brew-tui 0.6.1 → 0.6.2

package/build/chunk-QPXROTAP.js

@@ -0,0 +1,679 @@
+import {
+  captureSnapshot
+} from "./chunk-PVSE6XO7.js";
+import {
+  DATA_DIR,
+  LICENSE_PATH,
+  ensureDataDirs,
+  getMachineId
+} from "./chunk-EHIBIFCB.js";
+import {
+  fetchWithRetry,
+  t
+} from "./chunk-6NA4INJS.js";
+import {
+  logger
+} from "./chunk-KDHEUNRI.js";
+
+// src/lib/sync/sync-engine.ts
+import { readFile as readFile3, writeFile as writeFile3, rename as rename3 } from "fs/promises";
+import { join as join2 } from "path";
+import { hostname } from "os";
+
+// src/lib/sync/crypto.ts
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync, hkdfSync } from "crypto";
+var ENCRYPTION_SECRET = "brew-tui-sync-aes256gcm-v1";
+var HKDF_SALT = "brew-tui-sync-salt-v1";
+var keyCache = /* @__PURE__ */ new Map();
+var _legacyKey = null;
+function deriveEncryptionKey(licenseKey) {
+  const cached = keyCache.get(licenseKey);
+  if (cached) return cached;
+  const derived = Buffer.from(hkdfSync("sha256", ENCRYPTION_SECRET, HKDF_SALT, licenseKey, 32));
+  keyCache.set(licenseKey, derived);
+  return derived;
+}
+function deriveLegacyKey() {
+  if (!_legacyKey) {
+    _legacyKey = scryptSync(ENCRYPTION_SECRET, HKDF_SALT, 32, { N: 16384, r: 8, p: 1 });
+  }
+  return _legacyKey;
+}
+function encryptPayload(data, licenseKey) {
+  const key = deriveEncryptionKey(licenseKey);
+  const iv = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const plaintext = JSON.stringify(data);
+  const ciphertext = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return {
+    encrypted: ciphertext.toString("base64"),
+    iv: iv.toString("base64"),
+    tag: tag.toString("base64")
+  };
+}
+function decryptPayload(encrypted, iv, tag, licenseKey) {
+  const ivBuf = Buffer.from(iv, "base64");
+  const tagBuf = Buffer.from(tag, "base64");
+  const ciphertext = Buffer.from(encrypted, "base64");
+  for (const key of [deriveEncryptionKey(licenseKey), deriveLegacyKey()]) {
+    try {
+      const decipher = createDecipheriv("aes-256-gcm", key, ivBuf);
+      decipher.setAuthTag(tagBuf);
+      const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+      return JSON.parse(plaintext.toString("utf-8"));
+    } catch {
+    }
+  }
+  throw new Error("Failed to decrypt sync payload");
+}
+
+// src/lib/sync/backends/icloud-backend.ts
+import { readFile, writeFile, rename, mkdir, stat } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
+var ICLOUD_BASE = join(
+  homedir(),
+  "Library",
+  "Mobile Documents",
+  "com~apple~CloudDocs"
+);
+var ICLOUD_SYNC_DIR = join(ICLOUD_BASE, "BrewTUI");
+var ICLOUD_SYNC_PATH = join(ICLOUD_SYNC_DIR, "sync.json");
+async function isICloudAvailable() {
+  try {
+    await stat(ICLOUD_BASE);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function isValidEnvelope(v) {
+  if (!v || typeof v !== "object") return false;
+  const obj = v;
+  return obj["schemaVersion"] === 1 && typeof obj["encrypted"] === "string" && typeof obj["iv"] === "string" && typeof obj["tag"] === "string" && typeof obj["updatedAt"] === "string";
+}
+async function readSyncEnvelope() {
+  try {
+    const raw = await readFile(ICLOUD_SYNC_PATH, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (!isValidEnvelope(parsed)) {
+      logger.warn("sync: invalid envelope structure in iCloud file");
+      return null;
+    }
+    return parsed;
+  } catch (err) {
+    if (err instanceof Error && err.code === "ENOENT") {
+      return null;
+    }
+    logger.warn("sync: could not read iCloud envelope", { error: String(err) });
+    return null;
+  }
+}
+async function writeSyncEnvelope(envelope) {
+  await mkdir(ICLOUD_SYNC_DIR, { recursive: true });
+  const tmpPath = ICLOUD_SYNC_PATH + ".tmp";
+  await writeFile(tmpPath, JSON.stringify(envelope, null, 2), {
+    encoding: "utf-8",
+    mode: 384
+  });
+  await rename(tmpPath, ICLOUD_SYNC_PATH);
+}
+
+// src/lib/license/license-manager.ts
+import { readFile as readFile2, writeFile as writeFile2, rename as rename2, rm } from "fs/promises";
+import { createCipheriv as createCipheriv2, createDecipheriv as createDecipheriv2, randomBytes as randomBytes2, scryptSync as scryptSync2, hkdfSync as hkdfSync2 } from "crypto";
+
+// src/lib/license/polar-api.ts
+var BASE_URL = "https://api.polar.sh/v1/customer-portal/license-keys";
+var POLAR_ORGANIZATION_ID = "b8f245c0-d116-4457-92fb-1bda47139f82";
+function validateApiUrl(url) {
+  const parsed = new URL(url);
+  if (parsed.protocol !== "https:") {
+    throw new Error("HTTPS required for license API");
+  }
+  if (!parsed.hostname.endsWith("polar.sh")) {
+    throw new Error("Invalid API host");
+  }
+}
+async function post(endpoint, body, expectEmpty = false) {
+  const url = `${BASE_URL}/${endpoint}`;
+  validateApiUrl(url);
+  const res = await fetchWithRetry(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body)
+  }, 15e3);
+  if (!res.ok) {
+    let message = `Request failed with status ${res.status}`;
+    try {
+      const errBody = await res.json();
+      if (typeof errBody.detail === "string") message = errBody.detail;
+      else if (typeof errBody.error === "string") message = errBody.error;
+      else if (typeof errBody.message === "string") message = errBody.message;
+    } catch {
+    }
+    throw new Error(message);
+  }
+  if (expectEmpty || res.status === 204) return void 0;
+  return res.json();
+}
+async function activateLicense(key) {
+  const machineId = await getMachineId();
+  const activation = await post("activate", {
+    key,
+    organization_id: POLAR_ORGANIZATION_ID,
+    label: machineId
+    // SEG-004: Use machine UUID instead of hostname
+  });
+  if (!activation || typeof activation.id !== "string" || !activation.license_key) {
+    throw new Error("Invalid activation response: missing required fields");
+  }
+  let customerEmail = "";
+  let customerName = "";
+  try {
+    const validated = await post("validate", {
+      key,
+      organization_id: POLAR_ORGANIZATION_ID,
+      activation_id: activation.id
+    });
+    customerEmail = validated.customer?.email ?? "";
+    customerName = validated.customer?.name ?? "";
+  } catch {
+  }
+  return {
+    activated: true,
+    error: null,
+    instance: { id: activation.id },
+    license_key: {
+      id: 0,
+      status: activation.license_key.status,
+      key,
+      activation_limit: 0,
+      activations_count: 0,
+      expires_at: activation.license_key.expires_at
+    },
+    meta: { customer_email: customerEmail, customer_name: customerName }
+  };
+}
+async function validateLicense(key, instanceId) {
+  const res = await post("validate", {
+    key,
+    organization_id: POLAR_ORGANIZATION_ID,
+    activation_id: instanceId
+  });
+  if (!res || typeof res.id !== "string" || typeof res.status !== "string" || !res.customer) {
+    throw new Error("Invalid validation response: missing required fields");
+  }
+  const notExpired = res.expires_at === null || new Date(res.expires_at) > /* @__PURE__ */ new Date();
+  const valid = res.status === "granted" && notExpired;
+  return {
+    valid,
+    error: valid ? null : `License ${res.status}`,
+    license_key: {
+      id: 0,
+      status: res.status,
+      key,
+      expires_at: res.expires_at
+    },
+    instance: { id: instanceId }
+  };
+}
+async function deactivateLicense(key, instanceId) {
+  await post(
+    "deactivate",
+    { key, organization_id: POLAR_ORGANIZATION_ID, activation_id: instanceId },
+    true
+  );
+}
+
+// src/lib/license/license-manager.ts
+var REVALIDATION_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+var GRACE_PERIOD_MS = 7 * 24 * 60 * 60 * 1e3;
+var ACTIVATION_COOLDOWN_MS = 3e4;
+var MAX_ATTEMPTS = 5;
+var LOCKOUT_MS = 15 * 60 * 1e3;
+var tracker = {
+  attempts: 0,
+  lastAttempt: 0,
+  lockedUntil: 0
+};
+function checkRateLimit() {
+  const now = Date.now();
+  if (now < tracker.lockedUntil) {
+    const remaining = Math.ceil((tracker.lockedUntil - now) / 6e4);
+    throw new Error(t("cli_rateLimited", { minutes: remaining }));
+  }
+  if (now - tracker.lastAttempt < ACTIVATION_COOLDOWN_MS) {
+    throw new Error(t("cli_cooldown"));
+  }
+}
+function recordAttempt(success) {
+  const now = Date.now();
+  tracker.lastAttempt = now;
+  if (success) {
+    tracker.attempts = 0;
+    return;
+  }
+  tracker.attempts++;
+  if (tracker.attempts >= MAX_ATTEMPTS) {
+    tracker.lockedUntil = now + LOCKOUT_MS;
+    tracker.attempts = 0;
+  }
+}
+var ENCRYPTION_SECRET2 = "brew-tui-license-aes256gcm-v1";
+var HKDF_SALT2 = "brew-tui-salt-v1";
+var _derivedKey = null;
+var _legacyKey2 = null;
+var _decryptedWithLegacyKey = false;
+async function deriveEncryptionKey2() {
+  if (_derivedKey) return _derivedKey;
+  const machineId = await getMachineId();
+  const derived = hkdfSync2("sha256", ENCRYPTION_SECRET2, HKDF_SALT2, machineId, 32);
+  _derivedKey = Buffer.from(derived);
+  return _derivedKey;
+}
+function deriveLegacyKey2() {
+  if (!_legacyKey2) _legacyKey2 = scryptSync2(ENCRYPTION_SECRET2, HKDF_SALT2, 32);
+  return _legacyKey2;
+}
+async function encryptLicenseData(data) {
+  const key = await deriveEncryptionKey2();
+  const iv = randomBytes2(12);
+  const cipher = createCipheriv2("aes-256-gcm", key, iv);
+  const plaintext = JSON.stringify(data);
+  const ciphertext = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return {
+    encrypted: ciphertext.toString("base64"),
+    iv: iv.toString("base64"),
+    tag: tag.toString("base64")
+  };
+}
+async function decryptLicenseData(encrypted, iv, tag) {
+  const ivBuf = Buffer.from(iv, "base64");
+  const tagBuf = Buffer.from(tag, "base64");
+  const ciphertext = Buffer.from(encrypted, "base64");
+  const candidates = [
+    [await deriveEncryptionKey2(), false],
+    [deriveLegacyKey2(), true]
+  ];
+  let lastErr;
+  for (const [key, isLegacy] of candidates) {
+    try {
+      const decipher = createDecipheriv2("aes-256-gcm", key, ivBuf);
+      decipher.setAuthTag(tagBuf);
+      const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+      _decryptedWithLegacyKey = isLegacy;
+      return JSON.parse(plaintext.toString("utf-8"));
+    } catch (err) {
+      lastErr = err;
+    }
+  }
+  throw lastErr instanceof Error ? lastErr : new Error("Failed to decrypt license");
+}
+function isLicenseFile(obj) {
+  return typeof obj === "object" && obj !== null && obj.version === 1;
+}
+function isEncryptedLicenseFile(obj) {
+  if (!isLicenseFile(obj)) return false;
+  const record = obj;
+  return typeof record.encrypted === "string" && typeof record.iv === "string" && typeof record.tag === "string";
+}
+async function loadLicense() {
+  try {
+    const raw = await readFile2(LICENSE_PATH, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (!isLicenseFile(parsed)) {
+      throw new Error("Invalid license data format");
+    }
+    const file = parsed;
+    if (file.version !== 1) {
+      throw new Error("Unsupported data version");
+    }
+    if (isEncryptedLicenseFile(file)) {
+      const data = await decryptLicenseData(file.encrypted, file.iv, file.tag);
+      const fileRecord = file;
+      if (fileRecord.machineId) {
+        const currentMachineId = await getMachineId();
+        if (fileRecord.machineId !== currentMachineId) {
+          throw new Error("License was activated on a different machine");
+        }
+      }
+      if (_decryptedWithLegacyKey) {
+        _decryptedWithLegacyKey = false;
+        try {
+          await saveLicense(data);
+        } catch {
+        }
+      }
+      return data;
+    }
+    if (file.license) {
+      const data = file.license;
+      await saveLicense(data);
+      return data;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+async function saveLicense(data) {
+  await ensureDataDirs();
+  const { encrypted, iv, tag } = await encryptLicenseData(data);
+  const machineId = await getMachineId();
+  const file = { version: 1, encrypted, iv, tag, machineId };
+  const tmpPath = LICENSE_PATH + ".tmp";
+  await writeFile2(tmpPath, JSON.stringify(file, null, 2), { encoding: "utf-8", mode: 384 });
+  await rename2(tmpPath, LICENSE_PATH);
+}
+async function clearLicense() {
+  try {
+    await rm(LICENSE_PATH);
+  } catch {
+  }
+}
+function isExpired(license) {
+  if (!license.expiresAt) return false;
+  const expiry = new Date(license.expiresAt).getTime();
+  if (isNaN(expiry)) return true;
+  return expiry < Date.now();
+}
+function needsRevalidation(license) {
+  const lastValidated = new Date(license.lastValidatedAt).getTime();
+  if (isNaN(lastValidated)) return true;
+  return Date.now() - lastValidated > REVALIDATION_INTERVAL_MS;
+}
+function isWithinGracePeriod(license) {
+  const lastValidated = new Date(license.lastValidatedAt).getTime();
+  if (isNaN(lastValidated)) return false;
+  return Date.now() - lastValidated < GRACE_PERIOD_MS;
+}
+function getDegradationLevel(license) {
+  const lastValidated = new Date(license.lastValidatedAt).getTime();
+  if (isNaN(lastValidated)) return "expired";
+  const elapsed = Date.now() - lastValidated;
+  if (elapsed < 0) return "none";
+  const days = elapsed / (24 * 60 * 60 * 1e3);
+  if (days <= 7) return "none";
+  if (days <= 14) return "warning";
+  if (days <= 30) return "limited";
+  return "expired";
+}
+function validateLicenseKey(key) {
+  if (key.length < 10 || key.length > 100) {
+    throw new Error("Invalid license key format");
+  }
+  if (!/^[\w-]+$/.test(key)) {
+    throw new Error("Invalid license key format");
+  }
+}
+function detectPlan(key) {
+  const upper = key.toUpperCase();
+  return upper.startsWith("BTUI-T-") || upper.startsWith("BTUI-T_") ? "team" : "pro";
+}
+async function activate(key) {
+  validateLicenseKey(key);
+  checkRateLimit();
+  let success = false;
+  try {
+    const res = await activateLicense(key);
+    if (!res.activated) {
+      throw new Error(res.error ?? "Activation failed");
+    }
+    const license = {
+      key,
+      instanceId: res.instance.id,
+      status: "active",
+      customerEmail: res.meta.customer_email,
+      customerName: res.meta.customer_name,
+      plan: detectPlan(key),
+      activatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      expiresAt: res.license_key.expires_at,
+      lastValidatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    await saveLicense(license);
+    success = true;
+    return license;
+  } finally {
+    recordAttempt(success);
+  }
+}
+function isNetworkError(err) {
+  const msg = err instanceof Error ? err.message : String(err);
+  return /fetch failed|ECONNREFUSED|ENOTFOUND|ETIMEDOUT|network|timeout|abort/i.test(msg);
+}
+async function revalidate(license) {
+  try {
+    const res = await validateLicense(license.key, license.instanceId);
+    if (res.valid) {
+      const updated = {
+        ...license,
+        lastValidatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        status: "active",
+        expiresAt: res.license_key.expires_at
+      };
+      await saveLicense(updated);
+      return "valid";
+    }
+    await saveLicense({ ...license, status: "expired" });
+    return "expired";
+  } catch (err) {
+    if (isNetworkError(err)) {
+      return isWithinGracePeriod(license) ? "grace" : "expired";
+    }
+    await saveLicense({ ...license, status: "expired" });
+    return "expired";
+  }
+}
+async function deactivate(license) {
+  let remoteSuccess = false;
+  for (let attempt = 0; attempt < 3; attempt++) {
+    try {
+      await deactivateLicense(license.key, license.instanceId);
+      remoteSuccess = true;
+      break;
+    } catch {
+      if (attempt < 2) await new Promise((r) => setTimeout(r, 1e3));
+    }
+  }
+  await clearLicense();
+  return { remoteSuccess };
+}
+
+// src/lib/sync/sync-engine.ts
+var SYNC_CONFIG_PATH = join2(DATA_DIR, "sync-config.json");
+async function loadSyncConfig() {
+  try {
+    const raw = await readFile3(SYNC_CONFIG_PATH, "utf-8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+async function saveSyncConfig(config) {
+  const tmpPath = SYNC_CONFIG_PATH + ".tmp";
+  await writeFile3(tmpPath, JSON.stringify(config, null, 2), {
+    encoding: "utf-8",
+    mode: 384
+  });
+  await rename3(tmpPath, SYNC_CONFIG_PATH);
+}
+function detectConflicts(localSnapshot, otherMachines, localMachineId) {
+  const conflicts = [];
+  const localFormulaMap = new Map(localSnapshot.formulae.map((f) => [f.name, f.version]));
+  const localCaskMap = new Map(localSnapshot.casks.map((c) => [c.name, c.version]));
+  for (const machine of otherMachines) {
+    if (machine.machineId === localMachineId) continue;
+    for (const remoteFormula of machine.snapshot.formulae) {
+      const localVersion = localFormulaMap.get(remoteFormula.name);
+      if (localVersion !== void 0 && localVersion !== remoteFormula.version) {
+        conflicts.push({
+          packageName: remoteFormula.name,
+          packageType: "formula",
+          localVersion,
+          remoteMachine: machine.machineName,
+          remoteVersion: remoteFormula.version
+        });
+      }
+    }
+    for (const remoteCask of machine.snapshot.casks) {
+      const localVersion = localCaskMap.get(remoteCask.name);
+      if (localVersion !== void 0 && localVersion !== remoteCask.version) {
+        conflicts.push({
+          packageName: remoteCask.name,
+          packageType: "cask",
+          localVersion,
+          remoteMachine: machine.machineName,
+          remoteVersion: remoteCask.version
+        });
+      }
+    }
+  }
+  return conflicts;
+}
+async function writeEnvelope(payload, licenseKey) {
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const { encrypted, iv, tag } = encryptPayload(payload, licenseKey);
+  const envelope = {
+    schemaVersion: 1,
+    encrypted,
+    iv,
+    tag,
+    updatedAt: now
+  };
+  await writeSyncEnvelope(envelope);
+  return now;
+}
+async function loadLicenseKeyOrThrow() {
+  const license = await loadLicense();
+  if (!license || !license.key) {
+    throw new Error("Sync requires an active license");
+  }
+  return license.key;
+}
+function mergePayload(existing, localState) {
+  return {
+    machines: {
+      ...existing.machines,
+      [localState.machineId]: localState
+    }
+  };
+}
+async function sync(isPro, currentBrewfile) {
+  if (!isPro) {
+    throw new Error("Pro license required");
+  }
+  const available = await isICloudAvailable();
+  if (!available) {
+    return {
+      success: false,
+      conflicts: [],
+      resolvedCount: 0,
+      error: "iCloud Drive not available"
+    };
+  }
+  const licenseKey = await loadLicenseKeyOrThrow();
+  let existingPayload = null;
+  try {
+    const envelope = await readSyncEnvelope();
+    if (envelope) {
+      existingPayload = decryptPayload(envelope.encrypted, envelope.iv, envelope.tag, licenseKey);
+    }
+  } catch (err) {
+    logger.warn("sync: could not decrypt existing payload, starting fresh", { error: String(err) });
+    existingPayload = null;
+  }
+  const snapshot = await captureSnapshot();
+  const machineId = await getMachineId();
+  const machineName = hostname();
+  const localState = {
+    machineId,
+    machineName,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    snapshot,
+    ...currentBrewfile ? { brewfile: currentBrewfile } : {}
+  };
+  const otherMachines = existingPayload ? Object.values(existingPayload.machines).filter((m) => m.machineId !== machineId) : [];
+  const conflicts = detectConflicts(snapshot, otherMachines, machineId);
+  const basePayload = existingPayload ?? { machines: {} };
+  const mergedPayload = mergePayload(basePayload, localState);
+  if (conflicts.length > 0) {
+    await writeEnvelope(mergedPayload, licenseKey);
+    return {
+      success: false,
+      conflicts,
+      resolvedCount: 0
+    };
+  }
+  const now = await writeEnvelope(mergedPayload, licenseKey);
+  const existingConfig = await loadSyncConfig();
+  await saveSyncConfig({
+    enabled: true,
+    machineId,
+    machineName,
+    ...existingConfig ?? {},
+    lastSync: now
+  });
+  logger.info("sync: completed successfully", { machineId, machines: Object.keys(mergedPayload.machines).length });
+  return {
+    success: true,
+    conflicts: [],
+    resolvedCount: 0
+  };
+}
+async function applyConflictResolutions(payload, resolutions, localMachineId) {
+  const updatedPayload = {
+    machines: { ...payload.machines }
+  };
+  for (const { conflict, resolution } of resolutions) {
+    if (resolution !== "use-remote") continue;
+    const localMachine = updatedPayload.machines[localMachineId];
+    if (!localMachine) {
+      logger.warn("sync: cannot apply resolution, local machine missing in payload", { localMachineId });
+      continue;
+    }
+    if (conflict.packageType === "formula") {
+      updatedPayload.machines[localMachineId] = {
+        ...localMachine,
+        snapshot: {
+          ...localMachine.snapshot,
+          formulae: localMachine.snapshot.formulae.map(
+            (f) => f.name === conflict.packageName ? { ...f, version: conflict.remoteVersion } : f
+          )
+        }
+      };
+    } else {
+      updatedPayload.machines[localMachineId] = {
+        ...localMachine,
+        snapshot: {
+          ...localMachine.snapshot,
+          casks: localMachine.snapshot.casks.map(
+            (c) => c.name === conflict.packageName ? { ...c, version: conflict.remoteVersion } : c
+          )
+        }
+      };
+    }
+  }
+  const licenseKey = await loadLicenseKeyOrThrow();
+  await writeEnvelope(updatedPayload, licenseKey);
+  logger.info("sync: conflict resolutions applied", { count: resolutions.length });
+}
+
+export {
+  loadLicense,
+  isExpired,
+  needsRevalidation,
+  getDegradationLevel,
+  activate,
+  revalidate,
+  deactivate,
+  decryptPayload,
+  readSyncEnvelope,
+  loadSyncConfig,
+  saveSyncConfig,
+  sync,
+  applyConflictResolutions
+};
+//# sourceMappingURL=chunk-QPXROTAP.js.map