@thejoseki/clawform 2.3.1 → 2.3.2

package/src/lib/license-store.js

@@ -31,7 +31,11 @@ export const LICENSE_VERSION = 1;
 function licenseDir(home) { return join(home, LICENSE_DIR); }
 function licensePath(home) { return join(licenseDir(home), LICENSE_FILENAME); }
 
-function unlicensed() { return { v: LICENSE_VERSION, status: 'unlicensed' }; }
+// `reason` lets a caller tell an ABSENT record (never activated) from a STALE
+// one (an older Clawform wrote it; this version can't verify its signature) so
+// the CLI can say "refresh it" instead of "your key is gone". It carries no
+// grant — status is still 'unlicensed'.
+function unlicensed(reason = 'absent') { return { v: LICENSE_VERSION, status: 'unlicensed', reason }; }
 
 // Fields that a signature covers. Fixed order, so the digest depends on the
 // content and not on the order the caller happened to build the object in.
@@ -66,19 +70,50 @@ export function readLicense({ homedir = osHomedir, readFileSync = fsRead } = {})
   try {
     raw = readFileSync(licensePath(homedir()), 'utf8');
   } catch {
-    return unlicensed();
+    return unlicensed('absent');
   }
   try {
     const parsed = JSON.parse(raw);
-    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return unlicensed();
-    if (parsed.v !== LICENSE_VERSION || typeof parsed.status !== 'string') return unlicensed();
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return unlicensed('corrupt');
+    if (parsed.v !== LICENSE_VERSION || typeof parsed.status !== 'string') {
+      // A parseable record that still LOOKS like a licence but was written under
+      // a different schema version is STALE, not junk — the caller can offer a
+      // cheap refresh rather than "your key is gone".
+      return (parsed.status === 'active' && parsed.key) ? unlicensed('stale') : unlicensed('corrupt');
+    }
     // An unsigned or altered 'active' record is not a licence — it is exactly
-    // the forgery the signature exists to catch. 'unlicensed' claims nothing,
-    // so it needs no proof.
-    if (parsed.status === 'active' && !signatureValid(parsed)) return unlicensed();
+    // the forgery the signature exists to catch. But a record we WROTE whose
+    // signed field-set later changed (e.g. a new field was added to the schema)
+    // also fails here; both surface as 'stale' so re-activation, not accusation,
+    // is offered. 'unlicensed' claims nothing, so this grants nothing.
+    if (parsed.status === 'active' && !signatureValid(parsed)) return unlicensed('stale');
     return parsed;
   } catch {
-    return unlicensed();
+    return unlicensed('corrupt');
+  }
+}
+
+// Parse the record WITHOUT verifying the signature. RECOVERY ONLY: callers use
+// it to recover `instanceId`/`key` so an activation can be re-adopted or an
+// orphaned slot released. It grants NOTHING — an 'active' status here is not
+// proof of a licence (only a server-side `validate` is), and the worst a forged
+// record achieves through this path is deactivating an activation, never a free
+// entitlement. That asymmetry is why bypassing the signature is safe here and
+// never in `readLicense`.
+export function readLicenseRaw({ homedir = osHomedir, readFileSync = fsRead } = {}) {
+  let raw;
+  try {
+    raw = readFileSync(licensePath(homedir()), 'utf8');
+  } catch {
+    return unlicensed('absent');
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return unlicensed('corrupt');
+    if (parsed.status === 'active' && parsed.key) return parsed;
+    return unlicensed('absent');
+  } catch {
+    return unlicensed('corrupt');
   }
 }
 

package/src/lib/license.js

@@ -1,150 +1,163 @@
-// License enforcement decision — the one function value commands call before
-// doing work. Everything impure is injected (store, clock, validation client,
-// env) so the state matrix tests deterministically; production call sites pass
-// nothing and get the real store + adapter.
-//
-// The client seam is vendor-agnostic on purpose: whichever vendor survives the
-// payout test implements `validate(key) → { status, reason? }` with statuses
-//   'valid'    — vendor confirmed the key
-//   'invalid'  — vendor answered and said no (revoked / refunded / not found)
-//   'error'    — vendor unreachable (network down, vendor outage)
-// The distinction between 'invalid' and 'error' is the whole design: outages
-// get the offline grace window, revocations do not.
-
-import { readLicense as storeRead, writeLicense as storeWrite } from './license-store.js';
-import { readEnv } from './rename-compat.js';
-import { logger } from './logger.js';
-import { GRACE_DAYS, REVALIDATE_HOURS, CLOCK_SKEW_HOURS } from './license-config.js';
-
-// Emergency operations are never license-gated: an expired card must not be
-// the reason a stuck production stack cannot be rolled back. Additions to this
-// list are a product decision, not a convenience — a test pins its contents.
-export const NEVER_GATED = new Set(['deploy', 'rollback']);
-
-const HOUR = 3_600_000;
-const DAY = 24 * HOUR;
-
-function hoursSince(iso, nowMs) {
-  const t = Date.parse(iso ?? '');
-  return Number.isFinite(t) ? (nowMs - t) / HOUR : Infinity;
-}
-
-export async function assertLicensed({
-  command,
-  readLicense = storeRead,
-  writeLicense = storeWrite,
-  client,
-  now = Date.now,
-  env = process.env,
-  warn = (m) => logger.warn(m),
-} = {}) {
-  if (NEVER_GATED.has(command)) return;
-
-  // Dormant gate: until a vendor adapter ships, there is no way to activate a
-  // key at all, so enforcement would lock every user out. A client that marks
-  // itself configured:false keeps the gate open; the adapter flips this, and a
-  // pinned test makes that flip a reviewed decision.
-  if (client?.configured === false) return;
-
-  // CI path: a key in the environment is validated on every run and nothing is
-  // persisted — CI boxes are ephemeral, so a local cache (and with it the
-  // offline grace window) would be meaningless there.
-  const envKey = readEnv('LICENSE_KEY', env);
-  if (envKey) {
-    const res = await client.validate(envKey);
-    if (res.status === 'valid') return;
-    if (res.status === 'invalid') {
-      throw new Error(
-        `CLAWFORM_LICENSE_KEY was rejected (${res.reason ?? 'invalid'}). ` +
-        'Check the key, or buy a seat — see the README for where.',
-      );
-    }
-    throw new Error(
-      `Could not verify CLAWFORM_LICENSE_KEY (${res.reason ?? 'network error'}) and CI has no ` +
-      'offline grace. Retry when the license service is reachable.',
-    );
-  }
-
-  const record = readLicense();
-  if (record.status !== 'active' || !record.key) {
-    throw new Error(
-      // The one message every npm installer without a key will read — the only
-      // audience the product reliably has. It leads with the door that costs
-      // nothing, then the one for a key already bought.
-      `'clawform ${command}' needs an activated license. ` +
-      'New here? There is a free 14-day trial — full kit, no card — at https://clawform.thejoseki.com/?utm_source=cli. ' +
-      'Already have a key (trial or purchase email)? Run: clawform activate <key>',
-    );
-  }
-
-  // A trial carries its own end date, handed over by the vendor at activation
-  // and covered by the record's signature so it cannot be edited outward.
-  //
-  // Checked BEFORE the freshness shortcut below, which returns without touching
-  // the network: a recently-validated record would otherwise sail past its own
-  // expiry for another day.
-  //
-  // Expiry is a property of the licence, not of connectivity, so the offline
-  // grace never reaches it — and the message says "trial", never "offline". A
-  // buyer told their connection failed will go looking for a fault that is not
-  // there.
-  //
-  // A record with no expiresAt is a perpetual seat, not one that expired at the
-  // epoch. Absence has to be checked explicitly.
-  if (record.expiresAt) {
-    const endsAt = Date.parse(record.expiresAt);
-    if (Number.isFinite(endsAt) && now() >= endsAt) {
-      throw new Error(
-        `Your Clawform trial ended on ${record.expiresAt.slice(0, 10)}, so 'clawform ${command}' `
-        + 'is no longer available. Buy a seat at https://clawform.thejoseki.com/?utm_source=cli and run '
-        + '`clawform activate <key>`. Note that `clawform deploy` and `clawform rollback` keep '
-        + 'working either way — an expired licence never strands a stack.',
-      );
-    }
-  }
-
-  // Freshness has a floor as well as a ceiling. A record stamped in the future
-  // yields a negative age, which would read as "verified moments ago" forever —
-  // a permanent bypass that never contacts the vendor again. Below the floor we
-  // revalidate rather than refuse, so a genuinely fast clock costs a network
-  // call instead of an accusation.
-  const age = hoursSince(record.lastValidatedAt, now());
-  if (age >= -CLOCK_SKEW_HOURS && age < REVALIDATE_HOURS) return; // fresh verdict — no network
-
-  const res = await client.validate(record.key);
-
-  if (res.status === 'valid') {
-    // Carry a refreshed expiry through: the vendor is authoritative about it,
-    // and an extended trial should take effect without a re-activation.
-    writeLicense({
-      ...record,
-      lastValidatedAt: new Date(now()).toISOString(),
-      ...(res.expiresAt ? { expiresAt: res.expiresAt } : {}),
-    });
-    return;
-  }
-
-  if (res.status === 'invalid') {
-    throw new Error(
-      `This license is no longer valid (${res.reason ?? 'revoked'}). ` +
-      'If you believe this is a mistake, contact support with your purchase email.',
-    );
-  }
-
-  // Vendor unreachable — fall back on the grace window measured from the last
-  // SUCCESSFUL validation, so a machine that keeps failing to validate does not
-  // keep re-arming its own grace.
-  const graceLeftDays = GRACE_DAYS - age / 24;
-  if (graceLeftDays > 0) {
-    warn(
-      `Could not reach the license service to verify (${res.reason ?? 'offline'}). ` +
-      `Working offline — ${Math.ceil(graceLeftDays)} day(s) of grace remaining.`,
-    );
-    return;
-  }
-
-  throw new Error(
-    `The license could not be verified for more than ${GRACE_DAYS} days (offline or the ` +
-    'license service was unreachable). Reconnect once and the grace window resets.',
-  );
-}
+// License enforcement decision — the one function value commands call before
+// doing work. Everything impure is injected (store, clock, validation client,
+// env) so the state matrix tests deterministically; production call sites pass
+// nothing and get the real store + adapter.
+//
+// The client seam is vendor-agnostic on purpose: whichever vendor survives the
+// payout test implements `validate(key) → { status, reason? }` with statuses
+//   'valid'    — vendor confirmed the key
+//   'invalid'  — vendor answered and said no (revoked / refunded / not found)
+//   'error'    — vendor unreachable (network down, vendor outage)
+// The distinction between 'invalid' and 'error' is the whole design: outages
+// get the offline grace window, revocations do not.
+
+import { readLicense as storeRead, writeLicense as storeWrite } from './license-store.js';
+import { readEnv } from './rename-compat.js';
+import { logger } from './logger.js';
+import { GRACE_DAYS, REVALIDATE_HOURS, CLOCK_SKEW_HOURS } from './license-config.js';
+
+// Emergency operations are never license-gated: an expired card must not be
+// the reason a stuck production stack cannot be rolled back. Additions to this
+// list are a product decision, not a convenience — a test pins its contents.
+export const NEVER_GATED = new Set(['deploy', 'rollback']);
+
+const HOUR = 3_600_000;
+const DAY = 24 * HOUR;
+
+function hoursSince(iso, nowMs) {
+  const t = Date.parse(iso ?? '');
+  return Number.isFinite(t) ? (nowMs - t) / HOUR : Infinity;
+}
+
+export async function assertLicensed({
+  command,
+  readLicense = storeRead,
+  writeLicense = storeWrite,
+  client,
+  now = Date.now,
+  env = process.env,
+  warn = (m) => logger.warn(m),
+} = {}) {
+  if (NEVER_GATED.has(command)) return;
+
+  // Dormant gate: until a vendor adapter ships, there is no way to activate a
+  // key at all, so enforcement would lock every user out. A client that marks
+  // itself configured:false keeps the gate open; the adapter flips this, and a
+  // pinned test makes that flip a reviewed decision.
+  if (client?.configured === false) return;
+
+  // CI path: a key in the environment is validated on every run and nothing is
+  // persisted — CI boxes are ephemeral, so a local cache (and with it the
+  // offline grace window) would be meaningless there.
+  const envKey = readEnv('LICENSE_KEY', env);
+  if (envKey) {
+    const res = await client.validate(envKey);
+    if (res.status === 'valid') return;
+    if (res.status === 'invalid') {
+      throw new Error(
+        `CLAWFORM_LICENSE_KEY was rejected (${res.reason ?? 'invalid'}). ` +
+        'Check the key, or buy a seat — see the README for where.',
+      );
+    }
+    throw new Error(
+      `Could not verify CLAWFORM_LICENSE_KEY (${res.reason ?? 'network error'}) and CI has no ` +
+      'offline grace. Retry when the license service is reachable.',
+    );
+  }
+
+  const record = readLicense();
+  if (record.status !== 'active' || !record.key) {
+    if (record.reason === 'stale') {
+      // The record is on disk and looks like a licence, but an older Clawform
+      // wrote it and this version can't verify it. Saying "needs a license"
+      // reads as "my key is gone" — the exact panic that filed this bug. Point
+      // at the cheap fix: activate re-adopts the existing slot when it is still
+      // valid, so no extra seat is spent.
+      throw new Error(
+        `'clawform ${command}' can't run: this machine has a Clawform license record an older version ` +
+        `wrote, which this version cannot read. Run: clawform activate <key> — it re-adopts this machine's ` +
+        `existing activation when that is still valid, so it will not use another seat. ` +
+        `(Your key is in your trial or purchase email.)`,
+      );
+    }
+    throw new Error(
+      // The one message every npm installer without a key will read — the only
+      // audience the product reliably has. It leads with the door that costs
+      // nothing, then the one for a key already bought.
+      `'clawform ${command}' needs an activated license. ` +
+      'New here? There is a free 14-day trial — full kit, no card — at https://clawform.thejoseki.com/?utm_source=cli. ' +
+      'Already have a key (trial or purchase email)? Run: clawform activate <key>',
+    );
+  }
+
+  // A trial carries its own end date, handed over by the vendor at activation
+  // and covered by the record's signature so it cannot be edited outward.
+  //
+  // Checked BEFORE the freshness shortcut below, which returns without touching
+  // the network: a recently-validated record would otherwise sail past its own
+  // expiry for another day.
+  //
+  // Expiry is a property of the licence, not of connectivity, so the offline
+  // grace never reaches it — and the message says "trial", never "offline". A
+  // buyer told their connection failed will go looking for a fault that is not
+  // there.
+  //
+  // A record with no expiresAt is a perpetual seat, not one that expired at the
+  // epoch. Absence has to be checked explicitly.
+  if (record.expiresAt) {
+    const endsAt = Date.parse(record.expiresAt);
+    if (Number.isFinite(endsAt) && now() >= endsAt) {
+      throw new Error(
+        `Your Clawform trial ended on ${record.expiresAt.slice(0, 10)}, so 'clawform ${command}' `
+        + 'is no longer available. Buy a seat at https://clawform.thejoseki.com/?utm_source=cli and run '
+        + '`clawform activate <key>`. Note that `clawform deploy` and `clawform rollback` keep '
+        + 'working either way — an expired licence never strands a stack.',
+      );
+    }
+  }
+
+  // Freshness has a floor as well as a ceiling. A record stamped in the future
+  // yields a negative age, which would read as "verified moments ago" forever —
+  // a permanent bypass that never contacts the vendor again. Below the floor we
+  // revalidate rather than refuse, so a genuinely fast clock costs a network
+  // call instead of an accusation.
+  const age = hoursSince(record.lastValidatedAt, now());
+  if (age >= -CLOCK_SKEW_HOURS && age < REVALIDATE_HOURS) return; // fresh verdict — no network
+
+  const res = await client.validate(record.key);
+
+  if (res.status === 'valid') {
+    // Carry a refreshed expiry through: the vendor is authoritative about it,
+    // and an extended trial should take effect without a re-activation.
+    writeLicense({
+      ...record,
+      lastValidatedAt: new Date(now()).toISOString(),
+      ...(res.expiresAt ? { expiresAt: res.expiresAt } : {}),
+    });
+    return;
+  }
+
+  if (res.status === 'invalid') {
+    throw new Error(
+      `This license is no longer valid (${res.reason ?? 'revoked'}). ` +
+      'If you believe this is a mistake, contact support with your purchase email.',
+    );
+  }
+
+  // Vendor unreachable — fall back on the grace window measured from the last
+  // SUCCESSFUL validation, so a machine that keeps failing to validate does not
+  // keep re-arming its own grace.
+  const graceLeftDays = GRACE_DAYS - age / 24;
+  if (graceLeftDays > 0) {
+    warn(
+      `Could not reach the license service to verify (${res.reason ?? 'offline'}). ` +
+      `Working offline — ${Math.ceil(graceLeftDays)} day(s) of grace remaining.`,
+    );
+    return;
+  }
+
+  throw new Error(
+    `The license could not be verified for more than ${GRACE_DAYS} days (offline or the ` +
+    'license service was unreachable). Reconnect once and the grace window resets.',
+  );
+}