@forestrie/receipt-verify 0.1.1 → 0.4.0

package/dist/attach-transparent-statement-receipt.d.ts

@@ -0,0 +1,4 @@
+/** SCITT transparent statement unprotected receipt label (grants.md §3.2). */
+export declare const HEADER_RECEIPT = 396;
+export declare function attachReceiptAndIdtimestampToTransparentStatement(statementBytes: Uint8Array, receiptCborBytes: Uint8Array, idtimestampBe8: Uint8Array): Uint8Array;
+//# sourceMappingURL=attach-transparent-statement-receipt.d.ts.map

package/dist/attach-transparent-statement-receipt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attach-transparent-statement-receipt.d.ts","sourceRoot":"","sources":["../src/attach-transparent-statement-receipt.ts"],"names":[],"mappings":"AAWA,8EAA8E;AAC9E,eAAO,MAAM,cAAc,MAAM,CAAC;AAElC,wBAAgB,iDAAiD,CAC/D,cAAc,EAAE,UAAU,EAC1B,gBAAgB,EAAE,UAAU,EAC5B,cAAc,EAAE,UAAU,GACzB,UAAU,CAWZ"}

package/dist/attach-transparent-statement-receipt.js

@@ -0,0 +1,21 @@
+/**
+ * Attach resolve-receipt bytes and idtimestamp to SCITT transparent statement
+ * unprotected headers (Plan 0005). Deterministic receipt construction moved
+ * from @forestrie/canopy-e2e-kit (plan-2607-12 Phase 2, FOR-353).
+ *
+ * Golden vectors for receipt construction/verification are tracked by
+ * FOR-289.
+ */
+import { mergeUnprotectedIntoCoseSign1 } from "@forestrie/encoding";
+import { HEADER_IDTIMESTAMP } from "./forest-genesis-labels.js";
+/** SCITT transparent statement unprotected receipt label (grants.md §3.2). */
+export const HEADER_RECEIPT = 396;
+export function attachReceiptAndIdtimestampToTransparentStatement(statementBytes, receiptCborBytes, idtimestampBe8) {
+    if (idtimestampBe8.length !== 8) {
+        throw new Error("idtimestamp must be 8 bytes (big-endian)");
+    }
+    return mergeUnprotectedIntoCoseSign1(statementBytes, new Map([
+        [HEADER_RECEIPT, receiptCborBytes],
+        [HEADER_IDTIMESTAMP, idtimestampBe8],
+    ]));
+}

package/dist/build-receipt-offline.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Self-created SCITT receipts from local artifacts.
+ *
+ * Mirrors canopy-api resolve-receipt receipt assembly, but over local massif
+ * (`.log`) and checkpoint (`.sth`) bytes instead of R2 objects. The checkpoint
+ * signature covers only the accumulator, so the inclusion path is free to
+ * rebuild client-side: read massif nodes, build the leaf→peak path, attach it
+ * at header 396 to the checkpoint's pre-signed peak receipt. The result is
+ * verify-equivalent with an API-issued receipt (FOR-334 AC: both pass
+ * verifyGrantReceiptOffline identically; byte-equality is intentionally not
+ * claimed — encoder-level variation is known-benign, see plan-2607-15 §2).
+ *
+ * `computeAccumulatorPeak` supports the chain-anchored variant: build the path
+ * at an externally attested tree size (e.g. Univocity `logState` on Base
+ * Sepolia) and compare the computed peak with the published accumulator.
+ */
+import { type CoseSign1 } from "./parse-receipt.js";
+export type MassifNodeStore = {
+    /** 32-byte node at MMR index `i` (log data or ancestor peak stack). */
+    get(i: bigint): Uint8Array;
+    massifHeight: number;
+    massifIndex: bigint;
+    firstIndex: bigint;
+    /** Last MMR index with log data in this massif blob. */
+    lastIndex: bigint;
+};
+/**
+ * Open a v2 massif blob for MMR node reads. Nodes below `firstIndex` resolve
+ * through the ancestor peak stack; nodes above `lastIndex` are not present in
+ * this blob and throw.
+ */
+export declare function openMassifNodeStore(massifBytes: Uint8Array): MassifNodeStore;
+export type ParsedCheckpoint = {
+    coseSign1: CoseSign1;
+    unprotected: Map<number, unknown>;
+    /** Pre-signed peak receipts (label -65931), or null when absent. */
+    peakReceipts: unknown[] | null;
+    /** Sealed tree size (tree-size-2 of the embedded consistency proof). */
+    mmrSize: bigint | null;
+    delegationCert: Uint8Array | null;
+};
+/** Parse a format-v3 checkpoint (`.sth`) COSE Sign1. */
+export declare function parseCheckpoint(checkpointBytes: Uint8Array): ParsedCheckpoint;
+export type BuildReceiptOfflineInput = {
+    massifBytes: Uint8Array;
+    checkpointBytes: Uint8Array;
+    mmrIndex: bigint;
+};
+/**
+ * Assemble a receipt for the entry at `mmrIndex` from a local massif blob and
+ * its checkpoint. Pure over bytes; no network, no signing key — the signature
+ * is the checkpoint's pre-signed peak receipt. Throws with a specific reason
+ * on any failure.
+ */
+export declare function buildReceiptOffline(input: BuildReceiptOfflineInput): Uint8Array;
+export type ComputedAccumulatorPeak = {
+    /** Root computed from the massif's leaf value and rebuilt path. */
+    peak: Uint8Array;
+    /** Position of that peak in the accumulator, left to right. */
+    peakIndex: number;
+    proof: Uint8Array[];
+    leafValue: Uint8Array;
+};
+/**
+ * Chain-anchored variant: rebuild the inclusion path for `mmrIndex` at an
+ * externally attested tree size and compute the accumulator peak it commits
+ * to. Compare `peak` with `accumulator[peakIndex]` published by the Univocity
+ * contract (`logState`). Requires the local massif to hold nodes up to
+ * `mmrSize`.
+ */
+export declare function computeAccumulatorPeak(opts: {
+    massifBytes: Uint8Array;
+    mmrIndex: bigint;
+    mmrSize: bigint;
+}): Promise<ComputedAccumulatorPeak>;
+/** MMR indices of the peaks of the tree ending at `mmrIndex` (inclusive). */
+export declare function peakMMRIndexes(mmrIndex: bigint): bigint[];
+//# sourceMappingURL=build-receipt-offline.d.ts.map

package/dist/build-receipt-offline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-receipt-offline.d.ts","sourceRoot":"","sources":["../src/build-receipt-offline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AASH,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,oBAAoB,CAAC;AAW5B,MAAM,MAAM,eAAe,GAAG;IAC5B,uEAAuE;IACvE,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,UAAU,GAAG,eAAe,CA8C5E;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,SAAS,CAAC;IACrB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,oEAAoE;IACpE,YAAY,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC/B,wEAAwE;IACxE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,cAAc,EAAE,UAAU,GAAG,IAAI,CAAC;CACnC,CAAC;AAEF,wDAAwD;AACxD,wBAAgB,eAAe,CAAC,eAAe,EAAE,UAAU,GAAG,gBAAgB,CAqB7E;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,WAAW,EAAE,UAAU,CAAC;IACxB,eAAe,EAAE,UAAU,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,wBAAwB,GAC9B,UAAU,CA2EZ;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,mEAAmE;IACnE,IAAI,EAAE,UAAU,CAAC;IACjB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,SAAS,EAAE,UAAU,CAAC;CACvB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,WAAW,EAAE,UAAU,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAwBnC;AA2ID,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAczD"}

package/dist/build-receipt-offline.js

@@ -0,0 +1,353 @@
+/**
+ * Self-created SCITT receipts from local artifacts.
+ *
+ * Mirrors canopy-api resolve-receipt receipt assembly, but over local massif
+ * (`.log`) and checkpoint (`.sth`) bytes instead of R2 objects. The checkpoint
+ * signature covers only the accumulator, so the inclusion path is free to
+ * rebuild client-side: read massif nodes, build the leaf→peak path, attach it
+ * at header 396 to the checkpoint's pre-signed peak receipt. The result is
+ * verify-equivalent with an API-issued receipt (FOR-334 AC: both pass
+ * verifyGrantReceiptOffline identically; byte-equality is intentionally not
+ * claimed — encoder-level variation is known-benign, see plan-2607-15 §2).
+ *
+ * `computeAccumulatorPeak` supports the chain-anchored variant: build the path
+ * at an externally attested tree size (e.g. Univocity `logState` on Base
+ * Sepolia) and compare the computed peak with the published accumulator.
+ */
+import { decode as decodeCbor, encode as encodeCbor } from "cbor-x";
+import { calculateRoot, Massif, peakStackEnd, } from "@forestrie/merklelog";
+import { requireCoseSign1, toHeaderMap, unwrapCoseSign1Tag, } from "./parse-receipt.js";
+import { SubtleHasher } from "./subtle-hasher.js";
+const VDS_COSE_RECEIPT_PROOFS_TAG = 396;
+const SEAL_PEAK_RECEIPTS_LABEL = -65931;
+const DELEGATION_CERT_LABEL = 1000;
+const VDP_CONSISTENCY_PROOF_KEY = -2;
+const VALUE_BYTES = 32n;
+const MAX_MMR_HEIGHT = 64n;
+/**
+ * Open a v2 massif blob for MMR node reads. Nodes below `firstIndex` resolve
+ * through the ancestor peak stack; nodes above `lastIndex` are not present in
+ * this blob and throw.
+ */
+export function openMassifNodeStore(massifBytes) {
+    const massif = new Massif(massifBytes);
+    const start = massif.getStart();
+    const massifHeight = start.massifHeight;
+    if (!Number.isInteger(massifHeight) ||
+        massifHeight < 1 ||
+        massifHeight > 64) {
+        throw new Error(`massif header has invalid height ${massifHeight}`);
+    }
+    const massifIndex = BigInt(start.massifIndex);
+    const firstIndex = start.firstIndex;
+    const logStart = peakStackEnd(massifHeight);
+    const peakStackStart = logStart - MAX_MMR_HEIGHT * VALUE_BYTES;
+    const blobLen = BigInt(massifBytes.byteLength);
+    if (blobLen < logStart) {
+        throw new Error("massif blob too short for v2 layout");
+    }
+    const logNodeCount = (blobLen - logStart) / VALUE_BYTES;
+    const lastIndex = firstIndex + logNodeCount - 1n;
+    const stackMap = peakStackMapForMassif(massifHeight, firstIndex);
+    const get = (i) => {
+        if (i >= firstIndex) {
+            if (i > lastIndex) {
+                throw new Error(`mmr index ${i.toString(10)} is beyond this massif's log data ` +
+                    `(last ${lastIndex.toString(10)}); local content does not cover ` +
+                    `the requested tree size`);
+            }
+            const off = logStart + (i - firstIndex) * VALUE_BYTES;
+            return slice32(massifBytes, off, "log-data");
+        }
+        const peakIdx = stackMap.get(i);
+        if (peakIdx === undefined) {
+            throw new Error(`missing ancestor peak for mmr index ${i.toString(10)}`);
+        }
+        const off = peakStackStart + BigInt(peakIdx) * VALUE_BYTES;
+        return slice32(massifBytes, off, "peak-stack");
+    };
+    return { get, massifHeight, massifIndex, firstIndex, lastIndex };
+}
+/** Parse a format-v3 checkpoint (`.sth`) COSE Sign1. */
+export function parseCheckpoint(checkpointBytes) {
+    const decoded = decodeCbor(checkpointBytes);
+    const coseSign1 = requireCoseSign1(unwrapCoseSign1Tag(decoded));
+    const unprotected = toHeaderMap(coseSign1[1]);
+    const peakReceiptsRaw = unprotected.get(SEAL_PEAK_RECEIPTS_LABEL);
+    const peakReceipts = Array.isArray(peakReceiptsRaw) ? peakReceiptsRaw : null;
+    const delegationCertRaw = unprotected.get(DELEGATION_CERT_LABEL);
+    const delegationCert = delegationCertRaw instanceof Uint8Array && delegationCertRaw.length > 0
+        ? delegationCertRaw
+        : null;
+    return {
+        coseSign1,
+        unprotected,
+        peakReceipts,
+        mmrSize: sealedSizeFromCheckpoint(unprotected),
+        delegationCert,
+    };
+}
+/**
+ * Assemble a receipt for the entry at `mmrIndex` from a local massif blob and
+ * its checkpoint. Pure over bytes; no network, no signing key — the signature
+ * is the checkpoint's pre-signed peak receipt. Throws with a specific reason
+ * on any failure.
+ */
+export function buildReceiptOffline(input) {
+    const { mmrIndex } = input;
+    if (mmrIndex < 0n) {
+        throw new Error("mmrIndex must be non-negative");
+    }
+    const checkpoint = parseCheckpoint(input.checkpointBytes);
+    if (!checkpoint.peakReceipts) {
+        throw new Error("checkpoint carries no pre-signed peak receipts (label -65931)");
+    }
+    if (checkpoint.mmrSize === null || checkpoint.mmrSize <= 0n) {
+        throw new Error("checkpoint carries no consistency proof (cannot determine sealed size)");
+    }
+    const mmrSize = checkpoint.mmrSize;
+    const mmrLastIndex = mmrSize - 1n;
+    if (mmrIndex > mmrLastIndex) {
+        throw new Error(`checkpoint does not cover entry: mmrIndex ${mmrIndex.toString(10)} ` +
+            `>= sealed size ${mmrSize.toString(10)}`);
+    }
+    const store = openMassifNodeStore(input.massifBytes);
+    const expectedMassifIndex = massifIndexFromMMRIndex(store.massifHeight, mmrIndex);
+    if (expectedMassifIndex !== store.massifIndex) {
+        throw new Error(`entry at mmrIndex ${mmrIndex.toString(10)} lives in massif ` +
+            `${expectedMassifIndex.toString(10)}, but this blob is massif ` +
+            `${store.massifIndex.toString(10)}`);
+    }
+    const proof = inclusionProof(store.get, mmrLastIndex, mmrIndex);
+    const peakIdx = peakIndexForLeafProof(mmrSize, proof.length);
+    const receiptBytes = checkpoint.peakReceipts[peakIdx];
+    if (!(receiptBytes instanceof Uint8Array)) {
+        throw new Error(`checkpoint peak receipt slot ${peakIdx} is missing or not bstr`);
+    }
+    const receiptSign1 = requireCoseSign1(unwrapCoseSign1Tag(decodeCbor(receiptBytes)));
+    const receiptUnprotected = toHeaderMap(receiptSign1[1]);
+    if (checkpoint.delegationCert) {
+        receiptUnprotected.set(DELEGATION_CERT_LABEL, checkpoint.delegationCert);
+    }
+    const inclusionProofEntry = new Map([
+        [1, mmrIndex],
+        [2, proof],
+    ]);
+    const verifiableProofs = new Map([
+        [-1, [inclusionProofEntry]],
+    ]);
+    receiptUnprotected.set(VDS_COSE_RECEIPT_PROOFS_TAG, verifiableProofs);
+    // Peak receipts are signed with detached payload; emit nil so verify uses
+    // the peak derived from the inclusion proof.
+    const assembled = [
+        receiptSign1[0],
+        receiptUnprotected,
+        null,
+        receiptSign1[3],
+    ];
+    return cborBytes(assembled);
+}
+/**
+ * Chain-anchored variant: rebuild the inclusion path for `mmrIndex` at an
+ * externally attested tree size and compute the accumulator peak it commits
+ * to. Compare `peak` with `accumulator[peakIndex]` published by the Univocity
+ * contract (`logState`). Requires the local massif to hold nodes up to
+ * `mmrSize`.
+ */
+export async function computeAccumulatorPeak(opts) {
+    const { mmrIndex, mmrSize } = opts;
+    if (mmrSize <= 0n || mmrIndex >= mmrSize) {
+        throw new Error(`mmrIndex ${mmrIndex.toString(10)} is not covered by tree size ` +
+            `${mmrSize.toString(10)} (entry not anchored yet?)`);
+    }
+    const store = openMassifNodeStore(opts.massifBytes);
+    const leafValue = store.get(mmrIndex);
+    const path = inclusionProof(store.get, mmrSize - 1n, mmrIndex);
+    const proof = { path, mmrIndex };
+    const peak = await calculateRoot(new SubtleHasher(), leafValue, proof, mmrIndex);
+    return {
+        peak,
+        peakIndex: peakIndexForLeafProof(mmrSize, path.length),
+        proof: path,
+        leafValue,
+    };
+}
+// --- helpers ---
+function cborBytes(value) {
+    const encoded = encodeCbor(value);
+    return encoded instanceof Uint8Array
+        ? encoded
+        : new Uint8Array(encoded);
+}
+function slice32(buf, offset, label) {
+    if (offset < 0n || offset + 32n > BigInt(buf.byteLength)) {
+        throw new Error(`out of range read for ${label}: off=${offset.toString(10)}`);
+    }
+    const start = Number(offset);
+    return buf.slice(start, start + 32);
+}
+/**
+ * Sealed mmr size from a format-v3 checkpoint: tree-size-2 of the consistency
+ * proof (`bstr .cbor [tree-size-1, tree-size-2, paths, right-peaks]`) under
+ * the verifiable-proofs unprotected header (label 396, key -2).
+ */
+function sealedSizeFromCheckpoint(unprotected) {
+    const vdpRaw = unprotected.get(VDS_COSE_RECEIPT_PROOFS_TAG);
+    if (vdpRaw === undefined || vdpRaw === null)
+        return null;
+    const vdp = toHeaderMap(vdpRaw);
+    const proofBstr = vdp.get(VDP_CONSISTENCY_PROOF_KEY);
+    if (!(proofBstr instanceof Uint8Array))
+        return null;
+    const proof = decodeCbor(proofBstr);
+    if (!Array.isArray(proof) || proof.length < 2)
+        return null;
+    const treeSize2 = proof[1];
+    if (typeof treeSize2 === "bigint")
+        return treeSize2;
+    if (typeof treeSize2 === "number" && Number.isSafeInteger(treeSize2)) {
+        return BigInt(treeSize2);
+    }
+    return null;
+}
+// --- MMR index math (ported from go-merklelog/mmr, mirrors resolve-receipt) ---
+function bitLength(num) {
+    if (num === 0n)
+        return 0;
+    return num.toString(2).length;
+}
+function allOnes(num) {
+    return num > 0n && (num & (num + 1n)) === 0n;
+}
+function jumpLeftPerfect(pos) {
+    const bl = bitLength(pos);
+    if (bl === 0)
+        return pos;
+    const msb = 1n << BigInt(bl - 1);
+    return pos - (msb - 1n);
+}
+function posHeight(pos) {
+    let current = pos;
+    while (!allOnes(current)) {
+        current = jumpLeftPerfect(current);
+    }
+    return bitLength(current) - 1;
+}
+function indexHeight(i) {
+    return posHeight(i + 1n);
+}
+function inclusionProof(getNode, mmrLastIndex, i) {
+    if (i > mmrLastIndex) {
+        throw new Error("index out of range");
+    }
+    let g = BigInt(indexHeight(i));
+    const proof = [];
+    while (true) {
+        const siblingOffset = 2n << g;
+        let iSibling;
+        if (BigInt(indexHeight(i + 1n)) > g) {
+            iSibling = i - siblingOffset + 1n;
+            i += 1n;
+        }
+        else {
+            iSibling = i + siblingOffset - 1n;
+            i += siblingOffset;
+        }
+        if (iSibling > mmrLastIndex) {
+            return proof;
+        }
+        proof.push(getNode(iSibling));
+        g += 1n;
+    }
+}
+function peaksBitmap(mmrSize) {
+    if (mmrSize === 0n)
+        return 0n;
+    let pos = mmrSize;
+    let peakSize = (1n << BigInt(bitLength(mmrSize))) - 1n;
+    let peakMap = 0n;
+    while (peakSize > 0n) {
+        peakMap <<= 1n;
+        if (pos >= peakSize) {
+            pos -= peakSize;
+            peakMap |= 1n;
+        }
+        peakSize >>= 1n;
+    }
+    return peakMap;
+}
+function popcount64(x) {
+    let count = 0;
+    let v = x;
+    while (v > 0n) {
+        if ((v & 1n) === 1n)
+            count += 1;
+        v >>= 1n;
+    }
+    return count;
+}
+function peakIndexForLeafProof(mmrSize, proofLen) {
+    const leafCount = peaksBitmap(mmrSize);
+    const peaksMask = (1n << BigInt(proofLen + 1)) - 1n;
+    return popcount64(leafCount) - popcount64(leafCount & peaksMask);
+}
+function topPeak(i) {
+    const bl = bitLength(i + 2n);
+    return (1n << BigInt(bl - 1)) - 2n;
+}
+/** MMR indices of the peaks of the tree ending at `mmrIndex` (inclusive). */
+export function peakMMRIndexes(mmrIndex) {
+    let mmrSize = mmrIndex + 1n;
+    if (posHeight(mmrSize + 1n) > posHeight(mmrSize)) {
+        return [];
+    }
+    let peak = 0n;
+    const out = [];
+    while (mmrSize !== 0n) {
+        const peakSize = topPeak(mmrSize - 1n) + 1n;
+        peak = peak + peakSize;
+        out.push(peak - 1n);
+        mmrSize -= peakSize;
+    }
+    return out;
+}
+function peakStackMapForMassif(massifHeight, firstIndex) {
+    const map = new Map();
+    const iPeaks = peakMMRIndexes(firstIndex);
+    for (let i = 0; i < iPeaks.length; i++) {
+        const ip = iPeaks[i];
+        if (indexHeight(ip) < massifHeight - 1) {
+            continue;
+        }
+        map.set(ip, i);
+    }
+    return map;
+}
+function mmrIndexFromLeafIndex(leafIndex) {
+    let sum = 0n;
+    let current = leafIndex;
+    while (current > 0n) {
+        const h = BigInt(bitLength(current));
+        sum += (1n << h) - 1n;
+        const half = 1n << (h - 1n);
+        current -= half;
+    }
+    return sum;
+}
+function firstMMRSize(mmrIndex) {
+    let i = mmrIndex;
+    let h0 = indexHeight(i);
+    let h1 = indexHeight(i + 1n);
+    while (h0 < h1) {
+        i += 1n;
+        h0 = h1;
+        h1 = indexHeight(i + 1n);
+    }
+    return i + 1n;
+}
+function massifIndexFromMMRIndex(massifHeight, mmrIndex) {
+    const size = firstMMRSize(mmrIndex);
+    const leafIndex = peaksBitmap(size) - 1n;
+    const massifMaxLeaves = 1n << BigInt(massifHeight - 1);
+    return leafIndex / massifMaxLeaves;
+}

package/dist/decode-forestrie-grant-cose.d.ts

@@ -1,4 +1,4 @@
-import type { Grant } from "./grant.js";
+import type { Grant } from "@forestrie/encoding";
 /**
  * Decode Forestrie-Grant COSE Sign1 (Custodian transparent statement profile).
  */

package/dist/decode-forestrie-grant-cose.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decode-forestrie-grant-cose.d.ts","sourceRoot":"","sources":["../src/decode-forestrie-grant-cose.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAmCxC;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,UAAU,GAAG;IAC3D,KAAK,EAAE,KAAK,CAAC;IACb,cAAc,EAAE,UAAU,CAAC;CAC5B,CAmCA"}
+{"version":3,"file":"decode-forestrie-grant-cose.d.ts","sourceRoot":"","sources":["../src/decode-forestrie-grant-cose.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAmCjD;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,UAAU,GAAG;IAC3D,KAAK,EAAE,KAAK,CAAC;IACb,cAAc,EAAE,UAAU,CAAC;CAC5B,CAmCA"}

package/dist/entry-id.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Decode permanent SCRAPI entryId (32 hex chars = idtimestamp_be8 ||
+ * mmrIndex_be8). Deterministic receipt helpers moved from
+ * @forestrie/canopy-e2e-kit (plan-2607-12 Phase 2, FOR-353).
+ */
+export interface DecodedEntryId {
+    idtimestamp: bigint;
+    mmrIndex: bigint;
+}
+export declare function decodeEntryIdHex(entryIdHex: string): DecodedEntryId;
+/** First half of entryId (permanent URL): idtimestamp big-endian 8 bytes for header -65537. */
+export declare function entryIdHexToIdtimestampBe8(entryIdHex: string): Uint8Array;
+//# sourceMappingURL=entry-id.d.ts.map

package/dist/entry-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-id.d.ts","sourceRoot":"","sources":["../src/entry-id.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAkBD,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,cAAc,CAUnE;AAED,+FAA+F;AAC/F,wBAAgB,0BAA0B,CAAC,UAAU,EAAE,MAAM,GAAG,UAAU,CAKzE"}

package/dist/entry-id.js

@@ -0,0 +1,37 @@
+/**
+ * Decode permanent SCRAPI entryId (32 hex chars = idtimestamp_be8 ||
+ * mmrIndex_be8). Deterministic receipt helpers moved from
+ * @forestrie/canopy-e2e-kit (plan-2607-12 Phase 2, FOR-353).
+ */
+function readU64BE(buf, offset) {
+    let v = 0n;
+    for (let i = 0; i < 8; i++) {
+        v = (v << 8n) | BigInt(buf[offset + i]);
+    }
+    return v;
+}
+function hexToBytes(hex) {
+    const out = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < out.length; i++) {
+        out[i] = Number.parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    }
+    return out;
+}
+export function decodeEntryIdHex(entryIdHex) {
+    if (!/^[0-9a-f]{32}$/i.test(entryIdHex)) {
+        throw new Error(`entryId must be 32 lowercase hex chars: ${entryIdHex}`);
+    }
+    const lower = entryIdHex.toLowerCase();
+    const bytes = hexToBytes(lower);
+    return {
+        idtimestamp: readU64BE(bytes, 0),
+        mmrIndex: readU64BE(bytes, 8),
+    };
+}
+/** First half of entryId (permanent URL): idtimestamp big-endian 8 bytes for header -65537. */
+export function entryIdHexToIdtimestampBe8(entryIdHex) {
+    const { idtimestamp } = decodeEntryIdHex(entryIdHex);
+    const out = new Uint8Array(8);
+    new DataView(out.buffer).setBigUint64(0, idtimestamp, false);
+    return out;
+}

package/dist/grant-codec.d.ts

@@ -1,4 +1,4 @@
-import type { Grant } from "./grant.js";
+import type { Grant } from "@forestrie/encoding";
 export declare function decodeGrantPayload(bytes: Uint8Array): Grant;
 export declare function decodeGrantResponse(bytes: Uint8Array): {
     grant: Grant;

package/dist/grant-codec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-codec.d.ts","sourceRoot":"","sources":["../src/grant-codec.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAuDxC,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,KAAK,CAO3D;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,UAAU,GAAG;IACtD,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE,UAAU,CAAC;CACzB,CAsBA;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,KAAK,GAAG,UAAU,CAa3D"}
+{"version":3,"file":"grant-codec.d.ts","sourceRoot":"","sources":["../src/grant-codec.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAuDjD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,KAAK,CAO3D;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,UAAU,GAAG;IACtD,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE,UAAU,CAAC;CACzB,CAsBA;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,KAAK,GAAG,UAAU,CAa3D"}

package/dist/grant-codec.js

@@ -1,5 +1,5 @@
 import { decode as decodeCbor, encode as encodeCbor } from "cbor-x";
-import { grantDataToBytes } from "./grant-data.js";
+import { grantDataToBytes } from "@forestrie/encoding";
 import { fromPaddedWire32, toPaddedWire32 } from "./uuid-bytes.js";
 const CBOR_KEY_IDTIMESTAMP = 0;
 const CBOR_KEY_LOG_ID = 1;

package/dist/grant-commitment.d.ts

@@ -1,3 +1,3 @@
-import type { Grant } from "./grant.js";
+import type { Grant } from "@forestrie/encoding";
 export declare function grantCommitmentHashFromGrant(grant: Grant): Promise<Uint8Array>;
 //# sourceMappingURL=grant-commitment.d.ts.map

package/dist/grant-commitment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-commitment.d.ts","sourceRoot":"","sources":["../src/grant-commitment.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAwDxC,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,UAAU,CAAC,CAIrB"}
+{"version":3,"file":"grant-commitment.d.ts","sourceRoot":"","sources":["../src/grant-commitment.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAwDjD,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,UAAU,CAAC,CAIrB"}

package/dist/grant-commitment.js

@@ -1,4 +1,4 @@
-import { grantDataToBytes } from "./grant-data.js";
+import { grantDataToBytes } from "@forestrie/encoding";
 import { toPaddedWire32 } from "./uuid-bytes.js";
 const GRANT_FLAGS_32_BYTES = 32;
 const U64_BYTES = 8;

package/dist/index.d.ts

@@ -1,9 +1,16 @@
 export type { ReceiptVerifyResult, ReceiptVerifyStage, } from "./receipt-verify-result.js";
-export type { Grant } from "./grant.js";
+/** Canonical grant wire type — owned by @forestrie/encoding (FOR-353, ADR-0048). */
+export type { Grant } from "@forestrie/encoding";
 export type { VerifyGrantReceiptOfflineInput } from "./verify-grant-receipt-offline.js";
 export { parseReceipt } from "./parse-receipt.js";
+export type { BuildReceiptOfflineInput, ComputedAccumulatorPeak, MassifNodeStore, ParsedCheckpoint, } from "./build-receipt-offline.js";
+export { buildReceiptOffline, computeAccumulatorPeak, openMassifNodeStore, parseCheckpoint, peakMMRIndexes, } from "./build-receipt-offline.js";
 export { decodeTrustRootFromGenesis } from "./decode-trust-root-from-genesis.js";
 export { verifyGrantReceiptOffline } from "./verify-grant-receipt-offline.js";
 export { decodeForestrieGrantCose } from "./decode-forestrie-grant-cose.js";
 export { decodeGrantPayload, decodeGrantResponse } from "./grant-codec.js";
+/** Deterministic receipt construction (plan-2607-12 Phase 2, FOR-353). */
+export { HEADER_RECEIPT, attachReceiptAndIdtimestampToTransparentStatement, } from "./attach-transparent-statement-receipt.js";
+export { decodeEntryIdHex, entryIdHexToIdtimestampBe8 } from "./entry-id.js";
+export type { DecodedEntryId } from "./entry-id.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACxC,YAAY,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,oFAAoF;AACpF,YAAY,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,YAAY,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EACV,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,EACf,cAAc,GACf,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE3E,0EAA0E;AAC1E,OAAO,EACL,cAAc,EACd,iDAAiD,GAClD,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC7E,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -1,5 +1,9 @@
 export { parseReceipt } from "./parse-receipt.js";
+export { buildReceiptOffline, computeAccumulatorPeak, openMassifNodeStore, parseCheckpoint, peakMMRIndexes, } from "./build-receipt-offline.js";
 export { decodeTrustRootFromGenesis } from "./decode-trust-root-from-genesis.js";
 export { verifyGrantReceiptOffline } from "./verify-grant-receipt-offline.js";
 export { decodeForestrieGrantCose } from "./decode-forestrie-grant-cose.js";
 export { decodeGrantPayload, decodeGrantResponse } from "./grant-codec.js";
+/** Deterministic receipt construction (plan-2607-12 Phase 2, FOR-353). */
+export { HEADER_RECEIPT, attachReceiptAndIdtimestampToTransparentStatement, } from "./attach-transparent-statement-receipt.js";
+export { decodeEntryIdHex, entryIdHexToIdtimestampBe8 } from "./entry-id.js";

package/dist/parse-receipt.d.ts

@@ -1,15 +1,17 @@
 import type { Proof } from "@forestrie/merklelog";
-type CoseSign1 = [
+export type CoseSign1 = [
     protectedHeader: Uint8Array,
     unprotectedHeader: Map<number, unknown> | Record<string, unknown>,
     payload: Uint8Array | null,
     signature: Uint8Array
 ];
+export declare function unwrapCoseSign1Tag(value: unknown): unknown;
+export declare function requireCoseSign1(value: unknown): CoseSign1;
+export declare function toHeaderMap(value: Map<number, unknown> | Record<string, unknown>): Map<number, unknown>;
 export declare function parseReceipt(receiptBytes: Uint8Array): {
     explicitPeak: Uint8Array | null;
     proof: Proof;
     receiptCbor: Uint8Array;
     coseSign1: CoseSign1;
 };
-export {};
 //# sourceMappingURL=parse-receipt.d.ts.map

package/dist/parse-receipt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse-receipt.d.ts","sourceRoot":"","sources":["../src/parse-receipt.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAIlD,KAAK,SAAS,GAAG;IACf,eAAe,EAAE,UAAU;IAC3B,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACjE,OAAO,EAAE,UAAU,GAAG,IAAI;IAC1B,SAAS,EAAE,UAAU;CACtB,CAAC;AAgDF,wBAAgB,YAAY,CAAC,YAAY,EAAE,UAAU,GAAG;IACtD,YAAY,EAAE,UAAU,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE,UAAU,CAAC;IACxB,SAAS,EAAE,SAAS,CAAC;CACtB,CAwDA"}
+{"version":3,"file":"parse-receipt.d.ts","sourceRoot":"","sources":["../src/parse-receipt.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAIlD,MAAM,MAAM,SAAS,GAAG;IACtB,eAAe,EAAE,UAAU;IAC3B,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACjE,OAAO,EAAE,UAAU,GAAG,IAAI;IAC1B,SAAS,EAAE,UAAU;CACtB,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAW1D;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,CAiB1D;AAED,wBAAgB,WAAW,CACzB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACpD,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAUtB;AAED,wBAAgB,YAAY,CAAC,YAAY,EAAE,UAAU,GAAG;IACtD,YAAY,EAAE,UAAU,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE,UAAU,CAAC;IACxB,SAAS,EAAE,SAAS,CAAC;CACtB,CAwDA"}