@voltro/plugin-licensing 0.86.0 → 0.88.0

package/dist/snapshot.js

@@ -1,21 +1,32 @@
-//#region src/snapshot.ts
+// src/snapshot.ts
 var e = (e, t = {}) => {
-	let n = new Set(e.features), r = new Set(e.plugins), i = t.graceSeconds ?? 0, a = t.now ?? (() => Date.now() / 1e3), o = () => e.exp <= 0 || a() <= e.exp + i;
-	return {
-		claims: e,
-		state: () => e.exp <= 0 || a() <= e.exp ? "active" : o() ? "grace" : "expired",
-		limitFor: (t, n) => {
-			if (!o() || e.tenant !== void 0 && e.tenant !== t) return;
-			let r = e.entitlements[n];
-			if (r !== void 0) return r === "unlimited" ? Infinity : r;
+	let n = {};
+	for (let [t, r] of Object.entries(e.entitlements)) Object.defineProperty(n, t, {
+		value: r,
+		enumerable: !0
+	});
+	let r = Object.freeze({
+		...e,
+		entitlements: Object.freeze(n),
+		features: Object.freeze([...e.features]),
+		plugins: Object.freeze([...e.plugins])
+	}), i = new Set(r.features), a = new Set(r.plugins), o = t.graceSeconds ?? 0;
+	if (!Number.isSafeInteger(o) || o < 0) throw TypeError("Invalid license snapshot grace");
+	let s = t.now ?? (() => Date.now() / 1e3), c = () => r.exp <= 0 || s() < r.exp + o;
+	return Object.freeze({
+		claims: r,
+		state: () => r.exp <= 0 || s() < r.exp ? "active" : c() ? "grace" : "expired",
+		limitFor: (e, t) => {
+			if (!c() || r.tenant !== void 0 && r.tenant !== e || !Object.hasOwn(r.entitlements, t)) return;
+			let n = r.entitlements[t];
+			if (n !== void 0) return n === "unlimited" ? Infinity : n;
 		},
-		hasFeature: (e) => o() && n.has(e),
-		allowsPlugin: (e) => o() && r.has(e)
-	};
+		hasFeature: (e) => c() && i.has(e),
+		allowsPlugin: (e) => c() && a.has(e)
+	});
 }, t, n = (e) => {
 	t = e;
 }, r = () => t, i, a = (e) => {
 	i = e;
 }, o = () => i;
-//#endregion
 export { o as getRejection, r as getSnapshot, e as makeSnapshot, a as setRejection, n as setSnapshot };

package/dist/verify.js

@@ -1,55 +1,87 @@
 import { Data as e, Effect as t } from "effect";
-import { importSPKI as n, jwtVerify as r } from "jose";
-//#region src/verify.ts
-var i = class extends e.TaggedError("LicenseVerifyError") {}, a = (e) => typeof e == "object" && e && "code" in e ? String(e.code) : "", o = (e) => {
+import { decodeProtectedHeader as n, errors as r, importSPKI as i, jwtVerify as a } from "jose";
+// src/verify.ts
+var o = class extends e.TaggedError("LicenseVerifyError") {}, s = (e) => typeof e == "object" && e && "code" in e ? String(e.code) : "", c = (e) => {
 	let t = e instanceof Error ? e.message : String(e);
-	return a(e) === "ERR_JWT_EXPIRED" ? new i({
+	return s(e) === "ERR_JWT_EXPIRED" ? new o({
 		reason: "expired",
 		message: t
-	}) : new i({
+	}) : new o({
 		reason: "invalid",
 		message: t
 	});
-}, s = (e) => e === "unlimited" || typeof e == "number" && Number.isFinite(e) && e >= 0, c = (e, n) => {
-	let r = e.edition, a = e.entitlements, o = e.features;
-	if (typeof r != "string" || typeof a != "object" || !a) return t.fail(new i({
+}, l = (e) => e === "unlimited" || typeof e == "number" && Number.isFinite(e) && e >= 0, u = (e) => typeof e == "string" && e.length > 0 && e.length <= 256 && e.trim() === e, d = (e) => Array.isArray(e) && e.every(u), f = (e) => typeof e == "number" && Number.isSafeInteger(e) && e >= 0 && e <= 864e10, p = (e, n) => {
+	let r = e.edition, i = e.entitlements, a = e.features, s = e.plugins, c = e.tenant;
+	if (!u(r) || typeof i != "object" || !i || Array.isArray(i)) return t.fail(new o({
 		reason: "malformed",
 		message: "missing edition/entitlements"
 	}));
-	let c = {};
-	for (let [e, n] of Object.entries(a)) {
-		if (!s(n)) return t.fail(new i({
+	if (c !== void 0 && !u(c) || a !== void 0 && !d(a) || s !== void 0 && !d(s)) return t.fail(new o({
+		reason: "malformed",
+		message: "invalid license scope or grants"
+	}));
+	if (e.exp !== void 0 && !f(e.exp) || e.iat !== void 0 && !f(e.iat) || n !== void 0 && !u(n)) return t.fail(new o({
+		reason: "malformed",
+		message: "invalid license time or key identity"
+	}));
+	let p = {};
+	for (let [e, n] of Object.entries(i)) {
+		if (!u(e) || !l(n)) return t.fail(new o({
 			reason: "malformed",
 			message: `bad entitlement '${e}'`
 		}));
-		c[e] = n;
+		Object.defineProperty(p, e, {
+			value: n,
+			enumerable: !0
+		});
 	}
-	let l = Array.isArray(o) ? o.filter((e) => typeof e == "string") : [], u = e.plugins, d = Array.isArray(u) ? u.filter((e) => typeof e == "string") : [];
+	let m = a === void 0 ? [] : a, h = s === void 0 ? [] : s;
 	return t.succeed({
-		...typeof e.tenant == "string" ? { tenant: e.tenant } : {},
+		...c === void 0 ? {} : { tenant: c },
 		edition: r,
-		entitlements: c,
-		features: l,
-		plugins: d,
+		entitlements: p,
+		features: m,
+		plugins: h,
 		exp: typeof e.exp == "number" ? e.exp : 0,
 		...typeof e.iat == "number" ? { iat: e.iat } : {},
 		...n === void 0 ? {} : { kid: n }
 	});
-}, l = (e, a) => t.tryPromise({
-	try: () => n(a, "EdDSA"),
-	catch: (e) => new i({
-		reason: "key",
-		message: e instanceof Error ? e.message : String(e)
-	})
-}).pipe(t.flatMap((n) => t.tryPromise({
-	try: async () => {
-		let { payload: t, protectedHeader: i } = await r(e, n, { algorithms: ["EdDSA"] });
-		return {
-			payload: t,
-			kid: i.kid
-		};
-	},
-	catch: o
-})), t.flatMap(({ payload: e, kid: t }) => c(e, t)));
-//#endregion
-export { i as LicenseVerifyError, l as verifyLicense };
+}, m = (e, s, l = {}) => {
+	let u = l.graceSeconds ?? 0, d = l.nowSeconds;
+	return t.suspend(() => {
+		let l = d ?? Math.floor(Date.now() / 1e3);
+		return !Number.isSafeInteger(u) || u < 0 || !Number.isSafeInteger(l) || l < 0 || !Number.isFinite((/* @__PURE__ */ new Date(l * 1e3)).getTime()) ? t.fail(new o({
+			reason: "malformed",
+			message: "invalid trusted verification clock or grace"
+		})) : t.tryPromise({
+			try: () => i(s, "EdDSA"),
+			catch: (e) => new o({
+				reason: "key",
+				message: e instanceof Error ? e.message : String(e)
+			})
+		}).pipe(t.flatMap((i) => t.tryPromise({
+			try: async () => {
+				try {
+					let { payload: t, protectedHeader: n } = await a(e, i, {
+						algorithms: ["EdDSA"],
+						currentDate: /* @__PURE__ */ new Date(l * 1e3)
+					});
+					return {
+						payload: t,
+						kid: n.kid
+					};
+				} catch (t) {
+					if (!(t instanceof r.JWTExpired) || t.claim !== "exp" || u === 0) throw t;
+					let i = t.payload.exp;
+					if (i === void 0 || !Number.isSafeInteger(i) || i <= 0 || !Number.isSafeInteger(i + u) || l >= i + u) throw t;
+					return {
+						payload: t.payload,
+						kid: n(e).kid
+					};
+				}
+			},
+			catch: c
+		})), t.flatMap(({ payload: e, kid: t }) => p(e, t)));
+	});
+};
+export { o as LicenseVerifyError, m as verifyLicense };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-licensing",
-  "version": "0.86.0",
+  "version": "0.88.0",
   "description": "Offline-verified license keys + cloud-issued entitlement snapshots for @voltro apps",
   "keywords": [
     "voltro",
@@ -28,7 +28,27 @@
       "import": "./dist/sign.js",
       "default": "./dist/sign.js"
     },
-    "./package.json": "./package.json"
+    "./package.json": "./package.json",
+    "./games": {
+      "types": "./dist/games.d.ts",
+      "import": "./dist/games.js",
+      "default": "./dist/games.js"
+    },
+    "./cloud": {
+      "types": "./dist/cloud.d.ts",
+      "import": "./dist/cloud.js",
+      "default": "./dist/cloud.js"
+    },
+    "./gate": {
+      "types": "./dist/gate.d.ts",
+      "import": "./dist/gate.js",
+      "default": "./dist/gate.js"
+    },
+    "./inspect": {
+      "types": "./dist/inspect.d.ts",
+      "import": "./dist/inspect.js",
+      "default": "./dist/inspect.js"
+    }
   },
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -38,14 +58,14 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.86.0",
-    "@voltro/env": "0.86.0",
-    "@voltro/logger": "0.86.0",
-    "@voltro/protocol": "0.86.0",
-    "jose": "^6.2.12"
+    "@voltro/database": "0.88.0",
+    "@voltro/env": "0.88.0",
+    "@voltro/logger": "0.88.0",
+    "@voltro/protocol": "0.88.0",
+    "jose": "^6.2.13"
   },
   "peerDependencies": {
-    "effect": "4.0.1"
+    "effect": "4.1.0"
   },
   "publishConfig": {
     "access": "public"

package/dist/refresh.js

@@ -1,57 +0,0 @@
-//#region src/refresh.ts
-var e = async (e, t = {}) => {
-	try {
-		let n = await fetch(e, {
-			headers: t,
-			redirect: "error",
-			signal: AbortSignal.timeout(1e4)
-		});
-		if (!n.ok) return await n.body?.cancel(), {
-			kind: "refused",
-			reason: "http",
-			status: n.status
-		};
-		if (n.body === null) return {
-			kind: "refused",
-			reason: "response"
-		};
-		let r = n.body.getReader(), i = new TextDecoder("utf-8", { fatal: !0 }), a = 0, o = "";
-		try {
-			for (;;) {
-				let e = await r.read();
-				if (e.done) break;
-				if (a += e.value.byteLength, a > 65536) return await r.cancel(), {
-					kind: "refused",
-					reason: "response"
-				};
-				o += i.decode(e.value, { stream: !0 });
-			}
-			o += i.decode();
-		} finally {
-			r.releaseLock();
-		}
-		let s;
-		try {
-			s = JSON.parse(o);
-		} catch {
-			return {
-				kind: "refused",
-				reason: "response"
-			};
-		}
-		return typeof s != "object" || !s || Array.isArray(s) || !("token" in s) || typeof s.token != "string" || s.token.trim() === "" ? {
-			kind: "refused",
-			reason: "response"
-		} : {
-			kind: "token",
-			token: s.token
-		};
-	} catch {
-		return {
-			kind: "refused",
-			reason: "transport"
-		};
-	}
-};
-//#endregion
-export { e as fetchLicenseSnapshot };