@totemsdk/omnia-host 0.2.1 → 0.3.0

package/README.md

@@ -38,12 +38,13 @@ The daemon configuration is read from environment variables:
 
 ### Signing model
 
-`OMNIA_HOST_SEED` (or the keyfile) is the base seed. The host derives a
-per-address seed (`derivePerAddressSeed(baseSeed, localAddressIndex)`) and
-signs every channel state with the flat WOTS key at index 0 of that seed; the
-channel participant's `publicKeyDigest` is `derivePKdigest(perAddressSeed, 0)`.
-The WOTS lease journal and watermark persist in `<OMNIA_HOST_DB>.lease/` so
-they survive restarts together with the channel database.
+`OMNIA_HOST_SEED` (or the keyfile) is the base seed. The host derives the unified
+child TreeKey (`createUnifiedChildTreeKey(baseSeed, localAddressIndex)`) and signs
+every channel state (and the boot manifest) with serialized TreeSignatures; the
+channel participant's `publicKeyDigest` is that TreeKey's root public key, and the
+identity address is the matching Minima address. The WOTS lease journal and
+watermark persist in `<OMNIA_HOST_DB>.lease/` so they survive restarts together
+with the channel database.
 
 ### Read-only mode
 

package/dist/api/jsonrpc.d.ts

@@ -24,6 +24,18 @@ export interface ControlServerOptions {
     isReady?: () => boolean;
     methods?: Map<string, JsonRpcHandler>;
     onConnection?: (socket: WebSocket) => void;
+    /**
+     * Browser Origin allowlist (AUD-009). When set, browser requests whose
+     * `Origin` header is not listed are rejected. Requests with no Origin
+     * (native clients, curl) are always allowed.
+     */
+    allowedOrigins?: string[];
+    /**
+     * When set, control-plane requests must present this bearer token (AUD-009):
+     * `Authorization: Bearer <token>` over HTTP, or a query param / subprotocol
+     * over the WebSocket handshake.
+     */
+    authToken?: string;
 }
 export interface ControlServer {
     listen(): Promise<void>;

package/dist/api/jsonrpc.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createControlServer = createControlServer;
+const node_crypto_1 = __importDefault(require("node:crypto"));
 const node_http_1 = __importDefault(require("node:http"));
 const ws_1 = require("ws");
 function response(id, result) {
@@ -44,23 +45,95 @@ function sendJson(res, status, body) {
     res.writeHead(status, { 'content-type': 'application/json', 'content-length': Buffer.byteLength(payload) });
     res.end(payload);
 }
+function pathname(url) {
+    if (!url)
+        return '/';
+    const query = url.indexOf('?');
+    return query === -1 ? url : url.slice(0, query);
+}
+function isOriginAllowed(req, allowedOrigins) {
+    const origin = req.headers.origin;
+    // Native clients (no browser Origin header) are always allowed.
+    if (!origin)
+        return true;
+    // RFC-020 H1: browser requests require an explicit allowlist (default deny).
+    if (!allowedOrigins || allowedOrigins.length === 0)
+        return false;
+    return allowedOrigins.includes(origin);
+}
+function bearerToken(req) {
+    const header = req.headers.authorization;
+    if (typeof header === 'string' && header.startsWith('Bearer '))
+        return header.slice('Bearer '.length);
+    return undefined;
+}
+function handshakeToken(req) {
+    const url = new URL(req.url ?? '/', 'http://localhost');
+    const queryToken = url.searchParams.get('token');
+    if (queryToken)
+        return queryToken;
+    const header = req.headers['sec-websocket-protocol'];
+    const raw = Array.isArray(header) ? header.join(',') : header;
+    if (typeof raw === 'string') {
+        for (const part of raw.split(',')) {
+            const protocol = part.trim();
+            if (protocol.startsWith('bearer.'))
+                return protocol.slice('bearer.'.length);
+            if (protocol)
+                return protocol;
+        }
+    }
+    return undefined;
+}
+function safeTokenEqual(provided, expected) {
+    if (provided === undefined)
+        return false;
+    const a = Buffer.from(provided);
+    const b = Buffer.from(expected);
+    if (a.length !== b.length)
+        return false;
+    return node_crypto_1.default.timingSafeEqual(a, b);
+}
 function createControlServer(options) {
+    // RFC-020 H1: a non-loopback bind must be authenticated. Refuse to start a
+    // network-exposed control plane without a token.
+    const isLoopback = options.host === '127.0.0.1' || options.host === '::1' || options.host === 'localhost';
+    if (!isLoopback && (options.authToken === undefined || options.authToken.length === 0)) {
+        throw new Error(`Refusing to bind the control plane to ${options.host} without a control token (OMNIA_CONTROL_TOKEN)`);
+    }
     const methods = options.methods ?? new Map();
     const wsPath = options.wsPath ?? '/rpc';
+    const allowedOrigins = options.allowedOrigins;
+    const authToken = options.authToken;
     const server = node_http_1.default.createServer(async (req, res) => {
-        if (req.method === 'GET' && req.url === '/healthz') {
+        if (req.method === 'GET' && pathname(req.url) === '/healthz') {
             sendJson(res, 200, { ok: true });
             return;
         }
-        if (req.method === 'GET' && req.url === '/readyz') {
+        if (req.method === 'GET' && pathname(req.url) === '/readyz') {
             const ready = options.isReady?.() ?? false;
             sendJson(res, ready ? 200 : 503, { ok: ready });
             return;
         }
-        if (req.method !== 'POST' || req.url !== wsPath) {
+        if (req.method !== 'POST' || pathname(req.url) !== wsPath) {
             sendJson(res, 404, { error: 'Not found' });
             return;
         }
+        if (!isOriginAllowed(req, allowedOrigins)) {
+            sendJson(res, 403, { error: 'Forbidden' });
+            return;
+        }
+        // RFC-020 H1: require application/json — a browser cross-origin `text/plain`
+        // POST (a classic CSRF vector that skips CORS preflight) must be rejected.
+        const contentType = String(req.headers['content-type'] ?? '').toLowerCase();
+        if (!contentType.startsWith('application/json')) {
+            sendJson(res, 415, { error: 'Unsupported Media Type: application/json required' });
+            return;
+        }
+        if (authToken !== undefined && !safeTokenEqual(bearerToken(req), authToken)) {
+            sendJson(res, 403, { error: 'Forbidden' });
+            return;
+        }
         try {
             const request = JSON.parse(await readBody(req));
             sendJson(res, 200, await dispatch(request, methods));
@@ -72,7 +145,15 @@ function createControlServer(options) {
     });
     const webSockets = new ws_1.WebSocketServer({ noServer: true });
     server.on('upgrade', (req, socket, head) => {
-        if (req.url !== wsPath) {
+        if (pathname(req.url) !== wsPath) {
+            socket.destroy();
+            return;
+        }
+        if (!isOriginAllowed(req, allowedOrigins)) {
+            socket.destroy();
+            return;
+        }
+        if (authToken !== undefined && !safeTokenEqual(handshakeToken(req), authToken)) {
             socket.destroy();
             return;
         }

package/dist/config.d.ts

@@ -26,6 +26,16 @@ export interface OmniaHostConfig {
     identityFile?: string;
     /** EdgeServiceManifest serviceType (default "omnia-router"). */
     serviceType: string;
+    /**
+     * Browser Origin allowlist for the control plane (OMNIA_ALLOWED_ORIGINS,
+     * comma-separated). Undefined/empty allows any Origin.
+     */
+    allowedOrigins?: string[];
+    /**
+     * Bearer token required on control-plane requests (OMNIA_CONTROL_TOKEN).
+     * Undefined disables token auth.
+     */
+    controlToken?: string;
 }
 /** Load the daemon configuration from the documented OMNIA_* environment. */
 export declare function loadConfigFromEnv(env?: NodeJS.ProcessEnv): OmniaHostConfig;

package/dist/config.js

@@ -28,6 +28,13 @@ function optionalInteger(value) {
         throw new Error(`OMNIA_LOCAL_ADDRESS_INDEX must be a non-negative integer; received ${value}`);
     return parsed;
 }
+function parseOrigins(value) {
+    const parts = value
+        ?.split(',')
+        .map((part) => part.trim())
+        .filter((part) => part.length > 0);
+    return parts && parts.length > 0 ? parts : undefined;
+}
 function parseSeed(value) {
     const seed = optional(value);
     if (!seed)
@@ -76,5 +83,7 @@ function loadConfigFromEnv(env = process.env) {
         readOnly: env.OMNIA_HOST_READ_ONLY?.trim() === '1',
         identityFile: optional(env.OMNIA_HOST_IDENTITY_FILE),
         serviceType: optional(env.OMNIA_HOST_SERVICE_TYPE) ?? 'omnia-router',
+        allowedOrigins: parseOrigins(env.OMNIA_ALLOWED_ORIGINS),
+        controlToken: optional(env.OMNIA_CONTROL_TOKEN),
     };
 }

package/dist/identity.js

@@ -92,7 +92,22 @@ async function createHostManifest(config, signing, identity) {
         capabilities: ['omnia:open-channel', 'omnia:update-channel', 'omnia:route', 'omnia:settle'],
         tags: ['omnia', 'payment-channel', 'daemon'],
     };
-    return (0, manifest_1.signManifest)(manifest, signing.perAddressSeed, 0);
+    // RFC-037: sign the manifest with the unified child TreeKey. Allocate a
+    // one-time leaf via the lease so restarts never reuse a WOTS leaf.
+    const reservation = await signing.leaseProvider.reserveKeyUse({
+        treeId: 'omnia-manifest',
+        purpose: 'manifest',
+    });
+    const useIndex = reservation.indices.l1 * 64 + reservation.indices.l2;
+    try {
+        const signed = await (0, manifest_1.signManifest)(manifest, signing.treeKey, useIndex);
+        await signing.leaseProvider.commitKeyUse(reservation.reservationId, 'manifest');
+        return signed;
+    }
+    catch (err) {
+        await signing.leaseProvider.burnReservation(reservation.reservationId, 'manifest-sign-failed').catch(() => { });
+        throw err;
+    }
 }
 /** Boot-time identity + manifest assembly. */
 async function createHostIdentityAndManifest(config, signing) {

package/dist/lifecycle.js

@@ -86,6 +86,8 @@ function createOmniaHost(config, dependencies = {}) {
                     port: config.port,
                     wsPath: config.wsPath,
                     isReady: () => started,
+                    allowedOrigins: config.allowedOrigins,
+                    authToken: config.controlToken,
                     methods: dependencies.methods ?? (0, methods_js_1.createHostMethods)({
                         channels: channelStore,
                         routing: routingProvider,

package/dist/signing.d.ts

@@ -2,20 +2,21 @@
  * Host signing material — derives the channel signer, WOTS lease provider,
  * and Minima address from env-provisioned key material.
  *
- * Key model (matches @totemsdk/omnia's verification path):
+ * Key model (RFC-037 unified WOTS):
  *   - `baseSeed` comes from OMNIA_HOST_SEED (BIP39 mnemonic or 32-byte hex)
  *     or from an OMNIA_HOST_KEYFILE JSON.
- *   - `perAddressSeed = derivePerAddressSeed(baseSeed, localAddressIndex)`.
- *   - The channel participant's `publicKeyDigest` is the flat WOTS PK digest
- *     `derivePKdigest(perAddressSeed, 0)` — omnia verifies signatures with
- *     `wotsVerifyDigest(sig, digest, pkDigest)`, which is key-index agnostic,
- *     so the signer always signs with key index 0 of the per-address seed.
- *   - The lease indices {addressIndex, l1, l2} are slot bookkeeping for
- *     double-sign prevention (watermark monotonicity), not key derivation.
+ *   - The channel key is the unified child TreeKey
+ *     `createUnifiedChildTreeKey(baseSeed, localAddressIndex)`; the participant's
+ *     `publicKeyDigest` is its tree-root public key — the same key the on-chain
+ *     `MULTISIG` eltoo script embeds.
+ *   - Signatures are serialized hierarchical `TreeSignature`s (`serializeTreeSignature`)
+ *     over the reserved leaf `(l1*64 + l2)`, verified by `verifyChannelSignature`.
+ *   - The lease indices {addressIndex, l1, l2} select the one-time leaf.
  *
  * The lease journal/watermark persist in a directory next to the channel DB
  * (`<dbPath>.lease/`) so they survive restarts together with the channel store.
  */
+import { type TreeKey } from '@totemsdk/core';
 import type { StorageAdapter } from '@totemsdk/core';
 import type { ChannelSigner } from '@totemsdk/omnia';
 import type { WotsLeaseProvider } from '@totemsdk/wots-lease';
@@ -23,12 +24,14 @@ import type { OmniaHostConfig } from './config.js';
 export interface HostSigning {
     signer: ChannelSigner;
     leaseProvider: WotsLeaseProvider;
+    /** Minima address for the unified child TreeKey (identity + channels). */
     address: string;
+    /** Channel participant key: the unified child TreeKey root pubkey (RFC-037). */
     publicKeyDigest: string;
     /** 32-byte base seed (used by the identity/manifest layer). */
     baseSeed: Uint8Array;
-    /** Per-address seed used for channel signing (key index 0). */
-    perAddressSeed: Uint8Array;
+    /** Unified child TreeKey used for channel + manifest signing (RFC-037). */
+    treeKey: TreeKey;
     addressIndex: number;
     deviceId: string;
 }
@@ -43,13 +46,15 @@ interface KeyfilePayload {
 export declare function encryptSeedForKeyfile(seed: Uint8Array, passphrase: string): KeyfilePayload;
 /**
  * JSON-file-backed StorageAdapter rooted at a directory next to the channel DB.
- * Each key is stored as `<key>.json`; the directory is created on first write.
+ *
+ * Delegates to the hardened shared `FileStore` from `@totemsdk/storage/fs`
+ * (RFC-007): one versioned codec record per key written temp+rename with an
+ * fsync; corrupt records surface as `StorageError` (`corrupt`) rather than
+ * silently returning JSON `null`. The directory is created on first write.
  */
 export declare class JsonFileStorageAdapter implements StorageAdapter {
-    private readonly dir;
+    private readonly store;
     constructor(dir: string);
-    private fileFor;
-    private ensureDir;
     get<T>(key: string): Promise<T | null>;
     set<T>(key: string, value: T): Promise<void>;
     remove(key: string): Promise<boolean>;

package/dist/signing.js

@@ -3,16 +3,16 @@
  * Host signing material — derives the channel signer, WOTS lease provider,
  * and Minima address from env-provisioned key material.
  *
- * Key model (matches @totemsdk/omnia's verification path):
+ * Key model (RFC-037 unified WOTS):
  *   - `baseSeed` comes from OMNIA_HOST_SEED (BIP39 mnemonic or 32-byte hex)
  *     or from an OMNIA_HOST_KEYFILE JSON.
- *   - `perAddressSeed = derivePerAddressSeed(baseSeed, localAddressIndex)`.
- *   - The channel participant's `publicKeyDigest` is the flat WOTS PK digest
- *     `derivePKdigest(perAddressSeed, 0)` — omnia verifies signatures with
- *     `wotsVerifyDigest(sig, digest, pkDigest)`, which is key-index agnostic,
- *     so the signer always signs with key index 0 of the per-address seed.
- *   - The lease indices {addressIndex, l1, l2} are slot bookkeeping for
- *     double-sign prevention (watermark monotonicity), not key derivation.
+ *   - The channel key is the unified child TreeKey
+ *     `createUnifiedChildTreeKey(baseSeed, localAddressIndex)`; the participant's
+ *     `publicKeyDigest` is its tree-root public key — the same key the on-chain
+ *     `MULTISIG` eltoo script embeds.
+ *   - Signatures are serialized hierarchical `TreeSignature`s (`serializeTreeSignature`)
+ *     over the reserved leaf `(l1*64 + l2)`, verified by `verifyChannelSignature`.
+ *   - The lease indices {addressIndex, l1, l2} select the one-time leaf.
  *
  * The lease journal/watermark persist in a directory next to the channel DB
  * (`<dbPath>.lease/`) so they survive restarts together with the channel store.
@@ -30,6 +30,7 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const node_crypto_1 = require("node:crypto");
 const core_1 = require("@totemsdk/core");
+const fs_1 = require("@totemsdk/storage/fs");
 const wots_lease_1 = require("@totemsdk/wots-lease");
 const wots_lease_2 = require("@totemsdk/wots-lease");
 const KEYFILE_SCRYPT_N = 16384;
@@ -115,58 +116,34 @@ function resolveBaseSeed(config) {
 }
 /**
  * JSON-file-backed StorageAdapter rooted at a directory next to the channel DB.
- * Each key is stored as `<key>.json`; the directory is created on first write.
+ *
+ * Delegates to the hardened shared `FileStore` from `@totemsdk/storage/fs`
+ * (RFC-007): one versioned codec record per key written temp+rename with an
+ * fsync; corrupt records surface as `StorageError` (`corrupt`) rather than
+ * silently returning JSON `null`. The directory is created on first write.
  */
 class JsonFileStorageAdapter {
-    dir;
+    store;
     constructor(dir) {
-        this.dir = dir;
-    }
-    fileFor(key) {
-        const safe = key.replace(/[^a-zA-Z0-9_-]/g, '_');
-        return node_path_1.default.join(this.dir, `${safe}.json`);
-    }
-    ensureDir() {
-        node_fs_1.default.mkdirSync(this.dir, { recursive: true });
+        this.store = new fs_1.FileStore(dir);
     }
     async get(key) {
-        const file = this.fileFor(key);
-        if (!node_fs_1.default.existsSync(file))
-            return null;
-        try {
-            return JSON.parse(node_fs_1.default.readFileSync(file, 'utf8'));
-        }
-        catch {
-            return null;
-        }
+        return this.store.get(key);
     }
     async set(key, value) {
-        this.ensureDir();
-        node_fs_1.default.writeFileSync(this.fileFor(key), JSON.stringify(value));
+        return this.store.set(key, value);
     }
     async remove(key) {
-        const file = this.fileFor(key);
-        if (!node_fs_1.default.existsSync(file))
-            return false;
-        node_fs_1.default.unlinkSync(file);
-        return true;
+        return this.store.remove(key);
     }
     async clear() {
-        if (!node_fs_1.default.existsSync(this.dir))
-            return;
-        for (const entry of node_fs_1.default.readdirSync(this.dir)) {
-            node_fs_1.default.unlinkSync(node_path_1.default.join(this.dir, entry));
-        }
+        return this.store.clear();
     }
     async keys() {
-        if (!node_fs_1.default.existsSync(this.dir))
-            return [];
-        return node_fs_1.default.readdirSync(this.dir)
-            .filter((name) => name.endsWith('.json'))
-            .map((name) => name.slice(0, -'.json'.length));
+        return this.store.keys();
     }
     async has(key) {
-        return node_fs_1.default.existsSync(this.fileFor(key));
+        return this.store.has(key);
     }
 }
 exports.JsonFileStorageAdapter = JsonFileStorageAdapter;
@@ -196,25 +173,34 @@ function createHostSigning(config) {
         throw new Error(`localAddressIndex ${addressIndex} is outside device slot ${deviceSlot} range ` +
             `${range.startAddressIndex}–${range.endAddressIndex}`);
     }
-    const perAddressSeed = (0, core_1.derivePerAddressSeed)(baseSeed, addressIndex);
-    const kp = (0, core_1.wotsKeypairFromSeed)(perAddressSeed, 0);
-    const publicKeyDigest = `0x${(0, core_1.bytesToHex)(kp.pk)}`;
-    const address = (0, core_1.wotsAddressFromKeypair)(kp);
+    const treeKey = (0, core_1.createUnifiedChildTreeKey)(baseSeed, addressIndex);
+    const publicKey = treeKey.getPublicKey();
+    const publicKeyDigest = `0x${(0, core_1.bytesToHex)(publicKey)}`;
+    const address = (0, core_1.scriptToAddress)((0, core_1.scriptFromWotsPk)(publicKey));
+    const storage = new JsonFileStorageAdapter(leaseStorageDir(config.dbPath));
+    const leaseProvider = new wots_lease_1.LocalLeaseProvider(storage, undefined, deviceId);
     const signer = {
         publicKeyDigest,
-        async sign(payload, _indices) {
-            return (0, core_1.wotsSign)(perAddressSeed, 0, payload);
+        async sign(payload, indices) {
+            // RFC-020 C1: honor the reserved leaf instead of hardcoding index 0. The
+            // reservation must belong to this signer's address; the leaf within the
+            // per-address tree is (l1*64 + l2). Signatures are serialized TreeSignatures
+            // (RFC-037), verified by verifyChannelSignature against the tree-root pubkey.
+            if (indices.addressIndex !== addressIndex) {
+                throw new Error(`omnia-host signer address ${addressIndex} cannot sign reserved address ${indices.addressIndex}`);
+            }
+            const leafIndex = indices.l1 * 64 + indices.l2;
+            treeKey.setUses(leafIndex);
+            return (0, core_1.serializeTreeSignature)(treeKey.sign(payload));
         },
     };
-    const storage = new JsonFileStorageAdapter(leaseStorageDir(config.dbPath));
-    const leaseProvider = new wots_lease_1.LocalLeaseProvider(storage, undefined, deviceId);
     return {
         signer,
         leaseProvider,
         address,
         publicKeyDigest,
         baseSeed,
-        perAddressSeed,
+        treeKey,
         addressIndex,
         deviceId,
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@totemsdk/omnia-host",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Durable Omnia node daemon for channel lifecycle, routing, and control APIs",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -22,17 +22,18 @@
   "dependencies": {
     "better-sqlite3": "^12.2.0",
     "ws": "^8.21.1",
-    "@totemsdk/core": "^1.2.9",
-    "@totemsdk/identity": "^1.0.0",
+    "@totemsdk/chain-provider": "^0.2.1",
+    "@totemsdk/identity": "^1.0.1",
+    "@totemsdk/core": "^1.2.11",
+    "@totemsdk/omnia": "^2.0.0",
     "@totemsdk/manifest": "^1.0.0",
-    "@totemsdk/chain-provider": "^0.2.0",
-    "@totemsdk/omnia": "^1.0.1",
-    "@totemsdk/omnia-factory": "^0.2.0",
-    "@totemsdk/omnia-router": "^0.2.0",
-    "@totemsdk/omnia-splice": "^0.2.0",
-    "@totemsdk/minima-rpc": "^0.2.0",
-    "@totemsdk/omnia-vtxo": "^0.2.0",
-    "@totemsdk/wots-lease": "^1.0.0"
+    "@totemsdk/omnia-factory": "^0.3.0",
+    "@totemsdk/omnia-router": "^0.3.0",
+    "@totemsdk/omnia-vtxo": "^0.4.0",
+    "@totemsdk/minima-rpc": "^0.2.2",
+    "@totemsdk/omnia-splice": "^0.3.0",
+    "@totemsdk/storage": "^0.1.0",
+    "@totemsdk/wots-lease": "^1.0.1"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",
@@ -42,7 +43,7 @@
     "jest": "^30.4.2",
     "ts-jest": "^29.4.11",
     "typescript": "5.9.3",
-    "@totemsdk/txpow": "^1.0.0"
+    "@totemsdk/txpow": "^1.0.2"
   },
   "engines": {
     "node": ">=20.0.0"