@ziffer-io/verify 0.1.0

package/LICENSE

@@ -0,0 +1,120 @@
+ZIFFER SDK LICENSE
+
+Copyright (c) 2026 code75 SASU, Paris, France. All rights reserved.
+ZIFFER is a registered trademark of code75 SASU ("code75") — code75.io · ziffer.io
+
+This licence governs the software package it accompanies (the "SDK"): the ZIFFER client
+libraries, receipt verifier, wire types and MCP server published by code75. The SDK is
+proprietary software. It is not open source.
+
+1. DEFINITIONS
+   "Agreement" means the written contract under which code75 provides the ZIFFER service to
+   you or the organisation you act for. code75's standard form of that contract is the ZIFFER
+   Customer Agreement, docs/legal/ziffer-customer-agreement.md, v0.1, provided on request.
+   "Service" means the ZIFFER service so provided. "You" means the person or organisation
+   using the SDK under an Agreement.
+
+2. LICENCE
+   Subject to the Agreement and to this licence, code75 grants you a limited, non-exclusive,
+   non-transferable, non-sublicensable, revocable licence to install and run the SDK, in
+   unmodified form, solely to interact with the Service and to verify the receipts it issues,
+   for the term of the Agreement.
+
+3. RESTRICTIONS
+   Except as expressly permitted by section 2 or by a law that cannot be excluded by
+   contract, you shall not, and shall not permit anyone else to:
+   (a) copy, distribute, publish, sublicense, sell, rent, lease or lend the SDK, or make it
+       available to any third party;
+   (b) modify, adapt, translate or create derivative works of the SDK;
+   (c) reverse engineer, decompile, disassemble or otherwise attempt to derive the source
+       code, algorithms or protocols of the SDK or the Service;
+   (d) use the SDK to build, train or benchmark a product or service that competes with the
+       Service, or to access the Service other than through the interfaces code75 documents;
+   (e) circumvent, disable or interfere with any security, verification or usage-control
+       mechanism of the SDK or the Service;
+   (f) remove, obscure or alter any copyright, trademark or other proprietary notice on or
+       in the SDK.
+
+4. OWNERSHIP AND INTELLECTUAL PROPERTY
+   The SDK is licensed, not sold. code75 and its licensors own and retain all right, title
+   and interest in and to the SDK and the Service, including all copyright, patent, trade
+   secret, trademark and other intellectual property rights, and all improvements and
+   derivative works, by whomever made. Nothing in this licence transfers any such right to
+   you. All rights not expressly granted are reserved. Any suggestion, idea or feedback you
+   provide about the SDK or the Service may be used by code75 without restriction or
+   compensation. "ZIFFER" and "code75" and the associated logos are brands and marks of
+   code75; this licence grants no right to use them.
+
+5. THIRD-PARTY COMPONENTS
+   The SDK includes third-party open-source components listed in the accompanying file
+   THIRD-PARTY-NOTICES. Those components are licensed under their own terms, which govern
+   them and prevail over this licence for those components only. This licence does not
+   apply to them.
+
+6. UPDATES
+   code75 may release updated versions of the SDK. This licence applies to each version you
+   install unless a later version is accompanied by a different licence. code75 has no
+   obligation to provide updates or support except as stated in the Agreement.
+
+7. YOUR RESPONSIBILITY FOR YOUR ACTIONS AND YOUR DATA
+   The Service issues decisions and signed receipts; it does not perform any action. You
+   alone decide what your systems do with a decision, you alone hold the credentials with
+   which any action is performed, and you alone are responsible for every action your
+   systems take or fail to take, for the policy you write and sign, for the data you submit
+   to the Service, and for your compliance with applicable law, including data protection,
+   export control and sanctions laws. A decision or receipt is not legal, regulatory,
+   financial or professional advice and is not a guarantee that any action is lawful,
+   appropriate or safe.
+
+7A. INDEMNITY
+   You shall defend, indemnify and hold harmless code75, its officers, employees and
+   contractors from and against any claim, loss, liability, damage, cost or expense
+   (including reasonable legal fees) arising out of or relating to: (a) your use of the
+   SDK or the Service; (b) any action taken or not taken by your systems; (c) the policy,
+   data or content you provide; or (d) your breach of this licence, the Agreement or
+   applicable law.
+
+7B. PRE-RELEASE SOFTWARE
+   The SDK and the Service may be provided in a pre-release, evaluation or limited form.
+   You accept that such software may contain errors and may change or be withdrawn, and
+   you use it at your own risk.
+
+8. NO WARRANTY
+   THE SDK IS PROVIDED "AS IS" AND "AS AVAILABLE", WITHOUT WARRANTY OF ANY KIND, EXPRESS,
+   IMPLIED OR STATUTORY, INCLUDING WITHOUT LIMITATION ANY WARRANTY OF MERCHANTABILITY,
+   FITNESS FOR A PARTICULAR PURPOSE, TITLE OR NON-INFRINGEMENT, TO THE MAXIMUM EXTENT
+   PERMITTED BY LAW.
+
+9. LIMITATION OF LIABILITY
+   TO THE MAXIMUM EXTENT PERMITTED BY LAW, CODE75 SHALL NOT BE LIABLE FOR ANY INDIRECT,
+   INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS,
+   REVENUE, DATA OR GOODWILL, ARISING OUT OF OR RELATING TO THE SDK, HOWEVER CAUSED AND
+   UNDER ANY THEORY OF LIABILITY, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
+   CODE75'S TOTAL LIABILITY UNDER THIS LICENCE SHALL NOT EXCEED THE AMOUNT STATED IN THE
+   AGREEMENT OR, IF NONE IS STATED, ONE HUNDRED EUROS (EUR 100). Nothing in this licence
+   excludes or limits liability that cannot be excluded or limited under applicable law.
+
+10. TERMINATION
+   This licence terminates automatically, without notice, if you breach it or when the
+   Agreement ends. On termination you shall stop all use of the SDK and destroy every copy
+   in your possession or control. Sections 3, 4, 7, 7A, 8, 9, 10, 11 and 12 survive
+   termination.
+
+11. GOVERNING LAW AND JURISDICTION
+   This licence is governed by the laws of France, without regard to conflict-of-law rules.
+   Any dispute arising out of or relating to this licence is submitted to the exclusive
+   jurisdiction of the competent courts of Paris, France, unless the Agreement states
+   otherwise.
+
+12. GENERAL
+   This licence, the Agreement and THIRD-PARTY-NOTICES are the entire terms for the SDK.
+   Where this licence and the Agreement conflict, the Agreement prevails. If any provision
+   of this licence is held unenforceable, it is enforced to the maximum extent permitted
+   and the remainder stays in effect. No failure or delay by code75 in exercising a right
+   is a waiver of it. You may not assign this licence without code75's written consent;
+   code75 may assign it to a successor of the ZIFFER business. Any claim by you relating to
+   the SDK must be brought within one (1) year after it arises, to the extent the law
+   allows. This licence is written in English; a translation is for convenience only and
+   the English text prevails.
+
+Contact: code75 SASU, Paris — code75.io · ziffer.io

package/README.md

@@ -0,0 +1,121 @@
+# @ziffer-io/verify
+
+The **third implementation** of ACP receipt verification. The first two live in the
+engine repository at the pin this workspace's `Cargo.toml` names: the Python reference
+(`reference/src/acp_executor.py`, the readable §9.3 checklist) and Rust
+(`crates/acp-decision`, the production decision path). This package lives in ziffer
+**only because the engine repository is publicly frozen and ziffer CI cannot reach new
+engine commits**; the mirrored corpus in `fixtures/` plus `tools/check-verify-mirror.py`
+is what keeps three copies of one rule honest. Engine-home for this package is revisited
+if the freeze lifts.
+
+```bash
+npm install @ziffer-io/verify
+```
+
+Most integrations do not install this directly. `@ziffer-io/client` depends on it and re-exports
+`verifyReceipt`, so there is one verifier in your dependency tree rather than two that can
+disagree. Install it on its own when you verify receipts and never call the API.
+
+## What it does
+
+```ts
+import { verifyReceipt, Refusal } from '@ziffer-io/verify';
+
+const verified = verifyReceipt(receiptJson, proposalBytes, {
+  classical, // Ed25519 verification key, 32 bytes, from the signed bundle (PB-12)
+  pq,        // ML-DSA-65 verification key, 1,952 bytes, same home
+  minSuite: 'hybrid-ed25519-mldsa65', // CR-4 floor, from the signed manifest
+});
+// throws Refusal on any defect; verified.proposalHash is the verifier's OWN hash
+```
+
+`verifyReceipt` runs exactly the **stateless** portion of the §9.3 checklist — the part
+answerable with only receipt + proposal + identity: AB-0 (receipt version 3 only),
+AB-5/AB-6 (signed-body exclusion and byte cap), CR-1/CR-4/CR-3 (suite known, floor by
+containment, hybrid **conjunctive** — every primitive must verify), 9.3-2 (decision
+domain), 9.3-3 (proposal hash **recomputed** from the caller's own bytes, never read
+from the message — RES-8), 9.3-5/L-14 (temporal position and window ceiling, over
+strictly parsed RFC 3339 UTC instants), WE-4/L-17 (nonce type and size).
+
+A pass means "the stateless set found nothing", never "the receipt may be consumed":
+steps 4 (policy basis), 6's CL-2 claim, 7 (grading recomputation), 7b (the quorum),
+8 (tenant scoping) and 9–10 need the signed bundle, the attester registry, a ledger and
+a context store, and are deliberately absent rather than approximated. The module doc in
+`src/verify.ts` carries the full table and the R/B/T classification.
+
+Every refusal is a thrown `Refusal` whose `clause` is spelled **exactly as the engine's
+Rust clause constants** spell it (`AB-0`, `AB-6`, `CR-1`, `CR-4`, `AT-8a`, `9.3-1`,
+`9.3-2`, `9.3-3`, `9.3-5`, `L-14`, `WE-4`, `L-17`) — the clause is what the three
+implementations are compared on.
+
+## What it does not do
+
+- **It is not a receipt gate.** A pass is "the stateless set found nothing", not "this receipt may
+  be consumed" — the paragraph above lists the six §9.3 steps that need a signed bundle, an
+  attester registry, a ledger and a context store, and are absent rather than approximated.
+- **It fetches nothing and trusts nothing you did not hand it.** The identity keys and the CR-4
+  suite floor are arguments. It will not read them from the receipt, because a verifier that takes
+  a derived security value from the party it is verifying is the defect class this specification
+  has published five corrections for (RES-8).
+- **It does not hash your proposal for you.** You pass the bytes your own code passes to the API,
+  and the verifier recomputes the hash from them. Handing it the hash would verify nothing.
+- **It has no `approve`, and no test mode that mints a receipt.** Signing lives behind keys this
+  package never holds.
+
+## Strict Ed25519, written out
+
+`@noble/curves`' `verify` with `{ zip215: false }` enforces canonical encodings but —
+like OpenSSL — does **not** refuse small-order points. The ACP-106 rule (a small-order
+public key or a small-order `R` makes the verification equation stop mentioning the
+message) is therefore written out in `src/ed25519.ts`, exactly as the Python reference
+writes it in `verify_prim` and Rust gets from `verify_strict`. The mirrored
+`fixtures/refused_ed25519.json` is the executable statement: every vector is accepted by
+RFC 8032 as OpenSSL implements it and refused by all three implementations. Deleting the
+guard here was observed to accept the corpus's `r_is_the_identity_point` vector.
+
+## Canonicalization, proven not transcribed
+
+`src/canon.ts` reproduces the engine canon (sorted keys at every depth by **code
+point** — not JS's UTF-16 unit order — no whitespace, raw UTF-8). The proof is a
+triangle: `fixtures/canon_vectors.json` was generated by importing and executing the
+engine's own `acp_executor.canon` (`fixtures/gen_canon_vectors.py`), the TS tests assert
+byte-identity with the fixture on every case, and `tools/check-verify-mirror.py`
+re-derives every case against the engine at the pin.
+
+**Disclosed divergence (fail-closed):** the engine accepts a float *nested* in a signed
+structure (the ACP-75 bug-for-bug agreement between Python and Rust). This
+implementation refuses any non-integer number at any depth under `AT-8a`, because
+`JSON.parse` collapses `1000.0` and `1000` into one value and reproducing the engine's
+bytes would be a guess about bytes it never saw. Integers beyond `2^53−1` are refused
+for the same reason (the ACP-54 integer-domain family reached from the JS side). No
+conforming wire receipt carries either — every temporal field is an RFC 3339 string
+since v1.3.28 (ACP-167). Both refusals are pinned by tests so the divergence cannot
+vanish silently.
+
+## Fixtures
+
+Byte-identical mirrors of engine files, each with a `.provenance.json` sidecar (source
+path, rev, sha256 — a header *inside* the JSON would change the bytes the identity claim
+is about): `refused_ed25519.json`, `python_signatures.json` (the reference's signatures,
+which this side must accept — the TS leg of `tests/python_interop.rs`' claim; its seeds
+also pin the test-key derivation mirror in `src/testkeys.ts`), and
+`instant-type-vectors.json` (this package is the shared instant corpus's fourth
+consumer). Plus the derived `canon_vectors.json` above. Re-mirror at a pin bump;
+`tools/check-verify-mirror.py` refuses a mirror whose provenance rev is not the
+workspace pin.
+
+## Running
+
+```sh
+pnpm --filter @ziffer-io/verify test        # tsc -b && node --test (27 tests)
+python3 tools/check-verify-mirror.py  # from the repo root; needs ACP_REPO_PATH at the pin
+```
+
+## Licence
+
+Proprietary. Copyright (c) 2026 code75 SASU, Paris, France. ZIFFER is a registered trademark of code75
+SASU. This package is **not open source**: it is licensed for use with the ZIFFER service under
+your agreement with code75, on the terms in `LICENSE` beside this file. The third-party
+open-source components it redistributes are listed in `THIRD-PARTY-NOTICES` and are governed by
+their own licences.

package/THIRD-PARTY-NOTICES

@@ -0,0 +1,40 @@
+THIRD-PARTY NOTICES for @ziffer-io/verify
+
+GENERATED FILE -- do not edit by hand.
+Regenerate with: node tools/third-party-notices.mjs
+tools/release-npm.sh refuses to publish when this file is out of date.
+
+The LICENSE beside this file governs the ZIFFER SDK itself, which is
+proprietary software of code75 SASU. The components below are third-party
+open-source, are redistributed under their own licences, and those licences
+govern them and prevail for those components only (SDK licence, section 5).
+Each entry is read from the component as it is installed, at the version
+this release resolves.
+
+4 component(s):
+
+----------------------------------------------------------------------------
+@noble/ciphers  2.3.0
+  licence: MIT
+  Copyright (c) 2022 Paul Miller (https://paulmillr.com)
+  full text: LICENSE, as distributed in the package
+
+----------------------------------------------------------------------------
+@noble/curves  2.3.0
+  licence: MIT
+  Copyright (c) 2022 Paul Miller (https://paulmillr.com)
+  full text: LICENSE, as distributed in the package
+
+----------------------------------------------------------------------------
+@noble/hashes  2.3.0
+  licence: MIT
+  Copyright (c) 2022 Paul Miller (https://paulmillr.com)
+  full text: LICENSE, as distributed in the package
+
+----------------------------------------------------------------------------
+@noble/post-quantum  0.7.0
+  licence: MIT
+  Copyright (c) 2024 Paul Miller (https://paulmillr.com)
+  full text: LICENSE, as distributed in the package
+
+----------------------------------------------------------------------------

package/dist/canon.d.ts

@@ -0,0 +1,61 @@
+/**
+ * AT-8a -- the canonical bytes, the third writing of one encoding.
+ *
+ * The engine's two: `reference/src/acp_executor.py::canon` (json.dumps,
+ * sort_keys, separators (",", ":"), ensure_ascii=False) and
+ * `crates/acp-decision/src/receipt.rs::canon` (sorted keys at every depth,
+ * scalars through serde's writer). `fixtures/canon_vectors.json` holds bytes
+ * the ENGINE's own canon produced, and tools/check-verify-mirror.py re-derives
+ * them against the engine at the pin -- so this file agreeing with the fixture
+ * is this file agreeing with the engine, not with a transcription of it.
+ *
+ * # Key order is CODE-POINT order, sorted here, at every depth
+ *
+ * Python's `sort_keys=True` sorts str by code point; Rust sorts `&str` by
+ * UTF-8 bytes, which is the same order. JavaScript's default string comparison
+ * is by UTF-16 CODE UNIT, which disagrees for exactly one region: an astral
+ * character (>= U+10000) encodes as a surrogate pair starting at 0xD800, so it
+ * sorts BEFORE U+E000..U+FFFF instead of after. `compareCodePoints` below is
+ * written out for that reason, and the fixture's
+ * `astral_keys_sort_by_code_point_not_utf16_unit` case is red under a naive
+ * `keys.sort()`. Sorting is done HERE, never by trusting object insertion
+ * order -- the ACP-126 lesson (a map that is sorted "by construction" is
+ * sorted in exactly one build configuration) applies to JS objects verbatim:
+ * they preserve insertion order, and integer-like keys don't even do that.
+ *
+ * # Numbers: safe integers ONLY, and this is a disclosed divergence
+ *
+ * The engine accepts a float NESTED in a structure (top-level only is refused)
+ * -- the ACP-75 bug-for-bug agreement between Python and Rust. This
+ * implementation cannot join that agreement honestly: JSON.parse collapses
+ * `1000.0` and `1000` into one value, and Python/serde render the first as
+ * "1000.0" while JS would render "1000" -- silently different signed bytes for
+ * bytes the engine accepted. Guessing would be a forgery of the preimage, so
+ * a non-integer number is REFUSED here at any depth (AT-8a, fail closed).
+ * No conforming wire receipt carries one: every temporal field is an RFC 3339
+ * string since v1.3.28 (ACP-167). The same rule refuses integers outside
+ * Number.MAX_SAFE_INTEGER, where JSON.parse has already lost the digits the
+ * engine would have signed (the ACP-54 integer-domain family, reached from the
+ * JS side). Both refusals are pinned by tests so the divergence cannot vanish
+ * silently.
+ */
+/** What a parsed JSON document can be. `unknown` is narrowed at the walk. */
+export type Json = null | boolean | number | string | Json[] | {
+    [key: string]: Json;
+};
+/**
+ * Code-point comparison -- Python's `sorted()` over str, Rust's `&str` `Ord`.
+ *
+ * Iterating a string with `for..of` yields whole code points (surrogate pairs
+ * arrive as one unit), so comparing `codePointAt(0)` per step IS code-point
+ * order; the loop exists because `<` on the full strings would be UTF-16 order.
+ */
+export declare function compareCodePoints(a: string, b: string): number;
+/**
+ * The canonical UTF-8 bytes of a parsed JSON value.
+ *
+ * One encoding for BOTH signing preimages and id derivation, exactly as the
+ * reference states it: sorted keys, no whitespace, no floats, raw UTF-8.
+ */
+export declare function canon(value: unknown): Uint8Array;
+//# sourceMappingURL=canon.d.ts.map

package/dist/canon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canon.d.ts","sourceRoot":"","sources":["../src/canon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAKH,6EAA6E;AAC7E,MAAM,MAAM,IAAI,GAAG,IAAI,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,EAAE,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAEvF;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAkB9D;AAkED;;;;;GAKG;AACH,wBAAgB,KAAK,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CAIhD"}

package/dist/canon.js

@@ -0,0 +1,147 @@
+/**
+ * AT-8a -- the canonical bytes, the third writing of one encoding.
+ *
+ * The engine's two: `reference/src/acp_executor.py::canon` (json.dumps,
+ * sort_keys, separators (",", ":"), ensure_ascii=False) and
+ * `crates/acp-decision/src/receipt.rs::canon` (sorted keys at every depth,
+ * scalars through serde's writer). `fixtures/canon_vectors.json` holds bytes
+ * the ENGINE's own canon produced, and tools/check-verify-mirror.py re-derives
+ * them against the engine at the pin -- so this file agreeing with the fixture
+ * is this file agreeing with the engine, not with a transcription of it.
+ *
+ * # Key order is CODE-POINT order, sorted here, at every depth
+ *
+ * Python's `sort_keys=True` sorts str by code point; Rust sorts `&str` by
+ * UTF-8 bytes, which is the same order. JavaScript's default string comparison
+ * is by UTF-16 CODE UNIT, which disagrees for exactly one region: an astral
+ * character (>= U+10000) encodes as a surrogate pair starting at 0xD800, so it
+ * sorts BEFORE U+E000..U+FFFF instead of after. `compareCodePoints` below is
+ * written out for that reason, and the fixture's
+ * `astral_keys_sort_by_code_point_not_utf16_unit` case is red under a naive
+ * `keys.sort()`. Sorting is done HERE, never by trusting object insertion
+ * order -- the ACP-126 lesson (a map that is sorted "by construction" is
+ * sorted in exactly one build configuration) applies to JS objects verbatim:
+ * they preserve insertion order, and integer-like keys don't even do that.
+ *
+ * # Numbers: safe integers ONLY, and this is a disclosed divergence
+ *
+ * The engine accepts a float NESTED in a structure (top-level only is refused)
+ * -- the ACP-75 bug-for-bug agreement between Python and Rust. This
+ * implementation cannot join that agreement honestly: JSON.parse collapses
+ * `1000.0` and `1000` into one value, and Python/serde render the first as
+ * "1000.0" while JS would render "1000" -- silently different signed bytes for
+ * bytes the engine accepted. Guessing would be a forgery of the preimage, so
+ * a non-integer number is REFUSED here at any depth (AT-8a, fail closed).
+ * No conforming wire receipt carries one: every temporal field is an RFC 3339
+ * string since v1.3.28 (ACP-167). The same rule refuses integers outside
+ * Number.MAX_SAFE_INTEGER, where JSON.parse has already lost the digits the
+ * engine would have signed (the ACP-54 integer-domain family, reached from the
+ * JS side). Both refusals are pinned by tests so the divergence cannot vanish
+ * silently.
+ */
+import { CLAUSE_CANONICAL } from './clauses.js';
+import { Refusal } from './refusal.js';
+/**
+ * Code-point comparison -- Python's `sorted()` over str, Rust's `&str` `Ord`.
+ *
+ * Iterating a string with `for..of` yields whole code points (surrogate pairs
+ * arrive as one unit), so comparing `codePointAt(0)` per step IS code-point
+ * order; the loop exists because `<` on the full strings would be UTF-16 order.
+ */
+export function compareCodePoints(a, b) {
+    const ia = a[Symbol.iterator]();
+    const ib = b[Symbol.iterator]();
+    for (;;) {
+        const na = ia.next();
+        const nb = ib.next();
+        if (na.done && nb.done)
+            return 0;
+        if (na.done)
+            return -1;
+        if (nb.done)
+            return 1;
+        const ca = na.value.codePointAt(0);
+        const cb = nb.value.codePointAt(0);
+        // codePointAt(0) on a non-empty string cannot be undefined; the guard is
+        // for the type system, and refusing loudly beats a silent NaN comparison.
+        if (ca === undefined || cb === undefined) {
+            throw new Refusal(CLAUSE_CANONICAL, 'key is not a comparable string');
+        }
+        if (ca !== cb)
+            return ca - cb;
+    }
+}
+// A type predicate, not an `as` cast (the project rules forbid the cast, and
+// here it would be load-bearing): null and arrays are handled before this is
+// consulted, so what remains of `object` is a plain key-value record.
+function isPlainObject(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+function writeCanon(value, out) {
+    if (value === null || value === true || value === false) {
+        out.push(String(value));
+        return;
+    }
+    if (typeof value === 'number') {
+        if (!Number.isSafeInteger(value)) {
+            // Both halves of the disclosed divergence in the module doc: a float at
+            // ANY depth (the engine refuses top-level only), and an integer beyond
+            // 2^53-1 (JSON.parse already lost digits the engine would have signed).
+            throw new Refusal(CLAUSE_CANONICAL, 'number is not a safe integer: JS cannot reproduce the engine canon bytes for it');
+        }
+        // A JSON `-0` parses to negative zero here and to integer zero in Python
+        // and serde; String(-0) is "0", so all three emit the same byte. Noted so
+        // nobody "fixes" this to preserve the sign JS kept and JSON did not.
+        out.push(String(value));
+        return;
+    }
+    if (typeof value === 'string') {
+        // JSON.stringify escapes exactly what Python's ensure_ascii=False and
+        // serde_json escape: the quote, the backslash, \b \t \n \f \r, and other
+        // control chars as \u00xx -- everything else travels as raw UTF-8. The
+        // fixture's control-char and astral cases hold all three to it.
+        out.push(JSON.stringify(value));
+        return;
+    }
+    if (Array.isArray(value)) {
+        out.push('[');
+        for (let i = 0; i < value.length; i += 1) {
+            if (i > 0)
+                out.push(',');
+            writeCanon(value[i], out);
+        }
+        out.push(']');
+        return;
+    }
+    if (isPlainObject(value)) {
+        const obj = value;
+        const keys = Object.keys(obj).sort(compareCodePoints);
+        out.push('{');
+        for (let i = 0; i < keys.length; i += 1) {
+            const key = keys[i];
+            if (key === undefined)
+                continue; // unreachable; index is in range
+            if (i > 0)
+                out.push(',');
+            out.push(JSON.stringify(key));
+            out.push(':');
+            writeCanon(obj[key], out);
+        }
+        out.push('}');
+        return;
+    }
+    // undefined, functions, bigints, symbols: not JSON, not encodable.
+    throw new Refusal(CLAUSE_CANONICAL, `type ${typeof value} is not canonically encodable`);
+}
+/**
+ * The canonical UTF-8 bytes of a parsed JSON value.
+ *
+ * One encoding for BOTH signing preimages and id derivation, exactly as the
+ * reference states it: sorted keys, no whitespace, no floats, raw UTF-8.
+ */
+export function canon(value) {
+    const out = [];
+    writeCanon(value, out);
+    return new TextEncoder().encode(out.join(''));
+}
+//# sourceMappingURL=canon.js.map

package/dist/canon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canon.js","sourceRoot":"","sources":["../src/canon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAKvC;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAS,EAAE,CAAS;IACpD,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;IAChC,MAAM,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;IAChC,SAAS,CAAC;QACR,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;QACrB,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;QACrB,IAAI,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC;QACjC,IAAI,EAAE,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC,CAAC;QACvB,IAAI,EAAE,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC;QACtB,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACnC,yEAAyE;QACzE,0EAA0E;QAC1E,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;YACzC,MAAM,IAAI,OAAO,CAAC,gBAAgB,EAAE,gCAAgC,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChC,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,sEAAsE;AACtE,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,GAAa;IAC/C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;QACxD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACxB,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACjC,wEAAwE;YACxE,uEAAuE;YACvE,wEAAwE;YACxE,MAAM,IAAI,OAAO,CACf,gBAAgB,EAChB,iFAAiF,CAClF,CAAC;QACJ,CAAC;QACD,yEAAyE;QACzE,0EAA0E;QAC1E,qEAAqE;QACrE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACxB,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,sEAAsE;QACtE,yEAAyE;QACzE,uEAAuE;QACvE,gEAAgE;QAChE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAChC,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,IAAI,CAAC,GAAG,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzB,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACd,OAAO;IACT,CAAC;IACD,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,KAAK,CAAC;QAClB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACtD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,IAAI,GAAG,KAAK,SAAS;gBAAE,SAAS,CAAC,iCAAiC;YAClE,IAAI,CAAC,GAAG,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9B,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACd,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACd,OAAO;IACT,CAAC;IACD,mEAAmE;IACnE,MAAM,IAAI,OAAO,CAAC,gBAAgB,EAAE,QAAQ,OAAO,KAAK,+BAA+B,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,KAAK,CAAC,KAAc;IAClC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,UAAU,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACvB,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAChD,CAAC"}

package/dist/clauses.d.ts

@@ -0,0 +1,53 @@
+/**
+ * The refusal names, spelled EXACTLY as the engine's Rust clause constants
+ * spell them (crates/acp-decision/src/{receipt,decide,quorum}.rs at the pin).
+ *
+ * This is the third implementation of receipt verification, and the clause a
+ * refusal carries is what the three are compared ON: two verifiers that both
+ * refuse a forged, expired receipt -- one saying 9.3-1, the other 9.3-5 --
+ * have not been shown to agree on anything an operator could act on
+ * (decide.rs module doc). So every name here is a wire contract, not a label,
+ * and a constant may change only when the engine's does.
+ *
+ * The Rust constant NAME is kept beside each value so a reader diffing the two
+ * files sees one table, not two vocabularies.
+ */
+/** Rust `receipt::CLAUSE_VERSION` -- AB-0, the receipt does not declare version 3. */
+export declare const CLAUSE_VERSION = "AB-0";
+/** Rust `receipt::CLAUSE_BODY_SIZE` -- AB-6, the signed body exceeds the custody byte cap. */
+export declare const CLAUSE_BODY_SIZE = "AB-6";
+/** Rust `receipt::CLAUSE_UNKNOWN_SUITE` -- CR-1, the suite name is not one this build knows. */
+export declare const CLAUSE_UNKNOWN_SUITE = "CR-1";
+/** Rust `receipt::CLAUSE_SUITE_FLOOR` -- CR-4, the suite does not contain every floor primitive. */
+export declare const CLAUSE_SUITE_FLOOR = "CR-4";
+/** Rust `receipt::CLAUSE_CANONICAL` -- AT-8a, the structure is not canonically encodable. */
+export declare const CLAUSE_CANONICAL = "AT-8a";
+/** Rust `receipt::CLAUSE_SIGNATURE` -- 9.3-1, the signature did not verify under the bundle key. */
+export declare const CLAUSE_SIGNATURE = "9.3-1";
+/** Rust `receipt::CLAUSE_DECISION` -- 9.3-2, the decision was not ALLOW. */
+export declare const CLAUSE_DECISION = "9.3-2";
+/**
+ * Rust `decide.rs` spells 9.3-3 as a literal at the refusal site, not a
+ * constant; the value is the contract either way. Receipt not bound to this
+ * proposal (B-1a).
+ */
+export declare const CLAUSE_PROPOSAL_BINDING = "9.3-3";
+/** Rust literal in `decide.rs` step 5 -- temporal position (missing, malformed, expired, future). */
+export declare const CLAUSE_TEMPORAL = "9.3-5";
+/**
+ * Rust literal in `decide.rs` step 5 -- L-14, the validity-window ceiling.
+ * A SEPARATE clause from 9.3-5: a receipt whose window is 10x too long is an
+ * attacker widening the interval a stolen receipt is usable in (Y2), and
+ * calling that "expired" would tell an operator the wrong thing.
+ */
+export declare const CLAUSE_VALIDITY_WINDOW = "L-14";
+/** Rust `quorum::CLAUSE_WIRE_TYPE` -- WE-4, the nonce is not `b64:` + RFC 4648 s4 base64. */
+export declare const CLAUSE_WIRE_TYPE = "WE-4";
+/**
+ * Rust `decide::CLAUSE_RECEIPT_NONCE_SIZE` -- L-17, the receipt nonce is
+ * well-formed but not 128-bit. The receipt nonce's OWN size clause, never
+ * AT-1 (which sizes the attestation nonce): one number, two clauses, and the
+ * refusal carries the field's (ACP-88/ACP-89).
+ */
+export declare const CLAUSE_RECEIPT_NONCE_SIZE = "L-17";
+//# sourceMappingURL=clauses.d.ts.map

package/dist/clauses.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clauses.d.ts","sourceRoot":"","sources":["../src/clauses.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,sFAAsF;AACtF,eAAO,MAAM,cAAc,SAAS,CAAC;AACrC,8FAA8F;AAC9F,eAAO,MAAM,gBAAgB,SAAS,CAAC;AACvC,gGAAgG;AAChG,eAAO,MAAM,oBAAoB,SAAS,CAAC;AAC3C,oGAAoG;AACpG,eAAO,MAAM,kBAAkB,SAAS,CAAC;AACzC,6FAA6F;AAC7F,eAAO,MAAM,gBAAgB,UAAU,CAAC;AACxC,oGAAoG;AACpG,eAAO,MAAM,gBAAgB,UAAU,CAAC;AACxC,4EAA4E;AAC5E,eAAO,MAAM,eAAe,UAAU,CAAC;AACvC;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,UAAU,CAAC;AAC/C,qGAAqG;AACrG,eAAO,MAAM,eAAe,UAAU,CAAC;AACvC;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,SAAS,CAAC;AAC7C,6FAA6F;AAC7F,eAAO,MAAM,gBAAgB,SAAS,CAAC;AACvC;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,SAAS,CAAC"}

package/dist/clauses.js

@@ -0,0 +1,53 @@
+/**
+ * The refusal names, spelled EXACTLY as the engine's Rust clause constants
+ * spell them (crates/acp-decision/src/{receipt,decide,quorum}.rs at the pin).
+ *
+ * This is the third implementation of receipt verification, and the clause a
+ * refusal carries is what the three are compared ON: two verifiers that both
+ * refuse a forged, expired receipt -- one saying 9.3-1, the other 9.3-5 --
+ * have not been shown to agree on anything an operator could act on
+ * (decide.rs module doc). So every name here is a wire contract, not a label,
+ * and a constant may change only when the engine's does.
+ *
+ * The Rust constant NAME is kept beside each value so a reader diffing the two
+ * files sees one table, not two vocabularies.
+ */
+/** Rust `receipt::CLAUSE_VERSION` -- AB-0, the receipt does not declare version 3. */
+export const CLAUSE_VERSION = 'AB-0';
+/** Rust `receipt::CLAUSE_BODY_SIZE` -- AB-6, the signed body exceeds the custody byte cap. */
+export const CLAUSE_BODY_SIZE = 'AB-6';
+/** Rust `receipt::CLAUSE_UNKNOWN_SUITE` -- CR-1, the suite name is not one this build knows. */
+export const CLAUSE_UNKNOWN_SUITE = 'CR-1';
+/** Rust `receipt::CLAUSE_SUITE_FLOOR` -- CR-4, the suite does not contain every floor primitive. */
+export const CLAUSE_SUITE_FLOOR = 'CR-4';
+/** Rust `receipt::CLAUSE_CANONICAL` -- AT-8a, the structure is not canonically encodable. */
+export const CLAUSE_CANONICAL = 'AT-8a';
+/** Rust `receipt::CLAUSE_SIGNATURE` -- 9.3-1, the signature did not verify under the bundle key. */
+export const CLAUSE_SIGNATURE = '9.3-1';
+/** Rust `receipt::CLAUSE_DECISION` -- 9.3-2, the decision was not ALLOW. */
+export const CLAUSE_DECISION = '9.3-2';
+/**
+ * Rust `decide.rs` spells 9.3-3 as a literal at the refusal site, not a
+ * constant; the value is the contract either way. Receipt not bound to this
+ * proposal (B-1a).
+ */
+export const CLAUSE_PROPOSAL_BINDING = '9.3-3';
+/** Rust literal in `decide.rs` step 5 -- temporal position (missing, malformed, expired, future). */
+export const CLAUSE_TEMPORAL = '9.3-5';
+/**
+ * Rust literal in `decide.rs` step 5 -- L-14, the validity-window ceiling.
+ * A SEPARATE clause from 9.3-5: a receipt whose window is 10x too long is an
+ * attacker widening the interval a stolen receipt is usable in (Y2), and
+ * calling that "expired" would tell an operator the wrong thing.
+ */
+export const CLAUSE_VALIDITY_WINDOW = 'L-14';
+/** Rust `quorum::CLAUSE_WIRE_TYPE` -- WE-4, the nonce is not `b64:` + RFC 4648 s4 base64. */
+export const CLAUSE_WIRE_TYPE = 'WE-4';
+/**
+ * Rust `decide::CLAUSE_RECEIPT_NONCE_SIZE` -- L-17, the receipt nonce is
+ * well-formed but not 128-bit. The receipt nonce's OWN size clause, never
+ * AT-1 (which sizes the attestation nonce): one number, two clauses, and the
+ * refusal carries the field's (ACP-88/ACP-89).
+ */
+export const CLAUSE_RECEIPT_NONCE_SIZE = 'L-17';
+//# sourceMappingURL=clauses.js.map

package/dist/clauses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clauses.js","sourceRoot":"","sources":["../src/clauses.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,sFAAsF;AACtF,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AACrC,8FAA8F;AAC9F,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AACvC,gGAAgG;AAChG,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAC3C,oGAAoG;AACpG,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AACzC,6FAA6F;AAC7F,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AACxC,oGAAoG;AACpG,MAAM,CAAC,MAAM,gBAAgB,GAAG,OAAO,CAAC;AACxC,4EAA4E;AAC5E,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AACvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,OAAO,CAAC;AAC/C,qGAAqG;AACrG,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AACvC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAC7C,6FAA6F;AAC7F,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AACvC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,MAAM,CAAC"}