@forestrie/receipt-verify 0.3.0 → 0.5.0

package/dist/build-receipt-offline.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Self-created SCITT receipts from local artifacts.
+ *
+ * Mirrors canopy-api resolve-receipt receipt assembly, but over local massif
+ * (`.log`) and checkpoint (`.sth`) bytes instead of R2 objects. The checkpoint
+ * signature covers only the accumulator, so the inclusion path is free to
+ * rebuild client-side: read massif nodes, build the leaf→peak path, attach it
+ * at header 396 to the checkpoint's pre-signed peak receipt. The result is
+ * verify-equivalent with an API-issued receipt (FOR-334 AC: both pass
+ * verifyGrantReceiptOffline identically; byte-equality is intentionally not
+ * claimed — encoder-level variation is known-benign, see plan-2607-15 §2).
+ *
+ * `computeAccumulatorPeak` supports the chain-anchored variant: build the path
+ * at an externally attested tree size (e.g. Univocity `logState` on Base
+ * Sepolia) and compare the computed peak with the published accumulator.
+ */
+import { openMassifNodeStore, type MassifNodeStore } from "@forestrie/merklelog";
+import { type CoseSign1 } from "./parse-receipt.js";
+/**
+ * Re-exported for compatibility. The MMR proof math and massif node store now
+ * live in `@forestrie/merklelog` (plan-2607-15 §4, phase 2); receipt-verify
+ * keeps only the COSE-shaped layer below.
+ */
+export { openMassifNodeStore };
+export type { MassifNodeStore };
+export type ParsedCheckpoint = {
+    coseSign1: CoseSign1;
+    unprotected: Map<number, unknown>;
+    /** Pre-signed peak receipts (label -65931), or null when absent. */
+    peakReceipts: unknown[] | null;
+    /** Sealed tree size (tree-size-2 of the embedded consistency proof). */
+    mmrSize: bigint | null;
+    delegationCert: Uint8Array | null;
+};
+/** Parse a format-v3 checkpoint (`.sth`) COSE Sign1. */
+export declare function parseCheckpoint(checkpointBytes: Uint8Array): ParsedCheckpoint;
+export type BuildReceiptOfflineInput = {
+    massifBytes: Uint8Array;
+    checkpointBytes: Uint8Array;
+    mmrIndex: bigint;
+};
+/**
+ * Assemble a receipt for the entry at `mmrIndex` from a local massif blob and
+ * its checkpoint. Pure over bytes; no network, no signing key — the signature
+ * is the checkpoint's pre-signed peak receipt. Throws with a specific reason
+ * on any failure.
+ */
+export declare function buildReceiptOffline(input: BuildReceiptOfflineInput): Uint8Array;
+export type ComputedAccumulatorPeak = {
+    /** Root computed from the massif's leaf value and rebuilt path. */
+    peak: Uint8Array;
+    /** Position of that peak in the accumulator, left to right. */
+    peakIndex: number;
+    proof: Uint8Array[];
+    leafValue: Uint8Array;
+};
+/**
+ * Chain-anchored variant: rebuild the inclusion path for `mmrIndex` at an
+ * externally attested tree size and compute the accumulator peak it commits
+ * to. Compare `peak` with `accumulator[peakIndex]` published by the Univocity
+ * contract (`logState`). Requires the local massif to hold nodes up to
+ * `mmrSize`.
+ */
+export declare function computeAccumulatorPeak(opts: {
+    massifBytes: Uint8Array;
+    mmrIndex: bigint;
+    mmrSize: bigint;
+}): Promise<ComputedAccumulatorPeak>;
+//# sourceMappingURL=build-receipt-offline.d.ts.map

package/dist/build-receipt-offline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-receipt-offline.d.ts","sourceRoot":"","sources":["../src/build-receipt-offline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAIL,mBAAmB,EAEnB,KAAK,eAAe,EAErB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,oBAAoB,CAAC;AAQ5B;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAC/B,YAAY,EAAE,eAAe,EAAE,CAAC;AAEhC,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,SAAS,CAAC;IACrB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,oEAAoE;IACpE,YAAY,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC/B,wEAAwE;IACxE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,cAAc,EAAE,UAAU,GAAG,IAAI,CAAC;CACnC,CAAC;AAEF,wDAAwD;AACxD,wBAAgB,eAAe,CAAC,eAAe,EAAE,UAAU,GAAG,gBAAgB,CAqB7E;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,WAAW,EAAE,UAAU,CAAC;IACxB,eAAe,EAAE,UAAU,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,wBAAwB,GAC9B,UAAU,CA2EZ;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,mEAAmE;IACnE,IAAI,EAAE,UAAU,CAAC;IACjB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,SAAS,EAAE,UAAU,CAAC;CACvB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,WAAW,EAAE,UAAU,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAwBnC"}

package/dist/build-receipt-offline.js

@@ -0,0 +1,165 @@
+/**
+ * Self-created SCITT receipts from local artifacts.
+ *
+ * Mirrors canopy-api resolve-receipt receipt assembly, but over local massif
+ * (`.log`) and checkpoint (`.sth`) bytes instead of R2 objects. The checkpoint
+ * signature covers only the accumulator, so the inclusion path is free to
+ * rebuild client-side: read massif nodes, build the leaf→peak path, attach it
+ * at header 396 to the checkpoint's pre-signed peak receipt. The result is
+ * verify-equivalent with an API-issued receipt (FOR-334 AC: both pass
+ * verifyGrantReceiptOffline identically; byte-equality is intentionally not
+ * claimed — encoder-level variation is known-benign, see plan-2607-15 §2).
+ *
+ * `computeAccumulatorPeak` supports the chain-anchored variant: build the path
+ * at an externally attested tree size (e.g. Univocity `logState` on Base
+ * Sepolia) and compare the computed peak with the published accumulator.
+ */
+import { decode as decodeCbor, encode as encodeCbor } from "cbor-x";
+import { calculateRoot, inclusionProof, massifIndexFromMMRIndex, openMassifNodeStore, peakIndexForLeafProof, } from "@forestrie/merklelog";
+import { requireCoseSign1, toHeaderMap, unwrapCoseSign1Tag, } from "./parse-receipt.js";
+import { SubtleHasher } from "./subtle-hasher.js";
+const VDS_COSE_RECEIPT_PROOFS_TAG = 396;
+const SEAL_PEAK_RECEIPTS_LABEL = -65931;
+const DELEGATION_CERT_LABEL = 1000;
+const VDP_CONSISTENCY_PROOF_KEY = -2;
+/**
+ * Re-exported for compatibility. The MMR proof math and massif node store now
+ * live in `@forestrie/merklelog` (plan-2607-15 §4, phase 2); receipt-verify
+ * keeps only the COSE-shaped layer below.
+ */
+export { openMassifNodeStore };
+/** Parse a format-v3 checkpoint (`.sth`) COSE Sign1. */
+export function parseCheckpoint(checkpointBytes) {
+    const decoded = decodeCbor(checkpointBytes);
+    const coseSign1 = requireCoseSign1(unwrapCoseSign1Tag(decoded));
+    const unprotected = toHeaderMap(coseSign1[1]);
+    const peakReceiptsRaw = unprotected.get(SEAL_PEAK_RECEIPTS_LABEL);
+    const peakReceipts = Array.isArray(peakReceiptsRaw) ? peakReceiptsRaw : null;
+    const delegationCertRaw = unprotected.get(DELEGATION_CERT_LABEL);
+    const delegationCert = delegationCertRaw instanceof Uint8Array && delegationCertRaw.length > 0
+        ? delegationCertRaw
+        : null;
+    return {
+        coseSign1,
+        unprotected,
+        peakReceipts,
+        mmrSize: sealedSizeFromCheckpoint(unprotected),
+        delegationCert,
+    };
+}
+/**
+ * Assemble a receipt for the entry at `mmrIndex` from a local massif blob and
+ * its checkpoint. Pure over bytes; no network, no signing key — the signature
+ * is the checkpoint's pre-signed peak receipt. Throws with a specific reason
+ * on any failure.
+ */
+export function buildReceiptOffline(input) {
+    const { mmrIndex } = input;
+    if (mmrIndex < 0n) {
+        throw new Error("mmrIndex must be non-negative");
+    }
+    const checkpoint = parseCheckpoint(input.checkpointBytes);
+    if (!checkpoint.peakReceipts) {
+        throw new Error("checkpoint carries no pre-signed peak receipts (label -65931)");
+    }
+    if (checkpoint.mmrSize === null || checkpoint.mmrSize <= 0n) {
+        throw new Error("checkpoint carries no consistency proof (cannot determine sealed size)");
+    }
+    const mmrSize = checkpoint.mmrSize;
+    const mmrLastIndex = mmrSize - 1n;
+    if (mmrIndex > mmrLastIndex) {
+        throw new Error(`checkpoint does not cover entry: mmrIndex ${mmrIndex.toString(10)} ` +
+            `>= sealed size ${mmrSize.toString(10)}`);
+    }
+    const store = openMassifNodeStore(input.massifBytes);
+    const expectedMassifIndex = massifIndexFromMMRIndex(store.massifHeight, mmrIndex);
+    if (expectedMassifIndex !== store.massifIndex) {
+        throw new Error(`entry at mmrIndex ${mmrIndex.toString(10)} lives in massif ` +
+            `${expectedMassifIndex.toString(10)}, but this blob is massif ` +
+            `${store.massifIndex.toString(10)}`);
+    }
+    const proof = inclusionProof(store.get, mmrLastIndex, mmrIndex);
+    const peakIdx = peakIndexForLeafProof(mmrSize, proof.length);
+    const receiptBytes = checkpoint.peakReceipts[peakIdx];
+    if (!(receiptBytes instanceof Uint8Array)) {
+        throw new Error(`checkpoint peak receipt slot ${peakIdx} is missing or not bstr`);
+    }
+    const receiptSign1 = requireCoseSign1(unwrapCoseSign1Tag(decodeCbor(receiptBytes)));
+    const receiptUnprotected = toHeaderMap(receiptSign1[1]);
+    if (checkpoint.delegationCert) {
+        receiptUnprotected.set(DELEGATION_CERT_LABEL, checkpoint.delegationCert);
+    }
+    const inclusionProofEntry = new Map([
+        [1, mmrIndex],
+        [2, proof],
+    ]);
+    const verifiableProofs = new Map([
+        [-1, [inclusionProofEntry]],
+    ]);
+    receiptUnprotected.set(VDS_COSE_RECEIPT_PROOFS_TAG, verifiableProofs);
+    // Peak receipts are signed with detached payload; emit nil so verify uses
+    // the peak derived from the inclusion proof.
+    const assembled = [
+        receiptSign1[0],
+        receiptUnprotected,
+        null,
+        receiptSign1[3],
+    ];
+    return cborBytes(assembled);
+}
+/**
+ * Chain-anchored variant: rebuild the inclusion path for `mmrIndex` at an
+ * externally attested tree size and compute the accumulator peak it commits
+ * to. Compare `peak` with `accumulator[peakIndex]` published by the Univocity
+ * contract (`logState`). Requires the local massif to hold nodes up to
+ * `mmrSize`.
+ */
+export async function computeAccumulatorPeak(opts) {
+    const { mmrIndex, mmrSize } = opts;
+    if (mmrSize <= 0n || mmrIndex >= mmrSize) {
+        throw new Error(`mmrIndex ${mmrIndex.toString(10)} is not covered by tree size ` +
+            `${mmrSize.toString(10)} (entry not anchored yet?)`);
+    }
+    const store = openMassifNodeStore(opts.massifBytes);
+    const leafValue = store.get(mmrIndex);
+    const path = inclusionProof(store.get, mmrSize - 1n, mmrIndex);
+    const proof = { path, mmrIndex };
+    const peak = await calculateRoot(new SubtleHasher(), leafValue, proof, mmrIndex);
+    return {
+        peak,
+        peakIndex: peakIndexForLeafProof(mmrSize, path.length),
+        proof: path,
+        leafValue,
+    };
+}
+// --- helpers ---
+function cborBytes(value) {
+    const encoded = encodeCbor(value);
+    return encoded instanceof Uint8Array
+        ? encoded
+        : new Uint8Array(encoded);
+}
+/**
+ * Sealed mmr size from a format-v3 checkpoint: tree-size-2 of the consistency
+ * proof (`bstr .cbor [tree-size-1, tree-size-2, paths, right-peaks]`) under
+ * the verifiable-proofs unprotected header (label 396, key -2).
+ */
+function sealedSizeFromCheckpoint(unprotected) {
+    const vdpRaw = unprotected.get(VDS_COSE_RECEIPT_PROOFS_TAG);
+    if (vdpRaw === undefined || vdpRaw === null)
+        return null;
+    const vdp = toHeaderMap(vdpRaw);
+    const proofBstr = vdp.get(VDP_CONSISTENCY_PROOF_KEY);
+    if (!(proofBstr instanceof Uint8Array))
+        return null;
+    const proof = decodeCbor(proofBstr);
+    if (!Array.isArray(proof) || proof.length < 2)
+        return null;
+    const treeSize2 = proof[1];
+    if (typeof treeSize2 === "bigint")
+        return treeSize2;
+    if (typeof treeSize2 === "number" && Number.isSafeInteger(treeSize2)) {
+        return BigInt(treeSize2);
+    }
+    return null;
+}

package/dist/index.d.ts

@@ -3,6 +3,13 @@ export type { ReceiptVerifyResult, ReceiptVerifyStage, } from "./receipt-verify-
 export type { Grant } from "@forestrie/encoding";
 export type { VerifyGrantReceiptOfflineInput } from "./verify-grant-receipt-offline.js";
 export { parseReceipt } from "./parse-receipt.js";
+export type { BuildReceiptOfflineInput, ComputedAccumulatorPeak, MassifNodeStore, ParsedCheckpoint, } from "./build-receipt-offline.js";
+export { buildReceiptOffline, computeAccumulatorPeak, openMassifNodeStore, parseCheckpoint, } from "./build-receipt-offline.js";
+/**
+ * MMR proof math now lives in @forestrie/merklelog (plan-2607-15 §4 hoist);
+ * re-exported here to preserve the receipt-verify public surface.
+ */
+export { peakMMRIndexes } from "@forestrie/merklelog";
 export { decodeTrustRootFromGenesis } from "./decode-trust-root-from-genesis.js";
 export { verifyGrantReceiptOffline } from "./verify-grant-receipt-offline.js";
 export { decodeForestrieGrantCose } from "./decode-forestrie-grant-cose.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,oFAAoF;AACpF,YAAY,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,YAAY,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE3E,0EAA0E;AAC1E,OAAO,EACL,cAAc,EACd,iDAAiD,GAClD,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC7E,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,oFAAoF;AACpF,YAAY,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,YAAY,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EACV,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE3E,0EAA0E;AAC1E,OAAO,EACL,cAAc,EACd,iDAAiD,GAClD,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC7E,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -1,4 +1,10 @@
 export { parseReceipt } from "./parse-receipt.js";
+export { buildReceiptOffline, computeAccumulatorPeak, openMassifNodeStore, parseCheckpoint, } from "./build-receipt-offline.js";
+/**
+ * MMR proof math now lives in @forestrie/merklelog (plan-2607-15 §4 hoist);
+ * re-exported here to preserve the receipt-verify public surface.
+ */
+export { peakMMRIndexes } from "@forestrie/merklelog";
 export { decodeTrustRootFromGenesis } from "./decode-trust-root-from-genesis.js";
 export { verifyGrantReceiptOffline } from "./verify-grant-receipt-offline.js";
 export { decodeForestrieGrantCose } from "./decode-forestrie-grant-cose.js";

package/dist/parse-receipt.d.ts

@@ -1,15 +1,17 @@
 import type { Proof } from "@forestrie/merklelog";
-type CoseSign1 = [
+export type CoseSign1 = [
     protectedHeader: Uint8Array,
     unprotectedHeader: Map<number, unknown> | Record<string, unknown>,
     payload: Uint8Array | null,
     signature: Uint8Array
 ];
+export declare function unwrapCoseSign1Tag(value: unknown): unknown;
+export declare function requireCoseSign1(value: unknown): CoseSign1;
+export declare function toHeaderMap(value: Map<number, unknown> | Record<string, unknown>): Map<number, unknown>;
 export declare function parseReceipt(receiptBytes: Uint8Array): {
     explicitPeak: Uint8Array | null;
     proof: Proof;
     receiptCbor: Uint8Array;
     coseSign1: CoseSign1;
 };
-export {};
 //# sourceMappingURL=parse-receipt.d.ts.map

package/dist/parse-receipt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse-receipt.d.ts","sourceRoot":"","sources":["../src/parse-receipt.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAIlD,KAAK,SAAS,GAAG;IACf,eAAe,EAAE,UAAU;IAC3B,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACjE,OAAO,EAAE,UAAU,GAAG,IAAI;IAC1B,SAAS,EAAE,UAAU;CACtB,CAAC;AAgDF,wBAAgB,YAAY,CAAC,YAAY,EAAE,UAAU,GAAG;IACtD,YAAY,EAAE,UAAU,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE,UAAU,CAAC;IACxB,SAAS,EAAE,SAAS,CAAC;CACtB,CAwDA"}
+{"version":3,"file":"parse-receipt.d.ts","sourceRoot":"","sources":["../src/parse-receipt.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAIlD,MAAM,MAAM,SAAS,GAAG;IACtB,eAAe,EAAE,UAAU;IAC3B,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACjE,OAAO,EAAE,UAAU,GAAG,IAAI;IAC1B,SAAS,EAAE,UAAU;CACtB,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAW1D;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,CAiB1D;AAED,wBAAgB,WAAW,CACzB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACpD,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAUtB;AAED,wBAAgB,YAAY,CAAC,YAAY,EAAE,UAAU,GAAG;IACtD,YAAY,EAAE,UAAU,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE,UAAU,CAAC;IACxB,SAAS,EAAE,SAAS,CAAC;CACtB,CAwDA"}

package/dist/parse-receipt.js

@@ -1,6 +1,6 @@
 import { decode as decodeCbor } from "cbor-x";
 const VDS_COSE_RECEIPT_PROOFS_TAG = 396;
-function unwrapCoseSign1Tag(value) {
+export function unwrapCoseSign1Tag(value) {
     if (value && typeof value === "object" && !(value instanceof Map)) {
         const tagged = value;
         if (Object.prototype.hasOwnProperty.call(tagged, "value") &&
@@ -10,7 +10,7 @@ function unwrapCoseSign1Tag(value) {
     }
     return value;
 }
-function requireCoseSign1(value) {
+export function requireCoseSign1(value) {
     if (!Array.isArray(value) || value.length !== 4) {
         throw new Error("Receipt is not a COSE Sign1 array");
     }
@@ -28,7 +28,7 @@ function requireCoseSign1(value) {
         sig,
     ];
 }
-function toHeaderMap(value) {
+export function toHeaderMap(value) {
     if (value instanceof Map)
         return value;
     const out = new Map();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forestrie/receipt-verify",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "license": "MIT",
   "type": "module",
   "description": "Offline SCITT grant receipt verification (ADR-0045)",
@@ -29,8 +29,8 @@
   "dependencies": {
     "@noble/hashes": "^1.7.1",
     "cbor-x": "^1.5.9",
-    "@forestrie/encoding": "0.1.0",
-    "@forestrie/merklelog": "0.0.3"
+    "@forestrie/merklelog": "0.1.0",
+    "@forestrie/encoding": "0.2.0"
   },
   "devDependencies": {
     "esbuild": "^0.24.0",

package/src/build-receipt-offline.ts

@@ -0,0 +1,250 @@
+/**
+ * Self-created SCITT receipts from local artifacts.
+ *
+ * Mirrors canopy-api resolve-receipt receipt assembly, but over local massif
+ * (`.log`) and checkpoint (`.sth`) bytes instead of R2 objects. The checkpoint
+ * signature covers only the accumulator, so the inclusion path is free to
+ * rebuild client-side: read massif nodes, build the leaf→peak path, attach it
+ * at header 396 to the checkpoint's pre-signed peak receipt. The result is
+ * verify-equivalent with an API-issued receipt (FOR-334 AC: both pass
+ * verifyGrantReceiptOffline identically; byte-equality is intentionally not
+ * claimed — encoder-level variation is known-benign, see plan-2607-15 §2).
+ *
+ * `computeAccumulatorPeak` supports the chain-anchored variant: build the path
+ * at an externally attested tree size (e.g. Univocity `logState` on Base
+ * Sepolia) and compare the computed peak with the published accumulator.
+ */
+
+import { decode as decodeCbor, encode as encodeCbor } from "cbor-x";
+import {
+  calculateRoot,
+  inclusionProof,
+  massifIndexFromMMRIndex,
+  openMassifNodeStore,
+  peakIndexForLeafProof,
+  type MassifNodeStore,
+  type Proof,
+} from "@forestrie/merklelog";
+import {
+  requireCoseSign1,
+  toHeaderMap,
+  unwrapCoseSign1Tag,
+  type CoseSign1,
+} from "./parse-receipt.js";
+import { SubtleHasher } from "./subtle-hasher.js";
+
+const VDS_COSE_RECEIPT_PROOFS_TAG = 396;
+const SEAL_PEAK_RECEIPTS_LABEL = -65931;
+const DELEGATION_CERT_LABEL = 1000;
+const VDP_CONSISTENCY_PROOF_KEY = -2;
+
+/**
+ * Re-exported for compatibility. The MMR proof math and massif node store now
+ * live in `@forestrie/merklelog` (plan-2607-15 §4, phase 2); receipt-verify
+ * keeps only the COSE-shaped layer below.
+ */
+export { openMassifNodeStore };
+export type { MassifNodeStore };
+
+export type ParsedCheckpoint = {
+  coseSign1: CoseSign1;
+  unprotected: Map<number, unknown>;
+  /** Pre-signed peak receipts (label -65931), or null when absent. */
+  peakReceipts: unknown[] | null;
+  /** Sealed tree size (tree-size-2 of the embedded consistency proof). */
+  mmrSize: bigint | null;
+  delegationCert: Uint8Array | null;
+};
+
+/** Parse a format-v3 checkpoint (`.sth`) COSE Sign1. */
+export function parseCheckpoint(checkpointBytes: Uint8Array): ParsedCheckpoint {
+  const decoded = decodeCbor(checkpointBytes) as unknown;
+  const coseSign1 = requireCoseSign1(unwrapCoseSign1Tag(decoded));
+  const unprotected = toHeaderMap(coseSign1[1]);
+
+  const peakReceiptsRaw = unprotected.get(SEAL_PEAK_RECEIPTS_LABEL);
+  const peakReceipts = Array.isArray(peakReceiptsRaw) ? peakReceiptsRaw : null;
+
+  const delegationCertRaw = unprotected.get(DELEGATION_CERT_LABEL);
+  const delegationCert =
+    delegationCertRaw instanceof Uint8Array && delegationCertRaw.length > 0
+      ? delegationCertRaw
+      : null;
+
+  return {
+    coseSign1,
+    unprotected,
+    peakReceipts,
+    mmrSize: sealedSizeFromCheckpoint(unprotected),
+    delegationCert,
+  };
+}
+
+export type BuildReceiptOfflineInput = {
+  massifBytes: Uint8Array;
+  checkpointBytes: Uint8Array;
+  mmrIndex: bigint;
+};
+
+/**
+ * Assemble a receipt for the entry at `mmrIndex` from a local massif blob and
+ * its checkpoint. Pure over bytes; no network, no signing key — the signature
+ * is the checkpoint's pre-signed peak receipt. Throws with a specific reason
+ * on any failure.
+ */
+export function buildReceiptOffline(
+  input: BuildReceiptOfflineInput,
+): Uint8Array {
+  const { mmrIndex } = input;
+  if (mmrIndex < 0n) {
+    throw new Error("mmrIndex must be non-negative");
+  }
+
+  const checkpoint = parseCheckpoint(input.checkpointBytes);
+  if (!checkpoint.peakReceipts) {
+    throw new Error(
+      "checkpoint carries no pre-signed peak receipts (label -65931)",
+    );
+  }
+  if (checkpoint.mmrSize === null || checkpoint.mmrSize <= 0n) {
+    throw new Error(
+      "checkpoint carries no consistency proof (cannot determine sealed size)",
+    );
+  }
+  const mmrSize = checkpoint.mmrSize;
+  const mmrLastIndex = mmrSize - 1n;
+  if (mmrIndex > mmrLastIndex) {
+    throw new Error(
+      `checkpoint does not cover entry: mmrIndex ${mmrIndex.toString(10)} ` +
+        `>= sealed size ${mmrSize.toString(10)}`,
+    );
+  }
+
+  const store = openMassifNodeStore(input.massifBytes);
+  const expectedMassifIndex = massifIndexFromMMRIndex(
+    store.massifHeight,
+    mmrIndex,
+  );
+  if (expectedMassifIndex !== store.massifIndex) {
+    throw new Error(
+      `entry at mmrIndex ${mmrIndex.toString(10)} lives in massif ` +
+        `${expectedMassifIndex.toString(10)}, but this blob is massif ` +
+        `${store.massifIndex.toString(10)}`,
+    );
+  }
+
+  const proof = inclusionProof(store.get, mmrLastIndex, mmrIndex);
+  const peakIdx = peakIndexForLeafProof(mmrSize, proof.length);
+  const receiptBytes = checkpoint.peakReceipts[peakIdx];
+  if (!(receiptBytes instanceof Uint8Array)) {
+    throw new Error(
+      `checkpoint peak receipt slot ${peakIdx} is missing or not bstr`,
+    );
+  }
+
+  const receiptSign1 = requireCoseSign1(
+    unwrapCoseSign1Tag(decodeCbor(receiptBytes) as unknown),
+  );
+  const receiptUnprotected = toHeaderMap(receiptSign1[1]);
+
+  if (checkpoint.delegationCert) {
+    receiptUnprotected.set(DELEGATION_CERT_LABEL, checkpoint.delegationCert);
+  }
+
+  const inclusionProofEntry = new Map<number, unknown>([
+    [1, mmrIndex],
+    [2, proof],
+  ]);
+  const verifiableProofs = new Map<number, unknown>([
+    [-1, [inclusionProofEntry]],
+  ]);
+  receiptUnprotected.set(VDS_COSE_RECEIPT_PROOFS_TAG, verifiableProofs);
+
+  // Peak receipts are signed with detached payload; emit nil so verify uses
+  // the peak derived from the inclusion proof.
+  const assembled: CoseSign1 = [
+    receiptSign1[0],
+    receiptUnprotected,
+    null,
+    receiptSign1[3],
+  ];
+  return cborBytes(assembled);
+}
+
+export type ComputedAccumulatorPeak = {
+  /** Root computed from the massif's leaf value and rebuilt path. */
+  peak: Uint8Array;
+  /** Position of that peak in the accumulator, left to right. */
+  peakIndex: number;
+  proof: Uint8Array[];
+  leafValue: Uint8Array;
+};
+
+/**
+ * Chain-anchored variant: rebuild the inclusion path for `mmrIndex` at an
+ * externally attested tree size and compute the accumulator peak it commits
+ * to. Compare `peak` with `accumulator[peakIndex]` published by the Univocity
+ * contract (`logState`). Requires the local massif to hold nodes up to
+ * `mmrSize`.
+ */
+export async function computeAccumulatorPeak(opts: {
+  massifBytes: Uint8Array;
+  mmrIndex: bigint;
+  mmrSize: bigint;
+}): Promise<ComputedAccumulatorPeak> {
+  const { mmrIndex, mmrSize } = opts;
+  if (mmrSize <= 0n || mmrIndex >= mmrSize) {
+    throw new Error(
+      `mmrIndex ${mmrIndex.toString(10)} is not covered by tree size ` +
+        `${mmrSize.toString(10)} (entry not anchored yet?)`,
+    );
+  }
+  const store = openMassifNodeStore(opts.massifBytes);
+  const leafValue = store.get(mmrIndex);
+  const path = inclusionProof(store.get, mmrSize - 1n, mmrIndex);
+  const proof: Proof = { path, mmrIndex };
+  const peak = await calculateRoot(
+    new SubtleHasher(),
+    leafValue,
+    proof,
+    mmrIndex,
+  );
+  return {
+    peak,
+    peakIndex: peakIndexForLeafProof(mmrSize, path.length),
+    proof: path,
+    leafValue,
+  };
+}
+
+// --- helpers ---
+
+function cborBytes(value: unknown): Uint8Array {
+  const encoded = encodeCbor(value);
+  return encoded instanceof Uint8Array
+    ? encoded
+    : new Uint8Array(encoded as ArrayLike<number>);
+}
+
+/**
+ * Sealed mmr size from a format-v3 checkpoint: tree-size-2 of the consistency
+ * proof (`bstr .cbor [tree-size-1, tree-size-2, paths, right-peaks]`) under
+ * the verifiable-proofs unprotected header (label 396, key -2).
+ */
+function sealedSizeFromCheckpoint(
+  unprotected: Map<number, unknown>,
+): bigint | null {
+  const vdpRaw = unprotected.get(VDS_COSE_RECEIPT_PROOFS_TAG);
+  if (vdpRaw === undefined || vdpRaw === null) return null;
+  const vdp = toHeaderMap(vdpRaw as Map<number, unknown>);
+  const proofBstr = vdp.get(VDP_CONSISTENCY_PROOF_KEY);
+  if (!(proofBstr instanceof Uint8Array)) return null;
+  const proof = decodeCbor(proofBstr) as unknown;
+  if (!Array.isArray(proof) || proof.length < 2) return null;
+  const treeSize2 = proof[1];
+  if (typeof treeSize2 === "bigint") return treeSize2;
+  if (typeof treeSize2 === "number" && Number.isSafeInteger(treeSize2)) {
+    return BigInt(treeSize2);
+  }
+  return null;
+}

package/src/index.ts

@@ -6,6 +6,23 @@ export type {
 export type { Grant } from "@forestrie/encoding";
 export type { VerifyGrantReceiptOfflineInput } from "./verify-grant-receipt-offline.js";
 export { parseReceipt } from "./parse-receipt.js";
+export type {
+  BuildReceiptOfflineInput,
+  ComputedAccumulatorPeak,
+  MassifNodeStore,
+  ParsedCheckpoint,
+} from "./build-receipt-offline.js";
+export {
+  buildReceiptOffline,
+  computeAccumulatorPeak,
+  openMassifNodeStore,
+  parseCheckpoint,
+} from "./build-receipt-offline.js";
+/**
+ * MMR proof math now lives in @forestrie/merklelog (plan-2607-15 §4 hoist);
+ * re-exported here to preserve the receipt-verify public surface.
+ */
+export { peakMMRIndexes } from "@forestrie/merklelog";
 export { decodeTrustRootFromGenesis } from "./decode-trust-root-from-genesis.js";
 export { verifyGrantReceiptOffline } from "./verify-grant-receipt-offline.js";
 export { decodeForestrieGrantCose } from "./decode-forestrie-grant-cose.js";

package/src/parse-receipt.ts

@@ -3,14 +3,14 @@ import type { Proof } from "@forestrie/merklelog";
 
 const VDS_COSE_RECEIPT_PROOFS_TAG = 396;
 
-type CoseSign1 = [
+export type CoseSign1 = [
   protectedHeader: Uint8Array,
   unprotectedHeader: Map<number, unknown> | Record<string, unknown>,
   payload: Uint8Array | null,
   signature: Uint8Array,
 ];
 
-function unwrapCoseSign1Tag(value: unknown): unknown {
+export function unwrapCoseSign1Tag(value: unknown): unknown {
   if (value && typeof value === "object" && !(value instanceof Map)) {
     const tagged = value as { tag?: number; value?: unknown };
     if (
@@ -23,7 +23,7 @@ function unwrapCoseSign1Tag(value: unknown): unknown {
   return value;
 }
 
-function requireCoseSign1(value: unknown): CoseSign1 {
+export function requireCoseSign1(value: unknown): CoseSign1 {
   if (!Array.isArray(value) || value.length !== 4) {
     throw new Error("Receipt is not a COSE Sign1 array");
   }
@@ -42,7 +42,7 @@ function requireCoseSign1(value: unknown): CoseSign1 {
   ] as CoseSign1;
 }
 
-function toHeaderMap(
+export function toHeaderMap(
   value: Map<number, unknown> | Record<string, unknown>,
 ): Map<number, unknown> {
   if (value instanceof Map) return value as Map<number, unknown>;