@suveren/gateway 0.18.1 → 0.19.0

package/dist/mcp-server/chunk-JUFH4SKS.mjs

@@ -1,639 +0,0 @@
-// src/lib/as-pairing.ts
-import { createHash } from "crypto";
-import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "fs";
-import { dirname, join } from "path";
-function pairingPath(dataDir) {
-  return join(dataDir, "as-pairing.json");
-}
-function readPairing(dataDir) {
-  const path = pairingPath(dataDir);
-  if (!existsSync(path)) return null;
-  try {
-    const data = JSON.parse(readFileSync(path, "utf-8"));
-    if (typeof data.asUrl !== "string" || typeof data.publicKeyHex !== "string") return null;
-    return {
-      asUrl: data.asUrl,
-      publicKeyHex: data.publicKeyHex,
-      pairedAt: data.pairedAt ?? "",
-      ...typeof data.tlsSpkiPinHex === "string" ? { tlsSpkiPinHex: data.tlsSpkiPinHex } : {}
-    };
-  } catch {
-    return null;
-  }
-}
-function fingerprintOf(publicKeyHex) {
-  const raw = Buffer.from(publicKeyHex, "hex");
-  const digest = createHash("sha256").update(raw).digest("hex").toUpperCase();
-  return digest.match(/.{1,4}/g)?.join(":") ?? digest;
-}
-
-// src/lib/report/export-types.ts
-function isExportBundle(v) {
-  if (!v || typeof v !== "object") return false;
-  const o = v;
-  if (o.format !== "suveren-report-export" || o.version !== 1) return false;
-  if (!o.report || typeof o.report !== "object") return false;
-  if (!Array.isArray(o.tickets)) return false;
-  if (!o.authorizations || typeof o.authorizations !== "object") return false;
-  if (!o.authorityServer || typeof o.authorityServer !== "object") return false;
-  const as = o.authorityServer;
-  return typeof as.url === "string" && typeof as.publicKeyHex === "string";
-}
-
-// src/lib/report/verify-export.ts
-import { Parser as Parser2 } from "htmlparser2";
-import { verifyReceiptSignature as verifyReceiptSignature2, verifyAttestationSignature as verifyAttestationSignature2, decodeAttestationBlob as decodeAttestationBlob2 } from "@hap/core";
-
-// src/lib/report/parse-elements.ts
-import { Parser } from "htmlparser2";
-function parseElements(html) {
-  const found = [];
-  const seenCount = /* @__PURE__ */ new Map();
-  const parser = new Parser(
-    {
-      onopentag(name, attribs) {
-        if (!name.startsWith("sv-")) return;
-        const n = seenCount.get(name) ?? 0;
-        seenCount.set(name, n + 1);
-        found.push({ id: `${name}-${n}`, kind: name, attrs: { ...attribs } });
-      }
-    },
-    { decodeEntities: true }
-  );
-  parser.write(html);
-  parser.end();
-  return found;
-}
-
-// src/lib/report/ticket-resolvers.ts
-import { verifyReceiptSignature, verifyAttestationSignature, decodeAttestationBlob } from "@hap/core";
-
-// src/lib/report/format.ts
-import { getProfile } from "@hap/core";
-var MONTHS = ["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"];
-function formatDateTime(value) {
-  const n = typeof value === "number" ? value : Number(value);
-  if (!Number.isFinite(n)) return "unknown time";
-  const d = new Date(n * 1e3);
-  const day = d.getDate();
-  const month = MONTHS[d.getMonth()];
-  const hh = String(d.getHours()).padStart(2, "0");
-  const mm = String(d.getMinutes()).padStart(2, "0");
-  return `${day} ${month}, ${hh}:${mm}`;
-}
-function formatDuration(value) {
-  const n = typeof value === "number" ? value : Number(value);
-  if (!Number.isFinite(n) || n < 0) return "unknown duration";
-  const mins = Math.round(n / 60);
-  if (mins < 60) return `${mins} min`;
-  const hrs = Math.floor(mins / 60);
-  const rem = mins % 60;
-  return `${hrs} h ${String(rem).padStart(2, "0")} min`;
-}
-function groupThousands(n) {
-  const sign = n < 0 ? "-" : "";
-  const [intPart, frac] = Math.abs(n).toString().split(".");
-  const grouped = intPart.replace(/\B(?=(\d{3})+(?!\d))/g, " ");
-  return sign + grouped + (frac ? `.${frac}` : "");
-}
-var CURRENCY_SYMBOLS = { EUR: "\u20AC", USD: "$", GBP: "\xA3" };
-function formatCurrency(amount, currencyCode) {
-  const n = typeof amount === "number" ? amount : Number(amount);
-  if (!Number.isFinite(n)) return String(amount ?? "");
-  if (!currencyCode) return groupThousands(n);
-  const code = currencyCode.toUpperCase();
-  const symbol = CURRENCY_SYMBOLS[code];
-  return symbol ? `${symbol} ${groupThousands(n)}` : `${code} ${groupThousands(n)}`;
-}
-function formatBoundValue(unit, value, fallbackCurrency) {
-  const n = typeof value === "number" ? value : Number(value);
-  if (!Number.isFinite(n)) return String(value ?? "");
-  if (!unit || unit === "count") {
-    return fallbackCurrency ? formatCurrency(n, fallbackCurrency) : groupThousands(n);
-  }
-  if (unit === "minutes") return `${groupThousands(n)} min`;
-  if (unit === "hours") return `${groupThousands(n)} h`;
-  if (unit === "days") return `${groupThousands(n)} d`;
-  if (unit === "percent") return `${groupThousands(n)}%`;
-  if (unit.startsWith("currency:")) return formatCurrency(n, unit.slice("currency:".length));
-  return `${groupThousands(n)} ${unit}`;
-}
-function humanizeKey(key) {
-  return key.replace(/_/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
-}
-function formatBoundLabel(profileId, key, value, fallbackCurrency) {
-  const profile = profileId ? getProfile(profileId) : void 0;
-  const field = profile?.boundsSchema?.fields?.[key];
-  const displayName = field?.displayName ?? humanizeKey(key);
-  return `${displayName}: ${formatBoundValue(field?.unit, value, fallbackCurrency)}`;
-}
-function formatOwnerLabel(did) {
-  if (!did) return "Unknown owner";
-  const tail = did.length > 6 ? did.slice(-6) : did;
-  return `Owner (key \u2026${tail})`;
-}
-function profileShortLabel(profileId) {
-  if (!profileId) return "Unknown profile";
-  const name = profileId.split("@")[0].split("/").pop();
-  if (!name) return profileId;
-  return name.charAt(0).toUpperCase() + name.slice(1);
-}
-var ACTION_LABELS = {
-  create_quote: "Quote created",
-  update_quote: "Quote updated",
-  send_quote: "Quote sent",
-  convert_quote_to_order: "Order placed",
-  create_order: "Order created",
-  update_order: "Order updated",
-  send_message: "Reply sent",
-  send_email: "Reply sent",
-  create_contact: "Contact created",
-  update_contact: "Contact updated",
-  create_deal: "Deal created",
-  update_deal: "Deal updated",
-  create_task: "Task created",
-  update_task: "Task updated",
-  log_activity: "Activity logged",
-  create_record: "Record created",
-  update_record: "Record updated",
-  delete_record: "Record deleted",
-  create_event: "Event created",
-  update_event: "Event updated",
-  delete_event: "Event deleted",
-  publish_post: "Post published"
-};
-function pastTense(verb) {
-  if (!verb) return verb;
-  if (/e$/.test(verb)) return `${verb}d`;
-  return `${verb}ed`;
-}
-function capitalize(s) {
-  return s.length > 0 ? s.charAt(0).toUpperCase() + s.slice(1) : s;
-}
-function formatActionLabel(action) {
-  const raw = String(action ?? "").trim();
-  if (!raw) return "Action";
-  const withoutSystem = raw.includes("__") ? raw.slice(raw.indexOf("__") + 2) : raw;
-  const known = ACTION_LABELS[withoutSystem];
-  if (known) return known;
-  const parts = withoutSystem.split("_").filter(Boolean);
-  if (parts.length === 0) return capitalize(raw);
-  const [verb, ...rest] = parts;
-  if (rest.length === 0) return capitalize(pastTense(verb));
-  return `${capitalize(rest.join(" "))} ${pastTense(verb)}`;
-}
-var METRIC_LABELS = {
-  completed: "cases completed",
-  "median-time": "median time, start \u2192 goal",
-  "average-time": "average time, start \u2192 goal",
-  "without-approval": "share without approval",
-  approvals: "approvals",
-  "median-approval-wait": "median approval wait",
-  tickets: "tickets",
-  refusals: "system refusals"
-};
-function formatMetricValue(kind, value) {
-  const n = typeof value === "number" ? value : Number(value);
-  if (kind === "without-approval" && Number.isFinite(n)) return `${Math.round(n * 100)}%`;
-  if ((kind === "median-time" || kind === "average-time" || kind === "median-approval-wait") && Number.isFinite(n)) {
-    return formatDuration(n);
-  }
-  return String(value);
-}
-
-// src/lib/report/ticket-resolvers.ts
-function findReceiptEntry(archive, ticketId2) {
-  return archive.getReceipts().find((r) => r.receipt.id === ticketId2);
-}
-function findAuthorization(archive, authorizationId) {
-  return archive.getAuthorizations().find((a) => a.authorizationId === authorizationId);
-}
-async function checkTicket(archive, ticketId2) {
-  const entry = findReceiptEntry(archive, ticketId2);
-  if (!entry) {
-    return { ok: false, reason: `No ticket "${ticketId2}" in the local archive.` };
-  }
-  if (!entry.asPublicKey) {
-    return { ok: false, reason: `Ticket "${ticketId2}" has no archived Authority Server key to verify it against.`, entry };
-  }
-  try {
-    await verifyReceiptSignature(entry.receipt, entry.asPublicKey);
-  } catch (err) {
-    return {
-      ok: false,
-      reason: `Ticket "${ticketId2}" signature does not verify: ${err instanceof Error ? err.message : String(err)}`,
-      entry
-    };
-  }
-  return { ok: true, entry };
-}
-function checkUrlFor(entry) {
-  const id = String(entry.receipt.id ?? "");
-  return `${entry.asUrl.replace(/\/+$/, "")}/r/${id}`;
-}
-async function resolveTicketElement(archive, ref) {
-  const check = await checkTicket(archive, ref);
-  if (!check.ok) return { status: "unverifiable", reason: check.reason };
-  const r = check.entry.receipt;
-  return {
-    status: "verified",
-    data: {
-      ticketId: ref,
-      action: r.action,
-      actionLabel: formatActionLabel(r.action),
-      time: r.timestamp,
-      timeLabel: formatDateTime(r.timestamp),
-      profile: r.profileId,
-      profileLabel: profileShortLabel(typeof r.profileId === "string" ? r.profileId : void 0),
-      authorizationId: r.authorizationId,
-      limitsUsed: r.limits ?? r.executionContext ?? {},
-      checkUrl: checkUrlFor(check.entry)
-    }
-  };
-}
-async function resolveApprovalElement(archive, ticketRef) {
-  const check = await checkTicket(archive, ticketRef);
-  if (!check.ok) return { status: "unverifiable", reason: check.reason };
-  const proposal = check.entry.proposal;
-  if (!proposal) {
-    return {
-      status: "unverifiable",
-      reason: `Ticket "${ticketRef}" has no archived approval (it ran without review).`
-    };
-  }
-  const committedBy = proposal.committedBy ?? {};
-  const approvers = Object.values(committedBy);
-  const createdAt = typeof proposal.createdAt === "number" ? proposal.createdAt : void 0;
-  const decidedAt = approvers.length > 0 ? Math.max(...approvers.map((a) => a.at)) : void 0;
-  const waitSeconds = createdAt !== void 0 && decidedAt !== void 0 ? decidedAt - createdAt : void 0;
-  const who = approvers.map((a) => a.userId);
-  return {
-    status: "verified",
-    data: {
-      ticketId: ticketRef,
-      who,
-      whoLabel: who.length > 0 ? who.join(", ") : "unknown",
-      createdAt,
-      createdAtLabel: createdAt !== void 0 ? formatDateTime(createdAt) : "unknown",
-      decidedAt,
-      decidedAtLabel: decidedAt !== void 0 ? formatDateTime(decidedAt) : "unknown",
-      waitSeconds,
-      waitLabel: waitSeconds !== void 0 ? formatDuration(waitSeconds) : "unknown",
-      status: proposal.status
-    }
-  };
-}
-async function resolveMandateElement(archive, ticketRef) {
-  const check = await checkTicket(archive, ticketRef);
-  if (!check.ok) return { status: "unverifiable", reason: check.reason };
-  const r = check.entry.receipt;
-  const authorizationId = typeof r.authorizationId === "string" ? r.authorizationId : void 0;
-  if (!authorizationId) {
-    return { status: "unverifiable", reason: `Ticket "${ticketRef}" carries no authorizationId.` };
-  }
-  const auth = findAuthorization(archive, authorizationId);
-  if (!auth) {
-    return { status: "unverifiable", reason: `No archived mandate "${authorizationId}" for ticket "${ticketRef}".` };
-  }
-  if (auth.boundsHash && typeof r.boundsHash === "string" && auth.boundsHash !== r.boundsHash) {
-    return {
-      status: "unverifiable",
-      reason: `Mandate "${authorizationId}" boundsHash does not match ticket "${ticketRef}".`
-    };
-  }
-  let mode;
-  let owners = [];
-  let ownersRaw = [];
-  const firstBlob = auth.attestations[0]?.blob;
-  if (firstBlob && check.entry.asPublicKey) {
-    try {
-      const attestation = decodeAttestationBlob(firstBlob);
-      await verifyAttestationSignature(attestation, check.entry.asPublicKey);
-      mode = attestation.payload.commitment_mode;
-      const dids = attestation.payload.resolved_owners ?? [];
-      const subjects = attestation.payload.subjects ?? [];
-      ownersRaw = dids;
-      owners = dids.map((did) => {
-        const subject = subjects.find((s) => s.did === did);
-        return subject?.assurance === "high" && subject.disclose?.name ? subject.disclose.name : formatOwnerLabel(did);
-      });
-    } catch {
-    }
-  }
-  const fallbackCurrency = typeof auth.context?.currency === "string" ? auth.context.currency : void 0;
-  const rawLimits = auth.bounds ?? {};
-  const limits = Object.entries(rawLimits).map(([key, value]) => formatBoundLabel(auth.profileId, key, value, fallbackCurrency));
-  return {
-    status: "verified",
-    data: {
-      authorizationId,
-      profile: auth.profileId,
-      profileLabel: profileShortLabel(auth.profileId),
-      limits,
-      rawLimits,
-      intent: auth.intent,
-      mode,
-      owners,
-      ownersRaw
-    }
-  };
-}
-
-// src/lib/report/time.ts
-function parseTimestampSeconds(value) {
-  if (typeof value !== "string" || !value.trim()) return void 0;
-  const iso = /^\d{4}-\d{2}-\d{2}[ T]\d{2}:\d{2}:\d{2}/.test(value) && !/[zZ]|[+-]\d{2}:?\d{2}$/.test(value) ? `${value.replace(" ", "T")}Z` : value;
-  const ms = Date.parse(iso);
-  return Number.isFinite(ms) ? Math.floor(ms / 1e3) : void 0;
-}
-
-// src/lib/report/case-resolvers.ts
-function parseRef(value) {
-  if (!value) return { id: "" };
-  const i = value.indexOf(":");
-  if (i === -1) return { id: value.trim() };
-  return { type: value.slice(0, i).trim(), id: value.slice(i + 1).trim() };
-}
-function parseStepRefs(value) {
-  if (!value) return [];
-  return value.split(/\s+/).filter(Boolean).map((s) => parseRef(s).id || s);
-}
-function parseRecipients(toJson, ccJson) {
-  const out = [];
-  for (const raw of [toJson, ccJson]) {
-    if (!raw) continue;
-    try {
-      const arr = JSON.parse(raw);
-      if (Array.isArray(arr)) out.push(...arr.filter((x) => typeof x === "string"));
-    } catch {
-    }
-  }
-  return out.map((s) => s.toLowerCase());
-}
-function parseCaseAttrs(attrs) {
-  return {
-    startId: parseRef(attrs.start).id,
-    goalId: parseRef(attrs.goal).id,
-    stepIds: parseStepRefs(attrs.steps)
-  };
-}
-async function resolveCaseElement(archive, emailExport, attrs) {
-  const start = parseRef(attrs.start);
-  const startMessage = emailExport.inbox.find((m) => m.id === start.id);
-  if (!startMessage || !startMessage.case_id) {
-    return { status: "unverifiable", reason: `start "${attrs.start ?? ""}" is not a loaded case email with a case_id.` };
-  }
-  const startCaseId = startMessage.case_id;
-  const startTime = parseTimestampSeconds(startMessage.received_at);
-  if (startTime === void 0) {
-    return { status: "unverifiable", reason: `start message "${start.id}" has an unparseable received_at.`, startCaseId };
-  }
-  const goal = parseRef(attrs.goal);
-  const goalCheck = await checkTicket(archive, goal.id);
-  if (!goalCheck.ok) {
-    return { status: "unverifiable", reason: `goal: ${goalCheck.reason}`, startCaseId };
-  }
-  const goalReceipt = goalCheck.entry.receipt;
-  const goalTime = typeof goalReceipt.timestamp === "number" ? goalReceipt.timestamp : void 0;
-  if (goalTime === void 0) {
-    return { status: "unverifiable", reason: `goal ticket "${goal.id}" has no numeric timestamp.`, startCaseId };
-  }
-  if (goalTime < startTime) {
-    return { status: "unverifiable", reason: `goal ticket "${goal.id}" is timestamped before start "${start.id}".`, startCaseId };
-  }
-  const stepIds = parseStepRefs(attrs.steps);
-  const steps = [];
-  for (const stepId of stepIds) {
-    const stepCheck = await checkTicket(archive, stepId);
-    if (!stepCheck.ok) {
-      return { status: "unverifiable", reason: `step: ${stepCheck.reason}`, startCaseId };
-    }
-    const stepReceipt = stepCheck.entry.receipt;
-    const stepTime = typeof stepReceipt.timestamp === "number" ? stepReceipt.timestamp : void 0;
-    if (stepTime === void 0 || stepTime < startTime || stepTime > goalTime) {
-      return { status: "unverifiable", reason: `step ticket "${stepId}" is outside the case window [${startTime}, ${goalTime}].`, startCaseId };
-    }
-    steps.push({ ticketId: stepId, time: stepTime, action: stepReceipt.action });
-  }
-  let warningReason;
-  const sentForGoal = emailExport.sent.find((m) => m.receipt_id === goal.id);
-  if (sentForGoal) {
-    const isReply = sentForGoal.in_reply_to === start.id;
-    const recipients = parseRecipients(sentForGoal.to_json, sentForGoal.cc_json);
-    const addressedToSender = recipients.includes(startMessage.from_email.toLowerCase());
-    if (!isReply && !addressedToSender) {
-      warningReason = "goal link not confirmed";
-    }
-  }
-  const approvals = [];
-  for (const ticketId2 of [goal.id, ...stepIds]) {
-    const approval = await resolveApprovalElement(archive, ticketId2);
-    if (approval.status === "verified") {
-      approvals.push({ ticketId: ticketId2, ...approval.data });
-    }
-  }
-  const timeline = [
-    { type: "start", time: startTime, label: start.id },
-    ...steps.map((s) => ({ type: "step", time: s.time, label: s.ticketId })),
-    ...approvals.map((a) => ({ type: "approval", time: a.decidedAt ?? a.createdAt ?? 0, label: a.ticketId })),
-    { type: "goal", time: goalTime, label: goal.id }
-  ].sort((a, b) => a.time - b.time);
-  return {
-    status: warningReason ? "warning" : "verified",
-    reason: warningReason,
-    startCaseId,
-    data: {
-      caseId: startCaseId,
-      start: { id: start.id, time: startTime, sender: startMessage.from_email },
-      goal: { ticketId: goal.id, time: goalTime, action: goalReceipt.action },
-      steps,
-      approvals,
-      timeline,
-      totalDurationSeconds: goalTime - startTime
-    }
-  };
-}
-
-// src/lib/report/verify-export.ts
-function collectReferencedTicketIds(html) {
-  const ids = /* @__PURE__ */ new Set();
-  for (const el of parseElements(html)) {
-    if (el.kind === "sv-ticket" && el.attrs.ref) ids.add(el.attrs.ref);
-    if ((el.kind === "sv-approval" || el.kind === "sv-mandate") && el.attrs.ticket) ids.add(el.attrs.ticket);
-    if (el.kind === "sv-case") {
-      const { goalId, stepIds } = parseCaseAttrs(el.attrs);
-      if (goalId) ids.add(goalId);
-      for (const s of stepIds) ids.add(s);
-    }
-  }
-  return ids;
-}
-function ticketIdsOf(el) {
-  if (el.kind === "sv-ticket") return el.attrs.ref ? [el.attrs.ref] : [];
-  if (el.kind === "sv-approval" || el.kind === "sv-mandate") return el.attrs.ticket ? [el.attrs.ticket] : [];
-  if (el.kind === "sv-case") {
-    const { goalId, stepIds } = parseCaseAttrs(el.attrs);
-    return [...goalId ? [goalId] : [], ...stepIds];
-  }
-  return [];
-}
-var TICKET_BACKED_KINDS = /* @__PURE__ */ new Set(["sv-ticket", "sv-approval", "sv-mandate", "sv-case"]);
-var PROOF_SCRIPT_BLOCK_RE = /<script[^>]*id="suveren-proof"[^>]*>[\s\S]*?<\/script>/gi;
-function collectPresentedStates(documentHtml) {
-  const html = documentHtml.replace(PROOF_SCRIPT_BLOCK_RE, "");
-  const open = [];
-  const flaggedById = /* @__PURE__ */ new Map();
-  let depth = 0;
-  const classesOf = (attribs) => new Set((attribs.class ?? "").split(/\s+/).filter(Boolean));
-  const settle = (f) => {
-    const flagged = f.classes.has("sv-el-unverifiable") && !f.classes.has("sv-el-verified") && !f.classes.has("sv-el-warning") && f.badges.length > 0 && f.badges.every((b) => b.has("sv-badge-bad") && !b.has("sv-badge-ok") && !b.has("sv-badge-warn"));
-    flaggedById.set(f.id, (flaggedById.get(f.id) ?? true) && flagged);
-  };
-  const parser = new Parser2(
-    {
-      onopentag(_name, attribs) {
-        depth++;
-        const classes = classesOf(attribs);
-        if ([...classes].some((c) => c.startsWith("sv-badge"))) {
-          for (const f of open) f.badges.push(classes);
-        }
-        const id = attribs["data-sv-id"];
-        if (typeof id === "string" && id) open.push({ id, depth, classes, badges: [] });
-      },
-      onclosetag() {
-        while (open.length > 0 && open[open.length - 1].depth >= depth) settle(open.pop());
-        depth--;
-      }
-    },
-    { decodeEntities: true }
-  );
-  parser.write(html);
-  parser.end();
-  while (open.length > 0) settle(open.pop());
-  const states = /* @__PURE__ */ new Map();
-  for (const [id, flagged] of flaggedById) states.set(id, flagged ? "not-verifiable" : "verified");
-  return states;
-}
-function ticketId(receipt) {
-  return typeof receipt.id === "string" ? receipt.id : "";
-}
-async function checkAttestations(auth, publicKeyHex) {
-  if (auth.attestations.length === 0) {
-    return { valid: false, error: "No archived mandate attestation for this authorization." };
-  }
-  for (const att of auth.attestations) {
-    try {
-      const attestation = decodeAttestationBlob2(att.blob);
-      await verifyAttestationSignature2(attestation, publicKeyHex);
-    } catch (err) {
-      return { valid: false, error: err instanceof Error ? err.message : String(err) };
-    }
-  }
-  return { valid: true };
-}
-async function verifyExportBundle(bundle, opts = {}) {
-  const byId = new Map(bundle.tickets.map((t) => [ticketId(t), t]));
-  const referencedIds = collectReferencedTicketIds(bundle.report.html);
-  const allIds = /* @__PURE__ */ new Set([...referencedIds, ...byId.keys()]);
-  const tickets = [];
-  for (const id of allIds) {
-    const receipt = byId.get(id);
-    if (!receipt) {
-      tickets.push({ ticketId: id, referenced: referencedIds.has(id), present: false, signatureValid: false, error: "Not present in the bundle." });
-      continue;
-    }
-    try {
-      await verifyReceiptSignature2(receipt, bundle.authorityServer.publicKeyHex);
-      tickets.push({ ticketId: id, referenced: referencedIds.has(id), present: true, signatureValid: true });
-    } catch (err) {
-      tickets.push({
-        ticketId: id,
-        referenced: referencedIds.has(id),
-        present: true,
-        signatureValid: false,
-        error: err instanceof Error ? err.message : String(err)
-      });
-    }
-  }
-  const authorizations = [];
-  for (const [authorizationId, auth] of Object.entries(bundle.authorizations)) {
-    const { valid: attestationValid, error: attestationError } = await checkAttestations(auth, bundle.authorityServer.publicKeyHex);
-    let boundsHashMatches = "n/a";
-    const representative = [...byId.values()].find((r) => r.authorizationId === authorizationId);
-    if (auth.boundsHash && representative && typeof representative.boundsHash === "string") {
-      boundsHashMatches = auth.boundsHash === representative.boundsHash;
-    }
-    authorizations.push({
-      authorizationId,
-      attestationValid,
-      boundsHashMatches,
-      ...attestationError ? { error: attestationError } : boundsHashMatches === false ? { error: `boundsHash does not match ticket ${representative?.id ?? "unknown"}.` } : {}
-    });
-  }
-  const ticketById = new Map(tickets.map((t) => [t.ticketId, t]));
-  const authById = new Map(authorizations.map((a) => [a.authorizationId, a]));
-  const presentedStates = opts.documentHtml !== void 0 ? collectPresentedStates(opts.documentHtml) : /* @__PURE__ */ new Map();
-  const elements = [];
-  for (const el of parseElements(bundle.report.html)) {
-    if (!TICKET_BACKED_KINDS.has(el.kind)) continue;
-    const ticketIds = ticketIdsOf(el);
-    const presented = presentedStates.get(el.id) ?? "verified";
-    let error;
-    if (ticketIds.length === 0) error = "Names no ticket.";
-    for (const id of ticketIds) {
-      if (error) break;
-      const t = ticketById.get(id);
-      if (!t || !t.present) error = `Ticket ${id} is not in the bundle.`;
-      else if (!t.signatureValid) error = `Ticket ${id} has an invalid signature.`;
-    }
-    if (!error && el.kind === "sv-mandate") {
-      const receipt = byId.get(ticketIds[0]);
-      const authorizationId = typeof receipt.authorizationId === "string" ? receipt.authorizationId : void 0;
-      const auth = authorizationId ? bundle.authorizations[authorizationId] : void 0;
-      const authCheck = authorizationId ? authById.get(authorizationId) : void 0;
-      if (!auth || !authCheck) error = `The mandate for ticket ${ticketIds[0]} is not in the bundle.`;
-      else if (!authCheck.attestationValid) error = `The mandate for ticket ${ticketIds[0]} has an invalid attestation.`;
-      else if (auth.boundsHash && typeof receipt.boundsHash === "string" && auth.boundsHash !== receipt.boundsHash) {
-        error = `The mandate's boundsHash does not match ticket ${ticketIds[0]}.`;
-      }
-    }
-    elements.push({ elementId: el.id, kind: el.kind, ticketIds, presented, backed: !error, ...error ? { error } : {} });
-  }
-  const keyFingerprint = fingerprintOf(bundle.authorityServer.publicKeyHex);
-  const keyConfirmation = resolveKeyConfirmation(bundle.authorityServer.publicKeyHex, opts);
-  const allValid = tickets.filter((t) => t.present).every((t) => t.signatureValid) && authorizations.every((a) => a.attestationValid && a.boundsHashMatches !== false) && elements.every((e) => e.presented === "not-verifiable" || e.backed);
-  return { tickets, elements, authorizations, keyFingerprint, keyConfirmation, allValid };
-}
-function resolveKeyConfirmation(actualKeyHex, opts) {
-  const normalize = (h) => h.trim().toLowerCase();
-  if (opts.expectedKeyHex !== void 0) {
-    if (normalize(opts.expectedKeyHex) === normalize(actualKeyHex)) return { state: "confirmed", source: "provided" };
-    return { state: "mismatch", source: "provided", expectedFingerprint: fingerprintOf(opts.expectedKeyHex) };
-  }
-  if (opts.onlineKeyHex !== void 0) {
-    if (normalize(opts.onlineKeyHex) === normalize(actualKeyHex)) return { state: "confirmed", source: "online" };
-    return { state: "mismatch", source: "online", expectedFingerprint: fingerprintOf(opts.onlineKeyHex) };
-  }
-  return { state: "unconfirmed" };
-}
-
-export {
-  readPairing,
-  fingerprintOf,
-  parseElements,
-  formatDateTime,
-  formatDuration,
-  formatCurrency,
-  profileShortLabel,
-  formatActionLabel,
-  METRIC_LABELS,
-  formatMetricValue,
-  resolveTicketElement,
-  resolveApprovalElement,
-  resolveMandateElement,
-  parseTimestampSeconds,
-  parseCaseAttrs,
-  resolveCaseElement,
-  isExportBundle,
-  verifyExportBundle
-};