@jchat/runtime 0.0.2 → 1.0.0-alpha.10

package/CHANGELOG.md

@@ -0,0 +1,55 @@
+# @jchat/runtime
+
+## 1.0.0-alpha.10
+
+## 1.0.0-alpha.9
+
+### Patch Changes
+
+- 7aef82c: Refactor runtime registry endpoint defaults to focus strictly on cryptographic licensing and support environment-aware overrides.
+
+## 1.0.0-alpha.8
+
+## 1.0.0-alpha.7
+
+### Minor Changes
+
+- 7cef24c: - Enhance addon package diagnostics with semantic version compatibility validation for JChat host and Addon SDK
+  - Add support for local workspace development, sandbox test harnesses, and distribution packaging
+  - Improve runtime license verification and multi-environment path resolution
+  - Update addon generator templates with 20-language i18n support, standard scripts, and type definitions
+
+## 1.0.0-alpha.6
+
+## 1.0.0-alpha.5
+
+### Patch Changes
+
+- 457b0fc: Refactor server configuration: merged environment schema into `server-context.ts` in `@jchat/runtime` and updated `loadServerContext` to properly accept `publicKeyPem`. Updated `@jchat/chat` to pass `SIGNING_ROOT_KEY` into `loadServerContext`.
+- 93d798f: Fix `ServerConfigSchema` export
+
+## 1.0.0-alpha.4
+
+### Patch Changes
+
+- 457b0fc: Refactor server configuration: merged environment schema into `server-context.ts` in `@jchat/runtime` and updated `loadServerContext` to properly accept `publicKeyPem`. Updated `@jchat/chat` to pass `SIGNING_ROOT_KEY` into `loadServerContext`.
+- 93d798f: Fix `ServerConfigSchema` export
+
+## 1.0.0-alpha.3
+
+## 1.0.0-alpha.2
+
+### Patch Changes
+
+- 448e6cd: Move `makeTypesEnv` from runtime to shared package
+
+## 1.0.0-alpha.1
+
+### Patch Changes
+
+- 70537c0: Cleanup folder structure.
+  - @jchat/shared@1.0.0-alpha.1
+
+## 1.0.0-alpha.0
+
+- Initial public alpha release.

package/LICENSE

@@ -1,120 +1,23 @@
-JChat Runtime License Agreement
-Version 1.0 - July 29, 2026
+CUSTOM COMMERCIAL END USER LICENSE AGREEMENT (EULA)
 
-Copyright (c) 2026 Md. Jabarullah. All rights reserved.
+Copyright (c) 2026 JChat Project. All rights reserved.
 
-This agreement governs the @jchat/runtime software package (the "Runtime"). The Runtime is
-proprietary software made publicly downloadable only to support authorized JChat deployments.
-Public availability, including availability through the npm public registry, does not make the
-Runtime open-source software and does not grant any rights except those stated below.
+1. DEFINITIONS
+"Software" refers to this npm package and its source code.
+"Authorized Application" refers strictly to the application known as "JChat".
 
-1. Definitions
+2. LICENSE GRANT
+Subject to the terms of this Agreement and payment of any applicable fees, the 
+Licensor grants you a non-exclusive, non-transferable, revocable license to 
+download, install, and use the Software.
 
-"JChat" means the JChat software product and services published by Md. Jabarullah.
+3. RESTRICTIONS ON USE
+You are expressly prohibited from using this Software, in whole or in part, 
+in any application, product, or service other than the Authorized Application (JChat). 
+Any deployment, linking, execution, or inclusion of this Software into an 
+application that is not JChat constitutes a breach of this contract and 
+an infringement of copyright law.
 
-"Vendor License" means a valid standard, extended, or vendor-issued development license for JChat
-obtained from JChat Hub, Envato Market, Codester, or another channel expressly authorized by the
-copyright owner.
-
-"Authorized Deployment" means a JChat installation that complies with its Vendor License,
-including its domain, installation, environment, and usage restrictions.
-
-"You" means the individual or legal entity that owns a Vendor License or is acting for its
-authorized license holder.
-
-2. Limited License Grant
-
-Subject to continued compliance with this agreement and the applicable Vendor License, you receive
-a limited, non-exclusive, non-transferable except as expressly allowed by Section 2(d),
-non-sublicensable, and revocable license to:
-
-a. download the Runtime from npm or another distribution channel authorized by JChat;
-
-b. install and execute the Runtime solely as an unmodified dependency of an Authorized Deployment;
-
-c. make reasonable technical copies required for private package caches, continuous integration,
-   Docker or other deployment images, staging environments, disaster recovery, and backups for the
-   Authorized Deployment; and
-
-d. provide those copies to a client only as an integral part of an end product and only when that
-   transfer is permitted by the applicable Vendor License.
-
-A vendor-issued development license may additionally authorize local development use according to
-the conditions encoded in that license. No right is granted to use the Runtime independently from
-JChat or without a valid Vendor License.
-
-3. Restrictions
-
-Except where applicable law does not permit a restriction, you must not:
-
-a. sell, rent, sublicense, republish, publicly mirror, or distribute the Runtime as a standalone or
-   reusable package;
-
-b. modify, adapt, translate, or create derivative works of the Runtime;
-
-c. reverse engineer, decompile, disassemble, or otherwise attempt to discover non-public source
-   code or implementation details;
-
-d. remove or alter copyright, license, attribution, integrity, entitlement, or ownership notices;
-
-e. bypass, disable, interfere with, or misrepresent activation, entitlement, domain, installation,
-   signature, integrity, or registry verification;
-
-f. use the Runtime to build, enable, or operate an unlicensed JChat deployment; or
-
-g. use the Runtime as a component of a competing standalone product or licensing system.
-
-Internal caches and deployment artifacts allowed by Section 2 are not prohibited redistribution,
-provided they remain access-controlled and are used only for the Authorized Deployment.
-
-4. Ownership
-
-The Runtime is licensed, not sold. JChat and its licensors retain all title, copyright, patent,
-trade-secret, and other intellectual-property rights in the Runtime. No implied license is granted.
-
-5. Third-Party Software
-
-Third-party components, if any, remain governed by their respective licenses. This agreement does
-not reduce rights granted under a third-party license.
-
-6. Updates, Services, and Vendor License Terms
-
-This agreement does not promise updates, support, availability, or continued registry access.
-Purchase, activation, installation, replacement, and service terms remain governed by the
-applicable Vendor License and written JChat terms. If those terms conflict with this agreement for
-the Runtime, the more specific written terms supplied by JChat control.
-
-7. Term and Termination
-
-This agreement remains effective while you comply with it and maintain the required Vendor License.
-It terminates automatically when the Vendor License expires or is revoked, or when you materially
-breach this agreement. On termination, you must stop using the Runtime and remove all copies except
-copies retained solely where applicable law requires archival retention.
-
-Sections 3, 4, 5, 8, 9, and 10 survive termination.
-
-8. Disclaimer of Warranty
-
-TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE RUNTIME IS PROVIDED "AS IS" AND "AS
-AVAILABLE", WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, WHETHER EXPRESS, IMPLIED, OR STATUTORY,
-INCLUDING WARRANTIES OF TITLE, NON-INFRINGEMENT, MERCHANTABILITY, FITNESS FOR A PARTICULAR
-PURPOSE, ACCURACY, OR RELIABILITY.
-
-9. Limitation of Liability
-
-TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, JCHAT, MD. JABARULLAH, AND THEIR SUPPLIERS WILL
-NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, CONSEQUENTIAL, OR PUNITIVE DAMAGES,
-OR FOR LOSS OF DATA, PROFITS, REVENUE, BUSINESS, OR GOODWILL, ARISING FROM OR RELATED TO THE
-RUNTIME, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
-
-10. General
-
-The governing law, venue, and dispute terms stated in the applicable Vendor License or written
-JChat purchase terms apply to this agreement. If any provision is unenforceable, it will be limited
-to the minimum extent necessary, and the remaining provisions will continue in effect. A waiver
-must be in writing and applies only to the specific instance waived.
-
-The JChat name, logos, and related marks are not licensed except for truthful identification of
-compatible products and services.
-
-For permissions outside this agreement, contact JChat through https://jchat.com.
+4. NO REDISTRIBUTION
+You may not sub-license, rent, lease, or publicly redistribute this Software 
+to any third party without explicit written consent from the Licensor.

package/README.md

@@ -10,4 +10,4 @@ Encapsulates instance validation, local state management, and registry communica
 
 ## License
 
-See [LICENSE](./LICENSE) for terms.
+Proprietary — see the LICENSE file included in this package.

package/dist/index.d.mts

@@ -1,3 +1,4 @@
+import * as z from "zod";
 //#region src/domain.d.ts
 type Plan = "standard" | "extended";
 type RoutingMode = "path" | "subdomain";
@@ -85,7 +86,7 @@ type LocalState = {
 declare const DEFAULT_STATE_PATH: string;
 declare function createMachineFingerprint(): string;
 declare function createIdentity(machineFingerprint?: string): {
-  installationId: `${string}-${string}-${string}-${string}-${string}`;
+  installationId: string;
   machineFingerprint: string;
   privateKeyPem: string;
   publicKeyPem: string;
@@ -93,6 +94,7 @@ declare function createIdentity(machineFingerprint?: string): {
 declare function readTokenSync(filePath?: string): string;
 declare function readState(filePath?: string): Promise<LocalState | null>;
 declare function writeState(state: LocalState, filePath?: string): Promise<void>;
+declare function updateInstanceToken(instanceToken: string, statePath?: string): Promise<void>;
 declare function acquireProcessLock(statePath?: string): Promise<() => Promise<void>>;
 //#endregion
 //#region src/runtime.d.ts
@@ -105,6 +107,87 @@ declare function getRuntimeStatus(): {
 };
 declare function isApplicationDisabled(): boolean;
 //#endregion
+//#region src/install.d.ts
+type FetchLike = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+type LicenseVerificationResult = {
+  valid: true;
+  buyer: string;
+  token: string;
+  domain: string;
+  state: Omit<LocalState, "instanceToken" | "version">;
+} | {
+  valid: false;
+  error: string;
+};
+declare function installAndActivate(purchaseCode: string, domain: string, siteSlug: string | undefined, domainScope: DomainScope | undefined, routingMode: RoutingMode, provider?: PurchaseProvider, fetchImpl?: FetchLike): Promise<LicenseVerificationResult>;
+//#endregion
+//#region src/paths.d.ts
+interface RuntimePathOptions {
+  cwd?: string;
+  env?: Record<string, string | undefined>;
+}
+declare function resolveRuntimePaths(options?: RuntimePathOptions): {
+  repoRoot: string | null;
+  runtimeRoot: string;
+  uploadsDir: string;
+  addonBundlesDir: string;
+  addonSourceDir: string;
+  migrationsDir: string;
+};
+//#endregion
+//#region src/server-context.d.ts
+declare const ServerConfigSchema: z.ZodObject<{
+  JCHAT_PORT: z.ZodDefault<z.ZodPipe<z.ZodString, z.ZodTransform<number, string>>>;
+  JCHAT_COOKIE_SECRET: z.ZodString;
+  JCHAT_DATABASE_URL: z.ZodURL;
+  JCHAT_REDIS_DATABASE_URL: z.ZodURL;
+  JCHAT_STORAGE_TYPE: z.ZodEnum<{
+    readonly LOCAL: "LOCAL";
+    readonly MINIO: "MINIO";
+    readonly CLOUDFLARE_R2: "CLOUDFLARE_R2";
+    readonly AWS_S3: "AWS_S3";
+    readonly GCS: "GCS";
+  }>;
+  JCHAT_MINIO_ENDPOINT: z.ZodOptional<z.ZodString>;
+  JCHAT_MINIO_BUCKET_NAME: z.ZodOptional<z.ZodString>;
+  JCHAT_MINIO_ACCESS_KEY_ID: z.ZodOptional<z.ZodString>;
+  JCHAT_MINIO_SECRET_ACCESS_KEY: z.ZodOptional<z.ZodString>;
+  JCHAT_MINIO_PUBLIC_URL: z.ZodOptional<z.ZodString>;
+  JCHAT_AWS_REGION: z.ZodOptional<z.ZodString>;
+  JCHAT_AWS_BUCKET_NAME: z.ZodOptional<z.ZodString>;
+  JCHAT_AWS_ACCESS_KEY_ID: z.ZodOptional<z.ZodString>;
+  JCHAT_AWS_SECRET_ACCESS_KEY: z.ZodOptional<z.ZodString>;
+  JCHAT_CLOUDFLARE_ACCOUNT_ID: z.ZodOptional<z.ZodString>;
+  JCHAT_CLOUDFLARE_BUCKET_NAME: z.ZodOptional<z.ZodString>;
+  JCHAT_CLOUDFLARE_ACCESS_KEY_ID: z.ZodOptional<z.ZodString>;
+  JCHAT_CLOUDFLARE_SECRET_ACCESS_KEY: z.ZodOptional<z.ZodString>;
+  JCHAT_CLOUDFLARE_PUBLIC_URL: z.ZodOptional<z.ZodString>;
+  JCHAT_GCS_BUCKET_NAME: z.ZodOptional<z.ZodString>;
+  JCHAT_GCS_PROJECT_ID: z.ZodOptional<z.ZodString>;
+  JCHAT_GCS_CLIENT_EMAIL: z.ZodOptional<z.ZodString>;
+  JCHAT_GCS_PRIVATE_KEY: z.ZodOptional<z.ZodString>;
+  JCHAT_GCS_KEY_FILE: z.ZodOptional<z.ZodString>;
+  JCHAT_BOT_NAME: z.ZodString;
+  JCHAT_BOT_EMAIL: z.ZodEmail;
+  JCHAT_DOMAIN: z.ZodOptional<z.ZodString>;
+  JCHAT_SITE_URL: z.ZodOptional<z.ZodURL>;
+  JCHAT_ROUTING_MODE: z.ZodDefault<z.ZodEnum<{
+    path: "path";
+    subdomain: "subdomain";
+  }>>;
+  JCHAT_ADDON_ENCRYPTION_KEY: z.ZodString;
+  JCHAT_LICENSE_SERVER_URL: z.ZodOptional<z.ZodURL>;
+  JCHAT_STORE_SERVER_URL: z.ZodOptional<z.ZodURL>;
+  NODE_ENV: z.ZodDefault<z.ZodEnum<{
+    development: "development";
+    production: "production";
+    test: "test";
+  }>>;
+  SYSTEM_BOOTSTRAP_COMPLETE: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+type ServerConfig = z.infer<typeof ServerConfigSchema>;
+declare function loadServerContext(environment: Record<string, unknown>, distribution: "production" | "developer-sandbox" | undefined, publicKeyPem: string): ServerConfig;
+//#endregion
 //#region src/index.d.ts
 type PurchaseProvider = "envato" | "jchat";
 type RuntimeEnvironment = "production" | "development";
@@ -134,4 +217,4 @@ declare function verifySignature(token: string, currentDomain: string, options:
 declare function verifyEntitlement(token: string, currentDomain: string, installationId: string, machineFingerprint: string, options: RuntimeOptions): boolean;
 declare function hasEntitlement(token: string, currentDomain: string, entitlement: string, options: RuntimeOptions): boolean;
 //#endregion
-export { ActivationInput, ActivationResult, AuditEvent, CheckInput, CheckResult, ConfigPayload, DEFAULT_STATE_PATH, DomainScope, LocalState, NormalizedDomain, Plan, PurchaseProvider, RegistryProvider, RegistryRoutingMode, RoutingMode, RuntimeEnvironment, RuntimeOptions, RuntimeStatus, acquireProcessLock, activateRegistry, checkRegistry, createIdentity, createMachineFingerprint, getRuntimeStatus, hasEntitlement, isAllowedConfiguredDomain, isApplicationDisabled, isPublicDomain, normalizeDomain, parsePayload, readState, readTokenSync, recordAudit, registerInvalidationHandler, resolveActivationDomain, setRuntimeStatus, verifyEntitlement, verifySignature, writeState };
+export { ActivationInput, ActivationResult, AuditEvent, CheckInput, CheckResult, ConfigPayload, DEFAULT_STATE_PATH, DomainScope, FetchLike, LicenseVerificationResult, LocalState, NormalizedDomain, Plan, PurchaseProvider, RegistryProvider, RegistryRoutingMode, RoutingMode, RuntimeEnvironment, RuntimeOptions, RuntimeStatus, ServerConfig, ServerConfigSchema, acquireProcessLock, activateRegistry, checkRegistry, createIdentity, createMachineFingerprint, getRuntimeStatus, hasEntitlement, installAndActivate, isAllowedConfiguredDomain, isApplicationDisabled, isPublicDomain, loadServerContext, normalizeDomain, parsePayload, readState, readTokenSync, recordAudit, registerInvalidationHandler, resolveActivationDomain, resolveRuntimePaths, setRuntimeStatus, updateInstanceToken, verifyEntitlement, verifySignature, writeState };

package/dist/index.mjs

@@ -1 +1 @@
-import e from"node:crypto";import t from"node:net";import n from"node:fs/promises";import r from"node:path";import i from"node:fs";import a from"node:os";const o=new Set([`localhost`,`127.0.0.1`,`::1`]),s=[`.local`,`.test`,`.invalid`,`.example`];function c(e){let t=e.trim();if(!t)throw Error(`Instance domain is required`);let n=new URL(t.includes(`://`)?t:`https://${t}`).hostname.toLowerCase().replace(/\.$/,``),r=n===`www.localhost`?`localhost`:n.replace(/^www\./,``);if(!r||r.includes(`@`)||/\s/.test(r))throw Error(`Invalid instance domain`);return{host:r,isLocalhost:o.has(r)}}function l(e){let{host:n,isLocalhost:r}=c(e);return!r&&t.isIP(n)===0&&n.includes(`.`)&&!s.some(e=>n.endsWith(e))}function u(e){try{return c(e).isLocalhost||l(e)}catch{return!1}}function d(e){let{host:n,isLocalhost:r}=c(e);if(r||t.isIP(n)!==0)return null;let i=n.split(`.`);if(i.length<=2)return n;let a=new Set([`co`,`com`,`org`,`net`,`gov`,`edu`,`ac`,`sch`]),o=i.at(-1)??``,s=i.at(-2)??``;return a.has(s)&&o.length===2&&i.length>=3?i.slice(-3).join(`.`):i.slice(-2).join(`.`)}function f(e,t,n,r=`current-host`){let i=c(e).host;return n===`subdomain`&&t===`extended`&&r===`parent-domain`?d(i)??i:i}function p(e){if(e)return e.length<=8?`redacted`:`${e.slice(0,4)}…${e.slice(-4)}`}async function m(e,t,i=r.resolve(process.cwd(),`data/license-events.log`)){await n.mkdir(r.dirname(i),{recursive:!0});let a=JSON.stringify({at:new Date().toISOString(),event:e,domain:p(t.domain),installationId:p(t.installationId),reference:p(t.reference)});await n.appendFile(i,`${a}\n`,`utf8`)}let h=`unavailable`,g=`startup`,_;function v(e){_=e}function y(t,n=e.randomUUID()){h=t,g=n,t===`invalid`&&_?.()}function b(){return{status:h,reference:g}}function x(){return h===`invalid`}const S=Buffer.from(`aHR0cDovL2xvY2FsaG9zdDo0MDAw`,`base64`).toString(`utf8`);async function C(e){try{let t=await(e.fetchImpl??fetch)(`${e.registryEndpoint??S}/api/activate`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({purchaseCode:e.purchaseCode,domain:c(e.domain).host,siteSlug:e.siteSlug,domainScope:e.domainScope,provider:e.provider,routingMode:e.routingMode,installationId:e.installationId,installationPublicKey:e.installationPublicKey,machineFingerprint:e.machineFingerprint})}),n=await t.json();return t.ok===!1||!n.success||!n.token?{success:!1,message:n.message??`This license is already active on another domain. Please deactivate it first.`}:{success:!0,buyer:n.buyer??`Customer`,token:n.token,domain:n.domain??c(e.domain).host}}catch{return{success:!1,message:`Failed to connect to the central registry. Please try again later.`}}}async function w(t){let n=t.fetchImpl??fetch,r=t.localTokenValidator??((e,n,r,i)=>t.runtimeOptions?z(e,n,r,i,t.runtimeOptions):!1),i=(n,r)=>{let i=e.randomUUID();return y(`invalid`,i),m(`check_rejected`,{domain:n,reference:i},t.auditPath),{status:`invalid`,error:r,reference:i}},a=e=>{let n=c(t.domain).host;return r(t.token,n,t.installationId,t.machineFingerprint)?(y(`unreachable-fallback`),m(`check_unreachable`,{domain:n},t.auditPath),{status:`unreachable-fallback`,token:t.token,error:e}):i(n,`Local license validation failed.`)};try{let e=c(t.domain).host,r=await n(`${t.registryEndpoint??S}/api/check`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({token:t.token,domain:e,routingMode:t.routingMode,installationId:t.installationId,machineFingerprint:t.machineFingerprint})});if(!r.ok)return r.status>=500?a(`HTTP ${r.status}`):i(e,`License rejected by jchat service.`);let o=await r.json();if(!o.success||!o.token||!(t.runtimeOptions&&z(o.token,e,t.installationId,t.machineFingerprint,t.runtimeOptions))&&!t.localTokenValidator||t.localTokenValidator&&!t.localTokenValidator(o.token,e,t.installationId,t.machineFingerprint))return i(e,`License rejected by jchat service.`);let s=L(o.token);return!s||s.installationId!==t.installationId||s.machineFingerprint!==t.machineFingerprint||s.routingMode!==t.routingMode?i(e,`License binding rejected by jchat service.`):(y(`valid`),m(`check_success`,{domain:e},t.auditPath),{status:`valid`,token:o.token})}catch{return a(`License service unreachable.`)}}const T=r.resolve(process.cwd(),`data/instance.json`);function E(){return e.createHash(`sha256`).update([a.hostname(),a.platform(),a.arch()].join(`|`)).digest(`hex`)}function D(t=E()){let n=e.generateKeyPairSync(`ed25519`);return{installationId:e.randomUUID(),machineFingerprint:t,privateKeyPem:n.privateKey.export({type:`pkcs8`,format:`pem`}).toString(),publicKeyPem:n.publicKey.export({type:`spki`,format:`pem`}).toString()}}function O(e=T){try{if(!i.existsSync(e))return``;let t=i.readFileSync(e,`utf8`);return JSON.parse(t)?.instanceToken??``}catch{return``}}async function k(e=T){try{let t=JSON.parse(await Bun.file(e).text());if(!t||typeof t!=`object`)return null;let n=t;return n.version!==1||typeof n.installationId!=`string`||!n.installationId||typeof n.privateKeyPem!=`string`||!n.privateKeyPem||typeof n.publicKeyPem!=`string`||!n.publicKeyPem||typeof n.machineFingerprint!=`string`||!n.machineFingerprint||typeof n.instanceToken!=`string`||!n.instanceToken||n.lastSuccessfulCheckAt!==void 0&&(typeof n.lastSuccessfulCheckAt!=`string`||!n.lastSuccessfulCheckAt)?null:n}catch{return null}}async function A(t,i=T){let a=r.dirname(i);await n.mkdir(a,{recursive:!0});let o=`${i}.${process.pid}.${e.randomUUID()}.tmp`;await Bun.write(o,`${JSON.stringify(t,null,2)}\n`),await n.rename(o,i)}async function j(e=T){let t=`${e}.lock`;await n.mkdir(r.dirname(t),{recursive:!0});let i;try{i=await n.open(t,`wx`)}catch(e){if(!(e instanceof Error)||!(`code`in e)||e.code!==`EEXIST`)throw e;let r=Number.parseInt(await Bun.file(t).text().catch(()=>``),10),a=!1;if(Number.isInteger(r)&&r>0)try{process.kill(r,0),a=!0}catch{a=!1}if(a)throw Error(`Another JChat process already owns the license lock`);await n.rm(t,{force:!0}),i=await n.open(t,`wx`)}return await i.writeFile(`${process.pid}\n`),async()=>{await i.close(),await n.rm(t,{force:!0})}}function M(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function N(e){return typeof e==`string`&&e.trim().length>0}function P(e){if(!e)return null;try{return JSON.parse(Buffer.from(e,`base64url`).toString(`utf8`))}catch{return null}}function F(e){let t=e.split(`.`);if(t.length!==3)return null;let n=P(t[0]);return!M(n)||n.alg!==`RS256`||n.typ!==`JWT`?null:{alg:`RS256`,typ:`JWT`}}function I(e){if(!M(e))return null;let{iss:t,aud:n,licenseId:r,domain:i,buyer:a,installationId:o,machineFingerprint:s,plan:u,entitlements:d,purchaseProvider:f,environment:p,routingMode:m,iat:h}=e;if(!N(t)||!N(n)||!N(r)||!N(i)||!N(a)||!N(o)||!N(s)||u!==`standard`&&u!==`extended`||!Array.isArray(d)||!d.every(N)||f!==`envato`&&f!==`jchat`||p!==`production`&&p!==`development`||m!==`path`&&m!==`subdomain`||typeof h!=`number`||!Number.isSafeInteger(h)||h<0)return null;let g;try{g=c(i)}catch{return null}if(p===`development`&&!g.isLocalhost||p===`production`&&!l(i))return null;let _=d.includes(`site.create.multi`);return u===`extended`&&!_||u===`standard`&&_?null:{iss:t,aud:n,licenseId:r,domain:i,buyer:a,installationId:o,machineFingerprint:s,plan:u,entitlements:d,purchaseProvider:f,environment:p,routingMode:m,iat:h}}function L(e){let t=e.split(`.`);return t.length!==3||!t.every(Boolean)||!F(e)?null:I(P(t[1]))}function R(t,n,r){if(!t||t===`YOUR_LICENSE_KEY_PLACEHOLDER`)return!1;try{let i=t.split(`.`);if(i.length!==3||!F(t))return!1;let a=L(t);if(!a||a.iss!==(r.issuer??`https://license.jchat.local`)||a.aud!==(r.audience??`jchat-chat`)||c(a.domain).host!==c(n).host)return!1;let o=Buffer.from(`${i[0]}.${i[1]}`),s=Buffer.from(i[2].replace(/-/g,`+`).replace(/_/g,`/`),`base64`);return e.verify(`sha256`,o,r.publicKeyPem,s)}catch{return!1}}function z(e,t,n,r,i){if(!R(e,t,i))return!1;let a=L(e);return a?a.installationId===n&&a.machineFingerprint===r:!1}function B(e,t,n,r){return R(e,t,r)?L(e)?.entitlements?.includes(n)??!1:!1}export{T as DEFAULT_STATE_PATH,j as acquireProcessLock,C as activateRegistry,w as checkRegistry,D as createIdentity,E as createMachineFingerprint,b as getRuntimeStatus,B as hasEntitlement,u as isAllowedConfiguredDomain,x as isApplicationDisabled,l as isPublicDomain,c as normalizeDomain,L as parsePayload,k as readState,O as readTokenSync,m as recordAudit,v as registerInvalidationHandler,f as resolveActivationDomain,y as setRuntimeStatus,z as verifyEntitlement,R as verifySignature,A as writeState};
+import e from"node:crypto";import t from"node:net";import n from"node:fs/promises";import r from"node:path";import i from"node:fs";import a from"node:os";import{replaceKeys as o}from"string-ts";import*as s from"zod";const c=new Set([`localhost`,`127.0.0.1`,`::1`]),l=[`.local`,`.test`,`.invalid`,`.example`];function u(e){let t=e.trim();if(!t)throw Error(`Instance domain is required`);let n=new URL(t.includes(`://`)?t:`https://${t}`).hostname.toLowerCase().replace(/\.$/,``),r=n===`www.localhost`?`localhost`:n.replace(/^www\./,``);if(!r||r.includes(`@`)||/\s/.test(r))throw Error(`Invalid instance domain`);return{host:r,isLocalhost:c.has(r)}}function d(e){let{host:n,isLocalhost:r}=u(e);return!r&&t.isIP(n)===0&&n.includes(`.`)&&!l.some(e=>n.endsWith(e))}function f(e){try{return u(e).isLocalhost||d(e)}catch{return!1}}function p(e){let{host:n,isLocalhost:r}=u(e);if(r||t.isIP(n)!==0)return null;let i=n.split(`.`);if(i.length<=2)return n;let a=new Set([`co`,`com`,`org`,`net`,`gov`,`edu`,`ac`,`sch`]),o=i.at(-1)??``,s=i.at(-2)??``;return a.has(s)&&o.length===2&&i.length>=3?i.slice(-3).join(`.`):i.slice(-2).join(`.`)}function m(e,t,n,r=`current-host`){let i=u(e).host;return n===`subdomain`&&t===`extended`&&r===`parent-domain`?p(i)??i:i}function h(e){if(e)return e.length<=8?`redacted`:`${e.slice(0,4)}…${e.slice(-4)}`}async function g(e,t,i=r.resolve(process.cwd(),`data/license-events.log`)){await n.mkdir(r.dirname(i),{recursive:!0});let a=JSON.stringify({at:new Date().toISOString(),event:e,domain:h(t.domain),installationId:h(t.installationId),reference:h(t.reference)});await n.appendFile(i,`${a}\n`,`utf8`)}let _=`unavailable`,v=`startup`,y;function ee(e){y=e}function b(t,n=e.randomUUID()){_=t,v=n,t===`invalid`&&y?.()}function te(){return{status:_,reference:v}}function x(){return _===`invalid`}const S=process.env.JCHAT_LICENSE_SERVER_URL||`https://license.jchat.im`;async function C(e){try{let t=await(e.fetchImpl??fetch)(`${e.registryEndpoint??S}/api/v1/activate`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({purchaseCode:e.purchaseCode,domain:u(e.domain).host,siteSlug:e.siteSlug,domainScope:e.domainScope,provider:e.provider,routingMode:e.routingMode,installationId:e.installationId,installationPublicKey:e.installationPublicKey,machineFingerprint:e.machineFingerprint})}),n=await t.json();return t.ok===!1||!n.success||!n.token?{success:!1,message:n.message??`This license is already active on another domain. Please deactivate it first.`}:{success:!0,buyer:n.buyer??`Customer`,token:n.token,domain:n.domain??u(e.domain).host}}catch{return{success:!1,message:`Failed to connect to the central registry. Please try again later.`}}}async function w(t){let n=t.fetchImpl??fetch,r=t.localTokenValidator??((e,n,r,i)=>t.runtimeOptions?$(e,n,r,i,t.runtimeOptions):!1),i=(n,r)=>{let i=e.randomUUID();return b(`invalid`,i),g(`check_rejected`,{domain:n,reference:i},t.auditPath),{status:`invalid`,error:r,reference:i}},a=e=>{let n=u(t.domain).host;return r(t.token,n,t.installationId,t.machineFingerprint)?(b(`unreachable-fallback`),g(`check_unreachable`,{domain:n},t.auditPath),{status:`unreachable-fallback`,token:t.token,error:e}):i(n,`Local license validation failed.`)};try{let e=u(t.domain).host,r=await n(`${t.registryEndpoint??S}/api/v1/check`,{method:`POST`,headers:{"Content-Type":`application/json`},body:JSON.stringify({token:t.token,domain:e,routingMode:t.routingMode,installationId:t.installationId,machineFingerprint:t.machineFingerprint})});if(!r.ok)return r.status>=500?a(`HTTP ${r.status}`):i(e,`License rejected by jchat service.`);let o=await r.json();if(!o.success||!o.token||!(t.runtimeOptions&&$(o.token,e,t.installationId,t.machineFingerprint,t.runtimeOptions))&&!t.localTokenValidator||t.localTokenValidator&&!t.localTokenValidator(o.token,e,t.installationId,t.machineFingerprint))return i(e,`License rejected by jchat service.`);let s=Z(o.token);return!s||s.installationId!==t.installationId||s.machineFingerprint!==t.machineFingerprint||s.routingMode!==t.routingMode?i(e,`License binding rejected by jchat service.`):(b(`valid`),g(`check_success`,{domain:e},t.auditPath),{status:`valid`,token:o.token})}catch{return a(`License service unreachable.`)}}const T=r.resolve(process.cwd(),`data/instance.json`);function E(){return new Bun.CryptoHasher(`sha256`).update([a.hostname(),a.platform(),a.arch()].join(`|`)).digest(`hex`)}function D(t=E()){let n=e.generateKeyPairSync(`ed25519`);return{installationId:Bun.randomUUIDv7(),machineFingerprint:t,privateKeyPem:n.privateKey.export({type:`pkcs8`,format:`pem`}).toString(),publicKeyPem:n.publicKey.export({type:`spki`,format:`pem`}).toString()}}function O(e=T){try{if(!i.existsSync(e))return``;let t=i.readFileSync(e,`utf8`);return JSON.parse(t)?.instanceToken??``}catch{return``}}async function k(e=T){try{let t=JSON.parse(await Bun.file(e).text());if(!t||typeof t!=`object`)return null;let n=t;return n.version!==1||typeof n.installationId!=`string`||!n.installationId||typeof n.privateKeyPem!=`string`||!n.privateKeyPem||typeof n.publicKeyPem!=`string`||!n.publicKeyPem||typeof n.machineFingerprint!=`string`||!n.machineFingerprint||typeof n.instanceToken!=`string`||!n.instanceToken||n.lastSuccessfulCheckAt!==void 0&&(typeof n.lastSuccessfulCheckAt!=`string`||!n.lastSuccessfulCheckAt)?null:n}catch{return null}}async function A(e,t=T){let i=r.dirname(t);await n.mkdir(i,{recursive:!0});let a=`${t}.${process.pid}.${Bun.randomUUIDv7()}.tmp`;await Bun.write(a,`${JSON.stringify(e,null,2)}\n`),await n.rename(a,t)}async function j(e,t=T){let n=await k(t);if(!n)throw Error(`Local license state is missing`);await A({...n,instanceToken:e,lastSuccessfulCheckAt:new Date().toISOString()},t)}async function M(e=T){let t=`${e}.lock`;await n.mkdir(r.dirname(t),{recursive:!0});let i;try{i=await n.open(t,`wx`)}catch(e){if(!(e instanceof Error)||!(`code`in e)||e.code!==`EEXIST`)throw e;let r=Number.parseInt(await Bun.file(t).text().catch(()=>``),10),a=!1;if(Number.isInteger(r)&&r>0)try{process.kill(r,0),a=!0}catch{a=!1}if(a)throw Error(`Another JChat process already owns the license lock`,{cause:e});await n.rm(t,{force:!0}),i=await n.open(t,`wx`)}return await i.writeFile(`${process.pid}\n`),async()=>{await i.close(),await n.rm(t,{force:!0})}}async function N(e,t,n,r,i,a=`envato`,o=fetch){let s=D();try{let c=await C({purchaseCode:e,domain:t,siteSlug:n,domainScope:r,routingMode:i,provider:a,installationId:s.installationId,installationPublicKey:s.publicKeyPem,machineFingerprint:s.machineFingerprint,fetchImpl:o});return c.success?{valid:!0,buyer:c.buyer,token:c.token,domain:c.domain,state:s}:{valid:!1,error:c.message}}catch{return{valid:!1,error:`Failed to verify license. Check your internet connection.`}}}function P(e={}){let t=r.resolve(e.cwd??process.cwd()),n=e.env??process.env,i=I(t);return{repoRoot:i,runtimeRoot:t,uploadsDir:L(n.JCHAT_UPLOADS_DIR,t,i,`uploads`,`uploads`),addonBundlesDir:L(n.JCHAT_ADDONS_DIR,t,i,`addons`,`addons`),addonSourceDir:i?r.join(i,`addons`):r.join(t,`addons`),migrationsDir:L(n.JCHAT_MIGRATIONS_DIR,t,i,r.join(`packages`,`db`,`migrations`),`migrations`)}}function F(e){return i.existsSync(r.join(e,`package.json`))&&i.existsSync(r.join(e,`apps`))&&i.existsSync(r.join(e,`packages`))}function I(e){let t=r.resolve(e);for(;;){if(F(t))return t;let e=r.dirname(t);if(e===t)return null;t=e}}function L(e,t,n,i,a){return e?r.resolve(e):n?r.join(n,i):r.join(t,a)}`${[`manage`,`www`].join(`|`)}`;const R={PERMISSIONS:`permissions`,USERS:`users`,BOTS:`bots`,CORES:`cores`,SETTINGS:`settings`,MEMBERSHIPS:`memberships`,ROOMS:`rooms`,SITES:`sites`,RANKS:`ranks`,BLOCKS:`blocks`,BLOCKERS:`blockers`,SPAMS:`spams`,SOCIALS:`socials`,XPS:`xps`,JOINS:`joins`,DAILIES:`dailies`,SESSIONS:`sessions`,MEMBERS:`members`,STREAMS:`streams`,AUDITS:`audits`,ACTIONS:`actions`,UPDATES:`updates`,LOGS:`logs`,ERRORS:`errors`,CONFIGS:`configs`,BANS:`bans`};`${R.STREAMS}${R.AUDITS}${R.ACTIONS}`,`${R.STREAMS}${R.XPS}${R.UPDATES}`,`${R.STREAMS}${R.LOGS}${R.ERRORS}`;const z={MESSAGING:`Messaging`,PRIVATE_MESSAGING:`Private Messaging`,ROOMS:`Rooms`,MODERATION:`Moderation`,PROFILE:`Profile`,POSTS:`Posts`,GIFTS:`Gifts`,FRIENDS:`Friends`,SITE_ADMIN:`Site Admin`,ADDONS:`Addons`,COMMANDS:`Commands`},B={ALL:{value:`*`,label:`Super Admin`,description:`Grants absolute access to every feature and setting. Use with extreme caution.`,category:z.SITE_ADMIN},MESSAGE_SEND:{value:`message.send`,label:`Send Messages`,description:`Allows the user to send messages in public chat rooms.`,category:z.MESSAGING},MESSAGE_DELETE_OWN:{value:`message.delete.own`,label:`Delete Own Messages`,description:`Allows the user to remove their own sent messages.`,category:z.MESSAGING},MESSAGE_DELETE_ANY:{value:`message.delete.any`,label:`Delete Any Message`,description:`Moderator tool: delete messages sent by any user.`,category:z.MESSAGING},MESSAGE_CLEAR:{value:`message.clear`,label:`Clear Chat`,description:`Allows clearing the entire message history of a room.`,category:z.MESSAGING},MESSAGE_UPLOAD:{value:`message.upload`,label:`Upload Files`,description:`Allows attaching images and files to messages.`,category:z.MESSAGING},MESSAGE_USE_COMMANDS:{value:`message.use_commands`,label:`Use Slash Commands`,description:`Allows executing chat commands (e.g., /me, /shrug).`,category:z.MESSAGING},MESSAGE_WILDCARD:{value:`message.*`,label:`Full Messaging Access`,description:`Grants all message-related permissions in a room.`,category:z.MESSAGING},PM_SEND:{value:`pm.send`,label:`Send Private Messages`,description:`Allows starting and participating in 1-on-1 private conversations.`,category:z.PRIVATE_MESSAGING},PM_DELETE_OWN:{value:`pm.delete.own`,label:`Delete Own PMs`,description:`Allows deleting messages sent in private chats.`,category:z.PRIVATE_MESSAGING},PM_READ_ANY:{value:`pm.read.any`,label:`Read Any PM`,description:`Administrative tool: View all private conversations on the site.`,category:z.PRIVATE_MESSAGING},PM_DELETE_ANY:{value:`pm.delete.any`,label:`Delete Any PM`,description:`Moderator tool: Remove private messages sent by any user.`,category:z.PRIVATE_MESSAGING},PM_BYPASS:{value:`pm.bypass`,label:`Bypass Privacy Settings`,description:`Allows bypassing receiver's privacy settings (e.g. not accepting PMs or friends only).`,category:z.PRIVATE_MESSAGING},PM_WILDCARD:{value:`pm.*`,label:`Full PM Access`,description:`Grants all private-messaging related permissions.`,category:z.PRIVATE_MESSAGING},ROOM_JOIN:{value:`room.join`,label:`Join Rooms`,description:`Allows users to enter and view public or restricted chat rooms.`,category:z.ROOMS},ROOM_CREATE:{value:`room.create`,label:`Create Rooms`,description:`Allows users to create new chat rooms.`,category:z.ROOMS},ROOM_EDIT:{value:`room.edit`,label:`Edit Room Settings`,description:`Allows changing room names, descriptions, and settings.`,category:z.ROOMS},ROOM_DELETE:{value:`room.delete`,label:`Delete Rooms`,description:`Allows permanently removing chat rooms and their history.`,category:z.ROOMS},ROOM_LOCK:{value:`room.lock`,label:`Lock/Unlock Rooms`,description:`Allows moderators to temporarily prevent new messages in a room.`,category:z.ROOMS},ROOM_SET_TOPIC:{value:`room.set_topic`,label:`Change Room Topic`,description:`Allows updating the current topic/announcement displayed in a room.`,category:z.ROOMS},ROOM_WILDCARD:{value:`room.*`,label:`Full Room Management`,description:`Grants all room-related administration permissions.`,category:z.ROOMS},USER_KICK:{value:`user.kick`,label:`Kick Users`,description:`Allows removing a user from a room temporarily.`,category:z.MODERATION},USER_BAN:{value:`user.ban`,label:`Ban Users`,description:`Allows permanently banning users from the site or specific rooms.`,category:z.MODERATION},USER_UNBAN:{value:`user.unban`,label:`Unban Users`,description:`Allows lifting previously imposed bans.`,category:z.MODERATION},USER_MUTE:{value:`user.mute`,label:`Mute Users`,description:`Allows preventing a user from sending messages for a duration.`,category:z.MODERATION},USER_UNMUTE:{value:`user.unmute`,label:`Unmute Users`,description:`Allows lifting mutes early.`,category:z.MODERATION},USER_EDIT_RANK:{value:`user.edit_rank`,label:`Manage User Ranks`,description:`Allows assigning or removing ranks for other users.`,category:z.MODERATION},USER_VIEW_PROFILE:{value:`user.view_profile`,label:`View Profiles`,description:`Allows viewing detailed user profiles and settings.`,category:z.MODERATION},USER_WILDCARD:{value:`user.*`,label:`Full Moderation Access`,description:`Grants all user-management and moderation permissions.`,category:z.MODERATION},PROFILE_EDIT:{value:`profile.edit`,label:`Edit Own Profile`,description:`Allows users to change their display name, bio, and avatar.`,category:z.PROFILE},PROFILE_CUSTOMIZE:{value:`profile.customize`,label:`Profile Customization`,description:`Allows advanced styling like custom fonts, themes, and backgrounds.`,category:z.PROFILE},PROFILE_SET_STATUS:{value:`profile.set_status`,label:`Set Status`,description:`Allows setting custom status messages and status indicators.`,category:z.PROFILE},POST_CREATE:{value:`post.create`,label:`Create Posts`,description:`Allows sharing updates and media in the activity feed.`,category:z.POSTS},POST_CREATE_ANNOUNCEMENT:{value:`post.create.announcement`,label:`Create Announcements`,description:`Allows creating official site announcements.`,category:z.POSTS},POST_EDIT_OWN:{value:`post.edit.own`,label:`Edit Own Posts`,description:`Allows modifying previously shared feed posts.`,category:z.POSTS},POST_EDIT_ANY:{value:`post.edit.any`,label:`Edit Any Post`,description:`Administrative tool: Edit posts shared by any user.`,category:z.POSTS},POST_DELETE_OWN:{value:`post.delete.own`,label:`Delete Own Posts`,description:`Allows removing personal feed posts.`,category:z.POSTS},POST_DELETE_ANY:{value:`post.delete.any`,label:`Delete Any Post`,description:`Moderator tool: Remove posts shared by any user.`,category:z.POSTS},POST_REACT:{value:`post.react`,label:`React to Posts`,description:`Allows adding emoji reactions to feed posts.`,category:z.POSTS},POST_COMMENT:{value:`post.comment`,label:`Comment on Posts`,description:`Allows joining the conversation on shared feed items.`,category:z.POSTS},POST_COMMENT_DELETE_OWN:{value:`post.comment.delete.own`,label:`Delete Own Comments`,description:`Allows removing personal comments from feed posts.`,category:z.POSTS},POST_COMMENT_DELETE_ANY:{value:`post.comment.delete.any`,label:`Delete Any Comment`,description:`Moderator tool: Remove comments left by any user.`,category:z.POSTS},POST_WILDCARD:{value:`post.*`,label:`Full Feed Access`,description:`Grants all permissions related to the activity feed.`,category:z.POSTS},USER_BLOCK:{value:`user.block`,label:`Block Users`,description:`Allows preventing specific users from contacting the user.`,category:z.MODERATION},USER_UNBLOCK:{value:`user.unblock`,label:`Unblock Users`,description:`Allows lifting previously imposed user blocks.`,category:z.MODERATION},USER_IGNORE:{value:`user.ignore`,label:`Ignore Users`,description:`Allows hiding messages and notifications from specific users.`,category:z.MODERATION},USER_UNIGNORE:{value:`user.unignore`,label:`Stop Ignoring`,description:`Allows showing messages from previously ignored users again.`,category:z.MODERATION},SITE_EDIT:{value:`site.edit`,label:`Edit Site Settings`,description:`Allows changing site name, branding, and global configuration.`,category:z.SITE_ADMIN},SITE_CREATE:{value:`site.create`,label:`Create New Sites`,description:`Master Admin tool: Create independent Jchat site instances.`,category:z.SITE_ADMIN},SITE_MANAGE_RANKS:{value:`site.manage_ranks`,label:`Manage Ranks & Perms`,description:`Allows creating ranks and configuring their permission sets.`,category:z.SITE_ADMIN},SITE_MANAGE_ADDONS:{value:`site.manage_addons`,label:`Manage Addons`,description:`Allows installing, configuring, and removing jchat Addons.`,category:z.SITE_ADMIN},SITE_VIEW_AUDIT:{value:`site.view_audit`,label:`View Audit Logs`,description:`Administrative tool: See a detailed record of all admin actions.`,category:z.SITE_ADMIN},SITE_VIEW_REPORTS:{label:`View Reports`,value:`site.view_reports`,description:`Allows seeing reports filed by users against content or people.`,category:z.SITE_ADMIN},SITE_MANAGE_REPORTS:{value:`site.manage_reports`,label:`Handle Reports`,description:`Allows resolving or dismissing user reports.`,category:z.SITE_ADMIN},SITE_MANAGE_SPAM:{value:`site.manage_spam`,label:`Manage Anti-Spam`,description:`Allows configuring the anti-spam engine, thresholds, and per-module settings.`,category:z.SITE_ADMIN},SITE_WILDCARD:{value:`site.*`,label:`Full Site Administration`,description:`Grants all technical administration and site discovery permissions.`,category:z.SITE_ADMIN},FRIEND_REQUEST_SEND:{value:`friend.request.send`,label:`Send Friend Requests`,description:`Allows the user to send friend requests to other users.`,category:z.FRIENDS},FRIEND_REQUEST_MANAGE:{value:`friend.request.manage`,label:`Manage Friend Requests`,description:`Allows the user to accept or reject incoming friend requests.`,category:z.FRIENDS},FRIEND_REMOVE:{value:`friend.remove`,label:`Remove Friends`,description:`Allows the user to remove accepted friends from their list.`,category:z.FRIENDS},FRIEND_LIST:{value:`friend.list`,label:`View Friend List`,description:`Allows the user to view their own friends list.`,category:z.FRIENDS},ADDON_WILDCARD:{value:`addon.*`,label:`Full Addon System Access`,description:`Grants access to use every installed addon regardless of specific gates.`,category:z.ADDONS},COMMAND_CLEAR:{value:`command.clear`,label:`Clear Chat Command`,description:`Allows using the /clear slash command to clear chat history.`,category:z.COMMANDS},COMMAND_HELP:{value:`command.help`,label:`View Commands Help`,description:`Allows using the /help slash command.`,category:z.COMMANDS}},V=Object.fromEntries(Object.entries(B).map(([e,t])=>[e,t.value])),ne=Object.fromEntries(Object.entries(B).map(([e,t])=>[t.value,{name:t.value,label:t.label,description:t.description,category:t.category}]));Object.values(ne);const H=[V.MESSAGE_SEND,V.MESSAGE_UPLOAD,V.MESSAGE_DELETE_OWN,V.PM_SEND,V.PM_DELETE_OWN,V.ROOM_JOIN,V.POST_REACT,V.POST_COMMENT,V.POST_COMMENT_DELETE_OWN,V.PROFILE_EDIT,V.PROFILE_SET_STATUS,V.COMMAND_HELP];V.ALL,[V.SITE_EDIT,V.SITE_MANAGE_RANKS,V.SITE_MANAGE_ADDONS,V.SITE_VIEW_AUDIT,V.SITE_VIEW_REPORTS,V.SITE_MANAGE_REPORTS,V.SITE_MANAGE_SPAM,V.USER_WILDCARD,V.ROOM_EDIT,V.ROOM_DELETE,V.ROOM_LOCK,V.ROOM_SET_TOPIC,V.MESSAGE_WILDCARD,V.POST_WILDCARD,V.PM_WILDCARD,V.PROFILE_CUSTOMIZE,V.MESSAGE_USE_COMMANDS,V.POST_CREATE,V.POST_EDIT_OWN,V.POST_DELETE_OWN,V.FRIEND_REQUEST_SEND,V.FRIEND_REQUEST_MANAGE,V.FRIEND_REMOVE,V.FRIEND_LIST,V.COMMAND_CLEAR,...H],[V.ROOM_EDIT,V.ROOM_LOCK,V.ROOM_SET_TOPIC,V.MESSAGE_WILDCARD,V.POST_WILDCARD,V.PM_SEND,V.PM_DELETE_OWN,V.PM_READ_ANY,V.PM_DELETE_ANY,V.USER_KICK,V.USER_MUTE,V.USER_UNMUTE,V.USER_BAN,V.USER_UNBAN,V.PROFILE_CUSTOMIZE,V.MESSAGE_USE_COMMANDS,V.POST_CREATE,V.POST_EDIT_OWN,V.POST_DELETE_OWN,V.FRIEND_REQUEST_SEND,V.FRIEND_REQUEST_MANAGE,V.FRIEND_REMOVE,V.FRIEND_LIST,V.COMMAND_CLEAR,...H],[V.USER_KICK,V.USER_MUTE,V.USER_UNMUTE,V.MESSAGE_DELETE_ANY,V.MESSAGE_CLEAR,V.PROFILE_CUSTOMIZE,V.MESSAGE_USE_COMMANDS,V.POST_CREATE,V.POST_EDIT_OWN,V.POST_DELETE_OWN,V.FRIEND_REQUEST_SEND,V.FRIEND_REQUEST_MANAGE,V.FRIEND_REMOVE,V.FRIEND_LIST,V.COMMAND_CLEAR,...H],[V.PROFILE_CUSTOMIZE,V.MESSAGE_USE_COMMANDS,V.POST_CREATE,V.POST_EDIT_OWN,V.POST_DELETE_OWN,V.FRIEND_REQUEST_SEND,V.FRIEND_REQUEST_MANAGE,V.FRIEND_REMOVE,V.FRIEND_LIST,...H],[V.MESSAGE_USE_COMMANDS,V.POST_CREATE,V.POST_EDIT_OWN,V.POST_DELETE_OWN,V.FRIEND_REQUEST_SEND,V.FRIEND_REQUEST_MANAGE,V.FRIEND_REMOVE,V.FRIEND_LIST,...H],[...H];const U={LOCAL:`LOCAL`,MINIO:`MINIO`,CLOUDFLARE_R2:`CLOUDFLARE_R2`,AWS_S3:`AWS_S3`,GCS:`GCS`};function re(e){let t=e?.trim().replace(/^https?:\/\//,``).split(`/`)[0].split(`:`)[0].replace(/^\.+/,``);if(!t||t===`localhost`||t.endsWith(`.localhost`)||/^\d{1,3}(\.\d{1,3}){3}$/.test(t))return;let n=t.split(`.`);if(n.length>2){let e=[`co`,`com`,`org`,`net`,`gov`,`edu`,`ac`,`sch`],t=n[n.length-1],r=n[n.length-2];return e.includes(r)&&t.length===2&&n.length>=3?n.slice(-3).join(`.`):n.slice(-2).join(`.`)}return t}function ie(e){let t=e?.trim().replace(/^https?:\/\//,``).split(`/`)[0].split(`:`)[0].replace(/^\.+/,``).toLowerCase();return t?t===`localhost`||/^\d{1,3}(\.\d{1,3}){3}$/.test(t)?!0:re(t)===t:!1}new Map([{label:`Default`,value:`lato`,family:`'Lato', sans-serif`,googleName:`Lato`,scale:1},{label:`Elegant`,value:`playfair`,family:`'Playfair Display', serif`,googleName:`Playfair Display`,scale:1.1},{label:`Cursive`,value:`dancing`,family:`'Dancing Script', cursive`,googleName:`Dancing Script`,scale:1.2},{label:`Modern`,value:`poppins`,family:`'Poppins', sans-serif`,googleName:`Poppins`,scale:1},{label:`Monospace`,value:`jetbrains`,family:`'JetBrains Mono', monospace`,googleName:`JetBrains Mono`,scale:.95},{label:`Rounded`,value:`quicksand`,family:`'Quicksand', sans-serif`,googleName:`Quicksand`,scale:1},{label:`Serif`,value:`roboto-serif`,family:`'Roboto Serif', serif`,googleName:`Roboto Serif`,scale:1.05},{label:`Sci-Fi`,value:`audiowide`,family:`'Audiowide', cursive`,googleName:`Audiowide`,scale:.95},{label:`Type`,value:`special-elite`,family:`'Special Elite', cursive`,googleName:`Special Elite`,scale:1.15},{label:`Pixel`,value:`press-start`,family:`'Press Start 2P', cursive`,googleName:`Press Start 2P`,scale:.75},{label:`Gothic`,value:`grenze`,family:`'Grenze Gotisch', cursive`,googleName:`Grenze Gotisch`,scale:1.15},{label:`Deco`,value:`righteous`,family:`'Righteous', cursive`,googleName:`Righteous`,scale:1},{label:`Spooky`,value:`creepster`,family:`'Creepster', cursive`,googleName:`Creepster`,scale:1.1},{label:`Shadow`,value:`vast-shadow`,family:`'Vast Shadow', cursive`,googleName:`Vast Shadow`,scale:1.05},{label:`Tech`,value:`syncopate`,family:`'Syncopate', sans-serif`,googleName:`Syncopate`,scale:.9},{label:`Script`,value:`lobster`,family:`'Lobster', cursive`,googleName:`Lobster`,scale:1.05}].map(e=>[e.value,e.scale]));const ae=typeof window<`u`&&window.document!==void 0&&!window.process,W={brand:`color: #06b6d4; font-weight: bold;`,timestamp:`color: #888; font-size: 10px; font-family: monospace;`,info:`color: #3b82f6; font-weight: bold;`,success:`color: #10b981; font-weight: bold;`,warn:`color: #f59e0b; font-weight: bold;`,error:`color: #ef4444; font-weight: bold;`,debug:`color: #6366f1; font-style: italic;`,content:`color: inherit; font-family: inherit;`},G={reset:`\x1B[0m`,brand:`\x1B[1m\x1B[36m`,timestamp:`\x1B[90m`,info:`\x1B[1m\x1B[34m`,success:`\x1B[1m\x1B[32m`,warn:`\x1B[1m\x1B[33m`,error:`\x1B[1m\x1B[31m`,debug:`\x1B[3m\x1B[35m`};new Proxy(console,{get(e,t){if([`info`,`success`,`warn`,`error`,`debug`].includes(t)){let e=new Date().toLocaleTimeString();if(ae)return import.meta.env?.PROD&&t===`debug`?()=>{}:console.log.bind(console,`%c${e} %c[jchat]%c ${t}%c`,W.timestamp,W.brand,W[t],W.content);{let n=G[t]||``,r=G.brand,i=G.timestamp,a=G.reset;return console.log.bind(console,`${i}${e}${a} ${r}[jchat]${a} ${n}${t}${a}${i}`)}}return e[t]}});function oe(e){return t=>e.parse(o(t,`VITE_`,``))}const K=s.object({JCHAT_PORT:s.string().regex(/^\d+$/).transform(Number).refine(e=>e>=1&&e<=65535,{message:`Port must be between 1 and 65535`}).refine(e=>e!==80&&e!==443,{message:`Avoid ports 80/443 (reserved for HTTP/HTTPS)`}).default(3e3),JCHAT_COOKIE_SECRET:s.string().min(1),JCHAT_DATABASE_URL:s.url().startsWith(`postgresql://`).regex(/^postgresql:\/\/([^:]+):([^@]+)@([^:]+):(\d+)\/([^?]+)(\?.*)?$/,{message:`Must be in format: postgresql://username:password@host:port/database?schema`}),JCHAT_REDIS_DATABASE_URL:s.url().refine(e=>e.startsWith(`rediss://`)||e.startsWith(`redis://`),{message:`Must use redis:// or rediss:// protocol`}).refine(e=>/^(rediss?):\/\/(?:([^:]+):([^@]+)@)?([^:]+):(\d+)$/.test(e),{message:`Must be in format: rediss://default:<password>@<host>:<port>`}),JCHAT_STORAGE_TYPE:s.enum(U),JCHAT_MINIO_ENDPOINT:s.string().optional(),JCHAT_MINIO_BUCKET_NAME:s.string().optional(),JCHAT_MINIO_ACCESS_KEY_ID:s.string().optional(),JCHAT_MINIO_SECRET_ACCESS_KEY:s.string().optional(),JCHAT_MINIO_PUBLIC_URL:s.string().optional(),JCHAT_AWS_REGION:s.string().optional(),JCHAT_AWS_BUCKET_NAME:s.string().optional(),JCHAT_AWS_ACCESS_KEY_ID:s.string().optional(),JCHAT_AWS_SECRET_ACCESS_KEY:s.string().optional(),JCHAT_CLOUDFLARE_ACCOUNT_ID:s.string().optional(),JCHAT_CLOUDFLARE_BUCKET_NAME:s.string().optional(),JCHAT_CLOUDFLARE_ACCESS_KEY_ID:s.string().optional(),JCHAT_CLOUDFLARE_SECRET_ACCESS_KEY:s.string().optional(),JCHAT_CLOUDFLARE_PUBLIC_URL:s.string().optional(),JCHAT_GCS_BUCKET_NAME:s.string().optional(),JCHAT_GCS_PROJECT_ID:s.string().optional(),JCHAT_GCS_CLIENT_EMAIL:s.string().optional(),JCHAT_GCS_PRIVATE_KEY:s.string().optional(),JCHAT_GCS_KEY_FILE:s.string().optional(),JCHAT_BOT_NAME:s.string().trim().min(3),JCHAT_BOT_EMAIL:s.email(),JCHAT_DOMAIN:s.string().optional(),JCHAT_SITE_URL:s.url().optional(),JCHAT_ROUTING_MODE:s.enum([`path`,`subdomain`]).default(`subdomain`),JCHAT_ADDON_ENCRYPTION_KEY:s.string().min(16),JCHAT_LICENSE_SERVER_URL:s.url().optional(),JCHAT_STORE_SERVER_URL:s.url().optional(),NODE_ENV:s.enum([`development`,`test`,`production`]).default(`development`),SYSTEM_BOOTSTRAP_COMPLETE:s.boolean().optional()}).superRefine((e,t)=>{if(e.JCHAT_SITE_URL){let n;try{n=new URL(e.JCHAT_SITE_URL).hostname}catch{}n&&!ie(n)&&t.addIssue({path:[`JCHAT_SITE_URL`],code:`custom`,message:`JCHAT_SITE_URL must use the client main/root domain`})}e.JCHAT_STORAGE_TYPE===U.MINIO&&!(e.JCHAT_MINIO_ENDPOINT&&e.JCHAT_MINIO_BUCKET_NAME&&e.JCHAT_MINIO_ACCESS_KEY_ID&&e.JCHAT_MINIO_SECRET_ACCESS_KEY&&e.JCHAT_MINIO_PUBLIC_URL)&&(e.JCHAT_MINIO_ENDPOINT||t.addIssue({path:[`JCHAT_MINIO_ENDPOINT`],code:`custom`,message:`JCHAT_MINIO_ENDPOINT is required when JCHAT_STORAGE_TYPE is MINIO`}),e.JCHAT_MINIO_BUCKET_NAME||t.addIssue({path:[`JCHAT_MINIO_BUCKET_NAME`],code:`custom`,message:`JCHAT_MINIO_BUCKET_NAME is required when JCHAT_STORAGE_TYPE is MINIO`}),e.JCHAT_MINIO_ACCESS_KEY_ID||t.addIssue({path:[`JCHAT_MINIO_ACCESS_KEY_ID`],code:`custom`,message:`JCHAT_MINIO_ACCESS_KEY_ID is required when JCHAT_STORAGE_TYPE is MINIO`}),e.JCHAT_MINIO_SECRET_ACCESS_KEY||t.addIssue({path:[`JCHAT_MINIO_SECRET_ACCESS_KEY`],code:`custom`,message:`JCHAT_MINIO_SECRET_ACCESS_KEY is required when JCHAT_STORAGE_TYPE is MINIO`}),e.JCHAT_MINIO_PUBLIC_URL||t.addIssue({path:[`JCHAT_MINIO_PUBLIC_URL`],code:`custom`,message:`JCHAT_MINIO_PUBLIC_URL is required when JCHAT_STORAGE_TYPE is MINIO`})),e.JCHAT_STORAGE_TYPE===U.AWS_S3&&!(e.JCHAT_AWS_REGION&&e.JCHAT_AWS_ACCESS_KEY_ID&&e.JCHAT_AWS_SECRET_ACCESS_KEY&&e.JCHAT_AWS_BUCKET_NAME)&&(e.JCHAT_AWS_REGION||t.addIssue({path:[`JCHAT_AWS_REGION`],code:`custom`,message:`JCHAT_AWS_REGION is required when JCHAT_STORAGE_TYPE is AWS_S3`}),e.JCHAT_AWS_ACCESS_KEY_ID||t.addIssue({path:[`JCHAT_AWS_ACCESS_KEY_ID`],code:`custom`,message:`JCHAT_AWS_ACCESS_KEY_ID is required when JCHAT_STORAGE_TYPE is AWS_S3`}),e.JCHAT_AWS_SECRET_ACCESS_KEY||t.addIssue({path:[`JCHAT_AWS_SECRET_ACCESS_KEY`],code:`custom`,message:`JCHAT_AWS_SECRET_ACCESS_KEY is required when JCHAT_STORAGE_TYPE is AWS_S3`}),e.JCHAT_AWS_BUCKET_NAME||t.addIssue({path:[`JCHAT_AWS_BUCKET_NAME`],code:`custom`,message:`JCHAT_AWS_BUCKET_NAME is required when JCHAT_STORAGE_TYPE is AWS_S3`})),e.JCHAT_STORAGE_TYPE===U.CLOUDFLARE_R2&&!(e.JCHAT_CLOUDFLARE_ACCOUNT_ID&&e.JCHAT_CLOUDFLARE_ACCESS_KEY_ID&&e.JCHAT_CLOUDFLARE_SECRET_ACCESS_KEY&&e.JCHAT_CLOUDFLARE_BUCKET_NAME&&e.JCHAT_CLOUDFLARE_PUBLIC_URL)&&(e.JCHAT_CLOUDFLARE_ACCOUNT_ID||t.addIssue({path:[`JCHAT_CLOUDFLARE_ACCOUNT_ID`],code:`custom`,message:`JCHAT_CLOUDFLARE_ACCOUNT_ID is required when JCHAT_STORAGE_TYPE is CLOUDFLARE_R2`}),e.JCHAT_CLOUDFLARE_ACCESS_KEY_ID||t.addIssue({path:[`JCHAT_CLOUDFLARE_ACCESS_KEY_ID`],code:`custom`,message:`JCHAT_CLOUDFLARE_ACCESS_KEY_ID is required when JCHAT_STORAGE_TYPE is CLOUDFLARE_R2`}),e.JCHAT_CLOUDFLARE_SECRET_ACCESS_KEY||t.addIssue({path:[`JCHAT_CLOUDFLARE_SECRET_ACCESS_KEY`],code:`custom`,message:`JCHAT_CLOUDFLARE_SECRET_ACCESS_KEY is required when JCHAT_STORAGE_TYPE is CLOUDFLARE_R2`}),e.JCHAT_CLOUDFLARE_BUCKET_NAME||t.addIssue({path:[`JCHAT_CLOUDFLARE_BUCKET_NAME`],code:`custom`,message:`JCHAT_CLOUDFLARE_BUCKET_NAME is required when JCHAT_STORAGE_TYPE is CLOUDFLARE_R2`}),e.JCHAT_CLOUDFLARE_PUBLIC_URL||t.addIssue({path:[`JCHAT_CLOUDFLARE_PUBLIC_URL`],code:`custom`,message:`JCHAT_CLOUDFLARE_PUBLIC_URL is required when JCHAT_STORAGE_TYPE is CLOUDFLARE_R2`})),e.JCHAT_STORAGE_TYPE===U.GCS&&!(e.JCHAT_GCS_PROJECT_ID&&e.JCHAT_GCS_BUCKET_NAME&&e.JCHAT_GCS_CLIENT_EMAIL&&e.JCHAT_GCS_PRIVATE_KEY)&&(e.JCHAT_GCS_PROJECT_ID||t.addIssue({path:[`JCHAT_GCS_PROJECT_ID`],code:`custom`,message:`JCHAT_GCS_PROJECT_ID is required when JCHAT_STORAGE_TYPE is GCS`}),e.JCHAT_GCS_BUCKET_NAME||t.addIssue({path:[`JCHAT_GCS_BUCKET_NAME`],code:`custom`,message:`JCHAT_GCS_BUCKET_NAME is required when JCHAT_STORAGE_TYPE is GCS`}),e.JCHAT_GCS_CLIENT_EMAIL||t.addIssue({path:[`JCHAT_GCS_CLIENT_EMAIL`],code:`custom`,message:`JCHAT_GCS_CLIENT_EMAIL is required when JCHAT_STORAGE_TYPE is GCS`}),e.JCHAT_GCS_PRIVATE_KEY||t.addIssue({path:[`JCHAT_GCS_PRIVATE_KEY`],code:`custom`,message:`JCHAT_GCS_PRIVATE_KEY is required when JCHAT_STORAGE_TYPE is GCS`}))});function se(t,n=`production`,r){let i,a=!0;try{i=oe(K)(t);let o=O();if(n===`developer-sandbox`)a=!0;else if(!o)a=!1;else if(!i.JCHAT_DOMAIN||!f(i.JCHAT_DOMAIN))throw Error(`A valid installed JChat domain is required`);else if(!Q(o,i.JCHAT_DOMAIN||`localhost`,{publicKeyPem:r}))a=!1;else{let t=o.split(`.`),n=t[2]||``;if(n){let r=e.createHmac(`sha256`,n).update(`${t[0]}.${t[1]}`).digest(`hex`);i.JCHAT_COOKIE_SECRET+=r}}}catch{a=!1,i={...t,JCHAT_PORT:t.JCHAT_PORT?parseInt(String(t.JCHAT_PORT)):3e3}}return i.SYSTEM_BOOTSTRAP_COMPLETE=a,i}function q(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function J(e){return typeof e==`string`&&e.trim().length>0}function Y(e){if(!e)return null;try{return JSON.parse(Buffer.from(e,`base64url`).toString(`utf8`))}catch{return null}}function X(e){let t=e.split(`.`);if(t.length!==3)return null;let n=Y(t[0]);return!q(n)||n.alg!==`RS256`||n.typ!==`JWT`?null:{alg:`RS256`,typ:`JWT`}}function ce(e){if(!q(e))return null;let{iss:t,aud:n,licenseId:r,domain:i,buyer:a,installationId:o,machineFingerprint:s,plan:c,entitlements:l,purchaseProvider:f,environment:p,routingMode:m,iat:h}=e;if(!J(t)||!J(n)||!J(r)||!J(i)||!J(a)||!J(o)||!J(s)||c!==`standard`&&c!==`extended`||!Array.isArray(l)||!l.every(J)||f!==`envato`&&f!==`jchat`||p!==`production`&&p!==`development`||m!==`path`&&m!==`subdomain`||typeof h!=`number`||!Number.isSafeInteger(h)||h<0)return null;let g;try{g=u(i)}catch{return null}if(p===`development`&&!g.isLocalhost||p===`production`&&!d(i))return null;let _=l.includes(`site.create.multi`);return c===`extended`&&!_||c===`standard`&&_?null:{iss:t,aud:n,licenseId:r,domain:i,buyer:a,installationId:o,machineFingerprint:s,plan:c,entitlements:l,purchaseProvider:f,environment:p,routingMode:m,iat:h}}function Z(e){let t=e.split(`.`);return t.length!==3||!t.every(Boolean)||!X(e)?null:ce(Y(t[1]))}function Q(t,n,r){if(!t||t===`YOUR_LICENSE_KEY_PLACEHOLDER`)return!1;try{let i=t.split(`.`);if(i.length!==3||!X(t))return!1;let a=Z(t);if(!a||a.iss!==(r.issuer??`https://license.jchat.local`)||a.aud!==(r.audience??`jchat-chat`)||u(a.domain).host!==u(n).host)return!1;let o=Buffer.from(`${i[0]}.${i[1]}`),s=Buffer.from(i[2].replace(/-/g,`+`).replace(/_/g,`/`),`base64`);return e.verify(`sha256`,o,r.publicKeyPem,s)}catch{return!1}}function $(e,t,n,r,i){if(!Q(e,t,i))return!1;let a=Z(e);return a?a.installationId===n&&a.machineFingerprint===r:!1}function le(e,t,n,r){return Q(e,t,r)?Z(e)?.entitlements?.includes(n)??!1:!1}export{T as DEFAULT_STATE_PATH,K as ServerConfigSchema,M as acquireProcessLock,C as activateRegistry,w as checkRegistry,D as createIdentity,E as createMachineFingerprint,te as getRuntimeStatus,le as hasEntitlement,N as installAndActivate,f as isAllowedConfiguredDomain,x as isApplicationDisabled,d as isPublicDomain,se as loadServerContext,u as normalizeDomain,Z as parsePayload,k as readState,O as readTokenSync,g as recordAudit,ee as registerInvalidationHandler,m as resolveActivationDomain,P as resolveRuntimePaths,b as setRuntimeStatus,j as updateInstanceToken,$ as verifyEntitlement,Q as verifySignature,A as writeState};

package/package.json

@@ -1,12 +1,23 @@
 {
   "name": "@jchat/runtime",
-  "version": "0.0.2",
+  "version": "1.0.0-alpha.10",
   "private": false,
   "description": "Runtime support package for JChat deployments.",
-  "license": "SEE LICENSE",
+  "keywords": [
+    "chat",
+    "jchat",
+    "runtime"
+  ],
+  "license": "SEE LICENSE IN LICENSE",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/mjjabarullah/jchat.git",
+    "directory": "packages/runtime"
+  },
   "files": [
     "dist",
-    "README.md"
+    "README.md",
+    "CHANGELOG.md"
   ],
   "type": "module",
   "main": "./dist/index.mjs",
@@ -22,16 +33,23 @@
   },
   "scripts": {
     "build": "tsdown",
-    "lint": "oxlint . --config=../../oxlint.json",
+    "lint": "oxlint .",
     "format": "oxfmt . --write",
     "typecheck": "tsc --noEmit",
     "test": "bun --config ./bunfig.toml test",
     "prepack": "bun run build"
   },
+  "dependencies": {
+    "string-ts": "^2.3.1"
+  },
   "devDependencies": {
-    "@types/node": "^26.1.1",
-    "bun-types": "^1.3.14",
+    "@jchat/shared": "workspace:*",
+    "@types/bun": "catalog:",
     "tsdown": "^0.22.14",
-    "typescript": "^7.0.2"
+    "typescript": "catalog:",
+    "zod": "catalog:"
+  },
+  "peerDependencies": {
+    "zod": "catalog:"
   }
 }