@kindgi/cli 0.1.6-rc.0 → 0.1.7-rc.0

package/dist/license/aws.js

@@ -0,0 +1,291 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * A secret in AWS Secrets Manager, for `kindgi license renew` and `enroll`:
+ * `aws:<region>:<secret name>`, or `aws:<the secret's ARN>`. Reads
+ * `AWSCURRENT` (`GetSecretValue`), writes a new version
+ * (`PutSecretValue`), signed with Signature Version 4.
+ *
+ * Credentials, the first that answers: the environment
+ * (`AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`; what
+ * CI sets), a web identity (`AWS_ROLE_ARN` + `AWS_WEB_IDENTITY_TOKEN_FILE`:
+ * EKS IRSA, CI's OIDC), the container endpoint (ECS, EKS Pod Identity),
+ * the instance's role (IMDSv2 only), and on a laptop the AWS CLI's
+ * (`aws configure export-credentials`: profiles, SSO).
+ */
+import { createHash, createHmac, randomUUID } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { headerValueProblem } from '@kindgi/types';
+import { CloudSecretError } from './cloud.js';
+const REGION = /^[a-z]{2,4}(?:-[a-z]+)+-\d{1,2}$/;
+const ARN = /^arn:aws(?:-[a-z]+)*:secretsmanager:([a-z]{2,4}(?:-[a-z]+)+-\d{1,2}):\d{12}:secret:[A-Za-z0-9/_+=.@-]{1,512}$/;
+const SECRET_NAME = /^[A-Za-z0-9/_+=.@-]{1,512}$/;
+const METADATA_TIMEOUT_MS = 1500;
+/** The DNS suffix of a region's partition: China's differs. */
+const suffixOf = (region) => region.startsWith('cn-') ? 'amazonaws.com.cn' : 'amazonaws.com';
+export function awsSecretStore(ref, deps) {
+    const arn = ARN.exec(ref);
+    let region;
+    let secretId;
+    if (arn !== null) {
+        region = arn[1] ?? '';
+        secretId = ref;
+    }
+    else {
+        const colon = ref.indexOf(':');
+        region = ref.slice(0, colon);
+        secretId = ref.slice(colon + 1);
+        if (colon === -1 || !REGION.test(region) || !SECRET_NAME.test(secretId))
+            return undefined;
+    }
+    const describe = `the Secrets Manager secret ${secretId} (${region})`;
+    // Found once per store: a renewal reads, then maybe writes.
+    let credentials;
+    const send = async (target, body) => {
+        credentials ??= awsCredentials(deps, region);
+        const host = `secretsmanager.${region}.${suffixOf(region)}`;
+        const payload = JSON.stringify(body);
+        const headers = signV4({
+            method: 'POST',
+            host,
+            path: '/',
+            headers: {
+                'content-type': 'application/x-amz-json-1.1',
+                'x-amz-target': `secretsmanager.${target}`,
+            },
+            body: payload,
+            region,
+            service: 'secretsmanager',
+            credentials: await credentials,
+            now: new Date(),
+        });
+        return deps.fetch(`https://${host}/`, {
+            method: 'POST',
+            headers,
+            body: payload,
+            signal: AbortSignal.timeout(30_000),
+        });
+    };
+    return {
+        async read() {
+            const res = await send('GetSecretValue', { SecretId: secretId });
+            if (!res.ok) {
+                const error = await awsError(res);
+                if (error.type === 'ResourceNotFoundException')
+                    return undefined;
+                throw refused(describe, res.status, error, 'secretsmanager:GetSecretValue');
+            }
+            const value = (await res.json()).SecretString?.trim() ?? '';
+            return value === '' ? undefined : value;
+        },
+        async write(value) {
+            // A raw request names the new version itself: the SDKs and the AWS CLI
+            // add a UUID, and without one Secrets Manager answers 400
+            // (InvalidRequestException). It becomes the version's id.
+            const res = await send('PutSecretValue', {
+                SecretId: secretId,
+                SecretString: value,
+                ClientRequestToken: randomUUID(),
+            });
+            if (!res.ok) {
+                throw refused(describe, res.status, await awsError(res), 'secretsmanager:PutSecretValue');
+            }
+        },
+        describe,
+    };
+}
+async function awsError(res) {
+    const body = (await res.json().catch(() => ({})));
+    const type = body.__type?.split('#').pop();
+    const message = body.message ?? body.Message;
+    return { ...(type !== undefined && { type }), ...(message !== undefined && { message }) };
+}
+function refused(what, status, error, action) {
+    // AWS's own words with the type: what to fix (never a value: Secrets
+    // Manager's messages don't echo the secret).
+    const why = error.type !== undefined && error.message !== undefined
+        ? `${error.type}: ${error.message}`
+        : (error.type ?? error.message);
+    const denied = error.type === 'AccessDeniedException' || status === 403;
+    return new CloudSecretError(`${what} answered ${status}${why !== undefined ? ` (${why})` : ''}.${denied ? ` The identity running this needs ${action} on that secret.` : ''}`);
+}
+// ---- Signature Version 4 ------------------------------------------------------------
+/** The headers a SigV4-signed request carries: the given ones, `host`, `x-amz-date`, the token, `authorization`. */
+export function signV4(input) {
+    const amzDate = input.now
+        .toISOString()
+        .replace(/[-:]/g, '')
+        .replace(/\.\d{3}/, '');
+    const date = amzDate.slice(0, 8);
+    const headers = {
+        ...Object.fromEntries(Object.entries(input.headers).map(([k, v]) => [k.toLowerCase(), v.trim()])),
+        host: input.host,
+        'x-amz-date': amzDate,
+        ...(input.credentials.sessionToken !== undefined && {
+            'x-amz-security-token': input.credentials.sessionToken,
+        }),
+    };
+    const names = Object.keys(headers).sort();
+    const signedHeaders = names.join(';');
+    const query = Object.entries(input.query ?? {})
+        .map(([k, v]) => [encode(k), encode(v)])
+        .sort(([a, x], [b, y]) => (a === b ? (x < y ? -1 : 1) : a < b ? -1 : 1))
+        .map(([k, v]) => `${k}=${v}`)
+        .join('&');
+    const canonical = [
+        input.method,
+        input.path,
+        query,
+        ...names.map((n) => `${n}:${headers[n]}`),
+        '',
+        signedHeaders,
+        sha256Hex(input.body),
+    ].join('\n');
+    const scope = `${date}/${input.region}/${input.service}/aws4_request`;
+    const toSign = ['AWS4-HMAC-SHA256', amzDate, scope, sha256Hex(canonical)].join('\n');
+    const key = [date, input.region, input.service, 'aws4_request'].reduce((k, part) => hmac(k, part), Buffer.from(`AWS4${input.credentials.secretAccessKey}`, 'utf8'));
+    const signature = createHmac('sha256', key).update(toSign, 'utf8').digest('hex');
+    return {
+        ...headers,
+        authorization: `AWS4-HMAC-SHA256 Credential=${input.credentials.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`,
+    };
+}
+const hmac = (key, data) => createHmac('sha256', key).update(data, 'utf8').digest();
+const sha256Hex = (data) => createHash('sha256').update(data, 'utf8').digest('hex');
+/** RFC 3986 encoding, as SigV4 wants it. */
+const encode = (s) => encodeURIComponent(s).replace(/[!'()*]/g, (c) => `%${c.charCodeAt(0).toString(16).toUpperCase()}`);
+// ---- credentials ----------------------------------------------------------------------
+/** The first credentials that answer (see the module's comment), or a message saying none did. */
+export async function awsCredentials(deps, region) {
+    const sources = [fromEnv, fromWebIdentity, fromContainer, fromInstance, fromAwsCli];
+    for (const source of sources) {
+        const found = await source(deps, region);
+        if (found !== undefined)
+            return found;
+    }
+    throw new CloudSecretError("No AWS credentials here: none in the environment, no web identity, no container or instance role, and `aws configure export-credentials` gave nothing. Run it where the deployment's role is, or sign in with the AWS CLI.");
+}
+async function fromEnv(deps) {
+    return asCredentials(deps.env.AWS_ACCESS_KEY_ID, deps.env.AWS_SECRET_ACCESS_KEY, deps.env.AWS_SESSION_TOKEN, 'the environment (AWS_ACCESS_KEY_ID, AWS_SESSION_TOKEN)');
+}
+/** STS AssumeRoleWithWebIdentity (unsigned), regionally. */
+async function fromWebIdentity(deps, region) {
+    const roleArn = deps.env.AWS_ROLE_ARN;
+    const tokenFile = deps.env.AWS_WEB_IDENTITY_TOKEN_FILE;
+    if (!roleArn || !tokenFile)
+        return undefined;
+    const token = (await readFile(tokenFile, 'utf8')).trim();
+    const params = new URLSearchParams({
+        Action: 'AssumeRoleWithWebIdentity',
+        Version: '2011-06-15',
+        RoleArn: roleArn,
+        RoleSessionName: 'kindgi-license',
+        WebIdentityToken: token,
+    });
+    const res = await deps.fetch(`https://sts.${region}.${suffixOf(region)}/`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
+        body: params.toString(),
+        signal: AbortSignal.timeout(30_000),
+    });
+    if (!res.ok) {
+        throw new CloudSecretError(`STS refused the web identity for ${roleArn} (${res.status}).`);
+    }
+    const body = (await res.json());
+    const c = body.AssumeRoleWithWebIdentityResponse?.AssumeRoleWithWebIdentityResult?.Credentials;
+    return asCredentials(c?.AccessKeyId, c?.SecretAccessKey, c?.SessionToken);
+}
+/** ECS's relative URI, or EKS Pod Identity's full URI and its token. */
+async function fromContainer(deps) {
+    const relative = deps.env.AWS_CONTAINER_CREDENTIALS_RELATIVE_URI;
+    const full = deps.env.AWS_CONTAINER_CREDENTIALS_FULL_URI;
+    const url = relative ? `http://169.254.170.2${relative}` : full;
+    if (!url)
+        return undefined;
+    const tokenFile = deps.env.AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE;
+    const token = tokenFile
+        ? (await readFile(tokenFile, 'utf8')).trim()
+        : deps.env.AWS_CONTAINER_AUTHORIZATION_TOKEN?.trim();
+    const tokenProblem = token ? headerValueProblem(token) : undefined;
+    if (tokenProblem !== undefined) {
+        throw new CloudSecretError(`The container's authorization token (${tokenFile ? 'AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE' : 'AWS_CONTAINER_AUTHORIZATION_TOKEN'}) can't be sent in a header: it has ${tokenProblem}.`);
+    }
+    const res = await deps.fetch(url, {
+        headers: token ? { authorization: token } : {},
+        signal: AbortSignal.timeout(5000),
+    });
+    if (!res.ok)
+        throw new CloudSecretError(`The container credentials endpoint answered ${res.status}.`);
+    const c = (await res.json());
+    return asCredentials(c.AccessKeyId, c.SecretAccessKey, c.Token);
+}
+/** The instance's role, IMDSv2 only: no session token, no credentials. */
+async function fromInstance(deps) {
+    const imds = 'http://169.254.169.254/latest';
+    let c;
+    try {
+        const t = await deps.fetch(`${imds}/api/token`, {
+            method: 'PUT',
+            headers: { 'x-aws-ec2-metadata-token-ttl-seconds': '300' },
+            signal: AbortSignal.timeout(METADATA_TIMEOUT_MS),
+        });
+        if (!t.ok)
+            return undefined;
+        const headers = { 'x-aws-ec2-metadata-token': (await t.text()).trim() };
+        const roles = await deps.fetch(`${imds}/meta-data/iam/security-credentials/`, {
+            headers,
+            signal: AbortSignal.timeout(METADATA_TIMEOUT_MS),
+        });
+        const role = roles.ok ? (await roles.text()).split('\n')[0]?.trim() : undefined;
+        if (!role)
+            return undefined;
+        const res = await deps.fetch(`${imds}/meta-data/iam/security-credentials/${role}`, {
+            headers,
+            signal: AbortSignal.timeout(METADATA_TIMEOUT_MS),
+        });
+        if (!res.ok)
+            return undefined;
+        c = (await res.json());
+    }
+    catch {
+        return undefined;
+    }
+    // Outside the `try`: a credential that can't be sent is said, not "none here".
+    return asCredentials(c?.AccessKeyId, c?.SecretAccessKey, c?.Token, 'the instance role (IMDS)');
+}
+async function fromAwsCli(deps) {
+    let c;
+    try {
+        const out = await deps.run('aws', ['configure', 'export-credentials', '--format', 'process']);
+        c = JSON.parse(out);
+    }
+    catch {
+        return undefined;
+    }
+    // Outside the `try`: a credential that can't be sent is said, not "none here".
+    return asCredentials(c?.AccessKeyId, c?.SecretAccessKey, c?.SessionToken, 'the AWS CLI (aws configure export-credentials)');
+}
+/**
+ * Credentials as found, trimmed: a trailing newline would sign one request
+ * and send another (a 403 that blames the role). The key id and the session
+ * token go into headers, so one fetch can't send is refused by where it
+ * came from (`from`), never quoted.
+ */
+function asCredentials(rawAccessKeyId, rawSecretAccessKey, rawSessionToken, from = "AWS's answer") {
+    const accessKeyId = rawAccessKeyId?.trim();
+    const secretAccessKey = rawSecretAccessKey?.trim();
+    const sessionToken = rawSessionToken?.trim();
+    if (!accessKeyId || !secretAccessKey)
+        return undefined;
+    for (const [what, value] of [
+        ['access key id', accessKeyId],
+        ['session token', sessionToken],
+    ]) {
+        const problem = value ? headerValueProblem(value) : undefined;
+        if (problem !== undefined) {
+            throw new CloudSecretError(`The AWS ${what} from ${from} can't be sent in a header: it has ${problem}.`);
+        }
+    }
+    return { accessKeyId, secretAccessKey, ...(sessionToken ? { sessionToken } : {}) };
+}
+//# sourceMappingURL=aws.js.map

package/dist/license/aws.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws.js","sourceRoot":"","sources":["../../src/license/aws.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEnD,OAAO,EAAkB,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAS9D,MAAM,MAAM,GAAG,kCAAkC,CAAC;AAClD,MAAM,GAAG,GACP,+GAA+G,CAAC;AAClH,MAAM,WAAW,GAAG,6BAA6B,CAAC;AAClD,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC,+DAA+D;AAC/D,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE,CAClC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,eAAe,CAAC;AAElE,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,IAAe;IACzD,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,MAAc,CAAC;IACnB,IAAI,QAAgB,CAAC;IACrB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtB,QAAQ,GAAG,GAAG,CAAC;IACjB,CAAC;SAAM,CAAC;QACN,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7B,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAC;IAC5F,CAAC;IACD,MAAM,QAAQ,GAAG,8BAA8B,QAAQ,KAAK,MAAM,GAAG,CAAC;IACtE,4DAA4D;IAC5D,IAAI,WAAgD,CAAC;IACrD,MAAM,IAAI,GAAG,KAAK,EAAE,MAAc,EAAE,IAA6B,EAAE,EAAE;QACnE,WAAW,KAAK,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,kBAAkB,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,CAAC;YACrB,MAAM,EAAE,MAAM;YACd,IAAI;YACJ,IAAI,EAAE,GAAG;YACT,OAAO,EAAE;gBACP,cAAc,EAAE,4BAA4B;gBAC5C,cAAc,EAAE,kBAAkB,MAAM,EAAE;aAC3C;YACD,IAAI,EAAE,OAAO;YACb,MAAM;YACN,OAAO,EAAE,gBAAgB;YACzB,WAAW,EAAE,MAAM,WAAW;YAC9B,GAAG,EAAE,IAAI,IAAI,EAAE;SAChB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,GAAG,EAAE;YACpC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,IAAI;YACR,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;YACjE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;gBAClC,IAAI,KAAK,CAAC,IAAI,KAAK,2BAA2B;oBAAE,OAAO,SAAS,CAAC;gBACjE,MAAM,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,+BAA+B,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,KAAK,GAAI,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA+B,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAC3F,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,KAAK;YACf,uEAAuE;YACvE,0DAA0D;YAC1D,0DAA0D;YAC1D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE;gBACvC,QAAQ,EAAE,QAAQ;gBAClB,YAAY,EAAE,KAAK;gBACnB,kBAAkB,EAAE,UAAU,EAAE;aACjC,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,EAAE,+BAA+B,CAAC,CAAC;YAC5F,CAAC;QACH,CAAC;QACD,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,GAAa;IAEb,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAI/C,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC;IAC7C,OAAO,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AAC5F,CAAC;AAED,SAAS,OAAO,CACd,IAAY,EACZ,MAAc,EACd,KAA4D,EAC5D,MAAc;IAEd,qEAAqE;IACrE,6CAA6C;IAC7C,MAAM,GAAG,GACP,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QACrD,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,OAAO,EAAE;QACnC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,KAAK,uBAAuB,IAAI,MAAM,KAAK,GAAG,CAAC;IACxE,OAAO,IAAI,gBAAgB,CACzB,GAAG,IAAI,aAAa,MAAM,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,oCAAoC,MAAM,kBAAkB,CAAC,CAAC,CAAC,EAAE,EAAE,CAClJ,CAAC;AACJ,CAAC;AAED,wFAAwF;AAExF,oHAAoH;AACpH,MAAM,UAAU,MAAM,CAAC,KAWtB;IACC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG;SACtB,WAAW,EAAE;SACb,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;SACpB,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjC,MAAM,OAAO,GAA2B;QACtC,GAAG,MAAM,CAAC,WAAW,CACnB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAC3E;QACD,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,YAAY,EAAE,OAAO;QACrB,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,YAAY,KAAK,SAAS,IAAI;YAClD,sBAAsB,EAAE,KAAK,CAAC,WAAW,CAAC,YAAY;SACvD,CAAC;KACH,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;SAC5C,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAU,CAAC;SAChD,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACvE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;SAC5B,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,MAAM,SAAS,GAAG;QAChB,KAAK,CAAC,MAAM;QACZ,KAAK,CAAC,IAAI;QACV,KAAK;QACL,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,EAAE;QACF,aAAa;QACb,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;KACtB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,MAAM,KAAK,GAAG,GAAG,IAAI,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,eAAe,CAAC;IACtE,MAAM,MAAM,GAAG,CAAC,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrF,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,MAAM,CACpE,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,EAC1B,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,MAAM,CAAC,CAChE,CAAC;IACF,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjF,OAAO;QACL,GAAG,OAAO;QACV,aAAa,EAAE,+BAA+B,KAAK,CAAC,WAAW,CAAC,WAAW,IAAI,KAAK,mBAAmB,aAAa,eAAe,SAAS,EAAE;KAC/I,CAAC;AACJ,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,IAAY,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;AACpG,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5F,4CAA4C;AAC5C,MAAM,MAAM,GAAG,CAAC,CAAS,EAAE,EAAE,CAC3B,kBAAkB,CAAC,CAAC,CAAC,CAAC,OAAO,CAC3B,UAAU,EACV,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CACxD,CAAC;AAEJ,0FAA0F;AAE1F,kGAAkG;AAClG,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAe,EAAE,MAAc;IAClE,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,CAAU,CAAC;IAC7F,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;IACxC,CAAC;IACD,MAAM,IAAI,gBAAgB,CACxB,4NAA4N,CAC7N,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAAe;IACpC,OAAO,aAAa,CAClB,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAC1B,IAAI,CAAC,GAAG,CAAC,qBAAqB,EAC9B,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAC1B,wDAAwD,CACzD,CAAC;AACJ,CAAC;AAED,4DAA4D;AAC5D,KAAK,UAAU,eAAe,CAC5B,IAAe,EACf,MAAc;IAEd,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,2BAA2B,CAAC;IACvD,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IAC7C,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,MAAM,EAAE,2BAA2B;QACnC,OAAO,EAAE,YAAY;QACrB,OAAO,EAAE,OAAO;QAChB,eAAe,EAAE,gBAAgB;QACjC,gBAAgB,EAAE,KAAK;KACxB,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE;QACzE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC5F,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE;QACvB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,gBAAgB,CAAC,oCAAoC,OAAO,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAM7B,CAAC;IACF,MAAM,CAAC,GAAG,IAAI,CAAC,iCAAiC,EAAE,+BAA+B,EAAE,WAAW,CAAC;IAC/F,OAAO,aAAa,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC;AAC5E,CAAC;AAED,wEAAwE;AACxE,KAAK,UAAU,aAAa,CAAC,IAAe;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,sCAAsC,CAAC;IACjE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,kCAAkC,CAAC;IACzD,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,uBAAuB,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,sCAAsC,CAAC;IAClE,MAAM,KAAK,GAAG,SAAS;QACrB,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE;QAC5C,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iCAAiC,EAAE,IAAI,EAAE,CAAC;IACvD,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,gBAAgB,CACxB,wCAAwC,SAAS,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC,mCAAmC,uCAAuC,YAAY,GAAG,CACzL,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;QAChC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE;QAC9C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;KAClC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QACT,MAAM,IAAI,gBAAgB,CAAC,+CAA+C,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IAC3F,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI1B,CAAC;IACF,OAAO,aAAa,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,0EAA0E;AAC1E,KAAK,UAAU,YAAY,CAAC,IAAe;IACzC,MAAM,IAAI,GAAG,+BAA+B,CAAC;IAC7C,IAAI,CAAiF,CAAC;IACtF,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,YAAY,EAAE;YAC9C,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,sCAAsC,EAAE,KAAK,EAAE;YAC1D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC;SACjD,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAC5B,MAAM,OAAO,GAAG,EAAE,0BAA0B,EAAE,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACxE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,sCAAsC,EAAE;YAC5E,OAAO;YACP,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC;SACjD,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAChF,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,uCAAuC,IAAI,EAAE,EAAE;YACjF,OAAO;YACP,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC;SACjD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAC9B,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAa,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,+EAA+E;IAC/E,OAAO,aAAa,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,KAAK,EAAE,0BAA0B,CAAC,CAAC;AACjG,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,IAAe;IACvC,IAAI,CAAmF,CAAC;IACxF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,oBAAoB,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;QAC9F,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAa,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,+EAA+E;IAC/E,OAAO,aAAa,CAClB,CAAC,EAAE,WAAW,EACd,CAAC,EAAE,eAAe,EAClB,CAAC,EAAE,YAAY,EACf,gDAAgD,CACjD,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CACpB,cAAkC,EAClC,kBAAsC,EACtC,eAAmC,EACnC,IAAI,GAAG,cAAc;IAErB,MAAM,WAAW,GAAG,cAAc,EAAE,IAAI,EAAE,CAAC;IAC3C,MAAM,eAAe,GAAG,kBAAkB,EAAE,IAAI,EAAE,CAAC;IACnD,MAAM,YAAY,GAAG,eAAe,EAAE,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,WAAW,IAAI,CAAC,eAAe;QAAE,OAAO,SAAS,CAAC;IACvD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,eAAe,EAAE,WAAW,CAAC;QAC9B,CAAC,eAAe,EAAE,YAAY,CAAC;KACvB,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,gBAAgB,CACxB,WAAW,IAAI,SAAS,IAAI,sCAAsC,OAAO,GAAG,CAC7E,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACrF,CAAC"}

package/dist/license/cloud.d.ts

@@ -0,0 +1,13 @@
+import type { SecretStore } from './stores.js';
+/** How a cloud store reaches its API and its identity: injected in tests. */
+export interface CloudDeps {
+    readonly fetch: typeof fetch;
+    readonly env: Readonly<Record<string, string | undefined>>;
+    /** Runs a command (`gcloud`, `az`) and returns its stdout; throws when it fails. */
+    readonly run: (command: string, args: readonly string[]) => Promise<string>;
+}
+export declare class CloudSecretError extends Error {
+}
+export declare function gcpSecretStore(ref: string, deps: CloudDeps): SecretStore | undefined;
+export declare function azureSecretStore(ref: string, deps: CloudDeps): SecretStore | undefined;
+//# sourceMappingURL=cloud.d.ts.map

package/dist/license/cloud.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud.d.ts","sourceRoot":"","sources":["../../src/license/cloud.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,6EAA6E;AAC7E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC3D,oFAAoF;IACpF,QAAQ,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7E;AAUD,qBAAa,gBAAiB,SAAQ,KAAK;CAAG;AAI9C,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,CA0CpF;AA2BD,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,CAkCtF"}

package/dist/license/cloud.js

@@ -0,0 +1,193 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * A secret in a cloud secret manager, read and written with the platform's
+ * own identity, for `kindgi license renew` and `enroll`:
+ *
+ * - `gcp:projects/<project>/secrets/<name>`: Google Secret Manager. Reads
+ *   `versions/latest`, writes a new version (`:addVersion`), so the
+ *   runtime's `latest` reference picks it up at its next start. The token
+ *   comes from the metadata server (Cloud Run, GCE) or, elsewhere, `gcloud
+ *   auth print-access-token` (CI, a person).
+ * - `azure:https://<vault>.vault.azure.net/secrets/<name>`: Azure Key
+ *   Vault. Reads the current version, writes a new one. The token comes
+ *   from the managed identity (Container Apps and App Service's
+ *   `IDENTITY_ENDPOINT`, else IMDS), with `KINDGI_AZURE_CLIENT_ID` for a
+ *   user-assigned one, or, elsewhere, `az account get-access-token`.
+ *
+ * A value is never in a message; a failure names the secret and the
+ * answer's status, and what to check.
+ */
+import { bearerValueProblem } from '@kindgi/types';
+const GCP_REF = /^projects\/([a-z][a-z0-9-]{4,28}[a-z0-9])\/secrets\/([A-Za-z0-9_-]{1,255})$/;
+/** A Key Vault secret's URL, in the public, China or US Government cloud. */
+const AZURE_REF = /^https:\/\/([a-z0-9-]{3,24})\.(vault\.azure\.net|vault\.azure\.cn|vault\.usgovcloudapi\.net)\/secrets\/([A-Za-z0-9-]{1,127})$/;
+/** How long a metadata endpoint may take before it's taken as not there (not on that platform). */
+const METADATA_TIMEOUT_MS = 1500;
+const CALL_TIMEOUT_MS = 30_000;
+export class CloudSecretError extends Error {
+}
+// ---- Google Secret Manager -----------------------------------------------------
+export function gcpSecretStore(ref, deps) {
+    const m = GCP_REF.exec(ref);
+    if (m === null)
+        return undefined;
+    const project = m[1] ?? '';
+    const name = m[2] ?? '';
+    const base = `https://secretmanager.googleapis.com/v1/projects/${project}/secrets/${name}`;
+    const describe = `the Secret Manager secret ${name} (project ${project})`;
+    const token = () => gcpToken(deps);
+    return {
+        async read() {
+            const res = await call(deps, `${base}/versions/latest:access`, { method: 'GET' }, await token());
+            if (res.status === 404)
+                return undefined;
+            if (!res.ok)
+                throw await refused(res, describe, gcpHint(name, 'roles/secretmanager.secretAccessor'));
+            const body = (await res.json());
+            const value = Buffer.from(body.payload?.data ?? '', 'base64')
+                .toString('utf8')
+                .trim();
+            return value === '' ? undefined : value;
+        },
+        async write(value) {
+            const res = await call(deps, `${base}:addVersion`, {
+                method: 'POST',
+                body: JSON.stringify({
+                    payload: { data: Buffer.from(value, 'utf8').toString('base64') },
+                }),
+            }, await token());
+            if (!res.ok)
+                throw await refused(res, describe, gcpHint(name, 'roles/secretmanager.secretVersionAdder'));
+        },
+        describe,
+    };
+}
+function gcpHint(name, role) {
+    return `The identity running this needs ${role} on the secret ${name}.`;
+}
+/** The metadata server's token (Cloud Run, GCE), else gcloud's. */
+async function gcpToken(deps) {
+    const fromMetadata = await metadata(deps, 'http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token', { 'Metadata-Flavor': 'Google' });
+    if (fromMetadata !== undefined)
+        return fromMetadata;
+    try {
+        const token = (await deps.run('gcloud', ['auth', 'print-access-token'])).trim();
+        if (token !== '')
+            return token;
+    }
+    catch {
+        // Said below.
+    }
+    throw new CloudSecretError("No Google identity here: not on Cloud Run or GCE (no metadata server), and `gcloud auth print-access-token` gave nothing. Run it where the deployment's identity is, or sign in with gcloud.");
+}
+// ---- Azure Key Vault --------------------------------------------------------------
+export function azureSecretStore(ref, deps) {
+    const m = AZURE_REF.exec(ref);
+    if (m === null)
+        return undefined;
+    const vault = m[1] ?? '';
+    const suffix = m[2] ?? 'vault.azure.net';
+    const name = m[3] ?? '';
+    const url = `${ref}?api-version=7.4`;
+    const describe = `the Key Vault secret ${name} (vault ${vault})`;
+    const token = () => azureToken(deps, suffix);
+    return {
+        async read() {
+            const res = await call(deps, url, { method: 'GET' }, await token());
+            if (res.status === 404)
+                return undefined;
+            if (!res.ok)
+                throw await refused(res, describe, azureHint(vault, 'Key Vault Secrets User'));
+            const value = (await res.json()).value?.trim() ?? '';
+            return value === '' ? undefined : value;
+        },
+        async write(value) {
+            const res = await call(deps, url, { method: 'PUT', body: JSON.stringify({ value }) }, await token());
+            if (!res.ok) {
+                throw await refused(res, describe, azureHint(vault, 'a role with Microsoft.KeyVault/vaults/secrets/setSecret/action'));
+            }
+        },
+        describe,
+    };
+}
+function azureHint(vault, role) {
+    return `The identity running this needs ${role} on that secret (or the vault ${vault}), and the vault's network rules must let it in.`;
+}
+/**
+ * A token for Key Vault (`https://<suffix>`, `vault.azure.net` in the public
+ * cloud) from the managed identity, else the Azure CLI's sign-in. Never
+ * `AZURE_CLIENT_SECRET` or other bare `AZURE_*` settings.
+ */
+async function azureToken(deps, suffix) {
+    const resource = `https://${suffix}`;
+    const clientId = deps.env.KINDGI_AZURE_CLIENT_ID?.trim();
+    const endpoint = deps.env.IDENTITY_ENDPOINT;
+    const header = deps.env.IDENTITY_HEADER;
+    const query = (extra) => `resource=${encodeURIComponent(resource)}${extra}${clientId ? `&client_id=${encodeURIComponent(clientId)}` : ''}`;
+    if (endpoint !== undefined && endpoint !== '' && header !== undefined && header !== '') {
+        // Container Apps, App Service, Functions.
+        const token = await metadata(deps, `${endpoint}?${query('&api-version=2019-08-01')}`, { 'X-IDENTITY-HEADER': header }, CALL_TIMEOUT_MS);
+        if (token !== undefined)
+            return token;
+        throw new CloudSecretError(`The managed identity endpoint gave no token for ${resource}. Is a managed identity assigned to this app${clientId ? ` with client id ${clientId}` : ''}?`);
+    }
+    const imds = await metadata(deps, `http://169.254.169.254/metadata/identity/oauth2/token?${query('&api-version=2018-02-01')}`, { Metadata: 'true' });
+    if (imds !== undefined)
+        return imds;
+    try {
+        const token = (await deps.run('az', [
+            'account',
+            'get-access-token',
+            '--resource',
+            resource,
+            '--query',
+            'accessToken',
+            '-o',
+            'tsv',
+        ])).trim();
+        if (token !== '')
+            return token;
+    }
+    catch {
+        // Said below.
+    }
+    throw new CloudSecretError("No Azure identity here: no managed identity (IDENTITY_ENDPOINT, IMDS), and `az account get-access-token` gave nothing. Run it where the deployment's identity is, or sign in with az login.");
+}
+// ---- shared -----------------------------------------------------------------------
+/** A token from a metadata endpoint, or `undefined` when there's none (not on that platform). */
+async function metadata(deps, url, headers, timeoutMs = METADATA_TIMEOUT_MS) {
+    try {
+        const res = await deps.fetch(url, { headers, signal: AbortSignal.timeout(timeoutMs) });
+        if (!res.ok)
+            return undefined;
+        const token = (await res.json()).access_token;
+        return typeof token === 'string' && token !== '' ? token : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function call(deps, url, init, token) {
+    // From the gcloud or az output, or a metadata server: never quoted into
+    // fetch's error, which would print it.
+    const problem = bearerValueProblem(token);
+    if (problem !== undefined) {
+        throw new CloudSecretError(`The cloud access token can't be sent in a header: it has ${problem}. Check what gcloud, az or the metadata server gave.`);
+    }
+    return deps.fetch(url, {
+        method: init.method,
+        headers: {
+            authorization: `Bearer ${token}`,
+            ...(init.body !== undefined && { 'content-type': 'application/json' }),
+        },
+        ...(init.body !== undefined && { body: init.body }),
+        signal: AbortSignal.timeout(CALL_TIMEOUT_MS),
+    });
+}
+async function refused(res, what, hint) {
+    const body = (await res.json().catch(() => ({})));
+    const why = body.error?.message ?? body.error?.status ?? body.error?.code;
+    return new CloudSecretError(`${what} answered ${res.status}${why !== undefined ? ` (${why})` : ''}. ${res.status === 401 || res.status === 403 ? hint : ''}`.trim());
+}
+//# sourceMappingURL=cloud.js.map

package/dist/license/cloud.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud.js","sourceRoot":"","sources":["../../src/license/cloud.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAYnD,MAAM,OAAO,GAAG,6EAA6E,CAAC;AAC9F,6EAA6E;AAC7E,MAAM,SAAS,GACb,+HAA+H,CAAC;AAClI,mGAAmG;AACnG,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACjC,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,MAAM,OAAO,gBAAiB,SAAQ,KAAK;CAAG;AAE9C,mFAAmF;AAEnF,MAAM,UAAU,cAAc,CAAC,GAAW,EAAE,IAAe;IACzD,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACjC,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxB,MAAM,IAAI,GAAG,oDAAoD,OAAO,YAAY,IAAI,EAAE,CAAC;IAC3F,MAAM,QAAQ,GAAG,6BAA6B,IAAI,aAAa,OAAO,GAAG,CAAC;IAC1E,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO;QACL,KAAK,CAAC,IAAI;YACR,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,IAAI,EACJ,GAAG,IAAI,yBAAyB,EAChC,EAAE,MAAM,EAAE,KAAK,EAAE,EACjB,MAAM,KAAK,EAAE,CACd,CAAC;YACF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,SAAS,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,EAAE;gBACT,MAAM,MAAM,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,oCAAoC,CAAC,CAAC,CAAC;YAC1F,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoC,CAAC;YACnE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,IAAI,EAAE,EAAE,QAAQ,CAAC;iBAC1D,QAAQ,CAAC,MAAM,CAAC;iBAChB,IAAI,EAAE,CAAC;YACV,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,KAAK;YACf,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,IAAI,EACJ,GAAG,IAAI,aAAa,EACpB;gBACE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;iBACjE,CAAC;aACH,EACD,MAAM,KAAK,EAAE,CACd,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE;gBACT,MAAM,MAAM,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,wCAAwC,CAAC,CAAC,CAAC;QAChG,CAAC;QACD,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,IAAY;IACzC,OAAO,mCAAmC,IAAI,kBAAkB,IAAI,GAAG,CAAC;AAC1E,CAAC;AAED,mEAAmE;AACnE,KAAK,UAAU,QAAQ,CAAC,IAAe;IACrC,MAAM,YAAY,GAAG,MAAM,QAAQ,CACjC,IAAI,EACJ,4FAA4F,EAC5F,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAChC,CAAC;IACF,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IACpD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChF,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;IACD,MAAM,IAAI,gBAAgB,CACxB,8LAA8L,CAC/L,CAAC;AACJ,CAAC;AAED,sFAAsF;AAEtF,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,IAAe;IAC3D,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACjC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC;IACzC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACxB,MAAM,GAAG,GAAG,GAAG,GAAG,kBAAkB,CAAC;IACrC,MAAM,QAAQ,GAAG,wBAAwB,IAAI,WAAW,KAAK,GAAG,CAAC;IACjE,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO;QACL,KAAK,CAAC,IAAI;YACR,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,MAAM,KAAK,EAAE,CAAC,CAAC;YACpE,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,SAAS,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,MAAM,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,SAAS,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC,CAAC;YAC5F,MAAM,KAAK,GAAI,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAC7E,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,KAAK;YACf,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,IAAI,EACJ,GAAG,EACH,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAClD,MAAM,KAAK,EAAE,CACd,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,MAAM,OAAO,CACjB,GAAG,EACH,QAAQ,EACR,SAAS,CAAC,KAAK,EAAE,gEAAgE,CAAC,CACnF,CAAC;YACJ,CAAC;QACH,CAAC;QACD,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,IAAY;IAC5C,OAAO,mCAAmC,IAAI,iCAAiC,KAAK,kDAAkD,CAAC;AACzI,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,UAAU,CAAC,IAAe,EAAE,MAAc;IACvD,MAAM,QAAQ,GAAG,WAAW,MAAM,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC;IACxC,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE,CAC9B,YAAY,kBAAkB,CAAC,QAAQ,CAAC,GAAG,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,cAAc,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IACpH,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;QACvF,0CAA0C;QAC1C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAC1B,IAAI,EACJ,GAAG,QAAQ,IAAI,KAAK,CAAC,yBAAyB,CAAC,EAAE,EACjD,EAAE,mBAAmB,EAAE,MAAM,EAAE,EAC/B,eAAe,CAChB,CAAC;QACF,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACtC,MAAM,IAAI,gBAAgB,CACxB,mDAAmD,QAAQ,+CAA+C,QAAQ,CAAC,CAAC,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAC3J,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CACzB,IAAI,EACJ,yDAAyD,KAAK,CAAC,yBAAyB,CAAC,EAAE,EAC3F,EAAE,QAAQ,EAAE,MAAM,EAAE,CACrB,CAAC;IACF,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,CACZ,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE;YACnB,SAAS;YACT,kBAAkB;YAClB,YAAY;YACZ,QAAQ;YACR,SAAS;YACT,aAAa;YACb,IAAI;YACJ,KAAK;SACN,CAAC,CACH,CAAC,IAAI,EAAE,CAAC;QACT,IAAI,KAAK,KAAK,EAAE;YAAE,OAAO,KAAK,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;IACD,MAAM,IAAI,gBAAgB,CACxB,6LAA6L,CAC9L,CAAC;AACJ,CAAC;AAED,sFAAsF;AAEtF,iGAAiG;AACjG,KAAK,UAAU,QAAQ,CACrB,IAAe,EACf,GAAW,EACX,OAA+B,EAC/B,SAAS,GAAG,mBAAmB;IAE/B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACvF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QAC9B,MAAM,KAAK,GAAI,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA+B,CAAC,YAAY,CAAC;QAC7E,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,IAAe,EACf,GAAW,EACX,IAAyD,EACzD,KAAa;IAEb,wEAAwE;IACxE,uCAAuC;IACvC,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,gBAAgB,CACxB,4DAA4D,OAAO,sDAAsD,CAC1H,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;QACrB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;SACvE;QACD,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC;KAC7C,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,GAAa,EAAE,IAAY,EAAE,IAAY;IAC9D,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAE/C,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,IAAI,CAAC,KAAK,EAAE,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC;IAC1E,OAAO,IAAI,gBAAgB,CACzB,GAAG,IAAI,aAAa,GAAG,CAAC,MAAM,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,CACxI,CAAC;AACJ,CAAC"}

package/dist/license/expiry.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Where a license key stands, as the runtime judges it at startup, and
+ * what to do about it: `kindgi doctor` and `kindgi license renew` say the
+ * same thing the runtime's banner does.
+ *
+ * - more than 30 days left: valid;
+ * - 30 days or fewer: expiring (the runtime warns);
+ * - expired less than 14 days ago: the runtime still starts, with a warning;
+ * - after that: the runtime doesn't start with it.
+ */
+import type { LicenseClaims } from './license-key.js';
+export declare const LICENSE_WARN_DAYS = 30;
+export declare const LICENSE_GRACE_DAYS = 14;
+export type LicenseStanding = {
+    readonly kind: 'valid' | 'expiring';
+    readonly daysLeft: number;
+} | {
+    readonly kind: 'grace';
+    readonly lastStart: Date;
+} | {
+    readonly kind: 'expired';
+};
+export declare function standingOf(claims: LicenseClaims, now: number): LicenseStanding;
+/** A key from access.kindgi.com (`gh-<id>`, `dom-<domain>`), not one Kindgi issued by hand. */
+export declare function isSelfServe(subject: string): boolean;
+/**
+ * How to get the next key, in the runtime's startup banner's words, so
+ * `kindgi doctor`, the banner and the console say the same: for a
+ * self-serve key, renew it from the deployment (`renewCommand`) or sign in
+ * at access.kindgi.com; for a key Kindgi issued, write to Kindgi.
+ */
+export declare function renewAdvice(claims: LicenseClaims, renewCommand: string): string;
+//# sourceMappingURL=expiry.d.ts.map

package/dist/license/expiry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"expiry.d.ts","sourceRoot":"","sources":["../../src/license/expiry.ts"],"names":[],"mappings":"AAGA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,eAAO,MAAM,iBAAiB,KAAK,CAAC;AACpC,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAGrC,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,UAAU,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAClE;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC;AAEjC,wBAAgB,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,eAAe,CAa9E;AAED,+FAA+F;AAC/F,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAI/E"}

package/dist/license/expiry.js

@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+export const LICENSE_WARN_DAYS = 30;
+export const LICENSE_GRACE_DAYS = 14;
+const DAY_MS = 86_400_000;
+export function standingOf(claims, now) {
+    const left = claims.expiresAt.getTime() - now;
+    if (left > 0) {
+        const daysLeft = Math.floor(left / DAY_MS);
+        return { kind: daysLeft <= LICENSE_WARN_DAYS ? 'expiring' : 'valid', daysLeft };
+    }
+    if (-left < LICENSE_GRACE_DAYS * DAY_MS) {
+        return {
+            kind: 'grace',
+            lastStart: new Date(claims.expiresAt.getTime() + LICENSE_GRACE_DAYS * DAY_MS),
+        };
+    }
+    return { kind: 'expired' };
+}
+/** A key from access.kindgi.com (`gh-<id>`, `dom-<domain>`), not one Kindgi issued by hand. */
+export function isSelfServe(subject) {
+    return /^gh-\d+$/.test(subject) || /^dom-[a-z0-9.-]+$/.test(subject);
+}
+/**
+ * How to get the next key, in the runtime's startup banner's words, so
+ * `kindgi doctor`, the banner and the console say the same: for a
+ * self-serve key, renew it from the deployment (`renewCommand`) or sign in
+ * at access.kindgi.com; for a key Kindgi issued, write to Kindgi.
+ */
+export function renewAdvice(claims, renewCommand) {
+    return isSelfServe(claims.subject)
+        ? `Renew it: from this deployment (${renewCommand}), or sign in at https://access.kindgi.com`
+        : 'Renew it: contact@kindgi.com';
+}
+//# sourceMappingURL=expiry.js.map

package/dist/license/expiry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"expiry.js","sourceRoot":"","sources":["../../src/license/expiry.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAejC,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AACpC,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AACrC,MAAM,MAAM,GAAG,UAAU,CAAC;AAO1B,MAAM,UAAU,UAAU,CAAC,MAAqB,EAAE,GAAW;IAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC;IAC9C,IAAI,IAAI,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC;QAC3C,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,CAAC,IAAI,GAAG,kBAAkB,GAAG,MAAM,EAAE,CAAC;QACxC,OAAO;YACL,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,kBAAkB,GAAG,MAAM,CAAC;SAC9E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC7B,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,OAAO,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,MAAqB,EAAE,YAAoB;IACrE,OAAO,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC;QAChC,CAAC,CAAC,mCAAmC,YAAY,4CAA4C;QAC7F,CAAC,CAAC,8BAA8B,CAAC;AACrC,CAAC"}

package/dist/license/license-key.d.ts

@@ -0,0 +1,32 @@
+export declare const LICENSE_KEY_PREFIX = "kgi_lk_";
+/**
+ * The license signing keys a released runtime trusts, by `kid`: their
+ * Ed25519 public keys (base64). A new `kid` is added here, in a CLI
+ * release, before Kindgi signs with it: otherwise renewal refuses a
+ * correctly renewed key.
+ */
+export declare const KINDGI_LICENSE_PUBLIC_KEYS: Readonly<Record<string, string>>;
+export type LicenseUse = 'production' | 'non-production';
+/** What a key says. */
+export interface LicenseClaims {
+    readonly keyId: string;
+    readonly subject: string;
+    readonly name: string;
+    readonly use: LicenseUse;
+    readonly issuedAt: Date;
+    readonly expiresAt: Date;
+}
+export type LicenseKeyCheck = {
+    readonly kind: 'ok';
+    readonly claims: LicenseClaims;
+} | {
+    readonly kind: 'err';
+    /** `malformed`: not a key; `unknown-key`: signed with a `kid` this CLI doesn't know; `bad-signature`. */
+    readonly reason: 'malformed' | 'unknown-key' | 'bad-signature';
+};
+/**
+ * Whether `key` is a license key Kindgi signed, and what it says. The
+ * dates aren't judged here: renewal compares them with the current key's.
+ */
+export declare function checkLicenseKey(key: string, publicKeys?: Readonly<Record<string, string>>): LicenseKeyCheck;
+//# sourceMappingURL=license-key.d.ts.map