@kynesyslabs/demosdk 4.0.10 → 4.0.12

package/build/l2ps/binding/binding.js

@@ -0,0 +1,160 @@
+import { demosAddressFromClaim, isDemosClaim, normalizeDemosAddress, signWithPrimaryClaim, verifyPrimaryClaimSignature, } from "../../identity/cci/index.js";
+import { DemosTransactions } from "../../websdk/DemosTransactions.js";
+import { StorageProgram } from "../../storage/StorageProgram.js";
+import { bindingSigningBytes, signatureFromHex, signatureToHex, stripBindingSignature, } from "./canonical.js";
+/**
+ * Deterministic Storage Program name for `(channelId, subnetMemberId)`.
+ * Public so `resolveMember` can re-derive it; included verbatim in tests.
+ *
+ * Components are percent-encoded so the layout stays one-to-one. Without
+ * this guard, the pairs `("a:b", "c")` and `("a", "b:c")` would collide on
+ * the same SP name and `resolveMember` could be tricked into returning a
+ * binding from one channel/member context for a lookup of another.
+ */
+export function bindingProgramName(channelId, subnetMemberId) {
+    return `l2ps-binding:${encodeURIComponent(channelId)}:${encodeURIComponent(subnetMemberId)}`;
+}
+/**
+ * Brief calls subnetMemberId "the member's L2PS/RSA identity within the
+ * subnet". L2PS already publishes a stable fingerprint of the RSA key —
+ * we reuse that so the value is derivable on both sides without a separate
+ * registry.
+ */
+export async function subnetMemberIdFromL2PS(l2ps) {
+    return await l2ps.getKeyFingerprint();
+}
+/**
+ * Build and sign a binding. The signature is produced by the key
+ * controlling `claim`. Throws if `claim`'s scheme is not `demos:` or if
+ * the controlling address does not match the connected wallet — the
+ * invariant that ties channel signatures to on-chain identity.
+ */
+export async function createMembershipBinding(opts) {
+    const { channelId, subnetMemberId, claim, demos } = opts;
+    if (!channelId)
+        throw new Error("createMembershipBinding: channelId required");
+    if (!subnetMemberId)
+        throw new Error("createMembershipBinding: subnetMemberId required");
+    if (!isDemosClaim(claim))
+        throw new Error(`createMembershipBinding: claim must be a "demos:..." ClaimReference, got "${claim}"`);
+    const boundAt = opts.boundAt ?? Date.now();
+    if (!Number.isSafeInteger(boundAt) || boundAt < 0)
+        throw new Error("createMembershipBinding: boundAt must be a non-negative safe-integer unix-ms timestamp");
+    const unsigned = {
+        bindingVersion: "1",
+        channelId,
+        subnetMemberId,
+        cciPrimaryClaim: claim,
+        boundAt,
+    };
+    const payload = bindingSigningBytes(unsigned);
+    const sig = await signWithPrimaryClaim(claim, payload, demos);
+    return { ...unsigned, signature: signatureToHex(sig) };
+}
+/**
+ * Pure signature check — no chain access. Verifies the embedded signature
+ * against the Demos public key encoded in `cciPrimaryClaim`.
+ *
+ * Returns `false` (not throws) on any structural problem so callers can
+ * use it as a filter when iterating SP candidates in `resolveMember`.
+ */
+export function verifyMembershipBinding(binding) {
+    if (binding?.bindingVersion !== "1")
+        return false;
+    if (!binding.channelId || !binding.subnetMemberId)
+        return false;
+    if (!isDemosClaim(binding.cciPrimaryClaim))
+        return false;
+    if (!Number.isSafeInteger(binding.boundAt) ||
+        binding.boundAt < 0)
+        return false;
+    if (typeof binding.signature !== "string" || !binding.signature)
+        return false;
+    try {
+        const payload = bindingSigningBytes(stripBindingSignature(binding));
+        const sig = signatureFromHex(binding.signature);
+        return verifyPrimaryClaimSignature(binding.cciPrimaryClaim, payload, sig);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Anchor a signed binding to chain via SR-2 (Storage Program). The SP is
+ * deployed under `bindingProgramName(...)` so `resolveMember` can find it
+ * by name. The deployer (= connected Demos wallet) becomes the SP owner;
+ * that owner check is what makes the resolver safe against impostor SPs
+ * published under the same name.
+ *
+ * Returns once the broadcast succeeds. Callers that need on-chain finality
+ * should poll the returned tx hash before opening the channel.
+ */
+export async function anchorMembershipBinding(binding, demos) {
+    if (!verifyMembershipBinding(binding))
+        throw new Error("anchorMembershipBinding: refusing to anchor an unverifiable binding");
+    const claimAddress = demosAddressFromClaim(binding.cciPrimaryClaim);
+    const connected = normalizeDemosAddress(await demos.getEd25519Address());
+    if (claimAddress !== connected)
+        throw new Error(`anchorMembershipBinding: claim "${binding.cciPrimaryClaim}" does not match connected wallet ${connected}`);
+    const nonce = (await demos.getAddressNonce(connected)) + 1;
+    const payload = StorageProgram.createStorageProgram(connected, bindingProgramName(binding.channelId, binding.subnetMemberId), binding, "json", { mode: "public" }, { nonce });
+    const tx = DemosTransactions.empty();
+    tx.content.to = payload.storageAddress;
+    tx.content.nonce = nonce;
+    tx.content.amount = 0;
+    tx.content.type = "storageProgram";
+    tx.content.timestamp = Date.now();
+    tx.content.data = ["storageProgram", payload];
+    const signed = await demos.sign(tx);
+    const validity = await demos.confirm(signed);
+    await demos.broadcast(validity);
+    return { storageAddress: payload.storageAddress, txHash: signed.hash };
+}
+/**
+ * Find the bound `ClaimReference` for `(channelId, subnetMemberId)`.
+ *
+ * Two-stage check on every candidate Storage Program:
+ *   1. Embedded signature verifies under the embedded claim's key.
+ *   2. SP owner's Demos address matches that claim's address — so only
+ *      the actual key-holder could have deployed this SP under this name.
+ *
+ * Both checks must pass. Returns `null` when no candidate qualifies.
+ * Membership is fixed for channel lifetime (CH-1) so callers SHOULD cache
+ * the result for the session.
+ */
+export async function resolveMember(channelId, subnetMemberId, rpcUrl) {
+    const name = bindingProgramName(channelId, subnetMemberId);
+    const list = await StorageProgram.searchByName(rpcUrl, name, {
+        exactMatch: true,
+    });
+    for (const item of list) {
+        const sp = await StorageProgram.getByAddress(rpcUrl, item.storageAddress);
+        if (sp?.encoding !== "json" || !sp.data)
+            continue;
+        if (typeof sp.data !== "object")
+            continue;
+        const binding = sp.data;
+        if (binding.channelId !== channelId)
+            continue;
+        if (binding.subnetMemberId !== subnetMemberId)
+            continue;
+        if (!verifyMembershipBinding(binding))
+            continue;
+        // Both parses are inside the same try so a single adversarially-
+        // crafted candidate (malformed claim ref OR malformed sp.owner)
+        // gets skipped instead of aborting the whole resolution loop —
+        // otherwise a squatter publishing a poisoned binding under our
+        // deterministic name could deny-of-service every consumer.
+        try {
+            const claimAddress = demosAddressFromClaim(binding.cciPrimaryClaim);
+            if (normalizeDemosAddress(sp.owner) !== claimAddress)
+                continue;
+        }
+        catch {
+            continue;
+        }
+        return binding.cciPrimaryClaim;
+    }
+    return null;
+}
+//# sourceMappingURL=binding.js.map

package/build/l2ps/binding/binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding.js","sourceRoot":"","sources":["../../../../src/l2ps/binding/binding.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,qBAAqB,EACrB,YAAY,EACZ,qBAAqB,EACrB,oBAAoB,EACpB,2BAA2B,GAE9B,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAMzD,OAAO,EACH,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,qBAAqB,GACxB,MAAM,aAAa,CAAA;AAGpB;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAC9B,SAAiB,EACjB,cAAsB;IAEtB,OAAO,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,IAAI,kBAAkB,CACtE,cAAc,CACjB,EAAE,CAAA;AACP,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAAU;IACnD,OAAO,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAA;AACzC,CAAC;AAWD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CACzC,IAAiC;IAEjC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;IACxD,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAC9E,IAAI,CAAC,cAAc;QACf,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACvE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QACpB,MAAM,IAAI,KAAK,CACX,6EAA6E,KAAK,GAAG,CACxF,CAAA;IAEL,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,CAAA;IAC1C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;QAC7C,MAAM,IAAI,KAAK,CACX,wFAAwF,CAC3F,CAAA;IAEL,MAAM,QAAQ,GAAkC;QAC5C,cAAc,EAAE,GAAG;QACnB,SAAS;QACT,cAAc;QACd,eAAe,EAAE,KAAK;QACtB,OAAO;KACV,CAAA;IAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAA;IAC7C,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;IAE7D,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,CAAA;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACnC,OAA8B;IAE9B,IAAI,OAAO,EAAE,cAAc,KAAK,GAAG;QAAE,OAAO,KAAK,CAAA;IACjD,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,cAAc;QAAE,OAAO,KAAK,CAAA;IAC/D,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,eAAe,CAAC;QAAE,OAAO,KAAK,CAAA;IACxD,IACI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC;QACrC,OAAO,CAAC,OAAkB,GAAG,CAAC;QAE/B,OAAO,KAAK,CAAA;IAChB,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,SAAS;QAC3D,OAAO,KAAK,CAAA;IAEhB,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAA;QACnE,MAAM,GAAG,GAAG,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAC/C,OAAO,2BAA2B,CAC9B,OAAO,CAAC,eAAe,EACvB,OAAO,EACP,GAAG,CACN,CAAA;IACL,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAA;IAChB,CAAC;AACL,CAAC;AAOD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CACzC,OAA8B,EAC9B,KAAY;IAEZ,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC;QACjC,MAAM,IAAI,KAAK,CACX,qEAAqE,CACxE,CAAA;IAEL,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;IACnE,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAA;IACxE,IAAI,YAAY,KAAK,SAAS;QAC1B,MAAM,IAAI,KAAK,CACX,mCAAmC,OAAO,CAAC,eAAe,qCAAqC,SAAS,EAAE,CAC7G,CAAA;IAEL,MAAM,KAAK,GAAG,CAAC,MAAM,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAA;IAC1D,MAAM,OAAO,GAAG,cAAc,CAAC,oBAAoB,CAC/C,SAAS,EACT,kBAAkB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,cAAc,CAAC,EAC7D,OAA6C,EAC7C,MAAM,EACN,EAAE,IAAI,EAAE,QAAQ,EAAE,EAClB,EAAE,KAAK,EAAE,CACZ,CAAA;IAED,MAAM,EAAE,GAAG,iBAAiB,CAAC,KAAK,EAAiB,CAAA;IACnD,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,cAAc,CAAA;IACtC,EAAE,CAAC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAA;IACxB,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAA;IACrB,EAAE,CAAC,OAAO,CAAC,IAAI,GAAG,gBAAgB,CAAA;IAClC,EAAE,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACjC,EAAE,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAQ,CAAA;IAEpD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACnC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAC5C,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;IAE/B,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;AAC1E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAC/B,SAAiB,EACjB,cAAsB,EACtB,MAAc;IAEd,MAAM,IAAI,GAAG,kBAAkB,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1D,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE;QACzD,UAAU,EAAE,IAAI;KACnB,CAAC,CAAA;IAEF,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,CAAA;QACzE,IAAI,EAAE,EAAE,QAAQ,KAAK,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI;YAAE,SAAQ;QACjD,IAAI,OAAO,EAAE,CAAC,IAAI,KAAK,QAAQ;YAAE,SAAQ;QAEzC,MAAM,OAAO,GAAG,EAAE,CAAC,IAAwC,CAAA;QAC3D,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;YAAE,SAAQ;QAC7C,IAAI,OAAO,CAAC,cAAc,KAAK,cAAc;YAAE,SAAQ;QACvD,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC;YAAE,SAAQ;QAE/C,iEAAiE;QACjE,gEAAgE;QAChE,+DAA+D;QAC/D,+DAA+D;QAC/D,2DAA2D;QAC3D,IAAI,CAAC;YACD,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;YACnE,IAAI,qBAAqB,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,YAAY;gBAAE,SAAQ;QAClE,CAAC;QAAC,MAAM,CAAC;YACL,SAAQ;QACZ,CAAC;QAED,OAAO,OAAO,CAAC,eAAe,CAAA;IAClC,CAAC;IAED,OAAO,IAAI,CAAA;AACf,CAAC"}

package/build/l2ps/binding/canonical.d.ts

@@ -0,0 +1,19 @@
+import { signatureFromHex, signatureToHex } from "../utils/hex";
+import type { L2PSMembershipBinding, UnsignedL2PSMembershipBinding } from "./types";
+/**
+ * Domain prefix for binding signatures. The brief specifies prefixes for
+ * channelmsg and transcript but not for the binding itself; per §5 of the
+ * brief, all signatures in this family must be domain-separated, so we
+ * align with the established `dacs-*:v1:` pattern.
+ */
+export declare const BINDING_DOMAIN_PREFIX = "dacs-binding:v1:";
+/**
+ * Bytes that the binding signature covers:
+ *   `dacs-binding:v1:` || sha256(JCS(binding_without_signature))
+ *
+ * Domain separation prevents this signature from being lifted into a
+ * channelmsg or transcript context (or vice versa).
+ */
+export declare function bindingSigningBytes(unsigned: UnsignedL2PSMembershipBinding): Uint8Array;
+export declare function stripBindingSignature(b: L2PSMembershipBinding): UnsignedL2PSMembershipBinding;
+export { signatureFromHex, signatureToHex };

package/build/l2ps/binding/canonical.js

@@ -0,0 +1,30 @@
+import { sha256 } from "@noble/hashes/sha2";
+import { canonicalJSONStringify } from "../../websdk/utils/canonicalJson.js";
+import { bytesToHex, signatureFromHex, signatureToHex } from "../utils/hex.js";
+/**
+ * Domain prefix for binding signatures. The brief specifies prefixes for
+ * channelmsg and transcript but not for the binding itself; per §5 of the
+ * brief, all signatures in this family must be domain-separated, so we
+ * align with the established `dacs-*:v1:` pattern.
+ */
+export const BINDING_DOMAIN_PREFIX = "dacs-binding:v1:";
+/**
+ * Bytes that the binding signature covers:
+ *   `dacs-binding:v1:` || sha256(JCS(binding_without_signature))
+ *
+ * Domain separation prevents this signature from being lifted into a
+ * channelmsg or transcript context (or vice versa).
+ */
+export function bindingSigningBytes(unsigned) {
+    const canonical = canonicalJSONStringify(unsigned);
+    const digestHex = bytesToHex(sha256(new TextEncoder().encode(canonical)));
+    return new TextEncoder().encode(BINDING_DOMAIN_PREFIX + digestHex);
+}
+export function stripBindingSignature(b) {
+    const { signature: _signature, ...rest } = b;
+    return rest;
+}
+// Re-exported from the shared utility so existing imports of
+// `signatureFromHex` / `signatureToHex` from this module keep working.
+export { signatureFromHex, signatureToHex };
+//# sourceMappingURL=canonical.js.map

package/build/l2ps/binding/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../../../src/l2ps/binding/canonical.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AACrE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAM3E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAA;AAEvD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAC/B,QAAuC;IAEvC,MAAM,SAAS,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAA;IAClD,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IACzE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAAA;AACtE,CAAC;AAED,MAAM,UAAU,qBAAqB,CACjC,CAAwB;IAExB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAA;IAC5C,OAAO,IAAI,CAAA;AACf,CAAC;AAED,6DAA6D;AAC7D,uEAAuE;AACvE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAA"}

package/build/l2ps/binding/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * L2PS membership binding — DACS-3 §8.3.2 (SR-4 WI-1).
+ *
+ * Anchors `(channelId, subnetMemberId) -> CCI ClaimReference` proofs to
+ * chain via SR-2 Storage Programs so channel signatures can be verified
+ * against the same identity used in DACS-2.
+ */
+export { BINDING_DOMAIN_PREFIX, bindingSigningBytes, signatureFromHex, signatureToHex, stripBindingSignature, } from "./canonical";
+export type { L2PSMembershipBinding, UnsignedL2PSMembershipBinding, } from "./types";
+export { anchorMembershipBinding, bindingProgramName, createMembershipBinding, resolveMember, subnetMemberIdFromL2PS, verifyMembershipBinding, type AnchorMembershipBindingResult, type CreateMembershipBindingOpts, } from "./binding";

package/build/l2ps/binding/index.js

@@ -0,0 +1,10 @@
+/**
+ * L2PS membership binding — DACS-3 §8.3.2 (SR-4 WI-1).
+ *
+ * Anchors `(channelId, subnetMemberId) -> CCI ClaimReference` proofs to
+ * chain via SR-2 Storage Programs so channel signatures can be verified
+ * against the same identity used in DACS-2.
+ */
+export { BINDING_DOMAIN_PREFIX, bindingSigningBytes, signatureFromHex, signatureToHex, stripBindingSignature, } from "./canonical.js";
+export { anchorMembershipBinding, bindingProgramName, createMembershipBinding, resolveMember, subnetMemberIdFromL2PS, verifyMembershipBinding, } from "./binding.js";
+//# sourceMappingURL=index.js.map

package/build/l2ps/binding/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/l2ps/binding/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACH,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,qBAAqB,GACxB,MAAM,aAAa,CAAA;AAOpB,OAAO,EACH,uBAAuB,EACvB,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,sBAAsB,EACtB,uBAAuB,GAG1B,MAAM,WAAW,CAAA"}

package/build/l2ps/binding/types.d.ts

@@ -0,0 +1,20 @@
+import type { ClaimReference } from "../../identity/cci";
+/**
+ * DACS-3 §8.3.2 interim membership binding.
+ *
+ * Until L2PS is natively CCI-keyed, each subnet member publishes one of
+ * these so channel signatures can be tied back to the same identity used
+ * in DACS-2. The signature MUST be produced by the key controlling
+ * `cciPrimaryClaim` — on Demos, the Demos Ed25519 key (NOT the RSA subnet
+ * key the L2PS class is configured with).
+ */
+export interface L2PSMembershipBinding {
+    bindingVersion: "1";
+    channelId: string;
+    subnetMemberId: string;
+    cciPrimaryClaim: ClaimReference;
+    boundAt: number;
+    /** Hex (0x-prefixed) Ed25519 signature over `bindingSigningBytes`. */
+    signature: string;
+}
+export type UnsignedL2PSMembershipBinding = Omit<L2PSMembershipBinding, "signature">;

package/build/l2ps/binding/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/l2ps/binding/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/l2ps/binding/types.ts"],"names":[],"mappings":""}

package/build/l2ps/channel/canonical.d.ts

@@ -0,0 +1,24 @@
+import { signatureFromHex, signatureToHex } from "../utils/hex";
+import type { ChannelMessage, ChannelTranscript, UnsignedChannelMessage, UnsignedChannelTranscript } from "./types";
+/**
+ * Domain separation prefixes — verbatim from the brief (§2 WI-2, WI-3) and
+ * the spec references at §B.7. A signature lifted from one domain (e.g.
+ * channelmsg) fails verification in any other (e.g. transcript / binding).
+ */
+export declare const CHANNEL_MESSAGE_DOMAIN_PREFIX = "dacs-channelmsg:v1:";
+export declare const TRANSCRIPT_DOMAIN_PREFIX = "dacs-transcript:v1:";
+/**
+ * Hex digest of `JCS(envelope_without_signature)`. Exposed as a primitive
+ * so auditors can re-derive the hash independently from the wire envelope.
+ */
+export declare function envelopeHashHex(unsigned: UnsignedChannelMessage): string;
+/**
+ * Bytes the channel-message signature covers:
+ *   `dacs-channelmsg:v1:` || envelope_hash_hex
+ */
+export declare function channelMessageSigningBytes(unsigned: UnsignedChannelMessage): Uint8Array;
+export declare function stripChannelMessageSignature(msg: ChannelMessage): UnsignedChannelMessage;
+export declare function transcriptHashHex(unsigned: UnsignedChannelTranscript): string;
+export declare function transcriptSigningBytes(unsigned: UnsignedChannelTranscript): Uint8Array;
+export declare function stripTranscriptSignatures(t: ChannelTranscript): UnsignedChannelTranscript;
+export { signatureFromHex, signatureToHex };

package/build/l2ps/channel/canonical.js

@@ -0,0 +1,44 @@
+import { sha256 } from "@noble/hashes/sha2";
+import { canonicalJSONStringify } from "../../websdk/utils/canonicalJson.js";
+import { bytesToHex, signatureFromHex, signatureToHex } from "../utils/hex.js";
+/**
+ * Domain separation prefixes — verbatim from the brief (§2 WI-2, WI-3) and
+ * the spec references at §B.7. A signature lifted from one domain (e.g.
+ * channelmsg) fails verification in any other (e.g. transcript / binding).
+ */
+export const CHANNEL_MESSAGE_DOMAIN_PREFIX = "dacs-channelmsg:v1:";
+export const TRANSCRIPT_DOMAIN_PREFIX = "dacs-transcript:v1:";
+/**
+ * Hex digest of `JCS(envelope_without_signature)`. Exposed as a primitive
+ * so auditors can re-derive the hash independently from the wire envelope.
+ */
+export function envelopeHashHex(unsigned) {
+    const canonical = canonicalJSONStringify(unsigned);
+    return bytesToHex(sha256(new TextEncoder().encode(canonical)));
+}
+/**
+ * Bytes the channel-message signature covers:
+ *   `dacs-channelmsg:v1:` || envelope_hash_hex
+ */
+export function channelMessageSigningBytes(unsigned) {
+    return new TextEncoder().encode(CHANNEL_MESSAGE_DOMAIN_PREFIX + envelopeHashHex(unsigned));
+}
+export function stripChannelMessageSignature(msg) {
+    const { signature: _signature, ...rest } = msg;
+    return rest;
+}
+export function transcriptHashHex(unsigned) {
+    const canonical = canonicalJSONStringify(unsigned);
+    return bytesToHex(sha256(new TextEncoder().encode(canonical)));
+}
+export function transcriptSigningBytes(unsigned) {
+    return new TextEncoder().encode(TRANSCRIPT_DOMAIN_PREFIX + transcriptHashHex(unsigned));
+}
+export function stripTranscriptSignatures(t) {
+    const { signatures: _signatures, ...rest } = t;
+    return rest;
+}
+// Re-exported from the shared utility so existing imports of
+// `signatureFromHex` / `signatureToHex` from this module keep working.
+export { signatureFromHex, signatureToHex };
+//# sourceMappingURL=canonical.js.map

package/build/l2ps/channel/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../../../src/l2ps/channel/canonical.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AACrE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAQ3E;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,qBAAqB,CAAA;AAClE,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAA;AAE7D;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgC;IAC5D,MAAM,SAAS,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAA;IAClD,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACtC,QAAgC;IAEhC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAC3B,6BAA6B,GAAG,eAAe,CAAC,QAAQ,CAAC,CAC5D,CAAA;AACL,CAAC;AAED,MAAM,UAAU,4BAA4B,CACxC,GAAmB;IAEnB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAA;IAC9C,OAAO,IAAI,CAAA;AACf,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC7B,QAAmC;IAEnC,MAAM,SAAS,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAA;IAClD,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;AAClE,CAAC;AAED,MAAM,UAAU,sBAAsB,CAClC,QAAmC;IAEnC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAC3B,wBAAwB,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CACzD,CAAA;AACL,CAAC;AAED,MAAM,UAAU,yBAAyB,CACrC,CAAoB;IAEpB,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAA;IAC9C,OAAO,IAAI,CAAA;AACf,CAAC;AAED,6DAA6D;AAC7D,uEAAuE;AACvE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAA"}

package/build/l2ps/channel/channelIdRegistry.d.ts

@@ -0,0 +1,19 @@
+/**
+ * CH-6 per-session channelId uniqueness — pluggable persistence.
+ *
+ * The substrate (L2PS subnet UID) already produces a unique value per
+ * session in honest deployments, but the brief requires explicit rejection
+ * of any session reusing a prior `channelId`. SDK ships an in-memory
+ * default; production callers wire their own store (durable DB, chain
+ * lookup, app-side persistence).
+ */
+export interface ChannelIdRegistry {
+    /** Throws if `channelId` has been registered before. */
+    register(channelId: string): Promise<void>;
+    has(channelId: string): Promise<boolean>;
+}
+export declare class InMemoryChannelIdRegistry implements ChannelIdRegistry {
+    private readonly seen;
+    register(channelId: string): Promise<void>;
+    has(channelId: string): Promise<boolean>;
+}

package/build/l2ps/channel/channelIdRegistry.js

@@ -0,0 +1,16 @@
+export class InMemoryChannelIdRegistry {
+    constructor() {
+        this.seen = new Set();
+    }
+    async register(channelId) {
+        if (!channelId)
+            throw new Error("ChannelIdRegistry: channelId required");
+        if (this.seen.has(channelId))
+            throw new Error(`ChannelIdRegistry: channelId "${channelId}" already registered (CH-6 violation)`);
+        this.seen.add(channelId);
+    }
+    async has(channelId) {
+        return this.seen.has(channelId);
+    }
+}
+//# sourceMappingURL=channelIdRegistry.js.map

package/build/l2ps/channel/channelIdRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channelIdRegistry.js","sourceRoot":"","sources":["../../../../src/l2ps/channel/channelIdRegistry.ts"],"names":[],"mappings":"AAeA,MAAM,OAAO,yBAAyB;IAAtC;QACqB,SAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAc7C,CAAC;IAZG,KAAK,CAAC,QAAQ,CAAC,SAAiB;QAC5B,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QACxE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YACxB,MAAM,IAAI,KAAK,CACX,iCAAiC,SAAS,uCAAuC,CACpF,CAAA;QACL,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAC5B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAiB;QACvB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACnC,CAAC;CACJ"}

package/build/l2ps/channel/envelope.d.ts

@@ -0,0 +1,26 @@
+import { type ClaimReference } from "../../identity/cci";
+import { Demos } from "../../websdk/demosclass";
+import type { ChannelMessage, UnsignedChannelMessage } from "./types";
+/**
+ * Sign a `ChannelMessage` envelope with the sender's primary-claim key.
+ *
+ * The signature covers `dacs-channelmsg:v1:` || sha256(JCS(envelope w/o
+ * signature)). Transport-level wrappers MUST NOT alter the bytes returned
+ * here. Throws if `unsigned.sender` is not a demos: ClaimReference or
+ * does not match the connected wallet — preserves the
+ * in-channel-signer == on-chain-party invariant.
+ */
+export declare function signChannelMessage(unsigned: UnsignedChannelMessage, demos: Demos): Promise<ChannelMessage>;
+/**
+ * Pure signature check: verifies `msg.signature` covers JCS(msg without
+ * signature) with the `dacs-channelmsg:v1:` prefix under the key encoded
+ * in `msg.sender`. Membership (`sender ∈ members`) and sequence enforcement
+ * are handled by `ChannelSession` — this function does crypto only.
+ */
+export declare function verifyChannelMessage(msg: ChannelMessage): boolean;
+/**
+ * Pure membership check. Kept separate so `verifyChannelMessage` can be
+ * called in contexts where the member set hasn't been resolved yet (e.g.
+ * audit replay from a transcript).
+ */
+export declare function isSenderInMembers(msg: ChannelMessage, members: Iterable<ClaimReference>): boolean;

package/build/l2ps/channel/envelope.js

@@ -0,0 +1,62 @@
+import { isDemosClaim, signWithPrimaryClaim, verifyPrimaryClaimSignature, } from "../../identity/cci/index.js";
+import { channelMessageSigningBytes, signatureFromHex, signatureToHex, stripChannelMessageSignature, } from "./canonical.js";
+/**
+ * Sign a `ChannelMessage` envelope with the sender's primary-claim key.
+ *
+ * The signature covers `dacs-channelmsg:v1:` || sha256(JCS(envelope w/o
+ * signature)). Transport-level wrappers MUST NOT alter the bytes returned
+ * here. Throws if `unsigned.sender` is not a demos: ClaimReference or
+ * does not match the connected wallet — preserves the
+ * in-channel-signer == on-chain-party invariant.
+ */
+export async function signChannelMessage(unsigned, demos) {
+    if (!isDemosClaim(unsigned.sender))
+        throw new Error(`signChannelMessage: sender must be a demos: ClaimReference, got "${unsigned.sender}"`);
+    if (!Number.isInteger(unsigned.sequence) || unsigned.sequence < 1)
+        throw new Error(`signChannelMessage: sequence must be a positive integer (got ${unsigned.sequence})`);
+    if (!unsigned.channelId)
+        throw new Error("signChannelMessage: channelId required");
+    const payload = channelMessageSigningBytes(unsigned);
+    const sigBytes = await signWithPrimaryClaim(unsigned.sender, payload, demos);
+    const signature = {
+        sigVersion: "1",
+        signature: signatureToHex(sigBytes),
+    };
+    return { ...unsigned, signature };
+}
+/**
+ * Pure signature check: verifies `msg.signature` covers JCS(msg without
+ * signature) with the `dacs-channelmsg:v1:` prefix under the key encoded
+ * in `msg.sender`. Membership (`sender ∈ members`) and sequence enforcement
+ * are handled by `ChannelSession` — this function does crypto only.
+ */
+export function verifyChannelMessage(msg) {
+    if (msg?.signature?.sigVersion !== "1")
+        return false;
+    if (!isDemosClaim(msg.sender))
+        return false;
+    if (!Number.isInteger(msg.sequence) || msg.sequence < 1)
+        return false;
+    if (!msg.channelId)
+        return false;
+    try {
+        const payload = channelMessageSigningBytes(stripChannelMessageSignature(msg));
+        const sig = signatureFromHex(msg.signature.signature);
+        return verifyPrimaryClaimSignature(msg.sender, payload, sig);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Pure membership check. Kept separate so `verifyChannelMessage` can be
+ * called in contexts where the member set hasn't been resolved yet (e.g.
+ * audit replay from a transcript).
+ */
+export function isSenderInMembers(msg, members) {
+    for (const m of members)
+        if (m === msg.sender)
+            return true;
+    return false;
+}
+//# sourceMappingURL=envelope.js.map

package/build/l2ps/channel/envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../../../../src/l2ps/channel/envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,YAAY,EACZ,oBAAoB,EACpB,2BAA2B,GAE9B,MAAM,gBAAgB,CAAA;AAOvB,OAAO,EACH,0BAA0B,EAC1B,gBAAgB,EAChB,cAAc,EACd,4BAA4B,GAC/B,MAAM,aAAa,CAAA;AAEpB;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACpC,QAAgC,EAChC,KAAY;IAEZ,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9B,MAAM,IAAI,KAAK,CACX,oEAAoE,QAAQ,CAAC,MAAM,GAAG,CACzF,CAAA;IACL,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,GAAG,CAAC;QAC7D,MAAM,IAAI,KAAK,CACX,gEAAgE,QAAQ,CAAC,QAAQ,GAAG,CACvF,CAAA;IACL,IAAI,CAAC,QAAQ,CAAC,SAAS;QACnB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAE7D,MAAM,OAAO,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAA;IACpD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;IAC5E,MAAM,SAAS,GAA4B;QACvC,UAAU,EAAE,GAAG;QACf,SAAS,EAAE,cAAc,CAAC,QAAQ,CAAC;KACtC,CAAA;IACD,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,CAAA;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAmB;IACpD,IAAI,GAAG,EAAE,SAAS,EAAE,UAAU,KAAK,GAAG;QAAE,OAAO,KAAK,CAAA;IACpD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IAC3C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACrE,IAAI,CAAC,GAAG,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IAEhC,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,0BAA0B,CACtC,4BAA4B,CAAC,GAAG,CAAC,CACpC,CAAA;QACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QACrD,OAAO,2BAA2B,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;IAChE,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAA;IAChB,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC7B,GAAmB,EACnB,OAAiC;IAEjC,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,IAAI,CAAC,KAAK,GAAG,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;IAC1D,OAAO,KAAK,CAAA;AAChB,CAAC"}

package/build/l2ps/channel/finalize.d.ts

@@ -0,0 +1,63 @@
+/**
+ * SR-4 WI-C — finalise a negotiate-rfq session: on agreement, export the
+ * signed channel transcript and (per disclosure policy, DACS-3 §8.7)
+ * anchor an encrypted copy, returning the `channelTranscriptRef` that the
+ * negotiate-rfq output carries.
+ *
+ * This is the orchestration that ties WI-B's terminal state to WI-3's
+ * transcript anchor: `exportTranscript` (sign the ordered messages) →
+ * `anchorEncryptedTranscript` (encrypt-to-members + SR-2 anchor). Policy
+ * semantics (§8.7):
+ *   - `none` — transcript stays local; nothing anchored.
+ *   - `encrypted-anchored-recommended` — anchor only on explicit consent.
+ *   - `encrypted-anchored-required` — MUST anchor; a null result fails
+ *     the phase.
+ *
+ * The anchor call is injectable so the orchestration is unit-tested
+ * without a live node (the real anchor deploys an SR-2 storage program).
+ */
+import type { Demos } from "../../websdk";
+import type { ClaimReference } from "../../identity/cci";
+import type L2PS from "../l2ps";
+import type { AnchorEncryptedTranscriptOpts, AttestationRef, TranscriptDisclosurePolicy } from "../anchor";
+import type { ChannelMessage, ChannelTranscript } from "./types";
+import type { RfqOutcome, RfqState } from "./negotiate";
+/** Minimal RfqSession surface — structural for testability. */
+export interface RfqLike {
+    readonly state: RfqState;
+    outcome(): RfqOutcome;
+}
+/** Minimal ChannelSession surface — structural for testability. */
+export interface ChannelSessionView {
+    readonly channelId: string;
+    readonly members: ReadonlyArray<ClaimReference>;
+    messages(): ReadonlyArray<ChannelMessage>;
+}
+export interface FinalizeRfqOpts {
+    rfq: RfqLike;
+    session: ChannelSessionView;
+    /** This party's CCI claim (signs the transcript); must be a member. */
+    signer: ClaimReference;
+    demos: Demos;
+    /** Required when the policy actually anchors (not for `none`). */
+    l2ps?: L2PS;
+    policy: TranscriptDisclosurePolicy;
+    /** Needed to anchor under `encrypted-anchored-recommended`. */
+    consent?: boolean;
+    /**
+     * Injectable anchor implementation; defaults to the real
+     * `anchorEncryptedTranscript`. Tests pass a fake to avoid deploying
+     * a storage program.
+     */
+    anchor?: (opts: AnchorEncryptedTranscriptOpts) => Promise<AttestationRef | null>;
+}
+export interface RfqFinalizeResult {
+    /** The signed, ordered transcript (always produced). */
+    transcript: ChannelTranscript;
+    /**
+     * The anchored attestation reference, or null when the policy did not
+     * anchor (`none`, or `recommended` without consent).
+     */
+    channelTranscriptRef: AttestationRef | null;
+}
+export declare function finalizeRfq(opts: FinalizeRfqOpts): Promise<RfqFinalizeResult>;

package/build/l2ps/channel/finalize.js

@@ -0,0 +1,85 @@
+/**
+ * SR-4 WI-C — finalise a negotiate-rfq session: on agreement, export the
+ * signed channel transcript and (per disclosure policy, DACS-3 §8.7)
+ * anchor an encrypted copy, returning the `channelTranscriptRef` that the
+ * negotiate-rfq output carries.
+ *
+ * This is the orchestration that ties WI-B's terminal state to WI-3's
+ * transcript anchor: `exportTranscript` (sign the ordered messages) →
+ * `anchorEncryptedTranscript` (encrypt-to-members + SR-2 anchor). Policy
+ * semantics (§8.7):
+ *   - `none` — transcript stays local; nothing anchored.
+ *   - `encrypted-anchored-recommended` — anchor only on explicit consent.
+ *   - `encrypted-anchored-required` — MUST anchor; a null result fails
+ *     the phase.
+ *
+ * The anchor call is injectable so the orchestration is unit-tested
+ * without a live node (the real anchor deploys an SR-2 storage program).
+ */
+import { anchorEncryptedTranscript } from "../anchor/index.js";
+import { exportTranscript } from "./transcript.js";
+export async function finalizeRfq(opts) {
+    if (opts.rfq.state !== "accepted") {
+        throw new Error(`finalizeRfq: negotiation is "${opts.rfq.state}", not "accepted" — ` +
+            "only an agreed RFQ produces a transcript anchor");
+    }
+    // The signer must be a channel member — `exportTranscript` will sign
+    // with any demos claim, so a non-member signer produces a transcript
+    // that later fails `verifyTranscript` (signer ∉ members). Catch it
+    // here rather than emitting a transcript that cannot be verified.
+    if (!opts.session.members.includes(opts.signer)) {
+        throw new Error(`finalizeRfq: signer "${opts.signer}" is not a channel member — ` +
+            "the transcript signature would fail verification");
+    }
+    // The transcript must actually contain the agreed exchange: the
+    // accepted proposal and the matching accept that `rfq.outcome()`
+    // points at. A stale or mismatched session would otherwise let us
+    // export/anchor a transcript that does not back the agreement.
+    const outcome = opts.rfq.outcome();
+    const acceptedSequence = outcome.acceptedSequence;
+    if (acceptedSequence === undefined) {
+        throw new Error("finalizeRfq: accepted outcome has no acceptedSequence — cannot match transcript");
+    }
+    const messages = opts.session.messages();
+    const hasAcceptedProposal = messages.some(m => m.sequence === acceptedSequence);
+    const hasAccept = messages.some(m => m.type === "accept" &&
+        m.body
+            ?.acceptedSequence === acceptedSequence);
+    if (!hasAcceptedProposal || !hasAccept) {
+        throw new Error(`finalizeRfq: session transcript does not contain the accepted proposal ` +
+            `(seq ${acceptedSequence}) and its matching accept — session mismatch`);
+    }
+    const transcript = await exportTranscript({
+        channelId: opts.session.channelId,
+        members: [...opts.session.members],
+        messages,
+        signers: [{ claim: opts.signer, demos: opts.demos }],
+    });
+    // §8.7 `none`: transcript stays local; nothing anchored.
+    // §8.7 `recommended` WITHOUT consent: also a no-anchor outcome — it
+    // must NOT require an L2PS instance just to take its null-ref branch.
+    const willAnchor = opts.policy === "encrypted-anchored-required" ||
+        (opts.policy === "encrypted-anchored-recommended" && !!opts.consent);
+    if (!willAnchor) {
+        return { transcript, channelTranscriptRef: null };
+    }
+    if (!opts.l2ps) {
+        throw new Error(`finalizeRfq: policy "${opts.policy}" requires an L2PS instance to encrypt the transcript`);
+    }
+    const anchorFn = opts.anchor ?? anchorEncryptedTranscript;
+    const ref = await anchorFn({
+        transcript,
+        l2ps: opts.l2ps,
+        demos: opts.demos,
+        signer: opts.signer,
+        policy: opts.policy,
+        consent: opts.consent,
+    });
+    // §8.7: under `required`, the absence of an anchor fails the phase.
+    if (opts.policy === "encrypted-anchored-required" && !ref) {
+        throw new Error("finalizeRfq: policy is 'encrypted-anchored-required' but anchoring " +
+            "produced no attestation — phase fails");
+    }
+    return { transcript, channelTranscriptRef: ref };
+}
+//# sourceMappingURL=finalize.js.map