includes(src.prefer) ? src.prefer : 'balanced',
-    ...(Object.keys(floor).length ? { floor } : {}),
-    ...(Object.keys(ceiling).length ? { ceiling } : {}),
-    ...(allow?.length ? { allow } : {}),
-    ...(deny?.length ? { deny } : {}),
-  };
-}
-
-/**
- * An engine spec as stored. A string is read the obvious way — `assistant`, `auto`, a
- * `harness:<id>` / `model:<id>` prefix, or a bare model id — because a person types these
- * and a model proposes them in prose. Anything unreadable is `auto`, the honest default.
- */
-export function normalizeEngineSpec(e) {
-  if (e == null || e === '') return { kind: 'auto', policy: normalizePolicy() };
-  if (typeof e === 'string') {
-    const s = e.trim();
-    if (s === 'assistant' || s === 'auto') return s === 'assistant' ? { kind: 'assistant' } : { kind: 'auto', policy: normalizePolicy() };
-    const m = /^(model|harness):(.+)$/.exec(s);
-    if (m) return m[1] === 'harness' ? { kind: 'harness', harnessId: m[2].trim() } : { kind: 'model', model: m[2].trim() };
-    return { kind: 'model', model: s };
-  }
-  if (!isRecord(e)) return { kind: 'auto', policy: normalizePolicy() };
-  const kind = ENGINE_KINDS.includes(e.kind) ? e.kind : (e.harnessId ? 'harness' : e.model ? 'model' : e.policy ? 'auto' : 'auto');
-  if (kind === 'assistant') return { kind };
-  if (kind === 'auto') return { kind, policy: normalizePolicy(e.policy) };
-  if (kind === 'harness') {
-    const harnessId = str(e.harnessId || e.id, 120);
-    if (!harnessId) return { kind: 'auto', policy: normalizePolicy() };
-    const model = str(e.model, 200);
-    return { kind, harnessId, ...(model ? { model } : {}) };
-  }
-  const model = str(e.model || e.id, 200);
-  if (!model) return { kind: 'auto', policy: normalizePolicy() };
-  const providerId = str(e.providerId || e.destination || e.endpointId, 120);
-  return { kind: 'model', ...(providerId ? { providerId } : {}), model };
-}
-
-/** Is this a spec a validator should accept? Returns the errors, with a prefix. */
-export function validateEngineSpec(e, where = 'engine') {
-  const errors = [];
-  if (e == null || e === '') return errors;
-  if (typeof e === 'string') return errors; // every string reads as something
-  if (!isRecord(e)) return [`${where}: a string or an object`];
-  if (e.kind !== undefined && !ENGINE_KINDS.includes(e.kind)) errors.push(`${where}.kind: one of ${ENGINE_KINDS.join(', ')}`);
-  if (e.kind === 'harness' && !str(e.harnessId || e.id)) errors.push(`${where}.harnessId: which harness`);
-  if (e.kind === 'harness' && str(e.harnessId || e.id) && !HARNESS_ID_RE.test(String(e.harnessId || e.id).trim())) errors.push(`${where}.harnessId: a short identifier`);
-  if (e.kind === 'model' && !str(e.model || e.id)) errors.push(`${where}.model: which model`);
-  if (e.kind === 'auto' && e.policy !== undefined && !isRecord(e.policy)) errors.push(`${where}.policy: an object`);
-  if (e.kind === 'auto' && isRecord(e.policy) && e.policy.prefer !== undefined && !ROUTE_PREFERS.includes(e.policy.prefer)) errors.push(`${where}.policy.prefer: one of ${ROUTE_PREFERS.join(', ')}`);
-  return errors;
-}
-
-/**
- * The record's shape for a spec that names something concrete — `{ kind, id, model? }`,
- * the same fields scorecard.js keys `byEngine` on and the model ledger is keyed by. `auto`
- * and `assistant` have no ref: nothing ran yet.
- */
-export function engineRef(spec) {
-  const s = normalizeEngineSpec(spec);
-  if (s.kind === 'harness') return { kind: 'harness', id: s.harnessId, ...(s.model ? { model: s.model } : {}) };
-  if (s.kind === 'model') return s.providerId ? { kind: 'model', id: s.providerId, model: s.model } : { kind: 'model', id: s.model };
-  return null;
-}
-
-/** The ledger key of a spec, or null when it names nothing concrete. Same key as `engineKey` in scorecard.js. */
-export function engineKeyOf(spec) {
-  const r = engineRef(spec);
-  return r ? `${r.kind}:${r.id}${r.model && r.model !== r.id ? `/${r.model}` : ''}` : null;
-}
-
-/** One phrase a person reads on a card: "Claude Code", "gpt-4o at openrouter", "auto · cheapest that clears", "the chat's model". */
-export function describeEngine(spec, { harnessName = (id) => id, providerName = (id) => id } = {}) {
-  const s = normalizeEngineSpec(spec);
-  if (s.kind === 'assistant') return 'the chat’s model';
-  if (s.kind === 'auto') return `auto · ${s.policy.prefer.replace(/-/g, ' ')}`;
-  if (s.kind === 'harness') return `${harnessName(s.harnessId)}${s.model ? ` (${s.model})` : ''}`;
-  return `${s.model}${s.providerId ? ` at ${providerName(s.providerId)}` : ''}`;
-}
-
-/**
- * The role tier today's appointers understand (`cheap` / `balanced` / `strong`) for a spec:
- * the bridge to `prefer` until the recruiter routes by card (§13.4, step 5).
- */
-export function tierOf(spec) {
-  const s = normalizeEngineSpec(spec);
-  if (s.kind !== 'auto') return 'balanced';
-  return { 'best-quality': 'strong', 'cheapest-that-clears': 'cheap', fastest: 'cheap', balanced: 'balanced' }[s.policy.prefer] || 'balanced';
-}
+const f=Object.freeze(["model","harness","auto","assistant"]),p=Object.freeze(["cheapest-that-clears","best-quality","fastest","balanced"]),$=/^[a-zA-Z0-9_.:@+-]{1,120}$/,a=n=>n!==null&&typeof n=="object"&&!Array.isArray(n),s=(n,i=200)=>n==null||n===""?void 0:String(n).trim().slice(0,i)||void 0,l=n=>{const i=Number(n);return n===""||n==null||!Number.isFinite(i)?void 0:i},k=n=>Array.isArray(n)?[...new Set(n.map(i=>s(typeof i=="string"?i:I(i),200)).filter(Boolean))]:void 0;function d(n){const i=a(n)?n:{},t={},e={},r=l(i.floor?.quality);r!==void 0&&(t.quality=Math.max(0,Math.min(1,r)));const o=l(i.floor?.availability);o!==void 0&&(t.availability=Math.max(0,Math.min(1,o)));const c=l(i.ceiling?.costPerTask);c!==void 0&&c>=0&&(e.costPerTask=c);const u=l(i.ceiling?.latencyMs);u!==void 0&&u>=0&&(e.latencyMs=Math.round(u));const h=k(i.allow),y=k(i.deny);return{prefer:p.includes(i.prefer)?i.prefer:"balanced",...Object.keys(t).length?{floor:t}:{},...Object.keys(e).length?{ceiling:e}:{},...h?.length?{allow:h}:{},...y?.length?{deny:y}:{}}}function m(n){if(n==null||n==="")return{kind:"auto",policy:d()};if(typeof n=="string"){const r=n.trim();if(r==="assistant"||r==="auto")return r==="assistant"?{kind:"assistant"}:{kind:"auto",policy:d()};const o=/^(model|harness):(.+)$/.exec(r);return o?o[1]==="harness"?{kind:"harness",harnessId:o[2].trim()}:{kind:"model",model:o[2].trim()}:{kind:"model",model:r}}if(!a(n))return{kind:"auto",policy:d()};const i=f.includes(n.kind)?n.kind:n.harnessId?"harness":n.model?"model":(n.policy,"auto");if(i==="assistant")return{kind:i};if(i==="auto")return{kind:i,policy:d(n.policy)};if(i==="harness"){const r=s(n.harnessId||n.id,120);if(!r)return{kind:"auto",policy:d()};const o=s(n.model,200);return{kind:i,harnessId:r,...o?{model:o}:{}}}const t=s(n.model||n.id,200);if(!t)return{kind:"auto",policy:d()};const e=s(n.providerId||n.destination||n.endpointId,120);return{kind:"model",...e?{providerId:e}:{},model:t}}function b(n,i="engine"){const t=[];return n==null||n===""||typeof n=="string"?t:a(n)?(n.kind!==void 0&&!f.includes(n.kind)&&t.push(`${i}.kind: one of ${f.join(", ")}`),n.kind==="harness"&&!s(n.harnessId||n.id)&&t.push(`${i}.harnessId: which harness`),n.kind==="harness"&&s(n.harnessId||n.id)&&!$.test(String(n.harnessId||n.id).trim())&&t.push(`${i}.harnessId: a short identifier`),n.kind==="model"&&!s(n.model||n.id)&&t.push(`${i}.model: which model`),n.kind==="auto"&&n.policy!==void 0&&!a(n.policy)&&t.push(`${i}.policy: an object`),n.kind==="auto"&&a(n.policy)&&n.policy.prefer!==void 0&&!p.includes(n.policy.prefer)&&t.push(`${i}.policy.prefer: one of ${p.join(", ")}`),t):[`${i}: a string or an object`]}function g(n){const i=m(n);return i.kind==="harness"?{kind:"harness",id:i.harnessId,...i.model?{model:i.model}:{}}:i.kind==="model"?i.providerId?{kind:"model",id:i.providerId,model:i.model}:{kind:"model",id:i.model}:null}function I(n){const i=g(n);return i?`${i.kind}:${i.id}${i.model&&i.model!==i.id?`/${i.model}`:""}`:null}function x(n,{harnessName:i=e=>e,providerName:t=e=>e}={}){const e=m(n);return e.kind==="assistant"?"the chat’s model":e.kind==="auto"?`auto · ${e.policy.prefer.replace(/-/g," ")}`:e.kind==="harness"?`${i(e.harnessId)}${e.model?` (${e.model})`:""}`:`${e.model}${e.providerId?` at ${t(e.providerId)}`:""}`}function E(n){const i=m(n);return i.kind!=="auto"?"balanced":{"best-quality":"strong","cheapest-that-clears":"cheap",fastest:"cheap",balanced:"balanced"}[i.policy.prefer]||"balanced"}export{f as ENGINE_KINDS,$ as HARNESS_ID_RE,p as ROUTE_PREFERS,x as describeEngine,I as engineKeyOf,g as engineRef,m as normalizeEngineSpec,d as normalizePolicy,E as tierOf,b as validateEngineSpec};

package/entitlement.js

@@ -1,332 +1 @@
-// PLANS, GATES AND THE SIGNED ENTITLEMENT — one definition, every client.
-//
-// WHY THIS IS SHARED, and it is the sharpest example in the package. "Is this user Pro" is
-// currently answered in four places: the extension (`js/license.js`), the bridge
-// (`src/entitlement.js`), the gateway (`src/entitlement.js`) and now a desktop app. Three of
-// those already carry their own copy of the SAME public key, which is why `CLAUDE.md` has to
-// warn that rotating the signing key means editing every client by hand.
-//
-// Duplicating a feature matrix is worse than duplicating a helper: it does not fail loudly,
-// it fails as "Pro works in the browser but not on the desktop", which reads to the person
-// paying for it as the product being broken. Defining it once makes the two clients agree
-// BY CONSTRUCTION rather than by diligence.
-//
-// WHAT IS STILL THE CLIENT'S JOB (P8, as everywhere else): storing the licence, minting and
-// keeping an install id, opening a browser for checkout, and counting local usage against
-// the free limits. Those need storage and a platform. Everything here is pure.
-//
-// THE PRIVATE KEY IS NOT HERE AND NEVER WILL BE. The worker holds it; this file holds only
-// the public half, which is what lets every client verify OFFLINE — chat traffic never
-// touches the licence server, and a client that cannot reach the network keeps working.
-
-export class EntitlementError extends Error {
-  constructor(message) { super(message); this.name = 'EntitlementError'; }
-}
-
-export const PLANS = Object.freeze(['free', 'pro', 'team']);
-const RANK = Object.freeze({ free: 0, pro: 1, team: 2 });
-
-/** Where the licence server lives. One base; the endpoints derive from it. */
-export const API_BASE = 'https://api.chatpanel.net';
-export const ENDPOINTS = Object.freeze({
-  verify: `${API_BASE}/license/verify`,
-  entitlement: `${API_BASE}/entitlement`,
-  claim: `${API_BASE}/entitlement/claim`,
-  release: `${API_BASE}/entitlement/release`,
-  restore: `${API_BASE}/restore`,
-});
-
-/**
- * The PUBLIC half of the entitlement signing key.
- *
- * Byte-for-byte the key the extension and bridge already embed. If it is ever rotated it is
- * rotated HERE, and every client that takes this package inherits it on its next sync —
- * which is the entire reason this module exists.
- */
-export const ENTITLEMENT_PUBLIC_JWK = Object.freeze({
-  kty: 'EC',
-  crv: 'P-256',
-  x: 'CmgKLC4e3xDMvwhbjVqF7jbDe1JhC1KKQi8JN3qVX_4',
-  y: 'r40l6fQiyCcJYqW-SvB4VoSyn4F36yhSt82ZAOSo78E',
-});
-
-/** Where "Upgrade" sends people. A stable URL, so pricing can change without a release. */
-export const UPGRADE_URL = 'https://chatpanel.net/#pricing';
-
-export function checkoutUrl(plan = 'pro', installId = '', client = '') {
-  const u = new URL('https://chatpanel.net/');
-  if (installId) u.searchParams.set('install_id', installId);
-  if (plan) u.searchParams.set('plan', plan);
-  // Which client sent them, so a desktop purchase can be attributed and, later, seated
-  // differently from a browser one. Additive: the site ignores what it does not read.
-  if (client) u.searchParams.set('client', client);
-  u.hash = 'pricing';
-  return u.toString();
-}
-
-// --------------------------------------------------------------------------
-// The matrix
-// --------------------------------------------------------------------------
-
-/**
- * Every gated feature → the minimum plan that unlocks it. Anything absent is free.
- *
- * Features a given client cannot perform are still listed: the desktop cannot capture a
- * meeting, but it can READ one, and `liveMeetings` gates the dashboard and history search
- * as well as capture. A client omitting a key it "does not need" is how the two drift.
- */
-export const FEATURE_TIER = Object.freeze({
-  localAgents: 'free',
-  byoModels: 'free',
-  urlContext: 'free',
-  liveMeetings: 'free',
-
-  multiTab: 'pro',
-  unlimitedAgents: 'pro',
-  customSkills: 'pro',
-  customAgents: 'pro',
-  advancedAgent: 'pro',
-  unlimitedNotes: 'pro',
-  unlimitedMeetings: 'pro',
-  structuredInsert: 'pro',
-  exportChats: 'pro',
-  autoBackup: 'pro',
-  promptLibrary: 'pro',
-  fileAttachments: 'pro',
-  watch: 'pro',
-
-  cloudSync: 'team',
-  sharedLibrary: 'team',
-  hostedBridge: 'team',
-  sso: 'team',
-});
-
-export const PRO_FEATURES = Object.freeze({
-  unlimitedNotes: 'Unlimited notes — Free keeps your first 10',
-  unlimitedMeetings: 'Unlimited meetings — Free keeps your first 10',
-  multiTab: 'Attach several tabs at once',
-  unlimitedAgents: 'Unlimited custom agents',
-  customSkills: 'Create & edit your own skills',
-  advancedAgent: 'Per-agent system prompts & working directories',
-  structuredInsert: 'Clean diagrams on Excalidraw, draw.io & tldraw — shapes placed as data, not pixel-drawn',
-  exportChats: 'Export conversations as Markdown',
-  autoBackup: 'Automatic daily backup of all your data to disk',
-  watch: 'Watch a page & act on changes — the agent reacts as the page updates',
-});
-
-export const TEAM_FEATURES = Object.freeze({
-  cloudSync: 'Sync chats across your devices',
-  sharedLibrary: 'Shared team agents & skills',
-  hostedBridge: 'Hosted agents — no local bridge to run',
-  sso: 'SSO & admin controls',
-});
-
-/** Free-tier ceilings. LIFETIME counts where noted — see the anti-cheat note in each client. */
-export const FREE_LIMITS = Object.freeze({
-  notes: 10,
-  meetings: 10,
-  apiEndpoints: 1,
-  bridgeAgents: 1,
-  customAgents: 1,
-  attachmentsPerMessage: 1,
-  mcpServers: 1,
-  gatewayDestinations: 1,
-  webSearchEngines: 3,
-  webSearchesPerDay: 50,
-  fullRedactions: 25,
-});
-
-// --------------------------------------------------------------------------
-// Resolution
-// --------------------------------------------------------------------------
-
-/**
- * The plan actually in force.
- *
- * An expired licence is `free`, checked against an injected `now` so a client cannot be
- * tested only at the moment it happens to be run.
- */
-export function planOf(license, now = Date.now()) {
-  if (!license || !PLANS.includes(license.plan)) return 'free';
-  if (license.expiresAt && now > license.expiresAt) return 'free';
-  return license.plan;
-}
-
-export function planLabel(license, now = Date.now()) {
-  return { free: 'Free', pro: 'Pro', team: 'Team' }[planOf(license, now)];
-}
-
-export function isPro(license, now = Date.now()) {
-  return RANK[planOf(license, now)] >= RANK.pro;
-}
-
-export function isTeam(license, now = Date.now()) {
-  return planOf(license, now) === 'team';
-}
-
-/** Gate a feature. `count` expresses "this would be my Nth", for the counted allowances. */
-export function can(license, feature, count = 0, now = Date.now()) {
-  const plan = planOf(license, now);
-  if (feature === 'unlimitedAgents' && RANK[plan] < RANK.pro) {
-    return count < FREE_LIMITS.customAgents;
-  }
-  const need = FEATURE_TIER[feature] || 'free';
-  return RANK[plan] >= RANK[need];
-}
-
-/** The minimum plan a feature needs — for an upgrade prompt that names the right tier. */
-export function tierFor(feature) {
-  return FEATURE_TIER[feature] || 'free';
-}
-
-/**
- * Is this the Nth use of a lifetime-capped free allowance?
- *
- * The count is MONOTONIC — "how many have ever been created", not "how many exist now" —
- * because a cap on the current count is lifted by deleting things, which is not a limit.
- */
-export function withinFreeLimit(license, key, everCount, now = Date.now()) {
-  if (isPro(license, now)) return true;
-  const cap = FREE_LIMITS[key];
-  return typeof cap !== 'number' || everCount < cap;
-}
-
-// --------------------------------------------------------------------------
-// The signed token
-// --------------------------------------------------------------------------
-
-function b64urlToBytes(s) {
-  const pad = '='.repeat((4 - (String(s).length % 4)) % 4);
-  const b64 = String(s).replace(/-/g, '+').replace(/_/g, '/') + pad;
-  if (typeof Buffer !== 'undefined') return new Uint8Array(Buffer.from(b64, 'base64'));
-  const bin = atob(b64);
-  const out = new Uint8Array(bin.length);
-  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
-  return out;
-}
-
-function decodePayload(head) {
-  try {
-    return JSON.parse(new TextDecoder().decode(b64urlToBytes(head)));
-  } catch {
-    return null;
-  }
-}
-
-let _keyPromise = null;
-
-async function verifyKey(subtle) {
-  const s = subtle || globalThis.crypto?.subtle;
-  if (!s) throw new EntitlementError('no WebCrypto available on this runtime');
-  if (subtle) {
-    // An injected implementation must not be memoised into the shared slot, or a test that
-    // passes one would poison every later call in the process.
-    return s.importKey('jwk', ENTITLEMENT_PUBLIC_JWK, { name: 'ECDSA', namedCurve: 'P-256' }, false, ['verify']);
-  }
-  if (!_keyPromise) {
-    _keyPromise = s.importKey('jwk', ENTITLEMENT_PUBLIC_JWK, { name: 'ECDSA', namedCurve: 'P-256' }, false, ['verify']);
-  }
-  return _keyPromise;
-}
-
-/**
- * The payload field names the WORKER actually signs. Not negotiable, and not guessable:
- * `server/src/worker.js` grant() signs `{ typ:'ent', install_id, plan, sub, iat, exp }`,
- * and the extension checks `p.typ !== 'ent' || p.install_id !== installId`.
- *
- * Written down here because getting them wrong fails in the worst possible way: the
- * signature verifies, the token is genuine, and the binding check reads `undefined` — so
- * every real token is rejected and the user is told their licence is invalid. That is
- * exactly what happened when this module first read `payload.install`.
- */
-export const TOKEN_TYPE = 'ent';
-
-/**
- * Verify a server entitlement token and return its payload, or `null`.
- *
- * Four checks, and all four matter: the SIGNATURE (it came from the worker), the TYPE (a
- * `claim` token is also signed by the same key and must not be accepted as an entitlement),
- * the INSTALL BINDING (issued to this device, so a token copied from a forum grants
- * nothing), and EXPIRY. Returning null rather than throwing is deliberate — a caller
- * resolving a licence at startup must degrade to free, not crash the app.
- */
-export async function verifyEntitlement(token, installId, { subtle = null, now = Date.now() } = {}) {
-  if (!token || typeof token !== 'string' || token.indexOf('.') < 0) return null;
-  const [head, sig] = token.split('.');
-  if (!head || !sig) return null;
-
-  let ok = false;
-  try {
-    const s = subtle || globalThis.crypto?.subtle;
-    ok = await s.verify(
-      { name: 'ECDSA', hash: 'SHA-256' },
-      await verifyKey(subtle),
-      b64urlToBytes(sig),
-      new TextEncoder().encode(head),
-    );
-  } catch {
-    return null;
-  }
-  if (!ok) return null;
-
-  const payload = decodePayload(head);
-  if (!payload) return null;
-  // The same key signs `claim` and `restore` tokens. Accepting one of those as an
-  // entitlement would turn a portable, install-independent token into a licence.
-  if (payload.typ !== TOKEN_TYPE) return null;
-  if (payload.exp && now > Number(payload.exp)) return null;
-  // `install_id` binds the token to one device. A token with no binding is refused rather
-  // than treated as universal — "unbound" must never be the permissive case.
-  if (!payload.install_id || (installId && payload.install_id !== installId)) return null;
-  if (!PLANS.includes(payload.plan)) return null;
-  return payload;
-}
-
-/**
- * A verified payload → the licence record a client stores.
- *
- * TWO EXPIRIES, AND CONFLATING THEM COSTS SOMEONE THEIR PRO.
- *
- *   · `tokenExp` is the signed token's TTL — about a week. It exists so a revoked device
- *     stops working without the server having to reach it.
- *   · `expiresAt` is when the SUBSCRIPTION ends, which the server returns beside the token.
- *
- * `planOf` lapses a licence at `expiresAt`. Setting that from the token's TTL means anyone
- * offline for longer than the TTL silently drops to Free while still paying — which is
- * exactly the bug this signature now prevents by taking the subscription's date separately.
- * With no server date the licence does not expire locally; the next successful check is
- * what corrects it, and that is the safer direction to be wrong in.
- */
-export function licenseFromPayload(payload, { at = Date.now(), expiresAt = 0 } = {}) {
-  if (!payload) return { plan: 'free' };
-  return {
-    plan: payload.plan,
-    expiresAt: Number(expiresAt) || 0,
-    tokenExp: Number(payload.exp) || 0,
-    installId: payload.install_id || '',
-    sub: payload.sub || null,
-    checkedAt: at,
-    source: 'entitlement',
-  };
-}
-
-/**
- * Should this client re-check with the server yet?
- *
- * Offline verification is the point, so the cadence is generous — but a licence that has
- * NEVER been checked, or one whose expiry is close, is worth a call. Pure so the schedule is
- * testable without waiting a day.
- */
-export const RECHECK_INTERVAL_MS = 12 * 60 * 60 * 1000;
-
-export function needsRecheck(license, { now = Date.now(), interval = RECHECK_INTERVAL_MS } = {}) {
-  if (!license || !license.checkedAt) return true;
-  if (now - license.checkedAt > interval) return true;
-  // Inside the last day of either deadline, check eagerly: a renewal lands near the
-  // subscription date, and the token has to be replaced before ITS ttl runs out or the
-  // client is left holding something it can no longer prove.
-  const soon = 24 * 60 * 60 * 1000;
-  if (license.expiresAt && license.expiresAt - now < soon) return true;
-  if (license.tokenExp && license.tokenExp - now < soon) return true;
-  return false;
-}
+class A extends Error{constructor(t){super(t),this.name="EntitlementError"}}const d=Object.freeze(["free","pro","team"]),s=Object.freeze({free:0,pro:1,team:2}),l="https://api.chatpanel.net",T=Object.freeze({verify:`${l}/license/verify`,entitlement:`${l}/entitlement`,claim:`${l}/entitlement/claim`,release:`${l}/entitlement/release`,restore:`${l}/restore`}),m=Object.freeze({kty:"EC",crv:"P-256",x:"CmgKLC4e3xDMvwhbjVqF7jbDe1JhC1KKQi8JN3qVX_4",y:"r40l6fQiyCcJYqW-SvB4VoSyn4F36yhSt82ZAOSo78E"}),v="https://chatpanel.net/#pricing";function k(e="pro",t="",n=""){const r=new URL("https://chatpanel.net/");return t&&r.searchParams.set("install_id",t),e&&r.searchParams.set("plan",e),n&&r.searchParams.set("client",n),r.hash="pricing",r.toString()}const h=Object.freeze({localAgents:"free",byoModels:"free",urlContext:"free",liveMeetings:"free",multiTab:"pro",unlimitedAgents:"pro",customSkills:"pro",customAgents:"pro",advancedAgent:"pro",unlimitedNotes:"pro",unlimitedMeetings:"pro",structuredInsert:"pro",exportChats:"pro",autoBackup:"pro",promptLibrary:"pro",fileAttachments:"pro",watch:"pro",cloudSync:"team",sharedLibrary:"team",hostedBridge:"team",sso:"team"}),C=Object.freeze({unlimitedNotes:"Unlimited notes — Free keeps your first 10",unlimitedMeetings:"Unlimited meetings — Free keeps your first 10",multiTab:"Attach several tabs at once",unlimitedAgents:"Unlimited custom agents",customSkills:"Create & edit your own skills",advancedAgent:"Per-agent system prompts & working directories",structuredInsert:"Clean diagrams on Excalidraw, draw.io & tldraw — shapes placed as data, not pixel-drawn",exportChats:"Export conversations as Markdown",autoBackup:"Automatic daily backup of all your data to disk",watch:"Watch a page & act on changes — the agent reacts as the page updates"}),D=Object.freeze({cloudSync:"Sync chats across your devices",sharedLibrary:"Shared team agents & skills",hostedBridge:"Hosted agents — no local bridge to run",sso:"SSO & admin controls"}),y=Object.freeze({notes:10,meetings:10,apiEndpoints:1,bridgeAgents:1,customAgents:1,attachmentsPerMessage:1,mcpServers:1,gatewayDestinations:1,webSearchEngines:3,webSearchesPerDay:50,fullRedactions:25});function c(e,t=Date.now()){return!e||!d.includes(e.plan)||e.expiresAt&&t>e.expiresAt?"free":e.plan}function P(e,t=Date.now()){return{free:"Free",pro:"Pro",team:"Team"}[c(e,t)]}function b(e,t=Date.now()){return s[c(e,t)]>=s.pro}function _(e,t=Date.now()){return c(e,t)==="team"}function O(e,t,n=0,r=Date.now()){const o=c(e,r);if(t==="unlimitedAgents"&&s[o]<s.pro)return n<y.customAgents;const i=h[t]||"free";return s[o]>=s[i]}function N(e){return h[e]||"free"}function R(e,t,n,r=Date.now()){if(b(e,r))return!0;const o=y[t];return typeof o!="number"||n<o}function p(e){const t="=".repeat((4-String(e).length%4)%4),n=String(e).replace(/-/g,"+").replace(/_/g,"/")+t;if(typeof Buffer<"u")return new Uint8Array(Buffer.from(n,"base64"));const r=atob(n),o=new Uint8Array(r.length);for(let i=0;i<r.length;i++)o[i]=r.charCodeAt(i);return o}function g(e){try{return JSON.parse(new TextDecoder().decode(p(e)))}catch{return null}}let f=null;async function x(e){const t=e||globalThis.crypto?.subtle;if(!t)throw new A("no WebCrypto available on this runtime");return e?t.importKey("jwk",m,{name:"ECDSA",namedCurve:"P-256"},!1,["verify"]):(f||(f=t.importKey("jwk",m,{name:"ECDSA",namedCurve:"P-256"},!1,["verify"])),f)}const w="ent";async function L(e,{typ:t=null,subtle:n=null,now:r=Date.now()}={}){if(!e||typeof e!="string"||e.indexOf(".")<0)return null;const[o,i]=e.split(".");if(!o||!i)return null;let u=!1;try{u=await(n||globalThis.crypto?.subtle).verify({name:"ECDSA",hash:"SHA-256"},await x(n),p(i),new TextEncoder().encode(o))}catch{return null}if(!u)return null;const a=g(o);return!a||t&&a.typ!==t||a.exp&&r>Number(a.exp)?null:a}async function U(e,t,{subtle:n=null,now:r=Date.now()}={}){if(!e||typeof e!="string"||e.indexOf(".")<0)return null;const[o,i]=e.split(".");if(!o||!i)return null;let u=!1;try{u=await(n||globalThis.crypto?.subtle).verify({name:"ECDSA",hash:"SHA-256"},await x(n),p(i),new TextEncoder().encode(o))}catch{return null}if(!u)return null;const a=g(o);return!a||a.typ!==w||a.exp&&r>Number(a.exp)||!a.install_id||t&&a.install_id!==t||!d.includes(a.plan)?null:a}function j(e,{at:t=Date.now(),expiresAt:n=0}={}){return e?{plan:e.plan,expiresAt:Number(n)||0,tokenExp:Number(e.exp)||0,installId:e.install_id||"",sub:e.sub||null,checkedAt:t,source:"entitlement"}:{plan:"free"}}const S=720*60*1e3;function F(e,{now:t=Date.now(),interval:n=S}={}){if(!e||!e.checkedAt||t-e.checkedAt>n)return!0;const r=1440*60*1e3;return!!(e.expiresAt&&e.expiresAt-t<r||e.tokenExp&&e.tokenExp-t<r)}export{l as API_BASE,T as ENDPOINTS,m as ENTITLEMENT_PUBLIC_JWK,A as EntitlementError,h as FEATURE_TIER,y as FREE_LIMITS,d as PLANS,C as PRO_FEATURES,S as RECHECK_INTERVAL_MS,D as TEAM_FEATURES,w as TOKEN_TYPE,v as UPGRADE_URL,O as can,k as checkoutUrl,b as isPro,_ as isTeam,j as licenseFromPayload,F as needsRecheck,P as planLabel,c as planOf,N as tierFor,U as verifyEntitlement,L as verifySignedToken,R as withinFreeLimit};