sourcecode 1.31.30__tar.gz → 1.31.32__tar.gz

{sourcecode-1.31.30 → sourcecode-1.31.32}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sourcecode
-Version: 1.31.30
+Version: 1.31.32
 Summary: Deterministic codebase context for AI coding agents
 License:                                  Apache License
                                    Version 2.0, January 2004
@@ -225,7 +225,7 @@ Description-Content-Type: text/markdown
 
 **AI-ready change intelligence for Java/Spring enterprise monoliths.**
 
-![Version](https://img.shields.io/badge/version-1.31.30-blue)
+![Version](https://img.shields.io/badge/version-1.31.32-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -263,7 +263,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.31.30
+# sourcecode 1.31.32
 ```
 
 ---

{sourcecode-1.31.30 → sourcecode-1.31.32}/README.md

@@ -2,7 +2,7 @@
 
 **AI-ready change intelligence for Java/Spring enterprise monoliths.**
 
-![Version](https://img.shields.io/badge/version-1.31.30-blue)
+![Version](https://img.shields.io/badge/version-1.31.32-blue)
 ![Python](https://img.shields.io/badge/python-3.10%2B-green)
 
 ---
@@ -40,7 +40,7 @@ pipx install sourcecode
 
 ```bash
 sourcecode version
-# sourcecode 1.31.30
+# sourcecode 1.31.32
 ```
 
 ---

{sourcecode-1.31.30 → sourcecode-1.31.32}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "sourcecode"
-version = "1.31.30"
+version = "1.31.32"
 description = "Deterministic codebase context for AI coding agents"
 readme = "README.md"
 requires-python = ">=3.9"

{sourcecode-1.31.30 → sourcecode-1.31.32}/src/sourcecode/__init__.py

@@ -1,3 +1,3 @@
 """sourcecode — Deterministic codebase context maps for AI coding agents."""
 
-__version__ = "1.31.30"
+__version__ = "1.31.32"

{sourcecode-1.31.30 → sourcecode-1.31.32}/src/sourcecode/cache.py

@@ -469,6 +469,7 @@ def _cas_load_blob(cache_d: Path, blob_hash: str) -> Optional[str]:
     try:
         return gzip.decompress(path.read_bytes()).decode("utf-8")
     except Exception:
+        _safe_unlink(path)  # evict corrupted blob so it doesn't block future reads
         return None
 
 

{sourcecode-1.31.30 → sourcecode-1.31.32}/src/sourcecode/cli.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import hashlib
 import json
+import threading
 import time
 from pathlib import Path
 from typing import Any, Optional, cast
@@ -140,7 +141,7 @@ def _check_pipeline_coherence(sm: "SourceMap") -> list[str]:  # type: ignore[nam
     return issues
 
 _HELP = """\
-Compressed AI-ready context for Java/Spring enterprise codebases.
+Deterministic codebase context for AI coding agents.
 
 [bold]Primary usage:[/bold]
   sourcecode --compact                  high-signal summary (~600-800 tokens)
@@ -171,12 +172,25 @@ _SUBCOMMANDS: frozenset[str] = frozenset(
         "repo-ir", "mcp", "endpoints", "impact",
         # Enterprise workflow commands
         "onboard", "modernize", "fix-bug", "review-pr",
+        # License
+        "activate",
     }
 )
 
-# Mutable container holding the path extracted by _preprocess_argv().
-# Default "." means "current directory" when no path is given.
-_detected_path: list[str] = ["."]
+# Thread-local storage for the path extracted by _preprocess_argv().
+# Using threading.local() prevents concurrent MCP tool calls from clobbering
+# each other's target path (the old module-level list was a shared mutable global).
+_tls = threading.local()
+
+
+def _get_detected_path() -> str:
+    """Return the thread-local detected path, defaulting to '.'."""
+    return _tls.__dict__.get("detected_path", ".")
+
+
+def _set_detected_path(value: str) -> None:
+    """Set the thread-local detected path."""
+    _tls.detected_path = value
 
 
 # Options that take a value token — their next arg must not be treated as a path.
@@ -212,6 +226,7 @@ def _preprocess_args(args: list[str]) -> list[str]:
     """
     result = list(args)
     skip_next = False
+    _path_index: int = -1
     for i, arg in enumerate(result):
         if skip_next:
             skip_next = False
@@ -225,9 +240,11 @@ def _preprocess_args(args: list[str]) -> list[str]:
         if arg in _SUBCOMMANDS:
             return result  # known subcommand — leave for Click to dispatch
         # First genuine positional: treat as repository path
-        _detected_path[0] = arg
-        result.pop(i)
-        return result
+        _set_detected_path(arg)
+        _path_index = i
+        break
+    if _path_index >= 0:
+        result.pop(_path_index)
     return result
 
 
@@ -253,6 +270,35 @@ def _emit_error_json(error: str, message: str, **context: object) -> None:
     _sys.stderr.flush()
 
 
+# H-06: Intercept Click-level UsageError (unknown options, bad args) and emit JSON.
+# Click's default show() writes "Error: No such option: --foo" as plain text.
+# Automation consumers need JSON on stderr regardless of how the error originated.
+try:
+    import click.exceptions as _click_exc
+
+    def _json_click_usage_error_show(self: Any, file: Any = None) -> None:  # type: ignore[override]
+        import json as _je
+        import sys as _jse
+        _code_map = {
+            "NoSuchOption": "invalid_option",
+            "BadOptionUsage": "invalid_option",
+            "BadParameter": "bad_parameter",
+            "MissingParameter": "missing_required",
+            "BadArgumentUsage": "bad_argument",
+        }
+        code = _code_map.get(type(self).__name__, "invalid_option")
+        payload: dict[str, object] = {"error": code, "message": self.format_message()}
+        _opt = getattr(self, "option_name", None) or getattr(self, "param_hint", None)
+        if _opt:
+            payload["flag"] = str(_opt).strip("'\"")
+        _jse.stderr.write(_je.dumps(payload, ensure_ascii=False) + "\n")
+        _jse.stderr.flush()
+
+    _click_exc.UsageError.show = _json_click_usage_error_show  # type: ignore[method-assign]
+except Exception:
+    pass  # click unavailable — plain-text fallback
+
+
 def _copy_to_clipboard(content: str) -> bool:
     """Copy text to system clipboard. Returns True on success, False otherwise (never raises)."""
     import subprocess
@@ -303,7 +349,7 @@ def _get_command_with_preprocessing(typer_instance: Any) -> Any:
     def _cmd_main(args: Optional[list[str]] = None, **kwargs: Any) -> Any:
         if args is not None:
             # CliRunner / programmatic call: preprocess the explicit args list.
-            _detected_path[0] = "."
+            _set_detected_path(".")
             args = _preprocess_args(list(args))
         # args=None → Click reads sys.argv; _preprocess_argv() in main_entry handled it.
         return _orig_cmd_main(args=args, **kwargs)
@@ -332,7 +378,7 @@ app.add_typer(mcp_app, name="mcp")
 def _maybe_ask_consent() -> None:
     """Show first-run consent prompt once, on interactive TTYs only."""
     try:
-        from sourcecode.telemetry.config import has_been_asked, mark_asked, set_enabled
+        from sourcecode.telemetry.config import has_been_asked, set_enabled
         from sourcecode.telemetry.consent import ask_for_consent
         if not has_been_asked():
             enabled = ask_for_consent()
@@ -802,7 +848,7 @@ def main(
     # Path was extracted from argv by _preprocess_argv() before Click ran.
     # FIX-P2-8: preserve original user input in error messages (Windows Git Bash
     # rewrites "/nonexistent" → "C:\Program Files\Git\nonexistent" via Path.resolve()).
-    _raw_path_input = _detected_path[0]
+    _raw_path_input = _get_detected_path()
     target = Path(_raw_path_input).resolve()
     if not target.exists():
         _emit_error_json(
@@ -821,6 +867,7 @@ def main(
 
     # Normalize mode aliases
     _CONTRACT_MODES = frozenset({"contract", "minimal", "standard"})
+    _user_mode_explicit = mode not in ("contract",)  # track if user passed a non-default value
     if mode == "minimal":
         mode = "contract"   # minimal is a documented alias for contract
     elif mode not in _CONTRACT_MODES and mode != "raw":
@@ -841,6 +888,20 @@ def main(
         or docs or semantics or full_metrics or architecture
     )
     if mode in ("contract", "standard") and _legacy_flags_active:
+        if _user_mode_explicit:
+            _overriding_flags = [
+                f for f, v in [
+                    ("--compact", compact), ("--tree", tree),
+                    ("--trace-pipeline", trace_pipeline), ("--docs", docs),
+                    ("--semantics", semantics), ("--full-metrics", full_metrics),
+                    ("--architecture", architecture),
+                ] if v
+            ]
+            typer.echo(
+                f"[warning] --mode {mode} was overridden to raw because legacy flags "
+                f"({', '.join(_overriding_flags)}) require raw output mode.",
+                err=True,
+            )
         mode = "raw"
 
     # Map mode to contract_view depth
@@ -964,7 +1025,7 @@ def main(
                     f"cn={code_notes},mode={mode},"
                     f"ex={_excl_key},depth={effective_depth}"
                 )
-                _core_h = _hashlib.md5(_core_flags_str.encode()).hexdigest()[:8]
+                _core_h = _hashlib.sha256(_core_flags_str.encode()).hexdigest()[:8]
                 _core_key = f"{_git_sha}-{_core_h}"
 
                 # ── View flags: output presentation only (no re-analysis needed) ──
@@ -976,7 +1037,7 @@ def main(
                     f"mn={max_nodes},ge={graph_edges},mi={max_importers},"
                     f"eg={emit_graph}"
                 )
-                _view_h = _hashlib.md5(_view_flags_str.encode()).hexdigest()[:8]
+                _view_h = _hashlib.sha256(_view_flags_str.encode()).hexdigest()[:8]
 
                 # ── Lookup ──────────────────────────────────────────────────────
                 # Step 1: try L1 to obtain the core_hash needed for L2 key
@@ -1930,7 +1991,7 @@ def main(
             if _written_core_hash:
                 if not _view_key:
                     # _view_key not set (L1 was also a miss); compute it now
-                    _wvh = _hashlib.md5(_view_flags_str.encode()).hexdigest()[:8]
+                    _wvh = _hashlib.sha256(_view_flags_str.encode()).hexdigest()[:8]
                     _view_key = f"{_written_core_hash}-{_wvh}"
                 _cache_mod.write_view(
                     target,
@@ -2165,6 +2226,12 @@ def prepare_context_cmd(
         )
         raise typer.Exit(code=1)
 
+    # Pro gate: generate-tests and delta require an active Pro license.
+    _PRO_TASKS: frozenset[str] = frozenset({"generate-tests", "delta"})
+    if task in _PRO_TASKS:
+        from sourcecode.license import require_pro as _require_pro
+        _require_pro(task)
+
     # Validate --format: only "json" and "github-comment" are valid for prepare-context.
     # "yaml" is intentionally NOT supported here (use main command for yaml output).
     # Invalid values must error loudly — silently falling through to JSON is a lie.
@@ -2222,7 +2289,49 @@ def prepare_context_cmd(
             _sys.stderr.flush()
     _t0 = _time.perf_counter()
     try:
-        output = builder.build(task, since=since, symptom=symptom, fast=fast, include_config=include_config, all_gaps=all_gaps)
+        # H-02: apply timeout for generate-tests — large repos can stall indefinitely.
+        # Mirrors SOURCECODE_TESTS_TIMEOUT_MS used by the MCP generate_tests_context tool.
+        if task == "generate-tests" and not fast:
+            import concurrent.futures as _cf
+            import os as _os_gt
+            _timeout_ms = int(_os_gt.environ.get("SOURCECODE_TESTS_TIMEOUT_MS", "30000"))
+            _timeout_s = _timeout_ms / 1000.0
+            _ex = _cf.ThreadPoolExecutor(max_workers=1)
+            _fut = _ex.submit(
+                builder.build, task,
+                since=since, symptom=symptom, fast=fast,
+                include_config=include_config, all_gaps=all_gaps,
+            )
+            _done_set, _nd_set = _cf.wait([_fut], timeout=_timeout_s)
+            _ex.shutdown(wait=False)
+            if _nd_set:
+                import sys as _sys_gt
+                if _sys_gt.stderr.isatty():
+                    _sys_gt.stderr.write(
+                        f"[generate-tests] timeout after {_timeout_ms}ms — returning partial result\n"
+                    )
+                    _sys_gt.stderr.flush()
+                from sourcecode.prepare_context import TaskOutput as _TO
+                output = _TO(
+                    task=task,
+                    goal=TASKS[task].goal,
+                    project_summary=None,
+                    architecture_summary=None,
+                    relevant_files=[],
+                    suspected_areas=[],
+                    improvement_opportunities=[],
+                    test_gaps=[],
+                    key_dependencies=[],
+                    code_notes_summary=None,
+                    limitations=[f"generate-tests timed out after {_timeout_ms}ms"],
+                    truncated=True,
+                    truncated_reason=f"timeout_{_timeout_ms}ms",
+                    confidence="low",
+                )
+            else:
+                output = _fut.result()
+        else:
+            output = builder.build(task, since=since, symptom=symptom, fast=fast, include_config=include_config, all_gaps=all_gaps)
     finally:
         _progress.finish()
     _t_total = (_time.perf_counter() - _t0) * 1000
@@ -2532,6 +2641,19 @@ def prepare_context_cmd(
     if llm_prompt:
         out["llm_prompt"] = builder.render_prompt(output)
 
+    # H-01: fast-mode analysis transparency — consumer must not confuse "not analyzed"
+    # with "analyzed and found nothing". Fields that were never computed are absent or null,
+    # not zero. analysis_mode and skipped_analyzers make the omission explicit.
+    if fast:
+        out["analysis_mode"] = "fast"
+        _skipped: list[str] = ["deep_content_scan"]
+        _spec = TASKS.get(task)
+        if _spec and _spec.enable_code_notes:
+            _skipped.append("code_notes")
+        if task == "generate-tests":
+            _skipped.append("test_gap_discovery")
+        out["skipped_analyzers"] = _skipped
+
     # P0-1: Apply output budget per task — safety net for large repos.
     from sourcecode.output_budget import (
         trim_to_budget as _pc_trim,
@@ -2864,6 +2986,9 @@ def impact_cmd(
       sourcecode impact org.keycloak.services.DefaultKeycloakSession /path/to/keycloak
       sourcecode impact UserService --depth 6 --output impact.json
     """
+    from sourcecode.license import require_pro as _require_pro
+    _require_pro("impact")
+
     import json as _json
     import sys as _sys
 
@@ -2924,9 +3049,11 @@ def impact_cmd(
             if _copy_to_clipboard(output):
                 typer.echo("✓ copied to clipboard", err=True)
 
-    # Non-zero exit when target not found
+    # H-03: resolution=not_found is a valid structured answer, not an infra failure.
+    # Exit 0 so pipelines can parse the JSON without treating it as an error.
+    # Exit 1 is reserved for path-not-found, I/O failures, and real infra errors.
     if result.get("resolution") == "not_found":
-        raise typer.Exit(code=1)
+        raise typer.Exit(code=0)
 
     from sourcecode.mcp_nudge import nudge_mcp_if_needed as _nudge
     _nudge()
@@ -3246,6 +3373,9 @@ def modernize_cmd(
       sourcecode onboard .         — Architecture overview first
       sourcecode impact <target>   — Verify impact before touching a hotspot
     """
+    from sourcecode.license import require_pro as _require_pro
+    _require_pro("modernize")
+
     import json as _json
     import sys as _sys
     from sourcecode.repository_ir import build_repo_ir, find_java_files, apply_ir_size_limits
@@ -3418,6 +3548,24 @@ def modernize_cmd(
 
 # ── version ───────────────────────────────────────────────────────────────────
 
+@app.command("activate")
+def activate_cmd(
+    license_key: str = typer.Argument(..., help="Your Pro license key"),
+) -> None:
+    """Activate a Pro license key.
+
+    \b
+    Validates the key against the license server and writes
+    ~/.sourcecode/license.json.
+
+    \b
+    Examples:
+      sourcecode activate SC-XXXX-XXXX-XXXX
+    """
+    from sourcecode.license import activate_license as _activate
+    _activate(license_key)
+
+
 @app.command("version")
 def version_cmd() -> None:
     """Show version and exit."""
@@ -3471,6 +3619,9 @@ def mcp_serve() -> None:
         }
       }
     """
+    from sourcecode.license import require_pro as _require_pro
+    _require_pro("mcp serve")
+
     import logging
     import sys as _sys
 

{sourcecode-1.31.30 → sourcecode-1.31.32}/src/sourcecode/env_analyzer.py

@@ -478,8 +478,13 @@ class EnvAnalyzer:
         example_files_found: list,
         limitations: list,
         profiles_scanned: list,
+        depth: int = 0,
+        max_depth: int = 12,
     ) -> int:
         """Walk the directory tree accumulating env var findings. Returns spring_candidates count."""
+        if depth >= max_depth:
+            return 0
+
         try:
             entries = sorted(current.iterdir())
         except PermissionError:
@@ -496,7 +501,7 @@ class EnvAnalyzer:
                     continue
                 total_spring_candidates += self._walk(
                     root, entry, findings, example_entries, example_files_found,
-                    limitations, profiles_scanned,
+                    limitations, profiles_scanned, depth + 1, max_depth,
                 )
             elif entry.is_file():
                 rel = entry.relative_to(root).as_posix()

{sourcecode-1.31.30 → sourcecode-1.31.32}/src/sourcecode/git_analyzer.py

@@ -326,6 +326,9 @@ def _parse_uncommitted(output: str) -> "UncommittedChanges":
             continue
         x, y = line[0], line[1]
         filepath = line[3:].strip()
+        # Renamed files: git porcelain v1 produces "old -> new"; keep only the new path.
+        if x == "R" and " -> " in filepath:
+            filepath = filepath.split(" -> ", 1)[1]
         if x == "?" and y == "?":
             untracked.append(filepath)
         else:

sourcecode-1.31.32/src/sourcecode/license.py

@@ -0,0 +1,229 @@
+"""License activation and enforcement for the sourcecode CLI.
+
+Flow:
+  1. Module imported → _init() loads ~/.sourcecode/license.json (if present)
+  2. is_pro set globally (True when plan == "pro")
+  3. Pro commands call require_pro(feature_name) at entry — exits 1 if not Pro
+  4. `sourcecode activate <key>` calls activate_license(key) — validates via
+     Edge Function, writes ~/.sourcecode/license.json, exits 0 on success
+  5. Cached license is re-validated every 24 h (online); network errors keep
+     cached state (offline-first). Server-side invalidity clears cache.
+
+Supabase credentials (baked in; override via env vars for testing):
+  SOURCECODE_SUPABASE_URL      — project Edge Function base URL
+  SOURCECODE_SUPABASE_ANON_KEY — public anon key (not a secret)
+"""
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import Optional
+
+# ---------------------------------------------------------------------------
+# Supabase endpoint config — hardcoded for production; override via env for dev
+# ---------------------------------------------------------------------------
+_SUPABASE_URL: str = os.environ.get(
+    "SOURCECODE_SUPABASE_URL",
+    "https://qkndlmyekvujjdgthtmz.supabase.co",
+)
+_SUPABASE_ANON_KEY: str = os.environ.get(
+    "SOURCECODE_SUPABASE_ANON_KEY",
+    "",  # Set SOURCECODE_SUPABASE_ANON_KEY to your project anon key
+)
+
+_LICENSE_DIR: Path = Path.home() / ".sourcecode"
+_LICENSE_FILE: Path = _LICENSE_DIR / "license.json"
+_CACHE_TTL_SECONDS: int = 86400  # 24 hours
+
+# ---------------------------------------------------------------------------
+# Global license state — loaded once at import time
+# ---------------------------------------------------------------------------
+_license_data: Optional[dict] = None
+is_pro: bool = False
+
+
+def _load_license_file() -> Optional[dict]:
+    """Read ~/.sourcecode/license.json. Returns parsed dict or None."""
+    try:
+        if _LICENSE_FILE.exists():
+            raw = _LICENSE_FILE.read_text(encoding="utf-8")
+            return json.loads(raw)
+    except Exception:
+        pass
+    return None
+
+
+def _call_get_license(license_key: str) -> Optional[dict]:
+    """POST to /get-license edge function. Returns parsed dict or None on network error."""
+    import urllib.error
+    import urllib.request
+
+    if not _SUPABASE_ANON_KEY:
+        return None
+
+    url = f"{_SUPABASE_URL}/functions/v1/get-license"
+    body = json.dumps({"license_key": license_key}).encode("utf-8")
+    req = urllib.request.Request(url, data=body, method="POST")
+    req.add_header("apikey", _SUPABASE_ANON_KEY)
+    req.add_header("Authorization", f"Bearer {_SUPABASE_ANON_KEY}")
+    req.add_header("Content-Type", "application/json")
+    req.add_header("Accept", "application/json")
+
+    try:
+        with urllib.request.urlopen(req, timeout=8) as resp:
+            return json.loads(resp.read().decode("utf-8"))
+    except urllib.error.HTTPError as exc:
+        try:
+            return json.loads(exc.read().decode("utf-8", errors="replace"))
+        except Exception:
+            return {"valid": False, "error": f"HTTP {exc.code}"}
+    except Exception:
+        return None  # Network error — caller decides what to do
+
+
+def _maybe_revalidate() -> None:
+    """Re-validate cached license if stale. Mutates globals; never raises."""
+    global _license_data, is_pro
+
+    if not _license_data:
+        return
+
+    validated_at_str = _license_data.get("validated_at") or _license_data.get("activated_at")
+    if validated_at_str:
+        try:
+            validated_at = datetime.fromisoformat(validated_at_str)
+            if validated_at.tzinfo is None:
+                validated_at = validated_at.replace(tzinfo=timezone.utc)
+            age = (datetime.now(timezone.utc) - validated_at).total_seconds()
+            if age < _CACHE_TTL_SECONDS:
+                return
+        except Exception:
+            pass
+
+    key = _license_data.get("license_key")
+    if not key:
+        return
+
+    result = _call_get_license(key)
+    if result is None:
+        return  # Network error — keep cached data (offline-first)
+
+    if not result.get("valid"):
+        _license_data = None
+        is_pro = False
+        try:
+            if _LICENSE_FILE.exists():
+                _LICENSE_FILE.unlink()
+        except Exception:
+            pass
+        return
+
+    _license_data["plan"] = result.get("plan", "pro")
+    _license_data["features"] = result.get("features", [])
+    _license_data["validated_at"] = datetime.now(timezone.utc).isoformat()
+    is_pro = _license_data.get("plan") == "pro"
+    try:
+        _LICENSE_FILE.write_text(
+            json.dumps(_license_data, indent=2, ensure_ascii=False),
+            encoding="utf-8",
+        )
+    except Exception:
+        pass
+
+
+def _init() -> None:
+    global _license_data, is_pro
+    _license_data = _load_license_file()
+    is_pro = (
+        _license_data is not None
+        and _license_data.get("plan") == "pro"
+    )
+
+
+_init()
+
+
+# ---------------------------------------------------------------------------
+# Enforcement
+# ---------------------------------------------------------------------------
+
+def require_pro(feature_name: str) -> None:
+    """Exit with structured JSON error when not Pro.
+
+    Re-validates stale cached license before gating (once per 24 h, online).
+
+    Example:
+        from sourcecode.license import require_pro
+        require_pro("impact")
+    """
+    if is_pro:
+        _maybe_revalidate()
+
+    if not is_pro:
+        payload = {
+            "error": "pro_required",
+            "feature": feature_name,
+            "message": "Run: sourcecode activate <license_key>",
+        }
+        sys.stdout.write(json.dumps(payload, ensure_ascii=False) + "\n")
+        sys.stdout.flush()
+        sys.exit(1)
+
+
+# ---------------------------------------------------------------------------
+# Activation
+# ---------------------------------------------------------------------------
+
+def activate_license(license_key: str) -> None:
+    """Validate license_key via Edge Function, write ~/.sourcecode/license.json.
+
+    Outputs JSON to stdout; exits 0 on success, 1 on any failure.
+    Never raises — all error paths emit JSON and call sys.exit(1).
+    """
+    if not _SUPABASE_ANON_KEY:
+        _fail("configuration_error", "SOURCECODE_SUPABASE_ANON_KEY not set. Contact support.")
+
+    result = _call_get_license(license_key)
+
+    if result is None:
+        _fail("network_error", "Could not reach license server. Check your internet connection.")
+
+    if not result.get("valid"):
+        _fail("invalid_license", result.get("error", "License key is not valid or subscription is inactive."))
+
+    if result.get("plan") != "pro":
+        _fail("not_pro", "This license is not a Pro license.")
+
+    _LICENSE_DIR.mkdir(parents=True, exist_ok=True)
+    now = datetime.now(timezone.utc).isoformat()
+    data = {
+        "license_key": license_key,
+        "plan": result["plan"],
+        "features": result.get("features", []),
+        "email": result.get("email", ""),
+        "activated_at": now,
+        "validated_at": now,
+    }
+    _LICENSE_FILE.write_text(
+        json.dumps(data, indent=2, ensure_ascii=False),
+        encoding="utf-8",
+    )
+
+    output = {"status": "activated", "plan": "pro", "features": data["features"]}
+    sys.stdout.write(json.dumps(output, ensure_ascii=False) + "\n")
+    sys.stdout.flush()
+
+
+# ---------------------------------------------------------------------------
+# Internal helper
+# ---------------------------------------------------------------------------
+
+def _fail(error: str, message: str) -> None:
+    """Emit JSON error to stdout and exit 1. Never returns."""
+    payload = {"error": error, "message": message}
+    sys.stdout.write(json.dumps(payload, ensure_ascii=False) + "\n")
+    sys.stdout.flush()
+    sys.exit(1)