@southwind-ai/license 0.1.0

package/src/offline-code-base32.ts

@@ -0,0 +1,57 @@
+const ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+const VALUES = new Map(
+  [...ALPHABET].map((character, index) => [character, index]),
+);
+
+export function encodeBase32(bytes: Uint8Array): string {
+  let output = "";
+  let buffer = 0;
+  let bits = 0;
+  for (const byte of bytes) {
+    buffer = (buffer << 8) | byte;
+    bits += 8;
+    while (bits >= 5) {
+      bits -= 5;
+      output += ALPHABET[(buffer >>> bits) & 31];
+      buffer &= (1 << bits) - 1;
+    }
+  }
+  if (bits > 0) output += ALPHABET[(buffer << (5 - bits)) & 31];
+  return output;
+}
+
+export function decodeBase32(value: string): Uint8Array {
+  const output: number[] = [];
+  let buffer = 0;
+  let bits = 0;
+  for (const character of value) {
+    const decoded = VALUES.get(character);
+    if (decoded === undefined)
+      throw new Error(`非法 Base32 字符：${character}`);
+    buffer = (buffer << 5) | decoded;
+    bits += 5;
+    if (bits >= 8) {
+      bits -= 8;
+      output.push((buffer >>> bits) & 255);
+      buffer &= (1 << bits) - 1;
+    }
+  }
+  if (bits >= 5 || buffer !== 0) throw new Error("Base32 末尾填充位无效");
+  return Uint8Array.from(output);
+}
+
+export function segmentChecksum(data: string, segmentIndex: number): string {
+  let primary = (segmentIndex * 11 + 7) & 31;
+  let secondary = (segmentIndex * 17 + 19) & 31;
+  for (let index = 0; index < data.length; index += 1) {
+    const value = VALUES.get(data[index] || "");
+    if (value === undefined) throw new Error("分段包含非法字符");
+    primary = (primary + value * (index * 2 + 1)) & 31;
+    secondary = (secondary + value * ((index * 6 + 5) & 31)) & 31;
+  }
+  return (ALPHABET[primary] || "0") + (ALPHABET[secondary] || "0");
+}
+
+export function isBase32Character(character: string): boolean {
+  return VALUES.has(character);
+}

package/src/offline-code-decompression.ts

@@ -0,0 +1,55 @@
+import { Unzlib } from "fflate";
+import { OFFLINE_ACTIVATION_CODE_LIMITS } from "./offline-code-limits.js";
+
+const COMPRESSED_CHUNK_BYTES = 64;
+
+export class OfflineCodeDecompressionLimitError extends Error {
+  constructor() {
+    super("离线激活码解压结果超过安全上限");
+    this.name = "OfflineCodeDecompressionLimitError";
+  }
+}
+
+/**
+ * 分块驱动解压器，并在累计输出越过信封声明或协议上限时立即中断。
+ */
+export function decompressOfflineCode(
+  compressed: Uint8Array,
+  expectedLength: number,
+): Uint8Array {
+  if (
+    compressed.byteLength === 0 ||
+    compressed.byteLength > OFFLINE_ACTIVATION_CODE_LIMITS.compressedBytes
+  ) {
+    throw new OfflineCodeDecompressionLimitError();
+  }
+
+  const output = new Uint8Array(expectedLength);
+  let offset = 0;
+  const stream = new Unzlib((chunk) => {
+    const remaining = expectedLength - offset;
+    if (
+      chunk.byteLength > remaining ||
+      offset + chunk.byteLength >
+        OFFLINE_ACTIVATION_CODE_LIMITS.decompressedBytes
+    ) {
+      throw new OfflineCodeDecompressionLimitError();
+    }
+    output.set(chunk, offset);
+    offset += chunk.byteLength;
+  });
+
+  for (
+    let start = 0;
+    start < compressed.byteLength;
+    start += COMPRESSED_CHUNK_BYTES
+  ) {
+    const end = Math.min(start + COMPRESSED_CHUNK_BYTES, compressed.byteLength);
+    stream.push(compressed.subarray(start, end), end === compressed.byteLength);
+  }
+
+  if (offset !== expectedLength) {
+    throw new Error("离线激活码解压结果长度不一致");
+  }
+  return output;
+}

package/src/offline-code-limits.ts

@@ -0,0 +1,10 @@
+/**
+ * W1 安全上限。常见激活码不足 1 KiB；打印与请求上限保留了数十倍余量。
+ */
+export const OFFLINE_ACTIVATION_CODE_LIMITS = {
+  printedCharacters: 32 * 1024,
+  normalizedCharacters: 28 * 1024,
+  compressedBytes: 16 * 1024,
+  decompressedBytes: 64 * 1024,
+  requestBytes: 64 * 1024,
+} as const;

package/src/offline-code-wire.ts

@@ -0,0 +1,72 @@
+import type { SignedLicense } from "@southwind-ai/shared";
+
+export const ED25519_SIGNATURE_BYTES = 64;
+
+export function toCompactTuple(license: SignedLicense): unknown[] {
+  const { claims } = license;
+  return [
+    claims.licenseId,
+    claims.productCode,
+    claims.customer.id,
+    claims.customer.code,
+    claims.customer.name,
+    claims.project.id,
+    claims.project.code,
+    claims.project.name,
+    claims.contract.id,
+    claims.contract.contractNumber,
+    claims.contract.version,
+    claims.machineCode,
+    claims.issuedAt,
+    claims.expiresAt,
+    claims.licenseVersion.key,
+    claims.licenseVersion.name,
+    license.publicKeyId,
+  ];
+}
+
+export function fromCompactTuple(value: unknown, signature: string): unknown {
+  if (
+    !Array.isArray(value) ||
+    value.length !== 17 ||
+    value.some((item) => typeof item !== "string")
+  ) {
+    throw new Error("激活码字段类型或数量无效");
+  }
+  return {
+    formatVersion: 1,
+    algorithm: "ED25519",
+    publicKeyId: value[16],
+    signature,
+    claims: {
+      licenseId: value[0],
+      productCode: value[1],
+      customer: { id: value[2], code: value[3], name: value[4] },
+      project: { id: value[5], code: value[6], name: value[7] },
+      contract: { id: value[8], contractNumber: value[9], version: value[10] },
+      machineCode: value[11],
+      issuedAt: value[12],
+      expiresAt: value[13],
+      licenseVersion: { key: value[14], name: value[15] },
+    },
+  };
+}
+
+export function decodeEd25519Signature(value: string): Uint8Array {
+  if (!/^[A-Za-z0-9+/]{86}==$/.test(value)) {
+    throw new Error("License ED25519 签名编码无效");
+  }
+  const bytes = Uint8Array.from(atob(value), (character) =>
+    character.charCodeAt(0),
+  );
+  if (bytes.byteLength !== ED25519_SIGNATURE_BYTES) {
+    throw new Error("License ED25519 签名长度无效");
+  }
+  return bytes;
+}
+
+export function encodeEd25519Signature(bytes: Uint8Array): string {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary);
+}

package/src/offline-code.ts

@@ -0,0 +1,319 @@
+import { strFromU8, strToU8, zlibSync } from "fflate";
+import type { SignedLicense } from "@southwind-ai/shared";
+import { canonicalizeJson } from "./canonical-json.js";
+import { parseSignedLicense } from "./license-parser.js";
+import {
+  decodeBase32,
+  encodeBase32,
+  isBase32Character,
+  segmentChecksum,
+} from "./offline-code-base32.js";
+import {
+  decodeEd25519Signature,
+  ED25519_SIGNATURE_BYTES,
+  encodeEd25519Signature,
+  fromCompactTuple,
+  toCompactTuple,
+} from "./offline-code-wire.js";
+import { OFFLINE_ACTIVATION_CODE_LIMITS } from "./offline-code-limits.js";
+import {
+  decompressOfflineCode,
+  OfflineCodeDecompressionLimitError,
+} from "./offline-code-decompression.js";
+
+const PREFIX = "W1";
+const DATA_CHARACTERS_PER_SEGMENT = 25;
+const CHECKSUM_CHARACTERS = 2;
+const MAX_CANONICAL_BYTES = OFFLINE_ACTIVATION_CODE_LIMITS.decompressedBytes;
+
+export type OfflineActivationCodeErrorCode =
+  | "empty"
+  | "invalid-prefix"
+  | "unsupported-version"
+  | "invalid-character"
+  | "invalid-length"
+  | "input-too-long"
+  | "decompression-limit"
+  | "group-checksum"
+  | "payload-checksum"
+  | "damaged-payload"
+  | "invalid-license";
+
+export class OfflineActivationCodeError extends Error {
+  constructor(
+    readonly code: OfflineActivationCodeErrorCode,
+    message: string,
+    readonly groupIndex?: number,
+  ) {
+    super(message);
+    this.name = "OfflineActivationCodeError";
+  }
+}
+
+export interface DecodedOfflineActivationCode {
+  license: SignedLicense;
+  canonicalLicense: string;
+}
+
+export function encodeOfflineActivationCode(license: SignedLicense): string {
+  const canonicalLicense = canonicalizeJson(license);
+  const validated = parseSignedLicense(canonicalLicense);
+  if (!validated) {
+    throw new OfflineActivationCodeError("invalid-license", "License 格式无效");
+  }
+  const raw = strToU8(JSON.stringify(toCompactTuple(validated)));
+  if (raw.byteLength > MAX_CANONICAL_BYTES) {
+    throw new OfflineActivationCodeError("invalid-license", "License 内容过长");
+  }
+  const compressed = zlibSync(raw, { level: 9 });
+  if (compressed.byteLength > OFFLINE_ACTIVATION_CODE_LIMITS.compressedBytes) {
+    throw new OfflineActivationCodeError(
+      "invalid-license",
+      "License 压缩内容过长",
+    );
+  }
+  let signature: Uint8Array;
+  try {
+    signature = decodeEd25519Signature(validated.signature);
+  } catch (error) {
+    throw new OfflineActivationCodeError(
+      "invalid-license",
+      error instanceof Error ? error.message : "License ED25519 签名无效",
+    );
+  }
+  const envelope = new Uint8Array(
+    4 + compressed.byteLength + ED25519_SIGNATURE_BYTES + 4,
+  );
+  writeUint32(envelope, 0, raw.byteLength);
+  envelope.set(compressed, 4);
+  envelope.set(signature, 4 + compressed.byteLength);
+  writeUint32(
+    envelope,
+    envelope.byteLength - 4,
+    crc32(strToU8(canonicalLicense)),
+  );
+  return formatGroups(encodeBase32(envelope));
+}
+
+export function decodeOfflineActivationCode(
+  input: string,
+): DecodedOfflineActivationCode {
+  const normalized = normalizeInput(input);
+  const encoded = verifyAndJoinGroups(normalized.slice(PREFIX.length));
+  let envelope: Uint8Array;
+  try {
+    envelope = decodeBase32(encoded);
+  } catch {
+    throw new OfflineActivationCodeError(
+      "damaged-payload",
+      "激活码末尾数据不完整或已损坏",
+    );
+  }
+  if (envelope.byteLength < 10) {
+    throw new OfflineActivationCodeError(
+      "invalid-length",
+      "激活码数据长度不足",
+    );
+  }
+  const expectedLength = readUint32(envelope, 0);
+  if (expectedLength === 0 || expectedLength > MAX_CANONICAL_BYTES) {
+    throw new OfflineActivationCodeError(
+      "damaged-payload",
+      "激活码声明的内容长度无效",
+    );
+  }
+  let raw: Uint8Array;
+  try {
+    raw = decompressOfflineCode(
+      envelope.subarray(4, -(ED25519_SIGNATURE_BYTES + 4)),
+      expectedLength,
+    );
+  } catch (error) {
+    if (error instanceof OfflineCodeDecompressionLimitError) {
+      throw new OfflineActivationCodeError(
+        "decompression-limit",
+        "离线激活码内容超过安全上限",
+      );
+    }
+    throw new OfflineActivationCodeError(
+      "damaged-payload",
+      "激活码压缩内容已损坏",
+    );
+  }
+  if (raw.byteLength !== expectedLength) {
+    throw new OfflineActivationCodeError(
+      "damaged-payload",
+      "激活码内容长度校验失败",
+    );
+  }
+  let compact: unknown;
+  try {
+    compact = JSON.parse(strFromU8(raw));
+  } catch {
+    throw new OfflineActivationCodeError(
+      "damaged-payload",
+      "激活码紧凑内容已损坏",
+    );
+  }
+  const signature = encodeEd25519Signature(
+    envelope.subarray(-(ED25519_SIGNATURE_BYTES + 4), -4),
+  );
+  let canonicalLicense: string;
+  try {
+    canonicalLicense = canonicalizeJson(fromCompactTuple(compact, signature));
+  } catch (error) {
+    throw new OfflineActivationCodeError(
+      "damaged-payload",
+      error instanceof Error ? error.message : "激活码紧凑字段无效",
+    );
+  }
+  if (
+    crc32(strToU8(canonicalLicense)) !==
+    readUint32(envelope, envelope.byteLength - 4)
+  ) {
+    throw new OfflineActivationCodeError(
+      "payload-checksum",
+      "激活码整体校验失败",
+    );
+  }
+  const license = parseSignedLicense(canonicalLicense);
+  if (!license || canonicalizeJson(license) !== canonicalLicense) {
+    throw new OfflineActivationCodeError(
+      "invalid-license",
+      "激活码不是规范的 License",
+    );
+  }
+  return { license, canonicalLicense };
+}
+
+export function splitOfflineActivationCode(code: string): string[] {
+  const normalized = normalizeInput(code);
+  const body = normalized.slice(PREFIX.length);
+  return [PREFIX, ...chunkGroups(body)];
+}
+
+export function offlineActivationCodeErrorMessage(error: unknown): string {
+  if (!(error instanceof OfflineActivationCodeError))
+    return "离线激活码无法识别";
+  if (error.code === "group-checksum" && error.groupIndex) {
+    return `第 ${error.groupIndex} 段输入有误，请对照签发页面重新输入`;
+  }
+  return error.message;
+}
+
+function normalizeInput(input: string): string {
+  if (input.length > OFFLINE_ACTIVATION_CODE_LIMITS.printedCharacters) {
+    throw new OfflineActivationCodeError("input-too-long", "离线激活码过长");
+  }
+  const compact = input.toUpperCase().replace(/[\s-]/g, "");
+  if (compact.length > OFFLINE_ACTIVATION_CODE_LIMITS.normalizedCharacters) {
+    throw new OfflineActivationCodeError("input-too-long", "离线激活码过长");
+  }
+  if (!compact)
+    throw new OfflineActivationCodeError("empty", "请输入离线激活码");
+  const normalized = compact.replace(/O/g, "0").replace(/[IL]/g, "1");
+  if (!normalized.startsWith("W")) {
+    throw new OfflineActivationCodeError(
+      "invalid-prefix",
+      "激活码必须以 W1 开头",
+    );
+  }
+  if (!normalized.startsWith(PREFIX)) {
+    throw new OfflineActivationCodeError(
+      "unsupported-version",
+      "不支持该激活码版本",
+    );
+  }
+  for (const character of normalized.slice(PREFIX.length)) {
+    if (!isBase32Character(character)) {
+      throw new OfflineActivationCodeError(
+        "invalid-character",
+        `激活码包含无法识别的字符：${character}`,
+      );
+    }
+  }
+  return normalized;
+}
+
+function formatGroups(encoded: string): string {
+  const segments: string[] = [];
+  for (
+    let offset = 0;
+    offset < encoded.length;
+    offset += DATA_CHARACTERS_PER_SEGMENT
+  ) {
+    const data = encoded.slice(offset, offset + DATA_CHARACTERS_PER_SEGMENT);
+    segments.push(data + segmentChecksum(data, segments.length));
+  }
+  return `${PREFIX}-${segments.join("-")}`;
+}
+
+function verifyAndJoinGroups(body: string): string {
+  if (body.length < 2) {
+    throw new OfflineActivationCodeError(
+      "invalid-length",
+      "激活码缺少数据分组",
+    );
+  }
+  const segments = chunkGroups(body);
+  return segments
+    .map((segment, index) => {
+      if (
+        segment.length <= CHECKSUM_CHARACTERS ||
+        segment.length > DATA_CHARACTERS_PER_SEGMENT + CHECKSUM_CHARACTERS
+      ) {
+        throw new OfflineActivationCodeError(
+          "invalid-length",
+          "激活码分段长度无效",
+          index + 1,
+        );
+      }
+      const data = segment.slice(0, -CHECKSUM_CHARACTERS);
+      if (
+        segment.slice(-CHECKSUM_CHARACTERS) !== segmentChecksum(data, index)
+      ) {
+        throw new OfflineActivationCodeError(
+          "group-checksum",
+          `第 ${index + 1} 段校验失败`,
+          index + 1,
+        );
+      }
+      return data;
+    })
+    .join("");
+}
+
+function chunkGroups(body: string): string[] {
+  const size = DATA_CHARACTERS_PER_SEGMENT + CHECKSUM_CHARACTERS;
+  const groups: string[] = [];
+  for (let offset = 0; offset < body.length; offset += size) {
+    groups.push(body.slice(offset, offset + size));
+  }
+  return groups;
+}
+
+function crc32(bytes: Uint8Array): number {
+  let crc = 0xffffffff;
+  for (const byte of bytes) {
+    crc ^= byte;
+    for (let bit = 0; bit < 8; bit += 1) {
+      crc = (crc >>> 1) ^ (crc & 1 ? 0xedb88320 : 0);
+    }
+  }
+  return (crc ^ 0xffffffff) >>> 0;
+}
+
+function readUint32(bytes: Uint8Array, offset: number): number {
+  return new DataView(
+    bytes.buffer,
+    bytes.byteOffset,
+    bytes.byteLength,
+  ).getUint32(offset);
+}
+
+function writeUint32(bytes: Uint8Array, offset: number, value: number): void {
+  new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength).setUint32(
+    offset,
+    value,
+  );
+}