@datumesh/verify 0.0.0-stage → 0.2.0

package/dist/cjs/keys.d.ts

@@ -0,0 +1,73 @@
+import { type ErrorCode } from './errors.js';
+/** One validated key from a key document. */
+export interface KeyEntry {
+    alg: 'ed25519';
+    id: string;
+    public: string;
+    valid_from: string;
+    valid_to?: string;
+}
+/** The outcome of resolving one host's keys (SPEC 9.3). */
+export interface KeysResult {
+    ok: boolean;
+    /** "OK", "E_KEY_UNAVAILABLE" or "E_KEY_DOC". */
+    code: 'OK' | 'E_KEY_UNAVAILABLE' | 'E_KEY_DOC';
+    host: string;
+    detail: string;
+    /** The validated keys, in document order, when ok. */
+    keys?: KeyEntry[];
+}
+/** A mapping of key id to 64-hex public key: usable for any host, with no validity windows. */
+export type KeyMap = Record<string, string>;
+/** Anything `verify` accepts as keys. */
+export type KeySource = KeysResult | KeyMap | Record<string, unknown> | KeySource[];
+/**
+ * Interpret the HTTPS response for https://<host>/.well-known/datumesh.json (SPEC 9.3).
+ * `status` is the HTTP status, or null for a network, DNS, TLS or timeout failure. `body` is the
+ * response body as text or bytes. Never throws.
+ */
+export declare function keysFromResponse(host: string, status: number | null, body?: string | Uint8Array | null): KeysResult;
+/**
+ * Validate an already-parsed key document (its `host` member names the host it covers).
+ * Never throws.
+ */
+export declare function keysFromDocument(doc: unknown): KeysResult;
+/** Default timeout of fetchKeys, in milliseconds. */
+export declare const FETCH_TIMEOUT_MS = 10000;
+/**
+ * Fetch https://<host>/.well-known/datumesh.json once, with TLS verified by the platform, no
+ * redirects followed and a timeout, then interpret it with keysFromResponse. The only function
+ * in this library that touches the network. Never throws.
+ */
+export declare function fetchKeys(host: string, timeoutMs?: number): Promise<KeysResult>;
+interface HostSource {
+    host: string;
+    result: KeysResult;
+}
+interface AnySource {
+    ok: boolean;
+    code: ErrorCode | 'OK';
+    detail: string;
+    keys: KeyEntry[];
+}
+export interface Sources {
+    hosts: HostSource[];
+    any: AnySource[];
+}
+/**
+ * Normalise the `keys` argument of verify. Throws TypeError only for arguments that are not key
+ * sources at all (programmer errors); malformed key material becomes an error source.
+ */
+export declare function collectSources(keys: unknown, into?: Sources, depth?: number): Sources;
+export type KeyLookup = {
+    ok: true;
+    key: KeyEntry;
+    windows: boolean;
+} | {
+    ok: false;
+    code: ErrorCode;
+    detail: string;
+};
+/** SPEC 10.1 step 5 for key reference host#id at time `issued`. */
+export declare function lookupKey(sources: Sources, host: string, id: string, issued: string): KeyLookup;
+export {};

package/dist/cjs/keys.js

@@ -0,0 +1,257 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FETCH_TIMEOUT_MS = void 0;
+exports.keysFromResponse = keysFromResponse;
+exports.keysFromDocument = keysFromDocument;
+exports.fetchKeys = fetchKeys;
+exports.collectSources = collectSources;
+exports.lookupKey = lookupKey;
+// Key documents (SPEC.md 9.2), their retrieval (9.3) and the key sources `verify` accepts.
+const errors_js_1 = require("./errors.js");
+const hash_js_1 = require("./hash.js");
+const json_js_1 = require("./json.js");
+const lexical_js_1 = require("./lexical.js");
+class KeyDocError extends Error {
+    constructor(msg, path) {
+        super(msg);
+        this.path = path;
+    }
+}
+function bad(msg, path) {
+    throw new KeyDocError(msg, path);
+}
+/** Validate a parsed key document for `host` (SPEC 9.2). Throws KeyDocError. */
+function validateKeyDocument(doc, host) {
+    if (!(0, json_js_1.isObject)(doc))
+        bad('expected an object', '$');
+    for (const k of (0, json_js_1.sortedKeys)(doc))
+        if (!['host', 'keys', 'proto'].includes(k))
+            bad(`unexpected member ${JSON.stringify(k)}`, '$');
+    for (const k of ['host', 'keys', 'proto'])
+        if (!(0, json_js_1.has)(doc, k))
+            bad(`missing member ${JSON.stringify(k)}`, '$');
+    if (doc.proto !== 'datumesh/1')
+        bad("proto must be 'datumesh/1'", '$.proto');
+    if (doc.host !== host)
+        bad(`host must be ${JSON.stringify(host)}`, '$.host');
+    const keys = doc.keys;
+    if (!Array.isArray(keys) || keys.length < 1 || keys.length > lexical_js_1.LIMITS.keys)
+        bad(`keys must be an array of 1 to ${lexical_js_1.LIMITS.keys} keys`, '$.keys');
+    const out = [];
+    const seenIds = new Set();
+    const seenPublic = new Set();
+    keys.forEach((k, i) => {
+        const p = `$.keys[${i}]`;
+        if (!(0, json_js_1.isObject)(k))
+            bad('expected an object', p);
+        for (const m of (0, json_js_1.sortedKeys)(k))
+            if (!['alg', 'id', 'public', 'valid_from', 'valid_to'].includes(m))
+                bad(`unexpected member ${JSON.stringify(m)}`, p);
+        for (const m of ['alg', 'id', 'public', 'valid_from'])
+            if (!(0, json_js_1.has)(k, m))
+                bad(`missing member ${JSON.stringify(m)}`, p);
+        if (k.alg !== 'ed25519')
+            bad('alg must be ed25519', (0, json_js_1.memberPath)(p, 'alg'));
+        if (typeof k.id !== 'string' || !(0, lexical_js_1.isHex)(k.id, 16))
+            bad('id must be 16 lowercase hex digits', (0, json_js_1.memberPath)(p, 'id'));
+        if (typeof k.public !== 'string' || !(0, lexical_js_1.isHex)(k.public, 64))
+            bad('public must be 64 lowercase hex digits', (0, json_js_1.memberPath)(p, 'public'));
+        if (typeof k.valid_from !== 'string' || !(0, lexical_js_1.isInstant)(k.valid_from))
+            bad('valid_from must be an instant', (0, json_js_1.memberPath)(p, 'valid_from'));
+        if ((0, json_js_1.has)(k, 'valid_to')) {
+            if (typeof k.valid_to !== 'string' || !(0, lexical_js_1.isInstant)(k.valid_to))
+                bad('valid_to must be an instant', (0, json_js_1.memberPath)(p, 'valid_to'));
+            if (!(k.valid_to > k.valid_from))
+                bad('valid_to must be later than valid_from', p);
+        }
+        if ((0, hash_js_1.keyIdOf)((0, hash_js_1.fromHex)(k.public)) !== k.id)
+            bad('id is not the key id of public', (0, json_js_1.memberPath)(p, 'id'));
+        if (seenIds.has(k.id) || seenPublic.has(k.public))
+            bad('key appears twice', p);
+        seenIds.add(k.id);
+        seenPublic.add(k.public);
+        const e = { alg: 'ed25519', id: k.id, public: k.public, valid_from: k.valid_from };
+        if ((0, json_js_1.has)(k, 'valid_to'))
+            e.valid_to = k.valid_to;
+        out.push(e);
+    });
+    return out;
+}
+function docResult(host, parse) {
+    let doc;
+    try {
+        doc = parse();
+    }
+    catch (e) {
+        const d = e instanceof errors_js_1.DatumeshError ? `${e.code}: ${e.detail}` : String(e);
+        return { ok: false, code: 'E_KEY_DOC', host, detail: `key document is not strict JSON (${d})` };
+    }
+    try {
+        const keys = validateKeyDocument(doc, host);
+        return { ok: true, code: 'OK', host, detail: `${keys.length} key(s) for ${host}`, keys };
+    }
+    catch (e) {
+        if (e instanceof KeyDocError)
+            return { ok: false, code: 'E_KEY_DOC', host, detail: `${e.message} at ${e.path}` };
+        throw e;
+    }
+}
+/**
+ * Interpret the HTTPS response for https://<host>/.well-known/datumesh.json (SPEC 9.3).
+ * `status` is the HTTP status, or null for a network, DNS, TLS or timeout failure. `body` is the
+ * response body as text or bytes. Never throws.
+ */
+function keysFromResponse(host, status, body) {
+    const h = typeof host === 'string' ? host : String(host);
+    try {
+        if (status === null || status === undefined) {
+            return { ok: false, code: 'E_KEY_UNAVAILABLE', host: h, detail: 'network, DNS, TLS or timeout failure' };
+        }
+        if (status !== 200) {
+            return { ok: false, code: 'E_KEY_UNAVAILABLE', host: h, detail: `HTTP status ${String(status)} (only 200 is accepted; redirects are not followed)` };
+        }
+        if (typeof body !== 'string' && !(body instanceof Uint8Array)) {
+            return { ok: false, code: 'E_KEY_DOC', host: h, detail: '200 response without a body' };
+        }
+        return docResult(h, () => (0, json_js_1.toJson)(body));
+    }
+    catch (e) {
+        return { ok: false, code: 'E_KEY_UNAVAILABLE', host: h, detail: `could not interpret the response: ${String(e)}` };
+    }
+}
+/**
+ * Validate an already-parsed key document (its `host` member names the host it covers).
+ * Never throws.
+ */
+function keysFromDocument(doc) {
+    const host = (0, json_js_1.isObject)(doc) && typeof doc.host === 'string' ? doc.host : '';
+    try {
+        return docResult(host, () => (0, json_js_1.toJson)(doc));
+    }
+    catch (e) {
+        return { ok: false, code: 'E_KEY_DOC', host, detail: String(e) };
+    }
+}
+/** Default timeout of fetchKeys, in milliseconds. */
+exports.FETCH_TIMEOUT_MS = 10000;
+/**
+ * Fetch https://<host>/.well-known/datumesh.json once, with TLS verified by the platform, no
+ * redirects followed and a timeout, then interpret it with keysFromResponse. The only function
+ * in this library that touches the network. Never throws.
+ */
+async function fetchKeys(host, timeoutMs = exports.FETCH_TIMEOUT_MS) {
+    try {
+        (0, lexical_js_1.checkDnsName)(host, '$');
+    }
+    catch {
+        return { ok: false, code: 'E_KEY_UNAVAILABLE', host: String(host), detail: 'host is not a lowercase DNS name (SPEC 2.1); nothing was fetched' };
+    }
+    const f = globalThis.fetch;
+    if (typeof f !== 'function')
+        return { ok: false, code: 'E_KEY_UNAVAILABLE', host, detail: 'no global fetch in this runtime' };
+    let status;
+    let body;
+    try {
+        const res = await f(`https://${host}/.well-known/datumesh.json`, {
+            method: 'GET',
+            redirect: 'manual',
+            credentials: 'omit',
+            signal: AbortSignal.timeout(timeoutMs),
+        });
+        status = res.status;
+        // A redirect under redirect:"manual" is a 3xx (Node) or an opaque-redirect response with
+        // status 0 (browsers); either way it is not 200.
+        if (res.type === 'opaqueredirect')
+            status = 0;
+        if (status !== 200)
+            return keysFromResponse(host, status);
+        body = new Uint8Array(await res.arrayBuffer());
+    }
+    catch (e) {
+        return { ok: false, code: 'E_KEY_UNAVAILABLE', host, detail: `retrieval failed: ${e instanceof Error ? e.message : String(e)}` };
+    }
+    return keysFromResponse(host, status, body);
+}
+function isKeysResult(v) {
+    return typeof v.ok === 'boolean' && typeof v.code === 'string' && typeof v.host === 'string';
+}
+function fromMap(m) {
+    const keys = [];
+    for (const id of Object.keys(m)) {
+        const pub = m[id];
+        if (!(0, lexical_js_1.isHex)(id, 16) || typeof pub !== 'string' || !(0, lexical_js_1.isHex)(pub, 64) || (0, hash_js_1.keyIdOf)((0, hash_js_1.fromHex)(pub)) !== id) {
+            return { ok: false, code: 'E_KEY_DOC', detail: `key map entry ${JSON.stringify(id)} is not <key id>: <64-hex public key> with a matching id`, keys: [] };
+        }
+        keys.push({ alg: 'ed25519', id, public: pub, valid_from: '0001-01-01T00:00:00.000000Z' });
+    }
+    return { ok: true, code: 'OK', detail: 'key map (any host, no validity windows)', keys };
+}
+/**
+ * Normalise the `keys` argument of verify. Throws TypeError only for arguments that are not key
+ * sources at all (programmer errors); malformed key material becomes an error source.
+ */
+function collectSources(keys, into = { hosts: [], any: [] }, depth = 0) {
+    if (Array.isArray(keys)) {
+        if (depth > 8)
+            throw new TypeError('keys: arrays nested too deeply');
+        for (const k of keys)
+            collectSources(k, into, depth + 1);
+        return into;
+    }
+    if (typeof keys !== 'object' || keys === null) {
+        throw new TypeError('keys must be a key document, a KeysResult, a {keyId: publicKeyHex} map, or an array of these');
+    }
+    const o = keys;
+    if (isKeysResult(o)) {
+        const r = o;
+        if (r.ok) {
+            // Re-check what a caller may have built by hand.
+            const ok = Array.isArray(r.keys) && r.keys.every((k) => k && (0, lexical_js_1.isHex)(k.id, 16) && (0, lexical_js_1.isHex)(k.public, 64) && (0, lexical_js_1.isInstant)(k.valid_from) && (k.valid_to === undefined || (0, lexical_js_1.isInstant)(k.valid_to)));
+            into.hosts.push({ host: r.host, result: ok ? r : { ok: false, code: 'E_KEY_DOC', host: r.host, detail: 'KeysResult has malformed keys' } });
+        }
+        else {
+            const code = r.code === 'E_KEY_DOC' ? 'E_KEY_DOC' : 'E_KEY_UNAVAILABLE';
+            into.hosts.push({ host: r.host, result: { ok: false, code, host: r.host, detail: String(r.detail ?? '') } });
+        }
+        return into;
+    }
+    if ('keys' in o || 'host' in o || 'proto' in o) {
+        const r = keysFromDocument(o);
+        if (r.host)
+            into.hosts.push({ host: r.host, result: r });
+        else
+            into.any.push({ ok: false, code: 'E_KEY_DOC', detail: `key document without a host: ${r.detail}`, keys: [] });
+        return into;
+    }
+    into.any.push(fromMap(o));
+    return into;
+}
+/** SPEC 10.1 step 5 for key reference host#id at time `issued`. */
+function lookupKey(sources, host, id, issued) {
+    const h = sources.hosts.find((s) => s.host === host);
+    let keys;
+    let windows;
+    if (h) {
+        if (!h.result.ok)
+            return { ok: false, code: h.result.code, detail: `${host}: ${h.result.detail}` };
+        keys = h.result.keys ?? [];
+        windows = true;
+    }
+    else if (sources.any.length) {
+        const a = sources.any[0];
+        if (!a.ok)
+            return { ok: false, code: a.code, detail: a.detail };
+        keys = a.keys;
+        windows = false;
+    }
+    else {
+        return { ok: false, code: 'E_KEY_UNAVAILABLE', detail: `no key source covers ${host}` };
+    }
+    const key = keys.find((k) => k.id === id);
+    if (!key)
+        return { ok: false, code: 'E_KEY_UNKNOWN', detail: `${host} publishes no key ${id}` };
+    if (windows && !(key.valid_from <= issued && (key.valid_to === undefined || issued < key.valid_to))) {
+        return { ok: false, code: 'E_KEY_NOT_VALID', detail: `issued ${issued} is outside the window of key ${id}` };
+    }
+    return { ok: true, key, windows };
+}

package/dist/cjs/lexical.d.ts

@@ -0,0 +1,69 @@
+export declare const LIMITS: {
+    readonly name: 64;
+    readonly function_name: 512;
+    readonly args: 32;
+    readonly number: 128;
+    readonly string: 1024;
+    readonly summary: 1024;
+    readonly body: 1048576;
+    readonly inputs: 4096;
+    readonly licence_spdx: 64;
+    readonly licence_url: 512;
+    readonly keys: 64;
+};
+export declare const TYPES: readonly ["blob", "boolean", "date", "instant", "number", "string"];
+export type TypeName = (typeof TYPES)[number];
+export declare const VALID_TIME_TYPES: readonly string[];
+export declare function isTypeName(t: unknown): t is TypeName;
+/** SPEC 2.2. Grammar first (`code`), then the 64-character limit (E_CANON_LIMIT). */
+export declare function checkName(s: string, path: string, code?: 'E_CANON_NAME' | 'E_CANON_ARG_NAME'): void;
+/** SPEC 2.4: a name that is not `asof` and does not start with `dm_`. */
+export declare function checkArgName(s: string, path: string): void;
+/** SPEC 2.1. Every failure is E_CANON_NAME. */
+export declare function checkDnsName(s: string, path: string): void;
+/** SPEC 2.3: dns-name *( "/" name ). */
+export declare function checkNamespace(s: string, path: string): void;
+/** SPEC 2.3: namespace "/" name, at most 512 characters. */
+export declare function checkFunctionName(s: string, path: string): void;
+export declare function isHex(s: string, digits: number): boolean;
+export declare function checkHex(s: string, digits: number, path: string): void;
+/** SPEC 9.1: `<host>#<key id>`. Host failures are E_CANON_NAME, key id failures E_CANON_HEX. */
+export declare function checkKeyRef(s: string, path: string): {
+    host: string;
+    id: string;
+};
+/** SPEC 3.1: a canonical decimal of at most 128 characters. */
+export declare function isNumber(s: string): boolean;
+/** SPEC 3.1. Grammar (E_CANON_NUMBER) before the 128-character limit (E_CANON_LIMIT). */
+export declare function checkNumber(s: string, path: string): void;
+export declare function isDate(s: string): boolean;
+export declare function isInstant(s: string): boolean;
+/** SPEC 3.2. */
+export declare function checkDate(s: string, path: string): void;
+/** SPEC 3.3. */
+export declare function checkInstant(s: string, path: string): void;
+/**
+ * SPEC 3.5, in its order: characters, then NFC, then the UTF-8 length limit. With `body`
+ * set, TAB and LF are allowed and the limit is 1 MiB (SPEC 7, `code.body`).
+ */
+export declare function checkString(s: string, path: string, opts?: {
+    body?: boolean;
+    limit?: number;
+}): void;
+export declare const MEDIA_TYPE_MAX = 128;
+/** SPEC 3.7. Grammar, then length <= 2^53 - 1, then media type <= 128 characters; all E_CANON_BLOB. */
+export declare function checkBlob(s: string, path: string): {
+    sha256: string;
+    length: number;
+    mediaType: string;
+};
+export declare const URL_RE: RegExp;
+/**
+ * SPEC 8.1 `licence`: an SPDX licence identifier or an https:// URL. SPEC.md gives no grammar;
+ * this follows schemas/receipt.schema.json (and the reference tool): an identifier matches
+ * [A-Za-z0-9][A-Za-z0-9.+-]* (at most 64 characters), a URL is "https://" followed by one or more
+ * printable ASCII characters other than space (at most 512). Grammar before length.
+ */
+export declare function checkLicence(s: string, path: string): void;
+/** Value of a typed scalar against its (known) type: JSON type first, then the lexical form. */
+export declare function checkTypedValue(type: TypeName, value: unknown, path: string): void;

package/dist/cjs/lexical.js

@@ -0,0 +1,231 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.URL_RE = exports.MEDIA_TYPE_MAX = exports.VALID_TIME_TYPES = exports.TYPES = exports.LIMITS = void 0;
+exports.isTypeName = isTypeName;
+exports.checkName = checkName;
+exports.checkArgName = checkArgName;
+exports.checkDnsName = checkDnsName;
+exports.checkNamespace = checkNamespace;
+exports.checkFunctionName = checkFunctionName;
+exports.isHex = isHex;
+exports.checkHex = checkHex;
+exports.checkKeyRef = checkKeyRef;
+exports.isNumber = isNumber;
+exports.checkNumber = checkNumber;
+exports.isDate = isDate;
+exports.isInstant = isInstant;
+exports.checkDate = checkDate;
+exports.checkInstant = checkInstant;
+exports.checkString = checkString;
+exports.checkBlob = checkBlob;
+exports.checkLicence = checkLicence;
+exports.checkTypedValue = checkTypedValue;
+// Lexical rules of SPEC.md sections 2-3 and 8.1. Each check throws a DatumeshError with the
+// code the spec assigns; where the spec does not order two checks, the order chosen is noted
+// (and recorded in DEFECTS.md).
+const errors_js_1 = require("./errors.js");
+const unicode_js_1 = require("./unicode.js");
+const utf8_js_1 = require("./utf8.js");
+exports.LIMITS = {
+    name: 64,
+    function_name: 512,
+    args: 32,
+    number: 128,
+    string: 1024,
+    summary: 1024,
+    body: 1048576,
+    inputs: 4096,
+    licence_spdx: 64,
+    licence_url: 512,
+    keys: 64,
+};
+exports.TYPES = ['blob', 'boolean', 'date', 'instant', 'number', 'string'];
+exports.VALID_TIME_TYPES = ['date', 'instant', 'string'];
+function isTypeName(t) {
+    return typeof t === 'string' && exports.TYPES.includes(t);
+}
+const NAME_RE = /^[a-z][a-z0-9]*(?:_[a-z0-9]+)*$/;
+const LABEL_RE = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
+/** SPEC 2.2. Grammar first (`code`), then the 64-character limit (E_CANON_LIMIT). */
+function checkName(s, path, code = 'E_CANON_NAME') {
+    if (!NAME_RE.test(s))
+        (0, errors_js_1.fail)(code, `not a lowercase snake_case name: ${JSON.stringify(s)}`, path);
+    if (s.length > exports.LIMITS.name)
+        (0, errors_js_1.fail)('E_CANON_LIMIT', `name longer than ${exports.LIMITS.name} characters`, path);
+}
+/** SPEC 2.4: a name that is not `asof` and does not start with `dm_`. */
+function checkArgName(s, path) {
+    checkName(s, path, 'E_CANON_ARG_NAME');
+    if (s === 'asof' || s.startsWith('dm_'))
+        (0, errors_js_1.fail)('E_CANON_ARG_NAME', `reserved argument name ${JSON.stringify(s)}`, path);
+}
+/** SPEC 2.1. Every failure is E_CANON_NAME. */
+function checkDnsName(s, path) {
+    const labels = s.split('.');
+    if (labels.length < 2)
+        (0, errors_js_1.fail)('E_CANON_NAME', `DNS name needs at least two labels: ${JSON.stringify(s)}`, path);
+    for (const l of labels) {
+        if (l.length < 1 || l.length > 63 || !LABEL_RE.test(l))
+            (0, errors_js_1.fail)('E_CANON_NAME', `bad DNS label ${JSON.stringify(l)}`, path);
+    }
+    if (/^[0-9]+$/.test(labels[labels.length - 1]))
+        (0, errors_js_1.fail)('E_CANON_NAME', 'top-level label is numeric', path);
+    if (s.length > 253)
+        (0, errors_js_1.fail)('E_CANON_NAME', 'DNS name longer than 253 characters', path);
+}
+/** SPEC 2.3: dns-name *( "/" name ). */
+function checkNamespace(s, path) {
+    const parts = s.split('/');
+    checkDnsName(parts[0], path);
+    for (const seg of parts.slice(1))
+        checkName(seg, path);
+}
+/** SPEC 2.3: namespace "/" name, at most 512 characters. */
+function checkFunctionName(s, path) {
+    const i = s.lastIndexOf('/');
+    if (i < 0)
+        (0, errors_js_1.fail)('E_CANON_NAME', `function name has no namespace: ${JSON.stringify(s)}`, path);
+    checkNamespace(s.slice(0, i), path);
+    checkName(s.slice(i + 1), path);
+    if (s.length > exports.LIMITS.function_name)
+        (0, errors_js_1.fail)('E_CANON_LIMIT', 'function name too long', path);
+}
+function isHex(s, digits) {
+    return s.length === digits && /^[0-9a-f]*$/.test(s);
+}
+function checkHex(s, digits, path) {
+    if (!isHex(s, digits))
+        (0, errors_js_1.fail)('E_CANON_HEX', `expected ${digits} lowercase hex digits`, path);
+}
+/** SPEC 9.1: `<host>#<key id>`. Host failures are E_CANON_NAME, key id failures E_CANON_HEX. */
+function checkKeyRef(s, path) {
+    const i = s.indexOf('#');
+    const host = i < 0 ? s : s.slice(0, i);
+    checkDnsName(host, path);
+    if (i < 0)
+        (0, errors_js_1.fail)('E_CANON_NAME', 'key reference is <host>#<key id>', path);
+    const id = s.slice(i + 1);
+    checkHex(id, 16, path);
+    return { host, id };
+}
+const NUMBER_RE = /^-?(?:0|[1-9][0-9]*)(?:\.[0-9]*[1-9])?$/;
+/** SPEC 3.1: a canonical decimal of at most 128 characters. */
+function isNumber(s) {
+    return NUMBER_RE.test(s) && s !== '-0' && s.length <= exports.LIMITS.number;
+}
+/** SPEC 3.1. Grammar (E_CANON_NUMBER) before the 128-character limit (E_CANON_LIMIT). */
+function checkNumber(s, path) {
+    if (!NUMBER_RE.test(s) || s === '-0')
+        (0, errors_js_1.fail)('E_CANON_NUMBER', `not a canonical decimal: ${JSON.stringify(s)}`, path);
+    if (s.length > exports.LIMITS.number)
+        (0, errors_js_1.fail)('E_CANON_LIMIT', `number longer than ${exports.LIMITS.number} characters`, path);
+}
+function isCalendarDay(y, m, d) {
+    if (y < 1 || y > 9999 || m < 1 || m > 12 || d < 1)
+        return false;
+    const leap = (y % 4 === 0 && y % 100 !== 0) || y % 400 === 0;
+    const dim = [31, leap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31][m - 1];
+    return d <= dim;
+}
+const DATE_RE = /^([0-9]{4})-([0-9]{2})-([0-9]{2})$/;
+const INSTANT_RE = /^([0-9]{4})-([0-9]{2})-([0-9]{2})T([0-9]{2}):([0-9]{2}):([0-9]{2})\.[0-9]{6}Z$/;
+function isDate(s) {
+    const m = DATE_RE.exec(s);
+    return !!m && isCalendarDay(+m[1], +m[2], +m[3]);
+}
+function isInstant(s) {
+    const m = INSTANT_RE.exec(s);
+    return !!m && isCalendarDay(+m[1], +m[2], +m[3]) && +m[4] <= 23 && +m[5] <= 59 && +m[6] <= 59;
+}
+/** SPEC 3.2. */
+function checkDate(s, path) {
+    if (!isDate(s))
+        (0, errors_js_1.fail)('E_CANON_DATE', `not a YYYY-MM-DD calendar date: ${JSON.stringify(s)}`, path);
+}
+/** SPEC 3.3. */
+function checkInstant(s, path) {
+    if (!isInstant(s))
+        (0, errors_js_1.fail)('E_CANON_INSTANT', `not YYYY-MM-DDTHH:MM:SS.ffffffZ: ${JSON.stringify(s)}`, path);
+}
+/**
+ * SPEC 3.5, in its order: characters, then NFC, then the UTF-8 length limit. With `body`
+ * set, TAB and LF are allowed and the limit is 1 MiB (SPEC 7, `code.body`).
+ */
+function checkString(s, path, opts = {}) {
+    const cps = (0, unicode_js_1.codePoints)(s);
+    for (const cp of cps) {
+        if (cp >= 0xd800 && cp <= 0xdfff)
+            (0, errors_js_1.fail)('E_CANON_STRING', `surrogate code point U+${hex4(cp)}`, path);
+        if (cp <= 0x1f || (cp >= 0x7f && cp <= 0x9f)) {
+            if (!(opts.body && (cp === 0x09 || cp === 0x0a)))
+                (0, errors_js_1.fail)('E_CANON_STRING', `control character U+${hex4(cp)}`, path);
+        }
+        if (!(0, unicode_js_1.isAssigned)(cp))
+            (0, errors_js_1.fail)('E_CANON_STRING', `code point U+${hex4(cp)} is not assigned in Unicode 15.1`, path);
+    }
+    if (!(0, unicode_js_1.isNFC)(s))
+        (0, errors_js_1.fail)('E_CANON_STRING', 'not in Normalization Form C', path);
+    const limit = opts.limit ?? (opts.body ? exports.LIMITS.body : exports.LIMITS.string);
+    if ((0, utf8_js_1.utf8Length)(s) > limit)
+        (0, errors_js_1.fail)('E_CANON_LIMIT', `longer than ${limit} UTF-8 bytes`, path);
+}
+function hex4(cp) {
+    return cp.toString(16).toUpperCase().padStart(4, '0');
+}
+// SPEC 3.7: <sha256>:<length>:<type>/<subtype>, with RFC 6838 restricted names in lowercase.
+const BLOB_RE = /^[0-9a-f]{64}:(0|[1-9][0-9]*):([a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*)$/;
+const MAX_SAFE = '9007199254740991';
+exports.MEDIA_TYPE_MAX = 128;
+/** SPEC 3.7. Grammar, then length <= 2^53 - 1, then media type <= 128 characters; all E_CANON_BLOB. */
+function checkBlob(s, path) {
+    const m = BLOB_RE.exec(s);
+    if (!m)
+        (0, errors_js_1.fail)('E_CANON_BLOB', `not <sha256>:<length>:<type/subtype>: ${JSON.stringify(s)}`, path);
+    const len = m[1];
+    if (len.length > MAX_SAFE.length || (len.length === MAX_SAFE.length && len > MAX_SAFE))
+        (0, errors_js_1.fail)('E_CANON_BLOB', `length above ${MAX_SAFE}`, path);
+    if (m[2].length > exports.MEDIA_TYPE_MAX)
+        (0, errors_js_1.fail)('E_CANON_BLOB', `media type longer than ${exports.MEDIA_TYPE_MAX} characters`, path);
+    return { sha256: s.slice(0, 64), length: Number(len), mediaType: m[2] };
+}
+const SPDX_RE = /^[A-Za-z0-9][A-Za-z0-9.+-]*$/;
+exports.URL_RE = /^https:\/\/[!-~]+$/;
+/**
+ * SPEC 8.1 `licence`: an SPDX licence identifier or an https:// URL. SPEC.md gives no grammar;
+ * this follows schemas/receipt.schema.json (and the reference tool): an identifier matches
+ * [A-Za-z0-9][A-Za-z0-9.+-]* (at most 64 characters), a URL is "https://" followed by one or more
+ * printable ASCII characters other than space (at most 512). Grammar before length.
+ */
+function checkLicence(s, path) {
+    if (s.startsWith('https://')) {
+        if (!exports.URL_RE.test(s))
+            (0, errors_js_1.fail)('E_CANON_LICENCE', 'licence URL has characters outside printable ASCII', path);
+        if (s.length > exports.LIMITS.licence_url)
+            (0, errors_js_1.fail)('E_CANON_LIMIT', 'licence URL too long', path);
+        return;
+    }
+    if (!SPDX_RE.test(s))
+        (0, errors_js_1.fail)('E_CANON_LICENCE', `not an SPDX identifier or https URL: ${JSON.stringify(s)}`, path);
+    if (s.length > exports.LIMITS.licence_spdx)
+        (0, errors_js_1.fail)('E_CANON_LIMIT', 'licence identifier too long', path);
+}
+/** Value of a typed scalar against its (known) type: JSON type first, then the lexical form. */
+function checkTypedValue(type, value, path) {
+    if (type === 'boolean') {
+        if (typeof value !== 'boolean')
+            (0, errors_js_1.fail)('E_CANON_TYPE', 'boolean value must be JSON true or false', path);
+        return;
+    }
+    if (typeof value !== 'string')
+        (0, errors_js_1.fail)('E_CANON_TYPE', `${type} value must be a JSON string`, path);
+    if (type === 'number')
+        checkNumber(value, path);
+    else if (type === 'date')
+        checkDate(value, path);
+    else if (type === 'instant')
+        checkInstant(value, path);
+    else if (type === 'blob')
+        checkBlob(value, path);
+    else
+        checkString(value, path);
+}

package/dist/cjs/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}