From 37386f1eb5a8c6dfc35ebba8bd668473caf56188 Mon Sep 17 00:00:00 2001
From: Brian Love <brian@liveloveapp.com>
Date: Sat, 16 May 2026 19:51:17 -0700
Subject: [PATCH] fix(licensing): remove token tamper flake

---
 libs/licensing/src/lib/run-license-check.spec.ts | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/libs/licensing/src/lib/run-license-check.spec.ts b/libs/licensing/src/lib/run-license-check.spec.ts
index 145446d5b..da0265919 100644
--- a/libs/licensing/src/lib/run-license-check.spec.ts
+++ b/libs/licensing/src/lib/run-license-check.spec.ts
@@ -14,6 +14,13 @@ const BASE: LicenseClaims = {
   seats: 1,
 };
 
+function mutateSignature(token: string): string {
+  const [payload, signature] = token.split('.');
+  if (!payload || !signature) throw new Error('expected compact license token');
+  const replacement = signature.startsWith('x') ? 'y' : 'x';
+  return `${payload}.${replacement}${signature.slice(1)}`;
+}
+
 describe('runLicenseCheck', () => {
   let kp: DevKeyPair;
   let validToken: string;
@@ -77,7 +84,8 @@ describe('runLicenseCheck', () => {
   });
 
   it('re-runs when token changes (e.g., after key rotation in the host)', async () => {
-    const tamperedToken = `${validToken.slice(0, -1)}x`;
+    const tamperedToken = mutateSignature(validToken);
+    expect(tamperedToken).not.toBe(validToken);
     const first = await runLicenseCheck({
       package: '@ngaf/langgraph',
       token: validToken,