@stitchaxis/latchkey 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,49 @@
-# Temporary Holding Version
+# Latchkey CLI
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Local-first encrypted vault for AI API keys. No network calls by default.
+
+## Quickstart (after `npm install -g @stitchaxis/latchkey`)
+
+```bash
+latchkey login <licence-key>
+latchkey init                         # or: latchkey init --passphrase
+latchkey add OPENAI_API_KEY           # value from LATCHKEY_VALUE
+latchkey list
+latchkey run -- node agent.js         # needs .latchkey.toml; Approve with y + Enter
+```
+
+## Windows PowerShell (first success)
+
+Use `$env:` — not cmd `set`. Full walkthrough: [`docs/FIRST_RUN_WINDOWS.md`](../../docs/FIRST_RUN_WINDOWS.md).
+
+```powershell
+# From monorepo before npm publish:
+.\lk.cmd login <licence-key>
+.\lk.cmd init --passphrase
+$env:LATCHKEY_PASSPHRASE = "your-vault-password"
+$env:LATCHKEY_VALUE = "sk-test-fake-not-real"
+.\lk.cmd add MY_API_KEY
+
+# .latchkey.toml → [scope] allowed = ["MY_API_KEY"]
+.\lk.cmd run -- node -e "console.log('got=', process.env.MY_API_KEY)"
+# Approve? [y/N] → type y → Enter
+# expect: got= sk-test-fake-not-real
+```
+
+If an IDE terminal won’t accept keys at Approve: `.\lk.cmd run --yes -- …`
+
+## Project scope (`.latchkey.toml`)
+
+```toml
+[scope]
+allowed = ["OPENAI_API_KEY", "ANTHROPIC_API_KEY"]
+```
+
+## Daemon & MCP
+
+```bash
+node packages/cli/dist/daemon.js   # Unix socket at ~/.latchkey/daemon.sock
+LATCHKEY_MCP_APPROVE=1 node packages/cli/dist/mcp-server.js
+```
+
+See [SECURITY.md](./SECURITY.md) for the threat model.

package/dist/audit.d.ts

@@ -0,0 +1,11 @@
+export type AuditAction = "vault_init" | "secret_add" | "secret_get" | "secret_list" | "secret_remove" | "run_inject" | "scope_denied" | "unlock" | "lock" | "mcp_approve" | "mcp_deny" | "mcp_error";
+export interface AuditEntry {
+    ts: string;
+    action: AuditAction;
+    key?: string;
+    name?: string;
+    project?: string;
+    command?: string;
+    detail?: string;
+}
+export declare function auditLog(entry: Omit<AuditEntry, "ts">): Promise<void>;

package/dist/audit.js

@@ -0,0 +1,7 @@
+import { appendFile, mkdir } from "node:fs/promises";
+import { AUDIT_FILE, LATCHKEY_DIR } from "./paths.js";
+export async function auditLog(entry) {
+    await mkdir(LATCHKEY_DIR, { recursive: true });
+    const line = { ts: new Date().toISOString(), ...entry };
+    await appendFile(AUDIT_FILE, JSON.stringify(line) + "\n", "utf8");
+}

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,239 @@
+#!/usr/bin/env node
+import { spawn } from "node:child_process";
+import { createInterface } from "node:readline";
+import { stdin as input, stdout as output } from "node:process";
+import { Command } from "commander";
+import { addSecret, buildEnvForRun, ensureVaultInitialized, getSecret, listSecrets, lock, removeSecret, } from "./vault.js";
+import { loadProjectScope } from "./scope.js";
+import { redactSecrets } from "./redact.js";
+import { scanRepository } from "./scan.js";
+import { loginWithToken } from "./licensing/cache.js";
+import { enforceOnLogin } from "./licensing/enforce.js";
+import { getEffectiveAccess } from "./licensing/access.js";
+import { sandboxEnvFlag, sandboxPreviewNotice } from "./sandbox.js";
+function passphraseFromEnv() {
+    return process.env.LATCHKEY_PASSPHRASE;
+}
+async function readPassphraseInteractive() {
+    const rl = createInterface({ input, output });
+    return new Promise((resolve) => {
+        rl.question("Passphrase: ", (answer) => {
+            rl.close();
+            resolve(answer);
+        });
+    });
+}
+/** Returns true if user types y / yes / approve. */
+async function promptApprove(keys) {
+    console.log("");
+    console.log("Latchkey — inject secrets into this command?");
+    console.log(`  names: ${keys.join(", ")}`);
+    console.log("  Type y then Enter to Approve, or n then Enter to Deny.");
+    const rl = createInterface({ input, output });
+    const answer = await new Promise((resolve) => {
+        rl.question("Approve? [y/N] ", (a) => {
+            rl.close();
+            resolve(a.trim().toLowerCase());
+        });
+    });
+    return answer === "y" || answer === "yes" || answer === "approve";
+}
+const program = new Command();
+program
+    .name("latchkey")
+    .description("Local-first encrypted vault for AI API keys")
+    .version("0.1.0");
+program
+    .command("login <licenceKey>")
+    .description("Activate a signed licence (cached offline for 7 days)")
+    .action(async (licenceKey) => {
+    try {
+        await loginWithToken(licenceKey.trim());
+        await enforceOnLogin();
+        const { payload } = await getEffectiveAccess();
+        console.log(`Licence active: ${payload.tier} (${payload.email})`);
+    }
+    catch (e) {
+        console.error(redactSecrets(String(e)));
+        process.exitCode = 1;
+    }
+});
+program
+    .command("init")
+    .description("Initialize vault (master key in OS keychain, optional passphrase fallback)")
+    .option("--passphrase", "Use passphrase wrap instead of OS keychain")
+    .action(async (opts) => {
+    try {
+        let pass;
+        if (opts.passphrase) {
+            pass = await readPassphraseInteractive();
+        }
+        await ensureVaultInitialized({
+            passphrase: pass,
+            preferPassphrase: opts.passphrase,
+        });
+        console.log("Vault initialized at ~/.latchkey");
+    }
+    catch (e) {
+        console.error(redactSecrets(String(e)));
+        process.exitCode = 1;
+    }
+});
+program
+    .command("add <name>")
+    .description("Store a secret (value from LATCHKEY_VALUE or prompt)")
+    .option("--value <value>", "Secret value (avoid shell history)")
+    .action(async (name, opts) => {
+    try {
+        let value = opts.value ?? process.env.LATCHKEY_VALUE;
+        if (!value) {
+            value = await readPassphraseInteractive();
+        }
+        await addSecret(name, value, passphraseFromEnv());
+        console.log(`Stored ${name}`);
+    }
+    catch (e) {
+        console.error(redactSecrets(String(e)));
+        process.exitCode = 1;
+    }
+});
+program
+    .command("get <name>")
+    .description("Print secret to stdout (respects .latchkey.toml scope)")
+    .action(async (name) => {
+    try {
+        const value = await getSecret(name, { passphrase: passphraseFromEnv() });
+        process.stdout.write(value);
+    }
+    catch (e) {
+        console.error(redactSecrets(String(e)));
+        process.exitCode = 1;
+    }
+});
+program
+    .command("list")
+    .description("List secret names (never values)")
+    .action(async () => {
+    try {
+        const names = await listSecrets(passphraseFromEnv());
+        for (const n of names) {
+            console.log(n);
+        }
+    }
+    catch (e) {
+        console.error(redactSecrets(String(e)));
+        process.exitCode = 1;
+    }
+});
+program
+    .command("rm <name>")
+    .description("Remove a secret")
+    .action(async (name) => {
+    try {
+        await removeSecret(name, passphraseFromEnv());
+        console.log(`Removed ${name}`);
+    }
+    catch (e) {
+        console.error(redactSecrets(String(e)));
+        process.exitCode = 1;
+    }
+});
+program
+    .command("scan")
+    .description("Local leak scan for exposed key-shaped strings (runs offline)")
+    .option("--json", "JSON output")
+    .action(async (opts) => {
+    try {
+        const { payload } = await getEffectiveAccess();
+        if (!payload.leakScan) {
+            throw new Error("Leak scan requires a leak-scan licence. Purchase at https://modexventures.com/latchkey/pricing");
+        }
+        const findings = await scanRepository(process.cwd());
+        if (opts.json) {
+            console.log(JSON.stringify({ findings }, null, 2));
+        }
+        else if (findings.length === 0) {
+            console.log("No key-shaped strings found.");
+        }
+        else {
+            for (const f of findings) {
+                console.log(`${f.file}:${f.line} ${f.preview}`);
+            }
+        }
+    }
+    catch (e) {
+        console.error(redactSecrets(String(e)));
+        process.exitCode = 1;
+    }
+});
+program
+    .command("lock")
+    .description("Clear in-memory master key (auto-lock also applies after idle)")
+    .action(() => {
+    lock();
+    console.log("Locked");
+});
+program
+    .command("run")
+    .description("Run a command with scoped secrets injected into child env only (Approve: y/Enter; or --yes)")
+    .allowUnknownOption(true)
+    .allowExcessArguments(true)
+    .action(async () => {
+    const argv = process.argv;
+    const runIdx = argv.indexOf("run");
+    const sepIdx = argv.indexOf("--", runIdx);
+    if (sepIdx < 0 || sepIdx === argv.length - 1) {
+        console.error("Usage: latchkey run [--yes|-y] [--sandbox] -- <command> [args...]");
+        process.exitCode = 1;
+        return;
+    }
+    const between = argv.slice(runIdx + 1, sepIdx);
+    const sandbox = between.includes("--sandbox");
+    const autoYes = between.includes("--yes") ||
+        between.includes("-y") ||
+        process.env.LATCHKEY_APPROVE === "1" ||
+        process.env.LATCHKEY_APPROVE === "yes";
+    const cmdParts = argv.slice(sepIdx + 1);
+    const cmd = cmdParts[0];
+    const args = cmdParts.slice(1);
+    if (sandbox) {
+        sandboxPreviewNotice();
+    }
+    try {
+        const scope = await loadProjectScope(process.cwd());
+        const keys = scope?.allowed ?? [];
+        if (keys.length === 0) {
+            console.error("No keys to inject. Add a .latchkey.toml with scope.allowed = [\"OPENAI_API_KEY\", ...]");
+            process.exitCode = 1;
+            return;
+        }
+        const ok = autoYes
+            ? (console.log(`Approved (--yes): ${keys.join(", ")}`), true)
+            : await promptApprove(keys);
+        if (!ok) {
+            console.log("Denied — no secrets injected.");
+            process.exitCode = 1;
+            return;
+        }
+        const injected = await buildEnvForRun(keys, {
+            passphrase: passphraseFromEnv(),
+            cwd: process.cwd(),
+        });
+        const child = spawn(cmd, args, {
+            stdio: "inherit",
+            env: {
+                ...process.env,
+                ...injected,
+                ...(sandbox ? sandboxEnvFlag() : {}),
+            },
+        });
+        child.on("exit", (code) => {
+            process.exitCode = code ?? 0;
+        });
+    }
+    catch (e) {
+        console.error(redactSecrets(String(e)));
+        process.exitCode = 1;
+    }
+});
+program.parse();

package/dist/crypto.d.ts

@@ -0,0 +1,18 @@
+export declare const MASTER_KEY_BYTES = 32;
+export declare const SALT_BYTES = 16;
+export declare function initSodium(): Promise<void>;
+export declare function randomBytes(n: number): Uint8Array;
+export declare function toB64(data: Uint8Array): string;
+export declare function fromB64(s: string): Uint8Array;
+/** Argon2id key derivation for passphrase fallback (libsodium crypto_pwhash). */
+export declare function deriveKeyFromPassphrase(passphrase: string, salt: Uint8Array): Uint8Array;
+export declare function encryptSecret(plaintext: string, key: Uint8Array): {
+    ciphertext: string;
+    nonce: string;
+};
+export declare function decryptSecret(ciphertext: string, nonce: string, key: Uint8Array): string;
+export declare function wrapMasterKey(masterKey: Uint8Array, wrappingKey: Uint8Array): {
+    ciphertext: string;
+    nonce: string;
+};
+export declare function unwrapMasterKey(ciphertext: string, nonce: string, wrappingKey: Uint8Array): Uint8Array;

package/dist/crypto.js

@@ -0,0 +1,43 @@
+import sodium from "libsodium-wrappers-sumo";
+export const MASTER_KEY_BYTES = 32;
+export const SALT_BYTES = 16;
+export async function initSodium() {
+    await sodium.ready;
+}
+export function randomBytes(n) {
+    return sodium.randombytes_buf(n);
+}
+export function toB64(data) {
+    return sodium.to_base64(data, sodium.base64_variants.ORIGINAL);
+}
+export function fromB64(s) {
+    return sodium.from_base64(s, sodium.base64_variants.ORIGINAL);
+}
+/** Argon2id key derivation for passphrase fallback (libsodium crypto_pwhash). */
+export function deriveKeyFromPassphrase(passphrase, salt) {
+    return sodium.crypto_pwhash(MASTER_KEY_BYTES, passphrase, salt, sodium.crypto_pwhash_OPSLIMIT_INTERACTIVE, sodium.crypto_pwhash_MEMLIMIT_INTERACTIVE, sodium.crypto_pwhash_ALG_ARGON2ID13);
+}
+export function encryptSecret(plaintext, key) {
+    const nonce = randomBytes(sodium.crypto_secretbox_NONCEBYTES);
+    const message = sodium.from_string(plaintext);
+    const boxed = sodium.crypto_secretbox_easy(message, nonce, key);
+    return {
+        ciphertext: toB64(boxed),
+        nonce: toB64(nonce),
+    };
+}
+export function decryptSecret(ciphertext, nonce, key) {
+    const boxed = fromB64(ciphertext);
+    const nonceBytes = fromB64(nonce);
+    const opened = sodium.crypto_secretbox_open_easy(boxed, nonceBytes, key);
+    if (!opened) {
+        throw new Error("Decryption failed (wrong key or corrupted data)");
+    }
+    return sodium.to_string(opened);
+}
+export function wrapMasterKey(masterKey, wrappingKey) {
+    return encryptSecret(toB64(masterKey), wrappingKey);
+}
+export function unwrapMasterKey(ciphertext, nonce, wrappingKey) {
+    return fromB64(decryptSecret(ciphertext, nonce, wrappingKey));
+}

package/dist/crypto.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/crypto.test.js

@@ -0,0 +1,21 @@
+import { describe, it, expect, beforeAll } from "vitest";
+import { initSodium, randomBytes, encryptSecret, decryptSecret, deriveKeyFromPassphrase, wrapMasterKey, unwrapMasterKey, } from "./crypto.js";
+beforeAll(async () => {
+    await initSodium();
+});
+describe("crypto", () => {
+    it("round-trips secretbox encryption", () => {
+        const key = randomBytes(32);
+        const plain = "sk-test-abcdefghijklmnopqrstuvwxyz1234567890";
+        const { ciphertext, nonce } = encryptSecret(plain, key);
+        expect(decryptSecret(ciphertext, nonce, key)).toBe(plain);
+    });
+    it("wraps master key with passphrase-derived key", () => {
+        const master = randomBytes(32);
+        const salt = randomBytes(16);
+        const wrapping = deriveKeyFromPassphrase("correct horse battery staple", salt);
+        const wrapped = wrapMasterKey(master, wrapping);
+        const unwrapped = unwrapMasterKey(wrapped.ciphertext, wrapped.nonce, wrapping);
+        expect(Buffer.from(unwrapped).equals(Buffer.from(master))).toBe(true);
+    });
+});

package/dist/daemon.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/daemon.js

@@ -0,0 +1,45 @@
+#!/usr/bin/env node
+/**
+ * Local daemon: Unix socket IPC for lock status and idle heartbeat.
+ * No network listeners; no telemetry.
+ */
+import { createServer } from "node:net";
+import { mkdir } from "node:fs/promises";
+import { join } from "node:path";
+import { LATCHKEY_DIR } from "./paths.js";
+import { isLocked, touchActivity } from "./lock.js";
+import { redactSecrets } from "./redact.js";
+const SOCKET_PATH = process.env.LATCHKEY_DAEMON_SOCKET ?? join(LATCHKEY_DIR, "daemon.sock");
+async function main() {
+    await mkdir(LATCHKEY_DIR, { recursive: true });
+    try {
+        const { unlink } = await import("node:fs/promises");
+        await unlink(SOCKET_PATH).catch(() => { });
+    }
+    catch {
+        /* ignore */
+    }
+    const server = createServer((socket) => {
+        socket.on("data", (buf) => {
+            const msg = buf.toString("utf8").trim();
+            if (msg === "ping") {
+                touchActivity();
+                socket.write(JSON.stringify({ ok: true, locked: isLocked() }) + "\n");
+            }
+            else if (msg === "status") {
+                socket.write(JSON.stringify({ locked: isLocked() }) + "\n");
+            }
+            else {
+                socket.write(JSON.stringify({ error: "unknown_command" }) + "\n");
+            }
+        });
+    });
+    server.listen(SOCKET_PATH, () => {
+        process.stderr.write(`latchkey daemon listening on ${SOCKET_PATH}\n`);
+    });
+    server.on("error", (err) => {
+        process.stderr.write(redactSecrets(`daemon error: ${err}\n`));
+        process.exit(1);
+    });
+}
+main();

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { redactSecrets, redactValue } from "./redact.js";
+export { isKeyAllowed, loadProjectScope } from "./scope.js";
+export { addSecret, buildEnvForRun, ensureVaultInitialized, getSecret, listSecrets, lock, removeSecret, } from "./vault.js";

package/dist/index.js

@@ -0,0 +1,3 @@
+export { redactSecrets, redactValue } from "./redact.js";
+export { isKeyAllowed, loadProjectScope } from "./scope.js";
+export { addSecret, buildEnvForRun, ensureVaultInitialized, getSecret, listSecrets, lock, removeSecret, } from "./vault.js";

package/dist/keychain.d.ts

@@ -0,0 +1,8 @@
+export type MasterKeySource = "keychain" | "passphrase";
+export declare function tryGetMasterKeyFromKeychain(): Promise<Uint8Array | null>;
+export declare function storeMasterKeyInKeychain(masterKey: Uint8Array): Promise<void>;
+export declare function clearKeychainMasterKey(): Promise<void>;
+export declare function hasPassphraseWrap(): Promise<boolean>;
+export declare function storePassphraseWrap(masterKey: Uint8Array, passphrase: string): Promise<void>;
+export declare function unlockWithPassphrase(passphrase: string): Promise<Uint8Array>;
+export declare function generateMasterKey(): Uint8Array;

package/dist/keychain.js

@@ -0,0 +1,73 @@
+import { readFile, writeFile, mkdir } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { KEYCHAIN_ACCOUNT, KEYCHAIN_SERVICE, PASSPHRASE_WRAP_FILE, LATCHKEY_DIR, } from "./paths.js";
+import { deriveKeyFromPassphrase, fromB64, initSodium, randomBytes, toB64, unwrapMasterKey, wrapMasterKey, MASTER_KEY_BYTES, } from "./crypto.js";
+async function loadKeytar() {
+    try {
+        const mod = await import("keytar");
+        return (mod.default ?? mod);
+    }
+    catch {
+        return null;
+    }
+}
+export async function tryGetMasterKeyFromKeychain() {
+    try {
+        const keytar = await loadKeytar();
+        if (!keytar)
+            return null;
+        const b64 = await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
+        if (!b64)
+            return null;
+        return fromB64(b64);
+    }
+    catch {
+        return null;
+    }
+}
+export async function storeMasterKeyInKeychain(masterKey) {
+    const keytar = await loadKeytar();
+    if (!keytar) {
+        throw new Error("OS keychain (keytar) is unavailable. Re-run with --passphrase or rebuild native modules.");
+    }
+    await keytar.setPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT, toB64(masterKey));
+}
+export async function clearKeychainMasterKey() {
+    try {
+        const keytar = await loadKeytar();
+        if (!keytar)
+            return;
+        await keytar.deletePassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
+    }
+    catch {
+        /* ignore */
+    }
+}
+export async function hasPassphraseWrap() {
+    return existsSync(PASSPHRASE_WRAP_FILE);
+}
+export async function storePassphraseWrap(masterKey, passphrase) {
+    await initSodium();
+    await mkdir(LATCHKEY_DIR, { recursive: true });
+    const salt = randomBytes(16);
+    const wrappingKey = deriveKeyFromPassphrase(passphrase, salt);
+    const wrapped = wrapMasterKey(masterKey, wrappingKey);
+    const doc = {
+        version: 1,
+        salt: toB64(salt),
+        ciphertext: wrapped.ciphertext,
+        nonce: wrapped.nonce,
+    };
+    await writeFile(PASSPHRASE_WRAP_FILE, JSON.stringify(doc, null, 2), "utf8");
+}
+export async function unlockWithPassphrase(passphrase) {
+    await initSodium();
+    const raw = await readFile(PASSPHRASE_WRAP_FILE, "utf8");
+    const doc = JSON.parse(raw);
+    const salt = fromB64(doc.salt);
+    const wrappingKey = deriveKeyFromPassphrase(passphrase, salt);
+    return unwrapMasterKey(doc.ciphertext, doc.nonce, wrappingKey);
+}
+export function generateMasterKey() {
+    return randomBytes(MASTER_KEY_BYTES);
+}

package/dist/licensing/access.d.ts

@@ -0,0 +1,8 @@
+import type { LicensePayload } from "@stitchaxis/license";
+export interface EffectiveAccess {
+    source: "license" | "trial";
+    payload: LicensePayload;
+    daysRemaining?: number;
+}
+export declare function getEffectiveAccess(): Promise<EffectiveAccess>;
+export declare function requireHardenedApproval(payload: LicensePayload): void;

package/dist/licensing/access.js

@@ -0,0 +1,35 @@
+import { TIER_LIMITS } from "@stitchaxis/license";
+import { getCachedLicensePayload } from "./cache.js";
+import { isTrialActive, trialDaysRemaining } from "./trial.js";
+export async function getEffectiveAccess() {
+    const licensed = await getCachedLicensePayload();
+    if (licensed) {
+        return { source: "license", payload: licensed };
+    }
+    if (await isTrialActive()) {
+        const days = await trialDaysRemaining();
+        const trialPayload = {
+            v: 1,
+            tier: "solo",
+            email: "trial@local",
+            devices: TIER_LIMITS.solo.devices,
+            vaults: TIER_LIMITS.solo.vaults,
+            projects: TIER_LIMITS.solo.projects,
+            hardenedPolicy: false,
+            prioritySupport: false,
+            leakScan: false,
+            iat: 0,
+            exp: Math.floor(Date.now() / 1000) + days * 86400,
+            jti: "trial",
+        };
+        return { source: "trial", payload: trialPayload, daysRemaining: days };
+    }
+    throw new Error("Latchkey trial ended. Subscribe at https://modexventures.com/latchkey/pricing then run: latchkey login <licence-key>");
+}
+export function requireHardenedApproval(payload) {
+    if (!payload.hardenedPolicy)
+        return;
+    if (process.env.LATCHKEY_APPROVE_ACCESS !== "1") {
+        throw new Error("Executive hardened policy: set LATCHKEY_APPROVE_ACCESS=1 in this shell after you approve this secret access.");
+    }
+}

package/dist/licensing/cache.d.ts

@@ -0,0 +1,11 @@
+import { type LicensePayload } from "@stitchaxis/license";
+export interface LicenseCache {
+    token: string;
+    cachedAt: string;
+    offlineValidUntil: string;
+    payload: LicensePayload;
+}
+export declare function saveLicenseCache(token: string, payload: LicensePayload): Promise<void>;
+export declare function readLicenseCache(): Promise<LicenseCache | null>;
+export declare function getCachedLicensePayload(): Promise<LicensePayload | null>;
+export declare function loginWithToken(token: string): Promise<LicensePayload>;

package/dist/licensing/cache.js

@@ -0,0 +1,42 @@
+import { readFile, writeFile, mkdir } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { verifyAndDecodeLicense } from "@stitchaxis/license";
+import { LICENSE_CACHE_FILE, LATCHKEY_DIR } from "../paths.js";
+const OFFLINE_CACHE_DAYS = 7;
+export async function saveLicenseCache(token, payload) {
+    await mkdir(LATCHKEY_DIR, { recursive: true });
+    const now = new Date();
+    const offlineEnd = new Date(now.getTime() + OFFLINE_CACHE_DAYS * 24 * 60 * 60 * 1000);
+    const cache = {
+        token,
+        cachedAt: now.toISOString(),
+        offlineValidUntil: offlineEnd.toISOString(),
+        payload,
+    };
+    await writeFile(LICENSE_CACHE_FILE, JSON.stringify(cache, null, 2), "utf8");
+}
+export async function readLicenseCache() {
+    if (!existsSync(LICENSE_CACHE_FILE))
+        return null;
+    const raw = await readFile(LICENSE_CACHE_FILE, "utf8");
+    return JSON.parse(raw);
+}
+export async function getCachedLicensePayload() {
+    const cache = await readLicenseCache();
+    if (!cache)
+        return null;
+    if (new Date(cache.offlineValidUntil).getTime() < Date.now()) {
+        return null;
+    }
+    try {
+        return verifyAndDecodeLicense(cache.token);
+    }
+    catch {
+        return cache.payload;
+    }
+}
+export async function loginWithToken(token) {
+    const payload = verifyAndDecodeLicense(token);
+    await saveLicenseCache(token, payload);
+    return payload;
+}

package/dist/licensing/enforce.d.ts

@@ -0,0 +1,3 @@
+export declare function enforceBeforeSecretAccess(projectPath?: string): Promise<void>;
+export declare function enforceBeforeVaultWrite(): Promise<void>;
+export declare function enforceOnLogin(): Promise<void>;

package/dist/licensing/enforce.js

@@ -0,0 +1,20 @@
+import { getEffectiveAccess, requireHardenedApproval } from "./access.js";
+import { countVaults, registerProject, registerThisDevice, } from "./registry.js";
+export async function enforceBeforeSecretAccess(projectPath) {
+    const { payload } = await getEffectiveAccess();
+    requireHardenedApproval(payload);
+    if (projectPath) {
+        await registerProject(projectPath, payload.projects);
+    }
+}
+export async function enforceBeforeVaultWrite() {
+    const { payload } = await getEffectiveAccess();
+    const vaults = countVaults();
+    if (vaults >= payload.vaults) {
+        throw new Error(`Vault limit reached (${payload.vaults}). Upgrade at https://modexventures.com/latchkey/pricing`);
+    }
+}
+export async function enforceOnLogin() {
+    const { payload } = await getEffectiveAccess();
+    await registerThisDevice(payload.devices);
+}