@suveren/gateway 0.17.0 → 0.18.1

package/dist/mcp-server/chunk-JUFH4SKS.mjs

@@ -0,0 +1,639 @@
+// src/lib/as-pairing.ts
+import { createHash } from "crypto";
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "fs";
+import { dirname, join } from "path";
+function pairingPath(dataDir) {
+  return join(dataDir, "as-pairing.json");
+}
+function readPairing(dataDir) {
+  const path = pairingPath(dataDir);
+  if (!existsSync(path)) return null;
+  try {
+    const data = JSON.parse(readFileSync(path, "utf-8"));
+    if (typeof data.asUrl !== "string" || typeof data.publicKeyHex !== "string") return null;
+    return {
+      asUrl: data.asUrl,
+      publicKeyHex: data.publicKeyHex,
+      pairedAt: data.pairedAt ?? "",
+      ...typeof data.tlsSpkiPinHex === "string" ? { tlsSpkiPinHex: data.tlsSpkiPinHex } : {}
+    };
+  } catch {
+    return null;
+  }
+}
+function fingerprintOf(publicKeyHex) {
+  const raw = Buffer.from(publicKeyHex, "hex");
+  const digest = createHash("sha256").update(raw).digest("hex").toUpperCase();
+  return digest.match(/.{1,4}/g)?.join(":") ?? digest;
+}
+
+// src/lib/report/export-types.ts
+function isExportBundle(v) {
+  if (!v || typeof v !== "object") return false;
+  const o = v;
+  if (o.format !== "suveren-report-export" || o.version !== 1) return false;
+  if (!o.report || typeof o.report !== "object") return false;
+  if (!Array.isArray(o.tickets)) return false;
+  if (!o.authorizations || typeof o.authorizations !== "object") return false;
+  if (!o.authorityServer || typeof o.authorityServer !== "object") return false;
+  const as = o.authorityServer;
+  return typeof as.url === "string" && typeof as.publicKeyHex === "string";
+}
+
+// src/lib/report/verify-export.ts
+import { Parser as Parser2 } from "htmlparser2";
+import { verifyReceiptSignature as verifyReceiptSignature2, verifyAttestationSignature as verifyAttestationSignature2, decodeAttestationBlob as decodeAttestationBlob2 } from "@hap/core";
+
+// src/lib/report/parse-elements.ts
+import { Parser } from "htmlparser2";
+function parseElements(html) {
+  const found = [];
+  const seenCount = /* @__PURE__ */ new Map();
+  const parser = new Parser(
+    {
+      onopentag(name, attribs) {
+        if (!name.startsWith("sv-")) return;
+        const n = seenCount.get(name) ?? 0;
+        seenCount.set(name, n + 1);
+        found.push({ id: `${name}-${n}`, kind: name, attrs: { ...attribs } });
+      }
+    },
+    { decodeEntities: true }
+  );
+  parser.write(html);
+  parser.end();
+  return found;
+}
+
+// src/lib/report/ticket-resolvers.ts
+import { verifyReceiptSignature, verifyAttestationSignature, decodeAttestationBlob } from "@hap/core";
+
+// src/lib/report/format.ts
+import { getProfile } from "@hap/core";
+var MONTHS = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"];
+function formatDateTime(value) {
+  const n = typeof value === "number" ? value : Number(value);
+  if (!Number.isFinite(n)) return "unknown time";
+  const d = new Date(n * 1e3);
+  const day = d.getDate();
+  const month = MONTHS[d.getMonth()];
+  const hh = String(d.getHours()).padStart(2, "0");
+  const mm = String(d.getMinutes()).padStart(2, "0");
+  return `${day} ${month}, ${hh}:${mm}`;
+}
+function formatDuration(value) {
+  const n = typeof value === "number" ? value : Number(value);
+  if (!Number.isFinite(n) || n < 0) return "unknown duration";
+  const mins = Math.round(n / 60);
+  if (mins < 60) return `${mins} min`;
+  const hrs = Math.floor(mins / 60);
+  const rem = mins % 60;
+  return `${hrs} h ${String(rem).padStart(2, "0")} min`;
+}
+function groupThousands(n) {
+  const sign = n < 0 ? "-" : "";
+  const [intPart, frac] = Math.abs(n).toString().split(".");
+  const grouped = intPart.replace(/\B(?=(\d{3})+(?!\d))/g, " ");
+  return sign + grouped + (frac ? `.${frac}` : "");
+}
+var CURRENCY_SYMBOLS = { EUR: "\u20AC", USD: "$", GBP: "\xA3" };
+function formatCurrency(amount, currencyCode) {
+  const n = typeof amount === "number" ? amount : Number(amount);
+  if (!Number.isFinite(n)) return String(amount ?? "");
+  if (!currencyCode) return groupThousands(n);
+  const code = currencyCode.toUpperCase();
+  const symbol = CURRENCY_SYMBOLS[code];
+  return symbol ? `${symbol} ${groupThousands(n)}` : `${code} ${groupThousands(n)}`;
+}
+function formatBoundValue(unit, value, fallbackCurrency) {
+  const n = typeof value === "number" ? value : Number(value);
+  if (!Number.isFinite(n)) return String(value ?? "");
+  if (!unit || unit === "count") {
+    return fallbackCurrency ? formatCurrency(n, fallbackCurrency) : groupThousands(n);
+  }
+  if (unit === "minutes") return `${groupThousands(n)} min`;
+  if (unit === "hours") return `${groupThousands(n)} h`;
+  if (unit === "days") return `${groupThousands(n)} d`;
+  if (unit === "percent") return `${groupThousands(n)}%`;
+  if (unit.startsWith("currency:")) return formatCurrency(n, unit.slice("currency:".length));
+  return `${groupThousands(n)} ${unit}`;
+}
+function humanizeKey(key) {
+  return key.replace(/_/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
+}
+function formatBoundLabel(profileId, key, value, fallbackCurrency) {
+  const profile = profileId ? getProfile(profileId) : void 0;
+  const field = profile?.boundsSchema?.fields?.[key];
+  const displayName = field?.displayName ?? humanizeKey(key);
+  return `${displayName}: ${formatBoundValue(field?.unit, value, fallbackCurrency)}`;
+}
+function formatOwnerLabel(did) {
+  if (!did) return "Unknown owner";
+  const tail = did.length > 6 ? did.slice(-6) : did;
+  return `Owner (key \u2026${tail})`;
+}
+function profileShortLabel(profileId) {
+  if (!profileId) return "Unknown profile";
+  const name = profileId.split("@")[0].split("/").pop();
+  if (!name) return profileId;
+  return name.charAt(0).toUpperCase() + name.slice(1);
+}
+var ACTION_LABELS = {
+  create_quote: "Quote created",
+  update_quote: "Quote updated",
+  send_quote: "Quote sent",
+  convert_quote_to_order: "Order placed",
+  create_order: "Order created",
+  update_order: "Order updated",
+  send_message: "Reply sent",
+  send_email: "Reply sent",
+  create_contact: "Contact created",
+  update_contact: "Contact updated",
+  create_deal: "Deal created",
+  update_deal: "Deal updated",
+  create_task: "Task created",
+  update_task: "Task updated",
+  log_activity: "Activity logged",
+  create_record: "Record created",
+  update_record: "Record updated",
+  delete_record: "Record deleted",
+  create_event: "Event created",
+  update_event: "Event updated",
+  delete_event: "Event deleted",
+  publish_post: "Post published"
+};
+function pastTense(verb) {
+  if (!verb) return verb;
+  if (/e$/.test(verb)) return `${verb}d`;
+  return `${verb}ed`;
+}
+function capitalize(s) {
+  return s.length > 0 ? s.charAt(0).toUpperCase() + s.slice(1) : s;
+}
+function formatActionLabel(action) {
+  const raw = String(action ?? "").trim();
+  if (!raw) return "Action";
+  const withoutSystem = raw.includes("__") ? raw.slice(raw.indexOf("__") + 2) : raw;
+  const known = ACTION_LABELS[withoutSystem];
+  if (known) return known;
+  const parts = withoutSystem.split("_").filter(Boolean);
+  if (parts.length === 0) return capitalize(raw);
+  const [verb, ...rest] = parts;
+  if (rest.length === 0) return capitalize(pastTense(verb));
+  return `${capitalize(rest.join(" "))} ${pastTense(verb)}`;
+}
+var METRIC_LABELS = {
+  completed: "cases completed",
+  "median-time": "median time, start \u2192 goal",
+  "average-time": "average time, start \u2192 goal",
+  "without-approval": "share without approval",
+  approvals: "approvals",
+  "median-approval-wait": "median approval wait",
+  tickets: "tickets",
+  refusals: "system refusals"
+};
+function formatMetricValue(kind, value) {
+  const n = typeof value === "number" ? value : Number(value);
+  if (kind === "without-approval" && Number.isFinite(n)) return `${Math.round(n * 100)}%`;
+  if ((kind === "median-time" || kind === "average-time" || kind === "median-approval-wait") && Number.isFinite(n)) {
+    return formatDuration(n);
+  }
+  return String(value);
+}
+
+// src/lib/report/ticket-resolvers.ts
+function findReceiptEntry(archive, ticketId2) {
+  return archive.getReceipts().find((r) => r.receipt.id === ticketId2);
+}
+function findAuthorization(archive, authorizationId) {
+  return archive.getAuthorizations().find((a) => a.authorizationId === authorizationId);
+}
+async function checkTicket(archive, ticketId2) {
+  const entry = findReceiptEntry(archive, ticketId2);
+  if (!entry) {
+    return { ok: false, reason: `No ticket "${ticketId2}" in the local archive.` };
+  }
+  if (!entry.asPublicKey) {
+    return { ok: false, reason: `Ticket "${ticketId2}" has no archived Authority Server key to verify it against.`, entry };
+  }
+  try {
+    await verifyReceiptSignature(entry.receipt, entry.asPublicKey);
+  } catch (err) {
+    return {
+      ok: false,
+      reason: `Ticket "${ticketId2}" signature does not verify: ${err instanceof Error ? err.message : String(err)}`,
+      entry
+    };
+  }
+  return { ok: true, entry };
+}
+function checkUrlFor(entry) {
+  const id = String(entry.receipt.id ?? "");
+  return `${entry.asUrl.replace(/\/+$/, "")}/r/${id}`;
+}
+async function resolveTicketElement(archive, ref) {
+  const check = await checkTicket(archive, ref);
+  if (!check.ok) return { status: "unverifiable", reason: check.reason };
+  const r = check.entry.receipt;
+  return {
+    status: "verified",
+    data: {
+      ticketId: ref,
+      action: r.action,
+      actionLabel: formatActionLabel(r.action),
+      time: r.timestamp,
+      timeLabel: formatDateTime(r.timestamp),
+      profile: r.profileId,
+      profileLabel: profileShortLabel(typeof r.profileId === "string" ? r.profileId : void 0),
+      authorizationId: r.authorizationId,
+      limitsUsed: r.limits ?? r.executionContext ?? {},
+      checkUrl: checkUrlFor(check.entry)
+    }
+  };
+}
+async function resolveApprovalElement(archive, ticketRef) {
+  const check = await checkTicket(archive, ticketRef);
+  if (!check.ok) return { status: "unverifiable", reason: check.reason };
+  const proposal = check.entry.proposal;
+  if (!proposal) {
+    return {
+      status: "unverifiable",
+      reason: `Ticket "${ticketRef}" has no archived approval (it ran without review).`
+    };
+  }
+  const committedBy = proposal.committedBy ?? {};
+  const approvers = Object.values(committedBy);
+  const createdAt = typeof proposal.createdAt === "number" ? proposal.createdAt : void 0;
+  const decidedAt = approvers.length > 0 ? Math.max(...approvers.map((a) => a.at)) : void 0;
+  const waitSeconds = createdAt !== void 0 && decidedAt !== void 0 ? decidedAt - createdAt : void 0;
+  const who = approvers.map((a) => a.userId);
+  return {
+    status: "verified",
+    data: {
+      ticketId: ticketRef,
+      who,
+      whoLabel: who.length > 0 ? who.join(", ") : "unknown",
+      createdAt,
+      createdAtLabel: createdAt !== void 0 ? formatDateTime(createdAt) : "unknown",
+      decidedAt,
+      decidedAtLabel: decidedAt !== void 0 ? formatDateTime(decidedAt) : "unknown",
+      waitSeconds,
+      waitLabel: waitSeconds !== void 0 ? formatDuration(waitSeconds) : "unknown",
+      status: proposal.status
+    }
+  };
+}
+async function resolveMandateElement(archive, ticketRef) {
+  const check = await checkTicket(archive, ticketRef);
+  if (!check.ok) return { status: "unverifiable", reason: check.reason };
+  const r = check.entry.receipt;
+  const authorizationId = typeof r.authorizationId === "string" ? r.authorizationId : void 0;
+  if (!authorizationId) {
+    return { status: "unverifiable", reason: `Ticket "${ticketRef}" carries no authorizationId.` };
+  }
+  const auth = findAuthorization(archive, authorizationId);
+  if (!auth) {
+    return { status: "unverifiable", reason: `No archived mandate "${authorizationId}" for ticket "${ticketRef}".` };
+  }
+  if (auth.boundsHash && typeof r.boundsHash === "string" && auth.boundsHash !== r.boundsHash) {
+    return {
+      status: "unverifiable",
+      reason: `Mandate "${authorizationId}" boundsHash does not match ticket "${ticketRef}".`
+    };
+  }
+  let mode;
+  let owners = [];
+  let ownersRaw = [];
+  const firstBlob = auth.attestations[0]?.blob;
+  if (firstBlob && check.entry.asPublicKey) {
+    try {
+      const attestation = decodeAttestationBlob(firstBlob);
+      await verifyAttestationSignature(attestation, check.entry.asPublicKey);
+      mode = attestation.payload.commitment_mode;
+      const dids = attestation.payload.resolved_owners ?? [];
+      const subjects = attestation.payload.subjects ?? [];
+      ownersRaw = dids;
+      owners = dids.map((did) => {
+        const subject = subjects.find((s) => s.did === did);
+        return subject?.assurance === "high" && subject.disclose?.name ? subject.disclose.name : formatOwnerLabel(did);
+      });
+    } catch {
+    }
+  }
+  const fallbackCurrency = typeof auth.context?.currency === "string" ? auth.context.currency : void 0;
+  const rawLimits = auth.bounds ?? {};
+  const limits = Object.entries(rawLimits).map(([key, value]) => formatBoundLabel(auth.profileId, key, value, fallbackCurrency));
+  return {
+    status: "verified",
+    data: {
+      authorizationId,
+      profile: auth.profileId,
+      profileLabel: profileShortLabel(auth.profileId),
+      limits,
+      rawLimits,
+      intent: auth.intent,
+      mode,
+      owners,
+      ownersRaw
+    }
+  };
+}
+
+// src/lib/report/time.ts
+function parseTimestampSeconds(value) {
+  if (typeof value !== "string" || !value.trim()) return void 0;
+  const iso = /^\d{4}-\d{2}-\d{2}[ T]\d{2}:\d{2}:\d{2}/.test(value) && !/[zZ]|[+-]\d{2}:?\d{2}$/.test(value) ? `${value.replace(" ", "T")}Z` : value;
+  const ms = Date.parse(iso);
+  return Number.isFinite(ms) ? Math.floor(ms / 1e3) : void 0;
+}
+
+// src/lib/report/case-resolvers.ts
+function parseRef(value) {
+  if (!value) return { id: "" };
+  const i = value.indexOf(":");
+  if (i === -1) return { id: value.trim() };
+  return { type: value.slice(0, i).trim(), id: value.slice(i + 1).trim() };
+}
+function parseStepRefs(value) {
+  if (!value) return [];
+  return value.split(/\s+/).filter(Boolean).map((s) => parseRef(s).id || s);
+}
+function parseRecipients(toJson, ccJson) {
+  const out = [];
+  for (const raw of [toJson, ccJson]) {
+    if (!raw) continue;
+    try {
+      const arr = JSON.parse(raw);
+      if (Array.isArray(arr)) out.push(...arr.filter((x) => typeof x === "string"));
+    } catch {
+    }
+  }
+  return out.map((s) => s.toLowerCase());
+}
+function parseCaseAttrs(attrs) {
+  return {
+    startId: parseRef(attrs.start).id,
+    goalId: parseRef(attrs.goal).id,
+    stepIds: parseStepRefs(attrs.steps)
+  };
+}
+async function resolveCaseElement(archive, emailExport, attrs) {
+  const start = parseRef(attrs.start);
+  const startMessage = emailExport.inbox.find((m) => m.id === start.id);
+  if (!startMessage || !startMessage.case_id) {
+    return { status: "unverifiable", reason: `start "${attrs.start ?? ""}" is not a loaded case email with a case_id.` };
+  }
+  const startCaseId = startMessage.case_id;
+  const startTime = parseTimestampSeconds(startMessage.received_at);
+  if (startTime === void 0) {
+    return { status: "unverifiable", reason: `start message "${start.id}" has an unparseable received_at.`, startCaseId };
+  }
+  const goal = parseRef(attrs.goal);
+  const goalCheck = await checkTicket(archive, goal.id);
+  if (!goalCheck.ok) {
+    return { status: "unverifiable", reason: `goal: ${goalCheck.reason}`, startCaseId };
+  }
+  const goalReceipt = goalCheck.entry.receipt;
+  const goalTime = typeof goalReceipt.timestamp === "number" ? goalReceipt.timestamp : void 0;
+  if (goalTime === void 0) {
+    return { status: "unverifiable", reason: `goal ticket "${goal.id}" has no numeric timestamp.`, startCaseId };
+  }
+  if (goalTime < startTime) {
+    return { status: "unverifiable", reason: `goal ticket "${goal.id}" is timestamped before start "${start.id}".`, startCaseId };
+  }
+  const stepIds = parseStepRefs(attrs.steps);
+  const steps = [];
+  for (const stepId of stepIds) {
+    const stepCheck = await checkTicket(archive, stepId);
+    if (!stepCheck.ok) {
+      return { status: "unverifiable", reason: `step: ${stepCheck.reason}`, startCaseId };
+    }
+    const stepReceipt = stepCheck.entry.receipt;
+    const stepTime = typeof stepReceipt.timestamp === "number" ? stepReceipt.timestamp : void 0;
+    if (stepTime === void 0 || stepTime < startTime || stepTime > goalTime) {
+      return { status: "unverifiable", reason: `step ticket "${stepId}" is outside the case window [${startTime}, ${goalTime}].`, startCaseId };
+    }
+    steps.push({ ticketId: stepId, time: stepTime, action: stepReceipt.action });
+  }
+  let warningReason;
+  const sentForGoal = emailExport.sent.find((m) => m.receipt_id === goal.id);
+  if (sentForGoal) {
+    const isReply = sentForGoal.in_reply_to === start.id;
+    const recipients = parseRecipients(sentForGoal.to_json, sentForGoal.cc_json);
+    const addressedToSender = recipients.includes(startMessage.from_email.toLowerCase());
+    if (!isReply && !addressedToSender) {
+      warningReason = "goal link not confirmed";
+    }
+  }
+  const approvals = [];
+  for (const ticketId2 of [goal.id, ...stepIds]) {
+    const approval = await resolveApprovalElement(archive, ticketId2);
+    if (approval.status === "verified") {
+      approvals.push({ ticketId: ticketId2, ...approval.data });
+    }
+  }
+  const timeline = [
+    { type: "start", time: startTime, label: start.id },
+    ...steps.map((s) => ({ type: "step", time: s.time, label: s.ticketId })),
+    ...approvals.map((a) => ({ type: "approval", time: a.decidedAt ?? a.createdAt ?? 0, label: a.ticketId })),
+    { type: "goal", time: goalTime, label: goal.id }
+  ].sort((a, b) => a.time - b.time);
+  return {
+    status: warningReason ? "warning" : "verified",
+    reason: warningReason,
+    startCaseId,
+    data: {
+      caseId: startCaseId,
+      start: { id: start.id, time: startTime, sender: startMessage.from_email },
+      goal: { ticketId: goal.id, time: goalTime, action: goalReceipt.action },
+      steps,
+      approvals,
+      timeline,
+      totalDurationSeconds: goalTime - startTime
+    }
+  };
+}
+
+// src/lib/report/verify-export.ts
+function collectReferencedTicketIds(html) {
+  const ids = /* @__PURE__ */ new Set();
+  for (const el of parseElements(html)) {
+    if (el.kind === "sv-ticket" && el.attrs.ref) ids.add(el.attrs.ref);
+    if ((el.kind === "sv-approval" || el.kind === "sv-mandate") && el.attrs.ticket) ids.add(el.attrs.ticket);
+    if (el.kind === "sv-case") {
+      const { goalId, stepIds } = parseCaseAttrs(el.attrs);
+      if (goalId) ids.add(goalId);
+      for (const s of stepIds) ids.add(s);
+    }
+  }
+  return ids;
+}
+function ticketIdsOf(el) {
+  if (el.kind === "sv-ticket") return el.attrs.ref ? [el.attrs.ref] : [];
+  if (el.kind === "sv-approval" || el.kind === "sv-mandate") return el.attrs.ticket ? [el.attrs.ticket] : [];
+  if (el.kind === "sv-case") {
+    const { goalId, stepIds } = parseCaseAttrs(el.attrs);
+    return [...goalId ? [goalId] : [], ...stepIds];
+  }
+  return [];
+}
+var TICKET_BACKED_KINDS = /* @__PURE__ */ new Set(["sv-ticket", "sv-approval", "sv-mandate", "sv-case"]);
+var PROOF_SCRIPT_BLOCK_RE = /<script[^>]*id="suveren-proof"[^>]*>[\s\S]*?<\/script>/gi;
+function collectPresentedStates(documentHtml) {
+  const html = documentHtml.replace(PROOF_SCRIPT_BLOCK_RE, "");
+  const open = [];
+  const flaggedById = /* @__PURE__ */ new Map();
+  let depth = 0;
+  const classesOf = (attribs) => new Set((attribs.class ?? "").split(/\s+/).filter(Boolean));
+  const settle = (f) => {
+    const flagged = f.classes.has("sv-el-unverifiable") && !f.classes.has("sv-el-verified") && !f.classes.has("sv-el-warning") && f.badges.length > 0 && f.badges.every((b) => b.has("sv-badge-bad") && !b.has("sv-badge-ok") && !b.has("sv-badge-warn"));
+    flaggedById.set(f.id, (flaggedById.get(f.id) ?? true) && flagged);
+  };
+  const parser = new Parser2(
+    {
+      onopentag(_name, attribs) {
+        depth++;
+        const classes = classesOf(attribs);
+        if ([...classes].some((c) => c.startsWith("sv-badge"))) {
+          for (const f of open) f.badges.push(classes);
+        }
+        const id = attribs["data-sv-id"];
+        if (typeof id === "string" && id) open.push({ id, depth, classes, badges: [] });
+      },
+      onclosetag() {
+        while (open.length > 0 && open[open.length - 1].depth >= depth) settle(open.pop());
+        depth--;
+      }
+    },
+    { decodeEntities: true }
+  );
+  parser.write(html);
+  parser.end();
+  while (open.length > 0) settle(open.pop());
+  const states = /* @__PURE__ */ new Map();
+  for (const [id, flagged] of flaggedById) states.set(id, flagged ? "not-verifiable" : "verified");
+  return states;
+}
+function ticketId(receipt) {
+  return typeof receipt.id === "string" ? receipt.id : "";
+}
+async function checkAttestations(auth, publicKeyHex) {
+  if (auth.attestations.length === 0) {
+    return { valid: false, error: "No archived mandate attestation for this authorization." };
+  }
+  for (const att of auth.attestations) {
+    try {
+      const attestation = decodeAttestationBlob2(att.blob);
+      await verifyAttestationSignature2(attestation, publicKeyHex);
+    } catch (err) {
+      return { valid: false, error: err instanceof Error ? err.message : String(err) };
+    }
+  }
+  return { valid: true };
+}
+async function verifyExportBundle(bundle, opts = {}) {
+  const byId = new Map(bundle.tickets.map((t) => [ticketId(t), t]));
+  const referencedIds = collectReferencedTicketIds(bundle.report.html);
+  const allIds = /* @__PURE__ */ new Set([...referencedIds, ...byId.keys()]);
+  const tickets = [];
+  for (const id of allIds) {
+    const receipt = byId.get(id);
+    if (!receipt) {
+      tickets.push({ ticketId: id, referenced: referencedIds.has(id), present: false, signatureValid: false, error: "Not present in the bundle." });
+      continue;
+    }
+    try {
+      await verifyReceiptSignature2(receipt, bundle.authorityServer.publicKeyHex);
+      tickets.push({ ticketId: id, referenced: referencedIds.has(id), present: true, signatureValid: true });
+    } catch (err) {
+      tickets.push({
+        ticketId: id,
+        referenced: referencedIds.has(id),
+        present: true,
+        signatureValid: false,
+        error: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  const authorizations = [];
+  for (const [authorizationId, auth] of Object.entries(bundle.authorizations)) {
+    const { valid: attestationValid, error: attestationError } = await checkAttestations(auth, bundle.authorityServer.publicKeyHex);
+    let boundsHashMatches = "n/a";
+    const representative = [...byId.values()].find((r) => r.authorizationId === authorizationId);
+    if (auth.boundsHash && representative && typeof representative.boundsHash === "string") {
+      boundsHashMatches = auth.boundsHash === representative.boundsHash;
+    }
+    authorizations.push({
+      authorizationId,
+      attestationValid,
+      boundsHashMatches,
+      ...attestationError ? { error: attestationError } : boundsHashMatches === false ? { error: `boundsHash does not match ticket ${representative?.id ?? "unknown"}.` } : {}
+    });
+  }
+  const ticketById = new Map(tickets.map((t) => [t.ticketId, t]));
+  const authById = new Map(authorizations.map((a) => [a.authorizationId, a]));
+  const presentedStates = opts.documentHtml !== void 0 ? collectPresentedStates(opts.documentHtml) : /* @__PURE__ */ new Map();
+  const elements = [];
+  for (const el of parseElements(bundle.report.html)) {
+    if (!TICKET_BACKED_KINDS.has(el.kind)) continue;
+    const ticketIds = ticketIdsOf(el);
+    const presented = presentedStates.get(el.id) ?? "verified";
+    let error;
+    if (ticketIds.length === 0) error = "Names no ticket.";
+    for (const id of ticketIds) {
+      if (error) break;
+      const t = ticketById.get(id);
+      if (!t || !t.present) error = `Ticket ${id} is not in the bundle.`;
+      else if (!t.signatureValid) error = `Ticket ${id} has an invalid signature.`;
+    }
+    if (!error && el.kind === "sv-mandate") {
+      const receipt = byId.get(ticketIds[0]);
+      const authorizationId = typeof receipt.authorizationId === "string" ? receipt.authorizationId : void 0;
+      const auth = authorizationId ? bundle.authorizations[authorizationId] : void 0;
+      const authCheck = authorizationId ? authById.get(authorizationId) : void 0;
+      if (!auth || !authCheck) error = `The mandate for ticket ${ticketIds[0]} is not in the bundle.`;
+      else if (!authCheck.attestationValid) error = `The mandate for ticket ${ticketIds[0]} has an invalid attestation.`;
+      else if (auth.boundsHash && typeof receipt.boundsHash === "string" && auth.boundsHash !== receipt.boundsHash) {
+        error = `The mandate's boundsHash does not match ticket ${ticketIds[0]}.`;
+      }
+    }
+    elements.push({ elementId: el.id, kind: el.kind, ticketIds, presented, backed: !error, ...error ? { error } : {} });
+  }
+  const keyFingerprint = fingerprintOf(bundle.authorityServer.publicKeyHex);
+  const keyConfirmation = resolveKeyConfirmation(bundle.authorityServer.publicKeyHex, opts);
+  const allValid = tickets.filter((t) => t.present).every((t) => t.signatureValid) && authorizations.every((a) => a.attestationValid && a.boundsHashMatches !== false) && elements.every((e) => e.presented === "not-verifiable" || e.backed);
+  return { tickets, elements, authorizations, keyFingerprint, keyConfirmation, allValid };
+}
+function resolveKeyConfirmation(actualKeyHex, opts) {
+  const normalize = (h) => h.trim().toLowerCase();
+  if (opts.expectedKeyHex !== void 0) {
+    if (normalize(opts.expectedKeyHex) === normalize(actualKeyHex)) return { state: "confirmed", source: "provided" };
+    return { state: "mismatch", source: "provided", expectedFingerprint: fingerprintOf(opts.expectedKeyHex) };
+  }
+  if (opts.onlineKeyHex !== void 0) {
+    if (normalize(opts.onlineKeyHex) === normalize(actualKeyHex)) return { state: "confirmed", source: "online" };
+    return { state: "mismatch", source: "online", expectedFingerprint: fingerprintOf(opts.onlineKeyHex) };
+  }
+  return { state: "unconfirmed" };
+}
+
+export {
+  readPairing,
+  fingerprintOf,
+  parseElements,
+  formatDateTime,
+  formatDuration,
+  formatCurrency,
+  profileShortLabel,
+  formatActionLabel,
+  METRIC_LABELS,
+  formatMetricValue,
+  resolveTicketElement,
+  resolveApprovalElement,
+  resolveMandateElement,
+  parseTimestampSeconds,
+  parseCaseAttrs,
+  resolveCaseElement,
+  isExportBundle,
+  verifyExportBundle
+};