@novasamatech/host-papp 0.8.11 → 0.9.0

package/README.md

@@ -35,10 +35,6 @@ const papp = createPappAdapter({
   // otherwise existing pairings will be lost.
   appId: 'my-host-app',
 
-  // URL to a JSON document describing the host: { name: string, icon: string }.
-  // The icon should be a rasterized image at least 256x256 px.
-  metadata: 'https://my-host-app.example/papp-metadata.json',
-
   // Optional environment metadata shown on the wallet's confirmation screen.
   hostMetadata: {
     hostVersion: '1.4.0',
@@ -48,14 +44,15 @@ const papp = createPappAdapter({
 });
 ```
 
-`createPappAdapter` returns four sub-modules:
+`createPappAdapter` returns five sub-modules:
 
-| Module          | Purpose                                                                |
-| --------------- | ---------------------------------------------------------------------- |
-| `papp.sso`      | Authentication / pairing flow with a remote wallet.                    |
-| `papp.sessions` | List of paired user sessions and per-session messaging (sign, etc.).   |
-| `papp.secrets`  | Local secret storage for the derived guest accounts.                   |
-| `papp.identity` | On-chain identity lookups for arbitrary account ids.                   |
+| Module           | Purpose                                                              |
+| ---------------- | ------------------------------------------------------------------- |
+| `papp.sso`       | Authentication / pairing flow with a remote wallet.                 |
+| `papp.sessions`  | List of paired user sessions and per-session messaging (sign, etc.).|
+| `papp.secrets`   | Local secret storage for the derived guest accounts.                |
+| `papp.identity`  | On-chain identity lookups for arbitrary account ids.                |
+| `papp.allowance` | Resource allowances (bulletin / statement-store signers) per product.|
 
 Custom adapters (statement store, identity RPC, storage, lazy chain client) can be supplied
 via the `adapters` option for testing or non-browser environments.
@@ -200,6 +197,34 @@ await currentSession.signRaw({
 });
 ```
 
+`signVrf` asks the wallet for an sr25519 (schnorrkel) VRF signature from a product account
+(RFC-0023). The transcript travels as a recipe — a root domain-separation label plus an
+ordered list of `(label, value)` items — which the wallet replays verbatim into a Merlin
+transcript and signs. Callers that need a `signer` item must supply their own public key;
+the host never injects it.
+
+```ts
+const encoder = new TextEncoder();
+
+const vrf = await currentSession.signVrf({
+  productAccountId: ['product.dot', 0],
+  productId: 'product.dot',
+  transcriptLabel: encoder.encode('pop:airdrop'),
+  items: [
+    { label: encoder.encode('domain'), value: domainBytes },
+    { label: encoder.encode('signer'), value: accountPublicKey },
+  ],
+});
+
+vrf.match(
+  ({ preOutput, proof }) => submitLotteryTicket(preOutput, proof),
+  error => console.error('VRF signing failed:', error),
+);
+```
+
+This is the non-`AutoSigning` path only: when `AutoSigning` covers the account the host
+signs locally and never round-trips to the wallet.
+
 ## Ring VRF proofs and aliases
 
 A `UserSession` can ask the paired device for a privacy-preserving contextual alias, or a
@@ -208,7 +233,10 @@ selects the member key for the ring; `callingProductId` names the product the ho
 for. Both take the same `(context, ring)` so the alias in the proof matches `getRingVrfAlias`.
 
 ```ts
-const context = ['product.dot', '0x00']; // [productId, suffix] — suffix is a 0x-hex string
+// [productId, suffix]. The suffix is the wire `Index(u32) | Raw([u8; 32])` selector
+// (RFC 0022): `Index` for a plain index, `Raw` for a raw 32-byte index. It
+// expands to the same 32-byte value as a product account's derivation index.
+const context = ['product.dot', { tag: 'Index', value: 0 }];
 const ring = {
   chainId: '0x…', // 32-byte chain genesis hash
   junctions: [{ tag: 'PalletInstance', value: 42 }],
@@ -225,6 +253,28 @@ proof.match(
 );
 ```
 
+## Product subtree public keys
+
+Product accounts live at `//product//{productId}/{index}` (RFC 0022). The
+product junction is **hard**, so the user's root public key alone no longer
+determines product account public keys — the host asks the paired device for the
+product-subtree public key once, then soft-derives account public keys locally
+from it.
+
+```ts
+const subtreeKey = await currentSession.getProductSubtree('product.dot');
+
+subtreeKey.match(
+  publicKey => cacheProductSubtree('product.dot', publicKey), // one round trip per product, ever
+  error => console.error('subtree lookup failed:', error),
+);
+```
+
+The request is consent-free — the response carries no secret material. Only
+`AutoSigning` does: its payload is now the product-subtree secret key alone
+(`productRootPrivateKey`, 64-byte expanded sr25519 secret), which exposes exactly
+that product's subtree. The former `productDerivationSecret` is gone.
+
 ## Identity lookups
 
 `papp.identity` resolves on-chain identity data (lite / full username, credibility, slots)
@@ -246,6 +296,13 @@ const lookup = async (accountId: string) => {
 await papp.identity.getIdentities([accountIdA, accountIdB]);
 ```
 
+A paired `UserSession` also exposes `getIdentity()` as a shortcut that looks up the identity
+of its own user identity account — no account id to pass:
+
+```ts
+const identity = await session.getIdentity(); // Result<Identity | null, Error>
+```
+
 ## V2 SSO handshake
 
 V2 is a redesign of the SSO pairing flow that supports the same user identity across
@@ -258,38 +315,15 @@ identity, so contacts, chats, and roster events are shared between them.
 V2 is **not interoperable with V1**: a V1-only peer can't decode a V2 proposal QR and vice
 versa. Hosts that want to support both should branch on which protocol the peer advertises.
 
-### Shape of the flow
-
-```
-host                                          peer (authorising device)
-────────────────────────────────────────────────────────────────────────
-buildPairingDeeplink(device, metadata)
-  →  polkadotapp://pair?handshake=<hex>
-                                              scan QR, decode proposal
-                                              compute pairing topic from
-                                              the host's pubkeys
-                                              ECDH-encrypt + post:
-                                                Pending(AllowanceAllocation)
-                                                Success { encryptionKey,
-                                                          accountId,
-                                                          identitySignature }
-                                                Failed(reason)
-service.subscribeStatements(topic) +
-  poll the topic every 2s
-  ↓
-decode VersionedHandshakeResponse::V2
-  → ECDH-decrypt envelope with the
-    device encryption private key
-  → SCALE-decode inner payload
-  → state machine: Submitted → Pending →
-    Success | Failed
-  → on Success persist user identity
-```
+### The flow
 
-The user identity carried in `Success` is the chat encryption pubkey + the user's identity
-sr25519 accountId. The host verifies the 64-byte sr25519 `identitySignature` against the
-canonical 97 bytes `statementAccountId || encryptionPublicKey`
-(see `IDENTITY_SIGNATURE_PAYLOAD_BYTES`).
+1. The host builds a pairing deeplink from its device keypair and shows it as a QR code.
+2. The authorising device scans it and posts its response to the Statement Store: first a
+   `Pending` acknowledgement, then either `Success` — carrying the user's identity keys,
+   signed to authorise this device — or `Failed`.
+3. The host polls the pairing topic, decrypts and verifies each response, and drives a
+   `Submitted → Pending → Success | Failed` state machine. On `Success` it persists the
+   user identity.
 
 ### Building and rendering the QR
 
@@ -318,7 +352,7 @@ renderQrCode(deeplink); // 'polkadotapp://pair?handshake=<hex>'
 import { startPairingV2 } from '@novasamatech/host-papp';
 
 const pairing = startPairingV2({
-  statementStore: papp.adapters.statementStore, // any StatementStoreAdapter
+  statementStore, // any StatementStoreAdapter
   deviceIdentity: {
     statementAccountPublicKey: device.statementAccountPublicKey,
     encryptionPublicKey: device.encryptionPublicKey,
@@ -380,33 +414,14 @@ The service skips any incoming statement whose bytes match `initialProcessedData
 re-encrypts every Success with a fresh ephemeral key + AES-GCM nonce, so a genuine re-pair
 always produces different bytes and passes the dedupe.
 
-### Pairing topic / channel
+## Reading allowances
 
-If the host needs to derive the pairing topic or channel itself (for example to subscribe
-in-line, or to verify a statement source):
+Each `UserSession` can read its own persisted allowance slot-account key for a given
+product and resource. The session id is implicit — you only pass the product and resource:
 
 ```ts
-import { computePairingTopic, computePairingChannel } from '@novasamatech/host-papp';
+const session = papp.sessions.sessions.read().at(0);
 
-const topic   = computePairingTopic(statementAccountId, encryptionPublicKey);
-const channel = computePairingChannel(statementAccountId, encryptionPublicKey);
-//   topic   = blake2b256_keyed(encryptionPublicKey || "topic",   key=statementAccountId)
-//   channel = blake2b256_keyed(encryptionPublicKey || "channel", key=statementAccountId)
+// resource: 'bulletin' | 'statementStore'
+const key = await session.readAllowance(productId, 'statementStore'); // Result<Uint8Array | null, Error>
 ```
-
-### Codec exports
-
-The SCALE codecs are exported as plain `Codec<T>` values for callers that need to
-encode/decode statements outside the orchestrator:
-
-| Export                            | Description                                                                                  |
-| --------------------------------- | -------------------------------------------------------------------------------------------- |
-| `VersionedHandshakeProposal`      | Outer enum; V2 at SCALE discriminant 1, with `_v1Reserved` at 0.                             |
-| `HandshakeProposalV2`             | `{ device, metadata }` — what the QR encodes.                                                |
-| `Device`                          | `{ statementAccountId(32), encryptionPublicKey(65) }`.                                        |
-| `MetadataKey`, `MetadataEntry`    | Metadata enum + `(MetadataKey, str)` tuple.                                                   |
-| `VersionedHandshakeResponse`      | Outer enum for the answer; `V1` legacy + `V2`.                                                |
-| `HandshakeResponseV2`             | `{ encrypted, tmpKey(65) }` — the ECDH-wrapped envelope.                                      |
-| `EncryptedHandshakeResponseV2`    | Inner payload after envelope decrypt: `Pending` (1 byte), `Success` (161 bytes), `Failed`.    |
-| `HandshakeSuccessV2`              | `{ encryptionKey(65), accountId(32), identitySignature(64) }`.                                |
-| `IDENTITY_SIGNATURE_PAYLOAD_BYTES`| `97` — the bytes the user identity sr25519 signs over.                                       |

package/dist/crypto.js

@@ -1,13 +1,13 @@
-import { p256 } from '@noble/curves/nist.js';
+import { x25519 } from '@noble/curves/ed25519.js';
+import { Bytes } from '@novasamatech/scale';
 import { createSr25519Secret, deriveSr25519PublicKey, signWithSr25519Secret, verifySr25519Signature, } from '@novasamatech/statement-store';
 import { entropyToMiniSecret, mnemonicToEntropy } from '@polkadot-labs/hdkd-helpers';
-import { Bytes } from 'scale-ts';
 // schemas
 export function BrandedBytesCodec(length) {
     return Bytes(length);
 }
 export const SsPubKey = BrandedBytesCodec(32);
-export const EncrPubKey = BrandedBytesCodec(65);
+export const EncrPubKey = BrandedBytesCodec(32);
 // helpers
 const textEncoder = new TextEncoder();
 export function stringToBytes(str) {
@@ -27,16 +27,13 @@ export function deriveSr25519Account(mnemonic, derivation) {
 }
 // encryption key pair
 export function createEncrSecret(entropy) {
-    const miniSecret = entropyToMiniSecret(entropy);
-    const seed = new Uint8Array(48);
-    seed.set(miniSecret);
-    const { secretKey } = p256.keygen(seed);
-    return secretKey;
+    // The 32-byte mini-secret is the X25519 private scalar (clamped internally by @noble on use).
+    return entropyToMiniSecret(entropy);
 }
 export function getEncrPub(secret) {
-    return p256.getPublicKey(secret, false);
+    return x25519.getPublicKey(secret);
 }
 export function createSharedSecret(secret, publicKey) {
-    // slicing first byte: @noble/curves adds y offset at the start
-    return p256.getSharedSecret(secret, publicKey).slice(1, 33);
+    // The X25519 output is used whole. @noble aborts on an all-zero (small-order) result per RFC 7748.
+    return x25519.getSharedSecret(secret, publicKey);
 }

package/dist/crypto.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/crypto.spec.js

@@ -0,0 +1,31 @@
+import { describe, expect, it } from 'vitest';
+import { createSharedSecret, getEncrPub } from './crypto.js';
+// RFC 7748 §5.2 X25519 test vector.
+const fromHex = (hex) => Uint8Array.from(hex.match(/.{1,2}/g).map(byte => parseInt(byte, 16)));
+const ALICE_PRIVATE = '77076d0a7318a57d3c16c17251b26645df4c2f87ebc0992ab177fba51db92c2a';
+const ALICE_PUBLIC = '8520f0098930a754748b7ddcb43ef75a0dbf3a0d26381af4eba4a98eaa9b4e6a';
+const BOB_PRIVATE = '5dab087e624a8a4b79e17f8b83800ee66f3bb1292618b6fd1c2f8b27ff88e0eb';
+const BOB_PUBLIC = 'de9edb7d7b7dc1b4d35b61c2ece435373f8343c85b78674dadfc7e146f882b4f';
+const SHARED_SECRET = '4a5d9d5ba4ce2de1728e3bf480350f25e07e21c947d19e3376f09b3c1e161742';
+const asSecret = (hex) => fromHex(hex);
+describe('X25519 encryption keys', () => {
+    it('derives a 32-byte X25519 public key from a private scalar (RFC 7748 vector)', () => {
+        const publicKey = getEncrPub(asSecret(ALICE_PRIVATE));
+        expect(publicKey.length).toBe(32);
+        expect(publicKey).toEqual(fromHex(ALICE_PUBLIC));
+    });
+    it('computes the RFC 7748 shared secret whole, without slicing', () => {
+        const shared = createSharedSecret(asSecret(ALICE_PRIVATE), fromHex(BOB_PUBLIC));
+        expect(shared.length).toBe(32);
+        expect(shared).toEqual(fromHex(SHARED_SECRET));
+    });
+    it('agrees on the same shared secret from either side', () => {
+        const fromAlice = createSharedSecret(asSecret(ALICE_PRIVATE), fromHex(BOB_PUBLIC));
+        const fromBob = createSharedSecret(asSecret(BOB_PRIVATE), fromHex(ALICE_PUBLIC));
+        expect(fromAlice).toEqual(fromBob);
+    });
+    it('rejects a small-order public key (all-zero shared secret)', () => {
+        const smallOrderPoint = new Uint8Array(32);
+        expect(() => createSharedSecret(asSecret(ALICE_PRIVATE), smallOrderPoint)).toThrow();
+    });
+});

package/dist/helpers/createAsyncTaskPool.spec.js

@@ -1,5 +1,5 @@
 import { setTimeout } from 'node:timers/promises';
-import { err, fromPromise, ok, okAsync } from 'neverthrow';
+import { fromPromise, okAsync } from 'neverthrow';
 import { describe, expect, it, vi } from 'vitest';
 import { createAsyncTaskPool } from './createAsyncTaskPool.js';
 import { toError } from './utils.js';
@@ -8,7 +8,7 @@ describe('asyncTaskPool', () => {
     it('should exec async task', async () => {
         const pool = createAsyncTaskPool({ poolSize: 1, retryCount: 0, retryDelay: () => 0 });
         const result = await pool.call(() => fromPromise(delay().then(() => 'test'), toError));
-        expect(result).toEqual(ok('test'));
+        await expect(result).toBeOkWith('test');
     });
     it('should handle sync errors', async () => {
         const pool = createAsyncTaskPool({ poolSize: 1, retryCount: 0, retryDelay: () => 0 });
@@ -16,13 +16,13 @@ describe('asyncTaskPool', () => {
         const result = await pool.call(() => {
             throw error;
         });
-        expect(result).toEqual(err(error));
+        await expect(result).toBeErrWith(error);
     });
     it('should handle async errors', async () => {
         const pool = createAsyncTaskPool({ poolSize: 1, retryCount: 0, retryDelay: () => 0 });
         const error = new Error('test');
         const result = await pool.call(() => fromPromise(Promise.reject(error), toError));
-        return expect(result).toEqual(err(error));
+        await expect(result).toBeErrWith(error);
     });
     it('should handle queue', async () => {
         const pool = createAsyncTaskPool({ poolSize: 2, retryCount: 0, retryDelay: () => 0 });
@@ -52,7 +52,7 @@ describe('asyncTaskPool', () => {
             tries++;
             throw new Error();
         });
-        expect(result).toEqual(ok('test'));
+        await expect(result).toBeOkWith('test');
     });
     it('should throw on retry limit exceeding', async () => {
         const spy = vi.fn(() => 0);
@@ -66,7 +66,7 @@ describe('asyncTaskPool', () => {
             throw new Error();
         });
         expect(spy).toBeCalledTimes(1);
-        expect(result).toEqual(err(new Error()));
+        await expect(result).toBeErrWith(new Error());
     });
     it('should correctly calculate retry delay', async () => {
         const spy = vi.fn((retry) => retry * 10);
@@ -125,9 +125,9 @@ describe('asyncTaskPool', () => {
             const queued = pool.call(queuedSpy, { signal: controller.signal });
             controller.abort();
             const queuedResult = await queued;
-            expect(queuedResult.isErr()).toBe(true);
+            await expect(queuedResult).toBeErr();
             expect(queuedSpy).not.toHaveBeenCalled();
-            expect((await active).isOk()).toBe(true);
+            await expect(await active).toBeOk();
         });
         it('rejects the in-flight active task when the signal aborts', async () => {
             const pool = createAsyncTaskPool({ poolSize: 1, retryCount: 0, retryDelay: 0 });
@@ -136,7 +136,7 @@ describe('asyncTaskPool', () => {
                 signal: controller.signal,
             });
             controller.abort();
-            expect((await active).isErr()).toBe(true);
+            await expect(await active).toBeErr();
         });
         it('frees the slot for later tasks after an abort', async () => {
             const pool = createAsyncTaskPool({ poolSize: 1, retryCount: 0, retryDelay: 0 });
@@ -147,7 +147,7 @@ describe('asyncTaskPool', () => {
             controller.abort();
             await aborted;
             const next = await pool.call(() => okAsync('next'));
-            expect(next).toEqual(ok('next'));
+            await expect(next).toBeOkWith('next');
         });
         it('rejects immediately when called with an already-aborted signal', async () => {
             const pool = createAsyncTaskPool({ poolSize: 1, retryCount: 0, retryDelay: 0 });
@@ -155,7 +155,7 @@ describe('asyncTaskPool', () => {
             controller.abort();
             const spy = vi.fn(() => okAsync('x'));
             const result = await pool.call(spy, { signal: controller.signal });
-            expect(result.isErr()).toBe(true);
+            await expect(result).toBeErr();
             expect(spy).not.toHaveBeenCalled();
         });
     });

package/dist/index.d.ts

@@ -6,9 +6,12 @@ export type { PairingStatus } from './sso/auth/types.js';
 export type { DeviceIdentityForPairing } from './sso/auth/v2/service.js';
 export type { AllowanceErrorReason, AllowanceService } from './sso/allowance/index.js';
 export { AllowanceError } from './sso/allowance/index.js';
+export type { AllowanceResourceKind } from './sso/allowance/index.js';
 export type { UserSession } from './sso/sessionManager/userSession.js';
 export type { StoredUserSession } from './sso/userSessionRepository.js';
 export type { Identity } from './identity/types.js';
 export type { SignRawLegacyRequest, SignRawLegacyResponse, SigningPayloadRequest, SigningPayloadResponse, SigningRawRequest, SigningRequest, } from './sso/sessionManager/scale/signing.js';
 export type { RingVrfAliasRequest, RingVrfAliasResponse, RingVrfProofRequest, RingVrfProofResponse, } from './sso/sessionManager/scale/ringVrf.js';
+export type { SignVrfErr, SignVrfRequest, SignVrfResponse } from './sso/sessionManager/scale/signVrf.js';
 export type { CreateTransactionLegacyRequest, CreateTransactionRequest, CreateTransactionResponse, } from './sso/sessionManager/scale/createTransaction.js';
+export type { ProductSubtreeRequest, ProductSubtreeResponse } from './sso/sessionManager/scale/productSubtree.js';

package/dist/papp.js

@@ -19,6 +19,7 @@ export function createPappAdapter({ appId, hostMetadata, deviceIdentity, onAuthS
     const ssoSessionRepository = createUserSessionRepository(storage);
     const userSecretRepository = createUserSecretRepository(appId, storage);
     const allowanceRepository = createAllowanceRepository(appId, storage);
+    const identityRepository = createIdentityRepository({ adapter: identities, storage });
     const deviceIdentityStore = createDeviceIdentityStore(appId, storage);
     const sessions = createSsoSessionManager({
         storage,
@@ -26,6 +27,7 @@ export function createPappAdapter({ appId, hostMetadata, deviceIdentity, onAuthS
         ssoSessionRepository,
         userSecretRepository,
         allowanceRepository,
+        identityRepository,
     });
     return {
         sso: createAuth({
@@ -39,7 +41,7 @@ export function createPappAdapter({ appId, hostMetadata, deviceIdentity, onAuthS
         }),
         sessions,
         secrets: userSecretRepository,
-        identity: createIdentityRepository({ adapter: identities, storage }),
+        identity: identityRepository,
         allowance: createAllowanceService({ sessions: sessions.sessions, repository: allowanceRepository }),
     };
 }

package/dist/sso/allowance/repository.js

@@ -1,8 +1,9 @@
 import { gcm } from '@noble/ciphers/aes.js';
 import { blake2b } from '@noble/hashes/blake2.js';
+import { Bytes } from '@novasamatech/scale';
 import { fromThrowable } from 'neverthrow';
 import { fromHex, toHex } from 'polkadot-api/utils';
-import { Bytes, Enum, Struct, Vector, _void, str } from 'scale-ts';
+import { Enum, Struct, Vector, _void, str } from 'scale-ts';
 import { stringToBytes } from '../../crypto.js';
 import { toError } from '../../helpers/utils.js';
 const AllowanceResourceKindCodec = Enum({

package/dist/sso/auth/scale/handshakeV2.d.ts

@@ -16,14 +16,14 @@
  *                               for soft-derivation of product accounts; PApp
  *                               and host MUST derive identically so a dapp sees
  *                               the same address on every device.
- *   - `identityChatPrivateKey`— user identity chat P-256 private scalar (32 bytes),
+ *   - `identityChatPrivateKey`— user identity chat X25519 private scalar (32 bytes),
  *                               shared per the multi-device spec so this device
  *                               can decrypt traffic addressed to the user identity
- *   - `deviceEncPubKey`       — encryption public key of the PApp device (65 bytes,
- *                               P-256 uncompressed). Tells the host which key to
+ *   - `deviceEncPubKey`       — encryption public key of the PApp device (32 bytes,
+ *                               X25519). Tells the host which key to
  *                               use when addressing chat envelopes back to the
  *                               authorising PApp device.
- *   - `ssoEncPubKey`          — `papp_encr_pub` (65 bytes, P-256 uncompressed); see
+ *   - `ssoEncPubKey`          — `papp_encr_pub` (32 bytes, X25519); see
  *                               the `HandshakeSuccessV2` codec doc below.
  *   - `rootEntropySource`     — 32 bytes; `blake2b256_keyed(rootAccountSecret,
  *                               "product-entropy-derivation")` per RFC-0007 (layer 1).
@@ -137,7 +137,7 @@ export declare const HandshakeSuccessV2: import("scale-ts").Codec<{
     deviceEncPubKey: Uint8Array<ArrayBufferLike>;
     rootEntropySource: Uint8Array<ArrayBufferLike>;
 }>;
-/** Derive the identity chat P-256 public key (uncompressed) from its private scalar. */
+/** Derive the identity chat X25519 public key (32 bytes) from its private scalar. */
 export declare const deriveIdentityChatPublicKey: (privateKey: Uint8Array) => Uint8Array;
 export declare const HandshakeStatusV2: import("scale-ts").Codec<{
     tag: "AllowanceAllocation";

package/dist/sso/auth/scale/handshakeV2.js

@@ -16,14 +16,14 @@
  *                               for soft-derivation of product accounts; PApp
  *                               and host MUST derive identically so a dapp sees
  *                               the same address on every device.
- *   - `identityChatPrivateKey`— user identity chat P-256 private scalar (32 bytes),
+ *   - `identityChatPrivateKey`— user identity chat X25519 private scalar (32 bytes),
  *                               shared per the multi-device spec so this device
  *                               can decrypt traffic addressed to the user identity
- *   - `deviceEncPubKey`       — encryption public key of the PApp device (65 bytes,
- *                               P-256 uncompressed). Tells the host which key to
+ *   - `deviceEncPubKey`       — encryption public key of the PApp device (32 bytes,
+ *                               X25519). Tells the host which key to
  *                               use when addressing chat envelopes back to the
  *                               authorising PApp device.
- *   - `ssoEncPubKey`          — `papp_encr_pub` (65 bytes, P-256 uncompressed); see
+ *   - `ssoEncPubKey`          — `papp_encr_pub` (32 bytes, X25519); see
  *                               the `HandshakeSuccessV2` codec doc below.
  *   - `rootEntropySource`     — 32 bytes; `blake2b256_keyed(rootAccountSecret,
  *                               "product-entropy-derivation")` per RFC-0007 (layer 1).
@@ -31,10 +31,11 @@
  *                               (`host_derive_entropy`) without ever holding the raw
  *                               root account secret. See the codec doc below.
  */
-import { p256 } from '@noble/curves/nist.js';
-import { Bytes, Enum, Struct, Tuple, Vector, _void, str } from 'scale-ts';
+import { x25519 } from '@noble/curves/ed25519.js';
+import { Bytes } from '@novasamatech/scale';
+import { Enum, Struct, Tuple, Vector, _void, str } from 'scale-ts';
 const AccountIdCodec = Bytes(32);
-const PublicKeyCodec = Bytes(65);
+const PublicKeyCodec = Bytes(32);
 const PrivateKeyCodec = Bytes(32);
 const EntropySourceCodec = Bytes(32);
 export const MetadataKey = Enum({
@@ -63,14 +64,14 @@ export const HandshakeSuccessV2 = Struct({
     identityAccountId: AccountIdCodec,
     rootAccountId: AccountIdCodec,
     identityChatPrivateKey: PrivateKeyCodec,
-    /** PApp's P-256 SSO ECDH public key (`papp_encr_pub`). */
+    /** PApp's X25519 SSO ECDH public key (`papp_encr_pub`). */
     ssoEncPubKey: PublicKeyCodec,
     deviceEncPubKey: PublicKeyCodec,
     /** Layer-1 source for deterministic product entropy derivation (RFC-0007). */
     rootEntropySource: EntropySourceCodec,
 });
-/** Derive the identity chat P-256 public key (uncompressed) from its private scalar. */
-export const deriveIdentityChatPublicKey = (privateKey) => p256.getPublicKey(privateKey, false);
+/** Derive the identity chat X25519 public key (32 bytes) from its private scalar. */
+export const deriveIdentityChatPublicKey = (privateKey) => x25519.getPublicKey(privateKey);
 export const HandshakeStatusV2 = Enum({
     AllowanceAllocation: _void,
 });

package/dist/sso/auth/v2/envelope.d.ts

@@ -1,13 +1,13 @@
 /**
  * Decrypt the outer envelope of a `HandshakeResponseV2` statement payload.
  *
- * The answering side generates a one-shot P-256 keypair, performs ECDH against
- * the host device's encryption public key, and AES-GCM encrypts the sensitive
- * payload (the SCALE-encoded `EncryptedHandshakeResponseV2`) with a key
- * derived from the shared secret.
+ * The answering side generates a one-shot X25519 keypair, performs ECDH against
+ * the host device's encryption public key, and ChaCha20-Poly1305 encrypts the
+ * sensitive payload (the SCALE-encoded `EncryptedHandshakeResponseV2`) with a
+ * key derived from the shared secret.
  *
- * The shared-secret-to-AES-key derivation (HKDF-SHA256 over the ECDH X
- * coordinate) is delegated to `createEncryption(sharedSecret)` from
+ * The shared-secret-to-AEAD-key derivation (HKDF-SHA256 over the X25519 shared
+ * secret) is delegated to `createEncryption(sharedSecret)` from
  * `@novasamatech/statement-store` — byte-compatible with the existing V1
  * chat-request encryption helper, so we don't fork primitives here.
  */

package/dist/sso/auth/v2/envelope.js

@@ -1,21 +1,21 @@
 /**
  * Decrypt the outer envelope of a `HandshakeResponseV2` statement payload.
  *
- * The answering side generates a one-shot P-256 keypair, performs ECDH against
- * the host device's encryption public key, and AES-GCM encrypts the sensitive
- * payload (the SCALE-encoded `EncryptedHandshakeResponseV2`) with a key
- * derived from the shared secret.
+ * The answering side generates a one-shot X25519 keypair, performs ECDH against
+ * the host device's encryption public key, and ChaCha20-Poly1305 encrypts the
+ * sensitive payload (the SCALE-encoded `EncryptedHandshakeResponseV2`) with a
+ * key derived from the shared secret.
  *
- * The shared-secret-to-AES-key derivation (HKDF-SHA256 over the ECDH X
- * coordinate) is delegated to `createEncryption(sharedSecret)` from
+ * The shared-secret-to-AEAD-key derivation (HKDF-SHA256 over the X25519 shared
+ * secret) is delegated to `createEncryption(sharedSecret)` from
  * `@novasamatech/statement-store` — byte-compatible with the existing V1
  * chat-request encryption helper, so we don't fork primitives here.
  */
-import { p256 } from '@noble/curves/nist.js';
+import { x25519 } from '@noble/curves/ed25519.js';
 import { createEncryption } from '@novasamatech/statement-store';
-const ecdhX = (privateKey, peerPublicKey) => p256.getSharedSecret(privateKey, peerPublicKey).slice(1, 33);
+const ecdh = (privateKey, peerPublicKey) => x25519.getSharedSecret(privateKey, peerPublicKey);
 export const decryptResponseEnvelope = (deviceEncryptionPrivateKey, envelope) => {
-    const shared = ecdhX(deviceEncryptionPrivateKey, envelope.tmpKey);
+    const shared = ecdh(deviceEncryptionPrivateKey, envelope.tmpKey);
     const result = createEncryption(shared).decrypt(envelope.encrypted);
     if (result.isErr())
         throw result.error;

package/dist/sso/auth/v2/state.d.ts

@@ -29,8 +29,8 @@ export type HandshakePendingState = {
 export type HandshakeSuccessState = CodecType<typeof HandshakeSuccessV2> & {
     tag: 'Success';
     /**
-     * Derived locally from `identityChatPrivateKey` via P-256 scalar
-     * multiplication (uncompressed 65-byte form). Both sides MUST derive
+     * Derived locally from `identityChatPrivateKey` via X25519 scalar
+     * multiplication (32-byte form). Both sides MUST derive
      * identically; downstream session topics depend on it.
      */
     identityChatPublicKey: Uint8Array;

package/dist/sso/auth/v2/topic.d.ts

@@ -6,7 +6,7 @@
  *
  * Where:
  *   - `statementAccountId`     = the host's sr25519 device public key (32 bytes)
- *   - `encryptionPublicKey`    = the host's P-256 device public key (65 bytes uncompressed)
+ *   - `encryptionPublicKey`    = the host's X25519 device public key (32 bytes)
  *
  * Both sides compute the same topic/channel deterministically from the same
  * pubkeys carried in the QR-coded `VersionedHandshakeProposal::V2`, so they

package/dist/sso/auth/v2/topic.js

@@ -6,7 +6,7 @@
  *
  * Where:
  *   - `statementAccountId`     = the host's sr25519 device public key (32 bytes)
- *   - `encryptionPublicKey`    = the host's P-256 device public key (65 bytes uncompressed)
+ *   - `encryptionPublicKey`    = the host's X25519 device public key (32 bytes)
  *
  * Both sides compute the same topic/channel deterministically from the same
  * pubkeys carried in the QR-coded `VersionedHandshakeProposal::V2`, so they

package/dist/sso/deviceIdentityStore.js

@@ -1,9 +1,10 @@
 import { gcm } from '@noble/ciphers/aes.js';
 import { blake2b } from '@noble/hashes/blake2.js';
+import { Bytes } from '@novasamatech/scale';
 import { createSr25519Secret, deriveSr25519PublicKey } from '@novasamatech/statement-store';
 import { errAsync, fromPromise, okAsync } from 'neverthrow';
 import { fromHex, toHex } from 'polkadot-api/utils';
-import { Bytes, Option, Struct, str } from 'scale-ts';
+import { Option, Struct, str } from 'scale-ts';
 import { getEncrPub, stringToBytes } from '../crypto.js';
 import { toError } from '../helpers/utils.js';
 const KEY = 'DeviceIdentity';

package/dist/sso/sessionManager/impl.d.ts

@@ -1,5 +1,6 @@
 import type { StatementStoreAdapter } from '@novasamatech/statement-store';
 import type { StorageAdapter } from '@novasamatech/storage-adapter';
+import type { IdentityRepository } from '../../identity/types.js';
 import type { Callback } from '../../types.js';
 import type { AllowanceRepository } from '../allowance/index.js';
 import type { UserSecretRepository } from '../userSecretRepository.js';
@@ -12,8 +13,9 @@ type Params = {
     ssoSessionRepository: UserSessionRepository;
     userSecretRepository: UserSecretRepository;
     allowanceRepository: AllowanceRepository;
+    identityRepository: IdentityRepository;
 };
-export declare function createSsoSessionManager({ ssoSessionRepository, userSecretRepository, allowanceRepository, statementStore, storage, }: Params): {
+export declare function createSsoSessionManager({ ssoSessionRepository, userSecretRepository, allowanceRepository, identityRepository, statementStore, storage, }: Params): {
     sessions: {
         read: () => UserSession[];
         subscribe: (callback: Callback<UserSession[]>) => () => void;