@signwho/verify 0.1.0

package/dist/index.d.cts

@@ -0,0 +1,68 @@
+import { V as VerificationReport } from './verify-checks-BTlBVglW.cjs';
+export { A as AssuranceTier, C as CheckResult, a as CheckStatus, E as Evidence, T as TSA_GAP_NOTE_THRESHOLD_MS, c as checkFileIntegrity, b as checkTriangleHash, d as checkTsa, e as checkWebAuthn, f as deriveTier, g as describeGap, h as extractEmbeddedEvidence, r as runAllChecks, s as selfieNote, t as timestampGapNote, v as verifyPackage } from './verify-checks-BTlBVglW.cjs';
+export { base64UrlToBytes, bytesToBase64Url, computeTriangleHash, computeWebAuthnChallenge, hashArrayBuffer, hashData, uint8ToBase64 } from './crypto.cjs';
+
+interface DisputeSummaryInputs {
+    report: VerificationReport;
+    generatedAt: Date;
+    pdfName?: string;
+    evidenceFileName?: string;
+    evidenceSource: 'standalone' | 'embedded' | null;
+    isSample?: boolean;
+}
+interface DisputeSummary {
+    text: string;
+    filename: string;
+}
+declare const VERIFY_URL = "https://signwho.com/verify";
+declare function utcStamp(value: number | string | null | undefined): string | null;
+declare function disputeSummaryFilename(documentName: string | undefined): string;
+declare function buildDisputeSummary(input: DisputeSummaryInputs): DisputeSummary;
+
+interface WebAuthnProof {
+    credentialId: string;
+    publicKey: string;
+    alg: number;
+    authenticatorData: string;
+    clientDataJSON: string;
+    signature: string;
+    challenge: string;
+    challengeNonce: string;
+}
+interface TsaTimestamp {
+    token: string;
+    genTime: string | null;
+    serial: string | null;
+    tsa: string;
+    tsaUrl: string;
+}
+interface AuditEvent {
+    type: 'document_created' | 'document_viewed' | 'document_signed';
+    timestamp: number;
+    ip: string | null;
+    senderEmail: string | null;
+    signerEmail: string | null;
+}
+interface SignatureEvidence {
+    signerName: string;
+    documentName: string;
+    documentHash: string;
+    selfieHash?: string;
+    biometricTimestamp?: number;
+    authMethod: 'biometric' | 'passkey' | 'manual';
+    triangleHash?: string;
+    timestamp: number;
+    faceDetected?: boolean;
+    selfieIncluded?: boolean;
+    signedPdfHash?: string;
+    webauthnProof?: WebAuthnProof;
+    tsaTimestamp?: TsaTimestamp;
+    auditEvents?: AuditEvent[];
+    senderEmail?: string;
+    completedAt?: number;
+    signedPdfAuditHistoryOmitted?: true;
+}
+
+declare const FREETSA_CA_PEM = "\n-----BEGIN CERTIFICATE-----\nMIIH/zCCBeegAwIBAgIJAMHphhYNqOmAMA0GCSqGSIb3DQEBDQUAMIGVMREwDwYD\nVQQKEwhGcmVlIFRTQTEQMA4GA1UECxMHUm9vdCBDQTEYMBYGA1UEAxMPd3d3LmZy\nZWV0c2Eub3JnMSIwIAYJKoZIhvcNAQkBFhNidXNpbGV6YXNAZ21haWwuY29tMRIw\nEAYDVQQHEwlXdWVyemJ1cmcxDzANBgNVBAgTBkJheWVybjELMAkGA1UEBhMCREUw\nHhcNMTYwMzEzMDE1MjEzWhcNNDEwMzA3MDE1MjEzWjCBlTERMA8GA1UEChMIRnJl\nZSBUU0ExEDAOBgNVBAsTB1Jvb3QgQ0ExGDAWBgNVBAMTD3d3dy5mcmVldHNhLm9y\nZzEiMCAGCSqGSIb3DQEJARYTYnVzaWxlemFzQGdtYWlsLmNvbTESMBAGA1UEBxMJ\nV3VlcnpidXJnMQ8wDQYDVQQIEwZCYXllcm4xCzAJBgNVBAYTAkRFMIICIjANBgkq\nhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAtgKODjAy8REQ2WTNqUudAnjhlCrpE6ql\nmQfNppeTmVvZrH4zutn+NwTaHAGpjSGv4/WRpZ1wZ3BRZ5mPUBZyLgq0YrIfQ5Fx\n0s/MRZPzc1r3lKWrMR9sAQx4mN4z11xFEO529L0dFJjPF9MD8Gpd2feWzGyptlel\nb+PqT+++fOa2oY0+NaMM7l/xcNHPOaMz0/2olk0i22hbKeVhvokPCqhFhzsuhKsm\nq4Of/o+t6dI7sx5h0nPMm4gGSRhfq+z6BTRgCrqQG2FOLoVFgt6iIm/BnNffUr7V\nDYd3zZmIwFOj/H3DKHoGik/xK3E82YA2ZulVOFRW/zj4ApjPa5OFbpIkd0pmzxzd\nEcL479hSA9dFiyVmSxPtY5ze1P+BE9bMU1PScpRzw8MHFXxyKqW13Qv7LWw4sbk3\nSciB7GACbQiVGzgkvXG6y85HOuvWNvC5GLSiyP9GlPB0V68tbxz4JVTRdw/Xn/XT\nFNzRBM3cq8lBOAVt/PAX5+uFcv1S9wFE8YjaBfWCP1jdBil+c4e+0tdywT2oJmYB\nBF/kEt1wmGwMmHunNEuQNzh1FtJY54hbUfiWi38mASE7xMtMhfj/C4SvapiDN837\ngYaPfs8x3KZxbX7C3YAsFnJinlwAUss1fdKar8Q/YVs7H/nU4c4Ixxxz4f67fcVq\nM2ITKentbCMCAwEAAaOCAk4wggJKMAwGA1UdEwQFMAMBAf8wDgYDVR0PAQH/BAQD\nAgHGMB0GA1UdDgQWBBT6VQ2MNGZRQ0z357OnbJWveuaklzCBygYDVR0jBIHCMIG/\ngBT6VQ2MNGZRQ0z357OnbJWveuakl6GBm6SBmDCBlTERMA8GA1UEChMIRnJlZSBU\nU0ExEDAOBgNVBAsTB1Jvb3QgQ0ExGDAWBgNVBAMTD3d3dy5mcmVldHNhLm9yZzEi\nMCAGCSqGSIb3DQEJARYTYnVzaWxlemFzQGdtYWlsLmNvbTESMBAGA1UEBxMJV3Vl\ncnpidXJnMQ8wDQYDVQQIEwZCYXllcm4xCzAJBgNVBAYTAkRFggkAwemGFg2o6YAw\nMwYDVR0fBCwwKjAooCagJIYiaHR0cDovL3d3dy5mcmVldHNhLm9yZy9yb290X2Nh\nLmNybDCBzwYDVR0gBIHHMIHEMIHBBgorBgEEAYHyJAEBMIGyMDMGCCsGAQUFBwIB\nFidodHRwOi8vd3d3LmZyZWV0c2Eub3JnL2ZyZWV0c2FfY3BzLmh0bWwwMgYIKwYB\nBQUHAgEWJmh0dHA6Ly93d3cuZnJlZXRzYS5vcmcvZnJlZXRzYV9jcHMucGRmMEcG\nCCsGAQUFBwICMDsaOUZyZWVUU0EgdHJ1c3RlZCB0aW1lc3RhbXBpbmcgU29mdHdh\ncmUgYXMgYSBTZXJ2aWNlIChTYWFTKTA3BggrBgEFBQcBAQQrMCkwJwYIKwYBBQUH\nMAGGG2h0dHA6Ly93d3cuZnJlZXRzYS5vcmc6MjU2MDANBgkqhkiG9w0BAQ0FAAOC\nAgEAaK9+v5OFYu9M6ztYC+L69sw1omdyli89lZAfpWMMh9CRmJhM6KBqM/ipwoLt\nnxyxGsbCPhcQjuTvzm+ylN6VwTMmIlVyVSLKYZcdSjt/eCUN+41K7sD7GVmxZBAF\nILnBDmTGJmLkrU0KuuIpj8lI/E6Z6NnmuP2+RAQSHsfBQi6sssnXMo4HOW5gtPO7\ngDrUpVXID++1P4XndkoKn7Svw5n0zS9fv1hxBcYIHPPQUze2u30bAQt0n0iIyRLz\naWuhtpAtd7ffwEbASgzB7E+NGF4tpV37e8KiA2xiGSRqT5ndu28fgpOY87gD3ArZ\nDctZvvTCfHdAS5kEO3gnGGeZEVLDmfEsv8TGJa3AljVa5E40IQDsUXpQLi8G+UC4\n1DWZu8EVT4rnYaCw1VX7ShOR1PNCCvjb8S8tfdudd9zhU3gEB0rxdeTy1tVbNLXW\n99y90xcwr1ZIDUwM/xQ/noO8FRhm0LoPC73Ef+J4ZBdrvWwauF3zJe33d4ibxEcb\n8/pz5WzFkeixYM2nsHhqHsBKw7JPouKNXRnl5IAE1eFmqDyC7G/VT7OF669xM6hb\nUt5G21JE4cNK6NNucS+fzg1JPX0+3VhsYZjj7D5uljRvQXrJ8iHgr/M6j2oLHvTA\nI2MLdq2qjZFDOCXsxBxJpbmLGBx9ow6ZerlUxzws2AWv2pk=\n-----END CERTIFICATE-----\n";
+
+export { type AuditEvent, type DisputeSummary, type DisputeSummaryInputs, FREETSA_CA_PEM, type SignatureEvidence, type TsaTimestamp, VERIFY_URL, VerificationReport, type WebAuthnProof, buildDisputeSummary, disputeSummaryFilename, utcStamp };

package/dist/index.d.ts

@@ -0,0 +1,68 @@
+import { V as VerificationReport } from './verify-checks-BTlBVglW.js';
+export { A as AssuranceTier, C as CheckResult, a as CheckStatus, E as Evidence, T as TSA_GAP_NOTE_THRESHOLD_MS, c as checkFileIntegrity, b as checkTriangleHash, d as checkTsa, e as checkWebAuthn, f as deriveTier, g as describeGap, h as extractEmbeddedEvidence, r as runAllChecks, s as selfieNote, t as timestampGapNote, v as verifyPackage } from './verify-checks-BTlBVglW.js';
+export { base64UrlToBytes, bytesToBase64Url, computeTriangleHash, computeWebAuthnChallenge, hashArrayBuffer, hashData, uint8ToBase64 } from './crypto.js';
+
+interface DisputeSummaryInputs {
+    report: VerificationReport;
+    generatedAt: Date;
+    pdfName?: string;
+    evidenceFileName?: string;
+    evidenceSource: 'standalone' | 'embedded' | null;
+    isSample?: boolean;
+}
+interface DisputeSummary {
+    text: string;
+    filename: string;
+}
+declare const VERIFY_URL = "https://signwho.com/verify";
+declare function utcStamp(value: number | string | null | undefined): string | null;
+declare function disputeSummaryFilename(documentName: string | undefined): string;
+declare function buildDisputeSummary(input: DisputeSummaryInputs): DisputeSummary;
+
+interface WebAuthnProof {
+    credentialId: string;
+    publicKey: string;
+    alg: number;
+    authenticatorData: string;
+    clientDataJSON: string;
+    signature: string;
+    challenge: string;
+    challengeNonce: string;
+}
+interface TsaTimestamp {
+    token: string;
+    genTime: string | null;
+    serial: string | null;
+    tsa: string;
+    tsaUrl: string;
+}
+interface AuditEvent {
+    type: 'document_created' | 'document_viewed' | 'document_signed';
+    timestamp: number;
+    ip: string | null;
+    senderEmail: string | null;
+    signerEmail: string | null;
+}
+interface SignatureEvidence {
+    signerName: string;
+    documentName: string;
+    documentHash: string;
+    selfieHash?: string;
+    biometricTimestamp?: number;
+    authMethod: 'biometric' | 'passkey' | 'manual';
+    triangleHash?: string;
+    timestamp: number;
+    faceDetected?: boolean;
+    selfieIncluded?: boolean;
+    signedPdfHash?: string;
+    webauthnProof?: WebAuthnProof;
+    tsaTimestamp?: TsaTimestamp;
+    auditEvents?: AuditEvent[];
+    senderEmail?: string;
+    completedAt?: number;
+    signedPdfAuditHistoryOmitted?: true;
+}
+
+declare const FREETSA_CA_PEM = "\n-----BEGIN CERTIFICATE-----\nMIIH/zCCBeegAwIBAgIJAMHphhYNqOmAMA0GCSqGSIb3DQEBDQUAMIGVMREwDwYD\nVQQKEwhGcmVlIFRTQTEQMA4GA1UECxMHUm9vdCBDQTEYMBYGA1UEAxMPd3d3LmZy\nZWV0c2Eub3JnMSIwIAYJKoZIhvcNAQkBFhNidXNpbGV6YXNAZ21haWwuY29tMRIw\nEAYDVQQHEwlXdWVyemJ1cmcxDzANBgNVBAgTBkJheWVybjELMAkGA1UEBhMCREUw\nHhcNMTYwMzEzMDE1MjEzWhcNNDEwMzA3MDE1MjEzWjCBlTERMA8GA1UEChMIRnJl\nZSBUU0ExEDAOBgNVBAsTB1Jvb3QgQ0ExGDAWBgNVBAMTD3d3dy5mcmVldHNhLm9y\nZzEiMCAGCSqGSIb3DQEJARYTYnVzaWxlemFzQGdtYWlsLmNvbTESMBAGA1UEBxMJ\nV3VlcnpidXJnMQ8wDQYDVQQIEwZCYXllcm4xCzAJBgNVBAYTAkRFMIICIjANBgkq\nhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAtgKODjAy8REQ2WTNqUudAnjhlCrpE6ql\nmQfNppeTmVvZrH4zutn+NwTaHAGpjSGv4/WRpZ1wZ3BRZ5mPUBZyLgq0YrIfQ5Fx\n0s/MRZPzc1r3lKWrMR9sAQx4mN4z11xFEO529L0dFJjPF9MD8Gpd2feWzGyptlel\nb+PqT+++fOa2oY0+NaMM7l/xcNHPOaMz0/2olk0i22hbKeVhvokPCqhFhzsuhKsm\nq4Of/o+t6dI7sx5h0nPMm4gGSRhfq+z6BTRgCrqQG2FOLoVFgt6iIm/BnNffUr7V\nDYd3zZmIwFOj/H3DKHoGik/xK3E82YA2ZulVOFRW/zj4ApjPa5OFbpIkd0pmzxzd\nEcL479hSA9dFiyVmSxPtY5ze1P+BE9bMU1PScpRzw8MHFXxyKqW13Qv7LWw4sbk3\nSciB7GACbQiVGzgkvXG6y85HOuvWNvC5GLSiyP9GlPB0V68tbxz4JVTRdw/Xn/XT\nFNzRBM3cq8lBOAVt/PAX5+uFcv1S9wFE8YjaBfWCP1jdBil+c4e+0tdywT2oJmYB\nBF/kEt1wmGwMmHunNEuQNzh1FtJY54hbUfiWi38mASE7xMtMhfj/C4SvapiDN837\ngYaPfs8x3KZxbX7C3YAsFnJinlwAUss1fdKar8Q/YVs7H/nU4c4Ixxxz4f67fcVq\nM2ITKentbCMCAwEAAaOCAk4wggJKMAwGA1UdEwQFMAMBAf8wDgYDVR0PAQH/BAQD\nAgHGMB0GA1UdDgQWBBT6VQ2MNGZRQ0z357OnbJWveuaklzCBygYDVR0jBIHCMIG/\ngBT6VQ2MNGZRQ0z357OnbJWveuakl6GBm6SBmDCBlTERMA8GA1UEChMIRnJlZSBU\nU0ExEDAOBgNVBAsTB1Jvb3QgQ0ExGDAWBgNVBAMTD3d3dy5mcmVldHNhLm9yZzEi\nMCAGCSqGSIb3DQEJARYTYnVzaWxlemFzQGdtYWlsLmNvbTESMBAGA1UEBxMJV3Vl\ncnpidXJnMQ8wDQYDVQQIEwZCYXllcm4xCzAJBgNVBAYTAkRFggkAwemGFg2o6YAw\nMwYDVR0fBCwwKjAooCagJIYiaHR0cDovL3d3dy5mcmVldHNhLm9yZy9yb290X2Nh\nLmNybDCBzwYDVR0gBIHHMIHEMIHBBgorBgEEAYHyJAEBMIGyMDMGCCsGAQUFBwIB\nFidodHRwOi8vd3d3LmZyZWV0c2Eub3JnL2ZyZWV0c2FfY3BzLmh0bWwwMgYIKwYB\nBQUHAgEWJmh0dHA6Ly93d3cuZnJlZXRzYS5vcmcvZnJlZXRzYV9jcHMucGRmMEcG\nCCsGAQUFBwICMDsaOUZyZWVUU0EgdHJ1c3RlZCB0aW1lc3RhbXBpbmcgU29mdHdh\ncmUgYXMgYSBTZXJ2aWNlIChTYWFTKTA3BggrBgEFBQcBAQQrMCkwJwYIKwYBBQUH\nMAGGG2h0dHA6Ly93d3cuZnJlZXRzYS5vcmc6MjU2MDANBgkqhkiG9w0BAQ0FAAOC\nAgEAaK9+v5OFYu9M6ztYC+L69sw1omdyli89lZAfpWMMh9CRmJhM6KBqM/ipwoLt\nnxyxGsbCPhcQjuTvzm+ylN6VwTMmIlVyVSLKYZcdSjt/eCUN+41K7sD7GVmxZBAF\nILnBDmTGJmLkrU0KuuIpj8lI/E6Z6NnmuP2+RAQSHsfBQi6sssnXMo4HOW5gtPO7\ngDrUpVXID++1P4XndkoKn7Svw5n0zS9fv1hxBcYIHPPQUze2u30bAQt0n0iIyRLz\naWuhtpAtd7ffwEbASgzB7E+NGF4tpV37e8KiA2xiGSRqT5ndu28fgpOY87gD3ArZ\nDctZvvTCfHdAS5kEO3gnGGeZEVLDmfEsv8TGJa3AljVa5E40IQDsUXpQLi8G+UC4\n1DWZu8EVT4rnYaCw1VX7ShOR1PNCCvjb8S8tfdudd9zhU3gEB0rxdeTy1tVbNLXW\n99y90xcwr1ZIDUwM/xQ/noO8FRhm0LoPC73Ef+J4ZBdrvWwauF3zJe33d4ibxEcb\n8/pz5WzFkeixYM2nsHhqHsBKw7JPouKNXRnl5IAE1eFmqDyC7G/VT7OF669xM6hb\nUt5G21JE4cNK6NNucS+fzg1JPX0+3VhsYZjj7D5uljRvQXrJ8iHgr/M6j2oLHvTA\nI2MLdq2qjZFDOCXsxBxJpbmLGBx9ow6ZerlUxzws2AWv2pk=\n-----END CERTIFICATE-----\n";
+
+export { type AuditEvent, type DisputeSummary, type DisputeSummaryInputs, FREETSA_CA_PEM, type SignatureEvidence, type TsaTimestamp, VERIFY_URL, VerificationReport, type WebAuthnProof, buildDisputeSummary, disputeSummaryFilename, utcStamp };

package/dist/index.js

@@ -0,0 +1,401 @@
+import { hashArrayBuffer, computeTriangleHash, computeWebAuthnChallenge, base64UrlToBytes } from './chunk-HSRXDJDV.js';
+export { base64UrlToBytes, bytesToBase64Url, computeTriangleHash, computeWebAuthnChallenge, hashArrayBuffer, hashData, uint8ToBase64 } from './chunk-HSRXDJDV.js';
+import * as pkijs from 'pkijs';
+import { PDFDocument, PDFName, PDFDict, PDFArray, PDFRawStream } from 'pdf-lib';
+import { inflate } from 'pako';
+
+// src/freetsa-cacert.ts
+var FREETSA_CA_PEM = `
+-----BEGIN CERTIFICATE-----
+MIIH/zCCBeegAwIBAgIJAMHphhYNqOmAMA0GCSqGSIb3DQEBDQUAMIGVMREwDwYD
+VQQKEwhGcmVlIFRTQTEQMA4GA1UECxMHUm9vdCBDQTEYMBYGA1UEAxMPd3d3LmZy
+ZWV0c2Eub3JnMSIwIAYJKoZIhvcNAQkBFhNidXNpbGV6YXNAZ21haWwuY29tMRIw
+EAYDVQQHEwlXdWVyemJ1cmcxDzANBgNVBAgTBkJheWVybjELMAkGA1UEBhMCREUw
+HhcNMTYwMzEzMDE1MjEzWhcNNDEwMzA3MDE1MjEzWjCBlTERMA8GA1UEChMIRnJl
+ZSBUU0ExEDAOBgNVBAsTB1Jvb3QgQ0ExGDAWBgNVBAMTD3d3dy5mcmVldHNhLm9y
+ZzEiMCAGCSqGSIb3DQEJARYTYnVzaWxlemFzQGdtYWlsLmNvbTESMBAGA1UEBxMJ
+V3VlcnpidXJnMQ8wDQYDVQQIEwZCYXllcm4xCzAJBgNVBAYTAkRFMIICIjANBgkq
+hkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAtgKODjAy8REQ2WTNqUudAnjhlCrpE6ql
+mQfNppeTmVvZrH4zutn+NwTaHAGpjSGv4/WRpZ1wZ3BRZ5mPUBZyLgq0YrIfQ5Fx
+0s/MRZPzc1r3lKWrMR9sAQx4mN4z11xFEO529L0dFJjPF9MD8Gpd2feWzGyptlel
+b+PqT+++fOa2oY0+NaMM7l/xcNHPOaMz0/2olk0i22hbKeVhvokPCqhFhzsuhKsm
+q4Of/o+t6dI7sx5h0nPMm4gGSRhfq+z6BTRgCrqQG2FOLoVFgt6iIm/BnNffUr7V
+DYd3zZmIwFOj/H3DKHoGik/xK3E82YA2ZulVOFRW/zj4ApjPa5OFbpIkd0pmzxzd
+EcL479hSA9dFiyVmSxPtY5ze1P+BE9bMU1PScpRzw8MHFXxyKqW13Qv7LWw4sbk3
+SciB7GACbQiVGzgkvXG6y85HOuvWNvC5GLSiyP9GlPB0V68tbxz4JVTRdw/Xn/XT
+FNzRBM3cq8lBOAVt/PAX5+uFcv1S9wFE8YjaBfWCP1jdBil+c4e+0tdywT2oJmYB
+BF/kEt1wmGwMmHunNEuQNzh1FtJY54hbUfiWi38mASE7xMtMhfj/C4SvapiDN837
+gYaPfs8x3KZxbX7C3YAsFnJinlwAUss1fdKar8Q/YVs7H/nU4c4Ixxxz4f67fcVq
+M2ITKentbCMCAwEAAaOCAk4wggJKMAwGA1UdEwQFMAMBAf8wDgYDVR0PAQH/BAQD
+AgHGMB0GA1UdDgQWBBT6VQ2MNGZRQ0z357OnbJWveuaklzCBygYDVR0jBIHCMIG/
+gBT6VQ2MNGZRQ0z357OnbJWveuakl6GBm6SBmDCBlTERMA8GA1UEChMIRnJlZSBU
+U0ExEDAOBgNVBAsTB1Jvb3QgQ0ExGDAWBgNVBAMTD3d3dy5mcmVldHNhLm9yZzEi
+MCAGCSqGSIb3DQEJARYTYnVzaWxlemFzQGdtYWlsLmNvbTESMBAGA1UEBxMJV3Vl
+cnpidXJnMQ8wDQYDVQQIEwZCYXllcm4xCzAJBgNVBAYTAkRFggkAwemGFg2o6YAw
+MwYDVR0fBCwwKjAooCagJIYiaHR0cDovL3d3dy5mcmVldHNhLm9yZy9yb290X2Nh
+LmNybDCBzwYDVR0gBIHHMIHEMIHBBgorBgEEAYHyJAEBMIGyMDMGCCsGAQUFBwIB
+FidodHRwOi8vd3d3LmZyZWV0c2Eub3JnL2ZyZWV0c2FfY3BzLmh0bWwwMgYIKwYB
+BQUHAgEWJmh0dHA6Ly93d3cuZnJlZXRzYS5vcmcvZnJlZXRzYV9jcHMucGRmMEcG
+CCsGAQUFBwICMDsaOUZyZWVUU0EgdHJ1c3RlZCB0aW1lc3RhbXBpbmcgU29mdHdh
+cmUgYXMgYSBTZXJ2aWNlIChTYWFTKTA3BggrBgEFBQcBAQQrMCkwJwYIKwYBBQUH
+MAGGG2h0dHA6Ly93d3cuZnJlZXRzYS5vcmc6MjU2MDANBgkqhkiG9w0BAQ0FAAOC
+AgEAaK9+v5OFYu9M6ztYC+L69sw1omdyli89lZAfpWMMh9CRmJhM6KBqM/ipwoLt
+nxyxGsbCPhcQjuTvzm+ylN6VwTMmIlVyVSLKYZcdSjt/eCUN+41K7sD7GVmxZBAF
+ILnBDmTGJmLkrU0KuuIpj8lI/E6Z6NnmuP2+RAQSHsfBQi6sssnXMo4HOW5gtPO7
+gDrUpVXID++1P4XndkoKn7Svw5n0zS9fv1hxBcYIHPPQUze2u30bAQt0n0iIyRLz
+aWuhtpAtd7ffwEbASgzB7E+NGF4tpV37e8KiA2xiGSRqT5ndu28fgpOY87gD3ArZ
+DctZvvTCfHdAS5kEO3gnGGeZEVLDmfEsv8TGJa3AljVa5E40IQDsUXpQLi8G+UC4
+1DWZu8EVT4rnYaCw1VX7ShOR1PNCCvjb8S8tfdudd9zhU3gEB0rxdeTy1tVbNLXW
+99y90xcwr1ZIDUwM/xQ/noO8FRhm0LoPC73Ef+J4ZBdrvWwauF3zJe33d4ibxEcb
+8/pz5WzFkeixYM2nsHhqHsBKw7JPouKNXRnl5IAE1eFmqDyC7G/VT7OF669xM6hb
+Ut5G21JE4cNK6NNucS+fzg1JPX0+3VhsYZjj7D5uljRvQXrJ8iHgr/M6j2oLHvTA
+I2MLdq2qjZFDOCXsxBxJpbmLGBx9ow6ZerlUxzws2AWv2pk=
+-----END CERTIFICATE-----
+`;
+
+// src/verify-checks.ts
+var toHex = (b) => Array.from(b).map((x) => x.toString(16).padStart(2, "0")).join("");
+var eqHex = (a, b) => !!a && !!b && a.toLowerCase() === b.toLowerCase();
+var ab = (u) => u.buffer.slice(u.byteOffset, u.byteOffset + u.byteLength);
+function base64ToBytes(s) {
+  const bin = atob(s.replace(/\s+/g, ""));
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+function derEcdsaToRaw(der, size) {
+  let i = 0;
+  if (der[i++] !== 48) throw new Error("bad der seq");
+  if (der[i] & 128) {
+    i += 1 + (der[i] & 127);
+  } else i++;
+  if (der[i++] !== 2) throw new Error("bad der r");
+  let rl = der[i++];
+  let r = der.slice(i, i + rl);
+  i += rl;
+  if (der[i++] !== 2) throw new Error("bad der s");
+  let sl = der[i++];
+  let s = der.slice(i, i + sl);
+  const strip = (x) => {
+    let j = 0;
+    while (j < x.length - 1 && x[j] === 0) j++;
+    return x.slice(j);
+  };
+  r = strip(r);
+  s = strip(s);
+  const out = new Uint8Array(size * 2);
+  out.set(r, size - r.length);
+  out.set(s, size * 2 - s.length);
+  return out;
+}
+var curveSize = (c) => c === "P-521" ? 66 : c === "P-384" ? 48 : 32;
+var DIGEST_OIDS = {
+  "2.16.840.1.101.3.4.2.1": "SHA-256",
+  "2.16.840.1.101.3.4.2.2": "SHA-384",
+  "2.16.840.1.101.3.4.2.3": "SHA-512",
+  "1.3.14.3.2.26": "SHA-1"
+};
+function ensurePkijsEngine() {
+  try {
+    const e = pkijs.getEngine();
+    if (e && e.subtle) return;
+  } catch {
+  }
+  pkijs.setEngine("signwho", new pkijs.CryptoEngine({ name: "signwho", crypto: globalThis.crypto }));
+}
+async function checkFileIntegrity(pdfBytes, ev) {
+  const id = "file", label = "File matches the signed record";
+  if (!ev.signedPdfHash) return { id, label, status: "skip", detail: "This evidence.json has no signedPdfHash. Use the STANDALONE evidence.json from the email/download (the copy embedded in the PDF omits it by design)." };
+  if (!pdfBytes) return { id, label, status: "skip", detail: "Provide the signed PDF to check it against signedPdfHash." };
+  try {
+    const hex = await hashArrayBuffer(ab(pdfBytes));
+    return eqHex(hex, ev.signedPdfHash) ? { id, label, status: "pass", detail: `SHA-256 of the PDF you provided equals evidence.signedPdfHash (${hex.slice(0, 16)}\u2026).` } : { id, label, status: "fail", detail: `SHA-256 of the provided PDF (${hex.slice(0, 16)}\u2026) does NOT match evidence.signedPdfHash (${ev.signedPdfHash.slice(0, 16)}\u2026). This is not the delivered file, or it was modified.` };
+  } catch (e) {
+    return { id, label, status: "fail", detail: "Could not hash the PDF: " + e.message };
+  }
+}
+async function checkTriangleHash(ev) {
+  const id = "triangle", label = "Triangle Authentication binding intact";
+  if (ev.selfieIncluded === false)
+    return { id, label, status: "skip", detail: "No selfie \u2014 the signer completed without a camera capture, so there is no selfie/time/document Triangle binding for this signature (by design, not a failure)." };
+  if (!ev.selfieHash || ev.biometricTimestamp == null || !ev.documentHash || !ev.triangleHash)
+    return { id, label, status: "skip", detail: "Missing fields (selfieHash / biometricTimestamp / documentHash / triangleHash)." };
+  try {
+    const recomputed = await computeTriangleHash(ev.selfieHash, ev.biometricTimestamp, ev.documentHash);
+    return eqHex(recomputed, ev.triangleHash) ? { id, label, status: "pass", detail: "SHA-256(selfieHash || biometricTimestamp || documentHash) equals evidence.triangleHash \u2014 the three artifacts are bound together." } : { id, label, status: "fail", detail: "Recomputed triangleHash does not match evidence.triangleHash \u2014 a bound component was altered." };
+  } catch (e) {
+    return { id, label, status: "fail", detail: e.message };
+  }
+}
+async function checkWebAuthn(ev) {
+  const id = "webauthn", label = "Signature cryptographically verified (WebAuthn)";
+  const p = ev.webauthnProof;
+  if (!p || !p.signature) return { id, label, status: "skip", detail: "No WebAuthn assertion in this signature (signer had no usable platform/roaming authenticator \u2014 recorded as manual/passkey)." };
+  if (!ev.documentHash || !p.challengeNonce || !p.clientDataJSON || !p.authenticatorData || !p.publicKey || p.alg !== -7 && p.alg !== -257)
+    return { id, label, status: "fail", detail: "Assertion is missing required fields (publicKey/alg/authenticatorData/clientDataJSON/challengeNonce)." };
+  try {
+    const expected = await computeWebAuthnChallenge(ev.documentHash, p.challengeNonce);
+    const cdj = JSON.parse(new TextDecoder().decode(base64UrlToBytes(p.clientDataJSON)));
+    if (cdj.type !== "webauthn.get") return { id, label, status: "fail", detail: `clientDataJSON.type is "${cdj.type}", expected "webauthn.get".` };
+    if (cdj.challenge !== expected) return { id, label, status: "fail", detail: "The challenge in clientDataJSON is not SHA-256(documentHash || challengeNonce) \u2014 the assertion is not bound to this document." };
+    if (p.challenge && p.challenge !== expected) return { id, label, status: "fail", detail: "Stored challenge does not match the recomputed document-bound challenge." };
+    const authData = base64UrlToBytes(p.authenticatorData);
+    const cdjBytes = base64UrlToBytes(p.clientDataJSON);
+    const cdjHash = new Uint8Array(await crypto.subtle.digest("SHA-256", ab(cdjBytes)));
+    const signed = new Uint8Array(authData.length + cdjHash.length);
+    signed.set(authData, 0);
+    signed.set(cdjHash, authData.length);
+    const spki = base64UrlToBytes(p.publicKey);
+    const sig = base64UrlToBytes(p.signature);
+    let ok;
+    if (p.alg === -7) {
+      const key = await crypto.subtle.importKey("spki", ab(spki), { name: "ECDSA", namedCurve: "P-256" }, false, ["verify"]);
+      ok = await crypto.subtle.verify({ name: "ECDSA", hash: "SHA-256" }, key, ab(derEcdsaToRaw(sig, 32)), ab(signed));
+    } else {
+      const key = await crypto.subtle.importKey("spki", ab(spki), { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, false, ["verify"]);
+      ok = await crypto.subtle.verify({ name: "RSASSA-PKCS1-v1_5" }, key, ab(sig), ab(signed));
+    }
+    if (!ok) return { id, label, status: "fail", detail: "The WebAuthn assertion signature did not verify against the stored public key." };
+    const uv = (authData[32] & 4) !== 0;
+    return { id, label, status: "pass", detail: `Assertion over the document-bound challenge verifies against the public key (${p.alg === -7 ? "ES256" : "RS256"})${uv ? ", user verification (biometric/PIN) flag set" : ""}. Proves the private key holder signed THIS document.` };
+  } catch (e) {
+    return { id, label, status: "fail", detail: "Verification error: " + e.message };
+  }
+}
+async function checkTsa(ev) {
+  const id = "tsa", label = "Timestamp valid (FreeTSA, non-qualified)";
+  const t = ev.tsaTimestamp;
+  if (!t || !t.token) return { id, label, status: "skip", detail: "No RFC-3161 timestamp (best-effort at signing; FreeTSA may have been unreachable)." };
+  const tsaTarget = ev.triangleHash || ev.documentHash;
+  const tsaTargetName = ev.triangleHash ? "triangleHash" : "documentHash";
+  if (!tsaTarget) return { id, label, status: "fail", detail: "Cannot check the timestamp without a triangleHash or documentHash to match." };
+  try {
+    ensurePkijsEngine();
+    const tokenBytes = base64ToBytes(t.token);
+    const ci = pkijs.ContentInfo.fromBER(ab(tokenBytes));
+    const sd = new pkijs.SignedData({ schema: ci.content });
+    const si = sd.signerInfos[0];
+    const digAlg = DIGEST_OIDS[si.digestAlgorithm.algorithmId] || "SHA-256";
+    const ecView = si ? sd.encapContentInfo.eContent.valueBlock.valueHexView : new Uint8Array();
+    const eContent = ab(ecView);
+    const tst = pkijs.TSTInfo.fromBER(eContent);
+    const mi = toHex(new Uint8Array(tst.messageImprint.hashedMessage.valueBlock.valueHexView));
+    if (!eqHex(mi, tsaTarget)) return { id, label, status: "fail", detail: `The timestamp covers a different hash than evidence.${tsaTargetName}.` };
+    let md = null;
+    for (const a of si.signedAttrs?.attributes || []) if (a.type === "1.2.840.113549.1.9.4") md = new Uint8Array(a.values[0].valueBlock.valueHexView);
+    const ecHash = new Uint8Array(await crypto.subtle.digest(digAlg, eContent));
+    if (!md || toHex(md) !== toHex(ecHash)) return { id, label, status: "fail", detail: "The signed messageDigest does not match the timestamp content." };
+    const sa = new Uint8Array(si.signedAttrs.encodedValue.slice(0));
+    sa[0] = 49;
+    const signerCert = sd.certificates?.find((c) => {
+      try {
+        return c.serialNumber.isEqual(si.sid.serialNumber);
+      } catch {
+        return false;
+      }
+    }) || sd.certificates[0];
+    const isEc = si.signatureAlgorithm.algorithmId.startsWith("1.2.840.10045");
+    let sigOk;
+    if (isEc) {
+      const pub = await signerCert.getPublicKey();
+      const raw = derEcdsaToRaw(new Uint8Array(si.signature.valueBlock.valueHexView), curveSize(pub.algorithm.namedCurve));
+      sigOk = await crypto.subtle.verify({ name: "ECDSA", hash: digAlg }, pub, ab(raw), ab(sa));
+    } else {
+      const pub = await signerCert.getPublicKey({ algorithm: { algorithm: { name: "RSASSA-PKCS1-v1_5", hash: digAlg }, usages: ["verify"] } });
+      sigOk = await crypto.subtle.verify({ name: "RSASSA-PKCS1-v1_5" }, pub, ab(new Uint8Array(si.signature.valueBlock.valueHexView)), ab(sa));
+    }
+    if (!sigOk) return { id, label, status: "fail", detail: "The TSA signature over the timestamp did not verify." };
+    const genTimeDate = tst.genTime instanceof Date ? tst.genTime : new Date(String(tst.genTime));
+    if (isNaN(genTimeDate.getTime())) return { id, label, status: "fail", detail: "The timestamp has no readable genTime." };
+    const nb = signerCert.notBefore.value, na = signerCert.notAfter.value;
+    if (genTimeDate < nb || genTimeDate > na) return { id, label, status: "fail", detail: `genTime (${genTimeDate.toISOString()}) is outside the TSA signing certificate's validity window (${nb.toISOString()} \u2026 ${na.toISOString()}).` };
+    const pem = FREETSA_CA_PEM.replace(/-----[^-]+-----/g, "").replace(/\s+/g, "");
+    const caDer = base64ToBytes(pem);
+    const ca = pkijs.Certificate.fromBER(ab(caDer));
+    const chain = await new pkijs.CertificateChainValidationEngine({ certs: [signerCert], trustedCerts: [ca], checkDate: genTimeDate }).verify();
+    if (!chain.result) return { id, label, status: "fail", detail: "The TSA certificate does not chain to the bundled FreeTSA CA as of genTime (code " + chain.resultCode + ")." };
+    const gt = genTimeDate.toISOString();
+    return { id, label, status: "pass", facts: { genTime: genTimeDate.toISOString(), serial: toHex(new Uint8Array(tst.serialNumber.valueBlock.valueHexView)) }, detail: `FreeTSA attests this signature's ${tsaTargetName} existed at ${gt} (RFC-3161, ${digAlg}; chain validated to the bundled FreeTSA CA as of that time). Non-qualified TSA.` };
+  } catch (e) {
+    return { id, label, status: "fail", detail: "Timestamp parse/verify error: " + e.message };
+  }
+}
+function selfieNote(ev) {
+  if (ev.selfieIncluded === false) {
+    return {
+      id: "selfie",
+      label: "No selfie \u2014 not captured",
+      status: "info",
+      detail: `This signature was completed WITHOUT a selfie (the signer couldn't or chose not to use a camera). ${ev.webauthnProof ? "It is device-verified (WebAuthn) and timestamped, but carries no photographic evidence and no identity binding." : "It carries neither a selfie nor a device signature \u2014 it is document + timestamp only, the lowest assurance tier."}`
+    };
+  }
+  return {
+    id: "selfie",
+    label: "Selfie captured \u2014 not identity-verified",
+    status: "info",
+    detail: `A selfie was captured at signing (hash bound into the Triangle, verified above). ${ev.faceDetected ? "A face was detected by an in-browser heuristic. " : ""}This is NOT identity verification \u2014 SignWho does not match the face to a government ID or a real-world identity.`
+  };
+}
+var TSA_GAP_NOTE_THRESHOLD_MS = 10 * 60 * 1e3;
+function describeGap(ms) {
+  const abs = Math.abs(ms);
+  const minutes = Math.round(abs / 6e4);
+  if (minutes < 120) return `${minutes} minute${minutes === 1 ? "" : "s"}`;
+  const hours = Math.round(abs / 36e5);
+  if (hours < 48) return `${hours} hours`;
+  const days = Math.round(abs / 864e5);
+  return `${days} days`;
+}
+function timestampGapNote(ev, tsaCheck) {
+  if (!tsaCheck || tsaCheck.status !== "pass" || !tsaCheck.facts?.genTime) return null;
+  if (typeof ev.timestamp !== "number" || !Number.isFinite(ev.timestamp)) return null;
+  const genMs = Date.parse(tsaCheck.facts.genTime);
+  if (Number.isNaN(genMs)) return null;
+  const gap = genMs - ev.timestamp;
+  if (Math.abs(gap) <= TSA_GAP_NOTE_THRESHOLD_MS) return null;
+  const when = gap > 0 ? "after" : "before";
+  return {
+    id: "tsa-gap",
+    label: `Timestamp obtained ${describeGap(gap)} ${when} the recorded signing time`,
+    status: "info",
+    detail: `The independent timestamp was obtained ${describeGap(gap)} ${when} the recorded signing time (genTime ${tsaCheck.facts.genTime}, evidence.timestamp ${new Date(ev.timestamp).toISOString()}). The token is still valid \u2014 it proves the hash existed at genTime \u2014 but the signer's declared time and the third-party time disagree by more than ${TSA_GAP_NOTE_THRESHOLD_MS / 6e4} minutes.`,
+    facts: { gapMs: String(gap) }
+  };
+}
+async function runAllChecks(pdfBytes, ev) {
+  const tsa = await checkTsa(ev);
+  const gap = timestampGapNote(ev, tsa);
+  return [
+    await checkFileIntegrity(pdfBytes, ev),
+    await checkWebAuthn(ev),
+    tsa,
+    await checkTriangleHash(ev),
+    selfieNote(ev),
+    ...gap ? [gap] : []
+  ];
+}
+async function extractEmbeddedEvidence(pdfBytes) {
+  try {
+    const doc = await PDFDocument.load(pdfBytes, { ignoreEncryption: true, updateMetadata: false });
+    const names = doc.catalog.lookupMaybe(PDFName.of("Names"), PDFDict);
+    const ef = names?.lookupMaybe(PDFName.of("EmbeddedFiles"), PDFDict);
+    const arr = ef?.lookupMaybe(PDFName.of("Names"), PDFArray);
+    if (!arr) return null;
+    for (let i = 0; i + 1 < arr.size(); i += 2) {
+      const filespec = arr.lookup(i + 1, PDFDict);
+      const efDict = filespec.lookupMaybe(PDFName.of("EF"), PDFDict);
+      const stream = efDict?.lookup(PDFName.of("F"));
+      if (!stream || !(stream instanceof PDFRawStream)) continue;
+      let bytes = stream.contents;
+      const filter = stream.dict.get(PDFName.of("Filter"));
+      if (filter && filter.toString().includes("FlateDecode")) bytes = inflate(bytes);
+      const text = new TextDecoder().decode(bytes);
+      if (text.trim().startsWith("{")) return JSON.parse(text);
+    }
+  } catch {
+  }
+  return null;
+}
+function deriveTier(ev, checks) {
+  const noSelfie = ev.selfieIncluded === false || !ev.triangleHash && !ev.selfieHash;
+  if (!noSelfie) return "identity";
+  const webauthnPass = checks.find((c) => c.id === "webauthn")?.status === "pass";
+  return webauthnPass ? "device" : "floor";
+}
+async function verifyPackage(pdfBytes, ev) {
+  const checks = await runAllChecks(pdfBytes, ev);
+  const passes = checks.filter((c) => c.status === "pass").length;
+  const fails = checks.filter((c) => c.status === "fail").length;
+  return { evidence: ev, checks, tier: deriveTier(ev, checks), passes, fails, allGood: fails === 0 && passes > 0 };
+}
+
+// src/dispute-summary.ts
+var VERIFY_URL = "https://signwho.com/verify";
+var NOT_RECORDED = "not recorded in this package";
+function utcStamp(value) {
+  if (value === null || value === void 0 || value === "") return null;
+  const d = new Date(value);
+  if (Number.isNaN(d.getTime())) return null;
+  return d.toISOString().replace("T", " ").replace(/\.\d{3}Z$/, " UTC");
+}
+function disputeSummaryFilename(documentName) {
+  const base = (documentName || "").replace(/\.pdf$/i, "").replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "");
+  return `SignWho-Dispute-Summary-${base || "document"}.txt`;
+}
+var TIER_LABEL = {
+  identity: "Identity-bound \u2014 selfie, device signature and independent timestamp",
+  device: "Device-verified, no selfie \u2014 device signature and independent timestamp",
+  floor: "Document + timestamp only \u2014 neither identity nor device verified"
+};
+var TAG = { pass: "PASS", fail: "FAIL", skip: "N/A ", info: "NOTE" };
+function buildDisputeSummary(input) {
+  const { report, generatedAt, evidenceSource, isSample } = input;
+  const ev = report.evidence;
+  const events = ev.auditEvents || [];
+  const created = events.find((e) => e.type === "document_created");
+  const viewed = events.find((e) => e.type === "document_viewed");
+  const signed = events.find((e) => e.type === "document_signed");
+  const customerName = ev.signerName || NOT_RECORDED;
+  const customerEmail = signed?.signerEmail || viewed?.signerEmail || NOT_RECORDED;
+  const merchantEmail = ev.senderEmail || created?.senderEmail || NOT_RECORDED;
+  const signedAt = utcStamp(signed?.timestamp ?? ev.completedAt ?? ev.timestamp);
+  const tsaCheck = report.checks.find((c) => c.id === "tsa");
+  const tsaVerified = tsaCheck?.status === "pass" && !!tsaCheck.facts?.genTime;
+  const genTime = utcStamp(tsaVerified ? tsaCheck.facts.genTime : ev.tsaTimestamp?.genTime);
+  const tsaSerial = tsaVerified ? tsaCheck.facts.serial : ev.tsaTimestamp?.serial;
+  const noSelfie = ev.selfieIncluded === false || !ev.selfieHash && !ev.triangleHash;
+  const ipValue = (e) => e?.ip ? `${e.ip}  (${utcStamp(e.timestamp)})` : null;
+  const L = [];
+  const section = (n, title, stripe) => {
+    L.push("", `${n}. ${title}`, `   (Stripe evidence fields: ${stripe})`);
+  };
+  const row = (label, value) => {
+    L.push(`   ${label.padEnd(28)}${value || NOT_RECORDED}`);
+  };
+  L.push("SIGNWHO \u2014 PAYMENT DISPUTE SUMMARY");
+  L.push(`Generated ${utcStamp(generatedAt.getTime())} by the independent verifier at ${VERIFY_URL}.`);
+  L.push("Every check below ran in the browser from the two files alone; no SignWho server was consulted.");
+  if (isSample) L.push("THIS IS SIGNWHO'S BUNDLED SAMPLE PACKAGE \u2014 a demonstration, not a real agreement.");
+  if (!report.allGood) {
+    L.push("", `WARNING: ${report.fails} check(s) FAILED \u2014 this package does not verify. Do not rely on it as-is.`);
+  }
+  section(1, "CUSTOMER", "customer_name, customer_email_address");
+  row("Name (as signed):", customerName);
+  row("E-mail:", customerEmail);
+  row("Assurance level:", TIER_LABEL[report.tier]);
+  section(2, "CUSTOMER IP ADDRESSES", "customer_purchase_ip");
+  row("Viewed the document from:", ipValue(viewed));
+  row("Signed the document from:", ipValue(signed));
+  section(3, "TIMESTAMPS (UTC)", "service_date, customer_communication");
+  row("Document sent:", utcStamp(created?.timestamp));
+  row("Document viewed:", utcStamp(viewed?.timestamp));
+  row("Document signed:", signedAt);
+  row("Independent timestamp:", genTime ? `${genTime} \u2014 ${ev.tsaTimestamp?.tsa || "RFC 3161 TSA"}${tsaSerial ? `, token serial ${tsaSerial}` : ""} ${tsaVerified ? "(RFC 3161, third party)" : "(declared in the evidence, NOT verified by the timestamp check)"}` : null);
+  const gapNote = report.checks.find((c) => c.id === "tsa-gap");
+  if (gapNote) L.push(`   NOTE: ${gapNote.detail}`);
+  section(4, "DOCUMENT", "customer_signature, service_documentation");
+  row("Document name:", ev.documentName);
+  row("Sent by (merchant):", merchantEmail);
+  row("SHA-256, signed PDF:", ev.signedPdfHash || (evidenceSource === "embedded" ? "not present \u2014 the evidence was read from inside the PDF; the standalone evidence.json carries the file hash" : null));
+  row("SHA-256, original document:", ev.documentHash);
+  row("Signature method:", ev.authMethod === "biometric" ? "device biometric (Face ID / fingerprint / Windows Hello) \u2014 WebAuthn assertion" : ev.authMethod === "passkey" ? "device passkey \u2014 WebAuthn assertion" : ev.authMethod === "manual" ? "manual (no device signature)" : ev.webauthnProof ? "WebAuthn assertion" : null);
+  row("Customer's face:", noSelfie ? "no selfie was captured for this signature" : `a selfie was captured at signing (SHA-256 ${ev.selfieHash || NOT_RECORDED}); the image is printed on the certificate page of the signed PDF`);
+  section(5, `VERIFICATION RESULTS \u2014 ${report.passes} of ${report.checks.filter((c) => c.status !== "info").length} checks passed`, "uncategorized_text");
+  for (const c of report.checks) {
+    L.push(`   [${TAG[c.status]}] ${c.label}`);
+    L.push(`          ${c.detail}`);
+  }
+  L.push("", "6. HOW TO RE-VERIFY (for the card network or the customer's bank)");
+  L.push(`   Open the signed PDF and the evidence.json at ${VERIFY_URL} \u2014 the checks run in the browser, nothing is uploaded.`);
+  L.push("   Attach both files to the dispute: the signed PDF as the customer's signature, the evidence.json as the service documentation.");
+  if (input.pdfName || input.evidenceFileName) {
+    L.push(`   Files verified for this summary: ${[input.pdfName, input.evidenceFileName].filter(Boolean).join(", ")}`);
+  }
+  L.push("   The algorithms are public standards (SHA-256, WebAuthn/FIDO2, RFC 3161); anyone can re-run them with open tools.");
+  L.push("");
+  return { text: L.join("\n"), filename: disputeSummaryFilename(ev.documentName) };
+}
+
+export { FREETSA_CA_PEM, TSA_GAP_NOTE_THRESHOLD_MS, VERIFY_URL, buildDisputeSummary, checkFileIntegrity, checkTriangleHash, checkTsa, checkWebAuthn, deriveTier, describeGap, disputeSummaryFilename, extractEmbeddedEvidence, runAllChecks, selfieNote, timestampGapNote, utcStamp, verifyPackage };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map