zklicensing 0.1.0-beta.2 → 0.1.0-beta.21

package/build/permitsClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permitsClient.d.ts","sourceRoot":"","sources":["../src/permitsClient.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAqD,KAAK,iBAAiB,EAAE,KAAK,YAAY,EAAE,KAAK,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AACjK,OAAO,KAAK,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AACrF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD,kGAAkG;AAClG,MAAM,MAAM,mBAAmB,GAAG;IAChC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,WAAW,GAAG,yBAAyB,CAAC;IAC9G,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACzH,CAAC;AAEF,gFAAgF;AAChF,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC;IAC1G,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;IAC7D,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,IAAI,EAAE;QACJ,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QACnH,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAC;KAC9D,CAAC;IACF,OAAO,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnF,CAAC;AAEF,MAAM,MAAM,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE3C,2CAA2C;AAC3C,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,mDAAmD;IACnD,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,2CAA2C;IAC3C,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACzE,0FAA0F;IAC1F,sBAAsB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAClE;AAED,qBAAa,YAAa,SAAQ,KAAK;IACR,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM;IAAE,QAAQ,CAAC,SAAS,EAAE,OAAO;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO;gBAApH,OAAO,EAAE,MAAM,EAAW,MAAM,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,EAAW,SAAS,EAAE,OAAO,EAAW,IAAI,GAAE,OAAc;CAIxI;AAGD;qEACqE;AACrE,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtH;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAC1E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CACtF,CAAC;AAEF,wBAAgB,0BAA0B,CAAC,CAAC,EAAE;IAC5C,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;CAClH,GAAG,MAAM,CAST;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,CAAC,CAAC,EAAE,wBAAwB,KAAK,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,OAAO,GAAG,IAAI,CAAC;IAC7F,2EAA2E;IAC3E,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,CAAC;CACpF,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAChG,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAChF,OAAO,CAAC,EAAE,YAAY,CAAC;IAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IAC/C,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IACnH,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACvC,wEAAwE;IACxE,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IACxD,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,oBAAoB;;kBA6BpC,OAAO,CAAC,MAAM,CAAC;;oBAoCI,GAAG,EAAE;;2BACvB,MAAM;kBAAsB,GAAG;gBAAU,GAAG;;IACnE,yGAAyG;+BAC9E,MAAM;IACjC;;;;;OAKG;0BACmB,MAAM,WAAW,MAAM;gBACnC,YAAY,GAAG,IAAI;gBAAU,gBAAgB;cAAQ,MAAM;cAAQ,MAAM;iBAAW;YAAE,OAAO,EAAE,OAAO,EAAE,CAAC;YAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;SAAE;mBAC3H,MAAM;qBAAe,MAAM;iBAAW,OAAO;;IAE1D,2FAA2F;8BACjE,MAAM;kBACpB,MAAM;iBAAW,MAAM;oBAAc,MAAM;gBAAU,MAAM;iBAAW,MAAM;qBACzE,KAAK,CAAC;YAAE,UAAU,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;oCACnE,MAAM;eAC3B;YAAE,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,OAAO,EAAE,OAAO,CAAC;YAAC,OAAO,EAAE,OAAO,CAAC;YAAC,UAAU,EAAE,OAAO,CAAC;YAAC,mBAAmB,EAAE,OAAO,CAAA;SAAE,GAAG,IAAI;QAC3I,sGAAsG;kBAC5F;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;YAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;YAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,SAAS,CAAC,EAAE,GAAG,CAAC;YAAC,OAAO,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;YAAC,aAAa,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC,CAAC,2FAA2F;YAAC,UAAU,CAAC,EAAE,OAAO,CAAA;SAAE,GAAG,IAAI;;6BAEjS,MAAM,WAAW,MAAM,UAAU,MAAM,GAAG,MAAM;eACzD,OAAO;gBAAU,gBAAgB;iBAAW,OAAO;cAAQ,MAAM;cAAQ,MAAM;gBAAU,GAAG;;qBAC3F,MAAM;iBAAqC,WAAW;;IAGvE,4FAA4F;4BAC9D,gBAAgB,GAAG;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE;mBAKzF,GAAG;;IAE9B;;;;OAIG;IACH;;;;OAIG;;oBAEkB,KAAK,CAAC;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,YAAY,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,KAAK,CAAC;gBAAE,EAAE,EAAE,MAAM,CAAC;gBAAC,SAAS,EAAE,MAAM,CAAC;gBAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;gBAAC,OAAO,EAAE,MAAM,CAAC;gBAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;gBAAC,YAAY,EAAE,MAAM,CAAA;aAAE,CAAC,CAAA;SAAE,CAAC;eAAS,MAAM;mBAAa,MAAM;;mCAE5T,MAAM;IAErC;;;OAGG;uCACgC,MAAM,eAAe,MAAM;IAE9D,4FAA4F;yBACvE,MAAM;IAE3B;;;;OAIG;;iBAEQ,MAAM;cAAQ,MAAM;sBACf,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAC;YAAC,cAAc,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,GAAG,GAAG,IAAI,CAAC;YAAC,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC;YAAC,UAAU,EAAE,GAAG,GAAG,IAAI,CAAA;SAAE,CAAC;iBAC5L,KAAK,CAAC,YAAY,GAAG;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAC;YAAC,UAAU,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,OAAO,CAAC;YAAC,eAAe,EAAE,gBAAgB,CAAA;SAAE,CAAC;gBACzI,KAAK,CAAC;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,YAAY,CAAC;YAAC,GAAG,EAAE,MAAM,CAAC;YAAC,SAAS,EAAE,MAAM,CAAA;SAAE,CAAC;;IAE9H,qFAAqF;;mBAC/C,GAAG;sBAAgB;YAAE,OAAO,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE;;IAC1F,mEAAmE;;oBACxB,GAAG,EAAE;;6BACvB,MAAM,WAAW,MAAM;kBAC7B,WAAW,EAAE;;4BACR;QACtB,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAC9G,MAAM,EAAE,KAAK,CAAC;YAAE,GAAG,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QAAC,MAAM,CAAC,EAAE;YAAE,WAAW,CAAC,EAAE,MAAM,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,CAAC;YAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;YAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;SAAE,CAAC;QAC5J,YAAY,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAC/D,oIAAoI;QACpI,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;KACrD;kBAAsB,GAAG;iBAAW,WAAW;;IAChD;;;;;OAKG;sCAC+B,MAAM,QAAQ;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE;kBACnH,GAAG;gBAAU,OAAO;;IACvC,mGAAmG;oCACnE,MAAM,QAAQ,OAAO;kBAAsB,GAAG;;IAC9E,0EAA0E;qCACzC,MAAM;kBAAsB,GAAG;;IAChE,qHAAqH;iCACxF,MAAM;IACnC,6HAA6H;wCACzF,MAAM,WAAU;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE;kBAC/D,MAAM;iBAAW,MAAM;sBAAgB,mBAAmB,EAAE;;IAE/E,+EAA+E;2BAClD,MAAM,SAAS,MAAM;iBASzB,WAAW;;IAGpC;;;;;;;;;;;OAWG;iCAC0B,MAAM;mBACf,GAAG;uBAAiB,WAAW,GAAG,IAAI;4BAAsB,OAAO;iBAAW,WAAW;;kBAAiB,IAAI;0BAAoB,MAAM;sBAAgB,MAAM,GAAG,IAAI;;IACzL,8DAA8D;+BACnC,MAAM;kBAAsB,GAAG;;IAE1D,8EAA8E;8BAC9C,MAAM;;;;iCAQT,MAAM,WAAW,MAAM;sBAC7B,GAAG,EAAE;wBAAkB,OAAO;;IACrD;;;;;;;OAOG;6BACsB,MAAM;qBACT,GAAG;kBAAY,WAAW;;IAChD;;;;;;OAMG;4BACqB,MAAM,WAAW,MAAM,eAAe,MAAM;qBAC9C,GAAG;kBAAY,WAAW;;+BACrB,MAAM,WAAW,MAAM,UAAU;QAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE;iBAC/H,WAAW;;8BACH,MAAM,WAAW,MAAM,UAAU,SAAS,GAAG,WAAW,GAAG,QAAQ,eAAe,MAAM;iBAChG,WAAW;;IAC7B,qGAAqG;4BAC7E,MAAM,gBAAgB,MAAM,mBAAmB,MAAM,iBAAiB;QAAE,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE;iBACnI,WAAW;;gCACD,MAAM,QAAQ,MAAM,EAAE,aAAa,MAAM;iBACnD,WAAW;;IAE7B,gGAAgG;8BAChE,MAAM;;;IAUtC;;;;;;;;;;;;;;;OAeG;oBACmB,MAAM,KAAK;QAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC5G,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QACnI,GAAG,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,YAAY,CAAC;KACrC;qBAI+B,GAAG;eAAS,GAAG;iBAAW,MAAM;cAAQ,MAAM;wBAAkB,MAAM;mBAAa,MAAM;wBAAkB;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE;;yBAmC3K,MAAM;qBACZ,GAAG;iBAAW,WAAW,GAAG,IAAI;cAAQ,MAAM,GAAG,IAAI;eAC3D;YAAE,WAAW,EAAE,iBAAiB,CAAC;YAAC,GAAG,EAAE,MAAM,CAAC;YAAC,aAAa,EAAE,MAAM,CAAC;YAAC,cAAc,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,EAAE,CAAC;YACrH,mIAAmI;YACnI,aAAa,CAAC,EAAE;gBAAE,MAAM,EAAE,SAAS,GAAG,UAAU,CAAC;gBAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;aAAE,CAAA;SAAE,GAAG,IAAI;0BAC9E,MAAM,EAAE;sBAAgB,OAAO,GAAG,IAAI;;IAG1D;;;;OAIG;wBACuB,MAAM,UAAU,YAAY;;;;;;IAiBtD;;;;OAIG;4BAC2B,MAAM;qBAG6B,GAAG;;;;;;;;IAcpE,uIAAuI;2BAC1G,MAAM,WAAW,YAAY;;;;;IAS1D;;;;;OAKG;2BAC0B,MAAM,UAAU,YAAY;;;;;;;;IAgBzD;;;;OAIG;sCAC+B,MAAM,UAAU,MAAM;iBAAqB,WAAW;;IACxF,yEAAyE;qCACxC,MAAM;iBAAqB,WAAW;;IACvE,uHAAuH;kCACnF,MAAM;;;;IAO1C;;;OAGG;oCACmC,MAAM,YAAY,MAAM;iBASrC,WAAW;;IAGpC;;;;;OAKG;0BACyB,MAAM,WAAW,MAAM,aAAa,YAAY,UAAU,YAAY;;;;;IA4BlG,4GAA4G;oCACtE,YAAY;eAG3B;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,EAAE,EAAE,MAAM,CAAA;SAAE;;IAMnD,wCAAwC;wBACd,MAAM,WAAW,MAAM;;;EAepD;AAED,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEnE;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAG1C;AAED;;;;;;;;GAQG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB,GAAG,OAAO,CAAC,MAAM,CAAC,CAQlB;AAED;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0GAA0G;IAC1G,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,CAAC,CAoChK;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,gBAAgB,EAAE,MAAM,EAAE,IAAI,EAAE;IACrE,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,CAAC,sBAAsB,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7D,GAAG,OAAO,CAAC,YAAY,CAAC,CA4BxB"}

package/build/permitsClient.js

@@ -0,0 +1,597 @@
+// Copyright (c) 2025-2026 zkLicensing project developers
+// SPDX-License-Identifier: BUSL-1.1
+/**
+ * permitsClient.ts — `zklicensing/permits/client`
+ *
+ * Client for the keeper's /permits API: authority onboarding and registry
+ * deployment, signing requests, applications and decisions, grants,
+ * renewals, status changes, fees, key rotation, surrender and verification.
+ *
+ * Signing goes through a `PermitWallet`: in a browser, an adapter over Auro
+ * or WalletConnect; in scripts and agents, `minaSignerWallet` with a key the
+ * owner gave it. The keeper never sees a private key.
+ *
+ * `verifyPermitTrustless` checks a permit without trusting the keeper: the
+ * registry root comes straight from a Mina node and the keeper's witness
+ * must fold to it.
+ */
+import { Field, PublicKey, UInt64 } from 'o1js';
+import { acceptMessage, applyMessage, authorityMoveText, networkField, permitLeafHash, surrenderMessage, toSignableFields, withdrawMessage } from './permitMessages.js';
+import { recordToApplication, recordToLeaf, permitStatusAt } from './permitRegistryRebuild.js';
+export class PermitsError extends Error {
+    status;
+    code;
+    retryable;
+    body;
+    constructor(message, status, code, retryable, body = null) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.retryable = retryable;
+        this.body = body;
+        this.name = 'PermitsError';
+    }
+}
+// Canonical texts — the keeper derives the same strings.
+/** The sign-in text: names the site and network (the keeper's challenge
+ * supplies both), so a sign-in for devnet never works on mainnet. */
+export function sessionMessage(address, nonce, issuedAt, network, site) {
+    return ['zkLicensing session', `site: ${site}`, `network: ${network}`, `wallet: ${address}`, `nonce: ${nonce}`, `issuedAt: ${issuedAt}`].join('\n');
+}
+export function authorityAcceptanceMessage(f) {
+    return [
+        'zkLicensing Authority Terms acceptance',
+        `address: ${f.address}`,
+        `legalName: ${f.legalName}`,
+        `country: ${f.country}`,
+        `terms: ${f.termsVersion} ${f.termsHash}`,
+        `acceptedAt: ${f.acceptedAt}`,
+    ].join('\n');
+}
+export function createPermitsClient(opts) {
+    const base = opts.keeperUrl.replace(/\/+$/, '');
+    const fetcher = opts.fetcher ?? fetch;
+    let session = null;
+    function wallet() {
+        if (!opts.wallet)
+            throw new PermitsError('This action needs a wallet', 0, 'INVALID_REQUEST', false);
+        return opts.wallet;
+    }
+    async function call(method, path, body, auth = false) {
+        const headers = { Accept: 'application/json' };
+        if (body !== undefined)
+            headers['Content-Type'] = 'application/json';
+        if (auth)
+            headers.Authorization = `VendorSession ${await token()}`;
+        let resp;
+        try {
+            resp = await fetcher(base + path, { method, headers, ...(body !== undefined ? { body: JSON.stringify(body) } : {}) });
+        }
+        catch (e) {
+            throw new PermitsError(`Keeper unreachable: ${e?.message ?? e}`, 0, 'UPSTREAM_UNAVAILABLE', true);
+        }
+        const json = await resp.json().catch(() => null);
+        if (!resp.ok) {
+            if (resp.status === 401 && auth)
+                session = null;
+            throw new PermitsError(json?.error ?? `HTTP ${resp.status}`, resp.status, json?.code ?? (resp.status >= 500 ? 'UPSTREAM_UNAVAILABLE' : 'INVALID_REQUEST'), json?.retryable ?? resp.status >= 500, json);
+        }
+        return json;
+    }
+    /** Wallet sign-in (the keeper's existing session flow); cached until expiry. */
+    async function token() {
+        const w = wallet();
+        if (session && session.address === w.address && session.expiresAt - 60_000 > Date.now())
+            return session.token;
+        const chal = await call('POST', `/vendors/${encodeURIComponent(w.address)}/session/challenge`, { network: opts.network });
+        if (chal.network !== opts.network) {
+            throw new PermitsError(`Keeper issued a sign-in for ${chal.network}, expected ${opts.network}`, 0, 'INVALID_REQUEST', false);
+        }
+        const message = sessionMessage(w.address, chal.nonce, chal.issuedAt, chal.network, chal.site);
+        const signature = await w.signMessage(message);
+        const r = await call('POST', `/vendors/${encodeURIComponent(w.address)}/session/verify`, {
+            nonce: chal.nonce, signature, signedMessage: message, network: opts.network,
+        });
+        session = { token: r.token, expiresAt: Date.parse(r.expiresAt), address: w.address };
+        return r.token;
+    }
+    /** Describes, refuses a mismatch, and asks the confirmSignature hook. */
+    async function confirm(describe, registry) {
+        const ctx = opts.describeContext ? await opts.describeContext(registry) : {};
+        const d = describe(ctx);
+        if (!d.verified)
+            throw new PermitsError(`Refusing to sign: ${d.problem ?? 'the message could not be checked'}`, 0, 'SIGNATURE_INVALID', false, d);
+        if (opts.confirmSignature && (await opts.confirmSignature(d)) === false)
+            throw new PermitsError('Cancelled', 0, 'CANCELLED', false);
+    }
+    /** The registry's lineage from the keeper (a wrong one only fails the holder's own derivation). */
+    async function registryLineage(address) {
+        const r = await call('GET', `/permits/registries/${address}`);
+        return r.registry.lineage ?? address;
+    }
+    const client = {
+        network: opts.network,
+        signIn: token,
+        // ── reading ─────────────────────────────────────────────────────────────
+        listRegistries: () => call('GET', `/permits/registries?network=${opts.network}`),
+        getRegistry: (address) => call('GET', `/permits/registries/${address}`),
+        /** The registry's lineage (its first generation's address), which holder secrets are derived against. */
+        registryLineage: (address) => registryLineage(address),
+        /**
+         * A permit with a witness against its registry's root. Asked through an
+         * earlier generation's address, it comes from the current one
+         * (`registry`, `generation`), which starts with every permit of the one it
+         * replaced.
+         */
+        getPermit: (registry, subject) => call('GET', `/permits/registries/${registry}/permits/${subject}`),
+        /** A registry's generations and release, and any redeploy under way (no events needed). */
+        getDeployment: (registry) => call('GET', `/permits/registries/${registry}/deployment`),
+        verifyPermit: (registry, subject, scope) => call('GET', `/permits/verify?registry=${registry}&subject=${subject}${scope !== undefined ? `&scope=${scope}` : ''}`),
+        getRequest: (id, asSelf = false) => call('GET', `/permits/requests/${id}`, undefined, asSelf),
+        // ── authority ───────────────────────────────────────────────────────────
+        /** `agentConsent`: the owner's standing consent when an AI agent's key accepts for them. */
+        async acceptAuthorityTerms(f) {
+            const w = wallet();
+            const acceptedAt = new Date().toISOString();
+            const signedMessage = authorityAcceptanceMessage({ address: w.address, legalName: f.legalName, country: f.country, termsVersion: f.termsVersion, termsHash: f.termsHash, acceptedAt });
+            const signature = await w.signMessage(signedMessage);
+            return call('POST', '/permits/authorities/accept', { ...f, address: w.address, acceptedAt, signedMessage, signature, network: opts.network });
+        },
+        /**
+         * The platform's monthly fee statement for this wallet's registries
+         * (`month` YYYY-MM): its share of each permit fee, in euros, with VAT as
+         * the authority's details require. null when nothing to show.
+         */
+        /**
+         * What forced retirements left in escrow on this wallet's registries
+         * (Authority Terms §8.4): per registry, the applications whose fees stay
+         * there, their payers and the total.
+         */
+        authorityStranded: () => call('GET', `/permits/authorities/${wallet().address}/stranded`, undefined, true),
+        authorityFeeStatement: (month) => call('GET', `/permits/authorities/${wallet().address}/fee-statements?network=${opts.network}&month=${encodeURIComponent(month)}`, undefined, true).then(r => r.statement),
+        /**
+         * This wallet's receipts and credit notes for a license (zklicensing/receipt),
+         * purchase first; signs in with the wallet (a receipt shows the buyer's country).
+         */
+        getLicenseReceipts: (zkAppAddress, licenseHash) => call('GET', `/receipts?network=${opts.network}&zkAppAddress=${encodeURIComponent(zkAppAddress)}&licenseHash=${encodeURIComponent(licenseHash)}`, undefined, true).then(r => r.receipts),
+        /** This wallet's receipt or credit note for one transaction (a license or a permit fee). */
+        getReceipt: (txHash) => call('GET', `/receipts/${encodeURIComponent(txHash)}?network=${opts.network}`, undefined, true).then(r => r.receipt),
+        /**
+         * This wallet as a holder: its applications, its permits (with their
+         * effective status; a redeployed registry's earlier permits are marked
+         * frozen) and renewals offered to it that wait for acceptGrant.
+         */
+        getHolderOverview: () => call('GET', `/permits/holders/${wallet().address}?network=${opts.network}`, undefined, true),
+        /** This wallet's authority account (404 NOT_FOUND before the terms are accepted). */
+        getAuthority: () => call('GET', `/permits/authorities/${wallet().address}`, undefined, true),
+        /** Registries this wallet is an authority of, including drafts. */
+        listMyRegistries: () => call('GET', `/permits/authorities/${wallet().address}/registries`, undefined, true),
+        listRequests: (registry, status) => call('GET', `/permits/registries/${registry}/requests${status ? `?status=${status}` : ''}`, undefined, true),
+        createRegistry: (draft) => call('POST', '/permits/registries', { ...draft, network: opts.network }, true),
+        /**
+         * Changes a registry's public details (authority). On devnet they apply
+         * at once; on a listed mainnet registry they wait for the platform's
+         * review (`staged: true`). `scopeLabels` rewords the activities, one label
+         * each in order; the activities themselves can't change.
+         */
+        updateRegistryListing: (registry, edit) => call('PUT', `/permits/registries/${registry}/listing`, edit, true),
+        /** Stops (false) or resumes (true) taking applications (authority); everything else carries on. */
+        setApplicationsOpen: (registry, open) => call('PUT', `/permits/registries/${registry}/applications-open`, { open }, true),
+        /** Withdraws a staged edit of a registry's public details (authority). */
+        withdrawRegistryEdit: (registry) => call('DELETE', `/permits/registries/${registry}/listing/pending`, undefined, true),
+        /** A registry's figures for its authority: permits and applications by status, fees by kind and month (nanomina). */
+        getRegistryStats: (registry) => call('GET', `/permits/registries/${registry}/stats`, undefined, true),
+        /** The registry's money events (authority), oldest first: `from`/`to` as YYYY-MM-DD, `to` exclusive. Amounts in nanomina. */
+        getRegistryTransactions: (registry, period = {}) => call('GET', `/permits/registries/${registry}/transactions${period.from || period.to ? `?${new URLSearchParams(Object.entries(period).filter(([, v]) => v))}` : ''}`, undefined, true),
+        /** Signs a request with this wallet's key and adds the signature at `slot`. */
+        async signRequest(requestId, slot) {
+            const w = wallet();
+            const { request } = await client.getRequest(requestId);
+            const s = slot ?? request.keys.indexOf(w.address);
+            if (s < 0)
+                throw new PermitsError('This wallet is not in the request\'s key set', 0, 'FORBIDDEN', false);
+            const { describeRequest } = await import('./permitDescribe.js');
+            const registryCfg = request.kind === 'init' ? (await client.getRegistry(request.registry)).registry : undefined;
+            await confirm(ctx => describeRequest(request, { ...ctx, ...(registryCfg ? { registry: registryCfg } : {}) }), request.registry);
+            const signature = await w.signFields(request.message);
+            return call('POST', `/permits/requests/${requestId}/signatures`, { slot: s, signature });
+        },
+        /**
+         * Starts a redeploy to the current release: a new registry (same
+         * configuration, next generation) and two requests for the keys to sign,
+         * `retireRequest` (freezes this registry's permits on chain) and `request`
+         * (deploys the new one). Send them in that order: executeRequest(retire),
+         * then deployRegistry(request). The new registry starts with every permit
+         * of this one, as it is when it retires. With fees in escrow
+         * (ESCROW_NOT_EMPTY) only the platform can start a redeploy: the registry
+         * then drains
+         * (`draining: true`): no new filings while the open ones are decided,
+         * withdrawn or reclaimed; call again once they are, to get the requests.
+         */
+        redeployRegistry: (registry) => call('POST', `/permits/registries/${registry}/redeploy`, {}, true),
+        /** Calls off a redeploy whose retirement hasn't been sent. */
+        cancelRedeploy: (registry) => call('POST', `/permits/registries/${registry}/redeploy/cancel`, {}, true),
+        /** Proves the deployment, signs and pays with this wallet, and reports it. */
+        async deployRegistry(requestId) {
+            const w = wallet();
+            const { transaction, registry } = await call('POST', '/permits/prove/deploy', { requestId, feePayer: w.address });
+            const txHash = await w.signAndSendTransaction(transaction);
+            await call('POST', '/permits/confirm', { registry, requestId, txHash });
+            return { registry, txHash };
+        },
+        listApplications: (registry, status) => call('GET', `/permits/registries/${registry}/applications${status ? `?status=${status}` : ''}`, undefined, true),
+        /**
+         * Approves a filed application exactly as applied for (the permit is
+         * active once the request is signed and sent): a request for the
+         * authority keys to sign, then executeRequest. An unpaid one whose
+         * payment waits for a Mina upgrade is approved before payment (no
+         * request): the keeper raises the request once its fee is in escrow,
+         * and the applicant learns of it then.
+         */
+        approveApplication: (id) => call('POST', `/permits/applications/${id}/decision`, { decision: 'approve' }, true),
+        /**
+         * Rejects a filed application: the processing fee is kept, the rest
+         * refunded once the request is signed and sent. An unpaid one whose
+         * payment waits for a Mina upgrade is rejected before payment (no
+         * request): the keeper raises the request once its fee is in escrow,
+         * and the applicant learns of it then. `reason` stays off chain.
+         */
+        rejectApplication: (id, reason, reasonCode) => call('POST', `/permits/applications/${id}/decision`, { decision: 'reject', reason, reasonCode }, true),
+        requestRenewal: (registry, subject, change) => call('POST', `/permits/registries/${registry}/permits/${subject}/renewal`, change, true),
+        requestStatus: (registry, subject, action, reasonCode) => call('POST', `/permits/registries/${registry}/permits/${subject}/status`, { action, reasonCode }, true),
+        /** New fees; the processing fee (MINA) and decision window (slots) stay as they are unless given. */
+        requestFees: (registry, grantFeeMina, renewalFeeMina, applications) => call('POST', `/permits/registries/${registry}/fees`, { grantFeeMina, renewalFeeMina, ...applications }, true),
+        requestRotation: (registry, keys, threshold) => call('POST', `/permits/registries/${registry}/rotation`, { keys, threshold }, true),
+        /** Proves a fully signed non-grant request, signs and pays with this wallet, and reports it. */
+        async executeRequest(requestId) {
+            const w = wallet();
+            const { request } = await client.getRequest(requestId);
+            const { transaction } = await call('POST', '/permits/prove/request', { requestId, feePayer: w.address });
+            const txHash = await w.signAndSendTransaction(transaction);
+            await call('POST', '/permits/confirm', { registry: request.registry, requestId, txHash });
+            return { txHash };
+        },
+        // ── operator ────────────────────────────────────────────────────────────
+        /**
+         * Applies for a permit and pays the fee into escrow (`pay: false` only
+         * records the application; file it later with fileApplication). What is
+         * applied for is what an approval grants: activities (`scope`), dates and
+         * conditions document. Rejection or withdrawal keeps the registry's
+         * processing fee and refunds the rest to the payer; no decision by the
+         * deadline refunds it all.
+         *
+         * A new permit's secret for anonymous proofs (zklicensing/permits/holder-secret)
+         * is derived by the holder's wallet from a counter, the first not yet
+         * used by this key in the registry; only the salt (a hash of the secret)
+         * goes to the keeper. The wallet signs once per counter tried. When
+         * another key is the holder, derive with that key's wallet
+         * (deriveHolderSecret), pass `salt` and `pay: false`, and let the holder
+         * file it. To renew or change your active permit, pass its `subject`.
+         */
+        async apply(registry, a) {
+            const w = wallet();
+            const { pay = true, payer, ...body } = a;
+            const holderKey = body.holderKey ?? w.address;
+            const create = async (extra) => {
+                const r = await call('POST', `/permits/registries/${registry}/applications`, { ...body, holderKey, ...extra }, true);
+                if (!pay)
+                    return r;
+                try {
+                    return { ...r, ...(await client.fileApplication(r.application.id, payer)) };
+                }
+                catch (e) {
+                    // Ahead of a Mina upgrade the application is kept and paid afterwards, on the new registry.
+                    if (e instanceof PermitsError && e.code === 'PAYMENT_AFTER_UPGRADE') {
+                        const b = (e.body ?? {});
+                        return { ...r, paymentPaused: { reason: b.reason ?? 'upgrade', forkActivationSlot: b.forkActivationSlot ?? null } };
+                    }
+                    throw e;
+                }
+            };
+            if (body.salt || body.subject)
+                return create({});
+            if (holderKey !== w.address)
+                throw new PermitsError('The holder key must derive the permit secret: pass salt from deriveHolderSecret with the holder\'s wallet', 0, 'INVALID_REQUEST', false);
+            const { deriveHolderSecret, MAX_HOLDER_SECRETS } = await import('./holderSecret.js');
+            const lineage = await registryLineage(registry);
+            for (let index = 0; index < MAX_HOLDER_SECRETS; index++) {
+                const d = await deriveHolderSecret(w, { lineage, network: opts.network, index });
+                const taken = await client.getPermit(registry, d.subject).then(r => !!r.permit, e => {
+                    if (e instanceof PermitsError && e.status === 404)
+                        return false;
+                    throw e;
+                });
+                if (taken)
+                    continue; // used by an earlier permit
+                try {
+                    return await create({ salt: d.salt });
+                }
+                catch (e) {
+                    if (e instanceof PermitsError && e.code === 'SALT_IN_USE')
+                        continue; // a pending application has it
+                    throw e;
+                }
+            }
+            throw new PermitsError(`This key already has ${MAX_HOLDER_SECRETS} permits or applications in this registry; use another key`, 409, 'CONFLICT', false);
+        },
+        getApplication: (id) => call('GET', `/permits/applications/${id}`, undefined, true),
+        /**
+         * The holder signs what is applied for (with the registry's current fee
+         * and processing fee) and `payer` (default: this wallet) pays the fee
+         * into escrow. Returns the deadline slot for the authority's decision.
+         */
+        async fileApplication(id, payer) {
+            const w = wallet();
+            const { application, apply } = await client.getApplication(id);
+            if (!apply)
+                throw new PermitsError(`Application is ${application.status}`, 409, 'CONFLICT', false);
+            if (application.holderKey !== w.address)
+                throw new PermitsError('This wallet is not the applicant holder', 0, 'FORBIDDEN', false);
+            const msg = toSignableFields(applyMessage({ network: networkField(opts.network), registry: PublicKey.fromBase58(application.registry), application: recordToApplication(apply.application) }));
+            if (msg.join() !== apply.message.join())
+                throw new PermitsError('Refusing to sign: the keeper\'s message does not match the application', 0, 'SIGNATURE_INVALID', false);
+            const { describeApply } = await import('./permitDescribe.js');
+            await confirm(ctx => describeApply({ network: opts.network, registry: application.registry, application: apply.application, fields: msg }, ctx), application.registry);
+            const holderSignature = await w.signFields(msg);
+            const p = payer ?? w;
+            const proved = await call('POST', '/permits/prove/apply', { applicationId: id, feePayer: p.address, holderSignature });
+            const txHash = await p.signAndSendTransaction(proved.transaction);
+            await call('POST', '/permits/confirm', { registry: application.registry, applicationId: id, txHash });
+            return { txHash, fee: proved.fee, processingFee: proved.processingFee, deadline: proved.deadline };
+        },
+        /**
+         * Withdraws an application. Unpaid: recorded off chain. Paid (filed),
+         * before the deadline: the holder signs, the processing fee is kept and
+         * the rest goes back to the payer; this wallet pays the transaction fee.
+         */
+        async withdrawApplication(id) {
+            const w = wallet();
+            const { application, withdrawMessage: fields } = await client.getApplication(id);
+            if (application.status !== 'filed')
+                return call('POST', `/permits/applications/${id}/withdraw`, {}, true);
+            const escrow = application.escrow;
+            const msg = toSignableFields(withdrawMessage({ network: networkField(opts.network), registry: PublicKey.fromBase58(application.registry), application: recordToApplication(escrow) }));
+            if (!fields || msg.join() !== fields.join())
+                throw new PermitsError('Refusing to sign: the keeper\'s message does not match the application', 0, 'SIGNATURE_INVALID', false);
+            const { describeWithdraw } = await import('./permitDescribe.js');
+            await confirm(ctx => describeWithdraw({ network: opts.network, registry: application.registry, application: escrow, fields: msg }, ctx), application.registry);
+            const holderSignature = await w.signFields(msg);
+            const proved = await call('POST', '/permits/prove/withdraw', { applicationId: id, feePayer: w.address, holderSignature });
+            const txHash = await w.signAndSendTransaction(proved.transaction);
+            // The keeper issues the receipt for the kept processing fee (zklicensing/receipt).
+            const confirmed = await call('POST', '/permits/confirm', { registry: application.registry, applicationId: id, txHash });
+            return { application, txHash, kept: proved.kept, refunded: proved.refunded, ...(confirmed?.receipt ? { receipt: confirmed.receipt } : {}) };
+        },
+        /** After the deadline without a decision: returns the whole fee to the payer. Any wallet can send it (it pays the transaction fee). */
+        async reclaimApplication(id, sender) {
+            const p = sender ?? wallet();
+            const { application } = await client.getApplication(id);
+            const proved = await call('POST', '/permits/prove/reclaim', { applicationId: id, feePayer: p.address });
+            const txHash = await p.signAndSendTransaction(proved.transaction);
+            await call('POST', '/permits/confirm', { registry: application.registry, txHash });
+            return { txHash, refunded: proved.refunded, payer: proved.payer };
+        },
+        /**
+         * The holder accepts a signed grant: signs the exact permit and fee,
+         * then pays with `payer` (default: this wallet). The holder's wallet can
+         * re-derive the permit's secret for anonymous proofs at any time
+         * (findHolderSecret), from the chain alone.
+         */
+        async acceptGrant(requestId, payer) {
+            const w = wallet();
+            const { request } = await client.getRequest(requestId, true);
+            if (!request.newLeaf || request.newLeaf.holderKey !== w.address)
+                throw new PermitsError('This wallet is not the permit holder', 0, 'FORBIDDEN', false);
+            const msg = acceptMessage({ network: networkField(opts.network), registry: PublicKey.fromBase58(request.registry), newLeaf: recordToLeaf(request.newLeaf), fee: UInt64.from(request.fee) });
+            const { describeAccept } = await import('./permitDescribe.js');
+            await confirm(ctx => describeAccept({ network: opts.network, registry: request.registry, newLeaf: request.newLeaf, fee: request.fee, fields: toSignableFields(msg) }, ctx), request.registry);
+            const holderSignature = await w.signFields(toSignableFields(msg));
+            const p = payer ?? w;
+            const proved = await call('POST', '/permits/prove/request', { requestId, feePayer: p.address, holderSignature });
+            const txHash = await p.signAndSendTransaction(proved.transaction);
+            // The keeper issues the holder's receipt (zklicensing/receipt): keep it with the permit file.
+            const confirmed = await call('POST', '/permits/confirm', { registry: request.registry, requestId, txHash });
+            return { txHash, subject: request.newLeaf.subject, fee: proved.fee, toAuthority: proved.toAuthority, toPlatform: proved.toPlatform, ...(confirmed?.receipt ? { receipt: confirmed.receipt } : {}) };
+        },
+        /**
+         * A new payout address for the registry (authority): a request for the
+         * keys to sign; once sent it takes effect after 48 hours, unless
+         * cancelled (cancelRegistryPayout). The keeper applies it then.
+         */
+        proposeRegistryPayout: (registry, payout) => call('POST', `/permits/registries/${registry}/payout`, { payout }, true),
+        /** Cancels the pending payout change: a request for the keys to sign. */
+        cancelRegistryPayout: (registry) => call('POST', `/permits/registries/${registry}/payout/cancel`, {}, true),
+        /** Applies a payout change past its delay, paid by this wallet (the keeper does it itself when it has a fee payer). */
+        async applyRegistryPayout(registry) {
+            const w = wallet();
+            const { transaction, payout } = await call('POST', '/permits/prove/payout/apply', { registry, feePayer: w.address });
+            const txHash = await w.signAndSendTransaction(transaction);
+            await call('POST', '/permits/confirm', { registry, txHash });
+            return { txHash, payout };
+        },
+        /**
+         * Signs a key rotation as one of the NEW keys (`newSlot`: its place in
+         * the new set). Every new key signs, besides the current keys' threshold.
+         */
+        async signRotationAsNewKey(requestId, newSlot) {
+            const w = wallet();
+            const { request } = await client.getRequest(requestId);
+            if (request.kind !== 'rotate' || !request.newKeys)
+                throw new PermitsError('Not a key rotation', 0, 'INVALID_REQUEST', false);
+            const s = newSlot ?? request.newKeys.indexOf(w.address);
+            if (s < 0)
+                throw new PermitsError('This wallet is not in the new key set', 0, 'FORBIDDEN', false);
+            const { describeRequest } = await import('./permitDescribe.js');
+            await confirm(ctx => describeRequest(request, ctx), request.registry);
+            const signature = await w.signFields(request.message);
+            return call('POST', `/permits/requests/${requestId}/signatures`, { newSlot: s, signature });
+        },
+        /**
+         * Moves the holder's permit to `newWallet`'s key (both keys sign; free):
+         * the same terms under a new subject, whose secret the new wallet derives
+         * itself (its first unused counter in the registry's lineage). This
+         * wallet pays the fee unless `payer` is given.
+         */
+        async rekeyPermit(registry, subject, newWallet, payer) {
+            const w = wallet();
+            const { permit } = await client.getPermit(registry, subject);
+            if (!permit)
+                throw new PermitsError('Permit not found', 404, 'NOT_FOUND', false);
+            if (permit.holderKey !== w.address)
+                throw new PermitsError('This wallet is not the permit holder', 0, 'FORBIDDEN', false);
+            const { deriveHolderSecret, MAX_HOLDER_SECRETS } = await import('./holderSecret.js');
+            const lineage = await registryLineage(registry);
+            let derived = null;
+            for (let index = 0; index < MAX_HOLDER_SECRETS && !derived; index++) {
+                const d = await deriveHolderSecret(newWallet, { lineage, network: opts.network, index });
+                const taken = await client.getPermit(registry, d.subject).then(r => !!r.permit).catch(() => false);
+                if (!taken)
+                    derived = d;
+            }
+            if (!derived)
+                throw new PermitsError('The new wallet has no unused permit number left in this registry', 0, 'CONFLICT', false);
+            const body = { registry, subject, newHolderKey: newWallet.address, newSalt: derived.salt };
+            const m = await call('POST', '/permits/rekey/message', body);
+            if (m.newSubject !== derived.subject)
+                throw new PermitsError('The keeper names another new permit than the new wallet derived', 0, 'SIGNATURE_INVALID', false);
+            const { describeRekey } = await import('./permitDescribe.js');
+            await confirm(ctx => describeRekey({ network: opts.network, registry, leaf: permit, newSubject: m.newSubject, newHolderKey: newWallet.address, fields: m.message }, ctx), registry);
+            const holderSignature = await w.signFields(m.message);
+            const newHolderSignature = await newWallet.signFields(m.message);
+            const p = payer ?? w;
+            const { transaction } = await call('POST', '/permits/prove/rekey', { ...body, feePayer: p.address, holderSignature, newHolderSignature });
+            const txHash = await p.signAndSendTransaction(transaction);
+            await call('POST', '/permits/confirm', { registry, txHash });
+            return { txHash, subject: m.newSubject, salt: derived.salt };
+        },
+        /** Moves this wallet's authority account to `newWallet` (both sign); registry keys change by a rotation. */
+        async moveAuthorityAccount(newWallet) {
+            const w = wallet();
+            const text = authorityMoveText(w.address, newWallet.address);
+            return call('POST', '/permits/authorities/move', {
+                network: opts.network, from: w.address, to: newWallet.address,
+                oldTextSignature: await w.signMessage(text), newTextSignature: await newWallet.signMessage(text),
+            });
+        },
+        /** The holder gives up their permit. */
+        async surrender(registry, subject) {
+            const w = wallet();
+            const { permit } = await client.getPermit(registry, subject);
+            if (!permit)
+                throw new PermitsError('Permit not found', 404, 'NOT_FOUND', false);
+            const msg = surrenderMessage({ network: networkField(opts.network), registry: PublicKey.fromBase58(registry), leaf: recordToLeaf(permit) });
+            const { describeSurrender } = await import('./permitDescribe.js');
+            await confirm(ctx => describeSurrender({ network: opts.network, registry, leaf: permit, fields: toSignableFields(msg) }, ctx), registry);
+            const holderSignature = await w.signFields(toSignableFields(msg));
+            const { transaction } = await call('POST', '/permits/prove/surrender', { registry, subject, feePayer: w.address, holderSignature });
+            const txHash = await w.signAndSendTransaction(transaction);
+            await call('POST', '/permits/confirm', { registry, txHash });
+            return { txHash };
+        },
+    };
+    return client;
+}
+/**
+ * The registry's permits root and the current slot, read from a Mina node
+ * (not the keeper) — what a verifier of a holder proof should accept as
+ * `acceptedRoots` / `currentSlot` in `verifyHolderProof`.
+ */
+export async function readRegistryHead(args) {
+    const { readChainHead } = await import('./chainHead.js');
+    return readChainHead({ address: args.registry, network: args.network, graphqlUrl: args.graphqlUrl, fetcher: args.fetcher });
+}
+/**
+ * The current registry of `registry`'s lineage, from chain state alone: a
+ * retired registry names its successor (stored by its retirement, which its
+ * keys signed), and the successor's initialization checked the
+ * predecessor named it. Each hop also checks the successor runs a published
+ * PermitRegistry release and started from the predecessor's frozen root. A
+ * successor not deployed yet (between retirement and deployment, e.g.
+ * across a hard fork) leaves the retired registry current.
+ */
+export async function currentRegistryOnChain(args) {
+    const { currentOnChain, PERMIT_LINEAGE } = await import('./successorChain.js');
+    const { DEFAULT_MINA_GRAPHQL_URLS } = await import('./onChainRoot.js');
+    const { CANONICAL_PERMIT_VK_HASHES } = await import('./permitInterface.js');
+    const graphqlUrl = args.graphqlUrl ?? DEFAULT_MINA_GRAPHQL_URLS[args.network];
+    return (await currentOnChain({
+        start: args.registry, layout: PERMIT_LINEAGE, canonicalVks: Object.values(CANONICAL_PERMIT_VK_HASHES), graphqlUrl, fetcher: args.fetcher,
+    })).address;
+}
+/**
+ * Verifies a permit without trusting the keeper: the root comes from
+ * `fetchRoot` (default: the registry account's appState[0] read from a
+ * Mina node), and the keeper's leaf and witness must fold to that root.
+ */
+export async function verifyPermitTrustless(args) {
+    const client = createPermitsClient({ keeperUrl: args.keeperUrl, network: args.network, fetcher: args.fetcher });
+    // Default: root and current slot from a Mina node in one read, so the
+    // keeper decides neither which root counts nor what time it is.
+    let chainSlot;
+    let forkSlot = 0;
+    const fetchRoot = args.fetchRoot ?? (async (registry) => {
+        const { readChainHead } = await import('./chainHead.js');
+        const { PERMIT_REGISTRY_STATE } = await import('./permitInterface.js');
+        const head = await readChainHead({ address: registry, network: args.network, graphqlUrl: args.graphqlUrl, fetcher: args.fetcher });
+        chainSlot = head.slot;
+        forkSlot = Number(head.state[PERMIT_REGISTRY_STATE.forkActivationSlot] ?? 0) || 0;
+        return head.root;
+    });
+    // A redeployed registry names its successor on chain, and only that
+    // account could start from its permits: follow the chain of successors to
+    // the current registry (with the default node reads).
+    const current = args.fetchRoot ? args.registry : await currentRegistryOnChain({ registry: args.registry, network: args.network, graphqlUrl: args.graphqlUrl, fetcher: args.fetcher });
+    const served = await client.getPermit(current, args.subject);
+    const home = served.registry ?? current;
+    const chainRoot = await fetchRoot(home);
+    const { MerkleMapWitness, Bool } = await import('o1js');
+    const toWitness = (w) => new MerkleMapWitness(w.isLefts.map(b => Bool(b)), w.siblings.map(s => Field(s)));
+    const value = served.permit ? permitLeafHash(recordToLeaf(served.permit)) : Field(0);
+    const [root, key] = toWitness(served.witness).computeRootAndKey(value);
+    // A redeployed registry starts with every permit of the one it replaced,
+    // so a permit always verifies against the current registry of its lineage.
+    const lineageOk = home === current;
+    const rootMatches = lineageOk && root.toString() === chainRoot && key.toString() === args.subject;
+    const status = rootMatches ? permitStatusAt(served.permit ?? undefined, args.slot ?? chainSlot ?? served.slot, args.gracePeriod ?? 0, forkSlot) : 'unknown';
+    const required = args.requiredScope ?? 0n;
+    const scopeOk = !!served.permit && (BigInt(served.permit.scope) & required) === required;
+    return {
+        valid: rootMatches && scopeOk && (status === 'active' || status === 'in-grace'), status, scopeOk, rootMatches,
+        permit: rootMatches ? served.permit : null, registry: home, frozen: !!served.frozen,
+    };
+}
+/**
+ * A wallet for scripts and agents, from a private key the owner handed over.
+ * `send` broadcasts the signed transaction (default: o1js on the active
+ * Mina instance). Requires the optional `mina-signer` peer dependency.
+ */
+export async function minaSignerWallet(privateKeyBase58, opts) {
+    const { default: Client } = await import('mina-signer');
+    const signer = new Client({ network: opts.network === 'mainnet' ? 'mainnet' : 'testnet' });
+    const address = signer.derivePublicKey(privateKeyBase58);
+    const send = opts.send ?? (async (cmd) => {
+        const { Mina } = await import('o1js');
+        const tx = Mina.Transaction.fromJSON(cmd);
+        const pending = await tx.send();
+        return pending.hash;
+    });
+    return {
+        address,
+        async signFields(fields) {
+            return signer.signFields(fields.map(BigInt), privateKeyBase58).signature;
+        },
+        async signMessage(message) {
+            return signer.signMessage(message, privateKeyBase58).signature;
+        },
+        async signAndSendTransaction(transactionJson) {
+            const zkappCommand = JSON.parse(transactionJson);
+            const body = zkappCommand.feePayer.body;
+            const signed = signer.signZkappCommand({
+                zkappCommand,
+                feePayer: { feePayer: body.publicKey, fee: body.fee, nonce: body.nonce, memo: '' },
+            }, privateKeyBase58);
+            return send(signed.data.zkappCommand);
+        },
+    };
+}
+//# sourceMappingURL=permitsClient.js.map