@moonglade/provenance 0.0.0-stage → 2.6.0

package/dist/timestamp.js

@@ -0,0 +1,1103 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PKI_STATUS_TEXT = exports.globalCircuitBreaker = exports.EndpointCircuitBreaker = exports.DEFAULT_SERVER_POLICIES = exports.DEFAULT_NETWORK_HOSTS = exports.DEFAULT_FALLBACK_TSAS = exports.DEFAULT_PRIMARY_TSAS = exports.TIER_CONFIGS = void 0;
+exports.encodeDerLength = encodeDerLength;
+exports.encodeDerSequence = encodeDerSequence;
+exports.decodeDerLength = decodeDerLength;
+exports.parsePkiStatus = parsePkiStatus;
+exports.validateTimeStampResp = validateTimeStampResp;
+exports.verifyTimeStampToken = verifyTimeStampToken;
+exports.buildTimeStampReq = buildTimeStampReq;
+exports.extractGenTime = extractGenTime;
+exports.queryTsa = queryTsa;
+exports.probeTsa = probeTsa;
+exports.parseHttpDate = parseHttpDate;
+exports.probeNetworkTime = probeNetworkTime;
+exports.resolveNetworkConsensus = resolveNetworkConsensus;
+exports.concurrentDegradingTimestamp = concurrentDegradingTimestamp;
+const http = __importStar(require("http"));
+const https = __importStar(require("https"));
+const crypto = __importStar(require("crypto"));
+const pkijs = __importStar(require("pkijs"));
+const asn1js = __importStar(require("asn1js"));
+exports.TIER_CONFIGS = {
+    L1: {
+        default: 'http://timestamp.digicert.com',
+        fallbacks: [
+            'http://timestamp.sectigo.com',
+            'http://timestamp.globalsign.com/tsa/r6advanced1',
+            'http://timestamp.entrust.net/TSS/RFC3161sha2TS',
+            'http://time.certum.pl'
+        ]
+    },
+    L2: {
+        default: 'http://timestamp.apple.com/ts01',
+        fallbacks: [
+            'http://ts.quovadisglobal.com/eu',
+            'https://freetsa.org/tsr'
+        ]
+    },
+    L3: {
+        default: 'cloudflare.com',
+        fallbacks: [
+            'google.com',
+            'apple.com',
+            'amazon.com'
+        ]
+    }
+};
+exports.DEFAULT_PRIMARY_TSAS = [
+    exports.TIER_CONFIGS.L1.default,
+    ...exports.TIER_CONFIGS.L1.fallbacks
+];
+exports.DEFAULT_FALLBACK_TSAS = [
+    exports.TIER_CONFIGS.L2.default,
+    ...exports.TIER_CONFIGS.L2.fallbacks
+];
+exports.DEFAULT_NETWORK_HOSTS = [
+    exports.TIER_CONFIGS.L3.default,
+    ...exports.TIER_CONFIGS.L3.fallbacks
+];
+exports.DEFAULT_SERVER_POLICIES = [
+    // Tier 1 Primary
+    { url: 'http://timestamp.digicert.com', name: 'DigiCert', tier: 'L1_CRYPTO_PRIMARY', minIntervalMs: 1000 },
+    { url: 'http://timestamp.sectigo.com', name: 'Sectigo', tier: 'L1_CRYPTO_PRIMARY', minIntervalMs: 1000 },
+    { url: 'http://timestamp.globalsign.com/tsa/r6advanced1', name: 'GlobalSign', tier: 'L1_CRYPTO_PRIMARY', minIntervalMs: 1000 },
+    { url: 'http://timestamp.entrust.net/TSS/RFC3161sha2TS', name: 'Entrust', tier: 'L1_CRYPTO_PRIMARY', minIntervalMs: 1000 },
+    { url: 'http://time.certum.pl', name: 'Certum', tier: 'L1_CRYPTO_PRIMARY', minIntervalMs: 1000 },
+    // Tier 2 Fallback
+    { url: 'http://timestamp.apple.com/ts01', name: 'Apple', tier: 'L2_CRYPTO_FALLBACK', minIntervalMs: 1000 },
+    { url: 'http://ts.quovadisglobal.com/eu', name: 'QuoVadis', tier: 'L2_CRYPTO_FALLBACK', minIntervalMs: 1000 },
+    { url: 'https://freetsa.org/tsr', name: 'FreeTSA', tier: 'L2_CRYPTO_FALLBACK', minIntervalMs: 15000 }, // FreeTSA 15s policy
+    // Tier 3 Network Consensus
+    { url: 'cloudflare.com', name: 'Cloudflare', tier: 'L3_NETWORK_CONSENSUS', minIntervalMs: 500 },
+    { url: 'google.com', name: 'Google', tier: 'L3_NETWORK_CONSENSUS', minIntervalMs: 500 }
+];
+/**
+ * Circuit breaker & Server Pool Manager.
+ * Manages:
+ * 1. Endpoint health and consecutive failure tracking
+ * 2. Exponential backoff for failing/down servers
+ * 3. Individual server policies (e.g. FreeTSA 15s rate-limit cooldown)
+ * 4. Fair round-robin rotation queue ("who's next")
+ * 5. Telemetry for ready vs disabled/cooldown servers
+ */
+class EndpointCircuitBreaker {
+    health = new Map();
+    policies = new Map();
+    queuePointers = new Map();
+    baseBackoffMs;
+    maxBackoffMs;
+    constructor(options = {}) {
+        this.baseBackoffMs = options.baseBackoffMs ?? 5000; // 5s initial backoff
+        this.maxBackoffMs = options.maxBackoffMs ?? 300000; // 5m max backoff
+        const initialPolicies = options.policies || exports.DEFAULT_SERVER_POLICIES;
+        for (const p of initialPolicies) {
+            this.policies.set(p.url, p);
+        }
+    }
+    getPolicy(url) {
+        return this.policies.get(url) || {
+            url,
+            name: url,
+            tier: 'L1_CRYPTO_PRIMARY',
+            minIntervalMs: 1000
+        };
+    }
+    setPolicy(policy) {
+        this.policies.set(policy.url, policy);
+    }
+    isAvailable(url, now = Date.now()) {
+        const entry = this.health.get(url);
+        if (!entry)
+            return true;
+        return now >= entry.nextAvailableTime;
+    }
+    getServerStatus(url, now = Date.now()) {
+        const entry = this.health.get(url);
+        if (!entry || now >= entry.nextAvailableTime) {
+            return 'READY';
+        }
+        if (entry.consecutiveFailures > 0) {
+            return 'BACKOFF';
+        }
+        return 'COOLDOWN';
+    }
+    recordRequest(url, now = Date.now()) {
+        const policy = this.getPolicy(url);
+        const prev = this.health.get(url) || { consecutiveFailures: 0, nextAvailableTime: 0 };
+        this.health.set(url, {
+            ...prev,
+            url,
+            name: policy.name,
+            lastRequestTime: now,
+            // Enforce server policy rate cooldown
+            nextAvailableTime: Math.max(prev.nextAvailableTime, now + policy.minIntervalMs)
+        });
+    }
+    recordSuccess(url, now = Date.now()) {
+        const policy = this.getPolicy(url);
+        const prev = this.health.get(url);
+        const cooldownUntil = (prev?.lastRequestTime || 0) + policy.minIntervalMs;
+        this.health.set(url, {
+            url,
+            name: policy.name,
+            consecutiveFailures: 0,
+            lastSuccessTime: now,
+            lastRequestTime: prev?.lastRequestTime,
+            // Clear failure backoff; retain policy rate cooldown only if cooldownUntil > now
+            nextAvailableTime: cooldownUntil > now ? cooldownUntil : 0
+        });
+    }
+    recordFailure(url, error, now = Date.now()) {
+        const policy = this.getPolicy(url);
+        const prev = this.health.get(url) || { consecutiveFailures: 0, nextAvailableTime: 0 };
+        const consecutiveFailures = prev.consecutiveFailures + 1;
+        // Exponential backoff: base * 2^(failures - 1)
+        const backoffMs = Math.min(this.maxBackoffMs, this.baseBackoffMs * Math.pow(2, consecutiveFailures - 1));
+        this.health.set(url, {
+            url,
+            name: policy.name,
+            consecutiveFailures,
+            nextAvailableTime: now + backoffMs,
+            lastError: error,
+            lastRequestTime: prev.lastRequestTime,
+            lastSuccessTime: prev.lastSuccessTime
+        });
+        return backoffMs;
+    }
+    getHealth(url) {
+        return this.health.get(url);
+    }
+    reset() {
+        this.health.clear();
+        this.queuePointers.clear();
+    }
+    /**
+     * Return ordered candidate queue starting with "who's next".
+     */
+    getQueue(urls, queueKey = 'default') {
+        if (urls.length === 0)
+            return [];
+        const ptr = (this.queuePointers.get(queueKey) || 0) % urls.length;
+        return [...urls.slice(ptr), ...urls.slice(0, ptr)];
+    }
+    /**
+     * Return servers currently on cooldown or in failure backoff.
+     */
+    getDisabledEndpoints(urls, now = Date.now()) {
+        return urls
+            .filter(u => !this.isAvailable(u, now))
+            .map(u => {
+            const h = this.health.get(u);
+            const status = this.getServerStatus(u, now);
+            return {
+                url: u,
+                name: this.getPolicy(u).name,
+                status,
+                consecutiveFailures: h.consecutiveFailures,
+                remainingCooldownMs: Math.max(0, h.nextAvailableTime - now),
+                lastError: h.lastError
+            };
+        });
+    }
+    /**
+     * Return servers currently READY to serve requests immediately.
+     */
+    getReadyEndpoints(urls, now = Date.now()) {
+        return urls
+            .filter(u => this.isAvailable(u, now))
+            .map(u => {
+            const h = this.health.get(u);
+            return {
+                url: u,
+                name: this.getPolicy(u).name,
+                status: 'READY',
+                consecutiveFailures: h?.consecutiveFailures || 0,
+                remainingCooldownMs: 0
+            };
+        });
+    }
+    /**
+     * Fair rotating endpoint selection.
+     * Cycles through the array in round-robin order, picking healthy/available endpoints,
+     * skipping those in failure backoff or policy cooldown, and advancing the queue pointer.
+     */
+    selectRotatingEndpoints(urls, count = 1, queueKey = 'default', now = Date.now()) {
+        if (urls.length === 0)
+            return [];
+        const len = urls.length;
+        const currentPtr = (this.queuePointers.get(queueKey) || 0) % len;
+        const selected = [];
+        // 1. Scan in round-robin order starting at currentPtr for available endpoints
+        let checkIdx = currentPtr;
+        for (let i = 0; i < len && selected.length < count; i++) {
+            const candidate = urls[checkIdx];
+            if (this.isAvailable(candidate, now)) {
+                selected.push(candidate);
+            }
+            checkIdx = (checkIdx + 1) % len;
+        }
+        // 2. If not enough available endpoints, pick those with shortest remaining cooldown
+        if (selected.length < count) {
+            const remaining = urls.filter(u => !selected.includes(u));
+            remaining.sort((a, b) => {
+                const ta = this.health.get(a)?.nextAvailableTime || 0;
+                const tb = this.health.get(b)?.nextAvailableTime || 0;
+                return ta - tb;
+            });
+            for (const candidate of remaining) {
+                if (selected.length >= count)
+                    break;
+                selected.push(candidate);
+            }
+        }
+        // Advance queue pointer for the next request
+        this.queuePointers.set(queueKey, (currentPtr + 1) % len);
+        return selected;
+    }
+    /**
+     * Prioritized selection (used for targeted or non-rotating requests).
+     */
+    selectEndpoints(urls, maxCount = urls.length, now = Date.now()) {
+        return this.selectRotatingEndpoints(urls, maxCount, 'legacy', now);
+    }
+}
+exports.EndpointCircuitBreaker = EndpointCircuitBreaker;
+exports.globalCircuitBreaker = new EndpointCircuitBreaker();
+/**
+ * Helper to encode ASN.1 DER length octets.
+ */
+function encodeDerLength(len) {
+    if (len < 128) {
+        return Buffer.from([len]);
+    }
+    const octets = [];
+    let temp = len;
+    while (temp > 0) {
+        octets.unshift(temp & 0xff);
+        temp >>= 8;
+    }
+    return Buffer.from([0x80 | octets.length, ...octets]);
+}
+/**
+ * Helper to wrap elements in an ASN.1 DER SEQUENCE (tag 0x30).
+ */
+function encodeDerSequence(items) {
+    const body = Buffer.concat(items);
+    return Buffer.concat([Buffer.from([0x30]), encodeDerLength(body.length), body]);
+}
+/**
+ * Helper to decode ASN.1 DER length octets from a buffer at a given offset.
+ * Returns the parsed length and the number of octets consumed by the length header.
+ */
+function decodeDerLength(buf, offset) {
+    if (offset >= buf.length) {
+        throw new Error('Offset out of bounds reading DER length');
+    }
+    const first = buf[offset];
+    if (first < 0x80) {
+        return { length: first, headerLength: 1 };
+    }
+    const octetCount = first & 0x7f;
+    if (offset + 1 + octetCount > buf.length) {
+        throw new Error('Malformed DER length: exceeds buffer bounds');
+    }
+    let len = 0;
+    for (let i = 0; i < octetCount; i++) {
+        len = (len << 8) | buf[offset + 1 + i];
+    }
+    return { length: len, headerLength: 1 + octetCount };
+}
+exports.PKI_STATUS_TEXT = {
+    0: 'granted',
+    1: 'grantedWithMods',
+    2: 'rejection',
+    3: 'waiting',
+    4: 'revocationWarning',
+    5: 'revocationNotification'
+};
+/**
+ * Parse the RFC 3161 PKIStatusInfo integer code from TimeStampResp.
+ * RFC 3161 §2.4.2:
+ *   TimeStampResp ::= SEQUENCE {
+ *      status            PKIStatusInfo,
+ *      timeStampToken    TimeStampToken     OPTIONAL
+ *   }
+ *   PKIStatusInfo ::= SEQUENCE {
+ *      status        PKIStatus,
+ *      statusString  PKIFreeText     OPTIONAL,
+ *      failInfo      PKIFailureInfo  OPTIONAL
+ *   }
+ */
+function parsePkiStatus(respBuffer) {
+    if (!respBuffer || respBuffer.length < 5) {
+        throw new Error('Response buffer too short for RFC 3161 TimeStampResp');
+    }
+    if (respBuffer[0] !== 0x30) {
+        throw new Error(`Expected SEQUENCE tag (0x30) at start of TimeStampResp, got 0x${respBuffer[0].toString(16)}`);
+    }
+    const topLen = decodeDerLength(respBuffer, 1);
+    const statusInfoOffset = 1 + topLen.headerLength;
+    if (statusInfoOffset >= respBuffer.length || respBuffer[statusInfoOffset] !== 0x30) {
+        throw new Error(`Expected PKIStatusInfo SEQUENCE (0x30) at offset ${statusInfoOffset}`);
+    }
+    const statusInfoLen = decodeDerLength(respBuffer, statusInfoOffset + 1);
+    const statusIntOffset = statusInfoOffset + 1 + statusInfoLen.headerLength;
+    if (statusIntOffset >= respBuffer.length || respBuffer[statusIntOffset] !== 0x02) {
+        throw new Error(`Expected INTEGER tag (0x02) for PKIStatus at offset ${statusIntOffset}`);
+    }
+    const statusIntLen = decodeDerLength(respBuffer, statusIntOffset + 1);
+    const valOffset = statusIntOffset + 1 + statusIntLen.headerLength;
+    if (valOffset + statusIntLen.length > respBuffer.length) {
+        throw new Error('Truncated PKIStatus integer value in DER buffer');
+    }
+    let status = 0;
+    for (let i = 0; i < statusIntLen.length; i++) {
+        status = (status << 8) | respBuffer[valOffset + i];
+    }
+    return {
+        status,
+        statusText: exports.PKI_STATUS_TEXT[status] || `unknown_status_${status}`
+    };
+}
+/**
+ * In-band RFC 3161 TimeStampResp validator.
+ * Enforces:
+ * 1. PKIStatusInfo is granted (0) or grantedWithMods (1)
+ * 2. TimeStampToken presence
+ * 3. MessageImprint digest equality (asserts TSA stamped the exact requested file hash)
+ * 4. Cryptographic nonce echo match (asserts replay attack protection)
+ */
+function validateTimeStampResp(respBuffer, options = {}) {
+    let status = -1, statusText = 'parse_error';
+    try {
+        if (!respBuffer.length || respBuffer.length > 512 * 1024 || asn1js.fromBER(toArrayBuffer(respBuffer)).offset !== respBuffer.length)
+            throw new Error('Invalid or oversized response');
+        ({ status, statusText } = parsePkiStatus(respBuffer));
+        if (![0, 1].includes(status))
+            throw new Error(`RFC 3161 PKIStatus rejected: ${status} (${statusText})`);
+        const resp = pkijs.TimeStampResp.fromBER(toArrayBuffer(respBuffer));
+        if (!resp.timeStampToken || resp.timeStampToken.contentType !== '1.2.840.113549.1.7.2')
+            throw new Error('Missing CMS timestamp token');
+        const signed = new pkijs.SignedData({ schema: resp.timeStampToken.content });
+        if (signed.encapContentInfo.eContentType !== '1.2.840.113549.1.9.16.1.4')
+            throw new Error('Expected TSTInfo');
+        const bytes = Buffer.from(signed.encapContentInfo.eContent.getValue());
+        if (asn1js.fromBER(toArrayBuffer(bytes)).offset !== bytes.length)
+            throw new Error('Trailing TSTInfo data');
+        const info = pkijs.TSTInfo.fromBER(toArrayBuffer(bytes));
+        if (options.expectedDigest && (options.expectedDigest.length !== 32 || info.messageImprint.hashAlgorithm.algorithmId !== '2.16.840.1.101.3.4.2.1' || !Buffer.from(info.messageImprint.hashedMessage.valueBlock.valueHexView).equals(options.expectedDigest)))
+            throw new Error('TimeStampToken does not contain expected message imprint digest');
+        if (options.expectedNonce !== undefined) {
+            const expected = Buffer.isBuffer(options.expectedNonce) ? BigInt('0x' + (options.expectedNonce.toString('hex') || '0')) : options.expectedNonce;
+            const nonce = info.nonce ? BigInt('0x' + (Buffer.from(info.nonce.valueBlock.valueHexView).toString('hex') || '0')) : undefined;
+            if (nonce !== expected)
+                throw new Error('TimeStampToken nonce does not match request nonce');
+        }
+        return { valid: true, status, statusText, genTime: info.genTime.toISOString() };
+    }
+    catch (error) {
+        return { valid: false, status, statusText, error: error.message };
+    }
+}
+function toArrayBuffer(buf) {
+    const ab = new ArrayBuffer(buf.byteLength);
+    const view = new Uint8Array(ab);
+    view.set(buf);
+    return ab;
+}
+/**
+ * Cryptographically verifies an RFC 3161 TimeStampToken or TimeStampResp buffer using PKI.js.
+ * Validates CMS SignedData signature over signedAttrs (including 0x31 SET OF re-encoding),
+ * confirms message-digest matches the encapsulated TSTInfo, and asserts the stamped
+ * document digest matches documentBytes.
+ */
+async function verifyTimeStampToken(tsrBuffer, documentBytes, options = {}) {
+    try {
+        if (!tsrBuffer.length || tsrBuffer.length > 512 * 1024)
+            throw new Error('Timestamp input exceeds size limit');
+        const parsed = asn1js.fromBER(toArrayBuffer(tsrBuffer));
+        if (parsed.offset !== tsrBuffer.length)
+            throw new Error('Invalid or trailing timestamp DER');
+        let signed;
+        const children = parsed.result.valueBlock.value;
+        if (!Array.isArray(children))
+            throw new Error('Invalid timestamp structure');
+        if (children[0] instanceof asn1js.ObjectIdentifier) {
+            const ci = new pkijs.ContentInfo({ schema: parsed.result });
+            if (ci.contentType !== '1.2.840.113549.1.7.2')
+                throw new Error('Expected CMS SignedData');
+            signed = new pkijs.SignedData({ schema: ci.content });
+        }
+        else {
+            const resp = new pkijs.TimeStampResp({ schema: parsed.result });
+            if (![0, 1].includes(resp.status.status) || !resp.timeStampToken || resp.timeStampToken.contentType !== '1.2.840.113549.1.7.2')
+                throw new Error('Timestamp response not granted or missing token');
+            signed = new pkijs.SignedData({ schema: resp.timeStampToken.content });
+        }
+        if (signed.signerInfos.length !== 1 || signed.encapContentInfo.eContentType !== '1.2.840.113549.1.9.16.1.4')
+            throw new Error('Expected one TSA signer and TSTInfo content');
+        const content = signed.encapContentInfo.eContent;
+        if (!(content instanceof asn1js.OctetString))
+            throw new Error('Expected primitive DER TSTInfo octets');
+        const tstBytes = Buffer.from(content.getValue());
+        if (asn1js.fromBER(toArrayBuffer(tstBytes)).offset !== tstBytes.length)
+            throw new Error('Trailing TSTInfo bytes');
+        const info = pkijs.TSTInfo.fromBER(toArrayBuffer(tstBytes));
+        if (info.version !== 1 || info.messageImprint.hashAlgorithm.algorithmId !== '2.16.840.1.101.3.4.2.1')
+            throw new Error('Timestamp requires v1 SHA-256 imprint');
+        const expected = options.expectedDigest || crypto.createHash('sha256').update(documentBytes).digest();
+        if (expected.length !== 32 || info.messageImprint.hashedMessage.valueBlock.valueHexView.length !== 32)
+            throw new Error('SHA-256 imprint must be 32 bytes');
+        if (!Buffer.from(info.messageImprint.hashedMessage.valueBlock.valueHexView).equals(expected))
+            throw new Error('TSTInfo verification is failed: imprint mismatch');
+        const signer = signed.signerInfos[0];
+        const certificates = (signed.certificates || []).filter((c) => c instanceof pkijs.Certificate);
+        const cert = certificates.find(c => {
+            if (signer.sid instanceof pkijs.IssuerAndSerialNumber)
+                return c.issuer.isEqual(signer.sid.issuer) && c.serialNumber.isEqual(signer.sid.serialNumber);
+            const sid = signer.sid;
+            const value = sid.idBlock.isConstructed ? sid.valueBlock.value[0].valueBlock.valueHexView : sid.valueBlock.valueHexView;
+            return crypto.createHash('sha1').update(Buffer.from(c.subjectPublicKeyInfo.subjectPublicKey.valueBlock.valueHexView)).digest().equals(Buffer.from(value));
+        });
+        if (!cert || !signer.signedAttrs)
+            throw new Error('Missing TSA certificate or signed attributes');
+        const attributes = signer.signedAttrs.attributes;
+        const attr = (oid) => {
+            const matches = attributes.filter(a => a.type === oid);
+            if (matches.length !== 1 || matches[0].values.length !== 1)
+                throw new Error('Missing or duplicate timestamp attribute ' + oid);
+            return matches[0].values[0];
+        };
+        const type = attr('1.2.840.113549.1.9.3');
+        if (!(type instanceof asn1js.ObjectIdentifier) || type.valueBlock.toString() !== signed.encapContentInfo.eContentType)
+            throw new Error('Signed content type mismatch');
+        const hashes = { '2.16.840.1.101.3.4.2.1': 'sha256', '2.16.840.1.101.3.4.2.2': 'sha384', '2.16.840.1.101.3.4.2.3': 'sha512' };
+        const hash = hashes[signer.digestAlgorithm.algorithmId];
+        if (!hash)
+            throw new Error('Unsupported timestamp digest algorithm');
+        const digest = attr('1.2.840.113549.1.9.4');
+        if (!(digest instanceof asn1js.OctetString) || !Buffer.from(digest.valueBlock.valueHexView).equals(crypto.createHash(hash).update(tstBytes).digest()))
+            throw new Error('Signed content digest mismatch');
+        const certBytes = Buffer.from(cert.toSchema(true).toBER(false));
+        const x509 = new crypto.X509Certificate(certBytes);
+        const sigAlg = signer.signatureAlgorithm.algorithmId;
+        const allowedSignatureAlgorithms = {
+            rsa: ['1.2.840.113549.1.1.1', { sha256: '1.2.840.113549.1.1.11', sha384: '1.2.840.113549.1.1.12', sha512: '1.2.840.113549.1.1.13' }[hash]],
+            ec: [{ sha256: '1.2.840.10045.4.3.2', sha384: '1.2.840.10045.4.3.3', sha512: '1.2.840.10045.4.3.4' }[hash]]
+        };
+        if (!allowedSignatureAlgorithms[x509.publicKey.asymmetricKeyType || '']?.includes(sigAlg))
+            throw new Error('Unsupported timestamp signature algorithm');
+        const attrs = Buffer.from(signer.signedAttrs.encodedValue);
+        if (!attrs.length)
+            throw new Error('Missing signed attribute encoding');
+        attrs[0] = 0x31;
+        if (!crypto.verify(hash, attrs, x509.publicKey, Buffer.from(signer.signature.valueBlock.valueHexView)))
+            throw new Error('Timestamp CMS signature failed');
+        if (!Number.isFinite(info.genTime.getTime()) || info.genTime < cert.notBefore.value || info.genTime > cert.notAfter.value)
+            throw new Error('TSA certificate invalid at token generation time');
+        const eku = cert.extensions?.filter(e => e.extnID === '2.5.29.37');
+        if (!eku || eku.length !== 1 || !eku[0].critical)
+            throw new Error('TSA requires critical timestamping EKU');
+        const usage = pkijs.ExtKeyUsage.fromBER(toArrayBuffer(Buffer.from(eku[0].extnValue.valueBlock.valueHexView)));
+        if (usage.keyPurposes.length !== 1 || usage.keyPurposes[0] !== '1.3.6.1.5.5.7.3.8')
+            throw new Error('TSA EKU must be timestamping only');
+        const keyUsage = cert.extensions?.filter(e => e.extnID === '2.5.29.15') || [];
+        if (keyUsage.length > 1)
+            throw new Error('Duplicate TSA key usage');
+        if (keyUsage.length) {
+            const ku = asn1js.fromBER(toArrayBuffer(Buffer.from(keyUsage[0].extnValue.valueBlock.valueHexView))).result;
+            if (!(ku instanceof asn1js.BitString) || !(ku.valueBlock.valueHexView[0] & 0xc0))
+                throw new Error('TSA key usage forbids signatures');
+        }
+        const anchored = options.trustAnchors !== undefined;
+        const essV2 = attributes.filter(a => a.type === '1.2.840.113549.1.9.16.2.47');
+        // Legacy ESSCertID is accepted only for integrity-only checks. Anchored release policy requires v2.
+        const ess = attr(essV2.length ? '1.2.840.113549.1.9.16.2.47' : '1.2.840.113549.1.9.16.2.12');
+        const certIds = ess.valueBlock.value[0];
+        const fields = certIds.valueBlock.value[0].valueBlock.value;
+        let certHashAlgorithm = essV2.length ? 'sha256' : 'sha1';
+        let index = 0;
+        if (fields[0] instanceof asn1js.Sequence) {
+            if (!essV2.length)
+                throw new Error('Malformed ESSCertID');
+            certHashAlgorithm = hashes[new pkijs.AlgorithmIdentifier({ schema: fields[index++] }).algorithmId];
+        }
+        const certHash = fields[index++];
+        if (!certHashAlgorithm || !(certHash instanceof asn1js.OctetString) || !Buffer.from(certHash.valueBlock.valueHexView).equals(crypto.createHash(certHashAlgorithm).update(certBytes).digest()))
+            throw new Error('ESS certificate hash mismatch');
+        if (fields[index]) {
+            const issuer = new pkijs.IssuerSerial({ schema: fields[index++] });
+            if (!issuer.serialNumber.isEqual(cert.serialNumber) || !issuer.issuer.names.some(n => n.type === 4 && n.value.isEqual(cert.issuer)))
+                throw new Error('ESS issuer/serial mismatch');
+        }
+        if (index !== fields.length)
+            throw new Error('Malformed ESS certificate identifier');
+        if (anchored) {
+            if (!essV2.length || !options.trustAnchors?.length)
+                throw new Error('Anchored timestamp requires ESSCertIDv2 and explicit trust anchors');
+            const trustedCerts = options.trustAnchors.map(pem => {
+                if (!/^-----BEGIN CERTIFICATE-----[\s\S]+-----END CERTIFICATE-----\s*$/.test(pem))
+                    throw new Error('Malformed trust anchor PEM');
+                return pkijs.Certificate.fromBER(toArrayBuffer(new crypto.X509Certificate(pem).raw));
+            });
+            const chain = new pkijs.CertificateChainValidationEngine({ trustedCerts, certs: [...certificates.filter(c => c !== cert), cert], checkDate: info.genTime });
+            const result = await chain.verify({ passedWhenNotRevValues: true });
+            if (!result.result)
+                throw new Error('TSA chain validation failed: ' + result.resultMessage);
+        }
+        return { verified: true, signerVerified: true, trusted: anchored, trust: anchored ? 'ANCHORED' : 'INTEGRITY_ONLY', signerSubject: x509.subject, genTime: info.genTime.toISOString() };
+    }
+    catch (err) {
+        return { verified: false, trusted: false, error: err?.message || String(err) };
+    }
+}
+/**
+ * Build an RFC 3161 TimeStampReq ASN.1 DER structure.
+ * RFC 3161 §2.4.1:
+ *   TimeStampReq ::= SEQUENCE {
+ *      version          INTEGER { v1(1) },
+ *      messageImprint   MessageImprint,
+ *      nonce            INTEGER OPTIONAL,
+ *      certReq          BOOLEAN DEFAULT FALSE
+ *   }
+ */
+function buildTimeStampReq(sha256Digest, options = {}) {
+    if (sha256Digest.length !== 32) {
+        throw new Error(`TimeStampReq requires a 32-byte SHA-256 digest, received ${sha256Digest.length} bytes`);
+    }
+    const version = Buffer.from([0x02, 0x01, 0x01]); // INTEGER 1
+    // AlgorithmIdentifier for SHA-256 (OID: 2.16.840.1.101.3.4.2.1) + NULL parameters
+    const sha256Oid = Buffer.from([0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, 0x01]);
+    const nullParams = Buffer.from([0x05, 0x00]);
+    const algId = encodeDerSequence([sha256Oid, nullParams]);
+    // MessageImprint
+    const octetDigest = Buffer.concat([Buffer.from([0x04, 0x20]), sha256Digest]);
+    const messageImprint = encodeDerSequence([algId, octetDigest]);
+    const elements = [version, messageImprint];
+    // Nonce (comes before certReq in RFC 3161 §2.4.1)
+    if (options.nonce !== undefined) {
+        let nonceBuf;
+        if (Buffer.isBuffer(options.nonce)) {
+            nonceBuf = options.nonce;
+        }
+        else {
+            let hex = options.nonce.toString(16);
+            if (hex.length % 2 !== 0)
+                hex = '0' + hex;
+            nonceBuf = Buffer.from(hex, 'hex');
+        }
+        // Ensure positive integer in DER (prepend 0x00 if highest bit is set)
+        if (nonceBuf.length > 0 && (nonceBuf[0] & 0x80)) {
+            nonceBuf = Buffer.concat([Buffer.from([0x00]), nonceBuf]);
+        }
+        elements.push(Buffer.concat([Buffer.from([0x02]), encodeDerLength(nonceBuf.length), nonceBuf]));
+    }
+    // certReq: true
+    if (options.certReq !== false) {
+        elements.push(Buffer.from([0x01, 0x01, 0xff]));
+    }
+    return encodeDerSequence(elements);
+}
+/**
+ * Extract GeneralizedTime (tag 0x18) from ASN.1 DER TimeStampResp buffer.
+ * Returns ISO 8601 formatted string or null if not found.
+ */
+function extractGenTime(tsrBuffer) {
+    for (let i = 0; i < tsrBuffer.length - 16; i++) {
+        if (tsrBuffer[i] === 0x18) {
+            const len = tsrBuffer[i + 1];
+            if (len >= 13 && len <= 24 && i + 2 + len <= tsrBuffer.length) {
+                const str = tsrBuffer.slice(i + 2, i + 2 + len).toString('ascii');
+                // Matches YYYYMMDDHHMMSS...Z
+                if (/^\d{14}/.test(str)) {
+                    const year = str.slice(0, 4);
+                    const month = str.slice(4, 6);
+                    const day = str.slice(6, 8);
+                    const hour = str.slice(8, 10);
+                    const min = str.slice(10, 12);
+                    const sec = str.slice(12, 14);
+                    return `${year}-${month}-${day}T${hour}:${min}:${sec}Z`;
+                }
+            }
+        }
+    }
+    return null;
+}
+/**
+ * Execute HTTP POST query to an RFC 3161 TSA endpoint.
+ */
+function queryTsa(tsaUrl, tsqBuffer, timeoutMs = 5000) {
+    return new Promise((resolve, reject) => {
+        const url = new URL(tsaUrl);
+        if (!['http:', 'https:'].includes(url.protocol) || !Number.isFinite(timeoutMs) || timeoutMs <= 0 || timeoutMs > 60000)
+            return reject(new Error('Invalid TSA URL or timeout'));
+        const req = (url.protocol === 'https:' ? https : http).request(url, { method: 'POST', headers: { 'Content-Type': 'application/timestamp-query', 'Content-Length': tsqBuffer.length } });
+        const timer = setTimeout(() => req.destroy(new Error('TSA absolute deadline exceeded')), timeoutMs);
+        const fail = (error) => { clearTimeout(timer); reject(error); };
+        req.on('error', fail);
+        req.on('response', res => {
+            const chunks = [];
+            let size = 0;
+            res.on('error', fail);
+            res.on('aborted', () => fail(new Error('TSA response aborted')));
+            res.on('data', chunk => {
+                size += chunk.length;
+                if (size > 512 * 1024) {
+                    res.destroy();
+                    req.destroy(new Error('TSA response exceeds size limit'));
+                }
+                else
+                    chunks.push(Buffer.from(chunk));
+            });
+            res.on('end', () => {
+                clearTimeout(timer);
+                if (res.statusCode !== 200)
+                    reject(new Error('TSA HTTP status ' + res.statusCode));
+                else
+                    resolve(Buffer.concat(chunks));
+            });
+        });
+        req.end(tsqBuffer);
+    });
+}
+/**
+ * Probe a single TSA server and return a structured telemetry record.
+ * Automatically performs in-band RFC 3161 verification on successful responses:
+ * - Checks PKIStatus is granted (0) or grantedWithMods (1)
+ * - Verifies TimeStampToken exists
+ * - Asserts messageImprint digest matches expectedDigest (if provided)
+ * - Asserts returned nonce matches expectedNonce (if provided)
+ */
+async function probeTsa(tsaUrl, tsqBuffer, tier, timeoutMs = 4000, expectedDigest, expectedNonce, circuitBreaker = exports.globalCircuitBreaker) {
+    // Fast path: if circuit breaker has this endpoint in backoff, skip network query
+    if (!circuitBreaker.isAvailable(tsaUrl)) {
+        const health = circuitBreaker.getHealth(tsaUrl);
+        const waitRemaining = Math.max(0, (health?.nextAvailableTime || 0) - Date.now());
+        const status = circuitBreaker.getServerStatus(tsaUrl);
+        return {
+            tier,
+            method: 'RFC3161',
+            server: tsaUrl,
+            status: 'ERROR',
+            error: `Endpoint in ${status.toLowerCase()} (${Math.round(waitRemaining / 1000)}s remaining): ${health?.lastError || 'circuit breaker active'}`
+        };
+    }
+    circuitBreaker.recordRequest(tsaUrl);
+    try {
+        const data = await queryTsa(tsaUrl, tsqBuffer, timeoutMs);
+        if (data && data.length > 32) {
+            const validation = validateTimeStampResp(data, { expectedDigest, expectedNonce });
+            if (!validation.valid) {
+                circuitBreaker.recordFailure(tsaUrl, validation.error || 'RFC 3161 response validation failed');
+                return {
+                    tier,
+                    method: 'RFC3161',
+                    server: tsaUrl,
+                    status: 'ERROR',
+                    error: validation.error || 'RFC 3161 response validation failed'
+                };
+            }
+            circuitBreaker.recordSuccess(tsaUrl);
+            const verification = await verifyTimeStampToken(data, Buffer.alloc(0), { expectedDigest });
+            if (!verification.verified || !verification.genTime)
+                throw new Error(verification.error || 'Timestamp time missing');
+            const genTime = verification.genTime;
+            return {
+                tier,
+                method: 'RFC3161',
+                server: tsaUrl,
+                status: 'SUCCESS',
+                timestamp_iso: genTime,
+                token_b64: data.toString('base64'),
+                token_bytes: data
+            };
+        }
+        circuitBreaker.recordFailure(tsaUrl, 'Empty or invalid response from TSA');
+        return {
+            tier,
+            method: 'RFC3161',
+            server: tsaUrl,
+            status: 'ERROR',
+            error: 'Empty or invalid response from TSA'
+        };
+    }
+    catch (err) {
+        const isTimeout = /timed? out/i.test(err?.message || '');
+        circuitBreaker.recordFailure(tsaUrl, err?.message || String(err));
+        return {
+            tier,
+            method: 'RFC3161',
+            server: tsaUrl,
+            status: isTimeout ? 'TIMEOUT' : 'ERROR',
+            error: err?.message || String(err)
+        };
+    }
+}
+const HTTP_MONTHS = ['Jan', 'Feb', 'Mar', 'Apr', 'May', 'Jun', 'Jul', 'Aug', 'Sep', 'Oct', 'Nov', 'Dec'];
+const HTTP_DAYS = ['Sun', 'Mon', 'Tue', 'Wed', 'Thu', 'Fri', 'Sat'];
+const HTTP_DAYS_LONG = ['Sunday', 'Monday', 'Tuesday', 'Wednesday', 'Thursday', 'Friday', 'Saturday'];
+const IMF_FIXDATE = /^(Sun|Mon|Tue|Wed|Thu|Fri|Sat), (\d{2}) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (\d{4}) (\d{2}):(\d{2}):(\d{2}) GMT$/;
+const RFC850_DATE = /^(Sunday|Monday|Tuesday|Wednesday|Thursday|Friday|Saturday), (\d{2})-(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)-(\d{2}) (\d{2}):(\d{2}):(\d{2}) GMT$/;
+const ASCTIME_DATE = /^(Sun|Mon|Tue|Wed|Thu|Fri|Sat) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) ([ \d]\d) (\d{2}):(\d{2}):(\d{2}) (\d{4})$/;
+/**
+ * Parse an RFC 7231 section 7.1.1.1 HTTP-date: IMF-fixdate, or the obsolete RFC 850 and asctime
+ * forms a recipient must still accept. The grammar is case-sensitive, the day name must agree
+ * with the date, and the date must exist (no 31 February, no 24:00:00, no leap second).
+ * Returns epoch milliseconds, or null for anything else - including ISO-8601 and bare numbers
+ * that `new Date(...)` would happily accept.
+ */
+function parseHttpDate(value, now = Date.now()) {
+    if (typeof value !== 'string')
+        return null;
+    let dayName;
+    let day, month, year, hh, mm, ss;
+    let long = false;
+    let m = IMF_FIXDATE.exec(value);
+    if (m) {
+        dayName = m[1];
+        day = +m[2];
+        month = HTTP_MONTHS.indexOf(m[3]);
+        year = +m[4];
+        hh = +m[5];
+        mm = +m[6];
+        ss = +m[7];
+    }
+    else if ((m = RFC850_DATE.exec(value))) {
+        long = true;
+        dayName = m[1];
+        day = +m[2];
+        month = HTTP_MONTHS.indexOf(m[3]);
+        year = 2000 + +m[4];
+        // RFC 7231: a two-digit year more than 50 years in the future means the past century.
+        if (year > new Date(now).getUTCFullYear() + 50)
+            year -= 100;
+        hh = +m[5];
+        mm = +m[6];
+        ss = +m[7];
+    }
+    else if ((m = ASCTIME_DATE.exec(value))) {
+        dayName = m[1];
+        month = HTTP_MONTHS.indexOf(m[2]);
+        day = +m[3].trim();
+        hh = +m[4];
+        mm = +m[5];
+        ss = +m[6];
+        year = +m[7];
+    }
+    else {
+        return null;
+    }
+    if (hh > 23 || mm > 59 || ss > 59 || day < 1)
+        return null;
+    const d = new Date(0);
+    d.setUTCFullYear(year, month, day);
+    d.setUTCHours(hh, mm, ss, 0);
+    if (d.getUTCFullYear() !== year || d.getUTCMonth() !== month || d.getUTCDate() !== day)
+        return null;
+    const expected = (long ? HTTP_DAYS_LONG : HTTP_DAYS)[d.getUTCDay()];
+    if (dayName !== expected)
+        return null;
+    return d.getTime();
+}
+/** Identity of a network time source for de-duplication: scheme, path, case and trailing dot ignored. */
+function normalizeNetworkHost(host) {
+    return host.trim().toLowerCase().replace(/^[a-z][a-z0-9+.-]*:\/\//, '').replace(/\/.*$/, '').replace(/\.+$/, '');
+}
+function uniqueNetworkHosts(hosts) {
+    const seen = new Set();
+    return hosts.filter(h => {
+        const key = normalizeNetworkHost(h);
+        if (!key || seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+/**
+ * Probe network time via HTTP Date header. The header must be an RFC 7231 HTTP-date.
+ */
+function probeNetworkTime(host, timeoutMs = 3000) {
+    return new Promise((resolve) => {
+        const req = https.request(`https://${host}`, {
+            method: 'HEAD',
+            headers: { 'User-Agent': 'Moonglade-DTA/2.0' },
+            timeout: timeoutMs
+        }, (res) => {
+            const dateStr = res.headers['date'];
+            if (typeof dateStr === 'string') {
+                const ms = parseHttpDate(dateStr);
+                if (ms !== null) {
+                    resolve({
+                        tier: 'L3_NETWORK_CONSENSUS',
+                        method: 'HTTP_DATE',
+                        server: host,
+                        status: 'SUCCESS',
+                        timestamp_iso: new Date(ms).toISOString()
+                    });
+                    return;
+                }
+            }
+            resolve({
+                tier: 'L3_NETWORK_CONSENSUS',
+                method: 'HTTP_DATE',
+                server: host,
+                status: 'ERROR',
+                error: 'No valid Date header returned'
+            });
+        });
+        req.on('timeout', () => {
+            req.destroy();
+            resolve({
+                tier: 'L3_NETWORK_CONSENSUS',
+                method: 'HTTP_DATE',
+                server: host,
+                status: 'TIMEOUT',
+                error: `Network probe to ${host} timed out`
+            });
+        });
+        req.on('error', (err) => {
+            resolve({
+                tier: 'L3_NETWORK_CONSENSUS',
+                method: 'HTTP_DATE',
+                server: host,
+                status: 'ERROR',
+                error: err.message
+            });
+        });
+        req.end();
+    });
+}
+/**
+ * Evaluates whether successful L3 network probes form a Byzantine-tolerant quorum.
+ * Requirements:
+ * 1. At least 2 successful HTTP Date probes (or >= quorumThreshold).
+ * 2. Absolute time drift between min and max probe timestamps is within maxDriftMs (default: 3000ms).
+ * Returns the median timestamp and participating servers if quorum is reached, otherwise null.
+ */
+function resolveNetworkConsensus(probes, quorumThreshold = 2, maxDriftMs = 3000) {
+    // Configuration fails closed. Only a number >= 1 can lower or raise the default quorum of 2, and a
+    // fraction rounds UP; 0, negatives, NaN and non-numbers leave the default, and Infinity can never be
+    // met. A single host therefore reaches L3 only when the caller asks for exactly 1.
+    let quorum = 2;
+    if (typeof quorumThreshold === 'number' && quorumThreshold >= 1) {
+        if (!Number.isFinite(quorumThreshold))
+            return null;
+        quorum = Math.ceil(quorumThreshold);
+    }
+    // A NaN, negative, infinite or non-numeric drift limit must not disable the drift check.
+    const driftLimit = typeof maxDriftMs === 'number' && Number.isFinite(maxDriftMs) && maxDriftMs >= 0 ? maxDriftMs : 3000;
+    // A quorum counts distinct sources. The same host listed twice (or spelled two ways) is one
+    // participant, so repeating a server cannot manufacture agreement; its first answer is kept.
+    const distinct = new Map();
+    for (const p of probes) {
+        if (p.tier !== 'L3_NETWORK_CONSENSUS' || p.status !== 'SUCCESS' || !p.timestamp_iso)
+            continue;
+        if (typeof p.server !== 'string')
+            continue;
+        const key = normalizeNetworkHost(p.server);
+        if (key && !distinct.has(key))
+            distinct.set(key, p);
+    }
+    const successful = [...distinct.values()];
+    if (successful.length < quorum) {
+        return null;
+    }
+    const times = successful
+        .map(p => ({
+        server: p.server,
+        iso: p.timestamp_iso,
+        ms: new Date(p.timestamp_iso).getTime()
+    }))
+        .filter(t => !isNaN(t.ms));
+    if (times.length < quorum) {
+        return null;
+    }
+    times.sort((a, b) => a.ms - b.ms);
+    const minTime = times[0].ms;
+    const maxTime = times[times.length - 1].ms;
+    const drift = Math.abs(maxTime - minTime);
+    if (drift > driftLimit) {
+        return null;
+    }
+    // Median selection
+    const mid = Math.floor(times.length / 2);
+    const median = times[mid];
+    const serverList = times.map(t => t.server).join('+');
+    return {
+        consensusTime: median.iso,
+        server: `consensus(${serverList})`
+    };
+}
+/**
+ * Execute Concurrent Multi-Source Degrading Timestamping Architecture (DTA) fan-out.
+ * Default pattern: simultaneously seeks 1 probe from each tier (L1, L2, L3, L4).
+ * If specifiedServer or specifiedTier is requested, executes targeted query instead.
+ */
+async function concurrentDegradingTimestamp(sha256Digest, options = {}) {
+    const cb = options.circuitBreaker || exports.globalCircuitBreaker;
+    const timeoutMs = options.timeoutMs || 4000;
+    const nonce = options.nonce || crypto.randomBytes(8);
+    const tsq = buildTimeStampReq(sha256Digest, { certReq: options.certReq !== false, nonce });
+    const hostProbe = {
+        tier: 'L4_HOST_UNAUTHENTICATED',
+        method: 'KERNEL_UTC',
+        server: 'localhost',
+        status: 'SUCCESS',
+        timestamp_iso: new Date().toISOString()
+    };
+    // Case 1: Specifically requested server
+    if (options.specifiedServer) {
+        const s = options.specifiedServer;
+        if (s.startsWith('http://') || s.startsWith('https://')) {
+            const tier = exports.DEFAULT_FALLBACK_TSAS.includes(s) ? 'L2_CRYPTO_FALLBACK' : 'L1_CRYPTO_PRIMARY';
+            const probe = await probeTsa(s, tsq, tier, timeoutMs, sha256Digest, nonce, cb);
+            const allProbes = [probe, hostProbe];
+            if (probe.status === 'SUCCESS') {
+                return {
+                    tier: 'INTEGRITY_ONLY',
+                    tsa: probe.server,
+                    tsa_time: probe.timestamp_iso,
+                    token_b64: probe.token_b64,
+                    token_bytes: probe.token_bytes,
+                    probes: allProbes
+                };
+            }
+            return {
+                tier: 'L4_HOST_UNAUTHENTICATED',
+                tsa: 'localhost',
+                tsa_time: hostProbe.timestamp_iso,
+                probes: allProbes
+            };
+        }
+        else {
+            // One host cannot form a quorum. It is L3 only if the caller explicitly lowers the
+            // threshold to 1; otherwise the probe is kept as evidence and the result is L4.
+            const probe = await probeNetworkTime(s, timeoutMs);
+            const allProbes = [probe, hostProbe];
+            const single = resolveNetworkConsensus([probe], options.quorumThreshold ?? 2, options.maxDriftMs ?? 3000);
+            if (single) {
+                return {
+                    tier: 'L3_NETWORK_CONSENSUS',
+                    tsa: single.server,
+                    tsa_time: single.consensusTime,
+                    probes: allProbes
+                };
+            }
+            return {
+                tier: 'L4_HOST_UNAUTHENTICATED',
+                tsa: 'localhost',
+                tsa_time: hostProbe.timestamp_iso,
+                probes: allProbes
+            };
+        }
+    }
+    // Case 2: Specifically requested tier
+    if (options.specifiedTier === 'L4_HOST_UNAUTHENTICATED') {
+        return {
+            tier: 'L4_HOST_UNAUTHENTICATED',
+            tsa: 'localhost',
+            tsa_time: hostProbe.timestamp_iso,
+            probes: [hostProbe]
+        };
+    }
+    const probesPerTier = options.probesPerTier ?? options.maxParallelProbes ?? 1;
+    const rotate = options.rotate !== false; // Default: true fair rotation
+    const primaryPool = options.primaryEndpoints || exports.DEFAULT_PRIMARY_TSAS;
+    const fallbackPool = options.fallbackEndpoints || exports.DEFAULT_FALLBACK_TSAS;
+    const networkHosts = uniqueNetworkHosts(options.networkEndpoints || exports.DEFAULT_NETWORK_HOSTS);
+    const networkProbes = options.probesPerTier ?? options.maxParallelProbes ?? Math.min(3, networkHosts.length);
+    const probePromises = [];
+    if (!options.specifiedTier || options.specifiedTier === 'L1_CRYPTO_PRIMARY') {
+        const selectedPrimary = rotate
+            ? cb.selectRotatingEndpoints(primaryPool, probesPerTier, 'L1_PRIMARY')
+            : cb.selectEndpoints(primaryPool, probesPerTier);
+        probePromises.push(...selectedPrimary.map(url => probeTsa(url, tsq, 'L1_CRYPTO_PRIMARY', timeoutMs, sha256Digest, nonce, cb)));
+    }
+    if (!options.specifiedTier || options.specifiedTier === 'L2_CRYPTO_FALLBACK') {
+        const selectedFallback = rotate
+            ? cb.selectRotatingEndpoints(fallbackPool, probesPerTier, 'L2_FALLBACK')
+            : cb.selectEndpoints(fallbackPool, probesPerTier);
+        probePromises.push(...selectedFallback.map(url => probeTsa(url, tsq, 'L2_CRYPTO_FALLBACK', timeoutMs, sha256Digest, nonce, cb)));
+    }
+    if (!options.specifiedTier || options.specifiedTier === 'L3_NETWORK_CONSENSUS') {
+        const selectedNetwork = rotate
+            ? cb.selectRotatingEndpoints(networkHosts, networkProbes, 'L3_NETWORK')
+            : cb.selectEndpoints(networkHosts, networkProbes);
+        probePromises.push(...selectedNetwork.map(host => probeNetworkTime(host, Math.min(timeoutMs, 3000))));
+    }
+    const results = await Promise.all(probePromises);
+    const allProbes = [...results, hostProbe];
+    // Selection precedence: L1_CRYPTO_PRIMARY > L2_CRYPTO_FALLBACK > L3_NETWORK_CONSENSUS > L4_HOST_UNAUTHENTICATED
+    const successfulL1 = results.find(p => p.tier === 'L1_CRYPTO_PRIMARY' && p.status === 'SUCCESS');
+    if (successfulL1) {
+        return {
+            tier: 'INTEGRITY_ONLY',
+            tsa: successfulL1.server,
+            tsa_time: successfulL1.timestamp_iso,
+            token_b64: successfulL1.token_b64,
+            token_bytes: successfulL1.token_bytes,
+            probes: allProbes
+        };
+    }
+    const successfulL2 = results.find(p => p.tier === 'L2_CRYPTO_FALLBACK' && p.status === 'SUCCESS');
+    if (successfulL2) {
+        return {
+            tier: 'INTEGRITY_ONLY',
+            tsa: successfulL2.server,
+            tsa_time: successfulL2.timestamp_iso,
+            token_b64: successfulL2.token_b64,
+            token_bytes: successfulL2.token_bytes,
+            probes: allProbes
+        };
+    }
+    const consensus = resolveNetworkConsensus(results, options.quorumThreshold ?? 2, options.maxDriftMs ?? 3000);
+    if (consensus) {
+        return {
+            tier: 'L3_NETWORK_CONSENSUS',
+            tsa: consensus.server,
+            tsa_time: consensus.consensusTime,
+            probes: allProbes
+        };
+    }
+    return {
+        tier: 'L4_HOST_UNAUTHENTICATED',
+        tsa: 'localhost',
+        tsa_time: hostProbe.timestamp_iso,
+        probes: allProbes
+    };
+}