@parselo/scanner-core 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Parselo Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/aamva.d.ts

@@ -0,0 +1,13 @@
+export interface AamvaHeader {
+    fileType: string;
+    iin: string;
+    aamvaVersion: string;
+    jurisdictionVersion?: string;
+}
+export interface AamvaResult {
+    isAamva: boolean;
+    header?: AamvaHeader;
+    subfileTypes: string[];
+    elements: Record<string, string>;
+}
+export declare function parseAamva(raw: string): AamvaResult;

package/dist/aamva.js

@@ -0,0 +1,123 @@
+// aamva.ts
+// Zero-dependency AAMVA PDF417 payload parser (US + Canada, CDS versions 1-12).
+//
+// The barcode is DECODED natively (ML Kit on Android, Vision on iOS); the raw
+// payload string is passed across the bridge and parsed here, so parsing is
+// identical on every platform and there is one place to fix bugs.
+const DATE_CODES = new Set(["DBA", "DBB", "DBD", "DDB"]);
+// Codes we recognise for the regex fallback path (used only if the subfile
+// directory is unparseable on an oddly-encoded card).
+const KNOWN_CODES = [
+    "DCA", "DCB", "DCD", "DBA", "DCS", "DAC", "DAD", "DBD", "DBB", "DBC", "DAY",
+    "DAU", "DAG", "DAH", "DAI", "DAJ", "DAK", "DAQ", "DCF", "DCG", "DCK", "DDA",
+    "DDB", "DAZ", "DAW", "DCL", "DDE", "DDF", "DDG", "DDH", "DDI", "DDJ", "DDK",
+    "DDL", "DAR", "DAS", "DAT", "DCH", "DBN", "DBG", "DBS", "DCU", "DCE", "DDC",
+    "DDD", "DAA", "DAB", "DAE",
+];
+// AAMVA dates: CCYYMMDD in Canada, MMDDCCYY in the US. We pre-detect the
+// country from DCG; a year-first prefix (19xx/20xx) is the tie-breaker.
+function normaliseDate(value, country) {
+    const v = value.trim();
+    if (v.length !== 8 || !/^\d{8}$/.test(v))
+        return value;
+    let ccyy, mm, dd;
+    if (country === "CAN" || v.slice(0, 2) === "19" || v.slice(0, 2) === "20") {
+        ccyy = v.slice(0, 4);
+        mm = v.slice(4, 6);
+        dd = v.slice(6, 8); // CCYYMMDD
+    }
+    else {
+        mm = v.slice(0, 2);
+        dd = v.slice(2, 4);
+        ccyy = v.slice(4, 8); // MMDDCCYY
+    }
+    return `${ccyy}-${mm}-${dd}`;
+}
+export function parseAamva(raw) {
+    const result = { isAamva: false, subfileTypes: [], elements: {} };
+    if (!raw.startsWith("@"))
+        return result;
+    let markerPos = -1;
+    let marker = null;
+    for (const m of ["ANSI ", "AAMVA"]) {
+        const idx = raw.indexOf(m);
+        if (idx !== -1) {
+            markerPos = idx;
+            marker = m;
+            break;
+        }
+    }
+    if (marker === null)
+        return result;
+    result.isAamva = true;
+    let j = markerPos + marker.length;
+    const iin = raw.slice(j, j + 6);
+    j += 6;
+    const aamvaVersion = raw.slice(j, j + 2);
+    j += 2;
+    const ver = parseInt(aamvaVersion, 10);
+    let jurisdictionVersion;
+    if (!Number.isNaN(ver) && ver >= 2) {
+        jurisdictionVersion = raw.slice(j, j + 2);
+        j += 2;
+    }
+    const entriesStr = raw.slice(j, j + 2);
+    j += 2;
+    const n = parseInt(entriesStr, 10);
+    result.header = {
+        fileType: marker.trim(),
+        iin,
+        aamvaVersion,
+        ...(jurisdictionVersion ? { jurisdictionVersion } : {}),
+    };
+    // Country first (it drives the date format). DCG can sit anywhere in the body.
+    let country = "";
+    const dcgIdx = raw.indexOf("DCG");
+    if (dcgIdx !== -1) {
+        country = raw.slice(dcgIdx + 3).replace(/\r/g, "\n").split("\n")[0].trim().slice(0, 3);
+    }
+    const store = (code, value) => {
+        if (!/^[A-Z]{3}$/.test(code))
+            return;
+        result.elements[code] = DATE_CODES.has(code) ? normaliseDate(value, country) : value;
+    };
+    // Primary path: walk the subfile directory. Offsets are counted from byte 0
+    // (the "@"), and since we decode bytes 1:1, character offsets == byte offsets.
+    let k = j;
+    const directory = [];
+    const entryCount = Number.isNaN(n) ? 0 : n;
+    for (let i = 0; i < entryCount; i++) {
+        if (k + 10 > raw.length)
+            break;
+        const type = raw.slice(k, k + 2);
+        const offStr = raw.slice(k + 2, k + 6);
+        const lenStr = raw.slice(k + 6, k + 10);
+        k += 10;
+        if (/^\d{4}$/.test(offStr) && /^\d{4}$/.test(lenStr)) {
+            directory.push({ type, off: parseInt(offStr, 10), len: parseInt(lenStr, 10) });
+        }
+    }
+    let parsedAny = false;
+    for (const { type, off, len } of directory) {
+        result.subfileTypes.push(type);
+        const seg = raw.slice(off, off + len);
+        const body = seg.slice(0, 2) === type ? seg.slice(2) : seg; // strip repeated subfile designator
+        for (const elem of body.replace(/\r/g, "\n").split("\n")) {
+            if (elem.length < 3)
+                continue;
+            const code = elem.slice(0, 3);
+            if (/^[A-Z]{3}$/.test(code)) {
+                store(code, elem.slice(3));
+                parsedAny = true;
+            }
+        }
+    }
+    // Fallback: regex scan for known codes if directory parsing yielded nothing.
+    if (!parsedAny) {
+        const re = new RegExp(`(${KNOWN_CODES.join("|")})([^\\n\\r]*)`, "g");
+        let m;
+        while ((m = re.exec(raw)) !== null)
+            store(m[1], m[2]);
+    }
+    return result;
+}

package/dist/analytics.d.ts

@@ -0,0 +1,32 @@
+import type { FieldSource } from "./canonical";
+export interface ScanEvent {
+    jti: string;
+    ts: string;
+    documentType: string;
+    jurisdiction: string;
+    source: FieldSource;
+    success: boolean;
+    confidenceBucket: "high" | "medium" | "low";
+    deviceModel: string;
+}
+export interface KeyValueStore {
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+}
+export interface AnalyticsConfig {
+    ingestUrl: string;
+    store: KeyValueStore;
+    batchSize?: number;
+}
+export declare class ScanAnalytics {
+    private readonly ingestUrl;
+    private readonly store;
+    private readonly batchSize;
+    constructor(cfg: AnalyticsConfig);
+    /** Append an event; flush opportunistically once the buffer is full. */
+    record(event: ScanEvent): Promise<void>;
+    /** Send the buffered events; clear on success, keep them on failure for retry. */
+    flush(): Promise<void>;
+    private read;
+    private write;
+}

package/dist/analytics.js

@@ -0,0 +1,61 @@
+// analytics.ts
+// Records one PII-FREE event per scan and flushes them to the ingest endpoint in
+// batches, buffering when offline. NOTHING here may contain document data
+// (no name, DOB, number, address) - only counts and metadata. Keeping PII out of
+// this pipeline is what keeps it out of PIPEDA scope; do not "enrich" these events.
+const BUFFER_KEY = "scan_events_buffer_v1";
+export class ScanAnalytics {
+    ingestUrl;
+    store;
+    batchSize;
+    constructor(cfg) {
+        this.ingestUrl = cfg.ingestUrl;
+        this.store = cfg.store;
+        this.batchSize = cfg.batchSize ?? 25;
+    }
+    /** Append an event; flush opportunistically once the buffer is full. */
+    async record(event) {
+        const buffer = await this.read();
+        buffer.push(event);
+        await this.write(buffer);
+        if (buffer.length >= this.batchSize) {
+            // fire-and-forget: analytics must never break or block a scan
+            void this.flush();
+        }
+    }
+    /** Send the buffered events; clear on success, keep them on failure for retry. */
+    async flush() {
+        const buffer = await this.read();
+        if (buffer.length === 0)
+            return;
+        try {
+            const res = await fetch(this.ingestUrl, {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({ events: buffer }),
+            });
+            if (res.ok) {
+                await this.write([]);
+            }
+            // non-2xx: leave the buffer intact and try again next time
+        }
+        catch {
+            // offline / network error: keep the buffer for the next flush
+        }
+    }
+    async read() {
+        const raw = await this.store.get(BUFFER_KEY);
+        if (!raw)
+            return [];
+        try {
+            const parsed = JSON.parse(raw);
+            return Array.isArray(parsed) ? parsed : [];
+        }
+        catch {
+            return [];
+        }
+    }
+    async write(events) {
+        await this.store.set(BUFFER_KEY, JSON.stringify(events));
+    }
+}

package/dist/canonical.d.ts

@@ -0,0 +1,30 @@
+import type { AamvaResult } from "./aamva";
+export type FieldSource = "barcode" | "ocr" | "mrz";
+export interface CanonicalField {
+    value: string;
+    confidence: number;
+    source: FieldSource;
+}
+export type DocumentType = "drivers_license" | "id_card" | "passport" | "unknown";
+export interface CanonicalDocument {
+    documentType: DocumentType;
+    jurisdiction: string;
+    fields: {
+        firstName?: CanonicalField;
+        lastName?: CanonicalField;
+        middleName?: CanonicalField;
+        dateOfBirth?: CanonicalField;
+        expiryDate?: CanonicalField;
+        issueDate?: CanonicalField;
+        documentNumber?: CanonicalField;
+        sex?: CanonicalField;
+        addressStreet?: CanonicalField;
+        addressCity?: CanonicalField;
+        addressRegion?: CanonicalField;
+        addressPostalCode?: CanonicalField;
+        country?: CanonicalField;
+        vehicleClass?: CanonicalField;
+    };
+    raw: Record<string, string>;
+}
+export declare function toCanonical(a: AamvaResult, confidence?: number): CanonicalDocument;

package/dist/canonical.js

@@ -0,0 +1,38 @@
+// canonical.ts
+// One stable output shape every document maps into, regardless of source
+// (barcode now; OCR/MRZ later). Each field carries its value, a confidence,
+// and which path produced it, so the future merge step can prefer ground truth.
+export function toCanonical(a, confidence = 1.0) {
+    const e = a.elements;
+    const field = (code) => e[code] !== undefined ? { value: e[code], confidence, source: "barcode" } : undefined;
+    const region = e["DAJ"] ?? "";
+    const rawCountry = e["DCG"] ?? "";
+    const countryPrefix = rawCountry === "CAN" ? "CA" : rawCountry === "USA" ? "US" : rawCountry;
+    const jurisdiction = region
+        ? `${countryPrefix || "??"}-${region}`
+        : (countryPrefix || "unknown");
+    const documentType = a.subfileTypes.includes("ID")
+        ? "id_card"
+        : "drivers_license";
+    return {
+        documentType,
+        jurisdiction,
+        fields: {
+            firstName: field("DAC"),
+            lastName: field("DCS"),
+            middleName: field("DAD"),
+            dateOfBirth: field("DBB"),
+            expiryDate: field("DBA"),
+            issueDate: field("DBD"),
+            documentNumber: field("DAQ"),
+            sex: field("DBC"),
+            addressStreet: field("DAG"),
+            addressCity: field("DAI"),
+            addressRegion: field("DAJ"),
+            addressPostalCode: field("DAK"),
+            country: field("DCG"),
+            vehicleClass: field("DCA"),
+        },
+        raw: e,
+    };
+}

package/dist/index.d.ts

@@ -0,0 +1,38 @@
+import { type CanonicalDocument } from "./canonical";
+import { type LicenseResult } from "./license";
+import { type AnalyticsConfig } from "./analytics";
+export * from "./aamva";
+export * from "./canonical";
+export * from "./license";
+export * from "./analytics";
+export interface BarcodeNative {
+    captureAndDecodePdf417(): Promise<string | null>;
+}
+export interface ScannerConfig {
+    license: {
+        token: string;
+        bundleId: string;
+        publicKeys: Record<string, string>;
+    };
+    analytics: AnalyticsConfig;
+    native: BarcodeNative;
+    deviceModel: string;
+}
+export type ScanError = "license_malformed" | "license_unknown_key" | "license_bad_signature" | "license_expired" | "license_bundle_mismatch" | "no_barcode" | "not_aamva";
+export interface ScanResult {
+    ok: boolean;
+    document?: CanonicalDocument;
+    error?: ScanError;
+}
+export declare class Scanner {
+    private readonly cfg;
+    private readonly analytics;
+    private claims?;
+    constructor(cfg: ScannerConfig);
+    /** Verify the signature once, up front. Call on plugin init. */
+    init(): Promise<LicenseResult>;
+    scan(): Promise<ScanResult>;
+    /** Flush buffered analytics (e.g. on app foreground/background). */
+    flushAnalytics(): Promise<void>;
+    private emit;
+}

package/dist/index.js

@@ -0,0 +1,80 @@
+// index.ts
+// Ties the core together and shows the wrap points explicitly:
+//   verify license (gate)  ->  native decode  ->  parse  ->  canonical  ->  emit analytics
+//
+// The native PDF417 decode is supplied by the plugin's Swift/Kotlin bridge via
+// the BarcodeNative interface, so this orchestration is platform-agnostic.
+import { parseAamva } from "./aamva";
+import { toCanonical } from "./canonical";
+import { verifyLicense, isExpired } from "./license";
+import { ScanAnalytics } from "./analytics";
+export * from "./aamva";
+export * from "./canonical";
+export * from "./license";
+export * from "./analytics";
+export class Scanner {
+    cfg;
+    analytics;
+    claims;
+    constructor(cfg) {
+        this.cfg = cfg;
+        this.analytics = new ScanAnalytics(cfg.analytics);
+    }
+    /** Verify the signature once, up front. Call on plugin init. */
+    async init() {
+        const result = await verifyLicense({
+            token: this.cfg.license.token,
+            bundleId: this.cfg.license.bundleId,
+            publicKeys: this.cfg.license.publicKeys,
+        });
+        if (result.valid)
+            this.claims = result.claims;
+        return result;
+    }
+    async scan() {
+        // (1) LICENSE GATE -----------------------------------------------------
+        if (!this.claims) {
+            const result = await this.init();
+            if (!result.valid)
+                return { ok: false, error: `license_${result.reason}` };
+        }
+        // cheap per-scan expiry re-check (no crypto) so a long session can't outlive the token
+        if (!this.claims || isExpired(this.claims)) {
+            return { ok: false, error: "license_expired" };
+        }
+        // (2) NATIVE DECODE ----------------------------------------------------
+        const raw = await this.cfg.native.captureAndDecodePdf417();
+        if (!raw) {
+            await this.emit("unknown", "", false, "low");
+            return { ok: false, error: "no_barcode" };
+        }
+        // (3) PARSE ------------------------------------------------------------
+        const aamva = parseAamva(raw);
+        if (!aamva.isAamva) {
+            await this.emit("unknown", "", false, "low");
+            return { ok: false, error: "not_aamva" };
+        }
+        // (4) CANONICAL --------------------------------------------------------
+        const document = toCanonical(aamva);
+        // (5) ANALYTICS (PII-FREE) --------------------------------------------
+        await this.emit(document.documentType, document.jurisdiction, true, "high");
+        // (6) RETURN -----------------------------------------------------------
+        return { ok: true, document };
+    }
+    /** Flush buffered analytics (e.g. on app foreground/background). */
+    async flushAnalytics() {
+        await this.analytics.flush();
+    }
+    async emit(documentType, jurisdiction, success, confidenceBucket) {
+        await this.analytics.record({
+            jti: this.claims?.jti ?? "unknown",
+            ts: new Date().toISOString(),
+            documentType,
+            jurisdiction,
+            source: "barcode",
+            success,
+            confidenceBucket,
+            deviceModel: this.cfg.deviceModel,
+        });
+    }
+}

package/dist/license.d.ts

@@ -0,0 +1,23 @@
+export interface LicenseClaims {
+    sub: string;
+    plan: string;
+    quota?: number;
+    iat: number;
+    exp: number;
+    bundleIds: string[];
+    jti: string;
+    kid: string;
+}
+export interface LicenseResult {
+    valid: boolean;
+    reason?: "malformed" | "unknown_key" | "bad_signature" | "expired" | "bundle_mismatch";
+    claims?: LicenseClaims;
+}
+export interface VerifyOptions {
+    token: string;
+    bundleId: string;
+    publicKeys: Record<string, string>;
+    now?: number;
+}
+export declare function verifyLicense(opts: VerifyOptions): Promise<LicenseResult>;
+export declare function isExpired(claims: LicenseClaims, now?: number): boolean;

package/dist/license.js

@@ -0,0 +1,67 @@
+// license.ts
+// Verifies a KMS-signed license token entirely on-device, with no network call.
+// The token is a compact JWS (ES256 / NIST P-256): base64url(header).base64url(payload).base64url(signature)
+// The plugin embeds only the PUBLIC key (SPKI), so trials can expire offline.
+// --- base64 / base64url helpers (work in the webview and in Node) ---
+// Return types below are intentionally inferred: `new Uint8Array(n)` yields an
+// ArrayBuffer-backed array, which Web Crypto's BufferSource requires on TS 5.7+.
+// An explicit `: Uint8Array` annotation widens it to the wrong variant and fails.
+function b64ToBytes(s) {
+    const bin = atob(s);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        out[i] = bin.charCodeAt(i);
+    return out;
+}
+function b64urlToBytes(s) {
+    let t = s.replace(/-/g, "+").replace(/_/g, "/");
+    while (t.length % 4)
+        t += "=";
+    return b64ToBytes(t);
+}
+function b64urlToString(s) {
+    return new TextDecoder().decode(b64urlToBytes(s));
+}
+export async function verifyLicense(opts) {
+    const parts = opts.token.split(".");
+    if (parts.length !== 3)
+        return { valid: false, reason: "malformed" };
+    let header;
+    let claims;
+    try {
+        header = JSON.parse(b64urlToString(parts[0]));
+        claims = JSON.parse(b64urlToString(parts[1]));
+    }
+    catch {
+        return { valid: false, reason: "malformed" };
+    }
+    const kid = header.kid ?? claims.kid;
+    const spkiB64 = kid ? opts.publicKeys[kid] : undefined;
+    if (!spkiB64)
+        return { valid: false, reason: "unknown_key" };
+    // Verify the ES256 signature over "header.payload".
+    let signatureOk = false;
+    try {
+        const key = await crypto.subtle.importKey("spki", b64ToBytes(spkiB64), { name: "ECDSA", namedCurve: "P-256" }, false, ["verify"]);
+        const data = new TextEncoder().encode(`${parts[0]}.${parts[1]}`);
+        const sig = b64urlToBytes(parts[2]); // raw r||s, 64 bytes for P-256
+        signatureOk = await crypto.subtle.verify({ name: "ECDSA", hash: "SHA-256" }, key, sig, data);
+    }
+    catch {
+        signatureOk = false;
+    }
+    if (!signatureOk)
+        return { valid: false, reason: "bad_signature", claims };
+    const now = opts.now ?? Math.floor(Date.now() / 1000);
+    if (typeof claims.exp !== "number" || now >= claims.exp) {
+        return { valid: false, reason: "expired", claims };
+    }
+    if (!Array.isArray(claims.bundleIds) || !claims.bundleIds.includes(opts.bundleId)) {
+        return { valid: false, reason: "bundle_mismatch", claims };
+    }
+    return { valid: true, claims };
+}
+// Cheap re-check for a long-running session (no crypto): is the token still in date?
+export function isExpired(claims, now = Math.floor(Date.now() / 1000)) {
+    return typeof claims.exp !== "number" || now >= claims.exp;
+}

package/dist/mint.d.ts

@@ -0,0 +1,24 @@
+export declare function bytesToB64url(bytes: Uint8Array): string;
+export declare function strToB64url(s: string): string;
+export declare function derToRaw(der: Uint8Array): Uint8Array;
+export declare function kidFromSpki(spkiBytes: Uint8Array): string;
+export interface PublicKeyInfo {
+    kid: string;
+    spki: string;
+}
+export declare function getPublicKeyInfo(kmsKeyId: string): Promise<PublicKeyInfo>;
+export interface MintOptions {
+    kmsKeyId: string;
+    customerId: string;
+    plan: string;
+    bundleIds: string[];
+    days: number;
+    quota?: number;
+}
+export interface MintResult {
+    token: string;
+    jti: string;
+    exp: number;
+    kid: string;
+}
+export declare function mintLicenseToken(opts: MintOptions): Promise<MintResult>;

package/dist/mint.js

@@ -0,0 +1,107 @@
+// mint.ts
+// Shared KMS-signing logic used by both the mint-token CLI and the control-plane
+// issuance Lambda. Keeping both callers on the same code path guarantees
+// server-minted tokens are byte-compatible with the plugin's offline verifyLicense.
+import { createHash, randomUUID } from "node:crypto";
+import { KMSClient, SignCommand, GetPublicKeyCommand } from "@aws-sdk/client-kms";
+// ── base64url ────────────────────────────────────────────────────────────────
+export function bytesToB64url(bytes) {
+    let bin = "";
+    for (const b of bytes)
+        bin += String.fromCharCode(b);
+    return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+export function strToB64url(s) {
+    return bytesToB64url(new TextEncoder().encode(s));
+}
+// Standard base64 (non-URL): used for the SPKI bytes returned to callers.
+function uint8ToBase64(bytes) {
+    let bin = "";
+    for (const b of bytes)
+        bin += String.fromCharCode(b);
+    return btoa(bin);
+}
+// ── DER ECDSA signature → raw r‖s (P-256, 64 bytes) ────────────────────────
+// KMS returns DER-encoded; Web Crypto's ECDSA verify expects raw r‖s.
+export function derToRaw(der) {
+    let offset = 0;
+    if (der[offset++] !== 0x30)
+        throw new Error("bad DER: expected SEQUENCE");
+    let seqLen = der[offset++];
+    if (seqLen & 0x80) {
+        const n = seqLen & 0x7f;
+        seqLen = 0;
+        for (let i = 0; i < n; i++)
+            seqLen = (seqLen << 8) | der[offset++];
+    }
+    const readInt = () => {
+        if (der[offset++] !== 0x02)
+            throw new Error("bad DER: expected INTEGER");
+        const len = der[offset++];
+        const v = der.slice(offset, offset + len);
+        offset += len;
+        return v;
+    };
+    const norm = (b) => {
+        let x = b;
+        while (x.length > 32 && x[0] === 0x00)
+            x = x.slice(1);
+        const out = new Uint8Array(32);
+        out.set(x, 32 - x.length);
+        return out;
+    };
+    const r = norm(readInt());
+    const s = norm(readInt());
+    const out = new Uint8Array(64);
+    out.set(r, 0);
+    out.set(s, 32);
+    return out;
+}
+// ── kid: stable fingerprint of the SPKI bytes ───────────────────────────────
+export function kidFromSpki(spkiBytes) {
+    const hash = createHash("sha256").update(spkiBytes).digest();
+    return bytesToB64url(new Uint8Array(hash)).slice(0, 16);
+}
+export async function getPublicKeyInfo(kmsKeyId) {
+    const kms = new KMSClient({});
+    const res = await kms.send(new GetPublicKeyCommand({ KeyId: kmsKeyId }));
+    if (!res.PublicKey)
+        throw new Error("KMS returned no PublicKey");
+    const spki = new Uint8Array(res.PublicKey);
+    return { kid: kidFromSpki(spki), spki: uint8ToBase64(spki) };
+}
+export async function mintLicenseToken(opts) {
+    const kms = new KMSClient({});
+    const res = await kms.send(new GetPublicKeyCommand({ KeyId: opts.kmsKeyId }));
+    if (!res.PublicKey)
+        throw new Error("KMS returned no PublicKey");
+    const spki = new Uint8Array(res.PublicKey);
+    const kid = kidFromSpki(spki);
+    const nowSec = Math.floor(Date.now() / 1000);
+    const jti = "lic_" + randomUUID();
+    const exp = nowSec + opts.days * 86400;
+    const header = { alg: "ES256", typ: "JWT", kid };
+    const payload = {
+        sub: opts.customerId,
+        plan: opts.plan,
+        iat: nowSec,
+        exp,
+        bundleIds: opts.bundleIds,
+        jti,
+        kid,
+    };
+    if (opts.quota !== undefined)
+        payload.quota = opts.quota;
+    const signingInput = `${strToB64url(JSON.stringify(header))}.${strToB64url(JSON.stringify(payload))}`;
+    const signed = await kms.send(new SignCommand({
+        KeyId: opts.kmsKeyId,
+        Message: new TextEncoder().encode(signingInput),
+        MessageType: "RAW",
+        SigningAlgorithm: "ECDSA_SHA_256",
+    }));
+    if (!signed.Signature)
+        throw new Error("KMS Sign returned no Signature");
+    const rawSig = derToRaw(new Uint8Array(signed.Signature));
+    const token = `${signingInput}.${bytesToB64url(rawSig)}`;
+    return { token, jti, exp, kid };
+}

package/package.json

@@ -0,0 +1,42 @@
+{
+  "name": "@parselo/scanner-core",
+  "version": "0.0.1",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/parselo-io/parselo-sdk.git",
+    "directory": "packages/scanner-core"
+  },
+  "description": "Platform-agnostic core: AAMVA PDF417 parsing, offline license verification, and PII-free scan analytics.",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "dist/index.js",
+  "module": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./mint": {
+      "types": "./dist/mint.d.ts",
+      "import": "./dist/mint.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "test": "node --experimental-strip-types src/test.ts",
+    "mint": "node tools/mint-token.mjs",
+    "verify": "node --experimental-strip-types tools/verify-token.ts"
+  },
+  "devDependencies": {
+    "@aws-sdk/client-kms": "^3.600.0",
+    "typescript": "^5.5.0"
+  }
+}