@forestrie/receipt-verify 1.1.0 → 2.0.0

package/dist/attach-transparent-statement-receipt.d.ts

@@ -1,4 +1,8 @@
-/** SCITT transparent statement unprotected receipt label (grants.md §3.2). */
+/**
+ * SCITT transparent statement unprotected receipt label (grants.md §3.2).
+ * Alias of {@link COSE_LABEL_VDP} — kept exported under this name for
+ * existing callers.
+ */
 export declare const HEADER_RECEIPT = 396;
 export declare function attachReceiptAndIdtimestampToTransparentStatement(statementBytes: Uint8Array, receiptCborBytes: Uint8Array, idtimestampBe8: Uint8Array): Uint8Array;
 //# sourceMappingURL=attach-transparent-statement-receipt.d.ts.map

package/dist/attach-transparent-statement-receipt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"attach-transparent-statement-receipt.d.ts","sourceRoot":"","sources":["../src/attach-transparent-statement-receipt.ts"],"names":[],"mappings":"AAWA,8EAA8E;AAC9E,eAAO,MAAM,cAAc,MAAM,CAAC;AAElC,wBAAgB,iDAAiD,CAC/D,cAAc,EAAE,UAAU,EAC1B,gBAAgB,EAAE,UAAU,EAC5B,cAAc,EAAE,UAAU,GACzB,UAAU,CAWZ"}
+{"version":3,"file":"attach-transparent-statement-receipt.d.ts","sourceRoot":"","sources":["../src/attach-transparent-statement-receipt.ts"],"names":[],"mappings":"AAcA;;;;GAIG;AACH,eAAO,MAAM,cAAc,MAAiB,CAAC;AAE7C,wBAAgB,iDAAiD,CAC/D,cAAc,EAAE,UAAU,EAC1B,gBAAgB,EAAE,UAAU,EAC5B,cAAc,EAAE,UAAU,GACzB,UAAU,CAWZ"}

package/dist/attach-transparent-statement-receipt.js

@@ -6,10 +6,14 @@
  * Golden vectors for receipt construction/verification are tracked by
  * FOR-289.
  */
-import { mergeUnprotectedIntoCoseSign1 } from "@forestrie/encoding";
+import { COSE_LABEL_VDP, mergeUnprotectedIntoCoseSign1, } from "@forestrie/encoding";
 import { HEADER_IDTIMESTAMP } from "./forest-genesis-labels.js";
-/** SCITT transparent statement unprotected receipt label (grants.md §3.2). */
-export const HEADER_RECEIPT = 396;
+/**
+ * SCITT transparent statement unprotected receipt label (grants.md §3.2).
+ * Alias of {@link COSE_LABEL_VDP} — kept exported under this name for
+ * existing callers.
+ */
+export const HEADER_RECEIPT = COSE_LABEL_VDP;
 export function attachReceiptAndIdtimestampToTransparentStatement(statementBytes, receiptCborBytes, idtimestampBe8) {
     if (idtimestampBe8.length !== 8) {
         throw new Error("idtimestamp must be 8 bytes (big-endian)");

package/dist/build-receipt-offline.d.ts

@@ -28,7 +28,14 @@ export type ParsedCheckpoint = {
     unprotected: Map<number, unknown>;
     /** Pre-signed peak receipts (label -65931), or null when absent. */
     peakReceipts: unknown[] | null;
-    /** Sealed tree size (tree-size-2 of the embedded consistency proof). */
+    /**
+     * Sealed tree size: the SIGNED `tree-size-2` from the checkpoint's
+     * PROTECTED header (ADR-0066 D1 as amended, label -65933), not the
+     * unprotected consistency proof's declared value. `null` when the
+     * checkpoint carries no embedded consistency proof or no signed
+     * tree-size-2 — such a checkpoint is not verifiable and callers must
+     * treat it exactly as they would a checkpoint with no proof at all.
+     */
     mmrSize: bigint | null;
     delegationCert: Uint8Array | null;
 };

package/dist/build-receipt-offline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-receipt-offline.d.ts","sourceRoot":"","sources":["../src/build-receipt-offline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAMH,OAAO,EAIL,mBAAmB,EAEnB,KAAK,eAAe,EAErB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,oBAAoB,CAAC;AAQ5B;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAC/B,YAAY,EAAE,eAAe,EAAE,CAAC;AAEhC,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,SAAS,CAAC;IACrB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,oEAAoE;IACpE,YAAY,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC/B,wEAAwE;IACxE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,cAAc,EAAE,UAAU,GAAG,IAAI,CAAC;CACnC,CAAC;AAEF,wDAAwD;AACxD,wBAAgB,eAAe,CAAC,eAAe,EAAE,UAAU,GAAG,gBAAgB,CAqB7E;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,WAAW,EAAE,UAAU,CAAC;IACxB,eAAe,EAAE,UAAU,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,wBAAwB,GAC9B,UAAU,CAyCZ;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,gBAAgB,EAC5B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,UAAU,EAAE,GAClB,UAAU,CA4CZ;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,mEAAmE;IACnE,IAAI,EAAE,UAAU,CAAC;IACjB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,SAAS,EAAE,UAAU,CAAC;CACvB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,WAAW,EAAE,UAAU,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAwBnC"}
+{"version":3,"file":"build-receipt-offline.d.ts","sourceRoot":"","sources":["../src/build-receipt-offline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AASH,OAAO,EAIL,mBAAmB,EAEnB,KAAK,eAAe,EAErB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,oBAAoB,CAAC;AAO5B;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAC/B,YAAY,EAAE,eAAe,EAAE,CAAC;AAEhC,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,SAAS,CAAC;IACrB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,oEAAoE;IACpE,YAAY,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC/B;;;;;;;OAOG;IACH,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,cAAc,EAAE,UAAU,GAAG,IAAI,CAAC;CACnC,CAAC;AAEF,wDAAwD;AACxD,wBAAgB,eAAe,CAAC,eAAe,EAAE,UAAU,GAAG,gBAAgB,CAqB7E;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,WAAW,EAAE,UAAU,CAAC;IACxB,eAAe,EAAE,UAAU,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,wBAAwB,GAC9B,UAAU,CAyCZ;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,gBAAgB,EAC5B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,UAAU,EAAE,GAClB,UAAU,CA4CZ;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,mEAAmE;IACnE,IAAI,EAAE,UAAU,CAAC;IACjB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,SAAS,EAAE,UAAU,CAAC;CACvB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,WAAW,EAAE,UAAU,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAwBnC"}

package/dist/build-receipt-offline.js

@@ -14,14 +14,13 @@
  * at an externally attested tree size (e.g. Univocity `logState` on Base
  * Sepolia) and compare the computed peak with the published accumulator.
  */
-import { decodeCborDeterministic, encodeCborDeterministic, } from "@forestrie/encoding";
+import { COSE_LABEL_PEAK_RECEIPTS, COSE_LABEL_VDP, decodeCborDeterministic, encodeCborDeterministic, readProtectedTreeSize2, } from "@forestrie/encoding";
 import { calculateRoot, inclusionProof, massifIndexFromMMRIndex, openMassifNodeStore, peakIndexForLeafProof, } from "@forestrie/merklelog";
 import { requireCoseSign1, toHeaderMap, unwrapCoseSign1Tag, } from "./parse-receipt.js";
+import { decodeConsistencyProofFromUnprotected } from "./decode-checkpoint-consistency-proof.js";
 import { SubtleHasher } from "./subtle-hasher.js";
-const VDS_COSE_RECEIPT_PROOFS_TAG = 396;
-const SEAL_PEAK_RECEIPTS_LABEL = -65931;
+/** Not in scope for the shared cose-labels module (FOR-568 §4.1). */
 const DELEGATION_CERT_LABEL = 1000;
-const VDP_CONSISTENCY_PROOF_KEY = -2;
 /**
  * Re-exported for compatibility. The MMR proof math and massif node store now
  * live in `@forestrie/merklelog` (plan-2607-15 §4, phase 2); receipt-verify
@@ -33,7 +32,7 @@ export function parseCheckpoint(checkpointBytes) {
     const decoded = decodeCborDeterministic(checkpointBytes);
     const coseSign1 = requireCoseSign1(unwrapCoseSign1Tag(decoded));
     const unprotected = toHeaderMap(coseSign1[1]);
-    const peakReceiptsRaw = unprotected.get(SEAL_PEAK_RECEIPTS_LABEL);
+    const peakReceiptsRaw = unprotected.get(COSE_LABEL_PEAK_RECEIPTS);
     const peakReceipts = Array.isArray(peakReceiptsRaw) ? peakReceiptsRaw : null;
     const delegationCertRaw = unprotected.get(DELEGATION_CERT_LABEL);
     const delegationCert = delegationCertRaw instanceof Uint8Array && delegationCertRaw.length > 0
@@ -43,7 +42,7 @@ export function parseCheckpoint(checkpointBytes) {
         coseSign1,
         unprotected,
         peakReceipts,
-        mmrSize: sealedSizeFromCheckpoint(unprotected),
+        mmrSize: sealedSizeFromCheckpoint(coseSign1, unprotected),
         delegationCert,
     };
 }
@@ -114,7 +113,7 @@ export function assembleReceiptFromProof(checkpoint, mmrIndex, proof) {
     const verifiableProofs = new Map([
         [-1, [inclusionProofEntry]],
     ]);
-    receiptUnprotected.set(VDS_COSE_RECEIPT_PROOFS_TAG, verifiableProofs);
+    receiptUnprotected.set(COSE_LABEL_VDP, verifiableProofs);
     // Peak receipts are signed with detached payload; emit nil so verify uses
     // the peak derived from the inclusion proof.
     const assembled = [
@@ -155,26 +154,34 @@ function cborBytes(value) {
     return encodeCborDeterministic(value);
 }
 /**
- * Sealed mmr size from a format-v3 checkpoint: tree-size-2 of the consistency
- * proof (`bstr .cbor [tree-size-1, tree-size-2, paths, right-peaks]`) under
- * the verifiable-proofs unprotected header (label 396, key -2).
+ * Sealed mmr size from a format-v3 checkpoint: the SIGNED `tree-size-2`
+ * (ADR-0066 D1 as amended, label -65933) from the PROTECTED header — not the
+ * unprotected consistency proof's declared value, which a checkpoint without
+ * a signing key could freely restate (ADR-0066's "keyless first checkpoint"
+ * case). A consistency proof must still be present (an unsigned checkpoint
+ * with no proof is not sealed at all); its declared sizes are not otherwise
+ * used here — {@link checkpointConsistencyProof} in `checkpoint-chain.ts`
+ * is the validating decode that requires the two to agree.
+ *
+ * Lenient by design: an absent proof, a malformed proof, or an absent or
+ * malformed signed tree-size-2 all yield `null` rather than a throw, so a
+ * caller of {@link parseCheckpoint} sees exactly the same "not verifiable"
+ * outcome either way.
  */
-function sealedSizeFromCheckpoint(unprotected) {
-    const vdpRaw = unprotected.get(VDS_COSE_RECEIPT_PROOFS_TAG);
-    if (vdpRaw === undefined || vdpRaw === null)
+function sealedSizeFromCheckpoint(coseSign1, unprotected) {
+    let declared;
+    try {
+        declared = decodeConsistencyProofFromUnprotected(unprotected);
+    }
+    catch {
         return null;
-    const vdp = toHeaderMap(vdpRaw);
-    const proofBstr = vdp.get(VDP_CONSISTENCY_PROOF_KEY);
-    if (!(proofBstr instanceof Uint8Array))
+    }
+    if (declared === null)
         return null;
-    const proof = decodeCborDeterministic(proofBstr);
-    if (!Array.isArray(proof) || proof.length < 2)
+    try {
+        return readProtectedTreeSize2(coseSign1[0]);
+    }
+    catch {
         return null;
-    const treeSize2 = proof[1];
-    if (typeof treeSize2 === "bigint")
-        return treeSize2;
-    if (typeof treeSize2 === "number" && Number.isSafeInteger(treeSize2)) {
-        return BigInt(treeSize2);
     }
-    return null;
 }

package/dist/checkpoint-chain.d.ts

@@ -1,28 +1,101 @@
-/** Draft-bryce consistency proof embedded in a v3 checkpoint. */
+/** Draft-bryce consistency proof embedded in a v3 checkpoint. `treeSize2` is
+ * cross-checked against the checkpoint's SIGNED tree-size-2 (ADR-0066 D1 as
+ * amended); `treeSize1` is unsigned prover context, not cross-checked here —
+ * see {@link verifyCheckpointChain}, which compares it with the trusted
+ * origin instead. */
 export type CheckpointConsistencyProof = {
     treeSize1: bigint;
     treeSize2: bigint;
+    /** Signed `tree-size-2` (protected header label -65933); equal to
+     * {@link treeSize2} — {@link checkpointConsistencyProof} enforces this. */
+    signedTreeSize2: bigint;
     /** One inclusion path per tree-size-1 peak, proven at tree-size-2. */
     paths: Uint8Array[][];
     /** New peaks not covered by the proven roots (draft `right-peaks`). */
     rightPeaks: Uint8Array[];
 };
-/** Decode the embedded consistency proof (`vdp` 396 key -2). */
+/**
+ * The checkpoint's SIGNED `tree-size-2` (protected header, ADR-0066 D1 as
+ * amended) differs from the declared `tree-size-2` of its embedded
+ * (unprotected) consistency proof. Distinct from a structurally malformed
+ * proof: {@link verifyCheckpointChain} reports this as `"size_mismatch"`,
+ * not `"proof_malformed"`.
+ */
+export declare class CheckpointSignedSizeMismatchError extends Error {
+    constructor(message: string);
+}
+/**
+ * The checkpoint's ES256 signature is the malleable high-s twin (`s > n/2`,
+ * `n` the P-256 group order): go-merklelog rejects these for checkpoint
+ * COSE_Sign1 signatures because the univocity contract's P-256 verifier
+ * does, so a receipt that verified here while carrying a high-s signature
+ * could be one the chain refuses (FOR-568 rollout item 4). Checked here,
+ * before any WebCrypto verify is attempted, so a rejected signature never
+ * reaches {@link verifyCheckpointChain}'s `verifySignature` callback. Scoped
+ * to the checkpoint receipt path only — this module never touches the WebAuthn
+ * (-65800) or session-key-endorsement (-65801) signature paths, which stay
+ * governed by their own canonical-form rules.
+ */
+export declare class CheckpointHighSSignatureError extends Error {
+    constructor(message: string);
+}
+/**
+ * Decode the embedded consistency proof (`vdp` 396 key -2) and require its
+ * declared `tree-size-2` to equal the checkpoint's SIGNED `tree-size-2` from
+ * the protected header (ADR-0066 D1 as amended, D5.5, label -65933).
+ * `tree-size-1` is not signed and is not checked here (D2 is withdrawn); see
+ * {@link verifyCheckpointChain} for its comparison against the trusted
+ * origin.
+ *
+ * Also rejects a malleable high-s ES256 signature (see
+ * {@link CheckpointHighSSignatureError}) before any fold or WebCrypto verify
+ * work — a checkpoint signed with any other algorithm (e.g. KS256) is not
+ * subject to this check, since it does not go through the P-256 WebCrypto
+ * path this guards.
+ *
+ * @throws {Error} when the protected header carries no consistency proof,
+ *   the proof is structurally malformed (see
+ *   {@link decodeConsistencyProofFromUnprotected}), or the protected header
+ *   carries no signed tree-size-2 label
+ * @throws {CheckpointSignedSizeMismatchError} when the signed tree-size-2
+ *   differs from the declared proof's tree-size-2
+ * @throws {CheckpointHighSSignatureError} when the checkpoint is ES256-signed
+ *   with a high-s (malleable) signature
+ */
 export declare function checkpointConsistencyProof(checkpointBytes: Uint8Array): CheckpointConsistencyProof;
 /**
- * One fold step: from the trusted accumulator at `proof.treeSize1`,
- * produce the `treeSize2` accumulator (draft: `consistent_roots` output
- * plus the supplied right-peaks). Structural sanity: the result must have
- * exactly the peak count of a size-`treeSize2` MMR.
+ * One fold step: from the CALLER-TRUSTED accumulator at `sizeFrom`, produce
+ * the `proof.treeSize2` accumulator via the size-driven
+ * {@link consistentRootsForSizes} (ADR-0066 D5) — `roots` (the proven
+ * prefix) followed by the proof's supplied right-peaks (the target peaks no
+ * path reaches).
+ *
+ * `sizeFrom` is a parameter, not read off `proof`, because the fold must run
+ * against a size the CALLER already trusts (the previous link's verified
+ * `treeSize2`, or the caller's anchor for a first link) — reading it from
+ * the proof instead would let an unsigned or substituted proof dictate its
+ * own starting point. `proof.treeSize1` must equal it regardless: the two
+ * disagreeing means this proof does not continue from the state being
+ * folded, not a mere shape defect, so it is checked before any fold work.
+ *
+ * @throws {Error} when `proof.treeSize1 !== sizeFrom`, or when the proof
+ *   supplies a right-peaks count other than
+ *   {@link consistentRootsForSizes}'s `expectedRight`
+ * @throws {ConsistencyShapeError} (`@forestrie/merklelog`) when the proof
+ *   does not have the shape MMR(sizeFrom) -> MMR(proof.treeSize2) implies
  */
-export declare function computeCheckpointAccumulator(proof: CheckpointConsistencyProof, accumulatorFrom: Uint8Array[]): Promise<Uint8Array[]>;
+export declare function computeCheckpointAccumulator(proof: CheckpointConsistencyProof, accumulatorFrom: Uint8Array[], sizeFrom: bigint): Promise<Uint8Array[]>;
 /** Detached payload the checkpoint signature covers (ADR-0046): the raw
  * concatenation of the accumulator peaks in contract order. */
 export declare function accumulatorPayload(accumulator: Uint8Array[]): Uint8Array;
 export type CheckpointChainLink = {
     treeSize1: bigint;
     treeSize2: bigint;
+    /** Signed `tree-size-2` (protected header label -65933; ADR-0066 D1 as
+     * amended). */
+    signedTreeSize2: bigint;
     accumulator: Uint8Array[];
+    /** Always `true`: a link is recorded only after its signature verified. */
     signatureOk: boolean;
 };
 export type CheckpointChainResult = {
@@ -31,7 +104,24 @@ export type CheckpointChainResult = {
     accumulator: Uint8Array[];
 } | {
     ok: false;
-    reason: "empty_chain" | "legacy_chain_break" | "signature" | "proof_malformed";
+    reason: "empty_chain" | "signature"
+    /**
+     * The checkpoint's ES256 signature is the malleable high-s twin (see
+     * {@link CheckpointHighSSignatureError}) — rejected before any
+     * WebCrypto verify, so it is distinct from `"signature"` (a
+     * canonical-form low-s signature that did not verify).
+     */
+     | "signature_malleable" | "proof_malformed"
+    /**
+     * Two sizes that must be equal are not. Either a checkpoint's SIGNED
+     * `tree-size-2` disagrees with its declared consistency-proof
+     * `tree-size-2` (ADR-0066 D1 as amended, D5.5), or a link's declared
+     * `tree-size-1` disagrees with the size the fold starts from — the
+     * caller's `trustedBase.size` (0 with no `trustedBase`) for the
+     * first link, the previous link's `tree-size-2` after that.
+     * `detail` names both sizes.
+     */
+     | "size_mismatch";
     /** Index of the offending checkpoint. */
     at: number;
     detail: string;
@@ -41,20 +131,43 @@ export type CheckpointChainResult = {
  * Verify a retained checkpoint chain (ascending massif order) and fold out
  * the final authenticated accumulator.
  *
- * - The first link must be boundary-based from 0 (a whole-log chain), or
- *   the caller supplies `accumulatorFrom` matching its base (a suffix
- *   chain rooted in an already-trusted accumulator).
- * - Every subsequent link's base must equal the previous link's sealed
- *   size — a mismatch is the legacy (pre-FOR-410) drift signature and is
- *   permanent for that log (`legacy_chain_break`).
+ * - The first link's trusted starting size is `trustedBase?.size ?? 0n`
+ *   (base 0 for a whole-log chain) with `trustedBase?.accumulator ?? []`
+ *   as the fold's starting accumulator (a suffix chain rooted in an
+ *   already-trusted accumulator supplies both).
+ * - A supplied `trustedBase` must describe a state an MMR can be in: its
+ *   `size` a complete MMR size, and its `accumulator` holding one peak per
+ *   peak of that size. `peaksBitmap` rounds an incomplete size DOWN to the
+ *   largest MMR below it, so without the completeness check a size of 5
+ *   folds the 4 -> N shape while every link reports a base of 5 — a node
+ *   count no MMR has. Both are `proof_malformed`.
+ * - The first link's declared `tree-size-1` must equal that trusted
+ *   starting size, and every subsequent link's must equal the previous
+ *   link's sealed `tree-size-2`; either disagreement is `size_mismatch`.
+ *   `tree-size-1` itself is never compared with a signed value (D2 is
+ *   withdrawn): only this trusted-origin comparison applies. Because it is
+ *   unsigned, the reason it produces carries no more meaning than the size
+ *   disagreement itself (ADR-0066 D6: no pre-FOR-410 state is supported, so
+ *   there is no drift condition to fall back from).
+ * - Each checkpoint's SIGNED `tree-size-2` (ADR-0066 D1 as amended) must
+ *   equal its declared consistency-proof `tree-size-2`
+ *   ({@link checkpointConsistencyProof}); a disagreement is
+ *   `size_mismatch`.
  * - Each link's signature is checked over its computed accumulator via
  *   the injected verifier (the caller owns trust resolution — genesis
- *   roots, caller-known keys, or the label-1000 delegation path).
+ *   roots, caller-known keys, or the label-1000 delegation path). A link
+ *   joins `links` only once its signature has verified, so on any failure
+ *   `links` is the verified prefix and never holds an accumulator nothing
+ *   attested.
  */
 export declare function verifyCheckpointChain(opts: {
     checkpoints: Uint8Array[];
     verifySignature: (checkpointBytes: Uint8Array, detachedPayload: Uint8Array) => Promise<boolean>;
-    /** Trusted base accumulator for a suffix chain (absent: base must be 0). */
-    accumulatorFrom?: Uint8Array[];
+    /** Trusted base for a suffix chain (a whole-log chain has base size 0 and
+     * an empty accumulator, which is also the default when this is absent). */
+    trustedBase?: {
+        size: bigint;
+        accumulator: Uint8Array[];
+    };
 }): Promise<CheckpointChainResult>;
 //# sourceMappingURL=checkpoint-chain.d.ts.map

package/dist/checkpoint-chain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checkpoint-chain.d.ts","sourceRoot":"","sources":["../src/checkpoint-chain.ts"],"names":[],"mappings":"AA6BA,iEAAiE;AACjE,MAAM,MAAM,0BAA0B,GAAG;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;IACtB,uEAAuE;IACvE,UAAU,EAAE,UAAU,EAAE,CAAC;CAC1B,CAAC;AA2BF,gEAAgE;AAChE,wBAAgB,0BAA0B,CACxC,eAAe,EAAE,UAAU,GAC1B,0BAA0B,CA6C5B;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,0BAA0B,EACjC,eAAe,EAAE,UAAU,EAAE,GAC5B,OAAO,CAAC,UAAU,EAAE,CAAC,CAmBvB;AAED;+DAC+D;AAC/D,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,UAAU,CAQxE;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,WAAW,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,mBAAmB,EAAE,CAAC;IAAC,WAAW,EAAE,UAAU,EAAE,CAAA;CAAE,GACrE;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EACF,aAAa,GACb,oBAAoB,GACpB,WAAW,GACX,iBAAiB,CAAC;IACtB,yCAAyC;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,mBAAmB,EAAE,CAAC;CAC9B,CAAC;AAEN;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,eAAe,EAAE,CACf,eAAe,EAAE,UAAU,EAC3B,eAAe,EAAE,UAAU,KACxB,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB,4EAA4E;IAC5E,eAAe,CAAC,EAAE,UAAU,EAAE,CAAC;CAChC,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAiGjC"}
+{"version":3,"file":"checkpoint-chain.d.ts","sourceRoot":"","sources":["../src/checkpoint-chain.ts"],"names":[],"mappings":"AAwDA;;;;qBAIqB;AACrB,MAAM,MAAM,0BAA0B,GAAG;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB;+EAC2E;IAC3E,eAAe,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;IACtB,uEAAuE;IACvE,UAAU,EAAE,UAAU,EAAE,CAAC;CAC1B,CAAC;AAEF;;;;;;GAMG;AACH,qBAAa,iCAAkC,SAAQ,KAAK;gBAC9C,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,6BAA8B,SAAQ,KAAK;gBAC1C,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,0BAA0B,CACxC,eAAe,EAAE,UAAU,GAC1B,0BAA0B,CAgC5B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,0BAA0B,EACjC,eAAe,EAAE,UAAU,EAAE,EAC7B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,EAAE,CAAC,CAoBvB;AAED;+DAC+D;AAC/D,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,UAAU,CAQxE;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB;mBACe;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,2EAA2E;IAC3E,WAAW,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,mBAAmB,EAAE,CAAC;IAAC,WAAW,EAAE,UAAU,EAAE,CAAA;CAAE,GACrE;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EACF,aAAa,GACb,WAAW;IACb;;;;;OAKG;OACD,qBAAqB,GACrB,iBAAiB;IACnB;;;;;;;;OAQG;OACD,eAAe,CAAC;IACpB,yCAAyC;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,mBAAmB,EAAE,CAAC;CAC9B,CAAC;AAEN;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,eAAe,EAAE,CACf,eAAe,EAAE,UAAU,EAC3B,eAAe,EAAE,UAAU,KACxB,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB;+EAC2E;IAC3E,WAAW,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;CAC3D,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAoIjC"}