@totemsdk/omnia-host 0.12.0 → 0.13.1

package/dist/api/methods.js

@@ -1697,21 +1697,7 @@ function createHostMethods(context) {
         });
         if (!route)
             return { success: false, error: 'No route found', errorCode: 'ROUTE_NOT_FOUND' };
-        return {
-            success: true,
-            route: {
-                ...route,
-                totalFees: route.totalFees.toString(),
-                hops: route.hops.map((hop) => ({
-                    ...hop,
-                    amount: hop.amount.toString(),
-                    ...('isSwap' in hop && hop.isSwap ? {
-                        amountIn: hop.amountIn.toString(),
-                        amountOut: hop.amountOut.toString(),
-                    } : {}),
-                })),
-            },
-        };
+        return { success: true, route: serializeWireRoute(route) };
     };
     register('totem_omniaGetRoute', getRoute, 'omnia/getRoute');
     const getSwapRate = () => ({ success: true, announcements: [] });
@@ -2529,28 +2515,115 @@ function createHostMethods(context) {
     };
     register('totem_omniaSpliceIn', splice('in'), 'omnia/spliceIn');
     register('totem_omniaSpliceOut', splice('out'), 'omnia/spliceOut');
+    function parseWireRoute(value) {
+        if (!value || typeof value !== 'object')
+            throw new Error('route must be an object');
+        const raw = value;
+        if (!Array.isArray(raw.hops) || raw.hops.length === 0)
+            throw new Error('route.hops must be a non-empty array');
+        const hops = raw.hops.map((entry, index) => {
+            if (!entry || typeof entry !== 'object')
+                throw new Error(`route.hops[${index}] must be an object`);
+            const hop = entry;
+            const base = {
+                channelId: String(hop.channelId ?? ''),
+                from: String(hop.from ?? ''),
+                to: String(hop.to ?? ''),
+                amount: typeof hop.amount === 'bigint' ? hop.amount : BigInt(String(hop.amount ?? '0')),
+                tokenId: String(hop.tokenId ?? ''),
+                ...(typeof hop.htlcId === 'string' ? { htlcId: hop.htlcId } : {}),
+            };
+            if (hop.isSwap === true) {
+                return {
+                    ...base,
+                    isSwap: true,
+                    tokenIn: String(hop.tokenIn ?? ''),
+                    tokenOut: String(hop.tokenOut ?? ''),
+                    amountIn: typeof hop.amountIn === 'bigint' ? hop.amountIn : BigInt(String(hop.amountIn ?? '0')),
+                    amountOut: typeof hop.amountOut === 'bigint' ? hop.amountOut : BigInt(String(hop.amountOut ?? '0')),
+                    rate: String(hop.rate ?? ''),
+                    inboundChannelId: String(hop.inboundChannelId ?? ''),
+                    outboundChannelId: String(hop.outboundChannelId ?? ''),
+                };
+            }
+            return base;
+        });
+        const route = {
+            hops,
+            totalFees: typeof raw.totalFees === 'bigint' ? raw.totalFees : BigInt(String(raw.totalFees ?? '0')),
+            tokenIn: String(raw.tokenIn ?? ''),
+            tokenOut: String(raw.tokenOut ?? ''),
+            estimatedBlocks: Number(raw.estimatedBlocks ?? 0),
+        };
+        if (hops.some((hop) => hop.isSwap)) {
+            route.swapHops = hops.filter((hop) => hop.isSwap);
+        }
+        return route;
+    }
+    function serializeWireRoute(route) {
+        return {
+            tokenIn: route.tokenIn,
+            tokenOut: route.tokenOut,
+            totalFees: route.totalFees.toString(),
+            estimatedBlocks: route.estimatedBlocks,
+            hops: route.hops.map((hop) => {
+                const base = {
+                    channelId: hop.channelId,
+                    from: hop.from,
+                    to: hop.to,
+                    amount: hop.amount.toString(),
+                    tokenId: hop.tokenId,
+                    ...(hop.htlcId ? { htlcId: hop.htlcId } : {}),
+                };
+                if ('isSwap' in hop && hop.isSwap) {
+                    return {
+                        ...base,
+                        isSwap: true,
+                        tokenIn: hop.tokenIn,
+                        tokenOut: hop.tokenOut,
+                        amountIn: hop.amountIn.toString(),
+                        amountOut: hop.amountOut.toString(),
+                        rate: hop.rate,
+                        inboundChannelId: hop.inboundChannelId,
+                        outboundChannelId: hop.outboundChannelId,
+                    };
+                }
+                return base;
+            }),
+        };
+    }
     const payMultiHop = async (raw) => {
         const params = paramsObject(raw);
         requireMutationContext(context);
-        const route = params.route;
-        if (!route || typeof route !== 'object' || !Array.isArray(route.hops)) {
-            throw new Error('route with hops is required');
-        }
-        const paymentRequest = params.paymentRequest;
-        if (!paymentRequest || typeof paymentRequest !== 'object') {
-            throw new Error('paymentRequest is required');
-        }
-        const request = paymentRequest;
+        const from = context.localParticipant?.publicKeyDigest;
+        if (!from)
+            throw new Error('Local participant is not configured');
+        const amount = requiredBigInt(params, 'amount');
+        const tokenId = requiredString(params, 'tokenId');
+        const targetTokenId = typeof params.targetTokenId === 'string' ? params.targetTokenId : undefined;
+        const parsedRoute = params.route
+            ? parseWireRoute(params.route)
+            : await context.routing.getRoute({
+                from,
+                to: normalizeRouteNode(requiredString(params, 'toPartyId')),
+                amount,
+                tokenId,
+                ...(targetTokenId ? { targetTokenId } : {}),
+                ...(typeof params.maxHops === 'number' ? { maxHops: params.maxHops } : {}),
+            });
+        if (!parsedRoute)
+            throw new Error('No route found');
+        const isCrossToken = parsedRoute.hops.some((hop) => 'isSwap' in hop && hop.isSwap === true);
         const parsedRequest = {
-            hashlock: requiredString(request, 'hashlock'),
-            amount: requiredBigInt(request, 'amount'),
-            tokenId: requiredString(request, 'tokenId'),
-            expiryBlock: requiredBigInt(request, 'expiryBlock'),
-            preimage: typeof request.preimage === 'string' ? request.preimage : undefined,
-            description: typeof request.description === 'string' ? request.description : undefined,
+            hashlock: requiredString(params, 'hashlock'),
+            amount,
+            tokenId,
+            expiryBlock: requiredBigInt(params, 'expiryBlock'),
+            ...(typeof params.preimage === 'string' ? { preimage: params.preimage } : {}),
+            ...(typeof params.description === 'string' ? { description: params.description } : {}),
         };
-        const parsedRoute = route;
-        const isCrossToken = 'swapHops' in parsedRoute && Array.isArray(parsedRoute.swapHops) && parsedRoute.swapHops.length > 0;
+        if (!parsedRequest.preimage)
+            throw new Error('preimage is required');
         const ops = {
             addHTLC: (channel, htlcParams, leaseProvider) => (0, omnia_1.addHTLC)(channel, htlcParams, leaseProvider, context.signer),
             fulfillHTLC: (channel, htlcId, preimage, leaseProvider) => (0, omnia_1.fulfillHTLC)(channel, htlcId, preimage, leaseProvider, context.signer),
@@ -2588,6 +2661,7 @@ function createHostMethods(context) {
                 success: true,
                 preimage: result.preimage,
                 settledHops: result.settledHops,
+                route: serializeWireRoute(parsedRoute),
             };
         });
     };

package/dist/index.d.ts

@@ -9,6 +9,10 @@ export { createHostIdentityAndManifest, createHostManifest, loadHostIdentity, }
 export { SqliteChannelStore } from './stores/sqlite-store.js';
 export { OperationStore } from './stores/operations.js';
 export type { OperationRecord, OperationStatus } from './stores/operations.js';
+export { SqliteAuditStore, createAuditRecorder } from './stores/audit.js';
+export type { SignerAuditEntry } from './stores/audit.js';
+export { generateTotp, verifyTotp, mfaOperationHash, verifyMfaAssertion, assertMfaAssertion, MemoryMfaReplayGuard, } from './mfa.js';
+export type { MfaAssertion, MfaChallenge, MfaReplayGuard, MfaVerificationOptions, MfaVerificationResult, TotpOptions, } from './mfa.js';
 export { createTotemNodeAdapter } from './chain/totem-node-adapter.js';
 export type { TotemNodeAdapter, TotemNodeAdapterOptions, ConfirmationOptions } from './chain/totem-node-adapter.js';
 export { InProcessRoutingProvider } from './router/routing-provider.js';
@@ -20,5 +24,5 @@ export type { OperationStoreLike } from './api/methods.js';
 export { DisabledAnalyticsStore, DuckDbAnalyticsStore, initializeDuckDb } from './stores/analytics.js';
 export type { AnalyticsEvent, AnalyticsStore, DuckDbConnection } from './stores/analytics.js';
 export { createLocalSignerPort, createPolicySignerPort } from './signer-port.js';
-export type { SignerPolicy } from './signer-port.js';
+export type { SignerAuditRecord, SignerPolicy } from './signer-port.js';
 export * from './observe/index.js';

package/dist/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createPolicySignerPort = exports.createLocalSignerPort = exports.initializeDuckDb = exports.DuckDbAnalyticsStore = exports.DisabledAnalyticsStore = exports.createHostMethods = exports.GoRoutingProvider = exports.InProcessRoutingProvider = exports.createTotemNodeAdapter = exports.OperationStore = exports.SqliteChannelStore = exports.loadHostIdentity = exports.createHostManifest = exports.createHostIdentityAndManifest = exports.encryptSeedForKeyfile = exports.leaseStorageDir = exports.JsonFileStorageAdapter = exports.hasSigningMaterial = exports.createHostSigning = exports.createOmniaHost = exports.loadConfigFromEnv = void 0;
+exports.createPolicySignerPort = exports.createLocalSignerPort = exports.initializeDuckDb = exports.DuckDbAnalyticsStore = exports.DisabledAnalyticsStore = exports.createHostMethods = exports.GoRoutingProvider = exports.InProcessRoutingProvider = exports.createTotemNodeAdapter = exports.MemoryMfaReplayGuard = exports.assertMfaAssertion = exports.verifyMfaAssertion = exports.mfaOperationHash = exports.verifyTotp = exports.generateTotp = exports.createAuditRecorder = exports.SqliteAuditStore = exports.OperationStore = exports.SqliteChannelStore = exports.loadHostIdentity = exports.createHostManifest = exports.createHostIdentityAndManifest = exports.encryptSeedForKeyfile = exports.leaseStorageDir = exports.JsonFileStorageAdapter = exports.hasSigningMaterial = exports.createHostSigning = exports.createOmniaHost = exports.loadConfigFromEnv = void 0;
 var config_js_1 = require("./config.js");
 Object.defineProperty(exports, "loadConfigFromEnv", { enumerable: true, get: function () { return config_js_1.loadConfigFromEnv; } });
 var lifecycle_js_1 = require("./lifecycle.js");
@@ -33,6 +33,16 @@ var sqlite_store_js_1 = require("./stores/sqlite-store.js");
 Object.defineProperty(exports, "SqliteChannelStore", { enumerable: true, get: function () { return sqlite_store_js_1.SqliteChannelStore; } });
 var operations_js_1 = require("./stores/operations.js");
 Object.defineProperty(exports, "OperationStore", { enumerable: true, get: function () { return operations_js_1.OperationStore; } });
+var audit_js_1 = require("./stores/audit.js");
+Object.defineProperty(exports, "SqliteAuditStore", { enumerable: true, get: function () { return audit_js_1.SqliteAuditStore; } });
+Object.defineProperty(exports, "createAuditRecorder", { enumerable: true, get: function () { return audit_js_1.createAuditRecorder; } });
+var mfa_js_1 = require("./mfa.js");
+Object.defineProperty(exports, "generateTotp", { enumerable: true, get: function () { return mfa_js_1.generateTotp; } });
+Object.defineProperty(exports, "verifyTotp", { enumerable: true, get: function () { return mfa_js_1.verifyTotp; } });
+Object.defineProperty(exports, "mfaOperationHash", { enumerable: true, get: function () { return mfa_js_1.mfaOperationHash; } });
+Object.defineProperty(exports, "verifyMfaAssertion", { enumerable: true, get: function () { return mfa_js_1.verifyMfaAssertion; } });
+Object.defineProperty(exports, "assertMfaAssertion", { enumerable: true, get: function () { return mfa_js_1.assertMfaAssertion; } });
+Object.defineProperty(exports, "MemoryMfaReplayGuard", { enumerable: true, get: function () { return mfa_js_1.MemoryMfaReplayGuard; } });
 var totem_node_adapter_js_1 = require("./chain/totem-node-adapter.js");
 Object.defineProperty(exports, "createTotemNodeAdapter", { enumerable: true, get: function () { return totem_node_adapter_js_1.createTotemNodeAdapter; } });
 var routing_provider_js_1 = require("./router/routing-provider.js");

package/dist/mfa.d.ts

@@ -0,0 +1,77 @@
+/**
+ * TOTP + operation-bound MFA assertions (RFC-061 D8).
+ *
+ * The node/host creates an MfaChallenge for a money-moving operation; the user
+ * returns an MfaAssertion (TOTP proof). Verification binds the assertion to the
+ * exact operation hash, disclosure and expiry, and consumes it once. Secrets
+ * never leave the verifier.
+ */
+export interface TotpOptions {
+    /** Current time in ms (default Date.now()). */
+    time?: number;
+    period?: number;
+    digits?: number;
+    /** Accepted step window on either side (default 1). */
+    window?: number;
+}
+export declare function generateTotp(secret: string | Uint8Array, options?: TotpOptions): string;
+export declare function verifyTotp(secret: string | Uint8Array, code: string, options?: TotpOptions): boolean;
+export type MfaPurpose = 'sign' | 'submit' | 'key-rotation' | 'recovery' | 'admin';
+export type MfaMethod = 'totp' | 'webauthn' | 'recovery-code';
+/** Server-issued challenge bound to one exact operation. */
+export interface MfaChallenge {
+    challengeId: string;
+    purpose: MfaPurpose;
+    operationHash: string;
+    disclosureId?: string;
+    expiresAt: number;
+    attempts?: number;
+}
+/** Client-supplied proof for a challenge. */
+export interface MfaAssertion {
+    challengeId: string;
+    method: MfaMethod;
+    proof: string;
+    issuedAt: number;
+}
+/** Single-use replay guard (durable in a hosted deployment). */
+export interface MfaReplayGuard {
+    has(challengeId: string): boolean;
+    add(challengeId: string): void;
+}
+export declare class MemoryMfaReplayGuard implements MfaReplayGuard {
+    private readonly used;
+    has(challengeId: string): boolean;
+    add(challengeId: string): void;
+}
+export interface MfaVerificationOptions {
+    secret: string | Uint8Array;
+    /** Expected operation hash (see `mfaOperationHash`). */
+    operationHash: string;
+    disclosureId?: string;
+    now?: number;
+    period?: number;
+    digits?: number;
+    window?: number;
+    /** Tolerated future clock skew for issuedAt (default 5 minutes). */
+    clockSkewMs?: number;
+    /** Replay guard; defaults to a process-local guard when omitted. */
+    used?: MfaReplayGuard;
+}
+export interface MfaVerificationResult {
+    ok: boolean;
+    reason?: string;
+}
+export declare function verifyMfaAssertion(challenge: MfaChallenge, assertion: MfaAssertion, options: MfaVerificationOptions): MfaVerificationResult;
+export declare function assertMfaAssertion(challenge: MfaChallenge, assertion: MfaAssertion, options: MfaVerificationOptions): void;
+export interface MfaOperationInput {
+    purpose: MfaPurpose;
+    domain: string;
+    /** Canonical operation digest (SignRequest.digest). */
+    digest: Uint8Array | string;
+    disclosureId?: string;
+    amount?: string;
+    asset?: string;
+}
+/** Stable operation hash binding an MFA challenge to one signing intent. */
+export declare function mfaOperationHash(input: MfaOperationInput): string;

package/dist/mfa.js

@@ -0,0 +1,152 @@
+"use strict";
+/**
+ * TOTP + operation-bound MFA assertions (RFC-061 D8).
+ *
+ * The node/host creates an MfaChallenge for a money-moving operation; the user
+ * returns an MfaAssertion (TOTP proof). Verification binds the assertion to the
+ * exact operation hash, disclosure and expiry, and consumes it once. Secrets
+ * never leave the verifier.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MemoryMfaReplayGuard = void 0;
+exports.generateTotp = generateTotp;
+exports.verifyTotp = verifyTotp;
+exports.verifyMfaAssertion = verifyMfaAssertion;
+exports.assertMfaAssertion = assertMfaAssertion;
+exports.mfaOperationHash = mfaOperationHash;
+const node_crypto_1 = require("node:crypto");
+const BASE32 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+const DEFAULT_PERIOD = 30;
+const DEFAULT_DIGITS = 6;
+function toSecret(secret) {
+    if (secret instanceof Uint8Array)
+        return secret;
+    const clean = secret.toUpperCase().replace(/[\s-]/g, '').replace(/=+$/, '');
+    if (!clean)
+        throw new Error('MFA secret is empty');
+    let bits = 0;
+    let value = 0;
+    const out = [];
+    for (const ch of clean) {
+        const index = BASE32.indexOf(ch);
+        if (index < 0)
+            throw new Error('MFA secret is not valid base32');
+        value = (value << 5) | index;
+        bits += 5;
+        if (bits >= 8) {
+            out.push((value >>> (bits - 8)) & 0xff);
+            bits -= 8;
+        }
+    }
+    return Uint8Array.from(out);
+}
+function hotp(secret, counter, digits) {
+    const msg = Buffer.alloc(8);
+    msg.writeBigUInt64BE(BigInt(counter));
+    const digest = (0, node_crypto_1.createHmac)('sha1', secret).update(msg).digest();
+    const offset = digest[digest.length - 1] & 0x0f;
+    const binary = ((digest[offset] & 0x7f) << 24) |
+        ((digest[offset + 1] & 0xff) << 16) |
+        ((digest[offset + 2] & 0xff) << 8) |
+        (digest[offset + 3] & 0xff);
+    return String(binary % 10 ** digits).padStart(digits, '0');
+}
+function step(timeMs, period) {
+    return Math.floor(timeMs / 1000 / period);
+}
+function generateTotp(secret, options = {}) {
+    const period = options.period ?? DEFAULT_PERIOD;
+    const digits = options.digits ?? DEFAULT_DIGITS;
+    const time = options.time ?? Date.now();
+    return hotp(toSecret(secret), step(time, period), digits);
+}
+function verifyTotp(secret, code, options = {}) {
+    const period = options.period ?? DEFAULT_PERIOD;
+    const digits = options.digits ?? DEFAULT_DIGITS;
+    const window = options.window ?? 1;
+    const time = options.time ?? Date.now();
+    const normalized = code.replace(/\s+/g, '');
+    if (!/^\d+$/.test(normalized) || normalized.length !== digits)
+        return false;
+    const key = toSecret(secret);
+    const current = step(time, period);
+    for (let delta = -window; delta <= window; delta += 1) {
+        const candidate = hotp(key, current + delta, digits);
+        if (candidate.length === normalized.length &&
+            (0, node_crypto_1.timingSafeEqual)(Buffer.from(candidate), Buffer.from(normalized))) {
+            return true;
+        }
+    }
+    return false;
+}
+class MemoryMfaReplayGuard {
+    used = new Set();
+    has(challengeId) {
+        return this.used.has(challengeId);
+    }
+    add(challengeId) {
+        this.used.add(challengeId);
+    }
+}
+exports.MemoryMfaReplayGuard = MemoryMfaReplayGuard;
+const defaultGuard = new MemoryMfaReplayGuard();
+function verifyMfaAssertion(challenge, assertion, options) {
+    const now = options.now ?? Date.now();
+    if (!challenge.challengeId || assertion.challengeId !== challenge.challengeId) {
+        return { ok: false, reason: 'MFA assertion does not match the challenge' };
+    }
+    if (challenge.expiresAt <= now)
+        return { ok: false, reason: 'MFA challenge has expired' };
+    if (challenge.attempts !== undefined && challenge.attempts <= 0) {
+        return { ok: false, reason: 'MFA challenge has no attempts left' };
+    }
+    if (challenge.operationHash !== options.operationHash) {
+        return { ok: false, reason: 'MFA challenge does not match the operation' };
+    }
+    if (challenge.disclosureId !== undefined && challenge.disclosureId !== options.disclosureId) {
+        return { ok: false, reason: 'MFA challenge does not match the disclosure' };
+    }
+    const skew = options.clockSkewMs ?? 5 * 60_000;
+    if (!Number.isFinite(assertion.issuedAt) ||
+        assertion.issuedAt <= 0 ||
+        assertion.issuedAt > now + skew) {
+        return { ok: false, reason: 'MFA assertion has an invalid issuedAt' };
+    }
+    const used = options.used ?? defaultGuard;
+    if (used.has(challenge.challengeId)) {
+        return { ok: false, reason: 'MFA assertion has already been used' };
+    }
+    if (assertion.method !== 'totp') {
+        return { ok: false, reason: `unsupported MFA method: ${assertion.method}` };
+    }
+    if (!verifyTotp(options.secret, assertion.proof, {
+        time: assertion.issuedAt,
+        period: options.period,
+        digits: options.digits,
+        window: options.window,
+    })) {
+        return { ok: false, reason: 'MFA proof is invalid' };
+    }
+    used.add(challenge.challengeId);
+    return { ok: true };
+}
+function assertMfaAssertion(challenge, assertion, options) {
+    const result = verifyMfaAssertion(challenge, assertion, options);
+    if (!result.ok)
+        throw new Error(result.reason ?? 'MFA verification failed');
+}
+/** Stable operation hash binding an MFA challenge to one signing intent. */
+function mfaOperationHash(input) {
+    const digest = input.digest instanceof Uint8Array
+        ? Buffer.from(input.digest).toString('hex')
+        : String(input.digest).replace(/^0x/i, '').toLowerCase();
+    const canonical = JSON.stringify({
+        purpose: input.purpose,
+        domain: input.domain,
+        digest,
+        disclosureId: input.disclosureId ?? null,
+        amount: input.amount ?? null,
+        asset: input.asset ?? null,
+    });
+    return '0x' + (0, node_crypto_1.createHash)('sha256').update(canonical, 'utf8').digest('hex');
+}

package/dist/observe/snapshot.js

@@ -40,7 +40,7 @@ function channelView(channel) {
         currentSequence: channel.currentSequence,
         fundingCoinId: channel.fundingCoinId,
         fundingTxId: channel.fundingTxId,
-        parties: channel.parties,
+        parties: toJson(channel.parties),
         balances: Object.fromEntries(Object.entries(channel.balances).map(([k, v]) => [k, v.toString()])),
         pendingHTLCs: (channel.pendingHTLCs ?? []).map((h) => toJson(h)),
         updatedAt: channel.updatedAt,
@@ -54,7 +54,7 @@ function factoryView(factory) {
         status: f.status,
         tokenId: f.tokenId,
         tokenScale: f.tokenScale ?? 0,
-        participants: f.participants,
+        participants: toJson(f.participants),
         allocations: Object.fromEntries(Object.entries(allocations).map(([k, v]) => [k, v.toString()])),
         updatedAt: f.updatedAt,
     };
@@ -72,12 +72,12 @@ function operationsView(operations) {
                 continue;
             if (r.operationId)
                 seen.add(r.operationId);
-            out.push({
+            out.push(toJson({
                 operationId: r.operationId,
                 status: record.status ?? status,
                 updatedAt: record.updatedAt,
                 error: record.error,
-            });
+            }));
         }
     }
     return out;

package/dist/signer-port.d.ts

@@ -5,9 +5,24 @@
  * contract. A hosted deployment supplies its own `SignerPort` (KMS/HSM/MPC +
  * policy) instead; the host code is agnostic.
  */
-import { type CustodyMode, type SignDomain, type SignRequest, type SignerPort } from '@totemsdk/omnia';
+import { type CustodyAcknowledgement, type CustodyMode, type SignDomain, type SignRequest, type SignerPort } from '@totemsdk/omnia';
 import type { HostSigning } from './signing.js';
 export declare function createLocalSignerPort(signing: HostSigning): SignerPort;
+/** Durable audit record for every policy-signer decision (RFC-061 D6). */
+export interface SignerAuditRecord {
+    requestId: string;
+    domain: SignDomain;
+    mode: CustodyMode;
+    disclosureId: string;
+    acknowledgementId?: string;
+    signer: string;
+    decision: 'allow' | 'deny';
+    reason?: string;
+    amount?: string;
+    summary?: string;
+    occurredAt?: number;
+    mfaVerified?: boolean;
+}
 /** Hosted/KMS policy checks applied before delegating to the underlying port. */
 export interface SignerPolicy {
     allowedDomains?: SignDomain[];
@@ -16,6 +31,24 @@ export interface SignerPolicy {
     maxAmount?: bigint;
     /** Require a disclosure hash/version on the custody context. */
     requireDisclosure?: boolean;
+    /** RFC-061 signer gate: exact disclosure acknowledgement + policy decision. */
+    custody?: {
+        acknowledgement?: CustodyAcknowledgement;
+        subjectId?: string;
+        policyDecision?: 'allow' | 'deny';
+        now?: number;
+    };
+    /** Durable audit sink; called with allow/deny decisions. */
+    audit?: (record: SignerAuditRecord) => void | Promise<void>;
+    /**
+     * RFC-061 D8: verify a request-scoped, operation-bound MFA assertion.
+     * Defaults to non-self custody; a `minAmount` can scope it to larger moves.
+     */
+    mfa?: {
+        verify: (request: SignRequest) => void | Promise<void>;
+        modes?: CustodyMode[];
+        minAmount?: bigint;
+    };
     /** Additional operator approval hook (KMS/HSM/MPC or quorum). */
     authorize?: (request: SignRequest) => void | Promise<void>;
 }

package/dist/signer-port.js

@@ -56,6 +56,32 @@ function createPolicySignerPort(base, policy = {}) {
             if (!request.signers.includes(base.publicKeyDigest)) {
                 throw new Error(`signer ${base.publicKeyDigest} is not a required signer for ${request.requestId}`);
             }
+            const ack = policy.custody?.acknowledgement;
+            const auditBase = {
+                requestId: request.requestId,
+                domain: request.domain,
+                mode: request.custody.mode,
+                disclosureId: (0, omnia_1.custodyDisclosureId)(request.custody),
+                ...(ack
+                    ? { acknowledgementId: `${ack.disclosureId}:${ack.subjectId}:${ack.acknowledgedAt}` }
+                    : {}),
+                signer: base.publicKeyDigest,
+                amount: request.context.amount,
+                summary: request.context.summary,
+                occurredAt: Date.now(),
+            };
+            try {
+                (0, omnia_1.assertCustodyAllowsSigning)(request, policy.custody ?? {});
+            }
+            catch (err) {
+                await policy.audit?.({
+                    ...auditBase,
+                    decision: 'deny',
+                    mfaVerified: false,
+                    reason: err instanceof Error ? err.message : String(err),
+                });
+                throw err;
+            }
             if (policy.allowedDomains && !policy.allowedDomains.includes(request.domain)) {
                 throw new Error(`domain ${request.domain} is not allowed by policy`);
             }
@@ -72,8 +98,34 @@ function createPolicySignerPort(base, policy = {}) {
                     throw new Error(`request amount ${parsed} exceeds policy limit ${policy.maxAmount}`);
                 }
             }
+            let mfaVerified = false;
+            if (policy.mfa) {
+                const modes = policy.mfa.modes ?? ['trust-minimised', 'hosted'];
+                const modeRequired = modes.includes(request.custody.mode);
+                let amountRequired = true;
+                if (policy.mfa.minAmount !== undefined && request.context.amount !== undefined) {
+                    amountRequired = BigInt(request.context.amount) >= policy.mfa.minAmount;
+                }
+                if (modeRequired && amountRequired) {
+                    try {
+                        await policy.mfa.verify(request);
+                        mfaVerified = true;
+                    }
+                    catch (err) {
+                        await policy.audit?.({
+                            ...auditBase,
+                            decision: 'deny',
+                            mfaVerified: false,
+                            reason: err instanceof Error ? err.message : String(err),
+                        });
+                        throw err;
+                    }
+                }
+            }
             await policy.authorize?.(request);
-            return base.sign(request);
+            const signature = await base.sign(request);
+            await policy.audit?.({ ...auditBase, decision: 'allow', mfaVerified });
+            return signature;
         },
     };
 }

package/dist/stores/audit.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Durable signer audit store (RFC-061 D6).
+ *
+ * Every allow/deny decision from `createPolicySignerPort` is appended here
+ * through `@totemsdk/storage` (SyncSqliteStore; same codec/envelope as the
+ * host's other local state). Audit records never contain keys, seeds,
+ * preimages or raw signatures.
+ */
+import type { SignerAuditRecord } from '../signer-port.js';
+export interface SignerAuditEntry extends SignerAuditRecord {
+    auditId: string;
+    recordedAt: number;
+}
+/** Storage-backed, append-only signer audit log. */
+export declare class SqliteAuditStore {
+    private readonly kv;
+    constructor(path?: string);
+    append(record: SignerAuditRecord): SignerAuditEntry;
+    /** Newest first. */
+    list(limit?: number): SignerAuditEntry[];
+    close(): void;
+}
+/** Adapt the store to the `SignerPolicy.audit` callback. */
+export declare function createAuditRecorder(store: SqliteAuditStore): (record: SignerAuditRecord) => SignerAuditEntry;

package/dist/stores/audit.js

@@ -0,0 +1,49 @@
+"use strict";
+/**
+ * Durable signer audit store (RFC-061 D6).
+ *
+ * Every allow/deny decision from `createPolicySignerPort` is appended here
+ * through `@totemsdk/storage` (SyncSqliteStore; same codec/envelope as the
+ * host's other local state). Audit records never contain keys, seeds,
+ * preimages or raw signatures.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SqliteAuditStore = void 0;
+exports.createAuditRecorder = createAuditRecorder;
+const node_crypto_1 = require("node:crypto");
+const sqlite_sync_1 = require("@totemsdk/storage/sqlite-sync");
+const PREFIX = 'omnia:audit:';
+/** Storage-backed, append-only signer audit log. */
+class SqliteAuditStore {
+    kv;
+    constructor(path = ':memory:') {
+        this.kv = new sqlite_sync_1.SyncSqliteStore(path);
+    }
+    append(record) {
+        const recordedAt = Date.now();
+        const auditId = (0, node_crypto_1.randomUUID)();
+        const entry = { ...record, auditId, recordedAt };
+        this.kv.set(`${PREFIX}${String(recordedAt).padStart(13, '0')}:${auditId}`, entry);
+        return entry;
+    }
+    /** Newest first. */
+    list(limit = 100) {
+        const safeLimit = Number.isFinite(limit) && limit > 0 ? Math.floor(limit) : 100;
+        return this.kv
+            .keys()
+            .filter((key) => key.startsWith(PREFIX))
+            .sort()
+            .reverse()
+            .slice(0, safeLimit)
+            .map((key) => this.kv.get(key))
+            .filter((entry) => entry !== null);
+    }
+    close() {
+        this.kv.close();
+    }
+}
+exports.SqliteAuditStore = SqliteAuditStore;
+/** Adapt the store to the `SignerPolicy.audit` callback. */
+function createAuditRecorder(store) {
+    return (record) => store.append(record);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@totemsdk/omnia-host",
-  "version": "0.12.0",
+  "version": "0.13.1",
   "description": "Durable Omnia node daemon for channel lifecycle, routing, and control APIs",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -22,8 +22,8 @@
   ],
   "dependencies": {
     "ws": "^8.21.1",
-    "@totemsdk/chain-provider": "^0.3.0",
     "@totemsdk/core": "^1.4.0",
+    "@totemsdk/chain-provider": "^0.3.0",
     "@totemsdk/identity": "^1.0.2",
     "@totemsdk/liquidity-bond": "^0.3.1",
     "@totemsdk/manifest": "^2.0.2",
@@ -32,10 +32,10 @@
     "@totemsdk/omnia-factory": "^0.7.0",
     "@totemsdk/omnia-router": "^0.4.0",
     "@totemsdk/omnia-splice": "^0.3.0",
-    "@totemsdk/omnia-pool": "^0.5.3",
     "@totemsdk/p2p-hub": "^0.1.0",
-    "@totemsdk/storage": "^0.2.0",
+    "@totemsdk/storage": "^0.2.1",
     "@totemsdk/omnia-vtxo": "^0.6.1",
+    "@totemsdk/omnia-pool": "^0.5.3",
     "@totemsdk/wots-lease": "^1.0.1"
   },
   "devDependencies": {