@aleutian/verification 0.0.0 → 0.7.0

package/dist/cli/aleutian-verify.js

@@ -0,0 +1,3841 @@
+#!/usr/bin/env node
+import { createHash } from 'crypto';
+import { constants, createReadStream } from 'fs';
+import { stat, readFile, open } from 'fs/promises';
+import { sha512 } from '@noble/hashes/sha2.js';
+import { utf8ToBytes, bytesToHex } from '@noble/hashes/utils.js';
+import { ml_dsa65 } from '@noble/post-quantum/ml-dsa.js';
+import '@noble/post-quantum/ml-kem.js';
+import '@noble/hashes/sha3.js';
+import 'tweetnacl';
+
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/errors.ts
+var AnchorVerificationError = class _AnchorVerificationError extends Error {
+  name = "AnchorVerificationError";
+  constructor(message) {
+    super(message);
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, _AnchorVerificationError);
+    }
+  }
+};
+var ChainVerificationError = class _ChainVerificationError extends Error {
+  name = "ChainVerificationError";
+  constructor(message) {
+    super(message);
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, _ChainVerificationError);
+    }
+  }
+};
+var EntriesFormatError = class _EntriesFormatError extends Error {
+  name = "EntriesFormatError";
+  constructor(message) {
+    super(message);
+    Object.setPrototypeOf(this, _EntriesFormatError.prototype);
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, _EntriesFormatError);
+    }
+  }
+};
+
+// src/hash.ts
+function base64ToUint8Array(base64) {
+  if (typeof Buffer !== "undefined") {
+    return new Uint8Array(Buffer.from(base64, "base64"));
+  } else {
+    const binary = atob(base64);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+      bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+  }
+}
+async function sha512Hex(data) {
+  const encoder = new TextEncoder();
+  const bytes = encoder.encode(data);
+  const hashBuffer = await crypto.subtle.digest("SHA-512", bytes);
+  return Array.from(new Uint8Array(hashBuffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function sha512HexRaw(data) {
+  const hashBuffer = await crypto.subtle.digest("SHA-512", data);
+  return Array.from(new Uint8Array(hashBuffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function hexToUint8Array(hex) {
+  const bytes = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < bytes.length; i++) {
+    bytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+  }
+  return bytes;
+}
+
+// src/tombstone.ts
+var TOMBSTONE_CONTENT_HASH_PREFIX = "TOMBSTONE:";
+var TOMBSTONE_ENTRY_ID_PREFIX = "tomb_";
+var TOMBSTONE_ENTRY_TYPE = "tombstone";
+var HEX_PATTERN = /^[0-9a-f]{64}$/;
+function isTombstone(entryType, entryId) {
+  return entryType === TOMBSTONE_ENTRY_TYPE && entryId.startsWith(TOMBSTONE_ENTRY_ID_PREFIX);
+}
+function validateTombstoneContentHash(contentHash) {
+  if (contentHash.length !== 74) {
+    return false;
+  }
+  if (!contentHash.startsWith(TOMBSTONE_CONTENT_HASH_PREFIX)) {
+    return false;
+  }
+  const hexPart = contentHash.slice(10);
+  return HEX_PATTERN.test(hexPart);
+}
+
+// src/chain.ts
+var CHAIN_HASH_PREFIX = "aleutian.chain.v2:";
+var CHAIN_HASH_PREFIX_V3 = "aleutian.chain.v3:";
+var FORMAT_V2 = 2;
+var FORMAT_V3 = 3;
+var HASH_HEX = /^[0-9a-f]{128}$/;
+var TIMESTAMP_FORM = /^([0-9]{4})-([0-9]{2})-([0-9]{2})T([0-9]{2}):([0-9]{2}):([0-9]{2})\.[0-9]{6}Z$/;
+var MAX_GLOBAL_SEQ = 2n ** 63n - 1n;
+function isChainDigest(value) {
+  return typeof value === "string" && HASH_HEX.test(value);
+}
+function isChainTimestamp(value) {
+  if (typeof value !== "string") return false;
+  const m = TIMESTAMP_FORM.exec(value);
+  if (!m) return false;
+  const year = Number(m[1]);
+  const month = Number(m[2]);
+  const day = Number(m[3]);
+  if (month < 1 || month > 12 || day < 1) return false;
+  const leap = year % 4 === 0 && year % 100 !== 0 || year % 400 === 0;
+  const days = [31, leap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+  if (day > days[month - 1]) return false;
+  return Number(m[4]) <= 23 && Number(m[5]) <= 59 && Number(m[6]) <= 59;
+}
+function normalizeFormatVersion(version) {
+  return !version ? FORMAT_V2 : version;
+}
+async function computeChainHashV3(previousHash, globalSeq, timestamp, contentHash) {
+  if (typeof globalSeq === "number") {
+    if (!Number.isSafeInteger(globalSeq)) {
+      throw new Error(
+        `globalSeq ${globalSeq} is not a safe integer; pass a bigint for values beyond Number.MAX_SAFE_INTEGER \u2014 a rounded value would hash to a digest that is not this entry's`
+      );
+    }
+    if (globalSeq < 0) {
+      throw new Error(`globalSeq must be non-negative, got ${globalSeq}`);
+    }
+  } else if (globalSeq < 0n) {
+    throw new Error(`globalSeq must be non-negative, got ${globalSeq}`);
+  } else if (globalSeq > MAX_GLOBAL_SEQ) {
+    throw new Error(`globalSeq must be at most 2^63 - 1, got ${globalSeq}`);
+  }
+  if (previousHash !== "" && !HASH_HEX.test(previousHash)) {
+    throw new Error("previousHash must be empty or exactly 128 lowercase hex characters");
+  }
+  if (!isChainTimestamp(timestamp)) {
+    throw new Error("timestamp must be YYYY-MM-DDTHH:MM:SS.ffffffZ (UTC, six digits)");
+  }
+  if (!HASH_HEX.test(contentHash) && !validateTombstoneContentHash(contentHash)) {
+    throw new Error(
+      'contentHash must be 128 lowercase hex characters, or a tombstone value ("TOMBSTONE:" + 64 lowercase hex)'
+    );
+  }
+  const preimage = CHAIN_HASH_PREFIX_V3 + previousHash + "|" + globalSeq.toString() + "|" + timestamp + "|" + contentHash;
+  return sha512Hex(preimage);
+}
+async function computeChainHash(previousHash, runId, sequenceNum, timestamp, contentHash) {
+  if (!Number.isSafeInteger(sequenceNum)) {
+    throw new Error(`sequenceNum ${sequenceNum} exceeds Number.MAX_SAFE_INTEGER`);
+  }
+  const preimage = CHAIN_HASH_PREFIX + previousHash + "|" + runId + "|" + sequenceNum.toString() + "|" + timestamp + "|" + contentHash;
+  return sha512Hex(preimage);
+}
+var ANCHOR_CHAIN_DOMAIN_V2 = "aleutian.anchor.v2:";
+var SEED_ANCHOR_HASH = "03443d96d3b369839f63f98b712463efba04c00551822743108d60c5f291627859ff0b7dc29f99e3c847b07b0b18bb385426c744847c1b070563f8dd07271f27";
+var SEED_ANCHOR_ID = "anchor_00000000-0000-0000-0000-000000000000";
+async function computeAnchorChainHash(previousAnchorHash, companyId, startEntryId, endEntryId, tipChainHash) {
+  const preimage = ANCHOR_CHAIN_DOMAIN_V2 + previousAnchorHash + "|" + companyId + "|" + startEntryId + "|" + endEntryId + "|" + tipChainHash;
+  return sha512Hex(preimage);
+}
+var ANCHOR_CHAIN_DOMAIN_V7 = "aleutian.anchor.v7:";
+function anchorChainHashV7Sync(previousAnchorHash, subject, startSeq, endSeq, tipChainHash) {
+  const subjectBytes = utf8ToBytes(subject);
+  const head = utf8ToBytes(ANCHOR_CHAIN_DOMAIN_V7 + previousAnchorHash + "|");
+  const tail = utf8ToBytes("|" + startSeq + "|" + endSeq + "|" + tipChainHash);
+  const n = subjectBytes.length;
+  const out = new Uint8Array(head.length + 4 + n + tail.length);
+  out.set(head, 0);
+  out.set([n >>> 24 & 255, n >>> 16 & 255, n >>> 8 & 255, n & 255], head.length);
+  out.set(subjectBytes, head.length + 4);
+  out.set(tail, head.length + 4 + n);
+  return bytesToHex(sha512(out));
+}
+
+// src/fixtures/embedded-keys-dev.json
+var embedded_keys_dev_default = {
+  "aleutian-ml-dsa-65-2026-v1": "MIIHsjALBglghkgBZQMEAxIDggehAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+  "aleutian-ml-dsa-65-2025-v1": "MIIHsjALBglghkgBZQMEAxIDggehAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+};
+
+// src/fixtures/embedded-keys-staging.json
+var embedded_keys_staging_default = {
+  "aleutian-ml-dsa-65-2026-v1": "MIIHsjALBglghkgBZQMEAxIDggehAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+  "aleutian-ml-dsa-65-2025-v1": "MIIHsjALBglghkgBZQMEAxIDggehAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+};
+
+// src/fixtures/embedded-keys-prod.json
+var embedded_keys_prod_default = {
+  "aleutian-ml-dsa-65-2026-v1": "MIIHsjALBglghkgBZQMEAxIDggehAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA",
+  "aleutian-ml-dsa-65-2025-v1": "MIIHsjALBglghkgBZQMEAxIDggehAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+};
+
+// src/keys.ts
+var MLDSA_PUB_KEY_SIZE = 1952;
+function readDerLength(data, offset) {
+  if (offset >= data.length) {
+    throw new Error("DER: unexpected end of data");
+  }
+  const b = data[offset];
+  offset += 1;
+  if (b < 128) {
+    return [b, offset];
+  }
+  const numBytes = b & 127;
+  if (offset + numBytes > data.length) {
+    throw new Error("DER: length encoding truncated");
+  }
+  let length = 0;
+  for (let i = 0; i < numBytes; i++) {
+    length = length << 8 | data[offset];
+    offset += 1;
+  }
+  return [length, offset];
+}
+function decodeSpkiDer(keyB64) {
+  const der = base64ToUint8Array(keyB64);
+  if (der.length < MLDSA_PUB_KEY_SIZE + 20) {
+    throw new Error(`Invalid SPKI DER: too short (${der.length} bytes)`);
+  }
+  let pos = 0;
+  if (der[pos] !== 48) {
+    throw new Error("Invalid SPKI: expected SEQUENCE tag");
+  }
+  pos += 1;
+  const [outerLen, contentStart] = readDerLength(der, pos);
+  if (contentStart + outerLen > der.length) {
+    throw new Error("SPKI DER: outer SEQUENCE truncated");
+  }
+  pos = contentStart;
+  if (der[pos] !== 48) {
+    throw new Error("Invalid SPKI: expected AlgorithmIdentifier SEQUENCE");
+  }
+  pos += 1;
+  const [algLen, algContentStart] = readDerLength(der, pos);
+  pos = algContentStart + algLen;
+  if (der[pos] !== 3) {
+    throw new Error("Invalid SPKI: expected BIT STRING tag");
+  }
+  pos += 1;
+  const [bitStringLen, bitStringStart] = readDerLength(der, pos);
+  pos = bitStringStart;
+  if (der[pos] !== 0) {
+    throw new Error("Invalid SPKI BIT STRING: non-zero unused bits");
+  }
+  pos += 1;
+  const raw = der.slice(pos, pos + bitStringLen - 1);
+  if (raw.length !== MLDSA_PUB_KEY_SIZE) {
+    throw new Error(
+      `Invalid ML-DSA-65 key size: got ${raw.length} bytes, want ${MLDSA_PUB_KEY_SIZE}`
+    );
+  }
+  return raw;
+}
+function loadFixture() {
+  const env = typeof process !== "undefined" && process.env && process.env.ALEUTIAN_ENV ? process.env.ALEUTIAN_ENV : "dev";
+  switch (env) {
+    case "prod":
+      return embedded_keys_prod_default;
+    case "staging":
+      return embedded_keys_staging_default;
+    default:
+      return embedded_keys_dev_default;
+  }
+}
+var _EMBEDDED_PUBLIC_KEYS_B64 = new Map(
+  Object.entries(loadFixture())
+);
+new Map(
+  Array.from(_EMBEDDED_PUBLIC_KEYS_B64.entries()).map(([id, b64]) => [
+    id,
+    decodeSpkiDer(b64)
+  ])
+);
+
+// src/canonicalBase64.ts
+var ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+var DECODE = (() => {
+  const table = new Int16Array(128).fill(-1);
+  for (let i = 0; i < ALPHABET.length; i++) table[ALPHABET.charCodeAt(i)] = i;
+  return table;
+})();
+function sextet(code) {
+  return code < 128 ? DECODE[code] : -1;
+}
+function decodeCanonicalBase64(text) {
+  const len = text.length;
+  if (len % 4 !== 0) return null;
+  if (len === 0) return new Uint8Array(0);
+  let pad = 0;
+  if (text.charCodeAt(len - 1) === 61) pad = text.charCodeAt(len - 2) === 61 ? 2 : 1;
+  const out = new Uint8Array(len / 4 * 3 - pad);
+  let o = 0;
+  for (let i = 0; i < len; i += 4) {
+    const last = i + 4 === len;
+    const a = sextet(text.charCodeAt(i));
+    const b = sextet(text.charCodeAt(i + 1));
+    if (a < 0 || b < 0) return null;
+    if (last && pad === 2) {
+      if ((b & 15) !== 0) return null;
+      out[o++] = a << 2 | b >> 4;
+      break;
+    }
+    const c = sextet(text.charCodeAt(i + 2));
+    if (c < 0) return null;
+    if (last && pad === 1) {
+      if ((c & 3) !== 0) return null;
+      out[o++] = a << 2 | b >> 4;
+      out[o++] = (b & 15) << 4 | c >> 2;
+      break;
+    }
+    const d = sextet(text.charCodeAt(i + 3));
+    if (d < 0) return null;
+    out[o++] = a << 2 | b >> 4;
+    out[o++] = (b & 15) << 4 | c >> 2;
+    out[o++] = (c & 3) << 6 | d;
+  }
+  return out;
+}
+
+// src/anchorCanonical.ts
+var ANCHOR_SIGNATURE_CONTEXT_V7 = "aleutian.proof.anchor.v7";
+var HEX_128 = /^[0-9a-f]{128}$/;
+var LONE_SURROGATE = /[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/g;
+var HAS_LONE_SURROGATE = new RegExp(LONE_SURROGATE.source);
+function encodeInt64Token(v) {
+  if (typeof v === "bigint") {
+    return v.toString();
+  }
+  if (!Number.isFinite(v) || !Number.isInteger(v)) {
+    throw new AnchorVerificationError(
+      "anchor int64 field: number must be a finite integer"
+    );
+  }
+  if (!Number.isSafeInteger(v)) {
+    throw new AnchorVerificationError(
+      "anchor int64 field: number exceeds Number.MAX_SAFE_INTEGER; pass as bigint to avoid precision loss"
+    );
+  }
+  return v.toString();
+}
+function anchorInteger(v) {
+  if (typeof v === "bigint") return v;
+  if (typeof v === "number" && Number.isSafeInteger(v)) return BigInt(v);
+  throw new AnchorVerificationError(
+    "anchor int64 field: must be an integer (a bigint beyond Number.MAX_SAFE_INTEGER)"
+  );
+}
+function checkAnchorWellFormed(anchor) {
+  const version = anchor.version;
+  if (typeof version !== "number" || !Number.isInteger(version)) {
+    throw new AnchorVerificationError("anchor version must be an integer");
+  }
+  if (version === 5) {
+    throw new AnchorVerificationError(
+      "unsupported anchor version: 5 is withdrawn and has no canonical form"
+    );
+  }
+  if (version < 1 || version > 7) {
+    throw new AnchorVerificationError("unsupported anchor version");
+  }
+  if (version === 7) {
+    checkAnchorV7WellFormed(anchor);
+    return;
+  }
+  if (anchor.range?.startSeq !== void 0 || anchor.range?.endSeq !== void 0 || anchor.previousAnchorHash !== void 0) {
+    throw new AnchorVerificationError(
+      `Version=${version} anchor must not carry previous_anchor_hash, start_seq or end_seq`
+    );
+  }
+  const verifiedThrough = anchorInteger(anchor.verifiedThrough ?? 0);
+  const entryCount = anchorInteger(anchor.entryCount);
+  const createdAtMs = anchorInteger(anchor.createdAtMs);
+  if (version <= 3) {
+    if (verifiedThrough !== 0n) {
+      throw new AnchorVerificationError(
+        "Version<=3 anchor must have verified_through=0"
+      );
+    }
+  } else {
+    if (verifiedThrough <= 0n) {
+      throw new AnchorVerificationError(
+        `Version=${version} anchor must have positive verified_through`
+      );
+    }
+    if (version === 6 && !anchor.subject) {
+      throw new AnchorVerificationError(
+        "Version=6 anchor must have a non-empty subject"
+      );
+    }
+    if (entryCount < 1n) {
+      throw new AnchorVerificationError("anchor entry_count must be at least 1");
+    }
+    if (verifiedThrough > entryCount) {
+      throw new AnchorVerificationError(
+        "anchor verified_through must not exceed entry_count"
+      );
+    }
+    if (createdAtMs < 0n) {
+      throw new AnchorVerificationError("anchor created_at_ms must not be negative");
+    }
+  }
+  if (typeof anchor.signingKeyId !== "string" || anchor.signingKeyId === "") {
+    throw new AnchorVerificationError("anchor signing_key_id must not be empty");
+  }
+}
+var MAX_INT642 = 2n ** 63n - 1n;
+function checkAnchorV7WellFormed(anchor) {
+  if (typeof anchor.subject !== "string" || anchor.subject === "") {
+    throw new AnchorVerificationError("Version=7 anchor must have a non-empty subject");
+  }
+  if (typeof anchor.anchorId !== "string" || anchor.anchorId === "") {
+    throw new AnchorVerificationError("Version=7 anchor must have a non-empty anchor_id");
+  }
+  if (typeof anchor.previousAnchorId !== "string" || anchor.previousAnchorId === "") {
+    throw new AnchorVerificationError(
+      "Version=7 anchor must have a non-empty previous_anchor_id"
+    );
+  }
+  for (const [name, value] of [
+    ["subject", anchor.subject],
+    ["anchor_id", anchor.anchorId],
+    ["previous_anchor_id", anchor.previousAnchorId],
+    ["signing_key_id", anchor.signingKeyId]
+  ]) {
+    if (typeof value === "string" && HAS_LONE_SURROGATE.test(value)) {
+      throw new AnchorVerificationError(`Version=7 anchor ${name} must be valid UTF-8`);
+    }
+  }
+  if (anchor.range === void 0 || anchor.range.startSeq === void 0 || anchor.range.endSeq === void 0) {
+    throw new AnchorVerificationError("Version=7 anchor must name its range by start_seq and end_seq");
+  }
+  if (anchor.range.startEntryId || anchor.range.endEntryId) {
+    throw new AnchorVerificationError("Version=7 anchor must not name its range by entry id");
+  }
+  if (anchor.verifiedThrough !== void 0 && anchorInteger(anchor.verifiedThrough) !== 0n) {
+    throw new AnchorVerificationError("Version=7 anchor has no verified_through");
+  }
+  const start = anchorInteger(anchor.range.startSeq);
+  const end = anchorInteger(anchor.range.endSeq);
+  const count = anchorInteger(anchor.entryCount);
+  for (const n of [start, end, count]) {
+    if (n < 0n || n > MAX_INT642) {
+      throw new AnchorVerificationError(
+        "Version=7 anchor sequence numbers and entry_count must be from 0 to 2^63 - 1"
+      );
+    }
+  }
+  if (start > end) {
+    throw new AnchorVerificationError("Version=7 anchor start_seq must not exceed end_seq");
+  }
+  if (count !== end - start + 1n) {
+    throw new AnchorVerificationError(
+      "Version=7 anchor entry_count must equal end_seq - start_seq + 1"
+    );
+  }
+  const prevHash = anchor.previousAnchorHash;
+  if (typeof prevHash !== "string" || !HEX_128.test(prevHash)) {
+    throw new AnchorVerificationError(
+      "Version=7 anchor previous_anchor_hash must be 128 lowercase hex characters"
+    );
+  }
+  if (anchor.previousAnchorId === SEED_ANCHOR_ID !== (prevHash === SEED_ANCHOR_HASH)) {
+    throw new AnchorVerificationError(
+      "Version=7 anchor names the seed id exactly when it names the seed hash"
+    );
+  }
+  if (typeof anchor.chainHash !== "string" || !HEX_128.test(anchor.chainHash)) {
+    throw new AnchorVerificationError("Version=7 anchor chain_hash must be 128 lowercase hex characters");
+  }
+  if (anchorInteger(anchor.createdAtMs) < 0n) {
+    throw new AnchorVerificationError("anchor created_at_ms must not be negative");
+  }
+  if (typeof anchor.signingKeyId !== "string" || anchor.signingKeyId === "") {
+    throw new AnchorVerificationError("anchor signing_key_id must not be empty");
+  }
+}
+function encodeJsonString(s) {
+  const wellFormed = s.replace(LONE_SURROGATE, "\uFFFD");
+  return JSON.stringify(wellFormed).replace(
+    /[<>&\u2028\u2029]/g,
+    (c) => "\\u" + c.charCodeAt(0).toString(16).padStart(4, "0")
+  );
+}
+function canonicalizeAnchorV6(anchor) {
+  const verifiedThrough = anchor.verifiedThrough ?? 0;
+  const parts = [
+    `"anchor_id":${encodeJsonString(anchor.anchorId)}`,
+    `"chain_hash":${encodeJsonString(anchor.chainHash)}`,
+    `"created_at_ms":${encodeInt64Token(anchor.createdAtMs)}`,
+    `"entry_count":${encodeInt64Token(anchor.entryCount)}`,
+    `"previous_anchor_id":${encodeJsonString(anchor.previousAnchorId)}`,
+    `"range":{"end_entry_id":${encodeJsonString(anchor.range.endEntryId)},"start_entry_id":${encodeJsonString(anchor.range.startEntryId)}}`,
+    `"signing_key_id":${encodeJsonString(anchor.signingKeyId)}`,
+    `"subject":${encodeJsonString(anchor.subject)}`,
+    `"verified_through":${encodeInt64Token(verifiedThrough)}`,
+    `"version":${anchor.version}`
+  ];
+  return `{${parts.join(",")}}`;
+}
+function canonicalizeAnchorV7(anchor) {
+  const range = anchor.range;
+  if (range.startSeq === void 0 || range.endSeq === void 0) {
+    throw new AnchorVerificationError("Version=7 anchor must name its range by start_seq and end_seq");
+  }
+  const decimal = (v) => JSON.stringify(encodeInt64Token(v));
+  const parts = [
+    `"anchor_id":${encodeJsonString(anchor.anchorId)}`,
+    `"chain_hash":${encodeJsonString(anchor.chainHash)}`,
+    `"created_at_ms":${encodeInt64Token(anchor.createdAtMs)}`,
+    `"entry_count":${decimal(anchor.entryCount)}`,
+    `"previous_anchor_hash":${encodeJsonString(anchor.previousAnchorHash ?? "")}`,
+    `"previous_anchor_id":${encodeJsonString(anchor.previousAnchorId)}`,
+    `"range":{"end_seq":${decimal(range.endSeq)},"start_seq":${decimal(range.startSeq)}}`,
+    `"signing_key_id":${encodeJsonString(anchor.signingKeyId)}`,
+    `"subject":${encodeJsonString(anchor.subject)}`,
+    `"version":${anchor.version}`
+  ];
+  return `{${parts.join(",")}}`;
+}
+new TextEncoder().encode(ANCHOR_SIGNATURE_CONTEXT_V7);
+
+// src/strictJson.ts
+var JsonNumber = class {
+  constructor(text) {
+    this.text = text;
+  }
+};
+var JsonObject = class {
+  members = /* @__PURE__ */ new Map();
+};
+var GrammarViolation = class {
+};
+var VIOLATION = new GrammarViolation();
+var QUOTE = 34;
+var BACKSLASH = 92;
+function isDigit(c) {
+  return c !== void 0 && c >= 48 && c <= 57;
+}
+var StrictJsonScanner = class {
+  constructor(b, maxDepth) {
+    this.b = b;
+    this.maxDepth = maxDepth;
+  }
+  pos = 0;
+  decoder = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true });
+  /** Reused output buffer for strings that hold escapes (grows by doubling). */
+  scratch = new Uint8Array(0);
+  scratchLength = 0;
+  /** Throw the opaque grammar violation. */
+  fail() {
+    throw VIOLATION;
+  }
+  peek() {
+    return this.b[this.pos];
+  }
+  skipWhitespace() {
+    const b = this.b;
+    while (this.pos < b.length) {
+      const c = b[this.pos];
+      if (c !== 32 && c !== 9 && c !== 10 && c !== 13) return;
+      this.pos++;
+    }
+  }
+  expect(c) {
+    if (this.b[this.pos] !== c) this.fail();
+    this.pos++;
+  }
+  /** The end of the document: only whitespace may follow the top-level value. */
+  expectEnd() {
+    this.skipWhitespace();
+    if (this.pos !== this.b.length) this.fail();
+  }
+  literal(word) {
+    for (let i = 0; i < word.length; i++) {
+      if (this.b[this.pos + i] !== word.charCodeAt(i)) this.fail();
+    }
+    this.pos += word.length;
+  }
+  /** Skip a number, holding it to RFC 8259's grammar exactly. */
+  skipNumber() {
+    const b = this.b;
+    let p = this.pos;
+    if (b[p] === 45) p++;
+    if (b[p] === 48) p++;
+    else if (isDigit(b[p]) && b[p] !== 48) while (isDigit(b[p])) p++;
+    else this.fail();
+    if (b[p] === 46) {
+      p++;
+      if (!isDigit(b[p])) this.fail();
+      while (isDigit(b[p])) p++;
+    }
+    if (b[p] === 101 || b[p] === 69) {
+      p++;
+      if (b[p] === 43 || b[p] === 45) p++;
+      if (!isDigit(b[p])) this.fail();
+      while (isDigit(b[p])) p++;
+    }
+    this.pos = p;
+  }
+  /** Read a number as its source text (ASCII, so UTF-8 decoding is exact). */
+  readNumber() {
+    const start = this.pos;
+    this.skipNumber();
+    return this.decoder.decode(this.b.subarray(start, this.pos));
+  }
+  /** Read a string (the cursor is on its opening quote) and decode it. */
+  readString() {
+    return this.scanString(true);
+  }
+  /** Check a string (the cursor is on its opening quote) without decoding it. */
+  skipString() {
+    this.scanString(false);
+  }
+  /**
+   * Scan one string. Raw runs are validated in place; escapes are written,
+   * with the runs around them, into one reused byte buffer, so a string full of
+   * escapes costs one decode, not one allocation per escape.
+   */
+  scanString(decode) {
+    const b = this.b;
+    this.pos++;
+    const start = this.pos;
+    let runStart = start;
+    let escaped = false;
+    this.scratchLength = 0;
+    for (; ; ) {
+      const c = b[this.pos];
+      if (c === void 0) this.fail();
+      if (c === QUOTE) {
+        const end = this.pos;
+        this.pos++;
+        if (!decode) return "";
+        if (!escaped)
+          return end === start ? "" : this.decoder.decode(b.subarray(start, end));
+        this.put(b.subarray(runStart, end));
+        return this.decoder.decode(this.scratch.subarray(0, this.scratchLength));
+      }
+      if (c < 32) this.fail();
+      if (c < 128 && c !== BACKSLASH) {
+        this.pos++;
+        continue;
+      }
+      if (c >= 128) {
+        this.pos += this.utf8Length(this.pos);
+        continue;
+      }
+      if (decode) {
+        escaped = true;
+        this.put(b.subarray(runStart, this.pos));
+      }
+      const e = b[this.pos + 1];
+      this.pos += 2;
+      let cp;
+      switch (e) {
+        case 34:
+          cp = 34;
+          break;
+        case 92:
+          cp = 92;
+          break;
+        case 47:
+          cp = 47;
+          break;
+        case 98:
+          cp = 8;
+          break;
+        case 102:
+          cp = 12;
+          break;
+        case 110:
+          cp = 10;
+          break;
+        case 114:
+          cp = 13;
+          break;
+        case 116:
+          cp = 9;
+          break;
+        case 117: {
+          const unit = this.hex4(this.pos);
+          this.pos += 4;
+          if (unit >= 56320 && unit <= 57343) this.fail();
+          if (unit >= 55296 && unit <= 56319) {
+            if (b[this.pos] !== BACKSLASH || b[this.pos + 1] !== 117) this.fail();
+            const low = this.hex4(this.pos + 2);
+            if (low < 56320 || low > 57343) this.fail();
+            this.pos += 6;
+            cp = 65536 + (unit - 55296 << 10) + (low - 56320);
+          } else {
+            cp = unit;
+          }
+          break;
+        }
+        default:
+          this.fail();
+      }
+      if (decode) this.putCodePoint(cp);
+      runStart = this.pos;
+    }
+  }
+  reserve(n) {
+    const need = this.scratchLength + n;
+    if (need <= this.scratch.length) return;
+    const grown = new Uint8Array(Math.max(need, this.scratch.length * 2, 256));
+    grown.set(this.scratch.subarray(0, this.scratchLength));
+    this.scratch = grown;
+  }
+  put(run) {
+    if (run.length === 0) return;
+    this.reserve(run.length);
+    this.scratch.set(run, this.scratchLength);
+    this.scratchLength += run.length;
+  }
+  /** Append one code point as UTF-8 (escapes never yield a lone surrogate). */
+  putCodePoint(cp) {
+    this.reserve(4);
+    const s = this.scratch;
+    let n = this.scratchLength;
+    if (cp < 128) {
+      s[n++] = cp;
+    } else if (cp < 2048) {
+      s[n++] = 192 | cp >> 6;
+      s[n++] = 128 | cp & 63;
+    } else if (cp < 65536) {
+      s[n++] = 224 | cp >> 12;
+      s[n++] = 128 | cp >> 6 & 63;
+      s[n++] = 128 | cp & 63;
+    } else {
+      s[n++] = 240 | cp >> 18;
+      s[n++] = 128 | cp >> 12 & 63;
+      s[n++] = 128 | cp >> 6 & 63;
+      s[n++] = 128 | cp & 63;
+    }
+    this.scratchLength = n;
+  }
+  hex4(at) {
+    let v = 0;
+    for (let i = 0; i < 4; i++) {
+      const c = this.b[at + i];
+      let d;
+      if (c === void 0) this.fail();
+      if (c >= 48 && c <= 57) d = c - 48;
+      else if (c >= 97 && c <= 102) d = c - 97 + 10;
+      else if (c >= 65 && c <= 70) d = c - 65 + 10;
+      else this.fail();
+      v = v * 16 + d;
+    }
+    return v;
+  }
+  /** Validate one UTF-8 sequence starting at `at`; return its length. */
+  utf8Length(at) {
+    const b = this.b;
+    const c0 = b[at];
+    const cont = (i, lo = 128, hi = 191) => {
+      const c = b[at + i];
+      if (c === void 0 || c < lo || c > hi) this.fail();
+    };
+    if (c0 >= 194 && c0 <= 223) {
+      cont(1);
+      return 2;
+    }
+    if (c0 >= 224 && c0 <= 239) {
+      if (c0 === 224) cont(1, 160, 191);
+      else if (c0 === 237)
+        cont(1, 128, 159);
+      else cont(1);
+      cont(2);
+      return 3;
+    }
+    if (c0 >= 240 && c0 <= 244) {
+      if (c0 === 240) cont(1, 144, 191);
+      else if (c0 === 244) cont(1, 128, 143);
+      else cont(1);
+      cont(2);
+      cont(3);
+      return 4;
+    }
+    this.fail();
+  }
+};
+function runStrict(scan) {
+  try {
+    return { ok: true, value: scan() };
+  } catch (err) {
+    if (err === VIOLATION) return { ok: false };
+    if (err instanceof TypeError) return { ok: false };
+    throw new Error("strict JSON parser: internal error");
+  }
+}
+var TreeParser = class extends StrictJsonScanner {
+  duplicateKey = false;
+  parseDocument() {
+    this.skipWhitespace();
+    const v = this.parseValue(1);
+    this.expectEnd();
+    return v;
+  }
+  parseValue(depth) {
+    const c = this.peek();
+    switch (c) {
+      case 123:
+        return this.parseObject(depth);
+      case 91:
+        return this.parseArray(depth);
+      case QUOTE:
+        return this.readString();
+      case 116:
+        this.literal("true");
+        return true;
+      case 102:
+        this.literal("false");
+        return false;
+      case 110:
+        this.literal("null");
+        return null;
+      default:
+        return new JsonNumber(this.readNumber());
+    }
+  }
+  parseArray(depth) {
+    if (depth > this.maxDepth) this.fail();
+    this.pos++;
+    const items = [];
+    this.skipWhitespace();
+    if (this.peek() === 93) {
+      this.pos++;
+      return items;
+    }
+    for (; ; ) {
+      this.skipWhitespace();
+      items.push(this.parseValue(depth + 1));
+      this.skipWhitespace();
+      const c = this.peek();
+      if (c === 44) {
+        this.pos++;
+        continue;
+      }
+      if (c === 93) {
+        this.pos++;
+        return items;
+      }
+      this.fail();
+    }
+  }
+  parseObject(depth) {
+    if (depth > this.maxDepth) this.fail();
+    this.pos++;
+    const obj = new JsonObject();
+    this.skipWhitespace();
+    if (this.peek() === 125) {
+      this.pos++;
+      return obj;
+    }
+    for (; ; ) {
+      this.skipWhitespace();
+      if (this.peek() !== QUOTE) this.fail();
+      const name = this.readString();
+      this.skipWhitespace();
+      this.expect(58);
+      this.skipWhitespace();
+      const value = this.parseValue(depth + 1);
+      if (obj.members.has(name)) this.duplicateKey = true;
+      else obj.members.set(name, value);
+      this.skipWhitespace();
+      const c = this.peek();
+      if (c === 44) {
+        this.pos++;
+        continue;
+      }
+      if (c === 125) {
+        this.pos++;
+        return obj;
+      }
+      this.fail();
+    }
+  }
+};
+function parseStrictJson(bytes, maxDepth) {
+  const parser = new TreeParser(bytes, maxDepth);
+  const r = runStrict(() => parser.parseDocument());
+  return r.ok ? { ok: true, value: r.value, duplicateKey: parser.duplicateKey } : r;
+}
+
+// src/strictText.ts
+var MAX_ENTRIES_DEPTH = 32;
+var MAX_ANCHOR_DEPTH = 2;
+var INTEGER_TEXT = /^(0|-?[1-9][0-9]*)$/;
+var MIN_INT64 = -(2n ** 63n);
+var MAX_INT643 = 2n ** 63n - 1n;
+var ENCODER = new TextEncoder();
+function toBytes(text) {
+  return typeof text === "string" ? ENCODER.encode(text) : text;
+}
+function int64Of(value) {
+  if (!(value instanceof JsonNumber) || !INTEGER_TEXT.test(value.text)) return null;
+  if (value.text.length > 20) return null;
+  const n = BigInt(value.text);
+  return n < MIN_INT64 || n > MAX_INT643 ? null : n;
+}
+function narrow(n) {
+  return n >= BigInt(Number.MIN_SAFE_INTEGER) && n <= BigInt(Number.MAX_SAFE_INTEGER) ? Number(n) : n;
+}
+function foldName(name) {
+  return name.replace(/\u017f/g, "s").replace(/\u212a/g, "k").toLowerCase();
+}
+function hasMiscasedMember(obj, snake, aliases) {
+  for (const name of obj.members.keys()) {
+    if (!snake.has(name) && !aliases.has(name) && snake.has(foldName(name))) return true;
+  }
+  return false;
+}
+var BothSpellings = class {
+  constructor(snake) {
+    this.snake = snake;
+  }
+};
+function pick(obj, snake, ...aliases) {
+  let found;
+  let seen = 0;
+  for (const name of [snake, ...aliases]) {
+    if (obj.members.has(name)) {
+      seen++;
+      found = obj.members.get(name);
+    }
+  }
+  if (seen > 1) throw new BothSpellings(snake);
+  return found;
+}
+var ENTRY_ALIASES = {
+  entry_id: "entryId",
+  entry_type: "entryType",
+  timestamp: "timestamp",
+  run_id: "runId",
+  sequence_num: "sequenceNum",
+  global_seq: "globalSeq",
+  content_hash: "contentHash",
+  chain_hash: "chainHash",
+  format_version: "formatVersion",
+  salt: "salt",
+  leaf_hash: "leafHash",
+  erased: "erased"
+};
+var ENTRY_SNAKE = new Set(Object.keys(ENTRY_ALIASES));
+var ENTRY_CAMEL = new Set(Object.values(ENTRY_ALIASES));
+var ENTRY_REQUIRED = ["entry_id", "timestamp", "content_hash", "chain_hash"];
+function notEntries(detail) {
+  return new EntriesFormatError(`not an entries file: ${detail}`);
+}
+function entryMember(obj, snake) {
+  const alias = ENTRY_ALIASES[snake];
+  try {
+    return alias === snake ? obj.members.get(snake) : pick(obj, snake, alias);
+  } catch (err) {
+    if (err instanceof BothSpellings) {
+      throw notEntries(`an entry carries ${snake} under two spellings`);
+    }
+    throw err;
+  }
+}
+function entryString(obj, snake, required) {
+  const v = entryMember(obj, snake);
+  if (v === void 0) {
+    if (required) throw notEntries(`an entry has no ${snake}`);
+    return "";
+  }
+  if (typeof v !== "string") throw notEntries(`an entry's ${snake} is not a string`);
+  return v;
+}
+function entryInteger(obj, snake) {
+  const v = entryMember(obj, snake);
+  if (v === void 0) return void 0;
+  const n = int64Of(v);
+  if (n === null) throw notEntries(`an entry's ${snake} is not an integer`);
+  return n;
+}
+function v4Members(obj) {
+  const out = {};
+  if (entryMember(obj, "salt") !== void 0) out.salt = entryString(obj, "salt", true);
+  if (entryMember(obj, "leaf_hash") !== void 0) {
+    out.leafHash = entryString(obj, "leaf_hash", true);
+  }
+  const erased = entryMember(obj, "erased");
+  if (erased !== void 0) {
+    if (typeof erased !== "boolean") throw notEntries("an entry's erased is not a boolean");
+    out.erased = erased;
+  }
+  return out;
+}
+function entryV4From(value, formatVersion) {
+  const present = /* @__PURE__ */ new Set();
+  for (const snake of ENTRY_SNAKE) {
+    if (entryMember(value, snake) !== void 0) present.add(snake);
+  }
+  const sequenceNum = narrow(entryInteger(value, "sequence_num") ?? 0n);
+  if (typeof sequenceNum !== "number") {
+    throw notEntries("an entry's sequence_num is out of range");
+  }
+  return {
+    entryId: entryString(value, "entry_id", false),
+    entryType: entryString(value, "entry_type", false),
+    timestamp: entryString(value, "timestamp", true),
+    runId: entryString(value, "run_id", false),
+    sequenceNum,
+    globalSeq: narrow(entryInteger(value, "global_seq") ?? 0n),
+    contentHash: entryString(value, "content_hash", false),
+    chainHash: entryString(value, "chain_hash", true),
+    formatVersion: Number(formatVersion),
+    ...v4Members(value),
+    presentMembers: present
+  };
+}
+function entryFrom(value) {
+  if (!(value instanceof JsonObject)) {
+    throw notEntries("an entry is not a JSON object");
+  }
+  if (hasMiscasedMember(value, ENTRY_SNAKE, ENTRY_CAMEL)) {
+    throw notEntries("an entry member is spelled in another case");
+  }
+  const declared = entryInteger(value, "format_version");
+  if (declared === 4n) return entryV4From(value, declared);
+  const [entryId, timestamp, contentHash, chainHash] = ENTRY_REQUIRED.map(
+    (name) => entryString(value, name, true)
+  );
+  const sequenceNum = narrow(entryInteger(value, "sequence_num") ?? 0n);
+  if (typeof sequenceNum !== "number") {
+    throw notEntries("an entry's sequence_num is out of range");
+  }
+  const formatVersion = entryInteger(value, "format_version");
+  return {
+    entryId,
+    entryType: entryString(value, "entry_type", false),
+    timestamp,
+    runId: entryString(value, "run_id", false),
+    sequenceNum,
+    globalSeq: narrow(entryInteger(value, "global_seq") ?? 0n),
+    contentHash,
+    chainHash,
+    ...formatVersion === void 0 ? {} : { formatVersion: Number(formatVersion) },
+    // A v4 member on a v2 or v3 entry is carried through for the verifier to
+    // report as format_field_misuse (format-spec §2.2), never dropped.
+    ...v4Members(value)
+  };
+}
+function strictDocument(bytes) {
+  const r = parseStrictJson(bytes, MAX_ENTRIES_DEPTH);
+  if (!r.ok) return void 0;
+  if (r.duplicateKey) throw notEntries("a member name is repeated");
+  return r.value;
+}
+function strictValue(bytes, what) {
+  const v = strictDocument(bytes);
+  if (v === void 0) throw notEntries(`${what} is not valid JSON`);
+  return v;
+}
+function firstNonSpace(b) {
+  for (const c of b) {
+    if (c !== 32 && c !== 9 && c !== 10 && c !== 13) return c;
+  }
+  return void 0;
+}
+function parseEntriesText(text) {
+  const bytes = toBytes(text);
+  const first = firstNonSpace(bytes);
+  if (first === void 0) throw notEntries("the document is empty");
+  let values;
+  if (first === 91) {
+    const doc = strictValue(bytes, "the document");
+    if (!Array.isArray(doc)) throw notEntries("the document is not an array of entries");
+    values = doc;
+  } else if (first === 123) {
+    const doc = strictDocument(bytes);
+    if (doc instanceof JsonObject) {
+      const wrapped = doc.members.get("entries");
+      if (Array.isArray(wrapped)) values = wrapped;
+    }
+  }
+  if (values === void 0) {
+    values = [];
+    let start = 0;
+    while (start < bytes.length) {
+      let end = bytes.indexOf(10, start);
+      if (end === -1) end = bytes.length;
+      const line = bytes.subarray(start, end);
+      if (firstNonSpace(line) !== void 0) values.push(strictValue(line, "a line"));
+      start = end + 1;
+    }
+  }
+  if (values.length === 0) throw notEntries("it holds no entries");
+  return values.map(entryFrom);
+}
+var ANCHOR_ALIASES = {
+  version: [],
+  anchor_id: ["anchorId"],
+  subject: ["subjectId"],
+  company_id: ["companyId"],
+  chain_hash: ["chainHash"],
+  range: [],
+  entry_count: ["entryCount"],
+  signature: [],
+  signing_key_id: ["signingKeyId"],
+  created_at_ms: ["createdAtMs"],
+  previous_anchor_id: ["previousAnchorId"],
+  previous_anchor_hash: ["previousAnchorHash"],
+  verified_through: ["verifiedThrough"]
+};
+var RANGE_ALIASES = {
+  start_entry_id: ["startEntryId"],
+  end_entry_id: ["endEntryId"],
+  start_seq: ["startSeq"],
+  end_seq: ["endSeq"]
+};
+var V7_REQUIRED = [
+  "version",
+  "anchor_id",
+  "subject",
+  "chain_hash",
+  "range",
+  "entry_count",
+  "signature",
+  "signing_key_id",
+  "created_at_ms",
+  "previous_anchor_id",
+  "previous_anchor_hash"
+];
+var DECIMAL_TEXT = /^(0|[1-9][0-9]*)$/;
+function nameSets(table) {
+  return {
+    table,
+    snake: new Set(Object.keys(table)),
+    aliases: new Set(Object.values(table).flat())
+  };
+}
+var ANCHOR_NAMES = nameSets(ANCHOR_ALIASES);
+var RANGE_NAMES = nameSets(RANGE_ALIASES);
+function refused(detail) {
+  return new AnchorVerificationError(`anchor refused: ${detail}`);
+}
+function onlyKnownMembers(obj, names, where) {
+  if (hasMiscasedMember(obj, names.snake, names.aliases)) {
+    throw refused(`${where} has a member spelled in another case`);
+  }
+  for (const name of obj.members.keys()) {
+    if (!names.snake.has(name) && !names.aliases.has(name)) {
+      throw refused(`${where} has an unknown member`);
+    }
+  }
+}
+function anchorMember(obj, names, snake) {
+  try {
+    return pick(obj, snake, ...names.table[snake]);
+  } catch (err) {
+    if (err instanceof BothSpellings) throw refused(`${snake} is given under two spellings`);
+    throw err;
+  }
+}
+function stringMember(obj, names, snake) {
+  const v = anchorMember(obj, names, snake);
+  if (v === void 0) return "";
+  if (typeof v !== "string") throw refused(`${snake} is not a string`);
+  return v;
+}
+function integerMember(obj, names, snake) {
+  const v = anchorMember(obj, names, snake);
+  if (v === void 0) return 0n;
+  const n = int64Of(v);
+  if (n === null) throw refused(`${snake} is not an integer`);
+  return n;
+}
+function decimalMember(obj, names, snake) {
+  const v = anchorMember(obj, names, snake);
+  if (v === void 0) throw refused(`a v7 anchor has no ${snake}`);
+  if (typeof v !== "string") throw refused(`${snake} is not a string`);
+  if (!DECIMAL_TEXT.test(v) || v.length > 19 || BigInt(v) > MAX_INT643) {
+    throw refused(`${snake} is not a decimal integer from 0 to 2^63 - 1`);
+  }
+  return BigInt(v);
+}
+function anchorV7From(doc, range) {
+  for (const name of V7_REQUIRED) {
+    if (anchorMember(doc, ANCHOR_NAMES, name) === void 0) {
+      throw refused(`a v7 anchor has no ${name}`);
+    }
+  }
+  if (anchorMember(doc, ANCHOR_NAMES, "verified_through") !== void 0) {
+    throw refused("a v7 anchor has no verified_through");
+  }
+  if (range === void 0) throw refused("a v7 anchor has no range");
+  for (const name of ["start_entry_id", "end_entry_id"]) {
+    if (anchorMember(range, RANGE_NAMES, name) !== void 0) {
+      throw refused("a v7 range names start_seq and end_seq, not entry ids");
+    }
+  }
+  return {
+    version: 7,
+    anchorId: stringMember(doc, ANCHOR_NAMES, "anchor_id"),
+    subject: stringMember(doc, ANCHOR_NAMES, "subject"),
+    chainHash: stringMember(doc, ANCHOR_NAMES, "chain_hash"),
+    range: {
+      startEntryId: "",
+      endEntryId: "",
+      startSeq: decimalMember(range, RANGE_NAMES, "start_seq"),
+      endSeq: decimalMember(range, RANGE_NAMES, "end_seq")
+    },
+    entryCount: decimalMember(doc, ANCHOR_NAMES, "entry_count"),
+    signature: stringMember(doc, ANCHOR_NAMES, "signature"),
+    signingKeyId: stringMember(doc, ANCHOR_NAMES, "signing_key_id"),
+    createdAtMs: narrow(integerMember(doc, ANCHOR_NAMES, "created_at_ms")),
+    previousAnchorId: stringMember(doc, ANCHOR_NAMES, "previous_anchor_id"),
+    previousAnchorHash: stringMember(doc, ANCHOR_NAMES, "previous_anchor_hash")
+  };
+}
+function parseAnchorText(text) {
+  const r = parseStrictJson(toBytes(text), MAX_ANCHOR_DEPTH);
+  if (!r.ok) throw refused("not valid JSON for an anchor");
+  if (r.duplicateKey) throw refused("a member name is repeated");
+  const doc = r.value;
+  if (!(doc instanceof JsonObject)) throw refused("not a JSON object");
+  onlyKnownMembers(doc, ANCHOR_NAMES, "the anchor");
+  const declared = integerMember(doc, ANCHOR_NAMES, "version");
+  const version = declared < 0n || declared > 1000n ? -1 : Number(declared);
+  const subjectName = version === 6 || version === 7 ? "subject" : "company_id";
+  const otherName = subjectName === "subject" ? "company_id" : "subject";
+  if (anchorMember(doc, ANCHOR_NAMES, otherName) !== void 0) {
+    throw refused(`this version names its subject ${subjectName}, not ${otherName}`);
+  }
+  const rangeValue = anchorMember(doc, ANCHOR_NAMES, "range");
+  let range = new JsonObject();
+  if (rangeValue !== void 0) {
+    if (!(rangeValue instanceof JsonObject)) throw refused("range is not an object");
+    range = rangeValue;
+    onlyKnownMembers(range, RANGE_NAMES, "range");
+  }
+  if (version === 7) return anchorV7From(doc, rangeValue === void 0 ? void 0 : range);
+  if (anchorMember(range, RANGE_NAMES, "start_seq") !== void 0 || anchorMember(range, RANGE_NAMES, "end_seq") !== void 0) {
+    throw refused("a v1-v6 range names start_entry_id and end_entry_id, not sequence numbers");
+  }
+  if (anchorMember(doc, ANCHOR_NAMES, "previous_anchor_hash") !== void 0) {
+    throw refused("only a v7 anchor carries previous_anchor_hash");
+  }
+  return {
+    version,
+    anchorId: stringMember(doc, ANCHOR_NAMES, "anchor_id"),
+    subject: stringMember(doc, ANCHOR_NAMES, subjectName),
+    chainHash: stringMember(doc, ANCHOR_NAMES, "chain_hash"),
+    range: {
+      startEntryId: stringMember(range, RANGE_NAMES, "start_entry_id"),
+      endEntryId: stringMember(range, RANGE_NAMES, "end_entry_id")
+    },
+    entryCount: narrow(integerMember(doc, ANCHOR_NAMES, "entry_count")),
+    signature: stringMember(doc, ANCHOR_NAMES, "signature"),
+    signingKeyId: stringMember(doc, ANCHOR_NAMES, "signing_key_id"),
+    createdAtMs: narrow(integerMember(doc, ANCHOR_NAMES, "created_at_ms")),
+    previousAnchorId: stringMember(doc, ANCHOR_NAMES, "previous_anchor_id"),
+    verifiedThrough: narrow(integerMember(doc, ANCHOR_NAMES, "verified_through"))
+  };
+}
+
+// src/anchorLoaders.ts
+async function loadAnchor(path) {
+  const fs = await import('fs/promises');
+  return parseAnchorText(new Uint8Array(await fs.readFile(path)));
+}
+async function loadExportedEntries(path) {
+  const fs = await import('fs/promises');
+  return parseEntriesText(new Uint8Array(await fs.readFile(path)));
+}
+var FORMAT_V4 = 4;
+var CHAIN_LEAF_DOMAIN_V4 = "aleutian.chain.leaf.v4:";
+var CHAIN_HASH_PREFIX_V4 = "aleutian.chain.v4:";
+var HEX_64 = /^[0-9a-f]{64}$/;
+var CONTROL = /[\u0000-\u001f\u007f]/;
+var LONE_SURROGATE2 = /[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/;
+var LEAF_DOMAIN_BYTES = utf8ToBytes(CHAIN_LEAF_DOMAIN_V4);
+function isLeafText(value) {
+  if (typeof value !== "string" || value === "") return false;
+  if (LONE_SURROGATE2.test(value) || CONTROL.test(value)) return false;
+  if (value.length > 256) return false;
+  return utf8ToBytes(value).length <= 256;
+}
+function isSalt(value) {
+  return typeof value === "string" && HEX_64.test(value);
+}
+function hasTombstoneShapeV4(entryId, entryType, contentHash) {
+  return entryType === "tombstone" || (entryId?.startsWith("tomb_") ?? false) || (contentHash?.startsWith("TOMBSTONE:") ?? false);
+}
+function u32(n) {
+  return new Uint8Array([n >>> 24 & 255, n >>> 16 & 255, n >>> 8 & 255, n & 255]);
+}
+function concat(parts) {
+  let size = 0;
+  for (const p of parts) size += p.length;
+  const out = new Uint8Array(size);
+  let at = 0;
+  for (const p of parts) {
+    out.set(p, at);
+    at += p.length;
+  }
+  return out;
+}
+function leafPreimageV4(entryId, entryType, contentHash, salt) {
+  const id = utf8ToBytes(entryId);
+  const type = utf8ToBytes(entryType);
+  return concat([
+    LEAF_DOMAIN_BYTES,
+    u32(id.length),
+    id,
+    u32(type.length),
+    type,
+    utf8ToBytes(contentHash),
+    utf8ToBytes(salt)
+  ]);
+}
+function leafHashV4Sync(entryId, entryType, contentHash, salt) {
+  return bytesToHex(sha512(leafPreimageV4(entryId, entryType, contentHash, salt)));
+}
+function chainHashV4Sync(previousHash, globalSeq, timestamp, leafHash) {
+  return bytesToHex(
+    sha512(
+      utf8ToBytes(
+        CHAIN_HASH_PREFIX_V4 + previousHash + "|" + globalSeq + "|" + timestamp + "|" + leafHash
+      )
+    )
+  );
+}
+
+// src/internal/constantTime.ts
+var _nodeTimingSafeEqual = null;
+try {
+  const nodeCrypto = __require("crypto");
+  if (typeof nodeCrypto.timingSafeEqual === "function") {
+    _nodeTimingSafeEqual = nodeCrypto.timingSafeEqual;
+  }
+} catch {
+}
+function constantTimeEqual(a, b) {
+  if (a.length !== b.length) {
+    let acc = 1;
+    const n = Math.max(a.length, b.length);
+    for (let i = 0; i < n; i++) {
+      const ai = i < a.length ? a[i] : 0;
+      const bi = i < b.length ? b[i] : 0;
+      acc |= ai ^ bi;
+    }
+    return acc === 0;
+  }
+  if (_nodeTimingSafeEqual !== null) {
+    return _nodeTimingSafeEqual(a, b);
+  }
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) {
+    diff |= a[i] ^ b[i];
+  }
+  return diff === 0;
+}
+
+// src/verify.ts
+var HEX_ENCODER = new TextEncoder();
+function chainHashEqual(a, b) {
+  return constantTimeEqual(HEX_ENCODER.encode(a), HEX_ENCODER.encode(b));
+}
+var MAX_INT645 = 2n ** 63n - 1n;
+function exactInteger(value) {
+  if (typeof value === "bigint") return value;
+  if (typeof value === "number" && Number.isSafeInteger(value)) return BigInt(value);
+  return null;
+}
+function isTombstoneEntry(entry) {
+  return typeof entry.entryType === "string" && typeof entry.entryId === "string" && isTombstone(entry.entryType, entry.entryId);
+}
+function carries(entry, snake) {
+  const present = entry.presentMembers;
+  if (present !== void 0) return present.has(snake);
+  const e = entry;
+  switch (snake) {
+    case "entry_id":
+      return e.entryId !== void 0 && e.entryId !== "";
+    case "entry_type":
+      return e.entryType !== void 0 && e.entryType !== "";
+    case "content_hash":
+      return e.contentHash !== void 0 && e.contentHash !== "";
+    case "run_id":
+      return e.runId !== void 0 && e.runId !== "";
+    case "sequence_num":
+      return e.sequenceNum !== void 0 && e.sequenceNum !== 0;
+    case "salt":
+      return e.salt !== void 0;
+    case "leaf_hash":
+      return e.leafHash !== void 0;
+    case "erased":
+      return e.erased !== void 0;
+    case "global_seq":
+      return e.globalSeq !== void 0;
+    default:
+      return true;
+  }
+}
+var V4_LIVE_ONLY = ["entry_id", "entry_type", "content_hash", "salt"];
+function v4ShapeProblem(entry, seq, hasPredecessor) {
+  if (!carries(entry, "global_seq") || !carries(entry, "leaf_hash")) {
+    return { field: "shape", detail: "a v4 entry carries global_seq and leaf_hash" };
+  }
+  if (entry.erased !== void 0 || carries(entry, "erased")) {
+    if (entry.erased !== true) {
+      return { field: "erased", detail: "a live v4 entry carries no erased member" };
+    }
+    for (const name of V4_LIVE_ONLY) {
+      if (carries(entry, name)) {
+        return {
+          field: "shape",
+          detail: "an erased v4 entry carries no entry_id, entry_type, content_hash or salt"
+        };
+      }
+    }
+  } else {
+    for (const name of V4_LIVE_ONLY) {
+      if (!carries(entry, name)) {
+        return {
+          field: "shape",
+          detail: "a live v4 entry carries entry_id, entry_type, content_hash and salt"
+        };
+      }
+    }
+    if (!isLeafText(entry.entryId)) {
+      return {
+        field: "entryId",
+        detail: "entryId must be 1 to 256 UTF-8 bytes with no control character"
+      };
+    }
+    if (!isLeafText(entry.entryType)) {
+      return {
+        field: "entryType",
+        detail: "entryType must be 1 to 256 UTF-8 bytes with no control character"
+      };
+    }
+    if (!isChainDigest(entry.contentHash)) {
+      return {
+        field: "contentHash",
+        detail: "a v4 contentHash must be exactly 128 lowercase hex characters"
+      };
+    }
+    if (!isSalt(entry.salt)) {
+      return { field: "salt", detail: "salt must be exactly 64 lowercase hex characters" };
+    }
+  }
+  if (!isChainDigest(entry.leafHash)) {
+    return { field: "leafHash", detail: "leafHash must be exactly 128 lowercase hex characters" };
+  }
+  if (seq === null || seq < 0n || seq > MAX_INT645) {
+    return {
+      field: "globalSeq",
+      detail: "globalSeq must be an integer from 0 to 2^63 - 1 (a bigint beyond 2^53)"
+    };
+  }
+  if (hasPredecessor !== seq > 0n) {
+    return {
+      field: "globalSeq",
+      detail: hasPredecessor ? "an entry with a predecessor has a globalSeq above 0" : "a v4 entry with no predecessor has globalSeq 0: walk a segment from its predecessor hash"
+    };
+  }
+  return null;
+}
+async function walkChain(entries, startHash, maxBreaks) {
+  const breaks = [];
+  const startMalformed = startHash !== "" && !isChainDigest(startHash);
+  let previousHash = startMalformed ? null : startHash;
+  let previousSeq = null;
+  let tombstonesFound = 0;
+  let lastTombstone = -1;
+  const tombstonePositions = [];
+  let erasedFound = 0;
+  let seenV4 = false;
+  const report = (position, entry, breakType, context, expectedHash = "") => {
+    breaks.push({
+      position,
+      entryId: typeof entry.entryId === "string" ? entry.entryId : "",
+      expectedHash,
+      actualHash: isChainDigest(entry.chainHash) ? entry.chainHash : "",
+      breakType,
+      context
+    });
+  };
+  for (let i = 0; i < entries.length; i++) {
+    if (maxBreaks > 0 && breaks.length >= maxBreaks) {
+      break;
+    }
+    const entry = entries[i];
+    const seq = exactInteger(entry.globalSeq);
+    const declared = entry.formatVersion;
+    const entryFormat = declared === void 0 || typeof declared === "number" ? normalizeFormatVersion(declared) : Number.NaN;
+    const isV4 = entryFormat === FORMAT_V4;
+    const isV2orV3 = entryFormat === FORMAT_V2 || entryFormat === FORMAT_V3;
+    const formatKnown = isV2orV3 || isV4;
+    let crossFormat = null;
+    if (isV2orV3 && seenV4) {
+      crossFormat = "a v2 or v3 entry after a v4 entry: a chain never goes back from v4";
+    } else if (isV2orV3 && (carries(entry, "salt") || carries(entry, "leaf_hash") || carries(entry, "erased"))) {
+      crossFormat = "a v2 or v3 entry must not carry salt, leaf_hash or erased";
+    } else if (isV4 && (carries(entry, "run_id") || carries(entry, "sequence_num"))) {
+      crossFormat = "a v4 entry carries no run_id and no sequence_num";
+    } else if (isV4 && hasTombstoneShapeV4(
+      carries(entry, "entry_id") ? entry.entryId : void 0,
+      carries(entry, "entry_type") ? entry.entryType : void 0,
+      carries(entry, "content_hash") ? entry.contentHash : void 0
+    )) {
+      crossFormat = "a v4 entry has no tombstone type, tomb_ id or TOMBSTONE: content hash";
+    }
+    if (isV4) seenV4 = true;
+    if (previousSeq !== null && seq !== null && seq !== previousSeq + 1n) {
+      report(i, entry, "sequence_gap", {
+        expectedSeq: (previousSeq + 1n).toString(),
+        actualSeq: seq.toString()
+      });
+    }
+    previousSeq = seq;
+    if (!isChainDigest(entry.chainHash)) {
+      report(i, entry, "invalid_field", {
+        field: "chainHash",
+        detail: "chainHash must be exactly 128 lowercase hex characters"
+      });
+      previousHash = null;
+      continue;
+    }
+    if (isV4 && entry.erased === true) erasedFound++;
+    const stop = (breakType, context) => {
+      report(i, entry, breakType, context);
+      previousHash = entry.chainHash;
+    };
+    if (crossFormat !== null) {
+      stop("format_field_misuse", { detail: crossFormat });
+      continue;
+    }
+    const unknownFormat = () => {
+      const shown = typeof declared === "number" && Number.isSafeInteger(declared) ? String(declared) : "(not an integer)";
+      stop("unknown_format", {
+        detail: `chain hash format version ${shown} is not implemented by this build`
+      });
+    };
+    const runFieldMisuse = entryFormat === FORMAT_V3 && Boolean(entry.runId || entry.sequenceNum);
+    const fieldMisuse = () => stop("format_field_misuse", {
+      detail: "a v3 entry must not carry runId or sequenceNum; neither is bound into its hash"
+    });
+    const seqInvalid = seq === null || seq < 0n || seq > MAX_INT645;
+    const invalidSeq = () => stop("invalid_field", {
+      field: "globalSeq",
+      detail: "globalSeq must be an integer from 0 to 2^63 - 1 (a bigint beyond 2^53)"
+    });
+    const invalidStart = () => stop("invalid_field", {
+      field: "previousHash",
+      detail: "previousHash must be empty or exactly 128 lowercase hex characters"
+    });
+    if (!isV4 && isTombstoneEntry(entry)) {
+      tombstonesFound++;
+      lastTombstone = i;
+      tombstonePositions.push(i);
+      if (!validateTombstoneContentHash(entry.contentHash)) {
+        stop("invalid_tombstone", {
+          detail: 'a tombstone contentHash must be "TOMBSTONE:" + 64 lowercase hex'
+        });
+      } else if (!formatKnown) {
+        unknownFormat();
+      } else if (runFieldMisuse) {
+        fieldMisuse();
+      } else if (seqInvalid) {
+        invalidSeq();
+      } else if (i === 0 && startMalformed) {
+        invalidStart();
+      } else {
+        previousHash = entry.chainHash;
+      }
+      continue;
+    }
+    if (!isChainTimestamp(entry.timestamp)) {
+      stop("invalid_timestamp", {
+        detail: "timestamp must be YYYY-MM-DDTHH:MM:SS.ffffffZ (UTC, six digits)"
+      });
+      continue;
+    }
+    if (!formatKnown) {
+      unknownFormat();
+      continue;
+    }
+    if (runFieldMisuse) {
+      fieldMisuse();
+      continue;
+    }
+    if (i === 0 && startMalformed) {
+      invalidStart();
+      continue;
+    }
+    if (isV4) {
+      const problem = v4ShapeProblem(entry, seq, i > 0 || startHash !== "");
+      if (problem !== null) {
+        stop("invalid_field", problem);
+        continue;
+      }
+      if (previousHash === null) {
+        previousHash = entry.chainHash;
+        continue;
+      }
+      const storedLeaf = entry.leafHash;
+      const leaf = entry.erased === true ? storedLeaf : leafHashV4Sync(entry.entryId, entry.entryType, entry.contentHash, entry.salt);
+      const expectedHash2 = chainHashV4Sync(previousHash, seq.toString(), entry.timestamp, leaf);
+      if (!chainHashEqual(leaf, storedLeaf)) {
+        report(i, entry, "hash_mismatch", { field: "leafHash" }, expectedHash2);
+      } else if (!chainHashEqual(entry.chainHash, expectedHash2)) {
+        report(i, entry, "hash_mismatch", {}, expectedHash2);
+      }
+      previousHash = expectedHash2;
+      continue;
+    }
+    if (!isChainDigest(entry.contentHash) && !(typeof entry.contentHash === "string" && validateTombstoneContentHash(entry.contentHash))) {
+      stop("invalid_field", {
+        field: "contentHash",
+        detail: 'contentHash must be 128 lowercase hex characters, or a tombstone value ("TOMBSTONE:" + 64 lowercase hex)'
+      });
+      continue;
+    }
+    if (seqInvalid) {
+      invalidSeq();
+      continue;
+    }
+    if (entryFormat === FORMAT_V2) {
+      if (typeof entry.runId !== "string" || entry.runId === "") {
+        stop("invalid_field", {
+          field: "runId",
+          detail: "a v2 entry's runId must not be empty"
+        });
+        continue;
+      }
+      const sequenceNum = entry.sequenceNum;
+      if (typeof sequenceNum !== "number" || !Number.isSafeInteger(sequenceNum) || sequenceNum < 0) {
+        stop("invalid_field", {
+          field: "sequenceNum",
+          detail: "a v2 entry's sequenceNum must be a non-negative integer"
+        });
+        continue;
+      }
+    }
+    if (previousHash === null) {
+      previousHash = entry.chainHash;
+      continue;
+    }
+    const expectedHash = entryFormat === FORMAT_V2 ? await computeChainHash(
+      previousHash,
+      entry.runId,
+      entry.sequenceNum,
+      entry.timestamp,
+      entry.contentHash
+    ) : await computeChainHashV3(previousHash, seq, entry.timestamp, entry.contentHash);
+    if (!chainHashEqual(entry.chainHash, expectedHash)) {
+      report(i, entry, "hash_mismatch", {}, expectedHash);
+    }
+    previousHash = expectedHash;
+  }
+  return { breaks, tombstonesFound, lastTombstone, tombstonePositions, erasedFound };
+}
+function walkResult(walk, processed, durationMs, anchorOutcome) {
+  const entriesNotVerified = walk.lastTombstone + 1;
+  return {
+    valid: walk.breaks.length === 0,
+    entriesVerified: processed - entriesNotVerified,
+    entriesProcessed: processed,
+    tombstonesFound: walk.tombstonesFound,
+    erasedFound: walk.erasedFound,
+    lastTombstone: walk.lastTombstone,
+    entriesNotVerified,
+    breaks: walk.breaks,
+    durationMs,
+    ...anchorOutcome === void 0 ? {} : { anchorOutcome }
+  };
+}
+async function bindOutcome(anchor, entries, chainValid, previousAnchorHash) {
+  if (!chainValid) return "chain_broken";
+  const tip = entries[entries.length - 1];
+  if (entries[0].entryId !== anchor.range.startEntryId) return "range_start_mismatch";
+  if (tip.entryId !== anchor.range.endEntryId) return "range_end_mismatch";
+  if (BigInt(anchor.entryCount) !== BigInt(entries.length)) return "height_mismatch";
+  const namesSeed = anchor.previousAnchorId === SEED_ANCHOR_ID;
+  const usesSeed = previousAnchorHash === SEED_ANCHOR_HASH;
+  if (namesSeed !== usesSeed) return "predecessor_mismatch";
+  const expected = await computeAnchorChainHash(
+    previousAnchorHash,
+    anchor.subject,
+    anchor.range.startEntryId,
+    anchor.range.endEntryId,
+    tip.chainHash
+  );
+  return chainHashEqual(expected, anchor.chainHash) ? "bound" : "head_mismatch";
+}
+function bindOutcomeV7(anchor, entries, chainValid, expect) {
+  if (!chainValid) return { outcome: "chain_broken", tipIndex: -1 };
+  const startSeq = BigInt(anchor.range.startSeq);
+  const endSeq = BigInt(anchor.range.endSeq);
+  const firstSeq = exactInteger(entries[0].globalSeq);
+  if (firstSeq === null || firstSeq !== startSeq) {
+    return { outcome: "range_start_mismatch", tipIndex: -1 };
+  }
+  const offset = endSeq - startSeq;
+  const tipIndex = offset < BigInt(entries.length) ? Number(offset) : -1;
+  if (tipIndex < 0 || exactInteger(entries[tipIndex].globalSeq) !== endSeq) {
+    return { outcome: "height_mismatch", tipIndex: -1 };
+  }
+  const expectedPrev = expect.previousAnchorHash ?? "";
+  if (expectedPrev !== "" && !chainHashEqual(expectedPrev, anchor.previousAnchorHash)) {
+    return { outcome: "predecessor_mismatch", tipIndex };
+  }
+  const expectedSubject = expect.subject ?? "";
+  if (expectedSubject !== "" && expectedSubject !== anchor.subject) {
+    return { outcome: "tenant_mismatch", tipIndex };
+  }
+  const expected = anchorChainHashV7Sync(
+    anchor.previousAnchorHash,
+    anchor.subject,
+    startSeq.toString(),
+    endSeq.toString(),
+    entries[tipIndex].chainHash
+  );
+  return {
+    outcome: chainHashEqual(expected, anchor.chainHash) ? "bound" : "head_mismatch",
+    tipIndex
+  };
+}
+async function verifyChainOffline(entries, options = {}) {
+  if (entries.length === 0) {
+    throw new ChainVerificationError("entries array cannot be empty");
+  }
+  const startHash = options.previousHash ?? "";
+  if (options.anchor && startHash !== "") {
+    throw new ChainVerificationError(
+      "an anchor cannot be bound to a segment: omit previousHash and pass the chain from its first entry"
+    );
+  }
+  if (options.anchor) {
+    checkAnchorWellFormed(options.anchor);
+  }
+  const maxEntries = options.maxEntries ?? 0;
+  const entriesToProcess = maxEntries > 0 && entries.length > maxEntries ? entries.slice(0, maxEntries) : entries;
+  const startTime = performance.now();
+  const walk = await walkChain(entriesToProcess, startHash, options.maxBreaks ?? 0);
+  const breaks = walk.breaks;
+  const lastEntry = entriesToProcess[entriesToProcess.length - 1];
+  let anchorOutcome;
+  if (options.anchor) {
+    const anchor = options.anchor;
+    let prevAnchorHash = options.previousAnchorHash ?? "";
+    if (prevAnchorHash === "" && anchor.previousAnchorId === SEED_ANCHOR_ID) {
+      prevAnchorHash = SEED_ANCHOR_HASH;
+    }
+    if (anchor.version === 7) {
+      const expectedPrev = options.previousAnchorHash ?? "";
+      anchorOutcome = expectedPrev !== "" && !isChainDigest(expectedPrev) ? breaks.length === 0 ? "predecessor_mismatch" : "chain_broken" : bindOutcomeV7(anchor, entriesToProcess, breaks.length === 0, {
+        previousAnchorHash: expectedPrev
+      }).outcome;
+    } else if (!isChainDigest(prevAnchorHash)) {
+      anchorOutcome = breaks.length === 0 ? "predecessor_mismatch" : "chain_broken";
+    } else {
+      anchorOutcome = await bindOutcome(
+        anchor,
+        entriesToProcess,
+        breaks.length === 0,
+        prevAnchorHash
+      );
+    }
+    if (anchorOutcome !== "bound" && anchorOutcome !== "chain_broken") {
+      breaks.push({
+        position: entriesToProcess.length - 1,
+        entryId: typeof lastEntry.entryId === "string" ? lastEntry.entryId : "",
+        expectedHash: "",
+        actualHash: "",
+        breakType: "anchor_mismatch",
+        context: { outcome: anchorOutcome }
+      });
+    }
+  } else {
+    const expectedLastHash = options.expectedLastHash ?? "";
+    const tipHash = isChainDigest(lastEntry.chainHash) ? lastEntry.chainHash : "";
+    if (expectedLastHash && !chainHashEqual(tipHash, expectedLastHash)) {
+      breaks.push({
+        position: entriesToProcess.length - 1,
+        entryId: typeof lastEntry.entryId === "string" ? lastEntry.entryId : "",
+        expectedHash: expectedLastHash,
+        actualHash: tipHash,
+        breakType: "anchor_mismatch",
+        context: {}
+      });
+    }
+  }
+  return walkResult(walk, entriesToProcess.length, performance.now() - startTime, anchorOutcome);
+}
+
+// src/manifestFreshness.ts
+var MANIFEST_FRESHNESS_MAX_AGE_DAYS = 30;
+var MS_PER_DAY = 24 * 60 * 60 * 1e3;
+function evaluateManifestFreshness(version, generatedAtMs, nowMs, lastSeenVersion) {
+  const ageMs = nowMs - generatedAtMs;
+  const ageDays = ageMs > 0 ? Math.floor(ageMs / MS_PER_DAY) : 0;
+  return {
+    version,
+    generatedAtMs,
+    ageDays,
+    stale: ageDays > MANIFEST_FRESHNESS_MAX_AGE_DAYS,
+    rollbackDetected: lastSeenVersion >= 0
+  };
+}
+function manifestGeneratedDate(f) {
+  return new Date(f.generatedAtMs).toISOString().slice(0, 10);
+}
+function manifestRevocationNote(f) {
+  let note = `Revocation checked against trust manifest v${f.version} dated ${manifestGeneratedDate(f)} \u2014 a key revoked after that date is not reflected.`;
+  if (f.stale) {
+    note += ` [WARNING: manifest is ${f.ageDays} days old]`;
+  }
+  return note;
+}
+
+// src/keyId.ts
+var KEYID_DOMAIN = "proof.keyid.v1:";
+var MLDSA65_PUBLIC_KEY_SIZE = 1952;
+var MLDSA65_ALGORITHM_IDENTIFIER = hexToUint8Array("300b0609608648016503040312");
+function derLength(n) {
+  if (n < 128) return Uint8Array.of(n);
+  const body = [];
+  for (let v = n; v > 0; v = Math.floor(v / 256)) body.unshift(v % 256);
+  return Uint8Array.of(128 | body.length, ...body);
+}
+function concat2(...parts) {
+  const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+  let at = 0;
+  for (const p of parts) {
+    out.set(p, at);
+    at += p.length;
+  }
+  return out;
+}
+function mldsa65Spki(publicKey) {
+  if (publicKey.length !== MLDSA65_PUBLIC_KEY_SIZE) {
+    throw new Error(
+      `an ML-DSA-65 public key is ${MLDSA65_PUBLIC_KEY_SIZE} bytes, got ${publicKey.length}`
+    );
+  }
+  const bitString = concat2(
+    Uint8Array.of(3),
+    derLength(publicKey.length + 1),
+    Uint8Array.of(0),
+    publicKey
+  );
+  const body = concat2(MLDSA65_ALGORITHM_IDENTIFIER, bitString);
+  return concat2(Uint8Array.of(48), derLength(body.length), body);
+}
+async function keyIdMLDSA65(publicKey) {
+  const input = concat2(new TextEncoder().encode(KEYID_DOMAIN), mldsa65Spki(publicKey));
+  return (await sha512HexRaw(input)).slice(0, 32);
+}
+
+// src/sarEntries.ts
+var _CONCRETE_TAG_EXHAUSTIVE_PIN = {
+  sar_intent: true,
+  sar_acknowledged: true,
+  sar_fulfilled: true,
+  sar_rejected: true,
+  sar_extended: true
+};
+function _buildImmutableTagSet(tags) {
+  const s = new Set(tags);
+  const throwMutation = (op) => {
+    throw new TypeError(
+      `CONCRETE_SAR_ENTRY_TYPE_TAGS is immutable \u2014 refusing ${op}()`
+    );
+  };
+  Object.defineProperty(s, "add", {
+    value: () => throwMutation("add"),
+    writable: false,
+    configurable: false
+  });
+  Object.defineProperty(s, "delete", {
+    value: () => throwMutation("delete"),
+    writable: false,
+    configurable: false
+  });
+  Object.defineProperty(s, "clear", {
+    value: () => throwMutation("clear"),
+    writable: false,
+    configurable: false
+  });
+  return Object.freeze(s);
+}
+_buildImmutableTagSet(
+  Object.keys(_CONCRETE_TAG_EXHAUSTIVE_PIN)
+);
+
+// src/canonicalV3.ts
+var DOMAIN_PREFIX_V3 = "aleutian.chain.entry.v3:";
+new TextEncoder().encode(
+  DOMAIN_PREFIX_V3
+);
+
+// src/proofBundleReader.ts
+var BUNDLE_FORMAT_V1 = "aleutian.proof.bundle.v1";
+var BUNDLE_FORMAT_V2 = "aleutian.proof.bundle.v2";
+var BUNDLE_MAX_DEPTH = 8;
+var LBRACE = 123;
+var RBRACE = 125;
+var LBRACKET = 91;
+var RBRACKET = 93;
+var QUOTE2 = 34;
+var COMMA = 44;
+var COLON = 58;
+var ENTRY_MEMBERS = [
+  "entry_id",
+  "entry_type",
+  "global_seq",
+  "previous_hash",
+  "timestamp",
+  "content_hash",
+  "chain_hash"
+];
+var ENTRY_INDEX = new Map(ENTRY_MEMBERS.map((name, i) => [name, i]));
+var ENTRY_ALL = (1 << ENTRY_MEMBERS.length) - 1;
+var FORMAT_MAX_RAW = 6 * Math.max(BUNDLE_FORMAT_V1.length, BUNDLE_FORMAT_V2.length) + 2;
+var BundleReader = class extends StrictJsonScanner {
+  constructor(bytes, limits) {
+    super(bytes, BUNDLE_MAX_DEPTH);
+    this.limits = limits;
+  }
+  values = 0;
+  valueLimitHit = false;
+  duplicateKey = false;
+  topIsObject = false;
+  formatOk = false;
+  formatVersion = 1;
+  /**
+   * Whether an entry carried a v2-only member (`salt`, `leaf_hash`), and
+   * whether one lacked either. Members may come in any order, `format` last,
+   * so which of the two is a structure violation is decided at the end.
+   */
+  sawV2Member = false;
+  missedV2Member = false;
+  structureBad = false;
+  countExceeded = false;
+  chainCount = 0;
+  entryCount = 0;
+  checkpointCount = 0;
+  /** False once the outcome cannot be readable: nothing more is built. */
+  building = true;
+  anyMember = (_name, depth) => this.any(depth);
+  anyElement = (depth) => this.any(depth);
+  /** Scan the whole document; the chains, while still building. */
+  document() {
+    this.skipWhitespace();
+    const chains = this.root();
+    this.expectEnd();
+    return chains;
+  }
+  /** The lowest-numbered §9.1 reason after positions 1 and 2, or the chains. */
+  outcome(chains) {
+    const v2 = this.formatOk && this.formatVersion === 2;
+    if (this.valueLimitHit || this.values > (v2 ? this.v2ValueLimit : this.limits.values)) {
+      return { ok: false, reason: "too-large" };
+    }
+    if (this.duplicateKey) return { ok: false, reason: "duplicate-key" };
+    if (this.topIsObject && !this.formatOk) return { ok: false, reason: "format" };
+    if (this.structureBad) return { ok: false, reason: "structure" };
+    if (v2 ? this.missedV2Member : this.sawV2Member) return { ok: false, reason: "structure" };
+    if (this.countExceeded || chains === void 0)
+      return { ok: false, reason: "too-large" };
+    return { ok: true, format: this.formatVersion, chains };
+  }
+  /** §16 §5's value limit (17,000,000); v1's when none is given. */
+  get v2ValueLimit() {
+    return this.limits.valuesV2 ?? this.limits.values;
+  }
+  /**
+   * Past this many values no outcome can be readable under either format, so
+   * nothing more is built or kept (the format may come last).
+   */
+  get valueCutoff() {
+    return Math.max(this.limits.values, this.v2ValueLimit);
+  }
+  /** Whether §4 is still being checked: no structure violation, under the value limit. */
+  get checking() {
+    return !this.structureBad && !this.valueLimitHit;
+  }
+  violate() {
+    this.structureBad = true;
+    this.building = false;
+  }
+  /** A value begins: count it (§5). Past the higher of the two formats' limits, stop building. */
+  begin() {
+    this.values++;
+    if (!this.valueLimitHit && this.values > this.valueCutoff) {
+      this.valueLimitHit = true;
+      this.building = false;
+    }
+  }
+  // ---------------------------------------------------------------------------
+  // Grammar only
+  // ---------------------------------------------------------------------------
+  /** Any value, checked against §3 only (its names still tracked). */
+  any(depth) {
+    this.begin();
+    this.skipBody(depth);
+  }
+  /** The value at the cursor, already counted, checked against §3 only. */
+  skipBody(depth) {
+    const c = this.peek();
+    if (c === LBRACE) this.object(depth, this.anyMember);
+    else if (c === LBRACKET) this.array(depth, this.anyElement);
+    else if (c === QUOTE2) this.skipString();
+    else if (c === 116) this.literal("true");
+    else if (c === 102) this.literal("false");
+    else if (c === 110) this.literal("null");
+    else this.skipNumber();
+  }
+  /**
+   * An object: grammar, depth and duplicate names (until the value limit).
+   * `member` reads each first-seen member's value; a repeated name's value is
+   * only scanned, since the outcome is already duplicate-key or worse.
+   */
+  object(depth, member) {
+    if (depth > this.maxDepth) this.fail();
+    this.pos++;
+    this.skipWhitespace();
+    if (this.peek() === RBRACE) {
+      this.pos++;
+      return;
+    }
+    let names;
+    for (; ; ) {
+      this.skipWhitespace();
+      if (this.peek() !== QUOTE2) this.fail();
+      if (this.valueLimitHit) {
+        names = void 0;
+        this.skipString();
+        this.colon();
+        this.any(depth + 1);
+      } else {
+        const name = this.readString();
+        names ??= /* @__PURE__ */ new Set();
+        const fresh = !names.has(name);
+        if (fresh) {
+          names.add(name);
+        } else {
+          this.duplicateKey = true;
+          this.building = false;
+        }
+        this.colon();
+        if (fresh) member(name, depth + 1);
+        else this.any(depth + 1);
+      }
+      this.skipWhitespace();
+      const c = this.peek();
+      if (c === COMMA) {
+        this.pos++;
+        continue;
+      }
+      if (c === RBRACE) {
+        this.pos++;
+        return;
+      }
+      this.fail();
+    }
+  }
+  /** The colon after a member name, with the whitespace around it. */
+  colon() {
+    this.skipWhitespace();
+    this.expect(COLON);
+    this.skipWhitespace();
+  }
+  /** An array: grammar and depth; `element` reads each element. Returns the length. */
+  array(depth, element) {
+    if (depth > this.maxDepth) this.fail();
+    this.pos++;
+    this.skipWhitespace();
+    if (this.peek() === RBRACKET) {
+      this.pos++;
+      return 0;
+    }
+    let n = 0;
+    for (; ; ) {
+      this.skipWhitespace();
+      element(depth + 1);
+      n++;
+      this.skipWhitespace();
+      const c = this.peek();
+      if (c === COMMA) {
+        this.pos++;
+        continue;
+      }
+      if (c === RBRACKET) {
+        this.pos++;
+        return n;
+      }
+      this.fail();
+    }
+  }
+  // ---------------------------------------------------------------------------
+  // §4 positions. Each begins by counting its value; when §4 is no longer
+  // checked, it only scans. A wrong JSON type is a structure violation.
+  // ---------------------------------------------------------------------------
+  /** Scan a value of the wrong type for its position. */
+  wrongType(depth) {
+    this.violate();
+    this.skipBody(depth);
+  }
+  /** §4.1: the top-level object. */
+  root() {
+    this.begin();
+    if (this.peek() !== LBRACE) {
+      this.wrongType(1);
+      return void 0;
+    }
+    this.topIsObject = true;
+    let chains;
+    let hasChains = false;
+    this.object(1, (name, depth) => {
+      if (name === "format") this.format(depth);
+      else if (!this.checking) this.any(depth);
+      else if (name === "chains") {
+        hasChains = true;
+        chains = this.chains(depth);
+      } else {
+        this.violate();
+        this.any(depth);
+      }
+    });
+    if (this.checking && !hasChains) this.violate();
+    return this.building ? chains : void 0;
+  }
+  /** `format`: judged even after a structure violation (position 5 outranks 6). */
+  format(depth) {
+    this.begin();
+    if (this.valueLimitHit || this.peek() !== QUOTE2) {
+      this.building = false;
+      this.skipBody(depth);
+      return;
+    }
+    const start = this.pos;
+    this.skipString();
+    if (this.pos - start <= FORMAT_MAX_RAW) {
+      this.pos = start;
+      const format = this.readString();
+      if (format === BUNDLE_FORMAT_V1) {
+        this.formatOk = true;
+        this.formatVersion = 1;
+      } else if (format === BUNDLE_FORMAT_V2) {
+        this.formatOk = true;
+        this.formatVersion = 2;
+      }
+    }
+    if (!this.formatOk) this.building = false;
+  }
+  /** A string member or checkpoint text; undefined unless building. */
+  str(depth) {
+    this.begin();
+    if (!this.checking) {
+      this.skipBody(depth);
+      return void 0;
+    }
+    if (this.peek() !== QUOTE2) {
+      this.wrongType(depth);
+      return void 0;
+    }
+    if (!this.building) {
+      this.skipString();
+      return void 0;
+    }
+    return this.readString();
+  }
+  /** §4.1 `chains`. */
+  chains(depth) {
+    this.begin();
+    if (!this.checking) {
+      this.skipBody(depth);
+      return void 0;
+    }
+    if (this.peek() !== LBRACKET) {
+      this.wrongType(depth);
+      return void 0;
+    }
+    let out = this.building ? [] : void 0;
+    this.array(depth, (d) => {
+      if (!this.checking) return this.any(d);
+      if (++this.chainCount > this.limits.chains) this.overCount();
+      const chain = this.chain(d);
+      if (this.building && out !== void 0 && chain !== void 0) out.push(chain);
+      else out = void 0;
+    });
+    return this.building ? out : void 0;
+  }
+  overCount() {
+    this.countExceeded = true;
+    this.building = false;
+  }
+  /** §4.2 a chain. */
+  chain(depth) {
+    this.begin();
+    if (!this.checking) {
+      this.skipBody(depth);
+      return void 0;
+    }
+    if (this.peek() !== LBRACE) {
+      this.wrongType(depth);
+      return void 0;
+    }
+    let chainId;
+    let entries;
+    let checkpoints;
+    let seen = 0;
+    this.object(depth, (name, d) => {
+      if (!this.checking) return this.any(d);
+      if (name === "chain_id") {
+        seen |= 1;
+        chainId = this.str(d);
+      } else if (name === "entries") {
+        seen |= 2;
+        entries = this.entries(d);
+      } else if (name === "checkpoints") {
+        seen |= 4;
+        checkpoints = this.checkpoints(d);
+      } else {
+        this.violate();
+        this.any(d);
+      }
+    });
+    if (this.checking && seen !== 7) this.violate();
+    if (!this.building || chainId === void 0 || entries === void 0 || checkpoints === void 0) {
+      return void 0;
+    }
+    return { chainId, entries, checkpoints };
+  }
+  /** §4.2 `entries`: not empty. */
+  entries(depth) {
+    this.begin();
+    if (!this.checking) {
+      this.skipBody(depth);
+      return void 0;
+    }
+    if (this.peek() !== LBRACKET) {
+      this.wrongType(depth);
+      return void 0;
+    }
+    let out = this.building ? [] : void 0;
+    const n = this.array(depth, (d) => {
+      if (!this.checking) return this.any(d);
+      if (++this.entryCount > this.limits.entries) this.overCount();
+      const entry = this.entry(d);
+      if (this.building && out !== void 0 && entry !== void 0) out.push(entry);
+      else out = void 0;
+    });
+    if (this.checking && n === 0) this.violate();
+    return this.building ? out : void 0;
+  }
+  /** §4.2 `checkpoints`: strings. */
+  checkpoints(depth) {
+    this.begin();
+    if (!this.checking) {
+      this.skipBody(depth);
+      return void 0;
+    }
+    if (this.peek() !== LBRACKET) {
+      this.wrongType(depth);
+      return void 0;
+    }
+    let out = this.building ? [] : void 0;
+    this.array(depth, (d) => {
+      if (!this.checking) return this.any(d);
+      if (++this.checkpointCount > this.limits.checkpoints) this.overCount();
+      const text = this.str(d);
+      if (this.building && out !== void 0 && text !== void 0) out.push(text);
+      else out = void 0;
+    });
+    return this.building ? out : void 0;
+  }
+  /** §4.3 an entry. */
+  entry(depth) {
+    this.begin();
+    if (!this.checking) {
+      this.skipBody(depth);
+      return void 0;
+    }
+    if (this.peek() !== LBRACE) {
+      this.wrongType(depth);
+      return void 0;
+    }
+    const fields = [];
+    let seen = 0;
+    let recordSignature;
+    let disclosed;
+    let salt;
+    let leafHash;
+    let v2Seen = 0;
+    this.object(depth, (name, d) => {
+      if (!this.checking) return this.any(d);
+      const i = ENTRY_INDEX.get(name);
+      if (i !== void 0) {
+        seen |= 1 << i;
+        fields[i] = this.str(d);
+      } else if (name === "salt") {
+        v2Seen |= 1;
+        salt = this.str(d);
+      } else if (name === "leaf_hash") {
+        v2Seen |= 2;
+        leafHash = this.str(d);
+      } else if (name === "record_signature") {
+        const p = this.pair(d, "key_id", "signature");
+        if (p !== void 0) recordSignature = { keyId: p[0], signature: p[1] };
+      } else if (name === "disclosed") {
+        const p = this.pair(d, "content", "nonce");
+        if (p !== void 0) disclosed = { content: p[0], nonce: p[1] };
+      } else {
+        this.violate();
+        this.any(d);
+      }
+    });
+    if (this.checking && seen !== ENTRY_ALL) this.violate();
+    if (v2Seen !== 0) this.sawV2Member = true;
+    if (v2Seen !== 3) this.missedV2Member = true;
+    if (!this.building) return void 0;
+    const [
+      entryId,
+      entryType,
+      globalSeq,
+      previousHash,
+      timestamp,
+      contentHash,
+      chainHash
+    ] = fields;
+    return {
+      entryId,
+      entryType,
+      globalSeq,
+      previousHash,
+      timestamp,
+      contentHash,
+      chainHash,
+      ...salt === void 0 ? {} : { salt },
+      ...leafHash === void 0 ? {} : { leafHash },
+      recordSignature,
+      disclosed
+    };
+  }
+  /** `record_signature` or `disclosed`: exactly its two string members (§4.3). */
+  pair(depth, a, b) {
+    this.begin();
+    if (!this.checking) {
+      this.skipBody(depth);
+      return void 0;
+    }
+    if (this.peek() !== LBRACE) {
+      this.wrongType(depth);
+      return void 0;
+    }
+    let x;
+    let y;
+    let seen = 0;
+    this.object(depth, (name, d) => {
+      if (!this.checking) return this.any(d);
+      if (name === a) {
+        seen |= 1;
+        x = this.str(d);
+      } else if (name === b) {
+        seen |= 2;
+        y = this.str(d);
+      } else {
+        this.violate();
+        this.any(d);
+      }
+    });
+    if (this.checking && seen !== 3) this.violate();
+    return this.building && x !== void 0 && y !== void 0 ? [x, y] : void 0;
+  }
+};
+function readProofBundle(bytes, limits) {
+  if (bytes.length > limits.bundleBytes) return { ok: false, reason: "too-large" };
+  const reader = new BundleReader(bytes, limits);
+  const scanned = runStrict(() => reader.document());
+  if (!scanned.ok) return { ok: false, reason: "json" };
+  return reader.outcome(scanned.value);
+}
+
+// src/commitment.ts
+var COMMITMENT_DOMAIN = "aleutian.commit.v1:";
+var COMMITMENT_NONCE_SIZE = 32;
+new TextEncoder().encode(COMMITMENT_DOMAIN);
+
+// src/proofBundleHashes.ts
+var COMMITMENT_DOMAIN_BYTES = utf8ToBytes(COMMITMENT_DOMAIN);
+function sha512HexSync(text) {
+  return bytesToHex(sha512(utf8ToBytes(text)));
+}
+function chainHashV3Sync(previousHash, globalSeq, timestamp, contentHash) {
+  return sha512HexSync(
+    CHAIN_HASH_PREFIX_V3 + previousHash + "|" + globalSeq + "|" + timestamp + "|" + contentHash
+  );
+}
+function anchorChainHashSync(previousAnchorHash, subject, startEntryId, endEntryId, tipChainHash) {
+  return sha512HexSync(
+    ANCHOR_CHAIN_DOMAIN_V2 + previousAnchorHash + "|" + subject + "|" + startEntryId + "|" + endEntryId + "|" + tipChainHash
+  );
+}
+function openCommitmentSync(nonce, content, commitment) {
+  if (nonce.length !== COMMITMENT_NONCE_SIZE) return false;
+  const inner = sha512(content);
+  const outer = new Uint8Array(
+    COMMITMENT_DOMAIN_BYTES.length + nonce.length + inner.length
+  );
+  outer.set(COMMITMENT_DOMAIN_BYTES, 0);
+  outer.set(nonce, COMMITMENT_DOMAIN_BYTES.length);
+  outer.set(inner, COMMITMENT_DOMAIN_BYTES.length + nonce.length);
+  return bytesToHex(sha512(outer)) === commitment;
+}
+
+// src/sinkShapes.ts
+var SINK_CHAIN_ID = /^[a-z0-9][a-z0-9_-]{0,30}\.[0-9a-f]{32}$/;
+var SINK_ENTRY_ID = /^sink-[0-9a-f]{32}$/;
+var HEX_1282 = /^[0-9a-f]{128}$/;
+var HEX_642 = /^[0-9a-f]{64}$/;
+var HEX_32 = /^[0-9a-f]{32}$/;
+var DECIMAL = /^(0|[1-9][0-9]*)$/;
+var MAX_GLOBAL_SEQ2 = 2n ** 63n - 1n;
+var TIMESTAMP = /^([0-9]{4})-([0-9]{2})-([0-9]{2})T([0-9]{2}):([0-9]{2}):([0-9]{2})\.[0-9]{6}Z$/;
+function isGlobalSeq(s) {
+  if (!DECIMAL.test(s)) return false;
+  return s.length <= 19 && BigInt(s) <= MAX_GLOBAL_SEQ2;
+}
+function daysInMonth(year, month) {
+  if (month === 2) {
+    const leap = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+    return leap ? 29 : 28;
+  }
+  return month === 4 || month === 6 || month === 9 || month === 11 ? 30 : 31;
+}
+function isSinkTimestamp(s) {
+  const m = TIMESTAMP.exec(s);
+  if (!m) return false;
+  const year = Number(m[1]);
+  const month = Number(m[2]);
+  const day = Number(m[3]);
+  const hour = Number(m[4]);
+  const minute = Number(m[5]);
+  const second = Number(m[6]);
+  if (year < 1 || month < 1 || month > 12) return false;
+  if (day < 1 || day > daysInMonth(year, month)) return false;
+  return hour <= 23 && minute <= 59 && second <= 59;
+}
+
+// src/recordEnvelope.ts
+var RECORD_ENVELOPE_DOMAIN = "aleutian.proof.record.v1";
+var MLDSA65_PUBLIC_KEY_SIZE2 = 1952;
+var MLDSA65_SIGNATURE_SIZE = 3309;
+var EMPTY_CONTEXT2 = new Uint8Array(0);
+function isValidRecordEnvelopeFields(f) {
+  if (!SINK_CHAIN_ID.test(f.chainId)) return false;
+  if (!SINK_ENTRY_ID.test(f.entryId)) return false;
+  if (f.entryType !== "sink.event" && f.entryType !== "sink.erasure") return false;
+  if (!isGlobalSeq(f.globalSeq)) return false;
+  if (f.globalSeq === "0") {
+    if (f.previousHash !== "") return false;
+  } else if (!HEX_1282.test(f.previousHash)) {
+    return false;
+  }
+  if (!isSinkTimestamp(f.timestamp)) return false;
+  if (!HEX_1282.test(f.contentHash)) return false;
+  return HEX_32.test(f.signingKeyId);
+}
+function buildRecordEnvelopeV1(fields) {
+  if (!isValidRecordEnvelopeFields(fields)) {
+    throw new Error("record envelope: a field is outside sink-format \xA79.1");
+  }
+  return encodeEnvelope(RECORD_ENVELOPE_DOMAIN, [
+    fields.chainId,
+    fields.entryId,
+    fields.entryType,
+    fields.globalSeq,
+    fields.previousHash,
+    fields.timestamp,
+    fields.contentHash,
+    fields.signingKeyId
+  ]);
+}
+function encodeEnvelope(domainText, fieldValues) {
+  const enc = new TextEncoder();
+  const values = fieldValues.map((v) => enc.encode(v));
+  const domain = enc.encode(domainText);
+  let size = domain.length + 1;
+  for (const v of values) size += 5 + v.length;
+  const out = new Uint8Array(size);
+  const view = new DataView(out.buffer);
+  out.set(domain, 0);
+  let at = domain.length;
+  out[at++] = 0;
+  values.forEach((v, i) => {
+    out[at++] = i + 1;
+    view.setUint32(at, v.length, false);
+    at += 4;
+    out.set(v, at);
+    at += v.length;
+  });
+  return out;
+}
+function verifyMLDSA65Pure(publicKey, message, signature) {
+  return verifyMLDSA65PureWithContext(publicKey, message, signature, EMPTY_CONTEXT2);
+}
+function verifyMLDSA65PureWithContext(publicKey, message, signature, context) {
+  if (publicKey.length !== MLDSA65_PUBLIC_KEY_SIZE2) return false;
+  if (signature.length !== MLDSA65_SIGNATURE_SIZE) return false;
+  if (!(context instanceof Uint8Array) || context.length > 255) return false;
+  try {
+    return ml_dsa65.verify(signature, message, publicKey, { context });
+  } catch {
+    return false;
+  }
+}
+var RECORD_ENVELOPE_DOMAIN_V2 = "aleutian.proof.record.v2";
+var RECORD_SIGNATURE_CONTEXT_V2 = "aleutian.proof.record.v2";
+new TextEncoder().encode(RECORD_SIGNATURE_CONTEXT_V2);
+function isValidRecordEnvelopeFieldsV2(f) {
+  return isValidRecordEnvelopeFields(f) && typeof f.leafHash === "string" && HEX_1282.test(f.leafHash);
+}
+function buildRecordEnvelopeV2(fields) {
+  if (!isValidRecordEnvelopeFieldsV2(fields)) {
+    throw new Error("record envelope: a field is outside sink-format \xA79.1");
+  }
+  return encodeEnvelope(RECORD_ENVELOPE_DOMAIN_V2, [
+    fields.chainId,
+    fields.entryId,
+    fields.entryType,
+    fields.globalSeq,
+    fields.previousHash,
+    fields.timestamp,
+    fields.contentHash,
+    fields.signingKeyId,
+    fields.leafHash
+  ]);
+}
+
+// src/proofBundle.ts
+var PROOF_BUNDLE_RESULT_ID = "aleutian.proof.bundle-result.v1";
+var PROOF_BUNDLE_LIMITS = Object.freeze({
+  bundleBytes: 256 * 1024 * 1024,
+  values: 15e6,
+  valuesV2: 17e6,
+  chains: 1e5,
+  entries: 1e6,
+  checkpoints: 1e5,
+  checkpointTextBytes: 1024 * 1024
+});
+var MAX_DEPTH = BUNDLE_MAX_DEPTH;
+var ProofBundleVerifierError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ProofBundleVerifierError";
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+function hasExactMembers(obj, required) {
+  if (obj.members.size !== required.length) return false;
+  for (const name of required) if (!obj.members.has(name)) return false;
+  return true;
+}
+function str(obj, name) {
+  const v = obj.members.get(name);
+  return typeof v === "string" ? v : void 0;
+}
+function stringPair(v, a, b) {
+  if (!(v instanceof JsonObject) || !hasExactMembers(v, [a, b])) return null;
+  const x = str(v, a);
+  const y = str(v, b);
+  return x === void 0 || y === void 0 ? null : [x, y];
+}
+var CHECKPOINT_MEMBERS = [
+  "version",
+  "anchor_id",
+  "chain_hash",
+  "created_at_ms",
+  "entry_count",
+  "previous_anchor_id",
+  "range",
+  "signature",
+  "signing_key_id",
+  "subject",
+  "verified_through"
+];
+var CHECKPOINT_NUMBER = /^(0|[1-9][0-9]*)$/;
+var MAX_SAFE = BigInt(Number.MAX_SAFE_INTEGER);
+var MLDSA65_SIGNATURE_SIZE2 = 3309;
+function checkpointNumber(v) {
+  if (!(v instanceof JsonNumber) || !CHECKPOINT_NUMBER.test(v.text)) return null;
+  const n = BigInt(v.text);
+  return n <= MAX_SAFE ? n : null;
+}
+function pipeFree(s) {
+  return s !== void 0 && s !== "" && !s.includes("|");
+}
+function parseCheckpoint(text, limits) {
+  const bytes = new TextEncoder().encode(text);
+  if (bytes.length > limits.checkpointTextBytes) return null;
+  const parsed = parseStrictJson(bytes, MAX_DEPTH);
+  if (!parsed.ok || parsed.duplicateKey) return null;
+  const obj = parsed.value;
+  if (!(obj instanceof JsonObject) || !hasExactMembers(obj, CHECKPOINT_MEMBERS))
+    return null;
+  const version = checkpointNumber(obj.members.get("version"));
+  const createdAtMs = checkpointNumber(obj.members.get("created_at_ms"));
+  const entryCount = checkpointNumber(obj.members.get("entry_count"));
+  const verifiedThrough = checkpointNumber(obj.members.get("verified_through"));
+  if (version !== 6n || createdAtMs === null) return null;
+  if (entryCount === null || entryCount < 1n) return null;
+  if (verifiedThrough === null || verifiedThrough < 1n) return null;
+  const anchorId = str(obj, "anchor_id");
+  const previousAnchorId = str(obj, "previous_anchor_id");
+  const subject = str(obj, "subject");
+  if (!pipeFree(anchorId) || !pipeFree(previousAnchorId) || !pipeFree(subject))
+    return null;
+  const chainHash = str(obj, "chain_hash");
+  const signingKeyId = str(obj, "signing_key_id");
+  if (chainHash === void 0 || !HEX_1282.test(chainHash)) return null;
+  if (signingKeyId === void 0 || !HEX_32.test(signingKeyId)) return null;
+  const signatureText = str(obj, "signature");
+  const signature = signatureText === void 0 ? null : decodeCanonicalBase64(signatureText);
+  if (signature === null || signature.length !== MLDSA65_SIGNATURE_SIZE2) return null;
+  const range = stringPair(obj.members.get("range"), "start_entry_id", "end_entry_id");
+  if (range === null || !SINK_ENTRY_ID.test(range[0]) || !SINK_ENTRY_ID.test(range[1]))
+    return null;
+  return {
+    anchorId,
+    chainHash,
+    createdAtMs,
+    entryCount: Number(entryCount),
+    previousAnchorId,
+    startEntryId: range[0],
+    endEntryId: range[1],
+    signature,
+    signingKeyId,
+    subject,
+    verifiedThrough
+  };
+}
+function checkpointCanonicalBytes(cp) {
+  const canonical = canonicalizeAnchorV6({
+    version: 6,
+    anchorId: cp.anchorId,
+    subject: cp.subject,
+    chainHash: cp.chainHash,
+    range: { startEntryId: cp.startEntryId, endEntryId: cp.endEntryId },
+    entryCount: BigInt(cp.entryCount),
+    signingKeyId: cp.signingKeyId,
+    createdAtMs: cp.createdAtMs,
+    previousAnchorId: cp.previousAnchorId,
+    verifiedThrough: cp.verifiedThrough
+  });
+  return new TextEncoder().encode(canonical);
+}
+var CHECKPOINT_V7_MEMBERS = [
+  "version",
+  "anchor_id",
+  "chain_hash",
+  "created_at_ms",
+  "entry_count",
+  "previous_anchor_hash",
+  "previous_anchor_id",
+  "range",
+  "signature",
+  "signing_key_id",
+  "subject"
+];
+var ANCHOR_CONTEXT_V7 = new TextEncoder().encode(ANCHOR_SIGNATURE_CONTEXT_V7);
+var RECORD_CONTEXT_V2 = new TextEncoder().encode(RECORD_SIGNATURE_CONTEXT_V2);
+function parseCheckpointV7(text, limits) {
+  const bytes = new TextEncoder().encode(text);
+  if (bytes.length > limits.checkpointTextBytes) return null;
+  const parsed = parseStrictJson(bytes, MAX_DEPTH);
+  if (!parsed.ok || parsed.duplicateKey) return null;
+  const obj = parsed.value;
+  if (!(obj instanceof JsonObject) || !hasExactMembers(obj, CHECKPOINT_V7_MEMBERS))
+    return null;
+  const version = checkpointNumber(obj.members.get("version"));
+  const createdAtMs = checkpointNumber(obj.members.get("created_at_ms"));
+  if (version !== 7n || createdAtMs === null) return null;
+  const entryCountText = str(obj, "entry_count");
+  if (entryCountText === void 0 || !isGlobalSeq(entryCountText)) return null;
+  const entryCount = BigInt(entryCountText);
+  if (entryCount < 1n) return null;
+  const range = stringPair(obj.members.get("range"), "start_seq", "end_seq");
+  if (range === null || !isGlobalSeq(range[0]) || !isGlobalSeq(range[1])) return null;
+  if (range[0] !== "0" || entryCount !== BigInt(range[1]) + 1n) return null;
+  const anchorId = str(obj, "anchor_id");
+  const previousAnchorId = str(obj, "previous_anchor_id");
+  const subject = str(obj, "subject");
+  if (!pipeFree(anchorId) || !pipeFree(previousAnchorId) || !pipeFree(subject))
+    return null;
+  const chainHash = str(obj, "chain_hash");
+  const previousAnchorHash = str(obj, "previous_anchor_hash");
+  const signingKeyId = str(obj, "signing_key_id");
+  if (chainHash === void 0 || !HEX_1282.test(chainHash)) return null;
+  if (previousAnchorHash === void 0 || !HEX_1282.test(previousAnchorHash)) return null;
+  if (signingKeyId === void 0 || !HEX_32.test(signingKeyId)) return null;
+  if (previousAnchorId === SEED_ANCHOR_ID !== (previousAnchorHash === SEED_ANCHOR_HASH))
+    return null;
+  const signatureText = str(obj, "signature");
+  const signature = signatureText === void 0 ? null : decodeCanonicalBase64(signatureText);
+  if (signature === null || signature.length !== MLDSA65_SIGNATURE_SIZE2) return null;
+  return {
+    anchorId,
+    chainHash,
+    createdAtMs,
+    entryCount,
+    endSeq: range[1],
+    previousAnchorHash,
+    previousAnchorId,
+    signature,
+    signingKeyId,
+    subject
+  };
+}
+function checkpointCanonicalBytesV7(cp) {
+  const canonical = canonicalizeAnchorV7({
+    version: 7,
+    anchorId: cp.anchorId,
+    subject: cp.subject,
+    chainHash: cp.chainHash,
+    range: { startEntryId: "", endEntryId: "", startSeq: 0n, endSeq: BigInt(cp.endSeq) },
+    entryCount: cp.entryCount,
+    signingKeyId: cp.signingKeyId,
+    createdAtMs: cp.createdAtMs,
+    previousAnchorId: cp.previousAnchorId,
+    previousAnchorHash: cp.previousAnchorHash
+  });
+  return new TextEncoder().encode(canonical);
+}
+var ProblemSet = class {
+  byCode = /* @__PURE__ */ new Map();
+  add(code, index) {
+    const p = this.byCode.get(code);
+    if (p === void 0) {
+      this.byCode.set(code, { count: 1, first: index });
+    } else {
+      p.count++;
+      if (index !== null && (p.first === null || index < p.first)) p.first = index;
+    }
+  }
+  get empty() {
+    return this.byCode.size === 0;
+  }
+  /** Sorted by code in byte order (codes are ASCII, so UTF-16 order is byte order). */
+  list() {
+    return [...this.byCode.entries()].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([code, p]) => ({ code, count: p.count, first: p.first }));
+  }
+};
+var ERASURE_DOMAIN = "aleutian.sink.erasure.v1:";
+function erasureHash(previousGlobalSeq) {
+  const record = '{"erased":"every earlier event on this chain","through_global_seq":"' + previousGlobalSeq + '"}';
+  return sha512HexSync(ERASURE_DOMAIN + record);
+}
+function disclosedInShape(d) {
+  if (!HEX_642.test(d.nonce)) return false;
+  if (d.content.length > 87384) return false;
+  const content = decodeCanonicalBase64(d.content);
+  return content !== null && content.length >= 1 && content.length <= 65536;
+}
+function isWellFormed(e, format) {
+  if (format === 2 && !(HEX_642.test(e.salt ?? "") && HEX_1282.test(e.leafHash ?? ""))) {
+    return false;
+  }
+  return SINK_ENTRY_ID.test(e.entryId) && isGlobalSeq(e.globalSeq) && (e.previousHash === "" || HEX_1282.test(e.previousHash)) && isSinkTimestamp(e.timestamp) && HEX_1282.test(e.contentHash) && HEX_1282.test(e.chainHash);
+}
+function hashesRecompute(e, format) {
+  if (format === 1) {
+    return chainHashV3Sync(e.previousHash, e.globalSeq, e.timestamp, e.contentHash) === e.chainHash;
+  }
+  const leafHash = e.leafHash;
+  if (leafHashV4Sync(e.entryId, e.entryType, e.contentHash, e.salt) !== leafHash) return false;
+  return chainHashV4Sync(e.previousHash, e.globalSeq, e.timestamp, leafHash) === e.chainHash;
+}
+function checkCheckpointV7(text, head, ctx) {
+  const n = BigInt(ctx.entries.length);
+  const cp = parseCheckpointV7(text, ctx.limits);
+  if (cp === null) return "checkpoint-malformed";
+  if (!ctx.chainIdValid || cp.subject !== ctx.chainId) return "checkpoint-subject";
+  if (cp.previousAnchorId !== head.anchorId || cp.previousAnchorHash !== head.anchorHash || cp.entryCount <= head.count) {
+    return "checkpoint-sequence";
+  }
+  if (cp.entryCount > n) return "checkpoint-overreach";
+  if (cp.entryCount > BigInt(ctx.firstMalformed)) return "checkpoint-binding";
+  const tip = ctx.entries[Number(cp.entryCount) - 1];
+  const expected = anchorChainHashV7Sync(
+    cp.previousAnchorHash,
+    ctx.chainId,
+    "0",
+    cp.endSeq,
+    tip.chainHash
+  );
+  if (cp.chainHash !== expected) return "checkpoint-binding";
+  if (ctx.trust.checkpoint.size > 0) {
+    const key = ctx.trust.checkpoint.get(cp.signingKeyId);
+    if (key === void 0) return "checkpoint-unknown-key";
+    if (!verifyMLDSA65PureWithContext(
+      key,
+      checkpointCanonicalBytesV7(cp),
+      cp.signature,
+      ANCHOR_CONTEXT_V7
+    )) {
+      return "checkpoint-bad-signature";
+    }
+  }
+  return { anchorId: cp.anchorId, anchorHash: cp.chainHash, count: cp.entryCount };
+}
+function verifyChain(chain, trust, limits, format) {
+  const { chainId, entries } = chain;
+  const n = entries.length;
+  const problems = new ProblemSet();
+  const checkpointTrust = trust.checkpoint.size > 0;
+  const recordTrust = trust.record.size > 0;
+  const chainIdValid = SINK_CHAIN_ID.test(chainId);
+  if (!chainIdValid) problems.add("invalid-chain-id", null);
+  const wellFormed = [];
+  const disclosedBad = [];
+  const seenIds = /* @__PURE__ */ new Set();
+  for (let i = 0; i < n; i++) {
+    const e = entries[i];
+    const wf = isWellFormed(e, format);
+    const dBad = e.disclosed !== void 0 && (e.entryType !== "sink.event" || !disclosedInShape(e.disclosed));
+    wellFormed.push(wf);
+    disclosedBad.push(dBad);
+    if (!wf || dBad) problems.add("field-shape", i);
+    if (seenIds.has(e.entryId)) problems.add("duplicate-entry-id", i);
+    if (wf) seenIds.add(e.entryId);
+  }
+  const holdsErasureHash = new Array(n).fill(false);
+  let lastErasure = -1;
+  for (let i = 0; i < n; i++) {
+    if (!wellFormed[i]) continue;
+    const e = entries[i];
+    if (i === 0) {
+      if (e.globalSeq !== "0" || e.previousHash !== "") problems.add("first-entry", i);
+    } else if (wellFormed[i - 1]) {
+      const prev = entries[i - 1];
+      if (BigInt(e.globalSeq) !== BigInt(prev.globalSeq) + 1n)
+        problems.add("sequence", i);
+      if (e.previousHash !== prev.chainHash) problems.add("link", i);
+      if (e.contentHash === erasureHash(prev.globalSeq)) {
+        holdsErasureHash[i] = true;
+        lastErasure = i;
+      }
+    }
+    if (!hashesRecompute(e, format)) problems.add("chain-hash", i);
+  }
+  const E = lastErasure;
+  let events = 0;
+  let erasures = 0;
+  let opened = 0;
+  let committed = 0;
+  let erased = 0;
+  const genuineErasure = new Array(n).fill(false);
+  for (let i = 0; i < n; i++) {
+    const e = entries[i];
+    if (e.entryType === "sink.event") events++;
+    if (!wellFormed[i]) continue;
+    if (E >= 0 && i > E) {
+      problems.add("after-erasure", i);
+      continue;
+    }
+    if (disclosedBad[i]) continue;
+    if (holdsErasureHash[i]) {
+      if (e.entryType === "sink.erasure") {
+        genuineErasure[i] = true;
+        erasures++;
+      } else {
+        problems.add("erasure-invalid", i);
+      }
+    } else if (e.entryType === "sink.erasure") {
+      problems.add("erasure-invalid", i);
+    } else if (e.entryType === "sink.event") {
+      if (i < E) {
+        if (e.disclosed === void 0) erased++;
+        else problems.add("erased-event-disclosed", i);
+      } else if (e.disclosed === void 0) {
+        committed++;
+      } else {
+        const nonce = hexToUint8Array(e.disclosed.nonce);
+        const content = decodeCanonicalBase64(e.disclosed.content);
+        if (openCommitmentSync(nonce, content, e.contentHash)) opened++;
+        else problems.add("modified", i);
+      }
+    } else {
+      problems.add("entry-type", i);
+    }
+  }
+  const malformedAt = wellFormed.indexOf(false);
+  const firstMalformed = malformedAt === -1 ? n : malformedAt;
+  let passedCheckpoints = 0;
+  let covered = 0;
+  let prevAnchorId = SEED_ANCHOR_ID;
+  let prevAnchorHash = SEED_ANCHOR_HASH;
+  let prevCount = 0;
+  if (format === 2) {
+    let head = { anchorId: SEED_ANCHOR_ID, anchorHash: SEED_ANCHOR_HASH, count: 0n };
+    for (let k = 0; k < chain.checkpoints.length; k++) {
+      const step = checkCheckpointV7(chain.checkpoints[k], head, {
+        chainId,
+        chainIdValid,
+        entries,
+        firstMalformed,
+        trust,
+        limits
+      });
+      if (typeof step === "string") {
+        problems.add(step, k);
+        break;
+      }
+      head = step;
+      passedCheckpoints++;
+      covered = Number(step.count);
+    }
+  }
+  for (let k = 0; format === 1 && k < chain.checkpoints.length; k++) {
+    const cp = parseCheckpoint(chain.checkpoints[k], limits);
+    if (cp === null) {
+      problems.add("checkpoint-malformed", k);
+      break;
+    }
+    if (!chainIdValid || cp.subject !== chainId) {
+      problems.add("checkpoint-subject", k);
+      break;
+    }
+    if (cp.previousAnchorId !== prevAnchorId || cp.entryCount < 1 || cp.entryCount <= prevCount) {
+      problems.add("checkpoint-sequence", k);
+      break;
+    }
+    if (cp.entryCount > n) {
+      problems.add("checkpoint-overreach", k);
+      break;
+    }
+    const count = cp.entryCount;
+    let bound = count <= firstMalformed;
+    if (bound) {
+      const first = entries[0];
+      const tip = entries[count - 1];
+      bound = cp.startEntryId === first.entryId && cp.endEntryId === tip.entryId && cp.chainHash === anchorChainHashSync(
+        prevAnchorHash,
+        chainId,
+        cp.startEntryId,
+        cp.endEntryId,
+        tip.chainHash
+      );
+    }
+    if (!bound) {
+      problems.add("checkpoint-binding", k);
+      break;
+    }
+    if (checkpointTrust) {
+      const key = trust.checkpoint.get(cp.signingKeyId);
+      if (key === void 0) {
+        problems.add("checkpoint-unknown-key", k);
+        break;
+      }
+      if (!verifyMLDSA65Pure(key, checkpointCanonicalBytes(cp), cp.signature)) {
+        problems.add("checkpoint-bad-signature", k);
+        break;
+      }
+    }
+    passedCheckpoints++;
+    covered = count;
+    prevAnchorId = cp.anchorId;
+    prevAnchorHash = cp.chainHash;
+    prevCount = count;
+  }
+  let recordSignaturesPresent = 0;
+  const recordAuthenticated = new Array(n).fill(false);
+  for (let i = 0; i < n; i++) {
+    const e = entries[i];
+    const rs = e.recordSignature;
+    if (rs !== void 0) recordSignaturesPresent++;
+    if (!recordTrust) continue;
+    if (rs === void 0) {
+      problems.add("unsigned", i);
+      continue;
+    }
+    const signature = HEX_32.test(rs.keyId) ? decodeCanonicalBase64(rs.signature) : null;
+    if (signature === null || signature.length !== MLDSA65_SIGNATURE_SIZE2) {
+      problems.add("malformed-signature", i);
+      continue;
+    }
+    const key = trust.record.get(rs.keyId);
+    if (key === void 0) {
+      problems.add("unknown-key", i);
+      continue;
+    }
+    const envelopeBuildable = wellFormed[i] && chainIdValid && (e.entryType === "sink.event" || e.entryType === "sink.erasure") && e.previousHash === "" === (e.globalSeq === "0");
+    if (!envelopeBuildable) {
+      problems.add("bad-signature", i);
+      continue;
+    }
+    const fields = {
+      chainId,
+      entryId: e.entryId,
+      entryType: e.entryType,
+      globalSeq: e.globalSeq,
+      previousHash: e.previousHash,
+      timestamp: e.timestamp,
+      contentHash: e.contentHash,
+      signingKeyId: rs.keyId
+    };
+    const verified = format === 1 ? verifyMLDSA65Pure(key, buildRecordEnvelopeV1(fields), signature) : verifyMLDSA65PureWithContext(
+      key,
+      buildRecordEnvelopeV2({ ...fields, leafHash: e.leafHash }),
+      signature,
+      RECORD_CONTEXT_V2
+    );
+    if (verified) recordAuthenticated[i] = true;
+    else problems.add("bad-signature", i);
+  }
+  let authenticated = 0;
+  let checkpointAuthenticated = 0;
+  let recordAuthenticatedCount = 0;
+  const checkpointAuthenticatedAt = (i) => checkpointTrust && wellFormed[i] === true && i < covered;
+  for (let i = 0; i < n; i++) {
+    const byCheckpoint = checkpointAuthenticatedAt(i);
+    const byRecord = recordAuthenticated[i] === true;
+    if (byCheckpoint) checkpointAuthenticated++;
+    if (byRecord) recordAuthenticatedCount++;
+    if (byCheckpoint || byRecord) authenticated++;
+  }
+  let erasure = "none";
+  if (E >= 0 && genuineErasure[E]) {
+    if (problems.empty && checkpointAuthenticatedAt(E)) erasure = "anchored";
+    else if (problems.empty && recordAuthenticated[E]) erasure = "signed";
+    else erasure = "recorded";
+  }
+  const unauthenticated = n - authenticated;
+  const verdict = !problems.empty ? "failed" : unauthenticated > 0 ? "unauthenticated" : "ok";
+  return {
+    verdict,
+    erasure,
+    counts: {
+      entries: n,
+      events,
+      erasures,
+      opened,
+      committed,
+      erased,
+      checkpoints: passedCheckpoints,
+      unanchored: n - covered,
+      authenticated,
+      unauthenticated,
+      checkpoint_authenticated: checkpointAuthenticated,
+      record_authenticated: recordAuthenticatedCount,
+      record_signatures_present: recordSignaturesPresent
+    },
+    problems: problems.list()
+  };
+}
+function checkTrustShape(trust) {
+  const t = trust;
+  if (typeof t !== "object" || t === null || !Array.isArray(t.checkpointKeys) || !Array.isArray(t.recordKeys)) {
+    throw new ProofBundleVerifierError(
+      "trust must be an object with checkpointKeys and recordKeys arrays of Uint8Array"
+    );
+  }
+}
+async function keyMap(keys, role) {
+  const map = /* @__PURE__ */ new Map();
+  for (const key of keys) {
+    if (!(key instanceof Uint8Array) || key.length !== MLDSA65_PUBLIC_KEY_SIZE) {
+      throw new ProofBundleVerifierError(
+        `${role} trust: every key must be a raw ${MLDSA65_PUBLIC_KEY_SIZE}-byte ML-DSA-65 public key`
+      );
+    }
+    map.set(await keyIdMLDSA65(key), key);
+  }
+  return map;
+}
+async function verifyProofBundleWithLimits(bundle, trust, limits) {
+  if (!(bundle instanceof Uint8Array)) {
+    throw new ProofBundleVerifierError("bundle must be a Uint8Array");
+  }
+  checkTrustShape(trust);
+  const keys = {
+    checkpoint: await keyMap(trust.checkpointKeys, "checkpoint"),
+    record: await keyMap(trust.recordKeys, "record")
+  };
+  const read = readProofBundle(bundle, limits);
+  if (!read.ok)
+    return { result: PROOF_BUNDLE_RESULT_ID, readable: false, reason: read.reason };
+  const chains = read.chains;
+  const occurrences = /* @__PURE__ */ new Map();
+  for (const c of chains)
+    occurrences.set(c.chainId, (occurrences.get(c.chainId) ?? 0) + 1);
+  const bundleProblems = new ProblemSet();
+  const seen = /* @__PURE__ */ new Set();
+  chains.forEach((c, i) => {
+    if (seen.has(c.chainId)) bundleProblems.add("duplicate-chain", i);
+    seen.add(c.chainId);
+  });
+  const results = {};
+  let anyFailed = false;
+  let anyUnauthenticated = false;
+  for (let i = 0; i < chains.length; i++) {
+    const c = chains[i];
+    const r = verifyChain(c, keys, limits, read.format);
+    const keyedById = SINK_CHAIN_ID.test(c.chainId) && occurrences.get(c.chainId) === 1;
+    results[keyedById ? c.chainId : `#${i}`] = r;
+    if (r.verdict === "failed") anyFailed = true;
+    if (r.verdict === "unauthenticated") anyUnauthenticated = true;
+  }
+  const verdict = anyFailed || !bundleProblems.empty ? "failed" : anyUnauthenticated || chains.length === 0 ? "unauthenticated" : "ok";
+  return {
+    result: PROOF_BUNDLE_RESULT_ID,
+    readable: true,
+    checkpoint_trust: keys.checkpoint.size > 0 ? "checked" : "not_checked",
+    record_trust: keys.record.size > 0 ? "checked" : "not_checked",
+    verdict,
+    bundle_problems: bundleProblems.list(),
+    chains: results
+  };
+}
+function verifyProofBundle(bundle, trust) {
+  return verifyProofBundleWithLimits(bundle, trust, PROOF_BUNDLE_LIMITS);
+}
+async function keysTrustedForBothRoles(trust) {
+  checkTrustShape(trust);
+  const checkpoint = await keyMap(trust.checkpointKeys, "checkpoint");
+  const record = await keyMap(trust.recordKeys, "record");
+  return [...checkpoint.keys()].filter((id) => record.has(id)).sort();
+}
+
+// src/proofKeyFile.ts
+var ProofKeyFileError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ProofKeyFileError";
+    Object.setPrototypeOf(this, new.target.prototype);
+  }
+};
+var BEGIN = "-----BEGIN PUBLIC KEY-----";
+var END = "-----END PUBLIC KEY-----";
+var SPKI_SIZE = 4 + 13 + 5 + MLDSA65_PUBLIC_KEY_SIZE;
+var WHITESPACE_ONLY = /^[ \t\r\n]*$/;
+var BODY_LINE = /^[A-Za-z0-9+/=]+$/;
+function isAscii(bytes) {
+  for (const b of bytes) if (b > 127) return false;
+  return true;
+}
+function parseProofPublicKeyFile(bytes) {
+  if (!isAscii(bytes)) throw new ProofKeyFileError("key file: not an ASCII PEM file");
+  let text = "";
+  for (const b of bytes) text += String.fromCharCode(b);
+  const begin = text.indexOf(BEGIN);
+  if (begin < 0 || !WHITESPACE_ONLY.test(text.slice(0, begin))) {
+    throw new ProofKeyFileError(
+      "key file: not exactly one PEM block labelled PUBLIC KEY"
+    );
+  }
+  const afterBegin = begin + BEGIN.length;
+  const end = text.indexOf(END, afterBegin);
+  if (end < 0) throw new ProofKeyFileError("key file: PEM block not terminated");
+  if (!WHITESPACE_ONLY.test(text.slice(end + END.length))) {
+    throw new ProofKeyFileError(
+      "key file: something other than whitespace after the PEM block"
+    );
+  }
+  const inner = text.slice(afterBegin, end);
+  const lines = inner.split("\n");
+  if (lines.length < 3 || lines[0] !== "" && lines[0] !== "\r" || lines[lines.length - 1] !== "") {
+    throw new ProofKeyFileError("key file: malformed PEM body");
+  }
+  let body = "";
+  for (const raw of lines.slice(1, -1)) {
+    const line = raw.endsWith("\r") ? raw.slice(0, -1) : raw;
+    if (!BODY_LINE.test(line))
+      throw new ProofKeyFileError("key file: malformed PEM body");
+    body += line;
+  }
+  const der = decodeCanonicalBase64(body);
+  if (der === null) throw new ProofKeyFileError("key file: body is not canonical base64");
+  if (der.length !== SPKI_SIZE) {
+    throw new ProofKeyFileError("key file: not the SPKI of an ML-DSA-65 public key");
+  }
+  const key = der.slice(SPKI_SIZE - MLDSA65_PUBLIC_KEY_SIZE);
+  const expected = mldsa65Spki(key);
+  for (let i = 0; i < SPKI_SIZE; i++) {
+    if (der[i] !== expected[i]) {
+      throw new ProofKeyFileError("key file: not the SPKI of an ML-DSA-65 public key");
+    }
+  }
+  return key;
+}
+
+// src/fixtures/trust-root-dev.json
+var trust_root_dev_default = { public_key_b64: "R+dFhtvIZmQtyLr2S3xal9jvJAcfihEtBBuEclDzwxsIPWO1N3mkxAPIr/NUnVQllItEDs1Rtp3idRUT/qDULpnQr37XYivMrPbv35tjM9BELAQ17B1TPk//sacNZQ/6Utfp7YzawCEfnvMnqdQNJuWxgxGSIce+wzh5WsgPWDDGmCHgBrxDQKx0D9/AyTcbWq2E+qhe8kxVXm9Nitsz59vO4N/Ru6H3WrZAIhFFAiLpDYi0Sth8jPuwMr8kLHcbPwVkMbxlTbd+dUQYUL5URm/COlMWxogKSkpLhkEQdlS+ibamwdV8sSydSricaDkezeCCuzKZEHd5k09GBTN+UMmwo1RzB+Aq5G+9FhSvm9rj4r8zyu7zEVA4iBwM9vofVQ14+SDgcMbUBtQkqqsKri7IPeQ8QAyybztBIMA4DeUtYWmI1d65mqPH2EqoxAqVno/q6oQdPrrBo0zBeR71S420AXULV3rZymVjYFxTz5gv4A1myVsIbjEoh3k5Zv6Akp7fvjkhgYOyg37JSJn193chl9nCkUSWMr8oh/psY6u++oHycOkSe+HZgbZ4iFoCnh5KeOGrbs5v9iuuaEaesB1woJArCGI/OC6w7cvHITUw805YxNaW4xOCGWyZHp0IBUUYsUtJkm95qF07poIlXpVOOxDhAUtyaTShqGEcD65TN+V6+uYmF/oAtB8c1W+SCHwE5NWIeTN6GS4fNPD9pjRJ/BoxywGec+1CgMSamje/8gNI9HHGACTT8gc5rIQzeGJeHbA+M7eCUU7S9PPmIM+b0nTPdT3U8UV71NfiKxI5kz2wwRF9+DQiTchqZDW1YZtLWKZil91lu49Vl/OQLj1N28epsb+8xdCNW2nge+0Mf7T5NuQlJbDGkCltKM00lMLHqxvUwZK3Wm/25ih6CiEPJ1WMN53Ng8V7AbpmTIWUi4cosjsnffIKinEYO/ncuUrIfHgFPweZu1U/kZpgCfO8QxsneG7ro1dqpSa5/AHQi1/GuOe1NngaQefvz07sReR4DIEiUcbG77/Z923uVPBuEta5fYZFBEsQTc8zWfTg581tMW6Qog1Nn2pVr4PqSbHx7PUWgoegCfs0aRAEe1VR3yvuagPJwjMZ9UrwjAqW+7MIGZYtGVzn7Wx1Xlr/M0hLH/rATyPBTPESQNRFEuZUqIcyzuVr3vkNtaZnZC8xbKaOKt3S55BxQeUsprESq/T7CiVRU5IqpyzfpSp6fhRJiC+J+lDzw5jU3xyUb85FFLbOHPAyBMjVSeKXj2Pmfq89yaMxeGVS6ntdrgeD8WBd+echHhLtyuLSIgBtaD6I02IhT5YubpQ69MUsvaSZe1gpvRJ4sQUSjiy4kVbEbt8AYmzvWv7oheVA5N7kJPg0clFhDWvR7fgHA9W+L9tyUi8NAro02+n6hSnJQx9EtWbtLyYGP9pZJeqwjgxtpdtZDTnWTpMxwTqFHbebElUS1YyRHOkr/94kpFB4FxdrujPFNCv/udvJh1fWLTloEiJgX853WHUzQLbMCddeFjELaZgZIYZlVylW+h3jB6S0pGrb+RYmeJY4GNHcGpz7oz0DzV7zZVh4UMKQiQTQE/P04iysJo0Y7p01na+evgNxX3rQamzP5V2P40TfCJhdM+A/DiTsJ0C2B2PhMz46DdzuRngFWF831fg16lgqaIl00jK5UR4iIxNLdGmwlwxpWO5K5KXE/ETcVdKcqPI6IX8alvHbJJhNXUmV7znA2fRIeXY1w1VLMxTdgVgCa4e7+saXrcdIxSK5B7LcAHaV2/vX/6aFO29Kd2lxjlO7qHGjgOAw3rxz2EqA9m06VH4MsOvhNOgme1nPAH2aICN8ZphN2RSE0GqbCccKi8uTfZL943ZcZApgPXNImEMneiXr2gw62Z7zAs7rYXRE1bRby/VugLmR1G95SH6Zyy0n2nXoG0JFyNkMIWGIByoFTjodx1Jw5Pq1xheHi+14UIqHHWwVEj7mpREpBAOcAC0Ul2L1OJtmVq826WJaBzBf+zfoUr7upW4ZK1uUa2f2XFoKUxsxIBF8FosKiMRnqM6MBHveLJnQD2bQXwd4EYCPSc8m5aPBYDfNIwjqLmtIn1taFYJ6V7S78WTgzT5q+Uhj/rLA7g33JYSiD8YS2ahoKFJpNpNEDv9Xl/cQRfkbvikNVNfXy/MG9S7jgGrwnx6epnTFZJMKRXpOqmx+7ImrhEk9Xmji0QR9Roo3AY0u4x4ZhNxJJVjoD3nHlzuFAy3+kpatHdC2l1HOe7fR0QygIrG1Tg44vXMi4igxA2hwK+7MKwldLsQ/bgMO1FMkYkhnH+N3tFj2rEXBhsXLiU3+Diwz44U8mjoegYu7GDQwLSsOtWTkILUJgmdnQcWOwbepy1/2qikglXWmNZj0ekLaOIO+bUq3hn9LP6nBWf4jmMZP1jUI/XvBKw1bCvbCb0dzxFdwLsoiHyAEqVdzdeyhjDdQyAYYzy0V6ASyzHg9lMZXgYdwY0ao+lJaR+mNcmGpQ7YNugIC/cpcZ2lGCN/4sZCcDM6zguWhkjuy9sVwLNGbvoFZQuEwZpcMxeKteQzKFZokXE5j/naVBlLaH4K+hBaAxbI=" };
+
+// src/fixtures/trust-root-staging.json
+var trust_root_staging_default = { public_key_b64: "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=" };
+
+// src/fixtures/trust-root-prod.json
+var trust_root_prod_default = { public_key_b64: "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=" };
+
+// src/trustManifest.ts
+var MLDSA65_PUBLIC_KEY_SIZE3 = 1952;
+function selectTrustRootEnv() {
+  const env = typeof process !== "undefined" && process.env && process.env.ALEUTIAN_ENV ? process.env.ALEUTIAN_ENV : "dev";
+  if (env === "prod" || env === "staging" || env === "dev") {
+    return env;
+  }
+  return "dev";
+}
+function loadTrustRootFixture(env) {
+  const fixture = env === "prod" ? trust_root_prod_default : env === "staging" ? trust_root_staging_default : trust_root_dev_default;
+  const b64 = fixture.public_key_b64;
+  const raw = base64ToUint8(b64);
+  if (raw.length !== MLDSA65_PUBLIC_KEY_SIZE3) {
+    throw new Error(
+      `verification: fixtures/trust-root-${env}.json yielded ${raw.length} bytes; want ${MLDSA65_PUBLIC_KEY_SIZE3}. Re-run 15n_fix_A4 Step 2 for ${env}.`
+    );
+  }
+  return raw;
+}
+var ACTIVE_TRUST_ENV = selectTrustRootEnv();
+var TRUST_ROOT_PUBLIC_KEY = loadTrustRootFixture(
+  ACTIVE_TRUST_ENV
+);
+var TrustManifestError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "TrustManifestError";
+  }
+};
+var ManifestMalformedError = class extends TrustManifestError {
+  constructor(message) {
+    super(message, "manifest_malformed");
+    this.name = "ManifestMalformedError";
+  }
+};
+var ManifestRootSignatureError = class extends TrustManifestError {
+  constructor(message) {
+    super(message, "manifest_root_signature");
+    this.name = "ManifestRootSignatureError";
+  }
+};
+function parseAndVerifyTrustManifest(raw) {
+  const text = typeof raw === "string" ? raw : new TextDecoder().decode(raw);
+  return parseVerifyAndIndex(text);
+}
+function parseVerifyAndIndex(rawText) {
+  let parsed;
+  try {
+    parsed = JSON.parse(rawText);
+  } catch (e) {
+    throw new ManifestMalformedError(
+      `JSON parse: ${e.message}`
+    );
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new ManifestMalformedError("manifest root is not a JSON object");
+  }
+  const body = parsed;
+  const sigB64 = body.root_signature_b64;
+  if (!sigB64 || typeof sigB64 !== "string") {
+    throw new ManifestMalformedError(
+      "missing or non-string root_signature_b64"
+    );
+  }
+  let sig;
+  try {
+    sig = base64ToUint8(sigB64);
+  } catch (e) {
+    throw new ManifestMalformedError(
+      `root_signature_b64 not base64: ${e.message}`
+    );
+  }
+  const bodySansSig = { ...body };
+  delete bodySansSig.root_signature_b64;
+  const canonical = canonicalJson(bodySansSig);
+  const canonicalBytes = new TextEncoder().encode(canonical);
+  try {
+    const ok = ml_dsa65.verify(sig, canonicalBytes, TRUST_ROOT_PUBLIC_KEY);
+    if (!ok) {
+      throw new Error("ml_dsa65.verify returned false");
+    }
+  } catch (e) {
+    throw new ManifestRootSignatureError(
+      `verify against pinned root: ${e.message ?? e}`
+    );
+  }
+  const platformKeys = (body.platform_keys ?? []).map(parseEntry);
+  const tenantKeys = (body.tenant_keys ?? []).map(parseEntry);
+  const keys = /* @__PURE__ */ new Map();
+  for (const e of [...platformKeys, ...tenantKeys]) {
+    if (e.revokedAtMs !== null) continue;
+    if (!e.publicKeyB64) continue;
+    try {
+      keys.set(e.keyId, base64ToUint8(e.publicKeyB64));
+    } catch (err) {
+      throw new ManifestMalformedError(
+        `entry ${e.keyId}: public_key_b64 not base64: ${err.message}`
+      );
+    }
+  }
+  const generatedAtMs = numberFromBody(body.generated_at_ms);
+  const manifest = Object.freeze({
+    version: numberFromBody(body.version),
+    generatedAt: new Date(generatedAtMs),
+    env: stringFromBody(body.env),
+    approvedBy: stringFromBody(body.approved_by),
+    rootKeyId: stringFromBody(body.root_key_id),
+    schemaNote: stringFromBody(body.schema_note),
+    platformKeys: Object.freeze(platformKeys),
+    tenantKeys: Object.freeze(tenantKeys),
+    publicKey(keyId) {
+      const k = keys.get(keyId);
+      return k ? new Uint8Array(k) : void 0;
+    },
+    keyIds() {
+      return Array.from(keys.keys()).sort();
+    }
+  });
+  return manifest;
+}
+function parseEntry(raw) {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new ManifestMalformedError("entry is not a JSON object");
+  }
+  const e = raw;
+  return Object.freeze({
+    keyId: stringFromBody(e.key_id),
+    kmsKeyVersion: stringFromBody(e.kms_key_version),
+    publicKeyB64: stringFromBody(e.public_key_b64),
+    algorithm: stringFromBody(e.algorithm),
+    addedAtMs: numberFromBody(e.added_at_ms),
+    revokedAtMs: e.revoked_at_ms == null ? null : numberFromBody(e.revoked_at_ms),
+    notAfterMs: e.not_after_ms == null ? null : numberFromBody(e.not_after_ms),
+    tenantId: stringFromBody(e.tenant_id)
+  });
+}
+function stringFromBody(v) {
+  if (typeof v === "string") return v;
+  if (v == null) return "";
+  return String(v);
+}
+function numberFromBody(v) {
+  if (typeof v === "number") return v;
+  if (typeof v === "string") {
+    const n = Number(v);
+    if (Number.isFinite(n)) return n;
+  }
+  return 0;
+}
+function canonicalJson(value) {
+  return writeCanonical(value);
+}
+function writeCanonical(v) {
+  if (v === null) return "null";
+  if (typeof v === "boolean") return v ? "true" : "false";
+  if (typeof v === "number") {
+    if (!Number.isFinite(v)) {
+      throw new ManifestMalformedError(
+        `canonicalJson: non-finite number ${v}`
+      );
+    }
+    return JSON.stringify(v);
+  }
+  if (typeof v === "string") {
+    return JSON.stringify(v);
+  }
+  if (Array.isArray(v)) {
+    return "[" + v.map(writeCanonical).join(",") + "]";
+  }
+  if (typeof v === "object") {
+    const obj = v;
+    const keys = Object.keys(obj).sort();
+    const parts = keys.map(
+      (k) => JSON.stringify(k) + ":" + writeCanonical(obj[k])
+    );
+    return "{" + parts.join(",") + "}";
+  }
+  throw new ManifestMalformedError(
+    `canonicalJson: unsupported type ${typeof v}`
+  );
+}
+function base64ToUint8(b64) {
+  if (typeof atob === "function") {
+    const bin = atob(b64);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+    return out;
+  }
+  const buf = globalThis.Buffer.from(b64, "base64");
+  return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
+}
+var PROOF_BUNDLE_EXIT = Object.freeze({
+  ok: 0,
+  failed: 1,
+  usage: 2,
+  unreadable: 3,
+  unauthenticated: 4,
+  internal: 5
+});
+var PROCESS_IO = {
+  stdout: (text) => void process.stdout.write(text),
+  stderr: (text) => void process.stderr.write(text)
+};
+var USAGE = [
+  "usage: aleutian-verify verify-proof-bundle <bundle.json> [--checkpoint-key F]... [--record-key F]... [--json]",
+  "",
+  "Verify a proof sink export bundle (aleutian.proof.bundle.v1 or .v2) under the keys you trust.",
+  "  --checkpoint-key F  a PEM public key trusted for checkpoints (repeatable)",
+  "  --record-key F      a PEM public key trusted for record signatures (repeatable)",
+  "  --json              print exactly the aleutian.proof.bundle-result.v1 JSON",
+  "Exit 0 ok, 1 failed, 2 usage, 3 unreadable bundle, 4 unauthenticated, 5 internal error.",
+  ""
+].join("\n");
+var LIMITS_LINE = "Limits (bundle-format \xA71): a pass does not prove that the bundle holds every chain, that a chain is complete to its end, that erased content is gone anywhere, that timestamps are true time, or which sink a chain came from; it proves nothing against a writer who controls the evidence and every key you trust, and nothing about what happened after the export.";
+var UsageError = class extends Error {
+};
+var MAX_KEY_FILE_BYTES = 16 * 1024;
+function parseArgs(args) {
+  let bundlePath;
+  const checkpointKeyPaths = [];
+  const recordKeyPaths = [];
+  let json = false;
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    const value = () => {
+      const v = args[i + 1];
+      if (v === void 0) throw new UsageError(`${arg} requires a file`);
+      i++;
+      return v;
+    };
+    if (arg === "--checkpoint-key") checkpointKeyPaths.push(value());
+    else if (arg === "--record-key") recordKeyPaths.push(value());
+    else if (arg === "--json") json = true;
+    else if (arg.startsWith("-")) throw new UsageError(`unknown flag: ${arg}`);
+    else if (bundlePath === void 0) bundlePath = arg;
+    else throw new UsageError("exactly one bundle file is required");
+  }
+  if (bundlePath === void 0) throw new UsageError("a bundle file is required");
+  return { bundlePath, checkpointKeyPaths, recordKeyPaths, json };
+}
+async function loadKey(path) {
+  let bytes;
+  try {
+    const info = await stat(path);
+    if (!info.isFile()) throw new UsageError(`key file is not a regular file: ${path}`);
+    if (info.size > MAX_KEY_FILE_BYTES) {
+      throw new UsageError(
+        `key file is larger than ${MAX_KEY_FILE_BYTES} bytes: ${path}`
+      );
+    }
+    bytes = await readFile(path);
+  } catch (err) {
+    if (err instanceof UsageError) throw err;
+    throw new UsageError(`cannot read key file ${path}`);
+  }
+  if (bytes.length > MAX_KEY_FILE_BYTES) {
+    throw new UsageError(`key file is larger than ${MAX_KEY_FILE_BYTES} bytes: ${path}`);
+  }
+  try {
+    return parseProofPublicKeyFile(bytes);
+  } catch (err) {
+    if (err instanceof ProofKeyFileError)
+      throw new UsageError(`invalid key file ${path}: ${err.message}`);
+    throw err;
+  }
+}
+async function loadBundle(path) {
+  const limit = PROOF_BUNDLE_LIMITS.bundleBytes;
+  let handle;
+  try {
+    handle = await open(path, constants.O_RDONLY | (constants.O_NONBLOCK ?? 0));
+  } catch {
+    throw new UsageError(`cannot read bundle file ${path}`);
+  }
+  try {
+    const info = await handle.stat();
+    if (!info.isFile()) throw new UsageError(`not a regular file: ${path}`);
+    if (info.size > limit) return null;
+    const cap = limit + 1;
+    let buf = new Uint8Array(Math.min(info.size + 1, cap));
+    let n = 0;
+    for (; ; ) {
+      if (n === buf.length) {
+        if (buf.length >= cap) break;
+        const grown = new Uint8Array(Math.min(buf.length * 2, cap));
+        grown.set(buf);
+        buf = grown;
+      }
+      const { bytesRead } = await handle.read(buf, n, buf.length - n, null);
+      if (bytesRead === 0) break;
+      n += bytesRead;
+    }
+    return n > limit ? null : buf.subarray(0, n);
+  } catch (err) {
+    if (err instanceof UsageError) throw err;
+    throw new UsageError(`cannot read bundle file ${path}`);
+  } finally {
+    await handle.close().catch(() => void 0);
+  }
+}
+function exitCode(result) {
+  if (!result.readable) return PROOF_BUNDLE_EXIT.unreadable;
+  if (result.verdict === "failed") return PROOF_BUNDLE_EXIT.failed;
+  if (result.verdict === "unauthenticated") return PROOF_BUNDLE_EXIT.unauthenticated;
+  return PROOF_BUNDLE_EXIT.ok;
+}
+function problemsText(problems, indexLabel) {
+  return problems.map(
+    (p) => `${p.code} x${p.count}${p.first === null ? "" : ` (first at ${indexLabel} ${p.first})`}`
+  ).join(", ");
+}
+function chainLine(key, r) {
+  const c = r.counts;
+  const lines = [
+    `  ${key}: ${r.verdict.toUpperCase()}, erasure ${r.erasure}; ${c.entries} entries (${c.authenticated} authenticated, ${c.unauthenticated} unauthenticated), ${c.checkpoints} checkpoints, ${c.unanchored} unanchored`
+  ];
+  if (r.problems.length > 0) {
+    lines.push(`    problems: ${problemsText(r.problems, "index")}`);
+  }
+  return lines;
+}
+function unreadableText(reason, trust) {
+  return [
+    `Proof bundle: UNREADABLE (${reason})`,
+    `Checkpoint trust: NOT CHECKED (the bundle is unreadable; ${trust.checkpointKeys.length} key(s) supplied)`,
+    `Record trust: NOT CHECKED (the bundle is unreadable; ${trust.recordKeys.length} key(s) supplied)`,
+    LIMITS_LINE,
+    ""
+  ].join("\n");
+}
+function humanReadable(result, trust) {
+  const chains = Object.entries(result.chains);
+  const signaturesPresent = chains.reduce(
+    (n, [, r]) => n + r.counts.record_signatures_present,
+    0
+  );
+  const tally = { ok: 0, unauthenticated: 0, failed: 0 };
+  for (const [, r] of chains) tally[r.verdict]++;
+  const lines = [`Proof bundle: ${result.verdict.toUpperCase()}`];
+  lines.push(
+    result.checkpoint_trust === "checked" ? `Checkpoint trust: CHECKED (${trust.checkpointKeys.length} key(s))` : "Checkpoint trust: NOT CHECKED (checkpoints checked for structure only; they authenticate nothing)"
+  );
+  lines.push(
+    result.record_trust === "checked" ? `Record trust: CHECKED (${trust.recordKeys.length} key(s))` : `Record trust: NOT CHECKED (${signaturesPresent} entries carry record signatures; none were verified)`
+  );
+  if (result.bundle_problems.length > 0) {
+    lines.push(`Bundle problems: ${problemsText(result.bundle_problems, "chain")}`);
+  }
+  lines.push(
+    `Chains: ${chains.length} (ok ${tally.ok}, unauthenticated ${tally.unauthenticated}, failed ${tally.failed})`
+  );
+  if (chains.length === 0) lines.push("  (no chains: an empty bundle proves nothing)");
+  for (const [key, r] of chains) lines.push(...chainLine(key, r));
+  lines.push(LIMITS_LINE);
+  return lines.join("\n") + "\n";
+}
+async function runVerifyProofBundle(argv, io = PROCESS_IO) {
+  if (argv.includes("--help") || argv.includes("-h")) {
+    io.stdout(USAGE);
+    return PROOF_BUNDLE_EXIT.ok;
+  }
+  try {
+    const args = parseArgs(argv);
+    const trust = {
+      checkpointKeys: await Promise.all(args.checkpointKeyPaths.map(loadKey)),
+      recordKeys: await Promise.all(args.recordKeyPaths.map(loadKey))
+    };
+    const bytes = await loadBundle(args.bundlePath);
+    for (const id of await keysTrustedForBothRoles(trust)) {
+      io.stderr(
+        `warning: key ${id} is trusted for both checkpoints and records; one key for both roles means one compromise forges both
+`
+      );
+    }
+    const result = bytes === null ? { result: PROOF_BUNDLE_RESULT_ID, readable: false, reason: "too-large" } : await verifyProofBundle(bytes, trust);
+    if (args.json) {
+      io.stdout(JSON.stringify(result) + "\n");
+    } else if (!result.readable) {
+      io.stdout(unreadableText(result.reason, trust));
+    } else {
+      io.stdout(humanReadable(result, trust));
+    }
+    return exitCode(result);
+  } catch (err) {
+    if (err instanceof UsageError) {
+      io.stderr(`${err.message}
+${USAGE}`);
+      return PROOF_BUNDLE_EXIT.usage;
+    }
+    io.stderr("internal error in the verifier: no verdict on the bundle\n");
+    return PROOF_BUNDLE_EXIT.internal;
+  }
+}
+
+// src/cli/verifyBundle.ts
+var INTERFACE_NAME = "js-sdk";
+var EXIT_VALID = 0;
+var EXIT_INVALID = 1;
+var EXIT_USAGE = 2;
+var EXIT_IO_OR_PARSE = 3;
+async function main(argv) {
+  if (argv.length === 0 || argv[0] === "--help" || argv[0] === "-h") {
+    printUsage();
+    return argv[0] ? EXIT_VALID : EXIT_USAGE;
+  }
+  if (argv[0] === "verify-proof-bundle") {
+    return runVerifyProofBundle(argv.slice(1));
+  }
+  if (argv[0] !== "verify") {
+    process.stderr.write(`unknown command: ${argv[0]}
+`);
+    printUsage();
+    return EXIT_USAGE;
+  }
+  let parsed;
+  try {
+    parsed = parseArgs2(argv.slice(1));
+  } catch (err) {
+    process.stderr.write(`${err.message}
+`);
+    printUsage();
+    return EXIT_USAGE;
+  }
+  return runVerify(parsed);
+}
+async function runVerify(args) {
+  const bundleSha = await safeSha256(args.entriesPath);
+  const manifestBlock = await loadManifestAdvisory(args.manifestPath);
+  let anchor;
+  let entries;
+  try {
+    anchor = await loadAnchor(args.anchorPath);
+    entries = await loadExportedEntries(args.entriesPath);
+  } catch (err) {
+    emitResult({
+      status: "invalid",
+      chain_length: 0,
+      bundle_sha256: bundleSha,
+      reason: `load: ${err.message}`,
+      manifest: manifestBlock
+    });
+    return EXIT_IO_OR_PARSE;
+  }
+  let result;
+  try {
+    result = await verifyChainOffline(entries, {
+      anchor,
+      previousAnchorHash: args.previousAnchorHash,
+      maxEntries: args.maxEntries,
+      maxBreaks: 100
+    });
+  } catch (err) {
+    emitResult({
+      status: "invalid",
+      chain_length: 0,
+      bundle_sha256: bundleSha,
+      reason: `verify: ${err.message}`,
+      manifest: manifestBlock
+    });
+    return EXIT_IO_OR_PARSE;
+  }
+  const exposed = result.tombstonesFound > 0 ? {
+    tombstones: result.tombstonesFound,
+    entries_not_bound: result.entriesNotVerified,
+    note: notVerifiedNote(result.entriesNotVerified, result.valid)
+  } : {};
+  if (result.valid) {
+    emitResult({
+      status: "valid",
+      chain_length: result.entriesProcessed,
+      bundle_sha256: bundleSha,
+      manifest: manifestBlock,
+      ...exposed
+    });
+    return EXIT_VALID;
+  }
+  const firstBreak = result.breaks[0];
+  const reason = firstBreak ? `${firstBreak.breakType} at position ${firstBreak.position}` : "unspecified verification failure";
+  emitResult({
+    status: "invalid",
+    chain_length: result.entriesProcessed,
+    bundle_sha256: bundleSha,
+    reason,
+    breaks: result.breaks.map((b) => ({
+      position: b.position,
+      entry_id: b.entryId,
+      break_type: b.breakType
+    })),
+    manifest: manifestBlock,
+    ...exposed
+  });
+  return EXIT_INVALID;
+}
+function notVerifiedNote(entriesNotVerified, valid) {
+  const which = entriesNotVerified === 1 ? "entry 0 (the last tombstone)" : `entries 0 to ${entriesNotVerified - 1} (up to and including the last tombstone)`;
+  const are = entriesNotVerified === 1 ? "is" : "are";
+  return valid ? `${which} ${are} NOT verified and NOT bound by the anchor; status covers only the entries after` : `${which} ${are} NOT verified and NOT bound by the anchor`;
+}
+async function loadManifestAdvisory(manifestPath) {
+  if (manifestPath === void 0) return void 0;
+  let raw;
+  try {
+    raw = await readFile(manifestPath, "utf-8");
+  } catch (err) {
+    return { error: `read manifest: ${err.message}` };
+  }
+  try {
+    const manifest = parseAndVerifyTrustManifest(raw);
+    const f = evaluateManifestFreshness(
+      manifest.version,
+      manifest.generatedAt.getTime(),
+      Date.now(),
+      -1
+    );
+    return {
+      version: f.version,
+      generated_at: manifestGeneratedDate(f),
+      age_days: f.ageDays,
+      stale: f.stale,
+      revocation_note: manifestRevocationNote(f)
+    };
+  } catch (err) {
+    return { error: `verify manifest: ${err.message}` };
+  }
+}
+function emitResult(r) {
+  const out = {
+    bundle_sha256: r.bundle_sha256,
+    chain_length: r.chain_length,
+    interface: INTERFACE_NAME,
+    status: r.status
+  };
+  if (r.reason !== void 0) out.reason = r.reason;
+  if (r.breaks && r.breaks.length > 0) out.breaks = r.breaks;
+  if (r.manifest !== void 0) out.manifest = r.manifest;
+  if (r.tombstones !== void 0) out.tombstones = r.tombstones;
+  if (r.entries_not_bound !== void 0) out.entries_not_bound = r.entries_not_bound;
+  if (r.note !== void 0) out.note = r.note;
+  const sortedKeys = Object.keys(out).sort();
+  const sorted = {};
+  for (const k of sortedKeys) sorted[k] = out[k];
+  process.stdout.write(`${JSON.stringify(sorted)}
+`);
+}
+function parseArgs2(args) {
+  let anchorPath;
+  let entriesPath;
+  let previousAnchorHash = "";
+  let maxEntries = 0;
+  let manifestPath;
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    const next = () => {
+      const v = args[i + 1];
+      if (v === void 0) throw new Error(`${arg} requires a value`);
+      i++;
+      return v;
+    };
+    switch (arg) {
+      case "--anchor":
+        anchorPath = next();
+        break;
+      case "--entries":
+        entriesPath = next();
+        break;
+      case "--previous-anchor-hash":
+        previousAnchorHash = next();
+        break;
+      case "--max-entries":
+        maxEntries = Number.parseInt(next(), 10);
+        if (Number.isNaN(maxEntries) || maxEntries < 0) {
+          throw new Error("--max-entries must be a non-negative integer");
+        }
+        break;
+      case "--manifest":
+        manifestPath = next();
+        break;
+      default:
+        throw new Error(`unknown flag: ${arg}`);
+    }
+  }
+  if (!anchorPath) throw new Error("--anchor is required");
+  if (!entriesPath) throw new Error("--entries is required");
+  return {
+    anchorPath,
+    entriesPath,
+    previousAnchorHash,
+    maxEntries,
+    manifestPath
+  };
+}
+function printUsage() {
+  process.stderr.write(
+    [
+      "usage: aleutian-verify verify --anchor PATH --entries PATH [--max-entries N]",
+      "",
+      "Verify an extracted chain export (anchor + entries JSON/JSONL).",
+      "Emits a single JSON line to stdout matching the locked contract.",
+      "Exit 0 = valid, 1 = invalid, 2 = usage error, 3 = IO/parse error.",
+      "",
+      "usage: aleutian-verify verify-proof-bundle <bundle.json> [--checkpoint-key F]... [--record-key F]... [--json]",
+      "",
+      "Verify a proof sink export bundle under the keys you trust (see --help on the verb).",
+      ""
+    ].join("\n")
+  );
+}
+async function safeSha256(path) {
+  try {
+    const h = createHash("sha256");
+    await new Promise((resolve, reject) => {
+      const stream = createReadStream(path);
+      stream.on("data", (chunk) => h.update(chunk));
+      stream.on("end", () => resolve());
+      stream.on("error", (err) => reject(err));
+    });
+    return h.digest("hex");
+  } catch {
+    return "";
+  }
+}
+
+// src/cli/aleutian-verify.ts
+main(process.argv.slice(2)).then(
+  (code) => {
+    process.exitCode = code;
+  },
+  () => {
+    process.stderr.write("internal error in the verifier\n");
+    process.exitCode = 5;
+  }
+);
+//# sourceMappingURL=aleutian-verify.js.map
+//# sourceMappingURL=aleutian-verify.js.map