@kynesyslabs/demosdk 4.0.9 → 4.0.11

package/build/l2ps/channel/session.js

@@ -0,0 +1,101 @@
+import { isSenderInMembers, signChannelMessage, verifyChannelMessage, } from "./envelope.js";
+/**
+ * Per-channel session — owns the monotonic sequence counter and applies
+ * the four invariants from §8.3.3 / §8.12 on every message:
+ *
+ *   1. signature verifies under sender's CCI key
+ *   2. sender ∈ members (CH-1)
+ *   3. sequence is monotonic per channel (anti-replay)
+ *   4. channelId matches the session's channelId
+ *
+ * A single counter is shared across senders, as the brief specifies
+ * (`sequence: number  // monotonic per channel, starts at 1`). Outgoing
+ * messages get `current + 1`; incoming messages must use a sequence
+ * strictly greater than every value already seen.
+ */
+export class ChannelSession {
+    constructor(opts) {
+        this.opened = false;
+        this.highestSeen = 0;
+        this.transcript = [];
+        if (!opts.channelId)
+            throw new Error("ChannelSession: channelId required");
+        if (!opts.members?.length)
+            throw new Error("ChannelSession: members required");
+        if (!opts.members.includes(opts.me))
+            throw new Error(`ChannelSession: me (${opts.me}) is not in members`);
+        this.channelId = opts.channelId;
+        this.members = [...opts.members];
+        this.me = opts.me;
+        this.demos = opts.demos;
+        this.registry = opts.channelIdRegistry;
+    }
+    /**
+     * Register the channelId (CH-6) and prepare for messaging. Idempotent
+     * within a session — calling twice throws via the registry.
+     */
+    async open() {
+        if (this.opened)
+            throw new Error("ChannelSession: already opened");
+        if (this.registry)
+            await this.registry.register(this.channelId);
+        this.opened = true;
+    }
+    /**
+     * Build, sign, append-to-local-transcript, and return the next
+     * outgoing `ChannelMessage`. Sequence is `highestSeen + 1` so it is
+     * monotonic across both directions.
+     */
+    async sendOutgoing(opts) {
+        this.assertOpened();
+        // Reserve the sequence slot SYNCHRONOUSLY before any await — two
+        // concurrent sendOutgoing() calls would otherwise read the same
+        // `highestSeen`, sign two messages with identical sequence
+        // numbers, and silently violate the anti-replay invariant on the
+        // receiver side.
+        const sequence = ++this.highestSeen;
+        const unsigned = {
+            channelId: this.channelId,
+            sequence,
+            sender: this.me,
+            sentAt: opts.sentAt ?? Date.now(),
+            type: opts.type,
+            body: opts.body,
+            ...(opts.repliesTo !== undefined && {
+                refs: { repliesTo: opts.repliesTo },
+            }),
+        };
+        const signed = await signChannelMessage(unsigned, this.demos);
+        this.transcript.push(signed);
+        return signed;
+    }
+    /**
+     * Validate an incoming `ChannelMessage`. Throws with a precise reason
+     * on any failure — caller should treat throw as channel-fatal per
+     * §8.12 (a single tampered message invalidates the session's record).
+     */
+    async receiveIncoming(msg) {
+        this.assertOpened();
+        if (msg.channelId !== this.channelId)
+            throw new Error(`ChannelSession: channelId mismatch (expected ${this.channelId}, got ${msg.channelId})`);
+        if (!isSenderInMembers(msg, this.members))
+            throw new Error(`ChannelSession: sender "${msg.sender}" not in members (CH-1)`);
+        if (!Number.isInteger(msg.sequence) || msg.sequence < 1)
+            throw new Error(`ChannelSession: invalid sequence ${msg.sequence}`);
+        if (msg.sequence <= this.highestSeen)
+            throw new Error(`ChannelSession: non-monotonic sequence ${msg.sequence} (highest seen ${this.highestSeen})`);
+        if (!verifyChannelMessage(msg))
+            throw new Error("ChannelSession: signature verification failed");
+        this.highestSeen = msg.sequence;
+        this.transcript.push(msg);
+    }
+    /** Read-only snapshot of all messages this session has signed or accepted. */
+    messages() {
+        return this.transcript;
+    }
+    assertOpened() {
+        if (!this.opened)
+            throw new Error("ChannelSession: call open() before sending or receiving");
+    }
+}
+//# sourceMappingURL=session.js.map

package/build/l2ps/channel/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../../../src/l2ps/channel/session.ts"],"names":[],"mappings":"AAOA,OAAO,EACH,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,GACvB,MAAM,YAAY,CAAA;AAgBnB;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,cAAc;IAUvB,YAAY,IAAwB;QAJ5B,WAAM,GAAG,KAAK,CAAA;QACd,gBAAW,GAAG,CAAC,CAAA;QACN,eAAU,GAAqB,EAAE,CAAA;QAG9C,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QAC1E,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM;YACrB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAA;QACvD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACX,uBAAuB,IAAI,CAAC,EAAE,qBAAqB,CACtD,CAAA;QAEL,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAA;QAC/B,IAAI,CAAC,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAA;QAChC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,CAAA;QACjB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;QACvB,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAA;IAC1C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI;QACN,IAAI,IAAI,CAAC,MAAM;YACX,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;QACrD,IAAI,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC/D,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;IACtB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,IAKlB;QACG,IAAI,CAAC,YAAY,EAAE,CAAA;QACnB,iEAAiE;QACjE,gEAAgE;QAChE,2DAA2D;QAC3D,iEAAiE;QACjE,iBAAiB;QACjB,MAAM,QAAQ,GAAG,EAAE,IAAI,CAAC,WAAW,CAAA;QACnC,MAAM,QAAQ,GAA2B;YACrC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ;YACR,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE;YACjC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI;gBAChC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;aACtC,CAAC;SACL,CAAA;QACD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC5B,OAAO,MAAM,CAAA;IACjB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CAAC,GAAmB;QACrC,IAAI,CAAC,YAAY,EAAE,CAAA;QACnB,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS;YAChC,MAAM,IAAI,KAAK,CACX,gDAAgD,IAAI,CAAC,SAAS,SAAS,GAAG,CAAC,SAAS,GAAG,CAC1F,CAAA;QACL,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC;YACrC,MAAM,IAAI,KAAK,CACX,2BAA2B,GAAG,CAAC,MAAM,yBAAyB,CACjE,CAAA;QACL,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,GAAG,CAAC;YACnD,MAAM,IAAI,KAAK,CACX,oCAAoC,GAAG,CAAC,QAAQ,EAAE,CACrD,CAAA;QACL,IAAI,GAAG,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW;YAChC,MAAM,IAAI,KAAK,CACX,0CAA0C,GAAG,CAAC,QAAQ,kBAAkB,IAAI,CAAC,WAAW,GAAG,CAC9F,CAAA;QACL,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC;YAC1B,MAAM,IAAI,KAAK,CACX,+CAA+C,CAClD,CAAA;QACL,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAA;QAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC7B,CAAC;IAED,8EAA8E;IAC9E,QAAQ;QACJ,OAAO,IAAI,CAAC,UAAU,CAAA;IAC1B,CAAC;IAEO,YAAY;QAChB,IAAI,CAAC,IAAI,CAAC,MAAM;YACZ,MAAM,IAAI,KAAK,CACX,yDAAyD,CAC5D,CAAA;IACT,CAAC;CACJ"}

package/build/l2ps/channel/transcript.d.ts

@@ -0,0 +1,48 @@
+import { type ClaimReference } from "../../identity/cci";
+import { Demos } from "../../websdk/demosclass";
+import type { ChannelMessage, ChannelTranscript, TranscriptSignature, UnsignedChannelTranscript } from "./types";
+/**
+ * Build the unsigned transcript shell. Messages must already be in
+ * sequence order — typically `session.messages()`.
+ */
+export declare function buildUnsignedTranscript(opts: {
+    channelId: string;
+    members: ClaimReference[];
+    messages: ReadonlyArray<ChannelMessage>;
+    generatedAt?: number;
+}): UnsignedChannelTranscript;
+/**
+ * Produce one party's `TranscriptSignature` over the unsigned transcript.
+ * Domain-separated under `dacs-transcript:v1:` — cannot be confused with
+ * a channel-message or binding signature.
+ */
+export declare function signTranscript(unsigned: UnsignedChannelTranscript, signer: ClaimReference, demos: Demos): Promise<TranscriptSignature>;
+/**
+ * Convenience: assemble the full transcript with one or more party
+ * signatures. Pass signers in the order their signatures should appear.
+ */
+export declare function exportTranscript(opts: {
+    channelId: string;
+    members: ClaimReference[];
+    messages: ReadonlyArray<ChannelMessage>;
+    signers: Array<{
+        claim: ClaimReference;
+        demos: Demos;
+    }>;
+    generatedAt?: number;
+}): Promise<ChannelTranscript>;
+export interface TranscriptVerificationResult {
+    ok: boolean;
+    errors: string[];
+}
+/**
+ * Verify every claim about a transcript a non-member can check given only
+ * the public keys: (a) each `TranscriptSignature` is valid, (b) each
+ * `ChannelMessage` carries a valid signature, (c) every message's sender
+ * is in `members`, (d) sequences are strictly monotonic per channel,
+ * (e) every message's `channelId` matches the transcript.
+ *
+ * Returns a list of errors rather than throwing so auditors can collect
+ * every failure in one pass.
+ */
+export declare function verifyTranscript(t: ChannelTranscript): TranscriptVerificationResult;

package/build/l2ps/channel/transcript.js

@@ -0,0 +1,120 @@
+import { isDemosClaim, signWithPrimaryClaim, verifyPrimaryClaimSignature, } from "../../identity/cci/index.js";
+import { signatureFromHex, signatureToHex, stripTranscriptSignatures, transcriptSigningBytes, } from "./canonical.js";
+import { isSenderInMembers, verifyChannelMessage } from "./envelope.js";
+/**
+ * Build the unsigned transcript shell. Messages must already be in
+ * sequence order — typically `session.messages()`.
+ */
+export function buildUnsignedTranscript(opts) {
+    return {
+        transcriptVersion: "1",
+        channelId: opts.channelId,
+        members: [...opts.members],
+        messages: [...opts.messages],
+        generatedAt: opts.generatedAt ?? Date.now(),
+    };
+}
+/**
+ * Produce one party's `TranscriptSignature` over the unsigned transcript.
+ * Domain-separated under `dacs-transcript:v1:` — cannot be confused with
+ * a channel-message or binding signature.
+ */
+export async function signTranscript(unsigned, signer, demos) {
+    if (!isDemosClaim(signer))
+        throw new Error(`signTranscript: signer must be a demos: ClaimReference, got "${signer}"`);
+    const payload = transcriptSigningBytes(unsigned);
+    const sigBytes = await signWithPrimaryClaim(signer, payload, demos);
+    return {
+        sigVersion: "1",
+        signer,
+        signature: signatureToHex(sigBytes),
+    };
+}
+/**
+ * Convenience: assemble the full transcript with one or more party
+ * signatures. Pass signers in the order their signatures should appear.
+ */
+export async function exportTranscript(opts) {
+    const unsigned = buildUnsignedTranscript(opts);
+    const signatures = [];
+    for (const s of opts.signers) {
+        signatures.push(await signTranscript(unsigned, s.claim, s.demos));
+    }
+    return { ...unsigned, signatures };
+}
+/**
+ * Verify every claim about a transcript a non-member can check given only
+ * the public keys: (a) each `TranscriptSignature` is valid, (b) each
+ * `ChannelMessage` carries a valid signature, (c) every message's sender
+ * is in `members`, (d) sequences are strictly monotonic per channel,
+ * (e) every message's `channelId` matches the transcript.
+ *
+ * Returns a list of errors rather than throwing so auditors can collect
+ * every failure in one pass.
+ */
+export function verifyTranscript(t) {
+    const errors = [];
+    if (t?.transcriptVersion !== "1") {
+        errors.push("transcriptVersion is not 1");
+        return { ok: false, errors };
+    }
+    if (!t.channelId)
+        errors.push("missing channelId");
+    if (!t.members?.length)
+        errors.push("missing members");
+    let unsigned;
+    try {
+        unsigned = stripTranscriptSignatures(t);
+    }
+    catch {
+        errors.push("could not strip signatures");
+        return { ok: false, errors };
+    }
+    if (!t.signatures?.length) {
+        errors.push("no transcript signatures");
+    }
+    else {
+        const payload = transcriptSigningBytes(unsigned);
+        for (const s of t.signatures) {
+            if (s.sigVersion !== "1") {
+                errors.push(`transcript signature: unknown sigVersion ${s.sigVersion}`);
+                continue;
+            }
+            if (!t.members.includes(s.signer)) {
+                errors.push(`transcript signature signer "${s.signer}" not in members`);
+                continue;
+            }
+            try {
+                const ok = verifyPrimaryClaimSignature(s.signer, payload, signatureFromHex(s.signature));
+                if (!ok)
+                    errors.push(`transcript signature by "${s.signer}" failed verification`);
+            }
+            catch (e) {
+                errors.push(`transcript signature by "${s.signer}" malformed: ${e.message}`);
+            }
+        }
+    }
+    let highestSeen = 0;
+    for (const msg of t.messages ?? []) {
+        if (msg.channelId !== t.channelId) {
+            errors.push(`message seq=${msg.sequence}: channelId mismatch (${msg.channelId} vs ${t.channelId})`);
+        }
+        if (!isSenderInMembers(msg, t.members)) {
+            errors.push(`message seq=${msg.sequence}: sender "${msg.sender}" not in members`);
+        }
+        if (!Number.isInteger(msg.sequence) || msg.sequence < 1) {
+            errors.push(`message: invalid sequence ${msg.sequence}`);
+        }
+        else if (msg.sequence <= highestSeen) {
+            errors.push(`message seq=${msg.sequence}: non-monotonic (highest seen ${highestSeen})`);
+        }
+        else {
+            highestSeen = msg.sequence;
+        }
+        if (!verifyChannelMessage(msg)) {
+            errors.push(`message seq=${msg.sequence}: signature verification failed`);
+        }
+    }
+    return { ok: errors.length === 0, errors };
+}
+//# sourceMappingURL=transcript.js.map

package/build/l2ps/channel/transcript.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transcript.js","sourceRoot":"","sources":["../../../../src/l2ps/channel/transcript.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,YAAY,EACZ,oBAAoB,EACpB,2BAA2B,GAE9B,MAAM,gBAAgB,CAAA;AAQvB,OAAO,EACH,gBAAgB,EAChB,cAAc,EACd,yBAAyB,EACzB,sBAAsB,GACzB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEpE;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAKvC;IACG,OAAO;QACH,iBAAiB,EAAE,GAAG;QACtB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;QAC1B,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC5B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE;KAC9C,CAAA;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAChC,QAAmC,EACnC,MAAsB,EACtB,KAAY;IAEZ,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;QACrB,MAAM,IAAI,KAAK,CACX,gEAAgE,MAAM,GAAG,CAC5E,CAAA;IACL,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAA;IAChD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;IACnE,OAAO;QACH,UAAU,EAAE,GAAG;QACf,MAAM;QACN,SAAS,EAAE,cAAc,CAAC,QAAQ,CAAC;KACtC,CAAA;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,IAMtC;IACG,MAAM,QAAQ,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAA;IAC9C,MAAM,UAAU,GAA0B,EAAE,CAAA;IAC5C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QAC3B,UAAU,CAAC,IAAI,CAAC,MAAM,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;IACrE,CAAC;IACD,OAAO,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,CAAA;AACtC,CAAC;AAOD;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAC5B,CAAoB;IAEpB,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,IAAI,CAAC,EAAE,iBAAiB,KAAK,GAAG,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAA;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;IAChC,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IAClD,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAEtD,IAAI,QAAmC,CAAA;IACvC,IAAI,CAAC;QACD,QAAQ,GAAG,yBAAyB,CAAC,CAAC,CAAC,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACL,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAA;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;IAChC,CAAC;IAED,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;IAC3C,CAAC;SAAM,CAAC;QACJ,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAA;QAChD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;YAC3B,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC,UAAU,EAAE,CAAC,CAAA;gBACvE,SAAQ;YACZ,CAAC;YACD,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChC,MAAM,CAAC,IAAI,CACP,gCAAgC,CAAC,CAAC,MAAM,kBAAkB,CAC7D,CAAA;gBACD,SAAQ;YACZ,CAAC;YACD,IAAI,CAAC;gBACD,MAAM,EAAE,GAAG,2BAA2B,CAClC,CAAC,CAAC,MAAM,EACR,OAAO,EACP,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAChC,CAAA;gBACD,IAAI,CAAC,EAAE;oBACH,MAAM,CAAC,IAAI,CACP,4BAA4B,CAAC,CAAC,MAAM,uBAAuB,CAC9D,CAAA;YACT,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACT,MAAM,CAAC,IAAI,CACP,4BAA4B,CAAC,CAAC,MAAM,gBAAiB,CAAW,CAAC,OAAO,EAAE,CAC7E,CAAA;YACL,CAAC;QACL,CAAC;IACL,CAAC;IAED,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;QACjC,IAAI,GAAG,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CACP,eAAe,GAAG,CAAC,QAAQ,yBAAyB,GAAG,CAAC,SAAS,OAAO,CAAC,CAAC,SAAS,GAAG,CACzF,CAAA;QACL,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CACP,eAAe,GAAG,CAAC,QAAQ,aAAa,GAAG,CAAC,MAAM,kBAAkB,CACvE,CAAA;QACL,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;YACtD,MAAM,CAAC,IAAI,CAAC,6BAA6B,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;QAC5D,CAAC;aAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,WAAW,EAAE,CAAC;YACrC,MAAM,CAAC,IAAI,CACP,eAAe,GAAG,CAAC,QAAQ,iCAAiC,WAAW,GAAG,CAC7E,CAAA;QACL,CAAC;aAAM,CAAC;YACJ,WAAW,GAAG,GAAG,CAAC,QAAQ,CAAA;QAC9B,CAAC;QACD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CACP,eAAe,GAAG,CAAC,QAAQ,iCAAiC,CAC/D,CAAA;QACL,CAAC;IACL,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;AAC9C,CAAC"}

package/build/l2ps/channel/types.d.ts

@@ -0,0 +1,55 @@
+import type { ClaimReference } from "../../identity/cci";
+/**
+ * Allowed message types — verbatim from DACS-3 §8.3.3. Closed union by
+ * design: the substrate enforces the conformance set; application bodies
+ * are carried in `body: unknown`.
+ */
+export type ChannelMessageType = "offer" | "counter" | "accept" | "reject" | "sealed-envelope-commit" | "sealed-envelope-reveal" | "abort";
+/**
+ * Brief doesn't define the wire shape of the signature container. Versioned
+ * for forward compatibility (e.g. PQC swap-out) without breaking the
+ * envelope layout. Signature is hex-encoded over `channelMessageSigningBytes`.
+ */
+export interface ChannelMessageSignature {
+    sigVersion: "1";
+    signature: string;
+}
+/**
+ * DACS-3 §8.3.3 envelope — verbatim. Transport-level fields may wrap this
+ * but MUST NOT change the bytes that the signature covers.
+ */
+export interface ChannelMessage {
+    channelId: string;
+    sequence: number;
+    sender: ClaimReference;
+    sentAt: number;
+    type: ChannelMessageType;
+    body: unknown;
+    refs?: {
+        repliesTo?: number;
+    };
+    signature: ChannelMessageSignature;
+}
+export type UnsignedChannelMessage = Omit<ChannelMessage, "signature">;
+/**
+ * Per-signer transcript signature. Each member signs the full transcript
+ * (without `signatures`) — see WI-3 reference in the brief.
+ */
+export interface TranscriptSignature {
+    sigVersion: "1";
+    signer: ClaimReference;
+    signature: string;
+}
+/**
+ * DACS-3 §8.7 — the ordered, member-signed record of a channel session.
+ * Consumed by WI-3 for encrypted-anchor flows.
+ */
+export interface ChannelTranscript {
+    transcriptVersion: "1";
+    channelId: string;
+    members: ClaimReference[];
+    messages: ChannelMessage[];
+    generatedAt: number;
+    signatures: TranscriptSignature[];
+}
+export type UnsignedChannelTranscript = Omit<ChannelTranscript, "signatures">;

package/build/l2ps/channel/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/l2ps/channel/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/l2ps/channel/types.ts"],"names":[],"mappings":""}

package/build/l2ps/index.d.ts

@@ -1,3 +1,6 @@
 import L2PS from "./l2ps";
-import { L2PSConfig, L2PSEncryptedPayload } from "./l2ps";
-export { L2PS, L2PSConfig, L2PSEncryptedPayload };
+import { L2PSConfig, L2PSEncryptedBytes, L2PSEncryptedPayload } from "./l2ps";
+export { L2PS, L2PSConfig, L2PSEncryptedBytes, L2PSEncryptedPayload };
+export * as binding from "./binding";
+export * as channel from "./channel";
+export * as anchor from "./anchor";

package/build/l2ps/index.js

@@ -1,3 +1,6 @@
 import L2PS from "./l2ps.js";
 export { L2PS };
+export * as binding from "./binding/index.js";
+export * as channel from "./channel/index.js";
+export * as anchor from "./anchor/index.js";
 //# sourceMappingURL=index.js.map

package/build/l2ps/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/l2ps/index.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,QAAQ,CAAA;AAGzB,OAAO,EAAE,IAAI,EAAoC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/l2ps/index.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,QAAQ,CAAA;AAGzB,OAAO,EAAE,IAAI,EAAwD,CAAA;AAErE,OAAO,KAAK,OAAO,MAAM,WAAW,CAAA;AACpC,OAAO,KAAK,OAAO,MAAM,WAAW,CAAA;AACpC,OAAO,KAAK,MAAM,MAAM,UAAU,CAAA"}

package/build/l2ps/l2ps.d.ts

@@ -47,6 +47,21 @@ export interface L2PSEncryptedPayload {
      */
     nonce?: string;
 }
+/**
+ * Payload shape for `L2PS.encryptBytes` / `L2PS.decryptBytes`. Used by
+ * SR-4 WI-3 to encrypt channel transcripts to the subnet member set
+ * without dragging the L2PS-transaction envelope into a non-tx context.
+ */
+export interface L2PSEncryptedBytes {
+    /** UID of the L2PS network that encrypted these bytes. */
+    l2ps_uid: string;
+    /** Base64-encoded AES-GCM ciphertext. */
+    ciphertext: string;
+    /** Base64-encoded AES-GCM authentication tag. */
+    tag: string;
+    /** Base64-encoded AES-GCM nonce (always 12 bytes, fresh per call). */
+    nonce: string;
+}
 /**
  * L2PS (Layer 2 Private Subnets) class for encrypted transaction processing.
  *
@@ -207,4 +222,21 @@ export default class L2PS {
      * @returns Promise resolving to a 16-character fingerprint string
      */
     getKeyFingerprint(): Promise<string>;
+    /**
+     * AES-GCM-encrypt arbitrary bytes under the subnet key.
+     *
+     * Mirrors the per-call-nonce + nonce-as-AAD pattern in `encryptTx`: a
+     * fresh 12-byte nonce per call, bound into the auth tag via AAD so an
+     * attacker cannot DoS specific ciphertexts by flipping the stored
+     * nonce. Used by SR-4 WI-3 to encrypt channel transcripts to the
+     * subnet member set; nothing in the payload shape is L2PS-transaction
+     * specific.
+     */
+    encryptBytes(plaintext: Uint8Array): Promise<L2PSEncryptedBytes>;
+    /**
+     * Inverse of `encryptBytes`. Verifies the `l2ps_uid` matches this
+     * instance and that the AES-GCM auth tag (covering nonce + ciphertext)
+     * is intact; throws on either failure.
+     */
+    decryptBytes(payload: L2PSEncryptedBytes): Promise<Uint8Array>;
 }

package/build/l2ps/l2ps.js

@@ -309,6 +309,66 @@ class L2PS {
     async getKeyFingerprint() {
         return Hashing.sha256(this.privateKey).substring(0, 16);
     }
+    /**
+     * AES-GCM-encrypt arbitrary bytes under the subnet key.
+     *
+     * Mirrors the per-call-nonce + nonce-as-AAD pattern in `encryptTx`: a
+     * fresh 12-byte nonce per call, bound into the auth tag via AAD so an
+     * attacker cannot DoS specific ciphertexts by flipping the stored
+     * nonce. Used by SR-4 WI-3 to encrypt channel transcripts to the
+     * subnet member set; nothing in the payload shape is L2PS-transaction
+     * specific.
+     */
+    async encryptBytes(plaintext) {
+        const cipher = forge.cipher.createCipher('AES-GCM', this.privateKey);
+        const nonce = forge.random.getBytesSync(12);
+        cipher.start({ iv: nonce, additionalData: nonce });
+        cipher.update(forge.util.createBuffer(Buffer.from(plaintext).toString('binary'), 'binary'));
+        if (!cipher.finish()) {
+            throw new Error('L2PS.encryptBytes: AES-GCM finish() failed');
+        }
+        return {
+            l2ps_uid: this.config?.uid || this.id,
+            ciphertext: forge.util.encode64(cipher.output.getBytes()),
+            tag: forge.util.encode64(cipher.mode.tag.getBytes()),
+            nonce: forge.util.encode64(nonce),
+        };
+    }
+    /**
+     * Inverse of `encryptBytes`. Verifies the `l2ps_uid` matches this
+     * instance and that the AES-GCM auth tag (covering nonce + ciphertext)
+     * is intact; throws on either failure.
+     */
+    async decryptBytes(payload) {
+        if (payload.l2ps_uid !== (this.config?.uid || this.id)) {
+            throw new Error('L2PS.decryptBytes: payload encrypted for different L2PS uid');
+        }
+        // Storage-loaded JSON can violate the L2PSEncryptedBytes shape at
+        // runtime; without an explicit shape check forge would throw a
+        // base64 error that does not tell the caller which field is wrong.
+        if (typeof payload.ciphertext !== 'string' ||
+            typeof payload.tag !== 'string' ||
+            typeof payload.nonce !== 'string') {
+            throw new Error('L2PS.decryptBytes: payload must include base64 strings for ciphertext, tag, and nonce');
+        }
+        const ciphertext = forge.util.createBuffer(forge.util.decode64(payload.ciphertext));
+        const tag = forge.util.createBuffer(forge.util.decode64(payload.tag));
+        const iv = forge.util.decode64(payload.nonce);
+        if (iv.length !== 12) {
+            throw new Error('L2PS.decryptBytes: invalid nonce (expected base64-encoded 12-byte value)');
+        }
+        const decipher = forge.cipher.createDecipher('AES-GCM', this.privateKey);
+        decipher.start({ iv, tag, additionalData: iv });
+        decipher.update(ciphertext);
+        if (!decipher.finish()) {
+            throw new Error('L2PS.decryptBytes: AES-GCM authentication failed');
+        }
+        const bin = decipher.output.getBytes();
+        const out = new Uint8Array(bin.length);
+        for (let i = 0; i < bin.length; i++)
+            out[i] = bin.charCodeAt(i) & 0xff;
+        return out;
+    }
 }
 /** Static map of all L2PS instances, keyed by instance ID */
 L2PS.instances = new Map();

package/build/l2ps/l2ps.js.map

@@ -1 +1 @@
-{"version":3,"file":"l2ps.js","sourceRoot":"","sources":["../../../src/l2ps/l2ps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AA4C/C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAqB,IAAI;IAgBrB;;;;;;;;OAQG;IACH,YAAoB,UAAuB,EAAE,EAAe;QACxD,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAmB,EAAE,EAAW;QAChD,MAAM,GAAG,GAAG,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACvD,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACrC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,WAAW,CAAC,EAAU;QACzB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,YAAY;QACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,WAAW,CAAC,EAAU;QACzB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CAAC,EAAU;QAC5B,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACrC,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,SAAS,CAAC,EAAe,EAAE,cAAoB;QACjD,IAAI,CAAC,EAAE,EAAE,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YAErE,4DAA4D;YAC5D,6DAA6D;YAC7D,+DAA+D;YAC/D,mCAAmC;YACnC,EAAE;YACF,6DAA6D;YAC7D,8DAA8D;YAC9D,4DAA4D;YAC5D,4DAA4D;YAC5D,uDAAuD;YACvD,4DAA4D;YAC5D,gCAAgC;YAChC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAC5C,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;YACnD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAExB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACrD,CAAC;YAED,MAAM,gBAAgB,GAAyB;gBAC3C,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE;gBACrC,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC7D,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACpD,aAAa,EAAE,EAAE,CAAC,IAAI;gBACtB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;aACpC,CAAC;YAEF,MAAM,kBAAkB,GAA2B;gBAC/C,IAAI,EAAE,iBAAiB;gBACvB,IAAI,EAAE,cAAc,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI;gBACvC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE;gBACjB,oBAAoB,EAAE,EAAE,CAAC,OAAO,CAAC,oBAAoB;gBACrD,MAAM,EAAE,CAAC;gBACT,IAAI,EAAE,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;gBAC3C,SAAS,EAAE,EAAE;gBACb,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK;gBACvB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,eAAe,EAAE,EAAE,CAAC,OAAO,CAAC,eAAe;aAC9C,CAAC;YAEF,MAAM,WAAW,GAAoB;gBACjC,OAAO,EAAE,kBAAkB;gBAC3B,iBAAiB,EAAE,EAAE,CAAC,iBAAiB;gBACvC,SAAS,EAAE,IAAI;gBACf,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;gBACxD,MAAM,EAAE,SAAS;gBACjB,WAAW,EAAE,IAAI;aACpB,CAAC;YAEF,OAAO,WAAW,CAAC;QACvB,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3D,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,SAAS,CAAC,WAA4B;QACxC,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,OAAO,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,CAAC;YACD,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;YACrD,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAC/D,CAAC;YAED,MAAM,gBAAgB,GAAG,OAA+B,CAAC;YAEzD,IAAI,gBAAgB,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAChE,CAAC;YAED,yDAAyD;YAEzD,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC;YACpG,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YAE/E,0DAA0D;YAC1D,2DAA2D;YAC3D,iCAAiC;YACjC,EAAE;YACF,8DAA8D;YAC9D,4DAA4D;YAC5D,+DAA+D;YAC/D,2DAA2D;YAC3D,IAAI,EAAe,CAAC;YACpB,IAAI,gBAAgB,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACvC,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;YACjB,CAAC;iBAAM,CAAC;gBACJ,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;gBACjD,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CACX,0EAA0E,CAC7E,CAAC;gBACN,CAAC;YACL,CAAC;YAED,wDAAwD;YACxD,4DAA4D;YAC5D,0DAA0D;YAC1D,wCAAwC;YACxC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACzE,QAAQ,CAAC,KAAK,CAAC;gBACX,EAAE;gBACF,GAAG;gBACH,GAAG,CAAC,gBAAgB,CAAC,KAAK,KAAK,SAAS;oBACpC,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE;oBACxB,CAAC,CAAC,EAAE,CAAC;aACZ,CAAC,CAAC;YAEH,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAE/B,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;YAC7E,CAAC;YAED,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACnD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAgB,CAAC;YAE9D,IAAI,UAAU,CAAC,IAAI,KAAK,gBAAgB,CAAC,aAAa,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YAC3D,CAAC;YAED,OAAO,UAAU,CAAC;QACtB,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3D,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK;QACD,OAAO,IAAI,CAAC,EAAE,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,SAAS;QACL,OAAO,IAAI,CAAC,MAAM,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,MAAkB;QACxB,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACzB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB;QACnB,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC;;AA7TD,6DAA6D;AAC9C,cAAS,GAAsB,IAAI,GAAG,EAAE,CAAC;eAFvC,IAAI"}
+{"version":3,"file":"l2ps.js","sourceRoot":"","sources":["../../../src/l2ps/l2ps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,MAAM,YAAY,CAAC;AAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AA4D/C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAqB,IAAI;IAgBrB;;;;;;;;OAQG;IACH,YAAoB,UAAuB,EAAE,EAAe;QACxD,IAAI,CAAC,UAAU,IAAI,CAAC,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAmB,EAAE,EAAW;QAChD,MAAM,GAAG,GAAG,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,EAAE,IAAI,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACvD,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IACrC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,WAAW,CAAC,EAAU;QACzB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,YAAY;QACf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,WAAW,CAAC,EAAU;QACzB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,cAAc,CAAC,EAAU;QAC5B,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACrC,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,SAAS,CAAC,EAAe,EAAE,cAAoB;QACjD,IAAI,CAAC,EAAE,EAAE,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YAErE,4DAA4D;YAC5D,6DAA6D;YAC7D,+DAA+D;YAC/D,mCAAmC;YACnC,EAAE;YACF,6DAA6D;YAC7D,8DAA8D;YAC9D,4DAA4D;YAC5D,4DAA4D;YAC5D,uDAAuD;YACvD,4DAA4D;YAC5D,gCAAgC;YAChC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;YAC5C,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;YACnD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAExB,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACrD,CAAC;YAED,MAAM,gBAAgB,GAAyB;gBAC3C,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE;gBACrC,cAAc,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC7D,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACpD,aAAa,EAAE,EAAE,CAAC,IAAI;gBACtB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;aACpC,CAAC;YAEF,MAAM,kBAAkB,GAA2B;gBAC/C,IAAI,EAAE,iBAAiB;gBACvB,IAAI,EAAE,cAAc,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI;gBACvC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE;gBACjB,oBAAoB,EAAE,EAAE,CAAC,OAAO,CAAC,oBAAoB;gBACrD,MAAM,EAAE,CAAC;gBACT,IAAI,EAAE,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;gBAC3C,SAAS,EAAE,EAAE;gBACb,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK;gBACvB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,eAAe,EAAE,EAAE,CAAC,OAAO,CAAC,eAAe;aAC9C,CAAC;YAEF,MAAM,WAAW,GAAoB;gBACjC,OAAO,EAAE,kBAAkB;gBAC3B,iBAAiB,EAAE,EAAE,CAAC,iBAAiB;gBACvC,SAAS,EAAE,IAAI;gBACf,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;gBACxD,MAAM,EAAE,SAAS;gBACjB,WAAW,EAAE,IAAI;aACpB,CAAC;YAEF,OAAO,WAAW,CAAC;QACvB,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3D,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACH,KAAK,CAAC,SAAS,CAAC,WAA4B;QACxC,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,OAAO,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,CAAC;YACD,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;YACrD,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YAC/D,CAAC;YAED,MAAM,gBAAgB,GAAG,OAA+B,CAAC;YAEzD,IAAI,gBAAgB,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAChE,CAAC;YAED,yDAAyD;YAEzD,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC;YACpG,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;YAE/E,0DAA0D;YAC1D,2DAA2D;YAC3D,iCAAiC;YACjC,EAAE;YACF,8DAA8D;YAC9D,4DAA4D;YAC5D,+DAA+D;YAC/D,2DAA2D;YAC3D,IAAI,EAAe,CAAC;YACpB,IAAI,gBAAgB,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;gBACvC,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;YACjB,CAAC;iBAAM,CAAC;gBACJ,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;gBACjD,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CACX,0EAA0E,CAC7E,CAAC;gBACN,CAAC;YACL,CAAC;YAED,wDAAwD;YACxD,4DAA4D;YAC5D,0DAA0D;YAC1D,wCAAwC;YACxC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;YACzE,QAAQ,CAAC,KAAK,CAAC;gBACX,EAAE;gBACF,GAAG;gBACH,GAAG,CAAC,gBAAgB,CAAC,KAAK,KAAK,SAAS;oBACpC,CAAC,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE;oBACxB,CAAC,CAAC,EAAE,CAAC;aACZ,CAAC,CAAC;YAEH,QAAQ,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAE/B,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;YAC7E,CAAC;YAED,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACnD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAgB,CAAC;YAE9D,IAAI,UAAU,CAAC,IAAI,KAAK,gBAAgB,CAAC,aAAa,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;YAC3D,CAAC;YAED,OAAO,UAAU,CAAC;QACtB,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3D,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK;QACD,OAAO,IAAI,CAAC,EAAE,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,SAAS;QACL,OAAO,IAAI,CAAC,MAAM,CAAC;IACvB,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,MAAkB;QACxB,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACzB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB;QACnB,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,YAAY,CAAC,SAAqB;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACrE,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CACT,KAAK,CAAC,IAAI,CAAC,YAAY,CACnB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EACzC,QAAe,CAClB,CACJ,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAClE,CAAC;QACD,OAAO;YACH,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE;YACrC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzD,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YACpD,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;SACpC,CAAC;IACN,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,OAA2B;QAC1C,IAAI,OAAO,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACnF,CAAC;QACD,kEAAkE;QAClE,+DAA+D;QAC/D,mEAAmE;QACnE,IACI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ;YACtC,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAC/B,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EACnC,CAAC;YACC,MAAM,IAAI,KAAK,CACX,uFAAuF,CAC1F,CAAC;QACN,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CACtC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAC1C,CAAC;QACF,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACtE,MAAM,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACX,0EAA0E,CAC7E,CAAC;QACN,CAAC;QACD,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACzE,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,CAAC,CAAC;QAChD,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;QACvE,OAAO,GAAG,CAAC;IACf,CAAC;;AAvYD,6DAA6D;AAC9C,cAAS,GAAsB,IAAI,GAAG,EAAE,CAAC;eAFvC,IAAI"}

package/build/l2ps/utils/hex.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Hex encoding helpers shared across the SR-4 modules
+ * (binding / channel / anchor) so the signature wire format stays
+ * identical in every place that produces or consumes a hex string.
+ */
+/**
+ * Encode raw bytes as a lowercase, unprefixed hex string. Used for hash
+ * digests carried in signing payloads (the wire signature wrappers use
+ * the `0x`-prefixed `signatureToHex` instead).
+ */
+export declare function bytesToHex(bytes: Uint8Array): string;
+/**
+ * Wire encoding for an Ed25519 signature — lowercase `0x`-prefixed hex.
+ * Match for `signatureFromHex` on the verify side.
+ */
+export declare function signatureToHex(sig: Uint8Array): string;
+/**
+ * Decode a hex string (with or without a `0x` / `0X` prefix) into a
+ * `Uint8Array`. Rejects odd-length input and non-hex characters so a
+ * malformed wire signature surfaces immediately instead of producing a
+ * silently truncated byte array.
+ *
+ * @throws {Error} If the cleaned hex string is odd-length or contains
+ *                 non-hex characters.
+ */
+export declare function signatureFromHex(hex: string): Uint8Array;

package/build/l2ps/utils/hex.js

@@ -0,0 +1,45 @@
+/**
+ * Hex encoding helpers shared across the SR-4 modules
+ * (binding / channel / anchor) so the signature wire format stays
+ * identical in every place that produces or consumes a hex string.
+ */
+/**
+ * Encode raw bytes as a lowercase, unprefixed hex string. Used for hash
+ * digests carried in signing payloads (the wire signature wrappers use
+ * the `0x`-prefixed `signatureToHex` instead).
+ */
+export function bytesToHex(bytes) {
+    let out = "";
+    for (let i = 0; i < bytes.length; i++) {
+        out += bytes[i].toString(16).padStart(2, "0");
+    }
+    return out;
+}
+/**
+ * Wire encoding for an Ed25519 signature — lowercase `0x`-prefixed hex.
+ * Match for `signatureFromHex` on the verify side.
+ */
+export function signatureToHex(sig) {
+    return "0x" + bytesToHex(sig);
+}
+/**
+ * Decode a hex string (with or without a `0x` / `0X` prefix) into a
+ * `Uint8Array`. Rejects odd-length input and non-hex characters so a
+ * malformed wire signature surfaces immediately instead of producing a
+ * silently truncated byte array.
+ *
+ * @throws {Error} If the cleaned hex string is odd-length or contains
+ *                 non-hex characters.
+ */
+export function signatureFromHex(hex) {
+    const h = hex.startsWith("0x") || hex.startsWith("0X") ? hex.slice(2) : hex;
+    if (h.length % 2 !== 0 || !/^[0-9a-fA-F]*$/.test(h)) {
+        throw new Error("signatureFromHex: not a valid hex string");
+    }
+    const out = new Uint8Array(h.length / 2);
+    for (let i = 0; i < h.length; i += 2) {
+        out[i / 2] = Number.parseInt(h.slice(i, i + 2), 16);
+    }
+    return out;
+}
+//# sourceMappingURL=hex.js.map

package/build/l2ps/utils/hex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hex.js","sourceRoot":"","sources":["../../../../src/l2ps/utils/hex.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAiB;IACxC,IAAI,GAAG,GAAG,EAAE,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACjD,CAAC;IACD,OAAO,GAAG,CAAA;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,GAAe;IAC1C,OAAO,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;AACjC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IACxC,MAAM,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;IAC3E,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;IAC/D,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IACvD,CAAC;IACD,OAAO,GAAG,CAAA;AACd,CAAC"}

package/build/types/abstraction/index.d.ts

@@ -77,6 +77,21 @@ export interface InferFromGithubPayload extends Web2CoreTargetIdentityPayload {
     context: "github";
     proof: GithubProof;
 }
+/**
+ * A domain proof is the HTTPS URL of the well-known file the domain owner
+ * hosts to prove control:  https://<host>/.well-known/demos-cci.txt
+ * The file body is the standard web2 proof payload produced by
+ * Identities.createDomainProofPayload (i.e. `demos:dw2p:<algorithm>:<signature>`).
+ */
+export type DomainProof = `https://${string}/.well-known/demos-cci.txt`;
+export interface InferFromDomainPayload extends Web2CoreTargetIdentityPayload {
+    context: "domain";
+    proof: DomainProof;
+    /** The hostname being claimed (e.g. "example.com"). */
+    username: string;
+    /** Domains have no separate numeric id; mirrors `username`. */
+    userId: string;
+}
 export type XProof = `https://x.com/${string}/${string}`;
 export type TwitterProof = XProof;
 export type DiscordProof = `https://discord.com/channels/${string}/${string}/${string}` | `https://ptb.discord.com/channels/${string}/${string}/${string}` | `https://canary.discord.com/channels/${string}/${string}/${string}` | `https://discordapp.com/channels/${string}/${string}/${string}`;
@@ -130,7 +145,7 @@ export interface BaseWeb2IdentityPayload {
 }
 export interface Web2IdentityAssignPayload extends BaseWeb2IdentityPayload {
     method: "web2_identity_assign";
-    payload: InferFromGithubPayload | InferFromTwitterPayload | InferFromTelegramPayload | InferFromDiscordPayload;
+    payload: InferFromGithubPayload | InferFromTwitterPayload | InferFromTelegramPayload | InferFromDiscordPayload | InferFromDomainPayload;
 }
 export interface Web2IdentityRemovePayload extends BaseWeb2IdentityPayload {
     method: "web2_identity_remove";
@@ -443,7 +458,7 @@ export interface UserPoints {
 }
 export interface FindDemosIdByWeb2IdentityQuery {
     type: "web2";
-    context: "twitter" | "telegram" | "github" | "discord";
+    context: "twitter" | "telegram" | "github" | "discord" | "domain";
     username: string;
     userId?: string;
 }

package/build/websdk/Web2Calls.js

@@ -134,6 +134,8 @@ export class Web2Proxy {
         web2Tx.content.type = "web2Request";
         web2Tx.content.data = ["web2Request", web2Payload];
         web2Tx.content.timestamp = Date.now();
+        const nonce = await this._demos.getAddressNonce(await this._demos.getEd25519Address());
+        web2Tx.content.nonce = nonce + 1;
         const signedWeb2Tx = await this._demos.sign(web2Tx);
         const validityData = await this._demos.confirm(signedWeb2Tx);
         const txHash = validityData.response.data.transaction.hash;