@forestrie/receipt-verify 0.6.1 → 0.6.3

package/dist/index.d.ts

@@ -14,6 +14,17 @@ export { peakMMRIndexes } from "@forestrie/merklelog";
 export { decodeTrustRootFromGenesis } from "./decode-trust-root-from-genesis.js";
 export { verifyGrantReceiptOffline } from "./verify-grant-receipt-offline.js";
 export { verifyReceiptOffline } from "./verify-grant-receipt-offline.js";
+/**
+ * Caller-supplied trust anchors (FOR-297 "known log key"): verify offline
+ * under keys the caller trusts out of band instead of the genesis trust root.
+ * See the trust-ladder notes on verifyReceiptOfflineWithKeys.
+ */
+export { verifyGrantReceiptOfflineWithKeys, verifyReceiptOfflineWithKeys, } from "./verify-grant-receipt-offline.js";
+export type { VerifyGrantReceiptOfflineWithKeysInput, VerifyReceiptOfflineWithKeysInput, } from "./verify-grant-receipt-offline.js";
+export { resolveDelegatedVerifyKey } from "./resolve-delegated-verify-key.js";
+export type { DelegatedResolution } from "./resolve-delegated-verify-key.js";
+/** Import a raw 64-byte x||y P-256 public key as an ES256 verify key. */
+export { importEs256PublicKeyFromGrantDataXy64 } from "./decode-trust-root-cbor.js";
 export { decodeForestrieGrantCose } from "./decode-forestrie-grant-cose.js";
 export { decodeGrantPayload, decodeGrantResponse } from "./grant-codec.js";
 /** Deterministic receipt construction (plan-2607-12 Phase 2, FOR-353). */

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,oFAAoF;AACpF,YAAY,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,YAAY,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AACxF,YAAY,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EACV,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE3E,0EAA0E;AAC1E,OAAO,EACL,cAAc,EACd,iDAAiD,GAClD,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC7E,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,6EAA6E;AAC7E,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,oEAAoE;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,8EAA8E;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,oFAAoF;AACpF,YAAY,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,YAAY,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AACxF,YAAY,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EACV,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE;;;;GAIG;AACH,OAAO,EACL,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,sCAAsC,EACtC,iCAAiC,GAClC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,YAAY,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,yEAAyE;AACzE,OAAO,EAAE,qCAAqC,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE3E,0EAA0E;AAC1E,OAAO,EACL,cAAc,EACd,iDAAiD,GAClD,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC7E,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,6EAA6E;AAC7E,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,oEAAoE;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,8EAA8E;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/index.js

@@ -8,6 +8,15 @@ export { peakMMRIndexes } from "@forestrie/merklelog";
 export { decodeTrustRootFromGenesis } from "./decode-trust-root-from-genesis.js";
 export { verifyGrantReceiptOffline } from "./verify-grant-receipt-offline.js";
 export { verifyReceiptOffline } from "./verify-grant-receipt-offline.js";
+/**
+ * Caller-supplied trust anchors (FOR-297 "known log key"): verify offline
+ * under keys the caller trusts out of band instead of the genesis trust root.
+ * See the trust-ladder notes on verifyReceiptOfflineWithKeys.
+ */
+export { verifyGrantReceiptOfflineWithKeys, verifyReceiptOfflineWithKeys, } from "./verify-grant-receipt-offline.js";
+export { resolveDelegatedVerifyKey } from "./resolve-delegated-verify-key.js";
+/** Import a raw 64-byte x||y P-256 public key as an ES256 verify key. */
+export { importEs256PublicKeyFromGrantDataXy64 } from "./decode-trust-root-cbor.js";
 export { decodeForestrieGrantCose } from "./decode-forestrie-grant-cose.js";
 export { decodeGrantPayload, decodeGrantResponse } from "./grant-codec.js";
 /** Deterministic receipt construction (plan-2607-12 Phase 2, FOR-353). */

package/dist/resolve-delegated-verify-key.d.ts

@@ -10,6 +10,16 @@
  * sealer delegate keys are always secp256r1. KS256-rooted delegation is a
  * server-only concern.
  *
+ * Trust anchors (FOR-297 trust ladder): `rootKeys` need not be genesis-derived
+ * — a caller-known log OWNER key works identically (see
+ * `verifyReceiptOfflineWithKeys`), because the certificate issuer for a child
+ * log IS its owner. What differs is why you trust the keys: genesis-derived
+ * keys prove the key↔log binding from the bootstrap; a caller-known key merely
+ * asserts it (provenance of the key is the only defence, and there is no grant
+ * lifecycle visibility or split-view protection). The grant-chain walk
+ * (approach A, open) will derive per-log owner keys from genesis + public
+ * tiles, closing that gap without key distribution.
+ *
  * Note (parity with the server port source): this establishes that the root
  * authorized the delegated key, but does NOT yet enforce the certificate's MMR
  * window or expiry-at-issuance against the leaf — that hardening is shared with

package/dist/resolve-delegated-verify-key.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-delegated-verify-key.d.ts","sourceRoot":"","sources":["../src/resolve-delegated-verify-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAuBH;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,YAAY,EAAE,SAAS,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAqEvB;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,UAAU,EACvB,QAAQ,EAAE,SAAS,EAAE,GACpB,OAAO,CAAC,mBAAmB,CAAC,CA4B9B"}
+{"version":3,"file":"resolve-delegated-verify-key.d.ts","sourceRoot":"","sources":["../src/resolve-delegated-verify-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAuBH;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,YAAY,EAAE,SAAS,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAqEvB;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,UAAU,EACvB,QAAQ,EAAE,SAAS,EAAE,GACpB,OAAO,CAAC,mBAAmB,CAAC,CA4B9B"}

package/dist/resolve-delegated-verify-key.js

@@ -10,6 +10,16 @@
  * sealer delegate keys are always secp256r1. KS256-rooted delegation is a
  * server-only concern.
  *
+ * Trust anchors (FOR-297 trust ladder): `rootKeys` need not be genesis-derived
+ * — a caller-known log OWNER key works identically (see
+ * `verifyReceiptOfflineWithKeys`), because the certificate issuer for a child
+ * log IS its owner. What differs is why you trust the keys: genesis-derived
+ * keys prove the key↔log binding from the bootstrap; a caller-known key merely
+ * asserts it (provenance of the key is the only defence, and there is no grant
+ * lifecycle visibility or split-view protection). The grant-chain walk
+ * (approach A, open) will derive per-log owner keys from genesis + public
+ * tiles, closing that gap without key distribution.
+ *
  * Note (parity with the server port source): this establishes that the root
  * authorized the delegated key, but does NOT yet enforce the certificate's MMR
  * window or expiry-at-issuance against the leaf — that hardening is shared with

package/dist/verify-grant-receipt-offline.d.ts

@@ -10,6 +10,16 @@ export type VerifyGrantReceiptOfflineInput = {
  * Offline grant receipt verify (layers A–C, ADR-0045). Pure over bytes; no network.
  */
 export declare function verifyGrantReceiptOffline(input: VerifyGrantReceiptOfflineInput): Promise<ReceiptVerifyResult>;
+export type VerifyGrantReceiptOfflineWithKeysInput = Omit<VerifyGrantReceiptOfflineInput, "genesisCbor"> & {
+    /** Caller-known ES256 trust keys — see {@link VerifyReceiptOfflineWithKeysInput}. */
+    trustKeys: CryptoKey[];
+};
+/**
+ * {@link verifyGrantReceiptOffline} under caller-supplied trust keys instead of
+ * the genesis trust root — see {@link verifyReceiptOfflineWithKeys} for the
+ * trust model this buys (and what it does not).
+ */
+export declare function verifyGrantReceiptOfflineWithKeys(input: VerifyGrantReceiptOfflineWithKeysInput): Promise<ReceiptVerifyResult>;
 export type VerifyReceiptOfflineInput = {
     genesisCbor: Uint8Array;
     receiptCbor: Uint8Array;
@@ -30,4 +40,31 @@ export type VerifyReceiptOfflineInput = {
  * resolution, inclusion, and signature are all standard.
  */
 export declare function verifyReceiptOffline(input: VerifyReceiptOfflineInput): Promise<ReceiptVerifyResult>;
+export type VerifyReceiptOfflineWithKeysInput = Omit<VerifyReceiptOfflineInput, "genesisCbor"> & {
+    /**
+     * Caller-known ES256 trust keys, tried in order. For a child-log receipt
+     * this is the log OWNER's key (the delegation-cert issuer), NOT the sealer
+     * key — the label-1000 cert is verified under these keys and the delegated
+     * sealer key is extracted from it, so the anchor survives sealer rotation.
+     */
+    trustKeys: CryptoKey[];
+};
+/**
+ * {@link verifyReceiptOffline} under caller-supplied trust keys instead of the
+ * genesis trust root (FOR-297 "known log key"). Standard SCITT relying-party
+ * posture: the caller obtained the log owner's key out of band and trusts it.
+ *
+ * Trust ladder — what this rung gives up relative to its neighbours:
+ * - Known log key (this entry): fully offline, but the "key K owns log L"
+ *   binding is ASSERTED by the caller's key provenance, not proven; no grant
+ *   lifecycle/expiry visibility; no split-view protection.
+ * - Grant-chain walk (approach A, open): derives the binding from
+ *   `genesis.cbor` + public tiles and adds lifecycle visibility.
+ * - Chain-anchored (live or cached accumulator): adds split-view protection —
+ *   the contract-enforced on-chain accumulator is the strongest anchor.
+ *
+ * Do NOT fetch the trust key from the log operator's API or tile store — that
+ * silently reintroduces the operator trust this entry exists to remove.
+ */
+export declare function verifyReceiptOfflineWithKeys(input: VerifyReceiptOfflineWithKeysInput): Promise<ReceiptVerifyResult>;
 //# sourceMappingURL=verify-grant-receipt-offline.d.ts.map

package/dist/verify-grant-receipt-offline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify-grant-receipt-offline.d.ts","sourceRoot":"","sources":["../src/verify-grant-receipt-offline.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAOjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAGtE,MAAM,MAAM,8BAA8B,GAAG;IAC3C,WAAW,EAAE,UAAU,CAAC;IACxB,WAAW,EAAE,UAAU,CAAC;IACxB,KAAK,EAAE,KAAK,CAAC;IACb,cAAc,EAAE,UAAU,CAAC;CAC5B,CAAC;AA4EF;;GAEG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,mBAAmB,CAAC,CAc9B;AAED,MAAM,MAAM,yBAAyB,GAAG;IACtC,WAAW,EAAE,UAAU,CAAC;IACxB,WAAW,EAAE,UAAU,CAAC;IACxB;;;;;OAKG;IACH,OAAO,EAAE,UAAU,CAAC;IACpB,cAAc,EAAE,UAAU,CAAC;CAC5B,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,mBAAmB,CAAC,CAa9B"}
+{"version":3,"file":"verify-grant-receipt-offline.d.ts","sourceRoot":"","sources":["../src/verify-grant-receipt-offline.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAOjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAGtE,MAAM,MAAM,8BAA8B,GAAG;IAC3C,WAAW,EAAE,UAAU,CAAC;IACxB,WAAW,EAAE,UAAU,CAAC;IACxB,KAAK,EAAE,KAAK,CAAC;IACb,cAAc,EAAE,UAAU,CAAC;CAC5B,CAAC;AA4EF;;GAEG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,mBAAmB,CAAC,CAc9B;AAED,MAAM,MAAM,sCAAsC,GAAG,IAAI,CACvD,8BAA8B,EAC9B,aAAa,CACd,GAAG;IACF,qFAAqF;IACrF,SAAS,EAAE,SAAS,EAAE,CAAC;CACxB,CAAC;AAEF;;;;GAIG;AACH,wBAAsB,iCAAiC,CACrD,KAAK,EAAE,sCAAsC,GAC5C,OAAO,CAAC,mBAAmB,CAAC,CAa9B;AAED,MAAM,MAAM,yBAAyB,GAAG;IACtC,WAAW,EAAE,UAAU,CAAC;IACxB,WAAW,EAAE,UAAU,CAAC;IACxB;;;;;OAKG;IACH,OAAO,EAAE,UAAU,CAAC;IACpB,cAAc,EAAE,UAAU,CAAC;CAC5B,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,mBAAmB,CAAC,CAa9B;AAED,MAAM,MAAM,iCAAiC,GAAG,IAAI,CAClD,yBAAyB,EACzB,aAAa,CACd,GAAG;IACF;;;;;OAKG;IACH,SAAS,EAAE,SAAS,EAAE,CAAC;CACxB,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,iCAAiC,GACvC,OAAO,CAAC,mBAAmB,CAAC,CAa9B"}

package/dist/verify-grant-receipt-offline.js

@@ -74,6 +74,26 @@ export async function verifyGrantReceiptOffline(input) {
         inner,
     });
 }
+/**
+ * {@link verifyGrantReceiptOffline} under caller-supplied trust keys instead of
+ * the genesis trust root — see {@link verifyReceiptOfflineWithKeys} for the
+ * trust model this buys (and what it does not).
+ */
+export async function verifyGrantReceiptOfflineWithKeys(input) {
+    let inner;
+    try {
+        inner = await grantCommitmentHashFromGrant(input.grant);
+    }
+    catch {
+        return { ok: false, stage: "binding", reason: "grant_invalid" };
+    }
+    return verifyReceiptOfflineWithLeafInnerKeys({
+        receiptCbor: input.receiptCbor,
+        idtimestampBe8: input.idtimestampBe8,
+        inner,
+        trustKeys: input.trustKeys,
+    });
+}
 /**
  * Offline verify of a receipt against the EXACT registered payload. The log
  * leaf commits `SHA-256(idtimestamp ‖ SHA-256(payload))`; this is the standard,
@@ -90,6 +110,32 @@ export async function verifyReceiptOffline(input) {
         inner,
     });
 }
+/**
+ * {@link verifyReceiptOffline} under caller-supplied trust keys instead of the
+ * genesis trust root (FOR-297 "known log key"). Standard SCITT relying-party
+ * posture: the caller obtained the log owner's key out of band and trusts it.
+ *
+ * Trust ladder — what this rung gives up relative to its neighbours:
+ * - Known log key (this entry): fully offline, but the "key K owns log L"
+ *   binding is ASSERTED by the caller's key provenance, not proven; no grant
+ *   lifecycle/expiry visibility; no split-view protection.
+ * - Grant-chain walk (approach A, open): derives the binding from
+ *   `genesis.cbor` + public tiles and adds lifecycle visibility.
+ * - Chain-anchored (live or cached accumulator): adds split-view protection —
+ *   the contract-enforced on-chain accumulator is the strongest anchor.
+ *
+ * Do NOT fetch the trust key from the log operator's API or tile store — that
+ * silently reintroduces the operator trust this entry exists to remove.
+ */
+export async function verifyReceiptOfflineWithKeys(input) {
+    const inner = new Uint8Array(await crypto.subtle.digest("SHA-256", input.payload));
+    return verifyReceiptOfflineWithLeafInnerKeys({
+        receiptCbor: input.receiptCbor,
+        idtimestampBe8: input.idtimestampBe8,
+        inner,
+        trustKeys: input.trustKeys,
+    });
+}
 /**
  * Shared offline-verify core: reconstruct the leaf as
  * `univocityLeafHash(idtimestamp, inner)`, resolve the (possibly delegated,
@@ -98,13 +144,6 @@ export async function verifyReceiptOffline(input) {
  * commitment for a grant leaf, or `SHA-256(statement)` for a statement leaf.
  */
 async function verifyReceiptOfflineWithLeafInner(input) {
-    let parsed;
-    try {
-        parsed = parseReceipt(input.receiptCbor);
-    }
-    catch {
-        return { ok: false, stage: "parse", reason: "receipt_malformed" };
-    }
     let trustRoot;
     try {
         trustRoot = await decodeTrustRootFromGenesis(input.genesisCbor);
@@ -116,18 +155,41 @@ async function verifyReceiptOfflineWithLeafInner(input) {
     if (!verifyKeys.length) {
         return { ok: false, stage: "signature", reason: "no_es256_trust_key" };
     }
+    return verifyReceiptOfflineWithLeafInnerKeys({
+        receiptCbor: input.receiptCbor,
+        idtimestampBe8: input.idtimestampBe8,
+        inner: input.inner,
+        trustKeys: verifyKeys,
+    });
+}
+/**
+ * Trust-key-parameterised offline-verify core. Identical to the genesis path
+ * once the trust keys are in hand: resolve the (possibly delegated, FOR-297)
+ * verify key against `trustKeys`, then check signature + inclusion.
+ */
+async function verifyReceiptOfflineWithLeafInnerKeys(input) {
+    let parsed;
+    try {
+        parsed = parseReceipt(input.receiptCbor);
+    }
+    catch {
+        return { ok: false, stage: "parse", reason: "receipt_malformed" };
+    }
+    if (!input.trustKeys.length) {
+        return { ok: false, stage: "signature", reason: "no_es256_trust_key" };
+    }
     // FOR-297: when the receipt was signed by a DELEGATED key, verify the
-    // label-1000 delegation certificate under the root and try the delegated key
-    // first. A cert present but not chaining to the root is a hard failure — do
-    // not silently fall back to the root key (which cannot verify a
-    // delegated-signed receipt anyway).
-    const delegation = await resolveDelegatedVerifyKey(input.receiptCbor, verifyKeys);
+    // label-1000 delegation certificate under the trust keys and try the
+    // delegated key first. A cert present but not chaining to a trust key is a
+    // hard failure — do not silently fall back to the trust key (which cannot
+    // verify a delegated-signed receipt anyway).
+    const delegation = await resolveDelegatedVerifyKey(input.receiptCbor, input.trustKeys);
     if (delegation.kind === "broken") {
         return { ok: false, stage: "signature", reason: "delegation_invalid" };
     }
     const allVerifyKeys = delegation.kind === "resolved"
-        ? [delegation.delegatedKey, ...verifyKeys]
-        : verifyKeys;
+        ? [delegation.delegatedKey, ...input.trustKeys]
+        : input.trustKeys;
     let idtimestamp;
     try {
         idtimestamp = readIdtimestampBe8(input.idtimestampBe8);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forestrie/receipt-verify",
-  "version": "0.6.1",
+  "version": "0.6.3",
   "license": "MIT",
   "type": "module",
   "description": "Offline SCITT grant receipt verification (ADR-0045)",
@@ -28,7 +28,7 @@
   ],
   "dependencies": {
     "@noble/hashes": "^1.7.1",
-    "@forestrie/encoding": "0.3.0",
+    "@forestrie/encoding": "0.5.0",
     "@forestrie/merklelog": "0.1.1"
   },
   "devDependencies": {

package/src/index.ts

@@ -27,6 +27,23 @@ export { peakMMRIndexes } from "@forestrie/merklelog";
 export { decodeTrustRootFromGenesis } from "./decode-trust-root-from-genesis.js";
 export { verifyGrantReceiptOffline } from "./verify-grant-receipt-offline.js";
 export { verifyReceiptOffline } from "./verify-grant-receipt-offline.js";
+/**
+ * Caller-supplied trust anchors (FOR-297 "known log key"): verify offline
+ * under keys the caller trusts out of band instead of the genesis trust root.
+ * See the trust-ladder notes on verifyReceiptOfflineWithKeys.
+ */
+export {
+  verifyGrantReceiptOfflineWithKeys,
+  verifyReceiptOfflineWithKeys,
+} from "./verify-grant-receipt-offline.js";
+export type {
+  VerifyGrantReceiptOfflineWithKeysInput,
+  VerifyReceiptOfflineWithKeysInput,
+} from "./verify-grant-receipt-offline.js";
+export { resolveDelegatedVerifyKey } from "./resolve-delegated-verify-key.js";
+export type { DelegatedResolution } from "./resolve-delegated-verify-key.js";
+/** Import a raw 64-byte x||y P-256 public key as an ES256 verify key. */
+export { importEs256PublicKeyFromGrantDataXy64 } from "./decode-trust-root-cbor.js";
 export { decodeForestrieGrantCose } from "./decode-forestrie-grant-cose.js";
 export { decodeGrantPayload, decodeGrantResponse } from "./grant-codec.js";
 

package/src/resolve-delegated-verify-key.ts

@@ -10,6 +10,16 @@
  * sealer delegate keys are always secp256r1. KS256-rooted delegation is a
  * server-only concern.
  *
+ * Trust anchors (FOR-297 trust ladder): `rootKeys` need not be genesis-derived
+ * — a caller-known log OWNER key works identically (see
+ * `verifyReceiptOfflineWithKeys`), because the certificate issuer for a child
+ * log IS its owner. What differs is why you trust the keys: genesis-derived
+ * keys prove the key↔log binding from the bootstrap; a caller-known key merely
+ * asserts it (provenance of the key is the only defence, and there is no grant
+ * lifecycle visibility or split-view protection). The grant-chain walk
+ * (approach A, open) will derive per-log owner keys from genesis + public
+ * tiles, closing that gap without key distribution.
+ *
  * Note (parity with the server port source): this establishes that the root
  * authorized the delegated key, but does NOT yet enforce the certificate's MMR
  * window or expiry-at-issuance against the leaf — that hardening is shared with

package/src/verify-grant-receipt-offline.ts

@@ -116,6 +116,36 @@ export async function verifyGrantReceiptOffline(
   });
 }
 
+export type VerifyGrantReceiptOfflineWithKeysInput = Omit<
+  VerifyGrantReceiptOfflineInput,
+  "genesisCbor"
+> & {
+  /** Caller-known ES256 trust keys — see {@link VerifyReceiptOfflineWithKeysInput}. */
+  trustKeys: CryptoKey[];
+};
+
+/**
+ * {@link verifyGrantReceiptOffline} under caller-supplied trust keys instead of
+ * the genesis trust root — see {@link verifyReceiptOfflineWithKeys} for the
+ * trust model this buys (and what it does not).
+ */
+export async function verifyGrantReceiptOfflineWithKeys(
+  input: VerifyGrantReceiptOfflineWithKeysInput,
+): Promise<ReceiptVerifyResult> {
+  let inner: Uint8Array;
+  try {
+    inner = await grantCommitmentHashFromGrant(input.grant);
+  } catch {
+    return { ok: false, stage: "binding", reason: "grant_invalid" };
+  }
+  return verifyReceiptOfflineWithLeafInnerKeys({
+    receiptCbor: input.receiptCbor,
+    idtimestampBe8: input.idtimestampBe8,
+    inner,
+    trustKeys: input.trustKeys,
+  });
+}
+
 export type VerifyReceiptOfflineInput = {
   genesisCbor: Uint8Array;
   receiptCbor: Uint8Array;
@@ -153,6 +183,53 @@ export async function verifyReceiptOffline(
   });
 }
 
+export type VerifyReceiptOfflineWithKeysInput = Omit<
+  VerifyReceiptOfflineInput,
+  "genesisCbor"
+> & {
+  /**
+   * Caller-known ES256 trust keys, tried in order. For a child-log receipt
+   * this is the log OWNER's key (the delegation-cert issuer), NOT the sealer
+   * key — the label-1000 cert is verified under these keys and the delegated
+   * sealer key is extracted from it, so the anchor survives sealer rotation.
+   */
+  trustKeys: CryptoKey[];
+};
+
+/**
+ * {@link verifyReceiptOffline} under caller-supplied trust keys instead of the
+ * genesis trust root (FOR-297 "known log key"). Standard SCITT relying-party
+ * posture: the caller obtained the log owner's key out of band and trusts it.
+ *
+ * Trust ladder — what this rung gives up relative to its neighbours:
+ * - Known log key (this entry): fully offline, but the "key K owns log L"
+ *   binding is ASSERTED by the caller's key provenance, not proven; no grant
+ *   lifecycle/expiry visibility; no split-view protection.
+ * - Grant-chain walk (approach A, open): derives the binding from
+ *   `genesis.cbor` + public tiles and adds lifecycle visibility.
+ * - Chain-anchored (live or cached accumulator): adds split-view protection —
+ *   the contract-enforced on-chain accumulator is the strongest anchor.
+ *
+ * Do NOT fetch the trust key from the log operator's API or tile store — that
+ * silently reintroduces the operator trust this entry exists to remove.
+ */
+export async function verifyReceiptOfflineWithKeys(
+  input: VerifyReceiptOfflineWithKeysInput,
+): Promise<ReceiptVerifyResult> {
+  const inner = new Uint8Array(
+    await crypto.subtle.digest(
+      "SHA-256",
+      input.payload as unknown as BufferSource,
+    ),
+  );
+  return verifyReceiptOfflineWithLeafInnerKeys({
+    receiptCbor: input.receiptCbor,
+    idtimestampBe8: input.idtimestampBe8,
+    inner,
+    trustKeys: input.trustKeys,
+  });
+}
+
 /**
  * Shared offline-verify core: reconstruct the leaf as
  * `univocityLeafHash(idtimestamp, inner)`, resolve the (possibly delegated,
@@ -166,13 +243,6 @@ async function verifyReceiptOfflineWithLeafInner(input: {
   idtimestampBe8: Uint8Array;
   inner: Uint8Array;
 }): Promise<ReceiptVerifyResult> {
-  let parsed: ReturnType<typeof parseReceipt>;
-  try {
-    parsed = parseReceipt(input.receiptCbor);
-  } catch {
-    return { ok: false, stage: "parse", reason: "receipt_malformed" };
-  }
-
   let trustRoot;
   try {
     trustRoot = await decodeTrustRootFromGenesis(input.genesisCbor);
@@ -185,22 +255,52 @@ async function verifyReceiptOfflineWithLeafInner(input: {
     return { ok: false, stage: "signature", reason: "no_es256_trust_key" };
   }
 
+  return verifyReceiptOfflineWithLeafInnerKeys({
+    receiptCbor: input.receiptCbor,
+    idtimestampBe8: input.idtimestampBe8,
+    inner: input.inner,
+    trustKeys: verifyKeys,
+  });
+}
+
+/**
+ * Trust-key-parameterised offline-verify core. Identical to the genesis path
+ * once the trust keys are in hand: resolve the (possibly delegated, FOR-297)
+ * verify key against `trustKeys`, then check signature + inclusion.
+ */
+async function verifyReceiptOfflineWithLeafInnerKeys(input: {
+  receiptCbor: Uint8Array;
+  idtimestampBe8: Uint8Array;
+  inner: Uint8Array;
+  trustKeys: CryptoKey[];
+}): Promise<ReceiptVerifyResult> {
+  let parsed: ReturnType<typeof parseReceipt>;
+  try {
+    parsed = parseReceipt(input.receiptCbor);
+  } catch {
+    return { ok: false, stage: "parse", reason: "receipt_malformed" };
+  }
+
+  if (!input.trustKeys.length) {
+    return { ok: false, stage: "signature", reason: "no_es256_trust_key" };
+  }
+
   // FOR-297: when the receipt was signed by a DELEGATED key, verify the
-  // label-1000 delegation certificate under the root and try the delegated key
-  // first. A cert present but not chaining to the root is a hard failure — do
-  // not silently fall back to the root key (which cannot verify a
-  // delegated-signed receipt anyway).
+  // label-1000 delegation certificate under the trust keys and try the
+  // delegated key first. A cert present but not chaining to a trust key is a
+  // hard failure — do not silently fall back to the trust key (which cannot
+  // verify a delegated-signed receipt anyway).
   const delegation = await resolveDelegatedVerifyKey(
     input.receiptCbor,
-    verifyKeys,
+    input.trustKeys,
   );
   if (delegation.kind === "broken") {
     return { ok: false, stage: "signature", reason: "delegation_invalid" };
   }
   const allVerifyKeys =
     delegation.kind === "resolved"
-      ? [delegation.delegatedKey, ...verifyKeys]
-      : verifyKeys;
+      ? [delegation.delegatedKey, ...input.trustKeys]
+      : input.trustKeys;
 
   let idtimestamp: bigint;
   try {