@massu/core 1.15.1 → 1.15.2

package/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [1.15.2] - 2026-07-06
+
+**CRITICAL production fix: the `validate-key` cloud edge function returned HTTP 500 on every real API key (deploy drift), silently downgrading every Enterprise/Pro customer to Free** (`plan-2026-07-06-validate-key-deploy-drift`). The DEPLOYED `validate-key` Supabase edge function was a stale bundle that never received the 2026-05-31 `compareSync` fix — it still called the async bcrypt `compare()`, which spawns a Web Worker the Supabase Edge Runtime forbids, so it threw → HTTP 500 on every real `ms_live_` key. `@massu/core`'s license path (`validateLicense`) treated the 500 as "Free", so every paid key silently resolved to Free (surfaced during git-safe-api-key dogfooding, 2026-07-05). The repo source was already correct; the fix redeploys it (wrong-key probe now returns 401, not 500) — **no customer key changes, no re-hashing, no bcrypt/WebCrypto re-engineering** (the cause was a missed deploy, not a library bug). Patch per semver: a bug fix with no API change. Incident: `docs/incidents/2026-07-06-validate-key-deploy-drift-500.md`.
+
+### Fixed
+
+- **`validate-key` edge function 500'd on every real API key (deploy drift).** The live bundle (version 8, 2026-05-31) still imported the async `compare()` (Web-Worker → forbidden in the Supabase Edge Runtime → throw → HTTP 500) five weeks after `e7d67f6` fixed the repo source to route through `verifyApiKeyHash`/`compareSync`; the validate-key redeploy of that fix never actually landed. Verified from the deployed bundle via `supabase functions download`; blast radius confirmed = validate-key only (the other 6 API-key edge functions were already correct). Redeployed the correct source.
+- **`massu login` / `massu doctor` reported "Free" when the license server had errored or was unreachable.** `validateLicense` now returns a `LicenseValidationOutcome` (`validated` / `rejected` / `server_error` / `network_error` / `grace` / `cache_fresh` / `no_endpoint` / `no_key`); `login` and `doctor` distinguish an authoritative Free from a "could not validate (server error / offline) — tier UNKNOWN" state, so a server 500 is never misreported as a Free downgrade (this masking is why the outage looked like "Free").
+
+### Added
+
+- **CR-60: API-key edge functions MUST be deploy-verified (three-layer structural drift-prevention).** (1) A source drift-guard (`website/src/__tests__/edge-async-bcrypt-compare-drift.test.ts`, vitest, CI + pre-push) fails if any edge function imports or calls the async bcrypt `compare(` — hashing must route through `verifyApiKeyHash`/`compareSync`; catches a function bypassing the shared helper (which the Deno helper test cannot). (2) A canonical edge-deploy + post-deploy real-key smoke test (`scripts/massu-deploy-edge-functions.sh`) fails the deploy unless a known-good key validates (HTTP 200 + expected tier) and a wrong key returns 401 (`scripts/massu-deploy.sh` deploys only Vercel, so it could never have caught this). (3) A Guardian readiness watcher (`massu_validate_key_readiness_watcher`, hourly) POSTs a known-good key to the live gateway and fires CRITICAL on any 500 / non-200 / wrong tier — this class had zero alerting.
+
 ## [1.15.1] - 2026-07-05
 
 **Node 26 compatibility — native-module (better-sqlite3) ABI fix + Node-major CI matrix**. Restores massu on the now-default Node 26. `@massu/core` shipped a prebuilt `better-sqlite3` binary compiled for an older `NODE_MODULE_VERSION` (ABI) and declared `engines.node` `">=20.0.0 <26.0.0"`; when Homebrew's default Node became v26 (ABI 147), the native module failed to load (`NODE_MODULE_VERSION 127 ... requires 147`), breaking BOTH the license check and the memory database in every consumer repo — `npx @massu/core@1 doctor` reported UNHEALTHY. This bumps `better-sqlite3` `^12.6.2` → `^12.11.1` (which ships prebuilt ABI-147 binaries for macOS/Linux/Alpine/Windows, so `npx` consumers with no compiler still load it) and removes the artificial `<26.0.0` engines ceiling (now `>=20.0.0`). Verified end-to-end: the full sqlite-backed suite (2710 tests) + `doctor` HEALTHY on Node 26 AND Node 22 (previously-shipped ABI 127 — no regression). Patch per semver: a compatibility fix with no API change.