create-windy 0.2.6 → 0.2.8

package/template/packages/license-sdk/src/canonical-json.ts

@@ -1,104 +0,0 @@
-export type CanonicalJsonPrimitive = string | number | boolean | null;
-export type CanonicalJsonValue =
-  | CanonicalJsonPrimitive
-  | CanonicalJsonValue[]
-  | { [key: string]: CanonicalJsonValue };
-
-export type CanonicalJsonErrorCode =
-  | "CANONICAL_JSON_INVALID_TYPE"
-  | "CANONICAL_JSON_INVALID_NUMBER"
-  | "CANONICAL_JSON_INVALID_UNICODE"
-  | "CANONICAL_JSON_CYCLE";
-
-export class CanonicalJsonError extends Error {
-  constructor(
-    readonly code: CanonicalJsonErrorCode,
-    message: string,
-  ) {
-    super(message);
-    this.name = "CanonicalJsonError";
-  }
-}
-
-/**
- * RFC 8785 JSON Canonicalization Scheme (JCS) serializer.
- *
- * V1 intentionally accepts JSON values only: no undefined, BigInt, custom
- * toJSON conversion, non-finite numbers, or unpaired UTF-16 surrogates.
- */
-export function canonicalizeJson(value: unknown): string {
-  return serialize(value, new Set<object>());
-}
-
-function serialize(value: unknown, ancestors: Set<object>): string {
-  if (value === null) return "null";
-  if (typeof value === "boolean") return value ? "true" : "false";
-  if (typeof value === "string") return serializeString(value);
-  if (typeof value === "number") return serializeNumber(value);
-  if (typeof value !== "object") {
-    throw new CanonicalJsonError(
-      "CANONICAL_JSON_INVALID_TYPE",
-      `JCS 不支持 ${typeof value} 值`,
-    );
-  }
-  if (ancestors.has(value)) {
-    throw new CanonicalJsonError("CANONICAL_JSON_CYCLE", "JCS 不支持循环引用");
-  }
-
-  ancestors.add(value);
-  try {
-    if (Array.isArray(value)) {
-      return `[${value.map((item) => serialize(item, ancestors)).join(",")}]`;
-    }
-    const object = value as Record<string, unknown>;
-    const members = Object.keys(object)
-      .sort(compareUtf16)
-      .map(
-        (key) => `${serializeString(key)}:${serialize(object[key], ancestors)}`,
-      );
-    return `{${members.join(",")}}`;
-  } finally {
-    ancestors.delete(value);
-  }
-}
-
-function serializeNumber(value: number): string {
-  if (!Number.isFinite(value)) {
-    throw new CanonicalJsonError(
-      "CANONICAL_JSON_INVALID_NUMBER",
-      "JCS 不支持 NaN 或无穷大",
-    );
-  }
-  return JSON.stringify(value);
-}
-
-function serializeString(value: string): string {
-  assertUnicodeScalarSequence(value);
-  return JSON.stringify(value);
-}
-
-function assertUnicodeScalarSequence(value: string): void {
-  for (let index = 0; index < value.length; index += 1) {
-    const code = value.charCodeAt(index);
-    if (code >= 0xd800 && code <= 0xdbff) {
-      const next = value.charCodeAt(index + 1);
-      if (!Number.isFinite(next) || next < 0xdc00 || next > 0xdfff) {
-        invalidUnicode();
-      }
-      index += 1;
-    } else if (code >= 0xdc00 && code <= 0xdfff) {
-      invalidUnicode();
-    }
-  }
-}
-
-function invalidUnicode(): never {
-  throw new CanonicalJsonError(
-    "CANONICAL_JSON_INVALID_UNICODE",
-    "JCS 不支持未配对的 UTF-16 surrogate",
-  );
-}
-
-function compareUtf16(left: string, right: string): number {
-  return left < right ? -1 : left > right ? 1 : 0;
-}

package/template/packages/license-sdk/src/client.test.ts

@@ -1,82 +0,0 @@
-import { describe, expect, test } from "bun:test";
-import { WindyLicenseClient } from "./client.js";
-import { MemoryAtomicLicenseStore, MemoryLicenseStorage } from "./storage.js";
-import { LICENSE_V1_TEST_VECTOR } from "./v1-test-vector.js";
-
-const vectorLicense = JSON.stringify({
-  formatVersion: 1,
-  algorithm: "ED25519",
-  publicKeyId: LICENSE_V1_TEST_VECTOR.keyId,
-  claims: LICENSE_V1_TEST_VECTOR.claims,
-  signature: LICENSE_V1_TEST_VECTOR.signature,
-});
-
-describe("WindyLicenseClient", () => {
-  test("使用固定向量和多公钥环打开 V1 License", async () => {
-    const client = new WindyLicenseClient({
-      licenseSource: new MemoryAtomicLicenseStore(vectorLicense),
-      stateStorage: new MemoryLicenseStorage(),
-      productCode: "windy-platform",
-      machineCode: "machine-vector-001",
-      publicKeys: {
-        unrelated: LICENSE_V1_TEST_VECTOR.publicKeyPem,
-        [LICENSE_V1_TEST_VECTOR.keyId]: LICENSE_V1_TEST_VECTOR.publicKeyPem,
-      },
-      now: () => new Date("2026-07-10T10:00:00.000Z"),
-    });
-
-    const result = await client.recordOpen();
-
-    expect(result.valid).toBe(true);
-    expect(result.failures).toEqual([]);
-    expect(result.license?.claims.licenseId).toBe("license_vector_v1");
-  });
-
-  test("未知 publicKeyId 时拒绝运行", async () => {
-    const client = new WindyLicenseClient({
-      licenseSource: new MemoryAtomicLicenseStore(vectorLicense),
-      stateStorage: new MemoryLicenseStorage(),
-      productCode: "windy-platform",
-      machineCode: "machine-vector-001",
-      publicKeys: {},
-      now: () => new Date("2026-07-10T10:00:00.000Z"),
-    });
-
-    const result = await client.recordOpen();
-
-    expect(result.valid).toBe(false);
-    expect(result.failures).toEqual(["unknown-public-key"]);
-  });
-
-  test("明显回拨持续暂停，小幅 NTP 偏差不误判且时间恢复后自动恢复", async () => {
-    let now = new Date("2026-07-10T10:00:00.000Z");
-    const state = new MemoryLicenseStorage();
-    const client = new WindyLicenseClient({
-      licenseSource: new MemoryAtomicLicenseStore(vectorLicense),
-      stateStorage: state,
-      productCode: "windy-platform",
-      machineCode: "machine-vector-001",
-      publicKeys: {
-        [LICENSE_V1_TEST_VECTOR.keyId]: LICENSE_V1_TEST_VECTOR.publicKeyPem,
-      },
-      clockToleranceMs: 5 * 60 * 1000,
-      now: () => now,
-    });
-
-    expect((await client.recordOpen()).valid).toBe(true);
-    now = new Date("2026-07-10T09:54:00.000Z");
-    expect((await client.recordOpen()).failures).toContain("clock-rollback");
-    expect(await state.read("last-trusted-at")).toBe(
-      "2026-07-10T10:00:00.000Z",
-    );
-    expect((await client.recordOpen()).failures).toContain("clock-rollback");
-
-    now = new Date("2026-07-10T09:58:00.000Z");
-    const recovered = await client.recordOpen();
-    expect(recovered.valid).toBe(true);
-    expect(recovered.failures).not.toContain("clock-rollback");
-    expect(await state.read("last-trusted-at")).toBe(
-      "2026-07-10T10:00:00.000Z",
-    );
-  });
-});

package/template/packages/license-sdk/src/client.ts

@@ -1,86 +0,0 @@
-import type {
-  LicenseFailureReason,
-  LicenseUsageRecord,
-  SignedLicense,
-} from "@windy/shared";
-import type { LicenseSource, LicenseStorage } from "./storage.js";
-import type { LicensePublicKeySource } from "./verification.js";
-import { parseSignedLicense, validateLicenseDocument } from "./validation.js";
-
-export interface LicenseClientOptions {
-  licenseSource: LicenseSource;
-  stateStorage: LicenseStorage;
-  productCode: string;
-  machineCode: string;
-  publicKeys: LicensePublicKeySource;
-  now?: () => Date;
-  clockToleranceMs?: number;
-}
-
-export interface LicenseOpenResult {
-  valid: boolean;
-  license?: SignedLicense;
-  usage: LicenseUsageRecord;
-  failures: LicenseFailureReason[];
-}
-
-const LAST_TRUSTED_AT_KEY = "last-trusted-at";
-
-export class WindyLicenseClient {
-  private readonly now: () => Date;
-
-  constructor(private readonly options: LicenseClientOptions) {
-    this.now = options.now ?? (() => new Date());
-  }
-
-  async readLicense(): Promise<SignedLicense | undefined> {
-    const rawLicense = await this.options.licenseSource.readCurrent();
-    return rawLicense ? parseSignedLicense(rawLicense) : undefined;
-  }
-
-  async recordOpen(): Promise<LicenseOpenResult> {
-    const openedAt = this.now();
-    const rawLicense = await this.options.licenseSource.readCurrent();
-    const previousOpenedAt =
-      await this.options.stateStorage.read(LAST_TRUSTED_AT_KEY);
-
-    if (!rawLicense) {
-      return {
-        valid: false,
-        failures: ["invalid-format"],
-        usage: {
-          machineCode: this.options.machineCode,
-          openedAt: openedAt.toISOString(),
-          previousOpenedAt,
-          status: "invalid",
-          reason: "invalid-format",
-        },
-      };
-    }
-
-    const result = await validateLicenseDocument(rawLicense, {
-      productCode: this.options.productCode,
-      machineCode: this.options.machineCode,
-      publicKeys: this.options.publicKeys,
-      now: openedAt,
-      lastTrustedAt: previousOpenedAt,
-      clockToleranceMs: this.options.clockToleranceMs,
-    });
-    if (
-      !result.failures.includes("clock-rollback") &&
-      result.nextTrustedAt &&
-      result.nextTrustedAt !== previousOpenedAt
-    ) {
-      await this.options.stateStorage.write(
-        LAST_TRUSTED_AT_KEY,
-        result.nextTrustedAt,
-      );
-    }
-    return {
-      valid: result.valid,
-      license: result.license,
-      failures: result.failures,
-      usage: result.usage,
-    };
-  }
-}

package/template/packages/license-sdk/src/device.ts

@@ -1,46 +0,0 @@
-export interface DeviceCodeParts {
-  hostname?: string;
-  platform?: string;
-  arch?: string;
-  tenant?: string;
-}
-
-export function createDeviceCode(parts: DeviceCodeParts): string {
-  const stableParts = [
-    parts.hostname || "unknown-host",
-    parts.platform || "unknown-platform",
-    parts.arch || "unknown-arch",
-    parts.tenant || "default",
-  ];
-
-  return btoaSafe(stableParts.join("|"));
-}
-
-export function createDeviceQrPayload(machineCode: string): string {
-  return JSON.stringify({
-    type: "windy-device-code",
-    version: 1,
-    machineCode,
-  });
-}
-
-export function readDeviceCodeFromQrPayload(
-  payload: string,
-): string | undefined {
-  try {
-    const parsed = JSON.parse(payload) as { machineCode?: unknown };
-    return typeof parsed.machineCode === "string"
-      ? parsed.machineCode
-      : undefined;
-  } catch {
-    return payload.trim() || undefined;
-  }
-}
-
-function btoaSafe(value: string): string {
-  if (typeof btoa === "function") {
-    return btoa(value);
-  }
-
-  return Buffer.from(value, "utf8").toString("base64");
-}

package/template/packages/license-sdk/src/file-storage.test.ts

@@ -1,80 +0,0 @@
-import { afterEach, describe, expect, test } from "bun:test";
-import { mkdtemp, readdir, rm, writeFile } from "node:fs/promises";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-import { WindyLicenseClient } from "./client.js";
-import {
-  FileSystemAtomicLicenseStore,
-  FixedPathLicenseSource,
-} from "./file-storage.js";
-import { MemoryLicenseStorage } from "./storage.js";
-import { LICENSE_V1_TEST_VECTOR } from "./v1-test-vector.js";
-
-const temporaryDirectories: string[] = [];
-
-afterEach(async () => {
-  await Promise.all(
-    temporaryDirectories
-      .splice(0)
-      .map((directory) => rm(directory, { force: true, recursive: true })),
-  );
-});
-
-describe("filesystem License adapters", () => {
-  test("固定路径挂载复用统一 V1 校验器", async () => {
-    const directory = await temporaryDirectory();
-    const path = join(directory, "runtime", "current.license.json");
-    const store = new FileSystemAtomicLicenseStore(path);
-    await store.replaceCurrentAtomically(
-      JSON.stringify({
-        formatVersion: 1,
-        algorithm: "ED25519",
-        publicKeyId: LICENSE_V1_TEST_VECTOR.keyId,
-        claims: LICENSE_V1_TEST_VECTOR.claims,
-        signature: LICENSE_V1_TEST_VECTOR.signature,
-      }),
-    );
-
-    const client = new WindyLicenseClient({
-      licenseSource: new FixedPathLicenseSource(path),
-      stateStorage: new MemoryLicenseStorage(),
-      productCode: "windy-platform",
-      machineCode: "machine-vector-001",
-      publicKeys: {
-        [LICENSE_V1_TEST_VECTOR.keyId]: LICENSE_V1_TEST_VECTOR.publicKeyPem,
-      },
-      now: () => new Date("2026-07-10T10:00:00.000Z"),
-    });
-
-    await expect(client.recordOpen()).resolves.toMatchObject({
-      valid: true,
-      failures: [],
-    });
-  });
-
-  test("模拟原子提交前崩溃时旧文件保持完整且临时文件被清理", async () => {
-    const directory = await temporaryDirectory();
-    const path = join(directory, "current.license.json");
-    await writeFile(path, '{"license":"old"}', "utf8");
-    const store = new CrashBeforeCommitStore(path);
-
-    await expect(
-      store.replaceCurrentAtomically('{"license":"new"}'),
-    ).rejects.toThrow("模拟进程崩溃");
-
-    await expect(store.readCurrent()).resolves.toBe('{"license":"old"}');
-    expect(await readdir(directory)).toEqual(["current.license.json"]);
-  });
-});
-
-class CrashBeforeCommitStore extends FileSystemAtomicLicenseStore {
-  protected override async beforeCommit(): Promise<void> {
-    throw new Error("模拟进程崩溃");
-  }
-}
-
-async function temporaryDirectory(): Promise<string> {
-  const directory = await mkdtemp(join(tmpdir(), "windy-license-sdk-"));
-  temporaryDirectories.push(directory);
-  return directory;
-}

package/template/packages/license-sdk/src/file-storage.ts

@@ -1,77 +0,0 @@
-import { randomUUID } from "node:crypto";
-import { basename, dirname, join } from "node:path";
-import { mkdir, open, readFile, rename, unlink } from "node:fs/promises";
-import type { AtomicLicenseStore, LicenseSource } from "./storage.js";
-
-export class FixedPathLicenseSource implements LicenseSource {
-  constructor(protected readonly licensePath: string) {}
-
-  async readCurrent(): Promise<string | undefined> {
-    try {
-      return await readFile(this.licensePath, "utf8");
-    } catch (error) {
-      if (isMissingFile(error)) return undefined;
-      throw error;
-    }
-  }
-}
-
-/**
- * Atomic filesystem adapter. Temporary data is synced before the same-directory
- * rename; the directory is synced afterwards so a crash cannot expose a partial file.
- */
-export class FileSystemAtomicLicenseStore
-  extends FixedPathLicenseSource
-  implements AtomicLicenseStore
-{
-  constructor(
-    licensePath: string,
-    private readonly fileMode = 0o600,
-  ) {
-    super(licensePath);
-  }
-
-  async replaceCurrentAtomically(value: string): Promise<void> {
-    const directory = dirname(this.licensePath);
-    const temporaryPath = join(
-      directory,
-      `.${basename(this.licensePath)}.${process.pid}.${randomUUID()}.tmp`,
-    );
-    await mkdir(directory, { recursive: true });
-
-    let temporaryFile: Awaited<ReturnType<typeof open>> | undefined;
-    try {
-      temporaryFile = await open(temporaryPath, "wx", this.fileMode);
-      await temporaryFile.writeFile(value, "utf8");
-      await temporaryFile.sync();
-      await temporaryFile.close();
-      temporaryFile = undefined;
-      await this.beforeCommit();
-      await rename(temporaryPath, this.licensePath);
-      await syncDirectory(directory);
-    } finally {
-      await temporaryFile?.close().catch(() => undefined);
-      await unlink(temporaryPath).catch(() => undefined);
-    }
-  }
-
-  /** Test seam for simulating a process failure before the atomic commit. */
-  protected async beforeCommit(): Promise<void> {}
-}
-
-async function syncDirectory(directory: string): Promise<void> {
-  const handle = await open(directory, "r");
-  try {
-    await handle.sync();
-  } finally {
-    await handle.close();
-  }
-}
-
-function isMissingFile(error: unknown): boolean {
-  return (
-    error instanceof Error &&
-    "code" in error &&
-    (error as NodeJS.ErrnoException).code === "ENOENT"
-  );
-}