vibecarbon 0.1.0

package/src/lib/licensing/tiers.js

@@ -0,0 +1,181 @@
+/**
+ * License tier definitions for Vibecarbon
+ *
+ * Graphite tier: Free local development (no license key needed)
+ * Diamond tier: Full automation for indie hackers & startups
+ * Fullerene tier: Commercial license for agencies & enterprise
+ */
+
+export const TIERS = {
+  graphite: {
+    name: 'Graphite',
+    displayName: 'Vibecarbon Graphite',
+    features: ['local-dev', 'all-addons'],
+    providers: [],
+    maxServers: 0,
+    license: 'MIT',
+    deployFlags: [],
+    // Pricing
+    price: 0,
+    originalPrice: 0,
+    discountPercent: 0,
+    hostingCost: '$0',
+    // Marketing
+    marketingFeatures: [
+      'Create projects',
+      'Local development',
+      'Full Vibecarbon stack',
+      'All add-ons (observability, n8n, metabase, redis, CI/CD)',
+      'Community support',
+    ],
+  },
+  diamond: {
+    name: 'Diamond',
+    displayName: 'Vibecarbon Diamond',
+    features: [
+      'docker-compose',
+      'kubernetes',
+      'autoscaling',
+      'single-vps',
+      'ha',
+      'multi-region',
+      'failover',
+      'advanced-monitoring',
+      'all-addons',
+    ],
+    providers: ['hetzner'],
+    maxServers: Infinity,
+    license: 'AGPL-Exception',
+    deployFlags: ['--ha', '--k8s'],
+    // Pricing
+    price: 149,
+    originalPrice: 299,
+    discountPercent: 50,
+    hostingCost: '~$5-100/mo',
+    badge: 'Lifetime Access',
+    // Marketing
+    marketingFeatures: [
+      'All deployment modes (Compose, Compose HA, Kubernetes)',
+      'Single VPS, HA, or multi-VPS Kubernetes clusters',
+      'Full Vibecarbon stack',
+      'All add-ons (observability, n8n, metabase, redis, CI/CD)',
+      'PostgreSQL streaming replication (HA)',
+      'Advanced monitoring & alerting',
+      'Unlimited servers & projects',
+      'Community support',
+      'Full automation for indie hackers & startups',
+    ],
+  },
+  fullerene: {
+    name: 'Fullerene',
+    displayName: 'Vibecarbon Fullerene',
+    features: [
+      'docker-compose',
+      'kubernetes',
+      'autoscaling',
+      'single-vps',
+      'ha',
+      'multi-region',
+      'failover',
+      'advanced-monitoring',
+      'all-addons',
+      'commercial-use',
+    ],
+    providers: ['hetzner'],
+    maxServers: Infinity,
+    license: 'AGPL-Exception',
+    deployFlags: ['--ha', '--k8s'],
+    // Pricing
+    price: 499,
+    originalPrice: 999,
+    discountPercent: 50,
+    hostingCost: '~$5-100/mo',
+    badge: 'Lifetime Access',
+    // Marketing
+    marketingFeatures: [
+      'Commercial use rights (AGPL exception)',
+      'Deploy for clients & organizations',
+      'All deployment modes (Compose, Compose HA, Kubernetes)',
+      'Full Vibecarbon stack',
+      'All add-ons (observability, n8n, metabase, redis, CI/CD)',
+      'Advanced monitoring & alerting',
+      'Unlimited servers & projects',
+      'Email support',
+      'Commercial license for agencies & enterprise',
+    ],
+  },
+};
+
+/**
+ * Get tier by name
+ * @param {string} tierName - The tier name (graphite, diamond, fullerene)
+ * @returns {object|null} The tier configuration or null if not found
+ */
+export function getTier(tierName) {
+  return TIERS[tierName] || null;
+}
+
+/**
+ * Check if a tier has access to a specific feature
+ * @param {string} tierName - The tier name
+ * @param {string} feature - The feature to check
+ * @returns {boolean} Whether the tier has access to the feature
+ */
+export function hasFeature(tierName, feature) {
+  const tier = getTier(tierName);
+  return tier ? tier.features.includes(feature) : false;
+}
+
+/**
+ * Check if a tier allows a specific deployment flag
+ * @param {string} tierName - The tier name
+ * @param {string} flag - The deployment flag (e.g., '--k8s', '--ha', '--compose')
+ * @returns {boolean} Whether the tier allows the flag
+ */
+export function allowsFlag(tierName, _flag) {
+  // Graphite tier cannot deploy at all
+  if (tierName === 'graphite') {
+    return false;
+  }
+
+  // Diamond and Fullerene allow all deployment flags
+  if (tierName === 'diamond' || tierName === 'fullerene') {
+    return true;
+  }
+
+  return false;
+}
+
+/**
+ * Get the required tier for a deployment flag
+ * @param {string} flag - The deployment flag
+ * @returns {string} The minimum required tier
+ */
+export function getRequiredTier(flag) {
+  // All deployment flags now require only a Diamond (or higher) license
+  void flag;
+  return 'diamond';
+}
+
+/**
+ * Get all tier names
+ * @returns {string[]} Array of tier names
+ */
+export function getTierNames() {
+  return Object.keys(TIERS);
+}
+
+/**
+ * Compare two tiers and return which one is higher
+ * @param {string} tierA - First tier name
+ * @param {string} tierB - Second tier name
+ * @returns {number} -1 if A < B, 0 if equal, 1 if A > B
+ */
+export function compareTiers(tierA, tierB) {
+  const order = { graphite: 0, diamond: 1, fullerene: 2 };
+  const a = order[tierA] ?? -1;
+  const b = order[tierB] ?? -1;
+  if (a < b) return -1;
+  if (a > b) return 1;
+  return 0;
+}

package/src/lib/licensing/validator.js

@@ -0,0 +1,171 @@
+/**
+ * License key validator for Vibecarbon
+ *
+ * Key format:
+ * vc-<tier>-<customer_id>-<signature>
+ *
+ * Example: vc-d-a7f2b9c1-x8kd9mwp2v4n...
+ *
+ * - vc: prefix
+ * - tier: single character — d (Diamond) or f (Fullerene)
+ * - customer_id: 8-character hex identifier
+ * - signature: Ed25519 signature encoded as lowercase hex
+ *
+ * All licenses are lifetime (no expiration).
+ */
+
+import { createPublicKey, verify } from 'node:crypto';
+
+// Licensing is now enabled
+const LICENSING_DISABLED = false;
+
+// Ed25519 public key for license verification (embedded for offline validation)
+const PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAUrn80IKtISxTCpGjc5rf2ZZhhhu+SktK4L2GEWrjT6Q=
+-----END PUBLIC KEY-----`;
+
+// For development/testing - accept any key with valid format
+const DEV_MODE = process.env.VIBECARBON_DEV_LICENSE === 'true';
+
+// Tier character mapping
+const TIER_MAP = { d: 'diamond', f: 'fullerene' };
+
+/**
+ * Parse a license key: vc-<tier>-<customer_id>-<signature>
+ * @param {string} key - The license key string
+ * @returns {object} Parsed key components or error
+ */
+export function parseLicenseKey(key) {
+  if (!key || typeof key !== 'string') {
+    return { valid: false, error: 'License key is required' };
+  }
+
+  const trimmedKey = key.trim().toLowerCase();
+  const parts = trimmedKey.split('-');
+
+  // Must have at least 4 parts: vc, tier, customer_id, signature
+  if (parts.length < 4) {
+    return { valid: false, error: 'Invalid license key format' };
+  }
+
+  const [prefix, tierChar, customerId, ...signatureParts] = parts;
+  const signature = signatureParts.join('-');
+
+  // Validate prefix
+  if (prefix !== 'vc') {
+    return { valid: false, error: 'Invalid license key prefix' };
+  }
+
+  // Validate tier character
+  const tier = TIER_MAP[tierChar];
+  if (!tier) {
+    return { valid: false, error: 'Invalid license tier' };
+  }
+
+  // Validate customer ID (8 hex characters)
+  if (!/^[a-f0-9]{8}$/.test(customerId)) {
+    return { valid: false, error: 'Invalid customer ID format' };
+  }
+
+  // Validate signature exists and has minimum length
+  if (!signature || signature.length < 10) {
+    return { valid: false, error: 'Invalid signature' };
+  }
+
+  return {
+    valid: true,
+    tier,
+    tierChar,
+    customerId,
+    isLifetime: true,
+    signature,
+    originalKey: key.trim(),
+  };
+}
+
+/**
+ * Verify the cryptographic signature of a license key
+ * @param {object} parsedKey - Parsed license key from parseLicenseKey()
+ * @returns {object} Verification result
+ */
+export function verifySignature(parsedKey) {
+  if (!parsedKey.valid) {
+    return { valid: false, error: parsedKey.error };
+  }
+
+  // In development mode, skip signature verification
+  if (DEV_MODE) {
+    return { valid: true, verified: false, devMode: true };
+  }
+
+  try {
+    const publicKey = createPublicKey(PUBLIC_KEY_PEM);
+
+    // Signed message: <tierChar>-<customerId>
+    const message = `${parsedKey.tierChar}-${parsedKey.customerId}`;
+    const signatureBuffer = Buffer.from(parsedKey.signature, 'hex');
+
+    const isValid = verify(null, Buffer.from(message), publicKey, signatureBuffer);
+
+    if (!isValid) {
+      return { valid: false, error: 'Invalid license signature' };
+    }
+
+    return { valid: true, verified: true };
+  } catch (error) {
+    return { valid: false, error: `Signature verification failed: ${error.message}` };
+  }
+}
+
+/**
+ * Validate a complete license key
+ * @param {string} key - The license key string
+ * @returns {object} Complete validation result
+ */
+export function validateLicenseKey(key) {
+  // When licensing is disabled, bypass all validation
+  if (LICENSING_DISABLED) {
+    return {
+      valid: true,
+      tier: 'fullerene',
+      customerId: 'UNLICENSED',
+      isLifetime: true,
+      verified: false,
+      devMode: false,
+      licensingDisabled: true,
+    };
+  }
+
+  // Parse the key
+  const parsed = parseLicenseKey(key);
+  if (!parsed.valid) {
+    return parsed;
+  }
+
+  // Verify signature
+  const signatureResult = verifySignature(parsed);
+  if (!signatureResult.valid) {
+    return signatureResult;
+  }
+
+  return {
+    valid: true,
+    tier: parsed.tier,
+    customerId: parsed.customerId,
+    isLifetime: true,
+    verified: signatureResult.verified,
+    devMode: signatureResult.devMode || false,
+  };
+}
+
+/**
+ * Generate a development license key (for testing only)
+ * @param {string} tier - 'diamond' or 'fullerene'
+ * @returns {string} A development license key
+ */
+export function generateDevLicenseKey(tier = 'fullerene') {
+  const tierChar = tier === 'diamond' ? 'd' : 'f';
+  const customerId = 'de000001'; // 8 hex chars
+  const signature = 'de0e0000000000000000';
+  return `vc-${tierChar}-${customerId}-${signature}`;
+}

package/src/lib/merge-package-json.js

@@ -0,0 +1,90 @@
+/**
+ * Smart package.json merge for upgrades
+ *
+ * Merges the template package.json into the user's existing one:
+ * - Updates versions of shared dependencies (template wins)
+ * - Adds new template dependencies the user doesn't have
+ * - Preserves all user-added dependencies not in the template
+ * - Merges pnpm/npm config sections (overrides, etc.)
+ * - Updates scripts from template, preserves user-added scripts
+ * - Preserves other top-level fields the user may have added
+ */
+
+/**
+ * Deep-merge two plain objects. Source values win for shared keys.
+ * Arrays are replaced, not concatenated.
+ *
+ * @param {Record<string, unknown>} target
+ * @param {Record<string, unknown>} source
+ * @returns {Record<string, unknown>}
+ */
+function deepMerge(target, source) {
+  const result = { ...target };
+  for (const key of Object.keys(source)) {
+    if (
+      source[key] &&
+      typeof source[key] === 'object' &&
+      !Array.isArray(source[key]) &&
+      target[key] &&
+      typeof target[key] === 'object' &&
+      !Array.isArray(target[key])
+    ) {
+      result[key] = deepMerge(target[key], source[key]);
+    } else {
+      result[key] = source[key];
+    }
+  }
+  return result;
+}
+
+/**
+ * Merge dependency maps: update shared deps to template versions, add new ones, keep user extras.
+ *
+ * @param {Record<string, string>} [userDeps]
+ * @param {Record<string, string>} [templateDeps]
+ * @returns {Record<string, string>}
+ */
+function mergeDeps(userDeps, templateDeps) {
+  if (!templateDeps) return userDeps || {};
+  if (!userDeps) return { ...templateDeps };
+
+  const merged = { ...userDeps };
+
+  for (const [pkg, version] of Object.entries(templateDeps)) {
+    // Update existing or add new — template version wins
+    merged[pkg] = version;
+  }
+
+  return merged;
+}
+
+/**
+ * Merge the user's package.json with the template's package.json.
+ *
+ * @param {object} userPkg - The user's current package.json (parsed)
+ * @param {object} templatePkg - The template's package.json (parsed)
+ * @returns {object} - The merged package.json
+ */
+export function mergePackageJson(userPkg, templatePkg) {
+  // Start from the user's package.json to preserve all their fields
+  const merged = { ...userPkg };
+
+  // Update dependencies (template versions win, user extras preserved)
+  merged.dependencies = mergeDeps(userPkg.dependencies, templatePkg.dependencies);
+  merged.devDependencies = mergeDeps(userPkg.devDependencies, templatePkg.devDependencies);
+
+  // Merge scripts: template scripts win, user-added scripts preserved
+  merged.scripts = { ...userPkg.scripts, ...templatePkg.scripts };
+
+  // Merge pnpm config section (overrides, onlyBuiltDependencies, etc.)
+  if (templatePkg.pnpm) {
+    merged.pnpm = deepMerge(userPkg.pnpm || {}, templatePkg.pnpm);
+  }
+
+  // Update these standard fields from template
+  merged.type = templatePkg.type;
+  merged.version = templatePkg.version;
+  merged.private = templatePkg.private;
+
+  return merged;
+}