@zanii/kyb 0.1.0

package/LICENSE

@@ -0,0 +1,159 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or Derivative
+          Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or agreed
+      to in writing, Licensor provides the Work (and each Contributor
+      provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES
+      OR CONDITIONS OF ANY KIND, either express or implied, including,
+      without limitation, any warranties or conditions of TITLE,
+      NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2026 Zanii
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,56 @@
+# @zanii/kyb
+
+Owner-to-legal-entity binding: **who is legally on the hook?** `@zanii/kya` screens
+*agents*; `@zanii/credentials` binds *institutions* to domains. This closes the gap
+between them — binding an **owner did:key** to a legal entity, so `escrow`,
+`insurance`, and `sla` parties know who they are contracting with in the legal sense.
+
+```sh
+npm install @zanii/kyb @zanii/core
+```
+
+The binding is deliberately **two-way** — one-sided claims are refused:
+
+```jsonc
+// 1. the company serves https://acme.com/.well-known/zanii-owner.json
+{ "v": 1,
+  "entity": { "name": "Acme FZ-LLC", "jurisdiction": "AE-DU", "registration": "DED-12345" },
+  "domain": "acme.com",
+  "owner_dids": ["did:key:z6Mk…"] }
+```
+
+```ts
+import { buildOwnerAttestation, fetchAndVerifyOwner } from '@zanii/kyb';
+
+// 2. the owner signs the other half — this key claims this domain and entity
+const attestation = buildOwnerAttestation(
+  { did: owner.did, domain: 'acme.com', entity: { name: 'Acme FZ-LLC' }, ts: now },
+  ownerPrivateKey,
+);
+
+// 3. anyone verifies both halves agree
+const r = await fetchAndVerifyOwner(attestation);
+r.ok;       // signed by the DID + listed by the domain + same entity on both sides
+r.entity;   // the entity BOTH sides agree on
+```
+
+Python: `from zanii.kyb import build_owner_attestation, fetch_and_verify_owner, ...`
+— byte-identical JCS objects and hashes.
+
+## Why two-way
+
+A domain listing a DID proves nothing alone — anyone can list any DID. A key naming a
+domain proves nothing alone — anyone can name any domain. Both together bind: whoever
+controls the domain and whoever controls the key agree they are the same entity. The
+doc must be served from the domain it claims (no cross-domain vouching), entity names
+must match exactly, and `jurisdiction`/`registration` must agree wherever both sides
+state them (silence on a field is not a mismatch).
+
+## The limit, stated up front
+
+**Domain control is not corporate registration.** Zanii verifies that both sides claim
+the same entity — it does NOT verify the entity exists in a corporate registry, is
+solvent, or is lawfully named. Real KYB (registry checks, sanctions, UBO) is an
+off-protocol process this package makes *auditable*: the attestation is signed and
+permanent, so a false claim is attributable forever. We verify domain control; we
+never certify companies — the `@zanii/credentials` posture, unchanged.

package/dist/index.d.ts

@@ -0,0 +1,62 @@
+export type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
+/** The legal-entity details both sides must agree on. */
+export interface LegalEntity {
+    /** Registered name, e.g. `Acme FZ-LLC`. */
+    name: string;
+    /** Jurisdiction, e.g. `AE-DU`, `US-DE`. */
+    jurisdiction?: string;
+    /** Registry number / licence id — auditable off-protocol. */
+    registration?: string;
+}
+/** Published at `https://<domain>/.well-known/zanii-owner.json`. Domain control = half the binding. */
+export interface OwnerDoc {
+    v: 1;
+    entity: LegalEntity;
+    /** MUST equal the domain it is served from — no cross-domain vouching. */
+    domain: string;
+    /** The owner `did:key`(s) this entity operates. Rotation: overlap old + new. */
+    owner_dids: string[];
+}
+/** The owner-signed half: this key claims this domain and entity. */
+export interface OwnerAttestation {
+    v: 1;
+    type: 'kyb.attestation';
+    did: string;
+    domain: string;
+    entity: LegalEntity;
+    ts: string;
+    /** `ed25519:<hex>` by `did`. */
+    sig?: string;
+}
+/** Build + sign the owner's half of the binding. */
+export declare function buildOwnerAttestation(fields: {
+    did: string;
+    domain: string;
+    entity: LegalEntity;
+    ts: string;
+}, ownerPrivateKey: Uint8Array): OwnerAttestation;
+/** Verify the attestation is signed by the DID it names. */
+export declare function verifyOwnerAttestation(a: OwnerAttestation | undefined): boolean;
+export declare function attestationHash(a: OwnerAttestation): string;
+/** Fetch a domain's owner doc. Injected fetch keeps it offline-testable. Null = domain publishes nothing usable. */
+export declare function resolveOwnerDoc(domain: string, opts?: {
+    fetchImpl?: FetchLike;
+}): Promise<OwnerDoc | null>;
+export interface KybCheck {
+    ok: boolean;
+    reasons: string[];
+    /** Set when ok — the entity BOTH sides agree on. */
+    entity: LegalEntity | null;
+}
+/**
+ * The two-way check — pure and offline (pass the doc you resolved). `ok` only when:
+ * the attestation is validly signed by its DID, the domain doc lists that DID, and
+ * both sides name the SAME entity (exact `name` match; `jurisdiction`/`registration`
+ * must match when both sides state them).
+ */
+export declare function verifyOwnerBinding(attestation: OwnerAttestation, doc: OwnerDoc | null): KybCheck;
+/** Convenience: resolve the domain doc and run the two-way check in one call. */
+export declare function fetchAndVerifyOwner(attestation: OwnerAttestation, opts?: {
+    fetchImpl?: FetchLike;
+}): Promise<KybCheck>;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAkCA,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEjF,yDAAyD;AACzD,MAAM,WAAW,WAAW;IAC1B,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,uGAAuG;AACvG,MAAM,WAAW,QAAQ;IACvB,CAAC,EAAE,CAAC,CAAC;IACL,MAAM,EAAE,WAAW,CAAC;IACpB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,qEAAqE;AACrE,MAAM,WAAW,gBAAgB;IAC/B,CAAC,EAAE,CAAC,CAAC;IACL,IAAI,EAAE,iBAAiB,CAAC;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,gCAAgC;IAChC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,oDAAoD;AACpD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,WAAW,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,EACxE,eAAe,EAAE,UAAU,GAC1B,gBAAgB,CAelB;AAED,4DAA4D;AAC5D,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,gBAAgB,GAAG,SAAS,GAAG,OAAO,CAa/E;AAED,wBAAgB,eAAe,CAAC,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAE3D;AAED,oHAAoH;AACpH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,SAAS,CAAA;CAAO,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAepH;AAED,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,oDAAoD;IACpD,MAAM,EAAE,WAAW,GAAG,IAAI,CAAC;CAC5B;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,gBAAgB,EAAE,GAAG,EAAE,QAAQ,GAAG,IAAI,GAAG,QAAQ,CAyBhG;AAED,iFAAiF;AACjF,wBAAsB,mBAAmB,CACvC,WAAW,EAAE,gBAAgB,EAC7B,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,SAAS,CAAA;CAAO,GACnC,OAAO,CAAC,QAAQ,CAAC,CAMnB"}

package/dist/index.js

@@ -0,0 +1,138 @@
+/**
+ * @zanii/kyb — owner-to-legal-entity binding: who is legally on the hook?
+ *
+ * `@zanii/kya` screens *agents*; `@zanii/credentials` binds *institutions* to domains.
+ * The gap between them: nothing binds an **owner did:key** to a legal entity — and for
+ * `escrow`, `insurance`, and `sla` to work commercially, the parties need to know who
+ * they are contracting with in the legal sense.
+ *
+ * The binding is deliberately **two-way** — one-sided claims are refused:
+ *
+ * 1. The company serves `/.well-known/zanii-owner.json` on its **own domain**, listing
+ *    its owner DIDs and legal-entity details (domain control = the web's existing
+ *    trust anchor, the same mechanism `@zanii/credentials` uses).
+ * 2. The owner signs an **attestation** naming that exact domain and entity.
+ *
+ * A domain listing a DID it doesn't control proves nothing (anyone can list any DID);
+ * a key claiming a domain it doesn't control proves nothing (anyone can name any
+ * domain). Both together bind: whoever controls the domain and whoever controls the
+ * key agree they are the same entity.
+ *
+ * ## The limit, stated up front
+ *
+ * **Domain control is not corporate registration.** Zanii verifies that whoever
+ * controls `acme.com` and whoever controls the owner key both claim "Acme FZ-LLC" —
+ * it does NOT verify Acme FZ-LLC exists in a corporate registry, is solvent, or is
+ * lawfully named. Real KYB (registry checks, sanctions, UBO) is an off-protocol
+ * process this package makes *auditable*: the attestation is signed and permanent, so
+ * a false claim is attributable forever. We verify domain control; we never certify
+ * companies — the `@zanii/credentials` posture, unchanged.
+ */
+import { ed25519 } from '@noble/curves/ed25519';
+import { bytesToHex, hexToBytes } from '@noble/hashes/utils';
+import { canonicalBytes, jcsHash, publicKeyFromDid } from '@zanii/core';
+/** Build + sign the owner's half of the binding. */
+export function buildOwnerAttestation(fields, ownerPrivateKey) {
+    if (!fields.did)
+        throw new Error('did is required');
+    if (!fields.domain)
+        throw new Error('domain is required');
+    if (!fields.entity?.name)
+        throw new Error('entity.name is required');
+    if (Number.isNaN(Date.parse(fields.ts)))
+        throw new Error('ts must be an ISO timestamp');
+    const unsigned = {
+        v: 1,
+        type: 'kyb.attestation',
+        did: fields.did,
+        domain: fields.domain.toLowerCase(),
+        entity: fields.entity,
+        ts: fields.ts,
+    };
+    const sig = ed25519.sign(canonicalBytes(unsigned), ownerPrivateKey);
+    return { ...unsigned, sig: `ed25519:${bytesToHex(sig)}` };
+}
+/** Verify the attestation is signed by the DID it names. */
+export function verifyOwnerAttestation(a) {
+    const p = a ?? {};
+    if (p.v !== 1 || p.type !== 'kyb.attestation' || !p.did || !p.domain || !p.entity?.name)
+        return false;
+    if (typeof p.ts !== 'string' || Number.isNaN(Date.parse(p.ts)))
+        return false;
+    const pub = publicKeyFromDid(p.did);
+    const hex = typeof p.sig === 'string' && p.sig.startsWith('ed25519:') ? p.sig.slice(8) : '';
+    if (!pub || !/^[0-9a-f]{128}$/.test(hex))
+        return false;
+    const { sig: _omit, ...unsigned } = p;
+    try {
+        return ed25519.verify(hexToBytes(hex), canonicalBytes(unsigned), pub);
+    }
+    catch {
+        return false;
+    }
+}
+export function attestationHash(a) {
+    return jcsHash(a);
+}
+/** Fetch a domain's owner doc. Injected fetch keeps it offline-testable. Null = domain publishes nothing usable. */
+export async function resolveOwnerDoc(domain, opts = {}) {
+    const fetchImpl = opts.fetchImpl ?? ((u, i) => fetch(u, i));
+    const host = domain.toLowerCase();
+    let doc;
+    try {
+        const res = await fetchImpl(`https://${host}/.well-known/zanii-owner.json`);
+        if (!res.ok)
+            return null;
+        doc = (await res.json());
+    }
+    catch {
+        return null;
+    }
+    if (doc?.v !== 1 || !doc.entity?.name || !Array.isArray(doc.owner_dids))
+        return null;
+    // Served-from domain must match the claimed domain — no cross-domain vouching.
+    if (typeof doc.domain !== 'string' || doc.domain.toLowerCase() !== host)
+        return null;
+    return doc;
+}
+/**
+ * The two-way check — pure and offline (pass the doc you resolved). `ok` only when:
+ * the attestation is validly signed by its DID, the domain doc lists that DID, and
+ * both sides name the SAME entity (exact `name` match; `jurisdiction`/`registration`
+ * must match when both sides state them).
+ */
+export function verifyOwnerBinding(attestation, doc) {
+    const reasons = [];
+    if (!verifyOwnerAttestation(attestation)) {
+        return { ok: false, reasons: ['attestation is not validly signed by its DID'], entity: null };
+    }
+    if (!doc || doc.v !== 1 || typeof doc.domain !== 'string' || !doc.entity?.name || !Array.isArray(doc.owner_dids)) {
+        return { ok: false, reasons: [`${attestation.domain} publishes no valid owner doc — the domain side of the binding is missing`], entity: null };
+    }
+    if (doc.domain.toLowerCase() !== attestation.domain.toLowerCase()) {
+        reasons.push(`attestation names ${attestation.domain} but the doc is for ${doc.domain}`);
+    }
+    if (!doc.owner_dids.includes(attestation.did)) {
+        reasons.push(`the domain does not list ${attestation.did} — anyone can sign a claim; only the domain's list makes it mutual`);
+    }
+    if (doc.entity.name !== attestation.entity.name) {
+        reasons.push(`entity name mismatch: domain says '${doc.entity.name}', owner claims '${attestation.entity.name}'`);
+    }
+    for (const field of ['jurisdiction', 'registration']) {
+        const a = attestation.entity[field];
+        const d = doc.entity[field];
+        if (a !== undefined && d !== undefined && a !== d) {
+            reasons.push(`entity ${field} mismatch: domain says '${d}', owner claims '${a}'`);
+        }
+    }
+    return { ok: reasons.length === 0, reasons, entity: reasons.length === 0 ? doc.entity : null };
+}
+/** Convenience: resolve the domain doc and run the two-way check in one call. */
+export async function fetchAndVerifyOwner(attestation, opts = {}) {
+    if (!verifyOwnerAttestation(attestation)) {
+        return { ok: false, reasons: ['attestation is not validly signed by its DID'], entity: null };
+    }
+    const doc = await resolveOwnerDoc(attestation.domain, opts);
+    return verifyOwnerBinding(attestation, doc);
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAoCxE,oDAAoD;AACpD,MAAM,UAAU,qBAAqB,CACnC,MAAwE,EACxE,eAA2B;IAE3B,IAAI,CAAC,MAAM,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC1D,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACxF,MAAM,QAAQ,GAAG;QACf,CAAC,EAAE,CAAU;QACb,IAAI,EAAE,iBAA0B;QAChC,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE;QACnC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,EAAE,EAAE,MAAM,CAAC,EAAE;KACd,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC,CAAC;IACpE,OAAO,EAAE,GAAG,QAAQ,EAAE,GAAG,EAAE,WAAW,UAAU,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;AAC5D,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,sBAAsB,CAAC,CAA+B;IACpE,MAAM,CAAC,GAAG,CAAC,IAAK,EAAuB,CAAC;IACxC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI;QAAE,OAAO,KAAK,CAAC;IACtG,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,MAAM,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5F,IAAI,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,QAAQ,EAAE,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,QAA8C,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9G,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,CAAmB;IACjD,OAAO,OAAO,CAAC,CAAuC,CAAC,CAAC;AAC1D,CAAC;AAED,oHAAoH;AACpH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,OAAkC,EAAE;IACxF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAS,EAAE,CAAe,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAClC,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,WAAW,IAAI,+BAA+B,CAAC,CAAC;QAC5E,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAa,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IACrF,+EAA+E;IAC/E,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrF,OAAO,GAAG,CAAC;AACb,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAA6B,EAAE,GAAoB;IACpF,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,EAAE,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,8CAA8C,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAChG,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACjH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,2EAA2E,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAClJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QAClE,OAAO,CAAC,IAAI,CAAC,qBAAqB,WAAW,CAAC,MAAM,uBAAuB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO,CAAC,IAAI,CAAC,4BAA4B,WAAW,CAAC,GAAG,oEAAoE,CAAC,CAAC;IAChI,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC,sCAAsC,GAAG,CAAC,MAAM,CAAC,IAAI,oBAAoB,WAAW,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;IACpH,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,CAAC,cAAc,EAAE,cAAc,CAAU,EAAE,CAAC;QAC9D,MAAM,CAAC,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,OAAO,CAAC,IAAI,CAAC,UAAU,KAAK,2BAA2B,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACjG,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,WAA6B,EAC7B,OAAkC,EAAE;IAEpC,IAAI,CAAC,sBAAsB,CAAC,WAAW,CAAC,EAAE,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,8CAA8C,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAChG,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC5D,OAAO,kBAAkB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;AAC9C,CAAC"}

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@zanii/kyb",
+  "version": "0.1.0",
+  "description": "Owner-to-legal-entity binding - the missing link between an owner did:key and who is legally on the hook. Two-way: the company serves .well-known/zanii-owner.json on its own domain AND the owner signs an attestation naming that domain and entity; verification requires both. Zanii verifies domain control, never corporate registration - the claim becomes verifiable and attributable, not officially certified.",
+  "license": "Apache-2.0",
+  "homepage": "https://ledger.zanii.agency",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "devDependencies": {
+    "@types/node": "^26.1.0",
+    "typescript": "^5.8.2",
+    "vitest": "^3.0.9"
+  },
+  "dependencies": {
+    "@noble/curves": "^1.8.1",
+    "@noble/hashes": "^1.7.1",
+    "@zanii/core": "0.4.0"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit"
+  }
+}

package/src/index.ts

@@ -0,0 +1,178 @@
+/**
+ * @zanii/kyb — owner-to-legal-entity binding: who is legally on the hook?
+ *
+ * `@zanii/kya` screens *agents*; `@zanii/credentials` binds *institutions* to domains.
+ * The gap between them: nothing binds an **owner did:key** to a legal entity — and for
+ * `escrow`, `insurance`, and `sla` to work commercially, the parties need to know who
+ * they are contracting with in the legal sense.
+ *
+ * The binding is deliberately **two-way** — one-sided claims are refused:
+ *
+ * 1. The company serves `/.well-known/zanii-owner.json` on its **own domain**, listing
+ *    its owner DIDs and legal-entity details (domain control = the web's existing
+ *    trust anchor, the same mechanism `@zanii/credentials` uses).
+ * 2. The owner signs an **attestation** naming that exact domain and entity.
+ *
+ * A domain listing a DID it doesn't control proves nothing (anyone can list any DID);
+ * a key claiming a domain it doesn't control proves nothing (anyone can name any
+ * domain). Both together bind: whoever controls the domain and whoever controls the
+ * key agree they are the same entity.
+ *
+ * ## The limit, stated up front
+ *
+ * **Domain control is not corporate registration.** Zanii verifies that whoever
+ * controls `acme.com` and whoever controls the owner key both claim "Acme FZ-LLC" —
+ * it does NOT verify Acme FZ-LLC exists in a corporate registry, is solvent, or is
+ * lawfully named. Real KYB (registry checks, sanctions, UBO) is an off-protocol
+ * process this package makes *auditable*: the attestation is signed and permanent, so
+ * a false claim is attributable forever. We verify domain control; we never certify
+ * companies — the `@zanii/credentials` posture, unchanged.
+ */
+import { ed25519 } from '@noble/curves/ed25519';
+import { bytesToHex, hexToBytes } from '@noble/hashes/utils';
+import { canonicalBytes, jcsHash, publicKeyFromDid } from '@zanii/core';
+
+export type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
+
+/** The legal-entity details both sides must agree on. */
+export interface LegalEntity {
+  /** Registered name, e.g. `Acme FZ-LLC`. */
+  name: string;
+  /** Jurisdiction, e.g. `AE-DU`, `US-DE`. */
+  jurisdiction?: string;
+  /** Registry number / licence id — auditable off-protocol. */
+  registration?: string;
+}
+
+/** Published at `https://<domain>/.well-known/zanii-owner.json`. Domain control = half the binding. */
+export interface OwnerDoc {
+  v: 1;
+  entity: LegalEntity;
+  /** MUST equal the domain it is served from — no cross-domain vouching. */
+  domain: string;
+  /** The owner `did:key`(s) this entity operates. Rotation: overlap old + new. */
+  owner_dids: string[];
+}
+
+/** The owner-signed half: this key claims this domain and entity. */
+export interface OwnerAttestation {
+  v: 1;
+  type: 'kyb.attestation';
+  did: string;
+  domain: string;
+  entity: LegalEntity;
+  ts: string;
+  /** `ed25519:<hex>` by `did`. */
+  sig?: string;
+}
+
+/** Build + sign the owner's half of the binding. */
+export function buildOwnerAttestation(
+  fields: { did: string; domain: string; entity: LegalEntity; ts: string },
+  ownerPrivateKey: Uint8Array,
+): OwnerAttestation {
+  if (!fields.did) throw new Error('did is required');
+  if (!fields.domain) throw new Error('domain is required');
+  if (!fields.entity?.name) throw new Error('entity.name is required');
+  if (Number.isNaN(Date.parse(fields.ts))) throw new Error('ts must be an ISO timestamp');
+  const unsigned = {
+    v: 1 as const,
+    type: 'kyb.attestation' as const,
+    did: fields.did,
+    domain: fields.domain.toLowerCase(),
+    entity: fields.entity,
+    ts: fields.ts,
+  };
+  const sig = ed25519.sign(canonicalBytes(unsigned), ownerPrivateKey);
+  return { ...unsigned, sig: `ed25519:${bytesToHex(sig)}` };
+}
+
+/** Verify the attestation is signed by the DID it names. */
+export function verifyOwnerAttestation(a: OwnerAttestation | undefined): boolean {
+  const p = a ?? ({} as OwnerAttestation);
+  if (p.v !== 1 || p.type !== 'kyb.attestation' || !p.did || !p.domain || !p.entity?.name) return false;
+  if (typeof p.ts !== 'string' || Number.isNaN(Date.parse(p.ts))) return false;
+  const pub = publicKeyFromDid(p.did);
+  const hex = typeof p.sig === 'string' && p.sig.startsWith('ed25519:') ? p.sig.slice(8) : '';
+  if (!pub || !/^[0-9a-f]{128}$/.test(hex)) return false;
+  const { sig: _omit, ...unsigned } = p;
+  try {
+    return ed25519.verify(hexToBytes(hex), canonicalBytes(unsigned as unknown as Record<string, unknown>), pub);
+  } catch {
+    return false;
+  }
+}
+
+export function attestationHash(a: OwnerAttestation): string {
+  return jcsHash(a as unknown as Record<string, unknown>);
+}
+
+/** Fetch a domain's owner doc. Injected fetch keeps it offline-testable. Null = domain publishes nothing usable. */
+export async function resolveOwnerDoc(domain: string, opts: { fetchImpl?: FetchLike } = {}): Promise<OwnerDoc | null> {
+  const fetchImpl = opts.fetchImpl ?? ((u: string, i?: RequestInit) => fetch(u, i));
+  const host = domain.toLowerCase();
+  let doc: OwnerDoc;
+  try {
+    const res = await fetchImpl(`https://${host}/.well-known/zanii-owner.json`);
+    if (!res.ok) return null;
+    doc = (await res.json()) as OwnerDoc;
+  } catch {
+    return null;
+  }
+  if (doc?.v !== 1 || !doc.entity?.name || !Array.isArray(doc.owner_dids)) return null;
+  // Served-from domain must match the claimed domain — no cross-domain vouching.
+  if (typeof doc.domain !== 'string' || doc.domain.toLowerCase() !== host) return null;
+  return doc;
+}
+
+export interface KybCheck {
+  ok: boolean;
+  reasons: string[];
+  /** Set when ok — the entity BOTH sides agree on. */
+  entity: LegalEntity | null;
+}
+
+/**
+ * The two-way check — pure and offline (pass the doc you resolved). `ok` only when:
+ * the attestation is validly signed by its DID, the domain doc lists that DID, and
+ * both sides name the SAME entity (exact `name` match; `jurisdiction`/`registration`
+ * must match when both sides state them).
+ */
+export function verifyOwnerBinding(attestation: OwnerAttestation, doc: OwnerDoc | null): KybCheck {
+  const reasons: string[] = [];
+  if (!verifyOwnerAttestation(attestation)) {
+    return { ok: false, reasons: ['attestation is not validly signed by its DID'], entity: null };
+  }
+  if (!doc || doc.v !== 1 || typeof doc.domain !== 'string' || !doc.entity?.name || !Array.isArray(doc.owner_dids)) {
+    return { ok: false, reasons: [`${attestation.domain} publishes no valid owner doc — the domain side of the binding is missing`], entity: null };
+  }
+  if (doc.domain.toLowerCase() !== attestation.domain.toLowerCase()) {
+    reasons.push(`attestation names ${attestation.domain} but the doc is for ${doc.domain}`);
+  }
+  if (!doc.owner_dids.includes(attestation.did)) {
+    reasons.push(`the domain does not list ${attestation.did} — anyone can sign a claim; only the domain's list makes it mutual`);
+  }
+  if (doc.entity.name !== attestation.entity.name) {
+    reasons.push(`entity name mismatch: domain says '${doc.entity.name}', owner claims '${attestation.entity.name}'`);
+  }
+  for (const field of ['jurisdiction', 'registration'] as const) {
+    const a = attestation.entity[field];
+    const d = doc.entity[field];
+    if (a !== undefined && d !== undefined && a !== d) {
+      reasons.push(`entity ${field} mismatch: domain says '${d}', owner claims '${a}'`);
+    }
+  }
+  return { ok: reasons.length === 0, reasons, entity: reasons.length === 0 ? doc.entity : null };
+}
+
+/** Convenience: resolve the domain doc and run the two-way check in one call. */
+export async function fetchAndVerifyOwner(
+  attestation: OwnerAttestation,
+  opts: { fetchImpl?: FetchLike } = {},
+): Promise<KybCheck> {
+  if (!verifyOwnerAttestation(attestation)) {
+    return { ok: false, reasons: ['attestation is not validly signed by its DID'], entity: null };
+  }
+  const doc = await resolveOwnerDoc(attestation.domain, opts);
+  return verifyOwnerBinding(attestation, doc);
+}