@novasamatech/host-papp 0.9.1 → 0.9.3

package/dist/sso/sessionManager/scale/remoteMessage.d.ts

@@ -67,6 +67,13 @@ export declare const RemoteMessageCodec: import("scale-ts").Codec<{
             tag: "RingVrfAliasRequest";
             value: {
                 callingProductId: string;
+                keyHandle: [string, {
+                    tag: "Index";
+                    value: number;
+                } | {
+                    tag: "Raw";
+                    value: Uint8Array<ArrayBufferLike>;
+                }];
                 context: [string, {
                     tag: "Index";
                     value: number;
@@ -94,7 +101,7 @@ export declare const RemoteMessageCodec: import("scale-ts").Codec<{
                     alias: Uint8Array<ArrayBufferLike>;
                 }, import("@novasamatech/scale").CodecError<undefined, "GetAliasErr::Rejected"> | import("@novasamatech/scale").CodecError<{
                     reason: string;
-                }, "GetAliasErr::Unknown"> | import("@novasamatech/scale").CodecError<undefined, "GetAliasErr::RingNotFound"> | import("@novasamatech/scale").CodecError<undefined, "GetAliasErr::NotMember">>;
+                }, "GetAliasErr::Unknown"> | import("@novasamatech/scale").CodecError<undefined, "GetAliasErr::RingNotFound"> | import("@novasamatech/scale").CodecError<undefined, "GetAliasErr::NotMember"> | import("@novasamatech/scale").CodecError<undefined, "GetAliasErr::KeyNotRegistered"> | import("@novasamatech/scale").CodecError<undefined, "GetAliasErr::KeyNotInRing">>;
             };
         } | {
             tag: "ResourceAllocationRequest";
@@ -142,6 +149,7 @@ export declare const RemoteMessageCodec: import("scale-ts").Codec<{
                         tag: "AutoSigning";
                         value: {
                             productRootPrivateKey: Uint8Array<ArrayBufferLike>;
+                            ringVrfDomainEntropy: Uint8Array<ArrayBufferLike>;
                         };
                     } | {
                         tag: "BulletInAllowance";
@@ -224,6 +232,13 @@ export declare const RemoteMessageCodec: import("scale-ts").Codec<{
             tag: "RingVrfProofRequest";
             value: {
                 callingProductId: string;
+                keyHandle: [string, {
+                    tag: "Index";
+                    value: number;
+                } | {
+                    tag: "Raw";
+                    value: Uint8Array<ArrayBufferLike>;
+                }];
                 context: [string, {
                     tag: "Index";
                     value: number;
@@ -257,7 +272,7 @@ export declare const RemoteMessageCodec: import("scale-ts").Codec<{
                     ringRevision: number;
                 }, import("@novasamatech/scale").CodecError<undefined, "CreateProofErr::Rejected"> | import("@novasamatech/scale").CodecError<{
                     reason: string;
-                }, "CreateProofErr::Unknown"> | import("@novasamatech/scale").CodecError<undefined, "CreateProofErr::RingNotFound"> | import("@novasamatech/scale").CodecError<undefined, "CreateProofErr::NotMember">>;
+                }, "CreateProofErr::Unknown"> | import("@novasamatech/scale").CodecError<undefined, "CreateProofErr::RingNotFound"> | import("@novasamatech/scale").CodecError<undefined, "CreateProofErr::NotMember"> | import("@novasamatech/scale").CodecError<undefined, "CreateProofErr::KeyNotRegistered"> | import("@novasamatech/scale").CodecError<undefined, "CreateProofErr::KeyNotInRing"> | import("@novasamatech/scale").CodecError<undefined, "CreateProofErr::NotAllowlisted">>;
             };
         } | {
             tag: "SignVrfRequest";
@@ -300,6 +315,91 @@ export declare const RemoteMessageCodec: import("scale-ts").Codec<{
                     productPublicKey: Uint8Array<ArrayBufferLike>;
                 }, string>;
             };
+        } | {
+            tag: "RegisterRingVrfKeyRequest";
+            value: {
+                callingProductId: string;
+                index: {
+                    tag: "Index";
+                    value: number;
+                } | {
+                    tag: "Raw";
+                    value: Uint8Array<ArrayBufferLike>;
+                };
+                ring: {
+                    chainId: `0x${string}`;
+                    junctions: ({
+                        tag: "PalletInstance";
+                        value: number;
+                    } | {
+                        tag: "CollectionId";
+                        value: Uint8Array<ArrayBufferLike>;
+                    })[];
+                };
+            };
+        } | {
+            tag: "RegisterRingVrfKeyResponse";
+            value: {
+                respondingTo: string;
+                payload: import("scale-ts").ResultPayload<Uint8Array<ArrayBufferLike>, import("@novasamatech/scale").CodecError<undefined, "RegisterRingVrfKeyErr::NotConnected"> | import("@novasamatech/scale").CodecError<undefined, "RegisterRingVrfKeyErr::Rejected"> | import("@novasamatech/scale").CodecError<{
+                    reason: string;
+                }, "RegisterRingVrfKeyErr::Unknown"> | import("@novasamatech/scale").CodecError<undefined, "RegisterRingVrfKeyErr::RingNotFound">>;
+            };
+        } | {
+            tag: "ListRingVrfKeysRequest";
+            value: {
+                callingProductId: string;
+                owner: string;
+                disclosure: "Anonymized" | "PublicKey";
+            };
+        } | {
+            tag: "ListRingVrfKeysResponse";
+            value: {
+                respondingTo: string;
+                payload: import("scale-ts").ResultPayload<{
+                    handle: [string, {
+                        tag: "Index";
+                        value: number;
+                    } | {
+                        tag: "Raw";
+                        value: Uint8Array<ArrayBufferLike>;
+                    }];
+                    rings: {
+                        chainId: `0x${string}`;
+                        junctions: ({
+                            tag: "PalletInstance";
+                            value: number;
+                        } | {
+                            tag: "CollectionId";
+                            value: Uint8Array<ArrayBufferLike>;
+                        })[];
+                    }[];
+                    publicKey: Uint8Array<ArrayBufferLike> | undefined;
+                }[], import("@novasamatech/scale").CodecError<undefined, "ListRingVrfKeysErr::NotConnected"> | import("@novasamatech/scale").CodecError<undefined, "ListRingVrfKeysErr::Rejected"> | import("@novasamatech/scale").CodecError<{
+                    reason: string;
+                }, "ListRingVrfKeysErr::Unknown">>;
+            };
+        } | {
+            tag: "RingVrfSignRequest";
+            value: {
+                callingProductId: string;
+                keyHandle: [string, {
+                    tag: "Index";
+                    value: number;
+                } | {
+                    tag: "Raw";
+                    value: Uint8Array<ArrayBufferLike>;
+                }];
+                message: Uint8Array<ArrayBufferLike>;
+            };
+        } | {
+            tag: "RingVrfSignResponse";
+            value: {
+                respondingTo: string;
+                payload: import("scale-ts").ResultPayload<Uint8Array<ArrayBufferLike>, import("@novasamatech/scale").CodecError<undefined, "RingVrfSignErr::NotConnected"> | import("@novasamatech/scale").CodecError<undefined, "RingVrfSignErr::Rejected"> | import("@novasamatech/scale").CodecError<{
+                    reason: string;
+                }, "RingVrfSignErr::Unknown"> | import("@novasamatech/scale").CodecError<undefined, "RingVrfSignErr::KeyNotRegistered"> | import("@novasamatech/scale").CodecError<undefined, "RingVrfSignErr::NotAllowlisted">>;
+            };
         };
     };
 }>;

package/dist/sso/sessionManager/scale/remoteMessage.js

@@ -3,7 +3,8 @@ import { Struct, _void, str } from 'scale-ts';
 import { CreateTransactionLegacyRequestCodec, CreateTransactionRequestCodec, CreateTransactionResponseCodec, } from './createTransaction.js';
 import { ProductSubtreeRequestCodec, ProductSubtreeResponseCodec } from './productSubtree.js';
 import { ResourceAllocationRequestCodec, ResourceAllocationResponseCodec } from './resourceAllocation.js';
-import { RingVrfAliasRequestCodec, RingVrfAliasResponseCodec, RingVrfProofRequestCodec, RingVrfProofResponseCodec, } from './ringVrf.js';
+import { RingVrfAliasRequestCodec, RingVrfAliasResponseCodec, RingVrfProofRequestCodec, RingVrfProofResponseCodec, RingVrfSignRequestCodec, RingVrfSignResponseCodec, } from './ringVrf.js';
+import { ListRingVrfKeysRequestCodec, ListRingVrfKeysResponseCodec, RegisterRingVrfKeyRequestCodec, RegisterRingVrfKeyResponseCodec, } from './ringVrfKeys.js';
 import { SignVrfRequestCodec, SignVrfResponseCodec } from './signVrf.js';
 import { SignRawLegacyRequestCodec, SignRawLegacyResponseCodec, SigningRequestCodec, SigningResponseCodec, } from './signing.js';
 export const RemoteMessageCodec = Struct({
@@ -31,6 +32,15 @@ export const RemoteMessageCodec = Struct({
             // RFC-0022 additions — appended so existing variant indexes stay stable.
             ProductSubtreeRequest: ProductSubtreeRequestCodec,
             ProductSubtreeResponse: ProductSubtreeResponseCodec,
+            // RFC-0024 additions — likewise appended. `RingVrfAliasRequest` and
+            // `RingVrfProofRequest` above gained a `keyHandle` field in place rather
+            // than being re-added here, since a handle is now mandatory on both.
+            RegisterRingVrfKeyRequest: RegisterRingVrfKeyRequestCodec,
+            RegisterRingVrfKeyResponse: RegisterRingVrfKeyResponseCodec,
+            ListRingVrfKeysRequest: ListRingVrfKeysRequestCodec,
+            ListRingVrfKeysResponse: ListRingVrfKeysResponseCodec,
+            RingVrfSignRequest: RingVrfSignRequestCodec,
+            RingVrfSignResponse: RingVrfSignResponseCodec,
         }),
     }),
 });

package/dist/sso/sessionManager/scale/resourceAllocation.d.ts

@@ -32,6 +32,7 @@ export declare const ApAllocatedResourceCodec: import("scale-ts").Codec<{
     tag: "AutoSigning";
     value: {
         productRootPrivateKey: Uint8Array<ArrayBufferLike>;
+        ringVrfDomainEntropy: Uint8Array<ArrayBufferLike>;
     };
 } | {
     tag: "BulletInAllowance";
@@ -57,6 +58,7 @@ export declare const ApAllocationOutcomeCodec: import("scale-ts").Codec<{
         tag: "AutoSigning";
         value: {
             productRootPrivateKey: Uint8Array<ArrayBufferLike>;
+            ringVrfDomainEntropy: Uint8Array<ArrayBufferLike>;
         };
     } | {
         tag: "BulletInAllowance";
@@ -113,6 +115,7 @@ export declare const ResourceAllocationResponseCodec: import("scale-ts").Codec<{
             tag: "AutoSigning";
             value: {
                 productRootPrivateKey: Uint8Array<ArrayBufferLike>;
+                ringVrfDomainEntropy: Uint8Array<ArrayBufferLike>;
             };
         } | {
             tag: "BulletInAllowance";

package/dist/sso/sessionManager/scale/resourceAllocation.js

@@ -23,6 +23,17 @@ export const ApAllocatedResourceCodec = Enum({
         // `Sr25519PrivateKey ++ Sr25519Nonce` (64 bytes): the full expanded secret
         // needed to sign and soft-derive `/{index}` below the product root.
         productRootPrivateKey: Bytes(),
+        // RFC-0024: entropy of the `//{productId}` node of the ring VRF tree, which
+        // is disjoint from the sr25519 product-account tree above. It lets the Host
+        // derive the member secret of a *registered* key locally — the second
+        // motivation being that a headless Account Holder execution context may not
+        // fit a ring VRF proof inside its ~30 s / ~24 MB budget.
+        //
+        // Derivation from this entropy is unconditional arithmetic: nothing about
+        // holding it distinguishes a meaningful index from a meaningless one, so the
+        // registry supplies that distinction. A Host MUST NOT derive a member secret
+        // for a `(product, index)` pair absent from its registry.
+        ringVrfDomainEntropy: Bytes(),
     }),
 });
 export const ApAllocationOutcomeCodec = Enum({

package/dist/sso/sessionManager/scale/ringVrf.d.ts

@@ -2,6 +2,13 @@ import type { CodecType } from 'scale-ts';
 export type RingVrfAliasRequest = CodecType<typeof RingVrfAliasRequestCodec>;
 export declare const RingVrfAliasRequestCodec: import("scale-ts").Codec<{
     callingProductId: string;
+    keyHandle: [string, {
+        tag: "Index";
+        value: number;
+    } | {
+        tag: "Raw";
+        value: Uint8Array<ArrayBufferLike>;
+    }];
     context: [string, {
         tag: "Index";
         value: number;
@@ -28,11 +35,18 @@ export declare const RingVrfAliasResponseCodec: import("scale-ts").Codec<{
         alias: Uint8Array<ArrayBufferLike>;
     }, import("@novasamatech/scale").CodecError<undefined, "GetAliasErr::Rejected"> | import("@novasamatech/scale").CodecError<{
         reason: string;
-    }, "GetAliasErr::Unknown"> | import("@novasamatech/scale").CodecError<undefined, "GetAliasErr::RingNotFound"> | import("@novasamatech/scale").CodecError<undefined, "GetAliasErr::NotMember">>;
+    }, "GetAliasErr::Unknown"> | import("@novasamatech/scale").CodecError<undefined, "GetAliasErr::RingNotFound"> | import("@novasamatech/scale").CodecError<undefined, "GetAliasErr::NotMember"> | import("@novasamatech/scale").CodecError<undefined, "GetAliasErr::KeyNotRegistered"> | import("@novasamatech/scale").CodecError<undefined, "GetAliasErr::KeyNotInRing">>;
 }>;
 export type RingVrfProofRequest = CodecType<typeof RingVrfProofRequestCodec>;
 export declare const RingVrfProofRequestCodec: import("scale-ts").Codec<{
     callingProductId: string;
+    keyHandle: [string, {
+        tag: "Index";
+        value: number;
+    } | {
+        tag: "Raw";
+        value: Uint8Array<ArrayBufferLike>;
+    }];
     context: [string, {
         tag: "Index";
         value: number;
@@ -65,5 +79,32 @@ export declare const RingVrfProofResponseCodec: import("scale-ts").Codec<{
         ringRevision: number;
     }, import("@novasamatech/scale").CodecError<undefined, "CreateProofErr::Rejected"> | import("@novasamatech/scale").CodecError<{
         reason: string;
-    }, "CreateProofErr::Unknown"> | import("@novasamatech/scale").CodecError<undefined, "CreateProofErr::RingNotFound"> | import("@novasamatech/scale").CodecError<undefined, "CreateProofErr::NotMember">>;
+    }, "CreateProofErr::Unknown"> | import("@novasamatech/scale").CodecError<undefined, "CreateProofErr::RingNotFound"> | import("@novasamatech/scale").CodecError<undefined, "CreateProofErr::NotMember"> | import("@novasamatech/scale").CodecError<undefined, "CreateProofErr::KeyNotRegistered"> | import("@novasamatech/scale").CodecError<undefined, "CreateProofErr::KeyNotInRing"> | import("@novasamatech/scale").CodecError<undefined, "CreateProofErr::NotAllowlisted">>;
+}>;
+/**
+ * Host → Account Holder request for a plain signature by the ring VRF member key
+ * itself (RFC-0024 `ring_vrf_sign`), rather than an anonymous ring proof.
+ *
+ * Carries no context and no ring: the signature derives no alias and proves no
+ * membership, so there is nothing for either to scope. It is verified against
+ * the member public key and is therefore linkable to every other use of the key.
+ */
+export type RingVrfSignRequest = CodecType<typeof RingVrfSignRequestCodec>;
+export declare const RingVrfSignRequestCodec: import("scale-ts").Codec<{
+    callingProductId: string;
+    keyHandle: [string, {
+        tag: "Index";
+        value: number;
+    } | {
+        tag: "Raw";
+        value: Uint8Array<ArrayBufferLike>;
+    }];
+    message: Uint8Array<ArrayBufferLike>;
+}>;
+export type RingVrfSignResponse = CodecType<typeof RingVrfSignResponseCodec>;
+export declare const RingVrfSignResponseCodec: import("scale-ts").Codec<{
+    respondingTo: string;
+    payload: import("scale-ts").ResultPayload<Uint8Array<ArrayBufferLike>, import("@novasamatech/scale").CodecError<undefined, "RingVrfSignErr::NotConnected"> | import("@novasamatech/scale").CodecError<undefined, "RingVrfSignErr::Rejected"> | import("@novasamatech/scale").CodecError<{
+        reason: string;
+    }, "RingVrfSignErr::Unknown"> | import("@novasamatech/scale").CodecError<undefined, "RingVrfSignErr::KeyNotRegistered"> | import("@novasamatech/scale").CodecError<undefined, "RingVrfSignErr::NotAllowlisted">>;
 }>;

package/dist/sso/sessionManager/scale/ringVrf.js

@@ -1,8 +1,9 @@
-import { ContextualAlias, CreateProofErr, DotNsIdentifier, GetAliasErr, ProductProofContext, RingLocation, RingVrfProof, } from '@novasamatech/host-api';
+import { ContextualAlias, CreateProofErr, DotNsIdentifier, GetAliasErr, ProductProofContext, RingLocation, RingVrfKeyHandle, RingVrfProof, RingVrfSignErr, } from '@novasamatech/host-api';
 import { Bytes } from '@novasamatech/scale';
 import { Result, Struct, str } from 'scale-ts';
 export const RingVrfAliasRequestCodec = Struct({
     callingProductId: DotNsIdentifier,
+    keyHandle: RingVrfKeyHandle,
     context: ProductProofContext,
     ring: RingLocation,
 });
@@ -12,6 +13,7 @@ export const RingVrfAliasResponseCodec = Struct({
 });
 export const RingVrfProofRequestCodec = Struct({
     callingProductId: DotNsIdentifier,
+    keyHandle: RingVrfKeyHandle,
     context: ProductProofContext,
     ring: RingLocation,
     message: Bytes(),
@@ -20,3 +22,12 @@ export const RingVrfProofResponseCodec = Struct({
     respondingTo: str,
     payload: Result(RingVrfProof, CreateProofErr),
 });
+export const RingVrfSignRequestCodec = Struct({
+    callingProductId: DotNsIdentifier,
+    keyHandle: RingVrfKeyHandle,
+    message: Bytes(),
+});
+export const RingVrfSignResponseCodec = Struct({
+    respondingTo: str,
+    payload: Result(Bytes(), RingVrfSignErr),
+});

package/dist/sso/sessionManager/scale/ringVrfKeys.d.ts

@@ -0,0 +1,85 @@
+import type { CodecType } from 'scale-ts';
+/**
+ * Host → Account Holder registration of a key the calling product owns.
+ *
+ * Ownership is `callingProductId` and is never chosen by the caller, so this is
+ * consent-free. Registration is idempotent: re-registering an `index` for an
+ * additional `ring` extends the existing entry rather than creating a second
+ * one, so re-notifying the phone about an entry it already has costs nothing.
+ *
+ * A Host holding the product's ring VRF domain entropy (see `AutoSigning` in
+ * `resourceAllocation.ts`) answers immediately and mirrors this fire-and-forget;
+ * without the entropy it issues the request and waits.
+ *
+ * > A Host MUST NOT derive a member secret for a `(product, index)` pair absent
+ * > from its registry. Domain entropy makes derivation unconditional — only
+ * > registration, which always reaches the phone, brings a key into existence.
+ */
+export type RegisterRingVrfKeyRequest = CodecType<typeof RegisterRingVrfKeyRequestCodec>;
+export declare const RegisterRingVrfKeyRequestCodec: import("scale-ts").Codec<{
+    callingProductId: string;
+    index: {
+        tag: "Index";
+        value: number;
+    } | {
+        tag: "Raw";
+        value: Uint8Array<ArrayBufferLike>;
+    };
+    ring: {
+        chainId: `0x${string}`;
+        junctions: ({
+            tag: "PalletInstance";
+            value: number;
+        } | {
+            tag: "CollectionId";
+            value: Uint8Array<ArrayBufferLike>;
+        })[];
+    };
+}>;
+export type RegisterRingVrfKeyResponse = CodecType<typeof RegisterRingVrfKeyResponseCodec>;
+export declare const RegisterRingVrfKeyResponseCodec: import("scale-ts").Codec<{
+    respondingTo: string;
+    payload: import("scale-ts").ResultPayload<Uint8Array<ArrayBufferLike>, import("@novasamatech/scale").CodecError<undefined, "RegisterRingVrfKeyErr::NotConnected"> | import("@novasamatech/scale").CodecError<undefined, "RegisterRingVrfKeyErr::Rejected"> | import("@novasamatech/scale").CodecError<{
+        reason: string;
+    }, "RegisterRingVrfKeyErr::Unknown"> | import("@novasamatech/scale").CodecError<undefined, "RegisterRingVrfKeyErr::RingNotFound">>;
+}>;
+/**
+ * Host → Account Holder listing of the registry entries owned by `owner`.
+ *
+ * `owner` may be `callingProductId` — permissionless — or another product, in
+ * which case the caller needs a grant. `PublicKey` disclosure additionally
+ * returns the member public key, which is linkable across every ring it appears
+ * in and so is permissioned cross-product even though the handle is not.
+ */
+export type ListRingVrfKeysRequest = CodecType<typeof ListRingVrfKeysRequestCodec>;
+export declare const ListRingVrfKeysRequestCodec: import("scale-ts").Codec<{
+    callingProductId: string;
+    owner: string;
+    disclosure: "Anonymized" | "PublicKey";
+}>;
+export type ListRingVrfKeysResponse = CodecType<typeof ListRingVrfKeysResponseCodec>;
+export declare const ListRingVrfKeysResponseCodec: import("scale-ts").Codec<{
+    respondingTo: string;
+    payload: import("scale-ts").ResultPayload<{
+        handle: [string, {
+            tag: "Index";
+            value: number;
+        } | {
+            tag: "Raw";
+            value: Uint8Array<ArrayBufferLike>;
+        }];
+        rings: {
+            chainId: `0x${string}`;
+            junctions: ({
+                tag: "PalletInstance";
+                value: number;
+            } | {
+                tag: "CollectionId";
+                value: Uint8Array<ArrayBufferLike>;
+            })[];
+        }[];
+        publicKey: Uint8Array<ArrayBufferLike> | undefined;
+    }[], import("@novasamatech/scale").CodecError<undefined, "ListRingVrfKeysErr::NotConnected"> | import("@novasamatech/scale").CodecError<undefined, "ListRingVrfKeysErr::Rejected"> | import("@novasamatech/scale").CodecError<{
+        reason: string;
+    }, "ListRingVrfKeysErr::Unknown">>;
+}>;

package/dist/sso/sessionManager/scale/ringVrfKeys.js

@@ -0,0 +1,22 @@
+import { DerivationIndex, DotNsIdentifier, ListRingVrfKeysErr, RegisterRingVrfKeyErr, RegisteredRingVrfKey, RingLocation, RingVrfKeyDisclosure, RingVrfPublicKey, } from '@novasamatech/host-api';
+import { Result, Struct, Vector, str } from 'scale-ts';
+export const RegisterRingVrfKeyRequestCodec = Struct({
+    callingProductId: DotNsIdentifier,
+    index: DerivationIndex,
+    ring: RingLocation,
+});
+export const RegisterRingVrfKeyResponseCodec = Struct({
+    // referencing to RemoteMessage.messageId
+    respondingTo: str,
+    payload: Result(RingVrfPublicKey, RegisterRingVrfKeyErr),
+});
+export const ListRingVrfKeysRequestCodec = Struct({
+    callingProductId: DotNsIdentifier,
+    owner: DotNsIdentifier,
+    disclosure: RingVrfKeyDisclosure,
+});
+export const ListRingVrfKeysResponseCodec = Struct({
+    // referencing to RemoteMessage.messageId
+    respondingTo: str,
+    payload: Result(Vector(RegisteredRingVrfKey), ListRingVrfKeysErr),
+});

package/dist/sso/sessionManager/userSession.d.ts

@@ -1,4 +1,4 @@
-import { ContextualAlias, ProductProofContext, RingLocation, RingVrfProof, VrfSignature } from '@novasamatech/host-api';
+import { ContextualAlias, DerivationIndex, ProductProofContext, RegisteredRingVrfKey, RingLocation, RingVrfKeyDisclosure, RingVrfKeyHandle, RingVrfProof, VrfSignature } from '@novasamatech/host-api';
 import type { Encryption, StatementProver, StatementStoreAdapter } from '@novasamatech/statement-store';
 import type { StorageAdapter } from '@novasamatech/storage-adapter';
 import { ResultAsync } from 'neverthrow';
@@ -24,8 +24,27 @@ export type UserSession = StoredUserSession & {
     signRawLegacy(payload: SignRawLegacyRequest): ResultAsync<Uint8Array, Error>;
     createTransaction(payload: CreateTransactionRequest): ResultAsync<Uint8Array, Error>;
     createTransactionLegacy(payload: CreateTransactionLegacyRequest): ResultAsync<Uint8Array, Error>;
-    getRingVrfAlias(callingProductId: string, context: CodecType<typeof ProductProofContext>, ring: CodecType<typeof RingLocation>): ResultAsync<CodecType<typeof ContextualAlias>, Error>;
-    createRingVrfProof(callingProductId: string, context: CodecType<typeof ProductProofContext>, ring: CodecType<typeof RingLocation>, message: Uint8Array): ResultAsync<CodecType<typeof RingVrfProof>, Error>;
+    getRingVrfAlias(callingProductId: string, keyHandle: CodecType<typeof RingVrfKeyHandle>, context: CodecType<typeof ProductProofContext>, ring: CodecType<typeof RingLocation>): ResultAsync<CodecType<typeof ContextualAlias>, Error>;
+    createRingVrfProof(callingProductId: string, keyHandle: CodecType<typeof RingVrfKeyHandle>, context: CodecType<typeof ProductProofContext>, ring: CodecType<typeof RingLocation>, message: Uint8Array): ResultAsync<CodecType<typeof RingVrfProof>, Error>;
+    /**
+     * Signs `message` with the ring VRF member key itself (RFC-0024).
+     *
+     * Unlike {@link createRingVrfProof} this is not anonymous: the result is
+     * verified against the member public key and is linkable to every other use
+     * of that key.
+     */
+    ringVrfSign(callingProductId: string, keyHandle: CodecType<typeof RingVrfKeyHandle>, message: Uint8Array): ResultAsync<Uint8Array, Error>;
+    /**
+     * Registers a ring VRF key owned by `callingProductId` against `ring`,
+     * returning the member public key (RFC-0024).
+     *
+     * The Account Holder is the authoritative registry, so registration always
+     * reaches it. Idempotent — re-registering an index for an additional ring
+     * extends the existing entry.
+     */
+    registerRingVrfKey(callingProductId: string, index: CodecType<typeof DerivationIndex>, ring: CodecType<typeof RingLocation>): ResultAsync<Uint8Array, Error>;
+    /** Lists the ring VRF registry entries owned by `owner` (RFC-0024). */
+    listRingVrfKeys(callingProductId: string, owner: string, disclosure: CodecType<typeof RingVrfKeyDisclosure>): ResultAsync<CodecType<typeof RegisteredRingVrfKey>[], Error>;
     /**
      * Fetches the sr25519 public key of `//product//{productId}` (RFC-0022).
      *

package/dist/sso/sessionManager/userSession.js

@@ -1,4 +1,4 @@
-import { ContextualAlias, ProductProofContext, RingLocation, RingVrfProof, VrfSignature } from '@novasamatech/host-api';
+import { ContextualAlias, DerivationIndex, ProductProofContext, RegisteredRingVrfKey, RingLocation, RingVrfKeyDisclosure, RingVrfKeyHandle, RingVrfProof, VrfSignature, } from '@novasamatech/host-api';
 import { enumValue } from '@novasamatech/scale';
 import { createSession } from '@novasamatech/statement-store';
 import { fieldListView } from '@novasamatech/storage-adapter';
@@ -244,11 +244,12 @@ export function createUserSession({ userSession, statementStore, encryption, sto
                 return withHostActionTrace(withQueueTimeout(inner, 'createTransactionLegacy'), messageId, userSession.id);
             });
         },
-        getRingVrfAlias(callingProductId, context, ring) {
+        getRingVrfAlias(callingProductId, keyHandle, context, ring) {
             return enqueue(() => {
                 const messageId = nanoid();
                 const data = enumValue('v1', enumValue('RingVrfAliasRequest', {
                     callingProductId,
+                    keyHandle,
                     context,
                     ring,
                 }));
@@ -265,11 +266,12 @@ export function createUserSession({ userSession, statementStore, encryption, sto
                 return withHostActionTrace(awaitReplyOrAckFailure(request, reply).andThen(result => result.success ? ok(result.value) : err(result.value)), messageId, userSession.id);
             });
         },
-        createRingVrfProof(callingProductId, context, ring, message) {
+        createRingVrfProof(callingProductId, keyHandle, context, ring, message) {
             return enqueue(() => {
                 const messageId = nanoid();
                 const data = enumValue('v1', enumValue('RingVrfProofRequest', {
                     callingProductId,
+                    keyHandle,
                     context,
                     ring,
                     message,
@@ -287,6 +289,60 @@ export function createUserSession({ userSession, statementStore, encryption, sto
                 return withHostActionTrace(awaitReplyOrAckFailure(request, reply).andThen(result => result.success ? ok(result.value) : err(result.value)), messageId, userSession.id);
             });
         },
+        ringVrfSign(callingProductId, keyHandle, message) {
+            return enqueue(() => {
+                const messageId = nanoid();
+                const data = enumValue('v1', enumValue('RingVrfSignRequest', { callingProductId, keyHandle, message }));
+                emitHostAction(messageId, actionKindFromMessageData(data), userSession.id);
+                const responseFilter = (incoming) => {
+                    if (incoming.data.tag === 'v1' &&
+                        incoming.data.value.tag === 'RingVrfSignResponse' &&
+                        incoming.data.value.value.respondingTo === messageId) {
+                        return incoming.data.value.value.payload;
+                    }
+                };
+                const request = session.request(RemoteMessageCodec, { messageId, data });
+                const reply = session.waitForRequestMessage(RemoteMessageCodec, responseFilter);
+                const inner = awaitReplyOrAckFailure(request, reply).andThen(result => result.success ? ok(result.value) : err(result.value));
+                return withHostActionTrace(withQueueTimeout(inner, 'ringVrfSign'), messageId, userSession.id);
+            });
+        },
+        registerRingVrfKey(callingProductId, index, ring) {
+            return enqueue(() => {
+                const messageId = nanoid();
+                const data = enumValue('v1', enumValue('RegisterRingVrfKeyRequest', { callingProductId, index, ring }));
+                emitHostAction(messageId, actionKindFromMessageData(data), userSession.id);
+                const responseFilter = (incoming) => {
+                    if (incoming.data.tag === 'v1' &&
+                        incoming.data.value.tag === 'RegisterRingVrfKeyResponse' &&
+                        incoming.data.value.value.respondingTo === messageId) {
+                        return incoming.data.value.value.payload;
+                    }
+                };
+                const request = session.request(RemoteMessageCodec, { messageId, data });
+                const reply = session.waitForRequestMessage(RemoteMessageCodec, responseFilter);
+                const inner = awaitReplyOrAckFailure(request, reply).andThen(result => result.success ? ok(result.value) : err(result.value));
+                return withHostActionTrace(withQueueTimeout(inner, 'registerRingVrfKey'), messageId, userSession.id);
+            });
+        },
+        listRingVrfKeys(callingProductId, owner, disclosure) {
+            return enqueue(() => {
+                const messageId = nanoid();
+                const data = enumValue('v1', enumValue('ListRingVrfKeysRequest', { callingProductId, owner, disclosure }));
+                emitHostAction(messageId, actionKindFromMessageData(data), userSession.id);
+                const responseFilter = (incoming) => {
+                    if (incoming.data.tag === 'v1' &&
+                        incoming.data.value.tag === 'ListRingVrfKeysResponse' &&
+                        incoming.data.value.value.respondingTo === messageId) {
+                        return incoming.data.value.value.payload;
+                    }
+                };
+                const request = session.request(RemoteMessageCodec, { messageId, data });
+                const reply = session.waitForRequestMessage(RemoteMessageCodec, responseFilter);
+                const inner = awaitReplyOrAckFailure(request, reply).andThen(result => result.success ? ok(result.value) : err(result.value));
+                return withHostActionTrace(withQueueTimeout(inner, 'listRingVrfKeys'), messageId, userSession.id);
+            });
+        },
         getProductSubtree(productId) {
             return enqueue(() => {
                 const messageId = nanoid();

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@novasamatech/host-papp",
   "type": "module",
-  "version": "0.9.1",
+  "version": "0.9.3",
   "description": "Polkadot app integration",
   "license": "Apache-2.0",
   "repository": {
@@ -11,6 +11,10 @@
   "keywords": [
     "polkadot"
   ],
+  "scripts": {
+    "papi:fix": "node ../../scripts/fix-papi-descriptors.mjs .papi/descriptors/dist",
+    "papi:update": "papi update && npm run papi:fix"
+  },
   "main": "dist/index.js",
   "exports": {
     "./package.json": "./package.json",
@@ -34,10 +38,10 @@
     "@noble/ciphers": "2.2.0",
     "@noble/curves": "2.2.0",
     "@noble/hashes": "2.2.0",
-    "@novasamatech/host-api": "0.9.1",
-    "@novasamatech/scale": "0.9.1",
-    "@novasamatech/statement-store": "0.9.1",
-    "@novasamatech/storage-adapter": "0.9.1",
+    "@novasamatech/host-api": "0.9.3",
+    "@novasamatech/scale": "0.9.3",
+    "@novasamatech/statement-store": "0.9.3",
+    "@novasamatech/storage-adapter": "0.9.3",
     "@polkadot-api/utils": "^0.4.0",
     "@polkadot-labs/hdkd-helpers": "^0.0.31",
     "nanoevents": "10.0.0",