@antondziuin/talos-sdk 0.1.0 → 0.2.1

package/README.md

@@ -1,15 +1,18 @@
 # @antondziuin/talos-sdk (Node.js)
 
-Online-first client SDK for the Talos licensing platform. Node ≥18, **zero
-runtime dependencies** (`node:crypto` Ed25519, built-in `fetch`), dual ESM + CJS.
+Talos SDK for Node.js and Electron applications. Activate and validate licenses,
+read feature entitlements, manage floating seats, and download signed software
+updates. Supports offline grace periods and license files for air-gapped machines.
+
+Requires Node.js 18 or later. Includes TypeScript declarations, ESM and CommonJS
+builds, and **zero runtime dependencies**. Uses `node:crypto` for Ed25519
+verification and the built-in `fetch` for HTTP requests.
 
 ```sh
 npm install @antondziuin/talos-sdk
 ```
 
-MIT-licensed, from `0.1.0` onward. The platform it talks to is not — the split is
-deliberate: a library you install into your own application should not be
-something your legal review has to read.
+MIT-licensed.
 
 ## Quickstart
 
@@ -19,7 +22,7 @@ import { TalosClient } from "@antondziuin/talos-sdk";
 const talos = new TalosClient({
   productToken: "tpt_…",               // from the portal's Integration page
   anchorPublicKey: "base64-anchor-key", // pin THIS — the rotation-safe root
-  serverUrl: "https://api.talos.dev",
+  serverUrl: "https://talos.dziuin.dev", // Talos Cloud, or your self-hosted node
   appVersion: "1.4.2",
 });
 
@@ -34,6 +37,33 @@ if (talos.isFeatureEnabled("pdf-export")) enablePdfMenu();
 const seats = Number(talos.current?.getEntitlement("seats") ?? 1);
 ```
 
+## Local diagnostic reports
+
+After a licensing call, `talos.createDiagnosticReport()` returns JSON describing
+the last decision, offline grace deadline, SDK version and whether an activation
+is held. If the call throws, pass the caught error to classify it and get a next
+action:
+
+```ts
+try {
+  await talos.validate();
+  console.log(talos.createDiagnosticReport());
+} catch (error) {
+  console.log(talos.createDiagnosticReport(error));
+}
+```
+
+The report is a local snapshot: it makes no requests, writes no files and changes
+no licensing state. It excludes keys, tokens, server URLs, machine identifiers,
+entitlements and exception messages/stacks. Unknown error codes are replaced with
+`api_error`. An HTTP error is not a signed license decision. An offline result
+alone cannot identify the original transport or verification failure.
+
+In the portal, select the same license on **Integration → Connection progress**
+to see its devices, recorded validation, seat usage and recent activation refusals.
+Use the report for failures that the server cannot see. Do not use this report
+as authorization; continue to gate access on the SDK's verified license state.
+
 ## Supplying your own `fetch`
 
 `options.fetch` replaces the global one for **every** network call, artifact
@@ -184,6 +214,51 @@ pins, but they break on the first rotation — prefer the anchor.)
 Anti-tamper honesty: JS is patchable — gate premium value on server-returned
 *data* (entitlements/config), not client booleans.
 
+## Air-gapped machines
+
+Grace above is for an install that has been online. This is for one that never
+will be — an isolated network, no route out at all.
+
+```ts
+// On the machine. Write this out and carry it to your vendor:
+writeFileSync("talos-request.json", JSON.stringify(talos.createOfflineRequest(), null, 2));
+
+// They upload it in the portal and hand you back license.talos:
+const state = await talos.loadOfflineLicense("license.talos");
+state.decision; // "valid"
+```
+
+The first call generates an **Ed25519 keypair for this machine**, keeps the
+private half in the same encrypted state file as everything else, and puts the
+public half in the request beside the fingerprint. The file you get back is bound
+to both, so a file copied off another machine does not license this one and this
+machine's state directory does not license another. Calling it twice reuses the
+same identity — only the nonce changes.
+
+Everything is verified locally: the anchor-signed keyset travels inside the file,
+so an anchor-only pin still works with no server to fetch one from. The verdict
+is kept, so later starts need nothing — `validate()` re-checks the stored file
+instead of reaching for the network, and `isActivated` is true.
+
+`loadOfflineLicense` **throws** only for a file that is not a licence: unreadable,
+not one of ours, addressed to another product, or a signature that does not
+verify. A file that is one but cannot license this machine comes back as a
+verdict you can show the user — `machine_mismatch`, `offline_file_expired` (get a
+new file), `expired` (renew the licence), `clock_tampered`.
+
+Retiring the machine? `talos.createOfflineDeactivation()` writes a
+`talos-deactivation.json` for the vendor to upload, and **drops the licence
+before returning it** — so an app that loses the file has still stopped using the
+seat. Credited once per file, so a machine restored from a snapshot replaying its
+receipt changes nothing.
+
+Two things to know before you offer this to customers. A file **cannot be
+recalled** — revoking it in the portal frees the seat so you can issue to a
+replacement machine, but the machine holding it keeps working until the file's
+own expiry, which is why the policy's horizon is short. And hardware changes are
+not forgiven offline: the drift matcher lives on the server, so a replaced disk
+means `machine_mismatch` and a new request.
+
 ## Heartbeats, monitoring, and cadence
 
 ```ts
@@ -283,26 +358,12 @@ given.
 The same code arrives on the artifact download, for the same reason: the gate is
 the licence's `updates` entitlement, checked on both routes.
 
-## Hardening the shipped bundle
-
-The renderer, the bundle and the disk all belong to the person running your
-application, so nothing here is a licence check — the checks are on the server,
-and the entitlement is the thing worth gating on (see the portal's
-"Entitlements" page). What client-side hardening buys is time.
-
-- **Bundle first**, with esbuild or webpack: one file, no module boundaries, no
-  helpfully-named source files to open.
-- **Then `bytenode`**, which compiles that bundle to V8 bytecode — the practical
-  option for Node and Electron applications, and the one this SDK's C# sibling
-  reaches for with NativeAOT.
-- **Keep the client in the main process** in Electron. The renderer is the part
-  an attacker already controls; it should be told a verdict and never hold the
-  activation secret (see `examples/electron-main`).
+## Electron integration
 
-Honestly labelled: bytecode can be decompiled and every obfuscator has a
-deobfuscator. These buy an attacker's afternoon, not their ability — which is
-why the server decides seats, expiry and revocation, and why a feature that only
-exists on the server cannot be patched into existence on the client.
+Keep `TalosClient` in the main process and expose the license state to the
+renderer through IPC. Keep the activation secret in the main process. Use
+server-verified entitlements to control licensed features; client-side code
+can be modified by the person running the application.
 
 ## Hardware changes
 
@@ -321,15 +382,14 @@ an id you already hold — pass it in and the server will use it:
 const talos = new TalosClient({
   productToken: "tpt_…",
   anchorPublicKey: "…",
-  serverUrl: "https://api.talos.dev",
+  serverUrl: "https://talos.dziuin.dev",
   fingerprintComponents: { machine_guid: myNativeModule.machineId() },
 });
 ```
 
 The value must be stable for the life of the install — one that changes per
-launch reports a hardware change on every launch. See
-[docs/FINGERPRINT.md](../../docs/FINGERPRINT.md) for the recognised ids, the
-per-platform coverage table, and the drift budget that bounds all of this.
+launch reports a hardware change on every launch. The product's fingerprint
+policy controls which hardware changes are tolerated.
 
 ## Floating (concurrent) licenses
 
@@ -360,7 +420,7 @@ const talos = new TalosClient({
   productToken: "tpt_…",
   publicKey: "…",             // license key (activation/validation tokens)
   releasePublicKey: "…",      // release key (update manifests) — separate custody
-  serverUrl: "https://api.talos.dev",
+  serverUrl: "https://talos.dziuin.dev",
 });
 await talos.activate(licenseKey);
 
@@ -398,9 +458,3 @@ that is already updated.
 
 Downloaded bytes are verified against the signed manifest's SHA-256, so the
 CDN/mirror serving them is untrusted infrastructure.
-
-## Tests
-
-- `npm test` runs the client-side verification tests (no server needed).
-- The cross-language **contract test** (`test/contract.test.ts`) runs the SDK
-  against a live Rust server; see [`../csharp/contract.sh`](../csharp/contract.sh).

package/dist/index.cjs

@@ -30,7 +30,10 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  LICENSE_FILE_KIND: () => LICENSE_FILE_KIND,
   LicenseState: () => LicenseState,
+  RECEIPT_DOMAIN: () => RECEIPT_DOMAIN,
+  REQUEST_DOMAIN: () => REQUEST_DOMAIN,
   StateStore: () => StateStore,
   TalosApiError: () => TalosApiError,
   TalosClient: () => TalosClient,
@@ -48,11 +51,11 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // src/client.ts
-var import_node_crypto5 = require("crypto");
+var import_node_crypto6 = require("crypto");
 var import_node_fs3 = require("fs");
 var import_promises = require("fs/promises");
 var import_node_os3 = __toESM(require("os"), 1);
-var import_node_crypto6 = require("crypto");
+var import_node_crypto7 = require("crypto");
 
 // src/errors.ts
 var TalosError = class extends Error {
@@ -238,7 +241,13 @@ var StateStore = class {
       if (pending && typeof pending["version"] === "string" && typeof pending["releaseSeq"] === "number") {
         b.pendingRelease = { version: pending["version"], releaseSeq: pending["releaseSeq"] };
       }
-      return b.activationSecret ? b : null;
+      if (typeof o["machineKey"] === "string") b.machineKey = o["machineKey"];
+      if (typeof o["machinePublicKey"] === "string") {
+        b.machinePublicKey = o["machinePublicKey"];
+      }
+      if (typeof o["offlineToken"] === "string") b.offlineToken = o["offlineToken"];
+      if (typeof o["offlineSeen"] === "number") b.offlineSeen = o["offlineSeen"];
+      return b.activationSecret || b.offlineToken || b.machineKey ? b : null;
     } catch {
       return null;
     }
@@ -279,9 +288,51 @@ var StateStore = class {
 };
 
 // src/version.ts
-var SDK_VERSION = "0.1.0";
+var SDK_VERSION = "0.2.1";
 var SDK_ID = `node/${SDK_VERSION}`;
 
+// src/diagnostics.ts
+var decisions = /* @__PURE__ */ new Set(["valid", "expired", "revoked", "suspended", "deactivated", "machine_revoked", "invalid", "grace_expired", "clock_tampered"]);
+var errors = /* @__PURE__ */ new Set(["product_not_found", "license_not_found", "license_expired", "license_revoked", "license_suspended", "machine_revoked", "activation_limit_reached", "seat_limit_reached", "deactivation_limit_reached", "tenant_suspended", "tenant_closed", "invalid_activation_secret", "rate_limited"]);
+function diagnosticReport(activated, anchorPinned, state, error) {
+  const code = error instanceof TalosApiError ? errors.has(error.errorCode ?? "") ? error.errorCode : "api_error" : error instanceof TalosSignatureError ? "signature_verification_failed" : error != null ? "client_error" : null;
+  const decision = state == null ? null : decisions.has(state.decision) ? state.decision : "unknown";
+  const advice = {
+    signature_verification_failed: "Check the pinned anchor, product configuration and system time. Keep signature verification enabled.",
+    activation_limit_reached: "Open the license's devices in the portal. Release an unused device or review its activation limit.",
+    seat_limit_reached: "Close an unused app session or review the concurrent seat limit.",
+    license_expired: "Renew the license in the portal, then validate again.",
+    expired: "Renew the license in the portal, then validate again.",
+    license_revoked: "Revocation is permanent. Ask the vendor for a replacement license.",
+    revoked: "Revocation is permanent. Ask the vendor for a replacement license.",
+    license_suspended: "Ask the vendor to review the suspension before activating a new device.",
+    suspended: "Ask the vendor to review the suspension.",
+    machine_revoked: "Ask the vendor to review this device in the portal.",
+    grace_expired: "Reconnect to the configured Talos server and validate. Do not extend the local grace deadline.",
+    clock_tampered: "Correct the system clock and validate online.",
+    client_error: "Check connectivity, server configuration and local state access. The exception text is intentionally excluded."
+  };
+  const action = advice[code ?? decision ?? ""] ?? (code ? "Review the licensing call and configuration with the vendor. HTTP errors are not signed license decisions." : state?.isOffline ? "The last decision was offline. Check connectivity and validate online; this snapshot cannot identify the transport failure." : !activated ? "Activate with a license key, then validate the saved activation." : decision === "valid" ? "The last licensing call returned valid. Check the portal for this device's recorded validation." : "Run a licensing check and generate a new report. Ask the vendor to review an invalid decision.");
+  const timestamp = (value) => typeof value === "number" && Number.isFinite(value) ? value : null;
+  return JSON.stringify({
+    schema_version: 1,
+    sdk: SDK_ID,
+    generated_at: Math.floor(Date.now() / 1e3),
+    activated,
+    anchor_pinned: anchorPinned,
+    decision,
+    is_offline: state?.isOffline ?? null,
+    license_expires_at: timestamp(state?.licenseExpiresAt),
+    grace_until: timestamp(state?.graceUntil),
+    error_code: code,
+    http_status: error instanceof TalosApiError && Number.isInteger(error.statusCode) && error.statusCode >= 100 && error.statusCode <= 599 ? error.statusCode : null,
+    next_action: action
+  }, null, 2);
+}
+
+// src/offline.ts
+var import_node_crypto5 = require("crypto");
+
 // src/talos-compact.ts
 var import_node_crypto4 = require("crypto");
 var SPKI_PREFIX = Buffer.from("302a300506032b6570032100", "hex");
@@ -361,6 +412,36 @@ function verifyKeyset(anchorKey, expectedAud, token) {
   return claims;
 }
 
+// src/offline.ts
+var REQUEST_DOMAIN = "talos-offline-request";
+var RECEIPT_DOMAIN = "talos-offline-deactivation";
+var LICENSE_FILE_KIND = "talos-offline-license";
+var DOC_VERSION = 1;
+function generateMachineKey() {
+  const { privateKey, publicKey } = (0, import_node_crypto5.generateKeyPairSync)("ed25519");
+  return {
+    privateKey: privateKey.export({ format: "der", type: "pkcs8" }).toString("base64"),
+    // The raw key is the last 32 bytes of the SPKI DER; every other Ed25519
+    // implementation in this project speaks raw-32, including the server's.
+    publicKey: publicKey.export({ format: "der", type: "spki" }).subarray(-32).toString("base64")
+  };
+}
+function privateKeyObject(pkcs8Base64) {
+  return (0, import_node_crypto5.createPrivateKey)({
+    key: Buffer.from(pkcs8Base64, "base64"),
+    format: "der",
+    type: "pkcs8"
+  });
+}
+function signedMessage(domain, payloadB64) {
+  return `${domain}.${DOC_VERSION}.${payloadB64}`;
+}
+function signMachineDoc(key, domain, payload) {
+  const req = b64urlEncode(Buffer.from(JSON.stringify(payload), "utf8"));
+  const sig = (0, import_node_crypto5.sign)(null, Buffer.from(signedMessage(domain, req), "ascii"), privateKeyObject(key.privateKey));
+  return { v: DOC_VERSION, kind: domain, req, sig: b64urlEncode(sig) };
+}
+
 // src/client.ts
 var CLOCK_SKEW_SECONDS2 = 60;
 var DEFAULT_HEARTBEAT_SECONDS = 600;
@@ -445,8 +526,16 @@ var TalosClient = class {
   /** Bumped on release so an in-flight renewal cannot resurrect the seat. */
   leaseGeneration = 0;
   /** Default instance id for floating leases: one per client object. */
-  instanceId = b64urlEncode((0, import_node_crypto5.randomBytes)(9));
+  instanceId = b64urlEncode((0, import_node_crypto6.randomBytes)(9));
   current = null;
+  /**
+   * Return a local JSON support report without credentials, identifiers or
+   * exception text. Pass a caught error for classification. Makes no requests
+   * and does not change licensing state; `decision` is the last known result.
+   */
+  createDiagnosticReport(error) {
+    return diagnosticReport(this.isActivated, this.options.anchorPublicKey != null && this.options.anchorPublicKey !== "", this.current, error);
+  }
   listeners = /* @__PURE__ */ new Map();
   /** The newest release this client has already announced. */
   announcedReleaseSeq = 0;
@@ -472,9 +561,9 @@ var TalosClient = class {
     const stored = this.store?.load() ?? null;
     if (stored) {
       this.binding = stored;
-      this.licenseKeyHash = stored.licenseKeyHash;
-      this.activationSecret = stored.activationSecret;
-      this.machineId = stored.machineId;
+      this.licenseKeyHash = stored.licenseKeyHash || null;
+      this.activationSecret = stored.activationSecret || null;
+      this.machineId = stored.machineId || null;
       if (stored.keyset) {
         try {
           this.adoptKeyset(stored.keyset);
@@ -522,8 +611,17 @@ var TalosClient = class {
    * construction, so this is the startup question: prompt for a licence key, or
    * go straight to {@link validate}?
    */
+  /**
+   * Whether this install holds a licence for this machine.
+   *
+   * True for an online activation (the activation secret is held) **and** for an
+   * air-gapped install that has loaded a licence file. Widened rather than
+   * split, because what a host does with this is decide whether to ask the user
+   * for a licence key — and an air-gapped machine that already holds a valid
+   * file must not be asked for one it has no way to redeem.
+   */
   get isActivated() {
-    return this.activationSecret !== null;
+    return this.activationSecret !== null || this.binding?.offlineToken != null;
   }
   /** The server's id for this machine, once activated. */
   get currentMachineId() {
@@ -680,12 +778,221 @@ var TalosClient = class {
       // A fresh activation invalidates any cached verdict for the previous
       // binding; keep only the keyset, which is per product, not per machine.
       keyset: typeof body["keyset"] === "string" ? body["keyset"] : this.binding?.keyset,
-      timeHighWater: this.binding?.timeHighWater
+      timeHighWater: this.binding?.timeHighWater,
+      // The machine's own identity survives an online activation, because it is
+      // an identity and not a verdict: an install that reaches the network once
+      // must not have to repeat the whole air-gapped ceremony with its vendor
+      // the next time it is unplugged. The clock mark survives for the same
+      // reason a mark exists at all — it only moves forward.
+      machineKey: this.binding?.machineKey,
+      machinePublicKey: this.binding?.machinePublicKey,
+      offlineSeen: this.binding?.offlineSeen
+      // The offline *file* does not: a live activation supersedes it, and
+      // keeping it would leave two answers to "what licenses this machine".
     };
     this.advanceClock(claims);
     this.store?.save(this.binding);
     return this.adopt(stateFromClaims(claims, "valid", false));
   }
+  /**
+   * This machine's own keypair, generated once and kept in the state file.
+   *
+   * The air-gapped counterpart of the activation secret: a machine that cannot
+   * reach a server is never issued one, so it makes an identity of its own and
+   * the vendor binds the file to it.
+   */
+  machineKey() {
+    const held = this.binding?.machineKey;
+    const pub = this.binding?.machinePublicKey;
+    if (held && pub) return { privateKey: held, publicKey: pub };
+    const key = generateMachineKey();
+    this.binding = {
+      ...this.bindingBase(),
+      machineKey: key.privateKey,
+      machinePublicKey: key.publicKey
+    };
+    this.store?.save(this.binding);
+    return key;
+  }
+  /**
+   * The binding as it stands, or an empty one to build on.
+   *
+   * An air-gapped install reaches its first write with nothing stored — no
+   * licence key, no activation secret, no machine id — so there has to be
+   * something for the offline fields to be added to.
+   */
+  bindingBase() {
+    return this.binding ?? {
+      licenseKeyHash: "",
+      activationSecret: "",
+      machineId: "",
+      fingerprint: this.fingerprint
+    };
+  }
+  /**
+   * Write the request an air-gapped machine hands to its vendor.
+   *
+   * Save the returned object as `talos-request.json`, carry it to whoever sold
+   * the licence, and they upload it in the portal. What comes back is a
+   * `license.talos` for {@link loadOfflineLicense} — and only for *this*
+   * machine: the request carries the fingerprint and the public half of a
+   * keypair generated here, and the file is bound to both.
+   *
+   * Calling it twice produces two requests under the same identity. The vendor
+   * can issue against either; the second file supersedes the first without
+   * spending a second seat.
+   *
+   * ```ts
+   * writeFileSync("talos-request.json", JSON.stringify(talos.createOfflineRequest(), null, 2));
+   * ```
+   *
+   * @param licenseKey Optional. The operator picks the licence in the portal, so
+   * it is not needed — but when it is present the server checks it against the
+   * licence being issued against, which catches issuing from the wrong tab.
+   */
+  createOfflineRequest(licenseKey) {
+    const key = this.machineKey();
+    return signMachineDoc(key, REQUEST_DOMAIN, {
+      product_token: this.options.productToken,
+      license_key: licenseKey,
+      fingerprint: { composite: this.fingerprint, components: this.fp.components },
+      machine_pubkey: key.publicKey,
+      nonce: newNonce(),
+      hostname: this.reportedHostname(),
+      os: `${import_node_os3.default.type()} ${import_node_os3.default.release()}`,
+      arch: import_node_os3.default.arch(),
+      app_version: this.options.appVersion,
+      sdk_version: SDK_ID,
+      created_at: nowSeconds()
+    });
+  }
+  /**
+   * Adopt an air-gapped licence file issued for this machine.
+   *
+   * Everything is verified locally, because there is nothing to ask: the
+   * anchor-signed keyset travels inside the file, the verdict is signed by a key
+   * that keyset lists, and the file names both halves of this machine's identity
+   * — its fingerprint and the public key it generated. The verdict is then kept,
+   * so later starts are licensed with no further ceremony.
+   *
+   * **Throws** only for a file that is not a licence: unreadable, not one of
+   * ours, addressed to another product, or a broken signature. A file that *is*
+   * one but cannot license this machine right now comes back as a verdict —
+   * `machine_mismatch` for another machine's file, `offline_file_expired` for
+   * one past its horizon, `expired` for a licence that has ended, and
+   * `clock_tampered` for a clock wound back behind what this install has already
+   * seen. Those are things the user can be told and can act on, and turning
+   * them into exceptions would make the launch path throw for a reason nobody
+   * can catch usefully.
+   */
+  async loadOfflineLicense(pathOrBuffer) {
+    const raw = typeof pathOrBuffer === "string" ? (0, import_node_fs3.readFileSync)(pathOrBuffer) : Buffer.from(pathOrBuffer);
+    let doc;
+    try {
+      doc = JSON.parse(raw.toString("utf8"));
+    } catch {
+      throw new TalosError("not a Talos offline licence file");
+    }
+    if (doc["kind"] !== LICENSE_FILE_KIND || typeof doc["token"] !== "string") {
+      throw new TalosError("not a Talos offline licence file");
+    }
+    if (typeof doc["keyset"] === "string") this.adoptKeyset(doc["keyset"]);
+    return this.adoptOfflineToken(doc["token"], doc["keyset"]);
+  }
+  /**
+   * Hand this machine's air-gapped seat back.
+   *
+   * Save the returned object as `talos-deactivation.json` and send it to the
+   * vendor; they upload it in the portal and the seat returns to the pool.
+   * Signed by the same key the licence file is bound to, which is what makes it
+   * worth anything to a server that has never spoken to this machine.
+   *
+   * **The licence is dropped here, before the document is returned** — so an
+   * application that writes the file, or loses it, or never sends it has still
+   * stopped using the seat it is giving up. A receipt proves intent, not
+   * destruction: the vendor's copy of the file cannot be recalled, and if this
+   * machine is later restored from a snapshot it keeps working until that file
+   * expires. That is the accepted cost, and it is why the horizon is short.
+   *
+   * Throws when this install holds no offline licence — there is nothing to hand
+   * back, and a document saying otherwise would be a lie the vendor acts on.
+   */
+  createOfflineDeactivation() {
+    const token = this.binding?.offlineToken;
+    const key = this.binding?.machineKey;
+    const pub = this.binding?.machinePublicKey;
+    if (!token || !key || !pub) {
+      throw new TalosError("no offline licence to hand back");
+    }
+    let claims;
+    try {
+      claims = verifyCachedToken(
+        this.licenseVerifyKeys(),
+        "offline",
+        this.options.productToken,
+        token
+      );
+    } catch {
+      throw new TalosError("the stored offline licence no longer verifies");
+    }
+    this.binding = { ...this.bindingBase(), offlineToken: void 0 };
+    this.current = null;
+    this.store?.save(this.binding);
+    return signMachineDoc({ privateKey: key, publicKey: pub }, RECEIPT_DOMAIN, {
+      fid: claims["fid"],
+      mid: claims["mid"],
+      fph: this.fingerprint,
+      local_time: nowSeconds()
+    });
+  }
+  /**
+   * Verify the offline file against this machine and this clock, and adopt the
+   * verdict. Runs on load and again on every {@link validate}, because the two
+   * things that can change afterwards — the clock and the calendar — are
+   * exactly what it checks.
+   */
+  adoptOfflineToken(token, keyset) {
+    const claims = verifyCachedToken(
+      this.licenseVerifyKeys(),
+      "offline",
+      this.options.productToken,
+      token
+    );
+    const mismatch = () => this.adopt(new LicenseState("machine_mismatch", {}, null, true, null, null));
+    if (typeof claims["mpk"] !== "string" || claims["mpk"] !== this.binding?.machinePublicKey) {
+      return mismatch();
+    }
+    if (claims["fph"] !== this.fingerprint) return mismatch();
+    const now = nowSeconds();
+    const mark = Math.max(this.binding?.timeHighWater ?? 0, this.binding?.offlineSeen ?? 0);
+    if (mark > 0 && now + CLOCK_SKEW_SECONDS2 < mark) {
+      return this.adopt(new LicenseState("clock_tampered", {}, null, true, null, null));
+    }
+    const lic = claims["lic"] ?? {};
+    const features = lic["features"] ?? {};
+    const licExp = num(lic["lic_exp"]);
+    const exp = num(claims["exp"]);
+    this.machineId = typeof claims["mid"] === "string" ? claims["mid"] : this.machineId;
+    const base = this.bindingBase();
+    this.binding = {
+      ...base,
+      machineId: this.machineId ?? base.machineId,
+      offlineToken: token,
+      offlineSeen: Math.max(base.offlineSeen ?? 0, now),
+      ...typeof keyset === "string" ? { keyset } : {}
+    };
+    this.advanceClock(claims);
+    this.store?.save(this.binding);
+    if (exp === null || now > exp) {
+      return this.adopt(
+        new LicenseState("offline_file_expired", features, licExp, true, null, exp)
+      );
+    }
+    if (licExp !== null && now > licExp) {
+      return this.adopt(new LicenseState("expired", features, licExp, true, null, exp));
+    }
+    return this.adopt(new LicenseState("valid", features, licExp, true, null, exp));
+  }
   /**
    * The heartbeat cadence the server's policy asks for, in seconds, taken from
    * the last heartbeat's **signed** claims — so it cannot be lengthened in
@@ -825,6 +1132,9 @@ var TalosClient = class {
     }
   }
   async validate() {
+    if (!this.activationSecret && this.binding?.offlineToken) {
+      return this.adoptOfflineToken(this.binding.offlineToken);
+    }
     this.requireActivated();
     try {
       await this.ensureKeyset();
@@ -1332,7 +1642,7 @@ var TalosClient = class {
     }
     const partPath = destPath + ".talos-part";
     const handle = await (0, import_promises.open)(partPath, "w");
-    const hash = (0, import_node_crypto5.createHash)("sha256");
+    const hash = (0, import_node_crypto6.createHash)("sha256");
     let received = 0;
     let closed = false;
     const take = async (chunk) => {
@@ -1457,7 +1767,7 @@ function transitionEvent(prev, next) {
   return prev?.decision === next.decision ? null : "licenseInvalid";
 }
 function newNonce() {
-  return b64urlEncode((0, import_node_crypto5.randomBytes)(16));
+  return b64urlEncode((0, import_node_crypto6.randomBytes)(16));
 }
 function asArray(v) {
   return Array.isArray(v) ? v : [];
@@ -1478,7 +1788,7 @@ function pickArtifact(artifacts) {
   return matches.find((a) => a.kind === "installer") ?? matches[0];
 }
 async function verifyAppliedUpdate(filePath, delta) {
-  const hash = (0, import_node_crypto5.createHash)("sha256");
+  const hash = (0, import_node_crypto6.createHash)("sha256");
   const stream = (0, import_node_fs3.createReadStream)(filePath);
   await new Promise((resolve, reject) => {
     stream.on("data", (chunk) => hash.update(chunk));
@@ -1494,7 +1804,10 @@ async function verifyAppliedUpdate(filePath, delta) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  LICENSE_FILE_KIND,
   LicenseState,
+  RECEIPT_DOMAIN,
+  REQUEST_DOMAIN,
   StateStore,
   TalosApiError,
   TalosClient,