@useaccord/sdk 0.1.0

package/README.md

@@ -0,0 +1,126 @@
+# @useaccord/sdk
+
+TypeScript SDK for the **VeriDAO Accord** — a Schelling-point arbitration
+primitive on Solana (Anchor). Any program (the _Arbitrable_) files a Dispute
+via CPI; the Accord draws stake-weighted Jurors (Switchboard VRF), collects
+commit-reveal votes, and emits a Ruling the filer reads lazily.
+
+Built on [Solana Kit](https://github.com/anza-xyz/kit) (`@solana/kit`) with a
+[Codama](https://github.com/codama-idl/codama)-generated client + a hand-written
+`Accord` facade. No `@coral-xyz/anchor` runtime, no `@solana/web3.js`.
+
+> **Architecture spec:** [ADR-0010](../apps/docs/docs/adr/0010-sdk-codama-solana-kit-facade.md)
+
+## Install
+
+```bash
+pnpm add @useaccord/sdk @solana/kit
+```
+
+## Quick start
+
+```typescript
+import { Accord } from "@useaccord/sdk";
+import { createKeyPairSignerFromBytes } from "@solana/kit";
+import { readFileSync } from "node:fs";
+
+const signer = await createKeyPairSignerFromBytes(
+  new Uint8Array(JSON.parse(readFileSync("~/.config/solana/id.json", "utf-8"))),
+);
+
+const accord = new Accord({
+  endpoint: process.env.RPC_URL!, // e.g. local validator or Solana RPC
+  signer,
+});
+```
+
+## Arbitrable CPI API
+
+The two-method surface for programs that want dispute resolution:
+
+```typescript
+// File a dispute (the Arbitrable calls this via CPI)
+import { createDispute } from "@useaccord/sdk";
+const { instruction, dispute } = await createDispute(
+  accord.adapter,
+  accord.PROGRAM_ID,
+  { subaccord, filer: payer.address, options: 2, evidenceHash, fee },
+);
+
+// Read the ruling (lazy — returns null until finalized)
+import { fetchDisputeMaybe } from "@useaccord/sdk";
+const disputeAccount = await fetchDisputeMaybe(accord, dispute);
+if (disputeAccount?.exists) {
+  console.log(disputeAccount.data.finalRuling); // bigint | null
+}
+```
+
+## Method groups
+
+The `methods` namespace covers all eight instruction groups. Each returns a Kit
+`Instruction` — the caller signs and sends it.
+
+```typescript
+// Subaccord lifecycle + circuit breaker
+import { createSubaccord, initializePause, pause } from "@useaccord/sdk";
+
+// Staking
+import { stake, unstake } from "@useaccord/sdk";
+
+// Dispute filing
+import { createDispute } from "@useaccord/sdk";
+
+// Snapshot trust (ADR-0009 sortition)
+import {
+  postSnapshot,
+  challengeSnapshot,
+  finalizeSnapshot,
+} from "@useaccord/sdk";
+
+// VRF + draw
+import { requestVrf, draw, resolvePanel } from "@useaccord/sdk";
+
+// Commit-reveal voting
+import { commit, reveal, commitHash } from "@useaccord/sdk";
+
+// Appeals
+import { appeal, claimAppealRefund } from "@useaccord/sdk";
+```
+
+## PDA helpers
+
+```typescript
+import {
+  findSubaccordPda,
+  findDisputePda,
+  findJurorStakePda,
+  findAccordStatePda,
+} from "@useaccord/sdk";
+
+const [pda] = await findSubaccordPda(accord.PROGRAM_ID, creator, domainRef);
+```
+
+## Client-side crypto
+
+The SDK implements the off-chain logic that supports on-chain verification:
+
+- **Commit hash:** `sha256(vote_byte | salt[32] | juror_pubkey[32])` — matches
+  the program's `hashv` on-chain.
+- **Merkle-Sum Tree:** `buildMst` + `proveMembership` + `selectSlot` produce the
+  `JurorMembership` structs the `draw` instruction verifies (ADR-0009).
+- **Panel resolution:** `resolvePanel` retries on collision using the committed
+  VRF, incrementing `draw_attempt` without re-requesting randomness.
+
+## Building from source
+
+```bash
+make codegen   # anchor build --ignore-keys -> IDL -> Codama client
+make sdk       # tsc build the SDK package
+make lint      # typecheck
+```
+
+`src/generated/` is committed; regenerate via `make codegen` after program changes.
+
+## License
+
+MIT

package/dist/accord.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Accord facade — the primary consumer surface for the VeriDAO Accord SDK.
+ *
+ * Composes the generated Codama Kit client with domain-level orchestration.
+ * Method-group modules (`src/methods/*.ts`) are standalone functions that take
+ * the facade's client + args; this class pre-wires delegation to each group.
+ *
+ * @see ADR-0010
+ */
+import { type Address, type Rpc, type SolanaRpcApi, type TransactionSigner } from "@solana/kit";
+import { accordProgram } from "./generated/programs/accord";
+import { type AccordAdapter } from "./adapter.js";
+import { type AccordMethods } from "./methods.js";
+/** A Kit client extended with the Accord plugin. */
+export type AccordClient = ReturnType<ReturnType<typeof accordProgram>>;
+export interface AccordConfig {
+    /** JSON-RPC endpoint (e.g. "http://localhost:8899"). */
+    endpoint: string;
+    /** A Kit TransactionSigner (from wallet.ts or @solana/kit). */
+    signer: TransactionSigner;
+}
+export declare class Accord {
+    /** The canonical Accord program address. */
+    static readonly PROGRAM_ID: Address<"cordhVoshqRV6kzGBmM89A66wuusJGsDCvLMHPLyKed">;
+    readonly rpc: Rpc<SolanaRpcApi>;
+    readonly signer: TransactionSigner;
+    readonly client: AccordClient;
+    private _adapter?;
+    constructor(config: AccordConfig);
+    /**
+     * The concrete seam adapter — implements all seven `Accord*Client` seams
+     * against the generated Codama client. Pass to the pure orchestration
+     * functions in `src/methods/*.ts`, or use {@link methods} for bound helpers.
+     */
+    get adapter(): AccordAdapter;
+    /**
+     * Bound orchestration namespace covering all eight method groups. Each helper
+     * validates (pure) + builds the instruction via {@link adapter}; the caller
+     * signs + sends the returned `Instruction` with `this.signer`.
+     */
+    get methods(): AccordMethods;
+}
+//# sourceMappingURL=accord.d.ts.map

package/dist/accord.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accord.d.ts","sourceRoot":"","sources":["../src/accord.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAEL,KAAK,OAAO,EACZ,KAAK,GAAG,EACR,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACvB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,aAAa,EAGd,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AACvE,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAEvE,oDAAoD;AACpD,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC;AAExE,MAAM,WAAW,YAAY;IAC3B,wDAAwD;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,+DAA+D;IAC/D,MAAM,EAAE,iBAAiB,CAAC;CAC3B;AAED,qBAAa,MAAM;IACjB,4CAA4C;IAC5C,MAAM,CAAC,QAAQ,CAAC,UAAU,yDAAqB;IAE/C,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAE9B,OAAO,CAAC,QAAQ,CAAC,CAAgB;gBAErB,MAAM,EAAE,YAAY;IAWhC;;;;OAIG;IACH,IAAI,OAAO,IAAI,aAAa,CAG3B;IAED;;;;OAIG;IACH,IAAI,OAAO,IAAI,aAAa,CAE3B;CACF"}

package/dist/adapter.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Concrete adapter — wires every `Accord*Client` seam (declared by the
+ * `src/methods/*.ts` modules) to the Codama-generated Solana Kit client.
+ *
+ * The method modules stay pure orchestration over typed seams; this module is
+ * the single implementor the {@link Accord} facade binds. Each seam method maps
+ * 1:1 to a generated `getXxxInstruction` builder (sync, all-explicit accounts)
+ * or to a generated account fetcher, so a drift in the IDL surfaces here as a
+ * compile error — exactly the ADR-0010 guarantee.
+ *
+ * ADR-0012: the snapshot trio (post/challenge/finalize) and the one-shot `draw`
+ * are gone; `stake`/`unstake` thread an accumulator `path`; `draw_seat` fills
+ * the panel one seat per tx against `dispute.frozen_root`; `commit_vrf_callback`
+ * (invoked by the oracle) freezes the root.
+ *
+ * Signing model: the facade's loaded wallet (`accord.signer`) is the
+ * `TransactionSigner` for every instruction's signing account.
+ *
+ * @see ADR-0010, ADR-0012
+ */
+import type { Accord } from "./accord.js";
+import type { AccordAppealClient } from "./methods/appeal.js";
+import type { AccordDisputeClient } from "./methods/dispute.js";
+import type { AccordLifecycleClient } from "./methods/lifecycle.js";
+import type { AccordStakingClient } from "./methods/staking.js";
+import type { AccordSettlementClient } from "./methods/settlement.js";
+import type { AccordVotingClient, VotingAccounts } from "./methods/voting.js";
+import type { AccordVrfClient, SeatMembership, VrfDrawAccounts } from "./methods/vrf.js";
+/** Union of every seam the adapter implements. */
+export interface AccordAdapter extends AccordDisputeClient, AccordLifecycleClient, AccordStakingClient, AccordSettlementClient, AccordVrfClient, AccordVotingClient, AccordAppealClient {
+}
+/**
+ * Build the concrete adapter bound to an {@link Accord} facade instance. The
+ * returned object satisfies all six `Accord*Client` seams, so the pure
+ * orchestration functions in `src/methods/*.ts` can drive the chain end-to-end.
+ */
+export declare function createAccordAdapter(accord: Accord): AccordAdapter;
+export type { SeatMembership, VrfDrawAccounts, VotingAccounts };
+//# sourceMappingURL=adapter.d.ts.map

package/dist/adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../src/adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAWH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAgC1C,OAAO,KAAK,EACV,kBAAkB,EAGnB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EACV,mBAAmB,EAIpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACV,qBAAqB,EAEtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EACV,mBAAmB,EAIpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EACV,sBAAsB,EAGvB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,KAAK,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,KAAK,EACV,eAAe,EACf,cAAc,EACd,eAAe,EAChB,MAAM,kBAAkB,CAAC;AAE1B,kDAAkD;AAClD,MAAM,WAAW,aACf,SACE,mBAAmB,EACnB,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACtB,eAAe,EACf,kBAAkB,EAClB,kBAAkB;CAAG;AAEzB;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CA6YjE;AAiHD,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC"}

package/dist/chunk-7QVYU63E.js

@@ -0,0 +1,7 @@
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+
+export {
+  __name
+};
+//# sourceMappingURL=chunk-7QVYU63E.js.map

package/dist/chunk-7QVYU63E.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/constants.d.ts

@@ -0,0 +1,83 @@
+import type { Address } from "@solana/kit";
+/**
+ * v1 protocol constants and defaults.
+ *
+ * Sourced from `programs/accord/src/constants.rs` and AGENTS.md "v1 Defaults".
+ * Per-Subaccord params are configurable at creation; these are the milestone
+ * defaults.
+ */
+export declare const MAX_JURORS = 31;
+export declare const MAX_APPEALS = 3;
+export declare const MAX_OPTIONS = 8;
+export declare const UPDATE_TIMELOCK_SLOTS = 432000n;
+export declare const UNPAUSE_TIMELOCK_SLOTS = 216000n;
+/** Default appeal window (ADR-0022). Per-Subaccord now; this is the
+ *  `createSubaccord` default + the "v1 default" the docs cite — the runtime
+ *  value is `dispute.terms.appealWindow` (frozen at filing). 3 days. */
+export declare const DEFAULT_APPEAL_WINDOW_SECS = 259200n;
+/** Floor on the per-Subaccord appeal window (ADR-0022). 1 hour. */
+export declare const MIN_APPEAL_WINDOW_SECS = 3600n;
+/**
+ * Maximum tree depth that fits a `stake`/`requestWithdraw`/`reconcileStake`
+ * instruction within the 1232-byte serialized transaction limit when signed
+ * via a browser wallet. The MST proof is `depth × 40` bytes of instruction
+ * data; the `stake` ix has ~490 bytes of fixed overhead (7 accounts + headers
+ * + discriminator + amount). `490 + depth×40 ≤ 1232` ⇒ depth ≤ 18, but we
+ * cap at 16 (102-byte margin) for safety.
+ */
+export declare const MAX_SAFE_TREE_DEPTH = 16;
+/**
+ * Default Merkle accumulator tree depth. 2^16 = 65,536 seats; per-Subaccord.
+ * Capped at {@link MAX_SAFE_TREE_DEPTH} so browser-wallet signing works.
+ */
+export declare const DEFAULT_TREE_DEPTH = 16;
+/**
+ * Round-1 juror panel size (ADR-0019). Fixed protocol constant — not
+ * per-Subaccord configurable. The appeal ladder grows it via `2N+1`:
+ * 3 → 7 → 15 → 31 (the last exactly fills `MAX_JURORS` at `max_appeals = 3`).
+ */
+export declare const INITIAL_NUM_JURORS = 3;
+export declare const DEFAULT_ALPHA_BPS = 1000;
+export declare const DEFAULT_REVIEW_WINDOW_SECS = 604800n;
+export declare const DEFAULT_COMMIT_WINDOW_SECS = 172800n;
+export declare const DEFAULT_REVEAL_WINDOW_SECS = 172800n;
+export declare const DEFAULT_MAX_APPEALS = 3;
+/**
+ * Default reveal-quorum fraction in bps (ADR-0021): 6_666 = 2/3. A round is
+ * authoritative only once `reveal_count >= ceil(panel × bps / 10_000)`.
+ */
+export declare const DEFAULT_REVEAL_THRESHOLD_BPS = 6666;
+/** Program ceiling on per-round redraw attempts (bounds the redraw ladder). */
+export declare const MAX_DRAW_ATTEMPTS = 10;
+/** Default same-size redraw cap per round before a dispute fails (ADR-0021). */
+export declare const DEFAULT_MAX_DRAW_ATTEMPTS = 3;
+/**
+ * Default `Median` coherence tolerance in bps (ADR-0025): a revealed vote is
+ * coherent iff `|vote − ruling| · 10_000 ≤ ruling · coherence_tol_bps`. 100 =
+ * a 1% band around the final median. Inert for `Plurality` (exact option
+ * equality) — Plurality-only pools pass `0`.
+ */
+export declare const DEFAULT_COHERENCE_TOL_BPS = 100;
+export declare const DEFAULT_MIN_STAKE = 1000n;
+export declare const DEFAULT_FEE_PER_JUROR = 0n;
+/**
+ * Panel size for round `roundIdx`, seeded by `baseJurySize` (the Subaccord's
+ * `min_jury_size`). Defaults to {@link INITIAL_NUM_JURORS} (=3) for backward
+ * compatibility — pass the Subaccord's value explicitly for non-default pools.
+ */
+export declare function panelSizeForRound(roundIdx: number, baseJurySize?: number): number | null;
+/**
+ * Largest panel a Subaccord with `maxAppeals` appeals can reach, seeded by
+ * `baseJurySize` (the Subaccord's `min_jury_size`). Defaults to
+ * {@link INITIAL_NUM_JURORS} (=3).
+ */
+export declare function maxAppealPanelSize(maxAppeals: number, baseJurySize?: number): number;
+/** Mainnet/devnet base-layer VRF oracle queue (`DEFAULT_QUEUE`). */
+export declare const VRF_ORACLE_QUEUE: Address;
+/** Mainnet/devnet delegated (ephemeral rollup) VRF oracle queue (`DEFAULT_EPHEMERAL_QUEUE`). */
+export declare const VRF_ORACLE_EPHEMERAL_QUEUE: Address;
+/** Localnet base-layer test VRF oracle queue (`DEFAULT_TEST_QUEUE`). */
+export declare const VRF_ORACLE_TEST_QUEUE: Address;
+/** Localnet delegated (ephemeral rollup) test VRF oracle queue (`DEFAULT_EPHEMERAL_TEST_QUEUE`). */
+export declare const VRF_ORACLE_EPHEMERAL_TEST_QUEUE: Address;
+//# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE3C;;;;;;GAMG;AAIH,eAAO,MAAM,UAAU,KAAK,CAAC;AAC7B,eAAO,MAAM,WAAW,IAAI,CAAC;AAC7B,eAAO,MAAM,WAAW,IAAI,CAAC;AAI7B,eAAO,MAAM,qBAAqB,UAAW,CAAC;AAC9C,eAAO,MAAM,sBAAsB,UAAW,CAAC;AAI/C;;wEAEwE;AACxE,eAAO,MAAM,0BAA0B,UAAW,CAAC;AACnD,mEAAmE;AACnE,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAI7C;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;;GAGG;AACH,eAAO,MAAM,kBAAkB,KAAK,CAAC;AAIrC;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,IAAI,CAAC;AACpC,eAAO,MAAM,iBAAiB,OAAQ,CAAC;AACvC,eAAO,MAAM,0BAA0B,UAAW,CAAC;AACnD,eAAO,MAAM,0BAA0B,UAAW,CAAC;AACnD,eAAO,MAAM,0BAA0B,UAAW,CAAC;AACnD,eAAO,MAAM,mBAAmB,IAAI,CAAC;AACrC;;;GAGG;AACH,eAAO,MAAM,4BAA4B,OAAQ,CAAC;AAClD,+EAA+E;AAC/E,eAAO,MAAM,iBAAiB,KAAK,CAAC;AACpC,gFAAgF;AAChF,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAC3C;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAC7C,eAAO,MAAM,iBAAiB,QAAS,CAAC;AACxC,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAMxC;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,YAAY,GAAE,MAA2B,GACxC,MAAM,GAAG,IAAI,CAcf;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,EAClB,YAAY,GAAE,MAA2B,GACxC,MAAM,CAGR;AAWD,oEAAoE;AACpE,eAAO,MAAM,gBAAgB,EACuB,OAAO,CAAC;AAC5D,gGAAgG;AAChG,eAAO,MAAM,0BAA0B,EACa,OAAO,CAAC;AAC5D,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,EACkB,OAAO,CAAC;AAC5D,oGAAoG;AACpG,eAAO,MAAM,+BAA+B,EACO,OAAO,CAAC"}

package/dist/domain.d.ts

@@ -0,0 +1,73 @@
+/** Parsed domain document: optional frontmatter metadata + the body. */
+export interface ParsedDomainDoc {
+    title?: string;
+    description?: string;
+    body: string;
+}
+/** Result of fetching a domain doc from the daemon: verified bytes + parse. */
+export interface FetchedDomainDoc {
+    bytes: Uint8Array;
+    contentType: string;
+    doc: ParsedDomainDoc;
+}
+/** Options for {@link putDomainDoc} (ADR-0027 amendment — chain-anchored PUT). */
+export interface PutDomainDocOptions {
+    /**
+     * Anchor Subaccord address (`?subaccord=`): the daemon resolves it
+     * on-chain and requires its `domain_ref` to equal the doc hash
+     * (create-first — publish only after the create-tx confirms).
+     */
+    subaccord: string;
+    /** Content-Type for the PUT; defaults to `text/markdown`. */
+    contentType?: string;
+}
+/** Success result of {@link putDomainDoc}: 201 created / 200 idempotent no-op. */
+export interface PutDomainDocResult {
+    status: 200 | 201;
+    /** The doc's canonical 64-hex sha256 — the on-chain `domain_ref` value. */
+    hash: string;
+}
+/**
+ * Typed failure of {@link putDomainDoc}: the daemon rejected the publish.
+ * `status` mirrors the daemon's HTTP status (400 hash/anchor mismatch /
+ * missing param, 404 anchor not found, 409 collision alarm, 413 over cap,
+ * 5xx transport); `body` carries the raw response body for the message.
+ */
+export declare class DomainPublishError extends Error {
+    readonly status: number;
+    readonly body: string;
+    constructor(status: number, body: string);
+}
+/** `sha256(bytes)` as lowercase 64-hex — the canonical `domain_ref` string form. */
+export declare function hashDomainDoc(bytes: Uint8Array): string;
+/**
+ * Verify raw doc bytes against an on-chain `domain_ref` — either the 32 raw
+ * bytes or its 64-hex string form. False on any mismatch or wrong ref shape.
+ */
+export declare function verifyDomainDoc(bytes: Uint8Array, domainRef: Uint8Array | string): boolean;
+/**
+ * Parse a domain doc: optional `---`-delimited frontmatter with `title` /
+ * `description` (single-line `key: value`, surrounding quotes stripped),
+ * everything after the closing delimiter is `body`. Absent or unterminated
+ * frontmatter ⇒ the whole text is `body`. Unknown keys (including any
+ * `version`) are ignored.
+ */
+export declare function parseDomainDoc(bytes: Uint8Array): ParsedDomainDoc;
+/**
+ * Fetch a domain doc from the evidence daemon (`GET {daemonUrl}/domains/{hash}`),
+ * verify `sha256(bytes) === hash`, and parse it. Throws on non-200 responses
+ * and on verification failure (tampered or mismatched bytes).
+ */
+export declare function fetchDomainDoc(daemonUrl: string, hash: string): Promise<FetchedDomainDoc>;
+/**
+ * Publish a domain doc to the evidence daemon's public CAS
+ * (`PUT {daemonUrl}/domains/{sha256(bytes)}?subaccord=<addr>`) — the single
+ * publish implementation; the CLI and both dApps consume this (ADR-0027
+ * amendment, bean accord-uecf). Create-first: call only after the create-tx
+ * with `domain_ref = hash` has confirmed — the daemon anchor-verifies.
+ * Resolves `{ status, hash }` on 201 (created) / 200 (identical bytes already
+ * stored — idempotent no-op); throws {@link DomainPublishError} on any other
+ * status, carrying `status` + raw body.
+ */
+export declare function putDomainDoc(daemonUrl: string, bytes: Uint8Array, options: PutDomainDocOptions): Promise<PutDomainDocResult>;
+//# sourceMappingURL=domain.d.ts.map

package/dist/domain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain.d.ts","sourceRoot":"","sources":["../src/domain.ts"],"names":[],"mappings":"AAoBA,wEAAwE;AACxE,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,+EAA+E;AAC/E,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,UAAU,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,eAAe,CAAC;CACtB;AAED,kFAAkF;AAClF,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,kFAAkF;AAClF,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,GAAG,GAAG,GAAG,CAAC;IAClB,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAMzC;AAKD,oFAAoF;AACpF,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAEvD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,UAAU,GAAG,MAAM,GAC7B,OAAO,CAST;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,UAAU,GAAG,eAAe,CAMjE;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,gBAAgB,CAAC,CAc3B;AAED;;;;;;;;;GASG;AACH,wBAAsB,YAAY,CAChC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,kBAAkB,CAAC,CAgB7B"}

package/dist/errors.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Typed mapping of AccordError codes.
+ *
+ * Anchor assigns sequential codes starting at 6000 (the `ERROR_CODE_OFFSET`).
+ * The order matches the `#[error_code]` enum declaration in
+ * `programs/accord/src/errors.rs`.
+ */
+export declare const ACCORD_ERROR_CODE_OFFSET = 6000;
+export type AccordErrorCode = {
+    readonly code: number;
+    readonly name: string;
+    readonly message: string;
+};
+export declare const AccordErrors: {
+    readonly Unauthorized: AccordErrorCode;
+    readonly ImmutableSubaccord: AccordErrorCode;
+    readonly TimelockNotElapsed: AccordErrorCode;
+    readonly NoPendingUpdate: AccordErrorCode;
+    readonly NotPauseAuthority: AccordErrorCode;
+    readonly AlreadyPaused: AccordErrorCode;
+    readonly NotPaused: AccordErrorCode;
+    readonly NoPendingUnpause: AccordErrorCode;
+    readonly UnpauseTimelockNotElapsed: AccordErrorCode;
+    readonly ProgramPaused: AccordErrorCode;
+    readonly InsufficientStake: AccordErrorCode;
+    readonly StakeLocked: AccordErrorCode;
+    readonly InvalidAmount: AccordErrorCode;
+    readonly InsufficientBalance: AccordErrorCode;
+    readonly InsufficientJurors: AccordErrorCode;
+    readonly InvalidOptions: AccordErrorCode;
+    readonly InvalidState: AccordErrorCode;
+    readonly FeeMismatch: AccordErrorCode;
+    readonly InvalidMerklePath: AccordErrorCode;
+    readonly TreeFull: AccordErrorCode;
+    readonly DuplicateJuror: AccordErrorCode;
+    readonly InvalidMembershipProof: AccordErrorCode;
+    readonly InvalidPanelSize: AccordErrorCode;
+    readonly InflatedStake: AccordErrorCode;
+    readonly SortitionMismatch: AccordErrorCode;
+    readonly VrfAlreadyCommitted: AccordErrorCode;
+    readonly VrfNotCommitted: AccordErrorCode;
+    readonly CommitAlreadyExists: AccordErrorCode;
+    readonly CommitMissing: AccordErrorCode;
+    readonly RevealMismatch: AccordErrorCode;
+    readonly CommitWindowClosed: AccordErrorCode;
+    readonly RevealWindowClosed: AccordErrorCode;
+    readonly NotDrawnJuror: AccordErrorCode;
+    readonly InvalidVote: AccordErrorCode;
+    readonly AlreadyRevealed: AccordErrorCode;
+    readonly AppealWindowOpen: AccordErrorCode;
+    readonly MaxAppealsReached: AccordErrorCode;
+    readonly MaxAppealsLimitExceeded: AccordErrorCode;
+    readonly AppealWindowClosed: AccordErrorCode;
+    readonly RoundNotFinalizable: AccordErrorCode;
+    readonly DisputeNotFinal: AccordErrorCode;
+    readonly ArithmeticOverflow: AccordErrorCode;
+    readonly RoundAlreadySettled: AccordErrorCode;
+    readonly RoundNotSettlable: AccordErrorCode;
+    readonly DisputeFailed: AccordErrorCode;
+    readonly CancelTooEarly: AccordErrorCode;
+    readonly MaxRetriesExceeded: AccordErrorCode;
+};
+export type AccordErrorName = keyof typeof AccordErrors;
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,eAAO,MAAM,wBAAwB,OAAO,CAAC;AAE7C,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAQF,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+Pf,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG,MAAM,OAAO,YAAY,CAAC"}

package/dist/evidence/crypto.d.ts

@@ -0,0 +1,12 @@
+/** SHA-256 digest (32 bytes). */
+export declare function sha256(data: Uint8Array): Promise<Uint8Array>;
+/**
+ * HKDF-SHA256 with an empty salt (per SPEC §Crypto model) and a protocol `info`
+ * label that pins the derived key to its role (ingest vs deliver).
+ */
+export declare function hkdfSha256(ikm: Uint8Array, info: Uint8Array, length?: number): Promise<Uint8Array>;
+/** AES-256-GCM encrypt → `nonce(12) ‖ ciphertext ‖ tag(16)` (SPEC wire format). */
+export declare function aesGcmEncrypt(key: Uint8Array, plaintext: Uint8Array): Promise<Uint8Array>;
+/** AES-256-GCM decrypt of a `nonce(12) ‖ ciphertext ‖ tag(16)` blob. Throws on auth failure. */
+export declare function aesGcmDecrypt(key: Uint8Array, blob: Uint8Array): Promise<Uint8Array>;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/evidence/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/evidence/crypto.ts"],"names":[],"mappings":"AAyBA,iCAAiC;AACjC,wBAAsB,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAElE;AAED;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,GAAG,EAAE,UAAU,EACf,IAAI,EAAE,UAAU,EAChB,MAAM,SAAK,GACV,OAAO,CAAC,UAAU,CAAC,CAErB;AAED,mFAAmF;AACnF,wBAAsB,aAAa,CACjC,GAAG,EAAE,UAAU,EACf,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,UAAU,CAAC,CAQrB;AAED,gGAAgG;AAChG,wBAAsB,aAAa,CACjC,GAAG,EAAE,UAAU,EACf,IAAI,EAAE,UAAU,GACf,OAAO,CAAC,UAAU,CAAC,CAQrB"}

package/dist/evidence/ecies.d.ts

@@ -0,0 +1,45 @@
+/** HKDF `info` labels pin the derivation to its protocol role. */
+export declare const INGEST_INFO = "accord-ingest-v1";
+export declare const DELIVER_INFO = "accord-deliver-v1";
+/** Stored ciphertext bundle (ciphertext only — no plaintext field). */
+export interface IngestBundle {
+    /** AES-GCM(dek, plaintext) — nonce(12) prepended. */
+    ct: Uint8Array;
+    /** Claimant's ephemeral X25519 public key (32 bytes). */
+    claimant_ephem_pub: Uint8Array;
+    /** AES-GCM(k_in, dek) — nonce(12) prepended. */
+    wrapped: Uint8Array;
+    /** sha256(plaintext); matches the dispute's on-chain `evidence_hash`. */
+    plaintext_hash: Uint8Array;
+}
+/** A bundle re-encrypted to a single drawn juror. */
+export interface JurorBundle {
+    /** AES-GCM(k_out, plaintext) — nonce(12) prepended. */
+    out: Uint8Array;
+    /** Operator's ephemeral X25519 public key for this delivery (32 bytes). */
+    operator_ephem_pub: Uint8Array;
+}
+/**
+ * Claimant-side ingest encryption. Produces the bundle posted to the operator.
+ * Claimants run this off-daemon; the operator never calls it in production (it
+ * is exposed so claimant SDK clients share one implementation, and for
+ * round-trips / test vectors).
+ */
+export declare function claimantEncrypt(plaintext: Uint8Array, operatorEd25519Pub: Uint8Array): Promise<IngestBundle>;
+/**
+ * Operator-side decrypt of a stored bundle → plaintext (in-memory only).
+ * Callers MUST run {@link verifyIntegrity} next.
+ */
+export declare function operatorDecrypt(bundle: IngestBundle, operatorEd25519SecretSeed: Uint8Array): Promise<Uint8Array>;
+/** Operator re-encrypts plaintext to a drawn juror's Ed25519 pubkey. */
+export declare function deliverToJuror(plaintext: Uint8Array, jurorEd25519Pub: Uint8Array): Promise<JurorBundle>;
+/** Juror-side decrypt of a delivered bundle → plaintext. */
+export declare function jurorDecrypt(delivered: JurorBundle, jurorEd25519SecretSeed: Uint8Array): Promise<Uint8Array>;
+/**
+ * Mandatory integrity gate (SPEC §3, §Failure modes): `sha256(plaintext)` MUST
+ * equal the dispute's on-chain `evidence_hash`. Both operands are public hashes,
+ * so a plain compare suffices (no constant-time requirement). Throws on mismatch
+ * — at ingest this rejects a bad upload, at delivery it refuses + alerts.
+ */
+export declare function verifyIntegrity(plaintext: Uint8Array, evidenceHash: Uint8Array): Promise<void>;
+//# sourceMappingURL=ecies.d.ts.map

package/dist/evidence/ecies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ecies.d.ts","sourceRoot":"","sources":["../../src/evidence/ecies.ts"],"names":[],"mappings":"AAgCA,kEAAkE;AAClE,eAAO,MAAM,WAAW,qBAAqB,CAAC;AAC9C,eAAO,MAAM,YAAY,sBAAsB,CAAC;AAIhD,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC3B,qDAAqD;IACrD,EAAE,EAAE,UAAU,CAAC;IACf,yDAAyD;IACzD,kBAAkB,EAAE,UAAU,CAAC;IAC/B,gDAAgD;IAChD,OAAO,EAAE,UAAU,CAAC;IACpB,yEAAyE;IACzE,cAAc,EAAE,UAAU,CAAC;CAC5B;AAED,qDAAqD;AACrD,MAAM,WAAW,WAAW;IAC1B,uDAAuD;IACvD,GAAG,EAAE,UAAU,CAAC;IAChB,2EAA2E;IAC3E,kBAAkB,EAAE,UAAU,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,SAAS,EAAE,UAAU,EACrB,kBAAkB,EAAE,UAAU,GAC7B,OAAO,CAAC,YAAY,CAAC,CAiBvB;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,YAAY,EACpB,yBAAyB,EAAE,UAAU,GACpC,OAAO,CAAC,UAAU,CAAC,CAMrB;AAED,wEAAwE;AACxE,wBAAsB,cAAc,CAClC,SAAS,EAAE,UAAU,EACrB,eAAe,EAAE,UAAU,GAC1B,OAAO,CAAC,WAAW,CAAC,CAOtB;AAED,4DAA4D;AAC5D,wBAAsB,YAAY,CAChC,SAAS,EAAE,WAAW,EACtB,sBAAsB,EAAE,UAAU,GACjC,OAAO,CAAC,UAAU,CAAC,CAKrB;AAED;;;;;GAKG;AACH,wBAAsB,eAAe,CACnC,SAAS,EAAE,UAAU,EACrB,YAAY,EAAE,UAAU,GACvB,OAAO,CAAC,IAAI,CAAC,CAUf"}

package/dist/evidence/fetch.d.ts

@@ -0,0 +1,20 @@
+/**
+ * evidence/fetch.ts — framework-agnostic manifest fetch from the evidence daemon.
+ *
+ * GET {endpoint}/evidence/{subaccord}/{dispute}/{round}
+ *
+ * Returns the decrypted manifest (a YAML string for the `accord-evidence/v1`
+ * format, or a parsed JSON object if the plaintext was JSON). `null` when no
+ * bundle is stored for the round (404).
+ *
+ * This is the pure fetch — React apps wrap it in a `useQuery` hook
+ * (see apps/app and apps/canon `useManifest.ts`).
+ */
+export interface FetchManifestParams {
+    endpoint: string;
+    subaccord: string;
+    dispute: string;
+    round: number;
+}
+export declare function fetchManifest(params: FetchManifestParams): Promise<unknown>;
+//# sourceMappingURL=fetch.d.ts.map

package/dist/evidence/fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch.d.ts","sourceRoot":"","sources":["../../src/evidence/fetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,OAAO,CAAC,CAQlB"}

package/dist/evidence/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * evidence/index.ts — barrel for the `@useaccord/sdk/evidence` sub-path export.
+ *
+ * The Accord evidence encryption protocol + its Ed25519/X25519 key material,
+ * shared byte-exact by claimant, operator (the evidence-daemon), and juror.
+ * Also includes the manifest builder/parser/publisher (the `accord-evidence/v1`
+ * wire format) extracted from apps/app (ADR-0015).
+ *
+ * Kept behind a sub-path export so Arbitrables that only do `create_dispute`
+ * CPI don't pull the `@noble` crypto stack.
+ *
+ * The daemon base URL (`EVIDENCE_DAEMON_URL`) is deployment-specific and stays
+ * app-side; `publishEvidence` takes `endpoint` as a parameter (ADR-0011).
+ *
+ * Authority: ADR-0006 (evidence model), ADR-0011 (evidence-daemon),
+ * ADR-0015 (evidence crypto → SDK), ADR-0017 (evidence data format),
+ * SPEC §Crypto, EVIDENCE-FORMAT.md.
+ */
+export * from "./crypto.js";
+export * from "./keys.js";
+export * from "./ecies.js";
+export * from "./manifest.js";
+export * from "./options.js";
+export * from "./parse.js";
+export * from "./publish.js";
+export * from "./fetch.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/evidence/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/evidence/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,YAAY,CAAC"}