@moonbase.sh/licensing 2.0.1 → 3.1.0

package/dist/index.js

@@ -1,6 +1,13 @@
+// src/index.ts
+import { Buffer as Buffer2 } from "buffer";
+import process3 from "process";
+
 // src/client.ts
 import fetch from "cross-fetch";
 
+// src/schemas.ts
+import { z } from "zod";
+
 // src/types.ts
 var ActivationMethod = /* @__PURE__ */ ((ActivationMethod2) => {
   ActivationMethod2["Online"] = "Online";
@@ -9,7 +16,6 @@ var ActivationMethod = /* @__PURE__ */ ((ActivationMethod2) => {
 })(ActivationMethod || {});
 
 // src/schemas.ts
-import { z } from "zod";
 var activationRequestResponseSchema = z.object({
   id: z.string(),
   request: z.string(),
@@ -63,7 +69,7 @@ var LicenseClient = class {
       deviceName: await this.deviceIdResolver.resolveDeviceName(),
       deviceSignature: await this.deviceIdResolver.resolveDeviceId()
     };
-    const response = await fetch(this.configuration.endpoint + `/api/client/activations/${this.configuration.productId}/request${this.buildQueryString()}`, {
+    const response = await fetch(`${this.configuration.endpoint}/api/client/activations/${this.configuration.productId}/request${this.buildQueryString()}`, {
       ...defaultFetchOptions,
       method: "POST",
       body: JSON.stringify(content)
@@ -85,7 +91,8 @@ var LicenseClient = class {
   }
   async getRequestedActivation(request) {
     const response = await fetch(request.request, defaultFetchOptions);
-    if (response.status === 204 || response.status === 404) return null;
+    if (response.status === 204 || response.status === 404)
+      return null;
     return await this.handleLicenseResponse(response);
   }
   async requestTrial() {
@@ -93,7 +100,7 @@ var LicenseClient = class {
       deviceName: await this.deviceIdResolver.resolveDeviceName(),
       deviceSignature: await this.deviceIdResolver.resolveDeviceId()
     };
-    const response = await fetch(this.configuration.endpoint + `/api/client/trials/${this.configuration.productId}/request${this.buildQueryString()}`, {
+    const response = await fetch(`${this.configuration.endpoint}/api/client/trials/${this.configuration.productId}/request${this.buildQueryString()}`, {
       ...defaultFetchOptions,
       method: "POST",
       headers: {
@@ -105,7 +112,7 @@ var LicenseClient = class {
     return await this.handleLicenseResponse(response);
   }
   async validateLicense(license) {
-    const response = await fetch(this.configuration.endpoint + `/api/client/licenses/${this.configuration.productId}/validate${this.buildQueryString()}`, {
+    const response = await fetch(`${this.configuration.endpoint}/api/client/licenses/${this.configuration.productId}/validate${this.buildQueryString()}`, {
       ...defaultFetchOptions,
       method: "POST",
       headers: {
@@ -118,11 +125,12 @@ var LicenseClient = class {
   }
   async validateRawLicense(rawLicense) {
     const license = await this.licenseValidator.validateLicense(rawLicense.toString("utf8"));
-    if (license.activationMethod === "Offline" /* Offline */) return license;
+    if (license.activationMethod === "Offline" /* Offline */)
+      return license;
     return await this.validateLicense(license);
   }
   async revokeLicense(license) {
-    const response = await fetch(this.configuration.endpoint + `/api/client/licenses/${this.configuration.productId}/revoke?format=JWT`, {
+    const response = await fetch(`${this.configuration.endpoint}/api/client/licenses/${this.configuration.productId}/revoke?format=JWT`, {
       ...defaultFetchOptions,
       method: "POST",
       headers: {
@@ -144,11 +152,14 @@ var LicenseClient = class {
   buildQueryString() {
     const parts = ["format=JWT"];
     const { platform, appVersion, metadata } = this.configuration;
-    if (platform) parts.push(`platform=${encodeURIComponent(platform)}`);
-    if (appVersion) parts.push(`appVersion=${encodeURIComponent(appVersion)}`);
+    if (platform)
+      parts.push(`platform=${encodeURIComponent(platform)}`);
+    if (appVersion)
+      parts.push(`appVersion=${encodeURIComponent(appVersion)}`);
     if (metadata) {
       for (const [key, value] of Object.entries(metadata)) {
-        if (value === null || value === void 0 || value === "") continue;
+        if (value === null || value === void 0 || value === "")
+          continue;
         parts.push(`meta[${encodeURIComponent(key)}]=${encodeURIComponent(value)}`);
       }
     }
@@ -157,32 +168,486 @@ var LicenseClient = class {
 };
 
 // src/deviceIdResolver.ts
+import cp2 from "child_process";
+import { createHash as createHash2 } from "crypto";
+import os2 from "os";
+import process2 from "process";
 import si from "systeminformation";
-import os from "os";
+
+// src/errors.ts
+var ErrorType = /* @__PURE__ */ ((ErrorType2) => {
+  ErrorType2["None"] = "None";
+  ErrorType2["ApiError"] = "ApiError";
+  ErrorType2["NoEligibleLicense"] = "NoEligibleLicense";
+  ErrorType2["LicenseInvalid"] = "LicenseInvalid";
+  ErrorType2["LicenseRevoked"] = "LicenseRevoked";
+  ErrorType2["LicenseActivationRevoked"] = "LicenseActivationRevoked";
+  ErrorType2["LicenseExpired"] = "LicenseExpired";
+  ErrorType2["LicenseDeviceMismatch"] = "LicenseDeviceMismatch";
+  ErrorType2["DeviceIdentityUnavailable"] = "DeviceIdentityUnavailable";
+  return ErrorType2;
+})(ErrorType || {});
+var MoonbaseError = class extends Error {
+  constructor(title, detail, type, inner) {
+    super();
+    this.title = title;
+    this.detail = detail;
+    this.type = type;
+    this.inner = inner;
+    this.name = "MoonbaseError";
+    this.message = detail != null ? detail : title;
+  }
+};
+var InsufficientDeviceIdentityError = class extends MoonbaseError {
+  constructor(platform, reason = "no identity parameter could be read") {
+    super(
+      "No device identity",
+      `Could not identify this device (platform: ${platform}): ${reason}`,
+      "DeviceIdentityUnavailable" /* DeviceIdentityUnavailable */
+    );
+    this.platform = platform;
+    this.name = "InsufficientDeviceIdentityError";
+  }
+};
+
+// src/fingerprint.ts
+import { Buffer } from "buffer";
 import cp from "child_process";
 import { createHash } from "crypto";
-var DefaultDeviceIdResolver = class {
+import fs from "fs";
+import os from "os";
+import process from "process";
+var FINGERPRINT_PREFIX = "moonbase:fingerprint:v2";
+var FINGERPRINT_VERSION = 2;
+var MAX_VALUE_LENGTH = 128;
+var PRINTABLE_ASCII_MIN = 32;
+var PRINTABLE_ASCII_MAX = 126;
+var SOURCE_TAGS = {
+  identity: "",
+  deviceName: "n",
+  scoped: "s"
+};
+var DEVICE_ID_SOURCE_TAGS = Object.freeze({ ...SOURCE_TAGS });
+var SOURCE_BY_TAG = new Map(
+  Object.entries(SOURCE_TAGS).map(([source, tag]) => [tag, source])
+);
+var SCOPED_PLATFORMS = /* @__PURE__ */ new Set(["ios", "android"]);
+function identitySource(platform) {
+  return SCOPED_PLATFORMS.has(platform) ? "scoped" : "identity";
+}
+var STAMP_PATTERN = /^mbd(\d+)([a-z]*)_([0-9a-f]{64})$/;
+function canonicalizeValue(value) {
+  var _a;
+  let printable = "";
+  for (const char of value.normalize("NFC")) {
+    const code = (_a = char.codePointAt(0)) != null ? _a : 0;
+    if (code >= PRINTABLE_ASCII_MIN && code <= PRINTABLE_ASCII_MAX)
+      printable += char;
+  }
+  return printable.slice(0, MAX_VALUE_LENGTH).replace(/^ +| +$/g, "");
+}
+var PLATFORM_TAGS = /* @__PURE__ */ new Set(
+  ["mac", "ios", "windows", "android", "linux", "bsd", "unknown"]
+);
+function isPlatformTag(value) {
+  return PLATFORM_TAGS.has(value);
+}
+function platformTag(platform = process.platform) {
+  switch (platform) {
+    case "darwin":
+      return "mac";
+    case "win32":
+      return "windows";
+    case "android":
+      return "android";
+    case "linux":
+      return "linux";
+    case "freebsd":
+    case "openbsd":
+    case "netbsd":
+      return "bsd";
+    default:
+      return isPlatformTag(platform) ? platform : "unknown";
+  }
+}
+var IDENTIFYING_PARAMS = /* @__PURE__ */ new Set([
+  "ioPlatformUuid",
+  "machineId",
+  "systemUuid",
+  "baseboardSerialNumber",
+  "identifierForVendor",
+  "androidId",
+  "deviceName"
+]);
+var IDENTIFYING_PARAM_NAMES = Object.freeze([...IDENTIFYING_PARAMS]);
+var NOT_PROGRAMMED_VALUES = /* @__PURE__ */ new Set([
+  "to be filled by o.e.m.",
+  // The same filler without the dots, which plenty of firmware writes instead.
+  "to be filled by oem",
+  "default string",
+  "system serial number",
+  "base board serial number",
+  "chassis serial number",
+  "not specified",
+  "not applicable",
+  "not available",
+  "none",
+  "unknown",
+  "invalid",
+  "n/a",
+  "0123456789",
+  // `machine-id(5)`: the literal marker systemd writes to say "no id yet",
+  // e.g. in an initrd or a golden image awaiting first boot. Every machine
+  // deployed from such an image reads it, so it is the opposite of an identifier.
+  "uninitialized"
+]);
+var IDENTITY_CONSTRAINTS = {
+  androidId: {
+    // Reading the *static field* `Settings.Secure.ANDROID_ID` instead of calling
+    // `getString` with it yields the key name "android_id", identical on every
+    // device, so a single activation would unlock a whole Android install base.
+    // That string is not hex, so this stops it reaching the material.
+    //
+    // The bound is 1,16 and not 16 because AOSP before 8.0 generated the value
+    // with `Long.toHexString`, which drops leading zeros — a strict 16 would
+    // reject legitimate ids on roughly one in sixteen pre-Oreo devices.
+    format: /^[0-9a-f]{1,16}$/,
+    // A real ANDROID_ID shared by a large batch of 2010-era devices whose
+    // `ro.serialno` was unset, seeding the generator identically on every unit.
+    // Valid hex, so the format rule cannot catch it.
+    rejected: /* @__PURE__ */ new Set(["9774d56d682e549c"])
+  }
+};
+function isNotProgrammed(value) {
+  return NOT_PROGRAMMED_VALUES.has(value.toLowerCase()) || /^0+$/.test(value) || /^f+$/i.test(value);
+}
+function isUsableIdentity(name, value) {
+  var _a, _b, _c;
+  if (isNotProgrammed(value))
+    return false;
+  const constraint = IDENTITY_CONSTRAINTS[name];
+  if (!constraint)
+    return true;
+  return ((_b = (_a = constraint.format) == null ? void 0 : _a.test(value)) != null ? _b : true) && !((_c = constraint.rejected) == null ? void 0 : _c.has(value.toLowerCase()));
+}
+function canonicalizeParams(params) {
+  const kept = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const [name, rawValue] of params) {
+    const value = canonicalizeValue(rawValue);
+    if (value.length === 0)
+      continue;
+    if (IDENTIFYING_PARAMS.has(name) && !isUsableIdentity(name, value))
+      continue;
+    if (seen.has(name))
+      throw new Error(`Duplicate fingerprint parameter name: ${name}`);
+    seen.add(name);
+    kept.push([name, value]);
+  }
+  return kept;
+}
+function buildFingerprintMaterial(platform, params) {
+  const kept = canonicalizeParams(params);
+  if (kept.length === 0)
+    throw new InsufficientDeviceIdentityError(platform, "no identity parameter could be read");
+  if (SCOPED_PLATFORMS.has(platform) && kept.some(([name]) => name === "deviceName")) {
+    throw new InsufficientDeviceIdentityError(
+      platform,
+      "the host-name fallback is not available on this platform, where the host name is the same on every device"
+    );
+  }
+  if (!kept.some(([name]) => IDENTIFYING_PARAMS.has(name))) {
+    throw new InsufficientDeviceIdentityError(
+      platform,
+      `only model-level parameters could be read (${kept.map(([name]) => name).join(", ")}), none of which identify this individual machine`
+    );
+  }
+  const lines = [FINGERPRINT_PREFIX, `platform=${platform}`];
+  for (const [name, value] of kept)
+    lines.push(`${name}=${value}`);
+  return lines.join("\n");
+}
+function fingerprintDigest(material) {
+  return createHash("sha256").update(material, "utf8").digest("hex");
+}
+function stampDeviceId(digest, source = "identity") {
+  return `mbd${FINGERPRINT_VERSION}${SOURCE_TAGS[source]}_${digest}`;
+}
+function fingerprintDeviceId(material, source = "identity") {
+  return stampDeviceId(fingerprintDigest(material), source);
+}
+function parseDeviceIdStamp(deviceId) {
+  var _a;
+  const match = STAMP_PATTERN.exec(deviceId);
+  if (!match)
+    return null;
+  return {
+    version: Number(match[1]),
+    sourceTag: match[2],
+    source: (_a = SOURCE_BY_TAG.get(match[2])) != null ? _a : null,
+    digest: match[3]
+  };
+}
+function commandOutput(command) {
+  try {
+    return cp.execSync(command, { encoding: "utf8" });
+  } catch (e) {
+    return "";
+  }
+}
+function readSysFile(path2) {
+  try {
+    return fs.readFileSync(path2, "utf8");
+  } catch (e) {
+    return "";
+  }
+}
+function parseIoregPlatformUuid(ioregOutput) {
+  const match = ioregOutput.match(/"IOPlatformUUID"\s*=\s*"([^"]+)"/);
+  return match ? match[1].replaceAll("-", "").toUpperCase() : "";
+}
+function readMacIdentity() {
+  const uuid = parseIoregPlatformUuid(commandOutput("ioreg -rd1 -c IOPlatformExpertDevice"));
+  const params = [["ioPlatformUuid", uuid]];
+  return { params, deviceName: os.hostname().replace(/\.local$/i, "") };
+}
+function selectMachineId(...sources) {
+  var _a;
+  return (_a = sources.map(canonicalizeValue).find((value) => /^[0-9a-f]{32}$/.test(value) && !isNotProgrammed(value))) != null ? _a : "";
+}
+function readMachineId() {
+  return selectMachineId(
+    readSysFile("/etc/machine-id"),
+    readSysFile("/var/lib/dbus/machine-id")
+  );
+}
+function readLinuxIdentity() {
+  const params = [
+    ["machineId", readMachineId()],
+    ["sysVendor", readSysFile("/sys/class/dmi/id/sys_vendor")],
+    ["productName", readSysFile("/sys/class/dmi/id/product_name")],
+    ["boardVendor", readSysFile("/sys/class/dmi/id/board_vendor")],
+    ["boardName", readSysFile("/sys/class/dmi/id/board_name")]
+  ];
+  return { params, deviceName: os.hostname() };
+}
+function parseSmbiosStructures(data) {
+  const structures = [];
+  let offset = 0;
+  while (offset + 4 <= data.length) {
+    const type = data[offset];
+    const length = data[offset + 1];
+    if (length < 4 || offset + length > data.length)
+      break;
+    const formatted = data.subarray(offset, offset + length);
+    const strings = [];
+    let p = offset + length;
+    if (p + 1 < data.length && data[p] === 0 && data[p + 1] === 0) {
+      p += 2;
+    } else {
+      while (p < data.length) {
+        let end = p;
+        while (end < data.length && data[end] !== 0)
+          end++;
+        strings.push(data.toString("latin1", p, end));
+        p = end + 1;
+        if (p < data.length && data[p] === 0) {
+          p += 1;
+          break;
+        }
+      }
+    }
+    structures.push({ type, formatted, strings });
+    if (type === 127)
+      break;
+    offset = p;
+  }
+  return structures;
+}
+function resolveSmbiosString(structure, fieldOffset) {
+  if (fieldOffset >= structure.formatted.length)
+    return "";
+  const index = structure.formatted[fieldOffset];
+  if (index === 0 || index > structure.strings.length)
+    return "";
+  return structure.strings[index - 1];
+}
+function formatSmbiosUuid(structure, fieldOffset) {
+  if (fieldOffset + 16 > structure.formatted.length)
+    return "";
+  const bytes = structure.formatted.subarray(fieldOffset, fieldOffset + 16);
+  if (bytes.every((byte) => byte === 0) || bytes.every((byte) => byte === 255))
+    return "";
+  let hex = "";
+  for (const byte of bytes)
+    hex += byte.toString(16).padStart(2, "0").toUpperCase();
+  return hex;
+}
+function parseSmbiosParams(smbiosData) {
+  const structures = parseSmbiosStructures(smbiosData);
+  const params = [];
+  const system = structures.find((structure) => structure.type === 1);
+  if (system) {
+    params.push(["systemManufacturer", resolveSmbiosString(system, 4)]);
+    params.push(["systemProductName", resolveSmbiosString(system, 5)]);
+    params.push(["systemUuid", formatSmbiosUuid(system, 8)]);
+  }
+  const baseboard = structures.find((structure) => structure.type === 2);
+  if (baseboard) {
+    params.push(["baseboardManufacturer", resolveSmbiosString(baseboard, 4)]);
+    params.push(["baseboardProduct", resolveSmbiosString(baseboard, 5)]);
+    params.push(["baseboardSerialNumber", resolveSmbiosString(baseboard, 7)]);
+  }
+  return params;
+}
+function readWindowsSmbios() {
+  const script = "[Convert]::ToBase64String((Get-CimInstance -Namespace root/wmi -ClassName MSSmBios_RawSMBiosTables).SMBiosData)";
+  const output = commandOutput(`powershell -NoProfile -NonInteractive -Command "${script}"`);
+  try {
+    return Buffer.from(output.trim(), "base64");
+  } catch (e) {
+    return Buffer.alloc(0);
+  }
+}
+function readWindowsIdentity() {
+  return { params: parseSmbiosParams(readWindowsSmbios()), deviceName: os.hostname() };
+}
+function defaultDeviceIdentityReader(platform = process.platform) {
+  const tag = platformTag(platform);
+  return {
+    read() {
+      switch (tag) {
+        case "mac":
+          return readMacIdentity();
+        case "linux":
+          return readLinuxIdentity();
+        case "windows":
+          return readWindowsIdentity();
+        // Everything else yields no identity params here, so it resolves to an
+        // insufficient-identity error unless the deviceName fallback is enabled.
+        // For bsd and unknown that matches the spec, which defines none. Android
+        // is different: the spec *does* define `androidId`, but it comes from
+        // `Settings.Secure.getString`, which is Android-framework API that a
+        // Node.js process cannot reach. Collecting it is the C++/.NET SDKs' job.
+        // A host that can bridge it should supply its own DeviceIdentityReader.
+        default:
+          return { params: [], deviceName: os.hostname() };
+      }
+    }
+  };
+}
+
+// src/deviceIdResolver.ts
+var MoonbaseDeviceIdResolver = class {
+  constructor(options) {
+    var _a, _b, _c;
+    const platform = (_a = options == null ? void 0 : options.platform) != null ? _a : process2.platform;
+    this.platform = platformTag(platform);
+    this.reader = (_b = options == null ? void 0 : options.reader) != null ? _b : defaultDeviceIdentityReader(platform);
+    this.fallback = (_c = options == null ? void 0 : options.fallback) != null ? _c : "none";
+  }
+  async resolveDeviceName() {
+    return this.readIdentity().deviceName;
+  }
+  async resolveDeviceId() {
+    return this.compute().deviceId;
+  }
+  /**
+   * A fresh copy each call. The device binding is what activation sends and what
+   * validation compares, so handing out the resolver's own object would let a
+   * consumer that edits a diagnostic — or logs it through something that
+   * normalizes in place — silently change the id every later call returns.
+   */
+  async describeDevice() {
+    const described = this.compute();
+    return { ...described, paramNames: [...described.paramNames] };
+  }
+  compute() {
+    var _a;
+    (_a = this.described) != null ? _a : this.described = this.computeDescription();
+    return this.described;
+  }
+  /**
+   * Read identity at most once. Both halves of an activation request ask for it —
+   * the name and then the id — and a read can mean spawning `ioreg` or
+   * PowerShell, so reading per call would double the cost of every request and
+   * let the name and the id come from two different reads of the machine.
+   */
+  readIdentity() {
+    var _a;
+    (_a = this.identity) != null ? _a : this.identity = this.reader.read();
+    return this.identity;
+  }
+  computeDescription() {
+    const { params, deviceName } = this.readIdentity();
+    try {
+      return this.describe(params, identitySource(this.platform));
+    } catch (err) {
+      if (this.fallback !== "deviceName" || !(err instanceof InsufficientDeviceIdentityError))
+        throw err;
+      return this.describe([["deviceName", deviceName]], "deviceName");
+    }
+  }
+  describe(params, source) {
+    return {
+      deviceId: fingerprintDeviceId(buildFingerprintMaterial(this.platform, params), source),
+      version: FINGERPRINT_VERSION,
+      platform: this.platform,
+      source,
+      paramNames: canonicalizeParams(params).map(([name]) => name)
+    };
+  }
+};
+var MigratingDeviceIdResolver = class {
+  constructor(current, ...previous) {
+    this.current = current;
+    this.previous = previous;
+    const describe = current.describeDevice;
+    if (typeof describe === "function")
+      this.describeDevice = () => describe.call(current);
+  }
+  async resolveDeviceName() {
+    return this.current.resolveDeviceName();
+  }
+  async resolveDeviceId() {
+    return this.current.resolveDeviceId();
+  }
+  async acceptsDeviceId(deviceId) {
+    if (!this.previousIds) {
+      this.previousIds = Promise.all(this.previous.map(async (resolver) => {
+        try {
+          return await resolver.resolveDeviceId();
+        } catch (e) {
+          return "";
+        }
+      }));
+    }
+    return (await this.previousIds).some((previous) => previous.length > 0 && previous === deviceId);
+  }
+};
+var LegacyDeviceIdResolver = class {
   async resolveDeviceName() {
-    switch (process.platform) {
+    switch (process2.platform) {
       case "darwin":
         try {
-          return cp.execSync("scutil --get ComputerName").toString().trim();
+          return cp2.execSync("scutil --get ComputerName").toString().trim();
         } catch (e) {
-          return os.hostname();
+          return os2.hostname();
         }
       case "win32":
-        return process.env.COMPUTERNAME || os.hostname();
-      case "linux":
-        const prettyname = cp.execSync("hostnamectl --pretty").toString().trim();
-        return prettyname || os.hostname();
+        return process2.env.COMPUTERNAME || os2.hostname();
+      case "linux": {
+        const prettyname = cp2.execSync("hostnamectl --pretty").toString().trim();
+        return prettyname || os2.hostname();
+      }
       default:
-        return os.hostname();
+        return os2.hostname();
     }
   }
   async resolveDeviceId() {
     const [cpu, hw] = await Promise.all([si.cpu(), si.system()]);
     const parts = [
-      os.hostname(),
+      os2.hostname(),
       hw.manufacturer,
       hw.model,
       hw.serial,
@@ -194,40 +659,15 @@ var DefaultDeviceIdResolver = class {
       cpu.family,
       cpu.model
     ];
-    const hash = createHash("sha256").update(parts.join("")).digest();
+    const hash = createHash2("sha256").update(parts.join("")).digest();
     return hash.toString("base64").replaceAll("=", "");
   }
 };
 
 // src/store.ts
 import fsSync from "fs";
-import fs from "fs/promises";
+import fs2 from "fs/promises";
 import path from "path";
-
-// src/errors.ts
-var ErrorType = /* @__PURE__ */ ((ErrorType2) => {
-  ErrorType2["None"] = "None";
-  ErrorType2["ApiError"] = "ApiError";
-  ErrorType2["NoEligibleLicense"] = "NoEligibleLicense";
-  ErrorType2["LicenseInvalid"] = "LicenseInvalid";
-  ErrorType2["LicenseRevoked"] = "LicenseRevoked";
-  ErrorType2["LicenseActivationRevoked"] = "LicenseActivationRevoked";
-  ErrorType2["LicenseExpired"] = "LicenseExpired";
-  return ErrorType2;
-})(ErrorType || {});
-var MoonbaseError = class extends Error {
-  constructor(title, detail, type, inner) {
-    super();
-    this.title = title;
-    this.detail = detail;
-    this.type = type;
-    this.inner = inner;
-    this.name = "MoonbaseError";
-    this.message = detail != null ? detail : title;
-  }
-};
-
-// src/store.ts
 var InMemoryLicenseStore = class {
   async loadLocalLicense() {
     var _a;
@@ -245,9 +685,10 @@ var FileLicenseStore = class {
     this.options = options;
   }
   async loadLocalLicense() {
-    if (!fsSync.existsSync(this.path)) return null;
+    if (!fsSync.existsSync(this.path))
+      return null;
     try {
-      const file = await fs.readFile(this.path, { encoding: "utf-8" });
+      const file = await fs2.readFile(this.path, { encoding: "utf-8" });
       const license = licenseSchema.parse(JSON.parse(file));
       return license;
     } catch (err) {
@@ -255,11 +696,12 @@ var FileLicenseStore = class {
     }
   }
   async storeLocalLicense(license) {
-    await fs.writeFile(this.path, JSON.stringify(license), { encoding: "utf-8" });
+    await fs2.writeFile(this.path, JSON.stringify(license), { encoding: "utf-8" });
   }
   async deleteLocalLicense() {
-    if (!fsSync.existsSync(this.path)) return;
-    await fs.rm(this.path);
+    if (!fsSync.existsSync(this.path))
+      return;
+    await fs2.rm(this.path);
   }
   get path() {
     var _a, _b, _c, _d;
@@ -268,8 +710,8 @@ var FileLicenseStore = class {
 };
 
 // src/validator.ts
-import { z as z2 } from "zod";
 import jwt from "jsonwebtoken";
+import { z as z2 } from "zod";
 var licenseClaimsSchema = z2.object({
   ["l:id" /* LicenseId */]: z2.string(),
   ["trial" /* Trial */]: z2.string().or(z2.boolean()).transform((v) => v === true || v === "true").pipe(z2.boolean()),
@@ -306,15 +748,20 @@ var LicenseValidator = class {
       );
     }
     const expectedSignature = await this.deviceIdResolver.resolveDeviceId();
-    if (expectedSignature !== claims["sig" /* ComputerSignature */]) {
-      throw new MoonbaseError(
-        "License invalide",
-        "This license is not for this device",
-        "LicenseExpired" /* LicenseExpired */
-      );
-    }
+    const boundSignature = claims["sig" /* ComputerSignature */];
+    if (expectedSignature !== boundSignature && !await this.acceptsHistoricalDeviceId(boundSignature))
+      throw deviceMismatchError(expectedSignature, boundSignature);
     return license;
   }
+  /**
+   * Give a {@link IMigratingDeviceIdResolver} the chance to vouch for a device id
+   * this machine used to have. Only consulted after the fast path fails, so
+   * apps that have not opted into a migration pay nothing.
+   */
+  async acceptsHistoricalDeviceId(boundSignature) {
+    const accepts = this.deviceIdResolver.acceptsDeviceId;
+    return typeof accepts === "function" && await accepts.call(this.deviceIdResolver, boundSignature);
+  }
   parseLicenseToken(token) {
     return new Promise((resolve, reject) => {
       jwt.verify(token, this.configuration.publicKey, {
@@ -379,11 +826,57 @@ var LicenseValidator = class {
     });
   }
 };
+function deviceMismatchError(expected, bound) {
+  const detail = "This license is not for this device";
+  const stampNote = describeStampDifference(expected, bound);
+  return new MoonbaseError(
+    "License is for another device",
+    stampNote ? `${detail}. ${stampNote}` : detail,
+    "LicenseDeviceMismatch" /* LicenseDeviceMismatch */
+  );
+}
+function describeStampDifference(expected, bound) {
+  const expectedStamp = parseDeviceIdStamp(expected);
+  if (!expectedStamp)
+    return null;
+  const boundStamp = parseDeviceIdStamp(bound);
+  if (!boundStamp || boundStamp.version !== expectedStamp.version)
+    return describeVersionDifference(expectedStamp, boundStamp);
+  if (boundStamp.sourceTag !== expectedStamp.sourceTag)
+    return describeSourceDifference(expectedStamp, boundStamp);
+  return null;
+}
+function describeVersionDifference(expected, bound) {
+  if (bound && bound.version > expected.version) {
+    return `The binding was created by device fingerprint v${bound.version}, which is newer than the v${expected.version} this SDK computes \u2014 update the SDK rather than re-activating, which would rebind the device to the older algorithm.`;
+  }
+  const boundVersion = bound ? `device fingerprint v${bound.version}` : "an SDK predating versioned device fingerprints";
+  return `The binding was created by ${boundVersion}, while this SDK computes v${expected.version}, so this may instead be the same machine bound under the older algorithm \u2014 re-activate to find out, or configure a MigratingDeviceIdResolver to keep accepting the previous id.`;
+}
+function describeSourceDifference(expected, bound) {
+  if (bound.source === "scoped") {
+    return "The binding uses an app-scoped device identity, which cannot be compared with the id this SDK computes \u2014 not even on the same device. Re-activate here to bind this build.";
+  }
+  if (expected.source === "scoped") {
+    return "This SDK computes an app-scoped device identity, which cannot be compared with the one the binding carries \u2014 not even on the same device. Re-activate here to bind this app.";
+  }
+  if (bound.source === null) {
+    return `The binding carries the device identity tag "${bound.sourceTag}", which this SDK does not recognise \u2014 it was created by a newer Moonbase SDK, so update rather than re-activating.`;
+  }
+  if (expected.source === null) {
+    return `The id this SDK computes carries the device identity tag "${expected.sourceTag}", which the spec does not define \u2014 it came from a custom device id resolver, so check that resolver rather than the binding.`;
+  }
+  if (bound.source === "deviceName") {
+    return "The binding was created from the host-name fallback, while this SDK reads hardware identity, so this may instead be the same machine bound while no hardware identity could be read \u2014 re-activate to find out.";
+  }
+  return "The binding was created from hardware identity, while this SDK has fallen back to the host name \u2014 check why hardware identity cannot be read here rather than re-activating, which would rebind the device to the weaker id.";
+}
 
 // src/index.ts
 function detectPlatform() {
-  if (typeof process === "undefined") return void 0;
-  switch (process.platform) {
+  if (typeof process3 === "undefined")
+    return void 0;
+  switch (process3.platform) {
     case "darwin":
       return "Mac";
     case "win32":
@@ -403,7 +896,7 @@ var MoonbaseLicensing = class {
       platform: configuration.platform === void 0 ? detectPlatform() : configuration.platform
     };
     this.store = (_a = configuration.licenseStore) != null ? _a : new InMemoryLicenseStore();
-    this.deviceIdResolver = (_b = configuration.deivceIdResolver) != null ? _b : new DefaultDeviceIdResolver();
+    this.deviceIdResolver = (_b = configuration.deviceIdResolver) != null ? _b : new MoonbaseDeviceIdResolver();
     this.validator = new LicenseValidator(this.configuration, this.deviceIdResolver);
     this.client = new LicenseClient(this.configuration, this.deviceIdResolver, this.validator);
   }
@@ -415,7 +908,7 @@ var MoonbaseLicensing = class {
       format: "JWT"
     };
     const json = JSON.stringify(token);
-    return Buffer.from(Buffer.from(json).toString("base64"));
+    return Buffer2.from(Buffer2.from(json).toString("base64"));
   }
   async readRawLicense(license) {
     return await this.client.validateRawLicense(license);
@@ -423,12 +916,33 @@ var MoonbaseLicensing = class {
 };
 export {
   ActivationMethod,
-  DefaultDeviceIdResolver,
+  DEVICE_ID_SOURCE_TAGS,
   ErrorType,
+  FINGERPRINT_PREFIX,
+  FINGERPRINT_VERSION,
   FileLicenseStore,
+  IDENTIFYING_PARAM_NAMES,
   InMemoryLicenseStore,
+  InsufficientDeviceIdentityError,
+  LegacyDeviceIdResolver,
   LicenseClient,
   LicenseValidator,
+  MAX_VALUE_LENGTH,
+  MigratingDeviceIdResolver,
+  MoonbaseDeviceIdResolver,
   MoonbaseError,
-  MoonbaseLicensing
+  MoonbaseLicensing,
+  buildFingerprintMaterial,
+  canonicalizeParams,
+  canonicalizeValue,
+  defaultDeviceIdentityReader,
+  fingerprintDeviceId,
+  fingerprintDigest,
+  identitySource,
+  parseDeviceIdStamp,
+  parseIoregPlatformUuid,
+  parseSmbiosParams,
+  platformTag,
+  selectMachineId,
+  stampDeviceId
 };