@forestrie/receipt-verify 0.4.0 → 0.5.1

package/dist/build-receipt-offline.d.ts

@@ -14,22 +14,15 @@
  * at an externally attested tree size (e.g. Univocity `logState` on Base
  * Sepolia) and compare the computed peak with the published accumulator.
  */
+import { openMassifNodeStore, type MassifNodeStore } from "@forestrie/merklelog";
 import { type CoseSign1 } from "./parse-receipt.js";
-export type MassifNodeStore = {
-    /** 32-byte node at MMR index `i` (log data or ancestor peak stack). */
-    get(i: bigint): Uint8Array;
-    massifHeight: number;
-    massifIndex: bigint;
-    firstIndex: bigint;
-    /** Last MMR index with log data in this massif blob. */
-    lastIndex: bigint;
-};
 /**
- * Open a v2 massif blob for MMR node reads. Nodes below `firstIndex` resolve
- * through the ancestor peak stack; nodes above `lastIndex` are not present in
- * this blob and throw.
+ * Re-exported for compatibility. The MMR proof math and massif node store now
+ * live in `@forestrie/merklelog` (plan-2607-15 §4, phase 2); receipt-verify
+ * keeps only the COSE-shaped layer below.
  */
-export declare function openMassifNodeStore(massifBytes: Uint8Array): MassifNodeStore;
+export { openMassifNodeStore };
+export type { MassifNodeStore };
 export type ParsedCheckpoint = {
     coseSign1: CoseSign1;
     unprotected: Map<number, unknown>;
@@ -73,6 +66,4 @@ export declare function computeAccumulatorPeak(opts: {
     mmrIndex: bigint;
     mmrSize: bigint;
 }): Promise<ComputedAccumulatorPeak>;
-/** MMR indices of the peaks of the tree ending at `mmrIndex` (inclusive). */
-export declare function peakMMRIndexes(mmrIndex: bigint): bigint[];
 //# sourceMappingURL=build-receipt-offline.d.ts.map

package/dist/build-receipt-offline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-receipt-offline.d.ts","sourceRoot":"","sources":["../src/build-receipt-offline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AASH,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,oBAAoB,CAAC;AAW5B,MAAM,MAAM,eAAe,GAAG;IAC5B,uEAAuE;IACvE,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAAC;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,UAAU,GAAG,eAAe,CA8C5E;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,SAAS,CAAC;IACrB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,oEAAoE;IACpE,YAAY,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC/B,wEAAwE;IACxE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,cAAc,EAAE,UAAU,GAAG,IAAI,CAAC;CACnC,CAAC;AAEF,wDAAwD;AACxD,wBAAgB,eAAe,CAAC,eAAe,EAAE,UAAU,GAAG,gBAAgB,CAqB7E;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,WAAW,EAAE,UAAU,CAAC;IACxB,eAAe,EAAE,UAAU,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,wBAAwB,GAC9B,UAAU,CA2EZ;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,mEAAmE;IACnE,IAAI,EAAE,UAAU,CAAC;IACjB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,SAAS,EAAE,UAAU,CAAC;CACvB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,WAAW,EAAE,UAAU,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAwBnC;AA2ID,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAczD"}
+{"version":3,"file":"build-receipt-offline.d.ts","sourceRoot":"","sources":["../src/build-receipt-offline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,OAAO,EAIL,mBAAmB,EAEnB,KAAK,eAAe,EAErB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,oBAAoB,CAAC;AAQ5B;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAC/B,YAAY,EAAE,eAAe,EAAE,CAAC;AAEhC,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,SAAS,CAAC;IACrB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,oEAAoE;IACpE,YAAY,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC/B,wEAAwE;IACxE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,cAAc,EAAE,UAAU,GAAG,IAAI,CAAC;CACnC,CAAC;AAEF,wDAAwD;AACxD,wBAAgB,eAAe,CAAC,eAAe,EAAE,UAAU,GAAG,gBAAgB,CAqB7E;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,WAAW,EAAE,UAAU,CAAC;IACxB,eAAe,EAAE,UAAU,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,wBAAwB,GAC9B,UAAU,CA2EZ;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,mEAAmE;IACnE,IAAI,EAAE,UAAU,CAAC;IACjB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,SAAS,EAAE,UAAU,CAAC;CACvB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,WAAW,EAAE,UAAU,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAwBnC"}

package/dist/build-receipt-offline.js

@@ -14,63 +14,23 @@
  * at an externally attested tree size (e.g. Univocity `logState` on Base
  * Sepolia) and compare the computed peak with the published accumulator.
  */
-import { decode as decodeCbor, encode as encodeCbor } from "cbor-x";
-import { calculateRoot, Massif, peakStackEnd, } from "@forestrie/merklelog";
+import { decodeCborDeterministic, encodeCborDeterministic, } from "@forestrie/encoding";
+import { calculateRoot, inclusionProof, massifIndexFromMMRIndex, openMassifNodeStore, peakIndexForLeafProof, } from "@forestrie/merklelog";
 import { requireCoseSign1, toHeaderMap, unwrapCoseSign1Tag, } from "./parse-receipt.js";
 import { SubtleHasher } from "./subtle-hasher.js";
 const VDS_COSE_RECEIPT_PROOFS_TAG = 396;
 const SEAL_PEAK_RECEIPTS_LABEL = -65931;
 const DELEGATION_CERT_LABEL = 1000;
 const VDP_CONSISTENCY_PROOF_KEY = -2;
-const VALUE_BYTES = 32n;
-const MAX_MMR_HEIGHT = 64n;
 /**
- * Open a v2 massif blob for MMR node reads. Nodes below `firstIndex` resolve
- * through the ancestor peak stack; nodes above `lastIndex` are not present in
- * this blob and throw.
+ * Re-exported for compatibility. The MMR proof math and massif node store now
+ * live in `@forestrie/merklelog` (plan-2607-15 §4, phase 2); receipt-verify
+ * keeps only the COSE-shaped layer below.
  */
-export function openMassifNodeStore(massifBytes) {
-    const massif = new Massif(massifBytes);
-    const start = massif.getStart();
-    const massifHeight = start.massifHeight;
-    if (!Number.isInteger(massifHeight) ||
-        massifHeight < 1 ||
-        massifHeight > 64) {
-        throw new Error(`massif header has invalid height ${massifHeight}`);
-    }
-    const massifIndex = BigInt(start.massifIndex);
-    const firstIndex = start.firstIndex;
-    const logStart = peakStackEnd(massifHeight);
-    const peakStackStart = logStart - MAX_MMR_HEIGHT * VALUE_BYTES;
-    const blobLen = BigInt(massifBytes.byteLength);
-    if (blobLen < logStart) {
-        throw new Error("massif blob too short for v2 layout");
-    }
-    const logNodeCount = (blobLen - logStart) / VALUE_BYTES;
-    const lastIndex = firstIndex + logNodeCount - 1n;
-    const stackMap = peakStackMapForMassif(massifHeight, firstIndex);
-    const get = (i) => {
-        if (i >= firstIndex) {
-            if (i > lastIndex) {
-                throw new Error(`mmr index ${i.toString(10)} is beyond this massif's log data ` +
-                    `(last ${lastIndex.toString(10)}); local content does not cover ` +
-                    `the requested tree size`);
-            }
-            const off = logStart + (i - firstIndex) * VALUE_BYTES;
-            return slice32(massifBytes, off, "log-data");
-        }
-        const peakIdx = stackMap.get(i);
-        if (peakIdx === undefined) {
-            throw new Error(`missing ancestor peak for mmr index ${i.toString(10)}`);
-        }
-        const off = peakStackStart + BigInt(peakIdx) * VALUE_BYTES;
-        return slice32(massifBytes, off, "peak-stack");
-    };
-    return { get, massifHeight, massifIndex, firstIndex, lastIndex };
-}
+export { openMassifNodeStore };
 /** Parse a format-v3 checkpoint (`.sth`) COSE Sign1. */
 export function parseCheckpoint(checkpointBytes) {
-    const decoded = decodeCbor(checkpointBytes);
+    const decoded = decodeCborDeterministic(checkpointBytes);
     const coseSign1 = requireCoseSign1(unwrapCoseSign1Tag(decoded));
     const unprotected = toHeaderMap(coseSign1[1]);
     const peakReceiptsRaw = unprotected.get(SEAL_PEAK_RECEIPTS_LABEL);
@@ -124,7 +84,7 @@ export function buildReceiptOffline(input) {
     if (!(receiptBytes instanceof Uint8Array)) {
         throw new Error(`checkpoint peak receipt slot ${peakIdx} is missing or not bstr`);
     }
-    const receiptSign1 = requireCoseSign1(unwrapCoseSign1Tag(decodeCbor(receiptBytes)));
+    const receiptSign1 = requireCoseSign1(unwrapCoseSign1Tag(decodeCborDeterministic(receiptBytes)));
     const receiptUnprotected = toHeaderMap(receiptSign1[1]);
     if (checkpoint.delegationCert) {
         receiptUnprotected.set(DELEGATION_CERT_LABEL, checkpoint.delegationCert);
@@ -174,17 +134,7 @@ export async function computeAccumulatorPeak(opts) {
 }
 // --- helpers ---
 function cborBytes(value) {
-    const encoded = encodeCbor(value);
-    return encoded instanceof Uint8Array
-        ? encoded
-        : new Uint8Array(encoded);
-}
-function slice32(buf, offset, label) {
-    if (offset < 0n || offset + 32n > BigInt(buf.byteLength)) {
-        throw new Error(`out of range read for ${label}: off=${offset.toString(10)}`);
-    }
-    const start = Number(offset);
-    return buf.slice(start, start + 32);
+    return encodeCborDeterministic(value);
 }
 /**
  * Sealed mmr size from a format-v3 checkpoint: tree-size-2 of the consistency
@@ -199,7 +149,7 @@ function sealedSizeFromCheckpoint(unprotected) {
     const proofBstr = vdp.get(VDP_CONSISTENCY_PROOF_KEY);
     if (!(proofBstr instanceof Uint8Array))
         return null;
-    const proof = decodeCbor(proofBstr);
+    const proof = decodeCborDeterministic(proofBstr);
     if (!Array.isArray(proof) || proof.length < 2)
         return null;
     const treeSize2 = proof[1];
@@ -210,144 +160,3 @@ function sealedSizeFromCheckpoint(unprotected) {
     }
     return null;
 }
-// --- MMR index math (ported from go-merklelog/mmr, mirrors resolve-receipt) ---
-function bitLength(num) {
-    if (num === 0n)
-        return 0;
-    return num.toString(2).length;
-}
-function allOnes(num) {
-    return num > 0n && (num & (num + 1n)) === 0n;
-}
-function jumpLeftPerfect(pos) {
-    const bl = bitLength(pos);
-    if (bl === 0)
-        return pos;
-    const msb = 1n << BigInt(bl - 1);
-    return pos - (msb - 1n);
-}
-function posHeight(pos) {
-    let current = pos;
-    while (!allOnes(current)) {
-        current = jumpLeftPerfect(current);
-    }
-    return bitLength(current) - 1;
-}
-function indexHeight(i) {
-    return posHeight(i + 1n);
-}
-function inclusionProof(getNode, mmrLastIndex, i) {
-    if (i > mmrLastIndex) {
-        throw new Error("index out of range");
-    }
-    let g = BigInt(indexHeight(i));
-    const proof = [];
-    while (true) {
-        const siblingOffset = 2n << g;
-        let iSibling;
-        if (BigInt(indexHeight(i + 1n)) > g) {
-            iSibling = i - siblingOffset + 1n;
-            i += 1n;
-        }
-        else {
-            iSibling = i + siblingOffset - 1n;
-            i += siblingOffset;
-        }
-        if (iSibling > mmrLastIndex) {
-            return proof;
-        }
-        proof.push(getNode(iSibling));
-        g += 1n;
-    }
-}
-function peaksBitmap(mmrSize) {
-    if (mmrSize === 0n)
-        return 0n;
-    let pos = mmrSize;
-    let peakSize = (1n << BigInt(bitLength(mmrSize))) - 1n;
-    let peakMap = 0n;
-    while (peakSize > 0n) {
-        peakMap <<= 1n;
-        if (pos >= peakSize) {
-            pos -= peakSize;
-            peakMap |= 1n;
-        }
-        peakSize >>= 1n;
-    }
-    return peakMap;
-}
-function popcount64(x) {
-    let count = 0;
-    let v = x;
-    while (v > 0n) {
-        if ((v & 1n) === 1n)
-            count += 1;
-        v >>= 1n;
-    }
-    return count;
-}
-function peakIndexForLeafProof(mmrSize, proofLen) {
-    const leafCount = peaksBitmap(mmrSize);
-    const peaksMask = (1n << BigInt(proofLen + 1)) - 1n;
-    return popcount64(leafCount) - popcount64(leafCount & peaksMask);
-}
-function topPeak(i) {
-    const bl = bitLength(i + 2n);
-    return (1n << BigInt(bl - 1)) - 2n;
-}
-/** MMR indices of the peaks of the tree ending at `mmrIndex` (inclusive). */
-export function peakMMRIndexes(mmrIndex) {
-    let mmrSize = mmrIndex + 1n;
-    if (posHeight(mmrSize + 1n) > posHeight(mmrSize)) {
-        return [];
-    }
-    let peak = 0n;
-    const out = [];
-    while (mmrSize !== 0n) {
-        const peakSize = topPeak(mmrSize - 1n) + 1n;
-        peak = peak + peakSize;
-        out.push(peak - 1n);
-        mmrSize -= peakSize;
-    }
-    return out;
-}
-function peakStackMapForMassif(massifHeight, firstIndex) {
-    const map = new Map();
-    const iPeaks = peakMMRIndexes(firstIndex);
-    for (let i = 0; i < iPeaks.length; i++) {
-        const ip = iPeaks[i];
-        if (indexHeight(ip) < massifHeight - 1) {
-            continue;
-        }
-        map.set(ip, i);
-    }
-    return map;
-}
-function mmrIndexFromLeafIndex(leafIndex) {
-    let sum = 0n;
-    let current = leafIndex;
-    while (current > 0n) {
-        const h = BigInt(bitLength(current));
-        sum += (1n << h) - 1n;
-        const half = 1n << (h - 1n);
-        current -= half;
-    }
-    return sum;
-}
-function firstMMRSize(mmrIndex) {
-    let i = mmrIndex;
-    let h0 = indexHeight(i);
-    let h1 = indexHeight(i + 1n);
-    while (h0 < h1) {
-        i += 1n;
-        h0 = h1;
-        h1 = indexHeight(i + 1n);
-    }
-    return i + 1n;
-}
-function massifIndexFromMMRIndex(massifHeight, mmrIndex) {
-    const size = firstMMRSize(mmrIndex);
-    const leafIndex = peaksBitmap(size) - 1n;
-    const massifMaxLeaves = 1n << BigInt(massifHeight - 1);
-    return leafIndex / massifMaxLeaves;
-}

package/dist/decode-forestrie-grant-cose.js

@@ -1,5 +1,5 @@
 import { sha256 } from "@noble/hashes/sha256";
-import { decode as decodeCbor } from "cbor-x";
+import { decodeCborDeterministic } from "@forestrie/encoding";
 import { HEADER_FORESTRIE_GRANT_V0, HEADER_IDTIMESTAMP, } from "./forest-genesis-labels.js";
 import { decodeGrantPayload } from "./grant-codec.js";
 const IDTIMESTAMP_BYTES = 8;
@@ -31,7 +31,7 @@ function digestEquals(a, b) {
  * Decode Forestrie-Grant COSE Sign1 (Custodian transparent statement profile).
  */
 export function decodeForestrieGrantCose(bytes) {
-    const raw = decodeCbor(bytes);
+    const raw = decodeCborDeterministic(bytes);
     const arr = Array.isArray(raw) ? raw : null;
     if (!arr || arr.length !== 4) {
         throw new Error("Forestrie-Grant must be COSE Sign1 (array of 4)");

package/dist/decode-trust-root-from-genesis.js

@@ -1,4 +1,4 @@
-import { decode as decodeCbor } from "cbor-x";
+import { decodeCborDeterministic } from "@forestrie/encoding";
 import { COSE_ALG_ES256, COSE_CRV_P256, COSE_EC2_CRV, COSE_EC2_X, COSE_EC2_Y, COSE_KEY_ALG, COSE_KEY_KTY, COSE_KTY_EC2, } from "./cose-key.js";
 import { FOREST_GENESIS_LABEL_BOOTSTRAP_KEY, FOREST_GENESIS_LABEL_GENESIS_ALG, FOREST_GENESIS_LABEL_GENESIS_VERSION, FOREST_GENESIS_SCHEMA_V1, FOREST_GENESIS_SCHEMA_V2, } from "./forest-genesis-labels.js";
 import { decodeTrustRootCbor } from "./decode-trust-root-cbor.js";
@@ -26,7 +26,7 @@ function asGenesisUint8Array(v) {
 export async function decodeTrustRootFromGenesis(genesisCbor) {
     let raw;
     try {
-        raw = decodeCbor(genesisCbor);
+        raw = decodeCborDeterministic(genesisCbor);
     }
     catch {
         throw new Error("genesis CBOR decode failed");

package/dist/grant-codec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-codec.d.ts","sourceRoot":"","sources":["../src/grant-codec.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAuDjD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,KAAK,CAO3D;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,UAAU,GAAG;IACtD,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE,UAAU,CAAC;CACzB,CAsBA;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,KAAK,GAAG,UAAU,CAa3D"}
+{"version":3,"file":"grant-codec.d.ts","sourceRoot":"","sources":["../src/grant-codec.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAuDjD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,KAAK,CAO3D;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,UAAU,GAAG;IACtD,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE,UAAU,CAAC;CACzB,CAsBA;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,KAAK,GAAG,UAAU,CAa3D"}

package/dist/grant-codec.js

@@ -1,4 +1,4 @@
-import { decode as decodeCbor, encode as encodeCbor } from "cbor-x";
+import { decodeCborDeterministic, encodeCborDeterministic, } from "@forestrie/encoding";
 import { grantDataToBytes } from "@forestrie/encoding";
 import { fromPaddedWire32, toPaddedWire32 } from "./uuid-bytes.js";
 const CBOR_KEY_IDTIMESTAMP = 0;
@@ -48,14 +48,14 @@ function mapToGrant(m) {
 export function decodeGrantPayload(bytes) {
     if (!bytes?.length)
         throw new Error("Grant payload is empty");
-    const raw = decodeCbor(bytes);
+    const raw = decodeCborDeterministic(bytes);
     if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
         throw new Error("Grant payload must be a CBOR map");
     }
     return mapToGrant(raw);
 }
 export function decodeGrantResponse(bytes) {
-    const raw = decodeCbor(bytes);
+    const raw = decodeCborDeterministic(bytes);
     if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
         throw new Error("Grant response must be a CBOR map");
     }
@@ -84,5 +84,5 @@ export function encodeGrantPayload(grant) {
             grantDataToBytes(grant.grantData ?? new Uint8Array(0)),
         ],
     ]);
-    return new Uint8Array(encodeCbor(map));
+    return encodeCborDeterministic(map);
 }

package/dist/index.d.ts

@@ -4,7 +4,12 @@ export type { Grant } from "@forestrie/encoding";
 export type { VerifyGrantReceiptOfflineInput } from "./verify-grant-receipt-offline.js";
 export { parseReceipt } from "./parse-receipt.js";
 export type { BuildReceiptOfflineInput, ComputedAccumulatorPeak, MassifNodeStore, ParsedCheckpoint, } from "./build-receipt-offline.js";
-export { buildReceiptOffline, computeAccumulatorPeak, openMassifNodeStore, parseCheckpoint, peakMMRIndexes, } from "./build-receipt-offline.js";
+export { buildReceiptOffline, computeAccumulatorPeak, openMassifNodeStore, parseCheckpoint, } from "./build-receipt-offline.js";
+/**
+ * MMR proof math now lives in @forestrie/merklelog (plan-2607-15 §4 hoist);
+ * re-exported here to preserve the receipt-verify public surface.
+ */
+export { peakMMRIndexes } from "@forestrie/merklelog";
 export { decodeTrustRootFromGenesis } from "./decode-trust-root-from-genesis.js";
 export { verifyGrantReceiptOffline } from "./verify-grant-receipt-offline.js";
 export { decodeForestrieGrantCose } from "./decode-forestrie-grant-cose.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,oFAAoF;AACpF,YAAY,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,YAAY,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EACV,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,EACf,cAAc,GACf,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE3E,0EAA0E;AAC1E,OAAO,EACL,cAAc,EACd,iDAAiD,GAClD,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC7E,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,oFAAoF;AACpF,YAAY,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,YAAY,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EACV,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE3E,0EAA0E;AAC1E,OAAO,EACL,cAAc,EACd,iDAAiD,GAClD,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC7E,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -1,5 +1,10 @@
 export { parseReceipt } from "./parse-receipt.js";
-export { buildReceiptOffline, computeAccumulatorPeak, openMassifNodeStore, parseCheckpoint, peakMMRIndexes, } from "./build-receipt-offline.js";
+export { buildReceiptOffline, computeAccumulatorPeak, openMassifNodeStore, parseCheckpoint, } from "./build-receipt-offline.js";
+/**
+ * MMR proof math now lives in @forestrie/merklelog (plan-2607-15 §4 hoist);
+ * re-exported here to preserve the receipt-verify public surface.
+ */
+export { peakMMRIndexes } from "@forestrie/merklelog";
 export { decodeTrustRootFromGenesis } from "./decode-trust-root-from-genesis.js";
 export { verifyGrantReceiptOffline } from "./verify-grant-receipt-offline.js";
 export { decodeForestrieGrantCose } from "./decode-forestrie-grant-cose.js";

package/dist/parse-receipt.js

@@ -1,4 +1,4 @@
-import { decode as decodeCbor } from "cbor-x";
+import { decodeCborDeterministic } from "@forestrie/encoding";
 const VDS_COSE_RECEIPT_PROOFS_TAG = 396;
 export function unwrapCoseSign1Tag(value) {
     if (value && typeof value === "object" && !(value instanceof Map)) {
@@ -42,7 +42,7 @@ export function toHeaderMap(value) {
     return out;
 }
 export function parseReceipt(receiptBytes) {
-    const decoded = decodeCbor(receiptBytes);
+    const decoded = decodeCborDeterministic(receiptBytes);
     const unwrapped = unwrapCoseSign1Tag(decoded);
     requireCoseSign1(unwrapped);
     const coseSign1 = requireCoseSign1(unwrapped);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forestrie/receipt-verify",
-  "version": "0.4.0",
+  "version": "0.5.1",
   "license": "MIT",
   "type": "module",
   "description": "Offline SCITT grant receipt verification (ADR-0045)",
@@ -28,9 +28,8 @@
   ],
   "dependencies": {
     "@noble/hashes": "^1.7.1",
-    "cbor-x": "^1.5.9",
-    "@forestrie/encoding": "0.2.0",
-    "@forestrie/merklelog": "0.0.3"
+    "@forestrie/merklelog": "0.1.0",
+    "@forestrie/encoding": "0.3.0"
   },
   "devDependencies": {
     "esbuild": "^0.24.0",

package/src/build-receipt-offline.ts

@@ -15,11 +15,17 @@
  * Sepolia) and compare the computed peak with the published accumulator.
  */
 
-import { decode as decodeCbor, encode as encodeCbor } from "cbor-x";
+import {
+  decodeCborDeterministic,
+  encodeCborDeterministic,
+} from "@forestrie/encoding";
 import {
   calculateRoot,
-  Massif,
-  peakStackEnd,
+  inclusionProof,
+  massifIndexFromMMRIndex,
+  openMassifNodeStore,
+  peakIndexForLeafProof,
+  type MassifNodeStore,
   type Proof,
 } from "@forestrie/merklelog";
 import {
@@ -35,71 +41,13 @@ const SEAL_PEAK_RECEIPTS_LABEL = -65931;
 const DELEGATION_CERT_LABEL = 1000;
 const VDP_CONSISTENCY_PROOF_KEY = -2;
 
-const VALUE_BYTES = 32n;
-const MAX_MMR_HEIGHT = 64n;
-
-export type MassifNodeStore = {
-  /** 32-byte node at MMR index `i` (log data or ancestor peak stack). */
-  get(i: bigint): Uint8Array;
-  massifHeight: number;
-  massifIndex: bigint;
-  firstIndex: bigint;
-  /** Last MMR index with log data in this massif blob. */
-  lastIndex: bigint;
-};
-
 /**
- * Open a v2 massif blob for MMR node reads. Nodes below `firstIndex` resolve
- * through the ancestor peak stack; nodes above `lastIndex` are not present in
- * this blob and throw.
+ * Re-exported for compatibility. The MMR proof math and massif node store now
+ * live in `@forestrie/merklelog` (plan-2607-15 §4, phase 2); receipt-verify
+ * keeps only the COSE-shaped layer below.
  */
-export function openMassifNodeStore(massifBytes: Uint8Array): MassifNodeStore {
-  const massif = new Massif(massifBytes);
-  const start = massif.getStart();
-  const massifHeight = start.massifHeight;
-  if (
-    !Number.isInteger(massifHeight) ||
-    massifHeight < 1 ||
-    massifHeight > 64
-  ) {
-    throw new Error(`massif header has invalid height ${massifHeight}`);
-  }
-  const massifIndex = BigInt(start.massifIndex);
-  const firstIndex = start.firstIndex;
-
-  const logStart = peakStackEnd(massifHeight);
-  const peakStackStart = logStart - MAX_MMR_HEIGHT * VALUE_BYTES;
-  const blobLen = BigInt(massifBytes.byteLength);
-  if (blobLen < logStart) {
-    throw new Error("massif blob too short for v2 layout");
-  }
-  const logNodeCount = (blobLen - logStart) / VALUE_BYTES;
-  const lastIndex = firstIndex + logNodeCount - 1n;
-
-  const stackMap = peakStackMapForMassif(massifHeight, firstIndex);
-
-  const get = (i: bigint): Uint8Array => {
-    if (i >= firstIndex) {
-      if (i > lastIndex) {
-        throw new Error(
-          `mmr index ${i.toString(10)} is beyond this massif's log data ` +
-            `(last ${lastIndex.toString(10)}); local content does not cover ` +
-            `the requested tree size`,
-        );
-      }
-      const off = logStart + (i - firstIndex) * VALUE_BYTES;
-      return slice32(massifBytes, off, "log-data");
-    }
-    const peakIdx = stackMap.get(i);
-    if (peakIdx === undefined) {
-      throw new Error(`missing ancestor peak for mmr index ${i.toString(10)}`);
-    }
-    const off = peakStackStart + BigInt(peakIdx) * VALUE_BYTES;
-    return slice32(massifBytes, off, "peak-stack");
-  };
-
-  return { get, massifHeight, massifIndex, firstIndex, lastIndex };
-}
+export { openMassifNodeStore };
+export type { MassifNodeStore };
 
 export type ParsedCheckpoint = {
   coseSign1: CoseSign1;
@@ -113,7 +61,7 @@ export type ParsedCheckpoint = {
 
 /** Parse a format-v3 checkpoint (`.sth`) COSE Sign1. */
 export function parseCheckpoint(checkpointBytes: Uint8Array): ParsedCheckpoint {
-  const decoded = decodeCbor(checkpointBytes) as unknown;
+  const decoded = decodeCborDeterministic(checkpointBytes);
   const coseSign1 = requireCoseSign1(unwrapCoseSign1Tag(decoded));
   const unprotected = toHeaderMap(coseSign1[1]);
 
@@ -198,7 +146,7 @@ export function buildReceiptOffline(
   }
 
   const receiptSign1 = requireCoseSign1(
-    unwrapCoseSign1Tag(decodeCbor(receiptBytes) as unknown),
+    unwrapCoseSign1Tag(decodeCborDeterministic(receiptBytes)),
   );
   const receiptUnprotected = toHeaderMap(receiptSign1[1]);
 
@@ -275,20 +223,7 @@ export async function computeAccumulatorPeak(opts: {
 // --- helpers ---
 
 function cborBytes(value: unknown): Uint8Array {
-  const encoded = encodeCbor(value);
-  return encoded instanceof Uint8Array
-    ? encoded
-    : new Uint8Array(encoded as ArrayLike<number>);
-}
-
-function slice32(buf: Uint8Array, offset: bigint, label: string): Uint8Array {
-  if (offset < 0n || offset + 32n > BigInt(buf.byteLength)) {
-    throw new Error(
-      `out of range read for ${label}: off=${offset.toString(10)}`,
-    );
-  }
-  const start = Number(offset);
-  return buf.slice(start, start + 32);
+  return encodeCborDeterministic(value);
 }
 
 /**
@@ -304,7 +239,7 @@ function sealedSizeFromCheckpoint(
   const vdp = toHeaderMap(vdpRaw as Map<number, unknown>);
   const proofBstr = vdp.get(VDP_CONSISTENCY_PROOF_KEY);
   if (!(proofBstr instanceof Uint8Array)) return null;
-  const proof = decodeCbor(proofBstr) as unknown;
+  const proof = decodeCborDeterministic(proofBstr);
   if (!Array.isArray(proof) || proof.length < 2) return null;
   const treeSize2 = proof[1];
   if (typeof treeSize2 === "bigint") return treeSize2;
@@ -313,165 +248,3 @@ function sealedSizeFromCheckpoint(
   }
   return null;
 }
-
-// --- MMR index math (ported from go-merklelog/mmr, mirrors resolve-receipt) ---
-
-function bitLength(num: bigint): number {
-  if (num === 0n) return 0;
-  return num.toString(2).length;
-}
-
-function allOnes(num: bigint): boolean {
-  return num > 0n && (num & (num + 1n)) === 0n;
-}
-
-function jumpLeftPerfect(pos: bigint): bigint {
-  const bl = bitLength(pos);
-  if (bl === 0) return pos;
-  const msb = 1n << BigInt(bl - 1);
-  return pos - (msb - 1n);
-}
-
-function posHeight(pos: bigint): number {
-  let current = pos;
-  while (!allOnes(current)) {
-    current = jumpLeftPerfect(current);
-  }
-  return bitLength(current) - 1;
-}
-
-function indexHeight(i: bigint): number {
-  return posHeight(i + 1n);
-}
-
-function inclusionProof(
-  getNode: (i: bigint) => Uint8Array,
-  mmrLastIndex: bigint,
-  i: bigint,
-): Uint8Array[] {
-  if (i > mmrLastIndex) {
-    throw new Error("index out of range");
-  }
-  let g = BigInt(indexHeight(i));
-  const proof: Uint8Array[] = [];
-  while (true) {
-    const siblingOffset = 2n << g;
-    let iSibling: bigint;
-    if (BigInt(indexHeight(i + 1n)) > g) {
-      iSibling = i - siblingOffset + 1n;
-      i += 1n;
-    } else {
-      iSibling = i + siblingOffset - 1n;
-      i += siblingOffset;
-    }
-    if (iSibling > mmrLastIndex) {
-      return proof;
-    }
-    proof.push(getNode(iSibling));
-    g += 1n;
-  }
-}
-
-function peaksBitmap(mmrSize: bigint): bigint {
-  if (mmrSize === 0n) return 0n;
-  let pos = mmrSize;
-  let peakSize = (1n << BigInt(bitLength(mmrSize))) - 1n;
-  let peakMap = 0n;
-  while (peakSize > 0n) {
-    peakMap <<= 1n;
-    if (pos >= peakSize) {
-      pos -= peakSize;
-      peakMap |= 1n;
-    }
-    peakSize >>= 1n;
-  }
-  return peakMap;
-}
-
-function popcount64(x: bigint): number {
-  let count = 0;
-  let v = x;
-  while (v > 0n) {
-    if ((v & 1n) === 1n) count += 1;
-    v >>= 1n;
-  }
-  return count;
-}
-
-function peakIndexForLeafProof(mmrSize: bigint, proofLen: number): number {
-  const leafCount = peaksBitmap(mmrSize);
-  const peaksMask = (1n << BigInt(proofLen + 1)) - 1n;
-  return popcount64(leafCount) - popcount64(leafCount & peaksMask);
-}
-
-function topPeak(i: bigint): bigint {
-  const bl = bitLength(i + 2n);
-  return (1n << BigInt(bl - 1)) - 2n;
-}
-
-/** MMR indices of the peaks of the tree ending at `mmrIndex` (inclusive). */
-export function peakMMRIndexes(mmrIndex: bigint): bigint[] {
-  let mmrSize = mmrIndex + 1n;
-  if (posHeight(mmrSize + 1n) > posHeight(mmrSize)) {
-    return [];
-  }
-  let peak = 0n;
-  const out: bigint[] = [];
-  while (mmrSize !== 0n) {
-    const peakSize = topPeak(mmrSize - 1n) + 1n;
-    peak = peak + peakSize;
-    out.push(peak - 1n);
-    mmrSize -= peakSize;
-  }
-  return out;
-}
-
-function peakStackMapForMassif(
-  massifHeight: number,
-  firstIndex: bigint,
-): Map<bigint, number> {
-  const map = new Map<bigint, number>();
-  const iPeaks = peakMMRIndexes(firstIndex);
-  for (let i = 0; i < iPeaks.length; i++) {
-    const ip = iPeaks[i]!;
-    if (indexHeight(ip) < massifHeight - 1) {
-      continue;
-    }
-    map.set(ip, i);
-  }
-  return map;
-}
-
-function mmrIndexFromLeafIndex(leafIndex: bigint): bigint {
-  let sum = 0n;
-  let current = leafIndex;
-  while (current > 0n) {
-    const h = BigInt(bitLength(current));
-    sum += (1n << h) - 1n;
-    const half = 1n << (h - 1n);
-    current -= half;
-  }
-  return sum;
-}
-
-function firstMMRSize(mmrIndex: bigint): bigint {
-  let i = mmrIndex;
-  let h0 = indexHeight(i);
-  let h1 = indexHeight(i + 1n);
-  while (h0 < h1) {
-    i += 1n;
-    h0 = h1;
-    h1 = indexHeight(i + 1n);
-  }
-  return i + 1n;
-}
-
-function massifIndexFromMMRIndex(
-  massifHeight: number,
-  mmrIndex: bigint,
-): bigint {
-  const size = firstMMRSize(mmrIndex);
-  const leafIndex = peaksBitmap(size) - 1n;
-  const massifMaxLeaves = 1n << BigInt(massifHeight - 1);
-  return leafIndex / massifMaxLeaves;
-}

package/src/decode-forestrie-grant-cose.ts

@@ -1,5 +1,5 @@
 import { sha256 } from "@noble/hashes/sha256";
-import { decode as decodeCbor } from "cbor-x";
+import { decodeCborDeterministic } from "@forestrie/encoding";
 import type { Grant } from "@forestrie/encoding";
 import {
   HEADER_FORESTRIE_GRANT_V0,
@@ -42,7 +42,7 @@ export function decodeForestrieGrantCose(bytes: Uint8Array): {
   grant: Grant;
   idtimestampBe8: Uint8Array;
 } {
-  const raw = decodeCbor(bytes) as unknown;
+  const raw = decodeCborDeterministic(bytes);
   const arr = Array.isArray(raw) ? raw : null;
   if (!arr || arr.length !== 4) {
     throw new Error("Forestrie-Grant must be COSE Sign1 (array of 4)");

package/src/decode-trust-root-from-genesis.ts

@@ -1,4 +1,4 @@
-import { decode as decodeCbor } from "cbor-x";
+import { decodeCborDeterministic } from "@forestrie/encoding";
 import {
   COSE_ALG_ES256,
   COSE_CRV_P256,
@@ -45,7 +45,7 @@ export async function decodeTrustRootFromGenesis(
 ): Promise<RootVerifyKey> {
   let raw: unknown;
   try {
-    raw = decodeCbor(genesisCbor);
+    raw = decodeCborDeterministic(genesisCbor);
   } catch {
     throw new Error("genesis CBOR decode failed");
   }

package/src/grant-codec.ts

@@ -1,4 +1,7 @@
-import { decode as decodeCbor, encode as encodeCbor } from "cbor-x";
+import {
+  decodeCborDeterministic,
+  encodeCborDeterministic,
+} from "@forestrie/encoding";
 import type { Grant } from "@forestrie/encoding";
 import { grantDataToBytes } from "@forestrie/encoding";
 import { fromPaddedWire32, toPaddedWire32 } from "./uuid-bytes.js";
@@ -56,7 +59,7 @@ function mapToGrant(m: Map<number, unknown> | Record<number, unknown>): Grant {
 
 export function decodeGrantPayload(bytes: Uint8Array): Grant {
   if (!bytes?.length) throw new Error("Grant payload is empty");
-  const raw = decodeCbor(bytes) as unknown;
+  const raw = decodeCborDeterministic(bytes);
   if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
     throw new Error("Grant payload must be a CBOR map");
   }
@@ -67,7 +70,7 @@ export function decodeGrantResponse(bytes: Uint8Array): {
   grant: Grant;
   idtimestamp: Uint8Array;
 } {
-  const raw = decodeCbor(bytes) as unknown;
+  const raw = decodeCborDeterministic(bytes);
   if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
     throw new Error("Grant response must be a CBOR map");
   }
@@ -102,5 +105,5 @@ export function encodeGrantPayload(grant: Grant): Uint8Array {
       grantDataToBytes(grant.grantData ?? new Uint8Array(0)),
     ],
   ]);
-  return new Uint8Array(encodeCbor(map));
+  return encodeCborDeterministic(map);
 }

package/src/index.ts

@@ -17,8 +17,12 @@ export {
   computeAccumulatorPeak,
   openMassifNodeStore,
   parseCheckpoint,
-  peakMMRIndexes,
 } from "./build-receipt-offline.js";
+/**
+ * MMR proof math now lives in @forestrie/merklelog (plan-2607-15 §4 hoist);
+ * re-exported here to preserve the receipt-verify public surface.
+ */
+export { peakMMRIndexes } from "@forestrie/merklelog";
 export { decodeTrustRootFromGenesis } from "./decode-trust-root-from-genesis.js";
 export { verifyGrantReceiptOffline } from "./verify-grant-receipt-offline.js";
 export { decodeForestrieGrantCose } from "./decode-forestrie-grant-cose.js";

package/src/parse-receipt.ts

@@ -1,4 +1,4 @@
-import { decode as decodeCbor } from "cbor-x";
+import { decodeCborDeterministic } from "@forestrie/encoding";
 import type { Proof } from "@forestrie/merklelog";
 
 const VDS_COSE_RECEIPT_PROOFS_TAG = 396;
@@ -62,7 +62,7 @@ export function parseReceipt(receiptBytes: Uint8Array): {
   receiptCbor: Uint8Array;
   coseSign1: CoseSign1;
 } {
-  const decoded = decodeCbor(receiptBytes) as unknown;
+  const decoded = decodeCborDeterministic(receiptBytes);
   const unwrapped = unwrapCoseSign1Tag(decoded);
   requireCoseSign1(unwrapped);