sitezen-mcp 1.3.0 → 1.4.0

package/dist/beta-keys.js

@@ -0,0 +1,65 @@
+// Self-contained BETA license keys — no server required.
+//
+// A key embeds the tester's name + an expiry date, and is SIGNED with a secret
+// so it can't be forged or date-edited. The MCP verifies the signature and the
+// expiry locally on every run. Generate one per tester with scripts/make-key.mjs.
+//
+// SECURITY NOTE: the secret ships inside the published package, so a determined
+// user could extract it and forge a key. That's acceptable for a trusted-tester
+// beta. When we move to paid, validation moves server-side and the secret never
+// reaches clients.
+import * as crypto from "node:crypto";
+const BETA_SECRET = "9f3c1a7e5b2d8064c1f4a9e7d3b60285f1c8a4e6d7902b3c5a1e0f7b";
+function b64urlEncode(s) {
+    return Buffer.from(s, "utf8").toString("base64")
+        .replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function b64urlDecode(s) {
+    s = s.replace(/-/g, "+").replace(/_/g, "/");
+    while (s.length % 4)
+        s += "=";
+    return Buffer.from(s, "base64").toString("utf8");
+}
+function sign(payloadB64) {
+    return crypto.createHmac("sha256", BETA_SECRET).update(payloadB64).digest("hex").slice(0, 12);
+}
+/** Build a signed beta key valid for `days` days from now. */
+export function buildBetaKey(name, days) {
+    const exp = Date.now() + Math.max(1, days) * 24 * 60 * 60 * 1000;
+    const payload = { n: name, exp, v: 1 };
+    const p = b64urlEncode(JSON.stringify(payload));
+    return "SZ-BETA-" + p + "." + sign(p);
+}
+/** Verify a beta key: signature must match and it must not be expired. */
+export function verifyBetaKey(key) {
+    const k = (key || "").trim();
+    if (!k.startsWith("SZ-BETA-"))
+        return { ok: false, reason: "invalid" };
+    const rest = k.slice("SZ-BETA-".length);
+    const dot = rest.lastIndexOf(".");
+    if (dot < 0)
+        return { ok: false, reason: "invalid" };
+    const p = rest.slice(0, dot);
+    const sig = rest.slice(dot + 1);
+    if (sign(p) !== sig)
+        return { ok: false, reason: "invalid" };
+    let payload;
+    try {
+        payload = JSON.parse(b64urlDecode(p));
+    }
+    catch {
+        return { ok: false, reason: "invalid" };
+    }
+    if (typeof payload.exp !== "number")
+        return { ok: false, reason: "invalid" };
+    if (Date.now() > payload.exp)
+        return { ok: false, reason: "expired", payload };
+    return { ok: true, payload };
+}
+/** Human-readable expiry date for a key (or null if unreadable). */
+export function betaKeyExpiry(key) {
+    const c = verifyBetaKey(key);
+    if (c.payload && typeof c.payload.exp === "number")
+        return new Date(c.payload.exp);
+    return null;
+}

package/dist/errors.js

@@ -21,8 +21,9 @@ export const Errors = {
     noPageName: () => fail("NO_PAGE_NAME", "What should I name this page in WordPress?", "Tell me the page title."),
     noSiteUrl: () => fail("NO_SITE_URL", "I don't know which WordPress site to push to. Please tell me the site URL (e.g. https://example.com).", "Share the site URL."),
     noConnectionKey: (siteUrl) => fail("NO_CONNECTION_KEY", `I don't have a saved SiteZen connection key for ${siteUrl}. Please share the connection key — you can find it in WordPress under SiteZen → Connection.`, "Share the connection key for that site."),
-    noLicenseKey: () => fail("NO_LICENSE_KEY", "No SiteZen license key is set. Visit https://sitezen.io/pricing to grab one (the free plan is enough to start), then paste it into your claude_desktop_config.json as SITEZEN_LICENSE_KEY and restart Claude Desktop.", "Set SITEZEN_LICENSE_KEY in your Claude Desktop config, then restart."),
-    invalidLicense: () => fail("INVALID_LICENSE", "Your SiteZen license key isn't recognised. Check it for typos, or generate a fresh one at https://sitezen.io/dashboard.", "Update SITEZEN_LICENSE_KEY in the config and restart Claude Desktop."),
+    noLicenseKey: () => fail("NO_LICENSE_KEY", "No SiteZen license key is set. Reach out for a beta key, then paste it into your claude_desktop_config.json as SITEZEN_LICENSE_KEY and restart Claude Desktop.", "Set SITEZEN_LICENSE_KEY in your Claude Desktop config, then restart."),
+    invalidLicense: () => fail("INVALID_LICENSE", "Your SiteZen license key isn't recognised. Check it for typos, or reach out to hello@sitezenai.com for a fresh beta key.", "Update SITEZEN_LICENSE_KEY in the config and restart Claude Desktop."),
+    betaExpired: () => fail("BETA_EXPIRED", "Your beta access is over. If you'd like to keep using SiteZen, you can upgrade to a paid plan by reaching out to us at hello@sitezenai.com.", "Tell the user their beta access has ended and to contact hello@sitezenai.com to upgrade. Do not attempt the conversion."),
     limitReachedConversions: (plan, upgradeUrl) => fail("LIMIT_REACHED_CONVERSIONS", `You've used all the conversions in your ${plan} plan. Upgrade at ${upgradeUrl} — your existing converted pages stay live.`, "Upgrade the plan to keep converting."),
     limitReachedSites: (plan, sitesAllowed, upgradeUrl) => fail("LIMIT_REACHED_SITES", `Your ${plan} plan allows ${sitesAllowed} site(s) and you're already at the limit. Disconnect a site you no longer use (disconnect_site), or upgrade at ${upgradeUrl}.`, "Disconnect an existing site or upgrade the plan."),
     noFigmaToken: () => fail("NO_FIGMA_TOKEN", "No Figma access token is set. Generate one at https://www.figma.com/developers/api#access-tokens, then paste it into your claude_desktop_config.json as FIGMA_TOKEN and restart Claude Desktop.", "Set FIGMA_TOKEN in your Claude Desktop config, then restart."),

package/dist/license.js

@@ -12,8 +12,9 @@
 // cache automatically.
 import * as crypto from "node:crypto";
 import { readState, writeState } from "./state.js";
+import { verifyBetaKey } from "./beta-keys.js";
 const CACHE_TTL_MS = 60 * 60 * 1000; // 1 hour
-const UPGRADE_URL = "https://sitezen.io/pricing";
+const UPGRADE_URL = "https://sitezenai.com/pricing";
 function hashKey(key) {
     return crypto.createHash("sha256").update(key.trim()).digest("hex");
 }
@@ -51,54 +52,62 @@ async function callValidateEndpoint(key) {
         return null;
     }
 }
-function stubValidate(key) {
-    // Stub: any non-empty key → UNLIMITED plan while the real dashboard /
-    // LemonSqueezy licensing is still being built. This lets the product be
-    // tested end-to-end (multiple sites, unlimited conversions) without an
-    // artificial Free-plan wall. Replace by setting SITEZEN_LICENSE_API_URL in
-    // env — then the real validate endpoint governs sites/conversions.
-    return {
-        ok: true,
-        plan: "agency",
-        sites_allowed: -1, // -1 → unlimited sites
-        conversions_remaining: -1, // -1 → unlimited conversions
-        upgrade_url: UPGRADE_URL,
-        cached: false,
-    };
-}
 /**
- * Validate the user's license key. Returns null if the env var is missing or
- * the key is empty — caller should surface Errors.noLicenseKey() then.
- * Always cached for 1 hour.
+ * Validate the user's license key.
+ *   - `null`                → no key set (caller shows Errors.noLicenseKey())
+ *   - `{ ok: false, ... }`  → key present but expired / unrecognised
+ *   - `LicenseStatus`       → valid, use the plan/quota
+ *
+ * Two modes:
+ *   1. If SITEZEN_LICENSE_API_URL is set, the real dashboard governs the key
+ *      (cached for 1 hour). This is the future paid path.
+ *   2. Otherwise (today), validation is fully LOCAL against signed BETA keys
+ *      generated by scripts/make-key.mjs — each carries its own expiry, no
+ *      server needed. Random / edited / expired keys are rejected.
  */
 export async function validateLicense(licenseKey) {
     if (!licenseKey || !licenseKey.trim())
         return null;
     const key = licenseKey.trim();
-    // Hit cache first
-    const state = readState();
-    if (state.license_cache && cacheIsFresh(state.license_cache, key)) {
-        return {
-            ok: true,
-            plan: state.license_cache.plan,
-            sites_allowed: state.license_cache.sites_allowed,
-            conversions_remaining: state.license_cache.conversions_remaining,
-            upgrade_url: UPGRADE_URL,
-            cached: true,
+    // ── Paid path: a real license API is configured ──────────────────────
+    if (process.env.SITEZEN_LICENSE_API_URL) {
+        const state = readState();
+        if (state.license_cache && cacheIsFresh(state.license_cache, key)) {
+            return {
+                ok: true,
+                plan: state.license_cache.plan,
+                sites_allowed: state.license_cache.sites_allowed,
+                conversions_remaining: state.license_cache.conversions_remaining,
+                upgrade_url: UPGRADE_URL,
+                cached: true,
+            };
+        }
+        const fresh = await callValidateEndpoint(key);
+        if (!fresh)
+            return { ok: false, reason: "invalid" };
+        state.license_cache = {
+            key_hash: hashKey(key),
+            plan: fresh.plan,
+            sites_allowed: fresh.sites_allowed,
+            conversions_remaining: fresh.conversions_remaining,
+            cached_at: new Date().toISOString(),
         };
+        writeState(state);
+        return fresh;
     }
-    // Fresh validation — real endpoint if configured, else stub
-    const fresh = (await callValidateEndpoint(key)) ?? stubValidate(key);
-    // Persist to cache
-    state.license_cache = {
-        key_hash: hashKey(key),
-        plan: fresh.plan,
-        sites_allowed: fresh.sites_allowed,
-        conversions_remaining: fresh.conversions_remaining,
-        cached_at: new Date().toISOString(),
+    // ── Beta path: local signed-key validation (no server) ───────────────
+    const check = verifyBetaKey(key);
+    if (!check.ok)
+        return { ok: false, reason: check.reason };
+    // Valid beta key → unlimited use within its window; expiry is the only gate.
+    return {
+        ok: true,
+        plan: "free",
+        sites_allowed: -1,
+        conversions_remaining: -1,
+        upgrade_url: UPGRADE_URL,
+        cached: false,
     };
-    writeState(state);
-    return fresh;
 }
 /**
  * Decrement the cached conversion count after a successful conversion.

package/dist/tools-session.js

@@ -39,6 +39,8 @@ export function registerSessionTools(server) {
         const license = await validateLicense(process.env.SITEZEN_LICENSE_KEY);
         if (!license)
             return failResult(Errors.noLicenseKey());
+        if (license.ok === false)
+            return failResult(license.reason === "expired" ? Errors.betaExpired() : Errors.invalidLicense());
         const sitesUsed = state.sites.length;
         const canAddMore = license.sites_allowed < 0 || sitesUsed < license.sites_allowed;
         return ok({
@@ -71,6 +73,8 @@ export function registerSessionTools(server) {
         const license = await validateLicense(process.env.SITEZEN_LICENSE_KEY);
         if (!license)
             return failResult(Errors.noLicenseKey());
+        if (license.ok === false)
+            return failResult(license.reason === "expired" ? Errors.betaExpired() : Errors.invalidLicense());
         const state = readState();
         const existing = findSite(state, site_url);
         // Enforce site-count limit when adding a NEW site (re-saving the
@@ -118,6 +122,8 @@ export function registerSessionTools(server) {
         const license = await validateLicense(process.env.SITEZEN_LICENSE_KEY);
         if (!license)
             return failResult(Errors.noLicenseKey());
+        if (license.ok === false)
+            return failResult(license.reason === "expired" ? Errors.betaExpired() : Errors.invalidLicense());
         const state = readState();
         return ok({
             ok: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sitezen-mcp",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "SiteZen MCP server — lets Claude Desktop (or any MCP client) drive a SiteZen-enabled WordPress site directly. No Vercel, no platform API, no API-credit burn for the operator. The end user's Claude subscription pays for LLM tokens.",
   "type": "module",
   "bin": {