@thejoseki/clawform 2.3.1 → 2.4.0

package/src/aws/inventory.js

@@ -1,156 +1,156 @@
-import { paginateListStacks } from '@aws-sdk/client-cloudformation';
-
-export const STALE_DAYS = 180;
-
-const LIVE_STATUSES = [
-  'CREATE_COMPLETE',
-  'UPDATE_COMPLETE',
-  'UPDATE_ROLLBACK_COMPLETE',
-  'IMPORT_COMPLETE',
-];
-
-const hasLegacyPrefix = (name, prefixes) => prefixes.some((p) => name.startsWith(p + '-'));
-
-const SERVERLESS_DESC_RE = /Serverless application/i;
-
-export async function fetchStacks(client) {
-  const stacks = [];
-  for await (const page of paginateListStacks(
-    { client },
-    { StackStatusFilter: LIVE_STATUSES },
-  )) {
-    for (const s of page.StackSummaries ?? []) {
-      stacks.push({
-        name: s.StackName,
-        status: s.StackStatus,
-        templateDescription: s.TemplateDescription,
-        creationTime: s.CreationTime,
-        lastUpdatedTime: s.LastUpdatedTime,
-      });
-    }
-  }
-  return stacks;
-}
-
-export function classifyStacks(stacks, now = new Date(), legacyPrefixes = []) {
-  // legacyPrefixes comes from the consumer's clawform.config.json. Empty = a fresh
-  // consumer with no legacy stacks; nothing gets routed to the `legacy` bucket.
-  const result = { legacy: [], serverless: [], active: [], stale: [] };
-  const staleMs = STALE_DAYS * 24 * 60 * 60 * 1000;
-  for (const s of stacks) {
-    if (hasLegacyPrefix(s.name, legacyPrefixes)) {
-      result.legacy.push(s);
-      continue;
-    }
-    if (SERVERLESS_DESC_RE.test(s.templateDescription ?? '')) {
-      result.serverless.push(s);
-      continue;
-    }
-    const lastTouch = s.lastUpdatedTime ?? s.creationTime;
-    const ageMs = lastTouch ? now.getTime() - new Date(lastTouch).getTime() : 0;
-    if (ageMs > staleMs) result.stale.push(s);
-    else result.active.push(s);
-  }
-  return result;
-}
-
-function fmtDate(d) {
-  if (!d) return '';
-  return new Date(d).toISOString().slice(0, 10);
-}
-
-function escapePipe(s) {
-  return String(s ?? '').replace(/\|/g, '\\|');
-}
-
-function renderSection(lines, title, items, headers, fmtRow) {
-  lines.push(`## ${title} (${items.length})`, '');
-  if (items.length === 0) {
-    lines.push('_None_', '');
-    return;
-  }
-  lines.push('| ' + headers.join(' | ') + ' |');
-  lines.push('|' + headers.map(() => '---').join('|') + '|');
-  const sorted = [...items].sort((a, b) => a.name.localeCompare(b.name));
-  for (const it of sorted) {
-    lines.push('| ' + fmtRow(it).map((v) => `\`${escapePipe(v)}\``).join(' | ') + ' |');
-  }
-  lines.push('');
-}
-
-export function renderInventory(classified, meta) {
-  const lines = [
-    '# CloudFormation Stacks Inventory',
-    '',
-    `> Generated by \`clawform sync\` at ${meta.generatedAt}`,
-    `> Account: ${meta.account} · Region: ${meta.region}`,
-    '',
-  ];
-
-  renderSection(
-    lines,
-    '🔒 Legacy (refuse modify — see rules/legacy-freeze.md)',
-    classified.legacy,
-    ['Stack', 'Status', 'Last update'],
-    (s) => [s.name, s.status, fmtDate(s.lastUpdatedTime ?? s.creationTime)],
-  );
-
-  renderSection(
-    lines,
-    '🛠️ Serverless Framework (managed by `sls` tool — modify via serverless.yml)',
-    classified.serverless,
-    ['Stack', 'Status'],
-    (s) => [s.name, s.status],
-  );
-
-  renderSection(
-    lines,
-    '✅ Active (Clawform-modifiable)',
-    classified.active,
-    ['Stack', 'Status', 'Last update'],
-    (s) => [s.name, s.status, fmtDate(s.lastUpdatedTime ?? s.creationTime)],
-  );
-
-  renderSection(
-    lines,
-    `💤 Stale (≥${STALE_DAYS} days no update — review/decommission)`,
-    classified.stale,
-    ['Stack', 'Last update'],
-    (s) => [s.name, fmtDate(s.lastUpdatedTime ?? s.creationTime)],
-  );
-
-  return lines.join('\n');
-}
-
-const SECTION_KEY_BY_TITLE_FRAGMENT = [
-  ['Legacy', 'legacy'],
-  ['Serverless', 'serverless'],
-  ['Active', 'active'],
-  ['Stale', 'stale'],
-];
-
-function sectionKeyFromTitle(title) {
-  const hit = SECTION_KEY_BY_TITLE_FRAGMENT.find(([fragment]) => title.includes(fragment));
-  return hit ? hit[1] : null;
-}
-
-// Read-back counterpart to renderInventory — recovers the stack list from a
-// committed .clawform/catalog/stacks-inventory.md without a live AWS call. Used by the
-// project-audit workflow (Phase 3), which runs with no network access.
-export function parseInventory(markdown) {
-  const result = { legacy: [], serverless: [], active: [], stale: [] };
-  let currentKey = null;
-  for (const line of markdown.split(/\r?\n/)) {
-    const heading = line.match(/^## (.+?) \(\d+\)$/);
-    if (heading) {
-      currentKey = sectionKeyFromTitle(heading[1]);
-      continue;
-    }
-    if (!currentKey || !line.startsWith('| ')) continue;
-    const cells = line.split('|').map((c) => c.trim()).filter(Boolean);
-    if (cells.length === 0 || cells[0] === 'Stack') continue;
-    const name = cells[0].replace(/^`|`$/g, '');
-    result[currentKey].push(name);
-  }
-  return result;
-}
+import { paginateListStacks } from '@aws-sdk/client-cloudformation';
+
+export const STALE_DAYS = 180;
+
+const LIVE_STATUSES = [
+  'CREATE_COMPLETE',
+  'UPDATE_COMPLETE',
+  'UPDATE_ROLLBACK_COMPLETE',
+  'IMPORT_COMPLETE',
+];
+
+const hasLegacyPrefix = (name, prefixes) => prefixes.some((p) => name.startsWith(p + '-'));
+
+const SERVERLESS_DESC_RE = /Serverless application/i;
+
+export async function fetchStacks(client) {
+  const stacks = [];
+  for await (const page of paginateListStacks(
+    { client },
+    { StackStatusFilter: LIVE_STATUSES },
+  )) {
+    for (const s of page.StackSummaries ?? []) {
+      stacks.push({
+        name: s.StackName,
+        status: s.StackStatus,
+        templateDescription: s.TemplateDescription,
+        creationTime: s.CreationTime,
+        lastUpdatedTime: s.LastUpdatedTime,
+      });
+    }
+  }
+  return stacks;
+}
+
+export function classifyStacks(stacks, now = new Date(), legacyPrefixes = []) {
+  // legacyPrefixes comes from the consumer's clawform.config.json. Empty = a fresh
+  // consumer with no legacy stacks; nothing gets routed to the `legacy` bucket.
+  const result = { legacy: [], serverless: [], active: [], stale: [] };
+  const staleMs = STALE_DAYS * 24 * 60 * 60 * 1000;
+  for (const s of stacks) {
+    if (hasLegacyPrefix(s.name, legacyPrefixes)) {
+      result.legacy.push(s);
+      continue;
+    }
+    if (SERVERLESS_DESC_RE.test(s.templateDescription ?? '')) {
+      result.serverless.push(s);
+      continue;
+    }
+    const lastTouch = s.lastUpdatedTime ?? s.creationTime;
+    const ageMs = lastTouch ? now.getTime() - new Date(lastTouch).getTime() : 0;
+    if (ageMs > staleMs) result.stale.push(s);
+    else result.active.push(s);
+  }
+  return result;
+}
+
+function fmtDate(d) {
+  if (!d) return '';
+  return new Date(d).toISOString().slice(0, 10);
+}
+
+function escapePipe(s) {
+  return String(s ?? '').replace(/\|/g, '\\|');
+}
+
+function renderSection(lines, title, items, headers, fmtRow) {
+  lines.push(`## ${title} (${items.length})`, '');
+  if (items.length === 0) {
+    lines.push('_None_', '');
+    return;
+  }
+  lines.push('| ' + headers.join(' | ') + ' |');
+  lines.push('|' + headers.map(() => '---').join('|') + '|');
+  const sorted = [...items].sort((a, b) => a.name.localeCompare(b.name));
+  for (const it of sorted) {
+    lines.push('| ' + fmtRow(it).map((v) => `\`${escapePipe(v)}\``).join(' | ') + ' |');
+  }
+  lines.push('');
+}
+
+export function renderInventory(classified, meta) {
+  const lines = [
+    '# CloudFormation Stacks Inventory',
+    '',
+    `> Generated by \`clawform sync\` at ${meta.generatedAt}`,
+    `> Account: ${meta.account} · Region: ${meta.region}`,
+    '',
+  ];
+
+  renderSection(
+    lines,
+    '🔒 Legacy (refuse modify — see rules/legacy-freeze.md)',
+    classified.legacy,
+    ['Stack', 'Status', 'Last update'],
+    (s) => [s.name, s.status, fmtDate(s.lastUpdatedTime ?? s.creationTime)],
+  );
+
+  renderSection(
+    lines,
+    '🛠️ Serverless Framework (managed by `sls` tool — modify via serverless.yml)',
+    classified.serverless,
+    ['Stack', 'Status'],
+    (s) => [s.name, s.status],
+  );
+
+  renderSection(
+    lines,
+    '✅ Active (Clawform-modifiable)',
+    classified.active,
+    ['Stack', 'Status', 'Last update'],
+    (s) => [s.name, s.status, fmtDate(s.lastUpdatedTime ?? s.creationTime)],
+  );
+
+  renderSection(
+    lines,
+    `💤 Stale (≥${STALE_DAYS} days no update — review/decommission)`,
+    classified.stale,
+    ['Stack', 'Last update'],
+    (s) => [s.name, fmtDate(s.lastUpdatedTime ?? s.creationTime)],
+  );
+
+  return lines.join('\n');
+}
+
+const SECTION_KEY_BY_TITLE_FRAGMENT = [
+  ['Legacy', 'legacy'],
+  ['Serverless', 'serverless'],
+  ['Active', 'active'],
+  ['Stale', 'stale'],
+];
+
+function sectionKeyFromTitle(title) {
+  const hit = SECTION_KEY_BY_TITLE_FRAGMENT.find(([fragment]) => title.includes(fragment));
+  return hit ? hit[1] : null;
+}
+
+// Read-back counterpart to renderInventory — recovers the stack list from a
+// committed .clawform/catalog/stacks-inventory.md without a live AWS call. Used by the
+// project-audit workflow (Phase 3), which runs with no network access.
+export function parseInventory(markdown) {
+  const result = { legacy: [], serverless: [], active: [], stale: [] };
+  let currentKey = null;
+  for (const line of markdown.split(/\r?\n/)) {
+    const heading = line.match(/^## (.+?) \(\d+\)$/);
+    if (heading) {
+      currentKey = sectionKeyFromTitle(heading[1]);
+      continue;
+    }
+    if (!currentKey || !line.startsWith('| ')) continue;
+    const cells = line.split('|').map((c) => c.trim()).filter(Boolean);
+    if (cells.length === 0 || cells[0] === 'Stack') continue;
+    const name = cells[0].replace(/^`|`$/g, '');
+    result[currentKey].push(name);
+  }
+  return result;
+}

package/src/commands/activate.js

@@ -1,105 +1,137 @@
-// clawform activate <key> — claim one activation slot for this machine and
-// cache the verdict locally. All I/O seams are injectable for the tests; the
-// CLI passes nothing and gets the real store, fingerprint and vendor client.
-
-import { logger } from '../lib/logger.js';
-import { resolveClient, resolveTrialBenefitIds } from '../lib/license-client.js';
-import { writeLicense } from '../lib/license-store.js';
-import { machineFingerprint } from '../lib/fingerprint.js';
-import { claimTrialDevice } from '../lib/trial-claim.js';
-
-const maskKey = (key) => `…${String(key).slice(-4)}`;
-
-export default async function activate({ key } = {}, {
-  client = resolveClient(),
-  write = writeLicense,
-  fingerprint = machineFingerprint,
-  trialBenefitIds = resolveTrialBenefitIds(),
-  claimTrial = claimTrialDevice,
-  now = Date.now,
-  log = (m) => logger.ok(m),
-} = {}) {
-  if (!key || typeof key !== 'string') {
-    throw new Error('A license key is required: clawform activate <key> (it is in your purchase email).');
-  }
-
-  const fp = fingerprint();
-
-  // Which tier this key belongs to decides whether our own service is consulted
-  // at all. A PAID activation must never depend on it: someone who has just
-  // paid, blocked by our downtime, is the failure the deploy/rollback invariant
-  // exists to prevent — moved to the worst possible moment.
-  //
-  // Costs one extra validate call. That is a once-per-machine command, and the
-  // alternative is threading a callback through the vendor adapter so the
-  // branch can happen mid-activation.
-  let pre = null;
-  try { pre = await client.validate(key); } catch { /* fall through to activate, which reports it */ }
-
-  if (pre?.status === 'valid' && trialBenefitIds.includes(pre.benefitId)) {
-    // Claim BEFORE the slot is taken. A device refused after activation would
-    // keep the activation it had already spent.
-    //
-    // Fail-open on any error: our downtime must cost a lead, never a purchase.
-    // The window allows 14 more days of the cheap CLI commands — a far smaller
-    // loss than a would-be buyer who hit an error once and never came back.
-    let claim = { allowed: true };
-    try { claim = await claimTrial({ licenseKey: key, fingerprint: fp }); } catch { /* fail open */ }
-
-    if (claim && claim.allowed === false) {
-      throw new Error(
-        'This machine has already used a Clawform trial, so a second one cannot start here. '
-        + 'Buy a seat at https://clawform.thejoseki.com/?utm_source=cli — or, if you believe this is a mistake, '
-        + 'write to support@thejoseki.com and it will be sorted out by a person.',
-      );
-    }
-  }
-
-  // Hand the walk we already paid for to the adapter, so it does not repeat it.
-  // Without this one command made about ten Polar calls and got rate-limited.
-  const res = await client.activate(key, fp, pre?.status === 'valid' ? { validated: pre } : {});
-
-  if (res.status === 'valid') {
-    write({
-      status: 'active',
-      key,
-      instanceId: res.instanceId,
-      holder: res.holder,
-      fingerprint: fp,
-      lastValidatedAt: new Date(now()).toISOString(),
-      // Only when the vendor gave one. A perpetual seat carrying
-      // `expiresAt: undefined` would read as "expired at the epoch" to the
-      // gate's date arithmetic — every paying customer refused on day one.
-      ...(res.expiresAt ? { expiresAt: res.expiresAt } : {}),
-    });
-    log(`License ${maskKey(key)} activated on this machine${res.holder ? ` for ${res.holder}` : ''}.`);
-    return;
-  }
-
-  if (res.status === 'invalid') {
-    if (res.reason === 'limit_reached') {
-      throw new Error(
-        'This key has used all of its activation slots. Free one with `clawform deactivate` on a ' +
-        'machine you no longer use — CI should use the CLAWFORM_LICENSE_KEY env var, which never ' +
-        'takes a slot.',
-      );
-    }
-    throw new Error(`The license service rejected this key (${res.reason ?? 'invalid'}). Check for typos in the key from your purchase email.`);
-  }
-
-  // Throttling reads as unreachable to the generic branch below, and its
-  // advice — "try again once you are online" — is false for someone who is
-  // online and whose own retries caused this. Say what happened instead.
-  if (res.reason === 'rate_limited') {
-    throw new Error(
-      'The license service is rate-limiting this key. Nothing was activated. ' +
-      'Wait about a minute and run the same command again — repeating it immediately ' +
-      'extends the limit rather than clearing it.',
-    );
-  }
-
-  throw new Error(
-    `Could not reach the license service (${res.reason ?? 'network error'}). ` +
-    'Nothing was activated — try again once you are online.',
-  );
-}
+// clawform activate <key> — claim one activation slot for this machine and
+// cache the verdict locally. All I/O seams are injectable for the tests; the
+// CLI passes nothing and gets the real store, fingerprint and vendor client.
+
+import { logger } from '../lib/logger.js';
+import { resolveClient, resolveTrialBenefitIds } from '../lib/license-client.js';
+import { writeLicense, readLicenseRaw } from '../lib/license-store.js';
+import { machineFingerprint } from '../lib/fingerprint.js';
+import { claimTrialDevice } from '../lib/trial-claim.js';
+
+const maskKey = (key) => `…${String(key).slice(-4)}`;
+
+export default async function activate({ key } = {}, {
+  client = resolveClient(),
+  read = readLicenseRaw,
+  write = writeLicense,
+  fingerprint = machineFingerprint,
+  trialBenefitIds = resolveTrialBenefitIds(),
+  claimTrial = claimTrialDevice,
+  now = Date.now,
+  log = (m) => logger.ok(m),
+} = {}) {
+  if (!key || typeof key !== 'string') {
+    throw new Error('A license key is required: clawform activate <key> (it is in your purchase email).');
+  }
+
+  const fp = fingerprint();
+
+  // Idempotent re-activation. Polar offers no key-only "list activations", so a
+  // re-run would otherwise POST a brand-new activation every time and burn a
+  // slot — the leak that locks a user out after `limit_activations` upgrades.
+  // Instead, if this machine's local record already points at an activation for
+  // THIS key, probe it with `validate(key, instanceId)`; if the vendor still
+  // honours it, re-adopt it (and re-sign the record, healing a stale one and
+  // stamping the CURRENT fingerprint) without minting a second slot. Only when
+  // the stored slot is gone/invalid do we fall through to a fresh activation.
+  //
+  // The slot's validity is judged SERVER-SIDE, not by matching the stored
+  // fingerprint: on Windows/macOS the fingerprint has no stable machine-id and
+  // shifts when the hostname changes (rename, MDM, DHCP), so a fingerprint guard
+  // would skip the reuse and re-create exactly the leak this fixes. The record
+  // is per-machine local state (~/.clawform), so a key match is the identity
+  // that matters. Deliberately BEFORE the trial-claim block: an already-activated
+  // machine must not re-claim a trial.
+  const prior = read();
+  if (prior.status === 'active' && prior.key === key && prior.instanceId) {
+    let check = null;
+    try { check = await client.validate(key, prior.instanceId); } catch { /* fall through to a fresh activate */ }
+    if (check?.status === 'valid') {
+      write({
+        status: 'active', key, instanceId: prior.instanceId, holder: prior.holder,
+        fingerprint: fp, lastValidatedAt: new Date(now()).toISOString(),
+        ...(check.expiresAt ? { expiresAt: check.expiresAt } : (prior.expiresAt ? { expiresAt: prior.expiresAt } : {})),
+      });
+      log(`License ${maskKey(key)} — re-adopted this machine's existing activation. No extra seat used.`);
+      return;
+    }
+  }
+
+  // Which tier this key belongs to decides whether our own service is consulted
+  // at all. A PAID activation must never depend on it: someone who has just
+  // paid, blocked by our downtime, is the failure the deploy/rollback invariant
+  // exists to prevent — moved to the worst possible moment.
+  //
+  // Costs one extra validate call. That is a once-per-machine command, and the
+  // alternative is threading a callback through the vendor adapter so the
+  // branch can happen mid-activation.
+  let pre = null;
+  try { pre = await client.validate(key); } catch { /* fall through to activate, which reports it */ }
+
+  if (pre?.status === 'valid' && trialBenefitIds.includes(pre.benefitId)) {
+    // Claim BEFORE the slot is taken. A device refused after activation would
+    // keep the activation it had already spent.
+    //
+    // Fail-open on any error: our downtime must cost a lead, never a purchase.
+    // The window allows 14 more days of the cheap CLI commands — a far smaller
+    // loss than a would-be buyer who hit an error once and never came back.
+    let claim = { allowed: true };
+    try { claim = await claimTrial({ licenseKey: key, fingerprint: fp }); } catch { /* fail open */ }
+
+    if (claim && claim.allowed === false) {
+      throw new Error(
+        'This machine has already used a Clawform trial, so a second one cannot start here. '
+        + 'Buy a seat at https://clawform.thejoseki.com/?utm_source=cli — or, if you believe this is a mistake, '
+        + 'write to support@thejoseki.com and it will be sorted out by a person.',
+      );
+    }
+  }
+
+  // Hand the walk we already paid for to the adapter, so it does not repeat it.
+  // Without this one command made about ten Polar calls and got rate-limited.
+  const res = await client.activate(key, fp, pre?.status === 'valid' ? { validated: pre } : {});
+
+  if (res.status === 'valid') {
+    write({
+      status: 'active',
+      key,
+      instanceId: res.instanceId,
+      holder: res.holder,
+      fingerprint: fp,
+      lastValidatedAt: new Date(now()).toISOString(),
+      // Only when the vendor gave one. A perpetual seat carrying
+      // `expiresAt: undefined` would read as "expired at the epoch" to the
+      // gate's date arithmetic — every paying customer refused on day one.
+      ...(res.expiresAt ? { expiresAt: res.expiresAt } : {}),
+    });
+    log(`License ${maskKey(key)} activated on this machine${res.holder ? ` for ${res.holder}` : ''}.`);
+    return;
+  }
+
+  if (res.status === 'invalid') {
+    if (res.reason === 'limit_reached') {
+      throw new Error(
+        'This key has used all of its activation slots. Free one with `clawform deactivate` on a ' +
+        'machine you no longer use — CI should use the CLAWFORM_LICENSE_KEY env var, which never ' +
+        'takes a slot.',
+      );
+    }
+    throw new Error(`The license service rejected this key (${res.reason ?? 'invalid'}). Check for typos in the key from your purchase email.`);
+  }
+
+  // Throttling reads as unreachable to the generic branch below, and its
+  // advice — "try again once you are online" — is false for someone who is
+  // online and whose own retries caused this. Say what happened instead.
+  if (res.reason === 'rate_limited') {
+    throw new Error(
+      'The license service is rate-limiting this key. Nothing was activated. ' +
+      'Wait about a minute and run the same command again — repeating it immediately ' +
+      'extends the limit rather than clearing it.',
+    );
+  }
+
+  throw new Error(
+    `Could not reach the license service (${res.reason ?? 'network error'}). ` +
+    'Nothing was activated — try again once you are online.',
+  );
+}