@totemsdk/wots-lease 0.1.0

package/dist/axia.d.ts

@@ -0,0 +1,33 @@
+/**
+ * AxiaLeaseProvider — wraps the Axia API's /v1/wots-hardened endpoints.
+ *
+ * Callers do NOT need to call /finalize separately — commitKeyUse() does it.
+ */
+import type { StorageAdapter, LoggerAdapter } from '@totemsdk/core';
+import type { WotsLeaseProvider, ReserveParams, LeaseReservation, LeaseCertificate, LocalWatermark, SyncResult } from './types.js';
+export interface AxiaLeaseProviderConfig {
+    apiUrl: string;
+    apiKey: string;
+    rootPublicKey: string;
+    storage: StorageAdapter;
+    logger?: LoggerAdapter;
+}
+export declare class AxiaLeaseProvider implements WotsLeaseProvider {
+    private readonly watermark;
+    private readonly leaseStore;
+    private readonly journal;
+    private readonly apiUrl;
+    private readonly apiKey;
+    private readonly rootPublicKey;
+    private readonly logger;
+    private _initialized;
+    constructor(config: AxiaLeaseProviderConfig);
+    initialize(): Promise<void>;
+    reserveKeyUse(params: ReserveParams): Promise<LeaseReservation>;
+    commitKeyUse(reservationId: string, txId: string): Promise<void>;
+    burnReservation(reservationId: string, reason: string): Promise<void>;
+    getLocalWatermark(treeId: string): Promise<LocalWatermark>;
+    publishWatermark(_treeId: string): Promise<void>;
+    syncLeaseJournal(): Promise<SyncResult>;
+    verifyLeaseCertificate(cert?: LeaseCertificate): Promise<boolean>;
+}

package/dist/axia.js

@@ -0,0 +1,123 @@
+/**
+ * AxiaLeaseProvider — wraps the Axia API's /v1/wots-hardened endpoints.
+ *
+ * Callers do NOT need to call /finalize separately — commitKeyUse() does it.
+ */
+import { NoopLogger, LeaseStore } from '@totemsdk/core';
+import { prepareLease, finalizeLease } from '@totemsdk/core';
+import { WotsWatermarkStore, flatIndex } from './watermark.js';
+import { LeaseJournal } from './journal.js';
+import { LeaseNotFoundError } from './errors.js';
+export class AxiaLeaseProvider {
+    constructor(config) {
+        this._initialized = false;
+        this.apiUrl = config.apiUrl;
+        this.apiKey = config.apiKey;
+        this.rootPublicKey = config.rootPublicKey;
+        this.logger = config.logger ?? new NoopLogger();
+        this.watermark = new WotsWatermarkStore(config.storage, this.logger);
+        this.leaseStore = new LeaseStore(config.storage, this.logger);
+        this.journal = new LeaseJournal(config.storage, this.logger);
+    }
+    async initialize() {
+        if (this._initialized)
+            return;
+        await this.watermark.initialize();
+        await this.leaseStore.initialize();
+        await this.journal.initialize();
+        this._initialized = true;
+    }
+    async reserveKeyUse(params) {
+        if (!this._initialized)
+            await this.initialize();
+        const txId = params.payloadHash ?? `tx-${Date.now()}`;
+        const resp = await prepareLease(this.apiUrl, this.apiKey, {
+            txId,
+            rootPublicKey: this.rootPublicKey,
+            to: params.treeId,
+            amount: params.valueHint ?? '0',
+            ttlMs: params.ttlMs ?? 120000,
+        });
+        const indices = resp.lease;
+        const expiresAt = Date.now() + (params.ttlMs ?? 120000);
+        const reservationId = resp.txId;
+        const lease = {
+            leaseId: reservationId,
+            leaseToken: resp.leaseToken,
+            indices,
+            expiresAt,
+            status: 'active',
+            createdAt: Date.now(),
+            leaseTTL: params.ttlMs ?? 120000,
+        };
+        await this.leaseStore.save(lease);
+        await this.journal.append({
+            treeId: params.treeId,
+            branchId: params.branchId ?? 'default',
+            wotsIndex: flatIndex(indices),
+            indices,
+            status: 'reserved',
+            payloadHash: params.payloadHash,
+            timestamp: Date.now(),
+            deviceId: params.deviceId ?? 'axia',
+        });
+        return { reservationId, indices, expiresAt, leaseToken: resp.leaseToken };
+    }
+    async commitKeyUse(reservationId, txId) {
+        if (!this._initialized)
+            await this.initialize();
+        const lease = this.leaseStore.get(reservationId);
+        if (!lease)
+            throw new LeaseNotFoundError(reservationId);
+        await finalizeLease(this.apiUrl, this.apiKey, lease.leaseToken, txId);
+        const indices = lease.indices;
+        await this.watermark.markUnavailable(lease.indices.addressIndex.toString(), indices, 'committed');
+        await this.leaseStore.updateStatus(reservationId, 'finalized');
+        await this.journal.append({
+            treeId: reservationId,
+            branchId: 'default',
+            wotsIndex: flatIndex(indices),
+            indices,
+            status: 'committed',
+            txId,
+            timestamp: Date.now(),
+            deviceId: 'axia',
+        });
+    }
+    async burnReservation(reservationId, reason) {
+        if (!this._initialized)
+            await this.initialize();
+        const lease = this.leaseStore.get(reservationId);
+        if (!lease)
+            throw new LeaseNotFoundError(reservationId);
+        const indices = lease.indices;
+        await this.watermark.markUnavailable(lease.indices.addressIndex.toString(), indices, 'burned');
+        await this.leaseStore.updateStatus(reservationId, 'cancelled');
+        this.logger.warn(`[AxiaLeaseProvider] Burning reservation ${reservationId}: ${reason}`);
+        await this.journal.append({
+            treeId: reservationId,
+            branchId: 'default',
+            wotsIndex: flatIndex(indices),
+            indices,
+            status: 'burned',
+            timestamp: Date.now(),
+            deviceId: 'axia',
+        });
+    }
+    async getLocalWatermark(treeId) {
+        if (!this._initialized)
+            await this.initialize();
+        return this.watermark.getLocalWatermark(treeId);
+    }
+    async publishWatermark(_treeId) {
+        // Server maintains its own watermark via the lease API
+    }
+    async syncLeaseJournal() {
+        return { synced: true, conflicts: [] };
+    }
+    async verifyLeaseCertificate(cert) {
+        if (cert === undefined)
+            return true;
+        return false;
+    }
+}

package/dist/device.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Device keyspace partitioning — Layer 2.
+ *
+ * Deterministic address-index range assignment per device slot.
+ * Does NOT accept a raw seed; the caller derives the TreeKey in @totemsdk/core.
+ *
+ * Layout (8 device slots × 8 addresses each = 64 total):
+ *   device 0 → addressIndex 0–7
+ *   device 1 → addressIndex 8–15
+ *   device 2 → addressIndex 16–23
+ *   ...
+ */
+import type { DeviceKeyRange } from './types.js';
+export declare function allocateDeviceRange(params: {
+    deviceSlot: number;
+    deviceId: string;
+}): DeviceKeyRange;
+export declare function deviceSlotForAddressIndex(addressIndex: number): number;

package/dist/device.js

@@ -0,0 +1,30 @@
+/**
+ * Device keyspace partitioning — Layer 2.
+ *
+ * Deterministic address-index range assignment per device slot.
+ * Does NOT accept a raw seed; the caller derives the TreeKey in @totemsdk/core.
+ *
+ * Layout (8 device slots × 8 addresses each = 64 total):
+ *   device 0 → addressIndex 0–7
+ *   device 1 → addressIndex 8–15
+ *   device 2 → addressIndex 16–23
+ *   ...
+ */
+const ADDRESSES_PER_DEVICE = 8;
+const MAX_DEVICE_SLOTS = 8;
+export function allocateDeviceRange(params) {
+    if (params.deviceSlot < 0 || params.deviceSlot >= MAX_DEVICE_SLOTS) {
+        throw new RangeError(`Device slot must be 0–${MAX_DEVICE_SLOTS - 1}, got ${params.deviceSlot}`);
+    }
+    const startAddressIndex = params.deviceSlot * ADDRESSES_PER_DEVICE;
+    const endAddressIndex = startAddressIndex + ADDRESSES_PER_DEVICE - 1;
+    return {
+        deviceId: params.deviceId,
+        startAddressIndex,
+        endAddressIndex,
+        addressCount: ADDRESSES_PER_DEVICE,
+    };
+}
+export function deviceSlotForAddressIndex(addressIndex) {
+    return Math.floor(addressIndex / ADDRESSES_PER_DEVICE);
+}

package/dist/errors.d.ts

@@ -0,0 +1,26 @@
+export declare class WatermarkMonotonicityError extends Error {
+    constructor(message: string);
+}
+export declare class WatermarkExhaustedError extends Error {
+    readonly treeId: string;
+    constructor(treeId: string);
+}
+export declare class LeaseNotFoundError extends Error {
+    readonly reservationId: string;
+    constructor(reservationId: string);
+}
+export declare class PersonalLeaseNodeNotConfiguredError extends Error {
+    constructor();
+}
+export declare class P2PQuorumNotImplementedError extends Error {
+    constructor();
+}
+export declare class OnchainWatermarkNotImplementedError extends Error {
+    constructor();
+}
+export declare class DeviceRangeViolationError extends Error {
+    readonly addressIndex: number;
+    readonly allowedStart: number;
+    readonly allowedEnd: number;
+    constructor(addressIndex: number, allowedStart: number, allowedEnd: number);
+}

package/dist/errors.js

@@ -0,0 +1,48 @@
+export class WatermarkMonotonicityError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'WatermarkMonotonicityError';
+    }
+}
+export class WatermarkExhaustedError extends Error {
+    constructor(treeId) {
+        super(`WOTS keyspace exhausted for tree: ${treeId}`);
+        this.treeId = treeId;
+        this.name = 'WatermarkExhaustedError';
+    }
+}
+export class LeaseNotFoundError extends Error {
+    constructor(reservationId) {
+        super(`Lease reservation not found: ${reservationId}`);
+        this.reservationId = reservationId;
+        this.name = 'LeaseNotFoundError';
+    }
+}
+export class PersonalLeaseNodeNotConfiguredError extends Error {
+    constructor() {
+        super('PersonalLeaseNodeProvider requires a running lookup node. ' +
+            'Deploy @totemsdk/lookup-node and configure { nodeUrl, nodePubkey }.');
+        this.name = 'PersonalLeaseNodeNotConfiguredError';
+    }
+}
+export class P2PQuorumNotImplementedError extends Error {
+    constructor() {
+        super('P2PQuorumLeaseProvider is not yet implemented.');
+        this.name = 'P2PQuorumNotImplementedError';
+    }
+}
+export class OnchainWatermarkNotImplementedError extends Error {
+    constructor() {
+        super('OnchainWatermarkProvider is not yet implemented.');
+        this.name = 'OnchainWatermarkNotImplementedError';
+    }
+}
+export class DeviceRangeViolationError extends Error {
+    constructor(addressIndex, allowedStart, allowedEnd) {
+        super(`Address index ${addressIndex} is outside device range [${allowedStart}, ${allowedEnd}]`);
+        this.addressIndex = addressIndex;
+        this.allowedStart = allowedStart;
+        this.allowedEnd = allowedEnd;
+        this.name = 'DeviceRangeViolationError';
+    }
+}

package/dist/hybrid.d.ts

@@ -0,0 +1,34 @@
+/**
+ * HybridLeaseProvider — recommended production default.
+ *
+ * Always uses local first, then gates on node cert and/or quorum attestation
+ * for transactions above a configurable value threshold.
+ */
+import type { WotsLeaseProvider, ReserveParams, LeaseReservation, LeaseCertificate, LocalWatermark, SyncResult } from './types.js';
+import type { LocalLeaseProvider } from './local.js';
+import type { PersonalLeaseNodeProvider } from './stubs.js';
+import type { P2PQuorumLeaseProvider } from './stubs.js';
+import type { OnchainWatermarkProvider } from './stubs.js';
+export interface HybridLeaseProviderConfig {
+    local: LocalLeaseProvider;
+    node?: PersonalLeaseNodeProvider;
+    quorum?: P2PQuorumLeaseProvider;
+    onchain?: OnchainWatermarkProvider;
+    threshold?: number;
+}
+export declare class HybridLeaseProvider implements WotsLeaseProvider {
+    private readonly local;
+    private readonly node?;
+    private readonly quorum?;
+    private readonly onchain?;
+    private readonly threshold;
+    constructor(config: HybridLeaseProviderConfig);
+    private isHighValue;
+    reserveKeyUse(params: ReserveParams): Promise<LeaseReservation>;
+    commitKeyUse(reservationId: string, txId: string): Promise<void>;
+    burnReservation(reservationId: string, reason: string): Promise<void>;
+    getLocalWatermark(treeId: string): Promise<LocalWatermark>;
+    publishWatermark(treeId: string): Promise<void>;
+    syncLeaseJournal(): Promise<SyncResult>;
+    verifyLeaseCertificate(cert?: LeaseCertificate): Promise<boolean>;
+}

package/dist/hybrid.js

@@ -0,0 +1,64 @@
+/**
+ * HybridLeaseProvider — recommended production default.
+ *
+ * Always uses local first, then gates on node cert and/or quorum attestation
+ * for transactions above a configurable value threshold.
+ */
+export class HybridLeaseProvider {
+    constructor(config) {
+        this.local = config.local;
+        this.node = config.node;
+        this.quorum = config.quorum;
+        this.onchain = config.onchain;
+        this.threshold = config.threshold ?? Infinity;
+    }
+    isHighValue(params) {
+        if (!params.valueHint)
+            return false;
+        const val = parseFloat(params.valueHint);
+        return !isNaN(val) && val >= this.threshold;
+    }
+    async reserveKeyUse(params) {
+        const reservation = await this.local.reserveKeyUse(params);
+        if (this.isHighValue(params)) {
+            if (this.node) {
+                try {
+                    const nodeReservation = await this.node.reserveKeyUse(params);
+                    return { ...reservation, certificate: nodeReservation.certificate };
+                }
+                catch {
+                    // Node unavailable — continue with local only
+                }
+            }
+        }
+        return reservation;
+    }
+    commitKeyUse(reservationId, txId) {
+        return this.local.commitKeyUse(reservationId, txId);
+    }
+    burnReservation(reservationId, reason) {
+        return this.local.burnReservation(reservationId, reason);
+    }
+    getLocalWatermark(treeId) {
+        return this.local.getLocalWatermark(treeId);
+    }
+    publishWatermark(treeId) {
+        if (this.node) {
+            return this.node.publishWatermark(treeId).catch(() => this.local.publishWatermark(treeId));
+        }
+        return this.local.publishWatermark(treeId);
+    }
+    syncLeaseJournal() {
+        if (this.node) {
+            return this.node.syncLeaseJournal().catch(() => this.local.syncLeaseJournal());
+        }
+        return this.local.syncLeaseJournal();
+    }
+    async verifyLeaseCertificate(cert) {
+        if (!cert)
+            return this.local.verifyLeaseCertificate(cert);
+        if (this.node)
+            return this.node.verifyLeaseCertificate(cert);
+        return false;
+    }
+}

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+export type { UnavailableReason, SigningIndices, LeaseStatus, TreeWatermark, WotsWatermarkState, LeaseCertificate, LeaseReservation, ReserveParams, LocalWatermark, ConflictRecord, SyncResult, WotsLeaseProvider, JournalEntry, DeviceKeyRange, PersonalLeaseNodeConfig, } from './types.js';
+export { WotsWatermarkStore, flatIndex, fromFlatIndex, } from './watermark.js';
+export { LeaseJournal } from './journal.js';
+export { LocalLeaseProvider } from './local.js';
+export { AxiaLeaseProvider } from './axia.js';
+export type { AxiaLeaseProviderConfig } from './axia.js';
+export { HybridLeaseProvider } from './hybrid.js';
+export type { HybridLeaseProviderConfig } from './hybrid.js';
+export { PersonalLeaseNodeProvider, P2PQuorumLeaseProvider, OnchainWatermarkProvider, } from './stubs.js';
+export { allocateDeviceRange, deviceSlotForAddressIndex } from './device.js';
+export { WatermarkMonotonicityError, WatermarkExhaustedError, LeaseNotFoundError, PersonalLeaseNodeNotConfiguredError, P2PQuorumNotImplementedError, OnchainWatermarkNotImplementedError, DeviceRangeViolationError, } from './errors.js';

package/dist/index.js

@@ -0,0 +1,8 @@
+export { WotsWatermarkStore, flatIndex, fromFlatIndex, } from './watermark.js';
+export { LeaseJournal } from './journal.js';
+export { LocalLeaseProvider } from './local.js';
+export { AxiaLeaseProvider } from './axia.js';
+export { HybridLeaseProvider } from './hybrid.js';
+export { PersonalLeaseNodeProvider, P2PQuorumLeaseProvider, OnchainWatermarkProvider, } from './stubs.js';
+export { allocateDeviceRange, deviceSlotForAddressIndex } from './device.js';
+export { WatermarkMonotonicityError, WatermarkExhaustedError, LeaseNotFoundError, PersonalLeaseNodeNotConfiguredError, P2PQuorumNotImplementedError, OnchainWatermarkNotImplementedError, DeviceRangeViolationError, } from './errors.js';

package/dist/journal.d.ts

@@ -0,0 +1,19 @@
+/**
+ * LeaseJournal — append-only audit log for WOTS key-use events.
+ * Preserves the full history: reserved → committed | burned | reserved-expired.
+ */
+import type { StorageAdapter, LoggerAdapter } from '@totemsdk/core';
+import type { JournalEntry } from './types.js';
+export declare class LeaseJournal {
+    private readonly storage;
+    private readonly logger;
+    private entries;
+    private _initialized;
+    constructor(storage: StorageAdapter, logger?: LoggerAdapter);
+    initialize(): Promise<void>;
+    append(entry: JournalEntry): Promise<void>;
+    getAll(): JournalEntry[];
+    getByTree(treeId: string): JournalEntry[];
+    getByReservation(reservationId: string): JournalEntry | undefined;
+    clear(): Promise<void>;
+}

package/dist/journal.js

@@ -0,0 +1,39 @@
+/**
+ * LeaseJournal — append-only audit log for WOTS key-use events.
+ * Preserves the full history: reserved → committed | burned | reserved-expired.
+ */
+import { NoopLogger } from '@totemsdk/core';
+const STORAGE_KEY = 'totem_wots_journal';
+export class LeaseJournal {
+    constructor(storage, logger = new NoopLogger()) {
+        this.storage = storage;
+        this.logger = logger;
+        this.entries = [];
+        this._initialized = false;
+    }
+    async initialize() {
+        if (this._initialized)
+            return;
+        const stored = await this.storage.get(STORAGE_KEY);
+        this.entries = stored ?? [];
+        this._initialized = true;
+    }
+    async append(entry) {
+        this.entries.push(entry);
+        await this.storage.set(STORAGE_KEY, this.entries);
+        this.logger.debug(`[LeaseJournal] ${entry.status} treeId=${entry.treeId} idx=${entry.wotsIndex} txId=${entry.txId ?? '-'}`);
+    }
+    getAll() {
+        return [...this.entries];
+    }
+    getByTree(treeId) {
+        return this.entries.filter((e) => e.treeId === treeId);
+    }
+    getByReservation(reservationId) {
+        return [...this.entries].reverse().find((e) => e.reservationId === reservationId);
+    }
+    async clear() {
+        this.entries = [];
+        await this.storage.remove(STORAGE_KEY);
+    }
+}

package/dist/local.d.ts

@@ -0,0 +1,29 @@
+/**
+ * LocalLeaseProvider — Layer 1: local durable ledger.
+ *
+ * Single-device, no network coordination.
+ * All WOTS safety guaranteed by the local WotsWatermarkStore + LeaseJournal.
+ */
+import type { StorageAdapter, LoggerAdapter } from '@totemsdk/core';
+import type { WotsLeaseProvider, ReserveParams, LeaseReservation, LeaseCertificate, LocalWatermark, SyncResult } from './types.js';
+export declare class LocalLeaseProvider implements WotsLeaseProvider {
+    private readonly logger;
+    private readonly watermark;
+    private readonly leaseStore;
+    private readonly journal;
+    private _initialized;
+    private readonly deviceId;
+    /** In-memory map: reservationId → treeId (lost on restart; watermark survives). */
+    private readonly _treeIdByReservation;
+    constructor(storage: StorageAdapter, logger?: LoggerAdapter, deviceId?: string);
+    initialize(): Promise<void>;
+    private recoverExpiredReservations;
+    reserveKeyUse(params: ReserveParams): Promise<LeaseReservation>;
+    commitKeyUse(reservationId: string, txId: string): Promise<void>;
+    burnReservation(reservationId: string, reason: string): Promise<void>;
+    getLocalWatermark(treeId: string): Promise<LocalWatermark>;
+    publishWatermark(_treeId: string): Promise<void>;
+    syncLeaseJournal(): Promise<SyncResult>;
+    verifyLeaseCertificate(cert?: LeaseCertificate): Promise<boolean>;
+    private getDeviceRange;
+}

package/dist/local.js

@@ -0,0 +1,163 @@
+/**
+ * LocalLeaseProvider — Layer 1: local durable ledger.
+ *
+ * Single-device, no network coordination.
+ * All WOTS safety guaranteed by the local WotsWatermarkStore + LeaseJournal.
+ */
+import { NoopLogger } from '@totemsdk/core';
+import { LeaseStore } from '@totemsdk/core';
+import { WotsWatermarkStore, flatIndex } from './watermark.js';
+import { LeaseJournal } from './journal.js';
+import { LeaseNotFoundError, DeviceRangeViolationError } from './errors.js';
+function randomId() {
+    if (typeof crypto !== 'undefined' && crypto.randomUUID) {
+        return crypto.randomUUID();
+    }
+    return Math.random().toString(36).slice(2) + Date.now().toString(36);
+}
+export class LocalLeaseProvider {
+    constructor(storage, logger = new NoopLogger(), deviceId = 'local') {
+        this.logger = logger;
+        this._initialized = false;
+        /** In-memory map: reservationId → treeId (lost on restart; watermark survives). */
+        this._treeIdByReservation = new Map();
+        this.watermark = new WotsWatermarkStore(storage, logger);
+        this.leaseStore = new LeaseStore(storage, logger);
+        this.journal = new LeaseJournal(storage, logger);
+        this.deviceId = deviceId;
+    }
+    async initialize() {
+        if (this._initialized)
+            return;
+        await this.watermark.initialize();
+        await this.leaseStore.initialize();
+        await this.journal.initialize();
+        await this.recoverExpiredReservations();
+        this._initialized = true;
+    }
+    async recoverExpiredReservations() {
+        const now = Date.now();
+        for (const lease of this.leaseStore.getAll()) {
+            if (lease.status === 'active' && lease.expiresAt < now) {
+                const treeId = this._treeIdByReservation.get(lease.leaseId) ?? 'default';
+                await this.watermark.markUnavailable(treeId, lease.indices, 'reserved-expired');
+                await this.leaseStore.updateStatus(lease.leaseId, 'expired');
+                await this.journal.append({
+                    treeId,
+                    branchId: 'default',
+                    wotsIndex: flatIndex(lease.indices),
+                    indices: lease.indices,
+                    status: 'reserved-expired',
+                    timestamp: now,
+                    deviceId: this.deviceId,
+                });
+            }
+        }
+    }
+    async reserveKeyUse(params) {
+        if (!this._initialized)
+            await this.initialize();
+        const treeId = params.treeId;
+        const ttlMs = params.ttlMs ?? 120000;
+        const indices = this.watermark.getNextIndices(treeId);
+        if (params.deviceId) {
+            const range = this.getDeviceRange(params.deviceId);
+            if (range && (indices.addressIndex < range.start || indices.addressIndex > range.end)) {
+                throw new DeviceRangeViolationError(indices.addressIndex, range.start, range.end);
+            }
+        }
+        const reservationId = randomId();
+        const expiresAt = Date.now() + ttlMs;
+        const lease = {
+            leaseId: reservationId,
+            leaseToken: reservationId,
+            indices,
+            expiresAt,
+            status: 'active',
+            createdAt: Date.now(),
+            leaseTTL: ttlMs,
+        };
+        await this.leaseStore.save(lease);
+        // Track treeId in memory so commit/burn can reference the right watermark tree
+        this._treeIdByReservation.set(reservationId, treeId);
+        await this.journal.append({
+            treeId,
+            branchId: params.branchId ?? 'default',
+            wotsIndex: flatIndex(indices),
+            indices,
+            status: 'reserved',
+            payloadHash: params.payloadHash,
+            timestamp: Date.now(),
+            deviceId: params.deviceId ?? this.deviceId,
+        });
+        return { reservationId, indices, expiresAt };
+    }
+    async commitKeyUse(reservationId, txId) {
+        if (!this._initialized)
+            await this.initialize();
+        const lease = this.leaseStore.get(reservationId);
+        if (!lease)
+            throw new LeaseNotFoundError(reservationId);
+        const treeId = this._treeIdByReservation.get(reservationId) ?? 'default';
+        const indices = lease.indices;
+        await this.watermark.markUnavailable(treeId, indices, 'committed');
+        await this.leaseStore.updateStatus(reservationId, 'finalized');
+        this._treeIdByReservation.delete(reservationId);
+        await this.journal.append({
+            treeId,
+            branchId: 'default',
+            wotsIndex: flatIndex(indices),
+            indices,
+            status: 'committed',
+            txId,
+            timestamp: Date.now(),
+            deviceId: this.deviceId,
+        });
+    }
+    async burnReservation(reservationId, reason) {
+        if (!this._initialized)
+            await this.initialize();
+        const lease = this.leaseStore.get(reservationId);
+        if (!lease)
+            throw new LeaseNotFoundError(reservationId);
+        const treeId = this._treeIdByReservation.get(reservationId) ?? 'default';
+        const indices = lease.indices;
+        await this.watermark.markUnavailable(treeId, indices, 'burned');
+        await this.leaseStore.updateStatus(reservationId, 'cancelled');
+        this._treeIdByReservation.delete(reservationId);
+        this.logger.warn(`[LocalLeaseProvider] Burning reservation ${reservationId}: ${reason}`);
+        await this.journal.append({
+            treeId,
+            branchId: 'default',
+            wotsIndex: flatIndex(indices),
+            indices,
+            status: 'burned',
+            timestamp: Date.now(),
+            deviceId: this.deviceId,
+        });
+    }
+    async getLocalWatermark(treeId) {
+        if (!this._initialized)
+            await this.initialize();
+        return this.watermark.getLocalWatermark(treeId);
+    }
+    async publishWatermark(_treeId) {
+        // Layer 1: no-op
+    }
+    async syncLeaseJournal() {
+        // Layer 1: no-op
+        return { synced: true, conflicts: [] };
+    }
+    async verifyLeaseCertificate(cert) {
+        if (cert === undefined)
+            return true;
+        return false;
+    }
+    getDeviceRange(deviceId) {
+        const match = deviceId.match(/^device-?(\d+)$/i);
+        if (!match)
+            return null;
+        const slot = parseInt(match[1], 10);
+        return { start: slot * 8, end: slot * 8 + 7 };
+    }
+}