fluxmail 0.0.1 → 0.2.0

package/dist/licensing/client.d.ts

@@ -0,0 +1,52 @@
+/**
+ * HTTP client for the hosted license server's validate and deactivate
+ * endpoints. The contract of record is docs/license-validation-contract.md in
+ * this repo, implemented by the private license-server repo; request/response
+ * shapes here must match it.
+ */
+export declare const DEFAULT_LICENSE_SERVER_URL = "https://fluxmail.ai";
+export declare const LICENSE_KEY_PATTERN: RegExp;
+export type ValidateOutcome = 
+/** 200: `lease` is the signed token; verify it before trusting anything in it. */
+{
+    kind: 'valid';
+    lease: string;
+}
+/** 400: the server considered the request malformed — a config error to surface. */
+ | {
+    kind: 'invalid_request';
+}
+/** 404: key doesn't exist (typo or deleted). Keep any cached lease until it expires. */
+ | {
+    kind: 'license_not_found';
+}
+/** 403: subscription ended ("canceled" | "revoked" | "expired"). Degrade when the cached lease runs out. */
+ | {
+    kind: 'license_inactive';
+    status: string;
+}
+/** 409: the license is bound to a different instance; deactivate it there first. */
+ | {
+    kind: 'license_in_use';
+}
+/** 5xx, network failure, or an unintelligible response: keep the cached lease and retry later. */
+ | {
+    kind: 'outage';
+    detail: string;
+};
+export interface ValidateOptions {
+    serverUrl: string;
+    licenseKey: string;
+    /** Stable random id per install; the server binds each license to one instance. */
+    instanceId: string;
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+}
+export declare function validateLicense(opts: ValidateOptions): Promise<ValidateOutcome>;
+/**
+ * Best-effort release of this instance's license binding, so the key can be
+ * activated elsewhere. Returns false when the server could not be reached or
+ * declined; callers proceed with local deactivation either way.
+ */
+export declare function releaseLicense(opts: ValidateOptions): Promise<boolean>;
+//# sourceMappingURL=client.d.ts.map

package/dist/licensing/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/licensing/client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,eAAO,MAAM,0BAA0B,wBAAwB,CAAC;AAEhE,eAAO,MAAM,mBAAmB,QAAgC,CAAC;AAEjE,MAAM,MAAM,eAAe;AACzB,kFAAkF;AAChF;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAClC,oFAAoF;GAClF;IAAE,IAAI,EAAE,iBAAiB,CAAA;CAAE;AAC7B,wFAAwF;GACtF;IAAE,IAAI,EAAE,mBAAmB,CAAA;CAAE;AAC/B,4GAA4G;GAC1G;IAAE,IAAI,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE;AAC9C,oFAAoF;GAClF;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE;AAC5B,kGAAkG;GAChG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvC,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,eAAe,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CA6CrF;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAc5E"}

package/dist/licensing/client.js

@@ -0,0 +1,75 @@
+/**
+ * HTTP client for the hosted license server's validate and deactivate
+ * endpoints. The contract of record is docs/license-validation-contract.md in
+ * this repo, implemented by the private license-server repo; request/response
+ * shapes here must match it.
+ */
+export const DEFAULT_LICENSE_SERVER_URL = 'https://fluxmail.ai';
+export const LICENSE_KEY_PATTERN = /^fluxmail_lic_[0-9a-f]{40}$/;
+export async function validateLicense(opts) {
+    const doFetch = opts.fetchImpl ?? fetch;
+    const url = `${opts.serverUrl.replace(/\/+$/, '')}/api/v1/licenses/validate`;
+    let response;
+    try {
+        response = await doFetch(url, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ licenseKey: opts.licenseKey, instanceId: opts.instanceId }),
+            signal: AbortSignal.timeout(opts.timeoutMs ?? 10_000),
+        });
+    }
+    catch (err) {
+        return { kind: 'outage', detail: err instanceof Error ? err.message : String(err) };
+    }
+    let body;
+    try {
+        body = await response.json();
+    }
+    catch {
+        body = undefined;
+    }
+    const field = (name) => typeof body === 'object' && body !== null ? body[name] : undefined;
+    switch (response.status) {
+        case 200: {
+            const lease = field('lease');
+            if (typeof lease !== 'string' || !lease) {
+                return { kind: 'outage', detail: 'validation response is missing the lease token' };
+            }
+            return { kind: 'valid', lease };
+        }
+        case 400:
+            return { kind: 'invalid_request' };
+        case 404:
+            return { kind: 'license_not_found' };
+        case 403: {
+            const status = field('status');
+            return { kind: 'license_inactive', status: typeof status === 'string' ? status : 'inactive' };
+        }
+        case 409:
+            return { kind: 'license_in_use' };
+        default:
+            return { kind: 'outage', detail: `license server returned HTTP ${response.status}` };
+    }
+}
+/**
+ * Best-effort release of this instance's license binding, so the key can be
+ * activated elsewhere. Returns false when the server could not be reached or
+ * declined; callers proceed with local deactivation either way.
+ */
+export async function releaseLicense(opts) {
+    const doFetch = opts.fetchImpl ?? fetch;
+    const url = `${opts.serverUrl.replace(/\/+$/, '')}/api/v1/licenses/deactivate`;
+    try {
+        const response = await doFetch(url, {
+            method: 'POST',
+            headers: { 'content-type': 'application/json' },
+            body: JSON.stringify({ licenseKey: opts.licenseKey, instanceId: opts.instanceId }),
+            signal: AbortSignal.timeout(opts.timeoutMs ?? 10_000),
+        });
+        return response.ok;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/licensing/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/licensing/client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,0BAA0B,GAAG,qBAAqB,CAAC;AAEhE,MAAM,CAAC,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;AAyBjE,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAqB;IACzD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,2BAA2B,CAAC;IAC7E,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAC5B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;YAClF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;IACtF,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,GAAG,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAW,EAAE,CACtC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAE,IAAgC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAElG,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAC;QACxB,KAAK,GAAG,CAAC,CAAC,CAAC;YACT,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC;YAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;gBACxC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,gDAAgD,EAAE,CAAC;YACtF,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAClC,CAAC;QACD,KAAK,GAAG;YACN,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;QACrC,KAAK,GAAG;YACN,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC;QACvC,KAAK,GAAG,CAAC,CAAC,CAAC;YACT,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC/B,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,MAAM,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;QAChG,CAAC;QACD,KAAK,GAAG;YACN,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;QACpC;YACE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,gCAAgC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IACzF,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAqB;IACxD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,6BAA6B,CAAC;IAC/E,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YAClC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;YAClF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;SACtD,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,EAAE,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/licensing/entitlements.d.ts

@@ -0,0 +1,55 @@
+import { type FluxmailDb } from '../storage/db.js';
+/** After a lease expires, paid limits are honored this much longer before the plan lapses. */
+export declare const GRACE_PERIOD_MS: number;
+export interface Entitlements {
+    /** 'personal' when unlicensed, otherwise the plan name from the signed lease. */
+    plan: string;
+    /** True while a lease grants paid limits (including the grace period). */
+    licensed: boolean;
+    /** True when the lease has expired but the grace period is still running. */
+    inGrace: boolean;
+    maxMembers: number;
+    maxAccounts: number;
+    /** Licensed only: when the lease expires (or expired) and the grace period starts. */
+    leaseExpiresAt?: string;
+    /** In grace only: when paid limits lapse to the Personal plan unless renewed. */
+    graceUntil?: string;
+}
+export declare const PERSONAL_TIER: Entitlements;
+/** Accepts a transaction as well as the root db, like the other storage helpers. */
+type DbReader = Pick<FluxmailDb, 'select'>;
+export declare function readLeaseRow(db: DbReader): {
+    token: string;
+    updatedAt: number;
+} | undefined;
+export declare function saveLeaseToken(db: Pick<FluxmailDb, 'insert'>, token: string): void;
+export declare function clearLease(db: Pick<FluxmailDb, 'delete'>): void;
+/**
+ * Effective entitlements: the plan and caps from the cached lease while it
+ * verifies against a pinned license-server key, Personal-plan limits otherwise.
+ * An expired lease keeps its paid limits through the grace period, so a
+ * renewal hiccup never interrupts a running server. Reads only local state;
+ * enforcement never waits on the network.
+ */
+export declare function getEntitlements(db: DbReader, now?: Date): Entitlements;
+export declare function assertAccountLimit(current: number, entitlements: Entitlements): void;
+export declare function assertMemberLimit(current: number, entitlements: Entitlements): void;
+export interface LicenseState {
+    entitlements: Entitlements;
+    accountCount: number;
+    memberCount: number;
+    /** Usage exceeds the entitled caps; only possible after a paid license lapsed. */
+    overQuota: boolean;
+    /** Renewal warning while in grace or after a lapse; undefined when all is well. */
+    warning?: string;
+}
+/** Entitlements plus current usage, for quota enforcement and renewal warnings. */
+export declare function checkLicenseState(db: DbReader, now?: Date): LicenseState;
+/**
+ * Gate for MCP tool calls: throws once a lapsed license leaves the instance
+ * over the entitled caps. Returns the current state so callers can surface
+ * grace warnings without a second read.
+ */
+export declare function assertWithinQuota(db: DbReader, now?: Date): LicenseState;
+export {};
+//# sourceMappingURL=entitlements.d.ts.map

package/dist/licensing/entitlements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlements.d.ts","sourceRoot":"","sources":["../../src/licensing/entitlements.ts"],"names":[],"mappings":"AAEA,OAAO,EAAmC,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGpF,8FAA8F;AAC9F,eAAO,MAAM,eAAe,QAA2B,CAAC;AAExD,MAAM,WAAW,YAAY;IAC3B,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,QAAQ,EAAE,OAAO,CAAC;IAClB,6EAA6E;IAC7E,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,sFAAsF;IACtF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,aAAa,EAAE,YAM3B,CAAC;AAIF,oFAAoF;AACpF,KAAK,QAAQ,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;AAE3C,wBAAgB,YAAY,CAAC,EAAE,EAAE,QAAQ,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAG3F;AAED,wBAAgB,cAAc,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAMlF;AAED,wBAAgB,UAAU,CAAC,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,GAAG,IAAI,CAE/D;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,OAAa,GAAG,YAAY,CAsB5E;AAcD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,GAAG,IAAI,CAEpF;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,YAAY,GAAG,IAAI,CAEnF;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,YAAY,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,kFAAkF;IAClF,SAAS,EAAE,OAAO,CAAC;IACnB,mFAAmF;IACnF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,mFAAmF;AACnF,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,OAAa,GAAG,YAAY,CAqB9E;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,OAAa,GAAG,YAAY,CAa9E"}

package/dist/licensing/entitlements.js

@@ -0,0 +1,116 @@
+import { EmailError } from '@fluxmail/core';
+import { eq } from 'drizzle-orm';
+import { accounts, licenseLease, members } from '../storage/db.js';
+import { licensePublicKeys, verifyLease } from './lease.js';
+/** After a lease expires, paid limits are honored this much longer before the plan lapses. */
+export const GRACE_PERIOD_MS = 21 * 24 * 60 * 60 * 1000;
+export const PERSONAL_TIER = {
+    plan: 'personal',
+    licensed: false,
+    inGrace: false,
+    maxMembers: 1,
+    maxAccounts: 3,
+};
+const LEASE_ROW_ID = 'current';
+export function readLeaseRow(db) {
+    const row = db.select().from(licenseLease).where(eq(licenseLease.id, LEASE_ROW_ID)).get();
+    return row ? { token: row.token, updatedAt: row.updatedAt } : undefined;
+}
+export function saveLeaseToken(db, token) {
+    const updatedAt = Date.now();
+    db.insert(licenseLease)
+        .values({ id: LEASE_ROW_ID, token, updatedAt })
+        .onConflictDoUpdate({ target: licenseLease.id, set: { token, updatedAt } })
+        .run();
+}
+export function clearLease(db) {
+    db.delete(licenseLease).where(eq(licenseLease.id, LEASE_ROW_ID)).run();
+}
+/**
+ * Effective entitlements: the plan and caps from the cached lease while it
+ * verifies against a pinned license-server key, Personal-plan limits otherwise.
+ * An expired lease keeps its paid limits through the grace period, so a
+ * renewal hiccup never interrupts a running server. Reads only local state;
+ * enforcement never waits on the network.
+ */
+export function getEntitlements(db, now = new Date()) {
+    const row = readLeaseRow(db);
+    if (!row)
+        return PERSONAL_TIER;
+    try {
+        const lease = verifyLease(row.token, licensePublicKeys(), now, { allowExpired: true });
+        const expiresAt = Date.parse(lease.expiresAt);
+        const graceUntil = expiresAt + GRACE_PERIOD_MS;
+        if (now.getTime() >= graceUntil)
+            return PERSONAL_TIER;
+        const inGrace = now.getTime() >= expiresAt;
+        return {
+            plan: lease.plan,
+            licensed: true,
+            inGrace,
+            maxMembers: lease.maxMembers,
+            maxAccounts: lease.maxAccounts,
+            leaseExpiresAt: lease.expiresAt,
+            ...(inGrace ? { graceUntil: new Date(graceUntil).toISOString() } : {}),
+        };
+    }
+    catch {
+        // Unverifiable lease: degrade to Personal-plan limits, never block.
+        return PERSONAL_TIER;
+    }
+}
+function assertLimit(kind, current, max, ent) {
+    if (current < max)
+        return;
+    const noun = `${kind === 'mailbox' ? 'connected mailbox' : 'member'}${max === 1 ? '' : kind === 'mailbox' ? 'es' : 's'}`;
+    throw new EmailError('entitlement_exceeded', ent.licensed
+        ? `Your ${ent.plan} plan allows ${max} ${noun} (currently ${current}). Upgrade your plan to add more.`
+        : `The Personal plan allows ${max} ${noun} (currently ${current}). ` +
+            'A Fluxmail subscription unlocks more; see the README for details.');
+}
+export function assertAccountLimit(current, entitlements) {
+    assertLimit('mailbox', current, entitlements.maxAccounts, entitlements);
+}
+export function assertMemberLimit(current, entitlements) {
+    assertLimit('member', current, entitlements.maxMembers, entitlements);
+}
+/** Entitlements plus current usage, for quota enforcement and renewal warnings. */
+export function checkLicenseState(db, now = new Date()) {
+    const entitlements = getEntitlements(db, now);
+    const accountCount = db.select().from(accounts).all().length;
+    const memberCount = db.select().from(members).all().length;
+    const overQuota = accountCount > entitlements.maxAccounts || memberCount > entitlements.maxMembers;
+    let warning;
+    if (entitlements.inGrace) {
+        warning =
+            `The Fluxmail license expired ${entitlements.leaseExpiresAt}; paid limits continue until ` +
+                `${entitlements.graceUntil}. Renew before then or this instance drops to the Personal plan.`;
+    }
+    else if (!entitlements.licensed && readLeaseRow(db)) {
+        warning =
+            `The Fluxmail license has lapsed; this instance is on the Personal plan ` +
+                `(${entitlements.maxAccounts} mailboxes, ${entitlements.maxMembers} member).` +
+                (overQuota
+                    ? ` Current usage (${accountCount} mailboxes, ${memberCount} members) exceeds that, so email tools are ` +
+                        'blocked until you renew the license or remove mailboxes/members to fit.'
+                    : '');
+    }
+    return { entitlements, accountCount, memberCount, overQuota, ...(warning ? { warning } : {}) };
+}
+/**
+ * Gate for MCP tool calls: throws once a lapsed license leaves the instance
+ * over the entitled caps. Returns the current state so callers can surface
+ * grace warnings without a second read.
+ */
+export function assertWithinQuota(db, now = new Date()) {
+    const state = checkLicenseState(db, now);
+    if (state.overQuota) {
+        const { entitlements: ent } = state;
+        throw new EmailError('entitlement_exceeded', `This instance has ${state.accountCount} connected mailboxes and ${state.memberCount} members, but the ` +
+            `${ent.plan} plan allows ${ent.maxAccounts} and ${ent.maxMembers}. Renew the license ` +
+            '("fluxmail license activate <key>") or remove mailboxes/members ' +
+            '("fluxmail accounts remove", "fluxmail members remove") to fit the plan.');
+    }
+    return state;
+}
+//# sourceMappingURL=entitlements.js.map

package/dist/licensing/entitlements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlements.js","sourceRoot":"","sources":["../../src/licensing/entitlements.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAmB,MAAM,kBAAkB,CAAC;AACpF,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE5D,8FAA8F;AAC9F,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAiBxD,MAAM,CAAC,MAAM,aAAa,GAAiB;IACzC,IAAI,EAAE,UAAU;IAChB,QAAQ,EAAE,KAAK;IACf,OAAO,EAAE,KAAK;IACd,UAAU,EAAE,CAAC;IACb,WAAW,EAAE,CAAC;CACf,CAAC;AAEF,MAAM,YAAY,GAAG,SAAS,CAAC;AAK/B,MAAM,UAAU,YAAY,CAAC,EAAY;IACvC,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAC1F,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,EAA8B,EAAE,KAAa;IAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;SACpB,MAAM,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;SAC9C,kBAAkB,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC;SAC1E,GAAG,EAAE,CAAC;AACX,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,EAA8B;IACvD,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,EAAY,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;IAC5D,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG;QAAE,OAAO,aAAa,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,iBAAiB,EAAE,EAAE,GAAG,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACvF,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,UAAU,GAAG,SAAS,GAAG,eAAe,CAAC;QAC/C,IAAI,GAAG,CAAC,OAAO,EAAE,IAAI,UAAU;YAAE,OAAO,aAAa,CAAC;QACtD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,SAAS,CAAC;QAC3C,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,QAAQ,EAAE,IAAI;YACd,OAAO;YACP,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,cAAc,EAAE,KAAK,CAAC,SAAS;YAC/B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,OAAO,aAAa,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAA0B,EAAE,OAAe,EAAE,GAAW,EAAE,GAAiB;IAC9F,IAAI,OAAO,GAAG,GAAG;QAAE,OAAO;IAC1B,MAAM,IAAI,GAAG,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,QAAQ,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACzH,MAAM,IAAI,UAAU,CAClB,sBAAsB,EACtB,GAAG,CAAC,QAAQ;QACV,CAAC,CAAC,QAAQ,GAAG,CAAC,IAAI,gBAAgB,GAAG,IAAI,IAAI,eAAe,OAAO,mCAAmC;QACtG,CAAC,CAAC,4BAA4B,GAAG,IAAI,IAAI,eAAe,OAAO,KAAK;YAChE,mEAAmE,CAC1E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,YAA0B;IAC5E,WAAW,CAAC,SAAS,EAAE,OAAO,EAAE,YAAY,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,YAA0B;IAC3E,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;AACxE,CAAC;AAYD,mFAAmF;AACnF,MAAM,UAAU,iBAAiB,CAAC,EAAY,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;IAC9D,MAAM,YAAY,GAAG,eAAe,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC9C,MAAM,YAAY,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;IAC7D,MAAM,WAAW,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;IAC3D,MAAM,SAAS,GAAG,YAAY,GAAG,YAAY,CAAC,WAAW,IAAI,WAAW,GAAG,YAAY,CAAC,UAAU,CAAC;IAEnG,IAAI,OAA2B,CAAC;IAChC,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;QACzB,OAAO;YACL,gCAAgC,YAAY,CAAC,cAAc,+BAA+B;gBAC1F,GAAG,YAAY,CAAC,UAAU,kEAAkE,CAAC;IACjG,CAAC;SAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,YAAY,CAAC,EAAE,CAAC,EAAE,CAAC;QACtD,OAAO;YACL,yEAAyE;gBACzE,IAAI,YAAY,CAAC,WAAW,eAAe,YAAY,CAAC,UAAU,WAAW;gBAC7E,CAAC,SAAS;oBACR,CAAC,CAAC,mBAAmB,YAAY,eAAe,WAAW,6CAA6C;wBACtG,yEAAyE;oBAC3E,CAAC,CAAC,EAAE,CAAC,CAAC;IACZ,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACjG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAY,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;IAC9D,MAAM,KAAK,GAAG,iBAAiB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;QACpC,MAAM,IAAI,UAAU,CAClB,sBAAsB,EACtB,qBAAqB,KAAK,CAAC,YAAY,4BAA4B,KAAK,CAAC,WAAW,oBAAoB;YACtG,GAAG,GAAG,CAAC,IAAI,gBAAgB,GAAG,CAAC,WAAW,QAAQ,GAAG,CAAC,UAAU,sBAAsB;YACtF,kEAAkE;YAClE,0EAA0E,CAC7E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/licensing/lease.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Entitlement lease issued by the hosted license server: a detached-signature
+ * token of the form base64url(payloadJSON) + "." + base64url(ed25519 signature).
+ * The signature covers the payload bytes exactly as transmitted, so we verify
+ * before parsing and never re-serialize the JSON.
+ */
+export interface LeasePayload {
+    /** Payload version; this client understands only 2. */
+    v: 2;
+    licenseId: string;
+    /** Lowercase plan name for display ("pro", "team", …); clients never switch on it. */
+    plan: string;
+    /** People who may use this instance. */
+    maxMembers: number;
+    /** Connected mailboxes on this instance. */
+    maxAccounts: number;
+    /** ISO 8601 */
+    issuedAt: string;
+    /** ISO 8601, issuedAt + ~7 days */
+    expiresAt: string;
+}
+/**
+ * License-server signing keys (base64 SPKI DER), pinned at build time.
+ * Rotation: releases ship with both the old and new key pinned; the server
+ * switches its private key once instances have upgraded, then the old pin
+ * is removed.
+ */
+export declare const PINNED_LICENSE_PUBLIC_KEYS: readonly string[];
+/**
+ * Pinned keys plus any keys from FLUXMAIL_LICENSE_PUBLIC_KEYS (comma-separated
+ * base64 SPKI DER), which exists for development and tests. Extra keys are
+ * additive so an env typo can never unpin the production key, and the override
+ * is ignored under NODE_ENV=production (as set by the Docker image) so a stock
+ * production instance trusts only the pinned keys.
+ */
+export declare function licensePublicKeys(): string[];
+/**
+ * Verify a lease token against the accepted public keys and return its payload.
+ * Throws with a human-readable reason on any failure; callers on enforcement
+ * paths catch and fall back to Personal-plan limits. With allowExpired, an
+ * expired-but-authentic lease is returned so the caller can apply the grace
+ * period; signature and shape failures still throw.
+ */
+export declare function verifyLease(token: string, publicKeys: readonly string[], now?: Date, opts?: {
+    allowExpired?: boolean;
+}): LeasePayload;
+//# sourceMappingURL=lease.d.ts.map

package/dist/licensing/lease.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lease.d.ts","sourceRoot":"","sources":["../../src/licensing/lease.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,uDAAuD;IACvD,CAAC,EAAE,CAAC,CAAC;IACL,SAAS,EAAE,MAAM,CAAC;IAClB,sFAAsF;IACtF,IAAI,EAAE,MAAM,CAAC;IACb,wCAAwC;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,mCAAmC;IACnC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,eAAO,MAAM,0BAA0B,EAAE,SAAS,MAAM,EAGvD,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,EAAE,CAS5C;AAYD;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,SAAS,MAAM,EAAE,EAC7B,GAAG,OAAa,EAChB,IAAI,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAO,GACpC,YAAY,CAwDd"}

package/dist/licensing/lease.js

@@ -0,0 +1,103 @@
+import { createPublicKey, verify as verifySignature } from 'node:crypto';
+/**
+ * License-server signing keys (base64 SPKI DER), pinned at build time.
+ * Rotation: releases ship with both the old and new key pinned; the server
+ * switches its private key once instances have upgraded, then the old pin
+ * is removed.
+ */
+export const PINNED_LICENSE_PUBLIC_KEYS = [
+    'MCowBQYDK2VwAyEAoxmkS0uM1qUX6+Jzm3aoTPLFuZ8mcpyiEI3VE1qdM90=',
+    'MCowBQYDK2VwAyEA3ZAEKMPlNE1Ne0bTra438WMvI2Tle+C2aDOOAA8ETWM=',
+];
+/**
+ * Pinned keys plus any keys from FLUXMAIL_LICENSE_PUBLIC_KEYS (comma-separated
+ * base64 SPKI DER), which exists for development and tests. Extra keys are
+ * additive so an env typo can never unpin the production key, and the override
+ * is ignored under NODE_ENV=production (as set by the Docker image) so a stock
+ * production instance trusts only the pinned keys.
+ */
+export function licensePublicKeys() {
+    const extra = process.env.NODE_ENV === 'production' ? undefined : process.env.FLUXMAIL_LICENSE_PUBLIC_KEYS;
+    const fromEnv = extra
+        ? extra
+            .split(',')
+            .map((key) => key.trim())
+            .filter(Boolean)
+        : [];
+    return [...PINNED_LICENSE_PUBLIC_KEYS, ...fromEnv];
+}
+const BASE64URL = /^[A-Za-z0-9_-]+$/;
+function decodePublicKey(base64Spki) {
+    try {
+        return createPublicKey({ key: Buffer.from(base64Spki, 'base64'), format: 'der', type: 'spki' });
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Verify a lease token against the accepted public keys and return its payload.
+ * Throws with a human-readable reason on any failure; callers on enforcement
+ * paths catch and fall back to Personal-plan limits. With allowExpired, an
+ * expired-but-authentic lease is returned so the caller can apply the grace
+ * period; signature and shape failures still throw.
+ */
+export function verifyLease(token, publicKeys, now = new Date(), opts = {}) {
+    const parts = token.split('.');
+    if (parts.length !== 2 || !BASE64URL.test(parts[0]) || !BASE64URL.test(parts[1])) {
+        throw new Error('malformed lease token');
+    }
+    const payloadBytes = Buffer.from(parts[0], 'base64url');
+    const signature = Buffer.from(parts[1], 'base64url');
+    const signed = publicKeys.some((key) => {
+        const publicKey = decodePublicKey(key);
+        if (!publicKey)
+            return false;
+        try {
+            return verifySignature(null, payloadBytes, publicKey, signature);
+        }
+        catch {
+            return false;
+        }
+    });
+    if (!signed) {
+        throw new Error('lease signature does not match any accepted license key');
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(payloadBytes.toString('utf8'));
+    }
+    catch {
+        throw new Error('lease payload is not valid JSON');
+    }
+    if (typeof parsed !== 'object' || parsed === null) {
+        throw new Error('lease payload is not an object');
+    }
+    const payload = parsed;
+    if (payload.v !== 2) {
+        throw new Error(`unsupported lease version ${JSON.stringify(payload.v)}`);
+    }
+    if (typeof payload.licenseId !== 'string' || !payload.licenseId) {
+        throw new Error('lease payload has no licenseId');
+    }
+    if (typeof payload.plan !== 'string' || !payload.plan) {
+        throw new Error('lease payload has no plan');
+    }
+    for (const field of ['maxMembers', 'maxAccounts']) {
+        const value = payload[field];
+        if (typeof value !== 'number' || !Number.isInteger(value) || value < 1) {
+            throw new Error(`lease payload has an invalid ${field}`);
+        }
+    }
+    for (const field of ['issuedAt', 'expiresAt']) {
+        const value = payload[field];
+        if (typeof value !== 'string' || Number.isNaN(Date.parse(value))) {
+            throw new Error(`lease payload has an invalid ${field}`);
+        }
+    }
+    if (!opts.allowExpired && Date.parse(payload.expiresAt) <= now.getTime()) {
+        throw new Error(`lease expired at ${payload.expiresAt}`);
+    }
+    return payload;
+}
+//# sourceMappingURL=lease.js.map

package/dist/licensing/lease.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lease.js","sourceRoot":"","sources":["../../src/licensing/lease.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,IAAI,eAAe,EAAkB,MAAM,aAAa,CAAC;AAwBzF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAsB;IAC3D,8DAA8D;IAC9D,8DAA8D;CAC/D,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC;IAC3G,MAAM,OAAO,GAAG,KAAK;QACnB,CAAC,CAAC,KAAK;aACF,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;aACxB,MAAM,CAAC,OAAO,CAAC;QACpB,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,CAAC,GAAG,0BAA0B,EAAE,GAAG,OAAO,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAErC,SAAS,eAAe,CAAC,UAAkB;IACzC,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAClG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CACzB,KAAa,EACb,UAA6B,EAC7B,GAAG,GAAG,IAAI,IAAI,EAAE,EAChB,OAAmC,EAAE;IAErC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC;IAEtD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;QACrC,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,CAAC,SAAS;YAAE,OAAO,KAAK,CAAC;QAC7B,IAAI,CAAC;YACH,OAAO,eAAe,CAAC,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;QACnE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,OAAO,GAAG,MAAiC,CAAC;IAClD,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IAC/C,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,YAAY,EAAE,aAAa,CAAU,EAAE,CAAC;QAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,gCAAgC,KAAK,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,EAAE,WAAW,CAAU,EAAE,CAAC;QACvD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,gCAAgC,KAAK,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAmB,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,CAAC,SAAmB,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,OAAkC,CAAC;AAC5C,CAAC"}

package/dist/licensing/refresher.d.ts

@@ -0,0 +1,46 @@
+import type { FluxmailConfig } from '../config.js';
+import type { FluxmailDb } from '../storage/db.js';
+import { type LeasePayload } from './lease.js';
+/** Instances revalidate roughly daily; the lease itself is valid for ~7 days. */
+export declare const VALIDATE_INTERVAL_MS: number;
+export type RefreshResult = {
+    outcome: 'refreshed';
+    lease: LeasePayload;
+} | {
+    outcome: 'invalid_key' | 'not_found' | 'inactive' | 'in_use' | 'bad_lease' | 'outage';
+    message: string;
+    /** True while a previously cached lease still grants paid limits. */
+    cachedLeaseActive: boolean;
+};
+/**
+ * Stable random id per install, persisted next to the database. Not a secret;
+ * it lets the license server spot one key shared across many instances.
+ */
+export declare function loadInstanceId(dataDir: string): string;
+export interface RefreshOptions {
+    licenseKey: string;
+    serverUrl: string;
+    dataDir: string;
+    fetchImpl?: typeof fetch;
+}
+/**
+ * Validate the license with the server and cache the returned lease. Every
+ * failure keeps the existing cached lease, per the contract: an outage or a
+ * lapsed subscription degrades to free-tier limits only once the cached lease
+ * expires, and never interrupts a running server.
+ */
+export declare function refreshLicense(db: FluxmailDb, opts: RefreshOptions): Promise<RefreshResult>;
+/**
+ * Background revalidation for long-running server modes: refresh immediately
+ * if the last validation is over a day old, then keep a daily cadence. Timers
+ * are unref'd and every failure path is caught, so licensing can never keep
+ * the process alive or take it down. Returns a stop function.
+ */
+export declare function startLicenseRefresher(deps: {
+    db: FluxmailDb;
+    config: FluxmailConfig;
+    log?: (line: string) => void;
+    /** Notify long-lived services that renewed entitlements are available. */
+    onRefreshed?: () => void;
+}): () => void;
+//# sourceMappingURL=refresher.d.ts.map

package/dist/licensing/refresher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresher.d.ts","sourceRoot":"","sources":["../../src/licensing/refresher.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAAkC,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAG/E,iFAAiF;AACjF,eAAO,MAAM,oBAAoB,QAAsB,CAAC;AAIxD,MAAM,MAAM,aAAa,GACrB;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,YAAY,CAAA;CAAE,GAC7C;IACE,OAAO,EAAE,aAAa,GAAG,WAAW,GAAG,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,QAAQ,CAAC;IACtF,OAAO,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,iBAAiB,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEN;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAStD;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CA4DjG;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,EAAE,EAAE,UAAU,CAAC;IACf,MAAM,EAAE,cAAc,CAAC;IACvB,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,0EAA0E;IAC1E,WAAW,CAAC,EAAE,MAAM,IAAI,CAAC;CAC1B,GAAG,MAAM,IAAI,CAoDb"}