@forestrie/receipt-verify 1.0.0 → 2.0.0

package/dist/decode-genesis-cbor-map.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Shared decode step for a genesis document's CBOR body: deterministic CBOR
+ * decodes an integer-keyed map either as a native `Map` or as a plain
+ * object (encoder-dependent), so callers that read genesis labels normalise
+ * to a `Map<number, unknown>` once here rather than each re-implementing
+ * the same fallback. Used by {@link decodeTrustRootFromGenesis} and
+ * {@link decodeChainBindingFromGenesis}.
+ */
+export declare function decodeGenesisBodyAsIntKeyMap(raw: unknown): Map<number, unknown> | null;
+/** Narrow a decoded genesis field to `Uint8Array`, or `null` if it is not one. */
+export declare function asGenesisUint8Array(v: unknown): Uint8Array | null;
+//# sourceMappingURL=decode-genesis-cbor-map.d.ts.map

package/dist/decode-genesis-cbor-map.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decode-genesis-cbor-map.d.ts","sourceRoot":"","sources":["../src/decode-genesis-cbor-map.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,OAAO,GACX,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAW7B;AAED,kFAAkF;AAClF,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,IAAI,CAEjE"}

package/dist/decode-genesis-cbor-map.js

@@ -0,0 +1,26 @@
+/**
+ * Shared decode step for a genesis document's CBOR body: deterministic CBOR
+ * decodes an integer-keyed map either as a native `Map` or as a plain
+ * object (encoder-dependent), so callers that read genesis labels normalise
+ * to a `Map<number, unknown>` once here rather than each re-implementing
+ * the same fallback. Used by {@link decodeTrustRootFromGenesis} and
+ * {@link decodeChainBindingFromGenesis}.
+ */
+export function decodeGenesisBodyAsIntKeyMap(raw) {
+    if (raw instanceof Map)
+        return raw;
+    if (typeof raw === "object" && raw !== null && !Array.isArray(raw)) {
+        const out = new Map();
+        for (const [k, v] of Object.entries(raw)) {
+            const n = Number(k);
+            if (Number.isFinite(n))
+                out.set(n, v);
+        }
+        return out;
+    }
+    return null;
+}
+/** Narrow a decoded genesis field to `Uint8Array`, or `null` if it is not one. */
+export function asGenesisUint8Array(v) {
+    return v instanceof Uint8Array ? v : null;
+}

package/dist/decode-trust-root-from-genesis.d.ts

@@ -1,7 +1,25 @@
-import type { RootVerifyKey } from "./root-verify-key.js";
+import { type RootVerifyKey } from "./root-verify-key.js";
+import type { DecodedTrustRoot } from "./decoded-trust-root.js";
 /**
- * Extract receipt verify key from a forest genesis document CBOR blob.
- * Offline path: genesis-only trust anchor (ADR-0045).
+ * Extract the receipt verify key from a forest genesis document CBOR blob,
+ * alongside `bootstrapKeyXy` when the bootstrap key is ES256. Offline path:
+ * genesis-only trust anchor (ADR-0045). See {@link DecodedTrustRoot}.
+ * `bootstrapKeyXy` is read directly from the genesis-encoded bytes (never
+ * exported from the non-extractable `CryptoKey` in `key`), and is
+ * `undefined` for a KS256 v2 bootstrap key (an on-chain address — there is
+ * no P-256 public key to give up in that case).
+ *
+ * This is the single decode path: {@link decodeTrustRootFromGenesis} is
+ * `(await decodeTrustRootDetailsFromGenesis(genesisCbor)).key`.
+ */
+export declare function decodeTrustRootDetailsFromGenesis(genesisCbor: Uint8Array): Promise<DecodedTrustRoot>;
+/**
+ * Extract the receipt verify key from a forest genesis document CBOR blob.
+ * Offline path: genesis-only trust anchor (ADR-0045). The origin/main
+ * signature and behaviour (including a KS256 v2 bootstrap key resolving to
+ * the `ParsedKs256RootKey` on-chain address, not a throw): callers pinned
+ * to `RootVerifyKey` keep working unchanged. For the raw bootstrap public
+ * key bytes as well, use {@link decodeTrustRootDetailsFromGenesis}.
  */
 export declare function decodeTrustRootFromGenesis(genesisCbor: Uint8Array): Promise<RootVerifyKey>;
 //# sourceMappingURL=decode-trust-root-from-genesis.d.ts.map

package/dist/decode-trust-root-from-genesis.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decode-trust-root-from-genesis.d.ts","sourceRoot":"","sources":["../src/decode-trust-root-from-genesis.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAmB1D;;;GAGG;AACH,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,UAAU,GACtB,OAAO,CAAC,aAAa,CAAC,CA0CxB"}
+{"version":3,"file":"decode-trust-root-from-genesis.d.ts","sourceRoot":"","sources":["../src/decode-trust-root-from-genesis.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAwB,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAKhF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEhE;;;;;;;;;;;GAWG;AACH,wBAAsB,iCAAiC,CACrD,WAAW,EAAE,UAAU,GACtB,OAAO,CAAC,gBAAgB,CAAC,CA+C3B;AAED;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAC9C,WAAW,EAAE,UAAU,GACtB,OAAO,CAAC,aAAa,CAAC,CAExB"}

package/dist/decode-trust-root-from-genesis.js

@@ -2,28 +2,21 @@ import { decodeCborDeterministic } from "@forestrie/encoding";
 import { COSE_ALG_ES256, COSE_CRV_P256, COSE_EC2_CRV, COSE_EC2_X, COSE_EC2_Y, COSE_KEY_ALG, COSE_KEY_KTY, COSE_KTY_EC2, } from "./cose-key.js";
 import { FOREST_GENESIS_LABEL_BOOTSTRAP_KEY, FOREST_GENESIS_LABEL_GENESIS_ALG, FOREST_GENESIS_LABEL_GENESIS_VERSION, FOREST_GENESIS_SCHEMA_V1, FOREST_GENESIS_SCHEMA_V2, } from "./forest-genesis-labels.js";
 import { decodeTrustRootCbor } from "./decode-trust-root-cbor.js";
-function decodeBodyAsIntKeyMap(raw) {
-    if (raw instanceof Map)
-        return raw;
-    if (typeof raw === "object" && raw !== null && !Array.isArray(raw)) {
-        const out = new Map();
-        for (const [k, v] of Object.entries(raw)) {
-            const n = Number(k);
-            if (Number.isFinite(n))
-                out.set(n, v);
-        }
-        return out;
-    }
-    return null;
-}
-function asGenesisUint8Array(v) {
-    return v instanceof Uint8Array ? v : null;
-}
+import { isParsedKs256RootKey } from "./root-verify-key.js";
+import { asGenesisUint8Array, decodeGenesisBodyAsIntKeyMap, } from "./decode-genesis-cbor-map.js";
 /**
- * Extract receipt verify key from a forest genesis document CBOR blob.
- * Offline path: genesis-only trust anchor (ADR-0045).
+ * Extract the receipt verify key from a forest genesis document CBOR blob,
+ * alongside `bootstrapKeyXy` when the bootstrap key is ES256. Offline path:
+ * genesis-only trust anchor (ADR-0045). See {@link DecodedTrustRoot}.
+ * `bootstrapKeyXy` is read directly from the genesis-encoded bytes (never
+ * exported from the non-extractable `CryptoKey` in `key`), and is
+ * `undefined` for a KS256 v2 bootstrap key (an on-chain address — there is
+ * no P-256 public key to give up in that case).
+ *
+ * This is the single decode path: {@link decodeTrustRootFromGenesis} is
+ * `(await decodeTrustRootDetailsFromGenesis(genesisCbor)).key`.
  */
-export async function decodeTrustRootFromGenesis(genesisCbor) {
+export async function decodeTrustRootDetailsFromGenesis(genesisCbor) {
     let raw;
     try {
         raw = decodeCborDeterministic(genesisCbor);
@@ -31,7 +24,7 @@ export async function decodeTrustRootFromGenesis(genesisCbor) {
     catch {
         throw new Error("genesis CBOR decode failed");
     }
-    const m = decodeBodyAsIntKeyMap(raw);
+    const m = decodeGenesisBodyAsIntKeyMap(raw);
     if (!m)
         throw new Error("genesis document must be a CBOR map");
     const versionRaw = m.get(FOREST_GENESIS_LABEL_GENESIS_VERSION);
@@ -41,7 +34,11 @@ export async function decodeTrustRootFromGenesis(genesisCbor) {
         if (bootstrapKey === null) {
             throw new Error("v2 genesis missing bootstrapKey");
         }
-        return decodeTrustRootCbor({ alg, key: bootstrapKey });
+        const key = await decodeTrustRootCbor({ alg, key: bootstrapKey });
+        return {
+            key,
+            bootstrapKeyXy: isParsedKs256RootKey(key) ? undefined : bootstrapKey,
+        };
     }
     const kty = m.get(COSE_KEY_KTY);
     const crv = m.get(COSE_EC2_CRV);
@@ -55,10 +52,22 @@ export async function decodeTrustRootFromGenesis(genesisCbor) {
         const xy = new Uint8Array(64);
         xy.set(x, 0);
         xy.set(y, 32);
-        return decodeTrustRootCbor({ alg: COSE_ALG_ES256, key: xy });
+        const key = await decodeTrustRootCbor({ alg: COSE_ALG_ES256, key: xy });
+        return { key, bootstrapKeyXy: xy };
     }
     if (versionRaw === FOREST_GENESIS_SCHEMA_V1 || versionRaw === undefined) {
         throw new Error("unsupported or invalid genesis schema for trust root");
     }
     throw new Error("unsupported genesis document");
 }
+/**
+ * Extract the receipt verify key from a forest genesis document CBOR blob.
+ * Offline path: genesis-only trust anchor (ADR-0045). The origin/main
+ * signature and behaviour (including a KS256 v2 bootstrap key resolving to
+ * the `ParsedKs256RootKey` on-chain address, not a throw): callers pinned
+ * to `RootVerifyKey` keep working unchanged. For the raw bootstrap public
+ * key bytes as well, use {@link decodeTrustRootDetailsFromGenesis}.
+ */
+export async function decodeTrustRootFromGenesis(genesisCbor) {
+    return (await decodeTrustRootDetailsFromGenesis(genesisCbor)).key;
+}

package/dist/decoded-trust-root.d.ts

@@ -0,0 +1,17 @@
+import type { RootVerifyKey } from "./root-verify-key.js";
+/**
+ * Result of {@link decodeTrustRootDetailsFromGenesis}: the decoded verify
+ * key (an ES256 `CryptoKey`, or a KS256 on-chain address) plus, for the
+ * ES256 case, the raw 64-byte x||y P-256 public key coordinates the genesis
+ * document carries. `bootstrapKeyXy` is read directly from the
+ * genesis-encoded bytes, not exported from `key` (`key` stays
+ * non-extractable) — plan-2609-07 L3, for callers that need the
+ * serialisable public key material the `CryptoKey` cannot give up.
+ * `bootstrapKeyXy` is `undefined` for a KS256 v2 bootstrap key (an on-chain
+ * address — there is no P-256 public key to give up).
+ */
+export interface DecodedTrustRoot {
+    key: RootVerifyKey;
+    bootstrapKeyXy?: Uint8Array;
+}
+//# sourceMappingURL=decoded-trust-root.d.ts.map

package/dist/decoded-trust-root.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decoded-trust-root.d.ts","sourceRoot":"","sources":["../src/decoded-trust-root.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,aAAa,CAAC;IACnB,cAAc,CAAC,EAAE,UAAU,CAAC;CAC7B"}

package/dist/decoded-trust-root.js

@@ -0,0 +1 @@
+export {};

package/dist/forest-genesis-labels.d.ts

@@ -1,6 +1,13 @@
 export declare const FOREST_GENESIS_LABEL_GENESIS_VERSION = -68009;
 export declare const FOREST_GENESIS_LABEL_GENESIS_ALG = -68014;
 export declare const FOREST_GENESIS_LABEL_BOOTSTRAP_KEY = -68015;
+/**
+ * The forest's own log id, wire-encoded as 32 bytes: 16 zero bytes then the
+ * 16-byte forest bootstrap log id (plan-2609-07 L3; mirrors mcp-resolve's
+ * `genesis-binding.ts` naming so that consumer can import this instead of
+ * defining it locally). See {@link decodeChainBindingFromGenesis}.
+ */
+export declare const FOREST_GENESIS_LABEL_LOG_ID = -68010;
 export declare const FOREST_GENESIS_LABEL_UNIVOCITY_ADDR = -68011;
 export declare const FOREST_GENESIS_LABEL_CHAIN_ID = -68013;
 export declare const FOREST_GENESIS_SCHEMA_V2 = 2;

package/dist/forest-genesis-labels.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"forest-genesis-labels.d.ts","sourceRoot":"","sources":["../src/forest-genesis-labels.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,oCAAoC,SAAS,CAAC;AAC3D,eAAO,MAAM,gCAAgC,SAAS,CAAC;AACvD,eAAO,MAAM,kCAAkC,SAAS,CAAC;AACzD,eAAO,MAAM,mCAAmC,SAAS,CAAC;AAC1D,eAAO,MAAM,6BAA6B,SAAS,CAAC;AACpD,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAC1C,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAE1C,eAAO,MAAM,kBAAkB,SAAS,CAAC;AACzC,eAAO,MAAM,yBAAyB,SAAS,CAAC"}
+{"version":3,"file":"forest-genesis-labels.d.ts","sourceRoot":"","sources":["../src/forest-genesis-labels.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,oCAAoC,SAAS,CAAC;AAC3D,eAAO,MAAM,gCAAgC,SAAS,CAAC;AACvD,eAAO,MAAM,kCAAkC,SAAS,CAAC;AACzD;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,SAAS,CAAC;AAClD,eAAO,MAAM,mCAAmC,SAAS,CAAC;AAC1D,eAAO,MAAM,6BAA6B,SAAS,CAAC;AACpD,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAC1C,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAE1C,eAAO,MAAM,kBAAkB,SAAS,CAAC;AACzC,eAAO,MAAM,yBAAyB,SAAS,CAAC"}

package/dist/forest-genesis-labels.js

@@ -1,6 +1,13 @@
 export const FOREST_GENESIS_LABEL_GENESIS_VERSION = -68009;
 export const FOREST_GENESIS_LABEL_GENESIS_ALG = -68014;
 export const FOREST_GENESIS_LABEL_BOOTSTRAP_KEY = -68015;
+/**
+ * The forest's own log id, wire-encoded as 32 bytes: 16 zero bytes then the
+ * 16-byte forest bootstrap log id (plan-2609-07 L3; mirrors mcp-resolve's
+ * `genesis-binding.ts` naming so that consumer can import this instead of
+ * defining it locally). See {@link decodeChainBindingFromGenesis}.
+ */
+export const FOREST_GENESIS_LABEL_LOG_ID = -68010;
 export const FOREST_GENESIS_LABEL_UNIVOCITY_ADDR = -68011;
 export const FOREST_GENESIS_LABEL_CHAIN_ID = -68013;
 export const FOREST_GENESIS_SCHEMA_V2 = 2;

package/dist/freshen-receipt.d.ts

@@ -1,17 +1,34 @@
 import { type CheckpointConsistencyProof } from "./checkpoint-chain.js";
+/**
+ * BREAKING (within the 2.0.0 major already in flight): the sizeless
+ * `accumulatorFrom?: Uint8Array[]` seed is replaced by `trustedBase`, which
+ * carries the seed's SIZE alongside its peaks. Without a size the fold ran
+ * each link against the size read off that link's own proof, which is what
+ * {@link computeCheckpointAccumulator} exists to prevent (ADR-0066 D5.4) —
+ * a seed could only ever be checked against the peak count the proof's own
+ * declared base implies, and many sizes share a peak count.
+ */
 export type FreshenReceiptInput = {
     /** The stale receipt (COSE Sign1 with a 396 inclusion proof). */
     oldReceiptBytes: Uint8Array;
     /** The leaf's committed value: `SHA-256(idtimestamp ‖ inner)` — the same
      * value `verify` recomputes from the entry (caller derives it). */
     leafValue: Uint8Array;
-    /** Consistency-proof chain covering [0 or a trusted seed] → the latest sealed
-     * size, in ascending contiguous order (the raw per-checkpoint proofs, with
-     * `paths`). The chain's last link must end at the checkpoint's sealed size. */
+    /** Consistency-proof chain covering [0 or the trusted base] → the latest
+     * sealed size, in ascending contiguous order (the raw per-checkpoint
+     * proofs, with `paths`). The chain's last link must end at the
+     * checkpoint's sealed size. */
     consistencyProofs: readonly CheckpointConsistencyProof[];
-    /** Trusted accumulator seed for a suffix chain; omit for a chain from base 0.
-     * Its peak count must match the first link's tree-size-1. */
-    accumulatorFrom?: Uint8Array[];
+    /** Trusted base for a suffix chain — the size the caller already trusts
+     * and that size's accumulator; omit for a chain from base 0 (size 0, an
+     * empty accumulator). The size must be a complete MMR size, the
+     * accumulator must hold one peak per peak of that size, and the first
+     * link's declared `tree-size-1` must equal the size. Same shape as
+     * `verifyCheckpointChain`'s `trustedBase`. */
+    trustedBase?: {
+        size: bigint;
+        accumulator: Uint8Array[];
+    };
     /** The latest checkpoint (`.sth`): its pre-signed peak receipts + delegation
      * cert become the freshened receipt's signature. */
     latestCheckpointBytes: Uint8Array;

package/dist/freshen-receipt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"freshen-receipt.d.ts","sourceRoot":"","sources":["../src/freshen-receipt.ts"],"names":[],"mappings":"AAyDA,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,uBAAuB,CAAC;AAI/B,MAAM,MAAM,mBAAmB,GAAG;IAChC,iEAAiE;IACjE,eAAe,EAAE,UAAU,CAAC;IAC5B;uEACmE;IACnE,SAAS,EAAE,UAAU,CAAC;IACtB;;mFAE+E;IAC/E,iBAAiB,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACzD;iEAC6D;IAC7D,eAAe,CAAC,EAAE,UAAU,EAAE,CAAC;IAC/B;wDACoD;IACpD,qBAAqB,EAAE,UAAU,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,wEAAwE;IACxE,OAAO,EAAE,UAAU,CAAC;IACpB,wDAAwD;IACxD,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AASF;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,oBAAoB,CAAC,CAyJ/B"}
+{"version":3,"file":"freshen-receipt.d.ts","sourceRoot":"","sources":["../src/freshen-receipt.ts"],"names":[],"mappings":"AA2DA,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,uBAAuB,CAAC;AAI/B;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,iEAAiE;IACjE,eAAe,EAAE,UAAU,CAAC;IAC5B;uEACmE;IACnE,SAAS,EAAE,UAAU,CAAC;IACtB;;;mCAG+B;IAC/B,iBAAiB,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACzD;;;;;kDAK8C;IAC9C,WAAW,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IAC1D;wDACoD;IACpD,qBAAqB,EAAE,UAAU,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,wEAAwE;IACxE,OAAO,EAAE,UAAU,CAAC;IACpB,wDAAwD;IACxD,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AASF;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,oBAAoB,CAAC,CAwK/B"}

package/dist/freshen-receipt.js

@@ -45,7 +45,7 @@
  * tested go-merklelog port); this module only assembles node values by index
  * from the old receipt path + the consistency proofs.
  */
-import { calculateRoot, inclusionProofPath, peakIndexForLeafProof, peakMMRIndexes, } from "@forestrie/merklelog";
+import { calculateRoot, inclusionProofPath, mmrSizeForLeafCount, peakIndexForLeafProof, peakMMRIndexes, peaksBitmap, } from "@forestrie/merklelog";
 import { assembleReceiptFromProof, parseCheckpoint, } from "./build-receipt-offline.js";
 import { computeCheckpointAccumulator, } from "./checkpoint-chain.js";
 import { parseReceipt } from "./parse-receipt.js";
@@ -90,19 +90,26 @@ export async function freshenReceipt(input) {
         throw new Error("freshen requires at least one consistency proof linking the receipt's era to the checkpoint");
     }
     const firstLink = links[0];
-    // Base: a base-0 chain starts from an empty accumulator; a suffix chain's
-    // trusted seed must have the peak count of its tree-size-1.
-    const baseCount = input.accumulatorFrom?.length ?? 0;
-    if (firstLink.treeSize1 === 0n) {
-        if (baseCount !== 0) {
-            throw new Error("base-0 consistency chain must start from an empty accumulator seed");
-        }
-    }
-    else {
-        const wanted = peakMMRIndexes(firstLink.treeSize1 - 1n).length;
-        if (baseCount !== wanted) {
-            throw new Error(`base accumulator has ${baseCount} peaks; first link size ${firstLink.treeSize1} requires ${wanted}`);
-        }
+    // Base: the CALLER's trusted size and its accumulator (size 0 and an empty
+    // accumulator for a whole-log chain). The size has to be a size an MMR can
+    // have — `peaksBitmap` rounds an incomplete one DOWN, so a size of 5 would
+    // fold the 4 -> N shape — and the accumulator has to hold that size's
+    // peaks, which is the check the proof's own declared base used to stand in
+    // for.
+    const baseSize = input.trustedBase?.size ?? 0n;
+    const baseAccumulator = input.trustedBase?.accumulator ?? [];
+    if (baseSize < 0n ||
+        mmrSizeForLeafCount(peaksBitmap(baseSize)) !== baseSize) {
+        throw new Error(`trusted base size ${baseSize} is not a complete MMR size`);
+    }
+    const basePeaks = baseSize === 0n ? 0 : peakMMRIndexes(baseSize - 1n).length;
+    if (baseAccumulator.length !== basePeaks) {
+        throw new Error(`base accumulator has ${baseAccumulator.length} peaks; trusted base size ${baseSize} has ${basePeaks}`);
+    }
+    // The first link must continue from that size, not from a size it names
+    // itself (ADR-0066 D5.4).
+    if (firstLink.treeSize1 !== baseSize) {
+        throw new Error(`first consistency proof declares tree-size-1 ${firstLink.treeSize1}; the trusted base size is ${baseSize}`);
     }
     // Contiguity: each link continues where the previous one sealed.
     for (let i = 1; i < links.length; i++) {
@@ -115,10 +122,15 @@ export async function freshenReceipt(input) {
     if (lastLink.treeSize2 !== sealedSize) {
         throw new Error(`consistency chain ends at size ${lastLink.treeSize2} but the checkpoint sealed size ${sealedSize}`);
     }
-    // Fold the chain to the latest accumulator (self-check target).
-    let accumulator = input.accumulatorFrom ?? [];
+    // Fold the chain to the latest accumulator (self-check target). Each step
+    // runs against a size the caller trusts, never one read off the link being
+    // folded: the trusted base for the first link, and the size the previous
+    // link was just folded TO for every link after it.
+    let accumulator = baseAccumulator;
+    let sizeFrom = baseSize;
     for (const p of links) {
-        accumulator = await computeCheckpointAccumulator(p, accumulator);
+        accumulator = await computeCheckpointAccumulator(p, accumulator, sizeFrom);
+        sizeFrom = p.treeSize2;
     }
     const aLatest = accumulator;
     // Cross-check the fold against the checkpoint we are borrowing from (F1): the

package/dist/index.d.ts

@@ -14,7 +14,27 @@ export type { FreshenReceiptInput, FreshenReceiptResult, } from "./freshen-recei
  * re-exported here to preserve the receipt-verify public surface.
  */
 export { peakMMRIndexes } from "@forestrie/merklelog";
-export { decodeTrustRootFromGenesis } from "./decode-trust-root-from-genesis.js";
+/**
+ * `decodeTrustRootFromGenesis` keeps its origin/main signature and
+ * behaviour (`Promise<RootVerifyKey>`, including a KS256 v2 bootstrap key
+ * resolving without a throw) so pinned consumers (mcp-verify 1.0.0) are
+ * unaffected. `decodeTrustRootDetailsFromGenesis` is the additive sibling
+ * (plan-2609-07 L3) carrying `bootstrapKeyXy` alongside `key`.
+ */
+export { decodeTrustRootDetailsFromGenesis, decodeTrustRootFromGenesis, } from "./decode-trust-root-from-genesis.js";
+export type { DecodedTrustRoot } from "./decoded-trust-root.js";
+/**
+ * Genesis document label constants (plan-2609-07 L3): exported from the
+ * package root so consumers stop redefining them locally (mcp-resolve's own
+ * `genesis-binding.ts` did, before this).
+ */
+export { FOREST_GENESIS_LABEL_BOOTSTRAP_KEY, FOREST_GENESIS_LABEL_CHAIN_ID, FOREST_GENESIS_LABEL_GENESIS_ALG, FOREST_GENESIS_LABEL_GENESIS_VERSION, FOREST_GENESIS_LABEL_LOG_ID, FOREST_GENESIS_LABEL_UNIVOCITY_ADDR, } from "./forest-genesis-labels.js";
+/**
+ * Genesis-bound chain binding (plan-2609-07 L3): mirrors mcp-resolve's own
+ * `decodeChainBindingFromGenesis` so that consumer can delete its copy.
+ */
+export { decodeChainBindingFromGenesis } from "./decode-chain-binding-from-genesis.js";
+export type { ChainBinding } from "./chain-binding.js";
 export { verifyGrantReceiptOffline } from "./verify-grant-receipt-offline.js";
 export { verifyReceiptOffline } from "./verify-grant-receipt-offline.js";
 /**
@@ -56,7 +76,7 @@ export { findGrantLeafInMassif } from "./find-grant-leaf.js";
 export type { LocatedLeaf } from "./find-grant-leaf.js";
 /** Re-exported so callers of findGrantLeafInMassif can catch it (FOR-344). */
 export { MissingIndexError } from "@forestrie/merklelog";
-export { accumulatorPayload, checkpointConsistencyProof, computeCheckpointAccumulator, verifyCheckpointChain, type CheckpointChainLink, type CheckpointChainResult, type CheckpointConsistencyProof, } from "./checkpoint-chain.js";
+export { accumulatorPayload, checkpointConsistencyProof, computeCheckpointAccumulator, verifyCheckpointChain, CheckpointHighSSignatureError, CheckpointSignedSizeMismatchError, type CheckpointChainLink, type CheckpointChainResult, type CheckpointConsistencyProof, } from "./checkpoint-chain.js";
 /**
  * Univocity leaf commitment hash. Was CLI-private (forestrie-cli's own
  * mirror, "hoist to the library when the FOR-297 multi-hop resolver lands");

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,oFAAoF;AACpF,YAAY,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,YAAY,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AACxF,YAAY,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EACV,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC,+EAA+E;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EACV,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AACjF,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE;;;;GAIG;AACH,OAAO,EACL,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,sCAAsC,EACtC,iCAAiC,GAClC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,mCAAmC,CAAC;AAC3C,yEAAyE;AACzE,OAAO,EAAE,qCAAqC,EAAE,MAAM,6BAA6B,CAAC;AACpF;;;;;;GAMG;AACH,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAC7B,sBAAsB,EACtB,6BAA6B,EAC7B,qBAAqB,EACrB,sBAAsB,EACtB,oCAAoC,EACpC,uCAAuC,EACvC,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,iBAAiB,EACjB,sBAAsB,EACtB,kCAAkC,EAClC,wBAAwB,EACxB,iCAAiC,EACjC,kCAAkC,GACnC,MAAM,8BAA8B,CAAC;AACtC;;;GAGG;AACH,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE3E,0EAA0E;AAC1E,OAAO,EACL,cAAc,EACd,iDAAiD,GAClD,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC7E,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,6EAA6E;AAC7E,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,oEAAoE;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,8EAA8E;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,4BAA4B,EAC5B,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,GAChC,MAAM,uBAAuB,CAAC;AAC/B;;;;;GAKG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD;;;;;;GAMG;AACH,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,2CAA2C,EAC3C,KAAK,gBAAgB,GACtB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,oFAAoF;AACpF,YAAY,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,YAAY,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AACxF,YAAY,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EACV,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC,+EAA+E;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EACV,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD;;;;;;GAMG;AACH,OAAO,EACL,iCAAiC,EACjC,0BAA0B,GAC3B,MAAM,qCAAqC,CAAC;AAC7C,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE;;;;GAIG;AACH,OAAO,EACL,kCAAkC,EAClC,6BAA6B,EAC7B,gCAAgC,EAChC,oCAAoC,EACpC,2BAA2B,EAC3B,mCAAmC,GACpC,MAAM,4BAA4B,CAAC;AACpC;;;GAGG;AACH,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE;;;;GAIG;AACH,OAAO,EACL,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,sCAAsC,EACtC,iCAAiC,GAClC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,mCAAmC,CAAC;AAC3C,yEAAyE;AACzE,OAAO,EAAE,qCAAqC,EAAE,MAAM,6BAA6B,CAAC;AACpF;;;;;;GAMG;AACH,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAC7B,sBAAsB,EACtB,6BAA6B,EAC7B,qBAAqB,EACrB,sBAAsB,EACtB,oCAAoC,EACpC,uCAAuC,EACvC,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,iBAAiB,EACjB,sBAAsB,EACtB,kCAAkC,EAClC,wBAAwB,EACxB,iCAAiC,EACjC,kCAAkC,GACnC,MAAM,8BAA8B,CAAC;AACtC;;;GAGG;AACH,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE3E,0EAA0E;AAC1E,OAAO,EACL,cAAc,EACd,iDAAiD,GAClD,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC7E,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,6EAA6E;AAC7E,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,oEAAoE;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,8EAA8E;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,iCAAiC,EACjC,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,GAChC,MAAM,uBAAuB,CAAC;AAC/B;;;;;GAKG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD;;;;;;GAMG;AACH,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,2CAA2C,EAC3C,KAAK,gBAAgB,GACtB,MAAM,wBAAwB,CAAC"}

package/dist/index.js

@@ -7,7 +7,25 @@ export { freshenReceipt } from "./freshen-receipt.js";
  * re-exported here to preserve the receipt-verify public surface.
  */
 export { peakMMRIndexes } from "@forestrie/merklelog";
-export { decodeTrustRootFromGenesis } from "./decode-trust-root-from-genesis.js";
+/**
+ * `decodeTrustRootFromGenesis` keeps its origin/main signature and
+ * behaviour (`Promise<RootVerifyKey>`, including a KS256 v2 bootstrap key
+ * resolving without a throw) so pinned consumers (mcp-verify 1.0.0) are
+ * unaffected. `decodeTrustRootDetailsFromGenesis` is the additive sibling
+ * (plan-2609-07 L3) carrying `bootstrapKeyXy` alongside `key`.
+ */
+export { decodeTrustRootDetailsFromGenesis, decodeTrustRootFromGenesis, } from "./decode-trust-root-from-genesis.js";
+/**
+ * Genesis document label constants (plan-2609-07 L3): exported from the
+ * package root so consumers stop redefining them locally (mcp-resolve's own
+ * `genesis-binding.ts` did, before this).
+ */
+export { FOREST_GENESIS_LABEL_BOOTSTRAP_KEY, FOREST_GENESIS_LABEL_CHAIN_ID, FOREST_GENESIS_LABEL_GENESIS_ALG, FOREST_GENESIS_LABEL_GENESIS_VERSION, FOREST_GENESIS_LABEL_LOG_ID, FOREST_GENESIS_LABEL_UNIVOCITY_ADDR, } from "./forest-genesis-labels.js";
+/**
+ * Genesis-bound chain binding (plan-2609-07 L3): mirrors mcp-resolve's own
+ * `decodeChainBindingFromGenesis` so that consumer can delete its copy.
+ */
+export { decodeChainBindingFromGenesis } from "./decode-chain-binding-from-genesis.js";
 export { verifyGrantReceiptOffline } from "./verify-grant-receipt-offline.js";
 export { verifyReceiptOffline } from "./verify-grant-receipt-offline.js";
 /**
@@ -43,7 +61,7 @@ export { grantCommitmentHashFromGrant } from "./grant-commitment.js";
 export { findGrantLeafInMassif } from "./find-grant-leaf.js";
 /** Re-exported so callers of findGrantLeafInMassif can catch it (FOR-344). */
 export { MissingIndexError } from "@forestrie/merklelog";
-export { accumulatorPayload, checkpointConsistencyProof, computeCheckpointAccumulator, verifyCheckpointChain, } from "./checkpoint-chain.js";
+export { accumulatorPayload, checkpointConsistencyProof, computeCheckpointAccumulator, verifyCheckpointChain, CheckpointHighSSignatureError, CheckpointSignedSizeMismatchError, } from "./checkpoint-chain.js";
 /**
  * Univocity leaf commitment hash. Was CLI-private (forestrie-cli's own
  * mirror, "hoist to the library when the FOR-297 multi-hop resolver lands");

package/dist/parse-receipt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse-receipt.d.ts","sourceRoot":"","sources":["../src/parse-receipt.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAIlD,MAAM,MAAM,SAAS,GAAG;IACtB,eAAe,EAAE,UAAU;IAC3B,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACjE,OAAO,EAAE,UAAU,GAAG,IAAI;IAC1B,SAAS,EAAE,UAAU;CACtB,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAW1D;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,CAiB1D;AAED,wBAAgB,WAAW,CACzB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACpD,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAUtB;AAED,wBAAgB,YAAY,CAAC,YAAY,EAAE,UAAU,GAAG;IACtD,YAAY,EAAE,UAAU,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE,UAAU,CAAC;IACxB,SAAS,EAAE,SAAS,CAAC;CACtB,CAwDA"}
+{"version":3,"file":"parse-receipt.d.ts","sourceRoot":"","sources":["../src/parse-receipt.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAElD,MAAM,MAAM,SAAS,GAAG;IACtB,eAAe,EAAE,UAAU;IAC3B,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACjE,OAAO,EAAE,UAAU,GAAG,IAAI;IAC1B,SAAS,EAAE,UAAU;CACtB,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAW1D;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,CAiB1D;AAED,wBAAgB,WAAW,CACzB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACpD,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAUtB;AAED,wBAAgB,YAAY,CAAC,YAAY,EAAE,UAAU,GAAG;IACtD,YAAY,EAAE,UAAU,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE,UAAU,CAAC;IACxB,SAAS,EAAE,SAAS,CAAC;CACtB,CAwDA"}

package/dist/parse-receipt.js

@@ -1,5 +1,4 @@
-import { decodeCborDeterministic } from "@forestrie/encoding";
-const VDS_COSE_RECEIPT_PROOFS_TAG = 396;
+import { COSE_LABEL_VDP, decodeCborDeterministic } from "@forestrie/encoding";
 export function unwrapCoseSign1Tag(value) {
     if (value && typeof value === "object" && !(value instanceof Map)) {
         const tagged = value;
@@ -58,7 +57,7 @@ export function parseReceipt(receiptBytes) {
         throw new Error("Receipt payload must be nil (detached) or 32-byte peak hash");
     }
     const unprotected = toHeaderMap(coseSign1[1]);
-    const proofsRaw = unprotected.get(VDS_COSE_RECEIPT_PROOFS_TAG);
+    const proofsRaw = unprotected.get(COSE_LABEL_VDP);
     if (!proofsRaw || typeof proofsRaw !== "object") {
         throw new Error("Receipt missing header 396 (inclusion proof)");
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forestrie/receipt-verify",
-  "version": "1.0.0",
+  "version": "2.0.0",
   "license": "MIT",
   "type": "module",
   "description": "Offline SCITT grant receipt verification (ADR-0045)",
@@ -28,9 +28,9 @@
   ],
   "dependencies": {
     "@noble/hashes": "^1.7.1",
-    "@forestrie/chain-rpc": "0.2.0",
-    "@forestrie/encoding": "0.7.0",
-    "@forestrie/merklelog": "0.3.0"
+    "@forestrie/chain-rpc": "0.3.0",
+    "@forestrie/encoding": "0.8.0",
+    "@forestrie/merklelog": "0.4.0"
   },
   "devDependencies": {
     "esbuild": "^0.24.0",

package/src/attach-transparent-statement-receipt.ts

@@ -6,11 +6,18 @@
  * Golden vectors for receipt construction/verification are tracked by
  * FOR-289.
  */
-import { mergeUnprotectedIntoCoseSign1 } from "@forestrie/encoding";
+import {
+  COSE_LABEL_VDP,
+  mergeUnprotectedIntoCoseSign1,
+} from "@forestrie/encoding";
 import { HEADER_IDTIMESTAMP } from "./forest-genesis-labels.js";
 
-/** SCITT transparent statement unprotected receipt label (grants.md §3.2). */
-export const HEADER_RECEIPT = 396;
+/**
+ * SCITT transparent statement unprotected receipt label (grants.md §3.2).
+ * Alias of {@link COSE_LABEL_VDP} — kept exported under this name for
+ * existing callers.
+ */
+export const HEADER_RECEIPT = COSE_LABEL_VDP;
 
 export function attachReceiptAndIdtimestampToTransparentStatement(
   statementBytes: Uint8Array,

package/src/build-receipt-offline.ts

@@ -16,8 +16,11 @@
  */
 
 import {
+  COSE_LABEL_PEAK_RECEIPTS,
+  COSE_LABEL_VDP,
   decodeCborDeterministic,
   encodeCborDeterministic,
+  readProtectedTreeSize2,
 } from "@forestrie/encoding";
 import {
   calculateRoot,
@@ -34,12 +37,11 @@ import {
   unwrapCoseSign1Tag,
   type CoseSign1,
 } from "./parse-receipt.js";
+import { decodeConsistencyProofFromUnprotected } from "./decode-checkpoint-consistency-proof.js";
 import { SubtleHasher } from "./subtle-hasher.js";
 
-const VDS_COSE_RECEIPT_PROOFS_TAG = 396;
-const SEAL_PEAK_RECEIPTS_LABEL = -65931;
+/** Not in scope for the shared cose-labels module (FOR-568 §4.1). */
 const DELEGATION_CERT_LABEL = 1000;
-const VDP_CONSISTENCY_PROOF_KEY = -2;
 
 /**
  * Re-exported for compatibility. The MMR proof math and massif node store now
@@ -54,7 +56,14 @@ export type ParsedCheckpoint = {
   unprotected: Map<number, unknown>;
   /** Pre-signed peak receipts (label -65931), or null when absent. */
   peakReceipts: unknown[] | null;
-  /** Sealed tree size (tree-size-2 of the embedded consistency proof). */
+  /**
+   * Sealed tree size: the SIGNED `tree-size-2` from the checkpoint's
+   * PROTECTED header (ADR-0066 D1 as amended, label -65933), not the
+   * unprotected consistency proof's declared value. `null` when the
+   * checkpoint carries no embedded consistency proof or no signed
+   * tree-size-2 — such a checkpoint is not verifiable and callers must
+   * treat it exactly as they would a checkpoint with no proof at all.
+   */
   mmrSize: bigint | null;
   delegationCert: Uint8Array | null;
 };
@@ -65,7 +74,7 @@ export function parseCheckpoint(checkpointBytes: Uint8Array): ParsedCheckpoint {
   const coseSign1 = requireCoseSign1(unwrapCoseSign1Tag(decoded));
   const unprotected = toHeaderMap(coseSign1[1]);
 
-  const peakReceiptsRaw = unprotected.get(SEAL_PEAK_RECEIPTS_LABEL);
+  const peakReceiptsRaw = unprotected.get(COSE_LABEL_PEAK_RECEIPTS);
   const peakReceipts = Array.isArray(peakReceiptsRaw) ? peakReceiptsRaw : null;
 
   const delegationCertRaw = unprotected.get(DELEGATION_CERT_LABEL);
@@ -78,7 +87,7 @@ export function parseCheckpoint(checkpointBytes: Uint8Array): ParsedCheckpoint {
     coseSign1,
     unprotected,
     peakReceipts,
-    mmrSize: sealedSizeFromCheckpoint(unprotected),
+    mmrSize: sealedSizeFromCheckpoint(coseSign1, unprotected),
     delegationCert,
   };
 }
@@ -186,7 +195,7 @@ export function assembleReceiptFromProof(
   const verifiableProofs = new Map<number, unknown>([
     [-1, [inclusionProofEntry]],
   ]);
-  receiptUnprotected.set(VDS_COSE_RECEIPT_PROOFS_TAG, verifiableProofs);
+  receiptUnprotected.set(COSE_LABEL_VDP, verifiableProofs);
 
   // Peak receipts are signed with detached payload; emit nil so verify uses
   // the peak derived from the inclusion proof.
@@ -252,24 +261,34 @@ function cborBytes(value: unknown): Uint8Array {
 }
 
 /**
- * Sealed mmr size from a format-v3 checkpoint: tree-size-2 of the consistency
- * proof (`bstr .cbor [tree-size-1, tree-size-2, paths, right-peaks]`) under
- * the verifiable-proofs unprotected header (label 396, key -2).
+ * Sealed mmr size from a format-v3 checkpoint: the SIGNED `tree-size-2`
+ * (ADR-0066 D1 as amended, label -65933) from the PROTECTED header — not the
+ * unprotected consistency proof's declared value, which a checkpoint without
+ * a signing key could freely restate (ADR-0066's "keyless first checkpoint"
+ * case). A consistency proof must still be present (an unsigned checkpoint
+ * with no proof is not sealed at all); its declared sizes are not otherwise
+ * used here — {@link checkpointConsistencyProof} in `checkpoint-chain.ts`
+ * is the validating decode that requires the two to agree.
+ *
+ * Lenient by design: an absent proof, a malformed proof, or an absent or
+ * malformed signed tree-size-2 all yield `null` rather than a throw, so a
+ * caller of {@link parseCheckpoint} sees exactly the same "not verifiable"
+ * outcome either way.
  */
 function sealedSizeFromCheckpoint(
+  coseSign1: CoseSign1,
   unprotected: Map<number, unknown>,
 ): bigint | null {
-  const vdpRaw = unprotected.get(VDS_COSE_RECEIPT_PROOFS_TAG);
-  if (vdpRaw === undefined || vdpRaw === null) return null;
-  const vdp = toHeaderMap(vdpRaw as Map<number, unknown>);
-  const proofBstr = vdp.get(VDP_CONSISTENCY_PROOF_KEY);
-  if (!(proofBstr instanceof Uint8Array)) return null;
-  const proof = decodeCborDeterministic(proofBstr);
-  if (!Array.isArray(proof) || proof.length < 2) return null;
-  const treeSize2 = proof[1];
-  if (typeof treeSize2 === "bigint") return treeSize2;
-  if (typeof treeSize2 === "number" && Number.isSafeInteger(treeSize2)) {
-    return BigInt(treeSize2);
+  let declared;
+  try {
+    declared = decodeConsistencyProofFromUnprotected(unprotected);
+  } catch {
+    return null;
+  }
+  if (declared === null) return null;
+  try {
+    return readProtectedTreeSize2(coseSign1[0]);
+  } catch {
+    return null;
   }
-  return null;
 }