@jchat/runtime 0.0.1

package/LICENSE

@@ -0,0 +1,120 @@
+JChat Runtime License Agreement
+Version 1.0 - July 29, 2026
+
+Copyright (c) 2026 Md. Jabarullah. All rights reserved.
+
+This agreement governs the @jchat/runtime software package (the "Runtime"). The Runtime is
+proprietary software made publicly downloadable only to support authorized JChat deployments.
+Public availability, including availability through the npm public registry, does not make the
+Runtime open-source software and does not grant any rights except those stated below.
+
+1. Definitions
+
+"JChat" means the JChat software product and services published by Md. Jabarullah.
+
+"Vendor License" means a valid standard, extended, or vendor-issued development license for JChat
+obtained from JChat Hub, Envato Market, Codester, or another channel expressly authorized by the
+copyright owner.
+
+"Authorized Deployment" means a JChat installation that complies with its Vendor License,
+including its domain, installation, environment, and usage restrictions.
+
+"You" means the individual or legal entity that owns a Vendor License or is acting for its
+authorized license holder.
+
+2. Limited License Grant
+
+Subject to continued compliance with this agreement and the applicable Vendor License, you receive
+a limited, non-exclusive, non-transferable except as expressly allowed by Section 2(d),
+non-sublicensable, and revocable license to:
+
+a. download the Runtime from npm or another distribution channel authorized by JChat;
+
+b. install and execute the Runtime solely as an unmodified dependency of an Authorized Deployment;
+
+c. make reasonable technical copies required for private package caches, continuous integration,
+   Docker or other deployment images, staging environments, disaster recovery, and backups for the
+   Authorized Deployment; and
+
+d. provide those copies to a client only as an integral part of an end product and only when that
+   transfer is permitted by the applicable Vendor License.
+
+A vendor-issued development license may additionally authorize local development use according to
+the conditions encoded in that license. No right is granted to use the Runtime independently from
+JChat or without a valid Vendor License.
+
+3. Restrictions
+
+Except where applicable law does not permit a restriction, you must not:
+
+a. sell, rent, sublicense, republish, publicly mirror, or distribute the Runtime as a standalone or
+   reusable package;
+
+b. modify, adapt, translate, or create derivative works of the Runtime;
+
+c. reverse engineer, decompile, disassemble, or otherwise attempt to discover non-public source
+   code or implementation details;
+
+d. remove or alter copyright, license, attribution, integrity, entitlement, or ownership notices;
+
+e. bypass, disable, interfere with, or misrepresent activation, entitlement, domain, installation,
+   signature, integrity, or registry verification;
+
+f. use the Runtime to build, enable, or operate an unlicensed JChat deployment; or
+
+g. use the Runtime as a component of a competing standalone product or licensing system.
+
+Internal caches and deployment artifacts allowed by Section 2 are not prohibited redistribution,
+provided they remain access-controlled and are used only for the Authorized Deployment.
+
+4. Ownership
+
+The Runtime is licensed, not sold. JChat and its licensors retain all title, copyright, patent,
+trade-secret, and other intellectual-property rights in the Runtime. No implied license is granted.
+
+5. Third-Party Software
+
+Third-party components, if any, remain governed by their respective licenses. This agreement does
+not reduce rights granted under a third-party license.
+
+6. Updates, Services, and Vendor License Terms
+
+This agreement does not promise updates, support, availability, or continued registry access.
+Purchase, activation, installation, replacement, and service terms remain governed by the
+applicable Vendor License and written JChat terms. If those terms conflict with this agreement for
+the Runtime, the more specific written terms supplied by JChat control.
+
+7. Term and Termination
+
+This agreement remains effective while you comply with it and maintain the required Vendor License.
+It terminates automatically when the Vendor License expires or is revoked, or when you materially
+breach this agreement. On termination, you must stop using the Runtime and remove all copies except
+copies retained solely where applicable law requires archival retention.
+
+Sections 3, 4, 5, 8, 9, and 10 survive termination.
+
+8. Disclaimer of Warranty
+
+TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE RUNTIME IS PROVIDED "AS IS" AND "AS
+AVAILABLE", WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY,
+INCLUDING WARRANTIES OF TITLE, NON-INFRINGEMENT, MERCHANTABILITY, FITNESS FOR A PARTICULAR
+PURPOSE, ACCURACY, OR RELIABILITY.
+
+9. Limitation of Liability
+
+TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, JCHAT, MD. JABARULLAH, AND THEIR SUPPLIERS WILL
+NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, CONSEQUENTIAL, OR PUNITIVE DAMAGES,
+OR FOR LOSS OF DATA, PROFITS, REVENUE, BUSINESS, OR GOODWILL, ARISING FROM OR RELATED TO THE
+RUNTIME, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+
+10. General
+
+The governing law, venue, and dispute terms stated in the applicable Vendor License or written
+JChat purchase terms apply to this agreement. If any provision is unenforceable, it will be limited
+to the minimum extent necessary, and the remaining provisions will continue in effect. A waiver
+must be in writing and applies only to the specific instance waived.
+
+The JChat name, logos, and related marks are not licensed except for truthful identification of
+compatible products and services.
+
+For permissions outside this agreement, contact JChat through https://jchat.com.

package/dist/index.d.mts

@@ -0,0 +1,137 @@
+//#region src/domain.d.ts
+type Plan = "standard" | "extended";
+type RoutingMode = "path" | "subdomain";
+type DomainScope = "current-host" | "parent-domain";
+type NormalizedDomain = {
+  host: string;
+  isLocalhost: boolean;
+};
+/** Normalize the host used for instance binding; ports and www are not significant. */
+declare function normalizeDomain(value: string): NormalizedDomain;
+declare function isPublicDomain(value: string): boolean;
+declare function isAllowedConfiguredDomain(value: string): boolean;
+declare function resolveActivationDomain(host: string, plan: Plan, routingMode: RoutingMode, domainScope?: DomainScope): string;
+//#endregion
+//#region src/audit.d.ts
+type AuditEvent = "check_success" | "check_unreachable" | "check_rejected";
+declare function recordAudit(event: AuditEvent, details: {
+  domain?: string;
+  installationId?: string;
+  reference?: string;
+}, filePath?: string): Promise<void>;
+//#endregion
+//#region src/check.d.ts
+type CheckResult = {
+  status: "valid";
+  token: string;
+} | {
+  status: "unreachable-fallback";
+  token: string;
+  error: string;
+} | {
+  status: "invalid";
+  error: string;
+  reference: string;
+};
+type RegistryProvider = "envato" | "jchat";
+type RegistryRoutingMode = "path" | "subdomain";
+type ActivationInput = {
+  purchaseCode: string;
+  domain: string;
+  siteSlug?: string;
+  domainScope?: "current-host" | "parent-domain";
+  provider: RegistryProvider;
+  routingMode: RegistryRoutingMode;
+  installationId: string;
+  installationPublicKey: string;
+  machineFingerprint: string;
+  registryEndpoint?: string;
+  fetchImpl?: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+};
+type ActivationResult = {
+  success: true;
+  buyer: string;
+  token: string;
+  domain: string;
+} | {
+  success: false;
+  message: string;
+};
+declare function activateRegistry(input: ActivationInput): Promise<ActivationResult>;
+type CheckInput = {
+  token: string;
+  domain: string;
+  routingMode: RegistryRoutingMode;
+  installationId: string;
+  machineFingerprint: string;
+  registryEndpoint?: string;
+  runtimeOptions?: RuntimeOptions;
+  auditPath?: string;
+  fetchImpl?: (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+  localTokenValidator?: (token: string, domain: string, installationId: string, machineFingerprint: string) => boolean;
+};
+declare function checkRegistry(input: CheckInput): Promise<CheckResult>;
+//#endregion
+//#region src/state.d.ts
+type LocalState = {
+  version: 1;
+  installationId: string;
+  privateKeyPem: string;
+  publicKeyPem: string;
+  machineFingerprint: string;
+  instanceToken: string;
+  lastSuccessfulCheckAt?: string;
+};
+declare const DEFAULT_STATE_PATH: string;
+declare function createMachineFingerprint(): string;
+declare function createIdentity(machineFingerprint?: string): {
+  installationId: `${string}-${string}-${string}-${string}-${string}`;
+  machineFingerprint: string;
+  privateKeyPem: string;
+  publicKeyPem: string;
+};
+declare function readTokenSync(filePath?: string): string;
+declare function readState(filePath?: string): Promise<LocalState | null>;
+declare function writeState(state: LocalState, filePath?: string): Promise<void>;
+declare function acquireProcessLock(statePath?: string): Promise<() => Promise<void>>;
+//#endregion
+//#region src/runtime.d.ts
+type RuntimeStatus$1 = "valid" | "unreachable-fallback" | "invalid" | "unavailable";
+declare function registerInvalidationHandler(handler: () => void): void;
+declare function setRuntimeStatus(status: RuntimeStatus$1, reference?: string): void;
+declare function getRuntimeStatus(): {
+  status: RuntimeStatus$1;
+  reference: string;
+};
+declare function isApplicationDisabled(): boolean;
+//#endregion
+//#region src/index.d.ts
+type PurchaseProvider = "envato" | "jchat";
+type RuntimeEnvironment = "production" | "development";
+type ConfigPayload = {
+  iss: string;
+  aud: string;
+  licenseId: string;
+  domain: string;
+  buyer: string;
+  installationId: string;
+  machineFingerprint: string;
+  plan: Plan;
+  entitlements: string[];
+  purchaseProvider: PurchaseProvider;
+  environment: RuntimeEnvironment;
+  routingMode: RoutingMode;
+  iat: number;
+};
+type RuntimeOptions = {
+  publicKeyPem: string;
+  issuer?: string;
+  audience?: string;
+};
+type RuntimeStatus = "valid" | "unreachable-fallback" | "invalid" | "unavailable";
+declare function parsePayload(token: string): ConfigPayload | null;
+declare function verifySignature(token: string, currentDomain: string, options: RuntimeOptions): boolean;
+declare function verifyEntitlement(token: string, currentDomain: string, installationId: string, machineFingerprint: string, options: RuntimeOptions): boolean;
+declare function hasEntitlement(token: string, currentDomain: string, entitlement: string, options: RuntimeOptions): boolean;
+//#endregion
+export { ActivationInput, ActivationResult, AuditEvent, CheckInput, CheckResult, ConfigPayload, DEFAULT_STATE_PATH, DomainScope, LocalState, NormalizedDomain, Plan, PurchaseProvider, RegistryProvider, RegistryRoutingMode, RoutingMode, RuntimeEnvironment, RuntimeOptions, RuntimeStatus, acquireProcessLock, activateRegistry, checkRegistry, createIdentity, createMachineFingerprint, getRuntimeStatus, hasEntitlement, isAllowedConfiguredDomain, isApplicationDisabled, isPublicDomain, normalizeDomain, parsePayload, readState, readTokenSync, recordAudit, registerInvalidationHandler, resolveActivationDomain, setRuntimeStatus, verifyEntitlement, verifySignature, writeState };

package/dist/index.mjs

@@ -0,0 +1 @@
+import e from"node:crypto";import t from"node:net";import n from"node:fs/promises";import r from"node:path";import i from"node:fs";import a from"node:os";const o=new Set([`localhost`,`127.0.0.1`,`::1`]),s=[`.local`,`.test`,`.invalid`,`.example`];function c(e){let t=e.trim();if(!t)throw Error(`Instance domain is required`);let n=new URL(t.includes(`://`)?t:`https://${t}`).hostname.toLowerCase().replace(/\.$/,``),r=n===`www.localhost`?`localhost`:n.replace(/^www\./,``);if(!r||r.includes(`@`)||/\s/.test(r))throw Error(`Invalid instance domain`);return{host:r,isLocalhost:o.has(r)}}function l(e){let{host:n,isLocalhost:r}=c(e);return!r&&t.isIP(n)===0&&n.includes(`.`)&&!s.some(e=>n.endsWith(e))}function u(e){try{return c(e).isLocalhost||l(e)}catch{return!1}}function d(e){let{host:n,isLocalhost:r}=c(e);if(r||t.isIP(n)!==0)return null;let i=n.split(`.`);if(i.length<=2)return n;let a=new Set([`co`,`com`,`org`,`net`,`gov`,`edu`,`ac`,`sch`]),o=i.at(-1)??``,s=i.at(-2)??``;return a.has(s)&&o.length===2&&i.length>=3?i.slice(-3).join(`.`):i.slice(-2).join(`.`)}function f(e,t,n,r=`current-host`){let i=c(e).host;return n===`subdomain`&&t===`extended`&&r===`parent-domain`?d(i)??i:i}function p(e){if(e)return e.length<=8?`redacted`:`${e.slice(0,4)}…${e.slice(-4)}`}async function m(e,t,i=r.resolve(process.cwd(),`data/license-events.log`)){await n.mkdir(r.dirname(i),{recursive:!0});let a=JSON.stringify({at:new Date().toISOString(),event:e,domain:p(t.domain),installationId:p(t.installationId),reference:p(t.reference)});await n.appendFile(i,`${a}\n`,`utf8`)}let h=`unavailable`,g=`startup`,_;function v(e){_=e}function y(t,n=e.randomUUID()){h=t,g=n,t===`invalid`&&_?.()}function b(){return{status:h,reference:g}}function x(){return h===`invalid`}const S=Buffer.from(`aHR0cDovL2xvY2FsaG9zdDo0MDAw`,`base64`).toString(`utf8`);async function C(e){try{let t=await(e.fetchImpl??fetch)(`${e.registryEndpoint??S}/api/activate`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({purchaseCode:e.purchaseCode,domain:c(e.domain).host,siteSlug:e.siteSlug,domainScope:e.domainScope,provider:e.provider,routingMode:e.routingMode,installationId:e.installationId,installationPublicKey:e.installationPublicKey,machineFingerprint:e.machineFingerprint})}),n=await t.json();return t.ok===!1||!n.success||!n.token?{success:!1,message:n.message??`This license is already active on another domain. Please deactivate it first.`}:{success:!0,buyer:n.buyer??`Customer`,token:n.token,domain:n.domain??c(e.domain).host}}catch{return{success:!1,message:`Failed to connect to the central registry. Please try again later.`}}}async function w(t){let n=t.fetchImpl??fetch,r=t.localTokenValidator??((e,n,r,i)=>t.runtimeOptions?z(e,n,r,i,t.runtimeOptions):!1),i=(n,r)=>{let i=e.randomUUID();return y(`invalid`,i),m(`check_rejected`,{domain:n,reference:i},t.auditPath),{status:`invalid`,error:r,reference:i}},a=e=>{let n=c(t.domain).host;return r(t.token,n,t.installationId,t.machineFingerprint)?(y(`unreachable-fallback`),m(`check_unreachable`,{domain:n},t.auditPath),{status:`unreachable-fallback`,token:t.token,error:e}):i(n,`Local license validation failed.`)};try{let e=c(t.domain).host,r=await n(`${t.registryEndpoint??S}/api/check`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({token:t.token,domain:e,routingMode:t.routingMode,installationId:t.installationId,machineFingerprint:t.machineFingerprint})});if(!r.ok)return r.status>=500?a(`HTTP ${r.status}`):i(e,`License rejected by jchat service.`);let o=await r.json();if(!o.success||!o.token||!(t.runtimeOptions&&z(o.token,e,t.installationId,t.machineFingerprint,t.runtimeOptions))&&!t.localTokenValidator||t.localTokenValidator&&!t.localTokenValidator(o.token,e,t.installationId,t.machineFingerprint))return i(e,`License rejected by jchat service.`);let s=L(o.token);return!s||s.installationId!==t.installationId||s.machineFingerprint!==t.machineFingerprint||s.routingMode!==t.routingMode?i(e,`License binding rejected by jchat service.`):(y(`valid`),m(`check_success`,{domain:e},t.auditPath),{status:`valid`,token:o.token})}catch{return a(`License service unreachable.`)}}const T=r.resolve(process.cwd(),`data/instance.json`);function E(){return e.createHash(`sha256`).update([a.hostname(),a.platform(),a.arch()].join(`|`)).digest(`hex`)}function D(t=E()){let n=e.generateKeyPairSync(`ed25519`);return{installationId:e.randomUUID(),machineFingerprint:t,privateKeyPem:n.privateKey.export({type:`pkcs8`,format:`pem`}).toString(),publicKeyPem:n.publicKey.export({type:`spki`,format:`pem`}).toString()}}function O(e=T){try{if(!i.existsSync(e))return``;let t=i.readFileSync(e,`utf8`);return JSON.parse(t)?.instanceToken??``}catch{return``}}async function k(e=T){try{let t=JSON.parse(await Bun.file(e).text());if(!t||typeof t!=`object`)return null;let n=t;return n.version!==1||typeof n.installationId!=`string`||!n.installationId||typeof n.privateKeyPem!=`string`||!n.privateKeyPem||typeof n.publicKeyPem!=`string`||!n.publicKeyPem||typeof n.machineFingerprint!=`string`||!n.machineFingerprint||typeof n.instanceToken!=`string`||!n.instanceToken||n.lastSuccessfulCheckAt!==void 0&&(typeof n.lastSuccessfulCheckAt!=`string`||!n.lastSuccessfulCheckAt)?null:n}catch{return null}}async function A(t,i=T){let a=r.dirname(i);await n.mkdir(a,{recursive:!0});let o=`${i}.${process.pid}.${e.randomUUID()}.tmp`;await Bun.write(o,`${JSON.stringify(t,null,2)}\n`),await n.rename(o,i)}async function j(e=T){let t=`${e}.lock`;await n.mkdir(r.dirname(t),{recursive:!0});let i;try{i=await n.open(t,`wx`)}catch(e){if(!(e instanceof Error)||!(`code`in e)||e.code!==`EEXIST`)throw e;let r=Number.parseInt(await Bun.file(t).text().catch(()=>``),10),a=!1;if(Number.isInteger(r)&&r>0)try{process.kill(r,0),a=!0}catch{a=!1}if(a)throw Error(`Another JChat process already owns the license lock`);await n.rm(t,{force:!0}),i=await n.open(t,`wx`)}return await i.writeFile(`${process.pid}\n`),async()=>{await i.close(),await n.rm(t,{force:!0})}}function M(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function N(e){return typeof e==`string`&&e.trim().length>0}function P(e){if(!e)return null;try{return JSON.parse(Buffer.from(e,`base64url`).toString(`utf8`))}catch{return null}}function F(e){let t=e.split(`.`);if(t.length!==3)return null;let n=P(t[0]);return!M(n)||n.alg!==`RS256`||n.typ!==`JWT`?null:{alg:`RS256`,typ:`JWT`}}function I(e){if(!M(e))return null;let{iss:t,aud:n,licenseId:r,domain:i,buyer:a,installationId:o,machineFingerprint:s,plan:u,entitlements:d,purchaseProvider:f,environment:p,routingMode:m,iat:h}=e;if(!N(t)||!N(n)||!N(r)||!N(i)||!N(a)||!N(o)||!N(s)||u!==`standard`&&u!==`extended`||!Array.isArray(d)||!d.every(N)||f!==`envato`&&f!==`jchat`||p!==`production`&&p!==`development`||m!==`path`&&m!==`subdomain`||typeof h!=`number`||!Number.isSafeInteger(h)||h<0)return null;let g;try{g=c(i)}catch{return null}if(p===`development`&&!g.isLocalhost||p===`production`&&!l(i))return null;let _=d.includes(`site.create.multi`);return u===`extended`&&!_||u===`standard`&&_?null:{iss:t,aud:n,licenseId:r,domain:i,buyer:a,installationId:o,machineFingerprint:s,plan:u,entitlements:d,purchaseProvider:f,environment:p,routingMode:m,iat:h}}function L(e){let t=e.split(`.`);return t.length!==3||!t.every(Boolean)||!F(e)?null:I(P(t[1]))}function R(t,n,r){if(!t||t===`YOUR_LICENSE_KEY_PLACEHOLDER`)return!1;try{let i=t.split(`.`);if(i.length!==3||!F(t))return!1;let a=L(t);if(!a||a.iss!==(r.issuer??`https://license.jchat.local`)||a.aud!==(r.audience??`jchat-chat`)||c(a.domain).host!==c(n).host)return!1;let o=Buffer.from(`${i[0]}.${i[1]}`),s=Buffer.from(i[2].replace(/-/g,`+`).replace(/_/g,`/`),`base64`);return e.verify(`sha256`,o,r.publicKeyPem,s)}catch{return!1}}function z(e,t,n,r,i){if(!R(e,t,i))return!1;let a=L(e);return a?a.installationId===n&&a.machineFingerprint===r:!1}function B(e,t,n,r){return R(e,t,r)?L(e)?.entitlements?.includes(n)??!1:!1}export{T as DEFAULT_STATE_PATH,j as acquireProcessLock,C as activateRegistry,w as checkRegistry,D as createIdentity,E as createMachineFingerprint,b as getRuntimeStatus,B as hasEntitlement,u as isAllowedConfiguredDomain,x as isApplicationDisabled,l as isPublicDomain,c as normalizeDomain,L as parsePayload,k as readState,O as readTokenSync,m as recordAudit,v as registerInvalidationHandler,f as resolveActivationDomain,y as setRuntimeStatus,z as verifyEntitlement,R as verifySignature,A as writeState};

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@jchat/runtime",
+  "version": "0.0.1",
+  "private": false,
+  "description": "Runtime support package for JChat deployments.",
+  "license": "SEE LICENSE IN LICENSE",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/mjjabarullah/jchat.git",
+    "directory": "packages/runtime"
+  },
+  "files": [
+    "dist"
+  ],
+  "type": "module",
+  "main": "./dist/index.mjs",
+  "types": "./dist/index.d.mts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.mts",
+      "import": "./dist/index.mjs"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsdown",
+    "lint": "oxlint . --config=../../oxlint.json",
+    "format": "oxfmt . --write",
+    "typecheck": "tsc --noEmit",
+    "test": "bun --config ./bunfig.toml test",
+    "prepack": "bun run build"
+  },
+  "devDependencies": {
+    "@types/node": "^26.1.1",
+    "bun-types": "^1.3.14",
+    "tsdown": "^0.22.14",
+    "typescript": "^7.0.2"
+  }
+}