protect-mcp 0.9.7 → 0.11.0

package/dist/{chunk-UWB5ALVO.mjs → chunk-K7AEEQWW.mjs}

@@ -1,22 +1,11 @@
-import {
-  sha256
-} from "./chunk-AYNQIEN7.mjs";
-import {
-  ed25519
-} from "./chunk-FFVJL3KQ.mjs";
-import {
-  Hash,
-  abytes,
-  aexists,
-  ahash,
-  bytesToHex,
-  clean,
-  hexToBytes,
-  randomBytes,
-  toBytes
-} from "./chunk-D733KAPG.mjs";
+// src/signing-committed.ts
+import { ed25519 } from "@noble/curves/ed25519";
+import { sha256 as sha2563 } from "@noble/hashes/sha256";
+import { bytesToHex as bytesToHex3, hexToBytes as hexToBytes3, randomBytes as randomBytes2 } from "@noble/hashes/utils";
 
 // src/commitments/merkle.ts
+import { sha256 } from "@noble/hashes/sha256";
+import { bytesToHex, hexToBytes } from "@noble/hashes/utils";
 var DOMAIN_LEAF = 0;
 var DOMAIN_INTERNAL = 1;
 function hashLeaf(leafBytes) {
@@ -127,75 +116,10 @@ function largestPowerOfTwoLessThan(n) {
   return k;
 }
 
-// node_modules/@noble/hashes/esm/hmac.js
-var HMAC = class extends Hash {
-  constructor(hash, _key) {
-    super();
-    this.finished = false;
-    this.destroyed = false;
-    ahash(hash);
-    const key = toBytes(_key);
-    this.iHash = hash.create();
-    if (typeof this.iHash.update !== "function")
-      throw new Error("Expected instance of class which extends utils.Hash");
-    this.blockLen = this.iHash.blockLen;
-    this.outputLen = this.iHash.outputLen;
-    const blockLen = this.blockLen;
-    const pad = new Uint8Array(blockLen);
-    pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);
-    for (let i = 0; i < pad.length; i++)
-      pad[i] ^= 54;
-    this.iHash.update(pad);
-    this.oHash = hash.create();
-    for (let i = 0; i < pad.length; i++)
-      pad[i] ^= 54 ^ 92;
-    this.oHash.update(pad);
-    clean(pad);
-  }
-  update(buf) {
-    aexists(this);
-    this.iHash.update(buf);
-    return this;
-  }
-  digestInto(out) {
-    aexists(this);
-    abytes(out, this.outputLen);
-    this.finished = true;
-    this.iHash.digestInto(out);
-    this.oHash.update(out);
-    this.oHash.digestInto(out);
-    this.destroy();
-  }
-  digest() {
-    const out = new Uint8Array(this.oHash.outputLen);
-    this.digestInto(out);
-    return out;
-  }
-  _cloneInto(to) {
-    to || (to = Object.create(Object.getPrototypeOf(this), {}));
-    const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;
-    to = to;
-    to.finished = finished;
-    to.destroyed = destroyed;
-    to.blockLen = blockLen;
-    to.outputLen = outputLen;
-    to.oHash = oHash._cloneInto(to.oHash);
-    to.iHash = iHash._cloneInto(to.iHash);
-    return to;
-  }
-  clone() {
-    return this._cloneInto();
-  }
-  destroy() {
-    this.destroyed = true;
-    this.oHash.destroy();
-    this.iHash.destroy();
-  }
-};
-var hmac = (hash, key, message) => new HMAC(hash, key).update(message).digest();
-hmac.create = (hash, key) => new HMAC(hash, key);
-
 // src/commitments/primitives.ts
+import { sha256 as sha2562 } from "@noble/hashes/sha256";
+import { hmac } from "@noble/hashes/hmac";
+import { bytesToHex as bytesToHex2, hexToBytes as hexToBytes2, randomBytes } from "@noble/hashes/utils";
 function jcs(value) {
   if (value === null || value === void 0) return "null";
   if (typeof value === "boolean" || typeof value === "number")
@@ -257,7 +181,7 @@ function leavesFromFields(fields) {
 
 // src/signing-committed.ts
 function freshSalt() {
-  return randomBytes(32);
+  return randomBytes2(32);
 }
 function signCommittedDecision(entry, committedFieldNames, signingKey, publicKey, kid, issuer) {
   const allFields = {
@@ -297,7 +221,7 @@ function signCommittedDecision(entry, committedFieldNames, signingKey, publicKey
     const { sorted, leafBytes } = leavesFromFields(committedFields);
     const leafHashes = leafBytes.map(hashLeaf);
     const root = merkleRoot(leafHashes);
-    committedFieldsRoot = bytesToHex(root);
+    committedFieldsRoot = bytesToHex3(root);
     sorted.forEach((f, i) => {
       openings[f.name] = { name: f.name, value: f.value, salt: f.salt, index: i };
     });
@@ -314,8 +238,8 @@ function signCommittedDecision(entry, committedFieldNames, signingKey, publicKey
     payload.committed_field_names = committedFields.map((f) => f.name);
   }
   const canonical = jcs(payload);
-  const messageHash = sha256(new TextEncoder().encode(canonical));
-  const signatureBytes = ed25519.sign(messageHash, hexToBytes(signingKey));
+  const messageHash = sha2563(new TextEncoder().encode(canonical));
+  const signatureBytes = ed25519.sign(messageHash, hexToBytes3(signingKey));
   const signedReceipt = {
     ...payload,
     signature: {
@@ -328,7 +252,7 @@ function signCommittedDecision(entry, committedFieldNames, signingKey, publicKey
     }
   };
   const signedJson = JSON.stringify(signedReceipt);
-  const receiptHash = bytesToHex(sha256(new TextEncoder().encode(jcs(signedReceipt))));
+  const receiptHash = bytesToHex3(sha2563(new TextEncoder().encode(jcs(signedReceipt))));
   return {
     signed: signedJson,
     artifact_type: "decision_receipt_committed_v1",
@@ -457,7 +381,7 @@ function committedFieldNamesFromReceipt(receipt, openings) {
   return Array.from(new Set(names)).sort();
 }
 function receiptHashHex(receipt) {
-  return bytesToHex(sha256(new TextEncoder().encode(jcs(receipt))));
+  return bytesToHex3(sha2563(new TextEncoder().encode(jcs(receipt))));
 }
 function verifyCommittedReceiptSignature(receipt) {
   const signature = receipt.signature;
@@ -467,16 +391,15 @@ function verifyCommittedReceiptSignature(receipt) {
     return null;
   }
   const { signature: _signature, ...payloadWithoutSig } = receipt;
-  const messageHash = sha256(new TextEncoder().encode(jcs(payloadWithoutSig)));
+  const messageHash = sha2563(new TextEncoder().encode(jcs(payloadWithoutSig)));
   try {
-    return ed25519.verify(base64urlDecode(sig.sig), messageHash, hexToBytes(sig.public_key));
+    return ed25519.verify(base64urlDecode(sig.sig), messageHash, hexToBytes3(sig.public_key));
   } catch {
     return false;
   }
 }
 
 export {
-  hmac,
   signCommittedDecision,
   discloseField,
   createSelectiveDisclosurePackage,

package/dist/{chunk-WWPQNIVF.mjs → chunk-KRKZ2YX7.mjs}

@@ -1,11 +1,6 @@
-import {
-  sha256
-} from "./chunk-AYNQIEN7.mjs";
-import {
-  bytesToHex
-} from "./chunk-D733KAPG.mjs";
-
 // src/receipt-enrichment.ts
+import { sha256 } from "@noble/hashes/sha256";
+import { bytesToHex } from "@noble/hashes/utils";
 var ENRICHMENT_VERSION = 2;
 function canonicalJson(value) {
   const seen = /* @__PURE__ */ new WeakSet();

package/dist/{chunk-YM6SOJBR.mjs → chunk-NQOKPBSQ.mjs}

@@ -1,16 +1,21 @@
 import {
   ReceiptBuffer,
   buildActionReadback,
+  startStatusServer
+} from "./chunk-CIWIK6BT.mjs";
+import {
   checkRateLimit,
   getToolPolicy,
   isSigningEnabled,
   parseRateLimit,
-  signDecision,
-  startStatusServer
-} from "./chunk-G6X763MH.mjs";
+  signDecision
+} from "./chunk-WMIWQ6TS.mjs";
 import {
   evaluateCedar
-} from "./chunk-MWXDXYWH.mjs";
+} from "./chunk-FGCNKEEW.mjs";
+import {
+  receiptHash
+} from "./chunk-XOP3PEBM.mjs";
 
 // src/evidence-store.ts
 import { readFileSync, writeFileSync, existsSync } from "fs";
@@ -589,7 +594,7 @@ function parseNotificationConfigFromEnv() {
 import { spawn } from "child_process";
 import { randomUUID, randomBytes } from "crypto";
 import { createInterface } from "readline";
-import { appendFileSync } from "fs";
+import { appendFileSync, readFileSync as readFileSync2 } from "fs";
 import { join as join2 } from "path";
 var LOG_FILE = ".protect-mcp-log.jsonl";
 var RECEIPTS_FILE = ".protect-mcp-receipts.jsonl";
@@ -600,6 +605,8 @@ var ProtectGateway = class {
   clientReader = null;
   logFilePath;
   receiptFilePath;
+  /** s5.7 hash of the last line appended to the receipt file (chain link) */
+  lastReceiptHash = null;
   evidenceStore;
   receiptBuffer;
   /** Approval grants keyed by request_id (scoped to the specific action that was requested) */
@@ -619,6 +626,11 @@ var ProtectGateway = class {
     this.config = config;
     this.logFilePath = join2(process.cwd(), LOG_FILE);
     this.receiptFilePath = join2(process.cwd(), RECEIPTS_FILE);
+    try {
+      const existing = readFileSync2(this.receiptFilePath, "utf-8").split("\n").filter((l) => l.trim());
+      if (existing.length > 0) this.lastReceiptHash = receiptHash(JSON.parse(existing[existing.length - 1]));
+    } catch {
+    }
     this.evidenceStore = new EvidenceStore();
     this.receiptBuffer = new ReceiptBuffer();
     this.notificationConfig = parseNotificationConfigFromEnv();
@@ -965,12 +977,13 @@ var ProtectGateway = class {
     } catch {
     }
     if (isSigningEnabled()) {
-      const signed = signDecision(log);
+      const signed = signDecision(log, this.lastReceiptHash || void 0);
       if (signed.signed) {
         process.stderr.write(`[PROTECT_MCP_RECEIPT] ${signed.signed}
 `);
         try {
           appendFileSync(this.receiptFilePath, signed.signed + "\n");
+          if (signed.receipt_hash) this.lastReceiptHash = signed.receipt_hash;
         } catch {
         }
         this.receiptBuffer.add(log.request_id, signed.signed);

package/dist/{chunk-JQDVKZBN.mjs → chunk-SOJBLPPX.mjs}

@@ -1,3 +1,7 @@
+import {
+  receiptIdentity
+} from "./chunk-XOP3PEBM.mjs";
+
 // src/report.ts
 import { readFileSync, existsSync } from "fs";
 function generateReport(logPath, receiptPath, periodDays) {
@@ -34,8 +38,9 @@ function generateReport(logPath, receiptPath, periodDays) {
         const parsed = JSON.parse(trimmed);
         if (parsed.signature) {
           receiptsSigned++;
-          if (parsed.kid && !signerKid) signerKid = parsed.kid;
-          if (parsed.issuer && !signerIssuer) signerIssuer = parsed.issuer;
+          const identity = receiptIdentity(parsed);
+          if (identity.kid && !signerKid) signerKid = identity.kid;
+          if (identity.issuer && !signerIssuer) signerIssuer = identity.issuer;
         }
       } catch {
       }

package/dist/chunk-WMIWQ6TS.mjs

@@ -0,0 +1,266 @@
+import {
+  digestBuiltinPolicy
+} from "./chunk-FGCNKEEW.mjs";
+import {
+  computeSbIssuerKid,
+  createReceiptEnvelope
+} from "./chunk-XOP3PEBM.mjs";
+
+// src/policy.ts
+import { readFileSync } from "fs";
+function loadPolicy(path) {
+  const raw = readFileSync(path, "utf-8");
+  const parsed = JSON.parse(raw);
+  if (!parsed.tools || typeof parsed.tools !== "object") {
+    throw new Error(`Invalid policy file: missing "tools" object in ${path}`);
+  }
+  const policy = {
+    tools: parsed.tools,
+    default_tier: parsed.default_tier || "unknown",
+    policy_engine: parsed.policy_engine || "built-in",
+    ...parsed.external ? { external: parsed.external } : {}
+  };
+  const digest = computePolicyDigest(policy);
+  return {
+    policy,
+    digest,
+    credentials: parsed.credentials,
+    signing: parsed.signing
+  };
+}
+function computePolicyDigest(policy) {
+  return digestBuiltinPolicy(policy).policy_digest;
+}
+function getToolPolicy(toolName, policy) {
+  if (!policy) {
+    return { require: "any" };
+  }
+  if (policy.tools[toolName]) {
+    return policy.tools[toolName];
+  }
+  if (policy.tools["*"]) {
+    return policy.tools["*"];
+  }
+  return { require: "any" };
+}
+function parseRateLimit(spec) {
+  const match = spec.match(/^(\d+)\/(second|minute|hour|day)$/);
+  if (!match) {
+    throw new Error(`Invalid rate limit format: "${spec}". Expected "N/unit" (e.g. "5/hour")`);
+  }
+  const count = parseInt(match[1], 10);
+  const unit = match[2];
+  const windowMs = {
+    second: 1e3,
+    minute: 6e4,
+    hour: 36e5,
+    day: 864e5
+  };
+  return { count, windowMs: windowMs[unit] };
+}
+function checkRateLimit(key, limit, store) {
+  const now = Date.now();
+  const windowStart = now - limit.windowMs;
+  const timestamps = (store.get(key) || []).filter((t) => t > windowStart);
+  if (timestamps.length >= limit.count) {
+    store.set(key, timestamps);
+    return { allowed: false, remaining: 0 };
+  }
+  timestamps.push(now);
+  store.set(key, timestamps);
+  return { allowed: true, remaining: limit.count - timestamps.length };
+}
+
+// src/signing.ts
+import { readFileSync as readFileSync2, existsSync } from "fs";
+var signerState = null;
+var signingConfigured = false;
+var signingInitError = null;
+async function initSigning(config) {
+  const warnings = [];
+  signerState = null;
+  signingConfigured = Boolean(config && config.enabled !== false);
+  signingInitError = null;
+  if (!config || config.enabled === false) {
+    return warnings;
+  }
+  if (!config.key_path) {
+    signingInitError = "signing enabled but key_path is not configured";
+    warnings.push(`signing: ${signingInitError}`);
+    return warnings;
+  }
+  if (!existsSync(config.key_path)) {
+    signingInitError = `key file not found at ${config.key_path}`;
+    warnings.push(`signing: ${signingInitError} \u2014 run "protect-mcp init" to generate`);
+    return warnings;
+  }
+  let keyData;
+  try {
+    keyData = JSON.parse(readFileSync2(config.key_path, "utf-8"));
+    if (!keyData.privateKey || !keyData.publicKey) {
+      signingInitError = "key file missing privateKey or publicKey fields";
+      warnings.push(`signing: ${signingInitError}`);
+      return warnings;
+    }
+  } catch (err) {
+    signingInitError = `failed to load key file: ${err instanceof Error ? err.message : err}`;
+    warnings.push(`signing: ${signingInitError}`);
+    return warnings;
+  }
+  try {
+    signerState = {
+      privateKey: keyData.privateKey,
+      publicKey: keyData.publicKey,
+      // kid is opaque per draft-02; existing key files keep their explicit kid,
+      // and keys without one get the s2.1.1 RECOMMENDED sb:issuer format.
+      kid: keyData.kid || computeSbIssuerKid(keyData.publicKey),
+      issuer: config.issuer || keyData.issuer || "protect-mcp"
+    };
+  } catch (err) {
+    signingInitError = `failed to initialize signer: ${err instanceof Error ? err.message : err}`;
+    warnings.push(`signing: ${signingInitError} \u2014 enforce mode will fail closed`);
+  }
+  return warnings;
+}
+function signDecision(entry, prevReceiptHash) {
+  const artifactType = entry.decision === "deny" ? "gateway_restraint" : "decision_receipt";
+  if (signingConfigured && signingInitError) {
+    return {
+      ok: false,
+      signed: null,
+      artifact_type: artifactType,
+      warning: `signing initialization failed: ${signingInitError}`,
+      error: signingInitError
+    };
+  }
+  if (signingConfigured && !signerState) {
+    const error = "signing was configured but no signer is ready";
+    return {
+      ok: false,
+      signed: null,
+      artifact_type: artifactType,
+      warning: error,
+      error
+    };
+  }
+  if (!signerState) {
+    return { ok: false, signed: null, artifact_type: "none" };
+  }
+  try {
+    const payload = {
+      // draft-02 s3.1 access-decision fields
+      type: "protectmcp:decision",
+      tool_name: entry.tool,
+      decision: entry.decision,
+      reason: entry.reason_code,
+      policy_digest: entry.policy_digest,
+      // Extension fields (signed alongside the s3.1 core)
+      scope: entry.request_id,
+      // request scope
+      mode: entry.mode,
+      request_id: entry.request_id,
+      // Spec version: ties every receipt to the IETF standard
+      spec: "draft-farley-acta-signed-receipts-02",
+      // Issuer certification: distinguishes VOPRF-backed receipts from self-signed ones
+      // - scopeblind:verified  = issued via ScopeBlind VOPRF backend (paid tier)
+      // - self-signed          = signed with local Ed25519 key (free tier, protect-mcp default)
+      // - uncertified          = unsigned receipt (shadow mode, no signing configured)
+      issuer_certification: signerState ? "self-signed" : "uncertified",
+      // The signer's PUBLIC key, inside the signed payload, so a receipt is
+      // self-contained: any verifier (including the record viewer, in-browser)
+      // can check the signature without a side channel. Binding the key inside
+      // the signature means it cannot be swapped without breaking the signature;
+      // authenticity (that the key is YOUR gate's) still comes from pinning it.
+      public_key: signerState.publicKey
+    };
+    if (signerState.issuer && signerState.issuer !== signerState.kid) {
+      payload.issuer_name = signerState.issuer;
+    }
+    if (prevReceiptHash) payload.previousReceiptHash = prevReceiptHash;
+    if (entry.tier) payload.tier = entry.tier;
+    if (entry.credential_ref) payload.credential_ref = entry.credential_ref;
+    if (entry.rate_limit_remaining !== void 0) {
+      payload.rate_limit_remaining = entry.rate_limit_remaining;
+    }
+    if (entry.policy_engine) payload.policy_engine = entry.policy_engine;
+    if (entry.hook_event) payload.hook_event = entry.hook_event;
+    if (entry.sandbox_state) payload.sandbox_state = entry.sandbox_state;
+    if (entry.timing) payload.timing = entry.timing;
+    if (entry.swarm) payload.swarm = entry.swarm;
+    if (entry.payload_digest) payload.payload_digest = entry.payload_digest;
+    if (entry.enrichment) payload.enrichment = entry.enrichment;
+    if (entry.action_readback) payload.action_readback = entry.action_readback;
+    if (entry.deny_iteration) payload.deny_iteration = entry.deny_iteration;
+    const result = createReceiptEnvelope(
+      payload,
+      signerState.privateKey,
+      signerState.kid,
+      Number.isFinite(entry.timestamp) ? new Date(entry.timestamp).toISOString() : void 0
+    );
+    return {
+      ok: true,
+      signed: JSON.stringify(result.envelope),
+      artifact_type: artifactType,
+      receipt_hash: result.hash
+    };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "unknown error";
+    return {
+      ok: false,
+      signed: null,
+      artifact_type: artifactType,
+      warning: `signing failed: ${message}`,
+      error: message
+    };
+  }
+}
+function signGenericArtifact(_artifactType, payload) {
+  if (signingConfigured && signingInitError) {
+    return { ok: false, signed: null, warning: `signing initialization failed: ${signingInitError}`, error: signingInitError };
+  }
+  if (signingConfigured && !signerState) {
+    const error = "signing was configured but no signer is ready";
+    return { ok: false, signed: null, warning: error, error };
+  }
+  if (!signerState) {
+    return { ok: false, signed: null };
+  }
+  try {
+    const full = {
+      ...payload,
+      type: String(payload.type || "protectmcp:artifact"),
+      public_key: signerState.publicKey
+    };
+    if (signerState.issuer && signerState.issuer !== signerState.kid) {
+      full.issuer_name = signerState.issuer;
+    }
+    const result = createReceiptEnvelope(full, signerState.privateKey, signerState.kid);
+    return { ok: true, signed: JSON.stringify(result.envelope) };
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "unknown error";
+    return { ok: false, signed: null, warning: `signing failed: ${message}`, error: message };
+  }
+}
+function getSignerInfo() {
+  if (!signerState) return null;
+  return {
+    publicKey: signerState.publicKey,
+    kid: signerState.kid,
+    issuer: signerState.issuer
+  };
+}
+function isSigningEnabled() {
+  return signingConfigured && signingInitError === null && signerState !== null;
+}
+
+export {
+  loadPolicy,
+  getToolPolicy,
+  parseRateLimit,
+  checkRateLimit,
+  initSigning,
+  signDecision,
+  signGenericArtifact,
+  getSignerInfo,
+  isSigningEnabled
+};

package/dist/chunk-XOP3PEBM.mjs

@@ -0,0 +1,114 @@
+// src/acta-envelope.ts
+import { ed25519 } from "@noble/curves/ed25519";
+import { sha256 } from "@noble/hashes/sha256";
+import { bytesToHex, hexToBytes, utf8ToBytes } from "@noble/hashes/utils";
+function canonicalize(obj) {
+  return JSON.stringify(obj, (_key, value) => {
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+      const sorted = {};
+      for (const k of Object.keys(value).sort()) {
+        if (!/^[\x20-\x7E]*$/.test(k)) {
+          throw new Error(`Non-ASCII key "${k}" in receipt payload. Only ASCII keys are permitted.`);
+        }
+        sorted[k] = value[k];
+      }
+      return sorted;
+    }
+    return value;
+  });
+}
+function receiptHash(obj) {
+  return bytesToHex(sha256(utf8ToBytes(canonicalize(obj))));
+}
+var B58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+function base58(bytes) {
+  let n = BigInt("0x" + bytesToHex(bytes));
+  let out = "";
+  while (n > 0n) {
+    out = B58_ALPHABET[Number(n % 58n)] + out;
+    n /= 58n;
+  }
+  for (const b of bytes) {
+    if (b === 0) out = "1" + out;
+    else break;
+  }
+  return out;
+}
+function computeSbIssuerKid(publicKeyHex) {
+  return `sb:issuer:${base58(hexToBytes(publicKeyHex)).slice(0, 12)}`;
+}
+function createReceiptEnvelope(fields, privateKeyHex, kid, issuedAt) {
+  if (!fields.type) throw new Error("receipt payload requires a type");
+  if (!kid) throw new Error("kid is required");
+  const payload = {
+    ...fields,
+    issued_at: fields.issued_at || issuedAt || (/* @__PURE__ */ new Date()).toISOString(),
+    issuer_id: kid
+  };
+  const sig = bytesToHex(ed25519.sign(utf8ToBytes(canonicalize(payload)), hexToBytes(privateKeyHex)));
+  const envelope = { payload, signature: { alg: "EdDSA", kid, sig } };
+  return { envelope, hash: receiptHash(envelope) };
+}
+function verifyReceipt(envelope, publicKeyHex) {
+  try {
+    if (!envelope || typeof envelope !== "object") {
+      return { valid: false, shape: null, error: "not_an_object" };
+    }
+    const env = envelope;
+    const signature = env.signature;
+    if (signature && typeof signature === "object" && !Array.isArray(signature)) {
+      const sigObj = signature;
+      if (sigObj.alg !== "EdDSA") {
+        return { valid: false, shape: "acta-02", error: `unsupported_alg:${String(sigObj.alg)}` };
+      }
+      if (typeof sigObj.sig !== "string" || !env.payload || typeof env.payload !== "object") {
+        return { valid: false, shape: "acta-02", error: "malformed_envelope" };
+      }
+      const message = utf8ToBytes(canonicalize(env.payload));
+      const valid = ed25519.verify(hexToBytes(sigObj.sig), message, hexToBytes(publicKeyHex));
+      return valid ? { valid: true, shape: "acta-02", hash: receiptHash(env) } : { valid: false, shape: "acta-02", error: "invalid_signature" };
+    }
+    if (typeof signature === "string") {
+      const rest = {};
+      for (const k of Object.keys(env)) if (k !== "signature") rest[k] = env[k];
+      const message = utf8ToBytes(canonicalize(rest));
+      const valid = ed25519.verify(hexToBytes(signature), message, hexToBytes(publicKeyHex));
+      const shape = env.v === 2 ? "legacy-v2" : "legacy-v1";
+      return valid ? { valid: true, shape, hash: receiptHash(env) } : { valid: false, shape, error: "invalid_signature" };
+    }
+    return { valid: false, shape: null, error: "missing_signature" };
+  } catch (err) {
+    return {
+      valid: false,
+      shape: null,
+      error: `verification_error:${err instanceof Error ? err.message : "unknown"}`
+    };
+  }
+}
+function receiptIdentity(envelope) {
+  if (!envelope || typeof envelope !== "object") return { kid: null, issuer: null, type: null };
+  const env = envelope;
+  if (env.signature && typeof env.signature === "object") {
+    const payload = env.payload || {};
+    const sig = env.signature;
+    return {
+      kid: typeof sig.kid === "string" ? sig.kid : null,
+      issuer: typeof payload.issuer_id === "string" ? payload.issuer_id : typeof payload.issuer_name === "string" ? payload.issuer_name : null,
+      type: typeof payload.type === "string" ? payload.type : null
+    };
+  }
+  return {
+    kid: typeof env.kid === "string" ? env.kid : null,
+    issuer: typeof env.issuer === "string" ? env.issuer : null,
+    type: typeof env.type === "string" ? env.type : null
+  };
+}
+
+export {
+  canonicalize,
+  receiptHash,
+  computeSbIssuerKid,
+  createReceiptEnvelope,
+  verifyReceipt,
+  receiptIdentity
+};