@forestrie/forestrie-cli 0.11.0 → 0.11.1

package/README.md

@@ -421,6 +421,16 @@ differing from the genesis, a receipt with no delegation certificate or a
 non-KS256 genesis root, and any result other than that magic word.
 Use an archive node for an old `--block`.
 
+**Trust.** An attestation is what the RPC you named reported; it is unsigned,
+and `verify` cannot tell a fetched one from a forged one. So:
+
+- **Fetch it yourself,** or accept one only from a party you would trust to
+  read the chain for you.
+- **For more confidence, ask several independent RPCs** with the same
+  `--block` and check that each succeeds with the same `blockHash`.
+- **Pick a block near the receipt's time.** The guarantee is "valid under the
+  contract's signers at that block", and owners can change after issuance.
+
 ## Use as a library: `decode-receipt`
 
 The receipt decoder behind `forestrie decode-receipt` is exported as a

package/dist/cli.js

@@ -36758,7 +36758,7 @@ var init_verify3 = __esm(() => {
       },
       "ks256-attestation": {
         type: "string",
-        description: "ERC-1271 attestation (CBOR from `forestrie fetch-ks256-attestation`) for a KS256 contract root such as a Safe: the delegation certificate then verifies offline as valid under the contract's signers at the attested block, not as a signature by one key. Needs the forest chain id from --genesis. verify never calls the chain",
+        description: "ERC-1271 attestation (CBOR from `forestrie fetch-ks256-attestation`) for a KS256 contract root such as a Safe: the delegation certificate then verifies offline as valid under the contract's signers at the attested block, not as a signature by one key. Needs the forest chain id from --genesis. verify never calls the chain. Trust: an attestation is unsigned and only as good as whoever fetched it — accept one only from a party you would trust to read the chain for you, or fetch it yourself",
         valueHint: "path"
       },
       receipt: {
@@ -36852,7 +36852,7 @@ var init_verify_grant = __esm(() => {
       },
       "ks256-attestation": {
         type: "string",
-        description: "ERC-1271 attestation (CBOR from `forestrie fetch-ks256-attestation`) for a KS256 contract root such as a Safe: the delegation certificate then verifies offline as valid under the contract's signers at the attested block, not as a signature by one key. Needs the forest chain id from --genesis. verify never calls the chain",
+        description: "ERC-1271 attestation (CBOR from `forestrie fetch-ks256-attestation`) for a KS256 contract root such as a Safe: the delegation certificate then verifies offline as valid under the contract's signers at the attested block, not as a signature by one key. Needs the forest chain id from --genesis. verify never calls the chain. Trust: an attestation is unsigned and only as good as whoever fetched it — accept one only from a party you would trust to read the chain for you, or fetch it yourself",
         valueHint: "path"
       },
       receipt: {
@@ -37313,7 +37313,7 @@ var init_fetch_ks256_attestation3 = __esm(() => {
   fetch_ks256_attestation_default = defineForestrieCommand({
     meta: {
       name: "fetch-ks256-attestation",
-      description: "Ask a KS256 contract root (a Safe) over ERC-1271 whether it signs the receipt's delegation certificate, and cache the block-bound answer as a --ks256-attestation artifact (CBOR binding chainId/address/digest/signature hash/block) — verify then accepts the contract-rooted receipt offline as valid under the contract's signers at that block. Auditable: anyone with RPC can re-run the call at that block. An EOA root needs no attestation (verify recovers it)"
+      description: "Ask a KS256 contract root (a Safe) over ERC-1271 whether it signs the receipt's delegation certificate, and cache the block-bound answer as a --ks256-attestation artifact (CBOR binding chainId/address/digest/signature hash/block) — verify then accepts the contract-rooted receipt offline as valid under the contract's signers at that block. The answer is only as trustworthy as the RPC you name; for more confidence run it against several independent RPCs with the same --block and check they agree on the block hash. Auditable: anyone with RPC can re-run the call at that block. An EOA root needs no attestation (verify recovers it)"
     },
     args: {
       receipt: {
@@ -37339,7 +37339,7 @@ var init_fetch_ks256_attestation3 = __esm(() => {
       },
       block: {
         type: "string",
-        description: "Block number to pin the calls to, or 'latest' (default) — needs an archive node for old blocks",
+        description: "Block number to pin the calls to, or 'latest' (default). The attestation speaks for the contract's signers at this block, so pick one near the receipt's time for an authorised-at-issuance reading; old blocks need an archive node",
         valueHint: "number|latest"
       },
       out: {
@@ -37483,7 +37483,7 @@ init_dist();
 // package.json
 var package_default = {
   name: "@forestrie/forestrie-cli",
-  version: "0.11.0",
+  version: "0.11.1",
   description: "forestrie — participant CLI for forestrie transparency logs (SCITT / COSE receipts)",
   keywords: [
     "forestrie",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forestrie/forestrie-cli",
-  "version": "0.11.0",
+  "version": "0.11.1",
   "description": "forestrie — participant CLI for forestrie transparency logs (SCITT / COSE receipts)",
   "keywords": [
     "forestrie",

package/src/commands/fetch-ks256-attestation.ts

@@ -6,7 +6,7 @@ export default defineForestrieCommand({
   meta: {
     name: "fetch-ks256-attestation",
     description:
-      "Ask a KS256 contract root (a Safe) over ERC-1271 whether it signs the receipt's delegation certificate, and cache the block-bound answer as a --ks256-attestation artifact (CBOR binding chainId/address/digest/signature hash/block) — verify then accepts the contract-rooted receipt offline as valid under the contract's signers at that block. Auditable: anyone with RPC can re-run the call at that block. An EOA root needs no attestation (verify recovers it)",
+      "Ask a KS256 contract root (a Safe) over ERC-1271 whether it signs the receipt's delegation certificate, and cache the block-bound answer as a --ks256-attestation artifact (CBOR binding chainId/address/digest/signature hash/block) — verify then accepts the contract-rooted receipt offline as valid under the contract's signers at that block. The answer is only as trustworthy as the RPC you name; for more confidence run it against several independent RPCs with the same --block and check they agree on the block hash. Auditable: anyone with RPC can re-run the call at that block. An EOA root needs no attestation (verify recovers it)",
   },
   args: {
     receipt: {
@@ -35,7 +35,7 @@ export default defineForestrieCommand({
     block: {
       type: "string",
       description:
-        "Block number to pin the calls to, or 'latest' (default) — needs an archive node for old blocks",
+        "Block number to pin the calls to, or 'latest' (default). The attestation speaks for the contract's signers at this block, so pick one near the receipt's time for an authorised-at-issuance reading; old blocks need an archive node",
       valueHint: "number|latest",
     },
     out: {

package/src/commands/verify-grant.ts

@@ -24,7 +24,7 @@ export default defineForestrieCommand({
     "ks256-attestation": {
       type: "string",
       description:
-        "ERC-1271 attestation (CBOR from `forestrie fetch-ks256-attestation`) for a KS256 contract root such as a Safe: the delegation certificate then verifies offline as valid under the contract's signers at the attested block, not as a signature by one key. Needs the forest chain id from --genesis. verify never calls the chain",
+        "ERC-1271 attestation (CBOR from `forestrie fetch-ks256-attestation`) for a KS256 contract root such as a Safe: the delegation certificate then verifies offline as valid under the contract's signers at the attested block, not as a signature by one key. Needs the forest chain id from --genesis. verify never calls the chain. Trust: an attestation is unsigned and only as good as whoever fetched it — accept one only from a party you would trust to read the chain for you, or fetch it yourself",
       valueHint: "path",
     },
     receipt: {

package/src/commands/verify.ts

@@ -24,7 +24,7 @@ export default defineForestrieCommand({
     "ks256-attestation": {
       type: "string",
       description:
-        "ERC-1271 attestation (CBOR from `forestrie fetch-ks256-attestation`) for a KS256 contract root such as a Safe: the delegation certificate then verifies offline as valid under the contract's signers at the attested block, not as a signature by one key. Needs the forest chain id from --genesis. verify never calls the chain",
+        "ERC-1271 attestation (CBOR from `forestrie fetch-ks256-attestation`) for a KS256 contract root such as a Safe: the delegation certificate then verifies offline as valid under the contract's signers at the attested block, not as a signature by one key. Needs the forest chain id from --genesis. verify never calls the chain. Trust: an attestation is unsigned and only as good as whoever fetched it — accept one only from a party you would trust to read the chain for you, or fetch it yourself",
       valueHint: "path",
     },
     receipt: {