License

Attribution is built into the bottom-right of every drawing canvas, including viewers. There is no canvas option to hide or reposition it; a valid license removes it.

final controller = DiagramController(
  configuration: DiagramConfiguration(license: licenseToken),
);
DiagramCanvas(controller: controller);

license is a signed runtime license, not a private package-registry credential, and belongs to the diagram (controller.diagram.configuration.license), so every canvas on it honors it. Verification is offline. Invalid, missing, expired, or untrusted tokens leave attribution visible.

Service contract and provisioning

Runtime tokens use compact JWT with alg: EdDSA, typ: JWT, and a kid matching an SDK-pinned Ed25519 public key. Required claims are iss equal to https://diagram.vyuh.tech, aud equal to vyuh_diagram, a nonempty sub, integer Unix-second iat and exp, and an entitlements array containing attribution.remove. Optional nbf must not be in the future.

Production activation is pending key provisioning. The SDK currently trusts no runtime signing keys. The licensing service must adopt this contract and its public key must be pinned before licensed removal can work. Test keys are never trusted by the shipped canvas.

The private signing key stays on the server. Payloads are readable and must not contain secrets. Offline verification cannot detect immediate revocation or prevent a modified application from bypassing enforcement.