@parity/product-sdk 0.20.1 → 0.22.0

package/dist/address/index.d.ts

@@ -4,5 +4,6 @@ import '@parity/product-sdk-chain-client';
 import '@parity/product-sdk-contracts';
 import '@parity/product-sdk-crypto';
 import '@parity/product-sdk-host';
+import '@parity/product-sdk-individuality';
 import '@parity/product-sdk-local-storage';
 import '@parity/product-sdk-signer';

package/dist/core/index.d.ts

@@ -1,6 +1,6 @@
 export { createApp } from '../index.js';
 export { LogEntry, LogHandler, LogLevel, Logger, LoggerConfig, configure, createLogger } from '@parity/product-sdk-logger';
-export { A as Account, b as App, c as AppConfig, C as ChainApi, a as CloudStorageApi, d as CloudStorageConfig, D as DotNsIdentitySignature, L as LocalStorageApi, S as SignMessageWithDotNsIdentityArgs, W as WalletApi } from '../types-CztPAgZT.js';
+export { A as Account, b as App, c as AppConfig, C as ChainApi, a as CloudStorageApi, d as CloudStorageConfig, D as DotNsIdentitySignature, L as LocalStorageApi, S as SignMessageWithDotNsIdentityArgs, W as WalletApi } from '../types-DTgyMIi0.js';
 export { ChainClient } from '@parity/product-sdk-chain-client';
 export { ChainDefinition, PolkadotClient, TypedApi } from 'polkadot-api';
 import '@parity/result';
@@ -9,4 +9,4 @@ import '@parity/product-sdk-host';
 import '@parity/product-sdk-signer';
 import '@parity/product-sdk-local-storage';
 import '@parity/product-sdk-cloud-storage';
-import '../dotns-hLSvmo6u.js';
+import '../dotns-DIaptENj.js';

package/dist/{dotns-hLSvmo6u.d.ts → dotns-DIaptENj.d.ts}

@@ -16,7 +16,12 @@ interface DotNsRecord {
     /** Expiration timestamp (if applicable) */
     expiresAt?: number;
 }
-/** Context alias info: a deterministic, context-bound alias derived from a parent account */
+/**
+ * Context alias info: a deterministic, context-bound alias derived from a parent account
+ *
+ * @deprecated Returned by `deriveContextAlias`, whose addresses no key can spend.
+ *   Removal: `@parity/product-sdk` 0.23.0.
+ */
 interface ContextAliasInfo {
     /** Alias SS58 address */
     address: string;
@@ -27,22 +32,6 @@ interface ContextAliasInfo {
     /** Context string used for derivation */
     context: string;
 }
-/** Ring VRF alias info */
-interface AnonymousAliasInfo {
-    /** Anonymous alias identifier */
-    alias: string;
-    /** Ring location for proof generation */
-    ringLocation: RingLocation;
-    /** Context used for alias derivation */
-    context: string;
-}
-/** Ring location for VRF proofs */
-interface RingLocation {
-    /** Ring index */
-    ringIndex: number;
-    /** Member index within ring */
-    memberIndex: number;
-}
 /** Identity verification result */
 interface VerificationResult {
     /** Whether identity is verified */
@@ -175,4 +164,4 @@ declare function isDotNsAvailable(name: string): Promise<boolean>;
 declare function resolvePeopleUsernameOwner(username: string, peopleApi: PeopleUsernameQueryApi): Promise<`0x${string}` | null>;
 declare function accountIdHexToBytes(accountId: `0x${string}`): Uint8Array;
 
-export { type AnonymousAliasInfo as A, type ContextAliasInfo as C, type DotNsRecord as D, type OnChainIdentity as O, type PeopleUsernameChain as P, type RingLocation as R, type VerificationResult as V, type PeopleUsernameQueryApi as a, accountIdHexToBytes as b, isValidDotNsName as c, resolvePeopleUsernameOwner as d, reverseDotNs as e, isDotNsAvailable as i, normalizeDotNsName as n, resolveDotNs as r };
+export { type ContextAliasInfo as C, type DotNsRecord as D, type OnChainIdentity as O, type PeopleUsernameChain as P, type VerificationResult as V, type PeopleUsernameQueryApi as a, accountIdHexToBytes as b, isValidDotNsName as c, resolvePeopleUsernameOwner as d, reverseDotNs as e, isDotNsAvailable as i, normalizeDotNsName as n, resolveDotNs as r };

package/dist/identity/index.d.ts

@@ -1,12 +1,15 @@
-import { R as RingLocation, A as AnonymousAliasInfo, C as ContextAliasInfo } from '../dotns-hLSvmo6u.js';
-export { D as DotNsRecord, O as OnChainIdentity, P as PeopleUsernameChain, a as PeopleUsernameQueryApi, V as VerificationResult, b as accountIdHexToBytes, i as isDotNsAvailable, c as isValidDotNsName, n as normalizeDotNsName, r as resolveDotNs, d as resolvePeopleUsernameOwner, e as reverseDotNs } from '../dotns-hLSvmo6u.js';
+import { C as ContextAliasInfo } from '../dotns-DIaptENj.js';
+export { D as DotNsRecord, O as OnChainIdentity, P as PeopleUsernameChain, a as PeopleUsernameQueryApi, V as VerificationResult, b as accountIdHexToBytes, i as isDotNsAvailable, c as isValidDotNsName, n as normalizeDotNsName, r as resolveDotNs, d as resolvePeopleUsernameOwner, e as reverseDotNs } from '../dotns-DIaptENj.js';
 import 'polkadot-api';
 
 /**
- * Context alias derivation
+ * Context alias derivation (deprecated, removal in 0.23.0)
  *
  * Derives a deterministic, context-bound alias from a parent account using blake2b-256.
  *
+ * The output is a hash, not a key, so no signing key exists for the addresses
+ * returned here. See the notes on each function for what to use instead.
+ *
  * NOTE: this is NOT the canonical sr25519 product-account derivation used by
  * mobile, desktop, and dotli hosts. For that, use
  * `@parity/product-sdk-keys::deriveProductAccountPublicKey`.
@@ -18,57 +21,43 @@ import 'polkadot-api';
  * The alias is deterministically derived using:
  * aliasPublicKey = blake2b256(parentPublicKey || context)
  *
+ * @deprecated Returns addresses that no key can spend. The alias public key is a
+ *   blake2b-256 hash rather than a derived key, so no secret corresponds to the
+ *   SS58 address or to the H160: both can receive value and neither can ever
+ *   send it. Removal: `@parity/product-sdk` 0.23.0. Replace by intent:
+ *
+ *   - An account that holds or spends value:
+ *     `SignerManager.getProductAccount(dotNsIdentifier, index)` from
+ *     `@parity/product-sdk-signer`. Host-backed and actually signable.
+ *   - The address offline, with no host: `deriveProductAccountPublicKey` from
+ *     `@parity/product-sdk-keys`, the canonical sr25519 soft derivation.
+ *   - An unlinkable per-context alias: select a registered ring-VRF key, then call
+ *     `SignerManager.getProductAccountAlias(keyHandle, context, location)` or
+ *     `createRingVRFProof(keyHandle, context, location, message)`.
+ *   - A context-scoped identifier, never used as an account: `blake2b256` from
+ *     `@parity/product-sdk/crypto`. Same bytes, without address packaging that
+ *     invites the mistake.
+ *
  * @param parentAddress - Parent account SS58 address
  * @param context - Context string for derivation (e.g. an app id or scope label)
  * @param ss58Prefix - SS58 prefix (default: 42)
  * @returns Context alias info
- *
- * @example
- * ```ts
- * const alias = deriveContextAlias(
- *   '5GrwvaEF5zXb26Fz9rcQpDWS57CtERHpNehXCPcNoHGKutQY',
- *   'voting-round-1'
- * );
- * console.log('Alias address:', alias.address);
- * ```
  */
 declare function deriveContextAlias(parentAddress: string, context: string, ss58Prefix?: number): ContextAliasInfo;
 /**
  * Verify that a context alias was derived from a parent account.
  *
+ * @deprecated Recomputes {@link deriveContextAlias} from two public values and
+ *   compares the result, so it confirms a derivation relationship and nothing
+ *   more. No secret enters the operation at any point, which means there is
+ *   nothing here to authenticate: a passing result does not show that anyone
+ *   controls either account. Removal: `@parity/product-sdk` 0.23.0.
+ *
  * @param aliasAddress - Context alias SS58 address
  * @param parentAddress - Claimed parent address
  * @param context - Context string used for derivation
  * @returns True if derivation is valid
  */
 declare function verifyContextAlias(aliasAddress: string, parentAddress: string, context: string): boolean;
-/**
- * Derive an anonymous alias using Ring VRF
- *
- * This creates a context-specific alias that cannot be linked
- * back to the original identity without the ring proof.
- *
- * @param context - Context for alias derivation (e.g., "voting-round-1")
- * @param ringLocation - Ring location for proof generation
- * @returns Anonymous alias info
- */
-declare function deriveAnonymousAlias(context: string, ringLocation: RingLocation): AnonymousAliasInfo;
-/**
- * Create a Ring VRF proof for a message
- *
- * @param message - Message to prove
- * @param ringLocation - Ring location
- * @returns Proof bytes
- */
-declare function createRingProof(message: Uint8Array, ringLocation: RingLocation): Promise<Uint8Array>;
-/**
- * Verify a Ring VRF proof
- *
- * @param message - Original message
- * @param proof - Proof bytes
- * @param alias - Expected alias
- * @returns True if proof is valid
- */
-declare function verifyRingProof(message: Uint8Array, proof: Uint8Array, alias: string): Promise<boolean>;
 
-export { AnonymousAliasInfo, ContextAliasInfo, RingLocation, createRingProof, deriveAnonymousAlias, deriveContextAlias, verifyContextAlias, verifyRingProof };
+export { ContextAliasInfo, deriveContextAlias, verifyContextAlias };

package/dist/identity/index.js

@@ -39,25 +39,7 @@ function verifyContextAlias(aliasAddress, parentAddress, context) {
     return false;
   }
 }
-function deriveAnonymousAlias(context, ringLocation) {
-  log.debug("Deriving anonymous alias", { context, ringLocation });
-  throw new Error(
-    "deriveAnonymousAlias() is not yet implemented. This requires container mode with Ring VRF support."
-  );
-}
-async function createRingProof(message, ringLocation) {
-  log.debug("Creating ring proof", { ringLocation });
-  throw new Error(
-    "createRingProof() is not yet implemented. This requires container mode with Ring VRF support."
-  );
-}
-async function verifyRingProof(message, proof, alias) {
-  log.debug("Verifying ring proof");
-  throw new Error(
-    "verifyRingProof() is not yet implemented. This requires container mode with Ring VRF support."
-  );
-}
 
-export { createRingProof, deriveAnonymousAlias, deriveContextAlias, verifyContextAlias, verifyRingProof };
+export { deriveContextAlias, verifyContextAlias };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/identity/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/identity/product-account.ts"],"names":[],"mappings":";;;;;AAiBA,IAAM,GAAA,GAAM,aAAa,UAAU,CAAA;AAsB5B,SAAS,kBAAA,CACZ,aAAA,EACA,OAAA,EACA,UAAA,GAAa,EAAA,EACG;AAChB,EAAA,MAAM,EAAE,SAAA,EAAW,eAAA,EAAgB,GAAI,WAAW,aAAa,CAAA;AAG/D,EAAA,MAAM,YAAA,GAAe,IAAI,WAAA,EAAY,CAAE,OAAO,OAAO,CAAA;AACrD,EAAA,MAAM,WAAW,IAAI,UAAA,CAAW,eAAA,CAAgB,MAAA,GAAS,aAAa,MAAM,CAAA;AAC5E,EAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,CAAC,CAAA;AAC/B,EAAA,QAAA,CAAS,GAAA,CAAI,YAAA,EAAc,eAAA,CAAgB,MAAM,CAAA;AAEjD,EAAA,MAAM,cAAA,GAAiB,WAAW,QAAQ,CAAA;AAC1C,EAAA,MAAM,OAAA,GAAU,UAAA,CAAW,cAAA,EAAgB,UAAU,CAAA;AACrD,EAAA,MAAM,WAAA,GAAc,WAAW,cAAc,CAAA;AAE7C,EAAA,GAAA,CAAI,MAAM,uBAAA,EAAyB;AAAA,IAC/B,aAAA;AAAA,IACA,OAAA;AAAA,IACA;AAAA,GACH,CAAA;AAED,EAAA,OAAO;AAAA,IACH,OAAA;AAAA,IACA,WAAA;AAAA,IACA,aAAA;AAAA,IACA;AAAA,GACJ;AACJ;AAUO,SAAS,kBAAA,CACZ,YAAA,EACA,aAAA,EACA,OAAA,EACO;AACP,EAAA,IAAI;AACA,IAAA,MAAM,OAAA,GAAU,kBAAA,CAAmB,aAAA,EAAe,OAAO,CAAA;AACzD,IAAA,MAAM,EAAE,SAAA,EAAW,QAAA,EAAS,GAAI,WAAW,YAAY,CAAA;AACvD,IAAA,MAAM,EAAE,SAAA,EAAW,UAAA,EAAW,GAAI,UAAA,CAAW,QAAQ,OAAO,CAAA;AAG5D,IAAA,IAAI,QAAA,CAAS,MAAA,KAAW,UAAA,CAAW,MAAA,EAAQ,OAAO,KAAA;AAClD,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,QAAA,CAAS,QAAQ,CAAA,EAAA,EAAK;AACtC,MAAA,IAAI,SAAS,CAAC,CAAA,KAAM,UAAA,CAAW,CAAC,GAAG,OAAO,KAAA;AAAA,IAC9C;AACA,IAAA,OAAO,IAAA;AAAA,EACX,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,KAAA;AAAA,EACX;AACJ;AAYO,SAAS,oBAAA,CACZ,SACA,YAAA,EACkB;AAClB,EAAA,GAAA,CAAI,KAAA,CAAM,0BAAA,EAA4B,EAAE,OAAA,EAAS,cAAc,CAAA;AAI/D,EAAA,MAAM,IAAI,KAAA;AAAA,IACN;AAAA,GAEJ;AACJ;AASA,eAAsB,eAAA,CAClB,SACA,YAAA,EACmB;AACnB,EAAA,GAAA,CAAI,KAAA,CAAM,qBAAA,EAAuB,EAAE,YAAA,EAAc,CAAA;AAGjD,EAAA,MAAM,IAAI,KAAA;AAAA,IACN;AAAA,GAEJ;AACJ;AAUA,eAAsB,eAAA,CAClB,OAAA,EACA,KAAA,EACA,KAAA,EACgB;AAChB,EAAA,GAAA,CAAI,MAAM,sBAAsB,CAAA;AAGhC,EAAA,MAAM,IAAI,KAAA;AAAA,IACN;AAAA,GAEJ;AACJ","file":"index.js","sourcesContent":["// Copyright 2026 Parity Technologies (UK) Ltd.\n// SPDX-License-Identifier: Apache-2.0\n/**\n * Context alias derivation\n *\n * Derives a deterministic, context-bound alias from a parent account using blake2b-256.\n *\n * NOTE: this is NOT the canonical sr25519 product-account derivation used by\n * mobile, desktop, and dotli hosts. For that, use\n * `@parity/product-sdk-keys::deriveProductAccountPublicKey`.\n */\n\nimport { createLogger } from \"@parity/product-sdk-logger\";\nimport { blake2b256 } from \"@parity/product-sdk-crypto\";\nimport { ss58Encode, ss58Decode, deriveH160 } from \"@parity/product-sdk-address\";\nimport type { ContextAliasInfo, AnonymousAliasInfo, RingLocation } from \"./types.js\";\n\nconst log = createLogger(\"identity\");\n\n/**\n * Derive a context-bound alias from a parent account.\n *\n * The alias is deterministically derived using:\n * aliasPublicKey = blake2b256(parentPublicKey || context)\n *\n * @param parentAddress - Parent account SS58 address\n * @param context - Context string for derivation (e.g. an app id or scope label)\n * @param ss58Prefix - SS58 prefix (default: 42)\n * @returns Context alias info\n *\n * @example\n * ```ts\n * const alias = deriveContextAlias(\n *   '5GrwvaEF5zXb26Fz9rcQpDWS57CtERHpNehXCPcNoHGKutQY',\n *   'voting-round-1'\n * );\n * console.log('Alias address:', alias.address);\n * ```\n */\nexport function deriveContextAlias(\n    parentAddress: string,\n    context: string,\n    ss58Prefix = 42,\n): ContextAliasInfo {\n    const { publicKey: parentPublicKey } = ss58Decode(parentAddress);\n\n    // Derive alias public key: blake2b-256(parentPublicKey || context)\n    const contextBytes = new TextEncoder().encode(context);\n    const combined = new Uint8Array(parentPublicKey.length + contextBytes.length);\n    combined.set(parentPublicKey, 0);\n    combined.set(contextBytes, parentPublicKey.length);\n\n    const aliasPublicKey = blake2b256(combined);\n    const address = ss58Encode(aliasPublicKey, ss58Prefix);\n    const h160Address = deriveH160(aliasPublicKey);\n\n    log.debug(\"Derived context alias\", {\n        parentAddress,\n        context,\n        address,\n    });\n\n    return {\n        address,\n        h160Address,\n        parentAddress,\n        context,\n    };\n}\n\n/**\n * Verify that a context alias was derived from a parent account.\n *\n * @param aliasAddress - Context alias SS58 address\n * @param parentAddress - Claimed parent address\n * @param context - Context string used for derivation\n * @returns True if derivation is valid\n */\nexport function verifyContextAlias(\n    aliasAddress: string,\n    parentAddress: string,\n    context: string,\n): boolean {\n    try {\n        const derived = deriveContextAlias(parentAddress, context);\n        const { publicKey: aliasKey } = ss58Decode(aliasAddress);\n        const { publicKey: derivedKey } = ss58Decode(derived.address);\n\n        // Compare public keys\n        if (aliasKey.length !== derivedKey.length) return false;\n        for (let i = 0; i < aliasKey.length; i++) {\n            if (aliasKey[i] !== derivedKey[i]) return false;\n        }\n        return true;\n    } catch {\n        return false;\n    }\n}\n\n/**\n * Derive an anonymous alias using Ring VRF\n *\n * This creates a context-specific alias that cannot be linked\n * back to the original identity without the ring proof.\n *\n * @param context - Context for alias derivation (e.g., \"voting-round-1\")\n * @param ringLocation - Ring location for proof generation\n * @returns Anonymous alias info\n */\nexport function deriveAnonymousAlias(\n    context: string,\n    ringLocation: RingLocation,\n): AnonymousAliasInfo {\n    log.debug(\"Deriving anonymous alias\", { context, ringLocation });\n\n    // TODO: Implement Ring VRF alias derivation\n    // This requires the Ring VRF implementation from TruAPI\n    throw new Error(\n        \"deriveAnonymousAlias() is not yet implemented. \" +\n            \"This requires container mode with Ring VRF support.\",\n    );\n}\n\n/**\n * Create a Ring VRF proof for a message\n *\n * @param message - Message to prove\n * @param ringLocation - Ring location\n * @returns Proof bytes\n */\nexport async function createRingProof(\n    message: Uint8Array,\n    ringLocation: RingLocation,\n): Promise<Uint8Array> {\n    log.debug(\"Creating ring proof\", { ringLocation });\n\n    // TODO: Implement Ring VRF proof creation via TruAPI\n    throw new Error(\n        \"createRingProof() is not yet implemented. \" +\n            \"This requires container mode with Ring VRF support.\",\n    );\n}\n\n/**\n * Verify a Ring VRF proof\n *\n * @param message - Original message\n * @param proof - Proof bytes\n * @param alias - Expected alias\n * @returns True if proof is valid\n */\nexport async function verifyRingProof(\n    message: Uint8Array,\n    proof: Uint8Array,\n    alias: string,\n): Promise<boolean> {\n    log.debug(\"Verifying ring proof\");\n\n    // TODO: Implement Ring VRF proof verification\n    throw new Error(\n        \"verifyRingProof() is not yet implemented. \" +\n            \"This requires container mode with Ring VRF support.\",\n    );\n}\n"]}
+{"version":3,"sources":["../../src/identity/product-account.ts"],"names":[],"mappings":";;;;;AAoBA,IAAM,GAAA,GAAM,aAAa,UAAU,CAAA;AA8B5B,SAAS,kBAAA,CACZ,aAAA,EACA,OAAA,EACA,UAAA,GAAa,EAAA,EACG;AAChB,EAAA,MAAM,EAAE,SAAA,EAAW,eAAA,EAAgB,GAAI,WAAW,aAAa,CAAA;AAG/D,EAAA,MAAM,YAAA,GAAe,IAAI,WAAA,EAAY,CAAE,OAAO,OAAO,CAAA;AACrD,EAAA,MAAM,WAAW,IAAI,UAAA,CAAW,eAAA,CAAgB,MAAA,GAAS,aAAa,MAAM,CAAA;AAC5E,EAAA,QAAA,CAAS,GAAA,CAAI,iBAAiB,CAAC,CAAA;AAC/B,EAAA,QAAA,CAAS,GAAA,CAAI,YAAA,EAAc,eAAA,CAAgB,MAAM,CAAA;AAEjD,EAAA,MAAM,cAAA,GAAiB,WAAW,QAAQ,CAAA;AAC1C,EAAA,MAAM,OAAA,GAAU,UAAA,CAAW,cAAA,EAAgB,UAAU,CAAA;AACrD,EAAA,MAAM,WAAA,GAAc,WAAW,cAAc,CAAA;AAE7C,EAAA,GAAA,CAAI,MAAM,uBAAA,EAAyB;AAAA,IAC/B,aAAA;AAAA,IACA,OAAA;AAAA,IACA;AAAA,GACH,CAAA;AAED,EAAA,OAAO;AAAA,IACH,OAAA;AAAA,IACA,WAAA;AAAA,IACA,aAAA;AAAA,IACA;AAAA,GACJ;AACJ;AAgBO,SAAS,kBAAA,CACZ,YAAA,EACA,aAAA,EACA,OAAA,EACO;AACP,EAAA,IAAI;AACA,IAAA,MAAM,OAAA,GAAU,kBAAA,CAAmB,aAAA,EAAe,OAAO,CAAA;AACzD,IAAA,MAAM,EAAE,SAAA,EAAW,QAAA,EAAS,GAAI,WAAW,YAAY,CAAA;AACvD,IAAA,MAAM,EAAE,SAAA,EAAW,UAAA,EAAW,GAAI,UAAA,CAAW,QAAQ,OAAO,CAAA;AAG5D,IAAA,IAAI,QAAA,CAAS,MAAA,KAAW,UAAA,CAAW,MAAA,EAAQ,OAAO,KAAA;AAClD,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,QAAA,CAAS,QAAQ,CAAA,EAAA,EAAK;AACtC,MAAA,IAAI,SAAS,CAAC,CAAA,KAAM,UAAA,CAAW,CAAC,GAAG,OAAO,KAAA;AAAA,IAC9C;AACA,IAAA,OAAO,IAAA;AAAA,EACX,CAAA,CAAA,MAAQ;AACJ,IAAA,OAAO,KAAA;AAAA,EACX;AACJ","file":"index.js","sourcesContent":["// Copyright 2026 Parity Technologies (UK) Ltd.\n// SPDX-License-Identifier: Apache-2.0\n/**\n * Context alias derivation (deprecated, removal in 0.23.0)\n *\n * Derives a deterministic, context-bound alias from a parent account using blake2b-256.\n *\n * The output is a hash, not a key, so no signing key exists for the addresses\n * returned here. See the notes on each function for what to use instead.\n *\n * NOTE: this is NOT the canonical sr25519 product-account derivation used by\n * mobile, desktop, and dotli hosts. For that, use\n * `@parity/product-sdk-keys::deriveProductAccountPublicKey`.\n */\n\nimport { createLogger } from \"@parity/product-sdk-logger\";\nimport { blake2b256 } from \"@parity/product-sdk-crypto\";\nimport { ss58Encode, ss58Decode, deriveH160 } from \"@parity/product-sdk-address\";\nimport type { ContextAliasInfo } from \"./types.js\";\n\nconst log = createLogger(\"identity\");\n\n/**\n * Derive a context-bound alias from a parent account.\n *\n * The alias is deterministically derived using:\n * aliasPublicKey = blake2b256(parentPublicKey || context)\n *\n * @deprecated Returns addresses that no key can spend. The alias public key is a\n *   blake2b-256 hash rather than a derived key, so no secret corresponds to the\n *   SS58 address or to the H160: both can receive value and neither can ever\n *   send it. Removal: `@parity/product-sdk` 0.23.0. Replace by intent:\n *\n *   - An account that holds or spends value:\n *     `SignerManager.getProductAccount(dotNsIdentifier, index)` from\n *     `@parity/product-sdk-signer`. Host-backed and actually signable.\n *   - The address offline, with no host: `deriveProductAccountPublicKey` from\n *     `@parity/product-sdk-keys`, the canonical sr25519 soft derivation.\n *   - An unlinkable per-context alias: select a registered ring-VRF key, then call\n *     `SignerManager.getProductAccountAlias(keyHandle, context, location)` or\n *     `createRingVRFProof(keyHandle, context, location, message)`.\n *   - A context-scoped identifier, never used as an account: `blake2b256` from\n *     `@parity/product-sdk/crypto`. Same bytes, without address packaging that\n *     invites the mistake.\n *\n * @param parentAddress - Parent account SS58 address\n * @param context - Context string for derivation (e.g. an app id or scope label)\n * @param ss58Prefix - SS58 prefix (default: 42)\n * @returns Context alias info\n */\nexport function deriveContextAlias(\n    parentAddress: string,\n    context: string,\n    ss58Prefix = 42,\n): ContextAliasInfo {\n    const { publicKey: parentPublicKey } = ss58Decode(parentAddress);\n\n    // Derive alias public key: blake2b-256(parentPublicKey || context)\n    const contextBytes = new TextEncoder().encode(context);\n    const combined = new Uint8Array(parentPublicKey.length + contextBytes.length);\n    combined.set(parentPublicKey, 0);\n    combined.set(contextBytes, parentPublicKey.length);\n\n    const aliasPublicKey = blake2b256(combined);\n    const address = ss58Encode(aliasPublicKey, ss58Prefix);\n    const h160Address = deriveH160(aliasPublicKey);\n\n    log.debug(\"Derived context alias\", {\n        parentAddress,\n        context,\n        address,\n    });\n\n    return {\n        address,\n        h160Address,\n        parentAddress,\n        context,\n    };\n}\n\n/**\n * Verify that a context alias was derived from a parent account.\n *\n * @deprecated Recomputes {@link deriveContextAlias} from two public values and\n *   compares the result, so it confirms a derivation relationship and nothing\n *   more. No secret enters the operation at any point, which means there is\n *   nothing here to authenticate: a passing result does not show that anyone\n *   controls either account. Removal: `@parity/product-sdk` 0.23.0.\n *\n * @param aliasAddress - Context alias SS58 address\n * @param parentAddress - Claimed parent address\n * @param context - Context string used for derivation\n * @returns True if derivation is valid\n */\nexport function verifyContextAlias(\n    aliasAddress: string,\n    parentAddress: string,\n    context: string,\n): boolean {\n    try {\n        const derived = deriveContextAlias(parentAddress, context);\n        const { publicKey: aliasKey } = ss58Decode(aliasAddress);\n        const { publicKey: derivedKey } = ss58Decode(derived.address);\n\n        // Compare public keys\n        if (aliasKey.length !== derivedKey.length) return false;\n        for (let i = 0; i < aliasKey.length; i++) {\n            if (aliasKey[i] !== derivedKey[i]) return false;\n        }\n        return true;\n    } catch {\n        return false;\n    }\n}\n"]}

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export { LogEntry, LogHandler, LogLevel, Logger, LoggerConfig, configure, createLogger } from '@parity/product-sdk-logger';
-import { c as AppConfig, b as App } from './types-CztPAgZT.js';
-export { A as Account, C as ChainApi, a as CloudStorageApi, D as DotNsIdentitySignature, L as LocalStorageApi, S as SignMessageWithDotNsIdentityArgs, W as WalletApi } from './types-CztPAgZT.js';
+import { c as AppConfig, b as App } from './types-DTgyMIi0.js';
+export { A as Account, C as ChainApi, a as CloudStorageApi, D as DotNsIdentitySignature, L as LocalStorageApi, S as SignMessageWithDotNsIdentityArgs, W as WalletApi } from './types-DTgyMIi0.js';
 export { Result, err, isErrorOf, ok } from '@parity/result';
 export { SdkError, isSdkError } from '@parity/product-sdk-errors';
 export { isInsideContainer, isInsideContainerSync } from '@parity/product-sdk-host';
@@ -9,7 +9,7 @@ export { SignerManager } from '@parity/product-sdk-signer';
 export { createLocalKvStore } from '@parity/product-sdk-local-storage';
 export { CloudStorageClient, calculateCid } from '@parity/product-sdk-cloud-storage';
 export { ChainDefinition, PolkadotClient, TypedApi } from 'polkadot-api';
-import './dotns-hLSvmo6u.js';
+import './dotns-DIaptENj.js';
 
 /**
  * createApp - Main entry point for the Product SDK

package/dist/individuality/index.d.ts

@@ -0,0 +1 @@
+export * from '@parity/product-sdk-individuality';

package/dist/individuality/index.js

@@ -0,0 +1,3 @@
+export * from '@parity/product-sdk-individuality';
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/individuality/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.js","sourcesContent":[]}

package/dist/react/index.d.ts

@@ -2,12 +2,12 @@ import * as react_jsx_runtime from 'react/jsx-runtime';
 import * as react from 'react';
 import { ReactNode } from 'react';
 import { LogLevel } from '@parity/product-sdk-logger';
-import { b as App, S as SignMessageWithDotNsIdentityArgs, D as DotNsIdentitySignature, A as Account } from '../types-CztPAgZT.js';
+import { b as App, S as SignMessageWithDotNsIdentityArgs, D as DotNsIdentitySignature, A as Account } from '../types-DTgyMIi0.js';
 import { ChainDefinition, TypedApi } from 'polkadot-api';
 import '@parity/product-sdk-cloud-storage';
 import '@parity/result';
 import '@parity/product-sdk-chain-client';
-import '../dotns-hLSvmo6u.js';
+import '../dotns-DIaptENj.js';
 
 /** Props for ProductSDKProvider */
 interface ProductSDKProviderProps {

package/dist/testing/index.d.ts

@@ -1,4 +1,4 @@
-import { A as Account, L as LocalStorageApi, C as ChainApi, a as CloudStorageApi, b as App } from '../types-CztPAgZT.js';
+import { A as Account, L as LocalStorageApi, C as ChainApi, a as CloudStorageApi, b as App } from '../types-DTgyMIi0.js';
 export * from '@parity/product-sdk-local-storage/testing';
 export * from '@parity/product-sdk-signer/testing';
 export * from '@parity/product-sdk-contracts/testing';
@@ -7,7 +7,7 @@ import '@parity/product-sdk-logger';
 import '@parity/product-sdk-cloud-storage';
 import '@parity/result';
 import '@parity/product-sdk-chain-client';
-import '../dotns-hLSvmo6u.js';
+import '../dotns-DIaptENj.js';
 import 'polkadot-api';
 
 /** Configurable behavior for the fake {@link WalletApi}. */

package/dist/{types-CztPAgZT.d.ts → types-DTgyMIi0.d.ts}

@@ -2,7 +2,7 @@ import { LogLevel } from '@parity/product-sdk-logger';
 import { ProductCloudStorageError, CloudStorageEnvironment } from '@parity/product-sdk-cloud-storage';
 import { Result } from '@parity/result';
 import { ChainClient } from '@parity/product-sdk-chain-client';
-import { P as PeopleUsernameChain } from './dotns-hLSvmo6u.js';
+import { P as PeopleUsernameChain } from './dotns-DIaptENj.js';
 import { ChainDefinition, TypedApi, PolkadotClient } from 'polkadot-api';
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@parity/product-sdk",
-  "version": "0.20.1",
+  "version": "0.22.0",
   "description": "Unified SDK for building products in the Polkadot ecosystem - umbrella package",
   "type": "module",
   "sideEffects": false,
@@ -44,6 +44,10 @@
       "import": "./dist/identity/index.js",
       "types": "./dist/identity/index.d.ts"
     },
+    "./individuality": {
+      "import": "./dist/individuality/index.js",
+      "types": "./dist/individuality/index.d.ts"
+    },
     "./react": {
       "import": "./dist/react/index.js",
       "types": "./dist/react/index.d.ts"
@@ -67,19 +71,20 @@
   ],
   "dependencies": {
     "polkadot-api": "^2.1.6",
-    "@parity/product-sdk-cloud-storage": "0.9.1",
-    "@parity/product-sdk-chain-client": "0.9.3",
-    "@parity/product-sdk-contracts": "0.10.1",
-    "@parity/product-sdk-crypto": "0.1.1",
     "@parity/product-sdk-address": "0.1.1",
-    "@parity/product-sdk-host": "0.15.1",
+    "@parity/product-sdk-cloud-storage": "0.10.1",
+    "@parity/product-sdk-contracts": "0.10.2",
+    "@parity/product-sdk-chain-client": "0.11.0",
+    "@parity/product-sdk-crypto": "0.1.1",
+    "@parity/product-sdk-host": "0.16.0",
+    "@parity/product-sdk-individuality": "0.1.0",
+    "@parity/product-sdk-keys": "0.3.19",
     "@parity/product-sdk-logger": "0.1.1",
-    "@parity/product-sdk-keys": "0.3.18",
-    "@parity/result": "0.2.0",
-    "@parity/product-sdk-local-storage": "0.3.4",
-    "@parity/product-sdk-tx": "0.4.1",
     "@parity/product-sdk-errors": "0.2.0",
-    "@parity/product-sdk-signer": "0.12.1"
+    "@parity/result": "0.2.0",
+    "@parity/product-sdk-signer": "0.13.0",
+    "@parity/product-sdk-tx": "0.4.2",
+    "@parity/product-sdk-local-storage": "0.3.5"
   },
   "peerDependencies": {
     "react": "^18.0.0 || ^19.0.0"

package/src/identity/index.ts

@@ -3,8 +3,12 @@
 /**
  * @parity/product-sdk/identity
  *
- * Identity utilities: DotNS name resolution, context-alias derivation,
- * and Ring VRF anonymous aliases.
+ * Identity utilities: DotNS name resolution, plus the deprecated context-alias
+ * helpers.
+ *
+ * For real Ring VRF aliases and proofs, use `SignerManager`'s
+ * `getProductAccountAlias` and `createRingVRFProof` from
+ * `@parity/product-sdk-signer`.
  */
 
 // DotNS utilities
@@ -19,21 +23,13 @@ export {
 } from "./dotns.js";
 export type { PeopleUsernameChain, PeopleUsernameQueryApi } from "./dotns.js";
 
-// Context alias utilities
-export {
-    deriveContextAlias,
-    verifyContextAlias,
-    deriveAnonymousAlias,
-    createRingProof,
-    verifyRingProof,
-} from "./product-account.js";
+// Context alias utilities (deprecated)
+export { deriveContextAlias, verifyContextAlias } from "./product-account.js";
 
 // Types
 export type {
     DotNsRecord,
     ContextAliasInfo,
-    AnonymousAliasInfo,
-    RingLocation,
     VerificationResult,
     OnChainIdentity,
 } from "./types.js";

package/src/identity/product-account.test.ts

@@ -0,0 +1,129 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Frozen vectors for the deprecated context-alias helpers.
+ *
+ * These pin current behaviour so the deprecation cannot silently alter the
+ * derivation. Never re-derive: a caller may use the value as a plain
+ * identifier, where different output bytes would be a silent break.
+ */
+import { ss58Decode, ss58Encode } from "@parity/product-sdk-address";
+import { blake2b256 } from "@parity/product-sdk-crypto";
+import { describe, expect, it } from "vitest";
+import * as identity from "./index.js";
+import { deriveContextAlias, verifyContextAlias } from "./product-account.js";
+
+const ALICE = "5GrwvaEF5zXb26Fz9rcQpDWS57CtERHpNehXCPcNoHGKutQY";
+const CONTEXT = "voting-round-1";
+
+/** Recomputes the documented formula from primitives, independent of the implementation. */
+function expectedAliasPublicKey(parentAddress: string, context: string): Uint8Array {
+    const { publicKey } = ss58Decode(parentAddress);
+    const contextBytes = new TextEncoder().encode(context);
+    const combined = new Uint8Array(publicKey.length + contextBytes.length);
+    combined.set(publicKey, 0);
+    combined.set(contextBytes, publicKey.length);
+    return blake2b256(combined);
+}
+
+describe("deriveContextAlias", () => {
+    it("returns blake2b256(parentPublicKey || context), encoded at the given prefix", () => {
+        const alias = deriveContextAlias(ALICE, CONTEXT);
+        const expected = expectedAliasPublicKey(ALICE, CONTEXT);
+
+        expect(alias.address).toBe(ss58Encode(expected, 42));
+    });
+
+    it("matches a frozen vector for a known parent and context", () => {
+        const alias = deriveContextAlias(ALICE, CONTEXT);
+
+        expect(alias.address).toBe("5GPTdhxkG9wNKhCSN1vZrCwrf3fwvAf4j487vqrkVzvRMH6F");
+        expect(alias.h160Address).toBe("0x93d10a91de267ba79b27fbec373e5a3b2e86a283");
+        expect(alias.parentAddress).toBe(ALICE);
+        expect(alias.context).toBe(CONTEXT);
+    });
+
+    it("defaults to ss58 prefix 42", () => {
+        expect(deriveContextAlias(ALICE, CONTEXT).address).toBe(
+            deriveContextAlias(ALICE, CONTEXT, 42).address,
+        );
+    });
+
+    it("changes only the encoding when the ss58 prefix changes, not the key", () => {
+        const at42 = deriveContextAlias(ALICE, CONTEXT, 42);
+        const at0 = deriveContextAlias(ALICE, CONTEXT, 0);
+
+        expect(at0.address).not.toBe(at42.address);
+        expect(Array.from(ss58Decode(at0.address).publicKey)).toEqual(
+            Array.from(ss58Decode(at42.address).publicKey),
+        );
+    });
+
+    it("derives a different alias for a different context", () => {
+        expect(deriveContextAlias(ALICE, "round-1").address).not.toBe(
+            deriveContextAlias(ALICE, "round-2").address,
+        );
+    });
+});
+
+describe("verifyContextAlias", () => {
+    it("accepts an alias derived from the same parent and context", () => {
+        const alias = deriveContextAlias(ALICE, CONTEXT);
+
+        expect(verifyContextAlias(alias.address, ALICE, CONTEXT)).toBe(true);
+    });
+
+    it("rejects a different context", () => {
+        const alias = deriveContextAlias(ALICE, CONTEXT);
+
+        expect(verifyContextAlias(alias.address, ALICE, "voting-round-2")).toBe(false);
+    });
+
+    it("rejects a different parent", () => {
+        const alias = deriveContextAlias(ALICE, CONTEXT);
+        const bob = "5FHneW46xGXgs5mUiveU4sbTyGBzmstUspZC92UhjJM694ty";
+
+        expect(verifyContextAlias(alias.address, bob, CONTEXT)).toBe(false);
+    });
+
+    it("returns false rather than throwing on an undecodable address", () => {
+        expect(verifyContextAlias("not-an-address", ALICE, CONTEXT)).toBe(false);
+    });
+
+    // Guards the byte-level comparison: `addressesEqual` from
+    // @parity/product-sdk-address compares SS58 strings exactly and would
+    // return false here, silently narrowing behaviour.
+    it("compares public keys, so it accepts an alias encoded at another prefix", () => {
+        const alias = deriveContextAlias(ALICE, CONTEXT, 42);
+        const reencoded = ss58Encode(ss58Decode(alias.address).publicKey, 0);
+
+        expect(reencoded).not.toBe(alias.address);
+        expect(verifyContextAlias(reencoded, ALICE, CONTEXT)).toBe(true);
+    });
+});
+
+describe("the identity export surface", () => {
+    // These threw on every call, so no working consumer could exist. Deleting
+    // turns a guaranteed runtime throw into a compile error.
+    it("no longer exports the unimplemented ring helpers", () => {
+        for (const name of ["deriveAnonymousAlias", "createRingProof", "verifyRingProof"]) {
+            expect(name in identity).toBe(false);
+        }
+    });
+
+    it("still exports the DotNS helpers and the deprecated context-alias pair", () => {
+        for (const name of [
+            "resolveDotNs",
+            "reverseDotNs",
+            "isDotNsAvailable",
+            "resolvePeopleUsernameOwner",
+            "isValidDotNsName",
+            "normalizeDotNsName",
+            "accountIdHexToBytes",
+            "deriveContextAlias",
+            "verifyContextAlias",
+        ]) {
+            expect(name in identity).toBe(true);
+        }
+    });
+});

package/src/identity/product-account.ts

@@ -1,10 +1,13 @@
 // Copyright 2026 Parity Technologies (UK) Ltd.
 // SPDX-License-Identifier: Apache-2.0
 /**
- * Context alias derivation
+ * Context alias derivation (deprecated, removal in 0.23.0)
  *
  * Derives a deterministic, context-bound alias from a parent account using blake2b-256.
  *
+ * The output is a hash, not a key, so no signing key exists for the addresses
+ * returned here. See the notes on each function for what to use instead.
+ *
  * NOTE: this is NOT the canonical sr25519 product-account derivation used by
  * mobile, desktop, and dotli hosts. For that, use
  * `@parity/product-sdk-keys::deriveProductAccountPublicKey`.
@@ -13,7 +16,7 @@
 import { createLogger } from "@parity/product-sdk-logger";
 import { blake2b256 } from "@parity/product-sdk-crypto";
 import { ss58Encode, ss58Decode, deriveH160 } from "@parity/product-sdk-address";
-import type { ContextAliasInfo, AnonymousAliasInfo, RingLocation } from "./types.js";
+import type { ContextAliasInfo } from "./types.js";
 
 const log = createLogger("identity");
 
@@ -23,19 +26,27 @@ const log = createLogger("identity");
  * The alias is deterministically derived using:
  * aliasPublicKey = blake2b256(parentPublicKey || context)
  *
+ * @deprecated Returns addresses that no key can spend. The alias public key is a
+ *   blake2b-256 hash rather than a derived key, so no secret corresponds to the
+ *   SS58 address or to the H160: both can receive value and neither can ever
+ *   send it. Removal: `@parity/product-sdk` 0.23.0. Replace by intent:
+ *
+ *   - An account that holds or spends value:
+ *     `SignerManager.getProductAccount(dotNsIdentifier, index)` from
+ *     `@parity/product-sdk-signer`. Host-backed and actually signable.
+ *   - The address offline, with no host: `deriveProductAccountPublicKey` from
+ *     `@parity/product-sdk-keys`, the canonical sr25519 soft derivation.
+ *   - An unlinkable per-context alias: select a registered ring-VRF key, then call
+ *     `SignerManager.getProductAccountAlias(keyHandle, context, location)` or
+ *     `createRingVRFProof(keyHandle, context, location, message)`.
+ *   - A context-scoped identifier, never used as an account: `blake2b256` from
+ *     `@parity/product-sdk/crypto`. Same bytes, without address packaging that
+ *     invites the mistake.
+ *
  * @param parentAddress - Parent account SS58 address
  * @param context - Context string for derivation (e.g. an app id or scope label)
  * @param ss58Prefix - SS58 prefix (default: 42)
  * @returns Context alias info
- *
- * @example
- * ```ts
- * const alias = deriveContextAlias(
- *   '5GrwvaEF5zXb26Fz9rcQpDWS57CtERHpNehXCPcNoHGKutQY',
- *   'voting-round-1'
- * );
- * console.log('Alias address:', alias.address);
- * ```
  */
 export function deriveContextAlias(
     parentAddress: string,
@@ -71,6 +82,12 @@ export function deriveContextAlias(
 /**
  * Verify that a context alias was derived from a parent account.
  *
+ * @deprecated Recomputes {@link deriveContextAlias} from two public values and
+ *   compares the result, so it confirms a derivation relationship and nothing
+ *   more. No secret enters the operation at any point, which means there is
+ *   nothing here to authenticate: a passing result does not show that anyone
+ *   controls either account. Removal: `@parity/product-sdk` 0.23.0.
+ *
  * @param aliasAddress - Context alias SS58 address
  * @param parentAddress - Claimed parent address
  * @param context - Context string used for derivation
@@ -96,69 +113,3 @@ export function verifyContextAlias(
         return false;
     }
 }
-
-/**
- * Derive an anonymous alias using Ring VRF
- *
- * This creates a context-specific alias that cannot be linked
- * back to the original identity without the ring proof.
- *
- * @param context - Context for alias derivation (e.g., "voting-round-1")
- * @param ringLocation - Ring location for proof generation
- * @returns Anonymous alias info
- */
-export function deriveAnonymousAlias(
-    context: string,
-    ringLocation: RingLocation,
-): AnonymousAliasInfo {
-    log.debug("Deriving anonymous alias", { context, ringLocation });
-
-    // TODO: Implement Ring VRF alias derivation
-    // This requires the Ring VRF implementation from TruAPI
-    throw new Error(
-        "deriveAnonymousAlias() is not yet implemented. " +
-            "This requires container mode with Ring VRF support.",
-    );
-}
-
-/**
- * Create a Ring VRF proof for a message
- *
- * @param message - Message to prove
- * @param ringLocation - Ring location
- * @returns Proof bytes
- */
-export async function createRingProof(
-    message: Uint8Array,
-    ringLocation: RingLocation,
-): Promise<Uint8Array> {
-    log.debug("Creating ring proof", { ringLocation });
-
-    // TODO: Implement Ring VRF proof creation via TruAPI
-    throw new Error(
-        "createRingProof() is not yet implemented. " +
-            "This requires container mode with Ring VRF support.",
-    );
-}
-
-/**
- * Verify a Ring VRF proof
- *
- * @param message - Original message
- * @param proof - Proof bytes
- * @param alias - Expected alias
- * @returns True if proof is valid
- */
-export async function verifyRingProof(
-    message: Uint8Array,
-    proof: Uint8Array,
-    alias: string,
-): Promise<boolean> {
-    log.debug("Verifying ring proof");
-
-    // TODO: Implement Ring VRF proof verification
-    throw new Error(
-        "verifyRingProof() is not yet implemented. " +
-            "This requires container mode with Ring VRF support.",
-    );
-}

package/src/identity/types.ts

@@ -18,7 +18,12 @@ export interface DotNsRecord {
     expiresAt?: number;
 }
 
-/** Context alias info: a deterministic, context-bound alias derived from a parent account */
+/**
+ * Context alias info: a deterministic, context-bound alias derived from a parent account
+ *
+ * @deprecated Returned by `deriveContextAlias`, whose addresses no key can spend.
+ *   Removal: `@parity/product-sdk` 0.23.0.
+ */
 export interface ContextAliasInfo {
     /** Alias SS58 address */
     address: string;
@@ -30,24 +35,6 @@ export interface ContextAliasInfo {
     context: string;
 }
 
-/** Ring VRF alias info */
-export interface AnonymousAliasInfo {
-    /** Anonymous alias identifier */
-    alias: string;
-    /** Ring location for proof generation */
-    ringLocation: RingLocation;
-    /** Context used for alias derivation */
-    context: string;
-}
-
-/** Ring location for VRF proofs */
-export interface RingLocation {
-    /** Ring index */
-    ringIndex: number;
-    /** Member index within ring */
-    memberIndex: number;
-}
-
 /** Identity verification result */
 export interface VerificationResult {
     /** Whether identity is verified */

package/src/individuality/contract.test.ts

@@ -0,0 +1,56 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Compile-time guard for the chain contract in `@parity/product-sdk-individuality`.
+ *
+ * That package types its chain parameter structurally, listing the storage
+ * entries it needs rather than naming a descriptor. That keeps it free of a
+ * chain-client dependency and lets its tests use a plain double, at the cost that
+ * the contract can drift from the real chain silently, since the double satisfies
+ * it by construction.
+ *
+ * This file closes that gap: if a descriptor regeneration changes a key or a
+ * value type, `pnpm typecheck` fails here.
+ *
+ * **It lives in the umbrella package deliberately.** Inside the individuality
+ * package the same assertion is vacuous, passing even against a contract that
+ * demands a pallet the chain does not have, because the descriptor types do not
+ * fully resolve through that package's dependency graph. Here, where both
+ * `chain-client` and the individuality package are direct dependencies, it
+ * correctly rejects a bogus contract. The negative control below keeps that
+ * property honest: if `IndividualityChain` ever stopped constraining, the
+ * `@ts-expect-error` would report as unused and this file would fail.
+ */
+import type { getChainAPI } from "@parity/product-sdk-chain-client";
+import type { IndividualityChain } from "@parity/product-sdk-individuality";
+import { expect, test } from "vitest";
+
+// The false branch must be `false`, not `never`. `never` is assignable to
+// `true`, so a `never` branch would make the assertion unfalsifiable.
+type Assert<T extends true> = T;
+
+type PaseoClient = Awaited<ReturnType<typeof getChainAPI<"paseo">>>;
+type DevnetClient = Awaited<ReturnType<typeof getChainAPI<"devnet">>>;
+
+// These four aliases are the test. Each fails to typecheck if its condition
+// breaks, so they need no export and no runtime reference.
+type PaseoSatisfiesContract = Assert<PaseoClient extends IndividualityChain ? true : false>;
+type DevnetSatisfiesContract = Assert<DevnetClient extends IndividualityChain ? true : false>;
+
+// Negative control, kept type-only so it emits no runtime code. If
+// `IndividualityChain` ever stopped constraining, this flips to `false` and the
+// file fails to typecheck, which is what keeps the assertions above honest.
+type ClientWithoutIndividuality = {
+    assetHub: unknown;
+    raw: { assetHub: unknown };
+    destroy(): void;
+};
+type RejectsBogusClient = Assert<
+    ClientWithoutIndividuality extends IndividualityChain ? false : true
+>;
+
+test("the individuality chain contract is asserted at compile time", () => {
+    // The type assertions above are the test. This keeps vitest from reporting
+    // the file as an empty suite.
+    expect(true).toBe(true);
+});

package/src/individuality/index.ts

@@ -0,0 +1,8 @@
+// Copyright 2026 Parity Technologies (UK) Ltd.
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * @parity/product-sdk/individuality
+ *
+ * Re-exports from @parity/product-sdk-individuality.
+ */
+export * from "@parity/product-sdk-individuality";