fix(verify): reject unsupported receiptVersion values (closes #53)

src/verify.ts

@@ -2,6 +2,8 @@ import { verify as verifySignature } from 'node:crypto';
 import { canonicalizeReceiptBytes, CANONICALIZATION_VERSION } from './canonicalize.js';
 import { resolvePublicKey } from './keyResolver.js';
 
+export const RECEIPT_VERSION = 'v1';
+
 const REQUIRED_SIGNED_FIELDS = [
   'id',
   'companyId',
@@ -95,6 +97,16 @@ export async function verifyReceipt(receipt: unknown, options: VerifyOptions): P
     };
   }
 
+  if (receipt.receiptVersion !== RECEIPT_VERSION) {
+    return {
+      verified: false,
+      exitCode: 3,
+      errorCode: 'MALFORMED_RECEIPT',
+      errorMessage: `unsupported receiptVersion: expected "${RECEIPT_VERSION}"`,
+      receiptId: receipt.id as string,
+    };
+  }
+
   if (receipt.signatureAlg !== 'ed25519') {
     return {
       verified: false,

tests/verify.test.ts

@@ -59,4 +59,18 @@ describe('verifyReceipt', () => {
       expect(result.errorCode).toBe('SIGNATURE_INVALID');
     }
   });
+
+  it('returns malformed for unsupported receiptVersion', async () => {
+    const receipt = await loadJson('valid.json') as Record<string, unknown>;
+    // Forge a future receiptVersion value, which would otherwise pass
+    // required-field, signature, expiry, and status checks.
+    receipt.receiptVersion = 'v2';
+    const result = await verifyReceipt(receipt, { keyFile, noNetwork: true });
+    expect(result.verified).toBe(false);
+    if (!result.verified) {
+      expect(result.exitCode).toBe(3);
+      expect(result.errorCode).toBe('MALFORMED_RECEIPT');
+      expect(result.errorMessage.toLowerCase()).toContain('receiptversion');
+    }
+  });
 });