tenzro-wallet 0.1.0

package/dist/settlement/nanopayment-flow.js

@@ -0,0 +1,111 @@
+/**
+ * NanopaymentFlow — wallet-side orchestration helpers for nanopayment
+ * channels. The `NanopaymentPort` exposes the SDK's primitives one-for-one;
+ * this module composes them into the lifecycle a real consumer (LLM
+ * streaming UI, per-API-call paywall, bandwidth meter) actually drives:
+ *
+ *   open → many sendNanopayment → autoFlush at threshold → close on done
+ *
+ * The orchestration is all wallet-side. The node holds the channel state,
+ * the SDK exposes RPCs, this module sequences them.
+ */
+const DEFAULT_OPTS = {
+    flushEvery: 100,
+    flushAtAmount: 0n, // disabled by default — count-only
+};
+/**
+ * Stateful helper that owns one open channel. Counts payments + value, flushes
+ * on threshold, closes on `done()`. Designed to be created once at the start
+ * of a streaming session and discarded at the end.
+ */
+export class NanopaymentSession {
+    #port;
+    #channel;
+    #opts;
+    #unsettledCount = 0;
+    #unsettledAmount = 0n;
+    #totalPaid = 0n;
+    #closed = false;
+    constructor(port, channel, opts) {
+        this.#port = port;
+        this.#channel = channel;
+        this.#opts = opts;
+    }
+    /** Open a channel and return a session bound to it. */
+    static async open(port, req, opts = {}) {
+        const channel = await port.openChannel({
+            payer: req.payer,
+            payee: req.payee,
+            deposit: req.deposit,
+            ...(req.asset !== undefined ? { asset: req.asset } : {}),
+        });
+        return new NanopaymentSession(port, channel, opts);
+    }
+    get channelId() {
+        return this.#channel.channelId;
+    }
+    get totalPaid() {
+        return this.#totalPaid;
+    }
+    /**
+     * Send a single off-chain payment. Returns the receipt. Auto-flushes
+     * when count or amount thresholds cross.
+     */
+    async send(amount, memo) {
+        if (this.#closed) {
+            throw new Error('NanopaymentSession.send: session is closed');
+        }
+        const cap = this.#opts.sessionCap;
+        if (cap !== undefined && this.#totalPaid + amount > cap) {
+            throw new Error(`NanopaymentSession.send: amount ${amount} would exceed session cap ${cap} ` +
+                `(already paid ${this.#totalPaid})`);
+        }
+        const receipt = await this.#port.sendNanopayment({
+            channelId: this.#channel.channelId,
+            amount,
+            ...(memo !== undefined ? { memo } : {}),
+        });
+        this.#unsettledCount += 1;
+        this.#unsettledAmount += amount;
+        this.#totalPaid += amount;
+        if (this.#shouldAutoFlush()) {
+            await this.flush();
+        }
+        return receipt;
+    }
+    /** Force an on-chain batch settlement. Resets unsettled counters. */
+    async flush() {
+        if (this.#unsettledCount === 0)
+            return;
+        await this.#port.flushBatch(this.#channel.channelId);
+        this.#unsettledCount = 0;
+        this.#unsettledAmount = 0n;
+    }
+    /** Close the channel. Idempotent; subsequent sends throw. */
+    async close() {
+        if (this.#closed)
+            return;
+        this.#closed = true;
+        if (this.#unsettledCount > 0) {
+            // Best-effort flush before close; if it fails, close still proceeds —
+            // the node settles anything outstanding from the channel state.
+            try {
+                await this.#port.flushBatch(this.#channel.channelId);
+            }
+            catch {
+                // swallow — close handles final state
+            }
+        }
+        await this.#port.closeChannel(this.#channel.channelId);
+    }
+    #shouldAutoFlush() {
+        const flushEvery = this.#opts.flushEvery ?? DEFAULT_OPTS.flushEvery;
+        if (flushEvery > 0 && this.#unsettledCount >= flushEvery)
+            return true;
+        const flushAtAmount = this.#opts.flushAtAmount ?? DEFAULT_OPTS.flushAtAmount;
+        if (flushAtAmount > 0n && this.#unsettledAmount >= flushAtAmount)
+            return true;
+        return false;
+    }
+}
+//# sourceMappingURL=nanopayment-flow.js.map

package/dist/settlement/nanopayment-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nanopayment-flow.js","sourceRoot":"","sources":["../../src/settlement/nanopayment-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAiBH,MAAM,YAAY,GAA4D;IAC5E,UAAU,EAAE,GAAG;IACf,aAAa,EAAE,EAAE,EAAE,mCAAmC;CACvD,CAAC;AAEF;;;;GAIG;AACH,MAAM,OAAO,kBAAkB;IACpB,KAAK,CAAkB;IACvB,QAAQ,CAAc;IACtB,KAAK,CAA4B;IAC1C,eAAe,GAAG,CAAC,CAAC;IACpB,gBAAgB,GAAG,EAAE,CAAC;IACtB,UAAU,GAAG,EAAE,CAAC;IAChB,OAAO,GAAG,KAAK,CAAC;IAEhB,YACE,IAAqB,EACrB,OAAoB,EACpB,IAA+B;QAE/B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,uDAAuD;IACvD,MAAM,CAAC,KAAK,CAAC,IAAI,CACf,IAAqB,EACrB,GAAsE,EACtE,OAAkC,EAAE;QAEpC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC;YACrC,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC,CAAC;QACH,OAAO,IAAI,kBAAkB,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;IACjC,CAAC;IAED,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,UAAU,CAAC;IACzB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,MAAc,EAAE,IAAa;QACtC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;QAClC,IAAI,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,GAAG,MAAM,GAAG,GAAG,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,6BAA6B,GAAG,GAAG;gBAC1E,iBAAiB,IAAI,CAAC,UAAU,GAAG,CACtC,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC;YAC/C,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;YAClC,MAAM;YACN,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxC,CAAC,CAAC;QACH,IAAI,CAAC,eAAe,IAAI,CAAC,CAAC;QAC1B,IAAI,CAAC,gBAAgB,IAAI,MAAM,CAAC;QAChC,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC;QAC1B,IAAI,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;YAC5B,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,qEAAqE;IACrE,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,eAAe,KAAK,CAAC;YAAE,OAAO;QACvC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACrD,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,gBAAgB,GAAG,EAAE,CAAC;IAC7B,CAAC;IAED,6DAA6D;IAC7D,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI,CAAC,eAAe,GAAG,CAAC,EAAE,CAAC;YAC7B,sEAAsE;YACtE,gEAAgE;YAChE,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC;gBACP,sCAAsC;YACxC,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC;IAED,gBAAgB;QACd,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,YAAY,CAAC,UAAU,CAAC;QACpE,IAAI,UAAU,GAAG,CAAC,IAAI,IAAI,CAAC,eAAe,IAAI,UAAU;YAAE,OAAO,IAAI,CAAC;QACtE,MAAM,aAAa,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,YAAY,CAAC,aAAa,CAAC;QAC7E,IAAI,aAAa,GAAG,EAAE,IAAI,IAAI,CAAC,gBAAgB,IAAI,aAAa;YAAE,OAAO,IAAI,CAAC;QAC9E,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}

package/dist/surfaces/canton-external.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Canton Network MainNet surface — Tenzro hosts the validator; the user's
+ * canton-external party signs locally and the validator dispatches to the
+ * Global Synchronizer.
+ *
+ * Protocol shape (per DESIGN.md §4.5):
+ *   - prepare → ask the validator's Interactive Submission Service for a
+ *     `PreparedTransaction` proto + canonical hash.
+ *   - sign → recompute the hash locally (SHA-256 with Canton hash purpose 11
+ *     prefix, `HASHING_SCHEME_VERSION_V2`), constant-time-compare with the
+ *     validator's hash, then sign that hash via the SigningDriver. The
+ *     equality assertion is the wallet's only defence against a malicious
+ *     validator — without it, signing the validator-supplied hash trusts
+ *     the validator on what's being authorised.
+ *   - submit → `executeSubmission` with the signed hash; the validator
+ *     dispatches to the synchronizer.
+ *   - watch → tail `tailCompletions` filtered to this command id.
+ *
+ * The PreparedTransaction proto's content-level decode (re-deriving the
+ * user-visible fields from the proto and comparing them to `intent`) is
+ * deferred — see DESIGN.md §11 open question #5. Hash equality alone is
+ * sufficient to bind signature → exact bytes; content decode is a defence
+ * against a validator that returns *valid* bytes for the *wrong* transaction.
+ * We accept that gap until the proto schema lands in the kernel.
+ */
+import type { CantonValidatorPort } from '../ports/canton/canton-validator.js';
+import type { SurfaceKey, TdipDid } from '../types/identity.js';
+import type { SigningDriver } from '../types/signing-driver.js';
+import type { SurfaceModule } from '../types/surface-module.js';
+export interface CantonExternalDeps {
+    readonly keyResolver: (did: TdipDid) => SurfaceKey | undefined;
+    readonly signingDriver: SigningDriver;
+    /**
+     * Validator port. The kernel owns the adapter wiring (typically
+     * `LedgerApiAdapter`) and threads it through here. The surface module
+     * never constructs the port itself — keeps test injection clean.
+     */
+    readonly validatorPort: CantonValidatorPort;
+    /** User id to thread into completion filters (Canton needs `user_id`). */
+    readonly userId: string;
+}
+export declare function cantonExternalSurface(deps: CantonExternalDeps): SurfaceModule;
+//# sourceMappingURL=canton-external.d.ts.map

package/dist/surfaces/canton-external.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canton-external.d.ts","sourceRoot":"","sources":["../../src/surfaces/canton-external.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EACV,mBAAmB,EAIpB,MAAM,qCAAqC,CAAC;AAG7C,OAAO,KAAK,EAAkB,UAAU,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAEhF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAoBhE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,UAAU,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC;;;;OAIG;IACH,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;IAC5C,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,kBAAkB,GAAG,aAAa,CAoJ7E"}

package/dist/surfaces/canton-external.js

@@ -0,0 +1,252 @@
+/**
+ * Canton Network MainNet surface — Tenzro hosts the validator; the user's
+ * canton-external party signs locally and the validator dispatches to the
+ * Global Synchronizer.
+ *
+ * Protocol shape (per DESIGN.md §4.5):
+ *   - prepare → ask the validator's Interactive Submission Service for a
+ *     `PreparedTransaction` proto + canonical hash.
+ *   - sign → recompute the hash locally (SHA-256 with Canton hash purpose 11
+ *     prefix, `HASHING_SCHEME_VERSION_V2`), constant-time-compare with the
+ *     validator's hash, then sign that hash via the SigningDriver. The
+ *     equality assertion is the wallet's only defence against a malicious
+ *     validator — without it, signing the validator-supplied hash trusts
+ *     the validator on what's being authorised.
+ *   - submit → `executeSubmission` with the signed hash; the validator
+ *     dispatches to the synchronizer.
+ *   - watch → tail `tailCompletions` filtered to this command id.
+ *
+ * The PreparedTransaction proto's content-level decode (re-deriving the
+ * user-visible fields from the proto and comparing them to `intent`) is
+ * deferred — see DESIGN.md §11 open question #5. Hash equality alone is
+ * sufficient to bind signature → exact bytes; content decode is a defence
+ * against a validator that returns *valid* bytes for the *wrong* transaction.
+ * We accept that gap until the proto schema lands in the kernel.
+ */
+import { bytesEqualConstantTime, preparedTransactionHash } from "../ports/canton/hash.js";
+import { makeHandle } from "./util.js";
+export function cantonExternalSurface(deps) {
+    const port = deps.validatorPort;
+    return {
+        name: 'canton-external',
+        memoSpec() {
+            // Canton's transfer description is a free-form text field, optional
+            // (the network credits without it), capped at 256 chars to keep the
+            // CC `Numeric 10` payload + description under the standard transfer-
+            // command size budget. Per DESIGN.md §11.9, this is the canonical
+            // example surfaces follow.
+            return {
+                kind: 'text',
+                required: false,
+                maxLength: 256,
+                label: 'Transfer description',
+            };
+        },
+        async prepare(intent) {
+            if (intent.kind !== 'send')
+                throw new Error(`unsupported: ${intent.kind}`);
+            if (intent.to.kind !== 'canton') {
+                throw new Error('canton-external requires a canton recipient');
+            }
+            const fromKey = deps.keyResolver(intent.from);
+            if (!fromKey || fromKey.surface !== 'canton-external') {
+                throw new Error(`no canton-external key for ${intent.from}`);
+            }
+            const trackingId = `tenzro-wallet-${Date.now()}`;
+            // Two-path routing: if the recipient has a TransferPreapproval, use the
+            // one-step `TransferPreapproval_Send` path (atomic, final on commit).
+            // Otherwise fall back to the Token Standard two-step (TransferOffer
+            // / accept). Tenzro pre-creates preapprovals during external-party
+            // onboarding, so the preapproval path is the common case — but the
+            // recipient may be a non-Tenzro Canton party.
+            const preapproval = await port.lookupPreapproval(intent.to.partyId);
+            const viaPreapproval = preapproval !== null;
+            const req = {
+                actAs: fromKey.partyId,
+                synchronizerId: fromKey.synchronizerId,
+                commandId: trackingId,
+                // Pinned package id per DESIGN.md §4.5.3. Post-2026-05-05 baseline:
+                // `splice-amulet 0.1.17` on the Tenzro validator.
+                packageIdSelectionPreference: 'splice-amulet:0.1.17',
+                commands: shapeAmuletTransfer({
+                    from: fromKey.partyId,
+                    to: intent.to.partyId,
+                    amount: intent.amount,
+                    assetSymbol: intent.asset.symbol,
+                    memo: intent.memo,
+                    viaPreapproval,
+                    ...(preapproval !== null ? { preapprovalContractId: preapproval.contractId } : {}),
+                }),
+            };
+            const prepared = await port.prepareSubmission(req);
+            assertHashingScheme(prepared);
+            const body = {
+                kind: 'canton-external-send',
+                fromParty: fromKey.partyId,
+                toParty: intent.to.partyId,
+                amount: intent.amount,
+                assetSymbol: intent.asset.symbol,
+                ...(intent.memo !== undefined ? { description: intent.memo } : {}),
+                trackingId,
+                viaPreapproval,
+                synchronizerId: fromKey.synchronizerId,
+                preparedTransaction: prepared.preparedTransaction,
+                preparedTransactionHash: prepared.preparedTransactionHash,
+            };
+            return {
+                route: { kind: 'native', surface: 'canton-external' },
+                intent,
+                // Canton fees aren't paid in CC at the wallet level — they're SV
+                // reward economics under the hood. Display-only zero is fine here;
+                // the validator response carries the actual cost in CC if needed.
+                fees: [{ asset: intent.asset, amount: 0n, label: 'canton mainnet sync fee' }],
+                // Two-step (Token Standard) is held as `pending` on the receiver's
+                // side until acceptance; preapproval is atomic. Reflect the latency
+                // delta in `etaMs`.
+                etaMs: viaPreapproval ? 2000 : 8000,
+                reversibility: viaPreapproval ? 'final-on-submit' : 'reversible-until-confirmed',
+                warnings: [],
+                body,
+            };
+        },
+        async sign(prepared, _consent) {
+            const body = prepared.body;
+            const did = prepared.intent.from;
+            const key = deps.keyResolver(did);
+            if (!key || key.surface !== 'canton-external') {
+                throw new Error('missing canton-external key at sign time');
+            }
+            // Recompute the hash from the proto bytes the validator returned and
+            // assert it matches what the validator claims is the hash. Without
+            // this check the wallet trusts the validator on what it's signing —
+            // defeats external signing.
+            const recomputed = await preparedTransactionHash(body.preparedTransaction);
+            if (!bytesEqualConstantTime(recomputed, body.preparedTransactionHash)) {
+                throw new Error('canton-external: preparedTransactionHash mismatch — refusing to sign. ' +
+                    'Either the validator is malicious or the proto bytes were corrupted in transit.');
+            }
+            const result = await deps.signingDriver.sign({
+                did,
+                surfaceKey: key,
+                scheme: 'ed25519',
+                // Sign the recomputed hash, not the validator-supplied one. They're
+                // equal by the assertion above; using the recomputed one removes the
+                // last byte of trust in the validator's response.
+                preimage: recomputed,
+                purpose: 'canton-external-send',
+            });
+            return { prepared, signatures: result.signatures, body };
+        },
+        async submit(signed) {
+            const body = signed.body;
+            const key = deps.keyResolver(signed.prepared.intent.from);
+            if (!key || key.surface !== 'canton-external') {
+                throw new Error('missing canton-external key at submit time');
+            }
+            const req = {
+                preparedTransaction: body.preparedTransaction,
+                partySignatures: shapePartySignatures(key, signed.signatures),
+                hashingSchemeVersion: 'HASHING_SCHEME_VERSION_V2',
+                submissionId: body.trackingId,
+            };
+            await port.executeSubmission(req);
+            // Canton has no tx hash equivalent until the completion arrives. The
+            // returned `updateId` becomes `TxHandle.hash` once `watch` observes
+            // the completion; for now hand back the trackingId so the consent UI
+            // has something to display.
+            return makeHandle('canton-external', signed.prepared.intent, body.trackingId);
+        },
+        watch(handle) {
+            return watchViaPort(handle, port, deps.userId);
+        },
+    };
+}
+/**
+ * Translate a high-level transfer into Daml `Commands`. Hands the port a
+ * structured payload it can shape into the real Splice `Commands` proto;
+ * the kernel itself never sees the proto bytes. Two shapes by route:
+ *   - viaPreapproval: `TransferPreapproval_Send` (one-step).
+ *   - two-step: `AmuletRules_TransferOffer_Create` (recipient must accept).
+ */
+function shapeAmuletTransfer(args) {
+    if (args.viaPreapproval) {
+        return [
+            {
+                _intent: 'amulet-transfer-preapproval',
+                sender: args.from,
+                receiver: args.to,
+                amount: args.amount,
+                assetSymbol: args.assetSymbol,
+                ...(args.memo !== undefined ? { description: args.memo } : {}),
+                preapprovalContractId: args.preapprovalContractId,
+            },
+        ];
+    }
+    return [
+        {
+            _intent: 'amulet-transfer-offer',
+            sender: args.from,
+            receiver: args.to,
+            amount: args.amount,
+            assetSymbol: args.assetSymbol,
+            ...(args.memo !== undefined ? { description: args.memo } : {}),
+        },
+    ];
+}
+/**
+ * Shape the SigningDriver's signature output as `partySignatures` for the
+ * Interactive Submission Service. Single-party, threshold = N: the
+ * SigningDriver returns N signatures (one per signing key) and we attach
+ * each to the corresponding `signingKeys[i]`. M-of-N over different parties
+ * is a separate flow (multi-party signing) handled outside this surface.
+ */
+function shapePartySignatures(key, signatures) {
+    if (signatures.length < key.threshold) {
+        throw new Error(`canton-external: need ${key.threshold} signatures, got ${signatures.length}`);
+    }
+    return signatures.slice(0, key.threshold).map((sig, i) => {
+        const sk = key.signingKeys[i];
+        if (!sk)
+            throw new Error(`canton-external: missing signing key at index ${i}`);
+        return {
+            party: key.partyId,
+            signature: sig,
+            scheme: sk.scheme,
+            // Canton's `Fingerprint` (`1220` + lowercase-hex SHA-256 of the public
+            // key) is the validator's lookup key into `PartyToKeyMapping`.
+            // Precomputed at provision time so the signing path stays sync.
+            signedBy: sk.fingerprint,
+        };
+    });
+}
+function assertHashingScheme(r) {
+    if (r.hashingSchemeVersion !== 'HASHING_SCHEME_VERSION_V2') {
+        throw new Error(`canton-external: unsupported hashing scheme ${r.hashingSchemeVersion}; ` +
+            `kernel only knows V2 (see DESIGN.md §11 open question #4)`);
+    }
+}
+/**
+ * Watch a Canton submission to completion. Tails `port.tailCompletions`
+ * filtered to the user's party + this command id, surfaces the single
+ * `executed | failed` finality event as a TxStatus stream.
+ */
+async function* watchViaPort(handle, port, userId) {
+    yield { handle, phase: 'created' };
+    yield { handle, phase: 'pending' };
+    // Watching against the port: Canton has no confirmation depth, so we
+    // surface a single `confirmed` event for `executed` and stop there.
+    for await (const c of port.tailCompletions({
+        userId,
+        actAs: [handle.surface],
+    })) {
+        if (c.commandId !== handle.hash)
+            continue; // hash carries the trackingId
+        yield {
+            handle: { ...handle, hash: c.updateId },
+            phase: c.status === 'executed' ? 'confirmed' : 'failed',
+            ...(c.errorMessage !== undefined ? { reason: c.errorMessage } : {}),
+        };
+        return;
+    }
+}
+//# sourceMappingURL=canton-external.js.map

package/dist/surfaces/canton-external.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canton-external.js","sourceRoot":"","sources":["../../src/surfaces/canton-external.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAQH,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAM1F,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAgCvC,MAAM,UAAU,qBAAqB,CAAC,IAAwB;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC;IAEhC,OAAO;QACL,IAAI,EAAE,iBAAiB;QAEvB,QAAQ;YACN,oEAAoE;YACpE,oEAAoE;YACpE,qEAAqE;YACrE,kEAAkE;YAClE,2BAA2B;YAC3B,OAAO;gBACL,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,KAAK;gBACf,SAAS,EAAE,GAAG;gBACd,KAAK,EAAE,sBAAsB;aAC9B,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,MAAc;YAC1B,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3E,IAAI,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACjE,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,iBAAiB,EAAE,CAAC;gBACtD,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,UAAU,GAAG,iBAAiB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAEjD,wEAAwE;YACxE,sEAAsE;YACtE,oEAAoE;YACpE,mEAAmE;YACnE,mEAAmE;YACnE,8CAA8C;YAC9C,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC;YACpE,MAAM,cAAc,GAAG,WAAW,KAAK,IAAI,CAAC;YAE5C,MAAM,GAAG,GAA6B;gBACpC,KAAK,EAAE,OAAO,CAAC,OAAO;gBACtB,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,SAAS,EAAE,UAAU;gBACrB,oEAAoE;gBACpE,kDAAkD;gBAClD,4BAA4B,EAAE,sBAAsB;gBACpD,QAAQ,EAAE,mBAAmB,CAAC;oBAC5B,IAAI,EAAE,OAAO,CAAC,OAAO;oBACrB,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,OAAO;oBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;oBAChC,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,cAAc;oBACd,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACnF,CAAC;aACH,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACnD,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YAE9B,MAAM,IAAI,GAAuB;gBAC/B,IAAI,EAAE,sBAAsB;gBAC5B,SAAS,EAAE,OAAO,CAAC,OAAO;gBAC1B,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,OAAO;gBAC1B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;gBAChC,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,UAAU;gBACV,cAAc;gBACd,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;gBACjD,uBAAuB,EAAE,QAAQ,CAAC,uBAAuB;aAC1D,CAAC;YAEF,OAAO;gBACL,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE;gBACrD,MAAM;gBACN,iEAAiE;gBACjE,mEAAmE;gBACnE,kEAAkE;gBAClE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;gBAC7E,mEAAmE;gBACnE,oEAAoE;gBACpE,oBAAoB;gBACpB,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;gBACnC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,4BAA4B;gBAChF,QAAQ,EAAE,EAAE;gBACZ,IAAI;aACL,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,QAAoB,EAAE,QAAiB;YAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAA0B,CAAC;YACjD,MAAM,GAAG,GAAI,QAAQ,CAAC,MAA4C,CAAC,IAAI,CAAC;YACxE,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,iBAAiB,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC9D,CAAC;YACD,qEAAqE;YACrE,mEAAmE;YACnE,oEAAoE;YACpE,4BAA4B;YAC5B,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAC3E,IAAI,CAAC,sBAAsB,CAAC,UAAU,EAAE,IAAI,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,KAAK,CACb,wEAAwE;oBACtE,iFAAiF,CACpF,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;gBAC3C,GAAG;gBACH,UAAU,EAAE,GAAG;gBACf,MAAM,EAAE,SAAS;gBACjB,oEAAoE;gBACpE,qEAAqE;gBACrE,kDAAkD;gBAClD,QAAQ,EAAE,UAAU;gBACpB,OAAO,EAAE,sBAAsB;aAChC,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;QAC3D,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,MAAgB;YAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,IAA0B,CAAC;YAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CACzB,MAAM,CAAC,QAAQ,CAAC,MAA4C,CAAC,IAAI,CACnE,CAAC;YACF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,iBAAiB,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,GAAG,GAA6B;gBACpC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,eAAe,EAAE,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;gBAC7D,oBAAoB,EAAE,2BAA2B;gBACjD,YAAY,EAAE,IAAI,CAAC,UAAU;aAC9B,CAAC;YACF,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;YAClC,qEAAqE;YACrE,oEAAoE;YACpE,qEAAqE;YACrE,4BAA4B;YAC5B,OAAO,UAAU,CAAC,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAChF,CAAC;QAED,KAAK,CAAC,MAAgB;YACpB,OAAO,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,mBAAmB,CAAC,IAQ5B;IACC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QACxB,OAAO;YACL;gBACE,OAAO,EAAE,6BAA6B;gBACtC,MAAM,EAAE,IAAI,CAAC,IAAI;gBACjB,QAAQ,EAAE,IAAI,CAAC,EAAE;gBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9D,qBAAqB,EAAE,IAAI,CAAC,qBAAqB;aAClD;SACF,CAAC;IACJ,CAAC;IACD,OAAO;QACL;YACE,OAAO,EAAE,uBAAuB;YAChC,MAAM,EAAE,IAAI,CAAC,IAAI;YACjB,QAAQ,EAAE,IAAI,CAAC,EAAE;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAC3B,GAAmB,EACnB,UAAqC;IAErC,IAAI,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,SAAS,oBAAoB,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,EAAE,CAAC,CAAC;QAC/E,OAAO;YACL,KAAK,EAAE,GAAG,CAAC,OAAO;YAClB,SAAS,EAAE,GAAG;YACd,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,uEAAuE;YACvE,+DAA+D;YAC/D,gEAAgE;YAChE,QAAQ,EAAE,EAAE,CAAC,WAAW;SACzB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,CAA4B;IACvD,IAAI,CAAC,CAAC,oBAAoB,KAAK,2BAA2B,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,+CAA+C,CAAC,CAAC,oBAAoB,IAAI;YACvE,2DAA2D,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,SAAS,CAAC,CAAC,YAAY,CAC1B,MAAgB,EAChB,IAAyB,EACzB,MAAc;IAEd,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACnC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACnC,qEAAqE;IACrE,oEAAoE;IACpE,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC;QACzC,MAAM;QACN,KAAK,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;KACxB,CAAC,EAAE,CAAC;QACH,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,IAAI;YAAE,SAAS,CAAC,8BAA8B;QACzE,MAAM;YACJ,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;YACvC,KAAK,EAAE,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ;YACvD,GAAG,CAAC,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAC;QACF,OAAO;IACT,CAAC;AACH,CAAC"}

package/dist/surfaces/canton-internal.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Canton/Daml on the Tenzro-operated synchronizer.
+ *
+ * Same protocol as canton-external — Interactive Submission Service for
+ * prepare/execute, completion-stream for watch — different validator and
+ * different `synchronizerId`. Tenzro runs its own sequencer + mediator;
+ * participants hosted on Tenzro infra connect to it; the asset model is a
+ * Tenzro-local mirror of `Splice.Amulet` semantics, no Global Synchronizer
+ * governance hooks.
+ *
+ * The two surfaces stay separate because:
+ *   - The recipient mapping is different (`canton-internal` parties live
+ *     on the Tenzro synchronizer, not GSN).
+ *   - The asset symbol set is local (no CC, no SV economics).
+ *   - The validator port is configured with a different ledger base URL.
+ *
+ * The implementation mirrors canton-external.ts; the kernel can choose to
+ * factor the shared body out later if these stay 1:1, but keeping them
+ * separate now lets us evolve them independently as the Tenzro internal
+ * synchronizer's economics diverge from MainNet.
+ */
+import type { CantonValidatorPort } from '../ports/canton/canton-validator.js';
+import type { SurfaceKey, TdipDid } from '../types/identity.js';
+import type { SigningDriver } from '../types/signing-driver.js';
+import type { SurfaceModule } from '../types/surface-module.js';
+export interface CantonInternalDeps {
+    readonly keyResolver: (did: TdipDid) => SurfaceKey | undefined;
+    readonly signingDriver: SigningDriver;
+    /** Validator port, pointed at the Tenzro-operated synchronizer's validator. */
+    readonly validatorPort: CantonValidatorPort;
+    readonly userId: string;
+}
+export declare function cantonInternalSurface(deps: CantonInternalDeps): SurfaceModule;
+//# sourceMappingURL=canton-internal.d.ts.map

package/dist/surfaces/canton-internal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canton-internal.d.ts","sourceRoot":"","sources":["../../src/surfaces/canton-internal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EACV,mBAAmB,EAIpB,MAAM,qCAAqC,CAAC;AAG7C,OAAO,KAAK,EAAkB,UAAU,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAEhF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAgBhE,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,WAAW,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,UAAU,GAAG,SAAS,CAAC;IAC/D,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,+EAA+E;IAC/E,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,kBAAkB,GAAG,aAAa,CA4G7E"}

package/dist/surfaces/canton-internal.js

@@ -0,0 +1,163 @@
+/**
+ * Canton/Daml on the Tenzro-operated synchronizer.
+ *
+ * Same protocol as canton-external — Interactive Submission Service for
+ * prepare/execute, completion-stream for watch — different validator and
+ * different `synchronizerId`. Tenzro runs its own sequencer + mediator;
+ * participants hosted on Tenzro infra connect to it; the asset model is a
+ * Tenzro-local mirror of `Splice.Amulet` semantics, no Global Synchronizer
+ * governance hooks.
+ *
+ * The two surfaces stay separate because:
+ *   - The recipient mapping is different (`canton-internal` parties live
+ *     on the Tenzro synchronizer, not GSN).
+ *   - The asset symbol set is local (no CC, no SV economics).
+ *   - The validator port is configured with a different ledger base URL.
+ *
+ * The implementation mirrors canton-external.ts; the kernel can choose to
+ * factor the shared body out later if these stay 1:1, but keeping them
+ * separate now lets us evolve them independently as the Tenzro internal
+ * synchronizer's economics diverge from MainNet.
+ */
+import { bytesEqualConstantTime, preparedTransactionHash } from "../ports/canton/hash.js";
+import { makeHandle } from "./util.js";
+export function cantonInternalSurface(deps) {
+    const port = deps.validatorPort;
+    return {
+        name: 'canton-internal',
+        async prepare(intent) {
+            if (intent.kind !== 'send')
+                throw new Error(`unsupported: ${intent.kind}`);
+            if (intent.to.kind !== 'canton') {
+                throw new Error('canton-internal requires a canton recipient');
+            }
+            const fromKey = deps.keyResolver(intent.from);
+            if (!fromKey || fromKey.surface !== 'canton-internal') {
+                throw new Error(`no canton-internal key for ${intent.from}`);
+            }
+            const trackingId = `tenzro-wallet-${Date.now()}`;
+            const req = {
+                actAs: fromKey.partyId,
+                synchronizerId: fromKey.synchronizerId,
+                commandId: trackingId,
+                // Tenzro-internal asset package. Aligned with the splice-amulet
+                // semantics but published under a Tenzro-specific package id so
+                // the two synchronizers' assets don't collide.
+                packageIdSelectionPreference: 'tenzro-amulet:0.1.0',
+                commands: [
+                    {
+                        _intent: 'tenzro-amulet-transfer',
+                        sender: fromKey.partyId,
+                        receiver: intent.to.partyId,
+                        amount: intent.amount,
+                        assetSymbol: intent.asset.symbol,
+                        ...(intent.memo !== undefined ? { description: intent.memo } : {}),
+                    },
+                ],
+            };
+            const prepared = await port.prepareSubmission(req);
+            assertHashingScheme(prepared);
+            const body = {
+                kind: 'canton-internal-send',
+                fromParty: fromKey.partyId,
+                toParty: intent.to.partyId,
+                amount: intent.amount,
+                assetSymbol: intent.asset.symbol,
+                ...(intent.memo !== undefined ? { description: intent.memo } : {}),
+                trackingId,
+                synchronizerId: fromKey.synchronizerId,
+                preparedTransaction: prepared.preparedTransaction,
+                preparedTransactionHash: prepared.preparedTransactionHash,
+            };
+            return {
+                route: { kind: 'native', surface: 'canton-internal' },
+                intent,
+                // Tenzro-internal synchronizer charges a flat sync fee in the local
+                // asset; surface-level fee modelling tracks canton-external for now.
+                fees: [{ asset: intent.asset, amount: 0n, label: 'tenzro synchronizer fee' }],
+                etaMs: 1500,
+                reversibility: 'final-on-submit',
+                warnings: [],
+                body,
+            };
+        },
+        async sign(prepared, _consent) {
+            const body = prepared.body;
+            const did = prepared.intent.from;
+            const key = deps.keyResolver(did);
+            if (!key || key.surface !== 'canton-internal') {
+                throw new Error('missing canton-internal key at sign time');
+            }
+            const recomputed = await preparedTransactionHash(body.preparedTransaction);
+            if (!bytesEqualConstantTime(recomputed, body.preparedTransactionHash)) {
+                throw new Error('canton-internal: preparedTransactionHash mismatch — refusing to sign.');
+            }
+            const result = await deps.signingDriver.sign({
+                did,
+                surfaceKey: key,
+                scheme: 'ed25519',
+                preimage: recomputed,
+                purpose: 'canton-internal-send',
+            });
+            return { prepared, signatures: result.signatures, body };
+        },
+        async submit(signed) {
+            const body = signed.body;
+            const key = deps.keyResolver(signed.prepared.intent.from);
+            if (!key || key.surface !== 'canton-internal') {
+                throw new Error('missing canton-internal key at submit time');
+            }
+            const req = {
+                preparedTransaction: body.preparedTransaction,
+                partySignatures: shapePartySignatures(key, signed.signatures),
+                hashingSchemeVersion: 'HASHING_SCHEME_VERSION_V2',
+                submissionId: body.trackingId,
+            };
+            await port.executeSubmission(req);
+            return makeHandle('canton-internal', signed.prepared.intent, body.trackingId);
+        },
+        watch(handle) {
+            return watchViaPort(handle, port, deps.userId);
+        },
+    };
+}
+function shapePartySignatures(key, signatures) {
+    if (signatures.length < key.threshold) {
+        throw new Error(`canton-internal: need ${key.threshold} signatures, got ${signatures.length}`);
+    }
+    return signatures.slice(0, key.threshold).map((sig, i) => {
+        const sk = key.signingKeys[i];
+        if (!sk)
+            throw new Error(`canton-internal: missing signing key at index ${i}`);
+        return {
+            party: key.partyId,
+            signature: sig,
+            scheme: sk.scheme,
+            signedBy: sk.fingerprint,
+        };
+    });
+}
+function assertHashingScheme(r) {
+    if (r.hashingSchemeVersion !== 'HASHING_SCHEME_VERSION_V2') {
+        throw new Error(`canton-internal: unsupported hashing scheme ${r.hashingSchemeVersion}; ` +
+            `kernel only knows V2`);
+    }
+}
+async function* watchViaPort(handle, port, userId) {
+    yield { handle, phase: 'created' };
+    yield { handle, phase: 'pending' };
+    for await (const c of port.tailCompletions({
+        userId,
+        actAs: [handle.surface],
+    })) {
+        if (c.commandId !== handle.hash)
+            continue;
+        yield {
+            handle: { ...handle, hash: c.updateId },
+            phase: c.status === 'executed' ? 'confirmed' : 'failed',
+            ...(c.errorMessage !== undefined ? { reason: c.errorMessage } : {}),
+        };
+        return;
+    }
+}
+//# sourceMappingURL=canton-internal.js.map

package/dist/surfaces/canton-internal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canton-internal.js","sourceRoot":"","sources":["../../src/surfaces/canton-internal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAQH,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAM1F,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAuBvC,MAAM,UAAU,qBAAqB,CAAC,IAAwB;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC;IAEhC,OAAO;QACL,IAAI,EAAE,iBAAiB;QAEvB,KAAK,CAAC,OAAO,CAAC,MAAc;YAC1B,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3E,IAAI,MAAM,CAAC,EAAE,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACjE,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,iBAAiB,EAAE,CAAC;gBACtD,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,UAAU,GAAG,iBAAiB,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAEjD,MAAM,GAAG,GAA6B;gBACpC,KAAK,EAAE,OAAO,CAAC,OAAO;gBACtB,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,SAAS,EAAE,UAAU;gBACrB,gEAAgE;gBAChE,gEAAgE;gBAChE,+CAA+C;gBAC/C,4BAA4B,EAAE,qBAAqB;gBACnD,QAAQ,EAAE;oBACR;wBACE,OAAO,EAAE,wBAAwB;wBACjC,MAAM,EAAE,OAAO,CAAC,OAAO;wBACvB,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,OAAO;wBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;wBACrB,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;wBAChC,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACnE;iBACF;aACF,CAAC;YACF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACnD,mBAAmB,CAAC,QAAQ,CAAC,CAAC;YAE9B,MAAM,IAAI,GAAuB;gBAC/B,IAAI,EAAE,sBAAsB;gBAC5B,SAAS,EAAE,OAAO,CAAC,OAAO;gBAC1B,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,OAAO;gBAC1B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM;gBAChC,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,UAAU;gBACV,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;gBACjD,uBAAuB,EAAE,QAAQ,CAAC,uBAAuB;aAC1D,CAAC;YAEF,OAAO;gBACL,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE;gBACrD,MAAM;gBACN,oEAAoE;gBACpE,qEAAqE;gBACrE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;gBAC7E,KAAK,EAAE,IAAI;gBACX,aAAa,EAAE,iBAAiB;gBAChC,QAAQ,EAAE,EAAE;gBACZ,IAAI;aACL,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,QAAoB,EAAE,QAAiB;YAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAA0B,CAAC;YACjD,MAAM,GAAG,GAAI,QAAQ,CAAC,MAA4C,CAAC,IAAI,CAAC;YACxE,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,iBAAiB,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAC3E,IAAI,CAAC,sBAAsB,CAAC,UAAU,EAAE,IAAI,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBACtE,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;YAC3F,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;gBAC3C,GAAG;gBACH,UAAU,EAAE,GAAG;gBACf,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE,UAAU;gBACpB,OAAO,EAAE,sBAAsB;aAChC,CAAC,CAAC;YACH,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;QAC3D,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,MAAgB;YAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,IAA0B,CAAC;YAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CACzB,MAAM,CAAC,QAAQ,CAAC,MAA4C,CAAC,IAAI,CACnE,CAAC;YACF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,iBAAiB,EAAE,CAAC;gBAC9C,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,GAAG,GAA6B;gBACpC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;gBAC7C,eAAe,EAAE,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;gBAC7D,oBAAoB,EAAE,2BAA2B;gBACjD,YAAY,EAAE,IAAI,CAAC,UAAU;aAC9B,CAAC;YACF,MAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;YAClC,OAAO,UAAU,CAAC,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAChF,CAAC;QAED,KAAK,CAAC,MAAgB;YACpB,OAAO,YAAY,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACjD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,GAAmB,EACnB,UAAqC;IAErC,IAAI,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,SAAS,oBAAoB,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACvD,MAAM,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,EAAE,CAAC,CAAC;QAC/E,OAAO;YACL,KAAK,EAAE,GAAG,CAAC,OAAO;YAClB,SAAS,EAAE,GAAG;YACd,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,QAAQ,EAAE,EAAE,CAAC,WAAW;SACzB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,CAA4B;IACvD,IAAI,CAAC,CAAC,oBAAoB,KAAK,2BAA2B,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,+CAA+C,CAAC,CAAC,oBAAoB,IAAI;YACvE,sBAAsB,CACzB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,SAAS,CAAC,CAAC,YAAY,CAC1B,MAAgB,EAChB,IAAyB,EACzB,MAAc;IAEd,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACnC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACnC,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC;QACzC,MAAM;QACN,KAAK,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC;KACxB,CAAC,EAAE,CAAC;QACH,IAAI,CAAC,CAAC,SAAS,KAAK,MAAM,CAAC,IAAI;YAAE,SAAS;QAC1C,MAAM;YACJ,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;YACvC,KAAK,EAAE,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ;YACvD,GAAG,CAAC,CAAC,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAC;QACF,OAAO;IACT,CAAC;AACH,CAAC"}