@datumesh/verify 0.0.0-stage → 0.1.1

package/dist/esm/errors.js

@@ -0,0 +1,56 @@
+/** The spec revision this library conforms to. */
+export const SPEC_VERSION = 'spec-0.1.1';
+/** Every error code defined by SPEC.md 10.2, in the order of that table. */
+export const ERROR_CODES = [
+    'E_PARSE_JSON',
+    'E_PARSE_DUPLICATE_KEY',
+    'E_PARSE_URI',
+    'E_SCHEMA',
+    'E_CANON_NAME',
+    'E_CANON_ARG_NAME',
+    'E_CANON_ARG_DUPLICATE',
+    'E_CANON_ARG_ORDER',
+    'E_CANON_PERCENT',
+    'E_CANON_TYPE',
+    'E_CANON_NUMBER',
+    'E_CANON_DATE',
+    'E_CANON_INSTANT',
+    'E_CANON_STRING',
+    'E_CANON_HEX',
+    'E_CANON_LICENCE',
+    'E_CANON_SET',
+    'E_CANON_LIMIT',
+    'E_SLICE',
+    'E_PUBLISHER_MISMATCH',
+    'E_VALID_MISMATCH',
+    'E_TIME_ORDER',
+    'E_ARG_UNKNOWN',
+    'E_ARG_MISSING',
+    'E_KEY_UNAVAILABLE',
+    'E_KEY_DOC',
+    'E_KEY_UNKNOWN',
+    'E_KEY_NOT_VALID',
+    'E_SIGNATURE',
+    'E_FN_UNAVAILABLE',
+    'E_FN_HASH_MISMATCH',
+    'E_ARG_TYPE',
+    'E_RETURN_TYPE',
+    'E_INPUT_UNAVAILABLE',
+    'E_INPUT_INVALID',
+    'E_INPUT_UNDECLARED',
+    'E_VALUE_MISMATCH',
+];
+/** A Datumesh rule was broken. `code` is a SPEC.md 10.2 code; `path` locates the failure. */
+export class DatumeshError extends Error {
+    constructor(code, detail, path = null) {
+        super(`${code}${path ? ` at ${path}` : ''}: ${detail}`);
+        this.name = 'DatumeshError';
+        this.code = code;
+        this.path = path;
+        this.detail = detail;
+    }
+}
+/** Shorthand used throughout: throw a DatumeshError. */
+export function fail(code, detail, path = null) {
+    throw new DatumeshError(code, detail, path);
+}

package/dist/esm/hash.d.ts

@@ -0,0 +1,6 @@
+export declare function toHex(b: Uint8Array): string;
+export declare function fromHex(s: string): Uint8Array;
+/** SHA-256 in lowercase hex. */
+export declare function sha256Hex(b: Uint8Array): string;
+/** SPEC 9.1: first 16 hex digits of SHA-256 over the raw 32-byte public key. */
+export declare function keyIdOf(publicKey: Uint8Array): string;

package/dist/esm/hash.js

@@ -0,0 +1,21 @@
+import { sha256 } from '@noble/hashes/sha2';
+export function toHex(b) {
+    let s = '';
+    for (let i = 0; i < b.length; i++)
+        s += b[i].toString(16).padStart(2, '0');
+    return s;
+}
+export function fromHex(s) {
+    const out = new Uint8Array(s.length / 2);
+    for (let i = 0; i < out.length; i++)
+        out[i] = parseInt(s.slice(2 * i, 2 * i + 2), 16);
+    return out;
+}
+/** SHA-256 in lowercase hex. */
+export function sha256Hex(b) {
+    return toHex(sha256(b));
+}
+/** SPEC 9.1: first 16 hex digits of SHA-256 over the raw 32-byte public key. */
+export function keyIdOf(publicKey) {
+    return sha256Hex(publicKey).slice(0, 16);
+}

package/dist/esm/index.d.ts

@@ -0,0 +1,27 @@
+import { type Kind } from './validate.js';
+export { DatumeshError, ERROR_CODES, SPEC_VERSION, type ErrorCode } from './errors.js';
+export { verify, type VerifyResult, type Recompute } from './verify.js';
+export { parseUri, formatUri, httpsUrl, type CellRef, type TypedScalar, type Signature } from './uri.js';
+export { keysFromResponse, keysFromDocument, fetchKeys, FETCH_TIMEOUT_MS, type KeysResult, type KeyEntry, type KeyMap, type KeySource } from './keys.js';
+export type { Kind } from './validate.js';
+export type { JsonValue } from './json.js';
+/** Library version. */
+export declare const VERSION = "0.1.1";
+/**
+ * Validate `input` as `kind` and return its RFC 8785 canonical bytes. `input` is JSON text,
+ * UTF-8 bytes, or an already-parsed value. `kind` is "scalar", "cell", "ref", "function" or
+ * "receipt" (inferred from the members when omitted), or "jcs" for plain RFC 8785 with only the
+ * strict-parsing rules of SPEC 6.1. A receipt is returned whole, `sig` included, and is checked
+ * through SPEC 10.1 step 4. Throws DatumeshError.
+ */
+export declare function canonicalize(input: unknown, kind?: Kind | null): Uint8Array;
+/** Cell id (SPEC 4.4): SHA-256 of the cell's canonical bytes, lowercase hex. Throws DatumeshError. */
+export declare function cellHash(cell: unknown): string;
+/** Function hash (SPEC 7): SHA-256 of the descriptor's canonical bytes. Throws DatumeshError. */
+export declare function functionHash(descriptor: unknown): string;
+/** Receipt hash (SPEC 8.3): SHA-256 of the canonical receipt without `sig`. Throws DatumeshError. */
+export declare function receiptHash(receipt: unknown): string;
+/** The signed payload of a receipt (SPEC 8.3): canonical bytes without `sig`. Throws DatumeshError. */
+export declare function receiptPayload(receipt: unknown): Uint8Array;
+/** Key id of an Ed25519 public key given as 64 lowercase hex digits (SPEC 9.1). Throws DatumeshError. */
+export declare function keyId(publicKeyHex: string): string;

package/dist/esm/index.js

@@ -0,0 +1,63 @@
+/**
+ * @datumesh/verify: verify Datumesh receipts (SPEC.md, revision spec-0.1.1).
+ *
+ * Everything here is synchronous and offline except fetchKeys, the only function that uses the
+ * network.
+ */
+import { fail } from './errors.js';
+import { sha256Hex, keyIdOf, fromHex } from './hash.js';
+import { newObject, toJson } from './json.js';
+import { jcsBytes } from './jcs.js';
+import { isHex } from './lexical.js';
+import { KINDS, inferKind, validate } from './validate.js';
+export { DatumeshError, ERROR_CODES, SPEC_VERSION } from './errors.js';
+export { verify } from './verify.js';
+export { parseUri, formatUri, httpsUrl } from './uri.js';
+export { keysFromResponse, keysFromDocument, fetchKeys, FETCH_TIMEOUT_MS } from './keys.js';
+/** Library version. */
+export const VERSION = '0.1.1';
+function parseAndValidate(input, kind) {
+    if (kind !== undefined && kind !== null && !KINDS.includes(kind))
+        throw new TypeError(`unknown kind ${JSON.stringify(kind)}; expected one of ${KINDS.join(', ')}`);
+    const value = toJson(input);
+    const k = kind ?? inferKind(value);
+    validate(value, k);
+    return { value, kind: k };
+}
+/**
+ * Validate `input` as `kind` and return its RFC 8785 canonical bytes. `input` is JSON text,
+ * UTF-8 bytes, or an already-parsed value. `kind` is "scalar", "cell", "ref", "function" or
+ * "receipt" (inferred from the members when omitted), or "jcs" for plain RFC 8785 with only the
+ * strict-parsing rules of SPEC 6.1. A receipt is returned whole, `sig` included, and is checked
+ * through SPEC 10.1 step 4. Throws DatumeshError.
+ */
+export function canonicalize(input, kind) {
+    return jcsBytes(parseAndValidate(input, kind).value);
+}
+/** Cell id (SPEC 4.4): SHA-256 of the cell's canonical bytes, lowercase hex. Throws DatumeshError. */
+export function cellHash(cell) {
+    return sha256Hex(jcsBytes(parseAndValidate(cell, 'cell').value));
+}
+/** Function hash (SPEC 7): SHA-256 of the descriptor's canonical bytes. Throws DatumeshError. */
+export function functionHash(descriptor) {
+    return sha256Hex(jcsBytes(parseAndValidate(descriptor, 'function').value));
+}
+/** Receipt hash (SPEC 8.3): SHA-256 of the canonical receipt without `sig`. Throws DatumeshError. */
+export function receiptHash(receipt) {
+    return sha256Hex(receiptPayload(receipt));
+}
+/** The signed payload of a receipt (SPEC 8.3): canonical bytes without `sig`. Throws DatumeshError. */
+export function receiptPayload(receipt) {
+    const r = parseAndValidate(receipt, 'receipt').value;
+    const o = newObject();
+    for (const k of Object.keys(r))
+        if (k !== 'sig')
+            o[k] = r[k];
+    return jcsBytes(o);
+}
+/** Key id of an Ed25519 public key given as 64 lowercase hex digits (SPEC 9.1). Throws DatumeshError. */
+export function keyId(publicKeyHex) {
+    if (typeof publicKeyHex !== 'string' || !isHex(publicKeyHex, 64))
+        fail('E_CANON_HEX', 'expected 64 lowercase hex digits', '$');
+    return keyIdOf(fromHex(publicKeyHex));
+}

package/dist/esm/jcs.d.ts

@@ -0,0 +1,5 @@
+import type { JsonValue } from './json.js';
+/** RFC 8785 canonical text of a JSON value. */
+export declare function jcsText(v: JsonValue): string;
+/** RFC 8785 canonical bytes (UTF-8) of a JSON value. */
+export declare function jcsBytes(v: JsonValue): Uint8Array;

package/dist/esm/jcs.js

@@ -0,0 +1,18 @@
+// RFC 8785 JSON Canonicalization Scheme. Serialisation is delegated to the `canonicalize`
+// package (the RFC authors' implementation), which relies on ECMAScript JSON.stringify for
+// strings and numbers and on the default (UTF-16 code unit) sort for member names, exactly as
+// RFC 8785 specifies. It is only ever given values produced by ./json.ts (plain data, finite
+// numbers, well-formed strings), so its toJSON/undefined handling never comes into play.
+import serialize from 'canonicalize';
+import { utf8Encode } from './utf8.js';
+/** RFC 8785 canonical text of a JSON value. */
+export function jcsText(v) {
+    const s = serialize(v);
+    if (typeof s !== 'string')
+        throw new Error('canonicalize returned no text');
+    return s;
+}
+/** RFC 8785 canonical bytes (UTF-8) of a JSON value. */
+export function jcsBytes(v) {
+    return utf8Encode(jcsText(v));
+}

package/dist/esm/json.d.ts

@@ -0,0 +1,29 @@
+export type JsonValue = null | boolean | number | string | JsonValue[] | JsonObject;
+export interface JsonObject {
+    [key: string]: JsonValue;
+}
+/**
+ * Nesting deeper than this is rejected with E_PARSE_JSON. SPEC.md sets no depth limit; this is
+ * an implementation limit (Datumesh objects nest at most five levels) that keeps parsing and
+ * canonicalisation from exhausting the call stack.
+ */
+export declare const MAX_DEPTH = 1000;
+export declare function isObject(v: unknown): v is JsonObject;
+export declare function newObject(): JsonObject;
+export declare function has(o: JsonObject, k: string): boolean;
+/** Member names in JCS order (UTF-16 code units, which is JavaScript's default sort). */
+export declare function sortedKeys(o: JsonObject): string[];
+export declare function memberPath(path: string, name: string): string;
+/** Parse JSON text strictly. */
+export declare function parseJsonText(text: string): JsonValue;
+/** Parse UTF-8 JSON bytes strictly: no BOM, no invalid UTF-8. */
+export declare function parseJsonBytes(bytes: Uint8Array): JsonValue;
+/**
+ * Check an already-parsed JavaScript value against the JSON data model and return a private
+ * deep copy (plain data with null-prototype objects), so later checks cannot be affected by
+ * getters, prototypes or mutation. Duplicate members cannot be detected here: pass JSON text
+ * or bytes for that.
+ */
+export declare function normalizeValue(v: unknown, path?: string, depth?: number): JsonValue;
+/** JSON text (string), UTF-8 bytes (Uint8Array) or an already-parsed value. */
+export declare function toJson(input: unknown): JsonValue;

package/dist/esm/json.js

@@ -0,0 +1,309 @@
+// Strict JSON parsing (SPEC.md 6.1, I-JSON / RFC 7493). JSON.parse is not used: it accepts
+// duplicate members (last wins) and lone surrogates, both of which must be rejected.
+import { fail } from './errors.js';
+import { hasLoneSurrogate } from './unicode.js';
+import { utf8Decode } from './utf8.js';
+/**
+ * Nesting deeper than this is rejected with E_PARSE_JSON. SPEC.md sets no depth limit; this is
+ * an implementation limit (Datumesh objects nest at most five levels) that keeps parsing and
+ * canonicalisation from exhausting the call stack.
+ */
+export const MAX_DEPTH = 1000;
+export function isObject(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+export function newObject() {
+    return Object.create(null);
+}
+export function has(o, k) {
+    return Object.prototype.hasOwnProperty.call(o, k);
+}
+/** Member names in JCS order (UTF-16 code units, which is JavaScript's default sort). */
+export function sortedKeys(o) {
+    return Object.keys(o).sort();
+}
+export function memberPath(path, name) {
+    return /^[A-Za-z_][A-Za-z0-9_]*$/.test(name) ? `${path}.${name}` : `${path}[${JSON.stringify(name)}]`;
+}
+class Parser {
+    constructor(s) {
+        this.s = s;
+        this.i = 0;
+        /** Path of the first string holding an escaped lone surrogate; reported after parsing. */
+        this.surrogatePath = null;
+    }
+    err(msg) {
+        fail('E_PARSE_JSON', `${msg} at offset ${this.i}`, '$');
+    }
+    ws() {
+        const s = this.s;
+        while (this.i < s.length) {
+            const c = s.charCodeAt(this.i);
+            if (c === 0x20 || c === 0x09 || c === 0x0a || c === 0x0d)
+                this.i++;
+            else
+                break;
+        }
+    }
+    parseDocument() {
+        this.ws();
+        const v = this.value('$', 0);
+        this.ws();
+        if (this.i !== this.s.length)
+            this.err('unexpected data after the JSON value');
+        return v;
+    }
+    value(path, depth) {
+        if (depth > MAX_DEPTH)
+            this.err(`nesting deeper than ${MAX_DEPTH} levels (implementation limit)`);
+        const s = this.s;
+        const c = s[this.i];
+        if (c === '{')
+            return this.object(path, depth);
+        if (c === '[')
+            return this.array(path, depth);
+        if (c === '"')
+            return this.string(path);
+        if (c === 't' && s.startsWith('true', this.i)) {
+            this.i += 4;
+            return true;
+        }
+        if (c === 'f' && s.startsWith('false', this.i)) {
+            this.i += 5;
+            return false;
+        }
+        if (c === 'n' && s.startsWith('null', this.i)) {
+            this.i += 4;
+            return null;
+        }
+        if (c === '-' || (c >= '0' && c <= '9'))
+            return this.number();
+        if (c === undefined)
+            this.err('unexpected end of input');
+        if (s.startsWith('NaN', this.i) || s.startsWith('Infinity', this.i) || s.startsWith('-Infinity', this.i)) {
+            this.err('NaN and Infinity are not JSON');
+        }
+        this.err(`unexpected character ${JSON.stringify(c)}`);
+    }
+    object(path, depth) {
+        this.i++; // {
+        const o = newObject();
+        let dup = null;
+        this.ws();
+        if (this.s[this.i] === '}') {
+            this.i++;
+            return o;
+        }
+        for (;;) {
+            this.ws();
+            if (this.s[this.i] !== '"')
+                this.err('expected a member name');
+            const k = this.string(path);
+            this.ws();
+            if (this.s[this.i] !== ':')
+                this.err("expected ':'");
+            this.i++;
+            this.ws();
+            const v = this.value(memberPath(path, k), depth + 1);
+            if (has(o, k)) {
+                if (dup === null)
+                    dup = k;
+            }
+            else
+                o[k] = v;
+            this.ws();
+            const c = this.s[this.i];
+            if (c === ',') {
+                this.i++;
+                continue;
+            }
+            if (c === '}') {
+                this.i++;
+                break;
+            }
+            this.err("expected ',' or '}'");
+        }
+        // Like an object-pairs hook, duplicates are reported once the object is complete.
+        if (dup !== null)
+            fail('E_PARSE_DUPLICATE_KEY', `duplicate member ${JSON.stringify(dup)}`, path);
+        return o;
+    }
+    array(path, depth) {
+        this.i++; // [
+        const a = [];
+        this.ws();
+        if (this.s[this.i] === ']') {
+            this.i++;
+            return a;
+        }
+        for (;;) {
+            this.ws();
+            a.push(this.value(`${path}[${a.length}]`, depth + 1));
+            this.ws();
+            const c = this.s[this.i];
+            if (c === ',') {
+                this.i++;
+                continue;
+            }
+            if (c === ']') {
+                this.i++;
+                return a;
+            }
+            this.err("expected ',' or ']'");
+        }
+    }
+    string(path) {
+        const s = this.s;
+        this.i++; // opening quote
+        let out = '';
+        let start = this.i;
+        for (;;) {
+            if (this.i >= s.length)
+                this.err('unterminated string');
+            const c = s.charCodeAt(this.i);
+            if (c === 0x22) {
+                out += s.slice(start, this.i);
+                this.i++;
+                break;
+            }
+            if (c < 0x20)
+                this.err('control character in string');
+            if (c === 0x5c) {
+                out += s.slice(start, this.i);
+                const e = s[this.i + 1];
+                let ch;
+                switch (e) {
+                    case '"':
+                        ch = '"';
+                        break;
+                    case '\\':
+                        ch = '\\';
+                        break;
+                    case '/':
+                        ch = '/';
+                        break;
+                    case 'b':
+                        ch = '\b';
+                        break;
+                    case 'f':
+                        ch = '\f';
+                        break;
+                    case 'n':
+                        ch = '\n';
+                        break;
+                    case 'r':
+                        ch = '\r';
+                        break;
+                    case 't':
+                        ch = '\t';
+                        break;
+                    case 'u': {
+                        const h = s.slice(this.i + 2, this.i + 6);
+                        if (!/^[0-9A-Fa-f]{4}$/.test(h))
+                            this.err('bad \\u escape');
+                        ch = String.fromCharCode(parseInt(h, 16));
+                        this.i += 4;
+                        break;
+                    }
+                    default:
+                        this.err('bad escape');
+                }
+                out += ch;
+                this.i += 2;
+                start = this.i;
+                continue;
+            }
+            this.i++;
+        }
+        if (this.surrogatePath === null && hasLoneSurrogate(out))
+            this.surrogatePath = path;
+        return out;
+    }
+    number() {
+        const s = this.s;
+        const m = /-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?/y;
+        m.lastIndex = this.i;
+        const r = m.exec(s);
+        if (!r || r[0] === '-' || r[0] === '')
+            this.err('bad number');
+        const text = r[0];
+        // A digit right after "0" (e.g. 01) is not JSON.
+        const next = s[this.i + text.length];
+        if (next !== undefined && /[0-9.eE+-]/.test(next))
+            this.err('bad number');
+        this.i += text.length;
+        const n = Number(text);
+        if (!Number.isFinite(n))
+            fail('E_PARSE_JSON', `number out of IEEE 754 range: ${text.slice(0, 40)}`, '$');
+        return n;
+    }
+}
+/** Parse JSON text strictly. */
+export function parseJsonText(text) {
+    if (text.charCodeAt(0) === 0xfeff)
+        fail('E_PARSE_JSON', 'byte order mark', '$');
+    if (hasLoneSurrogate(text))
+        fail('E_PARSE_JSON', 'lone surrogate in the text', '$');
+    const p = new Parser(text);
+    const v = p.parseDocument();
+    if (p.surrogatePath !== null)
+        fail('E_PARSE_JSON', 'lone surrogate', p.surrogatePath);
+    return v;
+}
+/** Parse UTF-8 JSON bytes strictly: no BOM, no invalid UTF-8. */
+export function parseJsonBytes(bytes) {
+    if (bytes.length >= 3 && bytes[0] === 0xef && bytes[1] === 0xbb && bytes[2] === 0xbf) {
+        fail('E_PARSE_JSON', 'byte order mark', '$');
+    }
+    const text = utf8Decode(bytes);
+    if (text === null)
+        fail('E_PARSE_JSON', 'invalid UTF-8', '$');
+    return parseJsonText(text);
+}
+/**
+ * Check an already-parsed JavaScript value against the JSON data model and return a private
+ * deep copy (plain data with null-prototype objects), so later checks cannot be affected by
+ * getters, prototypes or mutation. Duplicate members cannot be detected here: pass JSON text
+ * or bytes for that.
+ */
+export function normalizeValue(v, path = '$', depth = 0) {
+    if (depth > MAX_DEPTH)
+        fail('E_PARSE_JSON', `nesting deeper than ${MAX_DEPTH} levels (or a cycle)`, path);
+    if (v === null || typeof v === 'boolean')
+        return v;
+    if (typeof v === 'number') {
+        if (!Number.isFinite(v))
+            fail('E_PARSE_JSON', 'NaN and Infinity are not JSON', path);
+        return v;
+    }
+    if (typeof v === 'string') {
+        if (hasLoneSurrogate(v))
+            fail('E_PARSE_JSON', 'lone surrogate', path);
+        return v;
+    }
+    if (Array.isArray(v))
+        return v.map((x, i) => normalizeValue(x, `${path}[${i}]`, depth + 1));
+    if (typeof v === 'object') {
+        const proto = Object.getPrototypeOf(v);
+        if (proto !== Object.prototype && proto !== null)
+            fail('E_PARSE_JSON', 'not a plain JSON object', path);
+        const o = newObject();
+        for (const k of Object.keys(v)) {
+            if (hasLoneSurrogate(k))
+                fail('E_PARSE_JSON', 'lone surrogate in a member name', path);
+            o[k] = normalizeValue(v[k], memberPath(path, k), depth + 1);
+        }
+        return o;
+    }
+    fail('E_PARSE_JSON', `${typeof v} is not a JSON value`, path);
+}
+/** JSON text (string), UTF-8 bytes (Uint8Array) or an already-parsed value. */
+export function toJson(input) {
+    if (typeof input === 'string')
+        return parseJsonText(input);
+    if (input instanceof Uint8Array)
+        return parseJsonBytes(input);
+    if (input instanceof ArrayBuffer)
+        return parseJsonBytes(new Uint8Array(input));
+    return normalizeValue(input);
+}

package/dist/esm/keys.d.ts

@@ -0,0 +1,73 @@
+import { type ErrorCode } from './errors.js';
+/** One validated key from a key document. */
+export interface KeyEntry {
+    alg: 'ed25519';
+    id: string;
+    public: string;
+    valid_from: string;
+    valid_to?: string;
+}
+/** The outcome of resolving one host's keys (SPEC 9.3). */
+export interface KeysResult {
+    ok: boolean;
+    /** "OK", "E_KEY_UNAVAILABLE" or "E_KEY_DOC". */
+    code: 'OK' | 'E_KEY_UNAVAILABLE' | 'E_KEY_DOC';
+    host: string;
+    detail: string;
+    /** The validated keys, in document order, when ok. */
+    keys?: KeyEntry[];
+}
+/** A mapping of key id to 64-hex public key: usable for any host, with no validity windows. */
+export type KeyMap = Record<string, string>;
+/** Anything `verify` accepts as keys. */
+export type KeySource = KeysResult | KeyMap | Record<string, unknown> | KeySource[];
+/**
+ * Interpret the HTTPS response for https://<host>/.well-known/datumesh.json (SPEC 9.3).
+ * `status` is the HTTP status, or null for a network, DNS, TLS or timeout failure. `body` is the
+ * response body as text or bytes. Never throws.
+ */
+export declare function keysFromResponse(host: string, status: number | null, body?: string | Uint8Array | null): KeysResult;
+/**
+ * Validate an already-parsed key document (its `host` member names the host it covers).
+ * Never throws.
+ */
+export declare function keysFromDocument(doc: unknown): KeysResult;
+/** Default timeout of fetchKeys, in milliseconds. */
+export declare const FETCH_TIMEOUT_MS = 10000;
+/**
+ * Fetch https://<host>/.well-known/datumesh.json once, with TLS verified by the platform, no
+ * redirects followed and a timeout, then interpret it with keysFromResponse. The only function
+ * in this library that touches the network. Never throws.
+ */
+export declare function fetchKeys(host: string, timeoutMs?: number): Promise<KeysResult>;
+interface HostSource {
+    host: string;
+    result: KeysResult;
+}
+interface AnySource {
+    ok: boolean;
+    code: ErrorCode | 'OK';
+    detail: string;
+    keys: KeyEntry[];
+}
+export interface Sources {
+    hosts: HostSource[];
+    any: AnySource[];
+}
+/**
+ * Normalise the `keys` argument of verify. Throws TypeError only for arguments that are not key
+ * sources at all (programmer errors); malformed key material becomes an error source.
+ */
+export declare function collectSources(keys: unknown, into?: Sources, depth?: number): Sources;
+export type KeyLookup = {
+    ok: true;
+    key: KeyEntry;
+    windows: boolean;
+} | {
+    ok: false;
+    code: ErrorCode;
+    detail: string;
+};
+/** SPEC 10.1 step 5 for key reference host#id at time `issued`. */
+export declare function lookupKey(sources: Sources, host: string, id: string, issued: string): KeyLookup;
+export {};