@datumesh/verify 0.0.0-stage → 0.2.0

package/dist/esm/validate.js

@@ -0,0 +1,397 @@
+// Structure (SPEC 10.1 step 2, E_SCHEMA), canonical form (step 3) and receipt consistency
+// (step 4) for every kind of Datumesh object. Within a step members are examined in JCS order,
+// depth first; at each object its member set is checked before its members.
+import { fail } from './errors.js';
+import { has, isObject, memberPath, sortedKeys } from './json.js';
+import { LIMITS, VALID_TIME_TYPES, checkArgName, checkFunctionName, checkHex, checkInstant, checkKeyRef, checkLicence, checkName, checkNamespace, checkString, checkTypedValue, isTypeName, } from './lexical.js';
+import { canonUnit, resolveUnit, structUnit } from './units.js';
+export const KINDS = ['scalar', 'cell', 'ref', 'function', 'receipt', 'jcs'];
+const SLICE = '*';
+// ---------------------------------------------------------------- step 2: structure
+function expectObject(v, path) {
+    if (!isObject(v))
+        fail('E_SCHEMA', 'expected an object', path);
+    return v;
+}
+function members(o, required, optional, path) {
+    const names = new Set([...Object.keys(o), ...required]);
+    for (const n of [...names].sort()) {
+        if (!has(o, n))
+            fail('E_SCHEMA', `missing member ${JSON.stringify(n)}`, path);
+        if (!required.includes(n) && !optional.includes(n))
+            fail('E_SCHEMA', `unexpected member ${JSON.stringify(n)}`, path);
+    }
+}
+function expectString(o, k, path) {
+    if (typeof o[k] !== 'string')
+        fail('E_SCHEMA', `${k} must be a string`, memberPath(path, k));
+}
+function structScalar(v, path) {
+    const o = expectObject(v, path);
+    members(o, ['type', 'value'], [], path);
+    expectString(o, 'type', path);
+    if (typeof o.value !== 'string' && typeof o.value !== 'boolean') {
+        fail('E_SCHEMA', 'value must be a string or a boolean', memberPath(path, 'value'));
+    }
+}
+function structArgs(v, path) {
+    const o = expectObject(v, path);
+    for (const k of sortedKeys(o)) {
+        if (o[k] === SLICE)
+            continue;
+        structScalar(o[k], memberPath(path, k));
+    }
+}
+function structCell(v, path, ref) {
+    const o = expectObject(v, path);
+    if (ref)
+        members(o, ['args', 'fn', 'ns'], ['asof'], path);
+    else
+        members(o, ['args', 'fn', 'fn_hash', 'ns'], [], path);
+    for (const k of sortedKeys(o)) {
+        if (k === 'args')
+            structArgs(o.args, memberPath(path, 'args'));
+        else
+            expectString(o, k, path);
+    }
+}
+function structFunction(v, path) {
+    const o = expectObject(v, path);
+    members(o, ['code', 'inputs', 'signature'], [], path);
+    const codePath = memberPath(path, 'code');
+    const code = expectObject(o.code, codePath);
+    members(code, ['body', 'lang'], [], codePath);
+    expectString(code, 'body', codePath);
+    expectString(code, 'lang', codePath);
+    const inputs = o.inputs;
+    if (!Array.isArray(inputs) || inputs.some((x) => typeof x !== 'string')) {
+        fail('E_SCHEMA', 'inputs must be an array of strings', memberPath(path, 'inputs'));
+    }
+    structSignature(o.signature, memberPath(path, 'signature'));
+}
+export function structSignature(v, path) {
+    const sig = expectObject(v, path);
+    members(sig, ['args', 'returns'], [], path);
+    const argsPath = memberPath(path, 'args');
+    const args = expectObject(sig.args, argsPath);
+    for (const k of sortedKeys(args)) {
+        const p = memberPath(argsPath, k);
+        const d = expectObject(args[k], p);
+        members(d, ['type', 'valid'], ['unit'], p);
+        expectString(d, 'type', p);
+        if (has(d, 'unit'))
+            structUnit(d.unit, memberPath(p, 'unit'));
+        if (typeof d.valid !== 'boolean')
+            fail('E_SCHEMA', 'valid must be a boolean', memberPath(p, 'valid'));
+    }
+    // SPEC 7: a type name, or {"type", "unit"} (the unit's absence is E_CANON_UNIT, in step 3).
+    const rp = memberPath(path, 'returns');
+    const r = sig.returns;
+    if (typeof r === 'string')
+        return;
+    if (!isObject(r))
+        fail('E_SCHEMA', 'returns must be a type name or an object', rp);
+    members(r, ['type'], ['unit'], rp);
+    expectString(r, 'type', rp);
+    if (has(r, 'unit'))
+        structUnit(r.unit, memberPath(rp, 'unit'));
+}
+const RECEIPT_MEMBERS = [
+    'asof',
+    'cell',
+    'computed_by',
+    'inputs',
+    'issued',
+    'licence',
+    'proto',
+    'publisher',
+    'sig',
+    'summary',
+    'tx',
+    'type',
+    'valid',
+    'value',
+];
+function structReceipt(v, path) {
+    const o = expectObject(v, path);
+    members(o, RECEIPT_MEMBERS, [], path);
+    for (const k of sortedKeys(o)) {
+        const p = memberPath(path, k);
+        switch (k) {
+            case 'cell':
+                structCell(o.cell, p, false);
+                break;
+            case 'inputs': {
+                const a = o.inputs;
+                if (!Array.isArray(a) || a.some((x) => typeof x !== 'string'))
+                    fail('E_SCHEMA', 'inputs must be an array of strings', p);
+                break;
+            }
+            case 'valid':
+                structArgs(o.valid, p);
+                break;
+            case 'value':
+                if (typeof o.value !== 'string' && typeof o.value !== 'boolean')
+                    fail('E_SCHEMA', 'value must be a string or a boolean', p);
+                break;
+            case 'proto':
+                expectString(o, k, path);
+                if (o.proto !== 'datumesh/1')
+                    fail('E_SCHEMA', "proto must be 'datumesh/1'", p);
+                break;
+            default:
+                expectString(o, k, path);
+        }
+    }
+}
+// ---------------------------------------------------------------- step 3: canonical form
+function canonScalar(o, path) {
+    const t = o.type;
+    if (!isTypeName(t))
+        fail('E_CANON_TYPE', `unknown type ${JSON.stringify(t)}`, memberPath(path, 'type'));
+    checkTypedValue(t, o.value, memberPath(path, 'value'));
+}
+function canonArgs(o, path) {
+    if (Object.keys(o).length > LIMITS.args)
+        fail('E_CANON_LIMIT', `more than ${LIMITS.args} arguments`, path);
+    for (const k of sortedKeys(o)) {
+        const p = memberPath(path, k);
+        checkArgName(k, p);
+        if (o[k] !== SLICE)
+            canonScalar(o[k], p);
+    }
+}
+function canonCell(o, path) {
+    for (const k of sortedKeys(o)) {
+        const p = memberPath(path, k);
+        const v = o[k];
+        if (k === 'args')
+            canonArgs(o.args, p);
+        else if (k === 'asof')
+            checkInstant(v, p);
+        else if (k === 'fn')
+            checkName(v, p);
+        else if (k === 'fn_hash')
+            checkHex(v, 64, p);
+        else if (k === 'ns')
+            checkNamespace(v, p);
+    }
+    if (o.ns.length + 1 + o.fn.length > LIMITS.function_name) {
+        fail('E_CANON_LIMIT', 'function name too long', path);
+    }
+}
+function canonStringSet(a, path, each) {
+    a.forEach((s, i) => each(s, `${path}[${i}]`));
+    for (let i = 1; i < a.length; i++) {
+        if (!(a[i - 1] < a[i]))
+            fail('E_CANON_SET', 'entries must be strictly ascending', path);
+    }
+    if (a.length > LIMITS.inputs)
+        fail('E_CANON_LIMIT', `more than ${LIMITS.inputs} inputs`, path);
+}
+export function canonSignature(sig, path) {
+    const argsPath = memberPath(path, 'args');
+    const args = sig.args;
+    if (Object.keys(args).length > LIMITS.args)
+        fail('E_CANON_LIMIT', `more than ${LIMITS.args} arguments`, argsPath);
+    for (const k of sortedKeys(args)) {
+        const p = memberPath(argsPath, k);
+        checkArgName(k, p);
+        const d = args[k];
+        // SPEC 7: type, then unit, then valid.
+        if (!isTypeName(d.type))
+            fail('E_CANON_TYPE', `unknown type ${JSON.stringify(d.type)}`, memberPath(p, 'type'));
+        if (d.type === 'number') {
+            if (!has(d, 'unit'))
+                fail('E_CANON_UNIT', 'a number argument declares its unit', p);
+            canonUnit(d.unit, args, memberPath(p, 'unit'));
+        }
+        else if (has(d, 'unit')) {
+            fail('E_CANON_UNIT', 'only number arguments have a unit', memberPath(p, 'unit'));
+        }
+        if (d.valid === true && !VALID_TIME_TYPES.includes(d.type)) {
+            fail('E_CANON_TYPE', 'a valid-time argument must be a date, instant or string', p);
+        }
+    }
+    const rp = memberPath(path, 'returns');
+    const r = sig.returns;
+    if (typeof r === 'string') {
+        if (!isTypeName(r))
+            fail('E_CANON_TYPE', `unknown type ${JSON.stringify(r)}`, rp);
+        if (r === 'number')
+            fail('E_CANON_UNIT', 'a number return is {"type": "number", "unit": ...}, not the bare name', rp);
+        return;
+    }
+    const o = r;
+    if (!isTypeName(o.type))
+        fail('E_CANON_TYPE', `unknown type ${JSON.stringify(o.type)}`, memberPath(rp, 'type'));
+    if (o.type !== 'number')
+        fail('E_CANON_UNIT', 'only a number return is written as an object', rp);
+    if (!has(o, 'unit'))
+        fail('E_CANON_UNIT', 'a number return declares its unit', rp);
+    canonUnit(o.unit, args, memberPath(rp, 'unit'));
+}
+/** The return type named by a valid signature's `returns` (SPEC 10.1 step 7.4). */
+export function returnType(sig) {
+    const r = sig.returns;
+    return typeof r === 'string' ? r : r.type;
+}
+function canonFunction(o, path) {
+    const code = o.code;
+    const codePath = memberPath(path, 'code');
+    checkString(code.body, memberPath(codePath, 'body'), { body: true });
+    checkName(code.lang, memberPath(codePath, 'lang'));
+    canonStringSet(o.inputs, memberPath(path, 'inputs'), checkFunctionName);
+    canonSignature(o.signature, memberPath(path, 'signature'));
+}
+function canonReceipt(o, path) {
+    for (const k of sortedKeys(o)) {
+        const p = memberPath(path, k);
+        const v = o[k];
+        switch (k) {
+            case 'asof':
+            case 'issued':
+            case 'tx':
+                checkInstant(v, p);
+                break;
+            case 'cell':
+                canonCell(v, p);
+                break;
+            case 'computed_by':
+                checkKeyRef(v, p);
+                break;
+            case 'inputs':
+                canonStringSet(v, p, (s, q) => checkHex(s, 64, q));
+                break;
+            case 'licence':
+                checkLicence(v, p);
+                break;
+            case 'publisher':
+                checkNamespace(v, p);
+                break;
+            case 'sig':
+                checkHex(v, 128, p);
+                break;
+            case 'summary':
+                if (v === '')
+                    fail('E_CANON_STRING', 'summary must not be empty', p);
+                checkString(v, p, { limit: LIMITS.summary });
+                break;
+            case 'type':
+                if (!isTypeName(v))
+                    fail('E_CANON_TYPE', `unknown type ${JSON.stringify(v)}`, p);
+                break;
+            case 'valid':
+                canonArgs(v, p);
+                break;
+            case 'value':
+                checkTypedValue(o.type, v, p);
+                break;
+        }
+    }
+}
+// ---------------------------------------------------------------- step 4: consistency
+function consistency(o, path) {
+    const cell = o.cell;
+    const args = cell.args;
+    const valid = o.valid;
+    const argsPath = memberPath(memberPath(path, 'cell'), 'args');
+    const validPath = memberPath(path, 'valid');
+    for (const k of sortedKeys(args)) {
+        if (args[k] === SLICE)
+            fail('E_SLICE', 'a receipt is for one cell, not a slice', memberPath(argsPath, k));
+    }
+    for (const k of sortedKeys(valid)) {
+        if (valid[k] === SLICE)
+            fail('E_SLICE', 'a receipt is for one cell, not a slice', memberPath(validPath, k));
+    }
+    if (o.publisher !== cell.ns)
+        fail('E_PUBLISHER_MISMATCH', 'publisher must equal cell.ns', memberPath(path, 'publisher'));
+    for (const k of sortedKeys(valid)) {
+        const v = valid[k];
+        const a = has(args, k) ? args[k] : null;
+        if (!a || a.type !== v.type || a.value !== v.value) {
+            fail('E_VALID_MISMATCH', `valid.${k} does not echo cell.args.${k}`, validPath);
+        }
+        if (!VALID_TIME_TYPES.includes(v.type)) {
+            fail('E_VALID_MISMATCH', 'valid-time arguments are dates, instants or strings', validPath);
+        }
+    }
+    const tx = o.tx;
+    const asof = o.asof;
+    const issued = o.issued;
+    // Instants are fixed width, so string order is time order (SPEC 3.3).
+    if (!(tx <= asof && asof <= issued))
+        fail('E_TIME_ORDER', 'requires tx <= asof <= issued', path);
+}
+// ---------------------------------------------------------------- entry points
+/** Validate `v` as `kind` (steps 2-3; for receipts also step 4). Throws DatumeshError. */
+export function validate(v, kind, path = '$') {
+    switch (kind) {
+        case 'jcs':
+            return;
+        case 'scalar':
+            structScalar(v, path);
+            canonScalar(v, path);
+            return;
+        case 'cell':
+        case 'ref':
+            structCell(v, path, kind === 'ref');
+            canonCell(v, path);
+            return;
+        case 'function':
+            structFunction(v, path);
+            canonFunction(v, path);
+            return;
+        case 'receipt':
+            structReceipt(v, path);
+            canonReceipt(v, path);
+            consistency(v, path);
+            return;
+    }
+}
+/**
+ * The unit of a cell's value (SPEC 7.1, units.md 3). Order: the cell (structure, canonical
+ * form), fn_hash against the descriptor (E_FN_HASH_MISMATCH), the descriptor (structure,
+ * canonical form), then substitution.
+ */
+export function cellUnit(desc, cell, fnHash) {
+    structCell(cell, 'cell', false);
+    canonCell(cell, 'cell');
+    if (fnHash(desc) !== cell.fn_hash)
+        fail('E_FN_HASH_MISMATCH', 'the descriptor does not hash to cell.fn_hash', 'descriptor');
+    structFunction(desc, 'descriptor');
+    canonFunction(desc, 'descriptor');
+    const sig = desc.signature;
+    return resolveUnit(sig.returns, cell.args, 'descriptor.signature.returns', 'cell.args');
+}
+/** Receipt step 2 only: true when the receipt has the right members and JSON types. */
+export function receiptStructure(v) {
+    structReceipt(v, '$');
+}
+/** Receipt steps 3 and 4, after receiptStructure has passed. */
+export function receiptCanonicalAndConsistent(v) {
+    canonReceipt(v, '$');
+    consistency(v, '$');
+}
+/**
+ * Infer the kind of an object from its members when the caller gives none: a receipt has
+ * `sig`, `proto` or `computed_by`; a descriptor `signature` or `code`; a cell `fn_hash`; a cell
+ * reference `fn`, `ns` or `args`; a typed scalar `type` or `value`. Anything else is E_SCHEMA.
+ */
+export function inferKind(v) {
+    if (!isObject(v))
+        fail('E_SCHEMA', 'cannot infer the kind of a non-object; pass kind', '$');
+    const h = (k) => has(v, k);
+    if (h('sig') || h('proto') || h('computed_by'))
+        return 'receipt';
+    if (h('signature') || h('code'))
+        return 'function';
+    if (h('fn_hash'))
+        return 'cell';
+    if (h('fn') || h('ns') || h('args'))
+        return 'ref';
+    if (h('type') || h('value'))
+        return 'scalar';
+    fail('E_SCHEMA', 'cannot infer the kind from the members; pass kind', '$');
+}

package/dist/esm/verify.d.ts

@@ -0,0 +1,57 @@
+import { type ErrorCode } from './errors.js';
+import { type JsonObject, type JsonValue } from './json.js';
+import { type Sources } from './keys.js';
+export interface VerifyResult {
+    /** True when the receipt is signature-valid (and, if recompute was given, fully verified). */
+    ok: boolean;
+    /** "OK" or a SPEC 10.2 error code. */
+    code: 'OK' | ErrorCode;
+    /** "signed" (steps 1-6) or "recomputed" (steps 1-7) when ok, else null. */
+    level: 'signed' | 'recomputed' | null;
+    /** The receipt hash, once the receipt has the structure of a receipt (step 2), else null. */
+    hash: string | null;
+    /** The `computed_by` key reference when ok, else null. */
+    key: string | null;
+    /** Human-readable explanation. */
+    detail: string;
+    /** Where the failure was found (a JSON path like `$.cell.args.base`), or null. */
+    path: string | null;
+    /** True only when blob content was supplied and step 7.7 ran and passed. Does not change `level`. */
+    blobChecked: boolean;
+}
+/** Input for SPEC 10.1 step 7. The library does not evaluate functions; `value` is the result. */
+export interface Recompute {
+    /** The function descriptor for cell.fn_hash (object or JSON text); absent: E_FN_UNAVAILABLE. */
+    descriptor?: unknown;
+    /** Input receipts by receipt hash, as JSON text (or bytes, or parsed objects). */
+    inputs?: Record<string, unknown>;
+    /** What evaluating the function produced: a typed scalar. */
+    value: {
+        type: string;
+        value: string | boolean;
+    };
+}
+declare class Stop extends Error {
+    readonly code: ErrorCode;
+    readonly detail: string;
+    readonly path: string | null;
+    constructor(code: ErrorCode, detail: string, path: string | null);
+}
+/**
+ * Verify a receipt (SPEC 10.1). `receipt` is JSON text, UTF-8 bytes or a parsed object (only
+ * text and bytes allow duplicate-member detection). `keys` is a key document, a KeysResult, a
+ * {keyId: publicKeyHex} map, or an array of these. With `recompute`, step 7 runs too. With
+ * `blob`, the content of a blob value, step 7.7 runs last (after step 7 when recomputing,
+ * otherwise right after step 6): E_SCHEMA if the value is not a blob, E_BLOB_MISMATCH if the
+ * content does not match. It does not change `level`; `blobChecked` reports it.
+ *
+ * Never throws for an invalid receipt or bad key material; throws TypeError only when an
+ * argument is of the wrong kind altogether.
+ */
+export declare function verify(receipt: unknown, keys: unknown, recomputeArg?: Recompute | null, blob?: Uint8Array | ArrayBuffer | null): VerifyResult;
+/** Steps 1-6 for an already-parsed receipt (used by checkEnvelope). Throws a Stop. */
+export declare function verifyEmbedded(receipt: JsonValue, sources: Sources): {
+    receipt: JsonObject;
+    hash: string;
+};
+export { Stop };

package/dist/esm/verify.js

@@ -0,0 +1,227 @@
+// Receipt verification (SPEC.md 10.1). Synchronous, offline, no global state, no logging.
+import { DatumeshError } from './errors.js';
+import { verifyEd25519Strict } from './ed25519.js';
+import { fromHex, sha256Hex } from './hash.js';
+import { has, newObject, sortedKeys, toJson } from './json.js';
+import { jcsBytes } from './jcs.js';
+import { collectSources, lookupKey } from './keys.js';
+import { checkBlob } from './lexical.js';
+import { receiptCanonicalAndConsistent, receiptStructure, returnType, validate } from './validate.js';
+class Stop extends Error {
+    constructor(code, detail, path) {
+        super(detail);
+        this.code = code;
+        this.detail = detail;
+        this.path = path;
+    }
+}
+function stop(code, detail, path = '$') {
+    throw new Stop(code, detail, path);
+}
+function withoutSig(r) {
+    const o = newObject();
+    for (const k of Object.keys(r))
+        if (k !== 'sig')
+            o[k] = r[k];
+    return o;
+}
+/** Steps 1-6. Throws Stop; returns the parsed receipt and its hash. */
+function verifySigned(input, sources, setHash) {
+    let r;
+    try {
+        r = toJson(input); // step 1
+        receiptStructure(r); // step 2
+    }
+    catch (e) {
+        if (e instanceof DatumeshError)
+            stop(e.code, e.detail, e.path);
+        throw e;
+    }
+    const receipt = r;
+    const payload = jcsBytes(withoutSig(receipt));
+    const hash = sha256Hex(payload);
+    setHash(hash);
+    try {
+        receiptCanonicalAndConsistent(receipt); // steps 3-4
+    }
+    catch (e) {
+        if (e instanceof DatumeshError)
+            stop(e.code, e.detail, e.path);
+        throw e;
+    }
+    // Step 5.
+    const ref = receipt.computed_by;
+    const hashAt = ref.indexOf('#');
+    const host = ref.slice(0, hashAt);
+    const id = ref.slice(hashAt + 1);
+    const found = lookupKey(sources, host, id, receipt.issued);
+    if (!found.ok)
+        stop(found.code, found.detail, found.code === 'E_KEY_NOT_VALID' ? '$.issued' : '$.computed_by');
+    // Step 6.
+    if (!verifyEd25519Strict(fromHex(receipt.sig), payload, fromHex(found.key.public))) {
+        stop('E_SIGNATURE', 'Ed25519 verification failed', '$.sig');
+    }
+    return { receipt, hash };
+}
+function recompute(receipt, rc, sources) {
+    const cell = receipt.cell;
+    const cellArgs = cell.args;
+    // 7.1 Descriptor.
+    if (rc.descriptor === undefined || rc.descriptor === null)
+        stop('E_FN_UNAVAILABLE', `no descriptor for ${cell.fn_hash}`, '$.cell.fn_hash');
+    let desc;
+    try {
+        const d = toJson(rc.descriptor);
+        if (sha256Hex(jcsBytes(d)) !== cell.fn_hash)
+            stop('E_FN_HASH_MISMATCH', 'descriptor does not hash to cell.fn_hash', '$.cell.fn_hash');
+        validate(d, 'function', 'descriptor');
+        desc = d;
+    }
+    catch (e) {
+        if (e instanceof DatumeshError)
+            stop(e.code, `descriptor: ${e.detail}`, e.path);
+        throw e;
+    }
+    const sig = desc.signature;
+    const declared = sig.args;
+    // 7.2 Arguments: unknown, then missing, then types.
+    for (const k of sortedKeys(cellArgs)) {
+        if (!has(declared, k))
+            stop('E_ARG_UNKNOWN', `function declares no argument ${JSON.stringify(k)}`, `$.cell.args.${k}`);
+    }
+    for (const k of sortedKeys(declared)) {
+        if (!has(cellArgs, k))
+            stop('E_ARG_MISSING', `argument ${JSON.stringify(k)} is not bound`, '$.cell.args');
+    }
+    for (const k of sortedKeys(cellArgs)) {
+        const want = declared[k].type;
+        if (cellArgs[k].type !== want)
+            stop('E_ARG_TYPE', `${k} is declared ${String(want)}`, `$.cell.args.${k}`);
+    }
+    // 7.3 valid holds exactly the declared valid-time arguments.
+    const validNames = sortedKeys(receipt.valid);
+    const declaredValid = sortedKeys(declared).filter((k) => declared[k].valid === true);
+    if (validNames.join('\u0000') !== declaredValid.join('\u0000')) {
+        stop('E_VALID_MISMATCH', 'valid must echo exactly the declared valid-time arguments', '$.valid');
+    }
+    // 7.4 Return type: `returns`, or its `type` member when it is an object.
+    const rt = returnType(sig);
+    if (receipt.type !== rt)
+        stop('E_RETURN_TYPE', `function returns ${rt}`, '$.type');
+    // 7.5 Inputs.
+    const declaredInputs = desc.inputs;
+    const supplied = rc.inputs ?? {};
+    let latestTx = null;
+    for (const h of receipt.inputs) {
+        if (!Object.prototype.hasOwnProperty.call(supplied, h))
+            stop('E_INPUT_UNAVAILABLE', `input receipt ${h} not available`, '$.inputs');
+        let inner;
+        try {
+            inner = verifySigned(supplied[h], sources, () => undefined);
+        }
+        catch (e) {
+            if (e instanceof Stop)
+                stop('E_INPUT_INVALID', `input ${h}: ${e.code}: ${e.detail}`, '$.inputs');
+            throw e;
+        }
+        if (inner.hash !== h)
+            stop('E_INPUT_UNAVAILABLE', `supplied receipt does not hash to ${h}`, '$.inputs');
+        const ic = inner.receipt.cell;
+        if (!declaredInputs.includes(`${ic.ns}/${ic.fn}`)) {
+            stop('E_INPUT_UNDECLARED', `input ${h} is a cell of an undeclared function`, '$.inputs');
+        }
+        if (inner.receipt.asof !== receipt.asof)
+            stop('E_TIME_ORDER', "input receipts must share the receipt's asof", '$.inputs');
+        const itx = inner.receipt.tx;
+        if (latestTx === null || itx > latestTx)
+            latestTx = itx;
+    }
+    if (latestTx !== null && receipt.tx !== latestTx)
+        stop('E_TIME_ORDER', 'tx must be the latest input tx', '$.tx');
+    // 7.6 Value.
+    const v = rc.value;
+    if (v.type !== receipt.type || v.value !== receipt.value)
+        stop('E_VALUE_MISMATCH', 'recomputed value differs from the receipt', '$.value');
+}
+/**
+ * Step 7.7: content is only for a blob value (E_SCHEMA otherwise); it has exactly `length`
+ * bytes, then a SHA-256 equal to the blob's hash (E_BLOB_MISMATCH).
+ */
+function checkContent(receipt, content) {
+    if (receipt.type !== 'blob')
+        stop('E_SCHEMA', `content was supplied, but the value is a ${String(receipt.type)}, not a blob`, '$.type');
+    const blob = checkBlob(receipt.value, '$.value'); // already checked in step 3
+    if (content.length !== blob.length)
+        stop('E_BLOB_MISMATCH', `content is ${content.length} bytes, the blob says ${blob.length}`, '$.value');
+    if (sha256Hex(content) !== blob.sha256)
+        stop('E_BLOB_MISMATCH', "the content's SHA-256 is not the blob's hash", '$.value');
+}
+function checkBlobArg(b) {
+    if (b === undefined || b === null)
+        return null;
+    if (b instanceof Uint8Array)
+        return b;
+    if (b instanceof ArrayBuffer)
+        return new Uint8Array(b);
+    throw new TypeError('blob must be the content bytes (Uint8Array or ArrayBuffer)');
+}
+function checkRecomputeArg(rc) {
+    if (rc === undefined || rc === null)
+        return null;
+    if (typeof rc !== 'object' || Array.isArray(rc))
+        throw new TypeError('recompute must be an object {descriptor, inputs, value}');
+    const r = rc;
+    if (!r.value || typeof r.value !== 'object' || typeof r.value.type !== 'string' || (typeof r.value.value !== 'string' && typeof r.value.value !== 'boolean')) {
+        throw new TypeError('recompute.value must be the evaluated typed scalar {type, value}');
+    }
+    if (r.inputs !== undefined && (typeof r.inputs !== 'object' || r.inputs === null || Array.isArray(r.inputs))) {
+        throw new TypeError('recompute.inputs must be an object mapping receipt hash to receipt JSON');
+    }
+    return r;
+}
+/**
+ * Verify a receipt (SPEC 10.1). `receipt` is JSON text, UTF-8 bytes or a parsed object (only
+ * text and bytes allow duplicate-member detection). `keys` is a key document, a KeysResult, a
+ * {keyId: publicKeyHex} map, or an array of these. With `recompute`, step 7 runs too. With
+ * `blob`, the content of a blob value, step 7.7 runs last (after step 7 when recomputing,
+ * otherwise right after step 6): E_SCHEMA if the value is not a blob, E_BLOB_MISMATCH if the
+ * content does not match. It does not change `level`; `blobChecked` reports it.
+ *
+ * Never throws for an invalid receipt or bad key material; throws TypeError only when an
+ * argument is of the wrong kind altogether.
+ */
+export function verify(receipt, keys, recomputeArg, blob) {
+    const sources = collectSources(keys);
+    const rc = checkRecomputeArg(recomputeArg);
+    const content = checkBlobArg(blob);
+    let hash = null;
+    try {
+        const { receipt: r } = verifySigned(receipt, sources, (h) => (hash = h));
+        if (rc)
+            recompute(r, rc, sources);
+        const checked = content !== null;
+        if (checked)
+            checkContent(r, content);
+        const what = rc ? 'fully verified: signature valid and value recomputed' : `signature-valid: signed by ${r.computed_by}`;
+        return {
+            ok: true,
+            code: 'OK',
+            level: rc ? 'recomputed' : 'signed',
+            hash,
+            key: r.computed_by,
+            detail: checked ? `${what}; blob content matches` : what,
+            path: null,
+            blobChecked: checked,
+        };
+    }
+    catch (e) {
+        if (e instanceof Stop)
+            return { ok: false, code: e.code, level: null, hash, key: null, detail: e.detail, path: e.path, blobChecked: false };
+        throw e; // a bug in this library, not a property of the receipt
+    }
+}
+/** Steps 1-6 for an already-parsed receipt (used by checkEnvelope). Throws a Stop. */
+export function verifyEmbedded(receipt, sources) {
+    return verifySigned(receipt, sources, () => undefined);
+}
+export { Stop };