@forestrie/receipt-verify 0.5.0 → 0.5.1

package/dist/build-receipt-offline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-receipt-offline.d.ts","sourceRoot":"","sources":["../src/build-receipt-offline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAIL,mBAAmB,EAEnB,KAAK,eAAe,EAErB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,oBAAoB,CAAC;AAQ5B;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAC/B,YAAY,EAAE,eAAe,EAAE,CAAC;AAEhC,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,SAAS,CAAC;IACrB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,oEAAoE;IACpE,YAAY,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC/B,wEAAwE;IACxE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,cAAc,EAAE,UAAU,GAAG,IAAI,CAAC;CACnC,CAAC;AAEF,wDAAwD;AACxD,wBAAgB,eAAe,CAAC,eAAe,EAAE,UAAU,GAAG,gBAAgB,CAqB7E;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,WAAW,EAAE,UAAU,CAAC;IACxB,eAAe,EAAE,UAAU,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,wBAAwB,GAC9B,UAAU,CA2EZ;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,mEAAmE;IACnE,IAAI,EAAE,UAAU,CAAC;IACjB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,SAAS,EAAE,UAAU,CAAC;CACvB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,WAAW,EAAE,UAAU,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAwBnC"}
+{"version":3,"file":"build-receipt-offline.d.ts","sourceRoot":"","sources":["../src/build-receipt-offline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,OAAO,EAIL,mBAAmB,EAEnB,KAAK,eAAe,EAErB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,oBAAoB,CAAC;AAQ5B;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAC/B,YAAY,EAAE,eAAe,EAAE,CAAC;AAEhC,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,SAAS,CAAC;IACrB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,oEAAoE;IACpE,YAAY,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC/B,wEAAwE;IACxE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,cAAc,EAAE,UAAU,GAAG,IAAI,CAAC;CACnC,CAAC;AAEF,wDAAwD;AACxD,wBAAgB,eAAe,CAAC,eAAe,EAAE,UAAU,GAAG,gBAAgB,CAqB7E;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,WAAW,EAAE,UAAU,CAAC;IACxB,eAAe,EAAE,UAAU,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,wBAAwB,GAC9B,UAAU,CA2EZ;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,mEAAmE;IACnE,IAAI,EAAE,UAAU,CAAC;IACjB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,SAAS,EAAE,UAAU,CAAC;CACvB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,WAAW,EAAE,UAAU,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAwBnC"}

package/dist/build-receipt-offline.js

@@ -14,7 +14,7 @@
  * at an externally attested tree size (e.g. Univocity `logState` on Base
  * Sepolia) and compare the computed peak with the published accumulator.
  */
-import { decode as decodeCbor, encode as encodeCbor } from "cbor-x";
+import { decodeCborDeterministic, encodeCborDeterministic, } from "@forestrie/encoding";
 import { calculateRoot, inclusionProof, massifIndexFromMMRIndex, openMassifNodeStore, peakIndexForLeafProof, } from "@forestrie/merklelog";
 import { requireCoseSign1, toHeaderMap, unwrapCoseSign1Tag, } from "./parse-receipt.js";
 import { SubtleHasher } from "./subtle-hasher.js";
@@ -30,7 +30,7 @@ const VDP_CONSISTENCY_PROOF_KEY = -2;
 export { openMassifNodeStore };
 /** Parse a format-v3 checkpoint (`.sth`) COSE Sign1. */
 export function parseCheckpoint(checkpointBytes) {
-    const decoded = decodeCbor(checkpointBytes);
+    const decoded = decodeCborDeterministic(checkpointBytes);
     const coseSign1 = requireCoseSign1(unwrapCoseSign1Tag(decoded));
     const unprotected = toHeaderMap(coseSign1[1]);
     const peakReceiptsRaw = unprotected.get(SEAL_PEAK_RECEIPTS_LABEL);
@@ -84,7 +84,7 @@ export function buildReceiptOffline(input) {
     if (!(receiptBytes instanceof Uint8Array)) {
         throw new Error(`checkpoint peak receipt slot ${peakIdx} is missing or not bstr`);
     }
-    const receiptSign1 = requireCoseSign1(unwrapCoseSign1Tag(decodeCbor(receiptBytes)));
+    const receiptSign1 = requireCoseSign1(unwrapCoseSign1Tag(decodeCborDeterministic(receiptBytes)));
     const receiptUnprotected = toHeaderMap(receiptSign1[1]);
     if (checkpoint.delegationCert) {
         receiptUnprotected.set(DELEGATION_CERT_LABEL, checkpoint.delegationCert);
@@ -134,10 +134,7 @@ export async function computeAccumulatorPeak(opts) {
 }
 // --- helpers ---
 function cborBytes(value) {
-    const encoded = encodeCbor(value);
-    return encoded instanceof Uint8Array
-        ? encoded
-        : new Uint8Array(encoded);
+    return encodeCborDeterministic(value);
 }
 /**
  * Sealed mmr size from a format-v3 checkpoint: tree-size-2 of the consistency
@@ -152,7 +149,7 @@ function sealedSizeFromCheckpoint(unprotected) {
     const proofBstr = vdp.get(VDP_CONSISTENCY_PROOF_KEY);
     if (!(proofBstr instanceof Uint8Array))
         return null;
-    const proof = decodeCbor(proofBstr);
+    const proof = decodeCborDeterministic(proofBstr);
     if (!Array.isArray(proof) || proof.length < 2)
         return null;
     const treeSize2 = proof[1];

package/dist/decode-forestrie-grant-cose.js

@@ -1,5 +1,5 @@
 import { sha256 } from "@noble/hashes/sha256";
-import { decode as decodeCbor } from "cbor-x";
+import { decodeCborDeterministic } from "@forestrie/encoding";
 import { HEADER_FORESTRIE_GRANT_V0, HEADER_IDTIMESTAMP, } from "./forest-genesis-labels.js";
 import { decodeGrantPayload } from "./grant-codec.js";
 const IDTIMESTAMP_BYTES = 8;
@@ -31,7 +31,7 @@ function digestEquals(a, b) {
  * Decode Forestrie-Grant COSE Sign1 (Custodian transparent statement profile).
  */
 export function decodeForestrieGrantCose(bytes) {
-    const raw = decodeCbor(bytes);
+    const raw = decodeCborDeterministic(bytes);
     const arr = Array.isArray(raw) ? raw : null;
     if (!arr || arr.length !== 4) {
         throw new Error("Forestrie-Grant must be COSE Sign1 (array of 4)");

package/dist/decode-trust-root-from-genesis.js

@@ -1,4 +1,4 @@
-import { decode as decodeCbor } from "cbor-x";
+import { decodeCborDeterministic } from "@forestrie/encoding";
 import { COSE_ALG_ES256, COSE_CRV_P256, COSE_EC2_CRV, COSE_EC2_X, COSE_EC2_Y, COSE_KEY_ALG, COSE_KEY_KTY, COSE_KTY_EC2, } from "./cose-key.js";
 import { FOREST_GENESIS_LABEL_BOOTSTRAP_KEY, FOREST_GENESIS_LABEL_GENESIS_ALG, FOREST_GENESIS_LABEL_GENESIS_VERSION, FOREST_GENESIS_SCHEMA_V1, FOREST_GENESIS_SCHEMA_V2, } from "./forest-genesis-labels.js";
 import { decodeTrustRootCbor } from "./decode-trust-root-cbor.js";
@@ -26,7 +26,7 @@ function asGenesisUint8Array(v) {
 export async function decodeTrustRootFromGenesis(genesisCbor) {
     let raw;
     try {
-        raw = decodeCbor(genesisCbor);
+        raw = decodeCborDeterministic(genesisCbor);
     }
     catch {
         throw new Error("genesis CBOR decode failed");

package/dist/grant-codec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-codec.d.ts","sourceRoot":"","sources":["../src/grant-codec.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAuDjD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,KAAK,CAO3D;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,UAAU,GAAG;IACtD,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE,UAAU,CAAC;CACzB,CAsBA;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,KAAK,GAAG,UAAU,CAa3D"}
+{"version":3,"file":"grant-codec.d.ts","sourceRoot":"","sources":["../src/grant-codec.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAuDjD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,KAAK,CAO3D;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,UAAU,GAAG;IACtD,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE,UAAU,CAAC;CACzB,CAsBA;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,KAAK,GAAG,UAAU,CAa3D"}

package/dist/grant-codec.js

@@ -1,4 +1,4 @@
-import { decode as decodeCbor, encode as encodeCbor } from "cbor-x";
+import { decodeCborDeterministic, encodeCborDeterministic, } from "@forestrie/encoding";
 import { grantDataToBytes } from "@forestrie/encoding";
 import { fromPaddedWire32, toPaddedWire32 } from "./uuid-bytes.js";
 const CBOR_KEY_IDTIMESTAMP = 0;
@@ -48,14 +48,14 @@ function mapToGrant(m) {
 export function decodeGrantPayload(bytes) {
     if (!bytes?.length)
         throw new Error("Grant payload is empty");
-    const raw = decodeCbor(bytes);
+    const raw = decodeCborDeterministic(bytes);
     if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
         throw new Error("Grant payload must be a CBOR map");
     }
     return mapToGrant(raw);
 }
 export function decodeGrantResponse(bytes) {
-    const raw = decodeCbor(bytes);
+    const raw = decodeCborDeterministic(bytes);
     if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
         throw new Error("Grant response must be a CBOR map");
     }
@@ -84,5 +84,5 @@ export function encodeGrantPayload(grant) {
             grantDataToBytes(grant.grantData ?? new Uint8Array(0)),
         ],
     ]);
-    return new Uint8Array(encodeCbor(map));
+    return encodeCborDeterministic(map);
 }

package/dist/parse-receipt.js

@@ -1,4 +1,4 @@
-import { decode as decodeCbor } from "cbor-x";
+import { decodeCborDeterministic } from "@forestrie/encoding";
 const VDS_COSE_RECEIPT_PROOFS_TAG = 396;
 export function unwrapCoseSign1Tag(value) {
     if (value && typeof value === "object" && !(value instanceof Map)) {
@@ -42,7 +42,7 @@ export function toHeaderMap(value) {
     return out;
 }
 export function parseReceipt(receiptBytes) {
-    const decoded = decodeCbor(receiptBytes);
+    const decoded = decodeCborDeterministic(receiptBytes);
     const unwrapped = unwrapCoseSign1Tag(decoded);
     requireCoseSign1(unwrapped);
     const coseSign1 = requireCoseSign1(unwrapped);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forestrie/receipt-verify",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "license": "MIT",
   "type": "module",
   "description": "Offline SCITT grant receipt verification (ADR-0045)",
@@ -28,9 +28,8 @@
   ],
   "dependencies": {
     "@noble/hashes": "^1.7.1",
-    "cbor-x": "^1.5.9",
     "@forestrie/merklelog": "0.1.0",
-    "@forestrie/encoding": "0.2.0"
+    "@forestrie/encoding": "0.3.0"
   },
   "devDependencies": {
     "esbuild": "^0.24.0",

package/src/build-receipt-offline.ts

@@ -15,7 +15,10 @@
  * Sepolia) and compare the computed peak with the published accumulator.
  */
 
-import { decode as decodeCbor, encode as encodeCbor } from "cbor-x";
+import {
+  decodeCborDeterministic,
+  encodeCborDeterministic,
+} from "@forestrie/encoding";
 import {
   calculateRoot,
   inclusionProof,
@@ -58,7 +61,7 @@ export type ParsedCheckpoint = {
 
 /** Parse a format-v3 checkpoint (`.sth`) COSE Sign1. */
 export function parseCheckpoint(checkpointBytes: Uint8Array): ParsedCheckpoint {
-  const decoded = decodeCbor(checkpointBytes) as unknown;
+  const decoded = decodeCborDeterministic(checkpointBytes);
   const coseSign1 = requireCoseSign1(unwrapCoseSign1Tag(decoded));
   const unprotected = toHeaderMap(coseSign1[1]);
 
@@ -143,7 +146,7 @@ export function buildReceiptOffline(
   }
 
   const receiptSign1 = requireCoseSign1(
-    unwrapCoseSign1Tag(decodeCbor(receiptBytes) as unknown),
+    unwrapCoseSign1Tag(decodeCborDeterministic(receiptBytes)),
   );
   const receiptUnprotected = toHeaderMap(receiptSign1[1]);
 
@@ -220,10 +223,7 @@ export async function computeAccumulatorPeak(opts: {
 // --- helpers ---
 
 function cborBytes(value: unknown): Uint8Array {
-  const encoded = encodeCbor(value);
-  return encoded instanceof Uint8Array
-    ? encoded
-    : new Uint8Array(encoded as ArrayLike<number>);
+  return encodeCborDeterministic(value);
 }
 
 /**
@@ -239,7 +239,7 @@ function sealedSizeFromCheckpoint(
   const vdp = toHeaderMap(vdpRaw as Map<number, unknown>);
   const proofBstr = vdp.get(VDP_CONSISTENCY_PROOF_KEY);
   if (!(proofBstr instanceof Uint8Array)) return null;
-  const proof = decodeCbor(proofBstr) as unknown;
+  const proof = decodeCborDeterministic(proofBstr);
   if (!Array.isArray(proof) || proof.length < 2) return null;
   const treeSize2 = proof[1];
   if (typeof treeSize2 === "bigint") return treeSize2;

package/src/decode-forestrie-grant-cose.ts

@@ -1,5 +1,5 @@
 import { sha256 } from "@noble/hashes/sha256";
-import { decode as decodeCbor } from "cbor-x";
+import { decodeCborDeterministic } from "@forestrie/encoding";
 import type { Grant } from "@forestrie/encoding";
 import {
   HEADER_FORESTRIE_GRANT_V0,
@@ -42,7 +42,7 @@ export function decodeForestrieGrantCose(bytes: Uint8Array): {
   grant: Grant;
   idtimestampBe8: Uint8Array;
 } {
-  const raw = decodeCbor(bytes) as unknown;
+  const raw = decodeCborDeterministic(bytes);
   const arr = Array.isArray(raw) ? raw : null;
   if (!arr || arr.length !== 4) {
     throw new Error("Forestrie-Grant must be COSE Sign1 (array of 4)");

package/src/decode-trust-root-from-genesis.ts

@@ -1,4 +1,4 @@
-import { decode as decodeCbor } from "cbor-x";
+import { decodeCborDeterministic } from "@forestrie/encoding";
 import {
   COSE_ALG_ES256,
   COSE_CRV_P256,
@@ -45,7 +45,7 @@ export async function decodeTrustRootFromGenesis(
 ): Promise<RootVerifyKey> {
   let raw: unknown;
   try {
-    raw = decodeCbor(genesisCbor);
+    raw = decodeCborDeterministic(genesisCbor);
   } catch {
     throw new Error("genesis CBOR decode failed");
   }

package/src/grant-codec.ts

@@ -1,4 +1,7 @@
-import { decode as decodeCbor, encode as encodeCbor } from "cbor-x";
+import {
+  decodeCborDeterministic,
+  encodeCborDeterministic,
+} from "@forestrie/encoding";
 import type { Grant } from "@forestrie/encoding";
 import { grantDataToBytes } from "@forestrie/encoding";
 import { fromPaddedWire32, toPaddedWire32 } from "./uuid-bytes.js";
@@ -56,7 +59,7 @@ function mapToGrant(m: Map<number, unknown> | Record<number, unknown>): Grant {
 
 export function decodeGrantPayload(bytes: Uint8Array): Grant {
   if (!bytes?.length) throw new Error("Grant payload is empty");
-  const raw = decodeCbor(bytes) as unknown;
+  const raw = decodeCborDeterministic(bytes);
   if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
     throw new Error("Grant payload must be a CBOR map");
   }
@@ -67,7 +70,7 @@ export function decodeGrantResponse(bytes: Uint8Array): {
   grant: Grant;
   idtimestamp: Uint8Array;
 } {
-  const raw = decodeCbor(bytes) as unknown;
+  const raw = decodeCborDeterministic(bytes);
   if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
     throw new Error("Grant response must be a CBOR map");
   }
@@ -102,5 +105,5 @@ export function encodeGrantPayload(grant: Grant): Uint8Array {
       grantDataToBytes(grant.grantData ?? new Uint8Array(0)),
     ],
   ]);
-  return new Uint8Array(encodeCbor(map));
+  return encodeCborDeterministic(map);
 }

package/src/parse-receipt.ts

@@ -1,4 +1,4 @@
-import { decode as decodeCbor } from "cbor-x";
+import { decodeCborDeterministic } from "@forestrie/encoding";
 import type { Proof } from "@forestrie/merklelog";
 
 const VDS_COSE_RECEIPT_PROOFS_TAG = 396;
@@ -62,7 +62,7 @@ export function parseReceipt(receiptBytes: Uint8Array): {
   receiptCbor: Uint8Array;
   coseSign1: CoseSign1;
 } {
-  const decoded = decodeCbor(receiptBytes) as unknown;
+  const decoded = decodeCborDeterministic(receiptBytes);
   const unwrapped = unwrapCoseSign1Tag(decoded);
   requireCoseSign1(unwrapped);