bhooai-nexus 3.0.4 → 3.0.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bhooai-nexus",
-  "version": "3.0.4",
+  "version": "3.0.5",
   "description": "BhooAI Nexus - a Node-based full-stack framework (websockets, GraphQL federation, inbuilt security, custom ODM, OAuth, payments, WebRTC, AI, plugins). v2: multi-app, Laravel-style folders, Docker-based scaling.",
   "license": "MIT",
   "author": "BhooAI - oravianando",

package/packages/nexus-admin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bhooai/nexus-admin",
-  "version": "2.0.17",
+  "version": "2.0.18",
   "description": "BhooAI Nexus v2 admin SPA — Apps-tab-first, live registry/health/logs/config/users/payments/AI",
   "type": "module",
   "license": "MIT",
@@ -15,6 +15,7 @@
     "src"
   ],
   "dependencies": {
+    "@bhooai/nexus-crypto": "^2.0.15",
     "@bhooai/nexus-safe-goto": "*",
     "react": "^18.3.1",
     "react-dom": "^18.3.1"

package/packages/nexus-admin/src/App.tsx

@@ -20,6 +20,11 @@ import {
   getCertStatus, generateCerts, type CertStatus, type CertGenerateResult,
   type UploadRecord, type UploadsResponse, type UploadStats, type UploadIndexStatus,
 } from './api.js';
+import { requireLicense } from '@bhooai/nexus-crypto/browser';
+
+// Licensed package: the admin SPA refuses to render without a key injected by
+// the host (VITE_NEXUS_LICENSE_KEY or globalThis.NEXUS_LICENSE_KEY).
+requireLicense('nexus-admin');
 
 
 type Tab = 'overview' | 'processes' | 'logs' | 'config' | 'env' | 'plugins' | 'users' | 'monitoring' | 'payments' | 'databases' | 'uploads' | 'schema' | 'ai' | 'graphql' | 'theme';

package/packages/nexus-ads/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@bhooai/nexus-ads",
-    "version": "2.0.15",
+    "version": "2.0.16",
     "publishConfig": {
         "access": "public"
     },
@@ -12,7 +12,8 @@
         "test": "vitest run"
     },
     "dependencies": {
-        "@bhooai/nexus-core": "^2.0.1"
+        "@bhooai/nexus-core": "^2.0.1",
+        "@bhooai/nexus-crypto": "^2.0.15"
     },
     "devDependencies": {
         "@types/node": "^22.5.0",

package/packages/nexus-ads/src/index.ts

@@ -5,6 +5,7 @@ export * from './GoogleAdsClient.js';
 import { GoogleAdsClient } from './GoogleAdsClient.js';
 import { fetchTransport } from './fetchTransport.js';
 import type { GoogleAdsConfig, HttpTransport } from './types.js';
+import { requireLicense } from '@bhooai/nexus-crypto';
 
 /** Default fetch-based transport (Node >= 18). */
 export { fetchTransport };
@@ -16,5 +17,7 @@ export interface CreateAdsOptions {
 
 /** Build a Google Ads client. Throws at construction if required creds are missing. */
 export function createGoogleAds(config: GoogleAdsConfig, opts: CreateAdsOptions = {}): GoogleAdsClient {
+  // Licensed feature: the Google Ads client needs a master key.
+  requireLicense('nexus-ads');
   return new GoogleAdsClient(config, opts.transport ?? fetchTransport, opts.apiVersion);
 }

package/packages/nexus-ai-client/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@bhooai/nexus-ai-client",
-    "version": "2.0.15",
+    "version": "2.0.16",
     "publishConfig": {
         "access": "public"
     },

package/packages/nexus-auth/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@bhooai/nexus-auth",
-    "version": "2.0.15",
+    "version": "2.0.16",
     "publishConfig": {
         "access": "public"
     },

package/packages/nexus-cache/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@bhooai/nexus-cache",
-    "version": "2.0.15",
+    "version": "2.0.16",
     "publishConfig": {
         "access": "public"
     },

package/packages/nexus-cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bhooai/nexus-cli",
-  "version": "2.0.17",
+  "version": "2.0.18",
   "description": "BhooAI Nexus v2 CLI — init, dev, build, test, scaffolding, plugins, queue, db.",
   "license": "MIT",
   "type": "module",

package/packages/nexus-cli/src/browser.ts

@@ -0,0 +1,20 @@
+/**
+ * Cross-platform "open this URL in the default browser". Best-effort: the
+ * caller always prints the URL too, so headless/SSH sessions still work.
+ */
+import { spawn } from 'node:child_process';
+
+export function openBrowser(url: string): void {
+  try {
+    if (process.platform === 'win32') {
+      // `start` is a cmd builtin; the empty "" is the window title.
+      spawn('cmd', ['/c', 'start', '', url], { stdio: 'ignore', detached: true }).unref();
+    } else if (process.platform === 'darwin') {
+      spawn('open', [url], { stdio: 'ignore', detached: true }).unref();
+    } else {
+      spawn('xdg-open', [url], { stdio: 'ignore', detached: true }).unref();
+    }
+  } catch {
+    // Headless / no browser — the URL was already printed.
+  }
+}

package/packages/nexus-cli/src/commands/dev.ts

@@ -12,6 +12,7 @@ import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import type { CommandContext } from '../dispatcher.js';
 import { loadConfigAuto } from '@bhooai/nexus-core';
+import { ensureLicense } from '@bhooai/nexus-crypto';
 import { resolveConfiguredPorts, findFreeShift, describePortHolder } from '../ports.js';
 import { ServiceManager, type ServiceSpec } from '../devServiceManager.js';
 import { startDevPanel } from '../devPanel.js';
@@ -24,6 +25,19 @@ const RESET = '\x1b[0m';
 export async function run(ctx: CommandContext): Promise<void> {
   const only = (ctx.args.flags.only as string)?.split(',').map((s) => s.trim()) ?? null;
   const projectRoot = process.cwd();
+
+  // License check at project start — verify with the authority
+  // (nexus-bhooai-com). Generation/verification live on the authority. If the
+  // check fails we still start the services: the backend boots in a
+  // license-error state and answers requests with 402 LICENSE_REQUIRED, so the
+  // UI can show the error instead of a proxy 500.
+  try {
+    await ensureLicense({ projectDir: projectRoot });
+  } catch (err) {
+    console.warn(`⚠ License check failed: ${(err as Error).message}`);
+    console.warn('  Starting anyway — API requests will return 402 LICENSE_REQUIRED.');
+  }
+
   const noPanel = !!ctx.args.flags['no-panel'];
   const isTty = Boolean(process.stdin.isTTY && process.stdout.isTTY);
 

package/packages/nexus-cli/src/commands/license.ts

@@ -1,145 +1,199 @@
 /**
- * nexus license — manage the master license key for this machine.
+ * nexus license — manage the project's signed license token.
  *
- *   nexus license add [key] [--server <url>]  — verify against the authority, then store
- *   nexus license status                       — source, fingerprint, live validity
- *   nexus license verify                       — re-check the stored key with the server
- *   nexus license remove                       — delete the stored key
+ *   nexus license add              — browser: authorize this project, auto-store the token
+ *   nexus license add <key>        — exchange a key for a signed token and store it
+ *   nexus license status           — source + live validity
+ *   nexus license verify           — re-check the stored token with the authority
+ *   nexus license token            — print the stored token (for CI: NEXUS_LICENSE_KEY)
+ *   nexus license remove           — delete the project's stored license
  *
- * The key itself unlocks nothing locally: every package derives its own key
- * from it (HKDF-SHA256) and gated features throw until a key is present.
+ * The token is signed by the authority (nexus-bhooai-com) and stored at
+ * `<project>/license/license.jwt`. Generation/verification live on the
+ * authority; this CLI only fetches + stores + checks.
  */
+import { createServer } from 'node:http';
+import { createHash, randomBytes } from 'node:crypto';
+import type { AddressInfo } from 'node:net';
 import type { CommandContext } from '../dispatcher.js';
-import { promptHidden, isInteractive } from '../prompts.js';
+import { isInteractive } from '../prompts.js';
+import { openBrowser } from '../browser.js';
 import {
-  loadMasterKey,
-  saveMasterKey,
-  removeMasterKey,
-  keyFingerprint,
-  LICENSE_ENV_VAR,
+  storeLicenseToken,
+  removeLicense,
+  resolveLicenseToken,
+  ensureLicense,
+  getLicenseServer,
+  licenseFilePath,
 } from '@bhooai/nexus-crypto';
 
-// DEV-MODE: local authority. Flip back to https://nexus.bhooai.com for release.
-const DEFAULT_SERVER = 'http://localhost:4000';
+const AUTH_TIMEOUT_MS = 5 * 60_000;
 
-interface VerifyResult {
-  valid: boolean;
-  plan?: string;
-  expiresAt?: string | null;
-  message?: string;
+function serverOf(ctx: CommandContext): string {
+  const flag = ctx.args.flags.server as string | undefined;
+  return (flag ?? getLicenseServer()).replace(/\/+$/, '');
 }
 
-async function verifyWithServer(server: string, key: string): Promise<VerifyResult> {
-  const url = `${server.replace(/\/+$/, '')}/api/license-verify`;
+async function postJson(url: string, body: unknown): Promise<{ ok: boolean; status: number; data: any }> {
   let res: Response;
   try {
-    res = await fetch(url, {
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ key }),
-    });
+    res = await fetch(url, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) });
   } catch {
-    throw new Error(`Cannot reach the license server at ${server} — check your connection.`);
+    throw new Error(`Cannot reach the license authority at ${new URL(url).origin} — check your connection.`);
   }
-  const data = (await res.json().catch(() => ({}))) as Partial<VerifyResult> & { error?: { message?: string } };
-  if (!res.ok) throw new Error(data.error?.message ?? `License server responded with HTTP ${res.status}.`);
-  return { valid: !!data.valid, plan: data.plan, expiresAt: data.expiresAt ?? null, message: data.message };
+  const data = await res.json().catch(() => ({}));
+  return { ok: res.ok, status: res.status, data };
 }
 
-function keySource(): { key: string | null; source: string } {
-  const env = (process.env[LICENSE_ENV_VAR] ?? '').trim();
-  if (env) return { key: env, source: `env ${LICENSE_ENV_VAR}` };
-  const file = loadMasterKey();
-  if (file) return { key: file, source: '~/.nexus/license.json' };
-  return { key: null, source: '' };
+/** Browser flow: loopback callback + PKCE, then exchange the code for a token. */
+async function runBrowserAdd(server: string, projectRoot: string): Promise<void> {
+  const state = randomBytes(16).toString('base64url');
+  const verifier = randomBytes(32).toString('base64url');
+  const challenge = createHash('sha256').update(verifier).digest('base64url');
+
+  let redirectUri = '';
+  const code = await new Promise<string>((resolve, reject) => {
+    const srv = createServer((req, res) => {
+      const url = new URL(req.url ?? '/', 'http://127.0.0.1');
+      if (url.pathname !== '/callback') {
+        res.writeHead(404);
+        res.end();
+        return;
+      }
+      const returnedState = url.searchParams.get('state');
+      const err = url.searchParams.get('error');
+      const authCode = url.searchParams.get('code');
+      res.writeHead(200, { 'content-type': 'text/html' });
+      if (err) {
+        res.end(`<h1>Authorization failed</h1><p>${err}</p><p>You can close this window.</p>`);
+        srv.close();
+        reject(new Error(`Authorization failed: ${err}`));
+        return;
+      }
+      if (returnedState !== state || !authCode) {
+        res.end('<h1>Invalid callback</h1><p>State mismatch. You can close this window.</p>');
+        srv.close();
+        reject(new Error('Authorization callback failed (state mismatch).'));
+        return;
+      }
+      res.end('<h1>License added</h1><p>You can close this window and return to the terminal.</p>');
+      srv.close();
+      resolve(authCode);
+    });
+
+    const timer = setTimeout(() => {
+      try { srv.close(); } catch { /* ignore */ }
+      reject(new Error('Timed out waiting for authorization.'));
+    }, AUTH_TIMEOUT_MS);
+    timer.unref?.();
+
+    srv.listen(0, '127.0.0.1', () => {
+      const port = (srv.address() as AddressInfo).port;
+      redirectUri = `http://127.0.0.1:${port}/callback`;
+      const authorizeUrl =
+        `${server}/cli/license?redirect_uri=${encodeURIComponent(redirectUri)}` +
+        `&state=${state}&code_challenge=${challenge}&code_challenge_method=S256`;
+      console.log('Opening your browser to authorize this project…');
+      console.log(`If it does not open, visit:\n  ${authorizeUrl}\n`);
+      openBrowser(authorizeUrl);
+    });
+  });
+
+  const { ok, status, data } = await postJson(`${server}/api/license/cli/token`, {
+    code,
+    code_verifier: verifier,
+    redirect_uri: redirectUri,
+  });
+  if (!ok || !data?.token) {
+    throw new Error(data?.error?.message ?? `Token exchange failed (HTTP ${status}).`);
+  }
+  const file = storeLicenseToken(projectRoot, data.token as string);
+  console.log(`✓ License added${data.plan ? ` (${data.plan} plan)` : ''}${data.expiresAt ? ` — expires ${data.expiresAt}` : ''}.`);
+  console.log(`  Stored in ${file}`);
+}
+
+/** Manual flow: exchange a pasted key for a signed token. */
+async function runManualAdd(server: string, key: string, projectRoot: string): Promise<void> {
+  const { ok, status, data } = await postJson(`${server}/api/licenses/token`, { key });
+  if (!ok || !data?.token) {
+    throw new Error(data?.error?.message ?? `License rejected (HTTP ${status}).`);
+  }
+  const file = storeLicenseToken(projectRoot, data.token as string);
+  console.log(`✓ License added${data.plan ? ` (${data.plan} plan)` : ''}${data.expiresAt ? ` — expires ${data.expiresAt}` : ''}.`);
+  console.log(`  Stored in ${file}`);
 }
 
 async function runAdd(ctx: CommandContext): Promise<void> {
-  const server = (ctx.args.flags.server as string | undefined) ?? DEFAULT_SERVER;
-  let key = (ctx.args._[1] ?? '').trim();
-  if (!key) {
+  const server = serverOf(ctx);
+  const projectRoot = process.cwd();
+  const key = (ctx.args._[1] ?? '').trim();
+
+  try {
+    if (key) {
+      await runManualAdd(server, key, projectRoot);
+      return;
+    }
     if (!isInteractive()) {
       console.error('Usage: nexus license add <key> [--server <url>]');
       process.exitCode = 1;
       return;
     }
-    key = (await promptHidden('Paste your license key (nxl_…): ')).trim();
-  }
-  if (!key) {
-    console.error('No key provided.');
-    process.exitCode = 1;
-    return;
-  }
-  console.log(`Verifying with ${server} …`);
-  let result: VerifyResult;
-  try {
-    result = await verifyWithServer(server, key);
+    await runBrowserAdd(server, projectRoot);
   } catch (err) {
     console.error(`✗ ${err instanceof Error ? err.message : String(err)}`);
     process.exitCode = 1;
-    return;
-  }
-  if (!result.valid) {
-    console.error(`✗ License rejected: ${result.message ?? 'unknown reason'}`);
-    process.exitCode = 1;
-    return;
   }
-  const path = saveMasterKey(key, { server });
-  console.log(`✓ Licensed${result.plan ? ` (${result.plan} plan)` : ''}${result.expiresAt ? ` — expires ${result.expiresAt}` : ''}.`);
-  console.log(`  Stored in ${path} (mode 0600).`);
 }
 
 async function runStatus(ctx: CommandContext): Promise<void> {
-  const server = (ctx.args.flags.server as string | undefined) ?? DEFAULT_SERVER;
-  const { key, source } = keySource();
-  if (!key) {
-    console.log('No license configured.');
-    console.log('Run `nexus license add <key>` (get one at https://nexus.bhooai.com/account).');
+  const projectRoot = process.cwd();
+  const resolved = resolveLicenseToken({ projectDir: projectRoot });
+  if (!resolved) {
+    console.log('No license configured for this project.');
+    console.log('Run `nexus license add` to authorize this project in the browser.');
     return;
   }
-  console.log(`Source:      ${source}`);
-  console.log(`Fingerprint: ${keyFingerprint(key)}…`);
+  console.log(`Source: ${resolved.file ?? 'env NEXUS_LICENSE_KEY'}`);
+  console.log(`Server: ${serverOf(ctx)}`);
   try {
-    const result = await verifyWithServer(server, key);
-    if (result.valid) {
-      console.log(`Status:      valid${result.plan ? ` (${result.plan})` : ''}${result.expiresAt ? ` — expires ${result.expiresAt}` : ''}`);
-    } else {
-      console.log(`Status:      INVALID — ${result.message ?? 'rejected by server'}`);
-    }
-  } catch {
-    console.log('Status:      unknown (server unreachable — cached key still works offline)');
+    const claims = await ensureLicense({ projectDir: projectRoot, server: serverOf(ctx) });
+    const exp = typeof claims.exp === 'number' ? ` — expires ${new Date(claims.exp * 1000).toISOString()}` : '';
+    console.log(`Status: valid${claims.plan ? ` (${claims.plan})` : ''}${exp}`);
+  } catch (err) {
+    console.log(`Status: INVALID — ${err instanceof Error ? err.message : String(err)}`);
+    process.exitCode = 1;
   }
 }
 
 async function runVerify(ctx: CommandContext): Promise<void> {
-  const server = (ctx.args.flags.server as string | undefined) ?? DEFAULT_SERVER;
-  const { key } = keySource();
-  if (!key) {
-    console.error('No license configured — run `nexus license add <key>` first.');
-    process.exitCode = 1;
-    return;
-  }
+  const projectRoot = process.cwd();
   try {
-    const result = await verifyWithServer(server, key);
-    if (result.valid) {
-      console.log(`✓ Valid${result.plan ? ` (${result.plan})` : ''}${result.expiresAt ? ` — expires ${result.expiresAt}` : ''}.`);
-    } else {
-      console.error(`✗ Invalid: ${result.message ?? 'rejected by server'}.`);
-      process.exitCode = 1;
-    }
+    const claims = await ensureLicense({ projectDir: projectRoot, server: serverOf(ctx), force: true });
+    console.log(`✓ Valid${claims.plan ? ` (${claims.plan})` : ''}.`);
   } catch (err) {
     console.error(`✗ ${err instanceof Error ? err.message : String(err)}`);
     process.exitCode = 1;
   }
 }
 
-async function runRemove(): Promise<void> {
-  if (process.env[LICENSE_ENV_VAR]) {
-    console.log(`Unset ${LICENSE_ENV_VAR} to remove the license (env takes precedence over the file).`);
+function runToken(): void {
+  const resolved = resolveLicenseToken({ projectDir: process.cwd() });
+  if (!resolved) {
+    console.error('No license configured — run `nexus license add` first.');
+    process.exitCode = 1;
     return;
   }
-  if (removeMasterKey()) console.log('✓ License removed.');
-  else console.log('No stored license found.');
+  // Bare token to stdout so CI can capture it.
+  process.stdout.write(resolved.token + '\n');
+}
+
+function runRemove(): void {
+  const projectRoot = process.cwd();
+  if (removeLicense(projectRoot)) {
+    console.log(`✓ License removed (${licenseFilePath(projectRoot)}).`);
+  } else {
+    console.log('No stored license found.');
+  }
 }
 
 export async function run(ctx: CommandContext): Promise<void> {
@@ -154,14 +208,18 @@ export async function run(ctx: CommandContext): Promise<void> {
     case 'verify':
       await runVerify(ctx);
       break;
+    case 'token':
+      runToken();
+      break;
     case 'remove':
-      await runRemove();
+      runRemove();
       break;
     default:
       console.log('Usage:');
       console.log('  nexus license add [key] [--server <url>]');
       console.log('  nexus license status');
       console.log('  nexus license verify');
+      console.log('  nexus license token');
       console.log('  nexus license remove');
       if (sub) {
         console.error(`Unknown license subcommand: ${sub}`);
@@ -170,5 +228,5 @@ export async function run(ctx: CommandContext): Promise<void> {
   }
 }
 
-export const description = 'Manage the master license key (add / status / verify / remove)';
-export const usage = 'nexus license <add|status|verify|remove> [key] [--server <url>]';
+export const description = 'Manage the project license (add / status / verify / token / remove)';
+export const usage = 'nexus license <add|status|verify|token|remove> [key] [--server <url>]';

package/packages/nexus-cli/templates/base/apps/frontend/index.html.ejs

@@ -4,7 +4,7 @@
   <meta charset="UTF-8"/>
   <meta name="viewport" content="width=device-width, initial-scale=1.0"/>
   <title><%= name %></title>
-  <style>html,body{margin:0;padding:0;background:#0b1220}</style>
+  <style>html,body{margin:0;padding:0;background:#fff}</style>
 </head>
 <body>
   <div id="root"></div>

package/packages/nexus-cli/templates/base/apps/frontend/src/App.tsx.ejs

@@ -7,7 +7,7 @@ export function App() {
     return <NotFound />;
   }
   return (
-    <main style={{ fontFamily: 'system-ui', padding: '2rem', background: '#0b1220', color: '#e2e8f0', minHeight: '100vh', margin: 0 }}>
+    <main style={{ fontFamily: 'system-ui', padding: '2rem', minHeight: '100vh', margin: 0 }}>
       <h1>Welcome to <%= name %></h1>
       <p>Your Nexus app is up. Edit <code>apps/frontend/src/App.tsx</code> to get started.</p>
     </main>

package/packages/nexus-cli/templates/base/apps/frontend/src/NotFound.tsx.ejs

@@ -1,6 +1,6 @@
 import React from 'react';
 
-const resetStyle = 'html,body{margin:0;padding:0;background:#0b1220}';
+const resetStyle = 'html,body{margin:0;padding:0;background:#fff}';
 
 export function NotFound() {
   return (
@@ -15,25 +15,25 @@ export function NotFound() {
         justifyContent: 'center',
         margin: 0,
         padding: 0,
-        background: '#0b1220',
-        color: '#e2e8f0',
+        background: '#fff',
+        color: '#0f172a',
       }}
     >
       <div
         style={{
           maxWidth: '32rem',
           textAlign: 'center',
-          background: '#0f172a',
-          border: '1px solid #1e293b',
+          background: '#f8fafc',
+          border: '1px solid #e2e8f0',
           borderRadius: 12,
           padding: '3rem 2rem',
         }}
       >
-        <div style={{ fontSize: '4rem', color: '#60a5fa', margin: '0 0 .5rem', fontWeight: 700 }}>
+        <div style={{ fontSize: '4rem', color: '#2563eb', margin: '0 0 .5rem', fontWeight: 700 }}>
           404
         </div>
         <h1 style={{ fontSize: '1.5rem', margin: '0 0 1rem', fontWeight: 600 }}>Not Found</h1>
-        <p style={{ color: '#94a3b8', lineHeight: 1.5, margin: '0 0 1.5rem' }}>
+        <p style={{ color: '#64748b', lineHeight: 1.5, margin: '0 0 1.5rem' }}>
           The page you were looking for does not exist.
         </p>
         <a
@@ -42,7 +42,7 @@ export function NotFound() {
             display: 'inline-block',
             padding: '.625rem 1.125rem',
             borderRadius: 8,
-            background: '#60a5fa',
+            background: '#2563eb',
             color: '#fff',
             textDecoration: 'none',
           }}

package/packages/nexus-cli/templates/base/gitignore

@@ -11,6 +11,9 @@ build/
 .env.local
 nexus.runtime.json
 
+# License (signed token — bearer credential, per project)
+license/
+
 # Generated
 logs/
 certs/

package/packages/nexus-core/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@bhooai/nexus-core",
-    "version": "2.0.15",
+    "version": "2.0.16",
     "publishConfig": {
         "access": "public"
     },
@@ -20,6 +20,7 @@
     "dependencies": {
         "@bhooai/nexus-ai-client": "^2.0.1",
         "@bhooai/nexus-auth": "^2.0.1",
+        "@bhooai/nexus-crypto": "^2.0.15",
         "@bhooai/nexus-data": "^2.0.1",
         "selfsigned": "^5.5.0",
         "zod": "^3.23.8"

package/packages/nexus-core/src/app/createNexusApp.ts

@@ -40,6 +40,7 @@ import { createLazyDb, registerAdminRoutes, RequestLogBuffer } from './adminModu
 import { registerAuthRoutes } from './authModule.js';
 import { issueCsrfToken, getCsrfToken, csrf, authToken, requireRole } from '@bhooai/nexus-auth';
 import { connect } from '@bhooai/nexus-data';
+import { ensureLicense } from '@bhooai/nexus-crypto';
 import { createGateway, createFederatedGateway, graphqlHttpHandler, getExplorerHtml, helloSubgraph, SubscriptionServer } from '@bhooai/nexus-graphql';
 import type { Subgraph, GraphQLContext } from '@bhooai/nexus-graphql';
 
@@ -103,6 +104,19 @@ export async function createNexusApp(opts: CreateNexusAppOptions = {}): Promise<
   const projectRoot = resolve(opts.projectRoot ?? dirname(srcRoot));
   let config = opts.config ?? (await loadConfigAuto({ root: projectRoot }));
 
+  // License check at project start — verify the token (signature via fetched
+  // JWKS + online status) with the authority. On failure the app still boots,
+  // but every request is answered with 402 LICENSE_REQUIRED (middleware below)
+  // instead of crashing — a crashed backend surfaces as an opaque HTTP 500
+  // through dev proxies.
+  let licenseError: string | null = null;
+  try {
+    await ensureLicense({ projectDir: projectRoot });
+  } catch (err) {
+    licenseError = (err as Error).message;
+    console.error(`[${name}] license check failed: ${licenseError}`);
+  }
+
   // ------------------------------------------------------------------
   // Per-app ports: nexus.config.ts `apps[]` is authoritative. The app's own
   // entry (matched by `opts.name`) wins over `server.port`. NEXUS_PORT (set
@@ -516,6 +530,17 @@ export async function createNexusApp(opts: CreateNexusAppOptions = {}): Promise<
     },
   });
 
+  // License gate — when the project-start check failed, answer every request
+  // (except /health) with 402 so the UI can show the license error rather than
+  // an opaque 500 from a crashed backend.
+  if (licenseError) {
+    const message = licenseError;
+    server.use(async (ctx, next) => {
+      if (ctx.path === '/health') return next();
+      ctx.json({ error: { code: 'LICENSE_REQUIRED', message } }, 402);
+    });
+  }
+
   // ------------------------------------------------------------------
   // Realtime WS server — mount discovered ws/*.room.ts handlers (chat lobby)
   // React stack only — future uses live canvas