@moonbase.sh/licensing 0.0.0-next-20260729150401

package/dist/index.js

@@ -0,0 +1,863 @@
+// src/index.ts
+import { Buffer as Buffer2 } from "buffer";
+import process3 from "process";
+
+// src/client.ts
+import fetch from "cross-fetch";
+
+// src/schemas.ts
+import { z } from "zod";
+
+// src/types.ts
+var ActivationMethod = /* @__PURE__ */ ((ActivationMethod2) => {
+  ActivationMethod2["Online"] = "Online";
+  ActivationMethod2["Offline"] = "Offline";
+  return ActivationMethod2;
+})(ActivationMethod || {});
+
+// src/schemas.ts
+var activationRequestResponseSchema = z.object({
+  id: z.string(),
+  request: z.string(),
+  browser: z.string()
+});
+var productSchema = z.object({
+  id: z.string(),
+  name: z.string(),
+  currentReleaseVersion: z.string().nullish(),
+  properties: z.record(z.unknown()).nullish()
+});
+var userSchema = z.object({
+  id: z.string(),
+  name: z.string(),
+  email: z.string(),
+  properties: z.record(z.unknown()).nullish()
+});
+var licenseSchema = z.object({
+  id: z.string(),
+  trial: z.boolean(),
+  activationMethod: z.nativeEnum(ActivationMethod),
+  product: productSchema,
+  ownedSubProductIds: z.array(z.string()).default([]),
+  subscriptionId: z.string().nullish(),
+  issuedAt: z.coerce.date(),
+  issuedTo: userSchema,
+  expiresAt: z.coerce.date().nullish(),
+  validatedAt: z.coerce.date(),
+  properties: z.record(z.unknown()).nullish(),
+  token: z.string()
+});
+
+// src/client.ts
+var defaultFetchOptions = {
+  method: "GET",
+  mode: "cors",
+  headers: {
+    "Accept": "application/json",
+    "Content-Type": "application/json",
+    "x-mb-client": `moonbase.js`
+  }
+};
+var LicenseClient = class {
+  constructor(configuration, deviceIdResolver, licenseValidator) {
+    this.configuration = configuration;
+    this.deviceIdResolver = deviceIdResolver;
+    this.licenseValidator = licenseValidator;
+  }
+  async requestActivation() {
+    const content = {
+      deviceName: await this.deviceIdResolver.resolveDeviceName(),
+      deviceSignature: await this.deviceIdResolver.resolveDeviceId()
+    };
+    const response = await fetch(`${this.configuration.endpoint}/api/client/activations/${this.configuration.productId}/request${this.buildQueryString()}`, {
+      ...defaultFetchOptions,
+      method: "POST",
+      body: JSON.stringify(content)
+    });
+    if (response.status >= 400) {
+      throw new MoonbaseError("Request not successful", `The API responded with a ${response.status} ${response.statusText} response`, "ApiError" /* ApiError */);
+    }
+    try {
+      return activationRequestResponseSchema.parse(await response.json());
+    } catch (err) {
+      const error = err;
+      throw new MoonbaseError(
+        "Could not request activation",
+        error.message,
+        "ApiError" /* ApiError */,
+        error
+      );
+    }
+  }
+  async getRequestedActivation(request) {
+    const response = await fetch(request.request, defaultFetchOptions);
+    if (response.status === 204 || response.status === 404)
+      return null;
+    return await this.handleLicenseResponse(response);
+  }
+  async requestTrial() {
+    const content = {
+      deviceName: await this.deviceIdResolver.resolveDeviceName(),
+      deviceSignature: await this.deviceIdResolver.resolveDeviceId()
+    };
+    const response = await fetch(`${this.configuration.endpoint}/api/client/trials/${this.configuration.productId}/request${this.buildQueryString()}`, {
+      ...defaultFetchOptions,
+      method: "POST",
+      headers: {
+        ...defaultFetchOptions.headers,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(content)
+    });
+    return await this.handleLicenseResponse(response);
+  }
+  async validateLicense(license) {
+    const response = await fetch(`${this.configuration.endpoint}/api/client/licenses/${this.configuration.productId}/validate${this.buildQueryString()}`, {
+      ...defaultFetchOptions,
+      method: "POST",
+      headers: {
+        ...defaultFetchOptions.headers,
+        "Content-Type": "text/plain"
+      },
+      body: license.token
+    });
+    return await this.handleLicenseResponse(response);
+  }
+  async validateRawLicense(rawLicense) {
+    const license = await this.licenseValidator.validateLicense(rawLicense.toString("utf8"));
+    if (license.activationMethod === "Offline" /* Offline */)
+      return license;
+    return await this.validateLicense(license);
+  }
+  async revokeLicense(license) {
+    const response = await fetch(`${this.configuration.endpoint}/api/client/licenses/${this.configuration.productId}/revoke?format=JWT`, {
+      ...defaultFetchOptions,
+      method: "POST",
+      headers: {
+        ...defaultFetchOptions.headers,
+        "Content-Type": "text/plain"
+      },
+      body: license.token
+    });
+    if (response.status >= 400) {
+      throw new MoonbaseError("Request not successful", `The API responded with a ${response.status} ${response.statusText} response`, "ApiError" /* ApiError */);
+    }
+  }
+  async handleLicenseResponse(response) {
+    if (response.status >= 400) {
+      throw new MoonbaseError("Request not successful", `The API responded with a ${response.status} ${response.statusText} response`, "ApiError" /* ApiError */);
+    }
+    return await this.licenseValidator.validateLicense(await response.text());
+  }
+  buildQueryString() {
+    const parts = ["format=JWT"];
+    const { platform, appVersion, metadata } = this.configuration;
+    if (platform)
+      parts.push(`platform=${encodeURIComponent(platform)}`);
+    if (appVersion)
+      parts.push(`appVersion=${encodeURIComponent(appVersion)}`);
+    if (metadata) {
+      for (const [key, value] of Object.entries(metadata)) {
+        if (value === null || value === void 0 || value === "")
+          continue;
+        parts.push(`meta[${encodeURIComponent(key)}]=${encodeURIComponent(value)}`);
+      }
+    }
+    return `?${parts.join("&")}`;
+  }
+};
+
+// src/deviceIdResolver.ts
+import cp2 from "child_process";
+import { createHash as createHash2 } from "crypto";
+import os2 from "os";
+import process2 from "process";
+import si from "systeminformation";
+
+// src/errors.ts
+var ErrorType = /* @__PURE__ */ ((ErrorType2) => {
+  ErrorType2["None"] = "None";
+  ErrorType2["ApiError"] = "ApiError";
+  ErrorType2["NoEligibleLicense"] = "NoEligibleLicense";
+  ErrorType2["LicenseInvalid"] = "LicenseInvalid";
+  ErrorType2["LicenseRevoked"] = "LicenseRevoked";
+  ErrorType2["LicenseActivationRevoked"] = "LicenseActivationRevoked";
+  ErrorType2["LicenseExpired"] = "LicenseExpired";
+  ErrorType2["LicenseDeviceMismatch"] = "LicenseDeviceMismatch";
+  ErrorType2["DeviceIdentityUnavailable"] = "DeviceIdentityUnavailable";
+  return ErrorType2;
+})(ErrorType || {});
+var MoonbaseError = class extends Error {
+  constructor(title, detail, type, inner) {
+    super();
+    this.title = title;
+    this.detail = detail;
+    this.type = type;
+    this.inner = inner;
+    this.name = "MoonbaseError";
+    this.message = detail != null ? detail : title;
+  }
+};
+var InsufficientDeviceIdentityError = class extends MoonbaseError {
+  constructor(platform, reason = "no identity parameter could be read") {
+    super(
+      "No device identity",
+      `Could not identify this device (platform: ${platform}): ${reason}`,
+      "DeviceIdentityUnavailable" /* DeviceIdentityUnavailable */
+    );
+    this.platform = platform;
+    this.name = "InsufficientDeviceIdentityError";
+  }
+};
+
+// src/fingerprint.ts
+import { Buffer } from "buffer";
+import cp from "child_process";
+import { createHash } from "crypto";
+import fs from "fs";
+import os from "os";
+import process from "process";
+var FINGERPRINT_PREFIX = "moonbase:fingerprint:v2";
+var FINGERPRINT_VERSION = 2;
+var MAX_VALUE_LENGTH = 128;
+var PRINTABLE_ASCII_MIN = 32;
+var PRINTABLE_ASCII_MAX = 126;
+var STAMP_PATTERN = /^mbd(\d+)(n?)_([0-9a-f]{64})$/;
+function canonicalizeValue(value) {
+  var _a;
+  let printable = "";
+  for (const char of value.normalize("NFC")) {
+    const code = (_a = char.codePointAt(0)) != null ? _a : 0;
+    if (code >= PRINTABLE_ASCII_MIN && code <= PRINTABLE_ASCII_MAX)
+      printable += char;
+  }
+  return printable.slice(0, MAX_VALUE_LENGTH).replace(/^ +| +$/g, "");
+}
+function platformTag(platform = process.platform) {
+  switch (platform) {
+    case "darwin":
+      return "mac";
+    case "win32":
+      return "windows";
+    case "android":
+      return "android";
+    case "linux":
+      return "linux";
+    case "freebsd":
+    case "openbsd":
+    case "netbsd":
+      return "bsd";
+    default:
+      return "unknown";
+  }
+}
+var IDENTIFYING_PARAMS = /* @__PURE__ */ new Set([
+  "ioPlatformUuid",
+  "machineId",
+  "systemUuid",
+  "baseboardSerialNumber",
+  "deviceName"
+]);
+var IDENTIFYING_PARAM_NAMES = Object.freeze([...IDENTIFYING_PARAMS]);
+var NOT_PROGRAMMED_VALUES = /* @__PURE__ */ new Set([
+  "to be filled by o.e.m.",
+  // The same filler without the dots, which plenty of firmware writes instead.
+  "to be filled by oem",
+  "default string",
+  "system serial number",
+  "base board serial number",
+  "chassis serial number",
+  "not specified",
+  "not applicable",
+  "not available",
+  "none",
+  "unknown",
+  "invalid",
+  "n/a",
+  "0123456789",
+  // `machine-id(5)`: the literal marker systemd writes to say "no id yet",
+  // e.g. in an initrd or a golden image awaiting first boot. Every machine
+  // deployed from such an image reads it, so it is the opposite of an identifier.
+  "uninitialized"
+]);
+function isNotProgrammed(value) {
+  return NOT_PROGRAMMED_VALUES.has(value.toLowerCase()) || /^0+$/.test(value) || /^f+$/i.test(value);
+}
+function canonicalizeParams(params) {
+  const kept = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const [name, rawValue] of params) {
+    const value = canonicalizeValue(rawValue);
+    if (value.length === 0)
+      continue;
+    if (IDENTIFYING_PARAMS.has(name) && isNotProgrammed(value))
+      continue;
+    if (seen.has(name))
+      throw new Error(`Duplicate fingerprint parameter name: ${name}`);
+    seen.add(name);
+    kept.push([name, value]);
+  }
+  return kept;
+}
+function buildFingerprintMaterial(platform, params) {
+  const kept = canonicalizeParams(params);
+  if (kept.length === 0)
+    throw new InsufficientDeviceIdentityError(platform, "no identity parameter could be read");
+  if (!kept.some(([name]) => IDENTIFYING_PARAMS.has(name))) {
+    throw new InsufficientDeviceIdentityError(
+      platform,
+      `only model-level parameters could be read (${kept.map(([name]) => name).join(", ")}), none of which identify this individual machine`
+    );
+  }
+  const lines = [FINGERPRINT_PREFIX, `platform=${platform}`];
+  for (const [name, value] of kept)
+    lines.push(`${name}=${value}`);
+  return lines.join("\n");
+}
+function fingerprintDigest(material) {
+  return createHash("sha256").update(material, "utf8").digest("hex");
+}
+function stampDeviceId(digest, source = "identity") {
+  return `mbd${FINGERPRINT_VERSION}${source === "deviceName" ? "n" : ""}_${digest}`;
+}
+function fingerprintDeviceId(material, source = "identity") {
+  return stampDeviceId(fingerprintDigest(material), source);
+}
+function parseDeviceIdStamp(deviceId) {
+  const match = STAMP_PATTERN.exec(deviceId);
+  if (!match)
+    return null;
+  return {
+    version: Number(match[1]),
+    source: match[2] === "n" ? "deviceName" : "identity",
+    digest: match[3]
+  };
+}
+function commandOutput(command) {
+  try {
+    return cp.execSync(command, { encoding: "utf8" });
+  } catch (e) {
+    return "";
+  }
+}
+function readSysFile(path2) {
+  try {
+    return fs.readFileSync(path2, "utf8");
+  } catch (e) {
+    return "";
+  }
+}
+function parseIoregPlatformUuid(ioregOutput) {
+  const match = ioregOutput.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/);
+  return match ? match[1].replaceAll("-", "").toUpperCase() : "";
+}
+function readMacIdentity() {
+  const uuid = parseIoregPlatformUuid(commandOutput("ioreg -rd1 -c IOPlatformExpertDevice"));
+  const params = [["ioPlatformUuid", uuid]];
+  return { params, deviceName: os.hostname().replace(/\.local$/i, "") };
+}
+function selectMachineId(...sources) {
+  var _a;
+  return (_a = sources.map(canonicalizeValue).find((value) => /^[0-9a-f]{32}$/.test(value) && !isNotProgrammed(value))) != null ? _a : "";
+}
+function readMachineId() {
+  return selectMachineId(
+    readSysFile("/etc/machine-id"),
+    readSysFile("/var/lib/dbus/machine-id")
+  );
+}
+function readLinuxIdentity() {
+  const params = [
+    ["machineId", readMachineId()],
+    ["sysVendor", readSysFile("/sys/class/dmi/id/sys_vendor")],
+    ["productName", readSysFile("/sys/class/dmi/id/product_name")],
+    ["boardVendor", readSysFile("/sys/class/dmi/id/board_vendor")],
+    ["boardName", readSysFile("/sys/class/dmi/id/board_name")]
+  ];
+  return { params, deviceName: os.hostname() };
+}
+function parseSmbiosStructures(data) {
+  const structures = [];
+  let offset = 0;
+  while (offset + 4 <= data.length) {
+    const type = data[offset];
+    const length = data[offset + 1];
+    if (length < 4 || offset + length > data.length)
+      break;
+    const formatted = data.subarray(offset, offset + length);
+    const strings = [];
+    let p = offset + length;
+    if (p + 1 < data.length && data[p] === 0 && data[p + 1] === 0) {
+      p += 2;
+    } else {
+      while (p < data.length) {
+        let end = p;
+        while (end < data.length && data[end] !== 0)
+          end++;
+        strings.push(data.toString("latin1", p, end));
+        p = end + 1;
+        if (p < data.length && data[p] === 0) {
+          p += 1;
+          break;
+        }
+      }
+    }
+    structures.push({ type, formatted, strings });
+    if (type === 127)
+      break;
+    offset = p;
+  }
+  return structures;
+}
+function resolveSmbiosString(structure, fieldOffset) {
+  if (fieldOffset >= structure.formatted.length)
+    return "";
+  const index = structure.formatted[fieldOffset];
+  if (index === 0 || index > structure.strings.length)
+    return "";
+  return structure.strings[index - 1];
+}
+function formatSmbiosUuid(structure, fieldOffset) {
+  if (fieldOffset + 16 > structure.formatted.length)
+    return "";
+  const bytes = structure.formatted.subarray(fieldOffset, fieldOffset + 16);
+  if (bytes.every((byte) => byte === 0) || bytes.every((byte) => byte === 255))
+    return "";
+  let hex = "";
+  for (const byte of bytes)
+    hex += byte.toString(16).padStart(2, "0").toUpperCase();
+  return hex;
+}
+function parseSmbiosParams(smbiosData) {
+  const structures = parseSmbiosStructures(smbiosData);
+  const params = [];
+  const system = structures.find((structure) => structure.type === 1);
+  if (system) {
+    params.push(["systemManufacturer", resolveSmbiosString(system, 4)]);
+    params.push(["systemProductName", resolveSmbiosString(system, 5)]);
+    params.push(["systemUuid", formatSmbiosUuid(system, 8)]);
+  }
+  const baseboard = structures.find((structure) => structure.type === 2);
+  if (baseboard) {
+    params.push(["baseboardManufacturer", resolveSmbiosString(baseboard, 4)]);
+    params.push(["baseboardProduct", resolveSmbiosString(baseboard, 5)]);
+    params.push(["baseboardSerialNumber", resolveSmbiosString(baseboard, 7)]);
+  }
+  return params;
+}
+function readWindowsSmbios() {
+  const script = "[Convert]::ToBase64String((Get-CimInstance -Namespace root/wmi -ClassName MSSmBios_RawSMBiosTables).SMBiosData)";
+  const output = commandOutput(`powershell -NoProfile -NonInteractive -Command "${script}"`);
+  try {
+    return Buffer.from(output.trim(), "base64");
+  } catch (e) {
+    return Buffer.alloc(0);
+  }
+}
+function readWindowsIdentity() {
+  return { params: parseSmbiosParams(readWindowsSmbios()), deviceName: os.hostname() };
+}
+function defaultDeviceIdentityReader(platform = process.platform) {
+  return {
+    read() {
+      switch (platform) {
+        case "darwin":
+          return readMacIdentity();
+        case "linux":
+          return readLinuxIdentity();
+        case "win32":
+          return readWindowsIdentity();
+        // android, bsd and anything else define no identity params: the spec
+        // has no stable hardware source for them, so they resolve to an
+        // insufficient-identity error unless the deviceName fallback is enabled.
+        default:
+          return { params: [], deviceName: os.hostname() };
+      }
+    }
+  };
+}
+
+// src/deviceIdResolver.ts
+var MoonbaseDeviceIdResolver = class {
+  constructor(options) {
+    var _a, _b, _c;
+    const platform = (_a = options == null ? void 0 : options.platform) != null ? _a : process2.platform;
+    this.platform = platformTag(platform);
+    this.reader = (_b = options == null ? void 0 : options.reader) != null ? _b : defaultDeviceIdentityReader(platform);
+    this.fallback = (_c = options == null ? void 0 : options.fallback) != null ? _c : "none";
+  }
+  async resolveDeviceName() {
+    return this.readIdentity().deviceName;
+  }
+  async resolveDeviceId() {
+    return this.compute().deviceId;
+  }
+  /**
+   * A fresh copy each call. The device binding is what activation sends and what
+   * validation compares, so handing out the resolver's own object would let a
+   * consumer that edits a diagnostic — or logs it through something that
+   * normalizes in place — silently change the id every later call returns.
+   */
+  async describeDevice() {
+    const described = this.compute();
+    return { ...described, paramNames: [...described.paramNames] };
+  }
+  compute() {
+    var _a;
+    (_a = this.described) != null ? _a : this.described = this.computeDescription();
+    return this.described;
+  }
+  /**
+   * Read identity at most once. Both halves of an activation request ask for it —
+   * the name and then the id — and a read can mean spawning `ioreg` or
+   * PowerShell, so reading per call would double the cost of every request and
+   * let the name and the id come from two different reads of the machine.
+   */
+  readIdentity() {
+    var _a;
+    (_a = this.identity) != null ? _a : this.identity = this.reader.read();
+    return this.identity;
+  }
+  computeDescription() {
+    const { params, deviceName } = this.readIdentity();
+    try {
+      return this.describe(params, "identity");
+    } catch (err) {
+      if (this.fallback !== "deviceName" || !(err instanceof InsufficientDeviceIdentityError))
+        throw err;
+      return this.describe([["deviceName", deviceName]], "deviceName");
+    }
+  }
+  describe(params, source) {
+    return {
+      deviceId: fingerprintDeviceId(buildFingerprintMaterial(this.platform, params), source),
+      version: FINGERPRINT_VERSION,
+      platform: this.platform,
+      source,
+      paramNames: canonicalizeParams(params).map(([name]) => name)
+    };
+  }
+};
+var MigratingDeviceIdResolver = class {
+  constructor(current, ...previous) {
+    this.current = current;
+    this.previous = previous;
+    const describe = current.describeDevice;
+    if (typeof describe === "function")
+      this.describeDevice = () => describe.call(current);
+  }
+  async resolveDeviceName() {
+    return this.current.resolveDeviceName();
+  }
+  async resolveDeviceId() {
+    return this.current.resolveDeviceId();
+  }
+  async acceptsDeviceId(deviceId) {
+    if (!this.previousIds) {
+      this.previousIds = Promise.all(this.previous.map(async (resolver) => {
+        try {
+          return await resolver.resolveDeviceId();
+        } catch (e) {
+          return "";
+        }
+      }));
+    }
+    return (await this.previousIds).some((previous) => previous.length > 0 && previous === deviceId);
+  }
+};
+var LegacyDeviceIdResolver = class {
+  async resolveDeviceName() {
+    switch (process2.platform) {
+      case "darwin":
+        try {
+          return cp2.execSync("scutil --get ComputerName").toString().trim();
+        } catch (e) {
+          return os2.hostname();
+        }
+      case "win32":
+        return process2.env.COMPUTERNAME || os2.hostname();
+      case "linux": {
+        const prettyname = cp2.execSync("hostnamectl --pretty").toString().trim();
+        return prettyname || os2.hostname();
+      }
+      default:
+        return os2.hostname();
+    }
+  }
+  async resolveDeviceId() {
+    const [cpu, hw] = await Promise.all([si.cpu(), si.system()]);
+    const parts = [
+      os2.hostname(),
+      hw.manufacturer,
+      hw.model,
+      hw.serial,
+      hw.uuid,
+      hw.sku,
+      cpu.manufacturer,
+      cpu.brand,
+      cpu.vendor,
+      cpu.family,
+      cpu.model
+    ];
+    const hash = createHash2("sha256").update(parts.join("")).digest();
+    return hash.toString("base64").replaceAll("=", "");
+  }
+};
+
+// src/store.ts
+import fsSync from "fs";
+import fs2 from "fs/promises";
+import path from "path";
+var InMemoryLicenseStore = class {
+  async loadLocalLicense() {
+    var _a;
+    return (_a = this.license) != null ? _a : null;
+  }
+  async storeLocalLicense(license) {
+    this.license = license;
+  }
+  async deleteLocalLicense() {
+    this.license = void 0;
+  }
+};
+var FileLicenseStore = class {
+  constructor(options) {
+    this.options = options;
+  }
+  async loadLocalLicense() {
+    if (!fsSync.existsSync(this.path))
+      return null;
+    try {
+      const file = await fs2.readFile(this.path, { encoding: "utf-8" });
+      const license = licenseSchema.parse(JSON.parse(file));
+      return license;
+    } catch (err) {
+      throw new MoonbaseError("File error", "Could not load local license", "LicenseInvalid" /* LicenseInvalid */, err);
+    }
+  }
+  async storeLocalLicense(license) {
+    await fs2.writeFile(this.path, JSON.stringify(license), { encoding: "utf-8" });
+  }
+  async deleteLocalLicense() {
+    if (!fsSync.existsSync(this.path))
+      return;
+    await fs2.rm(this.path);
+  }
+  get path() {
+    var _a, _b, _c, _d;
+    return path.resolve((_b = (_a = this.options) == null ? void 0 : _a.dir) != null ? _b : path.resolve(), (_d = (_c = this.options) == null ? void 0 : _c.licenseFileName) != null ? _d : "license.mb");
+  }
+};
+
+// src/validator.ts
+import jwt from "jsonwebtoken";
+import { z as z2 } from "zod";
+var licenseClaimsSchema = z2.object({
+  ["l:id" /* LicenseId */]: z2.string(),
+  ["trial" /* Trial */]: z2.string().or(z2.boolean()).transform((v) => v === true || v === "true").pipe(z2.boolean()),
+  ["method" /* ActivationMethod */]: z2.nativeEnum(ActivationMethod),
+  ["sig" /* ComputerSignature */]: z2.string(),
+  ["iat" /* IssuedAt */]: z2.number().transform((v) => new Date(v * 1e3)).pipe(z2.date()),
+  ["exp" /* ExpiresAt */]: z2.number().nullish().transform((v) => v ? new Date(v * 1e3) : void 0).pipe(z2.date().nullish()),
+  ["validated" /* ValidatedAt */]: z2.number().transform((v) => new Date(v * 1e3)).pipe(z2.date()),
+  ["p:id" /* ProductId */]: z2.string(),
+  ["p:name" /* ProductName */]: z2.string(),
+  ["p:rel" /* ProductReleaseVersion */]: z2.string().nullish(),
+  ["sp:owned" /* OwnedSubProducts */]: z2.string().nullish().transform((v) => v ? v.split(",") : []),
+  ["s:id" /* SubscriptionId */]: z2.string().nullish(),
+  ["u:id" /* UserId */]: z2.string(),
+  ["u:name" /* UserName */]: z2.string(),
+  ["u:email" /* UserEmail */]: z2.string(),
+  ["p:properties" /* ProductProperties */]: z2.record(z2.unknown()).nullish(),
+  ["u:properties" /* UserProperties */]: z2.record(z2.unknown()).nullish(),
+  ["l:properties" /* LicenseProperties */]: z2.record(z2.unknown()).nullish(),
+  ["t:properties" /* TrialProperties */]: z2.record(z2.unknown()).nullish()
+});
+var LicenseValidator = class {
+  constructor(configuration, deviceIdResolver) {
+    this.configuration = configuration;
+    this.deviceIdResolver = deviceIdResolver;
+  }
+  async validateLicense(token) {
+    const [license, claims] = await this.parseLicenseToken(token);
+    if (license.expiresAt && license.expiresAt < /* @__PURE__ */ new Date()) {
+      throw new MoonbaseError(
+        "License expired",
+        "This license has expired",
+        "LicenseExpired" /* LicenseExpired */
+      );
+    }
+    const expectedSignature = await this.deviceIdResolver.resolveDeviceId();
+    const boundSignature = claims["sig" /* ComputerSignature */];
+    if (expectedSignature !== boundSignature && !await this.acceptsHistoricalDeviceId(boundSignature))
+      throw deviceMismatchError(expectedSignature, boundSignature);
+    return license;
+  }
+  /**
+   * Give a {@link IMigratingDeviceIdResolver} the chance to vouch for a device id
+   * this machine used to have. Only consulted after the fast path fails, so
+   * apps that have not opted into a migration pay nothing.
+   */
+  async acceptsHistoricalDeviceId(boundSignature) {
+    const accepts = this.deviceIdResolver.acceptsDeviceId;
+    return typeof accepts === "function" && await accepts.call(this.deviceIdResolver, boundSignature);
+  }
+  parseLicenseToken(token) {
+    return new Promise((resolve, reject) => {
+      jwt.verify(token, this.configuration.publicKey, {
+        ignoreExpiration: true,
+        issuer: this.configuration.accountId,
+        audience: this.configuration.productId
+      }, (err, decoded) => {
+        var _a, _b, _c, _d, _e;
+        if (err) {
+          reject(new MoonbaseError(
+            "Could not validate license",
+            err.message,
+            "LicenseInvalid" /* LicenseInvalid */,
+            err
+          ));
+          return;
+        }
+        if (typeof decoded === "string") {
+          reject(new MoonbaseError(
+            "Could not validate license",
+            "The given license token could not be parsed",
+            "LicenseInvalid" /* LicenseInvalid */
+          ));
+          return;
+        }
+        try {
+          const claims = licenseClaimsSchema.parse(decoded);
+          resolve([{
+            id: claims["l:id" /* LicenseId */],
+            trial: claims["trial" /* Trial */],
+            activationMethod: claims["method" /* ActivationMethod */],
+            product: {
+              id: claims["p:id" /* ProductId */],
+              name: claims["p:name" /* ProductName */],
+              currentReleaseVersion: (_a = claims["p:rel" /* ProductReleaseVersion */]) != null ? _a : void 0,
+              properties: (_b = claims["p:properties" /* ProductProperties */]) != null ? _b : void 0
+            },
+            ownedSubProductIds: claims["sp:owned" /* OwnedSubProducts */],
+            subscriptionId: (_c = claims["s:id" /* SubscriptionId */]) != null ? _c : void 0,
+            issuedTo: {
+              id: claims["u:id" /* UserId */],
+              name: claims["u:name" /* UserName */],
+              email: claims["u:email" /* UserEmail */],
+              properties: (_d = claims["u:properties" /* UserProperties */]) != null ? _d : void 0
+            },
+            expiresAt: claims["exp" /* ExpiresAt */] || void 0,
+            issuedAt: claims["iat" /* IssuedAt */],
+            validatedAt: claims["validated" /* ValidatedAt */],
+            properties: (_e = claims["trial" /* Trial */] ? claims["t:properties" /* TrialProperties */] : claims["l:properties" /* LicenseProperties */]) != null ? _e : void 0,
+            token
+          }, claims]);
+        } catch (err2) {
+          const error = err2;
+          reject(new MoonbaseError(
+            "Could not validate license",
+            error.message,
+            "LicenseInvalid" /* LicenseInvalid */,
+            error
+          ));
+        }
+      });
+    });
+  }
+};
+function deviceMismatchError(expected, bound) {
+  const detail = "This license is not for this device";
+  const versionNote = describeVersionDifference(expected, bound);
+  return new MoonbaseError(
+    "License is for another device",
+    versionNote ? `${detail}. ${versionNote}` : detail,
+    "LicenseDeviceMismatch" /* LicenseDeviceMismatch */
+  );
+}
+function describeVersionDifference(expected, bound) {
+  const expectedStamp = parseDeviceIdStamp(expected);
+  if (!expectedStamp)
+    return null;
+  const boundStamp = parseDeviceIdStamp(bound);
+  if (boundStamp && boundStamp.version === expectedStamp.version)
+    return null;
+  if (boundStamp && boundStamp.version > expectedStamp.version) {
+    return `The binding was created by device fingerprint v${boundStamp.version}, which is newer than the v${expectedStamp.version} this SDK computes \u2014 update the SDK rather than re-activating, which would rebind the device to the older algorithm.`;
+  }
+  const boundVersion = boundStamp ? `device fingerprint v${boundStamp.version}` : "an SDK predating versioned device fingerprints";
+  return `The binding was created by ${boundVersion}, while this SDK computes v${expectedStamp.version}, so this may instead be the same machine bound under the older algorithm \u2014 re-activate to find out, or configure a MigratingDeviceIdResolver to keep accepting the previous id.`;
+}
+
+// src/index.ts
+function detectPlatform() {
+  if (typeof process3 === "undefined")
+    return void 0;
+  switch (process3.platform) {
+    case "darwin":
+      return "Mac";
+    case "win32":
+      return "Windows";
+    case "linux":
+      return "Linux";
+    default:
+      return void 0;
+  }
+}
+var MoonbaseLicensing = class {
+  constructor(configuration) {
+    var _a, _b;
+    this.configuration = {
+      ...configuration,
+      endpoint: configuration.endpoint.replace(/\/$/, ""),
+      platform: configuration.platform === void 0 ? detectPlatform() : configuration.platform
+    };
+    this.store = (_a = configuration.licenseStore) != null ? _a : new InMemoryLicenseStore();
+    this.deviceIdResolver = (_b = configuration.deviceIdResolver) != null ? _b : new MoonbaseDeviceIdResolver();
+    this.validator = new LicenseValidator(this.configuration, this.deviceIdResolver);
+    this.client = new LicenseClient(this.configuration, this.deviceIdResolver, this.validator);
+  }
+  async generateDeviceToken() {
+    const token = {
+      id: await this.deviceIdResolver.resolveDeviceId(),
+      name: await this.deviceIdResolver.resolveDeviceName(),
+      productId: this.configuration.productId,
+      format: "JWT"
+    };
+    const json = JSON.stringify(token);
+    return Buffer2.from(Buffer2.from(json).toString("base64"));
+  }
+  async readRawLicense(license) {
+    return await this.client.validateRawLicense(license);
+  }
+};
+export {
+  ActivationMethod,
+  ErrorType,
+  FINGERPRINT_PREFIX,
+  FINGERPRINT_VERSION,
+  FileLicenseStore,
+  IDENTIFYING_PARAM_NAMES,
+  InMemoryLicenseStore,
+  InsufficientDeviceIdentityError,
+  LegacyDeviceIdResolver,
+  LicenseClient,
+  LicenseValidator,
+  MAX_VALUE_LENGTH,
+  MigratingDeviceIdResolver,
+  MoonbaseDeviceIdResolver,
+  MoonbaseError,
+  MoonbaseLicensing,
+  buildFingerprintMaterial,
+  canonicalizeParams,
+  canonicalizeValue,
+  defaultDeviceIdentityReader,
+  fingerprintDeviceId,
+  fingerprintDigest,
+  parseDeviceIdStamp,
+  parseIoregPlatformUuid,
+  parseSmbiosParams,
+  platformTag,
+  selectMachineId,
+  stampDeviceId
+};