verifyhash 0.1.0 → 0.1.2

package/verifier/dist/seal-vh-standalone.js

@@ -0,0 +1,876 @@
+#!/usr/bin/env node
+"use strict";
+
+// seal-vh-standalone.js — the SINGLE-FILE, ZERO-DEPENDENCY, OFFLINE verifyhash SEALER (free tier).
+//
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 verifyhash.com — https://verifyhash.com
+//
+// GENERATED by verifier/build-standalone.js from the in-tree sealer — DO NOT EDIT BY HAND.
+// Re-generate with: node verifier/build-standalone.js   (the build is deterministic; see that file.)
+//
+// HOW TO USE IT (no clone, no `npm install`, no node_modules, no package.json, no account):
+//   1. Save THIS one file somewhere.
+//   2. Run:  node seal-vh-standalone.js <folder> -o out.vhevidence.json
+//   3. Hand `out.vhevidence.json` (+ your folder) to anyone; they verify it with verify-vh-standalone.js
+//      — also zero-install. Exit codes: 0 sealed / 1 IO / 2 usage (incl. >25 files) / 3 seal-build error.
+//
+// SELF-DESCRIBING (needs NO second file): this bundle carries its OWN build-provenance.
+//   node seal-vh-standalone.js --self-attest   # confirm THIS file's bytes are intact (0 ok / 1 modified)
+//   node seal-vh-standalone.js --provenance    # print the ordered source modules + sha256 it was built from
+//
+// FREE TIER: an UNSIGNED seal of up to 25 files. Sealing MORE files (`evidence_unlimited`) or a SIGNED
+// wrap (`evidence_signed`) is the PAID surface via `vh evidence seal` — this file has NO --sign/--license
+// /--key flag and uses NO key. It is READ-ONLY apart from the -o file you name, and opens NO network. The
+// seal is TAMPER-EVIDENT + OFFLINE-RECOMPUTABLE, NOT a trusted timestamp. keccak256 is the byte-identical
+// pure-JS implementation the verifier uses, so a seal this builds is accepted verbatim by the verifier.
+
+// ---- minimal CommonJS module shim (so the inlined modules keep their require() structure) --------
+var __modules = Object.create(null);
+var __cache = Object.create(null);
+function __require(id) {
+  if (id in __cache) return __cache[id].exports;
+  var factory = __modules[id];
+  if (!factory) throw new Error('standalone bundle: unknown module: ' + id);
+  var module = { exports: {} };
+  __cache[id] = module;
+  factory(module, module.exports, __require);
+  return module.exports;
+}
+
+// ===== module: keccak256-vendored  (from verifier/lib/keccak256-vendored.js) =====
+__modules["keccak256-vendored"] = function (module, exports, __require) {
+"use strict";
+
+// verifier/lib/keccak256-vendored.js — a PURE-JS, ZERO-DEPENDENCY keccak256 (T-35.1).
+//
+// WHY THIS FILE EXISTS
+//   The whole point of the free verifier is "save ONE file, run it with `node`, no `npm install`, audit it
+//   in one sitting." The in-tree verifier core takes keccak256 from `js-sha3` (verifier/lib/keccak.js) — an
+//   audited, dependency-free package that is already a project dependency — which is correct for the
+//   IN-TREE path. But `js-sha3` is still a RUNTIME dependency: a third party handed a single sealed packet
+//   would have to `npm install` it. This module is the LAST piece needed to inline the verifier into one
+//   self-contained file: a from-scratch keccak256 that `require`s NOTHING (no `js-sha3`, no Node core, no
+//   relative module). It is ADDITIVE — keccak.js and verifier/package.json's `dependencies: ["js-sha3"]`
+//   are deliberately left UNCHANGED so the existing tree + isolation test stay green.
+//
+// CORRECTNESS, NOT NOVELTY
+//   keccak256 is the FIXED, standardized Keccak[c=512] sponge over the Keccak-f[1600] permutation with the
+//   ORIGINAL Keccak padding (a single 0x01 domain byte, NOT SHA3's 0x06) and a 256-bit squeeze — exactly
+//   what Ethereum/ethers and `js-sha3.keccak256` compute. This is a textbook implementation of FIPS-202's
+//   Keccak-f (theta, rho, pi, chi, iota) done with 32-bit lane halves (lo/hi) so it runs on plain JS numbers
+//   with no BigInt and no 64-bit-int dependency. test/verifier.keccak-vendored.test.js proves byte-identical
+//   output vs BOTH `js-sha3` AND the production `ethers` keccak path across the empty input, the known
+//   vectors, and ≥500 random buffers — a single mismatch FAILS. So this is independent CODE but never an
+//   independent ALGORITHM: it cannot silently diverge from the standard.
+//
+// REQUIRES NOTHING: a grep of this source finds no CommonJS require call and no bare-name import.
+// (Intentional — this property is asserted by test/verifier.keccak-vendored.test.js.)
+
+// ---- Keccak-f[1600] round constants, split into 32-bit (hi, lo) halves --------------------------------
+// The 24 RC[i] are the canonical Keccak iota constants; here each 64-bit constant is pre-split so we never
+// need a 64-bit integer type. RC_HI[i] is bits 63..32, RC_LO[i] is bits 31..0.
+const RC_HI = [
+  0x00000000, 0x00000000, 0x80000000, 0x80000000, 0x00000000, 0x00000000, 0x80000000, 0x80000000,
+  0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x80000000, 0x80000000, 0x80000000,
+  0x80000000, 0x80000000, 0x00000000, 0x80000000, 0x80000000, 0x80000000, 0x00000000, 0x80000000,
+];
+const RC_LO = [
+  0x00000001, 0x00008082, 0x0000808a, 0x80008000, 0x0000808b, 0x80000001, 0x80008081, 0x00008009,
+  0x0000008a, 0x00000088, 0x80008009, 0x8000000a, 0x8000808b, 0x0000008b, 0x00008089, 0x00008003,
+  0x00008002, 0x00000080, 0x0000800a, 0x8000000a, 0x80008081, 0x00008080, 0x80000001, 0x80008008,
+];
+
+// Rotation offsets r[x,y] for the rho step, indexed by lane number (x + 5*y). Lane 0 is never rotated.
+const RHO = [
+  0, 1, 62, 28, 27, 36, 44, 6, 55, 20, 3, 10, 43, 25, 39, 41, 45, 15, 21, 8, 18, 2, 61, 56, 14,
+];
+// pi permutation: destination lane for each source lane. pi maps (x,y) -> (y, 2x+3y), so source lane
+// (x + 5y) is written to lane (y + 5*((2x+3y) mod 5)); PI[src] = dst.
+const PI = [
+  0, 10, 20, 5, 15, 16, 1, 11, 21, 6, 7, 17, 2, 12, 22, 23, 8, 18, 3, 13, 14, 24, 9, 19, 4,
+];
+
+// The state is 25 lanes; we hold each lane as two 32-bit halves in parallel arrays sLo/sHi (index = lane).
+
+// Keccak-f[1600] permutation, in place, on (sLo, sHi). 24 rounds of theta, rho+pi, chi, iota.
+function keccakF(sLo, sHi) {
+  const bcLo = new Array(5);
+  const bcHi = new Array(5);
+  const tLo = new Array(25);
+  const tHi = new Array(25);
+
+  for (let round = 0; round < 24; round++) {
+    // --- theta ---
+    for (let x = 0; x < 5; x++) {
+      bcLo[x] = sLo[x] ^ sLo[x + 5] ^ sLo[x + 10] ^ sLo[x + 15] ^ sLo[x + 20];
+      bcHi[x] = sHi[x] ^ sHi[x + 5] ^ sHi[x + 10] ^ sHi[x + 15] ^ sHi[x + 20];
+    }
+    for (let x = 0; x < 5; x++) {
+      // d = bc[x-1] XOR rotl1(bc[x+1])
+      const x1 = (x + 1) % 5;
+      const x4 = (x + 4) % 5;
+      const rotLo = ((bcLo[x1] << 1) | (bcHi[x1] >>> 31)) >>> 0;
+      const rotHi = ((bcHi[x1] << 1) | (bcLo[x1] >>> 31)) >>> 0;
+      const dLo = (bcLo[x4] ^ rotLo) >>> 0;
+      const dHi = (bcHi[x4] ^ rotHi) >>> 0;
+      for (let y = 0; y < 25; y += 5) {
+        sLo[x + y] = (sLo[x + y] ^ dLo) >>> 0;
+        sHi[x + y] = (sHi[x + y] ^ dHi) >>> 0;
+      }
+    }
+
+    // --- rho + pi --- (write permuted, rotated lanes into t)
+    for (let i = 0; i < 25; i++) {
+      const r = RHO[i];
+      const dest = PI[i];
+      let outLo, outHi;
+      if (r === 0) {
+        outLo = sLo[i];
+        outHi = sHi[i];
+      } else if (r < 32) {
+        outLo = ((sLo[i] << r) | (sHi[i] >>> (32 - r))) >>> 0;
+        outHi = ((sHi[i] << r) | (sLo[i] >>> (32 - r))) >>> 0;
+      } else if (r === 32) {
+        outLo = sHi[i];
+        outHi = sLo[i];
+      } else {
+        const rr = r - 32;
+        outLo = ((sHi[i] << rr) | (sLo[i] >>> (32 - rr))) >>> 0;
+        outHi = ((sLo[i] << rr) | (sHi[i] >>> (32 - rr))) >>> 0;
+      }
+      tLo[dest] = outLo;
+      tHi[dest] = outHi;
+    }
+
+    // --- chi --- a[x] = t[x] XOR ((NOT t[x+1]) AND t[x+2]), per row
+    for (let y = 0; y < 25; y += 5) {
+      for (let x = 0; x < 5; x++) {
+        const x1 = y + ((x + 1) % 5);
+        const x2 = y + ((x + 2) % 5);
+        sLo[y + x] = (tLo[y + x] ^ (~tLo[x1] & tLo[x2])) >>> 0;
+        sHi[y + x] = (tHi[y + x] ^ (~tHi[x1] & tHi[x2])) >>> 0;
+      }
+    }
+
+    // --- iota ---
+    sLo[0] = (sLo[0] ^ RC_LO[round]) >>> 0;
+    sHi[0] = (sHi[0] ^ RC_HI[round]) >>> 0;
+  }
+}
+
+// keccak256 over `bytes` (a Uint8Array/Buffer or array of byte values), returning a 32-byte Uint8Array.
+// Rate r = 1088 bits = 136 bytes (c = 512), original Keccak padding (0x01 .. 0x80), 256-bit output.
+function keccak256Bytes(bytes) {
+  const RATE = 136; // bytes absorbed per permutation
+  const sLo = new Array(25).fill(0);
+  const sHi = new Array(25).fill(0);
+
+  // Build the padded message: append a single 0x01 domain/pad start byte, zero-fill, set the high bit
+  // (0x80) of the final rate block. (If the 0x01 lands on the last byte of a block, it merges to 0x81.)
+  const inLen = bytes.length;
+  const padLen = RATE - (inLen % RATE); // 1..RATE, guarantees room for the 0x01 and 0x80 markers
+  const total = inLen + padLen;
+  const msg = new Uint8Array(total);
+  for (let i = 0; i < inLen; i++) msg[i] = bytes[i] & 0xff;
+  msg[inLen] = 0x01; // start of the original-Keccak pad (NOT SHA3's 0x06)
+  msg[total - 1] = (msg[total - 1] | 0x80) & 0xff; // final-block high bit
+
+  // Absorb: XOR each RATE-byte block into the state (little-endian lanes) and permute.
+  for (let off = 0; off < total; off += RATE) {
+    for (let i = 0; i < RATE; i += 8) {
+      const lane = i >> 3; // lane index within the rate region (0..16), block-relative
+      const b = off + i;
+      const lo =
+        ((msg[b] | (msg[b + 1] << 8) | (msg[b + 2] << 16) | (msg[b + 3] << 24)) >>> 0);
+      const hi =
+        ((msg[b + 4] | (msg[b + 5] << 8) | (msg[b + 6] << 16) | (msg[b + 7] << 24)) >>> 0);
+      sLo[lane] = (sLo[lane] ^ lo) >>> 0;
+      sHi[lane] = (sHi[lane] ^ hi) >>> 0;
+    }
+    keccakF(sLo, sHi);
+  }
+
+  // Squeeze 256 bits = 32 bytes = the first 4 lanes (little-endian), no further permutation needed.
+  const out = new Uint8Array(32);
+  for (let lane = 0; lane < 4; lane++) {
+    const lo = sLo[lane];
+    const hi = sHi[lane];
+    const base = lane * 8;
+    out[base] = lo & 0xff;
+    out[base + 1] = (lo >>> 8) & 0xff;
+    out[base + 2] = (lo >>> 16) & 0xff;
+    out[base + 3] = (lo >>> 24) & 0xff;
+    out[base + 4] = hi & 0xff;
+    out[base + 5] = (hi >>> 8) & 0xff;
+    out[base + 6] = (hi >>> 16) & 0xff;
+    out[base + 7] = (hi >>> 24) & 0xff;
+  }
+  return out;
+}
+
+// Lowercase hex (no 0x prefix) of a byte array — used by the hex-string entry point.
+function toHex(bytes) {
+  let s = "";
+  for (let i = 0; i < bytes.length; i++) {
+    const b = bytes[i] & 0xff;
+    s += (b < 16 ? "0" : "") + b.toString(16);
+  }
+  return s;
+}
+
+/**
+ * keccak256 over a byte buffer.
+ * @param {Uint8Array|Buffer|number[]} bytes input bytes
+ * @returns {Uint8Array} the 32-byte digest
+ */
+function keccak256(bytes) {
+  if (
+    !(bytes instanceof Uint8Array) &&
+    !Array.isArray(bytes) &&
+    !(typeof Buffer !== "undefined" && Buffer.isBuffer && Buffer.isBuffer(bytes))
+  ) {
+    throw new TypeError("keccak256 requires a Uint8Array/Buffer/byte-array of input bytes");
+  }
+  return keccak256Bytes(bytes);
+}
+
+/**
+ * keccak256 over a byte buffer, returned as a lowercase hex string WITHOUT a 0x prefix
+ * (matching `js-sha3`'s keccak256().hex() output, for drop-in cross-checking).
+ * @param {Uint8Array|Buffer|number[]} bytes input bytes
+ * @returns {string} 64-char lowercase hex
+ */
+function keccak256Hex(bytes) {
+  return toHex(keccak256(bytes));
+}
+
+module.exports = { keccak256, keccak256Hex };
+
+};
+
+// ===== module: keccak  (from verifier/lib/keccak.js) =====
+__modules["keccak"] = function (module, exports, __require) {
+"use strict";
+// Inlined keccak provider for the standalone bundle: the SAME `keccak256(bytes) -> Buffer` surface as
+// verifier/lib/keccak.js, but backed by the PURE-JS, zero-dependency vendored implementation
+// (verifier/lib/keccak256-vendored.js) instead of js-sha3 — so the bundle requires nothing external.
+var vendored = __require("keccak256-vendored");
+function keccak256(bytes) {
+  if (!(bytes instanceof Uint8Array) && !Buffer.isBuffer(bytes)) {
+    throw new TypeError("keccak256 requires a Buffer/Uint8Array of input bytes");
+  }
+  // The vendored routine returns a Uint8Array; wrap it as a Buffer so downstream `.slice(...).toString
+  // ("hex")` and `Buffer.concat([...])` callers behave exactly as they do with the js-sha3-backed shim.
+  return Buffer.from(vendored.keccak256(bytes));
+}
+module.exports = { keccak256 };
+};
+
+// ===== module: merkle  (from verifier/lib/merkle.js) =====
+__modules["merkle"] = function (module, exports, __require) {
+"use strict";
+
+// verifier/lib/merkle.js — INDEPENDENT re-derivation of the family's path-bound, domain-separated
+// Merkle convention, using ONLY ./keccak (js-sha3). NO ethers, NO hardhat, NO require back into cli/.
+//
+// WHY THIS EXISTS
+//   To verify an evidence seal / reconciliation seal / proof bundle OFFLINE without the producer stack,
+//   the independent verifier must RE-DERIVE the same per-file leaves and the same Merkle root the
+//   producer (cli/hash.js) computes. cli/hash.js uses `ethers` (keccak256/concat/toUtf8Bytes), which the
+//   verifier explicitly refuses to depend on. So this file reproduces the EXACT byte composition of
+//   pathLeaf / leafHash / nodeHash / buildTree from first principles — and test/verifier.cli.test.js
+//   cross-checks the result is byte-identical to the producer's. The two can never silently diverge.
+//
+// THE CONVENTION (must match cli/hash.js VERBATIM)
+//   * content digest      c          = keccak256(file bytes)
+//   * DIR_LEAF_DOMAIN      = keccak256("verifyhash/dir-leaf/v1")  (a fixed 32-byte prefix)
+//   * path-bound leaf      pathLeaf   = keccak256(DIR_LEAF_DOMAIN ++ utf8(relPath) ++ 0x00 ++ c)
+//   * tagged leaf          leafHash   = keccak256(0x00 ++ leaf)
+//   * interior node        nodeHash   = keccak256(0x01 ++ min(a,b) ++ max(a,b))   (sorted 32-byte pair)
+//   * tree                 sorted-leaf, "duplicate the lone odd node" pairing (OpenZeppelin style)
+//   relPath is normalized with no leading "./", exactly as the producer's toPosixRel does. CRUCIALLY
+//   this must be BYTE-FOR-BYTE the producer's normalization (cli/hash.js#toPosixRel) — see toPosixRel
+//   below — or the verifier would re-derive a DIFFERENT root than the producer sealed for some input
+//   class and would either falsely reject a genuine artifact or falsely accept the wrong one.
+
+const { keccak256 } = __require("keccak");
+
+// Domain tags, byte-identical to ContributionRegistry / cli/hash.js LEAF_TAG / NODE_TAG.
+const LEAF_TAG = Buffer.from([0x00]);
+const NODE_TAG = Buffer.from([0x01]);
+const PATH_SEP = Buffer.from([0x00]);
+
+// The fixed, versioned domain prefix for path-bound directory leaves: keccak256 of the ASCII tag.
+const DIR_LEAF_DOMAIN_STR = "verifyhash/dir-leaf/v1";
+const DIR_LEAF_DOMAIN = keccak256(Buffer.from(DIR_LEAF_DOMAIN_STR, "utf8")); // 32-byte Buffer
+
+const HEX32_RE = /^0x[0-9a-fA-F]{64}$/;
+
+// 0x-hex string (no 0x, lowercase) <-> 32-byte Buffer.
+function hexToBuf32(hex) {
+  if (typeof hex !== "string" || !HEX32_RE.test(hex)) {
+    throw new Error(`expected a 0x-prefixed 32-byte hex string, got: ${String(hex)}`);
+  }
+  return Buffer.from(hex.slice(2), "hex");
+}
+function bufToHex(buf) {
+  return "0x" + Buffer.from(buf).toString("hex");
+}
+
+/** keccak256 of raw bytes, returned as a 0x-prefixed 32-byte hex string (matches cli/hash.js hashBytes). */
+function hashBytes(bytes) {
+  const buf = Buffer.isBuffer(bytes) ? bytes : Buffer.from(bytes);
+  return bufToHex(keccak256(buf));
+}
+
+/**
+ * Normalize a relPath EXACTLY as the producer (cli/hash.js#toPosixRel) does, so the verifier
+ * re-derives the IDENTICAL root the producer sealed. The producer is `split(path.sep).join("/")`
+ * then `.replace(/^\.\//, "")`. The artifacts the verifier reads carry relPaths the producer wrote,
+ * and those are produced on POSIX hosts (cli/evidence.js#loadDirEntries does the same `path.sep`
+ * split) — where `path.sep === "/"`, so the split/join is a no-op and a literal backslash byte is a
+ * CONTENT byte that survives into the hash. We therefore must NOT collapse backslashes: a previous
+ * version unconditionally mapped "\\"->"/", which made the verifier hash `a/b.txt` while the producer
+ * hashed `a\b.txt` — a silent root divergence that could falsely REJECT a genuine backslash-named
+ * directory or falsely ACCEPT one where `a/b.txt` and `a\b.txt` collide. All we strip is the leading
+ * "./", which the producer also strips on every host. (Windows-authored relPaths, if ever needed,
+ * must be converted to "/" on BOTH the producer and verifier sides identically — not only here.)
+ */
+function toPosixRel(relPath) {
+  return String(relPath).replace(/^\.\//, "");
+}
+
+/**
+ * pathLeaf(relPath, contentDigest) = keccak256(DIR_LEAF_DOMAIN ++ utf8(relPath) ++ 0x00 ++ c).
+ * @param {string} relPath
+ * @param {string} contentDigest 0x bytes32
+ * @returns {string} 0x bytes32
+ */
+function pathLeaf(relPath, contentDigest) {
+  const relBytes = Buffer.from(toPosixRel(relPath), "utf8");
+  const c = hexToBuf32(contentDigest);
+  return bufToHex(keccak256(Buffer.concat([DIR_LEAF_DOMAIN, relBytes, PATH_SEP, c])));
+}
+
+/** leafHash(c) = keccak256(LEAF_TAG ++ c). */
+function leafHash(c) {
+  return bufToHex(keccak256(Buffer.concat([LEAF_TAG, hexToBuf32(c)])));
+}
+
+/** nodeHash(a,b) = keccak256(NODE_TAG ++ min(a,b) ++ max(a,b)) comparing as 32-byte big-endian values. */
+function nodeHash(a, b) {
+  const A = hexToBuf32(a);
+  const B = hexToBuf32(b);
+  const [lo, hi] = Buffer.compare(A, B) <= 0 ? [A, B] : [B, A];
+  return bufToHex(keccak256(Buffer.concat([NODE_TAG, lo, hi])));
+}
+
+/**
+ * Build the sorted-leaf, domain-separated Merkle root from an array of per-file PATH-BOUND leaves
+ * (the same values pathLeaf produces). Leaves are sorted ascending by their 32-byte value, tagged via
+ * leafHash, then folded with nodeHash, pairing a lone odd node with itself — byte-identical to
+ * cli/hash.js buildTree's root.
+ * @param {string[]} leaves array of 0x bytes32 path-bound leaves
+ * @returns {string} the 0x bytes32 root
+ */
+function rootFromLeaves(leaves) {
+  if (!Array.isArray(leaves) || leaves.length === 0) {
+    throw new Error("cannot build a Merkle tree from zero leaves");
+  }
+  const sorted = leaves
+    .slice()
+    .sort((a, b) => Buffer.compare(hexToBuf32(a), hexToBuf32(b)));
+  let layer = sorted.map((c) => leafHash(c));
+  while (layer.length > 1) {
+    const next = [];
+    for (let i = 0; i < layer.length; i += 2) {
+      const right = i + 1 < layer.length ? layer[i + 1] : layer[i];
+      next.push(nodeHash(layer[i], right));
+    }
+    layer = next;
+  }
+  return layer[0];
+}
+
+/**
+ * Re-derive the top-level root from a flat list of { relPath, contentHash } — the SAME computation the
+ * seal cores use: pathLeaf each, then rootFromLeaves. PURE.
+ * @param {{relPath:string, contentHash:string}[]} flat
+ * @returns {string} 0x bytes32 root
+ */
+function rootFromFlat(flat) {
+  return rootFromLeaves(flat.map((e) => pathLeaf(e.relPath, e.contentHash)));
+}
+
+module.exports = {
+  HEX32_RE,
+  DIR_LEAF_DOMAIN_STR,
+  hashBytes,
+  toPosixRel,
+  pathLeaf,
+  leafHash,
+  nodeHash,
+  rootFromLeaves,
+  rootFromFlat,
+};
+
+};
+
+// ===== module: seal-cli  (from verifier/lib/seal-cli.js) =====
+__modules["seal-cli"] = function (module, exports, __require) {
+"use strict";
+
+// verifier/lib/seal-cli.js — the FREE, ZERO-INSTALL "seal your own folder" PRODUCER, inlined verbatim into
+// verifier/dist/seal-vh-standalone.js by verifier/build-standalone.js (T-36.2).
+//
+// WHY THIS EXISTS
+//   EPIC-35 made the FREE VERIFY side zero-install: a counterparty handed ONE sealed packet saves a single
+//   file (verify-vh-standalone.js) and runs it — no clone, no `npm install`. The symmetric gap was the FREE
+//   PRODUCE side: a stranger who wants to SEAL up to 25 of their OWN files (the free tier) still had to clone
+//   the repo and `npm install` the heavy ethers/hardhat stack, because `vh evidence seal` routes through
+//   cli/evidence.js -> cli/core/packetseal.js -> cli/hash.js, and cli/hash.js pulls keccak256 from `ethers`.
+//   This module is the LAST piece that closes the loop: a from-scratch sealer that `require`s NOTHING but
+//   Node core (fs/path) and the verifier's OWN merkle lib (which itself is zero-third-party in the bundle —
+//   keccak256 comes from the inlined pure-JS vendored implementation). The emitted bundle lets a prospect
+//   PRODUCE a free `vh.evidence-seal` of up to 25 files with NO install, hand it to a counterparty, and have
+//   THEM verify it with NO install — the whole organic adoption loop, self-service, before any sales call.
+//
+// FREE-TIER BOUNDARY (enforced here, not advisory)
+//   The free tier is an UNSIGNED seal of up to SAMPLE_LIMIT (25) files. This sealer:
+//     * HARD-ERRORS (exit 2) on a folder of MORE than 25 files, naming the paid `evidence_unlimited`
+//       entitlement + the full `vh evidence seal` command that unlocks it. It never silently truncates.
+//     * has NO `--sign` / `--license` / `--key` flag AT ALL — signing (`evidence_signed`) is the PAID
+//       surface and lives only in the full CLI. There is no way to produce a signed packet from this file.
+//   So the standalone is strictly the FREE half of the product: a try-before-you-buy producer whose output
+//   the paid signed wrap is layered on top of (the bytes this emits are the exact canonical bytes the paid
+//   `vh evidence seal --sign` would wrap, so an upgrade re-uses, never re-does, the free seal).
+//
+// BYTE-FOR-BYTE COMPATIBLE with the producer
+//   The seal this emits is BYTE-IDENTICAL to cli/evidence.js#serializeSeal over the same directory: the same
+//   `kind`, `schemaVersion`, `note`, `root`, `fileCount`, and per-file { relPath, contentHash, leaf } in the
+//   same canonical key order, terminated with one "\n". That is WHY the standalone-produced seal is accepted
+//   verbatim by verify-vh-standalone.js (and the in-tree verifier) — the free PRODUCE and free VERIFY halves
+//   interoperate with zero install on either side. The merkle convention (pathLeaf / leafHash / nodeHash /
+//   sorted-leaf tree) is the verifier's own ./merkle lib, the SAME math the verifier re-derives on the other
+//   side, so a seal this builds always re-derives to the same root the verifier recomputes from the bytes.
+//
+// HONEST POSTURE + I/O DISCIPLINE
+//   The seal is TAMPER-EVIDENT + OFFLINE-RECOMPUTABLE, NOT a trusted timestamp (the load-bearing `note` is
+//   stated once, below, byte-identical to the producer's). This file reads the named folder and writes ONLY
+//   the single output file the user names with `-o`/`--out` (or prints to stdout) — it NEVER writes cwd
+//   otherwise, opens NO socket, and uses NO key. Same inputs -> byte-identical bytes.
+
+const fs = require("fs");
+const path = require("path");
+
+// The verifier's INDEPENDENT merkle convention (pathLeaf / hashBytes / rootFromFlat). In the bundle this is
+// the inlined verifier/lib/merkle.js, whose keccak256 is the inlined pure-JS vendored implementation — so the
+// whole sealer is zero-third-party. Out of the bundle (direct `node verifier/lib/seal-cli.js`) it resolves to
+// the same in-tree merkle lib, which uses js-sha3; either way the math is byte-identical.
+const merkle = __require("merkle");
+
+// Exit contract — the SAME as cli/evidence.js's EXIT: 0 ok / 1 IO / 2 usage / 3 gate-fail. The free-tier
+// >25-files boundary is a USAGE error (2): the invocation asked for a paid surface the free sealer cannot do.
+const EXIT = Object.freeze({ OK: 0, IO: 1, USAGE: 2, FAIL: 3 });
+
+// The free SAMPLE size, byte-identical to cli/evidence.js SAMPLE_LIMIT (25). Sealing MORE requires the paid
+// `evidence_unlimited` entitlement via the full `vh evidence seal` command — this free sealer hard-errors.
+const SAMPLE_LIMIT = 25;
+
+const SEAL_KIND = "vh.evidence-seal";
+const SEAL_SCHEMA_VERSION = 1;
+
+// The TRUST-BOUNDARIES one-liner — BYTE-IDENTICAL to cli/evidence.js EVIDENCE_TRUST_NOTE. The seal's `note`
+// field MUST equal this verbatim or the verifier's strict structural check (note must not drift) rejects the
+// packet. Stated once here so the standalone can never silently soften the caveat.
+const EVIDENCE_TRUST_NOTE =
+  "This evidence seal is TAMPER-EVIDENT + OFFLINE-RECOMPUTABLE, NOT a trusted timestamp. Its Merkle " +
+  "`root` commits to the full set of (relPath, content) pairs in the directory: any edit, rename, add, " +
+  "or remove changes the root, and verify RE-DERIVES the root from the bytes you hold and LOCALIZES the " +
+  "change to the exact file (MATCH / CHANGED / MISSING / UNEXPECTED). It does NOT prove WHEN the sealing " +
+  'happened ("sealed at T" rides the human-owned signing/timestamp trust-root, STRATEGY.md P-3) and it ' +
+  "is NOT a legal opinion. The packet is an UNTRUSTED transport container: verify never trusts the " +
+  "packet's own stored hashes.";
+
+// ---------------------------------------------------------------------------
+// FILESYSTEM WALK — recursively collect every regular file under dirAbs (skipping sockets/fifos/symlinks,
+// exactly as cli/hash.js#listFiles does — they have no stable content hash). Returns absolute paths.
+// ---------------------------------------------------------------------------
+function listFiles(dirAbs) {
+  const out = [];
+  const entries = fs.readdirSync(dirAbs, { withFileTypes: true });
+  for (const entry of entries) {
+    const full = path.join(dirAbs, entry.name);
+    if (entry.isDirectory()) {
+      out.push(...listFiles(full));
+    } else if (entry.isFile()) {
+      out.push(full);
+    }
+    // sockets/fifos/symlinks are intentionally skipped (no stable content hash) — same as cli/hash.js.
+  }
+  return out;
+}
+
+// Load a directory into a sorted [{ relPath, bytes }] list. relPath is POSIX-normalized + relative to dirAbs,
+// matching cli/evidence.js#loadDirEntries EXACTLY (split on path.sep, join "/"), so the standalone seal
+// travels with the directory identically to a producer-built one. Sorted by relPath for determinism.
+function loadDirEntries(dirAbs) {
+  const files = listFiles(dirAbs);
+  const entries = files.map((abs) => {
+    const rel = path.relative(dirAbs, abs).split(path.sep).join("/");
+    return { relPath: rel, bytes: fs.readFileSync(abs) };
+  });
+  entries.sort((a, b) => (a.relPath < b.relPath ? -1 : a.relPath > b.relPath ? 1 : 0));
+  return entries;
+}
+
+// ---------------------------------------------------------------------------
+// PURE SEAL BUILD — over the verifier's own merkle convention. Mirrors cli/core/packetseal.js#buildSeal +
+// cli/evidence.js#serializeSeal so the emitted bytes are byte-identical to the producer's. Throws a plain
+// Error (named in the message) on a structural problem (e.g. a duplicate relPath) — the CLI maps it to exit 3.
+// ---------------------------------------------------------------------------
+
+function buildSeal(entries) {
+  if (!Array.isArray(entries) || entries.length === 0) {
+    throw new Error("cannot build an evidence seal from zero files");
+  }
+  // Per-file (relPath, contentHash, leaf), de-duplicated on relPath (a duplicate is a hard error — every
+  // entry must occupy a distinct path, matching the producer core's invariant).
+  const seen = new Set();
+  const files = entries.map((e) => {
+    if (typeof e.relPath !== "string" || e.relPath.length === 0) {
+      throw new Error("evidence seal entry relPath must be a non-empty string");
+    }
+    if (seen.has(e.relPath)) {
+      throw new Error(`evidence seal has a duplicate relPath across the file set: ${JSON.stringify(e.relPath)}`);
+    }
+    seen.add(e.relPath);
+    const contentHash = merkle.hashBytes(e.bytes);
+    const leaf = merkle.pathLeaf(e.relPath, contentHash);
+    return { relPath: e.relPath, contentHash, leaf };
+  });
+  // Emit per-file leaves sorted by relPath so the seal bytes are deterministic regardless of input order
+  // (the producer core does the same), then re-derive the root over the SAME convention the verifier uses.
+  files.sort((a, b) => (a.relPath < b.relPath ? -1 : a.relPath > b.relPath ? 1 : 0));
+  const root = merkle.rootFromFlat(files.map((f) => ({ relPath: f.relPath, contentHash: f.contentHash })));
+  return {
+    kind: SEAL_KIND,
+    schemaVersion: SEAL_SCHEMA_VERSION,
+    note: EVIDENCE_TRUST_NOTE,
+    root,
+    fileCount: files.length,
+    files,
+  };
+}
+
+// Serialize a built seal to canonical, byte-deterministic bytes — BYTE-IDENTICAL to cli/evidence.js#
+// serializeSeal: an EXPLICIT key order, no insignificant whitespace, one trailing "\n". The producer builds
+// the same ordered object literal and JSON.stringify(...)+"\n"; reproducing that literal here yields the
+// identical bytes the verifier (and `sha256sum`) expect.
+function serializeSeal(seal) {
+  const canonical = {
+    kind: seal.kind,
+    schemaVersion: seal.schemaVersion,
+    note: seal.note,
+    root: seal.root,
+    fileCount: seal.fileCount,
+    files: seal.files.map((e) => ({
+      relPath: e.relPath,
+      contentHash: e.contentHash,
+      leaf: e.leaf,
+    })),
+  };
+  return JSON.stringify(canonical) + "\n";
+}
+
+// ---------------------------------------------------------------------------
+// CLI — `seal-vh-standalone.js <folder> [-o <out>] [--json]`.
+//   Walks <folder>, enforces the free-tier boundary, builds the UNSIGNED seal, and writes it to -o/--out
+//   (caller-named; NEVER cwd) or prints it. There is DELIBERATELY no --sign/--license/--key flag: signing is
+//   the paid surface. Exit: 0 ok / 1 IO / 2 usage (incl. the >25-files paid boundary) / 3 seal-build error.
+// ---------------------------------------------------------------------------
+
+function usage() {
+  return [
+    "seal-vh-standalone.js — FREE, zero-install evidence sealer (seal your own folder, hand it to anyone)",
+    "",
+    "Usage:",
+    "  node seal-vh-standalone.js <folder> [-o <out.vhevidence.json>] [--json]",
+    "",
+    "Walks <folder> and binds every file into ONE tamper-evident `vh.evidence-seal` you can hand to a",
+    "counterparty; they verify it with verify-vh-standalone.js — no clone, no `npm install`, on either side.",
+    "",
+    "FREE tier: an UNSIGNED seal of up to " + SAMPLE_LIMIT + " files. Sealing MORE files, or a SIGNED",
+    "attestation wrap, is the PAID surface (`evidence_unlimited` / `evidence_signed`) via `vh evidence seal`.",
+    "There is no --sign/--license/--key flag here: this file produces only the free, unsigned seal.",
+    "",
+    "Exit codes: 0 sealed / 1 IO error / 2 usage (incl. >" + SAMPLE_LIMIT + " files) / 3 seal-build error.",
+    "It is READ-ONLY apart from the -o file you name, opens NO network, and uses NO key.",
+    "",
+  ].join("\n");
+}
+
+function parseArgs(argv) {
+  const opts = { folder: undefined, out: undefined, json: false, _positionals: [] };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    const need = (flag) => {
+      const v = argv[++i];
+      if (v === undefined) {
+        const e = new Error(`${flag} requires a value`);
+        e.usage = true;
+        throw e;
+      }
+      return v;
+    };
+    switch (a) {
+      case "-o":
+      case "--out":
+        opts.out = need(a);
+        break;
+      case "--json":
+        opts.json = true;
+        break;
+      case "-h":
+      case "--help":
+        opts.help = true;
+        break;
+      default:
+        if (a && a.startsWith("-")) {
+          const e = new Error(`unknown flag: ${a}`);
+          e.usage = true;
+          throw e;
+        }
+        opts._positionals.push(a);
+    }
+  }
+  if (opts._positionals.length > 1) {
+    const e = new Error(
+      `unexpected extra argument: ${opts._positionals[1]} (seal takes exactly one <folder>)`
+    );
+    e.usage = true;
+    throw e;
+  }
+  opts.folder = opts._positionals[0];
+  return opts;
+}
+
+// Run the sealer with an injectable io ({ write, writeErr }) so it is unit-testable without spawning a
+// process. Returns the exit code. PURE except for the directory read + the single -o write.
+function run(argv, io = {}) {
+  const write = io.write || ((s) => process.stdout.write(s));
+  const writeErr = io.writeErr || ((s) => process.stderr.write(s));
+
+  let opts;
+  try {
+    opts = parseArgs(argv);
+  } catch (e) {
+    writeErr(`error: ${e.message}\n`);
+    return EXIT.USAGE;
+  }
+  if (opts.help) {
+    write(usage());
+    return EXIT.OK;
+  }
+  if (!opts.folder) {
+    writeErr("error: seal-vh-standalone requires a <folder> to seal\n\n");
+    writeErr(usage());
+    return EXIT.USAGE;
+  }
+
+  // Walk the folder (the only read I/O). A missing/unreadable folder or a non-directory is an IO error.
+  const dirAbs = path.resolve(opts.folder);
+  let stat;
+  try {
+    stat = fs.statSync(dirAbs);
+  } catch (e) {
+    writeErr(`error: cannot read folder ${opts.folder}: ${e.message}\n`);
+    return EXIT.IO;
+  }
+  if (!stat.isDirectory()) {
+    writeErr(`error: ${opts.folder} is not a directory\n`);
+    return EXIT.IO;
+  }
+  let entries;
+  try {
+    entries = loadDirEntries(dirAbs);
+  } catch (e) {
+    writeErr(`error: cannot read folder ${opts.folder}: ${e.message}\n`);
+    return EXIT.IO;
+  }
+  if (entries.length === 0) {
+    writeErr(`error: ${opts.folder} contains no files to seal\n`);
+    return EXIT.FAIL;
+  }
+
+  // FREE-TIER BOUNDARY — hard-error (exit 2) on more than SAMPLE_LIMIT files, naming the paid entitlement +
+  // the full command that unlocks it. The free sealer NEVER silently truncates or downgrades.
+  if (entries.length > SAMPLE_LIMIT) {
+    writeErr(
+      `error: this folder has ${entries.length} files, but the FREE sealer seals at most ${SAMPLE_LIMIT}.\n` +
+        `Sealing more than ${SAMPLE_LIMIT} files is the PAID "evidence_unlimited" entitlement — use the full ` +
+        "command:\n" +
+        "  vh evidence seal <folder> --license <file> --vendor <0xaddr>\n" +
+        "(The free, zero-install sealer is strictly try-before-you-buy: up to " +
+        SAMPLE_LIMIT +
+        " files, unsigned.)\n"
+    );
+    return EXIT.USAGE;
+  }
+
+  // Build the UNSIGNED seal. A structural problem (e.g. a duplicate relPath) is a seal-build error (3).
+  let seal;
+  try {
+    seal = buildSeal(entries);
+  } catch (e) {
+    writeErr(`error: cannot build evidence seal: ${e.message}\n`);
+    return EXIT.FAIL;
+  }
+  const artifactStr = serializeSeal(seal);
+
+  // Write to -o/--out (caller-chosen path; NEVER cwd) or print to stdout (writes nothing to disk).
+  let outAbs = null;
+  if (opts.out) {
+    outAbs = path.resolve(opts.out);
+    try {
+      fs.writeFileSync(outAbs, artifactStr);
+    } catch (e) {
+      writeErr(`error: cannot write -o file ${opts.out}: ${e.message}\n`);
+      return EXIT.IO;
+    }
+  }
+
+  if (opts.json) {
+    write(
+      JSON.stringify(
+        {
+          ok: true,
+          note: EVIDENCE_TRUST_NOTE,
+          kind: SEAL_KIND,
+          root: seal.root,
+          fileCount: seal.fileCount,
+          signed: false,
+          out: outAbs,
+          // With no -o the artifact rides in `artifact` so --json never drops it (parity with the producer).
+          artifact: outAbs ? null : artifactStr,
+        },
+        null,
+        2
+      ) + "\n"
+    );
+  } else {
+    write(EVIDENCE_TRUST_NOTE + "\n\n");
+    write(
+      `sealed ${seal.fileCount} file${seal.fileCount === 1 ? "" : "s"} into an evidence packet — root ${seal.root}\n`
+    );
+    if (outAbs) {
+      write(`  written:      ${outAbs}\n`);
+      write(`  verify it:    node verify-vh-standalone.js ${path.basename(outAbs)} --dir <folder>\n`);
+    } else {
+      write(artifactStr);
+    }
+  }
+  return EXIT.OK;
+}
+
+module.exports = {
+  EXIT,
+  SAMPLE_LIMIT,
+  SEAL_KIND,
+  SEAL_SCHEMA_VERSION,
+  EVIDENCE_TRUST_NOTE,
+  listFiles,
+  loadDirEntries,
+  buildSeal,
+  serializeSeal,
+  parseArgs,
+  usage,
+  run,
+};
+
+// CLI shim when this file is run directly (out of the bundle). Inside the bundle the boot wrapper drives run().
+if (require.main === module) {
+  process.exit(run(process.argv.slice(2)));
+}
+
+};
+
+// ---- embedded build-provenance (this file's own): see `--provenance` / `--self-attest` below. ----
+var __SELF_SHA256_SENTINEL = "0000000000000000000000000000000000000000000000000000000000000000";
+var __PROVENANCE = {
+  "schema": "verifyhash/build-provenance@1",
+  "target": "seal",
+  "note": "This bundle's OWN provenance, embedded so the single file is self-describing. Run `node seal-vh-standalone.js --self-attest` to recompute selfSha256 from these very bytes, or `--provenance` to print the ordered source modules + hashes it was built from. Cross-check against verifier/dist/BUILD-PROVENANCE.json (the same data) with: node verifier/build-standalone.js --check",
+  "selfSha256": "f1777ad496b73f6b94379b4eda13b9949862b0d56bdac938de3b27d1323011b4",
+  "modules": [
+    {
+      "id": "keccak256-vendored",
+      "synthetic": false,
+      "sourceFile": "verifier/lib/keccak256-vendored.js",
+      "sourceSha256": "4f5f2dda618a5889ab5b3f8498dc64ddeacdd22b57349d97824f60960ee334a1",
+      "inlinedSha256": "4f5f2dda618a5889ab5b3f8498dc64ddeacdd22b57349d97824f60960ee334a1",
+      "entry": false
+    },
+    {
+      "id": "keccak",
+      "synthetic": true,
+      "sourceFile": null,
+      "sourceSha256": null,
+      "inlinedSha256": "7ead489c805c4e62e8338dbcfde77a85ca52076e2a3639e2ba57ce3b2415828e",
+      "note": "swapped body (keccak provider shim) — defined in build-standalone.js, not a source file"
+    },
+    {
+      "id": "merkle",
+      "synthetic": false,
+      "sourceFile": "verifier/lib/merkle.js",
+      "sourceSha256": "1bea7bab4b479962225279f4590c5524fad5295c7c70cf01d4978dbf9f37f34b",
+      "inlinedSha256": "e65be5614998f9a00ca9b58a6c79b05abe7f70ed2e0dad61ece07a41ee5da876",
+      "entry": false
+    },
+    {
+      "id": "seal-cli",
+      "synthetic": false,
+      "sourceFile": "verifier/lib/seal-cli.js",
+      "sourceSha256": "7a68adacb21ace3c3a77a3bc9bc27ec8a4732c77df3e8d6a6c5864d44a7a13bc",
+      "inlinedSha256": "8ba0e03a6a9bcaa5ee400d045fc13c4eb7e99b2d7f4effb307135e7b02d8804d",
+      "entry": true
+    }
+  ]
+};
+function __maybeProvenance(argv) {
+  var wantProv = argv.indexOf('--provenance') !== -1;
+  var wantAttest = argv.indexOf('--self-attest') !== -1;
+  if (!wantProv && !wantAttest) return null;
+  if (wantProv) { process.stdout.write(JSON.stringify(__PROVENANCE, null, 2) + '\n'); }
+  if (wantAttest) {
+    var fs = require('fs');
+    var crypto = require('crypto');
+    var selfText;
+    try { selfText = fs.readFileSync(__filename, 'utf8'); }
+    catch (e) { process.stderr.write('self-attest: cannot read this file: ' + e.message + '\n'); return 1; }
+    // Re-blank our own selfSha256 line back to the sentinel, then hash — reproducing the build's pass-1 hash.
+    var blanked = selfText.replace(
+      '"selfSha256": "' + __PROVENANCE.selfSha256 + '"',
+      '"selfSha256": "' + __SELF_SHA256_SENTINEL + '"'
+    );
+    var got = crypto.createHash('sha256').update(Buffer.from(blanked, 'utf8')).digest('hex');
+    if (got === __PROVENANCE.selfSha256) {
+      process.stdout.write('[MATCH] self-attest: this file is intact (selfSha256 ' + got + ').\n');
+      return 0;
+    }
+    process.stderr.write('[MISMATCH] self-attest: this file has been MODIFIED ' +
+      '(embedded selfSha256 ' + __PROVENANCE.selfSha256 + ' != recomputed ' + got + ').\n');
+    return 1;
+  }
+  return 0;
+}
+
+// ---- boot: run the inlined sealer CLI with this process's argv. ----
+var __entry = __require("seal-cli");
+if (require.main === module) {
+  var __code = __maybeProvenance(process.argv.slice(2));
+  if (__code !== null) process.exit(__code);
+  process.exit(__entry.run(process.argv.slice(2)));
+}
+module.exports = __entry;