zklicensing 0.1.0-beta.0

package/build/ownership.js

@@ -0,0 +1,147 @@
+// Copyright (c) 2025-2026 zkLicensing project developers
+// All rights reserved.
+/**
+ * ownership.ts
+ *
+ * Ownership-token helpers and a small in-memory nonce store for the
+ * challenge-response /verify flow.
+ *
+ * Replay-resistance: the LicenseProof's public input binds (licenseHash,
+ * nonce). The keeper hands out a nonce, the client proves against it, the
+ * keeper consumes the nonce on the way through. Tokens are HMAC-SHA256 of
+ * the (zkAppAddress, licenseHash, exp, jti?) tuple so signature validation
+ * is purely cryptographic — no server-side lookup, restart-safe as long as
+ * the HMAC key persists.
+ *
+ * Session tracking: the optional `jti` field lets the caller run a
+ * revocation / concurrency layer on top of the stateless HMAC — the token
+ * is still validated cryptographically, but the caller can also check that
+ * the jti is present in a per-license active-session set. Absent jti keeps
+ * old callers working unchanged (there is no session tracking to begin with,
+ * so nothing needs to migrate).
+ */
+import { createHmac, randomBytes, timingSafeEqual } from 'crypto';
+import { Field } from 'o1js';
+export const OWNERSHIP_CHALLENGE_TTL_MS = 600_000;
+// A device that stays active refreshes via a fresh /challenge + /respond;
+// a lost/uninstalled device burns its slot for at most this long before
+// the server prunes it (see verifyService session store). 7 days keeps
+// re-prove pressure low on daily-use apps while still bounding the recovery
+// window for owners hitting the concurrent-device cap.
+export const OWNERSHIP_TOKEN_TTL_MS = 7 * 24 * 60 * 60 * 1000;
+// Generate a 128-bit random jti. base64url so it drops into token payloads
+// and query strings without escaping.
+export function newJti() {
+    return randomBytes(16).toString('base64url');
+}
+export function createChallengeStore(ttlMs = OWNERSHIP_CHALLENGE_TTL_MS) {
+    const issued = new Map(); // `${lh}:${nonce}` → expiresAt
+    return {
+        issue(licenseHash) {
+            const nonce = Field.random().toString();
+            issued.set(`${licenseHash}:${nonce}`, Date.now() + ttlMs);
+            return { nonce, ttl: ttlMs };
+        },
+        consume(licenseHash, nonce) {
+            const key = `${licenseHash}:${nonce}`;
+            const expiresAt = issued.get(key);
+            if (expiresAt === undefined)
+                return 'unknown';
+            issued.delete(key);
+            if (Date.now() > expiresAt)
+                return 'expired';
+            return 'ok';
+        },
+        size: () => issued.size,
+    };
+}
+// --- token signing -----------------------------------------------------------
+export function signOwnershipToken(key, payload) {
+    const body = Buffer.from(JSON.stringify(payload)).toString('base64url');
+    const mac = createHmac('sha256', key).update(body).digest('base64url');
+    return `${body}.${mac}`;
+}
+export function verifyOwnershipToken(key, token) {
+    const dot = token.indexOf('.');
+    if (dot < 0)
+        return null;
+    const body = token.slice(0, dot);
+    const mac = token.slice(dot + 1);
+    const expected = createHmac('sha256', key).update(body).digest('base64url');
+    const a = Buffer.from(mac);
+    const b = Buffer.from(expected);
+    if (a.length !== b.length || !timingSafeEqual(a, b))
+        return null;
+    try {
+        const payload = JSON.parse(Buffer.from(body, 'base64url').toString('utf8'));
+        if (Date.now() > payload.e)
+            return null;
+        return payload;
+    }
+    catch {
+        return null;
+    }
+}
+export function newOwnershipKey() {
+    return randomBytes(32);
+}
+export function createSessionStore() {
+    // licenseHash → jti → expiresAt
+    const sessions = new Map();
+    const pruneLicense = (licenseHash) => {
+        const perLic = sessions.get(licenseHash);
+        if (!perLic)
+            return undefined;
+        const now = Date.now();
+        for (const [jti, exp] of perLic)
+            if (exp <= now)
+                perLic.delete(jti);
+        if (perLic.size === 0) {
+            sessions.delete(licenseHash);
+            return undefined;
+        }
+        return perLic;
+    };
+    return {
+        insert(licenseHash, jti, exp, cap) {
+            const perLic = pruneLicense(licenseHash) ?? new Map();
+            if (cap > 0 && perLic.size >= cap && !perLic.has(jti)) {
+                return { state: 'at-cap', active: perLic.size };
+            }
+            perLic.set(jti, exp);
+            sessions.set(licenseHash, perLic);
+            return { state: 'ok', active: perLic.size };
+        },
+        has(licenseHash, jti) {
+            const perLic = pruneLicense(licenseHash);
+            return perLic?.has(jti) ?? false;
+        },
+        releaseSeat(licenseHash, jti) {
+            const perLic = sessions.get(licenseHash);
+            if (!perLic)
+                return false;
+            const had = perLic.delete(jti);
+            if (perLic.size === 0)
+                sessions.delete(licenseHash);
+            return had;
+        },
+        reset(licenseHash) {
+            const perLic = sessions.get(licenseHash);
+            if (!perLic)
+                return 0;
+            const n = perLic.size;
+            sessions.delete(licenseHash);
+            return n;
+        },
+        activeCount(licenseHash) {
+            return pruneLicense(licenseHash)?.size ?? 0;
+        },
+        size() {
+            let n = 0;
+            for (const perLic of sessions.values())
+                n += perLic.size;
+            return n;
+        },
+    };
+}
+//# sourceMappingURL=ownership.js.map

package/build/refundClient.d.ts

@@ -0,0 +1,52 @@
+/**
+ * refundClient.ts
+ *
+ * Browser-safe client for the refund flow. Mirrors `buyClient.ts` in shape:
+ * the caller drives the wallet step between `proveRefund` and
+ * `confirmRefund` so the SDK stays wallet-agnostic.
+ *
+ * The 14-day refund window is enforced on the keeper side (returns HTTP 409
+ * when closed) and cross-checked in the circuit; the SDK doesn't second-guess
+ * it locally so a single source of truth stays authoritative.
+ */
+export type ProveRefundRequest = {
+    keeperUrl: string;
+    licenseHash: string;
+    buyerAddress: string;
+    zkAppAddress: string;
+    fetcher?: typeof fetch;
+    signal?: AbortSignal;
+};
+export type ProveRefundResponse = {
+    provenTxJson: string;
+    licenseHash: string;
+};
+export type ConfirmRefundRequest = {
+    keeperUrl: string;
+    zkAppAddress: string;
+    licenseHash: string;
+    txHash: string;
+    fetcher?: typeof fetch;
+    signal?: AbortSignal;
+};
+export declare function proveRefund(req: ProveRefundRequest): Promise<ProveRefundResponse>;
+export declare function confirmRefund(req: ConfirmRefundRequest): Promise<{
+    ok: true;
+}>;
+export type RefundStatus = {
+    status: 'confirmed' | 'pending' | 'unknown';
+    txHash?: string | null;
+    elapsedMs?: number;
+};
+export type PollRefundStatusOptions = {
+    keeperUrl: string;
+    zkAppAddress: string;
+    licenseHash: string;
+    fetcher?: typeof fetch;
+    intervalMs?: number;
+    timeoutMs?: number;
+    signal?: AbortSignal;
+    onTick?: (status: RefundStatus) => void;
+};
+export declare function pollRefundStatus(opts: PollRefundStatusOptions): Promise<RefundStatus>;
+//# sourceMappingURL=refundClient.d.ts.map

package/build/refundClient.js

@@ -0,0 +1,92 @@
+// Copyright (c) 2025-2026 zkLicensing project developers
+// All rights reserved.
+function baseUrl(url) {
+    return url.replace(/\/+$/, '');
+}
+async function readJsonError(resp) {
+    try {
+        const body = await resp.json();
+        if (typeof body.error === 'string')
+            return body.error;
+    }
+    catch { /* body wasn't JSON */ }
+    return `HTTP ${resp.status}`;
+}
+// POST /prove/refund — keeper compiles + proves the refund tx.
+// The keeper 409s when the 14-day window has closed; that error surfaces
+// through the thrown `Error` message.
+export async function proveRefund(req) {
+    const fetcher = req.fetcher ?? fetch;
+    const resp = await fetcher(`${baseUrl(req.keeperUrl)}/prove/refund`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        signal: req.signal,
+        body: JSON.stringify({
+            licenseHash: req.licenseHash,
+            buyerAddress: req.buyerAddress,
+            zkAppAddress: req.zkAppAddress,
+        }),
+    });
+    if (!resp.ok)
+        throw new Error(await readJsonError(resp));
+    return await resp.json();
+}
+// POST /confirm/refund — promotes the in-memory refund intent to a
+// pending (refunded: true) LicenseRecord. Best-effort: if the caller
+// swallows the failure, eventSyncLoop will still pick up the on-chain
+// refund event.
+export async function confirmRefund(req) {
+    const fetcher = req.fetcher ?? fetch;
+    const resp = await fetcher(`${baseUrl(req.keeperUrl)}/confirm/refund`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        signal: req.signal,
+        body: JSON.stringify({
+            zkAppAddress: req.zkAppAddress,
+            licenseHash: req.licenseHash,
+            txHash: req.txHash,
+        }),
+    });
+    if (!resp.ok)
+        throw new Error(await readJsonError(resp));
+    return { ok: true };
+}
+// Polls GET /license/:zkAppAddress/:licenseHash until the refund has landed
+// on-chain (record.status === 'refunded') or the timeout fires. Mirrors
+// pollBuyStatus / pollRenewStatus.
+export async function pollRefundStatus(opts) {
+    const fetcher = opts.fetcher ?? fetch;
+    const interval = opts.intervalMs ?? 10_000;
+    const timeout = opts.timeoutMs ?? 20 * 60 * 1000;
+    const startedAt = Date.now();
+    const deadline = startedAt + timeout;
+    const url = `${baseUrl(opts.keeperUrl)}/license/${encodeURIComponent(opts.zkAppAddress)}/${encodeURIComponent(opts.licenseHash)}`;
+    while (true) {
+        if (opts.signal?.aborted)
+            throw new Error('pollRefundStatus aborted');
+        let status = { status: 'unknown', elapsedMs: Date.now() - startedAt };
+        try {
+            const resp = await fetcher(url, { signal: opts.signal });
+            if (resp.ok) {
+                const body = await resp.json();
+                if (!body.found) {
+                    status = { status: 'unknown', elapsedMs: Date.now() - startedAt };
+                }
+                else if (body.status === 'refunded') {
+                    status = { status: 'confirmed', txHash: body.txHash ?? null, elapsedMs: Date.now() - startedAt };
+                }
+                else {
+                    status = { status: 'pending', txHash: body.txHash ?? null, elapsedMs: Date.now() - startedAt };
+                }
+            }
+        }
+        catch { /* transient network — try again on next tick */ }
+        opts.onTick?.(status);
+        if (status.status === 'confirmed')
+            return status;
+        if (Date.now() >= deadline)
+            return status;
+        await new Promise((r) => setTimeout(r, interval));
+    }
+}
+//# sourceMappingURL=refundClient.js.map

package/build/renewClient.d.ts

@@ -0,0 +1,49 @@
+export type ProveRenewRequest = {
+    keeperUrl: string;
+    licenseHash: string;
+    buyerAddress: string;
+    zkAppAddress: string;
+    duration: 0 | 1 | 2;
+    waiverAccepted: boolean;
+    freezeAfterSlot?: number | null;
+    fetcher?: typeof fetch;
+    signal?: AbortSignal;
+};
+export type ProveRenewResponse = {
+    provenTxJson: string;
+    newExpirySlot: number;
+    licenseHash: string;
+    renewAmount: string;
+    generation: number;
+};
+export type ConfirmRenewRequest = {
+    keeperUrl: string;
+    zkAppAddress: string;
+    licenseHash: string;
+    txHash: string;
+    fetcher?: typeof fetch;
+    signal?: AbortSignal;
+};
+export declare function proveRenew(req: ProveRenewRequest): Promise<ProveRenewResponse>;
+export declare function confirmRenew(req: ConfirmRenewRequest): Promise<{
+    ok: true;
+}>;
+export type RenewStatus = {
+    status: 'confirmed' | 'pending' | 'unknown';
+    expirySlot?: number;
+    txHash?: string | null;
+    elapsedMs?: number;
+};
+export type PollRenewStatusOptions = {
+    keeperUrl: string;
+    zkAppAddress: string;
+    licenseHash: string;
+    newExpirySlot: number;
+    fetcher?: typeof fetch;
+    intervalMs?: number;
+    timeoutMs?: number;
+    signal?: AbortSignal;
+    onTick?: (status: RenewStatus) => void;
+};
+export declare function pollRenewStatus(opts: PollRenewStatusOptions): Promise<RenewStatus>;
+//# sourceMappingURL=renewClient.d.ts.map

package/build/renewClient.js

@@ -0,0 +1,135 @@
+// Copyright (c) 2025-2026 zkLicensing project developers
+// All rights reserved.
+/**
+ * renewClient.ts
+ *
+ * Browser-safe client for the renew flow. Mirrors `buyClient.ts` in shape:
+ * the caller drives the wallet step between `proveRenew` and `confirmRenew`
+ * so the SDK stays wallet-agnostic.
+ *
+ * Unlike buy, renew carries a legally load-bearing `waiverAccepted` flag —
+ * EU/UK CRD Article 16(m) extinguishes the 14-day right of withdrawal only
+ * on the buyer's express affirmative act (consent to immediate delivery +
+ * acknowledgment of loss of withdrawal). We refuse the /prove/renew call
+ * when the flag is false to keep third-party integrators from silently
+ * shipping a UI that omits the waiver gate.
+ *
+ * Also refused pre-network when the keeper's sales-freeze schedule has
+ * fired (salesFrozen === true) — the keeper would 423 the request anyway,
+ * so surfacing the specific message client-side avoids a wasted round-trip.
+ */
+import { resolveFreezeState } from './freezeClient.js';
+function baseUrl(url) {
+    return url.replace(/\/+$/, '');
+}
+async function readJsonError(resp) {
+    try {
+        const body = await resp.json();
+        if (typeof body.error === 'string')
+            return body.error;
+    }
+    catch { /* body wasn't JSON */ }
+    return `HTTP ${resp.status}`;
+}
+// POST /prove/renew — keeper compiles + proves the renew tx.
+// Rejects locally when `waiverAccepted` is false; a network call in that
+// state would be wasted work and would give the caller no signal that the
+// legal precondition was missing. Also rejects when the keeper's freeze
+// has fired — same reasoning.
+export async function proveRenew(req) {
+    if (req.waiverAccepted !== true) {
+        throw new Error('waiverAccepted must be true — Article 16(m) waiver required to renew');
+    }
+    const fetcher = req.fetcher ?? fetch;
+    const freeze = await resolveFreezeState({
+        keeperUrl: req.keeperUrl,
+        freezeAfterSlot: req.freezeAfterSlot,
+        fetcher,
+        signal: req.signal,
+    });
+    if (freeze.salesFrozen) {
+        throw new Error('Sales frozen — new renewals refused ahead of scheduled hardfork migration');
+    }
+    const resp = await fetcher(`${baseUrl(req.keeperUrl)}/prove/renew`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        signal: req.signal,
+        body: JSON.stringify({
+            licenseHash: req.licenseHash,
+            buyerAddress: req.buyerAddress,
+            zkAppAddress: req.zkAppAddress,
+            duration: req.duration,
+        }),
+    });
+    if (!resp.ok)
+        throw new Error(await readJsonError(resp));
+    return await resp.json();
+}
+// POST /confirm/renew — promotes the in-memory renew intent to a pending
+// LicenseRecord. Call this only after the wallet returns a txHash.
+export async function confirmRenew(req) {
+    const fetcher = req.fetcher ?? fetch;
+    const resp = await fetcher(`${baseUrl(req.keeperUrl)}/confirm/renew`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        signal: req.signal,
+        body: JSON.stringify({
+            zkAppAddress: req.zkAppAddress,
+            licenseHash: req.licenseHash,
+            txHash: req.txHash,
+        }),
+    });
+    if (!resp.ok)
+        throw new Error(await readJsonError(resp));
+    return { ok: true };
+}
+// Polls GET /license/:zkAppAddress/:licenseHash until the renew has landed
+// on-chain (pending flipped and new expiry recorded) or the timeout fires.
+// Mirrors pollBuyStatus, except the terminal condition is Mina-side rather
+// than keeper-side buy-watch — renew has no dedicated watch map.
+export async function pollRenewStatus(opts) {
+    const fetcher = opts.fetcher ?? fetch;
+    const interval = opts.intervalMs ?? 10_000;
+    const timeout = opts.timeoutMs ?? 20 * 60 * 1000;
+    const startedAt = Date.now();
+    const deadline = startedAt + timeout;
+    const url = `${baseUrl(opts.keeperUrl)}/license/${encodeURIComponent(opts.zkAppAddress)}/${encodeURIComponent(opts.licenseHash)}`;
+    while (true) {
+        if (opts.signal?.aborted)
+            throw new Error('pollRenewStatus aborted');
+        let status = { status: 'unknown', elapsedMs: Date.now() - startedAt };
+        try {
+            const resp = await fetcher(url, { signal: opts.signal });
+            if (resp.ok) {
+                const body = await resp.json();
+                if (!body.found) {
+                    status = { status: 'unknown', elapsedMs: Date.now() - startedAt };
+                }
+                else if (body.pending === false && (body.expirySlot ?? 0) >= opts.newExpirySlot) {
+                    status = {
+                        status: 'confirmed',
+                        expirySlot: body.expirySlot,
+                        txHash: body.txHash ?? null,
+                        elapsedMs: Date.now() - startedAt,
+                    };
+                }
+                else {
+                    status = {
+                        status: 'pending',
+                        expirySlot: body.expirySlot,
+                        txHash: body.txHash ?? null,
+                        elapsedMs: Date.now() - startedAt,
+                    };
+                }
+            }
+        }
+        catch { /* transient network — try again on next tick */ }
+        opts.onTick?.(status);
+        if (status.status === 'confirmed')
+            return status;
+        if (Date.now() >= deadline)
+            return status;
+        await new Promise((r) => setTimeout(r, interval));
+    }
+}
+//# sourceMappingURL=renewClient.js.map

package/build/statsClient.d.ts

@@ -0,0 +1,96 @@
+/**
+ * statsClient.ts
+ *
+ * Browser-safe HTTP client for the vendor-facing keeper endpoints that back
+ * the dashboard: GET /stats, GET /transactions, and GET /apps/vendor/:addr.
+ *
+ * Types mirror the keeper's response shapes so a dashboard implementation
+ * (this repo's zklicensing.com dashboard or a third-party one) doesn't have
+ * to re-derive them. New optional fields on the server should be added here
+ * as `?:` so older clients still typecheck against a newer keeper.
+ */
+import type { CountryBreakdown } from './countryStats.js';
+export type Tier = 'monthly' | 'yearly' | 'fiveYear';
+export type AppRecord = {
+    appId: string;
+    name: string;
+    description: string;
+    longDescription?: string;
+    category: string;
+    website: string;
+    zkAppAddress: string;
+    vendorAddress: string;
+    priceMonthlyMina: number;
+    priceYearlyMina: number;
+    priceFiveYearMina: number;
+    txHash: string;
+    verificationKeyHash?: string;
+    logo?: string;
+    iconUrl?: string;
+    tags?: string[];
+    contactEmail?: string;
+    country?: string;
+    status?: 'pending' | 'active' | 'inactive' | 'rejected';
+    rejectionReason?: string;
+    createdAt: string;
+    approvedAt?: string;
+    pendingEdit?: Partial<AppRecord> & {
+        editedAt: string;
+    };
+};
+export type VendorStatsResponse = {
+    apps: AppRecord[];
+    activeLicenses: number;
+    totalLicenses: number;
+    totalRevenueMina: number;
+    pendingRevenueMina?: number;
+    renewalRate: number | null;
+    monthlyRevenueMina: {
+        month: string;
+        mina: number;
+    }[];
+    licensesByTier?: {
+        monthly: number;
+        yearly: number;
+        fiveYear: number;
+    };
+    deltas: {
+        revenuePct: number | null;
+    };
+    countryBreakdown?: CountryBreakdown;
+};
+export type Transaction = {
+    type: 'purchase' | 'renewal' | 'release' | 'refund';
+    appId: string;
+    appName: string;
+    tier: Tier | null;
+    amountMina: number;
+    txHash: string;
+    date: string;
+};
+export type TransactionsResponse = {
+    transactions: Transaction[];
+};
+export type VendorAppsResponse = {
+    apps: AppRecord[];
+};
+export declare function fetchVendorStats(opts: {
+    keeperUrl: string;
+    vendorAddress: string;
+    fetcher?: typeof fetch;
+    signal?: AbortSignal;
+}): Promise<VendorStatsResponse | null>;
+export declare function fetchTransactions(opts: {
+    keeperUrl: string;
+    vendorAddress: string;
+    days?: number;
+    fetcher?: typeof fetch;
+    signal?: AbortSignal;
+}): Promise<TransactionsResponse | null>;
+export declare function fetchVendorApps(opts: {
+    keeperUrl: string;
+    vendorAddress: string;
+    fetcher?: typeof fetch;
+    signal?: AbortSignal;
+}): Promise<VendorAppsResponse | null>;
+//# sourceMappingURL=statsClient.d.ts.map

package/build/statsClient.js

@@ -0,0 +1,28 @@
+// Copyright (c) 2025-2026 zkLicensing project developers
+// All rights reserved.
+function baseUrl(url) {
+    return url.replace(/\/+$/, '');
+}
+export async function fetchVendorStats(opts) {
+    const fetcher = opts.fetcher ?? fetch;
+    const resp = await fetcher(`${baseUrl(opts.keeperUrl)}/stats?vendor=${encodeURIComponent(opts.vendorAddress)}`, { signal: opts.signal });
+    if (!resp.ok)
+        return null;
+    return await resp.json();
+}
+export async function fetchTransactions(opts) {
+    const fetcher = opts.fetcher ?? fetch;
+    const days = opts.days ?? 30;
+    const resp = await fetcher(`${baseUrl(opts.keeperUrl)}/transactions?vendor=${encodeURIComponent(opts.vendorAddress)}&days=${days}`, { signal: opts.signal });
+    if (!resp.ok)
+        return null;
+    return await resp.json();
+}
+export async function fetchVendorApps(opts) {
+    const fetcher = opts.fetcher ?? fetch;
+    const resp = await fetcher(`${baseUrl(opts.keeperUrl)}/apps/vendor/${encodeURIComponent(opts.vendorAddress)}`, { signal: opts.signal });
+    if (!resp.ok)
+        return null;
+    return await resp.json();
+}
+//# sourceMappingURL=statsClient.js.map

package/build/verifyCore.d.ts

@@ -0,0 +1,26 @@
+import { type LicenseRecord } from './licenseStore.js';
+export type VerifyResponse = {
+    valid: boolean;
+    expiresAt: string | null;
+    expirySlot: number;
+    inGracePeriod: boolean;
+    remainingDays: number;
+    reason: string | null;
+};
+/**
+ * Core license verification.
+ *
+ * @param zkAppAddress - app address (composite key with licenseHash)
+ * @param licenseHash  - Poseidon.hash([secretHash]) as a field string
+ * @param records      - current off-chain license records (from licenseStore)
+ * @param onChainRoot  - zkApp appState[0] fetched from Mina
+ * @param currentSlot  - current blockchain slot (globalSlotSinceGenesis)
+ */
+export declare function verifyLicenseCore(params: {
+    zkAppAddress: string;
+    licenseHash: string;
+    records: LicenseRecord[];
+    onChainRoot: string;
+    currentSlot: number;
+}): VerifyResponse;
+//# sourceMappingURL=verifyCore.d.ts.map

package/build/verifyCore.js

@@ -0,0 +1,57 @@
+// Copyright (c) 2025-2026 zkLicensing project developers
+// All rights reserved.
+/**
+ * verifyCore.ts
+ *
+ * Pure verification logic shared by keeperService and verifyService.
+ * No HTTP, no network — takes already-fetched on-chain state and
+ * performs Merkle inclusion check + expiry logic.
+ */
+import { Field } from 'o1js';
+import { buildMap } from './licenseStore.js';
+import { GRACE_PERIOD_N, MS_PER_SLOT_N, SLOTS_PER_DAY_N } from './contractInterface.js';
+function computeRemainingDays(expirySlot, currentSlot) {
+    if (expirySlot === 0)
+        return 0;
+    return Math.floor((expirySlot - currentSlot) / SLOTS_PER_DAY_N);
+}
+/**
+ * Core license verification.
+ *
+ * @param zkAppAddress - app address (composite key with licenseHash)
+ * @param licenseHash  - Poseidon.hash([secretHash]) as a field string
+ * @param records      - current off-chain license records (from licenseStore)
+ * @param onChainRoot  - zkApp appState[0] fetched from Mina
+ * @param currentSlot  - current blockchain slot (globalSlotSinceGenesis)
+ */
+export function verifyLicenseCore(params) {
+    const { zkAppAddress, licenseHash, records, onChainRoot, currentSlot } = params;
+    const map = buildMap(records, zkAppAddress);
+    const key = Field(licenseHash);
+    const currentValue = map.get(key).toString();
+    const witness = map.getWitness(key);
+    const [computedRoot] = witness.computeRootAndKey(Field(currentValue));
+    if (computedRoot.toString() !== onChainRoot) {
+        return { valid: false, expiresAt: null, expirySlot: 0, inGracePeriod: false, remainingDays: 0, reason: 'License state does not match on-chain root' };
+    }
+    if (currentValue === '0') {
+        return { valid: false, expiresAt: null, expirySlot: 0, inGracePeriod: false, remainingDays: 0, reason: 'License has been refunded' };
+    }
+    const expirySlot = Number(currentValue);
+    const inGracePeriod = currentSlot > expirySlot && currentSlot <= expirySlot + GRACE_PERIOD_N;
+    const expired = currentSlot > expirySlot + GRACE_PERIOD_N;
+    const expiresAt = new Date(Date.now() + (expirySlot - currentSlot) * MS_PER_SLOT_N).toISOString();
+    const remainingDays = computeRemainingDays(expirySlot, currentSlot);
+    if (expired) {
+        return { valid: false, expiresAt, expirySlot, inGracePeriod: false, remainingDays, reason: 'License has expired' };
+    }
+    return {
+        valid: true,
+        expiresAt,
+        expirySlot,
+        inGracePeriod,
+        remainingDays,
+        reason: inGracePeriod ? 'License is in grace period — renew to avoid interruption' : null,
+    };
+}
+//# sourceMappingURL=verifyCore.js.map

package/build/verifyService.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=verifyService.d.ts.map