zklicensing 0.1.0-beta.2 → 0.1.0-beta.4

package/build/index.js

@@ -1,54 +1,43 @@
 // Copyright (c) 2025-2026 zkLicensing project developers
-// All rights reserved.
+// SPDX-License-Identifier: BUSL-1.1
 /**
  * verifyLicense — client SDK.
  *
- * Calls the keeper's GET /verify until the on-chain refund window for the
- * license has closed; from that point on returns from a local anchor and
- * never touches the network again. The refund-window decision is server-
- * side: the keeper returns `refundWindowClosed: boolean` on its /verify
- * response, computed from its own record of `purchaseSlot + REFUND_WINDOW_N`
- * against the on-chain `currentSlot`. The SDK gates anchor writes on that
- * boolean and never trusts a `purchaseSlot` supplied by the local proof
- * file, so a user who forges their proof metadata cannot force the offline
- * branch prematurely.
+ * Calls the licensing service's GET /verify until the on-chain refund
+ * window for the license has closed; from that point on returns from a
+ * local anchor and never touches the network again. The refund-window
+ * decision is server-side: the service returns `refundWindowClosed:
+ * boolean` on its /verify response, computed from its own record of
+ * `purchaseSlot + REFUND_WINDOW_N` against the on-chain `currentSlot`.
+ * The SDK gates anchor writes on that boolean and never trusts a
+ * `purchaseSlot` supplied by the local proof file, so a user who forges
+ * their proof metadata cannot force the offline branch prematurely.
  *
  * Anchor purity: every field persisted in the Anchor derives from the
- * keeper's /verify response — `anchoredSlot`, `expirySlot`, `ownership`.
- * The only client-supplied input to the offline branch is
- * `proof.expirySlot`, used solely as the loadAnchor binding key. A
- * tampered proof file therefore never gets a wrong answer; it gets no
- * offline branch at all and falls through to the keeper on every call.
+ * service's /verify response — `anchoredSlot`, `expirySlot`. The only
+ * client-supplied input to the offline branch is `proof.expirySlot`,
+ * used solely as the loadAnchor binding key. A tampered proof file
+ * therefore never gets a wrong answer; it gets no offline branch at all
+ * and falls through to the licensing service on every call.
  */
 import { REFUND_WINDOW_N, GRACE_PERIOD_N, MS_PER_SLOT_N, SLOTS_PER_DAY_N, } from './contractInterface.js';
 const MS_PER_SLOT = MS_PER_SLOT_N;
 const SLOTS_PER_DAY = SLOTS_PER_DAY_N;
+// The one and only verify endpoint. Every issued license routes here
+// regardless of network — the platform verifier resolves devnet vs
+// mainnet from the zkAppAddress (each deployment is unique per network).
+// Tests inject a mock via VerifyOptions.fetcher, not by rewriting this URL.
+export const DEFAULT_VERIFIER_URL = 'https://zklicensing.com/api/verify';
+// Anchor records are keyed by (zkAppAddress, licenseHash). zkAppAddress
+// is generation-scoped by construction: each hardfork migration deploys
+// the LicensingApp at a fresh address (see keeper's finalizeRedeploy
+// and AppRecord.deploymentHistory[]), so keying on it implicitly
+// captures generation. An anchor written pre-migration is orphaned by
+// the new address on next verify and re-created cleanly — no
+// cross-generation carry-over.
 const ANCHOR_KEY_PREFIX = 'zklic_anchor_';
-const ACTIVATION_KEY_PREFIX = 'zklic_activation_';
-function activationKey(zkAppAddress, licenseHash) {
-    return `${ACTIVATION_KEY_PREFIX}${zkAppAddress}_${licenseHash}`;
-}
-export function loadActivation(storage, zkAppAddress, licenseHash, nowMs = Date.now()) {
-    try {
-        const raw = storage.getItem(activationKey(zkAppAddress, licenseHash));
-        if (!raw)
-            return null;
-        const rec = JSON.parse(raw);
-        if (nowMs > rec.expiresAt)
-            return null;
-        return rec;
-    }
-    catch {
-        return null;
-    }
-}
-export function saveActivation(storage, zkAppAddress, licenseHash, rec) {
-    try {
-        storage.setItem(activationKey(zkAppAddress, licenseHash), JSON.stringify(rec));
-    }
-    catch {
-        /* quota / read-only — non-fatal */
-    }
+function anchorKey(zkAppAddress, licenseHash) {
+    return `${ANCHOR_KEY_PREFIX}${zkAppAddress}_${licenseHash}`;
 }
 function defaultStorage() {
     if (typeof globalThis !== 'undefined' && globalThis.localStorage) {
@@ -56,19 +45,20 @@ function defaultStorage() {
     }
     return null;
 }
-function loadAnchor(storage, licenseHash, expirySlot) {
+function loadAnchor(storage, zkAppAddress, licenseHash, expirySlot) {
     try {
-        const raw = storage.getItem(ANCHOR_KEY_PREFIX + licenseHash);
+        const raw = storage.getItem(anchorKey(zkAppAddress, licenseHash));
         if (!raw)
             return null;
         const a = JSON.parse(raw);
-        // `a.expirySlot` is the KEEPER's value captured at anchor time; the
-        // `expirySlot` argument is the LOCAL proof file's value. Match ⇒ local
-        // file agrees with chain truth as of anchoring ⇒ offline is safe.
-        // Mismatch has two honest meanings:
+        // `a.expirySlot` is the SERVICE's value captured at anchor time;
+        // the `expirySlot` argument is the LOCAL proof file's value. Match
+        // ⇒ local file agrees with chain truth as of anchoring ⇒ offline is
+        // safe. Mismatch has two honest meanings:
         //   - renewal: chain moved, local file updated ⇒ re-anchor via chain check
-        //   - forgery: local file edited ⇒ every call falls through to the keeper,
-        //     which reports truth. The forger gets no offline branch at all.
+        //   - forgery: local file edited ⇒ every call falls through to the
+        //     licensing service, which reports truth. The forger gets no
+        //     offline branch at all.
         if (a.expirySlot !== expirySlot)
             return null;
         return a;
@@ -77,9 +67,9 @@ function loadAnchor(storage, licenseHash, expirySlot) {
         return null;
     }
 }
-function saveAnchor(storage, licenseHash, anchor) {
+function saveAnchor(storage, zkAppAddress, licenseHash, anchor) {
     try {
-        storage.setItem(ANCHOR_KEY_PREFIX + licenseHash, JSON.stringify(anchor));
+        storage.setItem(anchorKey(zkAppAddress, licenseHash), JSON.stringify(anchor));
     }
     catch {
         // Storage may be full or read-only; the offline path simply won't activate.
@@ -90,39 +80,6 @@ function computeRemainingDays(expirySlot, currentSlot) {
         return 0;
     return Math.floor((expirySlot - currentSlot) / SLOTS_PER_DAY);
 }
-// Renew the activation token when within this window of expiry. Picked so
-// that a daily verify call has many chances to refresh before the token dies.
-const TOKEN_RENEW_THRESHOLD_MS = 24 * 60 * 60 * 1000;
-async function tryActivate(storage, zkAppAddress, licenseHash, current, bootstrapSecretHash, prover, verifierUrl, fetcher, nowMs) {
-    const secretHash = current?.secretHash ?? bootstrapSecretHash;
-    if (!secretHash)
-        return current;
-    // Existing token still fresh — nothing to do.
-    if (current?.token && current.expiresAt - nowMs > TOKEN_RENEW_THRESHOLD_MS)
-        return current;
-    try {
-        const base = verifierUrl.replace(/\/+$/, '');
-        const challengeResp = await fetcher(`${base}/challenge?licenseHash=${encodeURIComponent(licenseHash)}`);
-        if (!challengeResp.ok)
-            return current;
-        const { nonce } = (await challengeResp.json());
-        const proofJson = await prover({ licenseHash, nonce, secretHash });
-        const respondResp = await fetcher(`${base}/respond`, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({ zkAppAddress, proof: proofJson }),
-        });
-        if (!respondResp.ok)
-            return current;
-        const { token, expiresAt } = (await respondResp.json());
-        const next = { token, expiresAt, secretHash };
-        saveActivation(storage, zkAppAddress, licenseHash, next);
-        return next;
-    }
-    catch {
-        return current;
-    }
-}
 function offlineCheck(anchor, nowMs) {
     const elapsedSlots = Math.max(0, Math.floor((nowMs - anchor.anchoredAtMs) / MS_PER_SLOT));
     const estCurrentSlot = anchor.anchoredSlot + elapsedSlots;
@@ -142,20 +99,18 @@ function offlineCheck(anchor, nowMs) {
                 ? 'License is in grace period — renew to avoid interruption'
                 : null,
         source: 'offline',
-        ownership: anchor.ownership,
     };
 }
 export async function verifyLicense(proof, options = {}) {
     const storage = options.storage === null ? null : options.storage ?? defaultStorage();
     const fetcher = options.fetcher ?? (typeof fetch !== 'undefined' ? fetch : undefined);
     const nowFn = options.now ?? (() => Date.now());
-    const verifierUrl = options.verifierUrl ?? proof.verifierUrl;
     if (storage) {
-        const anchor = loadAnchor(storage, proof.licenseHash, proof.expirySlot);
+        const anchor = loadAnchor(storage, proof.zkAppAddress, proof.licenseHash, proof.expirySlot);
         if (anchor)
             return offlineCheck(anchor, nowFn());
     }
-    if (!verifierUrl || !fetcher) {
+    if (!fetcher) {
         return {
             valid: false,
             expirySlot: proof.expirySlot,
@@ -163,24 +118,13 @@ export async function verifyLicense(proof, options = {}) {
             currentSlot: 0,
             inGracePeriod: false,
             remainingDays: 0,
-            reason: 'No verifier URL or fetcher available; cannot verify',
+            reason: 'No fetch implementation available; cannot verify',
             source: 'chain',
-            ownership: 'unverified',
         };
     }
-    let activation = storage
-        ? loadActivation(storage, proof.zkAppAddress, proof.licenseHash, nowFn())
-        : null;
-    if (storage && options.prover && (activation || options.secretHash)) {
-        activation = await tryActivate(storage, proof.zkAppAddress, proof.licenseHash, activation, options.secretHash, options.prover, verifierUrl, fetcher, nowFn());
-    }
-    const tokenParam = activation?.token
-        ? `&token=${encodeURIComponent(activation.token)}`
-        : '';
-    const url = `${verifierUrl.replace(/\/+$/, '')}` +
+    const url = `${DEFAULT_VERIFIER_URL}` +
         `?licenseHash=${encodeURIComponent(proof.licenseHash)}` +
-        `&zkAppAddress=${encodeURIComponent(proof.zkAppAddress)}` +
-        tokenParam;
+        `&zkAppAddress=${encodeURIComponent(proof.zkAppAddress)}`;
     let data;
     try {
         const resp = await fetcher(url);
@@ -194,7 +138,6 @@ export async function verifyLicense(proof, options = {}) {
                 remainingDays: 0,
                 reason: `Verification request failed (HTTP ${resp.status})`,
                 source: 'chain',
-                ownership: 'unverified',
             };
         }
         data = await resp.json();
@@ -209,13 +152,12 @@ export async function verifyLicense(proof, options = {}) {
             remainingDays: 0,
             reason: err?.message ?? 'Verification request errored',
             source: 'chain',
-            ownership: 'unverified',
         };
     }
-    // Keeper's authoritative expiry, or null if the response omits it. Only
-    // the null-safe form may be written into the anchor; the chain-result
-    // display value below falls back to the local proof file for user-facing
-    // fields, which is safe (display only).
+    // Service's authoritative expiry, or null if the response omits it.
+    // Only the null-safe form may be written into the anchor; the
+    // chain-result display value below falls back to the local proof file
+    // for user-facing fields, which is safe (display only).
     const respExpirySlotStrict = typeof data.expirySlot === 'number' ? data.expirySlot : null;
     const respExpirySlot = respExpirySlotStrict ?? proof.expirySlot;
     const respCurrentSlot = typeof data.currentSlot === 'number' ? data.currentSlot : 0;
@@ -230,24 +172,23 @@ export async function verifyLicense(proof, options = {}) {
             : computeRemainingDays(respExpirySlot, respCurrentSlot),
         reason: data.reason ?? null,
         source: 'chain',
-        ownership: data.ownership === 'verified' ? 'verified' : 'unverified',
     };
-    // Anchor gate uses the keeper's own refund-window decision. The keeper
-    // knows the true purchaseSlot (stored in its LicenseRecord) and the true
-    // currentSlot; the SDK never trusts a purchaseSlot or expirySlot supplied
-    // by the local proof file, since that file is client-writable and could
-    // be forged. If the keeper omits `expirySlot`, we fail-closed on the
-    // offline path — no anchor written, subsequent calls stay online.
+    // Anchor gate uses the service's own refund-window decision. The
+    // service knows the true purchaseSlot (stored in its LicenseRecord)
+    // and the true currentSlot; the SDK never trusts a purchaseSlot or
+    // expirySlot supplied by the local proof file, since that file is
+    // client-writable and could be forged. If the service omits
+    // `expirySlot`, we fail-closed on the offline path — no anchor
+    // written, subsequent calls stay online.
     if (storage &&
         result.valid &&
         data.refundWindowClosed === true &&
         typeof data.currentSlot === 'number' &&
         respExpirySlotStrict !== null) {
-        saveAnchor(storage, proof.licenseHash, {
+        saveAnchor(storage, proof.zkAppAddress, proof.licenseHash, {
             anchoredSlot: data.currentSlot,
             anchoredAtMs: nowFn(),
             expirySlot: respExpirySlotStrict,
-            ownership: result.ownership,
         });
     }
     return result;
@@ -255,4 +196,32 @@ export async function verifyLicense(proof, options = {}) {
 // Re-exported so tests and downstream tooling can reference the same values
 // the SDK uses internally without re-deriving them.
 export { REFUND_WINDOW_N, GRACE_PERIOD_N, MS_PER_SLOT };
+// Non-custodial device binding surface. Re-exported at the
+// barrel alongside buy / renew / refund so vendor SDK integrators can
+// pull the whole family from a single import path. Each also has its
+// own package subpath (`zklicensing/bind`, `zklicensing/unbind`,
+// `zklicensing/device-identity`) to match the buy / renew / refund
+// convention.
+export { proveBind, confirmBind } from './bindClient.js';
+export { proveUnbind, confirmUnbind } from './unbindClient.js';
+export { getOrCreateDeviceIdentity, computeDeviceCommitment, } from './deviceIdentity.js';
+// Offline device-binding verifier. Vendors reconstruct the
+// LicenseLeaf from a synced snapshot, verify the leaf hash against the
+// last-known licensesRoot, and confirm the caller's device commitment
+// appears in `occupied[]`. Also available at the `zklicensing/verify-offline`
+// subpath for callers that want to minimize their imported surface.
+export { verifyOffline, deviceCommitmentFromFields } from './verifyOffline.js';
+// Non-custodial trust anchor for `verifyOffline`. Reads the live
+// `licensesRoot` (zkapp.appState[0]) directly from Mina — pair it with
+// `verifyOffline` when you do not want to trust the licensing service's
+// reported root. Also available at the `zklicensing/on-chain-root`
+// subpath. o1js is imported lazily so callers that skip this helper
+// don't pay the o1js dep cost at load time.
+export { fetchOnChainLicensesRoot, DEFAULT_MINA_GRAPHQL_URLS } from './onChainRoot.js';
+// Human-readable seat names for the device-binding UI ("Silent Otter",
+// "Curious Panda"). Deterministic in `licenseHash + slotIndex + boundAtSlot`,
+// so every viewer of the same license computes the same name per slot
+// without a naming sidecar. Also available at the `zklicensing/seat-name`
+// subpath.
+export { seatNameFor, SEAT_NAME_COMBINATIONS } from './seatName.js';
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,oCAAoC;AAEpC;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EACL,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAEhC,MAAM,WAAW,GAAG,aAAa,CAAC;AAClC,MAAM,aAAa,GAAG,eAAe,CAAC;AAEtC,qEAAqE;AACrE,mEAAmE;AACnE,yEAAyE;AACzE,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,oCAAoC,CAAC;AAEzE,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,iEAAiE;AACjE,sEAAsE;AACtE,6DAA6D;AAC7D,+BAA+B;AAC/B,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAE1C,SAAS,SAAS,CAAC,YAAoB,EAAE,WAAmB;IAC1D,OAAO,GAAG,iBAAiB,GAAG,YAAY,IAAI,WAAW,EAAE,CAAC;AAC9D,CAAC;AA6CD,SAAS,cAAc;IACrB,IAAI,OAAO,UAAU,KAAK,WAAW,IAAK,UAAkB,CAAC,YAAY,EAAE,CAAC;QAC1E,OAAQ,UAAkB,CAAC,YAAuB,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,UAAU,CACjB,OAAgB,EAChB,YAAoB,EACpB,WAAmB,EACnB,UAAkB;IAElB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAW,CAAC;QACpC,iEAAiE;QACjE,mEAAmE;QACnE,oEAAoE;QACpE,0CAA0C;QAC1C,2EAA2E;QAC3E,mEAAmE;QACnE,iEAAiE;QACjE,6BAA6B;QAC7B,IAAI,CAAC,CAAC,UAAU,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC;QAC7C,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CACjB,OAAgB,EAChB,YAAoB,EACpB,WAAmB,EACnB,MAAc;IAEd,IAAI,CAAC;QACH,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,YAAY,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;IAC9E,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,UAAkB,EAAE,WAAmB;IACnE,IAAI,UAAU,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAC/B,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,UAAU,GAAG,WAAW,CAAC,GAAG,aAAa,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,YAAY,CAAC,MAAc,EAAE,KAAa;IACjD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC;IAC1F,MAAM,cAAc,GAAG,MAAM,CAAC,YAAY,GAAG,YAAY,CAAC;IAC1D,MAAM,OAAO,GAAG,cAAc,GAAG,MAAM,CAAC,UAAU,GAAG,cAAc,CAAC;IACpE,MAAM,aAAa,GAAG,CAAC,OAAO,IAAI,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC;IACrE,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,MAAM,CAAC,UAAU,GAAG,cAAc,CAAC,GAAG,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;IACrG,OAAO;QACL,KAAK,EAAE,CAAC,OAAO;QACf,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS;QACT,WAAW,EAAE,cAAc;QAC3B,aAAa;QACb,aAAa,EAAE,oBAAoB,CAAC,MAAM,CAAC,UAAU,EAAE,cAAc,CAAC;QACtE,MAAM,EAAE,OAAO;YACb,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,0DAA0D;gBAC5D,CAAC,CAAC,IAAI;QACR,MAAM,EAAE,SAAS;KAClB,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAiB,EACjB,UAAyB,EAAE;IAE3B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,cAAc,EAAE,CAAC;IACtF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,KAAK,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACtF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAEhD,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QAC5F,IAAI,MAAM;YAAE,OAAO,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,KAAK;YACpB,aAAa,EAAE,CAAC;YAChB,MAAM,EAAE,kDAAkD;YAC1D,MAAM,EAAE,OAAO;SAChB,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GACP,GAAG,oBAAoB,EAAE;QACzB,gBAAgB,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE;QACvD,iBAAiB,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;IAE5D,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,SAAS,EAAE,IAAI;gBACf,WAAW,EAAE,CAAC;gBACd,aAAa,EAAE,KAAK;gBACpB,aAAa,EAAE,CAAC;gBAChB,MAAM,EAAE,qCAAqC,IAAI,CAAC,MAAM,GAAG;gBAC3D,MAAM,EAAE,OAAO;aAChB,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,CAAC;YACd,aAAa,EAAE,KAAK;YACpB,aAAa,EAAE,CAAC;YAChB,MAAM,EAAE,GAAG,EAAE,OAAO,IAAI,8BAA8B;YACtD,MAAM,EAAE,OAAO;SAChB,CAAC;IACJ,CAAC;IAED,oEAAoE;IACpE,8DAA8D;IAC9D,sEAAsE;IACtE,wDAAwD;IACxD,MAAM,oBAAoB,GACxB,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/D,MAAM,cAAc,GAAW,oBAAoB,IAAI,KAAK,CAAC,UAAU,CAAC;IACxE,MAAM,eAAe,GAAW,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5F,MAAM,MAAM,GAAiB;QAC3B,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK;QACnB,UAAU,EAAE,cAAc;QAC1B,SAAS,EAAE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;QACrE,WAAW,EAAE,eAAe;QAC5B,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,aAAa;QACnC,aAAa,EAAE,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ;YACnD,CAAC,CAAC,IAAI,CAAC,aAAa;YACpB,CAAC,CAAC,oBAAoB,CAAC,cAAc,EAAE,eAAe,CAAC;QACzD,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI;QAC3B,MAAM,EAAE,OAAO;KAChB,CAAC;IAEF,iEAAiE;IACjE,oEAAoE;IACpE,mEAAmE;IACnE,kEAAkE;IAClE,4DAA4D;IAC5D,+DAA+D;IAC/D,yCAAyC;IACzC,IACE,OAAO;QACP,MAAM,CAAC,KAAK;QACZ,IAAI,CAAC,kBAAkB,KAAK,IAAI;QAChC,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;QACpC,oBAAoB,KAAK,IAAI,EAC7B,CAAC;QACD,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,WAAW,EAAE;YACzD,YAAY,EAAE,IAAI,CAAC,WAAW;YAC9B,YAAY,EAAE,KAAK,EAAE;YACrB,UAAU,EAAE,oBAAoB;SACjC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4EAA4E;AAC5E,oDAAoD;AACpD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC;AAExD,2DAA2D;AAC3D,sEAAsE;AACtE,qEAAqE;AACrE,iEAAiE;AACjE,mEAAmE;AACnE,cAAc;AACd,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAMzD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAM/D,OAAO,EACL,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,qBAAqB,CAAC;AAG7B,2DAA2D;AAC3D,uEAAuE;AACvE,sEAAsE;AACtE,8EAA8E;AAC9E,oEAAoE;AACpE,OAAO,EAAE,aAAa,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAO/E,iEAAiE;AACjE,uEAAuE;AACvE,wEAAwE;AACxE,mEAAmE;AACnE,oEAAoE;AACpE,4CAA4C;AAC5C,OAAO,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAGvF,uEAAuE;AACvE,8EAA8E;AAC9E,sEAAsE;AACtE,0EAA0E;AAC1E,WAAW;AACX,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC"}

package/build/licenseLeaf.d.ts

@@ -0,0 +1,76 @@
+/**
+ * licenseLeaf.ts
+ *
+ * On-chain leaf value stored at every occupied `licensesRoot` slot. Bundles
+ * the license expiry with the device-binding state (cap, slot commitments,
+ * fill counter) so a single tree lookup returns everything a verifier or a
+ * `/prove/bind` call needs.
+ *
+ * Wire shape (in order of hash preimage):
+ *   licenseHash          Field       the tree key, also carried in the leaf
+ *                                    so a stolen witness can't be re-pointed
+ *                                    at another entry. Doubles as the owner-
+ *                                    pubkey commitment — buyLicense asserts
+ *                                    licenseHash == Poseidon(pk.x, pk.isOdd)
+ *                                    so bind/unbind's ownership check reads
+ *                                    the same field as the tree key. Storing
+ *                                    them separately would be pure redundancy.
+ *   expirySlot           UInt32→Field UInt32 packed into a Field
+ *   cap                  UInt32→Field 0 disables /prove/bind; ≤DEVICE_SLOT_CAP
+ *                                    (kept as UInt32 in-circuit because o1js's
+ *                                    provable types don't include UInt8)
+ *   deviceSlotsRoot      Field       Poseidon fold over the 10 slot fields
+ *                                    below (2 fields × DEVICE_SLOT_CAP)
+ *   deviceSlotsFilled    UInt32→Field how many of the DEVICE_SLOT_CAP slots
+ *                                    are currently non-empty — carried
+ *                                    alongside the fold so `bind()` can do
+ *                                    a cheap "cap - filled > 0" check
+ *                                    without re-summing the array
+ *
+ * DEVICE_SLOT_CAP is fixed at 5 so the slot arrays have a size known to the
+ * circuit at compile time. `cap` in the leaf may be smaller — it's a
+ * per-license limit; slots [cap..DEVICE_SLOT_CAP) must always stay empty
+ * (Field(0)) and `bind()` rejects any write to them. `cap = 0` disables
+ * binding entirely; `bind()` rejects immediately without ever touching a
+ * slot.
+ *
+ * Slot encoding (fields carried in the fold, per slot i):
+ *   occupied[i]  Field   0 (empty) or Poseidon(devicePubKeyHash)
+ *   freedAt[i]   Field   packed (boundAtSlot << 32) | freedAtSlot; both
+ *                        are UInt32-range Mina slot numbers. On a fresh
+ *                        empty slot both halves are 0. On bind, boundAt
+ *                        gets the current slot and freedAt stays 0. On
+ *                        unbind, freedAt gets the current slot (boundAt
+ *                        is preserved for audit / cooldown math).
+ *
+ * The struct + helpers live in the SDK (not the circuit package) so both
+ * the on-chain `@method` bodies AND the off-chain keeper / verifier /
+ * dashboards can share a single source of truth for the leaf hash. The
+ * circuit re-exports them from `LicensingApp.ts` so existing consumers
+ * that import from there keep working.
+ */
+import { Field, PublicKey, UInt32 } from 'o1js';
+import type { LicenseRecord } from './licenseRecord.js';
+export declare const DEVICE_SLOT_CAP_N = 5;
+export declare const DEVICE_SLOT_CAP: UInt32;
+export declare const EMPTY_DEVICE_SLOTS_ROOT: Field;
+export declare function ownerPubKeyHash(pub: PublicKey): Field;
+export declare function packSlotTimes(boundAtSlot: UInt32, freedAtSlot: UInt32): Field;
+export declare function unpackSlotTimes(packed: Field): {
+    boundAtSlot: UInt32;
+    freedAtSlot: UInt32;
+};
+export declare function computeDeviceSlotsRoot(occupied: Field[], freedAt: Field[]): Field;
+export declare const DeviceSlot: any;
+export type DeviceSlot = any;
+export declare function emptyDeviceSlot(): DeviceSlot;
+export declare const DeviceSlots: any;
+export type DeviceSlots = any;
+export declare function emptyDeviceSlots(): DeviceSlots;
+export declare function deviceSlotsHash(ds: DeviceSlots): Field;
+export declare const LicenseLeaf: any;
+export type LicenseLeaf = any;
+export declare function leafHash(leaf: LicenseLeaf): Field;
+export declare function freshLeaf(licenseHash: Field, expirySlot: UInt32, cap: UInt32): LicenseLeaf;
+export declare function leafFromRecord(record: LicenseRecord): LicenseLeaf;
+//# sourceMappingURL=licenseLeaf.d.ts.map

package/build/licenseLeaf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"licenseLeaf.d.ts","sourceRoot":"","sources":["../src/licenseLeaf.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,OAAO,EAAE,KAAK,EAAsB,SAAS,EAAU,MAAM,EAAE,MAAM,MAAM,CAAC;AAC5E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAMxD,eAAO,MAAM,iBAAiB,IAAI,CAAC;AACnC,eAAO,MAAM,eAAe,QAAiC,CAAC;AAK9D,eAAO,MAAM,uBAAuB,EAAE,KAErC,CAAC;AAOF,wBAAgB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,KAAK,CAErD;AASD,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,KAAK,CAE7E;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,KAAK,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAQ3F;AAMD,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,KAAK,EAAE,EACjB,OAAO,EAAG,KAAK,EAAE,GAChB,KAAK,CAYP;AAYD,eAAO,MAAM,UAAU,EAAE,GAGvB,CAAC;AACH,MAAM,MAAM,UAAU,GAAG,GAAG,CAAC;AAE7B,wBAAgB,eAAe,IAAI,UAAU,CAE5C;AAID,eAAO,MAAM,WAAW,EAAE,GAExB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,GAAG,CAAC;AAE9B,wBAAgB,gBAAgB,IAAI,WAAW,CAI9C;AAKD,wBAAgB,eAAe,CAAC,EAAE,EAAE,WAAW,GAAG,KAAK,CAMtD;AAMD,eAAO,MAAM,WAAW,EAAE,GAMxB,CAAC;AACH,MAAM,MAAM,WAAW,GAAG,GAAG,CAAC;AAE9B,wBAAgB,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,KAAK,CAQjD;AAID,wBAAgB,SAAS,CACvB,WAAW,EAAE,KAAK,EAClB,UAAU,EAAG,MAAM,EACnB,GAAG,EAAU,MAAM,GAClB,WAAW,CAQb;AAMD,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,WAAW,CAUjE"}

package/build/licenseLeaf.js

@@ -0,0 +1,189 @@
+// Copyright (c) 2025-2026 zkLicensing project developers
+// SPDX-License-Identifier: BUSL-1.1
+/**
+ * licenseLeaf.ts
+ *
+ * On-chain leaf value stored at every occupied `licensesRoot` slot. Bundles
+ * the license expiry with the device-binding state (cap, slot commitments,
+ * fill counter) so a single tree lookup returns everything a verifier or a
+ * `/prove/bind` call needs.
+ *
+ * Wire shape (in order of hash preimage):
+ *   licenseHash          Field       the tree key, also carried in the leaf
+ *                                    so a stolen witness can't be re-pointed
+ *                                    at another entry. Doubles as the owner-
+ *                                    pubkey commitment — buyLicense asserts
+ *                                    licenseHash == Poseidon(pk.x, pk.isOdd)
+ *                                    so bind/unbind's ownership check reads
+ *                                    the same field as the tree key. Storing
+ *                                    them separately would be pure redundancy.
+ *   expirySlot           UInt32→Field UInt32 packed into a Field
+ *   cap                  UInt32→Field 0 disables /prove/bind; ≤DEVICE_SLOT_CAP
+ *                                    (kept as UInt32 in-circuit because o1js's
+ *                                    provable types don't include UInt8)
+ *   deviceSlotsRoot      Field       Poseidon fold over the 10 slot fields
+ *                                    below (2 fields × DEVICE_SLOT_CAP)
+ *   deviceSlotsFilled    UInt32→Field how many of the DEVICE_SLOT_CAP slots
+ *                                    are currently non-empty — carried
+ *                                    alongside the fold so `bind()` can do
+ *                                    a cheap "cap - filled > 0" check
+ *                                    without re-summing the array
+ *
+ * DEVICE_SLOT_CAP is fixed at 5 so the slot arrays have a size known to the
+ * circuit at compile time. `cap` in the leaf may be smaller — it's a
+ * per-license limit; slots [cap..DEVICE_SLOT_CAP) must always stay empty
+ * (Field(0)) and `bind()` rejects any write to them. `cap = 0` disables
+ * binding entirely; `bind()` rejects immediately without ever touching a
+ * slot.
+ *
+ * Slot encoding (fields carried in the fold, per slot i):
+ *   occupied[i]  Field   0 (empty) or Poseidon(devicePubKeyHash)
+ *   freedAt[i]   Field   packed (boundAtSlot << 32) | freedAtSlot; both
+ *                        are UInt32-range Mina slot numbers. On a fresh
+ *                        empty slot both halves are 0. On bind, boundAt
+ *                        gets the current slot and freedAt stays 0. On
+ *                        unbind, freedAt gets the current slot (boundAt
+ *                        is preserved for audit / cooldown math).
+ *
+ * The struct + helpers live in the SDK (not the circuit package) so both
+ * the on-chain `@method` bodies AND the off-chain keeper / verifier /
+ * dashboards can share a single source of truth for the leaf hash. The
+ * circuit re-exports them from `LicensingApp.ts` so existing consumers
+ * that import from there keep working.
+ */
+import { Field, Poseidon, Provable, Struct, UInt32 } from 'o1js';
+// Fixed slot-array width. Per the device-binding-noncustodial plan: 5 is
+// the sweet spot between "enough seats for a normal user" and "witnesses
+// stay small." Changing this is a hardfork migration (would flip every
+// leaf hash) — not a runtime tunable.
+export const DEVICE_SLOT_CAP_N = 5;
+export const DEVICE_SLOT_CAP = UInt32.from(DEVICE_SLOT_CAP_N);
+// Poseidon-fold of DEVICE_SLOT_CAP × 2 = 10 zero Fields, used as the
+// initial deviceSlotsRoot on every freshly-minted leaf. Precomputed once
+// at module load so `freshLeaf()` doesn't reconstruct it per-call.
+export const EMPTY_DEVICE_SLOTS_ROOT = Poseidon.hash(Array.from({ length: DEVICE_SLOT_CAP_N * 2 }, () => Field(0)));
+// Poseidon-bound identity of the passphrase-derived ownership pubkey.
+// The full PublicKey is (x: Field, isOdd: Bool); Poseidon(x, isOdd.toField())
+// gives a single Field commitment. The buy circuit asserts this equals
+// `licenseHash`, so the leaf carries no separate owner-pubkey field —
+// `licenseHash` IS the on-chain owner-pubkey commitment.
+export function ownerPubKeyHash(pub) {
+    return Poseidon.hash([pub.x, pub.isOdd.toField()]);
+}
+// Pack (boundAtSlot, freedAtSlot) into a single Field. Both are Mina
+// slot numbers (UInt32-range, ≤ 2^32-1), so the concatenation fits in 64
+// bits. Layout mirrors packPrices in LicensingApp.ts — low bits first so
+// the more frequently-read half (freedAt, checked by every bind cooldown)
+// unpacks with a single mask.
+const SHIFT_32 = Field(1n << 32n);
+export function packSlotTimes(boundAtSlot, freedAtSlot) {
+    return freedAtSlot.value.add(boundAtSlot.value.mul(SHIFT_32));
+}
+export function unpackSlotTimes(packed) {
+    // toBits(64) enforces the high 190 bits are zero — belt-and-suspenders
+    // since we only ever write via packSlotTimes, but keeps the circuit
+    // sound against an adversarially-crafted slot in a future upgrade.
+    const bits = packed.toBits(64);
+    const freedAtSlot = UInt32.Unsafe.fromField(Field.fromBits(bits.slice(0, 32)));
+    const boundAtSlot = UInt32.Unsafe.fromField(Field.fromBits(bits.slice(32, 64)));
+    return { boundAtSlot, freedAtSlot };
+}
+// Fold the parallel slot arrays into `deviceSlotsRoot`. Same order every
+// time — occupied[0], freedAt[0], occupied[1], freedAt[1], ... — so a
+// buyer that reconstructs the fold off-chain (verifier, dashboard) gets
+// the same commitment the circuit computed.
+export function computeDeviceSlotsRoot(occupied, freedAt) {
+    if (occupied.length !== DEVICE_SLOT_CAP_N || freedAt.length !== DEVICE_SLOT_CAP_N) {
+        throw new Error(`computeDeviceSlotsRoot expects exactly ${DEVICE_SLOT_CAP_N} entries in each array ` +
+            `(got occupied=${occupied.length}, freedAt=${freedAt.length})`);
+    }
+    const fields = [];
+    for (let i = 0; i < DEVICE_SLOT_CAP_N; i++) {
+        fields.push(occupied[i], freedAt[i]);
+    }
+    return Poseidon.hash(fields);
+}
+// Per-slot payload. The Struct wrapper is what lets o1js serialize this
+// inside larger provable structures — it also gives us a fixed
+// two-Field width so DeviceSlots.slots can be a `Provable.Array` of a
+// well-known type instead of a bag of loose Fields.
+//
+// Same `const X: any = Struct(...)` pattern as contractInterface.ts —
+// annotating as `any` sidesteps TS2742 (o1js sits outside the package
+// rootDir under npm hoisting, so tsc can't emit portable declarations
+// for the inferred Struct class). Instance methods and `static empty()`
+// therefore live as standalone helpers below rather than on the class.
+export const DeviceSlot = Struct({
+    occupied: Field, // 0 or Poseidon(devicePubKeyHash)
+    freedAt: Field, // packSlotTimes(boundAtSlot, freedAtSlot)
+});
+export function emptyDeviceSlot() {
+    return new DeviceSlot({ occupied: Field(0), freedAt: Field(0) });
+}
+// Fixed-width slot array. `Provable.Array(DeviceSlot, N)` promises the
+// circuit an exact length so witnesses can address slots by static index.
+export const DeviceSlots = Struct({
+    slots: Provable.Array(DeviceSlot, DEVICE_SLOT_CAP_N),
+});
+export function emptyDeviceSlots() {
+    return new DeviceSlots({
+        slots: Array.from({ length: DEVICE_SLOT_CAP_N }, () => emptyDeviceSlot()),
+    });
+}
+// In-circuit fold — takes a DeviceSlots value so it composes cleanly
+// inside `@method` bodies. The array length is fixed by the Struct's
+// Provable.Array declaration, so no runtime length guard is needed.
+export function deviceSlotsHash(ds) {
+    const fields = [];
+    for (const s of ds.slots) {
+        fields.push(s.occupied, s.freedAt);
+    }
+    return Poseidon.hash(fields);
+}
+// The leaf value itself. `LicensingApp.buyLicense` builds one of these
+// with EMPTY_DEVICE_SLOTS_ROOT and writes leafHash(leaf) into licensesRoot;
+// subsequent mutations (renew, refund, migrate, bind, unbind) each build
+// a new leaf with the appropriate field(s) updated and write its hash.
+export const LicenseLeaf = Struct({
+    licenseHash: Field,
+    expirySlot: UInt32,
+    cap: UInt32,
+    deviceSlotsRoot: Field,
+    deviceSlotsFilled: UInt32,
+});
+export function leafHash(leaf) {
+    return Poseidon.hash([
+        leaf.licenseHash,
+        leaf.expirySlot.value,
+        leaf.cap.value,
+        leaf.deviceSlotsRoot,
+        leaf.deviceSlotsFilled.value,
+    ]);
+}
+// Construct the leaf a fresh buy writes into the tree — no devices bound
+// yet, filled counter at zero, slot-fold at the precomputed empty root.
+export function freshLeaf(licenseHash, expirySlot, cap) {
+    return new LicenseLeaf({
+        licenseHash,
+        expirySlot,
+        cap,
+        deviceSlotsRoot: EMPTY_DEVICE_SLOTS_ROOT,
+        deviceSlotsFilled: UInt32.zero,
+    });
+}
+// Reconstruct the leaf that lives at `record.licenseHash` in the licensesRoot
+// MerkleMap. `LicenseRecord` optionally persists the device-binding fields;
+// anything missing falls back to the fresh-leaf defaults, matching the state
+// a just-issued license was minted with.
+export function leafFromRecord(record) {
+    return new LicenseLeaf({
+        licenseHash: Field(record.licenseHash),
+        expirySlot: UInt32.from(record.expirySlot),
+        cap: UInt32.from(record.deviceCap ?? 0),
+        deviceSlotsRoot: record.deviceSlotsRoot !== undefined
+            ? Field(record.deviceSlotsRoot)
+            : EMPTY_DEVICE_SLOTS_ROOT,
+        deviceSlotsFilled: UInt32.from(record.deviceSlotsFilled ?? 0),
+    });
+}
+//# sourceMappingURL=licenseLeaf.js.map

package/build/licenseLeaf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"licenseLeaf.js","sourceRoot":"","sources":["../src/licenseLeaf.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,oCAAoC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAa,MAAM,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAG5E,yEAAyE;AACzE,yEAAyE;AACzE,uEAAuE;AACvE,sCAAsC;AACtC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AACnC,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;AAE9D,qEAAqE;AACrE,yEAAyE;AACzE,mEAAmE;AACnE,MAAM,CAAC,MAAM,uBAAuB,GAAU,QAAQ,CAAC,IAAI,CACzD,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,iBAAiB,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAC9D,CAAC;AAEF,sEAAsE;AACtE,8EAA8E;AAC9E,uEAAuE;AACvE,sEAAsE;AACtE,yDAAyD;AACzD,MAAM,UAAU,eAAe,CAAC,GAAc;IAC5C,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,qEAAqE;AACrE,yEAAyE;AACzE,yEAAyE;AACzE,0EAA0E;AAC1E,8BAA8B;AAC9B,MAAM,QAAQ,GAAG,KAAK,CAAC,EAAE,IAAI,GAAG,CAAC,CAAC;AAElC,MAAM,UAAU,aAAa,CAAC,WAAmB,EAAE,WAAmB;IACpE,OAAO,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAa;IAC3C,uEAAuE;IACvE,oEAAoE;IACpE,mEAAmE;IACnE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAChF,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAChF,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC;AACtC,CAAC;AAED,yEAAyE;AACzE,sEAAsE;AACtE,wEAAwE;AACxE,4CAA4C;AAC5C,MAAM,UAAU,sBAAsB,CACpC,QAAiB,EACjB,OAAiB;IAEjB,IAAI,QAAQ,CAAC,MAAM,KAAK,iBAAiB,IAAI,OAAO,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CACb,0CAA0C,iBAAiB,yBAAyB;YACpF,iBAAiB,QAAQ,CAAC,MAAM,aAAa,OAAO,CAAC,MAAM,GAAG,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,iBAAiB,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,wEAAwE;AACxE,+DAA+D;AAC/D,sEAAsE;AACtE,oDAAoD;AACpD,EAAE;AACF,sEAAsE;AACtE,sEAAsE;AACtE,sEAAsE;AACtE,wEAAwE;AACxE,uEAAuE;AACvE,MAAM,CAAC,MAAM,UAAU,GAAQ,MAAM,CAAC;IACpC,QAAQ,EAAE,KAAK,EAAI,kCAAkC;IACrD,OAAO,EAAG,KAAK,EAAI,0CAA0C;CAC9D,CAAC,CAAC;AAGH,MAAM,UAAU,eAAe;IAC7B,OAAO,IAAI,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,uEAAuE;AACvE,0EAA0E;AAC1E,MAAM,CAAC,MAAM,WAAW,GAAQ,MAAM,CAAC;IACrC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,EAAE,iBAAiB,CAAC;CACrD,CAAC,CAAC;AAGH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,IAAI,WAAW,CAAC;QACrB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE,CAAC;KAC1E,CAAC,CAAC;AACL,CAAC;AAED,qEAAqE;AACrE,qEAAqE;AACrE,oEAAoE;AACpE,MAAM,UAAU,eAAe,CAAC,EAAe;IAC7C,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,uEAAuE;AACvE,4EAA4E;AAC5E,yEAAyE;AACzE,uEAAuE;AACvE,MAAM,CAAC,MAAM,WAAW,GAAQ,MAAM,CAAC;IACrC,WAAW,EAAQ,KAAK;IACxB,UAAU,EAAS,MAAM;IACzB,GAAG,EAAgB,MAAM;IACzB,eAAe,EAAI,KAAK;IACxB,iBAAiB,EAAE,MAAM;CAC1B,CAAC,CAAC;AAGH,MAAM,UAAU,QAAQ,CAAC,IAAiB;IACxC,OAAO,QAAQ,CAAC,IAAI,CAAC;QACnB,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,UAAU,CAAC,KAAK;QACrB,IAAI,CAAC,GAAG,CAAC,KAAK;QACd,IAAI,CAAC,eAAe;QACpB,IAAI,CAAC,iBAAiB,CAAC,KAAK;KAC7B,CAAC,CAAC;AACL,CAAC;AAED,yEAAyE;AACzE,wEAAwE;AACxE,MAAM,UAAU,SAAS,CACvB,WAAkB,EAClB,UAAmB,EACnB,GAAmB;IAEnB,OAAO,IAAI,WAAW,CAAC;QACrB,WAAW;QACX,UAAU;QACV,GAAG;QACH,eAAe,EAAI,uBAAuB;QAC1C,iBAAiB,EAAE,MAAM,CAAC,IAAI;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,yCAAyC;AACzC,MAAM,UAAU,cAAc,CAAC,MAAqB;IAClD,OAAO,IAAI,WAAW,CAAC;QACrB,WAAW,EAAQ,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC;QAC5C,UAAU,EAAS,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QACjD,GAAG,EAAgB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,CAAC,CAAC;QACrD,eAAe,EAAI,MAAM,CAAC,eAAe,KAAK,SAAS;YACrD,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC;YAC/B,CAAC,CAAC,uBAAuB;QAC3B,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,CAAC,CAAC;KAC9D,CAAC,CAAC;AACL,CAAC"}

package/build/licenseRecord.d.ts

@@ -7,6 +7,12 @@
  * the same type without dragging in filesystem code. licenseStore.ts
  * re-exports these to keep existing Node imports working.
  */
+export type FiatRateSnapshot = {
+    minaEurRate: number;
+    minaUsdRate: number;
+    minaGbpRate: number;
+    recordedAt: string;
+};
 export type LicenseRecord = {
     zkAppAddress: string;
     licenseHash: string;
@@ -15,22 +21,35 @@ export type LicenseRecord = {
     purchaseAmount: string;
     txHash: string;
     createdAt: string;
+    deviceCap?: number;
+    deviceSlotsRoot?: string;
+    deviceSlotsFilled?: number;
+    devices?: Array<{
+        slotIndex: number;
+        deviceCommitment: string;
+        boundAtSlot: number;
+        freedAtSlot: number;
+    }>;
     buyerAddress?: string;
     buyerCountry?: string;
+    buyerZip?: string;
     pending?: boolean;
     provedAtSlot?: number;
     initialExpirySlot?: number;
-    tier?: 'monthly' | 'yearly' | 'fiveYear';
+    tier?: 'monthly' | 'yearly' | 'fiveYear' | 'perpetual';
     renewedAtLeastOnce?: boolean;
     refunded?: boolean;
     released?: boolean;
     releaseSlot?: number;
+    releaseTxHash?: string;
     renewals?: Array<{
         slot: number;
         amount: string;
         newExpiry: number;
         txHash?: string;
+        fiatSnapshot?: FiatRateSnapshot;
     }>;
+    fiatSnapshot?: FiatRateSnapshot;
     refundWaiverAcceptedAt?: string;
     escrowless?: boolean;
 };