@peac/audit 0.10.9 → 0.10.11

package/dist/index.mjs

@@ -0,0 +1,1533 @@
+import { createHash } from 'crypto';
+import { posix } from 'path';
+import { canonicalize, verify, CryptoError } from '@peac/crypto';
+import { BUNDLE_ERRORS } from '@peac/kernel';
+import * as yazl from 'yazl';
+import * as yauzl from 'yauzl';
+
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/entry.ts
+var AUDIT_VERSION = "peac.audit/0.9";
+var AUDIT_EVENT_TYPES = [
+  "receipt_issued",
+  "receipt_verified",
+  "receipt_denied",
+  "access_decision",
+  "dispute_filed",
+  "dispute_acknowledged",
+  "dispute_resolved",
+  "dispute_rejected",
+  "dispute_appealed",
+  "dispute_final",
+  "attribution_created",
+  "attribution_verified",
+  "identity_verified",
+  "identity_rejected",
+  "policy_evaluated"
+];
+var AUDIT_SEVERITIES = [
+  "info",
+  "warn",
+  "error",
+  "critical"
+];
+function generateAuditId() {
+  const ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+  const now = Date.now();
+  let timestampPart = "";
+  let time = now;
+  for (let i = 0; i < 10; i++) {
+    timestampPart = ALPHABET[time % 32] + timestampPart;
+    time = Math.floor(time / 32);
+  }
+  let randomPart = "";
+  for (let i = 0; i < 16; i++) {
+    randomPart += ALPHABET[Math.floor(Math.random() * 32)];
+  }
+  return timestampPart + randomPart;
+}
+function isValidUlid(id) {
+  return /^[0-9A-HJKMNP-TV-Z]{26}$/.test(id);
+}
+function isValidTraceContext(trace) {
+  if (!/^[0-9a-f]{32}$/i.test(trace.trace_id)) {
+    return false;
+  }
+  if (!/^[0-9a-f]{16}$/i.test(trace.span_id)) {
+    return false;
+  }
+  if (trace.parent_span_id && !/^[0-9a-f]{16}$/i.test(trace.parent_span_id)) {
+    return false;
+  }
+  if (trace.trace_flags && !/^[0-9a-f]{2}$/i.test(trace.trace_flags)) {
+    return false;
+  }
+  return true;
+}
+function createAuditEntry(options) {
+  const entry = {
+    version: AUDIT_VERSION,
+    id: options.id ?? generateAuditId(),
+    event_type: options.event_type,
+    timestamp: options.timestamp ?? (/* @__PURE__ */ new Date()).toISOString(),
+    severity: options.severity ?? "info",
+    actor: options.actor,
+    resource: options.resource,
+    outcome: options.outcome
+  };
+  if (options.trace) {
+    entry.trace = options.trace;
+  }
+  if (options.context) {
+    entry.context = options.context;
+  }
+  if (options.dispute_ref) {
+    entry.dispute_ref = options.dispute_ref;
+  }
+  return entry;
+}
+function validateAuditEntry(entry) {
+  const errors = [];
+  if (!entry || typeof entry !== "object") {
+    return { valid: false, errors: ["Entry must be an object"] };
+  }
+  const e = entry;
+  if (e.version !== AUDIT_VERSION) {
+    errors.push(`Invalid version: expected "${AUDIT_VERSION}", got "${e.version}"`);
+  }
+  if (typeof e.id !== "string" || !isValidUlid(e.id)) {
+    errors.push("Invalid or missing id (must be ULID format)");
+  }
+  if (!AUDIT_EVENT_TYPES.includes(e.event_type)) {
+    errors.push(`Invalid event_type: "${e.event_type}"`);
+  }
+  if (typeof e.timestamp !== "string" || isNaN(Date.parse(e.timestamp))) {
+    errors.push("Invalid or missing timestamp (must be ISO 8601)");
+  }
+  if (!AUDIT_SEVERITIES.includes(e.severity)) {
+    errors.push(`Invalid severity: "${e.severity}"`);
+  }
+  if (!e.actor || typeof e.actor !== "object") {
+    errors.push("Missing or invalid actor");
+  } else {
+    const actor = e.actor;
+    if (!["user", "agent", "system"].includes(actor.type)) {
+      errors.push(`Invalid actor.type: "${actor.type}"`);
+    }
+    if (typeof actor.id !== "string" || actor.id.length === 0) {
+      errors.push("Actor must have non-empty id");
+    }
+  }
+  if (!e.resource || typeof e.resource !== "object") {
+    errors.push("Missing or invalid resource");
+  } else {
+    const resource = e.resource;
+    const validTypes = ["receipt", "attribution", "identity", "policy", "dispute", "content"];
+    if (!validTypes.includes(resource.type)) {
+      errors.push(`Invalid resource.type: "${resource.type}"`);
+    }
+    if (typeof resource.id !== "string" || resource.id.length === 0) {
+      errors.push("Resource must have non-empty id");
+    }
+  }
+  if (!e.outcome || typeof e.outcome !== "object") {
+    errors.push("Missing or invalid outcome");
+  } else {
+    const outcome = e.outcome;
+    if (typeof outcome.success !== "boolean") {
+      errors.push("Outcome must have boolean success field");
+    }
+  }
+  if (e.trace) {
+    if (!isValidTraceContext(e.trace)) {
+      errors.push("Invalid trace context format");
+    }
+  }
+  if (e.dispute_ref) {
+    if (typeof e.dispute_ref !== "string" || !isValidUlid(e.dispute_ref)) {
+      errors.push("Invalid dispute_ref (must be ULID format)");
+    }
+  }
+  return {
+    valid: errors.length === 0,
+    errors
+  };
+}
+function isValidAuditEntry(entry) {
+  return validateAuditEntry(entry).valid;
+}
+
+// src/jsonl.ts
+function formatJsonlLine(entry, options) {
+  if (options?.pretty) {
+    return JSON.stringify(entry, null, 2);
+  }
+  return JSON.stringify(entry);
+}
+function formatJsonl(entries, options) {
+  const lines = entries.map((entry) => formatJsonlLine(entry, { pretty: false }));
+  const result = lines.join("\n");
+  if (options?.trailingNewline && result.length > 0) {
+    return result + "\n";
+  }
+  return result;
+}
+function parseJsonlLine(line, lineNumber = 1) {
+  const trimmed = line.trim();
+  if (trimmed.length === 0) {
+    return {
+      ok: false,
+      error: "Empty line",
+      lineNumber
+    };
+  }
+  try {
+    const parsed = JSON.parse(trimmed);
+    if (!isValidAuditEntry(parsed)) {
+      return {
+        ok: false,
+        error: "Invalid audit entry structure",
+        lineNumber,
+        raw: trimmed.length > 100 ? trimmed.substring(0, 100) + "..." : trimmed
+      };
+    }
+    return {
+      ok: true,
+      entry: parsed,
+      lineNumber
+    };
+  } catch (e) {
+    return {
+      ok: false,
+      error: e instanceof Error ? e.message : "JSON parse error",
+      lineNumber,
+      raw: trimmed.length > 100 ? trimmed.substring(0, 100) + "..." : trimmed
+    };
+  }
+}
+function parseJsonl(content, options) {
+  const lines = content.split("\n");
+  const entries = [];
+  const errors = [];
+  const maxLines = options?.maxLines ?? 0;
+  let processed = 0;
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const lineNumber = i + 1;
+    if (line.trim().length === 0) {
+      continue;
+    }
+    if (maxLines > 0 && processed >= maxLines) {
+      break;
+    }
+    processed++;
+    const result = parseJsonlLine(line, lineNumber);
+    if (result.ok) {
+      entries.push(result.entry);
+    } else {
+      if (options?.skipInvalid) {
+        errors.push(result);
+      } else {
+        return {
+          entries,
+          errors: [result],
+          totalLines: processed,
+          successCount: entries.length,
+          errorCount: 1
+        };
+      }
+    }
+  }
+  return {
+    entries,
+    errors,
+    totalLines: processed,
+    successCount: entries.length,
+    errorCount: errors.length
+  };
+}
+function createJsonlAppender(options) {
+  return (entry) => {
+    const line = formatJsonlLine(entry, { pretty: false });
+    return line + "\n";
+  };
+}
+
+// src/bundle.ts
+var BUNDLE_VERSION = "peac.bundle/0.9";
+function createCaseBundle(options) {
+  const sortedEntries = [...options.entries].sort(
+    (a, b) => new Date(a.timestamp).getTime() - new Date(b.timestamp).getTime()
+  );
+  const traceIds = /* @__PURE__ */ new Set();
+  for (const entry of sortedEntries) {
+    if (entry.trace?.trace_id) {
+      traceIds.add(entry.trace.trace_id);
+    }
+  }
+  const summary = generateBundleSummary(sortedEntries);
+  return {
+    version: BUNDLE_VERSION,
+    dispute_ref: options.dispute_ref,
+    generated_at: (/* @__PURE__ */ new Date()).toISOString(),
+    generated_by: options.generated_by,
+    entries: sortedEntries,
+    trace_ids: Array.from(traceIds),
+    summary
+  };
+}
+function generateBundleSummary(entries) {
+  const byEventType = {};
+  for (const entry of entries) {
+    byEventType[entry.event_type] = (byEventType[entry.event_type] ?? 0) + 1;
+  }
+  const bySeverity = {
+    info: 0,
+    warn: 0,
+    error: 0,
+    critical: 0
+  };
+  for (const entry of entries) {
+    bySeverity[entry.severity]++;
+  }
+  const actors = /* @__PURE__ */ new Set();
+  const resources = /* @__PURE__ */ new Set();
+  for (const entry of entries) {
+    actors.add(`${entry.actor.type}:${entry.actor.id}`);
+    resources.add(`${entry.resource.type}:${entry.resource.id}`);
+  }
+  const firstEvent = entries.length > 0 ? entries[0].timestamp : "";
+  const lastEvent = entries.length > 0 ? entries[entries.length - 1].timestamp : "";
+  return {
+    entry_count: entries.length,
+    by_event_type: byEventType,
+    by_severity: bySeverity,
+    first_event: firstEvent,
+    last_event: lastEvent,
+    actor_count: actors.size,
+    resource_count: resources.size
+  };
+}
+function filterByDispute(entries, disputeRef) {
+  return entries.filter((entry) => entry.dispute_ref === disputeRef);
+}
+function filterByTraceId(entries, traceId) {
+  return entries.filter((entry) => entry.trace?.trace_id === traceId);
+}
+function filterByTimeRange(entries, start, end) {
+  const startTime = new Date(start).getTime();
+  const endTime = new Date(end).getTime();
+  return entries.filter((entry) => {
+    const entryTime = new Date(entry.timestamp).getTime();
+    return entryTime >= startTime && entryTime <= endTime;
+  });
+}
+function filterByResource(entries, resourceType, resourceId) {
+  return entries.filter((entry) => {
+    if (entry.resource.type !== resourceType) {
+      return false;
+    }
+    if (resourceId && entry.resource.id !== resourceId) {
+      return false;
+    }
+    return true;
+  });
+}
+function correlateByTrace(entries) {
+  const byTrace = /* @__PURE__ */ new Map();
+  for (const entry of entries) {
+    if (entry.trace?.trace_id) {
+      const existing = byTrace.get(entry.trace.trace_id) ?? [];
+      existing.push(entry);
+      byTrace.set(entry.trace.trace_id, existing);
+    }
+  }
+  const correlations = [];
+  for (const [traceId, traceEntries] of byTrace) {
+    const sorted = [...traceEntries].sort(
+      (a, b) => new Date(a.timestamp).getTime() - new Date(b.timestamp).getTime()
+    );
+    const spanIds = /* @__PURE__ */ new Set();
+    for (const entry of sorted) {
+      if (entry.trace?.span_id) {
+        spanIds.add(entry.trace.span_id);
+      }
+    }
+    const firstTime = new Date(sorted[0].timestamp).getTime();
+    const lastTime = new Date(sorted[sorted.length - 1].timestamp).getTime();
+    correlations.push({
+      trace_id: traceId,
+      entries: sorted,
+      span_ids: Array.from(spanIds),
+      duration_ms: lastTime - firstTime
+    });
+  }
+  return correlations;
+}
+function serializeBundle(bundle, pretty = false) {
+  if (pretty) {
+    return JSON.stringify(bundle, null, 2);
+  }
+  return JSON.stringify(bundle);
+}
+
+// src/dispute-bundle-types.ts
+var BUNDLE_VERSION2 = "peac-bundle/0.1";
+var DISPUTE_BUNDLE_VERSION = BUNDLE_VERSION2;
+var VERIFICATION_REPORT_VERSION = "peac-verification-report/0.1";
+var MAX_ZIP_ENTRIES = 1e4;
+var MAX_ENTRY_SIZE = 64 * 1024 * 1024;
+var MAX_TOTAL_SIZE = 512 * 1024 * 1024;
+var MAX_RECEIPTS = 1e4;
+var ALLOWED_PATHS = ["manifest.json", "bundle.sig", "receipts.ndjson", "keys/", "policy/"];
+var BundleErrorCodes = BUNDLE_ERRORS;
+var ULID_ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+function generateBundleId() {
+  const timestamp = Date.now();
+  const timestampChars = [];
+  let ts = timestamp;
+  for (let i = 9; i >= 0; i--) {
+    timestampChars[i] = ULID_ALPHABET[ts % 32];
+    ts = Math.floor(ts / 32);
+  }
+  const { randomBytes: cryptoRandomBytes } = __require("crypto");
+  const randBytes = cryptoRandomBytes(10);
+  const randomChars = [];
+  let randomValue = BigInt(0);
+  for (let i = 0; i < 10; i++) {
+    randomValue = randomValue << BigInt(8) | BigInt(randBytes[i]);
+  }
+  for (let i = 15; i >= 0; i--) {
+    randomChars[i] = ULID_ALPHABET[Number(randomValue & BigInt(31))];
+    randomValue = randomValue >> BigInt(5);
+  }
+  return timestampChars.join("") + randomChars.join("");
+}
+function sha256Hex(data) {
+  const hash = createHash("sha256");
+  hash.update(data);
+  return `sha256:${hash.digest("hex")}`;
+}
+function base64urlDecode(str) {
+  const padded = str + "=".repeat((4 - str.length % 4) % 4);
+  const base64 = padded.replace(/-/g, "+").replace(/_/g, "/");
+  return Buffer.from(base64, "base64");
+}
+function parseJws(jws) {
+  const parts = jws.split(".");
+  if (parts.length !== 3) {
+    return null;
+  }
+  try {
+    const headerJson = base64urlDecode(parts[0]).toString("utf8");
+    const payloadJson = base64urlDecode(parts[1]).toString("utf8");
+    return {
+      header: JSON.parse(headerJson),
+      payload: JSON.parse(payloadJson),
+      signature: base64urlDecode(parts[2]),
+      signingInput: `${parts[0]}.${parts[1]}`
+    };
+  } catch {
+    return null;
+  }
+}
+function bundleError(code, message, details) {
+  return { code, message, details };
+}
+function handleZipError(zipErr) {
+  const isPathError = zipErr.message.includes("invalid relative path") || zipErr.message.includes("absolute path") || zipErr.message.includes("..") || zipErr.message.includes("\\");
+  if (isPathError) {
+    return bundleError(BundleErrorCodes.PATH_TRAVERSAL, `Unsafe path in bundle: ${zipErr.message}`);
+  }
+  return bundleError(BundleErrorCodes.INVALID_FORMAT, `ZIP error: ${zipErr.message}`);
+}
+var VIRTUAL_ROOT = "/bundle";
+function isPathSafe(entryPath) {
+  if (entryPath.includes("\\")) return false;
+  if (entryPath.includes("\0")) return false;
+  const normalized = posix.normalize(entryPath);
+  if (normalized.startsWith("/")) return false;
+  if (normalized.startsWith("..")) return false;
+  if (normalized === ".") return false;
+  const resolved = posix.resolve(VIRTUAL_ROOT, normalized);
+  if (!resolved.startsWith(VIRTUAL_ROOT + "/") && resolved !== VIRTUAL_ROOT) {
+    return false;
+  }
+  return ALLOWED_PATHS.some((prefix) => normalized === prefix || normalized.startsWith(prefix));
+}
+async function createDisputeBundle(options) {
+  const {
+    kind = "dispute",
+    refs,
+    dispute_ref,
+    created_by,
+    receipts,
+    keys,
+    policy,
+    peac_txt,
+    bundle_id,
+    created_at,
+    signing_key,
+    signing_kid
+  } = options;
+  const bundleRefs = refs ?? (dispute_ref ? [{ type: "dispute", id: dispute_ref }] : []);
+  if (receipts.length === 0) {
+    return {
+      ok: false,
+      error: bundleError(BundleErrorCodes.MISSING_RECEIPTS, "No receipts provided")
+    };
+  }
+  if (receipts.length > MAX_RECEIPTS) {
+    return {
+      ok: false,
+      error: bundleError(
+        BundleErrorCodes.SIZE_EXCEEDED,
+        `Too many receipts: ${receipts.length} > ${MAX_RECEIPTS}`
+      )
+    };
+  }
+  if (keys.keys.length === 0) {
+    return {
+      ok: false,
+      error: bundleError(BundleErrorCodes.MISSING_KEYS, "No keys provided in JWKS")
+    };
+  }
+  const receiptEntries = [];
+  const seenReceiptIds = /* @__PURE__ */ new Set();
+  const ndjsonLines = [];
+  let minIssuedAt;
+  let maxIssuedAt;
+  for (let i = 0; i < receipts.length; i++) {
+    const jws = receipts[i];
+    const parsed = parseJws(jws);
+    if (!parsed) {
+      return {
+        ok: false,
+        error: bundleError(BundleErrorCodes.RECEIPT_INVALID, `Invalid JWS at index ${i}`)
+      };
+    }
+    const claims = parsed.payload;
+    const receiptId = claims.jti;
+    const issuedAtRaw = claims.iat;
+    if (!receiptId) {
+      return {
+        ok: false,
+        error: bundleError(
+          BundleErrorCodes.RECEIPT_INVALID,
+          `Receipt at index ${i} missing jti claim`
+        )
+      };
+    }
+    if (seenReceiptIds.has(receiptId)) {
+      return {
+        ok: false,
+        error: bundleError(
+          BundleErrorCodes.DUPLICATE_RECEIPT,
+          `Duplicate receipt ID: ${receiptId}`
+        )
+      };
+    }
+    seenReceiptIds.add(receiptId);
+    let issuedAt;
+    if (typeof issuedAtRaw === "number") {
+      issuedAt = new Date(issuedAtRaw * 1e3).toISOString();
+    } else if (typeof issuedAtRaw === "string") {
+      issuedAt = issuedAtRaw;
+    } else {
+      return {
+        ok: false,
+        error: bundleError(
+          BundleErrorCodes.RECEIPT_INVALID,
+          `Receipt ${receiptId} missing or invalid iat claim`
+        )
+      };
+    }
+    if (!minIssuedAt || issuedAt < minIssuedAt) minIssuedAt = issuedAt;
+    if (!maxIssuedAt || issuedAt > maxIssuedAt) maxIssuedAt = issuedAt;
+    const receiptHash = sha256Hex(Buffer.from(jws, "utf8"));
+    receiptEntries.push({
+      receipt_id: receiptId,
+      issued_at: issuedAt,
+      receipt_hash: receiptHash
+    });
+    ndjsonLines.push(jws);
+  }
+  const sortedIndices = receiptEntries.map((entry, i) => ({ entry, i })).sort((a, b) => {
+    if (a.entry.issued_at !== b.entry.issued_at) {
+      return a.entry.issued_at.localeCompare(b.entry.issued_at);
+    }
+    if (a.entry.receipt_id !== b.entry.receipt_id) {
+      return a.entry.receipt_id.localeCompare(b.entry.receipt_id);
+    }
+    return a.entry.receipt_hash.localeCompare(b.entry.receipt_hash);
+  });
+  const sortedReceiptEntries = sortedIndices.map((x) => x.entry);
+  const sortedNdjsonLines = sortedIndices.map((x) => ndjsonLines[x.i]);
+  const receiptsNdjson = sortedNdjsonLines.join("\n") + "\n";
+  const receiptsNdjsonBytes = Buffer.from(receiptsNdjson, "utf8");
+  const keyEntries = keys.keys.map((key) => ({
+    kid: key.kid,
+    alg: key.alg ?? "EdDSA"
+  }));
+  keyEntries.sort((a, b) => a.kid.localeCompare(b.kid));
+  const keysJson = JSON.stringify(keys, null, 2);
+  const keysBytes = Buffer.from(keysJson, "utf8");
+  const fileEntries = [
+    {
+      path: "receipts.ndjson",
+      sha256: sha256Hex(receiptsNdjsonBytes),
+      size: receiptsNdjsonBytes.length
+    },
+    {
+      path: "keys/keys.json",
+      sha256: sha256Hex(keysBytes),
+      size: keysBytes.length
+    }
+  ];
+  let policyHash;
+  let policyBytes;
+  if (policy) {
+    policyBytes = Buffer.from(policy, "utf8");
+    policyHash = sha256Hex(policyBytes);
+    fileEntries.push({
+      path: "policy/policy.yaml",
+      sha256: policyHash,
+      size: policyBytes.length
+    });
+  }
+  let peacTxtBytes;
+  let peacTxtHash;
+  if (peac_txt) {
+    peacTxtBytes = Buffer.from(peac_txt, "utf8");
+    peacTxtHash = sha256Hex(peacTxtBytes);
+    fileEntries.push({
+      path: "policy/peac.txt",
+      sha256: peacTxtHash,
+      size: peacTxtBytes.length
+    });
+  }
+  fileEntries.sort((a, b) => a.path.localeCompare(b.path));
+  const timeRange = {
+    start: minIssuedAt,
+    end: maxIssuedAt
+  };
+  const manifestWithoutHash = {
+    version: BUNDLE_VERSION2,
+    kind,
+    bundle_id: bundle_id ?? generateBundleId(),
+    refs: bundleRefs,
+    // Include deprecated dispute_ref for backwards compatibility
+    dispute_ref,
+    created_by,
+    created_at: created_at ?? (/* @__PURE__ */ new Date()).toISOString(),
+    time_range: timeRange,
+    receipts: sortedReceiptEntries,
+    keys: keyEntries,
+    files: fileEntries
+  };
+  if (policyHash) {
+    manifestWithoutHash.policy_hash = policyHash;
+  }
+  if (peacTxtHash) {
+    manifestWithoutHash.peac_txt_hash = peacTxtHash;
+  }
+  const contentHash = sha256Hex(canonicalize(manifestWithoutHash));
+  const manifest = {
+    ...manifestWithoutHash,
+    content_hash: contentHash
+  };
+  const zipfile = new yazl.ZipFile();
+  const mtime = new Date(manifest.created_at);
+  const zipOptions = { mtime, compress: false };
+  const manifestJson = JSON.stringify(manifest, null, 2);
+  zipfile.addBuffer(Buffer.from(manifestJson), "manifest.json", zipOptions);
+  zipfile.addBuffer(receiptsNdjsonBytes, "receipts.ndjson", zipOptions);
+  zipfile.addBuffer(keysBytes, "keys/keys.json", zipOptions);
+  if (policyBytes) {
+    zipfile.addBuffer(policyBytes, "policy/policy.yaml", zipOptions);
+  }
+  if (peacTxtBytes) {
+    zipfile.addBuffer(peacTxtBytes, "policy/peac.txt", zipOptions);
+  }
+  if (signing_key && signing_kid) {
+    const sigResult = await createBundleSignature(contentHash, signing_key, signing_kid);
+    if (!sigResult.ok) {
+      return sigResult;
+    }
+    zipfile.addBuffer(Buffer.from(sigResult.value), "bundle.sig", zipOptions);
+  }
+  return new Promise((resolve) => {
+    const chunks = [];
+    zipfile.outputStream.on("data", (chunk) => chunks.push(chunk)).on("end", () => {
+      resolve({ ok: true, value: Buffer.concat(chunks) });
+    }).on("error", (err) => {
+      resolve({
+        ok: false,
+        error: bundleError(
+          BundleErrorCodes.INVALID_FORMAT,
+          `Failed to create ZIP: ${err.message}`
+        )
+      });
+    });
+    zipfile.end();
+  });
+}
+async function createBundleSignature(contentHash, privateKey, kid) {
+  try {
+    const { sign } = await import('@peac/crypto');
+    const jws = await sign({ content_hash: contentHash }, privateKey, kid);
+    return { ok: true, value: jws };
+  } catch (err) {
+    return {
+      ok: false,
+      error: bundleError(
+        BundleErrorCodes.SIGNATURE_INVALID,
+        `Failed to create bundle signature: ${err.message}`
+      )
+    };
+  }
+}
+async function readDisputeBundle(zipBuffer) {
+  return new Promise((resolve) => {
+    yauzl.fromBuffer(zipBuffer, { lazyEntries: true }, (err, zipfile) => {
+      if (err || !zipfile) {
+        resolve({
+          ok: false,
+          error: bundleError(
+            BundleErrorCodes.INVALID_FORMAT,
+            `Failed to open ZIP: ${err?.message ?? "unknown error"}`
+          )
+        });
+        return;
+      }
+      const files = /* @__PURE__ */ new Map();
+      let entryCount = 0;
+      let totalSize = 0;
+      let actualTotalBytes = 0;
+      zipfile.on("entry", (entry) => {
+        if (/\/$/.test(entry.fileName)) {
+          zipfile.readEntry();
+          return;
+        }
+        entryCount++;
+        if (entryCount > MAX_ZIP_ENTRIES) {
+          zipfile.close();
+          resolve({
+            ok: false,
+            error: bundleError(
+              BundleErrorCodes.SIZE_EXCEEDED,
+              `Too many ZIP entries: > ${MAX_ZIP_ENTRIES}`
+            )
+          });
+          return;
+        }
+        if (!isPathSafe(entry.fileName)) {
+          zipfile.close();
+          resolve({
+            ok: false,
+            error: bundleError(
+              BundleErrorCodes.PATH_TRAVERSAL,
+              `Unsafe path in bundle: ${entry.fileName}`
+            )
+          });
+          return;
+        }
+        if (entry.uncompressedSize > MAX_ENTRY_SIZE) {
+          zipfile.close();
+          resolve({
+            ok: false,
+            error: bundleError(
+              BundleErrorCodes.SIZE_EXCEEDED,
+              `Entry too large: ${entry.fileName}`
+            )
+          });
+          return;
+        }
+        totalSize += entry.uncompressedSize;
+        if (totalSize > MAX_TOTAL_SIZE) {
+          zipfile.close();
+          resolve({
+            ok: false,
+            error: bundleError(
+              BundleErrorCodes.SIZE_EXCEEDED,
+              `Total size exceeded: > ${MAX_TOTAL_SIZE} bytes`
+            )
+          });
+          return;
+        }
+        zipfile.openReadStream(entry, (readErr, readStream) => {
+          if (readErr || !readStream) {
+            zipfile.close();
+            resolve({
+              ok: false,
+              error: bundleError(
+                BundleErrorCodes.INVALID_FORMAT,
+                `Failed to read ${entry.fileName}`
+              )
+            });
+            return;
+          }
+          const chunks = [];
+          let actualBytes = 0;
+          entry.uncompressedSize > 0 ? entry.uncompressedSize : MAX_ENTRY_SIZE;
+          readStream.on("data", (chunk) => {
+            actualBytes += chunk.length;
+            actualTotalBytes += chunk.length;
+            if (actualBytes > MAX_ENTRY_SIZE) {
+              readStream.destroy();
+              zipfile.close();
+              resolve({
+                ok: false,
+                error: bundleError(
+                  BundleErrorCodes.SIZE_EXCEEDED,
+                  `Entry exceeds size limit during decompression: ${entry.fileName}`,
+                  { claimed: entry.uncompressedSize, actual: actualBytes, limit: MAX_ENTRY_SIZE }
+                )
+              });
+              return;
+            }
+            if (actualTotalBytes > MAX_TOTAL_SIZE) {
+              readStream.destroy();
+              zipfile.close();
+              resolve({
+                ok: false,
+                error: bundleError(
+                  BundleErrorCodes.SIZE_EXCEEDED,
+                  `Total decompressed size exceeds limit: ${actualTotalBytes} > ${MAX_TOTAL_SIZE}`,
+                  { actual: actualTotalBytes, limit: MAX_TOTAL_SIZE }
+                )
+              });
+              return;
+            }
+            if (entry.uncompressedSize > 0 && actualBytes > entry.uncompressedSize * 2) {
+              readStream.destroy();
+              zipfile.close();
+              resolve({
+                ok: false,
+                error: bundleError(
+                  BundleErrorCodes.SIZE_EXCEEDED,
+                  `Entry decompressed size exceeds claimed size: ${entry.fileName}`,
+                  { claimed: entry.uncompressedSize, actual: actualBytes }
+                )
+              });
+              return;
+            }
+            chunks.push(chunk);
+          });
+          readStream.on("end", () => {
+            files.set(entry.fileName, Buffer.concat(chunks));
+            zipfile.readEntry();
+          });
+          readStream.on("error", (streamErr) => {
+            zipfile.close();
+            resolve({
+              ok: false,
+              error: bundleError(
+                BundleErrorCodes.INVALID_FORMAT,
+                `Stream error: ${streamErr.message}`
+              )
+            });
+          });
+        });
+      });
+      zipfile.on("end", () => {
+        processExtractedFiles(files, resolve);
+      });
+      zipfile.on("error", (zipErr) => {
+        resolve({
+          ok: false,
+          error: handleZipError(zipErr)
+        });
+      });
+      zipfile.readEntry();
+    });
+  });
+}
+function processExtractedFiles(files, resolve) {
+  const manifestBuffer = files.get("manifest.json");
+  if (!manifestBuffer) {
+    resolve({
+      ok: false,
+      error: bundleError(BundleErrorCodes.MANIFEST_MISSING, "manifest.json not found in bundle")
+    });
+    return;
+  }
+  let manifest;
+  try {
+    manifest = JSON.parse(manifestBuffer.toString("utf8"));
+  } catch (parseErr) {
+    resolve({
+      ok: false,
+      error: bundleError(
+        BundleErrorCodes.MANIFEST_INVALID,
+        `Failed to parse manifest.json: ${parseErr.message}`
+      )
+    });
+    return;
+  }
+  if (manifest.version !== BUNDLE_VERSION2) {
+    resolve({
+      ok: false,
+      error: bundleError(
+        BundleErrorCodes.MANIFEST_INVALID,
+        `Unsupported bundle version: ${manifest.version}`,
+        { expected: BUNDLE_VERSION2, actual: manifest.version }
+      )
+    });
+    return;
+  }
+  const { content_hash, ...manifestWithoutHash } = manifest;
+  const computedHash = sha256Hex(canonicalize(manifestWithoutHash));
+  if (computedHash !== content_hash) {
+    resolve({
+      ok: false,
+      error: bundleError(
+        BundleErrorCodes.HASH_MISMATCH,
+        "Bundle content_hash verification failed",
+        { expected: content_hash, computed: computedHash }
+      )
+    });
+    return;
+  }
+  for (const fileEntry of manifest.files) {
+    const fileBuffer = files.get(fileEntry.path);
+    if (!fileBuffer) {
+      resolve({
+        ok: false,
+        error: bundleError(BundleErrorCodes.INVALID_FORMAT, `File not found: ${fileEntry.path}`)
+      });
+      return;
+    }
+    const computedFileHash = sha256Hex(fileBuffer);
+    if (computedFileHash !== fileEntry.sha256) {
+      resolve({
+        ok: false,
+        error: bundleError(
+          BundleErrorCodes.HASH_MISMATCH,
+          `File hash mismatch: ${fileEntry.path}`,
+          { expected: fileEntry.sha256, computed: computedFileHash }
+        )
+      });
+      return;
+    }
+    if (fileBuffer.length !== fileEntry.size) {
+      resolve({
+        ok: false,
+        error: bundleError(
+          BundleErrorCodes.HASH_MISMATCH,
+          `File size mismatch: ${fileEntry.path}`,
+          { expected: fileEntry.size, actual: fileBuffer.length }
+        )
+      });
+      return;
+    }
+  }
+  const receiptsBuffer = files.get("receipts.ndjson");
+  const receipts = /* @__PURE__ */ new Map();
+  if (receiptsBuffer) {
+    const lines = receiptsBuffer.toString("utf8").trim().split("\n");
+    let lastKey = "";
+    for (let i = 0; i < lines.length; i++) {
+      const jws = lines[i].trim();
+      if (!jws) continue;
+      const parsed = parseJws(jws);
+      if (!parsed) {
+        resolve({
+          ok: false,
+          error: bundleError(BundleErrorCodes.RECEIPT_INVALID, `Invalid JWS at line ${i + 1}`)
+        });
+        return;
+      }
+      const receiptId = parsed.payload.jti;
+      if (receipts.has(receiptId)) {
+        resolve({
+          ok: false,
+          error: bundleError(
+            BundleErrorCodes.DUPLICATE_RECEIPT,
+            `Duplicate receipt ID in bundle: ${receiptId}`,
+            { receipt_id: receiptId, line: i + 1 }
+          )
+        });
+        return;
+      }
+      const issuedAt = typeof parsed.payload.iat === "number" ? new Date(parsed.payload.iat * 1e3).toISOString() : String(parsed.payload.iat);
+      const receiptHash = sha256Hex(Buffer.from(jws, "utf8"));
+      const currentKey = `${issuedAt}|${receiptId}|${receiptHash}`;
+      if (currentKey < lastKey) {
+        resolve({
+          ok: false,
+          error: bundleError(
+            BundleErrorCodes.RECEIPTS_UNORDERED,
+            "receipts.ndjson is not in deterministic order"
+          )
+        });
+        return;
+      }
+      lastKey = currentKey;
+      receipts.set(receiptId, jws);
+    }
+  }
+  let keys = { keys: [] };
+  const keysBuffer = files.get("keys/keys.json");
+  if (keysBuffer) {
+    try {
+      keys = JSON.parse(keysBuffer.toString("utf8"));
+    } catch {
+      resolve({
+        ok: false,
+        error: bundleError(BundleErrorCodes.MANIFEST_INVALID, "Failed to parse keys/keys.json")
+      });
+      return;
+    }
+  }
+  let policyContent;
+  const policyBuffer = files.get("policy/policy.yaml");
+  if (policyBuffer) {
+    policyContent = policyBuffer.toString("utf8");
+    if (manifest.policy_hash) {
+      const computedPolicyHash = sha256Hex(policyBuffer);
+      if (computedPolicyHash !== manifest.policy_hash) {
+        resolve({
+          ok: false,
+          error: bundleError(BundleErrorCodes.POLICY_HASH_MISMATCH, "Policy hash mismatch", {
+            expected: manifest.policy_hash,
+            computed: computedPolicyHash
+          })
+        });
+        return;
+      }
+    }
+  }
+  let peacTxtContent;
+  const peacTxtBuffer = files.get("policy/peac.txt");
+  if (peacTxtBuffer) {
+    peacTxtContent = peacTxtBuffer.toString("utf8");
+    if (manifest.peac_txt_hash) {
+      const computedPeacTxtHash = sha256Hex(peacTxtBuffer);
+      if (computedPeacTxtHash !== manifest.peac_txt_hash) {
+        resolve({
+          ok: false,
+          error: bundleError(BundleErrorCodes.POLICY_HASH_MISMATCH, "peac.txt hash mismatch", {
+            expected: manifest.peac_txt_hash,
+            computed: computedPeacTxtHash
+          })
+        });
+        return;
+      }
+    }
+  }
+  let bundleSig;
+  const sigBuffer = files.get("bundle.sig");
+  if (sigBuffer) {
+    bundleSig = sigBuffer.toString("utf8");
+  }
+  resolve({
+    ok: true,
+    value: {
+      manifest,
+      receipts,
+      keys,
+      policy: policyContent,
+      peac_txt: peacTxtContent,
+      bundle_sig: bundleSig
+    }
+  });
+}
+async function verifyBundleIntegrity(zipBuffer) {
+  const result = await readDisputeBundle(zipBuffer);
+  if (!result.ok) {
+    return result;
+  }
+  return { ok: true, value: { manifest: result.value.manifest } };
+}
+async function getBundleContentHash(zipBuffer) {
+  return new Promise((resolve) => {
+    yauzl.fromBuffer(zipBuffer, { lazyEntries: true }, (err, zipfile) => {
+      if (err || !zipfile) {
+        resolve({
+          ok: false,
+          error: bundleError(
+            BundleErrorCodes.INVALID_FORMAT,
+            `Failed to open ZIP: ${err?.message ?? "unknown"}`
+          )
+        });
+        return;
+      }
+      let found = false;
+      zipfile.on("entry", (entry) => {
+        if (entry.fileName === "manifest.json") {
+          found = true;
+          zipfile.openReadStream(entry, (readErr, readStream) => {
+            if (readErr || !readStream) {
+              zipfile.close();
+              resolve({
+                ok: false,
+                error: bundleError(BundleErrorCodes.INVALID_FORMAT, `Failed to read manifest.json`)
+              });
+              return;
+            }
+            const chunks = [];
+            readStream.on("data", (chunk) => chunks.push(chunk));
+            readStream.on("end", () => {
+              zipfile.close();
+              try {
+                const manifest = JSON.parse(
+                  Buffer.concat(chunks).toString("utf8")
+                );
+                resolve({ ok: true, value: manifest.content_hash });
+              } catch (parseErr) {
+                resolve({
+                  ok: false,
+                  error: bundleError(
+                    BundleErrorCodes.MANIFEST_INVALID,
+                    `Failed to parse manifest.json`
+                  )
+                });
+              }
+            });
+          });
+        } else {
+          zipfile.readEntry();
+        }
+      });
+      zipfile.on("end", () => {
+        if (!found) {
+          resolve({
+            ok: false,
+            error: bundleError(BundleErrorCodes.MANIFEST_MISSING, "manifest.json not found")
+          });
+        }
+      });
+      zipfile.on("error", (zipErr) => {
+        resolve({
+          ok: false,
+          error: handleZipError(zipErr)
+        });
+      });
+      zipfile.readEntry();
+    });
+  });
+}
+function sha256Hex2(data) {
+  const hash = createHash("sha256");
+  hash.update(data);
+  return `sha256:${hash.digest("hex")}`;
+}
+function base64urlDecode2(str) {
+  const padded = str + "=".repeat((4 - str.length % 4) % 4);
+  const base64 = padded.replace(/-/g, "+").replace(/_/g, "/");
+  return Buffer.from(base64, "base64");
+}
+function parseJws2(jws) {
+  const parts = jws.split(".");
+  if (parts.length !== 3) {
+    return null;
+  }
+  try {
+    const headerJson = base64urlDecode2(parts[0]).toString("utf8");
+    const payloadJson = base64urlDecode2(parts[1]).toString("utf8");
+    return {
+      header: JSON.parse(headerJson),
+      payload: JSON.parse(payloadJson),
+      signature: parts[2]
+    };
+  } catch {
+    return null;
+  }
+}
+function stripUndefined(obj) {
+  if (obj === null || obj === void 0) {
+    return obj;
+  }
+  if (Array.isArray(obj)) {
+    return obj.map(stripUndefined);
+  }
+  if (typeof obj === "object") {
+    const result = {};
+    for (const [key, value] of Object.entries(obj)) {
+      if (value !== void 0) {
+        result[key] = stripUndefined(value);
+      }
+    }
+    return result;
+  }
+  return obj;
+}
+function verifyReceiptClaims(payload, now) {
+  const errors = [];
+  const nowSec = Math.floor(now.getTime() / 1e3);
+  if (!payload.jti) {
+    errors.push("E_RECEIPT_MISSING_JTI");
+  }
+  if (!payload.iss) {
+    errors.push("E_RECEIPT_MISSING_ISS");
+  }
+  if (payload.iat === void 0) {
+    errors.push("E_RECEIPT_MISSING_IAT");
+  } else {
+    const iat = typeof payload.iat === "number" ? payload.iat : NaN;
+    if (isNaN(iat)) {
+      errors.push("E_RECEIPT_INVALID_IAT");
+    } else if (iat > nowSec + 300) {
+      errors.push("E_RECEIPT_NOT_YET_VALID");
+    }
+  }
+  if (payload.exp !== void 0) {
+    const exp = typeof payload.exp === "number" ? payload.exp : NaN;
+    if (isNaN(exp)) {
+      errors.push("E_RECEIPT_INVALID_EXP");
+    } else if (exp < nowSec) {
+      errors.push("E_RECEIPT_EXPIRED");
+    }
+  }
+  return {
+    valid: errors.length === 0,
+    errors
+  };
+}
+function getReceiptKeyId(header) {
+  return typeof header.kid === "string" ? header.kid : void 0;
+}
+function jwkToPublicKeyBytes(jwk) {
+  if (jwk.kty !== "OKP" || jwk.crv !== "Ed25519" || !jwk.x) {
+    return null;
+  }
+  const padded = jwk.x + "=".repeat((4 - jwk.x.length % 4) % 4);
+  const base64 = padded.replace(/-/g, "+").replace(/_/g, "/");
+  const bytes = Buffer.from(base64, "base64");
+  if (bytes.length !== 32) {
+    return null;
+  }
+  return new Uint8Array(bytes);
+}
+function findKey(keys, kid) {
+  return keys.find((k) => k.kid === kid);
+}
+async function verifyReceipt(receiptId, jws, bundleContents, options) {
+  const parsed = parseJws2(jws);
+  if (!parsed) {
+    return {
+      receipt_id: receiptId,
+      signature_valid: false,
+      claims_valid: false,
+      errors: ["E_RECEIPT_INVALID_FORMAT"]
+    };
+  }
+  const { header, payload } = parsed;
+  const keyId = getReceiptKeyId(header);
+  const errors = [];
+  if (!keyId) {
+    return {
+      receipt_id: receiptId,
+      signature_valid: false,
+      claims_valid: false,
+      errors: ["E_RECEIPT_MISSING_KID"]
+    };
+  }
+  const jwk = findKey(bundleContents.keys.keys, keyId);
+  if (!jwk) {
+    if (options.offline) {
+      return {
+        receipt_id: receiptId,
+        signature_valid: false,
+        claims_valid: false,
+        key_id: keyId,
+        errors: [BundleErrorCodes.KEY_MISSING]
+      };
+    }
+    return {
+      receipt_id: receiptId,
+      signature_valid: false,
+      claims_valid: false,
+      key_id: keyId,
+      errors: [BundleErrorCodes.KEY_MISSING]
+    };
+  }
+  const publicKeyBytes = jwkToPublicKeyBytes(jwk);
+  if (!publicKeyBytes) {
+    return {
+      receipt_id: receiptId,
+      signature_valid: false,
+      claims_valid: false,
+      key_id: keyId,
+      errors: ["E_RECEIPT_INVALID_KEY_FORMAT"]
+    };
+  }
+  let signatureValid = false;
+  try {
+    const result = await verify(jws, publicKeyBytes);
+    signatureValid = result.valid;
+    if (!signatureValid) {
+      errors.push("E_RECEIPT_SIGNATURE_INVALID");
+    }
+  } catch (err) {
+    if (err instanceof CryptoError) {
+      errors.push(`E_RECEIPT_CRYPTO_ERROR:${err.code}`);
+    } else {
+      errors.push("E_RECEIPT_SIGNATURE_INVALID");
+    }
+    signatureValid = false;
+  }
+  const claimsResult = verifyReceiptClaims(payload, options.now ?? /* @__PURE__ */ new Date());
+  errors.push(...claimsResult.errors);
+  return {
+    receipt_id: receiptId,
+    signature_valid: signatureValid,
+    claims_valid: claimsResult.valid,
+    key_id: keyId,
+    errors,
+    claims: signatureValid && claimsResult.valid && errors.length === 0 ? payload : void 0
+  };
+}
+function buildKeyUsage(results) {
+  const usage = /* @__PURE__ */ new Map();
+  for (const result of results) {
+    if (result.key_id) {
+      const existing = usage.get(result.key_id) ?? [];
+      existing.push(result.receipt_id);
+      usage.set(result.key_id, existing);
+    }
+  }
+  const entries = [];
+  for (const [kid, receiptIds] of usage) {
+    entries.push({
+      kid,
+      receipts_signed: receiptIds.length,
+      receipt_ids: receiptIds.sort()
+    });
+  }
+  return entries.sort((a, b) => a.kid.localeCompare(b.kid));
+}
+function generateAuditorSummary(totalReceipts, validCount, invalidCount, results) {
+  const headline = `${validCount}/${totalReceipts} receipts valid`;
+  const issues = [];
+  for (const result of results) {
+    if (!result.signature_valid || !result.claims_valid) {
+      const errorSummary = result.errors.length > 0 ? result.errors.join(", ") : "validation failed";
+      issues.push(`Receipt ${result.receipt_id}: ${errorSummary}`);
+    }
+  }
+  issues.sort();
+  let recommendation;
+  if (invalidCount === 0) {
+    recommendation = "valid";
+  } else if (invalidCount === totalReceipts) {
+    recommendation = "invalid";
+  } else {
+    recommendation = "needs_review";
+  }
+  return {
+    headline,
+    issues,
+    recommendation
+  };
+}
+async function verifyBundleSignature(bundleContents) {
+  const { bundle_sig, keys, manifest } = bundleContents;
+  if (!bundle_sig) {
+    return { present: false };
+  }
+  const parsed = parseJws2(bundle_sig);
+  if (!parsed) {
+    return {
+      present: true,
+      valid: false,
+      error: "E_BUNDLE_SIGNATURE_INVALID_FORMAT"
+    };
+  }
+  const keyId = typeof parsed.header.kid === "string" ? parsed.header.kid : void 0;
+  if (!keyId) {
+    return {
+      present: true,
+      valid: false,
+      error: "E_BUNDLE_SIGNATURE_MISSING_KID"
+    };
+  }
+  const jwk = keys.keys.find((k) => k.kid === keyId);
+  if (!jwk) {
+    return {
+      present: true,
+      valid: false,
+      key_id: keyId,
+      error: BundleErrorCodes.KEY_MISSING
+    };
+  }
+  const publicKeyBytes = jwkToPublicKeyBytes(jwk);
+  if (!publicKeyBytes) {
+    return {
+      present: true,
+      valid: false,
+      key_id: keyId,
+      error: "E_BUNDLE_SIGNATURE_INVALID_KEY_FORMAT"
+    };
+  }
+  try {
+    const result = await verify(bundle_sig, publicKeyBytes);
+    if (!result.valid) {
+      return {
+        present: true,
+        valid: false,
+        key_id: keyId,
+        error: BundleErrorCodes.SIGNATURE_INVALID
+      };
+    }
+    if (result.payload.content_hash !== manifest.content_hash) {
+      return {
+        present: true,
+        valid: false,
+        key_id: keyId,
+        error: "E_BUNDLE_SIGNATURE_CONTENT_MISMATCH"
+      };
+    }
+    return {
+      present: true,
+      valid: true,
+      key_id: keyId
+    };
+  } catch (err) {
+    const errorMsg = err instanceof CryptoError ? `E_BUNDLE_SIGNATURE_CRYPTO_ERROR:${err.code}` : BundleErrorCodes.SIGNATURE_INVALID;
+    return {
+      present: true,
+      valid: false,
+      key_id: keyId,
+      error: errorMsg
+    };
+  }
+}
+async function verifyBundle(zipBuffer, options) {
+  const readResult = await readDisputeBundle(zipBuffer);
+  if (!readResult.ok) {
+    return readResult;
+  }
+  const bundleContents = readResult.value;
+  const { manifest, receipts } = bundleContents;
+  const bundleSignature = await verifyBundleSignature(bundleContents);
+  const results = [];
+  for (const receiptEntry of manifest.receipts) {
+    const jws = receipts.get(receiptEntry.receipt_id);
+    if (!jws) {
+      results.push({
+        receipt_id: receiptEntry.receipt_id,
+        signature_valid: false,
+        claims_valid: false,
+        errors: ["E_BUNDLE_RECEIPT_NOT_FOUND"]
+      });
+      continue;
+    }
+    const result = await verifyReceipt(receiptEntry.receipt_id, jws, bundleContents, options);
+    results.push(result);
+  }
+  results.sort((a, b) => a.receipt_id.localeCompare(b.receipt_id));
+  const validCount = results.filter(
+    (r) => r.signature_valid && r.claims_valid && r.errors.length === 0
+  ).length;
+  const invalidCount = results.length - validCount;
+  const keysUsed = buildKeyUsage(results);
+  const auditorSummary = generateAuditorSummary(results.length, validCount, invalidCount, results);
+  const reportWithoutHash = {
+    version: VERIFICATION_REPORT_VERSION,
+    bundle_content_hash: manifest.content_hash,
+    bundle_signature: bundleSignature,
+    summary: {
+      total_receipts: results.length,
+      valid: validCount,
+      invalid: invalidCount
+    },
+    receipts: results,
+    keys_used: keysUsed,
+    auditor_summary: auditorSummary
+  };
+  const cleanedReport = stripUndefined(reportWithoutHash);
+  const reportHash = sha256Hex2(canonicalize(cleanedReport));
+  const report = {
+    ...reportWithoutHash,
+    report_hash: reportHash
+  };
+  return {
+    ok: true,
+    value: report
+  };
+}
+function serializeReport(report, pretty = false) {
+  if (pretty) {
+    return JSON.stringify(report, null, 2);
+  }
+  return JSON.stringify(report);
+}
+function formatReportText(report) {
+  const lines = [];
+  lines.push("PEAC Dispute Bundle Verification Report");
+  lines.push("========================================");
+  lines.push("");
+  lines.push(`Bundle content hash: ${report.bundle_content_hash}`);
+  lines.push(`Report hash: ${report.report_hash}`);
+  lines.push("");
+  lines.push("Bundle Signature");
+  lines.push("----------------");
+  if (!report.bundle_signature.present) {
+    lines.push("  Status: NOT SIGNED");
+  } else if (report.bundle_signature.valid) {
+    lines.push("  Status: VALID");
+    lines.push(`  Key ID: ${report.bundle_signature.key_id}`);
+  } else {
+    lines.push("  Status: INVALID");
+    if (report.bundle_signature.key_id) {
+      lines.push(`  Key ID: ${report.bundle_signature.key_id}`);
+    }
+    if (report.bundle_signature.error) {
+      lines.push(`  Error: ${report.bundle_signature.error}`);
+    }
+  }
+  lines.push("");
+  lines.push("Summary");
+  lines.push("-------");
+  lines.push(`Total receipts: ${report.summary.total_receipts}`);
+  lines.push(`Valid: ${report.summary.valid}`);
+  lines.push(`Invalid: ${report.summary.invalid}`);
+  lines.push("");
+  lines.push(`Recommendation: ${report.auditor_summary.recommendation.toUpperCase()}`);
+  lines.push(`Headline: ${report.auditor_summary.headline}`);
+  lines.push("");
+  if (report.auditor_summary.issues.length > 0) {
+    lines.push("Issues");
+    lines.push("------");
+    for (const issue of report.auditor_summary.issues) {
+      lines.push(`  - ${issue}`);
+    }
+    lines.push("");
+  }
+  if (report.keys_used.length > 0) {
+    lines.push("Keys Used");
+    lines.push("---------");
+    for (const keyUsage of report.keys_used) {
+      lines.push(`  ${keyUsage.kid}: ${keyUsage.receipts_signed} receipt(s)`);
+    }
+    lines.push("");
+  }
+  lines.push("Receipt Details");
+  lines.push("---------------");
+  for (const receipt of report.receipts) {
+    const status = receipt.signature_valid && receipt.claims_valid ? "VALID" : "INVALID";
+    lines.push(`  ${receipt.receipt_id}: ${status}`);
+    if (receipt.key_id) {
+      lines.push(`    Key: ${receipt.key_id}`);
+    }
+    if (receipt.errors.length > 0) {
+      lines.push(`    Errors: ${receipt.errors.join(", ")}`);
+    }
+  }
+  return lines.join("\n");
+}
+
+// src/index.ts
+var AUDIT_PACKAGE_VERSION = "0.9.27";
+
+export { AUDIT_EVENT_TYPES, AUDIT_PACKAGE_VERSION, AUDIT_SEVERITIES, AUDIT_VERSION, BUNDLE_VERSION, DISPUTE_BUNDLE_VERSION, BUNDLE_VERSION2 as DISPUTE_BUNDLE_VERSION_v2, VERIFICATION_REPORT_VERSION, correlateByTrace, createAuditEntry, createCaseBundle, createDisputeBundle, createJsonlAppender, filterByDispute, filterByResource, filterByTimeRange, filterByTraceId, formatJsonl, formatJsonlLine, formatReportText, generateAuditId, generateBundleSummary, getBundleContentHash, isValidAuditEntry, isValidTraceContext, isValidUlid, parseJsonl, parseJsonlLine, readDisputeBundle, serializeBundle, serializeReport, validateAuditEntry, verifyBundle, verifyBundleIntegrity };
+//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map