@zdevzone/keyforge-client 0.0.0-stage → 0.1.0

package/dist/device-signals-node.js

@@ -0,0 +1,130 @@
+/** Internal Node-only primitives shared by opt-in desktop collectors. */
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import { open, constants } from "node:fs/promises";
+export const QUERY_TIMEOUT_MS = 8000;
+export class DeviceSignalQueryError extends Error {
+    status;
+    constructor(status) {
+        super(`Device signal query: ${status}`);
+        this.status = status;
+    }
+}
+export function queryError(error) {
+    const value = error;
+    return new DeviceSignalQueryError(value?.code === "ERR_CHILD_PROCESS_STDIO_MAXBUFFER"
+        ? "query_failed"
+        : value?.killed
+            ? "timeout"
+            : value?.code === "EACCES" || value?.code === "EPERM" || value?.code === 5
+                ? "permission_denied"
+                : value?.code === "ENOENT"
+                    ? "unavailable"
+                    : "query_failed");
+}
+export function executeQuery(file, args, maxBuffer = 4096) {
+    return new Promise((resolve, reject) => execFile(file, [...args], { windowsHide: true, timeout: QUERY_TIMEOUT_MS, maxBuffer, encoding: "utf8" }, (error, stdout) => (error ? reject(queryError(error)) : resolve(stdout))));
+}
+/** Fixed local files only; one bounded nonblocking read also works for size-zero sysfs files. */
+export async function readIdentifier(file) {
+    try {
+        const handle = await open(file, constants.O_RDONLY | constants.O_NONBLOCK);
+        try {
+            if (!(await handle.stat()).isFile())
+                throw new DeviceSignalQueryError("unavailable");
+            const bytes = Buffer.alloc(4097);
+            const { bytesRead } = await handle.read(bytes, 0, bytes.length, 0);
+            if (bytesRead > 4096)
+                throw new DeviceSignalQueryError("query_failed");
+            return bytes.subarray(0, bytesRead).toString("utf8");
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch (error) {
+        throw error instanceof DeviceSignalQueryError ? error : queryError(error);
+    }
+}
+/** UUIDs use lowercase unbraced hyphenated hex; volume serials use eight lowercase hex digits. */
+export function normalizeDeviceIdentifier(kind, input) {
+    if (input.length > 256)
+        return null;
+    const value = input.trim().toLowerCase();
+    if (kind === "volume-serial") {
+        const hex = value.replace(/^([a-f0-9]{4})-([a-f0-9]{4})$/, "$1$2");
+        return /^[a-f0-9]{8}$/.test(hex) && !/^(0{8}|f{8}|12345678)$/.test(hex) ? hex : null;
+    }
+    if (kind === "linux-machine-id")
+        return /^[a-f0-9]{32}$/.test(value) && !/^([a-f0-9])\1{31}$/.test(value) ? value : null;
+    const uuid = value.replace(/^\{([a-f0-9-]+)\}$/, "$1");
+    if (!/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/.test(uuid))
+        return null;
+    const compact = uuid.replaceAll("-", "");
+    if (/^(0{32}|f{32}|([a-f0-9])\2{31})$/.test(compact) ||
+        compact === "03000200040005000006000700080009")
+        return null;
+    return uuid;
+}
+/** v1: SHA-256 of UTF-8 JSON [domain, version, canonical deployment URL, product, kind, identifier]. */
+export function hashDeviceIdentifier(context, kind, normalized) {
+    const url = new URL(context.serverUrl);
+    if (url.username ||
+        url.password ||
+        url.search ||
+        url.hash ||
+        !/^[a-z][a-z0-9-]{0,59}$/.test(context.productId))
+        throw new Error("Invalid device signal scope");
+    const deployment = url.toString().replace(/\/$/, "");
+    return createHash("sha256")
+        .update(JSON.stringify([
+        "keyforge-device-signals",
+        1,
+        deployment,
+        context.productId,
+        kind,
+        normalized,
+    ]), "utf8")
+        .digest("hex");
+}
+export function boundedQuery(query, kind) {
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => reject(new DeviceSignalQueryError("timeout")), QUERY_TIMEOUT_MS);
+        Promise.resolve()
+            .then(() => query(kind))
+            .then((value) => {
+            clearTimeout(timer);
+            if (typeof value !== "string" || Buffer.byteLength(value, "utf8") > 4096)
+                reject(new DeviceSignalQueryError("query_failed"));
+            else
+                resolve(value);
+        }, (error) => {
+            clearTimeout(timer);
+            reject(error);
+        });
+    });
+}
+export function createSignalProvider(platform, kinds, options, nativeQuery) {
+    return async (context) => {
+        const report = { signals: [], diagnostics: [] };
+        for (const kind of kinds) {
+            let status = "unsupported";
+            if ((options.platform ?? process.platform) === platform) {
+                try {
+                    const raw = await boundedQuery(options.query ?? nativeQuery, kind);
+                    const normalized = normalizeDeviceIdentifier(kind, raw);
+                    status = normalized ? "available" : raw.trim() ? "invalid" : "unavailable";
+                    if (normalized)
+                        report.signals.push({ kind, hash: hashDeviceIdentifier(context, kind, normalized) });
+                }
+                catch (error) {
+                    status =
+                        error instanceof DeviceSignalQueryError ? error.status : queryError(error).status;
+                }
+            }
+            report.diagnostics.push({ kind, status });
+        }
+        return report;
+    };
+}
+//# sourceMappingURL=device-signals-node.js.map

package/dist/device-signals-node.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-signals-node.js","sourceRoot":"","sources":["../src/device-signals-node.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAGnD,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,CAAC;AACrC,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAE7B,MAAM;IADxB,YACkB,MAAwE;QAExF,KAAK,CAAC,wBAAwB,MAAM,EAAE,CAAC,CAAC;sBAFxB,MAAM;IAGxB,CAAC;CACF;AACD,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,MAAM,KAAK,GAAG,KAA4D,CAAC;IAC3E,OAAO,IAAI,sBAAsB,CAC/B,KAAK,EAAE,IAAI,KAAK,mCAAmC;QACjD,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,KAAK,EAAE,MAAM;YACb,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,QAAQ,IAAI,KAAK,EAAE,IAAI,KAAK,OAAO,IAAI,KAAK,EAAE,IAAI,KAAK,CAAC;gBACxE,CAAC,CAAC,mBAAmB;gBACrB,CAAC,CAAC,KAAK,EAAE,IAAI,KAAK,QAAQ;oBACxB,CAAC,CAAC,aAAa;oBACf,CAAC,CAAC,cAAc,CACzB,CAAC;AACJ,CAAC;AACD,MAAM,UAAU,YAAY,CAC1B,IAAY,EACZ,IAAuB,EACvB,SAAS,GAAG,IAAI;IAEhB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CACrC,QAAQ,CACN,IAAI,EACJ,CAAC,GAAG,IAAI,CAAC,EACT,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAC7E,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CACzE,CACF,CAAC;AACJ,CAAC;AACD,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY;IAC/C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;QAC3E,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;gBAAE,MAAM,IAAI,sBAAsB,CAAC,aAAa,CAAC,CAAC;YACrF,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACnE,IAAI,SAAS,GAAG,IAAI;gBAAE,MAAM,IAAI,sBAAsB,CAAC,cAAc,CAAC,CAAC;YACvE,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACvD,CAAC;gBAAS,CAAC;YACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,YAAY,sBAAsB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AACD,kGAAkG;AAClG,MAAM,UAAU,yBAAyB,CAAC,IAAsB,EAAE,KAAa;IAC7E,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACzC,IAAI,IAAI,KAAK,eAAe,EAAE,CAAC;QAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,+BAA+B,EAAE,MAAM,CAAC,CAAC;QACnE,OAAO,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IACvF,CAAC;IACD,IAAI,IAAI,KAAK,kBAAkB;QAC7B,OAAO,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1F,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;IACvD,IAAI,CAAC,gEAAgE,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9F,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACzC,IACE,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC;QAChD,OAAO,KAAK,kCAAkC;QAE9C,OAAO,IAAI,CAAC;IACd,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,oBAAoB,CAClC,OAAiD,EACjD,IAAsB,EACtB,UAAkB;IAElB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACvC,IACE,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,IAAI;QACR,CAAC,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;QAEjD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrD,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CACL,IAAI,CAAC,SAAS,CAAC;QACb,yBAAyB;QACzB,CAAC;QACD,UAAU;QACV,OAAO,CAAC,SAAS;QACjB,IAAI;QACJ,UAAU;KACX,CAAC,EACF,MAAM,CACP;SACA,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,KAAkD,EAClD,IAAsB;IAEtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,sBAAsB,CAAC,SAAS,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;QAChG,OAAO,CAAC,OAAO,EAAE;aACd,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;aACvB,IAAI,CACH,CAAC,KAAK,EAAE,EAAE;YACR,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,IAAI;gBACtE,MAAM,CAAC,IAAI,sBAAsB,CAAC,cAAc,CAAC,CAAC,CAAC;;gBAChD,OAAO,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC,EACD,CAAC,KAAK,EAAE,EAAE;YACR,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CACF,CAAC;IACN,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,QAAgB,EAChB,KAAkC,EAClC,OAAmF,EACnF,WAAwD;IAExD,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,MAAM,GAAwB,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;QACrE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,MAAM,GAAyD,aAAa,CAAC;YACjF,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACxD,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,KAAK,IAAI,WAAW,EAAE,IAAI,CAAC,CAAC;oBACnE,MAAM,UAAU,GAAG,yBAAyB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;oBACxD,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC;oBAC3E,IAAI,UAAU;wBACZ,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;gBACzF,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM;wBACJ,KAAK,YAAY,sBAAsB,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;gBACtF,CAAC;YACH,CAAC;YACD,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC"}

package/dist/device-signals.d.ts

@@ -0,0 +1,13 @@
+/** Optional Node-only auto-detection. The core @zdevzone/keyforge-client entry point never imports this. */
+import { type LinuxDeviceSignalsOptions } from "./linux.js";
+import { type MacOSDeviceSignalsOptions } from "./macos.js";
+import type { DeviceSignalsProvider } from "./types.js";
+import { type WindowsDeviceSignalsOptions } from "./windows.js";
+export { DeviceSignalQueryError, hashDeviceIdentifier, normalizeDeviceIdentifier, } from "./device-signals-node.js";
+export interface DeviceSignalsOptions {
+    platform?: string;
+    windows?: Omit<WindowsDeviceSignalsOptions, "platform">;
+    linux?: Omit<LinuxDeviceSignalsOptions, "platform">;
+    macos?: Omit<MacOSDeviceSignalsOptions, "platform">;
+}
+export declare function createDeviceSignalsProvider(options?: DeviceSignalsOptions): DeviceSignalsProvider;

package/dist/device-signals.js

@@ -0,0 +1,17 @@
+/** Optional Node-only auto-detection. The core @zdevzone/keyforge-client entry point never imports this. */
+import { createLinuxDeviceSignalsProvider } from "./linux.js";
+import { createMacOSDeviceSignalsProvider } from "./macos.js";
+import { createWindowsDeviceSignalsProvider } from "./windows.js";
+export { DeviceSignalQueryError, hashDeviceIdentifier, normalizeDeviceIdentifier, } from "./device-signals-node.js";
+export function createDeviceSignalsProvider(options = {}) {
+    const platform = options.platform ?? process.platform;
+    if (platform === "win32")
+        return createWindowsDeviceSignalsProvider({ ...options.windows, platform });
+    if (platform === "linux")
+        return createLinuxDeviceSignalsProvider({ ...options.linux, platform });
+    if (platform === "darwin")
+        return createMacOSDeviceSignalsProvider({ ...options.macos, platform });
+    // Other runtimes retain installation licensing; no fake fingerprint is manufactured.
+    return async () => ({ signals: [], diagnostics: [] });
+}
+//# sourceMappingURL=device-signals.js.map

package/dist/device-signals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-signals.js","sourceRoot":"","sources":["../src/device-signals.ts"],"names":[],"mappings":"AAAA,4GAA4G;AAC5G,OAAO,EAAE,gCAAgC,EAAkC,MAAM,YAAY,CAAC;AAC9F,OAAO,EAAE,gCAAgC,EAAkC,MAAM,YAAY,CAAC;AAE9F,OAAO,EAAE,kCAAkC,EAAoC,MAAM,cAAc,CAAC;AAEpG,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,GAC1B,MAAM,0BAA0B,CAAC;AAOlC,MAAM,UAAU,2BAA2B,CACzC,OAAO,GAAyB,EAAE;IAElC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACtD,IAAI,QAAQ,KAAK,OAAO;QACtB,OAAO,kCAAkC,CAAC,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9E,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,gCAAgC,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClG,IAAI,QAAQ,KAAK,QAAQ;QACvB,OAAO,gCAAgC,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1E,qFAAqF;IACrF,OAAO,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export { KeyForgeClient, KeyForgeError, MemoryStorage } from "./client.js";
+export { verifySignedToken, TokenError } from "./tokens.js";
+export type { LicenseToken, TrialToken, SignedToken, VerificationContext } from "./tokens.js";
+export type { ClientOptions } from "./client.js";
+export type * from "./types.js";
+export { DEVICE_SIGNAL_KINDS } from "./types.js";

package/dist/index.js

@@ -0,0 +1,4 @@
+export { KeyForgeClient, KeyForgeError, MemoryStorage } from "./client.js";
+export { verifySignedToken, TokenError } from "./tokens.js";
+export { DEVICE_SIGNAL_KINDS } from "./types.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAI5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC"}

package/dist/linux.d.ts

@@ -0,0 +1,8 @@
+import type { DeviceSignalsProvider } from "./types.js";
+export interface LinuxDeviceSignalsOptions {
+    platform?: string;
+    /** Inject read-only OS operations for integration tests. */
+    readFile?: (path: string) => Promise<string>;
+    execute?: (file: string, args: readonly string[]) => Promise<string>;
+}
+export declare function createLinuxDeviceSignalsProvider(options?: LinuxDeviceSignalsOptions): DeviceSignalsProvider;

package/dist/linux.js

@@ -0,0 +1,35 @@
+/** Optional Node-only Linux adapter. No sudo, dmidecode, disk reads or shell scripts. */
+import { createSignalProvider, DeviceSignalQueryError, executeQuery, readIdentifier, } from "./device-signals-node.js";
+export function createLinuxDeviceSignalsProvider(options = {}) {
+    const read = options.readFile ?? readIdentifier, execute = options.execute ?? executeQuery;
+    const query = async (kind) => {
+        if (kind === "linux-machine-id") {
+            try {
+                const value = await read("/etc/machine-id");
+                if (value.trim())
+                    return value;
+            }
+            catch (error) {
+                if (!(error instanceof DeviceSignalQueryError && error.status === "unavailable") &&
+                    error?.code !== "ENOENT")
+                    throw error;
+            }
+            return read("/var/lib/dbus/machine-id");
+        }
+        if (kind === "smbios-uuid")
+            return read("/sys/class/dmi/id/product_uuid");
+        for (const file of ["/usr/bin/findmnt", "/bin/findmnt"]) {
+            try {
+                return await execute(file, ["--noheadings", "--raw", "--output", "UUID", "--target", "/"]);
+            }
+            catch (error) {
+                if (!(error instanceof DeviceSignalQueryError && error.status === "unavailable") &&
+                    error?.code !== "ENOENT")
+                    throw error;
+            }
+        }
+        throw new DeviceSignalQueryError("unavailable");
+    };
+    return createSignalProvider("linux", ["linux-machine-id", "smbios-uuid", "root-volume-uuid"], { ...options, query }, query);
+}
+//# sourceMappingURL=linux.js.map

package/dist/linux.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"linux.js","sourceRoot":"","sources":["../src/linux.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,OAAO,EACL,oBAAoB,EACpB,sBAAsB,EACtB,YAAY,EACZ,cAAc,GACf,MAAM,0BAA0B,CAAC;AASlC,MAAM,UAAU,gCAAgC,CAC9C,OAAO,GAA8B,EAAE;IAEvC,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,IAAI,cAAc,EAC7C,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,YAAY,CAAC;IAC5C,MAAM,KAAK,GAAG,KAAK,EAAE,IAAsB,EAAmB,EAAE;QAC9D,IAAI,IAAI,KAAK,kBAAkB,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBAC5C,IAAI,KAAK,CAAC,IAAI,EAAE;oBAAE,OAAO,KAAK,CAAC;YACjC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IACE,CAAC,CAAC,KAAK,YAAY,sBAAsB,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,CAAC;oBAC3E,KAA2B,EAAE,IAAI,KAAK,QAAQ;oBAE/C,MAAM,KAAK,CAAC;YAChB,CAAC;YACD,OAAO,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC1C,CAAC;QACD,IAAI,IAAI,KAAK,aAAa;YAAE,OAAO,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC1E,KAAK,MAAM,IAAI,IAAI,CAAC,kBAAkB,EAAE,cAAc,CAAC,EAAE,CAAC;YACxD,IAAI,CAAC;gBACH,OAAO,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,cAAc,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;YAC7F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IACE,CAAC,CAAC,KAAK,YAAY,sBAAsB,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,CAAC;oBAC3E,KAA2B,EAAE,IAAI,KAAK,QAAQ;oBAE/C,MAAM,KAAK,CAAC;YAChB,CAAC;QACH,CAAC;QACD,MAAM,IAAI,sBAAsB,CAAC,aAAa,CAAC,CAAC;IAClD,CAAC,CAAC;IACF,OAAO,oBAAoB,CACzB,OAAO,EACP,CAAC,kBAAkB,EAAE,aAAa,EAAE,kBAAkB,CAAC,EACvD,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,EACrB,KAAK,CACN,CAAC;AACJ,CAAC"}

package/dist/macos.d.ts

@@ -0,0 +1,7 @@
+import type { DeviceSignalsProvider } from "./types.js";
+export interface MacOSDeviceSignalsOptions {
+    platform?: string;
+    /** Test seam. Raw utility output stays local and is never returned in reports. */
+    execute?: (file: string, args: readonly string[]) => Promise<string>;
+}
+export declare function createMacOSDeviceSignalsProvider(options?: MacOSDeviceSignalsOptions): DeviceSignalsProvider;

package/dist/macos.js

@@ -0,0 +1,27 @@
+/** Optional Node-only macOS adapter; fixed read-only Apple system utilities. */
+import { createSignalProvider, executeQuery } from "./device-signals-node.js";
+export function createMacOSDeviceSignalsProvider(options = {}) {
+    const execute = options.execute ?? ((file, args) => executeQuery(file, args, 65536));
+    return createSignalProvider("darwin", ["macos-platform-uuid", "root-volume-uuid"], options, async (kind) => {
+        if (kind === "macos-platform-uuid") {
+            const value = await execute("/usr/sbin/ioreg", [
+                "-r",
+                "-d",
+                "1",
+                "-c",
+                "IOPlatformExpertDevice",
+                "-w",
+                "0",
+            ]);
+            if (Buffer.byteLength(value, "utf8") > 65536)
+                throw new Error("query_failed");
+            return /"IOPlatformUUID"\s*=\s*"([^"\r\n]{0,256})"/.exec(value)?.[1] ?? "";
+        }
+        const value = await execute("/usr/sbin/diskutil", ["info", "-plist", "/"]);
+        if (Buffer.byteLength(value, "utf8") > 65536)
+            throw new Error("query_failed");
+        // Read one known plist scalar, not arbitrary XML/entities or snapshot identifiers.
+        return /<key>VolumeUUID<\/key>\s*<string>([^<\r\n]{0,256})<\/string>/.exec(value)?.[1] ?? "";
+    });
+}
+//# sourceMappingURL=macos.js.map

package/dist/macos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"macos.js","sourceRoot":"","sources":["../src/macos.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAQ9E,MAAM,UAAU,gCAAgC,CAC9C,OAAO,GAA8B,EAAE;IAEvC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACrF,OAAO,oBAAoB,CACzB,QAAQ,EACR,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,EAC3C,OAAO,EACP,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,IAAI,IAAI,KAAK,qBAAqB,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,iBAAiB,EAAE;gBAC7C,IAAI;gBACJ,IAAI;gBACJ,GAAG;gBACH,IAAI;gBACJ,wBAAwB;gBACxB,IAAI;gBACJ,GAAG;aACJ,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;YAC9E,OAAO,4CAA4C,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7E,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QAC3E,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;QAC9E,mFAAmF;QACnF,OAAO,8DAA8D,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/F,CAAC,CACF,CAAC;AACJ,CAAC"}

package/dist/tokens.d.ts

@@ -0,0 +1,63 @@
+import { z } from "zod";
+export declare const licenseSchema: z.ZodObject<{
+    iss: z.ZodLiteral<"default">;
+    productId: z.ZodString;
+    kid: z.ZodString;
+    installationId: z.ZodString;
+    issuedAt: z.ZodString;
+    expiresAt: z.ZodNullable<z.ZodString>;
+    v: z.ZodLiteral<4>;
+    kind: z.ZodLiteral<"license">;
+    licenseId: z.ZodString;
+    plan: z.ZodString;
+    entitlements: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodNumber, z.ZodString, z.ZodBoolean]>>;
+    issuedTo: z.ZodString;
+    subject: z.ZodObject<{
+        kind: z.ZodEnum<{
+            installation: "installation";
+            service: "service";
+        }>;
+        id: z.ZodString;
+    }, z.core.$strict>;
+    offlineGraceUntil: z.ZodString;
+    status: z.ZodEnum<{
+        active: "active";
+        expired: "expired";
+        revoked: "revoked";
+    }>;
+}, z.core.$strict>;
+export declare const trialSchema: z.ZodObject<{
+    iss: z.ZodLiteral<"default">;
+    productId: z.ZodString;
+    kid: z.ZodString;
+    installationId: z.ZodString;
+    issuedAt: z.ZodString;
+    expiresAt: z.ZodNullable<z.ZodString>;
+    v: z.ZodLiteral<2>;
+    kind: z.ZodLiteral<"trial">;
+    verdict: z.ZodEnum<{
+        fresh: "fresh";
+        spent: "spent";
+    }>;
+    allowance: z.ZodNullable<z.ZodNumber>;
+    supportReference: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type LicenseToken = z.infer<typeof licenseSchema>;
+export type TrialToken = z.infer<typeof trialSchema>;
+export type SignedToken = LicenseToken | TrialToken;
+export declare class TokenError extends Error {
+    readonly code: string;
+    constructor(code: string);
+}
+export interface VerificationContext {
+    productId: string;
+    installationId: string;
+    publicKeys: Readonly<Record<string, string>>;
+    subjectKind?: "installation" | "service";
+    now?: number;
+    clockToleranceMs?: number;
+}
+export declare function encodeBase64url(bytes: Uint8Array): string;
+/** Authenticates a token, including its context. Expiry/status are evaluated separately
+ * so signed negative grants can replace a previously active cached grant. */
+export declare function verifySignedToken(token: string, context: VerificationContext): Promise<SignedToken>;

package/dist/tokens.js

@@ -0,0 +1,113 @@
+import { z } from "zod";
+const id = z.string().min(1).max(200);
+const date = z.string().datetime({ offset: true });
+const common = {
+    iss: z.literal("default"),
+    productId: id,
+    kid: id,
+    installationId: id,
+    issuedAt: date,
+    expiresAt: date.nullable(),
+};
+export const licenseSchema = z
+    .object({
+    ...common,
+    v: z.literal(4),
+    kind: z.literal("license"),
+    licenseId: id,
+    plan: id,
+    entitlements: z.record(z.string().min(1).max(64), z.union([z.number().finite(), z.string(), z.boolean()])),
+    issuedTo: z.string(),
+    subject: z.object({ kind: z.enum(["installation", "service"]), id }).strict(),
+    offlineGraceUntil: date,
+    status: z.enum(["active", "revoked", "expired"]),
+})
+    .strict()
+    .refine((p) => p.subject.id === p.installationId);
+export const trialSchema = z
+    .object({
+    ...common,
+    v: z.literal(2),
+    kind: z.literal("trial"),
+    verdict: z.enum(["fresh", "spent"]),
+    allowance: z.number().int().nonnegative().nullable(),
+    supportReference: z.string().nullable(),
+})
+    .strict();
+export class TokenError extends Error {
+    code;
+    constructor(code) {
+        super(`KeyForge token rejected (${code}).`);
+        this.code = code;
+        this.name = "TokenError";
+    }
+}
+export function encodeBase64url(bytes) {
+    return btoa(Array.from(bytes, (n) => String.fromCharCode(n)).join(""))
+        .replace(/=/g, "")
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_");
+}
+function decodeBase64url(encoded) {
+    if (!/^[A-Za-z0-9_-]+$/.test(encoded))
+        throw new TokenError("malformed_token");
+    let bytes;
+    try {
+        bytes = Uint8Array.from(atob(encoded.replace(/-/g, "+").replace(/_/g, "/")), (c) => c.charCodeAt(0));
+    }
+    catch {
+        throw new TokenError("malformed_token");
+    }
+    if (encodeBase64url(bytes) !== encoded)
+        throw new TokenError("malformed_token");
+    return bytes;
+}
+/** Authenticates a token, including its context. Expiry/status are evaluated separately
+ * so signed negative grants can replace a previously active cached grant. */
+export async function verifySignedToken(token, context) {
+    if (typeof token !== "string" || token.length > 65536)
+        throw new TokenError("malformed_token");
+    const parts = token.split(".");
+    if (parts.length !== 2)
+        throw new TokenError("malformed_token");
+    const bytes = decodeBase64url(parts[0]), signature = decodeBase64url(parts[1]);
+    if (signature.length !== 64)
+        throw new TokenError("malformed_token");
+    let input;
+    try {
+        input = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    }
+    catch {
+        throw new TokenError("malformed_token");
+    }
+    const parsed = z.union([licenseSchema, trialSchema]).safeParse(input);
+    if (!parsed.success)
+        throw new TokenError("invalid_payload");
+    const p = parsed.data;
+    if (p.productId !== context.productId ||
+        p.installationId !== context.installationId ||
+        (p.kind === "license" && p.subject.kind !== (context.subjectKind ?? "installation")))
+        throw new TokenError("context_mismatch");
+    const pem = Object.hasOwn(context.publicKeys, p.kid) ? context.publicKeys[p.kid] : undefined;
+    if (!pem)
+        throw new TokenError("unknown_key");
+    try {
+        if (!/^-----BEGIN PUBLIC KEY-----\s+[A-Za-z0-9+/=\s]+-----END PUBLIC KEY-----\s*$/.test(pem))
+            throw new Error("Invalid public key");
+        const der = Uint8Array.from(atob(pem.replace(/-----[^-]+-----/g, "").replace(/\s/g, "")), (c) => c.charCodeAt(0));
+        const key = await crypto.subtle.importKey("spki", der, { name: "Ed25519" }, false, ["verify"]);
+        // Current v4/v2 server contract signs decoded JSON bytes, not the base64url segment.
+        if (!(await crypto.subtle.verify("Ed25519", key, signature, bytes)))
+            throw new Error("Invalid signature");
+    }
+    catch {
+        throw new TokenError("invalid_signature");
+    }
+    const now = context.now ?? Date.now(), tolerance = context.clockToleranceMs ?? 300000;
+    if (!Number.isFinite(now) || !Number.isFinite(tolerance) || tolerance < 0)
+        throw new TokenError("invalid_clock");
+    if (Date.parse(p.issuedAt) > now + tolerance)
+        throw new TokenError("future_issuance");
+    return p;
+}
+//# sourceMappingURL=tokens.js.map

package/dist/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACtC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;AACnD,MAAM,MAAM,GAAG;IACb,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACzB,SAAS,EAAE,EAAE;IACb,GAAG,EAAE,EAAE;IACP,cAAc,EAAE,EAAE;IAClB,QAAQ,EAAE,IAAI;IACd,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE;CAC3B,CAAC;AACF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,GAAG,MAAM;IACT,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACf,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IAC1B,SAAS,EAAE,EAAE;IACb,IAAI,EAAE,EAAE;IACR,YAAY,EAAE,CAAC,CAAC,MAAM,CACpB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,EACzB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CACxD;IACD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7E,iBAAiB,EAAE,IAAI;IACvB,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;CACjD,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC,cAAc,CAAC,CAAC;AACpD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC;KACzB,MAAM,CAAC;IACN,GAAG,MAAM;IACT,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACf,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IACxB,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE;IACpD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,MAAM,EAAE,CAAC;AAKZ,MAAM,OAAO,UAAW,SAAQ,KAAK;IACP,IAAI;IAAhC,YAA4B,IAAY;QACtC,KAAK,CAAC,4BAA4B,IAAI,IAAI,CAAC,CAAC;oBADlB,IAAI;QAE9B,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AASD,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;SACnE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;SACjB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACzB,CAAC;AACD,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC/E,IAAI,KAA8B,CAAC;IACnC,IAAI,CAAC;QACH,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CACjF,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAChB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,eAAe,CAAC,KAAK,CAAC,KAAK,OAAO;QAAE,MAAM,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAChF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;6EAC6E;AAC7E,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAa,EACb,OAA4B;IAE5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK;QAAE,MAAM,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAChE,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EACrC,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC;IACrE,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC7D,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC;IACtB,IACE,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;QACjC,CAAC,CAAC,cAAc,KAAK,OAAO,CAAC,cAAc;QAC3C,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,IAAI,cAAc,CAAC,CAAC;QAEpF,MAAM,IAAI,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7F,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,UAAU,CAAC,aAAa,CAAC,CAAC;IAC9C,IAAI,CAAC;QACH,IAAI,CAAC,6EAA6E,CAAC,IAAI,CAAC,GAAG,CAAC;YAC1F,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAC9F,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAChB,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC/F,qFAAqF;QACrF,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EACnC,SAAS,GAAG,OAAO,CAAC,gBAAgB,IAAI,MAAM,CAAC;IACjD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC;QACvE,MAAM,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC;IACxC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,GAAG,GAAG,SAAS;QAAE,MAAM,IAAI,UAAU,CAAC,iBAAiB,CAAC,CAAC;IACtF,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,136 @@
+import type { LicenseToken, TrialToken } from "./tokens.js";
+export declare const DEVICE_SIGNAL_KINDS: readonly ["machine-guid", "smbios-uuid", "volume-serial", "linux-machine-id", "macos-platform-uuid", "root-volume-uuid"];
+export type DeviceSignalKind = (typeof DEVICE_SIGNAL_KINDS)[number];
+export interface DeviceSignal {
+    kind: DeviceSignalKind;
+    hash: string;
+}
+export interface DeviceSignalsReport {
+    signals: DeviceSignal[];
+    diagnostics: {
+        kind: DeviceSignalKind;
+        status: "available" | "unavailable" | "invalid" | "timeout" | "permission_denied" | "unsupported" | "query_failed";
+    }[];
+}
+export type DeviceSignalsProvider = (context: {
+    serverUrl: string;
+    productId: string;
+}) => Promise<DeviceSignalsReport>;
+export interface RegistrationMetadata {
+    appVersion?: string;
+    platform?: string;
+    userName?: string;
+    userEmail?: string;
+    machineSignals?: DeviceSignal[];
+}
+export interface ClientState {
+    version: 1;
+    serverUrl: string;
+    productId: string;
+    subjectKind: "installation" | "service";
+    installationId: string;
+    credential: string;
+    registration: RegistrationMetadata & {
+        installationId: string;
+        requestId: string;
+    };
+    registered: boolean;
+    trialStarted: boolean;
+    trialConsumed: number;
+    trialToken: string | null;
+    licenseToken: string | null;
+    denial: string | null;
+    lastObservedTime: number;
+    deviceSignals?: DeviceSignalsReport;
+}
+/** One owner per installation. load returns a snapshot; save atomically replaces it.
+ * Production implementations must protect credentials using platform secure storage. */
+export interface SecureStorage {
+    load(): Promise<ClientState | null>;
+    save(state: ClientState): Promise<void>;
+}
+export type Authorization = {
+    state: "unlicensed";
+    reason: string;
+} | {
+    state: "trial";
+    token: TrialToken;
+    remaining: number | null;
+} | {
+    state: "licensed";
+    token: LicenseToken;
+    entitlements: LicenseToken["entitlements"];
+    deadline: string;
+} | {
+    state: "reconnect_required" | "expired" | "revoked";
+    reason: string;
+};
+export interface NotificationPreferences {
+    messages: boolean;
+    expirations: boolean;
+}
+export type CustomerNotification = {
+    id: string;
+    title: string;
+    date: string;
+    read: boolean;
+} & ({
+    kind: "reply";
+    ticketId: string;
+} | {
+    kind: "expiration";
+    licenseId: string;
+} | {
+    kind: "license";
+    licenseId: string;
+    deliveryStatus: "available" | "retrieved" | "failed" | "manual";
+    collectPath: string;
+});
+export interface CustomerThread {
+    id: string;
+    revision: number;
+    licenseId: string;
+    installationId: string;
+    clientRequestId: string;
+    category: SupportRequest["category"];
+    urgency: SupportRequest["urgency"];
+    subject: string;
+    message: string;
+    status: "queued" | "in_progress" | "waiting_customer" | "resolved" | "closed";
+    receivedAt: string;
+    updatedAt: string;
+    messages: {
+        id: string;
+        author: "customer" | "support";
+        internal: false;
+        body: string;
+        createdAt: string;
+    }[];
+}
+export interface SupportRequest {
+    requestId: string;
+    licenseId: string;
+    category: "technical" | "licensing" | "billing" | "feature_request" | "other";
+    urgency: "low" | "normal" | "high" | "critical";
+    subject: string;
+    message: string;
+    createdAt: string;
+    reporter?: {
+        name?: string;
+    };
+    app?: {
+        version?: string;
+        platform?: string;
+    };
+}
+export interface ValidationResult {
+    valid: true;
+    id: string;
+    plan: string;
+    issuedTo: string;
+    expiresAt: string | null;
+    entitlements: Record<string, string | number | boolean>;
+    seatsInUse: number;
+    seatsAvailable: number;
+    serverTime: string;
+}

package/dist/types.js

@@ -0,0 +1,9 @@
+export const DEVICE_SIGNAL_KINDS = [
+    "machine-guid",
+    "smbios-uuid",
+    "volume-serial",
+    "linux-machine-id",
+    "macos-platform-uuid",
+    "root-volume-uuid",
+];
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,cAAc;IACd,aAAa;IACb,eAAe;IACf,kBAAkB;IAClB,qBAAqB;IACrB,kBAAkB;CACV,CAAC"}

package/dist/windows.d.ts

@@ -0,0 +1,8 @@
+import type { DeviceSignalKind, DeviceSignalsProvider } from "./types.js";
+export { DeviceSignalQueryError as WindowsQueryError, hashDeviceIdentifier as hashWindowsIdentifier, normalizeDeviceIdentifier as normalizeWindowsIdentifier, } from "./device-signals-node.js";
+export interface WindowsDeviceSignalsOptions {
+    /** Test seam: return one identifier, never command output or errors containing it. */
+    query?: (kind: DeviceSignalKind) => Promise<string>;
+    platform?: string;
+}
+export declare function createWindowsDeviceSignalsProvider(options?: WindowsDeviceSignalsOptions): DeviceSignalsProvider;