brew-tui 3.4.0 → 4.0.1

package/build/{brew-tui-bar-installer-D75KPQ3Z.js → brew-tui-bar-installer-CGJFE7PQ.js}

@@ -6,7 +6,7 @@ import {
   launchBrewTUIBar,
   syncAndLaunchBrewTUIBar,
   uninstallBrewTUIBar
-} from "./chunk-63AUNN5U.js";
+} from "./chunk-UKMRSNGQ.js";
 import "./chunk-NRRQECXA.js";
 import "./chunk-A7U3NZYM.js";
 import "./chunk-KDHEUNRI.js";
@@ -19,4 +19,4 @@ export {
   syncAndLaunchBrewTUIBar,
   uninstallBrewTUIBar
 };
-//# sourceMappingURL=brew-tui-bar-installer-D75KPQ3Z.js.map
+//# sourceMappingURL=brew-tui-bar-installer-CGJFE7PQ.js.map

package/build/{chunk-BP7CFABE.js → chunk-FFULOTXT.js}

@@ -6,7 +6,7 @@ var execFileAsync = promisify(execFile);
 var BREWTUIBAR_INFO_PLIST = "/Applications/Brew-TUI-Bar.app/Contents/Info.plist";
 var CONTRACT_VERSION = 1;
 function expectedVersion() {
-  return "3.4.0";
+  return "4.0.1";
 }
 async function readBrewTUIBarVersion() {
   try {
@@ -62,4 +62,4 @@ export {
   compareSemver,
   checkBrewTUIBarVersion
 };
-//# sourceMappingURL=chunk-BP7CFABE.js.map
+//# sourceMappingURL=chunk-FFULOTXT.js.map

package/build/{chunk-FQV2F47X.js → chunk-ILKWT7WR.js}

@@ -6,7 +6,7 @@ import {
   loadLicense,
   needsRevalidation,
   revalidate
-} from "./chunk-4RPJM7O7.js";
+} from "./chunk-TA3XPHF4.js";
 import {
   ensureDataDirs
 } from "./chunk-LFGDNAXH.js";
@@ -135,4 +135,4 @@ export {
   verifyStoreIntegrity,
   useLicenseStore
 };
-//# sourceMappingURL=chunk-FQV2F47X.js.map
+//# sourceMappingURL=chunk-ILKWT7WR.js.map

package/build/{chunk-D6DGYMXM.js → chunk-Q4PGJ4H2.js}

@@ -1,6 +1,6 @@
 import {
   loadLicense
-} from "./chunk-4RPJM7O7.js";
+} from "./chunk-TA3XPHF4.js";
 import {
   captureSnapshot
 } from "./chunk-OXDZ4DCK.js";
@@ -327,4 +327,4 @@ export {
   sync,
   applyConflictResolutions
 };
-//# sourceMappingURL=chunk-D6DGYMXM.js.map
+//# sourceMappingURL=chunk-Q4PGJ4H2.js.map

package/build/chunk-TA3XPHF4.js

@@ -0,0 +1,284 @@
+import {
+  fetchWithRetry
+} from "./chunk-NRRQECXA.js";
+import {
+  t
+} from "./chunk-A7U3NZYM.js";
+import {
+  LICENSE_PATH,
+  ensureDataDirs,
+  getMachineId
+} from "./chunk-LFGDNAXH.js";
+
+// src/lib/license/license-manager.ts
+import { readFile, writeFile, rename, rm } from "fs/promises";
+import { verify, createPublicKey } from "crypto";
+
+// src/lib/license/polar-api.ts
+var BASE_URL = "https://api.molinesdesigns.com/api/license";
+function validateApiUrl(url) {
+  const parsed = new URL(url);
+  if (parsed.protocol !== "https:") {
+    throw new Error("HTTPS required for license API");
+  }
+  if (parsed.hostname !== "molinesdesigns.com" && !parsed.hostname.endsWith(".molinesdesigns.com")) {
+    throw new Error("Invalid API host");
+  }
+}
+async function post(endpoint, body, expectEmpty = false) {
+  const url = `${BASE_URL}/${endpoint}`;
+  validateApiUrl(url);
+  const res = await fetchWithRetry(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body)
+  }, 15e3);
+  if (!res.ok) {
+    let message = `Request failed with status ${res.status}`;
+    try {
+      const errBody = await res.json();
+      if (typeof errBody.error === "string") message = errBody.error;
+    } catch {
+    }
+    throw new Error(message);
+  }
+  if (expectEmpty || res.status === 204) return void 0;
+  const wrapped = await res.json();
+  if (!wrapped.success || wrapped.data === void 0) {
+    throw new Error(wrapped.error ?? "Backend response missing data");
+  }
+  return wrapped.data;
+}
+function assertSigned(value) {
+  if (typeof value !== "object" || value === null) {
+    throw new Error("Invalid signed license: not an object");
+  }
+  const v = value;
+  if (typeof v.sig !== "string" || v.sig.length === 0) {
+    throw new Error("Invalid signed license: missing signature");
+  }
+  if (typeof v.license !== "object" || v.license === null) {
+    throw new Error("Invalid signed license: missing license payload");
+  }
+}
+async function activateLicense(key, machineId) {
+  const signed = await post("activate", { key, machineId });
+  assertSigned(signed);
+  return signed;
+}
+async function validateLicense(key, instanceId) {
+  const signed = await post("validate", { key, instanceId });
+  assertSigned(signed);
+  return signed;
+}
+async function deactivateLicense(key, instanceId) {
+  await post("deactivate", { key, instanceId });
+}
+
+// src/lib/license/types.ts
+function isLicenseData(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const v = value;
+  return typeof v.key === "string" && typeof v.instanceId === "string" && (v.status === "active" || v.status === "expired" || v.status === "inactive") && typeof v.customerEmail === "string" && typeof v.customerName === "string" && (v.plan === "pro" || v.plan === "team") && typeof v.activatedAt === "string" && (v.expiresAt === null || typeof v.expiresAt === "string") && typeof v.lastValidatedAt === "string";
+}
+
+// src/lib/license/license-manager.ts
+var REVALIDATION_INTERVAL_MS = 24 * 60 * 60 * 1e3;
+var GRACE_PERIOD_MS = 7 * 24 * 60 * 60 * 1e3;
+var ACTIVATION_COOLDOWN_MS = 3e4;
+var MAX_ATTEMPTS = 5;
+var LOCKOUT_MS = 15 * 60 * 1e3;
+var tracker = {
+  attempts: 0,
+  lastAttempt: 0,
+  lockedUntil: 0
+};
+function checkRateLimit() {
+  const now = Date.now();
+  if (now < tracker.lockedUntil) {
+    const remaining = Math.ceil((tracker.lockedUntil - now) / 6e4);
+    throw new Error(t("cli_rateLimited", { minutes: remaining }));
+  }
+  if (now - tracker.lastAttempt < ACTIVATION_COOLDOWN_MS) {
+    throw new Error(t("cli_cooldown"));
+  }
+}
+function recordAttempt(success) {
+  const now = Date.now();
+  tracker.lastAttempt = now;
+  if (success) {
+    tracker.attempts = 0;
+    return;
+  }
+  tracker.attempts++;
+  if (tracker.attempts >= MAX_ATTEMPTS) {
+    tracker.lockedUntil = now + LOCKOUT_MS;
+    tracker.attempts = 0;
+  }
+}
+var LICENSE_PUBLIC_KEY_B64 = "oHtzyU7ZACt8Eqga+U4PSagr0rSj1YLs3oVSpmjmwq0=";
+var _cachedPublicKey = null;
+function publicKey() {
+  if (_cachedPublicKey) return _cachedPublicKey;
+  const spkiPrefix = Buffer.from("302a300506032b6570032100", "hex");
+  const rawPub = Buffer.from(LICENSE_PUBLIC_KEY_B64, "base64");
+  const spki = Buffer.concat([spkiPrefix, rawPub]);
+  _cachedPublicKey = createPublicKey({ key: spki, format: "der", type: "spki" });
+  return _cachedPublicKey;
+}
+function canonicalJSON(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) {
+    return "[" + value.map(canonicalJSON).join(",") + "]";
+  }
+  const keys = Object.keys(value).sort();
+  const parts = keys.map(
+    (k) => JSON.stringify(k) + ":" + canonicalJSON(value[k])
+  );
+  return "{" + parts.join(",") + "}";
+}
+function verifySignedLicense(signed) {
+  try {
+    const sig = Buffer.from(signed.sig, "base64");
+    if (sig.length !== 64) return false;
+    const message = Buffer.from(canonicalJSON(signed.license), "utf8");
+    return verify(null, message, publicKey(), sig);
+  } catch {
+    return false;
+  }
+}
+function isLicenseFile(obj) {
+  if (typeof obj !== "object" || obj === null) return false;
+  const v = obj;
+  return v.version === 1 || v.version === 2;
+}
+async function loadLicense() {
+  try {
+    const raw = await readFile(LICENSE_PATH, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (!isLicenseFile(parsed)) return null;
+    const file = parsed;
+    if (file.version === 2) {
+      if (!file.license || typeof file.sig !== "string") return null;
+      if (!isLicenseData(file.license)) return null;
+      const signed = { license: file.license, sig: file.sig };
+      if (!verifySignedLicense(signed)) return null;
+      return file.license;
+    }
+    if (file.version === 1) {
+      return null;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+async function persistSigned(signed) {
+  await ensureDataDirs();
+  const file = {
+    version: 2,
+    license: signed.license,
+    sig: signed.sig
+  };
+  const tmpPath = LICENSE_PATH + ".tmp";
+  await writeFile(tmpPath, JSON.stringify(file, null, 2), { encoding: "utf-8", mode: 384 });
+  await rename(tmpPath, LICENSE_PATH);
+}
+async function clearLicense() {
+  try {
+    await rm(LICENSE_PATH);
+  } catch {
+  }
+}
+function isExpired(license) {
+  if (!license.expiresAt) return false;
+  const expiry = new Date(license.expiresAt).getTime();
+  if (isNaN(expiry)) return true;
+  return expiry < Date.now();
+}
+function needsRevalidation(license) {
+  const lastValidated = new Date(license.lastValidatedAt).getTime();
+  if (isNaN(lastValidated)) return true;
+  return Date.now() - lastValidated > REVALIDATION_INTERVAL_MS;
+}
+function isWithinGracePeriod(license) {
+  const lastValidated = new Date(license.lastValidatedAt).getTime();
+  if (isNaN(lastValidated)) return false;
+  return Date.now() - lastValidated < GRACE_PERIOD_MS;
+}
+function getDegradationLevel(license) {
+  const lastValidated = new Date(license.lastValidatedAt).getTime();
+  if (isNaN(lastValidated)) return "expired";
+  const elapsed = Date.now() - lastValidated;
+  if (elapsed < 0) return "expired";
+  const days = elapsed / (24 * 60 * 60 * 1e3);
+  if (days <= 7) return "none";
+  if (days <= 14) return "warning";
+  if (days <= 30) return "limited";
+  return "expired";
+}
+function validateLicenseKey(key) {
+  if (key.length < 10 || key.length > 100) {
+    throw new Error("Invalid license key format");
+  }
+  if (!/^[\w-]+$/.test(key)) {
+    throw new Error("Invalid license key format");
+  }
+}
+async function activate(key) {
+  validateLicenseKey(key);
+  checkRateLimit();
+  let success = false;
+  try {
+    const machineId = await getMachineId();
+    const signed = await activateLicense(key, machineId);
+    if (!verifySignedLicense(signed)) {
+      throw new Error("Backend response failed signature verification");
+    }
+    await persistSigned(signed);
+    success = true;
+    return signed.license;
+  } finally {
+    recordAttempt(success);
+  }
+}
+function isNetworkError(err) {
+  const msg = err instanceof Error ? err.message : String(err);
+  return /fetch failed|ECONNREFUSED|ENOTFOUND|ETIMEDOUT|network|timeout|abort/i.test(msg);
+}
+async function revalidate(license) {
+  try {
+    const signed = await validateLicense(license.key, license.instanceId);
+    if (!verifySignedLicense(signed)) {
+      return "expired";
+    }
+    await persistSigned(signed);
+    return signed.license.status === "active" ? "valid" : "expired";
+  } catch (err) {
+    if (isNetworkError(err)) {
+      return isWithinGracePeriod(license) ? "grace" : "expired";
+    }
+    return "expired";
+  }
+}
+async function deactivate(license) {
+  let remoteSuccess = false;
+  try {
+    await deactivateLicense(license.key, license.instanceId);
+    remoteSuccess = true;
+  } catch {
+  }
+  await clearLicense();
+  return { remoteSuccess };
+}
+
+export {
+  loadLicense,
+  isExpired,
+  needsRevalidation,
+  getDegradationLevel,
+  activate,
+  revalidate,
+  deactivate
+};
+//# sourceMappingURL=chunk-TA3XPHF4.js.map

package/build/chunk-TA3XPHF4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/lib/license/license-manager.ts","../src/lib/license/polar-api.ts","../src/lib/license/types.ts"],"sourcesContent":["import { readFile, writeFile, rename, rm } from 'node:fs/promises';\nimport { verify, createPublicKey } from 'node:crypto';\nimport { LICENSE_PATH, ensureDataDirs, getMachineId } from '../data-dir.js';\nimport {\n  activateLicense as apiActivate,\n  validateLicense as apiValidate,\n  deactivateLicense as apiDeactivate,\n  type SignedLicense,\n} from './polar-api.js';\nimport { t } from '../../i18n/index.js';\nimport { isLicenseData, type LicenseData, type LicenseFile } from './types.js';\n\n// SEG-009 guard: previously a hardcoded map bypassed Polar entirely. The\n// function is kept as an always-null export so a regression test can pin\n// the behaviour and the import site in license-store stays stable.\nexport function getBuiltinAccountType(_email: string): 'pro' | 'team' | 'free' | null {\n  return null;\n}\n\nconst REVALIDATION_INTERVAL_MS = 24 * 60 * 60 * 1000; // 24h\nconst GRACE_PERIOD_MS = 7 * 24 * 60 * 60 * 1000; // 7 days\n\n// ── Layer 18: Client-side rate limiting on activations ──\nconst ACTIVATION_COOLDOWN_MS = 30_000; // 30 seconds between attempts\nconst MAX_ATTEMPTS = 5;\nconst LOCKOUT_MS = 15 * 60 * 1000; // 15 min lockout after max attempts\n\ninterface ActivationTracker {\n  attempts: number;\n  lastAttempt: number;\n  lockedUntil: number;\n}\n\n// UX-004: rate-limit state is intentionally in-memory only. It is a first\n// filter to slow down brute force inside one TUI session — the authoritative\n// activation throttle lives in the Polar backend, which sees attempts across\n// process restarts. Persisting this client-side would invite users to delete\n// the file and reset themselves; the trade-off is documented here on purpose.\nconst tracker: ActivationTracker = {\n  attempts: 0,\n  lastAttempt: 0,\n  lockedUntil: 0,\n};\n\nfunction checkRateLimit(): void {\n  const now = Date.now();\n\n  // Check lockout\n  if (now < tracker.lockedUntil) {\n    const remaining = Math.ceil((tracker.lockedUntil - now) / 60000);\n    throw new Error(t('cli_rateLimited', { minutes: remaining }));\n  }\n\n  // Check cooldown\n  if (now - tracker.lastAttempt < ACTIVATION_COOLDOWN_MS) {\n    throw new Error(t('cli_cooldown'));\n  }\n}\n\nfunction recordAttempt(success: boolean): void {\n  const now = Date.now();\n  tracker.lastAttempt = now;\n\n  if (success) {\n    tracker.attempts = 0;\n    return;\n  }\n\n  tracker.attempts++;\n  if (tracker.attempts >= MAX_ATTEMPTS) {\n    tracker.lockedUntil = now + LOCKOUT_MS;\n    tracker.attempts = 0;\n  }\n}\n\n// SECURITY (SEG-009 v2): the signing key lives only on the brewtui-api NAS\n// (LICENSE_SIGNING_PRIVATE_KEY env var). The Ed25519 public counterpart is\n// embedded here AND in menubar/Brew-TUI-Bar/Sources/Services/LicenseChecker.swift —\n// both verify the signed envelope offline without round-tripping the network.\n// Exposing the public key is by design: a verifier needs it; forging signatures\n// without the private half is computationally infeasible.\n//\n// Cross-check vector for keeping JS and Swift in sync lives in\n// signature-cross-check.test.ts. Don't change the constant without rotating\n// the key on the backend AND bumping the schema version.\nconst LICENSE_PUBLIC_KEY_B64 = 'oHtzyU7ZACt8Eqga+U4PSagr0rSj1YLs3oVSpmjmwq0=';\n\nlet _cachedPublicKey: ReturnType<typeof createPublicKey> | null = null;\nfunction publicKey(): ReturnType<typeof createPublicKey> {\n  if (_cachedPublicKey) return _cachedPublicKey;\n  // SPKI wrapper for raw Ed25519 public keys (RFC 8410 §4):\n  //   SEQUENCE { AlgorithmIdentifier { 1.3.101.112 }, BIT STRING { rawKey } }\n  // 12-byte prefix + 32 raw bytes = 44 bytes total. Same prefix the backend\n  // uses in lib/signer.js to expose publicKeyBase64().\n  const spkiPrefix = Buffer.from('302a300506032b6570032100', 'hex');\n  const rawPub = Buffer.from(LICENSE_PUBLIC_KEY_B64, 'base64');\n  const spki = Buffer.concat([spkiPrefix, rawPub]);\n  _cachedPublicKey = createPublicKey({ key: spki, format: 'der', type: 'spki' });\n  return _cachedPublicKey;\n}\n\n/**\n * Deterministic JSON serialisation: object keys sorted recursively, no\n * whitespace, JSON.stringify for primitives. Both the backend signer\n * (backend/lib/signer.js) and the Swift verifier (LicenseChecker.swift)\n * implement the same algorithm — that's how the bytes-signed match the\n * bytes-verified across three languages.\n */\nexport function canonicalJSON(value: unknown): string {\n  if (value === null || typeof value !== 'object') return JSON.stringify(value);\n  if (Array.isArray(value)) {\n    return '[' + value.map(canonicalJSON).join(',') + ']';\n  }\n  const keys = Object.keys(value as Record<string, unknown>).sort();\n  const parts = keys.map((k) =>\n    JSON.stringify(k) + ':' + canonicalJSON((value as Record<string, unknown>)[k]),\n  );\n  return '{' + parts.join(',') + '}';\n}\n\n/**\n * Crypto-verify the envelope returned by the backend. Returns false on any\n * failure — including malformed base64, wrong-length signatures or invalid\n * canonical encoding — so the caller has a single boolean to gate Pro access.\n */\nexport function verifySignedLicense(signed: SignedLicense): boolean {\n  try {\n    const sig = Buffer.from(signed.sig, 'base64');\n    if (sig.length !== 64) return false;\n    const message = Buffer.from(canonicalJSON(signed.license), 'utf8');\n    return verify(null, message, publicKey(), sig);\n  } catch {\n    return false;\n  }\n}\n\n// BK-003: Type guard for license data format\nfunction isLicenseFile(obj: unknown): obj is LicenseFile {\n  if (typeof obj !== 'object' || obj === null) return false;\n  const v = obj as Record<string, unknown>;\n  return v.version === 1 || v.version === 2;\n}\n\nexport async function loadLicense(): Promise<LicenseData | null> {\n  try {\n    const raw = await readFile(LICENSE_PATH, 'utf-8');\n    const parsed: unknown = JSON.parse(raw);\n\n    if (!isLicenseFile(parsed)) return null;\n    const file = parsed as LicenseFile;\n\n    // v2: signed envelope. The only path that grants Pro since 4.0.0.\n    if (file.version === 2) {\n      if (!file.license || typeof file.sig !== 'string') return null;\n      if (!isLicenseData(file.license)) return null;\n      const signed: SignedLicense = { license: file.license, sig: file.sig };\n      if (!verifySignedLicense(signed)) return null;\n      return file.license;\n    }\n\n    // v1: legacy AES-GCM envelope or unencrypted blob. Both are rejected —\n    // the symmetric encryption key was shipped in the public bundle, so\n    // accepting v1 would defeat the point of the signature migration. The\n    // user just needs to run `brew-tui revalidate` once; activate() / the\n    // periodic revalidation will overwrite the file with a v2 envelope on\n    // the next successful round-trip to the backend.\n    if (file.version === 1) {\n      return null;\n    }\n\n    return null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Persists the signed envelope returned by the backend. Replaces the old\n * client-side AES-GCM saveLicense — the client no longer needs (or has) any\n * key material; it just writes the bytes the backend signed.\n *\n * Atomic write via tmp + rename: a crash mid-write leaves either the old\n * file intact or the new one fully written, never a torn JSON.\n */\nasync function persistSigned(signed: SignedLicense): Promise<void> {\n  await ensureDataDirs();\n  const file: LicenseFile = {\n    version: 2,\n    license: signed.license,\n    sig: signed.sig,\n  };\n  const tmpPath = LICENSE_PATH + '.tmp';\n  await writeFile(tmpPath, JSON.stringify(file, null, 2), { encoding: 'utf-8', mode: 0o600 });\n  await rename(tmpPath, LICENSE_PATH);\n}\n\n/**\n * @deprecated Use `persistSigned` with a backend-issued SignedLicense. Kept\n * for tests that pre-date the v2 envelope. Sign here locally with a test\n * keypair would defeat the threat model, so this path is intentionally\n * non-functional in production: any LicenseData saved through here cannot\n * be loaded back (no signature → loadLicense returns null).\n */\nexport async function saveLicense(_data: LicenseData): Promise<void> {\n  throw new Error('saveLicense is no longer supported; the backend issues signed envelopes (4.0.0).');\n}\n\nexport async function clearLicense(): Promise<void> {\n  try {\n    await rm(LICENSE_PATH);\n  } catch { /* file may not exist */ }\n}\n\nexport function isExpired(license: LicenseData): boolean {\n  if (!license.expiresAt) return false;\n  const expiry = new Date(license.expiresAt).getTime();\n  // Fail closed on corrupted/unparseable dates: NaN comparisons are always\n  // false, so the previous version treated a garbage expiresAt as \"never\n  // expires\", which is exploitable.\n  if (isNaN(expiry)) return true;\n  return expiry < Date.now();\n}\n\nexport function needsRevalidation(license: LicenseData): boolean {\n  const lastValidated = new Date(license.lastValidatedAt).getTime();\n  if (isNaN(lastValidated)) return true; // corrupted date → force revalidation\n  return Date.now() - lastValidated > REVALIDATION_INTERVAL_MS;\n}\n\nexport function isWithinGracePeriod(license: LicenseData): boolean {\n  const lastValidated = new Date(license.lastValidatedAt).getTime();\n  if (isNaN(lastValidated)) return false; // corrupted date → no grace\n  return Date.now() - lastValidated < GRACE_PERIOD_MS;\n}\n\n// ── Layer 15: Gradual degradation after extended offline ──\n\nexport type DegradationLevel = 'none' | 'warning' | 'limited' | 'expired';\nexport type RevalidationResult = 'valid' | 'grace' | 'expired';\n\n/**\n * Returns the degradation level based on time since last server validation.\n * - 0-7 days: none (full access)\n * - 7-14 days: warning (shows a notice but still works)\n * - 14-30 days: limited (some features disabled)\n * - 30+ days: expired (all Pro features disabled)\n */\nexport function getDegradationLevel(license: LicenseData): DegradationLevel {\n  const lastValidated = new Date(license.lastValidatedAt).getTime();\n  if (isNaN(lastValidated)) return 'expired'; // corrupted date → deny access\n  const elapsed = Date.now() - lastValidated;\n  // SEC-L1: a negative elapsed means lastValidatedAt is in the future. This\n  // is almost always a clock-skew exploit (set system clock forward to keep\n  // Pro features forever). Fail-closed instead of granting full access. The\n  // next revalidate() against Polar will reset things if the skew is benign.\n  if (elapsed < 0) return 'expired';\n  const days = elapsed / (24 * 60 * 60 * 1000);\n\n  if (days <= 7) return 'none';\n  if (days <= 14) return 'warning';\n  if (days <= 30) return 'limited';\n  return 'expired';\n}\n\n// Layer 10: License key format validation\nfunction validateLicenseKey(key: string): void {\n  // Polar keys are UUID-like: 8-4-4-4-12 hex chars or similar\n  // Reject obviously invalid keys to avoid unnecessary API calls\n  if (key.length < 10 || key.length > 100) {\n    throw new Error('Invalid license key format');\n  }\n  // Only allow alphanumeric, hyphens, underscores\n  if (!/^[\\w-]+$/.test(key)) {\n    throw new Error('Invalid license key format');\n  }\n}\n\nexport async function activate(key: string): Promise<LicenseData> {\n  validateLicenseKey(key);\n  checkRateLimit();\n\n  let success = false;\n  try {\n    const machineId = await getMachineId();\n    const signed = await apiActivate(key, machineId);\n\n    // Verify the envelope before trusting it. The backend should never emit\n    // an unverifiable response, but a MITM injecting `{license, sig:\"\"}`\n    // would otherwise pass straight through.\n    if (!verifySignedLicense(signed)) {\n      throw new Error('Backend response failed signature verification');\n    }\n\n    await persistSigned(signed);\n    success = true;\n    return signed.license;\n  } finally {\n    recordAttempt(success);\n  }\n}\n\n/**\n * Revalidate the license against the server. Each call refreshes\n * lastValidatedAt and resets the offline-degradation timer.\n */\n// EP-006: Detect if an error is a network error vs validation/contract error\nfunction isNetworkError(err: unknown): boolean {\n  const msg = err instanceof Error ? err.message : String(err);\n  return /fetch failed|ECONNREFUSED|ENOTFOUND|ETIMEDOUT|network|timeout|abort/i.test(msg);\n}\n\nexport async function revalidate(license: LicenseData): Promise<RevalidationResult> {\n  try {\n    const signed = await apiValidate(license.key, license.instanceId);\n    if (!verifySignedLicense(signed)) {\n      // Treat a malformed signature as a hard failure — same posture as\n      // an explicit \"expired\" from the backend.\n      return 'expired';\n    }\n    await persistSigned(signed);\n    // The backend stamps lastValidatedAt server-side, so the persisted\n    // envelope is already fresh. Surface only the status to the caller.\n    return signed.license.status === 'active' ? 'valid' : 'expired';\n  } catch (err) {\n    // EP-006: Network errors trigger grace period; validation/contract errors mean expired\n    if (isNetworkError(err)) {\n      return isWithinGracePeriod(license) ? 'grace' : 'expired';\n    }\n    // Unexpected response or contract violation — leave the existing file\n    // alone (the user was Pro a moment ago; a transient API blip shouldn't\n    // wipe the local state) but report expired so callers stop authorizing.\n    return 'expired';\n  }\n}\n\nexport async function deactivate(license: LicenseData): Promise<{ remoteSuccess: boolean }> {\n  // EP-001: apiDeactivate already wraps fetchWithRetry (3 attempts). The\n  // outer loop multiplied that into 9 POSTs — Polar would count each as a\n  // separate request and a flaky network would amplify load 3×.\n  let remoteSuccess = false;\n  try {\n    await apiDeactivate(license.key, license.instanceId);\n    remoteSuccess = true;\n  } catch { /* local clear still happens below */ }\n  await clearLicense();\n  return { remoteSuccess };\n}\n","import { fetchWithRetry } from '../fetch-timeout.js';\nimport type { LicenseData } from './types.js';\n\n// SEG-009/v2: licence operations no longer hit Polar directly. The brewtui-api\n// backend (NAS) proxies activate/validate/deactivate and returns an Ed25519-\n// signed envelope `{ license, sig }`. The client verifies that envelope\n// offline with the embedded public key (see license-manager.ts). The Polar\n// shared secret used to live in the published npm bundle, allowing anyone\n// with the bundle to forge a license; routing through the backend moves the\n// signing key off the client entirely.\nconst BASE_URL = 'https://api.molinesdesigns.com/api/license';\n\n/**\n * The shape returned by the backend's activate/validate endpoints. `license`\n * is the same LicenseData the rest of the codebase already consumes; `sig` is\n * base64 Ed25519 over canonical JSON of `license`.\n */\nexport interface SignedLicense {\n  license: LicenseData;\n  sig: string;\n}\n\nfunction validateApiUrl(url: string): void {\n  const parsed = new URL(url);\n  if (parsed.protocol !== 'https:') {\n    throw new Error('HTTPS required for license API');\n  }\n  // SEC-M1 (carried over from the old polar-api): only accept the exact\n  // hostname or a true subdomain of molinesdesigns.com. `endsWith` alone\n  // would let `evilmolinesdesigns.com` through.\n  if (\n    parsed.hostname !== 'molinesdesigns.com'\n    && !parsed.hostname.endsWith('.molinesdesigns.com')\n  ) {\n    throw new Error('Invalid API host');\n  }\n}\n\ninterface BackendEnvelope<T> {\n  success: boolean;\n  data?: T;\n  error?: string;\n  code?: string;\n}\n\nasync function post<T>(endpoint: string, body: Record<string, unknown>, expectEmpty = false): Promise<T> {\n  const url = `${BASE_URL}/${endpoint}`;\n  validateApiUrl(url);\n\n  const res = await fetchWithRetry(url, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(body),\n  }, 15_000);\n\n  if (!res.ok) {\n    let message = `Request failed with status ${res.status}`;\n    try {\n      const errBody = await res.json() as BackendEnvelope<unknown>;\n      if (typeof errBody.error === 'string') message = errBody.error;\n    } catch { /* non-JSON body — keep generic message */ }\n    throw new Error(message);\n  }\n\n  if (expectEmpty || res.status === 204) return undefined as T;\n  const wrapped = await res.json() as BackendEnvelope<T>;\n  if (!wrapped.success || wrapped.data === undefined) {\n    throw new Error(wrapped.error ?? 'Backend response missing data');\n  }\n  return wrapped.data;\n}\n\n/**\n * Validate the signed envelope structurally (the cryptographic verify happens\n * in license-manager.ts where the public key lives). Throws on any missing\n * field so callers can rely on the return type.\n */\nfunction assertSigned(value: unknown): asserts value is SignedLicense {\n  if (typeof value !== 'object' || value === null) {\n    throw new Error('Invalid signed license: not an object');\n  }\n  const v = value as Record<string, unknown>;\n  if (typeof v.sig !== 'string' || v.sig.length === 0) {\n    throw new Error('Invalid signed license: missing signature');\n  }\n  if (typeof v.license !== 'object' || v.license === null) {\n    throw new Error('Invalid signed license: missing license payload');\n  }\n}\n\nexport async function activateLicense(key: string, machineId: string): Promise<SignedLicense> {\n  const signed = await post<SignedLicense>('activate', { key, machineId });\n  assertSigned(signed);\n  return signed;\n}\n\nexport async function validateLicense(key: string, instanceId: string): Promise<SignedLicense> {\n  const signed = await post<SignedLicense>('validate', { key, instanceId });\n  assertSigned(signed);\n  return signed;\n}\n\nexport async function deactivateLicense(key: string, instanceId: string): Promise<void> {\n  await post<{ deactivated: boolean }>('deactivate', { key, instanceId });\n}\n\n// Exposed for tests: lets us point the client at a local backend without\n// reaching for the network. The runtime caller never uses it.\nexport function _internalBaseUrl(): string {\n  return BASE_URL;\n}\n","export interface LicenseData {\n  key: string;\n  instanceId: string;\n  status: 'active' | 'expired' | 'inactive';\n  customerEmail: string;\n  customerName: string;\n  plan: 'pro' | 'team';\n  activatedAt: string;\n  expiresAt: string | null;\n  lastValidatedAt: string;\n}\n\n// BK-006: type guard for license payload after AES-GCM decrypt. A corrupt or\n// migrated file could JSON.parse to anything — refuse instead of crashing on\n// undefined accesses downstream.\nexport function isLicenseData(value: unknown): value is LicenseData {\n  if (typeof value !== 'object' || value === null) return false;\n  const v = value as Record<string, unknown>;\n  return (\n    typeof v.key === 'string' &&\n    typeof v.instanceId === 'string' &&\n    (v.status === 'active' || v.status === 'expired' || v.status === 'inactive') &&\n    typeof v.customerEmail === 'string' &&\n    typeof v.customerName === 'string' &&\n    (v.plan === 'pro' || v.plan === 'team') &&\n    typeof v.activatedAt === 'string' &&\n    (v.expiresAt === null || typeof v.expiresAt === 'string') &&\n    typeof v.lastValidatedAt === 'string'\n  );\n}\n\n/**\n * v2 envelope: license payload + Ed25519 signature from the brewtui-api\n * backend. The client verifies the signature with the embedded public key\n * — see license-manager.ts. This replaces the v1 AES-GCM envelope where the\n * shared HKDF secret lived in the public npm bundle.\n *\n * v1 envelopes (encrypted: {iv,tag,encrypted}) and legacy unencrypted\n * envelopes ({license}) are still represented here so the loader can detect\n * and reject them with a helpful message (\"run brew-tui revalidate\").\n */\nexport interface LicenseFile {\n  version: 1 | 2;\n  // v2 fields\n  license?: LicenseData | null;\n  sig?: string;\n  // v1 legacy fields — present only on files written by < 4.0.0\n  hmac?: string;\n  encrypted?: string;\n  iv?: string;\n  tag?: string;\n}\n\nexport type LicenseStatus = 'free' | 'pro' | 'team' | 'expired' | 'validating';\n\n// PolarActivateResponse / PolarValidateResponse used to mirror the shape of\n// the customer-portal API responses. Since 4.0.0 the client no longer talks\n// to Polar directly — see polar-api.ts (now a thin wrapper around the\n// brewtui-api backend). The signed envelope returned by the backend is\n// `SignedLicense` (exported from polar-api.ts).\n\nexport type ProFeatureId =\n  | 'profiles'\n  | 'smart-cleanup'\n  | 'history'\n  | 'security-audit'\n  | 'rollback'\n  | 'brewfile'\n  | 'sync'\n  | 'impact-analysis';\n\nexport type TeamFeatureId = 'compliance';\n"],"mappings":";;;;;;;;;;;;;AAAA,SAAS,UAAU,WAAW,QAAQ,UAAU;AAChD,SAAS,QAAQ,uBAAuB;;;ACSxC,IAAM,WAAW;AAYjB,SAAS,eAAe,KAAmB;AACzC,QAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,MAAI,OAAO,aAAa,UAAU;AAChC,UAAM,IAAI,MAAM,gCAAgC;AAAA,EAClD;AAIA,MACE,OAAO,aAAa,wBACjB,CAAC,OAAO,SAAS,SAAS,qBAAqB,GAClD;AACA,UAAM,IAAI,MAAM,kBAAkB;AAAA,EACpC;AACF;AASA,eAAe,KAAQ,UAAkB,MAA+B,cAAc,OAAmB;AACvG,QAAM,MAAM,GAAG,QAAQ,IAAI,QAAQ;AACnC,iBAAe,GAAG;AAElB,QAAM,MAAM,MAAM,eAAe,KAAK;AAAA,IACpC,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,GAAG,IAAM;AAET,MAAI,CAAC,IAAI,IAAI;AACX,QAAI,UAAU,8BAA8B,IAAI,MAAM;AACtD,QAAI;AACF,YAAM,UAAU,MAAM,IAAI,KAAK;AAC/B,UAAI,OAAO,QAAQ,UAAU,SAAU,WAAU,QAAQ;AAAA,IAC3D,QAAQ;AAAA,IAA6C;AACrD,UAAM,IAAI,MAAM,OAAO;AAAA,EACzB;AAEA,MAAI,eAAe,IAAI,WAAW,IAAK,QAAO;AAC9C,QAAM,UAAU,MAAM,IAAI,KAAK;AAC/B,MAAI,CAAC,QAAQ,WAAW,QAAQ,SAAS,QAAW;AAClD,UAAM,IAAI,MAAM,QAAQ,SAAS,+BAA+B;AAAA,EAClE;AACA,SAAO,QAAQ;AACjB;AAOA,SAAS,aAAa,OAAgD;AACpE,MAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAC/C,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AACA,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,QAAQ,YAAY,EAAE,IAAI,WAAW,GAAG;AACnD,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AACA,MAAI,OAAO,EAAE,YAAY,YAAY,EAAE,YAAY,MAAM;AACvD,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACF;AAEA,eAAsB,gBAAgB,KAAa,WAA2C;AAC5F,QAAM,SAAS,MAAM,KAAoB,YAAY,EAAE,KAAK,UAAU,CAAC;AACvE,eAAa,MAAM;AACnB,SAAO;AACT;AAEA,eAAsB,gBAAgB,KAAa,YAA4C;AAC7F,QAAM,SAAS,MAAM,KAAoB,YAAY,EAAE,KAAK,WAAW,CAAC;AACxE,eAAa,MAAM;AACnB,SAAO;AACT;AAEA,eAAsB,kBAAkB,KAAa,YAAmC;AACtF,QAAM,KAA+B,cAAc,EAAE,KAAK,WAAW,CAAC;AACxE;;;ACzFO,SAAS,cAAc,OAAsC;AAClE,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,IAAI;AACV,SACE,OAAO,EAAE,QAAQ,YACjB,OAAO,EAAE,eAAe,aACvB,EAAE,WAAW,YAAY,EAAE,WAAW,aAAa,EAAE,WAAW,eACjE,OAAO,EAAE,kBAAkB,YAC3B,OAAO,EAAE,iBAAiB,aACzB,EAAE,SAAS,SAAS,EAAE,SAAS,WAChC,OAAO,EAAE,gBAAgB,aACxB,EAAE,cAAc,QAAQ,OAAO,EAAE,cAAc,aAChD,OAAO,EAAE,oBAAoB;AAEjC;;;AFVA,IAAM,2BAA2B,KAAK,KAAK,KAAK;AAChD,IAAM,kBAAkB,IAAI,KAAK,KAAK,KAAK;AAG3C,IAAM,yBAAyB;AAC/B,IAAM,eAAe;AACrB,IAAM,aAAa,KAAK,KAAK;AAa7B,IAAM,UAA6B;AAAA,EACjC,UAAU;AAAA,EACV,aAAa;AAAA,EACb,aAAa;AACf;AAEA,SAAS,iBAAuB;AAC9B,QAAM,MAAM,KAAK,IAAI;AAGrB,MAAI,MAAM,QAAQ,aAAa;AAC7B,UAAM,YAAY,KAAK,MAAM,QAAQ,cAAc,OAAO,GAAK;AAC/D,UAAM,IAAI,MAAM,EAAE,mBAAmB,EAAE,SAAS,UAAU,CAAC,CAAC;AAAA,EAC9D;AAGA,MAAI,MAAM,QAAQ,cAAc,wBAAwB;AACtD,UAAM,IAAI,MAAM,EAAE,cAAc,CAAC;AAAA,EACnC;AACF;AAEA,SAAS,cAAc,SAAwB;AAC7C,QAAM,MAAM,KAAK,IAAI;AACrB,UAAQ,cAAc;AAEtB,MAAI,SAAS;AACX,YAAQ,WAAW;AACnB;AAAA,EACF;AAEA,UAAQ;AACR,MAAI,QAAQ,YAAY,cAAc;AACpC,YAAQ,cAAc,MAAM;AAC5B,YAAQ,WAAW;AAAA,EACrB;AACF;AAYA,IAAM,yBAAyB;AAE/B,IAAI,mBAA8D;AAClE,SAAS,YAAgD;AACvD,MAAI,iBAAkB,QAAO;AAK7B,QAAM,aAAa,OAAO,KAAK,4BAA4B,KAAK;AAChE,QAAM,SAAS,OAAO,KAAK,wBAAwB,QAAQ;AAC3D,QAAM,OAAO,OAAO,OAAO,CAAC,YAAY,MAAM,CAAC;AAC/C,qBAAmB,gBAAgB,EAAE,KAAK,MAAM,QAAQ,OAAO,MAAM,OAAO,CAAC;AAC7E,SAAO;AACT;AASO,SAAS,cAAc,OAAwB;AACpD,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO,KAAK,UAAU,KAAK;AAC5E,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,MAAM,IAAI,aAAa,EAAE,KAAK,GAAG,IAAI;AAAA,EACpD;AACA,QAAM,OAAO,OAAO,KAAK,KAAgC,EAAE,KAAK;AAChE,QAAM,QAAQ,KAAK;AAAA,IAAI,CAAC,MACtB,KAAK,UAAU,CAAC,IAAI,MAAM,cAAe,MAAkC,CAAC,CAAC;AAAA,EAC/E;AACA,SAAO,MAAM,MAAM,KAAK,GAAG,IAAI;AACjC;AAOO,SAAS,oBAAoB,QAAgC;AAClE,MAAI;AACF,UAAM,MAAM,OAAO,KAAK,OAAO,KAAK,QAAQ;AAC5C,QAAI,IAAI,WAAW,GAAI,QAAO;AAC9B,UAAM,UAAU,OAAO,KAAK,cAAc,OAAO,OAAO,GAAG,MAAM;AACjE,WAAO,OAAO,MAAM,SAAS,UAAU,GAAG,GAAG;AAAA,EAC/C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,cAAc,KAAkC;AACvD,MAAI,OAAO,QAAQ,YAAY,QAAQ,KAAM,QAAO;AACpD,QAAM,IAAI;AACV,SAAO,EAAE,YAAY,KAAK,EAAE,YAAY;AAC1C;AAEA,eAAsB,cAA2C;AAC/D,MAAI;AACF,UAAM,MAAM,MAAM,SAAS,cAAc,OAAO;AAChD,UAAM,SAAkB,KAAK,MAAM,GAAG;AAEtC,QAAI,CAAC,cAAc,MAAM,EAAG,QAAO;AACnC,UAAM,OAAO;AAGb,QAAI,KAAK,YAAY,GAAG;AACtB,UAAI,CAAC,KAAK,WAAW,OAAO,KAAK,QAAQ,SAAU,QAAO;AAC1D,UAAI,CAAC,cAAc,KAAK,OAAO,EAAG,QAAO;AACzC,YAAM,SAAwB,EAAE,SAAS,KAAK,SAAS,KAAK,KAAK,IAAI;AACrE,UAAI,CAAC,oBAAoB,MAAM,EAAG,QAAO;AACzC,aAAO,KAAK;AAAA,IACd;AAQA,QAAI,KAAK,YAAY,GAAG;AACtB,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAUA,eAAe,cAAc,QAAsC;AACjE,QAAM,eAAe;AACrB,QAAM,OAAoB;AAAA,IACxB,SAAS;AAAA,IACT,SAAS,OAAO;AAAA,IAChB,KAAK,OAAO;AAAA,EACd;AACA,QAAM,UAAU,eAAe;AAC/B,QAAM,UAAU,SAAS,KAAK,UAAU,MAAM,MAAM,CAAC,GAAG,EAAE,UAAU,SAAS,MAAM,IAAM,CAAC;AAC1F,QAAM,OAAO,SAAS,YAAY;AACpC;AAaA,eAAsB,eAA8B;AAClD,MAAI;AACF,UAAM,GAAG,YAAY;AAAA,EACvB,QAAQ;AAAA,EAA2B;AACrC;AAEO,SAAS,UAAU,SAA+B;AACvD,MAAI,CAAC,QAAQ,UAAW,QAAO;AAC/B,QAAM,SAAS,IAAI,KAAK,QAAQ,SAAS,EAAE,QAAQ;AAInD,MAAI,MAAM,MAAM,EAAG,QAAO;AAC1B,SAAO,SAAS,KAAK,IAAI;AAC3B;AAEO,SAAS,kBAAkB,SAA+B;AAC/D,QAAM,gBAAgB,IAAI,KAAK,QAAQ,eAAe,EAAE,QAAQ;AAChE,MAAI,MAAM,aAAa,EAAG,QAAO;AACjC,SAAO,KAAK,IAAI,IAAI,gBAAgB;AACtC;AAEO,SAAS,oBAAoB,SAA+B;AACjE,QAAM,gBAAgB,IAAI,KAAK,QAAQ,eAAe,EAAE,QAAQ;AAChE,MAAI,MAAM,aAAa,EAAG,QAAO;AACjC,SAAO,KAAK,IAAI,IAAI,gBAAgB;AACtC;AAcO,SAAS,oBAAoB,SAAwC;AAC1E,QAAM,gBAAgB,IAAI,KAAK,QAAQ,eAAe,EAAE,QAAQ;AAChE,MAAI,MAAM,aAAa,EAAG,QAAO;AACjC,QAAM,UAAU,KAAK,IAAI,IAAI;AAK7B,MAAI,UAAU,EAAG,QAAO;AACxB,QAAM,OAAO,WAAW,KAAK,KAAK,KAAK;AAEvC,MAAI,QAAQ,EAAG,QAAO;AACtB,MAAI,QAAQ,GAAI,QAAO;AACvB,MAAI,QAAQ,GAAI,QAAO;AACvB,SAAO;AACT;AAGA,SAAS,mBAAmB,KAAmB;AAG7C,MAAI,IAAI,SAAS,MAAM,IAAI,SAAS,KAAK;AACvC,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAC9C;AAEA,MAAI,CAAC,WAAW,KAAK,GAAG,GAAG;AACzB,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAC9C;AACF;AAEA,eAAsB,SAAS,KAAmC;AAChE,qBAAmB,GAAG;AACtB,iBAAe;AAEf,MAAI,UAAU;AACd,MAAI;AACF,UAAM,YAAY,MAAM,aAAa;AACrC,UAAM,SAAS,MAAM,gBAAY,KAAK,SAAS;AAK/C,QAAI,CAAC,oBAAoB,MAAM,GAAG;AAChC,YAAM,IAAI,MAAM,gDAAgD;AAAA,IAClE;AAEA,UAAM,cAAc,MAAM;AAC1B,cAAU;AACV,WAAO,OAAO;AAAA,EAChB,UAAE;AACA,kBAAc,OAAO;AAAA,EACvB;AACF;AAOA,SAAS,eAAe,KAAuB;AAC7C,QAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,SAAO,uEAAuE,KAAK,GAAG;AACxF;AAEA,eAAsB,WAAW,SAAmD;AAClF,MAAI;AACF,UAAM,SAAS,MAAM,gBAAY,QAAQ,KAAK,QAAQ,UAAU;AAChE,QAAI,CAAC,oBAAoB,MAAM,GAAG;AAGhC,aAAO;AAAA,IACT;AACA,UAAM,cAAc,MAAM;AAG1B,WAAO,OAAO,QAAQ,WAAW,WAAW,UAAU;AAAA,EACxD,SAAS,KAAK;AAEZ,QAAI,eAAe,GAAG,GAAG;AACvB,aAAO,oBAAoB,OAAO,IAAI,UAAU;AAAA,IAClD;AAIA,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,WAAW,SAA2D;AAI1F,MAAI,gBAAgB;AACpB,MAAI;AACF,UAAM,kBAAc,QAAQ,KAAK,QAAQ,UAAU;AACnD,oBAAgB;AAAA,EAClB,QAAQ;AAAA,EAAwC;AAChD,QAAM,aAAa;AACnB,SAAO,EAAE,cAAc;AACzB;","names":[]}

package/build/{chunk-63AUNN5U.js → chunk-UKMRSNGQ.js}

@@ -186,7 +186,7 @@ async function launchBrewTUIBar() {
 }
 async function syncAndLaunchBrewTUIBar() {
   if (process.platform !== "darwin") return;
-  const { checkBrewTUIBarVersion } = await import("./version-check-2EYL5QFG.js");
+  const { checkBrewTUIBarVersion } = await import("./version-check-HAHQ336G.js");
   try {
     if (!await isBrewTUIBarInstalled()) {
       console.log(t("cli_brewtuibarInstalling"));
@@ -225,4 +225,4 @@ export {
   syncAndLaunchBrewTUIBar,
   uninstallBrewTUIBar
 };
-//# sourceMappingURL=chunk-63AUNN5U.js.map
+//# sourceMappingURL=chunk-UKMRSNGQ.js.map

package/build/{doctor-V7IRCOIM.js → doctor-HNDEFZIR.js}

@@ -1,16 +1,16 @@
 import {
   checkBrewTUIBarVersion,
   readBrewTUIBarVersion
-} from "./chunk-BP7CFABE.js";
+} from "./chunk-FFULOTXT.js";
 import {
   useLicenseStore
-} from "./chunk-FQV2F47X.js";
+} from "./chunk-ILKWT7WR.js";
 import {
   bundleIdAt,
   isBrewTUIBarInstalled,
   isBrewTUIBarRunning
-} from "./chunk-63AUNN5U.js";
-import "./chunk-4RPJM7O7.js";
+} from "./chunk-UKMRSNGQ.js";
+import "./chunk-TA3XPHF4.js";
 import "./chunk-NRRQECXA.js";
 import "./chunk-A7U3NZYM.js";
 import "./chunk-KDHEUNRI.js";
@@ -53,7 +53,7 @@ async function findBrewBinary() {
   }
 }
 async function runDoctor() {
-  const cliVersion = "3.4.0";
+  const cliVersion = "4.0.1";
   console.log(format("Brew-TUI", [
     { label: "CLI version", value: cliVersion },
     { label: "Platform", value: `${process.platform} (${arch()})` },
@@ -130,4 +130,4 @@ async function runDoctor() {
 export {
   runDoctor
 };
-//# sourceMappingURL=doctor-V7IRCOIM.js.map
+//# sourceMappingURL=doctor-HNDEFZIR.js.map

package/build/index.js

@@ -1,7 +1,7 @@
 import {
   useLicenseStore,
   verifyStoreIntegrity
-} from "./chunk-FQV2F47X.js";
+} from "./chunk-ILKWT7WR.js";
 import {
   brewUpdate,
   casksToListItems,
@@ -35,14 +35,14 @@ import {
   loadSyncConfig,
   readSyncEnvelope,
   sync
-} from "./chunk-D6DGYMXM.js";
+} from "./chunk-Q4PGJ4H2.js";
 import {
   activate,
   deactivate,
   getDegradationLevel,
   loadLicense,
   revalidate
-} from "./chunk-4RPJM7O7.js";
+} from "./chunk-TA3XPHF4.js";
 import {
   fetchWithRetry
 } from "./chunk-NRRQECXA.js";
@@ -4562,7 +4562,7 @@ function AccountView() {
       status === "pro" || status === "team" || status === "expired" ? `v ${t("hint_revalidate")}  ` : "",
       revalidating ? t("account_revalidating") : "",
       " ",
-      t("app_version", { version: "3.4.0" })
+      t("app_version", { version: "4.0.1" })
     ] }) })
   ] });
 }
@@ -6070,7 +6070,7 @@ async function reportError(err, context = {}) {
   const config = await resolveConfig();
   if (!config.enabled || !config.endpoint) return;
   const machineId = await getMachineId();
-  const version = true ? "3.4.0" : "unknown";
+  const version = true ? "4.0.1" : "unknown";
   await postReport(buildReport("error", err, context, machineId, version), config);
 }
 async function installCrashReporter() {
@@ -6079,7 +6079,7 @@ async function installCrashReporter() {
   if (!config.enabled || !config.endpoint) return;
   _installed = true;
   const machineId = await getMachineId();
-  const version = true ? "3.4.0" : "unknown";
+  const version = true ? "4.0.1" : "unknown";
   process.on("uncaughtException", (err) => {
     void postReport(buildReport("fatal", err, { kind: "uncaughtException" }, machineId, version), config);
   });
@@ -6094,11 +6094,11 @@ import { jsx as jsx39 } from "react/jsx-runtime";
 var [, , command, arg] = process.argv;
 async function runCli() {
   if (command === "--version" || command === "-v" || command === "version") {
-    const cliVersion = "3.4.0";
+    const cliVersion = "4.0.1";
     process.stdout.write(cliVersion + "\n");
     if (process.platform === "darwin") {
       try {
-        const { readBrewTUIBarVersion } = await import("./version-check-2EYL5QFG.js");
+        const { readBrewTUIBarVersion } = await import("./version-check-HAHQ336G.js");
         const appVersion = await readBrewTUIBarVersion();
         if (appVersion && appVersion !== cliVersion) {
           process.stderr.write(t("cli_versionMismatchWarning", { installed: appVersion, expected: cliVersion }) + "\n");
@@ -6222,7 +6222,7 @@ Snapshots: ${snapshots.length} (latest: ${latest ? formatDate(latest.capturedAt)
       } catch {
       }
       try {
-        const { loadSyncConfig: loadSyncConfig2 } = await import("./sync-engine-37NCGPBS.js");
+        const { loadSyncConfig: loadSyncConfig2 } = await import("./sync-engine-7M4WUHUW.js");
         const syncConfig = await loadSyncConfig2();
         if (syncConfig?.lastSync) {
           console.log(`Sync: last sync ${formatDate(syncConfig.lastSync)}`);
@@ -6243,7 +6243,7 @@ Snapshots: ${snapshots.length} (latest: ${latest ? formatDate(latest.capturedAt)
     return;
   }
   if (command === "install-brew-tui-bar") {
-    const { installBrewTUIBar } = await import("./brew-tui-bar-installer-D75KPQ3Z.js");
+    const { installBrewTUIBar } = await import("./brew-tui-bar-installer-CGJFE7PQ.js");
     try {
       console.log(t("cli_brewtuibarInstalling"));
       await installBrewTUIBar(false, arg === "--force");
@@ -6255,7 +6255,7 @@ Snapshots: ${snapshots.length} (latest: ${latest ? formatDate(latest.capturedAt)
     return;
   }
   if (command === "uninstall-brew-tui-bar") {
-    const { uninstallBrewTUIBar } = await import("./brew-tui-bar-installer-D75KPQ3Z.js");
+    const { uninstallBrewTUIBar } = await import("./brew-tui-bar-installer-CGJFE7PQ.js");
     try {
       await uninstallBrewTUIBar();
       console.log(t("cli_brewtuibarUninstalled"));
@@ -6266,7 +6266,7 @@ Snapshots: ${snapshots.length} (latest: ${latest ? formatDate(latest.capturedAt)
     return;
   }
   if (command === "doctor") {
-    const { runDoctor } = await import("./doctor-V7IRCOIM.js");
+    const { runDoctor } = await import("./doctor-HNDEFZIR.js");
     await runDoctor();
     return;
   }
@@ -6290,7 +6290,7 @@ Snapshots: ${snapshots.length} (latest: ${latest ? formatDate(latest.capturedAt)
 async function ensureBrewTUIBarRunning() {
   if (process.platform !== "darwin") return;
   await useLicenseStore.getState().initialize();
-  const { syncAndLaunchBrewTUIBar } = await import("./brew-tui-bar-installer-D75KPQ3Z.js");
+  const { syncAndLaunchBrewTUIBar } = await import("./brew-tui-bar-installer-CGJFE7PQ.js");
   await syncAndLaunchBrewTUIBar();
 }
 runCli().catch((err) => {

package/build/postinstall.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   syncAndLaunchBrewTUIBar
-} from "./chunk-63AUNN5U.js";
+} from "./chunk-UKMRSNGQ.js";
 import "./chunk-NRRQECXA.js";
 import {
   t

package/build/{sync-engine-37NCGPBS.js → sync-engine-7M4WUHUW.js}

@@ -3,8 +3,8 @@ import {
   loadSyncConfig,
   saveSyncConfig,
   sync
-} from "./chunk-D6DGYMXM.js";
-import "./chunk-4RPJM7O7.js";
+} from "./chunk-Q4PGJ4H2.js";
+import "./chunk-TA3XPHF4.js";
 import "./chunk-NRRQECXA.js";
 import "./chunk-A7U3NZYM.js";
 import "./chunk-OXDZ4DCK.js";
@@ -19,4 +19,4 @@ export {
   saveSyncConfig,
   sync
 };
-//# sourceMappingURL=sync-engine-37NCGPBS.js.map
+//# sourceMappingURL=sync-engine-7M4WUHUW.js.map

package/build/{version-check-2EYL5QFG.js → version-check-HAHQ336G.js}

@@ -4,7 +4,7 @@ import {
   compareSemver,
   expectedVersion,
   readBrewTUIBarVersion
-} from "./chunk-BP7CFABE.js";
+} from "./chunk-FFULOTXT.js";
 export {
   CONTRACT_VERSION,
   checkBrewTUIBarVersion,
@@ -12,4 +12,4 @@ export {
   expectedVersion,
   readBrewTUIBarVersion
 };
-//# sourceMappingURL=version-check-2EYL5QFG.js.map
+//# sourceMappingURL=version-check-HAHQ336G.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brew-tui",
-  "version": "3.4.0",
+  "version": "4.0.1",
   "description": "Brew-TUI — Visual TUI for Homebrew package management",
   "type": "module",
   "bin": {

package/build/chunk-4RPJM7O7.js

@@ -1,371 +0,0 @@
-import {
-  fetchWithRetry
-} from "./chunk-NRRQECXA.js";
-import {
-  t
-} from "./chunk-A7U3NZYM.js";
-import {
-  LICENSE_PATH,
-  ensureDataDirs,
-  getMachineId
-} from "./chunk-LFGDNAXH.js";
-
-// src/lib/license/license-manager.ts
-import { readFile, writeFile, rename, rm } from "fs/promises";
-import { createCipheriv, createDecipheriv, randomBytes, hkdfSync } from "crypto";
-
-// src/lib/license/polar-api.ts
-import { createHash } from "crypto";
-function hashMachineLabel(machineId) {
-  return createHash("sha256").update(machineId).digest("hex").slice(0, 32);
-}
-var BASE_URL = "https://api.polar.sh/v1/customer-portal/license-keys";
-var POLAR_ORGANIZATION_ID = "b8f245c0-d116-4457-92fb-1bda47139f82";
-function validateApiUrl(url) {
-  const parsed = new URL(url);
-  if (parsed.protocol !== "https:") {
-    throw new Error("HTTPS required for license API");
-  }
-  if (parsed.hostname !== "polar.sh" && !parsed.hostname.endsWith(".polar.sh")) {
-    throw new Error("Invalid API host");
-  }
-}
-async function post(endpoint, body, expectEmpty = false) {
-  const url = `${BASE_URL}/${endpoint}/`;
-  validateApiUrl(url);
-  const res = await fetchWithRetry(url, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify(body)
-  }, 15e3);
-  if (!res.ok) {
-    let message = `Request failed with status ${res.status}`;
-    try {
-      const errBody = await res.json();
-      if (typeof errBody.detail === "string") message = errBody.detail;
-      else if (typeof errBody.error === "string") message = errBody.error;
-      else if (typeof errBody.message === "string") message = errBody.message;
-    } catch {
-    }
-    throw new Error(message);
-  }
-  if (expectEmpty || res.status === 204) return void 0;
-  return res.json();
-}
-async function activateLicense(key) {
-  const machineId = await getMachineId();
-  const activation = await post("activate", {
-    key,
-    organization_id: POLAR_ORGANIZATION_ID,
-    // SEG-004 + BK-009: identificador estable por equipo, hasheado para
-    // que el UUID en claro no aparezca en logs de Polar.
-    label: hashMachineLabel(machineId)
-  });
-  if (!activation || typeof activation.id !== "string" || !activation.license_key) {
-    throw new Error("Invalid activation response: missing required fields");
-  }
-  let customerEmail = "";
-  let customerName = "";
-  try {
-    const validated = await post("validate", {
-      key,
-      organization_id: POLAR_ORGANIZATION_ID,
-      activation_id: activation.id
-    });
-    customerEmail = validated.customer?.email ?? "";
-    customerName = validated.customer?.name ?? "";
-  } catch {
-  }
-  return {
-    activated: true,
-    error: null,
-    instance: { id: activation.id },
-    license_key: {
-      id: 0,
-      status: activation.license_key.status,
-      key,
-      activation_limit: 0,
-      activations_count: 0,
-      expires_at: activation.license_key.expires_at
-    },
-    meta: { customer_email: customerEmail, customer_name: customerName }
-  };
-}
-async function validateLicense(key, instanceId) {
-  const res = await post("validate", {
-    key,
-    organization_id: POLAR_ORGANIZATION_ID,
-    activation_id: instanceId
-  });
-  if (!res || typeof res.id !== "string" || typeof res.status !== "string" || !res.customer) {
-    throw new Error("Invalid validation response: missing required fields");
-  }
-  const notExpired = res.expires_at === null || new Date(res.expires_at) > /* @__PURE__ */ new Date();
-  const valid = res.status === "granted" && notExpired;
-  return {
-    valid,
-    error: valid ? null : `License ${res.status}`,
-    license_key: {
-      id: 0,
-      status: res.status,
-      key,
-      expires_at: res.expires_at
-    },
-    instance: { id: instanceId }
-  };
-}
-async function deactivateLicense(key, instanceId) {
-  await post(
-    "deactivate",
-    { key, organization_id: POLAR_ORGANIZATION_ID, activation_id: instanceId },
-    true
-  );
-}
-
-// src/lib/license/types.ts
-function isLicenseData(value) {
-  if (typeof value !== "object" || value === null) return false;
-  const v = value;
-  return typeof v.key === "string" && typeof v.instanceId === "string" && (v.status === "active" || v.status === "expired" || v.status === "inactive") && typeof v.customerEmail === "string" && typeof v.customerName === "string" && (v.plan === "pro" || v.plan === "team") && typeof v.activatedAt === "string" && (v.expiresAt === null || typeof v.expiresAt === "string") && typeof v.lastValidatedAt === "string";
-}
-
-// src/lib/license/license-manager.ts
-var REVALIDATION_INTERVAL_MS = 24 * 60 * 60 * 1e3;
-var GRACE_PERIOD_MS = 7 * 24 * 60 * 60 * 1e3;
-var ACTIVATION_COOLDOWN_MS = 3e4;
-var MAX_ATTEMPTS = 5;
-var LOCKOUT_MS = 15 * 60 * 1e3;
-var tracker = {
-  attempts: 0,
-  lastAttempt: 0,
-  lockedUntil: 0
-};
-function checkRateLimit() {
-  const now = Date.now();
-  if (now < tracker.lockedUntil) {
-    const remaining = Math.ceil((tracker.lockedUntil - now) / 6e4);
-    throw new Error(t("cli_rateLimited", { minutes: remaining }));
-  }
-  if (now - tracker.lastAttempt < ACTIVATION_COOLDOWN_MS) {
-    throw new Error(t("cli_cooldown"));
-  }
-}
-function recordAttempt(success) {
-  const now = Date.now();
-  tracker.lastAttempt = now;
-  if (success) {
-    tracker.attempts = 0;
-    return;
-  }
-  tracker.attempts++;
-  if (tracker.attempts >= MAX_ATTEMPTS) {
-    tracker.lockedUntil = now + LOCKOUT_MS;
-    tracker.attempts = 0;
-  }
-}
-var ENCRYPTION_SECRET = "brew-tui-license-aes256gcm-v1";
-var HKDF_SALT = "brew-tui-salt-v1";
-var _derivedKey = null;
-async function deriveEncryptionKey() {
-  if (_derivedKey) return _derivedKey;
-  const machineId = await getMachineId();
-  const derived = hkdfSync("sha256", ENCRYPTION_SECRET, HKDF_SALT, machineId, 32);
-  _derivedKey = Buffer.from(derived);
-  return _derivedKey;
-}
-async function encryptLicenseData(data) {
-  const key = await deriveEncryptionKey();
-  const iv = randomBytes(12);
-  const cipher = createCipheriv("aes-256-gcm", key, iv);
-  const plaintext = JSON.stringify(data);
-  const ciphertext = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  return {
-    encrypted: ciphertext.toString("base64"),
-    iv: iv.toString("base64"),
-    tag: tag.toString("base64")
-  };
-}
-async function decryptLicenseData(encrypted, iv, tag) {
-  const ivBuf = Buffer.from(iv, "base64");
-  const tagBuf = Buffer.from(tag, "base64");
-  const ciphertext = Buffer.from(encrypted, "base64");
-  const key = await deriveEncryptionKey();
-  const decipher = createDecipheriv("aes-256-gcm", key, ivBuf);
-  decipher.setAuthTag(tagBuf);
-  const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
-  const parsed = JSON.parse(plaintext.toString("utf-8"));
-  if (!isLicenseData(parsed)) {
-    throw new Error("Decrypted license payload failed shape validation");
-  }
-  return parsed;
-}
-function isLicenseFile(obj) {
-  return typeof obj === "object" && obj !== null && obj.version === 1;
-}
-function isEncryptedLicenseFile(obj) {
-  if (!isLicenseFile(obj)) return false;
-  const record = obj;
-  return typeof record.encrypted === "string" && typeof record.iv === "string" && typeof record.tag === "string";
-}
-async function loadLicense() {
-  try {
-    const raw = await readFile(LICENSE_PATH, "utf-8");
-    const parsed = JSON.parse(raw);
-    if (!isLicenseFile(parsed)) {
-      throw new Error("Invalid license data format");
-    }
-    const file = parsed;
-    if (file.version !== 1) {
-      throw new Error("Unsupported data version");
-    }
-    if (isEncryptedLicenseFile(file)) {
-      const data = await decryptLicenseData(file.encrypted, file.iv, file.tag);
-      const fileRecord = file;
-      if (fileRecord.machineId) {
-        const currentMachineId = await getMachineId();
-        if (typeof fileRecord.machineId !== "string" || fileRecord.machineId.toLowerCase() !== currentMachineId.toLowerCase()) {
-          throw new Error("License was activated on a different machine");
-        }
-      }
-      return data;
-    }
-    if (file.license) {
-      const data = file.license;
-      await saveLicense(data);
-      return data;
-    }
-    return null;
-  } catch {
-    return null;
-  }
-}
-async function saveLicense(data) {
-  await ensureDataDirs();
-  const { encrypted, iv, tag } = await encryptLicenseData(data);
-  const machineId = await getMachineId();
-  const file = { version: 1, encrypted, iv, tag, machineId };
-  const tmpPath = LICENSE_PATH + ".tmp";
-  await writeFile(tmpPath, JSON.stringify(file, null, 2), { encoding: "utf-8", mode: 384 });
-  await rename(tmpPath, LICENSE_PATH);
-}
-async function clearLicense() {
-  try {
-    await rm(LICENSE_PATH);
-  } catch {
-  }
-}
-function isExpired(license) {
-  if (!license.expiresAt) return false;
-  const expiry = new Date(license.expiresAt).getTime();
-  if (isNaN(expiry)) return true;
-  return expiry < Date.now();
-}
-function needsRevalidation(license) {
-  const lastValidated = new Date(license.lastValidatedAt).getTime();
-  if (isNaN(lastValidated)) return true;
-  return Date.now() - lastValidated > REVALIDATION_INTERVAL_MS;
-}
-function isWithinGracePeriod(license) {
-  const lastValidated = new Date(license.lastValidatedAt).getTime();
-  if (isNaN(lastValidated)) return false;
-  return Date.now() - lastValidated < GRACE_PERIOD_MS;
-}
-function getDegradationLevel(license) {
-  const lastValidated = new Date(license.lastValidatedAt).getTime();
-  if (isNaN(lastValidated)) return "expired";
-  const elapsed = Date.now() - lastValidated;
-  if (elapsed < 0) return "expired";
-  const days = elapsed / (24 * 60 * 60 * 1e3);
-  if (days <= 7) return "none";
-  if (days <= 14) return "warning";
-  if (days <= 30) return "limited";
-  return "expired";
-}
-function validateLicenseKey(key) {
-  if (key.length < 10 || key.length > 100) {
-    throw new Error("Invalid license key format");
-  }
-  if (!/^[\w-]+$/.test(key)) {
-    throw new Error("Invalid license key format");
-  }
-}
-function detectPlan(key) {
-  const upper = key.toUpperCase();
-  return upper.startsWith("BTUI-T-") || upper.startsWith("BTUI-T_") ? "team" : "pro";
-}
-async function activate(key) {
-  validateLicenseKey(key);
-  checkRateLimit();
-  let success = false;
-  try {
-    const res = await activateLicense(key);
-    if (!res.activated) {
-      throw new Error(res.error ?? "Activation failed");
-    }
-    const license = {
-      key,
-      instanceId: res.instance.id,
-      status: "active",
-      customerEmail: res.meta.customer_email,
-      customerName: res.meta.customer_name,
-      plan: detectPlan(key),
-      activatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-      expiresAt: res.license_key.expires_at,
-      lastValidatedAt: (/* @__PURE__ */ new Date()).toISOString()
-    };
-    await saveLicense(license);
-    success = true;
-    return license;
-  } finally {
-    recordAttempt(success);
-  }
-}
-function isNetworkError(err) {
-  const msg = err instanceof Error ? err.message : String(err);
-  return /fetch failed|ECONNREFUSED|ENOTFOUND|ETIMEDOUT|network|timeout|abort/i.test(msg);
-}
-async function revalidate(license) {
-  try {
-    const res = await validateLicense(license.key, license.instanceId);
-    if (res.valid) {
-      const updated = {
-        ...license,
-        lastValidatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        status: "active",
-        expiresAt: res.license_key.expires_at
-      };
-      await saveLicense(updated);
-      return "valid";
-    }
-    await saveLicense({ ...license, status: "expired" });
-    return "expired";
-  } catch (err) {
-    if (isNetworkError(err)) {
-      return isWithinGracePeriod(license) ? "grace" : "expired";
-    }
-    await saveLicense({ ...license, status: "expired" });
-    return "expired";
-  }
-}
-async function deactivate(license) {
-  let remoteSuccess = false;
-  try {
-    await deactivateLicense(license.key, license.instanceId);
-    remoteSuccess = true;
-  } catch {
-  }
-  await clearLicense();
-  return { remoteSuccess };
-}
-
-export {
-  loadLicense,
-  isExpired,
-  needsRevalidation,
-  getDegradationLevel,
-  activate,
-  revalidate,
-  deactivate
-};
-//# sourceMappingURL=chunk-4RPJM7O7.js.map

package/build/chunk-4RPJM7O7.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/lib/license/license-manager.ts","../src/lib/license/polar-api.ts","../src/lib/license/types.ts"],"sourcesContent":["import { readFile, writeFile, rename, rm } from 'node:fs/promises';\nimport { createCipheriv, createDecipheriv, randomBytes, hkdfSync } from 'node:crypto';\nimport { LICENSE_PATH, ensureDataDirs, getMachineId } from '../data-dir.js';\nimport { activateLicense as apiActivate, validateLicense as apiValidate, deactivateLicense as apiDeactivate } from './polar-api.js';\nimport { t } from '../../i18n/index.js';\nimport { isLicenseData, type LicenseData, type LicenseFile } from './types.js';\n\n// SEG-009 guard: previously a hardcoded map bypassed Polar entirely. The\n// function is kept as an always-null export so a regression test can pin\n// the behaviour and the import site in license-store stays stable.\nexport function getBuiltinAccountType(_email: string): 'pro' | 'team' | 'free' | null {\n  return null;\n}\n\nconst REVALIDATION_INTERVAL_MS = 24 * 60 * 60 * 1000; // 24h\nconst GRACE_PERIOD_MS = 7 * 24 * 60 * 60 * 1000; // 7 days\n\n// ── Layer 18: Client-side rate limiting on activations ──\nconst ACTIVATION_COOLDOWN_MS = 30_000; // 30 seconds between attempts\nconst MAX_ATTEMPTS = 5;\nconst LOCKOUT_MS = 15 * 60 * 1000; // 15 min lockout after max attempts\n\ninterface ActivationTracker {\n  attempts: number;\n  lastAttempt: number;\n  lockedUntil: number;\n}\n\n// UX-004: rate-limit state is intentionally in-memory only. It is a first\n// filter to slow down brute force inside one TUI session — the authoritative\n// activation throttle lives in the Polar backend, which sees attempts across\n// process restarts. Persisting this client-side would invite users to delete\n// the file and reset themselves; the trade-off is documented here on purpose.\nconst tracker: ActivationTracker = {\n  attempts: 0,\n  lastAttempt: 0,\n  lockedUntil: 0,\n};\n\nfunction checkRateLimit(): void {\n  const now = Date.now();\n\n  // Check lockout\n  if (now < tracker.lockedUntil) {\n    const remaining = Math.ceil((tracker.lockedUntil - now) / 60000);\n    throw new Error(t('cli_rateLimited', { minutes: remaining }));\n  }\n\n  // Check cooldown\n  if (now - tracker.lastAttempt < ACTIVATION_COOLDOWN_MS) {\n    throw new Error(t('cli_cooldown'));\n  }\n}\n\nfunction recordAttempt(success: boolean): void {\n  const now = Date.now();\n  tracker.lastAttempt = now;\n\n  if (success) {\n    tracker.attempts = 0;\n    return;\n  }\n\n  tracker.attempts++;\n  if (tracker.attempts >= MAX_ATTEMPTS) {\n    tracker.lockedUntil = now + LOCKOUT_MS;\n    tracker.attempts = 0;\n  }\n}\n\n// SECURITY (SEG-002): the bundle-only constants below USED to be the entire\n// derivation input — anyone with the npm bundle could decrypt any user's\n// license.json. Now the per-user machineId is mixed into the HKDF info, so\n// the bundle alone is no longer sufficient: an attacker also needs the\n// target's ~/.brew-tui/machine-id. The two constants stay published; what's\n// secret is the user's local machineId, which never leaves the machine.\n//\n// HKDF-SHA256 was chosen over scrypt because Swift's CryptoKit (used by\n// Brew-TUI-Bar to read the same license.json) ships HKDF natively but not scrypt.\n// machineId is a UUIDv4 with 122 bits of entropy, so the cost-hardening of\n// scrypt is not what's protecting the key — the secrecy of the machineId is.\nconst ENCRYPTION_SECRET = 'brew-tui-license-aes256gcm-v1';\nconst HKDF_SALT = 'brew-tui-salt-v1';\n\nlet _derivedKey: Buffer | null = null;\n\nasync function deriveEncryptionKey(): Promise<Buffer> {\n  if (_derivedKey) return _derivedKey;\n  const machineId = await getMachineId();\n  // HKDF: ikm = SECRET, salt = HKDF_SALT, info = machineId, len = 32\n  const derived = hkdfSync('sha256', ENCRYPTION_SECRET, HKDF_SALT, machineId, 32);\n  _derivedKey = Buffer.from(derived);\n  return _derivedKey;\n}\n\nasync function encryptLicenseData(data: LicenseData): Promise<{ encrypted: string; iv: string; tag: string }> {\n  const key = await deriveEncryptionKey();\n  const iv = randomBytes(12); // 96-bit IV for GCM\n  const cipher = createCipheriv('aes-256-gcm', key, iv);\n\n  const plaintext = JSON.stringify(data);\n  const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf-8'), cipher.final()]);\n  const tag = cipher.getAuthTag();\n\n  return {\n    encrypted: ciphertext.toString('base64'),\n    iv: iv.toString('base64'),\n    tag: tag.toString('base64'),\n  };\n}\n\nasync function decryptLicenseData(encrypted: string, iv: string, tag: string): Promise<LicenseData> {\n  const ivBuf = Buffer.from(iv, 'base64');\n  const tagBuf = Buffer.from(tag, 'base64');\n  const ciphertext = Buffer.from(encrypted, 'base64');\n\n  // Only the machine-bound HKDF key is accepted. The legacy bundle-only\n  // scrypt fallback (in place from 0.6.3 through 2.x for license.json files\n  // written by 0.6.2 and earlier) was retired in 3.1.0 — see SEG-M2 in the\n  // security audit. Any envelope ciphered with the legacy key now fails\n  // decryption, which loadLicense() surfaces as \"license not found\" so the\n  // user re-activates.\n  const key = await deriveEncryptionKey();\n  const decipher = createDecipheriv('aes-256-gcm', key, ivBuf);\n  decipher.setAuthTag(tagBuf);\n  const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);\n  const parsed: unknown = JSON.parse(plaintext.toString('utf-8'));\n  if (!isLicenseData(parsed)) {\n    throw new Error('Decrypted license payload failed shape validation');\n  }\n  return parsed;\n}\n\n// BK-003: Type guard for license data format\nfunction isLicenseFile(obj: unknown): obj is LicenseFile {\n  return typeof obj === 'object' && obj !== null && (obj as Record<string, unknown>).version === 1;\n}\n\nfunction isEncryptedLicenseFile(obj: unknown): obj is LicenseFile & { encrypted: string; iv: string; tag: string } {\n  if (!isLicenseFile(obj)) return false;\n  const record = obj as unknown as Record<string, unknown>;\n  return typeof record.encrypted === 'string'\n    && typeof record.iv === 'string'\n    && typeof record.tag === 'string';\n}\n\nexport async function loadLicense(): Promise<LicenseData | null> {\n  try {\n    const raw = await readFile(LICENSE_PATH, 'utf-8');\n    const parsed: unknown = JSON.parse(raw);\n\n    // BK-003: Validate parsed data\n    if (!isLicenseFile(parsed)) {\n      throw new Error('Invalid license data format');\n    }\n\n    const file = parsed as LicenseFile;\n\n    if (file.version !== 1) {\n      // Future: add migration logic here\n      throw new Error('Unsupported data version');\n    }\n\n    // New encrypted format\n    if (isEncryptedLicenseFile(file)) {\n      const data = await decryptLicenseData(file.encrypted!, file.iv!, file.tag!);\n\n      // SEG-002: Check machine ID if stored in the envelope.\n      // getMachineId() now always resolves a value — if the user's machine-id\n      // file was wiped, a new UUID is created and this check rejects the\n      // license, prompting reactivation. Same behaviour the polar-api flow\n      // already had on save.\n      const fileRecord = file as unknown as Record<string, unknown>;\n      if (fileRecord.machineId) {\n        const currentMachineId = await getMachineId();\n        // SEC-L2: randomUUID() yields lowercase UUIDs, but a manually edited\n        // machine-id or license.json could carry mixed case. Normalise both\n        // sides before comparing so case alone is never the rejection reason.\n        if (typeof fileRecord.machineId !== 'string'\n            || fileRecord.machineId.toLowerCase() !== currentMachineId.toLowerCase()) {\n          throw new Error('License was activated on a different machine');\n        }\n      }\n\n      return data;\n    }\n\n    // Legacy unencrypted format — migrate to encrypted on read\n    if (file.license) {\n      const data = file.license;\n      // Re-save in encrypted format\n      await saveLicense(data);\n      return data;\n    }\n\n    return null;\n  } catch {\n    return null;\n  }\n}\n\nexport async function saveLicense(data: LicenseData): Promise<void> {\n  await ensureDataDirs();\n  const { encrypted, iv, tag } = await encryptLicenseData(data);\n  // SEG-002: Include machineId in the envelope for portability detection\n  const machineId = await getMachineId();\n  const file: Record<string, unknown> = { version: 1, encrypted, iv, tag, machineId };\n  const tmpPath = LICENSE_PATH + '.tmp';\n  await writeFile(tmpPath, JSON.stringify(file, null, 2), { encoding: 'utf-8', mode: 0o600 });\n  await rename(tmpPath, LICENSE_PATH);\n}\n\nexport async function clearLicense(): Promise<void> {\n  try {\n    await rm(LICENSE_PATH);\n  } catch { /* file may not exist */ }\n}\n\nexport function isExpired(license: LicenseData): boolean {\n  if (!license.expiresAt) return false;\n  const expiry = new Date(license.expiresAt).getTime();\n  // Fail closed on corrupted/unparseable dates: NaN comparisons are always\n  // false, so the previous version treated a garbage expiresAt as \"never\n  // expires\", which is exploitable.\n  if (isNaN(expiry)) return true;\n  return expiry < Date.now();\n}\n\nexport function needsRevalidation(license: LicenseData): boolean {\n  const lastValidated = new Date(license.lastValidatedAt).getTime();\n  if (isNaN(lastValidated)) return true; // corrupted date → force revalidation\n  return Date.now() - lastValidated > REVALIDATION_INTERVAL_MS;\n}\n\nexport function isWithinGracePeriod(license: LicenseData): boolean {\n  const lastValidated = new Date(license.lastValidatedAt).getTime();\n  if (isNaN(lastValidated)) return false; // corrupted date → no grace\n  return Date.now() - lastValidated < GRACE_PERIOD_MS;\n}\n\n// ── Layer 15: Gradual degradation after extended offline ──\n\nexport type DegradationLevel = 'none' | 'warning' | 'limited' | 'expired';\nexport type RevalidationResult = 'valid' | 'grace' | 'expired';\n\n/**\n * Returns the degradation level based on time since last server validation.\n * - 0-7 days: none (full access)\n * - 7-14 days: warning (shows a notice but still works)\n * - 14-30 days: limited (some features disabled)\n * - 30+ days: expired (all Pro features disabled)\n */\nexport function getDegradationLevel(license: LicenseData): DegradationLevel {\n  const lastValidated = new Date(license.lastValidatedAt).getTime();\n  if (isNaN(lastValidated)) return 'expired'; // corrupted date → deny access\n  const elapsed = Date.now() - lastValidated;\n  // SEC-L1: a negative elapsed means lastValidatedAt is in the future. This\n  // is almost always a clock-skew exploit (set system clock forward to keep\n  // Pro features forever). Fail-closed instead of granting full access. The\n  // next revalidate() against Polar will reset things if the skew is benign.\n  if (elapsed < 0) return 'expired';\n  const days = elapsed / (24 * 60 * 60 * 1000);\n\n  if (days <= 7) return 'none';\n  if (days <= 14) return 'warning';\n  if (days <= 30) return 'limited';\n  return 'expired';\n}\n\n// Layer 10: License key format validation\nfunction validateLicenseKey(key: string): void {\n  // Polar keys are UUID-like: 8-4-4-4-12 hex chars or similar\n  // Reject obviously invalid keys to avoid unnecessary API calls\n  if (key.length < 10 || key.length > 100) {\n    throw new Error('Invalid license key format');\n  }\n  // Only allow alphanumeric, hyphens, underscores\n  if (!/^[\\w-]+$/.test(key)) {\n    throw new Error('Invalid license key format');\n  }\n}\n\n// Polar license-key benefits use distinct prefixes per tier:\n//   Pro Monthly/Yearly  → \"BTUI-...\"\n//   Team Monthly/Yearly → \"BTUI-T-...\"\n// We detect the tier from the prefix instead of looking up the productId,\n// because Polar's customer-portal license endpoints don't echo product info\n// in the activation response.\nfunction detectPlan(key: string): 'pro' | 'team' {\n  const upper = key.toUpperCase();\n  return upper.startsWith('BTUI-T-') || upper.startsWith('BTUI-T_') ? 'team' : 'pro';\n}\n\nexport async function activate(key: string): Promise<LicenseData> {\n  validateLicenseKey(key);\n  checkRateLimit();\n\n  let success = false;\n  try {\n    const res = await apiActivate(key);\n\n    if (!res.activated) {\n      throw new Error(res.error ?? 'Activation failed');\n    }\n\n    const license: LicenseData = {\n      key,\n      instanceId: res.instance.id,\n      status: 'active',\n      customerEmail: res.meta.customer_email,\n      customerName: res.meta.customer_name,\n      plan: detectPlan(key),\n      activatedAt: new Date().toISOString(),\n      expiresAt: res.license_key.expires_at,\n      lastValidatedAt: new Date().toISOString(),\n    };\n\n    await saveLicense(license);\n    success = true;\n    return license;\n  } finally {\n    recordAttempt(success);\n  }\n}\n\n/**\n * Revalidate the license against the server.\n * This also serves as Layer 19 (telemetry): each validation call\n * allows Polar to track activation count, last-seen timestamp,\n * and detect if the activation limit is exceeded (license sharing).\n */\n// EP-006: Detect if an error is a network error vs validation/contract error\nfunction isNetworkError(err: unknown): boolean {\n  const msg = err instanceof Error ? err.message : String(err);\n  return /fetch failed|ECONNREFUSED|ENOTFOUND|ETIMEDOUT|network|timeout|abort/i.test(msg);\n}\n\nexport async function revalidate(license: LicenseData): Promise<RevalidationResult> {\n  try {\n    const res = await apiValidate(license.key, license.instanceId);\n\n    if (res.valid) {\n      const updated: LicenseData = {\n        ...license,\n        lastValidatedAt: new Date().toISOString(),\n        status: 'active',\n        expiresAt: res.license_key.expires_at,\n      };\n      await saveLicense(updated);\n      return 'valid';\n    }\n\n    await saveLicense({ ...license, status: 'expired' });\n    return 'expired';\n  } catch (err) {\n    // EP-006: Network errors trigger grace period; validation/contract errors mean expired\n    if (isNetworkError(err)) {\n      return isWithinGracePeriod(license) ? 'grace' : 'expired';\n    }\n    // Unexpected response or contract violation — treat as expired\n    await saveLicense({ ...license, status: 'expired' });\n    return 'expired';\n  }\n}\n\nexport async function deactivate(license: LicenseData): Promise<{ remoteSuccess: boolean }> {\n  // EP-001: apiDeactivate already wraps fetchWithRetry (3 attempts). The\n  // outer loop multiplied that into 9 POSTs — Polar would count each as a\n  // separate request and a flaky network would amplify load 3×.\n  let remoteSuccess = false;\n  try {\n    await apiDeactivate(license.key, license.instanceId);\n    remoteSuccess = true;\n  } catch { /* local clear still happens below */ }\n  await clearLicense();\n  return { remoteSuccess };\n}\n","import { createHash } from 'node:crypto';\nimport type { PolarActivateResponse, PolarValidateResponse } from './types.js';\nimport { fetchWithRetry } from '../fetch-timeout.js';\nimport { getMachineId } from '../data-dir.js';\n\n// BK-009: hash truncado SHA-256 del machineId — opacidad adicional frente a\n// correlacion en logs de Polar. El servidor solo necesita un identificador\n// estable por equipo; no requiere el UUID en claro.\nfunction hashMachineLabel(machineId: string): string {\n  return createHash('sha256').update(machineId).digest('hex').slice(0, 32);\n}\n\nconst BASE_URL = 'https://api.polar.sh/v1/customer-portal/license-keys';\n\n// ── GOV-004: Public organization ID (not a secret) ──\n// This is the public Polar organization identifier used for license key operations.\n// Found at: polar.sh/dashboard -> Settings -> General\nexport const POLAR_ORGANIZATION_ID = 'b8f245c0-d116-4457-92fb-1bda47139f82';\n\n// Polar product IDs (public, not secret) — useful for analytics, support, and\n// future server-side validation that wants to confirm what the customer bought.\nexport const POLAR_PRODUCT_IDS = {\n  proMonthly:  'b925b882-464c-40c1-9ffd-b088ab31d9a3',\n  proYearly:   '8f97bb81-b950-4bc3-97c5-8133dd817d0b',\n  teamMonthly: '7cf3fcb2-560d-4fbb-9936-15efac511b23',\n  teamYearly:  'd096914d-902d-47b0-8d62-5c7e6fc4e087',\n} as const;\n\n// Public checkout URLs surfaced from the landing page and the CLI upgrade prompt.\n// Team links carry ?quantity=3 because Polar has no native min-seats enforcement\n// and the Team tier is sold from 3 seats up.\nexport const POLAR_CHECKOUT_URLS = {\n  proMonthly:  'https://buy.polar.sh/polar_cl_QW1ZJ9887bU74drGr7JfujQfm3RKYnn1fuvc53DqD6D',\n  proYearly:   'https://buy.polar.sh/polar_cl_yQsiUeDelyyEQznbWffD1j77JAyP24ra7iEVQ22PA4h',\n  teamMonthly: 'https://buy.polar.sh/polar_cl_CO6xqSzKgFiQJwXnhZYGqisOP04Wspi0KKZSn38NjFZ?quantity=3',\n  teamYearly:  'https://buy.polar.sh/polar_cl_BZowqmtaKwWEkRJNtBcashWg7oZOH6OhnnsJ204opNA?quantity=3',\n} as const;\n\n// Layer 11: API URL validation\nfunction validateApiUrl(url: string): void {\n  const parsed = new URL(url);\n  if (parsed.protocol !== 'https:') {\n    throw new Error('HTTPS required for license API');\n  }\n  // SEC-M1: `endsWith('polar.sh')` would let `evilpolar.sh` pass. Match the\n  // exact apex OR a true subdomain via the leading-dot variant.\n  if (parsed.hostname !== 'polar.sh' && !parsed.hostname.endsWith('.polar.sh')) {\n    throw new Error('Invalid API host');\n  }\n}\n\n// Raw Polar response shapes\ninterface PolarActivation {\n  id: string; // activation_id\n  license_key: {\n    status: string;\n    expires_at: string | null;\n  };\n}\n\ninterface PolarValidated {\n  id: string;\n  status: string; // 'granted' | 'revoked' | 'disabled'\n  expires_at: string | null;\n  customer: {\n    email: string | null;\n    name: string | null;\n  };\n  activation: { id: string } | null;\n}\n\nasync function post<T>(endpoint: string, body: Record<string, unknown>, expectEmpty = false): Promise<T> {\n  // BK-008: Polar requiere trailing slash en sus rutas. Sin la barra final el\n  // servidor responde 307 y `fetch` con redirect followed pierde la cabecera\n  // Authorization → 405. Aseguramos la barra final aqui para que el caller\n  // pueda seguir usando rutas semanticas sin recordar la convencion.\n  const url = `${BASE_URL}/${endpoint}/`;\n  validateApiUrl(url);\n\n  const res = await fetchWithRetry(url, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify(body),\n  }, 15_000);\n\n  if (!res.ok) {\n    let message = `Request failed with status ${res.status}`;\n    try {\n      const errBody = await res.json() as { detail?: string; error?: string; message?: string };\n      if (typeof errBody.detail === 'string') message = errBody.detail;\n      else if (typeof errBody.error === 'string') message = errBody.error;\n      else if (typeof errBody.message === 'string') message = errBody.message;\n    } catch {\n      // non-JSON error body — use generic message above\n    }\n    throw new Error(message);\n  }\n\n  if (expectEmpty || res.status === 204) return undefined as T;\n  return res.json() as Promise<T>;\n}\n\nexport async function activateLicense(key: string): Promise<PolarActivateResponse> {\n  const machineId = await getMachineId();\n\n  const activation = await post<PolarActivation>('activate', {\n    key,\n    organization_id: POLAR_ORGANIZATION_ID,\n    // SEG-004 + BK-009: identificador estable por equipo, hasheado para\n    // que el UUID en claro no aparezca en logs de Polar.\n    label: hashMachineLabel(machineId),\n  });\n\n  // EP-001: Runtime validation of activation response\n  if (!activation || typeof activation.id !== 'string' || !activation.license_key) {\n    throw new Error('Invalid activation response: missing required fields');\n  }\n\n  // Polar's activate response doesn't include customer info — fetch it via validate\n  let customerEmail = '';\n  let customerName = '';\n  try {\n    const validated = await post<PolarValidated>('validate', {\n      key,\n      organization_id: POLAR_ORGANIZATION_ID,\n      activation_id: activation.id,\n    });\n    customerEmail = validated.customer?.email ?? '';\n    customerName = validated.customer?.name ?? '';\n  } catch {\n    // customer info is non-critical — activation still succeeds\n  }\n\n  return {\n    activated: true,\n    error: null,\n    instance: { id: activation.id },\n    license_key: {\n      id: 0,\n      status: activation.license_key.status,\n      key,\n      activation_limit: 0,\n      activations_count: 0,\n      expires_at: activation.license_key.expires_at,\n    },\n    meta: { customer_email: customerEmail, customer_name: customerName },\n  };\n}\n\nexport async function validateLicense(key: string, instanceId: string): Promise<PolarValidateResponse> {\n  const res = await post<PolarValidated>('validate', {\n    key,\n    organization_id: POLAR_ORGANIZATION_ID,\n    activation_id: instanceId,\n  });\n\n  // EP-002: Runtime validation of validate response\n  if (!res || typeof res.id !== 'string' || typeof res.status !== 'string' || !res.customer) {\n    throw new Error('Invalid validation response: missing required fields');\n  }\n\n  const notExpired = res.expires_at === null || new Date(res.expires_at) > new Date();\n  const valid = res.status === 'granted' && notExpired;\n\n  return {\n    valid,\n    error: valid ? null : `License ${res.status}`,\n    license_key: {\n      id: 0,\n      status: res.status,\n      key,\n      expires_at: res.expires_at,\n    },\n    instance: { id: instanceId },\n  };\n}\n\nexport async function deactivateLicense(key: string, instanceId: string): Promise<void> {\n  await post<void>(\n    'deactivate',\n    { key, organization_id: POLAR_ORGANIZATION_ID, activation_id: instanceId },\n    true,\n  );\n}\n","export interface LicenseData {\n  key: string;\n  instanceId: string;\n  status: 'active' | 'expired' | 'inactive';\n  customerEmail: string;\n  customerName: string;\n  plan: 'pro' | 'team';\n  activatedAt: string;\n  expiresAt: string | null;\n  lastValidatedAt: string;\n}\n\n// BK-006: type guard for license payload after AES-GCM decrypt. A corrupt or\n// migrated file could JSON.parse to anything — refuse instead of crashing on\n// undefined accesses downstream.\nexport function isLicenseData(value: unknown): value is LicenseData {\n  if (typeof value !== 'object' || value === null) return false;\n  const v = value as Record<string, unknown>;\n  return (\n    typeof v.key === 'string' &&\n    typeof v.instanceId === 'string' &&\n    (v.status === 'active' || v.status === 'expired' || v.status === 'inactive') &&\n    typeof v.customerEmail === 'string' &&\n    typeof v.customerName === 'string' &&\n    (v.plan === 'pro' || v.plan === 'team') &&\n    typeof v.activatedAt === 'string' &&\n    (v.expiresAt === null || typeof v.expiresAt === 'string') &&\n    typeof v.lastValidatedAt === 'string'\n  );\n}\n\nexport interface LicenseFile {\n  version: 1;\n  license?: LicenseData | null; // legacy unencrypted\n  hmac?: string; // legacy\n  encrypted?: string; // AES-256-GCM encrypted license JSON\n  iv?: string;\n  tag?: string;\n}\n\nexport type LicenseStatus = 'free' | 'pro' | 'team' | 'expired' | 'validating';\n\nexport interface PolarActivateResponse {\n  activated: boolean;\n  error: string | null;\n  license_key: {\n    id: number;\n    status: string;\n    key: string;\n    activation_limit: number;\n    activations_count: number;\n    expires_at: string | null;\n  };\n  instance: { id: string };\n  meta: { customer_name: string; customer_email: string };\n}\n\nexport interface PolarValidateResponse {\n  valid: boolean;\n  error: string | null;\n  license_key: {\n    id: number;\n    status: string;\n    key: string;\n    expires_at: string | null;\n  };\n  instance: { id: string };\n}\n\nexport type ProFeatureId =\n  | 'profiles'\n  | 'smart-cleanup'\n  | 'history'\n  | 'security-audit'\n  | 'rollback'\n  | 'brewfile'\n  | 'sync'\n  | 'impact-analysis';\n\nexport type TeamFeatureId = 'compliance';\n"],"mappings":";;;;;;;;;;;;;AAAA,SAAS,UAAU,WAAW,QAAQ,UAAU;AAChD,SAAS,gBAAgB,kBAAkB,aAAa,gBAAgB;;;ACDxE,SAAS,kBAAkB;AAQ3B,SAAS,iBAAiB,WAA2B;AACnD,SAAO,WAAW,QAAQ,EAAE,OAAO,SAAS,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AACzE;AAEA,IAAM,WAAW;AAKV,IAAM,wBAAwB;AAsBrC,SAAS,eAAe,KAAmB;AACzC,QAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,MAAI,OAAO,aAAa,UAAU;AAChC,UAAM,IAAI,MAAM,gCAAgC;AAAA,EAClD;AAGA,MAAI,OAAO,aAAa,cAAc,CAAC,OAAO,SAAS,SAAS,WAAW,GAAG;AAC5E,UAAM,IAAI,MAAM,kBAAkB;AAAA,EACpC;AACF;AAsBA,eAAe,KAAQ,UAAkB,MAA+B,cAAc,OAAmB;AAKvG,QAAM,MAAM,GAAG,QAAQ,IAAI,QAAQ;AACnC,iBAAe,GAAG;AAElB,QAAM,MAAM,MAAM,eAAe,KAAK;AAAA,IACpC,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,GAAG,IAAM;AAET,MAAI,CAAC,IAAI,IAAI;AACX,QAAI,UAAU,8BAA8B,IAAI,MAAM;AACtD,QAAI;AACF,YAAM,UAAU,MAAM,IAAI,KAAK;AAC/B,UAAI,OAAO,QAAQ,WAAW,SAAU,WAAU,QAAQ;AAAA,eACjD,OAAO,QAAQ,UAAU,SAAU,WAAU,QAAQ;AAAA,eACrD,OAAO,QAAQ,YAAY,SAAU,WAAU,QAAQ;AAAA,IAClE,QAAQ;AAAA,IAER;AACA,UAAM,IAAI,MAAM,OAAO;AAAA,EACzB;AAEA,MAAI,eAAe,IAAI,WAAW,IAAK,QAAO;AAC9C,SAAO,IAAI,KAAK;AAClB;AAEA,eAAsB,gBAAgB,KAA6C;AACjF,QAAM,YAAY,MAAM,aAAa;AAErC,QAAM,aAAa,MAAM,KAAsB,YAAY;AAAA,IACzD;AAAA,IACA,iBAAiB;AAAA;AAAA;AAAA,IAGjB,OAAO,iBAAiB,SAAS;AAAA,EACnC,CAAC;AAGD,MAAI,CAAC,cAAc,OAAO,WAAW,OAAO,YAAY,CAAC,WAAW,aAAa;AAC/E,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AAGA,MAAI,gBAAgB;AACpB,MAAI,eAAe;AACnB,MAAI;AACF,UAAM,YAAY,MAAM,KAAqB,YAAY;AAAA,MACvD;AAAA,MACA,iBAAiB;AAAA,MACjB,eAAe,WAAW;AAAA,IAC5B,CAAC;AACD,oBAAgB,UAAU,UAAU,SAAS;AAC7C,mBAAe,UAAU,UAAU,QAAQ;AAAA,EAC7C,QAAQ;AAAA,EAER;AAEA,SAAO;AAAA,IACL,WAAW;AAAA,IACX,OAAO;AAAA,IACP,UAAU,EAAE,IAAI,WAAW,GAAG;AAAA,IAC9B,aAAa;AAAA,MACX,IAAI;AAAA,MACJ,QAAQ,WAAW,YAAY;AAAA,MAC/B;AAAA,MACA,kBAAkB;AAAA,MAClB,mBAAmB;AAAA,MACnB,YAAY,WAAW,YAAY;AAAA,IACrC;AAAA,IACA,MAAM,EAAE,gBAAgB,eAAe,eAAe,aAAa;AAAA,EACrE;AACF;AAEA,eAAsB,gBAAgB,KAAa,YAAoD;AACrG,QAAM,MAAM,MAAM,KAAqB,YAAY;AAAA,IACjD;AAAA,IACA,iBAAiB;AAAA,IACjB,eAAe;AAAA,EACjB,CAAC;AAGD,MAAI,CAAC,OAAO,OAAO,IAAI,OAAO,YAAY,OAAO,IAAI,WAAW,YAAY,CAAC,IAAI,UAAU;AACzF,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AAEA,QAAM,aAAa,IAAI,eAAe,QAAQ,IAAI,KAAK,IAAI,UAAU,IAAI,oBAAI,KAAK;AAClF,QAAM,QAAQ,IAAI,WAAW,aAAa;AAE1C,SAAO;AAAA,IACL;AAAA,IACA,OAAO,QAAQ,OAAO,WAAW,IAAI,MAAM;AAAA,IAC3C,aAAa;AAAA,MACX,IAAI;AAAA,MACJ,QAAQ,IAAI;AAAA,MACZ;AAAA,MACA,YAAY,IAAI;AAAA,IAClB;AAAA,IACA,UAAU,EAAE,IAAI,WAAW;AAAA,EAC7B;AACF;AAEA,eAAsB,kBAAkB,KAAa,YAAmC;AACtF,QAAM;AAAA,IACJ;AAAA,IACA,EAAE,KAAK,iBAAiB,uBAAuB,eAAe,WAAW;AAAA,IACzE;AAAA,EACF;AACF;;;ACxKO,SAAS,cAAc,OAAsC;AAClE,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,IAAI;AACV,SACE,OAAO,EAAE,QAAQ,YACjB,OAAO,EAAE,eAAe,aACvB,EAAE,WAAW,YAAY,EAAE,WAAW,aAAa,EAAE,WAAW,eACjE,OAAO,EAAE,kBAAkB,YAC3B,OAAO,EAAE,iBAAiB,aACzB,EAAE,SAAS,SAAS,EAAE,SAAS,WAChC,OAAO,EAAE,gBAAgB,aACxB,EAAE,cAAc,QAAQ,OAAO,EAAE,cAAc,aAChD,OAAO,EAAE,oBAAoB;AAEjC;;;AFfA,IAAM,2BAA2B,KAAK,KAAK,KAAK;AAChD,IAAM,kBAAkB,IAAI,KAAK,KAAK,KAAK;AAG3C,IAAM,yBAAyB;AAC/B,IAAM,eAAe;AACrB,IAAM,aAAa,KAAK,KAAK;AAa7B,IAAM,UAA6B;AAAA,EACjC,UAAU;AAAA,EACV,aAAa;AAAA,EACb,aAAa;AACf;AAEA,SAAS,iBAAuB;AAC9B,QAAM,MAAM,KAAK,IAAI;AAGrB,MAAI,MAAM,QAAQ,aAAa;AAC7B,UAAM,YAAY,KAAK,MAAM,QAAQ,cAAc,OAAO,GAAK;AAC/D,UAAM,IAAI,MAAM,EAAE,mBAAmB,EAAE,SAAS,UAAU,CAAC,CAAC;AAAA,EAC9D;AAGA,MAAI,MAAM,QAAQ,cAAc,wBAAwB;AACtD,UAAM,IAAI,MAAM,EAAE,cAAc,CAAC;AAAA,EACnC;AACF;AAEA,SAAS,cAAc,SAAwB;AAC7C,QAAM,MAAM,KAAK,IAAI;AACrB,UAAQ,cAAc;AAEtB,MAAI,SAAS;AACX,YAAQ,WAAW;AACnB;AAAA,EACF;AAEA,UAAQ;AACR,MAAI,QAAQ,YAAY,cAAc;AACpC,YAAQ,cAAc,MAAM;AAC5B,YAAQ,WAAW;AAAA,EACrB;AACF;AAaA,IAAM,oBAAoB;AAC1B,IAAM,YAAY;AAElB,IAAI,cAA6B;AAEjC,eAAe,sBAAuC;AACpD,MAAI,YAAa,QAAO;AACxB,QAAM,YAAY,MAAM,aAAa;AAErC,QAAM,UAAU,SAAS,UAAU,mBAAmB,WAAW,WAAW,EAAE;AAC9E,gBAAc,OAAO,KAAK,OAAO;AACjC,SAAO;AACT;AAEA,eAAe,mBAAmB,MAA4E;AAC5G,QAAM,MAAM,MAAM,oBAAoB;AACtC,QAAM,KAAK,YAAY,EAAE;AACzB,QAAM,SAAS,eAAe,eAAe,KAAK,EAAE;AAEpD,QAAM,YAAY,KAAK,UAAU,IAAI;AACrC,QAAM,aAAa,OAAO,OAAO,CAAC,OAAO,OAAO,WAAW,OAAO,GAAG,OAAO,MAAM,CAAC,CAAC;AACpF,QAAM,MAAM,OAAO,WAAW;AAE9B,SAAO;AAAA,IACL,WAAW,WAAW,SAAS,QAAQ;AAAA,IACvC,IAAI,GAAG,SAAS,QAAQ;AAAA,IACxB,KAAK,IAAI,SAAS,QAAQ;AAAA,EAC5B;AACF;AAEA,eAAe,mBAAmB,WAAmB,IAAY,KAAmC;AAClG,QAAM,QAAQ,OAAO,KAAK,IAAI,QAAQ;AACtC,QAAM,SAAS,OAAO,KAAK,KAAK,QAAQ;AACxC,QAAM,aAAa,OAAO,KAAK,WAAW,QAAQ;AAQlD,QAAM,MAAM,MAAM,oBAAoB;AACtC,QAAM,WAAW,iBAAiB,eAAe,KAAK,KAAK;AAC3D,WAAS,WAAW,MAAM;AAC1B,QAAM,YAAY,OAAO,OAAO,CAAC,SAAS,OAAO,UAAU,GAAG,SAAS,MAAM,CAAC,CAAC;AAC/E,QAAM,SAAkB,KAAK,MAAM,UAAU,SAAS,OAAO,CAAC;AAC9D,MAAI,CAAC,cAAc,MAAM,GAAG;AAC1B,UAAM,IAAI,MAAM,mDAAmD;AAAA,EACrE;AACA,SAAO;AACT;AAGA,SAAS,cAAc,KAAkC;AACvD,SAAO,OAAO,QAAQ,YAAY,QAAQ,QAAS,IAAgC,YAAY;AACjG;AAEA,SAAS,uBAAuB,KAAmF;AACjH,MAAI,CAAC,cAAc,GAAG,EAAG,QAAO;AAChC,QAAM,SAAS;AACf,SAAO,OAAO,OAAO,cAAc,YAC9B,OAAO,OAAO,OAAO,YACrB,OAAO,OAAO,QAAQ;AAC7B;AAEA,eAAsB,cAA2C;AAC/D,MAAI;AACF,UAAM,MAAM,MAAM,SAAS,cAAc,OAAO;AAChD,UAAM,SAAkB,KAAK,MAAM,GAAG;AAGtC,QAAI,CAAC,cAAc,MAAM,GAAG;AAC1B,YAAM,IAAI,MAAM,6BAA6B;AAAA,IAC/C;AAEA,UAAM,OAAO;AAEb,QAAI,KAAK,YAAY,GAAG;AAEtB,YAAM,IAAI,MAAM,0BAA0B;AAAA,IAC5C;AAGA,QAAI,uBAAuB,IAAI,GAAG;AAChC,YAAM,OAAO,MAAM,mBAAmB,KAAK,WAAY,KAAK,IAAK,KAAK,GAAI;AAO1E,YAAM,aAAa;AACnB,UAAI,WAAW,WAAW;AACxB,cAAM,mBAAmB,MAAM,aAAa;AAI5C,YAAI,OAAO,WAAW,cAAc,YAC7B,WAAW,UAAU,YAAY,MAAM,iBAAiB,YAAY,GAAG;AAC5E,gBAAM,IAAI,MAAM,8CAA8C;AAAA,QAChE;AAAA,MACF;AAEA,aAAO;AAAA,IACT;AAGA,QAAI,KAAK,SAAS;AAChB,YAAM,OAAO,KAAK;AAElB,YAAM,YAAY,IAAI;AACtB,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,YAAY,MAAkC;AAClE,QAAM,eAAe;AACrB,QAAM,EAAE,WAAW,IAAI,IAAI,IAAI,MAAM,mBAAmB,IAAI;AAE5D,QAAM,YAAY,MAAM,aAAa;AACrC,QAAM,OAAgC,EAAE,SAAS,GAAG,WAAW,IAAI,KAAK,UAAU;AAClF,QAAM,UAAU,eAAe;AAC/B,QAAM,UAAU,SAAS,KAAK,UAAU,MAAM,MAAM,CAAC,GAAG,EAAE,UAAU,SAAS,MAAM,IAAM,CAAC;AAC1F,QAAM,OAAO,SAAS,YAAY;AACpC;AAEA,eAAsB,eAA8B;AAClD,MAAI;AACF,UAAM,GAAG,YAAY;AAAA,EACvB,QAAQ;AAAA,EAA2B;AACrC;AAEO,SAAS,UAAU,SAA+B;AACvD,MAAI,CAAC,QAAQ,UAAW,QAAO;AAC/B,QAAM,SAAS,IAAI,KAAK,QAAQ,SAAS,EAAE,QAAQ;AAInD,MAAI,MAAM,MAAM,EAAG,QAAO;AAC1B,SAAO,SAAS,KAAK,IAAI;AAC3B;AAEO,SAAS,kBAAkB,SAA+B;AAC/D,QAAM,gBAAgB,IAAI,KAAK,QAAQ,eAAe,EAAE,QAAQ;AAChE,MAAI,MAAM,aAAa,EAAG,QAAO;AACjC,SAAO,KAAK,IAAI,IAAI,gBAAgB;AACtC;AAEO,SAAS,oBAAoB,SAA+B;AACjE,QAAM,gBAAgB,IAAI,KAAK,QAAQ,eAAe,EAAE,QAAQ;AAChE,MAAI,MAAM,aAAa,EAAG,QAAO;AACjC,SAAO,KAAK,IAAI,IAAI,gBAAgB;AACtC;AAcO,SAAS,oBAAoB,SAAwC;AAC1E,QAAM,gBAAgB,IAAI,KAAK,QAAQ,eAAe,EAAE,QAAQ;AAChE,MAAI,MAAM,aAAa,EAAG,QAAO;AACjC,QAAM,UAAU,KAAK,IAAI,IAAI;AAK7B,MAAI,UAAU,EAAG,QAAO;AACxB,QAAM,OAAO,WAAW,KAAK,KAAK,KAAK;AAEvC,MAAI,QAAQ,EAAG,QAAO;AACtB,MAAI,QAAQ,GAAI,QAAO;AACvB,MAAI,QAAQ,GAAI,QAAO;AACvB,SAAO;AACT;AAGA,SAAS,mBAAmB,KAAmB;AAG7C,MAAI,IAAI,SAAS,MAAM,IAAI,SAAS,KAAK;AACvC,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAC9C;AAEA,MAAI,CAAC,WAAW,KAAK,GAAG,GAAG;AACzB,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAC9C;AACF;AAQA,SAAS,WAAW,KAA6B;AAC/C,QAAM,QAAQ,IAAI,YAAY;AAC9B,SAAO,MAAM,WAAW,SAAS,KAAK,MAAM,WAAW,SAAS,IAAI,SAAS;AAC/E;AAEA,eAAsB,SAAS,KAAmC;AAChE,qBAAmB,GAAG;AACtB,iBAAe;AAEf,MAAI,UAAU;AACd,MAAI;AACF,UAAM,MAAM,MAAM,gBAAY,GAAG;AAEjC,QAAI,CAAC,IAAI,WAAW;AAClB,YAAM,IAAI,MAAM,IAAI,SAAS,mBAAmB;AAAA,IAClD;AAEA,UAAM,UAAuB;AAAA,MAC3B;AAAA,MACA,YAAY,IAAI,SAAS;AAAA,MACzB,QAAQ;AAAA,MACR,eAAe,IAAI,KAAK;AAAA,MACxB,cAAc,IAAI,KAAK;AAAA,MACvB,MAAM,WAAW,GAAG;AAAA,MACpB,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,MACpC,WAAW,IAAI,YAAY;AAAA,MAC3B,kBAAiB,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC1C;AAEA,UAAM,YAAY,OAAO;AACzB,cAAU;AACV,WAAO;AAAA,EACT,UAAE;AACA,kBAAc,OAAO;AAAA,EACvB;AACF;AASA,SAAS,eAAe,KAAuB;AAC7C,QAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,SAAO,uEAAuE,KAAK,GAAG;AACxF;AAEA,eAAsB,WAAW,SAAmD;AAClF,MAAI;AACF,UAAM,MAAM,MAAM,gBAAY,QAAQ,KAAK,QAAQ,UAAU;AAE7D,QAAI,IAAI,OAAO;AACb,YAAM,UAAuB;AAAA,QAC3B,GAAG;AAAA,QACH,kBAAiB,oBAAI,KAAK,GAAE,YAAY;AAAA,QACxC,QAAQ;AAAA,QACR,WAAW,IAAI,YAAY;AAAA,MAC7B;AACA,YAAM,YAAY,OAAO;AACzB,aAAO;AAAA,IACT;AAEA,UAAM,YAAY,EAAE,GAAG,SAAS,QAAQ,UAAU,CAAC;AACnD,WAAO;AAAA,EACT,SAAS,KAAK;AAEZ,QAAI,eAAe,GAAG,GAAG;AACvB,aAAO,oBAAoB,OAAO,IAAI,UAAU;AAAA,IAClD;AAEA,UAAM,YAAY,EAAE,GAAG,SAAS,QAAQ,UAAU,CAAC;AACnD,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,WAAW,SAA2D;AAI1F,MAAI,gBAAgB;AACpB,MAAI;AACF,UAAM,kBAAc,QAAQ,KAAK,QAAQ,UAAU;AACnD,oBAAgB;AAAA,EAClB,QAAQ;AAAA,EAAwC;AAChD,QAAM,aAAa;AACnB,SAAO,EAAE,cAAc;AACzB;","names":[]}