@voltro/plugin-licensing 0.84.0 → 0.86.0

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import { Effect } from 'effect';
-import { Tag } from 'effect/Context';
+import { Service } from 'effect/Context';
 import { VoidIfEmpty } from 'effect/Types';
 import { VoltroPlugin } from '@voltro/protocol';
 import { YieldableError } from 'effect/Cause';
@@ -36,7 +36,7 @@ export declare interface LicenseClaims {
     readonly kid?: string;
 }
 
-export declare const LicenseService: Tag<LicenseServiceShape, LicenseServiceShape>;
+export declare const LicenseService: Service<LicenseServiceShape, LicenseServiceShape>;
 
 export declare interface LicenseServiceShape {
     readonly snapshot: () => LicenseSnapshot | undefined;
@@ -119,10 +119,12 @@ export declare interface LicensingPluginOptions {
     readonly publicKey?: string;
     /** The signed license token. Falls back to `VOLTRO_LICENSE_KEY`. */
     readonly licenseKey?: string;
-    /** URL to periodically re-fetch a fresh signed license (entitlement sync).
-     *  With `refreshMs`, a cluster-coordinated refresh re-verifies + re-installs
-     *  the snapshot. (The cloud endpoint that serves it ships in a later milestone.) */
+    /** URL returning JSON containing a signed `token`. The coordinated refresh
+     * verifies its signature before installing the new snapshot. */
     readonly snapshotUrl?: string;
+    /** Server-only snapshot headers, for example a service Authorization header.
+     * Redirects are refused. Keep credentials out of browsers and URLs. */
+    readonly snapshotHeaders?: Readonly<Record<string, string>>;
     /** Refresh interval (ms) for `snapshotUrl`. Default 15 minutes. */
     readonly refreshMs?: number;
     /** Seconds an expired license is still honored (grace) before it goes dark.

package/dist/index.js

@@ -1,84 +1,18 @@
-import { Data as e, Effect as t } from "effect";
-import { definePlugin as n, definePluginService as r, pluginInstanceName as i } from "@voltro/protocol";
-import { pluginEnv as a } from "@voltro/env";
-import { importSPKI as o, jwtVerify as s } from "jose";
-//#region src/verify.ts
-var c = class extends e.TaggedError("LicenseVerifyError") {}, l = (e) => typeof e == "object" && e && "code" in e ? String(e.code) : "", u = (e) => {
-	let t = e instanceof Error ? e.message : String(e);
-	return l(e) === "ERR_JWT_EXPIRED" ? new c({
-		reason: "expired",
-		message: t
-	}) : new c({
-		reason: "invalid",
-		message: t
-	});
-}, d = (e) => e === "unlimited" || typeof e == "number" && Number.isFinite(e) && e >= 0, f = (e, n) => {
-	let r = e.edition, i = e.entitlements, a = e.features;
-	if (typeof r != "string" || typeof i != "object" || !i) return t.fail(new c({
-		reason: "malformed",
-		message: "missing edition/entitlements"
-	}));
-	let o = {};
-	for (let [e, n] of Object.entries(i)) {
-		if (!d(n)) return t.fail(new c({
-			reason: "malformed",
-			message: `bad entitlement '${e}'`
-		}));
-		o[e] = n;
-	}
-	let s = Array.isArray(a) ? a.filter((e) => typeof e == "string") : [], l = e.plugins, u = Array.isArray(l) ? l.filter((e) => typeof e == "string") : [];
-	return t.succeed({
-		...typeof e.tenant == "string" ? { tenant: e.tenant } : {},
-		edition: r,
-		entitlements: o,
-		features: s,
-		plugins: u,
-		exp: typeof e.exp == "number" ? e.exp : 0,
-		...typeof e.iat == "number" ? { iat: e.iat } : {},
-		...n === void 0 ? {} : { kid: n }
-	});
-}, p = (e, n) => t.tryPromise({
-	try: () => o(n, "EdDSA"),
-	catch: (e) => new c({
-		reason: "key",
-		message: e instanceof Error ? e.message : String(e)
-	})
-}).pipe(t.flatMap((n) => t.tryPromise({
-	try: async () => {
-		let { payload: t, protectedHeader: r } = await s(e, n, { algorithms: ["EdDSA"] });
-		return {
-			payload: t,
-			kid: r.kid
-		};
-	},
-	catch: u
-})), t.flatMap(({ payload: e, kid: t }) => f(e, t))), m = (e, t = {}) => {
-	let n = new Set(e.features), r = new Set(e.plugins), i = t.graceSeconds ?? 0, a = t.now ?? (() => Date.now() / 1e3), o = () => e.exp <= 0 || a() <= e.exp + i;
-	return {
-		claims: e,
-		state: () => e.exp <= 0 || a() <= e.exp ? "active" : o() ? "grace" : "expired",
-		limitFor: (t, n) => {
-			if (!o() || e.tenant !== void 0 && e.tenant !== t) return;
-			let r = e.entitlements[n];
-			if (r !== void 0) return r === "unlimited" ? Infinity : r;
-		},
-		hasFeature: (e) => o() && n.has(e),
-		allowsPlugin: (e) => o() && r.has(e)
-	};
-}, h, g = (e) => {
-	h = e;
-}, _ = () => h, v, y = (e) => {
-	v = e;
-}, b = () => v, x = (e, n) => t.sync(() => {
-	let t = _()?.limitFor(e, n);
-	return t === void 0 ? null : t;
-}), S = () => {
-	let e = _(), t = e === void 0 ? void 0 : {
+import { fetchLicenseSnapshot as e } from "./refresh.js";
+import { LicenseVerifyError as t, verifyLicense as n } from "./verify.js";
+import { getRejection as r, getSnapshot as i, makeSnapshot as a, setRejection as o, setSnapshot as s } from "./snapshot.js";
+import { entitlementResolver as c } from "./resolver.js";
+import { Data as l, Effect as u } from "effect";
+import { definePlugin as d, definePluginService as f, pluginInstanceName as p } from "@voltro/protocol";
+import { pluginEnv as m } from "@voltro/env";
+//#region src/index.ts
+var h = () => {
+	let e = i(), t = e === void 0 ? void 0 : {
 		state: e.state(),
 		edition: e.claims.edition,
 		expiresAt: e.claims.exp,
 		...e.claims.tenant === void 0 ? {} : { tenant: e.claims.tenant }
-	}, n = b();
+	}, n = r();
 	return n === void 0 ? t ?? { state: "none" } : {
 		state: "rejected",
 		reason: n.reason,
@@ -89,7 +23,7 @@ var c = class extends e.TaggedError("LicenseVerifyError") {}, l = (e) => typeof
 			expiresAt: t.expiresAt
 		} }
 	};
-}, C = a([{
+}, g = m([{
 	name: "VOLTRO_LICENSE_PUBLIC_KEY",
 	required: !1,
 	secret: !1,
@@ -99,66 +33,59 @@ var c = class extends e.TaggedError("LicenseVerifyError") {}, l = (e) => typeof
 	required: !1,
 	secret: !1,
 	description: "The signed EdDSA license token, verified offline at boot."
-}]), { Tag: w, Live: T } = r("@voltro/plugin-licensing/LicenseService", {
-	snapshot: () => _(),
-	status: () => S(),
-	limitFor: (e, t) => _()?.limitFor(e, t),
-	hasFeature: (e) => _()?.hasFeature(e) ?? !1,
-	allowsPlugin: (e) => _()?.allowsPlugin(e) ?? !1,
-	edition: () => _()?.claims.edition
-}), E = class extends e.TaggedError("PluginNotLicensed") {}, D = (e) => _()?.allowsPlugin(e) ?? !1, O = (e) => D(e) ? t.void : t.fail(new E({ plugin: e })), k = (e = {}) => {
-	let r = C.read("VOLTRO_LICENSE_PUBLIC_KEY", e.publicKey), a = C.read("VOLTRO_LICENSE_KEY", e.licenseKey), o = e.graceSeconds ?? 0, s = e.refreshMs ?? 9e5, c, l = (e, n) => p(e, n).pipe(t.match({
+}]), { Tag: _, Live: v } = f("@voltro/plugin-licensing/LicenseService", {
+	snapshot: () => i(),
+	status: () => h(),
+	limitFor: (e, t) => i()?.limitFor(e, t),
+	hasFeature: (e) => i()?.hasFeature(e) ?? !1,
+	allowsPlugin: (e) => i()?.allowsPlugin(e) ?? !1,
+	edition: () => i()?.claims.edition
+}), y = class extends l.TaggedError("PluginNotLicensed") {}, b = (e) => i()?.allowsPlugin(e) ?? !1, x = (e) => b(e) ? u.void : u.fail(new y({ plugin: e })), S = (t = {}) => {
+	let r = g.read("VOLTRO_LICENSE_PUBLIC_KEY", t.publicKey), i = g.read("VOLTRO_LICENSE_KEY", t.licenseKey), c = t.graceSeconds ?? 0, l = t.refreshMs ?? 9e5, f, m = (e, t) => n(e, t).pipe(u.match({
 		onSuccess: (e) => {
-			g(m(e, { graceSeconds: o })), y(void 0), c?.info("license active", {
+			s(a(e, { graceSeconds: c })), o(void 0), f?.info("license active", {
 				edition: e.edition,
 				entitlements: Object.keys(e.entitlements).length,
 				exp: e.exp
 			});
 		},
 		onFailure: (e) => {
-			y({
+			o({
 				reason: e.reason,
 				message: e.message
-			}), c?.warn("license verification failed — entitlements fall back to static plan", {
+			}), f?.warn("license verification failed — entitlements fall back to static plan", {
 				reason: e.reason,
 				message: e.message
 			});
 		}
 	}));
-	return n({
-		name: i({
+	return d({
+		name: p({
 			base: "@voltro/plugin-licensing",
-			instance: e.name
+			instance: t.name
 		}),
 		description: "Offline-verified EdDSA license keys + entitlement snapshots; feeds @voltro/plugin-billing via entitlementResolver.",
-		declaredEnv: C.declared,
-		services: T,
-		onActivate: (e) => t.gen(function* () {
-			if (c = e.logger, r === void 0 || a === void 0) {
-				e.logger.debug("licensing: no license configured — static plan entitlements apply");
-				return;
-			}
-			yield* l(a, r);
+		declaredEnv: g.declared,
+		services: v,
+		onActivate: (e) => u.gen(function* () {
+			f = e.logger, r === void 0 || i === void 0 ? e.logger.debug("licensing: no license configured — static plan entitlements apply") : yield* m(i, r);
 		}),
 		bindDataStore: (n, i) => {
-			let a = e.snapshotUrl;
+			let a = t.snapshotUrl;
 			if (a === void 0 || r === void 0 || i?.scheduleCoordinated === void 0) return;
 			let o = r;
-			i.scheduleCoordinated("licensing.refresh", s, async () => {
-				try {
-					let e = await fetch(a);
-					if (!e.ok) return;
-					let n = (await e.text()).trim();
-					n.length > 0 && await t.runPromise(l(n, o));
-				} catch (e) {
-					c?.warn("license refresh failed", { message: e instanceof Error ? e.message : String(e) });
-				}
+			i.scheduleCoordinated("licensing.refresh", l, async () => {
+				let n = await e(a, t.snapshotHeaders);
+				n.kind === "token" ? await u.runPromise(m(n.token, o)) : f?.warn("license refresh failed — retaining the last verified snapshot", {
+					reason: n.reason,
+					...n.reason === "http" ? { status: n.status } : {}
+				});
 			});
 		},
-		onDeactivate: () => t.sync(() => {
-			g(void 0), y(void 0);
+		onDeactivate: () => u.sync(() => {
+			s(void 0), o(void 0);
 		})
 	});
 };
 //#endregion
-export { w as LicenseService, c as LicenseVerifyError, E as PluginNotLicensed, x as entitlementResolver, D as licenseAllowsPlugin, S as licenseStatus, k as licensingPlugin, O as requireLicensedPlugin, p as verifyLicense };
+export { _ as LicenseService, t as LicenseVerifyError, y as PluginNotLicensed, c as entitlementResolver, b as licenseAllowsPlugin, h as licenseStatus, S as licensingPlugin, x as requireLicensedPlugin, n as verifyLicense };

package/dist/refresh.js

@@ -0,0 +1,57 @@
+//#region src/refresh.ts
+var e = async (e, t = {}) => {
+	try {
+		let n = await fetch(e, {
+			headers: t,
+			redirect: "error",
+			signal: AbortSignal.timeout(1e4)
+		});
+		if (!n.ok) return await n.body?.cancel(), {
+			kind: "refused",
+			reason: "http",
+			status: n.status
+		};
+		if (n.body === null) return {
+			kind: "refused",
+			reason: "response"
+		};
+		let r = n.body.getReader(), i = new TextDecoder("utf-8", { fatal: !0 }), a = 0, o = "";
+		try {
+			for (;;) {
+				let e = await r.read();
+				if (e.done) break;
+				if (a += e.value.byteLength, a > 65536) return await r.cancel(), {
+					kind: "refused",
+					reason: "response"
+				};
+				o += i.decode(e.value, { stream: !0 });
+			}
+			o += i.decode();
+		} finally {
+			r.releaseLock();
+		}
+		let s;
+		try {
+			s = JSON.parse(o);
+		} catch {
+			return {
+				kind: "refused",
+				reason: "response"
+			};
+		}
+		return typeof s != "object" || !s || Array.isArray(s) || !("token" in s) || typeof s.token != "string" || s.token.trim() === "" ? {
+			kind: "refused",
+			reason: "response"
+		} : {
+			kind: "token",
+			token: s.token
+		};
+	} catch {
+		return {
+			kind: "refused",
+			reason: "transport"
+		};
+	}
+};
+//#endregion
+export { e as fetchLicenseSnapshot };

package/dist/resolver.js

@@ -0,0 +1,9 @@
+import { getSnapshot as e } from "./snapshot.js";
+import { Effect as t } from "effect";
+//#region src/resolver.ts
+var n = (n, r) => t.sync(() => {
+	let t = e()?.limitFor(n, r);
+	return t === void 0 ? null : t;
+});
+//#endregion
+export { n as entitlementResolver };

package/dist/snapshot.js

@@ -0,0 +1,21 @@
+//#region src/snapshot.ts
+var e = (e, t = {}) => {
+	let n = new Set(e.features), r = new Set(e.plugins), i = t.graceSeconds ?? 0, a = t.now ?? (() => Date.now() / 1e3), o = () => e.exp <= 0 || a() <= e.exp + i;
+	return {
+		claims: e,
+		state: () => e.exp <= 0 || a() <= e.exp ? "active" : o() ? "grace" : "expired",
+		limitFor: (t, n) => {
+			if (!o() || e.tenant !== void 0 && e.tenant !== t) return;
+			let r = e.entitlements[n];
+			if (r !== void 0) return r === "unlimited" ? Infinity : r;
+		},
+		hasFeature: (e) => o() && n.has(e),
+		allowsPlugin: (e) => o() && r.has(e)
+	};
+}, t, n = (e) => {
+	t = e;
+}, r = () => t, i, a = (e) => {
+	i = e;
+}, o = () => i;
+//#endregion
+export { o as getRejection, r as getSnapshot, e as makeSnapshot, a as setRejection, n as setSnapshot };

package/dist/verify.js

@@ -0,0 +1,55 @@
+import { Data as e, Effect as t } from "effect";
+import { importSPKI as n, jwtVerify as r } from "jose";
+//#region src/verify.ts
+var i = class extends e.TaggedError("LicenseVerifyError") {}, a = (e) => typeof e == "object" && e && "code" in e ? String(e.code) : "", o = (e) => {
+	let t = e instanceof Error ? e.message : String(e);
+	return a(e) === "ERR_JWT_EXPIRED" ? new i({
+		reason: "expired",
+		message: t
+	}) : new i({
+		reason: "invalid",
+		message: t
+	});
+}, s = (e) => e === "unlimited" || typeof e == "number" && Number.isFinite(e) && e >= 0, c = (e, n) => {
+	let r = e.edition, a = e.entitlements, o = e.features;
+	if (typeof r != "string" || typeof a != "object" || !a) return t.fail(new i({
+		reason: "malformed",
+		message: "missing edition/entitlements"
+	}));
+	let c = {};
+	for (let [e, n] of Object.entries(a)) {
+		if (!s(n)) return t.fail(new i({
+			reason: "malformed",
+			message: `bad entitlement '${e}'`
+		}));
+		c[e] = n;
+	}
+	let l = Array.isArray(o) ? o.filter((e) => typeof e == "string") : [], u = e.plugins, d = Array.isArray(u) ? u.filter((e) => typeof e == "string") : [];
+	return t.succeed({
+		...typeof e.tenant == "string" ? { tenant: e.tenant } : {},
+		edition: r,
+		entitlements: c,
+		features: l,
+		plugins: d,
+		exp: typeof e.exp == "number" ? e.exp : 0,
+		...typeof e.iat == "number" ? { iat: e.iat } : {},
+		...n === void 0 ? {} : { kid: n }
+	});
+}, l = (e, a) => t.tryPromise({
+	try: () => n(a, "EdDSA"),
+	catch: (e) => new i({
+		reason: "key",
+		message: e instanceof Error ? e.message : String(e)
+	})
+}).pipe(t.flatMap((n) => t.tryPromise({
+	try: async () => {
+		let { payload: t, protectedHeader: i } = await r(e, n, { algorithms: ["EdDSA"] });
+		return {
+			payload: t,
+			kid: i.kid
+		};
+	},
+	catch: o
+})), t.flatMap(({ payload: e, kid: t }) => c(e, t)));
+//#endregion
+export { i as LicenseVerifyError, l as verifyLicense };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-licensing",
-  "version": "0.84.0",
+  "version": "0.86.0",
   "description": "Offline-verified license keys + cloud-issued entitlement snapshots for @voltro apps",
   "keywords": [
     "voltro",
@@ -38,14 +38,14 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.84.0",
-    "@voltro/env": "0.84.0",
-    "@voltro/logger": "0.84.0",
-    "@voltro/protocol": "0.84.0",
+    "@voltro/database": "0.86.0",
+    "@voltro/env": "0.86.0",
+    "@voltro/logger": "0.86.0",
+    "@voltro/protocol": "0.86.0",
     "jose": "^6.2.12"
   },
   "peerDependencies": {
-    "effect": "^3.22.2"
+    "effect": "4.0.1"
   },
   "publishConfig": {
     "access": "public"