@ottochain/sdk 2.6.0 → 2.7.0

package/dist/cjs/apps/lending/assets.js

@@ -112,6 +112,11 @@ function createMintAssetPayload(params) {
 /**
  * Apply a typed morphism (Transfer / Burn / Compose / ...). asset-model.md §7.
  * Transfer = `{ kind: "Transfer", recipient }`; Burn (repay) = `{ kind: "Burn" }`.
+ *
+ * C2 — a `Compose`/`Pool` that folds in a counter-party the signer does NOT own is now rejected on-chain
+ * unless a live `AuthorizeCompose` nonce authorizes it: pass that nonce here (`nonce`) and build the commit
+ * half with {@link createAuthorizeComposePayload}. A same-holder compose (all parts signer-owned) needs no
+ * nonce. `otherAssets` must be duplicate-free and must not include `assetId`.
  */
 function createApplyMorphismPayload(params) {
     return {
@@ -128,7 +133,12 @@ function createApplyMorphismPayload(params) {
         },
     };
 }
-/** Commit half of a two-party compose. asset-model.md §7/§8. */
+/**
+ * Commit half of a two-party (cross-holder) compose. asset-model.md §7/§8. As of chain finding C2 this
+ * handshake is MANDATORY: a cross-holder `Compose`/`Pool` is rejected unless a matching, unexpired nonce
+ * from this call is live for the counter-party. The composing party then echoes `nonce` in its
+ * `ApplyMorphism`. A same-holder compose (all parts owned by the signer) does not need this.
+ */
 function createAuthorizeComposePayload(params) {
     return {
         AuthorizeCompose: {

package/dist/cjs/index.js

@@ -31,8 +31,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.IMMUTABLE_POLICY = exports.immutable = exports.unconstrained = exports.constrained = exports.defineFiberApp = exports.toProtoDefinition = exports.OttoMetagraphClient = exports.assert = exports.safeParse = exports.validateKeyPair = exports.validateAddress = exports.validatePublicKey = exports.validatePrivateKey = exports.validate = exports.CompleteContractRequestSchema = exports.AcceptContractRequestSchema = exports.ProposeContractRequestSchema = exports.ContractTermsSchema = exports.PlatformLinkSchema = exports.AgentIdentityRegistrationSchema = exports.TransferParamsSchema = exports.CurrencyTransactionSchema = exports.CurrencyTransactionValueSchema = exports.TransactionReferenceSchema = exports.SignedSchema = exports.SignatureProofSchema = exports.KeyPairSchema = exports.PublicKeySchema = exports.PrivateKeySchema = exports.DagAddressSchema = exports.wrapError = exports.isErrorCode = exports.ErrorCode = exports.TransactionError = exports.SigningError = exports.ValidationError = exports.NetworkError = exports.OttoChainError = exports.GENESIS_MANIFEST_VERSION = exports.buildGenesisManifest = exports.dropNulls = exports.MetagraphNetworkError = exports.HttpClient = exports.createMetagraphClient = exports.MetagraphClient = exports.batchSign = exports.addSignature = exports.createSignedObject = exports.signDataUpdate = exports.verify = void 0;
-exports.SHIELDED_POOL_STATE = exports.shieldApp = exports.RESERVED_EFFECT_KEYS = exports.toWallet = exports.toFiber = exports.scriptCall = exports.emit = exports.spawn = exports.triggers = exports.transferAsset = exports.setDependencyActive = exports.addDependency = exports.actorNotInArray = exports.depInState = exports.signerHasRoleVia = exports.signerHasReputationVia = exports.signerHasRole = exports.signerHasReputation = exports.actorHasEntry = exports.actorInSet = exports.actorIsSigner = exports.assetSignerIs = exports.signerHasEntry = exports.signerIsNotParty = exports.signerInSet = exports.signerIsAnyParty = exports.signerIsParty = exports.projectFiberPolicy = void 0;
+exports.constrained = exports.defineFiberApp = exports.toProtoDefinition = exports.SNAPSHOT_FINALIZED_EVENT = exports.OttoMetagraphClient = exports.assert = exports.safeParse = exports.validateKeyPair = exports.validateAddress = exports.validatePublicKey = exports.validatePrivateKey = exports.validate = exports.CompleteContractRequestSchema = exports.AcceptContractRequestSchema = exports.ProposeContractRequestSchema = exports.ContractTermsSchema = exports.PlatformLinkSchema = exports.AgentIdentityRegistrationSchema = exports.TransferParamsSchema = exports.CurrencyTransactionSchema = exports.CurrencyTransactionValueSchema = exports.TransactionReferenceSchema = exports.SignedSchema = exports.SignatureProofSchema = exports.KeyPairSchema = exports.PublicKeySchema = exports.PrivateKeySchema = exports.DagAddressSchema = exports.wrapError = exports.isErrorCode = exports.ErrorCode = exports.TransactionError = exports.SigningError = exports.ValidationError = exports.NetworkError = exports.OttoChainError = exports.GENESIS_MANIFEST_VERSION = exports.buildGenesisManifest = exports.MORPHISM_LINT_CODES = exports.lintApplyMorphism = exports.dropNulls = exports.MetagraphNetworkError = exports.HttpClient = exports.createMetagraphClient = exports.MetagraphClient = exports.batchSign = exports.addSignature = exports.createSignedObject = exports.signDataUpdate = exports.verify = void 0;
+exports.SHIELDED_POOL_STATE = exports.shieldApp = exports.RESERVED_EFFECT_KEYS = exports.toWallet = exports.toFiber = exports.scriptCall = exports.emit = exports.spawn = exports.triggers = exports.transferAsset = exports.setDependencyActive = exports.addDependency = exports.actorNotInArray = exports.depInState = exports.signerHasRoleVia = exports.signerHasReputationVia = exports.signerHasRole = exports.signerHasReputation = exports.actorHasEntry = exports.actorInSet = exports.actorIsSigner = exports.assetSignerIs = exports.signerHasEntry = exports.signerIsNotParty = exports.signerInSet = exports.signerIsAnyParty = exports.signerIsParty = exports.projectFiberPolicy = exports.IMMUTABLE_POLICY = exports.immutable = exports.unconstrained = void 0;
 // ─── Core metagraph SDK ───────────────────────────────────────────────────────
 // Consumers can also import directly from '@constellation-network/metagraph-sdk'
 __exportStar(require("@constellation-network/metagraph-sdk"), exports);
@@ -62,6 +62,10 @@ __exportStar(require("./types.js"), exports);
 __exportStar(require("./ottochain/transaction.js"), exports);
 var drop_nulls_js_1 = require("./ottochain/drop-nulls.js");
 Object.defineProperty(exports, "dropNulls", { enumerable: true, get: function () { return drop_nulls_js_1.dropNulls; } });
+// Message-layer advisory lint for ApplyMorphism (Compose/Pool consent + inflation checks).
+var morphism_lint_js_1 = require("./ottochain/morphism-lint.js");
+Object.defineProperty(exports, "lintApplyMorphism", { enumerable: true, get: function () { return morphism_lint_js_1.lintApplyMorphism; } });
+Object.defineProperty(exports, "MORPHISM_LINT_CODES", { enumerable: true, get: function () { return morphism_lint_js_1.MORPHISM_LINT_CODES; } });
 // ─── Genesis manifest exporter (std-app pre-registration content) ─────────────
 var genesis_manifest_js_1 = require("./ottochain/genesis-manifest.js");
 Object.defineProperty(exports, "buildGenesisManifest", { enumerable: true, get: function () { return genesis_manifest_js_1.buildGenesisManifest; } });
@@ -108,6 +112,8 @@ Object.defineProperty(exports, "assert", { enumerable: true, get: function () {
 // ─── OttoChain metagraph client ───────────────────────────────────────────────
 var metagraph_client_js_1 = require("./ottochain/metagraph-client.js");
 Object.defineProperty(exports, "OttoMetagraphClient", { enumerable: true, get: function () { return metagraph_client_js_1.MetagraphClient; } });
+var webhook_notifications_js_1 = require("./ottochain/webhook-notifications.js");
+Object.defineProperty(exports, "SNAPSHOT_FINALIZED_EVENT", { enumerable: true, get: function () { return webhook_notifications_js_1.SNAPSHOT_FINALIZED_EVENT; } });
 // Proto definition helper
 var fiber_app_js_1 = require("./schema/fiber-app.js");
 Object.defineProperty(exports, "toProtoDefinition", { enumerable: true, get: function () { return fiber_app_js_1.toProtoDefinition; } });

package/dist/cjs/ottochain/index.js

@@ -40,7 +40,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GENESIS_MANIFEST_VERSION = exports.buildGenesisManifest = exports.dropNulls = exports.createAuthorizeComposePayload = exports.createApplyMorphismPayload = exports.createMintAssetPayload = exports.createAssetPolicyPayload = exports.createDataTransactionRequest = exports.createScriptPayload = exports.createStateMachinePayload = exports.getPublicKeyForRegistration = exports.addTransactionSignature = exports.signTransaction = exports.createInvokeScriptPayload = exports.createArchivePayload = exports.createTransitionPayload = exports.MetagraphClient = exports.extractOnChainState = exports.getScriptInvocations = exports.getEventReceipts = exports.getLogsForFiber = exports.getLatestOnChainState = exports.getSnapshotOnChainState = exports.decodeOnChainState = exports.TOKEN_BEHAVIOR_BITS = exports.OTTOCHAIN_MESSAGE_TYPES = exports.proto = void 0;
+exports.GENESIS_MANIFEST_VERSION = exports.buildGenesisManifest = exports.dropNulls = exports.MORPHISM_LINT_CODES = exports.lintApplyMorphism = exports.createAuthorizeComposePayload = exports.createApplyMorphismPayload = exports.createMintAssetPayload = exports.createAssetPolicyPayload = exports.createDataTransactionRequest = exports.createScriptPayload = exports.createStateMachinePayload = exports.getPublicKeyForRegistration = exports.addTransactionSignature = exports.signTransaction = exports.createInvokeScriptPayload = exports.createArchivePayload = exports.createTransitionPayload = exports.SNAPSHOT_FINALIZED_EVENT = exports.commitKeyPath = exports.verifyMptInclusion = exports.verifyStateProof = exports.MetagraphClient = exports.extractOnChainState = exports.getScriptInvocations = exports.getEventReceipts = exports.getLogsForFiber = exports.getLatestOnChainState = exports.getSnapshotOnChainState = exports.decodeOnChainState = exports.TOKEN_BEHAVIOR_BITS = exports.OTTOCHAIN_MESSAGE_TYPES = exports.proto = void 0;
 // Re-export generated protobuf types (for binary encoding)
 exports.proto = __importStar(require("../generated/index.js"));
 // Runtime message type validation
@@ -57,6 +57,12 @@ Object.defineProperty(exports, "getScriptInvocations", { enumerable: true, get:
 Object.defineProperty(exports, "extractOnChainState", { enumerable: true, get: function () { return snapshot_js_1.extractOnChainState; } });
 var metagraph_client_js_1 = require("./metagraph-client.js");
 Object.defineProperty(exports, "MetagraphClient", { enumerable: true, get: function () { return metagraph_client_js_1.MetagraphClient; } });
+var state_proof_js_1 = require("./state-proof.js");
+Object.defineProperty(exports, "verifyStateProof", { enumerable: true, get: function () { return state_proof_js_1.verifyStateProof; } });
+Object.defineProperty(exports, "verifyMptInclusion", { enumerable: true, get: function () { return state_proof_js_1.verifyMptInclusion; } });
+Object.defineProperty(exports, "commitKeyPath", { enumerable: true, get: function () { return state_proof_js_1.commitKeyPath; } });
+var webhook_notifications_js_1 = require("./webhook-notifications.js");
+Object.defineProperty(exports, "SNAPSHOT_FINALIZED_EVENT", { enumerable: true, get: function () { return webhook_notifications_js_1.SNAPSHOT_FINALIZED_EVENT; } });
 // Transaction helpers (state machine payloads, signing)
 var transaction_js_1 = require("./transaction.js");
 Object.defineProperty(exports, "createTransitionPayload", { enumerable: true, get: function () { return transaction_js_1.createTransitionPayload; } });
@@ -72,6 +78,10 @@ Object.defineProperty(exports, "createAssetPolicyPayload", { enumerable: true, g
 Object.defineProperty(exports, "createMintAssetPayload", { enumerable: true, get: function () { return transaction_js_1.createMintAssetPayload; } });
 Object.defineProperty(exports, "createApplyMorphismPayload", { enumerable: true, get: function () { return transaction_js_1.createApplyMorphismPayload; } });
 Object.defineProperty(exports, "createAuthorizeComposePayload", { enumerable: true, get: function () { return transaction_js_1.createAuthorizeComposePayload; } });
+// Message-layer advisory lint for ApplyMorphism (Compose/Pool C2 mistakes the chain rejects).
+var morphism_lint_js_1 = require("./morphism-lint.js");
+Object.defineProperty(exports, "lintApplyMorphism", { enumerable: true, get: function () { return morphism_lint_js_1.lintApplyMorphism; } });
+Object.defineProperty(exports, "MORPHISM_LINT_CODES", { enumerable: true, get: function () { return morphism_lint_js_1.MORPHISM_LINT_CODES; } });
 // Data utilities
 var drop_nulls_js_1 = require("./drop-nulls.js");
 Object.defineProperty(exports, "dropNulls", { enumerable: true, get: function () { return drop_nulls_js_1.dropNulls; } });

package/dist/cjs/ottochain/morphism-lint.js

@@ -0,0 +1,99 @@
+"use strict";
+/**
+ * Message-layer advisory lint for an {@link ApplyMorphism} transaction (asset-model.md §7; chain
+ * audit finding C2, enforced in `AssetCombiner`).
+ *
+ * Purpose
+ * -------
+ * The definition-scoped {@link ../schema/guard-lint.ts | guard-lint} walks fiber-app DEFINITIONS; it
+ * never sees an `ApplyMorphism` MESSAGE, so a malformed / no-consent `Compose` slips past it. This
+ * linter closes that gap at the transaction-builder layer: hand it the `ApplyMorphism` you are about
+ * to sign and it flags the two classes of C2 mistake the chain rejects.
+ *
+ * The chain rule being mirrored (C2, `Compose`/`Pool` only):
+ *   - `otherAssetIds` must be free of duplicates and must NOT include the source `assetId`
+ *     (the old self/duplicate-inflation path — rejected unconditionally, holder-independent).
+ *   - every counter-party the signer does NOT hold requires a live {@link AuthorizeCompose} `nonce`;
+ *     a same-holder / all-signer-owned compose needs none.
+ *
+ * ERRORS are statically certain (the chain rejects regardless of who holds what). WARNINGS are
+ * heuristic — the signer's holdings/ownership are unknown at build time, so a missing consent nonce
+ * cannot be proven fatal (a same-holder compose is legitimately nonce-less).
+ *
+ * This is a PURE, non-throwing advisory. It is deliberately NOT wired into
+ * {@link createApplyMorphismPayload} (which must stay non-breaking and side-effect-free); call it
+ * explicitly before signing, or in your app's own pre-flight checks.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MORPHISM_LINT_CODES = void 0;
+exports.lintApplyMorphism = lintApplyMorphism;
+/** Stable rule codes for {@link lintApplyMorphism} — referenced by tests and report tooling. */
+exports.MORPHISM_LINT_CODES = {
+    /** `otherAssetIds` contains a duplicate id (chain rejects — inflation path). */
+    DUPLICATE_OTHER_ID: 'morphism-duplicate-other-id',
+    /** `otherAssetIds` includes the source `assetId` (self-composition — chain rejects). */
+    SELF_COMPOSE: 'morphism-self-compose',
+    /** `otherAssetIds` is non-empty but `kind` ignores it (not Compose/Pool — likely a mistake). */
+    OTHER_IDS_IGNORED: 'morphism-other-ids-ignored',
+    /** Compose/Pool with counter-parties and no consent `nonce` (rejected IF any part is not signer-owned). */
+    COMPOSE_NO_NONCE: 'morphism-compose-no-nonce',
+};
+/** The morphism kinds whose semantics READ `otherAssetIds` (fold counter-party parts into a composite). */
+const COMPOSING_KINDS = new Set(['COMPOSE', 'POOL']);
+function finding(severity, code, message, path) {
+    return { severity, code, message, path };
+}
+/**
+ * Lint a single {@link ApplyMorphism} message. Pure and non-throwing. Returns every finding
+ * (`error` + `warn`); callers decide the policy (e.g. block on any `error`, surface `warn`s).
+ *
+ * ERRORS (statically certain — the chain rejects unconditionally, holder-independent):
+ *   - {@link MORPHISM_LINT_CODES.DUPLICATE_OTHER_ID} — `otherAssetIds` contains a duplicate id.
+ *   - {@link MORPHISM_LINT_CODES.SELF_COMPOSE} — `otherAssetIds` includes the source `assetId`.
+ *   - {@link MORPHISM_LINT_CODES.OTHER_IDS_IGNORED} — `otherAssetIds` is non-empty but `kind` is not
+ *     `COMPOSE`/`POOL` (the field is ignored for other kinds — a likely authoring mistake).
+ *
+ * WARNINGS (heuristic — holder/ownership unknown at build time):
+ *   - {@link MORPHISM_LINT_CODES.COMPOSE_NO_NONCE} — a `COMPOSE`/`POOL` with a non-empty
+ *     `otherAssetIds` and NO `nonce`. IF any counter-party is not signer-owned the chain rejects it
+ *     (C2); attach the reveal half of an {@link AuthorizeCompose} handshake as `nonce`. A same-holder
+ *     compose (all parts signer-owned) is legitimately nonce-less — hence a warning, not an error.
+ */
+function lintApplyMorphism(msg) {
+    const out = [];
+    const ids = msg.otherAssetIds ?? [];
+    const isComposing = COMPOSING_KINDS.has(msg.kind);
+    // ---- error: duplicate ids in otherAssetIds ---------------------------------
+    // One finding per DISTINCT duplicated id (path points at its first repeat occurrence).
+    const seen = new Set();
+    const dupReported = new Set();
+    ids.forEach((id, i) => {
+        if (seen.has(id) && !dupReported.has(id)) {
+            dupReported.add(id);
+            out.push(finding('error', exports.MORPHISM_LINT_CODES.DUPLICATE_OTHER_ID, `otherAssetIds contains duplicate id "${id}". The chain rejects a Compose/Pool whose ` +
+                `otherAssetIds has duplicates (the old inflation path). List each counter-party asset once.`, `otherAssetIds[${i}]`));
+        }
+        seen.add(id);
+    });
+    // ---- error: otherAssetIds includes the source assetId (self-composition) ----
+    const selfIdx = ids.indexOf(msg.assetId);
+    if (selfIdx !== -1) {
+        out.push(finding('error', exports.MORPHISM_LINT_CODES.SELF_COMPOSE, `otherAssetIds includes the source assetId "${msg.assetId}" (self-composition). The chain ` +
+            `rejects this unconditionally. otherAssetIds must list only the OTHER parts folded into the composite.`, `otherAssetIds[${selfIdx}]`));
+    }
+    // ---- error: otherAssetIds set but kind ignores it ---------------------------
+    if (ids.length > 0 && !isComposing) {
+        out.push(finding('error', exports.MORPHISM_LINT_CODES.OTHER_IDS_IGNORED, `otherAssetIds is non-empty but kind is "${msg.kind}", which ignores otherAssetIds entirely ` +
+            `(only COMPOSE/POOL fold in counter-party parts). This is almost certainly a mistake — set ` +
+            `kind to COMPOSE/POOL, or drop otherAssetIds.`, 'otherAssetIds'));
+    }
+    // ---- warn: composing with counter-parties but no consent nonce --------------
+    // nonce === 0 is a valid live nonce; only an OMITTED nonce (undefined/null) triggers the warning.
+    if (isComposing && ids.length > 0 && msg.nonce == null) {
+        out.push(finding('warn', exports.MORPHISM_LINT_CODES.COMPOSE_NO_NONCE, `${msg.kind} folds in otherAssetIds but carries no consent nonce. If ANY counter-party asset ` +
+            `is not held by the signer, the chain REJECTS this (C2): attach the reveal half of an ` +
+            `AuthorizeCompose handshake as \`nonce\`. A same-holder compose (all parts signer-owned) ` +
+            `needs none, so this is advisory.`, 'nonce'));
+    }
+    return out;
+}

package/dist/cjs/ottochain/state-proof.js

@@ -0,0 +1,118 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.commitKeyPath = commitKeyPath;
+exports.verifyMptInclusion = verifyMptInclusion;
+exports.verifyStateProof = verifyStateProof;
+/**
+ * Light-client verification of committed state proofs.
+ *
+ * The chain's `/state-machines|scripts|assets/{id}/state-proof` endpoints return a
+ * {@link StateProof}: the record plus a Merkle-Patricia inclusion proof against `mptRoot`,
+ * whose combined hash IS the snapshot's consensus-signed `calculatedStateProof`. Verifying
+ * the proof locally means trusting NO serving node — only snapshot consensus.
+ *
+ * The fold mirrors metakit's `MerklePatriciaVerifier` byte-for-byte (validated against live
+ * cluster proofs):
+ *
+ *  - the response `witness` is LEAF-FIRST; verification walks it reversed (root-first);
+ *  - every node's digest = `sha256(typePrefix ++ utf8(JCS(dropNulls(contents))))` over the
+ *    commitment's SUBTYPE (contents-only) encoding — prefixes: leaf `0x00`, branch `0x01`,
+ *    extension `0x02`;
+ *  - a Branch consumes one path nibble via `pathsDigest`; an Extension consumes its `shared`
+ *    nibbles and continues at `childDigest`;
+ *  - the terminal Leaf must match the remaining path (`remaining`) and bind
+ *    `dataDigest == sha256(JCS(dropNulls(record)))` (no prefix);
+ *  - the trie path of a committed key is `hex(utf8(key))` (metakit `CommitKey.toHex`), e.g.
+ *    `fiber/<uuid>` → `66696265722f…`.
+ *
+ * NOTE: this intentionally does NOT route through the JLVM `mpt_verify` opcode — the
+ * TypeScript port of that opcode mis-canonicalizes non-scalar leaf values (fiber records)
+ * and returns false; its conformance vectors only cover scalar leaves. The Scala (chain)
+ * side is correct. Once the port is fixed upstream this helper stays valid either way: it
+ * is the same algorithm without the JsonLogic value-domain round-trip.
+ */
+const metagraph_sdk_1 = require("@constellation-network/metagraph-sdk");
+const sha256_js_1 = require("@noble/hashes/sha256.js");
+const utf8 = (s) => new TextEncoder().encode(s);
+const toHexStr = (b) => Array.from(b, (x) => x.toString(16).padStart(2, '0')).join('');
+/** `sha256(prefixByte? ++ utf8(JCS(dropNulls(value))))` — the chain's content-digest rule. */
+function jcsSha256(value, prefix) {
+    const canonical = utf8((0, metagraph_sdk_1.canonicalize)(value));
+    if (prefix === undefined)
+        return toHexStr((0, sha256_js_1.sha256)(canonical));
+    const framed = new Uint8Array(1 + canonical.length);
+    framed[0] = prefix;
+    framed.set(canonical, 1);
+    return toHexStr((0, sha256_js_1.sha256)(framed));
+}
+/** The MPT trie path of a committed key — `hex(utf8(key))` (metakit `CommitKey.toHex`). */
+function commitKeyPath(key) {
+    return toHexStr(utf8(key));
+}
+const NODE_PREFIX = { Leaf: 0, Branch: 1, Extension: 2 };
+/**
+ * Verify a Merkle-Patricia inclusion proof: `record` is committed at `key` under `mptRoot`.
+ *
+ * Pure and side-effect free; never throws on malformed input (returns `{ ok: false }`).
+ */
+function verifyMptInclusion(mptRoot, key, record, proof) {
+    const fail = (reason) => ({ ok: false, reason });
+    if (!proof || typeof proof.path !== 'string' || !Array.isArray(proof.witness) || proof.witness.length === 0)
+        return fail('malformed proof (missing path/witness)');
+    const expectedPath = commitKeyPath(key);
+    if (proof.path.toLowerCase() !== expectedPath)
+        return fail(`trie path != hex(utf8("${key}"))`);
+    let digest = String(mptRoot).replace(/^0x/, '').toLowerCase();
+    let path = proof.path.toLowerCase();
+    const nodes = [...proof.witness].reverse(); // response is leaf-first; fold root-first
+    for (const [depth, node] of nodes.entries()) {
+        const isLast = depth === nodes.length - 1;
+        const prefix = NODE_PREFIX[node?.type];
+        if (prefix === undefined)
+            return fail(`unknown witness node type '${String(node?.type)}'`);
+        if (jcsSha256(node.contents, prefix) !== digest)
+            return fail(`${node.type.toLowerCase()} commitment mismatch at depth ${depth}`);
+        if (node.type === 'Branch') {
+            const child = node.contents.pathsDigest?.[path[0]];
+            if (!child)
+                return fail(`branch has no child at nibble '${path[0]}' (depth ${depth})`);
+            digest = child.toLowerCase();
+            path = path.slice(1);
+        }
+        else if (node.type === 'Extension') {
+            const shared = String(node.contents.shared ?? '');
+            if (!path.startsWith(shared.toLowerCase()))
+                return fail(`extension shared-nibble mismatch at depth ${depth}`);
+            path = path.slice(shared.length);
+            digest = String(node.contents.childDigest ?? '').toLowerCase();
+        }
+        else {
+            // Leaf
+            if (!isLast)
+                return fail('leaf before end of witness');
+            if (String(node.contents.remaining ?? '').toLowerCase() !== path)
+                return fail('leaf remaining-path mismatch');
+            if (String(node.contents.dataDigest ?? '').toLowerCase() !== jcsSha256(record))
+                return fail('leaf dataDigest != sha256(JCS(record))');
+            return { ok: true };
+        }
+    }
+    return fail('witness does not terminate in a leaf');
+}
+/**
+ * Verify a whole {@link StateProof} response for a committed key.
+ *
+ * Checks the trie inclusion of `record` at `key` under the response's `mptRoot` (see
+ * {@link verifyMptInclusion}). The caller supplies the key it EXPECTS (`fiber/<id>`,
+ * `script/<id>`, `asset/<id>`, …) so a proof for some other record cannot be substituted;
+ * the response's own `key` field must agree.
+ *
+ * Trust anchor: `committedRoot` (= `sha256(mptRoot ++ catalogRoot)`) rides in the
+ * consensus-signed snapshot as `calculatedStateProof`; binding `mptRoot` to a snapshot is
+ * the caller's (or a snapshot-following light client's) responsibility.
+ */
+function verifyStateProof(resp, expectedKey) {
+    if (resp.key !== expectedKey)
+        return { ok: false, reason: `response key '${resp.key}' != expected '${expectedKey}'` };
+    return verifyMptInclusion(String(resp.mptRoot), expectedKey, resp.record, resp.proof);
+}

package/dist/cjs/ottochain/transaction.js

@@ -166,7 +166,13 @@ function createAssetPolicyPayload(params) {
 function createMintAssetPayload(params) {
     return { MintAsset: params };
 }
-/** Wrap an {@link ApplyMorphism} (apply a typed morphism to an asset instance). */
+/**
+ * Wrap an {@link ApplyMorphism} (apply a typed morphism to an asset instance).
+ *
+ * @see lintApplyMorphism (`./morphism-lint.ts`) — pure, non-throwing advisory that flags the
+ * Compose/Pool mistakes the chain rejects (duplicate / self-referential `otherAssetIds`; a
+ * cross-holder compose with no consent `nonce`). Run it on `params` before signing.
+ */
 function createApplyMorphismPayload(params) {
     return { ApplyMorphism: params };
 }

package/dist/cjs/ottochain/webhook-notifications.js

@@ -0,0 +1,33 @@
+"use strict";
+/**
+ * Webhook notification PAYLOAD types — the server-initiated push the chain POSTs to a subscribed
+ * callback, NOT part of the client's request surface.
+ *
+ * These are hand-authored (not generated from the OpenAPI contract) because the push is an OUTBOUND
+ * POST from the metagraph to the subscriber's callback URL — it is not an endpoint the chain's tapir
+ * `ApiEndpoints` serves, so it never appears in `openapi/ottochain-openapi-ml0.json`. They mirror the
+ * chain's shared network DTOs byte-for-byte:
+ *
+ *   chain: modules/models/src/main/scala/xyz/kd5ujc/schema/api/webhooks/Subscriber.scala
+ *          (SnapshotNotification / NotificationStats / SnapshotRejection)
+ *   emit:  modules/l0/.../webhooks/WebhookDispatcher.scala — `notification.asJson.noSpaces`
+ *
+ * Field-shape notes tied to the chain source:
+ * - The dispatcher serializes with a plain derived encoder (`.asJson`, NO `dropNullValues`), so an
+ *   `Option[Long]` that is `None` is emitted as an explicit `null` — the KEY is always present, the
+ *   VALUE is nullable. Hence `number | null` (a required key), not `number | undefined` (an optional
+ *   key). Consumers must handle `null`.
+ * - `Long` → JSON number; `Instant` → ISO-8601 string; `UUID` → string.
+ * - The dispatcher only ever emits `"snapshot.finalized"` today (there is a dead, never-dispatched
+ *   `RejectionNotification`/`transaction.rejected` type in the chain models — deliberately NOT mirrored
+ *   here, because the SDK should model only what is actually sent). Rejections now ride the finalized
+ *   snapshot's `rejections[]`, drained from its committed `RejectionReceipt`s.
+ *
+ * @see modules/models/.../schema/api/webhooks/Subscriber.scala
+ * @see modules/l0/.../webhooks/WebhookDispatcher.scala
+ * @packageDocumentation
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SNAPSHOT_FINALIZED_EVENT = void 0;
+/** The only event the chain's `WebhookDispatcher` currently emits. */
+exports.SNAPSHOT_FINALIZED_EVENT = 'snapshot.finalized';

package/dist/cjs/schema/effects.js

@@ -121,11 +121,20 @@ exports.triggers = triggers;
  * MUST be a literal {@link ProtoStateMachineDefinition} (e.g. a nested `machine().wireDefinition()` /
  * `toProtoDefinition(child)` output) — NOT an expression the engine would evaluate at runtime.
  *
- * F8 gotcha — `owners` is load-bearing. A spawned child's transitions are gated by
- * `owners ∪ authorizedSigners` (`riverdale-economy/README.md`), so EVERY party that will later drive
- * the child (e.g. every bidder on a spawned auction) MUST be listed in `owners`, or their events are
- * rejected. `owners` may be a literal id array or an expression (e.g. `{ var: "event.auctionOwners" }`);
- * `childId` / `initialData` likewise accept literals or expressions.
+ * H1 constraint — child `owners` MUST be a SUBSET of the SPAWNING PARENT fiber's `owners`. As of the
+ * fiber-engine permissionless-hardening (chain branch `fix/fiber-engine-permissionless-hardening`, audit
+ * finding H1) the chain FAILS-CLOSED — it aborts the whole transition under EVERY `spawnOwnerPolicy` — if
+ * a `_spawn`'s resolved child `owners` are not ⊆ the parent's owners. Assigning arbitrary, unsigned owners
+ * (the old "auction owned by all its bidders" pattern, where the bidders are NOT parent owners) is no
+ * longer valid: those events are not silently rejected, the spawn itself is rejected.
+ *
+ * So DO NOT try to enroll later participants by listing them here. A spawned child's transitions are gated
+ * by `owners ∪ authorizedSigners` for the DIRECT (wallet-signed) path; admit additional drivers through
+ * the child's OWN transitions (`authorizedSigners`), or drive it via the cascade (`_triggers`) subject to
+ * its `acceptedCallers` — never by widening `owners` beyond the parent's set. `owners` may be a literal id
+ * array or an expression (e.g. `{ var: "state.owners" }` — resolve it WITHIN the parent's owners), but a
+ * value the parent does not own (e.g. `{ var: "event.auctionOwners" }` supplied by the caller) will be
+ * rejected on-chain. `childId` / `initialData` likewise accept literals or expressions.
  */
 const spawn = (ds) => ({ _spawn: ds });
 exports.spawn = spawn;

package/dist/cjs/schema/guard-lint.js

@@ -33,6 +33,11 @@
  *
  *   leading-dot — `{"var":".foo"}` resolves to null on chain.
  *
+ *   H1 — a `_spawn` whose child `owners` are not provably a SUBSET of the spawning
+ *        parent's owners. The chain now fails-closed (aborts the transition) under
+ *        every spawnOwnerPolicy when child owners ⊄ parent owners; this advisory
+ *        flags the strong not-subset signals (hardcoded / `event.*`-derived owners).
+ *
  * This is a STANDALONE validator. It is deliberately NOT wired into
  * `defineFiberApp` / `toProtoDefinition`: doing so would break the build until
  * every app is remediated. Run it via `scripts/lint-apps.mjs`.
@@ -56,6 +61,7 @@ exports.LINT_CODES = {
     WITNESS_IN_TRANSITION: 'witness-in-transition', // rule 3
     DROPPED_DIRECTIVE: 'dropped-directive', // rule 4 (A3)
     LEADING_DOT_VAR: 'leading-dot-var', // rule 5
+    SPAWN_OWNERS: 'spawn-owners', // rule 6 (H1) — child owners not provably ⊆ parent
 };
 // =============================================================================
 // Rule data
@@ -293,6 +299,101 @@ function lintTransitionStructure(t, app, transition, path) {
     return out;
 }
 // =============================================================================
+// _spawn owner-subset rule (rule 6 / H1)
+// =============================================================================
+/** Collect every string `var` reference (path or `[path, default]` head) at or below `node`. */
+function collectVarRefs(node, acc) {
+    if (Array.isArray(node)) {
+        node.forEach((child) => collectVarRefs(child, acc));
+        return;
+    }
+    if (node === null || typeof node !== 'object')
+        return;
+    const obj = node;
+    const keys = Object.keys(obj);
+    if (keys.length === 1 && keys[0] === 'var') {
+        const ref = obj.var;
+        if (typeof ref === 'string')
+            acc.push(ref);
+        else if (Array.isArray(ref)) {
+            if (typeof ref[0] === 'string')
+                acc.push(ref[0]);
+            if (ref.length > 1)
+                collectVarRefs(ref[1], acc);
+        }
+        return;
+    }
+    for (const k of keys)
+        collectVarRefs(obj[k], acc);
+}
+/**
+ * Classify a `_spawn` child `owners` expression for the H1 subset risk. Returns a short reason string when
+ * the owners are NOT provably ⊆ the parent's owners from the definition alone, else `undefined`.
+ *
+ * The linter cannot see the parent fiber's runtime `owners` (they are set at `create()` time, not in the
+ * definition), so it flags only the two STRONG "not-subset" signals — keeping false positives low:
+ *   - a literal array carrying ≥1 concrete address string (a hardcoded external owner list); and
+ *   - any `event.*` reference (caller-supplied — the exact H1 owner-forgery vector).
+ * Owners derived purely from the parent's own `state.*` / `machineId` / `$`-context are assumed in-set and
+ * are NOT flagged.
+ */
+function spawnOwnersRisk(owners) {
+    if (Array.isArray(owners) && owners.some((o) => typeof o === 'string' && o.length > 0)) {
+        return 'a literal array with hardcoded owner address(es)';
+    }
+    const refs = [];
+    collectVarRefs(owners, refs);
+    if (refs.some((r) => r === 'event' || r.startsWith('event.'))) {
+        return "an 'event' reference (caller-supplied owners)";
+    }
+    return undefined;
+}
+/**
+ * rule 6 (H1) — scan a transition effect for `_spawn` directives whose child `owners` are not provably a
+ * SUBSET of the spawning parent's owners. The chain now fails-closed (aborts the transition) under every
+ * `spawnOwnerPolicy` when a child's resolved owners are not ⊆ the parent's. Advisory (warn): the linter
+ * cannot prove the subset statically, so it flags only the strong not-subset signals (see
+ * {@link spawnOwnersRisk}).
+ */
+function lintSpawnOwners(node, app, transition, path) {
+    const out = [];
+    if (Array.isArray(node)) {
+        node.forEach((child, i) => out.push(...lintSpawnOwners(child, app, transition, `${path}[${i}]`)));
+        return out;
+    }
+    if (node === null || typeof node !== 'object')
+        return out;
+    const obj = node;
+    for (const [k, v] of Object.entries(obj)) {
+        if (k === '_spawn' && Array.isArray(v)) {
+            v.forEach((entry, i) => {
+                if (entry && typeof entry === 'object' && !Array.isArray(entry) && 'owners' in entry) {
+                    const reason = spawnOwnersRisk(entry.owners);
+                    if (reason) {
+                        out.push({
+                            app,
+                            transition,
+                            severity: 'warn',
+                            code: exports.LINT_CODES.SPAWN_OWNERS,
+                            message: `_spawn child 'owners' must be a SUBSET of the spawning parent fiber's owners — the chain ` +
+                                `now FAILS-CLOSED (aborts the transition) under every spawnOwnerPolicy if they are not ⊆ the ` +
+                                `parent's (audit H1). This 'owners' is ${reason} and cannot be proven ⊆ the parent. Admit ` +
+                                `later participants via the child's own transitions / authorizedSigners / acceptedCallers ` +
+                                `instead of listing non-parent owners.`,
+                            path: `${path}.${k}[${i}].owners`,
+                        });
+                    }
+                }
+            });
+            // Do not descend into the spawn entry (its nested child definition's owners are relative to that
+            // child, not to this parent).
+            continue;
+        }
+        out.push(...lintSpawnOwners(v, app, transition, `${path}.${k}`));
+    }
+    return out;
+}
+// =============================================================================
 // Top-level entry point
 // =============================================================================
 function appLabel(def) {
@@ -323,6 +424,7 @@ function lintFiberApp(def) {
         }
         if (t.effect !== undefined) {
             out.push(...lintGuardExpression(t.effect, ctx, `${tPath}.effect`));
+            out.push(...lintSpawnOwners(t.effect, app, transition, `${tPath}.effect`));
         }
         out.push(...lintTransitionStructure(t, app, transition, tPath));
     });

package/dist/esm/apps/lending/assets.js

@@ -96,6 +96,11 @@ export function createMintAssetPayload(params) {
 /**
  * Apply a typed morphism (Transfer / Burn / Compose / ...). asset-model.md §7.
  * Transfer = `{ kind: "Transfer", recipient }`; Burn (repay) = `{ kind: "Burn" }`.
+ *
+ * C2 — a `Compose`/`Pool` that folds in a counter-party the signer does NOT own is now rejected on-chain
+ * unless a live `AuthorizeCompose` nonce authorizes it: pass that nonce here (`nonce`) and build the commit
+ * half with {@link createAuthorizeComposePayload}. A same-holder compose (all parts signer-owned) needs no
+ * nonce. `otherAssets` must be duplicate-free and must not include `assetId`.
  */
 export function createApplyMorphismPayload(params) {
     return {
@@ -112,7 +117,12 @@ export function createApplyMorphismPayload(params) {
         },
     };
 }
-/** Commit half of a two-party compose. asset-model.md §7/§8. */
+/**
+ * Commit half of a two-party (cross-holder) compose. asset-model.md §7/§8. As of chain finding C2 this
+ * handshake is MANDATORY: a cross-holder `Compose`/`Pool` is rejected unless a matching, unexpired nonce
+ * from this call is live for the counter-party. The composing party then echoes `nonce` in its
+ * `ApplyMorphism`. A same-holder compose (all parts owned by the signer) does not need this.
+ */
 export function createAuthorizeComposePayload(params) {
     return {
         AuthorizeCompose: {

package/dist/esm/index.js

@@ -34,6 +34,8 @@ export * from './types.js';
 // ─── OttoChain-specific transaction helpers ───────────────────────────────────
 export * from './ottochain/transaction.js';
 export { dropNulls } from './ottochain/drop-nulls.js';
+// Message-layer advisory lint for ApplyMorphism (Compose/Pool consent + inflation checks).
+export { lintApplyMorphism, MORPHISM_LINT_CODES } from './ottochain/morphism-lint.js';
 // ─── Genesis manifest exporter (std-app pre-registration content) ─────────────
 export { buildGenesisManifest, GENESIS_MANIFEST_VERSION } from './ottochain/genesis-manifest.js';
 // ─── Generated protobuf types (canonical definitions) ────────────────────────
@@ -48,6 +50,7 @@ DagAddressSchema, PrivateKeySchema, PublicKeySchema, KeyPairSchema, SignaturePro
 validate, validatePrivateKey, validatePublicKey, validateAddress, validateKeyPair, safeParse, assert, } from './validation.js';
 // ─── OttoChain metagraph client ───────────────────────────────────────────────
 export { MetagraphClient as OttoMetagraphClient } from './ottochain/metagraph-client.js';
+export { SNAPSHOT_FINALIZED_EVENT } from './ottochain/webhook-notifications.js';
 // Proto definition helper
 export { toProtoDefinition, defineFiberApp, 
 // Fiber policy (the fiber constitution): mirrors the chain ADT

package/dist/esm/ottochain/index.js

@@ -11,8 +11,12 @@ export * as proto from '../generated/index.js';
 export { OTTOCHAIN_MESSAGE_TYPES, TOKEN_BEHAVIOR_BITS } from './types.js';
 export { decodeOnChainState, getSnapshotOnChainState, getLatestOnChainState, getLogsForFiber, getEventReceipts, getScriptInvocations, extractOnChainState, } from './snapshot.js';
 export { MetagraphClient } from './metagraph-client.js';
+export { verifyStateProof, verifyMptInclusion, commitKeyPath } from './state-proof.js';
+export { SNAPSHOT_FINALIZED_EVENT } from './webhook-notifications.js';
 // Transaction helpers (state machine payloads, signing)
 export { createTransitionPayload, createArchivePayload, createInvokeScriptPayload, signTransaction, addTransactionSignature, getPublicKeyForRegistration, createStateMachinePayload, createScriptPayload, createDataTransactionRequest, createAssetPolicyPayload, createMintAssetPayload, createApplyMorphismPayload, createAuthorizeComposePayload, } from './transaction.js';
+// Message-layer advisory lint for ApplyMorphism (Compose/Pool C2 mistakes the chain rejects).
+export { lintApplyMorphism, MORPHISM_LINT_CODES } from './morphism-lint.js';
 // Data utilities
 export { dropNulls } from './drop-nulls.js';
 // Genesis manifest exporter (std-app pre-registration content)