whydid 1.0.0 → 1.0.1

package/dist/licensing/config.js

@@ -5,13 +5,13 @@ import { HttpLicenseApiClient } from "./license-client.js";
 import { createLicenseStore } from "./license-store.js";
 import { getMachineId } from "./machine-id.js";
 /**
- * PLACEHOLDER until license-server's real production keypair is generated
- * (license-server/scripts/generate-keypair.ts) — replace with the real
- * public key before this ever ships to a real customer. A build/release
- * check should refuse to publish while this constant is unchanged; add
- * that check as part of actual deployment, not covered by this plan.
+ * The real production Ed25519 public key, matching the private key held
+ * only in license-server's deployed .env (LICENSE_ED25519_PRIVATE_KEY) —
+ * generated once via license-server/scripts/generate-keypair.ts. Every
+ * signed license this public key verifies was signed by that exact
+ * deployment; swapping it invalidates every previously-issued license.
  */
-export const PUBLIC_KEY_DER_BASE64 = process.env.WHYDID_LICENSE_PUBLIC_KEY ?? "REPLACE_WITH_REAL_PRODUCTION_PUBLIC_KEY";
+export const PUBLIC_KEY_DER_BASE64 = process.env.WHYDID_LICENSE_PUBLIC_KEY ?? "MCowBQYDK2VwAyEA2CpLqf2+q26q6q1k77bbJZYvQ1otG4E6iY19e+KNogc=";
 export const LICENSE_API_URL = process.env.WHYDID_LICENSE_API_URL ?? "https://license.whydid.dev";
 export const PRICING_URL = "https://whydid.dev/pricing";
 function globalLicenseDir() {

package/dist/licensing/license-store.js

@@ -3,6 +3,24 @@ import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:
 import { dirname, join } from "node:path";
 const SERVICE_NAME = "whydid-license";
 const ACCOUNT_NAME = "license";
+async function loadRealKeytar() {
+    return import("@napi-rs/keyring/keytar.js");
+}
+/**
+ * The OS keychain prompt (e.g. macOS's "wants to use your confidential
+ * information") asks for the user's own Mac login password, not anything
+ * whydid-specific — but denying/canceling it throws a raw native error
+ * ("User canceled the operation.") straight out of @napi-rs/keyring. Left
+ * unwrapped, that string reaches the user verbatim with no context. This
+ * wraps ANY keychain-access failure (denied, canceled, or an unexpected
+ * platform error) in one clear, actionable message.
+ */
+function wrapKeychainError(err) {
+    const raw = err instanceof Error ? err.message : String(err);
+    return new Error(`whydid couldn't access your saved license in the system keychain (${raw}). ` +
+        `This is asking for your Mac's own login password, not a whydid password — ` +
+        `run the command again and click "Allow" (or "Always Allow") when prompted.`);
+}
 /**
  * OS keychain (macOS Keychain / Windows Credential Manager / Linux Secret
  * Service), via @napi-rs/keyring's keytar-compatible API — the maintained
@@ -12,13 +30,28 @@ const ACCOUNT_NAME = "license";
  * this platform/architecture.
  */
 export class KeychainLicenseStore {
+    loadKeytar;
+    constructor(loadKeytar = loadRealKeytar) {
+        this.loadKeytar = loadKeytar;
+    }
     async save(signed) {
-        const { setPassword } = await import("@napi-rs/keyring/keytar.js");
-        await setPassword(SERVICE_NAME, ACCOUNT_NAME, JSON.stringify(signed));
+        const { setPassword } = await this.loadKeytar();
+        try {
+            await setPassword(SERVICE_NAME, ACCOUNT_NAME, JSON.stringify(signed));
+        }
+        catch (err) {
+            throw wrapKeychainError(err);
+        }
     }
     async load() {
-        const { getPassword } = await import("@napi-rs/keyring/keytar.js");
-        const raw = await getPassword(SERVICE_NAME, ACCOUNT_NAME);
+        const { getPassword } = await this.loadKeytar();
+        let raw;
+        try {
+            raw = await getPassword(SERVICE_NAME, ACCOUNT_NAME);
+        }
+        catch (err) {
+            throw wrapKeychainError(err);
+        }
         if (!raw)
             return null;
         try {
@@ -29,7 +62,7 @@ export class KeychainLicenseStore {
         }
     }
     async clear() {
-        const { deletePassword } = await import("@napi-rs/keyring/keytar.js");
+        const { deletePassword } = await this.loadKeytar();
         await deletePassword(SERVICE_NAME, ACCOUNT_NAME).catch(() => false);
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whydid",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "type": "module",
   "license": "UNLICENSED",
   "description": "A local-first AI coding time machine — captures meaningful changes, reasoning, and session context so you can see what happened across your coding sessions, even days later.",