signafaide 0.0.0-stage → 0.3.0

package/dist/core.cjs

@@ -0,0 +1,2711 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target2, all) => {
+  for (var name in all)
+    __defProp(target2, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target2) => (target2 = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target2, "default", { value: mod, enumerable: true }) : target2,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/core.ts
+var core_exports = {};
+__export(core_exports, {
+  AGENT_RE: () => AGENT_RE,
+  ANCHOR_WINDOW_MS: () => ANCHOR_WINDOW_MS,
+  CHECKS: () => CHECKS,
+  Client: () => Client,
+  DEFAULT_URL: () => DEFAULT_URL,
+  HEADER: () => HEADER,
+  JsonNumber: () => JsonNumber,
+  KeysRequired: () => KeysRequired,
+  MAX_DECLARED_NAME: () => MAX_DECLARED_NAME,
+  MAX_NODES: () => MAX_NODES,
+  MAX_PROOF_BYTES: () => MAX_PROOF_BYTES,
+  MAX_ROUND: () => MAX_ROUND,
+  NOT_INDEPENDENT: () => NOT_INDEPENDENT,
+  Report: () => Report,
+  SignafaideError: () => SignafaideError,
+  SigningKey: () => SigningKey,
+  TOOLS: () => TOOLS,
+  TOOL_PREFIX: () => TOOL_PREFIX,
+  TOOL_UNRECORDED_PREFIX: () => TOOL_UNRECORDED_PREFIX,
+  VERSION: () => VERSION,
+  agentName: () => agentName,
+  assertPortableNumbers: () => assertPortableNumbers,
+  auditPath: () => auditPath,
+  b64url: () => b64url,
+  b64urlDecode: () => b64urlDecode,
+  blockAttestations: () => blockAttestations,
+  canonicalBytes: () => canonicalBytes,
+  canonicalize: () => canonicalize,
+  checkContent: () => checkContent,
+  checkHeader: () => checkHeader,
+  checkRoundTime: () => checkRoundTime,
+  clampTime: () => clampTime,
+  clientHeader: () => clientHeader,
+  contentFromText: () => contentFromText,
+  contentHash: () => contentHash,
+  countsText: () => countsText,
+  coverage: () => coverage,
+  coverageLines: () => coverageLines,
+  declaredName: () => declaredName,
+  detectAgent: () => detectAgent,
+  draftErrors: () => draftErrors,
+  envelopeErrors: () => envelopeErrors,
+  exportStatement: () => exportStatement,
+  fetchJson: () => fetchJson,
+  hashJson: () => hashJson,
+  isLoopbackUrl: () => isLoopbackUrl,
+  keyEntryErrors: () => keyEntryErrors,
+  keyId: () => keyId,
+  leafHash: () => leafHash,
+  loadDrandVerifier: () => loadDrandVerifier,
+  makeDraft: () => makeDraft,
+  makeRecord: () => makeRecord,
+  manifestEntry: () => manifestEntry,
+  manifestErrors: () => manifestErrors,
+  merkleRoot: () => merkleRoot,
+  newSalt: () => newSalt,
+  now: () => now,
+  otsStatus: () => otsStatus,
+  parseAgentKeys: () => parseAgentKeys,
+  parseHeadFile: () => parseHeadFile,
+  parseJson: () => parseJson,
+  parseOts: () => parseOts,
+  parseServiceKeys: () => parseServiceKeys,
+  receiptErrors: () => receiptErrors,
+  recordErrors: () => recordErrors,
+  recordHash: () => recordHash,
+  recordsHash: () => recordsHash,
+  registration: () => registration,
+  resultLine: () => resultLine,
+  rootsFromVector: () => rootsFromVector,
+  scopeText: () => scopeText,
+  serviceKeysHash: () => serviceKeysHash,
+  sha256Hex: () => sha256Hex,
+  signDraft: () => signDraft,
+  signedMessage: () => signedMessage,
+  target: () => target,
+  telemetryEnabled: () => telemetryEnabled,
+  timestampHeights: () => timestampHeights,
+  toolNote: () => toolNote,
+  toolNoteName: () => toolNoteName,
+  validProjectId: () => validProjectId,
+  validTime: () => validTime,
+  verifyInclusion: () => verifyInclusion,
+  verifyLocalState: () => verifyLocalState,
+  verifyPack: () => verifyPack,
+  verifySig: () => verifySig,
+  wireRecord: () => wireRecord,
+  withWallTime: () => withWallTime
+});
+module.exports = __toCommonJS(core_exports);
+
+// src/jcs.ts
+var LONE_SURROGATE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+var encoder = new TextEncoder();
+var JsonNumber = class {
+  constructor(text, value, unsafeInteger) {
+    this.text = text;
+    this.value = value;
+    this.unsafeInteger = unsafeInteger;
+  }
+  text;
+  value;
+  unsafeInteger;
+  toJSON() {
+    return this.value;
+  }
+};
+function canonicalize(value) {
+  if (value === null) return "null";
+  if (value instanceof JsonNumber) {
+    if (value.unsafeInteger) throw new RangeError(`unsafe_integer: integer ${value.text} is outside \xB1(2^53-1) and cannot be canonicalized exactly`);
+    if (!Number.isFinite(value.value)) throw new RangeError(`number ${value.text} is not a finite IEEE 754 double`);
+    return JSON.stringify(value.value);
+  }
+  switch (typeof value) {
+    case "boolean":
+      return value ? "true" : "false";
+    case "number":
+      if (!Number.isFinite(value)) throw new RangeError("JCS does not allow NaN or Infinity");
+      return JSON.stringify(value);
+    case "string":
+      if (LONE_SURROGATE.test(value)) throw new RangeError("JCS strings must not contain lone surrogates");
+      return JSON.stringify(value);
+    case "object": {
+      if (Array.isArray(value)) return "[" + value.map(canonicalize).join(",") + "]";
+      const proto = Object.getPrototypeOf(value);
+      if (proto !== Object.prototype && proto !== null) {
+        throw new TypeError(`JCS cannot encode ${value.constructor?.name ?? "this object"}`);
+      }
+      const obj = value;
+      const keys = Object.keys(obj).filter((k) => obj[k] !== void 0).sort();
+      return "{" + keys.map((k) => canonicalize(k) + ":" + canonicalize(obj[k])).join(",") + "}";
+    }
+    default:
+      throw new TypeError(`JCS cannot encode ${typeof value}`);
+  }
+}
+function canonicalBytes(value) {
+  return encoder.encode(canonicalize(value));
+}
+var isUnsafeInteger = (x) => Number.isInteger(x) && Math.abs(x) > Number.MAX_SAFE_INTEGER && Math.abs(x) < 1e21;
+function assertPortableNumbers(value) {
+  if (typeof value === "number" && isUnsafeInteger(value)) throw new RangeError(`unsafe_integer: ${value} is beyond +-(2^53-1); send it as a string`);
+  if (value && typeof value === "object") for (const v of Object.values(value)) assertPortableNumbers(v);
+}
+function parseJson(text) {
+  let i = 0;
+  const fail = (what) => {
+    throw new SyntaxError(`JSON: ${what} at position ${i}`);
+  };
+  const ws = () => {
+    while (i < text.length && " 	\n\r".includes(text[i])) i++;
+  };
+  const value = (depth) => {
+    if (depth > 512) fail("nested too deeply");
+    ws();
+    const c = text[i];
+    if (c === "{") {
+      i++;
+      const out2 = {};
+      ws();
+      if (text[i] === "}") {
+        i++;
+        return out2;
+      }
+      for (; ; ) {
+        ws();
+        if (text[i] !== '"') fail("expected a string key");
+        const k = str();
+        ws();
+        if (text[i++] !== ":") fail("expected ':'");
+        Object.defineProperty(out2, k, { value: value(depth + 1), enumerable: true, writable: true, configurable: true });
+        ws();
+        if (text[i] === ",") i++;
+        else if (text[i] === "}") {
+          i++;
+          return out2;
+        } else fail("expected ',' or '}'");
+      }
+    }
+    if (c === "[") {
+      i++;
+      const out2 = [];
+      ws();
+      if (text[i] === "]") {
+        i++;
+        return out2;
+      }
+      for (; ; ) {
+        out2.push(value(depth + 1));
+        ws();
+        if (text[i] === ",") i++;
+        else if (text[i] === "]") {
+          i++;
+          return out2;
+        } else fail("expected ',' or ']'");
+      }
+    }
+    if (c === '"') return str();
+    for (const [lit2, v2] of [["true", true], ["false", false], ["null", null]]) {
+      if (text.startsWith(lit2, i)) {
+        i += lit2.length;
+        return v2;
+      }
+    }
+    const m = /^-?(?:0|[1-9]\d*)(\.\d+)?([eE][+-]?\d+)?/.exec(text.slice(i, i + 400));
+    if (!m) fail("unexpected character");
+    i += m[0].length;
+    const lit = m[0];
+    const v = Number(lit);
+    if (!m[1] && !m[2]) return Math.abs(v) <= Number.MAX_SAFE_INTEGER ? v : new JsonNumber(lit, v, true);
+    return Number.isInteger(v) ? new JsonNumber(lit, v, false) : v;
+  };
+  const str = () => {
+    const start = i;
+    i++;
+    let raw = false;
+    while (i < text.length && text[i] !== '"') {
+      if (text[i] === "\\") {
+        raw = true;
+        i++;
+      } else if (text.charCodeAt(i) < 32) fail("control character in a string");
+      i++;
+    }
+    if (i >= text.length) fail("unterminated string");
+    i++;
+    const s = text.slice(start, i);
+    return raw ? JSON.parse(s) : s.slice(1, -1);
+  };
+  const out = value(0);
+  ws();
+  if (i !== text.length) fail("trailing text");
+  return out;
+}
+
+// node_modules/@noble/ed25519/index.js
+var ed25519_CURVE = {
+  p: 0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffedn,
+  n: 0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3edn,
+  h: 8n,
+  a: 0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffecn,
+  d: 0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3n,
+  Gx: 0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51an,
+  Gy: 0x6666666666666666666666666666666666666666666666666666666666666658n
+};
+var { p: P, n: N, Gx, Gy, a: _a, d: _d } = ed25519_CURVE;
+var h = 8n;
+var L = 32;
+var L2 = 64;
+var err = (m = "") => {
+  throw new Error(m);
+};
+var isBig = (n) => typeof n === "bigint";
+var isStr = (s) => typeof s === "string";
+var isBytes = (a) => a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array";
+var abytes = (a, l) => !isBytes(a) || typeof l === "number" && l > 0 && a.length !== l ? err("Uint8Array expected") : a;
+var u8n = (len) => new Uint8Array(len);
+var u8fr = (buf) => Uint8Array.from(buf);
+var padh = (n, pad) => n.toString(16).padStart(pad, "0");
+var bytesToHex = (b) => Array.from(abytes(b)).map((e) => padh(e, 2)).join("");
+var C = { _0: 48, _9: 57, A: 65, F: 70, a: 97, f: 102 };
+var _ch = (ch) => {
+  if (ch >= C._0 && ch <= C._9)
+    return ch - C._0;
+  if (ch >= C.A && ch <= C.F)
+    return ch - (C.A - 10);
+  if (ch >= C.a && ch <= C.f)
+    return ch - (C.a - 10);
+  return;
+};
+var hexToBytes = (hex2) => {
+  const e = "hex invalid";
+  if (!isStr(hex2))
+    return err(e);
+  const hl = hex2.length;
+  const al = hl / 2;
+  if (hl % 2)
+    return err(e);
+  const array = u8n(al);
+  for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) {
+    const n1 = _ch(hex2.charCodeAt(hi));
+    const n2 = _ch(hex2.charCodeAt(hi + 1));
+    if (n1 === void 0 || n2 === void 0)
+      return err(e);
+    array[ai] = n1 * 16 + n2;
+  }
+  return array;
+};
+var toU8 = (a, len) => abytes(isStr(a) ? hexToBytes(a) : u8fr(abytes(a)), len);
+var cr = () => globalThis?.crypto;
+var subtle = () => cr()?.subtle ?? err("crypto.subtle must be defined");
+var concatBytes = (...arrs) => {
+  const r = u8n(arrs.reduce((sum, a) => sum + abytes(a).length, 0));
+  let pad = 0;
+  arrs.forEach((a) => {
+    r.set(a, pad);
+    pad += a.length;
+  });
+  return r;
+};
+var randomBytes = (len = L) => {
+  const c = cr();
+  return c.getRandomValues(u8n(len));
+};
+var big = BigInt;
+var arange = (n, min, max, msg = "bad number: out of range") => isBig(n) && min <= n && n < max ? n : err(msg);
+var M = (a, b = P) => {
+  const r = a % b;
+  return r >= 0n ? r : b + r;
+};
+var modN = (a) => M(a, N);
+var invert = (num, md) => {
+  if (num === 0n || md <= 0n)
+    err("no inverse n=" + num + " mod=" + md);
+  let a = M(num, md), b = md, x = 0n, y = 1n, u = 1n, v = 0n;
+  while (a !== 0n) {
+    const q = b / a, r = b % a;
+    const m = x - u * q, n = y - v * q;
+    b = a, a = r, x = u, y = v, u = m, v = n;
+  }
+  return b === 1n ? M(x, md) : err("no inverse");
+};
+var callHash = (name) => {
+  const fn = etc[name];
+  if (typeof fn !== "function")
+    err("hashes." + name + " not set");
+  return fn;
+};
+var apoint = (p) => p instanceof Point ? p : err("Point expected");
+var B256 = 2n ** 256n;
+var Point = class _Point {
+  static BASE;
+  static ZERO;
+  ex;
+  ey;
+  ez;
+  et;
+  constructor(ex, ey, ez, et) {
+    const max = B256;
+    this.ex = arange(ex, 0n, max);
+    this.ey = arange(ey, 0n, max);
+    this.ez = arange(ez, 1n, max);
+    this.et = arange(et, 0n, max);
+    Object.freeze(this);
+  }
+  static fromAffine(p) {
+    return new _Point(p.x, p.y, 1n, M(p.x * p.y));
+  }
+  /** RFC8032 5.1.3: Uint8Array to Point. */
+  static fromBytes(hex2, zip215 = false) {
+    const d = _d;
+    const normed = u8fr(abytes(hex2, L));
+    const lastByte = hex2[31];
+    normed[31] = lastByte & ~128;
+    const y = bytesToNumLE(normed);
+    const max = zip215 ? B256 : P;
+    arange(y, 0n, max);
+    const y2 = M(y * y);
+    const u = M(y2 - 1n);
+    const v = M(d * y2 + 1n);
+    let { isValid, value: x } = uvRatio(u, v);
+    if (!isValid)
+      err("bad point: y not sqrt");
+    const isXOdd = (x & 1n) === 1n;
+    const isLastByteOdd = (lastByte & 128) !== 0;
+    if (!zip215 && x === 0n && isLastByteOdd)
+      err("bad point: x==0, isLastByteOdd");
+    if (isLastByteOdd !== isXOdd)
+      x = M(-x);
+    return new _Point(x, y, 1n, M(x * y));
+  }
+  /** Checks if the point is valid and on-curve. */
+  assertValidity() {
+    const a = _a;
+    const d = _d;
+    const p = this;
+    if (p.is0())
+      throw new Error("bad point: ZERO");
+    const { ex: X, ey: Y, ez: Z, et: T } = p;
+    const X2 = M(X * X);
+    const Y2 = M(Y * Y);
+    const Z2 = M(Z * Z);
+    const Z4 = M(Z2 * Z2);
+    const aX2 = M(X2 * a);
+    const left = M(Z2 * M(aX2 + Y2));
+    const right = M(Z4 + M(d * M(X2 * Y2)));
+    if (left !== right)
+      throw new Error("bad point: equation left != right (1)");
+    const XY = M(X * Y);
+    const ZT = M(Z * T);
+    if (XY !== ZT)
+      throw new Error("bad point: equation left != right (2)");
+    return this;
+  }
+  /** Equality check: compare points P&Q. */
+  equals(other) {
+    const { ex: X1, ey: Y1, ez: Z1 } = this;
+    const { ex: X2, ey: Y2, ez: Z2 } = apoint(other);
+    const X1Z2 = M(X1 * Z2);
+    const X2Z1 = M(X2 * Z1);
+    const Y1Z2 = M(Y1 * Z2);
+    const Y2Z1 = M(Y2 * Z1);
+    return X1Z2 === X2Z1 && Y1Z2 === Y2Z1;
+  }
+  is0() {
+    return this.equals(I);
+  }
+  /** Flip point over y coordinate. */
+  negate() {
+    return new _Point(M(-this.ex), this.ey, this.ez, M(-this.et));
+  }
+  /** Point doubling. Complete formula. Cost: `4M + 4S + 1*a + 6add + 1*2`. */
+  double() {
+    const { ex: X1, ey: Y1, ez: Z1 } = this;
+    const a = _a;
+    const A = M(X1 * X1);
+    const B = M(Y1 * Y1);
+    const C2 = M(2n * M(Z1 * Z1));
+    const D = M(a * A);
+    const x1y1 = X1 + Y1;
+    const E = M(M(x1y1 * x1y1) - A - B);
+    const G2 = D + B;
+    const F = G2 - C2;
+    const H = D - B;
+    const X3 = M(E * F);
+    const Y3 = M(G2 * H);
+    const T3 = M(E * H);
+    const Z3 = M(F * G2);
+    return new _Point(X3, Y3, Z3, T3);
+  }
+  /** Point addition. Complete formula. Cost: `8M + 1*k + 8add + 1*2`. */
+  add(other) {
+    const { ex: X1, ey: Y1, ez: Z1, et: T1 } = this;
+    const { ex: X2, ey: Y2, ez: Z2, et: T2 } = apoint(other);
+    const a = _a;
+    const d = _d;
+    const A = M(X1 * X2);
+    const B = M(Y1 * Y2);
+    const C2 = M(T1 * d * T2);
+    const D = M(Z1 * Z2);
+    const E = M((X1 + Y1) * (X2 + Y2) - A - B);
+    const F = M(D - C2);
+    const G2 = M(D + C2);
+    const H = M(B - a * A);
+    const X3 = M(E * F);
+    const Y3 = M(G2 * H);
+    const T3 = M(E * H);
+    const Z3 = M(F * G2);
+    return new _Point(X3, Y3, Z3, T3);
+  }
+  /**
+   * Point-by-scalar multiplication. Scalar must be in range 1 <= n < CURVE.n.
+   * Uses {@link wNAF} for base point.
+   * Uses fake point to mitigate side-channel leakage.
+   * @param n scalar by which point is multiplied
+   * @param safe safe mode guards against timing attacks; unsafe mode is faster
+   */
+  multiply(n, safe = true) {
+    if (!safe && (n === 0n || this.is0()))
+      return I;
+    arange(n, 1n, N);
+    if (n === 1n)
+      return this;
+    if (this.equals(G))
+      return wNAF(n).p;
+    let p = I;
+    let f = G;
+    for (let d = this; n > 0n; d = d.double(), n >>= 1n) {
+      if (n & 1n)
+        p = p.add(d);
+      else if (safe)
+        f = f.add(d);
+    }
+    return p;
+  }
+  /** Convert point to 2d xy affine point. (X, Y, Z) ∋ (x=X/Z, y=Y/Z) */
+  toAffine() {
+    const { ex: x, ey: y, ez: z } = this;
+    if (this.equals(I))
+      return { x: 0n, y: 1n };
+    const iz = invert(z, P);
+    if (M(z * iz) !== 1n)
+      err("invalid inverse");
+    return { x: M(x * iz), y: M(y * iz) };
+  }
+  toBytes() {
+    const { x, y } = this.assertValidity().toAffine();
+    const b = numTo32bLE(y);
+    b[31] |= x & 1n ? 128 : 0;
+    return b;
+  }
+  toHex() {
+    return bytesToHex(this.toBytes());
+  }
+  // encode to hex string
+  clearCofactor() {
+    return this.multiply(big(h), false);
+  }
+  isSmallOrder() {
+    return this.clearCofactor().is0();
+  }
+  isTorsionFree() {
+    let p = this.multiply(N / 2n, false).double();
+    if (N % 2n)
+      p = p.add(this);
+    return p.is0();
+  }
+  static fromHex(hex2, zip215) {
+    return _Point.fromBytes(toU8(hex2), zip215);
+  }
+  get x() {
+    return this.toAffine().x;
+  }
+  get y() {
+    return this.toAffine().y;
+  }
+  toRawBytes() {
+    return this.toBytes();
+  }
+};
+var G = new Point(Gx, Gy, 1n, M(Gx * Gy));
+var I = new Point(0n, 1n, 1n, 0n);
+Point.BASE = G;
+Point.ZERO = I;
+var numTo32bLE = (num) => hexToBytes(padh(arange(num, 0n, B256), L2)).reverse();
+var bytesToNumLE = (b) => big("0x" + bytesToHex(u8fr(abytes(b)).reverse()));
+var pow2 = (x, power) => {
+  let r = x;
+  while (power-- > 0n) {
+    r *= r;
+    r %= P;
+  }
+  return r;
+};
+var pow_2_252_3 = (x) => {
+  const x2 = x * x % P;
+  const b2 = x2 * x % P;
+  const b4 = pow2(b2, 2n) * b2 % P;
+  const b5 = pow2(b4, 1n) * x % P;
+  const b10 = pow2(b5, 5n) * b5 % P;
+  const b20 = pow2(b10, 10n) * b10 % P;
+  const b40 = pow2(b20, 20n) * b20 % P;
+  const b80 = pow2(b40, 40n) * b40 % P;
+  const b160 = pow2(b80, 80n) * b80 % P;
+  const b240 = pow2(b160, 80n) * b80 % P;
+  const b250 = pow2(b240, 10n) * b10 % P;
+  const pow_p_5_8 = pow2(b250, 2n) * x % P;
+  return { pow_p_5_8, b2 };
+};
+var RM1 = 0x2b8324804fc1df0b2b4d00993dfbd7a72f431806ad2fe478c4ee1b274a0ea0b0n;
+var uvRatio = (u, v) => {
+  const v3 = M(v * v * v);
+  const v7 = M(v3 * v3 * v);
+  const pow = pow_2_252_3(u * v7).pow_p_5_8;
+  let x = M(u * v3 * pow);
+  const vx2 = M(v * x * x);
+  const root1 = x;
+  const root2 = M(x * RM1);
+  const useRoot1 = vx2 === u;
+  const useRoot2 = vx2 === M(-u);
+  const noRoot = vx2 === M(-u * RM1);
+  if (useRoot1)
+    x = root1;
+  if (useRoot2 || noRoot)
+    x = root2;
+  if ((M(x) & 1n) === 1n)
+    x = M(-x);
+  return { isValid: useRoot1 || useRoot2, value: x };
+};
+var modL_LE = (hash) => modN(bytesToNumLE(hash));
+var sha512s = (...m) => callHash("sha512Sync")(...m);
+var hash2extK = (hashed) => {
+  const head = hashed.slice(0, L);
+  head[0] &= 248;
+  head[31] &= 127;
+  head[31] |= 64;
+  const prefix = hashed.slice(L, L2);
+  const scalar = modL_LE(head);
+  const point = G.multiply(scalar);
+  const pointBytes = point.toBytes();
+  return { head, prefix, scalar, point, pointBytes };
+};
+var getExtendedPublicKey = (priv) => hash2extK(sha512s(toU8(priv, L)));
+var getPublicKey = (priv) => getExtendedPublicKey(priv).pointBytes;
+var hashFinishS = (res) => res.finish(sha512s(res.hashable));
+var _sign = (e, rBytes, msg) => {
+  const { pointBytes: P2, scalar: s } = e;
+  const r = modL_LE(rBytes);
+  const R = G.multiply(r).toBytes();
+  const hashable = concatBytes(R, P2, msg);
+  const finish = (hashed) => {
+    const S = modN(r + modL_LE(hashed) * s);
+    return abytes(concatBytes(R, numTo32bLE(S)), L2);
+  };
+  return { hashable, finish };
+};
+var sign = (msg, privKey) => {
+  const m = toU8(msg);
+  const e = getExtendedPublicKey(privKey);
+  const rBytes = sha512s(e.prefix, m);
+  return hashFinishS(_sign(e, rBytes, m));
+};
+var veriOpts = { zip215: true };
+var _verify = (sig, msg, pub, opts = veriOpts) => {
+  sig = toU8(sig, L2);
+  msg = toU8(msg);
+  pub = toU8(pub, L);
+  const { zip215 } = opts;
+  let A;
+  let R;
+  let s;
+  let SB;
+  let hashable = Uint8Array.of();
+  try {
+    A = Point.fromHex(pub, zip215);
+    R = Point.fromHex(sig.slice(0, L), zip215);
+    s = bytesToNumLE(sig.slice(L, L2));
+    SB = G.multiply(s, false);
+    hashable = concatBytes(R.toBytes(), A.toBytes(), msg);
+  } catch (error) {
+  }
+  const finish = (hashed) => {
+    if (SB == null)
+      return false;
+    if (!zip215 && A.isSmallOrder())
+      return false;
+    const k = modL_LE(hashed);
+    const RkA = R.add(A.multiply(k, false));
+    return RkA.add(SB.negate()).clearCofactor().is0();
+  };
+  return { hashable, finish };
+};
+var verify = (s, m, p, opts = veriOpts) => hashFinishS(_verify(s, m, p, opts));
+var etc = {
+  sha512Async: async (...messages) => {
+    const s = subtle();
+    const m = concatBytes(...messages);
+    return u8n(await s.digest("SHA-512", m.buffer));
+  },
+  sha512Sync: void 0,
+  bytesToHex,
+  hexToBytes,
+  concatBytes,
+  mod: M,
+  invert,
+  randomBytes
+};
+var W = 8;
+var scalarBits = 256;
+var pwindows = Math.ceil(scalarBits / W) + 1;
+var pwindowSize = 2 ** (W - 1);
+var precompute = () => {
+  const points = [];
+  let p = G;
+  let b = p;
+  for (let w = 0; w < pwindows; w++) {
+    b = p;
+    points.push(b);
+    for (let i = 1; i < pwindowSize; i++) {
+      b = b.add(p);
+      points.push(b);
+    }
+    p = b.double();
+  }
+  return points;
+};
+var Gpows = void 0;
+var ctneg = (cnd, p) => {
+  const n = p.negate();
+  return cnd ? n : p;
+};
+var wNAF = (n) => {
+  const comp = Gpows || (Gpows = precompute());
+  let p = I;
+  let f = G;
+  const pow_2_w = 2 ** W;
+  const maxNum = pow_2_w;
+  const mask = big(pow_2_w - 1);
+  const shiftBy = big(W);
+  for (let w = 0; w < pwindows; w++) {
+    let wbits = Number(n & mask);
+    n >>= shiftBy;
+    if (wbits > pwindowSize) {
+      wbits -= maxNum;
+      n += 1n;
+    }
+    const off = w * pwindowSize;
+    const offF = off;
+    const offP = off + Math.abs(wbits) - 1;
+    const isEven = w % 2 !== 0;
+    const isNeg = wbits < 0;
+    if (wbits === 0) {
+      f = f.add(ctneg(isEven, comp[offF]));
+    } else {
+      p = p.add(ctneg(isNeg, comp[offP]));
+    }
+  }
+  return { p, f };
+};
+
+// src/crypto.ts
+var import_sha2 = require("@noble/hashes/sha2");
+var import_utils = require("@noble/hashes/utils");
+etc.sha512Sync = (...m) => (0, import_sha2.sha512)((0, import_utils.concatBytes)(...m));
+var DOMAINS = ["record", "batch", "head", "anchor", "register", "rotate", "agent_key", "export", "draft"];
+var HEX64 = /^[0-9a-f]{64}$/;
+var SALT_RE = /^[0-9a-f]{32}$/;
+var encoder2 = new TextEncoder();
+var nativeSha256 = null;
+var nativeVerify = null;
+var digest = (data) => nativeSha256 ? nativeSha256(data) : (0, import_sha2.sha256)(data);
+function sha256Hex(data) {
+  return (0, import_utils.bytesToHex)(digest(data));
+}
+function hashJson(value) {
+  return sha256Hex(canonicalBytes(value));
+}
+function newSalt() {
+  return (0, import_utils.bytesToHex)(randomBytes2(16));
+}
+function contentHash(content, salt) {
+  if (!content || typeof content !== "object" || Array.isArray(content)) throw new Error("content must be a JSON object");
+  if (typeof salt !== "string" || !SALT_RE.test(salt)) throw new Error("salt must be 32 lowercase hex characters (16 bytes)");
+  return sha256Hex((0, import_utils.concatBytes)((0, import_utils.hexToBytes)(salt), canonicalBytes(content)));
+}
+function checkContent(content, salt, expected) {
+  if (content === void 0 && salt === void 0) return null;
+  if (salt === void 0) throw new Error("content is present without its salt");
+  if (content === void 0) throw new Error("salt is present without content");
+  const h2 = contentHash(content, salt);
+  return h2 === expected ? null : h2;
+}
+var B64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+function b64url(data) {
+  let out = "";
+  for (let i = 0; i < data.length; i += 3) {
+    const n = data[i] << 16 | (data[i + 1] ?? 0) << 8 | (data[i + 2] ?? 0);
+    const chars = Math.min(4, Math.ceil((data.length - i) * 8 / 6));
+    for (let j = 0; j < chars; j++) out += B64[n >> 18 - 6 * j & 63];
+  }
+  return out;
+}
+function b64urlDecode(s) {
+  if (typeof s !== "string" || !/^[A-Za-z0-9_-]*$/.test(s) || s.length % 4 === 1) {
+    throw new Error("not base64url without padding");
+  }
+  const out = new Uint8Array(Math.floor(s.length * 6 / 8));
+  let bits = 0;
+  let acc = 0;
+  let o = 0;
+  for (const c of s) {
+    acc = acc << 6 | B64.indexOf(c);
+    bits += 6;
+    if (bits >= 8) {
+      bits -= 8;
+      out[o++] = acc >> bits & 255;
+    }
+  }
+  return out;
+}
+function keyId(publicKey) {
+  return sha256Hex(publicKey).slice(0, 16);
+}
+function signedMessage(domain, hashHex) {
+  if (!DOMAINS.includes(domain)) throw new Error(`unknown signature domain ${domain}`);
+  if (!HEX64.test(hashHex ?? "")) throw new Error("hash must be 64 lowercase hex characters");
+  return (0, import_utils.concatBytes)(encoder2.encode(`signafaide/v1/${domain}
+`), (0, import_utils.hexToBytes)(hashHex));
+}
+var SigningKey = class _SigningKey {
+  publicKey;
+  keyId;
+  #seed;
+  constructor(seed) {
+    if (seed.length !== 32) throw new Error("an Ed25519 seed is 32 bytes");
+    this.#seed = seed;
+    this.publicKey = getPublicKey(seed);
+    this.keyId = keyId(this.publicKey);
+  }
+  static generate(random = randomBytes2) {
+    return new _SigningKey(random(32));
+  }
+  seed() {
+    return this.#seed;
+  }
+  /** base64url Ed25519 signature over `signafaide/v1/<domain>\n` + raw hash. */
+  sign(domain, hashHex) {
+    return b64url(sign(signedMessage(domain, hashHex), this.#seed));
+  }
+};
+function verifySig(publicKeyB64, domain, hashHex, sigB64) {
+  try {
+    const pk = b64urlDecode(publicKeyB64);
+    const sig = b64urlDecode(sigB64);
+    if (pk.length !== 32 || sig.length !== 64) return false;
+    if (nativeVerify) return nativeVerify(pk, signedMessage(domain, hashHex), sig);
+    return verify(sig, signedMessage(domain, hashHex), pk, { zip215: false });
+  } catch {
+    return false;
+  }
+}
+function randomBytes2(n) {
+  const c = globalThis.crypto;
+  if (!c?.getRandomValues) throw new Error("no secure random source: pass one to SigningKey.generate");
+  return c.getRandomValues(new Uint8Array(n));
+}
+function leafHash(hashHex) {
+  return digest((0, import_utils.concatBytes)(new Uint8Array([0]), (0, import_utils.hexToBytes)(hashHex)));
+}
+function node(left, right) {
+  return digest((0, import_utils.concatBytes)(new Uint8Array([1]), left, right));
+}
+function split(n) {
+  let k = 1;
+  while (k * 2 < n) k *= 2;
+  return k;
+}
+function root(leaves) {
+  if (leaves.length === 1) return leaves[0];
+  const k = split(leaves.length);
+  return node(root(leaves.slice(0, k)), root(leaves.slice(k)));
+}
+function merkleRoot(hashes) {
+  if (!hashes.length) throw new Error("a Merkle tree needs at least one leaf");
+  return (0, import_utils.bytesToHex)(root(hashes.map(leafHash)));
+}
+function auditPath(hashes, index) {
+  if (index < 0 || index >= hashes.length) throw new Error("index out of range");
+  const leaves = hashes.map(leafHash);
+  const path = [];
+  const walk = (lo, hi) => {
+    if (hi - lo === 1) return;
+    const k = split(hi - lo);
+    if (index < lo + k) {
+      walk(lo, lo + k);
+      path.push((0, import_utils.bytesToHex)(root(leaves.slice(lo + k, hi))));
+    } else {
+      walk(lo + k, hi);
+      path.push((0, import_utils.bytesToHex)(root(leaves.slice(lo, lo + k))));
+    }
+  };
+  walk(0, leaves.length);
+  return path;
+}
+function verifyInclusion(hashHex, index, size, path, rootHex) {
+  try {
+    if (!Number.isInteger(index) || !Number.isInteger(size) || !Array.isArray(path)) return false;
+    let fn = index;
+    let sn = size - 1;
+    if (fn < 0 || fn > sn) return false;
+    let r = leafHash(hashHex);
+    for (const pHex of path) {
+      if (typeof pHex !== "string" || !HEX64.test(pHex) || sn === 0) return false;
+      const p = (0, import_utils.hexToBytes)(pHex);
+      if (fn % 2 === 1 || fn === sn) {
+        r = node(p, r);
+        while (fn % 2 === 0 && fn !== 0) {
+          fn = Math.floor(fn / 2);
+          sn = Math.floor(sn / 2);
+        }
+      } else {
+        r = node(r, p);
+      }
+      fn = Math.floor(fn / 2);
+      sn = Math.floor(sn / 2);
+    }
+    return sn === 0 && (0, import_utils.bytesToHex)(r) === rootHex;
+  } catch {
+    return false;
+  }
+}
+
+// src/records.ts
+var KINDS = ["decision", "outcome", "note"];
+var ENVELOPE_FIELDS = ["v", "kind", "project", "env", "agent", "seq", "prev", "time", "name", "content_hash", "ref"];
+var DRAFT_FIELDS = ["v", "kind", "agent", "seq", "prev", "time", "name", "content_hash", "ref"];
+var AGENT_KEYS_FORMAT = "signafaide-agent-keys/1";
+var MAX_CLOCK_SKEW_MS = 3e5;
+var AGENT_RE = /^[a-z0-9][a-z0-9._-]{0,63}$/;
+var TIME_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+var KEY_ID_RE = /^[0-9a-f]{16}$/;
+var PROJECT_RE = /^prj_[0-7][0-9A-HJKMNP-TV-Z]{25}$/;
+var sameKeys = (o, keys) => !!o && typeof o === "object" && !Array.isArray(o) && Object.keys(o).length === keys.length && keys.every((k) => k in o);
+var RECEIPT_FIELDS = ["record_hash", "index", "proof", "batch", "batch_hash", "batch_sig", "service_key_id", "head", "head_sig"];
+var BATCH_FIELDS = ["v", "project", "env", "seq", "prev", "root", "size", "server_time", "drand"];
+var HEAD_FIELDS = ["project", "env", "agent", "seq", "record_hash", "server_time"];
+var DRAND_FIELDS = ["chain", "round", "randomness", "signature"];
+function now() {
+  return (/* @__PURE__ */ new Date()).toISOString();
+}
+function clampTime(wall, prev, validFrom) {
+  let t = Date.parse(wall);
+  for (const f of [prev, validFrom]) if (f && validTime(f)) t = Math.max(t, Date.parse(f));
+  const out = new Date(t).toISOString();
+  return [out, out !== wall];
+}
+function withWallTime(content, wall) {
+  const meta = content.meta;
+  if (meta === void 0 || meta === null) return { ...content, meta: { wall_time: wall } };
+  if (typeof meta === "object" && !Array.isArray(meta)) return { ...content, meta: { ...meta, wall_time: wall } };
+  return { ...content, wall_time: wall };
+}
+function validTime(s) {
+  return typeof s === "string" && TIME_RE.test(s) && !s.startsWith("0000") && !Number.isNaN(Date.parse(s)) && new Date(s).toISOString() === s;
+}
+function agentName(raw) {
+  const s = raw.trim().toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^[^a-z0-9]+/, "").slice(0, 64).replace(/-+$/, "");
+  return s || "agent";
+}
+var isInt = (x) => typeof x === "number" && Number.isInteger(x);
+var isHex = (x) => typeof x === "string" && HEX64.test(x);
+function validProjectId(s) {
+  return typeof s === "string" && PROJECT_RE.test(s);
+}
+function receiptErrors(rc) {
+  if (!sameKeys(rc, RECEIPT_FIELDS)) return ["receipt fields are " + [...RECEIPT_FIELDS].sort().join(", ")];
+  const errs = [];
+  const { batch: b, head: h2 } = rc;
+  if (!(isHex(rc.record_hash) && isHex(rc.batch_hash) && isInt(rc.index) && rc.index >= 0)) errs.push("receipt record_hash, batch_hash or index is invalid");
+  if (!(Array.isArray(rc.proof) && rc.proof.every(isHex))) errs.push("receipt proof must be a list of hashes");
+  if (!["batch_sig", "head_sig", "service_key_id"].every((k) => typeof rc[k] === "string")) errs.push("receipt batch_sig, head_sig and service_key_id are strings");
+  if (!sameKeys(b, BATCH_FIELDS)) errs.push("batch fields are " + [...BATCH_FIELDS].sort().join(", "));
+  else if (!(b.v === 1 && validProjectId(b.project) && (b.env === "test" || b.env === "live") && isInt(b.seq) && b.seq >= 1 && (b.prev === null || isHex(b.prev)) && isHex(b.root) && isInt(b.size) && b.size >= 1 && validTime(b.server_time)))
+    errs.push("batch has an invalid value");
+  else if (b.drand !== null && !(sameKeys(b.drand, DRAND_FIELDS) && isInt(b.drand.round) && ["chain", "randomness", "signature"].every((k) => typeof b.drand[k] === "string")))
+    errs.push("batch drand must be null or {chain, round, randomness, signature}");
+  if (!sameKeys(h2, HEAD_FIELDS)) errs.push("head fields are " + [...HEAD_FIELDS].sort().join(", "));
+  else if (!(validProjectId(h2.project) && (h2.env === "test" || h2.env === "live") && typeof h2.agent === "string" && AGENT_RE.test(h2.agent) && isInt(h2.seq) && isHex(h2.record_hash) && validTime(h2.server_time)))
+    errs.push("head has an invalid value");
+  return errs;
+}
+function envelopeErrors(env, fields = ENVELOPE_FIELDS) {
+  if (!env || typeof env !== "object" || Array.isArray(env)) return ["envelope is not an object"];
+  const e = env;
+  const errs = [];
+  const missing = fields.filter((f) => !(f in e));
+  const extra = Object.keys(e).filter((k) => !fields.includes(k)).sort();
+  if (missing.length) errs.push("missing " + missing.join(", "));
+  if (extra.length) errs.push("unknown field " + extra.join(", "));
+  if (missing.length) return errs;
+  if (e.v !== 1) errs.push("v must be 1");
+  if (!KINDS.includes(e.kind)) errs.push("kind must be decision, outcome or note");
+  if (fields.includes("project") && !validProjectId(e.project)) errs.push("project must be prj_ followed by a 26-character ULID");
+  if (fields.includes("env") && e.env !== "test" && e.env !== "live") errs.push("env must be test or live");
+  if (typeof e.agent !== "string" || !AGENT_RE.test(e.agent)) errs.push("agent does not match ^[a-z0-9][a-z0-9._-]{0,63}$");
+  if (!isInt(e.seq) || e.seq < 1 || e.seq > Number.MAX_SAFE_INTEGER) errs.push("seq must be an integer from 1 to 2^53-1");
+  else if (e.seq === 1 && e.prev !== null) errs.push("prev must be null when seq = 1");
+  else if (e.seq > 1 && !(typeof e.prev === "string" && HEX64.test(e.prev))) errs.push("prev must be a record hash when seq > 1");
+  if (!validTime(e.time)) errs.push(`time ${JSON.stringify(e.time)} is not RFC 3339 UTC with milliseconds`);
+  const nameLen = typeof e.name === "string" ? [...e.name].length : 0;
+  if (nameLen < 1 || nameLen > 128) errs.push("name must be 1 to 128 characters");
+  if (typeof e.content_hash !== "string" || !HEX64.test(e.content_hash)) errs.push("content_hash must be 64 lowercase hex");
+  if (e.kind === "outcome") {
+    if (!(typeof e.ref === "string" && HEX64.test(e.ref))) errs.push("ref must be the decision's record hash for an outcome");
+  } else if (e.ref !== null) errs.push("ref must be null unless kind is outcome");
+  return errs;
+}
+function recordErrors(rec) {
+  if (!rec || typeof rec !== "object" || Array.isArray(rec)) return ["record is not an object"];
+  const r = rec;
+  const errs = envelopeErrors(r.envelope);
+  const extra = Object.keys(r).filter((k) => !["envelope", "key_id", "sig", "content", "salt", "receipt"].includes(k)).sort();
+  if (extra.length) errs.push("unknown record field " + extra.join(", "));
+  if (typeof r.key_id !== "string" || !KEY_ID_RE.test(r.key_id)) errs.push("key_id must be 16 lowercase hex");
+  let sigOk = false;
+  try {
+    sigOk = b64urlDecode(r.sig).length === 64;
+  } catch {
+    sigOk = false;
+  }
+  if (!sigOk) errs.push("sig must be a base64url Ed25519 signature");
+  if ("content" in r && (!r.content || typeof r.content !== "object" || Array.isArray(r.content))) errs.push("content must be a JSON object");
+  if ("salt" in r && (typeof r.salt !== "string" || !SALT_RE.test(r.salt))) errs.push("salt must be 32 lowercase hex");
+  return errs;
+}
+function makeRecord(key, f) {
+  assertPortableNumbers(f.content);
+  const salt = f.salt ?? newSalt();
+  const envelope = {
+    v: 1,
+    kind: f.kind,
+    project: f.project,
+    env: f.env,
+    agent: f.agent,
+    seq: f.seq,
+    prev: f.prev,
+    time: f.time ?? now(),
+    name: f.name,
+    content_hash: contentHash(f.content, salt),
+    ref: f.ref ?? null
+  };
+  const errs = envelopeErrors(envelope);
+  if (errs.length) throw new Error("invalid record: " + errs.join("; "));
+  return { envelope, key_id: key.keyId, sig: key.sign("record", hashJson(envelope)), content: f.content, salt };
+}
+var INSTANCE_START = "signafaide.instance_start";
+var INSTANCE_STOP = "signafaide.instance_stop";
+var INSTANCE_NOTE = "a new instance continued the chain, so records an earlier instance wrote but had not sent are not known";
+var CLEAN_RESTART_NOTE = "a new instance continued the chain right after the earlier instance's signed stop note (a clean restart, nothing to warn about)";
+function isStopNote(rec, agent, hash) {
+  const e = rec?.envelope;
+  if (!e || e.kind !== "note" || e.name !== INSTANCE_STOP || e.agent !== agent) return false;
+  try {
+    return hashJson(e) === hash;
+  } catch {
+    return false;
+  }
+}
+function recordHash(rec) {
+  return hashJson(rec.envelope);
+}
+function wireRecord(rec, storeContent) {
+  const out = { envelope: rec.envelope, key_id: rec.key_id, sig: rec.sig };
+  if (storeContent && rec.content !== void 0) {
+    out.content = rec.content;
+    if (rec.salt !== void 0) out.salt = rec.salt;
+  }
+  return out;
+}
+function makeDraft(key, f, storeContent) {
+  assertPortableNumbers(f.content);
+  const salt = f.salt ?? newSalt();
+  const d = { v: 1, kind: f.kind, agent: f.agent, seq: f.seq, prev: f.prev, time: f.time ?? now(), name: f.name, content_hash: contentHash(f.content, salt), ref: f.ref ?? null };
+  const errs = envelopeErrors(d, DRAFT_FIELDS);
+  if (errs.length) throw new Error("invalid record: " + errs.join("; "));
+  return { draft: true, envelope: d, key_id: key.keyId, sig: key.sign("draft", hashJson(d)), content: f.content, salt, store_content: storeContent };
+}
+function draftErrors(rec) {
+  if (!rec || typeof rec !== "object" || Array.isArray(rec)) return ["draft is not an object"];
+  const r = rec;
+  const errs = envelopeErrors(r.envelope, DRAFT_FIELDS);
+  const extra = Object.keys(r).filter((k) => !["draft", "envelope", "key_id", "sig", "content", "salt", "store_content"].includes(k)).sort();
+  if (extra.length) errs.push("unknown draft field " + extra.join(", "));
+  if (r.draft !== true) errs.push("draft must be true");
+  if (typeof r.key_id !== "string" || !KEY_ID_RE.test(r.key_id)) errs.push("key_id must be 16 lowercase hex (an unsigned draft from an older SDK cannot be verified)");
+  let sigOk = false;
+  try {
+    sigOk = b64urlDecode(r.sig).length === 64;
+  } catch {
+    sigOk = false;
+  }
+  if (!sigOk) errs.push("sig must be a base64url Ed25519 signature");
+  if ("content" in r && (!r.content || typeof r.content !== "object" || Array.isArray(r.content))) errs.push("content must be a JSON object");
+  if ("salt" in r && (typeof r.salt !== "string" || !SALT_RE.test(r.salt))) errs.push("salt must be 32 lowercase hex");
+  if ("store_content" in r && typeof r.store_content !== "boolean") errs.push("store_content must be true or false");
+  return errs;
+}
+function signDraft(key, draft, project, env, prev, ref, seq) {
+  const d = draft.envelope;
+  return makeRecord(key, { kind: d.kind, project, env, agent: d.agent, seq: seq ?? d.seq, prev, name: d.name, content: draft.content ?? {}, ref, time: d.time, salt: draft.salt });
+}
+function keyEntryErrors(k, agent = false) {
+  const fields = ["key_id", "public_key", "valid_from", "valid_to", ...agent ? ["agent"] : []];
+  if (!sameKeys(k, fields)) return ["key fields are " + [...fields].sort().join(", ")];
+  if (!fields.filter((f) => f !== "valid_to").every((f) => typeof k[f] === "string")) return ["key fields must be strings"];
+  if (!validTime(k.valid_from)) return [`key ${k.key_id}: valid_from is not a time`];
+  if (k.valid_to !== null && !validTime(k.valid_to)) return [`key ${k.key_id}: valid_to is not null or a time`];
+  return [];
+}
+function registration(project, env, agent, publicKey, validFrom) {
+  return { project, env, agent, public_key: publicKey, valid_from: validFrom };
+}
+function manifestEntry(agent, key, validFrom, validTo = null) {
+  const e = { agent, key_id: key.keyId, public_key: b64url(key.publicKey), valid_from: validFrom, valid_to: validTo };
+  return { ...e, sig: key.sign("agent_key", hashJson(e)) };
+}
+function manifestErrors(doc) {
+  if (!sameKeys(doc, ["format", "keys"]) || !Array.isArray(doc.keys)) return ['agent keys must be {"format": "signafaide-agent-keys/1", "keys": [...]}'];
+  if (doc.format !== AGENT_KEYS_FORMAT) return [`format is '${doc.format}', expected '${AGENT_KEYS_FORMAT}'`];
+  for (const e of doc.keys) {
+    if (!sameKeys(e, ["agent", "key_id", "public_key", "valid_from", "valid_to", "sig"]) || !Object.entries(e).every(([k, v]) => typeof v === "string" || k === "valid_to" && v === null)) {
+      return ["each agent key is {agent, key_id, public_key, valid_from, valid_to, sig}"];
+    }
+    if (!AGENT_RE.test(e.agent)) return [`agent ${e.agent} is not a valid agent name`];
+    try {
+      const pk = b64urlDecode(e.public_key);
+      if (pk.length !== 32 || keyId(pk) !== e.key_id) return [`key_id ${e.key_id} does not match its public key`];
+    } catch {
+      return [`key ${e.key_id}: public key is not base64url`];
+    }
+    if (!validTime(e.valid_from)) return [`key ${e.key_id}: valid_from is not a time`];
+    if (e.valid_to !== null && !validTime(e.valid_to)) return [`key ${e.key_id}: valid_to is not null or a time`];
+    const signed = { agent: e.agent, key_id: e.key_id, public_key: e.public_key, valid_from: e.valid_from, valid_to: e.valid_to };
+    if (!verifySig(e.public_key, "agent_key", hashJson(signed), e.sig)) return [`the self-signature of key ${e.key_id} for ${e.agent} does not verify`];
+  }
+  return [];
+}
+
+// src/version.ts
+var VERSION = "0.3.0";
+
+// src/telemetry.ts
+var HEADER = "X-Signafaide-Client";
+var SDK = "signafaide-js";
+var processEnv = () => typeof process !== "undefined" && process.env ? process.env : {};
+var hasPrefix = (env, prefix, skip = []) => Object.keys(env).some((k) => k.startsWith(prefix) && !skip.some((s) => k.startsWith(s)));
+var term = (env) => (env.TERM_PROGRAM ?? "").toLowerCase();
+var AGENTS = [
+  ["claude-code", (e) => e.CLAUDECODE === "1" || hasPrefix(e, "CLAUDE_CODE_")],
+  ["codex", (e) => hasPrefix(e, "CODEX_", ["CODEX_COMPANION_"])],
+  ["gemini-cli", (e) => hasPrefix(e, "GEMINI_CLI")],
+  ["copilot", (e) => hasPrefix(e, "COPILOT_") || hasPrefix(e, "GITHUB_COPILOT_")],
+  ["windsurf", (e) => hasPrefix(e, "WINDSURF_") || term(e) === "windsurf"],
+  ["cursor", (e) => hasPrefix(e, "CURSOR_") || term(e) === "cursor"]
+];
+function detectAgent(env = processEnv()) {
+  return AGENTS.find(([, test]) => test(env))?.[0] ?? "unknown";
+}
+function telemetryEnabled(env = processEnv()) {
+  return (env.SIGNAFAIDE_TELEMETRY ?? "").trim() !== "0";
+}
+function runtimeName() {
+  const g = globalThis;
+  if (g.Bun?.version) return `bun ${g.Bun.version}`;
+  if (g.Deno?.version?.deno) return `deno ${g.Deno.version.deno}`;
+  if (typeof process !== "undefined" && process.versions?.node) return `node ${process.versions.node}`;
+  return "js unknown";
+}
+function clientHeader(opts = {}) {
+  const on = telemetryEnabled(opts.env);
+  const parts = [runtimeName()];
+  if (on) parts.push(`adapter=${opts.adapter || "none"}`, `agent=${opts.agent || "unknown"}`);
+  parts.push(`via=${opts.via ?? "sdk"}`);
+  if (on && opts.strict) parts.push("strict=1");
+  return `${SDK}/${VERSION} (${parts.join("; ")})`;
+}
+
+// src/http.ts
+var DEFAULT_URL = "https://api.signafaide.co.uk";
+var NON_RETRYABLE = /* @__PURE__ */ new Set(["quota_exceeded", "invalid_key", "plan_required", "bad_signature", "invalid_record", "content_mismatch", "chain_conflict", "unknown_agent", "key_mismatch", "bad_response"]);
+var fetchTransport = async (req) => {
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(new Error("timeout")), req.timeoutMs);
+  const onAbort = () => ctrl.abort(new Error("aborted"));
+  if (req.signal?.aborted) onAbort();
+  else req.signal?.addEventListener("abort", onAbort, { once: true });
+  try {
+    const resp = await fetch(req.url, { method: req.method, headers: req.headers, body: req.body, signal: ctrl.signal });
+    return { status: resp.status, contentType: resp.headers.get("content-type") ?? "", text: await resp.text() };
+  } finally {
+    clearTimeout(timer);
+    req.signal?.removeEventListener("abort", onAbort);
+  }
+};
+var SignafaideError = class extends Error {
+  code;
+  status;
+  docs;
+  body;
+  constructor(message, opts = {}) {
+    super(message);
+    this.name = "SignafaideError";
+    this.code = opts.code ?? "error";
+    this.status = opts.status ?? 0;
+    this.docs = opts.docs;
+    this.body = opts.body ?? {};
+  }
+  get retryable() {
+    return this.code === "network" || this.code === "rate_limited" || this.status >= 500;
+  }
+  /** The service refused for a reason retrying cannot change (quota, key, revoked agent key...). */
+  get permanent() {
+    return !this.retryable && NON_RETRYABLE.has(this.code);
+  }
+};
+var Client = class {
+  constructor(url = DEFAULT_URL, apiKey, timeoutMs = 1e4, clientId, opts = {}) {
+    this.apiKey = apiKey;
+    this.timeoutMs = timeoutMs;
+    this.url = url.replace(/\/+$/, "");
+    this.clientId = clientId ?? clientHeader({});
+    this.transport = opts.transport ?? fetchTransport;
+    this.signal = opts.signal;
+    this.timeoutLabel = opts.timeoutLabel;
+  }
+  apiKey;
+  timeoutMs;
+  url;
+  clientId;
+  transport;
+  signal;
+  /** Said instead of "no answer within <timeout> s" when the request shares a larger limit. */
+  timeoutLabel;
+  async request(method, path, opts = {}) {
+    const auth = opts.auth ?? true;
+    let url = this.url + path;
+    const q = Object.entries(opts.query ?? {}).filter((e) => e[1] != null);
+    if (q.length) url += "?" + new URLSearchParams(q).toString();
+    const headers = { Accept: "application/json", [HEADER]: this.clientId };
+    if (typeof process !== "undefined" && process.versions?.node) headers["User-Agent"] = `signafaide-js/${VERSION}`;
+    if (opts.body !== void 0) headers["Content-Type"] = "application/json";
+    if (auth) {
+      if (!this.apiKey) throw new SignafaideError("No API key: run `signafaide init` or set SIGNAFAIDE_API_KEY.", { code: "invalid_key" });
+      headers.Authorization = `Bearer ${this.apiKey}`;
+    }
+    let resp;
+    try {
+      resp = await this.transport({ method, url, headers, body: opts.body === void 0 ? void 0 : JSON.stringify(opts.body), timeoutMs: this.timeoutMs, signal: this.signal });
+    } catch (e) {
+      const err2 = e;
+      const raw = err2.cause?.code ?? err2.code ?? err2.message ?? String(e);
+      const reason = /abort|timeout/i.test(`${err2.name} ${raw}`) ? this.timeoutLabel ?? `no answer within ${this.timeoutMs / 1e3} s` : raw;
+      throw new SignafaideError(`Cannot reach the signafAIde service at ${this.url} (${reason}); check the network or SIGNAFAIDE_URL.`, { code: "network" });
+    }
+    const { status, text, contentType: ctype } = resp;
+    if (status < 200 || status >= 300) throw serviceError(status, text);
+    return ctype.includes("json") || /^[[{]/.test(text) ? JSON.parse(text) : text;
+  }
+  sandbox() {
+    return this.request("POST", "/v1/sandbox", { body: {}, auth: false });
+  }
+  /** §2.4: the registration with its proof of possession (and rotation signature). */
+  registerAgent(name, publicKey, validFrom, proof, rotation) {
+    return this.request("POST", "/v1/agents", { body: { name, public_key: publicKey, valid_from: validFrom, proof, ...rotation ? { rotation } : {} } });
+  }
+  /** `{project, env}` of this API key (§6). */
+  project() {
+    return this.request("GET", "/v1/project");
+  }
+  submit(records) {
+    return this.request("POST", "/v1/records", { body: { records } });
+  }
+  head(agent) {
+    return this.request("GET", `/v1/heads/${encodeURIComponent(agent)}`);
+  }
+  /** `{record, receipt, anchor}` of one record of the key's project. */
+  record(recordHash2) {
+    return this.request("GET", `/v1/records/${encodeURIComponent(recordHash2)}`);
+  }
+  /** A verification pack (§7) of the whole project, or of one agent. */
+  export(agent, from, to) {
+    return this.request("GET", "/v1/export", { query: { agent, from, to } });
+  }
+  usage() {
+    return this.request("GET", "/v1/usage");
+  }
+  /** Usage event (`verify`, `export`). Not part of SPEC §6 yet. */
+  async event(name) {
+    await this.request("POST", "/v1/events", { body: { name }, auth: !!this.apiKey });
+  }
+  serviceKeys() {
+    return this.request("GET", "/.well-known/signafaide-keys.json", { auth: false });
+  }
+};
+function serviceError(status, text) {
+  try {
+    const body = JSON.parse(text);
+    const err2 = body.error;
+    if (typeof err2?.message === "string") return new SignafaideError(err2.message, { code: err2.code ?? "error", status, docs: err2.docs, body });
+  } catch {
+  }
+  return new SignafaideError(`The service answered HTTP ${status}: ${text.trim().slice(0, 200) || "no body"}.`, { code: "http_error", status });
+}
+async function fetchJson(url, timeoutMs = 1e4) {
+  const u = new URL(url);
+  return new Client(u.origin, void 0, timeoutMs, `signafaide-js/${VERSION}`).request("GET", u.pathname + u.search, { auth: false });
+}
+
+// src/plural.ts
+var plural = (n, one, many = `${one}s`) => `${n} ${n === 1 ? one : many}`;
+
+// src/coverage.ts
+var TOOLS = "signafaide.tools";
+var TOOL_PREFIX = "signafaide.tool/";
+var TOOL_UNRECORDED_PREFIX = "signafaide.tool_unrecorded/";
+var RESERVED_PREFIX = "signafaide.";
+var MAX_DECLARED_NAME = 101;
+var KEPT = MAX_DECLARED_NAME - 9;
+function declaredName(tool) {
+  const chars = [...tool];
+  if (chars.length <= MAX_DECLARED_NAME) return tool;
+  return `${chars.slice(0, KEPT).join("")}~${sha256Hex(new TextEncoder().encode(tool)).slice(0, 8)}`;
+}
+function toolNoteName(tool, recorded) {
+  return (recorded ? TOOL_PREFIX : TOOL_UNRECORDED_PREFIX) + declaredName(tool);
+}
+function toolNote(kind, name) {
+  if (kind !== "note" || typeof name !== "string") return null;
+  if (name === TOOLS) return "header";
+  const recorded = name.startsWith(TOOL_PREFIX);
+  if (!recorded && !name.startsWith(TOOL_UNRECORDED_PREFIX)) return null;
+  const rest = name.slice((recorded ? TOOL_PREFIX : TOOL_UNRECORDED_PREFIX).length);
+  return rest ? { name: rest, recorded } : null;
+}
+function byCodePoint(a, b) {
+  const [x, y] = [[...a], [...b]];
+  for (let i = 0; i < x.length && i < y.length; i++) {
+    const d = x[i].codePointAt(0) - y[i].codePointAt(0);
+    if (d) return d;
+  }
+  return x.length - y.length;
+}
+function coverage(records) {
+  let at = null;
+  let tools = /* @__PURE__ */ new Map();
+  const called = /* @__PURE__ */ new Set();
+  for (const { seq, kind, name } of records) {
+    const t = toolNote(kind, name);
+    if (t === "header") {
+      at = seq;
+      tools = /* @__PURE__ */ new Map();
+    } else if (t) {
+      if (at !== null) tools.set(t.name, t.recorded);
+    } else if (kind === "decision" && typeof name === "string" && !name.startsWith(RESERVED_PREFIX)) called.add(declaredName(name));
+  }
+  if (at === null) return { declared: [], undeclared_recorded: [], declared_at_seq: null };
+  return {
+    declared: [...tools.keys()].sort(byCodePoint).map((name) => ({ name, recorded: tools.get(name) })),
+    undeclared_recorded: [...called].filter((n) => !tools.has(n)).sort(byCodePoint),
+    declared_at_seq: at
+  };
+}
+var countIs = (n, one) => `${plural(n, one)} ${n === 1 ? "is" : "are"}`;
+function coverageLines(agent, c) {
+  if (c.declared_at_seq === null) return [`${agent}: no tool list was declared, so the pack cannot show which of the agent's tools are recorded`];
+  const unrecorded = c.declared.filter((t) => !t.recorded).map((t) => t.name);
+  const out = [];
+  if (!c.declared.length) out.push(`${agent}: the declared tool list is empty`);
+  else if (!unrecorded.length) out.push(`${agent}: ${c.declared.length === 1 ? "the" : "all"} ${countIs(c.declared.length, "declared tool")} recorded`);
+  else out.push(`${agent}: ${countIs(unrecorded.length, "declared tool")} not recorded: ${unrecorded.join(", ")}`);
+  if (c.undeclared_recorded.length) out.push(`${agent}: ${countIs(c.undeclared_recorded.length, "recorded tool")} not in the declared tool list: ${c.undeclared_recorded.join(", ")}`);
+  return out;
+}
+
+// src/ots.ts
+var import_legacy = require("@noble/hashes/legacy");
+var import_sha22 = require("@noble/hashes/sha2");
+var import_sha3 = require("@noble/hashes/sha3");
+var import_utils2 = require("@noble/hashes/utils");
+var MAGIC = new Uint8Array([
+  0,
+  79,
+  112,
+  101,
+  110,
+  84,
+  105,
+  109,
+  101,
+  115,
+  116,
+  97,
+  109,
+  112,
+  115,
+  0,
+  0,
+  80,
+  114,
+  111,
+  111,
+  102,
+  0,
+  191,
+  137,
+  226,
+  232,
+  132,
+  232,
+  146,
+  148
+]);
+var TAG_BITCOIN = "0588960d73d71901";
+var TAG_PENDING = "83dfe30d2ef90c8e";
+var MAX_MSG = 4096;
+var MAX_DEPTH = 256;
+var MAX_PROOF_BYTES = 65536;
+var MAX_NODES = 1024;
+var UNARY = {
+  2: (m) => (0, import_legacy.sha1)(m),
+  3: (m) => (0, import_legacy.ripemd160)(m),
+  8: (m) => (0, import_sha22.sha256)(m),
+  103: (m) => (0, import_sha3.keccak_256)(m),
+  242: (m) => Uint8Array.from(m).reverse(),
+  243: (m) => new TextEncoder().encode((0, import_utils2.bytesToHex)(m))
+};
+var BINARY = {
+  240: (m, a) => (0, import_utils2.concatBytes)(m, a),
+  241: (m, a) => (0, import_utils2.concatBytes)(a, m)
+};
+var hex = (b) => Array.from(b, (x) => x.toString(16).padStart(2, "0")).join("");
+var Reader = class {
+  constructor(data) {
+    this.data = data;
+  }
+  data;
+  pos = 0;
+  nodes = 0;
+  byte() {
+    if (this.pos >= this.data.length) throw new Error("ots: unexpected end of proof");
+    return this.data[this.pos++];
+  }
+  take(n) {
+    if (this.data.length - this.pos < n) throw new Error("ots: unexpected end of proof");
+    this.pos += n;
+    return this.data.subarray(this.pos - n, this.pos);
+  }
+  varuint() {
+    let value = 0;
+    for (let shift = 0; shift < 64; shift += 7) {
+      const b = this.byte();
+      value += (b & 127) * 2 ** shift;
+      if (!(b & 128)) return value;
+    }
+    throw new Error("ots: varuint too long");
+  }
+  varbytes(limit) {
+    const n = this.varuint();
+    if (n > limit) throw new Error(`ots: field longer than ${limit} bytes`);
+    return this.take(n);
+  }
+  node() {
+    if (++this.nodes > MAX_NODES) throw new Error(`ots: proof has more than ${MAX_NODES} operations and attestations`);
+  }
+};
+function parseOts(data) {
+  if (data.length > MAX_PROOF_BYTES) throw new Error(`ots: proof is longer than ${MAX_PROOF_BYTES} bytes`);
+  const r = new Reader(data);
+  if (hex(r.take(MAGIC.length)) !== hex(MAGIC)) throw new Error("ots: not an OpenTimestamps proof (bad magic)");
+  if (r.varuint() !== 1) throw new Error("ots: unsupported proof version");
+  if (r.byte() !== 8) throw new Error("ots: only SHA-256 file digests are supported");
+  const digest2 = Uint8Array.from(r.take(32));
+  const attestations = [];
+  readTimestamp(r, digest2, attestations, 0);
+  if (r.pos !== data.length) throw new Error("ots: trailing bytes after timestamp");
+  return { digest: hex(digest2), attestations };
+}
+function readTimestamp(r, msg, found, depth) {
+  if (depth > MAX_DEPTH) throw new Error("ots: proof nested too deeply");
+  for (; ; ) {
+    let tag = r.byte();
+    const fork = tag === 255;
+    if (fork) tag = r.byte();
+    r.node();
+    if (tag === 0) found.push({ ...readAttestation(r), msg });
+    else {
+      let next;
+      if (tag in BINARY) next = BINARY[tag](msg, r.varbytes(MAX_MSG));
+      else if (tag in UNARY) next = UNARY[tag](msg);
+      else throw new Error(`ots: unknown operation tag 0x${tag.toString(16).padStart(2, "0")}`);
+      if (next.length > MAX_MSG) throw new Error(`ots: operation result longer than ${MAX_MSG} bytes`);
+      readTimestamp(r, next, found, depth + 1);
+    }
+    if (!fork) return;
+  }
+}
+function readAttestation(r) {
+  const tag = hex(r.take(8));
+  const p = new Reader(r.varbytes(8192));
+  if (tag === TAG_BITCOIN) return { kind: "bitcoin", height: p.varuint() };
+  if (tag === TAG_PENDING) {
+    const uri = p.varbytes(1e3);
+    if (!uri.every((c) => /[A-Za-z0-9\-.:/_]/.test(String.fromCharCode(c)))) throw new Error("ots: calendar URI has invalid characters");
+    return { kind: "pending", uri: new TextDecoder().decode(uri) };
+  }
+  return { kind: "unknown", tag };
+}
+function otsStatus(data) {
+  const { digest: digest2, attestations } = parseOts(data);
+  const heights = attestations.flatMap((a) => a.kind === "bitcoin" ? [a.height] : []);
+  if (heights.length) return { digest: digest2, height: Math.min(...heights) };
+  if (attestations.some((a) => a.kind === "pending")) return { digest: digest2, height: null };
+  throw new Error("OTS proof has no attestation");
+}
+function blockAttestations(data) {
+  return parseOts(data).attestations.flatMap((a) => {
+    if (a.kind !== "bitcoin") return [];
+    if (a.msg.length !== 32) throw new Error(`ots: the timestamp attestation for block ${a.height} is not over a 32-byte Merkle root`);
+    return [[a.height, hex(a.msg)]];
+  });
+}
+function base64Decode(s) {
+  if (typeof s !== "string" || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(s)) throw new Error("ots is not standard base64");
+  const bin = atob(s);
+  return Uint8Array.from(bin, (c) => c.charCodeAt(0));
+}
+
+// src/timestamps.ts
+var import_sha23 = require("@noble/hashes/sha2");
+var import_utils3 = require("@noble/hashes/utils");
+function target(bits) {
+  const exponent = bits >>> 24;
+  const mantissa = BigInt(bits & 8388607);
+  if (bits & 8388608 || mantissa === 0n) return null;
+  const t = exponent >= 3 ? mantissa << BigInt(8 * (exponent - 3)) : mantissa >> BigInt(8 * (3 - exponent));
+  return t > 0n && t < 1n << 256n ? t : null;
+}
+function checkHeader(hash, headerHex) {
+  const hx = String(headerHex).trim();
+  if (!/^(?:[0-9a-fA-F]{2})*$/.test(hx)) throw new Error("the block header is not hex");
+  const header = (0, import_utils3.hexToBytes)(hx.toLowerCase());
+  if (header.length !== 80) throw new Error(`the block header is ${header.length} bytes, not 80`);
+  const id = (0, import_utils3.bytesToHex)((0, import_sha23.sha256)((0, import_sha23.sha256)(header)).reverse());
+  if (id !== String(hash).trim().toLowerCase()) throw new Error(`the block header does not hash to block ${hash}`);
+  const bits = new DataView(header.buffer, header.byteOffset).getUint32(72, true);
+  const t = target(bits);
+  if (t === null) throw new Error(`the block header's nBits 0x${bits.toString(16).padStart(8, "0")} is not a valid target`);
+  if (BigInt("0x" + id) > t) throw new Error(`block ${hash} does not meet the proof of work its header claims`);
+  return (0, import_utils3.bytesToHex)(header.slice(36, 68));
+}
+function rootsFromVector(m) {
+  return new Map(
+    Object.entries(m).filter(([, r]) => !!r && typeof r === "object").map(([h2, r]) => [Number(h2), [true, r]])
+  );
+}
+
+// src/verifier.ts
+var import_utils4 = require("@noble/hashes/utils");
+var CHECKS = [
+  ["schema", "Envelope schema"],
+  ["record_hash", "Record hashes"],
+  ["record_sig", "Client signatures"],
+  ["chain", "Agent chains"],
+  ["merkle", "Merkle proofs"],
+  ["batch_sig", "Batch hashes and signatures"],
+  ["batch_chain", "Batch chain"],
+  ["head_sig", "Signed heads"],
+  ["drand", "drand rounds"],
+  ["anchor", "Anchors"],
+  ["ots", "OpenTimestamps"],
+  ["content", "Content hashes"]
+];
+var NO_RECORDS = "no records: an empty pack proves nothing";
+var DRAND_NOT_CHECKED = "drand: not checked (BLS library not installed; npm install @noble/curves)";
+var NO_LOCAL_RECORDS = "no records: nothing has been recorded here yet";
+var NOT_INDEPENDENT = "NOT INDEPENDENT: agent keys came from the pack; pass --agent-keys <file|url> (the customer's `signafaide keys export`), or --trust-embedded-agent-keys";
+var QUICKNET_GENESIS = 1692803367;
+var MAX_ROUND_AGE_MS = 12e4;
+var MAX_ROUND = Math.floor((253402300799 - QUICKNET_GENESIS) / 3) + 1;
+var ANCHOR_WINDOW_MS = 72e5;
+var UNITS = [["record"], ["record"], ["record"], ["record"], ["record"], ["batch", "batches"], ["batch", "batches"], ["head"], ["round"], ["anchor"], ["proof"], ["record"]];
+var QUICKNET_CHAIN = "52db9ba70e0cc0f6eaf7803dd07447a1f5477735fd3f661792ba94600c84e971";
+var QUICKNET_PUBLIC_KEY = "83cf0f2896adee7eb8b5f01fcad3912212c437e0073e911fb90022d3e760183c8c4b450b6a0a6c3ac6a5776a2d1064510d1fec758c921cc22b0e17e63aaf4bcb5ed66304de9cf809bd274ca73bab4af5a6e9c76a4bc09e76eae8991ef5ece45a";
+var KeysRequired = class extends Error {
+  name = "KeysRequired";
+};
+function keyReasons(service, agent) {
+  const a = service === "independent" ? null : service;
+  const b = agent === "independent" ? null : agent;
+  if (a && b) return a === b ? `service keys and agent keys ${a}` : `service keys ${a} and agent keys ${b}`;
+  if (a) return `service keys ${a}`;
+  if (b) return `agent keys ${b}`;
+  return null;
+}
+function scopeText(filter, generated) {
+  const a = filter.agents;
+  const who = a === null ? "every agent" : a.length === 1 ? `agent ${a[0]}` : `agents ${a.join(", ")}`;
+  const { from: f, to: t } = filter;
+  const window = f === null && t === null ? "all records" : t === null ? `records from ${f}` : f === null ? `records before ${t}` : `records from ${f} before ${t}`;
+  return `export of ${who}, ${window}, generated ${generated}`;
+}
+var SHORT_NAMES = {
+  schema: "envelope schema",
+  record_hash: "record hashes",
+  record_sig: "client signatures",
+  chain: "agent chains",
+  merkle: "Merkle proofs",
+  batch_sig: "batch signatures",
+  batch_chain: "batch chain",
+  head_sig: "signed heads",
+  drand: "drand rounds",
+  anchor: "anchors",
+  ots: "public timestamp",
+  content: "content hashes"
+};
+var WITNESS_CHECKS = ["record_hash", "merkle", "batch_sig", "batch_chain", "head_sig", "drand", "anchor", "ots"];
+var NOTHING_COSIGNED = "nothing co-signed yet";
+function countsText(checks, nothingCosigned = false) {
+  const total = checks.length;
+  const failed = checks.filter((c) => c.status === "fail").map((c) => SHORT_NAMES[c.id]);
+  const pending = checks.filter((c) => c.status === "pending").map((c) => SHORT_NAMES[c.id]);
+  const unchecked = checks.filter((c) => c.status === "not_checked").map((c) => c.id);
+  const passed = total - failed.length - pending.length - unchecked.length;
+  if (failed.length) {
+    let out2 = `${failed.length} of ${total} checks failed (${failed.join(", ")})`;
+    if (passed) out2 += `, ${passed} passed`;
+    if (pending.length) out2 += `, ${pending.length} pending`;
+    if (unchecked.length) out2 += `, ${unchecked.length} not checked`;
+    return out2;
+  }
+  let out = `${passed} of ${total} checks passed`;
+  if (pending.length) out += `, ${pending.length} pending (${pending.join(", ")})`;
+  if (unchecked.length) {
+    let names = unchecked.map((i) => SHORT_NAMES[i]);
+    if (nothingCosigned && unchecked.some((i) => WITNESS_CHECKS.includes(i))) {
+      names = [NOTHING_COSIGNED, ...unchecked.filter((i) => !WITNESS_CHECKS.includes(i)).map((i) => SHORT_NAMES[i])];
+    }
+    out += `, ${unchecked.length} not checked (${names.join(", ")})`;
+  }
+  return out;
+}
+function resultLine(result, service = "independent", agent = "independent", byService = false, scope = null, counts = "") {
+  let out = result;
+  if (result === "PASS") {
+    if (byService) out += " (checked by the service with its own key registry; not independent)";
+    else {
+      const r = keyReasons(service, agent);
+      if (r) out += ` (${r}, not independent)`;
+    }
+  }
+  if (counts) out += `: ${counts}`;
+  if (scope) out += counts ? `; ${scope}` : `: ${scope}`;
+  return out;
+}
+var PENDING_MEANS = "pending: co-signed, waiting for the public timestamp (an anchor is made every hour and usually confirms within a few hours); never counted as passed";
+var Report = class {
+  constructor(checks, project = null, env = null, records = 0, warnings = [], notes = [], independent = { service_keys: true, agent_keys: true }, scope = null) {
+    this.checks = checks;
+    this.project = project;
+    this.env = env;
+    this.records = records;
+    this.warnings = warnings;
+    this.notes = notes;
+    this.independent = independent;
+    this.scope = scope;
+  }
+  checks;
+  project;
+  env;
+  records;
+  warnings;
+  notes;
+  independent;
+  scope;
+  /** Lines shown after the checks, before the result line: for local state, what still needs
+   * the witness (co-signature, public timestamp). */
+  after = [];
+  /** Local state with no record co-signed yet: the result line says so (§7). */
+  nothingCosigned = false;
+  /** Local state: chains that cannot ship (refused by the witness, or wedged here), as
+   * `<chain>: <reason>`. Any makes the result BLOCKED, which always fails (§7). */
+  blocked = [];
+  /** Local state with --fail-on-pending-send: records not co-signed yet, which then fail. */
+  notSent = 0;
+  /** The project's name from the signed export statement, when the pack has one. */
+  projectName = null;
+  /** Tool coverage per agent (§7; per chain for local state): the agent's current tool
+   * declaration and the recorded tools it does not list. A note, never a failure. */
+  coverage = {};
+  /** e.g. `PASS: export of every agent, all records, generated <t>`, or
+   * `PASS (agent keys taken from the pack, not independent): export of ...` (§7). */
+  get resultLine() {
+    const s = this.scope;
+    let counts = countsText(this.checks, this.nothingCosigned);
+    if (this.blocked.length) counts = `${plural(this.blocked.length, "chain")} cannot ship (${this.blocked.map((b) => b.split(":")[0]).join(", ")}); ${counts}`;
+    else if (this.notSent) counts = `${plural(this.notSent, "record")} not sent yet (--fail-on-pending-send); ${counts}`;
+    if (!s) return resultLine(this.result, this.independent.service_keys ? "independent" : "fetched over plain http", "independent", false, null, counts);
+    return resultLine(this.result, s.sources[0], s.sources[1], s.byService, scopeText(s.filter, s.generated), counts);
+  }
+  get ok() {
+    return !this.blocked.length && !this.notSent && this.checks.every((c) => c.status !== "fail");
+  }
+  get result() {
+    if (this.checks.some((c) => c.status === "fail") || this.notSent && !this.blocked.length) return "FAIL";
+    return this.blocked.length ? "BLOCKED" : "PASS";
+  }
+  check(id) {
+    return this.checks.find((c) => c.id === id);
+  }
+  firstFailed() {
+    return this.checks.find((c) => c.status === "fail")?.id ?? null;
+  }
+  /** Tool coverage in words (§7), agent by agent: what each agent declared, then the recorded
+   * tools its declaration does not list. */
+  coverageLines() {
+    return Object.entries(this.coverage).flatMap(([agent, c]) => coverageLines(agent, c));
+  }
+  lines() {
+    const out = [...this.notes];
+    if (this.project && this.env) {
+      out.push(
+        this.projectName ? `signafAIde pack of project ${this.projectName} (${this.project}, ${this.env}), ${plural(this.records, "record")}` : `signafAIde pack ${this.project} (${this.env}), ${plural(this.records, "record")}`
+      );
+    }
+    out.push(...this.warnings.map((w) => `WARNING: ${w}`));
+    for (const c of this.checks) {
+      const label = c.status === "fail" ? "FAIL" : c.status === "not_checked" ? "NOT CHECKED" : c.status === "pending" ? "PENDING" : c.value?.startsWith("confirmed@") ? "CONFIRMED" : (c.value ?? "pass").toUpperCase();
+      out.push(`${String(c.n).padStart(2)}. ${c.title.padEnd(28)} ${label.padEnd(12)} ${c.detail}`);
+      out.push(...c.failures.slice(0, 20).map((f) => `      - ${f.item}: ${f.message}`));
+      if (c.failures.length > 20) out.push(`      ... and ${c.failures.length - 20} more`);
+    }
+    if (this.checks.some((c) => c.status === "pending")) out.push(PENDING_MEANS);
+    out.push(...this.coverageLines().map((l) => `coverage: ${l}`));
+    out.push(...this.after);
+    out.push(...this.blocked.map((b) => `BLOCKED ${b}`));
+    out.push(this.resultLine);
+    return out;
+  }
+  toString() {
+    return this.lines().join("\n");
+  }
+  toJSON() {
+    return {
+      result: this.result,
+      result_line: this.resultLine,
+      project: this.project,
+      ...this.projectName ? { project_name: this.projectName } : {},
+      env: this.env,
+      records: this.records,
+      generated: this.scope?.generated ?? null,
+      filter: this.scope?.filter ?? null,
+      warnings: this.warnings,
+      independent: this.independent,
+      notes: this.notes,
+      checks: this.checks,
+      coverage: this.coverage,
+      ...this.after.length ? { not_yet: this.after } : {},
+      ...this.blocked.length ? { blocked: this.blocked } : {}
+    };
+  }
+};
+function parseServiceKeys(doc) {
+  const keys = Array.isArray(doc) ? doc : doc?.keys;
+  if (!Array.isArray(keys)) throw new Error('service keys must be {"keys": [...]} as served at /.well-known/signafaide-keys.json');
+  for (const k of keys) {
+    const errs = keyEntryErrors(k);
+    if (errs.length) throw new Error("keys: " + errs.join("; "));
+  }
+  return keys;
+}
+function parseAgentKeys(doc) {
+  const errs = manifestErrors(doc);
+  if (errs.length) throw new Error("agent keys: " + errs.join("; "));
+  return doc.keys;
+}
+function parseHeadFile(doc) {
+  const obj = (v, what) => {
+    if (!v || typeof v !== "object" || Array.isArray(v)) throw new Error(`head file: ${what} must be an object`);
+    return v;
+  };
+  const out = [];
+  for (const envs of Object.values(obj(doc, "the file")))
+    for (const agents of Object.values(obj(envs, "each project")))
+      for (const sh of Object.values(obj(agents, "each env"))) {
+        const why = signedHeadError(sh);
+        if (why) throw new Error(`head file: ${why}`);
+        out.push(sh);
+      }
+  return out;
+}
+function contentFromText(text, into = /* @__PURE__ */ new Map()) {
+  let items;
+  try {
+    const doc = parseJson(text);
+    items = Array.isArray(doc) ? doc : [doc];
+  } catch {
+    items = text.split("\n").filter((l) => l.trim()).map((l) => parseJson(l));
+  }
+  for (const it of items) {
+    if (it?.envelope && typeof it.envelope === "object" && it.content && typeof it.content === "object" && !Array.isArray(it.content) && !it.draft) {
+      into.set(hashJson(it.envelope), { content: it.content, salt: typeof it.salt === "string" ? it.salt : void 0 });
+    }
+  }
+  return into;
+}
+function timestampHeights(pack) {
+  const out = /* @__PURE__ */ new Set();
+  for (const a of Array.isArray(pack?.anchors) ? pack.anchors : []) {
+    try {
+      for (const [h2] of blockAttestations(base64Decode(a.anchor.ots))) out.add(h2);
+    } catch {
+    }
+  }
+  return [...out].sort((x, y) => x - y);
+}
+function recordsHash(records) {
+  return hashJson(
+    records.map((r) => {
+      const h2 = r?.receipt?.record_hash;
+      if (typeof h2 !== "string") throw new Error("a record has no receipt.record_hash");
+      return h2;
+    })
+  );
+}
+function exportStatement(pack) {
+  return { project: pack.project, ...pack.project_name !== void 0 ? { project_name: pack.project_name } : {}, env: pack.env, generated: pack.generated, filter: pack.filter, heads: pack.heads.map((sh) => sh.head), records_hash: recordsHash(pack.records) };
+}
+function isLoopbackUrl(url) {
+  if (!url.startsWith("http://")) return false;
+  const authority = url.slice(7).split(/[/?#]/)[0];
+  if (authority.includes("@")) return false;
+  let host = authority.startsWith("[") ? authority.slice(1).split("]")[0] : authority.includes(":") ? authority.slice(0, authority.lastIndexOf(":")) : authority;
+  host = host.toLowerCase();
+  if (host === "localhost" || host === "::1" || /^0*:(0*:){0,6}0*1$/.test(host) || host === "0:0:0:0:0:0:0:1") return true;
+  const v4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+  return !!v4 && Number(v4[1]) === 127 && v4.slice(1).every((o) => Number(o) <= 255 && String(Number(o)) === o);
+}
+function verifyPack(pack, serviceKeys, opts = {}) {
+  const byService = !!opts.byService;
+  let serviceSrc = !serviceKeys ? "taken from the pack" : opts.serviceKeysPlainHttp ? "fetched over plain http" : "independent";
+  let agentSrc = !opts.agentKeys ? "taken from the pack" : opts.agentKeysPlainHttp ? "fetched over plain http" : "independent";
+  if (byService) serviceSrc = agentSrc = "taken from the pack";
+  const independent = { service_keys: serviceSrc === "independent", agent_keys: agentSrc === "independent" };
+  const why = packError(pack);
+  if (why) return malformed(why, independent);
+  const warnings = [];
+  if (!serviceKeys) {
+    if (!opts.trustEmbeddedKeys || byService) throw new KeysRequired("service keys are required: pass --keys <file|url>, or --trust-embedded-keys to use the keys inside the pack");
+    warnings.push("service keys were taken from the pack itself (--trust-embedded-keys); this does not prove the service signed it");
+    serviceKeys = pack.service_keys;
+  }
+  for (const [src, what] of [[serviceSrc, "service"], [agentSrc, "agent"]]) {
+    if (src === "fetched over plain http") warnings.push(`${what} keys were fetched over plain http, which anyone on the network path can alter: not independent`);
+  }
+  let agentKeys;
+  let notIndependent = false;
+  if (opts.agentKeys && !byService) {
+    agentKeys = opts.agentKeys.map((e) => {
+      const held = pack.agent_keys.find((k) => k.agent === e.agent && k.key_id === e.key_id && k.public_key === e.public_key);
+      return { agent: e.agent, key_id: e.key_id, public_key: e.public_key, valid_from: e.valid_from, valid_to: earliest(e.valid_to ?? null, held?.valid_to ?? null) };
+    });
+  } else {
+    if (byService) {
+    } else if (opts.trustEmbeddedAgentKeys) warnings.push("agent keys were taken from the pack itself (--trust-embedded-agent-keys); this does not prove the customer's agents signed it");
+    else notIndependent = true;
+    agentKeys = pack.agent_keys;
+  }
+  const v = new Verifier(serviceKeys, agentKeys, opts.contents ?? /* @__PURE__ */ new Map(), pack.project, pack.env, false, {}, opts.drand ?? null, {
+    filter: pack.filter,
+    exportHeads: pack.heads,
+    clientHeads: opts.heads ?? null,
+    timestamps: opts.timestamps ?? null,
+    notIndependent,
+    generated: pack.generated,
+    exportSig: pack.export_sig,
+    pack
+  });
+  const report = new Report(v.run(pack.records, pack.anchors), pack.project, pack.env, pack.records.length, warnings, [], independent, {
+    generated: pack.generated,
+    filter: pack.filter,
+    sources: [serviceSrc, agentSrc],
+    byService
+  });
+  report.projectName = typeof pack.project_name === "string" ? pack.project_name : null;
+  report.coverage = v.coverage;
+  return report;
+}
+function earliest(a, b) {
+  if (a === null || b === null) return a ?? b;
+  return ms(b) < ms(a) ? b : a;
+}
+function verifyLocalState(local, serviceKeys, drand = null, serviceKeysPlainHttp = false) {
+  const v = new Verifier(serviceKeys, local.agentKeys, /* @__PURE__ */ new Map(), null, null, true, local.heads, drand);
+  v.drafts = local.drafts ?? 0;
+  v.localBases = local.bases ?? {};
+  const checks = v.run(local.records, [], local.chainIds);
+  const report = new Report(checks, null, null, local.records.length, [], [], { service_keys: !serviceKeysPlainHttp, agent_keys: true });
+  report.nothingCosigned = v.nothingCosigned;
+  report.coverage = v.coverage;
+  return report;
+}
+var isU64 = (x) => typeof x === "number" && Number.isInteger(x) && x >= 0;
+var isHex2 = (x) => typeof x === "string" && HEX64.test(x);
+function signedHeadError(sh) {
+  if (!exactKeys(sh, ["head", "head_sig"]) || typeof sh.head_sig !== "string") return "a signed head is {head, head_sig}";
+  const h2 = sh.head;
+  if (!exactKeys(h2, ["project", "env", "agent", "seq", "record_hash", "server_time"])) return "head fields are agent, env, project, record_hash, seq, server_time";
+  if (!(typeof h2.project === "string" && (h2.env === "test" || h2.env === "live") && typeof h2.agent === "string" && AGENT_RE.test(h2.agent) && isU64(h2.seq) && isHex2(h2.record_hash) && validTime(h2.server_time))) {
+    return "a head has an invalid value";
+  }
+  return "";
+}
+function packError(pack) {
+  if (!pack || typeof pack !== "object" || Array.isArray(pack)) return "the pack is not a JSON object";
+  if (pack.format !== "signafaide-pack/1") return `format is '${pack.format}', expected 'signafaide-pack/1'`;
+  const fields = ["format", "generated", "project", "env", "service_keys", "agent_keys", "filter", "heads", "records", "anchors", "export_sig"];
+  for (const k of fields) if (!(k in pack)) return `missing field \`${k}\``;
+  const extra = Object.keys(pack).filter((k) => !fields.includes(k) && k !== "project_name").sort();
+  if (extra.length) return `unknown field \`${extra[0]}\``;
+  for (const k of ["service_keys", "agent_keys", "heads", "records", "anchors"]) if (!Array.isArray(pack[k])) return `\`${k}\` must be a list`;
+  if (typeof pack.export_sig !== "string") return "`export_sig` must be a string";
+  if (pack.env !== "test" && pack.env !== "live") return "env must be test or live";
+  if (!validProjectId(pack.project)) return "project is not a valid project id";
+  if ("project_name" in pack) {
+    const n = pack.project_name;
+    if (typeof n !== "string" || !n.length || [...n].length > 200 || /[\u0000-\u001f\u007f-\u009f]/.test(n)) return "project_name must be 1 to 200 characters, without control characters";
+  }
+  if (!validTime(pack.generated)) return "generated is not a time";
+  for (const k of pack.service_keys) {
+    const e = keyEntryErrors(k);
+    if (e.length) return e[0];
+  }
+  for (const k of pack.agent_keys) {
+    const e = keyEntryErrors(k, true);
+    if (e.length) return e[0];
+  }
+  const f = pack.filter;
+  if (!exactKeys(f, ["agents", "from", "to"])) return "filter is {agents, from, to}";
+  for (const n of ["from", "to"]) if (f[n] !== null && !validTime(f[n])) return `filter.${n} is not a time`;
+  if (f.agents !== null && !(Array.isArray(f.agents) && f.agents.every((a) => typeof a === "string" && AGENT_RE.test(a)))) return "filter.agents holds an invalid agent name";
+  for (const sh of pack.heads) if (signedHeadError(sh)) return "heads holds an invalid head";
+  return null;
+}
+function malformed(why, independent) {
+  return new Report(
+    CHECKS.map(([id, title], i) => ({
+      n: i + 1,
+      id,
+      title,
+      status: i === 0 ? "fail" : "not_checked",
+      checked: 0,
+      detail: i === 0 ? "the pack itself is malformed" : "pack unreadable",
+      failures: i === 0 ? [{ item: "pack", message: why }] : []
+    })),
+    null,
+    null,
+    0,
+    [],
+    [],
+    independent
+  );
+}
+var ms = (s) => validTime(s) ? Date.parse(s) : null;
+var fmt = (t) => new Date(t).toISOString();
+function active(key, at) {
+  const s = ms(key.valid_from);
+  const e = ms(key.valid_to);
+  if (at === null || key.valid_from != null && s === null || key.valid_to != null && e === null) return false;
+  return (s === null || s <= at) && (e === null || at < e);
+}
+function serviceKeysHash(keys, createdMs) {
+  const list = keys.filter((k) => ms(k.valid_from) !== null && ms(k.valid_from) <= createdMs).map((k) => ({ key_id: k.key_id, public_key: k.public_key, valid_from: k.valid_from })).sort((a, b) => a.valid_from < b.valid_from ? -1 : a.valid_from > b.valid_from ? 1 : a.key_id < b.key_id ? -1 : a.key_id > b.key_id ? 1 : 0);
+  return hashJson(list);
+}
+function checkRoundTime(serverMs, round) {
+  if (!(round >= 1 && round <= MAX_ROUND)) return `drand round ${round} is out of range (1 to ${MAX_ROUND})`;
+  const published = (QUICKNET_GENESIS + (round - 1) * 3) * 1e3;
+  if (serverMs < published) return `server_time ${fmt(serverMs)} is before drand round ${round} was published at ${fmt(published)}`;
+  if (serverMs - published > MAX_ROUND_AGE_MS) return `drand round ${round} is ${Math.floor((serverMs - published) / 1e3)} s older than server_time; at most ${MAX_ROUND_AGE_MS / 1e3} s is allowed`;
+  return null;
+}
+var Acc = class {
+  checked = 0;
+  failures = [];
+  notes = [];
+  notChecked = false;
+  pending = false;
+  value;
+  fail(item, message) {
+    this.failures.push({ item, message });
+  }
+};
+var Verifier = class {
+  constructor(serviceKeys, agentKeys, contents, project, env, local, localHeads, drandVerifier, extras) {
+    this.serviceKeys = serviceKeys;
+    this.agentKeys = agentKeys;
+    this.contents = contents;
+    this.project = project;
+    this.env = env;
+    this.local = local;
+    this.localHeads = localHeads;
+    this.drandVerifier = drandVerifier;
+    this.x = extras ?? { filter: { agents: null, from: null, to: null }, exportHeads: [], clientHeads: null, timestamps: null, notIndependent: false };
+    this.generatedMs = this.x.generated ? ms(this.x.generated) : null;
+    this.fromMs = this.x.filter.from !== null ? ms(this.x.filter.from) : null;
+    this.toMs = this.x.filter.to !== null ? ms(this.x.filter.to) : null;
+    for (const k of agentKeys) {
+      const f = ms(k.valid_from);
+      if (f !== null && typeof k.agent === "string") this.firstKey.set(k.agent, Math.min(this.firstKey.get(k.agent) ?? f, f));
+    }
+  }
+  serviceKeys;
+  agentKeys;
+  contents;
+  project;
+  env;
+  local;
+  localHeads;
+  drandVerifier;
+  acc = CHECKS.map(() => new Acc());
+  x;
+  recs = [];
+  generatedMs = null;
+  fromMs = null;
+  toMs = null;
+  /** The earliest any key of each agent was valid: no record of that agent is older. */
+  firstKey = /* @__PURE__ */ new Map();
+  drafts = 0;
+  nothingCosigned = false;
+  /** Tool coverage per chain (§7), filled by `run`. */
+  coverage = {};
+  /** Local state: chain id -> the witness's signed head a chain continues after (§8). */
+  localBases = {};
+  /** A chain may start after seq 1 only when the export's from is after the agent's first key. */
+  fromCuts(agent) {
+    const k = this.firstKey.get(agent);
+    return this.fromMs !== null && k !== void 0 && this.fromMs > k;
+  }
+  /** A head's record may be cut off by to only when it could be at or after to (its time is at
+   * most 300 s after the head's server_time). */
+  toMayCut(h2) {
+    const s = ms(h2.server_time);
+    return this.toMs !== null && (s === null || s + MAX_CLOCK_SKEW_MS >= this.toMs);
+  }
+  serviceKey(kid, at) {
+    const k = this.serviceKeys.find((k2) => k2.key_id === kid);
+    if (!k) throw new Error(`unknown service key ${kid}`);
+    if (!active(k, ms(at))) throw new Error(`service key ${kid} was not active at ${at}`);
+    return k;
+  }
+  anyKey(domain, h2, sig, at) {
+    const t = ms(at);
+    return this.serviceKeys.some((k) => active(k, t) && verifySig(k.public_key, domain, h2, sig));
+  }
+  chainOf = /* @__PURE__ */ new Map();
+  /** The chain a record belongs to: its agent in a pack, `<project>/<env>/<agent>` locally. */
+  chainId(r) {
+    return this.chainOf.get(r) ?? r.envelope.agent;
+  }
+  headChain(head) {
+    return this.local ? `${head.project}/${head.env}/${head.agent}` : head.agent;
+  }
+  run(raw, anchors, chainIds) {
+    const a = this.acc;
+    if (this.x.notIndependent) a[2].fail("agent keys", NOT_INDEPENDENT);
+    if (!raw.length && !this.drafts) a[0].fail(this.local ? "local state" : "pack", this.local ? NO_LOCAL_RECORDS : NO_RECORDS);
+    if (chainIds) raw.forEach((r, i) => this.chainOf.set(r, chainIds[i]));
+    const recs = this.schema(raw);
+    this.recs = recs;
+    const shipped = recs.filter((x) => "receipt" in x.r);
+    for (const { label, r, h: h2 } of shipped) {
+      a[1].checked++;
+      if (h2 !== r.receipt.record_hash) a[1].fail(label, `envelope hashes to ${h2}, receipt says ${r.receipt.record_hash}`);
+    }
+    if (shipped.length < recs.length) a[1].notes.push(`${recs.length - shipped.length} not yet shipped (no receipt)`);
+    for (const x of recs) {
+      a[2].checked++;
+      const err2 = this.clientSig(x);
+      if (err2) a[2].fail(x.label, err2);
+    }
+    const chains = this.chains(recs);
+    this.merkle(shipped);
+    const batches = this.batchSigs(shipped);
+    this.batchChain(batches);
+    this.heads(shipped, chains);
+    this.drand(batches);
+    this.anchors(anchors, batches);
+    this.content(recs);
+    if (this.local && !shipped.length && recs.length) {
+      this.nothingCosigned = true;
+      for (const i of [1, 4, 5, 6, 7]) {
+        if (a[i].checked || a[i].failures.length) continue;
+        a[i].notChecked = true;
+        a[i].notes.push("nothing co-signed yet");
+      }
+    }
+    return a.map((acc, i) => ({
+      n: i + 1,
+      id: CHECKS[i][0],
+      title: CHECKS[i][1],
+      status: acc.failures.length ? "fail" : acc.notChecked ? "not_checked" : acc.pending ? "pending" : "pass",
+      checked: acc.checked,
+      detail: plural(acc.checked, ...UNITS[i]) + acc.notes.map((n) => `; ${n}`).join(""),
+      ...acc.value !== void 0 ? { value: acc.value } : {},
+      failures: acc.failures
+    }));
+  }
+  // 1
+  schema(raw) {
+    const out = [];
+    raw.forEach((r, i) => {
+      this.acc[0].checked++;
+      const draft = this.local && !!r && typeof r === "object" && r.draft === true;
+      let errs = draft ? draftErrors(r) : recordErrors(r);
+      if (draft) {
+        if (!errs.length && !this.chainId(r).startsWith("_pending/")) errs = [`a draft belongs in a pending chain, not ${this.chainId(r)}`];
+      } else if (!errs.length && r && "receipt" in r) errs = receiptErrors(r.receipt).length ? receiptErrors(r.receipt) : this.consistent(r);
+      else if (!errs.length && !this.local) errs = ["missing receipt"];
+      else if (!errs.length) errs = this.envelopeBucket(r);
+      if (errs.length) return this.acc[0].fail(`record[${i}]`, errs.join("; "));
+      out.push({ label: `${this.chainId(r)}#${r.envelope.seq}`, r, h: hashJson(r.envelope) });
+    });
+    return out;
+  }
+  /** Locally, a record's envelope names the project and env of its chain. */
+  envelopeBucket(r) {
+    const e = r.envelope;
+    const bucket = this.chainId(r).split("/").slice(0, 2).join("/");
+    if (this.local && !bucket.startsWith("_pending/") && bucket !== `${e.project}/${e.env}`) return [`envelope is for ${e.project}/${e.env}, but the record is in chain ${this.chainId(r)}`];
+    return [];
+  }
+  consistent(r) {
+    const e = r.envelope;
+    const { batch: b, head: h2 } = r.receipt;
+    if (!this.local && (e.project !== this.project || e.env !== this.env)) return ["envelope belongs to another project or env"];
+    if (!this.local && (b.project !== this.project || b.env !== this.env)) return ["receipt batch belongs to another project or env"];
+    if (this.local && (e.project !== b.project || e.env !== b.env)) return ["envelope and receipt batch name different projects or envs"];
+    const errs = this.envelopeBucket(r);
+    if (errs.length) return errs;
+    if (h2.project !== b.project || h2.env !== b.env || h2.agent !== e.agent) return ["receipt head belongs to another project, env or agent"];
+    return [];
+  }
+  clientSig({ r, h: h2 }) {
+    const env = r.envelope;
+    const k = this.agentKeys.find((k2) => k2.agent === env.agent && k2.key_id === r.key_id);
+    if (!k) return `no key ${r.key_id} for agent ${env.agent} in the agent keys`;
+    try {
+      if (keyId(b64urlDecode(k.public_key)) !== k.key_id) return "agent key_id does not match its public key";
+    } catch {
+      return "agent public key is not base64url";
+    }
+    if (!active(k, ms(env.time))) return `key ${k.key_id} was not active at ${env.time}`;
+    if (k.valid_to != null && "receipt" in r) {
+      const server = r.receipt.batch.server_time;
+      if (ms(server) >= ms(k.valid_to)) return `key ${k.key_id} was revoked at ${k.valid_to}, before the service received this record at ${server}`;
+    }
+    if (!verifySig(k.public_key, r.draft === true && this.local ? "draft" : "record", h2, r.sig)) return "signature does not verify";
+    return null;
+  }
+  // 4
+  chains(recs) {
+    const acc = this.acc[3];
+    const chains = /* @__PURE__ */ new Map();
+    for (const x of recs) {
+      const id = this.chainId(x.r);
+      const chain = chains.get(id) ?? /* @__PURE__ */ new Map();
+      chains.set(id, chain);
+      const seq = x.r.envelope.seq;
+      const held = chain.get(seq);
+      if (held && held.h !== x.h) {
+        acc.fail(x.label, "two different records with the same seq (fork)");
+        continue;
+      }
+      if (!held) chain.set(seq, x);
+    }
+    let edge = 0;
+    const based = [];
+    const starts = [];
+    const clean = [];
+    for (const agent of [...chains.keys()].sort()) {
+      const chain = chains.get(agent);
+      acc.checked += chain.size;
+      let prev = null;
+      for (const seq of [...chain.keys()].sort((x, y) => x - y)) {
+        const x = chain.get(seq);
+        const e = x.r.envelope;
+        if (prev && prev.r.envelope.seq + 1 === seq) {
+          if (e.prev !== prev.h) acc.fail(x.label, `prev does not equal the record_hash of seq ${seq - 1}`);
+          if (ms(e.time) < ms(prev.r.envelope.time)) acc.fail(x.label, `time ${e.time} is earlier than the time of seq ${seq - 1} (${prev.r.envelope.time})`);
+        } else if (prev) {
+          const a = prev.r.envelope.seq + 1;
+          acc.fail(x.label, this.local ? `the local chain is missing seq ${a}..${seq - 1}` : `the pack is missing seq ${a}..${seq - 1} of agent ${agent} (a gap inside the chain)`);
+        } else if (seq > 1) {
+          const base = this.local ? this.localBases[agent]?.head ?? {} : {};
+          if (this.local && base.seq === seq - 1 && base.record_hash === e.prev) based.push(`${agent} after seq ${seq - 1}`);
+          else if (this.local) acc.fail(x.label, `the local chain is missing seq 1..${seq - 1}`);
+          else if (this.fromCuts(agent)) edge++;
+          else if (this.x.filter.from !== null) acc.fail(x.label, `the pack is missing seq 1..${seq - 1} of agent ${agent}; its export's from filter is not after the agent's first key, so they belong in it`);
+          else acc.fail(x.label, `the pack is missing seq 1..${seq - 1} of agent ${agent} and its export declares no from filter`);
+        }
+        if (e.kind === "note" && e.name === INSTANCE_START) {
+          const p = prev && prev.r.envelope.seq + 1 === seq ? prev.r.envelope : null;
+          const base = this.local && !prev ? this.localBases[agent] : void 0;
+          const afterStop = p ? p.kind === "note" && p.name === INSTANCE_STOP : !!base?.stop && base.head?.seq === seq - 1 && e.prev === base.head?.record_hash && isStopNote(base.stop, e.agent, base.head.record_hash);
+          (afterStop ? clean : starts).push(`${agent} after seq ${seq - 1}`);
+        }
+        if ("receipt" in x.r) {
+          const server = x.r.receipt.batch.server_time;
+          if (ms(e.time) > ms(server) + MAX_CLOCK_SKEW_MS) acc.fail(x.label, `time ${e.time} is more than 300 s after its batch's server_time ${server}`);
+        }
+        prev = x;
+      }
+    }
+    if (edge) acc.notes.push(`${plural(edge, "chain")} start after seq 1, as the export's from filter allows`);
+    if (starts.length) acc.notes.push(`${INSTANCE_NOTE}: ${starts.join(", ")}`);
+    if (clean.length) acc.notes.push(`${CLEAN_RESTART_NOTE}: ${clean.join(", ")}`);
+    if (based.length) acc.notes.push(`continues after a co-signed record this machine does not hold: ${based.join(", ")} (the witness's signed head, see signed heads)`);
+    for (const agent of [...chains.keys()].sort()) {
+      const chain = chains.get(agent);
+      const seqs = [...chain.keys()].sort((x, y) => x - y);
+      this.coverage[agent] = coverage(seqs.map((seq) => ({ seq, kind: chain.get(seq).r.envelope.kind, name: chain.get(seq).r.envelope.name })));
+    }
+    return chains;
+  }
+  // 5
+  merkle(shipped) {
+    for (const { label, r, h: h2 } of shipped) {
+      this.acc[4].checked++;
+      const rc = r.receipt;
+      if (!verifyInclusion(h2, rc.index, rc.batch.size, rc.proof, rc.batch.root)) this.acc[4].fail(label, `proof does not lead to the root of batch ${rc.batch.seq}`);
+    }
+  }
+  // 6
+  batchSigs(shipped) {
+    const acc = this.acc[5];
+    const batches = /* @__PURE__ */ new Map();
+    const seen = /* @__PURE__ */ new Set();
+    for (const { r } of shipped) {
+      const rc = r.receipt;
+      const computed = hashJson(rc.batch);
+      const key = [computed, rc.batch_hash, rc.batch_sig, rc.service_key_id].join("\n");
+      if (seen.has(key)) continue;
+      seen.add(key);
+      acc.checked++;
+      const item = `batch ${rc.batch.seq}`;
+      if (computed !== rc.batch_hash) acc.fail(item, `batch hashes to ${computed}, receipt says ${rc.batch_hash}`);
+      try {
+        const k = this.serviceKey(rc.service_key_id, rc.batch.server_time);
+        if (!verifySig(k.public_key, "batch", computed, rc.batch_sig)) throw new Error("signature does not verify");
+      } catch (e) {
+        acc.fail(item, `batch_sig: ${e.message}`);
+      }
+      batches.set(`${String(rc.batch.seq).padStart(16, "0")}
+${computed}`, rc);
+    }
+    return batches;
+  }
+  // 7
+  batchChain(batches) {
+    const acc = this.acc[6];
+    const bySeq = /* @__PURE__ */ new Map();
+    for (const key of [...batches.keys()].sort()) {
+      acc.checked++;
+      const rc = batches.get(key);
+      const b = rc.batch;
+      const h2 = key.split("\n")[1];
+      const id = `${b.project}
+${b.env}
+${String(b.seq).padStart(16, "0")}`;
+      const held = bySeq.get(id);
+      if (held) {
+        if (held.h !== h2) acc.fail(`batch ${b.seq}`, "two different batches with the same seq (fork)");
+        continue;
+      }
+      bySeq.set(id, { h: h2, b });
+    }
+    let gaps = 0;
+    let prev = null;
+    for (const id of [...bySeq.keys()].sort()) {
+      const { h: h2, b } = bySeq.get(id);
+      const chain = `${b.project}
+${b.env}`;
+      if (b.seq === 1 !== (b.prev === null)) acc.fail(`batch ${b.seq}`, "prev must be null exactly when seq is 1");
+      if (prev && prev.chain === chain) {
+        if (prev.seq + 1 === b.seq && b.prev !== prev.h) acc.fail(`batch ${b.seq}`, `prev does not equal the batch_hash of batch ${prev.seq}`);
+        else if (prev.seq + 1 !== b.seq) gaps++;
+        if (ms(b.server_time) < ms(prev.b.server_time)) {
+          acc.fail(`batch ${b.seq}`, `server_time ${b.server_time} is earlier than the server_time of batch ${prev.seq} (${prev.b.server_time})`);
+        }
+      }
+      prev = { chain, seq: b.seq, h: h2, b };
+    }
+    if (gaps) acc.notes.push(`${plural(gaps, "gap")} between batches held in the pack`);
+  }
+  // 8
+  heads(shipped, chains) {
+    const acc = this.acc[7];
+    const seen = /* @__PURE__ */ new Set();
+    const held = (chain, seq) => chains.get(chain)?.get(seq)?.h;
+    const lastHeld = (chain) => Math.max(0, ...chains.get(chain)?.keys() ?? []);
+    for (const { r } of shipped) {
+      const rc = r.receipt;
+      const item = `head ${rc.head.agent}#${rc.head.seq}`;
+      const hh = hashJson(rc.head);
+      if (!seen.has(`${hh}
+${rc.head_sig}`)) {
+        seen.add(`${hh}
+${rc.head_sig}`);
+        try {
+          const k = this.serviceKey(rc.service_key_id, rc.head.server_time);
+          if (!verifySig(k.public_key, "head", hh, rc.head_sig)) throw new Error("signature does not verify");
+        } catch (e) {
+          acc.fail(item, `head_sig: ${e.message}`);
+        }
+        const x = held(this.headChain(rc.head), rc.head.seq);
+        if (x && x !== rc.head.record_hash) acc.fail(item, "head names a different record than the pack holds at that seq");
+      }
+      if (rc.head.seq < r.envelope.seq) acc.fail(item, `head is older than record seq ${r.envelope.seq} it was issued with`);
+    }
+    let inFilter = (_a2) => true;
+    if (!this.local) {
+      try {
+        const sh = hashJson(exportStatement(this.x.pack));
+        if (!this.anyKey("export", sh, this.x.exportSig ?? "", this.x.generated)) {
+          acc.fail("export statement", "export_sig does not verify with any service key active at generated: the pack's filter, heads, generated time or records were changed after the service signed it");
+        }
+      } catch (e) {
+        acc.fail("export statement", e.message);
+      }
+      const agents = this.x.filter.agents;
+      inFilter = (a) => agents === null || agents.includes(a);
+      for (const { label, r } of this.recs) {
+        const e = r.envelope;
+        const t = ms(e.time);
+        if (!inFilter(e.agent)) acc.fail(label, "the record's agent is not in the export's filter");
+        else if (this.fromMs !== null && t < this.fromMs) acc.fail(label, `time ${e.time} is before the export's from filter`);
+        else if (this.toMs !== null && t >= this.toMs) acc.fail(label, `time ${e.time} is not before the export's to filter`);
+      }
+    }
+    const exp = /* @__PURE__ */ new Map();
+    for (const sh of this.x.exportHeads) {
+      const h2 = sh.head;
+      const item = `export head ${h2.agent}#${h2.seq}`;
+      if (h2.project !== this.project || h2.env !== this.env) {
+        acc.fail(item, "the export head belongs to another project or env");
+        continue;
+      }
+      const hh = hashJson(h2);
+      if (!seen.has(`${hh}
+${sh.head_sig}`)) {
+        seen.add(`${hh}
+${sh.head_sig}`);
+        if (!this.anyKey("head", hh, sh.head_sig, h2.server_time)) acc.fail(item, "head_sig does not verify with any service key active at its server_time");
+      }
+      const sMs = ms(h2.server_time);
+      if (sMs === null || this.generatedMs === null || sMs > this.generatedMs) acc.fail(item, `the export head's server_time ${h2.server_time} is after the pack was generated (${this.x.generated})`);
+      if (!inFilter(h2.agent)) acc.fail(item, "the export head is for an agent outside the export's filter");
+      const x = held(h2.agent, h2.seq);
+      if (x && x !== h2.record_hash) acc.fail(item, "the export head names a different record than the pack holds at that seq");
+      if (exp.has(h2.agent)) acc.fail(item, "two export heads for the same agent");
+      else exp.set(h2.agent, h2);
+    }
+    if (!this.local) {
+      for (const agent of [...chains.keys()].sort()) {
+        const have = lastHeld(agent);
+        const h2 = exp.get(agent);
+        if (!h2) acc.fail(`agent ${agent}`, "the pack has no export head for this agent, so records cut off at the end cannot be detected");
+        else if (have > h2.seq) acc.fail(`export head ${agent}#${h2.seq}`, `the pack holds seq ${have}, beyond the export head seq ${h2.seq}`);
+        else if (have < h2.seq && !this.toMayCut(h2)) acc.fail(`export head ${agent}#${h2.seq}`, `the pack ends at seq ${have} but the service's head at export was seq ${h2.seq} (records missing at the end)`);
+      }
+      for (const agent of [...exp.keys()].sort()) if (!chains.has(agent)) acc.fail(`export head ${agent}#${exp.get(agent).seq}`, "the pack holds none of this agent's records, but the export names its head");
+    }
+    let newer = 0;
+    for (const sh of this.x.clientHeads ?? []) {
+      const h2 = sh.head;
+      if (h2.project !== this.project || h2.env !== this.env) continue;
+      if (!inFilter(h2.agent)) continue;
+      const item = `head file ${h2.agent}#${h2.seq}`;
+      const hh = hashJson(h2);
+      if (!seen.has(`${hh}
+${sh.head_sig}`)) {
+        seen.add(`${hh}
+${sh.head_sig}`);
+        if (!this.anyKey("head", hh, sh.head_sig, h2.server_time)) acc.fail(item, "head_sig does not verify with any service key active at its server_time");
+      }
+      const x = held(h2.agent, h2.seq);
+      if (x && x !== h2.record_hash) acc.fail(item, "the client's head names a different record than the pack holds at that seq");
+      const sMs = ms(h2.server_time);
+      if (sMs === null || this.generatedMs === null || sMs > this.generatedMs) {
+        newer++;
+        continue;
+      }
+      const have = lastHeld(h2.agent);
+      const applies = (have > 0 || !this.fromCuts(h2.agent)) && !this.toMayCut(h2);
+      if (applies && have < h2.seq) acc.fail(item, `the client's head is seq ${h2.seq} but the pack ends at seq ${have} (records missing at the end)`);
+    }
+    if (newer) acc.notes.push(`${plural(newer, "client head")} newer than the export, not applied`);
+    for (const id of Object.keys(this.localBases).sort()) {
+      const sh = this.localBases[id] ?? {};
+      const head = sh.head ?? {};
+      const hh = hashJson(head);
+      const sig = sh.head_sig ?? "";
+      if (this.serviceKeys.length && !seen.has(`${hh}
+${sig}`)) {
+        seen.add(`${hh}
+${sig}`);
+        if (!this.anyKey("head", hh, sig, head.server_time)) acc.fail(`base ${id}#${head.seq}`, "head_sig: signature does not verify");
+      }
+    }
+    for (const id of Object.keys(this.localHeads).sort()) {
+      const sh = this.localHeads[id] ?? {};
+      const head = sh.head ?? {};
+      const item = `head.json ${id}#${head.seq}`;
+      const hh = hashJson(head);
+      const sig = sh.head_sig ?? "";
+      if (!seen.has(`${hh}
+${sig}`)) {
+        seen.add(`${hh}
+${sig}`);
+        if (!this.anyKey("head", hh, sig, head.server_time)) acc.fail(item, "head_sig: signature does not verify");
+        const x = held(id, head.seq);
+        if (x && x !== head.record_hash) acc.fail(item, "head names a different record than the pack holds at that seq");
+      }
+      const have = lastHeld(id);
+      if (have < (head.seq ?? 0)) acc.fail(item, `the service holds seq ${head.seq} but the local chain ends at seq ${have} (truncated)`);
+    }
+    acc.checked = seen.size;
+  }
+  // 9
+  drand(batches) {
+    const acc = this.acc[8];
+    let nulls = 0;
+    const rounds = /* @__PURE__ */ new Set();
+    for (const rc of batches.values()) {
+      const d = rc.batch.drand;
+      if (d === null) {
+        nulls++;
+        continue;
+      }
+      const item = `batch ${rc.batch.seq} round ${d.round}`;
+      const why = checkRoundTime(ms(rc.batch.server_time) ?? 0, d.round);
+      if (why) acc.fail(item, why);
+      if (rounds.has(`${d.round}
+${d.signature}`)) continue;
+      rounds.add(`${d.round}
+${d.signature}`);
+      if (d.chain !== QUICKNET_CHAIN) acc.fail(item, `unknown drand chain ${d.chain}`);
+      else if (!/^([0-9a-f]{2})+$/.test(d.signature)) acc.fail(item, "signature is not hex");
+      else if (this.drandVerifier && !this.drandVerifier(d)) acc.fail(item, `BLS signature does not verify for round ${d.round}`);
+      else if (sha256Hex((0, import_utils4.hexToBytes)(d.signature)) !== d.randomness) acc.fail(item, "randomness is not sha256(signature)");
+    }
+    acc.checked = rounds.size;
+    if (nulls) acc.notes.push(`${plural(nulls, "batch", "batches")} without a drand round (beacon unreachable when written)`);
+    if (!rounds.size || !this.drandVerifier) {
+      acc.notChecked = true;
+      if (rounds.size) acc.notes.push(DRAND_NOT_CHECKED.split(": ")[1]);
+    }
+  }
+  // 10, 11
+  anchors(anchors, batches) {
+    const [a10, a11] = [this.acc[9], this.acc[10]];
+    const batchTimes = /* @__PURE__ */ new Map();
+    for (const [k, rc] of batches) batchTimes.set(k.split("\n")[1], [rc.batch.seq, rc.batch.server_time]);
+    const anchored = /* @__PURE__ */ new Set();
+    const bySeq = /* @__PURE__ */ new Map();
+    const proofs = [];
+    anchors.forEach((entry, i) => {
+      a10.checked++;
+      const errs = anchorError(entry);
+      if (errs) return a10.fail(`anchors[${i}]`, errs);
+      const a = entry.anchor;
+      const item = `anchor ${a.seq}`;
+      const { ots: _o, status: _s, bitcoin_block: _b, ...core } = a;
+      const ah = hashJson(core);
+      const created = ms(a.created);
+      if (!this.anyKey("anchor", ah, entry.anchor_sig, a.created)) a10.fail(item, "anchor_sig does not verify with any service key active at its creation");
+      if (serviceKeysHash(this.serviceKeys, created) !== a.keys_hash) a10.fail(item, "keys_hash does not match the service keys supplied: the key list was changed after this anchor was signed");
+      for (const [bh, p] of Object.entries(entry.paths)) {
+        if (verifyInclusion(bh, p.index, a.size, p.path, a.root)) {
+          anchored.add(bh);
+          const bt = batchTimes.get(bh);
+          if (bt && created < ms(bt[1])) a10.fail(item, `created ${a.created} is before the server_time of batch ${bt[0]} (${bt[1]}) it covers`);
+        } else a10.fail(item, `path for batch ${bh} does not lead to the anchor root`);
+      }
+      const held = bySeq.get(a.seq);
+      if (held) {
+        if (held.ah !== ah) a10.fail(item, "two different signed anchors with the same seq");
+      } else bySeq.set(a.seq, { ah, a });
+      a11.checked++;
+      try {
+        proofs.push(otsCheck(a, ah, this.x.timestamps));
+      } catch (e) {
+        a11.fail(item, e.message);
+      }
+    });
+    let prev = null;
+    for (const seq of [...bySeq.keys()].sort((x, y) => x - y)) {
+      const { ah, a } = bySeq.get(seq);
+      if (prev && prev.seq + 1 === seq && a.prev !== prev.ah) a10.fail(`anchor ${seq}`, `prev does not equal the anchor_hash of anchor ${prev.seq}`);
+      prev = { seq, ah };
+    }
+    let stale = 0;
+    let young = 0;
+    const refMs = this.local ? Date.now() : this.generatedMs;
+    for (const [k, rc] of batches) {
+      if (anchored.has(k.split("\n")[1])) continue;
+      const t = ms(rc.batch.server_time);
+      if (t === null || refMs === null || t + ANCHOR_WINDOW_MS < refMs) stale++;
+      else young++;
+    }
+    if (stale) {
+      a10.notChecked = true;
+      a10.notes.push(
+        this.local ? `${plural(stale, "batch", "batches")} older than the 2-hour anchor window: local state holds no anchors, so verify an export (\`signafaide export\`) to check them` : `${plural(stale, "batch", "batches")} not timestamped: older than the 2-hour anchor window, and no anchor in the pack covers them`
+      );
+    }
+    if (!anchors.length && !stale && !(this.local && young)) {
+      if (this.local) a10.notChecked = true;
+      else a10.pending = true;
+      a10.notes.push(this.local ? "local state holds no anchors" : "no anchors in the pack yet (an anchor is made every hour)");
+    } else if (young) {
+      a10.pending = true;
+      a10.notes.push(`${plural(young, "batch", "batches")} not yet anchored`);
+    }
+    const unchecked = proofs.filter((p) => p[0] === "unchecked");
+    if (!proofs.length) {
+      if (a10.pending && !a10.notChecked) {
+        a11.pending = true;
+        a11.notes.push("waiting for the anchor");
+      } else a11.notChecked = true;
+    } else if (unchecked.length) {
+      a11.notChecked = true;
+      a11.notes.push(`public timestamp not checked (${unchecked[0][2]}); claims block ${unchecked.map((p) => p[1]).join(", ")}`);
+    } else if (proofs.every((p) => p[0] === "confirmed")) {
+      const h2 = Math.max(...proofs.map((p) => p[1]));
+      a11.value = `confirmed@${h2}`;
+      a11.notes.push(`each public timestamp checked against its public record (block ${h2})`);
+    } else {
+      a11.value = "pending";
+      a11.pending = true;
+      a11.notes.push(`waiting for the public timestamp to confirm (usually within a few hours): ${proofs.filter((p) => p[0] === "pending").length} of ${proofs.length}`);
+    }
+  }
+  // 12
+  content(recs) {
+    const acc = this.acc[11];
+    for (const { label, r, h: h2 } of recs) {
+      let c = r.content;
+      let salt = r.salt;
+      const local = this.contents.get(h2);
+      if (c === void 0 && salt === void 0 && local) ({ content: c, salt } = local);
+      if (c === void 0 && salt === void 0) continue;
+      acc.checked++;
+      let ch;
+      try {
+        ch = checkContent(c, salt, r.envelope.content_hash);
+      } catch (e) {
+        acc.fail(label, e.message);
+        continue;
+      }
+      if (ch !== null) acc.fail(label, `content hashes to ${ch}, envelope says ${r.envelope.content_hash}`);
+    }
+    if (!acc.checked) {
+      acc.notChecked = true;
+      acc.notes.push("no content supplied (hash-only records)");
+    }
+  }
+};
+var exactKeys = (o, keys) => !!o && typeof o === "object" && !Array.isArray(o) && Object.keys(o).length === keys.length && keys.every((k) => k in o);
+function anchorError(entry) {
+  if (!exactKeys(entry, ["anchor", "anchor_sig", "paths"])) return "an anchor entry has exactly anchor, anchor_sig and paths";
+  const a = entry.anchor;
+  if (!exactKeys(a, ["v", "seq", "prev", "root", "size", "created", "keys_hash", "ots", "status", "bitcoin_block"])) {
+    return "anchor fields are v, seq, prev, root, size, created, keys_hash, ots, status, bitcoin_block";
+  }
+  if (a.v !== 1 || !isU64(a.seq) || !isU64(a.size) || !validTime(a.created)) return "anchor v, seq, size or created is invalid";
+  if (!(isHex2(a.root) && isHex2(a.keys_hash) && (a.prev === null || isHex2(a.prev)))) return "anchor root, keys_hash or prev is not a hash";
+  if (typeof a.ots !== "string" || typeof entry.anchor_sig !== "string" || !(a.bitcoin_block === null || isU64(a.bitcoin_block))) return "anchor ots, anchor_sig or bitcoin_block is invalid";
+  if (a.status !== "pending" && a.status !== "confirmed" || !entry.paths || typeof entry.paths !== "object" || Array.isArray(entry.paths)) return "anchor status or paths is invalid";
+  if (!Object.entries(entry.paths).every(([k, p]) => isHex2(k) && exactKeys(p, ["index", "path"]) && isU64(p.index) && Array.isArray(p.path) && p.path.every(isHex2))) {
+    return 'each anchor path is {"index": n, "path": [...]}';
+  }
+  return "";
+}
+function otsCheck(a, anchorHash, headers) {
+  const data = base64Decode(a.ots);
+  const { digest: digest2, height } = otsStatus(data);
+  if (digest2 !== anchorHash) throw new Error("OTS proof is for a different digest than the anchor hash");
+  if (a.status === "confirmed" && height === null) throw new Error("anchor says confirmed but the proof is still pending");
+  if (a.status === "confirmed" && a.bitcoin_block !== null && height !== a.bitcoin_block) throw new Error(`anchor says block ${a.bitcoin_block} but the proof attests block ${height}`);
+  if (height === null) return ["pending"];
+  const attested = blockAttestations(data);
+  if (!headers) return ["unchecked", height, "offline"];
+  const roots = /* @__PURE__ */ new Map();
+  for (const [h2, got] of headers) {
+    if (!got[0]) roots.set(h2, [false, got[1]]);
+    else
+      try {
+        roots.set(h2, [true, checkHeader(got[1].hash, got[1].header)]);
+      } catch (e) {
+        roots.set(h2, [false, e.message]);
+      }
+  }
+  for (const [h2, msg] of attested) {
+    const r = roots.get(h2);
+    if (r && r[0] && r[1] !== msg) throw new Error(`the timestamp claims block ${h2}, but its Merkle root does not match that block's header`);
+  }
+  for (const [h2] of attested) {
+    const r = roots.get(h2);
+    if (!r) return ["unchecked", height, `block ${h2} was not looked up`];
+    if (!r[0]) return ["unchecked", height, r[1]];
+  }
+  return ["confirmed", height];
+}
+async function loadDrandVerifier() {
+  let bls;
+  try {
+    bls = (await import("@noble/curves/bls12-381")).bls12_381;
+  } catch {
+    return null;
+  }
+  const { sha256: sha2564 } = await import("@noble/hashes/sha2");
+  const DST = "BLS_SIG_BLS12381G1_XMD:SHA-256_SSWU_RO_NUL_";
+  return (d) => {
+    try {
+      const msg = new Uint8Array(8);
+      new DataView(msg.buffer).setBigUint64(0, BigInt(d.round));
+      return bls.shortSignatures.verify(d.signature, bls.shortSignatures.hash(sha2564(msg), DST), QUICKNET_PUBLIC_KEY);
+    } catch {
+      return false;
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AGENT_RE,
+  ANCHOR_WINDOW_MS,
+  CHECKS,
+  Client,
+  DEFAULT_URL,
+  HEADER,
+  JsonNumber,
+  KeysRequired,
+  MAX_DECLARED_NAME,
+  MAX_NODES,
+  MAX_PROOF_BYTES,
+  MAX_ROUND,
+  NOT_INDEPENDENT,
+  Report,
+  SignafaideError,
+  SigningKey,
+  TOOLS,
+  TOOL_PREFIX,
+  TOOL_UNRECORDED_PREFIX,
+  VERSION,
+  agentName,
+  assertPortableNumbers,
+  auditPath,
+  b64url,
+  b64urlDecode,
+  blockAttestations,
+  canonicalBytes,
+  canonicalize,
+  checkContent,
+  checkHeader,
+  checkRoundTime,
+  clampTime,
+  clientHeader,
+  contentFromText,
+  contentHash,
+  countsText,
+  coverage,
+  coverageLines,
+  declaredName,
+  detectAgent,
+  draftErrors,
+  envelopeErrors,
+  exportStatement,
+  fetchJson,
+  hashJson,
+  isLoopbackUrl,
+  keyEntryErrors,
+  keyId,
+  leafHash,
+  loadDrandVerifier,
+  makeDraft,
+  makeRecord,
+  manifestEntry,
+  manifestErrors,
+  merkleRoot,
+  newSalt,
+  now,
+  otsStatus,
+  parseAgentKeys,
+  parseHeadFile,
+  parseJson,
+  parseOts,
+  parseServiceKeys,
+  receiptErrors,
+  recordErrors,
+  recordHash,
+  recordsHash,
+  registration,
+  resultLine,
+  rootsFromVector,
+  scopeText,
+  serviceKeysHash,
+  sha256Hex,
+  signDraft,
+  signedMessage,
+  target,
+  telemetryEnabled,
+  timestampHeights,
+  toolNote,
+  toolNoteName,
+  validProjectId,
+  validTime,
+  verifyInclusion,
+  verifyLocalState,
+  verifyPack,
+  verifySig,
+  wireRecord,
+  withWallTime
+});
+/*! Bundled license information:
+
+@noble/ed25519/index.js:
+  (*! noble-ed25519 - MIT License (c) 2019 Paul Miller (paulmillr.com) *)
+*/