@totemsdk/wots-lease 0.1.6 → 1.0.1

package/dist/axia.d.ts

@@ -29,5 +29,5 @@ export declare class AxiaLeaseProvider implements WotsLeaseProvider {
     getLocalWatermark(treeId: string): Promise<LocalWatermark>;
     publishWatermark(_treeId: string): Promise<void>;
     syncLeaseJournal(): Promise<SyncResult>;
-    verifyLeaseCertificate(cert?: LeaseCertificate): Promise<boolean>;
+    verifyLeaseCertificate(_cert?: LeaseCertificate): Promise<boolean>;
 }

package/dist/axia.js

@@ -11,6 +11,7 @@ const core_2 = require("@totemsdk/core");
 const watermark_js_1 = require("./watermark.js");
 const journal_js_1 = require("./journal.js");
 const errors_js_1 = require("./errors.js");
+const errors_1 = require("@totemsdk/storage/errors");
 class AxiaLeaseProvider {
     constructor(config) {
         this._initialized = false;
@@ -42,6 +43,12 @@ class AxiaLeaseProvider {
             ttlMs: params.ttlMs ?? 120000,
         });
         const indices = resp.lease;
+        // RFC-020 C2: never accept an index this tree has already consumed, even if
+        // a replaying/hostile lease server hands the same slot out again.
+        await this.watermark.refresh();
+        if (this.watermark.isUnavailable(params.treeId, indices)) {
+            throw new errors_js_1.IndicesUnavailableError(params.treeId, indices);
+        }
         const expiresAt = Date.now() + (params.ttlMs ?? 120000);
         const reservationId = resp.txId;
         const lease = {
@@ -75,10 +82,16 @@ class AxiaLeaseProvider {
             throw new errors_js_1.LeaseNotFoundError(reservationId);
         await (0, core_2.finalizeLease)(this.apiUrl, this.apiKey, lease.leaseToken, txId);
         const indices = lease.indices;
-        await this.watermark.markUnavailable(lease.indices.addressIndex.toString(), indices, 'committed');
+        // RFC-020 C2: key the watermark/journal by the real treeId, never the
+        // reservation id.
+        const treeId = lease.treeId;
+        if (!treeId) {
+            throw new errors_1.StorageError(`AxiaLeaseProvider: lease ${reservationId} has no treeId`, 'corrupt');
+        }
+        await this.watermark.markUnavailable(treeId, indices, 'committed');
         await this.leaseStore.updateStatus(reservationId, 'finalized');
         await this.journal.append({
-            treeId: reservationId,
+            treeId,
             branchId: 'default',
             wotsIndex: (0, watermark_js_1.flatIndex)(indices),
             indices,
@@ -95,11 +108,15 @@ class AxiaLeaseProvider {
         if (!lease)
             throw new errors_js_1.LeaseNotFoundError(reservationId);
         const indices = lease.indices;
-        await this.watermark.markUnavailable(lease.indices.addressIndex.toString(), indices, 'burned');
+        const treeId = lease.treeId;
+        if (!treeId) {
+            throw new errors_1.StorageError(`AxiaLeaseProvider: lease ${reservationId} has no treeId`, 'corrupt');
+        }
+        await this.watermark.markUnavailable(treeId, indices, 'burned');
         await this.leaseStore.updateStatus(reservationId, 'cancelled');
         this.logger.warn(`[AxiaLeaseProvider] Burning reservation ${reservationId}: ${reason}`);
         await this.journal.append({
-            treeId: reservationId,
+            treeId,
             branchId: 'default',
             wotsIndex: (0, watermark_js_1.flatIndex)(indices),
             indices,
@@ -119,9 +136,9 @@ class AxiaLeaseProvider {
     async syncLeaseJournal() {
         return { synced: true, conflicts: [] };
     }
-    async verifyLeaseCertificate(cert) {
-        if (cert === undefined)
-            return true;
+    async verifyLeaseCertificate(_cert) {
+        // RFC-020 C2: the Axia API does not return a server-signed certificate we
+        // can verify, so fail closed rather than asserting a trust we cannot prove.
         return false;
     }
 }

package/dist/certificate.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Shared helpers for authenticating lease certificates.
+ *
+ * A certificate is authenticated by a real signature over a canonical,
+ * deterministic byte encoding of its content. Providers that hold an issuing
+ * identity (`certificateSigner`, or the watermark coin owner on Layer 5) sign
+ * the payload before returning the certificate. Verification FAILS CLOSED:
+ * a certificate is rejected unless the caller supplies a `verify()` function
+ * and the signature cryptographically verifies against it. An empty signature,
+ * an absent verifier, or an identity without a verifier are all rejections —
+ * `issuedBy` alone is never treated as authenticity evidence.
+ */
+import type { CertificateSigner, LeaseCertificate } from './types.js';
+/**
+ * Canonical byte encoding of a certificate's bindable content.
+ *
+ * Any change to a bound field changes the message, so a certificate cannot
+ * be re-targeted at a different reservation, device, purpose, or expiry.
+ */
+export declare function canonicalCertificateMessage(cert: Pick<LeaseCertificate, 'treeId' | 'branchId' | 'deviceId' | 'indices' | 'purpose' | 'payloadHash' | 'reservationId' | 'issuedBy' | 'issuedAt' | 'expiresAt'>): Uint8Array;
+/** Sign a certificate via the issuer identity, returning hex of the signature. */
+export declare function signCertificate(signer: {
+    sign(message: Uint8Array): Promise<Uint8Array>;
+}, cert: Parameters<typeof canonicalCertificateMessage>[0]): Promise<string>;
+/**
+ * Verify a certificate's signature.
+ *
+ * Fails closed (AUD-016):
+ * - Empty/malformed signature -> false (an unsigned certificate is not
+ *   authenticity evidence regardless of what issuedBy claims).
+ * - No `signer`, or a `signer` without a `verify()` function -> false. Knowing
+ *   only an identity (e.g. a public key digest) cannot authenticate a
+ *   signature; a verifier is required.
+ * - Otherwise the signature must cryptographically verify against the
+ *   supplied verifier.
+ */
+export declare function certificateSignatureVerified(cert: LeaseCertificate, signer?: CertificateSigner): Promise<boolean>;

package/dist/certificate.js

@@ -0,0 +1,74 @@
+"use strict";
+/**
+ * Shared helpers for authenticating lease certificates.
+ *
+ * A certificate is authenticated by a real signature over a canonical,
+ * deterministic byte encoding of its content. Providers that hold an issuing
+ * identity (`certificateSigner`, or the watermark coin owner on Layer 5) sign
+ * the payload before returning the certificate. Verification FAILS CLOSED:
+ * a certificate is rejected unless the caller supplies a `verify()` function
+ * and the signature cryptographically verifies against it. An empty signature,
+ * an absent verifier, or an identity without a verifier are all rejections —
+ * `issuedBy` alone is never treated as authenticity evidence.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.canonicalCertificateMessage = canonicalCertificateMessage;
+exports.signCertificate = signCertificate;
+exports.certificateSignatureVerified = certificateSignatureVerified;
+const core_1 = require("@totemsdk/core");
+/**
+ * Canonical byte encoding of a certificate's bindable content.
+ *
+ * Any change to a bound field changes the message, so a certificate cannot
+ * be re-targeted at a different reservation, device, purpose, or expiry.
+ */
+function canonicalCertificateMessage(cert) {
+    const encoded = new TextEncoder().encode([
+        'TOTEM-LEASECERT',
+        'v1',
+        cert.issuedBy ?? '',
+        cert.treeId ?? '',
+        cert.branchId ?? '',
+        cert.deviceId ?? '',
+        cert.reservationId ?? '',
+        String(cert.indices?.addressIndex ?? 0),
+        String(cert.indices?.l1 ?? 0),
+        String(cert.indices?.l2 ?? 0),
+        cert.purpose ?? '',
+        cert.payloadHash ?? '',
+        String(cert.issuedAt ?? 0),
+        String(cert.expiresAt ?? 0),
+    ].join('\x1f'));
+    return (0, core_1.sha3_256)(encoded);
+}
+/** Sign a certificate via the issuer identity, returning hex of the signature. */
+async function signCertificate(signer, cert) {
+    return (0, core_1.bytesToHex)(await signer.sign(canonicalCertificateMessage(cert)));
+}
+/**
+ * Verify a certificate's signature.
+ *
+ * Fails closed (AUD-016):
+ * - Empty/malformed signature -> false (an unsigned certificate is not
+ *   authenticity evidence regardless of what issuedBy claims).
+ * - No `signer`, or a `signer` without a `verify()` function -> false. Knowing
+ *   only an identity (e.g. a public key digest) cannot authenticate a
+ *   signature; a verifier is required.
+ * - Otherwise the signature must cryptographically verify against the
+ *   supplied verifier.
+ */
+async function certificateSignatureVerified(cert, signer) {
+    if (typeof cert.signature !== 'string' || cert.signature.length === 0) {
+        return false;
+    }
+    if (!signer?.verify)
+        return false;
+    let sig;
+    try {
+        sig = (0, core_1.hexToBytes)(cert.signature);
+    }
+    catch {
+        return false;
+    }
+    return signer.verify(canonicalCertificateMessage(cert), sig);
+}

package/dist/errors.d.ts

@@ -2,6 +2,26 @@ import type { SigningIndices } from './types.js';
 export declare class WatermarkMonotonicityError extends Error {
     constructor(message: string);
 }
+/**
+ * Raised when seeding would move the local watermark cursor backwards. This is
+ * the fail-closed guard against restoring a wallet below its true high-water
+ * mark and reusing a WOTS leaf (RFC-013 §9).
+ */
+export declare class WatermarkSeedRegressionError extends Error {
+    readonly treeId: string;
+    readonly currentCursor: number;
+    readonly seedCursor: number;
+    constructor(treeId: string, currentCursor: number, seedCursor: number);
+}
+/**
+ * Raised when a restore/import has no usable watermark source and the caller has
+ * not declared the keyspace fresh. Failing closed is required: starting at 0
+ * would reissue spent leaves (RFC-013 §9).
+ */
+export declare class WatermarkSeedRequiredError extends Error {
+    readonly treeId: string;
+    constructor(treeId: string);
+}
 export declare class WatermarkExhaustedError extends Error {
     readonly treeId: string;
     constructor(treeId: string);
@@ -10,6 +30,12 @@ export declare class LeaseNotFoundError extends Error {
     readonly reservationId: string;
     constructor(reservationId: string);
 }
+export declare class InvalidLeaseTransitionError extends Error {
+    readonly reservationId: string;
+    readonly currentStatus: string;
+    readonly requestedStatus: string;
+    constructor(reservationId: string, currentStatus: string, requestedStatus: string);
+}
 export declare class IndicesUnavailableError extends Error {
     readonly treeId: string;
     readonly indices: SigningIndices;

package/dist/errors.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DeviceRangeViolationError = exports.OnchainWatermarkError = exports.QuorumConflictError = exports.QuorumUnavailableError = exports.OnchainWatermarkNotImplementedError = exports.P2PQuorumNotImplementedError = exports.PersonalLeaseNodeNotConfiguredError = exports.IndicesUnavailableError = exports.LeaseNotFoundError = exports.WatermarkExhaustedError = exports.WatermarkMonotonicityError = void 0;
+exports.DeviceRangeViolationError = exports.OnchainWatermarkError = exports.QuorumConflictError = exports.QuorumUnavailableError = exports.OnchainWatermarkNotImplementedError = exports.P2PQuorumNotImplementedError = exports.PersonalLeaseNodeNotConfiguredError = exports.IndicesUnavailableError = exports.InvalidLeaseTransitionError = exports.LeaseNotFoundError = exports.WatermarkExhaustedError = exports.WatermarkSeedRequiredError = exports.WatermarkSeedRegressionError = exports.WatermarkMonotonicityError = void 0;
 class WatermarkMonotonicityError extends Error {
     constructor(message) {
         super(message);
@@ -8,6 +8,37 @@ class WatermarkMonotonicityError extends Error {
     }
 }
 exports.WatermarkMonotonicityError = WatermarkMonotonicityError;
+/**
+ * Raised when seeding would move the local watermark cursor backwards. This is
+ * the fail-closed guard against restoring a wallet below its true high-water
+ * mark and reusing a WOTS leaf (RFC-013 §9).
+ */
+class WatermarkSeedRegressionError extends Error {
+    constructor(treeId, currentCursor, seedCursor) {
+        super(`Refusing to seed watermark for ${treeId} below the current cursor ` +
+            `(${seedCursor} < ${currentCursor}); this would re-expose used WOTS leaves.`);
+        this.treeId = treeId;
+        this.currentCursor = currentCursor;
+        this.seedCursor = seedCursor;
+        this.name = 'WatermarkSeedRegressionError';
+    }
+}
+exports.WatermarkSeedRegressionError = WatermarkSeedRegressionError;
+/**
+ * Raised when a restore/import has no usable watermark source and the caller has
+ * not declared the keyspace fresh. Failing closed is required: starting at 0
+ * would reissue spent leaves (RFC-013 §9).
+ */
+class WatermarkSeedRequiredError extends Error {
+    constructor(treeId) {
+        super(`No watermark source available for ${treeId}. Provide an on-chain cursor, an ` +
+            'exported watermark, or an operator high-water mark — or declare the keyspace fresh. ' +
+            'Refusing to start at 0.');
+        this.treeId = treeId;
+        this.name = 'WatermarkSeedRequiredError';
+    }
+}
+exports.WatermarkSeedRequiredError = WatermarkSeedRequiredError;
 class WatermarkExhaustedError extends Error {
     constructor(treeId) {
         super(`WOTS keyspace exhausted for tree: ${treeId}`);
@@ -24,6 +55,16 @@ class LeaseNotFoundError extends Error {
     }
 }
 exports.LeaseNotFoundError = LeaseNotFoundError;
+class InvalidLeaseTransitionError extends Error {
+    constructor(reservationId, currentStatus, requestedStatus) {
+        super(`Cannot transition lease ${reservationId} from ${currentStatus} to ${requestedStatus}`);
+        this.reservationId = reservationId;
+        this.currentStatus = currentStatus;
+        this.requestedStatus = requestedStatus;
+        this.name = 'InvalidLeaseTransitionError';
+    }
+}
+exports.InvalidLeaseTransitionError = InvalidLeaseTransitionError;
 class IndicesUnavailableError extends Error {
     constructor(treeId, indices) {
         super(`Indices (${indices.addressIndex}, ${indices.l1}, ${indices.l2}) are already unavailable for tree: ${treeId}`);

package/dist/hybrid.d.ts

@@ -4,7 +4,7 @@
  * Always uses local first, then gates on node cert and/or quorum attestation
  * for transactions above a configurable value threshold.
  */
-import type { WotsLeaseProvider, ReserveParams, LeaseReservation, LeaseCertificate, LocalWatermark, SyncResult } from './types.js';
+import type { WotsLeaseProvider, ReserveParams, LeaseReservation, LeaseCertificate, LocalWatermark, SyncResult, CertificateSigner } from './types.js';
 import type { LocalLeaseProvider } from './local.js';
 import type { PersonalLeaseNodeProvider } from './stubs.js';
 import type { P2PQuorumLeaseProvider } from './stubs.js';
@@ -15,6 +15,8 @@ export interface HybridLeaseProviderConfig {
     quorum?: P2PQuorumLeaseProvider;
     onchain?: OnchainWatermarkProvider;
     threshold?: number;
+    /** Identity that authenticates locally-assembled quorum certificates. */
+    certificateSigner?: CertificateSigner;
 }
 export declare class HybridLeaseProvider implements WotsLeaseProvider {
     private readonly local;
@@ -22,6 +24,7 @@ export declare class HybridLeaseProvider implements WotsLeaseProvider {
     private readonly quorum?;
     private readonly onchain?;
     private readonly threshold;
+    private readonly certificateSigner?;
     constructor(config: HybridLeaseProviderConfig);
     private isHighValue;
     reserveKeyUse(params: ReserveParams): Promise<LeaseReservation>;

package/dist/hybrid.js

@@ -7,6 +7,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.HybridLeaseProvider = void 0;
+const certificate_js_1 = require("./certificate.js");
 class HybridLeaseProvider {
     constructor(config) {
         this.local = config.local;
@@ -14,6 +15,7 @@ class HybridLeaseProvider {
         this.quorum = config.quorum;
         this.onchain = config.onchain;
         this.threshold = config.threshold ?? Infinity;
+        this.certificateSigner = config.certificateSigner;
     }
     isHighValue(params) {
         if (!params.valueHint)
@@ -22,29 +24,41 @@ class HybridLeaseProvider {
         return !isNaN(val) && val >= this.threshold;
     }
     async reserveKeyUse(params) {
+        // Cross-instance/restore safety (RFC-013 §8/§9): before a high-value
+        // reservation, anchor the local cursor to the on-chain watermark so a second
+        // instance of the same seed cannot be handed a leaf we already used.
+        if (this.isHighValue(params) && this.onchain) {
+            try {
+                await this.onchain.syncLeaseJournal();
+            }
+            catch {
+                // Chain unreachable — local monotonic watermark still guards reuse.
+            }
+        }
         const reservation = await this.local.reserveKeyUse(params);
         if (this.isHighValue(params)) {
             // Layer 4 — quorum attestation over the SAME local slot.
             if (this.quorum) {
                 try {
                     const attestations = await this.quorum.attestKeyUse(params, reservation.indices);
-                    return {
-                        ...reservation,
-                        certificate: {
-                            reservationId: reservation.reservationId,
-                            treeId: params.treeId,
-                            branchId: params.branchId,
-                            deviceId: params.deviceId,
-                            indices: reservation.indices,
-                            purpose: params.purpose,
-                            payloadHash: params.payloadHash,
-                            issuedBy: 'p2p-quorum',
-                            issuedAt: Date.now(),
-                            expiresAt: reservation.expiresAt,
-                            signature: '',
-                            attestations,
-                        },
+                    const certificate = {
+                        reservationId: reservation.reservationId,
+                        treeId: params.treeId,
+                        branchId: params.branchId,
+                        deviceId: params.deviceId,
+                        indices: reservation.indices,
+                        purpose: params.purpose,
+                        payloadHash: params.payloadHash,
+                        issuedBy: this.certificateSigner?.name ?? 'p2p-quorum',
+                        issuedAt: Date.now(),
+                        expiresAt: reservation.expiresAt,
+                        signature: '',
+                        attestations,
                     };
+                    certificate.signature = this.certificateSigner
+                        ? await (0, certificate_js_1.signCertificate)(this.certificateSigner, certificate)
+                        : '';
+                    return { ...reservation, certificate };
                 }
                 catch {
                     // Quorum unavailable — fall through to node / local only.
@@ -72,21 +86,57 @@ class HybridLeaseProvider {
     getLocalWatermark(treeId) {
         return this.local.getLocalWatermark(treeId);
     }
-    publishWatermark(treeId) {
+    async publishWatermark(treeId) {
+        // Anchor to the chain first (authoritative cross-instance cursor), then the
+        // personal node, then the local no-op.
+        if (this.onchain) {
+            try {
+                await this.onchain.publishWatermark(treeId);
+                return;
+            }
+            catch {
+                // fall through
+            }
+        }
         if (this.node) {
-            return this.node.publishWatermark(treeId).catch(() => this.local.publishWatermark(treeId));
+            try {
+                await this.node.publishWatermark(treeId);
+                return;
+            }
+            catch {
+                // fall through
+            }
         }
-        return this.local.publishWatermark(treeId);
+        await this.local.publishWatermark(treeId);
     }
-    syncLeaseJournal() {
+    async syncLeaseJournal() {
+        // Read the authoritative on-chain cursor first so a restore/second instance
+        // advances past every leaf published by anyone holding this seed.
+        if (this.onchain) {
+            try {
+                return await this.onchain.syncLeaseJournal();
+            }
+            catch {
+                // fall through
+            }
+        }
         if (this.node) {
-            return this.node.syncLeaseJournal().catch(() => this.local.syncLeaseJournal());
+            try {
+                return await this.node.syncLeaseJournal();
+            }
+            catch {
+                // fall through
+            }
         }
         return this.local.syncLeaseJournal();
     }
     async verifyLeaseCertificate(cert) {
         if (!cert)
             return this.local.verifyLeaseCertificate(cert);
+        // Locally-assembled quorum certificates authenticate against our issuer.
+        if (cert.issuedBy === (this.certificateSigner?.name ?? 'p2p-quorum')) {
+            return (0, certificate_js_1.certificateSignatureVerified)(cert, this.certificateSigner);
+        }
         if (this.node)
             return this.node.verifyLeaseCertificate(cert);
         return false;

package/dist/index.d.ts

@@ -1,7 +1,9 @@
-export type { UnavailableReason, SigningIndices, LeaseStatus, TreeWatermark, WotsWatermarkState, LeaseCertificate, LeaseReservation, ReserveParams, LocalWatermark, ConflictRecord, SyncResult, WotsLeaseProvider, JournalEntry, DeviceKeyRange, PersonalLeaseNodeConfig, QuorumAttestation, QuorumPeer, P2PQuorumLeaseProviderConfig, OnchainWatermarkProviderConfig, } from './types.js';
+export type { UnavailableReason, SigningIndices, LeaseStatus, TreeWatermark, WotsWatermarkState, LeaseCertificate, LeaseReservation, ReserveParams, LocalWatermark, WatermarkSeed, SeedWatermarkOptions, ConflictRecord, SyncResult, WotsLeaseProvider, JournalEntry, DeviceKeyRange, PersonalLeaseNodeConfig, QuorumAttestation, QuorumPeer, CertificateSigner, P2PQuorumLeaseProviderConfig, OnchainWatermarkProviderConfig, } from './types.js';
 export { WotsWatermarkStore, flatIndex, fromFlatIndex, } from './watermark.js';
 export { LeaseJournal } from './journal.js';
 export { LocalLeaseProvider } from './local.js';
+export { seedLeaseWatermark, exportLeaseWatermark } from './seed.js';
+export type { SeedLeaseWatermarkParams } from './seed.js';
 export { AxiaLeaseProvider } from './axia.js';
 export type { AxiaLeaseProviderConfig } from './axia.js';
 export { HybridLeaseProvider } from './hybrid.js';
@@ -10,4 +12,4 @@ export { PersonalLeaseNodeProvider, P2PQuorumLeaseProvider, OnchainWatermarkProv
 export { P2PQuorumLeaseProvider as QuorumLeaseProvider } from './quorum.js';
 export { OnchainWatermarkProvider as ChainWatermarkProvider } from './onchain.js';
 export { allocateDeviceRange, deviceSlotForAddressIndex } from './device.js';
-export { WatermarkMonotonicityError, WatermarkExhaustedError, LeaseNotFoundError, IndicesUnavailableError, PersonalLeaseNodeNotConfiguredError, P2PQuorumNotImplementedError, OnchainWatermarkNotImplementedError, QuorumUnavailableError, QuorumConflictError, OnchainWatermarkError, DeviceRangeViolationError, } from './errors.js';
+export { WatermarkMonotonicityError, WatermarkExhaustedError, WatermarkSeedRegressionError, WatermarkSeedRequiredError, LeaseNotFoundError, IndicesUnavailableError, PersonalLeaseNodeNotConfiguredError, P2PQuorumNotImplementedError, OnchainWatermarkNotImplementedError, QuorumUnavailableError, QuorumConflictError, OnchainWatermarkError, DeviceRangeViolationError, } from './errors.js';

package/dist/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DeviceRangeViolationError = exports.OnchainWatermarkError = exports.QuorumConflictError = exports.QuorumUnavailableError = exports.OnchainWatermarkNotImplementedError = exports.P2PQuorumNotImplementedError = exports.PersonalLeaseNodeNotConfiguredError = exports.IndicesUnavailableError = exports.LeaseNotFoundError = exports.WatermarkExhaustedError = exports.WatermarkMonotonicityError = exports.deviceSlotForAddressIndex = exports.allocateDeviceRange = exports.ChainWatermarkProvider = exports.QuorumLeaseProvider = exports.OnchainWatermarkProvider = exports.P2PQuorumLeaseProvider = exports.PersonalLeaseNodeProvider = exports.HybridLeaseProvider = exports.AxiaLeaseProvider = exports.LocalLeaseProvider = exports.LeaseJournal = exports.fromFlatIndex = exports.flatIndex = exports.WotsWatermarkStore = void 0;
+exports.DeviceRangeViolationError = exports.OnchainWatermarkError = exports.QuorumConflictError = exports.QuorumUnavailableError = exports.OnchainWatermarkNotImplementedError = exports.P2PQuorumNotImplementedError = exports.PersonalLeaseNodeNotConfiguredError = exports.IndicesUnavailableError = exports.LeaseNotFoundError = exports.WatermarkSeedRequiredError = exports.WatermarkSeedRegressionError = exports.WatermarkExhaustedError = exports.WatermarkMonotonicityError = exports.deviceSlotForAddressIndex = exports.allocateDeviceRange = exports.ChainWatermarkProvider = exports.QuorumLeaseProvider = exports.OnchainWatermarkProvider = exports.P2PQuorumLeaseProvider = exports.PersonalLeaseNodeProvider = exports.HybridLeaseProvider = exports.AxiaLeaseProvider = exports.exportLeaseWatermark = exports.seedLeaseWatermark = exports.LocalLeaseProvider = exports.LeaseJournal = exports.fromFlatIndex = exports.flatIndex = exports.WotsWatermarkStore = void 0;
 var watermark_js_1 = require("./watermark.js");
 Object.defineProperty(exports, "WotsWatermarkStore", { enumerable: true, get: function () { return watermark_js_1.WotsWatermarkStore; } });
 Object.defineProperty(exports, "flatIndex", { enumerable: true, get: function () { return watermark_js_1.flatIndex; } });
@@ -9,6 +9,9 @@ var journal_js_1 = require("./journal.js");
 Object.defineProperty(exports, "LeaseJournal", { enumerable: true, get: function () { return journal_js_1.LeaseJournal; } });
 var local_js_1 = require("./local.js");
 Object.defineProperty(exports, "LocalLeaseProvider", { enumerable: true, get: function () { return local_js_1.LocalLeaseProvider; } });
+var seed_js_1 = require("./seed.js");
+Object.defineProperty(exports, "seedLeaseWatermark", { enumerable: true, get: function () { return seed_js_1.seedLeaseWatermark; } });
+Object.defineProperty(exports, "exportLeaseWatermark", { enumerable: true, get: function () { return seed_js_1.exportLeaseWatermark; } });
 var axia_js_1 = require("./axia.js");
 Object.defineProperty(exports, "AxiaLeaseProvider", { enumerable: true, get: function () { return axia_js_1.AxiaLeaseProvider; } });
 var hybrid_js_1 = require("./hybrid.js");
@@ -27,6 +30,8 @@ Object.defineProperty(exports, "deviceSlotForAddressIndex", { enumerable: true,
 var errors_js_1 = require("./errors.js");
 Object.defineProperty(exports, "WatermarkMonotonicityError", { enumerable: true, get: function () { return errors_js_1.WatermarkMonotonicityError; } });
 Object.defineProperty(exports, "WatermarkExhaustedError", { enumerable: true, get: function () { return errors_js_1.WatermarkExhaustedError; } });
+Object.defineProperty(exports, "WatermarkSeedRegressionError", { enumerable: true, get: function () { return errors_js_1.WatermarkSeedRegressionError; } });
+Object.defineProperty(exports, "WatermarkSeedRequiredError", { enumerable: true, get: function () { return errors_js_1.WatermarkSeedRequiredError; } });
 Object.defineProperty(exports, "LeaseNotFoundError", { enumerable: true, get: function () { return errors_js_1.LeaseNotFoundError; } });
 Object.defineProperty(exports, "IndicesUnavailableError", { enumerable: true, get: function () { return errors_js_1.IndicesUnavailableError; } });
 Object.defineProperty(exports, "PersonalLeaseNodeNotConfiguredError", { enumerable: true, get: function () { return errors_js_1.PersonalLeaseNodeNotConfiguredError; } });

package/dist/journal.d.ts

@@ -1,6 +1,9 @@
 /**
- * LeaseJournal — append-only audit log for WOTS key-use events.
- * Preserves the full history: reserved → committed | burned | reserved-expired.
+ * LeaseJournal — physically append-only audit log for WOTS key-use events.
+ *
+ * Layout v1 stores one immutable record per sequence. The legacy whole-array
+ * key is retained as migration input/forensic history but is never rewritten.
+ * The SHA-256 chain format is intentionally unchanged (RFC-007 OQ3).
  */
 import type { StorageAdapter, LoggerAdapter } from '@totemsdk/core';
 import type { JournalEntry } from './types.js';
@@ -8,11 +11,18 @@ export declare class LeaseJournal {
     private readonly storage;
     private readonly logger;
     private entries;
-    private _initialized;
+    private initialized;
+    private initializePromise;
+    private appendTail;
     constructor(storage: StorageAdapter, logger?: LoggerAdapter);
     initialize(): Promise<void>;
+    private initializeOnce;
+    private readLegacyEntries;
+    private readPhysicalRecords;
+    private writeRecord;
     append(entry: JournalEntry): Promise<void>;
-    private _verifyChain;
+    private appendOne;
+    private ensureInitialized;
     getAll(): JournalEntry[];
     getByTree(treeId: string): JournalEntry[];
     getByReservation(reservationId: string): JournalEntry | undefined;