@kindgi/cli 0.1.6 → 0.1.7

package/dist/license/license-key.d.ts

@@ -0,0 +1,32 @@
+export declare const LICENSE_KEY_PREFIX = "kgi_lk_";
+/**
+ * The license signing keys a released runtime trusts, by `kid`: their
+ * Ed25519 public keys (base64). A new `kid` is added here, in a CLI
+ * release, before Kindgi signs with it: otherwise renewal refuses a
+ * correctly renewed key.
+ */
+export declare const KINDGI_LICENSE_PUBLIC_KEYS: Readonly<Record<string, string>>;
+export type LicenseUse = 'production' | 'non-production';
+/** What a key says. */
+export interface LicenseClaims {
+    readonly keyId: string;
+    readonly subject: string;
+    readonly name: string;
+    readonly use: LicenseUse;
+    readonly issuedAt: Date;
+    readonly expiresAt: Date;
+}
+export type LicenseKeyCheck = {
+    readonly kind: 'ok';
+    readonly claims: LicenseClaims;
+} | {
+    readonly kind: 'err';
+    /** `malformed`: not a key; `unknown-key`: signed with a `kid` this CLI doesn't know; `bad-signature`. */
+    readonly reason: 'malformed' | 'unknown-key' | 'bad-signature';
+};
+/**
+ * Whether `key` is a license key Kindgi signed, and what it says. The
+ * dates aren't judged here: renewal compares them with the current key's.
+ */
+export declare function checkLicenseKey(key: string, publicKeys?: Readonly<Record<string, string>>): LicenseKeyCheck;
+//# sourceMappingURL=license-key.d.ts.map

package/dist/license/license-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"license-key.d.ts","sourceRoot":"","sources":["../../src/license/license-key.ts"],"names":[],"mappings":"AAgBA,eAAO,MAAM,kBAAkB,YAAY,CAAC;AAE5C;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAEtE,CAAC;AAEH,MAAM,MAAM,UAAU,GAAG,YAAY,GAAG,gBAAgB,CAAC;AAEzD,uBAAuB;AACvB,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED,MAAM,MAAM,eAAe,GACvB;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GACvD;IACE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,yGAAyG;IACzG,QAAQ,CAAC,MAAM,EAAE,WAAW,GAAG,aAAa,GAAG,eAAe,CAAC;CAChE,CAAC;AAKN;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,MAAM,EACX,UAAU,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAA8B,GACxE,eAAe,CAyCjB"}

package/dist/license/license-key.js

@@ -0,0 +1,91 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * A Kindgi license key, read and checked offline, as the runtime checks it
+ * at startup: `kgi_lk_<base64url payload>.<base64url signature>`, the
+ * payload JSON `{ v: 1, kid, sub, name, use, iat, exp }` (seconds), the
+ * signature Ed25519 over the ASCII bytes of `kgi_lk_<base64url payload>`
+ * by Kindgi's license signing key `kid`.
+ *
+ * `kindgi license renew` checks a renewed key with this before writing
+ * it, so a key the runtime would refuse is never written.
+ */
+import { createPublicKey, verify } from 'node:crypto';
+export const LICENSE_KEY_PREFIX = 'kgi_lk_';
+/**
+ * The license signing keys a released runtime trusts, by `kid`: their
+ * Ed25519 public keys (base64). A new `kid` is added here, in a CLI
+ * release, before Kindgi signs with it: otherwise renewal refuses a
+ * correctly renewed key.
+ */
+export const KINDGI_LICENSE_PUBLIC_KEYS = Object.freeze({
+    'lk-2026-1': 'cIC6PF4tmqQzkH/MG1GVguOCHIEPBe8zLJWh64pGgp8=',
+});
+const BASE64URL = /^[A-Za-z0-9_-]+$/;
+const USES = ['production', 'non-production'];
+/**
+ * Whether `key` is a license key Kindgi signed, and what it says. The
+ * dates aren't judged here: renewal compares them with the current key's.
+ */
+export function checkLicenseKey(key, publicKeys = KINDGI_LICENSE_PUBLIC_KEYS) {
+    const trimmed = key.trim();
+    const dot = trimmed.lastIndexOf('.');
+    if (!trimmed.startsWith(LICENSE_KEY_PREFIX) || dot <= LICENSE_KEY_PREFIX.length) {
+        return { kind: 'err', reason: 'malformed' };
+    }
+    const signed = trimmed.slice(0, dot);
+    const payloadPart = signed.slice(LICENSE_KEY_PREFIX.length);
+    const signaturePart = trimmed.slice(dot + 1);
+    if (!BASE64URL.test(payloadPart) || !BASE64URL.test(signaturePart)) {
+        return { kind: 'err', reason: 'malformed' };
+    }
+    const payload = parsePayload(payloadPart);
+    if (payload === undefined)
+        return { kind: 'err', reason: 'malformed' };
+    const publicKey = Object.hasOwn(publicKeys, payload.kid) ? publicKeys[payload.kid] : undefined;
+    const raw = publicKey === undefined ? undefined : Buffer.from(publicKey, 'base64');
+    if (raw === undefined || raw.length !== 32)
+        return { kind: 'err', reason: 'unknown-key' };
+    const signature = Buffer.from(signaturePart, 'base64url');
+    const ok = signature.length === 64 &&
+        verify(null, Buffer.from(signed, 'ascii'), createPublicKey({
+            key: { kty: 'OKP', crv: 'Ed25519', x: raw.toString('base64url') },
+            format: 'jwk',
+        }), signature);
+    if (!ok)
+        return { kind: 'err', reason: 'bad-signature' };
+    return {
+        kind: 'ok',
+        claims: {
+            keyId: payload.kid,
+            subject: payload.sub,
+            name: payload.name,
+            use: payload.use,
+            issuedAt: new Date(payload.iat * 1000),
+            expiresAt: new Date(payload.exp * 1000),
+        },
+    };
+}
+function parsePayload(part) {
+    let value;
+    try {
+        value = JSON.parse(Buffer.from(part, 'base64url').toString('utf8'));
+    }
+    catch {
+        return undefined;
+    }
+    if (typeof value !== 'object' || value === null)
+        return undefined;
+    const p = value;
+    const text = (v) => typeof v === 'string' && v.trim() !== '';
+    if (p.v !== 1 || !text(p.kid) || !text(p.sub) || !text(p.name))
+        return undefined;
+    if (!USES.includes(p.use))
+        return undefined;
+    if (!Number.isSafeInteger(p.iat) || !Number.isSafeInteger(p.exp))
+        return undefined;
+    if (p.exp <= p.iat)
+        return undefined;
+    return p;
+}
+//# sourceMappingURL=license-key.js.map

package/dist/license/license-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"license-key.js","sourceRoot":"","sources":["../../src/license/license-key.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;GASG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAEtD,MAAM,CAAC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAqC,MAAM,CAAC,MAAM,CAAC;IACxF,WAAW,EAAE,8CAA8C;CAC5D,CAAC,CAAC;AAsBH,MAAM,SAAS,GAAG,kBAAkB,CAAC;AACrC,MAAM,IAAI,GAAsB,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;AAEjE;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,GAAW,EACX,aAA+C,0BAA0B;IAEzE,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,IAAI,GAAG,IAAI,kBAAkB,CAAC,MAAM,EAAE,CAAC;QAChF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAC7C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QACnE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACvE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/F,MAAM,GAAG,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACnF,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC1F,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;IAC1D,MAAM,EAAE,GACN,SAAS,CAAC,MAAM,KAAK,EAAE;QACvB,MAAM,CACJ,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,eAAe,CAAC;YACd,GAAG,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE;YACjE,MAAM,EAAE,KAAK;SACd,CAAC,EACF,SAAS,CACV,CAAC;IACJ,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACzD,OAAO;QACL,IAAI,EAAE,IAAI;QACV,MAAM,EAAE;YACN,KAAK,EAAE,OAAO,CAAC,GAAG;YAClB,OAAO,EAAE,OAAO,CAAC,GAAG;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,QAAQ,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;YACtC,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;SACxC;KACF,CAAC;AACJ,CAAC;AAWD,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAClE,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,MAAM,IAAI,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IACtE,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACjF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAa,CAAC;QAAE,OAAO,SAAS,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACnF,IAAK,CAAC,CAAC,GAAc,IAAK,CAAC,CAAC,GAAc;QAAE,OAAO,SAAS,CAAC;IAC7D,OAAO,CAAuB,CAAC;AACjC,CAAC"}

package/dist/license/protocol.d.ts

@@ -0,0 +1,63 @@
+/**
+ * The renewal protocol, the deployment's side. A deployment renews its own
+ * license key with an Ed25519 key pair it made (`kindgi license enroll`):
+ * access.kindgi.com keeps only the public half, and each request is
+ * signed, so nothing replayable crosses the wire. The test vectors in
+ * `tests/license-protocol.test.ts` pin every byte.
+ *
+ * - **The renewer's private key**, as kept in the deployment's own secret
+ *   store: `kgi_lrk_<the 32-byte seed, base64url>`. Never printed.
+ * - **The renewer id:** `lr_` and the first 22 characters of the base64url
+ *   SHA-256 of the 32-byte public key.
+ * - **The enroll line** the person pastes on access.kindgi.com:
+ *   `kgi_lrp_<public key>.<account>.<signature>`, each part base64url; the
+ *   account is their GitHub login, lowercased; the signature covers
+ *   `kindgi-license-enroll-v1\n<origin>\n<renewer id>\n<account>`.
+ * - **A renewal:** `POST <origin>/v1/renew`, the JSON body
+ *   `{"renewerId","ts","nonce"}`, and the header
+ *   `kindgi-renewer-signature`: Ed25519 over
+ *   `kindgi-license-renew-v1\nPOST <origin>/v1/renew\n<base64url SHA-256 of
+ *   the body>`.
+ */
+import { type KeyObject } from 'node:crypto';
+/** Where Kindgi's dev access lives: what enroll lines and renewals are signed for by default. */
+export declare const KINDGI_ACCESS_ORIGIN = "https://access.kindgi.com";
+export declare const RENEWER_PRIVATE_PREFIX = "kgi_lrk_";
+export declare const RENEWER_PUBLIC_PREFIX = "kgi_lrp_";
+export declare const RENEW_PATH = "/v1/renew";
+export declare const RENEW_SIGNATURE_HEADER = "kindgi-renewer-signature";
+/** A renewer's key pair, held in memory only. */
+export interface RenewerKey {
+    readonly privateKey: KeyObject;
+    /** The 32-byte public key. */
+    readonly publicKey: Uint8Array;
+    readonly renewerId: string;
+}
+/** A new renewer key pair. */
+export declare function generateRenewerKey(): RenewerKey;
+/** The renewer id of a public key: `lr_` and 22 characters of its SHA-256. */
+export declare function renewerIdOf(publicKey: Uint8Array): string;
+/** The private key as the secret store keeps it: `kgi_lrk_<seed>`. */
+export declare function encodeRenewerPrivateKey(key: RenewerKey): string;
+/**
+ * The private key read back from the secret store; `undefined` when the
+ * value isn't one (an empty secret, another secret, a cut-off value).
+ */
+export declare function decodeRenewerPrivateKey(value: string): RenewerKey | undefined;
+/** What an enroll line's signature covers. */
+export declare function enrollSigningInput(origin: string, renewerId: string, account: string): string;
+/** The line to paste on access.kindgi.com: made for `account` (a GitHub login) there. */
+export declare function enrollLine(key: RenewerKey, account: string, origin?: string): string;
+/** What a renewal's signature covers: the service's origin and the body's digest. */
+export declare function renewSigningInput(origin: string, body: Uint8Array): string;
+/** A renewal request, signed: its body and the signature header's value. */
+export declare function signRenewRequest(key: RenewerKey, options?: {
+    readonly origin?: string;
+    /** Seconds since the epoch. */
+    readonly now?: number;
+    readonly nonce?: string;
+}): {
+    readonly body: string;
+    readonly signature: string;
+};
+//# sourceMappingURL=protocol.d.ts.map

package/dist/license/protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../src/license/protocol.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,KAAK,SAAS,EAOf,MAAM,aAAa,CAAC;AAErB,iGAAiG;AACjG,eAAO,MAAM,oBAAoB,8BAA8B,CAAC;AAChE,eAAO,MAAM,sBAAsB,aAAa,CAAC;AACjD,eAAO,MAAM,qBAAqB,aAAa,CAAC;AAChD,eAAO,MAAM,UAAU,cAAc,CAAC;AACtC,eAAO,MAAM,sBAAsB,6BAA6B,CAAC;AAMjE,iDAAiD;AACjD,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;IAC/B,8BAA8B;IAC9B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED,8BAA8B;AAC9B,wBAAgB,kBAAkB,IAAI,UAAU,CAG/C;AAQD,8EAA8E;AAC9E,wBAAgB,WAAW,CAAC,SAAS,EAAE,UAAU,GAAG,MAAM,CAEzD;AAED,sEAAsE;AACtE,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAG/D;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAa7E;AAED,8CAA8C;AAC9C,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAE7F;AAED,yFAAyF;AACzF,wBAAgB,UAAU,CACxB,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,MAAM,EACf,MAAM,SAAuB,GAC5B,MAAM,CAWR;AAED,qFAAqF;AACrF,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,MAAM,CAG1E;AAED,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,UAAU,EACf,OAAO,GAAE;IACP,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,+BAA+B;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACpB,GACL;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAYvD"}

package/dist/license/protocol.js

@@ -0,0 +1,102 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * The renewal protocol, the deployment's side. A deployment renews its own
+ * license key with an Ed25519 key pair it made (`kindgi license enroll`):
+ * access.kindgi.com keeps only the public half, and each request is
+ * signed, so nothing replayable crosses the wire. The test vectors in
+ * `tests/license-protocol.test.ts` pin every byte.
+ *
+ * - **The renewer's private key**, as kept in the deployment's own secret
+ *   store: `kgi_lrk_<the 32-byte seed, base64url>`. Never printed.
+ * - **The renewer id:** `lr_` and the first 22 characters of the base64url
+ *   SHA-256 of the 32-byte public key.
+ * - **The enroll line** the person pastes on access.kindgi.com:
+ *   `kgi_lrp_<public key>.<account>.<signature>`, each part base64url; the
+ *   account is their GitHub login, lowercased; the signature covers
+ *   `kindgi-license-enroll-v1\n<origin>\n<renewer id>\n<account>`.
+ * - **A renewal:** `POST <origin>/v1/renew`, the JSON body
+ *   `{"renewerId","ts","nonce"}`, and the header
+ *   `kindgi-renewer-signature`: Ed25519 over
+ *   `kindgi-license-renew-v1\nPOST <origin>/v1/renew\n<base64url SHA-256 of
+ *   the body>`.
+ */
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomBytes, sign, } from 'node:crypto';
+/** Where Kindgi's dev access lives: what enroll lines and renewals are signed for by default. */
+export const KINDGI_ACCESS_ORIGIN = 'https://access.kindgi.com';
+export const RENEWER_PRIVATE_PREFIX = 'kgi_lrk_';
+export const RENEWER_PUBLIC_PREFIX = 'kgi_lrp_';
+export const RENEW_PATH = '/v1/renew';
+export const RENEW_SIGNATURE_HEADER = 'kindgi-renewer-signature';
+/** The PKCS#8 DER prefix of an Ed25519 private key, before its 32-byte seed. */
+const ED25519_PKCS8_PREFIX = Buffer.from('302e020100300506032b657004220420', 'hex');
+const BASE64URL = /^[A-Za-z0-9_-]+$/;
+/** A new renewer key pair. */
+export function generateRenewerKey() {
+    const { privateKey } = generateKeyPairSync('ed25519');
+    return renewerKeyFrom(privateKey);
+}
+function renewerKeyFrom(privateKey) {
+    const x = createPublicKey(privateKey).export({ format: 'jwk' }).x;
+    const publicKey = new Uint8Array(Buffer.from(x, 'base64url'));
+    return { privateKey, publicKey, renewerId: renewerIdOf(publicKey) };
+}
+/** The renewer id of a public key: `lr_` and 22 characters of its SHA-256. */
+export function renewerIdOf(publicKey) {
+    return `lr_${createHash('sha256').update(publicKey).digest('base64url').slice(0, 22)}`;
+}
+/** The private key as the secret store keeps it: `kgi_lrk_<seed>`. */
+export function encodeRenewerPrivateKey(key) {
+    const der = key.privateKey.export({ format: 'der', type: 'pkcs8' });
+    return `${RENEWER_PRIVATE_PREFIX}${Buffer.from(der.subarray(ED25519_PKCS8_PREFIX.length)).toString('base64url')}`;
+}
+/**
+ * The private key read back from the secret store; `undefined` when the
+ * value isn't one (an empty secret, another secret, a cut-off value).
+ */
+export function decodeRenewerPrivateKey(value) {
+    const text = value.trim();
+    if (!text.startsWith(RENEWER_PRIVATE_PREFIX))
+        return undefined;
+    const encoded = text.slice(RENEWER_PRIVATE_PREFIX.length);
+    if (!BASE64URL.test(encoded))
+        return undefined;
+    const seed = Buffer.from(encoded, 'base64url');
+    if (seed.length !== 32)
+        return undefined;
+    const privateKey = createPrivateKey({
+        key: Buffer.concat([ED25519_PKCS8_PREFIX, seed]),
+        format: 'der',
+        type: 'pkcs8',
+    });
+    return renewerKeyFrom(privateKey);
+}
+/** What an enroll line's signature covers. */
+export function enrollSigningInput(origin, renewerId, account) {
+    return `kindgi-license-enroll-v1\n${origin}\n${renewerId}\n${account.toLowerCase()}`;
+}
+/** The line to paste on access.kindgi.com: made for `account` (a GitHub login) there. */
+export function enrollLine(key, account, origin = KINDGI_ACCESS_ORIGIN) {
+    const signature = sign(null, Buffer.from(enrollSigningInput(origin, key.renewerId, account), 'utf8'), key.privateKey);
+    return [
+        `${RENEWER_PUBLIC_PREFIX}${Buffer.from(key.publicKey).toString('base64url')}`,
+        Buffer.from(account.toLowerCase(), 'utf8').toString('base64url'),
+        signature.toString('base64url'),
+    ].join('.');
+}
+/** What a renewal's signature covers: the service's origin and the body's digest. */
+export function renewSigningInput(origin, body) {
+    const digest = createHash('sha256').update(body).digest('base64url');
+    return `kindgi-license-renew-v1\nPOST ${origin}${RENEW_PATH}\n${digest}`;
+}
+/** A renewal request, signed: its body and the signature header's value. */
+export function signRenewRequest(key, options = {}) {
+    const body = JSON.stringify({
+        renewerId: key.renewerId,
+        ts: options.now ?? Math.floor(Date.now() / 1000),
+        nonce: options.nonce ?? randomBytes(16).toString('base64url'),
+    });
+    const signature = sign(null, Buffer.from(renewSigningInput(options.origin ?? KINDGI_ACCESS_ORIGIN, Buffer.from(body))), key.privateKey).toString('base64url');
+    return { body, signature };
+}
+//# sourceMappingURL=protocol.js.map

package/dist/license/protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../../src/license/protocol.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAEL,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,WAAW,EACX,IAAI,GACL,MAAM,aAAa,CAAC;AAErB,iGAAiG;AACjG,MAAM,CAAC,MAAM,oBAAoB,GAAG,2BAA2B,CAAC;AAChE,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAC;AACjD,MAAM,CAAC,MAAM,qBAAqB,GAAG,UAAU,CAAC;AAChD,MAAM,CAAC,MAAM,UAAU,GAAG,WAAW,CAAC;AACtC,MAAM,CAAC,MAAM,sBAAsB,GAAG,0BAA0B,CAAC;AAEjE,gFAAgF;AAChF,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;AACpF,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAUrC,8BAA8B;AAC9B,MAAM,UAAU,kBAAkB;IAChC,MAAM,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACtD,OAAO,cAAc,CAAC,UAAU,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,cAAc,CAAC,UAAqB;IAC3C,MAAM,CAAC,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAW,EAAE,WAAW,CAAC,CAAC,CAAC;IACxE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,WAAW,CAAC,SAAqB;IAC/C,OAAO,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACzF,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,uBAAuB,CAAC,GAAe;IACrD,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACpE,OAAO,GAAG,sBAAsB,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AACpH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,sBAAsB,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC1D,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,UAAU,GAAG,gBAAgB,CAAC;QAClC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;QAChD,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;IACH,OAAO,cAAc,CAAC,UAAU,CAAC,CAAC;AACpC,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,SAAiB,EAAE,OAAe;IACnF,OAAO,6BAA6B,MAAM,KAAK,SAAS,KAAK,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;AACvF,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,UAAU,CACxB,GAAe,EACf,OAAe,EACf,MAAM,GAAG,oBAAoB;IAE7B,MAAM,SAAS,GAAG,IAAI,CACpB,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,EACvE,GAAG,CAAC,UAAU,CACf,CAAC;IACF,OAAO;QACL,GAAG,qBAAqB,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE;QAC7E,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QAChE,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;KAChC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,iBAAiB,CAAC,MAAc,EAAE,IAAgB;IAChE,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACrE,OAAO,iCAAiC,MAAM,GAAG,UAAU,KAAK,MAAM,EAAE,CAAC;AAC3E,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,gBAAgB,CAC9B,GAAe,EACf,UAKI,EAAE;IAEN,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,EAAE,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAChD,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;KAC9D,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAI,CACpB,IAAI,EACJ,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,IAAI,oBAAoB,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EACzF,GAAG,CAAC,UAAU,CACf,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC7B,CAAC"}

package/dist/license/renew.d.ts

@@ -0,0 +1,59 @@
+/**
+ * One renewal, the deployment's side: read the current license key and the
+ * renewer's private key from where the deployment keeps them, ask
+ * access.kindgi.com (a signed `POST /v1/renew`), check the answer offline,
+ * and write it only when it's a new key the runtime will accept.
+ *
+ * The answer is checked before anything is written: signed by a key a
+ * released runtime trusts, for the same licensee and use as the current
+ * key, and expiring no earlier. A wrong, rolled-back or someone else's key
+ * is never written. Most days the key is unchanged and nothing is written.
+ */
+import { type LicenseClaims } from './license-key.js';
+import type { SecretStore } from './stores.js';
+export interface RenewDeps {
+    readonly fetch?: typeof fetch;
+    /** Milliseconds since the epoch. */
+    readonly now?: () => number;
+    readonly publicKeys?: Readonly<Record<string, string>>;
+    readonly timeoutMs?: number;
+}
+/** What `kindgi license renew` runs with: tests hand in their own clock and fetch. */
+export interface LicenseCommandDeps {
+    readonly renew?: RenewDeps;
+}
+export interface RenewInput {
+    /** Where the license key is kept; the new one is written there. */
+    readonly key: SecretStore;
+    /** Where the renewer's private key is kept (`kindgi license enroll` wrote it). */
+    readonly renewer: SecretStore;
+    /** access.kindgi.com, or another instance's origin. */
+    readonly origin?: string;
+}
+export type RenewOutcome = {
+    readonly kind: 'renewed' | 'unchanged';
+    readonly claims: LicenseClaims;
+    readonly renewerId: string;
+}
+/** The service said no: its code and message (`renewer-stopped`, `key-revoked`, …). */
+ | {
+    readonly kind: 'refused';
+    readonly status: number;
+    readonly error: string;
+    readonly message: string;
+    readonly renewerId?: string;
+}
+/** Nothing to renew with, nothing usable came back, or the service couldn't be reached. */
+ | {
+    readonly kind: 'failed';
+    readonly message: string;
+    readonly renewerId?: string;
+};
+export declare function renewLicense(input: RenewInput, deps?: RenewDeps): Promise<RenewOutcome>;
+/**
+ * What stopped a request, as exactly as the error says it. fetch's own
+ * `fetch failed` says nothing; its cause does (`connect ECONNREFUSED …`,
+ * `getaddrinfo ENOTFOUND …`, a certificate's), or just its code.
+ */
+export declare function networkReason(err: unknown): string;
+//# sourceMappingURL=renew.d.ts.map

package/dist/license/renew.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"renew.d.ts","sourceRoot":"","sources":["../../src/license/renew.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AAEH,OAAO,EAEL,KAAK,aAAa,EAGnB,MAAM,kBAAkB,CAAC;AAS1B,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,oCAAoC;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,sFAAsF;AACtF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,mEAAmE;IACnE,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC;IAC1B,kFAAkF;IAClF,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,uDAAuD;IACvD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,MAAM,YAAY,GACpB;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,WAAW,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AACH,uFAAuF;GACrF;IACE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AACH,2FAA2F;GACzF;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvF,wBAAsB,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,GAAE,SAAc,GAAG,OAAO,CAAC,YAAY,CAAC,CAqDjG;AA+DD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAWlD"}

package/dist/license/renew.js

@@ -0,0 +1,153 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * One renewal, the deployment's side: read the current license key and the
+ * renewer's private key from where the deployment keeps them, ask
+ * access.kindgi.com (a signed `POST /v1/renew`), check the answer offline,
+ * and write it only when it's a new key the runtime will accept.
+ *
+ * The answer is checked before anything is written: signed by a key a
+ * released runtime trusts, for the same licensee and use as the current
+ * key, and expiring no earlier. A wrong, rolled-back or someone else's key
+ * is never written. Most days the key is unchanged and nothing is written.
+ */
+import { KINDGI_LICENSE_PUBLIC_KEYS, checkLicenseKey, } from './license-key.js';
+import { KINDGI_ACCESS_ORIGIN, RENEW_PATH, RENEW_SIGNATURE_HEADER, decodeRenewerPrivateKey, signRenewRequest, } from './protocol.js';
+export async function renewLicense(input, deps = {}) {
+    const origin = (input.origin ?? KINDGI_ACCESS_ORIGIN).replace(/\/+$/, '');
+    const publicKeys = deps.publicKeys ?? KINDGI_LICENSE_PUBLIC_KEYS;
+    const held = await whatIsHeld(input, publicKeys);
+    if (held.kind === 'failed')
+        return held;
+    const { renewerId } = held.renewer;
+    const request = signRenewRequest(held.renewer, {
+        origin,
+        now: Math.floor((deps.now ?? Date.now)() / 1000),
+    });
+    const asked = await ask(origin, request, deps);
+    if (asked.kind === 'unreachable') {
+        return {
+            kind: 'failed',
+            renewerId,
+            message: `${origin} couldn't be reached (${asked.reason}). The key in ${input.key.describe} is unchanged; try again later.`,
+        };
+    }
+    const { res, body } = asked;
+    if (!res.ok) {
+        // The service's own refusals name their code; any other error answer
+        // (a 5xx, a proxy's page) refuses nothing: the next run may succeed.
+        if (typeof body.error !== 'string') {
+            return {
+                kind: 'failed',
+                renewerId,
+                message: `${origin} answered ${res.status}. The key in ${input.key.describe} is unchanged; try again later.`,
+            };
+        }
+        return {
+            kind: 'refused',
+            status: res.status,
+            error: body.error,
+            message: typeof body.message === 'string' ? body.message : `${origin} answered ${res.status}.`,
+            renewerId,
+        };
+    }
+    const answer = typeof body.licenseKey === 'string' ? body.licenseKey.trim() : '';
+    const renewed = checkLicenseKey(answer, publicKeys);
+    const problem = whyNotWritten(renewed, held.current);
+    if (renewed.kind === 'err' || problem !== undefined) {
+        return {
+            kind: 'failed',
+            renewerId,
+            message: `The key ${origin} sent wasn't written: ${problem}. The key in ${input.key.describe} is unchanged.`,
+        };
+    }
+    if (answer === held.currentKey)
+        return { kind: 'unchanged', claims: renewed.claims, renewerId };
+    await input.key.write(answer);
+    return { kind: 'renewed', claims: renewed.claims, renewerId };
+}
+/** The current key (checked) and the renewer's key, or what's missing. */
+async function whatIsHeld(input, publicKeys) {
+    const currentKey = await input.key.read();
+    if (currentKey === undefined) {
+        return {
+            kind: 'failed',
+            message: `There's no license key in ${input.key.describe} to renew. The first one comes from signing in at access.kindgi.com; put it there.`,
+        };
+    }
+    const current = checkLicenseKey(currentKey, publicKeys);
+    if (current.kind === 'err') {
+        return {
+            kind: 'failed',
+            message: `The value in ${input.key.describe} isn't a license key this CLI can check (${current.reason}).`,
+        };
+    }
+    const renewerValue = await input.renewer.read();
+    const renewer = renewerValue === undefined ? undefined : decodeRenewerPrivateKey(renewerValue);
+    if (renewer === undefined) {
+        return {
+            kind: 'failed',
+            message: `There's no renewer key in ${input.renewer.describe}. Enroll this deployment first: kindgi license enroll --for <your GitHub login> --renewer <where to keep its key>.`,
+        };
+    }
+    return { kind: 'held', currentKey, current: current.claims, renewer };
+}
+/** One signed request; a network failure is said, never thrown. */
+async function ask(origin, request, deps) {
+    try {
+        const res = await (deps.fetch ?? fetch)(`${origin}${RENEW_PATH}`, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json', [RENEW_SIGNATURE_HEADER]: request.signature },
+            body: request.body,
+            signal: AbortSignal.timeout(deps.timeoutMs ?? 30_000),
+        });
+        const body = (await res.json().catch(() => ({})));
+        return { kind: 'answered', res, body };
+    }
+    catch (cause) {
+        return { kind: 'unreachable', reason: networkReason(cause) };
+    }
+}
+/**
+ * What stopped a request, as exactly as the error says it. fetch's own
+ * `fetch failed` says nothing; its cause does (`connect ECONNREFUSED …`,
+ * `getaddrinfo ENOTFOUND …`, a certificate's), or just its code.
+ */
+export function networkReason(err) {
+    const said = [];
+    let at = err;
+    for (let depth = 0; at instanceof Error && depth < 4; depth++) {
+        if (at.name === 'TimeoutError')
+            return 'no answer in time';
+        const code = at.code;
+        const text = at.message !== '' ? at.message : typeof code === 'string' ? code : '';
+        if (text !== '' && text !== 'fetch failed')
+            said.push(text);
+        at = at.cause;
+    }
+    return said.at(-1) ?? (err instanceof Error && err.message !== '' ? err.message : String(err));
+}
+/**
+ * Why an answer mustn't be written, or `undefined`: a key a released
+ * runtime accepts, for the same licensee and use, expiring no earlier.
+ */
+function whyNotWritten(renewed, current) {
+    if (renewed.kind === 'err') {
+        if (renewed.reason === 'unknown-key') {
+            return "it's signed with a key this CLI doesn't know yet (unknown-key): update the CLI, then try again";
+        }
+        if (renewed.reason === 'malformed') {
+            return 'the answer held no license key (malformed): a page from a proxy or another server, perhaps';
+        }
+        return `it isn't a key a released runtime accepts (${renewed.reason})`;
+    }
+    const next = renewed.claims;
+    if (next.subject !== current.subject)
+        return `it's for ${next.name}, not ${current.name}`;
+    if (next.use !== current.use)
+        return `it's a ${next.use} key, not a ${current.use} one`;
+    if (next.expiresAt < current.expiresAt)
+        return 'it expires before the current one';
+    return undefined;
+}
+//# sourceMappingURL=renew.js.map

package/dist/license/renew.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"renew.js","sourceRoot":"","sources":["../../src/license/renew.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;GAUG;AAEH,OAAO,EACL,0BAA0B,EAG1B,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,UAAU,EACV,sBAAsB,EAEtB,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AA0CvB,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAiB,EAAE,OAAkB,EAAE;IACxE,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,oBAAoB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1E,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,0BAA0B,CAAC;IACjE,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IACjD,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;IAEnC,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE;QAC7C,MAAM;QACN,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC;KACjD,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACjC,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,SAAS;YACT,OAAO,EAAE,GAAG,MAAM,yBAAyB,KAAK,CAAC,MAAM,iBAAiB,KAAK,CAAC,GAAG,CAAC,QAAQ,iCAAiC;SAC5H,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;IAC5B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,qEAAqE;QACrE,qEAAqE;QACrE,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YACnC,OAAO;gBACL,IAAI,EAAE,QAAQ;gBACd,SAAS;gBACT,OAAO,EAAE,GAAG,MAAM,aAAa,GAAG,CAAC,MAAM,gBAAgB,KAAK,CAAC,GAAG,CAAC,QAAQ,iCAAiC;aAC7G,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EACL,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,aAAa,GAAG,CAAC,MAAM,GAAG;YACvF,SAAS;SACV,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjF,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACpD,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,SAAS;YACT,OAAO,EAAE,WAAW,MAAM,yBAAyB,OAAO,gBAAgB,KAAK,CAAC,GAAG,CAAC,QAAQ,gBAAgB;SAC7G,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;IAChG,MAAM,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;AAChE,CAAC;AAED,0EAA0E;AAC1E,KAAK,UAAU,UAAU,CACvB,KAAiB,EACjB,UAA4C;IAU5C,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,6BAA6B,KAAK,CAAC,GAAG,CAAC,QAAQ,oFAAoF;SAC7I,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACxD,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,gBAAgB,KAAK,CAAC,GAAG,CAAC,QAAQ,4CAA4C,OAAO,CAAC,MAAM,IAAI;SAC1G,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC;IAC/F,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO;YACL,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,6BAA6B,KAAK,CAAC,OAAO,CAAC,QAAQ,oHAAoH;SACjL,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;AACxE,CAAC;AAED,mEAAmE;AACnE,KAAK,UAAU,GAAG,CAChB,MAAc,EACd,OAA8D,EAC9D,IAAe;IAKf,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,GAAG,MAAM,GAAG,UAAU,EAAE,EAAE;YAChE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,sBAAsB,CAAC,EAAE,OAAO,CAAC,SAAS,EAAE;YAC5F,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;SACtD,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;QAC7E,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;IAC/D,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,EAAE,GAAY,GAAG,CAAC;IACtB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,EAAE,YAAY,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9D,IAAI,EAAE,CAAC,IAAI,KAAK,cAAc;YAAE,OAAO,mBAAmB,CAAC;QAC3D,MAAM,IAAI,GAAI,EAAyB,CAAC,IAAI,CAAC;QAC7C,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,cAAc;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC;IAChB,CAAC;IACD,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AACjG,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,OAAwB,EAAE,OAAsB;IACrE,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YACrC,OAAO,gGAAgG,CAAC;QAC1G,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACnC,OAAO,4FAA4F,CAAC;QACtG,CAAC;QACD,OAAO,8CAA8C,OAAO,CAAC,MAAM,GAAG,CAAC;IACzE,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC;IAC5B,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO;QAAE,OAAO,YAAY,IAAI,CAAC,IAAI,SAAS,OAAO,CAAC,IAAI,EAAE,CAAC;IAC1F,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;QAAE,OAAO,UAAU,IAAI,CAAC,GAAG,eAAe,OAAO,CAAC,GAAG,MAAM,CAAC;IACxF,IAAI,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS;QAAE,OAAO,mCAAmC,CAAC;IACnF,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/license/stores.d.ts

@@ -0,0 +1,19 @@
+import { type CloudDeps } from './cloud.js';
+export interface SecretStore {
+    /** The value, trimmed; `undefined` when there's none yet (no file, no line, empty). */
+    read(): Promise<string | undefined>;
+    /** Keep `value` as the new value. */
+    write(value: string): Promise<void>;
+    /** Where, for messages: never the value. */
+    readonly describe: string;
+}
+export declare class SecretRefError extends Error {
+}
+/** Runs a cloud's CLI (`gcloud`, `az`, `aws`) for a token: its stdout. */
+export declare const runCloudCli: CloudDeps['run'];
+/** The store a reference names. Throws `SecretRefError`, saying what a reference looks like. */
+export declare function secretStoreFor(ref: string, options?: {
+    readonly cwd?: string;
+    readonly cloud?: CloudDeps;
+}): SecretStore;
+//# sourceMappingURL=stores.d.ts.map

package/dist/license/stores.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stores.d.ts","sourceRoot":"","sources":["../../src/license/stores.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAE,KAAK,SAAS,EAAoC,MAAM,YAAY,CAAC;AAE9E,MAAM,WAAW,WAAW;IAC1B,uFAAuF;IACvF,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACpC,qCAAqC;IACrC,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,4CAA4C;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,qBAAa,cAAe,SAAQ,KAAK;CAAG;AAI5C,0EAA0E;AAC1E,eAAO,MAAM,WAAW,EAAE,SAAS,CAAC,KAAK,CAKrC,CAAC;AA0BL,gGAAgG;AAChG,wBAAgB,cAAc,CAC5B,GAAG,EAAE,MAAM,EACX,OAAO,GAAE;IAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAA;CAAO,GAClE,WAAW,CAWb"}