@jchat/runtime 1.0.0-alpha.2 → 1.0.0-alpha.21

package/src/index.ts

@@ -1,206 +0,0 @@
-import crypto from "node:crypto"
-import { isPublicDomain, normalizeDomain, type Plan, type RoutingMode } from "./domain"
-
-export * from "./audit"
-export * from "./check"
-export * from "./domain"
-export * from "./state"
-export * from "./runtime"
-export * from "./install"
-export * from "./paths"
-export * from "./env"
-
-export type PurchaseProvider = "envato" | "jchat"
-export type RuntimeEnvironment = "production" | "development"
-
-export type ConfigPayload = {
-  iss: string
-  aud: string
-  licenseId: string
-  domain: string
-  buyer: string
-  installationId: string
-  machineFingerprint: string
-  plan: Plan
-  entitlements: string[]
-  purchaseProvider: PurchaseProvider
-  environment: RuntimeEnvironment
-  routingMode: RoutingMode
-  iat: number
-}
-
-export type RuntimeOptions = {
-  publicKeyPem: string
-  issuer?: string
-  audience?: string
-}
-
-export type RuntimeStatus = "valid" | "unreachable-fallback" | "invalid" | "unavailable"
-
-type JwtHeader = {
-  alg: "RS256"
-  typ: "JWT"
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value)
-}
-
-function isNonEmptyString(value: unknown): value is string {
-  return typeof value === "string" && value.trim().length > 0
-}
-
-function decodeJsonSegment(value: string): unknown {
-  if (!value) return null
-  try {
-    return JSON.parse(Buffer.from(value, "base64url").toString("utf8")) as unknown
-  } catch {
-    return null
-  }
-}
-
-function parseHeader(token: string): JwtHeader | null {
-  const parts = token.split(".")
-  if (parts.length !== 3) return null
-  const header = decodeJsonSegment(parts[0])
-  if (!isRecord(header) || header.alg !== "RS256" || header.typ !== "JWT") return null
-  return { alg: "RS256", typ: "JWT" }
-}
-
-function validatePayload(value: unknown): ConfigPayload | null {
-  if (!isRecord(value)) return null
-
-  const {
-    iss,
-    aud,
-    licenseId,
-    domain,
-    buyer,
-    installationId,
-    machineFingerprint,
-    plan,
-    entitlements,
-    purchaseProvider,
-    environment,
-    routingMode,
-    iat
-  } = value
-
-  if (
-    !isNonEmptyString(iss) ||
-    !isNonEmptyString(aud) ||
-    !isNonEmptyString(licenseId) ||
-    !isNonEmptyString(domain) ||
-    !isNonEmptyString(buyer) ||
-    !isNonEmptyString(installationId) ||
-    !isNonEmptyString(machineFingerprint) ||
-    (plan !== "standard" && plan !== "extended") ||
-    !Array.isArray(entitlements) ||
-    !entitlements.every(isNonEmptyString) ||
-    (purchaseProvider !== "envato" && purchaseProvider !== "jchat") ||
-    (environment !== "production" && environment !== "development") ||
-    (routingMode !== "path" && routingMode !== "subdomain") ||
-    typeof iat !== "number" ||
-    !Number.isSafeInteger(iat) ||
-    iat < 0
-  ) {
-    return null
-  }
-
-  let normalizedDomain
-  try {
-    normalizedDomain = normalizeDomain(domain)
-  } catch {
-    return null
-  }
-
-  if (
-    (environment === "development" && !normalizedDomain.isLocalhost) ||
-    (environment === "production" && !isPublicDomain(domain))
-  ) {
-    return null
-  }
-
-  const hasMultiSiteEntitlement = entitlements.includes("site.create.multi")
-  if (
-    (plan === "extended" && !hasMultiSiteEntitlement) ||
-    (plan === "standard" && hasMultiSiteEntitlement)
-  ) {
-    return null
-  }
-
-  return {
-    iss,
-    aud,
-    licenseId,
-    domain,
-    buyer,
-    installationId,
-    machineFingerprint,
-    plan,
-    entitlements,
-    purchaseProvider,
-    environment,
-    routingMode,
-    iat
-  }
-}
-
-export function parsePayload(token: string): ConfigPayload | null {
-  const parts = token.split(".")
-  if (parts.length !== 3 || !parts.every(Boolean) || !parseHeader(token)) return null
-  return validatePayload(decodeJsonSegment(parts[1]))
-}
-
-export function verifySignature(
-  token: string,
-  currentDomain: string,
-  options: RuntimeOptions
-): boolean {
-  if (!token || token === "YOUR_LICENSE_KEY_PLACEHOLDER") return false
-
-  try {
-    const parts = token.split(".")
-    if (parts.length !== 3 || !parseHeader(token)) return false
-
-    const payload = parsePayload(token)
-    if (!payload) return false
-    if (payload.iss !== (options.issuer ?? "https://license.jchat.local")) return false
-    if (payload.aud !== (options.audience ?? "jchat-chat")) return false
-    if (normalizeDomain(payload.domain).host !== normalizeDomain(currentDomain).host) {
-      return false
-    }
-
-    const dataToVerify = Buffer.from(`${parts[0]}.${parts[1]}`)
-    const signature = Buffer.from(parts[2].replace(/-/g, "+").replace(/_/g, "/"), "base64")
-    return crypto.verify("sha256", dataToVerify, options.publicKeyPem, signature)
-  } catch {
-    return false
-  }
-}
-
-export function verifyEntitlement(
-  token: string,
-  currentDomain: string,
-  installationId: string,
-  machineFingerprint: string,
-  options: RuntimeOptions
-): boolean {
-  if (!verifySignature(token, currentDomain, options)) return false
-
-  const payload = parsePayload(token)
-  if (!payload) return false
-  return (
-    payload.installationId === installationId && payload.machineFingerprint === machineFingerprint
-  )
-}
-
-export function hasEntitlement(
-  token: string,
-  currentDomain: string,
-  entitlement: string,
-  options: RuntimeOptions
-): boolean {
-  if (!verifySignature(token, currentDomain, options)) return false
-  return parsePayload(token)?.entitlements?.includes(entitlement) ?? false
-}

package/src/install.ts

@@ -1,62 +0,0 @@
-import type { DomainScope, RoutingMode } from "./domain"
-import type { PurchaseProvider } from "./index"
-import { activateRegistry } from "./check"
-import { createIdentity, type LocalState } from "./state"
-
-export type FetchLike = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>
-
-export type LicenseVerificationResult =
-  | {
-      valid: true
-      buyer: string
-      token: string
-      domain: string
-      state: Omit<LocalState, "instanceToken" | "version">
-    }
-  | { valid: false; error: string }
-
-export async function installAndActivate(
-  purchaseCode: string,
-  domain: string,
-  siteSlug: string | undefined,
-  domainScope: DomainScope | undefined,
-  routingMode: RoutingMode,
-  provider: PurchaseProvider = "envato",
-  fetchImpl: FetchLike = fetch
-): Promise<LicenseVerificationResult> {
-  const installationIdentity = createIdentity()
-  try {
-    const licenseData = await activateRegistry({
-      purchaseCode,
-      domain,
-      siteSlug,
-      domainScope,
-      routingMode,
-      provider,
-      installationId: installationIdentity.installationId,
-      installationPublicKey: installationIdentity.publicKeyPem,
-      machineFingerprint: installationIdentity.machineFingerprint,
-      fetchImpl
-    })
-
-    if (!licenseData.success) {
-      return {
-        valid: false,
-        error: licenseData.message
-      }
-    }
-
-    return {
-      valid: true,
-      buyer: licenseData.buyer,
-      token: licenseData.token,
-      domain: licenseData.domain,
-      state: installationIdentity
-    }
-  } catch {
-    return {
-      valid: false,
-      error: "Failed to verify license. Check your internet connection."
-    }
-  }
-}

package/src/paths.test.ts

@@ -1,49 +0,0 @@
-import { describe, expect, it } from "bun:test"
-import path from "node:path"
-import { resolveRuntimePaths } from "./paths"
-
-describe("resolveRuntimePaths", () => {
-  it("prefers explicit env paths", () => {
-    const paths = resolveRuntimePaths({
-      cwd: "D:/runtime",
-      env: {
-        JCHAT_UPLOADS_DIR: "/data/uploads",
-        JCHAT_ADDONS_DIR: "/data/addons",
-        JCHAT_MIGRATIONS_DIR: "/data/migrations"
-      }
-    })
-
-    expect(paths.uploadsDir).toBe(path.resolve("/data/uploads"))
-    expect(paths.addonBundlesDir).toBe(path.resolve("/data/addons"))
-    expect(paths.addonSourceDir).toBe(path.join(path.resolve("D:/runtime"), "addons-dev"))
-    expect(paths.migrationsDir).toBe(path.resolve("/data/migrations"))
-  })
-
-  it("uses repo-root fallbacks when running inside the source tree", () => {
-    const repoRoot = path.resolve(import.meta.dir, "..", "..", "..")
-    const paths = resolveRuntimePaths({
-      cwd: path.join(repoRoot, "apps", "web"),
-      env: {}
-    })
-
-    expect(paths.repoRoot).toBe(repoRoot)
-    expect(paths.uploadsDir).toBe(path.join(repoRoot, "uploads"))
-    expect(paths.addonBundlesDir).toBe(path.join(repoRoot, "addons"))
-    expect(paths.addonSourceDir).toBe(path.join(repoRoot, "addons-dev"))
-    expect(paths.migrationsDir).toBe(path.join(repoRoot, "packages", "db", "migrations"))
-  })
-
-  it("falls back to runtime-relative directories outside the repo", () => {
-    const runtimeRoot = path.resolve("D:/isolated-runtime")
-    const paths = resolveRuntimePaths({
-      cwd: runtimeRoot,
-      env: {}
-    })
-
-    expect(paths.repoRoot).toBeNull()
-    expect(paths.uploadsDir).toBe(path.join(runtimeRoot, "uploads"))
-    expect(paths.addonBundlesDir).toBe(path.join(runtimeRoot, "addons"))
-    expect(paths.addonSourceDir).toBe(path.join(runtimeRoot, "addons-dev"))
-    expect(paths.migrationsDir).toBe(path.join(runtimeRoot, "migrations"))
-  })
-})

package/src/paths.ts

@@ -1,74 +0,0 @@
-import fs from "node:fs"
-import path from "node:path"
-
-interface RuntimePathOptions {
-  cwd?: string
-  env?: Record<string, string | undefined>
-}
-
-export function resolveRuntimePaths(options: RuntimePathOptions = {}) {
-  const runtimeRoot = path.resolve(options.cwd ?? process.cwd())
-  const env = options.env ?? process.env
-  const repoRoot = findRepoRoot(runtimeRoot)
-
-  return {
-    repoRoot,
-    runtimeRoot,
-    uploadsDir: resolveConfiguredPath(
-      env.JCHAT_UPLOADS_DIR,
-      runtimeRoot,
-      repoRoot,
-      "uploads",
-      "uploads"
-    ),
-    addonBundlesDir: resolveConfiguredPath(
-      env.JCHAT_ADDONS_DIR,
-      runtimeRoot,
-      repoRoot,
-      "addons",
-      "addons"
-    ),
-    addonSourceDir: repoRoot
-      ? path.join(repoRoot, "addons-dev")
-      : path.join(runtimeRoot, "addons-dev"),
-    migrationsDir: resolveConfiguredPath(
-      env.JCHAT_MIGRATIONS_DIR,
-      runtimeRoot,
-      repoRoot,
-      path.join("packages", "db", "migrations"),
-      "migrations"
-    )
-  }
-}
-
-function hasRepoMarkers(dir: string) {
-  return (
-    fs.existsSync(path.join(dir, "package.json")) &&
-    fs.existsSync(path.join(dir, "apps")) &&
-    fs.existsSync(path.join(dir, "packages"))
-  )
-}
-
-function findRepoRoot(startDir: string) {
-  let current = path.resolve(startDir)
-
-  while (true) {
-    if (hasRepoMarkers(current)) return current
-
-    const parent = path.dirname(current)
-    if (parent === current) return null
-    current = parent
-  }
-}
-
-function resolveConfiguredPath(
-  configuredPath: string | undefined,
-  runtimeRoot: string,
-  repoRoot: string | null,
-  repoRelativePath: string,
-  runtimeRelativePath: string
-) {
-  if (configuredPath) return path.resolve(configuredPath)
-  if (repoRoot) return path.join(repoRoot, repoRelativePath)
-  return path.join(runtimeRoot, runtimeRelativePath)
-}

package/src/runtime.test.ts

@@ -1,21 +0,0 @@
-import { describe, expect, test } from "bun:test"
-import {
-  getRuntimeStatus,
-  isApplicationDisabled,
-  registerInvalidationHandler,
-  setRuntimeStatus
-} from "./runtime"
-
-describe("license runtime status", () => {
-  test("disables the application and invokes the invalidation handler", () => {
-    let shutdowns = 0
-    registerInvalidationHandler(() => {
-      shutdowns += 1
-    })
-    setRuntimeStatus("invalid", "support-1")
-    expect(isApplicationDisabled()).toBe(true)
-    expect(getRuntimeStatus()).toEqual({ status: "invalid", reference: "support-1" })
-    expect(shutdowns).toBe(1)
-    setRuntimeStatus("valid", "support-2")
-  })
-})

package/src/runtime.ts

@@ -1,31 +0,0 @@
-import crypto from "node:crypto"
-
-export type RuntimeStatus = "valid" | "unreachable-fallback" | "invalid" | "unavailable"
-
-let runtimeStatus: RuntimeStatus = "unavailable"
-let supportReference = "startup"
-let shutdownHandler: (() => void) | undefined
-
-export function registerInvalidationHandler(handler: () => void): void {
-  shutdownHandler = handler
-}
-
-export function setRuntimeStatus(
-  status: RuntimeStatus,
-  reference: string = crypto.randomUUID()
-): void {
-  runtimeStatus = status
-  supportReference = reference
-  if (status === "invalid") shutdownHandler?.()
-}
-
-export function getRuntimeStatus(): {
-  status: RuntimeStatus
-  reference: string
-} {
-  return { status: runtimeStatus, reference: supportReference }
-}
-
-export function isApplicationDisabled(): boolean {
-  return runtimeStatus === "invalid"
-}

package/src/state.test.ts

@@ -1,54 +0,0 @@
-import { afterEach, describe, expect, test } from "bun:test"
-import fs from "node:fs/promises"
-import os from "node:os"
-import path from "node:path"
-import { acquireProcessLock, createIdentity, readState, readTokenSync, writeState } from "./state"
-
-const temporaryDirectories: string[] = []
-
-async function createTemporaryDirectory(prefix: string): Promise<string> {
-  const directory = await fs.mkdtemp(path.join(os.tmpdir(), prefix))
-  temporaryDirectories.push(directory)
-  return directory
-}
-
-describe("license state", () => {
-  afterEach(async () => {
-    await Promise.all(
-      temporaryDirectories
-        .splice(0)
-        .map((directory) => fs.rm(directory, { recursive: true, force: true }))
-    )
-  })
-
-  test("persists and reads a complete state atomically", async () => {
-    const directory = await createTemporaryDirectory("jchat-runtime-")
-    const filePath = path.join(directory, "license.json")
-    const identity = createIdentity("machine-a")
-    const state = { version: 1 as const, ...identity, instanceToken: "signed-license" }
-    await writeState(state, filePath)
-    expect(await readState(filePath)).toEqual(state)
-    expect(readTokenSync(filePath)).toBe("signed-license")
-  })
-
-  test("rejects incomplete local state", async () => {
-    const directory = await createTemporaryDirectory("jchat-runtime-invalid-")
-    const filePath = path.join(directory, "license.json")
-    await Bun.write(
-      filePath,
-      JSON.stringify({ version: 1, installationId: "installation-1", instanceToken: "token" })
-    )
-
-    expect(await readState(filePath)).toBeNull()
-  })
-
-  test("prevents two processes from acquiring the same local lock", async () => {
-    const directory = await createTemporaryDirectory("jchat-runtime-lock-")
-    const filePath = path.join(directory, "license.json")
-    const release = await acquireProcessLock(filePath)
-    await expect(acquireProcessLock(filePath)).rejects.toBeTruthy()
-    await release()
-    const secondRelease = await acquireProcessLock(filePath)
-    await secondRelease()
-  })
-})

package/src/state.ts

@@ -1,129 +0,0 @@
-import crypto from "node:crypto"
-import fsSync from "node:fs"
-import fs from "node:fs/promises"
-import os from "node:os"
-import path from "node:path"
-
-export type LocalState = {
-  version: 1
-  installationId: string
-  privateKeyPem: string
-  publicKeyPem: string
-  machineFingerprint: string
-  instanceToken: string
-  lastSuccessfulCheckAt?: string
-}
-
-export const DEFAULT_STATE_PATH = path.resolve(process.cwd(), "data/instance.json")
-
-export function createMachineFingerprint(): string {
-  return crypto
-    .createHash("sha256")
-    .update([os.hostname(), os.platform(), os.arch()].join("|"))
-    .digest("hex")
-}
-
-export function createIdentity(machineFingerprint = createMachineFingerprint()) {
-  const keyPair = crypto.generateKeyPairSync("ed25519")
-  return {
-    installationId: crypto.randomUUID(),
-    machineFingerprint,
-    privateKeyPem: keyPair.privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
-    publicKeyPem: keyPair.publicKey.export({ type: "spki", format: "pem" }).toString()
-  }
-}
-
-export function readTokenSync(filePath = DEFAULT_STATE_PATH): string {
-  try {
-    if (!fsSync.existsSync(filePath)) return ""
-    const content = fsSync.readFileSync(filePath, "utf8")
-    const parsed = JSON.parse(content) as LocalState
-    return parsed?.instanceToken ?? ""
-  } catch {
-    return ""
-  }
-}
-
-export async function readState(filePath = DEFAULT_STATE_PATH): Promise<LocalState | null> {
-  try {
-    const parsed: unknown = JSON.parse(await Bun.file(filePath).text())
-    if (!parsed || typeof parsed !== "object") return null
-    const state = parsed as Partial<LocalState>
-    if (
-      state.version !== 1 ||
-      typeof state.installationId !== "string" ||
-      !state.installationId ||
-      typeof state.privateKeyPem !== "string" ||
-      !state.privateKeyPem ||
-      typeof state.publicKeyPem !== "string" ||
-      !state.publicKeyPem ||
-      typeof state.machineFingerprint !== "string" ||
-      !state.machineFingerprint ||
-      typeof state.instanceToken !== "string" ||
-      !state.instanceToken ||
-      (state.lastSuccessfulCheckAt !== undefined &&
-        (typeof state.lastSuccessfulCheckAt !== "string" || !state.lastSuccessfulCheckAt))
-    ) {
-      return null
-    }
-    return state as LocalState
-  } catch {
-    return null
-  }
-}
-
-export async function writeState(state: LocalState, filePath = DEFAULT_STATE_PATH): Promise<void> {
-  const directory = path.dirname(filePath)
-  await fs.mkdir(directory, { recursive: true })
-  const temporaryPath = `${filePath}.${process.pid}.${crypto.randomUUID()}.tmp`
-  await Bun.write(temporaryPath, `${JSON.stringify(state, null, 2)}\n`)
-  await fs.rename(temporaryPath, filePath)
-}
-
-export async function updateInstanceToken(
-  instanceToken: string,
-  statePath = DEFAULT_STATE_PATH
-): Promise<void> {
-  const localState = await readState(statePath)
-  if (!localState) throw new Error("Local license state is missing")
-  await writeState(
-    { ...localState, instanceToken, lastSuccessfulCheckAt: new Date().toISOString() },
-    statePath
-  )
-}
-
-export async function acquireProcessLock(
-  statePath = DEFAULT_STATE_PATH
-): Promise<() => Promise<void>> {
-  const lockPath = `${statePath}.lock`
-  await fs.mkdir(path.dirname(lockPath), { recursive: true })
-  let handle
-  try {
-    handle = await fs.open(lockPath, "wx")
-  } catch (error) {
-    if (!(error instanceof Error) || !("code" in error) || error.code !== "EEXIST") throw error
-    const ownerPid = Number.parseInt(
-      await Bun.file(lockPath)
-        .text()
-        .catch(() => ""),
-      10
-    )
-    let ownerAlive = false
-    if (Number.isInteger(ownerPid) && ownerPid > 0) {
-      try {
-        process.kill(ownerPid, 0)
-        ownerAlive = true
-      } catch {
-        ownerAlive = false
-      }
-    }
-    if (ownerAlive) throw new Error("Another JChat process already owns the license lock")
-    await fs.rm(lockPath, { force: true })
-    handle = await fs.open(lockPath, "wx")
-  }
-  await handle.writeFile(`${process.pid}\n`)
-  return async () => {
-    await handle.close()
-    await fs.rm(lockPath, { force: true })
-  }
-}