whydid 1.0.0

package/dist/db/schema.js

@@ -0,0 +1,186 @@
+export const SCHEMA_SQL = `
+CREATE TABLE IF NOT EXISTS projects (
+  id TEXT PRIMARY KEY,
+  name TEXT NOT NULL,
+  root_path TEXT NOT NULL,
+  git_root TEXT,
+  head_state_id TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS sessions (
+  id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL REFERENCES projects(id),
+  agent TEXT NOT NULL,
+  agent_session_id TEXT,
+  started_at TEXT NOT NULL,
+  ended_at TEXT,
+  metadata_json TEXT
+);
+
+CREATE TABLE IF NOT EXISTS turns (
+  id TEXT PRIMARY KEY,
+  session_id TEXT NOT NULL REFERENCES sessions(id),
+  sequence INTEGER NOT NULL,
+  prompt TEXT,
+  started_at TEXT NOT NULL,
+  ended_at TEXT,
+  status TEXT NOT NULL,
+  metadata_json TEXT,
+  -- 'prompt' (an ordinary real user turn) or 'compact_resume' (a synthetic
+  -- turn Claude Code injects when its own context gets auto-compacted and
+  -- the session continues) — lets a checkpoint be traced back to "this
+  -- happened right after a context compaction" instead of looking ordinary.
+  kind TEXT NOT NULL DEFAULT 'prompt'
+);
+
+CREATE TABLE IF NOT EXISTS states (
+  id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL REFERENCES projects(id),
+  parent_state_id TEXT REFERENCES states(id),
+  session_id TEXT REFERENCES sessions(id),
+  turn_id TEXT REFERENCES turns(id),
+  state_type TEXT NOT NULL,
+  label TEXT,
+  summary TEXT,
+  reason TEXT,
+  decision_notes TEXT,
+  risk_level TEXT,
+  created_at TEXT NOT NULL,
+  git_commit_sha TEXT,
+  working_tree_hash TEXT NOT NULL,
+  milestone_label TEXT
+);
+
+CREATE INDEX IF NOT EXISTS idx_states_project ON states(project_id, created_at);
+
+CREATE TABLE IF NOT EXISTS file_changes (
+  id TEXT PRIMARY KEY,
+  state_id TEXT NOT NULL REFERENCES states(id),
+  file_path TEXT NOT NULL,
+  change_type TEXT NOT NULL,
+  before_hash TEXT,
+  after_hash TEXT,
+  lines_added INTEGER NOT NULL DEFAULT 0,
+  lines_removed INTEGER NOT NULL DEFAULT 0
+);
+
+CREATE INDEX IF NOT EXISTS idx_file_changes_state ON file_changes(state_id);
+
+CREATE TABLE IF NOT EXISTS state_manifest (
+  state_id TEXT NOT NULL REFERENCES states(id),
+  file_path TEXT NOT NULL,
+  content_hash TEXT NOT NULL,
+  size_bytes INTEGER NOT NULL,
+  PRIMARY KEY (state_id, file_path)
+);
+
+CREATE TABLE IF NOT EXISTS snapshots (
+  id TEXT PRIMARY KEY,
+  state_id TEXT NOT NULL REFERENCES states(id),
+  manifest_hash TEXT NOT NULL,
+  created_at TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS annotations (
+  id TEXT PRIMARY KEY,
+  state_id TEXT NOT NULL REFERENCES states(id),
+  summary TEXT,
+  reason TEXT,
+  decisions_json TEXT,
+  risk_level TEXT,
+  generated_by TEXT NOT NULL,
+  model TEXT,
+  status TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  input_tokens INTEGER,
+  output_tokens INTEGER
+);
+
+CREATE TABLE IF NOT EXISTS test_runs (
+  id TEXT PRIMARY KEY,
+  state_id TEXT NOT NULL REFERENCES states(id),
+  command TEXT NOT NULL,
+  status TEXT NOT NULL,
+  exit_code INTEGER,
+  duration_ms INTEGER,
+  output_path TEXT,
+  created_at TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS forks (
+  id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL REFERENCES projects(id),
+  source_state_id TEXT NOT NULL REFERENCES states(id),
+  name TEXT NOT NULL,
+  created_at TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS events (
+  id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL REFERENCES projects(id),
+  type TEXT NOT NULL,
+  timestamp TEXT NOT NULL,
+  payload_json TEXT
+);
+
+CREATE TABLE IF NOT EXISTS context_files (
+  project_id TEXT NOT NULL REFERENCES projects(id),
+  dir_path TEXT NOT NULL,
+  file_path TEXT NOT NULL,
+  checkpoint_count INTEGER NOT NULL,
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (project_id, file_path)
+);
+
+CREATE TABLE IF NOT EXISTS social_posts (
+  id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL REFERENCES projects(id),
+  session_id TEXT NOT NULL REFERENCES sessions(id),
+  platform TEXT NOT NULL,
+  content TEXT NOT NULL,
+  source TEXT NOT NULL,
+  pinned INTEGER NOT NULL DEFAULT 0,
+  created_at TEXT NOT NULL,
+  model TEXT,
+  input_tokens INTEGER,
+  output_tokens INTEGER
+);
+
+CREATE INDEX IF NOT EXISTS idx_social_posts_project ON social_posts(project_id, created_at);
+
+CREATE TABLE IF NOT EXISTS chat_conversations (
+  id TEXT PRIMARY KEY,
+  project_id TEXT NOT NULL REFERENCES projects(id),
+  title TEXT NOT NULL,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_chat_conversations_project ON chat_conversations(project_id, updated_at);
+
+CREATE TABLE IF NOT EXISTS chat_messages (
+  id TEXT PRIMARY KEY,
+  conversation_id TEXT NOT NULL REFERENCES chat_conversations(id),
+  role TEXT NOT NULL,
+  content TEXT NOT NULL,
+  cited_state_ids_json TEXT,
+  model TEXT,
+  input_tokens INTEGER,
+  output_tokens INTEGER,
+  created_at TEXT NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_chat_messages_conversation ON chat_messages(conversation_id, created_at);
+
+-- Full-text index over each annotated state's real content, for the project
+-- chat's grounding/retrieval step. state_id/project_id are UNINDEXED
+-- (retrievable but not tokenized) — only "text" participates in MATCH.
+CREATE VIRTUAL TABLE IF NOT EXISTS annotation_search USING fts5(
+  state_id UNINDEXED,
+  project_id UNINDEXED,
+  text
+);
+`;
+//# sourceMappingURL=schema.js.map

package/dist/git/git.js

@@ -0,0 +1,22 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+async function tryGit(args, cwd) {
+    try {
+        const { stdout } = await execFileAsync("git", args, { cwd });
+        return stdout.trim();
+    }
+    catch {
+        return null;
+    }
+}
+export async function detectGit(projectPath) {
+    const root = await tryGit(["rev-parse", "--show-toplevel"], projectPath);
+    if (!root) {
+        return { isRepo: false, root: null, branch: null, commitSha: null };
+    }
+    const branch = await tryGit(["rev-parse", "--abbrev-ref", "HEAD"], projectPath);
+    const commitSha = await tryGit(["rev-parse", "HEAD"], projectPath);
+    return { isRepo: true, root, branch, commitSha };
+}
+//# sourceMappingURL=git.js.map

package/dist/licensing/config.js

@@ -0,0 +1,28 @@
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { LicenseManager } from "./license-manager.js";
+import { HttpLicenseApiClient } from "./license-client.js";
+import { createLicenseStore } from "./license-store.js";
+import { getMachineId } from "./machine-id.js";
+/**
+ * PLACEHOLDER until license-server's real production keypair is generated
+ * (license-server/scripts/generate-keypair.ts) — replace with the real
+ * public key before this ever ships to a real customer. A build/release
+ * check should refuse to publish while this constant is unchanged; add
+ * that check as part of actual deployment, not covered by this plan.
+ */
+export const PUBLIC_KEY_DER_BASE64 = process.env.WHYDID_LICENSE_PUBLIC_KEY ?? "REPLACE_WITH_REAL_PRODUCTION_PUBLIC_KEY";
+export const LICENSE_API_URL = process.env.WHYDID_LICENSE_API_URL ?? "https://license.whydid.dev";
+export const PRICING_URL = "https://whydid.dev/pricing";
+function globalLicenseDir() {
+    return join(homedir(), ".whydid-license");
+}
+export async function createDefaultLicenseManager() {
+    const machineId = await getMachineId();
+    const store = await createLicenseStore(globalLicenseDir(), machineId);
+    const apiClient = new HttpLicenseApiClient(LICENSE_API_URL);
+    const manager = new LicenseManager(store, apiClient, PUBLIC_KEY_DER_BASE64);
+    await manager.load();
+    return manager;
+}
+//# sourceMappingURL=config.js.map

package/dist/licensing/license-client.js

@@ -0,0 +1,45 @@
+export class LicenseClientError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "LicenseClientError";
+    }
+}
+export class HttpLicenseApiClient {
+    baseUrl;
+    fetchImpl;
+    constructor(baseUrl, fetchImpl = fetch) {
+        this.baseUrl = baseUrl;
+        this.fetchImpl = fetchImpl;
+    }
+    async post(path, body) {
+        let res;
+        try {
+            res = await this.fetchImpl(`${this.baseUrl}${path}`, {
+                method: "POST",
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify(body),
+            });
+        }
+        catch {
+            throw new LicenseClientError("SERVER_UNAVAILABLE", "Could not reach the license server.");
+        }
+        const json = (await res.json());
+        if (!res.ok)
+            throw new LicenseClientError(json.code ?? "SERVER_UNAVAILABLE", json.message ?? `HTTP ${res.status}`);
+        return json;
+    }
+    async activate(licenseKey, machineId, dodoInstanceId) {
+        const body = await this.post("/v1/licenses/activate", dodoInstanceId ? { licenseKey, machineId, dodoInstanceId } : { licenseKey, machineId });
+        return body.signedLicense;
+    }
+    async refresh(licenseKey, machineId, dodoInstanceId) {
+        const body = await this.post("/v1/licenses/refresh", { licenseKey, machineId, dodoInstanceId });
+        return body.signedLicense;
+    }
+    async deactivate(licenseKey, machineId, dodoInstanceId) {
+        await this.post("/v1/licenses/deactivate", { licenseKey, machineId, dodoInstanceId });
+    }
+}
+//# sourceMappingURL=license-client.js.map

package/dist/licensing/license-manager.js

@@ -0,0 +1,89 @@
+import { getMachineId } from "./machine-id.js";
+import { verifySignedLicense } from "./verify-license.js";
+const MS_PER_DAY = 86_400_000;
+/**
+ * The single centralized licensing chokepoint — every other part of the
+ * app (the CLI's entry gate, and anything checking a feature) goes through
+ * this, never a scattered boolean or a raw signed-payload field access.
+ */
+export class LicenseManager {
+    store;
+    apiClient;
+    publicKeyDerBase64;
+    now;
+    cached = null;
+    constructor(store, apiClient, publicKeyDerBase64, now = () => new Date()) {
+        this.store = store;
+        this.apiClient = apiClient;
+        this.publicKeyDerBase64 = publicKeyDerBase64;
+        this.now = now;
+    }
+    /** Must be called once (e.g. at CLI startup) before the synchronous getters below are meaningful. */
+    async load() {
+        const signed = await this.store.load();
+        this.cached = signed ? verifySignedLicense(signed, this.publicKeyDerBase64) : null;
+    }
+    isActivated() {
+        return this.cached !== null;
+    }
+    /** Signature already verified in load(); this only checks the time window. */
+    isValid() {
+        if (!this.cached)
+            return false;
+        const lastValidatedAt = new Date(this.cached.lastValidatedAt).getTime();
+        const nowMs = this.now().getTime();
+        // Clock-rollback guard: the wall clock reporting a time before the last
+        // known validation is treated as suspicious, not trusted to compute a
+        // generous "still within grace" answer.
+        if (nowMs < lastValidatedAt)
+            return false;
+        const windowMs = (this.cached.revalidationDays + this.cached.offlineGraceDays) * MS_PER_DAY;
+        return nowMs - lastValidatedAt <= windowMs;
+    }
+    hasFeature(name) {
+        return this.isValid() && (this.cached?.features.includes(name) ?? false);
+    }
+    needsRefresh() {
+        if (!this.cached)
+            return false;
+        const lastValidatedAt = new Date(this.cached.lastValidatedAt).getTime();
+        const revalidationWindowMs = this.cached.revalidationDays * MS_PER_DAY;
+        return this.now().getTime() - lastValidatedAt > revalidationWindowMs;
+    }
+    getLicense() {
+        return this.cached;
+    }
+    async activate(licenseKey) {
+        const machineId = await getMachineId();
+        const signed = await this.apiClient.activate(licenseKey, machineId, this.cached?.dodoInstanceId);
+        await this.persist(signed);
+    }
+    async deactivate() {
+        if (this.cached) {
+            await this.apiClient.deactivate(this.cached.licenseId, this.cached.machineId, this.cached.dodoInstanceId).catch(() => undefined);
+        }
+        await this.store.clear();
+        this.cached = null;
+    }
+    /** Offline-tolerant by design: a failed refresh (no network) leaves the last-known signed license in place, still valid until the grace period actually runs out. */
+    async refreshIfNeeded() {
+        if (!this.cached || !this.needsRefresh())
+            return;
+        try {
+            const signed = await this.apiClient.refresh(this.cached.licenseId, this.cached.machineId, this.cached.dodoInstanceId);
+            await this.persist(signed);
+        }
+        catch {
+            // Offline or the server is unreachable — keep operating on the
+            // last-known-good signed payload until the grace period expires.
+        }
+    }
+    async persist(signed) {
+        const verified = verifySignedLicense(signed, this.publicKeyDerBase64);
+        if (!verified)
+            throw new Error("License server returned a signature that failed local verification.");
+        await this.store.save(signed);
+        this.cached = verified;
+    }
+}
+//# sourceMappingURL=license-manager.js.map

package/dist/licensing/license-payload.js

@@ -0,0 +1,12 @@
+const FIELD_ORDER = [
+    "licenseId", "dodoInstanceId", "machineId", "product", "plan", "features",
+    "issuedAt", "lastValidatedAt", "validUntil", "revalidationDays", "offlineGraceDays",
+];
+/** Deterministic JSON serialization (fixed key order) so signing and verification always operate on identical bytes regardless of how the payload object was constructed. */
+export function canonicalizePayload(payload) {
+    const ordered = {};
+    for (const key of FIELD_ORDER)
+        ordered[key] = payload[key];
+    return JSON.stringify(ordered);
+}
+//# sourceMappingURL=license-payload.js.map

package/dist/licensing/license-store.js

@@ -0,0 +1,96 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync, chmodSync } from "node:fs";
+import { createCipheriv, createDecipheriv, createHash, randomBytes } from "node:crypto";
+import { dirname, join } from "node:path";
+const SERVICE_NAME = "whydid-license";
+const ACCOUNT_NAME = "license";
+/**
+ * OS keychain (macOS Keychain / Windows Credential Manager / Linux Secret
+ * Service), via @napi-rs/keyring's keytar-compatible API — the maintained
+ * replacement for the archived node-keytar, verified live against this
+ * machine's real Keychain during implementation. Preferred storage — falls
+ * back to EncryptedFileLicenseStore when the native module can't load on
+ * this platform/architecture.
+ */
+export class KeychainLicenseStore {
+    async save(signed) {
+        const { setPassword } = await import("@napi-rs/keyring/keytar.js");
+        await setPassword(SERVICE_NAME, ACCOUNT_NAME, JSON.stringify(signed));
+    }
+    async load() {
+        const { getPassword } = await import("@napi-rs/keyring/keytar.js");
+        const raw = await getPassword(SERVICE_NAME, ACCOUNT_NAME);
+        if (!raw)
+            return null;
+        try {
+            return JSON.parse(raw);
+        }
+        catch {
+            return null;
+        }
+    }
+    async clear() {
+        const { deletePassword } = await import("@napi-rs/keyring/keytar.js");
+        await deletePassword(SERVICE_NAME, ACCOUNT_NAME).catch(() => false);
+    }
+}
+/**
+ * Fallback for platforms/architectures where the native keychain module
+ * can't load. AES-256-GCM-encrypted local file, keyed by material derived
+ * from this machine's own fingerprint — a soft measure ("harder to
+ * casually read than plain JSON"), not real security, exactly as the
+ * design doc frames it.
+ */
+export class EncryptedFileLicenseStore {
+    path;
+    key;
+    constructor(dir, keyMaterial) {
+        this.path = join(dir, "license.enc");
+        this.key = createHash("sha256").update(keyMaterial).digest(); // 32 bytes, fits AES-256
+    }
+    async save(signed) {
+        mkdirSync(dirname(this.path), { recursive: true });
+        const iv = randomBytes(12);
+        const cipher = createCipheriv("aes-256-gcm", this.key, iv);
+        const encrypted = Buffer.concat([cipher.update(JSON.stringify(signed), "utf-8"), cipher.final()]);
+        const authTag = cipher.getAuthTag();
+        const onDisk = { iv: iv.toString("base64"), authTag: authTag.toString("base64"), data: encrypted.toString("base64") };
+        writeFileSync(this.path, JSON.stringify(onDisk), { mode: 0o600 });
+        try {
+            chmodSync(this.path, 0o600);
+        }
+        catch {
+            // best-effort, not fatal
+        }
+    }
+    async load() {
+        if (!existsSync(this.path))
+            return null;
+        try {
+            const onDisk = JSON.parse(readFileSync(this.path, "utf-8"));
+            const decipher = createDecipheriv("aes-256-gcm", this.key, Buffer.from(onDisk.iv, "base64"));
+            decipher.setAuthTag(Buffer.from(onDisk.authTag, "base64"));
+            const decrypted = Buffer.concat([decipher.update(Buffer.from(onDisk.data, "base64")), decipher.final()]);
+            return JSON.parse(decrypted.toString("utf-8"));
+        }
+        catch {
+            // Wrong key material, corrupted file, or tampered ciphertext — fail
+            // closed (treat as "no license stored") rather than throw.
+            return null;
+        }
+    }
+    async clear() {
+        if (existsSync(this.path))
+            unlinkSync(this.path);
+    }
+}
+/** Tries the OS keychain first; falls back to the encrypted file only if the native module genuinely can't load on this platform. */
+export async function createLicenseStore(globalDir, fallbackKeyMaterial) {
+    try {
+        await import("@napi-rs/keyring/keytar.js");
+        return new KeychainLicenseStore();
+    }
+    catch {
+        return new EncryptedFileLicenseStore(globalDir, fallbackKeyMaterial);
+    }
+}
+//# sourceMappingURL=license-store.js.map

package/dist/licensing/machine-id.js

@@ -0,0 +1,78 @@
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { randomUUID, createHash } from "node:crypto";
+import { homedir } from "node:os";
+import { join } from "node:path";
+/**
+ * Not a secret — just namespaces the derived hash so it doesn't
+ * incidentally match another tool's fingerprint of the same machine.
+ */
+const APP_SALT = "whydid-machine-id-v1";
+export function deriveMachineId(rawStableValue) {
+    return createHash("sha256").update(rawStableValue + APP_SALT).digest("hex");
+}
+function globalLicenseDir(customDir) {
+    return customDir ?? join(homedir(), ".whydid-license");
+}
+/** macOS: the hardware UUID, stable across reboots and reinstalls of the OS. */
+function readMacOsHardwareUuid() {
+    try {
+        const output = execFileSync("ioreg", ["-rd1", "-c", "IOPlatformExpertDevice"], { encoding: "utf-8" });
+        const match = output.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/);
+        return match ? match[1] : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Windows: MachineGuid, generated at OS install and stable until a reinstall. */
+function readWindowsMachineGuid() {
+    try {
+        const output = execFileSync("reg", ["query", "HKLM\\SOFTWARE\\Microsoft\\Cryptography", "/v", "MachineGuid"], { encoding: "utf-8" });
+        const match = output.match(/MachineGuid\s+REG_SZ\s+(\S+)/);
+        return match ? match[1] : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Linux: /etc/machine-id (falling back to the dbus copy some distros use instead), a plain file read — no shell-out needed. */
+function readLinuxMachineId() {
+    for (const path of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
+        try {
+            const value = readFileSync(path, "utf-8").trim();
+            if (value)
+                return value;
+        }
+        catch {
+            // try the next path
+        }
+    }
+    return null;
+}
+async function defaultReadOsStableValue() {
+    if (process.platform === "darwin")
+        return readMacOsHardwareUuid();
+    if (process.platform === "win32")
+        return readWindowsMachineGuid();
+    if (process.platform === "linux")
+        return readLinuxMachineId();
+    return null;
+}
+/** Reused when no OS-native identifier is readable at all — weaker (doesn't survive a wiped home directory) but never blocks the customer, matching the design's "don't permanently lock customers out" requirement. */
+function getOrCreatePersistedFallbackId(globalDir) {
+    const path = join(globalDir, "fallback-machine-id");
+    if (existsSync(path))
+        return readFileSync(path, "utf-8").trim();
+    mkdirSync(globalDir, { recursive: true });
+    const id = randomUUID();
+    writeFileSync(path, id, "utf-8");
+    return id;
+}
+export async function getMachineId(options = {}) {
+    const readOsStableValue = options.readOsStableValue ?? defaultReadOsStableValue;
+    const dir = globalLicenseDir(options.globalDir);
+    const raw = (await readOsStableValue()) ?? getOrCreatePersistedFallbackId(dir);
+    return deriveMachineId(raw);
+}
+//# sourceMappingURL=machine-id.js.map

package/dist/licensing/secret-store.js

@@ -0,0 +1,102 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from "node:fs";
+import { dirname, join } from "node:path";
+export class EnvSecretStore {
+    async get(provider) {
+        const envName = `${provider.toUpperCase()}_API_KEY`;
+        return process.env[envName] ?? null;
+    }
+    async set(_provider, _value) {
+        throw new Error("EnvSecretStore is read-only; set the environment variable instead.");
+    }
+    async delete(_provider) {
+        throw new Error("EnvSecretStore is read-only; unset the environment variable instead.");
+    }
+}
+/**
+ * Per-project API keys saved locally instead of (or on top of) a global
+ * environment variable — from the dashboard's Settings page, or
+ * `whydid key set <provider> <key>` in the terminal. Stored in
+ * .whydid/secrets.json, written 0600; `whydid init` already adds .whydid/
+ * to the project's .gitignore, so this never gets committed by accident.
+ *
+ * A key saved this way always wins over a same-provider environment
+ * variable, for this project specifically — that's the point of "instead
+ * of setting it globally": one project can override without touching a
+ * shell profile (or every other project relying on the same global var).
+ */
+export class FileSecretStore {
+    path;
+    constructor(whydidDir) {
+        this.path = join(whydidDir, "secrets.json");
+    }
+    readAll() {
+        if (!existsSync(this.path))
+            return {};
+        try {
+            const parsed = JSON.parse(readFileSync(this.path, "utf-8"));
+            return typeof parsed === "object" && parsed !== null ? parsed : {};
+        }
+        catch {
+            return {};
+        }
+    }
+    writeAll(secrets) {
+        mkdirSync(dirname(this.path), { recursive: true });
+        writeFileSync(this.path, JSON.stringify(secrets, null, 2) + "\n", { mode: 0o600 });
+        try {
+            // writeFileSync's `mode` option only applies on initial creation, not
+            // when overwriting a file that already existed with looser
+            // permissions (e.g. carried over from a backup/sync tool) — force it
+            // on every write instead of just hoping the first write set it.
+            chmodSync(this.path, 0o600);
+        }
+        catch {
+            // Best-effort; not fatal if chmod isn't supported on this filesystem.
+        }
+    }
+    async get(provider) {
+        const stored = this.readAll()[provider];
+        if (stored)
+            return stored;
+        const envName = `${provider.toUpperCase()}_API_KEY`;
+        return process.env[envName] ?? null;
+    }
+    async set(provider, value) {
+        const secrets = this.readAll();
+        secrets[provider] = value;
+        this.writeAll(secrets);
+    }
+    async delete(provider) {
+        const secrets = this.readAll();
+        delete secrets[provider];
+        this.writeAll(secrets);
+    }
+    /** Whether a key is saved on disk for this provider specifically — not counting an environment variable fallback. For "is this saved locally," without ever exposing the value. */
+    hasStoredKey(provider) {
+        return !!this.readAll()[provider];
+    }
+}
+/** The provider ids whydid's own LLM factory knows how to use — see llm/factory.ts. */
+export const KNOWN_AI_PROVIDERS = ["anthropic", "openai"];
+function maskSecretKey(value) {
+    if (value.length <= 8)
+        return "•".repeat(value.length);
+    return `${value.slice(0, 4)}${"•".repeat(6)}${value.slice(-4)}`;
+}
+/**
+ * Status for every known AI provider — shared by the CLI (`whydid key
+ * list`) and the dashboard's Settings page, so the two can never disagree
+ * about which key is active or where it's coming from. Never returns the
+ * raw key itself.
+ */
+export async function getSecretStatuses(store) {
+    const results = [];
+    for (const provider of KNOWN_AI_PROVIDERS) {
+        const storedLocally = store.hasStoredKey(provider);
+        const resolved = await store.get(provider);
+        const source = storedLocally ? "file" : resolved ? "env" : "none";
+        results.push({ provider, configured: resolved !== null, source, masked: resolved ? maskSecretKey(resolved) : null });
+    }
+    return results;
+}
+//# sourceMappingURL=secret-store.js.map

package/dist/licensing/verify-license.js

@@ -0,0 +1,20 @@
+import { verify as cryptoVerify, createPublicKey } from "node:crypto";
+import { canonicalizePayload } from "./license-payload.js";
+/**
+ * Verifies a signed license against the compiled-in public key. Returns the
+ * payload only when the signature is genuine and matches the payload
+ * exactly — returns null (never throws) for a tampered payload, a wrong
+ * keypair, or malformed input, so callers always get a clean yes/no rather
+ * than having to guard against exceptions from crypto internals.
+ */
+export function verifySignedLicense(signed, publicKeyDerBase64) {
+    try {
+        const publicKey = createPublicKey({ key: Buffer.from(publicKeyDerBase64, "base64"), format: "der", type: "spki" });
+        const ok = cryptoVerify(null, Buffer.from(canonicalizePayload(signed.payload)), publicKey, Buffer.from(signed.signature, "base64"));
+        return ok ? signed.payload : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=verify-license.js.map