@postcept/receipt

@postcept/receipt

The open reference implementation for verifying Postcept Receipts and VCR-audit badges — independently, in any JavaScript environment (browser, Node, Deno, edge). No Postcept API call and no trust required: a receipt is proof you can check yourself with nothing but the published public key.

The receipt format and signing scheme are specified in SPEC.md. This package is the canonical JS implementation of that standard; the Postcept API signs with the byte-for-byte equivalent in Python.

Usage

import { verifyReceipt, verifyBadge, type Receipt } from "@postcept/receipt";

// Fetch the current public key once (or pin a key id from the receipt):
const { public_key } = await fetch("https://api.postcept.com/v1/signing-key").then((r) => r.json());

const ok = await verifyReceipt(receipt as Receipt, public_key);
// ok === true  → authentic and unmodified, signed by Postcept's key.

verifyReceipt and verifyBadge are pure and side-effect-free: they return false on a bad signature or malformed input rather than throwing.

Exports

Export	Purpose
verifyReceipt	Verify a receipt's Ed25519 signature against a public key.
verifyBadge	Verify a VCR-audit badge.
verifyReceiptInLog	Verify a receipt's transparency-log inclusion + signed tree head.
verifyInclusion / verifySignedTreeHead	Verify a Merkle inclusion proof / an STH.
receiptSigningBody	The exact body the signature covers (for re-implementers).
badgeSigningBody	The badge signing body.
canonicalize	Deterministic JSON encoding (sorted keys, ASCII-escaped).
@postcept/receipt/schema	JSON Schema for the receipt object.

Why a separate package?

So the verification logic has exactly one source of truth. Postcept's own website verifier and free-audit tool import it; so can you. The trust story only holds if the reference implementation is open and self-contained.