chore: OPSEC scrub public SDK surface

Author: VoxHash

.claude/rules/api-conformance.md

@@ -0,0 +1,29 @@
+---
+paths:
+  - "src/**"
+  - "lib/**"
+  - "*.ts"
+  - "*.js"
+  - "*.py"
+  - "*.go"
+  - "*.rs"
+  - "*.java"
+  - "*.cs"
+  - "*.vb"
+  - "*.php"
+  - "*.rb"
+  - "*.pl"
+  - "*.swift"
+  - "*.cpp"
+  - "*.h"
+  - "*.lua"
+  - "*.luau"
+---
+# API v1 Conformance
+
+- Default API base: `https://api.licensechain.app/v1`
+- Verify endpoint: `POST /licenses/verify` body: `{ key, hwuid? }`
+- Webhook verification: HMAC-SHA256 with constant-time comparison
+- License JWT claim: `token_use` must equal `licensechain_license_v1`
+- JWKS endpoint: `GET /v1/licenses/jwks` (RS256)
+- Never use `===` or `==` for signature comparison

.claude/settings.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "https://json.schemastore.org/claude-code-settings.json",
+  "permissions": {
+    "allow": [
+      "Bash(git status)",
+      "Bash(git diff *)",
+      "Bash(git log *)",
+      "Read",
+      "Write",
+      "Edit",
+      "Glob",
+      "Grep"
+    ],
+    "deny": [
+      "Bash(rm -rf *)",
+      "Bash(curl *)",
+      "Read(.env)",
+      "Read(.env.*)"
+    ]
+  }
+}

.github/workflows/ci.yml

@@ -0,0 +1,74 @@
+name: CI
+
+on:
+  push:
+    branches: [ main, develop ]
+  pull_request:
+    branches: [ main, develop ]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    
+    strategy:
+      matrix:
+        node-version: [18.x, 20.x]
+    
+    steps:
+    - uses: actions/checkout@v4
+    
+    - name: Use Node.js ${{ matrix.node-version }}
+      uses: actions/setup-node@v4
+      with:
+        node-version: ${{ matrix.node-version }}
+        cache: 'npm'
+    
+    - name: Install dependencies
+      run: |
+        if [ -f package-lock.json ]; then
+          npm ci
+        else
+          npm install
+        fi
+    
+    - name: Run linter
+      run: npm run lint || true
+      continue-on-error: true
+    
+    - name: Build
+      run: npm run build
+    
+    - name: Run tests
+      run: npm test || true
+      continue-on-error: true
+
+  publish:
+    needs: test
+    runs-on: ubuntu-latest
+    if: github.event_name == 'release' && github.event.action == 'published'
+    
+    steps:
+    - uses: actions/checkout@v4
+    
+    - name: Use Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: '20.x'
+        registry-url: 'https://registry.npmjs.org'
+    
+    - name: Install dependencies
+      run: |
+        if [ -f package-lock.json ]; then
+          npm ci
+        else
+          npm install
+        fi
+    
+    - name: Build
+      run: npm run build
+    
+    - name: Publish to npm
+      run: npm publish --access public
+      env:
+        NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+

.gitignore

@@ -0,0 +1,91 @@
+# Dependencies
+node_modules/
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# Build outputs
+dist/
+build/
+*.tsbuildinfo
+
+# Environment variables
+.env
+.env.local
+.env.development.local
+.env.test.local
+.env.production.local
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Logs
+logs/
+*.log
+
+# Runtime data
+pids/
+*.pid
+*.seed
+*.pid.lock
+
+# Coverage directory used by tools like istanbul
+coverage/
+*.lcov
+
+# nyc test coverage
+.nyc_output
+
+# Dependency directories
+jspm_packages/
+
+# Optional npm cache directory
+.npm
+
+# Optional eslint cache
+.eslintcache
+
+# Optional REPL history
+.node_repl_history
+
+# Output of 'npm pack'
+*.tgz
+
+# Yarn Integrity file
+.yarn-integrity
+
+# parcel-bundler cache (https://parceljs.org/)
+.cache
+.parcel-cache
+
+# next.js build output
+.next
+
+# nuxt.js build output
+.nuxt
+
+# vuepress build output
+.vuepress/dist
+
+# Serverless directories
+.serverless
+
+# FuseBox cache
+.fusebox/
+
+# DynamoDB Local files
+.dynamodb/
+
+# TernJS port file
+.tern-port
+
+# Stores VSCode versions used for testing VSCode extensions
+.vscode-test

CHANGELOG.md

@@ -0,0 +1,12 @@
+# Changelog
+
+All notable changes to this SDK are documented in this file.
+
+## [Unreleased]
+
+- Root exports: `verifyLicenseAssertionJwt`, `LICENSE_TOKEN_USE_CLAIM`, and `VerifyLicenseAssertionOptions` — parity with `licensechain-node-sdk` (`src/license-assertion.ts`). Rollup marks `jose` as external for CJS/ESM. `license-assertion.cjs` re-exports from `dist/index.js` for back-compat.
+
+## 2026-04-06
+
+- Added repository-level `ROADMAP.md` and `CHANGELOG.md` for SDK workspace doc-gap conformance.
+- Captured JavaScript SDK consolidation posture with shared JavaScript/Node core governance.

CLAUDE.md

@@ -0,0 +1,13 @@
+# LicenseChain JavaScript SDK
+
+- **Language**: TypeScript / JavaScript (isomorphic)
+- **Package**: `licensechain-js-sdk` (npm)
+- **Tier**: 1 (release-blocking)
+- **Group**: core-language
+- **Build**: `npm run build` (tsc)
+- **Test**: `npm test`
+- **API base**: `https://api.licensechain.app/v1`
+- **JWKS**: `verifyLicenseAssertionJwt` via `jose` (ESM+bundler or Node; UMD: jose external)
+- **Verify**: `LicenseService.verifyWithDetails` — sends `{ key, hwuid? }`
+- **Webhooks**: HMAC-SHA256 with `crypto.timingSafeEqual`
+- **Role**: Isomorphic/default choice SDK (consolidation with Node.js SDK shares HTTP core)

LICENSE

@@ -0,0 +1,15 @@
+Elastic License 2.0 (ELv2)
+
+Copyright (c) 2025 LicenseChain LLC
+
+This software and associated documentation files (the "Software") are provided
+under the Elastic License 2.0 (the "License"). You may not use this file except
+in compliance with the License. You may obtain a copy of the License at:
+
+    https://www.elastic.co/licensing/elastic-license
+
+Unless required by applicable law or agreed to in writing, software distributed
+under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+CONDITIONS OF ANY KIND, either express or implied. See the License for the
+specific language governing permissions and limitations under the License.
+