burnledger 0.4.0 → 0.6.0

package/dist/esm/anchor.js

@@ -0,0 +1,275 @@
+/** The statement's log anchor, tested against the log's own signed head.
+ *
+ * A certificate status statement is an OFF-LOG document. Nothing stops the
+ * issuer signing two of them, at the same instant, saying different things
+ * about the same record to two different readers — that is the split-view
+ * attack on revocation status, and no signature by the issuer can rule out a
+ * second signature by the issuer.
+ *
+ * What the statement DOES carry is an anchor: sth_tree_size and sth_root_hash,
+ * signed, naming the log head the issuer had in front of it when it spoke.
+ * Until now this CLI PRINTED that anchor and never checked it, so the field was
+ * decoration. Checking it does not make the statement append-only, and this
+ * file must not be read as claiming it does. What it buys is narrower and real:
+ *
+ *   - A statement can no longer name a tree the log does not have. The anchor
+ *     must be a PREFIX of the head the log publishes now, proved by an RFC 6962
+ *     consistency proof, or this CLI refuses the statement.
+ *   - So an issuer wanting to show two readers different revocation status has
+ *     two options, and both leave marks. Anchor both statements to the same
+ *     head, and the two statements are directly comparable signed evidence of
+ *     equivocation. Anchor them to different heads, and the log itself has
+ *     forked — which is what the witness's published record exists to catch,
+ *     and which no amount of re-signing can hide.
+ *
+ * What it does NOT close: a reader who checks one statement, alone, against a
+ * log the issuer also controls learns only that the issuer is self-consistent.
+ * Split view is detected by comparing notes — between readers, or against the
+ * witness — and this check is what makes the note worth comparing.
+ *
+ * This is a port of cmd/cli/anchor.go, verdict for verdict and word for word.
+ * Three CLIs that disagree about the same record are worse than one that never
+ * checked, so the detail strings are copied rather than paraphrased: a reader
+ * diffing the Go and the npm output must see the same line.
+ */
+import { bytesToHex, buildTreeHeadPayload, formatTimestamp, hexToBytes, verifyConsistency, } from "./verify.js";
+export const ANCHOR_CONFIRMED = "CONFIRMED";
+export const ANCHOR_UNVERIFIED = "UNVERIFIED";
+export const ANCHOR_INCONSISTENT = "INCONSISTENT";
+/** How much of a log response this will buffer, matching cmd/cli/online.go.
+ * A head is a few hundred bytes and a consistency proof is at most 64 hashes;
+ * anything near this size is a misbehaving or hostile server, not an answer. */
+const MAX_RESPONSE_BYTES = 1 << 20;
+const REQUEST_TIMEOUT_MS = 10_000;
+/** Test the statement's signed anchor against the log's own signed head.
+ *
+ * `key` is the key that signed the STATEMENT, taken from the reader's --keys
+ * file. The head is verified against it before a single field of the head is
+ * used: an unverified head is an unattributed one, and letting it decide
+ * whether the anchor is consistent would hand that decision to whoever answered
+ * the HTTP request.
+ *
+ * `statement` must already have passed unwrapStatusStatement, which is what
+ * guarantees `sth_root_hash` is 32 bytes of hex. That is the boundary check;
+ * this function does not repeat it.
+ */
+export async function checkStatementAnchor(crypto, apiUrl, statement, key) {
+    const treeSize = statement.sth_tree_size;
+    if (typeof treeSize !== "number" || !Number.isSafeInteger(treeSize) || treeSize < 0) {
+        // Go's uint64 field would have failed to unmarshal, taking the whole
+        // document with it; here the document already parsed, so the anchor is what
+        // is unusable. Either way nothing was established, which is UNVERIFIED.
+        return unverified("the statement's anchored tree size is not a usable integer");
+    }
+    if (treeSize === 0)
+        return unverified("the statement names no log head to anchor to");
+    let head;
+    try {
+        head = await fetchLogHead(apiUrl);
+    }
+    catch (e) {
+        return unverified(`could not read the log head: ${message(e)}`);
+    }
+    let headPayload;
+    try {
+        headPayload = buildTreeHeadPayload(head);
+    }
+    catch (e) {
+        return unverified(`could not rebuild the log head payload: ${message(e)}`);
+    }
+    const headSignature = hexToBytes(head.signature);
+    if (!(await crypto.ed25519Verify(key.keyBytes, headPayload, headSignature))) {
+        return unverified("the log head is not signed by the key that signed the statement, so it says nothing about it");
+    }
+    const headSize = head.tree_size;
+    const headRoot = hexToBytes(head.root_hash);
+    const statementRoot = hexToBytes(statement.sth_root_hash);
+    // A head SMALLER than one the same issuer signed into a statement means the
+    // log went backwards. An append-only structure cannot do that, so this needs
+    // no proof to refuse.
+    if (headSize < treeSize) {
+        return {
+            verdict: ANCHOR_INCONSISTENT,
+            detail: `the statement is anchored to tree size ${treeSize} but the log now publishes ` +
+                `${headSize} — an append-only log does not shrink`,
+        };
+    }
+    if (headSize === treeSize) {
+        // Consistency is equality at the same size, and it still has to be checked
+        // rather than assumed: two different roots signed for one tree size is the
+        // fork, stated as plainly as it can be.
+        if (!bytesEqual(headRoot, statementRoot)) {
+            return {
+                verdict: ANCHOR_INCONSISTENT,
+                detail: `two different roots signed for tree size ${treeSize}: ` +
+                    `${bytesToHex(statementRoot.slice(0, 8))} in the statement, ` +
+                    `${bytesToHex(headRoot.slice(0, 8))} from the log`,
+            };
+        }
+        return {
+            verdict: ANCHOR_CONFIRMED,
+            detail: `statement anchored to the log's current head (tree size ${headSize})`,
+        };
+    }
+    let proof;
+    try {
+        proof = await fetchConsistencyProof(apiUrl, treeSize, headSize);
+    }
+    catch (e) {
+        return unverified(`could not read a consistency proof: ${message(e)}`);
+    }
+    if (!(await verifyConsistency(crypto, treeSize, headSize, statementRoot, headRoot, proof))) {
+        return {
+            verdict: ANCHOR_INCONSISTENT,
+            detail: `the log cannot prove tree size ${treeSize} is a prefix of its current size ` +
+                `${headSize} — the statement is anchored to a different history`,
+        };
+    }
+    return {
+        verdict: ANCHOR_CONFIRMED,
+        detail: `statement's head (tree size ${treeSize}) proved to be a prefix of the log's ` +
+            `current head (tree size ${headSize})`,
+    };
+}
+function unverified(detail) {
+    return { verdict: ANCHOR_UNVERIFIED, detail };
+}
+function message(e) {
+    return e instanceof Error ? e.message : String(e);
+}
+function bytesEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    for (let i = 0; i < a.length; i++)
+        if (a[i] !== b[i])
+            return false;
+    return true;
+}
+/** Read GET /v1/log/head and validate every field the signature covers.
+ *
+ * `log_id` is one of them. The endpoint serves none today (handler/log.go
+ * signedTreeHeadResponse) and BurnLedger's signer refuses to issue a head that
+ * names a log, but buildTreeHeadPayload picks the signing domain from the
+ * field, so a head that carries one has to reach it: dropped, the head rebuilds
+ * under burnledger.sth.v3, fails its signature and is reported unattributable —
+ * while the record path verifies the very same bytes. cmd/cli/anchor.go reads
+ * exactly these five fields, and all three CLIs are held to one fixture,
+ * testdata/named_head_anchor.json, so a head from a log that stamps its id gets
+ * one verdict rather than three.
+ */
+async function fetchLogHead(apiUrl) {
+    const envelope = await getJson(`${base(apiUrl)}/v1/log/head`);
+    const body = unwrapData(envelope);
+    const treeSize = body.tree_size;
+    if (typeof treeSize !== "number" || !Number.isSafeInteger(treeSize) || treeSize < 0) {
+        throw new Error("log head: tree_size is not an exact non-negative integer");
+    }
+    requireHex(body, "root_hash", 32);
+    requireHex(body, "signature", 64);
+    // Absent and null both mean "names no log", as they do for Go's string
+    // field; anything else that is not a string is a head this build cannot
+    // read, which Go's decoder also refuses.
+    if (body.log_id != null && typeof body.log_id !== "string") {
+        throw new Error("log head: log_id is not a string");
+    }
+    // Validated here rather than left to the payload rebuild, so that a head with
+    // an unreadable timestamp reports the same thing the Go CLI reports.
+    try {
+        formatTimestamp(body.timestamp);
+    }
+    catch {
+        throw new Error("log head: timestamp is not RFC 3339");
+    }
+    return body;
+}
+async function fetchConsistencyProof(apiUrl, oldSize, newSize) {
+    const url = `${base(apiUrl)}/v1/log/proof/consistency?old_size=${oldSize}&new_size=${newSize}`;
+    const body = unwrapData(await getJson(url));
+    const raw = body.proof;
+    // Go decodes `"proof": null` to an empty slice, and an empty proof is a real
+    // answer at some tree sizes. An absent or null field is that, not an error.
+    if (raw === null || raw === undefined)
+        return [];
+    if (!Array.isArray(raw))
+        throw new Error("consistency proof: proof is not an array");
+    return raw.map((h, i) => {
+        if (typeof h !== "string" || !/^[0-9a-fA-F]{64}$/.test(h)) {
+            throw new Error(`consistency proof: proof[${i}] is not 32 bytes of hex`);
+        }
+        return hexToBytes(h);
+    });
+}
+function base(apiUrl) {
+    return apiUrl.replace(/\/+$/, "");
+}
+/** The API wraps every response in {"data": ...}. A body with no data object is
+ * an answer this build cannot read — never a finding about the record. */
+function unwrapData(parsed) {
+    if (parsed === null || typeof parsed !== "object") {
+        throw new Error("response is not a JSON object");
+    }
+    const doc = parsed;
+    const data = doc.data;
+    if (data === null || typeof data !== "object") {
+        throw new Error("response has no data object");
+    }
+    return data;
+}
+function requireHex(doc, field, bytes) {
+    const v = doc[field];
+    if (typeof v !== "string" || !new RegExp(`^[0-9a-fA-F]{${bytes * 2}}$`).test(v)) {
+        throw new Error(`log head: ${field} is not ${bytes} bytes of hex`);
+    }
+}
+/** Read one public log endpoint under the same size cap and timeout as the
+ * status fetch, and with the same absence of credentials: every endpoint this
+ * file touches is public by design, and sending an API key to whatever
+ * --api-url happens to point at is a credential leak the check never needed. */
+async function getJson(url) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => { controller.abort(); }, REQUEST_TIMEOUT_MS);
+    try {
+        const res = await fetch(url, { signal: controller.signal });
+        const body = await readCapped(res);
+        if (!res.ok)
+            throw new Error(`API returned ${res.status}`);
+        try {
+            return JSON.parse(body);
+        }
+        catch (e) {
+            throw new Error(`parse response: ${message(e)}`);
+        }
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** Read a response body, stopping at the cap instead of buffering whatever a
+ * hostile server decides to send. The stream is cancelled on the way out, so an
+ * endless body costs one megabyte and not the process. */
+async function readCapped(res) {
+    const reader = res.body?.getReader();
+    if (reader === undefined)
+        return "";
+    const chunks = [];
+    let total = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        total += value.length;
+        if (total > MAX_RESPONSE_BYTES) {
+            await reader.cancel();
+            throw new Error(`read response: body exceeds ${MAX_RESPONSE_BYTES} bytes`);
+        }
+        chunks.push(value);
+    }
+    const joined = new Uint8Array(total);
+    let at = 0;
+    for (const c of chunks) {
+        joined.set(c, at);
+        at += c.length;
+    }
+    return new TextDecoder().decode(joined);
+}
+//# sourceMappingURL=anchor.js.map

package/dist/esm/anchor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anchor.js","sourceRoot":"","sources":["../../src/anchor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAGH,OAAO,EACL,UAAU,EACV,oBAAoB,EACpB,eAAe,EACf,UAAU,EACV,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAkBrB,MAAM,CAAC,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAC5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,YAAY,CAAC;AAC9C,MAAM,CAAC,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAOlD;;gFAEgF;AAChF,MAAM,kBAAkB,GAAG,CAAC,IAAI,EAAE,CAAC;AAEnC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAOlC;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAiB,EACjB,MAAc,EACd,SAAkC,EAClC,GAAkB;IAElB,MAAM,QAAQ,GAAG,SAAS,CAAC,aAAa,CAAC;IACzC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACpF,qEAAqE;QACrE,4EAA4E;QAC5E,wEAAwE;QACxE,OAAO,UAAU,CAAC,4DAA4D,CAAC,CAAC;IAClF,CAAC;IACD,IAAI,QAAQ,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC,8CAA8C,CAAC,CAAC;IAEtF,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,UAAU,CAAC,gCAAgC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,WAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,WAAW,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,UAAU,CAAC,2CAA2C,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,MAAM,aAAa,GAAG,UAAU,CAAC,IAAI,CAAC,SAAmB,CAAC,CAAC;IAC3D,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC,EAAE,CAAC;QAC5E,OAAO,UAAU,CACf,8FAA8F,CAC/F,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAmB,CAAC;IAC1C,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,SAAmB,CAAC,CAAC;IACtD,MAAM,aAAa,GAAG,UAAU,CAAC,SAAS,CAAC,aAAuB,CAAC,CAAC;IAEpE,4EAA4E;IAC5E,6EAA6E;IAC7E,sBAAsB;IACtB,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;QACxB,OAAO;YACL,OAAO,EAAE,mBAAmB;YAC5B,MAAM,EACJ,0CAA0C,QAAQ,6BAA6B;gBAC/E,GAAG,QAAQ,uCAAuC;SACrD,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,2EAA2E;QAC3E,2EAA2E;QAC3E,wCAAwC;QACxC,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,CAAC;YACzC,OAAO;gBACL,OAAO,EAAE,mBAAmB;gBAC5B,MAAM,EACJ,4CAA4C,QAAQ,IAAI;oBACxD,GAAG,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB;oBAC7D,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe;aACrD,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,gBAAgB;YACzB,MAAM,EAAE,2DAA2D,QAAQ,GAAG;SAC/E,CAAC;IACJ,CAAC;IAED,IAAI,KAAmB,CAAC;IACxB,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,UAAU,CAAC,uCAAuC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QAC3F,OAAO;YACL,OAAO,EAAE,mBAAmB;YAC5B,MAAM,EACJ,kCAAkC,QAAQ,mCAAmC;gBAC7E,GAAG,QAAQ,qDAAqD;SACnE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,gBAAgB;QACzB,MAAM,EACJ,+BAA+B,QAAQ,uCAAuC;YAC9E,2BAA2B,QAAQ,GAAG;KACzC,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,SAAS,OAAO,CAAC,CAAU;IACzB,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,YAAY,CAAC,MAAc;IACxC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAElC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC;IAChC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IACD,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;IAClC,UAAU,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC;IAClC,uEAAuE;IACvE,wEAAwE;IACxE,yCAAyC;IACzC,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,8EAA8E;IAC9E,qEAAqE;IACrE,IAAI,CAAC;QACH,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,MAAc,EACd,OAAe,EACf,OAAe;IAEf,MAAM,GAAG,GACP,GAAG,IAAI,CAAC,MAAM,CAAC,sCAAsC,OAAO,aAAa,OAAO,EAAE,CAAC;IACrF,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC;IACvB,6EAA6E;IAC7E,4EAA4E;IAC5E,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACrF,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACtB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IACvB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,IAAI,CAAC,MAAc;IAC1B,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED;0EAC0E;AAC1E,SAAS,UAAU,CAAC,MAAe;IACjC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,GAAG,GAAG,MAAiC,CAAC;IAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,IAA+B,CAAC;AACzC,CAAC;AAED,SAAS,UAAU,CAAC,GAA4B,EAAE,KAAa,EAAE,KAAa;IAC5E,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;IACrB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,MAAM,CAAC,gBAAgB,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,aAAa,KAAK,WAAW,KAAK,eAAe,CAAC,CAAC;IACrE,CAAC;AACH,CAAC;AAED;;;gFAGgF;AAChF,KAAK,UAAU,OAAO,CAAC,GAAW;IAChC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAC5E,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED;;0DAE0D;AAC1D,KAAK,UAAU,UAAU,CAAC,GAAa;IACrC,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACpC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,SAAS,CAAC;QACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;QACtB,IAAI,KAAK,GAAG,kBAAkB,EAAE,CAAC;YAC/B,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,+BAA+B,kBAAkB,QAAQ,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClB,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC1C,CAAC"}

package/dist/esm/cli.d.ts

@@ -1,23 +1,54 @@
 #!/usr/bin/env node
 /** burnledger check — offline certificate verification.
  * Exit codes: 0=valid, 1=invalid, 2=usage error */
+import { type KeyListEvidence } from "./keys.js";
+import { type AnchorResult } from "./anchor.js";
 type Cert = Record<string, unknown>;
+/** A published status statement, exactly as GET /v1/certificates/{id}/status
+ * serves it: hex strings, not decoded bytes. verifyCertificateWithStatus reads
+ * this shape, so nothing here re-encodes a field the signature covers. */
+type StatusStatement = Record<string, unknown>;
 /** Flag first, then environment — the precedence docs/cli.md promises and the
- * Go CLI (cmd/cli/online.go resolveAPIConfig) implements. Exported for testing. */
-export declare function resolveApiConfig(apiUrl: string, apiKey: string, env: Record<string, string | undefined>): {
-    apiUrl: string;
-    apiKey: string;
-};
+ * Go CLI (cmd/cli/online.go resolveAPIBaseURL) implements. Exported for testing.
+ *
+ * It no longer resolves a key, and that is the change. GET
+ * /v1/certificates/{id}/status is unauthenticated by design: the audience for
+ * revocation is a relying party holding a certificate — a regulator, an
+ * auditor, the customer's customer — who has no account here and never will.
+ * Demanding an API key was what stopped that reader asking the one question the
+ * artifact exists to answer. */
+export declare function resolveApiBaseUrl(apiUrl: string, env: Record<string, string | undefined>): string;
+/** The API wraps every response in {"data": ...}; a caller may hand over either
+ * the envelope or the document inside it. Mirrors
+ * core.ParseCertificateStatusDocument, so this CLI and the Go one cannot
+ * disagree about which shape the endpoint returns. Exported for testing.
+ *
+ * A document that does not parse THROWS, and the caller turns that into a
+ * warning and a VALID_REVOCATION_UNKNOWN verdict. That is deliberate: an answer
+ * this build cannot read is silence about revocation, not a finding about the
+ * certificate. Handing a half-read document to the verifier instead would
+ * report "status statement signature is invalid" — a claim about the issuer —
+ * when what actually happened is that something returned nonsense.
+ *
+ * `status` itself is NOT validated against a known set. A statement saying
+ * SUSPENDED is a statement this build cannot read, and the verifier already has
+ * the right answer for that: it authenticates the signature first, then reports
+ * VALID_REVOCATION_UNKNOWN. Refusing it here would discard the statement before
+ * anyone authenticated it. */
+export declare function unwrapStatusStatement(parsed: unknown): StatusStatement;
 /** The pass/fail decision behind the exit code. A signature failure, a
- * transparency FAILURE (thrown, not NOT_AVAILABLE), or an online-confirmed
- * revocation all make the certificate invalid. Exported for testing. */
-export declare function certVerdict(sigResult: string, transparencyFailed: boolean, online: boolean, revocation: {
-    status: string;
-} | undefined): boolean;
-export declare function formatOutput(cert: Cert, sigResult: string, transparency: string, transparencyFailed: boolean, revocation: {
-    status: string;
-    reason?: string;
-} | undefined, online: boolean): string;
+ * revocation, or a transparency FAILURE (thrown, not NOT_AVAILABLE) all make
+ * the certificate unusable. Revocation is no longer a separate input: it is
+ * part of the verdict verifyCertificateWithStatus returns. Exported for
+ * testing.
+ *
+ * An INCONSISTENT anchor refuses, mirroring exitCode in cmd/cli/check.go. It is
+ * not a doubt: it is a proof, from the issuer's own signatures, that the head a
+ * statement was anchored to is not a prefix of the head the log now publishes.
+ * An anchor that could NOT be checked does not refuse — the reader is told so,
+ * and the statement still stands on its own signature. */
+export declare function certVerdict(sigResult: string, transparencyFailed: boolean, anchor?: AnchorResult): boolean;
+export declare function formatOutput(cert: Cert, sigResult: string, transparency: string, transparencyFailed: boolean, status: StatusStatement | undefined, online: boolean, anchor?: AnchorResult, keyList?: KeyListEvidence): string;
 /** Accept the raw API response too: GET /v1/certificates/{id} nests the
  * signed certificate as data.certificate. Exported for testing. */
 export declare function unwrapCertificate(parsed: Cert): Cert;

package/dist/esm/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";AACA;mDACmD;AAUnD,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AA+BpC;mFACmF;AACnF,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAMpC;AAoDD;;wEAEwE;AACxE,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EACjB,kBAAkB,EAAE,OAAO,EAC3B,MAAM,EAAE,OAAO,EACf,UAAU,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,GACzC,OAAO,CAMT;AAUD,wBAAgB,YAAY,CAC1B,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAChF,UAAU,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EAAE,MAAM,EAAE,OAAO,GAC3E,MAAM,CAmDR;AAED;mEACmE;AACnE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,IAAI,GAAG,IAAI,CAUpD"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/cli.ts"],"names":[],"mappings":";AACA;mDACmD;AAcnD,OAAO,EAML,KAAK,eAAe,EACrB,MAAM,WAAW,CAAC;AACnB,OAAO,EAA6C,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3F,KAAK,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AACpC;;0EAE0E;AAC1E,KAAK,eAAe,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAkC/C;;;;;;;;gCAQgC;AAChC,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtD,MAAM,CAIR;AA2ED;;;;;;;;;;;;;;;;8BAgB8B;AAC9B,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,OAAO,GAAG,eAAe,CAoBtE;AAqCD;;;;;;;;;;0DAU0D;AAC1D,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,YAAY,GACpE,OAAO,CAGT;AAuDD,wBAAgB,YAAY,CAC1B,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,kBAAkB,EAAE,OAAO,EAChF,MAAM,EAAE,eAAe,GAAG,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,YAAY,EAC3E,OAAO,CAAC,EAAE,eAAe,GACxB,MAAM,CAiGR;AAgFD;mEACmE;AACnE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,IAAI,GAAG,IAAI,CAUpD"}