@forestrie/receipt-verify 0.9.0 → 0.11.0

package/dist/index.d.ts

@@ -24,8 +24,8 @@ export { verifyReceiptOffline } from "./verify-grant-receipt-offline.js";
  */
 export { verifyGrantReceiptOfflineWithKeys, verifyReceiptOfflineWithKeys, } from "./verify-grant-receipt-offline.js";
 export type { VerifyGrantReceiptOfflineWithKeysInput, VerifyReceiptOfflineWithKeysInput, } from "./verify-grant-receipt-offline.js";
-export { resolveDelegatedVerifyKey } from "./resolve-delegated-verify-key.js";
-export type { DelegatedResolution } from "./resolve-delegated-verify-key.js";
+export { checkDelegationConstraints, idtimestampToUnixSeconds, resolveDelegatedVerifyKey, } from "./resolve-delegated-verify-key.js";
+export type { DelegatedResolution, DelegationConstraints, } from "./resolve-delegated-verify-key.js";
 /** Import a raw 64-byte x||y P-256 public key as an ES256 verify key. */
 export { importEs256PublicKeyFromGrantDataXy64 } from "./decode-trust-root-cbor.js";
 export { decodeForestrieGrantCose } from "./decode-forestrie-grant-cose.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,oFAAoF;AACpF,YAAY,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,YAAY,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AACxF,YAAY,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EACV,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC,+EAA+E;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EACV,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE;;;;GAIG;AACH,OAAO,EACL,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,sCAAsC,EACtC,iCAAiC,GAClC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,YAAY,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,yEAAyE;AACzE,OAAO,EAAE,qCAAqC,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE3E,0EAA0E;AAC1E,OAAO,EACL,cAAc,EACd,iDAAiD,GAClD,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC7E,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,6EAA6E;AAC7E,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,oEAAoE;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,8EAA8E;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,4BAA4B,EAC5B,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,GAChC,MAAM,uBAAuB,CAAC;AAC/B;;;;;GAKG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD;;;;;;GAMG;AACH,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,2CAA2C,EAC3C,KAAK,gBAAgB,GACtB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,oFAAoF;AACpF,YAAY,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,YAAY,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AACxF,YAAY,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EACV,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC,+EAA+E;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EACV,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE;;;;GAIG;AACH,OAAO,EACL,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,sCAAsC,EACtC,iCAAiC,GAClC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,0BAA0B,EAC1B,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,mCAAmC,CAAC;AAC3C,yEAAyE;AACzE,OAAO,EAAE,qCAAqC,EAAE,MAAM,6BAA6B,CAAC;AACpF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE3E,0EAA0E;AAC1E,OAAO,EACL,cAAc,EACd,iDAAiD,GAClD,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC7E,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,6EAA6E;AAC7E,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,oEAAoE;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,8EAA8E;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,4BAA4B,EAC5B,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,GAChC,MAAM,uBAAuB,CAAC;AAC/B;;;;;GAKG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD;;;;;;GAMG;AACH,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,2CAA2C,EAC3C,KAAK,gBAAgB,GACtB,MAAM,wBAAwB,CAAC"}

package/dist/index.js

@@ -16,7 +16,7 @@ export { verifyReceiptOffline } from "./verify-grant-receipt-offline.js";
  * See the trust-ladder notes on verifyReceiptOfflineWithKeys.
  */
 export { verifyGrantReceiptOfflineWithKeys, verifyReceiptOfflineWithKeys, } from "./verify-grant-receipt-offline.js";
-export { resolveDelegatedVerifyKey } from "./resolve-delegated-verify-key.js";
+export { checkDelegationConstraints, idtimestampToUnixSeconds, resolveDelegatedVerifyKey, } from "./resolve-delegated-verify-key.js";
 /** Import a raw 64-byte x||y P-256 public key as an ES256 verify key. */
 export { importEs256PublicKeyFromGrantDataXy64 } from "./decode-trust-root-cbor.js";
 export { decodeForestrieGrantCose } from "./decode-forestrie-grant-cose.js";

package/dist/known-accumulator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"known-accumulator.d.ts","sourceRoot":"","sources":["../src/known-accumulator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAWH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAoCtE,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,SAAS,EAAE,UAAU,CAAC;IACtB,gEAAgE;IAChE,KAAK,EAAE,UAAU,CAAC;IAClB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,SAAS,EAAE,UAAU,CAAC;CACvB,CAAC;AAEF,yEAAyE;AACzE,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,UAAU,CAa7E;AAgBD,+DAA+D;AAC/D,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,UAAU,GAAG,gBAAgB,CAgC1E;AAMD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,gBAAgB,EAC1B,IAAI,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GACnE,IAAI,CAiBN;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,2CAA2C,CAAC,KAAK,EAAE;IACvE,WAAW,EAAE,UAAU,CAAC;IACxB,cAAc,EAAE,UAAU,CAAC;IAC3B,uEAAuE;IACvE,KAAK,EAAE,UAAU,CAAC;IAClB,2DAA2D;IAC3D,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA4C/B"}
+{"version":3,"file":"known-accumulator.d.ts","sourceRoot":"","sources":["../src/known-accumulator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAWH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAsCtE,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,SAAS,EAAE,UAAU,CAAC;IACtB,gEAAgE;IAChE,KAAK,EAAE,UAAU,CAAC;IAClB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,kEAAkE;IAClE,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,qEAAqE;IACrE,SAAS,EAAE,UAAU,CAAC;CACvB,CAAC;AAEF,yEAAyE;AACzE,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,gBAAgB,GAAG,UAAU,CAa7E;AAgBD,+DAA+D;AAC/D,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,UAAU,GAAG,gBAAgB,CAgC1E;AAMD;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,gBAAgB,EAC1B,IAAI,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GACnE,IAAI,CAiBN;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,2CAA2C,CAAC,KAAK,EAAE;IACvE,WAAW,EAAE,UAAU,CAAC;IACxB,cAAc,EAAE,UAAU,CAAC;IAC3B,uEAAuE;IACvE,KAAK,EAAE,UAAU,CAAC;IAClB,2DAA2D;IAC3D,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;CACd,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAiD/B"}

package/dist/resolve-delegated-verify-key.d.ts

@@ -6,9 +6,12 @@
  * trust root and returns the delegated public key as an additional verify
  * candidate — the offline port of canopy-api's `resolveReceiptVerifyKey`.
  *
- * ES256 (P-256) only: the offline verifier is ES256-only (genesis alg), and
- * sealer delegate keys are always secp256r1. KS256-rooted delegation is a
- * server-only concern.
+ * P-256 roots only: the genesis alg is ES256 and sealer delegate keys are
+ * always secp256r1; KS256-rooted delegation is a server-only concern. A
+ * passkey (WebAuthn) root signs the certificate with alg -65800 and the
+ * ADR-0063 unprotected-header envelope — `verifyCoseSign1WithParsedKey`
+ * verifies that envelope against the same P-256 root keys, so the chain walk
+ * here is alg-agnostic (plan-2608-13 1.4).
  *
  * Trust anchors (FOR-297 trust ladder): `rootKeys` need not be genesis-derived
  * — a caller-known log OWNER key works identically (see
@@ -20,14 +23,34 @@
  * (approach A, open) will derive per-log owner keys from genesis + public
  * tiles, closing that gap without key distribution.
  *
- * Note (parity with the server port source): this establishes that the root
- * authorized the delegated key, but does NOT yet enforce the certificate's MMR
- * window or expiry-at-issuance against the leaf — that hardening is shared with
- * the server path and tracked separately (FOR-323).
+ * Constraint enforcement (FOR-420): the certificate authorizes the delegated
+ * key only over an MMR coverage window `[mmrStart, mmrEnd]` (payload labels 3/4)
+ * and until `expiresAt` (label 9, Unix seconds). {@link checkDelegationConstraints}
+ * enforces the soundly-offline-decidable slice against the verified leaf: the
+ * `mmrEnd` over-horizon bound (the leaf's index lower-bounds the checkpoint
+ * `treeSize-1` the on-chain `delegationVerifier.sol` binds) and expiry-at-issuance
+ * against the leaf's snowflake idtimestamp (never wall-clock — receipts must
+ * verify forever). The `mmrStart` lower bound, the exact `size-1` bound, and the
+ * `issuedAt` lower bound are NOT enforced (see that function). This replaces the
+ * earlier "does not yet enforce the window" gap.
  */
+export declare function idtimestampToUnixSeconds(idtimestamp: bigint): number;
+/**
+ * Coverage + validity window a root-signed delegation cert imposes on its
+ * delegated key. `mmrStart`/`mmrEnd` are inclusive MMR-index bounds;
+ * `issuedAt`/`expiresAt` are Unix seconds.
+ */
+export type DelegationConstraints = {
+    mmrStart: bigint;
+    mmrEnd: bigint;
+    issuedAt: number;
+    expiresAt: number;
+};
 /**
  * root-only: no delegation cert present — verify against the root keys as-is.
  * resolved: cert verified under a root key; use `delegatedKey` first.
+ *   `constraints` carries the cert's coverage/validity window when the payload
+ *   declares it (null for legacy certs that predate labels 3/4/8/9).
  * broken: a cert is present but did not verify under the root, or its delegated
  *   key could not be parsed — the delegation chain is invalid.
  */
@@ -36,9 +59,44 @@ export type DelegatedResolution = {
 } | {
     kind: "resolved";
     delegatedKey: CryptoKey;
+    constraints: DelegationConstraints | null;
 } | {
     kind: "broken";
 };
+/**
+ * Enforce a resolved cert's constraints against the verified leaf (FOR-420).
+ *
+ * Coverage: the delegation authorizes checkpoint positions `treeSize-1 ∈
+ * [mmrStart, mmrEnd]` (inclusive, `delegationVerifier.sol`). Offline we hold the
+ * verified leaf's `mmrIndex`, and `leafMmrIndex ≤ treeSize-1` (the leaf is
+ * included in the checkpoint). So `leafMmrIndex > mmrEnd` SOUNDLY implies
+ * `treeSize-1 > mmrEnd` — a key signing beyond its authorized horizon — and is
+ * rejected. The `mmrStart` lower bound is deliberately NOT enforced here: an
+ * early leaf can legitimately appear in a checkpoint whose `size-1 ≥ mmrStart`,
+ * so `leafMmrIndex < mmrStart` does not imply a violation and enforcing it would
+ * false-reject valid receipts under a narrow cert. The lower bound and the exact
+ * `size-1` upper bound need the checkpoint accumulator (absent in the single-peak
+ * offline path) — deferred; in practice lane certs are wide (`mmrStart=0`).
+ *
+ * Expiry-at-issuance: the leaf's time (from its snowflake idtimestamp) must not
+ * be AFTER the cert's `expiresAt` — a key signing past its authorized lifetime.
+ * Compared against the checkpoint/leaf time, NOT wall-clock, so a valid receipt
+ * verifies forever (the pinned FOR-297 / ADR-0050 requirement).
+ *
+ * The `issuedAt` lower bound is deliberately NOT enforced. `issuedAt` is when the
+ * cert was SIGNED; the leaf's idtimestamp is when it was SEQUENCED. On live lanes
+ * the delegation cert is signed a few seconds AFTER the leaf is sequenced (the
+ * checkpoint that includes the leaf is sealed reactively), so `issuedAt > leafTime`
+ * is normal and correct — the cert is never *used* to sign before it exists.
+ * Enforcing `issuedAt ≤ leafTime` false-rejects legitimate receipts (verified on
+ * lane A: a fresh bootstrap receipt has `issuedAt − leafTime ≈ 3s`).
+ */
+export declare function checkDelegationConstraints(constraints: DelegationConstraints, leafMmrIndex: bigint, leafIdtimestamp: bigint): {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
 /**
  * Resolve the delegated verify key from a receipt's delegation certificate.
  *

package/dist/resolve-delegated-verify-key.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-delegated-verify-key.d.ts","sourceRoot":"","sources":["../src/resolve-delegated-verify-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAuBH;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,YAAY,EAAE,SAAS,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAqEvB;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,UAAU,EACvB,QAAQ,EAAE,SAAS,EAAE,GACpB,OAAO,CAAC,mBAAmB,CAAC,CA4B9B"}
+{"version":3,"file":"resolve-delegated-verify-key.d.ts","sourceRoot":"","sources":["../src/resolve-delegated-verify-key.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAqCH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAKpE;AAED;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IACE,IAAI,EAAE,UAAU,CAAC;IACjB,YAAY,EAAE,SAAS,CAAC;IACxB,WAAW,EAAE,qBAAqB,GAAG,IAAI,CAAC;CAC3C,GACD;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAsGvB;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,0BAA0B,CACxC,WAAW,EAAE,qBAAqB,EAClC,YAAY,EAAE,MAAM,EACpB,eAAe,EAAE,MAAM,GACtB;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAS9C;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC7C,WAAW,EAAE,UAAU,EACvB,QAAQ,EAAE,SAAS,EAAE,GACpB,OAAO,CAAC,mBAAmB,CAAC,CAgC9B"}

package/dist/resolve-delegated-verify-key.js

@@ -6,9 +6,12 @@
  * trust root and returns the delegated public key as an additional verify
  * candidate — the offline port of canopy-api's `resolveReceiptVerifyKey`.
  *
- * ES256 (P-256) only: the offline verifier is ES256-only (genesis alg), and
- * sealer delegate keys are always secp256r1. KS256-rooted delegation is a
- * server-only concern.
+ * P-256 roots only: the genesis alg is ES256 and sealer delegate keys are
+ * always secp256r1; KS256-rooted delegation is a server-only concern. A
+ * passkey (WebAuthn) root signs the certificate with alg -65800 and the
+ * ADR-0063 unprotected-header envelope — `verifyCoseSign1WithParsedKey`
+ * verifies that envelope against the same P-256 root keys, so the chain walk
+ * here is alg-agnostic (plan-2608-13 1.4).
  *
  * Trust anchors (FOR-297 trust ladder): `rootKeys` need not be genesis-derived
  * — a caller-known log OWNER key works identically (see
@@ -20,10 +23,16 @@
  * (approach A, open) will derive per-log owner keys from genesis + public
  * tiles, closing that gap without key distribution.
  *
- * Note (parity with the server port source): this establishes that the root
- * authorized the delegated key, but does NOT yet enforce the certificate's MMR
- * window or expiry-at-issuance against the leaf — that hardening is shared with
- * the server path and tracked separately (FOR-323).
+ * Constraint enforcement (FOR-420): the certificate authorizes the delegated
+ * key only over an MMR coverage window `[mmrStart, mmrEnd]` (payload labels 3/4)
+ * and until `expiresAt` (label 9, Unix seconds). {@link checkDelegationConstraints}
+ * enforces the soundly-offline-decidable slice against the verified leaf: the
+ * `mmrEnd` over-horizon bound (the leaf's index lower-bounds the checkpoint
+ * `treeSize-1` the on-chain `delegationVerifier.sol` binds) and expiry-at-issuance
+ * against the leaf's snowflake idtimestamp (never wall-clock — receipts must
+ * verify forever). The `mmrStart` lower bound, the exact `size-1` bound, and the
+ * `issuedAt` lower bound are NOT enforced (see that function). This replaces the
+ * earlier "does not yet enforce the window" gap.
  */
 import { coseUnprotectedToMap, decodeCborDeterministic, decodeCoseSign1, verifyCoseSign1WithParsedKey, } from "@forestrie/encoding";
 /** Unprotected header label carrying the delegation certificate. */
@@ -35,8 +44,26 @@ const COSE_KEY_X = -2;
 const COSE_KEY_Y = -3;
 const COSE_KTY_EC2 = 2;
 const COSE_CRV_P256 = 1;
-/** Delegation-cert payload label for the delegated COSE_Key. */
+/** Delegation-cert payload labels (must match @forestrie/delegation-cose). */
+const PAYLOAD_MMR_START = 3;
+const PAYLOAD_MMR_END = 4;
 const PAYLOAD_DELEGATED_KEY = 5;
+const PAYLOAD_ISSUED_AT = 8;
+const PAYLOAD_EXPIRES_AT = 9;
+/**
+ * Snowflake idtimestamp → Unix seconds (DataTrails scheme; arbor
+ * `snowflakeid`). `TimeShift = 24`, per-epoch span `2^40 - 1` ms, current
+ * `CommitmentEpoch = 1` (next epoch ~2038). `unixMs = epoch*(2^40-1) +
+ * (id >> 24)`.
+ */
+const COMMITMENT_EPOCH = 1n;
+const SNOWFLAKE_TIME_SHIFT = 24n;
+const SNOWFLAKE_EPOCH_SPAN_MS = (1n << 40n) - 1n;
+export function idtimestampToUnixSeconds(idtimestamp) {
+    const ms = COMMITMENT_EPOCH * SNOWFLAKE_EPOCH_SPAN_MS +
+        (idtimestamp >> SNOWFLAKE_TIME_SHIFT);
+    return Number(ms / 1000n);
+}
 function extractDelegationCertBytes(unprotected) {
     const umap = coseUnprotectedToMap(unprotected);
     const certRaw = umap.get(DELEGATION_CERT_LABEL);
@@ -84,19 +111,91 @@ async function importDelegatedKey(keyMap) {
         return null;
     }
 }
-function extractDelegatedKeyFromPayload(payloadBytes) {
+function decodeCertPayloadMap(payloadBytes) {
     if (!payloadBytes || payloadBytes.length === 0)
         return null;
-    let payloadMap;
     try {
-        payloadMap = decodeCborDeterministic(payloadBytes);
+        return decodeCborDeterministic(payloadBytes);
     }
     catch {
         return null;
     }
+}
+function extractDelegatedKeyFromPayloadMap(payloadMap) {
     const get = labelGetter(payloadMap);
     return get ? get(PAYLOAD_DELEGATED_KEY) : null;
 }
+function toBigIntOrNull(v) {
+    if (typeof v === "bigint")
+        return v;
+    if (typeof v === "number" && Number.isInteger(v))
+        return BigInt(v);
+    return null;
+}
+function toNumberOrNull(v) {
+    if (typeof v === "bigint")
+        return Number(v);
+    if (typeof v === "number" && Number.isFinite(v))
+        return v;
+    return null;
+}
+/**
+ * Parse the cert's coverage/validity window from its payload map. Returns null
+ * when any of labels 3/4/8/9 is absent (legacy certs predating FOR-390 advance
+ * delegation) — enforcement is then skipped, preserving pre-constraint trust.
+ */
+function parseDelegationConstraints(payloadMap) {
+    const get = labelGetter(payloadMap);
+    if (!get)
+        return null;
+    const mmrStart = toBigIntOrNull(get(PAYLOAD_MMR_START));
+    const mmrEnd = toBigIntOrNull(get(PAYLOAD_MMR_END));
+    const issuedAt = toNumberOrNull(get(PAYLOAD_ISSUED_AT));
+    const expiresAt = toNumberOrNull(get(PAYLOAD_EXPIRES_AT));
+    if (mmrStart === null || mmrEnd === null)
+        return null;
+    if (issuedAt === null || expiresAt === null)
+        return null;
+    return { mmrStart, mmrEnd, issuedAt, expiresAt };
+}
+/**
+ * Enforce a resolved cert's constraints against the verified leaf (FOR-420).
+ *
+ * Coverage: the delegation authorizes checkpoint positions `treeSize-1 ∈
+ * [mmrStart, mmrEnd]` (inclusive, `delegationVerifier.sol`). Offline we hold the
+ * verified leaf's `mmrIndex`, and `leafMmrIndex ≤ treeSize-1` (the leaf is
+ * included in the checkpoint). So `leafMmrIndex > mmrEnd` SOUNDLY implies
+ * `treeSize-1 > mmrEnd` — a key signing beyond its authorized horizon — and is
+ * rejected. The `mmrStart` lower bound is deliberately NOT enforced here: an
+ * early leaf can legitimately appear in a checkpoint whose `size-1 ≥ mmrStart`,
+ * so `leafMmrIndex < mmrStart` does not imply a violation and enforcing it would
+ * false-reject valid receipts under a narrow cert. The lower bound and the exact
+ * `size-1` upper bound need the checkpoint accumulator (absent in the single-peak
+ * offline path) — deferred; in practice lane certs are wide (`mmrStart=0`).
+ *
+ * Expiry-at-issuance: the leaf's time (from its snowflake idtimestamp) must not
+ * be AFTER the cert's `expiresAt` — a key signing past its authorized lifetime.
+ * Compared against the checkpoint/leaf time, NOT wall-clock, so a valid receipt
+ * verifies forever (the pinned FOR-297 / ADR-0050 requirement).
+ *
+ * The `issuedAt` lower bound is deliberately NOT enforced. `issuedAt` is when the
+ * cert was SIGNED; the leaf's idtimestamp is when it was SEQUENCED. On live lanes
+ * the delegation cert is signed a few seconds AFTER the leaf is sequenced (the
+ * checkpoint that includes the leaf is sealed reactively), so `issuedAt > leafTime`
+ * is normal and correct — the cert is never *used* to sign before it exists.
+ * Enforcing `issuedAt ≤ leafTime` false-rejects legitimate receipts (verified on
+ * lane A: a fresh bootstrap receipt has `issuedAt − leafTime ≈ 3s`).
+ */
+export function checkDelegationConstraints(constraints, leafMmrIndex, leafIdtimestamp) {
+    if (leafMmrIndex > constraints.mmrEnd) {
+        return { ok: false, reason: "delegation_out_of_range" };
+    }
+    const t = idtimestampToUnixSeconds(leafIdtimestamp);
+    if (t > constraints.expiresAt) {
+        return { ok: false, reason: "delegation_expired" };
+    }
+    return { ok: true };
+}
 /**
  * Resolve the delegated verify key from a receipt's delegation certificate.
  *
@@ -124,9 +223,13 @@ export async function resolveDelegatedVerifyKey(receiptCbor, rootKeys) {
     const certDecoded = decodeCoseSign1(certBytes);
     if (!certDecoded)
         return { kind: "broken" };
-    const keyRaw = extractDelegatedKeyFromPayload(certDecoded.payloadBstr);
+    const payloadMap = decodeCertPayloadMap(certDecoded.payloadBstr);
+    const keyRaw = payloadMap
+        ? extractDelegatedKeyFromPayloadMap(payloadMap)
+        : null;
     const delegatedKey = keyRaw ? await importDelegatedKey(keyRaw) : null;
     if (!delegatedKey)
         return { kind: "broken" };
-    return { kind: "resolved", delegatedKey };
+    const constraints = parseDelegationConstraints(payloadMap);
+    return { kind: "resolved", delegatedKey, constraints };
 }

package/dist/verify-grant-receipt-offline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify-grant-receipt-offline.d.ts","sourceRoot":"","sources":["../src/verify-grant-receipt-offline.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAOjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAGtE,MAAM,MAAM,8BAA8B,GAAG;IAC3C,WAAW,EAAE,UAAU,CAAC;IACxB,WAAW,EAAE,UAAU,CAAC;IACxB,KAAK,EAAE,KAAK,CAAC;IACb,cAAc,EAAE,UAAU,CAAC;CAC5B,CAAC;AA4EF;;GAEG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,mBAAmB,CAAC,CAc9B;AAED,MAAM,MAAM,sCAAsC,GAAG,IAAI,CACvD,8BAA8B,EAC9B,aAAa,CACd,GAAG;IACF,qFAAqF;IACrF,SAAS,EAAE,SAAS,EAAE,CAAC;CACxB,CAAC;AAEF;;;;GAIG;AACH,wBAAsB,iCAAiC,CACrD,KAAK,EAAE,sCAAsC,GAC5C,OAAO,CAAC,mBAAmB,CAAC,CAa9B;AAED,MAAM,MAAM,yBAAyB,GAAG;IACtC,WAAW,EAAE,UAAU,CAAC;IACxB,WAAW,EAAE,UAAU,CAAC;IACxB;;;;;OAKG;IACH,OAAO,EAAE,UAAU,CAAC;IACpB,cAAc,EAAE,UAAU,CAAC;CAC5B,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,mBAAmB,CAAC,CAa9B;AAED,MAAM,MAAM,iCAAiC,GAAG,IAAI,CAClD,yBAAyB,EACzB,aAAa,CACd,GAAG;IACF;;;;;OAKG;IACH,SAAS,EAAE,SAAS,EAAE,CAAC;CACxB,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,iCAAiC,GACvC,OAAO,CAAC,mBAAmB,CAAC,CAa9B"}
+{"version":3,"file":"verify-grant-receipt-offline.d.ts","sourceRoot":"","sources":["../src/verify-grant-receipt-offline.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAUjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAGtE,MAAM,MAAM,8BAA8B,GAAG;IAC3C,WAAW,EAAE,UAAU,CAAC;IACxB,WAAW,EAAE,UAAU,CAAC;IACxB,KAAK,EAAE,KAAK,CAAC;IACb,cAAc,EAAE,UAAU,CAAC;CAC5B,CAAC;AA4EF;;GAEG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,8BAA8B,GACpC,OAAO,CAAC,mBAAmB,CAAC,CAc9B;AAED,MAAM,MAAM,sCAAsC,GAAG,IAAI,CACvD,8BAA8B,EAC9B,aAAa,CACd,GAAG;IACF,qFAAqF;IACrF,SAAS,EAAE,SAAS,EAAE,CAAC;CACxB,CAAC;AAEF;;;;GAIG;AACH,wBAAsB,iCAAiC,CACrD,KAAK,EAAE,sCAAsC,GAC5C,OAAO,CAAC,mBAAmB,CAAC,CAa9B;AAED,MAAM,MAAM,yBAAyB,GAAG;IACtC,WAAW,EAAE,UAAU,CAAC;IACxB,WAAW,EAAE,UAAU,CAAC;IACxB;;;;;OAKG;IACH,OAAO,EAAE,UAAU,CAAC;IACpB,cAAc,EAAE,UAAU,CAAC;CAC5B,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,yBAAyB,GAC/B,OAAO,CAAC,mBAAmB,CAAC,CAa9B;AAED,MAAM,MAAM,iCAAiC,GAAG,IAAI,CAClD,yBAAyB,EACzB,aAAa,CACd,GAAG;IACF;;;;;OAKG;IACH,SAAS,EAAE,SAAS,EAAE,CAAC;CACxB,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,iCAAiC,GACvC,OAAO,CAAC,mBAAmB,CAAC,CAa9B"}

package/dist/verify-grant-receipt-offline.js

@@ -3,7 +3,7 @@ import { calculateRoot, verifyInclusion, } from "@forestrie/merklelog";
 import { grantCommitmentHashFromGrant } from "./grant-commitment.js";
 import { decodeTrustRootFromGenesis } from "./decode-trust-root-from-genesis.js";
 import { es256ReceiptVerifyKeys } from "./decode-trust-root-cbor.js";
-import { resolveDelegatedVerifyKey } from "./resolve-delegated-verify-key.js";
+import { checkDelegationConstraints, resolveDelegatedVerifyKey, } from "./resolve-delegated-verify-key.js";
 import { univocityLeafHash } from "./leaf-commitment.js";
 import { parseReceipt } from "./parse-receipt.js";
 import { SubtleHasher } from "./subtle-hasher.js";
@@ -197,6 +197,17 @@ async function verifyReceiptOfflineWithLeafInnerKeys(input) {
     catch {
         return { ok: false, stage: "binding", reason: "idtimestamp_invalid" };
     }
+    // FOR-420: a resolved delegation cert authorizes its key only within an MMR
+    // coverage window and validity window. Enforce both before reporting the
+    // signature/inclusion as ok — a delegated key signing outside its authorized
+    // range, or after its expiry-at-issuance, fails at stage `signature`.
+    if (delegation.kind === "resolved" && delegation.constraints) {
+        const leafMmrIndex = parsed.proof.mmrIndex ?? parsed.proof.leafIndex ?? 0n;
+        const check = checkDelegationConstraints(delegation.constraints, leafMmrIndex, idtimestamp);
+        if (!check.ok) {
+            return { ok: false, stage: "signature", reason: check.reason };
+        }
+    }
     const leafHash = await univocityLeafHash(idtimestamp, input.inner);
     return verifySignatureAndInclusion({
         receiptCbor: input.receiptCbor,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forestrie/receipt-verify",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "license": "MIT",
   "type": "module",
   "description": "Offline SCITT grant receipt verification (ADR-0045)",
@@ -28,9 +28,9 @@
   ],
   "dependencies": {
     "@noble/hashes": "^1.7.1",
-    "@forestrie/merklelog": "0.3.0",
-    "@forestrie/chain-rpc": "0.1.1",
-    "@forestrie/encoding": "0.5.0"
+    "@forestrie/encoding": "0.6.0",
+    "@forestrie/chain-rpc": "0.2.0",
+    "@forestrie/merklelog": "0.3.0"
   },
   "devDependencies": {
     "esbuild": "^0.24.0",

package/src/index.ts

@@ -47,8 +47,15 @@ export type {
   VerifyGrantReceiptOfflineWithKeysInput,
   VerifyReceiptOfflineWithKeysInput,
 } from "./verify-grant-receipt-offline.js";
-export { resolveDelegatedVerifyKey } from "./resolve-delegated-verify-key.js";
-export type { DelegatedResolution } from "./resolve-delegated-verify-key.js";
+export {
+  checkDelegationConstraints,
+  idtimestampToUnixSeconds,
+  resolveDelegatedVerifyKey,
+} from "./resolve-delegated-verify-key.js";
+export type {
+  DelegatedResolution,
+  DelegationConstraints,
+} from "./resolve-delegated-verify-key.js";
 /** Import a raw 64-byte x||y P-256 public key as an ES256 verify key. */
 export { importEs256PublicKeyFromGrantDataXy64 } from "./decode-trust-root-cbor.js";
 export { decodeForestrieGrantCose } from "./decode-forestrie-grant-cose.js";

package/src/known-accumulator.ts

@@ -50,7 +50,9 @@ import type { ReceiptVerifyResult } from "./receipt-verify-result.js";
 function toContractLogId(logId: string): string {
   const hex = logId.replace(/-/g, "").replace(/^0x/, "").toLowerCase();
   if (!/^[0-9a-f]{32}$/.test(hex) && !/^[0-9a-f]{64}$/.test(hex)) {
-    throw new Error(`log id must be a UUID or 16/32-byte hex id, got '${logId}'`);
+    throw new Error(
+      `log id must be a UUID or 16/32-byte hex id, got '${logId}'`,
+    );
   }
   return "0x" + hex.padStart(64, "0");
 }
@@ -247,7 +249,12 @@ export async function verifyReceiptOfflineAgainstKnownAccumulator(input: {
   } else {
     const hasher = new SubtleHasher();
     const leafHash = await univocityLeafHash(input.idtimestampBe8, input.inner);
-    recomputedPeak = await calculateRoot(hasher, leafHash, parsed.proof, leafIdx);
+    recomputedPeak = await calculateRoot(
+      hasher,
+      leafHash,
+      parsed.proof,
+      leafIdx,
+    );
   }
 
   // 2. Exact peak match — receipt state is a snapshot-covered accumulator.

package/src/resolve-delegated-verify-key.ts

@@ -6,9 +6,12 @@
  * trust root and returns the delegated public key as an additional verify
  * candidate — the offline port of canopy-api's `resolveReceiptVerifyKey`.
  *
- * ES256 (P-256) only: the offline verifier is ES256-only (genesis alg), and
- * sealer delegate keys are always secp256r1. KS256-rooted delegation is a
- * server-only concern.
+ * P-256 roots only: the genesis alg is ES256 and sealer delegate keys are
+ * always secp256r1; KS256-rooted delegation is a server-only concern. A
+ * passkey (WebAuthn) root signs the certificate with alg -65800 and the
+ * ADR-0063 unprotected-header envelope — `verifyCoseSign1WithParsedKey`
+ * verifies that envelope against the same P-256 root keys, so the chain walk
+ * here is alg-agnostic (plan-2608-13 1.4).
  *
  * Trust anchors (FOR-297 trust ladder): `rootKeys` need not be genesis-derived
  * — a caller-known log OWNER key works identically (see
@@ -20,10 +23,16 @@
  * (approach A, open) will derive per-log owner keys from genesis + public
  * tiles, closing that gap without key distribution.
  *
- * Note (parity with the server port source): this establishes that the root
- * authorized the delegated key, but does NOT yet enforce the certificate's MMR
- * window or expiry-at-issuance against the leaf — that hardening is shared with
- * the server path and tracked separately (FOR-323).
+ * Constraint enforcement (FOR-420): the certificate authorizes the delegated
+ * key only over an MMR coverage window `[mmrStart, mmrEnd]` (payload labels 3/4)
+ * and until `expiresAt` (label 9, Unix seconds). {@link checkDelegationConstraints}
+ * enforces the soundly-offline-decidable slice against the verified leaf: the
+ * `mmrEnd` over-horizon bound (the leaf's index lower-bounds the checkpoint
+ * `treeSize-1` the on-chain `delegationVerifier.sol` binds) and expiry-at-issuance
+ * against the leaf's snowflake idtimestamp (never wall-clock — receipts must
+ * verify forever). The `mmrStart` lower bound, the exact `size-1` bound, and the
+ * `issuedAt` lower bound are NOT enforced (see that function). This replaces the
+ * earlier "does not yet enforce the window" gap.
  */
 
 import {
@@ -44,18 +53,57 @@ const COSE_KEY_Y = -3;
 const COSE_KTY_EC2 = 2;
 const COSE_CRV_P256 = 1;
 
-/** Delegation-cert payload label for the delegated COSE_Key. */
+/** Delegation-cert payload labels (must match @forestrie/delegation-cose). */
+const PAYLOAD_MMR_START = 3;
+const PAYLOAD_MMR_END = 4;
 const PAYLOAD_DELEGATED_KEY = 5;
+const PAYLOAD_ISSUED_AT = 8;
+const PAYLOAD_EXPIRES_AT = 9;
+
+/**
+ * Snowflake idtimestamp → Unix seconds (DataTrails scheme; arbor
+ * `snowflakeid`). `TimeShift = 24`, per-epoch span `2^40 - 1` ms, current
+ * `CommitmentEpoch = 1` (next epoch ~2038). `unixMs = epoch*(2^40-1) +
+ * (id >> 24)`.
+ */
+const COMMITMENT_EPOCH = 1n;
+const SNOWFLAKE_TIME_SHIFT = 24n;
+const SNOWFLAKE_EPOCH_SPAN_MS = (1n << 40n) - 1n;
+
+export function idtimestampToUnixSeconds(idtimestamp: bigint): number {
+  const ms =
+    COMMITMENT_EPOCH * SNOWFLAKE_EPOCH_SPAN_MS +
+    (idtimestamp >> SNOWFLAKE_TIME_SHIFT);
+  return Number(ms / 1000n);
+}
+
+/**
+ * Coverage + validity window a root-signed delegation cert imposes on its
+ * delegated key. `mmrStart`/`mmrEnd` are inclusive MMR-index bounds;
+ * `issuedAt`/`expiresAt` are Unix seconds.
+ */
+export type DelegationConstraints = {
+  mmrStart: bigint;
+  mmrEnd: bigint;
+  issuedAt: number;
+  expiresAt: number;
+};
 
 /**
  * root-only: no delegation cert present — verify against the root keys as-is.
  * resolved: cert verified under a root key; use `delegatedKey` first.
+ *   `constraints` carries the cert's coverage/validity window when the payload
+ *   declares it (null for legacy certs that predate labels 3/4/8/9).
  * broken: a cert is present but did not verify under the root, or its delegated
  *   key could not be parsed — the delegation chain is invalid.
  */
 export type DelegatedResolution =
   | { kind: "root-only" }
-  | { kind: "resolved"; delegatedKey: CryptoKey }
+  | {
+      kind: "resolved";
+      delegatedKey: CryptoKey;
+      constraints: DelegationConstraints | null;
+    }
   | { kind: "broken" };
 
 function extractDelegationCertBytes(unprotected: unknown): Uint8Array | null {
@@ -111,20 +159,96 @@ async function importDelegatedKey(keyMap: unknown): Promise<CryptoKey | null> {
   }
 }
 
-function extractDelegatedKeyFromPayload(
-  payloadBytes: Uint8Array,
-): unknown | null {
+function decodeCertPayloadMap(payloadBytes: Uint8Array): unknown | null {
   if (!payloadBytes || payloadBytes.length === 0) return null;
-  let payloadMap: unknown;
   try {
-    payloadMap = decodeCborDeterministic(payloadBytes);
+    return decodeCborDeterministic(payloadBytes);
   } catch {
     return null;
   }
+}
+
+function extractDelegatedKeyFromPayloadMap(
+  payloadMap: unknown,
+): unknown | null {
   const get = labelGetter(payloadMap);
   return get ? get(PAYLOAD_DELEGATED_KEY) : null;
 }
 
+function toBigIntOrNull(v: unknown): bigint | null {
+  if (typeof v === "bigint") return v;
+  if (typeof v === "number" && Number.isInteger(v)) return BigInt(v);
+  return null;
+}
+
+function toNumberOrNull(v: unknown): number | null {
+  if (typeof v === "bigint") return Number(v);
+  if (typeof v === "number" && Number.isFinite(v)) return v;
+  return null;
+}
+
+/**
+ * Parse the cert's coverage/validity window from its payload map. Returns null
+ * when any of labels 3/4/8/9 is absent (legacy certs predating FOR-390 advance
+ * delegation) — enforcement is then skipped, preserving pre-constraint trust.
+ */
+function parseDelegationConstraints(
+  payloadMap: unknown,
+): DelegationConstraints | null {
+  const get = labelGetter(payloadMap);
+  if (!get) return null;
+  const mmrStart = toBigIntOrNull(get(PAYLOAD_MMR_START));
+  const mmrEnd = toBigIntOrNull(get(PAYLOAD_MMR_END));
+  const issuedAt = toNumberOrNull(get(PAYLOAD_ISSUED_AT));
+  const expiresAt = toNumberOrNull(get(PAYLOAD_EXPIRES_AT));
+  if (mmrStart === null || mmrEnd === null) return null;
+  if (issuedAt === null || expiresAt === null) return null;
+  return { mmrStart, mmrEnd, issuedAt, expiresAt };
+}
+
+/**
+ * Enforce a resolved cert's constraints against the verified leaf (FOR-420).
+ *
+ * Coverage: the delegation authorizes checkpoint positions `treeSize-1 ∈
+ * [mmrStart, mmrEnd]` (inclusive, `delegationVerifier.sol`). Offline we hold the
+ * verified leaf's `mmrIndex`, and `leafMmrIndex ≤ treeSize-1` (the leaf is
+ * included in the checkpoint). So `leafMmrIndex > mmrEnd` SOUNDLY implies
+ * `treeSize-1 > mmrEnd` — a key signing beyond its authorized horizon — and is
+ * rejected. The `mmrStart` lower bound is deliberately NOT enforced here: an
+ * early leaf can legitimately appear in a checkpoint whose `size-1 ≥ mmrStart`,
+ * so `leafMmrIndex < mmrStart` does not imply a violation and enforcing it would
+ * false-reject valid receipts under a narrow cert. The lower bound and the exact
+ * `size-1` upper bound need the checkpoint accumulator (absent in the single-peak
+ * offline path) — deferred; in practice lane certs are wide (`mmrStart=0`).
+ *
+ * Expiry-at-issuance: the leaf's time (from its snowflake idtimestamp) must not
+ * be AFTER the cert's `expiresAt` — a key signing past its authorized lifetime.
+ * Compared against the checkpoint/leaf time, NOT wall-clock, so a valid receipt
+ * verifies forever (the pinned FOR-297 / ADR-0050 requirement).
+ *
+ * The `issuedAt` lower bound is deliberately NOT enforced. `issuedAt` is when the
+ * cert was SIGNED; the leaf's idtimestamp is when it was SEQUENCED. On live lanes
+ * the delegation cert is signed a few seconds AFTER the leaf is sequenced (the
+ * checkpoint that includes the leaf is sealed reactively), so `issuedAt > leafTime`
+ * is normal and correct — the cert is never *used* to sign before it exists.
+ * Enforcing `issuedAt ≤ leafTime` false-rejects legitimate receipts (verified on
+ * lane A: a fresh bootstrap receipt has `issuedAt − leafTime ≈ 3s`).
+ */
+export function checkDelegationConstraints(
+  constraints: DelegationConstraints,
+  leafMmrIndex: bigint,
+  leafIdtimestamp: bigint,
+): { ok: true } | { ok: false; reason: string } {
+  if (leafMmrIndex > constraints.mmrEnd) {
+    return { ok: false, reason: "delegation_out_of_range" };
+  }
+  const t = idtimestampToUnixSeconds(leafIdtimestamp);
+  if (t > constraints.expiresAt) {
+    return { ok: false, reason: "delegation_expired" };
+  }
+  return { ok: true };
+}
+
 /**
  * Resolve the delegated verify key from a receipt's delegation certificate.
  *
@@ -157,9 +281,13 @@ export async function resolveDelegatedVerifyKey(
   const certDecoded = decodeCoseSign1(certBytes);
   if (!certDecoded) return { kind: "broken" };
 
-  const keyRaw = extractDelegatedKeyFromPayload(certDecoded.payloadBstr);
+  const payloadMap = decodeCertPayloadMap(certDecoded.payloadBstr);
+  const keyRaw = payloadMap
+    ? extractDelegatedKeyFromPayloadMap(payloadMap)
+    : null;
   const delegatedKey = keyRaw ? await importDelegatedKey(keyRaw) : null;
   if (!delegatedKey) return { kind: "broken" };
 
-  return { kind: "resolved", delegatedKey };
+  const constraints = parseDelegationConstraints(payloadMap);
+  return { kind: "resolved", delegatedKey, constraints };
 }

package/src/verify-grant-receipt-offline.ts

@@ -8,7 +8,10 @@ import type { Grant } from "@forestrie/encoding";
 import { grantCommitmentHashFromGrant } from "./grant-commitment.js";
 import { decodeTrustRootFromGenesis } from "./decode-trust-root-from-genesis.js";
 import { es256ReceiptVerifyKeys } from "./decode-trust-root-cbor.js";
-import { resolveDelegatedVerifyKey } from "./resolve-delegated-verify-key.js";
+import {
+  checkDelegationConstraints,
+  resolveDelegatedVerifyKey,
+} from "./resolve-delegated-verify-key.js";
 import { univocityLeafHash } from "./leaf-commitment.js";
 import { parseReceipt } from "./parse-receipt.js";
 import type { ReceiptVerifyResult } from "./receipt-verify-result.js";
@@ -309,6 +312,22 @@ async function verifyReceiptOfflineWithLeafInnerKeys(input: {
     return { ok: false, stage: "binding", reason: "idtimestamp_invalid" };
   }
 
+  // FOR-420: a resolved delegation cert authorizes its key only within an MMR
+  // coverage window and validity window. Enforce both before reporting the
+  // signature/inclusion as ok — a delegated key signing outside its authorized
+  // range, or after its expiry-at-issuance, fails at stage `signature`.
+  if (delegation.kind === "resolved" && delegation.constraints) {
+    const leafMmrIndex = parsed.proof.mmrIndex ?? parsed.proof.leafIndex ?? 0n;
+    const check = checkDelegationConstraints(
+      delegation.constraints,
+      leafMmrIndex,
+      idtimestamp,
+    );
+    if (!check.ok) {
+      return { ok: false, stage: "signature", reason: check.reason };
+    }
+  }
+
   const leafHash = await univocityLeafHash(idtimestamp, input.inner);
 
   return verifySignatureAndInclusion({