@forestrie/receipt-verify 0.10.1 → 0.12.0

package/dist/index.d.ts

@@ -28,6 +28,13 @@ export { checkDelegationConstraints, idtimestampToUnixSeconds, resolveDelegatedV
 export type { DelegatedResolution, DelegationConstraints, } from "./resolve-delegated-verify-key.js";
 /** Import a raw 64-byte x||y P-256 public key as an ES256 verify key. */
 export { importEs256PublicKeyFromGrantDataXy64 } from "./decode-trust-root-cbor.js";
+/**
+ * Passkey session-key endorsement (ADR-0064): build, assemble, and verify
+ * the one-gesture artifact chaining a passkey log root to the plain-ES256
+ * per-turn session key — the offline rung root → endorsement → leaves.
+ */
+export { assembleSessionKeyEndorsement, buildSessionKeyEndorsementTbs, SESSION_KEY_ENDORSEMENT_CONTENT_TYPE, SESSION_KEY_PAYLOAD_KEY, verifySessionKeyEndorsement, } from "./session-key-endorsement.js";
+export type { SessionKeyEndorsementTbs, SessionKeyEndorsementVerifyResult, VerifySessionKeyEndorsementOptions, } from "./session-key-endorsement.js";
 export { decodeForestrieGrantCose } from "./decode-forestrie-grant-cose.js";
 export { decodeGrantPayload, decodeGrantResponse } from "./grant-codec.js";
 /** Deterministic receipt construction (plan-2607-12 Phase 2, FOR-353). */

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,oFAAoF;AACpF,YAAY,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,YAAY,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AACxF,YAAY,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EACV,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC,+EAA+E;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EACV,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE;;;;GAIG;AACH,OAAO,EACL,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,sCAAsC,EACtC,iCAAiC,GAClC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,mCAAmC,CAAC;AAC3C,yEAAyE;AACzE,OAAO,EAAE,qCAAqC,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE3E,0EAA0E;AAC1E,OAAO,EACL,cAAc,EACd,iDAAiD,GAClD,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC7E,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,6EAA6E;AAC7E,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,oEAAoE;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,8EAA8E;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,4BAA4B,EAC5B,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,GAChC,MAAM,uBAAuB,CAAC;AAC/B;;;;;GAKG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD;;;;;;GAMG;AACH,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,2CAA2C,EAC3C,KAAK,gBAAgB,GACtB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,oFAAoF;AACpF,YAAY,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,YAAY,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AACxF,YAAY,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EACV,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC,+EAA+E;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EACV,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE;;;;GAIG;AACH,OAAO,EACL,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,sCAAsC,EACtC,iCAAiC,GAClC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,mCAAmC,CAAC;AAC3C,yEAAyE;AACzE,OAAO,EAAE,qCAAqC,EAAE,MAAM,6BAA6B,CAAC;AACpF;;;;GAIG;AACH,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAC7B,oCAAoC,EACpC,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,wBAAwB,EACxB,iCAAiC,EACjC,kCAAkC,GACnC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE3E,0EAA0E;AAC1E,OAAO,EACL,cAAc,EACd,iDAAiD,GAClD,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC7E,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,6EAA6E;AAC7E,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,oEAAoE;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,8EAA8E;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,4BAA4B,EAC5B,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,GAChC,MAAM,uBAAuB,CAAC;AAC/B;;;;;GAKG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD;;;;;;GAMG;AACH,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,2CAA2C,EAC3C,KAAK,gBAAgB,GACtB,MAAM,wBAAwB,CAAC"}

package/dist/index.js

@@ -19,6 +19,12 @@ export { verifyGrantReceiptOfflineWithKeys, verifyReceiptOfflineWithKeys, } from
 export { checkDelegationConstraints, idtimestampToUnixSeconds, resolveDelegatedVerifyKey, } from "./resolve-delegated-verify-key.js";
 /** Import a raw 64-byte x||y P-256 public key as an ES256 verify key. */
 export { importEs256PublicKeyFromGrantDataXy64 } from "./decode-trust-root-cbor.js";
+/**
+ * Passkey session-key endorsement (ADR-0064): build, assemble, and verify
+ * the one-gesture artifact chaining a passkey log root to the plain-ES256
+ * per-turn session key — the offline rung root → endorsement → leaves.
+ */
+export { assembleSessionKeyEndorsement, buildSessionKeyEndorsementTbs, SESSION_KEY_ENDORSEMENT_CONTENT_TYPE, SESSION_KEY_PAYLOAD_KEY, verifySessionKeyEndorsement, } from "./session-key-endorsement.js";
 export { decodeForestrieGrantCose } from "./decode-forestrie-grant-cose.js";
 export { decodeGrantPayload, decodeGrantResponse } from "./grant-codec.js";
 /** Deterministic receipt construction (plan-2607-12 Phase 2, FOR-353). */

package/dist/resolve-delegated-verify-key.d.ts

@@ -6,9 +6,12 @@
  * trust root and returns the delegated public key as an additional verify
  * candidate — the offline port of canopy-api's `resolveReceiptVerifyKey`.
  *
- * ES256 (P-256) only: the offline verifier is ES256-only (genesis alg), and
- * sealer delegate keys are always secp256r1. KS256-rooted delegation is a
- * server-only concern.
+ * P-256 roots only: the genesis alg is ES256 and sealer delegate keys are
+ * always secp256r1; KS256-rooted delegation is a server-only concern. A
+ * passkey (WebAuthn) root signs the certificate with alg -65800 and the
+ * ADR-0063 unprotected-header envelope — `verifyCoseSign1WithParsedKey`
+ * verifies that envelope against the same P-256 root keys, so the chain walk
+ * here is alg-agnostic (plan-2608-13 1.4).
  *
  * Trust anchors (FOR-297 trust ladder): `rootKeys` need not be genesis-derived
  * — a caller-known log OWNER key works identically (see

package/dist/resolve-delegated-verify-key.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-delegated-verify-key.d.ts","sourceRoot":"","sources":["../src/resolve-delegated-verify-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAqCH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAKpE;AAED;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,YAAY,EAAE,SAAS,CAAC;IACxB,WAAW,EAAE,qBAAqB,GAAG,IAAI,CAAC;CAC3C,GACD;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAsGvB;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,qBAAqB,EAClC,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,MAAM,GACtB;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAS9C;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,UAAU,EACvB,QAAQ,EAAE,SAAS,EAAE,GACpB,OAAO,CAAC,mBAAmB,CAAC,CAgC9B"}
+{"version":3,"file":"resolve-delegated-verify-key.d.ts","sourceRoot":"","sources":["../src/resolve-delegated-verify-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAqCH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAKpE;AAED;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,YAAY,EAAE,SAAS,CAAC;IACxB,WAAW,EAAE,qBAAqB,GAAG,IAAI,CAAC;CAC3C,GACD;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAsGvB;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,qBAAqB,EAClC,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,MAAM,GACtB;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAS9C;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,UAAU,EACvB,QAAQ,EAAE,SAAS,EAAE,GACpB,OAAO,CAAC,mBAAmB,CAAC,CAgC9B"}

package/dist/resolve-delegated-verify-key.js

@@ -6,9 +6,12 @@
  * trust root and returns the delegated public key as an additional verify
  * candidate — the offline port of canopy-api's `resolveReceiptVerifyKey`.
  *
- * ES256 (P-256) only: the offline verifier is ES256-only (genesis alg), and
- * sealer delegate keys are always secp256r1. KS256-rooted delegation is a
- * server-only concern.
+ * P-256 roots only: the genesis alg is ES256 and sealer delegate keys are
+ * always secp256r1; KS256-rooted delegation is a server-only concern. A
+ * passkey (WebAuthn) root signs the certificate with alg -65800 and the
+ * ADR-0063 unprotected-header envelope — `verifyCoseSign1WithParsedKey`
+ * verifies that envelope against the same P-256 root keys, so the chain walk
+ * here is alg-agnostic (plan-2608-13 1.4).
  *
  * Trust anchors (FOR-297 trust ladder): `rootKeys` need not be genesis-derived
  * — a caller-known log OWNER key works identically (see

package/dist/session-key-endorsement.d.ts

@@ -0,0 +1,103 @@
+/**
+ * Passkey session-key endorsement (devdocs ADR-0064, plan-2608-13 Q5).
+ *
+ * A passkey log root signs ceremonies only; the per-turn user-envelope
+ * signer is a separate session key, endorsed ONCE by the root via a COSE
+ * Sign1 in the ADR-0063 WebAuthn envelope. This module owns both sides of
+ * that artifact's byte-exact shape:
+ *
+ * - build/assemble: the client constructs the TBS, hashes its Sig_structure
+ *   into the WebAuthn challenge, and attaches the assertion + signature;
+ * - verify: given the passkey root as trust anchor, validate the artifact
+ *   (typed, challenge-bound, fail-closed) and yield the session public key.
+ *
+ * The offline trust chain is then:
+ *   grant (root = passkey x‖y) → endorsement → session key → plain-ES256
+ *   per-turn leaves — zero per-leaf format change (ADR-0064 §4).
+ *
+ * Domain separation (ADR-0064 §2): the protected header carries the content
+ * type below, and the payload is EXACTLY `{"sessionKey": bstr .size 64}`.
+ * Anything else is a verification failure, never a fallback.
+ */
+import { type ParsedVerifyKey } from "@forestrie/encoding";
+/**
+ * Protected-header content type (label 3) naming the endorsement artifact.
+ * Signed via Sig_structure, so the artifact's type is non-malleable.
+ */
+export declare const SESSION_KEY_ENDORSEMENT_CONTENT_TYPE = "application/vnd.forestrie.session-key-endorsement+cbor";
+/** Payload map key holding the endorsed session public key (x‖y, 64 bytes). */
+export declare const SESSION_KEY_PAYLOAD_KEY = "sessionKey";
+/** To-be-signed endorsement halves plus the challenge preimage. */
+export interface SessionKeyEndorsementTbs {
+    /** Protected header map bytes `{1: -65800, 3: cty, 4: root x}`. */
+    protectedBstr: Uint8Array;
+    /** Payload bytes: deterministic CBOR `{"sessionKey": x‖y}`. */
+    payloadBstr: Uint8Array;
+    /**
+     * `Sig_structure` over the halves. The WebAuthn challenge MUST be
+     * `base64url(sha256(sigStructureBytes))` (ADR-0063 §3).
+     */
+    sigStructureBytes: Uint8Array;
+}
+/**
+ * Build the endorsement TBS. The caller hashes `sigStructureBytes` into the
+ * `navigator.credentials.get` challenge, then assembles with the assertion.
+ *
+ * @param input.rootPublicKeyX - Passkey root x coordinate (kid, 32 bytes)
+ * @param input.sessionPublicKeyXY - Endorsed session public key x‖y (64 bytes)
+ */
+export declare function buildSessionKeyEndorsementTbs(input: {
+    rootPublicKeyX: Uint8Array;
+    sessionPublicKeyXY: Uint8Array;
+}): SessionKeyEndorsementTbs;
+/**
+ * Assemble the final endorsement COSE Sign1: the assertion rides in the
+ * unprotected header at label -65800 (ADR-0063 §2), the signature is the
+ * assertion's, converted to low-s P1363 r‖s by the caller (see
+ * delegation-cose `derSignatureToP1363` / low-s normalisation).
+ */
+export declare function assembleSessionKeyEndorsement(input: {
+    tbs: SessionKeyEndorsementTbs;
+    authenticatorData: Uint8Array;
+    clientDataJSON: Uint8Array;
+    /** Low-s P1363 r‖s (64 bytes). */
+    signature: Uint8Array;
+}): Uint8Array;
+/** Verification outcome; failures name the first check that broke. */
+export type SessionKeyEndorsementVerifyResult = {
+    ok: true;
+    /** Endorsed session public key, raw x‖y (64 bytes). */
+    sessionPublicKeyXY: Uint8Array;
+    /** The same key imported for ES256 verify of per-turn leaves. */
+    sessionKey: CryptoKey;
+} | {
+    ok: false;
+    reason: "endorsement_malformed" | "wrong_alg" | "wrong_content_type" | "kid_invalid" | "kid_mismatch" | "payload_invalid" | "signature_invalid" | "session_key_import_failed";
+};
+/** Options for {@link verifySessionKeyEndorsement}. */
+export interface VerifySessionKeyEndorsementOptions {
+    /**
+     * Require the assertion's UV flag. Onboarding UV is DEPLOYMENT config,
+     * not grant policy — the endorsement precedes the grant (ADR-0064 §3).
+     * User presence is always required regardless.
+     */
+    requireUserVerification?: boolean;
+    /** Emit JSON warning lines on failure paths (no secrets). */
+    logFailures?: boolean;
+    /** Included in JSON log lines. */
+    logPrefix?: string;
+}
+/**
+ * Verify a session-key endorsement under the passkey root and yield the
+ * endorsed session key. All the ADR-0063 envelope checks (challenge binding
+ * to this artifact's `Sig_structure`, UP flag, ceremony type, low-s, both
+ * fail-closed directions) run inside the shared `-65800` verify branch;
+ * this function adds the ADR-0064 typing rules on top.
+ *
+ * @param endorsementCbor - The endorsement COSE Sign1 bytes
+ * @param rootKeys - Passkey root trust anchor(s), tried in order. Raw
+ *   coordinate anchors additionally pin `kid == root x`.
+ * @param opts - UV requirement (deployment config) and failure logging
+ */
+export declare function verifySessionKeyEndorsement(endorsementCbor: Uint8Array, rootKeys: ParsedVerifyKey | ParsedVerifyKey[], opts?: VerifySessionKeyEndorsementOptions): Promise<SessionKeyEndorsementVerifyResult>;
+//# sourceMappingURL=session-key-endorsement.d.ts.map

package/dist/session-key-endorsement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-key-endorsement.d.ts","sourceRoot":"","sources":["../src/session-key-endorsement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EASL,KAAK,eAAe,EACrB,MAAM,qBAAqB,CAAC;AAG7B;;;GAGG;AACH,eAAO,MAAM,oCAAoC,2DACS,CAAC;AAE3D,+EAA+E;AAC/E,eAAO,MAAM,uBAAuB,eAAe,CAAC;AAEpD,mEAAmE;AACnE,MAAM,WAAW,wBAAwB;IACvC,mEAAmE;IACnE,aAAa,EAAE,UAAU,CAAC;IAC1B,+DAA+D;IAC/D,WAAW,EAAE,UAAU,CAAC;IACxB;;;OAGG;IACH,iBAAiB,EAAE,UAAU,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,cAAc,EAAE,UAAU,CAAC;IAC3B,kBAAkB,EAAE,UAAU,CAAC;CAChC,GAAG,wBAAwB,CAyB3B;AAED;;;;;GAKG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE;IACnD,GAAG,EAAE,wBAAwB,CAAC;IAC9B,iBAAiB,EAAE,UAAU,CAAC;IAC9B,cAAc,EAAE,UAAU,CAAC;IAC3B,kCAAkC;IAClC,SAAS,EAAE,UAAU,CAAC;CACvB,GAAG,UAAU,CAab;AAED,sEAAsE;AACtE,MAAM,MAAM,iCAAiC,GACzC;IACE,EAAE,EAAE,IAAI,CAAC;IACT,uDAAuD;IACvD,kBAAkB,EAAE,UAAU,CAAC;IAC/B,iEAAiE;IACjE,UAAU,EAAE,SAAS,CAAC;CACvB,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EACF,uBAAuB,GACvB,WAAW,GACX,oBAAoB,GACpB,aAAa,GACb,cAAc,GACd,iBAAiB,GACjB,mBAAmB,GACnB,2BAA2B,CAAC;CACjC,CAAC;AAEN,uDAAuD;AACvD,MAAM,WAAW,kCAAkC;IACjD;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,6DAA6D;IAC7D,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAiDD;;;;;;;;;;;GAWG;AACH,wBAAsB,2BAA2B,CAC/C,eAAe,EAAE,UAAU,EAC3B,QAAQ,EAAE,eAAe,GAAG,eAAe,EAAE,EAC7C,IAAI,CAAC,EAAE,kCAAkC,GACxC,OAAO,CAAC,iCAAiC,CAAC,CA2D5C"}

package/dist/session-key-endorsement.js

@@ -0,0 +1,188 @@
+/**
+ * Passkey session-key endorsement (devdocs ADR-0064, plan-2608-13 Q5).
+ *
+ * A passkey log root signs ceremonies only; the per-turn user-envelope
+ * signer is a separate session key, endorsed ONCE by the root via a COSE
+ * Sign1 in the ADR-0063 WebAuthn envelope. This module owns both sides of
+ * that artifact's byte-exact shape:
+ *
+ * - build/assemble: the client constructs the TBS, hashes its Sig_structure
+ *   into the WebAuthn challenge, and attaches the assertion + signature;
+ * - verify: given the passkey root as trust anchor, validate the artifact
+ *   (typed, challenge-bound, fail-closed) and yield the session public key.
+ *
+ * The offline trust chain is then:
+ *   grant (root = passkey x‖y) → endorsement → session key → plain-ES256
+ *   per-turn leaves — zero per-leaf format change (ADR-0064 §4).
+ *
+ * Domain separation (ADR-0064 §2): the protected header carries the content
+ * type below, and the payload is EXACTLY `{"sessionKey": bstr .size 64}`.
+ * Anything else is a verification failure, never a fallback.
+ */
+import { COSE_ALG_ES256_WEBAUTHN, decodeCborDeterministic, decodeCoseSign1, encodeCborDeterministic, encodeCoseSign1Raw, encodeSigStructure, verifyCoseSign1WithParsedKey, WEBAUTHN_ENVELOPE_LABEL, } from "@forestrie/encoding";
+import { importEs256PublicKeyFromGrantDataXy64 } from "./decode-trust-root-cbor.js";
+/**
+ * Protected-header content type (label 3) naming the endorsement artifact.
+ * Signed via Sig_structure, so the artifact's type is non-malleable.
+ */
+export const SESSION_KEY_ENDORSEMENT_CONTENT_TYPE = "application/vnd.forestrie.session-key-endorsement+cbor";
+/** Payload map key holding the endorsed session public key (x‖y, 64 bytes). */
+export const SESSION_KEY_PAYLOAD_KEY = "sessionKey";
+/**
+ * Build the endorsement TBS. The caller hashes `sigStructureBytes` into the
+ * `navigator.credentials.get` challenge, then assembles with the assertion.
+ *
+ * @param input.rootPublicKeyX - Passkey root x coordinate (kid, 32 bytes)
+ * @param input.sessionPublicKeyXY - Endorsed session public key x‖y (64 bytes)
+ */
+export function buildSessionKeyEndorsementTbs(input) {
+    if (input.rootPublicKeyX.length !== 32) {
+        throw new Error("endorsement kid must be the 32-byte root x coordinate");
+    }
+    if (input.sessionPublicKeyXY.length !== 64) {
+        throw new Error("endorsed session key must be 64 bytes (x||y)");
+    }
+    const protectedBstr = encodeCborDeterministic(new Map([
+        [1, COSE_ALG_ES256_WEBAUTHN],
+        [3, SESSION_KEY_ENDORSEMENT_CONTENT_TYPE],
+        [4, input.rootPublicKeyX],
+    ]));
+    const payloadBstr = encodeCborDeterministic(new Map([
+        [SESSION_KEY_PAYLOAD_KEY, input.sessionPublicKeyXY],
+    ]));
+    const sigStructureBytes = encodeSigStructure(protectedBstr, new Uint8Array(0), payloadBstr);
+    return { protectedBstr, payloadBstr, sigStructureBytes };
+}
+/**
+ * Assemble the final endorsement COSE Sign1: the assertion rides in the
+ * unprotected header at label -65800 (ADR-0063 §2), the signature is the
+ * assertion's, converted to low-s P1363 r‖s by the caller (see
+ * delegation-cose `derSignatureToP1363` / low-s normalisation).
+ */
+export function assembleSessionKeyEndorsement(input) {
+    if (input.signature.length !== 64) {
+        throw new Error("endorsement signature must be 64-byte P1363 r||s");
+    }
+    const unprotected = new Map([
+        [WEBAUTHN_ENVELOPE_LABEL, [input.authenticatorData, input.clientDataJSON]],
+    ]);
+    return encodeCoseSign1Raw(input.tbs.protectedBstr, unprotected, input.tbs.payloadBstr, input.signature);
+}
+function protectedHeaderEntries(protectedBstr) {
+    let decoded;
+    try {
+        decoded = decodeCborDeterministic(protectedBstr);
+    }
+    catch {
+        return null;
+    }
+    if (decoded instanceof Map) {
+        return { alg: decoded.get(1), cty: decoded.get(3), kid: decoded.get(4) };
+    }
+    if (typeof decoded === "object" && decoded !== null) {
+        const obj = decoded;
+        return {
+            alg: obj[1] ?? obj["1"],
+            cty: obj[3] ?? obj["3"],
+            kid: obj[4] ?? obj["4"],
+        };
+    }
+    return null;
+}
+function decodePayloadSessionKeyXy(payloadBstr) {
+    let decoded;
+    try {
+        decoded = decodeCborDeterministic(payloadBstr);
+    }
+    catch {
+        return null;
+    }
+    // Exactly one entry, exactly the sessionKey label, exactly 64 bytes
+    // (ADR-0064 §2) — anything else is a failure, never a partial read.
+    let entries;
+    if (decoded instanceof Map) {
+        entries = [...decoded.entries()];
+    }
+    else if (typeof decoded === "object" && decoded !== null) {
+        entries = Object.entries(decoded);
+    }
+    else {
+        return null;
+    }
+    if (entries.length !== 1)
+        return null;
+    const [key, value] = entries[0];
+    if (key !== SESSION_KEY_PAYLOAD_KEY)
+        return null;
+    if (!(value instanceof Uint8Array) || value.length !== 64)
+        return null;
+    return value;
+}
+/**
+ * Verify a session-key endorsement under the passkey root and yield the
+ * endorsed session key. All the ADR-0063 envelope checks (challenge binding
+ * to this artifact's `Sig_structure`, UP flag, ceremony type, low-s, both
+ * fail-closed directions) run inside the shared `-65800` verify branch;
+ * this function adds the ADR-0064 typing rules on top.
+ *
+ * @param endorsementCbor - The endorsement COSE Sign1 bytes
+ * @param rootKeys - Passkey root trust anchor(s), tried in order. Raw
+ *   coordinate anchors additionally pin `kid == root x`.
+ * @param opts - UV requirement (deployment config) and failure logging
+ */
+export async function verifySessionKeyEndorsement(endorsementCbor, rootKeys, opts) {
+    const anchors = Array.isArray(rootKeys) ? rootKeys : [rootKeys];
+    const decoded = decodeCoseSign1(endorsementCbor);
+    if (!decoded)
+        return { ok: false, reason: "endorsement_malformed" };
+    const header = protectedHeaderEntries(decoded.protectedBstr);
+    if (!header)
+        return { ok: false, reason: "endorsement_malformed" };
+    const alg = typeof header.alg === "bigint" ? Number(header.alg) : header.alg;
+    if (alg !== COSE_ALG_ES256_WEBAUTHN) {
+        return { ok: false, reason: "wrong_alg" };
+    }
+    if (header.cty !== SESSION_KEY_ENDORSEMENT_CONTENT_TYPE) {
+        return { ok: false, reason: "wrong_content_type" };
+    }
+    if (!(header.kid instanceof Uint8Array) || header.kid.length !== 32) {
+        return { ok: false, reason: "kid_invalid" };
+    }
+    const sessionPublicKeyXY = decodePayloadSessionKeyXy(decoded.payloadBstr);
+    if (!sessionPublicKeyXY)
+        return { ok: false, reason: "payload_invalid" };
+    let kidMismatch = false;
+    for (const anchor of anchors) {
+        // When the anchor exposes raw coordinates, the signed kid must name it —
+        // a valid signature under a root whose x is not the kid is evidence of
+        // artifact confusion, not authorization (ADR-0064 §2 kid = root x).
+        if (!(anchor instanceof CryptoKey)) {
+            const x = anchor.x;
+            if (x.length !== header.kid.length ||
+                !x.every((b, i) => b === header.kid[i])) {
+                kidMismatch = true;
+                continue;
+            }
+        }
+        const sigOk = await verifyCoseSign1WithParsedKey(endorsementCbor, anchor, {
+            requireUserVerification: opts?.requireUserVerification,
+            logFailures: opts?.logFailures,
+            logPrefix: opts?.logPrefix ?? "session-key-endorsement",
+        });
+        if (!sigOk)
+            continue;
+        let sessionKey;
+        try {
+            sessionKey =
+                await importEs256PublicKeyFromGrantDataXy64(sessionPublicKeyXY);
+        }
+        catch {
+            return { ok: false, reason: "session_key_import_failed" };
+        }
+        return { ok: true, sessionPublicKeyXY, sessionKey };
+    }
+    return {
+        ok: false,
+        reason: kidMismatch ? "kid_mismatch" : "signature_invalid",
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forestrie/receipt-verify",
-  "version": "0.10.1",
+  "version": "0.12.0",
   "license": "MIT",
   "type": "module",
   "description": "Offline SCITT grant receipt verification (ADR-0045)",
@@ -28,9 +28,9 @@
   ],
   "dependencies": {
     "@noble/hashes": "^1.7.1",
-    "@forestrie/chain-rpc": "0.1.1",
-    "@forestrie/merklelog": "0.3.0",
-    "@forestrie/encoding": "0.5.0"
+    "@forestrie/chain-rpc": "0.2.0",
+    "@forestrie/encoding": "0.6.0",
+    "@forestrie/merklelog": "0.3.0"
   },
   "devDependencies": {
     "esbuild": "^0.24.0",

package/src/index.ts

@@ -58,6 +58,23 @@ export type {
 } from "./resolve-delegated-verify-key.js";
 /** Import a raw 64-byte x||y P-256 public key as an ES256 verify key. */
 export { importEs256PublicKeyFromGrantDataXy64 } from "./decode-trust-root-cbor.js";
+/**
+ * Passkey session-key endorsement (ADR-0064): build, assemble, and verify
+ * the one-gesture artifact chaining a passkey log root to the plain-ES256
+ * per-turn session key — the offline rung root → endorsement → leaves.
+ */
+export {
+  assembleSessionKeyEndorsement,
+  buildSessionKeyEndorsementTbs,
+  SESSION_KEY_ENDORSEMENT_CONTENT_TYPE,
+  SESSION_KEY_PAYLOAD_KEY,
+  verifySessionKeyEndorsement,
+} from "./session-key-endorsement.js";
+export type {
+  SessionKeyEndorsementTbs,
+  SessionKeyEndorsementVerifyResult,
+  VerifySessionKeyEndorsementOptions,
+} from "./session-key-endorsement.js";
 export { decodeForestrieGrantCose } from "./decode-forestrie-grant-cose.js";
 export { decodeGrantPayload, decodeGrantResponse } from "./grant-codec.js";
 

package/src/resolve-delegated-verify-key.ts

@@ -6,9 +6,12 @@
  * trust root and returns the delegated public key as an additional verify
  * candidate — the offline port of canopy-api's `resolveReceiptVerifyKey`.
  *
- * ES256 (P-256) only: the offline verifier is ES256-only (genesis alg), and
- * sealer delegate keys are always secp256r1. KS256-rooted delegation is a
- * server-only concern.
+ * P-256 roots only: the genesis alg is ES256 and sealer delegate keys are
+ * always secp256r1; KS256-rooted delegation is a server-only concern. A
+ * passkey (WebAuthn) root signs the certificate with alg -65800 and the
+ * ADR-0063 unprotected-header envelope — `verifyCoseSign1WithParsedKey`
+ * verifies that envelope against the same P-256 root keys, so the chain walk
+ * here is alg-agnostic (plan-2608-13 1.4).
  *
  * Trust anchors (FOR-297 trust ladder): `rootKeys` need not be genesis-derived
  * — a caller-known log OWNER key works identically (see

package/src/session-key-endorsement.ts

@@ -0,0 +1,281 @@
+/**
+ * Passkey session-key endorsement (devdocs ADR-0064, plan-2608-13 Q5).
+ *
+ * A passkey log root signs ceremonies only; the per-turn user-envelope
+ * signer is a separate session key, endorsed ONCE by the root via a COSE
+ * Sign1 in the ADR-0063 WebAuthn envelope. This module owns both sides of
+ * that artifact's byte-exact shape:
+ *
+ * - build/assemble: the client constructs the TBS, hashes its Sig_structure
+ *   into the WebAuthn challenge, and attaches the assertion + signature;
+ * - verify: given the passkey root as trust anchor, validate the artifact
+ *   (typed, challenge-bound, fail-closed) and yield the session public key.
+ *
+ * The offline trust chain is then:
+ *   grant (root = passkey x‖y) → endorsement → session key → plain-ES256
+ *   per-turn leaves — zero per-leaf format change (ADR-0064 §4).
+ *
+ * Domain separation (ADR-0064 §2): the protected header carries the content
+ * type below, and the payload is EXACTLY `{"sessionKey": bstr .size 64}`.
+ * Anything else is a verification failure, never a fallback.
+ */
+
+import {
+  COSE_ALG_ES256_WEBAUTHN,
+  decodeCborDeterministic,
+  decodeCoseSign1,
+  encodeCborDeterministic,
+  encodeCoseSign1Raw,
+  encodeSigStructure,
+  verifyCoseSign1WithParsedKey,
+  WEBAUTHN_ENVELOPE_LABEL,
+  type ParsedVerifyKey,
+} from "@forestrie/encoding";
+import { importEs256PublicKeyFromGrantDataXy64 } from "./decode-trust-root-cbor.js";
+
+/**
+ * Protected-header content type (label 3) naming the endorsement artifact.
+ * Signed via Sig_structure, so the artifact's type is non-malleable.
+ */
+export const SESSION_KEY_ENDORSEMENT_CONTENT_TYPE =
+  "application/vnd.forestrie.session-key-endorsement+cbor";
+
+/** Payload map key holding the endorsed session public key (x‖y, 64 bytes). */
+export const SESSION_KEY_PAYLOAD_KEY = "sessionKey";
+
+/** To-be-signed endorsement halves plus the challenge preimage. */
+export interface SessionKeyEndorsementTbs {
+  /** Protected header map bytes `{1: -65800, 3: cty, 4: root x}`. */
+  protectedBstr: Uint8Array;
+  /** Payload bytes: deterministic CBOR `{"sessionKey": x‖y}`. */
+  payloadBstr: Uint8Array;
+  /**
+   * `Sig_structure` over the halves. The WebAuthn challenge MUST be
+   * `base64url(sha256(sigStructureBytes))` (ADR-0063 §3).
+   */
+  sigStructureBytes: Uint8Array;
+}
+
+/**
+ * Build the endorsement TBS. The caller hashes `sigStructureBytes` into the
+ * `navigator.credentials.get` challenge, then assembles with the assertion.
+ *
+ * @param input.rootPublicKeyX - Passkey root x coordinate (kid, 32 bytes)
+ * @param input.sessionPublicKeyXY - Endorsed session public key x‖y (64 bytes)
+ */
+export function buildSessionKeyEndorsementTbs(input: {
+  rootPublicKeyX: Uint8Array;
+  sessionPublicKeyXY: Uint8Array;
+}): SessionKeyEndorsementTbs {
+  if (input.rootPublicKeyX.length !== 32) {
+    throw new Error("endorsement kid must be the 32-byte root x coordinate");
+  }
+  if (input.sessionPublicKeyXY.length !== 64) {
+    throw new Error("endorsed session key must be 64 bytes (x||y)");
+  }
+  const protectedBstr = encodeCborDeterministic(
+    new Map<number, unknown>([
+      [1, COSE_ALG_ES256_WEBAUTHN],
+      [3, SESSION_KEY_ENDORSEMENT_CONTENT_TYPE],
+      [4, input.rootPublicKeyX],
+    ]),
+  );
+  const payloadBstr = encodeCborDeterministic(
+    new Map<string, unknown>([
+      [SESSION_KEY_PAYLOAD_KEY, input.sessionPublicKeyXY],
+    ]),
+  );
+  const sigStructureBytes = encodeSigStructure(
+    protectedBstr,
+    new Uint8Array(0),
+    payloadBstr,
+  );
+  return { protectedBstr, payloadBstr, sigStructureBytes };
+}
+
+/**
+ * Assemble the final endorsement COSE Sign1: the assertion rides in the
+ * unprotected header at label -65800 (ADR-0063 §2), the signature is the
+ * assertion's, converted to low-s P1363 r‖s by the caller (see
+ * delegation-cose `derSignatureToP1363` / low-s normalisation).
+ */
+export function assembleSessionKeyEndorsement(input: {
+  tbs: SessionKeyEndorsementTbs;
+  authenticatorData: Uint8Array;
+  clientDataJSON: Uint8Array;
+  /** Low-s P1363 r‖s (64 bytes). */
+  signature: Uint8Array;
+}): Uint8Array {
+  if (input.signature.length !== 64) {
+    throw new Error("endorsement signature must be 64-byte P1363 r||s");
+  }
+  const unprotected = new Map<number, unknown>([
+    [WEBAUTHN_ENVELOPE_LABEL, [input.authenticatorData, input.clientDataJSON]],
+  ]);
+  return encodeCoseSign1Raw(
+    input.tbs.protectedBstr,
+    unprotected,
+    input.tbs.payloadBstr,
+    input.signature,
+  );
+}
+
+/** Verification outcome; failures name the first check that broke. */
+export type SessionKeyEndorsementVerifyResult =
+  | {
+      ok: true;
+      /** Endorsed session public key, raw x‖y (64 bytes). */
+      sessionPublicKeyXY: Uint8Array;
+      /** The same key imported for ES256 verify of per-turn leaves. */
+      sessionKey: CryptoKey;
+    }
+  | {
+      ok: false;
+      reason:
+        | "endorsement_malformed"
+        | "wrong_alg"
+        | "wrong_content_type"
+        | "kid_invalid"
+        | "kid_mismatch"
+        | "payload_invalid"
+        | "signature_invalid"
+        | "session_key_import_failed";
+    };
+
+/** Options for {@link verifySessionKeyEndorsement}. */
+export interface VerifySessionKeyEndorsementOptions {
+  /**
+   * Require the assertion's UV flag. Onboarding UV is DEPLOYMENT config,
+   * not grant policy — the endorsement precedes the grant (ADR-0064 §3).
+   * User presence is always required regardless.
+   */
+  requireUserVerification?: boolean;
+  /** Emit JSON warning lines on failure paths (no secrets). */
+  logFailures?: boolean;
+  /** Included in JSON log lines. */
+  logPrefix?: string;
+}
+
+function protectedHeaderEntries(
+  protectedBstr: Uint8Array,
+): { alg: unknown; cty: unknown; kid: unknown } | null {
+  let decoded: unknown;
+  try {
+    decoded = decodeCborDeterministic(protectedBstr);
+  } catch {
+    return null;
+  }
+  if (decoded instanceof Map) {
+    return { alg: decoded.get(1), cty: decoded.get(3), kid: decoded.get(4) };
+  }
+  if (typeof decoded === "object" && decoded !== null) {
+    const obj = decoded as Record<string | number, unknown>;
+    return {
+      alg: obj[1] ?? obj["1"],
+      cty: obj[3] ?? obj["3"],
+      kid: obj[4] ?? obj["4"],
+    };
+  }
+  return null;
+}
+
+function decodePayloadSessionKeyXy(payloadBstr: Uint8Array): Uint8Array | null {
+  let decoded: unknown;
+  try {
+    decoded = decodeCborDeterministic(payloadBstr);
+  } catch {
+    return null;
+  }
+  // Exactly one entry, exactly the sessionKey label, exactly 64 bytes
+  // (ADR-0064 §2) — anything else is a failure, never a partial read.
+  let entries: [unknown, unknown][];
+  if (decoded instanceof Map) {
+    entries = [...decoded.entries()];
+  } else if (typeof decoded === "object" && decoded !== null) {
+    entries = Object.entries(decoded);
+  } else {
+    return null;
+  }
+  if (entries.length !== 1) return null;
+  const [key, value] = entries[0]!;
+  if (key !== SESSION_KEY_PAYLOAD_KEY) return null;
+  if (!(value instanceof Uint8Array) || value.length !== 64) return null;
+  return value;
+}
+
+/**
+ * Verify a session-key endorsement under the passkey root and yield the
+ * endorsed session key. All the ADR-0063 envelope checks (challenge binding
+ * to this artifact's `Sig_structure`, UP flag, ceremony type, low-s, both
+ * fail-closed directions) run inside the shared `-65800` verify branch;
+ * this function adds the ADR-0064 typing rules on top.
+ *
+ * @param endorsementCbor - The endorsement COSE Sign1 bytes
+ * @param rootKeys - Passkey root trust anchor(s), tried in order. Raw
+ *   coordinate anchors additionally pin `kid == root x`.
+ * @param opts - UV requirement (deployment config) and failure logging
+ */
+export async function verifySessionKeyEndorsement(
+  endorsementCbor: Uint8Array,
+  rootKeys: ParsedVerifyKey | ParsedVerifyKey[],
+  opts?: VerifySessionKeyEndorsementOptions,
+): Promise<SessionKeyEndorsementVerifyResult> {
+  const anchors = Array.isArray(rootKeys) ? rootKeys : [rootKeys];
+
+  const decoded = decodeCoseSign1(endorsementCbor);
+  if (!decoded) return { ok: false, reason: "endorsement_malformed" };
+
+  const header = protectedHeaderEntries(decoded.protectedBstr);
+  if (!header) return { ok: false, reason: "endorsement_malformed" };
+
+  const alg = typeof header.alg === "bigint" ? Number(header.alg) : header.alg;
+  if (alg !== COSE_ALG_ES256_WEBAUTHN) {
+    return { ok: false, reason: "wrong_alg" };
+  }
+  if (header.cty !== SESSION_KEY_ENDORSEMENT_CONTENT_TYPE) {
+    return { ok: false, reason: "wrong_content_type" };
+  }
+  if (!(header.kid instanceof Uint8Array) || header.kid.length !== 32) {
+    return { ok: false, reason: "kid_invalid" };
+  }
+
+  const sessionPublicKeyXY = decodePayloadSessionKeyXy(decoded.payloadBstr);
+  if (!sessionPublicKeyXY) return { ok: false, reason: "payload_invalid" };
+
+  let kidMismatch = false;
+  for (const anchor of anchors) {
+    // When the anchor exposes raw coordinates, the signed kid must name it —
+    // a valid signature under a root whose x is not the kid is evidence of
+    // artifact confusion, not authorization (ADR-0064 §2 kid = root x).
+    if (!(anchor instanceof CryptoKey)) {
+      const x = anchor.x;
+      if (
+        x.length !== header.kid.length ||
+        !x.every((b, i) => b === (header.kid as Uint8Array)[i])
+      ) {
+        kidMismatch = true;
+        continue;
+      }
+    }
+    const sigOk = await verifyCoseSign1WithParsedKey(endorsementCbor, anchor, {
+      requireUserVerification: opts?.requireUserVerification,
+      logFailures: opts?.logFailures,
+      logPrefix: opts?.logPrefix ?? "session-key-endorsement",
+    });
+    if (!sigOk) continue;
+
+    let sessionKey: CryptoKey;
+    try {
+      sessionKey =
+        await importEs256PublicKeyFromGrantDataXy64(sessionPublicKeyXY);
+    } catch {
+      return { ok: false, reason: "session_key_import_failed" };
+    }
+    return { ok: true, sessionPublicKeyXY, sessionKey };
+  }
+
+  return {
+    ok: false,
+    reason: kidMismatch ? "kid_mismatch" : "signature_invalid",
+  };
+}