@forestrie/forestrie-cli 0.8.0 → 0.9.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli.js +1202 -340
- package/dist/lib/decode-receipt-labels.d.ts +12 -1
- package/dist/lib/decode-receipt-labels.d.ts.map +1 -1
- package/dist/lib/decode-receipt-labels.js +48 -1
- package/dist/lib/decode-receipt-labels.js.map +1 -1
- package/package.json +8 -8
- package/src/lib/checkpoint-provider.ts +30 -4
- package/src/lib/consistency-proof.ts +14 -6
- package/src/lib/decode-receipt-labels.ts +51 -1
- package/src/lib/resolve-receipt-freshen.ts +10 -1
|
@@ -7,7 +7,11 @@
|
|
|
7
7
|
* RFC 8392 (CWT claim keys), draft-ietf-cose-merkle-tree-proofs
|
|
8
8
|
* (395 vds / 396 verifiable proofs), and the forestrie private-use
|
|
9
9
|
* labels (canopy grants.md, ADR-0046, plan-0033 format v3,
|
|
10
|
-
* `@forestrie/receipt-verify` forest-genesis-labels).
|
|
10
|
+
* `@forestrie/receipt-verify` forest-genesis-labels). The forestrie
|
|
11
|
+
* private-use codepoints are normatively registered in
|
|
12
|
+
* forestrie/protocol's spec/label-registry.md — see that doc for
|
|
13
|
+
* -65800 (ALG_ES256_WEBAUTHN / TBD1), -65801 (TBD2), and -66535
|
|
14
|
+
* (SealDelegationProofLabel).
|
|
11
15
|
*/
|
|
12
16
|
/** CBOR tag for COSE_Sign1 (RFC 9052 §2). */
|
|
13
17
|
export declare const COSE_SIGN1_TAG = 18;
|
|
@@ -21,6 +25,13 @@ export declare const CWT_CLAIMS_LABEL = 15;
|
|
|
21
25
|
export declare const DELEGATION_CERT_LABEL = 1000;
|
|
22
26
|
/** Pre-signed peak inclusion receipts on a checkpoint (`SealPeakReceiptsLabel`). */
|
|
23
27
|
export declare const SEAL_PEAK_RECEIPTS_LABEL = -65931;
|
|
28
|
+
/**
|
|
29
|
+
* Signed `tree-size-2` on a checkpoint's PROTECTED header (ADR-0066 D1 as
|
|
30
|
+
* amended 2026-09-20, `@forestrie/encoding` `COSE_LABEL_TREE_SIZE_2`): the
|
|
31
|
+
* only sealed size a checkpoint signs. Label -65932 (`tree-size-1`) was
|
|
32
|
+
* withdrawn before use and must not be registered here.
|
|
33
|
+
*/
|
|
34
|
+
export declare const TREE_SIZE_2_LABEL = -65933;
|
|
24
35
|
/** Inclusion proofs key inside header 396. */
|
|
25
36
|
export declare const PROOFS_INCLUSION_KEY = -1;
|
|
26
37
|
/** Consistency proofs key inside header 396. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"decode-receipt-labels.d.ts","sourceRoot":"","sources":["../../src/lib/decode-receipt-labels.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"decode-receipt-labels.d.ts","sourceRoot":"","sources":["../../src/lib/decode-receipt-labels.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,6CAA6C;AAC7C,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC,iFAAiF;AACjF,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAC3C,uFAAuF;AACvF,eAAO,MAAM,SAAS,MAAM,CAAC;AAC7B,8CAA8C;AAC9C,eAAO,MAAM,gBAAgB,KAAK,CAAC;AACnC,gFAAgF;AAChF,eAAO,MAAM,qBAAqB,OAAO,CAAC;AAC1C,oFAAoF;AACpF,eAAO,MAAM,wBAAwB,SAAS,CAAC;AAC/C;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,SAAS,CAAC;AAExC,8CAA8C;AAC9C,eAAO,MAAM,oBAAoB,KAAK,CAAC;AACvC,gDAAgD;AAChD,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,6EAA6E;AAC7E,eAAO,MAAM,aAAa,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,CAuEvD,CAAC;AAEH,+DAA+D;AAC/D,eAAO,MAAM,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAWhD,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAIhD,CAAC;AAEH,wDAAwD;AACxD,eAAO,MAAM,eAAe,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAStD,CAAC;AAEH,yEAAyE;AACzE,eAAO,MAAM,oBAAoB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAO3D,CAAC;AAEH,mEAAmE;AACnE,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAGvD,CAAC;AAEH,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAE/D"}
|
|
@@ -7,7 +7,11 @@
|
|
|
7
7
|
* RFC 8392 (CWT claim keys), draft-ietf-cose-merkle-tree-proofs
|
|
8
8
|
* (395 vds / 396 verifiable proofs), and the forestrie private-use
|
|
9
9
|
* labels (canopy grants.md, ADR-0046, plan-0033 format v3,
|
|
10
|
-
* `@forestrie/receipt-verify` forest-genesis-labels).
|
|
10
|
+
* `@forestrie/receipt-verify` forest-genesis-labels). The forestrie
|
|
11
|
+
* private-use codepoints are normatively registered in
|
|
12
|
+
* forestrie/protocol's spec/label-registry.md — see that doc for
|
|
13
|
+
* -65800 (ALG_ES256_WEBAUTHN / TBD1), -65801 (TBD2), and -66535
|
|
14
|
+
* (SealDelegationProofLabel).
|
|
11
15
|
*/
|
|
12
16
|
/** CBOR tag for COSE_Sign1 (RFC 9052 §2). */
|
|
13
17
|
export const COSE_SIGN1_TAG = 18;
|
|
@@ -21,6 +25,13 @@ export const CWT_CLAIMS_LABEL = 15;
|
|
|
21
25
|
export const DELEGATION_CERT_LABEL = 1000;
|
|
22
26
|
/** Pre-signed peak inclusion receipts on a checkpoint (`SealPeakReceiptsLabel`). */
|
|
23
27
|
export const SEAL_PEAK_RECEIPTS_LABEL = -65931;
|
|
28
|
+
/**
|
|
29
|
+
* Signed `tree-size-2` on a checkpoint's PROTECTED header (ADR-0066 D1 as
|
|
30
|
+
* amended 2026-09-20, `@forestrie/encoding` `COSE_LABEL_TREE_SIZE_2`): the
|
|
31
|
+
* only sealed size a checkpoint signs. Label -65932 (`tree-size-1`) was
|
|
32
|
+
* withdrawn before use and must not be registered here.
|
|
33
|
+
*/
|
|
34
|
+
export const TREE_SIZE_2_LABEL = -65933;
|
|
24
35
|
/** Inclusion proofs key inside header 396. */
|
|
25
36
|
export const PROOFS_INCLUSION_KEY = -1;
|
|
26
37
|
/** Consistency proofs key inside header 396. */
|
|
@@ -51,6 +62,22 @@ export const HEADER_LABELS = new Map([
|
|
|
51
62
|
],
|
|
52
63
|
[-65537, { name: "idtimestamp", note: "forestrie private-use" }],
|
|
53
64
|
[-65538, { name: "forestrie grant v0", note: "forestrie private-use" }],
|
|
65
|
+
[
|
|
66
|
+
-65800,
|
|
67
|
+
{
|
|
68
|
+
name: "WebAuthn assertion envelope",
|
|
69
|
+
note: "forestrie TBD1: [authenticatorData, clientDataJSON] (unprotected; " +
|
|
70
|
+
"reuses the -65800 algorithm codepoint, label-registry.md §4)",
|
|
71
|
+
},
|
|
72
|
+
],
|
|
73
|
+
[
|
|
74
|
+
-65801,
|
|
75
|
+
{
|
|
76
|
+
name: "session key endorsement",
|
|
77
|
+
note: "forestrie TBD2: the endorsement COSE_Sign1, embedded as a bstr " +
|
|
78
|
+
"(unprotected, leaf-admission-and-session-endorsement.md)",
|
|
79
|
+
},
|
|
80
|
+
],
|
|
54
81
|
[
|
|
55
82
|
SEAL_PEAK_RECEIPTS_LABEL,
|
|
56
83
|
{
|
|
@@ -58,6 +85,21 @@ export const HEADER_LABELS = new Map([
|
|
|
58
85
|
note: "forestrie SealPeakReceiptsLabel (checkpoint header)",
|
|
59
86
|
},
|
|
60
87
|
],
|
|
88
|
+
[
|
|
89
|
+
TREE_SIZE_2_LABEL,
|
|
90
|
+
{
|
|
91
|
+
name: "tree-size-2",
|
|
92
|
+
note: "forestrie: signed sealed size (ADR-0066 D1 as amended, checkpoint " +
|
|
93
|
+
"protected header)",
|
|
94
|
+
},
|
|
95
|
+
],
|
|
96
|
+
[
|
|
97
|
+
-66535,
|
|
98
|
+
{
|
|
99
|
+
name: "on-chain delegation proof",
|
|
100
|
+
note: "forestrie SealDelegationProofLabel (checkpoint header)",
|
|
101
|
+
},
|
|
102
|
+
],
|
|
61
103
|
[-68009, { name: "forest genesis version", note: "forestrie private-use" }],
|
|
62
104
|
[-68011, { name: "univocity address", note: "forestrie private-use" }],
|
|
63
105
|
[-68013, { name: "chain id", note: "forestrie private-use" }],
|
|
@@ -71,6 +113,11 @@ export const ALG_NAMES = new Map([
|
|
|
71
113
|
[-35, "ES384"],
|
|
72
114
|
[-36, "ES512"],
|
|
73
115
|
[-65799, "KS256 (secp256k1 + Keccak-256, forestrie private-use)"],
|
|
116
|
+
[
|
|
117
|
+
-65800,
|
|
118
|
+
"ES256-WebAuthn (forestrie private-use; delegation proofs and " +
|
|
119
|
+
"certificates only, never checkpoint-signing)",
|
|
120
|
+
],
|
|
74
121
|
]);
|
|
75
122
|
/**
|
|
76
123
|
* Verifiable data structure ids (draft-ietf-cose-merkle-tree-proofs
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"decode-receipt-labels.js","sourceRoot":"","sources":["../../src/lib/decode-receipt-labels.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"decode-receipt-labels.js","sourceRoot":"","sources":["../../src/lib/decode-receipt-labels.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,6CAA6C;AAC7C,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAEjC,iFAAiF;AACjF,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAC3C,uFAAuF;AACvF,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,CAAC;AAC7B,8CAA8C;AAC9C,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AACnC,gFAAgF;AAChF,MAAM,CAAC,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAC1C,oFAAoF;AACpF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,KAAK,CAAC;AAC/C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,KAAK,CAAC;AAExC,8CAA8C;AAC9C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,CAAC;AACvC,gDAAgD;AAChD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,CAAC;AAQzC,6EAA6E;AAC7E,MAAM,CAAC,MAAM,aAAa,GAAmC,IAAI,GAAG,CAAC;IACnE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACpB,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACrB,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;IAC7B,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACpB,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACnB,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAC3B,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;IAC5D;QACE,SAAS;QACT,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,uBAAuB,EAAE;KACrE;IACD;QACE,uBAAuB;QACvB,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE;KAC7D;IACD;QACE,qBAAqB;QACrB;YACE,IAAI,EAAE,wBAAwB;YAC9B,IAAI,EAAE,6DAA6D;SACpE;KACF;IACD,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;IAChE,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;IACvE;QACE,CAAC,KAAK;QACN;YACE,IAAI,EAAE,6BAA6B;YACnC,IAAI,EACF,oEAAoE;gBACpE,8DAA8D;SACjE;KACF;IACD;QACE,CAAC,KAAK;QACN;YACE,IAAI,EAAE,yBAAyB;YAC/B,IAAI,EACF,iEAAiE;gBACjE,0DAA0D;SAC7D;KACF;IACD;QACE,wBAAwB;QACxB;YACE,IAAI,EAAE,0BAA0B;YAChC,IAAI,EAAE,qDAAqD;SAC5D;KACF;IACD;QACE,iBAAiB;QACjB;YACE,IAAI,EAAE,aAAa;YACnB,IAAI,EACF,oEAAoE;gBACpE,mBAAmB;SACtB;KACF;IACD;QACE,CAAC,KAAK;QACN;YACE,IAAI,EAAE,2BAA2B;YACjC,IAAI,EAAE,wDAAwD;SAC/D;KACF;IACD,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;IAC3E,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;IACtE,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;IAC7D,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;IACvE,CAAC,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;CACnE,CAAC,CAAC;AAEH,+DAA+D;AAC/D,MAAM,CAAC,MAAM,SAAS,GAAgC,IAAI,GAAG,CAAC;IAC5D,CAAC,CAAC,CAAC,EAAE,+BAA+B,CAAC;IACrC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;IACb,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC;IACd,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC;IACd,CAAC,CAAC,KAAK,EAAE,uDAAuD,CAAC;IACjE;QACE,CAAC,KAAK;QACN,+DAA+D;YAC7D,8CAA8C;KACjD;CACF,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,SAAS,GAAgC,IAAI,GAAG,CAAC;IAC5D,CAAC,CAAC,EAAE,2CAA2C,CAAC;IAChD,CAAC,CAAC,EAAE,mBAAmB,CAAC;IACxB,CAAC,CAAC,EAAE,0CAA0C,CAAC;CAChD,CAAC,CAAC;AAEH,wDAAwD;AACxD,MAAM,CAAC,MAAM,eAAe,GAAgC,IAAI,GAAG,CAAC;IAClE,CAAC,CAAC,EAAE,KAAK,CAAC;IACV,CAAC,CAAC,EAAE,KAAK,CAAC;IACV,CAAC,CAAC,EAAE,KAAK,CAAC;IACV,CAAC,CAAC,EAAE,KAAK,CAAC;IACV,CAAC,CAAC,EAAE,KAAK,CAAC;IACV,CAAC,CAAC,EAAE,KAAK,CAAC;IACV,CAAC,CAAC,EAAE,KAAK,CAAC;IACV,CAAC,CAAC,EAAE,oCAAoC,CAAC;CAC1C,CAAC,CAAC;AAEH,yEAAyE;AACzE,MAAM,CAAC,MAAM,oBAAoB,GAAgC,IAAI,GAAG,CAAC;IACvE,CAAC,CAAC,EAAE,KAAK,CAAC;IACV,CAAC,CAAC,EAAE,KAAK,CAAC;IACV,CAAC,CAAC,EAAE,KAAK,CAAC;IACV,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC;IACX,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;IACT,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC;CACV,CAAC,CAAC;AAEH,mEAAmE;AACnE,MAAM,CAAC,MAAM,gBAAgB,GAAgC,IAAI,GAAG,CAAC;IACnE,CAAC,oBAAoB,EAAE,kBAAkB,CAAC;IAC1C,CAAC,sBAAsB,EAAE,oBAAoB,CAAC;CAC/C,CAAC,CAAC;AAEH,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC;AAC1C,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@forestrie/forestrie-cli",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.9.0",
|
|
4
4
|
"description": "forestrie — participant CLI for forestrie transparency logs (SCITT / COSE receipts)",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"forestrie",
|
|
@@ -64,15 +64,15 @@
|
|
|
64
64
|
"prepack": "bun run build"
|
|
65
65
|
},
|
|
66
66
|
"dependencies": {
|
|
67
|
-
"@forestrie/chain-rpc": "^0.
|
|
67
|
+
"@forestrie/chain-rpc": "^0.3.0",
|
|
68
68
|
"@forestrie/cli-kit": "^0.1.1",
|
|
69
|
-
"@forestrie/delegation-cose": "^0.3.
|
|
69
|
+
"@forestrie/delegation-cose": "^0.3.2",
|
|
70
70
|
"@forestrie/deploy-core": "^0.7.1",
|
|
71
|
-
"@forestrie/encoding": "^0.
|
|
72
|
-
"@forestrie/grant-builder": "^0.
|
|
73
|
-
"@forestrie/merklelog": "^0.
|
|
74
|
-
"@forestrie/receipt-verify": "^
|
|
75
|
-
"@forestrie/scrapi-client": "^0.
|
|
71
|
+
"@forestrie/encoding": "^0.8.0",
|
|
72
|
+
"@forestrie/grant-builder": "^0.5.0",
|
|
73
|
+
"@forestrie/merklelog": "^0.4.0",
|
|
74
|
+
"@forestrie/receipt-verify": "^2.0.0",
|
|
75
|
+
"@forestrie/scrapi-client": "^0.2.2",
|
|
76
76
|
"citty": "^0.2.2",
|
|
77
77
|
"viem": "^2.31.0"
|
|
78
78
|
},
|
|
@@ -55,6 +55,23 @@ export type CheckpointSeal =
|
|
|
55
55
|
}
|
|
56
56
|
| { kind: "sth"; checkpointBytes: Uint8Array };
|
|
57
57
|
|
|
58
|
+
/**
|
|
59
|
+
* Fold-relevant fields of a consistency proof, shared by calldata-decoded
|
|
60
|
+
* proofs (`CalldataConsistencyProof` — no per-proof signed size; on-chain
|
|
61
|
+
* calldata carries no protected header) and sth-decoded
|
|
62
|
+
* `CheckpointConsistencyProof` (which adds `signedTreeSize2`, cross-checked
|
|
63
|
+
* against the checkpoint's protected header at decode time). Neither
|
|
64
|
+
* `computeCheckpointAccumulator` nor `freshenReceipt` reads `signedTreeSize2`
|
|
65
|
+
* — only the trusted base SIZE (passed separately, never off the proof) and
|
|
66
|
+
* `treeSize1`/`treeSize2`/`paths`/`rightPeaks` matter to the fold — so this
|
|
67
|
+
* provider carries the narrower shape and backfills `signedTreeSize2` with
|
|
68
|
+
* `treeSize2` only where receipt-verify's stricter parameter type demands it.
|
|
69
|
+
*/
|
|
70
|
+
export type FoldableConsistencyProof = Pick<
|
|
71
|
+
CheckpointConsistencyProof,
|
|
72
|
+
"treeSize1" | "treeSize2" | "paths" | "rightPeaks"
|
|
73
|
+
>;
|
|
74
|
+
|
|
58
75
|
/** One folded link: the accumulator committed at `treeSize2`. */
|
|
59
76
|
export type CheckpointLink = {
|
|
60
77
|
treeSize1: bigint;
|
|
@@ -64,7 +81,7 @@ export type CheckpointLink = {
|
|
|
64
81
|
/** The raw consistency proof this link was folded from — its per-peak `paths`
|
|
65
82
|
* (the tile-free climb material). Retained so a path-extending consumer
|
|
66
83
|
* (freshen) gets it without a re-decode; folding consumers ignore it. */
|
|
67
|
-
proof:
|
|
84
|
+
proof: FoldableConsistencyProof;
|
|
68
85
|
/** The signature material to verify this link's accumulator, when directly
|
|
69
86
|
* signed (see {@link CheckpointSeal}). The provider does NOT verify it. */
|
|
70
87
|
seal?: CheckpointSeal;
|
|
@@ -81,7 +98,7 @@ export type CheckpointLink = {
|
|
|
81
98
|
* start at base 0.
|
|
82
99
|
*/
|
|
83
100
|
export async function foldProofChain(
|
|
84
|
-
proofs: readonly
|
|
101
|
+
proofs: readonly FoldableConsistencyProof[],
|
|
85
102
|
opts: {
|
|
86
103
|
accumulatorFrom?: Uint8Array[];
|
|
87
104
|
accumulatorFromSize?: bigint;
|
|
@@ -109,7 +126,16 @@ export async function foldProofChain(
|
|
|
109
126
|
`checkpoint chain is not contiguous at link ${i}: base ${p.treeSize1} != expected ${expectedBase}`,
|
|
110
127
|
);
|
|
111
128
|
}
|
|
112
|
-
|
|
129
|
+
// receipt-verify 2.0.0: the trusted base size is a parameter, never read
|
|
130
|
+
// off the proof (ADR-0066 D5.4) — `expectedBase` is exactly that, already
|
|
131
|
+
// checked against `p.treeSize1` above. `signedTreeSize2` is backfilled
|
|
132
|
+
// from `treeSize2` only to satisfy the parameter type; the fold does not
|
|
133
|
+
// read it (see `FoldableConsistencyProof`'s doc comment above).
|
|
134
|
+
accumulator = await computeCheckpointAccumulator(
|
|
135
|
+
{ ...p, signedTreeSize2: p.treeSize2 },
|
|
136
|
+
accumulator,
|
|
137
|
+
expectedBase,
|
|
138
|
+
);
|
|
113
139
|
const link: CheckpointLink = {
|
|
114
140
|
treeSize1: p.treeSize1,
|
|
115
141
|
treeSize2: p.treeSize2,
|
|
@@ -220,7 +246,7 @@ export async function calldataCheckpointChain(opts: {
|
|
|
220
246
|
}),
|
|
221
247
|
);
|
|
222
248
|
|
|
223
|
-
const proofs:
|
|
249
|
+
const proofs: FoldableConsistencyProof[] = [];
|
|
224
250
|
const seals: (CheckpointSeal | undefined)[] = [];
|
|
225
251
|
const sourceRefs: string[] = [];
|
|
226
252
|
const finalLinkIndex: number[] = []; // link index of each tx's last proof
|
|
@@ -180,10 +180,16 @@ export async function buildConsistencyProofArtifact(opts: {
|
|
|
180
180
|
// supplied massifs fails HERE, not at the holder.
|
|
181
181
|
const accumulatorTo = peakMMRIndexes(opts.toSize - 1n).map(opts.get);
|
|
182
182
|
const hasher = await createSyncHasher();
|
|
183
|
+
// merklelog 0.4.0: both sizes are CALLER-TRUSTED state, never read off
|
|
184
|
+
// `proof` (ADR-0066 D5.4) — `opts.fromSize`/`opts.toSize` are exactly what
|
|
185
|
+
// this builder already trusts (they seeded `accumulatorFrom`/`accumulatorTo`
|
|
186
|
+
// above).
|
|
183
187
|
const check = await verifyConsistency(
|
|
184
188
|
hasher,
|
|
185
|
-
|
|
189
|
+
opts.fromSize,
|
|
190
|
+
opts.toSize,
|
|
186
191
|
accumulatorFrom,
|
|
192
|
+
proof.paths,
|
|
187
193
|
accumulatorTo,
|
|
188
194
|
);
|
|
189
195
|
if (!check.ok) {
|
|
@@ -249,14 +255,16 @@ export async function checkReceiptAnchoredViaConsistencyProof(opts: {
|
|
|
249
255
|
};
|
|
250
256
|
}
|
|
251
257
|
const hasher = await createSyncHasher();
|
|
258
|
+
// merklelog 0.4.0: sizes are caller-trusted parameters, not read off a
|
|
259
|
+
// proof object — `artifact.toSize` was already checked equal to
|
|
260
|
+
// `opts.trustedSize` above, and `artifact.fromSize` is the base whose
|
|
261
|
+
// accumulator `recomputedPeak` was just matched against.
|
|
252
262
|
const check = await verifyConsistency(
|
|
253
263
|
hasher,
|
|
254
|
-
|
|
255
|
-
|
|
256
|
-
mmrSizeB: artifact.toSize,
|
|
257
|
-
paths: artifact.paths,
|
|
258
|
-
},
|
|
264
|
+
artifact.fromSize,
|
|
265
|
+
artifact.toSize,
|
|
259
266
|
artifact.accumulatorFrom,
|
|
267
|
+
artifact.paths,
|
|
260
268
|
opts.trustedAccumulator,
|
|
261
269
|
);
|
|
262
270
|
if (!check.ok) {
|
|
@@ -7,7 +7,11 @@
|
|
|
7
7
|
* RFC 8392 (CWT claim keys), draft-ietf-cose-merkle-tree-proofs
|
|
8
8
|
* (395 vds / 396 verifiable proofs), and the forestrie private-use
|
|
9
9
|
* labels (canopy grants.md, ADR-0046, plan-0033 format v3,
|
|
10
|
-
* `@forestrie/receipt-verify` forest-genesis-labels).
|
|
10
|
+
* `@forestrie/receipt-verify` forest-genesis-labels). The forestrie
|
|
11
|
+
* private-use codepoints are normatively registered in
|
|
12
|
+
* forestrie/protocol's spec/label-registry.md — see that doc for
|
|
13
|
+
* -65800 (ALG_ES256_WEBAUTHN / TBD1), -65801 (TBD2), and -66535
|
|
14
|
+
* (SealDelegationProofLabel).
|
|
11
15
|
*/
|
|
12
16
|
|
|
13
17
|
/** CBOR tag for COSE_Sign1 (RFC 9052 §2). */
|
|
@@ -23,6 +27,13 @@ export const CWT_CLAIMS_LABEL = 15;
|
|
|
23
27
|
export const DELEGATION_CERT_LABEL = 1000;
|
|
24
28
|
/** Pre-signed peak inclusion receipts on a checkpoint (`SealPeakReceiptsLabel`). */
|
|
25
29
|
export const SEAL_PEAK_RECEIPTS_LABEL = -65931;
|
|
30
|
+
/**
|
|
31
|
+
* Signed `tree-size-2` on a checkpoint's PROTECTED header (ADR-0066 D1 as
|
|
32
|
+
* amended 2026-09-20, `@forestrie/encoding` `COSE_LABEL_TREE_SIZE_2`): the
|
|
33
|
+
* only sealed size a checkpoint signs. Label -65932 (`tree-size-1`) was
|
|
34
|
+
* withdrawn before use and must not be registered here.
|
|
35
|
+
*/
|
|
36
|
+
export const TREE_SIZE_2_LABEL = -65933;
|
|
26
37
|
|
|
27
38
|
/** Inclusion proofs key inside header 396. */
|
|
28
39
|
export const PROOFS_INCLUSION_KEY = -1;
|
|
@@ -61,6 +72,24 @@ export const HEADER_LABELS: ReadonlyMap<number, LabelInfo> = new Map([
|
|
|
61
72
|
],
|
|
62
73
|
[-65537, { name: "idtimestamp", note: "forestrie private-use" }],
|
|
63
74
|
[-65538, { name: "forestrie grant v0", note: "forestrie private-use" }],
|
|
75
|
+
[
|
|
76
|
+
-65800,
|
|
77
|
+
{
|
|
78
|
+
name: "WebAuthn assertion envelope",
|
|
79
|
+
note:
|
|
80
|
+
"forestrie TBD1: [authenticatorData, clientDataJSON] (unprotected; " +
|
|
81
|
+
"reuses the -65800 algorithm codepoint, label-registry.md §4)",
|
|
82
|
+
},
|
|
83
|
+
],
|
|
84
|
+
[
|
|
85
|
+
-65801,
|
|
86
|
+
{
|
|
87
|
+
name: "session key endorsement",
|
|
88
|
+
note:
|
|
89
|
+
"forestrie TBD2: the endorsement COSE_Sign1, embedded as a bstr " +
|
|
90
|
+
"(unprotected, leaf-admission-and-session-endorsement.md)",
|
|
91
|
+
},
|
|
92
|
+
],
|
|
64
93
|
[
|
|
65
94
|
SEAL_PEAK_RECEIPTS_LABEL,
|
|
66
95
|
{
|
|
@@ -68,6 +97,22 @@ export const HEADER_LABELS: ReadonlyMap<number, LabelInfo> = new Map([
|
|
|
68
97
|
note: "forestrie SealPeakReceiptsLabel (checkpoint header)",
|
|
69
98
|
},
|
|
70
99
|
],
|
|
100
|
+
[
|
|
101
|
+
TREE_SIZE_2_LABEL,
|
|
102
|
+
{
|
|
103
|
+
name: "tree-size-2",
|
|
104
|
+
note:
|
|
105
|
+
"forestrie: signed sealed size (ADR-0066 D1 as amended, checkpoint " +
|
|
106
|
+
"protected header)",
|
|
107
|
+
},
|
|
108
|
+
],
|
|
109
|
+
[
|
|
110
|
+
-66535,
|
|
111
|
+
{
|
|
112
|
+
name: "on-chain delegation proof",
|
|
113
|
+
note: "forestrie SealDelegationProofLabel (checkpoint header)",
|
|
114
|
+
},
|
|
115
|
+
],
|
|
71
116
|
[-68009, { name: "forest genesis version", note: "forestrie private-use" }],
|
|
72
117
|
[-68011, { name: "univocity address", note: "forestrie private-use" }],
|
|
73
118
|
[-68013, { name: "chain id", note: "forestrie private-use" }],
|
|
@@ -82,6 +127,11 @@ export const ALG_NAMES: ReadonlyMap<number, string> = new Map([
|
|
|
82
127
|
[-35, "ES384"],
|
|
83
128
|
[-36, "ES512"],
|
|
84
129
|
[-65799, "KS256 (secp256k1 + Keccak-256, forestrie private-use)"],
|
|
130
|
+
[
|
|
131
|
+
-65800,
|
|
132
|
+
"ES256-WebAuthn (forestrie private-use; delegation proofs and " +
|
|
133
|
+
"certificates only, never checkpoint-signing)",
|
|
134
|
+
],
|
|
85
135
|
]);
|
|
86
136
|
|
|
87
137
|
/**
|
|
@@ -102,7 +102,16 @@ async function emitFreshened(opts: {
|
|
|
102
102
|
const result = await freshenReceipt({
|
|
103
103
|
oldReceiptBytes: opts.oldReceiptBytes,
|
|
104
104
|
leafValue: opts.leafValue,
|
|
105
|
-
|
|
105
|
+
// `freshenReceipt`'s consistency-proof array type carries
|
|
106
|
+
// `signedTreeSize2` (checked at `.sth` decode time), but the fold itself
|
|
107
|
+
// never reads it — see `FoldableConsistencyProof`'s doc comment in
|
|
108
|
+
// checkpoint-provider.ts. Backfilled from `treeSize2` to satisfy the
|
|
109
|
+
// parameter type for calldata-sourced links, which have no per-proof
|
|
110
|
+
// signed size.
|
|
111
|
+
consistencyProofs: opts.links.map((l) => ({
|
|
112
|
+
...l.proof,
|
|
113
|
+
signedTreeSize2: l.proof.treeSize2,
|
|
114
|
+
})),
|
|
106
115
|
latestCheckpointBytes: opts.latestCheckpointBytes,
|
|
107
116
|
});
|
|
108
117
|
|