@reticlehq/server 3.8.2 → 3.10.0

package/dist/features/grade/grade-state.js

@@ -0,0 +1,93 @@
+/**
+ * Grade a finished run of an app from snapshots of its stored data. Pure.
+ *
+ * A snapshot is the state lines of `readStateSources`, and optionally a `url` line for the page the
+ * run ended on. Three snapshots go in: the reference (the app after the correct steps), again (the
+ * app after the same correct steps, from the same start), and the candidate (the app after the steps
+ * to grade). A line that differs between the two reference snapshots is noise and is ignored, and so
+ * is a change to a cell of a row that the two references wrote differently (see `grade-noise.ts`). Any
+ * other line that differs between the reference and the candidate is a difference, and the grade
+ * fails. A source that could not be read makes the grade unverified, never a pass.
+ *
+ * A row the candidate deleted and wrote again with a new id and the same values is not a difference
+ * (see `grade-renumber.ts`). The grade counts these rows.
+ *
+ * State lines are sorted rows, so the diff is a count of each line, not an ordered diff. That keeps
+ * the cost linear in the number of rows, and a source of many thousand rows is cheap.
+ */
+import { z } from 'zod';
+import { MSG_READ_FAILED } from '../compare/outside/state-sources.js';
+import { noiseCells, withoutNoiseCells } from './grade-noise.js';
+import { renumber } from './grade-renumber.js';
+export const GradeVerdict = {
+    PASS: 'pass',
+    FAIL: 'fail',
+    /** The grade proves nothing: a source could not be read, or the answer could not be checked. */
+    UNVERIFIED: 'unverified',
+};
+export const SnapshotSchema = z.strictObject({
+    lines: z.array(z.string()),
+});
+/** The line that holds the page a run ended on. */
+export const URL_PREFIX = 'url';
+/**
+ * The page a run ended on, as one line: the origin and path without a final slash, and the query
+ * values sorted by name. The fragment is removed. Text that is not a URL is kept as it is.
+ */
+export function urlLine(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return `${URL_PREFIX} ${url.trim()}`;
+    }
+    parsed.searchParams.sort();
+    const path = parsed.pathname.replace(/\/+$/, '');
+    const query = parsed.searchParams.toString();
+    return `${URL_PREFIX} ${parsed.origin}${path}${'' === query ? '' : `?${query}`}`;
+}
+const counts = (lines) => {
+    const out = new Map();
+    for (const line of lines) {
+        out.set(line, (out.get(line) ?? 0) + 1);
+    }
+    return out;
+};
+/** The lines `a` has more times than `b`, once for each extra time. */
+function surplus(a, b) {
+    const left = counts(b);
+    const out = [];
+    for (const line of a) {
+        const n = left.get(line) ?? 0;
+        if (n > 0) {
+            left.set(line, n - 1);
+        }
+        else {
+            out.push(line);
+        }
+    }
+    return out;
+}
+export function gradeState(reference, again, candidate) {
+    const unread = [reference, again, candidate].flatMap((s) => s.lines.filter((line) => line.startsWith(MSG_READ_FAILED)));
+    const referenceOnly = surplus(reference.lines, again.lines);
+    const againOnly = surplus(again.lines, reference.lines);
+    const noise = new Set([...referenceOnly, ...againOnly]);
+    const all = {
+        removed: surplus(reference.lines, candidate.lines),
+        added: surplus(candidate.lines, reference.lines),
+    };
+    const removedKept = all.removed.filter((line) => !noise.has(line));
+    const byCell = withoutNoiseCells(all.added.filter((line) => !noise.has(line)), noiseCells(referenceOnly, againOnly));
+    const { removed, added, renumbered } = renumber(removedKept, byCell.added, reference.lines, candidate.lines);
+    const ignored = all.removed.length + all.added.length - removedKept.length - byCell.added.length;
+    let verdict = GradeVerdict.PASS;
+    if (unread.length > 0) {
+        verdict = GradeVerdict.UNVERIFIED;
+    }
+    else if (removed.length > 0 || added.length > 0) {
+        verdict = GradeVerdict.FAIL;
+    }
+    return { verdict, removed, added, ignored, unread, renumbered };
+}

package/dist/features/grade/grade-suggest.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Write the state declaration for an app, so nobody writes one by hand. Pure.
+ *
+ * Two steps:
+ * 1. `tableSources`: one `command` source for each table of a database, from a list of table names
+ *    and a command template with `{table}` in it. `skip` holds name prefixes. It removes the tables that hold no task data,
+ *    such as a message queue that a background worker empties at its own time.
+ * 2. `quietSources`: keep the sources that read the same on two runs of the same correct steps.
+ *    A source that changes between those two runs (a session table, a log) would make every
+ *    candidate fail, because the candidate's own new rows are lines that neither reference has. Such
+ *    a source is kept with a time pattern removed when that makes it read the same, else dropped.
+ *    Each dropped source is reported with the reason.
+ *
+ * A source the reference does not change is kept too: a change to it by the candidate is a
+ * change to a record the task did not name.
+ */
+import { type StateSource } from '../compare/outside/state-sources.js';
+/** The word in a command template that the table name replaces. */
+export declare const TABLE_SLOT = "{table}";
+/** A date and time, with optional fractions of a second: the most common noise in a row. */
+export declare const TIME_PATTERN = "\\d{4}-\\d\\d-\\d\\d[ T]\\d\\d:\\d\\d:\\d\\d(?:\\.\\d+)?";
+export interface Skipped {
+    label: string;
+    reason: string;
+}
+export declare function tableSources(names: readonly string[], template: string, container?: string, skip?: readonly string[]): {
+    sources: StateSource[];
+    skipped: Skipped[];
+};
+export declare function quietSources(sources: readonly StateSource[], reference: readonly string[], again: readonly string[]): {
+    sources: StateSource[];
+    dropped: Skipped[];
+};

package/dist/features/grade/grade-suggest.js

@@ -0,0 +1,98 @@
+/**
+ * Write the state declaration for an app, so nobody writes one by hand. Pure.
+ *
+ * Two steps:
+ * 1. `tableSources`: one `command` source for each table of a database, from a list of table names
+ *    and a command template with `{table}` in it. `skip` holds name prefixes. It removes the tables that hold no task data,
+ *    such as a message queue that a background worker empties at its own time.
+ * 2. `quietSources`: keep the sources that read the same on two runs of the same correct steps.
+ *    A source that changes between those two runs (a session table, a log) would make every
+ *    candidate fail, because the candidate's own new rows are lines that neither reference has. Such
+ *    a source is kept with a time pattern removed when that makes it read the same, else dropped.
+ *    Each dropped source is reported with the reason.
+ *
+ * A source the reference does not change is kept too: a change to it by the candidate is a
+ * change to a record the task did not name.
+ */
+import { MSG_READ_FAILED, MSG_ROWS_CUT, STATE_PREFIX, StateSourceKind, } from '../compare/outside/state-sources.js';
+/** The word in a command template that the table name replaces. */
+export const TABLE_SLOT = '{table}';
+/** A table name that is safe in a shell command and in SQL without quotes. */
+const TABLE_NAME = /^[A-Za-z0-9_$]+$/;
+/** A date and time, with optional fractions of a second: the most common noise in a row. */
+export const TIME_PATTERN = '\\d{4}-\\d\\d-\\d\\d[ T]\\d\\d:\\d\\d:\\d\\d(?:\\.\\d+)?';
+export function tableSources(names, template, container, skip = []) {
+    const sources = [];
+    const skipped = [];
+    for (const raw of names) {
+        const name = raw.trim();
+        if ('' === name) {
+            continue;
+        }
+        if (skip.some((prefix) => name.startsWith(prefix))) {
+            skipped.push({ label: name, reason: 'the name starts with a --skip prefix' });
+            continue;
+        }
+        if (!TABLE_NAME.test(name)) {
+            skipped.push({ label: name, reason: 'the name has a character other than A-Z, 0-9, _ or $' });
+            continue;
+        }
+        sources.push({
+            kind: StateSourceKind.COMMAND,
+            label: name,
+            command: template.replaceAll(TABLE_SLOT, name),
+            ...(container === undefined ? {} : { container }),
+        });
+    }
+    return { sources, skipped };
+}
+/** The rows of one source in a snapshot, and the read failure when there is one. */
+function rowsOf(lines, label) {
+    const row = `${STATE_PREFIX} ${label} `;
+    const cut = `${MSG_ROWS_CUT} ${label}: `;
+    const failed = lines.find((line) => line.startsWith(`${MSG_READ_FAILED} ${label}: `));
+    const rows = lines.filter((line) => line.startsWith(row) || line.startsWith(cut));
+    return failed === undefined ? { rows } : { rows, failed };
+}
+function sameRows(a, b) {
+    if (a.length !== b.length) {
+        return false;
+    }
+    const x = [...a].sort();
+    const y = [...b].sort();
+    return x.every((line, i) => line === y[i]);
+}
+/** The first row that only one of the two runs has, to show why a source was dropped. */
+function firstDifference(a, b) {
+    const inA = new Set(a);
+    const inB = new Set(b);
+    return a.find((line) => !inB.has(line)) ?? b.find((line) => !inA.has(line)) ?? '';
+}
+export function quietSources(sources, reference, again) {
+    const kept = [];
+    const dropped = [];
+    const time = new RegExp(TIME_PATTERN, 'g');
+    for (const source of sources) {
+        const a = rowsOf(reference, source.label);
+        const b = rowsOf(again, source.label);
+        const failed = a.failed ?? b.failed;
+        if (failed !== undefined) {
+            dropped.push({ label: source.label, reason: failed });
+            continue;
+        }
+        if (sameRows(a.rows, b.rows)) {
+            kept.push(source);
+            continue;
+        }
+        const untimed = (rows) => rows.map((r) => r.replace(time, ''));
+        if (StateSourceKind.COMMAND === source.kind && sameRows(untimed(a.rows), untimed(b.rows))) {
+            kept.push({ ...source, ignore: [...(source.ignore ?? []), TIME_PATTERN] });
+            continue;
+        }
+        dropped.push({
+            label: source.label,
+            reason: `it changes between two runs of the same steps: ${firstDifference(a.rows, b.rows)}`,
+        });
+    }
+    return { sources: kept, dropped };
+}

package/dist/features/license/license.d.ts

@@ -1,14 +1,9 @@
 /**
- * Enterprise license-key verification + the assertEnterprise gate. ENTERPRISE CODE (Reticle Enterprise
- * License — see./LICENSE), not the FSL that covers the rest of the server.
+ * License-key verification for `reticle license` and the telemetry `licenseStatus` field.
  *
- * Offline + no phone-home (preserves the no-telemetry brand): a key is a signed payload Reticle issues
- * with its private key; this verifies it against the issuer's PUBLIC key with Ed25519. Dev/eval is a
- * no-op (requireLicense:false) so the gate never gets in a contributor's way; only a production-mode
- * caller with requireLicense:true must present a valid, unexpired key. The clock is injected (rule 7).
- *
- * Rules for this directory: the free server must never import from ee/; ee/ depends only on protocol +
- * node + zod. This file imports neither server core nor any sibling outside ee/.
+ * Offline, with no phone-home: a key is a signed payload that Reticle issues with its private key.
+ * This file verifies it against the issuer's PUBLIC key with Ed25519. Nothing in this package is
+ * gated on a key. The clock is injected (rule 7).
  */
 import { type KeyObject } from 'node:crypto';
 import { z } from 'zod';
@@ -23,8 +18,8 @@ export declare const LicenseStatus: {
 };
 export type LicenseStatus = (typeof LicenseStatus)[keyof typeof LicenseStatus];
 /**
- * The signed claims inside a key. `exp` is epoch ms; `features` (optional) scopes which ee features
- * unlock.
+ * The signed claims inside a key. `exp` is epoch ms; `features` (optional) scopes the features that
+ * the key covers.
  *
  * `lid` is the stable licence id and the only safe identity: `org` is a display name a human typed at
  * signing time, so two organisations with the same name collapse into one and a rename splits one into
@@ -61,48 +56,14 @@ export declare function signLicenseKey(payload: LicensePayload, privateKey: KeyO
 /** Verify a key against the issuer public key. Never throws — returns a structured status. */
 export declare function verifyLicenseKey(key: string | undefined, publicKey: KeyObject, now: number): LicenseCheck;
 /**
- * Where to get a key. A named constant because it appears in the gate's error AND in what
- * `reticle license` prints, and a contact address that drifts between the two is a support request
- * that reaches nobody.
+ * Where to get a key. A named constant because `reticle license` prints it on every branch, and a
+ * contact address that drifts is a support request that reaches nobody.
  */
 export declare const LICENSE_CONTACT = "hey@reticle.sh";
-/**
- * The features a licence gates in THIS build. The single source: `assertEnterprise` callers name a
- * member rather than a string literal, and `reticle license` reports the list, so what the CLI claims
- * is gated is derived from what is actually gated rather than a second list somebody maintains.
- *
- * It is deliberately short. Reticle's roadmap for enterprise is longer (SSO, SCIM, RBAC, multi-org,
- * policy gates), and none of it is here yet — printing a roadmap as though it were shipped is how a
- * buyer discovers on day two that the thing they paid for does not exist. What is listed is what the
- * running build will actually refuse without a key.
- */
-export declare const EnterpriseFeature: {
-    /** Recording an audit event. */
-    readonly AUDIT_LOG: "audit-log";
-};
-export type EnterpriseFeature = (typeof EnterpriseFeature)[keyof typeof EnterpriseFeature];
-/** Thrown when a production-mode enterprise feature is used without a valid license. */
-export declare class EnterpriseLicenseError extends Error {
-    readonly feature: string;
-    readonly reason: string;
-    constructor(feature: string, reason: string);
-}
-/** Context for the gate. requireLicense:false ⇒ dev/eval no-op. publicKey injectable for tests. */
-export interface GateContext {
-    requireLicense: boolean;
-    now: () => number;
-    key?: string;
-    publicKey?: KeyObject;
-}
-/**
- * Gate an enterprise feature. No-op in dev/eval (requireLicense:false). In production it throws
- * EnterpriseLicenseError unless a valid, unexpired key that covers `feature` is present.
- */
-export declare function assertEnterprise(feature: string, ctx: GateContext, env?: NodeJS.ProcessEnv, baked?: string): void;
 /** Env names that carry the activation: the operator's key, and the issuer public key baked at release. */
 export declare const LICENSE_KEY_ENV = "RETICLE_LICENSE_KEY";
 export declare const LICENSE_PUBLIC_KEY_ENV = "RETICLE_LICENSE_PUBLIC_KEY";
-/** The human-facing state of enterprise activation on this machine (what `reticle license status` shows). */
+/** The human-facing state of license activation on this machine (what `reticle license` shows). */
 interface LicenseReport {
     /**
      * Typed against core's closed list rather than re-listing the strings here: this status is reported
@@ -112,18 +73,7 @@ interface LicenseReport {
     status: LicenseActivation;
     /** The stable license id — what usage is attributed to. Present only when `status` is `active`. */
     licenseId?: string;
-    /**
-     * What a licence unlocks in this build, reported alongside where to get one — being told to set a
-     * variable with no idea what it unlocks is a dead end at the moment somebody is asking. Omitted
-     * once a licence is `active`, where the reader already has it.
-     */
-    gated?: readonly string[];
     contact: string;
-    /**
-     * The key is valid, and scoped to features this build does not gate, so it unlocks nothing here.
-     * Present only when true: a `false` on every healthy licence is noise on the common case.
-     */
-    coversNothingHere?: boolean;
     org?: string;
     plan?: string;
     expiresAt?: number;
@@ -132,18 +82,8 @@ interface LicenseReport {
 }
 /**
  * Resolve activation entirely from the environment — the install mechanism: the release bakes the
- * issuer public key, the operator sets RETICLE_LICENSE_KEY. No public key configured ⇒ evaluation mode
- * (enterprise features run free, dev/test only). Offline, no phone-home.
+ * issuer public key, the operator sets RETICLE_LICENSE_KEY. No public key configured ⇒ evaluation mode.
+ * Offline, no phone-home.
  */
 export declare function describeLicense(now: number, env?: NodeJS.ProcessEnv, baked?: string): LicenseReport;
-/**
- * Gate an enterprise feature using env-resolved activation. Enforcement is ON when the issuer public key
- * is configured (a real release). Without it, behaviour splits on runtime:
- *  - dev/eval (NODE_ENV ≠ production): features run FREE — never blocks a contributor or CI.
- *  - production (NODE_ENV = production): FAIL CLOSED — a release that reaches production with no
- *    resolvable issuer key was mis-built (the baked key wasn't stamped in, BAKED_ISSUER_PUBLIC_KEY_PEM
- *    is still ''), and silently unlocking every ee feature with no key and no warning is the worst
- *    outcome. Deny instead, with a distinct reason so the misconfiguration is obvious.
- */
-export declare function assertEnterpriseFromEnv(feature: string, now: number, env?: NodeJS.ProcessEnv, baked?: string): void;
 export {};

package/dist/features/license/license.js

@@ -1,14 +1,9 @@
 /**
- * Enterprise license-key verification + the assertEnterprise gate. ENTERPRISE CODE (Reticle Enterprise
- * License — see./LICENSE), not the FSL that covers the rest of the server.
+ * License-key verification for `reticle license` and the telemetry `licenseStatus` field.
  *
- * Offline + no phone-home (preserves the no-telemetry brand): a key is a signed payload Reticle issues
- * with its private key; this verifies it against the issuer's PUBLIC key with Ed25519. Dev/eval is a
- * no-op (requireLicense:false) so the gate never gets in a contributor's way; only a production-mode
- * caller with requireLicense:true must present a valid, unexpired key. The clock is injected (rule 7).
- *
- * Rules for this directory: the free server must never import from ee/; ee/ depends only on protocol +
- * node + zod. This file imports neither server core nor any sibling outside ee/.
+ * Offline, with no phone-home: a key is a signed payload that Reticle issues with its private key.
+ * This file verifies it against the issuer's PUBLIC key with Ed25519. Nothing in this package is
+ * gated on a key. The clock is injected (rule 7).
  */
 import { createPublicKey, sign as edSign, verify as edVerify } from 'node:crypto';
 import { z } from 'zod';
@@ -22,8 +17,8 @@ export const LicenseStatus = {
     EXPIRED: 'expired',
 };
 /**
- * The signed claims inside a key. `exp` is epoch ms; `features` (optional) scopes which ee features
- * unlock.
+ * The signed claims inside a key. `exp` is epoch ms; `features` (optional) scopes the features that
+ * the key covers.
  *
  * `lid` is the stable licence id and the only safe identity: `org` is a display name a human typed at
  * signing time, so two organisations with the same name collapse into one and a rename splits one into
@@ -48,8 +43,9 @@ export function signLicenseKey(payload, privateKey) {
 }
 /** Verify a key against the issuer public key. Never throws — returns a structured status. */
 export function verifyLicenseKey(key, publicKey, now) {
-    if (key === undefined || 0 === key.length)
+    if (key === undefined || 0 === key.length) {
         return { status: LicenseStatus.MISSING };
+    }
     const parts = key.split(KEY_SEP);
     if (parts.length !== 2 ||
         parts[0] === undefined ||
@@ -62,8 +58,9 @@ export function verifyLicenseKey(key, publicKey, now) {
     try {
         json = Buffer.from(parts[0], 'base64url').toString('utf8');
         const parsed = LicensePayloadSchema.safeParse(JSON.parse(json));
-        if (!parsed.success)
+        if (!parsed.success) {
             return { status: LicenseStatus.MALFORMED };
+        }
         payload = parsed.data;
     }
     catch {
@@ -76,98 +73,45 @@ export function verifyLicenseKey(key, publicKey, now) {
     catch {
         return { status: LicenseStatus.BAD_SIGNATURE };
     }
-    if (!signatureOk)
+    if (!signatureOk) {
         return { status: LicenseStatus.BAD_SIGNATURE };
-    if (payload.exp <= now)
+    }
+    if (payload.exp <= now) {
         return { status: LicenseStatus.EXPIRED, payload };
+    }
     return { status: LicenseStatus.VALID, payload };
 }
 /**
- * Where to get a key. A named constant because it appears in the gate's error AND in what
- * `reticle license` prints, and a contact address that drifts between the two is a support request
- * that reaches nobody.
+ * Where to get a key. A named constant because `reticle license` prints it on every branch, and a
+ * contact address that drifts is a support request that reaches nobody.
  */
 export const LICENSE_CONTACT = 'hey@reticle.sh';
-/**
- * The features a licence gates in THIS build. The single source: `assertEnterprise` callers name a
- * member rather than a string literal, and `reticle license` reports the list, so what the CLI claims
- * is gated is derived from what is actually gated rather than a second list somebody maintains.
- *
- * It is deliberately short. Reticle's roadmap for enterprise is longer (SSO, SCIM, RBAC, multi-org,
- * policy gates), and none of it is here yet — printing a roadmap as though it were shipped is how a
- * buyer discovers on day two that the thing they paid for does not exist. What is listed is what the
- * running build will actually refuse without a key.
- */
-export const EnterpriseFeature = {
-    /** Recording an audit event. */
-    AUDIT_LOG: 'audit-log',
-};
-/** Thrown when a production-mode enterprise feature is used without a valid license. */
-export class EnterpriseLicenseError extends Error {
-    feature;
-    reason;
-    constructor(feature, reason) {
-        super(`Reticle Enterprise feature "${feature}" requires a valid license (${reason}). Contact ${LICENSE_CONTACT}.`);
-        this.name = 'EnterpriseLicenseError';
-        this.feature = feature;
-        this.reason = reason;
-    }
-}
-/**
- * Gate an enterprise feature. No-op in dev/eval (requireLicense:false). In production it throws
- * EnterpriseLicenseError unless a valid, unexpired key that covers `feature` is present.
- */
-export function assertEnterprise(feature, ctx, env = process.env, baked) {
-    if (!ctx.requireLicense)
-        return;
-    // Resolved exactly as the env-entry point resolves it: BAKED first, env only as the dev/test
-    // hatch. Reading the environment alone denies every valid licence on a real release, where the key
-    // is baked and no env var is set. Two gates, one truth.
-    const publicKey = ctx.publicKey ?? loadPublicKey(resolveIssuerPublicKeyPem(env, baked));
-    if (publicKey === undefined)
-        throw new EnterpriseLicenseError(feature, 'no-issuer-key');
-    const check = verifyLicenseKey(ctx.key, publicKey, ctx.now());
-    if (check.status !== LicenseStatus.VALID)
-        throw new EnterpriseLicenseError(feature, check.status);
-    const { features } = check.payload;
-    if (features !== undefined && !features.includes(feature)) {
-        throw new EnterpriseLicenseError(feature, 'feature-not-licensed');
-    }
-}
 /** Env names that carry the activation: the operator's key, and the issuer public key baked at release. */
 export const LICENSE_KEY_ENV = 'RETICLE_LICENSE_KEY';
 export const LICENSE_PUBLIC_KEY_ENV = 'RETICLE_LICENSE_PUBLIC_KEY';
 /**
  * Issuer public key COMPILED INTO the build. Empty in the source tree; the release pipeline replaces
- * this literal with the real spki PEM. Baking it (rather than only reading env) is what makes the
- * enterprise gate fail closed: a self-hosted operator can no longer disable enforcement by simply
- * never setting RETICLE_LICENSE_PUBLIC_KEY, because the baked key takes precedence. The public key is
- * safe to ship openly — it can only verify licenses, never mint them (that needs the private key).
+ * this literal with the real spki PEM. The baked key takes precedence over RETICLE_LICENSE_PUBLIC_KEY,
+ * so an operator cannot swap in a key of their own. The public key is safe to ship openly: it can
+ * only verify licenses, never mint them (that needs the private key).
  */
 const BAKED_ISSUER_PUBLIC_KEY_PEM = "-----BEGIN PUBLIC KEY-----\nMCowBQYDK2VwAyEAcg+u61Fs5pwDHcYxFGhaxVaQoUbAdyl+RUdSViZyxDY=\n-----END PUBLIC KEY-----";
 /**
- * Resolve the issuer public-key PEM enforcement uses: the baked-in release key wins, so it can't be
- * turned off from the environment. Only when nothing is baked (dev/repo) does the env var apply — that
+ * Resolve the issuer public-key PEM: the baked-in release key wins, so the environment cannot
+ * replace it. Only when nothing is baked (dev/repo) does the env var apply — that
  * env path is the test/self-eval escape hatch, not the production switch.
  */
 function resolveIssuerPublicKeyPem(env, baked = BAKED_ISSUER_PUBLIC_KEY_PEM) {
-    if (baked.length > 0)
+    if (baked.length > 0) {
         return baked;
+    }
     const envPem = env[LICENSE_PUBLIC_KEY_ENV];
     return envPem !== undefined && envPem.length > 0 ? envPem : undefined;
 }
-/**
- * The two fields every report carries, spread into each branch. One object rather than a field on each
- * return, because the value that must never go missing is the one on the branch nobody was thinking
- * about — and the branch an unlicensed reader lands on is exactly that branch.
- */
-const LICENSE_OFFER = {
-    gated: Object.values(EnterpriseFeature),
-    contact: LICENSE_CONTACT,
-};
 function loadPublicKey(pem) {
-    if (pem === undefined || 0 === pem.length)
+    if (pem === undefined || 0 === pem.length) {
         return undefined;
+    }
     try {
         return createPublicKey(pem);
     }
@@ -177,111 +121,74 @@ function loadPublicKey(pem) {
 }
 /**
  * Resolve activation entirely from the environment — the install mechanism: the release bakes the
- * issuer public key, the operator sets RETICLE_LICENSE_KEY. No public key configured ⇒ evaluation mode
- * (enterprise features run free, dev/test only). Offline, no phone-home.
+ * issuer public key, the operator sets RETICLE_LICENSE_KEY. No public key configured ⇒ evaluation mode.
+ * Offline, no phone-home.
  */
 export function describeLicense(now, env = process.env, baked = BAKED_ISSUER_PUBLIC_KEY_PEM) {
     const pem = resolveIssuerPublicKeyPem(env, baked);
     if (pem === undefined || 0 === pem.length) {
-        // In a production runtime this is NOT a benign eval session — it is a mis-built release whose gate
-        // is off, and assertEnterpriseFromEnv now denies rather than unlocking. Say so loudly here too.
+        // In a production runtime this is NOT a benign eval session: it is a mis-built release. Say so.
         return isProductionEnv(env)
             ? {
-                ...LICENSE_OFFER,
+                contact: LICENSE_CONTACT,
                 status: LicenseActivation.INVALID,
-                detail: 'MISCONFIGURED — running in production with no issuer key baked; enterprise features are DENIED (rebuild with BAKED_ISSUER_PUBLIC_KEY_PEM stamped in)',
+                detail: 'MISCONFIGURED — running in production with no issuer key baked (rebuild with BAKED_ISSUER_PUBLIC_KEY_PEM stamped in)',
             }
             : {
-                ...LICENSE_OFFER,
+                contact: LICENSE_CONTACT,
                 status: LicenseActivation.EVAL,
-                detail: 'evaluation mode: enterprise features run free (no issuer key configured)',
+                detail: 'evaluation mode (no issuer key configured)',
             };
     }
     const publicKey = loadPublicKey(pem);
-    if (publicKey === undefined)
+    if (publicKey === undefined) {
         return {
-            ...LICENSE_OFFER,
+            contact: LICENSE_CONTACT,
             status: LicenseActivation.INVALID,
             detail: `${LICENSE_PUBLIC_KEY_ENV} is not a valid public key`,
         };
+    }
     const check = verifyLicenseKey(env[LICENSE_KEY_ENV], publicKey, now);
     if (check.status === LicenseStatus.VALID) {
         const { lid, org, plan, exp, features } = check.payload;
-        // A key scoped to features this build does not gate is `active` and unlocks nothing. Both halves
-        // were already on screen (`features` against `gated`) and nothing joined them, so the one word a
-        // customer actually reads told them they were fine while every gated call refused them.
-        const coversNothingHere = features !== undefined && !features.some((f) => LICENSE_OFFER.gated.includes(f));
-        const detail = coversNothingHere
-            ? `licensed to ${org} (${plan}), expires ${new Date(exp).toISOString()}. This key covers ${features?.join(', ')}, and nothing this build gates (${LICENSE_OFFER.gated.join(', ')}) is included. Contact ${LICENSE_CONTACT}`
-            : `licensed to ${org} (${plan}), expires ${new Date(exp).toISOString()}`;
         return {
             contact: LICENSE_CONTACT,
-            // The one active case that still needs the list: a key covering nothing this build gates is
-            // reported here, and the sentence explaining it is unreadable without both sides named.
-            ...(coversNothingHere ? { gated: LICENSE_OFFER.gated } : {}),
             status: LicenseActivation.ACTIVE,
             licenseId: lid,
             org,
             plan,
             expiresAt: exp,
             ...(features !== undefined ? { features } : {}),
-            ...(coversNothingHere ? { coversNothingHere } : {}),
-            detail,
+            detail: `licensed to ${org} (${plan}), expires ${new Date(exp).toISOString()}`,
         };
     }
     if (check.status === LicenseStatus.MISSING) {
         return {
-            ...LICENSE_OFFER,
+            contact: LICENSE_CONTACT,
             status: LicenseActivation.MISSING,
-            detail: `set ${LICENSE_KEY_ENV} to activate enterprise features in production. ` +
-                `Request a key from ${LICENSE_CONTACT}`,
+            detail: `set ${LICENSE_KEY_ENV} to activate a license. Request a key from ${LICENSE_CONTACT}`,
         };
     }
     if (check.status === LicenseStatus.EXPIRED) {
         // The id rides an expired key so the lapse can be identified; without it an expiry is
         // indistinguishable from any other.
         return {
-            ...LICENSE_OFFER,
+            contact: LICENSE_CONTACT,
             status: LicenseActivation.EXPIRED,
             licenseId: check.payload.lid,
             org: check.payload.org,
             expiresAt: check.payload.exp,
-            detail: `license expired. Renew with ${LICENSE_CONTACT} to keep using enterprise features`,
+            detail: `license expired. Renew with ${LICENSE_CONTACT}`,
         };
     }
     return {
-        ...LICENSE_OFFER,
+        contact: LICENSE_CONTACT,
         status: LicenseActivation.INVALID,
         detail: `license key rejected (${check.status}). ${LICENSE_CONTACT} can re-issue it`,
     };
 }
-/** True in a production runtime (NODE_ENV=production) — where a missing issuer key is a mis-built
- *  release, not an eval session, so the gate must fail CLOSED rather than run features free. */
+/** True in a production runtime (NODE_ENV=production), where a missing issuer key is a mis-built
+ *  release, not an eval session. */
 function isProductionEnv(env) {
     return 'production' === env['NODE_ENV'];
 }
-/**
- * Gate an enterprise feature using env-resolved activation. Enforcement is ON when the issuer public key
- * is configured (a real release). Without it, behaviour splits on runtime:
- *  - dev/eval (NODE_ENV ≠ production): features run FREE — never blocks a contributor or CI.
- *  - production (NODE_ENV = production): FAIL CLOSED — a release that reaches production with no
- *    resolvable issuer key was mis-built (the baked key wasn't stamped in, BAKED_ISSUER_PUBLIC_KEY_PEM
- *    is still ''), and silently unlocking every ee feature with no key and no warning is the worst
- *    outcome. Deny instead, with a distinct reason so the misconfiguration is obvious.
- */
-export function assertEnterpriseFromEnv(feature, now, env = process.env, baked = BAKED_ISSUER_PUBLIC_KEY_PEM) {
-    const publicKey = loadPublicKey(resolveIssuerPublicKeyPem(env, baked));
-    if (publicKey === undefined) {
-        if (isProductionEnv(env)) {
-            throw new EnterpriseLicenseError(feature, 'enterprise-gate-unconfigured');
-        }
-        return; // dev/eval — free
-    }
-    const key = env[LICENSE_KEY_ENV];
-    assertEnterprise(feature, {
-        requireLicense: true,
-        now: () => now,
-        ...(key !== undefined ? { key } : {}),
-        publicKey,
-    });
-}