@kynesyslabs/demosdk 4.0.10 → 4.0.12

package/build/l2ps/channel/transcript.js

@@ -0,0 +1,120 @@
+import { isDemosClaim, signWithPrimaryClaim, verifyPrimaryClaimSignature, } from "../../identity/cci/index.js";
+import { signatureFromHex, signatureToHex, stripTranscriptSignatures, transcriptSigningBytes, } from "./canonical.js";
+import { isSenderInMembers, verifyChannelMessage } from "./envelope.js";
+/**
+ * Build the unsigned transcript shell. Messages must already be in
+ * sequence order — typically `session.messages()`.
+ */
+export function buildUnsignedTranscript(opts) {
+    return {
+        transcriptVersion: "1",
+        channelId: opts.channelId,
+        members: [...opts.members],
+        messages: [...opts.messages],
+        generatedAt: opts.generatedAt ?? Date.now(),
+    };
+}
+/**
+ * Produce one party's `TranscriptSignature` over the unsigned transcript.
+ * Domain-separated under `dacs-transcript:v1:` — cannot be confused with
+ * a channel-message or binding signature.
+ */
+export async function signTranscript(unsigned, signer, demos) {
+    if (!isDemosClaim(signer))
+        throw new Error(`signTranscript: signer must be a demos: ClaimReference, got "${signer}"`);
+    const payload = transcriptSigningBytes(unsigned);
+    const sigBytes = await signWithPrimaryClaim(signer, payload, demos);
+    return {
+        sigVersion: "1",
+        signer,
+        signature: signatureToHex(sigBytes),
+    };
+}
+/**
+ * Convenience: assemble the full transcript with one or more party
+ * signatures. Pass signers in the order their signatures should appear.
+ */
+export async function exportTranscript(opts) {
+    const unsigned = buildUnsignedTranscript(opts);
+    const signatures = [];
+    for (const s of opts.signers) {
+        signatures.push(await signTranscript(unsigned, s.claim, s.demos));
+    }
+    return { ...unsigned, signatures };
+}
+/**
+ * Verify every claim about a transcript a non-member can check given only
+ * the public keys: (a) each `TranscriptSignature` is valid, (b) each
+ * `ChannelMessage` carries a valid signature, (c) every message's sender
+ * is in `members`, (d) sequences are strictly monotonic per channel,
+ * (e) every message's `channelId` matches the transcript.
+ *
+ * Returns a list of errors rather than throwing so auditors can collect
+ * every failure in one pass.
+ */
+export function verifyTranscript(t) {
+    const errors = [];
+    if (t?.transcriptVersion !== "1") {
+        errors.push("transcriptVersion is not 1");
+        return { ok: false, errors };
+    }
+    if (!t.channelId)
+        errors.push("missing channelId");
+    if (!t.members?.length)
+        errors.push("missing members");
+    let unsigned;
+    try {
+        unsigned = stripTranscriptSignatures(t);
+    }
+    catch {
+        errors.push("could not strip signatures");
+        return { ok: false, errors };
+    }
+    if (!t.signatures?.length) {
+        errors.push("no transcript signatures");
+    }
+    else {
+        const payload = transcriptSigningBytes(unsigned);
+        for (const s of t.signatures) {
+            if (s.sigVersion !== "1") {
+                errors.push(`transcript signature: unknown sigVersion ${s.sigVersion}`);
+                continue;
+            }
+            if (!t.members.includes(s.signer)) {
+                errors.push(`transcript signature signer "${s.signer}" not in members`);
+                continue;
+            }
+            try {
+                const ok = verifyPrimaryClaimSignature(s.signer, payload, signatureFromHex(s.signature));
+                if (!ok)
+                    errors.push(`transcript signature by "${s.signer}" failed verification`);
+            }
+            catch (e) {
+                errors.push(`transcript signature by "${s.signer}" malformed: ${e.message}`);
+            }
+        }
+    }
+    let highestSeen = 0;
+    for (const msg of t.messages ?? []) {
+        if (msg.channelId !== t.channelId) {
+            errors.push(`message seq=${msg.sequence}: channelId mismatch (${msg.channelId} vs ${t.channelId})`);
+        }
+        if (!isSenderInMembers(msg, t.members)) {
+            errors.push(`message seq=${msg.sequence}: sender "${msg.sender}" not in members`);
+        }
+        if (!Number.isInteger(msg.sequence) || msg.sequence < 1) {
+            errors.push(`message: invalid sequence ${msg.sequence}`);
+        }
+        else if (msg.sequence <= highestSeen) {
+            errors.push(`message seq=${msg.sequence}: non-monotonic (highest seen ${highestSeen})`);
+        }
+        else {
+            highestSeen = msg.sequence;
+        }
+        if (!verifyChannelMessage(msg)) {
+            errors.push(`message seq=${msg.sequence}: signature verification failed`);
+        }
+    }
+    return { ok: errors.length === 0, errors };
+}
+//# sourceMappingURL=transcript.js.map

package/build/l2ps/channel/transcript.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transcript.js","sourceRoot":"","sources":["../../../../src/l2ps/channel/transcript.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,YAAY,EACZ,oBAAoB,EACpB,2BAA2B,GAE9B,MAAM,gBAAgB,CAAA;AAQvB,OAAO,EACH,gBAAgB,EAChB,cAAc,EACd,yBAAyB,EACzB,sBAAsB,GACzB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEpE;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAKvC;IACG,OAAO;QACH,iBAAiB,EAAE,GAAG;QACtB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;QAC1B,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC5B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE;KAC9C,CAAA;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAChC,QAAmC,EACnC,MAAsB,EACtB,KAAY;IAEZ,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;QACrB,MAAM,IAAI,KAAK,CACX,gEAAgE,MAAM,GAAG,CAC5E,CAAA;IACL,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAA;IAChD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;IACnE,OAAO;QACH,UAAU,EAAE,GAAG;QACf,MAAM;QACN,SAAS,EAAE,cAAc,CAAC,QAAQ,CAAC;KACtC,CAAA;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAMtC;IACG,MAAM,QAAQ,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAA;IAC9C,MAAM,UAAU,GAA0B,EAAE,CAAA;IAC5C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,UAAU,CAAC,IAAI,CAAC,MAAM,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;IACrE,CAAC;IACD,OAAO,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,CAAA;AACtC,CAAC;AAOD;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC5B,CAAoB;IAEpB,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,CAAC,EAAE,iBAAiB,KAAK,GAAG,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAA;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;IAChC,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IAClD,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAEtD,IAAI,QAAmC,CAAA;IACvC,IAAI,CAAC;QACD,QAAQ,GAAG,yBAAyB,CAAC,CAAC,CAAC,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACL,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAA;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;IAChC,CAAC;IAED,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;IAC3C,CAAC;SAAM,CAAC;QACJ,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAA;QAChD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC,UAAU,EAAE,CAAC,CAAA;gBACvE,SAAQ;YACZ,CAAC;YACD,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChC,MAAM,CAAC,IAAI,CACP,gCAAgC,CAAC,CAAC,MAAM,kBAAkB,CAC7D,CAAA;gBACD,SAAQ;YACZ,CAAC;YACD,IAAI,CAAC;gBACD,MAAM,EAAE,GAAG,2BAA2B,CAClC,CAAC,CAAC,MAAM,EACR,OAAO,EACP,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAChC,CAAA;gBACD,IAAI,CAAC,EAAE;oBACH,MAAM,CAAC,IAAI,CACP,4BAA4B,CAAC,CAAC,MAAM,uBAAuB,CAC9D,CAAA;YACT,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACT,MAAM,CAAC,IAAI,CACP,4BAA4B,CAAC,CAAC,MAAM,gBAAiB,CAAW,CAAC,OAAO,EAAE,CAC7E,CAAA;YACL,CAAC;QACL,CAAC;IACL,CAAC;IAED,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACjC,IAAI,GAAG,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CACP,eAAe,GAAG,CAAC,QAAQ,yBAAyB,GAAG,CAAC,SAAS,OAAO,CAAC,CAAC,SAAS,GAAG,CACzF,CAAA;QACL,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CACP,eAAe,GAAG,CAAC,QAAQ,aAAa,GAAG,CAAC,MAAM,kBAAkB,CACvE,CAAA;QACL,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YACtD,MAAM,CAAC,IAAI,CAAC,6BAA6B,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC5D,CAAC;aAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CACP,eAAe,GAAG,CAAC,QAAQ,iCAAiC,WAAW,GAAG,CAC7E,CAAA;QACL,CAAC;aAAM,CAAC;YACJ,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAA;QAC9B,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CACP,eAAe,GAAG,CAAC,QAAQ,iCAAiC,CAC/D,CAAA;QACL,CAAC;IACL,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;AAC9C,CAAC"}

package/build/l2ps/channel/transport.d.ts

@@ -0,0 +1,117 @@
+/**
+ * SR-4 WI-A — Channel-over-L2PS transport adapter.
+ *
+ * The DACS channel layer (`ChannelSession`) is transport-agnostic: it
+ * produces signed `ChannelMessage` envelopes and verifies incoming ones,
+ * but does not move bytes. The L2PS instant-messaging layer
+ * (`L2PSMessagingPeer`) moves encrypted bytes between subnet members but
+ * knows nothing about channel envelopes. This adapter bridges the two:
+ * it serialises + encrypts an outgoing envelope onto the messaging
+ * transport, and on the receive side decrypts, deserialises, and feeds
+ * envelopes into the session **in strict sequence order**.
+ *
+ * Why a reorder buffer is mandatory:
+ * `ChannelSession.receiveIncoming` accepts any sequence strictly greater
+ * than the highest it has seen and then advances its counter to that
+ * value — so a *gap* (seq N+2 arriving before N+1) is not rejected, it
+ * permanently skips the missing messages. The L2PS transport delivers by
+ * timestamp and replays an offline queue, so out-of-order arrival is
+ * normal. This adapter therefore only hands the session the next
+ * contiguous sequence and buffers anything ahead of the gap until it
+ * fills.
+ *
+ * Scope / assumptions:
+ * - The shared per-channel sequence counter assumes turn-based messaging
+ *   (DACS negotiation is offer → counter → accept; a party waits for the
+ *   counter before replying). Two parties emitting the same sequence
+ *   concurrently is out of scope for SR-4 v1; such a colliding inbound
+ *   message (seq <= already-applied) is dropped as a duplicate.
+ * - Membership is the channel's `members`; the transport sends to every
+ *   member except self. Confidentiality is the subnet AES key (only
+ *   members hold it) — CH-2.
+ */
+import type { ChannelMessage, ChannelMessageType } from "./types";
+/**
+ * Minimal surface of `ChannelSession` the adapter depends on. Declared
+ * structurally so tests can inject a fake without real signing keys.
+ */
+export interface ChannelSessionLike {
+    readonly channelId: string;
+    sendOutgoing(opts: {
+        type: ChannelMessageType;
+        body: unknown;
+        sentAt?: number;
+        repliesTo?: number;
+    }): Promise<ChannelMessage>;
+    receiveIncoming(msg: ChannelMessage): Promise<void>;
+}
+/** Wire shape the L2PS messaging transport carries (ciphertext + nonce, base64). */
+export interface SerializedEncryptedMessage {
+    ciphertext: string;
+    nonce: string;
+    ephemeralKey?: string;
+}
+/** Incoming payload the messaging peer hands to an onMessage handler. */
+export interface IncomingMessagePayload {
+    from: string;
+    encrypted: SerializedEncryptedMessage;
+    messageHash: string;
+    offline?: boolean;
+}
+/**
+ * Minimal surface of `L2PSMessagingPeer` the adapter depends on.
+ * Declared structurally for the same reason as `ChannelSessionLike`.
+ */
+export interface L2PSMessagingPeerLike {
+    send(to: string, encrypted: SerializedEncryptedMessage, messageHash: string): Promise<unknown>;
+    onMessage(handler: (payload: IncomingMessagePayload) => void): void;
+}
+export interface L2PSChannelTransportOpts {
+    session: ChannelSessionLike;
+    peer: L2PSMessagingPeerLike;
+    /** Subnet AES-256 key (raw 32 bytes) — only members hold it (CH-2). */
+    sharedKey: Uint8Array;
+    /**
+     * Recipient public keys to deliver to (every channel member except
+     * self), in the format the messaging peer routes on.
+     */
+    recipients: string[];
+    /** Called with each envelope once it has been applied in order. */
+    onMessage?: (msg: ChannelMessage) => void;
+    /** Called on a decrypt / parse / verification failure. */
+    onError?: (err: Error) => void;
+}
+export declare class L2PSChannelTransport {
+    private readonly session;
+    private readonly peer;
+    private readonly sharedKey;
+    private readonly recipients;
+    private readonly onMessage?;
+    private readonly onError?;
+    /** Sequences seen ahead of the gap, awaiting contiguous application. */
+    private readonly buffer;
+    /** Highest contiguous sequence applied locally (sent or received). */
+    private appliedSeq;
+    /** Serialises drain() so concurrent inbound frames can't interleave. */
+    private draining;
+    private started;
+    constructor(opts: L2PSChannelTransportOpts);
+    /** Wire the peer's inbound handler. Call once. */
+    start(): void;
+    /**
+     * Build + sign the next outgoing envelope via the session, encrypt
+     * it under the subnet key, and deliver to every recipient.
+     */
+    send(opts: {
+        type: ChannelMessageType;
+        body: unknown;
+        repliesTo?: number;
+    }): Promise<ChannelMessage>;
+    private ingest;
+    /** Apply every buffered message that is now contiguous with appliedSeq. */
+    private drain;
+    /** Count of out-of-order messages currently held awaiting the gap. */
+    get bufferedCount(): number;
+    private encrypt;
+    private decrypt;
+}

package/build/l2ps/channel/transport.js

@@ -0,0 +1,178 @@
+/**
+ * SR-4 WI-A — Channel-over-L2PS transport adapter.
+ *
+ * The DACS channel layer (`ChannelSession`) is transport-agnostic: it
+ * produces signed `ChannelMessage` envelopes and verifies incoming ones,
+ * but does not move bytes. The L2PS instant-messaging layer
+ * (`L2PSMessagingPeer`) moves encrypted bytes between subnet members but
+ * knows nothing about channel envelopes. This adapter bridges the two:
+ * it serialises + encrypts an outgoing envelope onto the messaging
+ * transport, and on the receive side decrypts, deserialises, and feeds
+ * envelopes into the session **in strict sequence order**.
+ *
+ * Why a reorder buffer is mandatory:
+ * `ChannelSession.receiveIncoming` accepts any sequence strictly greater
+ * than the highest it has seen and then advances its counter to that
+ * value — so a *gap* (seq N+2 arriving before N+1) is not rejected, it
+ * permanently skips the missing messages. The L2PS transport delivers by
+ * timestamp and replays an offline queue, so out-of-order arrival is
+ * normal. This adapter therefore only hands the session the next
+ * contiguous sequence and buffers anything ahead of the gap until it
+ * fills.
+ *
+ * Scope / assumptions:
+ * - The shared per-channel sequence counter assumes turn-based messaging
+ *   (DACS negotiation is offer → counter → accept; a party waits for the
+ *   counter before replying). Two parties emitting the same sequence
+ *   concurrently is out of scope for SR-4 v1; such a colliding inbound
+ *   message (seq <= already-applied) is dropped as a duplicate.
+ * - Membership is the channel's `members`; the transport sends to every
+ *   member except self. Confidentiality is the subnet AES key (only
+ *   members hold it) — CH-2.
+ */
+/**
+ * Max number of sequences a buffered inbound frame may sit ahead of the
+ * current contiguous point before it is dropped, bounding reorder-buffer
+ * memory. Turn-based negotiation never legitimately exceeds this.
+ */
+const MAX_REORDER_AHEAD = 256;
+export class L2PSChannelTransport {
+    constructor(opts) {
+        /** Sequences seen ahead of the gap, awaiting contiguous application. */
+        this.buffer = new Map();
+        /** Highest contiguous sequence applied locally (sent or received). */
+        this.appliedSeq = 0;
+        /** Serialises drain() so concurrent inbound frames can't interleave. */
+        this.draining = Promise.resolve();
+        this.started = false;
+        this.session = opts.session;
+        this.peer = opts.peer;
+        this.sharedKey = opts.sharedKey;
+        this.recipients = opts.recipients;
+        this.onMessage = opts.onMessage;
+        this.onError = opts.onError;
+    }
+    /** Wire the peer's inbound handler. Call once. */
+    start() {
+        if (this.started)
+            throw new Error("L2PSChannelTransport: already started");
+        this.started = true;
+        this.peer.onMessage(payload => {
+            // Chain onto `draining` so frames are processed one at a time
+            // in arrival order; each appends to the buffer then drains.
+            this.draining = this.draining
+                .then(() => this.ingest(payload))
+                .catch(err => this.onError?.(err));
+        });
+    }
+    /**
+     * Build + sign the next outgoing envelope via the session, encrypt
+     * it under the subnet key, and deliver to every recipient.
+     */
+    async send(opts) {
+        const signed = await this.session.sendOutgoing(opts);
+        const encrypted = await this.encrypt(JSON.stringify(signed));
+        const messageHash = signed.signature.signature; // unique per signed envelope
+        // Deliver to every recipient BEFORE committing the sequence locally.
+        // If any send rejects, the throw propagates here and appliedSeq is
+        // left untouched, so a retry re-emits the same sequence rather than
+        // skipping ahead and stranding peers behind a reorder gap. (Recipients
+        // that did receive it will drop the duplicate on resend — seq <=
+        // appliedSeq — so at-least-once delivery is safe.)
+        for (const to of this.recipients) {
+            await this.peer.send(to, encrypted, messageHash);
+        }
+        // Our own send advances the shared per-channel counter; record it
+        // so we expect the peer's reply at appliedSeq + 1.
+        if (signed.sequence > this.appliedSeq)
+            this.appliedSeq = signed.sequence;
+        return signed;
+    }
+    async ingest(payload) {
+        let msg;
+        try {
+            const json = await this.decrypt(payload.encrypted);
+            msg = JSON.parse(json);
+        }
+        catch (e) {
+            throw new Error(`L2PSChannelTransport: failed to decrypt/parse inbound frame from ${payload.from}: ${e.message}`);
+        }
+        // Ignore traffic for other channels sharing the same subnet.
+        if (msg.channelId !== this.session.channelId)
+            return;
+        // Duplicate / already-applied (or a colliding concurrent send): drop.
+        if (msg.sequence <= this.appliedSeq)
+            return;
+        // Bound the reorder window: a member could otherwise stream many
+        // validly-encrypted frames at far-future sequences without ever
+        // filling the gap, growing `buffer` without limit. Drop anything
+        // beyond MAX_REORDER_AHEAD of the current contiguous point — a
+        // legitimate turn-based negotiation never runs that far ahead, and
+        // a dropped frame is re-deliverable (the offline queue replays it
+        // once the gap closes and appliedSeq advances).
+        if (msg.sequence > this.appliedSeq + MAX_REORDER_AHEAD) {
+            this.onError?.(new Error(`L2PSChannelTransport: dropping seq ${msg.sequence} — ` +
+                `more than ${MAX_REORDER_AHEAD} ahead of applied ${this.appliedSeq}`));
+            return;
+        }
+        // Buffer; a later sequence with the same value would be a protocol
+        // error — keep the first seen.
+        if (!this.buffer.has(msg.sequence))
+            this.buffer.set(msg.sequence, msg);
+        await this.drain();
+    }
+    /** Apply every buffered message that is now contiguous with appliedSeq. */
+    async drain() {
+        // Sequence counter is shared across both directions, so the next
+        // expected inbound is appliedSeq + 1.
+        let next = this.buffer.get(this.appliedSeq + 1);
+        while (next) {
+            this.buffer.delete(next.sequence);
+            // Throws on tamper (bad signature, wrong sender, channelId
+            // mismatch) — propagate as channel-fatal per §8.12.
+            await this.session.receiveIncoming(next);
+            this.appliedSeq = next.sequence;
+            this.onMessage?.(next);
+            next = this.buffer.get(this.appliedSeq + 1);
+        }
+    }
+    /** Count of out-of-order messages currently held awaiting the gap. */
+    get bufferedCount() {
+        return this.buffer.size;
+    }
+    // ── AES-256-GCM (Web Crypto) — matches the messaging wire format:
+    //    ciphertext (with auth tag) + 12-byte nonce, both base64. ──
+    async encrypt(plaintext) {
+        const nonce = crypto.getRandomValues(new Uint8Array(12));
+        const key = await crypto.subtle.importKey("raw", keyBytes(this.sharedKey), "AES-GCM", false, ["encrypt"]);
+        const cipher = await crypto.subtle.encrypt({ name: "AES-GCM", iv: nonce }, key, new TextEncoder().encode(plaintext));
+        return {
+            ciphertext: bytesToBase64(new Uint8Array(cipher)),
+            nonce: bytesToBase64(nonce),
+        };
+    }
+    async decrypt(enc) {
+        const key = await crypto.subtle.importKey("raw", keyBytes(this.sharedKey), "AES-GCM", false, ["decrypt"]);
+        const plain = await crypto.subtle.decrypt({ name: "AES-GCM", iv: base64ToBytes(enc.nonce) }, key, base64ToBytes(enc.ciphertext));
+        return new TextDecoder().decode(plain);
+    }
+}
+/**
+ * Return a standalone `ArrayBuffer` holding exactly the bytes of `view`.
+ * `view.buffer` exposes the whole backing buffer, which for a `subarray`
+ * (e.g. a 32-byte key sliced out of a larger buffer) is longer than the
+ * view — Web Crypto would then see the wrong length / wrong bytes and
+ * reject or mis-key the AES import. Copying the exact `[byteOffset,
+ * byteOffset+byteLength)` window guarantees the key import sees only the
+ * intended bytes.
+ */
+function keyBytes(view) {
+    return view.buffer.slice(view.byteOffset, view.byteOffset + view.byteLength);
+}
+function bytesToBase64(bytes) {
+    return Buffer.from(bytes).toString("base64");
+}
+function base64ToBytes(b64) {
+    return new Uint8Array(Buffer.from(b64, "base64"));
+}
+//# sourceMappingURL=transport.js.map

package/build/l2ps/channel/transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../../../../src/l2ps/channel/transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAIH;;;;GAIG;AACH,MAAM,iBAAiB,GAAG,GAAG,CAAA;AA6D7B,MAAM,OAAO,oBAAoB;IAgB7B,YAAY,IAA8B;QAR1C,wEAAwE;QACvD,WAAM,GAAG,IAAI,GAAG,EAA0B,CAAA;QAC3D,sEAAsE;QAC9D,eAAU,GAAG,CAAC,CAAA;QACtB,wEAAwE;QAChE,aAAQ,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAA;QAC3C,YAAO,GAAG,KAAK,CAAA;QAGnB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;QAC3B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;QACrB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;QAC/B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAA;QACjC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;QAC/B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;IAC/B,CAAC;IAED,kDAAkD;IAClD,KAAK;QACD,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QAC1E,IAAI,CAAC,OAAO,GAAG,IAAI,CAAA;QACnB,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE;YAC1B,8DAA8D;YAC9D,4DAA4D;YAC5D,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ;iBACxB,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;iBAChC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAY,CAAC,CAAC,CAAA;QACnD,CAAC,CAAC,CAAA;IACN,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,IAIV;QACG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;QAEpD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;QAC5D,MAAM,WAAW,GAAG,MAAM,CAAC,SAAS,CAAC,SAAS,CAAA,CAAC,6BAA6B;QAC5E,qEAAqE;QACrE,mEAAmE;QACnE,oEAAoE;QACpE,uEAAuE;QACvE,iEAAiE;QACjE,mDAAmD;QACnD,KAAK,MAAM,EAAE,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAC/B,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,WAAW,CAAC,CAAA;QACpD,CAAC;QAED,kEAAkE;QAClE,mDAAmD;QACnD,IAAI,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,UAAU;YAAE,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAA;QACxE,OAAO,MAAM,CAAA;IACjB,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,OAA+B;QAChD,IAAI,GAAmB,CAAA;QACvB,IAAI,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;YAClD,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAmB,CAAA;QAC5C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CACX,oEAAoE,OAAO,CAAC,IAAI,KAC3E,CAAW,CAAC,OACjB,EAAE,CACL,CAAA;QACL,CAAC;QAED,6DAA6D;QAC7D,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,OAAM;QACpD,sEAAsE;QACtE,IAAI,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU;YAAE,OAAM;QAC3C,iEAAiE;QACjE,gEAAgE;QAChE,iEAAiE;QACjE,+DAA+D;QAC/D,mEAAmE;QACnE,kEAAkE;QAClE,gDAAgD;QAChD,IAAI,GAAG,CAAC,QAAQ,GAAG,IAAI,CAAC,UAAU,GAAG,iBAAiB,EAAE,CAAC;YACrD,IAAI,CAAC,OAAO,EAAE,CACV,IAAI,KAAK,CACL,sCAAsC,GAAG,CAAC,QAAQ,KAAK;gBACnD,aAAa,iBAAiB,qBAAqB,IAAI,CAAC,UAAU,EAAE,CAC3E,CACJ,CAAA;YACD,OAAM;QACV,CAAC;QACD,mEAAmE;QACnE,+BAA+B;QAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;QAEtE,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;IACtB,CAAC;IAED,2EAA2E;IACnE,KAAK,CAAC,KAAK;QACf,iEAAiE;QACjE,sCAAsC;QACtC,IAAI,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAA;QAC/C,OAAO,IAAI,EAAE,CAAC;YACV,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;YACjC,2DAA2D;YAC3D,oDAAoD;YACpD,MAAM,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,IAAI,CAAC,CAAA;YACxC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAA;YAC/B,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAA;YACtB,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,CAAC,CAAA;QAC/C,CAAC;IACL,CAAC;IAED,sEAAsE;IACtE,IAAI,aAAa;QACb,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAA;IAC3B,CAAC;IAED,mEAAmE;IACnE,iEAAiE;IAEzD,KAAK,CAAC,OAAO,CAAC,SAAiB;QACnC,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;QACxD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACrC,KAAK,EACL,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EACxB,SAAS,EACT,KAAK,EACL,CAAC,SAAS,CAAC,CACd,CAAA;QACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACtC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,EAC9B,GAAG,EACH,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CACtC,CAAA;QACD,OAAO;YACH,UAAU,EAAE,aAAa,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;YACjD,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC;SAC9B,CAAA;IACL,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,GAA+B;QACjD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACrC,KAAK,EACL,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EACxB,SAAS,EACT,KAAK,EACL,CAAC,SAAS,CAAC,CACd,CAAA;QACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACrC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,aAAa,CAAC,GAAG,CAAC,KAAK,CAAiB,EAAE,EACjE,GAAG,EACH,aAAa,CAAC,GAAG,CAAC,UAAU,CAAiB,CAChD,CAAA;QACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC1C,CAAC;CACJ;AAED;;;;;;;;GAQG;AACH,SAAS,QAAQ,CAAC,IAAgB;IAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CACpB,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CACrB,CAAA;AACpB,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB;IACpC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;AAChD,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAC9B,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAA;AACrD,CAAC"}

package/build/l2ps/channel/types.d.ts

@@ -0,0 +1,55 @@
+import type { ClaimReference } from "../../identity/cci";
+/**
+ * Allowed message types — verbatim from DACS-3 §8.3.3. Closed union by
+ * design: the substrate enforces the conformance set; application bodies
+ * are carried in `body: unknown`.
+ */
+export type ChannelMessageType = "offer" | "counter" | "accept" | "reject" | "sealed-envelope-commit" | "sealed-envelope-reveal" | "abort";
+/**
+ * Brief doesn't define the wire shape of the signature container. Versioned
+ * for forward compatibility (e.g. PQC swap-out) without breaking the
+ * envelope layout. Signature is hex-encoded over `channelMessageSigningBytes`.
+ */
+export interface ChannelMessageSignature {
+    sigVersion: "1";
+    signature: string;
+}
+/**
+ * DACS-3 §8.3.3 envelope — verbatim. Transport-level fields may wrap this
+ * but MUST NOT change the bytes that the signature covers.
+ */
+export interface ChannelMessage {
+    channelId: string;
+    sequence: number;
+    sender: ClaimReference;
+    sentAt: number;
+    type: ChannelMessageType;
+    body: unknown;
+    refs?: {
+        repliesTo?: number;
+    };
+    signature: ChannelMessageSignature;
+}
+export type UnsignedChannelMessage = Omit<ChannelMessage, "signature">;
+/**
+ * Per-signer transcript signature. Each member signs the full transcript
+ * (without `signatures`) — see WI-3 reference in the brief.
+ */
+export interface TranscriptSignature {
+    sigVersion: "1";
+    signer: ClaimReference;
+    signature: string;
+}
+/**
+ * DACS-3 §8.7 — the ordered, member-signed record of a channel session.
+ * Consumed by WI-3 for encrypted-anchor flows.
+ */
+export interface ChannelTranscript {
+    transcriptVersion: "1";
+    channelId: string;
+    members: ClaimReference[];
+    messages: ChannelMessage[];
+    generatedAt: number;
+    signatures: TranscriptSignature[];
+}
+export type UnsignedChannelTranscript = Omit<ChannelTranscript, "signatures">;

package/build/l2ps/channel/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/l2ps/channel/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/l2ps/channel/types.ts"],"names":[],"mappings":""}

package/build/l2ps/index.d.ts

@@ -1,3 +1,6 @@
 import L2PS from "./l2ps";
-import { L2PSConfig, L2PSEncryptedPayload } from "./l2ps";
-export { L2PS, L2PSConfig, L2PSEncryptedPayload };
+import { L2PSConfig, L2PSEncryptedBytes, L2PSEncryptedPayload } from "./l2ps";
+export { L2PS, L2PSConfig, L2PSEncryptedBytes, L2PSEncryptedPayload };
+export * as binding from "./binding";
+export * as channel from "./channel";
+export * as anchor from "./anchor";

package/build/l2ps/index.js

@@ -1,3 +1,6 @@
 import L2PS from "./l2ps.js";
 export { L2PS };
+export * as binding from "./binding/index.js";
+export * as channel from "./channel/index.js";
+export * as anchor from "./anchor/index.js";
 //# sourceMappingURL=index.js.map

package/build/l2ps/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/l2ps/index.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,QAAQ,CAAA;AAGzB,OAAO,EAAE,IAAI,EAAoC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/l2ps/index.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,QAAQ,CAAA;AAGzB,OAAO,EAAE,IAAI,EAAwD,CAAA;AAErE,OAAO,KAAK,OAAO,MAAM,WAAW,CAAA;AACpC,OAAO,KAAK,OAAO,MAAM,WAAW,CAAA;AACpC,OAAO,KAAK,MAAM,MAAM,UAAU,CAAA"}

package/build/l2ps/l2ps.d.ts

@@ -47,6 +47,21 @@ export interface L2PSEncryptedPayload {
      */
     nonce?: string;
 }
+/**
+ * Payload shape for `L2PS.encryptBytes` / `L2PS.decryptBytes`. Used by
+ * SR-4 WI-3 to encrypt channel transcripts to the subnet member set
+ * without dragging the L2PS-transaction envelope into a non-tx context.
+ */
+export interface L2PSEncryptedBytes {
+    /** UID of the L2PS network that encrypted these bytes. */
+    l2ps_uid: string;
+    /** Base64-encoded AES-GCM ciphertext. */
+    ciphertext: string;
+    /** Base64-encoded AES-GCM authentication tag. */
+    tag: string;
+    /** Base64-encoded AES-GCM nonce (always 12 bytes, fresh per call). */
+    nonce: string;
+}
 /**
  * L2PS (Layer 2 Private Subnets) class for encrypted transaction processing.
  *
@@ -207,4 +222,21 @@ export default class L2PS {
      * @returns Promise resolving to a 16-character fingerprint string
      */
     getKeyFingerprint(): Promise<string>;
+    /**
+     * AES-GCM-encrypt arbitrary bytes under the subnet key.
+     *
+     * Mirrors the per-call-nonce + nonce-as-AAD pattern in `encryptTx`: a
+     * fresh 12-byte nonce per call, bound into the auth tag via AAD so an
+     * attacker cannot DoS specific ciphertexts by flipping the stored
+     * nonce. Used by SR-4 WI-3 to encrypt channel transcripts to the
+     * subnet member set; nothing in the payload shape is L2PS-transaction
+     * specific.
+     */
+    encryptBytes(plaintext: Uint8Array): Promise<L2PSEncryptedBytes>;
+    /**
+     * Inverse of `encryptBytes`. Verifies the `l2ps_uid` matches this
+     * instance and that the AES-GCM auth tag (covering nonce + ciphertext)
+     * is intact; throws on either failure.
+     */
+    decryptBytes(payload: L2PSEncryptedBytes): Promise<Uint8Array>;
 }

package/build/l2ps/l2ps.js

@@ -309,6 +309,66 @@ class L2PS {
     async getKeyFingerprint() {
         return Hashing.sha256(this.privateKey).substring(0, 16);
     }
+    /**
+     * AES-GCM-encrypt arbitrary bytes under the subnet key.
+     *
+     * Mirrors the per-call-nonce + nonce-as-AAD pattern in `encryptTx`: a
+     * fresh 12-byte nonce per call, bound into the auth tag via AAD so an
+     * attacker cannot DoS specific ciphertexts by flipping the stored
+     * nonce. Used by SR-4 WI-3 to encrypt channel transcripts to the
+     * subnet member set; nothing in the payload shape is L2PS-transaction
+     * specific.
+     */
+    async encryptBytes(plaintext) {
+        const cipher = forge.cipher.createCipher('AES-GCM', this.privateKey);
+        const nonce = forge.random.getBytesSync(12);
+        cipher.start({ iv: nonce, additionalData: nonce });
+        cipher.update(forge.util.createBuffer(Buffer.from(plaintext).toString('binary'), 'binary'));
+        if (!cipher.finish()) {
+            throw new Error('L2PS.encryptBytes: AES-GCM finish() failed');
+        }
+        return {
+            l2ps_uid: this.config?.uid || this.id,
+            ciphertext: forge.util.encode64(cipher.output.getBytes()),
+            tag: forge.util.encode64(cipher.mode.tag.getBytes()),
+            nonce: forge.util.encode64(nonce),
+        };
+    }
+    /**
+     * Inverse of `encryptBytes`. Verifies the `l2ps_uid` matches this
+     * instance and that the AES-GCM auth tag (covering nonce + ciphertext)
+     * is intact; throws on either failure.
+     */
+    async decryptBytes(payload) {
+        if (payload.l2ps_uid !== (this.config?.uid || this.id)) {
+            throw new Error('L2PS.decryptBytes: payload encrypted for different L2PS uid');
+        }
+        // Storage-loaded JSON can violate the L2PSEncryptedBytes shape at
+        // runtime; without an explicit shape check forge would throw a
+        // base64 error that does not tell the caller which field is wrong.
+        if (typeof payload.ciphertext !== 'string' ||
+            typeof payload.tag !== 'string' ||
+            typeof payload.nonce !== 'string') {
+            throw new Error('L2PS.decryptBytes: payload must include base64 strings for ciphertext, tag, and nonce');
+        }
+        const ciphertext = forge.util.createBuffer(forge.util.decode64(payload.ciphertext));
+        const tag = forge.util.createBuffer(forge.util.decode64(payload.tag));
+        const iv = forge.util.decode64(payload.nonce);
+        if (iv.length !== 12) {
+            throw new Error('L2PS.decryptBytes: invalid nonce (expected base64-encoded 12-byte value)');
+        }
+        const decipher = forge.cipher.createDecipher('AES-GCM', this.privateKey);
+        decipher.start({ iv, tag, additionalData: iv });
+        decipher.update(ciphertext);
+        if (!decipher.finish()) {
+            throw new Error('L2PS.decryptBytes: AES-GCM authentication failed');
+        }
+        const bin = decipher.output.getBytes();
+        const out = new Uint8Array(bin.length);
+        for (let i = 0; i < bin.length; i++)
+            out[i] = bin.charCodeAt(i) & 0xff;
+        return out;
+    }
 }
 /** Static map of all L2PS instances, keyed by instance ID */
 L2PS.instances = new Map();