@decidio/verify 0.1.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,31 @@
+# @decidio/verify
+
+**Standalone, zero-dependency verifier for Decidio Authority Receipts.** Verify a sealed receipt's signature, content binding, and chain order **offline — with no Decidio dependency**. A record you can verify only with the vendor's software isn't really owned; this is what makes "the customer owns the record" true rather than rhetorical.
+
+```bash
+npx @decidio/verify receipt.json                 # one receipt
+npx @decidio/verify r1.json r2.json r3.json      # each + the chain order
+```
+
+```ts
+import { verifyReceipt, verifyChain } from "@decidio/verify";
+const r = verifyReceipt(vc);   // { valid, issuer, contentBound, recordId, reason? }
+```
+
+## What it checks (offline, using only the public DID in the receipt)
+1. **Content binding** — re-derives `sha256((prevHash||"") + recordCanonical)` and confirms it equals the signed `contentHash`, so the signature commits to the actual content (tamper-evident).
+2. **Signature** — verifies a W3C Data Integrity proof (`DataIntegrityProof`, cryptosuite
+   `eddsa-jcs-2022`, Ed25519 via `did:key`) over the WHOLE receipt: the signing input is
+   `SHA-256(JCS(proof options))` followed by `SHA-256(JCS(receipt without proof))`, per
+   [Data Integrity EdDSA Cryptosuites v1.0](https://www.w3.org/TR/vc-di-eddsa/) §3.3.
+   Verification needs only SHA-256, Ed25519, base58 and RFC 8785 — no JSON-LD, no context
+   fetching, no DID resolution, no network.
+   *Receipts sealed before 2026-08-04 carry a pre-standard Decidio format under the name
+   `eddsa-2022`; those are refused with an explicit reason, not reported as tampered.*
+3. **Chain** (`verifyChain`) — each receipt's `prevHash` links to the prior `contentHash`, and every receipt independently verifies.
+
+Signature + content + chain verify **offline**. Revocation/status is a separate, network-bound check by design — a receipt is tamper-evidence, not a liveness check.
+
+## Parity
+A Python verifier ships in `decidio[verify]` (`python -m decidio.verify`). Both verifiers accept the **same** real Decidio seals — proven in the cross-language conformance suite. Zero dependencies beyond `node:crypto` (TS) / `cryptography` (Python).
+

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,113 @@
+#!/usr/bin/env node
+// decidio-verify <receipt.json> [<receipt2.json> ...]
+//   One file  → verify that receipt.   Many files → verify each AND the chain order.
+// Exit 0 only if everything verifies. No network, no Decidio dependency.
+import { readFileSync } from "node:fs";
+import { verifyReceipt, verifyChain } from "./verify.js";
+/** Parse a receipt, REFUSING duplicate object keys. RFC 8785 §3.1 requires duplicate-free input,
+ *  and JSON.parse silently keeps the last one — so a file containing
+ *  `"issuer":"did:key:zEVIL","issuer":"<real>"` verifies while a human (or any parser that keeps the
+ *  FIRST duplicate) reads the attacker's value. Same bytes, two different answers: refuse instead. */
+function parseStrict(text, file) {
+    const value = JSON.parse(text); // also validates the syntax the scanner below assumes
+    // A reviver cannot help here — duplicates are already collapsed by the time it runs — so detect
+    // them by re-walking the raw text.
+    const dup = findDuplicateKey(text);
+    if (dup)
+        throw new Error(`${file}: duplicate JSON key ${JSON.stringify(dup)} — RFC 8785 requires duplicate-free input, and different parsers disagree on which value is real`);
+    return value;
+}
+/** Minimal string-aware scanner: collects key names per object nesting level and reports the first
+ *  repeated one. Deliberately simple — it only needs to be correct on well-formed JSON, which
+ *  JSON.parse has already confirmed by the time this runs.
+ *
+ *  Keys are UNESCAPED before comparison. Comparing raw token text let `"issuer"` and
+ *  `"issuer"` register as two different keys while JSON.parse had already collapsed them into one
+ *  holding the LAST value — so the escaped form bypassed this check entirely, and because Python's
+ *  object_pairs_hook sees keys after unescaping, the two CLIs disagreed on the same file. A
+ *  cross-language divergence is the one outcome this tool exists to prevent. */
+function findDuplicateKey(text) {
+    const stack = [];
+    let i = 0;
+    const readString = () => {
+        let out = "";
+        i++; // opening quote
+        while (i < text.length) {
+            const ch = text[i];
+            if (ch === "\\") {
+                out += text[i] + text[i + 1];
+                i += 2;
+                continue;
+            }
+            if (ch === '"') {
+                i++;
+                return out;
+            }
+            out += ch;
+            i++;
+        }
+        return out;
+    };
+    while (i < text.length) {
+        const ch = text[i];
+        if (ch === '"') {
+            const s = readString();
+            // A string immediately followed by ':' (modulo whitespace) is a KEY.
+            let j = i;
+            while (j < text.length && /\s/.test(text[j]))
+                j++;
+            if (text[j] === ":" && stack.length > 0) {
+                // Unescape via the parser itself — safe because parseStrict already JSON.parse'd the whole
+                // file, so this token is known well-formed.
+                const key = JSON.parse(`"${s}"`);
+                const top = stack[stack.length - 1];
+                if (top.has(key))
+                    return key;
+                top.add(key);
+            }
+            continue;
+        }
+        if (ch === "{")
+            stack.push(new Set());
+        else if (ch === "}")
+            stack.pop();
+        i++;
+    }
+    return null;
+}
+function main(argv) {
+    const args = argv.slice(2);
+    // Optional: --issuer did:key:z...  → assert the receipt was issued by THIS DID (Decidio's
+    // published issuer), not merely validly self-signed by some key.
+    const issIdx = args.indexOf("--issuer");
+    const expectedIssuer = issIdx >= 0 ? args[issIdx + 1] : undefined;
+    const files = args.filter((a, i) => !a.startsWith("--") && !(issIdx >= 0 && i === issIdx + 1));
+    if (files.length === 0) {
+        console.error("usage: decidio-verify [--issuer <did:key>] <receipt.json> [more.json ...]");
+        return 2;
+    }
+    let vcs;
+    try {
+        vcs = files.map((f) => parseStrict(readFileSync(f, "utf8"), f));
+    }
+    catch (e) {
+        // A file we cannot read unambiguously is a REFUSAL, reported like any other, not a stack trace.
+        console.log(`✘ INVALID  ${String(e?.message ?? e)}`);
+        return 1;
+    }
+    let allOk = true;
+    vcs.forEach((vc, i) => {
+        const r = verifyReceipt(vc, expectedIssuer);
+        allOk = allOk && r.valid;
+        console.log(`${r.valid ? "✔ VALID  " : "✘ INVALID"}  ${files[i]}`);
+        console.log(`    record: ${r.recordId ?? "?"}   issuer: ${r.issuer}`);
+        console.log(`    content-bound: ${r.contentBound}${r.reason ? `   reason: ${r.reason}` : ""}`);
+    });
+    if (vcs.length > 1) {
+        const c = verifyChain(vcs, expectedIssuer);
+        allOk = allOk && c.valid;
+        console.log(`\nchain: ${c.valid ? "✔ intact" : "✘ broken"} (${c.length}/${vcs.length})${c.reason ? ` — ${c.reason}` : ""}`);
+    }
+    return allOk ? 0 : 1;
+}
+process.exit(main(process.argv));

package/dist/verify.d.ts

@@ -0,0 +1,21 @@
+export declare function jcsCanonicalize(value: unknown): string;
+export interface VerifyResult {
+    valid: boolean;
+    issuer: string;
+    contentBound: boolean;
+    recordId?: string;
+    dNumber?: string | null;
+    prevHash?: string | null;
+    reason?: string;
+}
+/** Verify a Decidio Authority Receipt (W3C VC, DataIntegrityProof / eddsa-jcs-2022) offline.
+ *  Pass `expectedIssuer` (Decidio's published did:key) to assert the receipt was issued by
+ *  Decidio — a valid signature by *some* key is not proof of *who* issued it. */
+export declare function verifyReceipt(vc: any, expectedIssuer?: string): VerifyResult;
+/** Verify an ordered chain: each receipt's prevHash must equal the prior contentHash,
+ *  and every receipt must independently verify. Proves tamper-evident ordering. */
+export declare function verifyChain(vcs: any[], expectedIssuer?: string): {
+    valid: boolean;
+    length: number;
+    reason?: string;
+};

package/dist/verify.js

@@ -0,0 +1,208 @@
+// @decidio/verify — STANDALONE open verifier for Decidio Authority Receipts.
+//
+// Zero dependencies (node:crypto only), zero Decidio coupling. A customer, auditor, or
+// counterparty can verify a sealed receipt OFFLINE, with their own tooling — never only through
+// Decidio's software. That is what makes "the customer owns the record" true rather than rhetorical.
+//
+// The receipt is a W3C Verifiable Credential secured with a DataIntegrityProof using the
+// `eddsa-jcs-2022` cryptosuite (Data Integrity EdDSA Cryptosuites v1.0 — W3C Recommendation,
+// 15 May 2025). That suite was chosen deliberately: verifying needs only SHA-256, Ed25519, base58
+// and RFC 8785 canonicalisation — no JSON-LD expansion, no RDF canonicalisation, no context
+// fetching, no DID resolution, no network. This file is ~150 lines and depends on nothing, which is
+// the proof of that claim: you do not have to trust it, you can re-implement it.
+//
+// It checks, using ONLY the public DID embedded in the receipt:
+//   1. issuer — the DID is Ed25519 and (when you pin one) is the issuer you expected;
+//   2. content binding — re-derive sha256((prevHash||"") + recordCanonical) and confirm it equals
+//      the receipt's contentHash, so the signature commits to the actual record content;
+//   3. signature — the standard eddsa-jcs-2022 proof over the whole document.
+// Chain ordering is checked by verifyChain(). (Revocation/status needs the network — out of scope
+// by design; a receipt is tamper-evidence, not a liveness check.)
+import { createPublicKey, verify as edVerify, createHash } from "node:crypto";
+const B58 = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+function b58decode(s) {
+    const bytes = [0];
+    for (const ch of s) {
+        const val = B58.indexOf(ch);
+        if (val < 0)
+            throw new Error("invalid base58");
+        let carry = val;
+        for (let i = 0; i < bytes.length; i++) {
+            carry += bytes[i] * 58;
+            bytes[i] = carry & 0xff;
+            carry >>= 8;
+        }
+        while (carry) {
+            bytes.push(carry & 0xff);
+            carry >>= 8;
+        }
+    }
+    for (const ch of s) {
+        if (ch === B58[0])
+            bytes.push(0);
+        else
+            break;
+    }
+    return Buffer.from(bytes.reverse());
+}
+// ── RFC 8785 JSON Canonicalization Scheme ─────────────────────────────────────────────────────
+// Inlined so this package keeps its zero-dependency promise. Rules: no whitespace; object keys
+// sorted by UTF-16 code unit of the raw key (JS default sort — NOT localeCompare, and note an
+// astral char sorts by code UNIT, so U+1F600 precedes U+FFFD); numbers via ECMAScript
+// Number::toString (what JSON.stringify emits); minimal string escaping with non-ASCII left as
+// UTF-8; array order preserved; lone surrogates and non-finite numbers are errors.
+function assertNoLoneSurrogate(s) {
+    for (let i = 0; i < s.length; i++) {
+        const c = s.charCodeAt(i);
+        if (c >= 0xd800 && c <= 0xdbff) {
+            const next = i + 1 < s.length ? s.charCodeAt(i + 1) : 0;
+            if (!(next >= 0xdc00 && next <= 0xdfff))
+                throw new Error("JCS: unpaired high surrogate");
+            i++;
+        }
+        else if (c >= 0xdc00 && c <= 0xdfff) {
+            throw new Error("JCS: unpaired low surrogate");
+        }
+    }
+}
+export function jcsCanonicalize(value) {
+    if (value === null)
+        return "null";
+    if (typeof value === "boolean")
+        return value ? "true" : "false";
+    if (typeof value === "number") {
+        if (!Number.isFinite(value))
+            throw new Error("JCS: non-finite numbers are not valid JSON");
+        return JSON.stringify(value);
+    }
+    if (typeof value === "string") {
+        assertNoLoneSurrogate(value);
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value))
+        return `[${value.map(jcsCanonicalize).join(",")}]`;
+    if (typeof value === "object") {
+        const obj = value;
+        const keys = Object.keys(obj).filter((k) => obj[k] !== undefined).sort();
+        for (const k of keys)
+            assertNoLoneSurrogate(k);
+        return `{${keys.map((k) => `${JSON.stringify(k)}:${jcsCanonicalize(obj[k])}`).join(",")}}`;
+    }
+    throw new Error(`JCS: cannot canonicalise type ${typeof value}`);
+}
+const jcsBytes = (v) => Buffer.from(jcsCanonicalize(v), "utf8");
+const sha256 = (s) => createHash("sha256").update(s, "utf8").digest("hex");
+const deriveHash = (canonical, prevHash) => sha256((prevHash ?? "") + canonical);
+const CRYPTOSUITE = "eddsa-jcs-2022";
+/** Data Integrity §3.3.4 — the 64-byte signing input: SHA-256 of the canonical proof config,
+ *  followed by SHA-256 of the canonical document. Config FIRST; the order is normative. The 64
+ *  bytes are signed directly (Ed25519 hashes internally; they are not hashed again). */
+function hashData(unsecuredDocument, proofConfig) {
+    return Buffer.concat([
+        createHash("sha256").update(jcsBytes(proofConfig)).digest(),
+        createHash("sha256").update(jcsBytes(unsecuredDocument)).digest(),
+    ]);
+}
+/** Verify a Decidio Authority Receipt (W3C VC, DataIntegrityProof / eddsa-jcs-2022) offline.
+ *  Pass `expectedIssuer` (Decidio's published did:key) to assert the receipt was issued by
+ *  Decidio — a valid signature by *some* key is not proof of *who* issued it. */
+export function verifyReceipt(vc, expectedIssuer) {
+    try {
+        const did = String(vc?.issuer ?? "");
+        if (!did.startsWith("did:key:z"))
+            return { valid: false, issuer: did, contentBound: false, reason: "unsupported issuer DID (expected did:key Ed25519)" };
+        if (expectedIssuer && did !== expectedIssuer)
+            return { valid: false, issuer: did, contentBound: false, reason: "issuer DID is not the expected issuer" };
+        const mc = b58decode(did.slice("did:key:z".length));
+        // did:key Ed25519 = multicodec 0xed01 followed by the 32-byte key (CID v1.0 §2.2.2). The key is
+        // read straight out of the identifier, which is why no resolver and no network are needed.
+        if (mc[0] !== 0xed || mc[1] !== 0x01)
+            return { valid: false, issuer: did, contentBound: false, reason: "issuer DID is not Ed25519" };
+        const pub = createPublicKey({ key: { kty: "OKP", crv: "Ed25519", x: mc.subarray(2).toString("base64url") }, format: "jwk" });
+        const cs = vc?.credentialSubject ?? {};
+        // TYPE discipline BEFORE content binding: with prevHash as an array, deriveHash yields a
+        // different digest, so checking binding first answered "content tampered" for what is really a
+        // malformed field — a scarier and different claim than the truth, and it made this verifier
+        // disagree with the Python one on the reason for the same file.
+        if (cs.prevHash !== null && cs.prevHash !== undefined && typeof cs.prevHash !== "string")
+            return { valid: false, issuer: did, contentBound: false, recordId: cs.recordId, reason: "prevHash must be a string or null (an array/object cannot be hashed unambiguously)" };
+        if (typeof cs.contentHash !== "string" || typeof cs.recordId !== "string")
+            return { valid: false, issuer: did, contentBound: false, reason: "recordId and contentHash must be strings" };
+        const contentBound = typeof cs.recordCanonical === "string" && deriveHash(cs.recordCanonical, cs.prevHash ?? null) === cs.contentHash;
+        if (!contentBound)
+            return { valid: false, issuer: did, contentBound: false, recordId: cs.recordId, reason: "contentHash does not match recordCanonical (content tampered)" };
+        const proof = vc?.proof ?? {};
+        if (proof.type !== "DataIntegrityProof")
+            return { valid: false, issuer: did, contentBound, recordId: cs.recordId, reason: "unsupported proof (expected DataIntegrityProof)" };
+        // Receipts sealed before 2026-08-04 used a pre-standard Decidio format under the name
+        // `eddsa-2022` (a pre-Recommendation working-draft name) whose signature covered a bespoke
+        // delimited string rather than the canonical document. Say so plainly — reporting it as an
+        // invalid signature would misrepresent an obsolete format as evidence of tampering.
+        if (proof.cryptosuite === "eddsa-2022")
+            return { valid: false, issuer: did, contentBound, recordId: cs.recordId, reason: "receipt uses Decidio's pre-standard format (eddsa-2022); not verifiable under the published spec — ask for a re-sealed receipt" };
+        if (proof.cryptosuite !== CRYPTOSUITE)
+            return { valid: false, issuer: did, contentBound, recordId: cs.recordId, reason: `unsupported cryptosuite (expected ${CRYPTOSUITE})` };
+        // proofValue MUST be a string, checked by type and not coerced. It is the ONLY proof field
+        // outside the signed bytes (it is stripped to form the proof config), so a coercing check —
+        // String(["z…"]) — let anyone with a text editor produce a byte-DIFFERENT receipt file that
+        // still read VALID, with no key and no signature break. That is receipt malleability, and an
+        // adversarial cross-language differential caught it in the first version of this file.
+        if (typeof proof.proofValue !== "string")
+            return { valid: false, issuer: did, contentBound, recordId: cs.recordId, reason: "proofValue must be a string (base58-btc multibase)" };
+        const proofValue = proof.proofValue;
+        if (!proofValue.startsWith("z"))
+            return { valid: false, issuer: did, contentBound, recordId: cs.recordId, reason: "missing/invalid proofValue (expected base58-btc multibase)" };
+        // A JSON number beyond 2^53 cannot survive parse → double → canonicalise: the parser silently
+        // rounds it, so a hand-edited file whose displayed number differs from the SIGNED number would
+        // still verify. Refuse rather than report VALID for a document we cannot faithfully reproduce.
+        // (Decidio receipts carry no numeric fields at all, so this can only fire on a foreign document.)
+        const unsafeNumber = (v) => typeof v === "number" ? Number.isInteger(v) && !Number.isSafeInteger(v)
+            : Array.isArray(v) ? v.some(unsafeNumber)
+                : v !== null && typeof v === "object" ? Object.values(v).some(unsafeNumber)
+                    : false;
+        if (unsafeNumber(vc))
+            return { valid: false, issuer: did, contentBound, recordId: cs.recordId, reason: "receipt contains an integer beyond 2^53 — its exact signed value cannot be reproduced, so it is not verifiable" };
+        // §3.3.2: strip `proof` from the document and `proofValue` from the proof options. The @context
+        // rule is immediately below — we require EQUALITY, not the REC's prefix; see the note there.
+        const { proof: _omit, ...unsecuredDocument } = vc;
+        const { proofValue: _pv, ...proofConfig } = proof;
+        if (proofConfig["@context"] !== undefined) {
+            const pc = [].concat(proofConfig["@context"]);
+            const dc = [].concat(unsecuredDocument["@context"]);
+            // STRICTER THAN THE REC, deliberately. §3.3.2 requires only a prefix match and then replaces
+            // the document's @context with the proof's before hashing — so extra document entries are
+            // never signed. That is exploitable without a key: append a context entry (or an inline
+            // term-redefining object) to a genuine receipt and it still reads VALID, which lets a
+            // JSON-LD-aware consumer be shown a remapped record this verifier certified. Requiring equal
+            // length closes it, and cannot reject a genuine receipt: Decidio's issuer always copies the
+            // document's @context into the proof unchanged.
+            if (dc.length !== pc.length)
+                return { valid: false, issuer: did, contentBound, recordId: cs.recordId, reason: "document @context carries entries the proof does not cover" };
+            for (let i = 0; i < pc.length; i++) {
+                if (pc[i] !== dc[i])
+                    return { valid: false, issuer: did, contentBound, recordId: cs.recordId, reason: "proof @context does not match the document @context" };
+            }
+            unsecuredDocument["@context"] = proofConfig["@context"];
+        }
+        const valid = edVerify(null, hashData(unsecuredDocument, proofConfig), pub, b58decode(proofValue.slice(1)));
+        return { valid, issuer: did, contentBound, recordId: cs.recordId, dNumber: cs.dNumber ?? null, prevHash: cs.prevHash ?? null, reason: valid ? undefined : "signature does not verify against issuer DID" };
+    }
+    catch (e) {
+        return { valid: false, issuer: String(vc?.issuer ?? ""), contentBound: false, reason: String(e?.message ?? e) };
+    }
+}
+/** Verify an ordered chain: each receipt's prevHash must equal the prior contentHash,
+ *  and every receipt must independently verify. Proves tamper-evident ordering. */
+export function verifyChain(vcs, expectedIssuer) {
+    let prev = null;
+    for (let i = 0; i < vcs.length; i++) {
+        const r = verifyReceipt(vcs[i], expectedIssuer);
+        if (!r.valid)
+            return { valid: false, length: i, reason: `receipt ${i} (${r.recordId ?? "?"}) invalid: ${r.reason}` };
+        const cs = vcs[i]?.credentialSubject ?? {};
+        if ((cs.prevHash ?? null) !== prev)
+            return { valid: false, length: i, reason: `receipt ${i} prevHash breaks the chain` };
+        prev = cs.contentHash;
+    }
+    return { valid: true, length: vcs.length };
+}

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "@decidio/verify",
+  "version": "0.1.0",
+  "description": "Standalone, zero-dependency verifier for Decidio Authority Receipts (W3C VC, Ed25519 did:key). Verify a sealed receipt's signature + content binding + chain order offline — no Decidio dependency. `npx @decidio/verify receipt.json`.",
+  "license": "Apache-2.0",
+  "type": "module",
+  "types": "dist/verify.d.ts",
+  "main": "dist/verify.js",
+  "bin": {
+    "decidio-verify": "dist/cli.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/verify.d.ts",
+      "default": "./dist/verify.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "keywords": [
+    "verifiable-credentials",
+    "audit",
+    "receipts",
+    "ed25519",
+    "offline-verification"
+  ],
+  "homepage": "https://decidioai.com/receipt-spec/",
+  "publishConfig": {
+    "access": "public"
+  },
+  "devDependencies": {
+    "@types/node": "^22.20.1",
+    "typescript": "^5.9.3"
+  },
+  "scripts": {
+    "typecheck": "tsc -p tsconfig.build.json --noEmit",
+    "build": "node -e \"fs.rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.build.json",
+    "prepublishOnly": "npm run build"
+  }
+}