Add period-based license keys alongside fixed expiry dates.

New keys default to validDays with countdown starting on first activation; existing expiresAtSec keys behave unchanged.

Co-authored-by: Cursor <cursoragent@cursor.com>

test/adminApi.test.mjs

@@ -77,6 +77,8 @@ void test('GET /v1/admin/licenses returns enriched product keys', async () => {
     assert.equal(res.status, 200);
     assert.equal(res.body.licenses.length, 1);
     assert.equal(res.body.licenses[0].key, 'TTRPG-TEST-KEY');
+    assert.equal(res.body.licenses[0].expiryMode, 'fixed');
+    assert.equal(res.body.licenses[0].expiresAtSec, 1893456000);
     assert.equal(res.body.licenses[0].revoked, true);
     assert.deepEqual(res.body.licenses[0].activatedDevices, ['dev1', 'dev2']);
     assert.equal(res.body.licenses[0].activatedCount, 2);
@@ -105,7 +107,7 @@ void test('POST /v1/admin/product-keys creates a new product key', async () => {
     assert.equal(res.body.expiresAtSec, 2000000000);
 
     const data = JSON.parse(fs.readFileSync(dataPath, 'utf8'));
-    assert.equal(data.productKeys.length, 2);
+    assert.equal(data.productKeys.length, 3);
     assert.ok(data.productKeys.some((x) => x.key === res.body.key));
   } finally {
     server.close();
@@ -113,6 +115,52 @@ void test('POST /v1/admin/product-keys creates a new product key', async () => {
   }
 });
 
+void test('POST /v1/admin/product-keys defaults to validDays period', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
+  const dataPath = path.join(tmp, 'data.json');
+  fs.copyFileSync(path.join(root, 'data.example.json'), dataPath);
+
+  const { server, adminToken } = await makeServer(dataPath);
+  const port = await listen(server);
+  try {
+    const res = await request(port, 'POST', '/v1/admin/product-keys', {
+      token: adminToken,
+      body: { maxDevices: 3, pid: 'dnd_player' },
+    });
+    assert.equal(res.status, 201);
+    assert.equal(res.body.validDays, 365);
+    assert.equal(res.body.expiresAtSec, undefined);
+
+    const data = JSON.parse(fs.readFileSync(dataPath, 'utf8'));
+    const created = data.productKeys.find((x) => x.key === res.body.key);
+    assert.equal(created.validDays, 365);
+    assert.equal(created.expiresAtSec, undefined);
+  } finally {
+    server.close();
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
+void test('POST /v1/admin/product-keys rejects conflicting expiry', async () => {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
+  const dataPath = path.join(tmp, 'data.json');
+  fs.copyFileSync(path.join(root, 'data.example.json'), dataPath);
+
+  const { server, adminToken } = await makeServer(dataPath);
+  const port = await listen(server);
+  try {
+    const res = await request(port, 'POST', '/v1/admin/product-keys', {
+      token: adminToken,
+      body: { maxDevices: 3, expiresAtSec: 2000000000, validDays: 30 },
+    });
+    assert.equal(res.status, 400);
+    assert.equal(res.body.error, 'conflicting_expiry');
+  } finally {
+    server.close();
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+});
+
 void test('POST /v1/admin/revoke by key revokes only that product key', async () => {
   const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
   const dataPath = path.join(tmp, 'data.json');