@kynesyslabs/demosdk 4.0.9 → 4.0.11

package/build/identity/cci/signing.js

@@ -0,0 +1,83 @@
+import { Cryptography } from "../../encryption/Cryptography.js";
+import { demosAddressFromClaim, normalizeDemosAddress, parseClaimRef, } from "./claim.js";
+/**
+ * Sign a payload with the key controlling a CCI primary claim.
+ *
+ * The brief invariant (DACS-3 §0 / §8.3.2): in-channel signatures MUST be
+ * produced by the key that controls the sender's primary claim — the same
+ * key that holds value on-chain. On Demos that is the Demos Ed25519 key,
+ * NOT the RSA L2PS subnet key.
+ *
+ * Domain separation is the caller's responsibility — pass the full payload
+ * including the `dacs-*:v1:` prefix. WI-0 stays scheme-agnostic.
+ *
+ * @param claim   - The signer's primary `demos:` ClaimReference. Refuses any
+ *                  other scheme until a controlling-key resolver for them
+ *                  is added.
+ * @param payload - Pre-domain-separated bytes to cover. Caller composes
+ *                  `dacs-*:v1: || canonical_hash`.
+ * @param demos   - Connected `Demos` instance. Its Ed25519 address must
+ *                  match `claim`'s identifier — otherwise we refuse to
+ *                  produce a misattributable signature.
+ * @returns       Raw 64-byte Ed25519 signature.
+ * @throws {Error} If the scheme is not `demos`, the wallet is not
+ *                 connected, or the connected address does not match the
+ *                 claim's address.
+ */
+export async function signWithPrimaryClaim(claim, payload, demos) {
+    const { scheme } = parseClaimRef(claim);
+    if (scheme !== "demos") {
+        throw new Error(`signWithPrimaryClaim: unsupported scheme "${scheme}". Only "demos" is currently supported.`);
+    }
+    if (!demos.walletConnected) {
+        throw new Error("signWithPrimaryClaim: Demos wallet not connected");
+    }
+    const claimAddress = demosAddressFromClaim(claim);
+    const connected = normalizeDemosAddress(await demos.getEd25519Address());
+    if (claimAddress !== connected) {
+        throw new Error(`signWithPrimaryClaim: claim "${claim}" does not match connected Demos wallet ${connected}`);
+    }
+    const signed = await demos.crypto.sign("ed25519", payload);
+    return toUint8Array(signed.signature);
+}
+/**
+ * Verify an Ed25519 signature produced by `signWithPrimaryClaim`.
+ *
+ * Recovers the public key from the claim identifier and verifies forge-style.
+ * Caller-supplied payload must match the bytes that were signed (including
+ * any `dacs-*:v1:` domain prefix).
+ *
+ * @param claim     - The claimed signer's `demos:` ClaimReference.
+ * @param payload   - Exact bytes that were signed (must roundtrip through
+ *                    UTF-8). Caller composes `dacs-*:v1: || hash`.
+ * @param signature - Raw 64-byte Ed25519 signature.
+ * @returns        `true` iff the signature verifies under the public key
+ *                 encoded in `claim`; `false` for cryptographic mismatch.
+ * @throws {Error} If the scheme is not `demos` or the recovered public
+ *                 key is not 32 bytes (malformed claim).
+ */
+export function verifyPrimaryClaimSignature(claim, payload, signature) {
+    const { scheme } = parseClaimRef(claim);
+    if (scheme !== "demos") {
+        throw new Error(`verifyPrimaryClaimSignature: unsupported scheme "${scheme}"`);
+    }
+    const publicKey = hexAddressToBytes(demosAddressFromClaim(claim));
+    if (publicKey.length !== 32) {
+        throw new Error(`verifyPrimaryClaimSignature: expected 32-byte Ed25519 public key, got ${publicKey.length}`);
+    }
+    return Cryptography.verify(new TextDecoder().decode(payload), Buffer.from(signature), Buffer.from(publicKey));
+}
+function hexAddressToBytes(address) {
+    const hex = address.startsWith("0x") ? address.slice(2) : address;
+    const out = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < hex.length; i += 2) {
+        out[i / 2] = Number.parseInt(hex.slice(i, i + 2), 16);
+    }
+    return out;
+}
+function toUint8Array(buf) {
+    if (buf instanceof Uint8Array)
+        return buf;
+    return Uint8Array.from(buf);
+}
+//# sourceMappingURL=signing.js.map

package/build/identity/cci/signing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.js","sourceRoot":"","sources":["../../../../src/identity/cci/signing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAA;AAGxD,OAAO,EACH,qBAAqB,EACrB,qBAAqB,EACrB,aAAa,GAChB,MAAM,SAAS,CAAA;AAEhB;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACtC,KAAqB,EACrB,OAAmB,EACnB,KAAY;IAEZ,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;IACvC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACX,6CAA6C,MAAM,yCAAyC,CAC/F,CAAA;IACL,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACvE,CAAC;IAED,MAAM,YAAY,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAA;IACjD,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAA;IACxE,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACX,gCAAgC,KAAK,2CAA2C,SAAS,EAAE,CAC9F,CAAA;IACL,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IAC1D,OAAO,YAAY,CAAC,MAAM,CAAC,SAA8B,CAAC,CAAA;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,2BAA2B,CACvC,KAAqB,EACrB,OAAmB,EACnB,SAAqB;IAErB,MAAM,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,CAAC,CAAA;IACvC,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACX,oDAAoD,MAAM,GAAG,CAChE,CAAA;IACL,CAAC;IAED,MAAM,SAAS,GAAG,iBAAiB,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAA;IACjE,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACX,yEAAyE,SAAS,CAAC,MAAM,EAAE,CAC9F,CAAA;IACL,CAAC;IAED,OAAO,YAAY,CAAC,MAAM,CACtB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EACjC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EACtB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CACzB,CAAA;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;IACjE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACzD,CAAC;IACD,OAAO,GAAG,CAAA;AACd,CAAC;AAED,SAAS,YAAY,CAAC,GAAsB;IACxC,IAAI,GAAG,YAAY,UAAU;QAAE,OAAO,GAAG,CAAA;IACzC,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC/B,CAAC"}

package/build/identity/cci/types.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Cross-Context Identity (CCI) — type definitions.
+ *
+ * A ClaimReference is the label that names an identity across substrates.
+ * It is NOT a key; the key controlling the claim signs in-channel messages.
+ * See `docs/l2ps-sr4-implementation-brief.md` §0 in the node repo for the
+ * full claim-vs-key distinction.
+ */
+export type ClaimScheme = "demos" | (string & {});
+export type ClaimReference = `${string}:${string}`;
+export interface ParsedClaimRef {
+    scheme: ClaimScheme;
+    identifier: string;
+}

package/build/identity/cci/types.js

@@ -0,0 +1,10 @@
+/**
+ * Cross-Context Identity (CCI) — type definitions.
+ *
+ * A ClaimReference is the label that names an identity across substrates.
+ * It is NOT a key; the key controlling the claim signs in-channel messages.
+ * See `docs/l2ps-sr4-implementation-brief.md` §0 in the node repo for the
+ * full claim-vs-key distinction.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/build/identity/cci/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/identity/cci/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG"}

package/build/identity/index.d.ts

@@ -0,0 +1,2 @@
+export * as humanpassport from "./humanpassport";
+export * as cci from "./cci";

package/build/identity/index.js

@@ -0,0 +1,3 @@
+export * as humanpassport from "./humanpassport/index.js";
+export * as cci from "./cci/index.js";
+//# sourceMappingURL=index.js.map

package/build/identity/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/identity/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,aAAa,MAAM,iBAAiB,CAAA;AAChD,OAAO,KAAK,GAAG,MAAM,OAAO,CAAA"}

package/build/l2ps/anchor/anchor.d.ts

@@ -0,0 +1,92 @@
+import { type ClaimReference } from "../../identity/cci";
+import { Demos } from "../../websdk/demosclass";
+import L2PS from "../l2ps";
+import type { ChannelTranscript } from "../channel/types";
+import type { AttestationRef, TranscriptDisclosurePolicy } from "./types";
+/**
+ * Deterministic per-channel Storage Program name. One anchor per
+ * channelId; a redo of the same channel reuses the slot (the SP's
+ * `mode: "owner"` ACL guarantees only the original signer can overwrite).
+ *
+ * @param channelId - Per-session `channelId` (matches `ChannelTranscript.channelId`).
+ * @returns         The SR-2 program name used by `anchorEncryptedTranscript`.
+ */
+export declare function anchorProgramName(channelId: string): string;
+export interface AnchorEncryptedTranscriptOpts {
+    transcript: ChannelTranscript;
+    /** Provides the AES-GCM key for encrypt-to-member-set. */
+    l2ps: L2PS;
+    demos: Demos;
+    /** Must be a member of `transcript.members` and match the connected Demos wallet. */
+    signer: ClaimReference;
+    policy: TranscriptDisclosurePolicy;
+    /** Required to actually anchor when `policy === "encrypted-anchored-recommended"`. */
+    consent?: boolean;
+}
+/**
+ * §8.7 anchor entrypoint. Encrypts a `ChannelTranscript` to the L2PS
+ * member set, anchors the ciphertext via SR-2, and signs the plaintext
+ * hash with the connected Demos key.
+ *
+ * Policy behaviour:
+ * - `none`            → throws (caller should not have invoked this).
+ * - `recommended`     → only anchors when `consent === true`; otherwise returns `null`.
+ * - `required`        → always anchors; broadcast failures propagate so
+ *                       the caller's phase can fail per §8.7.
+ *
+ * The SP is deployed via SR-2 with `mode: "public"` (anyone reads the
+ * ciphertext + the public content hash for tamper-evidence; only the
+ * owner can overwrite).
+ *
+ * @param opts - Transcript + L2PS instance (for the AES-GCM key) +
+ *               connected Demos (for the signing key + broadcast) +
+ *               signer claim + policy/consent.
+ * @returns   `{ anchor, contentHash }` on success, `null` only when the
+ *            recommended policy is in effect and consent is missing.
+ * @throws {Error} On `policy === "none"`, non-demos signer, non-member
+ *                 signer, signer-wallet mismatch, or broadcast failure
+ *                 under `required` policy.
+ */
+export declare function anchorEncryptedTranscript(opts: AnchorEncryptedTranscriptOpts): Promise<AttestationRef | null>;
+export interface DecryptAnchoredTranscriptOpts {
+    rpcUrl: string;
+    storageAddress: string;
+    l2ps: L2PS;
+}
+/**
+ * Fetch + decrypt + fully verify the original transcript.
+ *
+ * @param opts - RPC URL + Storage Program address + L2PS instance (caller
+ *               must be a subnet member; otherwise AES-GCM auth fails).
+ * @returns   A `ChannelTranscript` whose every component has been
+ *            validated end-to-end — callers do not need to run
+ *            `verifyTranscript` again.
+ * @throws {Error} On the first of:
+ *   - SP not found / wrong shape / unknown transcriptVersion
+ *   - ciphertext hash does not match the stored `contentHash` (tamper)
+ *   - AES-GCM auth fails (= caller's L2PS instance is not a subnet member)
+ *   - decrypted `channelId` does not match the anchor's `channelId`
+ *   - anchor-party transcript signature is invalid
+ *   - any embedded ChannelMessage signature, sequence, sender ∈ members,
+ *     or per-message channelId check fails (delegated to `verifyTranscript`).
+ */
+export declare function decryptAnchoredTranscript(opts: DecryptAnchoredTranscriptOpts): Promise<ChannelTranscript>;
+export interface VerifyAnchorIntegrityResult {
+    ok: boolean;
+    errors: string[];
+}
+/**
+ * Public tamper-check that needs no decryption keys. Hashes the on-chain
+ * ciphertext and compares with the stored `contentHash`; also asserts the
+ * SP owner address matches the embedded signer's CCI claim. Useful for
+ * auditors and non-members verifying an anchor without subnet access.
+ *
+ * @param opts - RPC URL + Storage Program address.
+ * @returns   `{ ok, errors }` — `ok` only when every public check passes;
+ *            `errors` contains every failure (collected in one pass so
+ *            auditors see the full picture, not the first failure).
+ */
+export declare function verifyAnchorIntegrity(opts: {
+    rpcUrl: string;
+    storageAddress: string;
+}): Promise<VerifyAnchorIntegrityResult>;

package/build/l2ps/anchor/anchor.js

@@ -0,0 +1,186 @@
+import { sha256 } from "@noble/hashes/sha2";
+import { canonicalJSONStringify } from "../../websdk/utils/canonicalJson.js";
+import { demosAddressFromClaim, isDemosClaim, normalizeDemosAddress, signWithPrimaryClaim, verifyPrimaryClaimSignature, } from "../../identity/cci/index.js";
+import { DemosTransactions } from "../../websdk/DemosTransactions.js";
+import { StorageProgram } from "../../storage/StorageProgram.js";
+import { stripTranscriptSignatures, transcriptSigningBytes, } from "../channel/canonical.js";
+import { verifyTranscript } from "../channel/transcript.js";
+import { bytesToHex, signatureFromHex, signatureToHex } from "../utils/hex.js";
+/**
+ * Deterministic per-channel Storage Program name. One anchor per
+ * channelId; a redo of the same channel reuses the slot (the SP's
+ * `mode: "owner"` ACL guarantees only the original signer can overwrite).
+ *
+ * @param channelId - Per-session `channelId` (matches `ChannelTranscript.channelId`).
+ * @returns         The SR-2 program name used by `anchorEncryptedTranscript`.
+ */
+export function anchorProgramName(channelId) {
+    return `l2ps-transcript:${encodeURIComponent(channelId)}`;
+}
+/**
+ * §8.7 anchor entrypoint. Encrypts a `ChannelTranscript` to the L2PS
+ * member set, anchors the ciphertext via SR-2, and signs the plaintext
+ * hash with the connected Demos key.
+ *
+ * Policy behaviour:
+ * - `none`            → throws (caller should not have invoked this).
+ * - `recommended`     → only anchors when `consent === true`; otherwise returns `null`.
+ * - `required`        → always anchors; broadcast failures propagate so
+ *                       the caller's phase can fail per §8.7.
+ *
+ * The SP is deployed via SR-2 with `mode: "public"` (anyone reads the
+ * ciphertext + the public content hash for tamper-evidence; only the
+ * owner can overwrite).
+ *
+ * @param opts - Transcript + L2PS instance (for the AES-GCM key) +
+ *               connected Demos (for the signing key + broadcast) +
+ *               signer claim + policy/consent.
+ * @returns   `{ anchor, contentHash }` on success, `null` only when the
+ *            recommended policy is in effect and consent is missing.
+ * @throws {Error} On `policy === "none"`, non-demos signer, non-member
+ *                 signer, signer-wallet mismatch, or broadcast failure
+ *                 under `required` policy.
+ */
+export async function anchorEncryptedTranscript(opts) {
+    if (opts.policy === "none") {
+        throw new Error("anchorEncryptedTranscript: policy is 'none' — do not call this helper");
+    }
+    if (opts.policy === "encrypted-anchored-recommended" &&
+        opts.consent !== true) {
+        return null;
+    }
+    if (!isDemosClaim(opts.signer)) {
+        throw new Error(`anchorEncryptedTranscript: signer must be a demos: ClaimReference, got "${opts.signer}"`);
+    }
+    if (!opts.transcript.members.includes(opts.signer)) {
+        throw new Error(`anchorEncryptedTranscript: signer "${opts.signer}" is not in transcript.members`);
+    }
+    const signerAddress = demosAddressFromClaim(opts.signer);
+    const connected = normalizeDemosAddress(await opts.demos.getEd25519Address());
+    if (signerAddress !== connected) {
+        throw new Error(`anchorEncryptedTranscript: signer "${opts.signer}" does not match connected wallet ${connected}`);
+    }
+    const unsignedView = stripTranscriptSignatures(opts.transcript);
+    const plaintextBytes = new TextEncoder().encode(canonicalJSONStringify(unsignedView));
+    const encrypted = await opts.l2ps.encryptBytes(plaintextBytes);
+    const contentHash = bytesToHex(sha256(base64ToBytes(encrypted.ciphertext)));
+    const sigBytes = await signWithPrimaryClaim(opts.signer, transcriptSigningBytes(unsignedView), opts.demos);
+    const payload = {
+        transcriptVersion: "1",
+        channelId: opts.transcript.channelId,
+        encrypted,
+        contentHash,
+        signature: {
+            sigVersion: "1",
+            signer: opts.signer,
+            signature: signatureToHex(sigBytes),
+        },
+    };
+    const storageAddress = await deployAnchorSP(opts.demos, anchorProgramName(opts.transcript.channelId), payload);
+    return { anchor: storageAddress, contentHash };
+}
+async function deployAnchorSP(demos, programName, payload) {
+    const deployer = normalizeDemosAddress(await demos.getEd25519Address());
+    const nonce = (await demos.getAddressNonce(deployer)) + 1;
+    const spPayload = StorageProgram.createStorageProgram(deployer, programName, payload, "json", { mode: "public" }, { nonce });
+    const tx = DemosTransactions.empty();
+    tx.content.to = spPayload.storageAddress;
+    tx.content.nonce = nonce;
+    tx.content.amount = 0;
+    tx.content.type = "storageProgram";
+    tx.content.timestamp = Date.now();
+    tx.content.data = ["storageProgram", spPayload];
+    const signed = await demos.sign(tx);
+    const validity = await demos.confirm(signed);
+    await demos.broadcast(validity);
+    return spPayload.storageAddress;
+}
+/**
+ * Fetch + decrypt + fully verify the original transcript.
+ *
+ * @param opts - RPC URL + Storage Program address + L2PS instance (caller
+ *               must be a subnet member; otherwise AES-GCM auth fails).
+ * @returns   A `ChannelTranscript` whose every component has been
+ *            validated end-to-end — callers do not need to run
+ *            `verifyTranscript` again.
+ * @throws {Error} On the first of:
+ *   - SP not found / wrong shape / unknown transcriptVersion
+ *   - ciphertext hash does not match the stored `contentHash` (tamper)
+ *   - AES-GCM auth fails (= caller's L2PS instance is not a subnet member)
+ *   - decrypted `channelId` does not match the anchor's `channelId`
+ *   - anchor-party transcript signature is invalid
+ *   - any embedded ChannelMessage signature, sequence, sender ∈ members,
+ *     or per-message channelId check fails (delegated to `verifyTranscript`).
+ */
+export async function decryptAnchoredTranscript(opts) {
+    const sp = await StorageProgram.getByAddress(opts.rpcUrl, opts.storageAddress);
+    if (!sp?.data || typeof sp.data !== "object")
+        throw new Error(`decryptAnchoredTranscript: no storage program at ${opts.storageAddress}`);
+    const payload = sp.data;
+    if (payload.transcriptVersion !== "1")
+        throw new Error("decryptAnchoredTranscript: unknown transcriptVersion");
+    const ctHash = bytesToHex(sha256(base64ToBytes(payload.encrypted.ciphertext)));
+    if (ctHash !== payload.contentHash)
+        throw new Error("decryptAnchoredTranscript: ciphertext hash does not match stored contentHash (tamper)");
+    const plaintext = await opts.l2ps.decryptBytes(payload.encrypted);
+    const transcript = JSON.parse(new TextDecoder().decode(plaintext));
+    if (transcript.channelId !== payload.channelId)
+        throw new Error("decryptAnchoredTranscript: decrypted channelId does not match anchor channelId");
+    const sigOk = verifyPrimaryClaimSignature(payload.signature.signer, transcriptSigningBytes(transcript), signatureFromHex(payload.signature.signature));
+    if (!sigOk)
+        throw new Error("decryptAnchoredTranscript: transcript signature verification failed");
+    const fullTranscript = {
+        ...transcript,
+        signatures: [payload.signature],
+    };
+    // Run the audit verifier on the assembled transcript so the caller's
+    // return value is end-to-end validated, not just the anchor wrapper.
+    const audit = verifyTranscript(fullTranscript);
+    if (!audit.ok)
+        throw new Error(`decryptAnchoredTranscript: transcript audit failed — ${audit.errors.join("; ")}`);
+    return fullTranscript;
+}
+/**
+ * Public tamper-check that needs no decryption keys. Hashes the on-chain
+ * ciphertext and compares with the stored `contentHash`; also asserts the
+ * SP owner address matches the embedded signer's CCI claim. Useful for
+ * auditors and non-members verifying an anchor without subnet access.
+ *
+ * @param opts - RPC URL + Storage Program address.
+ * @returns   `{ ok, errors }` — `ok` only when every public check passes;
+ *            `errors` contains every failure (collected in one pass so
+ *            auditors see the full picture, not the first failure).
+ */
+export async function verifyAnchorIntegrity(opts) {
+    const errors = [];
+    const sp = await StorageProgram.getByAddress(opts.rpcUrl, opts.storageAddress);
+    if (!sp?.data || typeof sp.data !== "object") {
+        errors.push(`no storage program at ${opts.storageAddress}`);
+        return { ok: false, errors };
+    }
+    const payload = sp.data;
+    if (payload.transcriptVersion !== "1")
+        errors.push(`unknown transcriptVersion ${payload.transcriptVersion}`);
+    try {
+        const hash = bytesToHex(sha256(base64ToBytes(payload.encrypted.ciphertext)));
+        if (hash !== payload.contentHash)
+            errors.push("ciphertext hash does not match stored contentHash");
+    }
+    catch (e) {
+        errors.push(`hash check failed: ${e.message}`);
+    }
+    try {
+        const signerAddress = demosAddressFromClaim(payload.signature.signer);
+        if (normalizeDemosAddress(sp.owner) !== signerAddress)
+            errors.push(`storage program owner ${sp.owner} does not match signer claim ${payload.signature.signer}`);
+    }
+    catch (e) {
+        errors.push(`signer claim address check failed: ${e.message}`);
+    }
+    return { ok: errors.length === 0, errors };
+}
+function base64ToBytes(b64) {
+    const bin = Buffer.from(b64, "base64");
+    return new Uint8Array(bin.buffer, bin.byteOffset, bin.byteLength);
+}
+//# sourceMappingURL=anchor.js.map

package/build/l2ps/anchor/anchor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anchor.js","sourceRoot":"","sources":["../../../../src/l2ps/anchor/anchor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AACrE,OAAO,EACH,qBAAqB,EACrB,YAAY,EACZ,qBAAqB,EACrB,oBAAoB,EACpB,2BAA2B,GAE9B,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAOzD,OAAO,EACH,yBAAyB,EACzB,sBAAsB,GACzB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AACxD,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAO3E;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IAC/C,OAAO,mBAAmB,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAA;AAC7D,CAAC;AAcD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC3C,IAAmC;IAEnC,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACX,uEAAuE,CAC1E,CAAA;IACL,CAAC;IACD,IACI,IAAI,CAAC,MAAM,KAAK,gCAAgC;QAChD,IAAI,CAAC,OAAO,KAAK,IAAI,EACvB,CAAC;QACC,OAAO,IAAI,CAAA;IACf,CAAC;IACD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACX,2EAA2E,IAAI,CAAC,MAAM,GAAG,CAC5F,CAAA;IACL,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACX,sCAAsC,IAAI,CAAC,MAAM,gCAAgC,CACpF,CAAA;IACL,CAAC;IACD,MAAM,aAAa,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACxD,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAA;IAC7E,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CACX,sCAAsC,IAAI,CAAC,MAAM,qCAAqC,SAAS,EAAE,CACpG,CAAA;IACL,CAAC;IAED,MAAM,YAAY,GAAG,yBAAyB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC/D,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAC3C,sBAAsB,CAAC,YAAY,CAAC,CACvC,CAAA;IAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC,CAAA;IAC9D,MAAM,WAAW,GAAG,UAAU,CAC1B,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAC9C,CAAA;IAED,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CACvC,IAAI,CAAC,MAAM,EACX,sBAAsB,CAAC,YAAY,CAAC,EACpC,IAAI,CAAC,KAAK,CACb,CAAA;IAED,MAAM,OAAO,GAA8B;QACvC,iBAAiB,EAAE,GAAG;QACtB,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS;QACpC,SAAS;QACT,WAAW;QACX,SAAS,EAAE;YACP,UAAU,EAAE,GAAG;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,cAAc,CAAC,QAAQ,CAAC;SACtC;KACJ,CAAA;IAED,MAAM,cAAc,GAAG,MAAM,cAAc,CACvC,IAAI,CAAC,KAAK,EACV,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAC5C,OAAO,CACV,CAAA;IAED,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,WAAW,EAAE,CAAA;AAClD,CAAC;AAED,KAAK,UAAU,cAAc,CACzB,KAAY,EACZ,WAAmB,EACnB,OAAkC;IAElC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAA;IACvE,MAAM,KAAK,GAAG,CAAC,MAAM,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAA;IACzD,MAAM,SAAS,GAAG,cAAc,CAAC,oBAAoB,CACjD,QAAQ,EACR,WAAW,EACX,OAA6C,EAC7C,MAAM,EACN,EAAE,IAAI,EAAE,QAAQ,EAAE,EAClB,EAAE,KAAK,EAAE,CACZ,CAAA;IAED,MAAM,EAAE,GAAG,iBAAiB,CAAC,KAAK,EAAiB,CAAA;IACnD,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC,cAAc,CAAA;IACxC,EAAE,CAAC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAA;IACxB,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAA;IACrB,EAAE,CAAC,OAAO,CAAC,IAAI,GAAG,gBAAgB,CAAA;IAClC,EAAE,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACjC,EAAE,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAQ,CAAA;IAEtD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACnC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAC5C,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;IAE/B,OAAO,SAAS,CAAC,cAAc,CAAA;AACnC,CAAC;AAQD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC3C,IAAmC;IAEnC,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,YAAY,CACxC,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,cAAc,CACtB,CAAA;IACD,IAAI,CAAC,EAAE,EAAE,IAAI,IAAI,OAAO,EAAE,CAAC,IAAI,KAAK,QAAQ;QACxC,MAAM,IAAI,KAAK,CACX,oDAAoD,IAAI,CAAC,cAAc,EAAE,CAC5E,CAAA;IAEL,MAAM,OAAO,GAAG,EAAE,CAAC,IAA4C,CAAA;IAC/D,IAAI,OAAO,CAAC,iBAAiB,KAAK,GAAG;QACjC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IAE3E,MAAM,MAAM,GAAG,UAAU,CACrB,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CACtD,CAAA;IACD,IAAI,MAAM,KAAK,OAAO,CAAC,WAAW;QAC9B,MAAM,IAAI,KAAK,CACX,uFAAuF,CAC1F,CAAA;IAEL,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACjE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CACzB,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CACT,CAAA;IAE9B,IAAI,UAAU,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;QAC1C,MAAM,IAAI,KAAK,CACX,gFAAgF,CACnF,CAAA;IAEL,MAAM,KAAK,GAAG,2BAA2B,CACrC,OAAO,CAAC,SAAS,CAAC,MAAM,EACxB,sBAAsB,CAAC,UAAU,CAAC,EAClC,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CAChD,CAAA;IACD,IAAI,CAAC,KAAK;QACN,MAAM,IAAI,KAAK,CACX,qEAAqE,CACxE,CAAA;IAEL,MAAM,cAAc,GAAsB;QACtC,GAAG,UAAU;QACb,UAAU,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;KAClC,CAAA;IAED,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,KAAK,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAA;IAC9C,IAAI,CAAC,KAAK,CAAC,EAAE;QACT,MAAM,IAAI,KAAK,CACX,wDAAwD,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpF,CAAA;IAEL,OAAO,cAAc,CAAA;AACzB,CAAC;AAOD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,IAG3C;IACG,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,YAAY,CACxC,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,cAAc,CACtB,CAAA;IACD,IAAI,CAAC,EAAE,EAAE,IAAI,IAAI,OAAO,EAAE,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,yBAAyB,IAAI,CAAC,cAAc,EAAE,CAAC,CAAA;QAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;IAChC,CAAC;IACD,MAAM,OAAO,GAAG,EAAE,CAAC,IAA4C,CAAA;IAC/D,IAAI,OAAO,CAAC,iBAAiB,KAAK,GAAG;QACjC,MAAM,CAAC,IAAI,CAAC,6BAA6B,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAA;IAEzE,IAAI,CAAC;QACD,MAAM,IAAI,GAAG,UAAU,CACnB,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CACtD,CAAA;QACD,IAAI,IAAI,KAAK,OAAO,CAAC,WAAW;YAC5B,MAAM,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAA;IACxE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,MAAM,CAAC,IAAI,CAAC,sBAAuB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAA;IAC7D,CAAC;IAED,IAAI,CAAC;QACD,MAAM,aAAa,GAAG,qBAAqB,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QACrE,IAAI,qBAAqB,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,aAAa;YACjD,MAAM,CAAC,IAAI,CACP,yBAAyB,EAAE,CAAC,KAAK,gCAAgC,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,CAC9F,CAAA;IACT,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACT,MAAM,CAAC,IAAI,CACP,sCAAuC,CAAW,CAAC,OAAO,EAAE,CAC/D,CAAA;IACL,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;AAC9C,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACtC,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,CAAC,CAAA;AACrE,CAAC"}

package/build/l2ps/anchor/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * DACS-3 §8.7 — encrypted transcript anchoring (SR-4 WI-3).
+ *
+ * Encrypts a `ChannelTranscript` to the subnet member set via the
+ * existing L2PS AES-GCM key, anchors the ciphertext + public content hash
+ * via SR-2 Storage Program, and signs the transcript-plaintext hash with
+ * the caller's Demos key.
+ */
+export { anchorEncryptedTranscript, anchorProgramName, decryptAnchoredTranscript, verifyAnchorIntegrity, type AnchorEncryptedTranscriptOpts, type DecryptAnchoredTranscriptOpts, type VerifyAnchorIntegrityResult, } from "./anchor";
+export type { AnchoredTranscriptPayload, AnchoredTranscriptSignature, AttestationRef, TranscriptDisclosurePolicy, } from "./types";

package/build/l2ps/anchor/index.js

@@ -0,0 +1,10 @@
+/**
+ * DACS-3 §8.7 — encrypted transcript anchoring (SR-4 WI-3).
+ *
+ * Encrypts a `ChannelTranscript` to the subnet member set via the
+ * existing L2PS AES-GCM key, anchors the ciphertext + public content hash
+ * via SR-2 Storage Program, and signs the transcript-plaintext hash with
+ * the caller's Demos key.
+ */
+export { anchorEncryptedTranscript, anchorProgramName, decryptAnchoredTranscript, verifyAnchorIntegrity, } from "./anchor.js";
+//# sourceMappingURL=index.js.map

package/build/l2ps/anchor/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/l2ps/anchor/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACH,yBAAyB,EACzB,iBAAiB,EACjB,yBAAyB,EACzB,qBAAqB,GAIxB,MAAM,UAAU,CAAA"}

package/build/l2ps/anchor/types.d.ts

@@ -0,0 +1,36 @@
+import type { ClaimReference } from "../../identity/cci";
+import type { L2PSEncryptedBytes } from "../l2ps";
+/**
+ * §8.7 disclosure policy values. Naming verbatim from the brief.
+ */
+export type TranscriptDisclosurePolicy = "none" | "encrypted-anchored-recommended" | "encrypted-anchored-required";
+/**
+ * The reference the negotiate-* phase output carries (brief §2 WI-3 step 4):
+ * a Storage Program address + a hex content hash that anyone can re-derive
+ * by hashing the on-chain ciphertext.
+ */
+export interface AttestationRef {
+    anchor: string;
+    contentHash: string;
+}
+/**
+ * Signature over the transcript-plaintext hash, written verbatim into the
+ * Storage Program so members can re-verify after decryption.
+ */
+export interface AnchoredTranscriptSignature {
+    sigVersion: "1";
+    signer: ClaimReference;
+    signature: string;
+}
+/**
+ * Wire shape stored inside the Storage Program. Self-contained so a
+ * verifier can run `verifyAnchorIntegrity` without prior context.
+ */
+export interface AnchoredTranscriptPayload {
+    transcriptVersion: "1";
+    channelId: string;
+    encrypted: L2PSEncryptedBytes;
+    /** Hex sha256 of the decoded ciphertext bytes — public tamper-evidence. */
+    contentHash: string;
+    signature: AnchoredTranscriptSignature;
+}

package/build/l2ps/anchor/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/l2ps/anchor/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/l2ps/anchor/types.ts"],"names":[],"mappings":""}

package/build/l2ps/binding/binding.d.ts

@@ -0,0 +1,72 @@
+import { type ClaimReference } from "../../identity/cci";
+import { Demos } from "../../websdk/demosclass";
+import type { L2PSMembershipBinding } from "./types";
+import L2PS from "../l2ps";
+/**
+ * Deterministic Storage Program name for `(channelId, subnetMemberId)`.
+ * Public so `resolveMember` can re-derive it; included verbatim in tests.
+ *
+ * Components are percent-encoded so the layout stays one-to-one. Without
+ * this guard, the pairs `("a:b", "c")` and `("a", "b:c")` would collide on
+ * the same SP name and `resolveMember` could be tricked into returning a
+ * binding from one channel/member context for a lookup of another.
+ */
+export declare function bindingProgramName(channelId: string, subnetMemberId: string): string;
+/**
+ * Brief calls subnetMemberId "the member's L2PS/RSA identity within the
+ * subnet". L2PS already publishes a stable fingerprint of the RSA key —
+ * we reuse that so the value is derivable on both sides without a separate
+ * registry.
+ */
+export declare function subnetMemberIdFromL2PS(l2ps: L2PS): Promise<string>;
+export interface CreateMembershipBindingOpts {
+    channelId: string;
+    subnetMemberId: string;
+    claim: ClaimReference;
+    demos: Demos;
+    /** Defaults to Date.now(). Useful for deterministic test fixtures. */
+    boundAt?: number;
+}
+/**
+ * Build and sign a binding. The signature is produced by the key
+ * controlling `claim`. Throws if `claim`'s scheme is not `demos:` or if
+ * the controlling address does not match the connected wallet — the
+ * invariant that ties channel signatures to on-chain identity.
+ */
+export declare function createMembershipBinding(opts: CreateMembershipBindingOpts): Promise<L2PSMembershipBinding>;
+/**
+ * Pure signature check — no chain access. Verifies the embedded signature
+ * against the Demos public key encoded in `cciPrimaryClaim`.
+ *
+ * Returns `false` (not throws) on any structural problem so callers can
+ * use it as a filter when iterating SP candidates in `resolveMember`.
+ */
+export declare function verifyMembershipBinding(binding: L2PSMembershipBinding): boolean;
+export interface AnchorMembershipBindingResult {
+    storageAddress: string;
+    txHash: string;
+}
+/**
+ * Anchor a signed binding to chain via SR-2 (Storage Program). The SP is
+ * deployed under `bindingProgramName(...)` so `resolveMember` can find it
+ * by name. The deployer (= connected Demos wallet) becomes the SP owner;
+ * that owner check is what makes the resolver safe against impostor SPs
+ * published under the same name.
+ *
+ * Returns once the broadcast succeeds. Callers that need on-chain finality
+ * should poll the returned tx hash before opening the channel.
+ */
+export declare function anchorMembershipBinding(binding: L2PSMembershipBinding, demos: Demos): Promise<AnchorMembershipBindingResult>;
+/**
+ * Find the bound `ClaimReference` for `(channelId, subnetMemberId)`.
+ *
+ * Two-stage check on every candidate Storage Program:
+ *   1. Embedded signature verifies under the embedded claim's key.
+ *   2. SP owner's Demos address matches that claim's address — so only
+ *      the actual key-holder could have deployed this SP under this name.
+ *
+ * Both checks must pass. Returns `null` when no candidate qualifies.
+ * Membership is fixed for channel lifetime (CH-1) so callers SHOULD cache
+ * the result for the session.
+ */
+export declare function resolveMember(channelId: string, subnetMemberId: string, rpcUrl: string): Promise<ClaimReference | null>;