@did-btcr2/method 0.36.1 → 0.37.0

package/src/core/aggregation/service.ts

@@ -2,18 +2,24 @@ import { canonicalize } from '@did-btcr2/common';
 import type { SignedBTCR2Update } from '@did-btcr2/cryptosuite';
 import { BIP340Cryptosuite, SchnorrMultikey } from '@did-btcr2/cryptosuite';
 import type { CompressedSecp256k1PublicKey } from '@did-btcr2/keypair';
-import { bytesToHex } from '@noble/hashes/utils';
+import { schnorr } from '@noble/curves/secp256k1.js';
+import { bytesToHex, hexToBytes } from '@noble/hashes/utils';
 import type { Transaction } from '@scure/btc-signer';
 import { getBeaconStrategy } from './beacon-strategy.js';
 import { AggregationCohort } from './cohort.js';
 import { validateCohortConditions, type CohortConditions } from './conditions.js';
 import { AggregationServiceError } from './errors.js';
+import { buildFallbackSpend, fallbackSighash } from './fallback-spend.js';
+import type { FallbackSignature } from './fallback-spend.js';
+import { buildFallbackLeaf } from './recovery-policy.js';
 import type { BaseMessage } from './messages/base.js';
 import { AGGREGATION_WIRE_VERSION } from './messages/base.js';
 import {
   COHORT_OPT_IN,
+  FALLBACK_SIGNATURE,
   NONCE_CONTRIBUTION,
   SIGNATURE_AUTHORIZATION,
+  SUBMIT_NONINCLUDED,
   SUBMIT_UPDATE,
   VALIDATION_ACK,
 } from './messages/constants.js';
@@ -24,6 +30,7 @@ import {
   createCohortOptInAcceptMessage,
   createCohortReadyMessage,
   createDistributeAggregatedDataMessage,
+  createFallbackAuthorizationRequestMessage,
 } from './messages/factories.js';
 import type { ServiceCohortPhaseType } from './phases.js';
 import { ServiceCohortPhase } from './phases.js';
@@ -58,8 +65,19 @@ export interface ValidationProgress {
 /** Final aggregation result for a cohort. */
 export interface AggregationResult {
   cohortId: string;
+  /**
+   * The 64-byte aggregated MuSig2 signature for the optimistic key path. Empty
+   * for a `script-path` result: the k-of-n fallback embeds k separate signatures
+   * directly in the witness of {@link signedTx}, with no single aggregate sig.
+   */
   signature: Uint8Array;
   signedTx: Transaction;
+  /**
+   * Which Taproot spend path produced {@link signedTx}: `key-path` is the
+   * optimistic n-of-n MuSig2 spend, `script-path` is the k-of-n fallback (ADR
+   * 042). Absent is treated as `key-path` for backward compatibility.
+   */
+  path?: 'key-path' | 'script-path';
 }
 
 /** Transaction data needed to start a signing session. */
@@ -86,7 +104,7 @@ export interface Rejection {
   reason: string;
 }
 
-/** Per-cohort service state — internal. */
+/** Per-cohort service state - internal. */
 interface ServiceCohortState {
   phase: ServiceCohortPhaseType;
   cohort: AggregationCohort;
@@ -95,6 +113,12 @@ interface ServiceCohortState {
   acceptedParticipants: Set<string>;
   signingSession?: BeaconSigningSession;
   result?: AggregationResult;
+  /**
+   * Collected fallback (k-of-n script-path) signatures, keyed by signer DID.
+   * Populated only after {@link AggregationService.startFallbackSigning}. Each is
+   * a verified standalone BIP-340 signature over the fallback script-path sighash.
+   */
+  fallbackSignatures?: Map<string, FallbackSignature>;
   /** Rejections accumulated since last drain. Runner polls via drainRejections(). */
   rejections: Array<Rejection>;
 }
@@ -147,7 +171,7 @@ export class AggregationService {
 
   receive(message: BaseMessage): void {
     // Reject messages whose wire version doesn't match what this build speaks.
-    // Missing version → treat as legacy and drop: bumping the protocol must be
+    // Missing version, treat as legacy and drop: bumping the protocol must be
     // coordinated across all participants.
     const version = message.version;
     if(version === undefined || version !== AGGREGATION_WIRE_VERSION) {
@@ -171,6 +195,9 @@ export class AggregationService {
       case SUBMIT_UPDATE:
         this.#handleSubmitUpdate(message);
         break;
+      case SUBMIT_NONINCLUDED:
+        this.#handleSubmitNonInclusion(message);
+        break;
       case VALIDATION_ACK:
         this.#handleValidationAck(message);
         break;
@@ -180,8 +207,11 @@ export class AggregationService {
       case SIGNATURE_AUTHORIZATION:
         this.#handleSignatureAuthorization(message);
         break;
+      case FALLBACK_SIGNATURE:
+        this.#handleFallbackSignature(message);
+        break;
       default:
-        // Unknown message type — silently ignore
+        // Unknown message type - silently ignore
         break;
     }
   }
@@ -202,7 +232,7 @@ export class AggregationService {
 
   /**
    * Create a new cohort with the given config. Returns the cohort ID.
-   * Cohort starts in `Created` phase — call `advertise()` to broadcast.
+   * Cohort starts in `Created` phase - call `advertise()` to broadcast.
    */
   createCohort(config: CohortConfig): string {
     // Fail fast on invalid conditions rather than discovering them at finalize.
@@ -214,10 +244,14 @@ export class AggregationService {
       );
     }
     const cohort = new AggregationCohort({
-      serviceDid      : this.did,
-      minParticipants : config.minParticipants,
-      network         : config.network,
-      beaconType      : config.beaconType,
+      serviceDid        : this.did,
+      minParticipants   : config.minParticipants,
+      network           : config.network,
+      beaconType        : config.beaconType,
+      recoveryKey       : hexToBytes(config.recoveryKey),
+      recoverySequence  : config.recoverySequence,
+      fundingModel      : config.fundingModel,
+      fallbackThreshold : config.fallbackThreshold,
     });
     this.#cohortStates.set(cohort.id, {
       phase                : ServiceCohortPhase.Created,
@@ -289,7 +323,7 @@ export class AggregationService {
 
     // Reject re-opt-in from already-accepted participants. Without this guard a
     // participant could send a second opt-in with a different key, overwriting
-    // pendingOptIns[did] while cohortKeys still holds the original key — opening
+    // pendingOptIns[did] while cohortKeys still holds the original key - opening
     // a desync window where #verifySubmittedUpdate accepts updates signed with
     // a key that is NOT in the MuSig2 cohort.
     if(state.acceptedParticipants.has(participantDid)) return;
@@ -427,7 +461,7 @@ export class AggregationService {
 
     // Cap the canonicalized update size before doing any heavier verification
     // work. Without this guard, a participant could submit multi-MB payloads
-    // that the service would canonicalize, hash, and aggregate — cheap DoS.
+    // that the service would canonicalize, hash, and aggregate - cheap DoS.
     const canonicalSize = canonicalize(signedUpdate as unknown as Record<string, unknown>).length;
     if(canonicalSize > this.maxUpdateSizeBytes) {
       state.rejections.push({
@@ -451,12 +485,81 @@ export class AggregationService {
       return;
     }
 
+    // One response per round. A member that already declined cannot also submit,
+    // and a member that already submitted cannot resubmit (a silent overwrite
+    // would corrupt the aggregated data the member already validated against).
+    // Both are dropped as rejections, symmetric with #handleSubmitNonInclusion.
+    if(state.cohort.nonIncluded.has(message.from)) {
+      state.rejections.push({
+        from   : message.from,
+        code   : 'UPDATE_MALFORMED',
+        reason : 'Participant already declined this round; cannot also submit an update',
+      });
+      return;
+    }
+    if(state.cohort.pendingUpdates.has(message.from)) {
+      state.rejections.push({
+        from   : message.from,
+        code   : 'UPDATE_MALFORMED',
+        reason : 'Participant already submitted an update this round; cannot resubmit',
+      });
+      return;
+    }
+
     state.cohort.addUpdate(message.from, signedUpdate);
 
     if(state.phase === ServiceCohortPhase.CohortSet) {
       state.phase = ServiceCohortPhase.CollectingUpdates;
     }
-    if(state.cohort.hasAllUpdates()) {
+    if(state.cohort.hasAllResponses()) {
+      state.phase = ServiceCohortPhase.UpdatesCollected;
+    }
+  }
+
+  /**
+   * Handle an incoming SUBMIT_NONINCLUDED message: a member declares it has no
+   * update this round (cooperative non-inclusion). Membership is proven by the
+   * signed transport envelope, so the body carries only the cohortId. The member
+   * stays in the cohort and still signs; it is absent from the CAS map and
+   * carries a non-inclusion leaf in the SMT.
+   */
+  #handleSubmitNonInclusion(message: BaseMessage): void {
+    const cohortId = message.body?.cohortId;
+    if(!cohortId) return;
+    const state = this.#cohortStates.get(cohortId);
+    if(!state) return;
+    if(state.phase !== ServiceCohortPhase.CohortSet && state.phase !== ServiceCohortPhase.CollectingUpdates) return;
+
+    // Membership is proven by the signed envelope sender. A non-member decline is
+    // dropped as a rejection, never thrown: addNonInclusion would otherwise throw
+    // UNKNOWN_PARTICIPANT out of receive() and fail the whole cohort, a DoS any
+    // non-member could trigger. Mirrors the SUBMIT_UPDATE verification path.
+    if(!state.cohort.participants.includes(message.from)) {
+      state.rejections.push({
+        from   : message.from,
+        code   : 'UPDATE_MALFORMED',
+        reason : 'Sender is not a member of this cohort',
+      });
+      return;
+    }
+
+    // One response per round: already submitted or already declined. Surface the
+    // conflict as a rejection, symmetric with the double-submit guard above.
+    if(state.cohort.pendingUpdates.has(message.from) || state.cohort.nonIncluded.has(message.from)) {
+      state.rejections.push({
+        from   : message.from,
+        code   : 'UPDATE_MALFORMED',
+        reason : 'Participant already responded this round',
+      });
+      return;
+    }
+
+    state.cohort.addNonInclusion(message.from);
+
+    if(state.phase === ServiceCohortPhase.CohortSet) {
+      state.phase = ServiceCohortPhase.CollectingUpdates;
+    }
+    if(state.cohort.hasAllResponses()) {
       state.phase = ServiceCohortPhase.UpdatesCollected;
     }
   }
@@ -588,7 +691,7 @@ export class AggregationService {
 
   /**
    * Start a signing session by creating auth requests for all participants.
-   * The caller provides the transaction data — typically built via
+   * The caller provides the transaction data - typically built via
    * `buildBeaconTransaction()` against a Bitcoin connection.
    */
   startSigning(cohortId: string, txData: SigningTxData): BaseMessage[] {
@@ -703,7 +806,7 @@ export class AggregationService {
     state.signingSession.addPartialSignature(message.from, partialSignature);
 
     if(state.signingSession.partialSignatures.size === state.cohort.participants.length) {
-      // All partial sigs received — generate final signature
+      // All partial sigs received - generate final signature
       const signature = state.signingSession.generateFinalSignature();
 
       // Set Taproot key-path witness (finalScriptWitness injects the aggregated MuSig2 sig)
@@ -713,12 +816,155 @@ export class AggregationService {
         cohortId,
         signature,
         signedTx : state.signingSession.pendingTx,
+        path     : 'key-path',
       };
       state.phase = ServiceCohortPhase.Complete;
     }
   }
 
 
+  /**
+   * Abandon the optimistic n-of-n key path and ask members to authorize the
+   * k-of-n fallback (script-path) spend of the SAME beacon transaction (graceful
+   * liveness, ADR 042). Reuses the in-flight signing session's transaction and
+   * spent output, so the announcement and its outputs are unchanged: only the
+   * witness path differs. Returns one FALLBACK_AUTHORIZATION_REQUEST per
+   * participant.
+   *
+   * Callable once optimistic signing has started (the session and its tx exist)
+   * and before it completes. A cohort can take exactly one of the two paths: the
+   * caller (runner) must commit to fallback and stop driving the optimistic path.
+   */
+  startFallbackSigning(cohortId: string): BaseMessage[] {
+    const state = this.#cohortStates.get(cohortId);
+    if(!state) {
+      throw new AggregationServiceError(`Cohort ${cohortId} not found.`, 'COHORT_NOT_FOUND', { cohortId });
+    }
+    if(!state.signingSession) {
+      throw new AggregationServiceError(
+        `Cannot start fallback for cohort ${cohortId}: no signing session.`,
+        'NO_SIGNING_SESSION', { cohortId }
+      );
+    }
+    const signingPhases: ServiceCohortPhaseType[] = [
+      ServiceCohortPhase.SigningStarted,
+      ServiceCohortPhase.NoncesCollected,
+      ServiceCohortPhase.AwaitingPartialSigs,
+    ];
+    if(!signingPhases.includes(state.phase)) {
+      throw new AggregationServiceError(
+        `Cannot start fallback for cohort ${cohortId}: phase is ${state.phase}.`,
+        'INVALID_PHASE', { cohortId, phase: state.phase }
+      );
+    }
+
+    const session = state.signingSession;
+    const prevOutScript = session.prevOutScripts[0];
+    const prevOutValue = session.prevOutValues[0];
+    if(!prevOutScript || prevOutValue === undefined) {
+      throw new AggregationServiceError(
+        `Cannot start fallback for cohort ${cohortId}: signing session missing prevout data.`,
+        'MISSING_PREV_OUT', { cohortId }
+      );
+    }
+
+    const fallbackLeaf = buildFallbackLeaf({
+      cohortKeys        : state.cohort.cohortKeys,
+      fallbackThreshold : state.cohort.effectiveFallbackThreshold,
+    });
+
+    state.fallbackSignatures = new Map();
+    state.phase = ServiceCohortPhase.FallbackRequested;
+
+    const messages: BaseMessage[] = [];
+    for(const participantDid of state.cohort.participants) {
+      messages.push(createFallbackAuthorizationRequestMessage({
+        from                  : this.did,
+        to                    : participantDid,
+        cohortId,
+        sessionId             : session.id,
+        pendingTx             : session.pendingTx.hex,
+        prevOutScriptHex      : bytesToHex(prevOutScript),
+        prevOutValue          : prevOutValue.toString(),
+        fallbackLeafScriptHex : bytesToHex(fallbackLeaf),
+      }));
+    }
+    return messages;
+  }
+
+  /**
+   * Handle an incoming FALLBACK_SIGNATURE: a member's standalone BIP-340
+   * signature over the fallback script-path sighash. The signature is
+   * authenticated to the sender (its `signerPk` must be the sender's own cohort
+   * key and the signature must verify against the sighash) and collected. Once k
+   * valid signatures are in, the k-of-n fallback spend is assembled and the
+   * cohort completes via the script path.
+   */
+  #handleFallbackSignature(message: BaseMessage): void {
+    const cohortId = message.body?.cohortId;
+    if(!cohortId) return;
+    const state = this.#cohortStates.get(cohortId);
+    if(!state || !state.signingSession || !state.fallbackSignatures) return;
+    if(state.phase !== ServiceCohortPhase.FallbackRequested) return;
+
+    const sessionId = message.body?.sessionId;
+    if(sessionId !== state.signingSession.id) return;
+
+    const signerPk = message.body?.signerPk as Uint8Array | undefined;
+    const fallbackSignature = message.body?.fallbackSignature as Uint8Array | undefined;
+    if(!signerPk || !fallbackSignature) return;
+
+    const prevOutScript = state.signingSession.prevOutScripts[0];
+    const prevOutValue = state.signingSession.prevOutValues[0];
+    if(!prevOutScript || prevOutValue === undefined) return;
+
+    // Authenticate the signature to the sender: signerPk must be the sender's own
+    // cohort key (x-only). A non-member or a mismatched key is dropped as a
+    // rejection, never thrown, so one bad contribution cannot stall the fallback.
+    const memberKey = state.cohort.participantKeys.get(message.from);
+    if(!memberKey) {
+      state.rejections.push({ from: message.from, code: 'UPDATE_MALFORMED', reason: 'Fallback signature from a non-member' });
+      return;
+    }
+    const memberXOnly = memberKey.slice(1);
+    if(signerPk.length !== 32 || !memberXOnly.every((b, i) => b === signerPk[i])) {
+      state.rejections.push({ from: message.from, code: 'UPDATE_MALFORMED', reason: 'Fallback signerPk does not match the sender cohort key' });
+      return;
+    }
+
+    const fallbackLeaf = buildFallbackLeaf({
+      cohortKeys        : state.cohort.cohortKeys,
+      fallbackThreshold : state.cohort.effectiveFallbackThreshold,
+    });
+    const sighash = fallbackSighash(state.signingSession.pendingTx, 0, prevOutScript, prevOutValue, fallbackLeaf);
+    let valid = false;
+    try { valid = fallbackSignature.length === 64 && schnorr.verify(fallbackSignature, sighash, signerPk); } catch { valid = false; }
+    if(!valid) {
+      state.rejections.push({ from: message.from, code: 'UPDATE_VERIFICATION_FAILED', reason: 'Fallback signature failed verification' });
+      return;
+    }
+
+    state.fallbackSignatures.set(message.from, { pubKey: signerPk, signature: fallbackSignature });
+
+    if(state.fallbackSignatures.size >= state.cohort.effectiveFallbackThreshold) {
+      const signedTx = buildFallbackSpend({
+        pendingTx         : state.signingSession.pendingTx,
+        cohortKeys        : state.cohort.cohortKeys,
+        fallbackThreshold : state.cohort.effectiveFallbackThreshold,
+        recoveryKey       : state.cohort.recoveryKey!,
+        recoverySequence  : state.cohort.recoverySequence!,
+        fundingModel      : state.cohort.fundingModel,
+        network           : state.cohort.network,
+        prevOutScript,
+        prevOutValue,
+        signatures        : [ ...state.fallbackSignatures.values() ],
+      });
+      state.result = { cohortId, signature: new Uint8Array(), signedTx, path: 'script-path' };
+      state.phase = ServiceCohortPhase.Complete;
+    }
+  }
+
+
   getResult(cohortId: string): AggregationResult | undefined {
     return this.#cohortStates.get(cohortId)?.result;
   }

package/src/core/aggregation/signing-session.ts

@@ -44,13 +44,13 @@ export class BeaconSigningSession {
   /** Previous output values for Taproot sighash computation. */
   public prevOutValues: bigint[];
 
-  /** Map of participant publicKey-hex → public nonce contribution. */
+  /** Map of participant publicKey-hex to public nonce contribution. */
   public nonceContributions: Map<PublicKeyHex, Nonce> = new Map();
 
   /** Aggregated MuSig2 nonce (66 bytes). */
   public aggregatedNonce?: Uint8Array;
 
-  /** Map of participant DID → partial signature. */
+  /** Map of participant DID to partial signature. */
   public partialSignatures: Map<string, Uint8Array> = new Map();
 
   /** Final 64-byte Schnorr signature. */
@@ -251,7 +251,7 @@ export class BeaconSigningSession {
       throw new SigningSessionError('Aggregated nonce not available.', 'MISSING_AGGREGATED_NONCE');
     }
     if(!this.#secretNonce) {
-      throw new SigningSessionError('Secret nonce not available — generateNonceContribution() must be called first.', 'MISSING_SECRET_NONCE');
+      throw new SigningSessionError('Secret nonce not available - generateNonceContribution() must be called first.', 'MISSING_SECRET_NONCE');
     }
     const session = new musig2.Session(
       this.aggregatedNonce,

package/src/core/aggregation/transport/http/envelope.ts

@@ -39,7 +39,7 @@ export interface VerifyEnvelopeOptions {
 /**
  * Build a {@link SignedEnvelope} around `message`.
  *
- * Pure function — no I/O beyond `randomBytes` for nonce generation (which
+ * Pure function - no I/O beyond `randomBytes` for nonce generation (which
  * uses the platform's cryptographic RNG: `crypto.getRandomValues` in browsers,
  * `node:crypto` in Node). Deterministic when both `nonce` and `timestamp` are
  * supplied via {@link SignEnvelopeOptions}.
@@ -73,7 +73,7 @@ export function signEnvelope(
  * communication public key. Throws {@link HttpTransportError} on any failure;
  * returns normally on success.
  *
- * Does NOT check nonce uniqueness — replay protection is the caller's
+ * Does NOT check nonce uniqueness - replay protection is the caller's
  * responsibility (the server-side transport maintains an LRU cache).
  */
 export function verifyEnvelope(
@@ -161,7 +161,7 @@ function normalizeMessage(message: EnvelopeMessage): Record<string, unknown> {
  *
  * Without this, `JSON.stringify` serializes a `Uint8Array` as an index-keyed
  * object (`{"0":1,"1":2,...}`), which `canonicalize` then re-parses into a
- * plain object — the receiver cannot reconstruct the original bytes even
+ * plain object - the receiver cannot reconstruct the original bytes even
  * though the signature still verifies.
  */
 export function normalizeForWire(value: unknown): unknown {

package/src/core/aggregation/transport/http/inbox-buffer.ts

@@ -13,7 +13,7 @@ export interface StoredEvent {
  * When a subscriber (re)connects with a `Last-Event-ID` header, the server
  * uses {@link since} to replay everything that arrived while the subscriber
  * was disconnected. Events older than the replay window (evicted from the
- * ring) are unrecoverable — callers should choose `capacity` based on
+ * ring) are unrecoverable - callers should choose `capacity` based on
  * expected message rate × acceptable reconnect window.
  */
 export class InboxBuffer {

package/src/core/aggregation/transport/http/nonce-cache.ts

@@ -6,7 +6,7 @@ export interface NonceCacheConfig {
 /**
  * Bounded anti-replay cache for `(did, nonce)` pairs.
  *
- * Replay windowing is the caller's responsibility — this cache only detects
+ * Replay windowing is the caller's responsibility - this cache only detects
  * duplicates. Callers are expected to reject envelopes/headers whose timestamp
  * is outside the clock-skew window *before* consulting the cache, so entries
  * here are always within the protocol's acceptable window.

package/src/core/aggregation/transport/http/rate-limiter.ts

@@ -39,7 +39,7 @@ export interface RateLimiterConfig {
  * sender DID). Tokens refill linearly at `rps` up to `burst`. Each `consume`
  * call atomically debits one token or returns `false` to reject.
  *
- * The limiter is synchronous and deterministic given `nowMs` — tests can
+ * The limiter is synchronous and deterministic given `nowMs` - tests can
  * drive it with a fixed clock to exercise exact boundaries.
  */
 export class RateLimiter {

package/src/core/aggregation/transport/http/request-auth.ts

@@ -61,7 +61,7 @@ export function buildRequestAuth(
 
 /**
  * Parse a `BTCR2-Sig` auth header value into its structured fields. Does NOT
- * verify the signature — call {@link verifyRequestAuth} for that.
+ * verify the signature: call {@link verifyRequestAuth} for that.
  */
 export function parseRequestAuth(headerValue: string): ParsedRequestAuth {
   const prefix = `${REQUEST_AUTH_SCHEME} `;

package/src/core/aggregation/transport/http/server.ts

@@ -114,7 +114,7 @@ const DEFAULT_ADVERT_TTL_MS = 5 * 60 * 1000;
 const DEFAULT_HEARTBEAT_MS  = 20_000;
 
 /**
- * Server-side HTTP transport. Sans-I/O — the caller mounts
+ * Server-side HTTP transport. Sans-I/O - the caller mounts
  * {@link handleRequest} and {@link handleSse} under their HTTP framework of
  * choice; the transport owns only in-memory state (actors, inboxes, advert
  * cache, replay / rate-limit policies).

package/src/core/aggregation/transport/http/sse-stream.ts

@@ -1,7 +1,7 @@
 /**
  * Parsed Server-Sent Events record.
  *
- * Events without a `data` field are never yielded (per the SSE spec — only a
+ * Events without a `data` field are never yielded (per the SSE spec - only a
  * blank line that follows at least one `data:` line dispatches an event).
  */
 export interface SseEvent {
@@ -24,7 +24,7 @@ export interface SseEvent {
  * CR-only line terminators are not supported (every mainstream SSE
  * implementation emits LF or CRLF).
  *
- * Pure, runtime-agnostic — works anywhere `ReadableStream<Uint8Array>` and
+ * Pure, runtime-agnostic - works anywhere `ReadableStream<Uint8Array>` and
  * `TextDecoder` exist (browsers and Node 22+).
  *
  * The caller owns stream lifecycle: cancellation should be effected via an

package/src/core/aggregation/transport/http/sse-writer.ts

@@ -1,7 +1,7 @@
 /**
  * Format an SSE event frame. Pairs with {@link parseSseStream}.
  *
- * Multi-line `data` is split across multiple `data:` lines per the SSE spec —
+ * Multi-line `data` is split across multiple `data:` lines per the SSE spec -
  * each embedded `\n` becomes its own line, and the parser rejoins them.
  *
  * The returned string includes a trailing blank line (the dispatch marker).

package/src/core/aggregation/transport/in-memory.ts

@@ -13,7 +13,7 @@ interface ActorEntry {
 /**
  * In-process message bus connecting one or more {@link InMemoryTransport}
  * instances. Routes broadcasts to every registered actor and directed messages
- * to the actor that owns the recipient DID — with no relay, server, or network.
+ * to the actor that owns the recipient DID, with no relay, server, or network.
  *
  * Each delivery does a JSON round-trip (Uint8Array preserved as `__bytes` hex)
  * so handlers receive an isolated, serialization-faithful copy, exactly as a

package/src/core/aggregation/transport/nostr.ts

@@ -64,9 +64,9 @@ interface ActorEntry {
  * sending or receiving.
  *
  * Message routing:
- * - Keygen messages (COHORT_ADVERT, COHORT_OPT_IN, COHORT_OPT_IN_ACCEPT, COHORT_READY) → kind 1 (plaintext)
- * - Update messages (SUBMIT_UPDATE, DISTRIBUTE_AGGREGATED_DATA, VALIDATION_ACK) → kind 1059 (NIP-44 encrypted)
- * - Sign messages → kind 1059 (NIP-44 encrypted)
+ * - Keygen messages (COHORT_ADVERT, COHORT_OPT_IN, COHORT_OPT_IN_ACCEPT, COHORT_READY) to kind 1 (plaintext)
+ * - Update messages (SUBMIT_UPDATE, DISTRIBUTE_AGGREGATED_DATA, VALIDATION_ACK) to kind 1059 (NIP-44 encrypted)
+ * - Sign messages to kind 1059 (NIP-44 encrypted)
  *
  * @class NostrTransport
  * @implements {Transport}
@@ -354,13 +354,13 @@ export class NostrTransport implements Transport {
    * backfill historical events to late subscribers: republishing gives late
    * joiners a window to discover the message without requiring protocol
    * changes. Relay rate-limit / publish failures inside the interval are
-   * caught and logged rather than propagated — the caller should stop the
+   * caught and logged rather than propagated - the caller should stop the
    * repeater once the protocol condition is satisfied.
    */
   publishRepeating(message: BaseMessage, sender: Did, intervalMs: number, recipient?: Did): () => void {
     let stopped = false;
     // Fire the first publish eagerly; any error surfaces as a rejected
-    // promise that we swallow to avoid unhandled rejections — the caller can
+    // promise that we swallow to avoid unhandled rejections - the caller can
     // observe delivery via receive-side handlers.
     void this.sendMessage(message, sender, recipient).catch((err) => {
       this.#logger.debug('publishRepeating first send failed:', err);
@@ -418,7 +418,7 @@ export class NostrTransport implements Transport {
       // Relay self-echo: sendMessage() adds the sender's own pubkey to the
       // event's `p` tags (so recipients can reply). The directed subscription
       // filter `{'#p': [actor_pk]}` therefore matches every event this actor
-      // publishes. Skip — we don't need to process our own outgoing events,
+      // publishes. Skip - we don't need to process our own outgoing events,
       // and attempting to NIP-44-decrypt them fails with "invalid MAC" because
       // the content was encrypted for the recipient, not self.
       if(event.pubkey === bytesToHex(actor.keys.publicKey.x)) return;

package/src/core/aggregation/transport/transport.ts

@@ -14,7 +14,7 @@ export type TransportType = 'nostr' | 'didcomm' | 'http';
  * shared by all registered actors. Each actor registers its own DID and keys;
  * the transport resolves the correct identity when sending or receiving messages.
  *
- * The transport is a pure passthrough — it knows nothing about the aggregation
+ * The transport is a pure passthrough: it knows nothing about the aggregation
  * protocol. It only signs/encrypts outgoing messages with the sender's keys and
  * dispatches incoming messages to the correct actor's registered handler.
  *
@@ -23,7 +23,7 @@ export type TransportType = 'nostr' | 'didcomm' | 'http';
 export interface Transport {
   name: string;
 
-  /** Start the underlying transport (idempotent — only starts once). */
+  /** Start the underlying transport (idempotent, only starts once). */
   start(): void;
 
   /** Register an actor (service or participant) with this transport. */
@@ -61,14 +61,14 @@ export interface Transport {
    * message is satisfied).
    *
    * Useful for broadcasts on transports that don't reliably backfill
-   * historical events to late subscribers (many Nostr relays) — republishing
+   * historical events to late subscribers (many Nostr relays): republishing
    * gives late joiners a window in which to discover the message. The first
    * publish is synchronous-ish (fired before the method returns).
    *
    * Callers specify `recipient` only for directed messages; for broadcasts
    * it is omitted.
    *
-   * @returns A stop function. Idempotent — safe to call more than once.
+   * @returns A stop function. Idempotent, safe to call more than once.
    */
   publishRepeating(
     message: BaseMessage,