@massu/core 1.10.3 → 1.10.5

package/dist/cli.js

@@ -1605,7 +1605,7 @@ function addFailureClass(db, opts) {
   return Number(result.lastInsertRowid);
 }
 function getFailureClasses(db) {
-  const rows = db.prepare("SELECT * FROM failure_classes ORDER BY name").all();
+  const rows = db.prepare("SELECT * FROM failure_classes ORDER BY name LIMIT 10000").all();
   return rows.map((row) => ({
     id: row.id,
     name: row.name,
@@ -14202,8 +14202,102 @@ var init_init = __esm({
   }
 });
 
+// src/security/license-pubkey.generated.ts
+var LICENSE_PUBKEY_ED25519, LICENSE_PUBKEY_FINGERPRINT_HEX, KNOWN_LICENSE_PUBKEY_FINGERPRINTS;
+var init_license_pubkey_generated = __esm({
+  "src/security/license-pubkey.generated.ts"() {
+    "use strict";
+    LICENSE_PUBKEY_ED25519 = new Uint8Array([39, 136, 108, 146, 85, 233, 119, 252, 223, 226, 123, 155, 234, 168, 200, 150, 36, 249, 174, 6, 130, 146, 125, 196, 136, 224, 202, 150, 53, 228, 114, 15]);
+    LICENSE_PUBKEY_FINGERPRINT_HEX = "18a63d64fdec9e5a368fc45feaa49bed6ced815967e582bc7b8af534f22a9475";
+    KNOWN_LICENSE_PUBKEY_FINGERPRINTS = /* @__PURE__ */ new Set([
+      "18a63d64fdec9e5a368fc45feaa49bed6ced815967e582bc7b8af534f22a9475"
+    ]);
+  }
+});
+
+// src/security/license-response-verifier.ts
+import { createPublicKey } from "crypto";
+function verifyLicenseResponse(payload) {
+  if (!KNOWN_LICENSE_PUBKEY_FINGERPRINTS.has(LICENSE_PUBKEY_FINGERPRINT_HEX)) {
+    return {
+      kind: "error",
+      reason: `Bundled license pubkey fingerprint ${LICENSE_PUBKEY_FINGERPRINT_HEX} is not in the trusted allowlist. Possible build-time tamper.`
+    };
+  }
+  const sig = payload._signature;
+  const alg = payload._signature_alg;
+  const payloadKeys = payload._signature_payload_keys;
+  const sigPubkey = payload._signature_pubkey_fingerprint;
+  if (typeof sig !== "string" || sig.length === 0) {
+    return { kind: "missing_signature" };
+  }
+  if (alg !== "ed25519") {
+    return { kind: "error", reason: `Unsupported signature algorithm: ${alg}` };
+  }
+  if (!Array.isArray(payloadKeys) || payloadKeys.length === 0) {
+    return { kind: "error", reason: "Missing _signature_payload_keys" };
+  }
+  if (typeof sigPubkey === "string" && sigPubkey !== LICENSE_PUBKEY_FINGERPRINT_HEX) {
+    return { kind: "unknown_pubkey", got: sigPubkey };
+  }
+  const canonicalObj = {};
+  for (const k3 of payloadKeys) {
+    if (typeof k3 !== "string") continue;
+    canonicalObj[k3] = payload[k3];
+  }
+  const canonical = JSON.stringify(canonicalObj, [...payloadKeys].sort());
+  try {
+    const spkiPrefix = Buffer.from([
+      48,
+      42,
+      48,
+      5,
+      6,
+      3,
+      43,
+      101,
+      112,
+      3,
+      33,
+      0
+    ]);
+    const der = Buffer.concat([spkiPrefix, Buffer.from(LICENSE_PUBKEY_ED25519)]);
+    const pubkey = createPublicKey({ key: der, format: "der", type: "spki" });
+    const { verify } = __require("crypto");
+    const ok = verify(
+      null,
+      Buffer.from(canonical, "utf-8"),
+      pubkey,
+      Buffer.from(sig, "base64")
+    );
+    return ok ? { kind: "valid" } : { kind: "bad_signature" };
+  } catch (err) {
+    return {
+      kind: "error",
+      reason: `Signature verification threw: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+}
+function isLicenseSignatureRequired() {
+  return process.env.MASSU_REQUIRE_SIGNED_LICENSE === "true";
+}
+var init_license_response_verifier = __esm({
+  "src/security/license-response-verifier.ts"() {
+    "use strict";
+    init_license_pubkey_generated();
+  }
+});
+
 // src/license.ts
 import { createHash as createHash5 } from "crypto";
+function warnLicenseSigOnce(reason) {
+  if (_warnedLicenseSig) return;
+  _warnedLicenseSig = true;
+  process.stderr.write(
+    `[massu] WARNING: license-validate response is unsigned or signature invalid (${reason}). Acceptance permitted under transition mode. Operator: provision Supabase Edge Function LICENSE_RESPONSE_SIGNING_PRIVATE_KEY_B64 then set MASSU_REQUIRE_SIGNED_LICENSE=true to enforce strict mode.
+`
+  );
+}
 function tierLevel(tier) {
   return TIER_LEVELS[tier] ?? 0;
 }
@@ -14263,6 +14357,13 @@ async function validateLicense(apiKey) {
         });
         if (response.ok) {
           const data = await response.json();
+          const sigResult = verifyLicenseResponse(data);
+          if (sigResult.kind !== "valid") {
+            if (isLicenseSignatureRequired()) {
+              throw new Error(`License response signature invalid: ${sigResult.kind}`);
+            }
+            warnLicenseSigOnce(sigResult.kind);
+          }
           if (data.valid) {
             const tier = data.plan ? PLAN_TO_TIER_MAP[data.plan] ?? "free" : data.tier ?? "free";
             const validUntil = data.validUntil ?? "";
@@ -14385,12 +14486,14 @@ async function handleLicenseToolCall(name, _args, _memDb) {
   }
   return { content: [{ type: "text", text: `Unknown license tool: ${name}` }] };
 }
-var TIER_LEVELS, TOOL_TIER_MAP, PLAN_TO_TIER_MAP, TIER_LABELS, cachedTier, cachedTierTimestamp, IN_MEMORY_CACHE_TTL_MS;
+var _warnedLicenseSig, TIER_LEVELS, TOOL_TIER_MAP, PLAN_TO_TIER_MAP, TIER_LABELS, cachedTier, cachedTierTimestamp, IN_MEMORY_CACHE_TTL_MS;
 var init_license = __esm({
   "src/license.ts"() {
     "use strict";
     init_config();
     init_memory_db();
+    init_license_response_verifier();
+    _warnedLicenseSig = false;
     TIER_LEVELS = {
       free: 0,
       pro: 1,
@@ -25469,7 +25572,7 @@ function buildCrossReferences(db) {
   const insertEdge = db.prepare(
     "INSERT OR IGNORE INTO knowledge_edges (source_type, source_id, target_type, target_id, edge_type) VALUES (?, ?, ?, ?, ?)"
   );
-  const rules = db.prepare("SELECT rule_id, vr_type, reference_path FROM knowledge_rules").all();
+  const rules = db.prepare("SELECT rule_id, vr_type, reference_path FROM knowledge_rules LIMIT 10000").all();
   for (const rule of rules) {
     if (rule.vr_type && rule.vr_type !== "VR-*") {
       const vrTypes = rule.vr_type.split(/[,\s]+/).filter((v3) => v3.startsWith("VR-"));
@@ -25484,7 +25587,7 @@ function buildCrossReferences(db) {
       edgeCount++;
     }
   }
-  const incidents = db.prepare("SELECT incident_num, cr_added FROM knowledge_incidents WHERE cr_added IS NOT NULL").all();
+  const incidents = db.prepare("SELECT incident_num, cr_added FROM knowledge_incidents WHERE cr_added IS NOT NULL LIMIT 10000").all();
   for (const inc of incidents) {
     if (inc.cr_added) {
       const crIds = inc.cr_added.match(/CR-\d+/g) || [];
@@ -25494,7 +25597,7 @@ function buildCrossReferences(db) {
       }
     }
   }
-  const chunks = db.prepare("SELECT id, content, metadata FROM knowledge_chunks").all();
+  const chunks = db.prepare("SELECT id, content, metadata FROM knowledge_chunks LIMIT 100000").all();
   for (const chunk of chunks) {
     const text18 = chunk.content;
     const crRefs = text18.match(/CR-\d+/g);
@@ -26108,7 +26211,7 @@ function handleRule(db, args2) {
       lines.push(`- **${rule.rule_id}**: ${rule.rule_text} | VR: ${rule.vr_type || "N/A"} | Ref: ${rule.reference_path || "N/A"}`);
     }
   } else {
-    const rules = db.prepare("SELECT * FROM knowledge_rules ORDER BY rule_id").all();
+    const rules = db.prepare("SELECT * FROM knowledge_rules ORDER BY rule_id LIMIT 10000").all();
     lines.push(`## All Canonical Rules (${rules.length} total)`);
     lines.push("");
     for (const rule of rules) {
@@ -26217,7 +26320,7 @@ function handleSchemaCheck(db, args2) {
     }
   }
   if (!table && !column) {
-    const all = db.prepare("SELECT * FROM knowledge_schema_mismatches ORDER BY table_name").all();
+    const all = db.prepare("SELECT * FROM knowledge_schema_mismatches ORDER BY table_name LIMIT 10000").all();
     lines.push(`## All Known Schema Mismatches (${all.length} total)`);
     lines.push("");
     lines.push("| Table | WRONG | CORRECT |");
@@ -26355,7 +26458,7 @@ function handleVerification(db, args2) {
       lines.push("");
     }
   } else {
-    const all = db.prepare("SELECT vr_type, command, use_when FROM knowledge_verifications ORDER BY vr_type").all();
+    const all = db.prepare("SELECT vr_type, command, use_when FROM knowledge_verifications ORDER BY vr_type LIMIT 10000").all();
     lines.push(`## All Verification Types (${all.length} total)`);
     lines.push("");
     for (const vr of all) {
@@ -26743,7 +26846,7 @@ function handleEffectiveness2(db, args2) {
   const topN = Math.min(args2.top_n || 10, 50);
   const mode = args2.mode || "most_violated";
   const lines = [];
-  const allRules = db.prepare("SELECT rule_id, rule_text FROM knowledge_rules ORDER BY rule_id").all();
+  const allRules = db.prepare("SELECT rule_id, rule_text FROM knowledge_rules ORDER BY rule_id LIMIT 10000").all();
   let memoryDb = null;
   const violationCounts = /* @__PURE__ */ new Map();
   const lastViolated = /* @__PURE__ */ new Map();

package/dist/hooks/classify-failure.js

@@ -1042,7 +1042,7 @@ function initMemorySchema(db) {
   `);
 }
 function getFailureClasses(db) {
-  const rows = db.prepare("SELECT * FROM failure_classes ORDER BY name").all();
+  const rows = db.prepare("SELECT * FROM failure_classes ORDER BY name LIMIT 10000").all();
   return rows.map((row) => ({
     id: row.id,
     name: row.name,

package/dist/hooks/incident-pipeline.js

@@ -1059,7 +1059,7 @@ function addFailureClass(db, opts) {
   return Number(result.lastInsertRowid);
 }
 function getFailureClasses(db) {
-  const rows = db.prepare("SELECT * FROM failure_classes ORDER BY name").all();
+  const rows = db.prepare("SELECT * FROM failure_classes ORDER BY name LIMIT 10000").all();
   return rows.map((row) => ({
     id: row.id,
     name: row.name,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@massu/core",
-  "version": "1.10.3",
+  "version": "1.10.5",
   "type": "module",
   "description": "AI Engineering Governance MCP Server - Session memory, knowledge system, feature registry, code intelligence, rule enforcement, tiered tooling (12 free / 73 total), 59 workflow commands, 11 agents, 20+ patterns",
   "main": "src/server.ts",
@@ -24,7 +24,7 @@
     "build:bundle-adapters": "tsx scripts/bundle-adapters.ts",
     "build:cli": "esbuild --bundle --platform=node --format=esm --outfile=dist/cli.js src/cli.ts --external:better-sqlite3 --external:yaml --external:zod --external:chokidar --external:proper-lockfile --external:fsevents --external:web-tree-sitter --external:tweetnacl --external:tar --external:smol-toml --external:vscode-languageserver-protocol --external:@massu/adapter-rails --external:@massu/adapter-phoenix --external:@massu/adapter-aspnet --external:@massu/adapter-spring --external:@massu/adapter-go-chi --banner:js='#!/usr/bin/env node\nimport{createRequire as __cr}from\"module\";const require=__cr(import.meta.url);'",
     "build:hooks": "esbuild --bundle --platform=node --format=esm --outdir=dist/hooks src/hooks/*.ts --external:better-sqlite3 --external:yaml --external:zod --external:chokidar --external:proper-lockfile --external:fsevents --external:web-tree-sitter --external:tweetnacl --external:tar --external:smol-toml --external:vscode-languageserver-protocol --external:@massu/adapter-rails --external:@massu/adapter-phoenix --external:@massu/adapter-aspnet --external:@massu/adapter-spring --external:@massu/adapter-go-chi --banner:js='import{createRequire as __cr}from\"module\";const require=__cr(import.meta.url);'",
-    "prepublishOnly": "bash ../../scripts/prepublish-check.sh && node ../../scripts/bundle-pubkey.mjs && npm run build",
+    "prepublishOnly": "bash ../../scripts/prepublish-check.sh && node ../../scripts/bundle-pubkey.mjs && node ../../scripts/bundle-license-pubkey.mjs && npm run build",
     "bench:watch": "tsx test/perf/watch-benchmark.ts"
   },
   "dependencies": {

package/src/knowledge-indexer.ts

@@ -349,7 +349,7 @@ export function buildCrossReferences(db: Database.Database): number {
   );
 
   // CR -> VR edges (from knowledge_rules)
-  const rules = db.prepare('SELECT rule_id, vr_type, reference_path FROM knowledge_rules').all() as CRRule[];
+  const rules = db.prepare('SELECT rule_id, vr_type, reference_path FROM knowledge_rules LIMIT 10000').all() as CRRule[];
   for (const rule of rules) {
     if (rule.vr_type && rule.vr_type !== 'VR-*') {
       // Split compound VR types (e.g., "VR-SCHEMA" or "VR-*")
@@ -367,7 +367,7 @@ export function buildCrossReferences(db: Database.Database): number {
   }
 
   // Incident -> CR edges (from knowledge_incidents)
-  const incidents = db.prepare('SELECT incident_num, cr_added FROM knowledge_incidents WHERE cr_added IS NOT NULL').all() as { incident_num: number; cr_added: string }[];
+  const incidents = db.prepare('SELECT incident_num, cr_added FROM knowledge_incidents WHERE cr_added IS NOT NULL LIMIT 10000').all() as { incident_num: number; cr_added: string }[];
   for (const inc of incidents) {
     if (inc.cr_added) {
       const crIds = inc.cr_added.match(/CR-\d+/g) || [];
@@ -379,7 +379,7 @@ export function buildCrossReferences(db: Database.Database): number {
   }
 
   // Scan all chunks for cross-references
-  const chunks = db.prepare('SELECT id, content, metadata FROM knowledge_chunks').all() as { id: number; content: string; metadata: string }[];
+  const chunks = db.prepare('SELECT id, content, metadata FROM knowledge_chunks LIMIT 100000').all() as { id: number; content: string; metadata: string }[];
   for (const chunk of chunks) {
     const text = chunk.content;
 

package/src/knowledge-tools.ts

@@ -462,7 +462,7 @@ function handleRule(db: Database.Database, args: Record<string, unknown>): ToolR
     }
   } else {
     // List all rules
-    const rules = db.prepare('SELECT * FROM knowledge_rules ORDER BY rule_id').all() as {
+    const rules = db.prepare('SELECT * FROM knowledge_rules ORDER BY rule_id LIMIT 10000').all() as {
       rule_id: string; rule_text: string; vr_type: string;
     }[];
 
@@ -614,7 +614,7 @@ function handleSchemaCheck(db: Database.Database, args: Record<string, unknown>)
 
   if (!table && !column) {
     // Show all mismatches
-    const all = db.prepare('SELECT * FROM knowledge_schema_mismatches ORDER BY table_name').all() as {
+    const all = db.prepare('SELECT * FROM knowledge_schema_mismatches ORDER BY table_name LIMIT 10000').all() as {
       table_name: string; wrong_column: string; correct_column: string;
     }[];
 
@@ -804,7 +804,7 @@ function handleVerification(db: Database.Database, args: Record<string, unknown>
     }
   } else {
     // List all
-    const all = db.prepare('SELECT vr_type, command, use_when FROM knowledge_verifications ORDER BY vr_type').all() as {
+    const all = db.prepare('SELECT vr_type, command, use_when FROM knowledge_verifications ORDER BY vr_type LIMIT 10000').all() as {
       vr_type: string; command: string; use_when: string;
     }[];
 
@@ -1319,7 +1319,7 @@ function handleEffectiveness(db: Database.Database, args: Record<string, unknown
   const lines: string[] = [];
 
   // Get all CR rules from knowledge DB
-  const allRules = db.prepare('SELECT rule_id, rule_text FROM knowledge_rules ORDER BY rule_id').all() as {
+  const allRules = db.prepare('SELECT rule_id, rule_text FROM knowledge_rules ORDER BY rule_id LIMIT 10000').all() as {
     rule_id: string; rule_text: string;
   }[];
 

package/src/license.ts

@@ -17,6 +17,21 @@ import { createHash } from 'crypto';
 import type { ToolDefinition, ToolResult } from './tools.ts';
 import { getConfig } from './config.ts';
 import { getMemoryDb } from './memory-db.ts';
+import { verifyLicenseResponse, isLicenseSignatureRequired } from './security/license-response-verifier.ts';
+
+// P-H019 one-shot warning gate. We emit the stderr warning at most once
+// per process lifetime so the customer's terminal isn't spammed every
+// session-start until the operator provisions the Edge Function signing key.
+let _warnedLicenseSig = false;
+function warnLicenseSigOnce(reason: string): void {
+  if (_warnedLicenseSig) return;
+  _warnedLicenseSig = true;
+  process.stderr.write(
+    `[massu] WARNING: license-validate response is unsigned or signature invalid (${reason}). ` +
+    `Acceptance permitted under transition mode. Operator: provision Supabase Edge Function ` +
+    `LICENSE_RESPONSE_SIGNING_PRIVATE_KEY_B64 then set MASSU_REQUIRE_SIGNED_LICENSE=true to enforce strict mode.\n`,
+  );
+}
 
 // ============================================================
 // Types
@@ -294,8 +309,35 @@ export async function validateLicense(apiKey: string): Promise<LicenseInfo> {
             validUntil?: string;
             features?: string[];
             reason?: string;
+            _signature?: string;
+            _signature_alg?: string;
+            _signature_payload_keys?: readonly string[];
+            _signature_pubkey_fingerprint?: string;
           };
 
+          // P-H019 (plan-stage-c-high-batch / 1.10.5): verify Ed25519
+          // signature on the validate-key response. Closes the bug class
+          // where MITM / malicious-cloud-endpoint / local SQLite edit
+          // could grant arbitrary tier.
+          //
+          // Transition mode (default): unsigned/invalid-sig responses are
+          // accepted with a one-shot stderr warning. Lets existing customers
+          // keep working while operators provision the Edge Function signing
+          // key.
+          //
+          // Strict mode (MASSU_REQUIRE_SIGNED_LICENSE=true, post-cutover):
+          // unsigned/invalid-sig responses are rejected; caller falls
+          // through to the grace-period cache or free tier.
+          const sigResult = verifyLicenseResponse(data);
+          if (sigResult.kind !== 'valid') {
+            if (isLicenseSignatureRequired()) {
+              // Strict mode — reject. Caller falls through to grace period.
+              throw new Error(`License response signature invalid: ${sigResult.kind}`);
+            }
+            // Transition mode — one-shot stderr warning per session.
+            warnLicenseSigOnce(sigResult.kind);
+          }
+
           if (data.valid) {
             // Map plan name to tier using PLAN_TO_TIER_MAP
             const tier: ToolTier = data.plan

package/src/memory-db.ts

@@ -1497,7 +1497,7 @@ export function addFailureClass(db: Database.Database, opts: AddFailureClassOpts
  * Get all failure classes from the taxonomy.
  */
 export function getFailureClasses(db: Database.Database): FailureClass[] {
-  const rows = db.prepare('SELECT * FROM failure_classes ORDER BY name').all() as Array<Record<string, unknown>>;
+  const rows = db.prepare('SELECT * FROM failure_classes ORDER BY name LIMIT 10000').all() as Array<Record<string, unknown>>;
   return rows.map(row => ({
     id: row.id as number,
     name: row.name as string,

package/src/security/license-pubkey.generated.ts

@@ -0,0 +1,30 @@
+// AUTO-GENERATED by scripts/bundle-license-pubkey.mjs at 2026-05-17T15:24:33.950Z.
+// Source pem: packages/core/security/license-pubkey.pem
+// RAW-bytes sha256: 18a63d64fdec9e5a368fc45feaa49bed6ced815967e582bc7b8af534f22a9475
+// DO NOT EDIT — regenerate via `node scripts/bundle-license-pubkey.mjs` or
+// the prepublishOnly hook (which runs on every npm publish).
+
+/**
+ * Ed25519 public key for verifying signed /validate-key responses from
+ * massu.ai. Used by packages/core/src/security/license-response-verifier.ts
+ * to reject MITM / malicious-cloud-endpoint responses.
+ *
+ * P-H019 (plan-stage-c-high-batch / 1.10.5).
+ *
+ * To rotate: regenerate the keypair via Node crypto.generateKeyPairSync,
+ * update packages/core/security/license-pubkey.pem with the new public key,
+ * append the new RAW-bytes sha256 to KNOWN_PUBKEY_FINGERPRINTS in
+ * scripts/bundle-license-pubkey.mjs (DO NOT delete the old entry during
+ * the rotation grace window), then run `node scripts/bundle-license-pubkey.mjs`.
+ * Operator then updates the Supabase Edge Function env var
+ * `LICENSE_RESPONSE_SIGNING_PRIVATE_KEY_B64` with the new private key.
+ */
+export const LICENSE_PUBKEY_ED25519: Uint8Array = new Uint8Array([39, 136, 108, 146, 85, 233, 119, 252, 223, 226, 123, 155, 234, 168, 200, 150, 36, 249, 174, 6, 130, 146, 125, 196, 136, 224, 202, 150, 53, 228, 114, 15]);
+
+/** Hex sha256 of LICENSE_PUBKEY_ED25519 (raw 32 bytes). */
+export const LICENSE_PUBKEY_FINGERPRINT_HEX = '18a63d64fdec9e5a368fc45feaa49bed6ced815967e582bc7b8af534f22a9475';
+
+/** Allowlist of historically-trusted license pubkey fingerprints. */
+export const KNOWN_LICENSE_PUBKEY_FINGERPRINTS: ReadonlySet<string> = new Set([
+  "18a63d64fdec9e5a368fc45feaa49bed6ced815967e582bc7b8af534f22a9475"
+]);

package/src/security/license-response-verifier.ts

@@ -0,0 +1,149 @@
+// Copyright (c) 2026 Massu. All rights reserved.
+// Licensed under BSL 1.1 - see LICENSE file for details.
+
+/**
+ * P-H019 (plan-stage-c-high-batch / 1.10.5): Ed25519 verifier for signed
+ * /validate-key responses from massu.ai.
+ *
+ * **Bug class closed**: pre-fix, `packages/core/src/license.ts:280-318`
+ * accepted ANY `{ valid: true, plan: 'enterprise' }` JSON over HTTPS from
+ * whatever endpoint `config.cloud?.endpoint` pointed to. MITM, malicious
+ * cloud.endpoint, or local edit of the cached `license_cache` SQLite row
+ * could grant arbitrary tier.
+ *
+ * **Structural fix**: the server (validate-key Supabase Edge Function)
+ * signs every response with Ed25519. The client (this module, called
+ * from `license.ts`) verifies the signature against the bundled public
+ * key in `license-pubkey.generated.ts`. Invalid / missing signature →
+ * reject under strict mode, warn-and-accept under transition mode.
+ *
+ * **Transition mode** (default): when `MASSU_REQUIRE_SIGNED_LICENSE` env
+ * var is NOT `'true'`, unsigned/invalid-sig responses are accepted but
+ * a one-shot stderr warning is emitted. Lets existing customers keep
+ * working while operators provision the signing key.
+ *
+ * **Strict mode** (post-cutover): when `MASSU_REQUIRE_SIGNED_LICENSE=true`,
+ * unsigned/invalid-sig responses are REJECTED (caller drops to grace-period
+ * cached or 'free' tier). Operator flips this after Supabase Edge Function
+ * env var `LICENSE_RESPONSE_SIGNING_PRIVATE_KEY_B64` is provisioned and
+ * cutover smoke test passes.
+ */
+
+import { createVerify, createPublicKey } from 'crypto';
+import {
+  LICENSE_PUBKEY_ED25519,
+  LICENSE_PUBKEY_FINGERPRINT_HEX,
+  KNOWN_LICENSE_PUBKEY_FINGERPRINTS,
+} from './license-pubkey.generated.ts';
+
+export interface SignedLicenseResponse {
+  /** Base64-encoded Ed25519 signature over the canonical-serialized payload. */
+  _signature?: string;
+  /** Signature algorithm tag (currently always `'ed25519'`). */
+  _signature_alg?: string;
+  /**
+   * Sorted list of top-level keys (excluding the `_signature*` triplet) that
+   * were included in the signed payload. Lets the client reconstruct the
+   * canonical-serialization input deterministically.
+   */
+  _signature_payload_keys?: readonly string[];
+  /** Hex sha256 of the LICENSE pubkey used for signing (so client can detect rotation). */
+  _signature_pubkey_fingerprint?: string;
+  // Plus the actual fields (plan, tier, validUntil, features, etc.)
+  [key: string]: unknown;
+}
+
+export type VerificationResult =
+  | { kind: 'valid' }
+  | { kind: 'missing_signature' }
+  | { kind: 'bad_signature' }
+  | { kind: 'unknown_pubkey'; got: string }
+  | { kind: 'error'; reason: string };
+
+/**
+ * Verify a server-signed /validate-key response. Returns a tagged union
+ * describing the verification outcome. Caller decides whether to accept
+ * based on strict/transition mode.
+ */
+export function verifyLicenseResponse(payload: SignedLicenseResponse): VerificationResult {
+  // Self-check: confirm the bundled key fingerprint matches the allowlist.
+  // CR-9 audit L2 pattern: a future build that swaps the pem to an unknown
+  // key refuses to load even if compiled in.
+  if (!KNOWN_LICENSE_PUBKEY_FINGERPRINTS.has(LICENSE_PUBKEY_FINGERPRINT_HEX)) {
+    return {
+      kind: 'error',
+      reason: `Bundled license pubkey fingerprint ${LICENSE_PUBKEY_FINGERPRINT_HEX} is not in the trusted allowlist. Possible build-time tamper.`,
+    };
+  }
+
+  const sig = payload._signature;
+  const alg = payload._signature_alg;
+  const payloadKeys = payload._signature_payload_keys;
+  const sigPubkey = payload._signature_pubkey_fingerprint;
+
+  if (typeof sig !== 'string' || sig.length === 0) {
+    return { kind: 'missing_signature' };
+  }
+  if (alg !== 'ed25519') {
+    return { kind: 'error', reason: `Unsupported signature algorithm: ${alg}` };
+  }
+  if (!Array.isArray(payloadKeys) || payloadKeys.length === 0) {
+    return { kind: 'error', reason: 'Missing _signature_payload_keys' };
+  }
+  if (typeof sigPubkey === 'string' && sigPubkey !== LICENSE_PUBKEY_FINGERPRINT_HEX) {
+    // Server signed with a different pubkey than we have bundled — rotation
+    // mismatch. Caller should fail-open under transition mode (operator
+    // hasn't published the new bundle yet) but reject under strict mode.
+    return { kind: 'unknown_pubkey', got: sigPubkey };
+  }
+
+  // Reconstruct the canonical serialization the server signed:
+  //   JSON.stringify({ k1: payload[k1], k2: payload[k2], ... }, payloadKeysSorted)
+  // where payloadKeysSorted is the sorted list of NON-underscore-prefixed keys.
+  const canonicalObj: Record<string, unknown> = {};
+  for (const k of payloadKeys) {
+    if (typeof k !== 'string') continue;
+    canonicalObj[k] = payload[k];
+  }
+  const canonical = JSON.stringify(canonicalObj, [...payloadKeys].sort());
+
+  // Verify signature.
+  try {
+    // Construct a node KeyObject from the bundled raw Ed25519 pubkey bytes.
+    // We use createPublicKey with SubjectPublicKeyInfo DER encoding (44 bytes:
+    // 12-byte algorithm OID prefix + 32-byte raw key).
+    const spkiPrefix = Buffer.from([
+      0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65,
+      0x70, 0x03, 0x21, 0x00,
+    ]);
+    const der = Buffer.concat([spkiPrefix, Buffer.from(LICENSE_PUBKEY_ED25519)]);
+    const pubkey = createPublicKey({ key: der, format: 'der', type: 'spki' });
+
+    // Ed25519 in node uses `verify` directly (no createVerify needed for ed25519).
+    // crypto.verify(algorithm, data, key, signature) — algorithm MUST be null for Ed25519.
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const { verify } = require('crypto');
+    const ok = verify(
+      null,
+      Buffer.from(canonical, 'utf-8'),
+      pubkey,
+      Buffer.from(sig, 'base64'),
+    );
+
+    return ok ? { kind: 'valid' } : { kind: 'bad_signature' };
+  } catch (err) {
+    return {
+      kind: 'error',
+      reason: `Signature verification threw: ${err instanceof Error ? err.message : String(err)}`,
+    };
+  }
+}
+
+/**
+ * P-H019 strict-mode gate. Operator sets `MASSU_REQUIRE_SIGNED_LICENSE=true`
+ * AFTER the validate-key Edge Function is provisioned with
+ * `LICENSE_RESPONSE_SIGNING_PRIVATE_KEY_B64` and cutover smoke test passes.
+ */
+export function isLicenseSignatureRequired(): boolean {
+  return process.env.MASSU_REQUIRE_SIGNED_LICENSE === 'true';
+}

package/src/security/registry-pubkey.generated.ts

@@ -1,4 +1,4 @@
-// AUTO-GENERATED by scripts/bundle-pubkey.mjs at 2026-05-17T05:43:58.152Z.
+// AUTO-GENERATED by scripts/bundle-pubkey.mjs at 2026-05-17T15:24:33.893Z.
 // Source pem: packages/core/security/registry-pubkey.pem
 // RAW-bytes sha256: 3b6226d036c472e533110d11a7d0cd2773ce1d7d4f1003517d5bd69c5418ed4c
 // DO NOT EDIT — regenerate via `node scripts/bundle-pubkey.mjs` or