@usesigil/kit 0.16.0 → 0.17.0

package/dist/caip2-network.js

@@ -0,0 +1,202 @@
+/**
+ * CAIP-2 Solana chain identifiers + AL4 isMainnet derivation.
+ * Phase 9 Batch J (ISC-77..80, 147).
+ *
+ * Per the CAIP-2 spec (https://chainagnostic.org/CAIPs/caip-2), Solana
+ * networks are identified by a `solana:<genesis-hash-prefix>` string. The
+ * canonical IDs are registered at
+ * https://github.com/ChainAgnostic/namespaces/blob/main/solana/caip2.md.
+ *
+ * Sigil SDK V2 ships AL4 as a CAIP-2 chain id PLUS a derived `isMainnet`
+ * boolean. Per Council ISC-147, exposing the full CAIP-2 string (not just
+ * the boolean) preserves the future ability to bind testnet / localnet
+ * intents without changing the SealResult shape — collapsing 4 networks
+ * into 2 was flagged as a "footgun in waiting".
+ */
+import { SigilSdkDomainError } from "./errors/sdk.js";
+import { SIGIL_ERROR__SDK__INVALID_NETWORK } from "./errors/codes.js";
+/** CAIP-2 namespace for Solana. */
+export const CAIP2_NAMESPACE_SOLANA = "solana";
+/** Mainnet-beta CAIP-2 chain id. */
+export const CAIP2_SOLANA_MAINNET = "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp";
+/** Devnet CAIP-2 chain id. */
+export const CAIP2_SOLANA_DEVNET = "solana:EtWTRABZaYq6iMfeYKouRu166VU2xqa1";
+/** Testnet CAIP-2 chain id (declared for completeness; not currently produced by `toCaip2`). */
+export const CAIP2_SOLANA_TESTNET = "solana:4uhcVJyU9pJkvQyS88uRDiswHXSCkY3z";
+/**
+ * Convert the SDK's internal `"devnet" | "mainnet"` network discriminant
+ * to its canonical CAIP-2 chain id.
+ *
+ * @throws if `network` is not one of the two supported values. (Type
+ * narrowing prevents this at compile time; the runtime check catches
+ * misuse from JS callers or `any`-cast bypasses.)
+ */
+export function toCaip2(network) {
+    if (network === "mainnet")
+        return CAIP2_SOLANA_MAINNET;
+    if (network === "devnet")
+        return CAIP2_SOLANA_DEVNET;
+    throw new SigilSdkDomainError(SIGIL_ERROR__SDK__INVALID_NETWORK, `toCaip2: network must be 'devnet' or 'mainnet', got ${String(network)}`, {
+        context: {
+            operation: "toCaip2",
+            received: String(network),
+        },
+    });
+}
+/**
+ * Derive the AL4 `isMainnet` boolean from a CAIP-2 chain id.
+ *
+ * `isMainnet === true` ONLY when the chain id matches the canonical
+ * mainnet-beta value. Devnet, testnet, localnet — anything else — all
+ * return false. This is intentional: `isMainnet` is a SECURITY signal
+ * (gate destructive defaults behind it); fuzzy matching would be a
+ * footgun.
+ */
+export function isMainnetCaip2(chain) {
+    return chain === CAIP2_SOLANA_MAINNET;
+}
+/**
+ * Convenience: combine `toCaip2` + `isMainnetCaip2` from a `"devnet" | "mainnet"`
+ * input. Used by `seal()` to populate `SealResult.network` and
+ * `SealResult.isMainnet` in a single call.
+ */
+export function deriveNetworkIdentity(network) {
+    const chain = toCaip2(network);
+    return { network: chain, isMainnet: isMainnetCaip2(chain) };
+}
+/**
+ * Convert a Sigil CAIP-2 string to a Wallet Standard chain identifier.
+ *
+ * Wallet Standard (https://github.com/wallet-standard/wallet-standard) uses
+ * `solana:<network-id>` per the SIWS / Solana Mobile spec, which is the
+ * exact same shape as Sigil's CAIP-2 strings (per the ChainAgnostic CAIP-2
+ * registry — https://chainagnostic.org/CAIPs/caip-2). The conversion is
+ * therefore identity at the value level — but the explicit helper
+ * documents the boundary so that future wallet-standard surface changes
+ * (e.g. an extra cluster discriminant, a versioning suffix) localize to
+ * this one function rather than spreading raw CAIP-2 casts across SIWS,
+ * connector adapters, and the seal() result shape.
+ *
+ * The return type is the wider template-literal `\`solana:${string}\`` to
+ * keep the helper assignable to Wallet Standard `IdentifierString` /
+ * `WalletWithSolanaFeatures` chain fields without consumers needing to
+ * narrow back through `SigilCaip2Chain`.
+ *
+ * @param caip2 — a CAIP-2 chain id produced by {@link toCaip2} or one of
+ *   the `CAIP2_SOLANA_*` constants. The argument MUST already be in the
+ *   `solana:<id>` form; this helper does not validate.
+ */
+export function toWalletStandardChain(caip2) {
+    return caip2;
+}
+/**
+ * Canonical Solana genesis hashes, keyed by network. Values are the full
+ * 44-character base58 hashes returned by `rpc.getGenesisHash()`.
+ *
+ *   mainnet-beta: 5eykt4UsFv8P8NJdTREpY1vzqKqZKvdpKuc147dw2N9d
+ *   devnet:       EtWTRABZaYq6iMfeYKouRu166VU2xqa1wcaWoxPkrZBG
+ *   testnet:      4uhcVJyU9pJkvQyS88uRDiswHXSCkY3zQawwpjk2NsNY
+ *
+ * Source: Solana Foundation Cluster RPC documentation
+ * (https://solana.com/docs/core/clusters). Hardcoded here so the
+ * verification path is offline-deterministic — a malicious RPC cannot
+ * substitute its own "canonical" hash.
+ */
+export const SOLANA_GENESIS_HASHES = {
+    mainnet: "5eykt4UsFv8P8NJdTREpY1vzqKqZKvdpKuc147dw2N9d",
+    devnet: "EtWTRABZaYq6iMfeYKouRu166VU2xqa1wcaWoxPkrZBG",
+    testnet: "4uhcVJyU9pJkvQyS88uRDiswHXSCkY3zQawwpjk2NsNY",
+};
+/**
+ * Verify that an RPC actually serves the cluster a caller claims it does.
+ *
+ * **Opt-in, non-throwing diagnostic.** Unlike `assertGenesisHash` in
+ * seal.ts (which is called inside `createSigilClientAsync` and throws on
+ * mismatch), this helper returns a structured result so callers can
+ * branch on it without `try/catch`. Use it in preflight checks, in
+ * `mainnetConfirmed` confirmation flows that want to surface the
+ * mismatch to the operator, or anywhere raw-tx-building code paths
+ * bypass the client factory.
+ *
+ * **Does NOT change `seal()` default behaviour.** The existing seal
+ * factory still calls `assertGenesisHash` (which throws) — that's the
+ * load-bearing safety gate. `verifyNetworkIdentity` is purely additive.
+ *
+ * @example
+ * ```ts
+ * const result = await verifyNetworkIdentity({
+ *   rpc,
+ *   claimedNetwork: "mainnet",
+ * });
+ * if (!result.verified) {
+ *   console.error(
+ *     `Refusing to submit mainnet tx — RPC reports ${result.actualNetwork} ` +
+ *     `(genesis ${result.observedGenesisHash}); ` +
+ *     `expected mainnet (${result.expectedGenesisHash}).`,
+ *   );
+ *   throw new Error("Network mismatch");
+ * }
+ * ```
+ */
+export async function verifyNetworkIdentity(input) {
+    const { rpc, claimedNetwork } = input;
+    if (claimedNetwork !== "devnet" && claimedNetwork !== "mainnet") {
+        // Defensive: JS callers or `any`-cast bypasses. Returned as
+        // unverified rather than throwing so the helper stays "diagnostic".
+        return {
+            verified: false,
+            actualNetwork: "unknown",
+            expectedGenesisHash: "",
+            reason: `claimedNetwork must be 'devnet' or 'mainnet', got ${String(claimedNetwork)}`,
+        };
+    }
+    const expectedGenesisHash = claimedNetwork === "mainnet"
+        ? SOLANA_GENESIS_HASHES.mainnet
+        : SOLANA_GENESIS_HASHES.devnet;
+    let observed;
+    try {
+        observed = await rpc.getGenesisHash().send();
+    }
+    catch (err) {
+        return {
+            verified: false,
+            actualNetwork: "unknown",
+            expectedGenesisHash,
+            reason: `getGenesisHash() failed: ${err instanceof Error ? err.message : String(err)}`,
+        };
+    }
+    if (typeof observed !== "string" || observed.length < 32) {
+        return {
+            verified: false,
+            actualNetwork: "unknown",
+            expectedGenesisHash,
+            observedGenesisHash: observed == null ? undefined : String(observed),
+            reason: "getGenesisHash() returned a malformed response — expected a 44-char base58 string",
+        };
+    }
+    // Identify the actual cluster the RPC serves.
+    let actualNetwork = "unknown";
+    for (const [name, hash] of Object.entries(SOLANA_GENESIS_HASHES)) {
+        if (observed === hash) {
+            actualNetwork = name;
+            break;
+        }
+    }
+    if (observed === expectedGenesisHash) {
+        return {
+            verified: true,
+            actualNetwork,
+            expectedGenesisHash,
+            observedGenesisHash: observed,
+        };
+    }
+    return {
+        verified: false,
+        actualNetwork,
+        expectedGenesisHash,
+        observedGenesisHash: observed,
+        reason: `Cluster mismatch — RPC reports ${actualNetwork} (genesis ${observed}) ` +
+            `but caller claimed ${claimedNetwork} (expected ${expectedGenesisHash}).`,
+    };
+}
+//# sourceMappingURL=caip2-network.js.map

package/dist/caip2-network.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"caip2-network.js","sourceRoot":"","sources":["../src/caip2-network.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,iCAAiC,EAAE,MAAM,mBAAmB,CAAC;AAEtE,mCAAmC;AACnC,MAAM,CAAC,MAAM,sBAAsB,GAAG,QAAiB,CAAC;AAExD,oCAAoC;AACpC,MAAM,CAAC,MAAM,oBAAoB,GAC/B,yCAAkD,CAAC;AAErD,8BAA8B;AAC9B,MAAM,CAAC,MAAM,mBAAmB,GAC9B,yCAAkD,CAAC;AAErD,gGAAgG;AAChG,MAAM,CAAC,MAAM,oBAAoB,GAC/B,yCAAkD,CAAC;AAUrD;;;;;;;GAOG;AACH,MAAM,UAAU,OAAO,CAAC,OAA6B;IACnD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,oBAAoB,CAAC;IACvD,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,mBAAmB,CAAC;IACrD,MAAM,IAAI,mBAAmB,CAC3B,iCAAiC,EACjC,uDAAuD,MAAM,CAAC,OAAO,CAAC,EAAE,EACxE;QACE,OAAO,EAAE;YACP,SAAS,EAAE,SAAS;YACpB,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC;SACjB;KACX,CACF,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,KAAK,KAAK,oBAAoB,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAA6B;IAIjE,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,qBAAqB,CACnC,KAAsB;IAEtB,OAAO,KAAK,CAAC;AACf,CAAC;AA0BD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,OAAO,EAAE,8CAA8C;IACvD,MAAM,EAAE,8CAA8C;IACtD,OAAO,EAAE,8CAA8C;CAC/C,CAAC;AAmCX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAG3C;IACC,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,KAAK,CAAC;IACtC,IAAI,cAAc,KAAK,QAAQ,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QAChE,4DAA4D;QAC5D,oEAAoE;QACpE,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,aAAa,EAAE,SAAS;YACxB,mBAAmB,EAAE,EAAE;YACvB,MAAM,EAAE,qDAAqD,MAAM,CAAC,cAAc,CAAC,EAAE;SACtF,CAAC;IACJ,CAAC;IACD,MAAM,mBAAmB,GACvB,cAAc,KAAK,SAAS;QAC1B,CAAC,CAAC,qBAAqB,CAAC,OAAO;QAC/B,CAAC,CAAC,qBAAqB,CAAC,MAAM,CAAC;IAEnC,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,GAAG,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,aAAa,EAAE,SAAS;YACxB,mBAAmB;YACnB,MAAM,EAAE,4BAA4B,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE;SACvF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACzD,OAAO;YACL,QAAQ,EAAE,KAAK;YACf,aAAa,EAAE,SAAS;YACxB,mBAAmB;YACnB,mBAAmB,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;YACpE,MAAM,EACJ,mFAAmF;SACtF,CAAC;IACJ,CAAC;IAED,8CAA8C;IAC9C,IAAI,aAAa,GAAuB,SAAS,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAG5D,EAAE,CAAC;QACJ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,aAAa,GAAG,IAAI,CAAC;YACrB,MAAM;QACR,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,KAAK,mBAAmB,EAAE,CAAC;QACrC,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,aAAa;YACb,mBAAmB;YACnB,mBAAmB,EAAE,QAAQ;SAC9B,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,aAAa;QACb,mBAAmB;QACnB,mBAAmB,EAAE,QAAQ;QAC7B,MAAM,EACJ,kCAAkC,aAAa,aAAa,QAAQ,IAAI;YACxE,sBAAsB,cAAc,cAAc,mBAAmB,IAAI;KAC5E,CAAC;AACJ,CAAC"}

package/dist/canonical-encode.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Canonical Borsh-style encoder primitives — shared utilities.
+ *
+ * APPEND-ONLY DISCIPLINE. The TA-19 policy preview digest
+ * (`policy/compute-policy-preview-digest.ts`) and the AL3 SealInput intent
+ * digest (`seal/intent-digest.ts`, Phase 9 Batch I) both depend on these
+ * primitives being byte-stable across SDK versions. Adding a new primitive
+ * is fine; CHANGING the byte layout of an existing one would break every
+ * downstream cross-impl Rust↔TS hash and silently invalidate every
+ * previously-signed policy preview digest.
+ *
+ * Mirrors the Rust-side conventions used by `solana_program::hash::hash`
+ * over Borsh-encoded structs:
+ *   - Little-endian for all multi-byte integers (u16/u32/u64).
+ *   - Vec<T> = u32 LE length prefix ++ flat element bytes (no per-element
+ *     framing).
+ *   - bool encoded as u8 (0 or 1; the canonical Borsh wire format).
+ *   - Pubkey = raw 32 bytes (base58 decoded).
+ *   - SHA-256 over the canonical-encoded byte string.
+ *
+ * Primitives are deliberately small, stateless, and side-effect-free so
+ * they can be unit-tested in isolation and reused without surprises.
+ */
+/**
+ * Decode a Solana base58 pubkey to its 32-byte raw form. Throws on any
+ * input that doesn't decode to exactly 32 bytes (catches malformed
+ * pubkeys before they corrupt the canonical encoding).
+ *
+ * @throws Error if `s` is empty, contains an invalid base58 character,
+ *   or decodes to a byte length other than 32.
+ */
+export declare function base58Decode32(s: string): Uint8Array;
+/** Write u8 (single byte). Returns new offset. */
+export declare function writeU8(view: DataView, offset: number, v: number): number;
+/** Write u16 little-endian. Returns new offset. */
+export declare function writeU16Le(view: DataView, offset: number, v: number): number;
+/** Write u32 little-endian. Returns new offset. */
+export declare function writeU32Le(view: DataView, offset: number, v: number): number;
+/** Write u64 little-endian. Returns new offset. */
+export declare function writeU64Le(view: DataView, offset: number, v: bigint): number;
+/** Write a bool as a single 0/1 byte. Returns new offset. */
+export declare function writeBool(view: DataView, offset: number, v: boolean): number;
+/**
+ * SHA-256 over the input bytes. Backed by `@noble/hashes/sha256` — pure
+ * JS, browser- and Bun-compatible, byte-identical to Node's `node:crypto`
+ * for the same input (TA-19 cross-impl fixture suite verifies this).
+ *
+ * Phase 9 Batch I switched the backend from `node:crypto` to noble so AL3
+ * intent-digest can ship the same primitive across Node, Bun, and the
+ * browser without runtime-conditional imports.
+ */
+export declare function sha256(input: Uint8Array): Uint8Array;
+/**
+ * Constant-time digest comparison (true if `a` and `b` are byte-equal).
+ * Uses XOR-accumulate with no early exit so timing leaks don't reveal
+ * which prefix matched. Used by cosign + policy-digest verification.
+ */
+export declare function digestsEqual(a: Uint8Array, b: Uint8Array): boolean;
+//# sourceMappingURL=canonical-encode.d.ts.map

package/dist/canonical-encode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-encode.d.ts","sourceRoot":"","sources":["../src/canonical-encode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAqBH;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAsCpD;AAQD,kDAAkD;AAClD,wBAAgB,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAGzE;AAED,mDAAmD;AACnD,wBAAgB,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAG5E;AAED,mDAAmD;AACnD,wBAAgB,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAG5E;AAED,mDAAmD;AACnD,wBAAgB,UAAU,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAG5E;AAED,6DAA6D;AAC7D,wBAAgB,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,GAAG,MAAM,CAG5E;AAID;;;;;;;;GAQG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CAEpD;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAOlE"}

package/dist/canonical-encode.js

@@ -0,0 +1,141 @@
+/**
+ * Canonical Borsh-style encoder primitives — shared utilities.
+ *
+ * APPEND-ONLY DISCIPLINE. The TA-19 policy preview digest
+ * (`policy/compute-policy-preview-digest.ts`) and the AL3 SealInput intent
+ * digest (`seal/intent-digest.ts`, Phase 9 Batch I) both depend on these
+ * primitives being byte-stable across SDK versions. Adding a new primitive
+ * is fine; CHANGING the byte layout of an existing one would break every
+ * downstream cross-impl Rust↔TS hash and silently invalidate every
+ * previously-signed policy preview digest.
+ *
+ * Mirrors the Rust-side conventions used by `solana_program::hash::hash`
+ * over Borsh-encoded structs:
+ *   - Little-endian for all multi-byte integers (u16/u32/u64).
+ *   - Vec<T> = u32 LE length prefix ++ flat element bytes (no per-element
+ *     framing).
+ *   - bool encoded as u8 (0 or 1; the canonical Borsh wire format).
+ *   - Pubkey = raw 32 bytes (base58 decoded).
+ *   - SHA-256 over the canonical-encoded byte string.
+ *
+ * Primitives are deliberately small, stateless, and side-effect-free so
+ * they can be unit-tested in isolation and reused without surprises.
+ */
+import { sha256 as nobleSha256 } from "@noble/hashes/sha2";
+// ── Base58 decode (no external dep) ─────────────────────────────────────────
+//
+// Solana pubkeys are base58 strings; we need the raw 32 bytes. The SDK has
+// many base58 helpers downstream but importing from `kit-adapter` here would
+// create a cycle (kit-adapter imports from `core/` which is consumed by
+// digest helpers). Inline a small standard-Bitcoin-alphabet decoder.
+const BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+const BASE58_INDEX = (() => {
+    const r = Object.create(null);
+    for (let i = 0; i < BASE58_ALPHABET.length; i++) {
+        r[BASE58_ALPHABET[i]] = i;
+    }
+    return r;
+})();
+/**
+ * Decode a Solana base58 pubkey to its 32-byte raw form. Throws on any
+ * input that doesn't decode to exactly 32 bytes (catches malformed
+ * pubkeys before they corrupt the canonical encoding).
+ *
+ * @throws Error if `s` is empty, contains an invalid base58 character,
+ *   or decodes to a byte length other than 32.
+ */
+export function base58Decode32(s) {
+    if (s.length === 0) {
+        throw new Error("base58Decode32: empty input");
+    }
+    let leadingZeros = 0;
+    while (leadingZeros < s.length && s[leadingZeros] === "1") {
+        leadingZeros++;
+    }
+    // Big integer mode: walk digits, base-256 carry.
+    const bytes = [];
+    for (let i = 0; i < s.length; i++) {
+        const c = s[i];
+        const v = BASE58_INDEX[c];
+        if (v === undefined) {
+            throw new Error(`base58Decode32: invalid char '${c}'`);
+        }
+        let carry = v;
+        for (let j = 0; j < bytes.length; j++) {
+            carry += bytes[j] * 58;
+            bytes[j] = carry & 0xff;
+            carry >>>= 8;
+        }
+        while (carry > 0) {
+            bytes.push(carry & 0xff);
+            carry >>>= 8;
+        }
+    }
+    // bytes is little-endian; reverse and prepend leading zeros.
+    const out = new Uint8Array(leadingZeros + bytes.length);
+    for (let i = 0; i < bytes.length; i++) {
+        out[leadingZeros + (bytes.length - 1 - i)] = bytes[i];
+    }
+    if (out.length !== 32) {
+        throw new Error(`base58Decode32: expected 32-byte pubkey, got ${out.length} bytes`);
+    }
+    return out;
+}
+// ── Cursor writers ──────────────────────────────────────────────────────────
+//
+// Each writer takes a DataView + offset and returns the new offset. The
+// `DataView` interface is browser- and Node-portable. All multi-byte integers
+// are little-endian (matching `solana_program` + Borsh canonical encoding).
+/** Write u8 (single byte). Returns new offset. */
+export function writeU8(view, offset, v) {
+    view.setUint8(offset, v & 0xff);
+    return offset + 1;
+}
+/** Write u16 little-endian. Returns new offset. */
+export function writeU16Le(view, offset, v) {
+    view.setUint16(offset, v, true);
+    return offset + 2;
+}
+/** Write u32 little-endian. Returns new offset. */
+export function writeU32Le(view, offset, v) {
+    view.setUint32(offset, v, true);
+    return offset + 4;
+}
+/** Write u64 little-endian. Returns new offset. */
+export function writeU64Le(view, offset, v) {
+    view.setBigUint64(offset, v, true);
+    return offset + 8;
+}
+/** Write a bool as a single 0/1 byte. Returns new offset. */
+export function writeBool(view, offset, v) {
+    view.setUint8(offset, v ? 1 : 0);
+    return offset + 1;
+}
+// ── SHA-256 hasher ──────────────────────────────────────────────────────────
+/**
+ * SHA-256 over the input bytes. Backed by `@noble/hashes/sha256` — pure
+ * JS, browser- and Bun-compatible, byte-identical to Node's `node:crypto`
+ * for the same input (TA-19 cross-impl fixture suite verifies this).
+ *
+ * Phase 9 Batch I switched the backend from `node:crypto` to noble so AL3
+ * intent-digest can ship the same primitive across Node, Bun, and the
+ * browser without runtime-conditional imports.
+ */
+export function sha256(input) {
+    return nobleSha256(input);
+}
+/**
+ * Constant-time digest comparison (true if `a` and `b` are byte-equal).
+ * Uses XOR-accumulate with no early exit so timing leaks don't reveal
+ * which prefix matched. Used by cosign + policy-digest verification.
+ */
+export function digestsEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let acc = 0;
+    for (let i = 0; i < a.length; i++) {
+        acc |= (a[i] ^ b[i]) & 0xff;
+    }
+    return acc === 0;
+}
+//# sourceMappingURL=canonical-encode.js.map

package/dist/canonical-encode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-encode.js","sourceRoot":"","sources":["../src/canonical-encode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,MAAM,IAAI,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAE3D,+EAA+E;AAC/E,EAAE;AACF,2EAA2E;AAC3E,6EAA6E;AAC7E,wEAAwE;AACxE,qEAAqE;AAErE,MAAM,eAAe,GACnB,4DAA4D,CAAC;AAC/D,MAAM,YAAY,GAA2B,CAAC,GAAG,EAAE;IACjD,MAAM,CAAC,GAA2B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChD,CAAC,CAAC,eAAe,CAAC,CAAC,CAAE,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC,EAAE,CAAC;AAEL;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,OAAO,YAAY,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,GAAG,EAAE,CAAC;QAC1D,YAAY,EAAE,CAAC;IACjB,CAAC;IACD,iDAAiD;IACjD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;QAChB,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,GAAG,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAE,GAAG,EAAE,CAAC;YACxB,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC;YACxB,KAAK,MAAM,CAAC,CAAC;QACf,CAAC;QACD,OAAO,KAAK,GAAG,CAAC,EAAE,CAAC;YACjB,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;YACzB,KAAK,MAAM,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IACD,6DAA6D;IAC7D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IACxD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,GAAG,CAAC,YAAY,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IACzD,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,gDAAgD,GAAG,CAAC,MAAM,QAAQ,CACnE,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+EAA+E;AAC/E,EAAE;AACF,wEAAwE;AACxE,8EAA8E;AAC9E,4EAA4E;AAE5E,kDAAkD;AAClD,MAAM,UAAU,OAAO,CAAC,IAAc,EAAE,MAAc,EAAE,CAAS;IAC/D,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAChC,OAAO,MAAM,GAAG,CAAC,CAAC;AACpB,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,UAAU,CAAC,IAAc,EAAE,MAAc,EAAE,CAAS;IAClE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAChC,OAAO,MAAM,GAAG,CAAC,CAAC;AACpB,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,UAAU,CAAC,IAAc,EAAE,MAAc,EAAE,CAAS;IAClE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAChC,OAAO,MAAM,GAAG,CAAC,CAAC;AACpB,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,UAAU,CAAC,IAAc,EAAE,MAAc,EAAE,CAAS;IAClE,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IACnC,OAAO,MAAM,GAAG,CAAC,CAAC;AACpB,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,SAAS,CAAC,IAAc,EAAE,MAAc,EAAE,CAAU;IAClE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,OAAO,MAAM,GAAG,CAAC,CAAC;AACpB,CAAC;AAED,+EAA+E;AAE/E;;;;;;;;GAQG;AACH,MAAM,UAAU,MAAM,CAAC,KAAiB;IACtC,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,CAAa,EAAE,CAAa;IACvD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,GAAG,IAAI,CAAC;IAChC,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,CAAC;AACnB,CAAC"}