@thejoseki/clawform 2.3.0 → 2.3.2

package/src/lib/kit-source.js

@@ -9,12 +9,20 @@
 // repaired with no network, which matters because `init plugin` is not
 // something a buyer should have to be online to re-run.
 
-import { readFileSync, writeFileSync, mkdirSync, existsSync } from 'node:fs';
+import { readFileSync, writeFileSync, mkdirSync, existsSync, statSync as fsStatSync } from 'node:fs';
 import { join } from 'node:path';
 import { unpackFiles } from './payload.js';
+import { logger } from './logger.js';
 
 export const KIT_CACHE_FILENAME = 'kit.bin';
 
+// Backstop against a permanently-frozen cache: the kit is served by a pipeline
+// SEPARATE from npm, so a version-stamped filename cannot catch "kit changed,
+// CLI did not". After this window a re-run re-checks the service (and still
+// falls back to the cached copy if the service is down). `--refresh` is the
+// deterministic path; this only bounds how long a silent staleness can last.
+export const KIT_CACHE_TTL_MS = 24 * 60 * 60 * 1000; // 24h
+
 // Said on every service failure. Someone hitting this may have a stack stuck
 // mid-update, and the first thing they need to know is that the emergency path
 // is not what just broke. Those two commands are never licence-gated, and they
@@ -46,11 +54,41 @@ async function detailOf(resp) {
 
 /**
  * Resolve the content kit, from cache or from the service.
+ *
+ * A FRESH cache (younger than ttlMs, and no `refresh`) is served with no
+ * network — the common case, and what keeps `init plugin` offline-safe. A cold,
+ * stale, or `refresh`-forced call goes to the service; if that fails with an
+ * OUTAGE (network / 5xx / 429) but a cache exists, the cache is served with a
+ * warning rather than breaking the run. A REFUSAL (403/4xx) still throws — it is
+ * a deliberate "this licence cannot have the kit", not a blip to paper over.
+ *
  * @returns {Promise<Array<{path: string, content: string}>>}
  */
-export async function obtainKit({ licenseKey, serviceUrl, cacheDir, fetch: fetchImpl = fetch }) {
+export async function obtainKit({
+  licenseKey, serviceUrl, cacheDir,
+  fetch: fetchImpl = fetch,
+  refresh = false,
+  ttlMs = KIT_CACHE_TTL_MS,
+  now = Date.now,
+  statSync = fsStatSync,
+  warn = (m) => logger.warn(m),
+}) {
   const cachePath = join(cacheDir, KIT_CACHE_FILENAME);
-  if (existsSync(cachePath)) return unpackFiles(readFileSync(cachePath));
+  const cached = existsSync(cachePath);
+  const fresh = cached && !refresh && (now() - statSync(cachePath).mtimeMs) < ttlMs;
+
+  if (fresh) return unpackFiles(readFileSync(cachePath));
+
+  // Serve the cache on an outage rather than breaking a re-run — but never on a
+  // deliberate refusal (below).
+  const fallbackOrThrow = (err) => {
+    if (cached) {
+      warn(`Could not refresh the plugin kit (${err.reason}) — using the cached copy. `
+        + 'Re-run `clawform init plugin --refresh` once the service is reachable to pull the latest skills.');
+      return unpackFiles(readFileSync(cachePath));
+    }
+    throw outage(err.reason);
+  };
 
   let resp;
   try {
@@ -60,12 +98,12 @@ export async function obtainKit({ licenseKey, serviceUrl, cacheDir, fetch: fetch
       body: JSON.stringify({ license_key: licenseKey }),
     });
   } catch (err) {
-    throw outage(err?.message ?? 'network error');
+    return fallbackOrThrow({ reason: err?.message ?? 'network error' });
   }
 
   // A throttle or a 5xx is the service failing, not the licence being judged —
   // the same distinction the vendor client draws, and for the same reason.
-  if (resp.status === 429 || resp.status >= 500) throw outage(`HTTP ${resp.status}`);
+  if (resp.status === 429 || resp.status >= 500) return fallbackOrThrow({ reason: `HTTP ${resp.status}` });
   if (!resp.ok) throw refusal(await detailOf(resp));
 
   const bundle = Buffer.from(await resp.arrayBuffer());

package/src/lib/license-client.js

@@ -1,84 +1,84 @@
-// Vendor-agnostic license client seam. Every consumer talks to this contract:
-//
-//   activate(key, fingerprint) → { status:'valid', instanceId, holder? }
-//                              | { status:'invalid', reason }   // limit_reached | expired | not_found
-//                              | { status:'error',   reason }   // vendor unreachable
-//   validate(key, activationId?) → { status:'valid'|'invalid'|'error', reason? }
-//   deactivate(key, activationId)→ { status:'valid'|'invalid'|'error', reason? }
-//
-// resolveClient() picks the implementation from the license mode:
-//   'off' (default)  → a dormant stub (configured:false) — assertLicensed
-//                      passes everything, so the repo's own dev/CI and every
-//                      buyer before launch is unaffected.
-//   'sandbox'/'live' → the real Polar adapter (configured:true) against the
-//                      matching base URL.
-//
-// Flipping the shipped default to a live mode is the single reviewed decision
-// that turns enforcement on (see license-config.js).
-
-import { existsSync } from 'node:fs';
-import { join, dirname } from 'node:path';
-import { fileURLToPath } from 'node:url';
-import { readEnv } from './rename-compat.js';
-import { createPolarClient } from './providers/polar.js';
-import {
-  LICENSE_MODE_DEFAULT,
-  DEV_MARKER,
-  POLAR_ORGANIZATION_ID,
-  POLAR_BENEFIT_ID,
-  POLAR_TRIAL_BENEFIT_ID,
-  POLAR_BASE_URL,
-} from './license-config.js';
-
-const DORMANT = {
-  configured: false,
-  async activate() { return { status: 'error', reason: 'license enforcement is off in this build' }; },
-  async validate() { return { status: 'error', reason: 'license enforcement is off in this build' }; },
-  async deactivate() { return { status: 'error', reason: 'license enforcement is off in this build' }; },
-};
-
-// Resolved from THIS module's location, never from process.cwd(): with cwd, a
-// buyer running clawform inside any repo that happens to carry the dev marker
-// would be handed the dormant client — a bypass needing no edit at all.
-const PACKAGE_ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', '..');
-
-export function isSourceCheckout(packageRoot = PACKAGE_ROOT) {
-  return existsSync(join(packageRoot, DEV_MARKER));
-}
-
-// `env` stays POSITIONAL: callers pass an env object, and folding it into an
-// options bag would silently reinterpret every existing call as `{env:
-// undefined}` — falling back to process.env and passing for the wrong reason.
-export function resolveMode(env = process.env, { packageRoot = PACKAGE_ROOT } = {}) {
-  const fromEnv = readEnv('LICENSE_MODE', env);
-  // The environment may pick BETWEEN enforcing modes; it can never turn
-  // enforcement down. Anything else — 'off', a typo, an empty string — is
-  // ignored rather than treated as a request to disable.
-  if (fromEnv === 'sandbox' || fromEnv === 'live') return fromEnv;
-  if (isSourceCheckout(packageRoot)) return 'off';
-  return LICENSE_MODE_DEFAULT;
-}
-
-// Which benefits are trials, for the mode this install is running in. Resolved
-// here rather than in license-config because that is where mode resolution
-// already lives, and a second copy of it would be free to disagree.
-//
-// A dormant install has no trials: nothing to claim, nothing to refuse.
-export function resolveTrialBenefitIds({ env = process.env, packageRoot = PACKAGE_ROOT } = {}) {
-  const mode = resolveMode(env, { packageRoot });
-  return POLAR_TRIAL_BENEFIT_ID[mode] ?? [];
-}
-
-export function resolveClient({ env = process.env, packageRoot = PACKAGE_ROOT, fetch } = {}) {
-  const mode = resolveMode(env, { packageRoot });
-  if (mode !== 'sandbox' && mode !== 'live') return DORMANT;
-  // Both looked up by the same mode, so they cannot drift apart: a base URL
-  // for one environment with an organization from the other is the failure
-  // this shape exists to make impossible.
-  return createPolarClient({
-    baseUrl: POLAR_BASE_URL[mode],
-    organizationId: POLAR_ORGANIZATION_ID[mode],
-    benefitIds: POLAR_BENEFIT_ID[mode],
-    ...(fetch ? { fetch } : {}),
-  });
-}
+// Vendor-agnostic license client seam. Every consumer talks to this contract:
+//
+//   activate(key, fingerprint) → { status:'valid', instanceId, holder? }
+//                              | { status:'invalid', reason }   // limit_reached | expired | not_found
+//                              | { status:'error',   reason }   // vendor unreachable
+//   validate(key, activationId?) → { status:'valid'|'invalid'|'error', reason? }
+//   deactivate(key, activationId)→ { status:'valid'|'invalid'|'error', reason? }
+//
+// resolveClient() picks the implementation from the license mode:
+//   'off' (default)  → a dormant stub (configured:false) — assertLicensed
+//                      passes everything, so the repo's own dev/CI and every
+//                      buyer before launch is unaffected.
+//   'sandbox'/'live' → the real Polar adapter (configured:true) against the
+//                      matching base URL.
+//
+// Flipping the shipped default to a live mode is the single reviewed decision
+// that turns enforcement on (see license-config.js).
+
+import { existsSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { readEnv } from './rename-compat.js';
+import { createPolarClient } from './providers/polar.js';
+import {
+  LICENSE_MODE_DEFAULT,
+  DEV_MARKER,
+  POLAR_ORGANIZATION_ID,
+  POLAR_BENEFIT_ID,
+  POLAR_TRIAL_BENEFIT_ID,
+  POLAR_BASE_URL,
+} from './license-config.js';
+
+const DORMANT = {
+  configured: false,
+  async activate() { return { status: 'error', reason: 'license enforcement is off in this build' }; },
+  async validate() { return { status: 'error', reason: 'license enforcement is off in this build' }; },
+  async deactivate() { return { status: 'error', reason: 'license enforcement is off in this build' }; },
+};
+
+// Resolved from THIS module's location, never from process.cwd(): with cwd, a
+// buyer running clawform inside any repo that happens to carry the dev marker
+// would be handed the dormant client — a bypass needing no edit at all.
+const PACKAGE_ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', '..');
+
+export function isSourceCheckout(packageRoot = PACKAGE_ROOT) {
+  return existsSync(join(packageRoot, DEV_MARKER));
+}
+
+// `env` stays POSITIONAL: callers pass an env object, and folding it into an
+// options bag would silently reinterpret every existing call as `{env:
+// undefined}` — falling back to process.env and passing for the wrong reason.
+export function resolveMode(env = process.env, { packageRoot = PACKAGE_ROOT } = {}) {
+  const fromEnv = readEnv('LICENSE_MODE', env);
+  // The environment may pick BETWEEN enforcing modes; it can never turn
+  // enforcement down. Anything else — 'off', a typo, an empty string — is
+  // ignored rather than treated as a request to disable.
+  if (fromEnv === 'sandbox' || fromEnv === 'live') return fromEnv;
+  if (isSourceCheckout(packageRoot)) return 'off';
+  return LICENSE_MODE_DEFAULT;
+}
+
+// Which benefits are trials, for the mode this install is running in. Resolved
+// here rather than in license-config because that is where mode resolution
+// already lives, and a second copy of it would be free to disagree.
+//
+// A dormant install has no trials: nothing to claim, nothing to refuse.
+export function resolveTrialBenefitIds({ env = process.env, packageRoot = PACKAGE_ROOT } = {}) {
+  const mode = resolveMode(env, { packageRoot });
+  return POLAR_TRIAL_BENEFIT_ID[mode] ?? [];
+}
+
+export function resolveClient({ env = process.env, packageRoot = PACKAGE_ROOT, fetch } = {}) {
+  const mode = resolveMode(env, { packageRoot });
+  if (mode !== 'sandbox' && mode !== 'live') return DORMANT;
+  // Both looked up by the same mode, so they cannot drift apart: a base URL
+  // for one environment with an organization from the other is the failure
+  // this shape exists to make impossible.
+  return createPolarClient({
+    baseUrl: POLAR_BASE_URL[mode],
+    organizationId: POLAR_ORGANIZATION_ID[mode],
+    benefitIds: POLAR_BENEFIT_ID[mode],
+    ...(fetch ? { fetch } : {}),
+  });
+}

package/src/lib/license-config.js

@@ -1,162 +1,162 @@
-// Licensing time policy. Vendor identifiers (org/product IDs) join this file
-// once the payout test settles which vendor we ship with — the time policy is
-// vendor-independent and the grace/revalidate logic only needs these two.
-
-// How long a cached "valid" verdict is trusted before the CLI re-checks with
-// the vendor in the background. Once per day keeps revocation reasonably fresh
-// without turning every command into a network call.
-export const REVALIDATE_HOURS = 24;
-
-// How long a buyer keeps working after the LAST successful validation when the
-// vendor cannot be reached (offline dev box, vendor outage). Two weeks: long
-// enough to survive a vacation offline, short enough that a revoked-but-
-// unreachable key does not run forever.
-export const GRACE_DAYS = 14;
-
-// --- Vendor: Polar -------------------------------------------------------
-// The organization id is not a secret — it is a public parameter of every
-// customer-portal call, and the API needs no server token besides the buyer's
-// own key. Safe to ship in the tarball.
-//
-// Keyed by mode, and it has to be. Polar's sandbox is a separate system rather
-// than a flag on the same one: you sign up for it separately, the organization
-// you create there does not exist in production, and its id is different. A
-// single id shared across both modes builds a client that talks to
-// api.polar.sh while naming a sandbox organization — every activation by a
-// real buyer fails, and it fails on the first day of selling rather than in
-// any amount of sandbox testing. Paired with POLAR_BASE_URL below so the two
-// can only be changed together.
-export const POLAR_ORGANIZATION_ID = {
-  live: '75b98aba-8768-4534-9b76-dd7f16cba3d3',
-  sandbox: 'c234fc61-20e4-4d6f-b919-0f5823f7984d',
-};
-export const POLAR_BASE_URL = {
-  live: 'https://api.polar.sh',
-  sandbox: 'https://sandbox-api.polar.sh',
-};
-
-// The License Keys benefit this product sells. The organization is not enough
-// to identify a key: every product under the same organization validates
-// against the same endpoint with the same organization id, so the moment a
-// second product sells from here, a key bought for THAT product activates this
-// one. A paying customer of one tool silently unlocking another is not a bug
-// anyone reports.
-//
-// Polar returns the benefit on both activate and validate, so the check costs
-// nothing and closes it. Keyed by mode for the same reason the organization is
-// — a sandbox benefit does not exist in production.
-//
-// A LIST per mode, one entry per paid tier. Polar carries limit_activations on
-// the benefit, not the product, so tiers with different device caps cannot share
-// one — the individual seat and the team seat are necessarily separate benefits.
-// A key is accepted when it matches ANY entry; the tier it belongs to is Polar's
-// business, not the CLI's.
-//
-// Nothing may appear in both lists: an id reachable from either environment
-// would let a sandbox key unlock a live install.
-export const POLAR_BENEFIT_ID = {
-  // [0] individual seat, [1] team seat. Order is not significance — a key is
-  // accepted on any match — but it is the order the walk tries, so the tier
-  // that sells most often belongs first.
-  live: [
-    'b85a9271-22ac-45b3-ab0a-b0c93df6b13c',
-    'be046860-7be4-43bd-ac8b-cf47d08f77d0',
-    'a3fc4e93-9e93-4317-bed5-5b44a5af9e19',
-  ],
-  sandbox: [
-    '69d1ccaa-65c4-48da-ad4a-64961772c17e',
-    'a540043d-da17-48ae-bee6-e9a900fbe1cc',
-    '9c5fe82d-09a7-490c-91e3-47d164603423',
-  ],
-};
-
-// Which of the benefits above are TRIALS. A trial key validates like any other
-// — it has to appear in POLAR_BENEFIT_ID as well — but it additionally claims
-// the machine, so one device cannot start a second trial under a new email.
-//
-// Listed separately rather than encoded in the entries above so phase 01's
-// shape and its tests stay untouched. A test pins that every id here also
-// appears in POLAR_BENEFIT_ID: an id in only one list is a trial key nobody can
-// activate, or a paid key that silently burns a device claim.
-//
-// The licence-key benefit on each trial product must be VISIBLE in Polar: the
-// buyer has to read the key out of the portal or the confirmation email to type
-// it into `clawform activate`. A hidden benefit is granted and unusable.
-export const POLAR_TRIAL_BENEFIT_ID = {
-  live: ['a3fc4e93-9e93-4317-bed5-5b44a5af9e19'],
-  sandbox: ['9c5fe82d-09a7-490c-91e3-47d164603423'],
-};
-
-// --- Content kit delivery -----------------------------------------------
-// The plugin content (skills/commands/agents/rules/templates) is NOT in the npm
-// tarball. It is fetched by `clawform init plugin` from this service, which
-// checks the licence with the vendor before serving anything.
-//
-// The previous model shipped the content as an encrypted blob with its key
-// beside it in the same tarball — which protected nothing: `npm i` handed a
-// non-buyer both halves. There is no key here now because the CLI never
-// decrypts; the bundle lives in a private bucket and travels over TLS.
-//
-// Not keyed by licence mode. There is one kit, and which licences may have it
-// is the service's judgement, not a build-time constant.
-export const KIT_SERVICE_URL = 'https://kit.thejoseki.com';
-
-// Written by scripts/pack-payload.js for upload, and cached under the vendor
-// home after a successful fetch. Never present in the published package.
-export const KIT_FILENAME = 'kit.bin';
-
-// Signs the local licence record. The gate trusts an 'active' record with a
-// fresh timestamp without calling the vendor, so an unsigned cache would make
-// `echo '{"status":"active",…}' > ~/.clawform/license.json` a complete bypass —
-// and a shareable one-liner at that. Signing raises it to "extract this secret
-// from the CLI first", the same bar as the dev marker.
-//
-// Same 1a honesty as PAYLOAD_KEY_HEX: the secret ships with the code, so a
-// determined attacker can still forge. The goal is killing the one-liner class.
-// Distinct from the payload key on purpose — keys with different jobs.
-//
-// Rotates alongside the payload key, and for the same reason: a release that
-// published this value hands every later release a forged 'active' record.
-// The cost is that records signed with the old secret read as unlicensed, so a
-// buyer re-activates — cheap now, and it only gets dearer with every seat sold.
-export const LICENSE_RECORD_SECRET_HEX = 'c4179ff7c3e2ebd223fdb2653ed1163f5b8cb89c7900af2a88f186fbb55818e5';
-
-// Tolerance for a machine clock running slightly ahead of the vendor's. Beyond
-// it, a future `lastValidatedAt` is treated as needing revalidation rather than
-// as an eternally fresh verdict.
-export const CLOCK_SKEW_HOURS = 1;
-
-// How a build tells whether it is a source checkout or an installed package.
-// This file is the payload build script — `package.json` `files` never ships
-// `scripts/`, so it is present in a clone and absent in `npm i -g @thejoseki/clawform`.
-//
-// Dormancy is granted by the install SHAPE, not by anything a buyer can set:
-// a `CLAWFORM_LICENSE_MODE=off` that disabled the gate would be a
-// copy-pasteable one-liner, the one bypass class that actually spreads.
-// Faking dormancy now means creating this file inside the installed package —
-// an edit, not a one-liner.
-//
-// ⚠️ Adding `scripts/` to `package.json` `files` would ship the marker and
-// silently disable enforcement for everyone. A packaging test asserts it stays
-// out of the tarball.
-export const DEV_MARKER = 'scripts/pack-payload.js';
-
-// The master switch, and the single decision that turns enforcement on.
-//
-// Held at 'off' through development, because enforcing before a key could be
-// bought would have locked out every user with no way back in. It moved to
-// 'live' only once all three preconditions were verified against the
-// production vendor rather than assumed:
-//
-//   - a Polar product exists with a License Keys benefit, activation limit 3
-//   - a real purchased key drives activate / validate / deactivate, the
-//     three-device cap refuses a fourth machine, and deactivate demonstrably
-//     frees a slot (proved by re-activating, not by the return code)
-//   - the sandbox and production environments reject each other's keys, which
-//     is what makes the per-mode organization and benefit ids load-bearing
-//
-// A source checkout stays dormant regardless: that exemption comes from the
-// dev marker's presence, not from this value, so contributors need no key.
-// Overridable per run via CLAWFORM_LICENSE_MODE, which can raise enforcement
-// but never lower it.
-export const LICENSE_MODE_DEFAULT = 'live';
+// Licensing time policy. Vendor identifiers (org/product IDs) join this file
+// once the payout test settles which vendor we ship with — the time policy is
+// vendor-independent and the grace/revalidate logic only needs these two.
+
+// How long a cached "valid" verdict is trusted before the CLI re-checks with
+// the vendor in the background. Once per day keeps revocation reasonably fresh
+// without turning every command into a network call.
+export const REVALIDATE_HOURS = 24;
+
+// How long a buyer keeps working after the LAST successful validation when the
+// vendor cannot be reached (offline dev box, vendor outage). Two weeks: long
+// enough to survive a vacation offline, short enough that a revoked-but-
+// unreachable key does not run forever.
+export const GRACE_DAYS = 14;
+
+// --- Vendor: Polar -------------------------------------------------------
+// The organization id is not a secret — it is a public parameter of every
+// customer-portal call, and the API needs no server token besides the buyer's
+// own key. Safe to ship in the tarball.
+//
+// Keyed by mode, and it has to be. Polar's sandbox is a separate system rather
+// than a flag on the same one: you sign up for it separately, the organization
+// you create there does not exist in production, and its id is different. A
+// single id shared across both modes builds a client that talks to
+// api.polar.sh while naming a sandbox organization — every activation by a
+// real buyer fails, and it fails on the first day of selling rather than in
+// any amount of sandbox testing. Paired with POLAR_BASE_URL below so the two
+// can only be changed together.
+export const POLAR_ORGANIZATION_ID = {
+  live: '75b98aba-8768-4534-9b76-dd7f16cba3d3',
+  sandbox: 'c234fc61-20e4-4d6f-b919-0f5823f7984d',
+};
+export const POLAR_BASE_URL = {
+  live: 'https://api.polar.sh',
+  sandbox: 'https://sandbox-api.polar.sh',
+};
+
+// The License Keys benefit this product sells. The organization is not enough
+// to identify a key: every product under the same organization validates
+// against the same endpoint with the same organization id, so the moment a
+// second product sells from here, a key bought for THAT product activates this
+// one. A paying customer of one tool silently unlocking another is not a bug
+// anyone reports.
+//
+// Polar returns the benefit on both activate and validate, so the check costs
+// nothing and closes it. Keyed by mode for the same reason the organization is
+// — a sandbox benefit does not exist in production.
+//
+// A LIST per mode, one entry per paid tier. Polar carries limit_activations on
+// the benefit, not the product, so tiers with different device caps cannot share
+// one — the individual seat and the team seat are necessarily separate benefits.
+// A key is accepted when it matches ANY entry; the tier it belongs to is Polar's
+// business, not the CLI's.
+//
+// Nothing may appear in both lists: an id reachable from either environment
+// would let a sandbox key unlock a live install.
+export const POLAR_BENEFIT_ID = {
+  // [0] individual seat, [1] team seat. Order is not significance — a key is
+  // accepted on any match — but it is the order the walk tries, so the tier
+  // that sells most often belongs first.
+  live: [
+    'b85a9271-22ac-45b3-ab0a-b0c93df6b13c',
+    'be046860-7be4-43bd-ac8b-cf47d08f77d0',
+    'a3fc4e93-9e93-4317-bed5-5b44a5af9e19',
+  ],
+  sandbox: [
+    '69d1ccaa-65c4-48da-ad4a-64961772c17e',
+    'a540043d-da17-48ae-bee6-e9a900fbe1cc',
+    '9c5fe82d-09a7-490c-91e3-47d164603423',
+  ],
+};
+
+// Which of the benefits above are TRIALS. A trial key validates like any other
+// — it has to appear in POLAR_BENEFIT_ID as well — but it additionally claims
+// the machine, so one device cannot start a second trial under a new email.
+//
+// Listed separately rather than encoded in the entries above so phase 01's
+// shape and its tests stay untouched. A test pins that every id here also
+// appears in POLAR_BENEFIT_ID: an id in only one list is a trial key nobody can
+// activate, or a paid key that silently burns a device claim.
+//
+// The licence-key benefit on each trial product must be VISIBLE in Polar: the
+// buyer has to read the key out of the portal or the confirmation email to type
+// it into `clawform activate`. A hidden benefit is granted and unusable.
+export const POLAR_TRIAL_BENEFIT_ID = {
+  live: ['a3fc4e93-9e93-4317-bed5-5b44a5af9e19'],
+  sandbox: ['9c5fe82d-09a7-490c-91e3-47d164603423'],
+};
+
+// --- Content kit delivery -----------------------------------------------
+// The plugin content (skills/commands/agents/rules/templates) is NOT in the npm
+// tarball. It is fetched by `clawform init plugin` from this service, which
+// checks the licence with the vendor before serving anything.
+//
+// The previous model shipped the content as an encrypted blob with its key
+// beside it in the same tarball — which protected nothing: `npm i` handed a
+// non-buyer both halves. There is no key here now because the CLI never
+// decrypts; the bundle lives in a private bucket and travels over TLS.
+//
+// Not keyed by licence mode. There is one kit, and which licences may have it
+// is the service's judgement, not a build-time constant.
+export const KIT_SERVICE_URL = 'https://kit.thejoseki.com';
+
+// Written by scripts/pack-payload.js for upload, and cached under the vendor
+// home after a successful fetch. Never present in the published package.
+export const KIT_FILENAME = 'kit.bin';
+
+// Signs the local licence record. The gate trusts an 'active' record with a
+// fresh timestamp without calling the vendor, so an unsigned cache would make
+// `echo '{"status":"active",…}' > ~/.clawform/license.json` a complete bypass —
+// and a shareable one-liner at that. Signing raises it to "extract this secret
+// from the CLI first", the same bar as the dev marker.
+//
+// Same 1a honesty as PAYLOAD_KEY_HEX: the secret ships with the code, so a
+// determined attacker can still forge. The goal is killing the one-liner class.
+// Distinct from the payload key on purpose — keys with different jobs.
+//
+// Rotates alongside the payload key, and for the same reason: a release that
+// published this value hands every later release a forged 'active' record.
+// The cost is that records signed with the old secret read as unlicensed, so a
+// buyer re-activates — cheap now, and it only gets dearer with every seat sold.
+export const LICENSE_RECORD_SECRET_HEX = 'c4179ff7c3e2ebd223fdb2653ed1163f5b8cb89c7900af2a88f186fbb55818e5';
+
+// Tolerance for a machine clock running slightly ahead of the vendor's. Beyond
+// it, a future `lastValidatedAt` is treated as needing revalidation rather than
+// as an eternally fresh verdict.
+export const CLOCK_SKEW_HOURS = 1;
+
+// How a build tells whether it is a source checkout or an installed package.
+// This file is the payload build script — `package.json` `files` never ships
+// `scripts/`, so it is present in a clone and absent in `npm i -g @thejoseki/clawform`.
+//
+// Dormancy is granted by the install SHAPE, not by anything a buyer can set:
+// a `CLAWFORM_LICENSE_MODE=off` that disabled the gate would be a
+// copy-pasteable one-liner, the one bypass class that actually spreads.
+// Faking dormancy now means creating this file inside the installed package —
+// an edit, not a one-liner.
+//
+// ⚠️ Adding `scripts/` to `package.json` `files` would ship the marker and
+// silently disable enforcement for everyone. A packaging test asserts it stays
+// out of the tarball.
+export const DEV_MARKER = 'scripts/pack-payload.js';
+
+// The master switch, and the single decision that turns enforcement on.
+//
+// Held at 'off' through development, because enforcing before a key could be
+// bought would have locked out every user with no way back in. It moved to
+// 'live' only once all three preconditions were verified against the
+// production vendor rather than assumed:
+//
+//   - a Polar product exists with a License Keys benefit, activation limit 3
+//   - a real purchased key drives activate / validate / deactivate, the
+//     three-device cap refuses a fourth machine, and deactivate demonstrably
+//     frees a slot (proved by re-activating, not by the return code)
+//   - the sandbox and production environments reject each other's keys, which
+//     is what makes the per-mode organization and benefit ids load-bearing
+//
+// A source checkout stays dormant regardless: that exemption comes from the
+// dev marker's presence, not from this value, so contributors need no key.
+// Overridable per run via CLAWFORM_LICENSE_MODE, which can raise enforcement
+// but never lower it.
+export const LICENSE_MODE_DEFAULT = 'live';