@zanii/core 0.4.0 → 0.5.1

package/dist/index.d.ts

@@ -5,7 +5,7 @@ export { leafHash, merkleRoot, inclusionProof, verifyInclusion, consistencyProof
 export { createSTH, verifySTH, type SignedTreeHead } from './sth.js';
 export { buildA2ABody, signA2ABody, assembleA2AReceipt, a2aHash, bodyOf, verifyA2AReceipt, participantsOf, prevFor, type A2AReceipt, type A2ABody, type A2AParty, } from './a2a.js';
 export { verifyAuditBundle, type AuditBundle, type BundledReceipt, type BundledRevocation, type BundledAnchor, type BundleReport, type BundleCheck, } from './bundle.js';
-export { createReceipt, receiptHash, hashPayload, saltedPayloadHash, verifyPayload, verifyReceipt, verifyReceiptSignature, verifyReceiptChain, type Receipt, type VerifyResult, } from './receipt.js';
+export { createReceipt, receiptHash, hashPayload, payloadBytes, saltedPayloadHash, verifyPayload, verifyPayloadLegacy, type PayloadDialect, verifyReceipt, verifyReceiptSignature, verifyReceiptChain, type Receipt, type VerifyResult, } from './receipt.js';
 export { createConfirmation, verifyConfirmation, type ActionConfirmation, } from './confirmation.js';
 export { createCoSignature, verifyCoSignature, type ReceiptCoSignature, } from './cosign.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EACL,UAAU,EACV,QAAQ,EACR,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,WAAW,EACX,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,WAAW,GACjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,QAAQ,EACR,UAAU,EACV,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AACrE,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,OAAO,EACP,MAAM,EACN,gBAAgB,EAChB,cAAc,EACd,OAAO,EACP,KAAK,UAAU,EACf,KAAK,OAAO,EACZ,KAAK,QAAQ,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,WAAW,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,aAAa,EACb,aAAa,EACb,sBAAsB,EACtB,kBAAkB,EAClB,KAAK,OAAO,EACZ,KAAK,YAAY,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,kBAAkB,GACxB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EACL,UAAU,EACV,QAAQ,EACR,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,WAAW,EACX,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,WAAW,GACjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,QAAQ,EACR,UAAU,EACV,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,UAAU,CAAC;AACrE,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,OAAO,EACP,MAAM,EACN,gBAAgB,EAChB,cAAc,EACd,OAAO,EACP,KAAK,UAAU,EACf,KAAK,OAAO,EACZ,KAAK,QAAQ,GACd,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,iBAAiB,EACjB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,WAAW,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,WAAW,EACX,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EACnB,KAAK,cAAc,EACnB,aAAa,EACb,sBAAsB,EACtB,kBAAkB,EAClB,KAAK,OAAO,EACZ,KAAK,YAAY,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,KAAK,kBAAkB,GACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,kBAAkB,GACxB,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -5,7 +5,7 @@ export { leafHash, merkleRoot, inclusionProof, verifyInclusion, consistencyProof
 export { createSTH, verifySTH } from './sth.js';
 export { buildA2ABody, signA2ABody, assembleA2AReceipt, a2aHash, bodyOf, verifyA2AReceipt, participantsOf, prevFor, } from './a2a.js';
 export { verifyAuditBundle, } from './bundle.js';
-export { createReceipt, receiptHash, hashPayload, saltedPayloadHash, verifyPayload, verifyReceipt, verifyReceiptSignature, verifyReceiptChain, } from './receipt.js';
+export { createReceipt, receiptHash, hashPayload, payloadBytes, saltedPayloadHash, verifyPayload, verifyPayloadLegacy, verifyReceipt, verifyReceiptSignature, verifyReceiptChain, } from './receipt.js';
 export { createConfirmation, verifyConfirmation, } from './confirmation.js';
 export { createCoSignature, verifyCoSignature, } from './cosign.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAgB,MAAM,WAAW,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EACL,UAAU,EACV,QAAQ,EACR,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,WAAW,GAIZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,QAAQ,EACR,UAAU,EACV,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,SAAS,EAAuB,MAAM,UAAU,CAAC;AACrE,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,OAAO,EACP,MAAM,EACN,gBAAgB,EAChB,cAAc,EACd,OAAO,GAIR,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,iBAAiB,GAOlB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,WAAW,EACX,WAAW,EACX,iBAAiB,EACjB,aAAa,EACb,aAAa,EACb,sBAAsB,EACtB,kBAAkB,GAGnB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,GAEnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,gBAAgB,EAAgB,MAAM,WAAW,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EACL,UAAU,EACV,QAAQ,EACR,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,WAAW,GAIZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,QAAQ,EACR,UAAU,EACV,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,SAAS,EAAuB,MAAM,UAAU,CAAC;AACrE,OAAO,EACL,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,OAAO,EACP,MAAM,EACN,gBAAgB,EAChB,cAAc,EACd,OAAO,GAIR,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,iBAAiB,GAOlB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,aAAa,EACb,WAAW,EACX,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,aAAa,EACb,mBAAmB,EAEnB,aAAa,EACb,sBAAsB,EACtB,kBAAkB,GAGnB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,GAEnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,GAElB,MAAM,aAAa,CAAC"}

package/dist/receipt.d.ts

@@ -16,6 +16,14 @@ export interface Receipt {
     /** Optional pseudonymous data-subject tag (SPEC §3) — lets the end user the action was
      * about find + audit their own slice (`@zanii/subject`). Covered by the signature. */
     subject_tag?: string;
+    /**
+     * How `payload_hash` committed to the payload (SPEC §3). `'jcs'` means the payload was
+     * encoded with `payloadBytes` (RFC 8785) before hashing — the only value written since
+     * `@zanii/sdk` 0.5.0. ABSENT means a pre-0.5.0 receipt, whose bytes came from the SDK's
+     * own `JSON.stringify`/`json.dumps` and therefore differ between the two SDKs; those
+     * are checked with `verifyPayloadLegacy`, never with `verifyPayload`.
+     */
+    payload_encoding?: 'jcs';
     sig: string;
 }
 export interface VerifyResult {
@@ -23,6 +31,18 @@ export interface VerifyResult {
     error?: string;
 }
 export declare function hashPayload(payload: Uint8Array | string): string;
+/**
+ * The bytes a `payload_hash` commits to (SPEC §3): RFC 8785 JCS, UTF-8.
+ *
+ * This exists because "hash the payload" was under-specified: each SDK reached for its
+ * own serialiser, so the same object hashed differently in TypeScript and Python and
+ * `verifyPayload` returned false across languages for honest data. One encoder, both
+ * languages, byte-identical — pinned by the cross-language vectors.
+ *
+ * A top-level `undefined` (or `null`) encodes as `null`, which is what both SDKs already
+ * hashed, so null payloads are unaffected by the change.
+ */
+export declare function payloadBytes(payload: unknown): Uint8Array;
 /**
  * Privacy-preserving payload commitment: `sha256(nonce ‖ payload)`. A bare
  * `hashPayload` of a low-entropy payload ("phone X, amount 500") is dictionary-
@@ -37,6 +57,23 @@ export declare function saltedPayloadHash(payload: Uint8Array | string, nonce?:
 };
 /** Prove a payload matches a salted `payload_hash`, given the nonce kept at record time. */
 export declare function verifyPayload(payload: Uint8Array | string, nonce: string, payloadHash: string): boolean;
+/** Which pre-0.5.0 SDK's serialiser reproduced a legacy `payload_hash`. */
+export type PayloadDialect = 'jcs' | 'legacy-ts' | 'legacy-py';
+/**
+ * Verify a payload against a receipt recorded BEFORE the JCS rule (no `payload_encoding`
+ * field). Such a receipt does not record which SDK wrote it, so this tries each old
+ * dialect and reports which one matched.
+ *
+ * Honest limits: the `legacy-ts` dialect depends on the object's original KEY INSERTION
+ * ORDER, which is not recoverable from a re-parsed payload, so it only matches when the
+ * caller reconstructs the object in the order it was recorded. Float formatting is
+ * likewise best-effort. A `null` result means no dialect reproduced the hash; it does not
+ * prove the payload wrong.
+ */
+export declare function verifyPayloadLegacy(payload: unknown, nonce: string, payloadHash: string): {
+    ok: boolean;
+    dialect: PayloadDialect | null;
+};
 export declare function createReceipt(fields: {
     agentId: string;
     delegation: DelegationCert[];
@@ -51,6 +88,8 @@ export declare function createReceipt(fields: {
     manifestHash?: string;
     /** Optional pseudonymous data-subject tag — per-subject auditability (`@zanii/subject`). */
     subjectTag?: string;
+    /** How `payloadHash` committed to the payload. Set `'jcs'` when it came from `payloadBytes`. */
+    payloadEncoding?: 'jcs';
 }, agentPrivateKey: Uint8Array): Receipt;
 /** Hash of the full receipt (incl. sig) — what the next receipt's `prev` points to. */
 export declare function receiptHash(receipt: Receipt): string;

package/dist/receipt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"receipt.d.ts","sourceRoot":"","sources":["../src/receipt.ts"],"names":[],"mappings":"AAKA,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEhF,MAAM,WAAW,OAAO;IACtB,CAAC,EAAE,CAAC,CAAC;IACL,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;0FACsF;IACtF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,CAGhE;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,UAAU,GAAG,MAAM,EAC5B,KAAK,CAAC,EAAE,MAAM,GACb;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAQzC;AAED,4FAA4F;AAC5F,wBAAgB,aAAa,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAMvG;AAED,wBAAgB,aAAa,CAC3B,MAAM,EAAE;IACN,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4FAA4F;IAC5F,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,EACD,eAAe,EAAE,UAAU,GAC1B,OAAO,CAkBT;AAED,uFAAuF;AACvF,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAEpD;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAUhE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GACzF,YAAY,CAwBd;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,OAAO,EAAE,EACnB,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAO,GAC3D,YAAY,GAAG;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CASzC"}
+{"version":3,"file":"receipt.d.ts","sourceRoot":"","sources":["../src/receipt.ts"],"names":[],"mappings":"AAKA,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEhF,MAAM,WAAW,OAAO;IACtB,CAAC,EAAE,CAAC,CAAC;IACL,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,iFAAiF;IACjF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;0FACsF;IACtF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,KAAK,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,CAGhE;AAsCD;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,UAAU,CAIzD;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,UAAU,GAAG,MAAM,EAC5B,KAAK,CAAC,EAAE,MAAM,GACb;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAQzC;AAED,4FAA4F;AAC5F,wBAAgB,aAAa,CAAC,OAAO,EAAE,UAAU,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAMvG;AAED,2EAA2E;AAC3E,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,WAAW,GAAG,WAAW,CAAC;AAyC/D;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CAAA;CAAE,CAcjD;AAED,wBAAgB,aAAa,CAC3B,MAAM,EAAE;IACN,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,cAAc,EAAE,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4FAA4F;IAC5F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gGAAgG;IAChG,eAAe,CAAC,EAAE,KAAK,CAAC;CACzB,EACD,eAAe,EAAE,UAAU,GAC1B,OAAO,CAmBT;AAED,uFAAuF;AACvF,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAEpD;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAUhE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,OAAO,EAChB,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAO,GACzF,YAAY,CAwBd;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,OAAO,EAAE,EACnB,IAAI,GAAE;IAAE,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAO,GAC3D,YAAY,GAAG;IAAE,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CASzC"}

package/dist/receipt.js

@@ -8,6 +8,58 @@ export function hashPayload(payload) {
     const bytes = typeof payload === 'string' ? new TextEncoder().encode(payload) : payload;
     return `sha256:${bytesToHex(sha256(bytes))}`;
 }
+/**
+ * Reject anything whose canonical form the two SDKs would not agree on. Mirrors
+ * `_check_jcs_safe` in `zanii.encoding`: non-integer numbers are the one place JSON
+ * serialisers legitimately disagree, so they are refused rather than hashed into a
+ * receipt no Python verifier can reproduce. Use integer minor units (`@zanii/payments`).
+ */
+function assertPayloadCanonicalizable(v, path = 'payload') {
+    if (v === null || typeof v === 'string' || typeof v === 'boolean')
+        return;
+    if (typeof v === 'number') {
+        if (!Number.isFinite(v))
+            throw new Error(`${path}: ${v} has no JSON representation`);
+        if (!Number.isInteger(v)) {
+            throw new Error(`${path}: non-integer number ${v} cannot be committed to a payload hash — the two SDKs ` +
+                'would encode it differently. Use integer minor units (see @zanii/payments) or a string.');
+        }
+        return;
+    }
+    if (Array.isArray(v)) {
+        v.forEach((x, i) => assertPayloadCanonicalizable(x, `${path}[${i}]`));
+        return;
+    }
+    if (typeof v === 'object') {
+        for (const [k, val] of Object.entries(v)) {
+            // An undefined member is DROPPED, per JSON.stringify: `{a:1,b:undefined}` encodes
+            // as `{"a":1}`, which is byte-identical to what Python produces for the equivalent
+            // input (the key simply absent). A Python `None` means JSON null, a different
+            // value, and correctly hashes differently. So this needs no special case.
+            if (val === undefined)
+                continue;
+            assertPayloadCanonicalizable(val, `${path}.${k}`);
+        }
+        return;
+    }
+    throw new Error(`${path}: ${typeof v} is not canonicalizable JSON`);
+}
+/**
+ * The bytes a `payload_hash` commits to (SPEC §3): RFC 8785 JCS, UTF-8.
+ *
+ * This exists because "hash the payload" was under-specified: each SDK reached for its
+ * own serialiser, so the same object hashed differently in TypeScript and Python and
+ * `verifyPayload` returned false across languages for honest data. One encoder, both
+ * languages, byte-identical — pinned by the cross-language vectors.
+ *
+ * A top-level `undefined` (or `null`) encodes as `null`, which is what both SDKs already
+ * hashed, so null payloads are unaffected by the change.
+ */
+export function payloadBytes(payload) {
+    const value = payload === undefined ? null : payload;
+    assertPayloadCanonicalizable(value);
+    return canonicalBytes(value);
+}
 /**
  * Privacy-preserving payload commitment: `sha256(nonce ‖ payload)`. A bare
  * `hashPayload` of a low-entropy payload ("phone X, amount 500") is dictionary-
@@ -34,6 +86,85 @@ export function verifyPayload(payload, nonce, payloadHash) {
         return false;
     }
 }
+/** Old `@zanii/sdk`: `JSON.stringify`, insertion order, no spaces, raw UTF-8. */
+function legacyTsEncode(payload) {
+    return JSON.stringify(payload) ?? 'null';
+}
+/** Old `zanii` (Python): `json.dumps(sort_keys=True)` — `, ` / `: ` separators, \uXXXX escapes. */
+function legacyPyEncode(value) {
+    const esc = (str) => {
+        let out = '';
+        for (const ch of str) {
+            const c = ch.codePointAt(0);
+            if (ch === '"')
+                out += '\\"';
+            else if (ch === '\\')
+                out += '\\\\';
+            else if (ch === '\n')
+                out += '\\n';
+            else if (ch === '\r')
+                out += '\\r';
+            else if (ch === '\t')
+                out += '\\t';
+            else if (c < 0x20)
+                out += `\\u${c.toString(16).padStart(4, '0')}`;
+            else if (c < 0x7f)
+                out += ch;
+            else if (c > 0xffff) {
+                // Python escapes astral characters as a surrogate pair
+                const u = c - 0x10000;
+                out += `\\u${(0xd800 + (u >> 10)).toString(16)}\\u${(0xdc00 + (u & 0x3ff)).toString(16)}`;
+            }
+            else
+                out += `\\u${c.toString(16).padStart(4, '0')}`;
+        }
+        return `"${out}"`;
+    };
+    const enc = (v) => {
+        if (v === null || v === undefined)
+            return 'null';
+        if (typeof v === 'boolean')
+            return v ? 'true' : 'false';
+        if (typeof v === 'number')
+            return Number.isInteger(v) ? String(v) : String(v);
+        if (typeof v === 'string')
+            return esc(v);
+        if (Array.isArray(v))
+            return `[${v.map(enc).join(', ')}]`;
+        const o = v;
+        const keys = Object.keys(o).sort();
+        return `{${keys.map((k) => `${esc(k)}: ${enc(o[k])}`).join(', ')}}`;
+    };
+    return enc(value);
+}
+/**
+ * Verify a payload against a receipt recorded BEFORE the JCS rule (no `payload_encoding`
+ * field). Such a receipt does not record which SDK wrote it, so this tries each old
+ * dialect and reports which one matched.
+ *
+ * Honest limits: the `legacy-ts` dialect depends on the object's original KEY INSERTION
+ * ORDER, which is not recoverable from a re-parsed payload, so it only matches when the
+ * caller reconstructs the object in the order it was recorded. Float formatting is
+ * likewise best-effort. A `null` result means no dialect reproduced the hash; it does not
+ * prove the payload wrong.
+ */
+export function verifyPayloadLegacy(payload, nonce, payloadHash) {
+    const attempts = [
+        ['jcs', () => payloadBytes(payload)],
+        ['legacy-ts', () => legacyTsEncode(payload)],
+        ['legacy-py', () => legacyPyEncode(payload)],
+    ];
+    for (const [dialect, encode] of attempts) {
+        try {
+            if (saltedPayloadHash(encode(), nonce).payload_hash === payloadHash)
+                return { ok: true, dialect };
+        }
+        catch {
+            /* this dialect cannot encode it — try the next */
+        }
+    }
+    return { ok: false, dialect: null };
+}
 export function createReceipt(fields, agentPrivateKey) {
     if (Number.isNaN(Date.parse(fields.ts)))
         throw new Error(`invalid ts timestamp: ${fields.ts}`);
@@ -50,6 +181,7 @@ export function createReceipt(fields, agentPrivateKey) {
         ...(fields.modelId ? { model_id: fields.modelId } : {}),
         ...(fields.manifestHash ? { manifest_hash: fields.manifestHash } : {}),
         ...(fields.subjectTag ? { subject_tag: fields.subjectTag } : {}),
+        ...(fields.payloadEncoding ? { payload_encoding: fields.payloadEncoding } : {}),
     };
     const sig = ed25519.sign(canonicalBytes(unsigned), agentPrivateKey);
     return { ...unsigned, sig: encodeSig(sig) };

package/dist/receipt.js.map

@@ -1 +1 @@
-{"version":3,"file":"receipt.js","sourceRoot":"","sources":["../src/receipt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAuB,MAAM,iBAAiB,CAAC;AA2BhF,MAAM,UAAU,WAAW,CAAC,OAA4B;IACtD,MAAM,KAAK,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACxF,OAAO,UAAU,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAA4B,EAC5B,KAAc;IAEd,MAAM,QAAQ,GAAG,KAAK,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC/F,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACzE,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC5B,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAC9C,OAAO,EAAE,YAAY,EAAE,UAAU,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACrF,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,aAAa,CAAC,OAA4B,EAAE,KAAa,EAAE,WAAmB;IAC5F,IAAI,CAAC;QACH,OAAO,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,YAAY,KAAK,WAAW,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,MAcC,EACD,eAA2B;IAE3B,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/F,MAAM,QAAQ,GAAG;QACf,CAAC,EAAE,CAAU;QACb,QAAQ,EAAE,MAAM,CAAC,OAAO;QACxB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC,CAAC;IACpE,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,MAAM,GAAG,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAgB,EAChB,OAAwF,EAAE;IAE1F,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAChF,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;IAE3F,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IAE1E,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE;QAC5C,OAAO,EAAE,OAAO,CAAC,QAAQ;QACzB,YAAY,EAAE,IAAI,CAAC,aAAa;QAChC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,EAAE,EAAE,EAAE;KACP,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAEzE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,eAAgB,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,OAAO,CAAC,MAAM,2BAA2B,EAAE,CAAC;IACnF,CAAC;IAED,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2DAA2D,EAAE,CAAC;IAC3F,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAmB,EACnB,OAA0D,EAAE;IAE5D,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QACvB,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,MAAM,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;QAC7F,YAAY,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}
+{"version":3,"file":"receipt.js","sourceRoot":"","sources":["../src/receipt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAuB,MAAM,iBAAiB,CAAC;AAmChF,MAAM,UAAU,WAAW,CAAC,OAA4B;IACtD,MAAM,KAAK,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACxF,OAAO,UAAU,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,SAAS,4BAA4B,CAAC,CAAU,EAAE,IAAI,GAAG,SAAS;IAChE,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,SAAS;QAAE,OAAO;IAC1E,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACrF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,wBAAwB,CAAC,wDAAwD;gBACtF,yFAAyF,CAC5F,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACrB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,4BAA4B,CAAC,CAAC,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QACtE,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,KAAK,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAA4B,CAAC,EAAE,CAAC;YACpE,kFAAkF;YAClF,mFAAmF;YACnF,8EAA8E;YAC9E,0EAA0E;YAC1E,IAAI,GAAG,KAAK,SAAS;gBAAE,SAAS;YAChC,4BAA4B,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,OAAO,CAAC,8BAA8B,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,OAAgB;IAC3C,MAAM,KAAK,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;IACrD,4BAA4B,CAAC,KAAK,CAAC,CAAC;IACpC,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAA4B,EAC5B,KAAc;IAEd,MAAM,QAAQ,GAAG,KAAK,IAAI,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAC/F,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACzE,QAAQ,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC5B,QAAQ,CAAC,GAAG,CAAC,YAAY,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAC9C,OAAO,EAAE,YAAY,EAAE,UAAU,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACrF,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,aAAa,CAAC,OAA4B,EAAE,KAAa,EAAE,WAAmB;IAC5F,IAAI,CAAC;QACH,OAAO,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,YAAY,KAAK,WAAW,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAKD,iFAAiF;AACjF,SAAS,cAAc,CAAC,OAAgB;IACtC,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC;AAC3C,CAAC;AAED,mGAAmG;AACnG,SAAS,cAAc,CAAC,KAAc;IACpC,MAAM,GAAG,GAAG,CAAC,GAAW,EAAU,EAAE;QAClC,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC;YAC7B,IAAI,EAAE,KAAK,GAAG;gBAAE,GAAG,IAAI,KAAK,CAAC;iBACxB,IAAI,EAAE,KAAK,IAAI;gBAAE,GAAG,IAAI,MAAM,CAAC;iBAC/B,IAAI,EAAE,KAAK,IAAI;gBAAE,GAAG,IAAI,KAAK,CAAC;iBAC9B,IAAI,EAAE,KAAK,IAAI;gBAAE,GAAG,IAAI,KAAK,CAAC;iBAC9B,IAAI,EAAE,KAAK,IAAI;gBAAE,GAAG,IAAI,KAAK,CAAC;iBAC9B,IAAI,CAAC,GAAG,IAAI;gBAAE,GAAG,IAAI,MAAM,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;iBAC7D,IAAI,CAAC,GAAG,IAAI;gBAAE,GAAG,IAAI,EAAE,CAAC;iBACxB,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC;gBACpB,uDAAuD;gBACvD,MAAM,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC;gBACtB,GAAG,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5F,CAAC;;gBAAM,GAAG,IAAI,MAAM,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QACxD,CAAC;QACD,OAAO,IAAI,GAAG,GAAG,CAAC;IACpB,CAAC,CAAC;IACF,MAAM,GAAG,GAAG,CAAC,CAAU,EAAU,EAAE;QACjC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;QACjD,IAAI,OAAO,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACxD,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC9E,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAC1D,MAAM,CAAC,GAAG,CAA4B,CAAC;QACvC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACtE,CAAC,CAAC;IACF,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CACjC,OAAgB,EAChB,KAAa,EACb,WAAmB;IAEnB,MAAM,QAAQ,GAAuD;QACnE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,OAAO,CAAE,CAAC;QAC7C,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;KAC7C,CAAC;IACF,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,IAAI,iBAAiB,CAAC,MAAM,EAAE,EAAE,KAAK,CAAC,CAAC,YAAY,KAAK,WAAW;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QACpG,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,MAgBC,EACD,eAA2B;IAE3B,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/F,MAAM,QAAQ,GAAG;QACf,CAAC,EAAE,CAAU;QACb,QAAQ,EAAE,MAAM,CAAC,OAAO;QACxB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,YAAY,EAAE,MAAM,CAAC,WAAW;QAChC,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChF,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC,CAAC;IACpE,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;AAC9C,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,WAAW,CAAC,OAAgB;IAC1C,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,MAAM,GAAG,GAAG,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IAC/B,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,cAAc,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAgB,EAChB,OAAwF,EAAE;IAE1F,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,6BAA6B,EAAE,CAAC;IAChF,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;IAE3F,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAChC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IAE1E,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE;QAC5C,OAAO,EAAE,OAAO,CAAC,QAAQ;QACzB,YAAY,EAAE,IAAI,CAAC,aAAa;QAChC,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,EAAE,EAAE,EAAE;KACP,CAAC,CAAC;IACH,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAEzE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,eAAgB,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACzD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,OAAO,CAAC,MAAM,2BAA2B,EAAE,CAAC;IACnF,CAAC;IAED,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;QAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2DAA2D,EAAE,CAAC;IAC3F,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAmB,EACnB,OAA0D,EAAE;IAE5D,IAAI,YAAY,GAAkB,IAAI,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QACvB,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,MAAM,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;QAC7F,YAAY,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zanii/core",
-  "version": "0.4.0",
+  "version": "0.5.1",
   "description": "Zanii protocol: verifiable identity, signed action receipts, Merkle transparency-log proofs. Pure, no I/O.",
   "license": "Apache-2.0",
   "homepage": "https://ledger.zanii.agency",

package/src/index.ts

@@ -1,68 +1,71 @@
-export { generateKeypair, didFromPublicKey, publicKeyFromDid, type Keypair } from './keys.js';
-export { canonicalBytes, jcsHash } from './encoding.js';
-export {
-  createCert,
-  certHash,
-  createRevocation,
-  verifyRevocation,
-  verifyCertSignature,
-  verifyChain,
-  scopeCovers,
-  scopesAllow,
-  type DelegationCert,
-  type RevocationRecord,
-  type ChainResult,
-} from './delegation.js';
-export {
-  leafHash,
-  merkleRoot,
-  inclusionProof,
-  verifyInclusion,
-  consistencyProof,
-  verifyConsistency,
-} from './merkle.js';
-export { createSTH, verifySTH, type SignedTreeHead } from './sth.js';
-export {
-  buildA2ABody,
-  signA2ABody,
-  assembleA2AReceipt,
-  a2aHash,
-  bodyOf,
-  verifyA2AReceipt,
-  participantsOf,
-  prevFor,
-  type A2AReceipt,
-  type A2ABody,
-  type A2AParty,
-} from './a2a.js';
-export {
-  verifyAuditBundle,
-  type AuditBundle,
-  type BundledReceipt,
-  type BundledRevocation,
-  type BundledAnchor,
-  type BundleReport,
-  type BundleCheck,
-} from './bundle.js';
-export {
-  createReceipt,
-  receiptHash,
-  hashPayload,
-  saltedPayloadHash,
-  verifyPayload,
-  verifyReceipt,
-  verifyReceiptSignature,
-  verifyReceiptChain,
-  type Receipt,
-  type VerifyResult,
-} from './receipt.js';
-export {
-  createConfirmation,
-  verifyConfirmation,
-  type ActionConfirmation,
-} from './confirmation.js';
-export {
-  createCoSignature,
-  verifyCoSignature,
-  type ReceiptCoSignature,
-} from './cosign.js';
+export { generateKeypair, didFromPublicKey, publicKeyFromDid, type Keypair } from './keys.js';
+export { canonicalBytes, jcsHash } from './encoding.js';
+export {
+  createCert,
+  certHash,
+  createRevocation,
+  verifyRevocation,
+  verifyCertSignature,
+  verifyChain,
+  scopeCovers,
+  scopesAllow,
+  type DelegationCert,
+  type RevocationRecord,
+  type ChainResult,
+} from './delegation.js';
+export {
+  leafHash,
+  merkleRoot,
+  inclusionProof,
+  verifyInclusion,
+  consistencyProof,
+  verifyConsistency,
+} from './merkle.js';
+export { createSTH, verifySTH, type SignedTreeHead } from './sth.js';
+export {
+  buildA2ABody,
+  signA2ABody,
+  assembleA2AReceipt,
+  a2aHash,
+  bodyOf,
+  verifyA2AReceipt,
+  participantsOf,
+  prevFor,
+  type A2AReceipt,
+  type A2ABody,
+  type A2AParty,
+} from './a2a.js';
+export {
+  verifyAuditBundle,
+  type AuditBundle,
+  type BundledReceipt,
+  type BundledRevocation,
+  type BundledAnchor,
+  type BundleReport,
+  type BundleCheck,
+} from './bundle.js';
+export {
+  createReceipt,
+  receiptHash,
+  hashPayload,
+  payloadBytes,
+  saltedPayloadHash,
+  verifyPayload,
+  verifyPayloadLegacy,
+  type PayloadDialect,
+  verifyReceipt,
+  verifyReceiptSignature,
+  verifyReceiptChain,
+  type Receipt,
+  type VerifyResult,
+} from './receipt.js';
+export {
+  createConfirmation,
+  verifyConfirmation,
+  type ActionConfirmation,
+} from './confirmation.js';
+export {
+  createCoSignature,
+  verifyCoSignature,
+  type ReceiptCoSignature,
+} from './cosign.js';

package/src/receipt.ts

@@ -1,171 +1,308 @@
-import { ed25519 } from '@noble/curves/ed25519';
-import { sha256 } from '@noble/hashes/sha256';
-import { bytesToHex, hexToBytes, randomBytes } from '@noble/hashes/utils';
-import { canonicalBytes, decodeSig, encodeSig, jcsHash } from './encoding.js';
-import { publicKeyFromDid } from './keys.js';
-import { scopesAllow, verifyChain, type DelegationCert } from './delegation.js';
-
-export interface Receipt {
-  v: 1;
-  agent_id: string;
-  delegation: DelegationCert[];
-  action: string;
-  target: string;
-  payload_hash: string;
-  ts: string;
-  prev: string | null;
-  /** Optional provenance (SPEC §3). Present when set; covered by the signature. */
-  runtime_hash?: string;
-  model_id?: string;
-  /** Hash of the product's tool/scope manifest that governed this action. */
-  manifest_hash?: string;
-  /** Optional pseudonymous data-subject tag (SPEC §3) — lets the end user the action was
-   * about find + audit their own slice (`@zanii/subject`). Covered by the signature. */
-  subject_tag?: string;
-  sig: string;
-}
-
-export interface VerifyResult {
-  ok: boolean;
-  error?: string;
-}
-
-export function hashPayload(payload: Uint8Array | string): string {
-  const bytes = typeof payload === 'string' ? new TextEncoder().encode(payload) : payload;
-  return `sha256:${bytesToHex(sha256(bytes))}`;
-}
-
-/**
- * Privacy-preserving payload commitment: `sha256(nonce ‖ payload)`. A bare
- * `hashPayload` of a low-entropy payload ("phone X, amount 500") is dictionary-
- * attackable from the public anchored log, and a linkable hash can itself be
- * personal data (PDPL). The per-receipt `nonce` is kept operator-side (NOT in the
- * receipt), so the on-chain value reveals nothing; keep it to later prove the
- * payload with `verifyPayload`. If `nonce` is omitted a fresh 16-byte one is drawn.
- */
-export function saltedPayloadHash(
-  payload: Uint8Array | string,
-  nonce?: string,
-): { payload_hash: string; nonce: string } {
-  const nonceHex = nonce ?? bytesToHex(randomBytes(16));
-  const nonceBytes = hexToBytes(nonceHex);
-  const payloadBytes = typeof payload === 'string' ? new TextEncoder().encode(payload) : payload;
-  const combined = new Uint8Array(nonceBytes.length + payloadBytes.length);
-  combined.set(nonceBytes, 0);
-  combined.set(payloadBytes, nonceBytes.length);
-  return { payload_hash: `sha256:${bytesToHex(sha256(combined))}`, nonce: nonceHex };
-}
-
-/** Prove a payload matches a salted `payload_hash`, given the nonce kept at record time. */
-export function verifyPayload(payload: Uint8Array | string, nonce: string, payloadHash: string): boolean {
-  try {
-    return saltedPayloadHash(payload, nonce).payload_hash === payloadHash;
-  } catch {
-    return false;
-  }
-}
-
-export function createReceipt(
-  fields: {
-    agentId: string;
-    delegation: DelegationCert[];
-    action: string;
-    target: string;
-    payloadHash: string;
-    ts: string;
-    prev: string | null;
-    /** Optional provenance — included in the signed receipt only when provided. */
-    runtimeHash?: string;
-    modelId?: string;
-    manifestHash?: string;
-    /** Optional pseudonymous data-subject tag — per-subject auditability (`@zanii/subject`). */
-    subjectTag?: string;
-  },
-  agentPrivateKey: Uint8Array,
-): Receipt {
-  if (Number.isNaN(Date.parse(fields.ts))) throw new Error(`invalid ts timestamp: ${fields.ts}`);
-  const unsigned = {
-    v: 1 as const,
-    agent_id: fields.agentId,
-    delegation: fields.delegation,
-    action: fields.action,
-    target: fields.target,
-    payload_hash: fields.payloadHash,
-    ts: fields.ts,
-    prev: fields.prev,
-    ...(fields.runtimeHash ? { runtime_hash: fields.runtimeHash } : {}),
-    ...(fields.modelId ? { model_id: fields.modelId } : {}),
-    ...(fields.manifestHash ? { manifest_hash: fields.manifestHash } : {}),
-    ...(fields.subjectTag ? { subject_tag: fields.subjectTag } : {}),
-  };
-  const sig = ed25519.sign(canonicalBytes(unsigned), agentPrivateKey);
-  return { ...unsigned, sig: encodeSig(sig) };
-}
-
-/** Hash of the full receipt (incl. sig) — what the next receipt's `prev` points to. */
-export function receiptHash(receipt: Receipt): string {
-  return jcsHash(receipt);
-}
-
-export function verifyReceiptSignature(receipt: Receipt): boolean {
-  const pub = publicKeyFromDid(receipt.agent_id);
-  const sig = decodeSig(receipt.sig);
-  if (!pub || !sig) return false;
-  const { sig: _omitted, ...unsigned } = receipt;
-  try {
-    return ed25519.verify(sig, canonicalBytes(unsigned), pub);
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Full single-receipt verification per SPEC §4:
- * signature → delegation chain (at receipt time) → scope covers target → prev linkage.
- */
-export function verifyReceipt(
-  receipt: Receipt,
-  opts: { expectedOwner?: string; revoked?: Set<string>; expectedPrev?: string | null } = {},
-): VerifyResult {
-  if (receipt.v !== 1) return { ok: false, error: 'unsupported receipt version' };
-  if (!verifyReceiptSignature(receipt)) return { ok: false, error: 'bad receipt signature' };
-
-  const ts = new Date(receipt.ts);
-  if (Number.isNaN(ts.getTime())) return { ok: false, error: 'invalid ts' };
-
-  const chain = verifyChain(receipt.delegation, {
-    agentId: receipt.agent_id,
-    expectedRoot: opts.expectedOwner,
-    revoked: opts.revoked,
-    at: ts,
-  });
-  if (!chain.ok) return { ok: false, error: `delegation: ${chain.error}` };
-
-  if (!scopesAllow(chain.effectiveScopes!, receipt.target)) {
-    return { ok: false, error: `target ${receipt.target} outside effective scopes` };
-  }
-
-  if (opts.expectedPrev !== undefined && receipt.prev !== opts.expectedPrev) {
-    return { ok: false, error: 'prev hash does not match preceding receipt (chain broken)' };
-  }
-
-  return { ok: true };
-}
-
-/**
- * Verify an agent's full receipt sequence: every receipt valid and hash-linked
- * to the one before it. Returns the index of the first bad receipt on failure.
- */
-export function verifyReceiptChain(
-  receipts: Receipt[],
-  opts: { expectedOwner?: string; revoked?: Set<string> } = {},
-): VerifyResult & { failedIndex?: number } {
-  let expectedPrev: string | null = null;
-  for (let i = 0; i < receipts.length; i++) {
-    const r = receipts[i]!;
-    const result = verifyReceipt(r, { ...opts, expectedPrev });
-    if (!result.ok) return { ok: false, error: `receipt ${i}: ${result.error}`, failedIndex: i };
-    expectedPrev = receiptHash(r);
-  }
-  return { ok: true };
-}
+import { ed25519 } from '@noble/curves/ed25519';
+import { sha256 } from '@noble/hashes/sha256';
+import { bytesToHex, hexToBytes, randomBytes } from '@noble/hashes/utils';
+import { canonicalBytes, decodeSig, encodeSig, jcsHash } from './encoding.js';
+import { publicKeyFromDid } from './keys.js';
+import { scopesAllow, verifyChain, type DelegationCert } from './delegation.js';
+
+export interface Receipt {
+  v: 1;
+  agent_id: string;
+  delegation: DelegationCert[];
+  action: string;
+  target: string;
+  payload_hash: string;
+  ts: string;
+  prev: string | null;
+  /** Optional provenance (SPEC §3). Present when set; covered by the signature. */
+  runtime_hash?: string;
+  model_id?: string;
+  /** Hash of the product's tool/scope manifest that governed this action. */
+  manifest_hash?: string;
+  /** Optional pseudonymous data-subject tag (SPEC §3) — lets the end user the action was
+   * about find + audit their own slice (`@zanii/subject`). Covered by the signature. */
+  subject_tag?: string;
+  /**
+   * How `payload_hash` committed to the payload (SPEC §3). `'jcs'` means the payload was
+   * encoded with `payloadBytes` (RFC 8785) before hashing — the only value written since
+   * `@zanii/sdk` 0.5.0. ABSENT means a pre-0.5.0 receipt, whose bytes came from the SDK's
+   * own `JSON.stringify`/`json.dumps` and therefore differ between the two SDKs; those
+   * are checked with `verifyPayloadLegacy`, never with `verifyPayload`.
+   */
+  payload_encoding?: 'jcs';
+  sig: string;
+}
+
+export interface VerifyResult {
+  ok: boolean;
+  error?: string;
+}
+
+export function hashPayload(payload: Uint8Array | string): string {
+  const bytes = typeof payload === 'string' ? new TextEncoder().encode(payload) : payload;
+  return `sha256:${bytesToHex(sha256(bytes))}`;
+}
+
+/**
+ * Reject anything whose canonical form the two SDKs would not agree on. Mirrors
+ * `_check_jcs_safe` in `zanii.encoding`: non-integer numbers are the one place JSON
+ * serialisers legitimately disagree, so they are refused rather than hashed into a
+ * receipt no Python verifier can reproduce. Use integer minor units (`@zanii/payments`).
+ */
+function assertPayloadCanonicalizable(v: unknown, path = 'payload'): void {
+  if (v === null || typeof v === 'string' || typeof v === 'boolean') return;
+  if (typeof v === 'number') {
+    if (!Number.isFinite(v)) throw new Error(`${path}: ${v} has no JSON representation`);
+    if (!Number.isInteger(v)) {
+      throw new Error(
+        `${path}: non-integer number ${v} cannot be committed to a payload hash — the two SDKs ` +
+          'would encode it differently. Use integer minor units (see @zanii/payments) or a string.',
+      );
+    }
+    return;
+  }
+  if (Array.isArray(v)) {
+    v.forEach((x, i) => assertPayloadCanonicalizable(x, `${path}[${i}]`));
+    return;
+  }
+  if (typeof v === 'object') {
+    for (const [k, val] of Object.entries(v as Record<string, unknown>)) {
+      // An undefined member is DROPPED, per JSON.stringify: `{a:1,b:undefined}` encodes
+      // as `{"a":1}`, which is byte-identical to what Python produces for the equivalent
+      // input (the key simply absent). A Python `None` means JSON null, a different
+      // value, and correctly hashes differently. So this needs no special case.
+      if (val === undefined) continue;
+      assertPayloadCanonicalizable(val, `${path}.${k}`);
+    }
+    return;
+  }
+  throw new Error(`${path}: ${typeof v} is not canonicalizable JSON`);
+}
+
+/**
+ * The bytes a `payload_hash` commits to (SPEC §3): RFC 8785 JCS, UTF-8.
+ *
+ * This exists because "hash the payload" was under-specified: each SDK reached for its
+ * own serialiser, so the same object hashed differently in TypeScript and Python and
+ * `verifyPayload` returned false across languages for honest data. One encoder, both
+ * languages, byte-identical — pinned by the cross-language vectors.
+ *
+ * A top-level `undefined` (or `null`) encodes as `null`, which is what both SDKs already
+ * hashed, so null payloads are unaffected by the change.
+ */
+export function payloadBytes(payload: unknown): Uint8Array {
+  const value = payload === undefined ? null : payload;
+  assertPayloadCanonicalizable(value);
+  return canonicalBytes(value);
+}
+
+/**
+ * Privacy-preserving payload commitment: `sha256(nonce ‖ payload)`. A bare
+ * `hashPayload` of a low-entropy payload ("phone X, amount 500") is dictionary-
+ * attackable from the public anchored log, and a linkable hash can itself be
+ * personal data (PDPL). The per-receipt `nonce` is kept operator-side (NOT in the
+ * receipt), so the on-chain value reveals nothing; keep it to later prove the
+ * payload with `verifyPayload`. If `nonce` is omitted a fresh 16-byte one is drawn.
+ */
+export function saltedPayloadHash(
+  payload: Uint8Array | string,
+  nonce?: string,
+): { payload_hash: string; nonce: string } {
+  const nonceHex = nonce ?? bytesToHex(randomBytes(16));
+  const nonceBytes = hexToBytes(nonceHex);
+  const payloadBytes = typeof payload === 'string' ? new TextEncoder().encode(payload) : payload;
+  const combined = new Uint8Array(nonceBytes.length + payloadBytes.length);
+  combined.set(nonceBytes, 0);
+  combined.set(payloadBytes, nonceBytes.length);
+  return { payload_hash: `sha256:${bytesToHex(sha256(combined))}`, nonce: nonceHex };
+}
+
+/** Prove a payload matches a salted `payload_hash`, given the nonce kept at record time. */
+export function verifyPayload(payload: Uint8Array | string, nonce: string, payloadHash: string): boolean {
+  try {
+    return saltedPayloadHash(payload, nonce).payload_hash === payloadHash;
+  } catch {
+    return false;
+  }
+}
+
+/** Which pre-0.5.0 SDK's serialiser reproduced a legacy `payload_hash`. */
+export type PayloadDialect = 'jcs' | 'legacy-ts' | 'legacy-py';
+
+/** Old `@zanii/sdk`: `JSON.stringify`, insertion order, no spaces, raw UTF-8. */
+function legacyTsEncode(payload: unknown): string | undefined {
+  return JSON.stringify(payload) ?? 'null';
+}
+
+/** Old `zanii` (Python): `json.dumps(sort_keys=True)` — `, ` / `: ` separators, \uXXXX escapes. */
+function legacyPyEncode(value: unknown): string {
+  const esc = (str: string): string => {
+    let out = '';
+    for (const ch of str) {
+      const c = ch.codePointAt(0)!;
+      if (ch === '"') out += '\\"';
+      else if (ch === '\\') out += '\\\\';
+      else if (ch === '\n') out += '\\n';
+      else if (ch === '\r') out += '\\r';
+      else if (ch === '\t') out += '\\t';
+      else if (c < 0x20) out += `\\u${c.toString(16).padStart(4, '0')}`;
+      else if (c < 0x7f) out += ch;
+      else if (c > 0xffff) {
+        // Python escapes astral characters as a surrogate pair
+        const u = c - 0x10000;
+        out += `\\u${(0xd800 + (u >> 10)).toString(16)}\\u${(0xdc00 + (u & 0x3ff)).toString(16)}`;
+      } else out += `\\u${c.toString(16).padStart(4, '0')}`;
+    }
+    return `"${out}"`;
+  };
+  const enc = (v: unknown): string => {
+    if (v === null || v === undefined) return 'null';
+    if (typeof v === 'boolean') return v ? 'true' : 'false';
+    if (typeof v === 'number') return Number.isInteger(v) ? String(v) : String(v);
+    if (typeof v === 'string') return esc(v);
+    if (Array.isArray(v)) return `[${v.map(enc).join(', ')}]`;
+    const o = v as Record<string, unknown>;
+    const keys = Object.keys(o).sort();
+    return `{${keys.map((k) => `${esc(k)}: ${enc(o[k])}`).join(', ')}}`;
+  };
+  return enc(value);
+}
+
+/**
+ * Verify a payload against a receipt recorded BEFORE the JCS rule (no `payload_encoding`
+ * field). Such a receipt does not record which SDK wrote it, so this tries each old
+ * dialect and reports which one matched.
+ *
+ * Honest limits: the `legacy-ts` dialect depends on the object's original KEY INSERTION
+ * ORDER, which is not recoverable from a re-parsed payload, so it only matches when the
+ * caller reconstructs the object in the order it was recorded. Float formatting is
+ * likewise best-effort. A `null` result means no dialect reproduced the hash; it does not
+ * prove the payload wrong.
+ */
+export function verifyPayloadLegacy(
+  payload: unknown,
+  nonce: string,
+  payloadHash: string,
+): { ok: boolean; dialect: PayloadDialect | null } {
+  const attempts: Array<[PayloadDialect, () => Uint8Array | string]> = [
+    ['jcs', () => payloadBytes(payload)],
+    ['legacy-ts', () => legacyTsEncode(payload)!],
+    ['legacy-py', () => legacyPyEncode(payload)],
+  ];
+  for (const [dialect, encode] of attempts) {
+    try {
+      if (saltedPayloadHash(encode(), nonce).payload_hash === payloadHash) return { ok: true, dialect };
+    } catch {
+      /* this dialect cannot encode it — try the next */
+    }
+  }
+  return { ok: false, dialect: null };
+}
+
+export function createReceipt(
+  fields: {
+    agentId: string;
+    delegation: DelegationCert[];
+    action: string;
+    target: string;
+    payloadHash: string;
+    ts: string;
+    prev: string | null;
+    /** Optional provenance — included in the signed receipt only when provided. */
+    runtimeHash?: string;
+    modelId?: string;
+    manifestHash?: string;
+    /** Optional pseudonymous data-subject tag — per-subject auditability (`@zanii/subject`). */
+    subjectTag?: string;
+    /** How `payloadHash` committed to the payload. Set `'jcs'` when it came from `payloadBytes`. */
+    payloadEncoding?: 'jcs';
+  },
+  agentPrivateKey: Uint8Array,
+): Receipt {
+  if (Number.isNaN(Date.parse(fields.ts))) throw new Error(`invalid ts timestamp: ${fields.ts}`);
+  const unsigned = {
+    v: 1 as const,
+    agent_id: fields.agentId,
+    delegation: fields.delegation,
+    action: fields.action,
+    target: fields.target,
+    payload_hash: fields.payloadHash,
+    ts: fields.ts,
+    prev: fields.prev,
+    ...(fields.runtimeHash ? { runtime_hash: fields.runtimeHash } : {}),
+    ...(fields.modelId ? { model_id: fields.modelId } : {}),
+    ...(fields.manifestHash ? { manifest_hash: fields.manifestHash } : {}),
+    ...(fields.subjectTag ? { subject_tag: fields.subjectTag } : {}),
+    ...(fields.payloadEncoding ? { payload_encoding: fields.payloadEncoding } : {}),
+  };
+  const sig = ed25519.sign(canonicalBytes(unsigned), agentPrivateKey);
+  return { ...unsigned, sig: encodeSig(sig) };
+}
+
+/** Hash of the full receipt (incl. sig) — what the next receipt's `prev` points to. */
+export function receiptHash(receipt: Receipt): string {
+  return jcsHash(receipt);
+}
+
+export function verifyReceiptSignature(receipt: Receipt): boolean {
+  const pub = publicKeyFromDid(receipt.agent_id);
+  const sig = decodeSig(receipt.sig);
+  if (!pub || !sig) return false;
+  const { sig: _omitted, ...unsigned } = receipt;
+  try {
+    return ed25519.verify(sig, canonicalBytes(unsigned), pub);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Full single-receipt verification per SPEC §4:
+ * signature → delegation chain (at receipt time) → scope covers target → prev linkage.
+ */
+export function verifyReceipt(
+  receipt: Receipt,
+  opts: { expectedOwner?: string; revoked?: Set<string>; expectedPrev?: string | null } = {},
+): VerifyResult {
+  if (receipt.v !== 1) return { ok: false, error: 'unsupported receipt version' };
+  if (!verifyReceiptSignature(receipt)) return { ok: false, error: 'bad receipt signature' };
+
+  const ts = new Date(receipt.ts);
+  if (Number.isNaN(ts.getTime())) return { ok: false, error: 'invalid ts' };
+
+  const chain = verifyChain(receipt.delegation, {
+    agentId: receipt.agent_id,
+    expectedRoot: opts.expectedOwner,
+    revoked: opts.revoked,
+    at: ts,
+  });
+  if (!chain.ok) return { ok: false, error: `delegation: ${chain.error}` };
+
+  if (!scopesAllow(chain.effectiveScopes!, receipt.target)) {
+    return { ok: false, error: `target ${receipt.target} outside effective scopes` };
+  }
+
+  if (opts.expectedPrev !== undefined && receipt.prev !== opts.expectedPrev) {
+    return { ok: false, error: 'prev hash does not match preceding receipt (chain broken)' };
+  }
+
+  return { ok: true };
+}
+
+/**
+ * Verify an agent's full receipt sequence: every receipt valid and hash-linked
+ * to the one before it. Returns the index of the first bad receipt on failure.
+ */
+export function verifyReceiptChain(
+  receipts: Receipt[],
+  opts: { expectedOwner?: string; revoked?: Set<string> } = {},
+): VerifyResult & { failedIndex?: number } {
+  let expectedPrev: string | null = null;
+  for (let i = 0; i < receipts.length; i++) {
+    const r = receipts[i]!;
+    const result = verifyReceipt(r, { ...opts, expectedPrev });
+    if (!result.ok) return { ok: false, error: `receipt ${i}: ${result.error}`, failedIndex: i };
+    expectedPrev = receiptHash(r);
+  }
+  return { ok: true };
+}