@xemahq/license-verifier 0.1.0

package/dist/lib/render-license-material.d.ts

@@ -0,0 +1,8 @@
+export interface LicenseMaterial {
+    readonly publicKeyPems: readonly string[];
+    readonly ossLicense: string;
+    readonly provisioned: boolean;
+    readonly provenance: string;
+}
+export declare function renderLicenseMaterial(material: LicenseMaterial): string;
+//# sourceMappingURL=render-license-material.d.ts.map

package/dist/lib/render-license-material.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"render-license-material.d.ts","sourceRoot":"","sources":["../../src/lib/render-license-material.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,eAAe;IAE9B,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IAE1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAE9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AA0BD,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,eAAe,GAAG,MAAM,CAyBvE"}

package/dist/lib/render-license-material.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderLicenseMaterial = renderLicenseMaterial;
+const PROVISIONED_HEADER = `// GENERATED FILE — do not edit by hand.
+//
+// Written by the license signing ceremony (\`xema-license-mint-oss\`). It holds
+// PUBLIC material only: the Ed25519 verification keys this build trusts, and
+// the non-secret open-source license signed with the corresponding private
+// key. The private key is held outside this repository and never appears here.`;
+const PLACEHOLDER_HEADER = `// GENERATED FILE — do not edit by hand.
+//
+// ⚠️  PLACEHOLDER — THIS BUILD'S LICENSE MATERIAL HAS NOT BEEN PROVISIONED.
+//
+// The trust store below is EMPTY and the open-source license below is NOT
+// SIGNED. Every verification against this material FAILS CLOSED:
+// \`verifyLicense\` returns \`TrustStoreEmpty\`, and no license — including this
+// one — is ever accepted.
+//
+// That is deliberate. The alternative, a token that verifies without a real
+// signature, would mean the licensing plane accepts forgeries in exactly the
+// builds nobody remembered to provision; a placeholder that refuses is loud
+// and safe, a placeholder that passes is silent and fatal.
+//
+// Replace it by running the signing ceremony documented in the package
+// README (\`xema-license-mint-oss --key <path outside this repo>\`).`;
+function renderLicenseMaterial(material) {
+    const header = material.provisioned ? PROVISIONED_HEADER : PLACEHOLDER_HEADER;
+    const keys = material.publicKeyPems.length === 0
+        ? '[]'
+        : `[\n${material.publicKeyPems
+            .map((pem) => `  ${singleQuoted(pem)},\n`)
+            .join('')}]`;
+    return `${header}
+//
+// ${material.provenance}
+
+/** Whether a real signing ceremony produced this material. */
+export const LICENSE_MATERIAL_PROVISIONED = ${material.provisioned};
+
+/** Ed25519 PUBLIC verification keys this build trusts, in PEM form. */
+export const EMBEDDED_LICENSE_PUBLIC_KEYS: readonly string[] = ${keys};
+
+/** The compiled-in open-source license (decision D1), as a compact JWS. */
+export const EMBEDDED_OSS_LICENSE =
+  ${singleQuoted(material.ossLicense)};
+`;
+}
+function singleQuoted(value) {
+    const escaped = JSON.stringify(value)
+        .slice(1, -1)
+        .replaceAll('\\"', '"')
+        .replaceAll("'", "\\'");
+    return `'${escaped}'`;
+}
+//# sourceMappingURL=render-license-material.js.map

package/dist/lib/render-license-material.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"render-license-material.js","sourceRoot":"","sources":["../../src/lib/render-license-material.ts"],"names":[],"mappings":";;AA6CA,sDAyBC;AAjDD,MAAM,kBAAkB,GAAG;;;;;gFAKqD,CAAC;AAEjF,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;sEAe2C,CAAC;AAEvE,SAAgB,qBAAqB,CAAC,QAAyB;IAC7D,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC;IAI9E,MAAM,IAAI,GACR,QAAQ,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC;QACjC,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,MAAM,QAAQ,CAAC,aAAa;aACzB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC;aACzC,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC;IACrB,OAAO,GAAG,MAAM;;KAEb,QAAQ,CAAC,UAAU;;;8CAGsB,QAAQ,CAAC,WAAW;;;iEAGD,IAAI;;;;IAIjE,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC;CACpC,CAAC;AACF,CAAC;AAOD,SAAS,YAAY,CAAC,KAAa;IACjC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SAClC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;SACZ,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC;SACtB,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1B,OAAO,IAAI,OAAO,GAAG,CAAC;AACxB,CAAC"}

package/dist/lib/resolve-license-state.d.ts

@@ -0,0 +1,20 @@
+import { LicenseLifecycleStage, LicenseStatus } from './license-enums.ts';
+import type { VerifiedLicense } from './verified-license.ts';
+export declare const DEFAULT_CLOCK_SKEW_TOLERANCE_MS = 60000;
+export declare const MAX_CLOCK_SKEW_TOLERANCE_MS: number;
+export interface ResolveLicenseStateOptions {
+    readonly now?: number;
+    readonly clockSkewToleranceMs?: number;
+    readonly highestObservedTimeMs?: number;
+}
+export interface LicenseState {
+    readonly status: LicenseStatus;
+    readonly stage: LicenseLifecycleStage;
+    readonly notYetValid: boolean;
+    readonly expiresAtMs: number | null;
+    readonly graceEndsAtMs: number | null;
+    readonly clockRollbackDetected: boolean;
+    readonly evaluatedAtMs: number;
+}
+export declare function resolveLicenseState(license: VerifiedLicense, options?: ResolveLicenseStateOptions): LicenseState;
+//# sourceMappingURL=resolve-license-state.d.ts.map

package/dist/lib/resolve-license-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-license-state.d.ts","sourceRoot":"","sources":["../../src/lib/resolve-license-state.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,qBAAqB,EACrB,aAAa,EACd,MAAM,oBAAoB,CAAC;AAE5B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAQ7D,eAAO,MAAM,+BAA+B,QAAS,CAAC;AAOtD,eAAO,MAAM,2BAA2B,QAAa,CAAC;AAEtD,MAAM,WAAW,0BAA0B;IAEzC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAMvC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CACzC;AAED,MAAM,WAAW,YAAY;IAM3B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAE/B,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;IAMtC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAEpC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAQtC,QAAQ,CAAC,qBAAqB,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAUD,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,eAAe,EACxB,OAAO,GAAE,0BAA+B,GACvC,YAAY,CA2Dd"}

package/dist/lib/resolve-license-state.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_CLOCK_SKEW_TOLERANCE_MS = exports.DEFAULT_CLOCK_SKEW_TOLERANCE_MS = void 0;
+exports.resolveLicenseState = resolveLicenseState;
+const license_enums_ts_1 = require("./license-enums.js");
+const rfc3339_ts_1 = require("./rfc3339.js");
+exports.DEFAULT_CLOCK_SKEW_TOLERANCE_MS = 60_000;
+exports.MAX_CLOCK_SKEW_TOLERANCE_MS = 5 * 60_000;
+function resolveLicenseState(license, options = {}) {
+    const now = options.now ?? Date.now();
+    if (!Number.isFinite(now)) {
+        throw new TypeError('resolveLicenseState requires a finite `now`');
+    }
+    const skew = options.clockSkewToleranceMs ?? exports.DEFAULT_CLOCK_SKEW_TOLERANCE_MS;
+    if (!Number.isFinite(skew) ||
+        skew < 0 ||
+        skew > exports.MAX_CLOCK_SKEW_TOLERANCE_MS) {
+        throw new RangeError(`clockSkewToleranceMs must be within 0..${exports.MAX_CLOCK_SKEW_TOLERANCE_MS}, received ${skew}`);
+    }
+    const { claims } = license;
+    const issuedAtMs = (0, rfc3339_ts_1.parseRfc3339Utc)(claims.issuedAt);
+    if (issuedAtMs === null) {
+        throw new TypeError('a verified license carried an unparseable issuedAt');
+    }
+    let expiresAtMs = null;
+    if (claims.expiresAt !== null) {
+        expiresAtMs = (0, rfc3339_ts_1.parseRfc3339Utc)(claims.expiresAt);
+        if (expiresAtMs === null) {
+            throw new TypeError('a verified license carried an unparseable expiresAt');
+        }
+    }
+    const notYetValid = now + skew < issuedAtMs;
+    const graceEndsAtMs = expiresAtMs === null ? null : expiresAtMs + license_enums_ts_1.LICENSE_GRACE_PERIOD_MS;
+    const temporalStage = resolveTemporalStage(now, skew, expiresAtMs, graceEndsAtMs);
+    const status = resolveEffectiveStatus(claims.status, temporalStage);
+    const stage = notYetValid
+        ? license_enums_ts_1.LicenseLifecycleStage.Restricted
+        : restrictForStatus(temporalStage, claims.status);
+    return {
+        status,
+        stage,
+        notYetValid,
+        expiresAtMs,
+        graceEndsAtMs,
+        clockRollbackDetected: options.highestObservedTimeMs !== undefined &&
+            now < options.highestObservedTimeMs,
+        evaluatedAtMs: now,
+    };
+}
+function resolveTemporalStage(now, skew, expiresAtMs, graceEndsAtMs) {
+    if (expiresAtMs === null || graceEndsAtMs === null) {
+        return license_enums_ts_1.LicenseLifecycleStage.Valid;
+    }
+    if (now - skew <= expiresAtMs) {
+        return license_enums_ts_1.LicenseLifecycleStage.Valid;
+    }
+    if (now - skew <= graceEndsAtMs) {
+        return license_enums_ts_1.LicenseLifecycleStage.Grace;
+    }
+    return license_enums_ts_1.LicenseLifecycleStage.Restricted;
+}
+function resolveEffectiveStatus(claimed, temporalStage) {
+    if (claimed === license_enums_ts_1.LicenseStatus.Active &&
+        temporalStage !== license_enums_ts_1.LicenseLifecycleStage.Valid) {
+        return license_enums_ts_1.LicenseStatus.Expired;
+    }
+    return claimed;
+}
+function restrictForStatus(temporalStage, claimed) {
+    return claimed === license_enums_ts_1.LicenseStatus.Active
+        ? temporalStage
+        : license_enums_ts_1.LicenseLifecycleStage.Restricted;
+}
+//# sourceMappingURL=resolve-license-state.js.map

package/dist/lib/resolve-license-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-license-state.js","sourceRoot":"","sources":["../../src/lib/resolve-license-state.ts"],"names":[],"mappings":";;;AAyEA,kDA8DC;AAvID,yDAI4B;AAC5B,6CAA+C;AASlC,QAAA,+BAA+B,GAAG,MAAM,CAAC;AAOzC,QAAA,2BAA2B,GAAG,CAAC,GAAG,MAAM,CAAC;AAoDtD,SAAgB,mBAAmB,CACjC,OAAwB,EACxB,UAAsC,EAAE;IAExC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,oBAAoB,IAAI,uCAA+B,CAAC;IAC7E,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtB,IAAI,GAAG,CAAC;QACR,IAAI,GAAG,mCAA2B,EAClC,CAAC;QACD,MAAM,IAAI,UAAU,CAClB,0CAA0C,mCAA2B,cAAc,IAAI,EAAE,CAC1F,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAG3B,MAAM,UAAU,GAAG,IAAA,4BAAe,EAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,SAAS,CAAC,oDAAoD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC9B,WAAW,GAAG,IAAA,4BAAe,EAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,IAAI,SAAS,CACjB,qDAAqD,CACtD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,GAAG,IAAI,GAAG,UAAU,CAAC;IAC5C,MAAM,aAAa,GACjB,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,GAAG,0CAAuB,CAAC;IAEtE,MAAM,aAAa,GAAG,oBAAoB,CACxC,GAAG,EACH,IAAI,EACJ,WAAW,EACX,aAAa,CACd,CAAC;IACF,MAAM,MAAM,GAAG,sBAAsB,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACpE,MAAM,KAAK,GAAG,WAAW;QACvB,CAAC,CAAC,wCAAqB,CAAC,UAAU;QAClC,CAAC,CAAC,iBAAiB,CAAC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAEpD,OAAO;QACL,MAAM;QACN,KAAK;QACL,WAAW;QACX,WAAW;QACX,aAAa;QACb,qBAAqB,EACnB,OAAO,CAAC,qBAAqB,KAAK,SAAS;YAC3C,GAAG,GAAG,OAAO,CAAC,qBAAqB;QACrC,aAAa,EAAE,GAAG;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,GAAW,EACX,IAAY,EACZ,WAA0B,EAC1B,aAA4B;IAE5B,IAAI,WAAW,KAAK,IAAI,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QACnD,OAAO,wCAAqB,CAAC,KAAK,CAAC;IACrC,CAAC;IACD,IAAI,GAAG,GAAG,IAAI,IAAI,WAAW,EAAE,CAAC;QAC9B,OAAO,wCAAqB,CAAC,KAAK,CAAC;IACrC,CAAC;IACD,IAAI,GAAG,GAAG,IAAI,IAAI,aAAa,EAAE,CAAC;QAChC,OAAO,wCAAqB,CAAC,KAAK,CAAC;IACrC,CAAC;IACD,OAAO,wCAAqB,CAAC,UAAU,CAAC;AAC1C,CAAC;AAQD,SAAS,sBAAsB,CAC7B,OAAsB,EACtB,aAAoC;IAEpC,IACE,OAAO,KAAK,gCAAa,CAAC,MAAM;QAChC,aAAa,KAAK,wCAAqB,CAAC,KAAK,EAC7C,CAAC;QACD,OAAO,gCAAa,CAAC,OAAO,CAAC;IAC/B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAUD,SAAS,iBAAiB,CACxB,aAAoC,EACpC,OAAsB;IAEtB,OAAO,OAAO,KAAK,gCAAa,CAAC,MAAM;QACrC,CAAC,CAAC,aAAa;QACf,CAAC,CAAC,wCAAqB,CAAC,UAAU,CAAC;AACvC,CAAC"}

package/dist/lib/rfc3339.d.ts

@@ -0,0 +1,2 @@
+export declare function parseRfc3339Utc(value: string): number | null;
+//# sourceMappingURL=rfc3339.d.ts.map

package/dist/lib/rfc3339.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rfc3339.d.ts","sourceRoot":"","sources":["../../src/lib/rfc3339.ts"],"names":[],"mappings":"AAuBA,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAsB5D"}

package/dist/lib/rfc3339.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseRfc3339Utc = parseRfc3339Utc;
+const RFC3339_UTC_PATTERN = /^(?<year>\d{4})-(?<month>\d{2})-(?<day>\d{2})T(?<hour>\d{2}):(?<minute>\d{2}):(?<second>\d{2})(?:\.\d{1,3})?Z$/;
+function parseRfc3339Utc(value) {
+    const match = RFC3339_UTC_PATTERN.exec(value);
+    if (match?.groups === undefined) {
+        return null;
+    }
+    const parsed = Date.parse(value);
+    if (!Number.isFinite(parsed)) {
+        return null;
+    }
+    const date = new Date(parsed);
+    const { year, month, day, hour, minute, second } = match.groups;
+    const agrees = date.getUTCFullYear() === Number(year) &&
+        date.getUTCMonth() + 1 === Number(month) &&
+        date.getUTCDate() === Number(day) &&
+        date.getUTCHours() === Number(hour) &&
+        date.getUTCMinutes() === Number(minute) &&
+        date.getUTCSeconds() === Number(second);
+    return agrees ? parsed : null;
+}
+//# sourceMappingURL=rfc3339.js.map

package/dist/lib/rfc3339.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rfc3339.js","sourceRoot":"","sources":["../../src/lib/rfc3339.ts"],"names":[],"mappings":";;AAuBA,0CAsBC;AAnCD,MAAM,mBAAmB,GACvB,gHAAgH,CAAC;AAYnH,SAAgB,eAAe,CAAC,KAAa;IAC3C,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,KAAK,EAAE,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,MAGxD,CAAC;IACF,MAAM,MAAM,GACV,IAAI,CAAC,cAAc,EAAE,KAAK,MAAM,CAAC,IAAI,CAAC;QACtC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC;QACxC,IAAI,CAAC,UAAU,EAAE,KAAK,MAAM,CAAC,GAAG,CAAC;QACjC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,IAAI,CAAC;QACnC,IAAI,CAAC,aAAa,EAAE,KAAK,MAAM,CAAC,MAAM,CAAC;QACvC,IAAI,CAAC,aAAa,EAAE,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC"}

package/dist/lib/sign-license.d.ts

@@ -0,0 +1,4 @@
+import type { LicenseClaims } from './license-claims.ts';
+import type { LicenseSigner } from './license-signer.ts';
+export declare function signLicense(claims: LicenseClaims, signer: LicenseSigner): Promise<string>;
+//# sourceMappingURL=sign-license.d.ts.map

package/dist/lib/sign-license.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-license.d.ts","sourceRoot":"","sources":["../../src/lib/sign-license.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAoB,MAAM,qBAAqB,CAAC;AAK3E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAiBzD,wBAAsB,WAAW,CAC/B,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,MAAM,CAAC,CA4BjB"}

package/dist/lib/sign-license.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signLicense = signLicense;
+const compact_jws_ts_1 = require("./compact-jws.js");
+const license_enums_ts_1 = require("./license-enums.js");
+const parse_license_claims_ts_1 = require("./parse-license-claims.js");
+async function signLicense(claims, signer) {
+    if (signer.algorithm !== license_enums_ts_1.LicenseSignatureAlgorithm.EdDSA) {
+        throw new TypeError(`a Xema license must be signed with ${license_enums_ts_1.LicenseSignatureAlgorithm.EdDSA}, signer offers ${signer.algorithm}`);
+    }
+    if (typeof signer.keyId !== 'string' || signer.keyId.length === 0) {
+        throw new TypeError('a license signer must expose a non-empty keyId');
+    }
+    const parsed = (0, parse_license_claims_ts_1.parseLicenseClaims)(JSON.parse(JSON.stringify(claims)));
+    if (!parsed.ok) {
+        throw new TypeError(`refusing to sign malformed license claims: ${parsed.message}`);
+    }
+    const header = {
+        alg: license_enums_ts_1.LicenseSignatureAlgorithm.EdDSA,
+        kid: signer.keyId,
+        typ: license_enums_ts_1.LICENSE_JWS_TYPE,
+    };
+    const segments = (0, compact_jws_ts_1.encodeJwsSegments)(JSON.stringify(header), JSON.stringify(parsed.claims));
+    const signature = await signer.sign(segments.signingInput);
+    return (0, compact_jws_ts_1.assembleCompactJws)(segments, signature);
+}
+//# sourceMappingURL=sign-license.js.map

package/dist/lib/sign-license.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-license.js","sourceRoot":"","sources":["../../src/lib/sign-license.ts"],"names":[],"mappings":";;AAuBA,kCA+BC;AAtDD,qDAAyE;AAEzE,yDAG4B;AAE5B,uEAA+D;AAgBxD,KAAK,UAAU,WAAW,CAC/B,MAAqB,EACrB,MAAqB;IAErB,IAAI,MAAM,CAAC,SAAS,KAAK,4CAAyB,CAAC,KAAK,EAAE,CAAC;QACzD,MAAM,IAAI,SAAS,CACjB,sCAAsC,4CAAyB,CAAC,KAAK,mBAAmB,MAAM,CAAC,SAAS,EAAE,CAC3G,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClE,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;IACxE,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,4CAAkB,EAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,SAAS,CACjB,8CAA8C,MAAM,CAAC,OAAO,EAAE,CAC/D,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAqB;QAC/B,GAAG,EAAE,4CAAyB,CAAC,KAAK;QACpC,GAAG,EAAE,MAAM,CAAC,KAAK;QACjB,GAAG,EAAE,mCAAgB;KACtB,CAAC;IACF,MAAM,QAAQ,GAAG,IAAA,kCAAiB,EAChC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EACtB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAC9B,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC3D,OAAO,IAAA,mCAAkB,EAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AACjD,CAAC"}

package/dist/lib/trust-store.d.ts

@@ -0,0 +1,7 @@
+import { type KeyObject } from 'node:crypto';
+export declare function computeLicenseKeyId(publicKeyPem: string): string;
+export interface LicenseTrustStore {
+    readonly keys: ReadonlyMap<string, KeyObject>;
+}
+export declare function createLicenseTrustStore(publicKeyPems: readonly string[]): LicenseTrustStore;
+//# sourceMappingURL=trust-store.d.ts.map

package/dist/lib/trust-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-store.d.ts","sourceRoot":"","sources":["../../src/lib/trust-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAsB1E,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAOhE;AAqBD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;CAC/C;AAeD,wBAAgB,uBAAuB,CACrC,aAAa,EAAE,SAAS,MAAM,EAAE,GAC/B,iBAAiB,CAcnB"}

package/dist/lib/trust-store.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.computeLicenseKeyId = computeLicenseKeyId;
+exports.createLicenseTrustStore = createLicenseTrustStore;
+const node_crypto_1 = require("node:crypto");
+const base64url_ts_1 = require("./base64url.js");
+const REQUIRED_KEY_TYPE = 'ed25519';
+function computeLicenseKeyId(publicKeyPem) {
+    const key = (0, node_crypto_1.createPublicKey)({ key: publicKeyPem, format: 'pem' });
+    assertEd25519(key);
+    const spki = key.export({ format: 'der', type: 'spki' });
+    return (0, base64url_ts_1.encodeBase64Url)(new Uint8Array((0, node_crypto_1.createHash)('sha256').update(spki).digest()));
+}
+function assertEd25519(key) {
+    if (key.asymmetricKeyType !== REQUIRED_KEY_TYPE) {
+        throw new TypeError(`a Xema license key must be ${REQUIRED_KEY_TYPE}, received ${String(key.asymmetricKeyType)}`);
+    }
+}
+function createLicenseTrustStore(publicKeyPems) {
+    const keys = new Map();
+    for (const pem of publicKeyPems) {
+        const key = (0, node_crypto_1.createPublicKey)({ key: pem, format: 'pem' });
+        assertEd25519(key);
+        const keyId = computeLicenseKeyId(pem);
+        if (keys.has(keyId)) {
+            throw new Error(`duplicate license verification key ${keyId} in the trust store`);
+        }
+        keys.set(keyId, key);
+    }
+    return { keys };
+}
+//# sourceMappingURL=trust-store.js.map

package/dist/lib/trust-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trust-store.js","sourceRoot":"","sources":["../../src/lib/trust-store.ts"],"names":[],"mappings":";;AAsBA,kDAOC;AAsCD,0DAgBC;AAnFD,6CAA0E;AAE1E,iDAAiD;AAMjD,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAcpC,SAAgB,mBAAmB,CAAC,YAAoB;IACtD,MAAM,GAAG,GAAG,IAAA,6BAAe,EAAC,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,aAAa,CAAC,GAAG,CAAC,CAAC;IACnB,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACzD,OAAO,IAAA,8BAAe,EACpB,IAAI,UAAU,CAAC,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAC3D,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,GAAc;IACnC,IAAI,GAAG,CAAC,iBAAiB,KAAK,iBAAiB,EAAE,CAAC;QAChD,MAAM,IAAI,SAAS,CACjB,8BAA8B,iBAAiB,cAAc,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAC7F,CAAC;IACJ,CAAC;AACH,CAAC;AA8BD,SAAgB,uBAAuB,CACrC,aAAgC;IAEhC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,IAAA,6BAAe,EAAC,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,aAAa,CAAC,GAAG,CAAC,CAAC;QACnB,MAAM,KAAK,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,sCAAsC,KAAK,qBAAqB,CACjE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC"}

package/dist/lib/verification-failure.d.ts

@@ -0,0 +1,17 @@
+export declare enum LicenseVerificationFailureCode {
+    MalformedToken = "malformed-token",
+    MalformedHeader = "malformed-header",
+    TrustStoreEmpty = "trust-store-empty",
+    UnknownKeyId = "unknown-key-id",
+    InvalidSignature = "invalid-signature",
+    MalformedClaims = "malformed-claims",
+    UnsupportedClaimsVersion = "unsupported-claims-version",
+    IssuerMismatch = "issuer-mismatch"
+}
+export interface LicenseVerificationFailure {
+    readonly ok: false;
+    readonly code: LicenseVerificationFailureCode;
+    readonly message: string;
+}
+export declare function verificationFailure(code: LicenseVerificationFailureCode, message: string): LicenseVerificationFailure;
+//# sourceMappingURL=verification-failure.d.ts.map

package/dist/lib/verification-failure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-failure.d.ts","sourceRoot":"","sources":["../../src/lib/verification-failure.ts"],"names":[],"mappings":"AASA,oBAAY,8BAA8B;IAExC,cAAc,oBAAoB;IAElC,eAAe,qBAAqB;IAEpC,eAAe,sBAAsB;IAErC,YAAY,mBAAmB;IAE/B,gBAAgB,sBAAsB;IAEtC,eAAe,qBAAqB;IAEpC,wBAAwB,+BAA+B;IAEvD,cAAc,oBAAoB;CACnC;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,8BAA8B,CAAC;IAE9C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,8BAA8B,EACpC,OAAO,EAAE,MAAM,GACd,0BAA0B,CAE5B"}

package/dist/lib/verification-failure.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LicenseVerificationFailureCode = void 0;
+exports.verificationFailure = verificationFailure;
+var LicenseVerificationFailureCode;
+(function (LicenseVerificationFailureCode) {
+    LicenseVerificationFailureCode["MalformedToken"] = "malformed-token";
+    LicenseVerificationFailureCode["MalformedHeader"] = "malformed-header";
+    LicenseVerificationFailureCode["TrustStoreEmpty"] = "trust-store-empty";
+    LicenseVerificationFailureCode["UnknownKeyId"] = "unknown-key-id";
+    LicenseVerificationFailureCode["InvalidSignature"] = "invalid-signature";
+    LicenseVerificationFailureCode["MalformedClaims"] = "malformed-claims";
+    LicenseVerificationFailureCode["UnsupportedClaimsVersion"] = "unsupported-claims-version";
+    LicenseVerificationFailureCode["IssuerMismatch"] = "issuer-mismatch";
+})(LicenseVerificationFailureCode || (exports.LicenseVerificationFailureCode = LicenseVerificationFailureCode = {}));
+function verificationFailure(code, message) {
+    return { ok: false, code, message };
+}
+//# sourceMappingURL=verification-failure.js.map

package/dist/lib/verification-failure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-failure.js","sourceRoot":"","sources":["../../src/lib/verification-failure.ts"],"names":[],"mappings":";;;AAmCA,kDAKC;AA/BD,IAAY,8BAiBX;AAjBD,WAAY,8BAA8B;IAExC,oEAAkC,CAAA;IAElC,sEAAoC,CAAA;IAEpC,uEAAqC,CAAA;IAErC,iEAA+B,CAAA;IAE/B,wEAAsC,CAAA;IAEtC,sEAAoC,CAAA;IAEpC,yFAAuD,CAAA;IAEvD,oEAAkC,CAAA;AACpC,CAAC,EAjBW,8BAA8B,8CAA9B,8BAA8B,QAiBzC;AASD,SAAgB,mBAAmB,CACjC,IAAoC,EACpC,OAAe;IAEf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACtC,CAAC"}

package/dist/lib/verified-license.d.ts

@@ -0,0 +1,10 @@
+import type { LicenseClaims } from './license-claims.ts';
+declare const VERIFIED_LICENSE_BRAND: unique symbol;
+export interface VerifiedLicense {
+    readonly [VERIFIED_LICENSE_BRAND]: true;
+    readonly claims: LicenseClaims;
+    readonly keyId: string;
+}
+export declare function createVerifiedLicense(claims: LicenseClaims, keyId: string): VerifiedLicense;
+export {};
+//# sourceMappingURL=verified-license.d.ts.map

package/dist/lib/verified-license.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verified-license.d.ts","sourceRoot":"","sources":["../../src/lib/verified-license.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAczD,QAAA,MAAM,sBAAsB,EAAE,OAAO,MAAuC,CAAC;AAW7E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,CAAC,sBAAsB,CAAC,EAAE,IAAI,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAE/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,MAAM,GACZ,eAAe,CAEjB"}

package/dist/lib/verified-license.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createVerifiedLicense = createVerifiedLicense;
+const VERIFIED_LICENSE_BRAND = Symbol('xema.verifiedLicense');
+function createVerifiedLicense(claims, keyId) {
+    return { [VERIFIED_LICENSE_BRAND]: true, claims, keyId };
+}
+//# sourceMappingURL=verified-license.js.map

package/dist/lib/verified-license.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verified-license.js","sourceRoot":"","sources":["../../src/lib/verified-license.ts"],"names":[],"mappings":";;AAgCA,sDAKC;AAvBD,MAAM,sBAAsB,GAAkB,MAAM,CAAC,sBAAsB,CAAC,CAAC;AAkB7E,SAAgB,qBAAqB,CACnC,MAAqB,EACrB,KAAa;IAEb,OAAO,EAAE,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC3D,CAAC"}

package/dist/lib/verify-license.d.ts

@@ -0,0 +1,13 @@
+import type { LicenseTrustStore } from './trust-store.ts';
+import { type LicenseVerificationFailure } from './verification-failure.ts';
+import { type VerifiedLicense } from './verified-license.ts';
+export interface VerifyLicenseOptions {
+    readonly trustStore: LicenseTrustStore;
+    readonly expectedIssuer?: string;
+}
+export type LicenseVerificationSuccess = {
+    readonly ok: true;
+} & VerifiedLicense;
+export type LicenseVerificationResult = LicenseVerificationSuccess | LicenseVerificationFailure;
+export declare function verifyLicense(token: string, options: VerifyLicenseOptions): LicenseVerificationResult;
+//# sourceMappingURL=verify-license.d.ts.map

package/dist/lib/verify-license.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-license.d.ts","sourceRoot":"","sources":["../../src/lib/verify-license.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAGL,KAAK,0BAA0B,EAChC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAEL,KAAK,eAAe,EACrB,MAAM,uBAAuB,CAAC;AAK/B,MAAM,WAAW,oBAAoB;IAMnC,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAMvC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC;AAED,MAAM,MAAM,0BAA0B,GAAG;IACvC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;CACnB,GAAG,eAAe,CAAC;AAEpB,MAAM,MAAM,yBAAyB,GACjC,0BAA0B,GAC1B,0BAA0B,CAAC;AAgB/B,wBAAgB,aAAa,CAC3B,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,oBAAoB,GAC5B,yBAAyB,CAqF3B"}

package/dist/lib/verify-license.js

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyLicense = verifyLicense;
+const node_crypto_1 = require("node:crypto");
+const base64url_ts_1 = require("./base64url.js");
+const compact_jws_ts_1 = require("./compact-jws.js");
+const license_enums_ts_1 = require("./license-enums.js");
+const parse_license_claims_ts_1 = require("./parse-license-claims.js");
+const verification_failure_ts_1 = require("./verification-failure.js");
+const verified_license_ts_1 = require("./verified-license.js");
+const HEADER_KEYS = ['alg', 'kid', 'typ'];
+const MAX_KEY_ID_LENGTH = 128;
+function verifyLicense(token, options) {
+    if (typeof token !== 'string') {
+        return (0, verification_failure_ts_1.verificationFailure)(verification_failure_ts_1.LicenseVerificationFailureCode.MalformedToken, 'a license token must be a string');
+    }
+    const segments = (0, compact_jws_ts_1.splitCompactJws)(token.trim());
+    if (segments === null) {
+        return (0, verification_failure_ts_1.verificationFailure)(verification_failure_ts_1.LicenseVerificationFailureCode.MalformedToken, 'a license token must be a compact JWS of three non-empty base64url segments');
+    }
+    const header = parseHeader(segments.encodedHeader);
+    if ('code' in header) {
+        return header;
+    }
+    if (options.trustStore.keys.size === 0) {
+        return (0, verification_failure_ts_1.verificationFailure)(verification_failure_ts_1.LicenseVerificationFailureCode.TrustStoreEmpty, 'this build carries no license verification keys; its license material was never provisioned');
+    }
+    const key = options.trustStore.keys.get(header.kid);
+    if (key === undefined) {
+        return (0, verification_failure_ts_1.verificationFailure)(verification_failure_ts_1.LicenseVerificationFailureCode.UnknownKeyId, `no trusted license verification key with id ${header.kid}`);
+    }
+    const signatureIsValid = (0, node_crypto_1.verify)(null, segments.signingInput, key, segments.signature);
+    if (!signatureIsValid) {
+        return (0, verification_failure_ts_1.verificationFailure)(verification_failure_ts_1.LicenseVerificationFailureCode.InvalidSignature, `the license signature does not verify under key ${header.kid}`);
+    }
+    const payloadText = (0, base64url_ts_1.decodeBase64UrlText)(segments.encodedPayload);
+    if (payloadText === null) {
+        return (0, verification_failure_ts_1.verificationFailure)(verification_failure_ts_1.LicenseVerificationFailureCode.MalformedClaims, 'the license payload is not valid UTF-8');
+    }
+    let payload;
+    try {
+        payload = JSON.parse(payloadText);
+    }
+    catch {
+        return (0, verification_failure_ts_1.verificationFailure)(verification_failure_ts_1.LicenseVerificationFailureCode.MalformedClaims, 'the license payload is not valid JSON');
+    }
+    const parsed = (0, parse_license_claims_ts_1.parseLicenseClaims)(payload);
+    if (!parsed.ok) {
+        return parsed;
+    }
+    const expectedIssuer = options.expectedIssuer ?? license_enums_ts_1.XEMA_LICENSE_ISSUER;
+    if (parsed.claims.issuer !== expectedIssuer) {
+        return (0, verification_failure_ts_1.verificationFailure)(verification_failure_ts_1.LicenseVerificationFailureCode.IssuerMismatch, `the license names issuer ${parsed.claims.issuer}, expected ${expectedIssuer}`);
+    }
+    return { ok: true, ...(0, verified_license_ts_1.createVerifiedLicense)(parsed.claims, header.kid) };
+}
+function parseHeader(encodedHeader) {
+    const text = (0, base64url_ts_1.decodeBase64UrlText)(encodedHeader);
+    if (text === null) {
+        return malformedHeader('the protected header is not valid UTF-8');
+    }
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch {
+        return malformedHeader('the protected header is not valid JSON');
+    }
+    if (typeof value !== 'object' ||
+        value === null ||
+        Array.isArray(value) ||
+        Object.getPrototypeOf(value) !== Object.prototype) {
+        return malformedHeader('the protected header must be a JSON object');
+    }
+    const object = value;
+    for (const key of Object.keys(object)) {
+        if (!HEADER_KEYS.includes(key)) {
+            return malformedHeader(`unknown header parameter "${key}"`);
+        }
+    }
+    if (object['alg'] !== license_enums_ts_1.LicenseSignatureAlgorithm.EdDSA) {
+        return malformedHeader(`unsupported signature algorithm ${JSON.stringify(object['alg'])}; a Xema license is ${license_enums_ts_1.LicenseSignatureAlgorithm.EdDSA}`);
+    }
+    if (object['typ'] !== license_enums_ts_1.LICENSE_JWS_TYPE) {
+        return malformedHeader(`unsupported token type ${JSON.stringify(object['typ'])}; a Xema license is ${license_enums_ts_1.LICENSE_JWS_TYPE}`);
+    }
+    const kid = object['kid'];
+    if (typeof kid !== 'string' ||
+        kid.length === 0 ||
+        kid.length > MAX_KEY_ID_LENGTH) {
+        return malformedHeader(`the header must carry a kid of 1..${MAX_KEY_ID_LENGTH} characters`);
+    }
+    return { alg: license_enums_ts_1.LicenseSignatureAlgorithm.EdDSA, kid, typ: license_enums_ts_1.LICENSE_JWS_TYPE };
+}
+function malformedHeader(message) {
+    return (0, verification_failure_ts_1.verificationFailure)(verification_failure_ts_1.LicenseVerificationFailureCode.MalformedHeader, message);
+}
+//# sourceMappingURL=verify-license.js.map

package/dist/lib/verify-license.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-license.js","sourceRoot":"","sources":["../../src/lib/verify-license.ts"],"names":[],"mappings":";;AA8DA,sCAwFC;AAtJD,6CAAwD;AAExD,iDAAqD;AACrD,qDAAmD;AAEnD,yDAI4B;AAC5B,uEAA+D;AAE/D,uEAImC;AACnC,+DAG+B;AAE/B,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAU,CAAC;AACnD,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAuC9B,SAAgB,aAAa,CAC3B,KAAa,EACb,OAA6B;IAE7B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAA,6CAAmB,EACxB,wDAA8B,CAAC,cAAc,EAC7C,kCAAkC,CACnC,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAA,gCAAe,EAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,IAAA,6CAAmB,EACxB,wDAA8B,CAAC,cAAc,EAC7C,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IACnD,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;QACrB,OAAO,MAAM,CAAC;IAChB,CAAC;IAKD,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,IAAA,6CAAmB,EACxB,wDAA8B,CAAC,eAAe,EAC9C,6FAA6F,CAC9F,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,IAAA,6CAAmB,EACxB,wDAA8B,CAAC,YAAY,EAC3C,+CAA+C,MAAM,CAAC,GAAG,EAAE,CAC5D,CAAC;IACJ,CAAC;IAGD,MAAM,gBAAgB,GAAG,IAAA,oBAAe,EACtC,IAAI,EACJ,QAAQ,CAAC,YAAY,EACrB,GAAG,EACH,QAAQ,CAAC,SAAS,CACnB,CAAC;IACF,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,IAAA,6CAAmB,EACxB,wDAA8B,CAAC,gBAAgB,EAC/C,mDAAmD,MAAM,CAAC,GAAG,EAAE,CAChE,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,IAAA,kCAAmB,EAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IACjE,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACzB,OAAO,IAAA,6CAAmB,EACxB,wDAA8B,CAAC,eAAe,EAC9C,wCAAwC,CACzC,CAAC;IACJ,CAAC;IAED,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAA,6CAAmB,EACxB,wDAA8B,CAAC,eAAe,EAC9C,uCAAuC,CACxC,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,4CAAkB,EAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,sCAAmB,CAAC;IACrE,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QAC5C,OAAO,IAAA,6CAAmB,EACxB,wDAA8B,CAAC,cAAc,EAC7C,4BAA4B,MAAM,CAAC,MAAM,CAAC,MAAM,cAAc,cAAc,EAAE,CAC/E,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,IAAA,2CAAqB,EAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED,SAAS,WAAW,CAClB,aAAqB;IAErB,MAAM,IAAI,GAAG,IAAA,kCAAmB,EAAC,aAAa,CAAC,CAAC;IAChD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,eAAe,CAAC,yCAAyC,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,eAAe,CAAC,wCAAwC,CAAC,CAAC;IACnE,CAAC;IACD,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS,EACjD,CAAC;QACD,OAAO,eAAe,CAAC,4CAA4C,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,CAAE,WAAiC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAItD,OAAO,eAAe,CAAC,6BAA6B,GAAG,GAAG,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,4CAAyB,CAAC,KAAK,EAAE,CAAC;QACtD,OAAO,eAAe,CACpB,mCAAmC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,uBAAuB,4CAAyB,CAAC,KAAK,EAAE,CACzH,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,mCAAgB,EAAE,CAAC;QACvC,OAAO,eAAe,CACpB,0BAA0B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,uBAAuB,mCAAgB,EAAE,CACjG,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,IACE,OAAO,GAAG,KAAK,QAAQ;QACvB,GAAG,CAAC,MAAM,KAAK,CAAC;QAChB,GAAG,CAAC,MAAM,GAAG,iBAAiB,EAC9B,CAAC;QACD,OAAO,eAAe,CACpB,qCAAqC,iBAAiB,aAAa,CACpE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,4CAAyB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,mCAAgB,EAAE,CAAC;AAC9E,CAAC;AAED,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO,IAAA,6CAAmB,EACxB,wDAA8B,CAAC,eAAe,EAC9C,OAAO,CACR,CAAC;AACJ,CAAC"}

package/dist/signing.d.ts

@@ -0,0 +1,4 @@
+export { LocalKeyLicenseSigner, type LicenseSigner, } from './lib/license-signer.ts';
+export { signLicense } from './lib/sign-license.ts';
+export { renderLicenseMaterial, type LicenseMaterial, } from './lib/render-license-material.ts';
+//# sourceMappingURL=signing.d.ts.map

package/dist/signing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../src/signing.ts"],"names":[],"mappings":"AAiBA,OAAO,EACL,qBAAqB,EACrB,KAAK,aAAa,GACnB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EACL,qBAAqB,EACrB,KAAK,eAAe,GACrB,MAAM,kCAAkC,CAAC"}

package/dist/signing.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderLicenseMaterial = exports.signLicense = exports.LocalKeyLicenseSigner = void 0;
+var license_signer_ts_1 = require("./lib/license-signer.js");
+Object.defineProperty(exports, "LocalKeyLicenseSigner", { enumerable: true, get: function () { return license_signer_ts_1.LocalKeyLicenseSigner; } });
+var sign_license_ts_1 = require("./lib/sign-license.js");
+Object.defineProperty(exports, "signLicense", { enumerable: true, get: function () { return sign_license_ts_1.signLicense; } });
+var render_license_material_ts_1 = require("./lib/render-license-material.js");
+Object.defineProperty(exports, "renderLicenseMaterial", { enumerable: true, get: function () { return render_license_material_ts_1.renderLicenseMaterial; } });
+//# sourceMappingURL=signing.js.map

package/dist/signing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.js","sourceRoot":"","sources":["../src/signing.ts"],"names":[],"mappings":";;;AAiBA,6DAGiC;AAF/B,0HAAA,qBAAqB,OAAA;AAGvB,yDAAoD;AAA3C,8GAAA,WAAW,OAAA;AACpB,+EAG0C;AAFxC,mIAAA,qBAAqB,OAAA"}

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "@xemahq/license-verifier",
+  "version": "0.1.0",
+  "description": "Offline verification of a Xema license — Ed25519 JWS against an embedded public key, lifecycle resolution and entitlement evaluation. Zero dependencies, Node built-ins only, so it runs in the CLI from a bare checkout and in the air-gap installer on a disconnected box.",
+  "license": "Apache-2.0",
+  "author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
+  "homepage": "https://xema.dev",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/xema-dev/xema-kernel-contracts.git",
+    "directory": "packages/kernel/license-verifier"
+  },
+  "bugs": "https://github.com/xema-dev/xema-kernel-contracts/issues",
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/",
+    "access": "public"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "devDependencies": {
+    "@types/node": "25.2.3",
+    "prettier": "3.6.2",
+    "typescript": "5.9.3",
+    "@xemahq/license-contracts": "0.1.0"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "xema-source": "./src/index.ts",
+      "default": "./dist/index.js"
+    },
+    "./signing": {
+      "types": "./dist/signing.d.ts",
+      "xema-source": "./src/signing.ts",
+      "default": "./dist/signing.js"
+    },
+    "./dist/lib/*": {
+      "types": "./dist/lib/*.d.ts",
+      "default": "./dist/lib/*.js"
+    }
+  },
+  "bin": {
+    "xema-license-keygen": "dist/bin/xema-license-keygen.js",
+    "xema-license-mint-oss": "dist/bin/xema-license-mint-oss.js"
+  },
+  "scripts": {
+    "clean": "rm -rf dist",
+    "build": "tsc -p tsconfig.json",
+    "format": "prettier --write \"src/**/*.ts\"",
+    "typecheck": "tsc -p tsconfig.typecheck.json",
+    "test": "node --experimental-transform-types --test \"src/lib/*.test.ts\""
+  }
+}