@soulbatical/tetra-core 0.7.0 → 0.8.1

package/dist/shared/billing/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/shared/billing/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACxE,YAAY,EACV,UAAU,EACV,aAAa,EACb,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/shared/billing/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AACxE,YAAY,EACV,UAAU,EACV,aAAa,EACb,YAAY,EACZ,eAAe,EACf,kBAAkB,EAClB,kBAAkB,EAClB,qBAAqB,EACrB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACjE,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/shared/billing/index.js

@@ -21,5 +21,7 @@
  * ```
  */
 export { BillingService } from './BillingService.js';
+export { SeatBillingService } from './SeatBillingService.js';
+export { calculateSeatPrice, seatPriceToCents, DEFAULT_SEAT_TIERS } from './seat-pricing.js';
 export { addBillingRoutes, addBillingWebhookRoutes } from './routes.js';
 //# sourceMappingURL=index.js.map

package/dist/shared/billing/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/shared/billing/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/shared/billing/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC7F,OAAO,EAAE,gBAAgB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC"}

package/dist/shared/billing/seat-pricing.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Seat-based pricing calculator
+ *
+ * Shared logic for per-user pricing with volume discounts and tier minimums.
+ * Used by: website pricing calculator, SeatBillingService, license validation.
+ *
+ * @module @soulbatical/tetra-core/billing
+ */
+export interface SeatTier {
+    /** Minimum users for this tier (inclusive) */
+    min: number;
+    /** Maximum users for this tier (inclusive, Infinity for last tier) */
+    max: number;
+    /** Price per user per month in EUR */
+    pricePerUser: number;
+    /** Minimum monthly charge for this tier (prevents price dips at tier boundary) */
+    minimum: number;
+}
+/** Default Tetra seat pricing tiers */
+export declare const DEFAULT_SEAT_TIERS: SeatTier[];
+export interface SeatPriceResult {
+    /** Total monthly price in EUR */
+    monthlyPrice: number;
+    /** Total yearly price in EUR */
+    yearlyPrice: number;
+    /** Number of free users */
+    freeUsers: number;
+    /** Number of paid users */
+    paidUsers: number;
+    /** Effective price per user (total / users) */
+    effectivePricePerUser: number;
+    /** Which tier the user count falls in */
+    tierIndex: number;
+    /** The tier's listed price per user */
+    tierPricePerUser: number;
+    /** Whether the minimum was applied */
+    minimumApplied: boolean;
+}
+/**
+ * Calculate the monthly price for a given number of seat users.
+ *
+ * Rules:
+ * - First 10 users are free
+ * - Price per user decreases with volume
+ * - Each tier has a minimum monthly charge (prevents price dips at boundary)
+ * - For 1000+ users, the last tier rate applies
+ */
+export declare function calculateSeatPrice(users: number, tiers?: SeatTier[]): SeatPriceResult;
+/**
+ * Convert seat price to Stripe-compatible amount in cents.
+ */
+export declare function seatPriceToCents(monthlyPrice: number): number;
+//# sourceMappingURL=seat-pricing.d.ts.map

package/dist/shared/billing/seat-pricing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seat-pricing.d.ts","sourceRoot":"","sources":["../../../src/shared/billing/seat-pricing.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,WAAW,QAAQ;IACvB,8CAA8C;IAC9C,GAAG,EAAE,MAAM,CAAC;IACZ,sEAAsE;IACtE,GAAG,EAAE,MAAM,CAAC;IACZ,sCAAsC;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,uCAAuC;AACvC,eAAO,MAAM,kBAAkB,EAAE,QAAQ,EAMxC,CAAC;AAEF,MAAM,WAAW,eAAe;IAC9B,iCAAiC;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,gCAAgC;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,2BAA2B;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,2BAA2B;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,qBAAqB,EAAE,MAAM,CAAC;IAC9B,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,gBAAgB,EAAE,MAAM,CAAC;IACzB,sCAAsC;IACtC,cAAc,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,KAAK,GAAE,QAAQ,EAAuB,GACrC,eAAe,CAuDjB;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAE7D"}

package/dist/shared/billing/seat-pricing.js

@@ -0,0 +1,81 @@
+/**
+ * Seat-based pricing calculator
+ *
+ * Shared logic for per-user pricing with volume discounts and tier minimums.
+ * Used by: website pricing calculator, SeatBillingService, license validation.
+ *
+ * @module @soulbatical/tetra-core/billing
+ */
+/** Default Tetra seat pricing tiers */
+export const DEFAULT_SEAT_TIERS = [
+    { min: 1, max: 10, pricePerUser: 0, minimum: 0 },
+    { min: 11, max: 100, pricePerUser: 3.90, minimum: 0 },
+    { min: 101, max: 250, pricePerUser: 2.90, minimum: 351 },
+    { min: 251, max: 500, pricePerUser: 1.90, minimum: 725 },
+    { min: 501, max: 1000, pricePerUser: 0.90, minimum: 950 },
+];
+/**
+ * Calculate the monthly price for a given number of seat users.
+ *
+ * Rules:
+ * - First 10 users are free
+ * - Price per user decreases with volume
+ * - Each tier has a minimum monthly charge (prevents price dips at boundary)
+ * - For 1000+ users, the last tier rate applies
+ */
+export function calculateSeatPrice(users, tiers = DEFAULT_SEAT_TIERS) {
+    if (users <= 0) {
+        return {
+            monthlyPrice: 0,
+            yearlyPrice: 0,
+            freeUsers: 0,
+            paidUsers: 0,
+            effectivePricePerUser: 0,
+            tierIndex: 0,
+            tierPricePerUser: 0,
+            minimumApplied: false,
+        };
+    }
+    // Find the tier
+    let tierIndex = 0;
+    let tierPricePerUser = 0;
+    for (let i = 0; i < tiers.length; i++) {
+        if (users >= tiers[i].min && users <= tiers[i].max) {
+            tierIndex = i;
+            tierPricePerUser = tiers[i].pricePerUser;
+            break;
+        }
+    }
+    // Beyond last tier: use last tier's rate
+    if (users > tiers[tiers.length - 1].max) {
+        const lastTier = tiers[tiers.length - 1];
+        tierIndex = tiers.length - 1;
+        tierPricePerUser = lastTier.pricePerUser;
+    }
+    const tier = tiers[tierIndex];
+    const freeUsers = Math.min(users, tiers[0].max);
+    const paidUsers = Math.max(0, users - tiers[0].max);
+    // Calculate raw price
+    const rawPrice = users * tierPricePerUser;
+    // Apply minimum
+    const minimum = tier?.minimum ?? 0;
+    const minimumApplied = rawPrice < minimum && minimum > 0;
+    const monthlyPrice = Math.max(rawPrice, minimum);
+    return {
+        monthlyPrice: Math.round(monthlyPrice * 100) / 100,
+        yearlyPrice: Math.round(monthlyPrice * 12 * 100) / 100,
+        freeUsers,
+        paidUsers,
+        effectivePricePerUser: users > 0 ? Math.round((monthlyPrice / users) * 100) / 100 : 0,
+        tierIndex,
+        tierPricePerUser,
+        minimumApplied,
+    };
+}
+/**
+ * Convert seat price to Stripe-compatible amount in cents.
+ */
+export function seatPriceToCents(monthlyPrice) {
+    return Math.round(monthlyPrice * 100);
+}
+//# sourceMappingURL=seat-pricing.js.map

package/dist/shared/billing/seat-pricing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seat-pricing.js","sourceRoot":"","sources":["../../../src/shared/billing/seat-pricing.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAaH,uCAAuC;AACvC,MAAM,CAAC,MAAM,kBAAkB,GAAe;IAC5C,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE;IAChD,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE;IACrD,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE;IACxD,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE;IACxD,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE;CAC1D,CAAC;AAqBF;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,QAAoB,kBAAkB;IAEtC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACf,OAAO;YACL,YAAY,EAAE,CAAC;YACf,WAAW,EAAE,CAAC;YACd,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,CAAC;YACZ,qBAAqB,EAAE,CAAC;YACxB,SAAS,EAAE,CAAC;YACZ,gBAAgB,EAAE,CAAC;YACnB,cAAc,EAAE,KAAK;SACtB,CAAC;IACJ,CAAC;IAED,gBAAgB;IAChB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,gBAAgB,GAAG,CAAC,CAAC;IAEzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YACnD,SAAS,GAAG,CAAC,CAAC;YACd,gBAAgB,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;YACzC,MAAM;QACR,CAAC;IACH,CAAC;IAED,yCAAyC;IACzC,IAAI,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACzC,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAC7B,gBAAgB,GAAG,QAAQ,CAAC,YAAY,CAAC;IAC3C,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAEpD,sBAAsB;IACtB,MAAM,QAAQ,GAAG,KAAK,GAAG,gBAAgB,CAAC;IAE1C,gBAAgB;IAChB,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,CAAC,CAAC;IACnC,MAAM,cAAc,GAAG,QAAQ,GAAG,OAAO,IAAI,OAAO,GAAG,CAAC,CAAC;IACzD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAEjD,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,GAAG,CAAC,GAAG,GAAG;QAClD,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,EAAE,GAAG,GAAG,CAAC,GAAG,GAAG;QACtD,SAAS;QACT,SAAS;QACT,qBAAqB,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,YAAY,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACrF,SAAS;QACT,gBAAgB;QAChB,cAAc;KACf,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,YAAoB;IACnD,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,GAAG,CAAC,CAAC;AACxC,CAAC"}

package/dist/shared/email/index.d.ts

@@ -10,6 +10,6 @@ export { addEmailAdminRoutes } from './adminRoutes.js';
 export { addMailgunWebhookRoutes } from './webhookRoutes.js';
 export { GmailClient, getGmailClient, listGmailAccounts, clearGmailClientCache, disconnectGmail, getGmailAuthUrl, startGmailOAuth, getGmailAuthServerStatus, resetGmailAuthServerState, exchangeGmailCode, addGmailOAuthRoutes, } from './gmail.js';
 export type { GmailTokens, GmailSendOptions, GmailSendResult, GmailSearchResult, GmailMessageSummary, GmailMessage, GmailMessagePart, GmailMessageHeader, GmailAttachmentInfo, GmailProfile, GmailOAuthConfig, GmailAuthServerStatus, GmailOAuthRoutesConfig, } from './gmail.js';
-export { escapeHtml } from './sanitize.js';
+export { escapeHtml, stripCRLF, sanitizeEmailHeader, stripHtml } from './sanitize.js';
 export type { EmailAttachment, EmailConfig, SendEmailOpts, EmailTemplate, EmailLogEntry, MailgunResponse, SmtpResponse, EmailSendResponse, } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/shared/email/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/shared/email/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAG7D,OAAO,EACL,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,eAAe,EACf,wBAAwB,EACxB,yBAAyB,EACzB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAG3C,YAAY,EACV,eAAe,EACf,WAAW,EACX,aAAa,EACb,aAAa,EACb,aAAa,EACb,eAAe,EACf,YAAY,EACZ,iBAAiB,GAClB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/shared/email/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAG1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAG7D,OAAO,EACL,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,eAAe,EACf,wBAAwB,EACxB,yBAAyB,EACzB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,iBAAiB,EACjB,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGtF,YAAY,EACV,eAAe,EACf,WAAW,EACX,aAAa,EACb,aAAa,EACb,aAAa,EACb,eAAe,EACf,YAAY,EACZ,iBAAiB,GAClB,MAAM,YAAY,CAAC"}

package/dist/shared/email/index.js

@@ -14,5 +14,5 @@ export { addMailgunWebhookRoutes } from './webhookRoutes.js';
 // Gmail (OAuth2 API transport + client for read/search/attachments)
 export { GmailClient, getGmailClient, listGmailAccounts, clearGmailClientCache, disconnectGmail, getGmailAuthUrl, startGmailOAuth, getGmailAuthServerStatus, resetGmailAuthServerState, exchangeGmailCode, addGmailOAuthRoutes, } from './gmail.js';
 // Sanitization
-export { escapeHtml } from './sanitize.js';
+export { escapeHtml, stripCRLF, sanitizeEmailHeader, stripHtml } from './sanitize.js';
 //# sourceMappingURL=index.js.map

package/dist/shared/email/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/shared/email/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,UAAU;AACV,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,oBAAoB;AACpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,kBAAkB;AAClB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,oEAAoE;AACpE,OAAO,EACL,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,eAAe,EACf,wBAAwB,EACxB,yBAAyB,EACzB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAiBpB,eAAe;AACf,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/shared/email/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,UAAU;AACV,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEjD,oBAAoB;AACpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE1C,kBAAkB;AAClB,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,oEAAoE;AACpE,OAAO,EACL,WAAW,EACX,cAAc,EACd,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,eAAe,EACf,wBAAwB,EACxB,yBAAyB,EACzB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,YAAY,CAAC;AAiBpB,eAAe;AACf,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,mBAAmB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC"}

package/dist/shared/email/sanitize.d.ts

@@ -8,4 +8,18 @@
  * Handles all OWASP-recommended characters: & < > " '
  */
 export declare function escapeHtml(str: string, maxLen?: number): string;
+/**
+ * Strip CRLF characters to prevent SMTP header injection.
+ * Use on ALL email header fields: to, from, subject, cc, bcc, reply-to.
+ */
+export declare function stripCRLF(str: string): string;
+/**
+ * Sanitize an email header field: strip CRLF + trim + length limit.
+ * Combines SMTP injection prevention with basic hygiene.
+ */
+export declare function sanitizeEmailHeader(str: string, maxLen?: number): string;
+/**
+ * Strip all HTML tags from a string. Use for user input that should be plain text.
+ */
+export declare function stripHtml(str: string): string;
 //# sourceMappingURL=sanitize.d.ts.map

package/dist/shared/email/sanitize.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../../src/shared/email/sanitize.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;GAGG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,SAAM,GAAG,MAAM,CAQ5D"}
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../../src/shared/email/sanitize.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;GAGG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,SAAM,GAAG,MAAM,CAQ5D;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,SAAM,GAAG,MAAM,CAErE;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7C"}

package/dist/shared/email/sanitize.js

@@ -16,4 +16,24 @@ export function escapeHtml(str, maxLen = 500) {
         .replace(/"/g, '"')
         .replace(/'/g, ''');
 }
+/**
+ * Strip CRLF characters to prevent SMTP header injection.
+ * Use on ALL email header fields: to, from, subject, cc, bcc, reply-to.
+ */
+export function stripCRLF(str) {
+    return str.replace(/[\r\n]/g, '');
+}
+/**
+ * Sanitize an email header field: strip CRLF + trim + length limit.
+ * Combines SMTP injection prevention with basic hygiene.
+ */
+export function sanitizeEmailHeader(str, maxLen = 200) {
+    return stripCRLF(str).trim().slice(0, maxLen);
+}
+/**
+ * Strip all HTML tags from a string. Use for user input that should be plain text.
+ */
+export function stripHtml(str) {
+    return str.replace(/<[^>]*>/g, '');
+}
 //# sourceMappingURL=sanitize.js.map

package/dist/shared/email/sanitize.js.map

@@ -1 +1 @@
-{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../../src/shared/email/sanitize.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,MAAM,GAAG,GAAG;IAClD,OAAO,GAAG;SACP,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC;SAChB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC"}
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../../src/shared/email/sanitize.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW,EAAE,MAAM,GAAG,GAAG;IAClD,OAAO,GAAG;SACP,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC;SAChB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,OAAO,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,MAAM,GAAG,GAAG;IAC3D,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,OAAO,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACrC,CAAC"}

package/dist/shared/license/constants.d.ts

@@ -11,17 +11,19 @@ export declare const PLAN_HIERARCHY: Record<string, number>;
 export declare const EXPIRY_WARNING_DAYS = 30;
 /** Separator between HMAC and payload in the license key */
 export declare const KEY_SEPARATOR = ".";
-/** HMAC algorithm */
-export declare const HMAC_ALGORITHM = "sha256";
-/** Length of the HMAC hex digest */
-export declare const HMAC_LENGTH = 64;
+/** Hash algorithm for integrity check */
+export declare const HASH_ALGORITHM = "sha256";
+/** Length of the hash hex digest */
+export declare const HASH_LENGTH = 64;
 /**
- * Signing secret — embedded in the package.
+ * License integrity model (MUI X style).
  *
- * This is NOT a security mechanism. Like MUI X and AG Grid, the license system
- * relies on legal compliance, not technical protection. The key is self-validating
- * and the algorithm is public. This secret simply prevents casual key forging
- * while keeping validation 100% offline.
+ * The hash is simply sha256(payload) — no secret key involved.
+ * This is an INTEGRITY check, not a security mechanism.
+ * Like MUI X and AG Grid, the license system relies on legal compliance,
+ * not technical protection. Anyone can generate a valid key.
+ *
+ * The value is in the ongoing updates, support, and legal right to use —
+ * not in preventing key generation.
  */
-export declare const SIGNING_SECRET = "tetra-license-v1-soulbatical-bv-2026";
 //# sourceMappingURL=constants.d.ts.map

package/dist/shared/license/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/shared/license/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,4FAA4F;AAC5F,eAAO,MAAM,WAAW,IAAI,CAAC;AAE7B,oDAAoD;AACpD,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAIjD,CAAC;AAEF,mDAAmD;AACnD,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC,4DAA4D;AAC5D,eAAO,MAAM,aAAa,MAAM,CAAC;AAEjC,qBAAqB;AACrB,eAAO,MAAM,cAAc,WAAW,CAAC;AAEvC,oCAAoC;AACpC,eAAO,MAAM,WAAW,KAAK,CAAC;AAE9B;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,yCAAyC,CAAC"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/shared/license/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,4FAA4F;AAC5F,eAAO,MAAM,WAAW,IAAI,CAAC;AAE7B,oDAAoD;AACpD,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAIjD,CAAC;AAEF,mDAAmD;AACnD,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC,4DAA4D;AAC5D,eAAO,MAAM,aAAa,MAAM,CAAC;AAEjC,yCAAyC;AACzC,eAAO,MAAM,cAAc,WAAW,CAAC;AAEvC,oCAAoC;AACpC,eAAO,MAAM,WAAW,KAAK,CAAC;AAE9B;;;;;;;;;;GAUG"}

package/dist/shared/license/constants.js

@@ -15,17 +15,19 @@ export const PLAN_HIERARCHY = {
 export const EXPIRY_WARNING_DAYS = 30;
 /** Separator between HMAC and payload in the license key */
 export const KEY_SEPARATOR = '.';
-/** HMAC algorithm */
-export const HMAC_ALGORITHM = 'sha256';
-/** Length of the HMAC hex digest */
-export const HMAC_LENGTH = 64; // sha256 = 32 bytes = 64 hex chars
+/** Hash algorithm for integrity check */
+export const HASH_ALGORITHM = 'sha256';
+/** Length of the hash hex digest */
+export const HASH_LENGTH = 64; // sha256 = 32 bytes = 64 hex chars
 /**
- * Signing secret — embedded in the package.
+ * License integrity model (MUI X style).
  *
- * This is NOT a security mechanism. Like MUI X and AG Grid, the license system
- * relies on legal compliance, not technical protection. The key is self-validating
- * and the algorithm is public. This secret simply prevents casual key forging
- * while keeping validation 100% offline.
+ * The hash is simply sha256(payload) — no secret key involved.
+ * This is an INTEGRITY check, not a security mechanism.
+ * Like MUI X and AG Grid, the license system relies on legal compliance,
+ * not technical protection. Anyone can generate a valid key.
+ *
+ * The value is in the ongoing updates, support, and legal right to use —
+ * not in preventing key generation.
  */
-export const SIGNING_SECRET = 'tetra-license-v1-soulbatical-bv-2026';
 //# sourceMappingURL=constants.js.map

package/dist/shared/license/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/shared/license/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,4FAA4F;AAC5F,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC;AAE7B,oDAAoD;AACpD,MAAM,CAAC,MAAM,cAAc,GAA2B;IACpD,OAAO,EAAE,CAAC;IACV,GAAG,EAAE,CAAC;IACN,UAAU,EAAE,CAAC;CACd,CAAC;AAEF,mDAAmD;AACnD,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAEtC,4DAA4D;AAC5D,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,CAAC;AAEjC,qBAAqB;AACrB,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC;AAEvC,oCAAoC;AACpC,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC,CAAC,mCAAmC;AAElE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,sCAAsC,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/shared/license/constants.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,4FAA4F;AAC5F,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC;AAE7B,oDAAoD;AACpD,MAAM,CAAC,MAAM,cAAc,GAA2B;IACpD,OAAO,EAAE,CAAC;IACV,GAAG,EAAE,CAAC;IACN,UAAU,EAAE,CAAC;CACd,CAAC;AAEF,mDAAmD;AACnD,MAAM,CAAC,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAEtC,4DAA4D;AAC5D,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,CAAC;AAEjC,yCAAyC;AACzC,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC;AAEvC,oCAAoC;AACpC,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,CAAC,CAAC,mCAAmC;AAElE;;;;;;;;;;GAUG"}

package/dist/shared/license/generator.d.ts

@@ -1,11 +1,14 @@
 /**
- * License Key Generator
+ * License Key Generator & Decoder
  *
  * Generates self-validating license keys with embedded metadata.
- * Format: {HMAC_HEX}.{BASE64_PAYLOAD}
+ * Format: {SHA256_HEX}{BASE64_PAYLOAD} (no separator, first 64 chars = hash)
  *
- * The HMAC ensures integrity (not security — the signing secret is embedded
- * in the package source, just like MUI X and AG Grid).
+ * Integrity model (MUI X style): hash = sha256(payload), no secret key.
+ * This is legal protection, not technical protection.
+ *
+ * NOTE: generateLicenseKey is exported for internal/admin use only.
+ * Consumer projects should never need to generate keys — they only validate.
  *
  * @module @soulbatical/tetra-core/license
  */
@@ -33,11 +36,11 @@ export interface GenerateKeyOptions {
 /**
  * Generate a license key.
  *
- * @returns The license key string: {HMAC}.{BASE64_PAYLOAD}
+ * @returns The license key string: {SHA256_HASH}{BASE64_PAYLOAD}
  */
 export declare function generateLicenseKey(options: GenerateKeyOptions): string;
 /**
- * Decode a license key without validating.
+ * Decode a license key without validating the hash.
  * Returns null if the key format is invalid.
  */
 export declare function decodeLicenseKey(key: string): LicensePayload | null;

package/dist/shared/license/generator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../../../src/shared/license/generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAG5F,MAAM,WAAW,kBAAkB;IACjC,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB;IAChB,IAAI,EAAE,WAAW,CAAC;IAClB,iDAAiD;IACjD,KAAK,CAAC,EAAE,YAAY,EAAE,CAAC;IACvB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,mDAAmD;IACnD,UAAU,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sDAAsD;IACtD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,CA0BtE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAkBnE"}
+{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../../../src/shared/license/generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAG5F,MAAM,WAAW,kBAAkB;IACjC,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB;IAChB,IAAI,EAAE,WAAW,CAAC;IAClB,iDAAiD;IACjD,KAAK,CAAC,EAAE,YAAY,EAAE,CAAC;IACvB,6CAA6C;IAC7C,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,mDAAmD;IACnD,UAAU,EAAE,MAAM,CAAC;IACnB,qDAAqD;IACrD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sDAAsD;IACtD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,kBAAkB,GAAG,MAAM,CA0BtE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAiBnE"}

package/dist/shared/license/generator.js

@@ -1,20 +1,23 @@
 /**
- * License Key Generator
+ * License Key Generator & Decoder
  *
  * Generates self-validating license keys with embedded metadata.
- * Format: {HMAC_HEX}.{BASE64_PAYLOAD}
+ * Format: {SHA256_HEX}{BASE64_PAYLOAD} (no separator, first 64 chars = hash)
  *
- * The HMAC ensures integrity (not security — the signing secret is embedded
- * in the package source, just like MUI X and AG Grid).
+ * Integrity model (MUI X style): hash = sha256(payload), no secret key.
+ * This is legal protection, not technical protection.
+ *
+ * NOTE: generateLicenseKey is exported for internal/admin use only.
+ * Consumer projects should never need to generate keys — they only validate.
  *
  * @module @soulbatical/tetra-core/license
  */
 import crypto from 'node:crypto';
-import { KEY_VERSION, KEY_SEPARATOR, HMAC_ALGORITHM, SIGNING_SECRET } from './constants.js';
+import { KEY_VERSION, HASH_ALGORITHM, HASH_LENGTH } from './constants.js';
 /**
  * Generate a license key.
  *
- * @returns The license key string: {HMAC}.{BASE64_PAYLOAD}
+ * @returns The license key string: {SHA256_HASH}{BASE64_PAYLOAD}
  */
 export function generateLicenseKey(options) {
     const payload = {
@@ -34,22 +37,21 @@ export function generateLicenseKey(options) {
         throw new Error(`Invalid expiry date: ${options.expiryDate}`);
     }
     const payloadBase64 = Buffer.from(JSON.stringify(payload)).toString('base64url');
-    const hmac = crypto
-        .createHmac(HMAC_ALGORITHM, SIGNING_SECRET)
+    const hash = crypto
+        .createHash(HASH_ALGORITHM)
         .update(payloadBase64)
         .digest('hex');
-    return `${hmac}${KEY_SEPARATOR}${payloadBase64}`;
+    return `${hash}${payloadBase64}`;
 }
 /**
- * Decode a license key without validating.
+ * Decode a license key without validating the hash.
  * Returns null if the key format is invalid.
  */
 export function decodeLicenseKey(key) {
     try {
-        const separatorIndex = key.indexOf(KEY_SEPARATOR);
-        if (separatorIndex === -1)
+        if (key.length <= HASH_LENGTH)
             return null;
-        const payloadBase64 = key.slice(separatorIndex + 1);
+        const payloadBase64 = key.slice(HASH_LENGTH);
         const json = Buffer.from(payloadBase64, 'base64url').toString('utf8');
         const payload = JSON.parse(json);
         // Basic shape validation

package/dist/shared/license/generator.js.map

@@ -1 +1 @@
-{"version":3,"file":"generator.js","sourceRoot":"","sources":["../../../src/shared/license/generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAuB5F;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA2B;IAC5D,MAAM,OAAO,GAAmB;QAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;QACtC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,WAAW;QACnC,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;QAC9C,UAAU,EAAE,WAAW;QACvB,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,IAAI,IAAI,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;QACvF,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,IAAI,IAAI,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC;QACjF,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,IAAI,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;KAC5E,CAAC;IAEF,yCAAyC;IACzC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACjF,MAAM,IAAI,GAAG,MAAM;SAChB,UAAU,CAAC,cAAc,EAAE,cAAc,CAAC;SAC1C,MAAM,CAAC,aAAa,CAAC;SACrB,MAAM,CAAC,KAAK,CAAC,CAAC;IAEjB,OAAO,GAAG,IAAI,GAAG,aAAa,GAAG,aAAa,EAAE,CAAC;AACnD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAClD,IAAI,cAAc,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAEvC,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;QAEnD,yBAAyB;QACzB,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YAChF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"generator.js","sourceRoot":"","sources":["../../../src/shared/license/generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAuB1E;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA2B;IAC5D,MAAM,OAAO,GAAmB;QAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;QACtC,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,WAAW;QACnC,MAAM,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;QAC9C,UAAU,EAAE,WAAW;QACvB,GAAG,CAAC,OAAO,CAAC,gBAAgB,IAAI,IAAI,IAAI,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;QACvF,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,IAAI,IAAI,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC;QACjF,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,IAAI,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC;KAC5E,CAAC;IAEF,yCAAyC;IACzC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACjF,MAAM,IAAI,GAAG,MAAM;SAChB,UAAU,CAAC,cAAc,CAAC;SAC1B,MAAM,CAAC,aAAa,CAAC;SACrB,MAAM,CAAC,KAAK,CAAC,CAAC;IAEjB,OAAO,GAAG,IAAI,GAAG,aAAa,EAAE,CAAC;AACnC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,IAAI,WAAW;YAAE,OAAO,IAAI,CAAC;QAE3C,MAAM,aAAa,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAC;QAEnD,yBAAyB;QACzB,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;YAChF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/shared/license/index.d.ts

@@ -2,8 +2,8 @@
  * License Module — Barrel Export
  *
  * Offline license key validation for Tetra Pro features.
- * Like MUI X and AG Grid: HMAC integrity check, self-validating keys,
- * zero network calls. Security relies on legal compliance, not technical protection.
+ * Integrity check via sha256 hash (MUI X model), self-validating keys,
+ * zero network calls. Legal compliance, not technical protection.
  *
  * @module @soulbatical/tetra-core/license
  */

package/dist/shared/license/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/shared/license/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,YAAY,EACV,WAAW,EACX,YAAY,EACZ,cAAc,EACd,cAAc,EACd,uBAAuB,EACvB,YAAY,EACZ,WAAW,EACX,aAAa,GACd,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACtE,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGzD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAG9G,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/shared/license/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,YAAY,EACV,WAAW,EACX,YAAY,EACZ,cAAc,EACd,cAAc,EACd,uBAAuB,EACvB,YAAY,EACZ,WAAW,EACX,aAAa,GACd,MAAM,YAAY,CAAC;AAIpB,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACtE,YAAY,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGzD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAG9G,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/shared/license/index.js

@@ -2,12 +2,13 @@
  * License Module — Barrel Export
  *
  * Offline license key validation for Tetra Pro features.
- * Like MUI X and AG Grid: HMAC integrity check, self-validating keys,
- * zero network calls. Security relies on legal compliance, not technical protection.
+ * Integrity check via sha256 hash (MUI X model), self-validating keys,
+ * zero network calls. Legal compliance, not technical protection.
  *
  * @module @soulbatical/tetra-core/license
  */
-// Generator (for admin/CLI use — not typically used in consumer projects)
+// Generator — exported for internal/admin/CLI use only.
+// Consumer projects should use validateLicense, not generateLicenseKey.
 export { generateLicenseKey, decodeLicenseKey } from './generator.js';
 // Validator (primary API for consumer projects)
 export { validateLicense, clearLicenseCache, isFeatureAvailable, validateLicenseUsage } from './validator.js';

package/dist/shared/license/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/shared/license/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAcH,0EAA0E;AAC1E,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGtE,gDAAgD;AAChD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE9G,YAAY;AACZ,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/shared/license/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAcH,wDAAwD;AACxD,wEAAwE;AACxE,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGtE,gDAAgD;AAChD,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE9G,YAAY;AACZ,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/shared/license/validator.d.ts

@@ -2,7 +2,8 @@
  * License Key Validator
  *
  * Validates license keys offline — zero network calls.
- * Like MUI X and AG Grid: integrity check via HMAC, then decode metadata.
+ * Integrity check via sha256 hash (MUI X model), then decode metadata.
+ * No signing secret — this is legal protection, not technical protection.
  *
  * @module @soulbatical/tetra-core/license
  */
@@ -24,13 +25,6 @@ export declare function clearLicenseCache(): void;
 export declare function isFeatureAvailable(requiredPlan: string, requiredScope: LicenseScope, config?: LicenseConfig): boolean;
 /**
  * Validate license usage against org/user limits.
- *
- * Call this after validateLicense() to check if the current usage
- * is within the license's limits. Returns a validation result with
- * status 'org_limit_exceeded' or 'user_limit_exceeded' if over limit.
- *
- * If the license has no limits (maxOrganizations/maxUsersPerOrg undefined),
- * this always returns valid.
  */
 export declare function validateLicenseUsage(usage: LicenseUsage, config?: LicenseConfig): LicenseValidationResult;
 //# sourceMappingURL=validator.d.ts.map

package/dist/shared/license/validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../src/shared/license/validator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAkB,YAAY,EAAE,uBAAuB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAcrH;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,uBAAuB,CAwB/E;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAGxC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,YAAY,EAC3B,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAWT;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,YAAY,EACnB,MAAM,CAAC,EAAE,aAAa,GACrB,uBAAuB,CA2BzB"}
+{"version":3,"file":"validator.d.ts","sourceRoot":"","sources":["../../../src/shared/license/validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAkB,YAAY,EAAE,uBAAuB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAarH;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,uBAAuB,CAwB/E;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CAGxC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,EACpB,aAAa,EAAE,YAAY,EAC3B,MAAM,CAAC,EAAE,aAAa,GACrB,OAAO,CAWT;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,YAAY,EACnB,MAAM,CAAC,EAAE,aAAa,GACrB,uBAAuB,CA2BzB"}

package/dist/shared/license/validator.js

@@ -2,12 +2,13 @@
  * License Key Validator
  *
  * Validates license keys offline — zero network calls.
- * Like MUI X and AG Grid: integrity check via HMAC, then decode metadata.
+ * Integrity check via sha256 hash (MUI X model), then decode metadata.
+ * No signing secret — this is legal protection, not technical protection.
  *
  * @module @soulbatical/tetra-core/license
  */
 import crypto from 'node:crypto';
-import { KEY_SEPARATOR, HMAC_ALGORITHM, SIGNING_SECRET, PLAN_HIERARCHY, EXPIRY_WARNING_DAYS, } from './constants.js';
+import { HASH_ALGORITHM, HASH_LENGTH, PLAN_HIERARCHY, EXPIRY_WARNING_DAYS, } from './constants.js';
 import { decodeLicenseKey } from './generator.js';
 /** Cached validation result to avoid re-validating on every call */
 let cachedResult = null;
@@ -62,13 +63,6 @@ export function isFeatureAvailable(requiredPlan, requiredScope, config) {
 }
 /**
  * Validate license usage against org/user limits.
- *
- * Call this after validateLicense() to check if the current usage
- * is within the license's limits. Returns a validation result with
- * status 'org_limit_exceeded' or 'user_limit_exceeded' if over limit.
- *
- * If the license has no limits (maxOrganizations/maxUsersPerOrg undefined),
- * this always returns valid.
  */
 export function validateLicenseUsage(usage, config) {
     const baseResult = validateLicense(config);
@@ -97,23 +91,22 @@ export function validateLicenseUsage(usage, config) {
 }
 // ─── Internal ────────────────────────────────────────────────
 function performValidation(key, config) {
-    // Step 1: Parse key format
-    const separatorIndex = key.indexOf(KEY_SEPARATOR);
-    if (separatorIndex === -1) {
+    // Step 1: Check minimum length (64 char hash + at least 1 char payload)
+    if (key.length <= HASH_LENGTH) {
         return {
             valid: false,
             status: 'invalid',
             message: 'Invalid license key format.',
         };
     }
-    const hmacProvided = key.slice(0, separatorIndex);
-    const payloadBase64 = key.slice(separatorIndex + 1);
-    // Step 2: Verify HMAC integrity
-    const hmacComputed = crypto
-        .createHmac(HMAC_ALGORITHM, SIGNING_SECRET)
+    const hashProvided = key.slice(0, HASH_LENGTH);
+    const payloadBase64 = key.slice(HASH_LENGTH);
+    // Step 2: Verify hash integrity (sha256, no secret — MUI X model)
+    const hashComputed = crypto
+        .createHash(HASH_ALGORITHM)
         .update(payloadBase64)
         .digest('hex');
-    if (!crypto.timingSafeEqual(Buffer.from(hmacProvided, 'hex'), Buffer.from(hmacComputed, 'hex'))) {
+    if (hashProvided !== hashComputed) {
         return {
             valid: false,
             status: 'invalid',
@@ -143,7 +136,6 @@ function performValidation(key, config) {
     const now = Date.now();
     const daysRemaining = Math.floor((payload.expiry - now) / (1000 * 60 * 60 * 24));
     if (payload.model === 'perpetual') {
-        // Perpetual: key is valid for all releases before expiry date
         const releaseDate = config?.releaseDate
             ? new Date(config.releaseDate).getTime()
             : now;
@@ -158,7 +150,6 @@ function performValidation(key, config) {
         }
     }
     else {
-        // Subscription: must be currently active
         if (now > payload.expiry) {
             return {
                 valid: false,
@@ -177,7 +168,7 @@ function performValidation(key, config) {
         daysRemaining,
         message: `Licensed to ${payload.customer} (${payload.plan}). ${daysRemaining > EXPIRY_WARNING_DAYS ? '' : `Expires in ${daysRemaining} days.`}`.trim(),
     };
-    // Log expiry warning (not an error, just a heads up)
+    // Log expiry warning
     if (!config?.silent && daysRemaining <= EXPIRY_WARNING_DAYS && daysRemaining > 0) {
         console.warn(`[Tetra] License expires in ${daysRemaining} days. Renew at https://tetra.soulbatical.com/renew`);
     }