@forestrie/receipt-verify 1.1.0 → 2.0.0

package/dist/freshen-receipt.js

@@ -45,7 +45,7 @@
  * tested go-merklelog port); this module only assembles node values by index
  * from the old receipt path + the consistency proofs.
  */
-import { calculateRoot, inclusionProofPath, peakIndexForLeafProof, peakMMRIndexes, } from "@forestrie/merklelog";
+import { calculateRoot, inclusionProofPath, mmrSizeForLeafCount, peakIndexForLeafProof, peakMMRIndexes, peaksBitmap, } from "@forestrie/merklelog";
 import { assembleReceiptFromProof, parseCheckpoint, } from "./build-receipt-offline.js";
 import { computeCheckpointAccumulator, } from "./checkpoint-chain.js";
 import { parseReceipt } from "./parse-receipt.js";
@@ -90,19 +90,26 @@ export async function freshenReceipt(input) {
         throw new Error("freshen requires at least one consistency proof linking the receipt's era to the checkpoint");
     }
     const firstLink = links[0];
-    // Base: a base-0 chain starts from an empty accumulator; a suffix chain's
-    // trusted seed must have the peak count of its tree-size-1.
-    const baseCount = input.accumulatorFrom?.length ?? 0;
-    if (firstLink.treeSize1 === 0n) {
-        if (baseCount !== 0) {
-            throw new Error("base-0 consistency chain must start from an empty accumulator seed");
-        }
-    }
-    else {
-        const wanted = peakMMRIndexes(firstLink.treeSize1 - 1n).length;
-        if (baseCount !== wanted) {
-            throw new Error(`base accumulator has ${baseCount} peaks; first link size ${firstLink.treeSize1} requires ${wanted}`);
-        }
+    // Base: the CALLER's trusted size and its accumulator (size 0 and an empty
+    // accumulator for a whole-log chain). The size has to be a size an MMR can
+    // have — `peaksBitmap` rounds an incomplete one DOWN, so a size of 5 would
+    // fold the 4 -> N shape — and the accumulator has to hold that size's
+    // peaks, which is the check the proof's own declared base used to stand in
+    // for.
+    const baseSize = input.trustedBase?.size ?? 0n;
+    const baseAccumulator = input.trustedBase?.accumulator ?? [];
+    if (baseSize < 0n ||
+        mmrSizeForLeafCount(peaksBitmap(baseSize)) !== baseSize) {
+        throw new Error(`trusted base size ${baseSize} is not a complete MMR size`);
+    }
+    const basePeaks = baseSize === 0n ? 0 : peakMMRIndexes(baseSize - 1n).length;
+    if (baseAccumulator.length !== basePeaks) {
+        throw new Error(`base accumulator has ${baseAccumulator.length} peaks; trusted base size ${baseSize} has ${basePeaks}`);
+    }
+    // The first link must continue from that size, not from a size it names
+    // itself (ADR-0066 D5.4).
+    if (firstLink.treeSize1 !== baseSize) {
+        throw new Error(`first consistency proof declares tree-size-1 ${firstLink.treeSize1}; the trusted base size is ${baseSize}`);
     }
     // Contiguity: each link continues where the previous one sealed.
     for (let i = 1; i < links.length; i++) {
@@ -115,10 +122,15 @@ export async function freshenReceipt(input) {
     if (lastLink.treeSize2 !== sealedSize) {
         throw new Error(`consistency chain ends at size ${lastLink.treeSize2} but the checkpoint sealed size ${sealedSize}`);
     }
-    // Fold the chain to the latest accumulator (self-check target).
-    let accumulator = input.accumulatorFrom ?? [];
+    // Fold the chain to the latest accumulator (self-check target). Each step
+    // runs against a size the caller trusts, never one read off the link being
+    // folded: the trusted base for the first link, and the size the previous
+    // link was just folded TO for every link after it.
+    let accumulator = baseAccumulator;
+    let sizeFrom = baseSize;
     for (const p of links) {
-        accumulator = await computeCheckpointAccumulator(p, accumulator);
+        accumulator = await computeCheckpointAccumulator(p, accumulator, sizeFrom);
+        sizeFrom = p.treeSize2;
     }
     const aLatest = accumulator;
     // Cross-check the fold against the checkpoint we are borrowing from (F1): the

package/dist/index.d.ts

@@ -76,7 +76,7 @@ export { findGrantLeafInMassif } from "./find-grant-leaf.js";
 export type { LocatedLeaf } from "./find-grant-leaf.js";
 /** Re-exported so callers of findGrantLeafInMassif can catch it (FOR-344). */
 export { MissingIndexError } from "@forestrie/merklelog";
-export { accumulatorPayload, checkpointConsistencyProof, computeCheckpointAccumulator, verifyCheckpointChain, type CheckpointChainLink, type CheckpointChainResult, type CheckpointConsistencyProof, } from "./checkpoint-chain.js";
+export { accumulatorPayload, checkpointConsistencyProof, computeCheckpointAccumulator, verifyCheckpointChain, CheckpointHighSSignatureError, CheckpointSignedSizeMismatchError, type CheckpointChainLink, type CheckpointChainResult, type CheckpointConsistencyProof, } from "./checkpoint-chain.js";
 /**
  * Univocity leaf commitment hash. Was CLI-private (forestrie-cli's own
  * mirror, "hoist to the library when the FOR-297 multi-hop resolver lands");

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,oFAAoF;AACpF,YAAY,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,YAAY,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AACxF,YAAY,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EACV,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC,+EAA+E;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EACV,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD;;;;;;GAMG;AACH,OAAO,EACL,iCAAiC,EACjC,0BAA0B,GAC3B,MAAM,qCAAqC,CAAC;AAC7C,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE;;;;GAIG;AACH,OAAO,EACL,kCAAkC,EAClC,6BAA6B,EAC7B,gCAAgC,EAChC,oCAAoC,EACpC,2BAA2B,EAC3B,mCAAmC,GACpC,MAAM,4BAA4B,CAAC;AACpC;;;GAGG;AACH,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE;;;;GAIG;AACH,OAAO,EACL,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,sCAAsC,EACtC,iCAAiC,GAClC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,mCAAmC,CAAC;AAC3C,yEAAyE;AACzE,OAAO,EAAE,qCAAqC,EAAE,MAAM,6BAA6B,CAAC;AACpF;;;;;;GAMG;AACH,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAC7B,sBAAsB,EACtB,6BAA6B,EAC7B,qBAAqB,EACrB,sBAAsB,EACtB,oCAAoC,EACpC,uCAAuC,EACvC,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,iBAAiB,EACjB,sBAAsB,EACtB,kCAAkC,EAClC,wBAAwB,EACxB,iCAAiC,EACjC,kCAAkC,GACnC,MAAM,8BAA8B,CAAC;AACtC;;;GAGG;AACH,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE3E,0EAA0E;AAC1E,OAAO,EACL,cAAc,EACd,iDAAiD,GAClD,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC7E,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,6EAA6E;AAC7E,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,oEAAoE;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,8EAA8E;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,4BAA4B,EAC5B,qBAAqB,EACrB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,GAChC,MAAM,uBAAuB,CAAC;AAC/B;;;;;GAKG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD;;;;;;GAMG;AACH,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,2CAA2C,EAC3C,KAAK,gBAAgB,GACtB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,oFAAoF;AACpF,YAAY,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,YAAY,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AACxF,YAAY,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EACV,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC,+EAA+E;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EACV,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD;;;;;;GAMG;AACH,OAAO,EACL,iCAAiC,EACjC,0BAA0B,GAC3B,MAAM,qCAAqC,CAAC;AAC7C,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE;;;;GAIG;AACH,OAAO,EACL,kCAAkC,EAClC,6BAA6B,EAC7B,gCAAgC,EAChC,oCAAoC,EACpC,2BAA2B,EAC3B,mCAAmC,GACpC,MAAM,4BAA4B,CAAC;AACpC;;;GAGG;AACH,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE;;;;GAIG;AACH,OAAO,EACL,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,sCAAsC,EACtC,iCAAiC,GAClC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,mCAAmC,CAAC;AAC3C,yEAAyE;AACzE,OAAO,EAAE,qCAAqC,EAAE,MAAM,6BAA6B,CAAC;AACpF;;;;;;GAMG;AACH,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAC7B,sBAAsB,EACtB,6BAA6B,EAC7B,qBAAqB,EACrB,sBAAsB,EACtB,oCAAoC,EACpC,uCAAuC,EACvC,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,iBAAiB,EACjB,sBAAsB,EACtB,kCAAkC,EAClC,wBAAwB,EACxB,iCAAiC,EACjC,kCAAkC,GACnC,MAAM,8BAA8B,CAAC;AACtC;;;GAGG;AACH,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE3E,0EAA0E;AAC1E,OAAO,EACL,cAAc,EACd,iDAAiD,GAClD,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC7E,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,6EAA6E;AAC7E,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,oEAAoE;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,8EAA8E;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,iCAAiC,EACjC,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,GAChC,MAAM,uBAAuB,CAAC;AAC/B;;;;;GAKG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD;;;;;;GAMG;AACH,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,2CAA2C,EAC3C,KAAK,gBAAgB,GACtB,MAAM,wBAAwB,CAAC"}

package/dist/index.js

@@ -61,7 +61,7 @@ export { grantCommitmentHashFromGrant } from "./grant-commitment.js";
 export { findGrantLeafInMassif } from "./find-grant-leaf.js";
 /** Re-exported so callers of findGrantLeafInMassif can catch it (FOR-344). */
 export { MissingIndexError } from "@forestrie/merklelog";
-export { accumulatorPayload, checkpointConsistencyProof, computeCheckpointAccumulator, verifyCheckpointChain, } from "./checkpoint-chain.js";
+export { accumulatorPayload, checkpointConsistencyProof, computeCheckpointAccumulator, verifyCheckpointChain, CheckpointHighSSignatureError, CheckpointSignedSizeMismatchError, } from "./checkpoint-chain.js";
 /**
  * Univocity leaf commitment hash. Was CLI-private (forestrie-cli's own
  * mirror, "hoist to the library when the FOR-297 multi-hop resolver lands");

package/dist/parse-receipt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parse-receipt.d.ts","sourceRoot":"","sources":["../src/parse-receipt.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAIlD,MAAM,MAAM,SAAS,GAAG;IACtB,eAAe,EAAE,UAAU;IAC3B,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACjE,OAAO,EAAE,UAAU,GAAG,IAAI;IAC1B,SAAS,EAAE,UAAU;CACtB,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAW1D;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,CAiB1D;AAED,wBAAgB,WAAW,CACzB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACpD,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAUtB;AAED,wBAAgB,YAAY,CAAC,YAAY,EAAE,UAAU,GAAG;IACtD,YAAY,EAAE,UAAU,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE,UAAU,CAAC;IACxB,SAAS,EAAE,SAAS,CAAC;CACtB,CAwDA"}
+{"version":3,"file":"parse-receipt.d.ts","sourceRoot":"","sources":["../src/parse-receipt.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAElD,MAAM,MAAM,SAAS,GAAG;IACtB,eAAe,EAAE,UAAU;IAC3B,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IACjE,OAAO,EAAE,UAAU,GAAG,IAAI;IAC1B,SAAS,EAAE,UAAU;CACtB,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAW1D;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,CAiB1D;AAED,wBAAgB,WAAW,CACzB,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACpD,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAUtB;AAED,wBAAgB,YAAY,CAAC,YAAY,EAAE,UAAU,GAAG;IACtD,YAAY,EAAE,UAAU,GAAG,IAAI,CAAC;IAChC,KAAK,EAAE,KAAK,CAAC;IACb,WAAW,EAAE,UAAU,CAAC;IACxB,SAAS,EAAE,SAAS,CAAC;CACtB,CAwDA"}

package/dist/parse-receipt.js

@@ -1,5 +1,4 @@
-import { decodeCborDeterministic } from "@forestrie/encoding";
-const VDS_COSE_RECEIPT_PROOFS_TAG = 396;
+import { COSE_LABEL_VDP, decodeCborDeterministic } from "@forestrie/encoding";
 export function unwrapCoseSign1Tag(value) {
     if (value && typeof value === "object" && !(value instanceof Map)) {
         const tagged = value;
@@ -58,7 +57,7 @@ export function parseReceipt(receiptBytes) {
         throw new Error("Receipt payload must be nil (detached) or 32-byte peak hash");
     }
     const unprotected = toHeaderMap(coseSign1[1]);
-    const proofsRaw = unprotected.get(VDS_COSE_RECEIPT_PROOFS_TAG);
+    const proofsRaw = unprotected.get(COSE_LABEL_VDP);
     if (!proofsRaw || typeof proofsRaw !== "object") {
         throw new Error("Receipt missing header 396 (inclusion proof)");
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forestrie/receipt-verify",
-  "version": "1.1.0",
+  "version": "2.0.0",
   "license": "MIT",
   "type": "module",
   "description": "Offline SCITT grant receipt verification (ADR-0045)",
@@ -29,8 +29,8 @@
   "dependencies": {
     "@noble/hashes": "^1.7.1",
     "@forestrie/chain-rpc": "0.3.0",
-    "@forestrie/merklelog": "0.3.0",
-    "@forestrie/encoding": "0.7.0"
+    "@forestrie/encoding": "0.8.0",
+    "@forestrie/merklelog": "0.4.0"
   },
   "devDependencies": {
     "esbuild": "^0.24.0",

package/src/attach-transparent-statement-receipt.ts

@@ -6,11 +6,18 @@
  * Golden vectors for receipt construction/verification are tracked by
  * FOR-289.
  */
-import { mergeUnprotectedIntoCoseSign1 } from "@forestrie/encoding";
+import {
+  COSE_LABEL_VDP,
+  mergeUnprotectedIntoCoseSign1,
+} from "@forestrie/encoding";
 import { HEADER_IDTIMESTAMP } from "./forest-genesis-labels.js";
 
-/** SCITT transparent statement unprotected receipt label (grants.md §3.2). */
-export const HEADER_RECEIPT = 396;
+/**
+ * SCITT transparent statement unprotected receipt label (grants.md §3.2).
+ * Alias of {@link COSE_LABEL_VDP} — kept exported under this name for
+ * existing callers.
+ */
+export const HEADER_RECEIPT = COSE_LABEL_VDP;
 
 export function attachReceiptAndIdtimestampToTransparentStatement(
   statementBytes: Uint8Array,

package/src/build-receipt-offline.ts

@@ -16,8 +16,11 @@
  */
 
 import {
+  COSE_LABEL_PEAK_RECEIPTS,
+  COSE_LABEL_VDP,
   decodeCborDeterministic,
   encodeCborDeterministic,
+  readProtectedTreeSize2,
 } from "@forestrie/encoding";
 import {
   calculateRoot,
@@ -34,12 +37,11 @@ import {
   unwrapCoseSign1Tag,
   type CoseSign1,
 } from "./parse-receipt.js";
+import { decodeConsistencyProofFromUnprotected } from "./decode-checkpoint-consistency-proof.js";
 import { SubtleHasher } from "./subtle-hasher.js";
 
-const VDS_COSE_RECEIPT_PROOFS_TAG = 396;
-const SEAL_PEAK_RECEIPTS_LABEL = -65931;
+/** Not in scope for the shared cose-labels module (FOR-568 §4.1). */
 const DELEGATION_CERT_LABEL = 1000;
-const VDP_CONSISTENCY_PROOF_KEY = -2;
 
 /**
  * Re-exported for compatibility. The MMR proof math and massif node store now
@@ -54,7 +56,14 @@ export type ParsedCheckpoint = {
   unprotected: Map<number, unknown>;
   /** Pre-signed peak receipts (label -65931), or null when absent. */
   peakReceipts: unknown[] | null;
-  /** Sealed tree size (tree-size-2 of the embedded consistency proof). */
+  /**
+   * Sealed tree size: the SIGNED `tree-size-2` from the checkpoint's
+   * PROTECTED header (ADR-0066 D1 as amended, label -65933), not the
+   * unprotected consistency proof's declared value. `null` when the
+   * checkpoint carries no embedded consistency proof or no signed
+   * tree-size-2 — such a checkpoint is not verifiable and callers must
+   * treat it exactly as they would a checkpoint with no proof at all.
+   */
   mmrSize: bigint | null;
   delegationCert: Uint8Array | null;
 };
@@ -65,7 +74,7 @@ export function parseCheckpoint(checkpointBytes: Uint8Array): ParsedCheckpoint {
   const coseSign1 = requireCoseSign1(unwrapCoseSign1Tag(decoded));
   const unprotected = toHeaderMap(coseSign1[1]);
 
-  const peakReceiptsRaw = unprotected.get(SEAL_PEAK_RECEIPTS_LABEL);
+  const peakReceiptsRaw = unprotected.get(COSE_LABEL_PEAK_RECEIPTS);
   const peakReceipts = Array.isArray(peakReceiptsRaw) ? peakReceiptsRaw : null;
 
   const delegationCertRaw = unprotected.get(DELEGATION_CERT_LABEL);
@@ -78,7 +87,7 @@ export function parseCheckpoint(checkpointBytes: Uint8Array): ParsedCheckpoint {
     coseSign1,
     unprotected,
     peakReceipts,
-    mmrSize: sealedSizeFromCheckpoint(unprotected),
+    mmrSize: sealedSizeFromCheckpoint(coseSign1, unprotected),
     delegationCert,
   };
 }
@@ -186,7 +195,7 @@ export function assembleReceiptFromProof(
   const verifiableProofs = new Map<number, unknown>([
     [-1, [inclusionProofEntry]],
   ]);
-  receiptUnprotected.set(VDS_COSE_RECEIPT_PROOFS_TAG, verifiableProofs);
+  receiptUnprotected.set(COSE_LABEL_VDP, verifiableProofs);
 
   // Peak receipts are signed with detached payload; emit nil so verify uses
   // the peak derived from the inclusion proof.
@@ -252,24 +261,34 @@ function cborBytes(value: unknown): Uint8Array {
 }
 
 /**
- * Sealed mmr size from a format-v3 checkpoint: tree-size-2 of the consistency
- * proof (`bstr .cbor [tree-size-1, tree-size-2, paths, right-peaks]`) under
- * the verifiable-proofs unprotected header (label 396, key -2).
+ * Sealed mmr size from a format-v3 checkpoint: the SIGNED `tree-size-2`
+ * (ADR-0066 D1 as amended, label -65933) from the PROTECTED header — not the
+ * unprotected consistency proof's declared value, which a checkpoint without
+ * a signing key could freely restate (ADR-0066's "keyless first checkpoint"
+ * case). A consistency proof must still be present (an unsigned checkpoint
+ * with no proof is not sealed at all); its declared sizes are not otherwise
+ * used here — {@link checkpointConsistencyProof} in `checkpoint-chain.ts`
+ * is the validating decode that requires the two to agree.
+ *
+ * Lenient by design: an absent proof, a malformed proof, or an absent or
+ * malformed signed tree-size-2 all yield `null` rather than a throw, so a
+ * caller of {@link parseCheckpoint} sees exactly the same "not verifiable"
+ * outcome either way.
  */
 function sealedSizeFromCheckpoint(
+  coseSign1: CoseSign1,
   unprotected: Map<number, unknown>,
 ): bigint | null {
-  const vdpRaw = unprotected.get(VDS_COSE_RECEIPT_PROOFS_TAG);
-  if (vdpRaw === undefined || vdpRaw === null) return null;
-  const vdp = toHeaderMap(vdpRaw as Map<number, unknown>);
-  const proofBstr = vdp.get(VDP_CONSISTENCY_PROOF_KEY);
-  if (!(proofBstr instanceof Uint8Array)) return null;
-  const proof = decodeCborDeterministic(proofBstr);
-  if (!Array.isArray(proof) || proof.length < 2) return null;
-  const treeSize2 = proof[1];
-  if (typeof treeSize2 === "bigint") return treeSize2;
-  if (typeof treeSize2 === "number" && Number.isSafeInteger(treeSize2)) {
-    return BigInt(treeSize2);
+  let declared;
+  try {
+    declared = decodeConsistencyProofFromUnprotected(unprotected);
+  } catch {
+    return null;
+  }
+  if (declared === null) return null;
+  try {
+    return readProtectedTreeSize2(coseSign1[0]);
+  } catch {
+    return null;
   }
-  return null;
 }