@svgrid/enterprise 3.1.2 → 3.1.4

package/dist/node/studio.js

@@ -16045,7 +16045,7 @@ function hasFieldConditions(schema) {
 *
 * `version.test.ts` asserts this matches `package.json`, so the two cannot drift.
 */
-var SVGRID_VERSION = "3.1.2";
+var SVGRID_VERSION = "3.1.4";
 /**
 * The version of `@svgrid/grid`, which releases on its own line: enterprise is
 * on 3.1.x while the grid is on 3.0.x.
@@ -41821,75 +41821,149 @@ function missingEnvKeys(envExample, envLocal) {
 	return declared.filter((k) => !present.has(k));
 }
 //#endregion
-//#region src/revoked.ts
-var REVOKED_KEYS = /* @__PURE__ */ new Set([]);
-/**
-* Pull the expiry out of a key.
-*
-* Keys are `SVENTERPRISE[-KIND]-<SLUG>-<SEATS>-<DATE>-<RANDOM>`, so the date is
-* always the second-to-last segment regardless of whether a KIND is present.
-* Two widths are accepted:
-*
-*   YYYYMM   - subscription granularity; expires at the end of that month.
-*   YYYYMMDD - trial granularity; expires at the end of that day.
-*
-* The 6-digit form came first, so every key issued before day-precision trials
-* existed still parses. Anything else (including the older keys whose slug sits
-* in that position) yields null, which reads as "no expiry encoded".
-*
-* Boundaries are UTC so a key does not lapse at a different instant per
-* timezone. Kept in sync with the (maintainer-side) key issuer.
-*/
-function parseLicenseExpiry(key) {
-	if (!key) return null;
-	const segments = key.split("-");
-	if (segments.length < 3) return null;
-	const stamp = segments[segments.length - 2];
-	if (stamp == null) return null;
-	if (/^\d{6}$/.test(stamp)) {
-		const year = Number(stamp.slice(0, 4));
-		const month = Number(stamp.slice(4, 6));
-		if (month < 1 || month > 12) return null;
-		return /* @__PURE__ */ new Date(Date.UTC(year, month, 1) - 1);
-	}
-	if (/^\d{8}$/.test(stamp)) {
-		const year = Number(stamp.slice(0, 4));
-		const month = Number(stamp.slice(4, 6));
-		const day = Number(stamp.slice(6, 8));
-		if (month < 1 || month > 12 || day < 1 || day > 31) return null;
-		const end = new Date(Date.UTC(year, month - 1, day, 23, 59, 59, 999));
-		if (end.getUTCMonth() !== month - 1) return null;
-		return end;
-	}
-	return null;
+//#region src/sha256.ts
+var K = new Uint32Array([
+	1116352408,
+	1899447441,
+	3049323471,
+	3921009573,
+	961987163,
+	1508970993,
+	2453635748,
+	2870763221,
+	3624381080,
+	310598401,
+	607225278,
+	1426881987,
+	1925078388,
+	2162078206,
+	2614888103,
+	3248222580,
+	3835390401,
+	4022224774,
+	264347078,
+	604807628,
+	770255983,
+	1249150122,
+	1555081692,
+	1996064986,
+	2554220882,
+	2821834349,
+	2952996808,
+	3210313671,
+	3336571891,
+	3584528711,
+	113926993,
+	338241895,
+	666307205,
+	773529912,
+	1294757372,
+	1396182291,
+	1695183700,
+	1986661051,
+	2177026350,
+	2456956037,
+	2730485921,
+	2820302411,
+	3259730800,
+	3345764771,
+	3516065817,
+	3600352804,
+	4094571909,
+	275423344,
+	430227734,
+	506948616,
+	659060556,
+	883997877,
+	958139571,
+	1322822218,
+	1537002063,
+	1747873779,
+	1955562222,
+	2024104815,
+	2227730452,
+	2361852424,
+	2428436474,
+	2756734187,
+	3204031479,
+	3329325298
+]);
+var rotr = (x, n) => x >>> n | x << 32 - n;
+function sha256Hex(input) {
+	const data = new TextEncoder().encode(input);
+	const bitLen = data.length * 8;
+	const total = Math.ceil((data.length + 9) / 64) * 64;
+	const buf = new Uint8Array(total);
+	buf.set(data);
+	buf[data.length] = 128;
+	const view = new DataView(buf.buffer);
+	view.setUint32(total - 8, Math.floor(bitLen / 4294967296));
+	view.setUint32(total - 4, bitLen >>> 0);
+	const h = new Uint32Array([
+		1779033703,
+		3144134277,
+		1013904242,
+		2773480762,
+		1359893119,
+		2600822924,
+		528734635,
+		1541459225
+	]);
+	const w = /* @__PURE__ */ new Uint32Array(64);
+	for (let off = 0; off < total; off += 64) {
+		for (let i = 0; i < 16; i++) w[i] = view.getUint32(off + i * 4);
+		for (let i = 16; i < 64; i++) {
+			const s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ w[i - 15] >>> 3;
+			const s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ w[i - 2] >>> 10;
+			w[i] = w[i - 16] + s0 + w[i - 7] + s1 >>> 0;
+		}
+		let a = h[0], b = h[1], c = h[2], d = h[3], e = h[4], f = h[5], g = h[6], hh = h[7];
+		for (let i = 0; i < 64; i++) {
+			const S1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+			const ch = e & f ^ ~e & g;
+			const t1 = hh + S1 + ch + K[i] + w[i] >>> 0;
+			const t2 = (rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + (a & b ^ a & c ^ b & c) >>> 0;
+			hh = g;
+			g = f;
+			f = e;
+			e = d + t1 >>> 0;
+			d = c;
+			c = b;
+			b = a;
+			a = t1 + t2 >>> 0;
+		}
+		h[0] = h[0] + a >>> 0;
+		h[1] = h[1] + b >>> 0;
+		h[2] = h[2] + c >>> 0;
+		h[3] = h[3] + d >>> 0;
+		h[4] = h[4] + e >>> 0;
+		h[5] = h[5] + f >>> 0;
+		h[6] = h[6] + g >>> 0;
+		h[7] = h[7] + hh >>> 0;
+	}
+	let out = "";
+	for (const word of h) out += word.toString(16).padStart(8, "0");
+	return out;
 }
+//#endregion
+//#region src/license-core.ts
 /** Classify a license key string. Pure and side-effect-free.
 *  `now` is injectable so expiry behaviour is testable without faking clocks. */
 function checkLicenseKey(key, now = /* @__PURE__ */ new Date()) {
-	if (key == null || key === "") return {
+	if (key == null || key.trim() === "") return {
 		status: "unset",
 		valid: false,
 		edition: "suite"
 	};
-	if (!key.startsWith("SVENTERPRISE-")) return {
+	if (sha256Hex(key.trim().toLowerCase()) !== "dabe98638cdc5760637bb2a741e65680a6ff0fb590d8b1018c9597650486cb10") return {
 		status: "invalid",
 		valid: false,
 		edition: "suite"
 	};
-	if (REVOKED_KEYS.has(key)) return {
-		status: "revoked",
-		valid: false,
-		edition: "suite"
-	};
-	const expiresAt = parseLicenseExpiry(key) ?? void 0;
-	const expired = expiresAt ? now.getTime() > expiresAt.getTime() : void 0;
-	const status = key.startsWith("SVENTERPRISE-DEV") ? "dev" : key.startsWith("SVENTERPRISE-EVAL") ? "eval" : "licensed";
 	return {
-		status,
+		status: "licensed",
 		valid: true,
-		edition: status === "licensed" && key.startsWith(`SVENTERPRISE-GRID-`) ? "grid" : "suite",
-		expiresAt,
-		expired
+		edition: "suite"
 	};
 }
 //#endregion

package/dist/pivot-enable.js

@@ -17,7 +17,7 @@
  * ```
  */
 import { registerPivotEngine } from '@svgrid/grid';
-import { isLicenseKeySet } from './license.js';
+import { hasValidLicense } from './license.js';
 import { emitUnlicensedNudge } from './watermark.js';
 import { createPivotModel } from './pivot.js';
 let enabled = false;
@@ -34,6 +34,6 @@ export function enablePivot() {
         return;
     enabled = true;
     registerPivotEngine(pivotEngine);
-    if (!isLicenseKeySet())
+    if (!hasValidLicense())
         emitUnlicensedNudge();
 }

package/dist/scheduler.js

@@ -16,7 +16,7 @@
  * ```
  */
 import { registerSchedulerView } from '@svgrid/grid';
-import { isLicenseKeySet } from './license.js';
+import { hasValidLicense } from './license.js';
 import { emitUnlicensedNudge } from './watermark.js';
 import SvGridScheduler from './SvGridScheduler.svelte';
 let enabled = false;
@@ -30,7 +30,7 @@ export function enableSchedulerView() {
         return;
     enabled = true;
     registerSchedulerView(SvGridScheduler);
-    if (!isLicenseKeySet())
+    if (!hasValidLicense())
         emitUnlicensedNudge();
 }
 export { default as SvGridScheduler } from './SvGridScheduler.svelte';

package/dist/selection-bar.js

@@ -22,7 +22,7 @@
  * ```
  */
 import { registerSelectionBarView } from '@svgrid/grid';
-import { isLicenseKeySet } from './license.js';
+import { hasValidLicense } from './license.js';
 import { emitUnlicensedNudge } from './watermark.js';
 import SvGridSelectionBar from './SvGridSelectionBar.svelte';
 let enabled = false;
@@ -36,7 +36,7 @@ export function enableSelectionBar() {
         return;
     enabled = true;
     registerSelectionBarView(SvGridSelectionBar);
-    if (!isLicenseKeySet())
+    if (!hasValidLicense())
         emitUnlicensedNudge();
 }
 export { default as SvGridSelectionBar } from './SvGridSelectionBar.svelte';

package/dist/server/enable.js

@@ -19,7 +19,7 @@
  * const ctl = createServerRowModel(source, { groupBy: ['region'], onChange })
  * ```
  */
-import { isLicenseKeySet } from '../license.js';
+import { hasValidLicense } from '../license.js';
 import { emitUnlicensedNudge } from '../watermark.js';
 let enabled = false;
 /**
@@ -34,7 +34,7 @@ export function enableServerRowModel() {
     if (enabled)
         return;
     enabled = true;
-    if (!isLicenseKeySet())
+    if (!hasValidLicense())
         emitUnlicensedNudge();
 }
 /**

package/dist/sha256.d.ts

@@ -0,0 +1 @@
+export declare function sha256Hex(input: string): string;

package/dist/sha256.js

@@ -0,0 +1,69 @@
+// Synchronous SHA-256 for the license check. WebCrypto's digest() is async,
+// and setLicenseKey / checkLicenseKey are synchronous on purpose (they run at
+// module start-up and in the Node / MCP generator), so the key is hashed here.
+// FIPS 180-4, over the UTF-8 bytes of the input; returns lowercase hex.
+const K = new Uint32Array([
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]);
+const rotr = (x, n) => (x >>> n) | (x << (32 - n));
+export function sha256Hex(input) {
+    const data = new TextEncoder().encode(input);
+    const bitLen = data.length * 8;
+    // Message + 0x80 + zero padding + 64-bit length, to a multiple of 64 bytes.
+    const total = Math.ceil((data.length + 9) / 64) * 64;
+    const buf = new Uint8Array(total);
+    buf.set(data);
+    buf[data.length] = 0x80;
+    const view = new DataView(buf.buffer);
+    view.setUint32(total - 8, Math.floor(bitLen / 0x100000000));
+    view.setUint32(total - 4, bitLen >>> 0);
+    const h = new Uint32Array([
+        0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
+    ]);
+    const w = new Uint32Array(64);
+    for (let off = 0; off < total; off += 64) {
+        for (let i = 0; i < 16; i++)
+            w[i] = view.getUint32(off + i * 4);
+        for (let i = 16; i < 64; i++) {
+            const s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ (w[i - 15] >>> 3);
+            const s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ (w[i - 2] >>> 10);
+            w[i] = (w[i - 16] + s0 + w[i - 7] + s1) >>> 0;
+        }
+        let a = h[0], b = h[1], c = h[2], d = h[3], e = h[4], f = h[5], g = h[6], hh = h[7];
+        for (let i = 0; i < 64; i++) {
+            const S1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+            const ch = (e & f) ^ (~e & g);
+            const t1 = (hh + S1 + ch + K[i] + w[i]) >>> 0;
+            const S0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
+            const maj = (a & b) ^ (a & c) ^ (b & c);
+            const t2 = (S0 + maj) >>> 0;
+            hh = g;
+            g = f;
+            f = e;
+            e = (d + t1) >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (t1 + t2) >>> 0;
+        }
+        h[0] = (h[0] + a) >>> 0;
+        h[1] = (h[1] + b) >>> 0;
+        h[2] = (h[2] + c) >>> 0;
+        h[3] = (h[3] + d) >>> 0;
+        h[4] = (h[4] + e) >>> 0;
+        h[5] = (h[5] + f) >>> 0;
+        h[6] = (h[6] + g) >>> 0;
+        h[7] = (h[7] + hh) >>> 0;
+    }
+    let out = '';
+    for (const word of h)
+        out += word.toString(16).padStart(8, '0');
+    return out;
+}

package/dist/upgrade-prompt.js

@@ -16,6 +16,7 @@
 //   - SSR-safe: every DOM access is guarded. On the server it's a no-op.
 //   - Zero dependencies, inline styles - no CSS file to import, nothing to
 //     bundle, works in any host app regardless of its styling.
+import { isFirstPartySite } from './first-party.js';
 const CARD_ATTR = 'data-svgrid-enterprise-upgrade';
 const PRICING_URL = 'https://svgrid.com/pricing';
 // ?ref=in-app lets us measure how many trials start from this exact prompt
@@ -32,6 +33,8 @@ export function showUpgradePrompt(feature, opts) {
         return;
     if (typeof document === 'undefined' || typeof window === 'undefined')
         return;
+    if (isFirstPartySite())
+        return;
     if (document.querySelector(`[${CARD_ATTR}]`))
         return;
     shownThisSession = true;

package/dist/version.d.ts

@@ -10,7 +10,7 @@
  *
  * `version.test.ts` asserts this matches `package.json`, so the two cannot drift.
  */
-export declare const SVGRID_VERSION = "3.1.2";
+export declare const SVGRID_VERSION = "3.1.4";
 /**
  * The version of `@svgrid/grid`, which releases on its own line: enterprise is
  * on 3.1.x while the grid is on 3.0.x.

package/dist/version.js

@@ -10,7 +10,7 @@
  *
  * `version.test.ts` asserts this matches `package.json`, so the two cannot drift.
  */
-export const SVGRID_VERSION = '3.1.2';
+export const SVGRID_VERSION = '3.1.4';
 /**
  * The version of `@svgrid/grid`, which releases on its own line: enterprise is
  * on 3.1.x while the grid is on 3.0.x.

package/dist/watermark.js

@@ -1,15 +1,19 @@
 // Evaluation UX for unlicensed @svgrid/enterprise use. Shows a small clickable
 // "www.svgrid.com" watermark in the bottom-right corner of every SvGrid on
 // the page, which fades out after 5 seconds, and emits a one-time console
-// nudge. Hard errors (revoked / bad-prefix keys) still throw via license.ts -
-// this file is only for the "no key set" case where the feature continues to
-// work but the user gets nudged.
+// nudge. Shown for "no key" and for a key that is not the license key alike;
+// neither throws, the feature keeps working and the user gets nudged. Never
+// shown on svgrid.com itself (first-party.ts).
+import { isFirstPartySite } from './first-party.js';
 const WATERMARK_ATTR = 'data-svgrid-enterprise-watermark';
 // Marks a grid that has already shown (and faded) its watermark, so the
 // MutationObserver doesn't re-add it once it fades out and is removed.
 const NUDGED_ATTR = 'data-svgrid-enterprise-nudged';
-const HOMEPAGE_URL = 'https://svgrid.com';
-const LICENSE_URL = 'https://svgrid.com/pricing/';
+// Both point at pricing with UTM tags, the convention upgrade-prompt.ts set.
+// The watermark link carries rel="noreferrer", so without utm_medium the site
+// analytics cannot tell a visit from an unlicensed install from direct traffic.
+const WATERMARK_URL = 'https://svgrid.com/pricing/?utm_source=svgrid-enterprise&utm_medium=watermark';
+const LICENSE_URL = 'https://svgrid.com/pricing/?utm_source=svgrid-enterprise&utm_medium=console';
 const WATERMARK_LABEL = 'www.svgrid.com';
 // How long the watermark stays fully visible before it starts fading, and how
 // long the fade itself takes.
@@ -18,6 +22,8 @@ const FADE_MS = 700;
 let consoleNudgeShown = false;
 let observer = null;
 export function emitUnlicensedNudge() {
+    if (isFirstPartySite())
+        return;
     showConsoleOnce();
     if (typeof document === 'undefined' || typeof window === 'undefined')
         return;
@@ -128,7 +134,7 @@ function ensureFixedFallback() {
 function buildWatermark(kind) {
     const a = document.createElement('a');
     a.setAttribute(WATERMARK_ATTR, kind);
-    a.href = HOMEPAGE_URL;
+    a.href = WATERMARK_URL;
     a.target = '_blank';
     a.rel = 'noopener noreferrer';
     a.textContent = WATERMARK_LABEL;