@forestrie/receipt-verify 2.1.0 → 2.2.0

package/dist/checkpoint-chain.d.ts

@@ -39,6 +39,21 @@ export declare class CheckpointSignedSizeMismatchError extends Error {
 export declare class CheckpointHighSSignatureError extends Error {
     constructor(message: string);
 }
+/**
+ * The checkpoint's protected header carries no integer `alg` (label 1).
+ *
+ * The univocity contract rejects such a header outright — the structural
+ * walk finds the size, and the `alg` requirement in the same call raises
+ * `ClaimNotFound(1)` or `UnexpectedMajorType`. Off-chain the header used to
+ * read as "no algorithm stated", which both turned OFF the high-s rejection
+ * below (gated on the algorithm being ES256) and still yielded a signed size
+ * to fold from — so a checkpoint the chain will never anchor verified here
+ * under weaker rules than a well-formed one (review finding S-1). Reported
+ * as `"proof_malformed"` by {@link verifyCheckpointChain}.
+ */
+export declare class CheckpointProtectedHeaderAlgError extends Error {
+    constructor(message: string);
+}
 /**
  * Decode the embedded consistency proof (`vdp` 396 key -2) and require its
  * declared `tree-size-2` to equal the checkpoint's SIGNED `tree-size-2` from
@@ -61,6 +76,8 @@ export declare class CheckpointHighSSignatureError extends Error {
  *   differs from the declared proof's tree-size-2
  * @throws {CheckpointHighSSignatureError} when the checkpoint is ES256-signed
  *   with a high-s (malleable) signature
+ * @throws {CheckpointProtectedHeaderAlgError} when the protected header
+ *   carries no integer `alg` (label 1)
  */
 export declare function checkpointConsistencyProof(checkpointBytes: Uint8Array): CheckpointConsistencyProof;
 /**
@@ -136,11 +153,14 @@ export type CheckpointChainResult = {
  *   as the fold's starting accumulator (a suffix chain rooted in an
  *   already-trusted accumulator supplies both).
  * - A supplied `trustedBase` must describe a state an MMR can be in: its
- *   `size` a complete MMR size, and its `accumulator` holding one peak per
- *   peak of that size. `peaksBitmap` rounds an incomplete size DOWN to the
- *   largest MMR below it, so without the completeness check a size of 5
- *   folds the 4 -> N shape while every link reports a base of 5 — a node
- *   count no MMR has. Both are `proof_malformed`.
+ *   `size` a complete MMR size, its `accumulator` holding one peak per peak
+ *   of that size, and every one of those peaks a 32-byte node value.
+ *   `peaksBitmap` rounds an incomplete size DOWN to the largest MMR below
+ *   it, so without the completeness check a size of 5 folds the 4 -> N shape
+ *   while every link reports a base of 5 — a node count no MMR has; and
+ *   without the byte-length check an origin peak of any length is copied
+ *   through the empty-path branch into the detached payload. All three are
+ *   `proof_malformed`.
  * - The first link's declared `tree-size-1` must equal that trusted
  *   starting size, and every subsequent link's must equal the previous
  *   link's sealed `tree-size-2`; either disagreement is `size_mismatch`.

package/dist/checkpoint-chain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"checkpoint-chain.d.ts","sourceRoot":"","sources":["../src/checkpoint-chain.ts"],"names":[],"mappings":"AAwDA;;;;qBAIqB;AACrB,MAAM,MAAM,0BAA0B,GAAG;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB;+EAC2E;IAC3E,eAAe,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;IACtB,uEAAuE;IACvE,UAAU,EAAE,UAAU,EAAE,CAAC;CAC1B,CAAC;AAEF;;;;;;GAMG;AACH,qBAAa,iCAAkC,SAAQ,KAAK;gBAC9C,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,6BAA8B,SAAQ,KAAK;gBAC1C,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,0BAA0B,CACxC,eAAe,EAAE,UAAU,GAC1B,0BAA0B,CAgC5B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,0BAA0B,EACjC,eAAe,EAAE,UAAU,EAAE,EAC7B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,EAAE,CAAC,CAoBvB;AAED;+DAC+D;AAC/D,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,UAAU,CAQxE;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB;mBACe;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,2EAA2E;IAC3E,WAAW,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,mBAAmB,EAAE,CAAC;IAAC,WAAW,EAAE,UAAU,EAAE,CAAA;CAAE,GACrE;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EACF,aAAa,GACb,WAAW;IACb;;;;;OAKG;OACD,qBAAqB,GACrB,iBAAiB;IACnB;;;;;;;;OAQG;OACD,eAAe,CAAC;IACpB,yCAAyC;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,mBAAmB,EAAE,CAAC;CAC9B,CAAC;AAEN;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,eAAe,EAAE,CACf,eAAe,EAAE,UAAU,EAC3B,eAAe,EAAE,UAAU,KACxB,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB;+EAC2E;IAC3E,WAAW,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;CAC3D,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAoIjC"}
+{"version":3,"file":"checkpoint-chain.d.ts","sourceRoot":"","sources":["../src/checkpoint-chain.ts"],"names":[],"mappings":"AAyDA;;;;qBAIqB;AACrB,MAAM,MAAM,0BAA0B,GAAG;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB;+EAC2E;IAC3E,eAAe,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC;IACtB,uEAAuE;IACvE,UAAU,EAAE,UAAU,EAAE,CAAC;CAC1B,CAAC;AAEF;;;;;;GAMG;AACH,qBAAa,iCAAkC,SAAQ,KAAK;gBAC9C,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,6BAA8B,SAAQ,KAAK;gBAC1C,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,iCAAkC,SAAQ,KAAK;gBAC9C,OAAO,EAAE,MAAM;CAI5B;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,0BAA0B,CACxC,eAAe,EAAE,UAAU,GAC1B,0BAA0B,CA6C5B;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,0BAA0B,EACjC,eAAe,EAAE,UAAU,EAAE,EAC7B,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,EAAE,CAAC,CAoBvB;AAED;+DAC+D;AAC/D,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,UAAU,CAQxE;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB;mBACe;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,2EAA2E;IAC3E,WAAW,EAAE,OAAO,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,mBAAmB,EAAE,CAAC;IAAC,WAAW,EAAE,UAAU,EAAE,CAAA;CAAE,GACrE;IACE,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EACF,aAAa,GACb,WAAW;IACb;;;;;OAKG;OACD,qBAAqB,GACrB,iBAAiB;IACnB;;;;;;;;OAQG;OACD,eAAe,CAAC;IACpB,yCAAyC;IACzC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,mBAAmB,EAAE,CAAC;CAC9B,CAAC;AAEN;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,EAAE;IAChD,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,eAAe,EAAE,CACf,eAAe,EAAE,UAAU,EAC3B,eAAe,EAAE,UAAU,KACxB,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB;+EAC2E;IAC3E,WAAW,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;CAC3D,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAuJjC"}

package/dist/checkpoint-chain.js

@@ -38,7 +38,7 @@
  * the key, so no reason string chosen from it may mean anything more than
  * "these two sizes differ".
  */
-import { COSE_ALG_ES256, extractAlgFromProtected, isLowS, readProtectedTreeSize2, } from "@forestrie/encoding";
+import { COSE_ALG_ES256, ProtectedHeaderAlgError, isLowS, readProtectedAlg, readProtectedTreeSize2, } from "@forestrie/encoding";
 import { consistentRootsForSizes, mmrSizeForLeafCount, peakMMRIndexes, peaksBitmap, } from "@forestrie/merklelog";
 import { SubtleHasher } from "./subtle-hasher.js";
 import { parseCheckpoint } from "./build-receipt-offline.js";
@@ -74,6 +74,24 @@ export class CheckpointHighSSignatureError extends Error {
         this.name = "CheckpointHighSSignatureError";
     }
 }
+/**
+ * The checkpoint's protected header carries no integer `alg` (label 1).
+ *
+ * The univocity contract rejects such a header outright — the structural
+ * walk finds the size, and the `alg` requirement in the same call raises
+ * `ClaimNotFound(1)` or `UnexpectedMajorType`. Off-chain the header used to
+ * read as "no algorithm stated", which both turned OFF the high-s rejection
+ * below (gated on the algorithm being ES256) and still yielded a signed size
+ * to fold from — so a checkpoint the chain will never anchor verified here
+ * under weaker rules than a well-formed one (review finding S-1). Reported
+ * as `"proof_malformed"` by {@link verifyCheckpointChain}.
+ */
+export class CheckpointProtectedHeaderAlgError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "CheckpointProtectedHeaderAlgError";
+    }
+}
 /**
  * Decode the embedded consistency proof (`vdp` 396 key -2) and require its
  * declared `tree-size-2` to equal the checkpoint's SIGNED `tree-size-2` from
@@ -96,10 +114,24 @@ export class CheckpointHighSSignatureError extends Error {
  *   differs from the declared proof's tree-size-2
  * @throws {CheckpointHighSSignatureError} when the checkpoint is ES256-signed
  *   with a high-s (malleable) signature
+ * @throws {CheckpointProtectedHeaderAlgError} when the protected header
+ *   carries no integer `alg` (label 1)
  */
 export function checkpointConsistencyProof(checkpointBytes) {
     const { coseSign1, unprotected } = parseCheckpoint(checkpointBytes);
-    const alg = extractAlgFromProtected(coseSign1[0]);
+    // Strict: a header with no integer alg is one the contract rejects, and
+    // reading it leniently would switch the high-s rejection below off while
+    // the signed size was still taken from it (S-1).
+    let alg;
+    try {
+        alg = readProtectedAlg(coseSign1[0]);
+    }
+    catch (err) {
+        if (err instanceof ProtectedHeaderAlgError) {
+            throw new CheckpointProtectedHeaderAlgError(`checkpoint protected header carries no integer alg (label 1): ${err.message}`);
+        }
+        throw err;
+    }
     const signature = coseSign1[3];
     if (alg === COSE_ALG_ES256 && signature.length === 64 && !isLowS(signature)) {
         throw new CheckpointHighSSignatureError("checkpoint ES256 signature is not low-s canonical (s > n/2); rejected " +
@@ -176,11 +208,14 @@ export function accumulatorPayload(accumulator) {
  *   as the fold's starting accumulator (a suffix chain rooted in an
  *   already-trusted accumulator supplies both).
  * - A supplied `trustedBase` must describe a state an MMR can be in: its
- *   `size` a complete MMR size, and its `accumulator` holding one peak per
- *   peak of that size. `peaksBitmap` rounds an incomplete size DOWN to the
- *   largest MMR below it, so without the completeness check a size of 5
- *   folds the 4 -> N shape while every link reports a base of 5 — a node
- *   count no MMR has. Both are `proof_malformed`.
+ *   `size` a complete MMR size, its `accumulator` holding one peak per peak
+ *   of that size, and every one of those peaks a 32-byte node value.
+ *   `peaksBitmap` rounds an incomplete size DOWN to the largest MMR below
+ *   it, so without the completeness check a size of 5 folds the 4 -> N shape
+ *   while every link reports a base of 5 — a node count no MMR has; and
+ *   without the byte-length check an origin peak of any length is copied
+ *   through the empty-path branch into the detached payload. All three are
+ *   `proof_malformed`.
  * - The first link's declared `tree-size-1` must equal that trusted
  *   starting size, and every subsequent link's must equal the previous
  *   link's sealed `tree-size-2`; either disagreement is `size_mismatch`.
@@ -240,6 +275,25 @@ export async function verifyCheckpointChain(opts) {
                 links,
             };
         }
+        // …and every peak must be a 32-byte node value, the check arbor's
+        // producer applies to both path elements and right-peaks (`toNode32`).
+        // The count alone does not reach it: on the empty-path branch an origin
+        // peak is copied into the result verbatim, so a 0/31/33/64-byte peak
+        // reaches `accumulatorPayload` and shortens or lengthens the detached
+        // payload, with only the signature left to reject it (review finding
+        // I2, canopy C6).
+        for (let i = 0; i < trustedBase.accumulator.length; i++) {
+            const peak = trustedBase.accumulator[i];
+            if (!(peak instanceof Uint8Array) || peak.length !== 32) {
+                return {
+                    ok: false,
+                    reason: "proof_malformed",
+                    at: 0,
+                    detail: `trusted base accumulator peak ${i} is not a 32-byte node value (${describePeak(peak)})`,
+                    links,
+                };
+            }
+        }
     }
     let accumulator = trustedBase?.accumulator ?? [];
     let expectedBase = trustedBase?.size ?? 0n;
@@ -322,3 +376,13 @@ export async function verifyCheckpointChain(opts) {
     }
     return { ok: true, links, accumulator };
 }
+/** Name what was found where a 32-byte accumulator peak was required. */
+function describePeak(peak) {
+    if (peak instanceof Uint8Array)
+        return `${peak.length} bytes`;
+    if (peak === null)
+        return "null";
+    if (Array.isArray(peak))
+        return "an array";
+    return typeof peak;
+}

package/dist/freshen-receipt.d.ts

@@ -16,7 +16,9 @@ export type FreshenReceiptInput = {
     leafValue: Uint8Array;
     /** Consistency-proof chain covering [0 or the trusted base] → the latest
      * sealed size, in ascending contiguous order (the raw per-checkpoint
-     * proofs, with `paths`). The chain's last link must end at the
+     * proofs, with `paths`). Every link's `signedTreeSize2` must equal its
+     * `treeSize2`, as `checkpointConsistencyProof` requires of the checkpoint
+     * it decoded each link from. The chain's last link must end at the
      * checkpoint's sealed size. */
     consistencyProofs: readonly CheckpointConsistencyProof[];
     /** Trusted base for a suffix chain — the size the caller already trusts
@@ -40,9 +42,11 @@ export type FreshenReceiptResult = {
     sealedSize: bigint;
 };
 /**
- * Freshen a stale receipt to the latest sealed state. Throws if the chain is
- * not a contiguous cover from the trusted base to the checkpoint's sealed size,
- * if a climb node is missing from the supplied proofs, or if the recomputed
+ * Freshen a stale receipt to the latest sealed state. Throws if a link's
+ * signed `tree-size-2` disagrees with its declared one
+ * ({@link CheckpointSignedSizeMismatchError}), if the chain is not a
+ * contiguous cover from the trusted base to the checkpoint's sealed size, if
+ * a climb node is missing from the supplied proofs, or if the recomputed
  * peak does not match the folded latest accumulator.
  */
 export declare function freshenReceipt(input: FreshenReceiptInput): Promise<FreshenReceiptResult>;

package/dist/freshen-receipt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"freshen-receipt.d.ts","sourceRoot":"","sources":["../src/freshen-receipt.ts"],"names":[],"mappings":"AA2DA,OAAO,EAEL,KAAK,0BAA0B,EAChC,MAAM,uBAAuB,CAAC;AAI/B;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,iEAAiE;IACjE,eAAe,EAAE,UAAU,CAAC;IAC5B;uEACmE;IACnE,SAAS,EAAE,UAAU,CAAC;IACtB;;;mCAG+B;IAC/B,iBAAiB,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACzD;;;;;kDAK8C;IAC9C,WAAW,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IAC1D;wDACoD;IACpD,qBAAqB,EAAE,UAAU,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,wEAAwE;IACxE,OAAO,EAAE,UAAU,CAAC;IACpB,wDAAwD;IACxD,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AASF;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,oBAAoB,CAAC,CAwK/B"}
+{"version":3,"file":"freshen-receipt.d.ts","sourceRoot":"","sources":["../src/freshen-receipt.ts"],"names":[],"mappings":"AA2DA,OAAO,EAGL,KAAK,0BAA0B,EAChC,MAAM,uBAAuB,CAAC;AAI/B;;;;;;;;GAQG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,iEAAiE;IACjE,eAAe,EAAE,UAAU,CAAC;IAC5B;uEACmE;IACnE,SAAS,EAAE,UAAU,CAAC;IACtB;;;;;mCAK+B;IAC/B,iBAAiB,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACzD;;;;;kDAK8C;IAC9C,WAAW,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IAC1D;wDACoD;IACpD,qBAAqB,EAAE,UAAU,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,wEAAwE;IACxE,OAAO,EAAE,UAAU,CAAC;IACpB,wDAAwD;IACxD,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AASF;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,oBAAoB,CAAC,CAsL/B"}

package/dist/freshen-receipt.js

@@ -47,7 +47,7 @@
  */
 import { calculateRoot, inclusionProofPath, mmrSizeForLeafCount, peakIndexForLeafProof, peakMMRIndexes, peaksBitmap, } from "@forestrie/merklelog";
 import { assembleReceiptFromProof, parseCheckpoint, } from "./build-receipt-offline.js";
-import { computeCheckpointAccumulator, } from "./checkpoint-chain.js";
+import { CheckpointSignedSizeMismatchError, computeCheckpointAccumulator, } from "./checkpoint-chain.js";
 import { parseReceipt } from "./parse-receipt.js";
 import { SubtleHasher } from "./subtle-hasher.js";
 function bytesEqual(a, b) {
@@ -59,9 +59,11 @@ function bytesEqual(a, b) {
     return x === 0;
 }
 /**
- * Freshen a stale receipt to the latest sealed state. Throws if the chain is
- * not a contiguous cover from the trusted base to the checkpoint's sealed size,
- * if a climb node is missing from the supplied proofs, or if the recomputed
+ * Freshen a stale receipt to the latest sealed state. Throws if a link's
+ * signed `tree-size-2` disagrees with its declared one
+ * ({@link CheckpointSignedSizeMismatchError}), if the chain is not a
+ * contiguous cover from the trusted base to the checkpoint's sealed size, if
+ * a climb node is missing from the supplied proofs, or if the recomputed
  * peak does not match the folded latest accumulator.
  */
 export async function freshenReceipt(input) {
@@ -106,6 +108,18 @@ export async function freshenReceipt(input) {
     if (baseAccumulator.length !== basePeaks) {
         throw new Error(`base accumulator has ${baseAccumulator.length} peaks; trusted base size ${baseSize} has ${basePeaks}`);
     }
+    // Every link's SIGNED tree-size-2 must equal its declared one — the same
+    // equality `checkpointConsistencyProof` enforces when it decodes a
+    // checkpoint (ADR-0066 D1 as amended, D5.5). These links arrive already
+    // decoded, so nothing here had re-read the field the type says was pinned
+    // to the signature, and a link carrying `signedTreeSize2: 999n` beside
+    // `treeSize2: 7n` freshened (review finding I5).
+    for (let i = 0; i < links.length; i++) {
+        const link = links[i];
+        if (link.signedTreeSize2 !== link.treeSize2) {
+            throw new CheckpointSignedSizeMismatchError(`consistency proof ${i}: signed tree-size-2 (-65933) ${link.signedTreeSize2} != declared consistency-proof tree-size-2 ${link.treeSize2}`);
+        }
+    }
     // The first link must continue from that size, not from a size it names
     // itself (ADR-0066 D5.4).
     if (firstLink.treeSize1 !== baseSize) {

package/dist/index.d.ts

@@ -76,7 +76,7 @@ export { findGrantLeafInMassif } from "./find-grant-leaf.js";
 export type { LocatedLeaf } from "./find-grant-leaf.js";
 /** Re-exported so callers of findGrantLeafInMassif can catch it (FOR-344). */
 export { MissingIndexError } from "@forestrie/merklelog";
-export { accumulatorPayload, checkpointConsistencyProof, computeCheckpointAccumulator, verifyCheckpointChain, CheckpointHighSSignatureError, CheckpointSignedSizeMismatchError, type CheckpointChainLink, type CheckpointChainResult, type CheckpointConsistencyProof, } from "./checkpoint-chain.js";
+export { accumulatorPayload, checkpointConsistencyProof, computeCheckpointAccumulator, verifyCheckpointChain, CheckpointHighSSignatureError, CheckpointProtectedHeaderAlgError, CheckpointSignedSizeMismatchError, type CheckpointChainLink, type CheckpointChainResult, type CheckpointConsistencyProof, } from "./checkpoint-chain.js";
 /**
  * Univocity leaf commitment hash. Was CLI-private (forestrie-cli's own
  * mirror, "hoist to the library when the FOR-297 multi-hop resolver lands");

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,oFAAoF;AACpF,YAAY,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,YAAY,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AACxF,YAAY,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EACV,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC,+EAA+E;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EACV,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD;;;;;;GAMG;AACH,OAAO,EACL,iCAAiC,EACjC,0BAA0B,GAC3B,MAAM,qCAAqC,CAAC;AAC7C,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE;;;;GAIG;AACH,OAAO,EACL,kCAAkC,EAClC,6BAA6B,EAC7B,gCAAgC,EAChC,oCAAoC,EACpC,2BAA2B,EAC3B,mCAAmC,GACpC,MAAM,4BAA4B,CAAC;AACpC;;;GAGG;AACH,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE;;;;GAIG;AACH,OAAO,EACL,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,sCAAsC,EACtC,iCAAiC,GAClC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,mCAAmC,CAAC;AAC3C,yEAAyE;AACzE,OAAO,EAAE,qCAAqC,EAAE,MAAM,6BAA6B,CAAC;AACpF;;;;;;GAMG;AACH,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAC7B,sBAAsB,EACtB,6BAA6B,EAC7B,qBAAqB,EACrB,sBAAsB,EACtB,oCAAoC,EACpC,uCAAuC,EACvC,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,iBAAiB,EACjB,sBAAsB,EACtB,kCAAkC,EAClC,wBAAwB,EACxB,iCAAiC,EACjC,kCAAkC,GACnC,MAAM,8BAA8B,CAAC;AACtC;;;GAGG;AACH,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE3E,0EAA0E;AAC1E,OAAO,EACL,cAAc,EACd,iDAAiD,GAClD,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC7E,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,6EAA6E;AAC7E,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,oEAAoE;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,8EAA8E;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,iCAAiC,EACjC,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,GAChC,MAAM,uBAAuB,CAAC;AAC/B;;;;;GAKG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD;;;;;;GAMG;AACH,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,2CAA2C,EAC3C,KAAK,gBAAgB,GACtB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,oFAAoF;AACpF,YAAY,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,YAAY,EAAE,8BAA8B,EAAE,MAAM,mCAAmC,CAAC;AACxF,YAAY,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EACV,wBAAwB,EACxB,uBAAuB,EACvB,eAAe,EACf,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,GAChB,MAAM,4BAA4B,CAAC;AACpC,+EAA+E;AAC/E,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EACV,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,sBAAsB,CAAC;AAC9B;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD;;;;;;GAMG;AACH,OAAO,EACL,iCAAiC,EACjC,0BAA0B,GAC3B,MAAM,qCAAqC,CAAC;AAC7C,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAChE;;;;GAIG;AACH,OAAO,EACL,kCAAkC,EAClC,6BAA6B,EAC7B,gCAAgC,EAChC,oCAAoC,EACpC,2BAA2B,EAC3B,mCAAmC,GACpC,MAAM,4BAA4B,CAAC;AACpC;;;GAGG;AACH,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,YAAY,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,yBAAyB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE;;;;GAIG;AACH,OAAO,EACL,iCAAiC,EACjC,4BAA4B,GAC7B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,sCAAsC,EACtC,iCAAiC,GAClC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,0BAA0B,EAC1B,mBAAmB,EACnB,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,mCAAmC,CAAC;AAC3C,YAAY,EACV,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,mCAAmC,CAAC;AAC3C,yEAAyE;AACzE,OAAO,EAAE,qCAAqC,EAAE,MAAM,6BAA6B,CAAC;AACpF;;;;;;GAMG;AACH,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAC7B,sBAAsB,EACtB,6BAA6B,EAC7B,qBAAqB,EACrB,sBAAsB,EACtB,oCAAoC,EACpC,uCAAuC,EACvC,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,iBAAiB,EACjB,sBAAsB,EACtB,kCAAkC,EAClC,wBAAwB,EACxB,iCAAiC,EACjC,kCAAkC,GACnC,MAAM,8BAA8B,CAAC;AACtC;;;GAGG;AACH,OAAO,EACL,0BAA0B,EAC1B,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,0BAA0B,EAC1B,uBAAuB,EACvB,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,GACxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE3E,0EAA0E;AAC1E,OAAO,EACL,cAAc,EACd,iDAAiD,GAClD,MAAM,2CAA2C,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,eAAe,CAAC;AAC7E,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEpD,6EAA6E;AAC7E,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,oEAAoE;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,YAAY,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,8EAA8E;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,4BAA4B,EAC5B,qBAAqB,EACrB,6BAA6B,EAC7B,iCAAiC,EACjC,iCAAiC,EACjC,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,GAChC,MAAM,uBAAuB,CAAC;AAC/B;;;;;GAKG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD;;;;;;GAMG;AACH,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,2CAA2C,EAC3C,KAAK,gBAAgB,GACtB,MAAM,wBAAwB,CAAC"}

package/dist/index.js

@@ -61,7 +61,7 @@ export { grantCommitmentHashFromGrant } from "./grant-commitment.js";
 export { findGrantLeafInMassif } from "./find-grant-leaf.js";
 /** Re-exported so callers of findGrantLeafInMassif can catch it (FOR-344). */
 export { MissingIndexError } from "@forestrie/merklelog";
-export { accumulatorPayload, checkpointConsistencyProof, computeCheckpointAccumulator, verifyCheckpointChain, CheckpointHighSSignatureError, CheckpointSignedSizeMismatchError, } from "./checkpoint-chain.js";
+export { accumulatorPayload, checkpointConsistencyProof, computeCheckpointAccumulator, verifyCheckpointChain, CheckpointHighSSignatureError, CheckpointProtectedHeaderAlgError, CheckpointSignedSizeMismatchError, } from "./checkpoint-chain.js";
 /**
  * Univocity leaf commitment hash. Was CLI-private (forestrie-cli's own
  * mirror, "hoist to the library when the FOR-297 multi-hop resolver lands");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forestrie/receipt-verify",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "license": "MIT",
   "type": "module",
   "description": "Offline SCITT grant receipt verification (ADR-0045)",
@@ -29,8 +29,8 @@
   "dependencies": {
     "@noble/hashes": "^1.7.1",
     "@forestrie/chain-rpc": "0.3.0",
-    "@forestrie/merklelog": "0.4.0",
-    "@forestrie/encoding": "0.8.0"
+    "@forestrie/encoding": "0.9.0",
+    "@forestrie/merklelog": "0.5.0"
   },
   "devDependencies": {
     "esbuild": "^0.24.0",

package/src/checkpoint-chain.ts

@@ -40,8 +40,9 @@
  */
 import {
   COSE_ALG_ES256,
-  extractAlgFromProtected,
+  ProtectedHeaderAlgError,
   isLowS,
+  readProtectedAlg,
   readProtectedTreeSize2,
 } from "@forestrie/encoding";
 import {
@@ -104,6 +105,25 @@ export class CheckpointHighSSignatureError extends Error {
   }
 }
 
+/**
+ * The checkpoint's protected header carries no integer `alg` (label 1).
+ *
+ * The univocity contract rejects such a header outright — the structural
+ * walk finds the size, and the `alg` requirement in the same call raises
+ * `ClaimNotFound(1)` or `UnexpectedMajorType`. Off-chain the header used to
+ * read as "no algorithm stated", which both turned OFF the high-s rejection
+ * below (gated on the algorithm being ES256) and still yielded a signed size
+ * to fold from — so a checkpoint the chain will never anchor verified here
+ * under weaker rules than a well-formed one (review finding S-1). Reported
+ * as `"proof_malformed"` by {@link verifyCheckpointChain}.
+ */
+export class CheckpointProtectedHeaderAlgError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "CheckpointProtectedHeaderAlgError";
+  }
+}
+
 /**
  * Decode the embedded consistency proof (`vdp` 396 key -2) and require its
  * declared `tree-size-2` to equal the checkpoint's SIGNED `tree-size-2` from
@@ -126,12 +146,27 @@ export class CheckpointHighSSignatureError extends Error {
  *   differs from the declared proof's tree-size-2
  * @throws {CheckpointHighSSignatureError} when the checkpoint is ES256-signed
  *   with a high-s (malleable) signature
+ * @throws {CheckpointProtectedHeaderAlgError} when the protected header
+ *   carries no integer `alg` (label 1)
  */
 export function checkpointConsistencyProof(
   checkpointBytes: Uint8Array,
 ): CheckpointConsistencyProof {
   const { coseSign1, unprotected } = parseCheckpoint(checkpointBytes);
-  const alg = extractAlgFromProtected(coseSign1[0]);
+  // Strict: a header with no integer alg is one the contract rejects, and
+  // reading it leniently would switch the high-s rejection below off while
+  // the signed size was still taken from it (S-1).
+  let alg: number;
+  try {
+    alg = readProtectedAlg(coseSign1[0]);
+  } catch (err) {
+    if (err instanceof ProtectedHeaderAlgError) {
+      throw new CheckpointProtectedHeaderAlgError(
+        `checkpoint protected header carries no integer alg (label 1): ${err.message}`,
+      );
+    }
+    throw err;
+  }
   const signature = coseSign1[3];
   if (alg === COSE_ALG_ES256 && signature.length === 64 && !isLowS(signature)) {
     throw new CheckpointHighSSignatureError(
@@ -273,11 +308,14 @@ export type CheckpointChainResult =
  *   as the fold's starting accumulator (a suffix chain rooted in an
  *   already-trusted accumulator supplies both).
  * - A supplied `trustedBase` must describe a state an MMR can be in: its
- *   `size` a complete MMR size, and its `accumulator` holding one peak per
- *   peak of that size. `peaksBitmap` rounds an incomplete size DOWN to the
- *   largest MMR below it, so without the completeness check a size of 5
- *   folds the 4 -> N shape while every link reports a base of 5 — a node
- *   count no MMR has. Both are `proof_malformed`.
+ *   `size` a complete MMR size, its `accumulator` holding one peak per peak
+ *   of that size, and every one of those peaks a 32-byte node value.
+ *   `peaksBitmap` rounds an incomplete size DOWN to the largest MMR below
+ *   it, so without the completeness check a size of 5 folds the 4 -> N shape
+ *   while every link reports a base of 5 — a node count no MMR has; and
+ *   without the byte-length check an origin peak of any length is copied
+ *   through the empty-path branch into the detached payload. All three are
+ *   `proof_malformed`.
  * - The first link's declared `tree-size-1` must equal that trusted
  *   starting size, and every subsequent link's must equal the previous
  *   link's sealed `tree-size-2`; either disagreement is `size_mismatch`.
@@ -349,6 +387,25 @@ export async function verifyCheckpointChain(opts: {
         links,
       };
     }
+    // …and every peak must be a 32-byte node value, the check arbor's
+    // producer applies to both path elements and right-peaks (`toNode32`).
+    // The count alone does not reach it: on the empty-path branch an origin
+    // peak is copied into the result verbatim, so a 0/31/33/64-byte peak
+    // reaches `accumulatorPayload` and shortens or lengthens the detached
+    // payload, with only the signature left to reject it (review finding
+    // I2, canopy C6).
+    for (let i = 0; i < trustedBase.accumulator.length; i++) {
+      const peak = trustedBase.accumulator[i] as unknown;
+      if (!(peak instanceof Uint8Array) || peak.length !== 32) {
+        return {
+          ok: false,
+          reason: "proof_malformed",
+          at: 0,
+          detail: `trusted base accumulator peak ${i} is not a 32-byte node value (${describePeak(peak)})`,
+          links,
+        };
+      }
+    }
   }
   let accumulator = trustedBase?.accumulator ?? [];
   let expectedBase = trustedBase?.size ?? 0n;
@@ -439,3 +496,11 @@ export async function verifyCheckpointChain(opts: {
   }
   return { ok: true, links, accumulator };
 }
+
+/** Name what was found where a 32-byte accumulator peak was required. */
+function describePeak(peak: unknown): string {
+  if (peak instanceof Uint8Array) return `${peak.length} bytes`;
+  if (peak === null) return "null";
+  if (Array.isArray(peak)) return "an array";
+  return typeof peak;
+}

package/src/freshen-receipt.ts

@@ -58,6 +58,7 @@ import {
   parseCheckpoint,
 } from "./build-receipt-offline.js";
 import {
+  CheckpointSignedSizeMismatchError,
   computeCheckpointAccumulator,
   type CheckpointConsistencyProof,
 } from "./checkpoint-chain.js";
@@ -81,7 +82,9 @@ export type FreshenReceiptInput = {
   leafValue: Uint8Array;
   /** Consistency-proof chain covering [0 or the trusted base] → the latest
    * sealed size, in ascending contiguous order (the raw per-checkpoint
-   * proofs, with `paths`). The chain's last link must end at the
+   * proofs, with `paths`). Every link's `signedTreeSize2` must equal its
+   * `treeSize2`, as `checkpointConsistencyProof` requires of the checkpoint
+   * it decoded each link from. The chain's last link must end at the
    * checkpoint's sealed size. */
   consistencyProofs: readonly CheckpointConsistencyProof[];
   /** Trusted base for a suffix chain — the size the caller already trusts
@@ -111,9 +114,11 @@ function bytesEqual(a: Uint8Array, b: Uint8Array): boolean {
 }
 
 /**
- * Freshen a stale receipt to the latest sealed state. Throws if the chain is
- * not a contiguous cover from the trusted base to the checkpoint's sealed size,
- * if a climb node is missing from the supplied proofs, or if the recomputed
+ * Freshen a stale receipt to the latest sealed state. Throws if a link's
+ * signed `tree-size-2` disagrees with its declared one
+ * ({@link CheckpointSignedSizeMismatchError}), if the chain is not a
+ * contiguous cover from the trusted base to the checkpoint's sealed size, if
+ * a climb node is missing from the supplied proofs, or if the recomputed
  * peak does not match the folded latest accumulator.
  */
 export async function freshenReceipt(
@@ -170,6 +175,20 @@ export async function freshenReceipt(
       `base accumulator has ${baseAccumulator.length} peaks; trusted base size ${baseSize} has ${basePeaks}`,
     );
   }
+  // Every link's SIGNED tree-size-2 must equal its declared one — the same
+  // equality `checkpointConsistencyProof` enforces when it decodes a
+  // checkpoint (ADR-0066 D1 as amended, D5.5). These links arrive already
+  // decoded, so nothing here had re-read the field the type says was pinned
+  // to the signature, and a link carrying `signedTreeSize2: 999n` beside
+  // `treeSize2: 7n` freshened (review finding I5).
+  for (let i = 0; i < links.length; i++) {
+    const link = links[i]!;
+    if (link.signedTreeSize2 !== link.treeSize2) {
+      throw new CheckpointSignedSizeMismatchError(
+        `consistency proof ${i}: signed tree-size-2 (-65933) ${link.signedTreeSize2} != declared consistency-proof tree-size-2 ${link.treeSize2}`,
+      );
+    }
+  }
   // The first link must continue from that size, not from a size it names
   // itself (ADR-0066 D5.4).
   if (firstLink.treeSize1 !== baseSize) {

package/src/index.ts

@@ -156,6 +156,7 @@ export {
   computeCheckpointAccumulator,
   verifyCheckpointChain,
   CheckpointHighSSignatureError,
+  CheckpointProtectedHeaderAlgError,
   CheckpointSignedSizeMismatchError,
   type CheckpointChainLink,
   type CheckpointChainResult,