vexp-cli 1.3.11 → 2.0.4

package/dist/license.js

@@ -2,12 +2,215 @@ import * as crypto from "crypto";
 import * as fs from "fs";
 import * as path from "path";
 import * as os from "os";
+import { CLI_VERSION } from "./version.js";
 // Ed25519 PUBLIC key (DER, base64) — same key as vexp-vscode/src/license.ts.
 // Only the server (vexp.dev) holds the matching private key.
 const VEXP_LICENSE_PUBLIC_KEY = "MCowBQYDK2VwAyEApwiWYGCyhCaGHAHWn/RTBSGo/1MNmGyZUgSNBQ5YE4g=";
+const VEXP_WEB_ORIGIN = process.env.VEXP_WEB_ORIGIN || "https://vexp.dev";
+// 14-day grace window after the last successful online refresh before we
+// stop trusting the cached freshToken and fall back to the long JWT only.
+const GRACE_MS = 14 * 24 * 60 * 60 * 1000;
+// Opportunistic refresh cadence: don't hit the network more than once per 24h.
+const REFRESH_BACKOFF_MS = 24 * 60 * 60 * 1000;
+// 3 second timeout on validate calls — any slower falls back silently.
+const VALIDATE_TIMEOUT_MS = 3000;
 function getLicensePath() {
     return path.join(os.homedir(), ".vexp", "license.jwt");
 }
+function getFreshTokenPath() {
+    return path.join(os.homedir(), ".vexp", "fresh.jwt");
+}
+function getLastCheckPath() {
+    return path.join(os.homedir(), ".vexp", "last_online_check");
+}
+function getDeviceIdPath() {
+    return path.join(os.homedir(), ".vexp", "device.id");
+}
+/**
+ * Stable anonymous device identifier. First call creates and persists it.
+ * Uses OS hostname + a random salt — no PII, no hardware fingerprinting.
+ */
+function getDeviceId() {
+    const p = getDeviceIdPath();
+    try {
+        const existing = fs.readFileSync(p, "utf-8").trim();
+        if (existing)
+            return existing;
+    }
+    catch {
+        // first run
+    }
+    const raw = `${os.hostname()}::${crypto.randomBytes(16).toString("hex")}`;
+    const id = crypto.createHash("sha256").update(raw).digest("hex").slice(0, 32);
+    try {
+        fs.mkdirSync(path.dirname(p), { recursive: true });
+        fs.writeFileSync(p, id, "utf-8");
+    }
+    catch {
+        // read-only FS: return the ephemeral id, refresh will still work
+    }
+    return id;
+}
+function readLastCheck() {
+    try {
+        const s = fs.readFileSync(getLastCheckPath(), "utf-8").trim();
+        const n = Number(s);
+        return Number.isFinite(n) ? n : 0;
+    }
+    catch {
+        return 0;
+    }
+}
+function writeLastCheck(ts) {
+    try {
+        fs.mkdirSync(path.dirname(getLastCheckPath()), { recursive: true });
+        fs.writeFileSync(getLastCheckPath(), String(ts), "utf-8");
+    }
+    catch {
+        // ignore
+    }
+}
+function loadFreshToken() {
+    try {
+        const jwt = fs.readFileSync(getFreshTokenPath(), "utf-8").trim();
+        if (!jwt)
+            return null;
+        return verifyAndDecode(jwt);
+    }
+    catch {
+        return null;
+    }
+}
+function saveFreshToken(jwt) {
+    try {
+        fs.mkdirSync(path.dirname(getFreshTokenPath()), { recursive: true });
+        fs.writeFileSync(getFreshTokenPath(), jwt, "utf-8");
+    }
+    catch {
+        // ignore
+    }
+}
+function removeFreshToken() {
+    try {
+        fs.unlinkSync(getFreshTokenPath());
+    }
+    catch {
+        // ignore
+    }
+}
+function getDeviceBlockedPath() {
+    return path.join(os.homedir(), ".vexp", "device_blocked.json");
+}
+/** Returns the active device-blocked marker, if any. */
+export function readDeviceBlocked() {
+    try {
+        const raw = fs.readFileSync(getDeviceBlockedPath(), "utf-8");
+        const parsed = JSON.parse(raw);
+        if (parsed &&
+            typeof parsed.at === "number" &&
+            typeof parsed.maxDevices === "number" &&
+            typeof parsed.manageUrl === "string") {
+            return parsed;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+function writeDeviceBlocked(info) {
+    try {
+        fs.mkdirSync(path.dirname(getDeviceBlockedPath()), { recursive: true });
+        fs.writeFileSync(getDeviceBlockedPath(), JSON.stringify(info), "utf-8");
+    }
+    catch {
+        // ignore
+    }
+}
+function clearDeviceBlocked() {
+    try {
+        fs.unlinkSync(getDeviceBlockedPath());
+    }
+    catch {
+        // ignore
+    }
+}
+/**
+ * Opportunistic online license refresh.
+ *
+ * Additive-only: any failure (network, 404, 5xx, timeout, server disabled)
+ * results in a silent no-op. The caller keeps using the local long JWT
+ * exactly as before. This MUST never throw.
+ */
+export async function tryOnlineRefresh(longJwt) {
+    // Rate limit: at most one network call per REFRESH_BACKOFF_MS
+    const last = readLastCheck();
+    if (Date.now() - last < REFRESH_BACKOFF_MS)
+        return;
+    // Global kill switch for users who want to stay fully offline
+    if (process.env.VEXP_OFFLINE === "1")
+        return;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), VALIDATE_TIMEOUT_MS);
+    try {
+        const res = await fetch(`${VEXP_WEB_ORIGIN}/api/license/validate`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({
+                jwt: longJwt,
+                deviceId: getDeviceId(),
+                clientVersion: CLI_VERSION,
+            }),
+            signal: controller.signal,
+        });
+        clearTimeout(timer);
+        // 404 = endpoint not deployed yet (old server), 503 = kill switch
+        if (res.status === 404 || res.status === 503) {
+            return;
+        }
+        if (!res.ok)
+            return;
+        const data = (await res.json());
+        if (data && data.valid && data.freshToken) {
+            // Only save if the freshToken itself verifies locally
+            if (verifyAndDecode(data.freshToken)) {
+                saveFreshToken(data.freshToken);
+                writeLastCheck(Date.now());
+                // Any previous device-blocked state is stale once the server issues
+                // a freshToken for us — we are back in a good state.
+                clearDeviceBlocked();
+            }
+        }
+        else if (data && data.reason === "device_limit_exceeded") {
+            // This machine is over the subscription's device cap. We do NOT touch
+            // the long JWT on disk: the user still owns a valid subscription, they
+            // just need to free a slot on vexp.dev/account/devices. We persist a
+            // marker so the CLI can surface the error next time a command runs.
+            writeDeviceBlocked({
+                at: Date.now(),
+                maxDevices: data.maxDevices ?? 4,
+                manageUrl: data.manageUrl ?? "https://vexp.dev/account/devices",
+            });
+            // Drop any stale freshToken so readLicenseLimits downgrades to FREE
+            // until the user frees a slot and retries.
+            removeFreshToken();
+            writeLastCheck(Date.now());
+        }
+        else if (data && data.revoked) {
+            // Server confirmed revocation. Drop the cached freshToken but keep
+            // the long JWT on disk — the user will fall back to whatever the
+            // long JWT allows until it expires naturally.
+            removeFreshToken();
+            writeLastCheck(Date.now());
+        }
+    }
+    catch {
+        // network error, timeout, abort — silent no-op
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
 function verifyAndDecode(jwt) {
     try {
         const parts = jwt.split(".");
@@ -48,7 +251,7 @@ export function activateLicense(jwt) {
     fs.writeFileSync(licensePath, jwt, "utf-8");
     return claims;
 }
-/** Remove the current license file */
+/** Remove the current license file (and any cached freshToken) */
 export function deactivateLicense() {
     const licensePath = getLicensePath();
     try {
@@ -58,24 +261,17 @@ export function deactivateLicense() {
     catch {
         // ignore
     }
-}
-/** Read license from ~/.vexp/license.jwt, verify, and return tier limits */
-export function readLicenseLimits() {
-    const licensePath = getLicensePath();
-    let jwt;
+    removeFreshToken();
+    clearDeviceBlocked();
     try {
-        jwt = fs.readFileSync(licensePath, "utf-8").trim();
+        if (fs.existsSync(getLastCheckPath()))
+            fs.unlinkSync(getLastCheckPath());
     }
     catch {
-        return FREE_LIMITS;
-    }
-    if (!jwt)
-        return FREE_LIMITS;
-    const claims = verifyAndDecode(jwt);
-    if (!claims || claims.exp * 1000 < Date.now()) {
-        return FREE_LIMITS;
+        // ignore
     }
-    // pe = Stripe period_end (renewal date), fallback to exp (JWT expiry)
+}
+function claimsToLimits(claims) {
     const renewsAt = new Date((claims.pe ?? claims.exp) * 1000);
     switch (claims.plan) {
         case "team":
@@ -86,4 +282,55 @@ export function readLicenseLimits() {
             return FREE_LIMITS;
     }
 }
-//# sourceMappingURL=license.js.map
+/**
+ * Read license from ~/.vexp/license.jwt, verify, and return tier limits.
+ *
+ * Phase 3 online validation is additive:
+ * 1. If a freshToken exists in ~/.vexp/fresh.jwt and is still valid, trust it
+ *    (it was signed by the server during the last successful refresh).
+ * 2. Otherwise, fall back to the long JWT in ~/.vexp/license.jwt exactly as
+ *    before (this is the zero-change path for users who never hit the server).
+ * 3. Fire a background refresh attempt. Any failure is silent — the caller
+ *    never sees a network error.
+ *
+ * The long JWT is NEVER deleted based on server response. The worst a
+ * successful server revoke does is remove the cached freshToken, after
+ * which the long JWT expires naturally at its own `exp`.
+ */
+export function readLicenseLimits() {
+    const licensePath = getLicensePath();
+    let longJwt;
+    try {
+        longJwt = fs.readFileSync(licensePath, "utf-8").trim();
+    }
+    catch {
+        return FREE_LIMITS;
+    }
+    if (!longJwt)
+        return FREE_LIMITS;
+    const longClaims = verifyAndDecode(longJwt);
+    if (!longClaims || longClaims.exp * 1000 < Date.now()) {
+        return FREE_LIMITS;
+    }
+    // Device cap enforcement: if this machine is over-cap, the server told
+    // us to downgrade here until a slot is freed. The long JWT stays on disk
+    // so that once the slot is freed, the next refresh lifts the block.
+    if (readDeviceBlocked()) {
+        return FREE_LIMITS;
+    }
+    // Fire-and-forget opportunistic refresh. Never awaited — we do not block
+    // CLI startup on the network.
+    void tryOnlineRefresh(longJwt);
+    // Prefer a still-valid freshToken within the grace window
+    const fresh = loadFreshToken();
+    if (fresh && fresh.exp * 1000 > Date.now()) {
+        const lastCheck = readLastCheck();
+        if (lastCheck === 0 || Date.now() - lastCheck < GRACE_MS) {
+            return claimsToLimits(fresh);
+        }
+        // freshToken is valid but the last successful refresh is older than the
+        // grace window → server is unreachable for too long. Fall back to the
+        // long JWT (keeps working as today, no downgrade to free).
+    }
+    return claimsToLimits(longClaims);
+}

package/dist/update-check.js

@@ -87,4 +87,3 @@ export async function checkForUpdate() {
         process.exit(1);
     }
 }
-//# sourceMappingURL=update-check.js.map

package/dist/version.js

@@ -2,4 +2,3 @@ import { createRequire } from "module";
 const require = createRequire(import.meta.url);
 const pkg = require("../package.json");
 export const CLI_VERSION = pkg.version || "0.0.0";
-//# sourceMappingURL=version.js.map