@revealui/core 0.2.1 → 0.5.0

package/dist/instance/methods/hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../../../src/instance/methods/hooks.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,qBAAqB,EACrB,cAAc,EACd,iBAAiB,EAEjB,gBAAgB,EACjB,MAAM,sBAAsB,CAAA;AAE7B;;GAEG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE,qBAAqB,EAAE,GAAG,SAAS,EAC1C,IAAI,EAAE;IACJ,GAAG,EAAE,cAAc,CAAA;IACnB,OAAO,EAAE,iBAAiB,CAAA;CAC3B,EACD,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAAC,cAAc,CAAC,CA0BzB"}
+{"version":3,"file":"hooks.d.ts","sourceRoot":"","sources":["../../../src/instance/methods/hooks.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,qBAAqB,EACrB,cAAc,EACd,iBAAiB,EAEjB,gBAAgB,EACjB,MAAM,sBAAsB,CAAC;AAE9B;;GAEG;AACH,wBAAsB,SAAS,CAC7B,KAAK,EAAE,qBAAqB,EAAE,GAAG,SAAS,EAC1C,IAAI,EAAE;IACJ,GAAG,EAAE,cAAc,CAAC;IACpB,OAAO,EAAE,iBAAiB,CAAC;CAC5B,EACD,QAAQ,EAAE,gBAAgB,GACzB,OAAO,CAAC,cAAc,CAAC,CA0BzB"}

package/dist/instance/methods/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../src/instance/methods/update.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAIjG,wBAAsB,MAAM,CAC1B,QAAQ,EAAE,gBAAgB,EAC1B,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EACtC,OAAO,EAAE,mBAAmB,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GACpD,OAAO,CAAC,cAAc,CAAC,CAgDzB"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../src/instance/methods/update.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAGlG,wBAAsB,MAAM,CAC1B,QAAQ,EAAE,gBAAgB,EAC1B,iBAAiB,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EACtC,OAAO,EAAE,mBAAmB,GAAG;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GACpD,OAAO,CAAC,cAAc,CAAC,CA6CzB"}

package/dist/instance/methods/update.js

@@ -3,13 +3,10 @@
  *
  * Updates an existing document in a collection with hook handling.
  */
-import { validateJWTFromRequest } from '../../utils/jwt-validation.js';
 import { callHooks } from './hooks.js';
 export async function update(instance, ensureDbConnected, options) {
     await ensureDbConnected();
     const { collection, req } = options;
-    // Validate JWT token if authorization header is provided
-    await validateJWTFromRequest(req);
     if (!instance.collections[collection]) {
         throw new Error(`Collection '${collection}' not found`);
     }

package/dist/jobs/index.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Background Job Queue
+ *
+ * PostgreSQL-backed job queue using raw SQL for portability.
+ * No external dependencies (no Redis, no pg-boss).
+ *
+ * Usage:
+ *   import { createJobQueue } from '@revealui/core/jobs';
+ *
+ *   const queue = createJobQueue(dbExecutor);
+ *   await queue.send('email.send', { to: 'user@example.com', subject: '...' });
+ *   queue.work('email.send', async (job) => { await sendEmail(job.data); });
+ */
+export type { DatabaseExecutor, JobHandler, JobPayload, JobQueue, JobQueueConfig, SendOptions, } from './queue.js';
+export { createJobQueue } from './queue.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/jobs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/jobs/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,YAAY,EACV,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,QAAQ,EACR,cAAc,EACd,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC"}

package/dist/jobs/index.js

@@ -0,0 +1,14 @@
+/**
+ * Background Job Queue
+ *
+ * PostgreSQL-backed job queue using raw SQL for portability.
+ * No external dependencies (no Redis, no pg-boss).
+ *
+ * Usage:
+ *   import { createJobQueue } from '@revealui/core/jobs';
+ *
+ *   const queue = createJobQueue(dbExecutor);
+ *   await queue.send('email.send', { to: 'user@example.com', subject: '...' });
+ *   queue.work('email.send', async (job) => { await sendEmail(job.data); });
+ */
+export { createJobQueue } from './queue.js';

package/dist/jobs/queue.d.ts

@@ -0,0 +1,57 @@
+/**
+ * PostgreSQL-backed Job Queue
+ *
+ * Uses raw SQL via a database executor for portability.
+ * Supports: delayed jobs, retries with exponential backoff, priorities, expiration.
+ *
+ * The jobs table must exist (see packages/db/src/schema/jobs.ts).
+ */
+/** Minimal database executor — accepts raw SQL strings */
+export interface DatabaseExecutor {
+    execute(query: string, params?: unknown[]): Promise<{
+        rows: Record<string, unknown>[];
+    }>;
+}
+export interface JobQueueConfig {
+    /** Polling interval in milliseconds (default: 5000) */
+    pollingIntervalMs: number;
+    /** Maximum concurrent jobs per worker (default: 5) */
+    concurrency: number;
+    /** Default retry limit for jobs without explicit limit (default: 3) */
+    defaultRetryLimit: number;
+    /** Base delay for exponential backoff in ms (default: 1000) */
+    retryBackoffMs: number;
+    /** Logger with error method */
+    logger?: {
+        error: (msg: string) => void;
+    };
+}
+export interface SendOptions {
+    /** Higher priority = processed first (default: 0) */
+    priority?: number;
+    /** Maximum retry attempts (default: config.defaultRetryLimit) */
+    retryLimit?: number;
+    /** Delay before first processing (Date or milliseconds from now) */
+    startAfter?: Date | number;
+    /** Job expires at this time (unprocessed jobs are skipped) */
+    expireAt?: Date;
+}
+export interface JobPayload {
+    id: string;
+    name: string;
+    data: Record<string, unknown>;
+    retryCount: number;
+}
+export type JobHandler = (job: JobPayload) => Promise<void>;
+export interface JobQueue {
+    /** Enqueue a job for background processing */
+    send(name: string, data: Record<string, unknown>, options?: SendOptions): Promise<string>;
+    /** Register a handler for a job type and start polling */
+    work(name: string, handler: JobHandler): void;
+    /** Stop all polling workers */
+    stop(): void;
+    /** Get counts by state for monitoring */
+    getQueueStats(): Promise<Record<string, number>>;
+}
+export declare function createJobQueue(executor: DatabaseExecutor, overrides?: Partial<JobQueueConfig>): JobQueue;
+//# sourceMappingURL=queue.d.ts.map

package/dist/jobs/queue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"queue.d.ts","sourceRoot":"","sources":["../../src/jobs/queue.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC/B,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAA;KAAE,CAAC,CAAC;CAC1F;AAED,MAAM,WAAW,cAAc;IAC7B,uDAAuD;IACvD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,sDAAsD;IACtD,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,+DAA+D;IAC/D,cAAc,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,MAAM,CAAC,EAAE;QAAE,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;CAC3C;AASD,MAAM,WAAW,WAAW;IAC1B,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,UAAU,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;IAC3B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAE5D,MAAM,WAAW,QAAQ;IACvB,8CAA8C;IAC9C,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1F,0DAA0D;IAC1D,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,IAAI,CAAC;IAC9C,+BAA+B;IAC/B,IAAI,IAAI,IAAI,CAAC;IACb,yCAAyC;IACzC,aAAa,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CAClD;AAMD,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,gBAAgB,EAC1B,SAAS,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAClC,QAAQ,CAwJV"}

package/dist/jobs/queue.js

@@ -0,0 +1,134 @@
+/**
+ * PostgreSQL-backed Job Queue
+ *
+ * Uses raw SQL via a database executor for portability.
+ * Supports: delayed jobs, retries with exponential backoff, priorities, expiration.
+ *
+ * The jobs table must exist (see packages/db/src/schema/jobs.ts).
+ */
+const DEFAULT_CONFIG = {
+    pollingIntervalMs: 5000,
+    concurrency: 5,
+    defaultRetryLimit: 3,
+    retryBackoffMs: 1000,
+};
+// =============================================================================
+// Implementation
+// =============================================================================
+export function createJobQueue(executor, overrides) {
+    const config = { ...DEFAULT_CONFIG, ...overrides };
+    const timers = [];
+    const activeJobs = new Set();
+    let stopped = false;
+    async function send(name, data, options) {
+        const id = crypto.randomUUID();
+        let startAfter = new Date();
+        if (options?.startAfter instanceof Date) {
+            startAfter = options.startAfter;
+        }
+        else if (typeof options?.startAfter === 'number') {
+            startAfter = new Date(Date.now() + options.startAfter);
+        }
+        await executor.execute(`INSERT INTO jobs (id, name, data, state, priority, retry_limit, start_after, expire_at, created_at)
+       VALUES ($1, $2, $3, 'created', $4, $5, $6, $7, NOW())`, [
+            id,
+            name,
+            JSON.stringify(data),
+            options?.priority ?? 0,
+            options?.retryLimit ?? config.defaultRetryLimit,
+            startAfter.toISOString(),
+            options?.expireAt?.toISOString() ?? null,
+        ]);
+        return id;
+    }
+    /**
+     * Atomically claim the next available job using FOR UPDATE SKIP LOCKED.
+     */
+    async function fetchNextJob(name) {
+        const result = await executor.execute(`UPDATE jobs
+       SET state = 'active', started_at = NOW()
+       WHERE id = (
+         SELECT id FROM jobs
+         WHERE name = $1
+           AND state IN ('created', 'retry')
+           AND start_after <= NOW()
+           AND (expire_at IS NULL OR expire_at > NOW())
+         ORDER BY priority DESC, created_at ASC
+         LIMIT 1
+         FOR UPDATE SKIP LOCKED
+       )
+       RETURNING id, name, data, retry_count`, [name]);
+        const row = result.rows[0];
+        if (!row)
+            return null;
+        return {
+            id: row.id,
+            name: row.name,
+            data: (typeof row.data === 'string' ? JSON.parse(row.data) : row.data),
+            retryCount: row.retry_count ?? 0,
+        };
+    }
+    async function completeJob(id) {
+        await executor.execute(`UPDATE jobs SET state = 'completed', completed_at = NOW() WHERE id = $1`, [id]);
+    }
+    async function failJob(id, retryCount, retryLimit, error) {
+        if (retryCount + 1 < retryLimit) {
+            const delay = config.retryBackoffMs * 2 ** retryCount;
+            const nextRetry = new Date(Date.now() + delay);
+            await executor.execute(`UPDATE jobs SET state = 'retry', retry_count = $1, start_after = $2, output = $3 WHERE id = $4`, [retryCount + 1, nextRetry.toISOString(), JSON.stringify({ error }), id]);
+        }
+        else {
+            await executor.execute(`UPDATE jobs SET state = 'failed', retry_count = $1, completed_at = NOW(), output = $2 WHERE id = $3`, [retryCount + 1, JSON.stringify({ error }), id]);
+        }
+    }
+    async function poll(name, handler) {
+        if (stopped)
+            return;
+        if (activeJobs.size >= config.concurrency)
+            return;
+        try {
+            const job = await fetchNextJob(name);
+            if (!job)
+                return;
+            activeJobs.add(job.id);
+            try {
+                await handler(job);
+                await completeJob(job.id);
+            }
+            catch (err) {
+                const errorMsg = err instanceof Error ? err.message : String(err);
+                config.logger?.error(`Job ${name}/${job.id} failed: ${errorMsg}`);
+                await failJob(job.id, job.retryCount, config.defaultRetryLimit, errorMsg);
+            }
+            finally {
+                activeJobs.delete(job.id);
+            }
+        }
+        catch (err) {
+            config.logger?.error(`Job queue poll error for ${name}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    function work(name, handler) {
+        const timer = setInterval(() => {
+            void poll(name, handler);
+        }, config.pollingIntervalMs);
+        timers.push(timer);
+        void poll(name, handler);
+    }
+    function stop() {
+        stopped = true;
+        for (const timer of timers) {
+            clearInterval(timer);
+        }
+        timers.length = 0;
+    }
+    async function getQueueStats() {
+        const result = await executor.execute(`SELECT state, count(*)::int as count FROM jobs GROUP BY state`);
+        const stats = {};
+        for (const row of result.rows) {
+            stats[row.state] = row.count;
+        }
+        return stats;
+    }
+    return { send, work, stop, getQueueStats };
+}

package/dist/license-encryption.d.ts

@@ -0,0 +1,21 @@
+/**
+ * AES-256-GCM encryption for license keys at rest.
+ *
+ * Format: enc:<iv-hex>:<ciphertext-hex>:<auth-tag-hex>
+ * Falls back to plaintext when REVEALUI_LICENSE_ENCRYPTION_KEY is not set.
+ */
+/**
+ * Encrypt a plaintext license key.
+ * Returns `enc:<iv>:<ciphertext>:<tag>` or the original plaintext if no key is configured.
+ */
+export declare function encryptLicenseKey(plaintext: string): string;
+/**
+ * Decrypt a license key.
+ * If the value doesn't start with `enc:`, returns it as-is (plaintext fallback).
+ */
+export declare function decryptLicenseKey(stored: string): string;
+/**
+ * Check whether a stored license key value is encrypted.
+ */
+export declare function isEncryptedLicenseKey(value: string): boolean;
+//# sourceMappingURL=license-encryption.d.ts.map

package/dist/license-encryption.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"license-encryption.d.ts","sourceRoot":"","sources":["../src/license-encryption.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAyBH;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAW3D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CA+BxD;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE5D"}

package/dist/license-encryption.js

@@ -0,0 +1,74 @@
+/**
+ * AES-256-GCM encryption for license keys at rest.
+ *
+ * Format: enc:<iv-hex>:<ciphertext-hex>:<auth-tag-hex>
+ * Falls back to plaintext when REVEALUI_LICENSE_ENCRYPTION_KEY is not set.
+ */
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from 'node:crypto';
+const ENC_PREFIX = 'enc:';
+const ALGORITHM = 'aes-256-gcm';
+const IV_BYTES = 12;
+/**
+ * Derives a 32-byte key from the env var value.
+ * Accepts either a 64-char hex string or an arbitrary passphrase (hashed to 32 bytes).
+ */
+function deriveKey(raw) {
+    if (/^[0-9a-f]{64}$/i.test(raw)) {
+        return Buffer.from(raw, 'hex');
+    }
+    return createHash('sha256').update(raw).digest();
+}
+function getEncryptionKey() {
+    const raw = process.env.REVEALUI_LICENSE_ENCRYPTION_KEY;
+    if (!raw)
+        return null;
+    return deriveKey(raw);
+}
+/**
+ * Encrypt a plaintext license key.
+ * Returns `enc:<iv>:<ciphertext>:<tag>` or the original plaintext if no key is configured.
+ */
+export function encryptLicenseKey(plaintext) {
+    const key = getEncryptionKey();
+    if (!key)
+        return plaintext;
+    const iv = randomBytes(IV_BYTES);
+    const cipher = createCipheriv(ALGORITHM, key, iv);
+    const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+    const tag = cipher.getAuthTag();
+    return `${ENC_PREFIX}${iv.toString('hex')}:${encrypted.toString('hex')}:${tag.toString('hex')}`;
+}
+/**
+ * Decrypt a license key.
+ * If the value doesn't start with `enc:`, returns it as-is (plaintext fallback).
+ */
+export function decryptLicenseKey(stored) {
+    if (!stored.startsWith(ENC_PREFIX)) {
+        return stored; // plaintext — backward compatible
+    }
+    const key = getEncryptionKey();
+    if (!key) {
+        throw new Error('Encrypted license key found but REVEALUI_LICENSE_ENCRYPTION_KEY is not set. ' +
+            'Cannot decrypt without the encryption key.');
+    }
+    const parts = stored.slice(ENC_PREFIX.length).split(':');
+    if (parts.length !== 3) {
+        throw new Error('Malformed encrypted license key — expected enc:<iv>:<ciphertext>:<tag>');
+    }
+    const [ivHex, ciphertextHex, tagHex] = parts;
+    const iv = Buffer.from(ivHex, 'hex');
+    const ciphertext = Buffer.from(ciphertextHex, 'hex');
+    const tag = Buffer.from(tagHex, 'hex');
+    if (iv.length !== IV_BYTES) {
+        throw new Error(`Invalid IV length: expected ${IV_BYTES} bytes, got ${iv.length}`);
+    }
+    const decipher = createDecipheriv(ALGORITHM, key, iv);
+    decipher.setAuthTag(tag);
+    return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');
+}
+/**
+ * Check whether a stored license key value is encrypted.
+ */
+export function isEncryptedLicenseKey(value) {
+    return value.startsWith(ENC_PREFIX);
+}

package/dist/license.d.ts

@@ -24,6 +24,21 @@ declare const licensePayloadSchema: z.ZodObject<{
     exp: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strip>;
 export type LicensePayload = z.infer<typeof licensePayloadSchema>;
+/** License cache TTL configuration */
+export interface LicenseCacheConfig {
+    /** Cache TTL in milliseconds (default: 24 hours) */
+    ttlMs: number;
+}
+/**
+ * Configure the license cache TTL.
+ * Useful for tests (short TTL) or deployments needing faster revocation detection.
+ */
+export declare function configureLicenseCache(overrides: Partial<LicenseCacheConfig>): void;
+/**
+ * Computes a deterministic Key ID (kid) from a public key PEM string.
+ * Returns the first 8 characters of the SHA-256 hex digest of the PEM.
+ */
+export declare function computeKeyId(publicKeyPem: string): string;
 /**
  * Validates a license key JWT and returns the decoded payload.
  * Returns null if the key is invalid, expired, or missing.
@@ -38,11 +53,11 @@ export declare function validateLicenseKey(licenseKey: string, publicKey: string
 export declare function initializeLicense(): Promise<LicenseTier>;
 /**
  * Returns the current license tier.
- * If the license hasn't been initialized, returns 'free'.
+ * If the license hasn't been initialized or the cache has expired, returns 'free'.
  */
 export declare function getCurrentTier(): LicenseTier;
 /**
- * Returns the full license payload, or null if no valid license.
+ * Returns the full license payload, or null if no valid license or cache expired.
  */
 export declare function getLicensePayload(): LicensePayload | null;
 /**
@@ -63,6 +78,12 @@ export declare function getMaxUsers(): number;
  * Track B metering: free=1K, pro=10K, max=50K, enterprise=unlimited.
  */
 export declare function getMaxAgentTasks(): number;
+/**
+ * Returns the maximum free-tier AI sampling tasks per billing cycle.
+ * Free users get 50 cloud AI tasks/month via platform Groq key.
+ * Paid users return 0 (they use full quota via getMaxAgentTasks instead).
+ */
+export declare function getMaxFreemiumTasks(): number;
 /**
  * Generates a signed license key JWT.
  * This is a server-only function — requires the private key.
@@ -71,9 +92,11 @@ export declare function getMaxAgentTasks(): number;
  * @param privateKey - RS256 private key (PEM format)
  * @param expiresInSeconds - JWT expiration in seconds. Pass null for perpetual
  *   licenses (no exp claim). Defaults to 1 year for subscription licenses.
+ * @param publicKey - RS256 public key (PEM format). When provided, a `kid`
+ *   claim is added to the JWT header for forward-compatible key rotation.
  * @returns Signed JWT string
  */
-export declare function generateLicenseKey(payload: Omit<LicensePayload, 'iat' | 'exp'>, privateKey: string, expiresInSeconds?: number | null): Promise<string>;
+export declare function generateLicenseKey(payload: Omit<LicensePayload, 'iat' | 'exp'>, privateKey: string, expiresInSeconds?: number | null, publicKey?: string): Promise<string>;
 /**
  * Reset license state. Primarily for testing.
  */

package/dist/license.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"license.d.ts","sourceRoot":"","sources":["../src/license.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,8BAA8B;AAC9B,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,GAAG,YAAY,CAAA;AAE/D,qCAAqC;AACrC,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;iBAqBxB,CAAA;AAEF,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAA;AA+BjE;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAgBhC;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,WAAW,CAAC,CAuB9D;AAED;;;GAGG;AACH,wBAAgB,cAAc,IAAI,WAAW,CAE5C;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,IAAI,CAEzD;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,YAAY,EAAE,WAAW,GAAG,OAAO,CAoB7D;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAKpC;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAKpC;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAKzC;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,KAAK,CAAC,EAC5C,UAAU,EAAE,MAAM,EAClB,gBAAgB,GAAE,MAAM,GAAG,IAAyB,GACnD,OAAO,CAAC,MAAM,CAAC,CAOjB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAExC"}
+{"version":3,"file":"license.d.ts","sourceRoot":"","sources":["../src/license.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,8BAA8B;AAC9B,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,GAAG,YAAY,CAAC;AAEhE,qCAAqC;AACrC,QAAA,MAAM,oBAAoB;;;;;;;;;;;;;iBAqBxB,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,sCAAsC;AACtC,MAAM,WAAW,kBAAkB;IACjC,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;CACf;AASD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAElF;AAoCD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CA0BhC;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,WAAW,CAAC,CAkC9D;AAaD;;;GAGG;AACH,wBAAgB,cAAc,IAAI,WAAW,CAG5C;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,IAAI,CAGzD;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,YAAY,EAAE,WAAW,GAAG,OAAO,CAqB7D;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAMpC;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAMpC;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAMzC;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAI5C;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,GAAG,KAAK,CAAC,EAC5C,UAAU,EAAE,MAAM,EAClB,gBAAgB,GAAE,MAAM,GAAG,IAAyB,EACpD,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC,CAYjB;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAGxC"}

package/dist/license.js

@@ -5,8 +5,11 @@
  * - jose - JWT token verification (Web Crypto API)
  * - zod - Schema validation for license payloads
  */
-import { importPKCS8, importSPKI, jwtVerify, SignJWT } from 'jose';
+import { createHash } from 'node:crypto';
+import { decodeProtectedHeader, importPKCS8, importSPKI, jwtVerify, SignJWT } from 'jose';
 import { z } from 'zod';
+import { decryptLicenseKey } from './license-encryption.js';
+import { logger } from './utils/logger.js';
 /** Decoded license payload schema */
 const licensePayloadSchema = z.object({
     /** License tier */
@@ -30,6 +33,18 @@ const licensePayloadSchema = z.object({
     /** License expiration timestamp — absent for perpetual licenses */
     exp: z.number().optional(),
 });
+const DEFAULT_CACHE_CONFIG = {
+    ttlMs: 5 * 60 * 1000, // 5 minutes — revoked licenses lose access within 5 min
+};
+let cacheConfig = { ...DEFAULT_CACHE_CONFIG };
+let cachedAt = 0;
+/**
+ * Configure the license cache TTL.
+ * Useful for tests (short TTL) or deployments needing faster revocation detection.
+ */
+export function configureLicenseCache(overrides) {
+    cacheConfig = { ...DEFAULT_CACHE_CONFIG, ...overrides };
+}
 let cachedState = {
     tier: 'free',
     payload: null,
@@ -41,13 +56,26 @@ let cachedState = {
  * For local development, it reads from REVEALUI_LICENSE_PUBLIC_KEY env var.
  */
 function getPublicKey() {
-    return process.env.REVEALUI_LICENSE_PUBLIC_KEY ?? null;
+    const raw = process.env.REVEALUI_LICENSE_PUBLIC_KEY ?? null;
+    // Docker/env files store PEM as single-line with literal \n — restore real newlines
+    return raw ? raw.replace(/\\n/g, '\n') : null;
 }
 /**
  * Reads the license key from environment.
+ * Supports encrypted keys (enc:iv:ciphertext:tag format) via REVEALUI_LICENSE_ENCRYPTION_KEY.
  */
 function getLicenseKey() {
-    return process.env.REVEALUI_LICENSE_KEY ?? null;
+    const raw = process.env.REVEALUI_LICENSE_KEY ?? null;
+    if (!raw)
+        return null;
+    return decryptLicenseKey(raw);
+}
+/**
+ * Computes a deterministic Key ID (kid) from a public key PEM string.
+ * Returns the first 8 characters of the SHA-256 hex digest of the PEM.
+ */
+export function computeKeyId(publicKeyPem) {
+    return createHash('sha256').update(publicKeyPem).digest('hex').slice(0, 8);
 }
 /**
  * Validates a license key JWT and returns the decoded payload.
@@ -55,6 +83,13 @@ function getLicenseKey() {
  */
 export async function validateLicenseKey(licenseKey, publicKey) {
     try {
+        // Extract kid from JWT header for forward-compatible key rotation
+        const header = decodeProtectedHeader(licenseKey);
+        const expectedKid = computeKeyId(publicKey);
+        if (header.kid && header.kid !== expectedKid) {
+            logger.warn(`JWT kid mismatch: token has "${header.kid}", current key is "${expectedKid}". ` +
+                'Token may have been signed with a rotated key.');
+        }
         const key = await importSPKI(publicKey, 'RS256');
         const { payload } = await jwtVerify(licenseKey, key, {
             algorithms: ['RS256', 'ES256'],
@@ -80,11 +115,13 @@ export async function initializeLicense() {
     const publicKey = getPublicKey();
     if (!(licenseKey && publicKey)) {
         cachedState = { tier: 'free', payload: null, validatedAt: Date.now() };
+        cachedAt = Date.now();
         return 'free';
     }
     const payload = await validateLicenseKey(licenseKey, publicKey);
     if (!payload) {
         cachedState = { tier: 'free', payload: null, validatedAt: Date.now() };
+        cachedAt = Date.now();
         return 'free';
     }
     cachedState = {
@@ -92,19 +129,39 @@ export async function initializeLicense() {
         payload,
         validatedAt: Date.now(),
     };
+    cachedAt = Date.now();
+    // Clamp cache TTL to license expiry so revoked licenses don't survive the full TTL
+    if (payload.exp) {
+        const msUntilExpiry = payload.exp * 1000 - Date.now();
+        if (msUntilExpiry > 0 && msUntilExpiry < cacheConfig.ttlMs) {
+            cacheConfig = { ...cacheConfig, ttlMs: msUntilExpiry };
+        }
+    }
     return payload.tier;
 }
+/**
+ * Invalidates the cached license state if it has exceeded the configured TTL.
+ * After invalidation, the license defaults to 'free' until re-initialized.
+ */
+function evictStaleCache() {
+    if (cachedAt > 0 && Date.now() - cachedAt > cacheConfig.ttlMs) {
+        cachedState = { tier: 'free', payload: null, validatedAt: null };
+        cachedAt = 0;
+    }
+}
 /**
  * Returns the current license tier.
- * If the license hasn't been initialized, returns 'free'.
+ * If the license hasn't been initialized or the cache has expired, returns 'free'.
  */
 export function getCurrentTier() {
+    evictStaleCache();
     return cachedState.tier;
 }
 /**
- * Returns the full license payload, or null if no valid license.
+ * Returns the full license payload, or null if no valid license or cache expired.
  */
 export function getLicensePayload() {
+    evictStaleCache();
     return cachedState.payload;
 }
 /**
@@ -112,6 +169,7 @@ export function getLicensePayload() {
  * Also validates that the license has not expired (checks JWT exp claim).
  */
 export function isLicensed(requiredTier) {
+    evictStaleCache();
     const tierRank = {
         free: 0,
         pro: 1,
@@ -134,6 +192,7 @@ export function isLicensed(requiredTier) {
  * Returns the maximum number of sites allowed by the current license.
  */
 export function getMaxSites() {
+    evictStaleCache();
     if (cachedState.tier === 'enterprise')
         return Infinity;
     if (cachedState.tier === 'max')
@@ -146,6 +205,7 @@ export function getMaxSites() {
  * Returns the maximum number of users/editors allowed by the current license.
  */
 export function getMaxUsers() {
+    evictStaleCache();
     if (cachedState.tier === 'enterprise')
         return Infinity;
     if (cachedState.tier === 'max')
@@ -159,6 +219,7 @@ export function getMaxUsers() {
  * Track B metering: free=1K, pro=10K, max=50K, enterprise=unlimited.
  */
 export function getMaxAgentTasks() {
+    evictStaleCache();
     if (cachedState.tier === 'enterprise')
         return Infinity;
     if (cachedState.tier === 'max')
@@ -167,6 +228,17 @@ export function getMaxAgentTasks() {
         return 10_000;
     return 1_000;
 }
+/**
+ * Returns the maximum free-tier AI sampling tasks per billing cycle.
+ * Free users get 50 cloud AI tasks/month via platform Groq key.
+ * Paid users return 0 (they use full quota via getMaxAgentTasks instead).
+ */
+export function getMaxFreemiumTasks() {
+    evictStaleCache();
+    if (cachedState.tier === 'free')
+        return 50;
+    return 0;
+}
 /**
  * Generates a signed license key JWT.
  * This is a server-only function — requires the private key.
@@ -175,11 +247,18 @@ export function getMaxAgentTasks() {
  * @param privateKey - RS256 private key (PEM format)
  * @param expiresInSeconds - JWT expiration in seconds. Pass null for perpetual
  *   licenses (no exp claim). Defaults to 1 year for subscription licenses.
+ * @param publicKey - RS256 public key (PEM format). When provided, a `kid`
+ *   claim is added to the JWT header for forward-compatible key rotation.
  * @returns Signed JWT string
  */
-export async function generateLicenseKey(payload, privateKey, expiresInSeconds = 365 * 24 * 60 * 60) {
+export async function generateLicenseKey(payload, privateKey, expiresInSeconds = 365 * 24 * 60 * 60, publicKey) {
     const key = await importPKCS8(privateKey, 'RS256');
-    const builder = new SignJWT({ ...payload }).setProtectedHeader({ alg: 'RS256' }).setIssuedAt();
+    const kid = publicKey ? computeKeyId(publicKey) : undefined;
+    const header = { alg: 'RS256' };
+    if (kid) {
+        header.kid = kid;
+    }
+    const builder = new SignJWT({ ...payload }).setProtectedHeader(header).setIssuedAt();
     if (expiresInSeconds !== null) {
         builder.setExpirationTime(`${expiresInSeconds}s`);
     }
@@ -190,4 +269,5 @@ export async function generateLicenseKey(payload, privateKey, expiresInSeconds =
  */
 export function resetLicenseState() {
     cachedState = { tier: 'free', payload: null, validatedAt: null };
+    cachedAt = 0;
 }

package/dist/monitoring/alerts.d.ts

@@ -100,14 +100,14 @@ declare class AlertManager {
  * Singleton instance
  */
 export declare const alertManager: AlertManager;
-/**
- * Export AlertManager class for testing
- */
-export { AlertManager };
 /**
  * Export types for testing
  */
 export type { AlertChannel, SentryClient };
+/**
+ * Export AlertManager class for testing
+ */
+export { AlertManager };
 /**
  * Convenience functions
  */

package/dist/monitoring/alerts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"alerts.d.ts","sourceRoot":"","sources":["../../src/monitoring/alerts.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAEvC;;GAEG;AACH,UAAU,YAAY;IACpB,cAAc,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,IAAI,CAAA;IAC5D,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAA;CACjC;AAsCD;;GAEG;AACH,KAAK,YAAY,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAA;AAEnD;;GAEG;AACH,UAAU,WAAW;IACnB,uBAAuB;IACvB,QAAQ,EAAE,YAAY,EAAE,CAAA;IAExB,kFAAkF;IAClF,qBAAqB,EAAE,OAAO,CAAA;IAE9B,2CAA2C;IAC3C,mBAAmB,EAAE,MAAM,CAAA;IAE3B,uCAAuC;IACvC,oBAAoB,EAAE,OAAO,CAAA;CAC9B;AAYD;;GAEG;AACH,cAAM,YAAY;IAChB,OAAO,CAAC,MAAM,CAAa;IAC3B,OAAO,CAAC,UAAU,CAAc;IAChC,OAAO,CAAC,gBAAgB,CAA8B;IACtD,OAAO,CAAC,mBAAmB,CAAI;IAC/B,OAAO,CAAC,YAAY,CAA4B;gBAEpC,MAAM,GAAE,OAAO,CAAC,WAAW,CAAM,EAAE,YAAY,CAAC,EAAE,YAAY,GAAG,IAAI;IAUjF;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI;IAU7B;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI;IAMjC;;OAEG;IACH,OAAO,CAAC,YAAY;IAoBpB;;OAEG;IACH,OAAO,CAAC,YAAY;IAuBpB;;OAEG;IACH,OAAO,CAAC,aAAa;IAYrB;;OAEG;IACH,OAAO,CAAC,YAAY;IAmEpB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAaxB;;OAEG;IACH,OAAO,CAAC,WAAW;IAwCnB;;OAEG;IACH,eAAe,IAAI,IAAI;IAOvB;;OAEG;IACH,OAAO,CAAC,YAAY;IAIpB;;OAEG;IACH,QAAQ,IAAI;QACV,SAAS,EAAE,MAAM,CAAA;QACjB,mBAAmB,EAAE,MAAM,CAAA;QAC3B,kBAAkB,EAAE,OAAO,CAAA;KAC5B;IAQD;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI;IAI3C;;OAEG;IACH,OAAO,IAAI,IAAI;CAIhB;AAED;;GAEG;AACH,eAAO,MAAM,YAAY,cAAqB,CAAA;AAE9C;;GAEG;AACH,OAAO,EAAE,YAAY,EAAE,CAAA;AAEvB;;GAEG;AACH,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,CAAA;AAE1C;;GAEG;AAEH,wBAAgB,SAAS,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAE5C;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAEhD;AAED,wBAAgB,aAAa,IAAI,UAAU,CAAC,OAAO,YAAY,CAAC,QAAQ,CAAC,CAExE;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,CAE/D"}
+{"version":3,"file":"alerts.d.ts","sourceRoot":"","sources":["../../src/monitoring/alerts.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAExC;;GAEG;AACH,UAAU,YAAY;IACpB,cAAc,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC7D,OAAO,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,CAAC;CAClC;AAsCD;;GAEG;AACH,KAAK,YAAY,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEpD;;GAEG;AACH,UAAU,WAAW;IACnB,uBAAuB;IACvB,QAAQ,EAAE,YAAY,EAAE,CAAC;IAEzB,kFAAkF;IAClF,qBAAqB,EAAE,OAAO,CAAC;IAE/B,2CAA2C;IAC3C,mBAAmB,EAAE,MAAM,CAAC;IAE5B,uCAAuC;IACvC,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAYD;;GAEG;AACH,cAAM,YAAY;IAChB,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,UAAU,CAAe;IACjC,OAAO,CAAC,gBAAgB,CAA+B;IACvD,OAAO,CAAC,mBAAmB,CAAK;IAChC,OAAO,CAAC,YAAY,CAA6B;gBAErC,MAAM,GAAE,OAAO,CAAC,WAAW,CAAM,EAAE,YAAY,CAAC,EAAE,YAAY,GAAG,IAAI;IAUjF;;OAEG;IACH,SAAS,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI;IAU7B;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI;IAMjC;;OAEG;IACH,OAAO,CAAC,YAAY;IAoBpB;;OAEG;IACH,OAAO,CAAC,YAAY;IAuBpB;;OAEG;IACH,OAAO,CAAC,aAAa;IAYrB;;OAEG;IACH,OAAO,CAAC,YAAY;IAmEpB;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAaxB;;OAEG;IACH,OAAO,CAAC,WAAW;IAwCnB;;OAEG;IACH,eAAe,IAAI,IAAI;IAOvB;;OAEG;IACH,OAAO,CAAC,YAAY;IAIpB;;OAEG;IACH,QAAQ,IAAI;QACV,SAAS,EAAE,MAAM,CAAC;QAClB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,kBAAkB,EAAE,OAAO,CAAC;KAC7B;IAQD;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI;IAI3C;;OAEG;IACH,OAAO,IAAI,IAAI;CAIhB;AAED;;GAEG;AACH,eAAO,MAAM,YAAY,cAAqB,CAAC;AAE/C;;GAEG;AACH,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,CAAC;AAC3C;;GAEG;AACH,OAAO,EAAE,YAAY,EAAE,CAAC;AAExB;;GAEG;AAEH,wBAAgB,SAAS,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,CAE5C;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAEhD;AAED,wBAAgB,aAAa,IAAI,UAAU,CAAC,OAAO,YAAY,CAAC,QAAQ,CAAC,CAExE;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,CAE/D"}