chit402-verify 0.3.4 → 0.4.0

package/dist/cli.js

@@ -0,0 +1,2090 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * xfuel-verify CLI — Offline receipt verification.
+ *
+ * Usage:
+ *   xfuel-verify receipt.json
+ *   xfuel-verify receipt.json --check-nullifier
+ *   xfuel-verify receipt.json --rpc https://mainnet.base.org
+ *   xfuel-verify receipt.json inclusion.json head.json --rpc
+ *   cat receipt.json | xfuel-verify -
+ *
+ * Exit codes:
+ *   0 = VERIFIED (every check passed)
+ *   1 = INVALID
+ *   2 = COULD_NOT_CHECK
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_module_1 = require("node:module");
+const node_fs_1 = require("node:fs");
+const index_js_1 = require("./index.js");
+const anchor_witness_js_1 = require("./anchor-witness.js");
+const jws_js_1 = require("./jws.js");
+const shell_js_1 = require("./shell.js");
+const preimage_js_1 = require("./preimage.js");
+const issuer_history_js_1 = require("./issuer-history.js");
+const base_payer_js_1 = require("./base-payer.js");
+const solana_payer_js_1 = require("./solana-payer.js");
+const verdict_js_1 = require("./verdict.js");
+const canonical_preimage_js_1 = require("./canonical-preimage.js");
+const v11_receipt_js_1 = require("./v11-receipt.js");
+const receipt_version_js_1 = require("./receipt-version.js");
+const issuer_pin_js_1 = require("./issuer-pin.js");
+const anchor_trust_js_1 = require("./anchor-trust.js");
+const HELP = `
+chit402-verify — verify a Chit402 receipt
+
+Usage:
+  chit402-verify <id|url|receipt.json>
+  chit402-verify - < receipt.json
+  chit402-verify <receipt.json> --issuer-history <history.json>
+  chit402-verify <receipt.json> --json
+
+Exit codes:
+  0  VERIFIED           every check passed
+  1  INVALID            tamper, bad signature, revoked key, NOT_IN_LOG
+  2  COULD_NOT_CHECK    log or anchor was not checked
+
+Flags:
+  --issuer-history <file>   History that prefix-extends the bundled snapshot
+  --json                    Print the verdict JSON
+  --help
+  --version
+
+${(0, receipt_version_js_1.formatSupportedReceiptVersions)()}
+`;
+function parseArgs(args) {
+    const result = {
+        file: null,
+        jwksFile: null,
+        jwksUrl: null,
+        fetchJwks: false,
+        trustedKids: null,
+        noTrustedKid: false,
+        checkNullifier: false,
+        checkPayer: false,
+        rpcUrl: null,
+        solanaRpcUrl: null,
+        sawRpc: false,
+        anchorFlag: false,
+        inclusionFile: null,
+        headFile: null,
+        epochRecordFile: null,
+        epochUrl: null,
+        carryOldHeadFile: null,
+        carryOldInclusionFile: null,
+        carryHeadFile: null,
+        carryInclusionFiles: [],
+        positionals: [],
+        json: false,
+        quiet: false,
+        help: false,
+        strictIssuerHistory: false,
+        issuerHistoryFile: null,
+        canonicalPreimageFile: null,
+        noIssuerHistory: false,
+        strict: false,
+        noPreimage: false,
+        issuerPinFile: null,
+        issuerPinCommit: null,
+        issuerPinSha256: null,
+        issuerPinSigFile: null,
+        issuerWitnessesFile: null,
+        issuerPriorPinFile: null,
+        issuerPriorCommit: null,
+        issuerPriorSha256: null,
+        issuerControlFile: null,
+        version: false,
+        anchorWalletsFile: null,
+        acceptShell: false,
+        jwsFile: null,
+        salt: null,
+        open: [],
+        url: null,
+    };
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === '--version' || arg === '-V') {
+            result.version = true;
+        }
+        else if (arg === '--help' || arg === '-h') {
+            result.help = true;
+        }
+        else if (arg === '--check-nullifier') {
+            result.checkNullifier = true;
+        }
+        else if (arg === '--check-payer') {
+            result.checkPayer = true;
+        }
+        else if (arg === '--jwks-file' && args[i + 1]) {
+            result.jwksFile = args[++i];
+        }
+        else if (arg === '--jwks-url' && args[i + 1]) {
+            result.jwksUrl = args[++i];
+        }
+        else if (arg === '--fetch-jwks') {
+            result.fetchJwks = true;
+        }
+        else if (arg === '--trusted-kid' && args[i + 1]) {
+            result.trustedKids = result.trustedKids || [];
+            result.trustedKids.push(args[++i]);
+        }
+        else if (arg === '--no-trusted-kid') {
+            result.noTrustedKid = true;
+        }
+        else if (arg === '--rpc') {
+            result.sawRpc = true;
+            const next = args[i + 1];
+            if (next && /^https?:\/\//i.test(next))
+                result.rpcUrl = args[++i];
+            else
+                result.anchorFlag = true;
+        }
+        else if (arg === '--inclusion' && args[i + 1]) {
+            result.inclusionFile = args[++i];
+        }
+        else if (arg === '--head' && args[i + 1]) {
+            result.headFile = args[++i];
+        }
+        else if (arg === '--epoch-record' && args[i + 1]) {
+            result.epochRecordFile = args[++i];
+        }
+        else if (arg === '--epoch-url' && args[i + 1]) {
+            result.epochUrl = args[++i];
+        }
+        else if (arg === '--carry-old-head' && args[i + 1]) {
+            result.carryOldHeadFile = args[++i];
+        }
+        else if (arg === '--carry-old-inclusion' && args[i + 1]) {
+            result.carryOldInclusionFile = args[++i];
+        }
+        else if (arg === '--carry-head' && args[i + 1]) {
+            result.carryHeadFile = args[++i];
+        }
+        else if (arg === '--carry-inclusion' && args[i + 1]) {
+            result.carryInclusionFiles.push(args[++i]);
+        }
+        else if (arg === '--solana-rpc' && args[i + 1]) {
+            result.solanaRpcUrl = args[++i];
+        }
+        else if (arg === '--issuer-history' && args[i + 1]) {
+            result.issuerHistoryFile = args[++i];
+        }
+        else if (arg === '--salt' && args[i + 1]) {
+            result.salt = args[++i];
+        }
+        else if (arg === '--open' && args[i + 1]) {
+            result.open.push(args[++i]);
+        }
+        else if (arg === '--canonical-preimage' && args[i + 1]) {
+            result.canonicalPreimageFile = args[++i];
+        }
+        else if (arg === '--anchor-wallets-file' && args[i + 1]) {
+            result.anchorWalletsFile = args[++i];
+        }
+        else if (arg === '--no-preimage') {
+            result.noPreimage = true;
+        }
+        else if (arg === '--jws' && args[i + 1]) {
+            result.jwsFile = args[++i];
+        }
+        else if (arg === '--url' && args[i + 1]) {
+            result.url = args[++i];
+        }
+        else if (arg === '--issuer-pin' && args[i + 1]) {
+            result.issuerPinFile = args[++i];
+        }
+        else if (arg === '--issuer-pin-commit' && args[i + 1]) {
+            result.issuerPinCommit = args[++i];
+        }
+        else if (arg === '--issuer-pin-sha256' && args[i + 1]) {
+            result.issuerPinSha256 = args[++i];
+        }
+        else if (arg === '--issuer-pin-sig' && args[i + 1]) {
+            result.issuerPinSigFile = args[++i];
+        }
+        else if (arg === '--issuer-witnesses' && args[i + 1]) {
+            result.issuerWitnessesFile = args[++i];
+        }
+        else if (arg === '--issuer-prior-pin' && args[i + 1]) {
+            result.issuerPriorPinFile = args[++i];
+        }
+        else if (arg === '--issuer-prior-commit' && args[i + 1]) {
+            result.issuerPriorCommit = args[++i];
+        }
+        else if (arg === '--issuer-prior-sha256' && args[i + 1]) {
+            result.issuerPriorSha256 = args[++i];
+        }
+        else if (arg === '--issuer-control' && args[i + 1]) {
+            result.issuerControlFile = args[++i];
+        }
+        else if (arg === '--json') {
+            result.json = true;
+        }
+        else if (arg === '--quiet' || arg === '-q') {
+            result.quiet = true;
+        }
+        else if (!arg.startsWith('-')) {
+            result.positionals.push(arg);
+            if (!result.file)
+                result.file = arg;
+        }
+    }
+    return result;
+}
+function readReceipt(file) {
+    let content;
+    if (file === '-') {
+        content = (0, node_fs_1.readFileSync)(0, 'utf8');
+    }
+    else {
+        content = (0, node_fs_1.readFileSync)(file, 'utf8');
+    }
+    return JSON.parse(content);
+}
+function formatAmount(units) {
+    if (!units)
+        return '—';
+    const n = Number(units);
+    if (!Number.isFinite(n))
+        return units;
+    const usd = n / 1e6;
+    return `$${usd.toFixed(usd >= 0.01 ? 2 : 6)} (${units} units)`;
+}
+function readJson(file) {
+    const content = file === '-' ? (0, node_fs_1.readFileSync)(0, 'utf8') : (0, node_fs_1.readFileSync)(file, 'utf8');
+    return JSON.parse(content);
+}
+function headStatus(file) {
+    try {
+        const doc = readJson(file);
+        return typeof doc?.status === 'string' ? doc.status : null;
+    }
+    catch {
+        return null;
+    }
+}
+function printLane(lane) {
+    const bit = (value) => (value == null ? 'unknown' : (value ? 'true' : 'false'));
+    console.log(`  Receipt lane (unsigned)`);
+    console.log(`  ─────────────────────────────────────────────────`);
+    console.log(`  book_seq:      ${lane.book_seq ?? '—'}`);
+    console.log(`  settled_by:    ${lane.settled_by ?? 'null'}`);
+    console.log(`  settled:       ${bit(lane.settled)}`);
+    console.log(`  anchor_changed_since_binding: ${bit(lane.anchor_changed_since_binding)}`);
+    console.log(`  freeze:        ${lane.freeze ? 'YES' : 'no'}`);
+    if (lane.reason)
+        console.log(`  reason:        ${lane.reason}`);
+    console.log(`  classification:${lane.classification}`);
+    console.log(`  ordering:      ${lane.ordering}`);
+    console.log(`  boundary:      ${lane.boundary}`);
+    if (lane.local_check) {
+        console.log(`  local_check:   payee ${lane.local_check.payee} amount ${lane.local_check.amount_atomic} (not a payment)`);
+    }
+    console.log(`  ${lane.rule}`);
+    console.log('');
+}
+function printAnchor(result, json, quiet, overallLabel) {
+    if (json) {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    if (quiet && result.overall !== 'failed' && result.overall !== 'not_in_log')
+        return;
+    const mark = (ok) => (ok ? '✓ YES' : '✗ NO');
+    console.log('');
+    console.log('  Anchored receipt root');
+    console.log('  ─────────────────────────────────────────────────');
+    console.log(`  Root:          ${result.root || '—'}`);
+    console.log(`  Head signature:${result.head_signature.valid ? ' ✓ YES' : ' ✗ NO'}${result.head_signature.trust ? ` (${result.head_signature.trust})` : ''}`);
+    if (result.head_signature.kid)
+        console.log(`  Head kid:      ${result.head_signature.kid}`);
+    if (result.head_signature.message)
+        console.log(`  Head reason:   ${result.head_signature.message}`);
+    const unlogged = result.inclusion.unlogged_reason ? ` unlogged:${result.inclusion.unlogged_reason}` : '';
+    if (result.overall === 'pending') {
+        console.log(`  Inclusion:     PENDING${result.inclusion.reason ? ` (${result.inclusion.reason})` : ''}`);
+    }
+    else {
+        console.log(`  Inclusion:     ${mark(result.inclusion.valid)}${result.inclusion.reason ? ` (${result.inclusion.reason})` : ''}${unlogged}`);
+    }
+    console.log(`  Leaf source:   ${result.inclusion.leaf_source}`);
+    console.log(`  Solana:        ${result.solana.checked ? mark(result.solana.valid) : (result.solana.reason || 'not checked')}`);
+    if (result.solana.signature)
+        console.log(`  Signature:     ${result.solana.signature}`);
+    if (result.solana.slot != null)
+        console.log(`  Slot:          ${result.solana.slot}`);
+    if (result.solana.cluster)
+        console.log(`  Cluster:       ${result.solana.cluster}`);
+    if (result.solana.fee_payer)
+        console.log(`  Fee payer:     ${result.solana.fee_payer}`);
+    if (result.solana.memo)
+        console.log(`  Memo:          ${result.solana.memo}`);
+    if (result.solana.reason && !result.solana.valid)
+        console.log(`  Solana reason: ${result.solana.reason}`);
+    if (result.issuer_pin?.checked) {
+        console.log(`  Issuer pin:    ${result.issuer_pin.ok ? '✓ YES' : '✗ NO'}${result.issuer_pin.code ? ` (${result.issuer_pin.code})` : ''}`);
+    }
+    console.log(`  Base:          ${result.base.checked ? mark(result.base.valid) : (result.base.reason || 'not checked')}`);
+    if (result.base.from)
+        console.log(`  Base from:     ${result.base.from}`);
+    if (result.base.tx)
+        console.log(`  Base tx:       ${result.base.tx}`);
+    if (result.base.chain_id != null)
+        console.log(`  Chain id:      ${result.base.chain_id}`);
+    if (result.base.reason && !result.base.valid)
+        console.log(`  Base reason:   ${result.base.reason}`);
+    console.log('');
+    if (result.overall !== 'failed' && result.overall !== 'not_in_log') {
+        console.log('  What this proves');
+        console.log('  ─────────────────────────────────────────────────');
+        for (const line of result.proves)
+            console.log(`  ${line}`);
+        console.log('');
+    }
+    console.log('  What this does not prove');
+    console.log('  ─────────────────────────────────────────────────');
+    for (const line of result.does_not_prove)
+        console.log(`  ${line}`);
+    console.log('');
+    if (result.overall === 'pending') {
+        console.log(`  Anchored size: ${result.inclusion.anchored_tree_size ?? '—'}`);
+        console.log(`  Live size:     ${result.inclusion.live_tree_size ?? '—'}`);
+    }
+    console.log(`  Overall: ${overallLabel || result.overall.toUpperCase()}`);
+    if (result.errors.length > 0)
+        console.log(`  Errors:  ${result.errors.join(', ')}`);
+    if (result.errors.includes(anchor_trust_js_1.LEGACY_HEAD_UNPINNED_SIGNER)) {
+        console.log(`  ${anchor_trust_js_1.HEAD_TRUST_MESSAGES[anchor_trust_js_1.LEGACY_HEAD_UNPINNED_SIGNER]}`);
+    }
+    console.log('');
+}
+function headNeedsEpochRecord(head) {
+    const schema = head.schema;
+    const version = head.payload_version;
+    return head.epoch != null || schema === 'chit402.tree_head.v2' || version === 2;
+}
+function epochUrlFromReceipt(receipt) {
+    const raw = receipt?.verify_url;
+    if (!raw)
+        return null;
+    try {
+        return `${new URL(raw).origin}/v1/receipts/tree/epoch`;
+    }
+    catch {
+        return null;
+    }
+}
+async function loadEpochRecord(args, receipt) {
+    if (args.epochRecordFile) {
+        return JSON.parse((0, node_fs_1.readFileSync)(args.epochRecordFile, 'utf8'));
+    }
+    const url = args.epochUrl || epochUrlFromReceipt(receipt);
+    if (!url)
+        return null;
+    const res = await fetch(url);
+    if (!res.ok)
+        return null;
+    const body = await res.json();
+    if (!body?.issuer_signature?.jws)
+        return null;
+    return body;
+}
+function epochSignatureOk(record, jws, jwks, trustedKids) {
+    const sig = record.issuer_signature;
+    const embedded = sig && 'issuer_jwk' in sig
+        ? sig.issuer_jwk
+        : undefined;
+    const kid = (0, jws_js_1.readJwsHeader)(jws)?.kid;
+    const keys = [];
+    for (const key of jwks?.keys || []) {
+        if (!key || key.kty !== 'EC')
+            continue;
+        const jwk = key;
+        if (kid && jwk.kid !== kid)
+            continue;
+        keys.push(jwk);
+    }
+    if (embedded && trustedKids?.includes((0, jws_js_1.jwkThumbprint)(embedded)))
+        keys.push(embedded);
+    for (const key of keys) {
+        const verified = (0, jws_js_1.verifyIssuerJws)(jws, key);
+        if (!verified.valid || !verified.payload)
+            continue;
+        const payload = verified.payload;
+        if (JSON.stringify(payload.epochs ?? null) !== JSON.stringify(record.epochs ?? null))
+            return false;
+        if (JSON.stringify(payload.orphans ?? []) !== JSON.stringify(record.orphans ?? []))
+            return false;
+        const payloadUnlogged = payload.unlogged === undefined ? null : payload.unlogged;
+        const recordUnlogged = record.unlogged === undefined ? null : record.unlogged;
+        if (JSON.stringify(payloadUnlogged) !== JSON.stringify(recordUnlogged))
+            return false;
+        return true;
+    }
+    return false;
+}
+function packageVersion() {
+    const require = (0, node_module_1.createRequire)(__filename);
+    const pkg = require('../package.json');
+    return pkg.version || '0.0.0';
+}
+const REMOVED_040 = {
+    '--strict': 'removed in 0.4: a skipped key window is no longer a separate result',
+    '--no-issuer-history': 'removed in 0.4: the history check is always on',
+    '--accept-no-key-window': 'removed in 0.4: VERIFIED_NO_KEY_WINDOW is retired',
+    '--accept-shell': 'removed in 0.4: a shell is not a verified payment',
+};
+function removedFlag(argv) {
+    for (const arg of argv) {
+        if (REMOVED_040[arg])
+            return REMOVED_040[arg];
+    }
+    return null;
+}
+async function resolvedHistory(args, receipt, jwks, trustedKids) {
+    const fileBytes = args.issuerHistoryFile ? (0, node_fs_1.readFileSync)(args.issuerHistoryFile, 'utf8') : null;
+    return (0, issuer_history_js_1.resolveIssuerHistory)({
+        fileBytes,
+        receipt,
+        jwks,
+        trustedKids,
+    });
+}
+function historyOptions(resolved) {
+    return {
+        issuerHistory: resolved.document,
+        issuerHistoryBytes: resolved.bytes,
+        fetchIssuerHistory: false,
+        skipIssuerHistory: false,
+        strictIssuerHistory: false,
+        labelSkippedKeyWindow: false,
+    };
+}
+function printVerdict(json, verdict, legacy, legacyOverall) {
+    const line = (0, verdict_js_1.overallLine)(verdict, legacyOverall);
+    if (json) {
+        const overall = line === 'NOT_IN_LOG'
+            ? 'not_in_log'
+            : line === 'VERIFIED_CARRIED_FORWARD'
+                ? 'verified_carried_forward'
+                : line === 'PENDING'
+                    ? 'pending'
+                    : line === 'PARTIAL'
+                        ? 'partial'
+                        : line === 'VERIFIED'
+                            ? 'verified'
+                            : line === 'COULD_NOT_CHECK'
+                                ? 'could_not_check'
+                                : 'failed';
+        console.log(JSON.stringify({ ...(legacy || {}), ...verdict, overall }, null, 2));
+    }
+    else {
+        console.log(`  Overall: ${line}`);
+        console.log(`  ${verdict.message}`);
+        if (verdict.history.source === 'bundled' && verdict.history.as_of) {
+            console.log(`  Issuer history: as of ${verdict.history.as_of}`);
+        }
+        if (verdict.next_step)
+            console.log(`  Next: ${verdict.next_step}`);
+    }
+    return verdict.exit_code;
+}
+function looksLikeTreeHead(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const doc = value;
+    if (doc.status === 'not_yet_published')
+        return true;
+    if (typeof doc.schema === 'string' && doc.schema.startsWith('chit402.tree_head.'))
+        return true;
+    return Boolean(doc.anchors && doc.root && !doc.task_id);
+}
+function readOfflineWitness(args) {
+    let head = null;
+    let inclusion = null;
+    for (const file of args.positionals.slice(1)) {
+        let doc;
+        try {
+            doc = readJson(file);
+        }
+        catch (err) {
+            throw new Error(`Error reading ${file}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        const row = doc;
+        if (looksLikeTreeHead(doc))
+            head = doc;
+        else if (doc && typeof doc === 'object' && (Array.isArray(row.proof) || row.leaf_index != null)) {
+            inclusion = doc;
+        }
+    }
+    return { head, inclusion };
+}
+function fileLooksLikeHead(file) {
+    if (!file)
+        return false;
+    try {
+        return looksLikeTreeHead(readJson(file));
+    }
+    catch {
+        return false;
+    }
+}
+const LOG_FETCH_MS = 8000;
+function inclusionHeadUrl(origin, inclusion) {
+    if (typeof inclusion.head_url === 'string' && inclusion.head_url.length > 0) {
+        try {
+            return new URL(inclusion.head_url, origin).toString();
+        }
+        catch {
+            return null;
+        }
+    }
+    const size = inclusion.anchored_tree_size ?? inclusion.tree_size;
+    if (size == null)
+        return null;
+    return `${origin}/v1/receipts/tree/head?tree_size=${encodeURIComponent(String(size))}`;
+}
+function missedLog(reason = 'log_unreachable') {
+    return {
+        logInclusion: 'could_not_check',
+        anchor: 'could_not_check',
+        logReason: reason,
+        log: null,
+    };
+}
+/**
+ * A 404 `{ error: "not_in_tree" }` is unsigned. NOT_IN_LOG also needs the
+ * log's signed head, and that signature has to verify. A head with no
+ * signature leaves the check unfinished.
+ */
+async function absenceAgainstSignedHead(origin, history) {
+    try {
+        const res = await fetch(`${origin}/v1/receipts/tree/head`, {
+            headers: { accept: 'application/json' },
+            signal: AbortSignal.timeout(LOG_FETCH_MS),
+        });
+        if (!res.ok)
+            return { kind: 'unchecked' };
+        const head = await res.json();
+        const trust = (0, anchor_trust_js_1.verifyTreeHeadTrust)(head, {
+            trustedKids: index_js_1.DEFAULT_TRUSTED_ISSUER_KIDS,
+            issuerHistory: history,
+        });
+        if (trust.ok)
+            return { kind: 'not_in_log' };
+        if (!trust.reason || trust.reason === 'head_signature_missing')
+            return { kind: 'unchecked' };
+        return { kind: 'bad_head', reason: trust.reason };
+    }
+    catch {
+        return { kind: 'unchecked' };
+    }
+}
+function hardLogReason(result) {
+    if (result.head_signature?.checked && result.head_signature.valid === false && result.head_signature.reason) {
+        return result.head_signature.reason;
+    }
+    const inclusionReason = result.inclusion?.reason;
+    if (result.inclusion
+        && result.inclusion.valid === false
+        && inclusionReason
+        && inclusionReason !== 'pending_anchor'
+        && inclusionReason !== 'not_in_tree') {
+        return inclusionReason;
+    }
+    const mismatch = (result.errors || []).find((err) => (/mismatch|head_signature|head_claims|head_key|inclusion_failed|bad_root|no_leaf/.test(err)));
+    return mismatch ? mismatch.replace(/^(solana|base):/, '') : null;
+}
+/** Shell absence check. A 200 proof is not verified here: there is no signed receipt. */
+async function publicShellAbsence(receipt, history) {
+    try {
+        const origin = new URL(String(receipt.verify_url)).origin;
+        const task = receipt.task_id;
+        if (!task)
+            return false;
+        const res = await fetch(`${origin}/v1/receipts/${encodeURIComponent(String(task))}/inclusion`, {
+            headers: { accept: 'application/json' },
+            signal: AbortSignal.timeout(LOG_FETCH_MS),
+        });
+        if (res.status !== 404)
+            return false;
+        const body = await res.json().catch(() => ({}));
+        if (body.error !== 'not_in_tree' && body.reason !== 'not_in_tree')
+            return false;
+        const absence = await absenceAgainstSignedHead(origin, history);
+        return absence.kind === 'not_in_log';
+    }
+    catch {
+        return false;
+    }
+}
+async function freshPublicLog(receipt, history = null) {
+    const missed = missedLog();
+    try {
+        const origin = new URL(String(receipt.verify_url)).origin;
+        const task = receipt.task_id;
+        if (!task)
+            return missed;
+        const res = await fetch(`${origin}/v1/receipts/${encodeURIComponent(String(task))}/inclusion`, {
+            headers: { accept: 'application/json' },
+            signal: AbortSignal.timeout(LOG_FETCH_MS),
+        });
+        if (res.status === 404) {
+            const body = await res.json().catch(() => ({}));
+            if (body.error !== 'not_in_tree' && body.reason !== 'not_in_tree')
+                return missed;
+            const absence = await absenceAgainstSignedHead(origin, history);
+            if (absence.kind === 'not_in_log') {
+                return { logInclusion: 'fail', anchor: 'pass', logReason: 'not_in_log', log: null };
+            }
+            if (absence.kind === 'bad_head') {
+                return { logInclusion: 'fail', anchor: 'fail', logReason: absence.reason, log: null };
+            }
+            return missed;
+        }
+        if (!res.ok)
+            return missed;
+        const inclusion = await res.json();
+        const headUrl = inclusionHeadUrl(origin, inclusion);
+        if (!headUrl)
+            return missed;
+        const headRes = await fetch(headUrl, {
+            headers: { accept: 'application/json' },
+            signal: AbortSignal.timeout(LOG_FETCH_MS),
+        });
+        if (!headRes.ok)
+            return missed;
+        const head = await headRes.json();
+        const result = await (0, anchor_witness_js_1.verifyAnchoredRoot)({
+            receipt: receipt,
+            inclusion,
+            head,
+            baseRpcUrl: process.env.BASE_RPC_URL || base_payer_js_1.BASE_RPC_URL,
+            solanaRpcUrl: process.env.SOLANA_RPC_URL || solana_payer_js_1.SOLANA_RPC_URL,
+            checkNewestAnchor: false,
+            issuerHistory: history,
+            trustedKids: index_js_1.DEFAULT_TRUSTED_ISSUER_KIDS,
+        });
+        if (result.overall === 'verified') {
+            return {
+                logInclusion: 'pass',
+                anchor: 'pass',
+                logReason: null,
+                log: {
+                    leaf_index: inclusion.leaf_index ?? null,
+                    tree_size: inclusion.tree_size ?? null,
+                    root: result.root,
+                    anchors: {
+                        base: result.base.tx,
+                        solana: result.solana.signature,
+                    },
+                },
+            };
+        }
+        if (result.overall === 'not_in_log') {
+            return { logInclusion: 'fail', anchor: 'pass', logReason: 'not_in_log', log: null };
+        }
+        if (result.overall === 'pending')
+            return missedLog('pending_anchor');
+        const hard = hardLogReason(result);
+        if (result.overall === 'failed' && hard) {
+            const anchorFail = /head_|anchor|mismatch/.test(hard);
+            const inclusionFail = result.inclusion?.valid === false || /inclusion|leaf|root|no_leaf|bad_root/.test(hard);
+            return {
+                logInclusion: inclusionFail ? 'fail' : 'could_not_check',
+                anchor: anchorFail || !inclusionFail ? 'fail' : 'pass',
+                logReason: hard,
+                log: null,
+            };
+        }
+        return missed;
+    }
+    catch {
+        return missed;
+    }
+}
+function historyHostAllowed(url) {
+    try {
+        const parsed = new URL(url);
+        if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:')
+            return false;
+        if (parsed.protocol === 'http:' && parsed.hostname !== '127.0.0.1' && parsed.hostname !== 'localhost')
+            return false;
+        if (parsed.protocol === 'https:') {
+            return index_js_1.DEFAULT_TRUSTED_JWKS_HOSTS.some((host) => host.toLowerCase() === parsed.hostname.toLowerCase());
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function loadAnchorIssuerHistory(args, receipt, jwks, trustedKids) {
+    return resolvedHistory(args, receipt, jwks, trustedKids);
+}
+async function loadAnchorWalletDocument(args, receipt) {
+    if (args.anchorWalletsFile) {
+        return JSON.parse((0, node_fs_1.readFileSync)(args.anchorWalletsFile, 'utf8'));
+    }
+    const historyUrl = (0, issuer_history_js_1.historyUrlFromReceipt)(receipt);
+    const epochOrigin = (() => {
+        if (!args.epochUrl)
+            return null;
+        try {
+            return new URL(args.epochUrl).origin;
+        }
+        catch {
+            return null;
+        }
+    })();
+    const origin = epochOrigin || (historyUrl ? new URL(historyUrl).origin : null);
+    if (!origin)
+        return null;
+    const url = `${origin}/.well-known/anchor-wallets.json`;
+    if (!historyHostAllowed(url))
+        return null;
+    try {
+        const res = await fetch(url, { signal: AbortSignal.timeout(4000) });
+        if (res.status === 404)
+            return null;
+        if (!res.ok)
+            return null;
+        return await res.json();
+    }
+    catch {
+        return null;
+    }
+}
+function emitVersionFailure(args, errors) {
+    const reason = errors[0] || 'unsupported_version';
+    const unsupported = reason === 'unsupported_version';
+    const verdict = (0, verdict_js_1.buildVerifyVerdict)({
+        version: packageVersion(),
+        errors,
+        signatureChecked: !unsupported,
+        signatureValid: unsupported ? null : false,
+        historyMissing: unsupported,
+        logInclusion: 'unclaimed',
+        anchor: 'unclaimed',
+    });
+    if (!args.json)
+        console.log(reason);
+    return printVerdict(args.json, verdict, {
+        errors,
+        issuer_signature: { valid: false, checked: !unsupported, key_trusted: false, reason },
+        amount_usdc: null,
+        tx: null,
+        payer: { checked: false, valid: false },
+    }, unsupported ? 'could_not_check' : 'failed');
+}
+async function runAnchor(args) {
+    const receiptPath = args.file;
+    const inclusionPath = args.inclusionFile || args.positionals[1] || null;
+    const headPath = args.headFile || (args.inclusionFile ? null : args.positionals[2]) || null;
+    const headCandidates = [args.headFile, headPath, ...args.positionals];
+    if (headCandidates.some((file) => file && headStatus(file) === 'not_yet_published')) {
+        console.error('Tree head is not_yet_published.');
+        return 3;
+    }
+    if (!receiptPath || !inclusionPath || !headPath) {
+        console.error('Anchor check needs a receipt, an inclusion proof, and a tree head.');
+        console.error('  xfuel-verify receipt.json inclusion.json head.json --rpc');
+        return 3;
+    }
+    let receipt;
+    let inclusion;
+    let head;
+    try {
+        receipt = readJson(receiptPath);
+        inclusion = readJson(inclusionPath);
+        head = readJson(headPath);
+    }
+    catch (err) {
+        console.error(`Error reading anchor inputs: ${err instanceof Error ? err.message : String(err)}`);
+        return 3;
+    }
+    const anchorGate = (0, receipt_version_js_1.classifyReceiptDocument)(receipt);
+    if (!anchorGate.ok)
+        return emitVersionFailure(args, anchorGate.errors);
+    let fileJwks;
+    if (args.jwksFile) {
+        try {
+            fileJwks = JSON.parse((0, node_fs_1.readFileSync)(args.jwksFile, 'utf8'));
+        }
+        catch (err) {
+            console.error(`Error reading JWKS file: ${err instanceof Error ? err.message : String(err)}`);
+            return 3;
+        }
+    }
+    const loaded = await (0, index_js_1.loadIssuerJwks)(receipt, {
+        jwks: fileJwks,
+        jwksUri: args.jwksUrl || undefined,
+        fetchJwks: args.fetchJwks,
+    });
+    const trustedKids = args.noTrustedKid
+        ? []
+        : (args.trustedKids ?? [...index_js_1.DEFAULT_TRUSTED_ISSUER_KIDS]);
+    let resolved;
+    let anchorWalletDocument = null;
+    try {
+        resolved = await loadAnchorIssuerHistory(args, receipt, loaded.jwks, trustedKids);
+        anchorWalletDocument = await loadAnchorWalletDocument(args, receipt);
+    }
+    catch (err) {
+        console.error(`Error reading issuer trust files: ${err instanceof Error ? err.message : String(err)}`);
+        return 3;
+    }
+    let epochRecord = null;
+    let verifyEpochSignature;
+    if (headNeedsEpochRecord(head)) {
+        try {
+            epochRecord = await loadEpochRecord(args, receipt);
+        }
+        catch {
+            epochRecord = null;
+        }
+        if (epochRecord?.issuer_signature?.jws) {
+            verifyEpochSignature = (jws) => epochSignatureOk(epochRecord, jws, loaded.jwks, trustedKids);
+        }
+    }
+    let issuerPin;
+    const pinClaim = (0, issuer_pin_js_1.readIssuerPinClaim)(receipt).claimed || (0, issuer_pin_js_1.readIssuerPinClaim)(head).claimed;
+    const pinRequested = Boolean(args.issuerPinFile) || pinClaim;
+    if (pinRequested) {
+        try {
+            const claimRef = (0, issuer_pin_js_1.readIssuerPinClaim)(receipt).ref || (0, issuer_pin_js_1.readIssuerPinClaim)(head).ref;
+            const ref = (args.issuerPinCommit || args.issuerPinSha256 || claimRef)
+                ? {
+                    commit: args.issuerPinCommit || claimRef?.commit || '',
+                    path: claimRef?.path || 'docs/well-known/issuer-key.json',
+                    sha256: (args.issuerPinSha256 || claimRef?.sha256 || '').toLowerCase(),
+                }
+                : null;
+            let witnesses;
+            if (args.issuerWitnessesFile)
+                witnesses = JSON.parse((0, node_fs_1.readFileSync)(args.issuerWitnessesFile, 'utf8'));
+            const priorRef = args.issuerPriorPinFile
+                ? {
+                    commit: args.issuerPriorCommit || '',
+                    path: 'docs/well-known/issuer-key.json',
+                    sha256: (args.issuerPriorSha256 || '').toLowerCase(),
+                }
+                : null;
+            issuerPin = {
+                pinBytes: args.issuerPinFile ? (0, node_fs_1.readFileSync)(args.issuerPinFile, 'utf8') : null,
+                sigBytes: args.issuerPinSigFile ? (0, node_fs_1.readFileSync)(args.issuerPinSigFile, 'utf8') : null,
+                ref,
+                witnesses,
+                priorPinBytes: args.issuerPriorPinFile ? (0, node_fs_1.readFileSync)(args.issuerPriorPinFile, 'utf8') : null,
+                priorRef,
+                controlJws: args.issuerControlFile ? (0, node_fs_1.readFileSync)(args.issuerControlFile, 'utf8').trim() : null,
+                required: true,
+            };
+        }
+        catch (err) {
+            console.error(`Error reading issuer pin: ${err instanceof Error ? err.message : String(err)}`);
+            return 3;
+        }
+    }
+    const result = await (0, anchor_witness_js_1.verifyAnchoredRoot)({
+        receipt,
+        inclusion,
+        head,
+        baseRpcUrl: args.rpcUrl || undefined,
+        solanaRpcUrl: args.solanaRpcUrl || undefined,
+        checkNewestAnchor: args.sawRpc,
+        epochRecord,
+        verifyEpochSignature,
+        issuerPin,
+        jwks: loaded.jwks,
+        trustedKids,
+        issuerHistory: resolved.document,
+        strictIssuerHistory: false,
+        anchorWalletDocument: anchorWalletDocument,
+    });
+    let canonicalPreimage = null;
+    if (args.canonicalPreimageFile) {
+        canonicalPreimage = (0, node_fs_1.readFileSync)(args.canonicalPreimageFile, 'utf8');
+    }
+    const verified = await (0, index_js_1.verifyReceipt)(receipt, {
+        jwks: loaded.jwks,
+        jwksUri: args.jwksUrl || undefined,
+        fetchJwks: args.fetchJwks,
+        trustedKids,
+        checkNullifier: args.checkNullifier,
+        checkPayer: args.checkPayer,
+        rpcUrl: args.rpcUrl || undefined,
+        solanaRpcUrl: args.solanaRpcUrl || undefined,
+        requirePreimages: !args.noPreimage,
+        ...historyOptions(resolved),
+        canonicalPreimage,
+        head,
+    });
+    // Inclusion was already checked above. Passing it again re-derives the leaf
+    // from book_chain.row_hash only, which rejects a receipt that stores row_hash
+    // at the top level. Log mode still requires the receipt itself. A missing or
+    // stripped issuer signature, a partial check, or a signed-versus-outer
+    // mismatch fails the combined result. An inclusion match is not VERIFIED.
+    const issuerSig = receipt.issuer_signature;
+    const signaturePresent = Boolean(issuerSig?.jws || issuerSig?.value);
+    const historyMiss = verified.issuer_history.reason === 'kid_not_in_history' || resolved.document == null;
+    const historyOnly = historyMiss
+        && verified.claim_mismatches.length === 0
+        && verified.errors.every((err) => /issuer history|kid_not_in_history/.test(err));
+    const receiptVerified = signaturePresent
+        && verified.issuer_signature.valid === true
+        && (verified.overall === 'verified' || verified.overall === 'verified_carried_forward' || historyOnly)
+        && verified.claim_mismatches.length === 0;
+    const receiptFailed = !receiptVerified;
+    const receiptErrors = [...verified.errors];
+    if (!signaturePresent) {
+        receiptErrors.push(verified.issuer_signature.reason || 'receipt_signature_missing');
+    }
+    else if (verified.issuer_signature.valid !== true && verified.issuer_signature.reason) {
+        receiptErrors.push(verified.issuer_signature.reason);
+    }
+    else if (verified.overall === 'partial') {
+        receiptErrors.push(verified.issuer_signature.reason || 'receipt_check_partial');
+    }
+    const errors = receiptFailed
+        ? [...result.errors, ...receiptErrors.filter((err) => !result.errors.includes(err))]
+        : result.errors;
+    const logMiss = result.overall === 'not_in_log';
+    const anchorOverall = logMiss
+        ? 'not_in_log'
+        : receiptFailed
+            ? 'failed'
+            : result.overall;
+    const combined = {
+        ...result,
+        errors,
+        overall: anchorOverall,
+        receipt_lane: verified.receipt_lane,
+        receipt_check: {
+            overall: result.overall === 'pending' && !receiptFailed ? 'pending' : verified.overall,
+            verified_scope: verified.verified_scope,
+            claim_mismatches: verified.claim_mismatches,
+            unsigned_fields: verified.unsigned_fields,
+            errors: verified.errors,
+        },
+    };
+    const logState = anchorLogState(result);
+    const verdict = (0, verdict_js_1.buildVerifyVerdict)({
+        version: packageVersion(),
+        receiptId: verified.receipt_id,
+        displayId: displayIdOf(receipt),
+        payloadVersion: verified.receipt_version ?? null,
+        historySource: resolved.source,
+        historyHead: resolved.headHash,
+        historyCount: resolved.entryCount,
+        historyAsOf: resolved.asOf,
+        signatureValid: signaturePresent && verified.issuer_signature.valid === true,
+        signatureChecked: true,
+        historyChecked: verified.issuer_history.checked,
+        historyOk: verified.issuer_history.ok,
+        historyReason: resolved.invalid ? (resolved.reason || verified.issuer_history.reason) : verified.issuer_history.reason,
+        historyMissing: resolved.document == null && !resolved.invalid,
+        bindingExpected: !!verified.binding.expected,
+        bindingMatches: verified.binding.matches,
+        claimMismatches: verified.claim_mismatches.length,
+        payerChecked: verified.payer.checked,
+        payerValid: verified.payer.valid,
+        errors: errors,
+        logInclusion: logState.logInclusion,
+        anchor: logState.anchor,
+        logReason: logState.logReason,
+        log: {
+            leaf_index: inclusion.leaf_index ?? null,
+            tree_size: inclusion.tree_size ?? null,
+            root: result.root,
+            anchors: {
+                base: result.base.tx,
+                solana: result.solana.signature,
+            },
+        },
+    });
+    if (args.json) {
+        return printVerdict(true, verdict, combined, anchorOverall);
+    }
+    printAnchor(combined, false, args.quiet, (0, verdict_js_1.overallLine)(verdict, anchorOverall));
+    if (!args.quiet || receiptFailed || verdict.result !== 'verified') {
+        const anchorPending = result.overall === 'pending';
+        const receiptLabel = anchorPending && !receiptFailed
+            ? 'PENDING'
+            : (0, verdict_js_1.overallLine)(verdict, verified.overall);
+        console.log(`  Receipt checks: ${receiptLabel} (signed claims only)`);
+        if (verified.claim_mismatches.length > 0) {
+            for (const mismatch of verified.claim_mismatches) {
+                console.log(`  ${mismatch.field}: outer ${mismatch.outer} ≠ signed ${mismatch.signed}`);
+            }
+        }
+        if (!(anchorPending && !receiptFailed))
+            printUnsigned(verified.unsigned_fields);
+        console.log('');
+    }
+    if (!args.quiet)
+        printLane(verified.receipt_lane);
+    console.log(`  ${verdict.message}`);
+    if (verdict.history.source === 'bundled' && verdict.history.as_of) {
+        console.log(`  Issuer history: as of ${verdict.history.as_of}`);
+    }
+    return verdict.exit_code;
+}
+function anchorLogState(result) {
+    if (result.overall === 'not_in_log') {
+        return { logInclusion: 'fail', anchor: 'pass', logReason: 'not_in_log' };
+    }
+    if (result.overall === 'pending' || result.overall === 'partial') {
+        return {
+            logInclusion: result.inclusion.valid ? 'pass' : 'could_not_check',
+            anchor: 'could_not_check',
+            logReason: result.overall === 'pending' ? 'pending_anchor' : (result.errors[0] || 'partial'),
+        };
+    }
+    if (result.inclusion && result.inclusion.valid === false) {
+        return {
+            logInclusion: 'fail',
+            anchor: 'fail',
+            logReason: result.errors[0] || result.inclusion.reason || 'log_inclusion',
+        };
+    }
+    if (result.overall === 'failed') {
+        return { logInclusion: 'pass', anchor: 'fail', logReason: result.errors[0] || 'anchor' };
+    }
+    if (result.overall === 'verified')
+        return { logInclusion: 'pass', anchor: 'pass', logReason: null };
+    return { logInclusion: 'could_not_check', anchor: 'could_not_check', logReason: 'log_unreachable' };
+}
+function displayIdOf(receipt) {
+    if (typeof receipt.display_id === 'string' && receipt.display_id)
+        return receipt.display_id;
+    const id = receipt.task_id || receipt.receipt_id || '';
+    const short = id.match(/^(chit-[0-9a-f]{8})/i);
+    return short ? short[1] : (id || null);
+}
+function printUnsigned(fields) {
+    console.log('  Scope:         signed claims only. Unsigned fields are UNVERIFIED.');
+    if (fields.length === 0)
+        return;
+    console.log(`  Unsigned fields (${fields.length})`);
+    console.log('  ─────────────────────────────────────────────────');
+    for (const field of fields)
+        console.log(`  UNVERIFIED     ${field}`);
+}
+async function runRefusal(doc, args) {
+    const trustedKids = args.trustedKids ?? index_js_1.DEFAULT_TRUSTED_ISSUER_KIDS;
+    const refusalGate = (0, receipt_version_js_1.classifyReceiptDocument)(doc);
+    if (!refusalGate.ok)
+        return emitVersionFailure(args, refusalGate.errors);
+    const result = (0, index_js_1.verifyRefusal)(doc, {
+        jwks: args.jwks,
+        trustedKids,
+    });
+    if (!result.valid && (result.errors[0] === 'unsupported_version' || result.reason === 'unsupported_version' || result.reason === 'payload_version_mismatch')) {
+        return emitVersionFailure(args, result.errors.length ? result.errors : [result.reason || 'unsupported_version']);
+    }
+    const preimages = await (0, preimage_js_1.verifyPublishedPreimages)(doc, {
+        requirePreimages: args.requirePreimages,
+    });
+    let canonicalFailed = false;
+    if (args.canonicalPreimage != null) {
+        const canonical = (0, canonical_preimage_js_1.verifyCanonicalPreimageBytes)(args.canonicalPreimage, result.payload_hash);
+        canonicalFailed = !canonical.ok;
+        if (canonicalFailed)
+            preimages.errors.push(`canonical preimage: ${canonical.reason}`);
+        if (canonicalFailed)
+            preimages.ok = false;
+    }
+    const pin = result.valid ? (0, issuer_history_js_1.readIssuerHistoryPin)({
+        issuer_history: result.issuer_history,
+    }) : null;
+    const history = await (0, issuer_history_js_1.checkReceiptIssuerHistory)(doc, {
+        document: args.resolved.document,
+        documentBytes: args.resolved.bytes,
+        fetchHistory: false,
+        strict: false,
+        jwks: args.jwks,
+        trustedKids,
+        issuedAt: doc.issued_at ?? null,
+        kid: result.kid ?? doc.issuer_signature?.kid ?? null,
+        pin,
+        requirePin: result.valid && Number(result.payload_version) >= 2 && args.resolved.document != null,
+    });
+    const historyFailed = history.checked && !history.ok && history.reason !== 'kid_not_in_history';
+    const failed = !result.valid || !preimages.ok || historyFailed || canonicalFailed;
+    const verdict = (0, verdict_js_1.buildVerifyVerdict)({
+        version: packageVersion(),
+        receiptId: result.refusal_id || doc.refusal_id || null,
+        displayId: result.refusal_id || doc.refusal_id || null,
+        payloadVersion: result.payload_version ?? null,
+        historySource: args.resolved.source,
+        historyHead: args.resolved.headHash,
+        historyCount: args.resolved.entryCount,
+        historyAsOf: args.resolved.asOf,
+        signatureValid: result.valid,
+        signatureChecked: true,
+        historyChecked: history.checked,
+        historyOk: history.ok,
+        historyReason: history.reason || args.resolved.reason,
+        historyMissing: args.resolved.document == null,
+        errors: [...result.errors, ...preimages.errors],
+        logInclusion: 'unclaimed',
+        anchor: 'unclaimed',
+    });
+    const overall = verdict.result === 'verified' ? 'verified' : verdict.result === 'could_not_check' ? 'could_not_check' : 'failed';
+    if (args.json) {
+        return printVerdict(true, verdict, { ...result, preimages, issuer_history: history, overall }, overall);
+    }
+    else if (!args.quiet || failed || verdict.result !== 'verified') {
+        console.log('');
+        console.log('  Chit402 Refusal Verification');
+        console.log('  ─────────────────────────────────────────────────');
+        console.log(`  Schema:        ${result.schema}`);
+        console.log(`  Refusal ID:    ${result.refusal_id || doc.refusal_id || '—'}`);
+        console.log(`  Code:          ${result.refusal_code || doc.refusal_code || '—'}`);
+        console.log(`  Nonce:         ${result.nonce || '—'}`);
+        console.log(`  Chain:         ${result.chain_id ?? 'null'}`);
+        console.log(`  Charged:       false`);
+        console.log('');
+        console.log('  Issuer Signature');
+        console.log('  ─────────────────────────────────────────────────');
+        console.log(`  Valid:         ${result.valid ? '✓ YES' : '✗ NO'}`);
+        if (result.kid)
+            console.log(`  Kid:           ${result.kid}`);
+        if (!result.valid && result.reason)
+            console.log(`  Reason:        ${result.reason}`);
+        console.log('');
+        if (!failed) {
+            console.log('  What this proves');
+            console.log('  ─────────────────────────────────────────────────');
+            for (const line of result.proves)
+                console.log(`  ${line}`);
+            console.log('');
+        }
+        console.log('  What this does not prove');
+        console.log('  ─────────────────────────────────────────────────');
+        for (const line of result.does_not_prove)
+            console.log(`  ${line}`);
+        console.log('');
+        console.log(`  Overall: ${(0, verdict_js_1.overallLine)(verdict, overall)}`);
+        console.log(`  ${verdict.message}`);
+        if (!preimages.ok)
+            console.log(`  Preimages:     ${preimages.errors.join('; ')}`);
+        if (history.warning)
+            console.log(`  Issuer history: ${history.warning}`);
+        if (historyFailed && history.reason)
+            console.log(`  Issuer history: ${history.reason}`);
+        console.log('');
+    }
+    return verdict.exit_code;
+}
+async function legacyMain() {
+    const removed = removedFlag(process.argv.slice(2));
+    if (removed) {
+        console.error(removed);
+        return 1;
+    }
+    const args = parseArgs(process.argv.slice(2));
+    if (args.version) {
+        console.log(`@xfuel/verify ${packageVersion()}`);
+        console.log((0, receipt_version_js_1.formatSupportedReceiptVersions)());
+        return 0;
+    }
+    let anchorMode = args.anchorFlag
+        || Boolean(args.inclusionFile || args.headFile)
+        || (args.positionals.length >= 3 && args.sawRpc);
+    if (!anchorMode && args.sawRpc && args.positionals.some((file) => fileLooksLikeHead(file))) {
+        anchorMode = true;
+    }
+    if (args.help) {
+        console.log(HELP);
+        return 0;
+    }
+    if (args.url && !args.jwsFile) {
+        try {
+            const response = await fetch(args.url);
+            await response.arrayBuffer();
+        }
+        catch {
+            // A failed fetch is still not a pass.
+        }
+        console.log('owner_proof_required');
+        console.log('  Overall: OWNER_PROOF_REQUIRED');
+        return 1;
+    }
+    let offlineWitness = null;
+    if (!anchorMode) {
+        try {
+            offlineWitness = readOfflineWitness(args);
+        }
+        catch (err) {
+            console.error(err instanceof Error ? err.message : String(err));
+            return 3;
+        }
+    }
+    // A shell plus a holder is not anchor mode. Inclusion is checked with the
+    // holder. Anchor mode would verify the unsigned shell and skip the key.
+    if (anchorMode && !args.jwsFile && !args.acceptShell)
+        return runAnchor(args);
+    if (!args.file) {
+        console.log(HELP);
+        return 3;
+    }
+    let receipt;
+    try {
+        receipt = readReceipt(args.file);
+    }
+    catch (err) {
+        console.error(`Error reading receipt: ${err instanceof Error ? err.message : String(err)}`);
+        return 3;
+    }
+    if ((0, shell_js_1.isReceiptShell)(receipt) || args.acceptShell || args.jwsFile) {
+        if (!(0, shell_js_1.isReceiptShell)(receipt)) {
+            console.error('Invalid shell: schema is not chit402.receipt_shell.v1');
+            return 3;
+        }
+        if (!args.jwsFile) {
+            const shellGate = (0, receipt_version_js_1.classifyShellDocument)(receipt);
+            if (!shellGate.ok)
+                return emitVersionFailure(args, shellGate.errors);
+            console.log(shell_js_1.INCLUDED_SHELL_LINE);
+            console.log('  Overall: INCLUDED_SHELL');
+            return args.acceptShell ? 0 : 1;
+        }
+        let holder;
+        try {
+            const text = (0, node_fs_1.readFileSync)(args.jwsFile, 'utf8');
+            let parsed = text;
+            try {
+                parsed = JSON.parse(text);
+            }
+            catch {
+                parsed = text;
+            }
+            holder = (0, shell_js_1.holderDocumentFromOwnerView)(parsed);
+        }
+        catch (err) {
+            console.error(`Error reading JWS: ${err instanceof Error ? err.message : String(err)}`);
+            return 3;
+        }
+        const shellDoc = receipt;
+        const holderGate = (0, receipt_version_js_1.classifyReceiptDocument)(holder);
+        if (!holderGate.ok)
+            return emitVersionFailure(args, holderGate.errors);
+        const compared = (0, shell_js_1.compareShellToJws)(shellDoc, holder);
+        if (!compared.ok) {
+            console.log('shell_jws_mismatch');
+            if (compared.field)
+                console.log(`  Field:         ${compared.field}`);
+            console.log('  Overall: FAILED');
+            return 1;
+        }
+        let jwks;
+        if (args.jwksFile) {
+            try {
+                jwks = JSON.parse((0, node_fs_1.readFileSync)(args.jwksFile, 'utf8'));
+            }
+            catch (err) {
+                console.error(`Error reading JWKS file: ${err instanceof Error ? err.message : String(err)}`);
+                return 3;
+            }
+        }
+        let inclusion = offlineWitness?.inclusion ?? null;
+        let head = offlineWitness?.head ?? null;
+        try {
+            if (args.inclusionFile)
+                inclusion = readJson(args.inclusionFile);
+            if (args.headFile)
+                head = readJson(args.headFile);
+        }
+        catch (err) {
+            console.error(`Error reading inclusion: ${err instanceof Error ? err.message : String(err)}`);
+            return 3;
+        }
+        const trustedKids = args.noTrustedKid
+            ? []
+            : (args.trustedKids ?? [...index_js_1.DEFAULT_TRUSTED_ISSUER_KIDS]);
+        let shellResolved;
+        try {
+            shellResolved = await resolvedHistory(args, holder, jwks, trustedKids);
+        }
+        catch (err) {
+            console.error(`Error reading issuer history: ${err instanceof Error ? err.message : String(err)}`);
+            return 3;
+        }
+        const result = await (0, index_js_1.verifyReceipt)(holder, {
+            jwks,
+            jwksUri: args.jwksUrl || undefined,
+            fetchJwks: args.fetchJwks,
+            trustedKids,
+            checkPayer: args.checkPayer,
+            rpcUrl: args.rpcUrl || undefined,
+            solanaRpcUrl: args.solanaRpcUrl || undefined,
+            requirePreimages: false,
+            ...historyOptions(shellResolved),
+            salt: args.salt,
+            head: head ?? undefined,
+            inclusion: inclusion ?? undefined,
+        });
+        const inclusionErrors = result.errors.filter((err) => /inclusion|leaf|row_hash|bad_root|tree_size|tree_head|no_leaf/.test(err));
+        const shellLeaf = (shellDoc.inclusion && typeof shellDoc.inclusion === 'object')
+            ? shellDoc.inclusion.leaf_hash
+            : null;
+        const provedLeaf = inclusion && typeof inclusion.leaf === 'string'
+            ? inclusion.leaf
+            : null;
+        // A head the user wrote by hand ({root, tree_size}) is not a log. The
+        // inclusion only counts against a head that carries an issuer JWS;
+        // verifyReceipt() checks that JWS against the same trust set.
+        const headSig = head && typeof head === 'object'
+            ? head.issuer_signature
+            : null;
+        const headSigned = !!headSig && typeof headSig.jws === 'string' && headSig.jws.split('.').length === 3;
+        const verdict = (0, shell_js_1.shellHolderVerdict)({
+            signatureValid: result.issuer_signature.valid === true,
+            keyTrusted: result.issuer_signature.key_trusted === true,
+            signatureReason: result.issuer_signature.reason || (result.issuer_signature.key_trusted ? null : 'key untrusted'),
+            inclusionSupplied: inclusion != null,
+            inclusionOk: inclusion != null && inclusionErrors.length === 0,
+            inclusionReason: inclusion == null ? 'inclusion_missing' : (inclusionErrors[0] || null),
+            headSigned,
+            paymentRef: result.tx,
+            bindingExpected: !!result.binding.expected,
+            bindingMatches: result.binding.matches === true,
+            shellLeaf: shellLeaf == null ? null : String(shellLeaf),
+            provedLeaf,
+        });
+        const coveringMiss = result.issuer_history.reason === 'kid_not_in_history' || shellResolved.document == null;
+        const receiptOk = result.issuer_signature.valid === true
+            && result.claim_mismatches.length === 0
+            && (result.overall === 'verified' || result.overall === 'verified_carried_forward' || coveringMiss);
+        if (!verdict.verified || !receiptOk) {
+            const reason = verdict.reason || result.errors[0] || 'failed';
+            console.log(reason);
+            console.log('  Overall: FAILED');
+            return 1;
+        }
+        if (coveringMiss || (result.issuer_history.checked && !result.issuer_history.ok)) {
+            if (coveringMiss) {
+                console.log('  Overall: COULD_NOT_CHECK');
+                console.log('  No issuer history covers this key.');
+                console.log('  Next: Pass --issuer-history with a snapshot that includes this kid.');
+                return 2;
+            }
+            console.log(result.issuer_history.reason || 'key_window');
+            console.log('  Overall: INVALID');
+            return 1;
+        }
+        if (args.checkPayer && !result.payer.valid) {
+            console.log(result.payer.reason || 'payment_unchecked');
+            console.log('  Overall: FAILED');
+            return 1;
+        }
+        const issuer = holder.issuer_signature;
+        if (args.salt) {
+            const opened = (0, shell_js_1.openV11Commitment)({
+                payload: (0, shell_js_1.decodeJwsPayload)(issuer?.jws),
+                saltHex: args.salt || '',
+                body: Buffer.alloc(0),
+            });
+            if (!opened.ok) {
+                console.log(opened.reason || 'commitment_mismatch');
+                console.log('  Overall: FAILED');
+                return 1;
+            }
+        }
+        console.log('  Overall: VERIFIED');
+        console.log('  Every check passed.');
+        return 0;
+    }
+    if (typeof receipt.issuer_signature?.jws === 'string') {
+        const receiptGate = (0, receipt_version_js_1.classifyReceiptDocument)(receipt);
+        if (!receiptGate.ok)
+            return emitVersionFailure(args, receiptGate.errors);
+    }
+    const v11 = receipt.v === 11 || (receipt.issuer_signature?.jws
+        ? (() => {
+            try {
+                const part = String(receipt.issuer_signature.jws).split('.')[1];
+                const payload = JSON.parse(Buffer.from(part, 'base64url').toString('utf8'));
+                return payload?.v === 11;
+            }
+            catch {
+                return false;
+            }
+        })()
+        : false);
+    if (!receipt.task_id && !v11) {
+        console.error('Invalid receipt: missing task_id');
+        return 3;
+    }
+    // Load JWKS if provided
+    let jwks;
+    if (args.jwksFile) {
+        try {
+            const jwksContent = (0, node_fs_1.readFileSync)(args.jwksFile, 'utf8');
+            jwks = JSON.parse(jwksContent);
+        }
+        catch (err) {
+            console.error(`Error reading JWKS file: ${err instanceof Error ? err.message : String(err)}`);
+            return 3;
+        }
+    }
+    const trustedKids = args.noTrustedKid
+        ? []
+        : (args.trustedKids ?? index_js_1.DEFAULT_TRUSTED_ISSUER_KIDS);
+    let resolved;
+    try {
+        resolved = await resolvedHistory(args, receipt, jwks, trustedKids);
+    }
+    catch (err) {
+        console.error(`Error reading issuer history: ${err instanceof Error ? err.message : String(err)}`);
+        return 3;
+    }
+    if ((0, index_js_1.isRefusalDocument)(receipt)) {
+        let canonicalPreimage = null;
+        if (args.canonicalPreimageFile) {
+            canonicalPreimage = (0, node_fs_1.readFileSync)(args.canonicalPreimageFile, 'utf8');
+        }
+        return runRefusal(receipt, {
+            jwks,
+            trustedKids,
+            json: args.json,
+            quiet: args.quiet,
+            requirePreimages: !args.noPreimage,
+            resolved,
+            canonicalPreimage,
+        });
+    }
+    let canonicalPreimage = null;
+    if (args.canonicalPreimageFile) {
+        try {
+            canonicalPreimage = (0, node_fs_1.readFileSync)(args.canonicalPreimageFile, 'utf8');
+        }
+        catch (err) {
+            console.error(`Error reading canonical preimage: ${err instanceof Error ? err.message : String(err)}`);
+            return 3;
+        }
+    }
+    const carryAsked = args.carryOldHeadFile || args.carryOldInclusionFile
+        || args.carryHeadFile || args.carryInclusionFiles.length > 0;
+    let carry = null;
+    if (carryAsked) {
+        try {
+            carry = {
+                oldHead: args.carryOldHeadFile ? readJson(args.carryOldHeadFile) : {},
+                oldInclusion: args.carryOldInclusionFile ? readJson(args.carryOldInclusionFile) : { error: 'not_in_tree' },
+                currentHead: args.carryHeadFile ? readJson(args.carryHeadFile) : {},
+                currentInclusions: args.carryInclusionFiles.length > 0
+                    ? args.carryInclusionFiles.map((file) => readJson(file))
+                    : [{ error: 'not_in_tree' }],
+            };
+        }
+        catch (err) {
+            console.error(`Error reading carry-forward files: ${err instanceof Error ? err.message : String(err)}`);
+            return 3;
+        }
+    }
+    let open;
+    if (args.open.length > 0) {
+        open = {};
+        try {
+            for (const spec of args.open) {
+                const opened = (0, v11_receipt_js_1.readOpenFile)(spec);
+                if (opened.kind === 'output')
+                    open.output = opened.bytes;
+                else
+                    open[opened.kind] = opened.text;
+            }
+        }
+        catch (err) {
+            console.error(err instanceof Error ? err.message : String(err));
+            return 3;
+        }
+    }
+    const result = await (0, index_js_1.verifyReceipt)(receipt, {
+        jwks,
+        jwksUri: args.jwksUrl || undefined,
+        fetchJwks: args.fetchJwks,
+        trustedKids,
+        checkNullifier: args.checkNullifier,
+        checkPayer: args.checkPayer,
+        rpcUrl: args.rpcUrl || undefined,
+        solanaRpcUrl: args.solanaRpcUrl || undefined,
+        requirePreimages: !args.noPreimage,
+        ...historyOptions(resolved),
+        canonicalPreimage,
+        salt: args.salt,
+        open,
+        head: offlineWitness?.head ?? undefined,
+        inclusion: offlineWitness?.inclusion ?? undefined,
+        carry,
+    });
+    const hadLog = Boolean(offlineWitness?.inclusion || offlineWitness?.head);
+    let logInclusion = 'unclaimed';
+    let anchorState = 'unclaimed';
+    let logReason = null;
+    const carried = result.overall === 'verified_carried_forward';
+    const headErrors = result.errors.filter((err) => /head_signature|head_claims|tree_head_mismatch|tree_size_mismatch|inclusion|not_in_tree|bad_root|no_leaf/.test(err));
+    if (hadLog || headErrors.length) {
+        if (headErrors.some((err) => err.includes('not_in_tree')) && headErrors.length === 1) {
+            logInclusion = 'fail';
+            anchorState = 'pass';
+            logReason = 'not_in_log';
+        }
+        else if (headErrors.length) {
+            logInclusion = headErrors.some((err) => /inclusion|not_in_tree|bad_root|no_leaf/.test(err)) ? 'fail' : 'pass';
+            anchorState = 'fail';
+            logReason = headErrors[0];
+        }
+        else {
+            logInclusion = 'pass';
+            anchorState = 'pass';
+        }
+    }
+    else if (!carried && typeof receipt.verify_url === 'string' && historyHostAllowed(receipt.verify_url)) {
+        const fresh = await freshPublicLog(receipt, resolved.document);
+        logInclusion = fresh.logInclusion;
+        anchorState = fresh.anchor;
+        logReason = fresh.logReason;
+    }
+    const receiptVerdict = (0, verdict_js_1.buildVerifyVerdict)({
+        version: packageVersion(),
+        receiptId: result.receipt_id,
+        displayId: displayIdOf(receipt),
+        payloadVersion: result.receipt_version ?? null,
+        historySource: resolved.source,
+        historyHead: resolved.headHash,
+        historyCount: resolved.entryCount,
+        historyAsOf: resolved.asOf,
+        signatureValid: result.issuer_signature.valid === true || carried,
+        signatureChecked: result.issuer_signature.checked || carried,
+        historyChecked: result.issuer_history.checked || carried,
+        historyOk: carried ? true : result.issuer_history.ok,
+        historyReason: carried ? null : (resolved.invalid ? (resolved.reason || result.issuer_history.reason) : result.issuer_history.reason),
+        historyMissing: carried ? false : (resolved.document == null && !resolved.invalid),
+        bindingExpected: !!result.binding.expected,
+        bindingMatches: result.binding.matches,
+        claimMismatches: result.claim_mismatches.length,
+        payerChecked: result.payer.checked,
+        payerValid: result.payer.valid,
+        errors: result.errors,
+        logInclusion,
+        anchor: anchorState,
+        logReason,
+        log: null,
+    });
+    if (args.json) {
+        return printVerdict(true, receiptVerdict, result, result.overall);
+    }
+    else if (!args.quiet || result.overall === 'failed' || receiptVerdict.result !== 'verified') {
+        console.log('');
+        console.log(`  Chit402 Receipt Verification`);
+        console.log(`  ─────────────────────────────────────────────────`);
+        console.log(`  Receipt ID:    ${result.receipt_id}`);
+        console.log(`  Hub:           ${result.hub || '—'}`);
+        console.log(`  Model:         ${result.model || '—'}`);
+        console.log(`  Amount:        ${result.issuer_signature.valid ? formatAmount(result.amount_usdc) : '— (not verified)'}`);
+        console.log(`  TX:            ${result.tx || '—'}`);
+        console.log(`  Output Hash:   ${result.output_hash ? result.output_hash.slice(0, 18) + '…' : '—'}`);
+        console.log('');
+        console.log(`  Binding`);
+        console.log(`  ─────────────────────────────────────────────────`);
+        if (result.binding.expected) {
+            console.log(`  Expected:      ${result.binding.expected.slice(0, 18)}…`);
+            console.log(`  Recomputed:    ${result.binding.recomputed?.slice(0, 18)}…`);
+            console.log(`  Match:         ${result.binding.matches ? '✓ YES' : '✗ NO'}`);
+            console.log(`  Covers:        ${result.binding.covers.join(', ')}`);
+        }
+        else {
+            console.log(`  Status:        ${result.binding.reason || 'No payment-binding commitment'}`);
+        }
+        console.log('');
+        console.log(`  Issuer Signature`);
+        console.log(`  ─────────────────────────────────────────────────`);
+        if (result.issuer_signature.checked) {
+            console.log(`  Kid:           ${result.issuer_signature.kid || '—'}`);
+            console.log(`  Valid:         ${result.issuer_signature.valid ? '✓ YES' : '✗ NO'}`);
+            console.log(`  Key trusted:   ${result.issuer_signature.key_trusted ? '✓ YES' : '✗ NO'}${result.issuer_signature.trust ? ` (${result.issuer_signature.trust})` : ''}`);
+            if (!result.issuer_signature.valid && result.issuer_signature.reason) {
+                console.log(`  Reason:        ${result.issuer_signature.reason}`);
+            }
+        }
+        else {
+            console.log(`  Status:        ${result.issuer_signature.reason || 'Not checked'}`);
+            if (receipt.issuer_signature && !args.jwksFile && !args.fetchJwks && !args.jwksUrl) {
+                console.log(`                 (pass --jwks-file, --fetch-jwks, or rely on the default trusted kid)`);
+            }
+        }
+        console.log('');
+        console.log(`  Payer (on-chain)`);
+        console.log(`  ─────────────────────────────────────────────────`);
+        if (result.payer.checked) {
+            console.log(`  Rail:          ${result.payer.rail || '—'}`);
+            console.log(`  Payer:         ${result.payer.payer_wallet || '—'}`);
+            console.log(`  Payee:         ${result.payer.payee || '—'}`);
+            console.log(`  Asset:         ${result.payer.asset || '—'}`);
+            console.log(`  Amount:        ${formatAmount(result.payer.amount || null)}`);
+            console.log(`  Valid:         ${result.payer.valid ? '✓ YES' : '✗ NO'}`);
+            if (!result.payer.valid && result.payer.reason) {
+                console.log(`  Reason:        ${result.payer.reason}`);
+            }
+        }
+        else {
+            console.log(`  Status:        ${result.payer.reason || 'Not checked'}`);
+            if (result.issuer_signature.valid && result.payer.payer_wallet && result.tx && !args.checkPayer) {
+                console.log(`                 (pass --check-payer to verify payer, payee, asset, and amount on-chain)`);
+            }
+        }
+        if (result.claim_mismatches.length > 0) {
+            console.log('');
+            console.log(`  Outer / signed mismatches`);
+            console.log(`  ─────────────────────────────────────────────────`);
+            for (const mismatch of result.claim_mismatches) {
+                console.log(`  ${mismatch.field}: outer ${mismatch.outer} ≠ signed ${mismatch.signed}`);
+            }
+        }
+        console.log('');
+        printUnsigned(result.unsigned_fields);
+        console.log('');
+        console.log(`  Nullifier`);
+        console.log(`  ─────────────────────────────────────────────────`);
+        if (result.nullifier.nullifier) {
+            console.log(`  Value:         ${result.nullifier.nullifier.slice(0, 18)}…`);
+            if (args.checkNullifier) {
+                console.log(`  On-chain:      ${result.nullifier.anchored ? '✓ ANCHORED' : '✗ NOT FOUND'}`);
+            }
+            else {
+                console.log(`  On-chain:      (not checked — use --check-nullifier)`);
+            }
+        }
+        else {
+            console.log(`  Status:        No nullifier (Tier-1 receipt)`);
+        }
+        console.log('');
+        printLane(result.receipt_lane);
+        if (result.preimages.checked) {
+            console.log(`  Preimages:     ${result.preimages.ok ? '✓ MATCH' : '✗ ' + result.preimages.errors.join('; ')}`);
+        }
+        if (result.issuer_history.checked) {
+            console.log(`  Issuer history: ${result.issuer_history.ok ? '✓ kid in window' : '✗ ' + (result.issuer_history.reason || 'failed')}`);
+        }
+        else if (result.issuer_history.warning) {
+            console.log(`  Issuer history: ${result.issuer_history.warning}`);
+        }
+        if (result.carry_forward?.status === 'VERIFIED_CARRIED_FORWARD') {
+            const carried = result.carry_forward;
+            console.log(`  Log`);
+            console.log(`  ─────────────────────────────────────────────────`);
+            console.log(`  Status:        ${carried.status}`);
+            console.log(`  Issued at:     ${carried.issued_at}`);
+            console.log(`  Issued epoch:  ${carried.issued_epoch}`);
+            console.log(`  Logged at:     ${carried.logged_at}`);
+            console.log(`  Logged epoch:  ${carried.logged_epoch}`);
+            console.log(`  Leaf index:    ${carried.leaf_index}`);
+            console.log('');
+        }
+        console.log(`  Overall: ${(0, verdict_js_1.overallLine)(receiptVerdict, result.overall)}`);
+        console.log(`  ${receiptVerdict.message}`);
+        if (receiptVerdict.history.source === 'bundled' && receiptVerdict.history.as_of) {
+            console.log(`  Issuer history: as of ${receiptVerdict.history.as_of}`);
+        }
+        if (receiptVerdict.next_step)
+            console.log(`  Next: ${receiptVerdict.next_step}`);
+        if (result.errors.length > 0) {
+            console.log(`  Errors:  ${result.errors.join(', ')}`);
+        }
+        console.log('');
+    }
+    return receiptVerdict.exit_code;
+}
+/**
+ * Node's fetch keeps its undici agent on this symbol after the first request.
+ * There is no public handle for that pool. Closing it lets the loop drain.
+ */
+const UNDICI_GLOBAL_DISPATCHER = Symbol.for('undici.globalDispatcher.1');
+function fetchDispatcher() {
+    const bag = globalThis;
+    return bag[UNDICI_GLOBAL_DISPATCHER];
+}
+/**
+ * process.exit() while a fetch keep-alive socket is already CLOSING aborts
+ * on Windows: Assertion failed: !(handle->flags & UV_HANDLE_CLOSING)
+ * (src/win/async.c). Set the code and close the pool so the loop can drain.
+ */
+async function finish(code) {
+    process.exitCode = code;
+    const dispatcher = fetchDispatcher();
+    if (!dispatcher)
+        return;
+    try {
+        const closing = dispatcher.close?.();
+        if (closing)
+            await closing;
+    }
+    catch {
+        try {
+            await dispatcher.destroy?.();
+        }
+        catch {
+            // The verification result is already the exit code.
+        }
+    }
+}
+const RECEIPT_ID_RE = /^(chit|xfuel)-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function removedFlagMessage(argv) {
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === '--')
+            break;
+        if (!arg.startsWith('-') || arg === '-')
+            continue;
+        if (REMOVED_040[arg])
+            return REMOVED_040[arg];
+        if (arg === '--issuer-history') {
+            const value = argv[i + 1];
+            if (!value || value.startsWith('-'))
+                return 'removed in 0.4: --issuer-history needs a file';
+            i += 1;
+            continue;
+        }
+        if (arg === '--json' || arg === '--help' || arg === '-h' || arg === '--version' || arg === '-V')
+            continue;
+        const name = arg.includes('=') ? arg.slice(0, arg.indexOf('=')) : arg;
+        return `removed in 0.4: ${name} is not a verifier flag`;
+    }
+    return null;
+}
+function parseLocked(argv) {
+    const parsed = {
+        json: false,
+        help: false,
+        version: false,
+        issuerHistoryFile: null,
+        positionals: [],
+    };
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === '--json')
+            parsed.json = true;
+        else if (arg === '--help' || arg === '-h')
+            parsed.help = true;
+        else if (arg === '--version' || arg === '-V')
+            parsed.version = true;
+        else if (arg === '--issuer-history' && argv[i + 1]) {
+            parsed.issuerHistoryFile = argv[++i];
+        }
+        else if (!arg.startsWith('-') || arg === '-') {
+            parsed.positionals.push(arg);
+        }
+    }
+    return parsed;
+}
+function printLocked(verdict, json) {
+    if (json) {
+        console.log(JSON.stringify(verdict, null, 2));
+        return verdict.exit_code;
+    }
+    for (const line of (0, verdict_js_1.humanVerdictLines)(verdict))
+        console.log(line);
+    return verdict.exit_code;
+}
+function lockedError(json, status, message, reason) {
+    if (!json) {
+        console.error(message);
+        return status;
+    }
+    const failed = status === 1;
+    const verdict = (0, verdict_js_1.buildVerifyVerdict)({
+        version: packageVersion(),
+        errors: failed ? [reason] : [],
+        signatureChecked: failed,
+        signatureValid: failed ? false : null,
+        logInclusion: 'could_not_check',
+        anchor: 'could_not_check',
+        logReason: failed ? null : reason,
+    });
+    console.log(JSON.stringify({
+        ...verdict,
+        result: failed ? 'invalid' : 'could_not_check',
+        exit_code: status,
+        reason,
+        message,
+        next_step: failed ? null : verdict.next_step,
+    }, null, 2));
+    return status;
+}
+function receiptJsonUrl(raw) {
+    const url = new URL(raw);
+    if (!url.pathname.endsWith('.json'))
+        url.searchParams.set('format', 'json');
+    return url.toString();
+}
+async function loadReceiptTarget(target) {
+    if (target === '-') {
+        return { receipt: JSON.parse((0, node_fs_1.readFileSync)(0, 'utf8')), origin: null };
+    }
+    let url = null;
+    if (/^https?:\/\//i.test(target))
+        url = receiptJsonUrl(target);
+    else if (RECEIPT_ID_RE.test(target))
+        url = `https://api.chit402.com/receipt/${target}?format=json`;
+    if (url) {
+        let res;
+        try {
+            res = await fetch(url, {
+                headers: { accept: 'application/json' },
+                signal: AbortSignal.timeout(LOG_FETCH_MS),
+            });
+        }
+        catch (err) {
+            const wrapped = new Error(err instanceof Error ? err.message : String(err));
+            wrapped.code = 'REMOTE';
+            throw wrapped;
+        }
+        if (!res.ok) {
+            const err = new Error(`fetch ${res.status}`);
+            err.code = 'REMOTE';
+            throw err;
+        }
+        const text = await res.text();
+        try {
+            return { receipt: JSON.parse(text), origin: new URL(url).origin };
+        }
+        catch {
+            const err = new Error('receipt response was not JSON');
+            err.code = 'REMOTE';
+            throw err;
+        }
+    }
+    return { receipt: JSON.parse((0, node_fs_1.readFileSync)(target, 'utf8')), origin: null };
+}
+function inputFailure(err, target) {
+    const code = err && typeof err === 'object' && 'code' in err ? String(err.code) : '';
+    const message = err instanceof Error ? err.message : String(err);
+    const remote = code === 'REMOTE' || code === 'FETCH' || /fetch failed|fetch \d+|timeout|aborted|network|ENOTFOUND|ECONNREFUSED|EAI_AGAIN/i.test(message);
+    if (remote) {
+        return { status: 2, message: 'The receipt could not be fetched.', reason: 'receipt_unavailable' };
+    }
+    if (code === 'ENOENT' || message.includes('ENOENT')) {
+        return { status: 1, message: `Error reading receipt: ${target}`, reason: 'unreadable' };
+    }
+    return { status: 1, message: `Error reading receipt: ${message}`, reason: 'unreadable' };
+}
+function shellInclusionAbsent(receipt) {
+    const inclusion = receipt.inclusion;
+    if (inclusion == null)
+        return true;
+    if (typeof inclusion !== 'object')
+        return false;
+    const row = inclusion;
+    if (row.error === 'not_in_tree')
+        return true;
+    const leaf = row.leaf_hash ?? row.leaf ?? null;
+    const head = row.signed_head;
+    const headAbsent = head == null || (typeof head === 'object'
+        && head.root == null
+        && head.signature == null);
+    return leaf == null && row.proof == null && headAbsent;
+}
+function shellLogReceipt(receipt, origin) {
+    const task = receipt.task_id || receipt.receipt_id || null;
+    if (!task || !RECEIPT_ID_RE.test(String(task)))
+        return null;
+    let host = origin;
+    if (!host && typeof receipt.verify_url === 'string') {
+        try {
+            host = new URL(receipt.verify_url).origin;
+        }
+        catch {
+            host = null;
+        }
+    }
+    if (!host)
+        host = 'https://api.chit402.com';
+    const verifyUrl = `${host}/receipt/${encodeURIComponent(String(task))}`;
+    if (!historyHostAllowed(verifyUrl))
+        return null;
+    return { verify_url: verifyUrl, task_id: String(task) };
+}
+async function main() {
+    const argv = process.argv.slice(2);
+    const jsonEarly = argv.includes('--json');
+    const removed = removedFlagMessage(argv);
+    if (removed)
+        return lockedError(jsonEarly, 1, removed, 'removed_flag');
+    const args = parseLocked(argv);
+    if (args.version) {
+        console.log(`chit402-verify ${packageVersion()}`);
+        console.log((0, receipt_version_js_1.formatSupportedReceiptVersions)());
+        return 0;
+    }
+    if (args.help) {
+        console.log(HELP);
+        return 0;
+    }
+    if (args.positionals.length === 0) {
+        console.log(HELP);
+        return 1;
+    }
+    if (args.positionals.length !== 1) {
+        return lockedError(args.json, 1, 'removed in 0.4: pass one receipt id, url, or file', 'removed_flag');
+    }
+    let receipt;
+    let receiptOrigin = null;
+    try {
+        const loaded = await loadReceiptTarget(args.positionals[0]);
+        receipt = loaded.receipt;
+        receiptOrigin = loaded.origin;
+    }
+    catch (err) {
+        const failure = inputFailure(err, args.positionals[0]);
+        if (failure.status === 2) {
+            const verdict = (0, verdict_js_1.buildVerifyVerdict)({
+                version: packageVersion(),
+                absentReason: failure.reason,
+            });
+            return printLocked({
+                ...verdict,
+                message: `${failure.message} It was NOT found invalid.`,
+                next_step: 'Fetch the receipt again, then re-run.',
+            }, args.json);
+        }
+        return lockedError(args.json, failure.status, failure.message, failure.reason);
+    }
+    const trustedKids = [...index_js_1.DEFAULT_TRUSTED_ISSUER_KIDS];
+    let fileBytes = null;
+    if (args.issuerHistoryFile) {
+        try {
+            fileBytes = (0, node_fs_1.readFileSync)(args.issuerHistoryFile, 'utf8');
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            return lockedError(args.json, 1, `Error reading issuer history: ${message}`, 'unreadable');
+        }
+    }
+    let resolved;
+    try {
+        resolved = await (0, issuer_history_js_1.resolveIssuerHistory)({
+            fileBytes,
+            receipt,
+            trustedKids,
+            timeoutMs: LOG_FETCH_MS,
+        });
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return lockedError(args.json, 1, `Error reading issuer history: ${message}`, 'unreadable');
+    }
+    if ((0, index_js_1.isRefusalDocument)(receipt)) {
+        const result = (0, index_js_1.verifyRefusal)(receipt, { trustedKids });
+        const verdict = (0, verdict_js_1.buildVerifyVerdict)({
+            version: packageVersion(),
+            receiptId: result.refusal_id || null,
+            displayId: result.refusal_id || null,
+            payloadVersion: result.payload_version ?? null,
+            historySource: resolved.source,
+            historyHead: resolved.headHash,
+            historyCount: resolved.entryCount,
+            historyAsOf: resolved.asOf,
+            signatureValid: result.valid,
+            signatureChecked: true,
+            historyChecked: !resolved.invalid && resolved.document != null,
+            historyOk: !resolved.invalid && resolved.document != null,
+            historyReason: resolved.reason,
+            historyMissing: resolved.document == null && !resolved.invalid,
+            errors: result.errors,
+            logInclusion: 'unclaimed',
+            anchor: 'unclaimed',
+        });
+        return printLocked(verdict, args.json);
+    }
+    const unsigned = typeof receipt.issuer_signature?.jws !== 'string' || receipt.issuer_signature.jws.length === 0;
+    if (unsigned || (0, shell_js_1.isReceiptShell)(receipt)) {
+        let logInclusion = 'unclaimed';
+        let anchorState = 'unclaimed';
+        let logReason = 'signed_receipt_unavailable';
+        if (shellInclusionAbsent(receipt)) {
+            const logReceipt = shellLogReceipt(receipt, receiptOrigin);
+            if (logReceipt && await publicShellAbsence(logReceipt, resolved.document)) {
+                logInclusion = 'fail';
+                anchorState = 'pass';
+                logReason = 'not_in_log';
+            }
+        }
+        const notInLog = logReason === 'not_in_log';
+        const verdict = (0, verdict_js_1.buildVerifyVerdict)({
+            version: packageVersion(),
+            receiptId: receipt.task_id || null,
+            displayId: displayIdOf(receipt),
+            payloadVersion: null,
+            historySource: resolved.source,
+            historyHead: resolved.headHash,
+            historyCount: resolved.entryCount,
+            historyAsOf: resolved.asOf,
+            signatureChecked: false,
+            historyReason: notInLog ? null : 'signed_receipt_unavailable',
+            historyMissing: false,
+            errors: [],
+            logInclusion,
+            anchor: anchorState,
+            logReason: notInLog ? 'not_in_log' : null,
+        });
+        return printLocked(verdict, args.json);
+    }
+    const result = await (0, index_js_1.verifyReceipt)(receipt, {
+        trustedKids,
+        requirePreimages: true,
+        ...historyOptions(resolved),
+    });
+    const unsupported = (result.errors || []).includes('unsupported_version');
+    let logInclusion = 'unclaimed';
+    let anchorState = 'unclaimed';
+    let logReason = null;
+    let log = null;
+    const signatureOk = result.issuer_signature.valid === true && !resolved.invalid && !unsupported;
+    const logHostOk = typeof receipt.verify_url === 'string' && historyHostAllowed(receipt.verify_url);
+    if (signatureOk && result.issuer_history.ok && logHostOk) {
+        const fresh = await freshPublicLog(receipt, resolved.document);
+        logInclusion = fresh.logInclusion;
+        anchorState = fresh.anchor;
+        logReason = fresh.logReason;
+        log = fresh.log;
+    }
+    const verdict = (0, verdict_js_1.buildVerifyVerdict)({
+        version: packageVersion(),
+        receiptId: result.receipt_id,
+        displayId: displayIdOf(receipt),
+        payloadVersion: result.receipt_version ?? null,
+        historySource: resolved.source,
+        historyHead: resolved.headHash,
+        historyCount: resolved.entryCount,
+        historyAsOf: resolved.asOf,
+        signatureValid: unsupported ? null : result.issuer_signature.valid === true,
+        signatureChecked: unsupported ? false : Boolean(result.issuer_signature.checked),
+        historyChecked: unsupported ? false : (resolved.invalid || result.issuer_history.checked),
+        historyOk: unsupported ? false : (resolved.invalid ? false : result.issuer_history.ok),
+        historyReason: resolved.invalid ? (resolved.reason || result.issuer_history.reason) : result.issuer_history.reason,
+        historyMissing: unsupported ? true : (resolved.document == null && !resolved.invalid),
+        bindingExpected: !!result.binding.expected,
+        bindingMatches: result.binding.matches,
+        claimMismatches: result.claim_mismatches.length,
+        payerChecked: result.payer.checked,
+        payerValid: result.payer.valid,
+        errors: result.errors,
+        logInclusion,
+        anchor: anchorState,
+        logReason,
+        log,
+    });
+    return printLocked(verdict, args.json);
+}
+main()
+    .then((code) => finish(code))
+    .catch((err) => {
+    console.error('Unexpected error:', err);
+    return finish(1);
+});
+//# sourceMappingURL=cli.js.map