@sdux-vault/engine 0.4.0 → 0.8.0

package/fesm2022/sdux-vault-engine.mjs

@@ -1,4 +1,4 @@
-import { registerVersion, vaultDebug, ControllerVotes, ControllerMessageTypes, OperationTypes, vaultWarn, VaultController, defineControllerKey, ControllerTypes, DevMode, DecisionOutcomeTypes, vaultError, defineBehaviorKey, DEVTOOLS_LOGGING_KEY_CONSTANT, DEVTOOLS_AGGREGATE_KEY_CONSTANT, createVaultError, EventTypes, EventBoundaryTypes, setVaultLogLevel, isTestEnv, BEHAVIOR_META, validateBehaviorKey, BehaviorTypes, VAULT_STOP, isVaultNoop, VaultPrivateErrorService, isHttpResourceRef, isFunction, isStateInputShape, isolateValue, isVaultClearState, VAULT_CLEAR_STATE, VAULT_NOOP, VAULT_CONTINUE, isVaultContinue, isUndefined, isDefined, isNullish, ResolveTypes, isPromise, VaultUsagePromiseError, CONTROLLER_META, validateControllerKey, VaultLicenseError } from '@sdux-vault/shared';
+import { registerVersion, vaultDebug, ControllerVotes, ControllerMessageTypes, OperationTypes, vaultWarn, VaultController, defineControllerKey, ControllerTypes, DevMode, DecisionOutcomeTypes, vaultError, defineBehaviorKey, DEVTOOLS_LOGGING_KEY_CONSTANT, DEVTOOLS_AGGREGATE_KEY_CONSTANT, createVaultError, EventTypes, EventBoundaryTypes, setVaultLogLevel, isTestEnv, BEHAVIOR_META, validateBehaviorKey, BehaviorTypes, VAULT_STOP, isVaultNoop, VaultLicenseError, VaultBehavior, VaultPrivateErrorService, isHttpResourceRef, isFunction, isStateInputShape, isolateValue, isVaultClearState, VAULT_CLEAR_STATE, VAULT_NOOP, VAULT_CONTINUE, isVaultContinue, isUndefined, isDefined, isNullish, ResolveTypes, isPromise, VaultUsagePromiseError, CONTROLLER_META, validateControllerKey } from '@sdux-vault/shared';
 import { of, map, catchError, forkJoin, Subject, ReplaySubject, isObservable, firstValueFrom, tap } from 'rxjs';
 import { __decorate } from 'tslib';
 import { filter } from 'rxjs/operators';
@@ -11,7 +11,7 @@ import { EventBus, initDevtoolsWidget } from '@sdux-vault/devtools';
 //	 cmd+alt+j (see .vscode/keybindings.json)
 // --- END AI MODEL FILE PATH ---
 const SDUX_PACKAGE = '@sdux-vault/engine';
-const SDUX_VERSION = '0.4.0';
+const SDUX_VERSION = '0.8.0';
 registerVersion(SDUX_PACKAGE, SDUX_VERSION);
 
 /**
@@ -1505,40 +1505,40 @@ const KNOWN_VAULT_KEYS = new Set([
     // ---------------------------------------------------------------------------
     // Core Behaviors (libs/core)
     // ---------------------------------------------------------------------------
+    'SDUX::Behavior::Core::AfterTap',
+    'SDUX::Behavior::Core::ArrayMerge',
+    'SDUX::Behavior::Core::BeforeTap',
+    'SDUX::Behavior::Core::EmitState',
     'SDUX::Behavior::Core::Error',
     'SDUX::Behavior::Core::ErrorCallback',
     'SDUX::Behavior::Core::Filter',
+    'SDUX::Behavior::Core::FromObservable',
+    'SDUX::Behavior::Core::FromPromise',
+    'SDUX::Behavior::Core::FromStream',
+    'SDUX::Behavior::Core::ObjectMerge',
+    'SDUX::Behavior::Core::Observable',
+    'SDUX::Behavior::Core::Promise',
     'SDUX::Behavior::Core::Reducer',
-    'SDUX::Behavior::Core::BeforeTap',
-    'SDUX::Behavior::Core::AfterTap',
-    'SDUX::Behavior::Core::EmitState',
     'SDUX::Behavior::Core::State',
     'SDUX::Behavior::Core::Value',
-    'SDUX::Behavior::Core::Observable',
-    'SDUX::Behavior::Core::Promise',
-    'SDUX::Behavior::Core::FromStream',
-    'SDUX::Behavior::Core::FromPromise',
-    'SDUX::Behavior::Core::FromObservable',
-    'SDUX::Behavior::Core::ObjectMerge',
-    'SDUX::Behavior::Core::ArrayMerge',
     // ---------------------------------------------------------------------------
     // Addon Behaviors (libs/addons)
     // ---------------------------------------------------------------------------
-    'SDUX::Behavior::Persist::SessionStorage',
-    'SDUX::Behavior::Persist::LocalStorage',
-    'SDUX::Behavior::Persist::CookieStorage',
-    'SDUX::Behavior::Encrypt::Aes256',
-    'SDUX::Behavior::Policy::StepwiseFilter',
-    'SDUX::Behavior::Policy::StepwiseReducer',
-    'SDUX::Behavior::Policy::StepwiseResolve',
     'SDUX::Behavior::Addon::DistinctUntilChanged',
+    'SDUX::Behavior::Cache::State',
+    'SDUX::Behavior::Core::Lookup',
+    'SDUX::Behavior::Core::Query',
+    'SDUX::Behavior::Encrypt::Aes256',
     'SDUX::Behavior::Interceptor::GlobalErrorPause',
     'SDUX::Behavior::Merge::ArrayAppend',
     'SDUX::Behavior::Merge::ArrayPush',
     'SDUX::Behavior::Merge::Deep',
-    'SDUX::Behavior::Core::Query',
-    'SDUX::Behavior::Core::Lookup',
-    'SDUX::Behavior::Cache::State',
+    'SDUX::Behavior::Persist::CookieStorage',
+    'SDUX::Behavior::Persist::LocalStorage',
+    'SDUX::Behavior::Persist::SessionStorage',
+    'SDUX::Behavior::Policy::StepwiseFilter',
+    'SDUX::Behavior::Policy::StepwiseReducer',
+    'SDUX::Behavior::Policy::StepwiseResolve',
     // ---------------------------------------------------------------------------
     // Engine Behaviors (vault-engine)
     // ---------------------------------------------------------------------------
@@ -1552,10 +1552,10 @@ const KNOWN_VAULT_KEYS = new Set([
     // ---------------------------------------------------------------------------
     // Addon Controllers (libs/addons)
     // ---------------------------------------------------------------------------
+    'SDUX::Controller::Policy::Delay',
+    'SDUX::Controller::Policy::MaxFailures',
     'SDUX::Controller::Policy::ReplayGlobalError',
     'SDUX::Controller::Policy::Stepwise',
-    'SDUX::Controller::Policy::MaxFailures',
-    'SDUX::Controller::Policy::Delay',
     'SDUX::Controller::Policy::Throttle'
 ]);
 
@@ -1623,7 +1623,7 @@ class VaultCoreInstance {
         this.#vaultConfig = Object.freeze(vaultConfig);
         DevMode.setDevMode(this.#vaultConfig.devMode);
         setVaultLogLevel(this.#vaultConfig.logLevel);
-        this.#bypassLicensing = config.devMode ? (config.bypassLicensing ?? true) : false;
+        this.#bypassLicensing = config.devMode ? (config.bypassLicensing ?? false) : false;
         this.#licenseTimeoutMs = config.licenseTimeoutMs ?? 15_000;
         this.#warnIfAccidentalDevMode();
     }
@@ -2023,8 +2023,6 @@ function isAuthorizedKey(key) {
 function hasVaultLicense() {
     if (!instance)
         return false;
-    if (instance.isBypassLicensing())
-        return true;
     return instance.hasVaultLicense();
 }
 
@@ -2295,6 +2293,210 @@ const assignTraceId = () => {
  */
 const isPipelineTerminal = (current) => isVaultNoop(current) || isSignalStop(current);
 
+/**
+ * The public keys
+ */
+const PublicKeys = {
+    /**
+     * the pro public key
+     */
+    pro: `
+-----BEGIN PUBLIC KEY-----
+-----END PUBLIC KEY-----
+`,
+    /**
+     * the enterprise public key
+     */
+    enterprise: `
+-----BEGIN PUBLIC KEY-----
+-----END PUBLIC KEY-----
+`,
+    /**
+     * the development public key
+     */
+    development: `
+-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6RDckQGY38NrlPq70YfI
+hIpBFmc9baNLS2HIeyKIU2m+Vvnt3AYcQJlQnzmO4ZLDOUkIP+VxAjaSCaUBeTOx
+KDYXAK8ds0xEur0cRV4Kn26jhLveLZVpfVzhkOjJ6I9ggLeh5JRt7kj3NPgKwnSm
+t5DxLh4JPyLfZdBDtW8tU2tCgCfEs2cArrVo/fg7Dei8FJ8w83PDhsKmX5UazSfj
+MC57gkTZ/cZmKBvVoIhnqaWVXcRRL+wZPArIsO801DRiMAhROyQYyC3EKpGLyUc1
+1VSKqdmQLIUE1pt151EnmStB+VOsMzCLZH4TyU7cd1Afs2Siqu947W2w4Qpm5+Y/
+FwIDAQAB
+-----END PUBLIC KEY-----
+`
+};
+
+/**
+ * Static license verification utility used to validate signed license tokens
+ * against tier-specific public keys. Tokens use a dot-separated format:
+ * `base64(payload).base64(signature)`.
+ *
+ * The verification process:
+ *  - Splits the token on `.` to extract the encoded payload and signature
+ *  - Decodes the payload from base64 to determine the license tier
+ *  - Rejects tokens with missing or unrecognized tier
+ *  - Loads the appropriate PEM-encoded public key for the tier
+ *  - Uses `crypto.subtle.verify()` (RSA-SHA256) to validate the signature
+ *    against the raw base64-encoded payload string
+ *
+ * Verification failures return `false` rather than throwing.
+ */
+const VerifyLicenseToken = {
+    /**
+     * Verifies the supplied signed license token using the public key associated
+     * with its declared tier.
+     *
+     * @param token - A dot-separated token in the format
+     * `base64(payload).base64(signature)`.
+     * @returns A promise resolving to `true` if the signature validates;
+     * otherwise `false`.
+     */
+    verify: async (token) => {
+        try {
+            const dotIndex = token.indexOf('.');
+            if (dotIndex === -1) {
+                return false;
+            }
+            const encodedPayload = token.substring(0, dotIndex);
+            const signatureB64 = token.substring(dotIndex + 1);
+            const payloadJson = atob(encodedPayload);
+            const payload = JSON.parse(payloadJson);
+            const signature = Uint8Array.from(atob(signatureB64), (c) => c.charCodeAt(0));
+            const licenseType = payload?.licenseType;
+            if (!licenseType) {
+                return false;
+            }
+            const keyPem = PublicKeys[licenseType];
+            if (!keyPem)
+                return false;
+            const key = await importPublicKey(keyPem);
+            const verified = await crypto.subtle.verify({
+                name: 'RSASSA-PKCS1-v1_5',
+                hash: 'SHA-256'
+            }, key, signature, new TextEncoder().encode(encodedPayload));
+            return verified;
+        }
+        catch {
+            return false;
+        }
+    }
+};
+/**
+ * Imports an RSA public key from PEM format into a WebCrypto `CryptoKey`
+ * configured for signature verification.
+ *
+ * @param pem - A PEM-encoded public key in subjectPublicKeyInfo format.
+ * @returns A promise resolving to a usable verification `CryptoKey`.
+ */
+async function importPublicKey(pem) {
+    const binaryDer = str2ab(pemToDer(pem));
+    return crypto.subtle.importKey('spki', binaryDer, {
+        name: 'RSASSA-PKCS1-v1_5',
+        hash: 'SHA-256'
+    }, false, ['verify']);
+}
+/**
+ * Converts a PEM-encoded public key into its raw DER body.
+ *
+ * @param pem - The PEM string containing header/footer markers.
+ * @returns A base64-decoded DER binary string.
+ */
+function pemToDer(pem) {
+    const b64 = pem.replace(/-----.*KEY-----/g, '').replace(/\s+/g, '');
+    return atob(b64);
+}
+/**
+ * Converts a binary string into an `ArrayBuffer`, suitable for WebCrypto key
+ * import operations.
+ *
+ * @param str - A binary string.
+ * @returns An `ArrayBuffer` containing the same byte values.
+ */
+function str2ab(str) {
+    const buf = new ArrayBuffer(str.length);
+    const arr = new Uint8Array(buf);
+    for (let i = 0; i < str.length; i++)
+        arr[i] = str.charCodeAt(i);
+    return buf;
+}
+
+class LicensingAbstract {
+    static needsLicense;
+    static key;
+    #licenseToken;
+    #featureCellKey;
+    #key;
+    #licenseService;
+    constructor(ctx) {
+        const ctor = this.constructor;
+        if (typeof ctor.key !== 'string' || !ctor.key.trim()) {
+            throw new VaultLicenseError(`LicensingClass requires a static "key". Did you forget @VaultBehavior?`);
+        }
+        this.#licenseService = LicensingService();
+        this.#key = ctor.key;
+        this.#featureCellKey = ctx.featureCellKey;
+        if (ctor.needsLicense) {
+            this.#requestLicense();
+        }
+    }
+    #requestLicense() {
+        this.#licenseToken = this.#licenseService.requestLicense(this.#featureCellKey, this.#key);
+    }
+    validateLicense(valid) {
+        if (!this.#licenseToken) {
+            throw new VaultLicenseError(`validateLicense() called but no license was requested for "${this.#featureCellKey}" and "${this.#key}".`);
+        }
+        this.#licenseService.validateLicense(this.#featureCellKey, this.#key, this.#licenseToken, valid);
+    }
+}
+
+let withCoreLicenseBehavior = class withCoreLicenseBehavior extends LicensingAbstract {
+    behaviorCtx;
+    static type;
+    static key;
+    static critical;
+    static needsLicense;
+    type = BehaviorTypes.CoreLicense;
+    critical = true;
+    key;
+    constructor(key, behaviorCtx) {
+        super(behaviorCtx);
+        this.behaviorCtx = behaviorCtx;
+        this.key = key;
+        this.#performLicenseValidation();
+    }
+    async #performLicenseValidation() {
+        try {
+            const payload = this.behaviorCtx.licensePayload;
+            if (!payload?.token) {
+                this.validateLicense(false);
+                return;
+            }
+            const isValid = await VerifyLicenseToken.verify(payload.token);
+            this.validateLicense(isValid);
+        }
+        catch {
+            this.validateLicense(false);
+        }
+    }
+    destroy() {
+        vaultWarn(`${this.key} - destroy noop`);
+    }
+    reset() {
+        vaultWarn(`${this.key} - reset noop`);
+    }
+};
+withCoreLicenseBehavior = __decorate([
+    VaultBehavior({
+        type: BehaviorTypes.CoreLicense,
+        key: defineBehaviorKey('Core', 'License'),
+        critical: true,
+        needsLicense: true,
+        licenseId: 'sdux-vault'
+    })
+], withCoreLicenseBehavior);
+
 // --- AI Model File Path (DO NOT DELETE) ---
 // FilePath: lib > src > orchestrator > orchestrator.ts
 // Updated: 2026-04-07 16:30
@@ -2436,6 +2638,7 @@ class Orchestrator {
         defaultBehaviors = this.#determineCoreCallbackErrorBehavior(defaultBehaviors, config);
         defaultBehaviors = this.#addDefaultMergeBehavior(defaultBehaviors, config);
         defaultBehaviors = this.#addCoreEmitStateCallbackBehavior(defaultBehaviors, config);
+        defaultBehaviors = this.#addCoreLicenseBehavior(defaultBehaviors);
         return defaultBehaviors;
     }
     #determineCoreCallbackErrorBehavior(behaviors, config) {
@@ -2450,6 +2653,13 @@ class Orchestrator {
         }
         return behaviors;
     }
+    #addCoreLicenseBehavior(behaviors) {
+        behaviors = behaviors?.filter((behavior) => behavior.type !== BehaviorTypes.CoreLicense);
+        if (hasVaultLicense()) {
+            behaviors.push(withCoreLicenseBehavior);
+        }
+        return behaviors;
+    }
     #registerBehaviorsWithVault(behaviors) {
         // eslint-disable-next-line
         const behaviorMetadata = behaviors.map((behavior) => {
@@ -2474,8 +2684,9 @@ class Orchestrator {
                 behavior.type === BehaviorTypes.CoreBeforeTap ||
                 behavior.type === BehaviorTypes.CoreError ||
                 behavior.type === BehaviorTypes.CoreErrorCallback ||
-                behavior.type === BehaviorTypes.CoreState ||
                 behavior.type === BehaviorTypes.CoreEmitState ||
+                behavior.type === BehaviorTypes.CoreLicense ||
+                behavior.type === BehaviorTypes.CoreState ||
                 behavior.type === BehaviorTypes.Filter ||
                 behavior.type === BehaviorTypes.FromObservable ||
                 behavior.type === BehaviorTypes.FromPromise ||
@@ -4084,36 +4295,6 @@ class FeatureCellClass extends FeatureCellBuilder {
     }
 }
 
-class LicensingAbstract {
-    static needsLicense;
-    static key;
-    #licenseToken;
-    #featureCellKey;
-    #key;
-    #licenseService;
-    constructor(ctx) {
-        const ctor = this.constructor;
-        if (typeof ctor.key !== 'string' || !ctor.key.trim()) {
-            throw new VaultLicenseError(`LicensingClass requires a static "key". Did you forget @VaultBehavior?`);
-        }
-        this.#licenseService = LicensingService();
-        this.#key = ctor.key;
-        this.#featureCellKey = ctx.featureCellKey;
-        if (ctor.needsLicense) {
-            this.#requestLicense();
-        }
-    }
-    #requestLicense() {
-        this.#licenseToken = this.#licenseService.requestLicense(this.#featureCellKey, this.#key);
-    }
-    validateLicense(valid) {
-        if (!this.#licenseToken) {
-            throw new VaultLicenseError(`validateLicense() called but no license was requested for "${this.#featureCellKey}" and "${this.#key}".`);
-        }
-        this.#licenseService.validateLicense(this.#featureCellKey, this.#key, this.#licenseToken, valid);
-    }
-}
-
 /**
  * The feature cell tokens map
  */
@@ -4205,5 +4386,5 @@ function resetFeatureCellToken() {
  * Generated bundle index. Do not edit.
  */
 
-export { Conductor, FeatureCellClass, LicensingAbstract, VAULT_LICENSE_ID, VaultCore, createFeatureCellToken, getFeatureCellToken, getLicensePayload, getVaultRegistryForTests, hasVaultLicense, isAuthorizedKey, registerFeatureCell, registerVaultSettled, resetFeatureCellRegistry, resetVaultForTests, vaultAllSettled, vaultSettled };
+export { Conductor, FeatureCellClass, LicensingAbstract, VAULT_LICENSE_ID, VaultCore, createFeatureCellToken, getFeatureCellToken, getLicensePayload, getVaultRegistryForTests, hasVaultLicense, isAuthorizedKey, isPipelineTerminal, registerFeatureCell, registerVaultSettled, resetFeatureCellRegistry, resetVaultForTests, vaultAllSettled, vaultSettled };
 //# sourceMappingURL=sdux-vault-engine.mjs.map