@kynesyslabs/demosdk 4.0.9 → 4.0.11

package/build/l2ps/binding/binding.js

@@ -0,0 +1,160 @@
+import { demosAddressFromClaim, isDemosClaim, normalizeDemosAddress, signWithPrimaryClaim, verifyPrimaryClaimSignature, } from "../../identity/cci/index.js";
+import { DemosTransactions } from "../../websdk/DemosTransactions.js";
+import { StorageProgram } from "../../storage/StorageProgram.js";
+import { bindingSigningBytes, signatureFromHex, signatureToHex, stripBindingSignature, } from "./canonical.js";
+/**
+ * Deterministic Storage Program name for `(channelId, subnetMemberId)`.
+ * Public so `resolveMember` can re-derive it; included verbatim in tests.
+ *
+ * Components are percent-encoded so the layout stays one-to-one. Without
+ * this guard, the pairs `("a:b", "c")` and `("a", "b:c")` would collide on
+ * the same SP name and `resolveMember` could be tricked into returning a
+ * binding from one channel/member context for a lookup of another.
+ */
+export function bindingProgramName(channelId, subnetMemberId) {
+    return `l2ps-binding:${encodeURIComponent(channelId)}:${encodeURIComponent(subnetMemberId)}`;
+}
+/**
+ * Brief calls subnetMemberId "the member's L2PS/RSA identity within the
+ * subnet". L2PS already publishes a stable fingerprint of the RSA key —
+ * we reuse that so the value is derivable on both sides without a separate
+ * registry.
+ */
+export async function subnetMemberIdFromL2PS(l2ps) {
+    return await l2ps.getKeyFingerprint();
+}
+/**
+ * Build and sign a binding. The signature is produced by the key
+ * controlling `claim`. Throws if `claim`'s scheme is not `demos:` or if
+ * the controlling address does not match the connected wallet — the
+ * invariant that ties channel signatures to on-chain identity.
+ */
+export async function createMembershipBinding(opts) {
+    const { channelId, subnetMemberId, claim, demos } = opts;
+    if (!channelId)
+        throw new Error("createMembershipBinding: channelId required");
+    if (!subnetMemberId)
+        throw new Error("createMembershipBinding: subnetMemberId required");
+    if (!isDemosClaim(claim))
+        throw new Error(`createMembershipBinding: claim must be a "demos:..." ClaimReference, got "${claim}"`);
+    const boundAt = opts.boundAt ?? Date.now();
+    if (!Number.isSafeInteger(boundAt) || boundAt < 0)
+        throw new Error("createMembershipBinding: boundAt must be a non-negative safe-integer unix-ms timestamp");
+    const unsigned = {
+        bindingVersion: "1",
+        channelId,
+        subnetMemberId,
+        cciPrimaryClaim: claim,
+        boundAt,
+    };
+    const payload = bindingSigningBytes(unsigned);
+    const sig = await signWithPrimaryClaim(claim, payload, demos);
+    return { ...unsigned, signature: signatureToHex(sig) };
+}
+/**
+ * Pure signature check — no chain access. Verifies the embedded signature
+ * against the Demos public key encoded in `cciPrimaryClaim`.
+ *
+ * Returns `false` (not throws) on any structural problem so callers can
+ * use it as a filter when iterating SP candidates in `resolveMember`.
+ */
+export function verifyMembershipBinding(binding) {
+    if (binding?.bindingVersion !== "1")
+        return false;
+    if (!binding.channelId || !binding.subnetMemberId)
+        return false;
+    if (!isDemosClaim(binding.cciPrimaryClaim))
+        return false;
+    if (!Number.isSafeInteger(binding.boundAt) ||
+        binding.boundAt < 0)
+        return false;
+    if (typeof binding.signature !== "string" || !binding.signature)
+        return false;
+    try {
+        const payload = bindingSigningBytes(stripBindingSignature(binding));
+        const sig = signatureFromHex(binding.signature);
+        return verifyPrimaryClaimSignature(binding.cciPrimaryClaim, payload, sig);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Anchor a signed binding to chain via SR-2 (Storage Program). The SP is
+ * deployed under `bindingProgramName(...)` so `resolveMember` can find it
+ * by name. The deployer (= connected Demos wallet) becomes the SP owner;
+ * that owner check is what makes the resolver safe against impostor SPs
+ * published under the same name.
+ *
+ * Returns once the broadcast succeeds. Callers that need on-chain finality
+ * should poll the returned tx hash before opening the channel.
+ */
+export async function anchorMembershipBinding(binding, demos) {
+    if (!verifyMembershipBinding(binding))
+        throw new Error("anchorMembershipBinding: refusing to anchor an unverifiable binding");
+    const claimAddress = demosAddressFromClaim(binding.cciPrimaryClaim);
+    const connected = normalizeDemosAddress(await demos.getEd25519Address());
+    if (claimAddress !== connected)
+        throw new Error(`anchorMembershipBinding: claim "${binding.cciPrimaryClaim}" does not match connected wallet ${connected}`);
+    const nonce = (await demos.getAddressNonce(connected)) + 1;
+    const payload = StorageProgram.createStorageProgram(connected, bindingProgramName(binding.channelId, binding.subnetMemberId), binding, "json", { mode: "public" }, { nonce });
+    const tx = DemosTransactions.empty();
+    tx.content.to = payload.storageAddress;
+    tx.content.nonce = nonce;
+    tx.content.amount = 0;
+    tx.content.type = "storageProgram";
+    tx.content.timestamp = Date.now();
+    tx.content.data = ["storageProgram", payload];
+    const signed = await demos.sign(tx);
+    const validity = await demos.confirm(signed);
+    await demos.broadcast(validity);
+    return { storageAddress: payload.storageAddress, txHash: signed.hash };
+}
+/**
+ * Find the bound `ClaimReference` for `(channelId, subnetMemberId)`.
+ *
+ * Two-stage check on every candidate Storage Program:
+ *   1. Embedded signature verifies under the embedded claim's key.
+ *   2. SP owner's Demos address matches that claim's address — so only
+ *      the actual key-holder could have deployed this SP under this name.
+ *
+ * Both checks must pass. Returns `null` when no candidate qualifies.
+ * Membership is fixed for channel lifetime (CH-1) so callers SHOULD cache
+ * the result for the session.
+ */
+export async function resolveMember(channelId, subnetMemberId, rpcUrl) {
+    const name = bindingProgramName(channelId, subnetMemberId);
+    const list = await StorageProgram.searchByName(rpcUrl, name, {
+        exactMatch: true,
+    });
+    for (const item of list) {
+        const sp = await StorageProgram.getByAddress(rpcUrl, item.storageAddress);
+        if (sp?.encoding !== "json" || !sp.data)
+            continue;
+        if (typeof sp.data !== "object")
+            continue;
+        const binding = sp.data;
+        if (binding.channelId !== channelId)
+            continue;
+        if (binding.subnetMemberId !== subnetMemberId)
+            continue;
+        if (!verifyMembershipBinding(binding))
+            continue;
+        // Both parses are inside the same try so a single adversarially-
+        // crafted candidate (malformed claim ref OR malformed sp.owner)
+        // gets skipped instead of aborting the whole resolution loop —
+        // otherwise a squatter publishing a poisoned binding under our
+        // deterministic name could deny-of-service every consumer.
+        try {
+            const claimAddress = demosAddressFromClaim(binding.cciPrimaryClaim);
+            if (normalizeDemosAddress(sp.owner) !== claimAddress)
+                continue;
+        }
+        catch {
+            continue;
+        }
+        return binding.cciPrimaryClaim;
+    }
+    return null;
+}
+//# sourceMappingURL=binding.js.map

package/build/l2ps/binding/binding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding.js","sourceRoot":"","sources":["../../../../src/l2ps/binding/binding.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,qBAAqB,EACrB,YAAY,EACZ,qBAAqB,EACrB,oBAAoB,EACpB,2BAA2B,GAE9B,MAAM,gBAAgB,CAAA;AAEvB,OAAO,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAMzD,OAAO,EACH,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,qBAAqB,GACxB,MAAM,aAAa,CAAA;AAGpB;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAC9B,SAAiB,EACjB,cAAsB;IAEtB,OAAO,gBAAgB,kBAAkB,CAAC,SAAS,CAAC,IAAI,kBAAkB,CACtE,cAAc,CACjB,EAAE,CAAA;AACP,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAAU;IACnD,OAAO,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAA;AACzC,CAAC;AAWD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CACzC,IAAiC;IAEjC,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,CAAA;IACxD,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAC9E,IAAI,CAAC,cAAc;QACf,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAA;IACvE,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QACpB,MAAM,IAAI,KAAK,CACX,6EAA6E,KAAK,GAAG,CACxF,CAAA;IAEL,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,CAAA;IAC1C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;QAC7C,MAAM,IAAI,KAAK,CACX,wFAAwF,CAC3F,CAAA;IAEL,MAAM,QAAQ,GAAkC;QAC5C,cAAc,EAAE,GAAG;QACnB,SAAS;QACT,cAAc;QACd,eAAe,EAAE,KAAK;QACtB,OAAO;KACV,CAAA;IAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAA;IAC7C,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;IAE7D,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,CAAA;AAC1D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACnC,OAA8B;IAE9B,IAAI,OAAO,EAAE,cAAc,KAAK,GAAG;QAAE,OAAO,KAAK,CAAA;IACjD,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,cAAc;QAAE,OAAO,KAAK,CAAA;IAC/D,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,eAAe,CAAC;QAAE,OAAO,KAAK,CAAA;IACxD,IACI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC;QACrC,OAAO,CAAC,OAAkB,GAAG,CAAC;QAE/B,OAAO,KAAK,CAAA;IAChB,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,SAAS;QAC3D,OAAO,KAAK,CAAA;IAEhB,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAA;QACnE,MAAM,GAAG,GAAG,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAC/C,OAAO,2BAA2B,CAC9B,OAAO,CAAC,eAAe,EACvB,OAAO,EACP,GAAG,CACN,CAAA;IACL,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAA;IAChB,CAAC;AACL,CAAC;AAOD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CACzC,OAA8B,EAC9B,KAAY;IAEZ,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC;QACjC,MAAM,IAAI,KAAK,CACX,qEAAqE,CACxE,CAAA;IAEL,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;IACnE,MAAM,SAAS,GAAG,qBAAqB,CAAC,MAAM,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAA;IACxE,IAAI,YAAY,KAAK,SAAS;QAC1B,MAAM,IAAI,KAAK,CACX,mCAAmC,OAAO,CAAC,eAAe,qCAAqC,SAAS,EAAE,CAC7G,CAAA;IAEL,MAAM,KAAK,GAAG,CAAC,MAAM,KAAK,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAA;IAC1D,MAAM,OAAO,GAAG,cAAc,CAAC,oBAAoB,CAC/C,SAAS,EACT,kBAAkB,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,cAAc,CAAC,EAC7D,OAA6C,EAC7C,MAAM,EACN,EAAE,IAAI,EAAE,QAAQ,EAAE,EAClB,EAAE,KAAK,EAAE,CACZ,CAAA;IAED,MAAM,EAAE,GAAG,iBAAiB,CAAC,KAAK,EAAiB,CAAA;IACnD,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,cAAc,CAAA;IACtC,EAAE,CAAC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAA;IACxB,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAA;IACrB,EAAE,CAAC,OAAO,CAAC,IAAI,GAAG,gBAAgB,CAAA;IAClC,EAAE,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACjC,EAAE,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAQ,CAAA;IAEpD,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACnC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAC5C,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;IAE/B,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;AAC1E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAC/B,SAAiB,EACjB,cAAsB,EACtB,MAAc;IAEd,MAAM,IAAI,GAAG,kBAAkB,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1D,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE;QACzD,UAAU,EAAE,IAAI;KACnB,CAAC,CAAA;IAEF,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,CAAA;QACzE,IAAI,EAAE,EAAE,QAAQ,KAAK,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI;YAAE,SAAQ;QACjD,IAAI,OAAO,EAAE,CAAC,IAAI,KAAK,QAAQ;YAAE,SAAQ;QAEzC,MAAM,OAAO,GAAG,EAAE,CAAC,IAAwC,CAAA;QAC3D,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;YAAE,SAAQ;QAC7C,IAAI,OAAO,CAAC,cAAc,KAAK,cAAc;YAAE,SAAQ;QACvD,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC;YAAE,SAAQ;QAE/C,iEAAiE;QACjE,gEAAgE;QAChE,+DAA+D;QAC/D,+DAA+D;QAC/D,2DAA2D;QAC3D,IAAI,CAAC;YACD,MAAM,YAAY,GAAG,qBAAqB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAA;YACnE,IAAI,qBAAqB,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,YAAY;gBAAE,SAAQ;QAClE,CAAC;QAAC,MAAM,CAAC;YACL,SAAQ;QACZ,CAAC;QAED,OAAO,OAAO,CAAC,eAAe,CAAA;IAClC,CAAC;IAED,OAAO,IAAI,CAAA;AACf,CAAC"}

package/build/l2ps/binding/canonical.d.ts

@@ -0,0 +1,19 @@
+import { signatureFromHex, signatureToHex } from "../utils/hex";
+import type { L2PSMembershipBinding, UnsignedL2PSMembershipBinding } from "./types";
+/**
+ * Domain prefix for binding signatures. The brief specifies prefixes for
+ * channelmsg and transcript but not for the binding itself; per §5 of the
+ * brief, all signatures in this family must be domain-separated, so we
+ * align with the established `dacs-*:v1:` pattern.
+ */
+export declare const BINDING_DOMAIN_PREFIX = "dacs-binding:v1:";
+/**
+ * Bytes that the binding signature covers:
+ *   `dacs-binding:v1:` || sha256(JCS(binding_without_signature))
+ *
+ * Domain separation prevents this signature from being lifted into a
+ * channelmsg or transcript context (or vice versa).
+ */
+export declare function bindingSigningBytes(unsigned: UnsignedL2PSMembershipBinding): Uint8Array;
+export declare function stripBindingSignature(b: L2PSMembershipBinding): UnsignedL2PSMembershipBinding;
+export { signatureFromHex, signatureToHex };

package/build/l2ps/binding/canonical.js

@@ -0,0 +1,30 @@
+import { sha256 } from "@noble/hashes/sha2";
+import { canonicalJSONStringify } from "../../websdk/utils/canonicalJson.js";
+import { bytesToHex, signatureFromHex, signatureToHex } from "../utils/hex.js";
+/**
+ * Domain prefix for binding signatures. The brief specifies prefixes for
+ * channelmsg and transcript but not for the binding itself; per §5 of the
+ * brief, all signatures in this family must be domain-separated, so we
+ * align with the established `dacs-*:v1:` pattern.
+ */
+export const BINDING_DOMAIN_PREFIX = "dacs-binding:v1:";
+/**
+ * Bytes that the binding signature covers:
+ *   `dacs-binding:v1:` || sha256(JCS(binding_without_signature))
+ *
+ * Domain separation prevents this signature from being lifted into a
+ * channelmsg or transcript context (or vice versa).
+ */
+export function bindingSigningBytes(unsigned) {
+    const canonical = canonicalJSONStringify(unsigned);
+    const digestHex = bytesToHex(sha256(new TextEncoder().encode(canonical)));
+    return new TextEncoder().encode(BINDING_DOMAIN_PREFIX + digestHex);
+}
+export function stripBindingSignature(b) {
+    const { signature: _signature, ...rest } = b;
+    return rest;
+}
+// Re-exported from the shared utility so existing imports of
+// `signatureFromHex` / `signatureToHex` from this module keep working.
+export { signatureFromHex, signatureToHex };
+//# sourceMappingURL=canonical.js.map

package/build/l2ps/binding/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../../../src/l2ps/binding/canonical.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AACrE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAM3E;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,kBAAkB,CAAA;AAEvD;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAC/B,QAAuC;IAEvC,MAAM,SAAS,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAA;IAClD,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;IACzE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAAA;AACtE,CAAC;AAED,MAAM,UAAU,qBAAqB,CACjC,CAAwB;IAExB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAA;IAC5C,OAAO,IAAI,CAAA;AACf,CAAC;AAED,6DAA6D;AAC7D,uEAAuE;AACvE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAA"}

package/build/l2ps/binding/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * L2PS membership binding — DACS-3 §8.3.2 (SR-4 WI-1).
+ *
+ * Anchors `(channelId, subnetMemberId) -> CCI ClaimReference` proofs to
+ * chain via SR-2 Storage Programs so channel signatures can be verified
+ * against the same identity used in DACS-2.
+ */
+export { BINDING_DOMAIN_PREFIX, bindingSigningBytes, signatureFromHex, signatureToHex, stripBindingSignature, } from "./canonical";
+export type { L2PSMembershipBinding, UnsignedL2PSMembershipBinding, } from "./types";
+export { anchorMembershipBinding, bindingProgramName, createMembershipBinding, resolveMember, subnetMemberIdFromL2PS, verifyMembershipBinding, type AnchorMembershipBindingResult, type CreateMembershipBindingOpts, } from "./binding";

package/build/l2ps/binding/index.js

@@ -0,0 +1,10 @@
+/**
+ * L2PS membership binding — DACS-3 §8.3.2 (SR-4 WI-1).
+ *
+ * Anchors `(channelId, subnetMemberId) -> CCI ClaimReference` proofs to
+ * chain via SR-2 Storage Programs so channel signatures can be verified
+ * against the same identity used in DACS-2.
+ */
+export { BINDING_DOMAIN_PREFIX, bindingSigningBytes, signatureFromHex, signatureToHex, stripBindingSignature, } from "./canonical.js";
+export { anchorMembershipBinding, bindingProgramName, createMembershipBinding, resolveMember, subnetMemberIdFromL2PS, verifyMembershipBinding, } from "./binding.js";
+//# sourceMappingURL=index.js.map

package/build/l2ps/binding/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/l2ps/binding/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACH,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,qBAAqB,GACxB,MAAM,aAAa,CAAA;AAOpB,OAAO,EACH,uBAAuB,EACvB,kBAAkB,EAClB,uBAAuB,EACvB,aAAa,EACb,sBAAsB,EACtB,uBAAuB,GAG1B,MAAM,WAAW,CAAA"}

package/build/l2ps/binding/types.d.ts

@@ -0,0 +1,20 @@
+import type { ClaimReference } from "../../identity/cci";
+/**
+ * DACS-3 §8.3.2 interim membership binding.
+ *
+ * Until L2PS is natively CCI-keyed, each subnet member publishes one of
+ * these so channel signatures can be tied back to the same identity used
+ * in DACS-2. The signature MUST be produced by the key controlling
+ * `cciPrimaryClaim` — on Demos, the Demos Ed25519 key (NOT the RSA subnet
+ * key the L2PS class is configured with).
+ */
+export interface L2PSMembershipBinding {
+    bindingVersion: "1";
+    channelId: string;
+    subnetMemberId: string;
+    cciPrimaryClaim: ClaimReference;
+    boundAt: number;
+    /** Hex (0x-prefixed) Ed25519 signature over `bindingSigningBytes`. */
+    signature: string;
+}
+export type UnsignedL2PSMembershipBinding = Omit<L2PSMembershipBinding, "signature">;

package/build/l2ps/binding/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/l2ps/binding/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/l2ps/binding/types.ts"],"names":[],"mappings":""}

package/build/l2ps/channel/canonical.d.ts

@@ -0,0 +1,24 @@
+import { signatureFromHex, signatureToHex } from "../utils/hex";
+import type { ChannelMessage, ChannelTranscript, UnsignedChannelMessage, UnsignedChannelTranscript } from "./types";
+/**
+ * Domain separation prefixes — verbatim from the brief (§2 WI-2, WI-3) and
+ * the spec references at §B.7. A signature lifted from one domain (e.g.
+ * channelmsg) fails verification in any other (e.g. transcript / binding).
+ */
+export declare const CHANNEL_MESSAGE_DOMAIN_PREFIX = "dacs-channelmsg:v1:";
+export declare const TRANSCRIPT_DOMAIN_PREFIX = "dacs-transcript:v1:";
+/**
+ * Hex digest of `JCS(envelope_without_signature)`. Exposed as a primitive
+ * so auditors can re-derive the hash independently from the wire envelope.
+ */
+export declare function envelopeHashHex(unsigned: UnsignedChannelMessage): string;
+/**
+ * Bytes the channel-message signature covers:
+ *   `dacs-channelmsg:v1:` || envelope_hash_hex
+ */
+export declare function channelMessageSigningBytes(unsigned: UnsignedChannelMessage): Uint8Array;
+export declare function stripChannelMessageSignature(msg: ChannelMessage): UnsignedChannelMessage;
+export declare function transcriptHashHex(unsigned: UnsignedChannelTranscript): string;
+export declare function transcriptSigningBytes(unsigned: UnsignedChannelTranscript): Uint8Array;
+export declare function stripTranscriptSignatures(t: ChannelTranscript): UnsignedChannelTranscript;
+export { signatureFromHex, signatureToHex };

package/build/l2ps/channel/canonical.js

@@ -0,0 +1,44 @@
+import { sha256 } from "@noble/hashes/sha2";
+import { canonicalJSONStringify } from "../../websdk/utils/canonicalJson.js";
+import { bytesToHex, signatureFromHex, signatureToHex } from "../utils/hex.js";
+/**
+ * Domain separation prefixes — verbatim from the brief (§2 WI-2, WI-3) and
+ * the spec references at §B.7. A signature lifted from one domain (e.g.
+ * channelmsg) fails verification in any other (e.g. transcript / binding).
+ */
+export const CHANNEL_MESSAGE_DOMAIN_PREFIX = "dacs-channelmsg:v1:";
+export const TRANSCRIPT_DOMAIN_PREFIX = "dacs-transcript:v1:";
+/**
+ * Hex digest of `JCS(envelope_without_signature)`. Exposed as a primitive
+ * so auditors can re-derive the hash independently from the wire envelope.
+ */
+export function envelopeHashHex(unsigned) {
+    const canonical = canonicalJSONStringify(unsigned);
+    return bytesToHex(sha256(new TextEncoder().encode(canonical)));
+}
+/**
+ * Bytes the channel-message signature covers:
+ *   `dacs-channelmsg:v1:` || envelope_hash_hex
+ */
+export function channelMessageSigningBytes(unsigned) {
+    return new TextEncoder().encode(CHANNEL_MESSAGE_DOMAIN_PREFIX + envelopeHashHex(unsigned));
+}
+export function stripChannelMessageSignature(msg) {
+    const { signature: _signature, ...rest } = msg;
+    return rest;
+}
+export function transcriptHashHex(unsigned) {
+    const canonical = canonicalJSONStringify(unsigned);
+    return bytesToHex(sha256(new TextEncoder().encode(canonical)));
+}
+export function transcriptSigningBytes(unsigned) {
+    return new TextEncoder().encode(TRANSCRIPT_DOMAIN_PREFIX + transcriptHashHex(unsigned));
+}
+export function stripTranscriptSignatures(t) {
+    const { signatures: _signatures, ...rest } = t;
+    return rest;
+}
+// Re-exported from the shared utility so existing imports of
+// `signatureFromHex` / `signatureToHex` from this module keep working.
+export { signatureFromHex, signatureToHex };
+//# sourceMappingURL=canonical.js.map

package/build/l2ps/channel/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../../../src/l2ps/channel/canonical.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAA;AACrE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAQ3E;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,qBAAqB,CAAA;AAClE,MAAM,CAAC,MAAM,wBAAwB,GAAG,qBAAqB,CAAA;AAE7D;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgC;IAC5D,MAAM,SAAS,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAA;IAClD,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACtC,QAAgC;IAEhC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAC3B,6BAA6B,GAAG,eAAe,CAAC,QAAQ,CAAC,CAC5D,CAAA;AACL,CAAC;AAED,MAAM,UAAU,4BAA4B,CACxC,GAAmB;IAEnB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAA;IAC9C,OAAO,IAAI,CAAA;AACf,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC7B,QAAmC;IAEnC,MAAM,SAAS,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAA;IAClD,OAAO,UAAU,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAA;AAClE,CAAC;AAED,MAAM,UAAU,sBAAsB,CAClC,QAAmC;IAEnC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAC3B,wBAAwB,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CACzD,CAAA;AACL,CAAC;AAED,MAAM,UAAU,yBAAyB,CACrC,CAAoB;IAEpB,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,CAAA;IAC9C,OAAO,IAAI,CAAA;AACf,CAAC;AAED,6DAA6D;AAC7D,uEAAuE;AACvE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAA"}

package/build/l2ps/channel/channelIdRegistry.d.ts

@@ -0,0 +1,19 @@
+/**
+ * CH-6 per-session channelId uniqueness — pluggable persistence.
+ *
+ * The substrate (L2PS subnet UID) already produces a unique value per
+ * session in honest deployments, but the brief requires explicit rejection
+ * of any session reusing a prior `channelId`. SDK ships an in-memory
+ * default; production callers wire their own store (durable DB, chain
+ * lookup, app-side persistence).
+ */
+export interface ChannelIdRegistry {
+    /** Throws if `channelId` has been registered before. */
+    register(channelId: string): Promise<void>;
+    has(channelId: string): Promise<boolean>;
+}
+export declare class InMemoryChannelIdRegistry implements ChannelIdRegistry {
+    private readonly seen;
+    register(channelId: string): Promise<void>;
+    has(channelId: string): Promise<boolean>;
+}

package/build/l2ps/channel/channelIdRegistry.js

@@ -0,0 +1,16 @@
+export class InMemoryChannelIdRegistry {
+    constructor() {
+        this.seen = new Set();
+    }
+    async register(channelId) {
+        if (!channelId)
+            throw new Error("ChannelIdRegistry: channelId required");
+        if (this.seen.has(channelId))
+            throw new Error(`ChannelIdRegistry: channelId "${channelId}" already registered (CH-6 violation)`);
+        this.seen.add(channelId);
+    }
+    async has(channelId) {
+        return this.seen.has(channelId);
+    }
+}
+//# sourceMappingURL=channelIdRegistry.js.map

package/build/l2ps/channel/channelIdRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channelIdRegistry.js","sourceRoot":"","sources":["../../../../src/l2ps/channel/channelIdRegistry.ts"],"names":[],"mappings":"AAeA,MAAM,OAAO,yBAAyB;IAAtC;QACqB,SAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAc7C,CAAC;IAZG,KAAK,CAAC,QAAQ,CAAC,SAAiB;QAC5B,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAA;QACxE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YACxB,MAAM,IAAI,KAAK,CACX,iCAAiC,SAAS,uCAAuC,CACpF,CAAA;QACL,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IAC5B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAiB;QACvB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAA;IACnC,CAAC;CACJ"}

package/build/l2ps/channel/envelope.d.ts

@@ -0,0 +1,26 @@
+import { type ClaimReference } from "../../identity/cci";
+import { Demos } from "../../websdk/demosclass";
+import type { ChannelMessage, UnsignedChannelMessage } from "./types";
+/**
+ * Sign a `ChannelMessage` envelope with the sender's primary-claim key.
+ *
+ * The signature covers `dacs-channelmsg:v1:` || sha256(JCS(envelope w/o
+ * signature)). Transport-level wrappers MUST NOT alter the bytes returned
+ * here. Throws if `unsigned.sender` is not a demos: ClaimReference or
+ * does not match the connected wallet — preserves the
+ * in-channel-signer == on-chain-party invariant.
+ */
+export declare function signChannelMessage(unsigned: UnsignedChannelMessage, demos: Demos): Promise<ChannelMessage>;
+/**
+ * Pure signature check: verifies `msg.signature` covers JCS(msg without
+ * signature) with the `dacs-channelmsg:v1:` prefix under the key encoded
+ * in `msg.sender`. Membership (`sender ∈ members`) and sequence enforcement
+ * are handled by `ChannelSession` — this function does crypto only.
+ */
+export declare function verifyChannelMessage(msg: ChannelMessage): boolean;
+/**
+ * Pure membership check. Kept separate so `verifyChannelMessage` can be
+ * called in contexts where the member set hasn't been resolved yet (e.g.
+ * audit replay from a transcript).
+ */
+export declare function isSenderInMembers(msg: ChannelMessage, members: Iterable<ClaimReference>): boolean;

package/build/l2ps/channel/envelope.js

@@ -0,0 +1,62 @@
+import { isDemosClaim, signWithPrimaryClaim, verifyPrimaryClaimSignature, } from "../../identity/cci/index.js";
+import { channelMessageSigningBytes, signatureFromHex, signatureToHex, stripChannelMessageSignature, } from "./canonical.js";
+/**
+ * Sign a `ChannelMessage` envelope with the sender's primary-claim key.
+ *
+ * The signature covers `dacs-channelmsg:v1:` || sha256(JCS(envelope w/o
+ * signature)). Transport-level wrappers MUST NOT alter the bytes returned
+ * here. Throws if `unsigned.sender` is not a demos: ClaimReference or
+ * does not match the connected wallet — preserves the
+ * in-channel-signer == on-chain-party invariant.
+ */
+export async function signChannelMessage(unsigned, demos) {
+    if (!isDemosClaim(unsigned.sender))
+        throw new Error(`signChannelMessage: sender must be a demos: ClaimReference, got "${unsigned.sender}"`);
+    if (!Number.isInteger(unsigned.sequence) || unsigned.sequence < 1)
+        throw new Error(`signChannelMessage: sequence must be a positive integer (got ${unsigned.sequence})`);
+    if (!unsigned.channelId)
+        throw new Error("signChannelMessage: channelId required");
+    const payload = channelMessageSigningBytes(unsigned);
+    const sigBytes = await signWithPrimaryClaim(unsigned.sender, payload, demos);
+    const signature = {
+        sigVersion: "1",
+        signature: signatureToHex(sigBytes),
+    };
+    return { ...unsigned, signature };
+}
+/**
+ * Pure signature check: verifies `msg.signature` covers JCS(msg without
+ * signature) with the `dacs-channelmsg:v1:` prefix under the key encoded
+ * in `msg.sender`. Membership (`sender ∈ members`) and sequence enforcement
+ * are handled by `ChannelSession` — this function does crypto only.
+ */
+export function verifyChannelMessage(msg) {
+    if (msg?.signature?.sigVersion !== "1")
+        return false;
+    if (!isDemosClaim(msg.sender))
+        return false;
+    if (!Number.isInteger(msg.sequence) || msg.sequence < 1)
+        return false;
+    if (!msg.channelId)
+        return false;
+    try {
+        const payload = channelMessageSigningBytes(stripChannelMessageSignature(msg));
+        const sig = signatureFromHex(msg.signature.signature);
+        return verifyPrimaryClaimSignature(msg.sender, payload, sig);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Pure membership check. Kept separate so `verifyChannelMessage` can be
+ * called in contexts where the member set hasn't been resolved yet (e.g.
+ * audit replay from a transcript).
+ */
+export function isSenderInMembers(msg, members) {
+    for (const m of members)
+        if (m === msg.sender)
+            return true;
+    return false;
+}
+//# sourceMappingURL=envelope.js.map

package/build/l2ps/channel/envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.js","sourceRoot":"","sources":["../../../../src/l2ps/channel/envelope.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,YAAY,EACZ,oBAAoB,EACpB,2BAA2B,GAE9B,MAAM,gBAAgB,CAAA;AAOvB,OAAO,EACH,0BAA0B,EAC1B,gBAAgB,EAChB,cAAc,EACd,4BAA4B,GAC/B,MAAM,aAAa,CAAA;AAEpB;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACpC,QAAgC,EAChC,KAAY;IAEZ,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC9B,MAAM,IAAI,KAAK,CACX,oEAAoE,QAAQ,CAAC,MAAM,GAAG,CACzF,CAAA;IACL,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,QAAQ,GAAG,CAAC;QAC7D,MAAM,IAAI,KAAK,CACX,gEAAgE,QAAQ,CAAC,QAAQ,GAAG,CACvF,CAAA;IACL,IAAI,CAAC,QAAQ,CAAC,SAAS;QACnB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAA;IAE7D,MAAM,OAAO,GAAG,0BAA0B,CAAC,QAAQ,CAAC,CAAA;IACpD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;IAC5E,MAAM,SAAS,GAA4B;QACvC,UAAU,EAAE,GAAG;QACf,SAAS,EAAE,cAAc,CAAC,QAAQ,CAAC;KACtC,CAAA;IACD,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,CAAA;AACrC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAmB;IACpD,IAAI,GAAG,EAAE,SAAS,EAAE,UAAU,KAAK,GAAG;QAAE,OAAO,KAAK,CAAA;IACpD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAA;IAC3C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACrE,IAAI,CAAC,GAAG,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IAEhC,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,0BAA0B,CACtC,4BAA4B,CAAC,GAAG,CAAC,CACpC,CAAA;QACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAA;QACrD,OAAO,2BAA2B,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,CAAA;IAChE,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAA;IAChB,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC7B,GAAmB,EACnB,OAAiC;IAEjC,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,IAAI,CAAC,KAAK,GAAG,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;IAC1D,OAAO,KAAK,CAAA;AAChB,CAAC"}

package/build/l2ps/channel/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * DACS-3 §8.3.3 / §8.7 — channel message envelope, session-level
+ * sequence + channelId enforcement, transcript export (SR-4 WI-2).
+ *
+ * All signatures use the sender's primary-claim key (on Demos: the
+ * connected Demos Ed25519 keypair) via WI-0's `signWithPrimaryClaim`;
+ * never the RSA L2PS subnet key.
+ */
+export type { ChannelMessage, ChannelMessageSignature, ChannelMessageType, ChannelTranscript, TranscriptSignature, UnsignedChannelMessage, UnsignedChannelTranscript, } from "./types";
+export { CHANNEL_MESSAGE_DOMAIN_PREFIX, TRANSCRIPT_DOMAIN_PREFIX, channelMessageSigningBytes, envelopeHashHex, signatureFromHex, signatureToHex, stripChannelMessageSignature, stripTranscriptSignatures, transcriptHashHex, transcriptSigningBytes, } from "./canonical";
+export { isSenderInMembers, signChannelMessage, verifyChannelMessage, } from "./envelope";
+export { InMemoryChannelIdRegistry, type ChannelIdRegistry, } from "./channelIdRegistry";
+export { ChannelSession, type ChannelSessionOpts } from "./session";
+export { buildUnsignedTranscript, exportTranscript, signTranscript, verifyTranscript, type TranscriptVerificationResult, } from "./transcript";

package/build/l2ps/channel/index.js

@@ -0,0 +1,14 @@
+/**
+ * DACS-3 §8.3.3 / §8.7 — channel message envelope, session-level
+ * sequence + channelId enforcement, transcript export (SR-4 WI-2).
+ *
+ * All signatures use the sender's primary-claim key (on Demos: the
+ * connected Demos Ed25519 keypair) via WI-0's `signWithPrimaryClaim`;
+ * never the RSA L2PS subnet key.
+ */
+export { CHANNEL_MESSAGE_DOMAIN_PREFIX, TRANSCRIPT_DOMAIN_PREFIX, channelMessageSigningBytes, envelopeHashHex, signatureFromHex, signatureToHex, stripChannelMessageSignature, stripTranscriptSignatures, transcriptHashHex, transcriptSigningBytes, } from "./canonical.js";
+export { isSenderInMembers, signChannelMessage, verifyChannelMessage, } from "./envelope.js";
+export { InMemoryChannelIdRegistry, } from "./channelIdRegistry.js";
+export { ChannelSession } from "./session.js";
+export { buildUnsignedTranscript, exportTranscript, signTranscript, verifyTranscript, } from "./transcript.js";
+//# sourceMappingURL=index.js.map

package/build/l2ps/channel/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/l2ps/channel/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAYH,OAAO,EACH,6BAA6B,EAC7B,wBAAwB,EACxB,0BAA0B,EAC1B,eAAe,EACf,gBAAgB,EAChB,cAAc,EACd,4BAA4B,EAC5B,yBAAyB,EACzB,iBAAiB,EACjB,sBAAsB,GACzB,MAAM,aAAa,CAAA;AAEpB,OAAO,EACH,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,GACvB,MAAM,YAAY,CAAA;AAEnB,OAAO,EACH,yBAAyB,GAE5B,MAAM,qBAAqB,CAAA;AAE5B,OAAO,EAAE,cAAc,EAA2B,MAAM,WAAW,CAAA;AAEnE,OAAO,EACH,uBAAuB,EACvB,gBAAgB,EAChB,cAAc,EACd,gBAAgB,GAEnB,MAAM,cAAc,CAAA"}

package/build/l2ps/channel/session.d.ts

@@ -0,0 +1,66 @@
+import { Demos } from "../../websdk/demosclass";
+import type { ClaimReference } from "../../identity/cci";
+import type { ChannelMessage, ChannelMessageType } from "./types";
+import type { ChannelIdRegistry } from "./channelIdRegistry";
+export interface ChannelSessionOpts {
+    channelId: string;
+    members: ClaimReference[];
+    /** This party's primary claim — must be in `members`. */
+    me: ClaimReference;
+    demos: Demos;
+    /**
+     * Optional CH-6 enforcement. If provided, `open()` registers the
+     * channelId here and throws on reuse.
+     */
+    channelIdRegistry?: ChannelIdRegistry;
+}
+/**
+ * Per-channel session — owns the monotonic sequence counter and applies
+ * the four invariants from §8.3.3 / §8.12 on every message:
+ *
+ *   1. signature verifies under sender's CCI key
+ *   2. sender ∈ members (CH-1)
+ *   3. sequence is monotonic per channel (anti-replay)
+ *   4. channelId matches the session's channelId
+ *
+ * A single counter is shared across senders, as the brief specifies
+ * (`sequence: number  // monotonic per channel, starts at 1`). Outgoing
+ * messages get `current + 1`; incoming messages must use a sequence
+ * strictly greater than every value already seen.
+ */
+export declare class ChannelSession {
+    readonly channelId: string;
+    readonly members: ReadonlyArray<ClaimReference>;
+    readonly me: ClaimReference;
+    private readonly demos;
+    private readonly registry;
+    private opened;
+    private highestSeen;
+    private readonly transcript;
+    constructor(opts: ChannelSessionOpts);
+    /**
+     * Register the channelId (CH-6) and prepare for messaging. Idempotent
+     * within a session — calling twice throws via the registry.
+     */
+    open(): Promise<void>;
+    /**
+     * Build, sign, append-to-local-transcript, and return the next
+     * outgoing `ChannelMessage`. Sequence is `highestSeen + 1` so it is
+     * monotonic across both directions.
+     */
+    sendOutgoing(opts: {
+        type: ChannelMessageType;
+        body: unknown;
+        sentAt?: number;
+        repliesTo?: number;
+    }): Promise<ChannelMessage>;
+    /**
+     * Validate an incoming `ChannelMessage`. Throws with a precise reason
+     * on any failure — caller should treat throw as channel-fatal per
+     * §8.12 (a single tampered message invalidates the session's record).
+     */
+    receiveIncoming(msg: ChannelMessage): Promise<void>;
+    /** Read-only snapshot of all messages this session has signed or accepted. */
+    messages(): ReadonlyArray<ChannelMessage>;
+    private assertOpened;
+}