It sounds like the NJ AG is saying, "Someone in NJ may have downloaded and run the code written by Tidbit and said code may have done things which are not allowed in NJ, hence Tidbit must provide said code to the NJ AG."

But it doesn't sound like the AG has much evidence (or simply isn't providing such evidence) that anyone in NJ ever actually downloaded or ran the code.

Is this a normal ask for Attorneys General to make in any circumstance regarding software?