zklicensing 0.1.0-beta.2 → 0.1.0-beta.21

package/build/licenseTrustless.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"licenseTrustless.d.ts","sourceRoot":"","sources":["../src/licenseTrustless.ts"],"names":[],"mappings":"AAqCA,MAAM,MAAM,4BAA4B,GAAG;IACzC,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,IAAI,CAAC;IAChB,yHAAyH;IACzH,eAAe,EAAE,MAAM,CAAC;IACxB,qFAAqF;IACrF,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,qJAAqJ;IACrJ,WAAW,EAAE,UAAU,GAAG,oBAAoB,CAAC;CAChD,CAAC;AAEF,KAAK,YAAY,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAqBlL,oEAAoE;AACpE,wBAAgB,eAAe,CAAC,CAAC,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI,CAO9D;AAqCD,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,mFAAmF;IACnF,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,4BAA4B,CAAC,CA+DxC"}

package/build/licenseTrustless.js

@@ -0,0 +1,180 @@
+// Copyright (c) 2025-2026 zkLicensing project developers
+// SPDX-License-Identifier: BUSL-1.1
+/**
+ * licenseTrustless.ts — a license check that doesn't trust the keeper.
+ *
+ * The keeper's `/verify` reads the chain for you; here the caller reads it:
+ *
+ *   1. From a Mina node: the contract account at each address checked (its
+ *      license root, verification key and permissions) and the current slot.
+ *      The contract must run a published LicensingApp release (the pinned
+ *      CANONICAL_VK_HASHES) and be locked: state changes only by proof, no
+ *      new verification key, no new permissions.
+ *   2. From the keeper: only the license's leaf fields and Merkle path
+ *      (`/witness`). They are hashed and folded up to the root read in 1, so
+ *      a keeper that lies, or is behind, can't make the check pass; it can
+ *      only make it fail. An absent license is proved the same way (an
+ *      empty leaf folds to the root).
+ *   3. Which addresses belong to the app: the platform-signed generation
+ *      list (`/apps/by-address`), checked against the pinned manifest keys.
+ *      As the keeper does, the current generation is tried first, then the
+ *      address given, then the other retired ones (licenses refunded or
+ *      expired before a redeploy stay there). Without a valid signed list the
+ *      given address and its on-chain successors are checked: a retired
+ *      contract names its successor in its state (see successorChain.ts).
+ *
+ * Whether the address is the app you think it is (the seller's website) is
+ * a separate check: verifyTrustAnchor. Loads o1js (for Poseidon).
+ */
+import { AgentError, PLATFORM_MANIFEST_PUBKEYS } from './agent.js';
+import { CANONICAL_VK_HASHES, GRACE_PERIOD_N, LICENSING_APP_STATE, MS_PER_SLOT_N, SLOTS_PER_DAY_N, effectiveExpirySlot } from './contractInterface.js';
+import { DEFAULT_MINA_GRAPHQL_URLS } from './onChainRoot.js';
+import { MinaNodeError, readZkappHead } from './chainHead.js';
+import { LICENSING_LINEAGE, currentOnChain } from './successorChain.js';
+import { verifyManifest } from './manifestVerify.js';
+async function readContract(address, graphqlUrl, f) {
+    let head;
+    try {
+        head = await readZkappHead({ address, graphqlUrl, fetcher: f });
+    }
+    catch (e) {
+        throw new AgentError(e?.message ?? String(e), 'UPSTREAM_UNAVAILABLE', e instanceof MinaNodeError ? e.status : 0, true);
+    }
+    const { account: a, slot } = head;
+    if (slot === undefined)
+        throw new AgentError(`Mina node ${graphqlUrl} did not report the current slot`, 'UPSTREAM_UNAVAILABLE', 0, true);
+    if (!a.found)
+        return { found: false, slot };
+    return {
+        found: true, slot,
+        root: a.appState?.[0],
+        forkSlot: Number(a.appState?.[LICENSING_APP_STATE.forkActivationSlot] ?? 0),
+        vkHash: a.vkHash,
+        editState: a.permissions?.editState, setPermissions: a.permissions?.setPermissions, setVerificationKey: a.permissions?.setVerificationKey?.auth,
+    };
+}
+/** Why a contract isn't a genuine, locked LicensingApp, or null. */
+export function contractProblem(c) {
+    if (!c.found || !c.root)
+        return 'no zkApp at this address on this network';
+    if (!c.vkHash || !Object.values(CANONICAL_VK_HASHES).includes(c.vkHash))
+        return 'the contract is not a published LicensingApp release (verification key)';
+    if (c.editState !== 'Proof')
+        return 'the contract state can be changed without a proof';
+    if (c.setVerificationKey !== 'Impossible')
+        return 'the contract\'s verification key can be replaced';
+    if (c.setPermissions !== 'Impossible')
+        return 'the contract\'s permissions can be changed';
+    return null;
+}
+/** Addresses to try, current generation first; null when no valid signed list. */
+async function signedGenerations(base, address, f, pinned, network) {
+    try {
+        const r = await f(`${base}/apps/by-address/${encodeURIComponent(address)}`, { headers: { Accept: 'application/json' } });
+        if (!r.ok)
+            return null;
+        // Only the signed fields count (the keeper adds unsigned envelope fields after signing).
+        const b = await verifyManifest(await r.json(), pinned, { network });
+        if (!b)
+            return null;
+        const gens = b.generations.filter(g => typeof g.zkAppAddress === 'string');
+        if (!gens.some(g => g.zkAppAddress === address))
+            return null;
+        const current = gens.find(g => g.gen === b.current)?.zkAppAddress;
+        const others = gens.map(g => g.zkAppAddress).filter(a => a !== current && a !== address).reverse();
+        return [...new Set([current, address, ...others].filter((a) => !!a))];
+    }
+    catch {
+        return null;
+    }
+}
+/** Folds the keeper's leaf fields and path; the on-chain root decides. */
+async function foldsTo(w, licenseHash, root) {
+    const { Field, UInt32 } = await import('o1js');
+    const { LicenseLeaf, leafHash } = await import('./licenseLeaf.js');
+    const { deserializeWitness } = await import('./licenseStore.js');
+    const leafValue = w.currentValue === '0'
+        ? Field(0)
+        : leafHash(new LicenseLeaf({
+            licenseHash: Field(licenseHash), expirySlot: UInt32.from(w.leaf.expirySlot), cap: UInt32.from(w.leaf.deviceCap),
+            deviceSlotsRoot: Field(w.leaf.deviceSlotsRoot), deviceSlotsFilled: UInt32.from(w.leaf.deviceSlotsFilled),
+        }));
+    const [computedRoot, key] = deserializeWitness({ isLefts: w.isLefts, siblings: w.siblings }).computeRootAndKey(leafValue);
+    return key.toString() === Field(licenseHash).toString() && computedRoot.toString() === root;
+}
+export async function verifyLicenseTrustless(opts) {
+    const f = opts.fetcher ?? fetch;
+    const base = opts.keeperUrl.replace(/\/+$/, '');
+    const graphqlUrl = opts.graphqlUrl ?? DEFAULT_MINA_GRAPHQL_URLS[opts.network];
+    if (!/^\d{1,80}$/.test(opts.licenseHash))
+        throw new AgentError('licenseHash must be a decimal field element', 'INVALID_REQUEST', 0, false);
+    const signed = await signedGenerations(base, opts.zkAppAddress, f, opts.pinnedPublicKeysBase64 ?? PLATFORM_MANIFEST_PUBKEYS, opts.network);
+    // The chain names the current generation too: a retired contract stores
+    // its successor. One found there goes first, so a missing or stale list
+    // still finds it.
+    let current;
+    try {
+        current = (await currentOnChain({ start: opts.zkAppAddress, layout: LICENSING_LINEAGE, canonicalVks: Object.values(CANONICAL_VK_HASHES), graphqlUrl, fetcher: f })).address;
+    }
+    catch (e) {
+        if (e instanceof MinaNodeError)
+            throw new AgentError(e.message, 'UPSTREAM_UNAVAILABLE', e.status, true);
+        return result({ valid: false, reason: `Not a genuine licensing lineage: ${e?.message ?? e}` }, opts.zkAppAddress, null, 0, signed);
+    }
+    const listed = signed ?? [opts.zkAppAddress];
+    const addresses = current === opts.zkAppAddress ? listed : [...new Set([current, ...listed])];
+    let last = null;
+    for (const address of addresses) {
+        const c = await readContract(address, graphqlUrl, f);
+        const problem = contractProblem(c);
+        if (problem) {
+            // The address asked about must be genuine; a broken other generation is skipped.
+            if (address === opts.zkAppAddress) {
+                return result({ valid: false, reason: `Not a genuine licensing contract: ${problem}` }, address, null, c.slot, signed);
+            }
+            continue;
+        }
+        const generation = Number(Object.entries(CANONICAL_VK_HASHES).find(([, h]) => h === c.vkHash)[0]);
+        let w = null;
+        let ok = false;
+        // The keeper may be a block or two behind a fresh purchase: one more read.
+        for (let attempt = 0; attempt < 2 && !ok; attempt++) {
+            if (attempt > 0)
+                await new Promise(r => setTimeout(r, opts.retryDelayMs ?? 3000));
+            const r = await f(`${base}/witness/${encodeURIComponent(address)}/${encodeURIComponent(opts.licenseHash)}?network=${opts.network}`, { headers: { Accept: 'application/json' } }).catch(() => null);
+            if (!r?.ok)
+                continue;
+            w = await r.json().catch(() => null);
+            if (w && Array.isArray(w.isLefts) && Array.isArray(w.siblings) && w.leaf)
+                ok = await foldsTo(w, opts.licenseHash, c.root);
+        }
+        if (!ok || !w) {
+            throw new AgentError(`The keeper's copy of ${address} does not match the chain (it may be catching up); retry, or check without trustless`, 'STATE_MISMATCH', 0, true, 10_000);
+        }
+        last = { address, generation, slot: c.slot };
+        if (w.currentValue === '0')
+            continue; // proved absent here: try the next generation
+        const expirySlot = w.leaf.expirySlot;
+        // A license that lapsed during the pre-fork sales freeze counts from the fork slot.
+        const until = effectiveExpirySlot(expirySlot, c.forkSlot ?? 0);
+        const inGracePeriod = c.slot > until && c.slot <= until + GRACE_PERIOD_N;
+        const expired = c.slot > until + GRACE_PERIOD_N;
+        return result({
+            valid: !expired,
+            expirySlot,
+            inGracePeriod: !expired && inGracePeriod,
+            expiresAt: new Date(Date.now() + (until - c.slot) * MS_PER_SLOT_N).toISOString(),
+            remainingDays: Math.floor((until - c.slot) / SLOTS_PER_DAY_N),
+            reason: expired ? 'License has expired' : inGracePeriod ? 'License is in grace period — renew to avoid interruption' : null,
+        }, address, generation, c.slot, signed);
+    }
+    return result({ valid: false, reason: 'License not found on chain (never bought at this app, or refunded)' }, last?.address ?? opts.zkAppAddress, last?.generation ?? null, last?.slot ?? 0, signed);
+}
+function result(r, address, generation, slot, signed) {
+    return {
+        valid: r.valid, expiresAt: r.expiresAt ?? null, expirySlot: r.expirySlot ?? 0, inGracePeriod: r.inGracePeriod ?? false,
+        remainingDays: r.remainingDays ?? 0, reason: r.reason, trustless: true,
+        resolvedAddress: address, generation, slot, generations: signed ? 'verified' : 'given-address-only',
+    };
+}
+//# sourceMappingURL=licenseTrustless.js.map

package/build/licenseTrustless.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"licenseTrustless.js","sourceRoot":"","sources":["../src/licenseTrustless.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,oCAAoC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,UAAU,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AACnE,OAAO,EAAE,mBAAmB,EAAE,cAAc,EAAE,mBAAmB,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AACvJ,OAAO,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAsBrD,KAAK,UAAU,YAAY,CAAC,OAAe,EAAE,UAAkB,EAAE,CAAe;IAC9E,IAAI,IAA+C,CAAC;IACpD,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,aAAa,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,MAAM,IAAI,UAAU,CAAC,CAAC,EAAE,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,CAAC,YAAY,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACzH,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IAClC,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,UAAU,CAAC,aAAa,UAAU,kCAAkC,EAAE,sBAAsB,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACzI,IAAI,CAAC,CAAC,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC5C,OAAO;QACL,KAAK,EAAE,IAAI,EAAE,IAAI;QACjB,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC3E,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,SAAS,EAAE,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC,WAAW,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,WAAW,EAAE,kBAAkB,EAAE,IAAI;KAChJ,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,eAAe,CAAC,CAAe;IAC7C,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI;QAAE,OAAO,0CAA0C,CAAC;IAC3E,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;QAAE,OAAO,yEAAyE,CAAC;IAC1J,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO;QAAE,OAAO,mDAAmD,CAAC;IACxF,IAAI,CAAC,CAAC,kBAAkB,KAAK,YAAY;QAAE,OAAO,kDAAkD,CAAC;IACrG,IAAI,CAAC,CAAC,cAAc,KAAK,YAAY;QAAE,OAAO,4CAA4C,CAAC;IAC3F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,OAAe,EAAE,CAAe,EAAE,MAAyB,EAAE,OAA6B;IACvI,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,IAAI,oBAAoB,kBAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACzH,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACvB,yFAAyF;QACzF,MAAM,CAAC,GAAG,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,MAAM,IAAI,GAAI,CAAC,CAAC,WAA8D,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC;QAC/H,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAa,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC;QACpG,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAID,0EAA0E;AAC1E,KAAK,UAAU,OAAO,CAAC,CAAU,EAAE,WAAmB,EAAE,IAAY;IAClE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACnE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,CAAC,CAAC,YAAY,KAAK,GAAG;QACtC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACV,CAAC,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC;YACzB,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC;YAC/G,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC;SACzG,CAAC,CAAC,CAAC;IACN,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,GAAG,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1H,OAAO,GAAG,CAAC,QAAQ,EAAE,KAAK,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,IAAI,YAAY,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC;AAC9F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAW5C;IACC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9E,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,6CAA6C,EAAE,iBAAiB,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IAE3I,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,EAAE,IAAI,CAAC,sBAAsB,IAAI,yBAAyB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3I,wEAAwE;IACxE,wEAAwE;IACxE,kBAAkB;IAClB,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9K,CAAC;IAAC,OAAO,CAAM,EAAE,CAAC;QAChB,IAAI,CAAC,YAAY,aAAa;YAAE,MAAM,IAAI,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,sBAAsB,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACxG,OAAO,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,CAAC,EAAE,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;IACrI,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,OAAO,KAAK,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAE9F,IAAI,IAAI,GAAwE,IAAI,CAAC;IACrF,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,OAAO,EAAE,CAAC;YACZ,iFAAiF;YACjF,IAAI,OAAO,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClC,OAAO,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qCAAqC,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACzH,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACnG,IAAI,CAAC,GAAmB,IAAI,CAAC;QAC7B,IAAI,EAAE,GAAG,KAAK,CAAC;QACf,2EAA2E;QAC3E,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC;YACpD,IAAI,OAAO,GAAG,CAAC;gBAAE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,CAAC;YAClF,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,IAAI,YAAY,kBAAkB,CAAC,OAAO,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YACnM,IAAI,CAAC,CAAC,EAAE,EAAE;gBAAE,SAAS;YACrB,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAmB,CAAC;YACvD,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI;gBAAE,EAAE,GAAG,MAAM,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,IAAK,CAAC,CAAC;QAC7H,CAAC;QACD,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YACd,MAAM,IAAI,UAAU,CAAC,wBAAwB,OAAO,sFAAsF,EAAE,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACjL,CAAC;QACD,IAAI,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,CAAC,YAAY,KAAK,GAAG;YAAE,SAAS,CAAC,8CAA8C;QACpF,MAAM,UAAU,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;QACrC,oFAAoF;QACpF,MAAM,KAAK,GAAG,mBAAmB,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC;QAC/D,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,GAAG,cAAc,CAAC;QACzE,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,GAAG,KAAK,GAAG,cAAc,CAAC;QAChD,OAAO,MAAM,CAAC;YACZ,KAAK,EAAE,CAAC,OAAO;YACf,UAAU;YACV,aAAa,EAAE,CAAC,OAAO,IAAI,aAAa;YACxC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,CAAC,WAAW,EAAE;YAChF,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC;YAC7D,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,0DAA0D,CAAC,CAAC,CAAC,IAAI;SAC5H,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,oEAAoE,EAAE,EAC1G,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,UAAU,IAAI,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;AAC3F,CAAC;AAED,SAAS,MAAM,CACb,CAAoF,EACpF,OAAe,EAAE,UAAyB,EAAE,IAAY,EAAE,MAAuB;IAEjF,OAAO;QACL,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,IAAI,KAAK;QACtH,aAAa,EAAE,CAAC,CAAC,aAAa,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI;QACtE,eAAe,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,oBAAoB;KACpG,CAAC;AACJ,CAAC"}

package/build/manifestVerify.d.ts

@@ -3,7 +3,7 @@
  *
  * Browser + Node Ed25519 signature verification for platform-signed manifests
  * (currently: the generation-list served at GET /apps/:appId, next: the
- * sales-freeze manifest). The keeper signs with the platform manifest key
+ * sales-freeze manifest). The backend signs with the platform manifest key
  * loaded via PLATFORM_MANIFEST_KEY_FILE; the SDK pins the public key against
  * a caller-supplied allow-list and verifies before trusting anything.
  *
@@ -27,4 +27,32 @@ export declare function canonicalize(value: unknown): string;
  * as "do not trust."
  */
 export declare function verifyManifestSignature(payload: unknown, signatureBase64: string, pinnedPublicKeysBase64: readonly string[]): Promise<boolean>;
+/**
+ * The fields the platform signs in an app's generation manifest (GET
+ * /apps/:appId, and the vendor's /.well-known/zklicensing/<address>.json).
+ * The keeper adds envelope fields after signing (signature, publicKey, app,
+ * forkActivationSlot…), so verifiers rebuild exactly these. `network` keeps a
+ * devnet manifest from passing for mainnet and the other way round.
+ */
+export type SignedManifest = {
+    appId: string;
+    network: 'devnet' | 'mainnet';
+    current: number;
+    generations: unknown[];
+    issuedAt: string;
+};
+/** The signed fields of a manifest body, or null when any is missing. */
+export declare function signedManifestOf(body: unknown): SignedManifest | null;
+/**
+ * Every signature a manifest carries: `signature`, and `signatures` (one per
+ * platform key; during a key rotation both the old and the new key sign).
+ */
+export declare function manifestSignaturesOf(body: unknown): string[];
+/**
+ * The signed manifest in `body` when one of its signatures verifies against
+ * a pinned key (and it is for `expect.network`, when given); else null.
+ */
+export declare function verifyManifest(body: unknown, pinnedPublicKeysBase64: readonly string[], expect?: {
+    network?: 'devnet' | 'mainnet';
+}): Promise<SignedManifest | null>;
 //# sourceMappingURL=manifestVerify.d.ts.map

package/build/manifestVerify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifestVerify.d.ts","sourceRoot":"","sources":["../src/manifestVerify.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;GAmBG;AASH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAQnD;AA6BD;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,eAAe,EAAE,MAAM,EACvB,sBAAsB,EAAE,SAAS,MAAM,EAAE,GACxC,OAAO,CAAC,OAAO,CAAC,CA+BlB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,OAAO,EAAE,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,yEAAyE;AACzE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,OAAO,GAAG,cAAc,GAAG,IAAI,CAMrE;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,EAAE,CAK5D;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,OAAO,EACb,sBAAsB,EAAE,SAAS,MAAM,EAAE,EACzC,MAAM,GAAE;IAAE,OAAO,CAAC,EAAE,QAAQ,GAAG,SAAS,CAAA;CAAO,GAC9C,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAQhC"}

package/build/manifestVerify.js

@@ -1,11 +1,11 @@
 // Copyright (c) 2025-2026 zkLicensing project developers
-// All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
 /**
  * manifestVerify.ts
  *
  * Browser + Node Ed25519 signature verification for platform-signed manifests
  * (currently: the generation-list served at GET /apps/:appId, next: the
- * sales-freeze manifest). The keeper signs with the platform manifest key
+ * sales-freeze manifest). The backend signs with the platform manifest key
  * loaded via PLATFORM_MANIFEST_KEY_FILE; the SDK pins the public key against
  * a caller-supplied allow-list and verifies before trusting anything.
  *
@@ -21,6 +21,10 @@
  * simple and mirrored.
  */
 // Canonical JSON: sorted keys, no whitespace, arrays preserved in order.
+// Undefined values are skipped, mirroring JSON.stringify — otherwise the
+// signed bytes would contain `"key":undefined` for optional fields left
+// unset, while `res.json()` on the wire would strip them, and the signature
+// would never verify.
 // Mirror of src/manifestSign.ts:canonicalize. Divergence here silently
 // breaks verification.
 export function canonicalize(value) {
@@ -28,8 +32,9 @@ export function canonicalize(value) {
         return JSON.stringify(value);
     if (Array.isArray(value))
         return '[' + value.map(canonicalize).join(',') + ']';
-    const keys = Object.keys(value).sort();
-    return '{' + keys.map(k => JSON.stringify(k) + ':' + canonicalize(value[k])).join(',') + '}';
+    const obj = value;
+    const keys = Object.keys(obj).filter(k => obj[k] !== undefined).sort();
+    return '{' + keys.map(k => JSON.stringify(k) + ':' + canonicalize(obj[k])).join(',') + '}';
 }
 function base64ToBytes(b64) {
     // atob is present in every modern JS runtime we target (browser + Node ≥ 16).
@@ -92,4 +97,41 @@ export async function verifyManifestSignature(payload, signatureBase64, pinnedPu
     }
     return false;
 }
+/** The signed fields of a manifest body, or null when any is missing. */
+export function signedManifestOf(body) {
+    if (!body || typeof body !== 'object')
+        return null;
+    const b = body;
+    if (typeof b.appId !== 'string' || (b.network !== 'devnet' && b.network !== 'mainnet') || typeof b.current !== 'number'
+        || !Array.isArray(b.generations) || typeof b.issuedAt !== 'string')
+        return null;
+    return { appId: b.appId, network: b.network, current: b.current, generations: b.generations, issuedAt: b.issuedAt };
+}
+/**
+ * Every signature a manifest carries: `signature`, and `signatures` (one per
+ * platform key; during a key rotation both the old and the new key sign).
+ */
+export function manifestSignaturesOf(body) {
+    if (!body || typeof body !== 'object')
+        return [];
+    const b = body;
+    const list = Array.isArray(b.signatures) ? b.signatures.map((s) => s?.signature).filter((s) => typeof s === 'string') : [];
+    return [...new Set([...(typeof b.signature === 'string' ? [b.signature] : []), ...list])];
+}
+/**
+ * The signed manifest in `body` when one of its signatures verifies against
+ * a pinned key (and it is for `expect.network`, when given); else null.
+ */
+export async function verifyManifest(body, pinnedPublicKeysBase64, expect = {}) {
+    const payload = signedManifestOf(body);
+    if (!payload)
+        return null;
+    if (expect.network && payload.network !== expect.network)
+        return null;
+    for (const sig of manifestSignaturesOf(body)) {
+        if (await verifyManifestSignature(payload, sig, pinnedPublicKeysBase64))
+            return payload;
+    }
+    return null;
+}
 //# sourceMappingURL=manifestVerify.js.map

package/build/manifestVerify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifestVerify.js","sourceRoot":"","sources":["../src/manifestVerify.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,oCAAoC;AAEpC;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,yEAAyE;AACzE,yEAAyE;AACzE,wEAAwE;AACxE,4EAA4E;AAC5E,sBAAsB;AACtB,uEAAuE;AACvE,uBAAuB;AACvB,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;IAC/E,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;IACvE,OAAO,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CACxB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAC/C,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;AACpB,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,8EAA8E;IAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,4DAA4D;AAC5D,0EAA0E;AAC1E,2DAA2D;AAC3D,MAAM,mBAAmB,GAAG,IAAI,UAAU,CAAC;IACzC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CACvE,CAAC,CAAC;AAEH,SAAS,gBAAgB,CAAC,GAAe;IACvC,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7F,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,mBAAmB,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IACpE,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC;IAChC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACzC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAgB,EAChB,eAAuB,EACvB,sBAAyC;IAEzC,IAAI,CAAC,sBAAsB,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,MAAM,GAAI,UAAU,CAAC,MAA6B,EAAE,MAAM,CAAC;IACjE,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,IAAI,cAA0B,CAAC;IAC/B,IAAI,CAAC;QAAC,cAAc,GAAG,aAAa,CAAC,eAAe,CAAC,CAAC;IAAC,CAAC;IACxD,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;IACvB,KAAK,MAAM,MAAM,IAAI,sBAAsB,EAAE,CAAC;QAC5C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,gBAAgB,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;YACrD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,SAAS,CAChC,MAAM,EACN,IAA8B,EAC9B,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAC5B,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,GAAG,EACH,cAAwC,EACxC,YAAsC,CACvC,CAAC;YACF,IAAI,EAAE;gBAAE,OAAO,IAAI,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,2CAA2C;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAiBD,yEAAyE;AACzE,MAAM,UAAU,gBAAgB,CAAC,IAAa;IAC5C,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,CAAC,GAAG,IAA+B,CAAC;IAC1C,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;WAClH,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAClF,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACjD,MAAM,CAAC,GAAG,IAAqD,CAAC;IAChE,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtJ,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAa,EACb,sBAAyC,EACzC,SAA6C,EAAE;IAE/C,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACtE,KAAK,MAAM,GAAG,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,IAAI,MAAM,uBAAuB,CAAC,OAAO,EAAE,GAAG,EAAE,sBAAsB,CAAC;YAAE,OAAO,OAAO,CAAC;IAC1F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/build/minaPriceHistory.d.ts

@@ -0,0 +1,9 @@
+export type HistoricalRate = {
+    eur: number;
+    usd: number;
+    gbp: number;
+};
+export declare function slotToUtcDate(slot: number, currentSlot: number, nowMs: number): string;
+export declare function getMinaFiatForDate(iso: string): Promise<HistoricalRate | null>;
+export declare function _resetForTests(): void;
+//# sourceMappingURL=minaPriceHistory.d.ts.map

package/build/minaPriceHistory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"minaPriceHistory.d.ts","sourceRoot":"","sources":["../src/minaPriceHistory.ts"],"names":[],"mappings":"AAsCA,MAAM,MAAM,cAAc,GAAG;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAKF,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAItF;AAmED,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAmCpF;AAKD,wBAAgB,cAAc,IAAI,IAAI,CAOrC"}

package/build/minaPriceHistory.js

@@ -0,0 +1,152 @@
+// Copyright (c) 2025-2026 zkLicensing project developers
+// SPDX-License-Identifier: BUSL-1.1
+/**
+ * minaPriceHistory.ts
+ *
+ * Historical MINA→fiat lookups for archive-replayed license records that were
+ * created before the backend had a live CoinGecko cache. Uses CoinGecko's
+ * free-tier `/coins/mina-protocol/history?date=DD-MM-YYYY` endpoint, which
+ * returns a UTC end-of-day snapshot in a single call. Rates for a past day
+ * never change, so results are cached permanently to a JSON file — a repeat
+ * bootstrap replays without another HTTP round-trip.
+ *
+ * Not used by live purchase / renew flows — those keep hitting the 5-minute
+ * `/simple/price` cache in keeperService.ts. Only invoked by the backfill
+ * pass that stamps historical `fiatSnapshot` after archive replay.
+ */
+import fs from 'fs/promises';
+// Mina consensus slot is 3 min in theory; on-chain block time targets 90s.
+// The stats module uses the same constant for its monthly aggregation
+// (stats.ts:25). Any drift here shows up as records stamped with the wrong
+// day's rate for events near the UTC midnight boundary.
+const SLOT_DURATION_MS = 90 * 1000;
+// CoinGecko free-tier is ~30 req/min. A 1.5s spacing keeps us comfortably
+// under that for a single-tenant backend backfill; if a very large replay ever
+// hits the limit CoinGecko returns 429 and getMinaFiatForDate returns null,
+// leaving that day's records unstamped (dashboards render fiat as `—`).
+const THROTTLE_MS = 1500;
+// Days for which CoinGecko returned no usable data. Kept in-memory only —
+// they don't get written to the on-disk cache so a follow-up bootstrap after
+// e.g. a CoinGecko outage will retry them. Guards against re-hitting the
+// endpoint for the same missing date within one process lifetime.
+const missingDates = new Set();
+// Convert a Mina global slot to a UTC calendar date (YYYY-MM-DD). Uses the
+// per-network (currentSlot, nowMs) pair as the anchor so caller can pass the
+// clock captured at bootstrap time. Same trick stats.ts:slotToMonthKey uses.
+export function slotToUtcDate(slot, currentSlot, nowMs) {
+    const ms = nowMs - (currentSlot - slot) * SLOT_DURATION_MS;
+    const d = new Date(ms);
+    return `${d.getUTCFullYear()}-${String(d.getUTCMonth() + 1).padStart(2, '0')}-${String(d.getUTCDate()).padStart(2, '0')}`;
+}
+function isoToCoinGeckoDate(iso) {
+    const [y, m, d] = iso.split('-');
+    return `${d}-${m}-${y}`;
+}
+function cachePath() {
+    return process.env.MINA_PRICE_CACHE_PATH ?? 'mina-prices.json';
+}
+let cache = null;
+let cacheLoaded = false;
+async function loadCache() {
+    if (cacheLoaded && cache)
+        return cache;
+    try {
+        const raw = await fs.readFile(cachePath(), 'utf8');
+        const parsed = JSON.parse(raw);
+        if (parsed && typeof parsed === 'object') {
+            cache = parsed;
+        }
+        else {
+            cache = {};
+        }
+    }
+    catch {
+        cache = {};
+    }
+    cacheLoaded = true;
+    return cache;
+}
+// Serialize cache writes so concurrent stamping calls don't clobber each
+// other's entries. Every write flushes the whole file — tiny (< 10KB even
+// for years of dates) so no need for anything fancier.
+let writeChain = Promise.resolve();
+function withWriteLock(fn) {
+    const result = writeChain.then(fn, fn);
+    writeChain = result.then(() => { }, () => { });
+    return result;
+}
+async function persistCache() {
+    if (!cache)
+        return;
+    await fs.writeFile(cachePath(), JSON.stringify(cache, null, 2));
+}
+// Serialize the outbound HTTP calls so we respect CoinGecko's rate limit
+// without a global scheduler. Concurrent callers of getMinaFiatForDate for
+// distinct dates queue up 1.5s apart.
+let lastFetchAt = 0;
+let fetchChain = Promise.resolve();
+function throttled(fn) {
+    const next = fetchChain.then(async () => {
+        const wait = Math.max(0, THROTTLE_MS - (Date.now() - lastFetchAt));
+        if (wait > 0)
+            await new Promise(r => setTimeout(r, wait));
+        lastFetchAt = Date.now();
+    });
+    fetchChain = next.then(() => { }, () => { });
+    return next.then(fn);
+}
+// Return { eur, usd, gbp } for the given UTC calendar date, or null if the
+// endpoint fails or omits any of the three currencies. Cached results are
+// returned immediately. Fail-soft: no exceptions, just null → caller leaves
+// the record unstamped.
+export async function getMinaFiatForDate(iso) {
+    const c = await loadCache();
+    if (c[iso])
+        return c[iso];
+    if (missingDates.has(iso))
+        return null;
+    const cgDate = isoToCoinGeckoDate(iso);
+    const url = `https://api.coingecko.com/api/v3/coins/mina-protocol/history?date=${cgDate}&localization=false`;
+    try {
+        const r = await throttled(() => fetch(url));
+        if (!r.ok) {
+            missingDates.add(iso);
+            return null;
+        }
+        const d = await r.json();
+        const px = d?.market_data?.current_price;
+        const eur = px?.eur;
+        const usd = px?.usd;
+        const gbp = px?.gbp;
+        const eurOk = typeof eur === 'number' && Number.isFinite(eur) && eur > 0;
+        const usdOk = typeof usd === 'number' && Number.isFinite(usd) && usd > 0;
+        const gbpOk = typeof gbp === 'number' && Number.isFinite(gbp) && gbp > 0;
+        if (!eurOk || !usdOk || !gbpOk) {
+            missingDates.add(iso);
+            return null;
+        }
+        const rate = { eur: eur, usd: usd, gbp: gbp };
+        await withWriteLock(async () => {
+            const cc = await loadCache();
+            cc[iso] = rate;
+            await persistCache();
+        });
+        return rate;
+    }
+    catch {
+        missingDates.add(iso);
+        return null;
+    }
+}
+// Test-only: reset in-process state so unit tests can exercise fresh cache
+// misses without cross-contamination. Not exported through the SDK's public
+// entry points.
+export function _resetForTests() {
+    cache = null;
+    cacheLoaded = false;
+    missingDates.clear();
+    lastFetchAt = 0;
+    fetchChain = Promise.resolve();
+    writeChain = Promise.resolve();
+}
+//# sourceMappingURL=minaPriceHistory.js.map

package/build/minaPriceHistory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"minaPriceHistory.js","sourceRoot":"","sources":["../src/minaPriceHistory.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,oCAAoC;AAEpC;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,MAAM,aAAa,CAAC;AAE7B,2EAA2E;AAC3E,sEAAsE;AACtE,2EAA2E;AAC3E,wDAAwD;AACxD,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AAEnC,0EAA0E;AAC1E,+EAA+E;AAC/E,4EAA4E;AAC5E,wEAAwE;AACxE,MAAM,WAAW,GAAG,IAAI,CAAC;AAEzB,0EAA0E;AAC1E,6EAA6E;AAC7E,yEAAyE;AACzE,kEAAkE;AAClE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;AAQvC,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,WAAmB,EAAE,KAAa;IAC5E,MAAM,EAAE,GAAG,KAAK,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,gBAAgB,CAAC;IAC3D,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;IACvB,OAAO,GAAG,CAAC,CAAC,cAAc,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;AAC5H,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,kBAAkB,CAAC;AACjE,CAAC;AAID,IAAI,KAAK,GAAqB,IAAI,CAAC;AACnC,IAAI,WAAW,GAAG,KAAK,CAAC;AAExB,KAAK,UAAU,SAAS;IACtB,IAAI,WAAW,IAAI,KAAK;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzC,KAAK,GAAG,MAAmB,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,KAAK,GAAG,EAAE,CAAC;QACb,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,EAAE,CAAC;IACb,CAAC;IACD,WAAW,GAAG,IAAI,CAAC;IACnB,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yEAAyE;AACzE,0EAA0E;AAC1E,uDAAuD;AACvD,IAAI,UAAU,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;AAClD,SAAS,aAAa,CAAI,EAAoB;IAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;IACvC,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC7C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,YAAY;IACzB,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,yEAAyE;AACzE,2EAA2E;AAC3E,sCAAsC;AACtC,IAAI,WAAW,GAAG,CAAC,CAAC;AACpB,IAAI,UAAU,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;AAClD,SAAS,SAAS,CAAI,EAAoB;IACxC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,CAAC,CAAC;QACnE,IAAI,IAAI,GAAG,CAAC;YAAE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAC1D,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC3C,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACvB,CAAC;AAED,2EAA2E;AAC3E,0EAA0E;AAC1E,4EAA4E;AAC5E,wBAAwB;AACxB,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAW;IAClD,MAAM,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC;IAC5B,IAAI,CAAC,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,qEAAqE,MAAM,qBAAqB,CAAC;IAC7G,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5C,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAwF,CAAC;QAC/G,MAAM,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,aAAa,CAAC;QACzC,MAAM,GAAG,GAAG,EAAE,EAAE,GAAG,CAAC;QACpB,MAAM,GAAG,GAAG,EAAE,EAAE,GAAG,CAAC;QACpB,MAAM,GAAG,GAAG,EAAE,EAAE,GAAG,CAAC;QACpB,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;QACzE,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;QACzE,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;QACzE,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YAC/B,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,IAAI,GAAmB,EAAE,GAAG,EAAE,GAAI,EAAE,GAAG,EAAE,GAAI,EAAE,GAAG,EAAE,GAAI,EAAE,CAAC;QACjE,MAAM,aAAa,CAAC,KAAK,IAAI,EAAE;YAC7B,MAAM,EAAE,GAAG,MAAM,SAAS,EAAE,CAAC;YAC7B,EAAE,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;YACf,MAAM,YAAY,EAAE,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,4EAA4E;AAC5E,gBAAgB;AAChB,MAAM,UAAU,cAAc;IAC5B,KAAK,GAAG,IAAI,CAAC;IACb,WAAW,GAAG,KAAK,CAAC;IACpB,YAAY,CAAC,KAAK,EAAE,CAAC;IACrB,WAAW,GAAG,CAAC,CAAC;IAChB,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAC/B,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;AACjC,CAAC"}

package/build/onChainRoot.d.ts

@@ -0,0 +1,60 @@
+/**
+ * onChainRoot.ts
+ *
+ * Non-custodial trust anchor for `verifyOffline`. Reads the live
+ * `licensesRoot` (`zkapp.appState[0]`) directly from Mina — no
+ * licensing-service round-trip, no trust assumption about whoever
+ * served the witness / license record.
+ *
+ * Pair it with `verifyOffline` to close the trust loop:
+ *
+ *   ```ts
+ *   import { fetchOnChainLicensesRoot } from 'zklicensing/on-chain-root';
+ *   import { verifyOffline }            from 'zklicensing/verify-offline';
+ *
+ *   // 1. Ask the licensing service for a witness + slot snapshot.
+ *   const snap = await fetch(`${service}/witness?licenseHash=${h}&zkAppAddress=${a}`).then(r => r.json());
+ *
+ *   // 2. Fetch the on-chain root INDEPENDENTLY, from Mina.
+ *   const onChainRoot = await fetchOnChainLicensesRoot({ zkAppAddress: a, network: 'devnet' });
+ *
+ *   // 3. Cross-check — if they disagree, the service is stale/wrong; bail.
+ *   if (snap.root !== onChainRoot) throw new Error('service root disagrees with chain');
+ *
+ *   // 4. Fold-verify the snapshot against the on-chain root.
+ *   const res = verifyOffline({ licensesRoot: onChainRoot, ...snap });
+ *   ```
+ *
+ * The read goes to the node's GraphQL API directly: no o1js is needed
+ * and o1js's global Mina instance is never touched, so it is safe in
+ * long-lived hosts that talk to several networks.
+ */
+export declare const DEFAULT_MINA_GRAPHQL_URLS: {
+    readonly mainnet: "https://api.minascan.io/node/mainnet/v1/graphql";
+    readonly devnet: "https://devnet-plain-1.gcp.o1test.net/graphql";
+};
+export type NetworkName = 'mainnet' | 'devnet';
+export type FetchOnChainLicensesRootInput = {
+    /** B62q… address of the deployed LicensingApp for this app. */
+    zkAppAddress: string;
+} & ({
+    network: NetworkName;
+    graphqlUrl?: string;
+} | {
+    graphqlUrl: string;
+    network?: NetworkName;
+});
+/**
+ * Read the live `licensesRoot` from the deployed LicensingApp's
+ * on-chain state. Returns the field value as a decimal string,
+ * matching the shape `verifyOffline` and the licensing service both
+ * consume.
+ *
+ * Throws on any of:
+ *   - `fetchAccount` returned an error (network down, wrong endpoint,
+ *     account doesn't exist on this chain);
+ *   - account exists but has no zkApp state (not a zkApp address, or
+ *     contract deployed but `initialize()` never ran).
+ */
+export declare function fetchOnChainLicensesRoot(input: FetchOnChainLicensesRootInput): Promise<string>;
+//# sourceMappingURL=onChainRoot.d.ts.map

package/build/onChainRoot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"onChainRoot.d.ts","sourceRoot":"","sources":["../src/onChainRoot.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAOH,eAAO,MAAM,yBAAyB;;;CAG5B,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE/C,MAAM,MAAM,6BAA6B,GAAG;IAC1C,+DAA+D;IAC/D,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,CACA;IAAE,OAAO,EAAE,WAAW,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7C;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,WAAW,CAAA;CAAE,CAChD,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,6BAA6B,GACnC,OAAO,CAAC,MAAM,CAAC,CAoBjB"}