@permitcore/permitcore 1.0.0

package/README.md

@@ -0,0 +1,229 @@
+# PermitCore Node.js SDK
+
+Official Node.js/TypeScript client for [PermitCore](https://permitcore.dev) license management.
+
+**Requirements:** Node.js 16+, zero runtime dependencies (uses the global `fetch` and Node's
+built-in `crypto` module for offline license token verification).
+
+---
+
+## Installation
+
+```bash
+npm install permitcore
+```
+
+---
+
+## Quick start
+
+```typescript
+import { PermitCoreClient } from 'permitcore';
+
+const client = new PermitCoreClient('https://your-instance.com');
+const result = await client.validate('PERMIT-XXXX-XXXX-XXXX-XXXX');
+
+if (result.isValid) {
+  console.log(`Valid! Product: ${result.productName}`);
+  if (PermitCoreClient.hasFeature(result, 'export')) {
+    enableExport();
+  }
+}
+```
+
+---
+
+## Validate
+
+```typescript
+const result = await client.validate(licenseKey, '2.3.1'); // version is optional
+
+// result.isValid                  boolean
+// result.productName              string | undefined
+// result.remainingActivations     number | undefined
+// result.expiresAt                string | undefined  (ISO 8601)
+// result.features                 string[] | undefined
+// result.customFields             Record<string, string> | undefined
+// result.isTrial                  boolean | undefined
+// result.trialDaysRemaining       number | undefined
+// result.nodeLocked               boolean | undefined
+// result.offlineGraceDays         number | undefined
+// result.minVersion               string | undefined
+// result.maxVersion               string | undefined
+// result.message                  string | undefined
+// result.isOffline                boolean | undefined  (true when served from local cache)
+```
+
+`validate()` never consumes an activation slot. It falls back to the local disk cache when the
+server is unreachable, as long as the license has `offlineGraceDays` configured. Passing
+`version` lets the server enforce `minVersion`/`maxVersion` restrictions on the license.
+
+---
+
+## Activate
+
+```typescript
+const result = await client.activate(
+  licenseKey,
+  undefined,               // deviceId — auto-generated HWID when omitted
+  'Production Server #1',  // deviceName
+  '2.3.1',                 // version (optional)
+);
+
+if (!result.isValid) {
+  throw new Error(`Activation failed: ${result.message}`);
+}
+```
+
+Call `activate()` **once** per installation. Use `validate()` on every subsequent launch.
+
+---
+
+## Meter (usage events)
+
+```typescript
+// Record a single API call
+const recorded = await client.meter(licenseKey, 'api_call');
+
+// Record bulk usage with metadata
+const recorded2 = await client.meter(licenseKey, 'export', 5, { format: 'pdf', pages: 12 });
+```
+
+Returns `true` if the event was recorded on the server, `false` on any failure (network error, or
+the server rejecting the event).
+
+---
+
+## Floating licenses
+
+```typescript
+// Check out a seat at session start
+const session = await client.checkout(licenseKey);
+if (!session.success) {
+  throw new Error(`No seats available: ${session.message}`);
+}
+
+const token = session.sessionToken!;
+
+// Heartbeat every 4-5 minutes to keep the seat alive
+await client.heartbeat(token);
+
+// Release the seat when done
+await client.checkin(token);
+```
+
+---
+
+## Offline license tokens
+
+An offline activation token (`pc_offline_v1.<payload>.<signature>`) lets your app verify a
+license with **zero network calls**, using ECDSA P-256 signature verification against your
+tenant's public key (`GET /api/v1/{tenantSlug}/public-key`). Useful for air-gapped or
+intermittently-connected deployments.
+
+```typescript
+// Pure local verification — no network call. Never throws.
+const result = client.verifyOfflineToken(token, publicKeyBase64);
+
+if (result.isValid) {
+  console.log(`Valid! Product: ${result.productName}`);
+} else {
+  console.log(`Invalid: ${result.message}`);
+}
+```
+
+```typescript
+// Verify + bind to this device + persist locally (call once, e.g. at install time)
+const result = client.activateOffline(token, publicKeyBase64, deviceId);
+
+// On every later launch — no token needed, reads the local cache, still no network call
+const result2 = client.validateOffline(deviceId);
+```
+
+```typescript
+// Optional: ask the server to verify the token AND check its revocation status (requires network)
+const result3 = await client.verifyOfflineOnline(token);
+```
+
+All four methods return an `OfflineTokenResult` — on a valid token, the payload fields
+(`tokenId`, `tenantSlug`, `tenantId`, `licenseId`, `deviceId`, `deviceName`, `productName`,
+`maxActivations`, `issuedAt`, `expiresAt`) are merged in alongside `isValid`/`message`.
+`verifyOfflineToken()` and `validateOffline()` never throw — malformed, tampered, expired, or
+missing input all come back as `isValid: false` with a descriptive `message`.
+
+`activateOffline()`'s local cache is stored under the OS temp directory as
+`.permitcore_offline_<hash>` (same convention as the `validate()`/`activate()` cache, keyed by
+device ID instead of license key).
+
+---
+
+## Version enforcement
+
+```typescript
+const result = await client.validate(licenseKey);
+
+const myVersion = '2.3.0';
+if (result.minVersion && myVersion < result.minVersion) {
+  throw new Error(`Please update to version ${result.minVersion} or newer.`);
+}
+if (result.maxVersion && myVersion > result.maxVersion) {
+  throw new Error(`This build (${myVersion}) is not licensed for versions above ${result.maxVersion}.`);
+}
+```
+
+Pass a `version` argument to `validate()`/`activate()` to also have the *server* enforce this —
+otherwise only client-side comparison happens.
+
+---
+
+## Offline grace pattern
+
+```typescript
+const result = await client.validate(licenseKey); // falls back to cache automatically
+
+if (!result.isValid) {
+  throw new Error(`License invalid: ${result.message}`);
+}
+
+if (result.isOffline) {
+  // Server unreachable — running on cached result
+  showNotice('Running in offline mode. Connect to the internet to refresh your license.');
+}
+```
+
+The cache is stored under the OS temp directory as `.permitcore_cache_<hash>`. It expires after
+`offlineGraceDays` days.
+
+---
+
+## Constructor options
+
+```typescript
+const client = new PermitCoreClient({
+  baseUrl: 'https://your-instance.com',
+  enableOfflineCache: true, // default — set false to always require network
+  timeoutMs: 5000,          // HTTP timeout in milliseconds
+});
+```
+
+---
+
+## LicenseResult reference
+
+| Field | Type | Description |
+|---|---|---|
+| `isValid` | `boolean` | True if the license is active and valid |
+| `productName` | `string?` | Product the license belongs to |
+| `remainingActivations` | `number?` | Slots left before MaxActivations is reached |
+| `expiresAt` | `string?` | Expiry date (ISO 8601 UTC), undefined if perpetual |
+| `features` | `string[]?` | Feature flag list, e.g. `['export', 'api']` |
+| `customFields` | `Record<string, string>?` | Arbitrary key/value metadata set on the license |
+| `isTrial` | `boolean?` | True for trial licenses |
+| `trialDaysRemaining` | `number?` | Days until trial expires |
+| `nodeLocked` | `boolean?` | True if bound to a specific device |
+| `offlineGraceDays` | `number?` | How many days the cache is valid |
+| `minVersion` / `maxVersion` | `string?` | Version enforcement bounds |
+| `message` | `string?` | Reason when `isValid = false` |
+| `isOffline` | `boolean?` | True when result came from local cache |
+
+`PermitCoreClient.hasFeature(result, feature)` — static, case-insensitive feature check.

package/dist/index.d.ts

@@ -0,0 +1,174 @@
+export interface LicenseResult {
+    isValid: boolean;
+    productName?: string;
+    remainingActivations?: number;
+    expiresAt?: string;
+    message?: string;
+    customFields?: Record<string, string>;
+    vendorWarning?: string;
+    features?: string[];
+    isTrial?: boolean;
+    trialDaysRemaining?: number;
+    nodeLocked?: boolean;
+    offlineGraceDays?: number;
+    minVersion?: string;
+    maxVersion?: string;
+    /**
+     * ECDSA-signed `pc_grace_v1` token (non-null only when the license has an offline grace
+     * period configured and this call succeeded). The SDK caches this — not the rest of this
+     * response — and verifies it locally before trusting a cached result on a later offline
+     * call. See `verifyGraceCacheToken`.
+     */
+    offlineCacheToken?: string | null;
+    /** True when served from local cache (server unreachable) */
+    isOffline?: boolean;
+}
+export interface MeterResult {
+    recorded: boolean;
+    message?: string;
+}
+export interface FloatingSession {
+    success: boolean;
+    sessionToken?: string;
+    expiresAt?: string;
+    message?: string;
+}
+export interface PermitCoreOptions {
+    baseUrl: string;
+    /** Enable offline grace period caching. Default: true */
+    enableOfflineCache?: boolean;
+    /** Request timeout in milliseconds. Default: 5000 */
+    timeoutMs?: number;
+}
+/** Decoded payload of a `pc_offline_v1` offline activation token. */
+export interface OfflineTokenPayload {
+    version: number;
+    tokenId: string;
+    tenantSlug: string;
+    tenantId: string;
+    licenseId: string;
+    licenseKeyHash: string;
+    deviceId: string;
+    deviceName?: string | null;
+    productName: string;
+    maxActivations: number;
+    issuedAt: string;
+    expiresAt: string;
+}
+export interface OfflineTokenResult {
+    isValid: boolean;
+    tokenId?: string;
+    tenantSlug?: string;
+    tenantId?: string;
+    licenseId?: string;
+    deviceId?: string;
+    deviceName?: string | null;
+    productName?: string;
+    maxActivations?: number;
+    issuedAt?: string;
+    expiresAt?: string;
+    message?: string;
+}
+/** Decoded payload of a `pc_grace_v1` offline grace-cache token. */
+export interface GraceCachePayload {
+    version: number;
+    tenantSlug: string;
+    kid?: string | null;
+    licenseKeyHash: string;
+    deviceId?: string | null;
+    isValid: boolean;
+    productName?: string | null;
+    features?: string[] | null;
+    remainingActivations?: number | null;
+    expiresAt?: string | null;
+    issuedAt: string;
+    validUntil: string;
+}
+export interface GraceCacheResult {
+    isValid: boolean;
+    message?: string;
+    payload?: GraceCachePayload;
+}
+export declare class PermitCoreClient {
+    private readonly baseUrl;
+    private readonly opts;
+    constructor(baseUrlOrOptions: string | PermitCoreOptions);
+    /**
+     * Validates a license key. Does NOT consume an activation slot.
+     * Falls back to local cache when server is unreachable (offline grace period).
+     */
+    validate(licenseKey: string, version?: string): Promise<LicenseResult>;
+    /**
+     * Validates AND activates the key on this device.
+     * Call only once per installation.
+     * @param deviceId Optional — auto-generated HWID is used when omitted.
+     */
+    activate(licenseKey: string, deviceId?: string, deviceName?: string, version?: string): Promise<LicenseResult>;
+    /**
+     * Records a usage event for metered billing.
+     * Returns true if the event was recorded on the server, false on any failure
+     * (network error, or the server rejecting the event).
+     */
+    meter(licenseKey: string, eventName: string, quantity?: number, meta?: Record<string, unknown>): Promise<boolean>;
+    checkout(licenseKey: string, deviceId?: string, deviceName?: string): Promise<FloatingSession>;
+    heartbeat(sessionToken: string): Promise<FloatingSession>;
+    checkin(sessionToken: string): Promise<void>;
+    /**
+     * Verifies a `pc_offline_v1` offline activation token entirely locally — no network I/O.
+     * The signed bytes are the UTF-8 bytes of the base64url payload *string* (not the decoded
+     * JSON), and the signature is ECDSA P-256/SHA-256 in raw IEEE P1363 format (not ASN.1 DER),
+     * matching `OfflineActivationService.Sign` server-side. Never throws — malformed input,
+     * a signature mismatch, or an expired token all just produce `{ isValid: false }`.
+     */
+    verifyOfflineToken(token: string, publicKeyBase64: string): OfflineTokenResult;
+    /**
+     * Verifies an offline token (see `verifyOfflineToken`), confirms it was issued for
+     * `deviceId`, and — on success — persists the verified payload locally so a later
+     * `validateOffline()` call can re-check it with zero network calls (e.g. on every app start).
+     */
+    activateOffline(token: string, publicKeyBase64: string, deviceId: string): OfflineTokenResult;
+    /**
+     * Re-checks a previously `activateOffline()`-persisted token against the local clock and
+     * device id — no network call, no token needed. This is what a long-running app should call
+     * on every start once it has already offline-activated once.
+     */
+    validateOffline(deviceId: string): OfflineTokenResult;
+    /**
+     * Thin online wrapper around `POST /api/v1/offline/verify` — lets the server additionally
+     * check token revocation status, which is impossible to verify purely locally. Not required
+     * for offline use; a convenience for apps that have connectivity and want the extra check.
+     */
+    verifyOfflineOnline(token: string): Promise<OfflineTokenResult>;
+    /**
+     * Verifies a `pc_grace_v1` offline grace-cache token entirely locally — no network I/O.
+     * Exposed publicly so a custom integration (not using the built-in save/load-from-cache
+     * flow) can implement its own caching around the same verified primitive. Never throws —
+     * malformed input, a signature mismatch, or an expired grace period all just produce
+     * `{ isValid: false }`.
+     */
+    verifyGraceCacheToken(token: string, publicKeyBase64: string): GraceCacheResult;
+    /**
+     * Returns a stable hardware fingerprint (SHA-256 of machine identifiers).
+     */
+    static getHardwareId(): string;
+    /** Check if a validate/activate result includes a specific feature flag. */
+    static hasFeature(result: LicenseResult, feature: string): boolean;
+    private fetch;
+    /**
+     * [S-Grace1] Caches the SIGNED token, not the raw response — the server only issues
+     * `offlineCacheToken` when a grace period is configured, so a null/missing token here
+     * already means "nothing to cache," same as the old `offlineGraceDays` check. The
+     * unverified `tenantSlug` is read out of the token purely to pick which tenant's
+     * public key to fetch (see `extractUnverifiedTenantSlug`); nothing is trusted or
+     * persisted until `verifyGraceCacheToken` confirms the signature against that key.
+     */
+    private saveToCache;
+    /**
+     * No network call here — verification uses only the public key persisted alongside the
+     * token at save time. This is the entire point: a hand-edited cache file (or one copied
+     * to another machine) fails ECDSA verification instead of silently working.
+     */
+    private loadFromCache;
+}
+export default PermitCoreClient;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,6DAA6D;IAC7D,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qEAAqE;AACrE,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,oEAAoE;AACpE,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,iBAAiB,CAAC;CAC7B;AAWD,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA8B;IAEnD,YAAY,gBAAgB,EAAE,MAAM,GAAG,iBAAiB,EAOvD;IAID;;;OAGG;IACG,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAc3E;IAID;;;;OAIG;IACG,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAoBnH;IAID;;;;OAIG;IACG,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,SAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAWjH;IAIK,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAOnG;IAIK,SAAS,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAM9D;IAIK,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMjD;IAID;;;;;;OAMG;IACH,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,kBAAkB,CA+C7E;IAED;;;;OAIG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,kBAAkB,CAe5F;IAED;;;;OAIG;IACH,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,kBAAkB,CAgBpD;IAED;;;;OAIG;IACG,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAWpE;IAOD;;;;;;OAMG;IACH,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,GAAG,gBAAgB,CAkC9E;IAID;;OAEG;IACH,MAAM,CAAC,aAAa,IAAI,MAAM,CAa7B;IAID,4EAA4E;IAC5E,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAEjE;YAIa,KAAK;IAmBnB;;;;;;;OAOG;YACW,WAAW;IAqBzB;;;;OAIG;IACH,OAAO,CAAC,aAAa;CAsBtB;eAuCc,gBAAgB"}

package/dist/index.js

@@ -0,0 +1,440 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PermitCoreClient = void 0;
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+// ── Client ─────────────────────────────────────────────────────────────────
+class PermitCoreClient {
+    constructor(baseUrlOrOptions) {
+        if (typeof baseUrlOrOptions === 'string') {
+            this.opts = { baseUrl: baseUrlOrOptions, enableOfflineCache: true, timeoutMs: 5000 };
+        }
+        else {
+            this.opts = { enableOfflineCache: true, timeoutMs: 5000, ...baseUrlOrOptions };
+        }
+        this.baseUrl = this.opts.baseUrl.replace(/\/$/, '');
+    }
+    // ── Validate ─────────────────────────────────────────────────────────
+    /**
+     * Validates a license key. Does NOT consume an activation slot.
+     * Falls back to local cache when server is unreachable (offline grace period).
+     */
+    async validate(licenseKey, version) {
+        try {
+            const res = await this.fetch(`${this.baseUrl}/api/v1/validate`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ licenseKey, ...(version ? { version } : {}) }),
+            });
+            if (res.isValid)
+                await this.saveToCache(licenseKey, res);
+            return res;
+        }
+        catch (err) {
+            const cached = this.loadFromCache(licenseKey);
+            if (cached)
+                return cached;
+            return { isValid: false, message: 'Cannot reach license server.', isOffline: true };
+        }
+    }
+    // ── Activate ─────────────────────────────────────────────────────────
+    /**
+     * Validates AND activates the key on this device.
+     * Call only once per installation.
+     * @param deviceId Optional — auto-generated HWID is used when omitted.
+     */
+    async activate(licenseKey, deviceId, deviceName, version) {
+        const hwid = deviceId ?? PermitCoreClient.getHardwareId();
+        try {
+            // [S-Nonce] Fetch a single-use nonce first (replay-attack protection)
+            const { nonce } = await this.fetch(`${this.baseUrl}/api/v1/nonce`);
+            const res = await this.fetch(`${this.baseUrl}/api/v1/activate`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ licenseKey, deviceId: hwid, deviceName, version, nonce }),
+            });
+            if (res.isValid)
+                await this.saveToCache(licenseKey, res);
+            return res;
+        }
+        catch {
+            // [S-Continuity] If this device already activated successfully before (e.g. an app
+            // that re-runs activate() on every launch, or a reinstall that kept the cache file),
+            // fall back to that cached result instead of failing outright.
+            const cached = this.loadFromCache(licenseKey);
+            if (cached)
+                return cached;
+            return { isValid: false, message: 'Cannot reach license server.', isOffline: true };
+        }
+    }
+    // ── Meter ────────────────────────────────────────────────────────────
+    /**
+     * Records a usage event for metered billing.
+     * Returns true if the event was recorded on the server, false on any failure
+     * (network error, or the server rejecting the event).
+     */
+    async meter(licenseKey, eventName, quantity = 1, meta) {
+        try {
+            const res = await this.fetch(`${this.baseUrl}/api/v1/meter`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ licenseKey, eventName, quantity, ...(meta ? { meta } : {}) }),
+            });
+            return res.recorded ?? false;
+        }
+        catch {
+            return false;
+        }
+    }
+    // ── Floating ─────────────────────────────────────────────────────────
+    async checkout(licenseKey, deviceId, deviceName) {
+        const hwid = deviceId ?? PermitCoreClient.getHardwareId();
+        return this.fetch(`${this.baseUrl}/api/v1/float/checkout`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ licenseKey, deviceId: hwid, deviceName }),
+        });
+    }
+    // [S-Float] Session token in the POST body — never the URL path — matches
+    // FloatingController.Heartbeat's FloatingTokenRequest exactly.
+    async heartbeat(sessionToken) {
+        return this.fetch(`${this.baseUrl}/api/v1/float/heartbeat`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ sessionToken }),
+        });
+    }
+    // [S-Float] Session token in the POST body — never the URL path — matches
+    // FloatingController.Checkin's FloatingTokenRequest exactly (also: it's a POST, not DELETE).
+    async checkin(sessionToken) {
+        await this.fetch(`${this.baseUrl}/api/v1/float/checkin`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ sessionToken }),
+        });
+    }
+    // ── Offline activation tokens ───────────────────────────────────────
+    /**
+     * Verifies a `pc_offline_v1` offline activation token entirely locally — no network I/O.
+     * The signed bytes are the UTF-8 bytes of the base64url payload *string* (not the decoded
+     * JSON), and the signature is ECDSA P-256/SHA-256 in raw IEEE P1363 format (not ASN.1 DER),
+     * matching `OfflineActivationService.Sign` server-side. Never throws — malformed input,
+     * a signature mismatch, or an expired token all just produce `{ isValid: false }`.
+     */
+    verifyOfflineToken(token, publicKeyBase64) {
+        try {
+            const parts = token.split('.');
+            if (parts.length !== 3 || parts[0] !== 'pc_offline_v1') {
+                return { isValid: false, message: 'Malformed offline token.' };
+            }
+            const payloadBytes = Buffer.from(parts[1], 'utf8');
+            const signature = Buffer.from(parts[2], 'base64url');
+            const publicKey = crypto.createPublicKey({
+                key: Buffer.from(publicKeyBase64, 'base64'),
+                format: 'der',
+                type: 'spki',
+            });
+            const signatureOk = crypto.verify('sha256', payloadBytes, { key: publicKey, dsaEncoding: 'ieee-p1363' }, signature);
+            if (!signatureOk)
+                return { isValid: false, message: 'Offline token signature is invalid.' };
+            const json = Buffer.from(parts[1], 'base64url').toString('utf8');
+            const payload = JSON.parse(json);
+            if (new Date(payload.expiresAt).getTime() < Date.now()) {
+                return { isValid: false, message: 'Offline token has expired.' };
+            }
+            return {
+                isValid: true,
+                tokenId: payload.tokenId,
+                tenantSlug: payload.tenantSlug,
+                tenantId: payload.tenantId,
+                licenseId: payload.licenseId,
+                deviceId: payload.deviceId,
+                deviceName: payload.deviceName,
+                productName: payload.productName,
+                maxActivations: payload.maxActivations,
+                issuedAt: payload.issuedAt,
+                expiresAt: payload.expiresAt,
+                message: 'Offline token is valid.',
+            };
+        }
+        catch {
+            return { isValid: false, message: 'Failed to verify offline token.' };
+        }
+    }
+    /**
+     * Verifies an offline token (see `verifyOfflineToken`), confirms it was issued for
+     * `deviceId`, and — on success — persists the verified payload locally so a later
+     * `validateOffline()` call can re-check it with zero network calls (e.g. on every app start).
+     */
+    activateOffline(token, publicKeyBase64, deviceId) {
+        const result = this.verifyOfflineToken(token, publicKeyBase64);
+        if (!result.isValid)
+            return result;
+        if (!result.deviceId || result.deviceId.toLowerCase() !== deviceId.toLowerCase()) {
+            return { isValid: false, message: 'Offline token was issued for a different device.' };
+        }
+        if (this.opts.enableOfflineCache) {
+            try {
+                fs.writeFileSync(getOfflineActivationPath(deviceId), JSON.stringify(result));
+            }
+            catch { /* non-critical */ }
+        }
+        return result;
+    }
+    /**
+     * Re-checks a previously `activateOffline()`-persisted token against the local clock and
+     * device id — no network call, no token needed. This is what a long-running app should call
+     * on every start once it has already offline-activated once.
+     */
+    validateOffline(deviceId) {
+        try {
+            const raw = fs.readFileSync(getOfflineActivationPath(deviceId), 'utf8');
+            const cached = JSON.parse(raw);
+            if (!cached.deviceId || cached.deviceId.toLowerCase() !== deviceId.toLowerCase()) {
+                return { isValid: false, message: 'No offline activation found for this device.' };
+            }
+            if (!cached.expiresAt || new Date(cached.expiresAt).getTime() < Date.now()) {
+                return { isValid: false, message: 'Offline activation has expired.' };
+            }
+            return { ...cached, isValid: true };
+        }
+        catch {
+            return { isValid: false, message: 'No offline activation found for this device.' };
+        }
+    }
+    /**
+     * Thin online wrapper around `POST /api/v1/offline/verify` — lets the server additionally
+     * check token revocation status, which is impossible to verify purely locally. Not required
+     * for offline use; a convenience for apps that have connectivity and want the extra check.
+     */
+    async verifyOfflineOnline(token) {
+        try {
+            const res = await this.fetch(`${this.baseUrl}/api/v1/offline/verify`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ token }),
+            });
+            return res;
+        }
+        catch {
+            return { isValid: false, message: 'Cannot reach license server.' };
+        }
+    }
+    // ── Grace-cache token verification (pc_grace_v1, ECDSA P-256 / IEEE P1363) ──────────
+    // [S-Grace1] Same crypto convention as verifyOfflineToken above (raw IEEE P1363 signature
+    // over the UTF-8 bytes of the base64url payload *string*), different prefix and payload
+    // shape. Matches OfflineActivationService.VerifyGraceCache server-side byte-for-byte.
+    /**
+     * Verifies a `pc_grace_v1` offline grace-cache token entirely locally — no network I/O.
+     * Exposed publicly so a custom integration (not using the built-in save/load-from-cache
+     * flow) can implement its own caching around the same verified primitive. Never throws —
+     * malformed input, a signature mismatch, or an expired grace period all just produce
+     * `{ isValid: false }`.
+     */
+    verifyGraceCacheToken(token, publicKeyBase64) {
+        try {
+            const parts = token.split('.');
+            if (parts.length !== 3 || parts[0] !== 'pc_grace_v1') {
+                return { isValid: false, message: 'Malformed grace cache token.' };
+            }
+            const payloadBytes = Buffer.from(parts[1], 'utf8');
+            const signature = Buffer.from(parts[2], 'base64url');
+            const publicKey = crypto.createPublicKey({
+                key: Buffer.from(publicKeyBase64, 'base64'),
+                format: 'der',
+                type: 'spki',
+            });
+            const signatureOk = crypto.verify('sha256', payloadBytes, { key: publicKey, dsaEncoding: 'ieee-p1363' }, signature);
+            if (!signatureOk)
+                return { isValid: false, message: 'Grace cache token signature is invalid.' };
+            const json = Buffer.from(parts[1], 'base64url').toString('utf8');
+            const payload = JSON.parse(json);
+            if (new Date(payload.validUntil).getTime() < Date.now()) {
+                return { isValid: false, message: 'Grace period has expired.', payload };
+            }
+            return { isValid: true, message: 'Valid.', payload };
+        }
+        catch {
+            return { isValid: false, message: 'Invalid or corrupt grace cache token.' };
+        }
+    }
+    // ── HWID ─────────────────────────────────────────────────────────────
+    /**
+     * Returns a stable hardware fingerprint (SHA-256 of machine identifiers).
+     */
+    static getHardwareId() {
+        const components = [
+            os.hostname(),
+            os.platform(),
+            os.arch(),
+            String(os.cpus().length),
+            getOrCreateSeedFile(),
+        ].filter(Boolean);
+        return crypto
+            .createHash('sha256')
+            .update(components.join('|'))
+            .digest('hex');
+    }
+    // ── Feature helpers ───────────────────────────────────────────────────
+    /** Check if a validate/activate result includes a specific feature flag. */
+    static hasFeature(result, feature) {
+        return result.features?.some(f => f.toLowerCase() === feature.toLowerCase()) ?? false;
+    }
+    // ── Internal ──────────────────────────────────────────────────────────
+    async fetch(url, init) {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.opts.timeoutMs);
+        try {
+            const res = await globalThis.fetch(url, {
+                ...init,
+                signal: controller.signal,
+                headers: { 'User-Agent': 'PermitCore-Node/1.0', ...(init?.headers ?? {}) },
+            });
+            if (!res.ok && res.status >= 500)
+                throw new Error(`HTTP ${res.status}`);
+            // checkin() gets a 204 No Content on success — res.json() would throw on the empty body.
+            if (res.status === 204)
+                return undefined;
+            const text = await res.text();
+            return (text ? JSON.parse(text) : undefined);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    /**
+     * [S-Grace1] Caches the SIGNED token, not the raw response — the server only issues
+     * `offlineCacheToken` when a grace period is configured, so a null/missing token here
+     * already means "nothing to cache," same as the old `offlineGraceDays` check. The
+     * unverified `tenantSlug` is read out of the token purely to pick which tenant's
+     * public key to fetch (see `extractUnverifiedTenantSlug`); nothing is trusted or
+     * persisted until `verifyGraceCacheToken` confirms the signature against that key.
+     */
+    async saveToCache(licenseKey, result) {
+        if (!this.opts.enableOfflineCache || !result.offlineCacheToken)
+            return;
+        try {
+            const tenantSlug = extractUnverifiedTenantSlug(result.offlineCacheToken);
+            if (!tenantSlug)
+                return;
+            const pubKeyResp = await this.fetch(`${this.baseUrl}/api/v1/${encodeURIComponent(tenantSlug)}/public-key`);
+            if (!pubKeyResp?.publicKey)
+                return;
+            // Verify before persisting anything — never cache a token this SDK can't itself
+            // verify later; that would just recreate the old "trust an opaque file" problem.
+            const check = this.verifyGraceCacheToken(result.offlineCacheToken, pubKeyResp.publicKey);
+            if (!check.isValid)
+                return;
+            const entry = { token: result.offlineCacheToken, publicKey: pubKeyResp.publicKey };
+            fs.writeFileSync(getCachePath(licenseKey), JSON.stringify(entry));
+        }
+        catch { /* cache failure must never block normal flow */ }
+    }
+    /**
+     * No network call here — verification uses only the public key persisted alongside the
+     * token at save time. This is the entire point: a hand-edited cache file (or one copied
+     * to another machine) fails ECDSA verification instead of silently working.
+     */
+    loadFromCache(licenseKey) {
+        if (!this.opts.enableOfflineCache)
+            return null;
+        try {
+            const data = fs.readFileSync(getCachePath(licenseKey), 'utf8');
+            const entry = JSON.parse(data);
+            if (!entry?.token || !entry?.publicKey)
+                return null;
+            const check = this.verifyGraceCacheToken(entry.token, entry.publicKey);
+            if (!check.isValid || !check.payload)
+                return null;
+            const p = check.payload;
+            return {
+                isValid: p.isValid,
+                productName: p.productName ?? undefined,
+                remainingActivations: p.remainingActivations ?? undefined,
+                expiresAt: p.expiresAt ?? undefined,
+                features: p.features ?? undefined,
+                isOffline: true,
+                message: `Offline mode — valid until ${p.validUntil} (cryptographically verified)`,
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+}
+exports.PermitCoreClient = PermitCoreClient;
+// ── Helpers ────────────────────────────────────────────────────────────────
+function getCachePath(licenseKey) {
+    const hash = crypto.createHash('sha256').update(licenseKey).digest('hex').slice(0, 16);
+    return path.join(os.tmpdir(), `.permitcore_cache_${hash}`);
+}
+function getOfflineActivationPath(deviceId) {
+    const hash = crypto.createHash('sha256').update(deviceId).digest('hex').slice(0, 16);
+    return path.join(os.tmpdir(), `.permitcore_offline_${hash}`);
+}
+// Reads only the `tenantSlug` field out of a pc_grace_v1 token's payload, WITHOUT verifying
+// the signature — safe to do because it's only used to pick which tenant's public-key
+// endpoint to fetch. The subsequent verifyGraceCacheToken call is what actually establishes
+// trust before anything gets persisted to disk.
+function extractUnverifiedTenantSlug(token) {
+    try {
+        const parts = token.split('.');
+        if (parts.length !== 3 || parts[0] !== 'pc_grace_v1')
+            return null;
+        const json = Buffer.from(parts[1], 'base64url').toString('utf8');
+        const payload = JSON.parse(json);
+        return payload.tenantSlug ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+function getOrCreateSeedFile() {
+    const seedPath = path.join(os.homedir(), '.permitcore_seed');
+    try {
+        if (!fs.existsSync(seedPath))
+            fs.writeFileSync(seedPath, crypto.randomUUID());
+        return fs.readFileSync(seedPath, 'utf8').trim();
+    }
+    catch {
+        return '';
+    }
+}
+// ── Default export ─────────────────────────────────────────────────────────
+exports.default = PermitCoreClient;
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,MAAY,MAAM,mCAAe;AACjC,MAAY,EAAE,+BAAW;AACzB,MAAY,EAAE,+BAAW;AACzB,MAAY,IAAI,iCAAa;AA8G7B,8EAA8E;AAE9E;IAIE,YAAY,gBAA4C;QACtD,IAAI,OAAO,gBAAgB,KAAK,QAAQ,EAAE,CAAC;YACzC,IAAI,CAAC,IAAI,GAAG,EAAE,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACvF,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,gBAAgB,EAAE,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,wEAAwE;IAExE;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,UAAkB,EAAE,OAAgB;QACjD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAgB,GAAG,IAAI,CAAC,OAAO,kBAAkB,EAAE;gBAC7E,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;aACtE,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,OAAO;gBAAE,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YACzD,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;YAC9C,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,8BAA8B,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACtF,CAAC;IACH,CAAC;IAED,wEAAwE;IAExE;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,UAAkB,EAAE,QAAiB,EAAE,UAAmB,EAAE,OAAgB;QACzF,MAAM,IAAI,GAAG,QAAQ,IAAI,gBAAgB,CAAC,aAAa,EAAE,CAAC;QAC1D,IAAI,CAAC;YACH,sEAAsE;YACtE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAoB,GAAG,IAAI,CAAC,OAAO,eAAe,CAAC,CAAC;YACtF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAgB,GAAG,IAAI,CAAC,OAAO,kBAAkB,EAAE;gBAC7E,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;aACjF,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,OAAO;gBAAE,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;YACzD,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,MAAM,CAAC;YACP,mFAAmF;YACnF,qFAAqF;YACrF,+DAA+D;YAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;YAC9C,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;YAC1B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,8BAA8B,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACtF,CAAC;IACH,CAAC;IAED,wEAAwE;IAExE;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,UAAkB,EAAE,SAAiB,EAAE,QAAQ,GAAG,CAAC,EAAE,IAA8B;QAC7F,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAc,GAAG,IAAI,CAAC,OAAO,eAAe,EAAE;gBACxE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;aACrF,CAAC,CAAC;YACH,OAAO,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,wEAAwE;IAExE,KAAK,CAAC,QAAQ,CAAC,UAAkB,EAAE,QAAiB,EAAE,UAAmB;QACvE,MAAM,IAAI,GAAG,QAAQ,IAAI,gBAAgB,CAAC,aAAa,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC,KAAK,CAAkB,GAAG,IAAI,CAAC,OAAO,wBAAwB,EAAE;YAC1E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;SACjE,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,+DAA+D;IAC/D,KAAK,CAAC,SAAS,CAAC,YAAoB;QAClC,OAAO,IAAI,CAAC,KAAK,CAAkB,GAAG,IAAI,CAAC,OAAO,yBAAyB,EAAE;YAC3E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,6FAA6F;IAC7F,KAAK,CAAC,OAAO,CAAC,YAAoB;QAChC,MAAM,IAAI,CAAC,KAAK,CAAO,GAAG,IAAI,CAAC,OAAO,uBAAuB,EAAE;YAC7D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,CAAC;SACvC,CAAC,CAAC;IACL,CAAC;IAED,uEAAuE;IAEvE;;;;;;OAMG;IACH,kBAAkB,CAAC,KAAa,EAAE,eAAuB;QACvD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,eAAe,EAAE,CAAC;gBACvD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;YACjE,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACnD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YACrD,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC;gBACvC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC;gBAC3C,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAC/B,QAAQ,EACR,YAAY,EACZ,EAAE,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,EAC7C,SAAS,CACV,CAAC;YACF,IAAI,CAAC,WAAW;gBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,qCAAqC,EAAE,CAAC;YAE5F,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAwB,CAAC;YAExD,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACvD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC;YACnE,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,yBAAyB;aACnC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC;QACxE,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,eAAe,CAAC,KAAa,EAAE,eAAuB,EAAE,QAAgB;QACtE,MAAM,MAAM,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QAEnC,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;YACjF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC;QACzF,CAAC;QAED,IAAI,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,EAAE,CAAC,aAAa,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/E,CAAC;YAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACH,eAAe,CAAC,QAAgB;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;YACxE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC;YAErD,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;gBACjF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC;YACrF,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAC3E,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC;YACxE,CAAC;YAED,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC;QACrF,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CAAC,KAAa;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAqB,GAAG,IAAI,CAAC,OAAO,wBAAwB,EAAE;gBACxF,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;aAChC,CAAC,CAAC;YACH,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;QACrE,CAAC;IACH,CAAC;IAED,uFAAuF;IACvF,0FAA0F;IAC1F,wFAAwF;IACxF,sFAAsF;IAEtF;;;;;;OAMG;IACH,qBAAqB,CAAC,KAAa,EAAE,eAAuB;QAC1D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,aAAa,EAAE,CAAC;gBACrD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;YACrE,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YACnD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YACrD,MAAM,SAAS,GAAG,MAAM,CAAC,eAAe,CAAC;gBACvC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,QAAQ,CAAC;gBAC3C,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,MAAM;aACb,CAAC,CAAC;YAEH,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAC/B,QAAQ,EACR,YAAY,EACZ,EAAE,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,EAC7C,SAAS,CACV,CAAC;YACF,IAAI,CAAC,WAAW;gBAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC;YAEhG,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAsB,CAAC;YAEtD,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACxD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,2BAA2B,EAAE,OAAO,EAAE,CAAC;YAC3E,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,wEAAwE;IAExE;;OAEG;IACH,MAAM,CAAC,aAAa;QAClB,MAAM,UAAU,GAAG;YACjB,EAAE,CAAC,QAAQ,EAAE;YACb,EAAE,CAAC,QAAQ,EAAE;YACb,EAAE,CAAC,IAAI,EAAE;YACT,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC;YACxB,mBAAmB,EAAE;SACtB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAElB,OAAO,MAAM;aACV,UAAU,CAAC,QAAQ,CAAC;aACpB,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;aAC5B,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IAED,yEAAyE;IAEzE,4EAA4E;IAC5E,MAAM,CAAC,UAAU,CAAC,MAAqB,EAAE,OAAe;QACtD,OAAO,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,KAAK,CAAC;IACxF,CAAC;IAED,yEAAyE;IAEjE,KAAK,CAAC,KAAK,CAAI,GAAW,EAAE,IAAkB;QACpD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE;gBACtC,GAAG,IAAI;gBACP,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,OAAO,EAAE,EAAE,YAAY,EAAE,qBAAqB,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE;aAC3E,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACxE,yFAAyF;YACzF,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,SAAc,CAAC;YAC9C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAM,CAAC;QACpD,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,WAAW,CAAC,UAAkB,EAAE,MAAqB;QACjE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,MAAM,CAAC,iBAAiB;YAAE,OAAO;QACvE,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,2BAA2B,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YACzE,IAAI,CAAC,UAAU;gBAAE,OAAO;YAExB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CACjC,GAAG,IAAI,CAAC,OAAO,WAAW,kBAAkB,CAAC,UAAU,CAAC,aAAa,CACtE,CAAC;YACF,IAAI,CAAC,UAAU,EAAE,SAAS;gBAAE,OAAO;YAEnC,gFAAgF;YAChF,iFAAiF;YACjF,MAAM,KAAK,GAAG,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,iBAAiB,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;YACzF,IAAI,CAAC,KAAK,CAAC,OAAO;gBAAE,OAAO;YAE3B,MAAM,KAAK,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,iBAAiB,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC;YACnF,EAAE,CAAC,aAAa,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC,CAAC,gDAAgD,CAAC,CAAC;IAC9D,CAAC;IAED;;;;OAIG;IACK,aAAa,CAAC,UAAkB;QACtC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB;YAAE,OAAO,IAAI,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;YAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA2C,CAAC;YACzE,IAAI,CAAC,KAAK,EAAE,KAAK,IAAI,CAAC,KAAK,EAAE,SAAS;gBAAE,OAAO,IAAI,CAAC;YAEpD,MAAM,KAAK,GAAG,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;YACvE,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAElD,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;YACxB,OAAO;gBACL,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,SAAS;gBACvC,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,IAAI,SAAS;gBACzD,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,SAAS;gBACnC,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,SAAS;gBACjC,SAAS,EAAE,IAAI;gBACf,OAAO,EAAE,8BAA8B,CAAC,CAAC,UAAU,+BAA+B;aACnF,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;IAC1B,CAAC;CACF;;AAED,8EAA8E;AAE9E,SAAS,YAAY,CAAC,UAAkB;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvF,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,qBAAqB,IAAI,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,wBAAwB,CAAC,QAAgB;IAChD,MAAM,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrF,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,uBAAuB,IAAI,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,4FAA4F;AAC5F,sFAAsF;AACtF,4FAA4F;AAC5F,gDAAgD;AAChD,SAAS,2BAA2B,CAAC,KAAa;IAChD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,aAAa;YAAE,OAAO,IAAI,CAAC;QAClE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QAC5D,OAAO,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB;IAC1B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,kBAAkB,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QAC9E,OAAO,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AACxB,CAAC;AAED,8EAA8E;kBAC/D,gBAAgB"}

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@permitcore/permitcore",
+  "version": "1.0.0",
+  "description": "Official Node.js SDK for PermitCore license management",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "test": "npm run build && node --test test/*.test.js",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "license",
+    "licensing",
+    "sdk",
+    "permitcore",
+    "activation"
+  ],
+  "author": "PermitCore",
+  "license": "MIT",
+  "homepage": "https://permitcore.dev",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/permitCore-spec/PermitCore",
+    "directory": "SDKs/node"
+  },
+  "devDependencies": {
+    "@types/node": "^26.1.2",
+    "typescript": "^7.0.2"
+  },
+  "engines": {
+    "node": ">=16"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}