@thejoseki/clawform 2.3.0 → 2.3.2

package/src/aws/inventory.js

@@ -1,156 +1,156 @@
-import { paginateListStacks } from '@aws-sdk/client-cloudformation';
-
-export const STALE_DAYS = 180;
-
-const LIVE_STATUSES = [
-  'CREATE_COMPLETE',
-  'UPDATE_COMPLETE',
-  'UPDATE_ROLLBACK_COMPLETE',
-  'IMPORT_COMPLETE',
-];
-
-const hasLegacyPrefix = (name, prefixes) => prefixes.some((p) => name.startsWith(p + '-'));
-
-const SERVERLESS_DESC_RE = /Serverless application/i;
-
-export async function fetchStacks(client) {
-  const stacks = [];
-  for await (const page of paginateListStacks(
-    { client },
-    { StackStatusFilter: LIVE_STATUSES },
-  )) {
-    for (const s of page.StackSummaries ?? []) {
-      stacks.push({
-        name: s.StackName,
-        status: s.StackStatus,
-        templateDescription: s.TemplateDescription,
-        creationTime: s.CreationTime,
-        lastUpdatedTime: s.LastUpdatedTime,
-      });
-    }
-  }
-  return stacks;
-}
-
-export function classifyStacks(stacks, now = new Date(), legacyPrefixes = []) {
-  // legacyPrefixes comes from the consumer's clawform.config.json. Empty = a fresh
-  // consumer with no legacy stacks; nothing gets routed to the `legacy` bucket.
-  const result = { legacy: [], serverless: [], active: [], stale: [] };
-  const staleMs = STALE_DAYS * 24 * 60 * 60 * 1000;
-  for (const s of stacks) {
-    if (hasLegacyPrefix(s.name, legacyPrefixes)) {
-      result.legacy.push(s);
-      continue;
-    }
-    if (SERVERLESS_DESC_RE.test(s.templateDescription ?? '')) {
-      result.serverless.push(s);
-      continue;
-    }
-    const lastTouch = s.lastUpdatedTime ?? s.creationTime;
-    const ageMs = lastTouch ? now.getTime() - new Date(lastTouch).getTime() : 0;
-    if (ageMs > staleMs) result.stale.push(s);
-    else result.active.push(s);
-  }
-  return result;
-}
-
-function fmtDate(d) {
-  if (!d) return '';
-  return new Date(d).toISOString().slice(0, 10);
-}
-
-function escapePipe(s) {
-  return String(s ?? '').replace(/\|/g, '\\|');
-}
-
-function renderSection(lines, title, items, headers, fmtRow) {
-  lines.push(`## ${title} (${items.length})`, '');
-  if (items.length === 0) {
-    lines.push('_None_', '');
-    return;
-  }
-  lines.push('| ' + headers.join(' | ') + ' |');
-  lines.push('|' + headers.map(() => '---').join('|') + '|');
-  const sorted = [...items].sort((a, b) => a.name.localeCompare(b.name));
-  for (const it of sorted) {
-    lines.push('| ' + fmtRow(it).map((v) => `\`${escapePipe(v)}\``).join(' | ') + ' |');
-  }
-  lines.push('');
-}
-
-export function renderInventory(classified, meta) {
-  const lines = [
-    '# CloudFormation Stacks Inventory',
-    '',
-    `> Generated by \`clawform sync\` at ${meta.generatedAt}`,
-    `> Account: ${meta.account} · Region: ${meta.region}`,
-    '',
-  ];
-
-  renderSection(
-    lines,
-    '🔒 Legacy (refuse modify — see rules/legacy-freeze.md)',
-    classified.legacy,
-    ['Stack', 'Status', 'Last update'],
-    (s) => [s.name, s.status, fmtDate(s.lastUpdatedTime ?? s.creationTime)],
-  );
-
-  renderSection(
-    lines,
-    '🛠️ Serverless Framework (managed by `sls` tool — modify via serverless.yml)',
-    classified.serverless,
-    ['Stack', 'Status'],
-    (s) => [s.name, s.status],
-  );
-
-  renderSection(
-    lines,
-    '✅ Active (Clawform-modifiable)',
-    classified.active,
-    ['Stack', 'Status', 'Last update'],
-    (s) => [s.name, s.status, fmtDate(s.lastUpdatedTime ?? s.creationTime)],
-  );
-
-  renderSection(
-    lines,
-    `💤 Stale (≥${STALE_DAYS} days no update — review/decommission)`,
-    classified.stale,
-    ['Stack', 'Last update'],
-    (s) => [s.name, fmtDate(s.lastUpdatedTime ?? s.creationTime)],
-  );
-
-  return lines.join('\n');
-}
-
-const SECTION_KEY_BY_TITLE_FRAGMENT = [
-  ['Legacy', 'legacy'],
-  ['Serverless', 'serverless'],
-  ['Active', 'active'],
-  ['Stale', 'stale'],
-];
-
-function sectionKeyFromTitle(title) {
-  const hit = SECTION_KEY_BY_TITLE_FRAGMENT.find(([fragment]) => title.includes(fragment));
-  return hit ? hit[1] : null;
-}
-
-// Read-back counterpart to renderInventory — recovers the stack list from a
-// committed .clawform/catalog/stacks-inventory.md without a live AWS call. Used by the
-// project-audit workflow (Phase 3), which runs with no network access.
-export function parseInventory(markdown) {
-  const result = { legacy: [], serverless: [], active: [], stale: [] };
-  let currentKey = null;
-  for (const line of markdown.split(/\r?\n/)) {
-    const heading = line.match(/^## (.+?) \(\d+\)$/);
-    if (heading) {
-      currentKey = sectionKeyFromTitle(heading[1]);
-      continue;
-    }
-    if (!currentKey || !line.startsWith('| ')) continue;
-    const cells = line.split('|').map((c) => c.trim()).filter(Boolean);
-    if (cells.length === 0 || cells[0] === 'Stack') continue;
-    const name = cells[0].replace(/^`|`$/g, '');
-    result[currentKey].push(name);
-  }
-  return result;
-}
+import { paginateListStacks } from '@aws-sdk/client-cloudformation';
+
+export const STALE_DAYS = 180;
+
+const LIVE_STATUSES = [
+  'CREATE_COMPLETE',
+  'UPDATE_COMPLETE',
+  'UPDATE_ROLLBACK_COMPLETE',
+  'IMPORT_COMPLETE',
+];
+
+const hasLegacyPrefix = (name, prefixes) => prefixes.some((p) => name.startsWith(p + '-'));
+
+const SERVERLESS_DESC_RE = /Serverless application/i;
+
+export async function fetchStacks(client) {
+  const stacks = [];
+  for await (const page of paginateListStacks(
+    { client },
+    { StackStatusFilter: LIVE_STATUSES },
+  )) {
+    for (const s of page.StackSummaries ?? []) {
+      stacks.push({
+        name: s.StackName,
+        status: s.StackStatus,
+        templateDescription: s.TemplateDescription,
+        creationTime: s.CreationTime,
+        lastUpdatedTime: s.LastUpdatedTime,
+      });
+    }
+  }
+  return stacks;
+}
+
+export function classifyStacks(stacks, now = new Date(), legacyPrefixes = []) {
+  // legacyPrefixes comes from the consumer's clawform.config.json. Empty = a fresh
+  // consumer with no legacy stacks; nothing gets routed to the `legacy` bucket.
+  const result = { legacy: [], serverless: [], active: [], stale: [] };
+  const staleMs = STALE_DAYS * 24 * 60 * 60 * 1000;
+  for (const s of stacks) {
+    if (hasLegacyPrefix(s.name, legacyPrefixes)) {
+      result.legacy.push(s);
+      continue;
+    }
+    if (SERVERLESS_DESC_RE.test(s.templateDescription ?? '')) {
+      result.serverless.push(s);
+      continue;
+    }
+    const lastTouch = s.lastUpdatedTime ?? s.creationTime;
+    const ageMs = lastTouch ? now.getTime() - new Date(lastTouch).getTime() : 0;
+    if (ageMs > staleMs) result.stale.push(s);
+    else result.active.push(s);
+  }
+  return result;
+}
+
+function fmtDate(d) {
+  if (!d) return '';
+  return new Date(d).toISOString().slice(0, 10);
+}
+
+function escapePipe(s) {
+  return String(s ?? '').replace(/\|/g, '\\|');
+}
+
+function renderSection(lines, title, items, headers, fmtRow) {
+  lines.push(`## ${title} (${items.length})`, '');
+  if (items.length === 0) {
+    lines.push('_None_', '');
+    return;
+  }
+  lines.push('| ' + headers.join(' | ') + ' |');
+  lines.push('|' + headers.map(() => '---').join('|') + '|');
+  const sorted = [...items].sort((a, b) => a.name.localeCompare(b.name));
+  for (const it of sorted) {
+    lines.push('| ' + fmtRow(it).map((v) => `\`${escapePipe(v)}\``).join(' | ') + ' |');
+  }
+  lines.push('');
+}
+
+export function renderInventory(classified, meta) {
+  const lines = [
+    '# CloudFormation Stacks Inventory',
+    '',
+    `> Generated by \`clawform sync\` at ${meta.generatedAt}`,
+    `> Account: ${meta.account} · Region: ${meta.region}`,
+    '',
+  ];
+
+  renderSection(
+    lines,
+    '🔒 Legacy (refuse modify — see rules/legacy-freeze.md)',
+    classified.legacy,
+    ['Stack', 'Status', 'Last update'],
+    (s) => [s.name, s.status, fmtDate(s.lastUpdatedTime ?? s.creationTime)],
+  );
+
+  renderSection(
+    lines,
+    '🛠️ Serverless Framework (managed by `sls` tool — modify via serverless.yml)',
+    classified.serverless,
+    ['Stack', 'Status'],
+    (s) => [s.name, s.status],
+  );
+
+  renderSection(
+    lines,
+    '✅ Active (Clawform-modifiable)',
+    classified.active,
+    ['Stack', 'Status', 'Last update'],
+    (s) => [s.name, s.status, fmtDate(s.lastUpdatedTime ?? s.creationTime)],
+  );
+
+  renderSection(
+    lines,
+    `💤 Stale (≥${STALE_DAYS} days no update — review/decommission)`,
+    classified.stale,
+    ['Stack', 'Last update'],
+    (s) => [s.name, fmtDate(s.lastUpdatedTime ?? s.creationTime)],
+  );
+
+  return lines.join('\n');
+}
+
+const SECTION_KEY_BY_TITLE_FRAGMENT = [
+  ['Legacy', 'legacy'],
+  ['Serverless', 'serverless'],
+  ['Active', 'active'],
+  ['Stale', 'stale'],
+];
+
+function sectionKeyFromTitle(title) {
+  const hit = SECTION_KEY_BY_TITLE_FRAGMENT.find(([fragment]) => title.includes(fragment));
+  return hit ? hit[1] : null;
+}
+
+// Read-back counterpart to renderInventory — recovers the stack list from a
+// committed .clawform/catalog/stacks-inventory.md without a live AWS call. Used by the
+// project-audit workflow (Phase 3), which runs with no network access.
+export function parseInventory(markdown) {
+  const result = { legacy: [], serverless: [], active: [], stale: [] };
+  let currentKey = null;
+  for (const line of markdown.split(/\r?\n/)) {
+    const heading = line.match(/^## (.+?) \(\d+\)$/);
+    if (heading) {
+      currentKey = sectionKeyFromTitle(heading[1]);
+      continue;
+    }
+    if (!currentKey || !line.startsWith('| ')) continue;
+    const cells = line.split('|').map((c) => c.trim()).filter(Boolean);
+    if (cells.length === 0 || cells[0] === 'Stack') continue;
+    const name = cells[0].replace(/^`|`$/g, '');
+    result[currentKey].push(name);
+  }
+  return result;
+}

package/src/commands/activate.js

@@ -4,7 +4,7 @@
 
 import { logger } from '../lib/logger.js';
 import { resolveClient, resolveTrialBenefitIds } from '../lib/license-client.js';
-import { writeLicense } from '../lib/license-store.js';
+import { writeLicense, readLicenseRaw } from '../lib/license-store.js';
 import { machineFingerprint } from '../lib/fingerprint.js';
 import { claimTrialDevice } from '../lib/trial-claim.js';
 
@@ -12,6 +12,7 @@ const maskKey = (key) => `…${String(key).slice(-4)}`;
 
 export default async function activate({ key } = {}, {
   client = resolveClient(),
+  read = readLicenseRaw,
   write = writeLicense,
   fingerprint = machineFingerprint,
   trialBenefitIds = resolveTrialBenefitIds(),
@@ -25,6 +26,37 @@ export default async function activate({ key } = {}, {
 
   const fp = fingerprint();
 
+  // Idempotent re-activation. Polar offers no key-only "list activations", so a
+  // re-run would otherwise POST a brand-new activation every time and burn a
+  // slot — the leak that locks a user out after `limit_activations` upgrades.
+  // Instead, if this machine's local record already points at an activation for
+  // THIS key, probe it with `validate(key, instanceId)`; if the vendor still
+  // honours it, re-adopt it (and re-sign the record, healing a stale one and
+  // stamping the CURRENT fingerprint) without minting a second slot. Only when
+  // the stored slot is gone/invalid do we fall through to a fresh activation.
+  //
+  // The slot's validity is judged SERVER-SIDE, not by matching the stored
+  // fingerprint: on Windows/macOS the fingerprint has no stable machine-id and
+  // shifts when the hostname changes (rename, MDM, DHCP), so a fingerprint guard
+  // would skip the reuse and re-create exactly the leak this fixes. The record
+  // is per-machine local state (~/.clawform), so a key match is the identity
+  // that matters. Deliberately BEFORE the trial-claim block: an already-activated
+  // machine must not re-claim a trial.
+  const prior = read();
+  if (prior.status === 'active' && prior.key === key && prior.instanceId) {
+    let check = null;
+    try { check = await client.validate(key, prior.instanceId); } catch { /* fall through to a fresh activate */ }
+    if (check?.status === 'valid') {
+      write({
+        status: 'active', key, instanceId: prior.instanceId, holder: prior.holder,
+        fingerprint: fp, lastValidatedAt: new Date(now()).toISOString(),
+        ...(check.expiresAt ? { expiresAt: check.expiresAt } : (prior.expiresAt ? { expiresAt: prior.expiresAt } : {})),
+      });
+      log(`License ${maskKey(key)} — re-adopted this machine's existing activation. No extra seat used.`);
+      return;
+    }
+  }
+
   // Which tier this key belongs to decides whether our own service is consulted
   // at all. A PAID activation must never depend on it: someone who has just
   // paid, blocked by our downtime, is the failure the deploy/rollback invariant
@@ -49,7 +81,7 @@ export default async function activate({ key } = {}, {
     if (claim && claim.allowed === false) {
       throw new Error(
         'This machine has already used a Clawform trial, so a second one cannot start here. '
-        + 'Buy a seat at https://clawform.thejoseki.com — or, if you believe this is a mistake, '
+        + 'Buy a seat at https://clawform.thejoseki.com/?utm_source=cli — or, if you believe this is a mistake, '
         + 'write to support@thejoseki.com and it will be sorted out by a person.',
       );
     }