@xfuel/verify 0.2.1 → 0.3.1

package/dist/refusal.js

@@ -0,0 +1,226 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REFUSAL_DOES_NOT_PROVE = exports.REFUSAL_PROVES = exports.REFUSAL_PAYLOAD_VERSION = exports.REFUSAL_PAYLOAD_VERSIONS = exports.REFUSAL_SCHEMA = void 0;
+exports.jwsPayloadSchema = jwsPayloadSchema;
+exports.isRefusalDocument = isRefusalDocument;
+exports.verifyRefusal = verifyRefusal;
+/**
+ * Offline check for a chit402.refusal.v1 document.
+ *
+ * Same ES256 issuer key and JWKS trust rules as a payment receipt.
+ * A refusal is not a payment. verifyReceipt refuses to treat one as spend.
+ */
+const jws_js_1 = require("./jws.js");
+exports.REFUSAL_SCHEMA = 'chit402.refusal.v1';
+/** Versions a verifier accepts. Version 1 has no history pin. */
+exports.REFUSAL_PAYLOAD_VERSIONS = [1, 2];
+/** Current issuance version. Version 1 still verifies. */
+exports.REFUSAL_PAYLOAD_VERSION = 2;
+exports.REFUSAL_PROVES = [
+    'The issuer signed that it refused this spend.',
+    'refusal_code is the code the issuer recorded.',
+    'nonce identifies this refusal document.',
+    'chain_id and anchor are the Base observation at refusal time. status UNAVAILABLE means the issuer had no block.',
+    'When status is observed, block_number and block_hash are that block. state_root is copied only when the RPC returned one; otherwise it is null.',
+    'book_row.seq, task_id, and row_hash name the policy_blocked row this refusal joins.',
+    'charged is false and amount_charged is 0. This refusal took no USDC.',
+];
+exports.REFUSAL_DOES_NOT_PROVE = [
+    'It does not prove a payment, a settlement, or a balance change.',
+    'It does not prove the refused spend would have landed in that block.',
+    'It does not prove a later reorg left the block hash or state root in place.',
+    'UNAVAILABLE means the issuer did not have a block. It does not mean the chain was empty.',
+    'It does not prove the policy rule was the right rule. It proves the issuer refused under that code.',
+    'It does not prove amount_requested would have been the settled price.',
+    'It is not a payment receipt. A payment verifier must not treat it as proof of spend.',
+    'verify_url is not inside the signature.',
+];
+/** Schema inside the JWS payload. Unverified; callers still check the signature. */
+function jwsPayloadSchema(doc) {
+    if (!doc || typeof doc !== 'object')
+        return null;
+    const jws = doc.issuer_signature?.jws;
+    if (!jws || typeof jws !== 'string')
+        return null;
+    const payloadB64 = jws.split('.')[1];
+    if (!payloadB64)
+        return null;
+    try {
+        const payload = JSON.parse(Buffer.from(payloadB64, 'base64url').toString('utf8'));
+        return typeof payload.schema === 'string' ? payload.schema : null;
+    }
+    catch {
+        return null;
+    }
+}
+function isRefusalDocument(doc) {
+    if (!doc || typeof doc !== 'object')
+        return false;
+    if (doc.schema === exports.REFUSAL_SCHEMA)
+        return true;
+    return jwsPayloadSchema(doc) === exports.REFUSAL_SCHEMA;
+}
+function jwksCandidates(jwks, kid) {
+    if (!jwks?.keys?.length)
+        return [];
+    const es256 = jwks.keys.filter((key) => key.kty === 'EC' && key.crv === 'P-256' && key.x && key.y);
+    if (!kid)
+        return es256;
+    return es256.filter((key) => key.kid === kid);
+}
+function same(left, right) {
+    return left === right;
+}
+function anchorSame(outer, signed) {
+    if (!outer || !signed)
+        return false;
+    return same(outer.status, signed.status)
+        && same(outer.rail, signed.rail)
+        && same(outer.chain_id ?? null, signed.chain_id ?? null)
+        && same(outer.block_number ?? null, signed.block_number ?? null)
+        && same(outer.block_hash ?? null, signed.block_hash ?? null)
+        && same(outer.state_root ?? null, signed.state_root ?? null);
+}
+function bookRowSame(outer, signed) {
+    if (!outer || !signed)
+        return false;
+    return same(outer.task_id, signed.task_id)
+        && Number(outer.seq) === Number(signed.seq)
+        && same(outer.prev_hash || null, signed.prev_hash || null)
+        && same(outer.row_hash, signed.row_hash)
+        && same(outer.event, signed.event);
+}
+function failed(reason, extra = {}) {
+    return {
+        schema: exports.REFUSAL_SCHEMA,
+        checked: extra.checked ?? true,
+        reason,
+        charged: false,
+        proves: exports.REFUSAL_PROVES,
+        does_not_prove: exports.REFUSAL_DOES_NOT_PROVE,
+        errors: [reason],
+        kid: extra.kid,
+        valid: false,
+    };
+}
+/**
+ * Verify the issuer signature and that the outer refusal fields match it.
+ * Trust is a JWKS key matched by kid, or an embedded key whose thumbprint
+ * is a pinned trusted kid. The embedded key alone is not a trust root.
+ */
+function verifyRefusal(doc, options = {}) {
+    if (!isRefusalDocument(doc)) {
+        return failed('not_a_refusal', { checked: false });
+    }
+    const jws = doc.issuer_signature?.jws;
+    if (!jws)
+        return failed('no_signature', { checked: false });
+    const trustedKids = options.trustedKids ?? jws_js_1.DEFAULT_TRUSTED_ISSUER_KIDS;
+    const header = (0, jws_js_1.readJwsHeader)(jws);
+    const kid = header?.kid || doc.issuer_signature?.kid;
+    const embedded = (0, jws_js_1.resolvePinnedIssuerJwk)(doc);
+    const pinned = !!(embedded && (0, jws_js_1.isPinnedTrustedJwk)(embedded, trustedKids));
+    const fromJwks = jwksCandidates(options.jwks, kid);
+    let payload = null;
+    let trusted = false;
+    let reason = 'signature_invalid';
+    for (const jwk of fromJwks) {
+        const result = (0, jws_js_1.verifyIssuerJws)(jws, jwk);
+        if (result.valid && result.payload) {
+            payload = result.payload;
+            trusted = true;
+            break;
+        }
+        reason = result.reason || 'signature_invalid';
+    }
+    if (!payload && pinned && embedded) {
+        const result = (0, jws_js_1.verifyIssuerJws)(jws, embedded);
+        if (result.valid && result.payload) {
+            payload = result.payload;
+            trusted = true;
+        }
+        else {
+            reason = result.reason || 'signature_invalid';
+        }
+    }
+    if (!payload && embedded && (0, jws_js_1.verifyIssuerJws)(jws, embedded).valid && !pinned && fromJwks.length === 0) {
+        return failed(jws_js_1.KEY_UNTRUSTED, { kid: kid || null });
+    }
+    if (!payload) {
+        if (fromJwks.length === 0 && !pinned)
+            return failed(jws_js_1.KEY_UNTRUSTED, { kid: kid || null });
+        return failed(reason, { kid: kid || null });
+    }
+    if (!trusted)
+        return failed(jws_js_1.KEY_UNTRUSTED, { kid: kid || null });
+    const signed = payload;
+    if (signed.schema !== exports.REFUSAL_SCHEMA)
+        return failed('schema_mismatch', { kid });
+    // The outer schema is unsigned. A present value that disagrees with the
+    // signed schema fails. An omitted outer schema still follows the JWS.
+    if (doc.schema != null && doc.schema !== signed.schema)
+        return failed('schema_mismatch', { kid });
+    const version = Number(signed.payload_version);
+    if (!exports.REFUSAL_PAYLOAD_VERSIONS.includes(version)) {
+        return failed('payload_version_mismatch', { kid });
+    }
+    if (doc.payload_version != null && Number(doc.payload_version) !== version) {
+        return failed('payload_version_mismatch', { kid });
+    }
+    if (version >= 2) {
+        const pin = signed.issuer_history;
+        if (!pin || typeof pin.hash !== 'string' || pin.version == null || pin.seq == null) {
+            return failed('issuer_history_pin_missing', { kid });
+        }
+        const payloadHash = signed.payload_hash;
+        if (typeof payloadHash !== 'string' || !/^[0-9a-f]{64}$/.test(payloadHash)) {
+            return failed('payload_hash_missing', { kid });
+        }
+    }
+    if (signed.kind !== 'refusal')
+        return failed('kind_mismatch', { kid });
+    if (signed.charged !== false || signed.amount_charged !== '0'
+        || doc.charged !== false || doc.amount_charged !== '0') {
+        return failed('charged_not_zero', { kid });
+    }
+    if (!same(doc.refusal_code, signed.refusal_code))
+        return failed('refusal_code_mismatch', { kid });
+    if (!same(doc.nonce, signed.nonce))
+        return failed('nonce_mismatch', { kid });
+    if (!same(doc.refusal_id, signed.refusal_id))
+        return failed('refusal_id_mismatch', { kid });
+    if (!same(doc.chain_id ?? null, signed.chain_id ?? null))
+        return failed('chain_id_mismatch', { kid });
+    if (!same(doc.task_id, signed.task_id)
+        || Number(doc.agent_id) !== Number(signed.agent_id)
+        || Number(doc.book_id) !== Number(signed.book_id)) {
+        return failed('identity_mismatch', { kid });
+    }
+    if (!same(doc.issued_at, signed.issued_at))
+        return failed('issued_at_mismatch', { kid });
+    if (!same(doc.amount_requested ?? null, signed.amount_requested ?? null)) {
+        return failed('amount_mismatch', { kid });
+    }
+    if (!anchorSame(doc.anchor, signed.anchor))
+        return failed('anchor_mismatch', { kid });
+    if (!bookRowSame(doc.book_row, signed.book_row))
+        return failed('book_row_mismatch', { kid });
+    return {
+        schema: exports.REFUSAL_SCHEMA,
+        valid: true,
+        checked: true,
+        kid: kid || null,
+        refusal_id: signed.refusal_id || null,
+        refusal_code: signed.refusal_code || null,
+        nonce: signed.nonce || null,
+        chain_id: signed.chain_id ?? null,
+        charged: false,
+        proves: exports.REFUSAL_PROVES,
+        does_not_prove: exports.REFUSAL_DOES_NOT_PROVE,
+        errors: [],
+        payload_version: version,
+        issuer_history: signed.issuer_history ?? null,
+        payload_hash: signed.payload_hash ?? null,
+    };
+}
+//# sourceMappingURL=refusal.js.map

package/dist/refusal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refusal.js","sourceRoot":"","sources":["../src/refusal.ts"],"names":[],"mappings":";;;AA4GA,4CAYC;AAED,8CAIC;AAmDD,sCA2GC;AA5RD;;;;;GAKG;AACH,qCAQkB;AAEL,QAAA,cAAc,GAAG,oBAAoB,CAAC;AACnD,iEAAiE;AACpD,QAAA,wBAAwB,GAAG,CAAC,CAAC,EAAE,CAAC,CAAU,CAAC;AACxD,0DAA0D;AAC7C,QAAA,uBAAuB,GAAG,CAAC,CAAC;AAE5B,QAAA,cAAc,GAAG;IAC5B,+CAA+C;IAC/C,+CAA+C;IAC/C,yCAAyC;IACzC,iHAAiH;IACjH,iJAAiJ;IACjJ,qFAAqF;IACrF,sEAAsE;CACvE,CAAC;AAEW,QAAA,sBAAsB,GAAG;IACpC,iEAAiE;IACjE,sEAAsE;IACtE,6EAA6E;IAC7E,0FAA0F;IAC1F,qGAAqG;IACrG,uEAAuE;IACvE,sFAAsF;IACtF,yCAAyC;CAC1C,CAAC;AAkEF,oFAAoF;AACpF,SAAgB,gBAAgB,CAAC,GAAY;IAC3C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,GAAG,GAAI,GAAuB,CAAC,gBAAgB,EAAE,GAAG,CAAC;IAC3D,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAyB,CAAC;QAC1G,OAAO,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAgB,iBAAiB,CAAC,GAAY;IAC5C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,IAAK,GAA4B,CAAC,MAAM,KAAK,sBAAc;QAAE,OAAO,IAAI,CAAC;IACzE,OAAO,gBAAgB,CAAC,GAAG,CAAC,KAAK,sBAAc,CAAC;AAClD,CAAC;AAED,SAAS,cAAc,CAAC,IAA6B,EAAE,GAAuB;IAC5E,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,IAAI,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;IACnG,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,IAAI,CAAC,IAAa,EAAE,KAAc;IACzC,OAAO,IAAI,KAAK,KAAK,CAAC;AACxB,CAAC;AAED,SAAS,UAAU,CAAC,KAAuC,EAAE,MAAwC;IACnG,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;WACnC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC;WAC7B,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,IAAI,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC;WACrD,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,IAAI,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC;WAC7D,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC;WACzD,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,WAAW,CAAC,KAAwC,EAAE,MAAyC;IACtG,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACpC,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC;WACrC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC;WACxC,IAAI,CAAC,KAAK,CAAC,SAAS,IAAI,IAAI,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC;WACvD,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;WACrC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,MAAM,CAAC,MAAc,EAAE,QAAsC,EAAE;IACtE,OAAO;QACL,MAAM,EAAE,sBAAc;QACtB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;QAC9B,MAAM;QACN,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,sBAAc;QACtB,cAAc,EAAE,8BAAsB;QACtC,MAAM,EAAE,CAAC,MAAM,CAAC;QAChB,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,KAAK,EAAE,KAAK;KACb,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAC3B,GAAoB,EACpB,UAAmE,EAAE;IAErE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,gBAAgB,EAAE,GAAG,CAAC;IACtC,IAAI,CAAC,GAAG;QAAE,OAAO,MAAM,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAE5D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,oCAA2B,CAAC;IACvE,MAAM,MAAM,GAAG,IAAA,sBAAa,EAAC,GAAG,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,MAAM,EAAE,GAAG,IAAI,GAAG,CAAC,gBAAgB,EAAE,GAAG,CAAC;IACrD,MAAM,QAAQ,GAAG,IAAA,+BAAsB,EAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAA,2BAAkB,EAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAEnD,IAAI,OAAO,GAAmC,IAAI,CAAC;IACnD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,MAAM,GAAG,mBAAmB,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAA,wBAAe,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YACzB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM;QACR,CAAC;QACD,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,mBAAmB,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,IAAA,wBAAe,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC9C,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YACzB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,mBAAmB,CAAC;QAChD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,QAAQ,IAAI,IAAA,wBAAe,EAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrG,OAAO,MAAM,CAAC,sBAAa,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC,sBAAa,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;QACzF,OAAO,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,sBAAa,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,IAAI,EAAE,CAAC,CAAC;IAEjE,MAAM,MAAM,GAAG,OAAqC,CAAC;IACrD,IAAI,MAAM,CAAC,MAAM,KAAK,sBAAc;QAAE,OAAO,MAAM,CAAC,iBAAiB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAChF,wEAAwE;IACxE,sEAAsE;IACtE,IAAI,GAAG,CAAC,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC,iBAAiB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAClG,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC/C,IAAI,CAAC,gCAAwB,CAAC,QAAQ,CAAC,OAAgB,CAAC,EAAE,CAAC;QACzD,OAAO,MAAM,CAAC,0BAA0B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,GAAG,CAAC,eAAe,IAAI,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,OAAO,EAAE,CAAC;QAC3E,OAAO,MAAM,CAAC,0BAA0B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;QACjB,MAAM,GAAG,GAAI,MAAoF,CAAC,cAAc,CAAC;QACjH,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,IAAI,GAAG,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;YACnF,OAAO,MAAM,CAAC,4BAA4B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,WAAW,GAAI,MAAqC,CAAC,YAAY,CAAC;QACxE,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3E,OAAO,MAAM,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,eAAe,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACvE,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,IAAI,MAAM,CAAC,cAAc,KAAK,GAAG;WACxD,GAAG,CAAC,OAAO,KAAK,KAAK,IAAI,GAAG,CAAC,cAAc,KAAK,GAAG,EAAE,CAAC;QACzD,OAAO,MAAM,CAAC,kBAAkB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC;QAAE,OAAO,MAAM,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAClG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,gBAAgB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7E,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;QAAE,OAAO,MAAM,CAAC,qBAAqB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5F,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,IAAI,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC,mBAAmB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACtG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC;WACjC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;WAChD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,OAAO,MAAM,CAAC,mBAAmB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC,oBAAoB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACzF,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,EAAE,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC,EAAE,CAAC;QACzE,OAAO,MAAM,CAAC,iBAAiB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,MAAuB,CAAC;QAAE,OAAO,MAAM,CAAC,iBAAiB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACvG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,QAA0B,CAAC;QAAE,OAAO,MAAM,CAAC,mBAAmB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAE/G,OAAO;QACL,MAAM,EAAE,sBAAc;QACtB,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,IAAI;QACb,GAAG,EAAE,GAAG,IAAI,IAAI;QAChB,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;QACrC,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,IAAI;QACzC,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,IAAI;QACjC,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,sBAAc;QACtB,cAAc,EAAE,8BAAsB;QACtC,MAAM,EAAE,EAAE;QACV,eAAe,EAAE,OAAO;QACxB,cAAc,EAAG,MAAqE,CAAC,cAAc,IAAI,IAAI;QAC7G,YAAY,EAAG,MAA2C,CAAC,YAAY,IAAI,IAAI;KAChF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@xfuel/verify",
-  "version": "0.2.1",
+  "version": "0.3.1",
   "description": "Offline verification for Chit402 receipts — verify payment binding and output hash without calling the API",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "bin": {
-    "xfuel-verify": "./dist/cli.js"
+    "xfuel-verify": "dist/cli.js"
   },
   "exports": {
     ".": {
@@ -34,7 +34,9 @@
   },
   "scripts": {
     "build": "tsc",
-    "test": "node --test test/*.test.mjs",
+    "digest": "node scripts/build-digest.mjs",
+    "test": "npm run build && node --test --test-concurrency=1 test/*.test.mjs",
+    "prepack": "npm run build",
     "prepublishOnly": "npm run build && npm test"
   },
   "keywords": [
@@ -52,7 +54,7 @@
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
-    "url": "https://github.com/XFuel-Lab/chit402.git",
+    "url": "git+https://github.com/XFuel-Lab/chit402.git",
     "directory": "packages/verify"
   },
   "dependencies": {