zklicensing 0.1.0-beta.2 → 0.1.0-beta.4

package/build/onChainRoot.js

@@ -0,0 +1,87 @@
+// Copyright (c) 2025-2026 zkLicensing project developers
+// SPDX-License-Identifier: BUSL-1.1
+/**
+ * onChainRoot.ts
+ *
+ * Non-custodial trust anchor for `verifyOffline`. Reads the live
+ * `licensesRoot` (`zkapp.appState[0]`) directly from Mina — no
+ * licensing-service round-trip, no trust assumption about whoever
+ * served the witness / license record.
+ *
+ * Pair it with `verifyOffline` to close the trust loop:
+ *
+ *   ```ts
+ *   import { fetchOnChainLicensesRoot } from 'zklicensing/on-chain-root';
+ *   import { verifyOffline }            from 'zklicensing/verify-offline';
+ *
+ *   // 1. Ask the licensing service for a witness + slot snapshot.
+ *   const snap = await fetch(`${service}/witness?licenseHash=${h}&zkAppAddress=${a}`).then(r => r.json());
+ *
+ *   // 2. Fetch the on-chain root INDEPENDENTLY, from Mina.
+ *   const onChainRoot = await fetchOnChainLicensesRoot({ zkAppAddress: a, network: 'devnet' });
+ *
+ *   // 3. Cross-check — if they disagree, the service is stale/wrong; bail.
+ *   if (snap.root !== onChainRoot) throw new Error('service root disagrees with chain');
+ *
+ *   // 4. Fold-verify the snapshot against the on-chain root.
+ *   const res = verifyOffline({ licensesRoot: onChainRoot, ...snap });
+ *   ```
+ *
+ * o1js is a peer dep — this file imports it dynamically so callers
+ * that only want `verifyOffline` (pure fold, no chain read) don't
+ * have to install o1js.
+ *
+ * Global-state caveat: o1js `Mina.setActiveInstance` mutates a module-
+ * scoped singleton. Long-lived hosts that talk to multiple Mina
+ * networks in the same process should treat this helper as a
+ * one-shot and re-set their own preferred network after use, or wrap
+ * it in a mutex.
+ */
+// GraphQL endpoints published by Minascan. These are read-only public
+// nodes — no auth, no rate-limit key. Vendors who prefer their own
+// Mina node can override via `graphqlUrl` on the input.
+export const DEFAULT_MINA_GRAPHQL_URLS = {
+    mainnet: 'https://api.minascan.io/node/mainnet/v1/graphql',
+    devnet: 'https://api.minascan.io/node/devnet/v1/graphql',
+};
+/**
+ * Read the live `licensesRoot` from the deployed LicensingApp's
+ * on-chain state. Returns the field value as a decimal string,
+ * matching the shape `verifyOffline` and the licensing service both
+ * consume.
+ *
+ * Throws on any of:
+ *   - `o1js` not installed (peer dep missing);
+ *   - `fetchAccount` returned an error (network down, wrong endpoint,
+ *     account doesn't exist on this chain);
+ *   - account exists but has no zkApp state (not a zkApp address, or
+ *     contract deployed but `initialize()` never ran).
+ */
+export async function fetchOnChainLicensesRoot(input) {
+    const { zkAppAddress } = input;
+    const network = input.network ?? 'devnet';
+    const graphqlUrl = input.graphqlUrl ?? DEFAULT_MINA_GRAPHQL_URLS[network];
+    let o1js;
+    try {
+        o1js = await import('o1js');
+    }
+    catch (err) {
+        throw new Error(`zklicensing/on-chain-root: o1js not installed — install it as a peer dep (${err?.message ?? err})`);
+    }
+    // o1js's networkId for devnet is 'testnet'; only mainnet uses 'mainnet'.
+    const networkId = network === 'mainnet' ? 'mainnet' : 'testnet';
+    const mina = o1js.Mina.Network({ networkId, mina: graphqlUrl });
+    o1js.Mina.setActiveInstance(mina);
+    const publicKey = o1js.PublicKey.fromBase58(zkAppAddress);
+    const { account, error } = await o1js.fetchAccount({ publicKey });
+    if (error) {
+        const detail = error.statusText ?? error.statusCode ?? JSON.stringify(error);
+        throw new Error(`fetchAccount(${zkAppAddress}) via ${graphqlUrl} failed: ${detail}`);
+    }
+    const root = account?.zkapp?.appState?.[0]?.toString?.();
+    if (!root) {
+        throw new Error(`zkApp ${zkAppAddress} has no appState — is the LicensingApp deployed and initialized on ${network}?`);
+    }
+    return root;
+}
+//# sourceMappingURL=onChainRoot.js.map

package/build/onChainRoot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"onChainRoot.js","sourceRoot":"","sources":["../src/onChainRoot.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,oCAAoC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,sEAAsE;AACtE,mEAAmE;AACnE,wDAAwD;AACxD,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,OAAO,EAAE,iDAAiD;IAC1D,MAAM,EAAG,gDAAgD;CACjD,CAAC;AAYX;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAoC;IAEpC,MAAM,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IAC/B,MAAM,OAAO,GAAgB,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC;IACvD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAE1E,IAAI,IAAS,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CACb,6EAA6E,GAAG,EAAE,OAAO,IAAI,GAAG,GAAG,CACpG,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,MAAM,SAAS,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAElC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;IAClE,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,gBAAgB,YAAY,SAAS,UAAU,YAAY,MAAM,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC;IACzD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,SAAS,YAAY,sEAAsE,OAAO,GAAG,CACtG,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/build/ownershipLicenseHash.d.ts

@@ -0,0 +1,25 @@
+/**
+ * ownershipLicenseHash.ts
+ *
+ * Field-side binding between the buyer's Pallas Schnorr pubkey and the
+ * `licenseHash` Field stored on-chain. The buy circuit and the buy client
+ * both compute this from the pubkey and assert equality — that mutual
+ * assertion is what proves knowledge of the passphrase without ever
+ * showing the passphrase to the network.
+ *
+ * A Pallas `PublicKey` is `(x: Field, isOdd: Bool)` — the two Fields that
+ * uniquely identify the compressed point. Poseidon-hashing them yields a
+ * single Field that matches the on-chain shape of every other `licenseHash`
+ * used by LicensingApp (which treats licenseHash as an opaque Field
+ * commitment, not a specific preimage).
+ */
+import { PublicKey } from 'o1js';
+/**
+ * Derive the Field-side `licenseHash` from a Pallas Schnorr pubkey. The
+ * hash is domain-free because the whole platform treats `licenseHash` as
+ * an opaque commitment — the on-chain contract never re-derives it from
+ * a preimage, so there's no cross-preimage collision surface to guard
+ * against here.
+ */
+export declare function licenseHashFromPubkey(publicKey: PublicKey): string;
+//# sourceMappingURL=ownershipLicenseHash.d.ts.map

package/build/ownershipLicenseHash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownershipLicenseHash.d.ts","sourceRoot":"","sources":["../src/ownershipLicenseHash.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAY,SAAS,EAAE,MAAM,MAAM,CAAC;AAE3C;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,SAAS,GAAG,MAAM,CAElE"}

package/build/ownershipLicenseHash.js

@@ -0,0 +1,29 @@
+// Copyright (c) 2025-2026 zkLicensing project developers
+// SPDX-License-Identifier: BUSL-1.1
+/**
+ * ownershipLicenseHash.ts
+ *
+ * Field-side binding between the buyer's Pallas Schnorr pubkey and the
+ * `licenseHash` Field stored on-chain. The buy circuit and the buy client
+ * both compute this from the pubkey and assert equality — that mutual
+ * assertion is what proves knowledge of the passphrase without ever
+ * showing the passphrase to the network.
+ *
+ * A Pallas `PublicKey` is `(x: Field, isOdd: Bool)` — the two Fields that
+ * uniquely identify the compressed point. Poseidon-hashing them yields a
+ * single Field that matches the on-chain shape of every other `licenseHash`
+ * used by LicensingApp (which treats licenseHash as an opaque Field
+ * commitment, not a specific preimage).
+ */
+import { Poseidon } from 'o1js';
+/**
+ * Derive the Field-side `licenseHash` from a Pallas Schnorr pubkey. The
+ * hash is domain-free because the whole platform treats `licenseHash` as
+ * an opaque commitment — the on-chain contract never re-derives it from
+ * a preimage, so there's no cross-preimage collision surface to guard
+ * against here.
+ */
+export function licenseHashFromPubkey(publicKey) {
+    return Poseidon.hash([publicKey.x, publicKey.isOdd.toField()]).toString();
+}
+//# sourceMappingURL=ownershipLicenseHash.js.map

package/build/ownershipLicenseHash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownershipLicenseHash.js","sourceRoot":"","sources":["../src/ownershipLicenseHash.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,oCAAoC;AAEpC;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,QAAQ,EAAa,MAAM,MAAM,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAAoB;IACxD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AAC5E,CAAC"}

package/build/ownershipSignature.d.ts

@@ -0,0 +1,122 @@
+/**
+ * ownershipSignature.ts
+ *
+ * Schnorr-over-Pallas signing primitive for the two on-chain flows that
+ * need the passphrase-derived owner key:
+ *
+ *  1. The /prove/bind and /prove/unbind flows — the passphrase-derived
+ *     keypair authorizes device slot mutations, and the signature is
+ *     re-verified INSIDE the circuit by `Signature.verify()` so even a
+ *     compromised licensing service cannot forge a bind.
+ *  2. The retained `ActivationMessage` shape (see below) — kept so external
+ *     tooling can still sign an "I hold the passphrase for this license"
+ *     assertion off-band. The platform no longer runs a challenge/respond
+ *     endpoint; the shape is purely an SDK primitive now.
+ *
+ * Deterministic HKDF-SHA256 derivation of a seed from the passphrase,
+ * reduced to a Pallas scalar → o1js `PrivateKey`. The buyer can
+ * re-derive the same keypair anywhere from just the passphrase.
+ *
+ * o1js-dependent by design: the whole point of switching from Ed25519 to
+ * Pallas Schnorr is native in-circuit verification. Any client that
+ * signs an activation or binding challenge already ships o1js for the
+ * downstream buy/verify surface, so the "keep this module o1js-free"
+ * constraint that motivated the Ed25519 version no longer applies.
+ *
+ * HKDF still needs WebCrypto (Node ≥ 20, Chromium 137+, Safari 17+,
+ * Firefox 130+). The module throws at derive time if
+ * `globalThis.crypto.subtle` is unavailable — callers cannot silently
+ * fall back to a weaker path.
+ */
+import { Field, PrivateKey, PublicKey, Signature } from 'o1js';
+export declare const TAG_ACTIVATION = 1n;
+export declare const TAG_BINDING = 2n;
+export declare const TAG_UNBINDING = 3n;
+/**
+ * HKDF-SHA256 with empty salt and a per-app domain-separation info
+ * string (`zkLicensing/v1/ownership|<zkAppAddress>`). Deterministic:
+ * same (passphrase, zkAppAddress) → same 32-byte seed. Different
+ * zkAppAddress → cryptographically unrelated seed even with the same
+ * passphrase.
+ */
+export declare function deriveSeed(passphrase: string, zkAppAddress: string): Promise<Uint8Array>;
+export type OwnershipKeypair = {
+    privateKey: PrivateKey;
+    publicKey: PublicKey;
+    publicKeyBase58: string;
+};
+/**
+ * Derive a Pallas Schnorr keypair deterministically from (passphrase,
+ * zkAppAddress). The keypair is bound to the specific app: the same
+ * passphrase used against a different app yields a different keypair,
+ * so a leaked passphrase cannot be replayed as an activation for any
+ * other app.
+ *
+ * The 32-byte HKDF output is interpreted as a big-endian integer and
+ * passed to `PrivateKey.fromBigInt`, which reduces it modulo the Pallas
+ * scalar field order internally. All 2^256 possible HKDF outputs map to
+ * valid private keys with (256 - log2(Fq_order))-bit modular bias — the
+ * scalar field is ~254 bits, so bias is <2^-253 and lies well below any
+ * practical distinguisher.
+ */
+export declare function deriveOwnershipKeypair(passphrase: string, zkAppAddress: string): Promise<OwnershipKeypair>;
+/**
+ * Activation assertion shape. Proves the caller holds the passphrase
+ * that derived the license's ownerPubKey. Retained as an SDK primitive
+ * so external tooling can still request / verify an off-band "I own
+ * this license" signature — the on-chain flows themselves do not use
+ * it.
+ */
+export type ActivationMessage = {
+    licenseHash: string;
+    nonce: string;
+    zkAppAddress: string;
+};
+/**
+ * Binding / unbinding message — the /prove/bind and /prove/unbind
+ * flows. Authorizes a specific device commitment being placed into or
+ * cleared from a specific slot on a specific license.
+ */
+export type BindingMessage = {
+    licenseHash: string;
+    deviceCommitment: string;
+    slotIndex: number;
+    nonce: string;
+};
+export type ChallengeMessage = ActivationMessage;
+/**
+ * Canonicalize the activation message into the Field[] that
+ * `Signature.create` / `Signature.verify` hash. The domain-separation
+ * tag prefix means no captured activation signature can be replayed as
+ * a binding signature, even if all other fields collide.
+ */
+export declare function activationMessageFields(msg: ActivationMessage): Field[];
+export declare function bindingMessageFields(msg: BindingMessage): Field[];
+export declare function unbindingMessageFields(msg: BindingMessage): Field[];
+export declare function signActivation(privateKey: PrivateKey, msg: ActivationMessage): Signature;
+export declare function signBinding(privateKey: PrivateKey, msg: BindingMessage): Signature;
+export declare function signUnbinding(privateKey: PrivateKey, msg: BindingMessage): Signature;
+export declare function signChallenge(privateKey: PrivateKey, msg: ChallengeMessage): Signature;
+/**
+ * Verify an activation signature. Returns false (never throws) for any
+ * failure — malformed pubkey, malformed signature, actual signature
+ * mismatch. Callers get a single go/no-go decision without having to
+ * distinguish "invalid" from "unparseable."
+ */
+export declare function verifyActivation(publicKey: PublicKey, msg: ActivationMessage, signature: Signature): boolean;
+export declare function verifyBinding(publicKey: PublicKey, msg: BindingMessage, signature: Signature): boolean;
+export declare function verifyUnbinding(publicKey: PublicKey, msg: BindingMessage, signature: Signature): boolean;
+export declare function verifyChallenge(publicKey: PublicKey, msg: ChallengeMessage, signature: Signature): boolean;
+/**
+ * Encode a signature for the wire (POST body, ProofFile JSON, etc).
+ * Base58 matches Mina's canonical serialization for both PublicKey and
+ * Signature, keeping the same encoding shape across everything the
+ * buyer's SDK produces.
+ */
+export declare function encodeSignature(sig: Signature): string;
+export declare function decodeSignature(base58: string): Signature;
+export declare function encodePublicKey(pk: PublicKey): string;
+export declare function decodePublicKey(base58: string): PublicKey;
+export declare function encodeBase64(bytes: Uint8Array): string;
+export declare function decodeBase64(b64: string): Uint8Array;
+//# sourceMappingURL=ownershipSignature.d.ts.map

package/build/ownershipSignature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownershipSignature.d.ts","sourceRoot":"","sources":["../src/ownershipSignature.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAyB/D,eAAO,MAAM,cAAc,KAAK,CAAC;AACjC,eAAO,MAAM,WAAW,KAAQ,CAAC;AACjC,eAAO,MAAM,aAAa,KAAM,CAAC;AAuCjC;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,UAAU,EAAI,MAAM,EACpB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,UAAU,CAAC,CAoBrB;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,UAAU,EAAO,UAAU,CAAC;IAC5B,SAAS,EAAQ,SAAS,CAAC;IAC3B,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,wBAAsB,sBAAsB,CAC1C,UAAU,EAAI,MAAM,EACpB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,gBAAgB,CAAC,CAK3B;AAID;;;;;;GAMG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAC9B,WAAW,EAAG,MAAM,CAAC;IACrB,KAAK,EAAS,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,WAAW,EAAO,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,EAAS,MAAM,CAAC;IACzB,KAAK,EAAa,MAAM,CAAC;CAC1B,CAAC;AAKF,MAAM,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AAEjD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,iBAAiB,GAAG,KAAK,EAAE,CASvE;AAkBD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,cAAc,GAAG,KAAK,EAAE,CAEjE;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,cAAc,GAAG,KAAK,EAAE,CAEnE;AAID,wBAAgB,cAAc,CAC5B,UAAU,EAAE,UAAU,EACtB,GAAG,EAAE,iBAAiB,GACrB,SAAS,CAEX;AAED,wBAAgB,WAAW,CACzB,UAAU,EAAE,UAAU,EACtB,GAAG,EAAE,cAAc,GAClB,SAAS,CAEX;AAED,wBAAgB,aAAa,CAC3B,UAAU,EAAE,UAAU,EACtB,GAAG,EAAE,cAAc,GAClB,SAAS,CAEX;AAID,wBAAgB,aAAa,CAC3B,UAAU,EAAE,UAAU,EACtB,GAAG,EAAE,gBAAgB,GACpB,SAAS,CAEX;AAID;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,iBAAiB,EACtB,SAAS,EAAE,SAAS,GACnB,OAAO,CAMT;AAED,wBAAgB,aAAa,CAC3B,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,cAAc,EACnB,SAAS,EAAE,SAAS,GACnB,OAAO,CAMT;AAED,wBAAgB,eAAe,CAC7B,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,cAAc,EACnB,SAAS,EAAE,SAAS,GACnB,OAAO,CAMT;AAGD,wBAAgB,eAAe,CAC7B,SAAS,EAAE,SAAS,EACpB,GAAG,EAAE,gBAAgB,EACrB,SAAS,EAAE,SAAS,GACnB,OAAO,CAET;AAID;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAEtD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAEzD;AAED,wBAAgB,eAAe,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,CAErD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAEzD;AAKD,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAEtD;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAEpD"}

package/build/ownershipSignature.js

@@ -0,0 +1,244 @@
+// Copyright (c) 2025-2026 zkLicensing project developers
+// SPDX-License-Identifier: BUSL-1.1
+/**
+ * ownershipSignature.ts
+ *
+ * Schnorr-over-Pallas signing primitive for the two on-chain flows that
+ * need the passphrase-derived owner key:
+ *
+ *  1. The /prove/bind and /prove/unbind flows — the passphrase-derived
+ *     keypair authorizes device slot mutations, and the signature is
+ *     re-verified INSIDE the circuit by `Signature.verify()` so even a
+ *     compromised licensing service cannot forge a bind.
+ *  2. The retained `ActivationMessage` shape (see below) — kept so external
+ *     tooling can still sign an "I hold the passphrase for this license"
+ *     assertion off-band. The platform no longer runs a challenge/respond
+ *     endpoint; the shape is purely an SDK primitive now.
+ *
+ * Deterministic HKDF-SHA256 derivation of a seed from the passphrase,
+ * reduced to a Pallas scalar → o1js `PrivateKey`. The buyer can
+ * re-derive the same keypair anywhere from just the passphrase.
+ *
+ * o1js-dependent by design: the whole point of switching from Ed25519 to
+ * Pallas Schnorr is native in-circuit verification. Any client that
+ * signs an activation or binding challenge already ships o1js for the
+ * downstream buy/verify surface, so the "keep this module o1js-free"
+ * constraint that motivated the Ed25519 version no longer applies.
+ *
+ * HKDF still needs WebCrypto (Node ≥ 20, Chromium 137+, Safari 17+,
+ * Firefox 130+). The module throws at derive time if
+ * `globalThis.crypto.subtle` is unavailable — callers cannot silently
+ * fall back to a weaker path.
+ */
+import { Field, PrivateKey, PublicKey, Signature } from 'o1js';
+// HKDF info binds the derivation to a specific zkApp address, so the
+// same passphrase yields different keypairs for different apps. This
+// makes credentials per-app: a leaked passphrase for app A cannot be
+// replayed as an activation for app B. RFC 5869 designates `info` as
+// the domain-separation channel (salt is for randomness, which we don't
+// have here — the passphrase IS the secret input).
+//
+// The `v1` prefix reserves room to rotate the KDF or the target key type
+// later without a silent collision — a future scheme bumps to `v2` and
+// derives an unrelated key from the same passphrase.
+const HKDF_INFO_PREFIX = 'zkLicensing/v1/ownership|';
+const HKDF_SALT = new Uint8Array(0);
+// Domain-separation tags baked into every signed message. Prevents a
+// signature captured on one flow (activation) from being replayed on
+// another (binding) — the first Field the signer hashes is the flow ID,
+// so the two signatures live in disjoint spaces even at identical
+// (licenseHash, nonce).
+//
+// Exported so `LicensingApp.bind()` / `unbind()` can rebuild the exact
+// same Field[] preimage inside the circuit for `Signature.verify()`.
+// Bumping these values is a hardfork — every off-chain signer and every
+// deployed circuit would need to agree.
+export const TAG_ACTIVATION = 1n;
+export const TAG_BINDING = 2n;
+export const TAG_UNBINDING = 3n;
+function buildHkdfInfo(zkAppAddress) {
+    return new TextEncoder().encode(HKDF_INFO_PREFIX + zkAppAddress);
+}
+function utf8Bytes(s) {
+    return new TextEncoder().encode(s);
+}
+function bytesToBase64(bytes) {
+    let s = '';
+    for (const b of bytes)
+        s += String.fromCharCode(b);
+    return btoa(s);
+}
+function base64ToBytes(b64) {
+    const bin = atob(b64);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        out[i] = bin.charCodeAt(i);
+    return out;
+}
+function subtle() {
+    const s = globalThis.crypto?.subtle;
+    if (!s) {
+        throw new Error('WebCrypto unavailable — ownershipSignature requires Node ≥ 20 or a modern browser (Chromium 137+, Safari 17+, Firefox 130+).');
+    }
+    return s;
+}
+function bytesToBigInt(bytes) {
+    let n = 0n;
+    for (const b of bytes)
+        n = (n << 8n) | BigInt(b);
+    return n;
+}
+/**
+ * HKDF-SHA256 with empty salt and a per-app domain-separation info
+ * string (`zkLicensing/v1/ownership|<zkAppAddress>`). Deterministic:
+ * same (passphrase, zkAppAddress) → same 32-byte seed. Different
+ * zkAppAddress → cryptographically unrelated seed even with the same
+ * passphrase.
+ */
+export async function deriveSeed(passphrase, zkAppAddress) {
+    const baseKey = await subtle().importKey('raw', utf8Bytes(passphrase), 'HKDF', false, ['deriveBits']);
+    const info = buildHkdfInfo(zkAppAddress);
+    const bits = await subtle().deriveBits({
+        name: 'HKDF',
+        hash: 'SHA-256',
+        salt: HKDF_SALT,
+        info: info,
+    }, baseKey, 256);
+    return new Uint8Array(bits);
+}
+/**
+ * Derive a Pallas Schnorr keypair deterministically from (passphrase,
+ * zkAppAddress). The keypair is bound to the specific app: the same
+ * passphrase used against a different app yields a different keypair,
+ * so a leaked passphrase cannot be replayed as an activation for any
+ * other app.
+ *
+ * The 32-byte HKDF output is interpreted as a big-endian integer and
+ * passed to `PrivateKey.fromBigInt`, which reduces it modulo the Pallas
+ * scalar field order internally. All 2^256 possible HKDF outputs map to
+ * valid private keys with (256 - log2(Fq_order))-bit modular bias — the
+ * scalar field is ~254 bits, so bias is <2^-253 and lies well below any
+ * practical distinguisher.
+ */
+export async function deriveOwnershipKeypair(passphrase, zkAppAddress) {
+    const seed = await deriveSeed(passphrase, zkAppAddress);
+    const privateKey = PrivateKey.fromBigInt(bytesToBigInt(seed));
+    const publicKey = privateKey.toPublicKey();
+    return { privateKey, publicKey, publicKeyBase58: publicKey.toBase58() };
+}
+/**
+ * Canonicalize the activation message into the Field[] that
+ * `Signature.create` / `Signature.verify` hash. The domain-separation
+ * tag prefix means no captured activation signature can be replayed as
+ * a binding signature, even if all other fields collide.
+ */
+export function activationMessageFields(msg) {
+    const addr = PublicKey.fromBase58(msg.zkAppAddress);
+    return [
+        Field(TAG_ACTIVATION),
+        Field(msg.licenseHash),
+        Field(msg.nonce),
+        addr.x,
+        addr.isOdd.toField(),
+    ];
+}
+/**
+ * Canonicalize a binding or unbinding message. The `tag` argument
+ * distinguishes bind (TAG_BINDING) from unbind (TAG_UNBINDING) so a
+ * bind signature captured off-chain cannot be replayed as an unbind
+ * even at identical (licenseHash, deviceCommitment, slotIndex, nonce).
+ */
+function bindingLikeFields(tag, msg) {
+    return [
+        Field(tag),
+        Field(msg.licenseHash),
+        Field(msg.deviceCommitment),
+        Field(msg.slotIndex),
+        Field(msg.nonce),
+    ];
+}
+export function bindingMessageFields(msg) {
+    return bindingLikeFields(TAG_BINDING, msg);
+}
+export function unbindingMessageFields(msg) {
+    return bindingLikeFields(TAG_UNBINDING, msg);
+}
+// ── Signing ───────────────────────────────────────────────────────
+export function signActivation(privateKey, msg) {
+    return Signature.create(privateKey, activationMessageFields(msg));
+}
+export function signBinding(privateKey, msg) {
+    return Signature.create(privateKey, bindingMessageFields(msg));
+}
+export function signUnbinding(privateKey, msg) {
+    return Signature.create(privateKey, unbindingMessageFields(msg));
+}
+// Retained for back-compat with the Ed25519-era name. New code should
+// call signActivation directly.
+export function signChallenge(privateKey, msg) {
+    return signActivation(privateKey, msg);
+}
+// ── Verification ──────────────────────────────────────────────────
+/**
+ * Verify an activation signature. Returns false (never throws) for any
+ * failure — malformed pubkey, malformed signature, actual signature
+ * mismatch. Callers get a single go/no-go decision without having to
+ * distinguish "invalid" from "unparseable."
+ */
+export function verifyActivation(publicKey, msg, signature) {
+    try {
+        return signature.verify(publicKey, activationMessageFields(msg)).toBoolean();
+    }
+    catch {
+        return false;
+    }
+}
+export function verifyBinding(publicKey, msg, signature) {
+    try {
+        return signature.verify(publicKey, bindingMessageFields(msg)).toBoolean();
+    }
+    catch {
+        return false;
+    }
+}
+export function verifyUnbinding(publicKey, msg, signature) {
+    try {
+        return signature.verify(publicKey, unbindingMessageFields(msg)).toBoolean();
+    }
+    catch {
+        return false;
+    }
+}
+// Back-compat alias, see signChallenge.
+export function verifyChallenge(publicKey, msg, signature) {
+    return verifyActivation(publicKey, msg, signature);
+}
+// ── Wire encoding helpers ─────────────────────────────────────────
+/**
+ * Encode a signature for the wire (POST body, ProofFile JSON, etc).
+ * Base58 matches Mina's canonical serialization for both PublicKey and
+ * Signature, keeping the same encoding shape across everything the
+ * buyer's SDK produces.
+ */
+export function encodeSignature(sig) {
+    return sig.toBase58();
+}
+export function decodeSignature(base58) {
+    return Signature.fromBase58(base58);
+}
+export function encodePublicKey(pk) {
+    return pk.toBase58();
+}
+export function decodePublicKey(base58) {
+    return PublicKey.fromBase58(base58);
+}
+// Retained so callers that already do `encodeBase64(seed)` for logging
+// or persistence keep working — this module no longer produces raw byte
+// pubkeys or signatures, only o1js objects with .toBase58().
+export function encodeBase64(bytes) {
+    return bytesToBase64(bytes);
+}
+export function decodeBase64(b64) {
+    return base64ToBytes(b64);
+}
+//# sourceMappingURL=ownershipSignature.js.map

package/build/ownershipSignature.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownershipSignature.js","sourceRoot":"","sources":["../src/ownershipSignature.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,oCAAoC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAE/D,qEAAqE;AACrE,qEAAqE;AACrE,qEAAqE;AACrE,qEAAqE;AACrE,wEAAwE;AACxE,mDAAmD;AACnD,EAAE;AACF,yEAAyE;AACzE,uEAAuE;AACvE,qDAAqD;AACrD,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AACrD,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;AAEpC,qEAAqE;AACrE,qEAAqE;AACrE,wEAAwE;AACxE,kEAAkE;AAClE,wBAAwB;AACxB,EAAE;AACF,uEAAuE;AACvE,qEAAqE;AACrE,wEAAwE;AACxE,wCAAwC;AACxC,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AACjC,MAAM,CAAC,MAAM,WAAW,GAAM,EAAE,CAAC;AACjC,MAAM,CAAC,MAAM,aAAa,GAAI,EAAE,CAAC;AAEjC,SAAS,aAAa,CAAC,YAAoB;IACzC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gBAAgB,GAAG,YAAY,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB;IACtC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,MAAM;IACb,MAAM,CAAC,GAAI,UAAU,CAAC,MAA6B,EAAE,MAAM,CAAC;IAC5D,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,KAAK,CACb,8HAA8H,CAC/H,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB;IACtC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,UAAoB,EACpB,YAAoB;IAEpB,MAAM,OAAO,GAAG,MAAM,MAAM,EAAE,CAAC,SAAS,CACtC,KAAK,EACL,SAAS,CAAC,UAAU,CAA2B,EAC/C,MAAM,EACN,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC;IACF,MAAM,IAAI,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,MAAM,EAAE,CAAC,UAAU,CACpC;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,SAAmC;QACzC,IAAI,EAAE,IAA8B;KACrC,EACD,OAAO,EACP,GAAG,CACJ,CAAC;IACF,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAQD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,UAAoB,EACpB,YAAoB;IAEpB,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC;IAC3C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC1E,CAAC;AAkCD;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAsB;IAC5D,MAAM,IAAI,GAAG,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACpD,OAAO;QACL,KAAK,CAAC,cAAc,CAAC;QACrB,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC;QACtB,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;QAChB,IAAI,CAAC,CAAC;QACN,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE;KACrB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,GAAW,EAAE,GAAmB;IACzD,OAAO;QACL,KAAK,CAAC,GAAG,CAAC;QACV,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC;QACtB,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC3B,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;QACpB,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;KACjB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAmB;IACtD,OAAO,iBAAiB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAmB;IACxD,OAAO,iBAAiB,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AAC/C,CAAC;AAED,qEAAqE;AAErE,MAAM,UAAU,cAAc,CAC5B,UAAsB,EACtB,GAAsB;IAEtB,OAAO,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,UAAsB,EACtB,GAAmB;IAEnB,OAAO,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,UAAsB,EACtB,GAAmB;IAEnB,OAAO,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,sEAAsE;AACtE,gCAAgC;AAChC,MAAM,UAAU,aAAa,CAC3B,UAAsB,EACtB,GAAqB;IAErB,OAAO,cAAc,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,qEAAqE;AAErE;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAAoB,EACpB,GAAsB,EACtB,SAAoB;IAEpB,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,SAAoB,EACpB,GAAmB,EACnB,SAAoB;IAEpB,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,SAAoB,EACpB,GAAmB,EACnB,SAAoB;IAEpB,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,MAAM,CAAC,SAAS,EAAE,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,wCAAwC;AACxC,MAAM,UAAU,eAAe,CAC7B,SAAoB,EACpB,GAAqB,EACrB,SAAoB;IAEpB,OAAO,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;AACrD,CAAC;AAED,qEAAqE;AAErE;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,GAAc;IAC5C,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,EAAa;IAC3C,OAAO,EAAE,CAAC,QAAQ,EAAE,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED,uEAAuE;AACvE,wEAAwE;AACxE,6DAA6D;AAC7D,MAAM,UAAU,YAAY,CAAC,KAAiB;IAC5C,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,aAAa,CAAC,GAAG,CAAC,CAAC;AAC5B,CAAC"}

package/build/proveErrors.d.ts

@@ -0,0 +1,35 @@
+/**
+ * proveErrors.ts
+ *
+ * Shared typed error for the "proving queue busy" 409 surface returned by
+ * /prove/buy, /prove/buy-no-escrow, /prove/renew, /prove/migrate, and
+ * /prove/refund. The keeper serializes all five endpoints on a per-app
+ * in-flight slot: while a proof is out with a buyer waiting to be signed
+ * (or a signed tx is waiting to land), further requests against the same
+ * app get an immediate 409 with a `retryAfterMs` hint. Callers should catch
+ * this and wait+retry rather than surfacing the failure — the wallet popup
+ * never opens for a proof with no live chance of landing.
+ *
+ * `queueDepth` is 1 in v1 (single slot per app); the field exists so that a
+ * future Tier-1 optimistic-chaining pass can widen it without breaking
+ * clients written today.
+ */
+export declare class ProveQueueBusyError extends Error {
+    readonly status = 409;
+    readonly retryAfterMs: number;
+    readonly queueDepth: number;
+    constructor(message: string, retryAfterMs: number, queueDepth: number);
+}
+export type ProveQueueBusyBody = {
+    error: 'proving queue busy';
+    retryAfterMs: number;
+    queueDepth?: number;
+};
+export type ParsedErrorBody = {
+    status: number;
+    body: Record<string, unknown>;
+    message: string;
+};
+export declare function readErrorBody(resp: Response): Promise<ParsedErrorBody>;
+export declare function tryQueueBusyFromBody(parsed: ParsedErrorBody): ProveQueueBusyError | null;
+//# sourceMappingURL=proveErrors.d.ts.map

package/build/proveErrors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proveErrors.d.ts","sourceRoot":"","sources":["../src/proveErrors.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;GAeG;AAEH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,MAAM,OAAO;IACtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAI,MAAM,CAAC;gBAClB,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM;CAMtE;AAGD,MAAM,MAAM,kBAAkB,GAAG;IAC/B,KAAK,EAAS,oBAAoB,CAAC;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAG,MAAM,CAAC;CACtB,CAAC;AAKF,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAEhC,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,wBAAsB,aAAa,CAAC,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC,eAAe,CAAC,CAO5E;AAID,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,eAAe,GAAG,mBAAmB,GAAG,IAAI,CASxF"}

package/build/proveErrors.js

@@ -0,0 +1,49 @@
+// Copyright (c) 2025-2026 zkLicensing project developers
+// SPDX-License-Identifier: BUSL-1.1
+/**
+ * proveErrors.ts
+ *
+ * Shared typed error for the "proving queue busy" 409 surface returned by
+ * /prove/buy, /prove/buy-no-escrow, /prove/renew, /prove/migrate, and
+ * /prove/refund. The keeper serializes all five endpoints on a per-app
+ * in-flight slot: while a proof is out with a buyer waiting to be signed
+ * (or a signed tx is waiting to land), further requests against the same
+ * app get an immediate 409 with a `retryAfterMs` hint. Callers should catch
+ * this and wait+retry rather than surfacing the failure — the wallet popup
+ * never opens for a proof with no live chance of landing.
+ *
+ * `queueDepth` is 1 in v1 (single slot per app); the field exists so that a
+ * future Tier-1 optimistic-chaining pass can widen it without breaking
+ * clients written today.
+ */
+export class ProveQueueBusyError extends Error {
+    status = 409;
+    retryAfterMs;
+    queueDepth;
+    constructor(message, retryAfterMs, queueDepth) {
+        super(message);
+        this.name = 'ProveQueueBusyError';
+        this.retryAfterMs = retryAfterMs;
+        this.queueDepth = queueDepth;
+    }
+}
+export async function readErrorBody(resp) {
+    let body = {};
+    try {
+        body = await resp.json();
+    }
+    catch { /* body wasn't JSON */ }
+    const message = typeof body.error === 'string' ? body.error : `HTTP ${resp.status}`;
+    return { status: resp.status, body, message };
+}
+// Returns a ProveQueueBusyError if the parsed body matches the queue-busy
+// shape; otherwise null. Cheap to call — no I/O.
+export function tryQueueBusyFromBody(parsed) {
+    if (parsed.status !== 409)
+        return null;
+    const { body } = parsed;
+    if (body.error !== 'proving queue busy' || typeof body.retryAfterMs !== 'number')
+        return null;
+    return new ProveQueueBusyError(body.error, body.retryAfterMs, typeof body.queueDepth === 'number' ? body.queueDepth : 1);
+}
+//# sourceMappingURL=proveErrors.js.map

package/build/proveErrors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proveErrors.js","sourceRoot":"","sources":["../src/proveErrors.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,oCAAoC;AAEpC;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IACnC,MAAM,GAAG,GAAG,CAAC;IACb,YAAY,CAAS;IACrB,UAAU,CAAW;IAC9B,YAAY,OAAe,EAAE,YAAoB,EAAE,UAAkB;QACnE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;CACF;AAmBD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAc;IAChD,IAAI,IAAI,GAA4B,EAAE,CAAC;IACvC,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAA6B,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;IACpF,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAChD,CAAC;AAED,0EAA0E;AAC1E,iDAAiD;AACjD,MAAM,UAAU,oBAAoB,CAAC,MAAuB;IAC1D,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IACxB,IAAI,IAAI,CAAC,KAAK,KAAK,oBAAoB,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC9F,OAAO,IAAI,mBAAmB,CAC5B,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,YAAY,EACjB,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAC1D,CAAC;AACJ,CAAC"}