tenzro-wallet 0.1.0

package/dist/surfaces/util.js

@@ -0,0 +1,36 @@
+/**
+ * Surface-internal helpers. Not exported from the package root.
+ */
+let counter = 0;
+export function makeHandle(surface, _intent, hash) {
+    counter += 1;
+    return {
+        id: `${surface}-${Date.now().toString(36)}-${counter.toString(36)}`,
+        surface,
+        submittedAt: Date.now(),
+        ...(hash !== undefined ? { hash } : {}),
+    };
+}
+/**
+ * M1 placeholder confirmation walk: created → pending → confirmed → finalized.
+ *
+ * Used by every surface that doesn't yet have a real port wired. As of M2,
+ * `tenzro-native` replaces this with `watchViaPort` against a real RPC; the
+ * remaining consumers (evm-on-tenzro, svm-on-tenzro, canton-internal,
+ * canton-external) keep using this until their respective milestones land.
+ *
+ * Delete this when no surface imports it any more.
+ */
+export async function* mockStatusWalk(handle) {
+    yield { handle, phase: 'created' };
+    await sleep(10);
+    yield { handle, phase: 'pending' };
+    await sleep(10);
+    yield { handle, phase: 'confirmed', blockHeight: 1, hash: `0x${handle.id}` };
+    await sleep(10);
+    yield { handle, phase: 'finalized', blockHeight: 1, hash: `0x${handle.id}` };
+}
+function sleep(ms) {
+    return new Promise((r) => setTimeout(r, ms));
+}
+//# sourceMappingURL=util.js.map

package/dist/surfaces/util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.js","sourceRoot":"","sources":["../../src/surfaces/util.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,IAAI,OAAO,GAAG,CAAC,CAAC;AAEhB,MAAM,UAAU,UAAU,CAAC,OAAoB,EAAE,OAAe,EAAE,IAAa;IAC7E,OAAO,IAAI,CAAC,CAAC;IACb,OAAO;QACL,EAAE,EAAE,GAAG,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE;QACnE,OAAO;QACP,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;QACvB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,cAAc,CAAC,MAAgB;IACpD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACnC,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IACnC,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC;IAC7E,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;IAChB,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC;AAC/E,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAC/C,CAAC"}

package/dist/types/asset.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Asset model. Balances are always stored in canonical native units (bigint);
+ * decimal conversion happens at the UI edge.
+ *
+ * `scope` distinguishes:
+ *  - "tenzro-native"  — the canonical TNZO balance (one ledger, three views)
+ *  - "tenzro-asset"   — any other asset registered on Tenzro (USDC on Tempo, etc.)
+ *  - "external-evm"   — assets on an external EVM chain (Ethereum, Base, ...)
+ *  - "external-svm"   — assets on Solana mainnet
+ *  - "canton-mainnet" — CIP-56 holdings on Canton Network MainNet
+ */
+import type { SurfaceName } from './surface.js';
+export type AssetScope = 'tenzro-native' | 'tenzro-asset' | 'external-evm' | 'external-svm' | 'canton-mainnet';
+/**
+ * Canonical asset identifier. For multi-surface assets (TNZO), the same AssetId
+ * appears under multiple SurfaceName entries in the unified balance.
+ */
+export interface AssetId {
+    readonly scope: AssetScope;
+    /** Symbol as displayed: TNZO, USDC, CC, etc. */
+    readonly symbol: string;
+    /** Chain-specific identifier (contract addr, mint addr, package+template, etc.). */
+    readonly nativeId?: string;
+    /** Decimal count for canonical-unit storage. */
+    readonly decimals: number;
+}
+export interface AssetView {
+    readonly asset: AssetId;
+    readonly surface: SurfaceName;
+    readonly balance: bigint;
+}
+/**
+ * The unified balance card the UI renders. One entry per asset, with all
+ * surface-views collapsed and any precision warnings attached.
+ */
+export interface UnifiedBalance {
+    readonly asset: AssetId;
+    /** Sum across all surfaces, in canonical units of `asset.decimals`. */
+    readonly total: bigint;
+    readonly views: readonly AssetView[];
+    readonly warnings: readonly string[];
+}
+//# sourceMappingURL=asset.d.ts.map

package/dist/types/asset.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset.d.ts","sourceRoot":"","sources":["../../src/types/asset.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,MAAM,UAAU,GAClB,eAAe,GACf,cAAc,GACd,cAAc,GACd,cAAc,GACd,gBAAgB,CAAC;AAErB;;;GAGG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAC3B,gDAAgD;IAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,oFAAoF;IACpF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,gDAAgD;IAChD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,uEAAuE;IACvE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC"}

package/dist/types/asset.js

@@ -0,0 +1,13 @@
+/**
+ * Asset model. Balances are always stored in canonical native units (bigint);
+ * decimal conversion happens at the UI edge.
+ *
+ * `scope` distinguishes:
+ *  - "tenzro-native"  — the canonical TNZO balance (one ledger, three views)
+ *  - "tenzro-asset"   — any other asset registered on Tenzro (USDC on Tempo, etc.)
+ *  - "external-evm"   — assets on an external EVM chain (Ethereum, Base, ...)
+ *  - "external-svm"   — assets on Solana mainnet
+ *  - "canton-mainnet" — CIP-56 holdings on Canton Network MainNet
+ */
+export {};
+//# sourceMappingURL=asset.js.map

package/dist/types/asset.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset.js","sourceRoot":"","sources":["../../src/types/asset.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/dist/types/consent.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Consent and policy types. The kernel always enforces
+ * `effectiveLimit = sessionPolicy ∩ delegationScope` at sign time.
+ */
+import type { AssetId } from './asset.js';
+/**
+ * KYC verification tier. Mirrors `tenzro_identity::KycTier` exactly:
+ * Unverified (0), Basic (1), Enhanced (2), Full (3). When set on a
+ * policy, the signing identity must hold a credential at this tier or
+ * higher for the policy to satisfy.
+ */
+export type KycTier = 'Unverified' | 'Basic' | 'Enhanced' | 'Full';
+export interface SpendingPolicy {
+    readonly maxPerTx?: bigint;
+    readonly maxPerDay?: bigint;
+    readonly assetWhitelist?: readonly AssetId[];
+    /** Allowed contract addresses, for EVM/SVM. */
+    readonly contractWhitelist?: readonly string[];
+    /** Operations the session may invoke. */
+    readonly operationWhitelist?: readonly string[];
+    readonly expiresAt?: number;
+    /**
+     * Minimum KYC tier the *signing identity* must hold for this policy to
+     * be satisfied. The kernel reads the identity's tier from the
+     * `tenzro-identity` port and compares numerically: signer tier ≥
+     * required tier. Undefined = no KYC requirement.
+     */
+    readonly minKycTier?: KycTier;
+}
+/**
+ * Compares two KYC tiers numerically. Returns positive when `a > b`,
+ * negative when `a < b`, zero when equal.
+ */
+export declare function compareKycTier(a: KycTier, b: KycTier): number;
+/**
+ * A user-confirmed consent envelope passed to `surface.sign(prepared, consent)`.
+ * The kernel's `sign()` facade attaches this; surface modules don't construct it.
+ */
+export interface Consent {
+    /** Set when the user is signing under an active session key. */
+    readonly sessionId?: string;
+    readonly approvedAt: number;
+    /** Optional human-typed confirmation phrase for high-value sends. */
+    readonly confirmationPhrase?: string;
+}
+//# sourceMappingURL=consent.d.ts.map

package/dist/types/consent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.d.ts","sourceRoot":"","sources":["../../src/types/consent.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,MAAM,OAAO,GAAG,YAAY,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;AAEnE,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAC7C,+CAA+C;IAC/C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/C,yCAAyC;IACzC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;CAC/B;AASD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,MAAM,CAE7D;AAED;;;GAGG;AACH,MAAM,WAAW,OAAO;IACtB,gEAAgE;IAChE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,qEAAqE;IACrE,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;CACtC"}

package/dist/types/consent.js

@@ -0,0 +1,18 @@
+/**
+ * Consent and policy types. The kernel always enforces
+ * `effectiveLimit = sessionPolicy ∩ delegationScope` at sign time.
+ */
+const KYC_TIER_ORDER = {
+    Unverified: 0,
+    Basic: 1,
+    Enhanced: 2,
+    Full: 3,
+};
+/**
+ * Compares two KYC tiers numerically. Returns positive when `a > b`,
+ * negative when `a < b`, zero when equal.
+ */
+export function compareKycTier(a, b) {
+    return KYC_TIER_ORDER[a] - KYC_TIER_ORDER[b];
+}
+//# sourceMappingURL=consent.js.map

package/dist/types/consent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.js","sourceRoot":"","sources":["../../src/types/consent.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA8BH,MAAM,cAAc,GAA4B;IAC9C,UAAU,EAAE,CAAC;IACb,KAAK,EAAE,CAAC;IACR,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;CACR,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,CAAU,EAAE,CAAU;IACnD,OAAO,cAAc,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC"}

package/dist/types/identity.d.ts

@@ -0,0 +1,115 @@
+/**
+ * TDIP identity types — the root of all wallet identity.
+ *
+ * A user has exactly one root DID. Each surface (native, evm, svm, canton-internal,
+ * canton-external) projects a derived key from the same MPC quorum.
+ *
+ * Spec refs:
+ *  - https://tenzro.com/docs/identity (TDIP)
+ *  - W3C DID 1.0 (DID Document compatibility)
+ */
+export type DidMethod = 'tenzro';
+export type TdipKind = 'human' | 'controlled-machine' | 'autonomous-machine';
+/**
+ * A `did:tenzro:human:{uuid}` or `did:tenzro:machine:{controller?}:{uuid}`.
+ * Stored as a normalized string; parsed via `parseTdipDid`.
+ */
+export type TdipDid = string & {
+    readonly __brand: 'TdipDid';
+};
+export interface TdipDidParts {
+    readonly method: DidMethod;
+    readonly kind: TdipKind;
+    /** Controller DID, only present when kind === 'controlled-machine'. */
+    readonly controller?: TdipDid;
+    readonly uuid: string;
+    /**
+     * Set when the identity was registered as a SeedAgent — protocol-owned
+     * bootstrap counterparty funded from the genesis treasury earmark. Drives
+     * counterparty filters (`deny_other_seed_agents`) and lets activity
+     * metrics exclude protocol-bootstrap traffic.
+     *
+     * Source of truth is `IdentityData::Machine.is_seed_agent` on the ledger;
+     * surfaced here for client-side gating without an extra RPC.
+     */
+    readonly isSeedAgent?: boolean;
+}
+/**
+ * Canton signing schemes accepted on `PartyToKeyMapping`. Mirrors the
+ * `CantonSigningScheme` in `ports/canton/canton-validator.ts`; redeclared
+ * here to avoid a port→type reverse import. See DESIGN.md §4.5.5.
+ */
+export type CantonKeyScheme = 'ed25519' | 'ec-dsa-p256';
+/**
+ * Canton party shape on a `SurfaceKey`. Both canton-internal and
+ * canton-external use this — they differ only in `synchronizerId` and
+ * which validator hosts the party. See DESIGN.md §4.5.4.
+ *
+ * Two-key model:
+ *   - `namespaceKey` roots the identity (cold/recovery key, fingerprint =
+ *     the `::xxxx` part of the party id, used for topology changes).
+ *   - `signingKeys` are the warm/online keys (per-tx). The party id is
+ *     immutable; signing keys can be rotated via topology updates.
+ *   - `threshold` is the M-of-N over `signingKeys`. M-of-N requires
+ *     `threshold <= signingKeys.length`.
+ */
+export interface CantonPartyKey {
+    /** `<hint>::<32-byte-fingerprint-hex>` */
+    readonly partyId: string;
+    /** Synchronizer the party is hosted on. `global-domain::<fp>` for MainNet
+     *  external, Tenzro-operated synchronizer id for internal. */
+    readonly synchronizerId: string;
+    /** Participant id hosting the party. */
+    readonly hostingParticipantId: string;
+    readonly namespaceKey: {
+        readonly scheme: 'ed25519';
+        readonly publicKey: Uint8Array;
+        /** Canton fingerprint string: `1220` + lowercase-hex SHA-256 of `publicKey`.
+         *  Matches the `::xxxx` portion of the party id when this is the namespace
+         *  key. Computed at provision time so the signing path stays sync. */
+        readonly fingerprint: string;
+    };
+    readonly signingKeys: ReadonlyArray<{
+        readonly scheme: CantonKeyScheme;
+        readonly publicKey: Uint8Array;
+        /** Canton fingerprint string: `1220` + lowercase-hex SHA-256 of `publicKey`.
+         *  Used as `signedBy` on the wire so the validator can look the key up
+         *  in `PartyToKeyMapping` without us carrying the pubkey. */
+        readonly fingerprint: string;
+    }>;
+    /** M of `signingKeys.length`. */
+    readonly threshold: number;
+}
+/**
+ * The set of cryptographic personas the wallet derives from one TDIP root.
+ * Each entry's `kind` matches the surface that consumes it.
+ */
+export type SurfaceKey = {
+    readonly surface: 'tenzro-native';
+    readonly scheme: 'ed25519';
+    readonly publicKey: Uint8Array;
+    /** Base58-encoded Tenzro address (per `Address` in tenzro-sdk types). */
+    readonly address: string;
+} | {
+    readonly surface: 'evm-on-tenzro';
+    readonly scheme: 'secp256k1';
+    readonly address: `0x${string}`;
+} | {
+    readonly surface: 'svm-on-tenzro';
+    readonly scheme: 'ed25519';
+    readonly publicKey: Uint8Array;
+    /** Base58-encoded SVM public-key/address. */
+    readonly address: string;
+} | ({
+    readonly surface: 'canton-internal';
+} & CantonPartyKey) | ({
+    readonly surface: 'canton-external';
+} & CantonPartyKey);
+export interface TdipIdentity {
+    readonly did: TdipDid;
+    readonly parts: TdipDidParts;
+    /** Surface keys derived from the MPC quorum. Indexed by surface name. */
+    readonly keys: ReadonlyMap<SurfaceKey['surface'], SurfaceKey>;
+    readonly createdAt: number;
+}
+//# sourceMappingURL=identity.d.ts.map

package/dist/types/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/types/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,MAAM,SAAS,GAAG,QAAQ,CAAC;AAEjC,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,oBAAoB,GAAG,oBAAoB,CAAC;AAE7E;;;GAGG;AACH,MAAM,MAAM,OAAO,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAA;CAAE,CAAC;AAE/D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,uEAAuE;IACvE,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,aAAa,CAAC;AAExD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,cAAc;IAC7B,0CAA0C;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;kEAC8D;IAC9D,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,wCAAwC;IACxC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,YAAY,EAAE;QACrB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;QAC3B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;QAC/B;;8EAEsE;QACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,CAAC;IACF,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC;QAClC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;QACjC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;QAC/B;;qEAE6D;QAC7D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;KAC9B,CAAC,CAAC;IACH,iCAAiC;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;GAGG;AACH,MAAM,MAAM,UAAU,GAClB;IACE,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,yEAAyE;IACzE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,GACD;IACE,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,KAAK,MAAM,EAAE,CAAC;CACjC,GACD;IACE,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,GACD,CAAC;IAAE,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,GAAG,cAAc,CAAC,GAC1D,CAAC;IAAE,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAA;CAAE,GAAG,cAAc,CAAC,CAAC;AAE/D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAC;IAC9D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B"}

package/dist/types/identity.js

@@ -0,0 +1,12 @@
+/**
+ * TDIP identity types — the root of all wallet identity.
+ *
+ * A user has exactly one root DID. Each surface (native, evm, svm, canton-internal,
+ * canton-external) projects a derived key from the same MPC quorum.
+ *
+ * Spec refs:
+ *  - https://tenzro.com/docs/identity (TDIP)
+ *  - W3C DID 1.0 (DID Document compatibility)
+ */
+export {};
+//# sourceMappingURL=identity.js.map

package/dist/types/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/types/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG"}

package/dist/types/index.d.ts

@@ -0,0 +1,10 @@
+export type { AssetId, AssetScope, AssetView, UnifiedBalance, } from './asset.js';
+export type { Consent, SpendingPolicy } from './consent.js';
+export type { DidMethod, SurfaceKey, TdipDid, TdipDidParts, TdipIdentity, TdipKind, } from './identity.js';
+export type { FeeBreakdown, Intent, MemoSpec, PreparedTx, Recipient, Reversibility, Route, SendIntent, SignedTx, TxHandle, TxStatus, TxStatusPhase, } from './intent.js';
+export { MEMO_SPEC_NONE } from './intent.js';
+export type { SigningDriver, SigningRequest, SigningResult, SigningScheme, } from './signing-driver.js';
+export { SURFACE_IS_ON_TENZRO, SURFACE_NATIVE_DECIMALS, } from './surface.js';
+export type { SurfaceName } from './surface.js';
+export type { SurfaceModule } from './surface-module.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,OAAO,EACP,UAAU,EACV,SAAS,EACT,cAAc,GACf,MAAM,YAAY,CAAC;AAEpB,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE5D,YAAY,EACV,SAAS,EACT,UAAU,EACV,OAAO,EACP,YAAY,EACZ,YAAY,EACZ,QAAQ,GACT,MAAM,eAAe,CAAC;AAEvB,YAAY,EACV,YAAY,EACZ,MAAM,EACN,QAAQ,EACR,UAAU,EACV,SAAS,EACT,aAAa,EACb,KAAK,EACL,UAAU,EACV,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,YAAY,EACV,aAAa,EACb,cAAc,EACd,aAAa,EACb,aAAa,GACd,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/types/index.js

@@ -0,0 +1,3 @@
+export { MEMO_SPEC_NONE } from "./intent.js";
+export { SURFACE_IS_ON_TENZRO, SURFACE_NATIVE_DECIMALS, } from "./surface.js";
+//# sourceMappingURL=index.js.map

package/dist/types/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAgCA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAS7C,OAAO,EACL,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,cAAc,CAAC"}

package/dist/types/intent.d.ts

@@ -0,0 +1,132 @@
+/**
+ * Intent / Preview / Signed / Handle / Status — the four-step lifecycle every
+ * surface module implements. The kernel never inspects the inside of a
+ * `PreparedTx` or `SignedTx`; it just plumbs them through the surface.
+ */
+import type { AssetId } from './asset.js';
+import type { TdipDid } from './identity.js';
+import type { SurfaceName } from './surface.js';
+/** Recipient address. The shape depends on the destination surface. */
+export type Recipient = {
+    readonly kind: 'tdip';
+    readonly did: TdipDid;
+} | {
+    readonly kind: 'evm';
+    readonly address: `0x${string}`;
+} | {
+    readonly kind: 'svm';
+    readonly publicKey: string;
+} | {
+    readonly kind: 'canton';
+    readonly partyId: string;
+};
+/**
+ * What the user wants to happen, expressed before the kernel has chosen a route.
+ */
+export interface SendIntent {
+    readonly kind: 'send';
+    readonly from: TdipDid;
+    readonly to: Recipient;
+    readonly asset: AssetId;
+    readonly amount: bigint;
+    /**
+     * Memo / destination tag / payment id — generalised across surfaces. Canton
+     * uses it as the transfer description; Stellar/XRPL (via bridge) use it as
+     * a destination tag; some exchanges require it to credit the recipient.
+     * `surface.memoSpec(intent)` (when implemented) tells the UI what shape and
+     * whether it's required.
+     */
+    readonly memo?: string;
+    /**
+     * Force a specific source surface. If omitted, the router chooses based on
+     * asset scope and recipient kind.
+     */
+    readonly fromSurface?: SurfaceName;
+}
+export type Intent = SendIntent;
+/** How the kernel proposes to execute an intent. */
+export type Route = {
+    readonly kind: 'native';
+    readonly surface: SurfaceName;
+} | {
+    readonly kind: 'cross-vm-pointer';
+    readonly fromSurface: SurfaceName;
+    readonly toSurface: SurfaceName;
+    /** Cross-VM Bridge precompile address on EVM-on-Tenzro. */
+    readonly precompile: '0x1003';
+} | {
+    readonly kind: 'bridge';
+    readonly fromSurface: SurfaceName;
+    readonly toSurface: SurfaceName;
+    readonly adapter: 'lifi' | 'layerzero' | 'ccip' | 'debridge' | 'canton-adapter';
+};
+/** Reversibility hint shown to the user. */
+export type Reversibility = 'final-on-submit' | 'reversible-until-confirmed' | 'irreversible';
+export interface FeeBreakdown {
+    readonly asset: AssetId;
+    readonly amount: bigint;
+    readonly label: string;
+}
+/**
+ * Result of `surface.prepare(intent)`. Opaque transaction body lives in `body`;
+ * everything else is for UI rendering and consent.
+ */
+export interface PreparedTx {
+    readonly route: Route;
+    readonly intent: Intent;
+    readonly fees: readonly FeeBreakdown[];
+    readonly etaMs: number;
+    readonly reversibility: Reversibility;
+    readonly warnings: readonly string[];
+    /** Surface-specific transaction body — opaque to the kernel. */
+    readonly body: unknown;
+}
+/** Result of `surface.sign(prepared, consent)`. */
+export interface SignedTx {
+    readonly prepared: PreparedTx;
+    readonly signatures: readonly Uint8Array[];
+    readonly body: unknown;
+}
+/** Returned by `surface.submit(signed)` — used to track the tx after submission. */
+export interface TxHandle {
+    readonly id: string;
+    readonly surface: SurfaceName;
+    readonly submittedAt: number;
+    /** On-chain transaction hash. Optional only because the M1 mock surfaces
+     *  produced handles before they had real chain hashes; real surfaces
+     *  always populate it. */
+    readonly hash?: string;
+}
+export type TxStatusPhase = 'created' | 'pending' | 'confirmed' | 'finalized' | 'failed' | 'dropped';
+export interface TxStatus {
+    readonly handle: TxHandle;
+    readonly phase: TxStatusPhase;
+    readonly blockHeight?: number;
+    readonly hash?: string;
+    readonly error?: string;
+}
+/**
+ * Surface-declared memo requirement. Returned by `SurfaceModule.memoSpec`
+ * (optional method); the kernel forwards this to the UI so consent flows
+ * can show the right input. `kind` is the dialect:
+ *
+ *   - `text`     — free-form string (Canton transfer description, generic memo)
+ *   - `numeric`  — uint string (Stellar `MEMO_ID`, XRPL destination tag)
+ *   - `hash`     — 32-byte hex (Stellar `MEMO_HASH`)
+ *
+ * `required` is true when the destination *will fail to credit* without the
+ * memo. The kernel doesn't enforce the requirement itself — that's the
+ * surface's job at `prepare` time — but the UI uses the flag to mark the
+ * field as "required" rather than "optional".
+ */
+export interface MemoSpec {
+    readonly kind: 'text' | 'numeric' | 'hash';
+    readonly required: boolean;
+    /** Optional max length / byte limit (e.g. Canton: 256 chars). */
+    readonly maxLength?: number;
+    /** UI-only, e.g. "Destination tag" / "Transfer description". */
+    readonly label?: string;
+}
+/** No-memo sentinel — surfaces that don't accept a memo return this. */
+export declare const MEMO_SPEC_NONE: MemoSpec;
+//# sourceMappingURL=intent.d.ts.map

package/dist/types/intent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"intent.d.ts","sourceRoot":"","sources":["../../src/types/intent.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,uEAAuE;AACvE,MAAM,MAAM,SAAS,GACjB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAA;CAAE,GAChD;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,MAAM,EAAE,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1D;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,WAAW,CAAC;CACpC;AAED,MAAM,MAAM,MAAM,GAAG,UAAU,CAAC;AAGhC,oDAAoD;AACpD,MAAM,MAAM,KAAK,GACb;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;CAAE,GAC1D;IACE,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IAChC,2DAA2D;IAC3D,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC;CAC/B,GACD;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW,GAAG,MAAM,GAAG,UAAU,GAAG,gBAAgB,CAAC;CACjF,CAAC;AAEN,4CAA4C;AAC5C,MAAM,MAAM,aAAa,GAAG,iBAAiB,GAAG,4BAA4B,GAAG,cAAc,CAAC;AAE9F,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,SAAS,YAAY,EAAE,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,gEAAgE;IAChE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED,mDAAmD;AACnD,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,SAAS,UAAU,EAAE,CAAC;IAC3C,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED,oFAAoF;AACpF,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;8BAE0B;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,aAAa,GACrB,SAAS,GACT,SAAS,GACT,WAAW,GACX,WAAW,GACX,QAAQ,GACR,SAAS,CAAC;AAEd,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAID;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,gEAAgE;IAChE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,wEAAwE;AACxE,eAAO,MAAM,cAAc,EAAE,QAA0D,CAAC"}

package/dist/types/intent.js

@@ -0,0 +1,8 @@
+/**
+ * Intent / Preview / Signed / Handle / Status — the four-step lifecycle every
+ * surface module implements. The kernel never inspects the inside of a
+ * `PreparedTx` or `SignedTx`; it just plumbs them through the surface.
+ */
+/** No-memo sentinel — surfaces that don't accept a memo return this. */
+export const MEMO_SPEC_NONE = { kind: 'text', required: false, maxLength: 0 };
+//# sourceMappingURL=intent.js.map

package/dist/types/intent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"intent.js","sourceRoot":"","sources":["../../src/types/intent.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA4IH,wEAAwE;AACxE,MAAM,CAAC,MAAM,cAAc,GAAa,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC"}

package/dist/types/signing-driver.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Signing driver abstraction. Maps to the same shape Splice Wallet Kernel uses
+ * (core-signing-internal, core-signing-fireblocks, core-signing-blockdaemon,
+ * core-signing-participant) plus a Tenzro-native MPC driver.
+ *
+ * Surface modules call these; they never see raw key material.
+ */
+import type { SurfaceKey, TdipDid } from './identity.js';
+/**
+ * - `ed25519` — single Ed25519 signature (Tenzro native non-hybrid surfaces,
+ *   SVM, Canton).
+ * - `secp256k1` — single ECDSA signature (EVM).
+ * - `ed25519+ml-dsa-65` — hybrid pair (Tenzro native). Per DESIGN.md §4.3.4
+ *   and §11, M5 threshold-signs the Ed25519 leg across the passkey-quorum
+ *   (FROST-Ed25519) but the ML-DSA-65 leg is supplied by the node TEE
+ *   alone, since threshold ML-DSA has no audited WASM-shippable
+ *   implementation as of 2026-04. Device-side `SigningDriver`s therefore
+ *   return a *single* Ed25519 signature for this scheme; the ML-DSA leg
+ *   is appended server-side and the node submits the hybrid pair. This
+ *   means the TEE is in every Tenzro-native signature until threshold
+ *   ML-DSA exists. Track NIST IR 8214B and FROST-PQ for when that flips
+ *   to a 2-element `signatures` array assembled locally.
+ */
+export type SigningScheme = 'ed25519' | 'secp256k1' | 'ed25519+ml-dsa-65';
+export interface SigningRequest {
+    readonly did: TdipDid;
+    readonly surfaceKey: SurfaceKey;
+    readonly scheme: SigningScheme;
+    /** Canonical preimage bytes — surface module is responsible for canonicalization. */
+    readonly preimage: Uint8Array;
+    /** Optional context tag for the signing driver's audit log. */
+    readonly purpose?: string;
+}
+export interface SigningResult {
+    /** One signature per scheme component. Hybrid signing returns two entries. */
+    readonly signatures: readonly Uint8Array[];
+}
+export interface SigningDriver {
+    readonly id: 'internal-mpc' | 'tenzro-tee' | 'fireblocks' | 'blockdaemon' | 'canton-participant'
+    /** Threshold Ed25519 device driver — FROST round-coordinated (M5). */
+     | 'frost-ed25519'
+    /** Threshold secp256k1 device driver — FROST round-coordinated (M5). */
+     | 'frost-secp256k1'
+    /** Hybrid driver — FROST-Ed25519 leg + node-TEE ML-DSA-65 leg (M5). */
+     | 'hybrid-ed25519-mldsa';
+    sign(req: SigningRequest): Promise<SigningResult>;
+}
+//# sourceMappingURL=signing-driver.d.ts.map

package/dist/types/signing-driver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing-driver.d.ts","sourceRoot":"","sources":["../../src/types/signing-driver.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAEzD;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,mBAAmB,CAAC;AAE1E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,qFAAqF;IACrF,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,8EAA8E;IAC9E,QAAQ,CAAC,UAAU,EAAE,SAAS,UAAU,EAAE,CAAC;CAC5C;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EACP,cAAc,GACd,YAAY,GACZ,YAAY,GACZ,aAAa,GACb,oBAAoB;IACtB,sEAAsE;OACpE,eAAe;IACjB,wEAAwE;OACtE,iBAAiB;IACnB,uEAAuE;OACrE,sBAAsB,CAAC;IAC3B,IAAI,CAAC,GAAG,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CACnD"}

package/dist/types/signing-driver.js

@@ -0,0 +1,9 @@
+/**
+ * Signing driver abstraction. Maps to the same shape Splice Wallet Kernel uses
+ * (core-signing-internal, core-signing-fireblocks, core-signing-blockdaemon,
+ * core-signing-participant) plus a Tenzro-native MPC driver.
+ *
+ * Surface modules call these; they never see raw key material.
+ */
+export {};
+//# sourceMappingURL=signing-driver.js.map

package/dist/types/signing-driver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing-driver.js","sourceRoot":"","sources":["../../src/types/signing-driver.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/types/surface-module.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The Surface interface — every surface module implements exactly this.
+ *
+ * `prepare` is read-mostly: it can hit RPCs to estimate fees, check nonces, and
+ * validate the recipient. It must never request user signing.
+ *
+ * `sign` is where the MPC quorum runs. Surface modules call into the
+ * `SigningDriver` (passed at kernel construction) rather than holding key
+ * material directly.
+ *
+ * `submit` is fire-and-forget; `watch` is the long-poll for finality.
+ *
+ * `preparePointer` is optional and lives on on-Tenzro surfaces only. Kernel
+ * dispatches to it when route is `cross-vm-pointer` (precompile 0x1003 / SVM
+ * cross-VM instruction / native syscall). Surfaces that can't be a pointer-op
+ * source (canton-external) omit it; canton-internal lands its impl in M4.
+ */
+import type { CrossVmPointerOp } from '../ports/cross-vm.js';
+import type { Consent } from './consent.js';
+import type { Intent, MemoSpec, PreparedTx, SignedTx, TxHandle, TxStatus } from './intent.js';
+import type { SurfaceName } from './surface.js';
+export interface SurfaceModule {
+    readonly name: SurfaceName;
+    prepare(intent: Intent): Promise<PreparedTx>;
+    preparePointer?(intent: Intent, op: CrossVmPointerOp): Promise<PreparedTx>;
+    sign(prepared: PreparedTx, consent: Consent): Promise<SignedTx>;
+    submit(signed: SignedTx): Promise<TxHandle>;
+    watch(handle: TxHandle): AsyncIterable<TxStatus>;
+    /**
+     * Tell the UI what memo / destination-tag shape this surface accepts for
+     * a given intent. Optional — surfaces that never need a memo can omit it
+     * (kernel treats absence as `MEMO_SPEC_NONE`). Recipients differ even
+     * within a surface (an exchange Canton party may require memos while a
+     * personal party may not), so the spec is per-intent, not per-surface.
+     */
+    memoSpec?(intent: Intent): MemoSpec;
+}
+//# sourceMappingURL=surface-module.d.ts.map

package/dist/types/surface-module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface-module.d.ts","sourceRoot":"","sources":["../../src/types/surface-module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAC9F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAEhD,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7C,cAAc,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3E,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,CAAC,MAAM,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,KAAK,CAAC,MAAM,EAAE,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACjD;;;;;;OAMG;IACH,QAAQ,CAAC,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAAC;CACrC"}

package/dist/types/surface-module.js

@@ -0,0 +1,19 @@
+/**
+ * The Surface interface — every surface module implements exactly this.
+ *
+ * `prepare` is read-mostly: it can hit RPCs to estimate fees, check nonces, and
+ * validate the recipient. It must never request user signing.
+ *
+ * `sign` is where the MPC quorum runs. Surface modules call into the
+ * `SigningDriver` (passed at kernel construction) rather than holding key
+ * material directly.
+ *
+ * `submit` is fire-and-forget; `watch` is the long-poll for finality.
+ *
+ * `preparePointer` is optional and lives on on-Tenzro surfaces only. Kernel
+ * dispatches to it when route is `cross-vm-pointer` (precompile 0x1003 / SVM
+ * cross-VM instruction / native syscall). Surfaces that can't be a pointer-op
+ * source (canton-external) omit it; canton-internal lands its impl in M4.
+ */
+export {};
+//# sourceMappingURL=surface-module.js.map

package/dist/types/surface-module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"surface-module.js","sourceRoot":"","sources":["../../src/types/surface-module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG"}