@charter-agreement-protocol/signer 0.1.1 → 0.2.1

package/CHANGELOG.md

@@ -0,0 +1,44 @@
+# Changelog
+
+All notable public changes to `@charter-agreement-protocol/signer` are
+documented here.
+
+## [0.2.1] — 2026-09-24
+
+Dependency-line release: this package now tracks the published verify
+line - `@charter-agreement-protocol/verifier` `^0.5.0` (resolved 0.5.0).
+No API change: verifier 0.5.0 added consumer-side surface only (the
+capability probe, the signature registry identity, the descriptor
+timestamp floor, the 104-case corpus); the producer surface this package
+delegates to is unchanged. Typecheck strict, 18/18 tests against the
+resolved 0.5.0. The producer-side capability alignment (mirrored
+`capabilities()` with refuse-before-mint, declared minting metadata,
+profile-bound signing) is the next feature release on this line.
+
+## [0.2.0] — 2026-09-17
+
+### Changed
+
+- **The R1–R3 honest-signer refusals now run pre-sign** (previously
+  deferred to post-sign verification with mislabeled errors; the `refused`
+  error was unreachable): `signAcceptance` / `signTermination` run the
+  verifier package's refusal checks after framing, before the key signs.
+  Breaking within 0.x: `signTermination`'s view requires `chain`,
+  `signAcceptance` enforces the guards over the `chain` it previously
+  ignored, and `signReceipt` requires its issuing view (the reference
+  takes a context, never none).
+- Post-sign verification failures return the bare `verification_failed`
+  (the reference vocabulary); malformed claims are rejected pre-sign as
+  `invalid_input` through the producer claims gate — no claim-shape defect
+  burns a key operation.
+- **All protocol logic is delegated to the verifier package's producer
+  surface (`^0.4.0`)**: framing, the claims gate, the refusal guards, and
+  assembly; this package keeps custody only (atomic snapshot, sign
+  callback, wrong-key guard, post-sign verification, closed errors).
+
+## [0.1.x] — 2026-09-14
+
+- Initial public releases: one signing function per artifact kind, the
+  key-handle contract with the atomic `keyIdentity` snapshot, the
+  wrong-key guard, and post-sign verification through
+  `@charter-agreement-protocol/verifier`.

package/NOTICE

@@ -1,9 +1,9 @@
-Charter Agreement Signer
+Charter Agreement Signer (TypeScript)
 Copyright 2026 BaseLabs
 
 This product includes software developed by BaseLabs
 (https://github.com/baselabs).
 
-This product depends on the charter_agreement_protocol package
-(https://github.com/baselabs/charter_agreement_protocol), also licensed under
-the Apache License, Version 2.0.
+This product depends on the @charter-agreement-protocol/verifier package
+(https://github.com/baselabs/charter_agreement_protocol_typescript), also
+licensed under the Apache License, Version 2.0.

package/README.md

@@ -8,12 +8,14 @@ Holder-side companion signer for the
 **CAP verifies; it never authorizes. This signer signs; it never takes
 custody.** You keep the key (HSM, OS keychain, key server) behind a handle
 object with two callbacks; the signer resolves ONE atomic `keyIdentity`
-snapshot, builds the exact RFC 7515 signing input, runs the honest-signer
-refusal guards before any key is touched, checks the returned signature
-against the snapshot's public key (the wrong-key guard), assembles the
-compact, and post-sign-verifies the assembled artifact through the
-`@charter-agreement-protocol/verifier` package — exactly one verification
-implementation.
+snapshot, then delegates EVERYTHING pure to the verifier package's producer
+surface — the exact RFC 7515 signing input, the producer claims gate, the
+R1–R3 honest-signer refusal guards (claims-truth, no-equivocation,
+ancestry/governing coverage), and assembly — **before the key signs**, with
+exactly one implementation. What stays here is custody: the sign callback,
+the wrong-key guard against the snapshot's public key, and the post-sign
+verification of the assembled artifact through the
+`@charter-agreement-protocol/verifier` package.
 
 ## Install
 
@@ -27,11 +29,15 @@ Requires Node >= 24.8 (ML-DSA support in the Node builtins).
 
 ```js
 import { signDescriptor } from "@charter-agreement-protocol/signer";
+import { generateKeyPairSync } from "node:crypto";
+
+const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+const publicKeyBase64url = publicKey.export({ type: "spki", format: "der" }).subarray(-32).toString("base64url");
 
 const handle = {
   // ONE atomic snapshot — the kid and public key cannot disagree.
   keyIdentity() {
-    return { kid: "my-key-001", publicKey }; // base64url raw public key
+    return { kid: "my-key-001", publicKey: publicKeyBase64url }; // base64url raw public key
   },
   // The holder's job: sign the exact message bytes with the held key.
   sign(message) {
@@ -44,7 +50,7 @@ const result = await signDescriptor(
     protocol_revision: 2,
     descriptor_number: 1,
     verification_keys: [
-      { key_id: "my-key-001", algorithm: "Ed25519", public_key: publicKey, status: "active" },
+      { key_id: "my-key-001", algorithm: "Ed25519", public_key: publicKeyBase64url, status: "active" },
     ],
     attestation_hints: [],
     extensions: { critical: {}, optional: {} },
@@ -65,27 +71,79 @@ empty context — your handle signs the exact message bytes as with Ed25519).
 | Export | What it does |
 |---|---|
 | `signDescriptor(claims, handle, opts?)` | Signs one Party Descriptor; post-verified via `verifyDescriptor` |
-| `signReceipt(claims, handle, chain \| null, opts?)` | Signs one Receipt; post-verified via `verifyReceipt` when a chain view is supplied |
-| `signAcceptance(claims, handle, view, opts?)` | Signs one Acceptance against the caller's verified view |
-| `signTermination(claims, handle, view, opts?)` | Signs one Termination against the caller's verified view |
+| `signReceipt(claims, handle, chain, opts?)` | Signs one Receipt against the required issuing view; post-verified via `verifyReceipt` (the reference takes a context, never none) |
+| `signAcceptance(claims, handle, view, opts?)` | Signs one Acceptance against the caller's verified view — the R1–R3 refusal guards run over `view.chain` before the key signs |
+| `signTermination(claims, handle, view, opts?)` | Signs one Termination against the caller's verified view — the R1–R3 refusal guards run over `view.chain` before the key signs |
+
+The acceptance/termination `view` is `{ revisionText, descriptorCompacts,
+chain }`: the revision the claims name, the signing party's descriptor
+chain, and the caller's full `ChainView` (`{ revisions, acceptances,
+descriptors, terminations }`) the refusal guards verify and bind against.
 
 Errors are closed: `{ ok: false, error: "invalid_handle" \| "signing_failed"
-\| "invalid_input" \| "refused", code? }`. A signing failure is never a
-silent pass.
+\| "invalid_input" \| "refused" \| "verification_failed" }` — `code` rides
+only on `invalid_input` and `refused`; `verification_failed` is bare
+(reference parity).
+`"refused"` is the honest-signer refusal: the claims contradict the caller's
+own verified view, and the handle's `sign` callback is never reached (the
+atomic `keyIdentity` snapshot resolves first — the reference ordering).
+`"verification_failed"` is the separate post-sign discipline: the assembled
+artifact did not verify against the caller's view (for example a key that is
+not in the party descriptor's `verification_keys`). Malformed claims are
+rejected pre-sign as `"invalid_input"` through the verifier package's
+producer claims gate — they never burn a key operation. A signing failure is
+never a silent pass.
+
+## The sibling verifier
+
+This package is one of two independent TypeScript siblings implementing the
+Charter Agreement Protocol — no Elixir code or dependency at runtime; the
+Elixir reference is the certification oracle (the verifier's vendored
+corpus is certified against it, and its CI cross-verifies
+TypeScript-signed artifacts from raw bytes).
+
+- **This package** — `@charter-agreement-protocol/signer`: key custody,
+  the wrong-key guard, post-sign verification, and the closed error
+  vocabulary — all protocol logic delegated to the verifier.
+- [`@charter-agreement-protocol/verifier`](https://www.npmjs.com/package/@charter-agreement-protocol/verifier)
+  — verification and the pure producer surface (signing inputs, claims
+  gate, refusal guards, assembly) that this package signs through.
+
+The pair releases together: this package depends on the verifier (`^0.4.0`),
+so a verifier release stages first and the signer locks and releases
+against the published version immediately after.
 
 ## Evidence
 
 - The Elixir reference repository's gate verifies TypeScript-signed
   artifacts from raw bytes (cross-implementation agreement, enforced in CI).
+- Framing, the producer claims gate, refusal guards, and assembly are the
+  verifier package's producer surface (0.4.0) — the same single
+  implementation the independent verifier certifies. What remains here is
+  custody plus input policing: the issuing-view discipline composes the
+  verifier's own `verifyChain`, never a local reimplementation.
 - Post-sign verification goes through the
   [@charter-agreement-protocol/verifier](https://www.npmjs.com/package/@charter-agreement-protocol/verifier)
   package — the certified dual-implementation-verified verifier.
 
+## The verify side
+
+This package tracks the published verify line: it depends on
+`@charter-agreement-protocol/verifier` `^0.5.0`. Verifier 0.5.0 added
+consumer-side surface only; the producer surface this package uses is
+unchanged. The producer-side capability alignment (mirrored
+`capabilities()` with refuse-before-mint, declared minting metadata,
+profile-bound signing) is the next feature release on this line.
+
 ## SemVer
 
-Package SemVer decoupled from the protocol's `protocol_revision`; a package
-major is owed only when a shipped public API is removed or changes
-behavior.
+Package SemVer decoupled from the protocol's `protocol_revision`. While the
+package is below 1.0, breaking public-API changes land in minor versions and
+are named in the commit message (0.2.0 is one: `signTermination`'s view
+requires `chain`, `signAcceptance` now enforces the refusal guards over the
+`chain` it previously ignored, and `signReceipt` requires its issuing view);
+at or above 1.0 a package major is owed when a shipped public API is removed
+or changes behavior.
 
 ## License
 

package/dist/index.js

@@ -2,7 +2,8 @@
 //
 // Public surface of the holder-side companion signer: one signing function
 // per artifact kind, the key-handle contract, and the closed error
-// vocabulary. Verification of assembled artifacts goes through
-// @charter-agreement-protocol/verifier — exactly one verification
-// implementation.
+// vocabulary. ALL protocol logic — framing, the producer claims gate, the
+// R1-R3 refusal guards, assembly, and verification of the assembled
+// artifact — goes through @charter-agreement-protocol/verifier: exactly
+// one implementation. This package holds the custody half only.
 export { signDescriptor, signReceipt, signAcceptance, signTermination, } from "./signer.js";

package/dist/signer.d.ts

@@ -16,14 +16,16 @@ export type SignError = {
 } | {
     error: "refused";
     code: string;
+} | {
+    error: "verification_failed";
 };
 export type SignOk<T> = {
     ok: true;
     result: T;
 };
-export type SignResult<T> = SignOk<T> | {
+export type SignResult<T> = SignOk<T> | ({
     ok: false;
-} & SignError;
+} & SignError);
 export type ChainView = {
     revisions: string[];
     acceptances: string[];
@@ -35,7 +37,7 @@ export declare function signDescriptor(claims: Record<string, unknown>, keyHandl
 }): Promise<SignResult<{
     descriptor: string;
 }>>;
-export declare function signReceipt(claims: Record<string, unknown>, keyHandle: unknown, chain: ChainView | null, opts?: {
+export declare function signReceipt(claims: Record<string, unknown>, keyHandle: unknown, chain: ChainView, opts?: {
     algorithm?: string;
 }): Promise<SignResult<{
     receipt: string;
@@ -52,6 +54,7 @@ export declare function signAcceptance(claims: Record<string, unknown>, keyHandl
 export declare function signTermination(claims: Record<string, unknown>, keyHandle: unknown, view: {
     revisionText: string;
     descriptorCompacts: string[];
+    chain: ChainView;
 }, opts?: {
     algorithm?: string;
 }): Promise<SignResult<{

package/dist/signer.js

@@ -7,21 +7,15 @@
 //   keyIdentity(handle) -> { kid, publicKey }   // ONE atomic snapshot
 //   sign(message, handle) -> signature bytes    // the holder's job
 //
-// The signer builds the exact RFC 7515 signing input through the verifier
-// package's producers surface, runs the honest-signer refusal guards
-// BEFORE any key is touched, checks the returned signature against the
-// snapshot's public key (the wrong-key guard), assembles the compact, and
-// post-sign-verifies the assembled artifact through the verifier package.
-// It never verifies third-party artifacts, never transports, never
-// persists, and never sees a private key.
-import { algorithmRegistry, canonical, decodeArtifact, defaultEmissionName, emissions, encodeBase64url, verifyAcceptance, verifyDescriptor, verifyReceipt, verifySignature, verifyTermination, } from "@charter-agreement-protocol/verifier";
-const TYPES = {
-    descriptor: "cap+party",
-    acceptance: "cap+acceptance",
-    termination: "cap+termination",
-    receipt: "cap+receipt",
-};
-const MAX_INPUT_BYTES = 1_048_576;
+// Framing, the producer claims gate, the honest-signer refusal guards
+// (R1–R3), and assembly are ALL the verifier package's producer surface —
+// exactly one implementation, exactly the reference signer's delegation.
+// This package adds the custody half: the atomic key snapshot, the sign
+// callback, the wrong-key guard against the snapshot's public key, and the
+// post-sign verification of the assembled artifact. It never verifies
+// third-party artifacts, never transports, never persists, and never sees
+// a private key.
+import { acceptanceSigningInput, algorithmRegistry, assembleCompact, descriptorSigningInput, receiptSigningInput, terminationSigningInput, verifyAcceptance, verifyChain, verifyDescriptor, verifyReceipt, verifySignature, verifyTermination, } from "@charter-agreement-protocol/verifier";
 function registryRow(algorithm) {
     return algorithmRegistry().find((row) => row.name === algorithm) ?? null;
 }
@@ -44,66 +38,27 @@ async function resolveKeyIdentity(handle) {
         return { error: "invalid_handle" };
     }
 }
-function resolveAlgorithm(selection) {
-    if (selection === undefined || selection === null)
-        return defaultEmissionName();
-    if (typeof selection === "string" && selection in emissions())
-        return selection;
-    return { error: "invalid_input", code: "algorithm_unsupported" };
-}
-function claimsRevision(claims) {
-    const value = claims.protocol_revision;
-    return typeof value === "number" && Number.isInteger(value) ? value : null;
-}
-// The producer core: canonical claims, the closed protected header with the
-// selected emission name and the SNAPSHOT kid, the size guard, and the
-// provisional framing check over a zero signature — CAP's producer contract.
-function frameSigningInput(kind, claims, kid, algorithm) {
-    if (!claims || typeof claims !== "object" || Array.isArray(claims)) {
-        return { error: "invalid_input", code: "invalid_type" };
-    }
-    if (claimsRevision(claims) !== emissions()[algorithm]) {
-        return { error: "invalid_input", code: "signing_input_invalid" };
-    }
-    if (typeof kid !== "string" || kid.length === 0 || kid.length > 128 || !/^[A-Za-z0-9._~-]+$/.test(kid)) {
-        return { error: "invalid_input", code: "signing_input_invalid" };
-    }
-    const row = registryRow(algorithm);
-    if (!row)
-        return { error: "invalid_input", code: "algorithm_unsupported" };
-    const payloadBytes = Buffer.from(canonical(claims), "utf8");
-    const protectedBytes = Buffer.from(canonical({ alg: algorithm, kid, typ: TYPES[kind] }), "utf8");
-    const protectedSegment = encodeBase64url(protectedBytes);
-    const payloadSegment = encodeBase64url(payloadBytes);
-    const message = Buffer.from(`${protectedSegment}.${payloadSegment}`, "utf8");
-    const signatureSegmentLength = Math.ceil((row.signatureBytes * 4) / 3);
-    if (message.length + 1 + signatureSegmentLength > MAX_INPUT_BYTES) {
-        return { error: "invalid_input", code: "signing_input_invalid" };
-    }
-    // The provisional check: a zero signature of the row's exact length must
-    // frame and bind (canonical bytes, registry binding, per-row length).
-    const zeroSignature = Buffer.alloc(row.signatureBytes);
-    const provisional = `${protectedSegment}.${payloadSegment}.${encodeBase64url(zeroSignature)}`;
-    const decoded = decodeArtifact(provisional);
-    if (!decoded.ok)
-        return { error: "invalid_input", code: "signing_input_invalid" };
-    return { protectedSegment, payloadSegment, message };
-}
-async function signCommon(kind, claims, keyHandle, opts) {
+// The shared custody tail (the reference signer's): identity snapshot ->
+// producer (framing, claims schema, R1-R3 refusals - one implementation,
+// in the verifier package) -> sign via the handle -> wrong-key guard.
+// A refusal or producer rejection never touches the key.
+async function signProduced(keyHandle, produce, opts) {
     const snapshot = await resolveKeyIdentity(keyHandle);
     if ("error" in snapshot)
         return snapshot;
-    const algorithm = resolveAlgorithm(opts?.algorithm);
-    if (typeof algorithm !== "string" && "error" in algorithm)
-        return algorithm;
-    const framed = frameSigningInput(kind, claims, snapshot.kid, algorithm);
-    if ("error" in framed)
-        return framed;
+    const produced = produce(snapshot.kid, opts?.algorithm);
+    if (!produced.ok) {
+        // signing_refused is the honest-signer refusal; every other producer
+        // code stays caller input.
+        return produced.code === "signing_refused"
+            ? { error: "refused", code: produced.code }
+            : { error: "invalid_input", code: produced.code };
+    }
     // The holder signs the exact message; a fault or a wrong-length result is
     // a signing failure, never a silent pass.
     let signature;
     try {
-        signature = await keyHandle.sign(framed.message, keyHandle);
+        signature = await keyHandle.sign(produced.input.message, keyHandle);
     }
     catch (_fault) {
         return { error: "signing_failed" };
@@ -111,66 +66,115 @@ async function signCommon(kind, claims, keyHandle, opts) {
     if (!(signature instanceof Uint8Array) || signature.length === 0) {
         return { error: "signing_failed" };
     }
-    const row = registryRow(algorithm);
+    const row = registryRow(produced.input.alg);
     if (!row || signature.length !== row.signatureBytes) {
         return { error: "signing_failed" };
     }
     // The wrong-key guard: the signature MUST verify against the snapshot's
-    // public key under the selected algorithm.
-    if (!verifySignature(framed.message, Buffer.from(signature), snapshot.publicKey, algorithm)) {
+    // public key under the minted algorithm.
+    if (!verifySignature(produced.input.message, Buffer.from(signature), snapshot.publicKey, produced.input.alg)) {
         return { error: "signing_failed" };
     }
-    return { message: framed.message, signature: Buffer.from(signature) };
+    return { input: produced.input, signature: Buffer.from(signature) };
 }
-function assemble(message, signature) {
-    return `${message.toString("utf8")}.${encodeBase64url(signature)}`;
+// Assembly goes through the verifier's assembleCompact: registry-row
+// length, framing re-decode, size gate - never a local string join.
+function compactOrInvalid(signed) {
+    const assembled = assembleCompact(signed.input, signed.signature);
+    if (!assembled.ok)
+        return { error: "invalid_input", code: assembled.code };
+    return { compact: assembled.compact };
+}
+// The view's chain is THIS package's public contract (the producer surface
+// validates its depth); the shallow shape is policed here so the closed
+// error vocabulary holds regardless of which verifier revision resolves.
+// A verifier crash past this gate stays loud - never a misleading error.
+function chainViewOrInvalid(chain) {
+    if (!chain || typeof chain !== "object" || Array.isArray(chain)) {
+        return { error: "invalid_input", code: "signing_input_invalid" };
+    }
+    return chain;
+}
+// A missing view object is caller input like a missing chain: the closed
+// error, never a dereference throw.
+function viewChainOrInvalid(view) {
+    if (!view || typeof view !== "object")
+        return { error: "invalid_input", code: "signing_input_invalid" };
+    return chainViewOrInvalid(view.chain);
 }
-// ---------------------------------------------------------------------------
-// Honest-signer refusal guards (R1–R3 from the Elixir reference): they run
-// against the caller's own verified view BEFORE any key is touched.
-// ---------------------------------------------------------------------------
 // ---------------------------------------------------------------------------
 // Public signing surface
 // ---------------------------------------------------------------------------
 export async function signDescriptor(claims, keyHandle, opts = {}) {
-    const signed = await signCommon("descriptor", claims, keyHandle, opts);
+    const signed = await signProduced(keyHandle, (kid, algorithm) => descriptorSigningInput(kid, claims, algorithm), opts);
     if ("error" in signed)
         return { ok: false, ...signed };
-    const compact = assemble(signed.message, signed.signature);
-    const verified = verifyDescriptor(compact);
+    const assembled = compactOrInvalid(signed);
+    if ("error" in assembled)
+        return { ok: false, ...assembled };
+    const verified = verifyDescriptor(assembled.compact);
     if (!verified.ok)
-        return { ok: false, error: "invalid_input", code: verified.code };
-    return { ok: true, result: { descriptor: compact } };
+        return { ok: false, error: "verification_failed" };
+    return { ok: true, result: { descriptor: assembled.compact } };
 }
 export async function signReceipt(claims, keyHandle, chain, opts = {}) {
-    const signed = await signCommon("receipt", claims, keyHandle, opts);
+    // The issuing view is REQUIRED (the reference takes ChainFacts or a
+    // CharterRevision, never none) and its discipline runs after the build,
+    // before the key - the reference's context is a verified ChainFacts by
+    // construction, so a TS view that fails the chain discipline is caller
+    // input, never a burned key operation.
+    const signed = await signProduced(keyHandle, (kid, algorithm) => {
+        const built = receiptSigningInput(kid, claims, algorithm);
+        if (!built.ok)
+            return built;
+        const resolved = chainViewOrInvalid(chain);
+        if ("error" in resolved)
+            return { ok: false, code: resolved.code };
+        if (!verifyChain(resolved).ok)
+            return { ok: false, code: "chain_invalid" };
+        return built;
+    }, opts);
     if ("error" in signed)
         return { ok: false, ...signed };
-    const compact = assemble(signed.message, signed.signature);
-    if (chain) {
-        const verified = verifyReceipt(compact, chain);
-        if (!verified.ok)
-            return { ok: false, error: "invalid_input", code: verified.code };
-    }
-    return { ok: true, result: { receipt: compact } };
+    const assembled = compactOrInvalid(signed);
+    if ("error" in assembled)
+        return { ok: false, ...assembled };
+    const verified = verifyReceipt(assembled.compact, chain);
+    if (!verified.ok)
+        return { ok: false, error: "verification_failed" };
+    return { ok: true, result: { receipt: assembled.compact } };
 }
 export async function signAcceptance(claims, keyHandle, view, opts = {}) {
-    const signed = await signCommon("acceptance", claims, keyHandle, opts);
+    const viewChain = viewChainOrInvalid(view);
+    const signed = await signProduced(keyHandle, (kid, algorithm) => {
+        if ("error" in viewChain)
+            return { ok: false, code: viewChain.code };
+        return acceptanceSigningInput(kid, claims, viewChain, algorithm);
+    }, opts);
     if ("error" in signed)
         return { ok: false, ...signed };
-    const compact = assemble(signed.message, signed.signature);
-    const verified = verifyAcceptance(compact, view.revisionText, view.descriptorCompacts);
+    const assembled = compactOrInvalid(signed);
+    if ("error" in assembled)
+        return { ok: false, ...assembled };
+    const verified = verifyAcceptance(assembled.compact, view.revisionText, view.descriptorCompacts);
     if (!verified.ok)
-        return { ok: false, error: "invalid_input", code: verified.code };
-    return { ok: true, result: { acceptance: compact } };
+        return { ok: false, error: "verification_failed" };
+    return { ok: true, result: { acceptance: assembled.compact } };
 }
 export async function signTermination(claims, keyHandle, view, opts = {}) {
-    const signed = await signCommon("termination", claims, keyHandle, opts);
+    const viewChain = viewChainOrInvalid(view);
+    const signed = await signProduced(keyHandle, (kid, algorithm) => {
+        if ("error" in viewChain)
+            return { ok: false, code: viewChain.code };
+        return terminationSigningInput(kid, claims, viewChain, algorithm);
+    }, opts);
     if ("error" in signed)
         return { ok: false, ...signed };
-    const compact = assemble(signed.message, signed.signature);
-    const verified = verifyTermination(compact, view.revisionText, view.descriptorCompacts);
+    const assembled = compactOrInvalid(signed);
+    if ("error" in assembled)
+        return { ok: false, ...assembled };
+    const verified = verifyTermination(assembled.compact, view.revisionText, view.descriptorCompacts);
     if (!verified.ok)
-        return { ok: false, error: "invalid_input", code: verified.code };
-    return { ok: true, result: { termination: compact } };
+        return { ok: false, error: "verification_failed" };
+    return { ok: true, result: { termination: assembled.compact } };
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@charter-agreement-protocol/signer",
-  "version": "0.1.1",
-  "description": "Holder-side companion signer for the Charter Agreement Protocol (CAP) in TypeScript — atomic key snapshots, honest-signer refusals, external-signature assembly, and post-sign verification through the @charter-agreement-protocol/verifier. CAP verifies; it never authorizes; this signer signs, it never verifies third-party artifacts or takes custody.",
+  "version": "0.2.1",
+  "description": "Holder-side companion signer for the Charter Agreement Protocol (CAP) in TypeScript - key custody only: an atomic key snapshot, the sign callback, the wrong-key guard, and post-sign verification, with framing, the claims gate, the R1-R3 honest-signer refusals, and assembly all delegated to the @charter-agreement-protocol/verifier producer surface. CAP verifies; it never authorizes; this signer signs, it never verifies third-party artifacts or takes custody.",
   "license": "Apache-2.0",
   "type": "module",
   "main": "./dist/index.js",
@@ -14,6 +14,7 @@
     "./package.json": "./package.json"
   },
   "files": [
+    "CHANGELOG.md",
     "dist",
     "LICENSE",
     "NOTICE",
@@ -26,13 +27,19 @@
     "build": "tsc -p tsconfig.build.json",
     "typecheck": "tsc --noEmit",
     "test": "node --test --experimental-strip-types --no-warnings signer.test.ts",
-    "prepack": "npm run build"
+    "prepack": "npm run build",
+    "typecheck:web": "tsc -p tsconfig.web.json",
+    "build:site": "node web/build.mjs && esbuild web/main.ts --bundle --minify --format=iife --target=es2022 --outfile=site-dist/app.js --alias:node:crypto=./web/shim/node-crypto.ts --alias:node:fs=./web/shim/node-fs.ts --alias:node:path=./web/shim/node-path.ts --inject:./web/shim/buffer-global.ts"
   },
   "dependencies": {
-    "@charter-agreement-protocol/verifier": "^0.2.0"
+    "@charter-agreement-protocol/verifier": "^0.5.0"
   },
   "devDependencies": {
+    "@noble/ed25519": "^3.2.0",
+    "@noble/hashes": "^2.4.0",
     "@types/node": "^26.5.1",
+    "buffer": "^6.0.3",
+    "esbuild": "^0.28.2",
     "typescript": "~5.9.0"
   },
   "repository": {