zklicensing 0.1.0-beta.2 → 0.1.0-beta.21

package/build/units.js

@@ -0,0 +1,65 @@
+// Copyright (c) 2025-2026 zkLicensing project developers
+// SPDX-License-Identifier: BUSL-1.1
+/**
+ * units.ts — the unit amounts are shown in.
+ *
+ * Devnet amounts are test MINA (tMINA), which has no value; mainnet amounts
+ * are MINA. Only what people read changes: field names (`priceYearlyMina`,
+ * nanomina amounts) stay the same on both networks. The MINA price in euros
+ * or dollars is real and still shown on devnet, but only as a reference for
+ * mainnet MINA (`fiatReference`), never as the value of tMINA.
+ */
+import { isEuCountry } from './taxId.js';
+/** 'tMINA' on devnet (and any test network), 'MINA' on mainnet. */
+export function minaUnit(network) {
+    return network === 'mainnet' ? 'MINA' : 'tMINA';
+}
+/** "12.5 tMINA" / "12.5 MINA" for an amount in MINA (number or decimal string). */
+export function formatMina(amountMina, network) {
+    return `${amountMina} ${minaUnit(network)}`;
+}
+/** "12.5 tMINA" for an amount in nanomina. */
+export function formatNanomina(nano, network) {
+    const n = BigInt(nano);
+    const neg = n < 0n;
+    const a = neg ? -n : n;
+    const frac = (a % 1000000000n).toString().padStart(9, '0').replace(/0+$/, '');
+    return `${neg ? '-' : ''}${(a / 1000000000n).toString()}${frac ? '.' + frac : ''} ${minaUnit(network)}`;
+}
+/**
+ * The words that go with a fiat value. Mainnet: "≈ €2.10". Devnet: the same
+ * amount of real MINA, said as such ("as MINA ≈ €2.10"), plus a note that
+ * tMINA itself has no value.
+ */
+export function fiatReference(network) {
+    return network === 'mainnet'
+        ? { prefix: '≈', note: null }
+        : { prefix: 'as MINA ≈', note: 'tMINA has no value; this is what the same amount of mainnet MINA is worth.' };
+}
+const SYMBOL = { eur: '€', usd: '$', gbp: '£' };
+/**
+ * Which money a person sees amounts in, by their country: euros in the EU,
+ * pounds and euros in the UK, dollars in the US, euros and dollars elsewhere
+ * (or when the country is unknown).
+ */
+export function fiatCurrencies(country) {
+    const c = String(country ?? '').trim().toUpperCase();
+    if (isEuCountry(c))
+        return ['eur'];
+    if (c === 'GB' || c === 'UK')
+        return ['gbp', 'eur'];
+    if (c === 'US')
+        return ['usd'];
+    return ['eur', 'usd'];
+}
+/** "€2.10", "-€26.78" for an amount of money. */
+export function formatFiat(amount, currency, digits = 2) {
+    const n = typeof amount === 'string' ? Number(amount) : amount;
+    return `${n < 0 ? '-' : ''}${SYMBOL[currency]}${Math.abs(n).toFixed(digits)}`;
+}
+/** "€2.10 · $2.30" for the given currencies (a currency without a rate is left out). */
+export function formatFiatList(values, currencies, digits = 2) {
+    return currencies.filter(c => values[c] !== undefined && values[c] !== null && values[c] !== '')
+        .map(c => formatFiat(values[c], c, digits)).join(' · ');
+}
+//# sourceMappingURL=units.js.map

package/build/units.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"units.js","sourceRoot":"","sources":["../src/units.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,oCAAoC;AAEpC;;;;;;;;GAQG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAIzC,mEAAmE;AACnE,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;AAClD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,UAAU,CAAC,UAA2B,EAAE,OAAe;IACrE,OAAO,GAAG,UAAU,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,cAAc,CAAC,IAA8B,EAAE,OAAe;IAC5E,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvB,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,CAAC;IACnB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,WAAc,CAAC,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACjF,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,GAAG,WAAc,CAAC,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;AAC7G,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,OAAO,OAAO,KAAK,SAAS;QAC1B,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE;QAC7B,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,4EAA4E,EAAE,CAAC;AAClH,CAAC;AAGD,MAAM,MAAM,GAAiC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAE9E;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,OAAuB;IACpD,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrD,IAAI,WAAW,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,UAAU,CAAC,MAAuB,EAAE,QAAsB,EAAE,MAAM,GAAG,CAAC;IACpF,MAAM,CAAC,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/D,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;AAChF,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,cAAc,CAAC,MAAsD,EAAE,UAA0B,EAAE,MAAM,GAAG,CAAC;IAC3H,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;SAC7F,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAE,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC"}

package/build/vatRates.d.ts

@@ -0,0 +1,54 @@
+/**
+ * vatRates.ts — `zklicensing/vat`
+ *
+ * Standard VAT rates (EU member states and the UK, with their history) and
+ * the VAT included in a VAT-inclusive price. Prices on zkLicensing are fixed
+ * per tier on-chain and include VAT: a buyer pays the listed price, and the
+ * VAT in it is at the buyer's country's standard rate on the sale date.
+ *
+ *   standardVatRate('FI', '2026-10-13')          → 25.5
+ *   vatIncludedNano(10_000_000_000n, 25.5)       → { netNano: 7_968_127_490n, vatNano: 2_031_872_510n }
+ *
+ * For vendors' own reporting and buyers' information — an estimate for
+ * consumer sales, not tax advice: business buyers with a VAT number are
+ * usually reverse-charged, and the EU's €10,000 cross-border threshold is
+ * not applied. Countries without VAT in the table give null.
+ */
+import { VAT_RATES_FETCHED, VAT_RATES_SOURCE } from './vatRatesData.js';
+export { VAT_RATES_FETCHED, VAT_RATES_SOURCE };
+/** The standard VAT rate (percent) in force in `country` on `date`, or null if the country isn't in the table. */
+export declare function standardVatRate(country: string, date?: Date | string | number): number | null;
+/** Countries in the table (ISO codes). */
+export declare function vatCountries(): string[];
+/** The VAT included in a VAT-inclusive `totalNano` at `ratePct`: vat = total × r / (100 + r), rounded to the nearest nanomina. */
+export declare function vatIncludedNano(totalNano: bigint, ratePct: number): {
+    netNano: bigint;
+    vatNano: bigint;
+};
+/** Same, for a MINA amount (display only). */
+export declare function vatIncludedMina(totalMina: number, ratePct: number): {
+    net: number;
+    vat: number;
+};
+/** The price shown to a buyer in `country` on `date`: the total, and the VAT it includes. Null rate outside the table. */
+export declare function priceWithVat(totalNano: bigint, country: string, date?: Date | string | number): {
+    totalNano: bigint;
+    country: string;
+    rate: number | null;
+    netNano: bigint;
+    vatNano: bigint;
+};
+/** The VAT block of a license receipt (amounts as decimal MINA strings). */
+export type VatReceipt = {
+    country: string;
+    /** Standard rate (percent) on the sale date; null when the country has no VAT in the table. */
+    ratePct: number | null;
+    totalMina: string;
+    vatMina: string;
+    netMina: string;
+    /** Which rates table was used. */
+    rates: string;
+};
+/** The VAT included in a purchase of `totalNano` by a buyer in `country` on `date`, for the license file. */
+export declare function vatReceipt(totalNano: bigint, country: string, date?: Date | string | number): VatReceipt;
+//# sourceMappingURL=vatRates.d.ts.map

package/build/vatRates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vatRates.d.ts","sourceRoot":"","sources":["../src/vatRates.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAsB,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE5F,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;AAQ/C,kHAAkH;AAClH,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,IAAI,GAAG,MAAM,GAAG,MAAmB,GAAG,MAAM,GAAG,IAAI,CAQzG;AAED,0CAA0C;AAC1C,wBAAgB,YAAY,IAAI,MAAM,EAAE,CAEvC;AAOD,kIAAkI;AAClI,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAMxG;AAED,8CAA8C;AAC9C,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAGhG;AAED,0HAA0H;AAC1H,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,IAAI,GAAG,MAAM,GAAG,MAAmB,GACxG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAI9F;AAED,4EAA4E;AAC5E,MAAM,MAAM,UAAU,GAAG;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,+FAA+F;IAC/F,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,kCAAkC;IAClC,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAOF,6GAA6G;AAC7G,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,IAAI,GAAG,MAAM,GAAG,MAAmB,GAAG,UAAU,CAOpH"}

package/build/vatRates.js

@@ -0,0 +1,82 @@
+// Copyright (c) 2025-2026 zkLicensing project developers
+// SPDX-License-Identifier: BUSL-1.1
+/**
+ * vatRates.ts — `zklicensing/vat`
+ *
+ * Standard VAT rates (EU member states and the UK, with their history) and
+ * the VAT included in a VAT-inclusive price. Prices on zkLicensing are fixed
+ * per tier on-chain and include VAT: a buyer pays the listed price, and the
+ * VAT in it is at the buyer's country's standard rate on the sale date.
+ *
+ *   standardVatRate('FI', '2026-10-13')          → 25.5
+ *   vatIncludedNano(10_000_000_000n, 25.5)       → { netNano: 7_968_127_490n, vatNano: 2_031_872_510n }
+ *
+ * For vendors' own reporting and buyers' information — an estimate for
+ * consumer sales, not tax advice: business buyers with a VAT number are
+ * usually reverse-charged, and the EU's €10,000 cross-border threshold is
+ * not applied. Countries without VAT in the table give null.
+ */
+import { STANDARD_VAT_RATES, VAT_RATES_FETCHED, VAT_RATES_SOURCE } from './vatRatesData.js';
+export { VAT_RATES_FETCHED, VAT_RATES_SOURCE };
+function isoDay(date) {
+    const d = date instanceof Date ? date : new Date(date);
+    if (!Number.isFinite(d.getTime()))
+        throw new Error('invalid date');
+    return d.toISOString().slice(0, 10);
+}
+/** The standard VAT rate (percent) in force in `country` on `date`, or null if the country isn't in the table. */
+export function standardVatRate(country, date = new Date()) {
+    const c = String(country ?? '').toUpperCase();
+    const periods = Object.prototype.hasOwnProperty.call(STANDARD_VAT_RATES, c) ? STANDARD_VAT_RATES[c] : undefined;
+    if (!periods)
+        return null;
+    const day = isoDay(date);
+    let rate = null;
+    for (const [from, r] of periods)
+        if (from <= day)
+            rate = r;
+    return rate;
+}
+/** Countries in the table (ISO codes). */
+export function vatCountries() {
+    return Object.keys(STANDARD_VAT_RATES);
+}
+const bp = (ratePct) => {
+    if (!Number.isFinite(ratePct) || ratePct < 0 || ratePct >= 100)
+        throw new Error('rate must be a percentage in [0, 100)');
+    return BigInt(Math.round(ratePct * 100));
+};
+/** The VAT included in a VAT-inclusive `totalNano` at `ratePct`: vat = total × r / (100 + r), rounded to the nearest nanomina. */
+export function vatIncludedNano(totalNano, ratePct) {
+    if (totalNano < 0n)
+        throw new Error('total must not be negative');
+    const r = bp(ratePct);
+    const den = 10000n + r;
+    const vatNano = (totalNano * r * 2n + den) / (den * 2n);
+    return { netNano: totalNano - vatNano, vatNano };
+}
+/** Same, for a MINA amount (display only). */
+export function vatIncludedMina(totalMina, ratePct) {
+    const { netNano, vatNano } = vatIncludedNano(BigInt(Math.round(totalMina * 1e9)), ratePct);
+    return { net: Number(netNano) / 1e9, vat: Number(vatNano) / 1e9 };
+}
+/** The price shown to a buyer in `country` on `date`: the total, and the VAT it includes. Null rate outside the table. */
+export function priceWithVat(totalNano, country, date = new Date()) {
+    const rate = standardVatRate(country, date);
+    const split = rate === null ? { netNano: totalNano, vatNano: 0n } : vatIncludedNano(totalNano, rate);
+    return { totalNano, country: String(country).toUpperCase(), rate, ...split };
+}
+const minaString = (nano) => {
+    const s = nano.toString().padStart(10, '0');
+    return `${s.slice(0, -9)}.${s.slice(-9)}`.replace(/\.?0+$/, '') || '0';
+};
+/** The VAT included in a purchase of `totalNano` by a buyer in `country` on `date`, for the license file. */
+export function vatReceipt(totalNano, country, date = new Date()) {
+    const p = priceWithVat(totalNano, country, date);
+    return {
+        country: p.country, ratePct: p.rate,
+        totalMina: minaString(p.totalNano), vatMina: minaString(p.vatNano), netMina: minaString(p.netNano),
+        rates: `${VAT_RATES_SOURCE}, ${VAT_RATES_FETCHED}`,
+    };
+}
+//# sourceMappingURL=vatRates.js.map

package/build/vatRates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vatRates.js","sourceRoot":"","sources":["../src/vatRates.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,oCAAoC;AAEpC;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE5F,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC;AAE/C,SAAS,MAAM,CAAC,IAA4B;IAC1C,MAAM,CAAC,GAAG,IAAI,YAAY,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;IACnE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtC,CAAC;AAED,kHAAkH;AAClH,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,OAA+B,IAAI,IAAI,EAAE;IACxF,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAChH,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACzB,IAAI,IAAI,GAAkB,IAAI,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,OAAO;QAAE,IAAI,IAAI,IAAI,GAAG;YAAE,IAAI,GAAG,CAAC,CAAC;IAC3D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0CAA0C;AAC1C,MAAM,UAAU,YAAY;IAC1B,OAAO,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,EAAE,GAAG,CAAC,OAAe,EAAE,EAAE;IAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,OAAO,IAAI,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACzH,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC,CAAC;AAEF,kIAAkI;AAClI,MAAM,UAAU,eAAe,CAAC,SAAiB,EAAE,OAAe;IAChE,IAAI,SAAS,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAClE,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,MAAO,GAAG,CAAC,CAAC;IACxB,MAAM,OAAO,GAAG,CAAC,SAAS,GAAG,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;IACxD,OAAO,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AACnD,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,eAAe,CAAC,SAAiB,EAAE,OAAe;IAChE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3F,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,GAAG,EAAE,CAAC;AACpE,CAAC;AAED,0HAA0H;AAC1H,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,OAAe,EAAE,OAA+B,IAAI,IAAI,EAAE;IAExG,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACrG,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,CAAC;AAC/E,CAAC;AAcD,MAAM,UAAU,GAAG,CAAC,IAAY,EAAE,EAAE;IAClC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5C,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;AACzE,CAAC,CAAC;AAEF,6GAA6G;AAC7G,MAAM,UAAU,UAAU,CAAC,SAAiB,EAAE,OAAe,EAAE,OAA+B,IAAI,IAAI,EAAE;IACtG,MAAM,CAAC,GAAG,YAAY,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACjD,OAAO;QACL,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI;QACnC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;QAClG,KAAK,EAAE,GAAG,gBAAgB,KAAK,iBAAiB,EAAE;KACnD,CAAC;AACJ,CAAC"}

package/build/vatRatesData.d.ts

@@ -0,0 +1,5 @@
+export declare const VAT_RATES_SOURCE = "ibericode/vat-rates (MIT)";
+export declare const VAT_RATES_FETCHED = "2026-10-13";
+/** country → [effective-from date, standard rate %][], oldest first. */
+export declare const STANDARD_VAT_RATES: Readonly<Record<string, ReadonlyArray<readonly [string, number]>>>;
+//# sourceMappingURL=vatRatesData.d.ts.map

package/build/vatRatesData.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vatRatesData.d.ts","sourceRoot":"","sources":["../src/vatRatesData.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,gBAAgB,8BAA8B,CAAC;AAC5D,eAAO,MAAM,iBAAiB,eAAe,CAAC;AAE9C,wEAAwE;AACxE,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CA6BjG,CAAC"}

package/build/vatRatesData.js

@@ -0,0 +1,42 @@
+// Copyright (c) 2025-2026 zkLicensing project developers
+// SPDX-License-Identifier: BUSL-1.1
+//
+// GENERATED by scripts/build-vat-rates.mjs — do not edit by hand.
+//
+// Standard VAT rates (percent) with the date each took effect, per country.
+// Source: ibericode/vat-rates, https://raw.githubusercontent.com/ibericode/vat-rates/master/vat-rates.json
+// (MIT License, Copyright 2019 Danny van Kooten). Fetched 2026-10-13.
+export const VAT_RATES_SOURCE = 'ibericode/vat-rates (MIT)';
+export const VAT_RATES_FETCHED = '2026-10-13';
+/** country → [effective-from date, standard rate %][], oldest first. */
+export const STANDARD_VAT_RATES = {
+    AT: [['1970-01-01', 20], ['2016-01-01', 20]],
+    BE: [['1970-01-01', 21]],
+    BG: [['1970-01-01', 20]],
+    CY: [['1970-01-01', 19]],
+    CZ: [['1970-01-01', 21], ['2024-01-01', 21]],
+    DE: [['1970-01-01', 19], ['2020-07-01', 16], ['2021-01-01', 19]],
+    DK: [['1970-01-01', 25]],
+    EE: [['1970-01-01', 20], ['2024-01-01', 22], ['2025-01-01', 22], ['2025-07-01', 24]],
+    ES: [['1970-01-01', 21]],
+    FI: [['1970-01-01', 24], ['2024-09-01', 25.5], ['2026-01-01', 25.5]],
+    FR: [['1970-01-01', 19.6], ['2012-01-01', 19.6], ['2014-01-01', 20]],
+    GB: [['2011-01-04', 20]],
+    GR: [['1970-01-01', 23], ['2016-01-01', 23], ['2016-06-01', 24]],
+    HR: [['1970-01-01', 25]],
+    HU: [['1970-01-01', 27]],
+    IE: [['1970-01-01', 23], ['2020-09-01', 21], ['2021-03-01', 23]],
+    IT: [['1970-01-01', 22]],
+    LT: [['1970-01-01', 21]],
+    LU: [['1970-01-01', 15], ['2015-01-01', 17], ['2016-01-01', 17], ['2023-01-01', 16], ['2024-01-01', 17]],
+    LV: [['1970-01-01', 21]],
+    MT: [['1970-01-01', 18]],
+    NL: [['1970-01-01', 19], ['2012-10-01', 21], ['2019-01-01', 21]],
+    PL: [['1970-01-01', 23]],
+    PT: [['1970-01-01', 23]],
+    RO: [['1970-01-01', 24], ['2016-01-01', 20], ['2017-01-01', 19], ['2025-08-01', 21]],
+    SE: [['1970-01-01', 25]],
+    SI: [['1970-01-01', 22]],
+    SK: [['1970-01-01', 19], ['2011-01-01', 20], ['2025-01-01', 23]],
+};
+//# sourceMappingURL=vatRatesData.js.map

package/build/vatRatesData.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vatRatesData.js","sourceRoot":"","sources":["../src/vatRatesData.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,oCAAoC;AACpC,EAAE;AACF,kEAAkE;AAClE,EAAE;AACF,4EAA4E;AAC5E,2GAA2G;AAC3G,sEAAsE;AAEtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAC5D,MAAM,CAAC,MAAM,iBAAiB,GAAG,YAAY,CAAC;AAE9C,wEAAwE;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAuE;IACpG,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC5C,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACxB,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACxB,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACxB,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAC5C,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAChE,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACxB,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACpF,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACxB,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;IACpE,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACpE,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACxB,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAChE,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACxB,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACxB,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAChE,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACxB,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACxB,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACxG,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACxB,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACxB,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAChE,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACxB,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACxB,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACpF,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACxB,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACxB,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;CACjE,CAAC"}

package/build/vendorAccountClient.d.ts

@@ -0,0 +1,66 @@
+/**
+ * vendorAccountClient.ts
+ *
+ * Browser-safe client for the vendor's shared legal/billing block —
+ * the fields that must stay consistent across every app registered by
+ * one vendor wallet (legal entity name, billing country and address,
+ * VAT id, company registry). One PATCH updates all of the vendor's
+ * apps atomically on the backend, so a legal-entity rename or address
+ * move doesn't leave old apps advertising stale CRD Art. 6 disclosures.
+ *
+ * Signature covers the vendor address, mirroring the "sign the
+ * resource id" pattern PUT /apps/:appId uses. The backend verifies
+ * against the on-chain vendor recorded on the app records.
+ */
+export type VendorLegalBlock = {
+    country?: string;
+    legalName?: string;
+    billingAddress?: {
+        line1: string;
+        line2?: string;
+        city: string;
+        postalCode: string;
+    };
+    invoiceEmail?: string;
+    supportEmail?: string;
+    vatId?: string;
+    companyRegistrationRegistry?: string;
+    companyRegistrationNumber?: string;
+    termsOfServiceUrl?: string;
+    privacyPolicyUrl?: string;
+    refundPolicyUrl?: string;
+};
+export type GetVendorLegalRequest = {
+    keeperUrl: string;
+    vendorAddress: string;
+    vendorSessionToken: string;
+    fetcher?: typeof fetch;
+    signal?: AbortSignal;
+};
+export type GetVendorLegalResponse = {
+    legal: VendorLegalBlock | null;
+};
+export type UpdateVendorLegalRequest = {
+    keeperUrl: string;
+    vendorAddress: string;
+    payload: VendorLegalBlock;
+    /** The vendor's session (`VendorSession` token) for the network its apps
+     * are on — mainnet if any app is on mainnet. Or give a `fetcher` that
+     * adds it. */
+    sessionToken?: string;
+    /** Ignored by the keeper (the old signature over the vendor's own address,
+     * which could be replayed); kept so existing callers compile. */
+    signature?: {
+        field: string;
+        scalar: string;
+    };
+    fetcher?: typeof fetch;
+    signal?: AbortSignal;
+};
+export type UpdateVendorLegalResponse = {
+    ok: true;
+    appsUpdated: number;
+};
+export declare function getVendorLegal(req: GetVendorLegalRequest): Promise<GetVendorLegalResponse>;
+export declare function updateVendorLegal(req: UpdateVendorLegalRequest): Promise<UpdateVendorLegalResponse>;
+//# sourceMappingURL=vendorAccountClient.d.ts.map

package/build/vendorAccountClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vendorAccountClient.d.ts","sourceRoot":"","sources":["../src/vendorAccountClient.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;GAaG;AAEH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE;QACf,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,SAAS,EAAW,MAAM,CAAC;IAC3B,aAAa,EAAO,MAAM,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAY,OAAO,KAAK,CAAC;IACjC,MAAM,CAAC,EAAa,WAAW,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IAGnC,KAAK,EAAE,gBAAgB,GAAG,IAAI,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,wBAAwB,GAAG;IACrC,SAAS,EAAM,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAQ,gBAAgB,CAAC;IAChC;;kBAEc;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;qEACiE;IACjE,SAAS,CAAC,EAAK;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IACjD,OAAO,CAAC,EAAO,OAAO,KAAK,CAAC;IAC5B,MAAM,CAAC,EAAQ,WAAW,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,EAAE,EAAW,IAAI,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAgBF,wBAAsB,cAAc,CAAC,GAAG,EAAE,qBAAqB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAWhG;AAOD,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,wBAAwB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAgBzG"}

package/build/vendorAccountClient.js

@@ -0,0 +1,47 @@
+// Copyright (c) 2025-2026 zkLicensing project developers
+// SPDX-License-Identifier: BUSL-1.1
+function baseUrl(url) {
+    return url.replace(/\/+$/, '');
+}
+async function readJsonError(resp) {
+    try {
+        const body = await resp.json();
+        if (typeof body.error === 'string')
+            return body.error;
+    }
+    catch { /* body wasn't JSON */ }
+    return `HTTP ${resp.status}`;
+}
+// GET /vendors/:address/legal — fetch the shared legal block for a wallet.
+// Returns `{ legal: null }` for wallets with no registered apps.
+export async function getVendorLegal(req) {
+    const fetcher = req.fetcher ?? fetch;
+    const resp = await fetcher(`${baseUrl(req.keeperUrl)}/vendors/${encodeURIComponent(req.vendorAddress)}/legal`, {
+        signal: req.signal,
+        headers: { Authorization: `VendorSession ${req.vendorSessionToken}` },
+    });
+    if (!resp.ok)
+        throw new Error(await readJsonError(resp));
+    return await resp.json();
+}
+// PATCH /vendors/:address/legal — updates the block on EVERY app the vendor
+// owns in a single atomic sweep. Authorised by the vendor's session. Bypasses the pendingEdit staging that
+// per-app metadata edits go through; legal fields are factual (not
+// marketing copy) so admin review doesn't gain anything and staleness
+// hurts CRD Art. 6 compliance.
+export async function updateVendorLegal(req) {
+    const fetcher = req.fetcher ?? fetch;
+    const resp = await fetcher(`${baseUrl(req.keeperUrl)}/vendors/${encodeURIComponent(req.vendorAddress)}/legal`, {
+        method: 'PATCH',
+        headers: {
+            'Content-Type': 'application/json',
+            ...(req.sessionToken ? { Authorization: `VendorSession ${req.sessionToken}` } : {}),
+        },
+        signal: req.signal,
+        body: JSON.stringify({ payload: req.payload }),
+    });
+    if (!resp.ok)
+        throw new Error(await readJsonError(resp));
+    return await resp.json();
+}
+//# sourceMappingURL=vendorAccountClient.js.map

package/build/vendorAccountClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vendorAccountClient.js","sourceRoot":"","sources":["../src/vendorAccountClient.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,oCAAoC;AAsEpC,SAAS,OAAO,CAAC,GAAW;IAC1B,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAc;IACzC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAA6B,CAAC;QAC1D,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;IAClC,OAAO,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;AAC/B,CAAC;AAED,2EAA2E;AAC3E,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAA0B;IAC7D,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,KAAK,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,kBAAkB,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,EAClF;QACE,MAAM,EAAG,GAAG,CAAC,MAAM;QACnB,OAAO,EAAE,EAAE,aAAa,EAAE,iBAAiB,GAAG,CAAC,kBAAkB,EAAE,EAAE;KACtE,CACF,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,OAAO,MAAM,IAAI,CAAC,IAAI,EAA4B,CAAC;AACrD,CAAC;AAED,4EAA4E;AAC5E,2GAA2G;AAC3G,mEAAmE;AACnE,sEAAsE;AACtE,+BAA+B;AAC/B,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAA6B;IACnE,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,KAAK,CAAC;IACrC,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,kBAAkB,CAAC,GAAG,CAAC,aAAa,CAAC,QAAQ,EAClF;QACE,MAAM,EAAG,OAAO;QAChB,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,iBAAiB,GAAG,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpF;QACD,MAAM,EAAG,GAAG,CAAC,MAAM;QACnB,IAAI,EAAK,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;KAClD,CACF,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,OAAO,MAAM,IAAI,CAAC,IAAI,EAA+B,CAAC;AACxD,CAAC"}

package/build/verifyCore.d.ts

@@ -3,6 +3,7 @@ export type VerifyResponse = {
     valid: boolean;
     expiresAt: string | null;
     expirySlot: number;
+    effectiveExpirySlot?: number;
     inGracePeriod: boolean;
     remainingDays: number;
     reason: string | null;
@@ -11,10 +12,11 @@ export type VerifyResponse = {
  * Core license verification.
  *
  * @param zkAppAddress - app address (composite key with licenseHash)
- * @param licenseHash  - Poseidon.hash([secretHash]) as a field string
+ * @param licenseHash  - Poseidon hash of the buyer's Ed25519 pubkey (see ownershipLicenseHash.ts) as a field string
  * @param records      - current off-chain license records (from licenseStore)
  * @param onChainRoot  - zkApp appState[0] fetched from Mina
  * @param currentSlot  - current blockchain slot (globalSlotSinceGenesis)
+ * @param forkActivationSlot - the app's forkActivationSlot state (0: none)
  */
 export declare function verifyLicenseCore(params: {
     zkAppAddress: string;
@@ -22,5 +24,6 @@ export declare function verifyLicenseCore(params: {
     records: LicenseRecord[];
     onChainRoot: string;
     currentSlot: number;
+    forkActivationSlot?: number;
 }): VerifyResponse;
 //# sourceMappingURL=verifyCore.d.ts.map

package/build/verifyCore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyCore.d.ts","sourceRoot":"","sources":["../src/verifyCore.ts"],"names":[],"mappings":"AAYA,OAAO,EAAY,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGjE,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IAGnB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,aAAa,EAAE,OAAO,CAAC;IAIvB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAOF;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE;IACxC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B,GAAG,cAAc,CA+CjB"}

package/build/verifyCore.js

@@ -1,5 +1,5 @@
 // Copyright (c) 2025-2026 zkLicensing project developers
-// All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
 /**
  * verifyCore.ts
  *
@@ -9,7 +9,7 @@
  */
 import { Field } from 'o1js';
 import { buildMap } from './licenseStore.js';
-import { GRACE_PERIOD_N, MS_PER_SLOT_N, SLOTS_PER_DAY_N } from './contractInterface.js';
+import { GRACE_PERIOD_N, MS_PER_SLOT_N, SLOTS_PER_DAY_N, effectiveExpirySlot } from './contractInterface.js';
 function computeRemainingDays(expirySlot, currentSlot) {
     if (expirySlot === 0)
         return 0;
@@ -19,10 +19,11 @@ function computeRemainingDays(expirySlot, currentSlot) {
  * Core license verification.
  *
  * @param zkAppAddress - app address (composite key with licenseHash)
- * @param licenseHash  - Poseidon.hash([secretHash]) as a field string
+ * @param licenseHash  - Poseidon hash of the buyer's Ed25519 pubkey (see ownershipLicenseHash.ts) as a field string
  * @param records      - current off-chain license records (from licenseStore)
  * @param onChainRoot  - zkApp appState[0] fetched from Mina
  * @param currentSlot  - current blockchain slot (globalSlotSinceGenesis)
+ * @param forkActivationSlot - the app's forkActivationSlot state (0: none)
  */
 export function verifyLicenseCore(params) {
     const { zkAppAddress, licenseHash, records, onChainRoot, currentSlot } = params;
@@ -34,21 +35,31 @@ export function verifyLicenseCore(params) {
     if (computedRoot.toString() !== onChainRoot) {
         return { valid: false, expiresAt: null, expirySlot: 0, inGracePeriod: false, remainingDays: 0, reason: 'License state does not match on-chain root' };
     }
+    // Post-LicenseLeaf: the map value is `leaf.hash()`, not raw expirySlot.
+    // Empty slots still hash to Field(0). Look up the record to recover
+    // expirySlot; `buildMap` excludes refunded/empty entries, so a missing
+    // record here means either "never bought" or "refunded" (record kept but
+    // expirySlot cleared to 0).
+    const record = records.find(r => r.zkAppAddress === zkAppAddress && r.licenseHash === licenseHash);
     if (currentValue === '0') {
-        return { valid: false, expiresAt: null, expirySlot: 0, inGracePeriod: false, remainingDays: 0, reason: 'License has been refunded' };
+        const reason = record?.refunded ? 'License has been refunded' : 'License not found';
+        return { valid: false, expiresAt: null, expirySlot: 0, inGracePeriod: false, remainingDays: 0, reason };
     }
-    const expirySlot = Number(currentValue);
-    const inGracePeriod = currentSlot > expirySlot && currentSlot <= expirySlot + GRACE_PERIOD_N;
-    const expired = currentSlot > expirySlot + GRACE_PERIOD_N;
-    const expiresAt = new Date(Date.now() + (expirySlot - currentSlot) * MS_PER_SLOT_N).toISOString();
-    const remainingDays = computeRemainingDays(expirySlot, currentSlot);
+    const expirySlot = record?.expirySlot ?? 0;
+    const effective = effectiveExpirySlot(expirySlot, params.forkActivationSlot ?? 0);
+    const bumped = effective !== expirySlot ? { effectiveExpirySlot: effective } : {};
+    const inGracePeriod = currentSlot > effective && currentSlot <= effective + GRACE_PERIOD_N;
+    const expired = currentSlot > effective + GRACE_PERIOD_N;
+    const expiresAt = new Date(Date.now() + (effective - currentSlot) * MS_PER_SLOT_N).toISOString();
+    const remainingDays = computeRemainingDays(effective, currentSlot);
     if (expired) {
-        return { valid: false, expiresAt, expirySlot, inGracePeriod: false, remainingDays, reason: 'License has expired' };
+        return { valid: false, expiresAt, expirySlot, ...bumped, inGracePeriod: false, remainingDays, reason: 'License has expired' };
     }
     return {
         valid: true,
         expiresAt,
         expirySlot,
+        ...bumped,
         inGracePeriod,
         remainingDays,
         reason: inGracePeriod ? 'License is in grace period — renew to avoid interruption' : null,

package/build/verifyCore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyCore.js","sourceRoot":"","sources":["../src/verifyCore.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,oCAAoC;AAEpC;;;;;;GAMG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAsB,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAiB7G,SAAS,oBAAoB,CAAC,UAAkB,EAAE,WAAmB;IACnE,IAAI,UAAU,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,GAAG,WAAW,CAAC,GAAG,eAAe,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAOjC;IACC,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IAEhF,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC;IAC/B,MAAM,YAAY,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAEpC,MAAM,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;IAEtE,IAAI,YAAY,CAAC,QAAQ,EAAE,KAAK,WAAW,EAAE,CAAC;QAC5C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;IACxJ,CAAC;IAED,wEAAwE;IACxE,oEAAoE;IACpE,uEAAuE;IACvE,yEAAyE;IACzE,4BAA4B;IAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,YAAY,IAAI,CAAC,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;IAEnG,IAAI,YAAY,KAAK,GAAG,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,mBAAmB,CAAC;QACpF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1G,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,EAAE,UAAU,IAAI,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,mBAAmB,CAAC,UAAU,EAAE,MAAM,CAAC,kBAAkB,IAAI,CAAC,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,SAAS,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,MAAM,aAAa,GAAG,WAAW,GAAG,SAAS,IAAI,WAAW,IAAI,SAAS,GAAG,cAAc,CAAC;IAC3F,MAAM,OAAO,GAAG,WAAW,GAAG,SAAS,GAAG,cAAc,CAAC;IACzD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,GAAG,WAAW,CAAC,GAAG,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC;IACjG,MAAM,aAAa,GAAG,oBAAoB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAEnE,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAChI,CAAC;IAED,OAAO;QACL,KAAK,EAAE,IAAI;QACX,SAAS;QACT,UAAU;QACV,GAAG,MAAM;QACT,aAAa;QACb,aAAa;QACb,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC,0DAA0D,CAAC,CAAC,CAAC,IAAI;KAC1F,CAAC;AACJ,CAAC"}

package/build/verifyOffline.d.ts

@@ -0,0 +1,85 @@
+/**
+ * verifyOffline.ts
+ *
+ * Non-custodial device-binding offline verifier. Given:
+ *   - a serialized MerkleMapWitness for the license entry
+ *   - a `licensesRoot` value the caller has anchored to (see "Trust anchoring")
+ *   - the full LicenseLeaf field set (licenseHash, expirySlot, deviceCap,
+ *     deviceSlots[]) as of that sync — the leaf carries no separate
+ *     owner-pubkey commitment because `licenseHash` IS it (buy circuit
+ *     asserts equality)
+ *   - the caller's device public key
+ *
+ * this module:
+ *   1. Reconstructs the LicenseLeaf hash from its fields.
+ *   2. Rebuilds the on-chain root through the witness and asserts it matches
+ *      the passed `licensesRoot` — proves the leaf field set is authentic
+ *      relative to that root.
+ *   3. If `deviceCap > 0`: computes the device commitment for the caller's
+ *      pubkey and asserts it appears in `occupied[]`.
+ *   4. Asserts `expirySlot > currentSlot` (grace-period handling stays in
+ *      the online verifier; the device-bound offline path is pass/fail).
+ *   5. If `deviceCap === 0`: skips the device check entirely — the app has
+ *      binding disabled at the vendor level.
+ *
+ * Trust anchoring — where does `licensesRoot` come from?
+ * -------------------------------------------------------
+ * This module treats the passed root as ground truth. It does NOT fetch
+ * it. Two ways to source it:
+ *
+ *   • Non-custodial (recommended). Fetch it yourself from Mina via
+ *     `fetchOnChainLicensesRoot({ zkAppAddress, network })` from
+ *     `zklicensing/on-chain-root`. That reads `zkapp.appState[0]` on
+ *     the deployed LicensingApp — the same field the circuit updates on
+ *     every buy/renew/bind/unbind/refund. No trust in the licensing
+ *     service required.
+ *
+ *   • Custodial (trusted-service). Use whatever root the licensing
+ *     service returned on its `/verify` or `/witness` response. Faster
+ *     (no o1js + Mina RPC round-trip) but relies on the service to
+ *     report the true chain state. If you go this route, cross-check
+ *     the reported root against the on-chain value on some cadence.
+ *
+ * The caller fetches the device slot state (occupied[] + freedAt[] + cap)
+ * from the vendor SDK or platform verifier alongside the licensesRoot on
+ * the sync cadence of their choice. The parallel arrays fold to
+ * `deviceSlotsRoot`, so any tampering with slot contents changes the leaf
+ * hash and fails the witness check — provided `licensesRoot` itself is
+ * trustworthy (see above), verifyOffline needs no trust in whoever
+ * served the slot arrays.
+ *
+ * Not exported at the top-level barrel by default; vendors who ship a
+ * device-cap app import from `zklicensing/verify-offline` explicitly.
+ */
+import { Field, PublicKey } from 'o1js';
+import { type serializeWitness } from './licenseStore.js';
+export type DeviceSlotSnapshot = {
+    slotIndex: number;
+    deviceCommitment: string;
+    boundAtSlot: number;
+    freedAtSlot: number;
+};
+export type VerifyOfflineInput = {
+    licensesRoot: string;
+    currentSlot: number;
+    licenseHash: string;
+    expirySlot: number;
+    deviceCap: number;
+    devices: DeviceSlotSnapshot[];
+    witness: ReturnType<typeof serializeWitness>;
+    devicePubKey?: PublicKey;
+};
+export type VerifyOfflineResult = {
+    valid: boolean;
+    reason: string | null;
+};
+/**
+ * Pure offline device-binding verifier. See module-level docstring.
+ *
+ * All errors are returned via `{ valid: false, reason }` rather than thrown
+ * — callers integrate this into a boot-time gate and don't want to catch
+ * around every call. `reason` is stable enough to key error UX off of.
+ */
+export declare function verifyOffline(input: VerifyOfflineInput): VerifyOfflineResult;
+export declare function deviceCommitmentFromFields(x: Field, isOdd: Field): Field;
+//# sourceMappingURL=verifyOffline.d.ts.map

package/build/verifyOffline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyOffline.d.ts","sourceRoot":"","sources":["../src/verifyOffline.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,EAAE,KAAK,EAAY,SAAS,EAAU,MAAM,MAAM,CAAC;AAC1D,OAAO,EAAsB,KAAK,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAc9E,MAAM,MAAM,kBAAkB,GAAG;IAC/B,SAAS,EAAS,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,WAAW,EAAO,MAAM,CAAC;IACzB,WAAW,EAAO,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,kBAAkB,GAAG;IAO/B,YAAY,EAAM,MAAM,CAAC;IACzB,WAAW,EAAO,MAAM,CAAC;IAMzB,WAAW,EAAO,MAAM,CAAC;IACzB,UAAU,EAAQ,MAAM,CAAC;IACzB,SAAS,EAAS,MAAM,CAAC;IACzB,OAAO,EAAW,kBAAkB,EAAE,CAAC;IAKvC,OAAO,EAAW,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC;IAMtD,YAAY,CAAC,EAAK,SAAS,CAAC;CAC7B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAG,OAAO,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAwBF;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,mBAAmB,CA0D5E;AAOD,wBAAgB,0BAA0B,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,GAAG,KAAK,CAExE"}