@corelicense/node 0.2.0

package/dist/core-license.js

@@ -0,0 +1,411 @@
+import { LicenseApiClient } from './client/license-api-client.js';
+import { PublicKeysClient } from './client/public-keys-client.js';
+import { FileCacheStore } from './cache/file-cache-store.js';
+import { PublicKeyResolver } from './crypto/public-key-resolver.js';
+import { verifyPolicyToken } from './crypto/verify-policy-token.js';
+import { LocalAudit } from './audit/local-audit.js';
+import { EventBus } from './events/event-bus.js';
+import { resolveInstanceId } from './instance/instance-id.js';
+import { FileInstallIdStore } from './instance/install-id.js';
+import { createExpressMiddleware } from './guards/express-middleware.js';
+import { createFastifyPlugin } from './guards/fastify-plugin.js';
+import { assertFeatureEnabled } from './guards/feature-guard.js';
+import { assertQuotaAvailable, assertWithinLimit, createEmptyUsage, todayDateString, } from './guards/quota-guard.js';
+import { guardWorker as runWorkerGuard } from './guards/worker-guard.js';
+import { guardCommand as runCommandGuard } from './guards/cli-guard.js';
+import { buildRuntimeConfigFromPolicy } from './runtime/runtime-config.js';
+import { LicenseExpiredError, LicenseInvalidError, LicenseRevokedError, LicenseSuspendedError, OfflineGraceExpiredError, } from './errors/license-error.js';
+import { PolicySignatureError } from './errors/policy-error.js';
+import { resolveApiUrl, parseEmbeddedApiUrl } from './env/resolve-api-url.js';
+const SDK_NAME = '@corelicense/node';
+const SDK_VERSION = '0.2.0';
+export class CoreLicense {
+    options;
+    cache;
+    apiClient;
+    publicKeyResolver;
+    audit;
+    events;
+    installIdStore;
+    instanceId = null;
+    resolvedProductId = null;
+    policy = null;
+    runtimeConfig = null;
+    backgroundTimer = null;
+    booted = false;
+    constructor(options) {
+        const baseOptions = {
+            cachePath: './storage/corelicense',
+            checkIntervalMs: 6 * 60 * 60 * 1000,
+            requestTimeoutMs: 5000,
+            offlineGrace: true,
+            defaultBlockMode: 'limited',
+            ...options,
+        };
+        const apiUrl = resolveApiUrl(baseOptions);
+        this.options = {
+            ...baseOptions,
+            apiUrl,
+        };
+        this.cache = new FileCacheStore(this.options.cachePath);
+        this.apiClient = this.createApiClient();
+        this.publicKeyResolver = this.createPublicKeyResolver();
+        this.audit = new LocalAudit(this.options.audit ?? { enabled: true });
+        this.events = new EventBus();
+        this.installIdStore = new FileInstallIdStore(this.options.cachePath);
+    }
+    async boot() {
+        await this.ensureApiEndpoint();
+        this.instanceId = await resolveInstanceId({
+            productId: this.options.productId,
+            licenseKey: this.options.licenseKey,
+            options: this.options.instance,
+        }, this.installIdStore);
+        await this.cache.set('instance.json', {
+            instanceId: this.instanceId,
+            productId: this.options.productId,
+        });
+        await this.publicKeyResolver.resolve();
+        const cachedToken = await this.cache.get('policy.token');
+        if (cachedToken) {
+            try {
+                await this.applyPolicyToken(cachedToken, { fromCache: true });
+            }
+            catch {
+                await this.cache.delete('policy.token');
+            }
+        }
+        if (!this.policy || this.shouldRefreshToken()) {
+            await this.refreshFromServer();
+        }
+        if (this.options.checkIntervalMs > 0) {
+            this.startBackgroundCheck();
+        }
+        this.booted = true;
+        await this.audit.log({
+            event: 'license_boot_complete',
+            status: this.policy?.status,
+            policyVersion: this.policy?.policyVersion,
+        });
+    }
+    async refresh() {
+        await this.refreshFromServer();
+        return this.getStatus();
+    }
+    async requireActive() {
+        this.ensureBooted();
+        const status = await this.getStatus();
+        switch (status.status) {
+            case 'active':
+            case 'limited':
+            case 'offline':
+                return;
+            case 'suspended':
+                throw new LicenseSuspendedError();
+            case 'revoked':
+                throw new LicenseRevokedError();
+            case 'expired':
+                throw new LicenseExpiredError();
+            case 'grace_expired':
+                throw new OfflineGraceExpiredError();
+            case 'invalid':
+            default:
+                throw new LicenseInvalidError();
+        }
+    }
+    async requireFeature(feature) {
+        this.ensureBooted();
+        await this.requireActive();
+        assertFeatureEnabled(this.policy, feature);
+        await this.audit.log({
+            event: 'feature_allowed',
+            feature,
+        });
+    }
+    async checkLimit(limitName, currentValue) {
+        this.ensureBooted();
+        assertWithinLimit(this.policy, limitName, currentValue);
+    }
+    async consumeQuota(quotaName, amount = 1) {
+        this.ensureBooted();
+        const usage = await this.getUsage();
+        const dailyLimit = this.policy?.limits[quotaName];
+        assertQuotaAvailable(usage, quotaName, amount, dailyLimit);
+        usage.quotas[quotaName] = (usage.quotas[quotaName] ?? 0) + amount;
+        await this.cache.set('usage.json', usage);
+        await this.audit.log({
+            event: 'quota_consumed',
+            quotaName,
+            amount,
+            total: usage.quotas[quotaName],
+        });
+    }
+    async getStatus() {
+        this.ensureBooted();
+        return this.resolveStatus();
+    }
+    async getPolicy() {
+        this.ensureBooted();
+        if (!this.policy) {
+            throw new LicenseInvalidError('No policy available');
+        }
+        return { ...this.policy };
+    }
+    async getRuntimeConfig() {
+        this.ensureBooted();
+        if (!this.runtimeConfig) {
+            throw new LicenseInvalidError('Runtime config is not available');
+        }
+        return { ...this.runtimeConfig };
+    }
+    express(options) {
+        return createExpressMiddleware(this, options);
+    }
+    fastifyPlugin(options) {
+        return createFastifyPlugin(this, options);
+    }
+    async guardWorker(name) {
+        this.ensureBooted();
+        const status = await this.getStatus();
+        await runWorkerGuard(status, name);
+        await this.requireFeature(`worker.${name}`);
+    }
+    async guardCommand(name) {
+        this.ensureBooted();
+        const status = await this.getStatus();
+        await runCommandGuard(status, name);
+    }
+    startBackgroundCheck() {
+        if (this.backgroundTimer) {
+            return;
+        }
+        this.backgroundTimer = setInterval(() => {
+            void this.runBackgroundRefresh();
+        }, this.options.checkIntervalMs);
+        if (typeof this.backgroundTimer.unref === 'function') {
+            this.backgroundTimer.unref();
+        }
+    }
+    stopBackgroundCheck() {
+        if (this.backgroundTimer) {
+            clearInterval(this.backgroundTimer);
+            this.backgroundTimer = null;
+        }
+    }
+    on(event, handler) {
+        this.events.on(event, handler);
+    }
+    ensureBooted() {
+        if (!this.booted) {
+            throw new LicenseInvalidError('CoreLicense.boot() must be called before use');
+        }
+    }
+    resolveStatus() {
+        if (!this.policy) {
+            return { status: 'invalid', message: 'No policy loaded' };
+        }
+        const now = Math.floor(Date.now() / 1000);
+        let status = this.policy.status;
+        let offline = false;
+        if (now > this.policy.expiresAt) {
+            if (this.options.offlineGrace && now <= this.policy.graceUntil) {
+                status = 'offline';
+                offline = true;
+            }
+            else if (now > this.policy.graceUntil) {
+                status = 'grace_expired';
+            }
+            else {
+                status = 'expired';
+            }
+        }
+        return {
+            status,
+            licenseId: this.policy.licenseId,
+            productId: this.policy.productId,
+            instanceId: this.policy.instanceId,
+            policyVersion: this.policy.policyVersion,
+            issuedAt: this.policy.issuedAt,
+            expiresAt: this.policy.expiresAt,
+            graceUntil: this.policy.graceUntil,
+            offline,
+        };
+    }
+    shouldRefreshToken() {
+        if (!this.policy) {
+            return true;
+        }
+        const now = Math.floor(Date.now() / 1000);
+        const refreshThreshold = 3600;
+        return this.policy.expiresAt - now <= refreshThreshold;
+    }
+    async refreshFromServer() {
+        const request = await this.buildCheckRequest();
+        try {
+            const response = await this.apiClient.check(request);
+            if (!response.ok || !response.policyToken) {
+                await this.handleOfflineFallback('license_check_failed');
+                return;
+            }
+            await this.persistApiUrlFromResponse(response.apiUrl);
+            await this.applyPolicyToken(response.policyToken);
+            await this.audit.log({
+                event: 'license_check_success',
+                status: response.status,
+                policyVersion: this.policy?.policyVersion,
+            });
+        }
+        catch {
+            await this.handleOfflineFallback('license_check_error');
+        }
+    }
+    async handleOfflineFallback(event) {
+        if (this.policy) {
+            const status = this.resolveStatus();
+            if (status.status === 'offline' || status.status === 'active' || status.status === 'limited') {
+                await this.events.emit('offlineMode', undefined);
+                await this.audit.log({ event, status: status.status, offline: true });
+                return;
+            }
+        }
+        if (!this.policy) {
+            throw new LicenseInvalidError('Unable to load license policy');
+        }
+    }
+    async applyPolicyToken(token, options = {}) {
+        const payload = await this.verifyTokenWithResolver(token);
+        this.validatePolicyBinding(payload);
+        const previousStatus = this.policy?.status;
+        this.policy = {
+            ...payload,
+            token,
+        };
+        this.runtimeConfig = buildRuntimeConfigFromPolicy(this.policy);
+        await this.cache.set('policy.token', token);
+        await this.cache.set('runtime.json', this.runtimeConfig);
+        if (previousStatus && previousStatus !== payload.status) {
+            await this.events.emit('statusChanged', this.resolveStatus());
+        }
+        await this.events.emit('policyUpdated', this.policy);
+        if (payload.status === 'revoked') {
+            await this.events.emit('licenseRevoked', undefined);
+        }
+        if (payload.status === 'suspended') {
+            await this.events.emit('licenseSuspended', undefined);
+        }
+        if (options.fromCache) {
+            await this.audit.log({
+                event: 'policy_loaded_from_cache',
+                status: payload.status,
+                policyVersion: payload.policyVersion,
+            });
+        }
+    }
+    async verifyTokenWithResolver(token) {
+        try {
+            return await this.verifyWithResolvedKeys(token, false);
+        }
+        catch (error) {
+            if (error instanceof PolicySignatureError && !this.publicKeyResolver.isPinned) {
+                await this.publicKeyResolver.invalidateCache();
+                return this.verifyWithResolvedKeys(token, true);
+            }
+            if (error instanceof PolicySignatureError && this.publicKeyResolver.isPinned) {
+                throw new PolicySignatureError('Pinned public key mismatch — update CORELICENSE_PUBLIC_KEY after key rotation');
+            }
+            throw error;
+        }
+    }
+    async verifyWithResolvedKeys(token, forceRefresh) {
+        const resolved = await this.publicKeyResolver.resolve(forceRefresh);
+        const key = this.publicKeyResolver.pickKeyForToken(token, resolved);
+        return verifyPolicyToken(token, { publicKey: key.publicKey });
+    }
+    validatePolicyBinding(payload) {
+        if (this.resolvedProductId) {
+            if (payload.productId !== this.resolvedProductId) {
+                throw new LicenseInvalidError('Policy productId mismatch');
+            }
+        }
+        else {
+            this.resolvedProductId = payload.productId;
+        }
+        if (this.instanceId && payload.instanceId !== this.instanceId) {
+            throw new LicenseInvalidError('Policy instanceId mismatch');
+        }
+    }
+    async buildCheckRequest() {
+        if (!this.instanceId) {
+            throw new LicenseInvalidError('Instance ID is not resolved');
+        }
+        return {
+            productId: this.options.productId,
+            licenseKey: this.options.licenseKey,
+            instanceId: this.instanceId,
+            appVersion: this.options.appVersion,
+            sdk: {
+                name: SDK_NAME,
+                version: SDK_VERSION,
+                runtime: 'node',
+                nodeVersion: process.version,
+            },
+        };
+    }
+    async getUsage() {
+        const today = todayDateString();
+        const cached = await this.cache.get('usage.json');
+        if (!cached || cached.date !== today) {
+            const fresh = createEmptyUsage(today);
+            await this.cache.set('usage.json', fresh);
+            return fresh;
+        }
+        return cached;
+    }
+    async runBackgroundRefresh() {
+        try {
+            await this.refreshFromServer();
+        }
+        catch (error) {
+            await this.audit.log({
+                event: 'background_refresh_failed',
+                message: error instanceof Error ? error.message : 'Unknown error',
+            });
+        }
+    }
+    createApiClient() {
+        return new LicenseApiClient({
+            apiUrl: this.options.apiUrl,
+            requestTimeoutMs: this.options.requestTimeoutMs,
+        });
+    }
+    createPublicKeyResolver() {
+        const publicKeysClient = new PublicKeysClient({
+            apiUrl: this.options.apiUrl,
+            requestTimeoutMs: this.options.requestTimeoutMs,
+        });
+        return new PublicKeyResolver({ productId: this.options.productId, publicKey: this.options.publicKey }, this.cache, publicKeysClient);
+    }
+    async ensureApiEndpoint() {
+        const cached = await this.cache.get('sdk.endpoint.json');
+        const resolved = resolveApiUrl(this.options, cached?.apiUrl ?? null);
+        if (resolved !== this.options.apiUrl) {
+            this.setApiUrl(resolved);
+        }
+    }
+    async persistApiUrlFromResponse(apiUrl) {
+        if (!apiUrl?.trim() || parseEmbeddedApiUrl(this.options.licenseKey)) {
+            return;
+        }
+        const normalized = apiUrl.trim().replace(/\/+$/, '');
+        await this.cache.set('sdk.endpoint.json', { apiUrl: normalized });
+        if (normalized !== this.options.apiUrl) {
+            this.setApiUrl(normalized);
+        }
+    }
+    setApiUrl(apiUrl) {
+        this.options.apiUrl = apiUrl;
+        this.apiClient = this.createApiClient();
+        this.publicKeyResolver = this.createPublicKeyResolver();
+    }
+}
+//# sourceMappingURL=core-license.js.map

package/dist/core-license.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"core-license.js","sourceRoot":"","sources":["../src/core-license.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EACL,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,eAAe,GAChB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,IAAI,cAAc,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,YAAY,IAAI,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAC3E,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAahE,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAyB,MAAM,0BAA0B,CAAC;AAErG,MAAM,QAAQ,GAAG,mBAAmB,CAAC;AACrC,MAAM,WAAW,GAAG,OAAO,CAAC;AAE5B,MAAM,OAAO,WAAW;IACd,OAAO,CAG2B;IAEzB,KAAK,CAAa;IAC3B,SAAS,CAAmB;IAC5B,iBAAiB,CAAoB;IAC5B,KAAK,CAAa;IAClB,MAAM,CAAW;IACjB,cAAc,CAAqB;IAE5C,UAAU,GAAkB,IAAI,CAAC;IACjC,iBAAiB,GAAkB,IAAI,CAAC;IACxC,MAAM,GAAkB,IAAI,CAAC;IAC7B,aAAa,GAAyB,IAAI,CAAC;IAC3C,eAAe,GAA0C,IAAI,CAAC;IAC9D,MAAM,GAAG,KAAK,CAAC;IAEvB,YAAY,OAA2B;QACrC,MAAM,WAAW,GAAG;YAClB,SAAS,EAAE,uBAAuB;YAClC,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;YACnC,gBAAgB,EAAE,IAAI;YACtB,YAAY,EAAE,IAAI;YAClB,gBAAgB,EAAE,SAAkB;YACpC,GAAG,OAAO;SACX,CAAC;QAEF,MAAM,MAAM,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,GAAG;YACb,GAAG,WAAW;YACd,MAAM;SACP,CAAC;QAEF,IAAI,CAAC,KAAK,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACxC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;QACxD,IAAI,CAAC,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,cAAc,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACvE,CAAC;IAED,KAAK,CAAC,IAAI;QACR,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE/B,IAAI,CAAC,UAAU,GAAG,MAAM,iBAAiB,CACvC;YACE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;YACjC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;YACnC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ;SAC/B,EACD,IAAI,CAAC,cAAc,CACpB,CAAC;QAEF,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,eAAe,EAAE;YACpC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;SAClC,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;QAEvC,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAS,cAAc,CAAC,CAAC;QAEjE,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;YAC9C,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACjC,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,GAAG,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC9B,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAEnB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YACnB,KAAK,EAAE,uBAAuB;YAC9B,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM;YAC3B,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAEtC,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,KAAK,QAAQ,CAAC;YACd,KAAK,SAAS,CAAC;YACf,KAAK,SAAS;gBACZ,OAAO;YACT,KAAK,WAAW;gBACd,MAAM,IAAI,qBAAqB,EAAE,CAAC;YACpC,KAAK,SAAS;gBACZ,MAAM,IAAI,mBAAmB,EAAE,CAAC;YAClC,KAAK,SAAS;gBACZ,MAAM,IAAI,mBAAmB,EAAE,CAAC;YAClC,KAAK,eAAe;gBAClB,MAAM,IAAI,wBAAwB,EAAE,CAAC;YACvC,KAAK,SAAS,CAAC;YACf;gBACE,MAAM,IAAI,mBAAmB,EAAE,CAAC;QACpC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAAe;QAClC,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3B,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAE3C,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YACnB,KAAK,EAAE,iBAAiB;YACxB,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,YAAoB;QACtD,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,SAAiB,EAAE,MAAM,GAAG,CAAC;QAC9C,IAAI,CAAC,YAAY,EAAE,CAAC;QAEpB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAElD,oBAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAE3D,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,MAAM,CAAC;QAClE,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;QAE1C,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;YACnB,KAAK,EAAE,gBAAgB;YACvB,SAAS;YACT,MAAM;YACN,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC;SAC/B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS;QACb,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC,aAAa,EAAE,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,SAAS;QACb,IAAI,CAAC,YAAY,EAAE,CAAC;QAEpB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,mBAAmB,CAAC,qBAAqB,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,IAAI,CAAC,YAAY,EAAE,CAAC;QAEpB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,mBAAmB,CAAC,iCAAiC,CAAC,CAAC;QACnE,CAAC;QAED,OAAO,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;IACnC,CAAC;IAED,OAAO,CAAC,OAA6B;QACnC,OAAO,uBAAuB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAED,aAAa,CAAC,OAA6B;QACzC,OAAO,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAAY;QAC5B,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,MAAM,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY;QAC7B,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACtC,MAAM,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,oBAAoB;QAClB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE;YACtC,KAAK,IAAI,CAAC,oBAAoB,EAAE,CAAC;QACnC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAEjC,IAAI,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACrD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,mBAAmB;QACjB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACpC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,EAAE,CACA,KAAQ,EACR,OAAgC;QAEhC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IACjC,CAAC;IAEO,YAAY;QAClB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,mBAAmB,CAAC,8CAA8C,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;QAC5D,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QAChC,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YAChC,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;gBAC/D,MAAM,GAAG,SAAS,CAAC;gBACnB,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;iBAAM,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;gBACxC,MAAM,GAAG,eAAe,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,MAAM,GAAG,SAAS,CAAC;YACrB,CAAC;QACH,CAAC;QAED,OAAO;YACL,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAChC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAChC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;YAClC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa;YACxC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC9B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAChC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,UAAU;YAClC,OAAO;SACR,CAAC;IACJ,CAAC;IAEO,kBAAkB;QACxB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,gBAAgB,GAAG,IAAI,CAAC;QAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,GAAG,GAAG,IAAI,gBAAgB,CAAC;IACzD,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE/C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAErD,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC1C,MAAM,IAAI,CAAC,qBAAqB,CAAC,sBAAsB,CAAC,CAAC;gBACzD,OAAO;YACT,CAAC;YAED,MAAM,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACtD,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAClD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;gBACnB,KAAK,EAAE,uBAAuB;gBAC9B,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa;aAC1C,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,CAAC,qBAAqB,CAAC,qBAAqB,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,qBAAqB,CAAC,KAAa;QAC/C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;YAEpC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC7F,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;gBACjD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBACtE,OAAO;YACT,CAAC;QACH,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,mBAAmB,CAAC,+BAA+B,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,KAAa,EACb,UAAmC,EAAE;QAErC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;QAE1D,IAAI,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAEpC,MAAM,cAAc,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;QAE3C,IAAI,CAAC,MAAM,GAAG;YACZ,GAAG,OAAO;YACV,KAAK;SACN,CAAC;QAEF,IAAI,CAAC,aAAa,GAAG,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/D,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;QAC5C,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAEzD,IAAI,cAAc,IAAI,cAAc,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;YACxD,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAErD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;gBACnB,KAAK,EAAE,0BAA0B;gBACjC,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,aAAa,EAAE,OAAO,CAAC,aAAa;aACrC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,uBAAuB,CAAC,KAAa;QACjD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,oBAAoB,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC;gBAC9E,MAAM,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,CAAC;gBAC/C,OAAO,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAClD,CAAC;YAED,IAAI,KAAK,YAAY,oBAAoB,IAAI,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,CAAC;gBAC7E,MAAM,IAAI,oBAAoB,CAC5B,+EAA+E,CAChF,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,sBAAsB,CAClC,KAAa,EACb,YAAqB;QAErB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACpE,OAAO,iBAAiB,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;IAChE,CAAC;IAEO,qBAAqB,CAAC,OAA2B;QACvD,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC3B,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,iBAAiB,EAAE,CAAC;gBACjD,MAAM,IAAI,mBAAmB,CAAC,2BAA2B,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,SAAS,CAAC;QAC7C,CAAC;QAED,IAAI,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YAC9D,MAAM,IAAI,mBAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,mBAAmB,CAAC,6BAA6B,CAAC,CAAC;QAC/D,CAAC;QAED,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;YACjC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;YACnC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;YACnC,GAAG,EAAE;gBACH,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,WAAW;gBACpB,OAAO,EAAE,MAAM;gBACf,WAAW,EAAE,OAAO,CAAC,OAAO;aAC7B;SACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAa,YAAY,CAAC,CAAC;QAE9D,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACrC,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACtC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YAC1C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,oBAAoB;QAChC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;gBACnB,KAAK,EAAE,2BAA2B;gBAClC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe;aAClE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEO,eAAe;QACrB,OAAO,IAAI,gBAAgB,CAAC;YAC1B,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;YAC3B,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB;SAChD,CAAC,CAAC;IACL,CAAC;IAEO,uBAAuB;QAC7B,MAAM,gBAAgB,GAAG,IAAI,gBAAgB,CAAC;YAC5C,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;YAC3B,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB;SAChD,CAAC,CAAC;QAEH,OAAO,IAAI,iBAAiB,CAC1B,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EACxE,IAAI,CAAC,KAAK,EACV,gBAAgB,CACjB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,mBAAmB,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC;QAErE,IAAI,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACrC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,yBAAyB,CAAC,MAAe;QACrD,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;YACpE,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QAElE,IAAI,UAAU,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,MAAc;QAC9B,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACxC,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC;IAC1D,CAAC;CACF"}

package/dist/crypto/key-loader.d.ts

@@ -0,0 +1,4 @@
+export type KeyFormat = 'spki' | 'pkcs8';
+export declare function loadPublicKey(keyMaterial: string, algorithm?: 'Ed25519' | 'RS256' | 'ES256'): Promise<CryptoKey>;
+export declare function loadPrivateKey(keyMaterial: string, algorithm?: 'Ed25519' | 'RS256' | 'ES256'): Promise<CryptoKey>;
+//# sourceMappingURL=key-loader.d.ts.map

package/dist/crypto/key-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-loader.d.ts","sourceRoot":"","sources":["../../src/crypto/key-loader.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAEzC,wBAAsB,aAAa,CACjC,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,SAAS,GAAG,OAAO,GAAG,OAAmB,GACnD,OAAO,CAAC,SAAS,CAAC,CAGpB;AAED,wBAAsB,cAAc,CAClC,WAAW,EAAE,MAAM,EACnB,SAAS,GAAE,SAAS,GAAG,OAAO,GAAG,OAAmB,GACnD,OAAO,CAAC,SAAS,CAAC,CAGpB"}

package/dist/crypto/key-loader.js

@@ -0,0 +1,19 @@
+import { importSPKI, importPKCS8 } from 'jose';
+export async function loadPublicKey(keyMaterial, algorithm = 'Ed25519') {
+    const normalized = normalizeKeyMaterial(keyMaterial);
+    return importSPKI(normalized, algorithm);
+}
+export async function loadPrivateKey(keyMaterial, algorithm = 'Ed25519') {
+    const normalized = normalizeKeyMaterial(keyMaterial);
+    return importPKCS8(normalized, algorithm);
+}
+function normalizeKeyMaterial(keyMaterial) {
+    const trimmed = keyMaterial.trim();
+    if (trimmed.includes('BEGIN')) {
+        return trimmed;
+    }
+    // Assume base64-encoded SPKI without PEM headers
+    const wrapped = trimmed.match(/.{1,64}/g)?.join('\n') ?? trimmed;
+    return `-----BEGIN PUBLIC KEY-----\n${wrapped}\n-----END PUBLIC KEY-----`;
+}
+//# sourceMappingURL=key-loader.js.map

package/dist/crypto/key-loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-loader.js","sourceRoot":"","sources":["../../src/crypto/key-loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAI/C,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,WAAmB,EACnB,YAA2C,SAAS;IAEpD,MAAM,UAAU,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACrD,OAAO,UAAU,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,WAAmB,EACnB,YAA2C,SAAS;IAEpD,MAAM,UAAU,GAAG,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACrD,OAAO,WAAW,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,oBAAoB,CAAC,WAAmB;IAC/C,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IAEnC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,iDAAiD;IACjD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC;IACjE,OAAO,+BAA+B,OAAO,4BAA4B,CAAC;AAC5E,CAAC"}

package/dist/crypto/public-key-resolver.d.ts

@@ -0,0 +1,16 @@
+import type { CacheStore } from '../cache/cache-store.js';
+import type { PublicKeysClient } from '../client/public-keys-client.js';
+import type { CoreLicenseOptions } from '../types/options.js';
+import type { ProductPublicKey, ResolvedPublicKeys } from '../types/public-keys.js';
+export declare class PublicKeyResolver {
+    private readonly options;
+    private readonly cache;
+    private readonly client;
+    constructor(options: Pick<CoreLicenseOptions, 'productId' | 'publicKey'>, cache: CacheStore, client: PublicKeysClient);
+    get isPinned(): boolean;
+    resolve(forceRefresh?: boolean): Promise<ResolvedPublicKeys>;
+    invalidateCache(): Promise<void>;
+    pickKeyForToken(token: string, resolved: ResolvedPublicKeys): ProductPublicKey;
+    private isCacheValid;
+}
+//# sourceMappingURL=public-key-resolver.d.ts.map

package/dist/crypto/public-key-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-key-resolver.d.ts","sourceRoot":"","sources":["../../src/crypto/public-key-resolver.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,KAAK,EAEV,gBAAgB,EAChB,kBAAkB,EACnB,MAAM,yBAAyB,CAAC;AAIjC,qBAAa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAFN,OAAO,EAAE,IAAI,CAAC,kBAAkB,EAAE,WAAW,GAAG,WAAW,CAAC,EAC5D,KAAK,EAAE,UAAU,EACjB,MAAM,EAAE,gBAAgB;IAG3C,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAEK,OAAO,CAAC,YAAY,UAAQ,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA0B1D,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IAItC,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,kBAAkB,GAAG,gBAAgB;IAiB9E,OAAO,CAAC,YAAY;CAMrB"}

package/dist/crypto/public-key-resolver.js

@@ -0,0 +1,61 @@
+import { decodeProtectedHeader } from 'jose';
+const CACHE_TTL_MS = 6 * 60 * 60 * 1000;
+export class PublicKeyResolver {
+    options;
+    cache;
+    client;
+    constructor(options, cache, client) {
+        this.options = options;
+        this.cache = cache;
+        this.client = client;
+    }
+    get isPinned() {
+        return Boolean(this.options.publicKey?.trim());
+    }
+    async resolve(forceRefresh = false) {
+        if (this.isPinned) {
+            return {
+                mode: 'pinned',
+                keys: [{ kid: '*', alg: 'Ed25519', publicKey: this.options.publicKey.trim() }],
+            };
+        }
+        if (!forceRefresh) {
+            const cached = await this.cache.get('public.keys.json');
+            if (cached && this.isCacheValid(cached)) {
+                return { mode: 'fetched', keys: cached.keys };
+            }
+        }
+        const response = await this.client.fetchProductKeys(this.options.productId);
+        const entry = {
+            productId: this.options.productId,
+            keys: response.keys,
+            fetchedAt: Date.now(),
+        };
+        await this.cache.set('public.keys.json', entry);
+        return { mode: 'fetched', keys: entry.keys };
+    }
+    async invalidateCache() {
+        await this.cache.delete('public.keys.json');
+    }
+    pickKeyForToken(token, resolved) {
+        if (resolved.mode === 'pinned' || resolved.keys.length === 1) {
+            return resolved.keys[0];
+        }
+        const header = decodeProtectedHeader(token);
+        const kid = header.kid;
+        if (typeof kid === 'string') {
+            const match = resolved.keys.find((key) => key.kid === kid);
+            if (match) {
+                return match;
+            }
+        }
+        return resolved.keys[0];
+    }
+    isCacheValid(cached) {
+        if (cached.productId !== this.options.productId) {
+            return false;
+        }
+        return Date.now() - cached.fetchedAt < CACHE_TTL_MS;
+    }
+}
+//# sourceMappingURL=public-key-resolver.js.map

package/dist/crypto/public-key-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-key-resolver.js","sourceRoot":"","sources":["../../src/crypto/public-key-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,MAAM,CAAC;AAW7C,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAExC,MAAM,OAAO,iBAAiB;IAET;IACA;IACA;IAHnB,YACmB,OAA4D,EAC5D,KAAiB,EACjB,MAAwB;QAFxB,YAAO,GAAP,OAAO,CAAqD;QAC5D,UAAK,GAAL,KAAK,CAAY;QACjB,WAAM,GAAN,MAAM,CAAkB;IACxC,CAAC;IAEJ,IAAI,QAAQ;QACV,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,YAAY,GAAG,KAAK;QAChC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,OAAO;gBACL,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAU,CAAC,IAAI,EAAE,EAAE,CAAC;aAChF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmB,kBAAkB,CAAC,CAAC;YAC1E,IAAI,MAAM,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;gBACxC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;YAChD,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC5E,MAAM,KAAK,GAAqB;YAC9B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;YACjC,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;QAEhD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,eAAe;QACnB,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC9C,CAAC;IAED,eAAe,CAAC,KAAa,EAAE,QAA4B;QACzD,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;QAC3B,CAAC;QAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC;QACvB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;YAC3D,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC;IAC3B,CAAC;IAEO,YAAY,CAAC,MAAwB;QAC3C,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YAChD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,YAAY,CAAC;IACtD,CAAC;CACF"}

package/dist/crypto/verify-policy-token.d.ts

@@ -0,0 +1,7 @@
+import type { PolicyTokenPayload } from '../types/policy.js';
+export interface VerifyPolicyTokenOptions {
+    publicKey: string;
+    algorithm?: 'Ed25519' | 'RS256' | 'ES256';
+}
+export declare function verifyPolicyToken(token: string, options: VerifyPolicyTokenOptions): Promise<PolicyTokenPayload>;
+//# sourceMappingURL=verify-policy-token.d.ts.map

package/dist/crypto/verify-policy-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-policy-token.d.ts","sourceRoot":"","sources":["../../src/crypto/verify-policy-token.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAG7D,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;CAC3C;AAED,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,kBAAkB,CAAC,CAU7B"}

package/dist/crypto/verify-policy-token.js

@@ -0,0 +1,47 @@
+import { jwtVerify } from 'jose';
+import { PolicySignatureError } from '../errors/policy-error.js';
+import { loadPublicKey } from './key-loader.js';
+export async function verifyPolicyToken(token, options) {
+    try {
+        const key = await loadPublicKey(options.publicKey, options.algorithm ?? 'Ed25519');
+        const { payload } = await jwtVerify(token, key);
+        return mapPayload(payload);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : 'Unknown verification error';
+        throw new PolicySignatureError(message);
+    }
+}
+function mapPayload(payload) {
+    const required = [
+        'licenseId',
+        'productId',
+        'instanceId',
+        'status',
+        'features',
+        'limits',
+        'policyVersion',
+        'issuedAt',
+        'expiresAt',
+        'graceUntil',
+    ];
+    for (const field of required) {
+        if (payload[field] === undefined) {
+            throw new PolicySignatureError(`Policy token missing required field: ${field}`);
+        }
+    }
+    return {
+        licenseId: String(payload.licenseId),
+        productId: String(payload.productId),
+        customerId: payload.customerId ? String(payload.customerId) : undefined,
+        instanceId: String(payload.instanceId),
+        status: payload.status,
+        features: payload.features,
+        limits: payload.limits,
+        policyVersion: String(payload.policyVersion),
+        issuedAt: Number(payload.issuedAt),
+        expiresAt: Number(payload.expiresAt),
+        graceUntil: Number(payload.graceUntil),
+    };
+}
+//# sourceMappingURL=verify-policy-token.js.map

package/dist/crypto/verify-policy-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-policy-token.js","sourceRoot":"","sources":["../../src/crypto/verify-policy-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAmB,MAAM,MAAM,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAOhD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAa,EACb,OAAiC;IAEjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,SAAS,CAAC,CAAC;QACnF,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAEhD,OAAO,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,4BAA4B,CAAC;QACtF,MAAM,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,OAAmB;IACrC,MAAM,QAAQ,GAAG;QACf,WAAW;QACX,WAAW;QACX,YAAY;QACZ,QAAQ;QACR,UAAU;QACV,QAAQ;QACR,eAAe;QACf,UAAU;QACV,WAAW;QACX,YAAY;KACJ,CAAC;IAEX,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,oBAAoB,CAAC,wCAAwC,KAAK,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QACpC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QACpC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;QACvE,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;QACtC,MAAM,EAAE,OAAO,CAAC,MAAsC;QACtD,QAAQ,EAAE,OAAO,CAAC,QAA0C;QAC5D,MAAM,EAAE,OAAO,CAAC,MAAsC;QACtD,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC;QAC5C,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;QAClC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QACpC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;KACvC,CAAC;AACJ,CAAC"}

package/dist/env/load-options-from-env.d.ts

@@ -0,0 +1,7 @@
+import type { CoreLicenseOptions } from '../types/options.js';
+/**
+ * Build CoreLicense options from standard CORELICENSE_* environment variables.
+ * API URL is resolved automatically from the license key — no CORELICENSE_API_URL required.
+ */
+export declare function loadOptionsFromEnv(overrides?: Partial<CoreLicenseOptions>): CoreLicenseOptions;
+//# sourceMappingURL=load-options-from-env.d.ts.map

package/dist/env/load-options-from-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"load-options-from-env.d.ts","sourceRoot":"","sources":["../../src/env/load-options-from-env.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAU9D;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,GAAE,OAAO,CAAC,kBAAkB,CAAM,GAC1C,kBAAkB,CAyBpB"}