@typedstandards/verify-core 0.13.0 → 0.14.0

package/CHANGELOG.md

@@ -6,6 +6,37 @@ references are to `npstorey/civic-ai-tools-website` (#119 is the offline-crypto
 hardening arc; #116 is the standalone-verifier arc this package was extracted
 in).
 
+## 0.14.0 — 2026-10-16
+
+The W5 release (civic-ai-tools#260, shipped in #146 and #147). **A minor bump**: new exports
+(`CONTENT_LAYOUT`; `parseStrictJson` and `RepeatedMemberNameError`), and a type URI check #12 newly
+reads `ok`.
+
+- **`content/layout/v1` is registered (hub ADR-0034; spec §8.14).** New export `CONTENT_LAYOUT`
+  (`'content/layout/v1'`). `KNOWN_TYPE_URIS` holds eighteen entries: `content/analysis/v1`, then
+  `content/layout/v1`, then the sixteen attestation sub-types in the §8.12.1 table order, unchanged.
+  Check #12 reads `ok` for a layout node, where it read `unknown_type`. No payload check is added: a
+  layout node's envelope verifies as any node's (§8.14.5).
+- **`parseStrictJson` and `RepeatedMemberNameError` (new exports; typedstandards#145,
+  specification §8.2 and §9.2 check #1).** `parseStrictJson(text: string | Uint8Array)`
+  refuses a JSON text that repeats a member name within an object, which is not I-JSON
+  (RFC 7493), the input RFC 8785 JCS requires. It throws `RepeatedMemberNameError`
+  (`name` `'RepeatedMemberNameError'`), carrying `memberName` (unescaped) and
+  `pointer`, the JSON Pointer (RFC 6901) of the object that holds it. Names compare
+  after unescaping; the same name in two different objects is not a repeat. A text with
+  no repeated name returns exactly what `JSON.parse` returns, and a text that is not
+  JSON throws what `JSON.parse` throws, unchanged. Bytes are decoded as UTF-8 with
+  `fatal`. The walk keeps its own stack, so nesting the platform parser accepts does
+  not overflow it. No dependency is added.
+- **`verifyRecord` is unchanged:** it takes a parsed package, so the refusal belongs to
+  whoever reads the text. `JSON.parse` keeps the last occurrence of a repeated name, and
+  the envelope hash is computed over the parsed object, so a caller that parses a
+  package with it accepts a text the specification refuses.
+- **A negative vector**, `src/__fixtures__/repeated-member-name.bundle.json` (not
+  published): the site's minted interop bundle with a second, earlier `summary` member in
+  its package, which under `JSON.parse` gives the signed package's envelope and content
+  hashes. Its provenance is in `src/__fixtures__/README.md`.
+
 ## 0.13.0 — 2026-09-27
 
 The core-minors release (typedstandards#113, shipped in #114, #115 and #118). **A minor bump** —

package/README.md

@@ -64,6 +64,14 @@ const result = await verifyRecord(input, {
 // contentHash, typeResolution, signerIdentity, lifecycle, ...
 ```
 
+> **Parse the package's text with `parseStrictJson`.** A record package's JSON text is
+> I-JSON (RFC 7493), so a verifier refuses a text that repeats a member name within an
+> object, before any hash is computed (spec §8.2, §9.2 check #1). `JSON.parse` keeps the
+> last occurrence and drops the others, and `verifyRecord` takes the parsed object, so it
+> cannot see a repeat. `parseStrictJson(text)` (a string, or bytes decoded as UTF-8)
+> throws `RepeatedMemberNameError`, with `memberName` and `pointer` (the JSON Pointer of
+> the object), on a repeated name, and otherwise returns what `JSON.parse` returns.
+
 > **`verifyEvidence` is the same function.** The 2026-08-19 vocabulary settlement
 > renamed the entry point to `verifyRecord` (spec Appendix J) — "evidence" is
 > retired from the artifact/infrastructure brand role and kept only for the

package/dist/checks.d.ts

@@ -102,6 +102,7 @@ export interface ContentProfileCheck {
  * integrity failure: both labels are signature-covered.
  */
 export declare function checkContentProfile(pkg: Record<string, unknown>): ContentProfileCheck;
+export declare const CONTENT_LAYOUT = "content/layout/v1";
 export declare const KNOWN_TYPE_URIS: readonly string[];
 export declare const TYPE_RESOLUTION_STATUSES: readonly ["ok", "implicit", "unknown_type"];
 export type TypeResolutionStatus = (typeof TYPE_RESOLUTION_STATUSES)[number];

package/dist/checks.js

@@ -244,15 +244,22 @@ export function checkContentProfile(pkg) {
     return { status: 'ok', ...base };
 }
 // --- Typed-standards envelope checks (spec §9.2 checks #12, #14, #15) ---
-// v0.1 ratified node type URIs (spec §8.12.1). Recognized so check #12 resolves
-// them; only `content/analysis/v1` (+ the lifecycle sub-types) are operationalized
-// today, but the full ratified set is registered so conformant packages don't
-// render as `unknown_type`. The sixteen attestation sub-types are in the order
-// of the §8.12.1 table; `type-resolution.test.ts` holds that table's copy.
-// Exported and frozen so a check outside this package can compare the registered
-// set with the specification's list without being able to change it.
+// The `content/layout/v1` sub-type (spec §8.14, hub ADR-0034): a standalone
+// assertion of how a host's page arranges a node's parts. Registered for check
+// #12; verify-core runs no payload check on it (§8.14.5).
+export const CONTENT_LAYOUT = 'content/layout/v1';
+// v0.1 ratified node type URIs. Recognized so check #12 resolves them; only
+// `content/analysis/v1` (+ the lifecycle sub-types) are operationalized today,
+// but the full ratified set is registered so conformant packages don't render
+// as `unknown_type`. The two `content/*` sub-types come first:
+// `content/analysis/v1`, then `content/layout/v1` (§8.14). The sixteen
+// attestation sub-types follow in the order of the §8.12.1 table;
+// `type-resolution.test.ts` holds that table's copy. Exported and frozen so a
+// check outside this package can compare the registered set with the
+// specification's list without being able to change it.
 export const KNOWN_TYPE_URIS = Object.freeze([
     'content/analysis/v1',
+    CONTENT_LAYOUT,
     'attestation/withdraws/v1',
     'attestation/reinstates/v1',
     'attestation/supersedes/v1',

package/dist/index.d.ts

@@ -15,3 +15,4 @@ export * from './asn1.ts';
 export * from './x509.ts';
 export * from './rfc3161.ts';
 export * from './verify.ts';
+export * from './strict-json.ts';

package/dist/index.js

@@ -29,3 +29,4 @@ export * from "./asn1.js";
 export * from "./x509.js";
 export * from "./rfc3161.js";
 export * from "./verify.js";
+export * from "./strict-json.js";

package/dist/strict-json.d.ts

@@ -0,0 +1,24 @@
+/** A JSON text repeats a member name within one object, so it is not I-JSON (RFC 7493). */
+export declare class RepeatedMemberNameError extends Error {
+    /** The repeated member name, unescaped. */
+    readonly memberName: string;
+    /** The JSON Pointer (RFC 6901) of the object that holds it: `""` for the top-level value. */
+    readonly pointer: string;
+    constructor(memberName: string, pointer: string);
+}
+/**
+ * Parse a record's JSON text strictly: refuse a text that repeats a member name
+ * within an object (I-JSON, RFC 7493; specification §8.2), before any hash is
+ * computed over what it holds.
+ *
+ * - Bytes are decoded as UTF-8 with `fatal`, so malformed UTF-8 throws the
+ *   decoder's `TypeError` rather than being replaced. A leading byte order mark is
+ *   removed, as the decoder does by default.
+ * - A text that is not JSON throws what `JSON.parse` throws, unchanged.
+ * - A text that repeats a member name within one object throws
+ *   `RepeatedMemberNameError`, naming the member and the JSON Pointer of the
+ *   object. Names compare after unescaping, so `"a"` repeats `"a"`; the same
+ *   name in two different objects is not a repeat.
+ * - Otherwise it returns `JSON.parse`'s value.
+ */
+export declare function parseStrictJson(text: string | Uint8Array): unknown;

package/dist/strict-json.js

@@ -0,0 +1,109 @@
+// The strict parse of a record's JSON text (typedstandards#145; specification §8.2,
+// §9.2 check #1; hub ADR-0035).
+//
+// A record package's JSON text is I-JSON (RFC 7493), the input RFC 8785 JCS
+// requires, and I-JSON allows no member name to repeat within an object. The
+// platform's `JSON.parse` keeps the last occurrence of a repeated name and drops
+// the earlier ones without a word, and the envelope hash is computed over the
+// parsed object, so a text with a repeated name hashes as the text without it while
+// a reader that keeps another occurrence sees other content. `parseStrictJson`
+// refuses such a text, and otherwise returns exactly what `JSON.parse` returns.
+//
+// Pure: no I/O, no dependency, browser-safe. The walk keeps its own stack, so any
+// nesting the platform parser accepts is walked without recursion.
+/** A JSON text repeats a member name within one object, so it is not I-JSON (RFC 7493). */
+export class RepeatedMemberNameError extends Error {
+    /** The repeated member name, unescaped. */
+    memberName;
+    /** The JSON Pointer (RFC 6901) of the object that holds it: `""` for the top-level value. */
+    pointer;
+    constructor(memberName, pointer) {
+        super(`JSON text is not I-JSON (RFC 7493): the member name ${JSON.stringify(memberName)} is repeated in the object at JSON Pointer ${JSON.stringify(pointer)}`);
+        this.name = 'RepeatedMemberNameError';
+        this.memberName = memberName;
+        this.pointer = pointer;
+    }
+}
+const QUOTE = 0x22;
+const BACKSLASH = 0x5c;
+const OPEN_OBJECT = 0x7b;
+const CLOSE_OBJECT = 0x7d;
+const OPEN_ARRAY = 0x5b;
+const CLOSE_ARRAY = 0x5d;
+const COMMA = 0x2c;
+const escapeSegment = (s) => s.replace(/~/g, '~0').replace(/\//g, '~1');
+/** The index of the quote that closes the string opening at `start`, in text known to be JSON. */
+function stringEnd(text, start) {
+    let i = start + 1;
+    for (;;) {
+        const c = text.charCodeAt(i);
+        if (c === BACKSLASH)
+            i += 2;
+        else if (c === QUOTE)
+            return i;
+        else
+            i += 1;
+    }
+}
+/** Throw `RepeatedMemberNameError` at the first repeated name, in text `JSON.parse` has accepted. */
+function refuseRepeatedNames(text) {
+    const stack = [];
+    const segments = [];
+    const n = text.length;
+    for (let i = 0; i < n; i++) {
+        const c = text.charCodeAt(i);
+        if (c === QUOTE) {
+            const end = stringEnd(text, i);
+            const top = stack[stack.length - 1];
+            if (top?.names && top.expectName) {
+                const raw = text.slice(i + 1, end);
+                const name = raw.includes('\\') ? JSON.parse(text.slice(i, end + 1)) : raw;
+                if (top.names.has(name))
+                    throw new RepeatedMemberNameError(name, segments.map((s) => `/${escapeSegment(s)}`).join(''));
+                top.names.add(name);
+                top.segment = name;
+                top.expectName = false;
+            }
+            i = end;
+        }
+        else if (c === OPEN_OBJECT || c === OPEN_ARRAY) {
+            const parent = stack[stack.length - 1];
+            if (parent)
+                segments.push(parent.names ? parent.segment : String(parent.index));
+            stack.push({ names: c === OPEN_OBJECT ? new Set() : null, expectName: c === OPEN_OBJECT, segment: '', index: 0 });
+        }
+        else if (c === CLOSE_OBJECT || c === CLOSE_ARRAY) {
+            stack.pop();
+            if (stack.length > 0)
+                segments.pop();
+        }
+        else if (c === COMMA) {
+            const top = stack[stack.length - 1];
+            if (top.names)
+                top.expectName = true;
+            else
+                top.index += 1;
+        }
+    }
+}
+/**
+ * Parse a record's JSON text strictly: refuse a text that repeats a member name
+ * within an object (I-JSON, RFC 7493; specification §8.2), before any hash is
+ * computed over what it holds.
+ *
+ * - Bytes are decoded as UTF-8 with `fatal`, so malformed UTF-8 throws the
+ *   decoder's `TypeError` rather than being replaced. A leading byte order mark is
+ *   removed, as the decoder does by default.
+ * - A text that is not JSON throws what `JSON.parse` throws, unchanged.
+ * - A text that repeats a member name within one object throws
+ *   `RepeatedMemberNameError`, naming the member and the JSON Pointer of the
+ *   object. Names compare after unescaping, so `"a"` repeats `"a"`; the same
+ *   name in two different objects is not a repeat.
+ * - Otherwise it returns `JSON.parse`'s value.
+ */
+export function parseStrictJson(text) {
+    const source = typeof text === 'string' ? text : new TextDecoder('utf-8', { fatal: true }).decode(text);
+    const value = JSON.parse(source);
+    refuseRepeatedNames(source);
+    return value;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@typedstandards/verify-core",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Portable, browser-safe verification core for Typed Standards record packages — the §9.2 check suite, single-sourced so it verifies identically on a server and in the browser.",
   "license": "MIT",
   "author": "Nathan Storey",