@mcsherrylabs/evolver-client 0.8.0

package/dist/bodies.js

@@ -0,0 +1,145 @@
+// Tx-body builders for the core ledgers + channel messages.
+//
+// Each builder returns the serialized OUTER oneof message (the tx_body bytes)
+// ready to pass to buildSignedTx. Field numbers per
+// src/main/protobuf/evolver/ledger/{identity,group,owners}.proto.
+//
+// A CHANNEL message tx_body is the raw application payload bytes — the ledger
+// has no core handler, the body is opaque.
+import { fString, fBytes, fMessage, fVarint, concat } from "./wire.js";
+export const LEDGER = {
+    identity: "ce.evolver.ledger.identity",
+    groups: "ce.evolver.ledger.groups",
+    owners: "ce.evolver.ledger.owners",
+};
+// ── Identity ledger ──────────────────────────────────────────────────────────
+// TxBody.body oneof: 1 create_identity | 3 add_key | 4 replace_key | 5 delete_key
+// KeyEntryWithPoP: 1 key_type | 2 public_key | 3 pop_signature | 4 key_label
+function encodeKeyEntry(k, withPoP) {
+    return [
+        ...fString(1, k.keyType),
+        ...fBytes(2, k.publicKey),
+        ...(withPoP && k.popSig ? fBytes(3, k.popSig) : []),
+        ...fString(4, k.keyLabel),
+    ];
+}
+/**
+ * Inner CreateIdentityTxBody — the PROTO body that goes on the wire.
+ *
+ * ⚠️ 148: this is NO LONGER the PoP preimage. Proof of possession uses the canonical field
+ * encoding (`popCreateIdentity` in ./generated/codecs), not a hash of these proto bytes. The two
+ * were the same function before, which is why `withPoP` existed; the wire body still needs proto,
+ * so the function stays — it just no longer serves double duty.
+ */
+export function createIdentityInner(nodeId, initialCredit, keys, withPoP) {
+    // CreateIdentityTxBody: 1 node_id | 2 initial_credit | 3 keys (repeated)
+    return concat(fString(1, nodeId), fVarint(2, initialCredit), ...keys.map((k) => fMessage(3, concat(encodeKeyEntry(k, withPoP)))));
+}
+/** Wrap a CreateIdentityTxBody as the tx_body (TxBody.create_identity = 1). */
+export function createIdentityBody(inner) {
+    return concat(fMessage(1, inner));
+}
+/** Inner AddKeyTxBody: 1 public_key | 2 key_type | 3 key_label | 5 pop_signature (omit when empty).
+ *
+ *  ⚠️ This is NOT the PoP preimage and has not been since 148 — that is `popAddKey` in
+ *  ./generated/codecs. This comment claimed otherwise for two features, which is the exact reason
+ *  a recipe is now stated once, as data, instead of in prose beside each function that touches it. */
+export function addKeyInner(args) {
+    return concat(fBytes(1, args.publicKey), fString(2, args.keyType), fString(3, args.keyLabel), args.popSignature.length > 0 ? fBytes(5, args.popSignature) : []);
+}
+export function addKeyBody(args) {
+    return concat(fMessage(3, addKeyInner(args))); // TxBody.add_key = 3
+}
+/** Inner ReplaceKeyTxBody: 1 public_key | 2 key_type | 3 key_label | 5 pop_signature (omit when empty).
+ *  Mirrors AddKeyTxBody exactly on the wire. The PoP preimage is `popReplaceKey` in
+ *  ./generated/codecs — a DIFFERENT digest from AddKey's despite the identical layout, because the
+ *  two descriptions carry different tags. */
+export function replaceKeyInner(args) {
+    return concat(fBytes(1, args.publicKey), fString(2, args.keyType), fString(3, args.keyLabel), args.popSignature.length > 0 ? fBytes(5, args.popSignature) : []);
+}
+export function replaceKeyBody(args) {
+    return concat(fMessage(4, replaceKeyInner(args))); // TxBody.replace_key = 4
+}
+export function deleteKeyBody(args) {
+    // DeleteKeyTxBody: 1 key_type | 2 key_label
+    const inner = concat(fString(1, args.keyType), fString(2, args.keyLabel));
+    return concat(fMessage(5, inner)); // TxBody.delete_key = 5
+}
+/**
+ * Credit transfer (154): move credit from the signing identity to 1..20 recipients.
+ *
+ * TransferTxBody{ 1 transfers (repeated) }, TransferEntry{ 1 recipient, 2 amount },
+ * TxBody.transfer = 6.
+ *
+ * The entries are encoded IN THE ORDER GIVEN and nothing here sorts, merges or
+ * deduplicates them — the order is part of the meaning, because it decides which
+ * transfers survive if the sender runs short at apply time. The node's own rules
+ * (1..20 entries, amounts >= 1, distinct recipients, none of them the sender,
+ * every recipient an existing identity) are enforced there and refused at submit;
+ * this function encodes what it is given.
+ */
+export function transferBody(entries) {
+    const inner = concat(...entries.map((e) => fMessage(1, concat(fString(1, e.recipient), fVarint(2, e.amount)))));
+    return concat(fMessage(6, inner)); // TxBody.transfer = 6
+}
+// ── Groups ledger ────────────────────────────────────────────────────────────
+// GroupTxBody.tx oneof: 1 create_group | 2 add_member | 3 remove_member
+export function createGroupBody(name) {
+    return concat(fMessage(1, concat(fString(1, name)))); // CreateGroupTxBody{ name = 1 }
+}
+export function addMemberBody(groupName, memberNodeId) {
+    return concat(fMessage(2, concat(fString(1, groupName), fString(2, memberNodeId))));
+}
+export function removeMemberBody(groupName, memberNodeId) {
+    return concat(fMessage(3, concat(fString(1, groupName), fString(2, memberNodeId))));
+}
+// ── Owners ledger ────────────────────────────────────────────────────────────
+// OwnersTxBody.tx oneof: 1 claim | 2 remove
+// ClaimTxBody: 1 ledger_id | 3 group_owner | 4 da_group (string) | 5 da_threshold_m (uint32)
+// (#7 removed field 2 co_owners — multi-owner ledgers are group-owned only.
+//  097 retired the old `bool da_managed` field 4 — DA is now a named DA group +
+//  threshold m; absence of a da_group ⇒ not DA-managed.)
+export function claimBody(args) {
+    const parts = [...fString(1, args.ledgerId)];
+    if (args.groupOwner)
+        parts.push(...fString(3, args.groupOwner));
+    if (args.daGroup)
+        parts.push(...fString(4, args.daGroup));
+    if (args.daThresholdM)
+        parts.push(...fVarint(5, args.daThresholdM)); // proto3: omit 0 (default)
+    if (args.tollAmount && BigInt(args.tollAmount) !== 0n)
+        parts.push(...fVarint(6, args.tollAmount));
+    if (args.tollRecipient)
+        parts.push(...fString(7, args.tollRecipient));
+    return concat(fMessage(1, concat(parts))); // OwnersTxBody.claim = 1
+}
+export function removeOwnerBody(ledgerId) {
+    return concat(fMessage(2, concat(fString(1, ledgerId)))); // OwnersTxBody.remove = 2
+}
+// 153 — UpdateChannelTollTxBody: 1 ledger_id | 2 toll_amount (int64) | 3 toll_recipient.
+// OwnersTxBody.update_channel_toll = 5. toll_amount 0 / omitted ⇒ REMOVE the toll.
+export function updateChannelTollBody(args) {
+    const parts = [...fString(1, args.ledgerId)];
+    if (args.tollAmount && BigInt(args.tollAmount) !== 0n)
+        parts.push(...fVarint(2, args.tollAmount));
+    if (args.tollRecipient)
+        parts.push(...fString(3, args.tollRecipient));
+    return concat(fMessage(5, concat(parts))); // OwnersTxBody.update_channel_toll = 5
+}
+// ── Channel (ledger_id = the channel id) ─────────────────────────────────────
+// The tx_body IS the raw payload bytes — opaque, no wrapper.
+export function channelBody(payload) {
+    return payload;
+}
+// ── proof-of-possession digests ──────────────────────────────────────────────
+//
+// ⚠️ 149 — THEY ARE NOT WRITTEN HERE ANY MORE. `popCreateIdentityDigest` / `popAddKeyDigest` /
+// `popReplaceKeyDigest` were hand-composed twins of `PoPSignable.scala`, and this file is where
+// the drift that reached regression stage 62 lived: 148 moved the Scala half to the canonical
+// encoding and this half stayed on hand-rolled proto3, with `npm test` green throughout.
+//
+// Import `popCreateIdentity` / `popAddKey` / `popReplaceKey` from ./generated/codecs instead —
+// emitted from the node's own descriptions, so there is no second half to forget. The three tags
+// (AddKey and ReplaceKey have identical field layouts, so one shared tag made a proof gathered for
+// an AddKey valid for a ReplaceKey) are now a property of the descriptions, not of this file.
+//# sourceMappingURL=bodies.js.map

package/dist/bodies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bodies.js","sourceRoot":"","sources":["../src/bodies.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,EAAE;AACF,8EAA8E;AAC9E,oDAAoD;AACpD,kEAAkE;AAClE,EAAE;AACF,8EAA8E;AAC9E,2CAA2C;AAE3C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAGvE,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,QAAQ,EAAE,4BAA4B;IACtC,MAAM,EAAE,0BAA0B;IAClC,MAAM,EAAE,0BAA0B;CAC1B,CAAC;AAEX,gFAAgF;AAChF,kFAAkF;AAElF,6EAA6E;AAC7E,SAAS,cAAc,CAAC,CAAW,EAAE,OAAgB;IACnD,OAAO;QACL,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;QACxB,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC;QACzB,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAc,EACd,aAA8B,EAC9B,IAAgB,EAChB,OAAgB;IAEhB,yEAAyE;IACzE,OAAO,MAAM,CACX,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,EAClB,OAAO,CAAC,CAAC,EAAE,aAAa,CAAC,EACzB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CACpE,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,kBAAkB,CAAC,KAAiB;IAClD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AACpC,CAAC;AASD;;;;sGAIsG;AACtG,MAAM,UAAU,WAAW,CAAC,IAAgB;IAC1C,OAAO,MAAM,CACX,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EACzB,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,EACxB,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,EACzB,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CACjE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAgB;IACzC,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,qBAAqB;AACtE,CAAC;AASD;;;6CAG6C;AAC7C,MAAM,UAAU,eAAe,CAAC,IAAoB;IAClD,OAAO,MAAM,CACX,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EACzB,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,EACxB,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,EACzB,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CACjE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAoB;IACjD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,yBAAyB;AAC9E,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,IAA2C;IACvE,4CAA4C;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1E,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,wBAAwB;AAC7D,CAAC;AAUD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,YAAY,CAAC,OAA2B;IACtD,MAAM,KAAK,GAAG,MAAM,CAClB,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAC1F,CAAC;IACF,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,sBAAsB;AAC3D,CAAC;AAED,gFAAgF;AAChF,wEAAwE;AAExE,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,gCAAgC;AACxF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,YAAoB;IACnE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,YAAoB;IACtE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;AACtF,CAAC;AAED,gFAAgF;AAChF,4CAA4C;AAC5C,6FAA6F;AAC7F,4EAA4E;AAC5E,gFAAgF;AAChF,yDAAyD;AAEzD,MAAM,UAAU,SAAS,CAAC,IAOzB;IACC,MAAM,KAAK,GAAa,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IAChE,IAAI,IAAI,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,IAAI,IAAI,CAAC,YAAY;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,2BAA2B;IAChG,IAAI,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IAClG,IAAI,IAAI,CAAC,aAAa;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,yBAAyB;AACtE,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,0BAA0B;AACtF,CAAC;AAED,yFAAyF;AACzF,mFAAmF;AACnF,MAAM,UAAU,qBAAqB,CAAC,IAIrC;IACC,MAAM,KAAK,GAAa,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvD,IAAI,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IAClG,IAAI,IAAI,CAAC,aAAa;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IACtE,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,uCAAuC;AACpF,CAAC;AAED,gFAAgF;AAChF,6DAA6D;AAC7D,MAAM,UAAU,WAAW,CAAC,OAAmB;IAC7C,OAAO,OAAO,CAAC;AACjB,CAAC;AAGD,gFAAgF;AAChF,EAAE;AACF,+FAA+F;AAC/F,gGAAgG;AAChG,8FAA8F;AAC9F,yFAAyF;AACzF,EAAE;AACF,+FAA+F;AAC/F,iGAAiG;AACjG,mGAAmG;AACnG,8FAA8F"}

package/dist/crypto/auth.d.ts

@@ -0,0 +1,25 @@
+export declare const BLS_DST = "BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_POP_";
+export interface BlsKeypair {
+    priv: Uint8Array;
+    pub: Uint8Array;
+}
+export interface EdKeypair {
+    priv: Uint8Array;
+    pub: Uint8Array;
+}
+export declare function genBls(): BlsKeypair;
+/** Sign raw message bytes (hash-to-curve absorbs them) → 96-byte compressed G2. */
+export declare function blsSign(msg: Uint8Array, priv: Uint8Array): Uint8Array;
+export declare function genEd(): EdKeypair;
+export declare function edSign(msg: Uint8Array, priv: Uint8Array): Uint8Array;
+/** Verify an Ed25519 signature over `msg` against a raw 32-byte public key.
+ *  138: used by the remote-key enrollment to re-verify the phone-produced
+ *  AddKey PoP before the outer tx is signed (never sign blind). */
+export declare function edVerify(msg: Uint8Array, sig: Uint8Array, pub32: Uint8Array): boolean;
+export declare function edPubToSpki(raw32: Uint8Array): Uint8Array;
+/** Raw 32-byte Ed25519 pubkey from either a raw key or an X.509 SPKI-wrapped one
+ *  (the on-chain `node_keys` form). The key is always the last 32 bytes. */
+export declare function edSpkiToRaw(spkiOrRaw: Uint8Array): Uint8Array;
+/** X25519 public key from an Ed25519 public key (raw 32 or SPKI). */
+export declare function edToX25519Pub(edPub: Uint8Array): Uint8Array;
+//# sourceMappingURL=auth.d.ts.map

package/dist/crypto/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/crypto/auth.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,OAAO,gDAAgD,CAAC;AAErE,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,UAAU,CAAC;CACjB;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,UAAU,CAAC;CACjB;AAID,wBAAgB,MAAM,IAAI,UAAU,CAGnC;AAED,mFAAmF;AACnF,wBAAgB,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,GAAG,UAAU,CAIrE;AAID,wBAAgB,KAAK,IAAI,SAAS,CAGjC;AAED,wBAAgB,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,GAAG,UAAU,CAEpE;AAED;;mEAEmE;AACnE,wBAAgB,QAAQ,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAMrF;AAQD,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CAGzD;AAED;4EAC4E;AAC5E,wBAAgB,WAAW,CAAC,SAAS,EAAE,UAAU,GAAG,UAAU,CAE7D;AAcD,qEAAqE;AACrE,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CAE3D"}

package/dist/crypto/auth.js

@@ -0,0 +1,71 @@
+// On-chain AUTH keys: BLS12-381-G1 (G2 signatures, G1 public keys) + Ed25519.
+// These authenticate WHO sent a tx. Distinct from the app-level ENCRYPTION keys
+// in ./group.ts. Isomorphic (@noble/curves is pure JS).
+//
+// The BLS DST must be byte-identical to BLSOperations.DST on the server; it is
+// shared by both proof-of-possession and ledger-auth (TxAuth) signatures.
+import { bls12_381 } from "@noble/curves/bls12-381";
+import { ed25519, edwardsToMontgomeryPub } from "@noble/curves/ed25519";
+import { concatBytes } from "./hash.js";
+export const BLS_DST = "BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_POP_";
+// ── BLS12-381 ──────────────────────────────────────────────────────────────
+export function genBls() {
+    const priv = bls12_381.utils.randomPrivateKey();
+    return { priv, pub: bls12_381.getPublicKey(priv) };
+}
+/** Sign raw message bytes (hash-to-curve absorbs them) → 96-byte compressed G2. */
+export function blsSign(msg, priv) {
+    const point = bls12_381.longSignatures.hash(msg, BLS_DST);
+    const sig = bls12_381.longSignatures.sign(point, priv);
+    return bls12_381.longSignatures.Signature.toBytes(sig);
+}
+// ── Ed25519 ────────────────────────────────────────────────────────────────
+export function genEd() {
+    const priv = ed25519.utils.randomPrivateKey();
+    return { priv, pub: ed25519.getPublicKey(priv) };
+}
+export function edSign(msg, priv) {
+    return ed25519.sign(msg, priv);
+}
+/** Verify an Ed25519 signature over `msg` against a raw 32-byte public key.
+ *  138: used by the remote-key enrollment to re-verify the phone-produced
+ *  AddKey PoP before the outer tx is signed (never sign blind). */
+export function edVerify(msg, sig, pub32) {
+    try {
+        return ed25519.verify(sig, msg, pub32);
+    }
+    catch {
+        return false;
+    }
+}
+// Wrap a raw 32-byte Ed25519 public key as X.509 SubjectPublicKeyInfo — the wire
+// form expected in KeyEntryWithPoP.public_key for Ed25519.
+const ED_SPKI_PREFIX = Uint8Array.from([
+    0x30, 0x2a, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x03, 0x21, 0x00,
+]);
+export function edPubToSpki(raw32) {
+    if (raw32.length !== 32)
+        throw new Error("expected 32-byte ed25519 public key");
+    return concatBytes(ED_SPKI_PREFIX, raw32);
+}
+/** Raw 32-byte Ed25519 pubkey from either a raw key or an X.509 SPKI-wrapped one
+ *  (the on-chain `node_keys` form). The key is always the last 32 bytes. */
+export function edSpkiToRaw(spkiOrRaw) {
+    return spkiOrRaw.length === 32 ? spkiOrRaw : spkiOrRaw.subarray(spkiOrRaw.length - 32);
+}
+// ── Ed25519 → X25519 (derive the key-agreement key from the identity key) ──────
+// Lets a member's existing on-chain Ed25519 identity key double as the ECDH key for
+// group-key wrapping — no separate X25519 key to generate, store, or publish.
+//
+// Only the PUBLIC derivation lives here, because public material is meant to travel:
+// wrapping a group key to a member needs nothing but their on-chain key. The PRIVATE
+// derivation is deliberately NOT here and NOT exported anywhere — it is a module-private
+// helper of ./group.ts, reachable only by constructing a GroupKeyUnwrapper. Signing has
+// worked that way since the Signer trait; decryption now does too, so no raw scalar
+// crosses a module boundary. (See issue #53 for the remaining question: whether a
+// phone-held identity key should be able to decrypt at all.)
+/** X25519 public key from an Ed25519 public key (raw 32 or SPKI). */
+export function edToX25519Pub(edPub) {
+    return edwardsToMontgomeryPub(edSpkiToRaw(edPub));
+}
+//# sourceMappingURL=auth.js.map

package/dist/crypto/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/crypto/auth.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,gFAAgF;AAChF,wDAAwD;AACxD,EAAE;AACF,+EAA+E;AAC/E,0EAA0E;AAE1E,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,MAAM,CAAC,MAAM,OAAO,GAAG,6CAA6C,CAAC;AAYrE,8EAA8E;AAE9E,MAAM,UAAU,MAAM;IACpB,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;IAChD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;AACrD,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,OAAO,CAAC,GAAe,EAAE,IAAgB;IACvD,MAAM,KAAK,GAAG,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvD,OAAO,SAAS,CAAC,cAAc,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,8EAA8E;AAE9E,MAAM,UAAU,KAAK;IACnB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;IAC9C,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,GAAe,EAAE,IAAgB;IACtD,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACjC,CAAC;AAED;;mEAEmE;AACnE,MAAM,UAAU,QAAQ,CAAC,GAAe,EAAE,GAAe,EAAE,KAAiB;IAC1E,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,2DAA2D;AAC3D,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC;IACrC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI;CACvE,CAAC,CAAC;AAEH,MAAM,UAAU,WAAW,CAAC,KAAiB;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAChF,OAAO,WAAW,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;AAC5C,CAAC;AAED;4EAC4E;AAC5E,MAAM,UAAU,WAAW,CAAC,SAAqB;IAC/C,OAAO,SAAS,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AACzF,CAAC;AAED,kFAAkF;AAClF,oFAAoF;AACpF,8EAA8E;AAC9E,EAAE;AACF,qFAAqF;AACrF,qFAAqF;AACrF,yFAAyF;AACzF,wFAAwF;AACxF,oFAAoF;AACpF,kFAAkF;AAClF,6DAA6D;AAE7D,qEAAqE;AACrE,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,OAAO,sBAAsB,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;AACpD,CAAC"}

package/dist/crypto/canonical.d.ts

@@ -0,0 +1,21 @@
+/** 4-byte big-endian length prefix, then the bytes. */
+export declare function lengthPrefixed(field: Uint8Array): Uint8Array;
+/** A UTF-8 string as a length-prefixed field. Never normalised (rule 8). */
+export declare function lpString(s: string): Uint8Array;
+/** The purpose tag: length-prefixed, written first. */
+export declare function dst(tag: string): Uint8Array;
+/** 4-byte big-endian integer. */
+export declare function int32BE(v: number | bigint): Uint8Array;
+/**
+ * 8-byte big-endian integer.
+ *
+ * ⚠️ BIG-endian. The pre-148 transaction digest used LITTLE-endian for `ttl_round` — the codebase's
+ * lone outlier — and a byte-swapped value produces a digest wrong in only 8 bytes, which fails at
+ * the far end with no clue why. The vectors carry a non-palindromic value precisely to catch it.
+ */
+export declare function int64BE(v: number | bigint): Uint8Array;
+/** The element count of a variable-length list (rule 5). */
+export declare function count(n: number): Uint8Array;
+/** Concatenate encoded parts. */
+export declare function encoded(...parts: Uint8Array[]): Uint8Array;
+//# sourceMappingURL=canonical.d.ts.map

package/dist/crypto/canonical.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.d.ts","sourceRoot":"","sources":["../../src/crypto/canonical.ts"],"names":[],"mappings":"AAqBA,uDAAuD;AACvD,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CAK5D;AAED,4EAA4E;AAC5E,wBAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAE9C;AAED,uDAAuD;AACvD,wBAAgB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAE3C;AAED,iCAAiC;AACjC,wBAAgB,OAAO,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,CAItD;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,UAAU,CAItD;AAED,4DAA4D;AAC5D,wBAAgB,KAAK,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAE3C;AAED,iCAAiC;AACjC,wBAAgB,OAAO,CAAC,GAAG,KAAK,EAAE,UAAU,EAAE,GAAG,UAAU,CAS1D"}

package/dist/crypto/canonical.js

@@ -0,0 +1,68 @@
+// 148 — the canonical field encoding, TypeScript side.
+//
+// The node's `Hashing.Builder` / `CanonicalBytes` apply these same rules. Both languages are
+// pinned to the SAME golden vectors under `src/test/resources/vectors/`, so neither can be
+// updated alone — which matters here because these two implementations have drifted before, and
+// the only symptom was signatures that silently failed to verify.
+//
+// Rules: specs/148-canonical-signing-encoding/contracts/encoding-contract.md
+//   1. purpose tag first, length-prefixed
+//   2. every variable-length field length-prefixed (4-byte BIG-endian length)
+//   3. fixed-width fields bare
+//   4. every field always written — empty is length 0, never omitted
+//   5. lists carry a count
+//   7. integers fixed-width BIG-endian at a declared width
+//
+// ⚠️ Integers are `bigint`, never `number` (Constitution VIII). `Number()`/`parseInt` on any of
+// these values is prohibited: epoch millis and balances exceed 2^53, and a float round-trip is
+// silent — correct in every test case except the one that matters.
+const enc = new TextEncoder();
+/** 4-byte big-endian length prefix, then the bytes. */
+export function lengthPrefixed(field) {
+    const out = new Uint8Array(4 + field.length);
+    new DataView(out.buffer).setUint32(0, field.length, false); // false = BIG-endian
+    out.set(field, 4);
+    return out;
+}
+/** A UTF-8 string as a length-prefixed field. Never normalised (rule 8). */
+export function lpString(s) {
+    return lengthPrefixed(enc.encode(s));
+}
+/** The purpose tag: length-prefixed, written first. */
+export function dst(tag) {
+    return lpString(tag);
+}
+/** 4-byte big-endian integer. */
+export function int32BE(v) {
+    const out = new Uint8Array(4);
+    new DataView(out.buffer).setInt32(0, Number(v), false);
+    return out;
+}
+/**
+ * 8-byte big-endian integer.
+ *
+ * ⚠️ BIG-endian. The pre-148 transaction digest used LITTLE-endian for `ttl_round` — the codebase's
+ * lone outlier — and a byte-swapped value produces a digest wrong in only 8 bytes, which fails at
+ * the far end with no clue why. The vectors carry a non-palindromic value precisely to catch it.
+ */
+export function int64BE(v) {
+    const out = new Uint8Array(8);
+    new DataView(out.buffer).setBigInt64(0, BigInt(v), false);
+    return out;
+}
+/** The element count of a variable-length list (rule 5). */
+export function count(n) {
+    return int32BE(n);
+}
+/** Concatenate encoded parts. */
+export function encoded(...parts) {
+    const total = parts.reduce((n, p) => n + p.length, 0);
+    const out = new Uint8Array(total);
+    let off = 0;
+    for (const p of parts) {
+        out.set(p, off);
+        off += p.length;
+    }
+    return out;
+}
+//# sourceMappingURL=canonical.js.map

package/dist/crypto/canonical.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical.js","sourceRoot":"","sources":["../../src/crypto/canonical.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,EAAE;AACF,6FAA6F;AAC7F,2FAA2F;AAC3F,gGAAgG;AAChG,kEAAkE;AAClE,EAAE;AACF,6EAA6E;AAC7E,0CAA0C;AAC1C,8EAA8E;AAC9E,+BAA+B;AAC/B,qEAAqE;AACrE,2BAA2B;AAC3B,2DAA2D;AAC3D,EAAE;AACF,gGAAgG;AAChG,+FAA+F;AAC/F,mEAAmE;AAEnE,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAE9B,uDAAuD;AACvD,MAAM,UAAU,cAAc,CAAC,KAAiB;IAC9C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,qBAAqB;IACjF,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAClB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,QAAQ,CAAC,CAAS;IAChC,OAAO,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,GAAG,CAAC,GAAW;IAC7B,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,iCAAiC;AACjC,MAAM,UAAU,OAAO,CAAC,CAAkB;IACxC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACvD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CAAC,CAAkB;IACxC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,KAAK,CAAC,CAAS;IAC7B,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,iCAAiC;AACjC,MAAM,UAAU,OAAO,CAAC,GAAG,KAAmB;IAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChB,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/crypto/group.d.ts

@@ -0,0 +1,29 @@
+import type { GroupKeyUnwrapper, WrappedKey } from "../types.js";
+export interface X25519Keypair {
+    priv: Uint8Array;
+    pub: Uint8Array;
+}
+export declare function genX25519(): X25519Keypair;
+export declare function randomGroupKey(): Uint8Array;
+/** Wrap the group key to a member's X25519 public key (ephemeral-sender ECIES). */
+export declare function wrapGroupKey(groupKey: Uint8Array, recipientPub: Uint8Array): Promise<WrappedKey>;
+/**
+ * An unwrapper over a NATIVE X25519 private key — the shape a separately registered
+ * encryption key would use (issue #53). The scalar lives only in this closure.
+ */
+export declare function x25519GroupKeyUnwrapper(priv: Uint8Array): GroupKeyUnwrapper;
+/**
+ * An unwrapper over an Ed25519 IDENTITY key: derives the key-agreement scalar once, at
+ * construction, and keeps it in this closure. This is what every member uses today —
+ * their on-chain Ed25519 key IS their encryption key.
+ *
+ * Pass the identity's 32-byte Ed25519 seed. Nothing else in the SDK or any application
+ * can obtain the derived scalar, which is the point: decryption is now reached through a
+ * handle, exactly as signing is reached through a Signer.
+ */
+export declare function edGroupKeyUnwrapper(edPriv: Uint8Array): GroupKeyUnwrapper;
+/** Encrypt a message under the group key (this is the opaque channel tx_body). */
+export declare function encryptMessage(groupKey: Uint8Array, plaintext: Uint8Array): Promise<Uint8Array>;
+/** Decrypt a message with the group key. */
+export declare function decryptMessage(groupKey: Uint8Array, blob: Uint8Array): Promise<Uint8Array>;
+//# sourceMappingURL=group.d.ts.map

package/dist/crypto/group.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"group.d.ts","sourceRoot":"","sources":["../../src/crypto/group.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEjE,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,UAAU,CAAC;IACjB,GAAG,EAAE,UAAU,CAAC;CACjB;AAED,wBAAgB,SAAS,IAAI,aAAa,CAGzC;AAED,wBAAgB,cAAc,IAAI,UAAU,CAI3C;AAuBD,mFAAmF;AACnF,wBAAsB,YAAY,CAAC,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAKtG;AAmBD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,UAAU,GAAG,iBAAiB,CAG3E;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,GAAG,iBAAiB,CAGzE;AAED,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAE/F;AAED,4CAA4C;AAC5C,wBAAgB,cAAc,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAE1F"}

package/dist/crypto/group.js

@@ -0,0 +1,107 @@
+// App-level "encrypted to the group" crypto. The chain sees only opaque ciphertext.
+// X25519 keys here decide WHO CAN READ a message; the on-chain auth keys decide WHO SENT
+// it. They are not independent: a member's key-agreement key is DERIVED from their
+// Ed25519 identity key (edwardsToMontgomery), so there is no separate encryption key to
+// generate, publish or look up — the on-chain identity key is the one source of truth for
+// both. (This comment used to claim the two were SEPARATE. They stopped being separate
+// when the derivation landed, and the consequences are issue #53: the same key both signs
+// and agrees, and a phone-held identity key cannot decrypt because a remote signer offers
+// signing but no ECDH.)
+//
+// The private half NEVER leaves this module. Callers hold a GroupKeyUnwrapper, whose
+// implementation closes over the scalar — the same discipline the Signer trait applies to
+// signing. That is also the seam for later: remote (phone-side) key agreement, or a
+// separately registered X25519 key, becomes one more implementation of this interface
+// rather than a change at every call site.
+//
+// Scheme (wire-compatible with examples/group-chat's original node:crypto impl):
+//   - a random 32-byte symmetric GROUP KEY encrypts messages (AES-256-GCM).
+//   - the group key is WRAPPED to each member's X25519 public key, ECIES-style:
+//     ephemeral X25519 → ECDH → HKDF-SHA256(salt = recipientPub) → AES-256-GCM.
+//   - AES framing: iv(12) ‖ ciphertext ‖ tag(16).
+//
+// Isomorphic: X25519 + HKDF via @noble, AES-256-GCM + RNG via Web Crypto (global
+// `crypto`, present in browsers and Node 16+). AES ops are therefore async.
+import { x25519, edwardsToMontgomeryPriv } from "@noble/curves/ed25519";
+import { hkdf } from "@noble/hashes/hkdf";
+import { sha256 } from "@noble/hashes/sha256";
+export function genX25519() {
+    const priv = x25519.utils.randomPrivateKey();
+    return { priv, pub: x25519.getPublicKey(priv) };
+}
+export function randomGroupKey() {
+    const k = new Uint8Array(32);
+    crypto.getRandomValues(k);
+    return k;
+}
+const KEK_INFO = new TextEncoder().encode("evolver-group-chat/kek/v1");
+async function aesGcmEncrypt(key, plaintext) {
+    const iv = new Uint8Array(12);
+    crypto.getRandomValues(iv);
+    const ck = await crypto.subtle.importKey("raw", key, "AES-GCM", false, ["encrypt"]);
+    const ct = new Uint8Array(await crypto.subtle.encrypt({ name: "AES-GCM", iv }, ck, plaintext));
+    const out = new Uint8Array(iv.length + ct.length); // subtle appends the 16-byte tag to ct
+    out.set(iv, 0);
+    out.set(ct, iv.length);
+    return out;
+}
+async function aesGcmDecrypt(key, blob) {
+    if (blob.length < 12 + 16)
+        throw new Error("ciphertext too short");
+    const iv = blob.subarray(0, 12);
+    const ctTag = blob.subarray(12);
+    const ck = await crypto.subtle.importKey("raw", key, "AES-GCM", false, ["decrypt"]);
+    return new Uint8Array(await crypto.subtle.decrypt({ name: "AES-GCM", iv: iv }, ck, ctTag));
+}
+/** Wrap the group key to a member's X25519 public key (ephemeral-sender ECIES). */
+export async function wrapGroupKey(groupKey, recipientPub) {
+    const eph = genX25519();
+    const shared = x25519.getSharedSecret(eph.priv, recipientPub);
+    const kek = hkdf(sha256, shared, recipientPub, KEK_INFO, 32);
+    return { ephPub: eph.pub, blob: await aesGcmEncrypt(kek, groupKey) };
+}
+/** Recover the group key with the member's X25519 private key. MODULE-PRIVATE on purpose:
+ *  the only way to reach it is a [[GroupKeyUnwrapper]] built by one of the factories
+ *  below, so a raw key-agreement scalar never crosses a module boundary. */
+async function unwrapRaw(w, recipientPriv) {
+    const recipientPub = x25519.getPublicKey(recipientPriv);
+    const shared = x25519.getSharedSecret(recipientPriv, w.ephPub);
+    const kek = hkdf(sha256, shared, recipientPub, KEK_INFO, 32);
+    return aesGcmDecrypt(kek, w.blob);
+}
+/** X25519 private derived from an Ed25519 seed. Module-private: see the header — this is
+ *  the one derivation of the PRIVATE half in the SDK, and only the factory below calls it.
+ *  (`edToX25519Pub` is public, in ./auth.ts — public material is meant to travel.) */
+function edToX25519Priv(edPriv) {
+    return edwardsToMontgomeryPriv(edPriv);
+}
+/**
+ * An unwrapper over a NATIVE X25519 private key — the shape a separately registered
+ * encryption key would use (issue #53). The scalar lives only in this closure.
+ */
+export function x25519GroupKeyUnwrapper(priv) {
+    const held = priv;
+    return { keyType: "X25519", unwrap: (w) => unwrapRaw(w, held) };
+}
+/**
+ * An unwrapper over an Ed25519 IDENTITY key: derives the key-agreement scalar once, at
+ * construction, and keeps it in this closure. This is what every member uses today —
+ * their on-chain Ed25519 key IS their encryption key.
+ *
+ * Pass the identity's 32-byte Ed25519 seed. Nothing else in the SDK or any application
+ * can obtain the derived scalar, which is the point: decryption is now reached through a
+ * handle, exactly as signing is reached through a Signer.
+ */
+export function edGroupKeyUnwrapper(edPriv) {
+    const held = edToX25519Priv(edPriv);
+    return { keyType: "X25519 (from Ed25519 identity)", unwrap: (w) => unwrapRaw(w, held) };
+}
+/** Encrypt a message under the group key (this is the opaque channel tx_body). */
+export function encryptMessage(groupKey, plaintext) {
+    return aesGcmEncrypt(groupKey, plaintext);
+}
+/** Decrypt a message with the group key. */
+export function decryptMessage(groupKey, blob) {
+    return aesGcmDecrypt(groupKey, blob);
+}
+//# sourceMappingURL=group.js.map

package/dist/crypto/group.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"group.js","sourceRoot":"","sources":["../../src/crypto/group.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,yFAAyF;AACzF,mFAAmF;AACnF,wFAAwF;AACxF,0FAA0F;AAC1F,uFAAuF;AACvF,0FAA0F;AAC1F,0FAA0F;AAC1F,wBAAwB;AACxB,EAAE;AACF,qFAAqF;AACrF,0FAA0F;AAC1F,oFAAoF;AACpF,sFAAsF;AACtF,2CAA2C;AAC3C,EAAE;AACF,iFAAiF;AACjF,4EAA4E;AAC5E,gFAAgF;AAChF,gFAAgF;AAChF,kDAAkD;AAClD,EAAE;AACF,iFAAiF;AACjF,4EAA4E;AAE5E,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAQ9C,MAAM,UAAU,SAAS;IACvB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC;IAC7C,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,MAAM,CAAC,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC7B,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC;AAEvE,KAAK,UAAU,aAAa,CAAC,GAAe,EAAE,SAAqB;IACjE,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC9B,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAmB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACpG,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,SAAyB,CAAC,CAAC,CAAC;IAC/G,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,uCAAuC;IAC1F,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACf,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IACvB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAe,EAAE,IAAgB;IAC5D,IAAI,IAAI,CAAC,MAAM,GAAG,EAAE,GAAG,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACnE,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAChC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAmB,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACpG,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAkB,EAAE,EAAE,EAAE,EAAE,KAAqB,CAAC,CAAC,CAAC;AAC7H,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAoB,EAAE,YAAwB;IAC/E,MAAM,GAAG,GAAG,SAAS,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC7D,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,CAAC;AACvE,CAAC;AAED;;4EAE4E;AAC5E,KAAK,UAAU,SAAS,CAAC,CAAa,EAAE,aAAyB;IAC/D,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,aAAa,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC7D,OAAO,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED;;sFAEsF;AACtF,SAAS,cAAc,CAAC,MAAkB;IACxC,OAAO,uBAAuB,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAgB;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC;IAClB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;AAClE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAkB;IACpD,MAAM,IAAI,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;IACpC,OAAO,EAAE,OAAO,EAAE,gCAAgC,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,QAAoB,EAAE,SAAqB;IACxE,OAAO,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,cAAc,CAAC,QAAoB,EAAE,IAAgB;IACnE,OAAO,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AACvC,CAAC"}

package/dist/crypto/hash.d.ts

@@ -0,0 +1,7 @@
+export declare function sha256(b: Uint8Array): Uint8Array;
+/** Alias used where the call site means "the body hash". */
+export declare const hash256: typeof sha256;
+export declare function concatBytes(...arrays: Uint8Array[]): Uint8Array;
+export declare function bytesToHex(bytes: Uint8Array): string;
+export declare function hexToBytes(hex: string): Uint8Array;
+//# sourceMappingURL=hash.d.ts.map

package/dist/crypto/hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../../src/crypto/hash.ts"],"names":[],"mappings":"AAIA,wBAAgB,MAAM,CAAC,CAAC,EAAE,UAAU,GAAG,UAAU,CAEhD;AAED,4DAA4D;AAC5D,eAAO,MAAM,OAAO,eAAS,CAAC;AAE9B,wBAAgB,WAAW,CAAC,GAAG,MAAM,EAAE,UAAU,EAAE,GAAG,UAAU,CAU/D;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIpD;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAKlD"}

package/dist/crypto/hash.js

@@ -0,0 +1,34 @@
+// SHA-256 + byte utilities. Isomorphic (@noble/hashes is pure JS).
+import { sha256 as nobleSha256 } from "@noble/hashes/sha256";
+export function sha256(b) {
+    return nobleSha256(b);
+}
+/** Alias used where the call site means "the body hash". */
+export const hash256 = sha256;
+export function concatBytes(...arrays) {
+    let len = 0;
+    for (const a of arrays)
+        len += a.length;
+    const out = new Uint8Array(len);
+    let i = 0;
+    for (const a of arrays) {
+        out.set(a, i);
+        i += a.length;
+    }
+    return out;
+}
+export function bytesToHex(bytes) {
+    let s = "";
+    for (const b of bytes)
+        s += b.toString(16).padStart(2, "0");
+    return s;
+}
+export function hexToBytes(hex) {
+    if (hex.length % 2 !== 0)
+        throw new Error("invalid hex string");
+    const out = new Uint8Array(hex.length / 2);
+    for (let i = 0; i < out.length; i++)
+        out[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+    return out;
+}
+//# sourceMappingURL=hash.js.map

package/dist/crypto/hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.js","sourceRoot":"","sources":["../../src/crypto/hash.ts"],"names":[],"mappings":"AAAA,mEAAmE;AAEnE,OAAO,EAAE,MAAM,IAAI,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAE7D,MAAM,UAAU,MAAM,CAAC,CAAa;IAClC,OAAO,WAAW,CAAC,CAAC,CAAC,CAAC;AACxB,CAAC;AAED,4DAA4D;AAC5D,MAAM,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC;AAE9B,MAAM,UAAU,WAAW,CAAC,GAAG,MAAoB;IACjD,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,CAAC,IAAI,MAAM;QAAE,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACd,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAiB;IAC1C,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5D,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxF,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/crypto/stream.d.ts

@@ -0,0 +1,27 @@
+export declare const SEG_BYTES = 1048576;
+/** Exact ciphertext length for a known plaintext length. */
+export declare function ctSize(plaintextBytes: number): number;
+/** Plaintext → v2 envelope. Buffers ≤ one segment.
+ *
+ *  `noncePrefix` is injectable so format vectors are reproducible. IV uniqueness
+ *  rests on (key, prefix) being used for exactly ONE file: reusing a key across
+ *  files REQUIRES a distinct random prefix per file, and reusing a prefix
+ *  REQUIRES a fresh key. Breaking that reuses an IV under one key, which forfeits
+ *  both confidentiality and authenticity for every affected segment. The default
+ *  (random prefix, and a fresh per-attachment key from the caller) satisfies it
+ *  structurally — pass this only where both halves are known-fresh. */
+export declare function encryptStream(key: Uint8Array, opts?: {
+    noncePrefix?: Uint8Array;
+}): {
+    transform: TransformStream<Uint8Array, Uint8Array>;
+};
+/** v2 envelope → plaintext. Errors on ANY decrypt-obligation violation; only
+ *  verified segments are emitted. rangeMode: the stream carries header+prefix
+ *  followed by segments starting at firstSegIndex; ONLY the terminal-flag
+ *  obligation is relaxed (an interior range cannot observe finality). */
+export declare function decryptStream(key: Uint8Array, opts?: {
+    rangeMode?: {
+        firstSegIndex: number;
+    };
+}): TransformStream<Uint8Array, Uint8Array>;
+//# sourceMappingURL=stream.d.ts.map

package/dist/crypto/stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../src/crypto/stream.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,SAAS,UAAY,CAAC;AAEnC,4DAA4D;AAC5D,wBAAgB,MAAM,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,CAGrD;AA6CD;;;;;;;;uEAQuE;AACvE,wBAAgB,aAAa,CAC3B,GAAG,EAAE,UAAU,EACf,IAAI,CAAC,EAAE;IAAE,WAAW,CAAC,EAAE,UAAU,CAAA;CAAE,GAClC;IAAE,SAAS,EAAE,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;CAAE,CAkCxD;AAED;;;yEAGyE;AACzE,wBAAgB,aAAa,CAC3B,GAAG,EAAE,UAAU,EACf,IAAI,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAC/C,eAAe,CAAC,UAAU,EAAE,UAAU,CAAC,CAsDzC"}