@velora-cms/server 0.11.0

package/dist/marketplace/license-revalidation-job.js

@@ -0,0 +1,139 @@
+import { licenseCheckIntervalHours } from "../config/license-revalidation.js";
+import { revalidateLicense } from "./revalidate-license.js";
+/** One sweep over every plugin that has a license row. A single plugin's
+ * failure is logged and never aborts the sweep (the Session 91 precedent:
+ * one plugin must never take the others down). */
+export async function runLicenseRevalidationPass(deps) {
+    const licenses = await deps.prisma.pluginLicense.findMany({ select: { pluginId: true } });
+    let checked = 0;
+    let revoked = 0;
+    let failed = 0;
+    for (const { pluginId } of licenses) {
+        try {
+            const outcome = await revalidateLicense(deps, pluginId);
+            if (outcome.checked) {
+                checked += 1;
+                if (outcome.status === "revoked")
+                    revoked += 1;
+            }
+            else {
+                failed += 1;
+            }
+        }
+        catch (error) {
+            failed += 1;
+            console.error(`[license] revalidation threw for ${pluginId}`, error);
+        }
+    }
+    return { checked, revoked, failed };
+}
+// A pass that hasn't settled after this long is presumed wedged rather than
+// merely slow. The one genuinely UNBOUNDED await anywhere in this pipeline
+// is a third-party plugin's onDeactivate hook: PluginRegistryService.
+// deactivate() awaits `this.manifests.get(pluginId)?.onDeactivate?.()`
+// directly, with no timeout of its own. Everything else already carries a
+// bound — the upstream license check is capped by marketplace-client.ts's
+// own 8s AbortSignal.timeout, and a plain DB write is sub-second.
+//
+// This value MUST sit above that 8s upstream bound. A single unreachable
+// license server already burns the full 8s for ONE plugin, so a shorter
+// timeout here would trip the "presumed wedged" path during exactly the
+// outage this feature exists to survive — and the log line would then
+// misattribute a slow network to a hung onDeactivate hook. 15s leaves
+// headroom for that 8s call plus a deactivate() (a DB write and a
+// well-behaved hook) while still bounding a genuinely wedged hook to
+// seconds rather than the life of the process.
+//
+// Trade-off, stated plainly: a sweep over several licensed plugins all
+// hitting a slow (not hung) upstream can still exceed 15s in aggregate and
+// trip this path, letting a second pass start alongside the first. That is
+// safe — each plugin's write is independent, and re-checking one twice in
+// close succession is a no-op at worst (deactivate() itself is idempotent,
+// guarded by `if (!row.enabled) return`) — whereas the alternative, a hook
+// that never resolves permanently pinning the overlap guard and silently
+// disabling all future enforcement for the rest of the process's life, is
+// the one thing this constant exists to rule out.
+const DEFAULT_PASS_TIMEOUT_MS = 15_000;
+function delay(ms) {
+    return new Promise((resolve) => {
+        const handle = setTimeout(resolve, ms);
+        handle.unref?.();
+    });
+}
+/** Starts the first background timer in apps/server. Two things are
+ * non-negotiable: the handle is unref()'d so it can never hold the process
+ * open, and the caller MUST stop it on app close (app.ts registers an
+ * onClose hook) — otherwise every integration test that builds and closes
+ * an app leaves a live timer behind.
+ *
+ * Passes are intended never to overlap, but forward progress must never
+ * depend on a third-party hook actually resolving. What is ACTUALLY
+ * guaranteed (corrected from an earlier version of this comment, which
+ * claimed the wait was inherently bounded by the upstream 8s timeout
+ * alone — true of the license CHECK, but not of registry.deactivate(),
+ * which also awaits a plugin's onDeactivate hook with no timeout of its
+ * own):
+ *   - stop() always resolves within ~passTimeoutMs of being called,
+ *     regardless of whether the in-flight pass (or the hook it's stuck
+ *     in) ever finishes. If it gives up, it logs clearly that it did.
+ *   - A pass that's been "in flight" longer than passTimeoutMs is
+ *     presumed wedged, and the overlap guard stops treating it as a
+ *     reason to skip the next tick — so a hung onDeactivate hook can
+ *     disable enforcement for at most one bad tick, not for the rest of
+ *     the process's life.
+ *   - Giving up on a wedged pass does not cancel it. It keeps running in
+ *     the background and will still write whatever verdict it eventually
+ *     reaches; it just can no longer block anyone else from making
+ *     progress. */
+export function startLicenseRevalidation(deps, opts = {}) {
+    const intervalMs = opts.intervalMs ?? licenseCheckIntervalHours() * 60 * 60 * 1000;
+    const passTimeoutMs = opts.passTimeoutMs ?? DEFAULT_PASS_TIMEOUT_MS;
+    let inFlight;
+    let inFlightStartedAt = 0;
+    const pass = async () => {
+        // A previous pass is still marked in-flight — but only skip this tick
+        // while it's within passTimeoutMs of its own start. Past that, it's
+        // presumed wedged (see the comment above startLicenseRevalidation) and
+        // a fresh pass is allowed to start rather than skipping forever.
+        if (inFlight && Date.now() - inFlightStartedAt < passTimeoutMs)
+            return;
+        const run = (async () => {
+            try {
+                await runLicenseRevalidationPass(deps);
+            }
+            catch (error) {
+                console.error("[license] revalidation pass failed", error);
+            }
+        })();
+        inFlight = run;
+        inFlightStartedAt = Date.now();
+        try {
+            await run;
+        }
+        finally {
+            // Only clear if we're still the pass currently being tracked — a
+            // later tick may already have presumed us wedged and started its
+            // own run, whose own finally is the one responsible for clearing
+            // `inFlight` when IT settles. Without this check, a very-late
+            // resolution of an abandoned pass could clobber a newer pass's
+            // in-flight tracking.
+            if (inFlight === run)
+                inFlight = undefined;
+        }
+    };
+    void pass(); // one pass at boot
+    const handle = setInterval(() => void pass(), intervalMs);
+    handle.unref?.();
+    return async () => {
+        clearInterval(handle);
+        const current = inFlight;
+        if (!current)
+            return;
+        const timedOut = await Promise.race([current.then(() => false), delay(passTimeoutMs).then(() => true)]);
+        if (timedOut) {
+            console.error(`[license] stop() gave up waiting for an in-flight revalidation pass after ${passTimeoutMs}ms — ` +
+                "a plugin's onDeactivate hook is likely hung. app.close() is proceeding without it; the pass " +
+                "keeps running in the background and will still write its own outcome if/when it settles.");
+        }
+    };
+}

package/dist/marketplace/marketplace-client.d.ts

@@ -0,0 +1,43 @@
+export declare class MarketplaceUnavailableError extends Error {
+    constructor(reason: string);
+}
+export declare class MarketplaceNotFoundError extends Error {
+    constructor(pluginId: string);
+}
+export interface MarketplaceListParams {
+    q?: string;
+    type?: string;
+    db?: string;
+    cursor?: string;
+    limit?: number;
+}
+export declare function fetchListings(baseUrl: string, params: MarketplaceListParams, opts?: {
+    timeoutMs?: number;
+}): Promise<unknown>;
+export declare function fetchListing(baseUrl: string, pluginId: string, opts?: {
+    timeoutMs?: number;
+}): Promise<unknown>;
+export interface LicenseVerdict {
+    status: "valid" | "invalid" | "revoked";
+    reason?: string;
+}
+/** Writes the package body to destPath. Nothing is written unless the
+ * response is a 2xx — a 404 leaves no partial file behind for the
+ * installer to trip over. */
+export declare function downloadPackage(baseUrl: string, pluginId: string, version: string, destPath: string, opts?: {
+    timeoutMs?: number;
+    maxBytes?: number;
+}): Promise<void>;
+/** null means the version is genuinely unsigned upstream (a legitimate
+ * answer for rows predating the signing pipeline), not a failure. */
+export declare function downloadSignature(baseUrl: string, pluginId: string, version: string, opts?: {
+    timeoutMs?: number;
+    maxBytes?: number;
+}): Promise<string | null>;
+export declare function validateLicenseUpstream(baseUrl: string, input: {
+    key: string;
+    pluginId: string;
+    domain: string;
+}, opts?: {
+    timeoutMs?: number;
+}): Promise<LicenseVerdict>;

package/dist/marketplace/marketplace-client.js

@@ -0,0 +1,228 @@
+import { writeFile } from "node:fs/promises";
+/** The first outbound HTTP client in apps/server, so its failure
+ * contract is explicit: every network-shaped failure (unreachable,
+ * timeout, non-2xx, unparseable body) becomes MarketplaceUnavailableError,
+ * and nothing ever hangs — a marketplace outage must degrade the admin's
+ * browse screen to a clear error state, never a stalled request. */
+const DEFAULT_TIMEOUT_MS = 8000;
+/** H1 (S138 hardening review): a hard byte ceiling for a downloaded
+ * package body, enforced by THIS client — independent of whatever the
+ * marketplace's own upload path enforces server-side (apps/marketplace's
+ * packages route caps uploads at 20 MB). That cap is the honest
+ * marketplace's policy, not a property of the wire: this client is the
+ * CMS's own trust boundary against a compromised, misconfigured, or
+ * simply wrong VELORA_MARKETPLACE_URL, which owes this process no such
+ * courtesy. 24 MB — 20% headroom over the marketplace's 20 MB cap, so a
+ * legitimate package sitting right at that cap round-trips without
+ * tripping this one — while still bounding a single install's worst-case
+ * memory use to a small, fixed multiple of what a real package can ever
+ * legitimately be, on a fast link or a slow one alike (AbortSignal.timeout
+ * bounds time, not bytes — see readBoundedBody below). */
+const MAX_PACKAGE_BYTES = 24 * 1024 * 1024;
+/** Matches verify-package.ts's own MAX_SIDECAR_BYTES ceiling for the
+ * exact same artifact once it's on disk — a signature sidecar is a few KB
+ * of JSON at most, so this client refuses anything upstream claims (or
+ * turns out) to be larger, well before it ever reaches that later,
+ * disk-based check. */
+const MAX_SIGNATURE_BYTES = 8192;
+/** Reads a Response body under a hard byte ceiling that a malicious or
+ * merely-wrong `content-length` cannot bypass in either direction: a
+ * declared length over the ceiling is rejected immediately (never reading
+ * a byte of body), and the ACTUAL bytes read are counted as they arrive
+ * and the read is aborted the instant they exceed the ceiling — whether or
+ * not a header was sent at all, and regardless of whether it told the
+ * truth. AbortSignal.timeout (already on `response` via the fetch() call
+ * that produced it) bounds how long this can take; this bounds how much of
+ * it can land in the heap. */
+async function readBoundedBody(response, maxBytes, label, timeoutMs) {
+    const declared = response.headers.get("content-length");
+    if (declared !== null) {
+        const declaredBytes = Number(declared);
+        if (Number.isFinite(declaredBytes) && declaredBytes > maxBytes) {
+            // Never read: don't even start pulling a body we already know is
+            // too large. Cancelling releases the connection rather than leaving
+            // it dangling for the caller to eventually time out on.
+            await response.body?.cancel().catch(() => { });
+            throw new MarketplaceUnavailableError(`${label} declared content-length ${declaredBytes} bytes, over the ${maxBytes}-byte limit`);
+        }
+    }
+    if (!response.body) {
+        // No stream to bound incrementally (shouldn't happen with undici's
+        // fetch, but this module never assumes) — fall back to a single
+        // bounded read.
+        let buf;
+        try {
+            buf = Buffer.from(await response.arrayBuffer());
+        }
+        catch (error) {
+            const reason = error instanceof Error && error.name === "TimeoutError" ? `no response within ${timeoutMs}ms` : String(error);
+            throw new MarketplaceUnavailableError(`${label} body read failed: ${reason}`);
+        }
+        if (buf.byteLength > maxBytes) {
+            throw new MarketplaceUnavailableError(`${label} exceeds the ${maxBytes}-byte limit`);
+        }
+        return buf;
+    }
+    const reader = response.body.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            total += value.byteLength;
+            if (total > maxBytes) {
+                await reader.cancel(`${label} exceeded ${maxBytes} bytes`).catch(() => { });
+                throw new MarketplaceUnavailableError(`${label} exceeds the ${maxBytes}-byte limit`);
+            }
+            chunks.push(value);
+        }
+    }
+    catch (error) {
+        if (error instanceof MarketplaceUnavailableError)
+            throw error;
+        const reason = error instanceof Error && error.name === "TimeoutError" ? `no response within ${timeoutMs}ms` : String(error);
+        throw new MarketplaceUnavailableError(`${label} body read failed: ${reason}`);
+    }
+    return Buffer.concat(chunks);
+}
+export class MarketplaceUnavailableError extends Error {
+    constructor(reason) {
+        super(`marketplace unavailable: ${reason}`);
+        this.name = "MarketplaceUnavailableError";
+    }
+}
+export class MarketplaceNotFoundError extends Error {
+    constructor(pluginId) {
+        super(`no published listing for "${pluginId}"`);
+        this.name = "MarketplaceNotFoundError";
+    }
+}
+async function getJson(url, timeoutMs, notFound) {
+    let response;
+    try {
+        response = await fetch(url, { signal: AbortSignal.timeout(timeoutMs), headers: { accept: "application/json" } });
+    }
+    catch (error) {
+        const reason = error instanceof Error && error.name === "TimeoutError" ? `no response within ${timeoutMs}ms` : String(error);
+        throw new MarketplaceUnavailableError(reason);
+    }
+    if (response.status === 404 && notFound)
+        throw notFound();
+    if (!response.ok)
+        throw new MarketplaceUnavailableError(`upstream responded ${response.status}`);
+    try {
+        return await response.json();
+    }
+    catch {
+        throw new MarketplaceUnavailableError("upstream returned a body that is not JSON");
+    }
+}
+export async function fetchListings(baseUrl, params, opts = {}) {
+    const query = new URLSearchParams();
+    if (params.q)
+        query.set("q", params.q);
+    if (params.type)
+        query.set("type", params.type);
+    if (params.db)
+        query.set("db", params.db);
+    if (params.cursor)
+        query.set("cursor", params.cursor);
+    if (params.limit)
+        query.set("limit", String(params.limit));
+    const suffix = query.toString() ? `?${query}` : "";
+    return getJson(`${baseUrl}/api/v1/listings${suffix}`, opts.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+}
+export async function fetchListing(baseUrl, pluginId, opts = {}) {
+    return getJson(`${baseUrl}/api/v1/listings/${encodeURIComponent(pluginId)}`, opts.timeoutMs ?? DEFAULT_TIMEOUT_MS, () => new MarketplaceNotFoundError(pluginId));
+}
+/** Writes the package body to destPath. Nothing is written unless the
+ * response is a 2xx — a 404 leaves no partial file behind for the
+ * installer to trip over. */
+export async function downloadPackage(baseUrl, pluginId, version, destPath, opts = {}) {
+    const url = `${baseUrl}/api/v1/packages/${encodeURIComponent(pluginId)}/${encodeURIComponent(version)}`;
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    let response;
+    try {
+        response = await fetch(url, { signal: AbortSignal.timeout(timeoutMs) });
+    }
+    catch (error) {
+        const reason = error instanceof Error && error.name === "TimeoutError" ? `no response within ${timeoutMs}ms` : String(error);
+        throw new MarketplaceUnavailableError(reason);
+    }
+    if (response.status === 404)
+        throw new MarketplaceNotFoundError(`${pluginId}@${version}`);
+    if (!response.ok)
+        throw new MarketplaceUnavailableError(`upstream responded ${response.status}`);
+    // H1: bounded read, not a bare arrayBuffer() — see readBoundedBody and
+    // MAX_PACKAGE_BYTES above for why. Nothing is written to destPath unless
+    // the whole body arrived under the ceiling.
+    const bytes = await readBoundedBody(response, opts.maxBytes ?? MAX_PACKAGE_BYTES, "package artifact", timeoutMs);
+    await writeFile(destPath, bytes);
+}
+/** null means the version is genuinely unsigned upstream (a legitimate
+ * answer for rows predating the signing pipeline), not a failure. */
+export async function downloadSignature(baseUrl, pluginId, version, opts = {}) {
+    const url = `${baseUrl}/api/v1/packages/${encodeURIComponent(pluginId)}/${encodeURIComponent(version)}/signature`;
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    let response;
+    try {
+        response = await fetch(url, { signal: AbortSignal.timeout(timeoutMs) });
+    }
+    catch (error) {
+        const reason = error instanceof Error && error.name === "TimeoutError" ? `no response within ${timeoutMs}ms` : String(error);
+        throw new MarketplaceUnavailableError(reason);
+    }
+    if (response.status === 404)
+        return null;
+    if (!response.ok)
+        throw new MarketplaceUnavailableError(`upstream responded ${response.status}`);
+    // H1: bounded read (MAX_SIGNATURE_BYTES) — a signature sidecar is a few
+    // KB of JSON; anything upstream claims or turns out to be larger than
+    // that is refused here rather than buffered.
+    const bytes = await readBoundedBody(response, opts.maxBytes ?? MAX_SIGNATURE_BYTES, "signature sidecar", timeoutMs);
+    return bytes.toString("utf8");
+}
+export async function validateLicenseUpstream(baseUrl, input, opts = {}) {
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    let response;
+    try {
+        response = await fetch(`${baseUrl}/api/v1/licenses/validate`, {
+            method: "POST",
+            headers: { "content-type": "application/json", accept: "application/json" },
+            body: JSON.stringify(input),
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+    }
+    catch (error) {
+        const reason = error instanceof Error && error.name === "TimeoutError" ? `no response within ${timeoutMs}ms` : String(error);
+        throw new MarketplaceUnavailableError(reason);
+    }
+    if (!response.ok)
+        throw new MarketplaceUnavailableError(`license server responded ${response.status}`);
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch {
+        throw new MarketplaceUnavailableError("license server returned a body that is not JSON");
+    }
+    return parseLicenseVerdict(body);
+}
+const LICENSE_STATUSES = new Set(["valid", "invalid", "revoked"]);
+/** Task 3 gates paid installs on `status === "valid"`, so an unnarrowed
+ * response shape at this network trust boundary is a real weak point — a
+ * misconfigured base URL or a buggy/compromised license server returning
+ * `{}` or `{status: 200}` must not silently sail through as a verdict. */
+function parseLicenseVerdict(body) {
+    if (typeof body !== "object" ||
+        body === null ||
+        !("status" in body) ||
+        typeof body.status !== "string" ||
+        !LICENSE_STATUSES.has(body.status) ||
+        ("reason" in body && body.reason !== undefined && typeof body.reason !== "string")) {
+        throw new MarketplaceUnavailableError(`license server returned a malformed verdict: ${JSON.stringify(body)}`);
+    }
+    return body;
+}

package/dist/marketplace/revalidate-license.d.ts

@@ -0,0 +1,39 @@
+import type { PrismaClient } from "@prisma/client";
+import type { PluginRegistryService } from "../plugins/plugin-registry-service.js";
+/** Every verdict-to-consequence mapping lives HERE, so the scheduled job,
+ * the boot pass, the activation re-check, and the manual re-check cannot
+ * drift apart. Two rules are load-bearing:
+ *   - FAIL OPEN: an unreachable license server (or missing site domain)
+ *     never changes status and never deactivates. A site must not lose
+ *     paid functionality because velora.com is down.
+ *   - domain_mismatch WARNS, it does not deactivate: an honest operator
+ *     changing VELORA_SITE_DOMAIN can cause it, and killing their paid
+ *     plugins over a config edit is the wrong trade (S139 decision 1).
+ * This function also never RE-ENABLES a plugin — an admin's own manual
+ * deactivation must survive a license check. */
+export type RevalidationOutcome = {
+    checked: true;
+    status: "valid";
+} | {
+    checked: true;
+    status: "revoked";
+    reason: string;
+    deactivated: boolean;
+} | {
+    checked: true;
+    status: "domain_mismatch";
+    reason: string;
+} | {
+    checked: false;
+    reason: string;
+} | {
+    checked: false;
+    reason: string;
+    missingLicense: true;
+};
+export interface RevalidateDeps {
+    prisma: PrismaClient;
+    registry: PluginRegistryService;
+    marketplaceBaseUrl: string;
+}
+export declare function revalidateLicense(deps: RevalidateDeps, pluginId: string): Promise<RevalidationOutcome>;

package/dist/marketplace/revalidate-license.js

@@ -0,0 +1,103 @@
+import { getSiteDomain } from "../config/site.js";
+import { MarketplaceUnavailableError, validateLicenseUpstream } from "./marketplace-client.js";
+const DOMAIN_MISMATCH = "domain_mismatch";
+/** S153: revoking a BUNDLE's license switches off the whole set it
+ * installed — the members are what the license actually bought (the S152
+ * cascade-to-owned-members decision extended to deactivation). Reverse
+ * install order, per-member try/catch; deactivate() is idempotent and a
+ * member individually uninstalled since (no registry row) just throws
+ * PluginNotInstalledError into the catch. Skip-don't-claim members have
+ * no ownership rows and are never touched. Never re-enables anything. */
+async function deactivateWithOwnedMembers(deps, pluginId) {
+    let deactivated = false;
+    try {
+        await deps.registry.deactivate(pluginId);
+        deactivated = true;
+    }
+    catch (error) {
+        console.error(`[license] failed to deactivate ${pluginId} after a negative license verdict`, error);
+    }
+    const row = await deps.prisma.pluginRegistry.findUnique({ where: { pluginId }, select: { type: true } });
+    if (row?.type !== "bundle")
+        return deactivated;
+    const members = await deps.prisma.pluginBundleMember.findMany({
+        where: { bundlePluginId: pluginId },
+        orderBy: { position: "desc" },
+    });
+    for (const member of members) {
+        try {
+            await deps.registry.deactivate(member.memberPluginId);
+        }
+        catch (error) {
+            console.error(`[license] failed to deactivate bundle member ${member.memberPluginId} of ${pluginId}`, error);
+        }
+    }
+    return deactivated;
+}
+// The license server that produces this reason string is a different app
+// (apps/marketplace's own license-validation route) with no shared constant
+// tying the two together — an exact byte match here is a drift point.
+// Since this service never re-enables a plugin, a MISS on domain_mismatch
+// (a case variant, a hyphenated "domain-mismatch", stray whitespace) falls
+// through to the hard-revoke-and-deactivate branch below and becomes a
+// one-way ratchet an admin has to manually recover from — the unsafe
+// direction for the one verdict an honest operator's own config edit can
+// trigger. Normalize before comparing so those variants still take the
+// WARN path; the stored/returned reason keeps the upstream's original text.
+function normalizeReason(reason) {
+    return reason.trim().toLowerCase().replace(/[-_]+/g, "_");
+}
+export async function revalidateLicense(deps, pluginId) {
+    const license = await deps.prisma.pluginLicense.findUnique({ where: { pluginId } });
+    if (!license)
+        return { checked: false, reason: "no license on record", missingLicense: true };
+    const domain = getSiteDomain();
+    if (!domain) {
+        const reason = "VELORA_SITE_DOMAIN is not configured — skipping the license check";
+        await deps.prisma.pluginLicense.update({
+            where: { pluginId },
+            data: { lastAttemptAt: new Date(), lastAttemptError: reason },
+        });
+        return { checked: false, reason };
+    }
+    let verdict;
+    try {
+        verdict = await validateLicenseUpstream(deps.marketplaceBaseUrl, { key: license.key, pluginId, domain });
+    }
+    catch (error) {
+        if (error instanceof MarketplaceUnavailableError) {
+            // FAIL OPEN — status and lastReason deliberately untouched.
+            await deps.prisma.pluginLicense.update({
+                where: { pluginId },
+                data: { lastAttemptAt: new Date(), lastAttemptError: error.message },
+            });
+            return { checked: false, reason: error.message };
+        }
+        throw error;
+    }
+    const now = new Date();
+    if (verdict.status === "valid") {
+        await deps.prisma.pluginLicense.update({
+            where: { pluginId },
+            data: { status: "valid", lastReason: null, lastValidatedAt: now, lastAttemptAt: now, lastAttemptError: null },
+        });
+        return { checked: true, status: "valid" };
+    }
+    const reason = verdict.reason ?? verdict.status;
+    if (verdict.status === "invalid" && normalizeReason(reason) === DOMAIN_MISMATCH) {
+        await deps.prisma.pluginLicense.update({
+            where: { pluginId },
+            data: { status: DOMAIN_MISMATCH, lastReason: reason, lastValidatedAt: now, lastAttemptAt: now, lastAttemptError: null },
+        });
+        return { checked: true, status: DOMAIN_MISMATCH, reason };
+    }
+    // Revoke hard: a confirmed negative that an operator's own config cannot
+    // have caused. deactivate() is idempotent, tolerates a missing manifest,
+    // and persists enabled:false before running onDeactivate.
+    await deps.prisma.pluginLicense.update({
+        where: { pluginId },
+        data: { status: "revoked", lastReason: reason, lastValidatedAt: now, lastAttemptAt: now, lastAttemptError: null },
+    });
+    const deactivated = await deactivateWithOwnedMembers(deps, pluginId);
+    return { checked: true, status: "revoked", reason, deactivated };
+}

package/dist/media/media-service.d.ts

@@ -0,0 +1,36 @@
+import type { Prisma, PrismaClient } from "@prisma/client";
+import type { MediaFile } from "@velora-cms/api-schemas";
+import type { Dialect } from "@velora-cms/prisma-variants";
+export interface MediaStorageConfig {
+    endpoint: string;
+    region: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    bucket: string;
+}
+export declare function mediaStorageConfigFromEnv(): MediaStorageConfig;
+export interface MediaUploadInput {
+    filename: string;
+    mimeType: string;
+    data: Buffer;
+    uploadedBy: string;
+}
+export declare class MediaService {
+    private readonly prisma;
+    private readonly config;
+    private readonly dialect;
+    private readonly s3;
+    constructor(prisma: PrismaClient, config: MediaStorageConfig, dialect: Dialect);
+    ensureBucket(): Promise<void>;
+    upload(input: MediaUploadInput): Promise<MediaFile>;
+    getById(id: string): Promise<MediaFile | null>;
+    list(options: {
+        cursor?: string;
+        limit: number;
+        search?: string;
+    }): Promise<MediaFile[]>;
+    getDownloadUrl(id: string, expiresInSeconds?: number): Promise<string>;
+    delete(id: string): Promise<void>;
+    private canonicalUrl;
+}
+export declare function buildFilenameSearchFilter(search: string, dialect: Dialect): Prisma.StringFilter;