@postcept/receipt - npm Package Compare versions

Comparing version 1.1.2 to 1.2.0

dist/index.d.ts

 export { asciiJson, base64ToBytes, canonicalize, TIMESTAMP_SPELLINGS } from "./canonical.js";
-export { type Observation, type Postcondition, type Receipt, receiptSigningBody, verifyObservation, verifyReceipt, } from "./receipt.js";
+export { CANONICALIZATION_SCHEME, type Observation, type Postcondition, type Receipt, receiptSigningBody, verifyObservation, verifyReceipt, } from "./receipt.js";
 export { type AuditBadge, badgeSigningBody, verifyBadge } from "./badge.js";
 export { type ConsistencyProof, type InclusionProof, type SignedTreeHead, receiptLeafHash, verifyConsistency, verifyInclusion, verifyReceiptInLog, verifySignedTreeHead, } from "./transparency.js";
 export { type EvidenceExportLike, type EvidenceManifest, evidenceContentDigest, verifyEvidenceExport, verifyEvidenceManifest, } from "./evidence.js";

dist/index.js

@@ -5,5 +5,5 @@ // @postcept/receipt: open reference implementation for verifying Postcept Receipts
 export { asciiJson, base64ToBytes, canonicalize, TIMESTAMP_SPELLINGS } from "./canonical.js";
-export { receiptSigningBody, verifyObservation, verifyReceipt, } from "./receipt.js";
+export { CANONICALIZATION_SCHEME, receiptSigningBody, verifyObservation, verifyReceipt, } from "./receipt.js";
 export { badgeSigningBody, verifyBadge } from "./badge.js";
 export { receiptLeafHash, verifyConsistency, verifyInclusion, verifyReceiptInLog, verifySignedTreeHead, } from "./transparency.js";
 export { evidenceContentDigest, verifyEvidenceExport, verifyEvidenceManifest, } from "./evidence.js";

dist/receipt.d.ts

@@ -41,2 +41,3 @@ export interface Postcondition {
 }
+export declare const CANONICALIZATION_SCHEME = "postcept-canonical-json-v1";
 export declare function receiptSigningBody(r: Receipt, ts: (s: string) => string): Record<string, unknown>;
@@ -43,0 +44,0 @@ /**

dist/receipt.js

@@ -5,2 +5,7 @@ // The signed receipt object and its verification. Reference implementation of the
 import { base64ToBytes, canonicalize, sha256Hex, TIMESTAMP_SPELLINGS } from "./canonical.js";
+// Stable identifier for the canonical-JSON scheme (sorted keys, no whitespace,
+// non-ASCII and control characters escaped). Bound into the v3 signing body so the
+// signature covers which scheme produced the bytes. Matches CANONICALIZATION_SCHEME
+// in the control plane. Bump both together if the scheme ever changes.
+export const CANONICALIZATION_SCHEME = "postcept-canonical-json-v1";
 /**
@@ -40,2 +45,6 @@ * The exact subset of a receipt the signature covers, by version. `ts` applies a
             version: "3",
+            // Bind the signature metadata into the protected content (see CANONICALIZATION_SCHEME).
+            algorithm: r.algorithm ?? "ed25519",
+            signing_key_id: r.signing_key_id ?? null,
+            canonicalization: CANONICALIZATION_SCHEME,
             supersedes: r.supersedes ?? null,
@@ -42,0 +51,0 @@ contract_digest: r.contract_digest ?? null,

package.json

 {
   "name": "@postcept/receipt",
-  "version": "1.1.2",
+  "version": "1.2.0",
   "description": "Independently verify a Postcept Receipt, the signed proof that an AI agent's high-risk action actually happened in the system of record. Runs anywhere, needs only the public key.",
@@ -5,0 +5,0 @@ "license": "MIT",

SPEC.md

@@ -157,2 +157,5 @@ # Postcept Receipt: open verification standard
   "version": "3",
+  "algorithm": "ed25519",                 // the signature scheme, now signed
+  "signing_key_id": "ed25519:...",        // the key that signed, now signed
+  "canonicalization": "postcept-canonical-json-v1",  // the scheme in §2, now signed
   "supersedes": "<receipt_id | null>",
@@ -159,0 +162,0 @@ "contract_digest": "sha256:... | null",

No alert changes

Improved metrics

Total package byte prevSize

43908

2.37%

Lines of code

664

1.53%

No dependency changes