zklicensing 0.1.0-beta.0

package/build/contractInterface.js

@@ -0,0 +1,213 @@
+// Copyright (c) 2025-2026 zkLicensing project developers
+// All rights reserved.
+/**
+ * contractInterface.ts
+ *
+ * Public contract interface: event Structs, slot/grace constants, duration
+ * helpers, and a minimal `LicensingAppEventsContract` SmartContract subclass
+ * that has the events declaration but no @method bodies.
+ *
+ * The full `LicensingApp` (with provable method bodies) lives in the private
+ * zklicensing-app package; only the things needed to decode events and reason
+ * about durations are published here so a public verify service can replay
+ * the archive without pulling in the contract source.
+ *
+ * `CANONICAL_VK_HASH` and `CANONICAL_LICENSE_PROOF_VK_HASH` are the
+ * verification-key hashes of the two published circuits — `LicensingApp`
+ * (the on-chain zkApp) and `LicenseOwnershipProgram` (the ownership
+ * challenge/response `ZkProgram`), respectively. Both are hand-maintained
+ * constants — bump them whenever the corresponding circuit changes and
+ * rerun the keeper's boot assertion (see zklicensing-app/src/keeperService.ts)
+ * / the verify service's `ensureCompiled()` check to catch drift.
+ */
+import { declareState, fetchAccount, Field, PublicKey, SmartContract, Struct, UInt32, UInt64, MerkleMap } from 'o1js';
+// ------------------------------------------------------------
+// EVENT STRUCTS
+// ------------------------------------------------------------
+// Struct() returns a class whose type references o1js internals that fall
+// outside this package's rootDir (npm hoists o1js to the workspace root).
+// Annotating each export as `any` keeps tsc from inferring (and therefore
+// emitting) those internal type references. Consumers get full typing through
+// the hand-written contractInterface.d.ts shim.
+//
+// The clean alternative — `export class X extends Struct({...}) {}` as the
+// mina-fungible-token repo does — only works when o1js sits inside rootDir,
+// which a workspace member can't guarantee.
+export const LicenseIssuedEvent = Struct({
+    licenseHash: Field,
+    buyer: PublicKey,
+    amount: UInt64,
+    slot: UInt32,
+    expirySlot: UInt32,
+});
+export const ExpiryUpdateEvent = Struct({
+    licenseHash: Field,
+    newExpiry: UInt32,
+});
+export const PriceUpdatedEvent = Struct({
+    priceMonthly: UInt64,
+    priceYearly: UInt64,
+    priceFiveYear: UInt64,
+});
+export const AppCreatedEvent = Struct({
+    vendor: PublicKey,
+});
+// Emitted by `migrateLicense` when a license issued under an ancestor
+// deployment is re-minted into this deployment at zero payment. `licenseHash`
+// is stable across all deployments because the buyer's derived hash is what
+// identifies the license; `expirySlot` is copied verbatim from the ancestor's
+// licensesRoot entry; `ancestorGen` is the generation index the migration
+// resolved against (needed so archive replay and auditors can trace which
+// frozen root supplied the entry — skip-generation migrations are one-hop).
+export const LicenseMigratedEvent = Struct({
+    licenseHash: Field,
+    expirySlot: UInt32,
+    ancestorGen: UInt32,
+});
+// ------------------------------------------------------------
+// CONSTANTS (slot math — 90 s/slot after Mesa upgrade)
+// ------------------------------------------------------------
+export const MONTHLY_SLOTS_N = 28_800; // 30 days × 24 × 40
+export const ONE_YEAR_SLOTS_N = 350_640; // 365.25 days × 24 × 40 (Julian year)
+export const FIVE_YEAR_SLOTS_N = 1_753_200; // 5 × ONE_YEAR_SLOTS_N
+export const REFUND_WINDOW_N = 13_440;
+export const GRACE_PERIOD_N = 6_720;
+export const MS_PER_SLOT_N = 90_000; // Mesa slot duration in ms
+export const SLOTS_PER_DAY_N = 960; // 86_400_000 / MS_PER_SLOT_N
+// Slot tolerance for the globalSlotSinceGenesis precondition. Applied uniformly to
+// every method that reads currentSlot. 40 slots × 90 s = 1 hour — sized to
+// clear the honest-user prove+wallet+mempool latency envelope. The refund vs
+// release windows stay disjoint by construction: requestRefund asserts against
+// the lower bound (currentSlot ≤ purchaseSlot + REFUND_WINDOW), releaseFunds
+// asserts against a threshold shifted by +TOLERANCE_WINDOW so neither can
+// land on the same real slot as the other. See AUDIT_BRIEF.md §7.
+export const TOLERANCE_WINDOW_N = 40;
+export const EMPTY = Field(0);
+export const EMPTY_ROOT = new MerkleMap().getRoot();
+// ------------------------------------------------------------
+// DURATION HELPERS
+// ------------------------------------------------------------
+export const DURATION_LABELS = ['1 Month', '1 Year', '5 Years'];
+export const DURATION_INDEX = { '1 Month': 0, '1 Year': 1, '5 Years': 2 };
+export function durationSlotsFromLabel(label) {
+    if (label === '1 Month')
+        return MONTHLY_SLOTS_N;
+    if (label === '1 Year')
+        return ONE_YEAR_SLOTS_N;
+    if (label === '5 Years')
+        return FIVE_YEAR_SLOTS_N;
+    return null;
+}
+export function durationIndexFromLabel(label) {
+    if (label === '1 Month')
+        return 0;
+    if (label === '1 Year')
+        return 1;
+    if (label === '5 Years')
+        return 2;
+    return null;
+}
+export function durationLabelFromIndex(idx) {
+    return DURATION_LABELS[idx] ?? null;
+}
+// ------------------------------------------------------------
+// EVENTS-ONLY CONTRACT
+//
+// A SmartContract subclass with the same `events: { ... }` declaration as
+// LicensingApp but no `@method` bodies. Used by archive-replay code to call
+// `.fetchEvents()` without depending on the private circuit source.
+// ------------------------------------------------------------
+export class LicensingAppEventsContract extends SmartContract {
+    events = {
+        appCreated: AppCreatedEvent,
+        licenseIssued: LicenseIssuedEvent,
+        licenseIssuedNoEscrow: LicenseIssuedEvent,
+        licenseRenewed: ExpiryUpdateEvent,
+        licenseMigrated: LicenseMigratedEvent,
+        refundIssued: Field,
+        fundsReleased: Field,
+        priceUpdated: PriceUpdatedEvent,
+    };
+}
+// State-slot layout mirrors LicensingApp's declareState(). Read-only from here
+// — no @method bodies exist. Consumers use `.version.get()`, `.licensesRoot.get()`
+// etc. after fetchAccount(). `pricesPacked` is a single Field with the three
+// UInt64 tier prices packed as [pM | pY<<64 | pF<<128]; unpack with
+// `unpackPrices` if you need the individual tiers off-chain.
+declareState(LicensingAppEventsContract, {
+    licensesRoot: Field,
+    vendor: PublicKey,
+    escrowRoot: Field,
+    pricesPacked: Field,
+    version: UInt32,
+    ancestorsRoot: Field,
+});
+// Off-chain mirror of the in-circuit price packing (see LicensingApp.ts). Kept
+// here so the events service can decode `pricesPacked` slots without pulling
+// the private contract source.
+export function unpackPrices(packed) {
+    const raw = packed.toBigInt();
+    const mask = (1n << 64n) - 1n;
+    return {
+        priceMonthly: UInt64.from(raw & mask),
+        priceYearly: UInt64.from((raw >> 64n) & mask),
+        priceFiveYear: UInt64.from((raw >> 128n) & mask),
+    };
+}
+// ------------------------------------------------------------
+// SUPPORTED SOURCE VERSIONS
+//
+// On-chain `version` slot is set at init() and can never change (setPermissions
+// is impossible; setVerificationKey is impossibleDuringCurrentVersion). A
+// keeper / verifier that only understands v1 state decodes must refuse to serve
+// a zkApp deployed from a different source revision — otherwise it could
+// mis-decode events or feed a stale state format to the verifier.
+//
+// Add new versions here once the corresponding decoder / verifier code path
+// lands. Never remove: dropping a version is a support-removal decision that
+// belongs in a release note, not silent breakage.
+// ------------------------------------------------------------
+export const SUPPORTED_LICENSING_APP_VERSIONS = [1];
+// Read the immutable `version` slot from a deployed LicensingApp. Returns null
+// when the account is not (yet) a zkApp — caller decides whether to retry
+// (deploy still pending) or reject (wrong address).
+export async function fetchLicensingAppVersion(zkAppAddress) {
+    const pub = PublicKey.fromBase58(zkAppAddress);
+    await fetchAccount({ publicKey: pub });
+    const contract = new LicensingAppEventsContract(pub);
+    try {
+        const v = contract.version.get();
+        return Number(v.toString());
+    }
+    catch {
+        return null;
+    }
+}
+// ------------------------------------------------------------
+// CANONICAL VK HASHES
+//
+// Per-generation, append-only. The keeper boots with `LicensingApp.compile()`
+// and asserts the resulting VK hash matches `CANONICAL_VK_HASH` (the current
+// generation's row); the verify service resolves an address's generation via
+// AppRecord.deploymentHistory and asserts the on-chain VK hash matches
+// `CANONICAL_VK_HASHES[generation]`. Retired-generation licenses (e.g. a
+// 5-year buyer whose license lives on v1 after the platform bumped to v2/v3)
+// continue to verify because the historical row is still present. A genuine
+// old circuit deployed at a fresh address fails: the address is not in any
+// `deploymentHistory[]`, so the resolver returns null and verify rejects.
+//
+// Rules:
+//   - Append the new generation's row at each hardfork migration; never
+//     delete historical rows.
+//   - Bump `CURRENT_GENERATION` to the new key alongside the row.
+//   - `CANONICAL_VK_HASH` is derived from the record — drift test and keeper
+//     boot-assert are unchanged.
+// ------------------------------------------------------------
+export const CANONICAL_VK_HASHES = {
+    1: '25510637873522061606403949338800808972643356911784243535869508122414992770753',
+    // 2: '…' — append at each hardfork migration, never delete.
+};
+export const CURRENT_GENERATION = 1;
+export const CANONICAL_VK_HASH = CANONICAL_VK_HASHES[CURRENT_GENERATION];
+export const CANONICAL_LICENSE_PROOF_VK_HASH = '6592142093294558010952934797827640785154417146015648013584661926355710165692';
+//# sourceMappingURL=contractInterface.js.map

package/build/countryStats.d.ts

@@ -0,0 +1,37 @@
+/**
+ * countryStats.ts
+ *
+ * Buyer-country breakdown of a vendor's revenue, bucketed by UTC calendar year.
+ * Structured for tax reporting: one row per (year, appId, countryCode) with
+ * license count + the vendor's cut in MINA. Both the keeper (source of
+ * truth for /stats) and the dashboard UI import from here so the numbers can
+ * never drift between them.
+ *
+ * Purchases attribute to the year the buyer confirmed on-chain (LicenseRecord
+ * `createdAt` ISO timestamp). Legacy records that predate `createdAt` fall
+ * back to slot-derived time. Renewals attribute to the renewal year via
+ * `renewals[i].slot → time`. Refunded purchases contribute zero revenue but
+ * still count the license (a purchase happened even if the money was
+ * returned) — remove `count` from refunded rows client-side if you want a
+ * strictly net view.
+ *
+ * Browser-safe: pure computation, no fs, no fetch.
+ */
+import type { LicenseRecord } from './licenseRecord.js';
+export type CountryBucket = {
+    count: number;
+    revenueMina: number;
+};
+export type CountryYearBreakdown = {
+    aggregate: Record<string, CountryBucket>;
+    byApp: Record<string, Record<string, CountryBucket>>;
+};
+export type CountryBreakdown = {
+    years: number[];
+    byYear: Record<number, CountryYearBreakdown>;
+};
+export declare function computeCountryBreakdown(apps: {
+    appId: string;
+    zkAppAddress: string;
+}[], records: LicenseRecord[], currentSlot: number, nowMs: number): CountryBreakdown;
+//# sourceMappingURL=countryStats.d.ts.map

package/build/countryStats.js

@@ -0,0 +1,89 @@
+// Copyright (c) 2025-2026 zkLicensing project developers
+// All rights reserved.
+// LicensingApp charges a 2 % platform fee (200 basis points); the vendor
+// receives the remaining 9 800 bps. Keep this in sync with the on-chain
+// constant in LicensingApp.
+const PLATFORM_FEE_BASIS_POINTS = 200n;
+const VENDOR_BPS = 10000n - PLATFORM_FEE_BASIS_POINTS;
+// 90 s/slot post-Mesa. Used only for slot→time fallback attribution.
+const SLOT_DURATION_MS = 90_000;
+export function computeCountryBreakdown(apps, records, currentSlot, nowMs) {
+    const appByAddress = new Map(apps.map(a => [a.zkAppAddress, a.appId]));
+    const byYear = {};
+    const yearSet = new Set();
+    const ensureYear = (year) => {
+        let yb = byYear[year];
+        if (!yb) {
+            yb = { aggregate: {}, byApp: {} };
+            byYear[year] = yb;
+            yearSet.add(year);
+        }
+        return yb;
+    };
+    const ensureAppBucket = (yb, appId) => {
+        let ab = yb.byApp[appId];
+        if (!ab) {
+            ab = {};
+            yb.byApp[appId] = ab;
+        }
+        return ab;
+    };
+    const add = (bucket, code, count, revenueNano) => {
+        let b = bucket[code];
+        if (!b) {
+            b = { count: 0, revenueMina: 0 };
+            bucket[code] = b;
+        }
+        b.count += count;
+        b.revenueMina += Number(revenueNano) / 1e9;
+    };
+    const slotToYear = (slot) => {
+        if (currentSlot <= 0)
+            return null;
+        const ms = nowMs - (currentSlot - slot) * SLOT_DURATION_MS;
+        const y = new Date(ms).getUTCFullYear();
+        return Number.isFinite(y) ? y : null;
+    };
+    for (const r of records) {
+        const appId = appByAddress.get(r.zkAppAddress);
+        if (!appId)
+            continue;
+        const country = r.buyerCountry && /^[A-Z]{2}$/.test(r.buyerCountry) ? r.buyerCountry : '??';
+        // Purchase — attribute to the year of confirm-on-chain (createdAt).
+        // Fallback: slot-derived time for legacy records that lack createdAt.
+        let purchaseYear = null;
+        if (r.createdAt) {
+            const y = new Date(r.createdAt).getUTCFullYear();
+            if (Number.isFinite(y))
+                purchaseYear = y;
+        }
+        if (purchaseYear === null && r.purchaseSlot > 0) {
+            purchaseYear = slotToYear(r.purchaseSlot);
+        }
+        if (purchaseYear !== null) {
+            const yb = ensureYear(purchaseYear);
+            const ab = ensureAppBucket(yb, appId);
+            const purchaseCut = (!r.refunded && r.purchaseAmount && r.purchaseAmount !== '0')
+                ? (BigInt(r.purchaseAmount) * VENDOR_BPS) / 10000n
+                : 0n;
+            add(ab, country, 1, purchaseCut);
+            add(yb.aggregate, country, 1, purchaseCut);
+        }
+        // Renewals — revenue only (no license count), attributed to renewal year.
+        for (const rn of r.renewals ?? []) {
+            const y = slotToYear(rn.slot);
+            if (y === null)
+                continue;
+            const yb = ensureYear(y);
+            const ab = ensureAppBucket(yb, appId);
+            const cut = (BigInt(rn.amount) * VENDOR_BPS) / 10000n;
+            add(ab, country, 0, cut);
+            add(yb.aggregate, country, 0, cut);
+        }
+    }
+    return {
+        years: Array.from(yearSet).sort((a, b) => b - a),
+        byYear,
+    };
+}
+//# sourceMappingURL=countryStats.js.map

package/build/deployClient.d.ts

@@ -0,0 +1,168 @@
+/**
+ * deployClient.ts
+ *
+ * Browser-safe client for the deploy flow. Mirrors the buy / renew / refund
+ * client shape: `proveDeploy` posts to the keeper's `/prove/deploy` endpoint
+ * and returns the atomic deploy+initialize tx already signed with the
+ * throwaway zkApp key. The vendor's wallet then adds the fee-payer signature
+ * and broadcasts.
+ *
+ * The atomic bundling is what makes single-shot initialization safe:
+ * `provenTxJson` holds both `zkApp.deploy()` and `zkApp.initialize()`
+ * AccountUpdates in the same transaction, and the keeper generates a
+ * throwaway zkApp keypair per request that is discarded before the tx is
+ * returned — so the target address is not observable to an attacker until
+ * the initialize AU inside is already signed and locked to `(vendor,
+ * prices)`. Combined with the in-circuit `vendor.requireEquals(empty())`
+ * precondition on `initialize()`, this yields a one-shot init per account.
+ *
+ * Also exports admin-side `redeployApp` / `redeployAll` for the platform
+ * operator to trigger post-hardfork v1→v2 migrations via the keeper's
+ * `/admin/redeploy*` endpoints (bearer-token auth).
+ */
+export type ProveDeployRequest = {
+    keeperUrl: string;
+    senderPublicKey: string;
+    vendorAddress: string;
+    priceMonthlyMina: number;
+    priceYearlyMina: number;
+    priceFiveYearMina: number;
+    fetcher?: typeof fetch;
+    signal?: AbortSignal;
+};
+export type ProveDeployResponse = {
+    provenTxJson: string;
+    verificationKeyHash: string;
+    zkAppAddress: string;
+};
+export type DeployStatus = {
+    status: 'unknown' | 'pending' | 'confirmed' | 'failed';
+    landedAtSlot?: number;
+    elapsedMs?: number;
+};
+export declare function proveDeploy(req: ProveDeployRequest): Promise<ProveDeployResponse>;
+export type PollDeployStatusOptions = {
+    keeperUrl: string;
+    zkAppAddress: string;
+    fetcher?: typeof fetch;
+    intervalMs?: number;
+    timeoutMs?: number;
+    signal?: AbortSignal;
+    onTick?: (status: DeployStatus) => void;
+};
+export declare function pollDeployStatus(opts: PollDeployStatusOptions): Promise<DeployStatus>;
+export type RedeployAppRequest = {
+    keeperUrl: string;
+    appId: string;
+    adminToken: string;
+    force?: boolean;
+    fetcher?: typeof fetch;
+    signal?: AbortSignal;
+};
+export type RedeployAppResponse = {
+    ok: true;
+    zkAppAddress: string;
+    txHash: string;
+    verificationKeyHash: string;
+    onChainVersion: number;
+    forcedEscrowNonEmpty?: true;
+};
+export type RedeployAllRequest = {
+    keeperUrl: string;
+    adminToken: string;
+    force?: boolean;
+    fetcher?: typeof fetch;
+    signal?: AbortSignal;
+};
+export type RedeployAllResponse = {
+    ok: true;
+    count: number;
+    succeeded: number;
+    results: Array<{
+        appId: string;
+        ok: true;
+        zkAppAddress: string;
+        txHash: string;
+        verificationKeyHash: string;
+        onChainVersion: number;
+        forcedEscrowNonEmpty?: true;
+    } | {
+        appId: string;
+        ok: false;
+        error: string;
+    }>;
+};
+export declare function redeployApp(req: RedeployAppRequest): Promise<RedeployAppResponse>;
+export declare function redeployAll(req: RedeployAllRequest): Promise<RedeployAllResponse>;
+export type VendorRedeployPreflight = {
+    ok: boolean;
+    freezeSlotConfigured: boolean;
+    appExists: boolean;
+    status?: 'active' | 'inactive' | 'pending';
+    refundWindow: {
+        closed: boolean;
+        opensAtSlot: number;
+        currentSlot: number;
+    };
+    onChainAccount: {
+        exists: boolean;
+    };
+    escrow: {
+        empty: boolean;
+    };
+    version: {
+        current: number;
+        supported: boolean;
+        supportedList: readonly number[];
+    };
+    reasons: string[];
+};
+export declare function fetchVendorRedeployPreflight(opts: {
+    keeperUrl: string;
+    appId: string;
+    fetcher?: typeof fetch;
+    signal?: AbortSignal;
+}): Promise<VendorRedeployPreflight>;
+export type VendorRedeployChallenge = {
+    nonce: string;
+    expiresAt: number;
+};
+export declare function getVendorRedeployChallenge(opts: {
+    keeperUrl: string;
+    appId: string;
+    fetcher?: typeof fetch;
+    signal?: AbortSignal;
+}): Promise<VendorRedeployChallenge>;
+export type ProveVendorRedeployRequest = {
+    keeperUrl: string;
+    appId: string;
+    nonce: string;
+    signature: {
+        field: string;
+        scalar: string;
+    };
+    senderPublicKey: string;
+    force?: boolean;
+    fetcher?: typeof fetch;
+    signal?: AbortSignal;
+};
+export type ProveVendorRedeployResponse = {
+    provenTxJson: string;
+    zkAppAddress: string;
+    verificationKeyHash: string;
+    redeployId: string;
+    forcedEscrowNonEmpty?: true;
+};
+export declare function proveVendorRedeploy(req: ProveVendorRedeployRequest): Promise<ProveVendorRedeployResponse>;
+export type RegisterVendorRedeployRequest = {
+    keeperUrl: string;
+    appId: string;
+    redeployId: string;
+    txHash: string;
+    fetcher?: typeof fetch;
+    signal?: AbortSignal;
+};
+export declare function registerVendorRedeploy(req: RegisterVendorRedeployRequest): Promise<{
+    ok: true;
+}>;
+//# sourceMappingURL=deployClient.d.ts.map

package/build/deployClient.js

@@ -0,0 +1,172 @@
+// Copyright (c) 2025-2026 zkLicensing project developers
+// All rights reserved.
+function baseUrl(url) {
+    return url.replace(/\/+$/, '');
+}
+async function readJsonError(resp) {
+    try {
+        const body = await resp.json();
+        if (typeof body.error === 'string')
+            return body.error;
+    }
+    catch { /* body wasn't JSON */ }
+    return `HTTP ${resp.status}`;
+}
+// POST /prove/deploy — keeper generates the throwaway zkApp keypair, assembles
+// the deploy+initialize tx, proves it, and signs the zkApp AccountUpdate with
+// the throwaway key. The caller forwards `provenTxJson` to the vendor's wallet
+// for the fee-payer signature.
+//
+// At least one of the three prices must be > 0 (enforced by the keeper *and*
+// by the circuit's `initialize()`).
+export async function proveDeploy(req) {
+    const fetcher = req.fetcher ?? fetch;
+    const resp = await fetcher(`${baseUrl(req.keeperUrl)}/prove/deploy`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        signal: req.signal,
+        body: JSON.stringify({
+            senderPublicKey: req.senderPublicKey,
+            vendorAddress: req.vendorAddress,
+            priceMonthlyMina: req.priceMonthlyMina,
+            priceYearlyMina: req.priceYearlyMina,
+            priceFiveYearMina: req.priceFiveYearMina,
+        }),
+    });
+    if (!resp.ok)
+        throw new Error(await readJsonError(resp));
+    return await resp.json();
+}
+// Polls GET /deploy/status until it returns a terminal state ('confirmed' or
+// 'failed') or the timeout fires. 'unknown' means the keeper hasn't seen the
+// tx yet (register step not called or watch not armed).
+export async function pollDeployStatus(opts) {
+    const fetcher = opts.fetcher ?? fetch;
+    const interval = opts.intervalMs ?? 3_000;
+    const timeout = opts.timeoutMs ?? 10 * 60 * 1000;
+    const deadline = Date.now() + timeout;
+    const url = `${baseUrl(opts.keeperUrl)}/deploy/status?zkAppAddress=${encodeURIComponent(opts.zkAppAddress)}`;
+    while (true) {
+        if (opts.signal?.aborted)
+            throw new Error('pollDeployStatus aborted');
+        let status = { status: 'unknown' };
+        try {
+            const resp = await fetcher(url, { signal: opts.signal });
+            if (resp.ok)
+                status = await resp.json();
+        }
+        catch { /* transient network — try again on next tick */ }
+        opts.onTick?.(status);
+        if (status.status === 'confirmed' || status.status === 'failed')
+            return status;
+        if (Date.now() >= deadline)
+            return status;
+        await new Promise((r) => setTimeout(r, interval));
+    }
+}
+function adminHeaders(token) {
+    return {
+        'Content-Type': 'application/json',
+        'Authorization': `Bearer ${token}`,
+    };
+}
+// POST /admin/redeploy/:appId — one-shot migration for a single app. Rejects
+// with a descriptive error if any keeper-side guard fails (409) or the deploy
+// itself throws (500). The returned `zkAppAddress` is the *new* v2 address; the
+// old one stays on chain but is no longer referenced by keeper records.
+export async function redeployApp(req) {
+    const fetcher = req.fetcher ?? fetch;
+    const resp = await fetcher(`${baseUrl(req.keeperUrl)}/admin/redeploy/${encodeURIComponent(req.appId)}`, {
+        method: 'POST',
+        headers: adminHeaders(req.adminToken),
+        signal: req.signal,
+        body: JSON.stringify(req.force ? { force: true } : {}),
+    });
+    if (!resp.ok)
+        throw new Error(await readJsonError(resp));
+    return await resp.json();
+}
+// POST /admin/redeploy-all — iterate every registered app and attempt migration.
+// Idempotent: apps already migrated surface as ok:false with a clear error, so
+// a rerun after a partial failure retries only the remaining ones. Callers
+// should inspect `results` for per-app outcomes rather than relying on the
+// top-level `ok`, which is always true unless the whole request failed.
+export async function redeployAll(req) {
+    const fetcher = req.fetcher ?? fetch;
+    const resp = await fetcher(`${baseUrl(req.keeperUrl)}/admin/redeploy-all`, {
+        method: 'POST',
+        headers: adminHeaders(req.adminToken),
+        signal: req.signal,
+        body: JSON.stringify(req.force ? { force: true } : {}),
+    });
+    if (!resp.ok)
+        throw new Error(await readJsonError(resp));
+    return await resp.json();
+}
+// GET /vendor/redeploy/:appId/preflight — read-only guard status. No nonce
+// consumed, no signature required. UI decides button state from the returned
+// fields; 404 means the app itself is unknown (a distinct failure mode from a
+// known app failing individual guards).
+export async function fetchVendorRedeployPreflight(opts) {
+    const fetcher = opts.fetcher ?? fetch;
+    const resp = await fetcher(`${baseUrl(opts.keeperUrl)}/vendor/redeploy/${encodeURIComponent(opts.appId)}/preflight`, {
+        signal: opts.signal,
+    });
+    if (!resp.ok)
+        throw new Error(await readJsonError(resp));
+    return await resp.json();
+}
+// GET /vendor/redeploy/:appId/challenge — mint a one-shot nonce that the
+// vendor's wallet signs. The nonce is bound to the appId and expires in 60s;
+// consumed on /prove.
+export async function getVendorRedeployChallenge(opts) {
+    const fetcher = opts.fetcher ?? fetch;
+    const resp = await fetcher(`${baseUrl(opts.keeperUrl)}/vendor/redeploy/${encodeURIComponent(opts.appId)}/challenge`, {
+        signal: opts.signal,
+    });
+    if (!resp.ok)
+        throw new Error(await readJsonError(resp));
+    return await resp.json();
+}
+// POST /vendor/redeploy/:appId/prove — keeper verifies the nonce + signature
+// against the on-chain vendor of the app, runs all redeploy guards, generates
+// a throwaway zkApp keypair, builds and proves the deploy+initialize tx, and
+// signs the zkApp AU with the throwaway key. Returns the tx JSON for the
+// vendor's wallet to add the fee-payer signature and broadcast.
+export async function proveVendorRedeploy(req) {
+    const fetcher = req.fetcher ?? fetch;
+    const resp = await fetcher(`${baseUrl(req.keeperUrl)}/vendor/redeploy/${encodeURIComponent(req.appId)}/prove`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        signal: req.signal,
+        body: JSON.stringify({
+            nonce: req.nonce,
+            signature: req.signature,
+            senderPublicKey: req.senderPublicKey,
+            ...(req.force ? { force: true } : {}),
+        }),
+    });
+    if (!resp.ok)
+        throw new Error(await readJsonError(resp));
+    return await resp.json();
+}
+// POST /vendor/redeploy/:appId/register — arm the keeper's deploy-watcher on
+// the new address. On confirmation the keeper mutates AppRecord to promote
+// the new deployment (push old to deploymentHistory[], overwrite live fields,
+// clear event-sync cursors). Idempotent to duplicate calls (the watcher
+// checks whether one is already armed for the address). Poll GET
+// /deploy/status?zkAppAddress=<new> — or use pollDeployStatus — for landing
+// progress, same as first-time deploys.
+export async function registerVendorRedeploy(req) {
+    const fetcher = req.fetcher ?? fetch;
+    const resp = await fetcher(`${baseUrl(req.keeperUrl)}/vendor/redeploy/${encodeURIComponent(req.appId)}/register`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        signal: req.signal,
+        body: JSON.stringify({ redeployId: req.redeployId, txHash: req.txHash }),
+    });
+    if (!resp.ok)
+        throw new Error(await readJsonError(resp));
+    return await resp.json();
+}
+//# sourceMappingURL=deployClient.js.map