zklicensing 0.1.0-beta.2 → 0.1.0-beta.21

package/build/freezeClient.js

@@ -1,5 +1,26 @@
 // Copyright (c) 2025-2026 zkLicensing project developers
-// All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
+/**
+ * The health block for `network`. Without a network: the only configured
+ * one, or null when several are configured (ambiguous). Falls back to the
+ * legacy flat shape.
+ */
+export function pickNetworkHealth(health, network) {
+    const nested = ['devnet', 'mainnet'].filter(n => health[n] && typeof health[n].slot === 'number');
+    if (nested.length > 0) {
+        if (network)
+            return health[network] ?? null;
+        return nested.length === 1 ? health[nested[0]] : null;
+    }
+    if (typeof health.slot === 'number' || typeof health.salesFrozen === 'boolean') {
+        return {
+            slot: typeof health.slot === 'number' ? health.slot : 0,
+            salesFrozen: health.salesFrozen === true,
+            freezeAfterSlot: typeof health.freezeAfterSlot === 'number' ? health.freezeAfterSlot : null,
+        };
+    }
+    return null;
+}
 function baseUrl(url) {
     return url.replace(/\/+$/, '');
 }
@@ -28,7 +49,7 @@ export async function getKeeperHealth(opts) {
 // the caller override or process.env, the current slot is not known
 // client-side, so salesFrozen is filled from /health only — the override
 // path returns { freezeAfterSlot: N, salesFrozen: false, currentSlot: null }
-// and lets the keeper reject the actual prove call if the freeze has fired.
+// and lets the backend reject the actual prove call if the freeze has fired.
 export async function resolveFreezeState(opts) {
     if (typeof opts.freezeAfterSlot === 'number' && opts.freezeAfterSlot > 0) {
         return { salesFrozen: false, freezeAfterSlot: opts.freezeAfterSlot, currentSlot: null };
@@ -43,15 +64,18 @@ export async function resolveFreezeState(opts) {
             fetcher: opts.fetcher,
             signal: opts.signal,
         });
+        const net = pickNetworkHealth(health, opts.network);
+        if (!net)
+            return { salesFrozen: false, freezeAfterSlot: null, currentSlot: null };
         return {
-            salesFrozen: health.salesFrozen === true,
-            freezeAfterSlot: typeof health.freezeAfterSlot === 'number' ? health.freezeAfterSlot : null,
-            currentSlot: typeof health.slot === 'number' ? health.slot : null,
+            salesFrozen: net.salesFrozen === true,
+            freezeAfterSlot: typeof net.freezeAfterSlot === 'number' && net.freezeAfterSlot > 0 ? net.freezeAfterSlot : null,
+            currentSlot: typeof net.slot === 'number' && net.slot > 0 ? net.slot : null,
         };
     }
     catch {
         // /health unreachable — treat as no freeze so we don't block buys on a
-        // transient network hiccup. The keeper's own guard is still the last
+        // transient network hiccup. The backend's own guard is still the last
         // line of defense.
         return { salesFrozen: false, freezeAfterSlot: null, currentSlot: null };
     }

package/build/freezeClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"freezeClient.js","sourceRoot":"","sources":["../src/freezeClient.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,oCAAoC;AAgDpC;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAoB,EAAE,OAA8B;IACpF,MAAM,MAAM,GAAI,CAAC,QAAQ,EAAE,SAAS,CAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,OAAO,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IAC9G,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,IAAI,OAAO;YAAE,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;QAC5C,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QAC/E,OAAO;YACL,IAAI,EAAa,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClE,WAAW,EAAM,MAAM,CAAC,WAAW,KAAK,IAAI;YAC5C,eAAe,EAAE,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI;SAC5F,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAmBD,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,aAAa;IACpB,yEAAyE;IACzE,sDAAsD;IACtD,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,CAAC,OAAO,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IAChE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC1C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC5B,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAQD,qEAAqE;AACrE,wEAAwE;AACxE,gDAAgD;AAChD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAA4B;IAChE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACzF,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD,OAAO,MAAM,IAAI,CAAC,IAAI,EAAkB,CAAC;AAC3C,CAAC;AAcD,yEAAyE;AACzE,oEAAoE;AACpE,yEAAyE;AACzE,6EAA6E;AAC7E,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAA+B;IACtE,IAAI,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ,IAAI,IAAI,CAAC,eAAe,GAAG,CAAC,EAAE,CAAC;QACzE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC1F,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;IAChC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;YACnC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAI,IAAI,CAAC,OAAO;YACvB,MAAM,EAAK,IAAI,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QAClF,OAAO;YACL,WAAW,EAAM,GAAG,CAAC,WAAW,KAAK,IAAI;YACzC,eAAe,EAAE,OAAO,GAAG,CAAC,eAAe,KAAK,QAAQ,IAAI,GAAG,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI;YAChH,WAAW,EAAM,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;SAChF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,sEAAsE;QACtE,mBAAmB;QACnB,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC1E,CAAC;AACH,CAAC"}

package/build/generationClient.d.ts

@@ -15,6 +15,7 @@ export interface GenerationInfo {
 }
 export interface FetchGenerationRequest {
     keeperUrl: string;
+    network: 'devnet' | 'mainnet';
     appId: string;
     /** Base64-encoded Ed25519 public keys pinned by the caller. Empty ⇒ verified:false. */
     pinnedPublicKeysBase64: readonly string[];
@@ -23,6 +24,8 @@ export interface FetchGenerationRequest {
 }
 export interface FetchGenerationByAddressRequest {
     keeperUrl: string;
+    /** When given, a list signed for the other network is refused. */
+    network?: 'devnet' | 'mainnet';
     /** Any zkApp address in the app's generation chain — current live or any retired. */
     zkAppAddress: string;
     /** Base64-encoded Ed25519 public keys pinned by the caller. Empty ⇒ verified:false. */
@@ -34,7 +37,7 @@ export interface FetchGenerationByAddressRequest {
  * GET /apps/:appId — returns { appId, current, generations, issuedAt, publicKey, signature }.
  * We reconstruct the canonical payload (everything except `publicKey` +
  * `signature`) and verify against the pin list. `publicKey` in the response
- * is advisory only — it's the key the keeper claims to have signed with;
+ * is advisory only — it's the key the backend claims to have signed with;
  * the SDK never trusts it in place of a pin.
  */
 export declare function fetchGenerationInfo(req: FetchGenerationRequest): Promise<GenerationInfo>;
@@ -42,11 +45,11 @@ export declare function fetchGenerationInfo(req: FetchGenerationRequest): Promis
  * GET /apps/by-address/:zkAppAddress — same signed payload as fetchGenerationInfo,
  * but keyed by an address the caller already has (direct-paste buys, renew on a
  * since-retired address). Buyers arriving without an appId would otherwise have
- * to trust the keeper's unsigned `/apps` list to bind their address to an appId
+ * to trust the backend's unsigned `/apps` list to bind their address to an appId
  * first — defeating the pin.
  *
  * Extra assertion beyond the appId flow: the queried address MUST appear in the
- * returned `generations[]`. Without this, a malicious keeper could return a
+ * returned `generations[]`. Without this, a malicious backend could return a
  * validly-signed payload for a DIFFERENT app in response to the query, and the
  * signature check alone wouldn't catch it.
  */

package/build/generationClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generationClient.d.ts","sourceRoot":"","sources":["../src/generationClient.ts"],"names":[],"mappings":"AA4BA,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAW,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAQ,SAAS,GAAG,MAAM,CAAC;IACjC,UAAU,CAAC,EAAG,MAAM,CAAC;IACrB,UAAU,CAAC,EAAG,MAAM,CAAC;IACrB,SAAS,CAAC,EAAI,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,sGAAsG;IACtG,OAAO,EAAM,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,eAAe,EAAE,CAAC;IAC/B,qEAAqE;IACrE,QAAQ,EAAK,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAG,QAAQ,GAAG,SAAS,CAAC;IAC/B,KAAK,EAAK,MAAM,CAAC;IACjB,uFAAuF;IACvF,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,MAAM,CAAC,EAAG,WAAW,CAAC;CACvB;AAED,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,OAAO,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC/B,qFAAqF;IACrF,YAAY,EAAE,MAAM,CAAC;IACrB,uFAAuF;IACvF,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,MAAM,CAAC,EAAG,WAAW,CAAC;CACvB;AAuBD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,sBAAsB,GAAG,OAAO,CAAC,cAAc,CAAC,CAc9F;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,+BAA+B,GACnC,OAAO,CAAC,cAAc,CAAC,CAmBzB"}

package/build/generationClient.js

@@ -1,67 +1,54 @@
 // Copyright (c) 2025-2026 zkLicensing project developers
-// All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
 /**
  * generationClient.ts
  *
- * Browser-safe fetcher for the keeper's signed generation-list. Returns the
+ * Browser-safe fetcher for the backend's signed generation-list. Returns the
  * app's deployment history — every past address plus the current live one —
  * verified against a caller-supplied pin list of platform manifest public
  * keys.
  *
- * Trust model: the keeper is not the trust anchor for this data — it can
+ * Trust model: the backend is not the trust anchor for this data — it can
  * be re-hosted, mirrored, cached, or (worst case) impersonated. The pin
  * list is. Any response that fails signature verification is surfaced as
  * `verified: false` with `generations: []` so callers cannot accidentally
  * route a wallet prompt to an unverified address.
  *
  * Optional corroboration channel: an operator that publishes
- *   https://<vendor-host>/.well-known/zklicensing/<appId>.json
- * (using the same keeper-signed payload) can be cross-checked from the
- * on-chain zkappUri. Per-app filename because a vendor may host several
- * apps at one origin. The cross-check is opt-in per-app — a 404 at that
+ *   https://<vendor-host>/.well-known/zklicensing/<zkAppAddress>.json
+ * (using the same backend-signed payload) can be cross-checked from the
+ * on-chain zkappUri. One file per deployed address (so per generation),
+ * because a vendor may host several apps at one origin. The cross-check is opt-in per-app — a 404 at that
  * URL is not a failure signal, just "no corroboration published for this
  * app." That's the caller's job, not this module's.
  */
-import { verifyManifestSignature } from './manifestVerify.js';
+import { verifyManifest } from './manifestVerify.js';
 function baseUrl(url) {
     return url.replace(/\/+$/, '');
 }
-function parseGenerationBody(body) {
-    const gensRaw = body.generations;
-    return {
-        current: typeof body.current === 'number' ? body.current : null,
-        generations: Array.isArray(gensRaw) ? gensRaw : [],
-        signature: typeof body.signature === 'string' ? body.signature : null,
-        issuedAt: typeof body.issuedAt === 'string' ? body.issuedAt : null,
-        appId: typeof body.appId === 'string' ? body.appId : null,
-    };
-}
-async function verifyAndProject(parsed, pinnedPublicKeysBase64) {
-    const { current, generations, signature, issuedAt, appId } = parsed;
-    if (!signature || !issuedAt || !appId || current === null) {
-        return { current, generations, verified: false };
-    }
-    // Reconstruct the canonical payload — must match keeperService's
-    // signPayload input exactly.
-    const canonical = { appId, current, generations, issuedAt };
-    const verified = await verifyManifestSignature(canonical, signature, pinnedPublicKeysBase64);
-    if (!verified) {
-        // Never surface unverified `current`/`generations` — a caller must not
-        // accidentally route a wallet prompt to an address we couldn't authenticate.
+/**
+ * The verified generation list in a keeper response: a platform signature
+ * from a pinned key (current or, during a key rotation, the previous one)
+ * over the signed fields, for `network` when given. Unverified data is
+ * never surfaced: a caller must not route a wallet prompt to an address we
+ * couldn't authenticate.
+ */
+async function verifyAndProject(body, pinnedPublicKeysBase64, network) {
+    const signed = await verifyManifest(body, pinnedPublicKeysBase64, network ? { network } : {});
+    if (!signed)
         return { current: null, generations: [], verified: false };
-    }
-    return { current, generations, verified: true };
+    return { current: signed.current, generations: signed.generations, verified: true };
 }
 /**
  * GET /apps/:appId — returns { appId, current, generations, issuedAt, publicKey, signature }.
  * We reconstruct the canonical payload (everything except `publicKey` +
  * `signature`) and verify against the pin list. `publicKey` in the response
- * is advisory only — it's the key the keeper claims to have signed with;
+ * is advisory only — it's the key the backend claims to have signed with;
  * the SDK never trusts it in place of a pin.
  */
 export async function fetchGenerationInfo(req) {
     const fetcher = req.fetcher ?? fetch;
-    const resp = await fetcher(`${baseUrl(req.keeperUrl)}/apps/${encodeURIComponent(req.appId)}`, {
+    const resp = await fetcher(`${baseUrl(req.keeperUrl)}/apps/${encodeURIComponent(req.appId)}?network=${req.network}`, {
         method: 'GET',
         signal: req.signal,
     });
@@ -75,17 +62,17 @@ export async function fetchGenerationInfo(req) {
     catch {
         return { current: null, generations: [], verified: false };
     }
-    return verifyAndProject(parseGenerationBody(body), req.pinnedPublicKeysBase64);
+    return verifyAndProject(body, req.pinnedPublicKeysBase64, req.network);
 }
 /**
  * GET /apps/by-address/:zkAppAddress — same signed payload as fetchGenerationInfo,
  * but keyed by an address the caller already has (direct-paste buys, renew on a
  * since-retired address). Buyers arriving without an appId would otherwise have
- * to trust the keeper's unsigned `/apps` list to bind their address to an appId
+ * to trust the backend's unsigned `/apps` list to bind their address to an appId
  * first — defeating the pin.
  *
  * Extra assertion beyond the appId flow: the queried address MUST appear in the
- * returned `generations[]`. Without this, a malicious keeper could return a
+ * returned `generations[]`. Without this, a malicious backend could return a
  * validly-signed payload for a DIFFERENT app in response to the query, and the
  * signature check alone wouldn't catch it.
  */
@@ -102,7 +89,7 @@ export async function fetchGenerationInfoByAddress(req) {
     catch {
         return { current: null, generations: [], verified: false };
     }
-    const projected = await verifyAndProject(parseGenerationBody(body), req.pinnedPublicKeysBase64);
+    const projected = await verifyAndProject(body, req.pinnedPublicKeysBase64, req.network);
     if (!projected.verified)
         return projected;
     if (!projected.generations.some(g => g.zkAppAddress === req.zkAppAddress)) {

package/build/generationClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generationClient.js","sourceRoot":"","sources":["../src/generationClient.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,oCAAoC;AAEpC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAyCrD,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAC7B,IAAa,EACb,sBAAyC,EACzC,OAA8B;IAE9B,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,sBAAsB,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9F,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACxE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,WAAgC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AAC3G,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAA2B;IACnE,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,KAAK,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,OAAO,EAAE,EAAE;QACnH,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,GAAG,CAAC,MAAM;KACnB,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QAAC,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAA6B,CAAC;IAAC,CAAC;IAC5D,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAAC,CAAC;IAErE,OAAO,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,sBAAsB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,GAAoC;IAEpC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,KAAK,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,oBAAoB,kBAAkB,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,EACnF,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CACtC,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7D,CAAC;IACD,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QAAC,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAA6B,CAAC;IAAC,CAAC;IAC5D,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAAC,CAAC;IAErE,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,sBAAsB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACxF,IAAI,CAAC,SAAS,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QAC1E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/build/holderSecret.d.ts

@@ -0,0 +1,70 @@
+/**
+ * holderSecret.ts — the permit holder's secret for anonymous proofs
+ * (see permitProof.ts). Light: no ZkProgram, so clients can derive it when
+ * applying without loading the proof.
+ */
+import { Field } from 'o1js';
+import { type PermitNetwork } from './permitMessages.js';
+/** Tags for the holder secret's signed message and for the salt derived from it. */
+export declare const HOLDER_SECRET_TAG: Field;
+export declare const HOLDER_SALT_TAG: Field;
+/** How many counter values recovery tries: one key rarely holds more permits in one registry. */
+export declare const MAX_HOLDER_SECRETS = 16;
+/**
+ * What the holder's wallet signs (a text signature, signMessage) to derive a
+ * secret: the registry's lineage, its network and a counter: 0 for the
+ * key's first permit in the registry, 1 for the next, and so on. The
+ * lineage is the registry's first generation's address (the keeper's
+ * `registry.lineage`; the address itself for a registry never redeployed),
+ * so a permit's secret stays the same when the registry moves to a new
+ * address. Readable in the wallet, and nothing needs to be kept: the holder
+ * re-derives the secret from the chain and the wallet alone (findHolderSecret).
+ */
+export declare function holderSecretText(lineage: string, network: PermitNetwork, index: number): string;
+/** The holder secret from the wallet's (deterministic) text signature over holderSecretText. */
+export declare function holderSecretFromSignature(sig: {
+    field: string;
+    scalar: string;
+}): Field;
+/** The permit's salt: public to the keeper and the authority, and reveals nothing about the secret. */
+export declare function saltFromHolderSecret(holderSecret: Field): Field;
+type TextWallet = {
+    address: string;
+    signMessage(message: string): Promise<{
+        field: string;
+        scalar: string;
+    }>;
+};
+/** Derives the secret, salt and permit subject for counter `index` (one wallet signature). */
+export declare function deriveHolderSecret(wallet: TextWallet, args: {
+    lineage: string;
+    network: PermitNetwork;
+    index: number;
+}): Promise<{
+    secret: string;
+    salt: string;
+    subject: string;
+    index: number;
+}>;
+/**
+ * Recovers the secret of the permit `subject` held by this wallet: signs for
+ * counter 0, 1, 2… until one gives that subject (usually the first). Throws
+ * when none does: another wallet, or a permit issued before secrets were
+ * derived this way.
+ */
+export declare function findHolderSecret(wallet: TextWallet, args: {
+    lineage: string;
+    network: PermitNetwork;
+    subject: string;
+    maxTries?: number;
+}): Promise<{
+    secret: string;
+    index: number;
+}>;
+/**
+ * True when `holderSecret` belongs to the permit (subject = H(holderKey, salt(secret))).
+ * Check before proving, for a clear error instead of a failed proof.
+ */
+export declare function holderSecretMatches(holderKey: string, subject: string, holderSecret: string): boolean;
+export {};
+//# sourceMappingURL=holderSecret.d.ts.map

package/build/holderSecret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"holderSecret.d.ts","sourceRoot":"","sources":["../src/holderSecret.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAuB,MAAM,MAAM,CAAC;AAClD,OAAO,EAA+B,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEtF,oFAAoF;AACpF,eAAO,MAAM,iBAAiB,EAAE,KAA4G,CAAC;AAC7I,eAAO,MAAM,eAAe,EAAE,KAA0G,CAAC;AAEzI,iGAAiG;AACjG,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAErC;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAW/F;AAED,gGAAgG;AAChG,wBAAgB,yBAAyB,CAAC,GAAG,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,KAAK,CAIvF;AAED,uGAAuG;AACvG,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,KAAK,GAAG,KAAK,CAE/D;AAED,KAAK,UAAU,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC;AAEhH,8FAA8F;AAC9F,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC/D,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAK3E;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,aAAa,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,GACpF,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAM5C;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAErG"}

package/build/holderSecret.js

@@ -0,0 +1,76 @@
+// Copyright (c) 2025-2026 zkLicensing project developers
+// SPDX-License-Identifier: BUSL-1.1
+/**
+ * holderSecret.ts — the permit holder's secret for anonymous proofs
+ * (see permitProof.ts). Light: no ZkProgram, so clients can derive it when
+ * applying without loading the proof.
+ */
+import { Field, Poseidon, PublicKey } from 'o1js';
+import { networkField, permitSubject } from './permitMessages.js';
+/** Tags for the holder secret's signed message and for the salt derived from it. */
+export const HOLDER_SECRET_TAG = Field([...'zkPermits/v1/holder-secret'].reduce((v, ch) => (v << 8n) | BigInt(ch.charCodeAt(0)), 0n));
+export const HOLDER_SALT_TAG = Field([...'zkPermits/v1/holder-salt'].reduce((v, ch) => (v << 8n) | BigInt(ch.charCodeAt(0)), 0n));
+/** How many counter values recovery tries: one key rarely holds more permits in one registry. */
+export const MAX_HOLDER_SECRETS = 16;
+/**
+ * What the holder's wallet signs (a text signature, signMessage) to derive a
+ * secret: the registry's lineage, its network and a counter: 0 for the
+ * key's first permit in the registry, 1 for the next, and so on. The
+ * lineage is the registry's first generation's address (the keeper's
+ * `registry.lineage`; the address itself for a registry never redeployed),
+ * so a permit's secret stays the same when the registry moves to a new
+ * address. Readable in the wallet, and nothing needs to be kept: the holder
+ * re-derives the secret from the chain and the wallet alone (findHolderSecret).
+ */
+export function holderSecretText(lineage, network, index) {
+    if (!Number.isSafeInteger(index) || index < 0)
+        throw new Error('holder secret index must be a non-negative integer');
+    PublicKey.fromBase58(lineage);
+    networkField(network);
+    return [
+        'zkPermits: recover my permit secret',
+        `registry: ${lineage}`,
+        `network: ${network}`,
+        `permit number: ${index}`,
+        'Sign this only on zkLicensing pages: it lets the signer recognise this permit\'s anonymous proofs.',
+    ].join('\n');
+}
+/** The holder secret from the wallet's (deterministic) text signature over holderSecretText. */
+export function holderSecretFromSignature(sig) {
+    const scalar = BigInt(sig.scalar);
+    const low = scalar & ((1n << 128n) - 1n);
+    return Poseidon.hash([HOLDER_SECRET_TAG, Field(BigInt(sig.field)), Field(scalar >> 128n), Field(low)]);
+}
+/** The permit's salt: public to the keeper and the authority, and reveals nothing about the secret. */
+export function saltFromHolderSecret(holderSecret) {
+    return Poseidon.hash([HOLDER_SALT_TAG, holderSecret]);
+}
+/** Derives the secret, salt and permit subject for counter `index` (one wallet signature). */
+export async function deriveHolderSecret(wallet, args) {
+    const signature = await wallet.signMessage(holderSecretText(args.lineage, args.network, args.index));
+    const secret = holderSecretFromSignature(signature);
+    const salt = saltFromHolderSecret(secret);
+    return { secret: secret.toString(), salt: salt.toString(), subject: permitSubject(PublicKey.fromBase58(wallet.address), salt).toString(), index: args.index };
+}
+/**
+ * Recovers the secret of the permit `subject` held by this wallet: signs for
+ * counter 0, 1, 2… until one gives that subject (usually the first). Throws
+ * when none does: another wallet, or a permit issued before secrets were
+ * derived this way.
+ */
+export async function findHolderSecret(wallet, args) {
+    for (let index = 0; index < (args.maxTries ?? MAX_HOLDER_SECRETS); index++) {
+        const d = await deriveHolderSecret(wallet, { lineage: args.lineage, network: args.network, index });
+        if (d.subject === args.subject)
+            return { secret: d.secret, index };
+    }
+    throw new Error('This wallet derives no secret for this permit: is it the wallet the permit was applied for with, on this network?');
+}
+/**
+ * True when `holderSecret` belongs to the permit (subject = H(holderKey, salt(secret))).
+ * Check before proving, for a clear error instead of a failed proof.
+ */
+export function holderSecretMatches(holderKey, subject, holderSecret) {
+    return permitSubject(PublicKey.fromBase58(holderKey), saltFromHolderSecret(Field(holderSecret))).toString() === subject;
+}
+//# sourceMappingURL=holderSecret.js.map

package/build/holderSecret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"holderSecret.js","sourceRoot":"","sources":["../src/holderSecret.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,oCAAoC;AAEpC;;;;GAIG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAsB,MAAM,qBAAqB,CAAC;AAEtF,oFAAoF;AACpF,MAAM,CAAC,MAAM,iBAAiB,GAAU,KAAK,CAAC,CAAC,GAAG,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAC7I,MAAM,CAAC,MAAM,eAAe,GAAU,KAAK,CAAC,CAAC,GAAG,0BAA0B,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAEzI,iGAAiG;AACjG,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAErC;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,OAAsB,EAAE,KAAa;IACrF,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACrH,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC9B,YAAY,CAAC,OAAO,CAAC,CAAC;IACtB,OAAO;QACL,qCAAqC;QACrC,aAAa,OAAO,EAAE;QACtB,YAAY,OAAO,EAAE;QACrB,kBAAkB,KAAK,EAAE;QACzB,oGAAoG;KACrG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,yBAAyB,CAAC,GAAsC;IAC9E,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACzC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACzG,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,oBAAoB,CAAC,YAAmB;IACtD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC,CAAC;AACxD,CAAC;AAID,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAkB,EAClB,IAAgE;IAEhE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACrG,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;AAChK,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAkB,EAClB,IAAqF;IAErF,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,kBAAkB,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3E,MAAM,CAAC,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACpG,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IACrE,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,mHAAmH,CAAC,CAAC;AACvI,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB,EAAE,OAAe,EAAE,YAAoB;IAC1F,OAAO,aAAa,CAAC,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC;AAC1H,CAAC"}

package/build/index.d.ts

@@ -1,60 +1,39 @@
 /**
  * verifyLicense — client SDK.
  *
- * Calls the keeper's GET /verify until the on-chain refund window for the
- * license has closed; from that point on returns from a local anchor and
- * never touches the network again. The refund-window decision is server-
- * side: the keeper returns `refundWindowClosed: boolean` on its /verify
- * response, computed from its own record of `purchaseSlot + REFUND_WINDOW_N`
- * against the on-chain `currentSlot`. The SDK gates anchor writes on that
- * boolean and never trusts a `purchaseSlot` supplied by the local proof
- * file, so a user who forges their proof metadata cannot force the offline
- * branch prematurely.
+ * Calls the licensing service's GET /verify until the on-chain refund
+ * window for the license has closed; from that point on returns from a
+ * local anchor and never touches the network again. The refund-window
+ * decision is server-side: the service returns `refundWindowClosed:
+ * boolean` on its /verify response, computed from its own record of
+ * `purchaseSlot + REFUND_WINDOW_N` against the on-chain `currentSlot`.
+ * The SDK gates anchor writes on that boolean and never trusts a
+ * `purchaseSlot` supplied by the local license file, so a user who forges
+ * their proof metadata cannot force the offline branch prematurely.
  *
  * Anchor purity: every field persisted in the Anchor derives from the
- * keeper's /verify response — `anchoredSlot`, `expirySlot`, `ownership`.
- * The only client-supplied input to the offline branch is
- * `proof.expirySlot`, used solely as the loadAnchor binding key. A
- * tampered proof file therefore never gets a wrong answer; it gets no
- * offline branch at all and falls through to the keeper on every call.
+ * service's /verify response — `anchoredSlot`, `expirySlot`. The only
+ * client-supplied input to the offline branch is `proof.expirySlot`,
+ * used solely as the loadAnchor binding key. A tampered license file
+ * therefore never gets a wrong answer; it gets no offline branch at all
+ * and falls through to the licensing service on every call.
  */
-import { REFUND_WINDOW_N, GRACE_PERIOD_N } from './contractInterface.js';
+import { REFUND_WINDOW_N, GRACE_PERIOD_N } from './slotConstants.js';
 declare const MS_PER_SLOT = 90000;
+export declare const DEFAULT_VERIFIER_URL = "https://zklicensing.com/api/verify";
 export interface Storage {
     getItem(key: string): string | null;
     setItem(key: string, value: string): void;
 }
-export interface ActivationRecord {
-    token: string;
-    expiresAt: number;
-    secretHash?: string;
-}
-export declare function loadActivation(storage: Storage, zkAppAddress: string, licenseHash: string, nowMs?: number): ActivationRecord | null;
-export declare function saveActivation(storage: Storage, zkAppAddress: string, licenseHash: string, rec: ActivationRecord): void;
 export interface ProofInput {
     licenseHash: string;
     zkAppAddress: string;
     expirySlot: number;
-    verifierUrl?: string;
 }
-/**
- * Callback that proves an OwnershipChallenge using a stored secretHash.
- * Callers wire this up with their own o1js + LicenseProof imports so the SDK
- * stays dependency-free for the verify-only path. Return value is the
- * `proof.toJSON()` payload the verifier's POST /respond expects.
- */
-export type TokenProver = (input: {
-    licenseHash: string;
-    nonce: string;
-    secretHash: string;
-}) => Promise<unknown>;
 export interface VerifyOptions {
-    verifierUrl?: string;
     storage?: Storage | null;
     fetcher?: typeof fetch;
     now?: () => number;
-    prover?: TokenProver;
-    secretHash?: string;
 }
 export interface VerifyResult {
     valid: boolean;
@@ -65,8 +44,29 @@ export interface VerifyResult {
     remainingDays: number;
     reason: string | null;
     source: 'offline' | 'chain';
-    ownership: 'verified' | 'unverified';
 }
 export declare function verifyLicense(proof: ProofInput, options?: VerifyOptions): Promise<VerifyResult>;
 export { REFUND_WINDOW_N, GRACE_PERIOD_N, MS_PER_SLOT };
+type BindClient = typeof import('./bindClient.js');
+type UnbindClient = typeof import('./unbindClient.js');
+type DeviceIdentityModule = typeof import('./deviceIdentity.js');
+export declare function proveBind(...a: Parameters<BindClient['proveBind']>): ReturnType<BindClient['proveBind']>;
+export declare function confirmBind(...a: Parameters<BindClient['confirmBind']>): ReturnType<BindClient['confirmBind']>;
+export declare function pollBindStatus(...a: Parameters<BindClient['pollBindStatus']>): ReturnType<BindClient['pollBindStatus']>;
+export declare function fetchBindingState(...a: Parameters<BindClient['fetchBindingState']>): ReturnType<BindClient['fetchBindingState']>;
+export declare function proveUnbind(...a: Parameters<UnbindClient['proveUnbind']>): ReturnType<UnbindClient['proveUnbind']>;
+export declare function confirmUnbind(...a: Parameters<UnbindClient['confirmUnbind']>): ReturnType<UnbindClient['confirmUnbind']>;
+export declare function pollUnbindStatus(...a: Parameters<UnbindClient['pollUnbindStatus']>): ReturnType<UnbindClient['pollUnbindStatus']>;
+export declare function getOrCreateDeviceIdentity(...a: Parameters<DeviceIdentityModule['getOrCreateDeviceIdentity']>): ReturnType<DeviceIdentityModule['getOrCreateDeviceIdentity']>;
+export type { ProveBindRequest, ProveBindResponse, ConfirmBindRequest, BindStatus, PollBindStatusOptions, } from './bindClient.js';
+export type { ProveUnbindRequest, ProveUnbindResponse, ConfirmUnbindRequest, UnbindStatus, PollUnbindStatusOptions, } from './unbindClient.js';
+export type { DeviceIdentity } from './deviceIdentity.js';
+export type { VerifyOfflineInput, VerifyOfflineResult, DeviceSlotSnapshot, } from './verifyOffline.js';
+export { fetchOnChainLicensesRoot, DEFAULT_MINA_GRAPHQL_URLS } from './onChainRoot.js';
+export type { FetchOnChainLicensesRootInput, NetworkName } from './onChainRoot.js';
+export { licenseFileName, platformFeeNano, vendorShareNano } from './licenseRecord.js';
+export { seatNameFor, SEAT_NAME_COMBINATIONS } from './seatName.js';
+export type { SeatNameInput } from './seatName.js';
+export { proveVendorRelease, confirmVendorRelease } from './releaseClient.js';
+export type { ProveVendorReleaseRequest, ProveVendorReleaseResponse, ConfirmVendorReleaseRequest, ConfirmVendorReleaseResponse, } from './releaseClient.js';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EACL,eAAe,EACf,cAAc,EAGf,MAAM,oBAAoB,CAAC;AAE5B,QAAA,MAAM,WAAW,QAAgB,CAAC;AAOlC,eAAO,MAAM,oBAAoB,uCAAuC,CAAC;AAczE,MAAM,WAAW,OAAO;IACtB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACpC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACzB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,OAAO,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IAInB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAIzB,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,OAAO,CAAC;IAIvB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC;CAC7B;AAoFD,wBAAsB,aAAa,CACjC,KAAK,EAAE,UAAU,EACjB,OAAO,GAAE,aAAkB,GAC1B,OAAO,CAAC,YAAY,CAAC,CAqGvB;AAID,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;AASxD,KAAK,UAAU,GAAG,cAAc,iBAAiB,CAAC,CAAC;AACnD,KAAK,YAAY,GAAG,cAAc,mBAAmB,CAAC,CAAC;AACvD,KAAK,oBAAoB,GAAG,cAAc,qBAAqB,CAAC,CAAC;AAIjE,wBAAsB,SAAS,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAiD;AAChK,wBAAsB,WAAW,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAmD;AACxK,wBAAsB,cAAc,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,CAAsD;AACpL,wBAAsB,iBAAiB,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAyD;AAChM,wBAAsB,WAAW,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,GAAG,UAAU,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAqD;AAC9K,wBAAsB,aAAa,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,GAAG,UAAU,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAuD;AACtL,wBAAsB,gBAAgB,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,GAAG,UAAU,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAA0D;AAClM,wBAAsB,yBAAyB,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC,oBAAoB,CAAC,2BAA2B,CAAC,CAAC,GAAG,UAAU,CAAC,oBAAoB,CAAC,2BAA2B,CAAC,CAAC,CAA2E;AAC9P,YAAY,EACV,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,UAAU,EACV,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,YAAY,EACZ,uBAAuB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAM1D,YAAY,EACV,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAQ5B,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AACvF,YAAY,EAAE,6BAA6B,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAKnF,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAOvF,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACpE,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAOnD,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC9E,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,oBAAoB,CAAC"}