@charter-agreement-protocol/signer 0.2.2 → 0.3.0

package/CHANGELOG.md

@@ -3,6 +3,137 @@
 All notable public changes to `@charter-agreement-protocol/signer` are
 documented here.
 
+## [0.3.0] — October 14, 2026
+
+### Breaking
+
+- `signAcceptance` and `signTermination` now take `(claims, keyHandle, chain,
+  opts)`. The verifier derives context from that chain; `revisionText` and
+  `descriptorCompacts` are removed from the signer input. Migration:
+
+  ```ts
+  // Before
+  await signAcceptance(claims, keyHandle, { revisionText, descriptorCompacts, chain }, opts);
+  // Now
+  await signAcceptance(claims, keyHandle, chain, opts);
+  await signTermination(terminationClaims, keyHandle, chain, opts);
+  ```
+
+- The holder's own descriptor key is checked before signing. A wrong kid,
+  public key, or key algorithm returns
+  `{ ok: false, error: "refused", code: "signing_key_mismatch" }`.
+  `signing_key_invalid` maps to `invalid_key_handle`. For otherwise valid
+  descriptor claims, an absent or null successor predecessor, a valid predecessor
+  supplied to a genesis, broken signed lineage, or digest aliases that disagree
+  with the reverified lineage return `invalid_input`/`descriptor_chain_invalid`.
+  A non-object predecessor, both digest aliases absent, or missing, null, empty,
+  or non-string lineage return `invalid_input`/`invalid_type`. Throwing reads also
+  return `invalid_type`. History excluded by a profile or requiring unavailable
+  crypto preserves the profile or substrate code.
+- Context, claims/context mismatches, profile exclusions, and compact size
+  limits reject before the signing callback. Missing or malformed context
+  types return `invalid_input`/`invalid_type`; malformed sets preserve the
+  verifier's code, including `compact_invalid`. `verification_failed` now
+  means only that `finishSigning` rejected what preparation approved.
+- Unavailable crypto returns the top-level
+  `{ ok: false, error: "algorithm_unsupported_on_substrate" }` before signing,
+  including an ML-DSA-65 request on the browser bundle.
+- Rename `invalid_handle` to `invalid_key_handle`. Update error comparisons
+  and exhaustive switches; the result shape is unchanged. Add the new substrate
+  error and refusal code to exhaustive handling.
+- Options must be absent or a plain object containing only `algorithm`,
+  `limits`, `profile`, and (for `signDescriptor`) `predecessor`. Unknown keys,
+  non-plain objects, and unreadable getters return `invalid_input`/`invalid_type`.
+  Malformed limits and profiles preserve `invalid_limits` and `invalid_profile`.
+  Previously, a misspelled option key silently fell back to Ed25519.
+
+### Added
+
+- `signDescriptor` accepts the verifier's `DescriptorPredecessor` as
+  `opts.predecessor`, with retained signed `lineage`, for successor descriptors.
+- All four functions accept verifier `limits` and `profile` options. Limits
+  include the final compact and context artifacts and also apply to the custody
+  guard and completion. Profiles check the new artifact and retained context.
+- `signReceipt` accepts bare revision text as well as a chain view. With a
+  bare revision, the custody guard checks the snapshot key and verifier facts
+  list `signature` in `not_verified`.
+- Export `SigningOptions` and `DescriptorOptions`. Real-key tests cover
+  Ed25519 and ML-DSA-65 successors and pre-sign refusals, with zero signing calls
+  asserted on rejection. The browser bundle test runs the complete workshop flow.
+- Include `SECURITY.md`, `CODE_OF_CONDUCT.md`, and `CONTRIBUTING.md` in the
+  npm package with this package's reporting and contribution practices.
+- Run the shared signer table from `charter_agreement_signer` 0.5.0, copied byte for byte with
+  a SHA-256 check. All 121 rows use real seed keys and compare result shapes,
+  codes, snapshot counts, and custody counts. Twelve Ed25519 successes match
+  exact compacts; five ML-DSA-65 successes pass public verification. The explicit
+  list of unexpressible rows is empty, and the run count is asserted. Eight
+  shared requests or contexts needing ML-DSA-65 refuse before browser custody.
+
+### Changed
+
+- Delegate preparation and completion to verifier 0.7.0's `prepareSigning`
+  and `finishSigning`; remove the signer's context derivation,
+  producer calls, assembly calls, and choice of post-sign verification function.
+- Require `@charter-agreement-protocol/verifier` ^0.7.0. Its signing preparation
+  corpus uses the public input shapes, and signing plans can only be made through
+  `prepareSigning`. The signer already uses that path.
+- Accept signature bytes from any JavaScript realm, including Buffer and plain
+  `Uint8Array`. Ed25519 snapshot keys with noncanonical y coordinates, no curve
+  point, x = 0 with the sign bit set, or small order return `invalid_key_handle`.
+  Invalid descriptor claim keys can fail earlier with `signing_input_invalid`.
+  The verifier checks option values before either key callback. Sparse profile
+  algorithm lists return `invalid_input`/`invalid_profile`; nonfinite or
+  explicitly undefined limit values return `invalid_input`/`invalid_limits`.
+- Copy claims into plain JSON before the first `await`, without array
+  constructor hooks. Read defined context and predecessor members once and
+  retain artifact lists for the verifier. Lineage arrays have no JSON bounds.
+  Claims entry guards use the verifier's maximum JSON bounds. Caller limits and final compact size are
+  checked by `prepareSigning`; oversize claims return `signing_input_invalid`.
+  Predecessor lineage has no signer item limit.
+- Read defined option members once with ordinary property access, including
+  inherited members and accepted class or Map properties. Keep invalid member
+  values opaque for the verifier's checks. Return every verifier option error,
+  including copy errors. Long algorithm lists retain an invalid length without
+  walking their entries.
+- Run all 121 shared rows in Node and the browser bundle with no skips.
+  `ml-successor-ok` and `ml-successor-wrong` now use their table
+  `expected_limited`: `algorithm_unsupported_on_substrate`, one snapshot, and
+  zero custody calls because the browser cannot verify ML-DSA-65 predecessor
+  history. Node retains successor success and
+  `invalid_input`/`descriptor_chain_invalid`, respectively. Removing the duplicate
+  `termination-excluded-context` row
+  reduces the exact Ed25519 success count from 13 to 12 in each lane.
+  Existing row outcomes and the signer API remain unchanged with this build.
+- Resolve limits, then profile, then algorithm, before taking the key snapshot.
+  Absent, `undefined`, and `null` algorithms select Ed25519. Explicit values are
+  `Ed25519` and `ML-DSA-65`; others return `invalid_input`/`algorithm_unsupported`
+  before either callback. The snapshot checks only a non-empty string kid and
+  a string public key; the verifier checks key encoding and shape.
+- Keep version 0.3.0 and the workshop badge. Builds remove stale library output;
+  CI typechecks and builds the workshop on Linux with Node 24.8.0 and Node 24.
+- SECURITY.md uses GitHub private vulnerability reporting. Evidence descriptions
+  name the checks that run; this signer has no telemetry.
+- See the [profile scope](README.md#profile-scope) for the shared ruling.
+
+### Migration from CAP 0.4 to 0.5
+
+- Revisions must name two distinct parties from different descriptor histories.
+  Replace fixtures that use one descriptor for both roles with two real parties.
+  Chain views supply explicit `revisions`, `acceptances`, `descriptors`, and
+  `terminations` arrays, including empty lists.
+
+### Migration from verifier 0.5 to 0.6
+
+- Producer build failures surface as `invalid_input`/`signing_input_invalid`.
+  Termination claims omit `extensions` and other extra members.
+- Digests are canonical base64url SHA-256 values and revision JSON is canonical.
+  Descriptor keys use canonical encodings with the selected algorithm's byte
+  length. Mixed party histories and unknown claims reject.
+- Direct verifier callers pass retained signed `lineage` in predecessor facts
+  to `verifyDescriptor`; `{ digest, claims }` alone is insufficient. Genesis
+  calls omit the predecessor. This signer exposes that predecessor in options.
+- Profiles and limits can reject context as well as the new artifact.
+
 ## [0.2.2] — October 6, 2026
 
 ### Changed
@@ -27,9 +158,8 @@ No API change: verifier 0.5.0 added consumer-side surface only (the
 capability probe, the signature registry identity, the descriptor
 timestamp floor, the 104-case corpus); the producer surface this package
 delegates to is unchanged. Typecheck strict, 18/18 tests against the
-resolved 0.5.0. The producer-side capability alignment (mirrored
-`capabilities()` with refuse-before-mint, declared minting metadata,
-profile-bound signing) is the next feature release on this line.
+resolved 0.5.0. Corrected in 0.3.0: 0.2.2 did not add signer capability metadata,
+profile options, or telemetry.
 
 ## [0.2.0] — 2026-09-17
 

package/CODE_OF_CONDUCT.md

@@ -0,0 +1,87 @@
+<!-- Adapted from the Contributor Covenant version 2.1 (https://www.contributor-covenant.org),
+     the canonical text with the reporting contact substituted for this repository. -->
+
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, caste, color, religion, or sexual identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes, and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the overall community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or advances of any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email address, without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of acceptable behavior and will take appropriate and fair corrective action in response to any behavior that they deem inappropriate, threatening, offensive, or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, and will communicate reasons for moderation decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when an individual is officially representing the community in public spaces. Examples of representing our community include using an official e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community leaders responsible for enforcement at the repository maintainer PRIVATELY at palermo777@gmail.com — conduct reports are kept
+confidential; please do not open public issues for conduct reports. All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing clarity around the nature of the violation and an explanation of why the behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of actions.
+
+**Consequence**: A warning with consequences for continued behavior. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period of time. This includes avoiding interactions in community spaces as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public communication with the community for a specified period of time. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community standards, including sustained inappropriate behavior, harassment of an individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 2.1, available at [https://www.contributor-covenant.org/version/2/1/code_of_conduct.html][v2.1].
+
+Community Impact Guidelines were inspired by [Mozilla's code of conduct enforcement ladder][Mozilla CoC].
+
+For answers to common questions about this code of conduct, see the FAQ at [https://www.contributor-covenant.org/faq][FAQ]. Translations are available at [https://www.contributor-covenant.org/translations][translations].
+
+[homepage]: https://www.contributor-covenant.org
+[v2.1]: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html
+[Mozilla CoC]: https://github.com/mozilla/diversity
+[FAQ]: https://www.contributor-covenant.org/faq
+[translations]: https://www.contributor-covenant.org/translations

package/CONTRIBUTING.md

@@ -0,0 +1,71 @@
+# Contributing
+
+Contributions must preserve the signer's boundaries: the library depends
+only on the public verifier package, key identity comes from one atomic
+snapshot, errors contain no caller values, and test handles do not ship.
+Private keys stay behind the caller's callbacks.
+
+## Toolchain
+
+Use Node 24, at least 24.8.0, and npm. `package-lock.json` pins the build
+tools and verifier version. CI runs on Linux with Node 24.8.0 and the current
+Node 24 line.
+
+## Before a pull request
+
+Install with the frozen lockfile, then run the local checks:
+
+```console
+npm ci
+npm test
+npm run typecheck
+npm run typecheck:web
+npm run build
+npm run build:site
+npm pack --dry-run
+```
+
+The checks after installation run locally without a network connection.
+The suite builds a browser bundle with the workshop's shims and exercises
+real Ed25519 and ML-DSA-65 keys. The library build writes `dist/`; the site
+build writes `site-dist/`.
+
+## Windows
+
+Developer platforms are macOS and Linux. Windows developers use WSL2,
+clone inside its filesystem and follow the Linux commands. CI runs on
+Linux only. Native ML-DSA tests require the supported Node crypto runtime.
+
+## Commits
+
+Use explicit paths when staging or committing. Keep tool directories and
+local process state out of commits. Work on `main` in small commits with
+plain messages unless the maintainer asks otherwise. Do not use `git stash`.
+
+## Tests and checks
+
+- For behavior changes, write the test, observe it fail for the intended
+  reason, then make it pass. Record the observed failure in the commit.
+- New checks must fail under a named temporary mutation. Restore the
+  original code and run the suite again before committing.
+- Use real keys and real signing callbacks. Do not use mocks, fake crypto
+  or handles that return invented signatures.
+- Search for tests of the old contract before changing behavior.
+
+The local suite runs the [shared signer table](test/fixtures/README.md)
+against the TypeScript verifier this checkout installs. It compares recorded
+Elixir outcomes and exact Ed25519 compacts with real seed keys, then checks
+every success through verification. It does not execute Elixir locally.
+Keep the source table byte for byte and report disagreements with both outcomes.
+
+## Protocol dependency changes
+
+Move the verifier requirement and lockfile together. Read its changelog,
+test against the published package and document changes to input rules
+or error codes. Keep signing fixtures canonical.
+
+## Docs
+
+Update documentation with the behavior it describes. Keep error names,
+supported options, package metadata and the workshop's version badge in
+sync. Describe only checks that run and features that ship.

package/README.md

@@ -7,15 +7,12 @@ Holder-side companion signer for the
 
 **CAP verifies; it never authorizes. This signer signs; it never takes
 custody.** You keep the key (HSM, OS keychain, key server) behind a handle
-object with two callbacks; the signer resolves ONE atomic `keyIdentity`
-snapshot, then delegates EVERYTHING pure to the verifier package's producer
-surface — the exact RFC 7515 signing input, the producer claims gate, the
-R1–R3 honest-signer refusal guards (claims-truth, no-equivocation,
-ancestry/governing coverage), and assembly — **before the key signs**, with
-exactly one implementation. What stays here is custody: the sign callback,
-the wrong-key guard against the snapshot's public key, and the post-sign
-verification of the assembled artifact through the
-`@charter-agreement-protocol/verifier` package.
+with two callbacks. The signer resolves limits, profile, and algorithm, copies
+claims and context at entry, and takes one atomic `keyIdentity` snapshot.
+The verifier's `prepareSigning` checks framing, claims, context, profile,
+limits, and the holder's own descriptor key before the callback signs.
+The signer checks the signature against the snapshot public key, then calls
+`finishSigning` to assemble and verify under the retained context and settings.
 
 ## Install
 
@@ -23,8 +20,8 @@ verification of the assembled artifact through the
 npm install @charter-agreement-protocol/signer
 ```
 
-Release **0.2.2** requires Node >= 24.8.0 (ML-DSA support in the Node builtins)
-and depends on `@charter-agreement-protocol/verifier` `^0.5.0`.
+Version **0.3.0** requires Node >= 24.8.0 and
+`@charter-agreement-protocol/verifier` ^0.7.0, for its pre-sign API.
 
 ## Quickstart
 
@@ -72,76 +69,175 @@ For ML-DSA-65 artifacts pass `{ algorithm: "ML-DSA-65" }` as the options
 argument with `protocol_revision: 3` claims (pure ML-DSA per RFC 9964, the
 empty context — your handle signs the exact message bytes as with Ed25519).
 
+An absent, `undefined` or `null` algorithm selects Ed25519. Explicit
+algorithms are `Ed25519` and `ML-DSA-65`; any other value returns
+`invalid_input` with `code: "algorithm_unsupported"` before either key
+callback runs.
+
 ## API
 
 | Export | What it does |
 |---|---|
-| `signDescriptor(claims, handle, opts?)` | Signs one Party Descriptor; post-verified via `verifyDescriptor` |
-| `signReceipt(claims, handle, chain, opts?)` | Signs one Receipt against the required issuing view; post-verified via `verifyReceipt` (the reference takes a context, never none) |
-| `signAcceptance(claims, handle, view, opts?)` | Signs one Acceptance against the caller's verified view — the R1–R3 refusal guards run over `view.chain` before the key signs |
-| `signTermination(claims, handle, view, opts?)` | Signs one Termination against the caller's verified view — the R1–R3 refusal guards run over `view.chain` before the key signs |
-
-The acceptance/termination `view` is `{ revisionText, descriptorCompacts,
-chain }`: the revision the claims name, the signing party's descriptor
-chain, and the caller's full `ChainView` (`{ revisions, acceptances,
-descriptors, terminations }`) the refusal guards verify and bind against.
-
-Errors are closed: `{ ok: false, error: "invalid_handle" \| "signing_failed"
-\| "invalid_input" \| "refused" \| "verification_failed" }` — `code` rides
-only on `invalid_input` and `refused`; `verification_failed` is bare
-(reference parity).
-`"refused"` is the honest-signer refusal: the claims contradict the caller's
-own verified view, and the handle's `sign` callback is never reached (the
-atomic `keyIdentity` snapshot resolves first — the reference ordering).
-`"verification_failed"` is the separate post-sign discipline: the assembled
-artifact did not verify against the caller's view (for example a key that is
-not in the party descriptor's `verification_keys`). Malformed claims are
-rejected pre-sign as `"invalid_input"` through the verifier package's
-producer claims gate — they never burn a key operation. A signing failure is
-never a silent pass.
+| `signDescriptor(claims, handle, opts?)` | Signs a genesis or successor Party Descriptor; successors require `opts.predecessor` |
+| `signReceipt(claims, handle, context, opts?)` | Signs a Receipt against a chain view or bare revision text |
+| `signAcceptance(claims, handle, chain, opts?)` | Signs an Acceptance using the context the verifier derives from the chain |
+| `signTermination(claims, handle, chain, opts?)` | Signs a Termination using the context the verifier derives from the chain |
+| `SigningOptions`, `DescriptorOptions`, `ChainView`, `KeyHandle`, `KeySnapshot`, `SignError`, `SignResult` | Public TypeScript contracts |
+
+A `ChainView` contains four string arrays: `{ revisions, acceptances,
+descriptors, terminations }`. Pass all four, including explicit empty arrays.
+Acceptance and termination use this chain directly. The verifier derives the
+claimed revision and the holder's own descriptor history from its verified
+contents. The signer copies claims at entry, before awaiting a key callback.
+Claims copies contain fresh plain JSON objects and arrays, strings, finite
+numbers, booleans, and null. Repeated objects are copied separately. Non-JSON
+claims, cycles, and throwing reads return `invalid_input`/`invalid_type`.
+Chain context and predecessor use their defined members with ordinary property
+reads, and retained artifact lists get fresh arrays. Valid members are immutable
+text; invalid member values stay opaque for the verifier.
+
+Claims copies use an iterative traversal guarded by the verifier's maximum
+supported JSON bounds, rather than the caller's limits. Values beyond those
+maximums return `invalid_input`/`signing_input_invalid`. Smaller claims reach
+`prepareSigning`, which owns all checks under caller limits, including final
+compact size. Context list copies retain enough entries to exceed every
+supported artifact item limit, letting the verifier return its own result.
+Predecessor lineage has no signer item limit. The verifier checks immutable
+artifact text under artifact byte limits, separately from parsed claims' string
+limits.
+
+Migration from the previous issuing view:
+
+```ts
+// Before
+await signAcceptance(claims, handle, { revisionText, descriptorCompacts, chain }, opts);
+// Now
+await signAcceptance(claims, handle, chain, opts);
+await signTermination(terminationClaims, handle, chain, opts);
+```
+
+For a successor descriptor, pass the verifier's `DescriptorPredecessor` facts
+with retained signed `lineage`. The signing key must match an active key in
+the predecessor:
+
+```ts
+import { verifyDescriptor } from "@charter-agreement-protocol/verifier";
+
+const previous = verifyDescriptor(genesisCompact);
+if (!previous.ok) throw new Error(previous.code);
+const next = await signDescriptor(successorClaims, handle, { predecessor: previous.facts });
+```
+
+For a receipt against bare revision text, the verifier checks the receipt's
+claims against that revision. The revision names no signing key, so the signer
+uses its snapshot for the custody guard; receipt verification reports
+`signature` in `not_verified`. A chain-backed receipt checks the key against
+the issuing party's descriptor keys in the holder's own view.
+
+`opts` is absent or an object with known own keys only: `algorithm`, `limits`,
+and `profile`, plus `predecessor` for `signDescriptor`. Another root shape, an
+unknown own key, or a throwing getter returns `invalid_input` with
+`code: "invalid_type"`. Defined members use ordinary property reads, once at
+entry, including inherited and nonenumerable members. Class instances and
+`Map` objects work where the verifier accepts their properties; Map entries
+are not option properties.
+
+`limits` is the verifier's `Partial<Limits>` and `profile` is its `Profile`.
+The signer reads only their defined shape. Invalid values stay opaque for the
+verifier's synchronous checks; they are not recursively copied by the signer.
+Limits are checked before profile, algorithm, and the key snapshot. Malformed
+values, including bigint, symbol, and boxed numbers, retain the verifier's
+`invalid_limits` or `invalid_profile` result. Sparse algorithm lists return
+`invalid_profile`; nonfinite or explicitly undefined limit values return
+`invalid_limits`. A list longer than the algorithm registry cannot be a valid
+unique subset, so its invalid length reaches the verifier without reading its
+entries. The verifier's copy failures are also returned unchanged.
+Limits bound the final compact, including signature bytes, and
+every context artifact read; raised limits also apply to assembly and the
+custody guard. Profiles can restrict `algorithms` and/or
+`revisions: { min, max }`; an omitted axis keeps the full supported range.
+An EdDSA-only profile, an ML-DSA-44/87-only profile, or revisions 1..1 excludes
+every artifact this signer emits. Exclusions return `algorithm_outside_profile`
+or `revision_outside_profile`.
+
+<a id="profile-scope"></a>
+
+For acceptance and termination, the caller's profile covers the claimed
+revision, the signing party's own descriptor history, and the new artifact.
+The rest of the set is checked under the full default profile. For receipts,
+the profile covers the new artifact and the whole retained set. For descriptors,
+it covers the new artifact and predecessor history.
+
+Errors are closed:
+
+| Result error | Meaning |
+|---|---|
+| `invalid_input`, with `code` | The verifier rejected claims, context, limits, or profile, or options were invalid |
+| `invalid_key_handle` | The snapshot callback failed, its shape was malformed, or the verifier returned `signing_key_invalid` |
+| `refused`, with `code: "signing_refused"` | The claims contradict the holder's own verified view (R1–R3) |
+| `refused`, with `code: "signing_key_mismatch"` | The kid, public key bytes, or key algorithm does not match the holder's own descriptor key |
+| `algorithm_unsupported_on_substrate` | The runtime cannot verify the selected algorithm or a context artifact |
+| `signing_failed` | The callback failed, returned a malformed signature, or failed the wrong-key guard |
+| `verification_failed` | `finishSigning` rejected what preparation approved |
+
+Every failure has `ok: false`. Only `invalid_input` and `refused` carry `code`.
+The signing callback can return a Buffer or any `Uint8Array`, including one
+from another JavaScript realm. The verifier rejects Ed25519 public keys with
+noncanonical y coordinates, no curve point, x = 0 with the sign bit set, or
+small order as `invalid_key_handle` when they are snapshot keys. Descriptor
+claims containing such keys can fail earlier with `signing_input_invalid`.
+All pre-sign rejections leave the `sign` callback untouched; the atomic key
+snapshot precedes `prepareSigning`. A malformed context type returns
+`invalid_input`/`invalid_type`. For otherwise valid descriptor claims, predecessor
+errors return `invalid_input` with these codes before signing:
+
+- `invalid_type`: a non-object predecessor, a missing digest alias (both `digest`
+  and `descriptor_digest` absent), or missing, null, empty, or non-string `lineage`.
+  Throwing reads also return this code.
+- `descriptor_chain_invalid`: an absent or null predecessor for a successor,
+  a valid predecessor supplied to a genesis, a broken signed lineage, or digest
+  aliases that disagree with the reverified lineage.
+- `algorithm_outside_profile`, `revision_outside_profile`, or
+  `algorithm_unsupported_on_substrate`: predecessor history excluded by the
+  profile or requiring unavailable crypto.
 
 ## The sibling verifier
 
-This package is one of two independent TypeScript siblings implementing the
-Charter Agreement Protocol — no Elixir code or dependency at runtime; the
-Elixir reference is the certification oracle (the verifier's vendored
-corpus is certified against it, and its CI cross-verifies
-TypeScript-signed artifacts from raw bytes).
-
-- **This package** — `@charter-agreement-protocol/signer`: key custody,
-  the wrong-key guard, post-sign verification, and the closed error
-  vocabulary — all protocol logic delegated to the verifier.
-- [`@charter-agreement-protocol/verifier`](https://www.npmjs.com/package/@charter-agreement-protocol/verifier)
-  — verification and the pure producer surface (signing inputs, claims
-  gate, refusal guards, assembly) that this package signs through.
-
-This signer depends on the verifier (`^0.5.0`, locked to 0.5.0). When changing
-that dependency, publish the verifier version first, then lock and release
-the signer against the published version. The packages have independent
-SemVer versions; signer documentation and build-tool updates can release
-without a verifier version change.
+The signer and verifier are separate TypeScript packages implementing the
+Charter Agreement Protocol, with no Elixir dependency at runtime. The
+verifier ships a corpus certified against the Elixir protocol reference.
+This signer tests its artifacts through the TypeScript verifier.
+All protocol checks run in `prepareSigning` and `finishSigning`; the signer
+keeps key custody callbacks, the signature guard, entry copies, option
+resolution, and the closed error vocabulary.
 
 ## Evidence
 
-- The Elixir reference repository's gate verifies TypeScript-signed
-  artifacts from raw bytes (cross-implementation agreement, enforced in CI).
-- Framing, the producer claims gate, refusal guards, and assembly are the
-  verifier package's producer surface (0.5.0) — the same single
-  implementation the independent verifier certifies. What remains here is
-  custody plus input policing: the issuing-view discipline composes the
-  verifier's own `verifyChain`, never a local reimplementation.
-- Post-sign verification goes through the
-  [@charter-agreement-protocol/verifier](https://www.npmjs.com/package/@charter-agreement-protocol/verifier)
-  package — the certified dual-implementation-verified verifier.
-
-## The verify side
-
-This package tracks the published verify line: it depends on
-`@charter-agreement-protocol/verifier` `^0.5.0`. Verifier 0.5.0 added
-consumer-side surface only; the producer surface this package uses is
-unchanged. The producer-side capability alignment (mirrored
-`capabilities()` with refuse-before-mint, declared minting metadata,
-profile-bound signing) is the next feature release on this line.
+- Linux CI runs the suite on Node 24.8.0 and the current Node 24 line.
+  Real Node crypto mints Ed25519 and ML-DSA-65 genesis and successor descriptors.
+  Pre-sign rejection tests count real signing calls and require zero calls.
+  Tests cover key mismatches, predecessor checks, malformed contexts, profiles,
+  final compact limits, receipt claims, entry copies, and unknown algorithms.
+- The workshop's browser bundle mints Ed25519 and runs the complete workshop
+  flow. It cannot verify ML-DSA-65 and refuses that request before signing with
+  the top-level `algorithm_unsupported_on_substrate` error.
+- The [shared table](test/fixtures/README.md) runs all 121 rows from the Elixir
+  signer, `charter_agreement_signer` 0.5.0, with its exact source bytes pinned by SHA-256. Real seed
+  keys check result shapes and codes, snapshot and custody counts, 12 exact
+  Ed25519 success compacts, and five ML-DSA-65 successes through verification.
+  All 121 rows run in both Node and the browser bundle with no skips. Eight
+  shared requests or contexts that need ML-DSA-65 also return a substrate error
+  before custody in the browser bundle.
+  This compares the recorded Elixir outcomes; it does not run Elixir locally.
+
+## Verifier compatibility and telemetry
+
+The verifier requires canonical digests and revision JSON, distinct party
+histories, and all four chain arrays. Build failures surface as `invalid_input`
+with `code: "signing_input_invalid"`; termination claims must omit `extensions`.
+See [CHANGELOG.md](CHANGELOG.md) for migration notes.
+
+This package has no telemetry events or hooks and no signer capability report.
 
 ## SemVer
 
@@ -156,13 +252,14 @@ or changes behavior.
 ## Development
 
 Use Node 24 (at least 24.8.0) and npm. The lockfile selects TypeScript 7.0.2
-and `@types/node` 26.6.4. CI runs on Linux with Node 24 and a frozen install;
-the same npm commands are used for local development on macOS and Linux.
+and `@types/node` 26.6.4. CI runs on Linux with Node 24.8.0 and Node 24
+using a frozen install; the same npm commands are used for local development on macOS and Linux.
 
 ```console
 npm ci
 npm run typecheck
 npm test
+npm run test:cases
 npm run build
 npm run typecheck:web
 npm run build:site

package/SECURITY.md

@@ -0,0 +1,55 @@
+# Security policy
+
+## Supported versions
+
+The latest published `0.x` line is supported. Wire compatibility follows
+the public `@charter-agreement-protocol/verifier` package's contract.
+
+## Security invariants
+
+- The library never solicits, processes or retains private key material.
+  Custody lives behind the caller's key-handle callbacks.
+- Every signature is verified against the snapshot public key before
+  success. A signature from another key returns `signing_failed`.
+- Key identity (`kid` and public key) comes from one atomic `keyIdentity`
+  snapshot per signing call. The signer supplies that snapshot's kid to
+  the producer.
+- Errors contain closed names and codes, with no key material, message
+  bytes, claims content or callback exception text.
+- The library's only runtime dependency is the public verifier package.
+  It contains no transport or HTTP client/server.
+- Test handles stay in test files and do not ship in the npm package.
+
+## Reporting a vulnerability
+
+Report it privately through GitHub's private vulnerability reporting for
+`baselabs/charter_agreement_signer_typescript` (the repository's Security
+tab, then "Report a vulnerability"). Do not open a public issue containing
+an exploit, credential, private key or unreleased vulnerability detail.
+
+A report should include:
+
+- the affected version or commit;
+- the violated property;
+- a minimal reproduction with newly generated test keys and no production
+  claims or credentials;
+- the expected security outcome.
+
+## Verifying a release
+
+The [Release workflow](https://github.com/baselabs/charter_agreement_signer_typescript/blob/main/.github/workflows/release.yml)
+checks the package before staging it on npm with provenance through
+GitHub Actions OIDC. The owner approves the staged release on npm with 2FA.
+Inspect the published package's source repository, archive integrity and
+provenance metadata with:
+
+```console
+npm view @charter-agreement-protocol/signer repository.url dist.integrity dist.attestations
+```
+
+## Acknowledgment
+
+We will acknowledge reports within 7 days and send status updates at least
+weekly until resolution, coordinating disclosure through a private advisory.
+This is a best-effort cadence from a small maintainer team, not a contractual
+SLA. Mark urgent reports clearly.

package/dist/index.d.ts

@@ -1 +1 @@
-export { signDescriptor, signReceipt, signAcceptance, signTermination, type KeyHandle, type KeySnapshot, type ChainView, type SignError, type SignResult, } from "./signer.ts";
+export { signDescriptor, signReceipt, signAcceptance, signTermination, type KeyHandle, type KeySnapshot, type ChainView, type SigningOptions, type DescriptorOptions, type SignError, type SignResult, } from "./signer.ts";

package/dist/index.js

@@ -2,8 +2,6 @@
 //
 // Public surface of the holder-side companion signer: one signing function
 // per artifact kind, the key-handle contract, and the closed error
-// vocabulary. ALL protocol logic — framing, the producer claims gate, the
-// R1-R3 refusal guards, assembly, and verification of the assembled
-// artifact — goes through @charter-agreement-protocol/verifier: exactly
-// one implementation. This package holds the custody half only.
+// vocabulary. Protocol checks run through prepareSigning and finishSigning
+// in @charter-agreement-protocol/verifier. This package keeps custody.
 export { signDescriptor, signReceipt, signAcceptance, signTermination, } from "./signer.js";

package/dist/signer.d.ts

@@ -1,3 +1,4 @@
+import { type DescriptorPredecessor, type Limits, type Profile } from "@charter-agreement-protocol/verifier";
 export type KeySnapshot = {
     kid: string;
     publicKey: string;
@@ -7,7 +8,7 @@ export type KeyHandle = {
     sign(message: Uint8Array, handle: unknown): Uint8Array | Promise<Uint8Array>;
 };
 export type SignError = {
-    error: "invalid_handle";
+    error: "invalid_key_handle";
 } | {
     error: "signing_failed";
 } | {
@@ -15,7 +16,9 @@ export type SignError = {
     code: string;
 } | {
     error: "refused";
-    code: string;
+    code: "signing_refused" | "signing_key_mismatch";
+} | {
+    error: "algorithm_unsupported_on_substrate";
 } | {
     error: "verification_failed";
 };
@@ -32,31 +35,23 @@ export type ChainView = {
     descriptors: string[];
     terminations: string[];
 };
-export declare function signDescriptor(claims: Record<string, unknown>, keyHandle: unknown, opts?: {
-    algorithm?: string;
-}): Promise<SignResult<{
+export type SigningOptions = {
+    algorithm?: string | null;
+    limits?: Partial<Limits>;
+    profile?: Profile;
+};
+export type DescriptorOptions = SigningOptions & {
+    predecessor?: DescriptorPredecessor | null;
+};
+export declare function signDescriptor(claims: Record<string, unknown>, keyHandle: unknown, opts?: DescriptorOptions): Promise<SignResult<{
     descriptor: string;
 }>>;
-export declare function signReceipt(claims: Record<string, unknown>, keyHandle: unknown, chain: ChainView, opts?: {
-    algorithm?: string;
-}): Promise<SignResult<{
+export declare function signReceipt(claims: Record<string, unknown>, keyHandle: unknown, context: ChainView | string, opts?: SigningOptions): Promise<SignResult<{
     receipt: string;
 }>>;
-export declare function signAcceptance(claims: Record<string, unknown>, keyHandle: unknown, view: {
-    revisionText: string;
-    descriptorCompacts: string[];
-    chain: ChainView;
-}, opts?: {
-    algorithm?: string;
-}): Promise<SignResult<{
+export declare function signAcceptance(claims: Record<string, unknown>, keyHandle: unknown, chain: ChainView, opts?: SigningOptions): Promise<SignResult<{
     acceptance: string;
 }>>;
-export declare function signTermination(claims: Record<string, unknown>, keyHandle: unknown, view: {
-    revisionText: string;
-    descriptorCompacts: string[];
-    chain: ChainView;
-}, opts?: {
-    algorithm?: string;
-}): Promise<SignResult<{
+export declare function signTermination(claims: Record<string, unknown>, keyHandle: unknown, chain: ChainView, opts?: SigningOptions): Promise<SignResult<{
     termination: string;
 }>>;

package/dist/signer.js

@@ -1,180 +1,289 @@
 // CAP never authorizes.
-//
-// The holder-side companion signer for the Charter Agreement Protocol,
-// ported from the Elixir reference (charter_agreement_signer). The caller
-// owns key custody through a handle object with two callbacks:
-//
-//   keyIdentity(handle) -> { kid, publicKey }   // ONE atomic snapshot
-//   sign(message, handle) -> signature bytes    // the holder's job
-//
-// Framing, the producer claims gate, the honest-signer refusal guards
-// (R1–R3), and assembly are ALL the verifier package's producer surface —
-// exactly one implementation, exactly the reference signer's delegation.
-// This package adds the custody half: the atomic key snapshot, the sign
-// callback, the wrong-key guard against the snapshot's public key, and the
-// post-sign verification of the assembled artifact. It never verifies
-// third-party artifacts, never transports, never persists, and never sees
-// a private key.
-import { acceptanceSigningInput, algorithmRegistry, assembleCompact, descriptorSigningInput, receiptSigningInput, terminationSigningInput, verifyAcceptance, verifyChain, verifyDescriptor, verifyReceipt, verifySignature, verifyTermination, } from "@charter-agreement-protocol/verifier";
-function registryRow(algorithm) {
-    return algorithmRegistry().find((row) => row.name === algorithm) ?? null;
+// The holder supplies one key snapshot and signs the verifier's prepared
+// message. The verifier owns framing, claims, context, limits, profile,
+// key matching, assembly, and completion. This package keeps custody and
+// the wrong-key guard.
+import { DEFAULT_LIMITS, algorithmRegistry, MAXIMUM_LIMITS, defaultEmissionName, decodeCharterRevision, emissions, finishSigning, prepareSigning, verifySignature, } from "@charter-agreement-protocol/verifier";
+const COPY_LIMIT = Symbol("copy limit");
+// Read one child at a time without recursion or array constructor hooks.
+// Only ancestors are retained, so repeated objects get separate copies.
+function copyClaims(value) {
+    const limits = MAXIMUM_LIMITS;
+    const ancestors = new WeakSet();
+    const frames = [];
+    let bytes = 0;
+    const addBytes = (size) => {
+        bytes += size;
+        if (bytes > limits.max_bytes)
+            throw COPY_LIMIT;
+    };
+    const stringBytes = (text) => {
+        if (Buffer.byteLength(text) > limits.max_string_bytes)
+            throw COPY_LIMIT;
+        return Buffer.byteLength(JSON.stringify(text));
+    };
+    const copy = (item, depth) => {
+        if (item === null || typeof item === "boolean") {
+            addBytes(item === null || item === true ? 4 : 5);
+            return item;
+        }
+        if (typeof item === "string") {
+            addBytes(stringBytes(item));
+            return item;
+        }
+        if (typeof item === "number" && Number.isFinite(item)) {
+            addBytes(JSON.stringify(item).length);
+            return item;
+        }
+        if (typeof item !== "object" || ancestors.has(item))
+            throw new TypeError("invalid_type");
+        if (depth + 1 > limits.max_depth)
+            throw COPY_LIMIT;
+        const array = Array.isArray(item);
+        let keys = null;
+        if (!array) {
+            const prototype = Object.getPrototypeOf(item);
+            if ((prototype !== Object.prototype && prototype !== null) || Object.getOwnPropertySymbols(item).length > 0) {
+                throw new TypeError("invalid_type");
+            }
+            keys = Object.keys(item);
+        }
+        const size = array ? item.length : keys.length;
+        if (!Number.isSafeInteger(size) || size < 0 || array && size > 2 ** 32 - 1)
+            throw new TypeError("invalid_type");
+        if (size > (array ? limits.max_array_items : limits.max_object_members)) {
+            throw COPY_LIMIT;
+        }
+        addBytes(2 + Math.max(0, size - 1));
+        const target = array ? [] : Object.create(null);
+        ancestors.add(item);
+        frames.push({ source: item, target, keys, size, index: 0, depth: depth + 1 });
+        return target;
+    };
+    const result = copy(value, 0);
+    while (frames.length > 0) {
+        const frame = frames[frames.length - 1];
+        if (frame.index === frame.size) {
+            ancestors.delete(frame.source);
+            frames.pop();
+            continue;
+        }
+        const index = frame.index++;
+        const key = frame.keys ? frame.keys[index] : String(index);
+        if (frame.keys)
+            addBytes(stringBytes(key) + 1);
+        const child = frame.source[key];
+        const copied = copy(child, frame.depth);
+        if (Array.isArray(frame.target))
+            frame.target.push(copied);
+        else
+            frame.target[key] = copied;
+    }
+    return result;
+}
+function copyChainView(chain) {
+    const names = ["revisions", "acceptances", "descriptors", "terminations"];
+    const lists = Object.fromEntries(names.map((name) => [name, (value) => copyTextList(value, MAXIMUM_LIMITS.max_artifact_set_items + 1)]));
+    return optionMembers(chain, names, lists);
 }
 async function resolveKeyIdentity(handle) {
-    if (handle === null || typeof handle !== "object" || !("keyIdentity" in handle)) {
-        return { error: "invalid_handle" };
-    }
     try {
+        if (handle === null || typeof handle !== "object")
+            return { error: "invalid_key_handle" };
         const snapshot = await handle.keyIdentity(handle);
-        if (snapshot &&
-            typeof snapshot.kid === "string" &&
-            snapshot.kid.length > 0 &&
-            typeof snapshot.publicKey === "string" &&
-            Buffer.from(snapshot.publicKey, "base64url").length > 0) {
-            return snapshot;
+        if (!snapshot || typeof snapshot !== "object" || Array.isArray(snapshot))
+            return { error: "invalid_key_handle" };
+        const { kid, publicKey } = snapshot;
+        if (typeof kid !== "string" || kid.length === 0 || typeof publicKey !== "string") {
+            return { error: "invalid_key_handle" };
         }
-        return { error: "invalid_handle" };
+        return { kid, publicKey };
     }
     catch (_fault) {
-        return { error: "invalid_handle" };
+        return { error: "invalid_key_handle" };
+    }
+}
+const OPTION_KEYS = new Set(["algorithm", "limits", "profile"]);
+const byteArrayTag = Object.getOwnPropertyDescriptor(Object.getPrototypeOf(Uint8Array.prototype), Symbol.toStringTag).get;
+// Read the defined shape once, including inherited and nonenumerable members.
+// Invalid member values stay opaque for the verifier to check synchronously.
+function optionMembers(value, names, nested = {}) {
+    if (value === null || typeof value !== "object" || Array.isArray(value) || value instanceof Number)
+        return value;
+    const source = value;
+    const result = Object.create(null);
+    const unknown = Object.keys(source).find((name) => !names.includes(name));
+    if (unknown !== undefined)
+        result[unknown] = null;
+    for (const name of names) {
+        const member = source[name];
+        if (member !== undefined || name in source)
+            result[name] = nested[name] ? nested[name](member) : member;
+    }
+    return result;
+}
+function optionAlgorithms(value) {
+    if (!Array.isArray(value))
+        return value;
+    const length = value.length;
+    if (!Number.isSafeInteger(length) || length < 0)
+        throw new TypeError("invalid_type");
+    // A unique registry subset cannot be longer than the registry. Retain an
+    // invalid length for the verifier without reading an unbounded caller list.
+    if (length > MAXIMUM_LIMITS.max_artifact_set_items)
+        return Array(MAXIMUM_LIMITS.max_artifact_set_items + 1);
+    if (length > algorithmRegistry().length)
+        return value;
+    const result = [];
+    for (let i = 0; i < length; i += 1)
+        result.push(value[i]);
+    return result;
+}
+function copyTextList(value, maximum = 2 ** 32 - 1) {
+    if (!Array.isArray(value))
+        return value;
+    const length = value.length;
+    // A plain array cannot represent a length above 2^32 - 1.
+    if (!Number.isSafeInteger(length) || length < 0 || length > 2 ** 32 - 1)
+        throw new TypeError("invalid_type");
+    const result = [];
+    for (let i = 0; i < Math.min(length, maximum); i += 1)
+        result.push(value[i]);
+    return result;
+}
+function checkOptions(settings) {
+    // Empty text always gives invalid_syntax after successful option checks.
+    // Every earlier code comes from the verifier, including copy failures.
+    const checked = decodeCharterRevision("", settings);
+    return !checked.ok && checked.code !== "invalid_syntax" ? { error: "invalid_input", code: checked.code } : null;
+}
+function signingOptions(opts, descriptor) {
+    try {
+        if (opts === null || typeof opts !== "object" || Array.isArray(opts) || opts instanceof Number) {
+            return { error: "invalid_input", code: "invalid_type" };
+        }
+        if (!Reflect.ownKeys(opts).every((key) => typeof key === "string" &&
+            (OPTION_KEYS.has(key) || descriptor && key === "predecessor"))) {
+            return { error: "invalid_input", code: "invalid_type" };
+        }
+        const supplied = opts;
+        const settings = {
+            limits: optionMembers(supplied.limits, Object.keys(DEFAULT_LIMITS)),
+        };
+        const limitsError = checkOptions(settings);
+        if (limitsError)
+            return limitsError;
+        settings.profile = optionMembers(supplied.profile, ["algorithms", "revisions"], {
+            algorithms: optionAlgorithms,
+            revisions: (range) => optionMembers(range, ["min", "max"]),
+        });
+        const profileError = checkOptions(settings);
+        if (profileError)
+            return profileError;
+        const algorithm = supplied.algorithm ?? defaultEmissionName();
+        if (typeof algorithm !== "string" || !Object.hasOwn(emissions(), algorithm)) {
+            return { error: "invalid_input", code: "algorithm_unsupported" };
+        }
+        if (!descriptor)
+            return { ...settings, algorithm };
+        const previous = supplied.predecessor;
+        const predecessor = optionMembers(previous, ["digest", "descriptor_digest", "lineage"], {
+            lineage: (value) => copyTextList(value),
+        });
+        return { ...settings, algorithm, predecessor: predecessor };
+    }
+    catch (fault) {
+        return { error: "invalid_input", code: fault === COPY_LIMIT ? "limit_exceeded" : "invalid_type" };
     }
 }
-// The shared custody tail (the reference signer's): identity snapshot ->
-// producer (framing, claims schema, R1-R3 refusals - one implementation,
-// in the verifier package) -> sign via the handle -> wrong-key guard.
-// A refusal or producer rejection never touches the key.
-async function signProduced(keyHandle, produce, opts) {
+function prepareError(code) {
+    switch (code) {
+        case "signing_refused":
+        case "signing_key_mismatch":
+            return { error: "refused", code };
+        case "signing_key_invalid":
+            return { error: "invalid_key_handle" };
+        case "algorithm_unsupported_on_substrate":
+            return { error: "algorithm_unsupported_on_substrate" };
+        default:
+            return { error: "invalid_input", code };
+    }
+}
+async function signPrepared(kind, claims, keyHandle, context, opts) {
+    const options = signingOptions(opts, kind === "descriptor");
+    if ("error" in options)
+        return options;
+    let retained;
+    try {
+        retained = kind === "descriptor" ? options.predecessor ?? null :
+            typeof context === "string" ? context : copyChainView(context);
+    }
+    catch (fault) {
+        return { error: "invalid_input", code: fault === COPY_LIMIT ? "limit_exceeded" : "invalid_type" };
+    }
+    try {
+        // Caller limits belong to preparation. The entry guard only stops values
+        // beyond every JSON limit the verifier can accept.
+        claims = copyClaims(claims);
+    }
+    catch (fault) {
+        return { error: "invalid_input", code: fault === COPY_LIMIT ? "signing_input_invalid" : "invalid_type" };
+    }
     const snapshot = await resolveKeyIdentity(keyHandle);
     if ("error" in snapshot)
         return snapshot;
-    const produced = produce(snapshot.kid, opts?.algorithm);
-    if (!produced.ok) {
-        // signing_refused is the honest-signer refusal; every other producer
-        // code stays caller input.
-        return produced.code === "signing_refused"
-            ? { error: "refused", code: produced.code }
-            : { error: "invalid_input", code: produced.code };
-    }
-    // The holder signs the exact message; a fault or a wrong-length result is
-    // a signing failure, never a silent pass.
+    const prepared = prepareSigning(kind, snapshot.kid, claims, snapshot.publicKey, retained, {
+        algorithm: options.algorithm,
+        limits: options.limits,
+        profile: options.profile,
+    });
+    if (!prepared.ok)
+        return prepareError(prepared.code);
+    const input = prepared.plan.input;
     let signature;
     try {
-        signature = await keyHandle.sign(produced.input.message, keyHandle);
+        signature = await keyHandle.sign(Buffer.from(input.message), keyHandle);
     }
     catch (_fault) {
         return { error: "signing_failed" };
     }
-    if (!(signature instanceof Uint8Array) || signature.length === 0) {
+    if (!ArrayBuffer.isView(signature) || byteArrayTag.call(signature) !== "Uint8Array") {
         return { error: "signing_failed" };
     }
-    const row = registryRow(produced.input.alg);
-    if (!row || signature.length !== row.signatureBytes) {
+    let checkedSignature;
+    try {
+        checkedSignature = Buffer.from(signature);
+    }
+    catch (_signature) {
         return { error: "signing_failed" };
     }
-    // The wrong-key guard: the signature MUST verify against the snapshot's
-    // public key under the minted algorithm.
-    if (!verifySignature(produced.input.message, Buffer.from(signature), snapshot.publicKey, produced.input.alg)) {
+    // The verifier's signature guard owns signature length checks.
+    if (!verifySignature(prepared.plan.input.message, checkedSignature, snapshot.publicKey, input.alg, {
+        limits: options.limits,
+        profile: options.profile,
+    })) {
         return { error: "signing_failed" };
     }
-    return { input: produced.input, signature: Buffer.from(signature) };
-}
-// Assembly goes through the verifier's assembleCompact: registry-row
-// length, framing re-decode, size gate - never a local string join.
-function compactOrInvalid(signed) {
-    const assembled = assembleCompact(signed.input, signed.signature);
-    if (!assembled.ok)
-        return { error: "invalid_input", code: assembled.code };
-    return { compact: assembled.compact };
-}
-// The view's chain is THIS package's public contract (the producer surface
-// validates its depth); the shallow shape is policed here so the closed
-// error vocabulary holds regardless of which verifier revision resolves.
-// A verifier crash past this gate stays loud - never a misleading error.
-function chainViewOrInvalid(chain) {
-    if (!chain || typeof chain !== "object" || Array.isArray(chain)) {
-        return { error: "invalid_input", code: "signing_input_invalid" };
-    }
-    return chain;
-}
-// A missing view object is caller input like a missing chain: the closed
-// error, never a dereference throw.
-function viewChainOrInvalid(view) {
-    if (!view || typeof view !== "object")
-        return { error: "invalid_input", code: "signing_input_invalid" };
-    return chainViewOrInvalid(view.chain);
+    const finished = finishSigning(prepared.plan, checkedSignature);
+    // No real-crypto path reaches this mapping after preparation and the
+    // custody guard succeed; keep it for a verifier completion error.
+    if (!finished.ok)
+        return { error: "verification_failed" };
+    return { compact: finished.compact };
 }
-// ---------------------------------------------------------------------------
-// Public signing surface
-// ---------------------------------------------------------------------------
 export async function signDescriptor(claims, keyHandle, opts = {}) {
-    const signed = await signProduced(keyHandle, (kid, algorithm) => descriptorSigningInput(kid, claims, algorithm), opts);
-    if ("error" in signed)
-        return { ok: false, ...signed };
-    const assembled = compactOrInvalid(signed);
-    if ("error" in assembled)
-        return { ok: false, ...assembled };
-    const verified = verifyDescriptor(assembled.compact);
-    if (!verified.ok)
-        return { ok: false, error: "verification_failed" };
-    return { ok: true, result: { descriptor: assembled.compact } };
+    const signed = await signPrepared("descriptor", claims, keyHandle, null, opts);
+    return "error" in signed ? { ok: false, ...signed } : { ok: true, result: { descriptor: signed.compact } };
 }
-export async function signReceipt(claims, keyHandle, chain, opts = {}) {
-    // The issuing view is REQUIRED (the reference takes ChainFacts or a
-    // CharterRevision, never none) and its discipline runs after the build,
-    // before the key - the reference's context is a verified ChainFacts by
-    // construction, so a TS view that fails the chain discipline is caller
-    // input, never a burned key operation.
-    const signed = await signProduced(keyHandle, (kid, algorithm) => {
-        const built = receiptSigningInput(kid, claims, algorithm);
-        if (!built.ok)
-            return built;
-        const resolved = chainViewOrInvalid(chain);
-        if ("error" in resolved)
-            return { ok: false, code: resolved.code };
-        if (!verifyChain(resolved).ok)
-            return { ok: false, code: "chain_invalid" };
-        return built;
-    }, opts);
-    if ("error" in signed)
-        return { ok: false, ...signed };
-    const assembled = compactOrInvalid(signed);
-    if ("error" in assembled)
-        return { ok: false, ...assembled };
-    const verified = verifyReceipt(assembled.compact, chain);
-    if (!verified.ok)
-        return { ok: false, error: "verification_failed" };
-    return { ok: true, result: { receipt: assembled.compact } };
+export async function signReceipt(claims, keyHandle, context, opts = {}) {
+    const signed = await signPrepared("receipt", claims, keyHandle, context, opts);
+    return "error" in signed ? { ok: false, ...signed } : { ok: true, result: { receipt: signed.compact } };
 }
-export async function signAcceptance(claims, keyHandle, view, opts = {}) {
-    const viewChain = viewChainOrInvalid(view);
-    const signed = await signProduced(keyHandle, (kid, algorithm) => {
-        if ("error" in viewChain)
-            return { ok: false, code: viewChain.code };
-        return acceptanceSigningInput(kid, claims, viewChain, algorithm);
-    }, opts);
-    if ("error" in signed)
-        return { ok: false, ...signed };
-    const assembled = compactOrInvalid(signed);
-    if ("error" in assembled)
-        return { ok: false, ...assembled };
-    const verified = verifyAcceptance(assembled.compact, view.revisionText, view.descriptorCompacts);
-    if (!verified.ok)
-        return { ok: false, error: "verification_failed" };
-    return { ok: true, result: { acceptance: assembled.compact } };
+export async function signAcceptance(claims, keyHandle, chain, opts = {}) {
+    const signed = await signPrepared("acceptance", claims, keyHandle, chain, opts);
+    return "error" in signed ? { ok: false, ...signed } : { ok: true, result: { acceptance: signed.compact } };
 }
-export async function signTermination(claims, keyHandle, view, opts = {}) {
-    const viewChain = viewChainOrInvalid(view);
-    const signed = await signProduced(keyHandle, (kid, algorithm) => {
-        if ("error" in viewChain)
-            return { ok: false, code: viewChain.code };
-        return terminationSigningInput(kid, claims, viewChain, algorithm);
-    }, opts);
-    if ("error" in signed)
-        return { ok: false, ...signed };
-    const assembled = compactOrInvalid(signed);
-    if ("error" in assembled)
-        return { ok: false, ...assembled };
-    const verified = verifyTermination(assembled.compact, view.revisionText, view.descriptorCompacts);
-    if (!verified.ok)
-        return { ok: false, error: "verification_failed" };
-    return { ok: true, result: { termination: assembled.compact } };
+export async function signTermination(claims, keyHandle, chain, opts = {}) {
+    const signed = await signPrepared("termination", claims, keyHandle, chain, opts);
+    return "error" in signed ? { ok: false, ...signed } : { ok: true, result: { termination: signed.compact } };
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@charter-agreement-protocol/signer",
-  "version": "0.2.2",
-  "description": "Holder-side companion signer for the Charter Agreement Protocol (CAP) in TypeScript - key custody only: an atomic key snapshot, the sign callback, the wrong-key guard, and post-sign verification, with framing, the claims gate, the R1-R3 honest-signer refusals, and assembly all delegated to the @charter-agreement-protocol/verifier producer surface. CAP verifies; it never authorizes; this signer signs, it never verifies third-party artifacts or takes custody.",
+  "version": "0.3.0",
+  "description": "Holder-side companion signer for the Charter Agreement Protocol (CAP) in TypeScript - key custody only: an atomic key snapshot, the sign callback, the wrong-key guard, and post-sign verification, with framing, claims, context, key matching, limits, profile, and completion delegated to the @charter-agreement-protocol/verifier pre-sign API. CAP verifies; it never authorizes; this signer signs, it never verifies third-party artifacts or takes custody.",
   "license": "Apache-2.0",
   "type": "module",
   "main": "./dist/index.js",
@@ -15,24 +15,29 @@
   },
   "files": [
     "CHANGELOG.md",
+    "CODE_OF_CONDUCT.md",
+    "CONTRIBUTING.md",
     "dist",
     "LICENSE",
     "NOTICE",
-    "README.md"
+    "README.md",
+    "SECURITY.md"
   ],
   "engines": {
     "node": ">=24.8.0"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.build.json",
+    "build": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc -p tsconfig.build.json",
     "typecheck": "tsc --noEmit",
-    "test": "node --test --experimental-strip-types --no-warnings signer.test.ts",
+    "test": "node --test --experimental-strip-types --no-warnings signer.test.ts signer.browser.test.ts signer.cases.test.ts",
+    "test:cost": "node --test --experimental-strip-types --no-warnings signer.cost.test.ts",
+    "test:cases": "node --test --experimental-strip-types --no-warnings signer.cases.test.ts",
     "prepack": "npm run build",
     "typecheck:web": "tsc -p tsconfig.web.json",
     "build:site": "node web/build.mjs && esbuild web/main.ts --bundle --minify --format=iife --target=es2022 --outfile=site-dist/app.js --alias:node:crypto=./web/shim/node-crypto.ts --alias:node:fs=./web/shim/node-fs.ts --alias:node:path=./web/shim/node-path.ts --inject:./web/shim/buffer-global.ts"
   },
   "dependencies": {
-    "@charter-agreement-protocol/verifier": "^0.5.0"
+    "@charter-agreement-protocol/verifier": "^0.7.0"
   },
   "devDependencies": {
     "@noble/ed25519": "^3.2.0",