@tertaut/sdk 0.1.0

package/README.md

@@ -0,0 +1,126 @@
+# @tertaut/sdk
+
+Official JavaScript/TypeScript SDK for **Tertaut MDaaS** — The universal monetization & licensing engine for modern software (Desktop apps, CLI tools, Chrome Extensions, Web SaaS, and AI Wrappers).
+
+[![npm version](https://img.shields.io/npm/v/@tertaut/sdk.svg)](https://www.npmjs.com/package/@tertaut/sdk)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
+
+---
+
+## 📦 Installation
+
+```bash
+# npm
+npm install @tertaut/sdk
+
+# pnpm
+pnpm add @tertaut/sdk
+
+# bun
+bun add @tertaut/sdk
+
+# yarn
+yarn add @tertaut/sdk
+```
+
+---
+
+## 🚀 Quick Start
+
+### 1. License Activation & Machine Binding (Desktop / CLI / Electron / Tauri)
+Bind a license key to hardware fingerprint with automatic RS256 offline cryptographic token support:
+
+```typescript
+import { createClient, computeFingerprint } from '@tertaut/sdk'
+
+const tertaut = createClient({
+  apiUrl: 'https://tertaut.com' // or your self-hosted Tertaut instance
+})
+
+// 1. Automatically calculate client hardware fingerprint
+const fingerprint = await computeFingerprint()
+
+// 2. Activate license
+const result = await tertaut.license.activate({
+  key: 'TRT-XXXX-XXXX-XXXX-XXXX',
+  productSlug: 'my-desktop-app',
+  activationType: 'MACHINE_BIND',
+  deviceFingerprint: fingerprint,
+  deviceName: 'MacBook-Pro-M3'
+})
+
+if (result.valid) {
+  console.log('License activated successfully!')
+  console.log('Offline Token (RS256):', result.offlineToken)
+}
+```
+
+---
+
+### 2. 1-Line License Startup Guard
+Protect your application startup with automatic storage check, online validation, and local RS256 offline fallback:
+
+```typescript
+import { createClient } from '@tertaut/sdk'
+
+const tertaut = createClient({ productSlug: 'my-desktop-app' })
+
+// Throws an error or exits if license is invalid or revoked
+await tertaut.protect()
+```
+
+---
+
+### 3. AI API Proxy Shield (Zero Client-Side Secret Leak)
+Call AI providers (OpenAI, Anthropic, Gemini, Groq) using the user's license key without exposing your master API keys to the client:
+
+```typescript
+import { createClient } from '@tertaut/sdk'
+
+const tertaut = createClient({
+  apiUrl: 'https://tertaut.com',
+  licenseKey: 'TRT-XXXX-XXXX-XXXX-XXXX'
+})
+
+const response = await tertaut.ai.chat({
+  productId: 'prd_my_ai_tool',
+  model: 'gpt-4o-mini',
+  messages: [{ role: 'user', content: 'Generate a sales summary.' }]
+})
+
+console.log(response)
+```
+
+---
+
+### 4. Webhook Signature Verification (Cloud SaaS & Entitlement)
+Verify incoming webhooks from Tertaut using HMAC-SHA256:
+
+```typescript
+import { webhooks } from '@tertaut/sdk'
+
+// In your Express / Next.js / Bun API handler:
+const isValid = await webhooks.verify({
+  rawBody: req.rawBody,
+  signature: req.headers['x-tertaut-signature'],
+  secret: process.env.TERTAUT_WEBHOOK_SECRET!
+})
+
+if (!isValid) {
+  return res.status(401).send('Invalid signature')
+}
+```
+
+---
+
+## ⚙️ Features
+- 🔐 **Universal Licensing**: Machine-binding (hardware hash), Domain-lock, Chrome Extension identity, and deep-link activation.
+- 📴 **Offline Cryptographic Tokens**: RS256 asymmetric signatures verified against Tertaut's public JWKS.
+- 🧠 **AI Proxy Shield**: Vault encryption for LLM keys with real-time token metering.
+- 🔄 **Cloud SaaS Sync**: Webhook helpers for `order.paid`, `subscription.renewed`, and `license.revoked`.
+- 🪶 **Zero Heavy Dependencies**: Works across Node.js (18+), Bun, Deno, Electron, and modern browsers.
+
+---
+
+## 📄 License
+MIT © [PT Retas Lintas Batas](https://tertaut.com)

package/dist/ai.d.ts

@@ -0,0 +1,29 @@
+import type { AiChatOptions, AiChatResponse, UsageResult } from './types.js';
+export declare class AiClient {
+    private request;
+    private defaultProductId?;
+    constructor(requestFn: <T>(path: string, init?: RequestInit) => Promise<T>, defaultProductId?: string);
+    /**
+     * Mengirim request chat completion ke model AI via Tertaut AI Proxy Shield.
+     * Kunci API builder tetap terenkripsi dan terlindungi di server Tertaut.
+     *
+     * @example
+     * const res = await tertaut.ai.chat({
+     *   model: 'gpt-4o-mini',
+     *   messages: [{ role: 'user', content: 'Halo AI!' }]
+     * })
+     * console.log(res.text)
+     */
+    chat(opts: AiChatOptions): Promise<AiChatResponse>;
+    /**
+     * 1 BARIS KODE: Prompt AI cepat dan langsung kembalikan string balasan.
+     *
+     * @example
+     * const summary = await tertaut.ai.complete('Ringkas kode ini: ...')
+     */
+    complete(prompt: string, model?: string, extraOptions?: Partial<AiChatOptions>): Promise<string>;
+    /**
+     * Mengambil riwayat dan sisa kuota token pemakaian AI untuk lisensi ini.
+     */
+    getUsage(productId?: string): Promise<UsageResult>;
+}

package/dist/ai.js

@@ -0,0 +1,89 @@
+export class AiClient {
+    request;
+    defaultProductId;
+    constructor(requestFn, defaultProductId) {
+        this.request = requestFn;
+        this.defaultProductId = defaultProductId;
+    }
+    /**
+     * Mengirim request chat completion ke model AI via Tertaut AI Proxy Shield.
+     * Kunci API builder tetap terenkripsi dan terlindungi di server Tertaut.
+     *
+     * @example
+     * const res = await tertaut.ai.chat({
+     *   model: 'gpt-4o-mini',
+     *   messages: [{ role: 'user', content: 'Halo AI!' }]
+     * })
+     * console.log(res.text)
+     */
+    async chat(opts) {
+        const productId = opts.productId || this.defaultProductId;
+        if (!productId) {
+            throw new Error('Wajib menentukan productId untuk memanggil AI Proxy Shield');
+        }
+        const { productId: _, ...payload } = opts;
+        const raw = await this.request(`/api/proxy/${productId}`, {
+            method: 'POST',
+            body: JSON.stringify(payload),
+        });
+        // Helper ekstraksi teks universal dari berbagai provider (OpenAI, Anthropic, Gemini)
+        let text = '';
+        if (raw?.choices?.[0]?.message?.content) {
+            text = raw.choices[0].message.content;
+        }
+        else if (raw?.choices?.[0]?.text) {
+            text = raw.choices[0].text;
+        }
+        else if (Array.isArray(raw?.content) && raw.content[0]?.text) {
+            text = raw.content[0].text;
+        }
+        else if (raw?.candidates?.[0]?.content?.parts?.[0]?.text) {
+            text = raw.candidates[0].content.parts[0].text;
+        }
+        else if (typeof raw?.output === 'string') {
+            text = raw.output;
+        }
+        else if (typeof raw?.message === 'string') {
+            text = raw.message;
+        }
+        else {
+            text = typeof raw === 'string' ? raw : JSON.stringify(raw);
+        }
+        return {
+            text,
+            raw,
+            model: opts.model,
+            usage: raw?.usage
+                ? {
+                    promptTokens: raw.usage.prompt_tokens || raw.usage.promptTokens,
+                    completionTokens: raw.usage.completion_tokens || raw.usage.completionTokens,
+                    totalTokens: raw.usage.total_tokens || raw.usage.totalTokens,
+                }
+                : undefined,
+        };
+    }
+    /**
+     * 1 BARIS KODE: Prompt AI cepat dan langsung kembalikan string balasan.
+     *
+     * @example
+     * const summary = await tertaut.ai.complete('Ringkas kode ini: ...')
+     */
+    async complete(prompt, model = 'gpt-4o-mini', extraOptions = {}) {
+        const res = await this.chat({
+            model,
+            messages: [{ role: 'user', content: prompt }],
+            ...extraOptions,
+        });
+        return res.text;
+    }
+    /**
+     * Mengambil riwayat dan sisa kuota token pemakaian AI untuk lisensi ini.
+     */
+    async getUsage(productId) {
+        const pid = productId || this.defaultProductId;
+        if (!pid) {
+            throw new Error('Wajib menentukan productId untuk mengecek penggunaan AI');
+        }
+        return this.request(`/api/proxy/${pid}/usage`);
+    }
+}

package/dist/chrome.d.ts

@@ -0,0 +1,22 @@
+type StorageItem = string | number | boolean | null | undefined;
+type StorageValue = StorageItem | StorageValue[] | {
+    [key: string]: StorageValue;
+};
+/**
+ * CHROME_IDENTITY: id akun Google pembeli via chrome.identity.
+ * Tanpa permission identity.getAuthToken, gunakan profileUserInfo.
+ */
+export declare function getIdentityId(opts?: {
+    interactive?: boolean;
+    fallbackToEmail?: boolean;
+}): Promise<string | null>;
+/** Simpan kunci lisensi local di storage.sync (broadcast antar tool milik pembeli). */
+export declare function saveToSyncStorage(items: Record<string, StorageValue>): Promise<boolean>;
+export declare function loadFromSyncStorage<T = StorageValue>(key: string): Promise<T | null>;
+/**
+ * Persist journal keyaki (offline lock / aktivasi) ke storage.sync
+ * agar verifikasi CHROME_IDENTITY tetap konsisten.
+ */
+export declare function persistJournal(licenseKey: string, entry: Record<string, StorageValue>): Promise<boolean>;
+export declare function getExtensionId(): string | null;
+export {};

package/dist/chrome.js

@@ -0,0 +1,70 @@
+function chromeApi() {
+    const raw = globalThis.chrome;
+    return raw || undefined;
+}
+const sync = () => chromeApi()?.storage?.sync;
+/**
+ * CHROME_IDENTITY: id akun Google pembeli via chrome.identity.
+ * Tanpa permission identity.getAuthToken, gunakan profileUserInfo.
+ */
+export async function getIdentityId(opts = {}) {
+    const identity = chromeApi()?.identity;
+    if (!identity)
+        return null;
+    if (identity.getProfileUserInfo) {
+        try {
+            const info = await identity.getProfileUserInfo();
+            if (info.id)
+                return info.id;
+            if (info.email)
+                return info.email;
+        }
+        catch {
+            /* lanjut ke auth token */
+        }
+    }
+    try {
+        const res = await identity.getAuthToken({ interactive: !!opts.interactive });
+        const email = await identity.getProfileUserInfo?.();
+        return email?.id || res.token;
+    }
+    catch {
+        return null;
+    }
+}
+/** Simpan kunci lisensi local di storage.sync (broadcast antar tool milik pembeli). */
+export async function saveToSyncStorage(items) {
+    const area = sync();
+    if (!area)
+        return false;
+    await area.set(items);
+    return true;
+}
+export async function loadFromSyncStorage(key) {
+    const area = sync();
+    if (!area)
+        return null;
+    const stored = await area.get(key.split('.')[0]);
+    const root = stored[key.split('.')[0]];
+    if (typeof root === 'object' && root !== null && key.includes('.')) {
+        const path = key.split('.')[1];
+        return root[path];
+    }
+    return root === undefined ? null : root;
+}
+/**
+ * Persist journal keyaki (offline lock / aktivasi) ke storage.sync
+ * agar verifikasi CHROME_IDENTITY tetap konsisten.
+ */
+export async function persistJournal(licenseKey, entry) {
+    const area = sync();
+    if (!area)
+        return false;
+    const stored = await area.get(`tertaut_journal_${licenseKey}`);
+    const existing = stored[`tertaut_journal_${licenseKey}`] || {};
+    await area.set({ [`tertaut_journal_${licenseKey}`]: { ...existing, ...entry } });
+    return true;
+}
+export function getExtensionId() {
+    return chromeApi()?.runtime?.id ?? chromeApi()?.extension?.getURL?.('') ?? null;
+}

package/dist/client.d.ts

@@ -0,0 +1,124 @@
+import type { SdkOptions, ActivationType, ActivationResult, ValidationResult, OfflineVerifyResult, LicenseCheckResult, ProtectOptions, JwksResponse } from './types.js';
+import { AiClient } from './ai.js';
+import { webhooks } from './webhooks.js';
+import { type LicenseStorage, type StoredLicenseData } from './storage.js';
+export interface ActivateInput {
+    key: string;
+    productSlug?: string;
+    activationType?: ActivationType;
+    deviceFingerprint?: string;
+    deviceName?: string;
+    domain?: string;
+    chromeIdentityId?: string;
+}
+export interface ValidateInput {
+    key?: string;
+    productSlug?: string;
+    deviceFingerprint?: string;
+    domain?: string;
+    chromeIdentityId?: string;
+    offlineToken?: string;
+}
+export interface DeactivateInput {
+    key: string;
+    deviceFingerprint?: string;
+    domain?: string;
+}
+export interface ChatInput {
+    productId: string;
+    provider?: string;
+    model: string;
+    messages?: unknown[];
+    prompt?: string;
+    stream?: boolean;
+    [key: string]: unknown;
+}
+export interface TertautClient {
+    /** Endpoint universal ping. */
+    health(): Promise<{
+        status: string;
+        uptime?: number;
+        version?: string;
+    }>;
+    link(): string;
+    /**
+     * 1 BARIS KODE: Proteksi lisensi software otomatis.
+     * Cek storage -> validasi online -> fallback RS256 offline token.
+     */
+    guard(options?: ProtectOptions): Promise<LicenseCheckResult>;
+    /**
+     * Proteksi dengan melempar error jika lisensi tidak sah.
+     * Sangat ideal untuk startup guard atau middleware.
+     */
+    protect(options?: ProtectOptions): Promise<LicenseCheckResult>;
+    /**
+     * 1 BARIS KODE: Aktivasi lisensi dan langsung simpan ke storage perangkat.
+     */
+    activate(key: string, input?: Partial<ActivateInput>): Promise<ActivationResult>;
+    /**
+     * Melepas lisensi dari perangkat ini dan membersihkan cache.
+     */
+    deactivate(key?: string): Promise<{
+        deactivated: boolean;
+    }>;
+    /**
+     * Cek cepat apakah perangkat sudah memiliki lisensi tersimpan.
+     */
+    isActivated(): Promise<boolean>;
+    /**
+     * Mengambil data lisensi yang tersimpan di storage lokal.
+     */
+    getStored(): Promise<StoredLicenseData | null>;
+    /** Storage adapter yang sedang aktif. */
+    storage: LicenseStorage;
+    /** Low-level licensing engine endpoints. */
+    license: {
+        activate(input: ActivateInput): Promise<ActivationResult>;
+        validate(input: ValidateInput): Promise<ValidationResult>;
+        deactivate(input: DeactivateInput): Promise<{
+            deactivated: boolean;
+            devicesRemaining: number;
+        }>;
+        verifyOfflineToken(token: string): Promise<OfflineVerifyResult>;
+        jwks(): Promise<JwksResponse>;
+    };
+    /** Client AI Proxy Shield (OpenAI, Anthropic, Gemini, OpenRouter). */
+    ai: AiClient;
+    /** Helper verifikasi webhook masuk dari platform Tertaut. */
+    webhooks: typeof webhooks;
+    /** Fake Door Test & Lead Capture (waitlist/early-bird form eksternal). */
+    fakeDoorTest: {
+        get(slug?: string): Promise<any>;
+        recordView(slug?: string): Promise<{
+            success: boolean;
+        }>;
+        submitLead(lead: {
+            email: string;
+            name?: string;
+            slug?: string;
+        }): Promise<{
+            success: boolean;
+            message?: string;
+        }>;
+    };
+    fakeDoor: {
+        get(slug?: string): Promise<any>;
+        recordView(slug?: string): Promise<{
+            success: boolean;
+        }>;
+        submitLead(lead: {
+            email: string;
+            name?: string;
+            slug?: string;
+        }): Promise<{
+            success: boolean;
+            message?: string;
+        }>;
+    };
+    /** Informasi produk publik, versi, & changelog. */
+    products: {
+        get(slug?: string): Promise<any>;
+        versions(slug?: string): Promise<any[]>;
+    };
+}
+export declare function createClient(opts?: SdkOptions): TertautClient;

package/dist/client.js

@@ -0,0 +1,124 @@
+import { LicenseGuard } from './guard.js';
+import { AiClient } from './ai.js';
+import { webhooks } from './webhooks.js';
+import { createUniversalStorage } from './storage.js';
+function buildHeaders(opts) {
+    const headers = { 'Content-Type': 'application/json' };
+    if (opts.accessToken)
+        headers['Authorization'] = `Bearer ${opts.accessToken}`;
+    if (opts.licenseKey)
+        headers['X-License-Key'] = opts.licenseKey;
+    return headers;
+}
+export function createClient(opts = {}) {
+    const envUrl = typeof process !== 'undefined' ? process.env?.TERTAUT_API_URL : undefined;
+    const rawUrl = opts.apiUrl || envUrl || 'https://tertaut.com';
+    // Menangani input root domain ("https://tertaut.com") maupun URL api ("https://tertaut.com/api")
+    const base = rawUrl.replace(/\/+$/, '').replace(/\/api$/, '');
+    const headers = buildHeaders(opts);
+    async function request(path, init = {}) {
+        const res = await fetch(`${base}${path}`, {
+            ...init,
+            headers: { ...headers, ...init.headers },
+        });
+        if (!res.ok) {
+            let message = `Tertaut API ${path} → HTTP ${res.status}`;
+            try {
+                const body = await res.clone().json();
+                if (body && (body.message || body.error))
+                    message = body.message || body.error;
+            }
+            catch {
+                /* ignore */
+            }
+            throw new Error(message);
+        }
+        const body = (await res.json());
+        let data = body;
+        while (data && typeof data === 'object' && !Array.isArray(data) && 'data' in data) {
+            data = data.data;
+        }
+        return data;
+    }
+    const storage = opts.storage || createUniversalStorage();
+    const license = {
+        activate(input) {
+            return request('/api/licenses/activate', {
+                method: 'POST',
+                body: JSON.stringify(input),
+            });
+        },
+        validate(input) {
+            return request('/api/licenses/validate', {
+                method: 'POST',
+                body: JSON.stringify(input),
+            });
+        },
+        deactivate(input) {
+            return request('/api/licenses/deactivate', {
+                method: 'POST',
+                body: JSON.stringify(input),
+            });
+        },
+        verifyOfflineToken(token) {
+            return request('/api/licenses/verify-offline-token', {
+                method: 'POST',
+                body: JSON.stringify({ token }),
+            });
+        },
+        jwks() {
+            return request('/api/licenses/.well-known/jwks');
+        },
+    };
+    const ai = new AiClient(request, opts.productId);
+    const rawClient = {
+        health() {
+            return request('/health');
+        },
+        link() {
+            return base;
+        },
+        storage,
+        license,
+        ai,
+        webhooks,
+        fakeDoorTest: {
+            get(slug) {
+                const s = slug || opts.productSlug;
+                return request(`/api/fakedoortests/public/${encodeURIComponent(s || '')}`);
+            },
+            recordView(slug) {
+                const s = slug || opts.productSlug;
+                return request(`/api/fakedoortests/public/${encodeURIComponent(s || '')}/view`, { method: 'POST' });
+            },
+            submitLead(lead) {
+                const s = lead.slug || opts.productSlug;
+                return request(`/api/fakedoortests/public/${encodeURIComponent(s || '')}/lead`, {
+                    method: 'POST',
+                    body: JSON.stringify({ email: lead.email, name: lead.name }),
+                });
+            },
+        },
+        get fakeDoor() {
+            return this.fakeDoorTest;
+        },
+        products: {
+            get(slug) {
+                const s = slug || opts.productSlug;
+                return request(`/api/products/${encodeURIComponent(s || '')}`);
+            },
+            versions(slug) {
+                const s = slug || opts.productSlug;
+                return request(`/api/products/${encodeURIComponent(s || '')}/versions`);
+            },
+        },
+        guard: (options) => guardInstance.guard(options),
+        protect: (options) => guardInstance.protect(options),
+        activate: (key, input) => guardInstance.activate(key, input),
+        deactivate: (key) => guardInstance.deactivate(key),
+        isActivated: () => guardInstance.isActivated(),
+        getStored: () => guardInstance.getStored(),
+    };
+    const guardInstance = new LicenseGuard(rawClient, { ...opts, storage });
+    return rawClient;
+}

package/dist/desktop.d.ts

@@ -0,0 +1,25 @@
+import type { JwksResponse, OfflineVerifyResult } from './types.js';
+/**
+ * Verifikasi offline RS256 penuh (WebCrypto, tanpa jaringan).
+ * JWKS di-cache sampai keluar area konteks/versi.
+ */
+export declare function verifyOfflineLocally(token: string, source?: JwksResponse | (() => Promise<JwksResponse>)): Promise<OfflineVerifyResult>;
+/**
+ * Fingerprint stable berbasis env: platform, arsitektur, concurrency, memori,
+ * userAgent (browser/desktop) — di-hash SHA-256. MACHINE_BIND.
+ */
+export declare function computeFingerprint(extraSeed?: string): Promise<string>;
+/**
+ * Deep link Android (intent://... atau Schema URI) untuk auto-fill lisensi.
+ * Returns URI scheme + juga URI action untuk fallback.
+ */
+export declare function buildDeepLink(opts: {
+    key: string;
+    productSlug: string;
+    appType?: string;
+    apiUrl: string;
+    fallbackUrl?: string;
+}): {
+    uri: string;
+    intentUrl: string;
+};

package/dist/desktop.js

@@ -0,0 +1,57 @@
+import { verifyOfflineToken } from './jwt.js';
+let cachedJwks = null;
+/**
+ * Verifikasi offline RS256 penuh (WebCrypto, tanpa jaringan).
+ * JWKS di-cache sampai keluar area konteks/versi.
+ */
+export async function verifyOfflineLocally(token, source = () => Promise.reject(new Error('Wajib berikan JWKS: ambil dari /api/licenses/.well-known/jwks saat masih online'))) {
+    let jwks = source;
+    if (typeof source !== 'function' && source && Array.isArray(source.keys)) {
+        cachedJwks = source;
+        jwks = source;
+    }
+    const resolved = typeof jwks === 'function'
+        ? cachedJwks ?? (await jwks())
+        : jwks;
+    return verifyOfflineToken(token, resolved);
+}
+const encoder = new TextEncoder();
+async function sha256Hex(input) {
+    const digest = await globalThis.crypto.subtle.digest('SHA-256', encoder.encode(input));
+    return Array.from(new Uint8Array(digest))
+        .map((b) => b.toString(16).padStart(2, '0'))
+        .join('');
+}
+/**
+ * Fingerprint stable berbasis env: platform, arsitektur, concurrency, memori,
+ * userAgent (browser/desktop) — di-hash SHA-256. MACHINE_BIND.
+ */
+export async function computeFingerprint(extraSeed = '') {
+    const processLike = globalThis.process;
+    const nav = typeof navigator !== 'undefined'
+        ? { ua: navigator.userAgent, platform: navigator.platform, cores: navigator.hardwareConcurrency }
+        : { ua: processLike?.platform || 'node', platform: '', cores: 0 };
+    const deviceMemory = nav.deviceMemory || '';
+    const seed = [
+        nav.platform,
+        processLike?.arch || '',
+        nav.cores || 0,
+        deviceMemory,
+        nav.ua,
+        extraSeed,
+    ].join('|');
+    return sha256Hex(seed);
+}
+/**
+ * Deep link Android (intent://... atau Schema URI) untuk auto-fill lisensi.
+ * Returns URI scheme + juga URI action untuk fallback.
+ */
+export function buildDeepLink(opts) {
+    const params = new URLSearchParams({ key: opts.key, product: opts.productSlug, api: opts.apiUrl });
+    if (opts.appType)
+        params.set('appType', opts.appType);
+    const scheme = `tertaut://activate?${params.toString()}`;
+    const fallback = opts.fallbackUrl || `${opts.apiUrl}/p/${encodeURIComponent(opts.productSlug)}?key=${opts.key}`;
+    const intentUrl = `intent://activate?${params.toString()}#Intent;scheme=tertaut;package=com.tertaut.activation;S.browser_fallback_url=${encodeURIComponent(fallback)};end`;
+    return { uri: scheme, intentUrl };
+}