@forestrie/receipt-verify 3.0.0 → 3.0.1

package/dist/build-receipt-offline.d.ts

@@ -31,10 +31,14 @@ export type ParsedCheckpoint = {
     /**
      * Sealed tree size: the SIGNED `tree-size-2` from the checkpoint's
      * PROTECTED header (ADR-0066 D1 as amended, label -65933), not the
-     * unprotected consistency proof's declared value. `null` when the
-     * checkpoint carries no embedded consistency proof or no signed
-     * tree-size-2 — such a checkpoint is not verifiable and callers must
-     * treat it exactly as they would a checkpoint with no proof at all.
+     * unprotected consistency proof's declared value. `null` ONLY when the
+     * checkpoint is genuinely unsealed — no embedded consistency proof, or a
+     * well-formed protected header with no signed tree-size-2 label — and
+     * callers must treat that the same as a checkpoint with no proof at all.
+     * A structurally malformed consistency proof, or a protected header that
+     * is not deterministically encoded (ADR-0066 D9), is a DIFFERENT
+     * condition — {@link parseCheckpoint} throws for those rather than
+     * folding them into this `null` (review finding O3).
      */
     mmrSize: bigint | null;
     delegationCert: Uint8Array | null;

package/dist/build-receipt-offline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"build-receipt-offline.d.ts","sourceRoot":"","sources":["../src/build-receipt-offline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AASH,OAAO,EAIL,mBAAmB,EAEnB,KAAK,eAAe,EAErB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,oBAAoB,CAAC;AAO5B;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAC/B,YAAY,EAAE,eAAe,EAAE,CAAC;AAEhC,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,SAAS,CAAC;IACrB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,oEAAoE;IACpE,YAAY,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC/B;;;;;;;OAOG;IACH,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,cAAc,EAAE,UAAU,GAAG,IAAI,CAAC;CACnC,CAAC;AAEF,wDAAwD;AACxD,wBAAgB,eAAe,CAAC,eAAe,EAAE,UAAU,GAAG,gBAAgB,CAqB7E;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,WAAW,EAAE,UAAU,CAAC;IACxB,eAAe,EAAE,UAAU,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,wBAAwB,GAC9B,UAAU,CAyCZ;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,gBAAgB,EAC5B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,UAAU,EAAE,GAClB,UAAU,CA4CZ;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,mEAAmE;IACnE,IAAI,EAAE,UAAU,CAAC;IACjB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,SAAS,EAAE,UAAU,CAAC;CACvB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,WAAW,EAAE,UAAU,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAwBnC"}
+{"version":3,"file":"build-receipt-offline.d.ts","sourceRoot":"","sources":["../src/build-receipt-offline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AASH,OAAO,EAIL,mBAAmB,EAEnB,KAAK,eAAe,EAErB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,oBAAoB,CAAC;AAO5B;;;;GAIG;AACH,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAC/B,YAAY,EAAE,eAAe,EAAE,CAAC;AAEhC,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,SAAS,CAAC;IACrB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,oEAAoE;IACpE,YAAY,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IAC/B;;;;;;;;;;;OAWG;IACH,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,cAAc,EAAE,UAAU,GAAG,IAAI,CAAC;CACnC,CAAC;AAEF,wDAAwD;AACxD,wBAAgB,eAAe,CAAC,eAAe,EAAE,UAAU,GAAG,gBAAgB,CAqB7E;AAED,MAAM,MAAM,wBAAwB,GAAG;IACrC,WAAW,EAAE,UAAU,CAAC;IACxB,eAAe,EAAE,UAAU,CAAC;IAC5B,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,wBAAwB,GAC9B,UAAU,CAyCZ;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,gBAAgB,EAC5B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,UAAU,EAAE,GAClB,UAAU,CA4CZ;AAED,MAAM,MAAM,uBAAuB,GAAG;IACpC,mEAAmE;IACnE,IAAI,EAAE,UAAU,CAAC;IACjB,+DAA+D;IAC/D,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB,SAAS,EAAE,UAAU,CAAC;CACvB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAAC,IAAI,EAAE;IACjD,WAAW,EAAE,UAAU,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAwBnC"}

package/dist/build-receipt-offline.js

@@ -166,26 +166,21 @@ function cborBytes(value) {
  * validating decode that requires the signed size and the last relayed
  * proof's to agree.
  *
- * Lenient by design: an absent proof, an empty or malformed
- * consistency-proofs array, or an absent or malformed signed tree-size-2
- * all yield `null` rather than a throw, so a caller of
- * {@link parseCheckpoint} sees exactly the same "not verifiable" outcome
- * either way.
+ * Lenient only for an ABSENT proof or an absent signed tree-size-2: both
+ * yield `null`, so a caller of {@link parseCheckpoint} sees the same "not
+ * verifiable" outcome for either. A proof or protected header that IS
+ * present but malformed is a different condition and is not swallowed here
+ * — {@link decodeConsistencyProofsFromUnprotected} throws for a structurally
+ * malformed proof (including an empty consistency-proofs array), and
+ * {@link readProtectedTreeSize2} throws for a protected header that is not
+ * deterministically encoded (ADR-0066 D9); both propagate rather than
+ * folding into `null` (review finding O3: a D9 conformance failure is a
+ * sealer-side defect worth attributing, not the ordinary "no proof yet"
+ * case).
  */
 function sealedSizeFromCheckpoint(coseSign1, unprotected) {
-    let declared;
-    try {
-        declared = decodeConsistencyProofsFromUnprotected(unprotected);
-    }
-    catch {
-        return null;
-    }
+    const declared = decodeConsistencyProofsFromUnprotected(unprotected);
     if (declared === null)
         return null;
-    try {
-        return readProtectedTreeSize2(coseSign1[0]);
-    }
-    catch {
-        return null;
-    }
+    return readProtectedTreeSize2(coseSign1[0]);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forestrie/receipt-verify",
-  "version": "3.0.0",
+  "version": "3.0.1",
   "license": "MIT",
   "type": "module",
   "description": "Offline SCITT grant receipt verification (ADR-0045)",
@@ -28,9 +28,9 @@
   ],
   "dependencies": {
     "@noble/hashes": "^1.7.1",
+    "@forestrie/chain-rpc": "0.3.0",
     "@forestrie/encoding": "0.9.1",
-    "@forestrie/merklelog": "0.5.0",
-    "@forestrie/chain-rpc": "0.3.0"
+    "@forestrie/merklelog": "0.5.0"
   },
   "devDependencies": {
     "esbuild": "^0.24.0",

package/src/build-receipt-offline.ts

@@ -59,10 +59,14 @@ export type ParsedCheckpoint = {
   /**
    * Sealed tree size: the SIGNED `tree-size-2` from the checkpoint's
    * PROTECTED header (ADR-0066 D1 as amended, label -65933), not the
-   * unprotected consistency proof's declared value. `null` when the
-   * checkpoint carries no embedded consistency proof or no signed
-   * tree-size-2 — such a checkpoint is not verifiable and callers must
-   * treat it exactly as they would a checkpoint with no proof at all.
+   * unprotected consistency proof's declared value. `null` ONLY when the
+   * checkpoint is genuinely unsealed — no embedded consistency proof, or a
+   * well-formed protected header with no signed tree-size-2 label — and
+   * callers must treat that the same as a checkpoint with no proof at all.
+   * A structurally malformed consistency proof, or a protected header that
+   * is not deterministically encoded (ADR-0066 D9), is a DIFFERENT
+   * condition — {@link parseCheckpoint} throws for those rather than
+   * folding them into this `null` (review finding O3).
    */
   mmrSize: bigint | null;
   delegationCert: Uint8Array | null;
@@ -273,26 +277,23 @@ function cborBytes(value: unknown): Uint8Array {
  * validating decode that requires the signed size and the last relayed
  * proof's to agree.
  *
- * Lenient by design: an absent proof, an empty or malformed
- * consistency-proofs array, or an absent or malformed signed tree-size-2
- * all yield `null` rather than a throw, so a caller of
- * {@link parseCheckpoint} sees exactly the same "not verifiable" outcome
- * either way.
+ * Lenient only for an ABSENT proof or an absent signed tree-size-2: both
+ * yield `null`, so a caller of {@link parseCheckpoint} sees the same "not
+ * verifiable" outcome for either. A proof or protected header that IS
+ * present but malformed is a different condition and is not swallowed here
+ * — {@link decodeConsistencyProofsFromUnprotected} throws for a structurally
+ * malformed proof (including an empty consistency-proofs array), and
+ * {@link readProtectedTreeSize2} throws for a protected header that is not
+ * deterministically encoded (ADR-0066 D9); both propagate rather than
+ * folding into `null` (review finding O3: a D9 conformance failure is a
+ * sealer-side defect worth attributing, not the ordinary "no proof yet"
+ * case).
  */
 function sealedSizeFromCheckpoint(
   coseSign1: CoseSign1,
   unprotected: Map<number, unknown>,
 ): bigint | null {
-  let declared;
-  try {
-    declared = decodeConsistencyProofsFromUnprotected(unprotected);
-  } catch {
-    return null;
-  }
+  const declared = decodeConsistencyProofsFromUnprotected(unprotected);
   if (declared === null) return null;
-  try {
-    return readProtectedTreeSize2(coseSign1[0]);
-  } catch {
-    return null;
-  }
+  return readProtectedTreeSize2(coseSign1[0]);
 }