@rafaylabs/animation-mcp 0.0.0-stage → 1.0.0

package/dist/auth/client.js

@@ -0,0 +1,170 @@
+import { loadConfig, saveConfig, grantLicense, isLicenseValid } from './config.js';
+import { LICENSE_PRODUCT, isProductConfigured } from './product.js';
+const DEFAULT_API_BASE = process.env.ANIMATION_MCP_API_URL || 'https://getrafaylabs.com/api/lottie';
+const LS_LICENSE_API = 'https://api.lemonsqueezy.com/v1/licenses';
+const NOT_CONFIGURED = 'Licence verification is not configured in this build yet. Please try again later or contact info@getrafaylabs.com.';
+async function lemonSqueezy(endpoint, params) {
+    const response = await fetch(`${LS_LICENSE_API}/${endpoint}`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded', Accept: 'application/json' },
+        body: new URLSearchParams(params),
+        signal: AbortSignal.timeout(15_000),
+    });
+    return (await response.json());
+}
+/** A key from someone else's Lemon Squeezy store must never unlock our product. */
+function productMismatch(meta, expected) {
+    return !(Number(meta?.store_id) === expected.storeId && expected.productIds.includes(Number(meta?.product_id)));
+}
+function badStatus(data) {
+    const status = data?.license_key?.status;
+    if (status === 'expired')
+        return 'This licence key has expired.';
+    if (status === 'disabled')
+        return 'This licence key has been disabled.';
+    return null;
+}
+/**
+ * Activates a Lemon Squeezy licence key on this machine.
+ * Fails closed: any problem (network, wrong product, not configured) means "not licensed".
+ */
+export async function verifyLicenseKey(key, instanceName = 'Developer Machine', expected = LICENSE_PRODUCT) {
+    const cleaned = key.trim();
+    if (!cleaned)
+        return { valid: false, tier: 'free', error: 'Licence key cannot be empty.' };
+    if (!isProductConfigured(expected))
+        return { valid: false, tier: 'free', error: NOT_CONFIGURED };
+    try {
+        const data = await lemonSqueezy('activate', { license_key: cleaned, instance_name: instanceName });
+        if (!data.activated) {
+            return { valid: false, tier: 'free', error: data.error || 'Invalid or expired licence key.' };
+        }
+        if (productMismatch(data.meta, expected)) {
+            // Free the activation slot we just consumed, then refuse.
+            if (data.instance?.id) {
+                lemonSqueezy('deactivate', { license_key: cleaned, instance_id: data.instance.id }).catch(() => { });
+            }
+            return { valid: false, tier: 'free', error: 'This licence key is not for RafayLabs Animation MCP.' };
+        }
+        const statusError = badStatus(data);
+        if (statusError)
+            return { valid: false, tier: 'free', error: statusError };
+        return {
+            valid: true,
+            tier: 'lifetime',
+            email: data.meta?.customer_email,
+            instanceId: data.instance?.id,
+        };
+    }
+    catch (err) {
+        return { valid: false, tier: 'free', error: `Network error verifying licence: ${err.message}` };
+    }
+}
+async function revalidate(key, instanceId, expected) {
+    if (!instanceId)
+        return verifyLicenseKey(key, 'Developer Machine', expected);
+    if (!isProductConfigured(expected))
+        return { valid: false, tier: 'free', error: NOT_CONFIGURED };
+    try {
+        const data = await lemonSqueezy('validate', { license_key: key, instance_id: instanceId });
+        if (!data.valid || productMismatch(data.meta, expected) || badStatus(data)) {
+            return { valid: false, tier: 'free', error: data.error || 'Licence is no longer valid.' };
+        }
+        return { valid: true, tier: 'lifetime', email: data.meta?.customer_email, instanceId };
+    }
+    catch (err) {
+        return { valid: false, tier: 'free', error: `Network error verifying licence: ${err.message}` };
+    }
+}
+/**
+ * Decides whether this run is a paid one. Used by every quota-limited tool.
+ *  - A verified, unexpired, untampered cached licence counts.
+ *  - ANIMATION_MCP_KEY is only a way to *supply* a key: it is always checked with Lemon Squeezy.
+ *  - Anything else is the free tier.
+ */
+export async function resolveLicense(expected = LICENSE_PRODUCT) {
+    const config = loadConfig();
+    const envKey = process.env.ANIMATION_MCP_KEY?.trim();
+    const key = envKey || config.licenseKey;
+    if (isLicenseValid(config) && (!envKey || config.licenseKey === envKey))
+        return true;
+    if (!key)
+        return false; // account-token sessions cannot be re-checked silently: sign in again
+    const result = await revalidate(key, config.licenseKey === key ? config.instanceId : undefined, expected);
+    if (!result.valid)
+        return false;
+    grantLicense(config, { email: result.email ?? config.email, licenseKey: key, instanceId: result.instanceId });
+    return true;
+}
+/**
+ * Frees this machine's activation on Lemon Squeezy so the key can be used on another device.
+ * Returns ok:true when the activation is gone (or was already gone).
+ */
+export async function deactivateLicense(key, instanceId) {
+    try {
+        const data = await lemonSqueezy('deactivate', { license_key: key, instance_id: instanceId });
+        if (data.deactivated)
+            return { ok: true };
+        // Already removed on the Lemon Squeezy side: nothing left to free.
+        if (/not found/i.test(String(data.error ?? '')))
+            return { ok: true };
+        return { ok: false, error: data.error || 'Lemon Squeezy did not confirm the deactivation.' };
+    }
+    catch (err) {
+        return { ok: false, error: `Network error: ${err.message}` };
+    }
+}
+const EMAIL_UNAVAILABLE = 'Email sign-in is not available yet. Use your Lemon Squeezy licence key, or continue on the free tier.';
+/**
+ * Email magic-code sign-in. Requires the server endpoint; fails closed when it is missing.
+ */
+export async function requestEmailMagicCode(email) {
+    try {
+        const res = await fetch(`${DEFAULT_API_BASE}/auth/magic-code`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ email: email.trim().toLowerCase() }),
+            signal: AbortSignal.timeout(15_000),
+        });
+        if (!res.ok)
+            return { success: false, message: EMAIL_UNAVAILABLE };
+        const data = (await res.json());
+        return { success: true, message: data.message || `Code sent to ${email}` };
+    }
+    catch {
+        return { success: false, message: EMAIL_UNAVAILABLE };
+    }
+}
+/**
+ * Verifies a magic code with the server. The paid tier is granted only from a server
+ * response that carries a token; there is no local fallback.
+ */
+export async function verifyEmailMagicCode(email, code) {
+    const cleanEmail = email.trim().toLowerCase();
+    try {
+        const res = await fetch(`${DEFAULT_API_BASE}/auth/verify-code`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ email: cleanEmail, code: code.trim() }),
+            signal: AbortSignal.timeout(15_000),
+        });
+        if (!res.ok)
+            return { success: false, error: EMAIL_UNAVAILABLE };
+        const data = (await res.json());
+        if (!data?.token)
+            return { success: false, error: 'The server did not confirm this code.' };
+        const config = loadConfig();
+        if (data.tier === 'lifetime') {
+            grantLicense(config, { email: cleanEmail, licenseKey: data.licenseKey, token: data.token });
+        }
+        else {
+            config.email = cleanEmail;
+            config.tier = 'free';
+            saveConfig(config);
+        }
+        return { success: true, config };
+    }
+    catch {
+        return { success: false, error: EMAIL_UNAVAILABLE };
+    }
+}

package/dist/auth/config.d.ts

@@ -0,0 +1,36 @@
+export interface UserConfig {
+    email?: string;
+    licenseKey?: string;
+    tier: 'free' | 'lifetime';
+    token?: string;
+    instanceId?: string;
+    /** Sign-in token from getrafaylabs.com (the server decides plan and limits). */
+    serverToken?: string;
+    githubLogin?: string;
+    cachedUntil?: string;
+    /** Tamper-evidence signature over the paid-licence fields (see signLicense). */
+    sig?: string;
+    downloadsToday: number;
+    searchesToday: number;
+    lastResetDate: string;
+}
+/**
+ * Loads user config from ~/.animation-mcp/config.json with daily quota resets
+ */
+export declare function loadConfig(): UserConfig;
+/**
+ * Persists config to ~/.animation-mcp/config.json
+ */
+export declare function saveConfig(config: UserConfig): void;
+/** Marks a config as a verified paid licence (call only after a successful server/LS check). */
+export declare function grantLicense(config: UserConfig, grant: {
+    email?: string;
+    licenseKey?: string;
+    token?: string;
+    instanceId?: string;
+}): UserConfig;
+/**
+ * True only for a paid licence that was verified, has not expired (7-day cache) and
+ * whose fields have not been edited by hand. An environment variable alone never counts.
+ */
+export declare function isLicenseValid(config: UserConfig): boolean;

package/dist/auth/config.js

@@ -0,0 +1,106 @@
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+import crypto from 'crypto';
+// Resolved on every call (not at import time) so the home folder can be changed in tests.
+const configDir = () => path.join(os.homedir(), '.animation-mcp');
+const configFile = () => path.join(configDir(), 'config.json');
+function getTodayString() {
+    return new Date().toISOString().split('T')[0];
+}
+/**
+ * Loads user config from ~/.animation-mcp/config.json with daily quota resets
+ */
+export function loadConfig() {
+    try {
+        if (fs.existsSync(configFile())) {
+            const data = JSON.parse(fs.readFileSync(configFile(), 'utf-8'));
+            const today = getTodayString();
+            // Reset daily counts if new day
+            if (data.lastResetDate !== today) {
+                data.downloadsToday = 0;
+                data.searchesToday = 0;
+                data.lastResetDate = today;
+                saveConfig(data);
+            }
+            return data;
+        }
+    }
+    catch (err) {
+        // Fall back to default free config
+    }
+    const defaultConfig = {
+        tier: 'free',
+        downloadsToday: 0,
+        searchesToday: 0,
+        lastResetDate: getTodayString(),
+    };
+    saveConfig(defaultConfig);
+    return defaultConfig;
+}
+/**
+ * Persists config to ~/.animation-mcp/config.json
+ */
+export function saveConfig(config) {
+    try {
+        if (!fs.existsSync(configDir())) {
+            fs.mkdirSync(configDir(), { recursive: true, mode: 0o700 });
+        }
+        fs.writeFileSync(configFile(), JSON.stringify(config, null, 2), {
+            mode: 0o600,
+        });
+    }
+    catch (err) {
+        console.error('Failed to save config:', err);
+    }
+}
+const LICENSE_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+/**
+ * HMAC over the licence fields, keyed to this machine + user.
+ *
+ * This only stops the trivial "edit config.json and write tier: lifetime" bypass.
+ * The secret lives in published client code, so it is NOT real security: real
+ * enforcement of paid features has to happen on the server.
+ */
+function signLicense(config) {
+    const secret = crypto
+        .createHash('sha256')
+        .update(`rafaylabs-animation-mcp:${os.hostname()}:${os.userInfo().username}`)
+        .digest();
+    const payload = [
+        config.tier,
+        config.licenseKey ?? '',
+        config.token ?? '',
+        config.email ?? '',
+        config.instanceId ?? '',
+        config.cachedUntil ?? '',
+    ].join('|');
+    return crypto.createHmac('sha256', secret).update(payload).digest('hex');
+}
+/** Marks a config as a verified paid licence (call only after a successful server/LS check). */
+export function grantLicense(config, grant) {
+    config.tier = 'lifetime';
+    config.email = grant.email ?? config.email;
+    config.licenseKey = grant.licenseKey;
+    config.token = grant.token;
+    config.instanceId = grant.instanceId;
+    config.cachedUntil = new Date(Date.now() + LICENSE_TTL_MS).toISOString();
+    config.sig = signLicense(config);
+    saveConfig(config);
+    return config;
+}
+/**
+ * True only for a paid licence that was verified, has not expired (7-day cache) and
+ * whose fields have not been edited by hand. An environment variable alone never counts.
+ */
+export function isLicenseValid(config) {
+    if (config.tier !== 'lifetime' || !(config.licenseKey || config.token))
+        return false;
+    if (!config.cachedUntil || !config.sig)
+        return false;
+    if (new Date(config.cachedUntil).getTime() <= Date.now())
+        return false;
+    const expected = Buffer.from(signLicense(config));
+    const actual = Buffer.from(config.sig);
+    return expected.length === actual.length && crypto.timingSafeEqual(expected, actual);
+}

package/dist/auth/device-login.d.ts

@@ -0,0 +1,2 @@
+/** GitHub sign-in without any secret on this machine (same idea as `gh auth login`). Returns the GitHub username. */
+export declare function deviceLogin(): Promise<string>;

package/dist/auth/device-login.js

@@ -0,0 +1,63 @@
+import { spawn } from 'child_process';
+import { loadConfig, saveConfig } from './config.js';
+import { SERVER_URL, fetchMe } from '../api/server.js';
+function openBrowser(url) {
+    try {
+        const [cmd, args] = process.platform === 'darwin' ? ['open', [url]] : process.platform === 'win32' ? ['cmd', ['/c', 'start', '', url]] : ['xdg-open', [url]];
+        const child = spawn(cmd, args, { stdio: 'ignore', detached: true });
+        child.on('error', () => { });
+        child.unref();
+    }
+    catch {
+        /* the link is also printed, so this is optional */
+    }
+}
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/** GitHub sign-in without any secret on this machine (same idea as `gh auth login`). Returns the GitHub username. */
+export async function deviceLogin() {
+    let start;
+    try {
+        const res = await fetch(`${SERVER_URL}/api/mcp/auth/device`, { method: 'POST', signal: AbortSignal.timeout(15_000) });
+        if (!res.ok)
+            throw new Error(`HTTP ${res.status}`);
+        start = await res.json();
+    }
+    catch (err) {
+        throw new Error(`Could not start sign-in (${err.message}). Check your internet connection and try again.`);
+    }
+    console.log(`\nOpen this link and sign in with GitHub:\n\n  ${start.verification_url}\n`);
+    console.log(`Your code: ${start.user_code}  (check it matches on the page)\n`);
+    openBrowser(start.verification_url);
+    console.log('⏳ Waiting for you to finish in the browser...');
+    const deadline = Date.now() + Number(start.expires_in ?? 600) * 1000;
+    const interval = Math.max(2, Number(start.interval ?? 5)) * 1000;
+    while (Date.now() < deadline) {
+        await sleep(interval);
+        let res;
+        try {
+            res = await fetch(`${SERVER_URL}/api/mcp/auth/token`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ device_code: start.device_code }),
+                signal: AbortSignal.timeout(15_000),
+            });
+        }
+        catch {
+            continue; // brief network blip: keep waiting
+        }
+        const json = await res.json().catch(() => ({}));
+        if (json.access_token) {
+            const config = loadConfig();
+            config.serverToken = json.access_token;
+            saveConfig(config);
+            const me = await fetchMe();
+            config.githubLogin = me.github_login;
+            saveConfig(config);
+            return me.github_login;
+        }
+        if (json.error === 'authorization_pending')
+            continue;
+        throw new Error('Sign-in expired or was cancelled. Run `animation-mcp login` again.');
+    }
+    throw new Error('Sign-in timed out. Run `animation-mcp login` again.');
+}

package/dist/auth/product.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Which Lemon Squeezy product a licence key must belong to.
+ *
+ * These are hard-coded on purpose (NOT read from env vars): an env var would let
+ * anyone point the check at their own store and mint valid-looking keys.
+ *
+ * Fill these in from your Lemon Squeezy dashboard before publishing:
+ *   Store ID   -> Settings > Stores
+ *   Product ID -> Products > (your product) > the number in the URL / API
+ * Until both are set, licence activation fails closed (nobody gets a paid tier).
+ */
+export interface ProductBinding {
+    storeId: number;
+    productIds: number[];
+}
+export declare const LICENSE_PRODUCT: ProductBinding;
+export declare function isProductConfigured(p?: ProductBinding): boolean;

package/dist/auth/product.js

@@ -0,0 +1,9 @@
+export const LICENSE_PRODUCT = {
+    storeId: 520930, // RafayLabs store (confirm it matches meta.store_id on a live-mode key)
+    // "Animation MCP Lifetime". This ID is from TEST mode. Before going live, create the
+    // product in live mode and add its (different) ID here, then remove the test one.
+    productIds: [1517699],
+};
+export function isProductConfigured(p = LICENSE_PRODUCT) {
+    return p.storeId > 0 && p.productIds.length > 0;
+}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Creates and initializes the Animation MCP Server
+ */
+export declare function startMcpServer(): Promise<void>;