chit402-verify 0.3.4 → 0.4.0

package/dist/verdict.js

@@ -0,0 +1,381 @@
+"use strict";
+/**
+ * @xfuel/verify 0.4.0 verdict.
+ * `verified` is only when every check passed. A failed check is `invalid`
+ * even when another check could not be completed.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VERDICT_DOC_ANCHORS = void 0;
+exports.verdictCopy = verdictCopy;
+exports.buildVerifyVerdict = buildVerifyVerdict;
+exports.overallLine = overallLine;
+exports.verdictDocAnchor = verdictDocAnchor;
+exports.humanVerdictLines = humanVerdictLines;
+const WINDOW_FAIL = new Set([
+    'kid_revoked_before_issuance',
+    'issued_before_not_before',
+    'issued_after_not_after',
+    'issued_at_missing',
+    'not_before_missing',
+    'not_after_invalid',
+    'revoked_at_missing',
+    'kid_status_regression',
+    'issuer_history_invalid',
+    'issuer_history_pin_mismatch',
+    'issuer_history_pin_missing',
+    'issuer_history_version_mismatch',
+    'issuer_history_seq_mismatch',
+    'signature_invalid',
+    'key untrusted',
+    'prev_hash_mismatch',
+    'entry_hash_mismatch',
+    'head_hash_mismatch',
+    'introduced_key_signature',
+    'inherited_key_window',
+    'issuer_history_not_extension',
+]);
+function verdictCopy(reason, result) {
+    if (result === 'verified')
+        return { message: 'Every check passed.', next_step: null };
+    if (reason === 'not_in_log' || reason === 'NOT_IN_LOG') {
+        return {
+            message: 'This receipt is not a leaf of the public log. The payment row in the book is unchanged.',
+            next_step: null,
+        };
+    }
+    if (reason === 'unsupported_version') {
+        return {
+            message: 'This receipt version is not supported by this verifier.',
+            next_step: 'Upgrade @xfuel/verify.',
+        };
+    }
+    if (reason === 'kid_not_in_history') {
+        return {
+            message: 'No issuer history covers this key.',
+            next_step: 'Pass --issuer-history with a snapshot that includes this kid.',
+        };
+    }
+    if (reason === 'signed_receipt_unavailable') {
+        return {
+            message: 'This document is the public shell. The signed receipt is on the owner view.',
+            next_step: 'Pass the signed receipt from the owner view.',
+        };
+    }
+    if (reason === 'receipt_unavailable') {
+        return {
+            message: 'The receipt could not be fetched.',
+            next_step: 'Fetch the receipt again, then re-run.',
+        };
+    }
+    if (reason === 'log_unreachable' || reason === 'anchor_unreachable') {
+        return {
+            message: 'The receipt log or anchor could not be fetched.',
+            next_step: 'Fetch the log and the anchor again, then re-run.',
+        };
+    }
+    if (reason === 'pending' || reason === 'pending_anchor') {
+        return {
+            message: 'The leaf is past the anchored tree. The anchor is not in yet.',
+            next_step: 'Re-run when the anchor for this leaf is published.',
+        };
+    }
+    if (reason === 'kid_status_regression') {
+        return {
+            message: 'Issuer history changes not_before or restores a revoked key.',
+            next_step: null,
+        };
+    }
+    if (reason === 'kid_revoked_before_issuance' || reason === 'issued_before_not_before' || reason === 'issued_after_not_after') {
+        return {
+            message: 'The issuer key was revoked or this receipt is outside its window.',
+            next_step: null,
+        };
+    }
+    if (reason === 'version_mismatch'
+        || reason === 'payload_version_mismatch'
+        || reason === 'id_mismatch'
+        || reason === 'id_prefix_version_mismatch') {
+        return {
+            message: 'The receipt id or version does not match the signature.',
+            next_step: null,
+        };
+    }
+    if (reason === 'intent_on_legacy_version') {
+        return {
+            message: 'A signed intent is not a payment on this receipt version.',
+            next_step: null,
+        };
+    }
+    if (reason === 'payment_mismatch' || reason === 'binding_mismatch') {
+        return {
+            message: 'The payment on the receipt does not match the signature.',
+            next_step: null,
+        };
+    }
+    if (reason === 'key untrusted') {
+        return {
+            message: "Signed by a key that is not the issuer's.",
+            next_step: null,
+        };
+    }
+    if (result === 'could_not_check') {
+        return {
+            message: 'A check could not be completed.',
+            next_step: null,
+        };
+    }
+    return {
+        message: 'The receipt does not match what the issuer signed.',
+        next_step: null,
+    };
+}
+function claimed(state) {
+    if (!state || state === 'unclaimed')
+        return 'could_not_check';
+    return state;
+}
+function buildVerifyVerdict(input) {
+    if (input.absentReason)
+        return absentReceiptVerdict(input);
+    const errors = input.errors || [];
+    const unsupported = errors.includes('unsupported_version');
+    const versionMismatch = errors.includes('version_mismatch') || errors.includes('payload_version_mismatch');
+    const idMismatch = errors.includes('id_mismatch') || errors.includes('task_id_mismatch') || errors.includes('receipt_id_mismatch');
+    const idPrefix = errors.includes('id_prefix_version_mismatch');
+    const intentLegacy = errors.includes('intent_on_legacy_version');
+    let shape = 'pass';
+    if (idPrefix || intentLegacy)
+        shape = 'fail';
+    else if (unsupported)
+        shape = 'could_not_check';
+    else if (versionMismatch || idMismatch)
+        shape = 'fail';
+    let signature = 'could_not_check';
+    if (unsupported)
+        signature = 'could_not_check';
+    else if (input.signatureChecked && input.signatureValid === true)
+        signature = 'pass';
+    else if (input.signatureChecked && input.signatureValid === false)
+        signature = 'fail';
+    else if (input.signatureValid === true)
+        signature = 'pass';
+    const historyReason = input.historyReason || null;
+    let keyWindow = 'could_not_check';
+    if (input.historyMissing || historyReason === 'kid_not_in_history')
+        keyWindow = 'could_not_check';
+    else if (input.historyChecked && input.historyOk)
+        keyWindow = 'pass';
+    else if (input.historyChecked && historyReason && WINDOW_FAIL.has(historyReason))
+        keyWindow = 'fail';
+    else if (input.historyChecked && input.historyOk === false)
+        keyWindow = 'fail';
+    // Pass only after the signature was checked and passed. An unchecked or
+    // failed signature did not check the payment, so it is not a pass.
+    let payment = signature === 'pass' ? 'pass' : 'could_not_check';
+    const preimageFailed = errors.some((err) => /preimage|payload_hash_mismatch|canonical preimage/.test(err));
+    if (signature === 'pass') {
+        if ((input.claimMismatches || 0) > 0 || (input.bindingExpected && input.bindingMatches === false) || preimageFailed)
+            payment = 'fail';
+        else if (input.payerChecked && input.payerValid === false)
+            payment = 'fail';
+        else if (input.bindingExpected && input.bindingMatches !== true && !unsupported)
+            payment = 'could_not_check';
+    }
+    const logInclusion = claimed(input.logInclusion);
+    const anchor = claimed(input.anchor);
+    const checks = {
+        signature,
+        key_window: keyWindow,
+        payment_binding: payment,
+        log_inclusion: logInclusion,
+        anchor,
+        shape,
+    };
+    const failed = Object.keys(checks).filter((name) => checks[name] === 'fail');
+    const unchecked = Object.keys(checks).filter((name) => checks[name] === 'could_not_check');
+    let result = 'verified';
+    let reason = null;
+    if (failed.length) {
+        result = 'invalid';
+        reason = failReason(failed, historyReason, input.logReason || null, errors, payment);
+    }
+    else if (unchecked.length) {
+        result = 'could_not_check';
+        reason = uncheckedReason(unchecked, historyReason, input.logReason || null, errors);
+    }
+    const copy = verdictCopy(reason, result);
+    const exit_code = result === 'verified' ? 0 : result === 'invalid' ? 1 : 2;
+    return {
+        result,
+        exit_code,
+        reason,
+        message: copy.message,
+        next_step: copy.next_step,
+        receipt_id: input.receiptId ?? null,
+        display_id: input.displayId ?? null,
+        payload_version: input.payloadVersion ?? null,
+        checks,
+        history: {
+            source: input.historySource ?? null,
+            head_hash: input.historyHead ?? null,
+            entry_count: input.historyCount ?? null,
+            as_of: input.historyAsOf ?? null,
+        },
+        log: input.log ?? null,
+        verifier: { name: 'chit402-verify', version: input.version },
+    };
+}
+function absentReceiptVerdict(input) {
+    const reason = input.absentReason || 'receipt_unavailable';
+    const copy = verdictCopy(reason, 'could_not_check');
+    const could = 'could_not_check';
+    return {
+        result: 'could_not_check',
+        exit_code: 2,
+        reason,
+        message: copy.message,
+        next_step: copy.next_step,
+        receipt_id: null,
+        display_id: null,
+        payload_version: null,
+        checks: {
+            signature: could,
+            key_window: could,
+            payment_binding: could,
+            log_inclusion: could,
+            anchor: could,
+            shape: could,
+        },
+        history: {
+            source: null,
+            head_hash: null,
+            entry_count: null,
+            as_of: null,
+        },
+        log: null,
+        verifier: { name: 'chit402-verify', version: input.version },
+    };
+}
+function failReason(failed, historyReason, logReason, errors, payment) {
+    if (failed.includes('shape')) {
+        if (errors.includes('id_prefix_version_mismatch'))
+            return 'id_prefix_version_mismatch';
+        if (errors.includes('intent_on_legacy_version'))
+            return 'intent_on_legacy_version';
+        if (errors.includes('version_mismatch') || errors.includes('payload_version_mismatch'))
+            return 'version_mismatch';
+        return 'id_mismatch';
+    }
+    if (failed.includes('signature'))
+        return errors.find((err) => err === 'key untrusted') || 'signature_invalid';
+    if (failed.includes('key_window'))
+        return historyReason || 'key_window';
+    if (failed.includes('payment_binding') || payment === 'fail')
+        return 'payment_mismatch';
+    if (failed.includes('log_inclusion')) {
+        if (logReason === 'not_in_log')
+            return 'not_in_log';
+        return logReason || 'log_inclusion';
+    }
+    if (failed.includes('anchor'))
+        return logReason || 'anchor';
+    return 'invalid';
+}
+function uncheckedReason(unchecked, historyReason, logReason, errors) {
+    if (unchecked.includes('shape') || errors.includes('unsupported_version'))
+        return 'unsupported_version';
+    if (unchecked.includes('key_window'))
+        return historyReason || 'kid_not_in_history';
+    if (unchecked.includes('signature'))
+        return 'signature_unchecked';
+    if (unchecked.includes('log_inclusion') || unchecked.includes('anchor'))
+        return logReason || 'log_unreachable';
+    return 'could_not_check';
+}
+function overallLine(verdict, legacyOverall) {
+    if (verdict.result === 'verified')
+        return 'VERIFIED';
+    if (verdict.reason === 'not_in_log')
+        return 'NOT_IN_LOG';
+    if (verdict.result === 'invalid')
+        return 'INVALID';
+    if (legacyOverall === 'pending' || verdict.reason === 'pending' || verdict.reason === 'pending_anchor')
+        return 'PENDING';
+    if (legacyOverall === 'partial')
+        return 'PARTIAL';
+    return 'COULD_NOT_CHECK';
+}
+/** Fragment for `https://chit402.com/docs/verify#`. Ids have no spaces. */
+function verdictDocAnchor(reason) {
+    if (reason === 'key untrusted')
+        return 'key_untrusted';
+    return reason;
+}
+/** Human lines. Exit 2 always includes the exact `NOT found invalid` line. */
+function humanVerdictLines(verdict) {
+    const lines = [overallLine(verdict), verdict.message];
+    if (verdict.exit_code === 2)
+        lines.push('NOT found invalid');
+    if (verdict.reason)
+        lines.push(`Details: https://chit402.com/docs/verify#${verdictDocAnchor(verdict.reason)}`);
+    if (verdict.history.source === 'bundled' && verdict.history.as_of) {
+        lines.push(`Issuer history: as of ${verdict.history.as_of}`);
+    }
+    if (verdict.next_step)
+        lines.push(verdict.next_step);
+    return lines;
+}
+/**
+ * Reason ids printed as `https://chit402.com/docs/verify#<reason>`.
+ * The public page must have one element id for each.
+ */
+exports.VERDICT_DOC_ANCHORS = [
+    'not_in_log',
+    'signed_receipt_unavailable',
+    'unsupported_version',
+    'kid_not_in_history',
+    'receipt_unavailable',
+    'log_unreachable',
+    'anchor_unreachable',
+    'pending_anchor',
+    'pending',
+    'kid_status_regression',
+    'kid_revoked_before_issuance',
+    'issued_before_not_before',
+    'issued_after_not_after',
+    'issued_at_missing',
+    'not_before_missing',
+    'not_after_invalid',
+    'revoked_at_missing',
+    'issuer_history_invalid',
+    'issuer_history_pin_mismatch',
+    'issuer_history_pin_missing',
+    'issuer_history_version_mismatch',
+    'issuer_history_seq_mismatch',
+    'issuer_history_not_extension',
+    'signature_invalid',
+    'key_untrusted',
+    'key_window',
+    'version_mismatch',
+    'id_mismatch',
+    'id_prefix_version_mismatch',
+    'intent_on_legacy_version',
+    'payment_mismatch',
+    'log_inclusion',
+    'anchor',
+    'invalid',
+    'signature_unchecked',
+    'could_not_check',
+    'prev_hash_mismatch',
+    'entry_hash_mismatch',
+    'head_hash_mismatch',
+    'introduced_key_signature',
+    'inherited_key_window',
+    'head_signature_missing',
+    'head_signature_invalid',
+    'head_claims_mismatch',
+    'head_key_untrusted',
+    'inclusion_failed',
+    'root_mismatch',
+];
+//# sourceMappingURL=verdict.js.map

package/dist/verdict.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verdict.js","sourceRoot":"","sources":["../src/verdict.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAsEH,kCA+FC;AAyCD,gDAmFC;AAuED,kCAOC;AAGD,4CAGC;AAGD,8CASC;AAnVD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,6BAA6B;IAC7B,0BAA0B;IAC1B,wBAAwB;IACxB,mBAAmB;IACnB,oBAAoB;IACpB,mBAAmB;IACnB,oBAAoB;IACpB,uBAAuB;IACvB,wBAAwB;IACxB,6BAA6B;IAC7B,4BAA4B;IAC5B,iCAAiC;IACjC,6BAA6B;IAC7B,mBAAmB;IACnB,eAAe;IACf,oBAAoB;IACpB,qBAAqB;IACrB,oBAAoB;IACpB,0BAA0B;IAC1B,sBAAsB;IACtB,8BAA8B;CAC/B,CAAC,CAAC;AAEH,SAAgB,WAAW,CAAC,MAAqB,EAAE,MAAqB;IACtE,IAAI,MAAM,KAAK,UAAU;QAAE,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IACtF,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QACvD,OAAO;YACL,OAAO,EAAE,yFAAyF;YAClG,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;QACrC,OAAO;YACL,OAAO,EAAE,yDAAyD;YAClE,SAAS,EAAE,wBAAwB;SACpC,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,oBAAoB,EAAE,CAAC;QACpC,OAAO;YACL,OAAO,EAAE,oCAAoC;YAC7C,SAAS,EAAE,+DAA+D;SAC3E,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,4BAA4B,EAAE,CAAC;QAC5C,OAAO;YACL,OAAO,EAAE,6EAA6E;YACtF,SAAS,EAAE,8CAA8C;SAC1D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;QACrC,OAAO;YACL,OAAO,EAAE,mCAAmC;YAC5C,SAAS,EAAE,uCAAuC;SACnD,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,iBAAiB,IAAI,MAAM,KAAK,oBAAoB,EAAE,CAAC;QACpE,OAAO;YACL,OAAO,EAAE,iDAAiD;YAC1D,SAAS,EAAE,kDAAkD;SAC9D,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,gBAAgB,EAAE,CAAC;QACxD,OAAO;YACL,OAAO,EAAE,+DAA+D;YACxE,SAAS,EAAE,oDAAoD;SAChE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,uBAAuB,EAAE,CAAC;QACvC,OAAO;YACL,OAAO,EAAE,8DAA8D;YACvE,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,6BAA6B,IAAI,MAAM,KAAK,0BAA0B,IAAI,MAAM,KAAK,wBAAwB,EAAE,CAAC;QAC7H,OAAO;YACL,OAAO,EAAE,mEAAmE;YAC5E,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IACD,IACE,MAAM,KAAK,kBAAkB;WAC1B,MAAM,KAAK,0BAA0B;WACrC,MAAM,KAAK,aAAa;WACxB,MAAM,KAAK,4BAA4B,EAC1C,CAAC;QACD,OAAO;YACL,OAAO,EAAE,yDAAyD;YAClE,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,0BAA0B,EAAE,CAAC;QAC1C,OAAO;YACL,OAAO,EAAE,2DAA2D;YACpE,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,kBAAkB,IAAI,MAAM,KAAK,kBAAkB,EAAE,CAAC;QACnE,OAAO;YACL,OAAO,EAAE,0DAA0D;YACnE,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;QAC/B,OAAO;YACL,OAAO,EAAE,2CAA2C;YACpD,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,iBAAiB,EAAE,CAAC;QACjC,OAAO;YACL,OAAO,EAAE,iCAAiC;YAC1C,SAAS,EAAE,IAAI;SAChB,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,oDAAoD;QAC7D,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC;AAoCD,SAAS,OAAO,CAAC,KAA2C;IAC1D,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,WAAW;QAAE,OAAO,iBAAiB,CAAC;IAC9D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,kBAAkB,CAAC,KAAmB;IACpD,IAAI,KAAK,CAAC,YAAY;QAAE,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;IAClC,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IAC3D,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC;IAC3G,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;IACnI,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC;IAEjE,IAAI,KAAK,GAAe,MAAM,CAAC;IAC/B,IAAI,QAAQ,IAAI,YAAY;QAAE,KAAK,GAAG,MAAM,CAAC;SACxC,IAAI,WAAW;QAAE,KAAK,GAAG,iBAAiB,CAAC;SAC3C,IAAI,eAAe,IAAI,UAAU;QAAE,KAAK,GAAG,MAAM,CAAC;IAEvD,IAAI,SAAS,GAAe,iBAAiB,CAAC;IAC9C,IAAI,WAAW;QAAE,SAAS,GAAG,iBAAiB,CAAC;SAC1C,IAAI,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI;QAAE,SAAS,GAAG,MAAM,CAAC;SAChF,IAAI,KAAK,CAAC,gBAAgB,IAAI,KAAK,CAAC,cAAc,KAAK,KAAK;QAAE,SAAS,GAAG,MAAM,CAAC;SACjF,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI;QAAE,SAAS,GAAG,MAAM,CAAC;IAE3D,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,IAAI,CAAC;IAClD,IAAI,SAAS,GAAe,iBAAiB,CAAC;IAC9C,IAAI,KAAK,CAAC,cAAc,IAAI,aAAa,KAAK,oBAAoB;QAAE,SAAS,GAAG,iBAAiB,CAAC;SAC7F,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,SAAS;QAAE,SAAS,GAAG,MAAM,CAAC;SAChE,IAAI,KAAK,CAAC,cAAc,IAAI,aAAa,IAAI,WAAW,CAAC,GAAG,CAAC,aAAa,CAAC;QAAE,SAAS,GAAG,MAAM,CAAC;SAChG,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,SAAS,KAAK,KAAK;QAAE,SAAS,GAAG,MAAM,CAAC;IAE/E,wEAAwE;IACxE,mEAAmE;IACnE,IAAI,OAAO,GAAe,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAC5E,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,mDAAmD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3G,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;QACzB,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,cAAc,KAAK,KAAK,CAAC,IAAI,cAAc;YAAE,OAAO,GAAG,MAAM,CAAC;aACjI,IAAI,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,UAAU,KAAK,KAAK;YAAE,OAAO,GAAG,MAAM,CAAC;aACvE,IAAI,KAAK,CAAC,eAAe,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,GAAG,iBAAiB,CAAC;IAC/G,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAErC,MAAM,MAAM,GAAG;QACb,SAAS;QACT,UAAU,EAAE,SAAS;QACrB,eAAe,EAAE,OAAO;QACxB,aAAa,EAAE,YAAY;QAC3B,MAAM;QACN,KAAK;KACN,CAAC;IAEF,MAAM,MAAM,GAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAA6B,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,CAAC;IAC1G,MAAM,SAAS,GAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAA6B,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,iBAAiB,CAAC,CAAC;IAExH,IAAI,MAAM,GAAkB,UAAU,CAAC;IACvC,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,GAAG,SAAS,CAAC;QACnB,MAAM,GAAG,UAAU,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACvF,CAAC;SAAM,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,GAAG,iBAAiB,CAAC;QAC3B,MAAM,GAAG,eAAe,CAAC,SAAS,EAAE,aAAa,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,EAAE,MAAM,CAAC,CAAC;IACtF,CAAC;IAED,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,SAAS,GAAc,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtF,OAAO;QACL,MAAM;QACN,SAAS;QACT,MAAM;QACN,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QACnC,UAAU,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QACnC,eAAe,EAAE,KAAK,CAAC,cAAc,IAAI,IAAI;QAC7C,MAAM;QACN,OAAO,EAAE;YACP,MAAM,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;YACnC,SAAS,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;YACpC,WAAW,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;YACvC,KAAK,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;SACjC;QACD,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI;QACtB,QAAQ,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;KAC7D,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAmB;IAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,IAAI,qBAAqB,CAAC;IAC3D,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACpD,MAAM,KAAK,GAAe,iBAAiB,CAAC;IAC5C,OAAO;QACL,MAAM,EAAE,iBAAiB;QACzB,SAAS,EAAE,CAAC;QACZ,MAAM;QACN,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,UAAU,EAAE,IAAI;QAChB,UAAU,EAAE,IAAI;QAChB,eAAe,EAAE,IAAI;QACrB,MAAM,EAAE;YACN,SAAS,EAAE,KAAK;YAChB,UAAU,EAAE,KAAK;YACjB,eAAe,EAAE,KAAK;YACtB,aAAa,EAAE,KAAK;YACpB,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,KAAK;SACb;QACD,OAAO,EAAE;YACP,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,IAAI;YACjB,KAAK,EAAE,IAAI;SACZ;QACD,GAAG,EAAE,IAAI;QACT,QAAQ,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE;KAC7D,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CACjB,MAAgB,EAChB,aAA4B,EAC5B,SAAwB,EACxB,MAAgB,EAChB,OAAmB;IAEnB,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAAC;YAAE,OAAO,4BAA4B,CAAC;QACvF,IAAI,MAAM,CAAC,QAAQ,CAAC,0BAA0B,CAAC;YAAE,OAAO,0BAA0B,CAAC;QACnF,IAAI,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,0BAA0B,CAAC;YAAE,OAAO,kBAAkB,CAAC;QAClH,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,eAAe,CAAC,IAAI,mBAAmB,CAAC;IAC9G,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,aAAa,IAAI,YAAY,CAAC;IACxE,IAAI,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,kBAAkB,CAAC;IACxF,IAAI,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACrC,IAAI,SAAS,KAAK,YAAY;YAAE,OAAO,YAAY,CAAC;QACpD,OAAO,SAAS,IAAI,eAAe,CAAC;IACtC,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,IAAI,QAAQ,CAAC;IAC5D,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,eAAe,CACtB,SAAmB,EACnB,aAA4B,EAC5B,SAAwB,EACxB,MAAgB;IAEhB,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAC;QAAE,OAAO,qBAAqB,CAAC;IACxG,IAAI,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,aAAa,IAAI,oBAAoB,CAAC;IACnF,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,qBAAqB,CAAC;IAClE,IAAI,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,IAAI,iBAAiB,CAAC;IAC/G,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,SAAgB,WAAW,CAAC,OAAsB,EAAE,aAA6B;IAC/E,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC;IACrD,IAAI,OAAO,CAAC,MAAM,KAAK,YAAY;QAAE,OAAO,YAAY,CAAC;IACzD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACnD,IAAI,aAAa,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,gBAAgB;QAAE,OAAO,SAAS,CAAC;IACzH,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAClD,OAAO,iBAAiB,CAAC;AAC3B,CAAC;AAED,2EAA2E;AAC3E,SAAgB,gBAAgB,CAAC,MAAc;IAC7C,IAAI,MAAM,KAAK,eAAe;QAAE,OAAO,eAAe,CAAC;IACvD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,SAAgB,iBAAiB,CAAC,OAAsB;IACtD,MAAM,KAAK,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,SAAS,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC7D,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,4CAA4C,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/G,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAClE,KAAK,CAAC,IAAI,CAAC,yBAAyB,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,OAAO,CAAC,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACU,QAAA,mBAAmB,GAAG;IACjC,YAAY;IACZ,4BAA4B;IAC5B,qBAAqB;IACrB,oBAAoB;IACpB,qBAAqB;IACrB,iBAAiB;IACjB,oBAAoB;IACpB,gBAAgB;IAChB,SAAS;IACT,uBAAuB;IACvB,6BAA6B;IAC7B,0BAA0B;IAC1B,wBAAwB;IACxB,mBAAmB;IACnB,oBAAoB;IACpB,mBAAmB;IACnB,oBAAoB;IACpB,wBAAwB;IACxB,6BAA6B;IAC7B,4BAA4B;IAC5B,iCAAiC;IACjC,6BAA6B;IAC7B,8BAA8B;IAC9B,mBAAmB;IACnB,eAAe;IACf,YAAY;IACZ,kBAAkB;IAClB,aAAa;IACb,4BAA4B;IAC5B,0BAA0B;IAC1B,kBAAkB;IAClB,eAAe;IACf,QAAQ;IACR,SAAS;IACT,qBAAqB;IACrB,iBAAiB;IACjB,oBAAoB;IACpB,qBAAqB;IACrB,oBAAoB;IACpB,0BAA0B;IAC1B,sBAAsB;IACtB,wBAAwB;IACxB,wBAAwB;IACxB,sBAAsB;IACtB,oBAAoB;IACpB,kBAAkB;IAClB,eAAe;CACP,CAAC"}

package/issuer-history.snapshot.json

@@ -0,0 +1 @@
+{"canonicalization":"Each entry_hash is SHA-256 of the JCS (RFC 8785) UTF-8 bytes of the entry without entry_hash. prev_hash is the previous entry_hash, or null on the first entry. The current issuer key signs head_hash and entry_count. A sealed snapshot also signs version and seq. SHA-256 of the JCS bytes of the whole document is the snapshot hash a receipt pins.","entries":[{"alg":"ES256","entry_hash":"349d7bb495bad55aaa25d05ee91134575e6e7d300795b37b41f4bcf29af80f0e","jwk":{"alg":"ES256","crv":"P-256","kid":"IvFpmC-vPhkY_v0vidsrWVT9uzlE5XWKZgAEOeJTq1Q","kty":"EC","use":"sig","x":"_H7J9niXF2tez_MnF25pnrDN7iJ_VC9gBzYYW9gzSPk","y":"jiorfRc9wtNaRmaFHsQaXNzcWteUA0RnpvD4SWdVl34"},"kid":"IvFpmC-vPhkY_v0vidsrWVT9uzlE5XWKZgAEOeJTq1Q","not_after":null,"not_before":"2026-09-04T08:52:05Z","prev_hash":null,"reason":null,"revoked_at":null,"status":"active"}],"head_hash":"349d7bb495bad55aaa25d05ee91134575e6e7d300795b37b41f4bcf29af80f0e","issuer_signature":{"alg":"ES256","issuer_jwk":{"alg":"ES256","crv":"P-256","kid":"IvFpmC-vPhkY_v0vidsrWVT9uzlE5XWKZgAEOeJTq1Q","kty":"EC","use":"sig","x":"_H7J9niXF2tez_MnF25pnrDN7iJ_VC9gBzYYW9gzSPk","y":"jiorfRc9wtNaRmaFHsQaXNzcWteUA0RnpvD4SWdVl34"},"jws":"eyJhbGciOiJFUzI1NiIsInR5cCI6ImNoaXQ0MDItaXNzdWVyLWhpc3Rvcnkrand0Iiwia2lkIjoiSXZGcG1DLXZQaGtZX3Ywdmlkc3JXVlQ5dXpsRTVYV0taZ0FFT2VKVHExUSJ9.eyJzY2hlbWEiOiJjaGl0NDAyLmlzc3Vlcl9oaXN0b3J5LnYxIiwicGF5bG9hZF92ZXJzaW9uIjoxLCJlbnRyeV9jb3VudCI6MSwiaGVhZF9oYXNoIjoiMzQ5ZDdiYjQ5NWJhZDU1YWFhMjVkMDVlZTkxMTM0NTc1ZTZlN2QzMDA3OTViMzdiNDFmNGJjZjI5YWY4MGYwZSIsInZlcnNpb24iOjIsInNlcSI6Mn0.YHgulY1FLf_wZrxafAkqQr2rrT-lVbU8TCuNrIHPDp0M7k7L0BJteUhQQuNI7HrS-jqN1cOXzwYJ_3LabmxADw","kid":"IvFpmC-vPhkY_v0vidsrWVT9uzlE5XWKZgAEOeJTq1Q","payload_version":1,"typ":"chit402-issuer-history+jwt"},"not_before_note":"Only kid IvFpmC-vPhkY_v0vidsrWVT9uzlE5XWKZgAEOeJTq1Q defaults not_before to 2026-09-04T08:52:05Z, the first deployment of this ES256 issuer path. The earliest receipt in the repo signed by that kid is 2026-09-26T17:27:32Z (fixture chit-5d775d12). Any other kid uses its history entry or ISSUER_KEY_NOT_BEFORE. A null not_before is unknown and the window check fails closed.","payload_version":1,"schema":"chit402.issuer_history.v1","seq":2,"version":2}

package/package.json

@@ -1,59 +1,70 @@
-{
-  "name": "chit402-verify",
-  "version": "0.3.4",
-  "description": "Chit402 receipt verification — verify payment binding and output commitment offline.",
-  "main": "./index.js",
-  "types": "./index.d.ts",
-  "bin": {
-    "chit402-verify": "cli.js"
-  },
-  "exports": {
-    ".": {
-      "types": "./index.d.ts",
-      "import": "./index.js",
-      "require": "./index.cjs"
-    }
-  },
-  "sideEffects": false,
-  "engines": {
-    "node": ">=18"
-  },
-  "files": [
-    "index.js",
-    "index.cjs",
-    "index.d.ts",
-    "cli.js",
-    "README.md",
-    "LICENSE"
-  ],
-  "publishConfig": {
-    "access": "public"
-  },
-  "scripts": {
-    "test": "node test.mjs"
-  },
-  "keywords": [
-    "chit402",
-    "verify",
-    "receipt",
-    "x402",
-    "usdc",
-    "base",
-    "offline",
-    "zk"
-  ],
-  "author": "XFuel Lab",
-  "license": "Apache-2.0",
-  "homepage": "https://chit402.com",
-  "bugs": {
-    "url": "https://github.com/XFuel-Lab/chit402/issues"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/XFuel-Lab/chit402.git",
-    "directory": "packages/aliases/chit402-verify"
-  },
-  "dependencies": {
-    "@xfuel/verify": "^0.3.4"
-  }
-}
+{
+  "name": "chit402-verify",
+  "version": "0.4.0",
+  "description": "Offline verification for Chit402 receipts — verify payment binding and output hash without calling the API",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "bin": {
+    "chit402-verify": "dist/cli.js",
+    "xfuel-verify": "dist/cli.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.js"
+    },
+    "./cli": "./dist/cli.js",
+    "./dist/cli.js": "./dist/cli.js"
+  },
+  "sideEffects": false,
+  "engines": {
+    "node": ">=18"
+  },
+  "files": [
+    "dist",
+    "issuer-history.snapshot.json",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "homepage": "https://github.com/XFuel-Lab/chit402/tree/main/packages/verify#readme",
+  "bugs": {
+    "url": "https://github.com/XFuel-Lab/chit402/issues"
+  },
+  "scripts": {
+    "build": "tsc",
+    "digest": "node scripts/build-digest.mjs",
+    "test": "npm run build && node --test --test-concurrency=1 test/*.test.mjs",
+    "prepack": "npm run build",
+    "prepublishOnly": "npm run build && npm test"
+  },
+  "keywords": [
+    "chit402",
+    "xfuel",
+    "verify",
+    "receipt",
+    "x402",
+    "usdc",
+    "base",
+    "offline",
+    "zk"
+  ],
+  "author": "XFuel Lab",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/XFuel-Lab/chit402.git",
+    "directory": "packages/verify"
+  },
+  "dependencies": {
+    "ethers": "^6.16.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "typescript": "^5.9.3"
+  }
+}

package/cli.js

@@ -1,27 +0,0 @@
-#!/usr/bin/env node
-/**
- * chit402-verify CLI — Chit402 receipt verification
- *
- * This is the public-facing CLI. Internally it runs @xfuel/verify.
- */
-import { createRequire } from 'node:module';
-import { spawn } from 'node:child_process';
-
-const require = createRequire(import.meta.url);
-// Resolve via the package exports map. Deep imports of dist/cli.js throw
-// ERR_PACKAGE_PATH_NOT_EXPORTED unless @xfuel/verify lists that subpath.
-const verifyCliPath = require.resolve('@xfuel/verify/dist/cli.js');
-
-const child = spawn(process.execPath, [verifyCliPath, ...process.argv.slice(2)], {
-  stdio: 'inherit',
-  env: process.env,
-});
-
-child.on('exit', (code) => {
-  process.exit(code ?? 0);
-});
-
-child.on('error', (err) => {
-  console.error('Failed to start chit402-verify:', err.message);
-  process.exit(1);
-});

package/index.cjs

@@ -1,8 +0,0 @@
-/**
- * chit402-verify — Chit402 receipt verification re-export (CommonJS)
- */
-'use strict';
-
-const verify = require('@xfuel/verify');
-module.exports = verify;
-module.exports.default = verify.default;

package/index.d.ts

@@ -1,5 +0,0 @@
-/**
- * chit402-verify — Chit402 receipt verification type re-exports
- */
-export * from '@xfuel/verify';
-export { default } from '@xfuel/verify';

package/index.js

@@ -1,7 +0,0 @@
-/**
- * chit402-verify — Chit402 receipt verification re-export
- *
- * Verify payment binding and output commitment offline.
- */
-export * from '@xfuel/verify';
-export { default } from '@xfuel/verify';