@novasamatech/host-papp 0.8.12 → 0.9.1

package/README.md

@@ -233,7 +233,10 @@ selects the member key for the ring; `callingProductId` names the product the ho
 for. Both take the same `(context, ring)` so the alias in the proof matches `getRingVrfAlias`.
 
 ```ts
-const context = ['product.dot', '0x00']; // [productId, suffix] — suffix is a 0x-hex string
+// [productId, suffix]. The suffix is the wire `Index(u32) | Raw([u8; 32])` selector
+// (RFC 0022): `Index` for a plain index, `Raw` for a raw 32-byte index. It
+// expands to the same 32-byte value as a product account's derivation index.
+const context = ['product.dot', { tag: 'Index', value: 0 }];
 const ring = {
   chainId: '0x…', // 32-byte chain genesis hash
   junctions: [{ tag: 'PalletInstance', value: 42 }],
@@ -250,6 +253,28 @@ proof.match(
 );
 ```
 
+## Product subtree public keys
+
+Product accounts live at `//product//{productId}/{index}` (RFC 0022). The
+product junction is **hard**, so the user's root public key alone no longer
+determines product account public keys — the host asks the paired device for the
+product-subtree public key once, then soft-derives account public keys locally
+from it.
+
+```ts
+const subtreeKey = await currentSession.getProductSubtree('product.dot');
+
+subtreeKey.match(
+  publicKey => cacheProductSubtree('product.dot', publicKey), // one round trip per product, ever
+  error => console.error('subtree lookup failed:', error),
+);
+```
+
+The request is consent-free — the response carries no secret material. Only
+`AutoSigning` does: its payload is now the product-subtree secret key alone
+(`productRootPrivateKey`, 64-byte expanded sr25519 secret), which exposes exactly
+that product's subtree. The former `productDerivationSecret` is gone.
+
 ## Identity lookups
 
 `papp.identity` resolves on-chain identity data (lite / full username, credibility, slots)

package/dist/crypto.js

@@ -1,13 +1,13 @@
-import { p256 } from '@noble/curves/nist.js';
+import { x25519 } from '@noble/curves/ed25519.js';
+import { Bytes } from '@novasamatech/scale';
 import { createSr25519Secret, deriveSr25519PublicKey, signWithSr25519Secret, verifySr25519Signature, } from '@novasamatech/statement-store';
 import { entropyToMiniSecret, mnemonicToEntropy } from '@polkadot-labs/hdkd-helpers';
-import { Bytes } from 'scale-ts';
 // schemas
 export function BrandedBytesCodec(length) {
     return Bytes(length);
 }
 export const SsPubKey = BrandedBytesCodec(32);
-export const EncrPubKey = BrandedBytesCodec(65);
+export const EncrPubKey = BrandedBytesCodec(32);
 // helpers
 const textEncoder = new TextEncoder();
 export function stringToBytes(str) {
@@ -27,16 +27,13 @@ export function deriveSr25519Account(mnemonic, derivation) {
 }
 // encryption key pair
 export function createEncrSecret(entropy) {
-    const miniSecret = entropyToMiniSecret(entropy);
-    const seed = new Uint8Array(48);
-    seed.set(miniSecret);
-    const { secretKey } = p256.keygen(seed);
-    return secretKey;
+    // The 32-byte mini-secret is the X25519 private scalar (clamped internally by @noble on use).
+    return entropyToMiniSecret(entropy);
 }
 export function getEncrPub(secret) {
-    return p256.getPublicKey(secret, false);
+    return x25519.getPublicKey(secret);
 }
 export function createSharedSecret(secret, publicKey) {
-    // slicing first byte: @noble/curves adds y offset at the start
-    return p256.getSharedSecret(secret, publicKey).slice(1, 33);
+    // The X25519 output is used whole. @noble aborts on an all-zero (small-order) result per RFC 7748.
+    return x25519.getSharedSecret(secret, publicKey);
 }

package/dist/crypto.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/crypto.spec.js

@@ -0,0 +1,31 @@
+import { describe, expect, it } from 'vitest';
+import { createSharedSecret, getEncrPub } from './crypto.js';
+// RFC 7748 §5.2 X25519 test vector.
+const fromHex = (hex) => Uint8Array.from(hex.match(/.{1,2}/g).map(byte => parseInt(byte, 16)));
+const ALICE_PRIVATE = '77076d0a7318a57d3c16c17251b26645df4c2f87ebc0992ab177fba51db92c2a';
+const ALICE_PUBLIC = '8520f0098930a754748b7ddcb43ef75a0dbf3a0d26381af4eba4a98eaa9b4e6a';
+const BOB_PRIVATE = '5dab087e624a8a4b79e17f8b83800ee66f3bb1292618b6fd1c2f8b27ff88e0eb';
+const BOB_PUBLIC = 'de9edb7d7b7dc1b4d35b61c2ece435373f8343c85b78674dadfc7e146f882b4f';
+const SHARED_SECRET = '4a5d9d5ba4ce2de1728e3bf480350f25e07e21c947d19e3376f09b3c1e161742';
+const asSecret = (hex) => fromHex(hex);
+describe('X25519 encryption keys', () => {
+    it('derives a 32-byte X25519 public key from a private scalar (RFC 7748 vector)', () => {
+        const publicKey = getEncrPub(asSecret(ALICE_PRIVATE));
+        expect(publicKey.length).toBe(32);
+        expect(publicKey).toEqual(fromHex(ALICE_PUBLIC));
+    });
+    it('computes the RFC 7748 shared secret whole, without slicing', () => {
+        const shared = createSharedSecret(asSecret(ALICE_PRIVATE), fromHex(BOB_PUBLIC));
+        expect(shared.length).toBe(32);
+        expect(shared).toEqual(fromHex(SHARED_SECRET));
+    });
+    it('agrees on the same shared secret from either side', () => {
+        const fromAlice = createSharedSecret(asSecret(ALICE_PRIVATE), fromHex(BOB_PUBLIC));
+        const fromBob = createSharedSecret(asSecret(BOB_PRIVATE), fromHex(ALICE_PUBLIC));
+        expect(fromAlice).toEqual(fromBob);
+    });
+    it('rejects a small-order public key (all-zero shared secret)', () => {
+        const smallOrderPoint = new Uint8Array(32);
+        expect(() => createSharedSecret(asSecret(ALICE_PRIVATE), smallOrderPoint)).toThrow();
+    });
+});

package/dist/index.d.ts

@@ -14,3 +14,4 @@ export type { SignRawLegacyRequest, SignRawLegacyResponse, SigningPayloadRequest
 export type { RingVrfAliasRequest, RingVrfAliasResponse, RingVrfProofRequest, RingVrfProofResponse, } from './sso/sessionManager/scale/ringVrf.js';
 export type { SignVrfErr, SignVrfRequest, SignVrfResponse } from './sso/sessionManager/scale/signVrf.js';
 export type { CreateTransactionLegacyRequest, CreateTransactionRequest, CreateTransactionResponse, } from './sso/sessionManager/scale/createTransaction.js';
+export type { ProductSubtreeRequest, ProductSubtreeResponse } from './sso/sessionManager/scale/productSubtree.js';

package/dist/sso/allowance/repository.js

@@ -1,8 +1,9 @@
 import { gcm } from '@noble/ciphers/aes.js';
 import { blake2b } from '@noble/hashes/blake2.js';
+import { Bytes } from '@novasamatech/scale';
 import { fromThrowable } from 'neverthrow';
 import { fromHex, toHex } from 'polkadot-api/utils';
-import { Bytes, Enum, Struct, Vector, _void, str } from 'scale-ts';
+import { Enum, Struct, Vector, _void, str } from 'scale-ts';
 import { stringToBytes } from '../../crypto.js';
 import { toError } from '../../helpers/utils.js';
 const AllowanceResourceKindCodec = Enum({

package/dist/sso/auth/scale/handshakeV2.d.ts

@@ -16,14 +16,14 @@
  *                               for soft-derivation of product accounts; PApp
  *                               and host MUST derive identically so a dapp sees
  *                               the same address on every device.
- *   - `identityChatPrivateKey`— user identity chat P-256 private scalar (32 bytes),
+ *   - `identityChatPrivateKey`— user identity chat X25519 private scalar (32 bytes),
  *                               shared per the multi-device spec so this device
  *                               can decrypt traffic addressed to the user identity
- *   - `deviceEncPubKey`       — encryption public key of the PApp device (65 bytes,
- *                               P-256 uncompressed). Tells the host which key to
+ *   - `deviceEncPubKey`       — encryption public key of the PApp device (32 bytes,
+ *                               X25519). Tells the host which key to
  *                               use when addressing chat envelopes back to the
  *                               authorising PApp device.
- *   - `ssoEncPubKey`          — `papp_encr_pub` (65 bytes, P-256 uncompressed); see
+ *   - `ssoEncPubKey`          — `papp_encr_pub` (32 bytes, X25519); see
  *                               the `HandshakeSuccessV2` codec doc below.
  *   - `rootEntropySource`     — 32 bytes; `blake2b256_keyed(rootAccountSecret,
  *                               "product-entropy-derivation")` per RFC-0007 (layer 1).
@@ -137,7 +137,7 @@ export declare const HandshakeSuccessV2: import("scale-ts").Codec<{
     deviceEncPubKey: Uint8Array<ArrayBufferLike>;
     rootEntropySource: Uint8Array<ArrayBufferLike>;
 }>;
-/** Derive the identity chat P-256 public key (uncompressed) from its private scalar. */
+/** Derive the identity chat X25519 public key (32 bytes) from its private scalar. */
 export declare const deriveIdentityChatPublicKey: (privateKey: Uint8Array) => Uint8Array;
 export declare const HandshakeStatusV2: import("scale-ts").Codec<{
     tag: "AllowanceAllocation";

package/dist/sso/auth/scale/handshakeV2.js

@@ -16,14 +16,14 @@
  *                               for soft-derivation of product accounts; PApp
  *                               and host MUST derive identically so a dapp sees
  *                               the same address on every device.
- *   - `identityChatPrivateKey`— user identity chat P-256 private scalar (32 bytes),
+ *   - `identityChatPrivateKey`— user identity chat X25519 private scalar (32 bytes),
  *                               shared per the multi-device spec so this device
  *                               can decrypt traffic addressed to the user identity
- *   - `deviceEncPubKey`       — encryption public key of the PApp device (65 bytes,
- *                               P-256 uncompressed). Tells the host which key to
+ *   - `deviceEncPubKey`       — encryption public key of the PApp device (32 bytes,
+ *                               X25519). Tells the host which key to
  *                               use when addressing chat envelopes back to the
  *                               authorising PApp device.
- *   - `ssoEncPubKey`          — `papp_encr_pub` (65 bytes, P-256 uncompressed); see
+ *   - `ssoEncPubKey`          — `papp_encr_pub` (32 bytes, X25519); see
  *                               the `HandshakeSuccessV2` codec doc below.
  *   - `rootEntropySource`     — 32 bytes; `blake2b256_keyed(rootAccountSecret,
  *                               "product-entropy-derivation")` per RFC-0007 (layer 1).
@@ -31,10 +31,11 @@
  *                               (`host_derive_entropy`) without ever holding the raw
  *                               root account secret. See the codec doc below.
  */
-import { p256 } from '@noble/curves/nist.js';
-import { Bytes, Enum, Struct, Tuple, Vector, _void, str } from 'scale-ts';
+import { x25519 } from '@noble/curves/ed25519.js';
+import { Bytes } from '@novasamatech/scale';
+import { Enum, Struct, Tuple, Vector, _void, str } from 'scale-ts';
 const AccountIdCodec = Bytes(32);
-const PublicKeyCodec = Bytes(65);
+const PublicKeyCodec = Bytes(32);
 const PrivateKeyCodec = Bytes(32);
 const EntropySourceCodec = Bytes(32);
 export const MetadataKey = Enum({
@@ -63,14 +64,14 @@ export const HandshakeSuccessV2 = Struct({
     identityAccountId: AccountIdCodec,
     rootAccountId: AccountIdCodec,
     identityChatPrivateKey: PrivateKeyCodec,
-    /** PApp's P-256 SSO ECDH public key (`papp_encr_pub`). */
+    /** PApp's X25519 SSO ECDH public key (`papp_encr_pub`). */
     ssoEncPubKey: PublicKeyCodec,
     deviceEncPubKey: PublicKeyCodec,
     /** Layer-1 source for deterministic product entropy derivation (RFC-0007). */
     rootEntropySource: EntropySourceCodec,
 });
-/** Derive the identity chat P-256 public key (uncompressed) from its private scalar. */
-export const deriveIdentityChatPublicKey = (privateKey) => p256.getPublicKey(privateKey, false);
+/** Derive the identity chat X25519 public key (32 bytes) from its private scalar. */
+export const deriveIdentityChatPublicKey = (privateKey) => x25519.getPublicKey(privateKey);
 export const HandshakeStatusV2 = Enum({
     AllowanceAllocation: _void,
 });

package/dist/sso/auth/v2/envelope.d.ts

@@ -1,13 +1,13 @@
 /**
  * Decrypt the outer envelope of a `HandshakeResponseV2` statement payload.
  *
- * The answering side generates a one-shot P-256 keypair, performs ECDH against
- * the host device's encryption public key, and AES-GCM encrypts the sensitive
- * payload (the SCALE-encoded `EncryptedHandshakeResponseV2`) with a key
- * derived from the shared secret.
+ * The answering side generates a one-shot X25519 keypair, performs ECDH against
+ * the host device's encryption public key, and ChaCha20-Poly1305 encrypts the
+ * sensitive payload (the SCALE-encoded `EncryptedHandshakeResponseV2`) with a
+ * key derived from the shared secret.
  *
- * The shared-secret-to-AES-key derivation (HKDF-SHA256 over the ECDH X
- * coordinate) is delegated to `createEncryption(sharedSecret)` from
+ * The shared-secret-to-AEAD-key derivation (HKDF-SHA256 over the X25519 shared
+ * secret) is delegated to `createEncryption(sharedSecret)` from
  * `@novasamatech/statement-store` — byte-compatible with the existing V1
  * chat-request encryption helper, so we don't fork primitives here.
  */

package/dist/sso/auth/v2/envelope.js

@@ -1,21 +1,21 @@
 /**
  * Decrypt the outer envelope of a `HandshakeResponseV2` statement payload.
  *
- * The answering side generates a one-shot P-256 keypair, performs ECDH against
- * the host device's encryption public key, and AES-GCM encrypts the sensitive
- * payload (the SCALE-encoded `EncryptedHandshakeResponseV2`) with a key
- * derived from the shared secret.
+ * The answering side generates a one-shot X25519 keypair, performs ECDH against
+ * the host device's encryption public key, and ChaCha20-Poly1305 encrypts the
+ * sensitive payload (the SCALE-encoded `EncryptedHandshakeResponseV2`) with a
+ * key derived from the shared secret.
  *
- * The shared-secret-to-AES-key derivation (HKDF-SHA256 over the ECDH X
- * coordinate) is delegated to `createEncryption(sharedSecret)` from
+ * The shared-secret-to-AEAD-key derivation (HKDF-SHA256 over the X25519 shared
+ * secret) is delegated to `createEncryption(sharedSecret)` from
  * `@novasamatech/statement-store` — byte-compatible with the existing V1
  * chat-request encryption helper, so we don't fork primitives here.
  */
-import { p256 } from '@noble/curves/nist.js';
+import { x25519 } from '@noble/curves/ed25519.js';
 import { createEncryption } from '@novasamatech/statement-store';
-const ecdhX = (privateKey, peerPublicKey) => p256.getSharedSecret(privateKey, peerPublicKey).slice(1, 33);
+const ecdh = (privateKey, peerPublicKey) => x25519.getSharedSecret(privateKey, peerPublicKey);
 export const decryptResponseEnvelope = (deviceEncryptionPrivateKey, envelope) => {
-    const shared = ecdhX(deviceEncryptionPrivateKey, envelope.tmpKey);
+    const shared = ecdh(deviceEncryptionPrivateKey, envelope.tmpKey);
     const result = createEncryption(shared).decrypt(envelope.encrypted);
     if (result.isErr())
         throw result.error;

package/dist/sso/auth/v2/state.d.ts

@@ -29,8 +29,8 @@ export type HandshakePendingState = {
 export type HandshakeSuccessState = CodecType<typeof HandshakeSuccessV2> & {
     tag: 'Success';
     /**
-     * Derived locally from `identityChatPrivateKey` via P-256 scalar
-     * multiplication (uncompressed 65-byte form). Both sides MUST derive
+     * Derived locally from `identityChatPrivateKey` via X25519 scalar
+     * multiplication (32-byte form). Both sides MUST derive
      * identically; downstream session topics depend on it.
      */
     identityChatPublicKey: Uint8Array;

package/dist/sso/auth/v2/topic.d.ts

@@ -6,7 +6,7 @@
  *
  * Where:
  *   - `statementAccountId`     = the host's sr25519 device public key (32 bytes)
- *   - `encryptionPublicKey`    = the host's P-256 device public key (65 bytes uncompressed)
+ *   - `encryptionPublicKey`    = the host's X25519 device public key (32 bytes)
  *
  * Both sides compute the same topic/channel deterministically from the same
  * pubkeys carried in the QR-coded `VersionedHandshakeProposal::V2`, so they

package/dist/sso/auth/v2/topic.js

@@ -6,7 +6,7 @@
  *
  * Where:
  *   - `statementAccountId`     = the host's sr25519 device public key (32 bytes)
- *   - `encryptionPublicKey`    = the host's P-256 device public key (65 bytes uncompressed)
+ *   - `encryptionPublicKey`    = the host's X25519 device public key (32 bytes)
  *
  * Both sides compute the same topic/channel deterministically from the same
  * pubkeys carried in the QR-coded `VersionedHandshakeProposal::V2`, so they

package/dist/sso/deviceIdentityStore.js

@@ -1,9 +1,10 @@
 import { gcm } from '@noble/ciphers/aes.js';
 import { blake2b } from '@noble/hashes/blake2.js';
+import { Bytes } from '@novasamatech/scale';
 import { createSr25519Secret, deriveSr25519PublicKey } from '@novasamatech/statement-store';
 import { errAsync, fromPromise, okAsync } from 'neverthrow';
 import { fromHex, toHex } from 'polkadot-api/utils';
-import { Bytes, Option, Struct, str } from 'scale-ts';
+import { Option, Struct, str } from 'scale-ts';
 import { getEncrPub, stringToBytes } from '../crypto.js';
 import { toError } from '../helpers/utils.js';
 const KEY = 'DeviceIdentity';

package/dist/sso/sessionManager/scale/createTransaction.d.ts

@@ -4,8 +4,14 @@ export declare const CreateTransactionRequestCodec: import("scale-ts").Codec<{
     payload: {
         tag: "v1";
         value: {
-            signer: [string, number];
-            genesisHash: Uint8Array<ArrayBufferLike>;
+            signer: [string, {
+                tag: "Index";
+                value: number;
+            } | {
+                tag: "Raw";
+                value: Uint8Array<ArrayBufferLike>;
+            }];
+            genesisHash: `0x${string}`;
             callData: Uint8Array<ArrayBufferLike>;
             extensions: {
                 id: string;
@@ -22,7 +28,7 @@ export declare const CreateTransactionLegacyRequestCodec: import("scale-ts").Cod
         tag: "v1";
         value: {
             signer: Uint8Array<ArrayBufferLike>;
-            genesisHash: Uint8Array<ArrayBufferLike>;
+            genesisHash: `0x${string}`;
             callData: Uint8Array<ArrayBufferLike>;
             extensions: {
                 id: string;

package/dist/sso/sessionManager/scale/createTransaction.js

@@ -1,6 +1,6 @@
 import { LegacyTransaction, ProductAccountTransaction } from '@novasamatech/host-api';
-import { Enum } from '@novasamatech/scale';
-import { Bytes, Result, Struct, str } from 'scale-ts';
+import { Bytes, Enum } from '@novasamatech/scale';
+import { Result, Struct, str } from 'scale-ts';
 export const CreateTransactionRequestCodec = Struct({
     payload: Enum({
         v1: ProductAccountTransaction,

package/dist/sso/sessionManager/scale/productSubtree.js

@@ -1,5 +1,6 @@
 import { DotNsIdentifier } from '@novasamatech/host-api';
-import { Bytes, Result, Struct, str } from 'scale-ts';
+import { Bytes } from '@novasamatech/scale';
+import { Result, Struct, str } from 'scale-ts';
 // RFC-0022 made `//product//{productId}` a hard junction, so the root public
 // key alone no longer determines product account public keys. This request
 // closes the gap: the Account Holder returns the product-subtree public key,

package/dist/sso/sessionManager/scale/remoteMessage.d.ts

@@ -10,9 +10,33 @@ export declare const RemoteMessageCodec: import("scale-ts").Codec<{
         } | {
             tag: "SignRequest";
             value: {
+                tag: "Raw";
+                value: {
+                    productAccountId: [string, {
+                        tag: "Index";
+                        value: number;
+                    } | {
+                        tag: "Raw";
+                        value: Uint8Array<ArrayBufferLike>;
+                    }];
+                    data: {
+                        tag: "Bytes";
+                        value: Uint8Array<ArrayBufferLike>;
+                    } | {
+                        tag: "Payload";
+                        value: string;
+                    };
+                };
+            } | {
                 tag: "Payload";
                 value: {
-                    productAccountId: [string, number];
+                    productAccountId: [string, {
+                        tag: "Index";
+                        value: number;
+                    } | {
+                        tag: "Raw";
+                        value: Uint8Array<ArrayBufferLike>;
+                    }];
                     blockHash: `0x${string}`;
                     blockNumber: `0x${string}`;
                     era: `0x${string}`;
@@ -29,18 +53,6 @@ export declare const RemoteMessageCodec: import("scale-ts").Codec<{
                     mode: number | undefined;
                     withSignedTransaction: boolean | void;
                 };
-            } | {
-                tag: "Raw";
-                value: {
-                    productAccountId: [string, number];
-                    data: {
-                        tag: "Bytes";
-                        value: Uint8Array<ArrayBufferLike>;
-                    } | {
-                        tag: "Payload";
-                        value: string;
-                    };
-                };
             };
         } | {
             tag: "SignResponse";
@@ -55,7 +67,13 @@ export declare const RemoteMessageCodec: import("scale-ts").Codec<{
             tag: "RingVrfAliasRequest";
             value: {
                 callingProductId: string;
-                context: [string, `0x${string}`];
+                context: [string, {
+                    tag: "Index";
+                    value: number;
+                } | {
+                    tag: "Raw";
+                    value: Uint8Array<ArrayBufferLike>;
+                }];
                 ring: {
                     chainId: `0x${string}`;
                     junctions: ({
@@ -87,7 +105,13 @@ export declare const RemoteMessageCodec: import("scale-ts").Codec<{
                     value: undefined;
                 } | {
                     tag: "SmartContractAllowance";
-                    value: number;
+                    value: {
+                        tag: "Index";
+                        value: number;
+                    } | {
+                        tag: "Raw";
+                        value: Uint8Array<ArrayBufferLike>;
+                    };
                 } | {
                     tag: "AutoSigning";
                     value: undefined;
@@ -117,7 +141,6 @@ export declare const RemoteMessageCodec: import("scale-ts").Codec<{
                     } | {
                         tag: "AutoSigning";
                         value: {
-                            productDerivationSecret: string;
                             productRootPrivateKey: Uint8Array<ArrayBufferLike>;
                         };
                     } | {
@@ -137,8 +160,14 @@ export declare const RemoteMessageCodec: import("scale-ts").Codec<{
                 payload: {
                     tag: "v1";
                     value: {
-                        signer: [string, number];
-                        genesisHash: Uint8Array<ArrayBufferLike>;
+                        signer: [string, {
+                            tag: "Index";
+                            value: number;
+                        } | {
+                            tag: "Raw";
+                            value: Uint8Array<ArrayBufferLike>;
+                        }];
+                        genesisHash: `0x${string}`;
                         callData: Uint8Array<ArrayBufferLike>;
                         extensions: {
                             id: string;
@@ -162,7 +191,7 @@ export declare const RemoteMessageCodec: import("scale-ts").Codec<{
                     tag: "v1";
                     value: {
                         signer: Uint8Array<ArrayBufferLike>;
-                        genesisHash: Uint8Array<ArrayBufferLike>;
+                        genesisHash: `0x${string}`;
                         callData: Uint8Array<ArrayBufferLike>;
                         extensions: {
                             id: string;
@@ -195,7 +224,13 @@ export declare const RemoteMessageCodec: import("scale-ts").Codec<{
             tag: "RingVrfProofRequest";
             value: {
                 callingProductId: string;
-                context: [string, `0x${string}`];
+                context: [string, {
+                    tag: "Index";
+                    value: number;
+                } | {
+                    tag: "Raw";
+                    value: Uint8Array<ArrayBufferLike>;
+                }];
                 ring: {
                     chainId: `0x${string}`;
                     junctions: ({
@@ -227,7 +262,13 @@ export declare const RemoteMessageCodec: import("scale-ts").Codec<{
         } | {
             tag: "SignVrfRequest";
             value: {
-                productAccountId: [string, number];
+                productAccountId: [string, {
+                    tag: "Index";
+                    value: number;
+                } | {
+                    tag: "Raw";
+                    value: Uint8Array<ArrayBufferLike>;
+                }];
                 productId: string;
                 transcriptLabel: Uint8Array<ArrayBufferLike>;
                 items: {
@@ -246,6 +287,19 @@ export declare const RemoteMessageCodec: import("scale-ts").Codec<{
                     reason: string;
                 }, "SignVrfErr::Unknown">>;
             };
+        } | {
+            tag: "ProductSubtreeRequest";
+            value: {
+                productId: string;
+            };
+        } | {
+            tag: "ProductSubtreeResponse";
+            value: {
+                respondingTo: string;
+                payload: import("scale-ts").ResultPayload<{
+                    productPublicKey: Uint8Array<ArrayBufferLike>;
+                }, string>;
+            };
         };
     };
 }>;

package/dist/sso/sessionManager/scale/remoteMessage.js

@@ -1,6 +1,7 @@
 import { Enum } from '@novasamatech/scale';
 import { Struct, _void, str } from 'scale-ts';
 import { CreateTransactionLegacyRequestCodec, CreateTransactionRequestCodec, CreateTransactionResponseCodec, } from './createTransaction.js';
+import { ProductSubtreeRequestCodec, ProductSubtreeResponseCodec } from './productSubtree.js';
 import { ResourceAllocationRequestCodec, ResourceAllocationResponseCodec } from './resourceAllocation.js';
 import { RingVrfAliasRequestCodec, RingVrfAliasResponseCodec, RingVrfProofRequestCodec, RingVrfProofResponseCodec, } from './ringVrf.js';
 import { SignVrfRequestCodec, SignVrfResponseCodec } from './signVrf.js';
@@ -27,6 +28,9 @@ export const RemoteMessageCodec = Struct({
             RingVrfProofResponse: RingVrfProofResponseCodec,
             SignVrfRequest: SignVrfRequestCodec,
             SignVrfResponse: SignVrfResponseCodec,
+            // RFC-0022 additions — appended so existing variant indexes stay stable.
+            ProductSubtreeRequest: ProductSubtreeRequestCodec,
+            ProductSubtreeResponse: ProductSubtreeResponseCodec,
         }),
     }),
 });

package/dist/sso/sessionManager/scale/resourceAllocation.d.ts

@@ -5,7 +5,13 @@ export declare const ApAllocatableResourceCodec: import("scale-ts").Codec<{
     value: undefined;
 } | {
     tag: "SmartContractAllowance";
-    value: number;
+    value: {
+        tag: "Index";
+        value: number;
+    } | {
+        tag: "Raw";
+        value: Uint8Array<ArrayBufferLike>;
+    };
 } | {
     tag: "AutoSigning";
     value: undefined;
@@ -25,7 +31,6 @@ export declare const ApAllocatedResourceCodec: import("scale-ts").Codec<{
 } | {
     tag: "AutoSigning";
     value: {
-        productDerivationSecret: string;
         productRootPrivateKey: Uint8Array<ArrayBufferLike>;
     };
 } | {
@@ -51,7 +56,6 @@ export declare const ApAllocationOutcomeCodec: import("scale-ts").Codec<{
     } | {
         tag: "AutoSigning";
         value: {
-            productDerivationSecret: string;
             productRootPrivateKey: Uint8Array<ArrayBufferLike>;
         };
     } | {
@@ -73,7 +77,13 @@ export declare const ResourceAllocationRequestCodec: import("scale-ts").Codec<{
         value: undefined;
     } | {
         tag: "SmartContractAllowance";
-        value: number;
+        value: {
+            tag: "Index";
+            value: number;
+        } | {
+            tag: "Raw";
+            value: Uint8Array<ArrayBufferLike>;
+        };
     } | {
         tag: "AutoSigning";
         value: undefined;
@@ -102,7 +112,6 @@ export declare const ResourceAllocationResponseCodec: import("scale-ts").Codec<{
         } | {
             tag: "AutoSigning";
             value: {
-                productDerivationSecret: string;
                 productRootPrivateKey: Uint8Array<ArrayBufferLike>;
             };
         } | {

package/dist/sso/sessionManager/scale/resourceAllocation.js

@@ -1,9 +1,10 @@
 import { DerivationIndex, DotNsIdentifier } from '@novasamatech/host-api';
-import { Status } from '@novasamatech/scale';
-import { Bytes, Enum, Result, Struct, Vector, _void, str } from 'scale-ts';
+import { Bytes, Status } from '@novasamatech/scale';
+import { Enum, Result, Struct, Vector, _void, str } from 'scale-ts';
 export const ApAllocatableResourceCodec = Enum({
     StatementStoreAllowance: _void,
     BulletInAllowance: _void,
+    // Account the allowance is granted for, addressed by the RFC-0022 selector.
     SmartContractAllowance: DerivationIndex,
     AutoSigning: _void,
 });
@@ -15,8 +16,12 @@ export const ApAllocatedResourceCodec = Enum({
         slotAccountKey: Bytes(),
     }),
     SmartContractAllowance: _void,
+    // RFC-0022: the payload collapsed to the product-subtree secret key alone.
+    // `//product//{productId}` is a hard junction, so this key exposes exactly
+    // that product's subtree — the secret path component is gone.
     AutoSigning: Struct({
-        productDerivationSecret: str,
+        // `Sr25519PrivateKey ++ Sr25519Nonce` (64 bytes): the full expanded secret
+        // needed to sign and soft-derive `/{index}` below the product root.
         productRootPrivateKey: Bytes(),
     }),
 });

package/dist/sso/sessionManager/scale/ringVrf.d.ts

@@ -2,7 +2,13 @@ import type { CodecType } from 'scale-ts';
 export type RingVrfAliasRequest = CodecType<typeof RingVrfAliasRequestCodec>;
 export declare const RingVrfAliasRequestCodec: import("scale-ts").Codec<{
     callingProductId: string;
-    context: [string, `0x${string}`];
+    context: [string, {
+        tag: "Index";
+        value: number;
+    } | {
+        tag: "Raw";
+        value: Uint8Array<ArrayBufferLike>;
+    }];
     ring: {
         chainId: `0x${string}`;
         junctions: ({
@@ -27,7 +33,13 @@ export declare const RingVrfAliasResponseCodec: import("scale-ts").Codec<{
 export type RingVrfProofRequest = CodecType<typeof RingVrfProofRequestCodec>;
 export declare const RingVrfProofRequestCodec: import("scale-ts").Codec<{
     callingProductId: string;
-    context: [string, `0x${string}`];
+    context: [string, {
+        tag: "Index";
+        value: number;
+    } | {
+        tag: "Raw";
+        value: Uint8Array<ArrayBufferLike>;
+    }];
     ring: {
         chainId: `0x${string}`;
         junctions: ({

package/dist/sso/sessionManager/scale/ringVrf.js

@@ -1,5 +1,6 @@
 import { ContextualAlias, CreateProofErr, DotNsIdentifier, GetAliasErr, ProductProofContext, RingLocation, RingVrfProof, } from '@novasamatech/host-api';
-import { Bytes, Result, Struct, str } from 'scale-ts';
+import { Bytes } from '@novasamatech/scale';
+import { Result, Struct, str } from 'scale-ts';
 export const RingVrfAliasRequestCodec = Struct({
     callingProductId: DotNsIdentifier,
     context: ProductProofContext,

package/dist/sso/sessionManager/scale/signVrf.d.ts

@@ -13,7 +13,13 @@ import type { CodecType } from 'scale-ts';
  */
 export type SignVrfRequest = CodecType<typeof SignVrfRequestCodec>;
 export declare const SignVrfRequestCodec: import("scale-ts").Codec<{
-    productAccountId: [string, number];
+    productAccountId: [string, {
+        tag: "Index";
+        value: number;
+    } | {
+        tag: "Raw";
+        value: Uint8Array<ArrayBufferLike>;
+    }];
     productId: string;
     transcriptLabel: Uint8Array<ArrayBufferLike>;
     items: {

package/dist/sso/sessionManager/scale/signVrf.js

@@ -1,6 +1,6 @@
 import { ProductAccountId, VrfSignature, VrfTranscriptItem } from '@novasamatech/host-api';
-import { ErrEnum } from '@novasamatech/scale';
-import { Bytes, Result, Struct, Vector, _void, str } from 'scale-ts';
+import { Bytes, ErrEnum } from '@novasamatech/scale';
+import { Result, Struct, Vector, _void, str } from 'scale-ts';
 export const SignVrfRequestCodec = Struct({
     productAccountId: ProductAccountId,
     productId: str,

package/dist/sso/sessionManager/scale/signing.d.ts

@@ -1,7 +1,13 @@
 import type { CodecType } from 'scale-ts';
 export type SigningPayloadRequest = CodecType<typeof SigningPayloadRequestCodec>;
 export declare const SigningPayloadRequestCodec: import("scale-ts").Codec<{
-    productAccountId: [string, number];
+    productAccountId: [string, {
+        tag: "Index";
+        value: number;
+    } | {
+        tag: "Raw";
+        value: Uint8Array<ArrayBufferLike>;
+    }];
     blockHash: `0x${string}`;
     blockNumber: `0x${string}`;
     era: `0x${string}`;
@@ -20,7 +26,13 @@ export declare const SigningPayloadRequestCodec: import("scale-ts").Codec<{
 }>;
 export type SigningRawRequest = CodecType<typeof SigningRawRequestCodec>;
 export declare const SigningRawRequestCodec: import("scale-ts").Codec<{
-    productAccountId: [string, number];
+    productAccountId: [string, {
+        tag: "Index";
+        value: number;
+    } | {
+        tag: "Raw";
+        value: Uint8Array<ArrayBufferLike>;
+    }];
     data: {
         tag: "Bytes";
         value: Uint8Array<ArrayBufferLike>;
@@ -47,9 +59,33 @@ export declare const SignRawLegacyResponseCodec: import("scale-ts").Codec<{
 }>;
 export type SigningRequest = CodecType<typeof SigningRequestCodec>;
 export declare const SigningRequestCodec: import("scale-ts").Codec<{
+    tag: "Raw";
+    value: {
+        productAccountId: [string, {
+            tag: "Index";
+            value: number;
+        } | {
+            tag: "Raw";
+            value: Uint8Array<ArrayBufferLike>;
+        }];
+        data: {
+            tag: "Bytes";
+            value: Uint8Array<ArrayBufferLike>;
+        } | {
+            tag: "Payload";
+            value: string;
+        };
+    };
+} | {
     tag: "Payload";
     value: {
-        productAccountId: [string, number];
+        productAccountId: [string, {
+            tag: "Index";
+            value: number;
+        } | {
+            tag: "Raw";
+            value: Uint8Array<ArrayBufferLike>;
+        }];
         blockHash: `0x${string}`;
         blockNumber: `0x${string}`;
         era: `0x${string}`;
@@ -66,18 +102,6 @@ export declare const SigningRequestCodec: import("scale-ts").Codec<{
         mode: number | undefined;
         withSignedTransaction: boolean | void;
     };
-} | {
-    tag: "Raw";
-    value: {
-        productAccountId: [string, number];
-        data: {
-            tag: "Bytes";
-            value: Uint8Array<ArrayBufferLike>;
-        } | {
-            tag: "Payload";
-            value: string;
-        };
-    };
 }>;
 export type SigningPayloadResponseData = CodecType<typeof SigningPayloadResponseDataCodec>;
 export declare const SigningPayloadResponseDataCodec: import("scale-ts").Codec<{

package/dist/sso/sessionManager/scale/signing.js

@@ -1,6 +1,6 @@
 import { AccountId, ProductAccountId } from '@novasamatech/host-api';
-import { Enum, Hex, OptionBool } from '@novasamatech/scale';
-import { Bytes, Option, Result, Struct, Vector, str, u32 } from 'scale-ts';
+import { Bytes, Enum, Hex, OptionBool } from '@novasamatech/scale';
+import { Option, Result, Struct, Vector, str, u32 } from 'scale-ts';
 export const SigningPayloadRequestCodec = Struct({
     productAccountId: ProductAccountId,
     blockHash: Hex(),

package/dist/sso/sessionManager/userSession.d.ts

@@ -26,6 +26,13 @@ export type UserSession = StoredUserSession & {
     createTransactionLegacy(payload: CreateTransactionLegacyRequest): ResultAsync<Uint8Array, Error>;
     getRingVrfAlias(callingProductId: string, context: CodecType<typeof ProductProofContext>, ring: CodecType<typeof RingLocation>): ResultAsync<CodecType<typeof ContextualAlias>, Error>;
     createRingVrfProof(callingProductId: string, context: CodecType<typeof ProductProofContext>, ring: CodecType<typeof RingLocation>, message: Uint8Array): ResultAsync<CodecType<typeof RingVrfProof>, Error>;
+    /**
+     * Fetches the sr25519 public key of `//product//{productId}` (RFC-0022).
+     *
+     * Consent-free and cacheable: one round trip per product, ever. Account
+     * public keys are then soft-derived locally from the returned subtree key.
+     */
+    getProductSubtree(productId: string): ResultAsync<Uint8Array, Error>;
     signVrf(payload: SignVrfRequest): ResultAsync<CodecType<typeof VrfSignature>, Error>;
     requestResourceAllocation(request: ResourceAllocationRequest): ResultAsync<ApAllocationOutcome[], Error>;
     subscribe(callback: Callback<CodecType<typeof RemoteMessageCodec>, ResultAsync<boolean, Error>>): VoidFunction;

package/dist/sso/sessionManager/userSession.js

@@ -287,6 +287,24 @@ export function createUserSession({ userSession, statementStore, encryption, sto
                 return withHostActionTrace(awaitReplyOrAckFailure(request, reply).andThen(result => result.success ? ok(result.value) : err(result.value)), messageId, userSession.id);
             });
         },
+        getProductSubtree(productId) {
+            return enqueue(() => {
+                const messageId = nanoid();
+                const data = enumValue('v1', enumValue('ProductSubtreeRequest', { productId }));
+                emitHostAction(messageId, actionKindFromMessageData(data), userSession.id);
+                const responseFilter = (message) => {
+                    if (message.data.tag === 'v1' &&
+                        message.data.value.tag === 'ProductSubtreeResponse' &&
+                        message.data.value.value.respondingTo === messageId) {
+                        return message.data.value.value.payload;
+                    }
+                };
+                const request = session.request(RemoteMessageCodec, { messageId, data });
+                const reply = session.waitForRequestMessage(RemoteMessageCodec, responseFilter);
+                const inner = awaitReplyOrAckFailure(request, reply).andThen(result => result.success ? ok(result.value.productPublicKey) : err(new Error(result.value)));
+                return withHostActionTrace(withQueueTimeout(inner, 'getProductSubtree'), messageId, userSession.id);
+            });
+        },
         signVrf(payload) {
             return enqueue(() => {
                 const messageId = nanoid();

package/dist/sso/userSecretRepository.js

@@ -1,8 +1,9 @@
 import { gcm } from '@noble/ciphers/aes.js';
 import { blake2b } from '@noble/hashes/blake2.js';
+import { Bytes } from '@novasamatech/scale';
 import { fromThrowable } from 'neverthrow';
 import { fromHex, toHex } from 'polkadot-api/utils';
-import { Bytes, Struct } from 'scale-ts';
+import { Struct } from 'scale-ts';
 import { BrandedBytesCodec, stringToBytes } from '../crypto.js';
 import { toError } from '../helpers/utils.js';
 const StoredUserSecretsCodec = Struct({

package/dist/sso/userSessionRepository.js

@@ -1,30 +1,31 @@
+import { Bytes } from '@novasamatech/scale';
 import { AccountIdCodec, LocalSessionAccountCodec, RemoteSessionAccountCodec } from '@novasamatech/statement-store';
 import { fieldListView } from '@novasamatech/storage-adapter';
 import { nanoid } from 'nanoid';
 import { fromHex, toHex } from 'polkadot-api/utils';
-import { Bytes, Struct, Vector, str } from 'scale-ts';
+import { Struct, Vector, str } from 'scale-ts';
 const storedUserSessionCodec = Struct({
     id: str,
     localAccount: LocalSessionAccountCodec,
     remoteAccount: RemoteSessionAccountCodec,
     rootAccountId: AccountIdCodec,
     identityAccountId: AccountIdCodec,
-    identityChatPublicKey: Bytes(65),
-    // `papp_encr_pub` (65-byte uncompressed P-256). Persisted so the host can
+    identityChatPublicKey: Bytes(32),
+    // `papp_encr_pub` (32-byte X25519). Persisted so the host can
     // rebuild its SSO session transport (`shared_secret_session =
     // ECDH(host_encr_secret, ssoEncPubKey)`) on a cold start without re-running
     // the handshake.
-    ssoEncPubKey: Bytes(65),
+    ssoEncPubKey: Bytes(32),
     // RFC-0007 layer-1 `rootEntropySource` from the handshake; consumed by the
     // host's `host_derive_entropy` handler via `deriveProductEntropyFromSource`.
     rootEntropySource: Bytes(32),
-    // Encryption public key of the authorising PApp device (65-byte uncompressed
-    // P-256), lifted from `HandshakeResponseV2.deviceEncPubKey`. Distinct from
+    // Encryption public key of the authorising PApp device (32-byte X25519),
+    // lifted from `HandshakeResponseV2.deviceEncPubKey`. Distinct from
     // `ssoEncPubKey` (the SSO session keypair) and from `remoteAccount.publicKey`
     // (the derived SSO shared secret): this is the peer device's long-lived ECDH
     // key, used by the host's device-sync channel to address the paired device.
     // Always present — `HandshakeResponseV2` carries it for every V2 pairing.
-    deviceEncPubKey: Bytes(65),
+    deviceEncPubKey: Bytes(32),
 });
 export function createStoredUserSession(localAccount, remoteAccount, rootAccountId, extras) {
     return {
@@ -43,7 +44,11 @@ export const createUserSessionRepository = (storage) => {
     const codec = Vector(storedUserSessionCodec);
     return fieldListView({
         storage,
-        key: 'SsoSessionsV3',
+        // V4: the encryption keys shrank from 65-byte P-256 to 32-byte X25519
+        // (CHAT-RFC-0004). Fixed-size `Bytes` does not length-check on decode, so a
+        // V3 blob would decode misaligned into a session that looks valid but
+        // carries garbage keys — bump the key so old blobs are dropped instead.
+        key: 'SsoSessionsV4',
         from: x => codec.dec(fromHex(x)),
         to: x => toHex(codec.enc(x)),
     });

package/dist/sso/userSessionRepository.spec.js

@@ -5,14 +5,14 @@ import { describe, expect, it } from 'vitest';
 import { createStoredUserSession, createUserSessionRepository } from './userSessionRepository.js';
 const bytes = (len, fill) => new Uint8Array(len).fill(fill);
 // remoteAccount.publicKey is a fixed 32-byte field (the SSO shared secret),
-// which is exactly why the peer device's 65-byte encryption key needs its own
+// which is exactly why the peer device's 32-byte encryption key needs its own
 // `deviceEncPubKey` field rather than being squeezed in here.
 const SHARED_SECRET = bytes(32, 0x07);
-const DEVICE_ENC_PUB = bytes(65, 0x04);
+const DEVICE_ENC_PUB = bytes(32, 0x04);
 const baseExtras = {
     identityAccountId: createAccountId(bytes(32, 0x11)),
-    identityChatPublicKey: bytes(65, 0x22),
-    ssoEncPubKey: bytes(65, 0x33),
+    identityChatPublicKey: bytes(32, 0x22),
+    ssoEncPubKey: bytes(32, 0x33),
     rootEntropySource: bytes(32, 0x44),
 };
 const makeSession = (deviceEncPubKey = DEVICE_ENC_PUB) => createStoredUserSession(createLocalSessionAccount(createAccountId(bytes(32, 0x01))), createRemoteSessionAccount(createAccountId(bytes(32, 0x02)), SHARED_SECRET), createAccountId(bytes(32, 0x55)), { ...baseExtras, deviceEncPubKey });

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@novasamatech/host-papp",
   "type": "module",
-  "version": "0.8.12",
+  "version": "0.9.1",
   "description": "Polkadot app integration",
   "license": "Apache-2.0",
   "repository": {
@@ -34,10 +34,10 @@
     "@noble/ciphers": "2.2.0",
     "@noble/curves": "2.2.0",
     "@noble/hashes": "2.2.0",
-    "@novasamatech/host-api": "0.8.12",
-    "@novasamatech/scale": "0.8.12",
-    "@novasamatech/statement-store": "0.8.12",
-    "@novasamatech/storage-adapter": "0.8.12",
+    "@novasamatech/host-api": "0.9.1",
+    "@novasamatech/scale": "0.9.1",
+    "@novasamatech/statement-store": "0.9.1",
+    "@novasamatech/storage-adapter": "0.9.1",
     "@polkadot-api/utils": "^0.4.0",
     "@polkadot-labs/hdkd-helpers": "^0.0.31",
     "nanoevents": "10.0.0",