@xfuel/verify 0.2.1 → 0.3.1

package/dist/cli.js

@@ -7,6 +7,7 @@
  *   xfuel-verify receipt.json
  *   xfuel-verify receipt.json --check-nullifier
  *   xfuel-verify receipt.json --rpc https://mainnet.base.org
+ *   xfuel-verify receipt.json inclusion.json head.json --rpc
  *   cat receipt.json | xfuel-verify -
  *
  * Exit codes:
@@ -18,11 +19,18 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const node_fs_1 = require("node:fs");
 const index_js_1 = require("./index.js");
+const anchor_witness_js_1 = require("./anchor-witness.js");
+const jws_js_1 = require("./jws.js");
+const preimage_js_1 = require("./preimage.js");
+const issuer_history_js_1 = require("./issuer-history.js");
+const canonical_preimage_js_1 = require("./canonical-preimage.js");
 const HELP = `
 xfuel-verify — Offline verification for Chit402 receipts
 
 Usage:
   xfuel-verify <receipt.json>           Verify binding locally
+  xfuel-verify <refusal.json>           Verify a chit402.refusal.v1 document
+                                        (issuer refused; not a payment)
   xfuel-verify <receipt.json> --jwks-file <jwks.json>
                                         Verify issuer signature with a JWKS file
   xfuel-verify <receipt.json> --fetch-jwks
@@ -43,9 +51,25 @@ Options:
   --check-nullifier   Query Base RPC for nullifier anchor (requires network)
   --check-payer       Query Base or Solana RPC. Base confirms payer, payee, asset, amount
   --solana-rpc <url>  Solana RPC URL (default: https://api.mainnet-beta.solana.com or SOLANA_RPC_URL)
-  --rpc <url>         Custom RPC URL (default: https://mainnet.base.org)
+  --rpc <url>         Base RPC URL (default: https://mainnet.base.org)
+  --rpc               With a receipt, an inclusion proof, and a tree head: check the
+                      leaf, then the Solana memo and the Base calldata for that root.
+                      A v2 head also needs the signed epoch record.
+  --epoch-record <f>  Signed epoch record JSON. Skips the network fetch.
+  --epoch-url <url>   GET this epoch record. Default: the receipt verify_url
+                      origin plus /v1/receipts/tree/epoch
+  --inclusion <file>  Inclusion proof JSON (chit402.inclusion.v1)
+  --head <file>       Signed tree head JSON (chit402.tree_head.v1 or v2)
   --json              Output JSON instead of human-readable
   --quiet             Only output errors
+  --strict-issuer-history
+                      Fail if the issuer key history cannot be fetched
+  --issuer-history-file <path>
+                      Read issuer history JSON instead of fetching it
+  --canonical-preimage <path>
+                      SHA-256 this file and match the signed payload_hash
+  --no-issuer-history Do not check the kid's not_before / not_after window
+  --no-preimage       Do not require published hash preimages
 
 Exit codes:
   0 = verified
@@ -63,16 +87,48 @@ Trust:
   with the unsigned outer payment / caller_binding copy is a failure.
 
 Network behavior:
-  By default, no network requests are made. Network is only used when:
-  - --fetch-jwks or --jwks-url is passed
-  - --check-nullifier is passed (queries Base RPC for on-chain anchor)
-  - --check-payer is passed (queries Base or Solana RPC for USDC settlement)
+  JWKS, nullifiers, and anchors are not fetched unless you pass a flag.
+  Issuer history is fetched by default when the receipt names a history URL
+  and neither --issuer-history-file nor --no-issuer-history is set. A payload
+  v10 receipt fails (exit 1) when that fetch cannot run. Offline mode is
+  --issuer-history-file <snapshot>, or --no-issuer-history to skip the window.
+  Other network uses:
+  - --fetch-jwks or --jwks-url
+  - --check-nullifier (Base RPC)
+  - --check-payer (Base or Solana RPC)
+  - --rpc with a receipt, an inclusion proof, and a tree head
+  - a v2 head, which fetches GET /v1/receipts/tree/epoch unless --epoch-record
 
   Solana payer verify uses SOLANA_RPC_URL when set, else the public mainnet RPC.
 
+Anchored root:
+  xfuel-verify receipt.json inclusion.json head.json --rpc
+  xfuel-verify receipt.json --inclusion inclusion.json --head head.json --rpc https://mainnet.base.org
+
+  Checks the Merkle inclusion, fetches the Solana transaction and requires the
+  SPL Memo to contain the root, and checks the Base calldata the same way.
+  Prints what this proves and what it does not prove. Exit 0 when both chains
+  match, 2 when the leaf is included but an anchor is still pending, 1 when a
+  check fails.
+
+Receipt lane (unsigned, beside book_seq):
+  settled_by is observed_transfer when the USDC transfer was checked on Base
+  or Solana, and receipt when only the issuer asserts settlement. Unknown is
+  null. Ordering is seq + settled_by + (anchor_changed AND not settled).
+  Boundary: complete over registry marks, blind to payments the registry
+  never joined. freeze is true only when book_seq is set, settled_by is
+  receipt, the anchor changed after binding, and the row is not settled. An
+  anchor change alone does not freeze, and freeze does not change the
+  signature exit code. classification unverifiable_from_registry means the
+  binding is past expiry and settled_by, receipt_id, observed_tx_hash, and
+  observed_transfer_id are all null. That is not unpaid. local_check, when
+  set, is a Base USDC payee and amount a stranger can check. It does not
+  claim the row was paid. Design by Turbo on 1F916 (post 6579, comments
+  88201, 88403, and 88596).
+
 Examples:
-  # Local binding verification (no network)
-  xfuel-verify my-receipt.json
+  # Skip the issuer-history fetch. A v10 receipt otherwise needs that network call.
+  xfuel-verify my-receipt.json --no-issuer-history
 
   # Verify issuer signature with JWKS file
   xfuel-verify my-receipt.json --jwks-file issuer-jwks.json
@@ -95,9 +151,21 @@ function parseArgs(args) {
         checkPayer: false,
         rpcUrl: null,
         solanaRpcUrl: null,
+        sawRpc: false,
+        anchorFlag: false,
+        inclusionFile: null,
+        headFile: null,
+        epochRecordFile: null,
+        epochUrl: null,
+        positionals: [],
         json: false,
         quiet: false,
         help: false,
+        strictIssuerHistory: false,
+        issuerHistoryFile: null,
+        canonicalPreimageFile: null,
+        noIssuerHistory: false,
+        noPreimage: false,
     };
     for (let i = 0; i < args.length; i++) {
         const arg = args[i];
@@ -126,12 +194,44 @@ function parseArgs(args) {
         else if (arg === '--no-trusted-kid') {
             result.noTrustedKid = true;
         }
-        else if (arg === '--rpc' && args[i + 1]) {
-            result.rpcUrl = args[++i];
+        else if (arg === '--rpc') {
+            result.sawRpc = true;
+            const next = args[i + 1];
+            if (next && /^https?:\/\//i.test(next))
+                result.rpcUrl = args[++i];
+            else
+                result.anchorFlag = true;
+        }
+        else if (arg === '--inclusion' && args[i + 1]) {
+            result.inclusionFile = args[++i];
+        }
+        else if (arg === '--head' && args[i + 1]) {
+            result.headFile = args[++i];
+        }
+        else if (arg === '--epoch-record' && args[i + 1]) {
+            result.epochRecordFile = args[++i];
+        }
+        else if (arg === '--epoch-url' && args[i + 1]) {
+            result.epochUrl = args[++i];
         }
         else if (arg === '--solana-rpc' && args[i + 1]) {
             result.solanaRpcUrl = args[++i];
         }
+        else if (arg === '--strict-issuer-history') {
+            result.strictIssuerHistory = true;
+        }
+        else if (arg === '--issuer-history-file' && args[i + 1]) {
+            result.issuerHistoryFile = args[++i];
+        }
+        else if (arg === '--canonical-preimage' && args[i + 1]) {
+            result.canonicalPreimageFile = args[++i];
+        }
+        else if (arg === '--no-issuer-history') {
+            result.noIssuerHistory = true;
+        }
+        else if (arg === '--no-preimage') {
+            result.noPreimage = true;
+        }
         else if (arg === '--json') {
             result.json = true;
         }
@@ -139,7 +239,9 @@ function parseArgs(args) {
             result.quiet = true;
         }
         else if (!arg.startsWith('-')) {
-            result.file = arg;
+            result.positionals.push(arg);
+            if (!result.file)
+                result.file = arg;
         }
     }
     return result;
@@ -163,11 +265,324 @@ function formatAmount(units) {
     const usd = n / 1e6;
     return `$${usd.toFixed(usd >= 0.01 ? 2 : 6)} (${units} units)`;
 }
+function readJson(file) {
+    const content = file === '-' ? (0, node_fs_1.readFileSync)(0, 'utf8') : (0, node_fs_1.readFileSync)(file, 'utf8');
+    return JSON.parse(content);
+}
+function headStatus(file) {
+    try {
+        const doc = readJson(file);
+        return typeof doc?.status === 'string' ? doc.status : null;
+    }
+    catch {
+        return null;
+    }
+}
+function printLane(lane) {
+    const bit = (value) => (value == null ? 'unknown' : (value ? 'true' : 'false'));
+    console.log(`  Receipt lane (unsigned)`);
+    console.log(`  ─────────────────────────────────────────────────`);
+    console.log(`  book_seq:      ${lane.book_seq ?? '—'}`);
+    console.log(`  settled_by:    ${lane.settled_by ?? 'null'}`);
+    console.log(`  settled:       ${bit(lane.settled)}`);
+    console.log(`  anchor_changed_since_binding: ${bit(lane.anchor_changed_since_binding)}`);
+    console.log(`  freeze:        ${lane.freeze ? 'YES' : 'no'}`);
+    if (lane.reason)
+        console.log(`  reason:        ${lane.reason}`);
+    console.log(`  classification:${lane.classification}`);
+    console.log(`  ordering:      ${lane.ordering}`);
+    console.log(`  boundary:      ${lane.boundary}`);
+    if (lane.local_check) {
+        console.log(`  local_check:   payee ${lane.local_check.payee} amount ${lane.local_check.amount_atomic} (not a payment)`);
+    }
+    console.log(`  ${lane.rule}`);
+    console.log('');
+}
+function printAnchor(result, json, quiet) {
+    if (json) {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    if (quiet && result.overall !== 'failed')
+        return;
+    const mark = (ok) => (ok ? '✓ YES' : '✗ NO');
+    console.log('');
+    console.log('  Anchored receipt root');
+    console.log('  ─────────────────────────────────────────────────');
+    console.log(`  Root:          ${result.root || '—'}`);
+    console.log(`  Inclusion:     ${mark(result.inclusion.valid)}${result.inclusion.reason ? ` (${result.inclusion.reason})` : ''}`);
+    console.log(`  Leaf source:   ${result.inclusion.leaf_source}`);
+    console.log(`  Solana:        ${result.solana.checked ? mark(result.solana.valid) : (result.solana.reason || 'not checked')}`);
+    if (result.solana.signature)
+        console.log(`  Signature:     ${result.solana.signature}`);
+    if (result.solana.slot != null)
+        console.log(`  Slot:          ${result.solana.slot}`);
+    if (result.solana.cluster)
+        console.log(`  Cluster:       ${result.solana.cluster}`);
+    if (result.solana.memo)
+        console.log(`  Memo:          ${result.solana.memo}`);
+    if (result.solana.reason && !result.solana.valid)
+        console.log(`  Solana reason: ${result.solana.reason}`);
+    console.log(`  Base:          ${result.base.checked ? mark(result.base.valid) : (result.base.reason || 'not checked')}`);
+    if (result.base.tx)
+        console.log(`  Base tx:       ${result.base.tx}`);
+    if (result.base.chain_id != null)
+        console.log(`  Chain id:      ${result.base.chain_id}`);
+    if (result.base.reason && !result.base.valid)
+        console.log(`  Base reason:   ${result.base.reason}`);
+    console.log('');
+    console.log('  What this proves');
+    console.log('  ─────────────────────────────────────────────────');
+    for (const line of result.proves)
+        console.log(`  ${line}`);
+    console.log('');
+    console.log('  What this does not prove');
+    console.log('  ─────────────────────────────────────────────────');
+    for (const line of result.does_not_prove)
+        console.log(`  ${line}`);
+    console.log('');
+    console.log(`  Overall: ${result.overall.toUpperCase()}`);
+    if (result.errors.length > 0)
+        console.log(`  Errors:  ${result.errors.join(', ')}`);
+    console.log('');
+}
+function headNeedsEpochRecord(head) {
+    const schema = head.schema;
+    const version = head.payload_version;
+    return head.epoch != null || schema === 'chit402.tree_head.v2' || version === 2;
+}
+function epochUrlFromReceipt(receipt) {
+    const raw = receipt?.verify_url;
+    if (!raw)
+        return null;
+    try {
+        return `${new URL(raw).origin}/v1/receipts/tree/epoch`;
+    }
+    catch {
+        return null;
+    }
+}
+async function loadEpochRecord(args, receipt) {
+    if (args.epochRecordFile) {
+        return JSON.parse((0, node_fs_1.readFileSync)(args.epochRecordFile, 'utf8'));
+    }
+    const url = args.epochUrl || epochUrlFromReceipt(receipt);
+    if (!url)
+        return null;
+    const res = await fetch(url);
+    if (!res.ok)
+        return null;
+    const body = await res.json();
+    if (!body?.issuer_signature?.jws)
+        return null;
+    return body;
+}
+function epochSignatureOk(record, jws, jwks, trustedKids) {
+    const sig = record.issuer_signature;
+    const embedded = sig && 'issuer_jwk' in sig
+        ? sig.issuer_jwk
+        : undefined;
+    const kid = (0, jws_js_1.readJwsHeader)(jws)?.kid;
+    const keys = [];
+    for (const key of jwks?.keys || []) {
+        if (!key || key.kty !== 'EC')
+            continue;
+        const jwk = key;
+        if (kid && jwk.kid !== kid)
+            continue;
+        keys.push(jwk);
+    }
+    if (embedded && trustedKids?.includes((0, jws_js_1.jwkThumbprint)(embedded)))
+        keys.push(embedded);
+    for (const key of keys) {
+        const verified = (0, jws_js_1.verifyIssuerJws)(jws, key);
+        if (!verified.valid || !verified.payload)
+            continue;
+        const payload = verified.payload;
+        if (JSON.stringify(payload.epochs ?? null) !== JSON.stringify(record.epochs ?? null))
+            return false;
+        if (JSON.stringify(payload.orphans ?? []) !== JSON.stringify(record.orphans ?? []))
+            return false;
+        return true;
+    }
+    return false;
+}
+async function runAnchor(args) {
+    const receiptPath = args.file;
+    const inclusionPath = args.inclusionFile || args.positionals[1] || null;
+    const headPath = args.headFile || (args.inclusionFile ? null : args.positionals[2]) || null;
+    if (!receiptPath || !inclusionPath || !headPath) {
+        const candidates = [args.headFile, headPath, ...args.positionals];
+        if (candidates.some((file) => file && headStatus(file) === 'not_yet_published')) {
+            console.error('Tree head is not_yet_published.');
+            return 3;
+        }
+        console.error('Anchor check needs a receipt, an inclusion proof, and a tree head.');
+        console.error('  xfuel-verify receipt.json inclusion.json head.json --rpc');
+        return 3;
+    }
+    let receipt;
+    let inclusion;
+    let head;
+    try {
+        receipt = readJson(receiptPath);
+        inclusion = readJson(inclusionPath);
+        head = readJson(headPath);
+    }
+    catch (err) {
+        console.error(`Error reading anchor inputs: ${err instanceof Error ? err.message : String(err)}`);
+        return 3;
+    }
+    let epochRecord = null;
+    let verifyEpochSignature;
+    if (headNeedsEpochRecord(head)) {
+        try {
+            epochRecord = await loadEpochRecord(args, receipt);
+        }
+        catch {
+            epochRecord = null;
+        }
+        if (epochRecord?.issuer_signature?.jws) {
+            let fileJwks;
+            if (args.jwksFile) {
+                try {
+                    fileJwks = JSON.parse((0, node_fs_1.readFileSync)(args.jwksFile, 'utf8'));
+                }
+                catch (err) {
+                    console.error(`Error reading JWKS file: ${err instanceof Error ? err.message : String(err)}`);
+                    return 3;
+                }
+            }
+            const loaded = await (0, index_js_1.loadIssuerJwks)(receipt, {
+                jwks: fileJwks,
+                jwksUri: args.jwksUrl || undefined,
+                fetchJwks: args.fetchJwks,
+            });
+            const trustedKids = args.noTrustedKid
+                ? []
+                : (args.trustedKids ?? [...index_js_1.DEFAULT_TRUSTED_ISSUER_KIDS]);
+            verifyEpochSignature = (jws) => epochSignatureOk(epochRecord, jws, loaded.jwks, trustedKids);
+        }
+    }
+    const result = await (0, anchor_witness_js_1.verifyAnchoredRoot)({
+        receipt,
+        inclusion,
+        head,
+        baseRpcUrl: args.rpcUrl || undefined,
+        solanaRpcUrl: args.solanaRpcUrl || undefined,
+        epochRecord,
+        verifyEpochSignature,
+    });
+    const verified = await (0, index_js_1.verifyReceipt)(receipt, { head });
+    const lane = verified.receipt_lane;
+    if (args.json) {
+        console.log(JSON.stringify({ ...result, receipt_lane: lane }, null, 2));
+    }
+    else {
+        printAnchor(result, false, args.quiet);
+        if (!args.quiet)
+            printLane(lane);
+    }
+    if (result.overall === 'verified')
+        return 0;
+    if (result.overall === 'partial')
+        return 2;
+    return 1;
+}
+async function runRefusal(doc, args) {
+    const trustedKids = args.trustedKids ?? index_js_1.DEFAULT_TRUSTED_ISSUER_KIDS;
+    const result = (0, index_js_1.verifyRefusal)(doc, {
+        jwks: args.jwks,
+        trustedKids,
+    });
+    const preimages = await (0, preimage_js_1.verifyPublishedPreimages)(doc, {
+        requirePreimages: args.requirePreimages,
+    });
+    let canonicalFailed = false;
+    if (args.canonicalPreimage != null) {
+        const canonical = (0, canonical_preimage_js_1.verifyCanonicalPreimageBytes)(args.canonicalPreimage, result.payload_hash);
+        canonicalFailed = !canonical.ok;
+        if (canonicalFailed)
+            preimages.errors.push(`canonical preimage: ${canonical.reason}`);
+        if (canonicalFailed)
+            preimages.ok = false;
+    }
+    const pin = result.valid ? (0, issuer_history_js_1.readIssuerHistoryPin)({
+        issuer_history: result.issuer_history,
+    }) : null;
+    const history = args.skipIssuerHistory
+        ? { checked: false, ok: true, unreachable: false, warning: null, reason: null, kid: result.kid ?? null }
+        : await (0, issuer_history_js_1.checkReceiptIssuerHistory)(doc, {
+            document: args.issuerHistory,
+            documentBytes: args.issuerHistoryBytes,
+            fetchHistory: args.fetchIssuerHistory,
+            strict: args.strictIssuerHistory,
+            jwks: args.jwks,
+            trustedKids,
+            issuedAt: doc.issued_at ?? null,
+            kid: result.kid ?? doc.issuer_signature?.kid ?? null,
+            pin,
+            requirePin: result.valid && Number(result.payload_version) >= 2,
+        });
+    const historyFailed = history.checked && !history.ok;
+    const failed = !result.valid || !preimages.ok || historyFailed || canonicalFailed;
+    if (args.json) {
+        console.log(JSON.stringify({ ...result, preimages, issuer_history: history }, null, 2));
+    }
+    else if (!args.quiet || failed) {
+        console.log('');
+        console.log('  Chit402 Refusal Verification');
+        console.log('  ─────────────────────────────────────────────────');
+        console.log(`  Schema:        ${result.schema}`);
+        console.log(`  Refusal ID:    ${result.refusal_id || doc.refusal_id || '—'}`);
+        console.log(`  Code:          ${result.refusal_code || doc.refusal_code || '—'}`);
+        console.log(`  Nonce:         ${result.nonce || '—'}`);
+        console.log(`  Chain:         ${result.chain_id ?? 'null'}`);
+        console.log(`  Charged:       false`);
+        console.log('');
+        console.log('  Issuer Signature');
+        console.log('  ─────────────────────────────────────────────────');
+        console.log(`  Valid:         ${result.valid ? '✓ YES' : '✗ NO'}`);
+        if (result.kid)
+            console.log(`  Kid:           ${result.kid}`);
+        if (!result.valid && result.reason)
+            console.log(`  Reason:        ${result.reason}`);
+        console.log('');
+        console.log('  What this proves');
+        console.log('  ─────────────────────────────────────────────────');
+        for (const line of result.proves)
+            console.log(`  ${line}`);
+        console.log('');
+        console.log('  What this does not prove');
+        console.log('  ─────────────────────────────────────────────────');
+        for (const line of result.does_not_prove)
+            console.log(`  ${line}`);
+        console.log('');
+        console.log(`  Overall: ${failed ? 'FAILED' : 'VERIFIED'}`);
+        if (!preimages.ok)
+            console.log(`  Preimages:     ${preimages.errors.join('; ')}`);
+        if (history.warning)
+            console.log(`  Issuer history: ${history.warning}`);
+        if (historyFailed && history.reason)
+            console.log(`  Issuer history: ${history.reason}`);
+        console.log('');
+    }
+    return failed ? 1 : 0;
+}
 async function main() {
     const args = parseArgs(process.argv.slice(2));
-    if (args.help || !args.file) {
+    const anchorMode = args.anchorFlag
+        || Boolean(args.inclusionFile || args.headFile)
+        || (args.positionals.length >= 3 && args.sawRpc);
+    if (args.help) {
         console.log(HELP);
-        return args.help ? 0 : 3;
+        return 0;
+    }
+    if (anchorMode)
+        return runAnchor(args);
+    if (!args.file) {
+        console.log(HELP);
+        return 3;
     }
     let receipt;
     try {
@@ -195,7 +610,54 @@ async function main() {
     }
     const trustedKids = args.noTrustedKid
         ? []
-        : (args.trustedKids ?? undefined);
+        : (args.trustedKids ?? index_js_1.DEFAULT_TRUSTED_ISSUER_KIDS);
+    if ((0, index_js_1.isRefusalDocument)(receipt)) {
+        let issuerHistory = null;
+        let issuerHistoryBytes = null;
+        if (args.issuerHistoryFile) {
+            issuerHistoryBytes = (0, node_fs_1.readFileSync)(args.issuerHistoryFile, 'utf8');
+            issuerHistory = JSON.parse(issuerHistoryBytes);
+        }
+        let canonicalPreimage = null;
+        if (args.canonicalPreimageFile) {
+            canonicalPreimage = (0, node_fs_1.readFileSync)(args.canonicalPreimageFile, 'utf8');
+        }
+        return runRefusal(receipt, {
+            jwks,
+            trustedKids,
+            json: args.json,
+            quiet: args.quiet,
+            requirePreimages: !args.noPreimage,
+            issuerHistory,
+            issuerHistoryBytes,
+            fetchIssuerHistory: !args.noIssuerHistory && !issuerHistory,
+            strictIssuerHistory: args.strictIssuerHistory,
+            skipIssuerHistory: args.noIssuerHistory,
+            canonicalPreimage,
+        });
+    }
+    let issuerHistory = null;
+    let issuerHistoryBytes = null;
+    if (args.issuerHistoryFile) {
+        try {
+            issuerHistoryBytes = (0, node_fs_1.readFileSync)(args.issuerHistoryFile, 'utf8');
+            issuerHistory = JSON.parse(issuerHistoryBytes);
+        }
+        catch (err) {
+            console.error(`Error reading issuer history: ${err instanceof Error ? err.message : String(err)}`);
+            return 3;
+        }
+    }
+    let canonicalPreimage = null;
+    if (args.canonicalPreimageFile) {
+        try {
+            canonicalPreimage = (0, node_fs_1.readFileSync)(args.canonicalPreimageFile, 'utf8');
+        }
+        catch (err) {
+            console.error(`Error reading canonical preimage: ${err instanceof Error ? err.message : String(err)}`);
+            return 3;
+        }
+    }
     const result = await (0, index_js_1.verifyReceipt)(receipt, {
         jwks,
         jwksUri: args.jwksUrl || undefined,
@@ -205,6 +667,13 @@ async function main() {
         checkPayer: args.checkPayer,
         rpcUrl: args.rpcUrl || undefined,
         solanaRpcUrl: args.solanaRpcUrl || undefined,
+        requirePreimages: !args.noPreimage,
+        issuerHistory,
+        issuerHistoryBytes,
+        fetchIssuerHistory: !args.noIssuerHistory && !issuerHistory,
+        strictIssuerHistory: args.strictIssuerHistory,
+        skipIssuerHistory: args.noIssuerHistory,
+        canonicalPreimage,
     });
     if (args.json) {
         console.log(JSON.stringify(result, null, 2));
@@ -292,6 +761,16 @@ async function main() {
             console.log(`  Status:        No nullifier (Tier-1 receipt)`);
         }
         console.log('');
+        printLane(result.receipt_lane);
+        if (result.preimages.checked) {
+            console.log(`  Preimages:     ${result.preimages.ok ? '✓ MATCH' : '✗ ' + result.preimages.errors.join('; ')}`);
+        }
+        if (result.issuer_history.checked) {
+            console.log(`  Issuer history: ${result.issuer_history.ok ? '✓ kid in window' : '✗ ' + (result.issuer_history.reason || 'failed')}`);
+        }
+        else if (result.issuer_history.warning) {
+            console.log(`  Issuer history: ${result.issuer_history.warning}`);
+        }
         console.log(`  Overall: ${result.overall.toUpperCase()}`);
         if (result.errors.length > 0) {
             console.log(`  Errors:  ${result.errors.join(', ')}`);
@@ -309,10 +788,43 @@ async function main() {
             return 1;
     }
 }
+/**
+ * Node's fetch keeps its undici agent on this symbol after the first request.
+ * There is no public handle for that pool. Closing it lets the loop drain.
+ */
+const UNDICI_GLOBAL_DISPATCHER = Symbol.for('undici.globalDispatcher.1');
+function fetchDispatcher() {
+    const bag = globalThis;
+    return bag[UNDICI_GLOBAL_DISPATCHER];
+}
+/**
+ * process.exit() while a fetch keep-alive socket is already CLOSING aborts
+ * on Windows: Assertion failed: !(handle->flags & UV_HANDLE_CLOSING)
+ * (src/win/async.c). Set the code and close the pool so the loop can drain.
+ */
+async function finish(code) {
+    process.exitCode = code;
+    const dispatcher = fetchDispatcher();
+    if (!dispatcher)
+        return;
+    try {
+        const closing = dispatcher.close?.();
+        if (closing)
+            await closing;
+    }
+    catch {
+        try {
+            await dispatcher.destroy?.();
+        }
+        catch {
+            // The verification result is already the exit code.
+        }
+    }
+}
 main()
-    .then((code) => process.exit(code))
+    .then((code) => finish(code))
     .catch((err) => {
     console.error('Unexpected error:', err);
-    process.exit(3);
+    return finish(3);
 });
 //# sourceMappingURL=cli.js.map