sublimekeys 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Sublimearts.io
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,111 @@
+# sublimekeys
+
+Official Node.js/Electron SDK for [SublimeKeys](https://keys.sublimearts.io) —
+license key activation, verification and trials for indie desktop apps, with
+**offline-capable verification**: once a license is activated, your app can
+verify it locally in milliseconds with no network call, for up to 7 days at a
+time, before quietly re-syncing online.
+
+Zero runtime dependencies — Ed25519 verification uses Node's built-in
+`node:crypto`, so there's nothing to native-compile and nothing for a bundler
+or `asar` packaging step to trip over.
+
+```bash
+npm install sublimekeys
+```
+
+Requires Node.js 20+ (any current Electron release ships a much newer Node
+than that).
+
+## Quickstart
+
+This mirrors the lifecycle described in the [SublimeKeys docs](https://keys.sublimearts.io/docs):
+first run activates, every later run verifies (offline-first), uninstall
+deactivates.
+
+```ts
+import { SublimeKeysClient } from "sublimekeys";
+
+const client = new SublimeKeysClient("my-app");
+
+// First run — ask the user for their key once.
+const activated = await client.activate(userEnteredKey);
+if (activated.valid) unlockFullVersion();
+
+// Every later launch — offline-first, instant, falls back online
+// automatically once the cached lease's 7-day trust window lapses.
+const result = await client.verify(savedKey);
+if (result.valid) unlockFullVersion();
+console.log(result.source); // "offline_cache" most days, "online" roughly weekly
+
+// Uninstall / sign out.
+await client.deactivate(savedKey);
+```
+
+`client.getMachineId()` gives you a stable, locally-persisted identifier if
+you need to store it yourself — every method above also generates and caches
+one automatically the first time it's needed, so passing it explicitly is
+optional.
+
+## Trials
+
+```ts
+const trial = await client.startTrial(); // get-or-create a 7-day trial; idempotent —
+                                          // reinstalling never resets the clock
+if (trial.status === "active") console.log(`${trial.daysLeft} days left`);
+
+const status = await client.trialStatus(); // read-only check, never starts one
+```
+
+## How offline verification works
+
+When `activate()` or `verify()` succeeds, the server returns a lease — a small
+Ed25519-signed token proving "this license is valid for this machine, as of
+now." The SDK caches it locally and, on every later `verify()` call, checks
+the signature against a **pinned public key built into this package** — no
+network call, no dependency on the server being reachable.
+
+The lease itself expires after 7 days (server-controlled). Once it does, the
+next `verify()` call transparently goes online, gets a fresh lease, and the
+cycle repeats. This means a revoked or expired license can take up to 7 days
+to be caught while a machine stays fully offline — an intentional tradeoff for
+instant, network-independent checks the rest of the time, not a bug.
+
+## API
+
+| Method | What it does |
+|---|---|
+| `activate(licenseKey, machineId?)` | First run. Always online. |
+| `verify(licenseKey, machineId?, { allowOffline? })` | Every later run. Offline-first by default. |
+| `deactivate(licenseKey, machineId?)` | Uninstall/sign-out. Frees the seat, clears the local cache. |
+| `startTrial(machineId?)` | Get-or-create a trial. |
+| `trialStatus(machineId?)` | Read-only trial check. |
+| `getMachineId()` | Stable per-install identifier (auto-generated, persisted locally). |
+
+All methods return a plain object (`LicenseResult` or `TrialResult`) — they
+never throw for a normal "not valid" outcome. Network failures are caught
+internally too; `verify()` falls back to the offline cache or a
+`{ valid: false, source: "offline_cache_miss" }` result rather than throwing.
+
+## Using this in an Electron app
+
+This SDK is Node-only (it uses `node:crypto` and `node:fs`), so it needs to
+run in Electron's **main process**, not directly in a renderer with
+`contextIsolation` on (the recommended, secure default). Two common patterns:
+
+- Call `SublimeKeysClient` methods in `main.ts`/`main.js` and expose the
+  results to the renderer over IPC (`ipcMain.handle` / `contextBridge`).
+- Or run it from a preload script if you've deliberately scoped Node access
+  there.
+
+See `examples/electron/` for a minimal main-process integration, including
+the IPC wiring.
+
+Because verification uses only built-in Node APIs (no native addon, no
+prebuilt binary per-platform), there's nothing extra to configure in
+`electron-builder`/`electron-forge`'s `asar` packaging or native-rebuild step
+— the whole SDK is plain JS/TS.
+
+## License
+
+MIT

package/dist/index.cjs

@@ -0,0 +1,384 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  LeaseError: () => LeaseError,
+  NetworkError: () => NetworkError,
+  PUBLIC_KEY_B64U: () => PUBLIC_KEY_B64U,
+  SublimeKeysClient: () => SublimeKeysClient,
+  SublimeKeysError: () => SublimeKeysError,
+  getOrCreateMachineId: () => getOrCreateMachineId,
+  verifyLease: () => verifyLease
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/pubkey.ts
+var PUBLIC_KEY_B64U = "OEK14M1tAFMPuh0RkgdV3Xvgpb0igCfzbct527xoAzE";
+
+// src/errors.ts
+var SublimeKeysError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SublimeKeysError";
+  }
+};
+var NetworkError = class extends SublimeKeysError {
+  constructor(message) {
+    super(message);
+    this.name = "NetworkError";
+  }
+};
+var LeaseError = class extends SublimeKeysError {
+  constructor(message) {
+    super(message);
+    this.name = "LeaseError";
+  }
+};
+
+// src/http.ts
+var DEFAULT_BASE_URL = "https://api.sublimearts.io";
+var HttpClient = class {
+  baseUrl;
+  timeoutMs;
+  constructor(baseUrl = DEFAULT_BASE_URL, timeoutMs = 1e4) {
+    this.baseUrl = baseUrl.replace(/\/+$/, "");
+    this.timeoutMs = timeoutMs;
+  }
+  async postJson(path, body) {
+    return this.request("POST", path, body);
+  }
+  async getJson(path) {
+    return this.request("GET", path, void 0);
+  }
+  async request(method, path, body) {
+    const url = `${this.baseUrl}${path}`;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    let res;
+    try {
+      res = await fetch(url, {
+        method,
+        headers: body !== void 0 ? { "Content-Type": "application/json" } : void 0,
+        body: body !== void 0 ? JSON.stringify(body) : void 0,
+        signal: controller.signal
+      });
+    } catch (err) {
+      const reason = err instanceof Error ? err.message : String(err);
+      throw new NetworkError(reason);
+    } finally {
+      clearTimeout(timer);
+    }
+    if (!res.ok) {
+      let message = `${res.status} ${res.statusText}`;
+      try {
+        const payload = await res.json();
+        if (payload?.detail) message = payload.detail;
+      } catch {
+      }
+      return { valid: false, message, email: null, expires_at: null, lease: null };
+    }
+    return await res.json();
+  }
+};
+
+// src/lease.ts
+var import_node_crypto = require("crypto");
+function loadEd25519PublicKey(rawBytes) {
+  return (0, import_node_crypto.createPublicKey)({
+    key: { kty: "OKP", crv: "Ed25519", x: rawBytes.toString("base64url") },
+    format: "jwk"
+  });
+}
+function verifyLease(token, publicKeyBytes, opts) {
+  const parts = token.split(".");
+  if (parts.length !== 2) {
+    throw new LeaseError("malformed lease token: expected exactly one '.' separator");
+  }
+  const [payloadB64, sigB64] = parts;
+  let payloadBytes;
+  let sigBytes;
+  try {
+    payloadBytes = Buffer.from(payloadB64, "base64url");
+    sigBytes = Buffer.from(sigB64, "base64url");
+  } catch (err) {
+    throw new LeaseError(`malformed lease token: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const publicKey = loadEd25519PublicKey(publicKeyBytes);
+  let signatureValid;
+  try {
+    signatureValid = (0, import_node_crypto.verify)(null, payloadBytes, publicKey, sigBytes);
+  } catch {
+    signatureValid = false;
+  }
+  if (!signatureValid) {
+    throw new LeaseError("invalid lease signature");
+  }
+  let payload;
+  try {
+    payload = JSON.parse(payloadBytes.toString("utf-8"));
+  } catch (err) {
+    throw new LeaseError(`malformed lease payload: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  if (payload.license_key !== opts.expectedLicenseKey) {
+    throw new LeaseError("lease license_key does not match");
+  }
+  if (payload.machine_id !== opts.expectedMachineId) {
+    throw new LeaseError("lease machine_id does not match");
+  }
+  if (payload.product_id !== opts.expectedProductId) {
+    throw new LeaseError("lease product_id does not match");
+  }
+  const now = opts.now ?? /* @__PURE__ */ new Date();
+  if (!payload.lease_expires_at || now >= new Date(payload.lease_expires_at)) {
+    throw new LeaseError("lease trust window has lapsed");
+  }
+  if (payload.license_expires_at && now >= new Date(payload.license_expires_at)) {
+    throw new LeaseError("license has expired");
+  }
+  return payload;
+}
+
+// src/machine.ts
+var import_node_crypto3 = require("crypto");
+var import_node_fs2 = require("fs");
+var import_node_path2 = require("path");
+
+// src/storage.ts
+var import_node_crypto2 = require("crypto");
+var import_node_fs = require("fs");
+var import_node_os = require("os");
+var import_node_path = require("path");
+function defaultCacheDir(productId) {
+  return (0, import_node_path.join)((0, import_node_os.homedir)(), ".sublimekeys", productId);
+}
+function leasePath(productId, base) {
+  return (0, import_node_path.join)(base ?? defaultCacheDir(productId), "lease.json");
+}
+function loadLease(productId, base) {
+  const path = leasePath(productId, base);
+  if (!(0, import_node_fs.existsSync)(path)) return null;
+  try {
+    return JSON.parse((0, import_node_fs.readFileSync)(path, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function saveLease(productId, licenseKey, token, base) {
+  const path = leasePath(productId, base);
+  (0, import_node_fs.mkdirSync)((0, import_node_path.join)(path, ".."), { recursive: true });
+  const data = JSON.stringify({ license_key: licenseKey, token });
+  const tmpPath = (0, import_node_path.join)(path, "..", `.lease-${(0, import_node_crypto2.randomBytes)(6).toString("hex")}.tmp`);
+  try {
+    (0, import_node_fs.writeFileSync)(tmpPath, data, "utf-8");
+    (0, import_node_fs.renameSync)(tmpPath, path);
+  } catch (err) {
+    try {
+      (0, import_node_fs.unlinkSync)(tmpPath);
+    } catch {
+    }
+    throw err;
+  }
+  try {
+    (0, import_node_fs.chmodSync)(path, 384);
+  } catch {
+  }
+}
+function clearLease(productId, base) {
+  const path = leasePath(productId, base);
+  try {
+    (0, import_node_fs.unlinkSync)(path);
+  } catch {
+  }
+}
+
+// src/machine.ts
+function getOrCreateMachineId(productId, base) {
+  const dir = base ?? defaultCacheDir(productId);
+  const path = (0, import_node_path2.join)(dir, "machine_id");
+  if ((0, import_node_fs2.existsSync)(path)) {
+    const existing = (0, import_node_fs2.readFileSync)(path, "utf-8").trim();
+    if (existing) return existing;
+  }
+  const machineId = (0, import_node_crypto3.randomUUID)();
+  (0, import_node_fs2.mkdirSync)(dir, { recursive: true });
+  (0, import_node_fs2.writeFileSync)(path, machineId, "utf-8");
+  return machineId;
+}
+
+// src/client.ts
+var SublimeKeysClient = class {
+  productId;
+  http;
+  cacheBase;
+  publicKeyBytes;
+  constructor(productId, options = {}) {
+    this.productId = productId;
+    this.http = new HttpClient(options.baseUrl ?? DEFAULT_BASE_URL, options.timeoutMs ?? 1e4);
+    this.cacheBase = options.cacheDir;
+    this.publicKeyBytes = Buffer.from(options.publicKeyB64u ?? PUBLIC_KEY_B64U, "base64url");
+  }
+  /** A stable, locally-persisted machine identifier — generated once on
+   * first call, reused after that. */
+  getMachineId() {
+    return getOrCreateMachineId(this.productId, this.cacheBase);
+  }
+  /** First run for this license on this machine. Always goes online —
+   * activation is inherently server-side state. Safe to call again on a
+   * machine that's already activated (the server treats it as a no-op
+   * that doesn't consume another activation slot). */
+  async activate(licenseKey, machineId) {
+    const resolvedMachineId = machineId ?? this.getMachineId();
+    let data;
+    try {
+      data = await this.http.postJson("/activate", {
+        license_key: licenseKey,
+        machine_id: resolvedMachineId,
+        product_id: this.productId
+      });
+    } catch (err) {
+      const reason = err instanceof NetworkError ? err.message : String(err);
+      return { valid: false, message: `Network error: ${reason}`, source: "online" };
+    }
+    const result = {
+      valid: data.valid,
+      message: data.message,
+      email: data.email ?? null,
+      expiresAt: data.expires_at ?? null,
+      source: "online"
+    };
+    if (result.valid && data.lease) {
+      saveLease(this.productId, licenseKey, data.lease, this.cacheBase);
+    }
+    return result;
+  }
+  /** Every launch after the first. Checks the local cached lease first
+   * (instant, no network) if allowOffline is true; falls back to an online
+   * /verify call when there's no usable cached lease. Refreshes the cache
+   * on every successful online check, and clears it on a revoked/invalid
+   * result so a stale cache never outlives the license it was issued for. */
+  async verify(licenseKey, machineId, options = {}) {
+    const resolvedMachineId = machineId ?? this.getMachineId();
+    const allowOffline = options.allowOffline ?? true;
+    if (allowOffline) {
+      const cached = loadLease(this.productId, this.cacheBase);
+      if (cached && cached.license_key === licenseKey) {
+        try {
+          const payload = verifyLease(cached.token, this.publicKeyBytes, {
+            expectedLicenseKey: licenseKey,
+            expectedMachineId: resolvedMachineId,
+            expectedProductId: this.productId,
+            now: options._now
+          });
+          return {
+            valid: true,
+            message: "Valid (offline)",
+            email: payload.email ?? null,
+            expiresAt: payload.license_expires_at ?? null,
+            source: "offline_cache"
+          };
+        } catch (err) {
+          if (!(err instanceof LeaseError)) throw err;
+        }
+      }
+    }
+    let data;
+    try {
+      data = await this.http.postJson("/verify", {
+        license_key: licenseKey,
+        machine_id: resolvedMachineId,
+        product_id: this.productId
+      });
+    } catch {
+      return { valid: false, message: "Offline and no valid cached lease", source: "offline_cache_miss" };
+    }
+    const result = {
+      valid: data.valid,
+      message: data.message,
+      email: data.email ?? null,
+      expiresAt: data.expires_at ?? null,
+      source: "online"
+    };
+    if (result.valid && data.lease) {
+      saveLease(this.productId, licenseKey, data.lease, this.cacheBase);
+    } else if (!result.valid) {
+      clearLease(this.productId, this.cacheBase);
+    }
+    return result;
+  }
+  /** User signs out / uninstalls. Clears the local cache immediately —
+   * otherwise a deliberately-deactivated license would keep
+   * offline-verifying as valid until its trust window lapsed. */
+  async deactivate(licenseKey, machineId) {
+    const resolvedMachineId = machineId ?? this.getMachineId();
+    let data;
+    try {
+      data = await this.http.postJson("/deactivate", {
+        license_key: licenseKey,
+        machine_id: resolvedMachineId,
+        product_id: this.productId
+      });
+    } catch (err) {
+      const reason = err instanceof NetworkError ? err.message : String(err);
+      return { valid: false, message: `Network error: ${reason}`, source: "online" };
+    }
+    clearLease(this.productId, this.cacheBase);
+    return { valid: data.valid, message: data.message, source: "online" };
+  }
+  /** Get-or-create a trial for this machine. Idempotent server-side —
+   * reinstalling never resets the clock. */
+  async startTrial(machineId) {
+    return this.trialCall("/trial/start", machineId);
+  }
+  /** Read-only trial check — never starts one. */
+  async trialStatus(machineId) {
+    return this.trialCall("/trial/status", machineId);
+  }
+  async trialCall(path, machineId) {
+    const resolvedMachineId = machineId ?? this.getMachineId();
+    let data;
+    try {
+      data = await this.http.postJson(path, {
+        machine_id: resolvedMachineId,
+        product_id: this.productId
+      });
+    } catch (err) {
+      const reason = err instanceof NetworkError ? err.message : String(err);
+      return { status: "none", daysLeft: 0, message: `Network error: ${reason}` };
+    }
+    return {
+      status: data.status,
+      daysLeft: data.days_left ?? 0,
+      expiresAt: data.expires_at ?? null,
+      message: data.message ?? ""
+    };
+  }
+};
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  LeaseError,
+  NetworkError,
+  PUBLIC_KEY_B64U,
+  SublimeKeysClient,
+  SublimeKeysError,
+  getOrCreateMachineId,
+  verifyLease
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/pubkey.ts","../src/errors.ts","../src/http.ts","../src/lease.ts","../src/machine.ts","../src/storage.ts","../src/client.ts"],"sourcesContent":["export { SublimeKeysClient } from \"./client.js\";\nexport type {\n  LicenseResult,\n  TrialResult,\n  LicenseSource,\n  SublimeKeysClientOptions,\n  VerifyOptions,\n} from \"./client.js\";\nexport { verifyLease } from \"./lease.js\";\nexport type { LeasePayload, VerifyLeaseOptions } from \"./lease.js\";\nexport { SublimeKeysError, NetworkError, LeaseError } from \"./errors.js\";\nexport { PUBLIC_KEY_B64U } from \"./pubkey.js\";\nexport { getOrCreateMachineId } from \"./machine.js\";\n","/** SublimeKeys production Ed25519 public key (base64url, 32 raw bytes).\n * Pinned here so the offline hot path never fetches /public-key at runtime. */\nexport const PUBLIC_KEY_B64U = \"OEK14M1tAFMPuh0RkgdV3Xvgpb0igCfzbct527xoAzE\";\n","export class SublimeKeysError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"SublimeKeysError\";\n  }\n}\n\n/** A request to the SublimeKeys API failed to complete (unreachable host, timeout, connection reset, ...). */\nexport class NetworkError extends SublimeKeysError {\n  constructor(message: string) {\n    super(message);\n    this.name = \"NetworkError\";\n  }\n}\n\n/** A cached offline lease failed verification — malformed, tampered, expired,\n * or scoped to a different license/machine/product. */\nexport class LeaseError extends SublimeKeysError {\n  constructor(message: string) {\n    super(message);\n    this.name = \"LeaseError\";\n  }\n}\n","// Thin fetch-based JSON client — zero HTTP dependencies, matching the\n// license server's own minimal-dependency style. This is also where the\n// server's one REST inconsistency gets papered over: /activate raises an\n// HTTP error (404/403, body {\"detail\": \"...\"}) while /verify always returns\n// HTTP 200 with valid:false. Callers of this module see one shape either way.\n\nimport { NetworkError } from \"./errors.js\";\n\nexport const DEFAULT_BASE_URL = \"https://api.sublimearts.io\";\n\nexport interface ApiResponse {\n  valid: boolean;\n  message: string;\n  email?: string | null;\n  expires_at?: string | null;\n  lease?: string | null;\n  [key: string]: unknown;\n}\n\nexport class HttpClient {\n  private baseUrl: string;\n  private timeoutMs: number;\n\n  constructor(baseUrl: string = DEFAULT_BASE_URL, timeoutMs = 10_000) {\n    this.baseUrl = baseUrl.replace(/\\/+$/, \"\");\n    this.timeoutMs = timeoutMs;\n  }\n\n  async postJson(path: string, body: Record<string, unknown>): Promise<ApiResponse> {\n    return this.request(\"POST\", path, body);\n  }\n\n  async getJson(path: string): Promise<ApiResponse> {\n    return this.request(\"GET\", path, undefined);\n  }\n\n  private async request(method: string, path: string, body: Record<string, unknown> | undefined): Promise<ApiResponse> {\n    const url = `${this.baseUrl}${path}`;\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.timeoutMs);\n\n    let res: Response;\n    try {\n      res = await fetch(url, {\n        method,\n        headers: body !== undefined ? { \"Content-Type\": \"application/json\" } : undefined,\n        body: body !== undefined ? JSON.stringify(body) : undefined,\n        signal: controller.signal,\n      });\n    } catch (err) {\n      const reason = err instanceof Error ? err.message : String(err);\n      throw new NetworkError(reason);\n    } finally {\n      clearTimeout(timer);\n    }\n\n    if (!res.ok) {\n      let message = `${res.status} ${res.statusText}`;\n      try {\n        const payload = (await res.json()) as { detail?: string };\n        if (payload?.detail) message = payload.detail;\n      } catch {\n        // non-JSON error body — keep the status line as the message\n      }\n      return { valid: false, message, email: null, expires_at: null, lease: null };\n    }\n\n    return (await res.json()) as ApiResponse;\n  }\n}\n","// Offline verification of SublimeKeys signed leases.\n//\n// A lease is a compact token: base64url(json_payload) + \".\" + base64url(signature),\n// signed with Ed25519 by the SublimeKeys license server. Verifying it locally\n// requires no network call, which is the entire point of this module.\n\nimport { createPublicKey, verify as cryptoVerify } from \"node:crypto\";\nimport { LeaseError } from \"./errors.js\";\n\nexport interface LeasePayload {\n  kid?: string;\n  license_key: string;\n  machine_id: string;\n  product_id: string;\n  email?: string | null;\n  issued_at?: string;\n  lease_expires_at: string;\n  license_expires_at?: string | null;\n  [key: string]: unknown;\n}\n\nexport interface VerifyLeaseOptions {\n  expectedLicenseKey: string;\n  expectedMachineId: string;\n  expectedProductId: string;\n  now?: Date;\n}\n\nfunction loadEd25519PublicKey(rawBytes: Buffer) {\n  return createPublicKey({\n    key: { kty: \"OKP\", crv: \"Ed25519\", x: rawBytes.toString(\"base64url\") },\n    format: \"jwk\",\n  });\n}\n\n/**\n * Verify a lease token and return its payload if valid.\n *\n * Throws LeaseError for any failure — malformed token, bad signature,\n * wrong license/machine/product, or an expired trust window/license.\n * A valid signature only proves \"SublimeKeys signed this,\" not \"this is\n * for the product/machine/license you expect\" — the three equality\n * checks below are not optional and cannot be skipped by a caller.\n */\nexport function verifyLease(token: string, publicKeyBytes: Buffer, opts: VerifyLeaseOptions): LeasePayload {\n  const parts = token.split(\".\");\n  if (parts.length !== 2) {\n    throw new LeaseError(\"malformed lease token: expected exactly one '.' separator\");\n  }\n  const [payloadB64, sigB64] = parts;\n\n  let payloadBytes: Buffer;\n  let sigBytes: Buffer;\n  try {\n    payloadBytes = Buffer.from(payloadB64, \"base64url\");\n    sigBytes = Buffer.from(sigB64, \"base64url\");\n  } catch (err) {\n    throw new LeaseError(`malformed lease token: ${err instanceof Error ? err.message : String(err)}`);\n  }\n\n  const publicKey = loadEd25519PublicKey(publicKeyBytes);\n\n  // Verify the signature BEFORE parsing the payload as JSON — never hand\n  // unauthenticated bytes to a parser first, even a safe one.\n  let signatureValid: boolean;\n  try {\n    signatureValid = cryptoVerify(null, payloadBytes, publicKey, sigBytes);\n  } catch {\n    signatureValid = false;\n  }\n  if (!signatureValid) {\n    throw new LeaseError(\"invalid lease signature\");\n  }\n\n  let payload: LeasePayload;\n  try {\n    payload = JSON.parse(payloadBytes.toString(\"utf-8\")) as LeasePayload;\n  } catch (err) {\n    throw new LeaseError(`malformed lease payload: ${err instanceof Error ? err.message : String(err)}`);\n  }\n\n  if (payload.license_key !== opts.expectedLicenseKey) {\n    throw new LeaseError(\"lease license_key does not match\");\n  }\n  if (payload.machine_id !== opts.expectedMachineId) {\n    throw new LeaseError(\"lease machine_id does not match\");\n  }\n  if (payload.product_id !== opts.expectedProductId) {\n    throw new LeaseError(\"lease product_id does not match\");\n  }\n\n  const now = opts.now ?? new Date();\n\n  if (!payload.lease_expires_at || now >= new Date(payload.lease_expires_at)) {\n    throw new LeaseError(\"lease trust window has lapsed\");\n  }\n\n  if (payload.license_expires_at && now >= new Date(payload.license_expires_at)) {\n    throw new LeaseError(\"license has expired\");\n  }\n\n  return payload;\n}\n","// A stable per-install machine identifier.\n//\n// Deliberately a persisted random UUID, not a hardware fingerprint. Real\n// hardware IDs (MAC addresses, disk serials, ...) are spoofable, change on\n// VMs/cloud desktops/Apple Silicon Rosetta in ways that generate false\n// mismatches and support tickets, and buy little real security over a\n// persisted UUID for this use case. Trivially resettable by deleting one\n// file — that's a known, accepted tradeoff (a soft deterrent, not DRM),\n// not an oversight.\n\nimport { randomUUID } from \"node:crypto\";\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { defaultCacheDir } from \"./storage.js\";\n\nexport function getOrCreateMachineId(productId: string, base?: string): string {\n  const dir = base ?? defaultCacheDir(productId);\n  const path = join(dir, \"machine_id\");\n\n  if (existsSync(path)) {\n    const existing = readFileSync(path, \"utf-8\").trim();\n    if (existing) return existing;\n  }\n\n  const machineId = randomUUID();\n  mkdirSync(dir, { recursive: true });\n  writeFileSync(path, machineId, \"utf-8\");\n  return machineId;\n}\n","// Local cache for signed leases — one JSON file per product, written\n// atomically (temp file + rename) so a crash mid-write never leaves a\n// half-written file behind.\n\nimport { randomBytes } from \"node:crypto\";\nimport { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync, chmodSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\n\nexport interface CachedLease {\n  license_key: string;\n  token: string;\n}\n\nexport function defaultCacheDir(productId: string): string {\n  return join(homedir(), \".sublimekeys\", productId);\n}\n\nfunction leasePath(productId: string, base?: string): string {\n  return join(base ?? defaultCacheDir(productId), \"lease.json\");\n}\n\nexport function loadLease(productId: string, base?: string): CachedLease | null {\n  const path = leasePath(productId, base);\n  if (!existsSync(path)) return null;\n  try {\n    return JSON.parse(readFileSync(path, \"utf-8\")) as CachedLease;\n  } catch {\n    return null;\n  }\n}\n\nexport function saveLease(productId: string, licenseKey: string, token: string, base?: string): void {\n  const path = leasePath(productId, base);\n  mkdirSync(join(path, \"..\"), { recursive: true });\n  const data = JSON.stringify({ license_key: licenseKey, token });\n\n  const tmpPath = join(path, \"..\", `.lease-${randomBytes(6).toString(\"hex\")}.tmp`);\n  try {\n    writeFileSync(tmpPath, data, \"utf-8\");\n    renameSync(tmpPath, path);\n  } catch (err) {\n    try {\n      unlinkSync(tmpPath);\n    } catch {\n      // best-effort cleanup\n    }\n    throw err;\n  }\n\n  try {\n    chmodSync(path, 0o600);\n  } catch {\n    // best-effort — no-op on native Windows ACLs, real on POSIX/WSL\n  }\n}\n\nexport function clearLease(productId: string, base?: string): void {\n  const path = leasePath(productId, base);\n  try {\n    unlinkSync(path);\n  } catch {\n    // already gone — fine\n  }\n}\n","// SublimeKeysClient — the main SDK entry point.\n//\n// Cache-first, not online-first-with-fallback: after one successful\n// activate()/verify(), subsequent verify() calls make zero network requests\n// for as long as the cached lease's trust window is valid (currently 7 days,\n// set server-side) — that's the actual point of offline leases. A network\n// call only happens again once the cache is missing, invalid, or its trust\n// window has lapsed.\n\nimport { PUBLIC_KEY_B64U } from \"./pubkey.js\";\nimport { NetworkError, LeaseError } from \"./errors.js\";\nimport { DEFAULT_BASE_URL, HttpClient } from \"./http.js\";\nimport { verifyLease } from \"./lease.js\";\nimport { getOrCreateMachineId } from \"./machine.js\";\nimport { loadLease, saveLease, clearLease } from \"./storage.js\";\n\nexport type LicenseSource = \"online\" | \"offline_cache\" | \"offline_cache_miss\";\n\nexport interface LicenseResult {\n  valid: boolean;\n  message: string;\n  email?: string | null;\n  expiresAt?: string | null;\n  source: LicenseSource;\n}\n\nexport interface TrialResult {\n  status: \"active\" | \"expired\" | \"none\";\n  daysLeft: number;\n  expiresAt?: string | null;\n  message: string;\n}\n\nexport interface SublimeKeysClientOptions {\n  baseUrl?: string;\n  cacheDir?: string;\n  publicKeyB64u?: string;\n  timeoutMs?: number;\n}\n\nexport interface VerifyOptions {\n  allowOffline?: boolean;\n  /** Internal test hook — overrides \"now\" when checking lease expiry. */\n  _now?: Date;\n}\n\nexport class SublimeKeysClient {\n  readonly productId: string;\n  private readonly http: HttpClient;\n  private readonly cacheBase?: string;\n  private readonly publicKeyBytes: Buffer;\n\n  constructor(productId: string, options: SublimeKeysClientOptions = {}) {\n    this.productId = productId;\n    this.http = new HttpClient(options.baseUrl ?? DEFAULT_BASE_URL, options.timeoutMs ?? 10_000);\n    this.cacheBase = options.cacheDir;\n    this.publicKeyBytes = Buffer.from(options.publicKeyB64u ?? PUBLIC_KEY_B64U, \"base64url\");\n  }\n\n  /** A stable, locally-persisted machine identifier — generated once on\n   * first call, reused after that. */\n  getMachineId(): string {\n    return getOrCreateMachineId(this.productId, this.cacheBase);\n  }\n\n  /** First run for this license on this machine. Always goes online —\n   * activation is inherently server-side state. Safe to call again on a\n   * machine that's already activated (the server treats it as a no-op\n   * that doesn't consume another activation slot). */\n  async activate(licenseKey: string, machineId?: string): Promise<LicenseResult> {\n    const resolvedMachineId = machineId ?? this.getMachineId();\n    let data;\n    try {\n      data = await this.http.postJson(\"/activate\", {\n        license_key: licenseKey,\n        machine_id: resolvedMachineId,\n        product_id: this.productId,\n      });\n    } catch (err) {\n      const reason = err instanceof NetworkError ? err.message : String(err);\n      return { valid: false, message: `Network error: ${reason}`, source: \"online\" };\n    }\n\n    const result: LicenseResult = {\n      valid: data.valid,\n      message: data.message,\n      email: data.email ?? null,\n      expiresAt: data.expires_at ?? null,\n      source: \"online\",\n    };\n    if (result.valid && data.lease) {\n      saveLease(this.productId, licenseKey, data.lease, this.cacheBase);\n    }\n    return result;\n  }\n\n  /** Every launch after the first. Checks the local cached lease first\n   * (instant, no network) if allowOffline is true; falls back to an online\n   * /verify call when there's no usable cached lease. Refreshes the cache\n   * on every successful online check, and clears it on a revoked/invalid\n   * result so a stale cache never outlives the license it was issued for. */\n  async verify(licenseKey: string, machineId?: string, options: VerifyOptions = {}): Promise<LicenseResult> {\n    const resolvedMachineId = machineId ?? this.getMachineId();\n    const allowOffline = options.allowOffline ?? true;\n\n    if (allowOffline) {\n      const cached = loadLease(this.productId, this.cacheBase);\n      if (cached && cached.license_key === licenseKey) {\n        try {\n          const payload = verifyLease(cached.token, this.publicKeyBytes, {\n            expectedLicenseKey: licenseKey,\n            expectedMachineId: resolvedMachineId,\n            expectedProductId: this.productId,\n            now: options._now,\n          });\n          return {\n            valid: true,\n            message: \"Valid (offline)\",\n            email: payload.email ?? null,\n            expiresAt: payload.license_expires_at ?? null,\n            source: \"offline_cache\",\n          };\n        } catch (err) {\n          if (!(err instanceof LeaseError)) throw err;\n          // cache unusable — fall through to an online check\n        }\n      }\n    }\n\n    let data;\n    try {\n      data = await this.http.postJson(\"/verify\", {\n        license_key: licenseKey,\n        machine_id: resolvedMachineId,\n        product_id: this.productId,\n      });\n    } catch {\n      return { valid: false, message: \"Offline and no valid cached lease\", source: \"offline_cache_miss\" };\n    }\n\n    const result: LicenseResult = {\n      valid: data.valid,\n      message: data.message,\n      email: data.email ?? null,\n      expiresAt: data.expires_at ?? null,\n      source: \"online\",\n    };\n    if (result.valid && data.lease) {\n      saveLease(this.productId, licenseKey, data.lease, this.cacheBase);\n    } else if (!result.valid) {\n      // Don't leave a stale cache behind — a license revoked server-side\n      // must not keep offline-verifying as valid for days afterward.\n      clearLease(this.productId, this.cacheBase);\n    }\n    return result;\n  }\n\n  /** User signs out / uninstalls. Clears the local cache immediately —\n   * otherwise a deliberately-deactivated license would keep\n   * offline-verifying as valid until its trust window lapsed. */\n  async deactivate(licenseKey: string, machineId?: string): Promise<LicenseResult> {\n    const resolvedMachineId = machineId ?? this.getMachineId();\n    let data;\n    try {\n      data = await this.http.postJson(\"/deactivate\", {\n        license_key: licenseKey,\n        machine_id: resolvedMachineId,\n        product_id: this.productId,\n      });\n    } catch (err) {\n      const reason = err instanceof NetworkError ? err.message : String(err);\n      return { valid: false, message: `Network error: ${reason}`, source: \"online\" };\n    }\n\n    clearLease(this.productId, this.cacheBase);\n    return { valid: data.valid, message: data.message, source: \"online\" };\n  }\n\n  /** Get-or-create a trial for this machine. Idempotent server-side —\n   * reinstalling never resets the clock. */\n  async startTrial(machineId?: string): Promise<TrialResult> {\n    return this.trialCall(\"/trial/start\", machineId);\n  }\n\n  /** Read-only trial check — never starts one. */\n  async trialStatus(machineId?: string): Promise<TrialResult> {\n    return this.trialCall(\"/trial/status\", machineId);\n  }\n\n  private async trialCall(path: string, machineId?: string): Promise<TrialResult> {\n    const resolvedMachineId = machineId ?? this.getMachineId();\n    let data;\n    try {\n      data = await this.http.postJson(path, {\n        machine_id: resolvedMachineId,\n        product_id: this.productId,\n      });\n    } catch (err) {\n      const reason = err instanceof NetworkError ? err.message : String(err);\n      return { status: \"none\", daysLeft: 0, message: `Network error: ${reason}` };\n    }\n    return {\n      status: data.status as TrialResult[\"status\"],\n      daysLeft: (data.days_left as number) ?? 0,\n      expiresAt: (data.expires_at as string) ?? null,\n      message: (data.message as string) ?? \"\",\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACEO,IAAM,kBAAkB;;;ACFxB,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAC1C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAGO,IAAM,eAAN,cAA2B,iBAAiB;AAAA,EACjD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAIO,IAAM,aAAN,cAAyB,iBAAiB;AAAA,EAC/C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;;;ACdO,IAAM,mBAAmB;AAWzB,IAAM,aAAN,MAAiB;AAAA,EACd;AAAA,EACA;AAAA,EAER,YAAY,UAAkB,kBAAkB,YAAY,KAAQ;AAClE,SAAK,UAAU,QAAQ,QAAQ,QAAQ,EAAE;AACzC,SAAK,YAAY;AAAA,EACnB;AAAA,EAEA,MAAM,SAAS,MAAc,MAAqD;AAChF,WAAO,KAAK,QAAQ,QAAQ,MAAM,IAAI;AAAA,EACxC;AAAA,EAEA,MAAM,QAAQ,MAAoC;AAChD,WAAO,KAAK,QAAQ,OAAO,MAAM,MAAS;AAAA,EAC5C;AAAA,EAEA,MAAc,QAAQ,QAAgB,MAAc,MAAiE;AACnH,UAAM,MAAM,GAAG,KAAK,OAAO,GAAG,IAAI;AAClC,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,KAAK,SAAS;AAEjE,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,MAAM,KAAK;AAAA,QACrB;AAAA,QACA,SAAS,SAAS,SAAY,EAAE,gBAAgB,mBAAmB,IAAI;AAAA,QACvE,MAAM,SAAS,SAAY,KAAK,UAAU,IAAI,IAAI;AAAA,QAClD,QAAQ,WAAW;AAAA,MACrB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC9D,YAAM,IAAI,aAAa,MAAM;AAAA,IAC/B,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAEA,QAAI,CAAC,IAAI,IAAI;AACX,UAAI,UAAU,GAAG,IAAI,MAAM,IAAI,IAAI,UAAU;AAC7C,UAAI;AACF,cAAM,UAAW,MAAM,IAAI,KAAK;AAChC,YAAI,SAAS,OAAQ,WAAU,QAAQ;AAAA,MACzC,QAAQ;AAAA,MAER;AACA,aAAO,EAAE,OAAO,OAAO,SAAS,OAAO,MAAM,YAAY,MAAM,OAAO,KAAK;AAAA,IAC7E;AAEA,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB;AACF;;;AC/DA,yBAAwD;AAsBxD,SAAS,qBAAqB,UAAkB;AAC9C,aAAO,oCAAgB;AAAA,IACrB,KAAK,EAAE,KAAK,OAAO,KAAK,WAAW,GAAG,SAAS,SAAS,WAAW,EAAE;AAAA,IACrE,QAAQ;AAAA,EACV,CAAC;AACH;AAWO,SAAS,YAAY,OAAe,gBAAwB,MAAwC;AACzG,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,WAAW,GAAG;AACtB,UAAM,IAAI,WAAW,2DAA2D;AAAA,EAClF;AACA,QAAM,CAAC,YAAY,MAAM,IAAI;AAE7B,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,mBAAe,OAAO,KAAK,YAAY,WAAW;AAClD,eAAW,OAAO,KAAK,QAAQ,WAAW;AAAA,EAC5C,SAAS,KAAK;AACZ,UAAM,IAAI,WAAW,0BAA0B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,EACnG;AAEA,QAAM,YAAY,qBAAqB,cAAc;AAIrD,MAAI;AACJ,MAAI;AACF,yBAAiB,mBAAAA,QAAa,MAAM,cAAc,WAAW,QAAQ;AAAA,EACvE,QAAQ;AACN,qBAAiB;AAAA,EACnB;AACA,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,WAAW,yBAAyB;AAAA,EAChD;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,aAAa,SAAS,OAAO,CAAC;AAAA,EACrD,SAAS,KAAK;AACZ,UAAM,IAAI,WAAW,4BAA4B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,EACrG;AAEA,MAAI,QAAQ,gBAAgB,KAAK,oBAAoB;AACnD,UAAM,IAAI,WAAW,kCAAkC;AAAA,EACzD;AACA,MAAI,QAAQ,eAAe,KAAK,mBAAmB;AACjD,UAAM,IAAI,WAAW,iCAAiC;AAAA,EACxD;AACA,MAAI,QAAQ,eAAe,KAAK,mBAAmB;AACjD,UAAM,IAAI,WAAW,iCAAiC;AAAA,EACxD;AAEA,QAAM,MAAM,KAAK,OAAO,oBAAI,KAAK;AAEjC,MAAI,CAAC,QAAQ,oBAAoB,OAAO,IAAI,KAAK,QAAQ,gBAAgB,GAAG;AAC1E,UAAM,IAAI,WAAW,+BAA+B;AAAA,EACtD;AAEA,MAAI,QAAQ,sBAAsB,OAAO,IAAI,KAAK,QAAQ,kBAAkB,GAAG;AAC7E,UAAM,IAAI,WAAW,qBAAqB;AAAA,EAC5C;AAEA,SAAO;AACT;;;AC5FA,IAAAC,sBAA2B;AAC3B,IAAAC,kBAAmE;AACnE,IAAAC,oBAAqB;;;ACRrB,IAAAC,sBAA4B;AAC5B,qBAAsG;AACtG,qBAAwB;AACxB,uBAAqB;AAOd,SAAS,gBAAgB,WAA2B;AACzD,aAAO,2BAAK,wBAAQ,GAAG,gBAAgB,SAAS;AAClD;AAEA,SAAS,UAAU,WAAmB,MAAuB;AAC3D,aAAO,uBAAK,QAAQ,gBAAgB,SAAS,GAAG,YAAY;AAC9D;AAEO,SAAS,UAAU,WAAmB,MAAmC;AAC9E,QAAM,OAAO,UAAU,WAAW,IAAI;AACtC,MAAI,KAAC,2BAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACF,WAAO,KAAK,UAAM,6BAAa,MAAM,OAAO,CAAC;AAAA,EAC/C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,UAAU,WAAmB,YAAoB,OAAe,MAAqB;AACnG,QAAM,OAAO,UAAU,WAAW,IAAI;AACtC,oCAAU,uBAAK,MAAM,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC/C,QAAM,OAAO,KAAK,UAAU,EAAE,aAAa,YAAY,MAAM,CAAC;AAE9D,QAAM,cAAU,uBAAK,MAAM,MAAM,cAAU,iCAAY,CAAC,EAAE,SAAS,KAAK,CAAC,MAAM;AAC/E,MAAI;AACF,sCAAc,SAAS,MAAM,OAAO;AACpC,mCAAW,SAAS,IAAI;AAAA,EAC1B,SAAS,KAAK;AACZ,QAAI;AACF,qCAAW,OAAO;AAAA,IACpB,QAAQ;AAAA,IAER;AACA,UAAM;AAAA,EACR;AAEA,MAAI;AACF,kCAAU,MAAM,GAAK;AAAA,EACvB,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,WAAW,WAAmB,MAAqB;AACjE,QAAM,OAAO,UAAU,WAAW,IAAI;AACtC,MAAI;AACF,mCAAW,IAAI;AAAA,EACjB,QAAQ;AAAA,EAER;AACF;;;ADjDO,SAAS,qBAAqB,WAAmB,MAAuB;AAC7E,QAAM,MAAM,QAAQ,gBAAgB,SAAS;AAC7C,QAAM,WAAO,wBAAK,KAAK,YAAY;AAEnC,UAAI,4BAAW,IAAI,GAAG;AACpB,UAAM,eAAW,8BAAa,MAAM,OAAO,EAAE,KAAK;AAClD,QAAI,SAAU,QAAO;AAAA,EACvB;AAEA,QAAM,gBAAY,gCAAW;AAC7B,iCAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAClC,qCAAc,MAAM,WAAW,OAAO;AACtC,SAAO;AACT;;;AEkBO,IAAM,oBAAN,MAAwB;AAAA,EACpB;AAAA,EACQ;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,WAAmB,UAAoC,CAAC,GAAG;AACrE,SAAK,YAAY;AACjB,SAAK,OAAO,IAAI,WAAW,QAAQ,WAAW,kBAAkB,QAAQ,aAAa,GAAM;AAC3F,SAAK,YAAY,QAAQ;AACzB,SAAK,iBAAiB,OAAO,KAAK,QAAQ,iBAAiB,iBAAiB,WAAW;AAAA,EACzF;AAAA;AAAA;AAAA,EAIA,eAAuB;AACrB,WAAO,qBAAqB,KAAK,WAAW,KAAK,SAAS;AAAA,EAC5D;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,SAAS,YAAoB,WAA4C;AAC7E,UAAM,oBAAoB,aAAa,KAAK,aAAa;AACzD,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,KAAK,KAAK,SAAS,aAAa;AAAA,QAC3C,aAAa;AAAA,QACb,YAAY;AAAA,QACZ,YAAY,KAAK;AAAA,MACnB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,SAAS,eAAe,eAAe,IAAI,UAAU,OAAO,GAAG;AACrE,aAAO,EAAE,OAAO,OAAO,SAAS,kBAAkB,MAAM,IAAI,QAAQ,SAAS;AAAA,IAC/E;AAEA,UAAM,SAAwB;AAAA,MAC5B,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,MACd,OAAO,KAAK,SAAS;AAAA,MACrB,WAAW,KAAK,cAAc;AAAA,MAC9B,QAAQ;AAAA,IACV;AACA,QAAI,OAAO,SAAS,KAAK,OAAO;AAC9B,gBAAU,KAAK,WAAW,YAAY,KAAK,OAAO,KAAK,SAAS;AAAA,IAClE;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,OAAO,YAAoB,WAAoB,UAAyB,CAAC,GAA2B;AACxG,UAAM,oBAAoB,aAAa,KAAK,aAAa;AACzD,UAAM,eAAe,QAAQ,gBAAgB;AAE7C,QAAI,cAAc;AAChB,YAAM,SAAS,UAAU,KAAK,WAAW,KAAK,SAAS;AACvD,UAAI,UAAU,OAAO,gBAAgB,YAAY;AAC/C,YAAI;AACF,gBAAM,UAAU,YAAY,OAAO,OAAO,KAAK,gBAAgB;AAAA,YAC7D,oBAAoB;AAAA,YACpB,mBAAmB;AAAA,YACnB,mBAAmB,KAAK;AAAA,YACxB,KAAK,QAAQ;AAAA,UACf,CAAC;AACD,iBAAO;AAAA,YACL,OAAO;AAAA,YACP,SAAS;AAAA,YACT,OAAO,QAAQ,SAAS;AAAA,YACxB,WAAW,QAAQ,sBAAsB;AAAA,YACzC,QAAQ;AAAA,UACV;AAAA,QACF,SAAS,KAAK;AACZ,cAAI,EAAE,eAAe,YAAa,OAAM;AAAA,QAE1C;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,KAAK,KAAK,SAAS,WAAW;AAAA,QACzC,aAAa;AAAA,QACb,YAAY;AAAA,QACZ,YAAY,KAAK;AAAA,MACnB,CAAC;AAAA,IACH,QAAQ;AACN,aAAO,EAAE,OAAO,OAAO,SAAS,qCAAqC,QAAQ,qBAAqB;AAAA,IACpG;AAEA,UAAM,SAAwB;AAAA,MAC5B,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,MACd,OAAO,KAAK,SAAS;AAAA,MACrB,WAAW,KAAK,cAAc;AAAA,MAC9B,QAAQ;AAAA,IACV;AACA,QAAI,OAAO,SAAS,KAAK,OAAO;AAC9B,gBAAU,KAAK,WAAW,YAAY,KAAK,OAAO,KAAK,SAAS;AAAA,IAClE,WAAW,CAAC,OAAO,OAAO;AAGxB,iBAAW,KAAK,WAAW,KAAK,SAAS;AAAA,IAC3C;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,WAAW,YAAoB,WAA4C;AAC/E,UAAM,oBAAoB,aAAa,KAAK,aAAa;AACzD,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,KAAK,KAAK,SAAS,eAAe;AAAA,QAC7C,aAAa;AAAA,QACb,YAAY;AAAA,QACZ,YAAY,KAAK;AAAA,MACnB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,SAAS,eAAe,eAAe,IAAI,UAAU,OAAO,GAAG;AACrE,aAAO,EAAE,OAAO,OAAO,SAAS,kBAAkB,MAAM,IAAI,QAAQ,SAAS;AAAA,IAC/E;AAEA,eAAW,KAAK,WAAW,KAAK,SAAS;AACzC,WAAO,EAAE,OAAO,KAAK,OAAO,SAAS,KAAK,SAAS,QAAQ,SAAS;AAAA,EACtE;AAAA;AAAA;AAAA,EAIA,MAAM,WAAW,WAA0C;AACzD,WAAO,KAAK,UAAU,gBAAgB,SAAS;AAAA,EACjD;AAAA;AAAA,EAGA,MAAM,YAAY,WAA0C;AAC1D,WAAO,KAAK,UAAU,iBAAiB,SAAS;AAAA,EAClD;AAAA,EAEA,MAAc,UAAU,MAAc,WAA0C;AAC9E,UAAM,oBAAoB,aAAa,KAAK,aAAa;AACzD,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,KAAK,KAAK,SAAS,MAAM;AAAA,QACpC,YAAY;AAAA,QACZ,YAAY,KAAK;AAAA,MACnB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,SAAS,eAAe,eAAe,IAAI,UAAU,OAAO,GAAG;AACrE,aAAO,EAAE,QAAQ,QAAQ,UAAU,GAAG,SAAS,kBAAkB,MAAM,GAAG;AAAA,IAC5E;AACA,WAAO;AAAA,MACL,QAAQ,KAAK;AAAA,MACb,UAAW,KAAK,aAAwB;AAAA,MACxC,WAAY,KAAK,cAAyB;AAAA,MAC1C,SAAU,KAAK,WAAsB;AAAA,IACvC;AAAA,EACF;AACF;","names":["cryptoVerify","import_node_crypto","import_node_fs","import_node_path","import_node_crypto"]}

package/dist/index.d.cts

@@ -0,0 +1,105 @@
+type LicenseSource = "online" | "offline_cache" | "offline_cache_miss";
+interface LicenseResult {
+    valid: boolean;
+    message: string;
+    email?: string | null;
+    expiresAt?: string | null;
+    source: LicenseSource;
+}
+interface TrialResult {
+    status: "active" | "expired" | "none";
+    daysLeft: number;
+    expiresAt?: string | null;
+    message: string;
+}
+interface SublimeKeysClientOptions {
+    baseUrl?: string;
+    cacheDir?: string;
+    publicKeyB64u?: string;
+    timeoutMs?: number;
+}
+interface VerifyOptions {
+    allowOffline?: boolean;
+    /** Internal test hook — overrides "now" when checking lease expiry. */
+    _now?: Date;
+}
+declare class SublimeKeysClient {
+    readonly productId: string;
+    private readonly http;
+    private readonly cacheBase?;
+    private readonly publicKeyBytes;
+    constructor(productId: string, options?: SublimeKeysClientOptions);
+    /** A stable, locally-persisted machine identifier — generated once on
+     * first call, reused after that. */
+    getMachineId(): string;
+    /** First run for this license on this machine. Always goes online —
+     * activation is inherently server-side state. Safe to call again on a
+     * machine that's already activated (the server treats it as a no-op
+     * that doesn't consume another activation slot). */
+    activate(licenseKey: string, machineId?: string): Promise<LicenseResult>;
+    /** Every launch after the first. Checks the local cached lease first
+     * (instant, no network) if allowOffline is true; falls back to an online
+     * /verify call when there's no usable cached lease. Refreshes the cache
+     * on every successful online check, and clears it on a revoked/invalid
+     * result so a stale cache never outlives the license it was issued for. */
+    verify(licenseKey: string, machineId?: string, options?: VerifyOptions): Promise<LicenseResult>;
+    /** User signs out / uninstalls. Clears the local cache immediately —
+     * otherwise a deliberately-deactivated license would keep
+     * offline-verifying as valid until its trust window lapsed. */
+    deactivate(licenseKey: string, machineId?: string): Promise<LicenseResult>;
+    /** Get-or-create a trial for this machine. Idempotent server-side —
+     * reinstalling never resets the clock. */
+    startTrial(machineId?: string): Promise<TrialResult>;
+    /** Read-only trial check — never starts one. */
+    trialStatus(machineId?: string): Promise<TrialResult>;
+    private trialCall;
+}
+
+interface LeasePayload {
+    kid?: string;
+    license_key: string;
+    machine_id: string;
+    product_id: string;
+    email?: string | null;
+    issued_at?: string;
+    lease_expires_at: string;
+    license_expires_at?: string | null;
+    [key: string]: unknown;
+}
+interface VerifyLeaseOptions {
+    expectedLicenseKey: string;
+    expectedMachineId: string;
+    expectedProductId: string;
+    now?: Date;
+}
+/**
+ * Verify a lease token and return its payload if valid.
+ *
+ * Throws LeaseError for any failure — malformed token, bad signature,
+ * wrong license/machine/product, or an expired trust window/license.
+ * A valid signature only proves "SublimeKeys signed this," not "this is
+ * for the product/machine/license you expect" — the three equality
+ * checks below are not optional and cannot be skipped by a caller.
+ */
+declare function verifyLease(token: string, publicKeyBytes: Buffer, opts: VerifyLeaseOptions): LeasePayload;
+
+declare class SublimeKeysError extends Error {
+    constructor(message: string);
+}
+/** A request to the SublimeKeys API failed to complete (unreachable host, timeout, connection reset, ...). */
+declare class NetworkError extends SublimeKeysError {
+    constructor(message: string);
+}
+/** A cached offline lease failed verification — malformed, tampered, expired,
+ * or scoped to a different license/machine/product. */
+declare class LeaseError extends SublimeKeysError {
+    constructor(message: string);
+}
+
+/** SublimeKeys production Ed25519 public key (base64url, 32 raw bytes).
+ * Pinned here so the offline hot path never fetches /public-key at runtime. */
+declare const PUBLIC_KEY_B64U = "OEK14M1tAFMPuh0RkgdV3Xvgpb0igCfzbct527xoAzE";
+
+declare function getOrCreateMachineId(productId: string, base?: string): string;
+
+export { LeaseError, type LeasePayload, type LicenseResult, type LicenseSource, NetworkError, PUBLIC_KEY_B64U, SublimeKeysClient, type SublimeKeysClientOptions, SublimeKeysError, type TrialResult, type VerifyLeaseOptions, type VerifyOptions, getOrCreateMachineId, verifyLease };

package/dist/index.d.ts

@@ -0,0 +1,105 @@
+type LicenseSource = "online" | "offline_cache" | "offline_cache_miss";
+interface LicenseResult {
+    valid: boolean;
+    message: string;
+    email?: string | null;
+    expiresAt?: string | null;
+    source: LicenseSource;
+}
+interface TrialResult {
+    status: "active" | "expired" | "none";
+    daysLeft: number;
+    expiresAt?: string | null;
+    message: string;
+}
+interface SublimeKeysClientOptions {
+    baseUrl?: string;
+    cacheDir?: string;
+    publicKeyB64u?: string;
+    timeoutMs?: number;
+}
+interface VerifyOptions {
+    allowOffline?: boolean;
+    /** Internal test hook — overrides "now" when checking lease expiry. */
+    _now?: Date;
+}
+declare class SublimeKeysClient {
+    readonly productId: string;
+    private readonly http;
+    private readonly cacheBase?;
+    private readonly publicKeyBytes;
+    constructor(productId: string, options?: SublimeKeysClientOptions);
+    /** A stable, locally-persisted machine identifier — generated once on
+     * first call, reused after that. */
+    getMachineId(): string;
+    /** First run for this license on this machine. Always goes online —
+     * activation is inherently server-side state. Safe to call again on a
+     * machine that's already activated (the server treats it as a no-op
+     * that doesn't consume another activation slot). */
+    activate(licenseKey: string, machineId?: string): Promise<LicenseResult>;
+    /** Every launch after the first. Checks the local cached lease first
+     * (instant, no network) if allowOffline is true; falls back to an online
+     * /verify call when there's no usable cached lease. Refreshes the cache
+     * on every successful online check, and clears it on a revoked/invalid
+     * result so a stale cache never outlives the license it was issued for. */
+    verify(licenseKey: string, machineId?: string, options?: VerifyOptions): Promise<LicenseResult>;
+    /** User signs out / uninstalls. Clears the local cache immediately —
+     * otherwise a deliberately-deactivated license would keep
+     * offline-verifying as valid until its trust window lapsed. */
+    deactivate(licenseKey: string, machineId?: string): Promise<LicenseResult>;
+    /** Get-or-create a trial for this machine. Idempotent server-side —
+     * reinstalling never resets the clock. */
+    startTrial(machineId?: string): Promise<TrialResult>;
+    /** Read-only trial check — never starts one. */
+    trialStatus(machineId?: string): Promise<TrialResult>;
+    private trialCall;
+}
+
+interface LeasePayload {
+    kid?: string;
+    license_key: string;
+    machine_id: string;
+    product_id: string;
+    email?: string | null;
+    issued_at?: string;
+    lease_expires_at: string;
+    license_expires_at?: string | null;
+    [key: string]: unknown;
+}
+interface VerifyLeaseOptions {
+    expectedLicenseKey: string;
+    expectedMachineId: string;
+    expectedProductId: string;
+    now?: Date;
+}
+/**
+ * Verify a lease token and return its payload if valid.
+ *
+ * Throws LeaseError for any failure — malformed token, bad signature,
+ * wrong license/machine/product, or an expired trust window/license.
+ * A valid signature only proves "SublimeKeys signed this," not "this is
+ * for the product/machine/license you expect" — the three equality
+ * checks below are not optional and cannot be skipped by a caller.
+ */
+declare function verifyLease(token: string, publicKeyBytes: Buffer, opts: VerifyLeaseOptions): LeasePayload;
+
+declare class SublimeKeysError extends Error {
+    constructor(message: string);
+}
+/** A request to the SublimeKeys API failed to complete (unreachable host, timeout, connection reset, ...). */
+declare class NetworkError extends SublimeKeysError {
+    constructor(message: string);
+}
+/** A cached offline lease failed verification — malformed, tampered, expired,
+ * or scoped to a different license/machine/product. */
+declare class LeaseError extends SublimeKeysError {
+    constructor(message: string);
+}
+
+/** SublimeKeys production Ed25519 public key (base64url, 32 raw bytes).
+ * Pinned here so the offline hot path never fetches /public-key at runtime. */
+declare const PUBLIC_KEY_B64U = "OEK14M1tAFMPuh0RkgdV3Xvgpb0igCfzbct527xoAzE";
+
+declare function getOrCreateMachineId(productId: string, base?: string): string;
+
+export { LeaseError, type LeasePayload, type LicenseResult, type LicenseSource, NetworkError, PUBLIC_KEY_B64U, SublimeKeysClient, type SublimeKeysClientOptions, SublimeKeysError, type TrialResult, type VerifyLeaseOptions, type VerifyOptions, getOrCreateMachineId, verifyLease };

package/dist/index.js

@@ -0,0 +1,351 @@
+// src/pubkey.ts
+var PUBLIC_KEY_B64U = "OEK14M1tAFMPuh0RkgdV3Xvgpb0igCfzbct527xoAzE";
+
+// src/errors.ts
+var SublimeKeysError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SublimeKeysError";
+  }
+};
+var NetworkError = class extends SublimeKeysError {
+  constructor(message) {
+    super(message);
+    this.name = "NetworkError";
+  }
+};
+var LeaseError = class extends SublimeKeysError {
+  constructor(message) {
+    super(message);
+    this.name = "LeaseError";
+  }
+};
+
+// src/http.ts
+var DEFAULT_BASE_URL = "https://api.sublimearts.io";
+var HttpClient = class {
+  baseUrl;
+  timeoutMs;
+  constructor(baseUrl = DEFAULT_BASE_URL, timeoutMs = 1e4) {
+    this.baseUrl = baseUrl.replace(/\/+$/, "");
+    this.timeoutMs = timeoutMs;
+  }
+  async postJson(path, body) {
+    return this.request("POST", path, body);
+  }
+  async getJson(path) {
+    return this.request("GET", path, void 0);
+  }
+  async request(method, path, body) {
+    const url = `${this.baseUrl}${path}`;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    let res;
+    try {
+      res = await fetch(url, {
+        method,
+        headers: body !== void 0 ? { "Content-Type": "application/json" } : void 0,
+        body: body !== void 0 ? JSON.stringify(body) : void 0,
+        signal: controller.signal
+      });
+    } catch (err) {
+      const reason = err instanceof Error ? err.message : String(err);
+      throw new NetworkError(reason);
+    } finally {
+      clearTimeout(timer);
+    }
+    if (!res.ok) {
+      let message = `${res.status} ${res.statusText}`;
+      try {
+        const payload = await res.json();
+        if (payload?.detail) message = payload.detail;
+      } catch {
+      }
+      return { valid: false, message, email: null, expires_at: null, lease: null };
+    }
+    return await res.json();
+  }
+};
+
+// src/lease.ts
+import { createPublicKey, verify as cryptoVerify } from "crypto";
+function loadEd25519PublicKey(rawBytes) {
+  return createPublicKey({
+    key: { kty: "OKP", crv: "Ed25519", x: rawBytes.toString("base64url") },
+    format: "jwk"
+  });
+}
+function verifyLease(token, publicKeyBytes, opts) {
+  const parts = token.split(".");
+  if (parts.length !== 2) {
+    throw new LeaseError("malformed lease token: expected exactly one '.' separator");
+  }
+  const [payloadB64, sigB64] = parts;
+  let payloadBytes;
+  let sigBytes;
+  try {
+    payloadBytes = Buffer.from(payloadB64, "base64url");
+    sigBytes = Buffer.from(sigB64, "base64url");
+  } catch (err) {
+    throw new LeaseError(`malformed lease token: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const publicKey = loadEd25519PublicKey(publicKeyBytes);
+  let signatureValid;
+  try {
+    signatureValid = cryptoVerify(null, payloadBytes, publicKey, sigBytes);
+  } catch {
+    signatureValid = false;
+  }
+  if (!signatureValid) {
+    throw new LeaseError("invalid lease signature");
+  }
+  let payload;
+  try {
+    payload = JSON.parse(payloadBytes.toString("utf-8"));
+  } catch (err) {
+    throw new LeaseError(`malformed lease payload: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  if (payload.license_key !== opts.expectedLicenseKey) {
+    throw new LeaseError("lease license_key does not match");
+  }
+  if (payload.machine_id !== opts.expectedMachineId) {
+    throw new LeaseError("lease machine_id does not match");
+  }
+  if (payload.product_id !== opts.expectedProductId) {
+    throw new LeaseError("lease product_id does not match");
+  }
+  const now = opts.now ?? /* @__PURE__ */ new Date();
+  if (!payload.lease_expires_at || now >= new Date(payload.lease_expires_at)) {
+    throw new LeaseError("lease trust window has lapsed");
+  }
+  if (payload.license_expires_at && now >= new Date(payload.license_expires_at)) {
+    throw new LeaseError("license has expired");
+  }
+  return payload;
+}
+
+// src/machine.ts
+import { randomUUID } from "crypto";
+import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { join as join2 } from "path";
+
+// src/storage.ts
+import { randomBytes } from "crypto";
+import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync, chmodSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+function defaultCacheDir(productId) {
+  return join(homedir(), ".sublimekeys", productId);
+}
+function leasePath(productId, base) {
+  return join(base ?? defaultCacheDir(productId), "lease.json");
+}
+function loadLease(productId, base) {
+  const path = leasePath(productId, base);
+  if (!existsSync(path)) return null;
+  try {
+    return JSON.parse(readFileSync(path, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function saveLease(productId, licenseKey, token, base) {
+  const path = leasePath(productId, base);
+  mkdirSync(join(path, ".."), { recursive: true });
+  const data = JSON.stringify({ license_key: licenseKey, token });
+  const tmpPath = join(path, "..", `.lease-${randomBytes(6).toString("hex")}.tmp`);
+  try {
+    writeFileSync(tmpPath, data, "utf-8");
+    renameSync(tmpPath, path);
+  } catch (err) {
+    try {
+      unlinkSync(tmpPath);
+    } catch {
+    }
+    throw err;
+  }
+  try {
+    chmodSync(path, 384);
+  } catch {
+  }
+}
+function clearLease(productId, base) {
+  const path = leasePath(productId, base);
+  try {
+    unlinkSync(path);
+  } catch {
+  }
+}
+
+// src/machine.ts
+function getOrCreateMachineId(productId, base) {
+  const dir = base ?? defaultCacheDir(productId);
+  const path = join2(dir, "machine_id");
+  if (existsSync2(path)) {
+    const existing = readFileSync2(path, "utf-8").trim();
+    if (existing) return existing;
+  }
+  const machineId = randomUUID();
+  mkdirSync2(dir, { recursive: true });
+  writeFileSync2(path, machineId, "utf-8");
+  return machineId;
+}
+
+// src/client.ts
+var SublimeKeysClient = class {
+  productId;
+  http;
+  cacheBase;
+  publicKeyBytes;
+  constructor(productId, options = {}) {
+    this.productId = productId;
+    this.http = new HttpClient(options.baseUrl ?? DEFAULT_BASE_URL, options.timeoutMs ?? 1e4);
+    this.cacheBase = options.cacheDir;
+    this.publicKeyBytes = Buffer.from(options.publicKeyB64u ?? PUBLIC_KEY_B64U, "base64url");
+  }
+  /** A stable, locally-persisted machine identifier — generated once on
+   * first call, reused after that. */
+  getMachineId() {
+    return getOrCreateMachineId(this.productId, this.cacheBase);
+  }
+  /** First run for this license on this machine. Always goes online —
+   * activation is inherently server-side state. Safe to call again on a
+   * machine that's already activated (the server treats it as a no-op
+   * that doesn't consume another activation slot). */
+  async activate(licenseKey, machineId) {
+    const resolvedMachineId = machineId ?? this.getMachineId();
+    let data;
+    try {
+      data = await this.http.postJson("/activate", {
+        license_key: licenseKey,
+        machine_id: resolvedMachineId,
+        product_id: this.productId
+      });
+    } catch (err) {
+      const reason = err instanceof NetworkError ? err.message : String(err);
+      return { valid: false, message: `Network error: ${reason}`, source: "online" };
+    }
+    const result = {
+      valid: data.valid,
+      message: data.message,
+      email: data.email ?? null,
+      expiresAt: data.expires_at ?? null,
+      source: "online"
+    };
+    if (result.valid && data.lease) {
+      saveLease(this.productId, licenseKey, data.lease, this.cacheBase);
+    }
+    return result;
+  }
+  /** Every launch after the first. Checks the local cached lease first
+   * (instant, no network) if allowOffline is true; falls back to an online
+   * /verify call when there's no usable cached lease. Refreshes the cache
+   * on every successful online check, and clears it on a revoked/invalid
+   * result so a stale cache never outlives the license it was issued for. */
+  async verify(licenseKey, machineId, options = {}) {
+    const resolvedMachineId = machineId ?? this.getMachineId();
+    const allowOffline = options.allowOffline ?? true;
+    if (allowOffline) {
+      const cached = loadLease(this.productId, this.cacheBase);
+      if (cached && cached.license_key === licenseKey) {
+        try {
+          const payload = verifyLease(cached.token, this.publicKeyBytes, {
+            expectedLicenseKey: licenseKey,
+            expectedMachineId: resolvedMachineId,
+            expectedProductId: this.productId,
+            now: options._now
+          });
+          return {
+            valid: true,
+            message: "Valid (offline)",
+            email: payload.email ?? null,
+            expiresAt: payload.license_expires_at ?? null,
+            source: "offline_cache"
+          };
+        } catch (err) {
+          if (!(err instanceof LeaseError)) throw err;
+        }
+      }
+    }
+    let data;
+    try {
+      data = await this.http.postJson("/verify", {
+        license_key: licenseKey,
+        machine_id: resolvedMachineId,
+        product_id: this.productId
+      });
+    } catch {
+      return { valid: false, message: "Offline and no valid cached lease", source: "offline_cache_miss" };
+    }
+    const result = {
+      valid: data.valid,
+      message: data.message,
+      email: data.email ?? null,
+      expiresAt: data.expires_at ?? null,
+      source: "online"
+    };
+    if (result.valid && data.lease) {
+      saveLease(this.productId, licenseKey, data.lease, this.cacheBase);
+    } else if (!result.valid) {
+      clearLease(this.productId, this.cacheBase);
+    }
+    return result;
+  }
+  /** User signs out / uninstalls. Clears the local cache immediately —
+   * otherwise a deliberately-deactivated license would keep
+   * offline-verifying as valid until its trust window lapsed. */
+  async deactivate(licenseKey, machineId) {
+    const resolvedMachineId = machineId ?? this.getMachineId();
+    let data;
+    try {
+      data = await this.http.postJson("/deactivate", {
+        license_key: licenseKey,
+        machine_id: resolvedMachineId,
+        product_id: this.productId
+      });
+    } catch (err) {
+      const reason = err instanceof NetworkError ? err.message : String(err);
+      return { valid: false, message: `Network error: ${reason}`, source: "online" };
+    }
+    clearLease(this.productId, this.cacheBase);
+    return { valid: data.valid, message: data.message, source: "online" };
+  }
+  /** Get-or-create a trial for this machine. Idempotent server-side —
+   * reinstalling never resets the clock. */
+  async startTrial(machineId) {
+    return this.trialCall("/trial/start", machineId);
+  }
+  /** Read-only trial check — never starts one. */
+  async trialStatus(machineId) {
+    return this.trialCall("/trial/status", machineId);
+  }
+  async trialCall(path, machineId) {
+    const resolvedMachineId = machineId ?? this.getMachineId();
+    let data;
+    try {
+      data = await this.http.postJson(path, {
+        machine_id: resolvedMachineId,
+        product_id: this.productId
+      });
+    } catch (err) {
+      const reason = err instanceof NetworkError ? err.message : String(err);
+      return { status: "none", daysLeft: 0, message: `Network error: ${reason}` };
+    }
+    return {
+      status: data.status,
+      daysLeft: data.days_left ?? 0,
+      expiresAt: data.expires_at ?? null,
+      message: data.message ?? ""
+    };
+  }
+};
+export {
+  LeaseError,
+  NetworkError,
+  PUBLIC_KEY_B64U,
+  SublimeKeysClient,
+  SublimeKeysError,
+  getOrCreateMachineId,
+  verifyLease
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/pubkey.ts","../src/errors.ts","../src/http.ts","../src/lease.ts","../src/machine.ts","../src/storage.ts","../src/client.ts"],"sourcesContent":["/** SublimeKeys production Ed25519 public key (base64url, 32 raw bytes).\n * Pinned here so the offline hot path never fetches /public-key at runtime. */\nexport const PUBLIC_KEY_B64U = \"OEK14M1tAFMPuh0RkgdV3Xvgpb0igCfzbct527xoAzE\";\n","export class SublimeKeysError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = \"SublimeKeysError\";\n  }\n}\n\n/** A request to the SublimeKeys API failed to complete (unreachable host, timeout, connection reset, ...). */\nexport class NetworkError extends SublimeKeysError {\n  constructor(message: string) {\n    super(message);\n    this.name = \"NetworkError\";\n  }\n}\n\n/** A cached offline lease failed verification — malformed, tampered, expired,\n * or scoped to a different license/machine/product. */\nexport class LeaseError extends SublimeKeysError {\n  constructor(message: string) {\n    super(message);\n    this.name = \"LeaseError\";\n  }\n}\n","// Thin fetch-based JSON client — zero HTTP dependencies, matching the\n// license server's own minimal-dependency style. This is also where the\n// server's one REST inconsistency gets papered over: /activate raises an\n// HTTP error (404/403, body {\"detail\": \"...\"}) while /verify always returns\n// HTTP 200 with valid:false. Callers of this module see one shape either way.\n\nimport { NetworkError } from \"./errors.js\";\n\nexport const DEFAULT_BASE_URL = \"https://api.sublimearts.io\";\n\nexport interface ApiResponse {\n  valid: boolean;\n  message: string;\n  email?: string | null;\n  expires_at?: string | null;\n  lease?: string | null;\n  [key: string]: unknown;\n}\n\nexport class HttpClient {\n  private baseUrl: string;\n  private timeoutMs: number;\n\n  constructor(baseUrl: string = DEFAULT_BASE_URL, timeoutMs = 10_000) {\n    this.baseUrl = baseUrl.replace(/\\/+$/, \"\");\n    this.timeoutMs = timeoutMs;\n  }\n\n  async postJson(path: string, body: Record<string, unknown>): Promise<ApiResponse> {\n    return this.request(\"POST\", path, body);\n  }\n\n  async getJson(path: string): Promise<ApiResponse> {\n    return this.request(\"GET\", path, undefined);\n  }\n\n  private async request(method: string, path: string, body: Record<string, unknown> | undefined): Promise<ApiResponse> {\n    const url = `${this.baseUrl}${path}`;\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.timeoutMs);\n\n    let res: Response;\n    try {\n      res = await fetch(url, {\n        method,\n        headers: body !== undefined ? { \"Content-Type\": \"application/json\" } : undefined,\n        body: body !== undefined ? JSON.stringify(body) : undefined,\n        signal: controller.signal,\n      });\n    } catch (err) {\n      const reason = err instanceof Error ? err.message : String(err);\n      throw new NetworkError(reason);\n    } finally {\n      clearTimeout(timer);\n    }\n\n    if (!res.ok) {\n      let message = `${res.status} ${res.statusText}`;\n      try {\n        const payload = (await res.json()) as { detail?: string };\n        if (payload?.detail) message = payload.detail;\n      } catch {\n        // non-JSON error body — keep the status line as the message\n      }\n      return { valid: false, message, email: null, expires_at: null, lease: null };\n    }\n\n    return (await res.json()) as ApiResponse;\n  }\n}\n","// Offline verification of SublimeKeys signed leases.\n//\n// A lease is a compact token: base64url(json_payload) + \".\" + base64url(signature),\n// signed with Ed25519 by the SublimeKeys license server. Verifying it locally\n// requires no network call, which is the entire point of this module.\n\nimport { createPublicKey, verify as cryptoVerify } from \"node:crypto\";\nimport { LeaseError } from \"./errors.js\";\n\nexport interface LeasePayload {\n  kid?: string;\n  license_key: string;\n  machine_id: string;\n  product_id: string;\n  email?: string | null;\n  issued_at?: string;\n  lease_expires_at: string;\n  license_expires_at?: string | null;\n  [key: string]: unknown;\n}\n\nexport interface VerifyLeaseOptions {\n  expectedLicenseKey: string;\n  expectedMachineId: string;\n  expectedProductId: string;\n  now?: Date;\n}\n\nfunction loadEd25519PublicKey(rawBytes: Buffer) {\n  return createPublicKey({\n    key: { kty: \"OKP\", crv: \"Ed25519\", x: rawBytes.toString(\"base64url\") },\n    format: \"jwk\",\n  });\n}\n\n/**\n * Verify a lease token and return its payload if valid.\n *\n * Throws LeaseError for any failure — malformed token, bad signature,\n * wrong license/machine/product, or an expired trust window/license.\n * A valid signature only proves \"SublimeKeys signed this,\" not \"this is\n * for the product/machine/license you expect\" — the three equality\n * checks below are not optional and cannot be skipped by a caller.\n */\nexport function verifyLease(token: string, publicKeyBytes: Buffer, opts: VerifyLeaseOptions): LeasePayload {\n  const parts = token.split(\".\");\n  if (parts.length !== 2) {\n    throw new LeaseError(\"malformed lease token: expected exactly one '.' separator\");\n  }\n  const [payloadB64, sigB64] = parts;\n\n  let payloadBytes: Buffer;\n  let sigBytes: Buffer;\n  try {\n    payloadBytes = Buffer.from(payloadB64, \"base64url\");\n    sigBytes = Buffer.from(sigB64, \"base64url\");\n  } catch (err) {\n    throw new LeaseError(`malformed lease token: ${err instanceof Error ? err.message : String(err)}`);\n  }\n\n  const publicKey = loadEd25519PublicKey(publicKeyBytes);\n\n  // Verify the signature BEFORE parsing the payload as JSON — never hand\n  // unauthenticated bytes to a parser first, even a safe one.\n  let signatureValid: boolean;\n  try {\n    signatureValid = cryptoVerify(null, payloadBytes, publicKey, sigBytes);\n  } catch {\n    signatureValid = false;\n  }\n  if (!signatureValid) {\n    throw new LeaseError(\"invalid lease signature\");\n  }\n\n  let payload: LeasePayload;\n  try {\n    payload = JSON.parse(payloadBytes.toString(\"utf-8\")) as LeasePayload;\n  } catch (err) {\n    throw new LeaseError(`malformed lease payload: ${err instanceof Error ? err.message : String(err)}`);\n  }\n\n  if (payload.license_key !== opts.expectedLicenseKey) {\n    throw new LeaseError(\"lease license_key does not match\");\n  }\n  if (payload.machine_id !== opts.expectedMachineId) {\n    throw new LeaseError(\"lease machine_id does not match\");\n  }\n  if (payload.product_id !== opts.expectedProductId) {\n    throw new LeaseError(\"lease product_id does not match\");\n  }\n\n  const now = opts.now ?? new Date();\n\n  if (!payload.lease_expires_at || now >= new Date(payload.lease_expires_at)) {\n    throw new LeaseError(\"lease trust window has lapsed\");\n  }\n\n  if (payload.license_expires_at && now >= new Date(payload.license_expires_at)) {\n    throw new LeaseError(\"license has expired\");\n  }\n\n  return payload;\n}\n","// A stable per-install machine identifier.\n//\n// Deliberately a persisted random UUID, not a hardware fingerprint. Real\n// hardware IDs (MAC addresses, disk serials, ...) are spoofable, change on\n// VMs/cloud desktops/Apple Silicon Rosetta in ways that generate false\n// mismatches and support tickets, and buy little real security over a\n// persisted UUID for this use case. Trivially resettable by deleting one\n// file — that's a known, accepted tradeoff (a soft deterrent, not DRM),\n// not an oversight.\n\nimport { randomUUID } from \"node:crypto\";\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { defaultCacheDir } from \"./storage.js\";\n\nexport function getOrCreateMachineId(productId: string, base?: string): string {\n  const dir = base ?? defaultCacheDir(productId);\n  const path = join(dir, \"machine_id\");\n\n  if (existsSync(path)) {\n    const existing = readFileSync(path, \"utf-8\").trim();\n    if (existing) return existing;\n  }\n\n  const machineId = randomUUID();\n  mkdirSync(dir, { recursive: true });\n  writeFileSync(path, machineId, \"utf-8\");\n  return machineId;\n}\n","// Local cache for signed leases — one JSON file per product, written\n// atomically (temp file + rename) so a crash mid-write never leaves a\n// half-written file behind.\n\nimport { randomBytes } from \"node:crypto\";\nimport { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync, chmodSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\n\nexport interface CachedLease {\n  license_key: string;\n  token: string;\n}\n\nexport function defaultCacheDir(productId: string): string {\n  return join(homedir(), \".sublimekeys\", productId);\n}\n\nfunction leasePath(productId: string, base?: string): string {\n  return join(base ?? defaultCacheDir(productId), \"lease.json\");\n}\n\nexport function loadLease(productId: string, base?: string): CachedLease | null {\n  const path = leasePath(productId, base);\n  if (!existsSync(path)) return null;\n  try {\n    return JSON.parse(readFileSync(path, \"utf-8\")) as CachedLease;\n  } catch {\n    return null;\n  }\n}\n\nexport function saveLease(productId: string, licenseKey: string, token: string, base?: string): void {\n  const path = leasePath(productId, base);\n  mkdirSync(join(path, \"..\"), { recursive: true });\n  const data = JSON.stringify({ license_key: licenseKey, token });\n\n  const tmpPath = join(path, \"..\", `.lease-${randomBytes(6).toString(\"hex\")}.tmp`);\n  try {\n    writeFileSync(tmpPath, data, \"utf-8\");\n    renameSync(tmpPath, path);\n  } catch (err) {\n    try {\n      unlinkSync(tmpPath);\n    } catch {\n      // best-effort cleanup\n    }\n    throw err;\n  }\n\n  try {\n    chmodSync(path, 0o600);\n  } catch {\n    // best-effort — no-op on native Windows ACLs, real on POSIX/WSL\n  }\n}\n\nexport function clearLease(productId: string, base?: string): void {\n  const path = leasePath(productId, base);\n  try {\n    unlinkSync(path);\n  } catch {\n    // already gone — fine\n  }\n}\n","// SublimeKeysClient — the main SDK entry point.\n//\n// Cache-first, not online-first-with-fallback: after one successful\n// activate()/verify(), subsequent verify() calls make zero network requests\n// for as long as the cached lease's trust window is valid (currently 7 days,\n// set server-side) — that's the actual point of offline leases. A network\n// call only happens again once the cache is missing, invalid, or its trust\n// window has lapsed.\n\nimport { PUBLIC_KEY_B64U } from \"./pubkey.js\";\nimport { NetworkError, LeaseError } from \"./errors.js\";\nimport { DEFAULT_BASE_URL, HttpClient } from \"./http.js\";\nimport { verifyLease } from \"./lease.js\";\nimport { getOrCreateMachineId } from \"./machine.js\";\nimport { loadLease, saveLease, clearLease } from \"./storage.js\";\n\nexport type LicenseSource = \"online\" | \"offline_cache\" | \"offline_cache_miss\";\n\nexport interface LicenseResult {\n  valid: boolean;\n  message: string;\n  email?: string | null;\n  expiresAt?: string | null;\n  source: LicenseSource;\n}\n\nexport interface TrialResult {\n  status: \"active\" | \"expired\" | \"none\";\n  daysLeft: number;\n  expiresAt?: string | null;\n  message: string;\n}\n\nexport interface SublimeKeysClientOptions {\n  baseUrl?: string;\n  cacheDir?: string;\n  publicKeyB64u?: string;\n  timeoutMs?: number;\n}\n\nexport interface VerifyOptions {\n  allowOffline?: boolean;\n  /** Internal test hook — overrides \"now\" when checking lease expiry. */\n  _now?: Date;\n}\n\nexport class SublimeKeysClient {\n  readonly productId: string;\n  private readonly http: HttpClient;\n  private readonly cacheBase?: string;\n  private readonly publicKeyBytes: Buffer;\n\n  constructor(productId: string, options: SublimeKeysClientOptions = {}) {\n    this.productId = productId;\n    this.http = new HttpClient(options.baseUrl ?? DEFAULT_BASE_URL, options.timeoutMs ?? 10_000);\n    this.cacheBase = options.cacheDir;\n    this.publicKeyBytes = Buffer.from(options.publicKeyB64u ?? PUBLIC_KEY_B64U, \"base64url\");\n  }\n\n  /** A stable, locally-persisted machine identifier — generated once on\n   * first call, reused after that. */\n  getMachineId(): string {\n    return getOrCreateMachineId(this.productId, this.cacheBase);\n  }\n\n  /** First run for this license on this machine. Always goes online —\n   * activation is inherently server-side state. Safe to call again on a\n   * machine that's already activated (the server treats it as a no-op\n   * that doesn't consume another activation slot). */\n  async activate(licenseKey: string, machineId?: string): Promise<LicenseResult> {\n    const resolvedMachineId = machineId ?? this.getMachineId();\n    let data;\n    try {\n      data = await this.http.postJson(\"/activate\", {\n        license_key: licenseKey,\n        machine_id: resolvedMachineId,\n        product_id: this.productId,\n      });\n    } catch (err) {\n      const reason = err instanceof NetworkError ? err.message : String(err);\n      return { valid: false, message: `Network error: ${reason}`, source: \"online\" };\n    }\n\n    const result: LicenseResult = {\n      valid: data.valid,\n      message: data.message,\n      email: data.email ?? null,\n      expiresAt: data.expires_at ?? null,\n      source: \"online\",\n    };\n    if (result.valid && data.lease) {\n      saveLease(this.productId, licenseKey, data.lease, this.cacheBase);\n    }\n    return result;\n  }\n\n  /** Every launch after the first. Checks the local cached lease first\n   * (instant, no network) if allowOffline is true; falls back to an online\n   * /verify call when there's no usable cached lease. Refreshes the cache\n   * on every successful online check, and clears it on a revoked/invalid\n   * result so a stale cache never outlives the license it was issued for. */\n  async verify(licenseKey: string, machineId?: string, options: VerifyOptions = {}): Promise<LicenseResult> {\n    const resolvedMachineId = machineId ?? this.getMachineId();\n    const allowOffline = options.allowOffline ?? true;\n\n    if (allowOffline) {\n      const cached = loadLease(this.productId, this.cacheBase);\n      if (cached && cached.license_key === licenseKey) {\n        try {\n          const payload = verifyLease(cached.token, this.publicKeyBytes, {\n            expectedLicenseKey: licenseKey,\n            expectedMachineId: resolvedMachineId,\n            expectedProductId: this.productId,\n            now: options._now,\n          });\n          return {\n            valid: true,\n            message: \"Valid (offline)\",\n            email: payload.email ?? null,\n            expiresAt: payload.license_expires_at ?? null,\n            source: \"offline_cache\",\n          };\n        } catch (err) {\n          if (!(err instanceof LeaseError)) throw err;\n          // cache unusable — fall through to an online check\n        }\n      }\n    }\n\n    let data;\n    try {\n      data = await this.http.postJson(\"/verify\", {\n        license_key: licenseKey,\n        machine_id: resolvedMachineId,\n        product_id: this.productId,\n      });\n    } catch {\n      return { valid: false, message: \"Offline and no valid cached lease\", source: \"offline_cache_miss\" };\n    }\n\n    const result: LicenseResult = {\n      valid: data.valid,\n      message: data.message,\n      email: data.email ?? null,\n      expiresAt: data.expires_at ?? null,\n      source: \"online\",\n    };\n    if (result.valid && data.lease) {\n      saveLease(this.productId, licenseKey, data.lease, this.cacheBase);\n    } else if (!result.valid) {\n      // Don't leave a stale cache behind — a license revoked server-side\n      // must not keep offline-verifying as valid for days afterward.\n      clearLease(this.productId, this.cacheBase);\n    }\n    return result;\n  }\n\n  /** User signs out / uninstalls. Clears the local cache immediately —\n   * otherwise a deliberately-deactivated license would keep\n   * offline-verifying as valid until its trust window lapsed. */\n  async deactivate(licenseKey: string, machineId?: string): Promise<LicenseResult> {\n    const resolvedMachineId = machineId ?? this.getMachineId();\n    let data;\n    try {\n      data = await this.http.postJson(\"/deactivate\", {\n        license_key: licenseKey,\n        machine_id: resolvedMachineId,\n        product_id: this.productId,\n      });\n    } catch (err) {\n      const reason = err instanceof NetworkError ? err.message : String(err);\n      return { valid: false, message: `Network error: ${reason}`, source: \"online\" };\n    }\n\n    clearLease(this.productId, this.cacheBase);\n    return { valid: data.valid, message: data.message, source: \"online\" };\n  }\n\n  /** Get-or-create a trial for this machine. Idempotent server-side —\n   * reinstalling never resets the clock. */\n  async startTrial(machineId?: string): Promise<TrialResult> {\n    return this.trialCall(\"/trial/start\", machineId);\n  }\n\n  /** Read-only trial check — never starts one. */\n  async trialStatus(machineId?: string): Promise<TrialResult> {\n    return this.trialCall(\"/trial/status\", machineId);\n  }\n\n  private async trialCall(path: string, machineId?: string): Promise<TrialResult> {\n    const resolvedMachineId = machineId ?? this.getMachineId();\n    let data;\n    try {\n      data = await this.http.postJson(path, {\n        machine_id: resolvedMachineId,\n        product_id: this.productId,\n      });\n    } catch (err) {\n      const reason = err instanceof NetworkError ? err.message : String(err);\n      return { status: \"none\", daysLeft: 0, message: `Network error: ${reason}` };\n    }\n    return {\n      status: data.status as TrialResult[\"status\"],\n      daysLeft: (data.days_left as number) ?? 0,\n      expiresAt: (data.expires_at as string) ?? null,\n      message: (data.message as string) ?? \"\",\n    };\n  }\n}\n"],"mappings":";AAEO,IAAM,kBAAkB;;;ACFxB,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAC1C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAGO,IAAM,eAAN,cAA2B,iBAAiB;AAAA,EACjD,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAIO,IAAM,aAAN,cAAyB,iBAAiB;AAAA,EAC/C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;;;ACdO,IAAM,mBAAmB;AAWzB,IAAM,aAAN,MAAiB;AAAA,EACd;AAAA,EACA;AAAA,EAER,YAAY,UAAkB,kBAAkB,YAAY,KAAQ;AAClE,SAAK,UAAU,QAAQ,QAAQ,QAAQ,EAAE;AACzC,SAAK,YAAY;AAAA,EACnB;AAAA,EAEA,MAAM,SAAS,MAAc,MAAqD;AAChF,WAAO,KAAK,QAAQ,QAAQ,MAAM,IAAI;AAAA,EACxC;AAAA,EAEA,MAAM,QAAQ,MAAoC;AAChD,WAAO,KAAK,QAAQ,OAAO,MAAM,MAAS;AAAA,EAC5C;AAAA,EAEA,MAAc,QAAQ,QAAgB,MAAc,MAAiE;AACnH,UAAM,MAAM,GAAG,KAAK,OAAO,GAAG,IAAI;AAClC,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,KAAK,SAAS;AAEjE,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,MAAM,KAAK;AAAA,QACrB;AAAA,QACA,SAAS,SAAS,SAAY,EAAE,gBAAgB,mBAAmB,IAAI;AAAA,QACvE,MAAM,SAAS,SAAY,KAAK,UAAU,IAAI,IAAI;AAAA,QAClD,QAAQ,WAAW;AAAA,MACrB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC9D,YAAM,IAAI,aAAa,MAAM;AAAA,IAC/B,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAEA,QAAI,CAAC,IAAI,IAAI;AACX,UAAI,UAAU,GAAG,IAAI,MAAM,IAAI,IAAI,UAAU;AAC7C,UAAI;AACF,cAAM,UAAW,MAAM,IAAI,KAAK;AAChC,YAAI,SAAS,OAAQ,WAAU,QAAQ;AAAA,MACzC,QAAQ;AAAA,MAER;AACA,aAAO,EAAE,OAAO,OAAO,SAAS,OAAO,MAAM,YAAY,MAAM,OAAO,KAAK;AAAA,IAC7E;AAEA,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB;AACF;;;AC/DA,SAAS,iBAAiB,UAAU,oBAAoB;AAsBxD,SAAS,qBAAqB,UAAkB;AAC9C,SAAO,gBAAgB;AAAA,IACrB,KAAK,EAAE,KAAK,OAAO,KAAK,WAAW,GAAG,SAAS,SAAS,WAAW,EAAE;AAAA,IACrE,QAAQ;AAAA,EACV,CAAC;AACH;AAWO,SAAS,YAAY,OAAe,gBAAwB,MAAwC;AACzG,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,WAAW,GAAG;AACtB,UAAM,IAAI,WAAW,2DAA2D;AAAA,EAClF;AACA,QAAM,CAAC,YAAY,MAAM,IAAI;AAE7B,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,mBAAe,OAAO,KAAK,YAAY,WAAW;AAClD,eAAW,OAAO,KAAK,QAAQ,WAAW;AAAA,EAC5C,SAAS,KAAK;AACZ,UAAM,IAAI,WAAW,0BAA0B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,EACnG;AAEA,QAAM,YAAY,qBAAqB,cAAc;AAIrD,MAAI;AACJ,MAAI;AACF,qBAAiB,aAAa,MAAM,cAAc,WAAW,QAAQ;AAAA,EACvE,QAAQ;AACN,qBAAiB;AAAA,EACnB;AACA,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,WAAW,yBAAyB;AAAA,EAChD;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,KAAK,MAAM,aAAa,SAAS,OAAO,CAAC;AAAA,EACrD,SAAS,KAAK;AACZ,UAAM,IAAI,WAAW,4BAA4B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAAA,EACrG;AAEA,MAAI,QAAQ,gBAAgB,KAAK,oBAAoB;AACnD,UAAM,IAAI,WAAW,kCAAkC;AAAA,EACzD;AACA,MAAI,QAAQ,eAAe,KAAK,mBAAmB;AACjD,UAAM,IAAI,WAAW,iCAAiC;AAAA,EACxD;AACA,MAAI,QAAQ,eAAe,KAAK,mBAAmB;AACjD,UAAM,IAAI,WAAW,iCAAiC;AAAA,EACxD;AAEA,QAAM,MAAM,KAAK,OAAO,oBAAI,KAAK;AAEjC,MAAI,CAAC,QAAQ,oBAAoB,OAAO,IAAI,KAAK,QAAQ,gBAAgB,GAAG;AAC1E,UAAM,IAAI,WAAW,+BAA+B;AAAA,EACtD;AAEA,MAAI,QAAQ,sBAAsB,OAAO,IAAI,KAAK,QAAQ,kBAAkB,GAAG;AAC7E,UAAM,IAAI,WAAW,qBAAqB;AAAA,EAC5C;AAEA,SAAO;AACT;;;AC5FA,SAAS,kBAAkB;AAC3B,SAAS,cAAAA,aAAY,aAAAC,YAAW,gBAAAC,eAAc,iBAAAC,sBAAqB;AACnE,SAAS,QAAAC,aAAY;;;ACRrB,SAAS,mBAAmB;AAC5B,SAAS,YAAY,WAAW,cAAc,YAAY,YAAY,eAAe,iBAAiB;AACtG,SAAS,eAAe;AACxB,SAAS,YAAY;AAOd,SAAS,gBAAgB,WAA2B;AACzD,SAAO,KAAK,QAAQ,GAAG,gBAAgB,SAAS;AAClD;AAEA,SAAS,UAAU,WAAmB,MAAuB;AAC3D,SAAO,KAAK,QAAQ,gBAAgB,SAAS,GAAG,YAAY;AAC9D;AAEO,SAAS,UAAU,WAAmB,MAAmC;AAC9E,QAAM,OAAO,UAAU,WAAW,IAAI;AACtC,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACF,WAAO,KAAK,MAAM,aAAa,MAAM,OAAO,CAAC;AAAA,EAC/C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,UAAU,WAAmB,YAAoB,OAAe,MAAqB;AACnG,QAAM,OAAO,UAAU,WAAW,IAAI;AACtC,YAAU,KAAK,MAAM,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC/C,QAAM,OAAO,KAAK,UAAU,EAAE,aAAa,YAAY,MAAM,CAAC;AAE9D,QAAM,UAAU,KAAK,MAAM,MAAM,UAAU,YAAY,CAAC,EAAE,SAAS,KAAK,CAAC,MAAM;AAC/E,MAAI;AACF,kBAAc,SAAS,MAAM,OAAO;AACpC,eAAW,SAAS,IAAI;AAAA,EAC1B,SAAS,KAAK;AACZ,QAAI;AACF,iBAAW,OAAO;AAAA,IACpB,QAAQ;AAAA,IAER;AACA,UAAM;AAAA,EACR;AAEA,MAAI;AACF,cAAU,MAAM,GAAK;AAAA,EACvB,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,WAAW,WAAmB,MAAqB;AACjE,QAAM,OAAO,UAAU,WAAW,IAAI;AACtC,MAAI;AACF,eAAW,IAAI;AAAA,EACjB,QAAQ;AAAA,EAER;AACF;;;ADjDO,SAAS,qBAAqB,WAAmB,MAAuB;AAC7E,QAAM,MAAM,QAAQ,gBAAgB,SAAS;AAC7C,QAAM,OAAOC,MAAK,KAAK,YAAY;AAEnC,MAAIC,YAAW,IAAI,GAAG;AACpB,UAAM,WAAWC,cAAa,MAAM,OAAO,EAAE,KAAK;AAClD,QAAI,SAAU,QAAO;AAAA,EACvB;AAEA,QAAM,YAAY,WAAW;AAC7B,EAAAC,WAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAClC,EAAAC,eAAc,MAAM,WAAW,OAAO;AACtC,SAAO;AACT;;;AEkBO,IAAM,oBAAN,MAAwB;AAAA,EACpB;AAAA,EACQ;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,WAAmB,UAAoC,CAAC,GAAG;AACrE,SAAK,YAAY;AACjB,SAAK,OAAO,IAAI,WAAW,QAAQ,WAAW,kBAAkB,QAAQ,aAAa,GAAM;AAC3F,SAAK,YAAY,QAAQ;AACzB,SAAK,iBAAiB,OAAO,KAAK,QAAQ,iBAAiB,iBAAiB,WAAW;AAAA,EACzF;AAAA;AAAA;AAAA,EAIA,eAAuB;AACrB,WAAO,qBAAqB,KAAK,WAAW,KAAK,SAAS;AAAA,EAC5D;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,SAAS,YAAoB,WAA4C;AAC7E,UAAM,oBAAoB,aAAa,KAAK,aAAa;AACzD,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,KAAK,KAAK,SAAS,aAAa;AAAA,QAC3C,aAAa;AAAA,QACb,YAAY;AAAA,QACZ,YAAY,KAAK;AAAA,MACnB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,SAAS,eAAe,eAAe,IAAI,UAAU,OAAO,GAAG;AACrE,aAAO,EAAE,OAAO,OAAO,SAAS,kBAAkB,MAAM,IAAI,QAAQ,SAAS;AAAA,IAC/E;AAEA,UAAM,SAAwB;AAAA,MAC5B,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,MACd,OAAO,KAAK,SAAS;AAAA,MACrB,WAAW,KAAK,cAAc;AAAA,MAC9B,QAAQ;AAAA,IACV;AACA,QAAI,OAAO,SAAS,KAAK,OAAO;AAC9B,gBAAU,KAAK,WAAW,YAAY,KAAK,OAAO,KAAK,SAAS;AAAA,IAClE;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,OAAO,YAAoB,WAAoB,UAAyB,CAAC,GAA2B;AACxG,UAAM,oBAAoB,aAAa,KAAK,aAAa;AACzD,UAAM,eAAe,QAAQ,gBAAgB;AAE7C,QAAI,cAAc;AAChB,YAAM,SAAS,UAAU,KAAK,WAAW,KAAK,SAAS;AACvD,UAAI,UAAU,OAAO,gBAAgB,YAAY;AAC/C,YAAI;AACF,gBAAM,UAAU,YAAY,OAAO,OAAO,KAAK,gBAAgB;AAAA,YAC7D,oBAAoB;AAAA,YACpB,mBAAmB;AAAA,YACnB,mBAAmB,KAAK;AAAA,YACxB,KAAK,QAAQ;AAAA,UACf,CAAC;AACD,iBAAO;AAAA,YACL,OAAO;AAAA,YACP,SAAS;AAAA,YACT,OAAO,QAAQ,SAAS;AAAA,YACxB,WAAW,QAAQ,sBAAsB;AAAA,YACzC,QAAQ;AAAA,UACV;AAAA,QACF,SAAS,KAAK;AACZ,cAAI,EAAE,eAAe,YAAa,OAAM;AAAA,QAE1C;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,KAAK,KAAK,SAAS,WAAW;AAAA,QACzC,aAAa;AAAA,QACb,YAAY;AAAA,QACZ,YAAY,KAAK;AAAA,MACnB,CAAC;AAAA,IACH,QAAQ;AACN,aAAO,EAAE,OAAO,OAAO,SAAS,qCAAqC,QAAQ,qBAAqB;AAAA,IACpG;AAEA,UAAM,SAAwB;AAAA,MAC5B,OAAO,KAAK;AAAA,MACZ,SAAS,KAAK;AAAA,MACd,OAAO,KAAK,SAAS;AAAA,MACrB,WAAW,KAAK,cAAc;AAAA,MAC9B,QAAQ;AAAA,IACV;AACA,QAAI,OAAO,SAAS,KAAK,OAAO;AAC9B,gBAAU,KAAK,WAAW,YAAY,KAAK,OAAO,KAAK,SAAS;AAAA,IAClE,WAAW,CAAC,OAAO,OAAO;AAGxB,iBAAW,KAAK,WAAW,KAAK,SAAS;AAAA,IAC3C;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,WAAW,YAAoB,WAA4C;AAC/E,UAAM,oBAAoB,aAAa,KAAK,aAAa;AACzD,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,KAAK,KAAK,SAAS,eAAe;AAAA,QAC7C,aAAa;AAAA,QACb,YAAY;AAAA,QACZ,YAAY,KAAK;AAAA,MACnB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,SAAS,eAAe,eAAe,IAAI,UAAU,OAAO,GAAG;AACrE,aAAO,EAAE,OAAO,OAAO,SAAS,kBAAkB,MAAM,IAAI,QAAQ,SAAS;AAAA,IAC/E;AAEA,eAAW,KAAK,WAAW,KAAK,SAAS;AACzC,WAAO,EAAE,OAAO,KAAK,OAAO,SAAS,KAAK,SAAS,QAAQ,SAAS;AAAA,EACtE;AAAA;AAAA;AAAA,EAIA,MAAM,WAAW,WAA0C;AACzD,WAAO,KAAK,UAAU,gBAAgB,SAAS;AAAA,EACjD;AAAA;AAAA,EAGA,MAAM,YAAY,WAA0C;AAC1D,WAAO,KAAK,UAAU,iBAAiB,SAAS;AAAA,EAClD;AAAA,EAEA,MAAc,UAAU,MAAc,WAA0C;AAC9E,UAAM,oBAAoB,aAAa,KAAK,aAAa;AACzD,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,KAAK,KAAK,SAAS,MAAM;AAAA,QACpC,YAAY;AAAA,QACZ,YAAY,KAAK;AAAA,MACnB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,SAAS,eAAe,eAAe,IAAI,UAAU,OAAO,GAAG;AACrE,aAAO,EAAE,QAAQ,QAAQ,UAAU,GAAG,SAAS,kBAAkB,MAAM,GAAG;AAAA,IAC5E;AACA,WAAO;AAAA,MACL,QAAQ,KAAK;AAAA,MACb,UAAW,KAAK,aAAwB;AAAA,MACxC,WAAY,KAAK,cAAyB;AAAA,MAC1C,SAAU,KAAK,WAAsB;AAAA,IACvC;AAAA,EACF;AACF;","names":["existsSync","mkdirSync","readFileSync","writeFileSync","join","join","existsSync","readFileSync","mkdirSync","writeFileSync"]}

package/package.json

@@ -0,0 +1,52 @@
+{
+  "name": "sublimekeys",
+  "version": "0.1.0",
+  "description": "Official Node.js/Electron SDK for SublimeKeys — license activation, verification, and offline signed-lease checks with zero runtime dependencies.",
+  "type": "module",
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "scripts": {
+    "build": "tsup",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.test.json"
+  },
+  "keywords": [
+    "license",
+    "licensing",
+    "sublimekeys",
+    "electron",
+    "software-licensing",
+    "ed25519",
+    "offline-verification"
+  ],
+  "license": "MIT",
+  "author": "Sublimearts.io",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Volume00/sublimekeys-node.git"
+  },
+  "homepage": "https://keys.sublimearts.io",
+  "bugs": {
+    "url": "https://github.com/Volume00/sublimekeys-node/issues"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.2",
+    "tsup": "^8.3.5",
+    "typescript": "^5.7.2",
+    "vitest": "^4.1.10"
+  }
+}