@cygnuxlabs/tracekit 0.0.0-stage → 1.2.2

package/dist/verify/jcs.d.ts

@@ -0,0 +1,19 @@
+/**
+ * JCS (RFC 8785) and the strict parser of docs/format-v2.md §1, byte for byte (tests/vectors/jcs.jsonl).
+ * Strict: bytes that are not UTF-8, duplicate keys, NaN/±Infinity (and overflow such as 1e400), lone surrogates and
+ * integer tokens (no `.` or exponent) outside ±(2^53-1) are refused, and so are arrays and objects nested deeper than
+ * MAX_DEPTH. No node: imports: browsers load this too.
+ */
+/** `code` is one of: invalid_utf8, syntax, duplicate_key, non_finite, int_range, lone_surrogate, depth. */
+export declare class StrictJSONError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+export declare const MAX_DEPTH = 128;
+/** Where number tokens with a fraction or exponent sit (container -> keys): JSON Schema's "integer" excludes them. */
+export type Floats = WeakMap<object, Set<string | number>>;
+export declare function strictParse(text: string, floats?: Floats): unknown;
+/** JCS text of a JSON value; StrictJSONError for anything JCS can't encode. */
+export declare function canonicalize(v: unknown): string;
+/** strictParse of UTF-8 bytes (a byte order mark is not whitespace). */
+export declare function strictParseBytes(data: Uint8Array, floats?: Floats): unknown;

package/dist/verify/jcs.js

@@ -0,0 +1,154 @@
+/**
+ * JCS (RFC 8785) and the strict parser of docs/format-v2.md §1, byte for byte (tests/vectors/jcs.jsonl).
+ * Strict: bytes that are not UTF-8, duplicate keys, NaN/±Infinity (and overflow such as 1e400), lone surrogates and
+ * integer tokens (no `.` or exponent) outside ±(2^53-1) are refused, and so are arrays and objects nested deeper than
+ * MAX_DEPTH. No node: imports: browsers load this too.
+ */
+/** `code` is one of: invalid_utf8, syntax, duplicate_key, non_finite, int_range, lone_surrogate, depth. */
+export class StrictJSONError extends Error {
+    code;
+    constructor(code, message) {
+        super(`${code}: ${message}`);
+        this.code = code;
+    }
+}
+const WS = /[ \t\n\r]*/y;
+const ESC = /\\(?:["\\/bfnrt]|u[0-9a-fA-F]{4})/y;
+const NUM = /-?(?:0|[1-9]\d*)(\.\d+)?([eE][+-]?\d+)?/y;
+export const MAX_DEPTH = 128;
+const LONE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+export function strictParse(text, floats) {
+    let i = 0;
+    let float = false; // the last value read was a number token with a fraction or exponent
+    const mark = (o, k) => {
+        if (!float || !floats)
+            return;
+        if (!floats.has(o))
+            floats.set(o, new Set());
+        floats.get(o).add(k);
+    };
+    const fail = (code, msg) => { throw new StrictJSONError(code, msg); };
+    const match = (re) => {
+        re.lastIndex = i;
+        const m = re.exec(text);
+        if (m)
+            i = re.lastIndex;
+        return m;
+    };
+    const str = () => {
+        const start = i;
+        if (text[i++] !== '"')
+            fail("syntax", `string expected at ${start}`);
+        for (let c; (c = text.charCodeAt(i)) !== 0x22;) {
+            if (c === 0x5c)
+                match(ESC) ?? fail("syntax", `bad escape at ${i}`);
+            else if (c < 0x20 || Number.isNaN(c))
+                fail("syntax", `unterminated string at ${start}`);
+            else
+                i++;
+        }
+        const raw = text.slice(start, ++i), s = JSON.parse(raw);
+        if (LONE.test(s))
+            fail("lone_surrogate", raw.slice(0, 80));
+        return s;
+    };
+    const expect = (c) => {
+        match(WS);
+        if (text[i++] !== c)
+            fail("syntax", `${c} expected at ${i - 1}`);
+    };
+    const value = (depth) => {
+        float = false;
+        match(WS);
+        const c = text[i];
+        if ((c === "{" || c === "[") && depth === MAX_DEPTH)
+            fail("depth", `nesting deeper than ${MAX_DEPTH} at ${i}`);
+        if (c === "{") {
+            i++;
+            const o = {};
+            match(WS);
+            if (text[i] === "}")
+                return i++, o;
+            do {
+                match(WS);
+                const k = str();
+                if (Object.hasOwn(o, k))
+                    fail("duplicate_key", JSON.stringify(k));
+                expect(":");
+                Object.defineProperty(o, k, { value: value(depth + 1), enumerable: true, writable: true, configurable: true }); // "__proto__" too
+                mark(o, k);
+                match(WS);
+            } while (text[i] === "," && ++i);
+            expect("}");
+            float = false;
+            return o;
+        }
+        if (c === "[") {
+            i++;
+            const a = [];
+            match(WS);
+            if (text[i] === "]")
+                return i++, a;
+            do
+                a.push(value(depth + 1)), mark(a, a.length - 1);
+            while ((match(WS), text[i] === ",") && ++i);
+            expect("]");
+            float = false;
+            return a;
+        }
+        if (c === '"')
+            return str();
+        for (const [lit, v] of [["true", true], ["false", false], ["null", null]])
+            if (text.startsWith(lit, i))
+                return (i += lit.length), v;
+        for (const lit of ["NaN", "Infinity", "-Infinity"])
+            if (text.startsWith(lit, i))
+                fail("non_finite", lit);
+        const m = match(NUM) ?? fail("syntax", `value expected at ${i}`);
+        const n = Number(m[0]);
+        if (!Number.isFinite(n))
+            fail("non_finite", m[0]);
+        if (!m[1] && !m[2] && !Number.isSafeInteger(n))
+            fail("int_range", m[0]);
+        float = !!(m[1] || m[2]);
+        return n;
+    };
+    const v = value(0);
+    match(WS);
+    if (i < text.length)
+        fail("syntax", `extra data at ${i}`);
+    return v;
+}
+/** JCS text of a JSON value; StrictJSONError for anything JCS can't encode. */
+export function canonicalize(v) {
+    if (typeof v === "string") {
+        if (LONE.test(v))
+            throw new StrictJSONError("lone_surrogate", JSON.stringify(v));
+        return JSON.stringify(v);
+    }
+    if (typeof v === "number") {
+        if (!Number.isFinite(v))
+            throw new StrictJSONError("non_finite", String(v));
+        return JSON.stringify(v); // ECMAScript Number::toString, -0 as 0: what JCS specifies
+    }
+    if (v === null || typeof v === "boolean")
+        return String(v);
+    if (Array.isArray(v))
+        return `[${v.map(canonicalize).join(",")}]`;
+    if (typeof v === "object") {
+        const o = v;
+        return `{${Object.keys(o).sort().map((k) => `${canonicalize(k)}:${canonicalize(o[k])}`).join(",")}}`; // UTF-16 order
+    }
+    throw new StrictJSONError("syntax", `${typeof v} is not JSON`);
+}
+/** strictParse of UTF-8 bytes (a byte order mark is not whitespace). */
+export function strictParseBytes(data, floats) {
+    let text;
+    try {
+        text = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(data);
+    }
+    catch {
+        throw new StrictJSONError("invalid_utf8", "not UTF-8");
+    }
+    return strictParse(text, floats);
+}

package/dist/verify/primitives.d.ts

@@ -0,0 +1,62 @@
+export declare const bytes: (s: string) => Uint8Array<ArrayBuffer>;
+export declare const concat: (...parts: Uint8Array[]) => Uint8Array<ArrayBuffer>;
+export declare const equal: (a: Uint8Array, b: Uint8Array) => boolean;
+export declare const hex: (b: Uint8Array) => string;
+export declare function unhex(s: string): Uint8Array;
+export declare function sha256(...parts: Uint8Array[]): Promise<Uint8Array>;
+export declare const sha256hex: (data: Uint8Array) => Promise<string>;
+export declare function b64encode(data: Uint8Array): string;
+/** Standard base64: only the alphabet, then at most two `=`, padded to whole quads (padding after a whole quad is
+ * tolerated); bits past the last byte are ignored. */
+export declare function b64decode(s: unknown): Uint8Array;
+/** Canonical base64 only (checkpoint notes and vkeys). */
+export declare function unb64(s: string): Uint8Array;
+export declare function ed25519Verify(pub: Uint8Array, msg: Uint8Array, sig: Uint8Array): Promise<boolean>;
+/** The algorithm of a DER SubjectPublicKeyInfo, or null when it is not one this format defines. */
+export declare const keyAlg: (spki: Uint8Array) => "ed25519" | null;
+export declare const spkiKid: (spki: Uint8Array) => Promise<string>;
+export declare const spkiOf: (pub: Uint8Array) => Uint8Array<ArrayBuffer>;
+/** §4: false unless `alg` is the key's own algorithm and the signature holds under its v2 rules. */
+export declare const verifyV2: (alg: string, spki: Uint8Array, msg: Uint8Array, sig: Uint8Array) => Promise<boolean>;
+export declare const leafHash: (data: Uint8Array) => Promise<Uint8Array<ArrayBufferLike>>;
+/** RFC 9162 §2.1.3.2. */
+export declare function verifyInclusion(index: number, size: number, leaf: Uint8Array, proof: Uint8Array[], root: Uint8Array | undefined): Promise<boolean>;
+/** RFC 9162 §2.1.4.2. */
+export declare function verifyConsistency(first: number, second: number, firstRoot: Uint8Array, secondRoot: Uint8Array, proof: Uint8Array[]): Promise<boolean>;
+export declare const ED25519 = 1, COSIGNATURE = 4, HYBRID = 255;
+export declare const SLH_DSA: Uint8Array<ArrayBuffer>;
+export declare class NoteError extends Error {
+}
+export declare const keyId: (name: string, type: number, pub: Uint8Array) => Promise<Uint8Array<ArrayBufferLike>>;
+export declare function vkey(name: string, type: number, pub: Uint8Array): Promise<string>;
+export type VKey = {
+    name: string;
+    id: Uint8Array;
+    type: number;
+    pub: Uint8Array;
+};
+/** (name, key id, type, public key) of a vkey `name+hex id+base64(type ‖ key)`. */
+export declare function parseVkey(text: string): Promise<VKey>;
+export type Note = {
+    origin: string;
+    size: number;
+    root: Uint8Array;
+    cosigs: [string, bigint][];
+    unchecked: boolean;
+};
+/**
+ * Open a checkpoint note with pinned vkeys: a pinned Ed25519 log key named after the origin must sign it, and each
+ * pinned hybrid key of the origin must have a line. Web Crypto has no SLH-DSA, so a hybrid line is left `unchecked`.
+ */
+export declare function openNote(data: Uint8Array, logKeys: string[], witnessKeys: string[]): Promise<Note>;
+export declare const LEAF_TYPES: string[];
+export declare const SIGNER_LEAVES: string[];
+export declare const registryOrigin: (logOrigin: string, tsalt: Uint8Array) => Promise<string>;
+export declare const runHash: (tsalt: Uint8Array, runId: string) => Promise<Uint8Array<ArrayBufferLike>>;
+export declare function parseLeaf(data: Uint8Array): {
+    type: string;
+    runHash: Uint8Array<ArrayBufferLike>;
+    logId: string;
+    seq: number;
+    hash: string;
+};

package/dist/verify/primitives.js

@@ -0,0 +1,298 @@
+/**
+ * Hashes, base64, strict Ed25519 (docs/format-v2.md §4), RFC 9162 proofs (§5), C2SP checkpoint notes (§6) and registry
+ * leaves (§7), on Web Crypto only.
+ */
+const subtle = globalThis.crypto.subtle;
+const utf8 = new TextEncoder();
+export const bytes = (s) => utf8.encode(s);
+export const concat = (...parts) => {
+    const out = new Uint8Array(parts.reduce((n, p) => n + p.length, 0));
+    let at = 0;
+    for (const p of parts)
+        out.set(p, (at += p.length) - p.length);
+    return out;
+};
+export const equal = (a, b) => a.length === b.length && a.every((x, i) => x === b[i]);
+export const hex = (b) => Array.from(b, (x) => x.toString(16).padStart(2, "0")).join("");
+export function unhex(s) {
+    if (!/^(?:[0-9a-fA-F]{2})*$/.test(s))
+        throw new Error(`not hex: ${s.slice(0, 80)}`);
+    return Uint8Array.from(s.match(/../g) ?? [], (x) => parseInt(x, 16));
+}
+export async function sha256(...parts) {
+    return new Uint8Array(await subtle.digest("SHA-256", concat(...parts)));
+}
+export const sha256hex = async (data) => hex(await sha256(data));
+const B64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+export function b64encode(data) {
+    let s = "";
+    for (let i = 0; i < data.length; i += 3) {
+        const n = (data[i] << 16) | ((data[i + 1] ?? 0) << 8) | (data[i + 2] ?? 0);
+        s += B64[n >> 18] + B64[(n >> 12) & 63] + (i + 1 < data.length ? B64[(n >> 6) & 63] : "=")
+            + (i + 2 < data.length ? B64[n & 63] : "=");
+    }
+    return s;
+}
+/** Standard base64: only the alphabet, then at most two `=`, padded to whole quads (padding after a whole quad is
+ * tolerated); bits past the last byte are ignored. */
+export function b64decode(s) {
+    const m = typeof s === "string" ? /^([A-Za-z0-9+/]*)(={0,2})$/.exec(s) : null;
+    const r = m ? m[1].length % 4 : 1;
+    if (!m || r === 1 || (r && m[1].length % 4 + m[2].length < 4))
+        throw new Error("bad base64");
+    const out = [];
+    let acc = 0, bits = 0;
+    for (const c of m[1]) {
+        acc = (acc << 6) | B64.indexOf(c);
+        if ((bits += 6) >= 8)
+            out.push((acc >> (bits -= 8)) & 255);
+    }
+    return Uint8Array.from(out);
+}
+/** Canonical base64 only (checkpoint notes and vkeys). */
+export function unb64(s) {
+    const raw = b64decode(s);
+    if (b64encode(raw) !== s)
+        throw new Error("non-canonical base64");
+    return raw;
+}
+// Ed25519: S < L, a canonical public key (y < p) that is not of small order, then Web Crypto's cofactorless check
+const L = (1n << 252n) + 27742317777372353535851937790883648493n;
+const P = (1n << 255n) - 19n;
+const SMALL_ORDER = new Set([
+    "0100000000000000000000000000000000000000000000000000000000000000",
+    "ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f",
+    "0000000000000000000000000000000000000000000000000000000000000000",
+    "0000000000000000000000000000000000000000000000000000000000000080",
+    "26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05",
+    "26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc85",
+    "c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a",
+    "c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac03fa",
+]);
+const le = (b) => b.reduceRight((n, x) => (n << 8n) | BigInt(x), 0n);
+export async function ed25519Verify(pub, msg, sig) {
+    if (pub.length !== 32 || sig.length !== 64 || le(sig.subarray(32)) >= L)
+        return false;
+    const y = le(pub) & ((1n << 255n) - 1n);
+    // x = 0 with the sign bit set is no encoding at all; y = ±1 are the small-order points with x = 0
+    if (y >= P || SMALL_ORDER.has(hex(pub)) || (pub[31] & 0x80 && (y === 1n || y === P - 1n)))
+        return false;
+    try {
+        const key = await subtle.importKey("raw", pub, { name: "Ed25519" }, false, ["verify"]);
+        return await subtle.verify({ name: "Ed25519" }, key, sig, msg);
+    }
+    catch {
+        return false; // not a point on the curve
+    }
+}
+const ED25519_SPKI = unhex("302a300506032b6570032100");
+/** The algorithm of a DER SubjectPublicKeyInfo, or null when it is not one this format defines. */
+export const keyAlg = (spki) => spki.length === 44 && equal(spki.subarray(0, 12), ED25519_SPKI) ? "ed25519" : null;
+export const spkiKid = async (spki) => "sha256:" + await sha256hex(spki);
+export const spkiOf = (pub) => concat(ED25519_SPKI, pub);
+/** §4: false unless `alg` is the key's own algorithm and the signature holds under its v2 rules. */
+export const verifyV2 = async (alg, spki, msg, sig) => keyAlg(spki) === alg && ed25519Verify(spki.subarray(12), msg, sig);
+// RFC 9162 Merkle trees; sizes are below 2^53, so halving is exact in a Number
+export const leafHash = (data) => sha256(Uint8Array.of(0), data);
+const nodeHash = (l, r) => sha256(Uint8Array.of(1), l, r);
+const odd = (n) => n % 2 === 1;
+const half = (n) => Math.floor(n / 2);
+/** RFC 9162 §2.1.3.2. */
+export async function verifyInclusion(index, size, leaf, proof, root) {
+    if (!(index >= 0 && index < size) || !root)
+        return false;
+    let fn = index, sn = size - 1, r = leaf;
+    for (const p of proof) {
+        if (sn === 0)
+            return false;
+        if (odd(fn) || fn === sn) {
+            r = await nodeHash(p, r);
+            if (!odd(fn))
+                while (fn && !odd(fn))
+                    fn = half(fn), sn = half(sn);
+        }
+        else
+            r = await nodeHash(r, p);
+        fn = half(fn);
+        sn = half(sn);
+    }
+    return sn === 0 && equal(r, root);
+}
+/** RFC 9162 §2.1.4.2. */
+export async function verifyConsistency(first, second, firstRoot, secondRoot, proof) {
+    if (first === 0 || first > second)
+        return false;
+    if (first === second)
+        return !proof.length && equal(firstRoot, secondRoot);
+    let pow = first;
+    while (!odd(pow))
+        pow = half(pow);
+    const path = pow === 1 ? [firstRoot, ...proof] : proof; // a power of two: its root is the first proof node
+    if (!path.length)
+        return false;
+    let fn = first - 1, sn = second - 1;
+    while (odd(fn))
+        fn = half(fn), sn = half(sn);
+    let fr = path[0], sr = path[0];
+    for (const c of path.slice(1)) {
+        if (sn === 0)
+            return false;
+        if (odd(fn) || fn === sn) {
+            fr = await nodeHash(c, fr);
+            sr = await nodeHash(c, sr);
+            if (!odd(fn))
+                while (fn && !odd(fn))
+                    fn = half(fn), sn = half(sn);
+        }
+        else
+            sr = await nodeHash(sr, c);
+        fn = half(fn);
+        sn = half(sn);
+    }
+    return sn === 0 && equal(fr, firstRoot) && equal(sr, secondRoot);
+}
+// C2SP signed notes: tlog-checkpoint, the log's type 0x01 line, witnesses' type 0x04 cosignatures, the hybrid 0xff line
+export const ED25519 = 0x01, COSIGNATURE = 0x04, HYBRID = 0xff;
+export const SLH_DSA = bytes("tracekit/slh-dsa-sha2-128s");
+const MAX_NOTE = 1 << 20;
+const DASH = "— ";
+// Unicode whitespace as str.isspace sees it, besides the control characters a name can't hold anyway
+const SPACE = /[\x1c-\x20\x85\xa0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000]/;
+export class NoteError extends Error {
+}
+function checkName(name) {
+    if (!name || name.includes("+") || bytes(name).length > 255 || SPACE.test(name) || /[\x00-\x1f]/.test(name))
+        throw new NoteError(`bad key name ${JSON.stringify(name.slice(0, 64))}`);
+}
+export const keyId = async (name, type, pub) => (await sha256(bytes(name), Uint8Array.of(0x0a, type), pub)).subarray(0, 4);
+export async function vkey(name, type, pub) {
+    checkName(name);
+    return `${name}+${hex(await keyId(name, type, pub))}+${b64encode(concat(Uint8Array.of(type), pub))}`;
+}
+/** (name, key id, type, public key) of a vkey `name+hex id+base64(type ‖ key)`. */
+export async function parseVkey(text) {
+    const i = text.indexOf("+"), j = text.indexOf("+", i + 1);
+    if (i < 0 || j < 0)
+        throw new NoteError("a vkey is name+id+key");
+    const name = text.slice(0, i), hid = text.slice(i + 1, j);
+    checkName(name);
+    let raw;
+    try {
+        raw = unb64(text.slice(j + 1));
+    }
+    catch (e) {
+        throw new NoteError(e.message);
+    }
+    if (!(raw.length === 33 && (raw[0] === ED25519 || raw[0] === COSIGNATURE)
+        || raw.length === 1 + SLH_DSA.length + 32 && raw[0] === HYBRID && equal(raw.subarray(1, 1 + SLH_DSA.length), SLH_DSA)))
+        throw new NoteError("not an Ed25519 log, cosignature or SLH-DSA log vkey");
+    const id = await keyId(name, raw[0], raw.subarray(1));
+    if (hid !== hex(id))
+        throw new NoteError("vkey id does not match the key");
+    return { name, id, type: raw[0], pub: raw.subarray(1) };
+}
+/**
+ * Open a checkpoint note with pinned vkeys: a pinned Ed25519 log key named after the origin must sign it, and each
+ * pinned hybrid key of the origin must have a line. Web Crypto has no SLH-DSA, so a hybrid line is left `unchecked`.
+ */
+export async function openNote(data, logKeys, witnessKeys) {
+    if (data.length > MAX_NOTE)
+        throw new NoteError("note too large");
+    let note;
+    try {
+        note = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(data);
+    }
+    catch {
+        throw new NoteError("note is not UTF-8");
+    }
+    if (!note.endsWith("\n") || /[\x00-\x09\x0b-\x1f]/.test(note))
+        throw new NoteError("malformed note");
+    const i = note.indexOf("\n\n");
+    if (i < 0)
+        throw new NoteError("no signature block");
+    const text = note.slice(0, i + 1), lines = note.slice(i + 2, -1).split("\n");
+    if (lines.length > 64)
+        throw new NoteError("too many signatures");
+    const head = text.slice(0, -1).split("\n");
+    if (head.length !== 3)
+        throw new NoteError("a checkpoint is origin, size and root");
+    const [origin, size] = head;
+    checkName(origin);
+    if (!/^(0|[1-9][0-9]{0,19})$/.test(size))
+        throw new NoteError("bad tree size");
+    let root;
+    try {
+        root = unb64(head[2]);
+    }
+    catch (e) {
+        throw new NoteError(e.message);
+    }
+    if (root.length !== 32)
+        throw new NoteError("bad root hash");
+    const pinned = new Map();
+    for (const [keys, want] of [[logKeys, [ED25519, HYBRID]], [witnessKeys, [COSIGNATURE]]])
+        for (const k of keys) {
+            const p = await parseVkey(k);
+            if (!want.includes(p.type))
+                throw new NoteError(`pinned key ${p.name} has the wrong signature type`);
+            pinned.set(`${p.name}\n${hex(p.id)}`, [k, p]);
+        }
+    const hybrids = new Set([...pinned].filter(([, [, p]]) => p.type === HYBRID && p.name === origin).map(([id]) => id));
+    const seen = new Set(), cosigs = [], msg = bytes(text);
+    let logged = false, unchecked = false;
+    for (const line of lines) {
+        const parts = line.startsWith(DASH) ? line.slice(DASH.length).split(" ") : [];
+        if (parts.length !== 2)
+            throw new NoteError("malformed signature line");
+        const [name, blob] = parts;
+        checkName(name);
+        let raw;
+        try {
+            raw = unb64(blob);
+        }
+        catch (e) {
+            throw new NoteError(e.message);
+        }
+        if (raw.length < 5)
+            throw new NoteError("short signature");
+        const id = `${name}\n${hex(raw.subarray(0, 4))}`;
+        if (seen.has(id))
+            throw new NoteError("two signatures from one key");
+        seen.add(id);
+        const key = pinned.get(id);
+        if (!key)
+            continue;
+        const [k, p] = key, sig = raw.subarray(4);
+        if (p.type === ED25519) {
+            if (!await verifyV2("ed25519", spkiOf(p.pub), msg, sig))
+                throw new NoteError(`bad signature from pinned key ${name}`);
+            logged ||= name === origin;
+        }
+        else if (p.type === HYBRID) {
+            unchecked = true;
+            hybrids.delete(id);
+        }
+        else {
+            const ts = sig.length === 72 ? new DataView(sig.buffer, sig.byteOffset).getBigUint64(0) : null;
+            if (ts === null || !await verifyV2("ed25519", spkiOf(p.pub), bytes(`cosignature/v1\ntime ${ts}\n${text}`), sig.subarray(8)))
+                throw new NoteError(`bad cosignature from pinned witness ${name}`);
+            cosigs.push([k, ts]);
+        }
+    }
+    if (!logged)
+        throw new NoteError(`no signature from a pinned log key for origin ${origin}`);
+    if (hybrids.size)
+        throw new NoteError(`no SLH-DSA signature from the pinned hybrid key for origin ${origin}`);
+    return { origin, size: Number(size), root, cosigs, unchecked };
+}
+// registry leaves: type u8 ‖ H(tenant_salt ‖ run_id) 32B ‖ record log_id 16B ‖ seq u64 ‖ record hash 32B
+export const LEAF_TYPES = ["run.registered", "run.final", "log.closed", "key.retire", "capture.gap", "trace.tamper"];
+export const SIGNER_LEAVES = ["log.closed", "key.retire", "capture.gap", "trace.tamper"];
+export const registryOrigin = async (logOrigin, tsalt) => `${logOrigin}/registry/${(await sha256hex(concat(bytes("registry "), tsalt))).slice(0, 32)}`;
+export const runHash = (tsalt, runId) => sha256(tsalt, bytes(runId));
+export function parseLeaf(data) {
+    if (data.length !== 89 || !(data[0] >= 1 && data[0] <= LEAF_TYPES.length))
+        throw new Error("not a registry leaf");
+    return { type: LEAF_TYPES[data[0] - 1], runHash: data.subarray(1, 33), logId: hex(data.subarray(33, 49)),
+        seq: Number(new DataView(data.buffer, data.byteOffset).getBigUint64(49)), hash: "sha256:" + hex(data.subarray(57)) };
+}

package/dist/verify/schema.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The JSON Schema 2020-12 subset tracekit.event.v2.json uses (docs/format-v2.md §3): type, const, enum, required,
+ * properties, additionalProperties, items, oneOf, allOf, if/then, $ref to #/$defs, pattern (full match, ASCII),
+ * minimum, maximum, minLength, maxLength (code points), minItems, maxItems. "integer" excludes number tokens written with a
+ * fraction or exponent. Any other keyword throws, so the schema can't silently lose a check.
+ */
+import type { Floats } from "./jcs.js";
+/** JSON equality with numbers and booleans compared as numbers, as the reference's Python does. */
+export declare function same(a: unknown, b: unknown): boolean;
+/** Error strings of a tracekit.event.v2 event (empty when valid); `floats` from strictParse. */
+export declare function validateEvent(event: unknown, floats: Floats): string[];

package/dist/verify/schema.js

@@ -0,0 +1,98 @@
+import SCHEMA from "./tracekit.event.v2.json" with { type: "json" };
+const KEYWORDS = new Set(["type", "const", "enum", "required", "properties", "additionalProperties", "items", "oneOf",
+    "allOf", "if", "then", "$ref", "pattern", "minimum", "maximum", "minLength", "maxLength", "minItems", "maxItems", "$schema", "$id",
+    "$defs", "title", "description"]);
+const isObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+const isNumber = (v) => typeof v === "number";
+const PATTERNS = new Map();
+/** JSON equality with numbers and booleans compared as numbers, as the reference's Python does. */
+export function same(a, b) {
+    if ((isNumber(a) || typeof a === "boolean") && (isNumber(b) || typeof b === "boolean"))
+        return Number(a) === Number(b);
+    if (Array.isArray(a) && Array.isArray(b))
+        return a.length === b.length && a.every((x, i) => same(x, b[i]));
+    if (isObject(a) && isObject(b)) {
+        const k = Object.keys(a);
+        return k.length === Object.keys(b).length && k.every((x) => Object.hasOwn(b, x) && same(a[x], b[x]));
+    }
+    return a === b;
+}
+function check(v, s, path, errs, float, floats) {
+    const unknown = Object.keys(s).filter((k) => !KEYWORDS.has(k));
+    if (unknown.length)
+        throw new Error(`unknown schema keyword(s) ${unknown} at ${path}`);
+    if ("$ref" in s)
+        return check(v, SCHEMA.$defs[s.$ref.slice("#/$defs/".length)], path, errs, float, floats);
+    if ("type" in s) {
+        const ts = Array.isArray(s.type) ? s.type : [s.type];
+        const is = (t) => t === "integer" ? isNumber(v) && Number.isInteger(v) && !float : t === "number" ? isNumber(v)
+            : t === "object" ? isObject(v) : t === "array" ? Array.isArray(v) : t === "null" ? v === null : typeof v === t;
+        if (!ts.some(is))
+            return errs.push(`${path}: expected ${ts.join("/")}`);
+    }
+    if ("const" in s && !same(v, s.const))
+        errs.push(`${path}: must be ${JSON.stringify(s.const)}`);
+    if ("enum" in s && !s.enum.some((x) => same(v, x)))
+        errs.push(`${path}: ${JSON.stringify(v)} not in ${JSON.stringify(s.enum)}`);
+    if (typeof v === "string") {
+        if ("pattern" in s) {
+            if (!PATTERNS.has(s.pattern))
+                PATTERNS.set(s.pattern, new RegExp(`^(?:${s.pattern})$`));
+            if (!PATTERNS.get(s.pattern).test(v))
+                errs.push(`${path}: does not match ${s.pattern}`);
+        }
+        const n = [...v].length;
+        if ("minLength" in s && n < s.minLength)
+            errs.push(`${path}: shorter than ${s.minLength}`);
+        if ("maxLength" in s && n > s.maxLength)
+            errs.push(`${path}: longer than ${s.maxLength}`);
+    }
+    if (isNumber(v) && "minimum" in s && v < s.minimum)
+        errs.push(`${path}: below ${s.minimum}`);
+    if (isNumber(v) && "maximum" in s && v > s.maximum)
+        errs.push(`${path}: above ${s.maximum}`);
+    if (Array.isArray(v) && "maxItems" in s && v.length > s.maxItems)
+        errs.push(`${path}: more than ${s.maxItems} items`);
+    if (Array.isArray(v) && "minItems" in s && v.length < s.minItems)
+        errs.push(`${path}: fewer than ${s.minItems} items`);
+    if (isObject(v)) {
+        for (const k of s.required ?? [])
+            if (!Object.hasOwn(v, k))
+                errs.push(`${path}: missing required '${k}'`);
+        const props = s.properties ?? {}, ap = s.additionalProperties ?? true;
+        for (const [k, x] of Object.entries(v)) {
+            const f = floats.get(v)?.has(k) ?? false;
+            if (Object.hasOwn(props, k))
+                check(x, props[k], `${path}.${k}`, errs, f, floats);
+            else if (ap === false)
+                errs.push(`${path}: unexpected field '${k}'`);
+            else if (isObject(ap))
+                check(x, ap, `${path}.${k}`, errs, f, floats);
+        }
+    }
+    if (Array.isArray(v) && "items" in s)
+        v.forEach((x, i) => check(x, s.items, `${path}[${i}]`, errs, floats.get(v)?.has(i) ?? false, floats));
+    if ("oneOf" in s) {
+        const matched = s.oneOf.filter((sub) => {
+            const e = [];
+            check(v, sub, path, e, float, floats);
+            return !e.length;
+        }).length;
+        if (matched !== 1)
+            errs.push(`${path}: must match exactly one alternative (matched ${matched})`);
+    }
+    for (const sub of s.allOf ?? [])
+        check(v, sub, path, errs, float, floats);
+    if ("if" in s) {
+        const e = [];
+        check(v, s.if, path, e, float, floats);
+        if (!e.length && "then" in s)
+            check(v, s.then, path, errs, float, floats);
+    }
+}
+/** Error strings of a tracekit.event.v2 event (empty when valid); `floats` from strictParse. */
+export function validateEvent(event, floats) {
+    const errs = [];
+    check(event, SCHEMA, "event", errs, false, floats);
+    return errs;
+}