npm install @tourkit/core @tourkit/react

npm install @tourkit/core @tourkit/react @lemonsqueezy/lemonsqueezy.js

// src/app/api/license/validate/route.ts
import { type NextRequest, NextResponse } from 'next/server'

interface LemonSqueezyValidateResponse {
  valid: boolean
  error: string | null
  license_key: {
    id: number
    status: string
    key: string
    activation_limit: number
    activation_usage: number
    created_at: string
    expires_at: string | null
  }
  instance: {
    id: string
    name: string
    created_at: string
  } | null
  meta: {
    store_id: number
    order_id: number
    order_item_id: number
    product_id: number
    product_name: string
    variant_id: number
    variant_name: string
    customer_id: number
    customer_name: string
    customer_email: string
  }
}

export async function POST(request: NextRequest) {
  const { licenseKey, instanceId } = await request.json()

  if (!licenseKey || typeof licenseKey !== 'string') {
    return NextResponse.json(
      { valid: false, error: 'License key is required' },
      { status: 400 }
    )
  }

  const body: Record<string, string> = { license_key: licenseKey }
  if (instanceId) {
    body.instance_id = instanceId
  }

  const response = await fetch(
    'https://api.lemonsqueezy.com/v1/licenses/validate',
    {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify(body),
    }
  )

  const data: LemonSqueezyValidateResponse = await response.json()

  // Only return what the client needs — don't leak customer email or order details
  return NextResponse.json({
    valid: data.valid,
    status: data.license_key?.status,
    productName: data.meta?.product_name,
    expiresAt: data.license_key?.expires_at,
    activationUsage: data.license_key?.activation_usage,
    activationLimit: data.license_key?.activation_limit,
  })
}

// src/app/api/license/activate/route.ts
import { type NextRequest, NextResponse } from 'next/server'

export async function POST(request: NextRequest) {
  const { licenseKey, instanceName } = await request.json()

  if (!licenseKey) {
    return NextResponse.json(
      { valid: false, error: 'License key is required' },
      { status: 400 }
    )
  }

  const response = await fetch(
    'https://api.lemonsqueezy.com/v1/licenses/activate',
    {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({
        license_key: licenseKey,
        instance_name: instanceName || 'default',
      }),
    }
  )

  if (!response.ok) {
    const status = response.status
    // 404 = invalid key, 400 = activation limit reached
    const errorMap: Record<number, string> = {
      404: 'Invalid license key',
      400: 'Activation limit reached for this key',
    }
    return NextResponse.json(
      { valid: false, error: errorMap[status] || 'Activation failed' },
      { status }
    )
  }

  const data = await response.json()

  return NextResponse.json({
    valid: data.activated,
    instanceId: data.instance?.id,
    activationUsage: data.license_key?.activation_usage,
    activationLimit: data.license_key?.activation_limit,
  })
}

// src/hooks/use-license-validation.ts
import { useCallback, useEffect, useState } from 'react'

interface LicenseState {
  isValid: boolean
  isLoading: boolean
  error: string | null
  status: string | null
  expiresAt: string | null
}

const CACHE_KEY = 'tourkit-license-cache'
const INSTANCE_KEY = 'tourkit-license-instance'
const DEFAULT_TTL = 72 * 60 * 60 * 1000 // 72 hours in ms

function getCachedValidation(): LicenseState | null {
  try {
    const cached = localStorage.getItem(CACHE_KEY)
    if (!cached) return null

    const { state, timestamp } = JSON.parse(cached)
    const age = Date.now() - timestamp
    if (age > DEFAULT_TTL) {
      localStorage.removeItem(CACHE_KEY)
      return null
    }
    return state
  } catch {
    return null
  }
}

function cacheValidation(state: LicenseState) {
  try {
    localStorage.setItem(
      CACHE_KEY,
      JSON.stringify({ state, timestamp: Date.now() })
    )
  } catch {
    // localStorage full or unavailable — continue without cache
  }
}

export function useLicenseValidation(licenseKey: string | undefined) {
  const [state, setState] = useState<LicenseState>({
    isValid: false,
    isLoading: true,
    error: null,
    status: null,
    expiresAt: null,
  })

  const validate = useCallback(async () => {
    if (!licenseKey) {
      setState({
        isValid: false,
        isLoading: false,
        error: null,
        status: null,
        expiresAt: null,
      })
      return
    }

    // Check cache first
    const cached = getCachedValidation()
    if (cached) {
      setState({ ...cached, isLoading: false })
      return
    }

    setState(prev => ({ ...prev, isLoading: true }))

    try {
      const instanceId = localStorage.getItem(INSTANCE_KEY)

      // If no instance exists, activate first
      if (!instanceId) {
        const activateRes = await fetch('/api/license/activate', {
          method: 'POST',
          headers: { 'Content-Type': 'application/json' },
          body: JSON.stringify({
            licenseKey,
            instanceName: window.location.hostname,
          }),
        })

        const activateData = await activateRes.json()

        if (activateData.valid && activateData.instanceId) {
          localStorage.setItem(INSTANCE_KEY, activateData.instanceId)
        } else if (!activateRes.ok) {
          const result: LicenseState = {
            isValid: false,
            isLoading: false,
            error: activateData.error,
            status: 'activation_failed',
            expiresAt: null,
          }
          setState(result)
          return
        }
      }

      // Validate with instance ID
      const storedInstance = localStorage.getItem(INSTANCE_KEY)
      const validateRes = await fetch('/api/license/validate', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({
          licenseKey,
          instanceId: storedInstance,
        }),
      })

      const validateData = await validateRes.json()
      const result: LicenseState = {
        isValid: validateData.valid,
        isLoading: false,
        error: validateData.valid ? null : 'License key is not valid',
        status: validateData.status,
        expiresAt: validateData.expiresAt,
      }

      setState(result)
      cacheValidation(result)
    } catch {
      // Network failure — use cached result if available, otherwise fail open
      const cached = getCachedValidation()
      if (cached) {
        setState({ ...cached, isLoading: false })
      } else {
        setState({
          isValid: false,
          isLoading: false,
          error: 'Network error during validation',
          status: null,
          expiresAt: null,
        })
      }
    }
  }, [licenseKey])

  useEffect(() => {
    validate()
  }, [validate])

  return state
}

// src/providers/tour-kit-provider.tsx
'use client'

import { TourProvider, TourKitProvider } from '@tourkit/react'
import { useLicenseValidation } from '@/hooks/use-license-validation'

interface Props {
  licenseKey: string | undefined
  children: React.ReactNode
}

export function LicensedTourProvider({ licenseKey, children }: Props) {
  const license = useLicenseValidation(licenseKey)

  return (
    <TourKitProvider
      license={{
        key: licenseKey,
        isValid: license.isValid,
        isLoading: license.isLoading,
      }}
    >
      <TourProvider>{children}</TourProvider>
    </TourKitProvider>
  )
}

// src/app/layout.tsx
import { LicensedTourProvider } from '@/providers/tour-kit-provider'

export default function RootLayout({
  children,
}: {
  children: React.ReactNode
}) {
  return (
    <html lang="en">
      <body>
        <LicensedTourProvider
          licenseKey={process.env.NEXT_PUBLIC_TOURKIT_LICENSE_KEY}
        >
          {children}
        </LicensedTourProvider>
      </body>
    </html>
  )
}

// src/app/api/webhooks/lemonsqueezy/route.ts
import { type NextRequest, NextResponse } from 'next/server'
import crypto from 'node:crypto'

const WEBHOOK_SECRET = process.env.LEMONSQUEEZY_WEBHOOK_SECRET!

function verifySignature(payload: string, signature: string): boolean {
  const hmac = crypto.createHmac('sha256', WEBHOOK_SECRET)
  const digest = hmac.update(payload).digest('hex')
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(digest)
  )
}

export async function POST(request: NextRequest) {
  const payload = await request.text()
  const signature = request.headers.get('x-signature') || ''

  if (!verifySignature(payload, signature)) {
    return NextResponse.json({ error: 'Invalid signature' }, { status: 401 })
  }

  const event = JSON.parse(payload)
  const eventName = event.meta?.event_name

  if (eventName === 'license_key_updated') {
    const licenseKey = event.data?.attributes?.key
    const status = event.data?.attributes?.status

    if (status === 'disabled' || status === 'expired') {
      // Store revoked keys in your database or KV store
      // Your validate API route checks this list before returning valid=true
      console.log(`License ${licenseKey} revoked: ${status}`)
    }
  }

  return NextResponse.json({ received: true })
}