@xemahq/license-verifier 0.1.0

package/README.md

@@ -0,0 +1,224 @@
+<p align="center">
+<svg width="680" height="120" viewBox="0 0 680 120" fill="none" xmlns="http://www.w3.org/2000/svg" role="img" aria-label="@xemahq/license-verifier">
+  <rect width="680" height="120" rx="14" fill="#0B1020"/>
+  <g transform="translate(28,34)">
+    <path d="M26 0 L52 15 L52 45 L26 60 L0 45 L0 15 Z" fill="#8B5CF6" opacity="0.18"/>
+    <path d="M26 12 L41 21 L41 39 L26 48 L11 39 L11 21 Z" fill="#8B5CF6"/>
+  </g>
+  <text x="92" y="52" font-family="ui-monospace,SFMono-Regular,Menlo,monospace" font-size="22" fill="#F8FAFC" font-weight="700">@xemahq/license-verifier</text>
+  <text x="92" y="80" font-family="ui-sans-serif,system-ui,sans-serif" font-size="15" fill="#94A3B8">Offline verification of a Xema license</text>
+  <text x="652" y="105" text-anchor="end" font-family="ui-sans-serif,system-ui,sans-serif" font-size="12" fill="#475569">xema.dev</text>
+</svg>
+</p>
+
+<p align="center">
+  <a href="https://xema.dev">Website</a> &middot;
+  <a href="https://www.npmjs.com/package/@xemahq/license-verifier">npm</a>
+</p>
+
+<p align="center">
+  <img alt="npm" src="https://img.shields.io/npm/v/%40xemahq%2Flicense-verifier?color=2563eb&label=npm">
+  <img alt="license" src="https://img.shields.io/npm/l/%40xemahq%2Flicense-verifier?color=10b981">
+  <img alt="types" src="https://img.shields.io/npm/types/%40xemahq%2Flicense-verifier?color=3178c6">
+</p>
+
+# @xemahq/license-verifier
+
+> Offline verification of a Xema license
+
+## Overview
+
+This package belongs to Layer 1 — a framework-agnostic runtime SDK with **zero
+dependencies**, Node built-ins only (`node:crypto`). It verifies a Xema license
+offline: no network, no filesystem, no clock during signature verification.
+
+The zero-dependency rule is load-bearing, not stylistic. This code runs inside
+the `xema` CLI, which must work from a bare checkout with nothing installed;
+inside the air-gap installer on a machine that has never resolved a DNS name;
+and inside platform services. It therefore re-declares the license vocabulary
+that `@xemahq/license-contracts` also declares — the same precedent as
+`@xemahq/distribution-source-hash` — and guards the duplication with a parity
+test that loads both packages and fails closed the moment any value or any
+field set stops agreeing.
+
+## What a license is — and what it is not
+
+A **license** is long-lived, customer-held and offline-verifiable. It answers
+**"may this customer run this edition at all"**.
+
+That is a different artifact from the **image-delivery entitlement
+attestation** (`ImageDeliveryEntitlementPredicate` in
+`@xemahq/kernel-contracts/distribution`, verified by `verifyImageDeliveryEntitlement`),
+which is short-lived, replay-protected by a nonce and an idempotency key,
+bound to one release digest, and answers **"may these exact bits move to this
+customer right now"**.
+
+The two **compose**: the license is the credential that authorizes minting a
+delivery entitlement. This package neither duplicates nor weakens that
+attestation, and the `shared | mirror | airgap` delivery axis stays where it
+already lives (`ImageDeliveryMode`, `CustomerImageEntitlement`).
+
+## Verifying
+
+```ts
+import {
+  EntitlementAction,
+  EntitlementKind,
+  evaluateEntitlement,
+  getProductionLicenseTrustStore,
+  verifyLicense,
+} from '@xemahq/license-verifier';
+
+const verification = verifyLicense(token, {
+  trustStore: getProductionLicenseTrustStore(),
+});
+if (!verification.ok) {
+  throw new Error(`${verification.code}: ${verification.message}`);
+}
+
+const decision = evaluateEntitlement(verification, {
+  kind: EntitlementKind.Biome,
+  id: 'knowledge-base',
+  action: EntitlementAction.Install,
+});
+```
+
+Verification is **cryptographic and structural only** — it proves the claims
+are authentic. It does **not** mean the license is in force. Expiry,
+revocation and suspension are resolved by `resolveLicenseState`, and whether
+anything may actually happen is decided by `evaluateEntitlement`. Holding a
+`VerifiedLicense` is never an entitlement.
+
+`VerifiedLicense` is branded with a module-private symbol, so it cannot be
+constructed by anything except a successful verification. "Verified" is a
+proof, not a naming convention.
+
+## Fail-closed behaviour
+
+Every one of the following is a refusal, with a distinct
+`LicenseVerificationFailureCode` so the CLI can render an actionable message:
+
+- a token that is not a compact JWS, has an empty segment, uses non-canonical
+  base64url, or exceeds the size ceiling;
+- a header carrying an unknown parameter, an algorithm other than `EdDSA`, a
+  media type other than `application/vnd.xema.license+jws`, or no `kid`;
+- a build whose trust store is empty (`TrustStoreEmpty` — reported before the
+  signature check, so an unprovisioned build says what is actually wrong);
+- a `kid` the build does not trust;
+- a signature that does not verify over the exact transmitted bytes;
+- claims with an unknown field, a missing field, a value outside a closed
+  enum, a duplicate entitlement, a limit that is absent rather than `null`, a
+  non-UTC or impossible timestamp, or an expiry before its issuance;
+- a claims version the build was not compiled to understand;
+- an issuer other than the pinned one.
+
+There is no fallback, no coercion, and no path that returns success on doubt.
+
+## The expiry ladder
+
+Expiry degrades what a customer may do NEXT; it never stops a running
+workload. `evaluateEntitlement` resolves the whole ladder in one table:
+
+| effective status | stage | `RunExisting` | `Install` | `Upgrade` |
+| --- | --- | --- | --- | --- |
+| `Active` | `Valid` | yes | yes | yes |
+| `Expired` | `Grace` (30 days) | yes | yes | yes |
+| `Expired` | `Restricted` | yes | no | no |
+| `Suspended` | any | yes | no | no |
+| `Revoked` | any | no | no | no |
+
+`Revoked` is the single, deliberate exception to "never stop a workload",
+because a revocation is for cause rather than for a lapsed renewal.
+
+A clock rollback — the system clock behind the highest instant this
+installation has seen — is reported on `LicenseState.clockRollbackDetected`
+and changes no decision. Disconnected hardware genuinely drifts backwards, and
+punishing a customer automatically for a dead RTC battery would make the
+licensing plane the cause of the outage. Warn loudly; do not deny.
+
+Clock skew is tolerated up to one minute by default and five minutes at most.
+A tolerance is a concession to drift, not a dial for extending a license.
+
+## Key management
+
+- The **private signing key never exists inside any repository** and is never
+  an input to anything in this package. `xema-license-keygen` refuses to write
+  a key inside a git working tree, at any depth.
+- Only the **public** verification key is embedded, in
+  `src/embedded/license-material.generated.ts`.
+- `kid` is **derived**, never assigned: `base64url(sha256(SPKI DER))`. The same
+  key produces the same id in the ceremony, in the trust store and in every
+  issued license, with no bookkeeping in between.
+- **Rotation** is the trust store: it holds several keys at once, so a new key
+  becomes trusted by shipping a build that contains it and stops being trusted
+  by shipping a build that does not. Both keys coexist across the rollover.
+  An unknown `kid` is always a refusal — there is no discovery.
+- Signing goes through the `LicenseSigner` interface, so moving from a local
+  key to Vault Transit or a cloud KMS is a provider swap.
+
+### The checked-in material is a deliberate placeholder
+
+This package ships with an **empty trust store** and an **unsigned**
+open-source license. Every verification against it fails with
+`TrustStoreEmpty`, including the embedded license itself, and
+`isLicenseMaterialProvisioned()` returns `false`.
+
+A placeholder that verified without a real signature would mean the licensing
+plane accepts forgeries in exactly the builds nobody remembered to provision.
+A placeholder that refuses is loud and safe. Tests assert the refusal, so
+replacing the material without running the ceremony cannot pass CI unchanged.
+
+### The signing ceremony
+
+Run once, offline, on a machine that is not the build machine.
+
+```bash
+# 1. Generate the Ed25519 signing key OUTSIDE any repository.
+#    The command refuses to write into a git working tree and refuses to
+#    overwrite an existing key.
+xema-license-keygen --out ~/.xema-license/signing-key.pem
+
+# 2. Mint the open-source license and embed the PUBLIC material.
+#    Run from this package's root; it self-verifies the minted license through
+#    the ordinary verification path before writing anything.
+cd packages/kernel/license-verifier
+xema-license-mint-oss \
+  --key ~/.xema-license/signing-key.pem \
+  --issued-at 2026-07-31T00:00:00.000Z \
+  --write-embedded
+
+# 3. Rebuild, run the tests (the placeholder assertions in
+#    `embedded-license.test.ts` must be updated in the same change to assert
+#    that the embedded license now VERIFIES), and commit only
+#    src/embedded/license-material.generated.ts.
+```
+
+Then store the private key SOPS-encrypted in `xema-deploy`, mounted to
+`license-api` only. **Never** commit it, never paste it into an issue, and
+never place it in a directory that a repository might later be initialised in.
+A lost signing key cannot be recovered; a leaked one invalidates every license
+until a rotation build reaches every customer.
+
+## Signing
+
+```ts
+import { LocalKeyLicenseSigner, signLicense } from '@xemahq/license-verifier/signing';
+```
+
+The signing half sits behind its own subpath so importing a verifier never
+pulls in a minter. It lives in this package because signing and verifying must
+share ONE definition of the signing input and ONE claim parser — a second
+implementation in the issuing service is how an issuer starts minting licenses
+its own verifier rejects. `signLicense` validates claims through that parser
+before signing, so a malformed license cannot be produced at all.
+
+## Related packages
+
+| Package | Role |
+| --- | --- |
+| `@xemahq/license-contracts` | The Layer 0 claim shape and closed enums. |
+| `@xemahq/kernel-contracts/distribution` | The complementary, short-lived image-delivery entitlement attestation. |
+
+## License
+
+Apache-2.0 &copy; Xema — [xema.dev](https://xema.dev)

package/dist/bin/xema-license-keygen.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=xema-license-keygen.d.ts.map

package/dist/bin/xema-license-keygen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xema-license-keygen.d.ts","sourceRoot":"","sources":["../../src/bin/xema-license-keygen.ts"],"names":[],"mappings":""}

package/dist/bin/xema-license-keygen.js

@@ -0,0 +1,63 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const trust_store_ts_1 = require("../lib/trust-store.js");
+const USAGE = `xema-license-keygen --out <path>
+
+Generate the Ed25519 license signing key (decision D7).
+
+The PRIVATE key is written to <path> with mode 0600 and MUST be stored
+outside any repository — SOPS-encrypted in xema-deploy today, Vault Transit
+or a cloud KMS later. The PUBLIC key and its derived key id are printed to
+stdout; those are what get embedded in verifier builds.
+
+This command refuses to write inside a git repository.`;
+function parseOutPath(argv) {
+    const index = argv.indexOf('--out');
+    if (index === -1 || index === argv.length - 1) {
+        throw new Error(`--out <path> is required\n\n${USAGE}`);
+    }
+    return (0, node_path_1.resolve)(argv[index + 1]);
+}
+function assertOutsideAnyRepository(outPath) {
+    let directory = (0, node_path_1.dirname)(outPath);
+    for (;;) {
+        if ((0, node_fs_1.existsSync)((0, node_path_1.resolve)(directory, '.git'))) {
+            throw new Error(`refusing to write a signing key inside the git repository at ${directory}`);
+        }
+        const parent = (0, node_path_1.dirname)(directory);
+        if (parent === directory) {
+            return;
+        }
+        directory = parent;
+    }
+}
+function main(argv) {
+    const outPath = parseOutPath(argv);
+    assertOutsideAnyRepository(outPath);
+    if ((0, node_fs_1.existsSync)(outPath)) {
+        throw new Error(`refusing to overwrite an existing key at ${outPath}; a lost signing key cannot be recovered`);
+    }
+    const { privateKey, publicKey } = (0, node_crypto_1.generateKeyPairSync)('ed25519');
+    const privateKeyPem = privateKey
+        .export({ format: 'pem', type: 'pkcs8' })
+        .toString();
+    const publicKeyPem = publicKey
+        .export({ format: 'pem', type: 'spki' })
+        .toString();
+    (0, node_fs_1.writeFileSync)(outPath, privateKeyPem, { flag: 'wx', mode: 0o600 });
+    process.stdout.write(`private key written to ${outPath} (mode 0600)\n`);
+    process.stdout.write(`key id: ${(0, trust_store_ts_1.computeLicenseKeyId)(publicKeyPem)}\n`);
+    process.stdout.write(`public key:\n${publicKeyPem}`);
+}
+try {
+    main(process.argv.slice(2));
+}
+catch (error) {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 1;
+}
+//# sourceMappingURL=xema-license-keygen.js.map

package/dist/bin/xema-license-keygen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"xema-license-keygen.js","sourceRoot":"","sources":["../../src/bin/xema-license-keygen.ts"],"names":[],"mappings":";;;AACA,6CAAkD;AAClD,qCAAoD;AACpD,yCAA6C;AAE7C,0DAA4D;AAE5D,MAAM,KAAK,GAAG;;;;;;;;;uDASyC,CAAC;AAExD,SAAS,YAAY,CAAC,IAAuB;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,IAAA,mBAAO,EAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAW,CAAC,CAAC;AAC5C,CAAC;AAQD,SAAS,0BAA0B,CAAC,OAAe;IACjD,IAAI,SAAS,GAAG,IAAA,mBAAO,EAAC,OAAO,CAAC,CAAC;IACjC,SAAS,CAAC;QACR,IAAI,IAAA,oBAAU,EAAC,IAAA,mBAAO,EAAC,SAAS,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CACb,gEAAgE,SAAS,EAAE,CAC5E,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,IAAA,mBAAO,EAAC,SAAS,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,SAAS,GAAG,MAAM,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,IAAuB;IACnC,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACnC,0BAA0B,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,IAAA,oBAAU,EAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,4CAA4C,OAAO,0CAA0C,CAC9F,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,IAAA,iCAAmB,EAAC,SAAS,CAAC,CAAC;IACjE,MAAM,aAAa,GAAG,UAAU;SAC7B,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;SACxC,QAAQ,EAAE,CAAC;IACd,MAAM,YAAY,GAAG,SAAS;SAC3B,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;SACvC,QAAQ,EAAE,CAAC;IAId,IAAA,uBAAa,EAAC,OAAO,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEnE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,OAAO,gBAAgB,CAAC,CAAC;IACxE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,IAAA,oCAAmB,EAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,YAAY,EAAE,CAAC,CAAC;AACvD,CAAC;AAED,IAAI,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAC9D,CAAC;IACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC"}

package/dist/bin/xema-license-mint-oss.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=xema-license-mint-oss.d.ts.map

package/dist/bin/xema-license-mint-oss.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xema-license-mint-oss.d.ts","sourceRoot":"","sources":["../../src/bin/xema-license-mint-oss.ts"],"names":[],"mappings":""}

package/dist/bin/xema-license-mint-oss.js

@@ -0,0 +1,70 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const oss_license_ts_1 = require("../lib/oss-license.js");
+const license_signer_ts_1 = require("../lib/license-signer.js");
+const render_license_material_ts_1 = require("../lib/render-license-material.js");
+const sign_license_ts_1 = require("../lib/sign-license.js");
+const trust_store_ts_1 = require("../lib/trust-store.js");
+const verify_license_ts_1 = require("../lib/verify-license.js");
+const EMBEDDED_MATERIAL_PATH = 'src/embedded/license-material.generated.ts';
+const USAGE = `xema-license-mint-oss --key <path> [--issued-at <rfc3339>] [--write-embedded]
+
+Mint the ONE open-source license (decision D1) and, with --write-embedded,
+rewrite ${EMBEDDED_MATERIAL_PATH} so this package's builds carry it.
+
+--key must point at the Ed25519 signing key OUTSIDE this repository. The
+minted license is non-secret and is meant to be published; the key is not.
+
+--write-embedded must be run from the package root, and rewrites the file in
+place. Rebuild the package afterwards.`;
+function readFlag(argv, flag) {
+    const index = argv.indexOf(flag);
+    if (index === -1) {
+        return null;
+    }
+    if (index === argv.length - 1) {
+        throw new Error(`${flag} requires a value\n\n${USAGE}`);
+    }
+    return argv[index + 1];
+}
+async function main(argv) {
+    const keyPath = readFlag(argv, '--key');
+    if (keyPath === null) {
+        throw new Error(`--key <path> is required\n\n${USAGE}`);
+    }
+    const issuedAt = readFlag(argv, '--issued-at') ?? new Date().toISOString();
+    const writeEmbedded = argv.includes('--write-embedded');
+    const signer = license_signer_ts_1.LocalKeyLicenseSigner.fromPrivateKeyPem((0, node_fs_1.readFileSync)((0, node_path_1.resolve)(keyPath), 'utf8'));
+    const publicKeyPem = signer.exportPublicKeyPem();
+    const token = await (0, sign_license_ts_1.signLicense)((0, oss_license_ts_1.buildOssLicenseClaims)(issuedAt), signer);
+    const verification = (0, verify_license_ts_1.verifyLicense)(token, {
+        trustStore: (0, trust_store_ts_1.createLicenseTrustStore)([publicKeyPem]),
+    });
+    if (!verification.ok) {
+        throw new Error(`the minted license failed verification (${verification.code}): ${verification.message}`);
+    }
+    if (writeEmbedded) {
+        const target = (0, node_path_1.resolve)(process.cwd(), EMBEDDED_MATERIAL_PATH);
+        if (!(0, node_fs_1.existsSync)(target)) {
+            throw new Error(`${target} does not exist; run --write-embedded from the @xemahq/license-verifier package root`);
+        }
+        (0, node_fs_1.writeFileSync)(target, (0, render_license_material_ts_1.renderLicenseMaterial)({
+            publicKeyPems: [publicKeyPem],
+            ossLicense: token,
+            provisioned: true,
+            provenance: `Open-source license ${verification.claims.licenseId} issued ${issuedAt} under key ${signer.keyId}.`,
+        }));
+        process.stdout.write(`embedded material written to ${target}\n`);
+    }
+    process.stdout.write(`key id: ${signer.keyId}\n`);
+    process.stdout.write(`public key:\n${publicKeyPem}`);
+    process.stdout.write(`oss license:\n${token}\n`);
+}
+main(process.argv.slice(2)).catch((error) => {
+    process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+    process.exitCode = 1;
+});
+//# sourceMappingURL=xema-license-mint-oss.js.map

package/dist/bin/xema-license-mint-oss.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"xema-license-mint-oss.js","sourceRoot":"","sources":["../../src/bin/xema-license-mint-oss.ts"],"names":[],"mappings":";;;AACA,qCAAkE;AAClE,yCAAoC;AAEpC,0DAA8D;AAC9D,gEAAiE;AACjE,kFAA0E;AAC1E,4DAAqD;AACrD,0DAAgE;AAChE,gEAAyD;AAEzD,MAAM,sBAAsB,GAAG,4CAA4C,CAAC;AAE5E,MAAM,KAAK,GAAG;;;UAGJ,sBAAsB;;;;;;uCAMO,CAAC;AAExC,SAAS,QAAQ,CAAC,IAAuB,EAAE,IAAY;IACrD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,wBAAwB,KAAK,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,GAAG,CAAC,CAAW,CAAC;AACnC,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAuB;IACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACxC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3E,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAExD,MAAM,MAAM,GAAG,yCAAqB,CAAC,iBAAiB,CACpD,IAAA,sBAAY,EAAC,IAAA,mBAAO,EAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CACvC,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,CAAC,kBAAkB,EAAE,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,IAAA,6BAAW,EAAC,IAAA,sCAAqB,EAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IAMzE,MAAM,YAAY,GAAG,IAAA,iCAAa,EAAC,KAAK,EAAE;QACxC,UAAU,EAAE,IAAA,wCAAuB,EAAC,CAAC,YAAY,CAAC,CAAC;KACpD,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,2CAA2C,YAAY,CAAC,IAAI,MAAM,YAAY,CAAC,OAAO,EAAE,CACzF,CAAC;IACJ,CAAC;IAED,IAAI,aAAa,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,IAAA,mBAAO,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAA,oBAAU,EAAC,MAAM,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,GAAG,MAAM,sFAAsF,CAChG,CAAC;QACJ,CAAC;QACD,IAAA,uBAAa,EACX,MAAM,EACN,IAAA,kDAAqB,EAAC;YACpB,aAAa,EAAE,CAAC,YAAY,CAAC;YAC7B,UAAU,EAAE,KAAK;YACjB,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,uBAAuB,YAAY,CAAC,MAAM,CAAC,SAAS,WAAW,QAAQ,cAAc,MAAM,CAAC,KAAK,GAAG;SACjH,CAAC,CACH,CAAC;QACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,MAAM,IAAI,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,YAAY,EAAE,CAAC,CAAC;IACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAC9D,CAAC;IACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}

package/dist/embedded/license-material.generated.d.ts

@@ -0,0 +1,4 @@
+export declare const LICENSE_MATERIAL_PROVISIONED = false;
+export declare const EMBEDDED_LICENSE_PUBLIC_KEYS: readonly string[];
+export declare const EMBEDDED_OSS_LICENSE = "eyJhbGciOiJFZERTQSIsImtpZCI6IlVOUFJPVklTSU9ORUQtUExBQ0VIT0xERVItTk9ULUEtUkVBTC1LRVkiLCJ0eXAiOiJhcHBsaWNhdGlvbi92bmQueGVtYS5saWNlbnNlK2p3cyJ9.eyJ2ZXJzaW9uIjoxLCJsaWNlbnNlSWQiOiJ4ZW1hLW9zcyIsImlzc3VlciI6Imh0dHBzOi8vbGljZW5zZS54ZW1hLmRldiIsInN1YmplY3QiOnsiY3VzdG9tZXJJZCI6InhlbWEtb3Blbi1zb3VyY2UiLCJjdXN0b21lck5hbWUiOiJYZW1hIE9wZW4gU291cmNlIn0sInRpZXIiOiJvcGVuLXNvdXJjZSIsInN0YXR1cyI6ImFjdGl2ZSIsImVudGl0bGVtZW50cyI6W3sia2luZCI6ImRpc3RyaWJ1dGlvbiIsImlkIjoib3NzIn1dLCJsaW1pdHMiOnsibm9kZXMiOm51bGwsInNlYXRzIjpudWxsfSwiaXNzdWVkQXQiOiIxOTcwLTAxLTAxVDAwOjAwOjAwLjAwMFoiLCJleHBpcmVzQXQiOm51bGx9.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
+//# sourceMappingURL=license-material.generated.d.ts.map

package/dist/embedded/license-material.generated.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"license-material.generated.d.ts","sourceRoot":"","sources":["../../src/embedded/license-material.generated.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,4BAA4B,QAAQ,CAAC;AAGlD,eAAO,MAAM,4BAA4B,EAAE,SAAS,MAAM,EAAO,CAAC;AAGlE,eAAO,MAAM,oBAAoB,qqBACmoB,CAAC"}

package/dist/embedded/license-material.generated.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EMBEDDED_OSS_LICENSE = exports.EMBEDDED_LICENSE_PUBLIC_KEYS = exports.LICENSE_MATERIAL_PROVISIONED = void 0;
+exports.LICENSE_MATERIAL_PROVISIONED = false;
+exports.EMBEDDED_LICENSE_PUBLIC_KEYS = [];
+exports.EMBEDDED_OSS_LICENSE = 'eyJhbGciOiJFZERTQSIsImtpZCI6IlVOUFJPVklTSU9ORUQtUExBQ0VIT0xERVItTk9ULUEtUkVBTC1LRVkiLCJ0eXAiOiJhcHBsaWNhdGlvbi92bmQueGVtYS5saWNlbnNlK2p3cyJ9.eyJ2ZXJzaW9uIjoxLCJsaWNlbnNlSWQiOiJ4ZW1hLW9zcyIsImlzc3VlciI6Imh0dHBzOi8vbGljZW5zZS54ZW1hLmRldiIsInN1YmplY3QiOnsiY3VzdG9tZXJJZCI6InhlbWEtb3Blbi1zb3VyY2UiLCJjdXN0b21lck5hbWUiOiJYZW1hIE9wZW4gU291cmNlIn0sInRpZXIiOiJvcGVuLXNvdXJjZSIsInN0YXR1cyI6ImFjdGl2ZSIsImVudGl0bGVtZW50cyI6W3sia2luZCI6ImRpc3RyaWJ1dGlvbiIsImlkIjoib3NzIn1dLCJsaW1pdHMiOnsibm9kZXMiOm51bGwsInNlYXRzIjpudWxsfSwiaXNzdWVkQXQiOiIxOTcwLTAxLTAxVDAwOjAwOjAwLjAwMFoiLCJleHBpcmVzQXQiOm51bGx9.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA';
+//# sourceMappingURL=license-material.generated.js.map

package/dist/embedded/license-material.generated.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"license-material.generated.js","sourceRoot":"","sources":["../../src/embedded/license-material.generated.ts"],"names":[],"mappings":";;;AAoBa,QAAA,4BAA4B,GAAG,KAAK,CAAC;AAGrC,QAAA,4BAA4B,GAAsB,EAAE,CAAC;AAGrD,QAAA,oBAAoB,GAC/B,kqBAAkqB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,13 @@
+export { LicenseSource, resolveEffectiveLicense, type EffectiveLicense, type EffectiveLicenseUnverifiable, type EffectiveLicenseVerified, type ResolveEffectiveLicenseInput, } from './lib/effective-license.ts';
+export { getEmbeddedOssLicense, getProductionLicenseTrustStore, isLicenseMaterialProvisioned, verifyEmbeddedOssLicense, } from './lib/embedded-license.ts';
+export { EntitlementDenialReason, evaluateEntitlement, type EntitlementDecision, type EntitlementQuery, } from './lib/evaluate-entitlement.ts';
+export { LimitDecisionReason, evaluateLimit, type LimitDecision, } from './lib/evaluate-limit.ts';
+export type { LicenseClaims, LicenseEntitlement, LicenseJwsHeader, LicenseLimitValue, LicenseLimits, LicenseSubject, } from './lib/license-claims.ts';
+export { CANONICAL_IDENTIFIER_PATTERN, ENTITLEMENT_ID_WILDCARD, EntitlementAction, EntitlementKind, LICENSE_GRACE_PERIOD_MS, LICENSE_JWS_TYPE, LICENSE_LIMIT_UNLIMITED, LicenseClaimsVersion, LicenseLifecycleStage, LicenseLimitKind, LicenseSignatureAlgorithm, LicenseStatus, LicenseTier, OSS_DISTRIBUTION_ID, OSS_LICENSE_CUSTOMER_ID, OSS_LICENSE_CUSTOMER_NAME, OSS_LICENSE_ID, XEMA_LICENSE_ISSUER, } from './lib/license-enums.ts';
+export { buildOssLicenseClaims } from './lib/oss-license.ts';
+export { DEFAULT_CLOCK_SKEW_TOLERANCE_MS, MAX_CLOCK_SKEW_TOLERANCE_MS, resolveLicenseState, type LicenseState, type ResolveLicenseStateOptions, } from './lib/resolve-license-state.ts';
+export { computeLicenseKeyId, createLicenseTrustStore, type LicenseTrustStore, } from './lib/trust-store.ts';
+export { LicenseVerificationFailureCode, type LicenseVerificationFailure, } from './lib/verification-failure.ts';
+export { verifyLicense, type LicenseVerificationResult, type LicenseVerificationSuccess, type VerifyLicenseOptions, } from './lib/verify-license.ts';
+export type { VerifiedLicense } from './lib/verified-license.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,uBAAuB,EACvB,KAAK,gBAAgB,EACrB,KAAK,4BAA4B,EACjC,KAAK,wBAAwB,EAC7B,KAAK,4BAA4B,GAClC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,qBAAqB,EACrB,8BAA8B,EAC9B,4BAA4B,EAC5B,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,GACtB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,KAAK,aAAa,GACnB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACb,cAAc,GACf,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,uBAAuB,EACvB,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EAChB,yBAAyB,EACzB,aAAa,EACb,WAAW,EACX,mBAAmB,EACnB,uBAAuB,EACvB,yBAAyB,EACzB,cAAc,EACd,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,EAC3B,mBAAmB,EACnB,KAAK,YAAY,EACjB,KAAK,0BAA0B,GAChC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,KAAK,iBAAiB,GACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,8BAA8B,EAC9B,KAAK,0BAA0B,GAChC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,aAAa,EACb,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAC/B,KAAK,oBAAoB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/index.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyLicense = exports.LicenseVerificationFailureCode = exports.createLicenseTrustStore = exports.computeLicenseKeyId = exports.resolveLicenseState = exports.MAX_CLOCK_SKEW_TOLERANCE_MS = exports.DEFAULT_CLOCK_SKEW_TOLERANCE_MS = exports.buildOssLicenseClaims = exports.XEMA_LICENSE_ISSUER = exports.OSS_LICENSE_ID = exports.OSS_LICENSE_CUSTOMER_NAME = exports.OSS_LICENSE_CUSTOMER_ID = exports.OSS_DISTRIBUTION_ID = exports.LicenseTier = exports.LicenseStatus = exports.LicenseSignatureAlgorithm = exports.LicenseLimitKind = exports.LicenseLifecycleStage = exports.LicenseClaimsVersion = exports.LICENSE_LIMIT_UNLIMITED = exports.LICENSE_JWS_TYPE = exports.LICENSE_GRACE_PERIOD_MS = exports.EntitlementKind = exports.EntitlementAction = exports.ENTITLEMENT_ID_WILDCARD = exports.CANONICAL_IDENTIFIER_PATTERN = exports.evaluateLimit = exports.LimitDecisionReason = exports.evaluateEntitlement = exports.EntitlementDenialReason = exports.verifyEmbeddedOssLicense = exports.isLicenseMaterialProvisioned = exports.getProductionLicenseTrustStore = exports.getEmbeddedOssLicense = exports.resolveEffectiveLicense = exports.LicenseSource = void 0;
+var effective_license_ts_1 = require("./lib/effective-license.js");
+Object.defineProperty(exports, "LicenseSource", { enumerable: true, get: function () { return effective_license_ts_1.LicenseSource; } });
+Object.defineProperty(exports, "resolveEffectiveLicense", { enumerable: true, get: function () { return effective_license_ts_1.resolveEffectiveLicense; } });
+var embedded_license_ts_1 = require("./lib/embedded-license.js");
+Object.defineProperty(exports, "getEmbeddedOssLicense", { enumerable: true, get: function () { return embedded_license_ts_1.getEmbeddedOssLicense; } });
+Object.defineProperty(exports, "getProductionLicenseTrustStore", { enumerable: true, get: function () { return embedded_license_ts_1.getProductionLicenseTrustStore; } });
+Object.defineProperty(exports, "isLicenseMaterialProvisioned", { enumerable: true, get: function () { return embedded_license_ts_1.isLicenseMaterialProvisioned; } });
+Object.defineProperty(exports, "verifyEmbeddedOssLicense", { enumerable: true, get: function () { return embedded_license_ts_1.verifyEmbeddedOssLicense; } });
+var evaluate_entitlement_ts_1 = require("./lib/evaluate-entitlement.js");
+Object.defineProperty(exports, "EntitlementDenialReason", { enumerable: true, get: function () { return evaluate_entitlement_ts_1.EntitlementDenialReason; } });
+Object.defineProperty(exports, "evaluateEntitlement", { enumerable: true, get: function () { return evaluate_entitlement_ts_1.evaluateEntitlement; } });
+var evaluate_limit_ts_1 = require("./lib/evaluate-limit.js");
+Object.defineProperty(exports, "LimitDecisionReason", { enumerable: true, get: function () { return evaluate_limit_ts_1.LimitDecisionReason; } });
+Object.defineProperty(exports, "evaluateLimit", { enumerable: true, get: function () { return evaluate_limit_ts_1.evaluateLimit; } });
+var license_enums_ts_1 = require("./lib/license-enums.js");
+Object.defineProperty(exports, "CANONICAL_IDENTIFIER_PATTERN", { enumerable: true, get: function () { return license_enums_ts_1.CANONICAL_IDENTIFIER_PATTERN; } });
+Object.defineProperty(exports, "ENTITLEMENT_ID_WILDCARD", { enumerable: true, get: function () { return license_enums_ts_1.ENTITLEMENT_ID_WILDCARD; } });
+Object.defineProperty(exports, "EntitlementAction", { enumerable: true, get: function () { return license_enums_ts_1.EntitlementAction; } });
+Object.defineProperty(exports, "EntitlementKind", { enumerable: true, get: function () { return license_enums_ts_1.EntitlementKind; } });
+Object.defineProperty(exports, "LICENSE_GRACE_PERIOD_MS", { enumerable: true, get: function () { return license_enums_ts_1.LICENSE_GRACE_PERIOD_MS; } });
+Object.defineProperty(exports, "LICENSE_JWS_TYPE", { enumerable: true, get: function () { return license_enums_ts_1.LICENSE_JWS_TYPE; } });
+Object.defineProperty(exports, "LICENSE_LIMIT_UNLIMITED", { enumerable: true, get: function () { return license_enums_ts_1.LICENSE_LIMIT_UNLIMITED; } });
+Object.defineProperty(exports, "LicenseClaimsVersion", { enumerable: true, get: function () { return license_enums_ts_1.LicenseClaimsVersion; } });
+Object.defineProperty(exports, "LicenseLifecycleStage", { enumerable: true, get: function () { return license_enums_ts_1.LicenseLifecycleStage; } });
+Object.defineProperty(exports, "LicenseLimitKind", { enumerable: true, get: function () { return license_enums_ts_1.LicenseLimitKind; } });
+Object.defineProperty(exports, "LicenseSignatureAlgorithm", { enumerable: true, get: function () { return license_enums_ts_1.LicenseSignatureAlgorithm; } });
+Object.defineProperty(exports, "LicenseStatus", { enumerable: true, get: function () { return license_enums_ts_1.LicenseStatus; } });
+Object.defineProperty(exports, "LicenseTier", { enumerable: true, get: function () { return license_enums_ts_1.LicenseTier; } });
+Object.defineProperty(exports, "OSS_DISTRIBUTION_ID", { enumerable: true, get: function () { return license_enums_ts_1.OSS_DISTRIBUTION_ID; } });
+Object.defineProperty(exports, "OSS_LICENSE_CUSTOMER_ID", { enumerable: true, get: function () { return license_enums_ts_1.OSS_LICENSE_CUSTOMER_ID; } });
+Object.defineProperty(exports, "OSS_LICENSE_CUSTOMER_NAME", { enumerable: true, get: function () { return license_enums_ts_1.OSS_LICENSE_CUSTOMER_NAME; } });
+Object.defineProperty(exports, "OSS_LICENSE_ID", { enumerable: true, get: function () { return license_enums_ts_1.OSS_LICENSE_ID; } });
+Object.defineProperty(exports, "XEMA_LICENSE_ISSUER", { enumerable: true, get: function () { return license_enums_ts_1.XEMA_LICENSE_ISSUER; } });
+var oss_license_ts_1 = require("./lib/oss-license.js");
+Object.defineProperty(exports, "buildOssLicenseClaims", { enumerable: true, get: function () { return oss_license_ts_1.buildOssLicenseClaims; } });
+var resolve_license_state_ts_1 = require("./lib/resolve-license-state.js");
+Object.defineProperty(exports, "DEFAULT_CLOCK_SKEW_TOLERANCE_MS", { enumerable: true, get: function () { return resolve_license_state_ts_1.DEFAULT_CLOCK_SKEW_TOLERANCE_MS; } });
+Object.defineProperty(exports, "MAX_CLOCK_SKEW_TOLERANCE_MS", { enumerable: true, get: function () { return resolve_license_state_ts_1.MAX_CLOCK_SKEW_TOLERANCE_MS; } });
+Object.defineProperty(exports, "resolveLicenseState", { enumerable: true, get: function () { return resolve_license_state_ts_1.resolveLicenseState; } });
+var trust_store_ts_1 = require("./lib/trust-store.js");
+Object.defineProperty(exports, "computeLicenseKeyId", { enumerable: true, get: function () { return trust_store_ts_1.computeLicenseKeyId; } });
+Object.defineProperty(exports, "createLicenseTrustStore", { enumerable: true, get: function () { return trust_store_ts_1.createLicenseTrustStore; } });
+var verification_failure_ts_1 = require("./lib/verification-failure.js");
+Object.defineProperty(exports, "LicenseVerificationFailureCode", { enumerable: true, get: function () { return verification_failure_ts_1.LicenseVerificationFailureCode; } });
+var verify_license_ts_1 = require("./lib/verify-license.js");
+Object.defineProperty(exports, "verifyLicense", { enumerable: true, get: function () { return verify_license_ts_1.verifyLicense; } });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,mEAOoC;AANlC,qHAAA,aAAa,OAAA;AACb,+HAAA,uBAAuB,OAAA;AAMzB,iEAKmC;AAJjC,4HAAA,qBAAqB,OAAA;AACrB,qIAAA,8BAA8B,OAAA;AAC9B,mIAAA,4BAA4B,OAAA;AAC5B,+HAAA,wBAAwB,OAAA;AAE1B,yEAKuC;AAJrC,kIAAA,uBAAuB,OAAA;AACvB,8HAAA,mBAAmB,OAAA;AAIrB,6DAIiC;AAH/B,wHAAA,mBAAmB,OAAA;AACnB,kHAAA,aAAa,OAAA;AAWf,2DAmBgC;AAlB9B,gIAAA,4BAA4B,OAAA;AAC5B,2HAAA,uBAAuB,OAAA;AACvB,qHAAA,iBAAiB,OAAA;AACjB,mHAAA,eAAe,OAAA;AACf,2HAAA,uBAAuB,OAAA;AACvB,oHAAA,gBAAgB,OAAA;AAChB,2HAAA,uBAAuB,OAAA;AACvB,wHAAA,oBAAoB,OAAA;AACpB,yHAAA,qBAAqB,OAAA;AACrB,oHAAA,gBAAgB,OAAA;AAChB,6HAAA,yBAAyB,OAAA;AACzB,iHAAA,aAAa,OAAA;AACb,+GAAA,WAAW,OAAA;AACX,uHAAA,mBAAmB,OAAA;AACnB,2HAAA,uBAAuB,OAAA;AACvB,6HAAA,yBAAyB,OAAA;AACzB,kHAAA,cAAc,OAAA;AACd,uHAAA,mBAAmB,OAAA;AAErB,uDAA6D;AAApD,uHAAA,qBAAqB,OAAA;AAC9B,2EAMwC;AALtC,2IAAA,+BAA+B,OAAA;AAC/B,uIAAA,2BAA2B,OAAA;AAC3B,+HAAA,mBAAmB,OAAA;AAIrB,uDAI8B;AAH5B,qHAAA,mBAAmB,OAAA;AACnB,yHAAA,uBAAuB,OAAA;AAGzB,yEAGuC;AAFrC,yIAAA,8BAA8B,OAAA;AAGhC,6DAKiC;AAJ/B,kHAAA,aAAa,OAAA"}

package/dist/lib/base64url.d.ts

@@ -0,0 +1,4 @@
+export declare function encodeBase64Url(bytes: Uint8Array): string;
+export declare function decodeBase64Url(value: string): Uint8Array | null;
+export declare function decodeBase64UrlText(value: string): string | null;
+//# sourceMappingURL=base64url.d.ts.map

package/dist/lib/base64url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64url.d.ts","sourceRoot":"","sources":["../../src/lib/base64url.ts"],"names":[],"mappings":"AAGA,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAEzD;AAYD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAShE;AAGD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAahE"}

package/dist/lib/base64url.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.encodeBase64Url = encodeBase64Url;
+exports.decodeBase64Url = decodeBase64Url;
+exports.decodeBase64UrlText = decodeBase64UrlText;
+const BASE64URL_PATTERN = /^[A-Za-z0-9_-]+$/;
+function encodeBase64Url(bytes) {
+    return Buffer.from(bytes).toString('base64url');
+}
+function decodeBase64Url(value) {
+    if (!BASE64URL_PATTERN.test(value)) {
+        return null;
+    }
+    const decoded = Buffer.from(value, 'base64url');
+    if (decoded.toString('base64url') !== value) {
+        return null;
+    }
+    return new Uint8Array(decoded);
+}
+function decodeBase64UrlText(value) {
+    const bytes = decodeBase64Url(value);
+    if (bytes === null) {
+        return null;
+    }
+    const text = Buffer.from(bytes).toString('utf8');
+    if (Buffer.compare(Buffer.from(text, 'utf8'), Buffer.from(bytes)) !== 0) {
+        return null;
+    }
+    return text;
+}
+//# sourceMappingURL=base64url.js.map

package/dist/lib/base64url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base64url.js","sourceRoot":"","sources":["../../src/lib/base64url.ts"],"names":[],"mappings":";;AAGA,0CAEC;AAYD,0CASC;AAGD,kDAaC;AAzCD,MAAM,iBAAiB,GAAG,kBAAkB,CAAC;AAE7C,SAAgB,eAAe,CAAC,KAAiB;IAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAClD,CAAC;AAYD,SAAgB,eAAe,CAAC,KAAa;IAC3C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,KAAK,KAAK,EAAE,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAGD,SAAgB,mBAAmB,CAAC,KAAa;IAC/C,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAIjD,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/lib/compact-jws.d.ts

@@ -0,0 +1,16 @@
+export declare const MAX_LICENSE_TOKEN_BYTES: number;
+export interface CompactJwsSegments {
+    readonly encodedHeader: string;
+    readonly encodedPayload: string;
+    readonly signature: Uint8Array;
+    readonly signingInput: Uint8Array;
+}
+export declare function splitCompactJws(token: string): CompactJwsSegments | null;
+export interface EncodedJwsSegments {
+    readonly encodedHeader: string;
+    readonly encodedPayload: string;
+    readonly signingInput: Uint8Array;
+}
+export declare function encodeJwsSegments(headerJson: string, payloadJson: string): EncodedJwsSegments;
+export declare function assembleCompactJws(segments: EncodedJwsSegments, signature: Uint8Array): string;
+//# sourceMappingURL=compact-jws.d.ts.map

package/dist/lib/compact-jws.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compact-jws.d.ts","sourceRoot":"","sources":["../../src/lib/compact-jws.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,uBAAuB,QAAY,CAAC;AAEjD,MAAM,WAAW,kBAAkB;IAEjC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAO/B,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC;CACnC;AAGD,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAqCxE;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,QAAQ,CAAC,YAAY,EAAE,UAAU,CAAC;CACnC;AAQD,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,GAClB,kBAAkB,CAcpB;AAGD,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,kBAAkB,EAC5B,SAAS,EAAE,UAAU,GACpB,MAAM,CAER"}

package/dist/lib/compact-jws.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_LICENSE_TOKEN_BYTES = void 0;
+exports.splitCompactJws = splitCompactJws;
+exports.encodeJwsSegments = encodeJwsSegments;
+exports.assembleCompactJws = assembleCompactJws;
+const base64url_ts_1 = require("./base64url.js");
+exports.MAX_LICENSE_TOKEN_BYTES = 64 * 1024;
+function splitCompactJws(token) {
+    if (token.length === 0 ||
+        Buffer.byteLength(token) > exports.MAX_LICENSE_TOKEN_BYTES) {
+        return null;
+    }
+    const parts = token.split('.');
+    if (parts.length !== 3) {
+        return null;
+    }
+    const [encodedHeader, encodedPayload, encodedSignature] = parts;
+    if (encodedHeader.length === 0 ||
+        encodedPayload.length === 0 ||
+        encodedSignature.length === 0) {
+        return null;
+    }
+    const signature = (0, base64url_ts_1.decodeBase64Url)(encodedSignature);
+    if (signature === null) {
+        return null;
+    }
+    return {
+        encodedHeader,
+        encodedPayload,
+        signature,
+        signingInput: new Uint8Array(Buffer.from(`${encodedHeader}.${encodedPayload}`, 'ascii')),
+    };
+}
+function encodeJwsSegments(headerJson, payloadJson) {
+    const encodedHeader = (0, base64url_ts_1.encodeBase64Url)(new Uint8Array(Buffer.from(headerJson, 'utf8')));
+    const encodedPayload = (0, base64url_ts_1.encodeBase64Url)(new Uint8Array(Buffer.from(payloadJson, 'utf8')));
+    return {
+        encodedHeader,
+        encodedPayload,
+        signingInput: new Uint8Array(Buffer.from(`${encodedHeader}.${encodedPayload}`, 'ascii')),
+    };
+}
+function assembleCompactJws(segments, signature) {
+    return `${segments.encodedHeader}.${segments.encodedPayload}.${(0, base64url_ts_1.encodeBase64Url)(signature)}`;
+}
+//# sourceMappingURL=compact-jws.js.map

package/dist/lib/compact-jws.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compact-jws.js","sourceRoot":"","sources":["../../src/lib/compact-jws.ts"],"names":[],"mappings":";;;AA0BA,0CAqCC;AAeD,8CAiBC;AAGD,gDAKC;AAvGD,iDAAkE;AAOrD,QAAA,uBAAuB,GAAG,EAAE,GAAG,IAAI,CAAC;AAmBjD,SAAgB,eAAe,CAAC,KAAa;IAC3C,IACE,KAAK,CAAC,MAAM,KAAK,CAAC;QAClB,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,+BAAuB,EAClD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,CAAC,aAAa,EAAE,cAAc,EAAE,gBAAgB,CAAC,GAAG,KAIzD,CAAC;IACF,IACE,aAAa,CAAC,MAAM,KAAK,CAAC;QAC1B,cAAc,CAAC,MAAM,KAAK,CAAC;QAC3B,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAC7B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,IAAA,8BAAe,EAAC,gBAAgB,CAAC,CAAC;IACpD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAGD,OAAO;QACL,aAAa;QACb,cAAc;QACd,SAAS;QACT,YAAY,EAAE,IAAI,UAAU,CAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,IAAI,cAAc,EAAE,EAAE,OAAO,CAAC,CAC3D;KACF,CAAC;AACJ,CAAC;AAeD,SAAgB,iBAAiB,CAC/B,UAAkB,EAClB,WAAmB;IAEnB,MAAM,aAAa,GAAG,IAAA,8BAAe,EACnC,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAChD,CAAC;IACF,MAAM,cAAc,GAAG,IAAA,8BAAe,EACpC,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CACjD,CAAC;IACF,OAAO;QACL,aAAa;QACb,cAAc;QACd,YAAY,EAAE,IAAI,UAAU,CAC1B,MAAM,CAAC,IAAI,CAAC,GAAG,aAAa,IAAI,cAAc,EAAE,EAAE,OAAO,CAAC,CAC3D;KACF,CAAC;AACJ,CAAC;AAGD,SAAgB,kBAAkB,CAChC,QAA4B,EAC5B,SAAqB;IAErB,OAAO,GAAG,QAAQ,CAAC,aAAa,IAAI,QAAQ,CAAC,cAAc,IAAI,IAAA,8BAAe,EAAC,SAAS,CAAC,EAAE,CAAC;AAC9F,CAAC"}