@forgecharts/sdk 1.3.7 → 1.3.8

package/dist/internal.js

@@ -10798,6 +10798,7 @@ var DEFAULT_FEATURES = {};
 var LicenseManager = class _LicenseManager {
   static instance = null;
   payload = null;
+  status = "idle";
   subscribers = /* @__PURE__ */ new Set();
   constructor() {
   }
@@ -10844,17 +10845,27 @@ var LicenseManager = class _LicenseManager {
     if (!verifyUrl) {
       throw new Error("LicenseManager: verifyUrl is required");
     }
-    const res = await fetch(verifyUrl, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ licenseKey: key.trim().toUpperCase() })
-    });
-    if (!res.ok) {
-      throw new Error(`License server error: ${res.status} ${res.statusText}`);
-    }
-    const data = await res.json();
-    if (!data.valid) {
-      throw new Error(data.reason ?? "License invalid");
+    this.status = "pending";
+    this.notify();
+    let data;
+    try {
+      const res = await fetch(verifyUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ licenseKey: key.trim().toUpperCase() })
+      });
+      if (!res.ok) {
+        throw new Error(`License server error: ${res.status} ${res.statusText}`);
+      }
+      data = await res.json();
+      if (!data.valid) {
+        throw new Error(data.reason ?? "License invalid");
+      }
+    } catch (err) {
+      this.payload = null;
+      this.status = "failed";
+      this.notify();
+      throw err;
     }
     const raw = {
       licenseKey: data.licenseKey ?? key.trim().toUpperCase(),
@@ -10869,14 +10880,29 @@ var LicenseManager = class _LicenseManager {
     };
     const payload = this.#applyPolicyPipeline(raw);
     this.payload = payload;
+    this.status = "valid";
     this.notify();
     return payload;
   }
   /** Load a pre-validated payload (e.g. from cache / localStorage). Runs through the same migration + guardrail pipeline as `validateLicense`. */
   loadLicense(payload) {
     this.payload = this.#applyPolicyPipeline(payload);
+    this.status = "valid";
     this.notify();
   }
+  /** Where the license is in its validation lifecycle. */
+  getValidationStatus() {
+    return this.status;
+  }
+  /**
+   * True when a validation attempt is pending or has failed — every
+   * license-gated feature must be denied. 'idle' (validation never
+   * attempted) is NOT locked down: dev/test usage keeps the permissive
+   * "omitted = allowed" defaults.
+   */
+  isLockedDown() {
+    return this.status === "pending" || this.status === "failed";
+  }
   /**
    * Runs a raw/legacy/partial payload through `migrateLegacyPayload` (fills
    * missing productTier/capabilities/schemaVersion, deterministically, with
@@ -10931,9 +10957,10 @@ var LicenseManager = class _LicenseManager {
   hasCapability(name) {
     return this.getCapabilities()[name] === true;
   }
-  /** Clear the current license state (returns to safe unmanaged defaults). */
+  /** Clear the current license state (returns to safe unmanaged defaults and 'idle' status). */
   clear() {
     this.payload = null;
+    this.status = "idle";
     this.notify();
   }
 };
@@ -11300,8 +11327,14 @@ var ChartRuntimeResolver = class _ChartRuntimeResolver {
    * If the active license has an explicit feature flag, use it.
    * Otherwise fall back to `defaultValue` (allows capability even without an
    * explicit flag, matching the "omitted = allowed" convention).
+   *
+   * Lockdown override: while a validation attempt is pending or has failed,
+   * every gated feature is denied — a failed verify must never yield more
+   * than a valid one. 'idle' (validation never attempted) keeps the
+   * permissive defaults for dev/test usage.
    */
   #featureOrDefault(name, defaultValue) {
+    if (this.lm.isLockedDown()) return false;
     const features = this.lm.getFeatures();
     const flag = features[name];
     return flag === void 0 ? defaultValue : flag === true;