chit402-verify 0.3.4 → 0.4.0

package/dist/index.js

@@ -0,0 +1,1648 @@
+"use strict";
+/**
+ * @xfuel/verify — Offline verification for Chit402 receipts.
+ *
+ * Verify payment binding and output commitment WITHOUT calling the Chit402 API.
+ * Third parties use this to confirm:
+ *   1. The receipt's payment binding matches on-chain settlement
+ *   2. The output hash commitment is correct
+ *   3. The issuer signature is valid (ES256/JWKS)
+ *   4. (Optional) The SP1 nullifier is anchored on-chain
+ *
+ * See docs/specs/RECEIPT_V2_SEMANTICS.md for the verification algorithm.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REFUSAL_SCHEMA = exports.verifyRefusal = exports.isRefusalDocument = exports.HEAD_BINDING_PAYLOAD_VERSION = exports.outerHeadDisagrees = exports.signedHeadBinding = exports.headBindingVerdict = exports.RECEIPT_LANE_BOUNDARY = exports.RECEIPT_LANE_ORDERING = exports.RECEIPT_LANE_RULE = exports.RECEIPT_LANE_SCHEMA = exports.anchorChangedSinceBinding = exports.deriveSettled = exports.deriveSettledBy = exports.receiptLaneDecision = exports.receiptLaneFromVerification = exports.buildReceiptLane = exports.jwksHostAllowed = exports.isPinnedTrustedJwk = exports.jwkThumbprint = exports.KEY_UNTRUSTED = exports.DEFAULT_TRUSTED_JWKS_HOSTS = exports.DEFAULT_TRUSTED_ISSUER_KIDS = exports.verifyIssuerJws = exports.resolvePinnedIssuerJwk = exports.canonicalSignedPayload = exports.BASE_SEPOLIA_RPC_URL = exports.ZK_VERIFIER_ADDRESS = exports.decodeJwsPayload = exports.receiptPayerClaimsFromEnvelope = exports.verifyPayerBinding = exports.SOLANA_USDC_MINT_DEVNET = exports.SOLANA_USDC_MINT_MAINNET = exports.SOLANA_RPC_URL = exports.fetchSolanaTransaction = exports.inferUsdcOutflowFromBalances = exports.extractUsdcTransfersFromTx = exports.isSolanaBase58Pubkey = exports.parseSolanaPaymentRef = exports.verifySolanaPayer = exports.BASE_RPC_URL = exports.ERC20_TRANSFER_TOPIC = exports.USDC_ADDRESSES = exports.fetchBaseTransactionReceipt = exports.sumUsdcTransfersFromPayer = exports.isEvmAddress = exports.parseBasePaymentRef = exports.verifyBasePayer = exports.computeInferenceBinding = exports.computePaymentCommitment = void 0;
+exports.ISSUER_ROTATION_CONTEXT = exports.ISSUER_REGISTRATION_CONTEXT = exports.canonicalPublicKey = exports.verifyRegistrationSignature = exports.verifyCitizenRotation = exports.serializeIssuerPin = exports.rotationStatement = exports.registrationPreimage = exports.readIssuerPinClaim = exports.loadIssuerPinBytes = exports.issuerPinFileHash = exports.issuerPinContentUrl = exports.assessIssuerPin = exports.BASE_MAINNET_CHAIN_ID = exports.SOLANA_GENESIS = exports.ANCHOR_DOES_NOT_PROVE = exports.ANCHOR_PROVES = exports.leafHash = exports.parseAnchorMemo = exports.extractMemos = exports.verifyMerkleInclusion = exports.verifyAnchoredRoot = exports.CARRY_FORWARD_STATUS = exports.PINNED_ANCHOR_EPOCHS = exports.verifyCarryForward = exports.EPOCH2_OPENING_ROOT = exports.matchEpoch1Prefix = exports.epoch1PrefixRoot = exports.EPOCH1_SIZE2_ROOT = exports.EPOCH1_SIZE1_ROOT = exports.EPOCH1_GENESIS_DIGEST = exports.EPOCH1_FINAL_SIZE = exports.EPOCH1_FINAL_ROOT = exports.TREE_HEAD_SCHEMA_V2 = exports.TREE_HEAD_SCHEMA_V1 = exports.canonicalUnloggedRows = exports.unloggedReasonForTask = exports.unloggedIdCommitment = exports.verifyUnloggedCommitment = exports.verifyUnloggedSection = exports.verifyEpochInclusion = exports.verifyEpochRecord = exports.verifyEpochLink = exports.acceptTreeHeadSchema = exports.requestDigestOfPreimage = exports.verifyRequestDigest = exports.REFUSAL_DOES_NOT_PROVE = exports.REFUSAL_PROVES = exports.REFUSAL_PAYLOAD_VERSION = exports.REFUSAL_SCHEMA_V2 = void 0;
+exports.decodeShellJwsPayload = exports.openV11Commitment = exports.shellHolderVerdict = exports.holderDocumentFromOwnerView = exports.compareShellToJws = exports.shellFromHolder = exports.isReceiptShell = exports.issuerHistoryDocumentHash = exports.readIssuerHistoryPin = exports.isJsonInteger = exports.refusalPayloadVersion = exports.readSignedClaims = exports.formatSupportedReceiptVersions = exports.signedClaimsOnAllowlist = exports.classifyShellDocument = exports.legacyIdentityErrors = exports.classifySignedClaims = exports.classifyReceiptDocument = exports.VERSION_MISMATCH = exports.UNSUPPORTED_VERSION = exports.VERIFIER_MIN = exports.REFUSAL_EXACT_VERSIONS = exports.LEGACY_PAYLOAD_VERSIONS = exports.SUPPORTED_RECEIPT_VERSIONS = exports.CANONICAL_PAYLOAD_VERSION = exports.verifyCanonicalPreimageBytes = exports.compileAnchorWallets = exports.verifyAnchorWalletDocument = exports.verifyTreeHeadTrust = exports.headTrustedFromInclusion = exports.headOmitsPinnedSigner = exports.HEAD_TRUST_MESSAGES = exports.LEGACY_HEAD_UNPINNED_SIGNER = exports.ANCHOR_WALLET_SOURCES_NOT_CONSULTED = exports.PINNED_SOLANA_ANCHOR_FEE_PAYER = exports.PINNED_BASE_ANCHOR_WALLET = exports.ISSUER_PIN_CHAIN_REFUSED = exports.ISSUER_ROTATION_UNCONTROLLED = exports.ISSUER_PIN_MUTABLE_REF = exports.ISSUER_PIN_DOWNGRADE = exports.ISSUER_SELF_SIG_INVALID = exports.ISSUER_PIN_HASH_MISMATCH = exports.ISSUER_PIN_MISMATCH = exports.CITIZEN_FREEZE_PURPOSE = exports.CITIZEN_FREEZE_SCHEMA = exports.PUBLISHED_ISSUER_PIN_KID = exports.ISSUER_PIN_CHAIN_ID = exports.ISSUER_PIN_PATH = exports.ISSUER_PIN_SCHEMA = exports.ISSUER_PIN_VERSION = void 0;
+exports.INCLUDED_SHELL_LINE = exports.SHELL_SCHEMA = void 0;
+exports.canonicalPayloadVersion = canonicalPayloadVersion;
+exports.canonicalIssuerPayload = canonicalIssuerPayload;
+exports.sumUsdcTransfersToPayee = sumUsdcTransfersToPayee;
+exports.reconcileSettledTransfer = reconcileSettledTransfer;
+exports.verifyIssuerSignature = verifyIssuerSignature;
+exports.verifyIssuerSignatureWithJwks = verifyIssuerSignatureWithJwks;
+exports.verifyBinding = verifyBinding;
+exports.verifyNullifier = verifyNullifier;
+exports.hashCanonicalPayload = hashCanonicalPayload;
+exports.claimIdVerdict = claimIdVerdict;
+exports.diffOuterClaims = diffOuterClaims;
+exports.unsignedOuterFields = unsignedOuterFields;
+exports.loadIssuerJwks = loadIssuerJwks;
+exports.fetchIssuerJwks = fetchIssuerJwks;
+exports.receiptPayerClaims = receiptPayerClaims;
+exports.verifyReceiptUpToV10 = verifyReceiptUpToV10;
+exports.verifyReceipt = verifyReceipt;
+const ethers_1 = require("ethers");
+const anchor_witness_js_1 = require("./anchor-witness.js");
+const row_hash_js_1 = require("./row-hash.js");
+const carry_forward_js_1 = require("./carry-forward.js");
+const node_crypto_1 = require("node:crypto");
+const binding_js_1 = require("./binding.js");
+Object.defineProperty(exports, "computePaymentCommitment", { enumerable: true, get: function () { return binding_js_1.computePaymentCommitment; } });
+Object.defineProperty(exports, "computeInferenceBinding", { enumerable: true, get: function () { return binding_js_1.computeInferenceBinding; } });
+const base_payer_js_1 = require("./base-payer.js");
+Object.defineProperty(exports, "verifyBasePayer", { enumerable: true, get: function () { return base_payer_js_1.verifyBasePayer; } });
+Object.defineProperty(exports, "parseBasePaymentRef", { enumerable: true, get: function () { return base_payer_js_1.parseBasePaymentRef; } });
+Object.defineProperty(exports, "isEvmAddress", { enumerable: true, get: function () { return base_payer_js_1.isEvmAddress; } });
+Object.defineProperty(exports, "sumUsdcTransfersFromPayer", { enumerable: true, get: function () { return base_payer_js_1.sumUsdcTransfersFromPayer; } });
+Object.defineProperty(exports, "fetchBaseTransactionReceipt", { enumerable: true, get: function () { return base_payer_js_1.fetchBaseTransactionReceipt; } });
+Object.defineProperty(exports, "USDC_ADDRESSES", { enumerable: true, get: function () { return base_payer_js_1.USDC_ADDRESSES; } });
+Object.defineProperty(exports, "ERC20_TRANSFER_TOPIC", { enumerable: true, get: function () { return base_payer_js_1.ERC20_TRANSFER_TOPIC; } });
+Object.defineProperty(exports, "BASE_RPC_URL", { enumerable: true, get: function () { return base_payer_js_1.BASE_RPC_URL; } });
+const solana_payer_js_1 = require("./solana-payer.js");
+Object.defineProperty(exports, "verifySolanaPayer", { enumerable: true, get: function () { return solana_payer_js_1.verifySolanaPayer; } });
+Object.defineProperty(exports, "parseSolanaPaymentRef", { enumerable: true, get: function () { return solana_payer_js_1.parseSolanaPaymentRef; } });
+Object.defineProperty(exports, "isSolanaBase58Pubkey", { enumerable: true, get: function () { return solana_payer_js_1.isSolanaBase58Pubkey; } });
+Object.defineProperty(exports, "extractUsdcTransfersFromTx", { enumerable: true, get: function () { return solana_payer_js_1.extractUsdcTransfersFromTx; } });
+Object.defineProperty(exports, "inferUsdcOutflowFromBalances", { enumerable: true, get: function () { return solana_payer_js_1.inferUsdcOutflowFromBalances; } });
+Object.defineProperty(exports, "fetchSolanaTransaction", { enumerable: true, get: function () { return solana_payer_js_1.fetchSolanaTransaction; } });
+Object.defineProperty(exports, "SOLANA_RPC_URL", { enumerable: true, get: function () { return solana_payer_js_1.SOLANA_RPC_URL; } });
+Object.defineProperty(exports, "SOLANA_USDC_MINT_MAINNET", { enumerable: true, get: function () { return solana_payer_js_1.SOLANA_USDC_MINT_MAINNET; } });
+Object.defineProperty(exports, "SOLANA_USDC_MINT_DEVNET", { enumerable: true, get: function () { return solana_payer_js_1.SOLANA_USDC_MINT_DEVNET; } });
+const payer_js_1 = require("./payer.js");
+Object.defineProperty(exports, "verifyPayerBinding", { enumerable: true, get: function () { return payer_js_1.verifyPayerBinding; } });
+Object.defineProperty(exports, "receiptPayerClaimsFromEnvelope", { enumerable: true, get: function () { return payer_js_1.receiptPayerClaimsFromEnvelope; } });
+Object.defineProperty(exports, "decodeJwsPayload", { enumerable: true, get: function () { return payer_js_1.decodeJwsPayload; } });
+const v11_receipt_js_1 = require("./v11-receipt.js");
+const receipt_version_js_1 = require("./receipt-version.js");
+const jws_js_1 = require("./jws.js");
+const head_binding_js_1 = require("./head-binding.js");
+const receipt_lane_js_1 = require("./receipt-lane.js");
+const refusal_js_1 = require("./refusal.js");
+const preimage_js_1 = require("./preimage.js");
+const issuer_history_js_1 = require("./issuer-history.js");
+const canonical_preimage_js_1 = require("./canonical-preimage.js");
+const anchor_trust_js_1 = require("./anchor-trust.js");
+/** ZKVerifierSP1 contract on Base mainnet. */
+exports.ZK_VERIFIER_ADDRESS = '0x9373499645292715a2275A78eD65B14215C41c06';
+/** Base Sepolia testnet RPC. */
+exports.BASE_SEPOLIA_RPC_URL = 'https://sepolia.base.org';
+/** Minimal ABI for nullifier check. */
+const ZK_VERIFIER_ABI = [
+    'function usedNullifiers(bytes32) view returns (bool)',
+];
+/**
+ * HMAC payload version.
+ * Versions <= 7 keep the historical net/fee field list.
+ * Version 8 signs settled_amount plus the internal accounting breakdown.
+ * Lockstep with `canonicalPayloadVersion` in services/gateway/src/receipt.js
+ * for the v8 list (the v7 list here is the historical 15-field public formula).
+ */
+function canonicalPayloadVersion(receipt) {
+    const stamped = receipt.hmac_attestation?.payload_version
+        ?? receipt.signature?.payload_version;
+    if (stamped != null)
+        return Number(stamped);
+    const issuerV = receipt.issuer_signature?.payload_version;
+    if (issuerV != null)
+        return Number(issuerV);
+    const payment = receipt.payment;
+    if (payment?.accounting || (payment && Object.prototype.hasOwnProperty.call(payment, 'settled_amount'))) {
+        return 8;
+    }
+    return 7;
+}
+function canonicalFieldsV7(receipt) {
+    return [
+        receipt.task_id ?? null,
+        receipt.payment?.rail ?? null,
+        receipt.payment?.ref ?? null,
+        receipt.payment?.gross_amount ?? null,
+        receipt.payment?.net_amount ?? null,
+        receipt.payment?.fee_amount ?? null,
+        receipt.payment?.protocol_fee_bps ?? receipt.payment?.fee_bps ?? null,
+        receipt.payment?.platform_fee ?? null,
+        receipt.payment?.platform_fee_bps ?? null,
+        receipt.provider_cogs?.actual ?? null,
+        receipt.route?.model ?? null,
+        receipt.route?.model_commitment?.commitment ?? null,
+        receipt.route?.provider ?? null,
+        receipt.output?.hash ?? null,
+        receipt.binding?.expected_commitment ?? null,
+    ];
+}
+function canonicalFieldsV8(receipt) {
+    const breakdown = receipt.payment?.accounting?.internal_breakdown;
+    const caller = receipt.caller_binding;
+    return [
+        receipt.task_id ?? null,
+        receipt.payment?.rail ?? null,
+        receipt.payment?.ref ?? null,
+        receipt.payment?.gross_amount ?? null,
+        receipt.payment?.settled_amount ?? null,
+        breakdown?.route_margin_bps ?? null,
+        breakdown?.route_margin_amount ?? null,
+        breakdown?.receipt_floor_amount ?? null,
+        breakdown?.provider_cogs_amount ?? null,
+        breakdown?.tier2_proof_amount ?? null,
+        receipt.provider_cogs?.actual ?? null,
+        receipt.route?.model ?? null,
+        receipt.route?.model_commitment?.commitment ?? null,
+        receipt.route?.provider ?? null,
+        receipt.output?.hash ?? null,
+        receipt.binding?.expected_commitment ?? null,
+        caller?.payer_wallet ?? null,
+        caller?.agent_pubkey ?? null,
+        caller?.api_key_hash ?? null,
+    ];
+}
+/**
+ * Canonical, order-stable payload an HMAC issuer signature covers.
+ * v8 matches `canonicalSignedPayload` in services/gateway/src/receipt.js.
+ * v7 and earlier stay on the historical 15-field list so old signatures verify.
+ */
+function canonicalIssuerPayload(receipt) {
+    const fields = canonicalPayloadVersion(receipt) >= 8
+        ? canonicalFieldsV8(receipt)
+        : canonicalFieldsV7(receipt);
+    return JSON.stringify(fields);
+}
+function topicAddress(topic) {
+    const hex = topic.toLowerCase().replace(/^0x/, '');
+    return `0x${hex.slice(-40)}`;
+}
+/**
+ * Sum USDC Transfer values to `payee` in a transaction's logs.
+ * Non-Transfer logs are ignored. When `usdcAddress` is set, other contracts are ignored.
+ */
+function sumUsdcTransfersToPayee(logs, payee, usdcAddress) {
+    if (!payee || !(0, base_payer_js_1.isEvmAddress)(payee))
+        return null;
+    const payeeLower = payee.toLowerCase();
+    const usdcLower = usdcAddress?.toLowerCase();
+    let total = 0n;
+    let found = false;
+    for (const log of logs || []) {
+        if (usdcLower && log.address?.toLowerCase() !== usdcLower)
+            continue;
+        const topics = log.topics || [];
+        if (topics[0]?.toLowerCase() !== base_payer_js_1.ERC20_TRANSFER_TOPIC)
+            continue;
+        if (topics.length < 3 || !topics[2])
+            continue;
+        if (topicAddress(topics[2]) !== payeeLower)
+            continue;
+        found = true;
+        total += BigInt(log.data || '0x0');
+    }
+    return found ? total : null;
+}
+/**
+ * Payment facts for on-chain reconciliation.
+ * A JWS is used only after `verifyIssuerSignatureWithJwks` accepts the key.
+ * An untrusted or invalid JWS is not decoded into the comparison, and the
+ * unsigned outer `payment` copy is not a fallback for those claims.
+ * Receipts with no JWS still use the outer payment (legacy envelopes).
+ */
+function trustedPaymentForReconcile(receipt, options) {
+    const outerVersion = Number(receipt.issuer_signature?.payload_version ?? canonicalPayloadVersion(receipt));
+    const jws = receipt.issuer_signature?.jws;
+    if (!jws) {
+        return { ok: true, version: outerVersion, payment: receipt.payment || {} };
+    }
+    const verification = verifyIssuerSignatureWithJwks(receipt, options.jwks, {
+        trustedKids: options.trustedKids,
+    });
+    if (!verification.valid || verification.key_trusted === false) {
+        return {
+            ok: false,
+            version: 0,
+            reason: verification.reason || jws_js_1.KEY_UNTRUSTED,
+        };
+    }
+    const claims = verification.payload;
+    const claimPayment = (claims?.payment && typeof claims.payment === 'object')
+        ? claims.payment
+        : null;
+    if (!claimPayment) {
+        return { ok: false, version: 0, reason: 'no_signed_amount' };
+    }
+    // The signed payload is the version. The outer copy is not a fallback.
+    const signed = (0, receipt_version_js_1.classifySignedClaims)(claims && typeof claims === 'object' ? claims : null, null);
+    if (!signed.ok || signed.family !== 'legacy') {
+        return { ok: false, version: 0, reason: 'unsupported_version' };
+    }
+    return { ok: true, version: signed.version, payment: claimPayment };
+}
+/**
+ * Optional on-chain reconciliation. Given a tx receipt's logs, the signed
+ * amount the payee was supposed to receive must equal the USDC Transfer to payee.
+ *
+ * The amount and payee come from JWS claims only after a key-trust check
+ * (JWKS by kid, or an embedded key whose thumbprint is a pinned kid). An
+ * untrusted signature does not contribute those facts.
+ *
+ * v8 compares `settled_amount` (falling back to `gross_amount`): that is the
+ * on-chain transfer. v7 and earlier compare `net_amount`, which those receipts
+ * defined as "amount after fees". A single direct transfer of gross will not
+ * match a net that subtracts a fee that never moved on chain.
+ */
+function reconcileSettledTransfer(receipt, logs, options = {}) {
+    const trusted = trustedPaymentForReconcile(receipt, options);
+    if (!trusted.ok) {
+        return {
+            checked: false,
+            matches: false,
+            payload_version: trusted.version,
+            signed_field: null,
+            signed_amount: null,
+            transfer_amount: null,
+            payee: null,
+            reason: trusted.reason,
+        };
+    }
+    const { version, payment } = trusted;
+    const payee = payment.payee ?? null;
+    let signed_field = null;
+    let signed_amount = null;
+    if (version >= 8) {
+        if (payment.settled_amount != null && payment.settled_amount !== '') {
+            signed_field = 'settled_amount';
+            signed_amount = String(payment.settled_amount);
+        }
+        else if (payment.gross_amount != null && payment.gross_amount !== '') {
+            signed_field = 'gross_amount';
+            signed_amount = String(payment.gross_amount);
+        }
+    }
+    else {
+        signed_field = 'net_amount';
+        signed_amount = payment.net_amount != null ? String(payment.net_amount) : null;
+    }
+    if (!payee || !(0, base_payer_js_1.isEvmAddress)(payee)) {
+        return {
+            checked: false,
+            matches: false,
+            payload_version: version,
+            signed_field,
+            signed_amount,
+            transfer_amount: null,
+            payee,
+            reason: 'no_payee',
+        };
+    }
+    if (signed_amount == null) {
+        return {
+            checked: false,
+            matches: false,
+            payload_version: version,
+            signed_field,
+            signed_amount,
+            transfer_amount: null,
+            payee,
+            reason: 'no_signed_amount',
+        };
+    }
+    const transfer = sumUsdcTransfersToPayee(logs, payee, options.usdcAddress);
+    if (transfer == null) {
+        return {
+            checked: true,
+            matches: false,
+            payload_version: version,
+            signed_field,
+            signed_amount,
+            transfer_amount: null,
+            payee,
+            reason: 'no_transfer_to_payee',
+        };
+    }
+    const matches = BigInt(signed_amount) === transfer;
+    return {
+        checked: true,
+        matches,
+        payload_version: version,
+        signed_field,
+        signed_amount,
+        transfer_amount: transfer.toString(),
+        payee,
+        reason: matches
+            ? undefined
+            : `amount_mismatch: signed ${signed_field} ${signed_amount} !== transfer ${transfer.toString()}`,
+    };
+}
+/**
+ * Verify a receipt's ES256 issuer signature against a JWK (public key).
+ * This is the public-key verification path — no shared secret required.
+ *
+ * Verification steps:
+ *   1. GET /receipt/:taskId?format=json → receipt.issuer_signature
+ *   2. GET /.well-known/jwks.json → find key matching issuer_signature.kid
+ *   3. ES256 verify canonicalIssuerPayload(receipt) against the signature
+ *
+ * @param receipt - Receipt JSON with issuer_signature
+ * @param jwk - JWK public key { kty: 'EC', crv: 'P-256', x, y }
+ */
+function verifyIssuerSignature(receipt, jwk) {
+    const sig = receipt.issuer_signature;
+    if (!sig || !sig.value) {
+        return { checked: false, valid: false, reason: 'no_issuer_signature' };
+    }
+    if (sig.alg !== 'ES256') {
+        return { checked: false, valid: false, reason: `unsupported_alg: ${sig.alg}` };
+    }
+    if (!jwk || jwk.kty !== 'EC' || jwk.crv !== 'P-256') {
+        return { checked: false, valid: false, reason: 'invalid_jwk' };
+    }
+    if (sig.kid && jwk.kid && sig.kid !== jwk.kid) {
+        return { checked: false, valid: false, reason: 'kid_mismatch' };
+    }
+    try {
+        const jwkInput = { kty: jwk.kty, crv: jwk.crv, x: jwk.x, y: jwk.y };
+        const publicKey = (0, node_crypto_1.createPublicKey)({ key: jwkInput, format: 'jwk' });
+        const signature = Buffer.from(sig.value, 'base64url');
+        const payload = canonicalIssuerPayload(receipt);
+        const valid = (0, node_crypto_1.verify)('sha256', Buffer.from(payload, 'utf8'), {
+            key: publicKey,
+            dsaEncoding: 'ieee-p1363',
+        }, signature);
+        return { checked: true, valid, kid: sig.kid };
+    }
+    catch (err) {
+        return { checked: true, valid: false, kid: sig.kid, reason: `verify_error: ${err.message}` };
+    }
+}
+/**
+ * Verify a receipt's ES256 issuer signature against a JWKS (key set).
+ * Finds the matching key by kid and verifies.
+ *
+ * @param receipt - Receipt JSON with issuer_signature
+ * @param jwks - JWKS with keys array
+ */
+function jwksCandidates(jwks, kid) {
+    const keys = jwks?.keys || [];
+    const es256 = keys.filter((k) => (0, jws_js_1.isEs256PublicJwk)(k) && (k.alg == null || k.alg === 'ES256'));
+    if (!kid)
+        return es256;
+    return es256.filter((k) => k.kid === kid);
+}
+/**
+ * Verify an issuer signature against trusted keys only.
+ *
+ * Trust, in order:
+ *   1. A JWKS entry matched by `kid` (supplied file or fetched issuer JWKS).
+ *   2. An embedded `issuer_jwk` whose RFC 7638 thumbprint equals a pinned trusted kid.
+ *
+ * An embedded key that merely verifies the bytes is `key untrusted`.
+ */
+function verifyIssuerSignatureWithJwks(receipt, jwks, options = {}) {
+    const sig = receipt.issuer_signature;
+    if (!sig) {
+        return { checked: false, valid: false, key_trusted: false, reason: 'no_issuer_signature' };
+    }
+    const trustedKids = options.trustedKids ?? jws_js_1.DEFAULT_TRUSTED_ISSUER_KIDS;
+    const header = sig.jws ? (0, jws_js_1.readJwsHeader)(sig.jws) : null;
+    const kid = header?.kid || sig.kid;
+    const embedded = (0, jws_js_1.resolvePinnedIssuerJwk)(receipt);
+    const pinned = !!(embedded && (0, jws_js_1.isPinnedTrustedJwk)(embedded, trustedKids));
+    if (sig.jws) {
+        const fromJwks = jwksCandidates(jwks, kid);
+        for (const jwk of fromJwks) {
+            const jwsResult = (0, jws_js_1.verifyIssuerJws)(sig.jws, jwk);
+            if (jwsResult.valid) {
+                return {
+                    checked: true,
+                    valid: true,
+                    key_trusted: true,
+                    trust: 'jwks',
+                    kid: jwk.kid || kid,
+                    payload: jwsResult.payload,
+                };
+            }
+        }
+        if (pinned && embedded) {
+            const pinResult = (0, jws_js_1.verifyIssuerJws)(sig.jws, embedded);
+            if (pinResult.valid) {
+                return {
+                    checked: true,
+                    valid: true,
+                    key_trusted: true,
+                    trust: 'pinned_kid',
+                    kid: embedded.kid || (0, jws_js_1.jwkThumbprint)(embedded),
+                    payload: pinResult.payload,
+                };
+            }
+            return {
+                checked: true,
+                valid: false,
+                key_trusted: true,
+                kid: kid || embedded.kid,
+                reason: pinResult.reason || 'signature_invalid',
+            };
+        }
+        if (embedded && (0, jws_js_1.verifyIssuerJws)(sig.jws, embedded).valid) {
+            return {
+                checked: true,
+                valid: false,
+                key_trusted: false,
+                kid: embedded.kid || kid,
+                reason: jws_js_1.KEY_UNTRUSTED,
+            };
+        }
+        if (fromJwks.length === 0 && !pinned) {
+            return {
+                checked: true,
+                valid: false,
+                key_trusted: false,
+                kid,
+                reason: jws_js_1.KEY_UNTRUSTED,
+            };
+        }
+        return {
+            checked: true,
+            valid: false,
+            key_trusted: fromJwks.length > 0 || pinned,
+            kid,
+            reason: 'signature_invalid',
+        };
+    }
+    if (!sig.value) {
+        return { checked: false, valid: false, key_trusted: false, reason: 'no_issuer_signature' };
+    }
+    if (!jwks || !Array.isArray(jwks.keys)) {
+        return {
+            checked: false,
+            valid: false,
+            key_trusted: false,
+            kid: sig.kid,
+            reason: 'JWKS not provided — pass jwks option to verify issuer signature',
+        };
+    }
+    if (jwks.keys.length === 0) {
+        return { checked: false, valid: false, key_trusted: false, kid: sig.kid, reason: 'empty_jwks' };
+    }
+    // Find matching key by kid, or try all ES256 keys if no kid on signature
+    const candidates = sig.kid
+        ? jwks.keys.filter(k => k.kid === sig.kid && k.alg === 'ES256')
+        : jwks.keys.filter(k => k.alg === 'ES256');
+    if (candidates.length === 0) {
+        return { checked: false, valid: false, key_trusted: false, kid: sig.kid, reason: 'no_matching_key' };
+    }
+    for (const jwk of candidates) {
+        const result = verifyIssuerSignature(receipt, jwk);
+        if (result.valid) {
+            return { ...result, key_trusted: true, trust: 'jwks', kid: jwk.kid || sig.kid };
+        }
+    }
+    return { checked: true, valid: false, key_trusted: true, kid: sig.kid, reason: 'signature_invalid' };
+}
+/**
+ * Verify a receipt's payment binding locally (no network required).
+ *
+ * This recomputes the commitment from the receipt's fields and compares
+ * it to the stored `binding.expected_commitment`.
+ */
+function noCommitmentReason(rail) {
+    if (rail === 'unmetered' || rail === 'tfuel') {
+        return 'No binding present on receipt (unmetered or TFUEL rail)';
+    }
+    if (rail === 'usdc' || rail === 'reported') {
+        return 'No payment-binding commitment (expected_commitment is null)';
+    }
+    return 'No binding present on receipt (may be unmetered or TFUEL rail)';
+}
+function verifyBinding(receipt) {
+    const binding = receipt.binding;
+    const railHint = binding?.rail || receipt.payment?.rail || null;
+    if (!binding) {
+        return {
+            verified: false,
+            expected: null,
+            recomputed: null,
+            matches: false,
+            covers: [],
+            reason: noCommitmentReason(railHint),
+        };
+    }
+    if (binding.expected_commitment == null || binding.expected_commitment === '') {
+        return {
+            verified: false,
+            expected: null,
+            recomputed: null,
+            matches: false,
+            covers: binding.covers || [],
+            reason: noCommitmentReason(railHint),
+        };
+    }
+    const paymentRef = receipt.payment?.ref ?? null;
+    const taskId = receipt.task_id;
+    const rail = (binding.rail || receipt.payment?.rail || 'usdc');
+    const amount = binding.amount || receipt.payment?.net_amount || '0';
+    const covers = binding.covers || ['payment', 'settlement'];
+    // Determine if this is a PBR (includes model + output)
+    const bindsInference = covers.includes('inference') ||
+        !!(binding.model_commitment && binding.output_hash);
+    let recomputed;
+    try {
+        if (bindsInference) {
+            const result = (0, binding_js_1.computeInferenceBinding)({
+                paymentRef,
+                taskId,
+                rail,
+                amount,
+                modelCommitment: binding.model_commitment,
+                outputHash: binding.output_hash,
+            });
+            recomputed = result.commitment;
+        }
+        else {
+            const result = (0, binding_js_1.computePaymentCommitment)({
+                paymentRef,
+                taskId,
+                rail,
+                amount,
+            });
+            recomputed = result.commitment;
+        }
+    }
+    catch (err) {
+        return {
+            verified: false,
+            expected: binding.expected_commitment || null,
+            recomputed: null,
+            matches: false,
+            covers,
+            reason: `Failed to recompute commitment: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+    const expected = binding.expected_commitment || null;
+    const matches = !!(expected &&
+        recomputed &&
+        expected.toLowerCase() === recomputed.toLowerCase());
+    return {
+        verified: true,
+        expected,
+        recomputed,
+        matches,
+        covers,
+        reason: matches ? undefined : 'Commitment mismatch — receipt may be tampered',
+    };
+}
+/**
+ * Verify a receipt's nullifier is anchored on-chain.
+ *
+ * Requires network access to the Base RPC.
+ */
+async function verifyNullifier(receipt, options = {}) {
+    const nullifier = receipt.proof?.nullifier ?? null;
+    if (!nullifier) {
+        return {
+            verified: false,
+            nullifier: null,
+            anchored: null,
+            reason: 'No nullifier present (Tier-1 receipt or proof pending)',
+        };
+    }
+    if (!/^0x[0-9a-fA-F]{64}$/.test(nullifier)) {
+        return {
+            verified: false,
+            nullifier,
+            anchored: null,
+            reason: 'Invalid nullifier format',
+        };
+    }
+    const rpcUrl = options.rpcUrl || base_payer_js_1.BASE_RPC_URL;
+    const verifierAddress = options.verifierAddress || exports.ZK_VERIFIER_ADDRESS;
+    try {
+        const provider = new ethers_1.JsonRpcProvider(rpcUrl);
+        const contract = new ethers_1.Contract(verifierAddress, ZK_VERIFIER_ABI, provider);
+        const isUsed = await contract.usedNullifiers(nullifier);
+        return {
+            verified: true,
+            nullifier,
+            anchored: isUsed,
+            reason: isUsed ? undefined : 'Nullifier not found on-chain (proof may not be submitted yet)',
+        };
+    }
+    catch (err) {
+        return {
+            verified: false,
+            nullifier,
+            anchored: null,
+            reason: `Chain query failed: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+}
+/**
+ * Canonical signed payload for HMAC verification.
+ * Alias of canonicalIssuerPayload — both must produce identical bytes.
+ */
+exports.canonicalSignedPayload = canonicalIssuerPayload;
+/**
+ * Hash the canonical payload (for ERC-8004 response_hash).
+ */
+function hashCanonicalPayload(receipt) {
+    return (0, ethers_1.keccak256)((0, ethers_1.toUtf8Bytes)((0, exports.canonicalSignedPayload)(receipt)));
+}
+/**
+ * claim_id-era receipts include the key even when the value is null.
+ * Older payloads omit the key and stay valid.
+ */
+function claimIdVerdict(claims) {
+    if (!claims || !Object.prototype.hasOwnProperty.call(claims, 'claim_id')) {
+        return 'not_present_legacy';
+    }
+    const payment = asRecord(claims.payment);
+    const ref = payment?.ref;
+    const hasRef = ref != null && String(ref) !== '';
+    const id = claims.claim_id;
+    const missing = id == null || id === '';
+    if (hasRef && missing)
+        return 'refused';
+    return 'ok';
+}
+function claimString(value) {
+    if (value == null || value === '')
+        return null;
+    return String(value);
+}
+function asRecord(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return null;
+    return value;
+}
+function isPlain(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+function formatClaim(value) {
+    if (value == null)
+        return null;
+    if (typeof value === 'string')
+        return value;
+    if (typeof value === 'number' || typeof value === 'boolean')
+        return String(value);
+    return JSON.stringify(value);
+}
+/** 0x hex is compared case-insensitively. Checksum case is not a different claim. */
+function sameLeaf(signed, outer) {
+    if (Array.isArray(signed) || Array.isArray(outer)) {
+        return JSON.stringify(signed) === JSON.stringify(outer);
+    }
+    if (typeof signed === 'string' && typeof outer === 'string') {
+        if (/^0x[0-9a-fA-F]+$/.test(signed) && /^0x[0-9a-fA-F]+$/.test(outer)) {
+            return signed.toLowerCase() === outer.toLowerCase();
+        }
+        return signed === outer;
+    }
+    if (signed == null || outer == null)
+        return signed == null && outer == null;
+    return Object.is(signed, outer);
+}
+/**
+ * The outer receipt `schema` (`xfuel.receipt.v3`) is the document type.
+ * The JWS `schema` (`chit402.foreign_payout.v1`) is the payload type.
+ * They share a name and are not copies of each other.
+ */
+function schemaIsNotACopy(path) {
+    return path === 'schema';
+}
+function compareSignedNode(signed, outer, prefix, mismatches) {
+    if (!isPlain(signed))
+        return;
+    if (!isPlain(outer)) {
+        mismatches.push({
+            field: prefix || '$',
+            outer: formatClaim(outer),
+            signed: formatClaim(signed),
+        });
+        return;
+    }
+    for (const key of Object.keys(signed)) {
+        const path = prefix ? `${prefix}.${key}` : key;
+        if (schemaIsNotACopy(path))
+            continue;
+        if (!Object.prototype.hasOwnProperty.call(outer, key))
+            continue;
+        const sv = signed[key];
+        const ov = outer[key];
+        if (isPlain(sv) && isPlain(ov)) {
+            compareSignedNode(sv, ov, path, mismatches);
+            continue;
+        }
+        if (!sameLeaf(sv, ov)) {
+            mismatches.push({ field: path, outer: formatClaim(ov), signed: formatClaim(sv) });
+        }
+    }
+}
+/**
+ * Walk every signed claim. When the outer receipt has the same path, the
+ * values must match, including null against a filled-in outer copy. A path
+ * the outer receipt omits is not a copy, so it is not a mismatch.
+ */
+function diffOuterClaims(receipt, claims) {
+    if (!claims)
+        return [];
+    const mismatches = [];
+    compareSignedNode(claims, receipt, '', mismatches);
+    return mismatches;
+}
+function pushUnsignedLeaves(value, path, paths) {
+    if (isPlain(value)) {
+        const keys = Object.keys(value).sort();
+        if (keys.length === 0) {
+            paths.push(path);
+            return;
+        }
+        for (const key of keys)
+            pushUnsignedLeaves(value[key], `${path}.${key}`, paths);
+        return;
+    }
+    paths.push(path);
+}
+function collectUnsigned(outer, signed, prefix, paths) {
+    if (!isPlain(outer))
+        return;
+    const signedObj = isPlain(signed) ? signed : null;
+    for (const key of Object.keys(outer).sort()) {
+        const path = prefix ? `${prefix}.${key}` : key;
+        // The signature container is the credential that was checked, not an unsigned claim.
+        if (!prefix && key === 'issuer_signature')
+            continue;
+        const signedHas = !!signedObj && Object.prototype.hasOwnProperty.call(signedObj, key);
+        if (!signedHas || schemaIsNotACopy(path)) {
+            pushUnsignedLeaves(outer[key], path, paths);
+            continue;
+        }
+        const sv = signedObj[key];
+        if (isPlain(outer[key]) && isPlain(sv))
+            collectUnsigned(outer[key], sv, path, paths);
+    }
+}
+/** Outer paths the signed claims do not cover. Sorted. Not a failure by themselves. */
+function unsignedOuterFields(receipt, claims) {
+    const paths = [];
+    collectUnsigned(receipt, claims, '', paths);
+    return paths;
+}
+function receiptViewFromClaims(receipt, claims) {
+    const payment = asRecord(claims.payment);
+    const binding = asRecord(claims.binding);
+    const route = asRecord(claims.route);
+    const output = asRecord(claims.output);
+    const caller = asRecord(claims.caller_binding);
+    const modelCommitment = claimString(route?.model_commitment);
+    return {
+        ...receipt,
+        task_id: claimString(claims.task_id) || receipt.task_id,
+        payment: {
+            rail: claimString(payment?.rail) ?? undefined,
+            ref: claimString(payment?.ref),
+            gross_amount: claimString(payment?.gross_amount),
+            settled_amount: claimString(payment?.settled_amount),
+            net_amount: claimString(payment?.net_amount),
+            asset: claimString(payment?.asset),
+            payee: claimString(payment?.payee),
+            fee_amount: claimString(payment?.fee_amount),
+            protocol_fee_bps: typeof payment?.protocol_fee_bps === 'number' ? payment.protocol_fee_bps : null,
+            platform_fee: claimString(payment?.platform_fee),
+            platform_fee_bps: typeof payment?.platform_fee_bps === 'number' ? payment.platform_fee_bps : null,
+        },
+        route: {
+            model: claimString(route?.model) ?? undefined,
+            provider: claimString(route?.provider) ?? undefined,
+            model_commitment: modelCommitment ? { commitment: modelCommitment } : null,
+        },
+        output: output?.hash ? { hash: claimString(output.hash) ?? undefined } : null,
+        caller_binding: caller
+            ? {
+                payer_wallet: claimString(caller.payer_wallet),
+                agent_pubkey: claimString(caller.agent_pubkey),
+                api_key_hash: claimString(caller.api_key_hash),
+            }
+            : null,
+        provider_cogs: asRecord(claims.provider_cogs)?.actual != null
+            ? { actual: claimString(asRecord(claims.provider_cogs)?.actual) ?? undefined }
+            : receipt.provider_cogs,
+        binding: {
+            expected_commitment: binding && 'expected_commitment' in binding
+                ? (claimString(binding.expected_commitment) ?? undefined)
+                : undefined,
+            amount: claimString(binding?.amount)
+                || claimString(payment?.net_amount)
+                || claimString(payment?.gross_amount)
+                || '0',
+            rail: claimString(binding?.rail) || claimString(payment?.rail) || undefined,
+            covers: Array.isArray(binding?.covers) ? binding.covers : ['payment', 'settlement'],
+            model_commitment: claimString(binding?.model_commitment) || modelCommitment,
+            output_hash: claimString(binding?.output_hash) || claimString(output?.hash),
+        },
+    };
+}
+function payerClaimsFromPayload(payload) {
+    const payment = asRecord(payload.payment);
+    const caller = asRecord(payload.caller_binding);
+    return {
+        payment: {
+            ref: claimString(payment?.ref),
+            gross_amount: claimString(payment?.gross_amount),
+            payee: claimString(payment?.payee),
+            asset: claimString(payment?.asset),
+            rail: claimString(payment?.rail),
+        },
+        caller_binding: caller ? { payer_wallet: claimString(caller.payer_wallet) } : null,
+    };
+}
+function factsFromClaims(claims) {
+    if (!claims) {
+        return { hub: null, model: null, amount_usdc: null, tx: null, output_hash: null };
+    }
+    const payment = asRecord(claims.payment);
+    const route = asRecord(claims.route);
+    const output = asRecord(claims.output);
+    return {
+        hub: claimString(route?.provider),
+        model: claimString(route?.model),
+        amount_usdc: claimString(payment?.gross_amount),
+        tx: claimString(payment?.ref),
+        output_hash: claimString(output?.hash),
+    };
+}
+function issuerJwksUri(receipt) {
+    const fromVerification = receipt?.verification?.jwks_uri;
+    if (typeof fromVerification === 'string' && fromVerification.startsWith('https://'))
+        return fromVerification;
+    const jws = receipt?.issuer_signature?.jws;
+    const header = jws ? (0, jws_js_1.readJwsHeader)(jws) : null;
+    if (header?.jku && header.jku.startsWith('https://'))
+        return header.jku;
+    return null;
+}
+function httpsUrl(uri) {
+    try {
+        return new URL(uri).protocol === 'https:';
+    }
+    catch {
+        return false;
+    }
+}
+function mergeJwks(primary, extra) {
+    const keys = [...(primary?.keys || []), ...(extra?.keys || [])];
+    if (keys.length === 0)
+        return undefined;
+    const seen = new Set();
+    const deduped = [];
+    for (const key of keys) {
+        const id = `${key.kid || ''}:${key.x || ''}:${key.y || ''}`;
+        if (seen.has(id))
+            continue;
+        seen.add(id);
+        deduped.push(key);
+    }
+    return { keys: deduped };
+}
+/**
+ * Key sources shared by receipt verification and the epoch-record check:
+ * a caller-supplied JWKS, `--jwks-url` (any https URL), and `--fetch-jwks`
+ * from an allowlisted host. A failed fetch is an error. It does not add a key.
+ */
+async function loadIssuerJwks(source, options = {}) {
+    const errors = [];
+    let jwks = options.jwks;
+    const trustedHosts = options.trustedJwksHosts ?? jws_js_1.DEFAULT_TRUSTED_JWKS_HOSTS;
+    if (options.jwksUri || options.fetchJwks) {
+        const uri = options.jwksUri || issuerJwksUri(source);
+        const allowed = !!uri && (options.jwksUri ? httpsUrl(uri) : (0, jws_js_1.jwksHostAllowed)(uri, trustedHosts));
+        if (uri && allowed) {
+            try {
+                const fetched = await fetchIssuerJwks(uri, options.fetchImpl);
+                jwks = mergeJwks(jwks, fetched);
+            }
+            catch (err) {
+                errors.push(`JWKS fetch failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+        else if (options.jwksUri) {
+            errors.push('JWKS URI rejected — only https URLs are fetched');
+        }
+        else if (options.fetchJwks && uri) {
+            errors.push(`JWKS host untrusted: ${uri}`);
+        }
+    }
+    return { jwks, errors };
+}
+/** Fetch a JWKS document. Caller decides whether the URL is a trust root. */
+async function fetchIssuerJwks(uri, fetchImpl = globalThis.fetch) {
+    if (!httpsUrl(uri))
+        throw new Error('jwks_uri must be https');
+    const res = await fetchImpl(uri);
+    if (!res.ok)
+        throw new Error(`jwks_fetch_failed: ${res.status}`);
+    const body = await res.json();
+    if (!body || !Array.isArray(body.keys))
+        throw new Error('jwks_malformed');
+    return body;
+}
+/**
+ * Full receipt verification — trusted issuer signature, signed-claim facts,
+ * optional on-chain payer and nullifier checks.
+ *
+ * Facts (amount, payer, payee, asset, tx, model) are taken only from a JWS
+ * that verified under a trusted key. The embedded `issuer_jwk` is not trusted
+ * unless its RFC 7638 thumbprint is a pinned kid, or the same key is in a JWKS.
+ */
+/** Extract JWS claims for payer binding. Prefers the JWS payload over the outer copy. */
+function receiptPayerClaims(receipt) {
+    return (0, payer_js_1.receiptPayerClaimsFromEnvelope)(receipt);
+}
+function normalizeBoundRoot(root) {
+    if (root == null || root === '')
+        return null;
+    const hex = String(root).replace(/^0x/i, '').toLowerCase();
+    return /^[0-9a-f]{64}$/.test(hex) ? hex : null;
+}
+/**
+ * Row hash for an offline leaf. Null and `''` are missing: do not hash `task_id|`.
+ */
+function inclusionRow(receipt, inclusion) {
+    const bound = (0, row_hash_js_1.boundRowHash)(receipt, inclusion);
+    if (!bound.ok)
+        return bound;
+    if (bound.row == null || bound.row === '')
+        return { ok: false, reason: 'no_leaf' };
+    return { ok: true, row: bound.row };
+}
+/**
+ * Bind a supplied inclusion proof to its leaf index and tree size.
+ * The head's size, when present, has to be the inclusion's size.
+ */
+function offlineInclusionBound(receipt, head, inclusion) {
+    const index = inclusion.leaf_index;
+    const size = inclusion.tree_size ?? head?.tree_size;
+    if (head?.tree_size != null && inclusion.tree_size != null
+        && Number(head.tree_size) !== Number(inclusion.tree_size)) {
+        return { ok: false, reason: 'tree_size_mismatch' };
+    }
+    if (index == null || size == null || !Array.isArray(inclusion.proof)) {
+        return { ok: false, reason: 'inclusion_failed' };
+    }
+    const root = normalizeBoundRoot(head?.root) || normalizeBoundRoot(inclusion.root);
+    if (!root)
+        return { ok: false, reason: 'bad_root' };
+    if (receipt.task_id == null)
+        return { ok: false, reason: 'missing_task_id' };
+    const bound = inclusionRow(receipt, inclusion);
+    if (!bound.ok)
+        return bound;
+    const leaf = (0, anchor_witness_js_1.leafHash)(Buffer.from(`${receipt.task_id}|${bound.row}`));
+    if (typeof inclusion.leaf === 'string' && /^[0-9a-fA-F]{64}$/.test(inclusion.leaf)
+        && inclusion.leaf.toLowerCase() !== leaf.toString('hex')) {
+        return { ok: false, reason: 'leaf_mismatch' };
+    }
+    const included = (0, anchor_witness_js_1.verifyMerkleInclusion)(leaf, Number(index), Number(size), root, inclusion.proof);
+    return included ? { ok: true } : { ok: false, reason: 'inclusion_failed' };
+}
+/**
+ * `{ root }` and `{ root, tree_size }` only compare a signed tree_head_hash.
+ * Any other supplied head is an offline tree-head witness and needs a signature.
+ */
+function offlineHeadNeedsSignature(head) {
+    if (!head || typeof head !== 'object')
+        return false;
+    return Object.keys(head).some((key) => key !== 'root' && key !== 'tree_size');
+}
+function suppliedHeadCovers(receipt, signedRoot, head, inclusion) {
+    const signed = normalizeBoundRoot(signedRoot);
+    const supplied = normalizeBoundRoot(head?.root);
+    if (!signed || !supplied)
+        return false;
+    if (signed === supplied)
+        return true;
+    if (!inclusion || !Array.isArray(inclusion.proof) || inclusion.leaf_index == null)
+        return true;
+    if (receipt.task_id == null)
+        return false;
+    const bound = inclusionRow(receipt, inclusion);
+    if (!bound.ok)
+        return false;
+    const leaf = (0, anchor_witness_js_1.leafHash)(Buffer.from(`${receipt.task_id}|${bound.row}`));
+    if (typeof inclusion.leaf === 'string' && /^[0-9a-fA-F]{64}$/.test(inclusion.leaf)
+        && inclusion.leaf.toLowerCase() !== leaf.toString('hex')) {
+        return false;
+    }
+    const size = inclusion.tree_size ?? head.tree_size;
+    if (size == null || !Number.isInteger(Number(size)))
+        return false;
+    return (0, anchor_witness_js_1.verifyMerkleInclusion)(leaf, Number(inclusion.leaf_index), Number(size), supplied, inclusion.proof);
+}
+/** v1–v10 verifier. A v11 payload is `unsupported_version` and is not checked as v10. */
+async function verifyReceiptUpToV10(receipt, options = {}) {
+    return (0, v11_receipt_js_1.verifyReceiptUpToV10)(receipt, options, verifyReceipt);
+}
+async function verifyReceipt(receipt, options = {}) {
+    let gate;
+    try {
+        gate = (0, receipt_version_js_1.classifyReceiptDocument)(receipt);
+    }
+    catch {
+        return (0, v11_receipt_js_1.rejectReceiptVersion)(receipt, ['unsupported_version'], 'unsupported_version');
+    }
+    const identityErrors = (0, receipt_version_js_1.legacyIdentityErrors)(receipt);
+    if (identityErrors.length) {
+        return (0, v11_receipt_js_1.rejectReceiptVersion)(receipt, identityErrors, identityErrors[0]);
+    }
+    if (!gate.ok) {
+        return (0, v11_receipt_js_1.rejectReceiptVersion)(receipt, gate.errors, gate.reason);
+    }
+    if (gate.family === 'v11') {
+        const v11 = await (0, v11_receipt_js_1.verifyV11Receipt)(receipt, options);
+        return Object.assign(v11, { receipt_version: 11, version_source: 'signed' });
+    }
+    const versionStamp = gate.family === 'legacy'
+        ? { receipt_version: gate.version, version_source: gate.version_source }
+        : {};
+    const errors = [];
+    const trustedKids = options.trustedKids ?? jws_js_1.DEFAULT_TRUSTED_ISSUER_KIDS;
+    const trustedHosts = options.trustedJwksHosts ?? jws_js_1.DEFAULT_TRUSTED_JWKS_HOSTS;
+    const loadedKeys = await loadIssuerJwks(receipt, {
+        jwks: options.jwks,
+        jwksUri: options.jwksUri,
+        fetchJwks: options.fetchJwks,
+        trustedJwksHosts: trustedHosts,
+        fetchImpl: options.fetchImpl,
+    });
+    const jwks = loadedKeys.jwks;
+    errors.push(...loadedKeys.errors);
+    let issuer_signature;
+    if (receipt.issuer_signature?.jws || receipt.issuer_signature?.value) {
+        issuer_signature = verifyIssuerSignatureWithJwks(receipt, jwks, { trustedKids });
+        if (issuer_signature.checked && !issuer_signature.valid) {
+            errors.push(issuer_signature.reason === jws_js_1.KEY_UNTRUSTED
+                ? jws_js_1.KEY_UNTRUSTED
+                : `Issuer signature invalid: ${issuer_signature.reason}`);
+        }
+    }
+    else if (receipt.issuer_signature) {
+        issuer_signature = {
+            checked: false,
+            valid: false,
+            key_trusted: false,
+            kid: receipt.issuer_signature.kid,
+            reason: 'JWKS not provided — pass jwks option to verify issuer signature',
+        };
+    }
+    else {
+        issuer_signature = {
+            checked: false,
+            valid: false,
+            key_trusted: false,
+            reason: 'No issuer signature present on receipt',
+        };
+    }
+    const decoded = receipt.issuer_signature?.jws
+        ? (0, payer_js_1.decodeJwsPayload)(receipt.issuer_signature.jws)
+        : null;
+    const claim_mismatches = diffOuterClaims(receipt, decoded);
+    const unsigned_fields = unsignedOuterFields(receipt, decoded);
+    for (const mismatch of claim_mismatches) {
+        errors.push(`outer/signed mismatch: ${mismatch.field} (outer ${mismatch.outer}, signed ${mismatch.signed})`);
+    }
+    const verifiedClaims = issuer_signature.valid ? issuer_signature.payload : undefined;
+    const claim_id = claimIdVerdict(issuer_signature.valid ? verifiedClaims : decoded);
+    if (issuer_signature.valid && claim_id === 'refused') {
+        errors.push('payment.ref is set and claim_id is null');
+    }
+    const headVerdict = (0, head_binding_js_1.headBindingVerdict)(issuer_signature.valid ? verifiedClaims : null);
+    const headMissing = headVerdict === 'missing';
+    if (headMissing) {
+        errors.push('payload v9 requires tree_head_hash and tolerance inside signed claims');
+    }
+    const signedBinding = headVerdict === 'ok' ? (0, head_binding_js_1.signedHeadBinding)(verifiedClaims) : null;
+    // A published head may differ from the signed prefix. That is not a failure.
+    // An inclusion proof, when one is supplied, must be for this receipt's leaf
+    // (`task_id|row_hash`), not an arbitrary hash already in the tree.
+    // A head inside the inclusion is a summary. It counts only when its JWS
+    // verifies under JWKS or a pinned kid. A key carried beside that JWS is
+    // not a trust root. A caller-supplied head wins.
+    const witnessHead = (options.head
+        ?? (0, anchor_trust_js_1.headTrustedFromInclusion)(options.inclusion, { jwks, trustedKids })
+        ?? null);
+    let headMismatch = false;
+    let sizeMismatch = false;
+    if (witnessHead && options.inclusion
+        && witnessHead.tree_size != null
+        && options.inclusion.tree_size != null
+        && Number(witnessHead.tree_size) !== Number(options.inclusion.tree_size)) {
+        sizeMismatch = true;
+        errors.push('tree_size_mismatch');
+    }
+    else if (signedBinding?.tree_head_hash && witnessHead?.root && options.inclusion) {
+        if (!suppliedHeadCovers(receipt, signedBinding.tree_head_hash, witnessHead, options.inclusion)) {
+            headMismatch = true;
+            errors.push('tree_head_mismatch');
+        }
+    }
+    const issuedAt = (verifiedClaims && 'iat' in verifiedClaims ? verifiedClaims.iat : null)
+        ?? decoded?.iat
+        ?? receipt.created_at
+        ?? null;
+    const historyPin = (0, issuer_history_js_1.readIssuerHistoryPin)(verifiedClaims);
+    const payloadVersion = Number(verifiedClaims?.payload_version);
+    // Payload v10 signs the history pin. A missing pin fails even when the
+    // caller did not pass a history file or ask for a fetch.
+    const pinRequired = !options.skipIssuerHistory
+        && Number.isFinite(payloadVersion)
+        && payloadVersion >= canonical_preimage_js_1.CANONICAL_PAYLOAD_VERSION;
+    const historyAsked = pinRequired || (!options.skipIssuerHistory && !!(options.issuerHistory
+        || options.issuerHistoryBytes
+        || options.fetchIssuerHistory
+        || options.strictIssuerHistory
+        || options.issuerHistoryUrl
+        || historyPin));
+    const issuer_history = historyAsked
+        ? await (0, issuer_history_js_1.checkReceiptIssuerHistory)(receipt, {
+            document: options.issuerHistory ?? null,
+            documentBytes: options.issuerHistoryBytes ?? null,
+            fetchHistory: options.fetchIssuerHistory === true || options.strictIssuerHistory === true,
+            strict: options.strictIssuerHistory === true,
+            historyUrl: options.issuerHistoryUrl ?? null,
+            jwks,
+            trustedKids,
+            fetchImpl: options.fetchImpl,
+            trustedHosts,
+            issuedAt,
+            kid: issuer_signature.kid ?? receipt.issuer_signature?.kid ?? null,
+            pin: historyPin,
+            requirePin: pinRequired,
+        })
+        : {
+            checked: false,
+            ok: true,
+            unreachable: false,
+            warning: null,
+            reason: null,
+            kid: issuer_signature.kid ?? receipt.issuer_signature?.kid ?? null,
+            document: null,
+            loaded: false,
+        };
+    // Offline: a tree-head witness is trusted only when its ES256 signature
+    // covers the outer size, root, and the other fields anchor mode already
+    // compares. A missing signature is head_signature_missing. The history
+    // body loaded above is the one this check trusts. Chain RPC is not used.
+    let headTrustFailed = false;
+    const suppliedHead = witnessHead;
+    if (offlineHeadNeedsSignature(suppliedHead)) {
+        const trust = (0, anchor_trust_js_1.verifyTreeHeadTrust)(suppliedHead, {
+            jwks,
+            trustedKids,
+            issuerHistory: issuer_history.document,
+            strictIssuerHistory: options.strictIssuerHistory === true,
+        });
+        if (!trust.ok) {
+            headTrustFailed = true;
+            errors.push(trust.reason || 'head_signature_invalid');
+        }
+        else if (issuer_history.loaded && !issuer_history.document) {
+            headTrustFailed = true;
+            errors.push('issuer_history_invalid');
+        }
+    }
+    let inclusionFailed = false;
+    if (!sizeMismatch && options.inclusion && (options.inclusion.proof || options.inclusion.leaf_index != null)) {
+        const bound = offlineInclusionBound(receipt, witnessHead, options.inclusion);
+        if (!bound.ok) {
+            inclusionFailed = true;
+            errors.push(bound.reason);
+        }
+    }
+    let binding;
+    if (receipt.issuer_signature?.jws) {
+        if (verifiedClaims) {
+            binding = verifyBinding(receiptViewFromClaims(receipt, verifiedClaims));
+        }
+        else {
+            binding = {
+                verified: false,
+                expected: null,
+                recomputed: null,
+                matches: false,
+                covers: [],
+                reason: issuer_signature.reason === jws_js_1.KEY_UNTRUSTED
+                    ? 'Binding not checked — issuer key untrusted'
+                    : 'Binding not checked — issuer signature not verified',
+            };
+        }
+    }
+    else {
+        binding = verifyBinding(receipt);
+    }
+    if (!binding.matches && binding.expected) {
+        errors.push('Payment binding mismatch');
+    }
+    const signedPayerClaims = verifiedClaims ? payerClaimsFromPayload(verifiedClaims) : null;
+    let payer;
+    if (options.checkPayer) {
+        if (!signedPayerClaims) {
+            payer = {
+                checked: false,
+                valid: false,
+                reason: 'Payer facts come from verified signed claims — issuer signature is not trusted',
+            };
+        }
+        else {
+            const payerResult = await (0, payer_js_1.verifyPayerBinding)(signedPayerClaims, {
+                rpcUrl: options.rpcUrl,
+                solanaRpcUrl: options.solanaRpcUrl,
+                fetchSolanaTransaction: options.fetchSolanaTransaction,
+                fetchBaseReceipt: options.fetchBaseReceipt,
+            });
+            payer = {
+                checked: payerResult.checked,
+                valid: payerResult.valid,
+                rail: payerResult.rail,
+                reason: payerResult.reason,
+                payer_wallet: payerResult.payerWallet ?? signedPayerClaims.caller_binding?.payer_wallet ?? null,
+                payee: signedPayerClaims.payment?.payee ?? null,
+                asset: signedPayerClaims.payment?.asset ?? null,
+                amount: payerResult.expectedAmount ?? signedPayerClaims.payment?.gross_amount ?? null,
+            };
+            if (payerResult.checked && !payerResult.valid) {
+                errors.push(`Payer binding mismatch: ${payerResult.reason}`);
+            }
+        }
+    }
+    else if (signedPayerClaims?.caller_binding?.payer_wallet && signedPayerClaims.payment?.ref) {
+        payer = {
+            checked: false,
+            valid: false,
+            payer_wallet: signedPayerClaims.caller_binding.payer_wallet,
+            payee: signedPayerClaims.payment.payee ?? null,
+            asset: signedPayerClaims.payment.asset ?? null,
+            amount: signedPayerClaims.payment.gross_amount ?? null,
+            reason: 'On-chain payer check not requested — pass checkPayer: true',
+        };
+    }
+    else if (!receipt.issuer_signature?.jws && receipt.caller_binding?.payer_wallet && receipt.payment?.ref) {
+        payer = {
+            checked: false,
+            valid: false,
+            reason: 'On-chain payer check not requested — pass checkPayer: true',
+        };
+    }
+    else if (receipt.issuer_signature?.jws && !issuer_signature.valid) {
+        payer = {
+            checked: false,
+            valid: false,
+            reason: 'Payer facts come from verified signed claims — issuer signature is not trusted',
+        };
+    }
+    else {
+        payer = {
+            checked: false,
+            valid: false,
+            reason: 'No payer_wallet or payment.ref to verify',
+        };
+    }
+    let nullifier;
+    if (options.checkNullifier && receipt.proof?.nullifier) {
+        nullifier = await verifyNullifier(receipt, {
+            rpcUrl: options.rpcUrl,
+            verifierAddress: options.verifierAddress,
+        });
+        if (nullifier.verified && nullifier.anchored === false) {
+            errors.push('Nullifier not anchored on-chain');
+        }
+    }
+    else {
+        nullifier = {
+            verified: false,
+            nullifier: receipt.proof?.nullifier ?? null,
+            anchored: null,
+            reason: options.checkNullifier
+                ? 'No nullifier present'
+                : 'On-chain check not requested',
+        };
+    }
+    const facts = factsFromClaims(verifiedClaims);
+    const warnings = [];
+    const preimages = await (0, preimage_js_1.verifyPublishedPreimages)(receipt, {
+        requirePreimages: options.requirePreimages === true,
+        fetchImpl: options.fetchImpl,
+        trustedHosts,
+    });
+    if (!preimages.ok)
+        errors.push(...preimages.errors);
+    const signedPayloadHash = verifiedClaims && 'payload_hash' in verifiedClaims
+        ? verifiedClaims.payload_hash
+        : null;
+    const storedPreimage = typeof receipt.issuer_signature?.canonical_preimage === 'string'
+        ? receipt.issuer_signature.canonical_preimage
+        : null;
+    let canonicalPreimageFailed = false;
+    if (storedPreimage != null) {
+        const storedCheck = (0, canonical_preimage_js_1.verifyCanonicalPreimageBytes)(storedPreimage, signedPayloadHash);
+        if (!storedCheck.ok) {
+            canonicalPreimageFailed = true;
+            if (storedCheck.reason)
+                errors.push(`canonical preimage: ${storedCheck.reason}`);
+        }
+    }
+    if (typeof options.canonicalPreimage === 'string') {
+        const fileCheck = (0, canonical_preimage_js_1.verifyCanonicalPreimageBytes)(options.canonicalPreimage, signedPayloadHash);
+        if (!fileCheck.ok) {
+            canonicalPreimageFailed = true;
+            if (fileCheck.reason)
+                errors.push(`canonical preimage: ${fileCheck.reason}`);
+        }
+    }
+    if (issuer_history.warning)
+        warnings.push(issuer_history.warning);
+    if (issuer_history.checked && !issuer_history.ok && issuer_history.reason) {
+        errors.push(`issuer history: ${issuer_history.reason}`);
+    }
+    const hasIssuerSig = !!receipt.issuer_signature;
+    const jwksWasSupplied = !!(options.jwks || options.jwksUri || (options.fetchJwks && jwks));
+    const claimRefused = issuer_signature.valid && claim_id === 'refused';
+    const signatureFailed = hasIssuerSig && !issuer_signature.valid && (!!issuer_signature.checked
+        || jwksWasSupplied
+        || issuer_signature.reason === jws_js_1.KEY_UNTRUSTED
+        || issuer_signature.reason === 'no_matching_key'
+        || issuer_signature.reason === 'empty_jwks');
+    const mismatchFailed = claim_mismatches.length > 0;
+    const bindingFailed = !!(binding.expected && !binding.matches);
+    const payerFailed = !!(options.checkPayer && payer.checked && !payer.valid);
+    const nullifierFailed = !!(options.checkNullifier
+        && receipt.proof?.nullifier
+        && nullifier.anchored === false);
+    const signatureUnchecked = hasIssuerSig && !issuer_signature.checked;
+    let overall;
+    const preimageFailed = !preimages.ok;
+    const historyFailed = issuer_history.checked && !issuer_history.ok;
+    if (signatureFailed || mismatchFailed || bindingFailed || payerFailed || nullifierFailed || claimRefused || headMissing || headMismatch || sizeMismatch || headTrustFailed || inclusionFailed || preimageFailed || historyFailed || canonicalPreimageFailed) {
+        overall = 'failed';
+    }
+    else if (signatureUnchecked) {
+        overall = 'partial';
+    }
+    else if (!binding.expected && !hasIssuerSig && !options.checkPayer) {
+        overall = 'partial';
+    }
+    else if ((binding.matches || !binding.expected)
+        && (!options.checkPayer || payer.valid)
+        && (!options.checkNullifier || !receipt.proof?.nullifier || nullifier.anchored === true)
+        && (issuer_signature.valid || !hasIssuerSig)) {
+        overall = 'verified';
+    }
+    else {
+        overall = 'partial';
+    }
+    // A refusal is a different document. Recognition uses the signed JWS
+    // schema, not only the unsigned outer schema. A valid issuer signature
+    // here must not be reported as a verified payment.
+    const verifiedSchema = typeof verifiedClaims?.schema === 'string' ? verifiedClaims.schema : null;
+    if (verifiedSchema === refusal_js_1.REFUSAL_SCHEMA || (0, refusal_js_1.isRefusalDocument)(receipt)) {
+        errors.push('refusal document is not a payment receipt');
+        overall = 'failed';
+    }
+    let carry_forward;
+    if (options.carry) {
+        const bound = (0, row_hash_js_1.boundRowHash)(receipt, { row_hash: options.carry.row_hash });
+        const leaf = !bound.ok || bound.row == null || bound.row === '' || receipt.task_id == null
+            ? null
+            : (0, anchor_witness_js_1.leafHash)(Buffer.from(`${receipt.task_id}|${bound.row}`));
+        const verdict = !bound.ok
+            ? { applicable: true, ok: false, status: null, reason: bound.reason }
+            : (bound.row == null || bound.row === '')
+                ? { applicable: true, ok: false, status: null, reason: 'row_hash_missing' }
+                : leaf
+                    ? (0, carry_forward_js_1.verifyCarryForward)({
+                        leaf,
+                        oldHead: options.carry.oldHead,
+                        oldInclusion: options.carry.oldInclusion,
+                        currentHead: options.carry.currentHead,
+                        currentInclusions: options.carry.currentInclusions,
+                        trustedKids,
+                        jwks,
+                    })
+                    : { applicable: true, ok: false, status: null, reason: 'not_in_tree' };
+        if (verdict.applicable && !verdict.ok) {
+            errors.push(verdict.reason);
+            overall = 'failed';
+        }
+        else if (verdict.applicable && verdict.ok && overall === 'verified') {
+            overall = 'verified_carried_forward';
+            carry_forward = {
+                status: verdict.status,
+                issued_at: verdict.issued_at,
+                issued_epoch: verdict.issued_epoch,
+                logged_at: verdict.logged_at,
+                logged_epoch: verdict.logged_epoch,
+                leaf_index: verdict.leaf_index,
+            };
+        }
+    }
+    const signedPayment = asRecord(verifiedClaims?.payment);
+    const signedSettlement = asRecord(verifiedClaims?.settlement);
+    const receipt_lane = (0, receipt_lane_js_1.receiptLaneFromVerification)({
+        receipt,
+        claims: {
+            schema: verifiedSchema,
+            payment: signedPayment ? {
+                ref: typeof signedPayment.ref === 'string' ? signedPayment.ref : null,
+                rail: typeof signedPayment.rail === 'string' ? signedPayment.rail : null,
+                collected: typeof signedPayment.collected === 'boolean' ? signedPayment.collected : null,
+            } : null,
+            settlement: signedSettlement ? {
+                kind: typeof signedSettlement.kind === 'string' ? signedSettlement.kind : null,
+            } : null,
+        },
+        issuerValid: issuer_signature.valid === true,
+        payer: { checked: payer.checked, valid: payer.valid },
+        head: options.head ?? null,
+    });
+    return {
+        receipt_id: receipt.task_id,
+        binding,
+        issuer_signature,
+        payer,
+        nullifier,
+        output_hash: facts.output_hash,
+        hub: facts.hub,
+        model: facts.model,
+        amount_usdc: facts.amount_usdc,
+        tx: facts.tx,
+        claim_mismatches,
+        unsigned_fields,
+        verified_scope: 'signed_claims',
+        claim_id,
+        head_binding: signedBinding
+            ? { tree_head_hash: signedBinding.tree_head_hash, tolerance: signedBinding.tolerance }
+            : null,
+        receipt_lane,
+        preimages,
+        issuer_history,
+        warnings,
+        ...(carry_forward ? { carry_forward } : {}),
+        ...versionStamp,
+        overall,
+        errors,
+    };
+}
+var jws_js_2 = require("./jws.js");
+Object.defineProperty(exports, "resolvePinnedIssuerJwk", { enumerable: true, get: function () { return jws_js_2.resolvePinnedIssuerJwk; } });
+Object.defineProperty(exports, "verifyIssuerJws", { enumerable: true, get: function () { return jws_js_2.verifyIssuerJws; } });
+Object.defineProperty(exports, "DEFAULT_TRUSTED_ISSUER_KIDS", { enumerable: true, get: function () { return jws_js_2.DEFAULT_TRUSTED_ISSUER_KIDS; } });
+Object.defineProperty(exports, "DEFAULT_TRUSTED_JWKS_HOSTS", { enumerable: true, get: function () { return jws_js_2.DEFAULT_TRUSTED_JWKS_HOSTS; } });
+Object.defineProperty(exports, "KEY_UNTRUSTED", { enumerable: true, get: function () { return jws_js_2.KEY_UNTRUSTED; } });
+Object.defineProperty(exports, "jwkThumbprint", { enumerable: true, get: function () { return jws_js_2.jwkThumbprint; } });
+Object.defineProperty(exports, "isPinnedTrustedJwk", { enumerable: true, get: function () { return jws_js_2.isPinnedTrustedJwk; } });
+Object.defineProperty(exports, "jwksHostAllowed", { enumerable: true, get: function () { return jws_js_2.jwksHostAllowed; } });
+var receipt_lane_js_2 = require("./receipt-lane.js");
+Object.defineProperty(exports, "buildReceiptLane", { enumerable: true, get: function () { return receipt_lane_js_2.buildReceiptLane; } });
+Object.defineProperty(exports, "receiptLaneFromVerification", { enumerable: true, get: function () { return receipt_lane_js_2.receiptLaneFromVerification; } });
+Object.defineProperty(exports, "receiptLaneDecision", { enumerable: true, get: function () { return receipt_lane_js_2.receiptLaneDecision; } });
+Object.defineProperty(exports, "deriveSettledBy", { enumerable: true, get: function () { return receipt_lane_js_2.deriveSettledBy; } });
+Object.defineProperty(exports, "deriveSettled", { enumerable: true, get: function () { return receipt_lane_js_2.deriveSettled; } });
+Object.defineProperty(exports, "anchorChangedSinceBinding", { enumerable: true, get: function () { return receipt_lane_js_2.anchorChangedSinceBinding; } });
+Object.defineProperty(exports, "RECEIPT_LANE_SCHEMA", { enumerable: true, get: function () { return receipt_lane_js_2.RECEIPT_LANE_SCHEMA; } });
+Object.defineProperty(exports, "RECEIPT_LANE_RULE", { enumerable: true, get: function () { return receipt_lane_js_2.RECEIPT_LANE_RULE; } });
+Object.defineProperty(exports, "RECEIPT_LANE_ORDERING", { enumerable: true, get: function () { return receipt_lane_js_2.RECEIPT_LANE_ORDERING; } });
+Object.defineProperty(exports, "RECEIPT_LANE_BOUNDARY", { enumerable: true, get: function () { return receipt_lane_js_2.RECEIPT_LANE_BOUNDARY; } });
+var head_binding_js_2 = require("./head-binding.js");
+Object.defineProperty(exports, "headBindingVerdict", { enumerable: true, get: function () { return head_binding_js_2.headBindingVerdict; } });
+Object.defineProperty(exports, "signedHeadBinding", { enumerable: true, get: function () { return head_binding_js_2.signedHeadBinding; } });
+Object.defineProperty(exports, "outerHeadDisagrees", { enumerable: true, get: function () { return head_binding_js_2.outerHeadDisagrees; } });
+Object.defineProperty(exports, "HEAD_BINDING_PAYLOAD_VERSION", { enumerable: true, get: function () { return head_binding_js_2.HEAD_BINDING_PAYLOAD_VERSION; } });
+var refusal_js_2 = require("./refusal.js");
+Object.defineProperty(exports, "isRefusalDocument", { enumerable: true, get: function () { return refusal_js_2.isRefusalDocument; } });
+Object.defineProperty(exports, "verifyRefusal", { enumerable: true, get: function () { return refusal_js_2.verifyRefusal; } });
+Object.defineProperty(exports, "REFUSAL_SCHEMA", { enumerable: true, get: function () { return refusal_js_2.REFUSAL_SCHEMA; } });
+Object.defineProperty(exports, "REFUSAL_SCHEMA_V2", { enumerable: true, get: function () { return refusal_js_2.REFUSAL_SCHEMA_V2; } });
+Object.defineProperty(exports, "REFUSAL_PAYLOAD_VERSION", { enumerable: true, get: function () { return refusal_js_2.REFUSAL_PAYLOAD_VERSION; } });
+Object.defineProperty(exports, "REFUSAL_PROVES", { enumerable: true, get: function () { return refusal_js_2.REFUSAL_PROVES; } });
+Object.defineProperty(exports, "REFUSAL_DOES_NOT_PROVE", { enumerable: true, get: function () { return refusal_js_2.REFUSAL_DOES_NOT_PROVE; } });
+var request_binding_js_1 = require("./request-binding.js");
+Object.defineProperty(exports, "verifyRequestDigest", { enumerable: true, get: function () { return request_binding_js_1.verifyRequestDigest; } });
+Object.defineProperty(exports, "requestDigestOfPreimage", { enumerable: true, get: function () { return request_binding_js_1.requestDigestOfPreimage; } });
+var epoch_js_1 = require("./epoch.js");
+Object.defineProperty(exports, "acceptTreeHeadSchema", { enumerable: true, get: function () { return epoch_js_1.acceptTreeHeadSchema; } });
+Object.defineProperty(exports, "verifyEpochLink", { enumerable: true, get: function () { return epoch_js_1.verifyEpochLink; } });
+Object.defineProperty(exports, "verifyEpochRecord", { enumerable: true, get: function () { return epoch_js_1.verifyEpochRecord; } });
+Object.defineProperty(exports, "verifyEpochInclusion", { enumerable: true, get: function () { return epoch_js_1.verifyEpochInclusion; } });
+Object.defineProperty(exports, "verifyUnloggedSection", { enumerable: true, get: function () { return epoch_js_1.verifyUnloggedSection; } });
+Object.defineProperty(exports, "verifyUnloggedCommitment", { enumerable: true, get: function () { return epoch_js_1.verifyUnloggedCommitment; } });
+Object.defineProperty(exports, "unloggedIdCommitment", { enumerable: true, get: function () { return epoch_js_1.unloggedIdCommitment; } });
+Object.defineProperty(exports, "unloggedReasonForTask", { enumerable: true, get: function () { return epoch_js_1.unloggedReasonForTask; } });
+Object.defineProperty(exports, "canonicalUnloggedRows", { enumerable: true, get: function () { return epoch_js_1.canonicalUnloggedRows; } });
+Object.defineProperty(exports, "TREE_HEAD_SCHEMA_V1", { enumerable: true, get: function () { return epoch_js_1.TREE_HEAD_SCHEMA_V1; } });
+Object.defineProperty(exports, "TREE_HEAD_SCHEMA_V2", { enumerable: true, get: function () { return epoch_js_1.TREE_HEAD_SCHEMA_V2; } });
+Object.defineProperty(exports, "EPOCH1_FINAL_ROOT", { enumerable: true, get: function () { return epoch_js_1.EPOCH1_FINAL_ROOT; } });
+Object.defineProperty(exports, "EPOCH1_FINAL_SIZE", { enumerable: true, get: function () { return epoch_js_1.EPOCH1_FINAL_SIZE; } });
+Object.defineProperty(exports, "EPOCH1_GENESIS_DIGEST", { enumerable: true, get: function () { return epoch_js_1.EPOCH1_GENESIS_DIGEST; } });
+Object.defineProperty(exports, "EPOCH1_SIZE1_ROOT", { enumerable: true, get: function () { return epoch_js_1.EPOCH1_SIZE1_ROOT; } });
+Object.defineProperty(exports, "EPOCH1_SIZE2_ROOT", { enumerable: true, get: function () { return epoch_js_1.EPOCH1_SIZE2_ROOT; } });
+Object.defineProperty(exports, "epoch1PrefixRoot", { enumerable: true, get: function () { return epoch_js_1.epoch1PrefixRoot; } });
+Object.defineProperty(exports, "matchEpoch1Prefix", { enumerable: true, get: function () { return epoch_js_1.matchEpoch1Prefix; } });
+Object.defineProperty(exports, "EPOCH2_OPENING_ROOT", { enumerable: true, get: function () { return epoch_js_1.EPOCH2_OPENING_ROOT; } });
+var carry_forward_js_2 = require("./carry-forward.js");
+Object.defineProperty(exports, "verifyCarryForward", { enumerable: true, get: function () { return carry_forward_js_2.verifyCarryForward; } });
+Object.defineProperty(exports, "PINNED_ANCHOR_EPOCHS", { enumerable: true, get: function () { return carry_forward_js_2.PINNED_ANCHOR_EPOCHS; } });
+Object.defineProperty(exports, "CARRY_FORWARD_STATUS", { enumerable: true, get: function () { return carry_forward_js_2.CARRY_FORWARD_STATUS; } });
+var anchor_witness_js_2 = require("./anchor-witness.js");
+Object.defineProperty(exports, "verifyAnchoredRoot", { enumerable: true, get: function () { return anchor_witness_js_2.verifyAnchoredRoot; } });
+Object.defineProperty(exports, "verifyMerkleInclusion", { enumerable: true, get: function () { return anchor_witness_js_2.verifyMerkleInclusion; } });
+Object.defineProperty(exports, "extractMemos", { enumerable: true, get: function () { return anchor_witness_js_2.extractMemos; } });
+Object.defineProperty(exports, "parseAnchorMemo", { enumerable: true, get: function () { return anchor_witness_js_2.parseAnchorMemo; } });
+Object.defineProperty(exports, "leafHash", { enumerable: true, get: function () { return anchor_witness_js_2.leafHash; } });
+Object.defineProperty(exports, "ANCHOR_PROVES", { enumerable: true, get: function () { return anchor_witness_js_2.ANCHOR_PROVES; } });
+Object.defineProperty(exports, "ANCHOR_DOES_NOT_PROVE", { enumerable: true, get: function () { return anchor_witness_js_2.ANCHOR_DOES_NOT_PROVE; } });
+Object.defineProperty(exports, "SOLANA_GENESIS", { enumerable: true, get: function () { return anchor_witness_js_2.SOLANA_GENESIS; } });
+Object.defineProperty(exports, "BASE_MAINNET_CHAIN_ID", { enumerable: true, get: function () { return anchor_witness_js_2.BASE_MAINNET_CHAIN_ID; } });
+var issuer_pin_js_1 = require("./issuer-pin.js");
+Object.defineProperty(exports, "assessIssuerPin", { enumerable: true, get: function () { return issuer_pin_js_1.assessIssuerPin; } });
+Object.defineProperty(exports, "issuerPinContentUrl", { enumerable: true, get: function () { return issuer_pin_js_1.issuerPinContentUrl; } });
+Object.defineProperty(exports, "issuerPinFileHash", { enumerable: true, get: function () { return issuer_pin_js_1.issuerPinFileHash; } });
+Object.defineProperty(exports, "loadIssuerPinBytes", { enumerable: true, get: function () { return issuer_pin_js_1.loadIssuerPinBytes; } });
+Object.defineProperty(exports, "readIssuerPinClaim", { enumerable: true, get: function () { return issuer_pin_js_1.readIssuerPinClaim; } });
+Object.defineProperty(exports, "registrationPreimage", { enumerable: true, get: function () { return issuer_pin_js_1.registrationPreimage; } });
+Object.defineProperty(exports, "rotationStatement", { enumerable: true, get: function () { return issuer_pin_js_1.rotationStatement; } });
+Object.defineProperty(exports, "serializeIssuerPin", { enumerable: true, get: function () { return issuer_pin_js_1.serializeIssuerPin; } });
+Object.defineProperty(exports, "verifyCitizenRotation", { enumerable: true, get: function () { return issuer_pin_js_1.verifyCitizenRotation; } });
+Object.defineProperty(exports, "verifyRegistrationSignature", { enumerable: true, get: function () { return issuer_pin_js_1.verifyRegistrationSignature; } });
+Object.defineProperty(exports, "canonicalPublicKey", { enumerable: true, get: function () { return issuer_pin_js_1.canonicalPublicKey; } });
+Object.defineProperty(exports, "ISSUER_REGISTRATION_CONTEXT", { enumerable: true, get: function () { return issuer_pin_js_1.ISSUER_REGISTRATION_CONTEXT; } });
+Object.defineProperty(exports, "ISSUER_ROTATION_CONTEXT", { enumerable: true, get: function () { return issuer_pin_js_1.ISSUER_ROTATION_CONTEXT; } });
+Object.defineProperty(exports, "ISSUER_PIN_VERSION", { enumerable: true, get: function () { return issuer_pin_js_1.ISSUER_PIN_VERSION; } });
+Object.defineProperty(exports, "ISSUER_PIN_SCHEMA", { enumerable: true, get: function () { return issuer_pin_js_1.ISSUER_PIN_SCHEMA; } });
+Object.defineProperty(exports, "ISSUER_PIN_PATH", { enumerable: true, get: function () { return issuer_pin_js_1.ISSUER_PIN_PATH; } });
+Object.defineProperty(exports, "ISSUER_PIN_CHAIN_ID", { enumerable: true, get: function () { return issuer_pin_js_1.ISSUER_PIN_CHAIN_ID; } });
+Object.defineProperty(exports, "PUBLISHED_ISSUER_PIN_KID", { enumerable: true, get: function () { return issuer_pin_js_1.PUBLISHED_ISSUER_PIN_KID; } });
+Object.defineProperty(exports, "CITIZEN_FREEZE_SCHEMA", { enumerable: true, get: function () { return issuer_pin_js_1.CITIZEN_FREEZE_SCHEMA; } });
+Object.defineProperty(exports, "CITIZEN_FREEZE_PURPOSE", { enumerable: true, get: function () { return issuer_pin_js_1.CITIZEN_FREEZE_PURPOSE; } });
+Object.defineProperty(exports, "ISSUER_PIN_MISMATCH", { enumerable: true, get: function () { return issuer_pin_js_1.ISSUER_PIN_MISMATCH; } });
+Object.defineProperty(exports, "ISSUER_PIN_HASH_MISMATCH", { enumerable: true, get: function () { return issuer_pin_js_1.ISSUER_PIN_HASH_MISMATCH; } });
+Object.defineProperty(exports, "ISSUER_SELF_SIG_INVALID", { enumerable: true, get: function () { return issuer_pin_js_1.ISSUER_SELF_SIG_INVALID; } });
+Object.defineProperty(exports, "ISSUER_PIN_DOWNGRADE", { enumerable: true, get: function () { return issuer_pin_js_1.ISSUER_PIN_DOWNGRADE; } });
+Object.defineProperty(exports, "ISSUER_PIN_MUTABLE_REF", { enumerable: true, get: function () { return issuer_pin_js_1.ISSUER_PIN_MUTABLE_REF; } });
+Object.defineProperty(exports, "ISSUER_ROTATION_UNCONTROLLED", { enumerable: true, get: function () { return issuer_pin_js_1.ISSUER_ROTATION_UNCONTROLLED; } });
+Object.defineProperty(exports, "ISSUER_PIN_CHAIN_REFUSED", { enumerable: true, get: function () { return issuer_pin_js_1.ISSUER_PIN_CHAIN_REFUSED; } });
+var anchor_trust_js_2 = require("./anchor-trust.js");
+Object.defineProperty(exports, "PINNED_BASE_ANCHOR_WALLET", { enumerable: true, get: function () { return anchor_trust_js_2.PINNED_BASE_ANCHOR_WALLET; } });
+Object.defineProperty(exports, "PINNED_SOLANA_ANCHOR_FEE_PAYER", { enumerable: true, get: function () { return anchor_trust_js_2.PINNED_SOLANA_ANCHOR_FEE_PAYER; } });
+Object.defineProperty(exports, "ANCHOR_WALLET_SOURCES_NOT_CONSULTED", { enumerable: true, get: function () { return anchor_trust_js_2.ANCHOR_WALLET_SOURCES_NOT_CONSULTED; } });
+Object.defineProperty(exports, "LEGACY_HEAD_UNPINNED_SIGNER", { enumerable: true, get: function () { return anchor_trust_js_2.LEGACY_HEAD_UNPINNED_SIGNER; } });
+Object.defineProperty(exports, "HEAD_TRUST_MESSAGES", { enumerable: true, get: function () { return anchor_trust_js_2.HEAD_TRUST_MESSAGES; } });
+Object.defineProperty(exports, "headOmitsPinnedSigner", { enumerable: true, get: function () { return anchor_trust_js_2.headOmitsPinnedSigner; } });
+Object.defineProperty(exports, "headTrustedFromInclusion", { enumerable: true, get: function () { return anchor_trust_js_2.headTrustedFromInclusion; } });
+Object.defineProperty(exports, "verifyTreeHeadTrust", { enumerable: true, get: function () { return anchor_trust_js_2.verifyTreeHeadTrust; } });
+Object.defineProperty(exports, "verifyAnchorWalletDocument", { enumerable: true, get: function () { return anchor_trust_js_2.verifyAnchorWalletDocument; } });
+Object.defineProperty(exports, "compileAnchorWallets", { enumerable: true, get: function () { return anchor_trust_js_2.compileAnchorWallets; } });
+var canonical_preimage_js_2 = require("./canonical-preimage.js");
+Object.defineProperty(exports, "verifyCanonicalPreimageBytes", { enumerable: true, get: function () { return canonical_preimage_js_2.verifyCanonicalPreimageBytes; } });
+Object.defineProperty(exports, "CANONICAL_PAYLOAD_VERSION", { enumerable: true, get: function () { return canonical_preimage_js_2.CANONICAL_PAYLOAD_VERSION; } });
+var receipt_version_js_2 = require("./receipt-version.js");
+Object.defineProperty(exports, "SUPPORTED_RECEIPT_VERSIONS", { enumerable: true, get: function () { return receipt_version_js_2.SUPPORTED_RECEIPT_VERSIONS; } });
+Object.defineProperty(exports, "LEGACY_PAYLOAD_VERSIONS", { enumerable: true, get: function () { return receipt_version_js_2.LEGACY_PAYLOAD_VERSIONS; } });
+Object.defineProperty(exports, "REFUSAL_EXACT_VERSIONS", { enumerable: true, get: function () { return receipt_version_js_2.REFUSAL_EXACT_VERSIONS; } });
+Object.defineProperty(exports, "VERIFIER_MIN", { enumerable: true, get: function () { return receipt_version_js_2.VERIFIER_MIN; } });
+Object.defineProperty(exports, "UNSUPPORTED_VERSION", { enumerable: true, get: function () { return receipt_version_js_2.UNSUPPORTED_VERSION; } });
+Object.defineProperty(exports, "VERSION_MISMATCH", { enumerable: true, get: function () { return receipt_version_js_2.VERSION_MISMATCH; } });
+Object.defineProperty(exports, "classifyReceiptDocument", { enumerable: true, get: function () { return receipt_version_js_2.classifyReceiptDocument; } });
+Object.defineProperty(exports, "classifySignedClaims", { enumerable: true, get: function () { return receipt_version_js_2.classifySignedClaims; } });
+Object.defineProperty(exports, "legacyIdentityErrors", { enumerable: true, get: function () { return receipt_version_js_2.legacyIdentityErrors; } });
+Object.defineProperty(exports, "classifyShellDocument", { enumerable: true, get: function () { return receipt_version_js_2.classifyShellDocument; } });
+Object.defineProperty(exports, "signedClaimsOnAllowlist", { enumerable: true, get: function () { return receipt_version_js_2.signedClaimsOnAllowlist; } });
+Object.defineProperty(exports, "formatSupportedReceiptVersions", { enumerable: true, get: function () { return receipt_version_js_2.formatSupportedReceiptVersions; } });
+Object.defineProperty(exports, "readSignedClaims", { enumerable: true, get: function () { return receipt_version_js_2.readSignedClaims; } });
+Object.defineProperty(exports, "refusalPayloadVersion", { enumerable: true, get: function () { return receipt_version_js_2.refusalPayloadVersion; } });
+Object.defineProperty(exports, "isJsonInteger", { enumerable: true, get: function () { return receipt_version_js_2.isJsonInteger; } });
+var issuer_history_js_2 = require("./issuer-history.js");
+Object.defineProperty(exports, "readIssuerHistoryPin", { enumerable: true, get: function () { return issuer_history_js_2.readIssuerHistoryPin; } });
+Object.defineProperty(exports, "issuerHistoryDocumentHash", { enumerable: true, get: function () { return issuer_history_js_2.issuerHistoryDocumentHash; } });
+var shell_js_1 = require("./shell.js");
+Object.defineProperty(exports, "isReceiptShell", { enumerable: true, get: function () { return shell_js_1.isReceiptShell; } });
+Object.defineProperty(exports, "shellFromHolder", { enumerable: true, get: function () { return shell_js_1.shellFromHolder; } });
+Object.defineProperty(exports, "compareShellToJws", { enumerable: true, get: function () { return shell_js_1.compareShellToJws; } });
+Object.defineProperty(exports, "holderDocumentFromOwnerView", { enumerable: true, get: function () { return shell_js_1.holderDocumentFromOwnerView; } });
+Object.defineProperty(exports, "shellHolderVerdict", { enumerable: true, get: function () { return shell_js_1.shellHolderVerdict; } });
+Object.defineProperty(exports, "openV11Commitment", { enumerable: true, get: function () { return shell_js_1.openV11Commitment; } });
+Object.defineProperty(exports, "decodeShellJwsPayload", { enumerable: true, get: function () { return shell_js_1.decodeJwsPayload; } });
+Object.defineProperty(exports, "SHELL_SCHEMA", { enumerable: true, get: function () { return shell_js_1.SHELL_SCHEMA; } });
+Object.defineProperty(exports, "INCLUDED_SHELL_LINE", { enumerable: true, get: function () { return shell_js_1.INCLUDED_SHELL_LINE; } });
+exports.default = {
+    verifyBinding,
+    verifyIssuerSignature,
+    verifyIssuerSignatureWithJwks,
+    verifyIssuerJws: jws_js_1.verifyIssuerJws,
+    resolvePinnedIssuerJwk: jws_js_1.resolvePinnedIssuerJwk,
+    verifyNullifier,
+    verifyPayerBinding: payer_js_1.verifyPayerBinding,
+    verifySolanaPayer: solana_payer_js_1.verifySolanaPayer,
+    verifyBasePayer: base_payer_js_1.verifyBasePayer,
+    verifyReceipt,
+    receiptPayerClaims,
+    receiptPayerClaimsFromEnvelope: payer_js_1.receiptPayerClaimsFromEnvelope,
+    decodeJwsPayload: payer_js_1.decodeJwsPayload,
+    computePaymentCommitment: binding_js_1.computePaymentCommitment,
+    computeInferenceBinding: binding_js_1.computeInferenceBinding,
+    canonicalIssuerPayload,
+    canonicalPayloadVersion,
+    canonicalSignedPayload: exports.canonicalSignedPayload,
+    reconcileSettledTransfer,
+    sumUsdcTransfersToPayee,
+    hashCanonicalPayload,
+    ZK_VERIFIER_ADDRESS: exports.ZK_VERIFIER_ADDRESS,
+    BASE_RPC_URL: base_payer_js_1.BASE_RPC_URL,
+    BASE_SEPOLIA_RPC_URL: exports.BASE_SEPOLIA_RPC_URL,
+    SOLANA_RPC_URL: solana_payer_js_1.SOLANA_RPC_URL,
+};
+//# sourceMappingURL=index.js.map