@carchalabs/seal-electron 0.0.0-stage → 0.6.0

package/LICENSE

@@ -0,0 +1,109 @@
+Carcha Seal SDK License
+Version 1.0, 7 November 2026
+
+Copyright (c) 2026 Bugra Omer Aydemir (Carcha Labs) ("we", "us").
+All rights not expressly granted below are reserved.
+
+This license covers the software in the carcha-seal-sdk repository and the packages
+built from it (the "SDK"). The source code is published so that you can review it;
+publishing it does not make it open source. Versions of the SDK published before
+7 November 2026 were released under the MIT License, which still applies to those
+versions.
+
+1. Definitions
+
+"Carcha Seal Service" means a license server operated by us, or a license server you
+run under a written agreement with us.
+
+"Your Application" means software that you develop and provide to your own customers,
+that uses the SDK to obtain and check licenses from the Carcha Seal Service, and whose
+main purpose is not licensing, license management, copy protection or software
+protection.
+
+"End Users" means the people and organizations that receive Your Application from you.
+
+2. What you may do
+
+As long as you comply with this license, we grant you a non-exclusive, worldwide,
+royalty-free, non-transferable license, which you may not sublicense except as
+section 2(c) allows, to:
+
+(a) use, copy and modify the SDK to integrate Your Application with the Carcha Seal
+    Service;
+
+(b) read and study the SDK's source code, for example to evaluate the SDK or to review
+    its security; and
+
+(c) distribute the SDK, unmodified or modified under (a), only as part of Your
+    Application, in object code or source code form, and let your End Users use it
+    only as part of Your Application.
+
+3. What you may not do
+
+You may not, and may not allow anyone else to:
+
+(a) sell, license, rent, lend or otherwise distribute the SDK, or any part or modified
+    version of it, on its own or as part of a software development kit, library,
+    framework or other product for developers;
+
+(b) use the SDK, or any part or modified version of it, with a license server or
+    service other than the Carcha Seal Service, except a test server you run only to
+    test Your Application;
+
+(c) use the SDK, or any part, modified version or translation of it, in a product or
+    service that substitutes for the Carcha Seal Service or the SDK, or that offers the
+    same or substantially similar functionality;
+
+(d) reverse engineer, decompile or disassemble the compiled parts of the SDK (such as
+    its native libraries), or otherwise try to derive source code we have not
+    published, except to the extent applicable law permits it despite this
+    restriction;
+
+(e) disable, bypass or tamper with the SDK's license checks, signature verification,
+    encryption or device binding, or help anyone else do so, in any application that
+    uses the Carcha Seal Service, except in Your Application while you test it;
+
+(f) remove or change this license or any copyright or other notice in the SDK; or
+
+(g) use our names, logos or trademarks, including "Carcha Seal" and "Carcha Labs",
+    except to state truthfully that Your Application uses Carcha Seal.
+
+4. Your End Users
+
+Your terms for Your Application must not give your End Users more rights in the SDK
+than to use it as part of Your Application. You are responsible for your End Users'
+use of the SDK as part of Your Application.
+
+5. Contributions
+
+If you send us changes or suggestions for the SDK, you grant us a perpetual,
+irrevocable, worldwide, royalty-free license to use, modify and distribute them for
+any purpose.
+
+6. Termination
+
+Your rights under this license end automatically if you breach it. If you end the
+breach within 30 days after we notify you of it, your rights are restored, unless you
+have breached this license before. When your rights end, you must stop using and
+distributing the SDK; your End Users may keep using copies of Your Application they
+received before then. Sections 3, 5, 7 and 8 continue to apply after termination.
+
+7. No warranty
+
+To the extent the law allows, the SDK is provided "as is", without warranty of any
+kind, express or implied, including warranties of merchantability, fitness for a
+particular purpose and non-infringement. If you have a separate written agreement with
+us for the Carcha Seal Service, its terms on warranty and liability apply to the SDK
+instead of sections 7 and 8.
+
+8. Limitation of liability
+
+To the extent the law allows, we are not liable for any damages arising from the SDK
+or this license. Nothing in this license limits or excludes liability that cannot be
+limited or excluded under applicable law, including liability for intent or gross
+negligence, for death or personal injury, or under product liability law.
+
+9. New versions of this license
+
+We may publish new versions of this license. Each version of the SDK stays under the
+license it was published with.

package/README.md

@@ -1,3 +1,36 @@
-# Temporary Holding Version
+# @carchalabs/seal-electron
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The [Carcha Seal](https://seal.carchalabs.com) (formerly LicenseKit) SDK. It runs in the Electron main process or in plain Node. It activates a license key on this device, saves the signed lease, and verifies it offline with your public keys.
+
+```js
+const { Seal } = require('@carchalabs/seal-electron');
+
+const kit = new Seal({
+  serverUrl: 'https://licenses.example.com',
+  product: 'example-studio',
+  publicKey: [currentKeyPem, nextKeyPem],
+  storageDir: app.getPath('userData'),
+  secureStore: {
+    encrypt: (s) => safeStorage.encryptString(s),
+    decrypt: (b) => safeStorage.decryptString(b),
+  },
+});
+
+const state = await kit.check();
+if (state.status === 'unlicensed') await kit.activate(userEnteredKey);
+if (Seal.hasFeature(state, 'export-pdf')) exportPdf();
+```
+
+`check()` returns one of `valid`, `grace`, `invalid`, `unlicensed` or `clock_suspect`, with `offline` and `storageProtected` flags. A refusal from the server (suspended, expired, device removed, update required) is kept while offline and cleared by the next successful check-in. `notices` carries what the server asks your app to act on, such as `sdk_update_recommended` or `app_update_recommended` with a `minimum` version and a `requiredFrom` date; the SDK shows nothing itself. `activate(key, machineName)` sends the device name you pass, and none when you pass nothing (a computer's host name often holds its user's name). `deactivate()` releases the seat.
+
+Code can be protected the same way (Envelope): encrypt a CommonJS module or a folder of them with `seal-encrypt --feature pro dist/premium dist/premium`, and load it with `await kit.requireEncrypted('pro', path.join(__dirname, 'premium/index.js.lke'))`. Without the feature in the license the code cannot be read; a licensed user can still read it from memory.
+
+Computers that never reach the server use offline activation: `offlineRequest(key)` returns a request file, the license server turns it into a license file (its `/offline` page, `POST /v1/offline/activate` or the console), and `activateOffline(file)` loads it; it works only on that computer, for the policy's offline days. `deactivateOffline()` removes the license and returns a deactivation file the vendor uploads to free the seat. See the [documentation](https://seal.carchalabs.com/docs/#concepts).
+
+The SDK sends the license key, a per-product SHA-256 hash of the operating system's machine ID, the device name, the platform, your app version and its own version. The raw machine ID does not leave the computer.
+
+**Feature data.** `await kit.decrypt('pro', data)` returns data you encrypted for a feature (`encryptForFeature` in `@carchalabs/seal-core`, with the feature's content key from the console). It works offline from the stored lease and only on a device whose license includes the feature; without a license the data stays encrypted, so removing a license check from your app does not unlock it. With `@carchalabs/seal-hwid` 0.2 the native module does the decryption and the key never reaches JavaScript.
+
+**Hardware components.** When `@carchalabs/seal-hwid` is installed, the SDK also sends one keyed hash per hardware part (motherboard, disk, network card, OS install, CPU and graphics models) and whether the computer is a virtual machine. The license server then recognises the computer after a new disk, network card or operating system install, and refuses a copied disk or system image on other hardware. Raw serial numbers never leave the computer. Without the package, or on a platform it has no module for, nothing extra is sent. `hardware: false` turns it off. Bundlers must leave the package to Node (mark it external); electron-builder unpacks its native module from the asar archive.
+
+Integration guide (activate once, check at start, put feature code behind `decrypt`, ship the native module, harden the app): [seal.carchalabs.com/docs/#integration](https://seal.carchalabs.com/docs/#integration). Full reference: [seal.carchalabs.com/docs](https://seal.carchalabs.com/docs/#sdk). Requires Node 22.13 or later. [Carcha Seal SDK License](LICENSE): for apps that use Carcha Seal; versions before 7 November 2026 are MIT.

package/dist/fingerprint.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The OS tools are run by absolute path, never looked up through PATH: an app started from a terminal inherits the
+ * user's PATH, and a fake `ioreg` or `reg` placed first in it could report another computer's id.
+ */
+export declare const IOREG = "/usr/sbin/ioreg";
+export declare const REG_EXE: string[];
+export declare const LINUX_ID_FILES: string[];
+export interface MachineIdDeps {
+    platform?: NodeJS.Platform;
+    /** Attempts to read the OS id before giving up (default 3). */
+    attempts?: number;
+    /** Pause between attempts (default 250 ms, doubled each time). */
+    delayMs?: number;
+    /**
+     * Use hostname + CPU + MAC when the OS id cannot be read. Off by default: that value differs from the OS id, so the
+     * same computer would look like a new device and take another seat.
+     */
+    allowFallback?: boolean;
+    run?: (file: string, args: string[], options: {
+        timeout: number;
+        windowsHide: boolean;
+    }) => Promise<{
+        stdout: string;
+    }>;
+    readText?: (file: string) => Promise<string>;
+}
+/** The OS id could not be read; licensing on this computer cannot continue until it can. */
+export declare class MachineIdUnavailableError extends Error {
+    readonly code = "machine_id_unavailable";
+    constructor();
+}
+/** Reads a stable, OS-provided machine id, retrying a few times. Throws MachineIdUnavailableError unless allowFallback. */
+export declare function readMachineId(deps?: MachineIdDeps): Promise<string>;

package/dist/fingerprint.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MachineIdUnavailableError = exports.LINUX_ID_FILES = exports.REG_EXE = exports.IOREG = void 0;
+exports.readMachineId = readMachineId;
+const node_child_process_1 = require("node:child_process");
+const promises_1 = require("node:fs/promises");
+const node_os_1 = require("node:os");
+const node_path_1 = require("node:path");
+const node_util_1 = require("node:util");
+const execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);
+/**
+ * The OS tools are run by absolute path, never looked up through PATH: an app started from a terminal inherits the
+ * user's PATH, and a fake `ioreg` or `reg` placed first in it could report another computer's id.
+ */
+exports.IOREG = '/usr/sbin/ioreg';
+exports.REG_EXE = [
+    'C:\\Windows\\System32\\reg.exe',
+    node_path_1.win32.join(process.env.SystemRoot || 'C:\\Windows', 'System32', 'reg.exe'),
+].filter((file, index, all) => all.indexOf(file) === index);
+exports.LINUX_ID_FILES = ['/etc/machine-id', '/var/lib/dbus/machine-id'];
+/** The OS id could not be read; licensing on this computer cannot continue until it can. */
+class MachineIdUnavailableError extends Error {
+    code = 'machine_id_unavailable';
+    constructor() {
+        super('This computer\'s id could not be read. Try again; if it keeps failing, contact the app\'s support.');
+        this.name = 'MachineIdUnavailableError';
+    }
+}
+exports.MachineIdUnavailableError = MachineIdUnavailableError;
+/** Reads a stable, OS-provided machine id, retrying a few times. Throws MachineIdUnavailableError unless allowFallback. */
+async function readMachineId(deps = {}) {
+    const attempts = Math.max(1, deps.attempts ?? 3);
+    let delay = deps.delayMs ?? 250;
+    for (let attempt = 1; attempt <= attempts; attempt++) {
+        const id = await readOsMachineId(deps);
+        if (id)
+            return id;
+        if (attempt < attempts) {
+            await new Promise((resolve) => setTimeout(resolve, delay));
+            delay *= 2;
+        }
+    }
+    if (deps.allowFallback)
+        return `fallback:${fallbackTraits()}`;
+    throw new MachineIdUnavailableError();
+}
+/** One attempt; null when the OS id is not available. */
+async function readOsMachineId(deps) {
+    const os = deps.platform ?? (0, node_os_1.platform)();
+    const run = deps.run ?? ((file, args, options) => execFileAsync(file, args, options));
+    const readText = deps.readText ?? ((file) => (0, promises_1.readFile)(file, 'utf8'));
+    try {
+        if (os === 'darwin') {
+            const { stdout } = await run(exports.IOREG, ['-rd1', '-c', 'IOPlatformExpertDevice'], { timeout: 3000, windowsHide: true });
+            const m = stdout.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/);
+            if (m)
+                return `mac:${m[1]}`;
+        }
+        else if (os === 'win32') {
+            for (const reg of exports.REG_EXE) {
+                try {
+                    // /reg:64 reads the 64-bit registry view, so a 32-bit build sees the same MachineGuid.
+                    const { stdout } = await run(reg, ['query', 'HKLM\\SOFTWARE\\Microsoft\\Cryptography', '/v', 'MachineGuid', '/reg:64'], {
+                        timeout: 3000,
+                        windowsHide: true,
+                    });
+                    const m = stdout.match(/MachineGuid\s+REG_SZ\s+([\w-]+)/i);
+                    if (m)
+                        return `win:${m[1]}`;
+                }
+                catch {
+                    /* try the next location */
+                }
+            }
+        }
+        else {
+            for (const f of exports.LINUX_ID_FILES) {
+                const id = (await readText(f).catch(() => '')).trim();
+                if (id)
+                    return `linux:${id}`;
+            }
+        }
+    }
+    catch {
+        /* fall through */
+    }
+    return null;
+}
+function fallbackTraits() {
+    const macs = Object.values((0, node_os_1.networkInterfaces)())
+        .flat()
+        .filter((i) => i && !i.internal && i.mac && i.mac !== '00:00:00:00:00:00')
+        .map((i) => i.mac)
+        .sort();
+    return [(0, node_os_1.hostname)(), (0, node_os_1.cpus)()[0]?.model ?? '', macs[0] ?? ''].join('|');
+}
+//# sourceMappingURL=fingerprint.js.map

package/dist/fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../src/fingerprint.ts"],"names":[],"mappings":";;;AA4CA,sCAaC;AAzDD,2DAA8C;AAC9C,+CAA4C;AAC5C,qCAAsE;AACtE,yCAAkC;AAClC,yCAAsC;AAEtC,MAAM,aAAa,GAAG,IAAA,qBAAS,EAAC,6BAAQ,CAAC,CAAC;AAE1C;;;GAGG;AACU,QAAA,KAAK,GAAG,iBAAiB,CAAC;AAC1B,QAAA,OAAO,GAAG;IACrB,gCAAgC;IAChC,iBAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,aAAa,EAAE,UAAU,EAAE,SAAS,CAAC;CAC3E,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC;AAC/C,QAAA,cAAc,GAAG,CAAC,iBAAiB,EAAE,0BAA0B,CAAC,CAAC;AAiB9E,4FAA4F;AAC5F,MAAa,yBAA0B,SAAQ,KAAK;IACzC,IAAI,GAAG,wBAAwB,CAAC;IACzC;QACE,KAAK,CAAC,oGAAoG,CAAC,CAAC;QAC5G,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAND,8DAMC;AAED,2HAA2H;AACpH,KAAK,UAAU,aAAa,CAAC,OAAsB,EAAE;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC;IACjD,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC;IAChC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;QACrD,MAAM,EAAE,GAAG,MAAM,eAAe,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,EAAE;YAAE,OAAO,EAAE,CAAC;QAClB,IAAI,OAAO,GAAG,QAAQ,EAAE,CAAC;YACvB,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;YAC3D,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;IACH,CAAC;IACD,IAAI,IAAI,CAAC,aAAa;QAAE,OAAO,YAAY,cAAc,EAAE,EAAE,CAAC;IAC9D,MAAM,IAAI,yBAAyB,EAAE,CAAC;AACxC,CAAC;AAED,yDAAyD;AACzD,KAAK,UAAU,eAAe,CAAC,IAAmB;IAChD,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAA,kBAAQ,GAAE,CAAC;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACtF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAA,mBAAQ,EAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;YACpB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,aAAK,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,wBAAwB,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YACpH,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAC3D,IAAI,CAAC;gBAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9B,CAAC;aAAM,IAAI,EAAE,KAAK,OAAO,EAAE,CAAC;YAC1B,KAAK,MAAM,GAAG,IAAI,eAAO,EAAE,CAAC;gBAC1B,IAAI,CAAC;oBACH,uFAAuF;oBACvF,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,yCAAyC,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE;wBACtH,OAAO,EAAE,IAAI;wBACb,WAAW,EAAE,IAAI;qBAClB,CAAC,CAAC;oBACH,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;oBAC3D,IAAI,CAAC;wBAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9B,CAAC;gBAAC,MAAM,CAAC;oBACP,2BAA2B;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,CAAC,IAAI,sBAAc,EAAE,CAAC;gBAC/B,MAAM,EAAE,GAAG,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACtD,IAAI,EAAE;oBAAE,OAAO,SAAS,EAAE,EAAE,CAAC;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kBAAkB;IACpB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,cAAc;IACrB,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAA,2BAAiB,GAAE,CAAC;SAC5C,IAAI,EAAE;SACN,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,KAAK,mBAAmB,CAAC;SACzE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAE,CAAC,GAAG,CAAC;SAClB,IAAI,EAAE,CAAC;IACV,OAAO,CAAC,IAAA,kBAAQ,GAAE,EAAE,IAAA,cAAI,GAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvE,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,173 @@
+import { MachineIdUnavailableError, readMachineId } from './fingerprint';
+export { MachineIdUnavailableError, readMachineId };
+/** This SDK's version, sent to the server so vendors can see (and require) which SDK each device runs. */
+export declare const SDK_VERSION: string;
+export type LicenseStatus = 'valid' | 'grace' | 'invalid' | 'unlicensed' | 'clock_suspect';
+/**
+ * Something the server asks the app to act on: sdk_update_recommended (update the Carcha Seal SDK in the app) or
+ * app_update_recommended (the vendor's minimum app version), each with minimum and requiredFrom.
+ */
+export interface LicenseNotice {
+    code: string;
+    minimum?: string;
+    /** ISO date from which an older SDK is refused; null when the update is only recommended. */
+    requiredFrom?: string | null;
+}
+export interface LicenseState {
+    status: LicenseStatus;
+    offline: boolean;
+    storageProtected: boolean;
+    reason?: string;
+    message?: string;
+    customer?: string;
+    features: string[];
+    expiresAt: string | null;
+    maintenanceUntil?: string | null;
+    revalidateBy?: string;
+    keyHint?: string;
+    /** From the last successful check-in; kept while offline. The app decides how to show them. */
+    notices?: LicenseNotice[];
+    /** True when the license came from an offline license file (activateOffline); renew it with a new file. */
+    offlineActivated?: boolean;
+}
+/** Hashed hardware components (see @carchalabs/seal-hwid); the server matches a device by them. */
+export interface HardwareReport {
+    components: {
+        kind: string;
+        hash: string;
+    }[];
+    /** True when the device runs as a virtual machine. */
+    vm: boolean;
+}
+export interface SecureStore {
+    encrypt(plain: string): Buffer | Promise<Buffer>;
+    decrypt(cipher: Buffer): string | Promise<string>;
+    isProtected?(): boolean;
+}
+export interface SealOptions {
+    /** The license server: https://, or http:// on this computer only (localhost, 127.x.x.x, [::1]). */
+    serverUrl: string;
+    product: string;
+    publicKey: string | string[];
+    storageDir: string;
+    appVersion?: string;
+    graceDays?: number;
+    secureStore?: SecureStore;
+    requestTimeoutMs?: number;
+    fetchImpl?: typeof fetch;
+    machineId?: () => Promise<string>;
+    /** Use hostname + CPU + MAC when the OS machine id cannot be read (default false; see readMachineId). */
+    allowFallbackFingerprint?: boolean;
+    /**
+     * Hardware components sent with each request, so the device keeps its seat after a new disk, network
+     * card or OS install. Default: read with @carchalabs/seal-hwid when it is installed; nothing is
+     * sent when it is not (or cannot load on this platform). false: never send them. A function: your own.
+     */
+    hardware?: false | (() => HardwareReport | null | Promise<HardwareReport | null>);
+    now?: () => number;
+}
+export declare class LicenseError extends Error {
+    readonly code: string;
+    readonly status?: number | undefined;
+    constructor(code: string, message: string, status?: number | undefined);
+}
+export declare class Seal {
+    private readonly opts;
+    private readonly file;
+    private readonly keys;
+    private fingerprintCache?;
+    private hardwareCache?;
+    /** The native lease verifier, when it trusts every key this app was given (undefined = not looked up yet). */
+    private nativeLease?;
+    private deviceKeyCache?;
+    constructor(opts: SealOptions);
+    private get fetch();
+    private nowSec;
+    private get storageProtected();
+    fingerprint(): Promise<string>;
+    /** Read once per instance: hardware does not change while the app runs. Never throws. */
+    private hardware;
+    /** The saved record; null when there is none, or it cannot be read or is not a record (as no license). */
+    private load;
+    /** Replaces license.dat whole: written to license.dat.tmp, then renamed over it, so a crash or full disk mid-write
+     * leaves the previous record. */
+    private save;
+    private clear;
+    private post;
+    private emptyState;
+    /**
+     * The device's public key, sent with activation and check-ins so the server wraps feature keys for
+     * this machine only. Only when the native module verifies for this app (it then also decrypts, with
+     * the matching secret it derives itself) and hardware is not turned off. Never throws.
+     */
+    private deviceKey;
+    /**
+     * The native verifier, used only when its compiled-in keys include every key this app was given:
+     * an app that trusts other keys (a self-hosted server) is checked by the JavaScript verifier alone.
+     */
+    private native;
+    /**
+     * Verifies a lease twice, in JavaScript and in the native module, when the native verifier applies.
+     * Both follow the same rules, so a different answer means one of them was tampered with: the lease
+     * is then treated as modified.
+     */
+    private verify;
+    private stateFromLease;
+    /** machineName: the name to show the vendor for this device. Nothing is sent when the app gives none (host names often hold a person's name). */
+    activate(licenseKey: string, machineName?: string): Promise<LicenseState>;
+    check(): Promise<LicenseState>;
+    /** The state from the saved record when the server gave no usable answer; a usable lease moves lastSeen forward. */
+    private offlineCheck;
+    /**
+     * Decrypts data you encrypted for a feature (encryptForFeature in @carchalabs/seal-core, with the
+     * feature's content key from the console). Works offline: it uses the saved lease, which must be valid
+     * (or in its offline grace period), grant the feature and carry its key, and the saved license key.
+     * The native module does the work when it trusts this app's keys, so the content key never reaches
+     * JavaScript; without it the JavaScript implementation is used. Throws a LicenseError:
+     * `unlicensed`, a lease failure reason, `clock_suspect`, `feature_not_licensed` or `decrypt_failed`.
+     */
+    decrypt(feature: string, data: Uint8Array): Promise<Buffer>;
+    /**
+     * Envelope: loads a CommonJS module you encrypted for a feature (seal-encrypt, one file or a
+     * folder) and returns its exports, like require(). The code is decrypted with the lease's feature key
+     * (see decrypt) and compiled from memory; it never exists as a plain file. Relative requires inside
+     * it load encrypted neighbours (`./x` finds `x.lke`, `x.js.lke` or `x/index.js.lke`), anything else
+     * goes to Node as usual. Loaded once per process, like require(). Throws the same LicenseErrors as
+     * decrypt. A licensed user can still read the code from memory: this keeps an app with the license
+     * check removed from having the feature, it does not hide the code from its licensed users.
+     */
+    requireEncrypted(feature: string, file: string): Promise<any>;
+    private readonly encryptedModules;
+    private loadEncrypted;
+    /**
+     * Checks the saved lease once for a feature and returns a synchronous decrypter bound to it: decrypt
+     * uses it once, requireEncrypted for a module and the encrypted modules it requires.
+     */
+    private opener;
+    /**
+     * Offline activation, step 1 on a machine that cannot reach the server: the request file (JSON text)
+     * the user takes to a connected device. The license server turns it into a license file at
+     * POST /v1/offline/activate (or its offline activation page). It holds what activate() would send:
+     * the license key, this device's fingerprint and hashed hardware parts, never raw serial numbers.
+     */
+    offlineRequest(licenseKey: string, machineName?: string): Promise<string>;
+    /**
+     * Offline activation, step 2: loads the license file the server issued for this machine's request.
+     * It is verified like an online lease (signature, product, this device) and then saved; from then on
+     * check() works without the server until the lease's renewal date plus the offline grace. Throws a
+     * LicenseError: `invalid_file`, `wrong_product`, or a lease failure reason such as `wrong_device`.
+     */
+    activateOffline(licenseFile: string): Promise<LicenseState>;
+    /**
+     * Gives an offline machine's seat back: removes the license from this device and returns the
+     * deactivation file (JSON text) for the vendor, who frees the seat by uploading it in the console.
+     * Throws `unlicensed` when there is no license to remove.
+     */
+    deactivateOffline(): Promise<string>;
+    deactivate(): Promise<void>;
+    static hasFeature(state: LicenseState, feature: string): boolean;
+}
+/** The SDK class under its earlier name (LicenseKit). Same class; use Seal in new code. */
+export { Seal as LicenseKit };
+/** @deprecated The options under the class's earlier name; use SealOptions. */
+export type LicenseKitOptions = SealOptions;