mailschema 0.2.1 → 0.3.0

package/dist/core/contract.js

@@ -0,0 +1,253 @@
+import { CONTRACT_MAX_BYTES, contractSchema, createValidator, EFFECTS, FORMATS, schemaErrors, } from "./artifacts.js";
+import { descriptionErrors } from "./description.js";
+import { digest, InvalidDocument, parse } from "./json.js";
+import { unportablePattern } from "./patterns.js";
+/** The capability binding's kinds: the exact effects each declares and its longest lifetime. */
+export const CAPABILITY_KINDS = {
+    refusal: { effects: ['refusal', 'state'], maxLifetimeSeconds: 604800 },
+    'protective-report': { effects: ['protection', 'state'], maxLifetimeSeconds: 259200 },
+    'address-confirmation': { effects: ['assertion', 'state'], maxLifetimeSeconds: 86400 },
+};
+// The JSON Schema 2020-12 keywords a contract's schemas may use. Every implementation
+// enforces all of them alike; scope-resolved references and content annotations are absent.
+const KEYWORDS = new Set([
+    '$schema', '$ref', '$defs', '$comment',
+    'allOf', 'anyOf', 'oneOf', 'not', 'if', 'then', 'else', 'dependentSchemas',
+    'prefixItems', 'items', 'contains', 'properties', 'patternProperties',
+    'additionalProperties', 'propertyNames', 'unevaluatedItems', 'unevaluatedProperties',
+    'type', 'enum', 'const', 'multipleOf', 'maximum', 'exclusiveMaximum', 'minimum',
+    'exclusiveMinimum', 'maxLength', 'minLength', 'pattern', 'maxItems', 'minItems',
+    'uniqueItems', 'maxContains', 'minContains', 'maxProperties', 'minProperties', 'required',
+    'dependentRequired', 'format',
+    'title', 'description', 'default', 'deprecated', 'readOnly', 'writeOnly', 'examples',
+]); // prettier-ignore
+const SCHEMA = ['additionalProperties', 'propertyNames', 'items', 'contains', 'not', 'if', 'then', 'else', 'unevaluatedItems', 'unevaluatedProperties']; // prettier-ignore
+const SCHEMA_LISTS = ['allOf', 'anyOf', 'oneOf', 'prefixItems'];
+const SCHEMA_MAPS = ['properties', 'patternProperties', '$defs', 'dependentSchemas'];
+const DIALECT = 'https://json-schema.org/draft/2020-12/schema';
+// The keywords that apply their subschemas to the value itself, not to a member or item.
+const IN_PLACE = new Set(['not', 'if', 'then', 'else', 'allOf', 'anyOf', 'oneOf', 'dependentSchemas']);
+const escape = (name) => name.replaceAll('~', '~0').replaceAll('/', '~1');
+/** The values a schema object holds where schemas belong, as [keyword, pointer, value]. */
+function children(node, pointer) {
+    const found = [];
+    for (const keyword of SCHEMA)
+        if (Object.hasOwn(node, keyword))
+            found.push([keyword, `${pointer}/${keyword}`, node[keyword]]);
+    for (const keyword of SCHEMA_LISTS)
+        if (Array.isArray(node[keyword]))
+            for (const [index, item] of node[keyword].entries())
+                found.push([keyword, `${pointer}/${keyword}/${index}`, item]);
+    for (const keyword of SCHEMA_MAPS) {
+        const map = node[keyword];
+        if (map && typeof map === 'object' && !Array.isArray(map))
+            for (const [name, item] of Object.entries(map))
+                found.push([keyword, `${pointer}/${keyword}/${escape(name)}`, item]);
+    }
+    return found;
+}
+const isObject = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+/**
+ * Every schema within a schema, object or boolean, with its JSON Pointer from the root, the
+ * schema itself first.
+ */
+function* schemas(schema, pointer) {
+    if (typeof schema === 'boolean')
+        yield [pointer, schema];
+    if (!isObject(schema))
+        return;
+    yield [pointer, schema];
+    for (const [, at, item] of children(schema, pointer))
+        yield* schemas(item, at);
+}
+/**
+ * Whether applying the schema can never finish: from its root, a chain of $ref and in-place
+ * keywords returns to a schema without moving into a member or item.
+ */
+function endless(schema) {
+    // Where each schema object sends its value, and whether it is the same value.
+    const links = new Map();
+    for (const [at, node] of schemas(schema, '')) {
+        if (!isObject(node))
+            continue;
+        const applied = children(node, at)
+            .filter(([keyword]) => keyword !== '$defs')
+            .map(([keyword, to]) => [to, IN_PLACE.has(keyword)]);
+        if (typeof node.$ref === 'string')
+            applied.push([node.$ref.slice(1), true]);
+        links.set(at, applied);
+    }
+    const reachable = [''];
+    for (const at of reachable)
+        for (const [to] of links.get(at) ?? [])
+            if (!reachable.includes(to))
+                reachable.push(to);
+    const state = new Map();
+    const loops = (at) => {
+        if (state.has(at))
+            return state.get(at) === 'open';
+        state.set(at, 'open');
+        const looped = (links.get(at) ?? []).some(([to, inPlace]) => inPlace && loops(to));
+        state.set(at, 'done');
+        return looped;
+    };
+    return reachable.some(loops);
+}
+/** Why a schema a contract supplies cannot be enforced alike everywhere, if it cannot. */
+function schemaProblems(schema, pointer) {
+    const problems = [];
+    const positions = new Set([...schemas(schema, '')].map(([at]) => at));
+    for (const [at, value] of schemas(schema, pointer)) {
+        if (typeof value === 'boolean')
+            continue;
+        const node = value;
+        for (const keyword of Object.keys(node))
+            if (!KEYWORDS.has(keyword))
+                problems.push(`${at}: ${keyword} is not a MAP schema keyword`);
+        if ('$schema' in node && (at !== pointer || node.$schema !== DIALECT))
+            problems.push(`${at}: $schema names JSON Schema 2020-12, at the schema's root only`);
+        const ref = node.$ref;
+        if (ref !== undefined &&
+            (typeof ref !== 'string' || !ref.startsWith('#') || !positions.has(ref.slice(1))))
+            problems.push(`${at}: $ref is a JSON Pointer to a schema within this schema`);
+        if ('format' in node && !FORMATS.includes(node.format))
+            problems.push(`${at}: format is one of ${FORMATS.join(', ')}`);
+        if (typeof node.multipleOf === 'number' && !Number.isInteger(node.multipleOf))
+            problems.push(`${at}: multipleOf is an integer`);
+        const patterns = [
+            ...(typeof node.pattern === 'string' ? [node.pattern] : []),
+            ...Object.keys(node.patternProperties ?? {}),
+        ];
+        for (const pattern of patterns) {
+            const problem = unportablePattern(pattern);
+            if (problem)
+                problems.push(`${at}: pattern ${JSON.stringify(pattern)} uses ${problem}`);
+        }
+    }
+    if (problems.length)
+        return problems;
+    if (endless(schema))
+        return [`${pointer}: $ref leads back without moving into the value`];
+    try {
+        createValidator().compile(schema);
+    }
+    catch (error) {
+        problems.push(`${pointer}: ${error.message}`);
+    }
+    return problems;
+}
+const validateContract = createValidator().compile(contractSchema);
+/** An HTTPS URL's host and port as an origin compares them: lowercase, without :443. */
+const authority = (url) => /^https:\/\/([^/?#]*)/i.exec(url)?.[1].toLowerCase().replace(/:443$/, '');
+/** Why the value is not a MAP 0.3 type contract, or no reasons. */
+export function contractErrors(value) {
+    if (!validateContract(value))
+        return schemaErrors(validateContract.errors);
+    const errors = [];
+    if (new TextEncoder().encode(JSON.stringify(value)).length > CONTRACT_MAX_BYTES)
+        errors.push(`/: exceeds ${CONTRACT_MAX_BYTES} bytes`);
+    const ids = value.operations.map((operation) => operation.id);
+    if (new Set(ids).size !== ids.length)
+        errors.push('/operations: identifiers must be unique');
+    errors.push(...schemaProblems(value.detailsSchema, '/detailsSchema'));
+    for (const [index, operation] of value.operations.entries()) {
+        const at = `/operations/${index}`;
+        if (operation.inputSchema)
+            errors.push(...schemaProblems(operation.inputSchema, `${at}/inputSchema`));
+        if (!operation.capability)
+            continue;
+        const kind = CAPABILITY_KINDS[operation.capability.kind];
+        const expected = kind.effects.map((effect) => `${EFFECTS}${effect}`).sort();
+        if (operation.effects.toSorted().join('\n') !== expected.join('\n'))
+            errors.push(`${at}/effects: a ${operation.capability.kind} capability declares exactly ${expected.join(' and ')}`);
+        if (operation.capability.maxLifetimeSeconds > kind.maxLifetimeSeconds)
+            errors.push(`${at}/capability/maxLifetimeSeconds: at most ${kind.maxLifetimeSeconds}`);
+    }
+    return errors;
+}
+/** A valid contract with its digest and compiled schemas. */
+export class Contract {
+    document;
+    /** `sha-256:` and the SHA-256 of the contract's RFC 8785 form. */
+    digest;
+    #details;
+    #inputs = new Map();
+    /** The contract, or InvalidDocument with every reason the value is not one. */
+    constructor(value) {
+        const errors = contractErrors(value);
+        if (errors.length)
+            throw new InvalidDocument('The value is not a MAP 0.3 type contract.', errors);
+        this.document = structuredClone(value);
+        this.digest = digest(this.document);
+        const ajv = createValidator();
+        this.#details = ajv.compile(this.document.detailsSchema);
+        for (const operation of this.document.operations)
+            if (operation.inputSchema)
+                this.#inputs.set(operation.id, ajv.compile(operation.inputSchema));
+    }
+    /** The contract in the bytes or text, read as MAP JSON within the contract limit. */
+    static parse(input) {
+        return new Contract(parse(input, CONTRACT_MAX_BYTES));
+    }
+    get id() {
+        return this.document.id;
+    }
+    get version() {
+        return this.document.version;
+    }
+    operation(id) {
+        return this.document.operations.find((operation) => operation.id === id);
+    }
+    /** Why the details do not satisfy the contract's details schema, or no reasons. */
+    detailsErrors(details) {
+        return this.#details(details) ? [] : schemaErrors(this.#details.errors, '/details');
+    }
+    /** Why the input is not acceptable for the operation, or no reasons. */
+    inputErrors(operationId, input) {
+        const operation = this.operation(operationId);
+        if (!operation)
+            return [`/operation: ${operationId} is not an operation of this contract`];
+        const validate = this.#inputs.get(operationId);
+        if (!validate)
+            return input === undefined ? [] : ['/input: this operation accepts no input'];
+        return validate(input) ? [] : schemaErrors(validate.errors, '/input');
+    }
+    /**
+     * Why a valid description does not use this contract as it allows, or no reasons: it names
+     * this contract by identifier, version and digest; it offers only declared operations; a
+     * capability appears only where the contract permits one, at the service's origin and
+     * within the kind's lifetime; and its details satisfy the details schema.
+     */
+    descriptionErrors(description) {
+        const invalid = descriptionErrors(description);
+        if (invalid.length)
+            return invalid;
+        const errors = [];
+        const { type } = description;
+        if (type.id !== this.id || type.version !== this.version)
+            errors.push(`/type: names ${type.id} ${type.version}, not this contract`);
+        if (type.contractDigest !== this.digest)
+            errors.push('/type/contractDigest: does not match');
+        if (description.profile !== this.document.profile)
+            errors.push('/profile: differs from the contract profile');
+        const lifetime = (Date.parse(description.expiresAt) - Date.parse(description.issuedAt)) / 1000;
+        const origin = authority(description.service.id);
+        for (const [index, offered] of description.operations.entries()) {
+            const at = `/operations/${index}`;
+            const operation = this.operation(offered.id);
+            if (!operation) {
+                errors.push(`${at}/id: ${offered.id} is not an operation of this contract`);
+                continue;
+            }
+            if (!offered.capability)
+                continue;
+            if (!operation.capability)
+                errors.push(`${at}/capability: the contract permits no capability for ${offered.id}`);
+            else if (lifetime > operation.capability.maxLifetimeSeconds)
+                errors.push(`/expiresAt: a ${offered.id} capability lasts at most ${operation.capability.maxLifetimeSeconds} seconds`);
+            if (authority(offered.capability.url) !== origin)
+                errors.push(`${at}/capability/url: must have the service's origin`);
+        }
+        return [...errors, ...this.detailsErrors(description.details)];
+    }
+}

package/dist/core/description.d.ts

@@ -0,0 +1,45 @@
+export interface Description {
+    '@context': string;
+    '@type': 'MailAction';
+    '@id': string;
+    profile: string;
+    type: {
+        id: string;
+        version: string;
+        contractDigest: string;
+    };
+    issuedAt: string;
+    expiresAt: string;
+    inLanguage: string;
+    service: {
+        id: string;
+        tenant?: string;
+    };
+    recipient: string;
+    subject: {
+        id: string;
+        title: string;
+    };
+    terms: {
+        id: string;
+        version: string;
+    };
+    details: Record<string, unknown>;
+    operations: {
+        id: string;
+        capability?: {
+            url: string;
+        };
+    }[];
+    human: {
+        url: string;
+    };
+}
+/**
+ * Why the value is not a MAP 0.3 description, or no reasons. Beyond the core schema:
+ * expiry follows issuance, operation identifiers are unique, and no security-sensitive
+ * identifier contains whitespace, a control or a formatting character.
+ */
+export declare function descriptionErrors(value: unknown): string[];
+/** The description in the bytes or text, or InvalidDocument with every reason it is not one. */
+export declare function parseDescription(input: string | Uint8Array): Description;

package/dist/core/description.js

@@ -0,0 +1,47 @@
+// A MAP description: the JSON-LD a message carries beside its readable content.
+import { coreSchema, createValidator, DESCRIPTION_MAX_BYTES, schemaErrors } from "./artifacts.js";
+import { InvalidDocument, parse } from "./json.js";
+const validate = createValidator().compile(coreSchema);
+// Whitespace, controls, bidirectional and invisible formatting characters.
+const UNSAFE = /[\p{White_Space}\p{Cc}\p{Cf}]/u;
+/**
+ * Why the value is not a MAP 0.3 description, or no reasons. Beyond the core schema:
+ * expiry follows issuance, operation identifiers are unique, and no security-sensitive
+ * identifier contains whitespace, a control or a formatting character.
+ */
+export function descriptionErrors(value) {
+    if (!validate(value))
+        return schemaErrors(validate.errors);
+    const errors = [];
+    if (Date.parse(value.expiresAt) <= Date.parse(value.issuedAt))
+        errors.push('/expiresAt: must be later than issuedAt');
+    const ids = value.operations.map((operation) => operation.id);
+    if (new Set(ids).size !== ids.length)
+        errors.push('/operations: identifiers must be unique');
+    const identifiers = [
+        ['/@id', value['@id']],
+        ['/type/id', value.type.id],
+        ['/service/id', value.service.id],
+        ['/service/tenant', value.service.tenant],
+        ['/recipient', value.recipient],
+        ['/subject/id', value.subject.id],
+        ['/terms/id', value.terms.id],
+        ['/human/url', value.human.url],
+        ...value.operations.map((operation, index) => [
+            `/operations/${index}/capability/url`,
+            operation.capability?.url,
+        ]),
+    ];
+    for (const [pointer, identifier] of identifiers)
+        if (identifier !== undefined && UNSAFE.test(identifier))
+            errors.push(`${pointer}: must not contain whitespace, controls or formatting characters`);
+    return errors;
+}
+/** The description in the bytes or text, or InvalidDocument with every reason it is not one. */
+export function parseDescription(input) {
+    const value = parse(input, DESCRIPTION_MAX_BYTES);
+    const errors = descriptionErrors(value);
+    if (errors.length)
+        throw new InvalidDocument('The value is not a MAP 0.3 description.', errors);
+    return value;
+}

package/dist/core/implementation.d.ts

@@ -0,0 +1,32 @@
+export interface ImplementationRecord {
+    service: string;
+    maintainer: {
+        name: string;
+        url: string;
+    };
+    type: {
+        id: string;
+        version: string;
+        contractDigest: string;
+    };
+    operations: string[];
+    binding: string;
+    artifact?: {
+        url: string;
+        digest: string;
+        digestMode: 'canonical-json' | 'bytes';
+    };
+    format?: string;
+    status: 'Draft' | 'Experimental' | 'Stable' | 'Deprecated' | 'Superseded';
+    documentation: string;
+    evidence: {
+        kind: 'declaration' | 'test-report';
+        url: string;
+        summary: string;
+    }[];
+    successor?: string;
+}
+/** Why the value is not an implementation record, or no reasons. */
+export declare function implementationErrors(value: unknown): string[];
+/** The record in the bytes or text, or InvalidDocument with every reason it is not one. */
+export declare function parseImplementation(input: string | Uint8Array): ImplementationRecord;

package/dist/core/implementation.js

@@ -0,0 +1,25 @@
+// An implementation record: a Registry declaration or report of a service's support for exact
+// contract versions.
+import { CONTRACT_MAX_BYTES, createValidator, implementationSchema, schemaErrors, } from "./artifacts.js";
+import { InvalidDocument, parse } from "./json.js";
+const validate = createValidator().compile(implementationSchema);
+/** Why the value is not an implementation record, or no reasons. */
+export function implementationErrors(value) {
+    if (!validate(value))
+        return schemaErrors(validate.errors);
+    const errors = [];
+    const { origin } = new URL(value.service);
+    if (value.service !== origin && value.service !== `${origin}/`)
+        errors.push('/service: must be an HTTPS origin, not an operation path');
+    if (new Set(value.operations).size !== value.operations.length)
+        errors.push('/operations: identifiers must be unique');
+    return errors;
+}
+/** The record in the bytes or text, or InvalidDocument with every reason it is not one. */
+export function parseImplementation(input) {
+    const value = parse(input, CONTRACT_MAX_BYTES);
+    const errors = implementationErrors(value);
+    if (errors.length)
+        throw new InvalidDocument('The value is not an implementation record.', errors);
+    return value;
+}

package/dist/core/index.d.ts

@@ -0,0 +1,7 @@
+export { PROFILE, CONTEXT, DESCRIPTION_MEDIA_TYPE, DESCRIPTION_MAX_BYTES, CONTRACT_MAX_BYTES, EFFECTS, FORMATS, coreSchema, contractSchema, implementationSchema, } from './artifacts.ts';
+export { InvalidDocument, MAX_DEPTH, decodeUtf8, parse, canonicalize, digest } from './json.ts';
+export { sha256 } from './sha256.ts';
+export { descriptionErrors, parseDescription, type Description } from './description.ts';
+export { CAPABILITY_KINDS, Contract, contractErrors, type CapabilityKind, type ContractDocument, type Operation, } from './contract.ts';
+export { implementationErrors, parseImplementation, type ImplementationRecord, } from './implementation.ts';
+export { unportablePattern } from './patterns.ts';

package/dist/core/index.js

@@ -0,0 +1,9 @@
+// Mail Action Protocol 0.3 processing: one implementation, run unchanged by the repository's
+// site and checks and shipped as the npm package.
+export { PROFILE, CONTEXT, DESCRIPTION_MEDIA_TYPE, DESCRIPTION_MAX_BYTES, CONTRACT_MAX_BYTES, EFFECTS, FORMATS, coreSchema, contractSchema, implementationSchema, } from "./artifacts.js";
+export { InvalidDocument, MAX_DEPTH, decodeUtf8, parse, canonicalize, digest } from "./json.js";
+export { sha256 } from "./sha256.js";
+export { descriptionErrors, parseDescription } from "./description.js";
+export { CAPABILITY_KINDS, Contract, contractErrors, } from "./contract.js";
+export { implementationErrors, parseImplementation, } from "./implementation.js";
+export { unportablePattern } from "./patterns.js";

package/dist/core/json.d.ts

@@ -0,0 +1,23 @@
+/** A document that is not MAP JSON, or not the document it claims to be. */
+export declare class InvalidDocument extends Error {
+    readonly errors: string[];
+    constructor(message: string, errors?: string[]);
+}
+export declare const MAX_DEPTH = 32;
+/** The bytes as text, refusing anything but well-formed UTF-8. */
+export declare function decodeUtf8(input: Uint8Array): string;
+/**
+ * Parse MAP JSON from its original text: UTF-8 I-JSON (RFC 7493) of at most `maxBytes`, with
+ * no byte order mark, duplicate member names, lone surrogates, noncharacters or U+0000, no
+ * container deeper than 32 counting the root as 1, and every number a finite token of at most
+ * 64 characters within ±(2^53−1) that does not underflow to zero. These rules apply to the
+ * original tokens, before a general parser could erase them.
+ */
+export declare function parse(input: string | Uint8Array, maxBytes: number): unknown;
+/**
+ * The RFC 8785 canonical form of a JSON value: members sorted by their UTF-16 code units,
+ * ECMAScript's minimal string escapes and its number format.
+ */
+export declare function canonicalize(value: unknown): string;
+/** `sha-256:` and the SHA-256 of the value's RFC 8785 form, as MAP identifies contracts. */
+export declare const digest: (value: unknown) => string;

package/dist/core/json.js

@@ -0,0 +1,200 @@
+// MAP JSON: I-JSON parsed from its original text, and the RFC 8785 digests that identify
+// contracts and descriptions.
+import { sha256 } from "./sha256.js";
+/** A document that is not MAP JSON, or not the document it claims to be. */
+export class InvalidDocument extends Error {
+    errors;
+    constructor(message, errors = [message]) {
+        super(message);
+        this.errors = errors;
+    }
+}
+export const MAX_DEPTH = 32;
+const MAX_NUMBER_TOKEN = 64;
+const LONE_SURROGATE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/;
+const NUMBER = /^-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?/;
+const ZERO = /^-?0(?:\.0+)?(?:[eE][+-]?[0-9]+)?$/;
+const forbidden = (point) => point === 0 || (point >= 0xfdd0 && point <= 0xfdef) || (point & 0xfffe) === 0xfffe;
+/** The bytes as text, refusing anything but well-formed UTF-8. */
+export function decodeUtf8(input) {
+    try {
+        // The byte order mark is kept, so parsing refuses it.
+        return new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(input);
+    }
+    catch {
+        throw new InvalidDocument('The JSON is not valid UTF-8.');
+    }
+}
+/**
+ * Parse MAP JSON from its original text: UTF-8 I-JSON (RFC 7493) of at most `maxBytes`, with
+ * no byte order mark, duplicate member names, lone surrogates, noncharacters or U+0000, no
+ * container deeper than 32 counting the root as 1, and every number a finite token of at most
+ * 64 characters within ±(2^53−1) that does not underflow to zero. These rules apply to the
+ * original tokens, before a general parser could erase them.
+ */
+export function parse(input, maxBytes) {
+    const text = typeof input === 'string' ? input : decodeUtf8(input);
+    if (text.charCodeAt(0) === 0xfeff)
+        throw new InvalidDocument('A byte order mark is not allowed.');
+    if (new TextEncoder().encode(text).length > maxBytes)
+        throw new InvalidDocument(`The JSON exceeds ${maxBytes} bytes.`);
+    let index = 0;
+    const fail = (reason) => {
+        throw new InvalidDocument(`Invalid MAP JSON at offset ${index}: ${reason}.`);
+    };
+    const space = () => {
+        while (' \t\n\r'.includes(text[index] ?? '-'))
+            index += 1;
+    };
+    const string = () => {
+        const start = index;
+        index += 1;
+        while (index < text.length && text[index] !== '"')
+            index += text[index] === '\\' ? 2 : 1;
+        if (text[index] !== '"')
+            fail('unterminated string');
+        index += 1;
+        let value;
+        try {
+            value = JSON.parse(text.slice(start, index));
+        }
+        catch {
+            return fail('malformed string');
+        }
+        if (LONE_SURROGATE.test(value))
+            fail('lone surrogate');
+        for (const character of value)
+            if (forbidden(character.codePointAt(0)))
+                fail('U+0000 or a noncharacter');
+        return value;
+    };
+    // `depth` counts the containers enclosing the value.
+    const value = (depth) => {
+        space();
+        const next = text[index];
+        if ((next === '{' || next === '[') && depth >= MAX_DEPTH)
+            fail(`nesting deeper than ${MAX_DEPTH}`);
+        if (next === '{') {
+            index += 1;
+            const result = {};
+            const names = new Set();
+            space();
+            if (text[index] === '}') {
+                index += 1;
+                return result;
+            }
+            for (;;) {
+                space();
+                if (text[index] !== '"')
+                    fail('expected a member name');
+                const name = string();
+                if (names.has(name))
+                    fail(`duplicate member ${JSON.stringify(name)}`);
+                names.add(name);
+                space();
+                if (text[index] !== ':')
+                    fail('expected ":"');
+                index += 1;
+                // A member named __proto__ is data, never the object's prototype.
+                Object.defineProperty(result, name, {
+                    value: value(depth + 1),
+                    enumerable: true,
+                    writable: true,
+                    configurable: true,
+                });
+                space();
+                if (text[index] === ',') {
+                    index += 1;
+                    continue;
+                }
+                if (text[index] === '}') {
+                    index += 1;
+                    return result;
+                }
+                fail('expected "," or "}"');
+            }
+        }
+        if (next === '[') {
+            index += 1;
+            const result = [];
+            space();
+            if (text[index] === ']') {
+                index += 1;
+                return result;
+            }
+            for (;;) {
+                result.push(value(depth + 1));
+                space();
+                if (text[index] === ',') {
+                    index += 1;
+                    continue;
+                }
+                if (text[index] === ']') {
+                    index += 1;
+                    return result;
+                }
+                fail('expected "," or "]"');
+            }
+        }
+        if (next === '"')
+            return string();
+        for (const literal of ['true', 'false', 'null'])
+            if (text.startsWith(literal, index)) {
+                index += literal.length;
+                return JSON.parse(literal);
+            }
+        const token = NUMBER.exec(text.slice(index))?.[0];
+        if (token === undefined)
+            return fail('unexpected token');
+        index += token.length;
+        if (token.length > MAX_NUMBER_TOKEN)
+            fail(`a number token longer than ${MAX_NUMBER_TOKEN} characters`);
+        const number = Number(token);
+        if (!Number.isFinite(number) || Math.abs(number) > Number.MAX_SAFE_INTEGER)
+            fail('a number outside the I-JSON range');
+        if (number === 0 && !ZERO.test(token))
+            fail('a number that underflows to zero');
+        return number;
+    };
+    const result = value(0);
+    space();
+    if (index !== text.length)
+        fail('trailing content');
+    return result;
+}
+const ESCAPES = {
+    '"': '\\"',
+    '\\': '\\\\',
+    '\b': '\\b',
+    '\f': '\\f',
+    '\n': '\\n',
+    '\r': '\\r',
+    '\t': '\\t',
+};
+/**
+ * The RFC 8785 canonical form of a JSON value: members sorted by their UTF-16 code units,
+ * ECMAScript's minimal string escapes and its number format.
+ */
+export function canonicalize(value) {
+    if (value === null || typeof value === 'boolean')
+        return String(value);
+    if (typeof value === 'number') {
+        if (!Number.isFinite(value))
+            throw new TypeError('Numbers must be finite.');
+        return String(value);
+    }
+    if (typeof value === 'string')
+        return `"${value.replace(/["\\\u0000-\u001f]/g, (char) => ESCAPES[char] ?? `\\u${char.charCodeAt(0).toString(16).padStart(4, '0')}`)}"`;
+    if (Array.isArray(value))
+        return `[${value.map(canonicalize).join(',')}]`;
+    if (typeof value === 'object') {
+        const members = value;
+        return `{${Object.keys(members)
+            .sort()
+            .map((name) => `${canonicalize(name)}:${canonicalize(members[name])}`)
+            .join(',')}}`;
+    }
+    throw new TypeError(`${typeof value} is not a JSON value.`);
+}
+/** `sha-256:` and the SHA-256 of the value's RFC 8785 form, as MAP identifies contracts. */
+export const digest = (value) => `sha-256:${sha256(canonicalize(value))}`;

package/dist/core/patterns.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Why a pattern is outside the portable subset, or undefined. The subset is printable ASCII
+ * text, with any other code point written as \uXXXX. It has literal characters and escaped
+ * syntax characters; \t, \n, \f, \r and \d, the ASCII digits; non-empty classes of literal or
+ * escaped members and ranges, with a literal hyphen only first or last; (?: groups;
+ * alternation; ^ and $; and one *, +, ?, {n}, {n,} or {n,m} after an atom. Other class
+ * escapes and the dot match different characters in different engines, and brackets, && or a
+ * stray brace inside a class, or a quantifier on a quantifier, are read differently or refused
+ * by one of them. ^ and $ anchor the whole value, as in ECMA-262; an engine whose anchors also
+ * match at line breaks must read them so.
+ */
+export declare function unportablePattern(pattern: string): string | undefined;