From ad20621dd30340f361011e6913b0abdbd881165e Mon Sep 17 00:00:00 2001
From: Tanveer Wahid <twahid@keeta.com>
Date: Thu, 2 Jul 2026 15:51:30 -0700
Subject: [PATCH 01/11] chore: better align project to TS naming

---
 .github/workflows/ci.yml                      |   4 +-
 .github/workflows/publish.yml                 |   4 +-
 CONTRIBUTING.md                               |   2 +-
 Directory.Packages.props                      |   2 +
 KeetaNet.Anchor.slnx                          |   1 +
 Makefile                                      |  24 ++--
 README.md                                     | 107 ++++++++++-------
 cspell.yaml                                   |   2 +
 ...chor.Extensions.DependencyInjection.csproj |  22 ++++
 ...etaNetAnchorServiceCollectionExtensions.cs |  22 ++++
 src/KeetaNet.Anchor/Crypto/Account.cs         |  50 +-------
 src/KeetaNet.Anchor/Crypto/AccountFactory.cs  |  61 ++++++++++
 src/KeetaNet.Anchor/Crypto/Certificate.cs     |  20 +---
 .../Crypto/CertificateFactory.cs              |  26 ++++
 .../Crypto/EncryptedContainer.cs              |  62 +---------
 .../Crypto/EncryptedContainerFactory.cs       |  60 ++++++++++
 .../Crypto/KycAttributeValue.cs               |  66 ++++++++++
 src/KeetaNet.Anchor/Crypto/KycCertificate.cs  | 113 ++++++------------
 .../Crypto/KycCertificateFactory.cs           |  22 ++++
 .../Crypto/SharableCertificateAttributes.cs   |  60 ++--------
 .../SharableCertificateAttributesFactory.cs   |  49 ++++++++
 .../Interop/WasmRuntime.Surface.cs            |  42 +++++++
 src/KeetaNet.Anchor/Interop/WasmRuntime.cs    |   6 +
 .../AssetMovement/AssetMovementClient.cs      |  39 +++---
 .../Services/AssetMovement/AssetTransfer.cs   |   6 +-
 src/KeetaNet.Anchor/Services/Kyc/KycClient.cs |  19 +--
 .../AssetFlowTests.cs                         |  36 +++---
 .../KeetaNet.Anchor.E2eTests/AssetSession.cs  |   6 +-
 .../ContainerInteropTests.cs                  |  18 +--
 .../KeetaNet.Anchor.E2eTests/KycFlowTests.cs  |  12 +-
 .../KycInteropTests.cs                        |  20 ++--
 tests/KeetaNet.Anchor.E2eTests/Leaves.cs      |   4 +-
 .../SharableInteropTests.cs                   |  16 +--
 .../KeetaNet.Anchor.Tests/ConcurrencyTests.cs |  16 +--
 tests/KeetaNet.Anchor.Tests/ContainerTests.cs |  38 +++---
 tests/KeetaNet.Anchor.Tests/CryptoTests.cs    |  37 +++---
 .../DependencyInjectionTests.cs               |  33 +++++
 tests/KeetaNet.Anchor.Tests/IssueTests.cs     |  20 ++--
 .../KeetaNet.Anchor.Tests.csproj              |   2 +
 tests/KeetaNet.Anchor.Tests/LifecycleTests.cs |  20 ++--
 tests/KeetaNet.Anchor.Tests/ProveTests.cs     |  12 +-
 tests/KeetaNet.Anchor.Tests/SharableTests.cs  |  34 +++---
 42 files changed, 734 insertions(+), 481 deletions(-)
 create mode 100644 src/KeetaNet.Anchor.Extensions.DependencyInjection/KeetaNet.Anchor.Extensions.DependencyInjection.csproj
 create mode 100644 src/KeetaNet.Anchor.Extensions.DependencyInjection/KeetaNetAnchorServiceCollectionExtensions.cs
 create mode 100644 src/KeetaNet.Anchor/Crypto/AccountFactory.cs
 create mode 100644 src/KeetaNet.Anchor/Crypto/CertificateFactory.cs
 create mode 100644 src/KeetaNet.Anchor/Crypto/EncryptedContainerFactory.cs
 create mode 100644 src/KeetaNet.Anchor/Crypto/KycAttributeValue.cs
 create mode 100644 src/KeetaNet.Anchor/Crypto/KycCertificateFactory.cs
 create mode 100644 src/KeetaNet.Anchor/Crypto/SharableCertificateAttributesFactory.cs
 create mode 100644 src/KeetaNet.Anchor/Interop/WasmRuntime.Surface.cs
 create mode 100644 tests/KeetaNet.Anchor.Tests/DependencyInjectionTests.cs

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a9f033b..2827fe6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -92,7 +92,7 @@ jobs:
           scope: "@keetanetwork"
 
       - name: Check formatting and linting
-        run: make lint
+        run: make do-lint-ci
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -126,7 +126,7 @@ jobs:
         run: bash scripts/build-wasm.sh
 
       - name: Pack
-        run: dotnet pack src/KeetaNet.Anchor/KeetaNet.Anchor.csproj -c Release -o artifacts
+        run: dotnet pack KeetaNet.Anchor.slnx -c Release -o artifacts
 
       - name: Upload package
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 4a481f4..931556a 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -24,7 +24,7 @@ jobs:
           global-json-file: global.json
 
       - name: Set up Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
         with:
           toolchain: "1.94.0"
           targets: wasm32-wasip1
@@ -41,7 +41,7 @@ jobs:
 
       - name: Pack
         run: >
-          dotnet pack src/KeetaNet.Anchor/KeetaNet.Anchor.csproj -c Release -o artifacts
+          dotnet pack KeetaNet.Anchor.slnx -c Release -o artifacts
           ${{ startsWith(github.ref, 'refs/tags/releases/v') && format('-p:Version={0}', steps.version.outputs.value) || '' }}
 
       - name: Attest build provenance
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 159b163..f7833a0 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -5,7 +5,7 @@
 1. Install the .NET SDK matching [`global.json`](global.json) and Rust with the `wasm32-wasip1` target (`rustup target add wasm32-wasip1`).
 2. Run `make developer` to restore, build, and test. The first build runs `make wasm` to produce the embedded wasm core from the pinned crates.io release.
 3. Make changes. Use hard tabs for indentation (spaces only where the format requires them, ex. YAML).
-4. Run `make lint` and `make test` before opening a pull request.
+4. Run `make do-lint` and `make test` before opening a pull request.
 
 Always drive tasks through the `Makefile`, never raw `dotnet`.
 
diff --git a/Directory.Packages.props b/Directory.Packages.props
index e8c5233..8bde0e2 100644
--- a/Directory.Packages.props
+++ b/Directory.Packages.props
@@ -7,10 +7,12 @@
 
 	<ItemGroup>
 		<PackageVersion Include="Wasmtime" Version="44.0.0" />
+		<PackageVersion Include="Microsoft.Extensions.DependencyInjection.Abstractions" Version="10.0.2" />
 	</ItemGroup>
 
 	<ItemGroup Label="Test">
 		<PackageVersion Include="xunit.v3" Version="3.2.2" />
+		<PackageVersion Include="Microsoft.Extensions.DependencyInjection" Version="10.0.2" />
 		<!--
 			Must stay on the Microsoft.Testing.Platform 1.x line: xunit.v3 stable
 			ships an MTP v1 adapter (xunit.v3.core.mtp-v1 -> MTP 1.9.1), and the
diff --git a/KeetaNet.Anchor.slnx b/KeetaNet.Anchor.slnx
index a25bf48..eba149c 100644
--- a/KeetaNet.Anchor.slnx
+++ b/KeetaNet.Anchor.slnx
@@ -1,6 +1,7 @@
 <Solution>
   <Folder Name="/src/">
     <Project Path="src/KeetaNet.Anchor/KeetaNet.Anchor.csproj" />
+    <Project Path="src/KeetaNet.Anchor.Extensions.DependencyInjection/KeetaNet.Anchor.Extensions.DependencyInjection.csproj" />
   </Folder>
   <Folder Name="/tests/">
     <Project Path="tests/KeetaNet.Anchor.Tests/KeetaNet.Anchor.Tests.csproj" />
diff --git a/Makefile b/Makefile
index bf6a22c..565b8a4 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: help developer restore build rebuild format lint test coverage pack clean wasm node-harness release
+.PHONY: help developer restore build rebuild do-lint do-lint-ci test coverage pack clean wasm node-harness release
 
 # Build configuration (Debug or Release)
 CONFIG ?= Release
@@ -32,12 +32,14 @@ build: restore $(WASM_DEST)
 # Clean then build
 rebuild: clean build
 
-# Apply formatting fixes
-format:
+# Lint code (applies formatting fixes; C# + the TypeScript harness, one command)
+do-lint: node-harness
 	dotnet format $(SLN)
+	npx --yes cspell --config cspell.yaml --no-progress "src/**/*.cs" "tests/**/*.cs" "tests/node-harness/src/**" "scripts/**" "Makefile" "*.md"
+	cd $(HARNESS_DIR) && npm run lint
 
-# Verify formatting, spelling, and the harness lint without writing changes
-lint: node-harness
+# Lint code for CI (check only, no fixes)
+do-lint-ci: node-harness
 	dotnet format $(SLN) --verify-no-changes
 	npx --yes cspell --config cspell.yaml --no-progress "src/**/*.cs" "tests/**/*.cs" "tests/node-harness/src/**" "scripts/**" "Makefile" "*.md"
 	cd $(HARNESS_DIR) && npm run lint
@@ -61,9 +63,9 @@ coverage: build
 	dotnet test $(UNIT_TESTS) -c $(CONFIG) --no-build \
 		-- --coverage --coverage-output-format cobertura --coverage-output coverage.cobertura.xml
 
-# Produce the NuGet package (.nupkg + .snupkg)
+# Produce the NuGet packages (.nupkg + .snupkg)
 pack: build
-	dotnet pack src/KeetaNet.Anchor/KeetaNet.Anchor.csproj -c Release --no-build -o $(ARTIFACTS)
+	dotnet pack $(SLN) -c Release --no-build -o $(ARTIFACTS)
 
 # Build the P1 wasm core from the pinned crates.io release
 wasm:
@@ -105,11 +107,13 @@ help:
 	@echo "  make test         - Run all tests (builds node-harness; unit + e2e)"
 	@echo "  make node-harness - Install + build the TypeScript interop harnesses"
 	@echo "  make coverage     - Run unit tests with code coverage"
-	@echo "  make format       - Apply formatting fixes"
-	@echo "  make lint         - Verify formatting + spelling"
-	@echo "  make pack         - Produce the NuGet package into $(ARTIFACTS)/"
+	@echo "  make do-lint      - Lint code with formatting fixes (C# + harness + spelling)"
+	@echo "  make pack         - Produce the NuGet packages into $(ARTIFACTS)/"
 	@echo "  make wasm         - Build the P1 wasm core from the pinned crates.io release"
 	@echo "  make clean        - Remove build outputs"
 	@echo ""
+	@echo "CI Commands:"
+	@echo "  make do-lint-ci   - Lint code for CI (check only, no fixes)"
+	@echo ""
 	@echo "Release commands:"
 	@echo "  make release vX.Y.Z - Create a signed releases/vX.Y.Z tag"
diff --git a/README.md b/README.md
index 3997c65..4fd22e4 100644
--- a/README.md
+++ b/README.md
@@ -7,6 +7,7 @@ C# SDK for the KeetaNet anchor. The client logic runs inside a sandboxed WebAsse
 | Package | Description |
 | --- | --- |
 | `KeetaNet.Anchor` | KYC and asset-movement clients, crypto, certificates, and containers over the anchor wasm core. |
+| `KeetaNet.Anchor.Extensions.DependencyInjection` | `Microsoft.Extensions.DependencyInjection` integration: registers the shared runtime singleton. |
 
 ## Requirements
 
@@ -29,8 +30,8 @@ Use the `Makefile`, not raw `dotnet`, for every task:
 | `make test` | Run all tests: unit + e2e against the live TypeScript anchor |
 | `make node-harness` | Install + build the TypeScript interop harnesses |
 | `make coverage` | Run unit tests with code coverage |
-| `make lint` | Verify formatting, spelling, and the harness lint |
-| `make format` | Apply formatting fixes |
+| `make do-lint` | Lint with formatting fixes (C#, spelling, harness) |
+| `make do-lint-ci` | Lint for CI (check only, no fixes) |
 | `make pack` | Produce the NuGet package |
 | `make wasm` | Build the P1 wasm core from the pinned crates.io release |
 
@@ -38,7 +39,7 @@ Use the `Makefile`, not raw `dotnet`, for every task:
 
 ### The Runtime
 
-Everything starts from a `WasmRuntime`, which loads the embedded wasm core and owns the dispatcher thread all calls serialize onto. Create one per application and dispose it last: every object below borrows it.
+Everything starts from a `WasmRuntime`, which loads the embedded wasm core and owns the dispatcher thread all calls serialize onto. Create one per application and dispose it last: every object below is created from its factories and borrows it.
 
 The runtime is thread-safe. Non-network operations (crypto, certificates, containers) dispatch synchronously. Networked client operations are `async`, accept a `CancellationToken`, and honor it before dispatch and during host HTTP and sleeps.
 
@@ -49,7 +50,25 @@ using KeetaNet.Anchor.Crypto;
 using var runtime = WasmRuntime.Load();
 ```
 
-Every handle-backed type (`Account`, certificates, containers, clients) implements `IDisposable`. Wrap them in `using` and dispose them before the runtime.
+The runtime exposes one factory per domain — `Accounts`, `Certificates`, `KycCertificates`, `Containers`, `Sharables` — plus `CreateKycClient` and `CreateAssetMovementClient` for the networked clients. Every handle-backed object they create implements `IDisposable`. Wrap them in `using` and dispose them before the runtime.
+
+In an application using `Microsoft.Extensions.DependencyInjection`, register the runtime once instead of threading it around; the container owns its disposal:
+
+```csharp
+// Program.cs — requires the KeetaNet.Anchor.Extensions.DependencyInjection package.
+builder.Services.AddKeetaNetAnchor();
+
+// Any service: inject the singleton and create what you need per use.
+public sealed class Onboarding(WasmRuntime runtime)
+{
+	public string NewSignerAddress()
+	{
+		string seed = runtime.Accounts.GenerateRandomSeed();
+		using Account signer = runtime.Accounts.FromSeed(seed, index: 0, algorithm: "ed25519");
+		return signer.Address;
+	}
+}
+```
 
 ### Accounts
 
@@ -57,8 +76,8 @@ An `Account` is a signer derived from a seed, private key, or BIP39 passphrase,
 
 ```csharp
 // Derive a signer from a fresh seed.
-string seed = Account.GenerateSeed(runtime);
-using Account signer = Account.FromSeed(runtime, seed, index: 0, algorithm: "ed25519");
+string seed = runtime.Accounts.GenerateRandomSeed();
+using Account signer = runtime.Accounts.FromSeed(seed, index: 0, algorithm: "ed25519");
 
 Console.WriteLine(signer.Address);   // keeta_...
 Console.WriteLine(signer.PublicKey); // type-prefixed hex
@@ -73,7 +92,7 @@ byte[] ciphertext = signer.Encrypt("for your eyes"u8.ToArray());
 byte[] plaintext = signer.Decrypt(ciphertext);
 
 // A read-only account verifies and encrypts but cannot sign or decrypt.
-using Account watcher = Account.FromAddress(runtime, signer.Address);
+using Account watcher = runtime.Accounts.FromAccount(signer.Address);
 ```
 
 ### KYC Verification
@@ -83,14 +102,14 @@ using Account watcher = Account.FromAddress(runtime, signer.Address);
 Provider results use the pending-or-ready shape: `Ready` carries the value, otherwise `RetryAfterMs` says when to ask again.
 
 ```csharp
-using KycClient kyc = KycClient.WithAccount(runtime, nodeUrl, root, signer);
+using KycClient kyc = runtime.CreateKycClient(nodeUrl, root, signer);
 
 string[] countries = { "US" };
-IReadOnlyList<KycProvider> providers = await kyc.ProvidersAsync(countries, cancellationToken);
+IReadOnlyList<KycProvider> providers = await kyc.GetProvidersAsync(countries, cancellationToken);
 KycProvider provider = providers[0];
 
 // Start a verification. The user completes it in a browser at WebUrl.
-VerificationOutcome created = await kyc.CreateVerificationAsync(provider, countries, cancellationToken: cancellationToken);
+VerificationOutcome created = await kyc.StartVerificationAsync(provider, countries, cancellationToken: cancellationToken);
 Verification verification = created.Ready!;
 Console.WriteLine(verification.WebUrl);
 Console.WriteLine(verification.ExpectedCost.Token);
@@ -109,8 +128,8 @@ string leafPem = issued.Results[0].Value;
 A `KycCertificate` is an issued leaf: a base X.509 certificate plus KYC attributes, some plain and some encrypted to the subject. Verify it against the provider's CA, then read attributes with the subject account.
 
 ```csharp
-using KycCertificate leaf = KycCertificate.Parse(runtime, leafPem);
-using Certificate providerCa = kyc.ProviderCertificate(provider);
+using KycCertificate leaf = runtime.KycCertificates.Parse(leafPem);
+using Certificate providerCa = kyc.GetCA(provider);
 
 bool trusted = leaf.Verify(
 	trustedRoots: new[] { providerCa },
@@ -118,29 +137,31 @@ bool trusted = leaf.Verify(
 	moment: DateTimeOffset.UtcNow);
 
 // List what the leaf carries.
-foreach (KycAttribute attribute in leaf.Attributes())
+foreach (string name in leaf.GetAttributeNames())
 {
-	Console.WriteLine($"{attribute.Name} (sensitive: {attribute.Sensitive})");
+	Console.WriteLine(name);
 }
 
-// Scalars and dates decode as text; structured attributes decode as JSON.
+// GetAttributeBuffer returns the undecoded semantic bytes. GetAttribute wraps
+// them in a typed box; pick the accessor matching the attribute's shape.
 // Sensitive attributes decrypt with the subject account; plain ones use the
 // overloads without an account.
-string fullName = leaf.GetText("fullName", subject);
-string birthDate = leaf.GetText("dateOfBirth", subject); // ISO-8601 timestamp
-JsonElement address = leaf.GetJson("address", subject);
+byte[] rawEmail = leaf.GetAttributeBuffer("email", subject);
+string fullName = leaf.GetAttribute("fullName", subject).AsText();
+DateTimeOffset birthDate = leaf.GetAttribute("dateOfBirth", subject).AsTimestamp();
+JsonElement address = leaf.GetAttribute("address", subject).AsJson();
 ```
 
 ### Selective Disclosure with Proofs
 
-A holder can attest to one sensitive attribute without revealing the private key. `Prove` decrypts the attribute and produces an `AttributeProof`. Anyone holding the leaf validates it with only the subject's public key.
+A holder can attest to one sensitive attribute without revealing the private key. `GetProof` decrypts the attribute and produces an `AttributeProof`. Anyone holding the leaf validates it with only the subject's public key.
 
 ```csharp
 // Holder: decrypt and prove one attribute.
-AttributeProof proof = leaf.Prove("email", subject);
+AttributeProof proof = leaf.GetProof("email", subject);
 
 // Verifier: a read-only subject account suffices.
-using Account subjectPublic = Account.FromAddress(runtime, subjectAddress);
+using Account subjectPublic = runtime.Accounts.FromAccount(subjectAddress);
 bool attested = leaf.ValidateProof("email", subjectPublic, proof);
 ```
 
@@ -152,7 +173,7 @@ bool attested = leaf.ValidateProof("email", subjectPublic, proof);
 var validFrom = new DateTimeOffset(2024, 1, 1, 0, 0, 0, TimeSpan.Zero);
 var validTo = validFrom.AddYears(1);
 
-using KycCertificate issued = KycCertificate.Builder(runtime)
+using KycCertificate issued = runtime.KycCertificates.Builder()
 	.Subject(subject)
 	.Issuer(issuer)
 	.IssuerName("Example CA")
@@ -160,9 +181,9 @@ using KycCertificate issued = KycCertificate.Builder(runtime)
 	.Validity(validFrom, validTo)
 	.SetAttribute("fullName", sensitive: true, "Jane Doe")
 	.SetAttribute("dateOfBirth", sensitive: true, new DateTimeOffset(1980, 1, 1, 0, 0, 0, TimeSpan.Zero))
-	.Issue();
+	.Build();
 
-string pem = issued.Pem();
+string pem = issued.ToPem();
 ```
 
 ### Sharable Attribute Bundles
@@ -171,18 +192,18 @@ string pem = issued.Pem();
 
 ```csharp
 // Subject: disclose two attributes and grant the recipient.
-using SharableCertificateAttributes bundle = SharableCertificateAttributes.FromCertificate(
-	runtime, leaf, subject, names: new[] { "email", "fullName" });
+using SharableCertificateAttributes bundle = runtime.Sharables.FromCertificate(
+	leaf, subject, names: new[] { "email", "fullName" });
 bundle.GrantAccess(new[] { recipient });
 string envelope = bundle.ToPem();
 
 // Recipient: open with their own account and read the disclosed values.
 using SharableCertificateAttributes opened =
-	SharableCertificateAttributes.FromPem(runtime, envelope, new[] { recipient });
+	runtime.Sharables.FromPem(envelope, new[] { recipient });
 
-IReadOnlyList<string> disclosed = opened.AttributeNames();
-byte[]? email = opened.AttributeBuffer("email"); // null when not disclosed
-using KycCertificate embeddedLeaf = opened.LeafCertificate();
+IReadOnlyList<string> disclosed = opened.GetAttributeNames();
+byte[]? email = opened.GetAttributeBuffer("email"); // null when not disclosed
+using KycCertificate embeddedLeaf = opened.GetCertificate();
 ```
 
 ### Encrypted Containers
@@ -193,15 +214,15 @@ using KycCertificate embeddedLeaf = opened.LeafCertificate();
 byte[] payload = "the payload"u8.ToArray();
 
 // Seal to the recipient and sign as the sender.
-using EncryptedContainer container = EncryptedContainer.FromPlaintext(
-	runtime, payload, principals: new[] { recipient }, signer: signer);
-byte[] blob = container.Encoded();
+using EncryptedContainer container = runtime.Containers.FromPlaintext(
+	payload, principals: new[] { recipient }, signer: signer);
+byte[] blob = container.GetEncoded();
 
 // Recipient: open, verify, and identify the signer.
-using EncryptedContainer opened = EncryptedContainer.FromEncrypted(runtime, blob, new[] { recipient });
-byte[] received = opened.Plaintext();
+using EncryptedContainer opened = runtime.Containers.FromEncrypted(blob, new[] { recipient });
+byte[] received = opened.GetPlaintext();
 bool signatureValid = opened.VerifySignature();
-byte[]? signerKey = opened.SigningAccount(); // type-prefixed public key, null when unsigned
+byte[]? signerKey = opened.GetSigningAccount(); // type-prefixed public key, null when unsigned
 ```
 
 ### Asset Movement
@@ -209,16 +230,16 @@ byte[]? signerKey = opened.SigningAccount(); // type-prefixed public key, null w
 `AssetMovementClient` discovers asset-movement providers and drives transfers, persistent forwarding, and KYC sharing. Simulated and initiated transfers return fluent objects bound to their provider and id.
 
 ```csharp
-using AssetMovementClient assets = AssetMovementClient.WithAccount(runtime, nodeUrl, root, signer);
+using AssetMovementClient assets = runtime.CreateAssetMovementClient(nodeUrl, root, signer);
 
 // Discovery: all providers, by id, by signer account, or by transfer shape.
-IReadOnlyList<AssetProvider> providers = await assets.ProvidersAsync(cancellationToken);
+IReadOnlyList<AssetProvider> providers = await assets.GetProvidersAsync(cancellationToken);
 var search = new AssetProviderSearch(Asset: asset, From: "chain:evm:100", To: "chain:keeta:100");
 IReadOnlyList<AssetProvider> capable = await assets.GetProvidersForTransferAsync(search, cancellationToken);
 AssetProvider provider = capable[0];
 
 // Check the signer's readiness before transacting.
-AssetAccountStatus account = await assets.AccountStatusAsync(provider, cancellationToken);
+AssetAccountStatus account = await assets.GetAccountStatusAsync(provider, cancellationToken);
 
 // Push transfer: simulate first, then promote the simulation.
 var request = new AssetTransferRequest(
@@ -228,15 +249,15 @@ var request = new AssetTransferRequest(
 	Value: "100");
 AssetSimulatedTransfer simulated = await assets.SimulateTransferAsync(provider, request, cancellationToken);
 AssetTransfer transfer = await simulated.CreateTransferAsync(cancellationToken: cancellationToken);
-AssetTransferStatus status = await transfer.GetStatusAsync(cancellationToken);
+AssetTransferStatus status = await transfer.GetTransferStatusAsync(cancellationToken);
 
 // Pull transfer (fiat rails): initiate, pick an instruction, execute.
 AssetTransfer pull = await assets.InitiateTransferAsync(provider, pullRequest, cancellationToken);
 var instruction = new AssetPullInstruction("ACH_DEBIT", pull.InstructionChoices[0].GetProperty("pullFrom"));
-AssetTransferStatus executed = await pull.ExecuteAsync(instruction, cancellationToken);
+AssetTransferStatus executed = await pull.ExecuteTransferAsync(instruction, cancellationToken);
 
 // Share KYC attributes; a pending outcome polls its promise URL inside the core.
-AssetShareKycOutcome shared = await assets.ShareKycAndWaitAsync(
+AssetShareKycOutcome shared = await assets.ShareKycAttributesAndWaitAsync(
 	provider,
 	new AssetShareKycRequest(exportedAttributes),
 	pollInterval: TimeSpan.FromSeconds(1),
@@ -244,7 +265,7 @@ AssetShareKycOutcome shared = await assets.ShareKycAndWaitAsync(
 	cancellationToken: cancellationToken);
 ```
 
-Persistent forwarding follows the same pattern: `InitiateForwardingTemplateAsync` / `CreateForwardingTemplateAsync` / `CreateForwardingAddressAsync` create, the `List*Async` methods page, and the `Deactivate*Async` methods retire.
+Persistent forwarding follows the same pattern: `InitiatePersistentForwardingTemplateAsync` / `CreatePersistentForwardingTemplateAsync` / `CreatePersistentForwardingAddressAsync` create, the `List*Async` methods page, and the `Deactivate*Async` methods retire.
 
 ### Errors
 
diff --git a/cspell.yaml b/cspell.yaml
index e2c43b5..5d02866 100644
--- a/cspell.yaml
+++ b/cspell.yaml
@@ -35,6 +35,7 @@ words:
   - secp256r1
   - passphrase
   - pem
+  - sharables
   - roslyn
   - sourcelink
   - deterministic
@@ -48,6 +49,7 @@ words:
   - cobertura
   - ciphertext
   - millis
+  - undecoded
   - pems
   - dtos
   - oldsmar
diff --git a/src/KeetaNet.Anchor.Extensions.DependencyInjection/KeetaNet.Anchor.Extensions.DependencyInjection.csproj b/src/KeetaNet.Anchor.Extensions.DependencyInjection/KeetaNet.Anchor.Extensions.DependencyInjection.csproj
new file mode 100644
index 0000000..7a2895b
--- /dev/null
+++ b/src/KeetaNet.Anchor.Extensions.DependencyInjection/KeetaNet.Anchor.Extensions.DependencyInjection.csproj
@@ -0,0 +1,22 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+	<PropertyGroup>
+		<TargetFrameworks>net8.0;net10.0</TargetFrameworks>
+		<AssemblyName>KeetaNet.Anchor.Extensions.DependencyInjection</AssemblyName>
+		<RootNamespace>Microsoft.Extensions.DependencyInjection</RootNamespace>
+		<GenerateDocumentationFile>true</GenerateDocumentationFile>
+		<IsPackable>true</IsPackable>
+		<PackageId>KeetaNet.Anchor.Extensions.DependencyInjection</PackageId>
+		<Description>Microsoft.Extensions.DependencyInjection integration for the KeetaNet anchor SDK: registers the shared WasmRuntime singleton.</Description>
+		<PackageTags>keeta;keetanet;anchor;dependency-injection</PackageTags>
+	</PropertyGroup>
+
+	<ItemGroup>
+		<PackageReference Include="Microsoft.Extensions.DependencyInjection.Abstractions" />
+	</ItemGroup>
+
+	<ItemGroup>
+		<ProjectReference Include="../KeetaNet.Anchor/KeetaNet.Anchor.csproj" />
+	</ItemGroup>
+
+</Project>
diff --git a/src/KeetaNet.Anchor.Extensions.DependencyInjection/KeetaNetAnchorServiceCollectionExtensions.cs b/src/KeetaNet.Anchor.Extensions.DependencyInjection/KeetaNetAnchorServiceCollectionExtensions.cs
new file mode 100644
index 0000000..8254b12
--- /dev/null
+++ b/src/KeetaNet.Anchor.Extensions.DependencyInjection/KeetaNetAnchorServiceCollectionExtensions.cs
@@ -0,0 +1,22 @@
+using KeetaNet.Anchor;
+using Microsoft.Extensions.DependencyInjection.Extensions;
+
+namespace Microsoft.Extensions.DependencyInjection;
+
+/// <summary>
+/// Registers the KeetaNet anchor SDK with an <see cref="IServiceCollection"/>.
+/// </summary>
+public static class KeetaNetAnchorServiceCollectionExtensions
+{
+	/// <summary>
+	/// Register the shared <see cref="WasmRuntime"/> as a singleton, loading the
+	/// embedded wasm core on first resolve. The container disposes it on
+	/// shutdown. The runtime is thread-safe.
+	/// </summary>
+	/// <returns>The same collection, for chaining.</returns>
+	public static IServiceCollection AddKeetaNetAnchor(this IServiceCollection services)
+	{
+		services.TryAddSingleton(static _ => WasmRuntime.Load());
+		return services;
+	}
+}
diff --git a/src/KeetaNet.Anchor/Crypto/Account.cs b/src/KeetaNet.Anchor/Crypto/Account.cs
index 8048257..1c2da2c 100644
--- a/src/KeetaNet.Anchor/Crypto/Account.cs
+++ b/src/KeetaNet.Anchor/Crypto/Account.cs
@@ -6,59 +6,11 @@ namespace KeetaNet.Anchor.Crypto;
 /// </summary>
 public sealed class Account : WasmObject
 {
-	private Account(WasmRuntime runtime, int handle)
+	internal Account(WasmRuntime runtime, int handle)
 		: base(runtime, handle)
 	{
 	}
 
-	/// <summary>Derive a signing account from a hex <paramref name="seed"/>.</summary>
-	/// <remarks><paramref name="algorithm"/> is <c>ed25519</c>, <c>ecdsa_secp256k1</c>, or <c>ecdsa_secp256r1</c>.</remarks>
-	public static Account FromSeed(WasmRuntime runtime, string seed, uint index, string algorithm)
-	{
-		int handle = runtime.AccountFromSeed(seed, index, algorithm);
-		return new(runtime, handle);
-	}
-
-	/// <summary>Build a read-only account from its textual address.</summary>
-	public static Account FromAddress(WasmRuntime runtime, string address)
-	{
-		int handle = runtime.AccountFromAddress(address);
-		return new(runtime, handle);
-	}
-
-	/// <summary>Derive a signing account from a hex <paramref name="privateKey"/>.</summary>
-	/// <remarks><paramref name="algorithm"/> is <c>ed25519</c>, <c>ecdsa_secp256k1</c>, or <c>ecdsa_secp256r1</c>.</remarks>
-	public static Account FromPrivateKey(WasmRuntime runtime, string privateKey, string algorithm)
-	{
-		int handle = runtime.AccountFromPrivateKey(privateKey, algorithm);
-		return new(runtime, handle);
-	}
-
-	/// <summary>Derive a signing account from a BIP39 mnemonic <paramref name="words"/>.</summary>
-	public static Account FromPassphrase(WasmRuntime runtime, IEnumerable<string> words, uint index, string algorithm)
-	{
-		string mnemonic = string.Join('\n', words);
-		int handle = runtime.AccountFromPassphrase(mnemonic, index, algorithm);
-		return new(runtime, handle);
-	}
-
-	/// <summary>Build a read-only account from a hex <paramref name="publicKey"/>.</summary>
-	public static Account FromPublicKey(WasmRuntime runtime, string publicKey, string algorithm)
-	{
-		int handle = runtime.AccountFromPublicKey(publicKey, algorithm);
-		return new(runtime, handle);
-	}
-
-	/// <summary>Generate a random hex seed.</summary>
-	public static string GenerateSeed(WasmRuntime runtime) => runtime.AccountGenerateSeed();
-
-	/// <summary>Generate a random BIP39 mnemonic.</summary>
-	public static IReadOnlyList<string> GeneratePassphrase(WasmRuntime runtime)
-	{
-		string words = runtime.AccountGeneratePassphrase();
-		return words.Split('\n', StringSplitOptions.RemoveEmptyEntries);
-	}
-
 	/// <summary>The account's textual <c>keeta_...</c> address.</summary>
 	public string Address => Runtime.AccountAddress(Handle);
 
diff --git a/src/KeetaNet.Anchor/Crypto/AccountFactory.cs b/src/KeetaNet.Anchor/Crypto/AccountFactory.cs
new file mode 100644
index 0000000..05c1219
--- /dev/null
+++ b/src/KeetaNet.Anchor/Crypto/AccountFactory.cs
@@ -0,0 +1,61 @@
+namespace KeetaNet.Anchor.Crypto;
+
+/// <summary>
+/// Creates <see cref="Account"/> objects owned by one runtime. Reached through
+/// <see cref="WasmRuntime.Accounts"/>; every account it creates must be
+/// disposed before that runtime.
+/// </summary>
+public sealed class AccountFactory
+{
+	private readonly WasmRuntime _runtime;
+
+	internal AccountFactory(WasmRuntime runtime) => _runtime = runtime;
+
+	/// <summary>Derive a signing account from a hex <paramref name="seed"/>.</summary>
+	/// <remarks><paramref name="algorithm"/> is <c>ed25519</c>, <c>ecdsa_secp256k1</c>, or <c>ecdsa_secp256r1</c>.</remarks>
+	public Account FromSeed(string seed, uint index, string algorithm)
+	{
+		int handle = _runtime.AccountFromSeed(seed, index, algorithm);
+		return new(_runtime, handle);
+	}
+
+	/// <summary>Build a read-only account from its textual <c>keeta_...</c> account string.</summary>
+	public Account FromAccount(string account)
+	{
+		int handle = _runtime.AccountFromAddress(account);
+		return new(_runtime, handle);
+	}
+
+	/// <summary>Derive a signing account from a hex <paramref name="privateKey"/>.</summary>
+	/// <remarks><paramref name="algorithm"/> is <c>ed25519</c>, <c>ecdsa_secp256k1</c>, or <c>ecdsa_secp256r1</c>.</remarks>
+	public Account FromPrivateKey(string privateKey, string algorithm)
+	{
+		int handle = _runtime.AccountFromPrivateKey(privateKey, algorithm);
+		return new(_runtime, handle);
+	}
+
+	/// <summary>Derive a signing account from a BIP39 mnemonic <paramref name="words"/>.</summary>
+	public Account FromPassphrase(IEnumerable<string> words, uint index, string algorithm)
+	{
+		string mnemonic = string.Join('\n', words);
+		int handle = _runtime.AccountFromPassphrase(mnemonic, index, algorithm);
+		return new(_runtime, handle);
+	}
+
+	/// <summary>Build a read-only account from a hex <paramref name="publicKey"/>.</summary>
+	public Account FromPublicKey(string publicKey, string algorithm)
+	{
+		int handle = _runtime.AccountFromPublicKey(publicKey, algorithm);
+		return new(_runtime, handle);
+	}
+
+	/// <summary>Generate a random hex seed.</summary>
+	public string GenerateRandomSeed() => _runtime.AccountGenerateSeed();
+
+	/// <summary>Generate a random BIP39 mnemonic.</summary>
+	public IReadOnlyList<string> GeneratePassphrase()
+	{
+		string words = _runtime.AccountGeneratePassphrase();
+		return words.Split('\n', StringSplitOptions.RemoveEmptyEntries);
+	}
+}
diff --git a/src/KeetaNet.Anchor/Crypto/Certificate.cs b/src/KeetaNet.Anchor/Crypto/Certificate.cs
index 2da166a..d0ab09e 100644
--- a/src/KeetaNet.Anchor/Crypto/Certificate.cs
+++ b/src/KeetaNet.Anchor/Crypto/Certificate.cs
@@ -10,28 +10,14 @@ internal Certificate(WasmRuntime runtime, int handle)
 	{
 	}
 
-	/// <summary>Parse a PEM-encoded certificate.</summary>
-	public static Certificate Parse(WasmRuntime runtime, string pem)
-	{
-		int handle = runtime.CertificateParse(pem);
-		return new(runtime, handle);
-	}
-
-	/// <summary>Parse a DER-encoded certificate.</summary>
-	public static Certificate ParseDer(WasmRuntime runtime, byte[] der)
-	{
-		int handle = runtime.CertificateParseDer(der);
-		return new(runtime, handle);
-	}
-
 	/// <summary>The PEM encoding of the certificate.</summary>
-	public string Pem() => Runtime.CertificatePem(Handle);
+	public string ToPem() => Runtime.CertificatePem(Handle);
 
 	/// <summary>The DER encoding of the certificate.</summary>
-	public byte[] Der() => Runtime.CertificateDer(Handle);
+	public byte[] ToDer() => Runtime.CertificateDer(Handle);
 
 	/// <summary>Whether the certificate is valid at <paramref name="moment"/>.</summary>
-	public bool ValidAt(DateTimeOffset moment)
+	public bool IsValidAt(DateTimeOffset moment)
 	{
 		long unixMillis = moment.ToUnixTimeMilliseconds();
 		return Runtime.CertificateValidAt(Handle, unixMillis);
diff --git a/src/KeetaNet.Anchor/Crypto/CertificateFactory.cs b/src/KeetaNet.Anchor/Crypto/CertificateFactory.cs
new file mode 100644
index 0000000..ab0996c
--- /dev/null
+++ b/src/KeetaNet.Anchor/Crypto/CertificateFactory.cs
@@ -0,0 +1,26 @@
+namespace KeetaNet.Anchor.Crypto;
+
+/// <summary>
+/// Parses base X.509 <see cref="Certificate"/> objects owned by one runtime.
+/// Reached through <see cref="WasmRuntime.Certificates"/>.
+/// </summary>
+public sealed class CertificateFactory
+{
+	private readonly WasmRuntime _runtime;
+
+	internal CertificateFactory(WasmRuntime runtime) => _runtime = runtime;
+
+	/// <summary>Parse a PEM-encoded certificate.</summary>
+	public Certificate Parse(string pem)
+	{
+		int handle = _runtime.CertificateParse(pem);
+		return new(_runtime, handle);
+	}
+
+	/// <summary>Parse a DER-encoded certificate.</summary>
+	public Certificate ParseDer(byte[] der)
+	{
+		int handle = _runtime.CertificateParseDer(der);
+		return new(_runtime, handle);
+	}
+}
diff --git a/src/KeetaNet.Anchor/Crypto/EncryptedContainer.cs b/src/KeetaNet.Anchor/Crypto/EncryptedContainer.cs
index 1653978..5f1cb1b 100644
--- a/src/KeetaNet.Anchor/Crypto/EncryptedContainer.cs
+++ b/src/KeetaNet.Anchor/Crypto/EncryptedContainer.cs
@@ -6,68 +6,16 @@ namespace KeetaNet.Anchor.Crypto;
 /// </summary>
 public sealed class EncryptedContainer : WasmObject
 {
-	private EncryptedContainer(WasmRuntime runtime, int handle)
+	internal EncryptedContainer(WasmRuntime runtime, int handle)
 		: base(runtime, handle)
 	{
 	}
 
-	/// <summary>
-	/// Build a plaintext container. A non-empty <paramref name="principals"/> set
-	/// seals it to those accounts; <paramref name="signer"/> attaches a detached
-	/// signature; <paramref name="locked"/> overrides the default plaintext policy.
-	/// </summary>
-	public static EncryptedContainer FromPlaintext(
-		WasmRuntime runtime,
-		byte[] data,
-		IEnumerable<Account>? principals = null,
-		bool? locked = null,
-		Account? signer = null)
-	{
-		int[] handles = Handles.Of(principals);
-		int lockedFlag = locked switch
-		{
-			null => -1,
-			true => 1,
-			false => 0,
-		};
-		int signerHandle = signer?.Handle ?? 0;
-
-		int handle = runtime.EncryptedContainerFromPlaintext(data, handles, lockedFlag, signerHandle);
-		return new(runtime, handle);
-	}
-
-	/// <summary>
-	/// Build a container from an encoded blob that may be plaintext or encrypted,
-	/// resolving an encrypted blob with the optional <paramref name="principals"/>.
-	/// </summary>
-	public static EncryptedContainer FromEncoded(
-		WasmRuntime runtime,
-		byte[] data,
-		IEnumerable<Account>? principals = null)
-	{
-		int[] handles = Handles.Of(principals);
-		int handle = runtime.EncryptedContainerFromEncoded(data, handles);
-
-		return new(runtime, handle);
-	}
-
-	/// <summary>
-	/// Build a container from a blob that must be encrypted, opened by one of
-	/// <paramref name="principals"/>.
-	/// </summary>
-	public static EncryptedContainer FromEncrypted(WasmRuntime runtime, byte[] data, IEnumerable<Account> principals)
-	{
-		int[] handles = Handles.Of(principals);
-		int handle = runtime.EncryptedContainerFromEncrypted(data, handles);
-
-		return new(runtime, handle);
-	}
-
 	/// <summary>The decrypted, decompressed plaintext.</summary>
-	public byte[] Plaintext() => Runtime.EncryptedContainerGetPlaintext(Handle);
+	public byte[] GetPlaintext() => Runtime.EncryptedContainerGetPlaintext(Handle);
 
 	/// <summary>The container's DER encoding.</summary>
-	public byte[] Encoded() => Runtime.EncryptedContainerGetEncoded(Handle);
+	public byte[] GetEncoded() => Runtime.EncryptedContainerGetEncoded(Handle);
 
 	/// <summary>Whether the container is sealed to a principal set.</summary>
 	public bool IsEncrypted => Runtime.EncryptedContainerIsEncrypted(Handle);
@@ -82,7 +30,7 @@ public static EncryptedContainer FromEncrypted(WasmRuntime runtime, byte[] data,
 	/// The type-prefixed public key of the signing account, or <c>null</c> when
 	/// the container is unsigned.
 	/// </summary>
-	public byte[]? SigningAccount()
+	public byte[]? GetSigningAccount()
 	{
 		byte[] key = Runtime.EncryptedContainerSigningAccount(Handle);
 		if (key.Length == 0)
@@ -94,7 +42,7 @@ public static EncryptedContainer FromEncrypted(WasmRuntime runtime, byte[] data,
 	}
 
 	/// <summary>The type-prefixed public keys of the accounts that can open it.</summary>
-	public IReadOnlyList<byte[]> Principals()
+	public IReadOnlyList<byte[]> GetPrincipals()
 	{
 		byte[] payload = Runtime.EncryptedContainerPrincipals(Handle);
 		return PrincipalKeys.Decode(payload);
diff --git a/src/KeetaNet.Anchor/Crypto/EncryptedContainerFactory.cs b/src/KeetaNet.Anchor/Crypto/EncryptedContainerFactory.cs
new file mode 100644
index 0000000..73faa53
--- /dev/null
+++ b/src/KeetaNet.Anchor/Crypto/EncryptedContainerFactory.cs
@@ -0,0 +1,60 @@
+namespace KeetaNet.Anchor.Crypto;
+
+/// <summary>
+/// Creates <see cref="EncryptedContainer"/> objects owned by one runtime.
+/// Reached through <see cref="WasmRuntime.Containers"/>.
+/// </summary>
+public sealed class EncryptedContainerFactory
+{
+	private readonly WasmRuntime _runtime;
+
+	internal EncryptedContainerFactory(WasmRuntime runtime) => _runtime = runtime;
+
+	/// <summary>
+	/// Build a plaintext container. A non-empty <paramref name="principals"/> set
+	/// seals it to those accounts; <paramref name="signer"/> attaches a detached
+	/// signature; <paramref name="locked"/> overrides the default plaintext policy.
+	/// </summary>
+	public EncryptedContainer FromPlaintext(
+		byte[] data,
+		IEnumerable<Account>? principals = null,
+		bool? locked = null,
+		Account? signer = null)
+	{
+		int[] handles = Handles.Of(principals);
+		int lockedFlag = locked switch
+		{
+			null => -1,
+			true => 1,
+			false => 0,
+		};
+		int signerHandle = signer?.Handle ?? 0;
+
+		int handle = _runtime.EncryptedContainerFromPlaintext(data, handles, lockedFlag, signerHandle);
+		return new(_runtime, handle);
+	}
+
+	/// <summary>
+	/// Build a container from an encoded blob that may be plaintext or encrypted,
+	/// resolving an encrypted blob with the optional <paramref name="principals"/>.
+	/// </summary>
+	public EncryptedContainer FromEncoded(byte[] data, IEnumerable<Account>? principals = null)
+	{
+		int[] handles = Handles.Of(principals);
+		int handle = _runtime.EncryptedContainerFromEncoded(data, handles);
+
+		return new(_runtime, handle);
+	}
+
+	/// <summary>
+	/// Build a container from a blob that must be encrypted, opened by one of
+	/// <paramref name="principals"/>.
+	/// </summary>
+	public EncryptedContainer FromEncrypted(byte[] data, IEnumerable<Account> principals)
+	{
+		int[] handles = Handles.Of(principals);
+		int handle = _runtime.EncryptedContainerFromEncrypted(data, handles);
+
+		return new(_runtime, handle);
+	}
+}
diff --git a/src/KeetaNet.Anchor/Crypto/KycAttributeValue.cs b/src/KeetaNet.Anchor/Crypto/KycAttributeValue.cs
new file mode 100644
index 0000000..96c3d5d
--- /dev/null
+++ b/src/KeetaNet.Anchor/Crypto/KycAttributeValue.cs
@@ -0,0 +1,66 @@
+using System.Globalization;
+using System.Text;
+using System.Text.Json;
+
+namespace KeetaNet.Anchor.Crypto;
+
+/// <summary>
+/// A decoded KYC attribute value: the undecoded semantic bytes plus typed
+/// accessors. The attribute schema lives in the reference implementation, so
+/// each accessor parses on demand and throws <see cref="KeetaException"/>
+/// (code <c>ATTRIBUTE_DECODE</c>) when the bytes are not that shape.
+/// </summary>
+public sealed class KycAttributeValue
+{
+	private static readonly UTF8Encoding StrictUtf8 = new(encoderShouldEmitUTF8Identifier: false, throwOnInvalidBytes: true);
+
+	private readonly string _name;
+
+	internal KycAttributeValue(string name, byte[] buffer)
+	{
+		_name = name;
+		Buffer = buffer;
+	}
+
+	/// <summary>The undecoded semantic bytes.</summary>
+	public byte[] Buffer { get; }
+
+	/// <summary>The value as UTF-8 text (scalar attributes).</summary>
+	public string AsText()
+	{
+		try
+		{
+			return StrictUtf8.GetString(Buffer);
+		}
+		catch (DecoderFallbackException error)
+		{
+			throw new KeetaException("ATTRIBUTE_DECODE", $"attribute `{_name}` is not valid UTF-8 text: {error.Message}");
+		}
+	}
+
+	/// <summary>The value as an RFC-3339 timestamp (date attributes).</summary>
+	public DateTimeOffset AsTimestamp()
+	{
+		string text = AsText();
+		if (!DateTimeOffset.TryParse(text, CultureInfo.InvariantCulture, DateTimeStyles.RoundtripKind, out DateTimeOffset timestamp))
+		{
+			throw new KeetaException("ATTRIBUTE_DECODE", $"attribute `{_name}` is not an RFC-3339 timestamp");
+		}
+
+		return timestamp;
+	}
+
+	/// <summary>The value as JSON (structured attributes).</summary>
+	public JsonElement AsJson()
+	{
+		try
+		{
+			using var document = JsonDocument.Parse(Buffer);
+			return document.RootElement.Clone();
+		}
+		catch (JsonException error)
+		{
+			throw new KeetaException("ATTRIBUTE_DECODE", $"attribute `{_name}` is not valid JSON: {error.Message}");
+		}
+	}
+}
diff --git a/src/KeetaNet.Anchor/Crypto/KycCertificate.cs b/src/KeetaNet.Anchor/Crypto/KycCertificate.cs
index d92cdd1..ef434ed 100644
--- a/src/KeetaNet.Anchor/Crypto/KycCertificate.cs
+++ b/src/KeetaNet.Anchor/Crypto/KycCertificate.cs
@@ -4,9 +4,6 @@
 
 namespace KeetaNet.Anchor.Crypto;
 
-/// <summary>One KYC attribute: its OID <see cref="Name"/> and whether its value is encrypted.</summary>
-public sealed record KycAttribute(string Name, bool Sensitive);
-
 /// <summary>
 /// A proof attesting to a sensitive attribute's committed value. It validates
 /// against the certificate with only the subject's public key, so a holder can
@@ -28,18 +25,8 @@ private KycCertificate(WasmRuntime runtime, int handle)
 	/// <summary>Adopt an existing core-module leaf handle.</summary>
 	internal static KycCertificate Adopt(WasmRuntime runtime, int handle) => new(runtime, handle);
 
-	/// <summary>Parse a PEM-encoded KYC certificate.</summary>
-	public static KycCertificate Parse(WasmRuntime runtime, string pem)
-	{
-		int handle = runtime.KycCertificateParse(pem);
-		return new(runtime, handle);
-	}
-
-	/// <summary>Begin issuing a new KYC leaf certificate under <paramref name="runtime"/>.</summary>
-	public static KycCertificateBuilder Builder(WasmRuntime runtime) => new(runtime);
-
 	/// <summary>The PEM encoding of the certificate.</summary>
-	public string Pem() => Runtime.KycCertificatePem(Handle);
+	public string ToPem() => Runtime.KycCertificatePem(Handle);
 
 	/// <summary>The base certificate, as an independently owned certificate object.</summary>
 	public Certificate Base()
@@ -49,7 +36,7 @@ public Certificate Base()
 	}
 
 	/// <summary>Whether the certificate is valid at <paramref name="moment"/>.</summary>
-	public bool ValidAt(DateTimeOffset moment)
+	public bool IsValidAt(DateTimeOffset moment)
 	{
 		long unixMillis = moment.ToUnixTimeMilliseconds();
 		return Runtime.KycCertificateValidAt(Handle, unixMillis);
@@ -71,94 +58,72 @@ public bool Verify(
 		return Runtime.KycCertificateVerify(Handle, roots, bridges, unixMillis);
 	}
 
-	/// <summary>The KYC attributes the certificate carries.</summary>
-	public IReadOnlyList<KycAttribute> Attributes()
+	/// <summary>The names of the KYC attributes the certificate carries.</summary>
+	public IReadOnlyList<string> GetAttributeNames()
 	{
 		byte[] payload = Runtime.KycCertificateAttributes(Handle);
-		return KeetaJson.ReadList<KycAttribute>(payload);
-	}
-
-	/// <summary>A plain (unencrypted) attribute by <paramref name="name"/>.</summary>
-	public byte[] PlainAttribute(string name) => Runtime.KycCertificatePlainAttribute(Handle, name);
-
-	/// <summary>Decrypt a sensitive attribute by <paramref name="name"/> using <paramref name="subject"/>.</summary>
-	public byte[] DecryptAttribute(string name, Account subject) =>
-		Runtime.KycCertificateDecryptAttribute(Handle, name, subject.Handle);
+		IReadOnlyList<AttributeEntry> entries = KeetaJson.ReadList<AttributeEntry>(payload);
 
-	/// <summary>
-	/// Prove sensitive attribute <paramref name="name"/>, decrypting it with
-	/// <paramref name="subject"/>. The returned proof validates against this
-	/// certificate without the private key, for selective disclosure.
-	/// </summary>
-	public AttributeProof Prove(string name, Account subject)
-	{
-		byte[] payload = Runtime.KycCertificateProve(Handle, name, subject.Handle);
-		return JsonSerializer.Deserialize<AttributeProof>(payload, KeetaJson.Options) ?? throw new KeetaException("PROOF", "the proof payload was empty");
+		return entries.Select(entry => entry.Name).ToList();
 	}
 
-	/// <summary>
-	/// Whether <paramref name="proof"/> attests to sensitive attribute
-	/// <paramref name="name"/>, validated with <paramref name="subject"/>'s public key.
-	/// </summary>
-	public bool ValidateProof(string name, Account subject, AttributeProof proof)
-	{
-		string proofJson = JsonSerializer.Serialize(proof, KeetaJson.Options);
-		return Runtime.KycCertificateValidateProof(Handle, name, subject.Handle, proofJson);
-	}
+	/// <summary>The undecoded semantic bytes of plain (unencrypted) attribute <paramref name="name"/>.</summary>
+	public byte[] GetAttributeBuffer(string name) => Runtime.KycCertificatePlainAttribute(Handle, name);
 
 	/// <summary>
-	/// A plain scalar attribute decoded as text. Scalar and date attributes
-	/// decode to a UTF-8 string (dates as an ISO-8601 timestamp).
+	/// The undecoded semantic bytes of sensitive attribute <paramref name="name"/>,
+	/// decrypted with <paramref name="subject"/>.
 	/// </summary>
-	public string GetText(string name)
+	public byte[] GetAttributeBuffer(string name, Account subject) =>
+		Runtime.KycCertificateDecryptAttribute(Handle, name, subject.Handle);
+
+	/// <summary>Plain attribute <paramref name="name"/> as a typed value box.</summary>
+	public KycAttributeValue GetAttribute(string name)
 	{
-		byte[] value = PlainAttribute(name);
-		return Encoding.UTF8.GetString(value);
+		byte[] buffer = GetAttributeBuffer(name);
+		return new(name, buffer);
 	}
 
 	/// <summary>
-	/// A sensitive scalar attribute decrypted with <paramref name="subject"/> and
-	/// decoded as text (dates as an ISO-8601 timestamp).
+	/// Sensitive attribute <paramref name="name"/>, decrypted with
+	/// <paramref name="subject"/>, as a typed value box.
 	/// </summary>
-	public string GetText(string name, Account subject)
+	public KycAttributeValue GetAttribute(string name, Account subject)
 	{
-		byte[] value = DecryptAttribute(name, subject);
-		return Encoding.UTF8.GetString(value);
+		byte[] buffer = GetAttributeBuffer(name, subject);
+		return new(name, buffer);
 	}
 
 	/// <summary>
-	/// A plain structured attribute decoded as JSON. Structured attributes
-	/// (e.g. address, entity type) decode to a JSON object or array matching the
-	/// TypeScript client's value shape.
+	/// A proof of sensitive attribute <paramref name="name"/>, decrypted with
+	/// <paramref name="subject"/>. The proof validates against this certificate
+	/// without the private key, for selective disclosure.
 	/// </summary>
-	public JsonElement GetJson(string name)
+	public AttributeProof GetProof(string name, Account subject)
 	{
-		byte[] value = PlainAttribute(name);
-		return ParseJson(value);
+		byte[] payload = Runtime.KycCertificateProve(Handle, name, subject.Handle);
+		return JsonSerializer.Deserialize<AttributeProof>(payload, KeetaJson.Options) ?? throw new KeetaException("PROOF", "the proof payload was empty");
 	}
 
 	/// <summary>
-	/// A sensitive structured attribute decrypted with <paramref name="subject"/>
-	/// and decoded as JSON.
+	/// Whether <paramref name="proof"/> attests to sensitive attribute
+	/// <paramref name="name"/>, validated with <paramref name="subject"/>'s public key.
 	/// </summary>
-	public JsonElement GetJson(string name, Account subject)
-	{
-		byte[] value = DecryptAttribute(name, subject);
-		return ParseJson(value);
-	}
-
-	private static JsonElement ParseJson(byte[] payload)
+	public bool ValidateProof(string name, Account subject, AttributeProof proof)
 	{
-		using var document = JsonDocument.Parse(payload);
-		return document.RootElement.Clone();
+		string proofJson = JsonSerializer.Serialize(proof, KeetaJson.Options);
+		return Runtime.KycCertificateValidateProof(Handle, name, subject.Handle, proofJson);
 	}
 
 	private protected override void Release(WasmRuntime runtime, int handle) => runtime.KycCertificateFree(handle);
+
+	/// <summary>The core's attribute-list transport shape.</summary>
+	private sealed record AttributeEntry(string Name, bool Sensitive);
 }
 
 /// <summary>
 /// A fluent builder for a KYC leaf certificate: collect a subject, issuer,
-/// validity window, and attributes, then <see cref="Issue"/> the signed
+/// validity window, and attributes, then <see cref="Build"/> the signed
 /// leaf. Sensitive attributes are encrypted to the subject; the issuer
 /// signs. The subject and issuer may use different signing algorithms.
 /// </summary>
@@ -264,8 +229,8 @@ public KycCertificateBuilder SetAttribute(string name, bool sensitive, byte[] va
 		return this;
 	}
 
-	/// <summary>Issue the signed leaf certificate.</summary>
-	public KycCertificate Issue()
+	/// <summary>Build (issue) the signed leaf certificate.</summary>
+	public KycCertificate Build()
 	{
 		Account subject = _subject ?? throw new InvalidOperationException("a subject account is required to issue a certificate");
 		Account issuer = _issuer ?? throw new InvalidOperationException("an issuer account is required to issue a certificate");
diff --git a/src/KeetaNet.Anchor/Crypto/KycCertificateFactory.cs b/src/KeetaNet.Anchor/Crypto/KycCertificateFactory.cs
new file mode 100644
index 0000000..c556de2
--- /dev/null
+++ b/src/KeetaNet.Anchor/Crypto/KycCertificateFactory.cs
@@ -0,0 +1,22 @@
+namespace KeetaNet.Anchor.Crypto;
+
+/// <summary>
+/// Parses and issues <see cref="KycCertificate"/> leaves owned by one runtime.
+/// Reached through <see cref="WasmRuntime.KycCertificates"/>.
+/// </summary>
+public sealed class KycCertificateFactory
+{
+	private readonly WasmRuntime _runtime;
+
+	internal KycCertificateFactory(WasmRuntime runtime) => _runtime = runtime;
+
+	/// <summary>Parse a PEM-encoded KYC certificate.</summary>
+	public KycCertificate Parse(string pem)
+	{
+		int handle = _runtime.KycCertificateParse(pem);
+		return KycCertificate.Adopt(_runtime, handle);
+	}
+
+	/// <summary>Begin issuing a new KYC leaf certificate.</summary>
+	public KycCertificateBuilder Builder() => new(_runtime);
+}
diff --git a/src/KeetaNet.Anchor/Crypto/SharableCertificateAttributes.cs b/src/KeetaNet.Anchor/Crypto/SharableCertificateAttributes.cs
index 687f186..db94321 100644
--- a/src/KeetaNet.Anchor/Crypto/SharableCertificateAttributes.cs
+++ b/src/KeetaNet.Anchor/Crypto/SharableCertificateAttributes.cs
@@ -8,55 +8,11 @@ namespace KeetaNet.Anchor.Crypto;
 /// </summary>
 public sealed class SharableCertificateAttributes : WasmObject
 {
-	private SharableCertificateAttributes(WasmRuntime runtime, int handle)
+	internal SharableCertificateAttributes(WasmRuntime runtime, int handle)
 		: base(runtime, handle)
 	{
 	}
 
-	/// <summary>
-	/// Prove or copy each attribute in <paramref name="names"/> from
-	/// <paramref name="certificate"/> using the <paramref name="subject"/> account,
-	/// bridging the trust chain with <paramref name="intermediates"/>, and seal the
-	/// result. Grant a recipient before exporting.
-	/// </summary>
-	public static SharableCertificateAttributes FromCertificate(
-		WasmRuntime runtime,
-		KycCertificate certificate,
-		Account subject,
-		IEnumerable<Certificate>? intermediates = null,
-		IEnumerable<string>? names = null)
-	{
-		int[] bridges = Handles.Of(intermediates);
-		string[] labels = (names ?? Enumerable.Empty<string>()).ToArray();
-		int handle = runtime.SharableFromCertificate(certificate.Handle, subject.Handle, bridges, labels);
-
-		return new(runtime, handle);
-	}
-
-	/// <summary>Open a bundle from encoded container bytes, resolved with <paramref name="principals"/>.</summary>
-	public static SharableCertificateAttributes FromEncoded(
-		WasmRuntime runtime,
-		byte[] data,
-		IEnumerable<Account>? principals = null)
-	{
-		int[] handles = Handles.Of(principals);
-		int handle = runtime.SharableFromEncoded(data, handles);
-
-		return new(runtime, handle);
-	}
-
-	/// <summary>Open a bundle from a PEM envelope, resolved with <paramref name="principals"/>.</summary>
-	public static SharableCertificateAttributes FromPem(
-		WasmRuntime runtime,
-		string pem,
-		IEnumerable<Account>? principals = null)
-	{
-		int[] handles = Handles.Of(principals);
-		int handle = runtime.SharableFromPem(pem, handles);
-
-		return new(runtime, handle);
-	}
-
 	/// <summary>Grant <paramref name="accounts"/> access, invalidating the encoded form.</summary>
 	public void GrantAccess(IEnumerable<Account> accounts)
 	{
@@ -68,7 +24,7 @@ public void GrantAccess(IEnumerable<Account> accounts)
 	public void RevokeAccess(byte[] publicKey) => Runtime.SharableRevokeAccess(Handle, publicKey);
 
 	/// <summary>The type-prefixed public keys of the accounts that can open the bundle.</summary>
-	public IReadOnlyList<byte[]> Principals()
+	public IReadOnlyList<byte[]> GetPrincipals()
 	{
 		byte[] payload = Runtime.SharablePrincipals(Handle);
 		return PrincipalKeys.Decode(payload);
@@ -81,37 +37,37 @@ public IReadOnlyList<byte[]> Principals()
 	public string ToPem() => Runtime.SharableToPem(Handle);
 
 	/// <summary>The embedded leaf certificate, as an independently owned object.</summary>
-	public KycCertificate LeafCertificate()
+	public KycCertificate GetCertificate()
 	{
 		int handle = Runtime.SharableCertificate(Handle);
 		return KycCertificate.Adopt(Runtime, handle);
 	}
 
 	/// <summary>The embedded intermediate certificate chain, as owned objects.</summary>
-	public IReadOnlyList<Certificate> Intermediates()
+	public IReadOnlyList<Certificate> GetIntermediates()
 	{
 		byte[] payload = Runtime.SharableIntermediates(Handle);
 		string[] pems = JsonSerializer.Deserialize<string[]>(payload) ?? Array.Empty<string>();
 
-		return pems.Select(pem => Certificate.Parse(Runtime, pem)).ToList();
+		return pems.Select(Runtime.Certificates.Parse).ToList();
 	}
 
 	/// <summary>The names of the disclosed attributes.</summary>
-	public IReadOnlyList<string> AttributeNames()
+	public IReadOnlyList<string> GetAttributeNames()
 	{
 		byte[] payload = Runtime.SharableAttributeNames(Handle);
 		return JsonSerializer.Deserialize<string[]>(payload) ?? Array.Empty<string>();
 	}
 
 	/// <summary>The validated raw disclosed value for <paramref name="name"/>, or <c>null</c> when not disclosed.</summary>
-	public byte[]? AttributeBuffer(string name)
+	public byte[]? GetAttributeBuffer(string name)
 	{
 		byte[] value = Runtime.SharableAttributeBuffer(Handle, name);
 		return NullWhenEmpty(value);
 	}
 
 	/// <summary>The schema-decoded semantic value for <paramref name="name"/>, or <c>null</c> when not disclosed.</summary>
-	public byte[]? AttributeValue(string name)
+	public byte[]? GetAttributeValue(string name)
 	{
 		byte[] value = Runtime.SharableAttributeValue(Handle, name);
 		return NullWhenEmpty(value);
diff --git a/src/KeetaNet.Anchor/Crypto/SharableCertificateAttributesFactory.cs b/src/KeetaNet.Anchor/Crypto/SharableCertificateAttributesFactory.cs
new file mode 100644
index 0000000..c656d1b
--- /dev/null
+++ b/src/KeetaNet.Anchor/Crypto/SharableCertificateAttributesFactory.cs
@@ -0,0 +1,49 @@
+namespace KeetaNet.Anchor.Crypto;
+
+/// <summary>
+/// Creates <see cref="SharableCertificateAttributes"/> bundles owned by one
+/// runtime. Reached through <see cref="WasmRuntime.Sharables"/>.
+/// </summary>
+public sealed class SharableCertificateAttributesFactory
+{
+	private readonly WasmRuntime _runtime;
+
+	internal SharableCertificateAttributesFactory(WasmRuntime runtime) => _runtime = runtime;
+
+	/// <summary>
+	/// Prove or copy each attribute in <paramref name="names"/> from
+	/// <paramref name="certificate"/> using the <paramref name="subject"/> account,
+	/// bridging the trust chain with <paramref name="intermediates"/>, and seal the
+	/// result. Grant a recipient before exporting.
+	/// </summary>
+	public SharableCertificateAttributes FromCertificate(
+		KycCertificate certificate,
+		Account subject,
+		IEnumerable<Certificate>? intermediates = null,
+		IEnumerable<string>? names = null)
+	{
+		int[] bridges = Handles.Of(intermediates);
+		string[] labels = (names ?? Enumerable.Empty<string>()).ToArray();
+		int handle = _runtime.SharableFromCertificate(certificate.Handle, subject.Handle, bridges, labels);
+
+		return new(_runtime, handle);
+	}
+
+	/// <summary>Open a bundle from encoded container bytes, resolved with <paramref name="principals"/>.</summary>
+	public SharableCertificateAttributes FromEncoded(byte[] data, IEnumerable<Account>? principals = null)
+	{
+		int[] handles = Handles.Of(principals);
+		int handle = _runtime.SharableFromEncoded(data, handles);
+
+		return new(_runtime, handle);
+	}
+
+	/// <summary>Open a bundle from a PEM envelope, resolved with <paramref name="principals"/>.</summary>
+	public SharableCertificateAttributes FromPem(string pem, IEnumerable<Account>? principals = null)
+	{
+		int[] handles = Handles.Of(principals);
+		int handle = _runtime.SharableFromPem(pem, handles);
+
+		return new(_runtime, handle);
+	}
+}
diff --git a/src/KeetaNet.Anchor/Interop/WasmRuntime.Surface.cs b/src/KeetaNet.Anchor/Interop/WasmRuntime.Surface.cs
new file mode 100644
index 0000000..71252ca
--- /dev/null
+++ b/src/KeetaNet.Anchor/Interop/WasmRuntime.Surface.cs
@@ -0,0 +1,42 @@
+using KeetaNet.Anchor.Crypto;
+
+namespace KeetaNet.Anchor;
+
+/// <summary>
+/// The runtime's public creation surface: domain factories for handle-backed
+/// crypto objects, and creation methods for the networked clients. Everything
+/// created here is owned by this runtime and must be disposed before it.
+/// </summary>
+public sealed partial class WasmRuntime
+{
+	/// <summary>Creates accounts: signers from key material, read-only accounts from addresses or public keys.</summary>
+	public AccountFactory Accounts { get; }
+
+	/// <summary>Parses base X.509 certificates: provider CAs, trust roots, intermediates.</summary>
+	public CertificateFactory Certificates { get; }
+
+	/// <summary>Parses and issues KYC leaf certificates.</summary>
+	public KycCertificateFactory KycCertificates { get; }
+
+	/// <summary>Creates hybrid-encrypted, optionally signed containers.</summary>
+	public EncryptedContainerFactory Containers { get; }
+
+	/// <summary>Creates and opens selectively disclosed attribute bundles.</summary>
+	public SharableCertificateAttributesFactory Sharables { get; }
+
+	/// <summary>
+	/// Create a KYC anchor client signed by <paramref name="account"/>, resolving
+	/// providers from <paramref name="root"/>'s on-chain service metadata read via
+	/// the node API at <paramref name="nodeUrl"/>.
+	/// </summary>
+	public KycClient CreateKycClient(string nodeUrl, string root, Account account) =>
+		KycClient.WithAccount(this, nodeUrl, root, account);
+
+	/// <summary>
+	/// Create an asset-movement anchor client signed by <paramref name="account"/>,
+	/// resolving providers from <paramref name="root"/>'s on-chain service metadata
+	/// read via the node API at <paramref name="nodeUrl"/>.
+	/// </summary>
+	public AssetMovementClient CreateAssetMovementClient(string nodeUrl, string root, Account account) =>
+		AssetMovementClient.WithAccount(this, nodeUrl, root, account);
+}
diff --git a/src/KeetaNet.Anchor/Interop/WasmRuntime.cs b/src/KeetaNet.Anchor/Interop/WasmRuntime.cs
index e65a1eb..231b24a 100644
--- a/src/KeetaNet.Anchor/Interop/WasmRuntime.cs
+++ b/src/KeetaNet.Anchor/Interop/WasmRuntime.cs
@@ -54,6 +54,12 @@ public sealed partial class WasmRuntime : IDisposable
 
 	private WasmRuntime(Func<Engine, Module> loadModule)
 	{
+		Accounts = new Crypto.AccountFactory(this);
+		Certificates = new Crypto.CertificateFactory(this);
+		KycCertificates = new Crypto.KycCertificateFactory(this);
+		Containers = new Crypto.EncryptedContainerFactory(this);
+		Sharables = new Crypto.SharableCertificateAttributesFactory(this);
+
 		_dispatcher = new WasmDispatcher();
 		try
 		{
diff --git a/src/KeetaNet.Anchor/Services/AssetMovement/AssetMovementClient.cs b/src/KeetaNet.Anchor/Services/AssetMovement/AssetMovementClient.cs
index 562230e..f0743ba 100644
--- a/src/KeetaNet.Anchor/Services/AssetMovement/AssetMovementClient.cs
+++ b/src/KeetaNet.Anchor/Services/AssetMovement/AssetMovementClient.cs
@@ -17,32 +17,33 @@ private AssetMovementClient(WasmRuntime runtime, int handle)
 	}
 
 	/// <summary>
-	/// Build a client signed by an existing <paramref name="account"/> from the
-	/// <c>crypto</c> surface, resolving providers from <paramref name="root"/>'s
-	/// on-chain service metadata read via the node API at <paramref name="nodeUrl"/>.
+	/// Build a client signed by an existing <paramref name="account"/>, resolving
+	/// providers from <paramref name="root"/>'s on-chain service metadata read via
+	/// the node API at <paramref name="nodeUrl"/>. Reached through
+	/// <see cref="WasmRuntime.CreateAssetMovementClient"/>.
 	/// </summary>
-	public static AssetMovementClient WithAccount(WasmRuntime runtime, string nodeUrl, string root, Crypto.Account account)
+	internal static AssetMovementClient WithAccount(WasmRuntime runtime, string nodeUrl, string root, Crypto.Account account)
 	{
 		int handle = runtime.AssetWithAccount(nodeUrl, root, account.Handle);
 		return new AssetMovementClient(runtime, handle);
 	}
 
 	/// <summary>Every advertised provider.</summary>
-	public async Task<IReadOnlyList<AssetProvider>> ProvidersAsync(CancellationToken cancellationToken = default)
+	public async Task<IReadOnlyList<AssetProvider>> GetProvidersAsync(CancellationToken cancellationToken = default)
 	{
 		byte[] payload = await Runtime.AssetProviders(Handle, cancellationToken).ConfigureAwait(false);
 		return KeetaJson.ReadList<AssetProvider>(payload);
 	}
 
 	/// <summary>The provider with <paramref name="id"/>, or null when none advertises it.</summary>
-	public async Task<AssetProvider?> ProviderByIdAsync(string id, CancellationToken cancellationToken = default)
+	public async Task<AssetProvider?> GetProviderByIdAsync(string id, CancellationToken cancellationToken = default)
 	{
 		byte[] payload = await Runtime.AssetProviderById(Handle, id, cancellationToken).ConfigureAwait(false);
 		return ParseOptionalProvider(payload);
 	}
 
 	/// <summary>The provider signed by <paramref name="account"/>, or null when absent.</summary>
-	public async Task<AssetProvider?> ProviderByAccountAsync(string account, CancellationToken cancellationToken = default)
+	public async Task<AssetProvider?> GetProviderByAccountAsync(string account, CancellationToken cancellationToken = default)
 	{
 		byte[] payload = await Runtime.AssetProviderByAccount(Handle, account, cancellationToken).ConfigureAwait(false);
 		return ParseOptionalProvider(payload);
@@ -83,7 +84,7 @@ public async Task<IReadOnlyList<AssetProvider>> GetProvidersForTransferAsync(
 		string id,
 		CancellationToken cancellationToken = default)
 	{
-		AssetProvider? provider = await ProviderByIdAsync(id, cancellationToken).ConfigureAwait(false);
+		AssetProvider? provider = await GetProviderByIdAsync(id, cancellationToken).ConfigureAwait(false);
 		return provider?.Legal;
 	}
 
@@ -143,14 +144,14 @@ public Task<AssetTransferStatus> ExecuteTransferAsync(
 		ReadOperationAsync<AssetTransferStatus>(Runtime.AssetExecuteTransfer, provider, request, cancellationToken);
 
 	/// <summary>Read the status of transfer <paramref name="id"/>.</summary>
-	public Task<AssetTransferStatus> TransferStatusAsync(
+	public Task<AssetTransferStatus> GetTransferStatusAsync(
 		AssetProvider provider,
 		string id,
 		CancellationToken cancellationToken = default) =>
 		ReadOperationForIdAsync<AssetTransferStatus>(Runtime.AssetTransferStatus, provider, id, cancellationToken);
 
 	/// <summary>Read whether the signer's account is ready to use this provider.</summary>
-	public async Task<AssetAccountStatus> AccountStatusAsync(
+	public async Task<AssetAccountStatus> GetAccountStatusAsync(
 		AssetProvider provider,
 		CancellationToken cancellationToken = default)
 	{
@@ -161,28 +162,28 @@ public async Task<AssetAccountStatus> AccountStatusAsync(
 	}
 
 	/// <summary>Open a persistent-forwarding template session.</summary>
-	public Task<AssetTemplateSession> InitiateForwardingTemplateAsync(
+	public Task<AssetTemplateSession> InitiatePersistentForwardingTemplateAsync(
 		AssetProvider provider,
 		AssetInitiateTemplateRequest request,
 		CancellationToken cancellationToken = default) =>
 		ReadOperationAsync<AssetTemplateSession>(Runtime.AssetInitiateForwardingTemplate, provider, request, cancellationToken);
 
 	/// <summary>Create a persistent-forwarding template.</summary>
-	public Task<AssetForwardingTemplate> CreateForwardingTemplateAsync(
+	public Task<AssetForwardingTemplate> CreatePersistentForwardingTemplateAsync(
 		AssetProvider provider,
 		AssetCreateTemplateRequest request,
 		CancellationToken cancellationToken = default) =>
 		ReadOperationAsync<AssetForwardingTemplate>(Runtime.AssetCreateForwardingTemplate, provider, request, cancellationToken);
 
 	/// <summary>List persistent-forwarding templates.</summary>
-	public Task<AssetTemplatePage> ListForwardingTemplatesAsync(
+	public Task<AssetTemplatePage> ListForwardingAddressTemplatesAsync(
 		AssetProvider provider,
 		AssetListTemplatesRequest request,
 		CancellationToken cancellationToken = default) =>
 		ReadOperationAsync<AssetTemplatePage>(Runtime.AssetListForwardingTemplates, provider, request, cancellationToken);
 
 	/// <summary>Create a persistent-forwarding address, returning its (obfuscated) details.</summary>
-	public Task<JsonElement> CreateForwardingAddressAsync(
+	public Task<JsonElement> CreatePersistentForwardingAddressAsync(
 		AssetProvider provider,
 		AssetCreateAddressRequest request,
 		CancellationToken cancellationToken = default) =>
@@ -196,14 +197,14 @@ public Task<AssetAddressPage> ListForwardingAddressesAsync(
 		ReadOperationAsync<AssetAddressPage>(Runtime.AssetListForwardingAddresses, provider, request, cancellationToken);
 
 	/// <summary>Deactivate a persistent-forwarding template by id.</summary>
-	public Task DeactivateForwardingTemplateAsync(
+	public Task DeactivatePersistentForwardingTemplateAsync(
 		AssetProvider provider,
 		string id,
 		CancellationToken cancellationToken = default) =>
 		RunOperationForIdAsync(Runtime.AssetDeactivateForwardingTemplate, provider, id, cancellationToken);
 
 	/// <summary>Deactivate a persistent-forwarding address by id.</summary>
-	public Task DeactivateForwardingAddressAsync(
+	public Task DeactivatePersistentForwardingAddressAsync(
 		AssetProvider provider,
 		string id,
 		CancellationToken cancellationToken = default) =>
@@ -219,9 +220,9 @@ public Task<AssetTransactionPage> ListTransactionsAsync(
 	/// <summary>
 	/// Share KYC attributes with the provider, returning the outcome verbatim.
 	/// A pending outcome carries the promise URL the caller must poll; use
-	/// <see cref="ShareKycAndWaitAsync"/> to poll it automatically.
+	/// <see cref="ShareKycAttributesAndWaitAsync"/> to poll it automatically.
 	/// </summary>
-	public Task<AssetShareKycOutcome> ShareKycAsync(
+	public Task<AssetShareKycOutcome> ShareKycAttributesAsync(
 		AssetProvider provider,
 		AssetShareKycRequest request,
 		CancellationToken cancellationToken = default) =>
@@ -231,7 +232,7 @@ public Task<AssetShareKycOutcome> ShareKycAsync(
 	/// Share KYC attributes and, when the outcome is pending with a promise URL,
 	/// poll that URL inside the core until it resolves.
 	/// </summary>
-	public async Task<AssetShareKycOutcome> ShareKycAndWaitAsync(
+	public async Task<AssetShareKycOutcome> ShareKycAttributesAndWaitAsync(
 		AssetProvider provider,
 		AssetShareKycRequest request,
 		TimeSpan? pollInterval = null,
diff --git a/src/KeetaNet.Anchor/Services/AssetMovement/AssetTransfer.cs b/src/KeetaNet.Anchor/Services/AssetMovement/AssetTransfer.cs
index 392dc28..6a31dc0 100644
--- a/src/KeetaNet.Anchor/Services/AssetMovement/AssetTransfer.cs
+++ b/src/KeetaNet.Anchor/Services/AssetMovement/AssetTransfer.cs
@@ -78,11 +78,11 @@ internal AssetTransfer(
 	public IReadOnlyList<JsonElement> InstructionChoices { get; }
 
 	/// <summary>Read this transfer's current status.</summary>
-	public Task<AssetTransferStatus> GetStatusAsync(CancellationToken cancellationToken = default) =>
-		_client.TransferStatusAsync(_provider, Id, cancellationToken);
+	public Task<AssetTransferStatus> GetTransferStatusAsync(CancellationToken cancellationToken = default) =>
+		_client.GetTransferStatusAsync(_provider, Id, cancellationToken);
 
 	/// <summary>Execute a fiat pull <paramref name="instruction"/> for this transfer.</summary>
-	public Task<AssetTransferStatus> ExecuteAsync(
+	public Task<AssetTransferStatus> ExecuteTransferAsync(
 		AssetPullInstruction instruction,
 		CancellationToken cancellationToken = default)
 	{
diff --git a/src/KeetaNet.Anchor/Services/Kyc/KycClient.cs b/src/KeetaNet.Anchor/Services/Kyc/KycClient.cs
index a2688a9..b2b4953 100644
--- a/src/KeetaNet.Anchor/Services/Kyc/KycClient.cs
+++ b/src/KeetaNet.Anchor/Services/Kyc/KycClient.cs
@@ -17,18 +17,19 @@ private KycClient(WasmRuntime runtime, int handle)
 	}
 
 	/// <summary>
-	/// Build a client signed by an existing <paramref name="account"/> from the
-	/// <c>crypto</c> surface, resolving providers from <paramref name="root"/>'s
-	/// on-chain service metadata read via the node API at <paramref name="nodeUrl"/>.
+	/// Build a client signed by an existing <paramref name="account"/>, resolving
+	/// providers from <paramref name="root"/>'s on-chain service metadata read via
+	/// the node API at <paramref name="nodeUrl"/>. Reached through
+	/// <see cref="WasmRuntime.CreateKycClient"/>.
 	/// </summary>
-	public static KycClient WithAccount(WasmRuntime runtime, string nodeUrl, string root, Crypto.Account account)
+	internal static KycClient WithAccount(WasmRuntime runtime, string nodeUrl, string root, Crypto.Account account)
 	{
 		int handle = runtime.KycWithAccount(nodeUrl, root, account.Handle);
 		return new KycClient(runtime, handle);
 	}
 
 	/// <summary>Every provider that serves all <paramref name="countries"/> (ISO codes).</summary>
-	public async Task<IReadOnlyList<KycProvider>> ProvidersAsync(
+	public async Task<IReadOnlyList<KycProvider>> GetProvidersAsync(
 		IEnumerable<string> countries,
 		CancellationToken cancellationToken = default)
 	{
@@ -39,11 +40,11 @@ public async Task<IReadOnlyList<KycProvider>> ProvidersAsync(
 	}
 
 	/// <summary>
-	/// Begin a verification with <paramref name="provider"/> for
+	/// Start a verification with <paramref name="provider"/> for
 	/// <paramref name="countries"/>, optionally redirecting the user to
 	/// <paramref name="redirect"/> when the flow ends.
 	/// </summary>
-	public async Task<VerificationOutcome> CreateVerificationAsync(
+	public async Task<VerificationOutcome> StartVerificationAsync(
 		KycProvider provider,
 		IEnumerable<string> countries,
 		string? redirect = null,
@@ -75,8 +76,8 @@ public async Task<CertificatesOutcome> GetCertificatesAsync(
 
 	/// <summary>Parse <paramref name="provider"/>'s advertised issuer CA certificate.</summary>
 	/// <remarks>Use it as a trusted root when verifying an issued <see cref="Crypto.KycCertificate"/>.</remarks>
-	public Crypto.Certificate ProviderCertificate(KycProvider provider) =>
-		Crypto.Certificate.Parse(Runtime, provider.Ca);
+	public Crypto.Certificate GetCA(KycProvider provider) =>
+		Runtime.Certificates.Parse(provider.Ca);
 
 	/// <summary>Read the status of verification <paramref name="id"/>.</summary>
 	public async Task<StatusOutcome> GetVerificationStatusAsync(
diff --git a/tests/KeetaNet.Anchor.E2eTests/AssetFlowTests.cs b/tests/KeetaNet.Anchor.E2eTests/AssetFlowTests.cs
index 0e6a043..53debd4 100644
--- a/tests/KeetaNet.Anchor.E2eTests/AssetFlowTests.cs
+++ b/tests/KeetaNet.Anchor.E2eTests/AssetFlowTests.cs
@@ -21,12 +21,12 @@ public async Task DiscoveryReadsThePublishedProvider()
 		using var session = AssetSession.Open();
 		(AssetMovementClient client, AssetAnchor anchor, CancellationToken cancellationToken) = session;
 
-		IReadOnlyList<AssetProvider> providers = await client.ProvidersAsync(cancellationToken);
+		IReadOnlyList<AssetProvider> providers = await client.GetProvidersAsync(cancellationToken);
 		AssetProvider provider = Assert.Single(providers);
 		Assert.Equal(anchor.ProviderId, provider.Id);
 		Assert.True(client.IsOperationSupported(provider, "simulateTransfer"));
 
-		AssetProvider? byAccount = await client.ProviderByAccountAsync(anchor.Signer, cancellationToken);
+		AssetProvider? byAccount = await client.GetProviderByAccountAsync(anchor.Signer, cancellationToken);
 		Assert.NotNull(byAccount);
 
 		var advertised = new AssetProviderSearch(anchor.Asset, EvmLocation, KeetaLocation);
@@ -47,7 +47,7 @@ public async Task TransfersRunEndToEndAgainstTheLiveAnchor()
 		(AssetMovementClient client, AssetAnchor anchor, CancellationToken cancellationToken) = session;
 		AssetProvider provider = await session.DiscoveredProviderAsync();
 
-		AssetAccountStatus status = await client.AccountStatusAsync(provider, cancellationToken);
+		AssetAccountStatus status = await client.GetAccountStatusAsync(provider, cancellationToken);
 		Assert.False(status.ActionRequired);
 
 		AssetSimulatedTransfer simulated = await client.SimulateTransferAsync(provider, PushTransfer(anchor, anchor.SendToAddress), cancellationToken);
@@ -63,7 +63,7 @@ public async Task TransfersRunEndToEndAgainstTheLiveAnchor()
 		await Assert.ThrowsAsync<KeetaException>(
 			() => client.InitiateTransferAsync(provider, PushTransfer(anchor, recipient: null), cancellationToken));
 
-		AssetTransferStatus completed = await transfer.GetStatusAsync(cancellationToken);
+		AssetTransferStatus completed = await transfer.GetTransferStatusAsync(cancellationToken);
 		Assert.Equal("123", completed.Transaction.GetProperty("id").GetString());
 		Assert.Equal("COMPLETED", completed.Transaction.GetProperty("status").GetString());
 
@@ -72,7 +72,7 @@ await Assert.ThrowsAsync<KeetaException>(
 		Assert.Equal("ACH_DEBIT", pullInstruction.GetProperty("type").GetString());
 
 		var instruction = new AssetPullInstruction("ACH_DEBIT", pullInstruction.GetProperty("pullFrom"));
-		AssetTransferStatus executed = await pull.ExecuteAsync(instruction, cancellationToken);
+		AssetTransferStatus executed = await pull.ExecuteTransferAsync(instruction, cancellationToken);
 		Assert.Equal("EXECUTED", executed.Transaction.GetProperty("status").GetString());
 
 		session.Shutdown();
@@ -85,12 +85,12 @@ public async Task ForwardingAndListingRunAgainstTheLiveAnchor()
 		(AssetMovementClient client, AssetAnchor anchor, CancellationToken cancellationToken) = session;
 		AssetProvider provider = await session.DiscoveredProviderAsync();
 
-		AssetTemplateSession templateSession = await client.InitiateForwardingTemplateAsync(
+		AssetTemplateSession templateSession = await client.InitiatePersistentForwardingTemplateAsync(
 			provider, new AssetInitiateTemplateRequest(anchor.Asset, EvmLocation), cancellationToken);
 		Assert.Equal("test-session-id", templateSession.Id);
 		Assert.Equal("link-sandbox-test-token", templateSession.Data.GetProperty("plaidLinkToken").GetString());
 
-		AssetForwardingTemplate template = await client.CreateForwardingTemplateAsync(
+		AssetForwardingTemplate template = await client.CreatePersistentForwardingTemplateAsync(
 			provider,
 			new AssetCreateTemplateRequest(Asset: anchor.Asset, Location: EvmLocation, Address: anchor.SendToAddress),
 			cancellationToken);
@@ -102,18 +102,18 @@ public async Task ForwardingAndListingRunAgainstTheLiveAnchor()
 			plaidPublicToken = "public-sandbox-token",
 			plaidAccountId = "account-1",
 		};
-		AssetForwardingTemplate completed = await client.CreateForwardingTemplateAsync(
+		AssetForwardingTemplate completed = await client.CreatePersistentForwardingTemplateAsync(
 			provider, new AssetCreateTemplateRequest(Id: templateSession.Id, Data: completionData), cancellationToken);
 		Assert.Equal("template-id", completed.Id);
 
-		AssetTemplatePage templates = await client.ListForwardingTemplatesAsync(
+		AssetTemplatePage templates = await client.ListForwardingAddressTemplatesAsync(
 			provider,
 			new AssetListTemplatesRequest(new[] { anchor.Asset }, new[] { EvmLocation }),
 			cancellationToken);
 		Assert.Single(templates.Templates);
 		Assert.Equal("1", templates.Total);
 
-		JsonElement created = await client.CreateForwardingAddressAsync(
+		JsonElement created = await client.CreatePersistentForwardingAddressAsync(
 			provider,
 			new AssetCreateAddressRequest(
 				EvmLocation,
@@ -125,7 +125,7 @@ public async Task ForwardingAndListingRunAgainstTheLiveAnchor()
 		Assert.Equal(anchor.SendToAddress, created.GetProperty("address").GetString());
 		Assert.Equal("10", created.GetProperty("fees").GetProperty("total").GetString());
 
-		JsonElement fromTemplate = await client.CreateForwardingAddressAsync(
+		JsonElement fromTemplate = await client.CreatePersistentForwardingAddressAsync(
 			provider,
 			new AssetCreateAddressRequest(EvmLocation, anchor.Asset, PersistentAddressTemplateId: template.Id),
 			cancellationToken);
@@ -150,11 +150,11 @@ public async Task ForwardingAndListingRunAgainstTheLiveAnchor()
 		JsonElement transaction = Assert.Single(transactions.Transactions);
 		Assert.Equal("123", transaction.GetProperty("id").GetString());
 
-		await client.DeactivateForwardingTemplateAsync(provider, template.Id, cancellationToken);
-		await client.DeactivateForwardingAddressAsync(provider, template.Id, cancellationToken);
+		await client.DeactivatePersistentForwardingTemplateAsync(provider, template.Id, cancellationToken);
+		await client.DeactivatePersistentForwardingAddressAsync(provider, template.Id, cancellationToken);
 
 		await Assert.ThrowsAsync<KeetaException>(
-			() => client.DeactivateForwardingTemplateAsync(provider, "does-not-exist", cancellationToken));
+			() => client.DeactivatePersistentForwardingTemplateAsync(provider, "does-not-exist", cancellationToken));
 
 		// An operation the provider does not advertise must surface a typed
 		// error before any request leaves the client.
@@ -175,17 +175,17 @@ public async Task ShareKycSettlesAndPollsAgainstTheLiveAnchor()
 		(AssetMovementClient client, _, CancellationToken cancellationToken) = session;
 		AssetProvider provider = await session.DiscoveredProviderAsync();
 
-		AssetShareKycOutcome settled = await client.ShareKycAsync(
+		AssetShareKycOutcome settled = await client.ShareKycAttributesAsync(
 			provider, new AssetShareKycRequest("exported-attributes"), cancellationToken);
 		Assert.False(settled.IsPending);
 
-		AssetShareKycOutcome withoutPolling = await client.ShareKycAndWaitAsync(
+		AssetShareKycOutcome withoutPolling = await client.ShareKycAttributesAndWaitAsync(
 			provider, new AssetShareKycRequest("exported-attributes"), cancellationToken: cancellationToken);
 		Assert.False(withoutPolling.IsPending);
 
 		// The promise route reports pending (202 + Retry-After) for the first
 		// two polls and settles on the third.
-		AssetShareKycOutcome polled = await client.ShareKycAndWaitAsync(
+		AssetShareKycOutcome polled = await client.ShareKycAttributesAndWaitAsync(
 			provider,
 			new AssetShareKycRequest("promise-flow"),
 			pollInterval: TimeSpan.FromMilliseconds(1),
@@ -194,7 +194,7 @@ public async Task ShareKycSettlesAndPollsAgainstTheLiveAnchor()
 		Assert.False(polled.IsPending);
 
 		await Assert.ThrowsAsync<KeetaException>(
-			() => client.ShareKycAndWaitAsync(
+			() => client.ShareKycAttributesAndWaitAsync(
 				provider,
 				new AssetShareKycRequest("promise-stall"),
 				pollInterval: TimeSpan.FromSeconds(1),
diff --git a/tests/KeetaNet.Anchor.E2eTests/AssetSession.cs b/tests/KeetaNet.Anchor.E2eTests/AssetSession.cs
index 7074f64..2d71b74 100644
--- a/tests/KeetaNet.Anchor.E2eTests/AssetSession.cs
+++ b/tests/KeetaNet.Anchor.E2eTests/AssetSession.cs
@@ -40,8 +40,8 @@ public static AssetSession Open()
 		{
 			AssetAnchor anchor = AssetAnchor.Start(harness);
 			WasmRuntime runtime = WasmRuntime.Load();
-			Account signer = Account.FromSeed(runtime, E2eSeeds.Caller, 0, E2eSeeds.Secp256k1);
-			AssetMovementClient client = AssetMovementClient.WithAccount(runtime, anchor.Api, anchor.Root, signer);
+			Account signer = runtime.Accounts.FromSeed(E2eSeeds.Caller, 0, E2eSeeds.Secp256k1);
+			AssetMovementClient client = runtime.CreateAssetMovementClient(anchor.Api, anchor.Root, signer);
 
 			return new AssetSession(harness, anchor, runtime, signer, client);
 		}
@@ -65,7 +65,7 @@ public void Deconstruct(
 	/// <summary>The single provider the running anchor publishes.</summary>
 	public async Task<AssetProvider> DiscoveredProviderAsync()
 	{
-		AssetProvider? provider = await Client.ProviderByIdAsync(Anchor.ProviderId, CancellationToken);
+		AssetProvider? provider = await Client.GetProviderByIdAsync(Anchor.ProviderId, CancellationToken);
 		Assert.NotNull(provider);
 
 		return provider!;
diff --git a/tests/KeetaNet.Anchor.E2eTests/ContainerInteropTests.cs b/tests/KeetaNet.Anchor.E2eTests/ContainerInteropTests.cs
index 4bd409d..993796d 100644
--- a/tests/KeetaNet.Anchor.E2eTests/ContainerInteropTests.cs
+++ b/tests/KeetaNet.Anchor.E2eTests/ContainerInteropTests.cs
@@ -35,16 +35,16 @@ public void CsharpDecryptsAndVerifiesTheTypescriptContainer()
 		harness.Shutdown();
 
 		using var runtime = WasmRuntime.Load();
-		using Account principal = Account.FromSeed(runtime, E2eSeeds.Subject, 0, E2eSeeds.Secp256k1);
-		using Account tsSigner = Account.FromSeed(runtime, E2eSeeds.Issuer, 0, E2eSeeds.Secp256k1);
-		using EncryptedContainer opened = EncryptedContainer.FromEncrypted(runtime, container, new[] { principal });
+		using Account principal = runtime.Accounts.FromSeed(E2eSeeds.Subject, 0, E2eSeeds.Secp256k1);
+		using Account tsSigner = runtime.Accounts.FromSeed(E2eSeeds.Issuer, 0, E2eSeeds.Secp256k1);
+		using EncryptedContainer opened = runtime.Containers.FromEncrypted(container, new[] { principal });
 
-		Assert.Equal(Payload, opened.Plaintext());
+		Assert.Equal(Payload, opened.GetPlaintext());
 		Assert.True(opened.IsEncrypted);
 		Assert.True(opened.IsSigned);
 		Assert.True(opened.VerifySignature());
 
-		byte[]? recoveredSigner = opened.SigningAccount();
+		byte[]? recoveredSigner = opened.GetSigningAccount();
 		Assert.NotNull(recoveredSigner);
 		Assert.Equal(tsSigner.PublicKey, Convert.ToHexString(recoveredSigner!), ignoreCase: true);
 	}
@@ -53,10 +53,10 @@ public void CsharpDecryptsAndVerifiesTheTypescriptContainer()
 	public void TypescriptDecryptsAndVerifiesTheCsharpContainer()
 	{
 		using var runtime = WasmRuntime.Load();
-		using Account principal = Account.FromSeed(runtime, E2eSeeds.Subject, 0, E2eSeeds.Secp256k1);
-		using Account signer = Account.FromSeed(runtime, E2eSeeds.Issuer, 0, E2eSeeds.Secp256k1);
-		using EncryptedContainer container = EncryptedContainer.FromPlaintext(runtime, Payload, new[] { principal }, locked: false, signer: signer);
-		byte[] encoded = container.Encoded();
+		using Account principal = runtime.Accounts.FromSeed(E2eSeeds.Subject, 0, E2eSeeds.Secp256k1);
+		using Account signer = runtime.Accounts.FromSeed(E2eSeeds.Issuer, 0, E2eSeeds.Secp256k1);
+		using EncryptedContainer container = runtime.Containers.FromPlaintext(Payload, new[] { principal }, locked: false, signer: signer);
+		byte[] encoded = container.GetEncoded();
 
 		using var harness = NodeHarness.Spawn("container");
 		var decodeArguments = new JsonObject
diff --git a/tests/KeetaNet.Anchor.E2eTests/KycFlowTests.cs b/tests/KeetaNet.Anchor.E2eTests/KycFlowTests.cs
index c7388c2..d3f97a9 100644
--- a/tests/KeetaNet.Anchor.E2eTests/KycFlowTests.cs
+++ b/tests/KeetaNet.Anchor.E2eTests/KycFlowTests.cs
@@ -23,17 +23,17 @@ public async Task VerificationPathRunsAgainstTheLiveAnchor(string algorithm)
 		KycAnchor anchor = KycAnchor.Start(harness);
 
 		using var runtime = WasmRuntime.Load();
-		using Account signer = Account.FromSeed(runtime, E2eSeeds.Caller, 0, algorithm);
-		using KycClient client = KycClient.WithAccount(runtime, anchor.Api, anchor.Root, signer);
+		using Account signer = runtime.Accounts.FromSeed(E2eSeeds.Caller, 0, algorithm);
+		using KycClient client = runtime.CreateKycClient(anchor.Api, anchor.Root, signer);
 
-		IReadOnlyList<KycProvider> providers = await client.ProvidersAsync(Countries, cancellationToken);
+		IReadOnlyList<KycProvider> providers = await client.GetProvidersAsync(Countries, cancellationToken);
 		KycProvider provider = Assert.Single(providers);
 		Assert.Equal(anchor.ProviderId, provider.Id);
 
-		using CryptoCertificate ca = client.ProviderCertificate(provider);
+		using CryptoCertificate ca = client.GetCA(provider);
 		Assert.NotEmpty(ca.SubjectPublicKey);
 
-		VerificationOutcome created = await client.CreateVerificationAsync(provider, Countries, cancellationToken: cancellationToken);
+		VerificationOutcome created = await client.StartVerificationAsync(provider, Countries, cancellationToken: cancellationToken);
 		Assert.NotNull(created.Ready);
 		Verification verification = created.Ready!;
 		Assert.NotEmpty(verification.Id);
@@ -42,7 +42,7 @@ public async Task VerificationPathRunsAgainstTheLiveAnchor(string algorithm)
 
 		// A redirect URL rides the signed create body; the server must accept
 		// the extra field and still assign a verification.
-		VerificationOutcome redirected = await client.CreateVerificationAsync(provider, Countries, "https://example.test/done", cancellationToken);
+		VerificationOutcome redirected = await client.StartVerificationAsync(provider, Countries, "https://example.test/done", cancellationToken);
 		Assert.NotNull(redirected.Ready);
 		Assert.NotEmpty(redirected.Ready!.Id);
 
diff --git a/tests/KeetaNet.Anchor.E2eTests/KycInteropTests.cs b/tests/KeetaNet.Anchor.E2eTests/KycInteropTests.cs
index f2907ad..434f640 100644
--- a/tests/KeetaNet.Anchor.E2eTests/KycInteropTests.cs
+++ b/tests/KeetaNet.Anchor.E2eTests/KycInteropTests.cs
@@ -24,18 +24,18 @@ public void CsharpReadsAndProvesTheTypescriptIssuedLeaf()
 		IssuedLeaf issued = IssuedLeaf.Issue(harness);
 
 		using var runtime = WasmRuntime.Load();
-		using Account subject = Account.FromSeed(runtime, E2eSeeds.Subject, 0, E2eSeeds.Secp256k1);
-		using KycCertificate leaf = KycCertificate.Parse(runtime, issued.Pem);
+		using Account subject = runtime.Accounts.FromSeed(E2eSeeds.Subject, 0, E2eSeeds.Secp256k1);
+		using KycCertificate leaf = runtime.KycCertificates.Parse(issued.Pem);
 
 		foreach (AttributeCase attribute in cases)
 		{
-			byte[] decoded = leaf.DecryptAttribute(attribute.Name, subject);
+			byte[] decoded = leaf.GetAttributeBuffer(attribute.Name, subject);
 			IssueAttributes.AssertMatches(attribute, decoded);
 		}
 
 		// A C# proof must validate on both sides, and a TypeScript proof must
 		// validate through the C# reader.
-		AttributeProof localProof = leaf.Prove(ProvenAttribute, subject);
+		AttributeProof localProof = leaf.GetProof(ProvenAttribute, subject);
 		Assert.True(leaf.ValidateProof(ProvenAttribute, subject, localProof));
 		Assert.True(ValidateThroughHarness(harness, issued.Pem, localProof));
 
@@ -54,8 +54,8 @@ public void CsharpVerifiesTheTypescriptIssuedChain()
 		harness.Shutdown();
 
 		using var runtime = WasmRuntime.Load();
-		using KycCertificate leaf = KycCertificate.Parse(runtime, issued.Pem);
-		using CryptoCertificate ca = CryptoCertificate.Parse(runtime, issued.CaPem);
+		using KycCertificate leaf = runtime.KycCertificates.Parse(issued.Pem);
+		using CryptoCertificate ca = runtime.Certificates.Parse(issued.CaPem);
 
 		Assert.True(
 			leaf.Verify(new[] { ca }, Array.Empty<CryptoCertificate>(), DateTimeOffset.UtcNow),
@@ -68,10 +68,10 @@ public void TypescriptReadsAndValidatesTheCsharpIssuedLeaf()
 		IReadOnlyList<AttributeCase> cases = IssueAttributes.Cases();
 
 		using var runtime = WasmRuntime.Load();
-		using Account subject = Account.FromSeed(runtime, E2eSeeds.Subject, 0, E2eSeeds.Secp256k1);
-		using Account issuer = Account.FromSeed(runtime, E2eSeeds.Issuer, 0, E2eSeeds.Secp256k1);
+		using Account subject = runtime.Accounts.FromSeed(E2eSeeds.Subject, 0, E2eSeeds.Secp256k1);
+		using Account issuer = runtime.Accounts.FromSeed(E2eSeeds.Issuer, 0, E2eSeeds.Secp256k1);
 		using KycCertificate leaf = LocalLeaf.Issue(runtime, subject, issuer, cases);
-		string leafPem = leaf.Pem();
+		string leafPem = leaf.ToPem();
 
 		using var harness = NodeHarness.Spawn("kyc");
 		JsonElement attributes = DecodeThroughHarness(harness, leafPem, cases);
@@ -82,7 +82,7 @@ public void TypescriptReadsAndValidatesTheCsharpIssuedLeaf()
 			IssueAttributes.AssertJsonEqual(attribute.Name, attribute.Expected, actual);
 		}
 
-		AttributeProof proof = leaf.Prove(ProvenAttribute, subject);
+		AttributeProof proof = leaf.GetProof(ProvenAttribute, subject);
 		Assert.True(
 			ValidateThroughHarness(harness, leafPem, proof),
 			"the reference must validate a C# proof over a C#-issued leaf");
diff --git a/tests/KeetaNet.Anchor.E2eTests/Leaves.cs b/tests/KeetaNet.Anchor.E2eTests/Leaves.cs
index 89ab300..76f090e 100644
--- a/tests/KeetaNet.Anchor.E2eTests/Leaves.cs
+++ b/tests/KeetaNet.Anchor.E2eTests/Leaves.cs
@@ -37,7 +37,7 @@ public static KycCertificate Issue(
 		Account issuer,
 		IReadOnlyList<AttributeCase> cases)
 	{
-		KycCertificateBuilder builder = KycCertificate.Builder(runtime)
+		KycCertificateBuilder builder = runtime.KycCertificates.Builder()
 			.Subject(subject)
 			.Issuer(issuer)
 			.SubjectName("Subject")
@@ -50,6 +50,6 @@ public static KycCertificate Issue(
 			builder.SetAttribute(attribute.Name, attribute.Sensitive, attribute.Semantic);
 		}
 
-		return builder.Issue();
+		return builder.Build();
 	}
 }
diff --git a/tests/KeetaNet.Anchor.E2eTests/SharableInteropTests.cs b/tests/KeetaNet.Anchor.E2eTests/SharableInteropTests.cs
index dda2d97..18258c0 100644
--- a/tests/KeetaNet.Anchor.E2eTests/SharableInteropTests.cs
+++ b/tests/KeetaNet.Anchor.E2eTests/SharableInteropTests.cs
@@ -37,13 +37,13 @@ public void CsharpOpensTheTypescriptBuiltBundle(string algorithm)
 		harness.Shutdown();
 
 		using var runtime = WasmRuntime.Load();
-		using Account recipient = Account.FromSeed(runtime, E2eSeeds.Recipient, 0, algorithm);
-		using SharableCertificateAttributes opened = SharableCertificateAttributes.FromPem(runtime, pem, new[] { recipient });
+		using Account recipient = runtime.Accounts.FromSeed(E2eSeeds.Recipient, 0, algorithm);
+		using SharableCertificateAttributes opened = runtime.Sharables.FromPem(pem, new[] { recipient });
 
 		foreach (string name in Names)
 		{
 			byte[] reference = Convert.FromBase64String(referenceBuffers.GetProperty(name).GetString()!);
-			Assert.Equal(reference, opened.AttributeBuffer(name));
+			Assert.Equal(reference, opened.GetAttributeBuffer(name));
 		}
 	}
 
@@ -54,12 +54,12 @@ public void TypescriptOpensTheCsharpBuiltBundle(string algorithm)
 		IReadOnlyList<AttributeCase> cases = IssueAttributes.Cases(Names);
 
 		using var runtime = WasmRuntime.Load();
-		using Account subject = Account.FromSeed(runtime, E2eSeeds.Subject, 0, algorithm);
-		using Account issuer = Account.FromSeed(runtime, E2eSeeds.Issuer, 0, algorithm);
-		using Account recipient = Account.FromSeed(runtime, E2eSeeds.Recipient, 0, algorithm);
+		using Account subject = runtime.Accounts.FromSeed(E2eSeeds.Subject, 0, algorithm);
+		using Account issuer = runtime.Accounts.FromSeed(E2eSeeds.Issuer, 0, algorithm);
+		using Account recipient = runtime.Accounts.FromSeed(E2eSeeds.Recipient, 0, algorithm);
 
 		using KycCertificate leaf = LocalLeaf.Issue(runtime, subject, issuer, cases);
-		using SharableCertificateAttributes bundle = SharableCertificateAttributes.FromCertificate(runtime, leaf, subject, names: Names);
+		using SharableCertificateAttributes bundle = runtime.Sharables.FromCertificate(leaf, subject, names: Names);
 		bundle.GrantAccess(new[] { recipient });
 
 		using var harness = NodeHarness.Spawn("sharable");
@@ -78,7 +78,7 @@ public void TypescriptOpensTheCsharpBuiltBundle(string algorithm)
 		foreach (string name in Names)
 		{
 			byte[] reference = Convert.FromBase64String(referenceBuffers.GetProperty(name).GetString()!);
-			Assert.Equal(bundle.AttributeBuffer(name), reference);
+			Assert.Equal(bundle.GetAttributeBuffer(name), reference);
 		}
 	}
 }
diff --git a/tests/KeetaNet.Anchor.Tests/ConcurrencyTests.cs b/tests/KeetaNet.Anchor.Tests/ConcurrencyTests.cs
index 8cfd738..bfdb6e4 100644
--- a/tests/KeetaNet.Anchor.Tests/ConcurrencyTests.cs
+++ b/tests/KeetaNet.Anchor.Tests/ConcurrencyTests.cs
@@ -21,7 +21,7 @@ public sealed class ConcurrencyTests
 	public async Task ParallelSignAndVerifyFromThreadPoolThreadsStayConsistent()
 	{
 		using var runtime = WasmRuntime.Load();
-		using Account account = Account.FromSeed(runtime, TestSeeds.Subject, 0, "ed25519");
+		using Account account = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, "ed25519");
 		string expectedAddress = account.Address;
 
 		Task<bool>[] work = Enumerable.Range(0, 32)
@@ -59,7 +59,7 @@ public async Task ParallelAccountLifecyclesYieldIndependentResults()
 
 	private static string DeriveAddress(WasmRuntime runtime, uint index)
 	{
-		using Account account = Account.FromSeed(runtime, TestSeeds.Subject, index, "ed25519");
+		using Account account = runtime.Accounts.FromSeed(TestSeeds.Subject, index, "ed25519");
 		return account.Address;
 	}
 
@@ -67,14 +67,14 @@ private static string DeriveAddress(WasmRuntime runtime, uint index)
 	public async Task PreCanceledTokenCancelsWithoutDispatching()
 	{
 		using var runtime = WasmRuntime.Load();
-		using Account account = Account.FromSeed(runtime, TestSeeds.Subject, 0, "ed25519");
-		using KycClient client = KycClient.WithAccount(runtime, "http://127.0.0.1:1", account.Address, account);
+		using Account account = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, "ed25519");
+		using KycClient client = runtime.CreateKycClient("http://127.0.0.1:1", account.Address, account);
 
 		using var cancellation = new CancellationTokenSource();
 		await cancellation.CancelAsync();
 
 		await Assert.ThrowsAnyAsync<OperationCanceledException>(
-			() => client.ProvidersAsync(Countries, cancellation.Token));
+			() => client.GetProvidersAsync(Countries, cancellation.Token));
 	}
 
 	[Fact]
@@ -87,12 +87,12 @@ public async Task CancellationDuringHostHttpSurfacesAsCanceled()
 		int port = ((IPEndPoint)listener.LocalEndpoint).Port;
 
 		using var runtime = WasmRuntime.Load();
-		using Account account = Account.FromSeed(runtime, TestSeeds.Subject, 0, "ed25519");
-		using KycClient client = KycClient.WithAccount(runtime, $"http://127.0.0.1:{port}", account.Address, account);
+		using Account account = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, "ed25519");
+		using KycClient client = runtime.CreateKycClient($"http://127.0.0.1:{port}", account.Address, account);
 
 		using var cancellation = new CancellationTokenSource(TimeSpan.FromMilliseconds(250));
 
 		await Assert.ThrowsAnyAsync<OperationCanceledException>(
-			() => client.ProvidersAsync(Countries, cancellation.Token));
+			() => client.GetProvidersAsync(Countries, cancellation.Token));
 	}
 }
diff --git a/tests/KeetaNet.Anchor.Tests/ContainerTests.cs b/tests/KeetaNet.Anchor.Tests/ContainerTests.cs
index 29cb4ea..71881a3 100644
--- a/tests/KeetaNet.Anchor.Tests/ContainerTests.cs
+++ b/tests/KeetaNet.Anchor.Tests/ContainerTests.cs
@@ -16,11 +16,11 @@ public sealed class ContainerTests
 	public void PlaintextRoundTripsThroughItsEncoding()
 	{
 		using var runtime = WasmRuntime.Load();
-		using EncryptedContainer plain = EncryptedContainer.FromPlaintext(runtime, Payload);
+		using EncryptedContainer plain = runtime.Containers.FromPlaintext(Payload);
 
-		byte[] encoded = plain.Encoded();
-		using EncryptedContainer restored = EncryptedContainer.FromEncoded(runtime, encoded);
-		Assert.Equal(Payload, restored.Plaintext());
+		byte[] encoded = plain.GetEncoded();
+		using EncryptedContainer restored = runtime.Containers.FromEncoded(encoded);
+		Assert.Equal(Payload, restored.GetPlaintext());
 		Assert.False(restored.IsEncrypted);
 	}
 
@@ -29,18 +29,18 @@ public void PlaintextRoundTripsThroughItsEncoding()
 	public void PrincipalDecryptsTheSealedPayload(string algorithm)
 	{
 		using var runtime = WasmRuntime.Load();
-		using Account owner = Account.FromSeed(runtime, TestSeeds.Subject, 0, algorithm);
+		using Account owner = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, algorithm);
 
 		byte[] encoded;
 		using (EncryptedContainer encrypted =
-			EncryptedContainer.FromPlaintext(runtime, Payload, new[] { owner }, locked: false))
+			runtime.Containers.FromPlaintext(Payload, new[] { owner }, locked: false))
 		{
 			Assert.True(encrypted.IsEncrypted);
-			encoded = encrypted.Encoded();
+			encoded = encrypted.GetEncoded();
 		}
 
-		using EncryptedContainer opened = EncryptedContainer.FromEncrypted(runtime, encoded, new[] { owner });
-		Assert.Equal(Payload, opened.Plaintext());
+		using EncryptedContainer opened = runtime.Containers.FromEncrypted(encoded, new[] { owner });
+		Assert.Equal(Payload, opened.GetPlaintext());
 		Assert.True(opened.IsEncrypted);
 	}
 
@@ -49,20 +49,20 @@ public void PrincipalDecryptsTheSealedPayload(string algorithm)
 	public void SignedContainerVerifiesAndRecoversItsSigner(string algorithm)
 	{
 		using var runtime = WasmRuntime.Load();
-		using Account signer = Account.FromSeed(runtime, TestSeeds.Issuer, 0, algorithm);
+		using Account signer = runtime.Accounts.FromSeed(TestSeeds.Issuer, 0, algorithm);
 
 		byte[] encoded;
 		using (EncryptedContainer signed =
-			EncryptedContainer.FromPlaintext(runtime, Payload, locked: false, signer: signer))
+			runtime.Containers.FromPlaintext(Payload, locked: false, signer: signer))
 		{
-			encoded = signed.Encoded();
+			encoded = signed.GetEncoded();
 		}
 
-		using EncryptedContainer restored = EncryptedContainer.FromEncoded(runtime, encoded);
+		using EncryptedContainer restored = runtime.Containers.FromEncoded(encoded);
 		Assert.True(restored.IsSigned);
 		Assert.True(restored.VerifySignature());
 
-		byte[]? recovered = restored.SigningAccount();
+		byte[]? recovered = restored.GetSigningAccount();
 		Assert.NotNull(recovered);
 		Assert.Equal(signer.PublicKey, Convert.ToHexString(recovered!), ignoreCase: true);
 	}
@@ -71,16 +71,16 @@ public void SignedContainerVerifiesAndRecoversItsSigner(string algorithm)
 	public void GrantAndRevokeCyclePrincipals()
 	{
 		using var runtime = WasmRuntime.Load();
-		using Account owner = Account.FromSeed(runtime, TestSeeds.Subject, 0, "ecdsa_secp256k1");
-		using Account reader = Account.FromSeed(runtime, TestSeeds.Recipient, 0, "ecdsa_secp256k1");
+		using Account owner = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, "ecdsa_secp256k1");
+		using Account reader = runtime.Accounts.FromSeed(TestSeeds.Recipient, 0, "ecdsa_secp256k1");
 		using EncryptedContainer container =
-			EncryptedContainer.FromPlaintext(runtime, Payload, new[] { owner }, locked: false);
+			runtime.Containers.FromPlaintext(Payload, new[] { owner }, locked: false);
 
 		container.GrantAccess(new[] { reader });
-		Assert.Equal(2, container.Principals().Count);
+		Assert.Equal(2, container.GetPrincipals().Count);
 
 		byte[] readerKey = Convert.FromHexString(reader.PublicKey);
 		container.RevokeAccess(readerKey);
-		Assert.Single(container.Principals());
+		Assert.Single(container.GetPrincipals());
 	}
 }
diff --git a/tests/KeetaNet.Anchor.Tests/CryptoTests.cs b/tests/KeetaNet.Anchor.Tests/CryptoTests.cs
index 971466f..7914213 100644
--- a/tests/KeetaNet.Anchor.Tests/CryptoTests.cs
+++ b/tests/KeetaNet.Anchor.Tests/CryptoTests.cs
@@ -18,7 +18,7 @@ public sealed class CryptoTests
 	public void AccountDerivesSignsAndVerifies(string algorithm)
 	{
 		using var runtime = WasmRuntime.Load();
-		using Account account = Account.FromSeed(runtime, TestSeeds.Subject, 0, algorithm);
+		using Account account = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, algorithm);
 
 		Assert.Equal(algorithm, account.Algorithm);
 		Assert.StartsWith("keeta_", account.Address, StringComparison.Ordinal);
@@ -37,7 +37,7 @@ public void AccountDerivesSignsAndVerifies(string algorithm)
 	public void EncryptToSelfRoundTrips(string algorithm)
 	{
 		using var runtime = WasmRuntime.Load();
-		using Account account = Account.FromSeed(runtime, TestSeeds.Subject, 0, algorithm);
+		using Account account = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, algorithm);
 
 		byte[] secret = Encoding.UTF8.GetBytes("for my eyes only");
 		byte[] ciphertext = account.Encrypt(secret);
@@ -50,10 +50,10 @@ public void GeneratedPassphraseDerivesASigner()
 	{
 		using var runtime = WasmRuntime.Load();
 
-		IReadOnlyList<string> mnemonic = Account.GeneratePassphrase(runtime);
+		IReadOnlyList<string> mnemonic = runtime.Accounts.GeneratePassphrase();
 		Assert.True(mnemonic.Count is 12 or 24);
 
-		using Account account = Account.FromPassphrase(runtime, mnemonic, 0, "ed25519");
+		using Account account = runtime.Accounts.FromPassphrase(mnemonic, 0, "ed25519");
 		byte[] message = Encoding.UTF8.GetBytes("mnemonic signer");
 		byte[] signature = account.Sign(message);
 		Assert.True(account.Verify(message, signature));
@@ -63,14 +63,14 @@ public void GeneratedPassphraseDerivesASigner()
 	public void FixtureCertificateExposesItsFields()
 	{
 		using var runtime = WasmRuntime.Load();
-		using Account subject = Account.FromSeed(runtime, KycFixture.SubjectSeed, 0, KycFixture.Algorithm);
-		using CryptoCertificate certificate = CryptoCertificate.Parse(runtime, KycFixture.Pem);
+		using Account subject = runtime.Accounts.FromSeed(KycFixture.SubjectSeed, 0, KycFixture.Algorithm);
+		using CryptoCertificate certificate = runtime.Certificates.Parse(KycFixture.Pem);
 
-		Assert.Contains("BEGIN CERTIFICATE", certificate.Pem(), StringComparison.Ordinal);
-		Assert.True(certificate.ValidAt(KycFixture.ValidAt));
+		Assert.Contains("BEGIN CERTIFICATE", certificate.ToPem(), StringComparison.Ordinal);
+		Assert.True(certificate.IsValidAt(KycFixture.ValidAt));
 
 		DateTimeOffset epoch = DateTimeOffset.FromUnixTimeSeconds(0);
-		Assert.False(certificate.ValidAt(epoch));
+		Assert.False(certificate.IsValidAt(epoch));
 
 		Assert.Contains("Test Subject", certificate.Subject, StringComparison.Ordinal);
 		Assert.Contains("Test Issuer", certificate.Issuer, StringComparison.Ordinal);
@@ -84,23 +84,24 @@ public void FixtureCertificateExposesItsFields()
 	public void FixtureKycCertificateReadsAndDecryptsAttributes()
 	{
 		using var runtime = WasmRuntime.Load();
-		using Account subject = Account.FromSeed(runtime, KycFixture.SubjectSeed, 0, KycFixture.Algorithm);
-		using KycCertificate kyc = KycCertificate.Parse(runtime, KycFixture.Pem);
+		using Account subject = runtime.Accounts.FromSeed(KycFixture.SubjectSeed, 0, KycFixture.Algorithm);
+		using KycCertificate kyc = runtime.KycCertificates.Parse(KycFixture.Pem);
 
-		IReadOnlyList<KycAttribute> attributes = kyc.Attributes();
-		Assert.Equal(3, attributes.Count);
-		Assert.Equal(2, attributes.Count(attribute => attribute.Sensitive));
+		// The fixture was issued with raw OID attribute names.
+		IReadOnlyList<string> attributeNames = kyc.GetAttributeNames();
+		Assert.Equal(3, attributeNames.Count);
+		Assert.All(attributeNames, name => Assert.Matches(@"^[\d.]+$", name));
 
-		byte[] postalCode = kyc.PlainAttribute("postalCode");
+		byte[] postalCode = kyc.GetAttributeBuffer("postalCode");
 		Assert.Equal("12345", Encoding.UTF8.GetString(postalCode));
 
-		byte[] email = kyc.DecryptAttribute("email", subject);
+		byte[] email = kyc.GetAttributeBuffer("email", subject);
 		Assert.Equal("john@example.com", Encoding.UTF8.GetString(email));
 
 		using CryptoCertificate baseCertificate = kyc.Base();
-		Assert.Contains("BEGIN CERTIFICATE", baseCertificate.Pem(), StringComparison.Ordinal);
+		Assert.Contains("BEGIN CERTIFICATE", baseCertificate.ToPem(), StringComparison.Ordinal);
 
-		using CryptoCertificate trustRoot = CryptoCertificate.Parse(runtime, KycFixture.Pem);
+		using CryptoCertificate trustRoot = runtime.Certificates.Parse(KycFixture.Pem);
 		CryptoCertificate[] roots = { trustRoot };
 		CryptoCertificate[] none = Array.Empty<CryptoCertificate>();
 		Assert.True(kyc.Verify(roots, none, KycFixture.ValidAt));
diff --git a/tests/KeetaNet.Anchor.Tests/DependencyInjectionTests.cs b/tests/KeetaNet.Anchor.Tests/DependencyInjectionTests.cs
new file mode 100644
index 0000000..964d51d
--- /dev/null
+++ b/tests/KeetaNet.Anchor.Tests/DependencyInjectionTests.cs
@@ -0,0 +1,33 @@
+using KeetaNet.Anchor.Crypto;
+using Microsoft.Extensions.DependencyInjection;
+using Xunit;
+
+namespace KeetaNet.Anchor.Tests;
+
+/// <summary>
+/// The container integration: one shared runtime, idempotent registration,
+/// container-owned disposal.
+/// </summary>
+public sealed class DependencyInjectionTests
+{
+	[Fact]
+	public void RegistersOneSharedRuntimeTheContainerDisposes()
+	{
+		var services = new ServiceCollection();
+		services.AddKeetaNetAnchor();
+		services.AddKeetaNetAnchor();
+
+		WasmRuntime runtime;
+		using (ServiceProvider provider = services.BuildServiceProvider())
+		{
+			runtime = provider.GetRequiredService<WasmRuntime>();
+			WasmRuntime resolvedAgain = provider.GetRequiredService<WasmRuntime>();
+			Assert.Same(runtime, resolvedAgain);
+
+			using Account account = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, "ed25519");
+			Assert.StartsWith("keeta_", account.Address, StringComparison.Ordinal);
+		}
+
+		Assert.True(runtime.IsDisposed);
+	}
+}
diff --git a/tests/KeetaNet.Anchor.Tests/IssueTests.cs b/tests/KeetaNet.Anchor.Tests/IssueTests.cs
index cbde72f..8f2fd22 100644
--- a/tests/KeetaNet.Anchor.Tests/IssueTests.cs
+++ b/tests/KeetaNet.Anchor.Tests/IssueTests.cs
@@ -17,14 +17,14 @@ public sealed class IssueTests
 	public void IssuedLeafRoundTripsEveryAttributeShape(string subjectAlgorithm)
 	{
 		using var runtime = WasmRuntime.Load();
-		using Account subject = Account.FromSeed(runtime, TestSeeds.Subject, 0, subjectAlgorithm);
-		using Account issuer = Account.FromSeed(runtime, TestSeeds.Issuer, 0, "ecdsa_secp256k1");
+		using Account subject = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, subjectAlgorithm);
+		using Account issuer = runtime.Accounts.FromSeed(TestSeeds.Issuer, 0, "ecdsa_secp256k1");
 
 		JsonElement address = JsonSerializer.Deserialize<JsonElement>("""{"addressType":"HOME","postalCode":"34677","townName":"Oldsmar"}""");
 
 		DateTimeOffset dateOfBirth = DateTimeOffset.FromUnixTimeSeconds(315_532_800);
 
-		using KycCertificate leaf = KycCertificate.Builder(runtime)
+		using KycCertificate leaf = runtime.KycCertificates.Builder()
 			.Subject(subject)
 			.Issuer(issuer)
 			.SubjectName("Subject")
@@ -35,19 +35,19 @@ public void IssuedLeafRoundTripsEveryAttributeShape(string subjectAlgorithm)
 			.SetAttribute("email", sensitive: true, "user@example.com")
 			.SetAttribute("dateOfBirth", sensitive: true, dateOfBirth)
 			.SetAttribute("address", sensitive: true, address)
-			.Issue();
+			.Build();
 
-		string pem = leaf.Pem();
+		string pem = leaf.ToPem();
 		Assert.Contains("BEGIN CERTIFICATE", pem, StringComparison.Ordinal);
 
-		using KycCertificate parsed = KycCertificate.Parse(runtime, pem);
+		using KycCertificate parsed = runtime.KycCertificates.Parse(pem);
 
-		byte[] postalCode = parsed.PlainAttribute("postalCode");
+		byte[] postalCode = parsed.GetAttributeBuffer("postalCode");
 		Assert.Equal("12345", Encoding.UTF8.GetString(postalCode));
-		Assert.Equal("user@example.com", parsed.GetText("email", subject));
-		Assert.Equal("1980-01-01T00:00:00.000Z", parsed.GetText("dateOfBirth", subject));
+		Assert.Equal("user@example.com", parsed.GetAttribute("email", subject).AsText());
+		Assert.Equal(dateOfBirth, parsed.GetAttribute("dateOfBirth", subject).AsTimestamp());
 
-		JsonElement decodedAddress = parsed.GetJson("address", subject);
+		JsonElement decodedAddress = parsed.GetAttribute("address", subject).AsJson();
 		JsonElement addressPostalCode = decodedAddress.GetProperty("postalCode");
 		Assert.Equal("34677", addressPostalCode.GetString());
 	}
diff --git a/tests/KeetaNet.Anchor.Tests/KeetaNet.Anchor.Tests.csproj b/tests/KeetaNet.Anchor.Tests/KeetaNet.Anchor.Tests.csproj
index b3510ab..12c3bb2 100644
--- a/tests/KeetaNet.Anchor.Tests/KeetaNet.Anchor.Tests.csproj
+++ b/tests/KeetaNet.Anchor.Tests/KeetaNet.Anchor.Tests.csproj
@@ -11,10 +11,12 @@
 	<ItemGroup>
 		<PackageReference Include="xunit.v3" />
 		<PackageReference Include="Microsoft.Testing.Extensions.CodeCoverage" />
+		<PackageReference Include="Microsoft.Extensions.DependencyInjection" />
 	</ItemGroup>
 
 	<ItemGroup>
 		<ProjectReference Include="../../src/KeetaNet.Anchor/KeetaNet.Anchor.csproj" />
+		<ProjectReference Include="../../src/KeetaNet.Anchor.Extensions.DependencyInjection/KeetaNet.Anchor.Extensions.DependencyInjection.csproj" />
 	</ItemGroup>
 
 </Project>
diff --git a/tests/KeetaNet.Anchor.Tests/LifecycleTests.cs b/tests/KeetaNet.Anchor.Tests/LifecycleTests.cs
index 4b37a49..9ae10ee 100644
--- a/tests/KeetaNet.Anchor.Tests/LifecycleTests.cs
+++ b/tests/KeetaNet.Anchor.Tests/LifecycleTests.cs
@@ -17,10 +17,12 @@ public sealed class LifecycleTests
 	[Fact]
 	[SuppressMessage("IDisposableAnalyzers.Correctness", "IDISP016:Don't use disposed instance",
 		Justification = "Use after dispose is exactly the behavior under test; it must throw ObjectDisposedException.")]
+	[SuppressMessage("IDisposableAnalyzers.Correctness", "IDISP017:Prefer using",
+		Justification = "Explicit Dispose is the behavior under test.")]
 	public void DisposedWrapperRefusesUse()
 	{
 		using var runtime = WasmRuntime.Load();
-		Account account = Account.FromSeed(runtime, TestSeeds.Subject, 0, "ed25519");
+		Account account = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, "ed25519");
 
 		account.Dispose();
 
@@ -36,7 +38,7 @@ public void DisposedWrapperRefusesUse()
 	public void DoubleDisposeIsIdempotent()
 	{
 		var runtime = WasmRuntime.Load();
-		Account account = Account.FromSeed(runtime, TestSeeds.Subject, 0, "ed25519");
+		Account account = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, "ed25519");
 
 		account.Dispose();
 		account.Dispose();
@@ -52,7 +54,7 @@ public void DoubleDisposeIsIdempotent()
 	public void WrapperOutlivingRuntimeStaysSafe()
 	{
 		var runtime = WasmRuntime.Load();
-		using Account account = Account.FromSeed(runtime, TestSeeds.Subject, 0, "ed25519");
+		using Account account = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, "ed25519");
 
 		runtime.Dispose();
 
@@ -64,13 +66,13 @@ public void WrapperOutlivingRuntimeStaysSafe()
 	public async Task ClientOutlivingRuntimeRefusesDispatch()
 	{
 		var runtime = WasmRuntime.Load();
-		using Account account = Account.FromSeed(runtime, TestSeeds.Subject, 0, "ed25519");
-		using KycClient client = KycClient.WithAccount(runtime, "http://127.0.0.1:1", account.Address, account);
+		using Account account = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, "ed25519");
+		using KycClient client = runtime.CreateKycClient("http://127.0.0.1:1", account.Address, account);
 
 		runtime.Dispose();
 
 		await Assert.ThrowsAsync<ObjectDisposedException>(
-			() => client.ProvidersAsync(Countries, TestContext.Current.CancellationToken));
+			() => client.GetProvidersAsync(Countries, TestContext.Current.CancellationToken));
 	}
 
 	[Fact]
@@ -88,7 +90,7 @@ public void FinalizerBackstopReclaimsForgottenHandle()
 #endif
 
 		// The queued backstop free must leave the dispatcher healthy.
-		using Account survivor = Account.FromSeed(runtime, TestSeeds.Subject, 1, "ed25519");
+		using Account survivor = runtime.Accounts.FromSeed(TestSeeds.Subject, 1, "ed25519");
 		Assert.StartsWith("keeta_", survivor.Address, StringComparison.Ordinal);
 	}
 
@@ -97,7 +99,7 @@ public void FinalizerBackstopReclaimsForgottenHandle()
 	public void LeakCounterFlagsForgottenDispose()
 	{
 		using var runtime = WasmRuntime.Load();
-		Account tracked = Account.FromSeed(runtime, TestSeeds.Subject, 0, "ed25519");
+		Account tracked = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, "ed25519");
 
 		Assert.Equal(1, runtime.OutstandingHandles);
 
@@ -117,7 +119,7 @@ public void LeakCounterFlagsForgottenDispose()
 		Justification = "Deliberately leaked to exercise the finalizer backstop.")]
 	private static void LeakAccount(WasmRuntime runtime)
 	{
-		Account leaked = Account.FromSeed(runtime, TestSeeds.Subject, 0, "ed25519");
+		Account leaked = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, "ed25519");
 		Assert.StartsWith("keeta_", leaked.Address, StringComparison.Ordinal);
 	}
 }
diff --git a/tests/KeetaNet.Anchor.Tests/ProveTests.cs b/tests/KeetaNet.Anchor.Tests/ProveTests.cs
index 1637109..3086bc4 100644
--- a/tests/KeetaNet.Anchor.Tests/ProveTests.cs
+++ b/tests/KeetaNet.Anchor.Tests/ProveTests.cs
@@ -14,10 +14,10 @@ public sealed class ProveTests
 	public void ProofValidatesForItsAttributeOnly(string subjectAlgorithm)
 	{
 		using var runtime = WasmRuntime.Load();
-		using Account subject = Account.FromSeed(runtime, TestSeeds.Subject, 0, subjectAlgorithm);
-		using Account issuer = Account.FromSeed(runtime, TestSeeds.Issuer, 0, "ecdsa_secp256k1");
+		using Account subject = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, subjectAlgorithm);
+		using Account issuer = runtime.Accounts.FromSeed(TestSeeds.Issuer, 0, "ecdsa_secp256k1");
 
-		using KycCertificate leaf = KycCertificate.Builder(runtime)
+		using KycCertificate leaf = runtime.KycCertificates.Builder()
 			.Subject(subject)
 			.Issuer(issuer)
 			.SubjectName("Subject")
@@ -26,14 +26,14 @@ public void ProofValidatesForItsAttributeOnly(string subjectAlgorithm)
 			.Validity(TestSeeds.NotBefore, TestSeeds.NotAfter)
 			.SetAttribute("email", sensitive: true, "user@example.com")
 			.SetAttribute("fullName", sensitive: true, "Test User")
-			.Issue();
+			.Build();
 
-		AttributeProof proof = leaf.Prove("email", subject);
+		AttributeProof proof = leaf.GetProof("email", subject);
 		Assert.NotEmpty(proof.Value);
 		Assert.NotEmpty(proof.Salt);
 		Assert.True(leaf.ValidateProof("email", subject, proof));
 
-		AttributeProof other = leaf.Prove("fullName", subject);
+		AttributeProof other = leaf.GetProof("fullName", subject);
 		Assert.False(leaf.ValidateProof("email", subject, other));
 	}
 }
diff --git a/tests/KeetaNet.Anchor.Tests/SharableTests.cs b/tests/KeetaNet.Anchor.Tests/SharableTests.cs
index 20823df..3e27ce7 100644
--- a/tests/KeetaNet.Anchor.Tests/SharableTests.cs
+++ b/tests/KeetaNet.Anchor.Tests/SharableTests.cs
@@ -18,10 +18,10 @@ public sealed class SharableTests
 	public void ExportWithoutARecipientIsRejected()
 	{
 		using var runtime = WasmRuntime.Load();
-		using Account subject = Account.FromSeed(runtime, TestSeeds.Subject, 0, "ecdsa_secp256k1");
-		using Account issuer = Account.FromSeed(runtime, TestSeeds.Issuer, 0, "ecdsa_secp256k1");
+		using Account subject = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, "ecdsa_secp256k1");
+		using Account issuer = runtime.Accounts.FromSeed(TestSeeds.Issuer, 0, "ecdsa_secp256k1");
 		using KycCertificate leaf = IssueLeaf(runtime, subject, issuer);
-		using SharableCertificateAttributes bundle = SharableCertificateAttributes.FromCertificate(runtime, leaf, subject, names: EmailOnly);
+		using SharableCertificateAttributes bundle = runtime.Sharables.FromCertificate(leaf, subject, names: EmailOnly);
 
 		Assert.Throws<KeetaException>(() => bundle.Export());
 	}
@@ -31,39 +31,39 @@ public void ExportWithoutARecipientIsRejected()
 	public void RecipientReadsTheDisclosedBundleBack(string algorithm)
 	{
 		using var runtime = WasmRuntime.Load();
-		using Account subject = Account.FromSeed(runtime, TestSeeds.Subject, 0, algorithm);
-		using Account issuer = Account.FromSeed(runtime, TestSeeds.Issuer, 0, algorithm);
-		using Account recipient = Account.FromSeed(runtime, TestSeeds.Recipient, 0, algorithm);
+		using Account subject = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, algorithm);
+		using Account issuer = runtime.Accounts.FromSeed(TestSeeds.Issuer, 0, algorithm);
+		using Account recipient = runtime.Accounts.FromSeed(TestSeeds.Recipient, 0, algorithm);
 		using KycCertificate leaf = IssueLeaf(runtime, subject, issuer);
 
-		using SharableCertificateAttributes bundle = SharableCertificateAttributes.FromCertificate(runtime, leaf, subject, names: BothAttributes);
+		using SharableCertificateAttributes bundle = runtime.Sharables.FromCertificate(leaf, subject, names: BothAttributes);
 		bundle.GrantAccess(new[] { recipient });
 
 		string pem = bundle.ToPem();
 
-		using SharableCertificateAttributes opened = SharableCertificateAttributes.FromPem(runtime, pem, new[] { recipient });
+		using SharableCertificateAttributes opened = runtime.Sharables.FromPem(pem, new[] { recipient });
 
-		byte[]? postalCode = opened.AttributeValue("postalCode");
+		byte[]? postalCode = opened.GetAttributeValue("postalCode");
 		Assert.Equal("12345", Encoding.UTF8.GetString(postalCode!));
 
-		byte[]? email = opened.AttributeValue("email");
+		byte[]? email = opened.GetAttributeValue("email");
 		Assert.Equal("john@example.com", Encoding.UTF8.GetString(email!));
 
-		Assert.Null(opened.AttributeBuffer("doesNotExist"));
+		Assert.Null(opened.GetAttributeBuffer("doesNotExist"));
 
-		using KycCertificate embedded = opened.LeafCertificate();
-		Assert.Contains("BEGIN CERTIFICATE", embedded.Pem(), StringComparison.Ordinal);
+		using KycCertificate embedded = opened.GetCertificate();
+		Assert.Contains("BEGIN CERTIFICATE", embedded.ToPem(), StringComparison.Ordinal);
 
-		IReadOnlyList<byte[]> principals = opened.Principals();
+		IReadOnlyList<byte[]> principals = opened.GetPrincipals();
 		Assert.Single(principals);
 		Assert.Equal(recipient.PublicKey, Convert.ToHexString(principals[0]), ignoreCase: true);
 
-		Assert.Equal(2, opened.AttributeNames().Count);
+		Assert.Equal(2, opened.GetAttributeNames().Count);
 	}
 
 	private static KycCertificate IssueLeaf(WasmRuntime runtime, Account subject, Account issuer)
 	{
-		return KycCertificate.Builder(runtime)
+		return runtime.KycCertificates.Builder()
 			.Subject(subject)
 			.Issuer(issuer)
 			.SubjectName("Subject")
@@ -72,6 +72,6 @@ private static KycCertificate IssueLeaf(WasmRuntime runtime, Account subject, Ac
 			.Validity(TestSeeds.NotBefore, TestSeeds.NotAfter)
 			.SetAttribute("postalCode", sensitive: false, "12345")
 			.SetAttribute("email", sensitive: true, "john@example.com")
-			.Issue();
+			.Build();
 	}
 }

From a244469dd685516df265a5e4135f4a87e6595387 Mon Sep 17 00:00:00 2001
From: Tanveer Wahid <twahid@keeta.com>
Date: Thu, 2 Jul 2026 17:37:10 -0700
Subject: [PATCH 02/11] fix(ci): setup proper toolchain

---
 .github/workflows/ci.yml      | 24 ++++++------------------
 .github/workflows/publish.yml |  5 +----
 rust-toolchain.toml           |  6 ++++++
 3 files changed, 13 insertions(+), 22 deletions(-)
 create mode 100644 rust-toolchain.toml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2827fe6..5778e79 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,9 +6,6 @@ on:
   pull_request:
     branches: [main]
 
-env:
-  RUST_TOOLCHAIN: "1.94.0"
-
 jobs:
   build-test:
     name: Build & Test (${{ matrix.os }})
@@ -29,10 +26,7 @@ jobs:
           global-json-file: global.json
 
       - name: Set up Rust
-        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
-        with:
-          toolchain: "1.94.0"
-          targets: wasm32-wasip1
+        uses: dsherret/rust-toolchain-file@3551321aa44dd44a0393eb3b6bdfbc5d25ecf621 # v1
 
       - name: Cache wasm build
         uses: actions/cache@v4
@@ -41,7 +35,7 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             .wasm-build
-          key: wasm-${{ runner.os }}-${{ hashFiles('scripts/build-wasm.sh') }}
+          key: wasm-${{ runner.os }}-${{ hashFiles('scripts/build-wasm.sh', 'rust-toolchain.toml') }}
 
       - name: Set up Node.js
         uses: actions/setup-node@v4
@@ -108,10 +102,7 @@ jobs:
           global-json-file: global.json
 
       - name: Set up Rust
-        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
-        with:
-          toolchain: "1.94.0"
-          targets: wasm32-wasip1
+        uses: dsherret/rust-toolchain-file@3551321aa44dd44a0393eb3b6bdfbc5d25ecf621 # v1
 
       - name: Cache wasm build
         uses: actions/cache@v4
@@ -120,7 +111,7 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             .wasm-build
-          key: wasm-${{ runner.os }}-${{ hashFiles('scripts/build-wasm.sh') }}
+          key: wasm-${{ runner.os }}-${{ hashFiles('scripts/build-wasm.sh', 'rust-toolchain.toml') }}
 
       - name: Build wasm core
         run: bash scripts/build-wasm.sh
@@ -171,10 +162,7 @@ jobs:
           global-json-file: global.json
 
       - name: Set up Rust
-        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
-        with:
-          toolchain: "1.94.0"
-          targets: wasm32-wasip1
+        uses: dsherret/rust-toolchain-file@3551321aa44dd44a0393eb3b6bdfbc5d25ecf621 # v1
 
       - name: Cache wasm build
         uses: actions/cache@v4
@@ -183,7 +171,7 @@ jobs:
             ~/.cargo/registry
             ~/.cargo/git
             .wasm-build
-          key: wasm-${{ runner.os }}-${{ hashFiles('scripts/build-wasm.sh') }}
+          key: wasm-${{ runner.os }}-${{ hashFiles('scripts/build-wasm.sh', 'rust-toolchain.toml') }}
 
       - name: Build wasm core
         run: bash scripts/build-wasm.sh
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 931556a..6439237 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -24,10 +24,7 @@ jobs:
           global-json-file: global.json
 
       - name: Set up Rust
-        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable
-        with:
-          toolchain: "1.94.0"
-          targets: wasm32-wasip1
+        uses: dsherret/rust-toolchain-file@3551321aa44dd44a0393eb3b6bdfbc5d25ecf621 # v1
 
       - name: Build wasm core
         run: bash scripts/build-wasm.sh
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
new file mode 100644
index 0000000..861343e
--- /dev/null
+++ b/rust-toolchain.toml
@@ -0,0 +1,6 @@
+# rustfmt is required: keetanetwork-asn1's codegen silently emits unformatted
+# (and uncompilable) output when rustfmt is missing from the toolchain.
+[toolchain]
+channel = "1.94.0"
+components = ["rustfmt"]
+targets = ["wasm32-wasip1"]

From d615b73e02d6ab5b68ab67860ba3b1405e34aa3d Mon Sep 17 00:00:00 2001
From: Tanveer Wahid <twahid@keeta.com>
Date: Thu, 2 Jul 2026 18:10:34 -0700
Subject: [PATCH 03/11] chore: cleanup sonar issues

---
 .github/workflows/ci.yml                      |  2 +-
 .github/workflows/publish.yml                 |  4 ++-
 Makefile                                      |  2 +-
 cspell.yaml                                   |  4 +++
 scripts/build-wasm.sh                         | 25 +++++++++++++++----
 scripts/release.sh                            |  8 +++---
 .../KeetaNet.Anchor.Tests/ConcurrencyTests.cs | 10 ++++----
 tests/KeetaNet.Anchor.Tests/LifecycleTests.cs | 16 ++++++------
 tests/KeetaNet.Anchor.Tests/ProveTests.cs     | 10 +++++---
 tests/KeetaNet.Anchor.Tests/SharableTests.cs  | 10 +++++---
 tests/KeetaNet.Anchor.Tests/TestSeeds.cs      |  8 +++++-
 11 files changed, 65 insertions(+), 34 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5778e79..385fd1f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -50,7 +50,7 @@ jobs:
 
       - name: Build node harness
         shell: bash
-        run: npm ci && npm run build
+        run: npm ci --ignore-scripts && npm rebuild sqlite3 && npm run build
         working-directory: tests/node-harness
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 6439237..c65d6b8 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -47,8 +47,10 @@ jobs:
           subject-path: "artifacts/*.nupkg"
 
       - name: Push
+        env:
+          NUGET_API_KEY: ${{ secrets.GITHUB_TOKEN }}
         run: >
           dotnet nuget push "artifacts/*.nupkg"
           --source "https://nuget.pkg.github.com/KeetaNetwork/index.json"
-          --api-key "${{ secrets.GITHUB_TOKEN }}"
+          --api-key "$NUGET_API_KEY"
           --skip-duplicate
diff --git a/Makefile b/Makefile
index 565b8a4..962139c 100644
--- a/Makefile
+++ b/Makefile
@@ -50,7 +50,7 @@ test: build node-harness
 
 # Build the TypeScript harnesses (installs deps + compiles every entry)
 $(HARNESS_DIR)/node_modules/.package-lock.json: $(HARNESS_DIR)/package-lock.json
-	cd $(HARNESS_DIR) && npm ci
+	cd $(HARNESS_DIR) && npm ci --ignore-scripts && npm rebuild sqlite3
 
 $(HARNESS_DIR)/dist/.built: $(HARNESS_DIR)/node_modules/.package-lock.json $(HARNESS_SOURCES)
 	cd $(HARNESS_DIR) && npm run build
diff --git a/cspell.yaml b/cspell.yaml
index 5d02866..b7ded19 100644
--- a/cspell.yaml
+++ b/cspell.yaml
@@ -56,3 +56,7 @@ words:
   - belgrave
   - idisp
   - lifecycles
+  - tlsv
+  - rasn
+  - rustfmt
+  - userprofile
diff --git a/scripts/build-wasm.sh b/scripts/build-wasm.sh
index 8e56978..abbcd65 100755
--- a/scripts/build-wasm.sh
+++ b/scripts/build-wasm.sh
@@ -16,10 +16,23 @@ DEST="${ROOT}/src/KeetaNet.Anchor/wasm/keetanetwork_anchor_client_wasi.wasm"
 DOWNLOAD_URL="https://crates.io/api/v1/crates/${CRATE_NAME}/${CRATE_VERSION}/download"
 
 checksum() {
+	local file="$1"
 	if command -v sha256sum >/dev/null 2>&1; then
-		sha256sum "$1" | cut -d' ' -f1
+		sha256sum "${file}" | cut -d' ' -f1
 	else
-		shasum -a 256 "$1" | cut -d' ' -f1
+		shasum -a 256 "${file}" | cut -d' ' -f1
+	fi
+}
+
+# rasn-compiler (used by keetanetwork-asn1's build script) probes for a
+# literal `$CARGO_HOME/bin/rustfmt`.
+shim_rustfmt_for_windows() {
+	[[ "${OS:-}" == "Windows_NT" ]] || return 0
+
+	local cargo_bin="${CARGO_HOME:-${USERPROFILE}/.cargo}/bin"
+	if [[ -f "${cargo_bin}/rustfmt.exe" && ! -f "${cargo_bin}/rustfmt" ]]; then
+		echo "build-wasm: shimming extension-less rustfmt for rasn-compiler"
+		cp "${cargo_bin}/rustfmt.exe" "${cargo_bin}/rustfmt"
 	fi
 }
 
@@ -39,16 +52,17 @@ require_wasip1_target() {
 
 fetch_crate() {
 	mkdir -p "${BUILD_DIR}"
-	if [ ! -f "${TARBALL}" ]; then
+	if [[ ! -f "${TARBALL}" ]]; then
 		echo "build-wasm: downloading ${CRATE_NAME} ${CRATE_VERSION} from crates.io"
 		# crates.io rejects requests without a User-Agent.
 		curl --fail --silent --show-error --location \
+			--proto '=https' --tlsv1.2 \
 			--user-agent "anchor-csharp build-wasm (https://github.com/KeetaNetwork/anchor-csharp)" \
 			--output "${TARBALL}" "${DOWNLOAD_URL}"
 	fi
 
 	actual="$(checksum "${TARBALL}")"
-	if [ "${actual}" != "${CRATE_SHA256}" ]; then
+	if [[ "${actual}" != "${CRATE_SHA256}" ]]; then
 		rm -f "${TARBALL}"
 		echo "build-wasm: checksum mismatch for ${TARBALL}" >&2
 		echo "  expected: ${CRATE_SHA256}" >&2
@@ -56,7 +70,7 @@ fetch_crate() {
 		exit 1
 	fi
 
-	if [ ! -d "${CRATE_DIR}" ]; then
+	if [[ ! -d "${CRATE_DIR}" ]]; then
 		tar --extract --gzip --file "${TARBALL}" --directory "${BUILD_DIR}"
 	fi
 }
@@ -71,6 +85,7 @@ build_artifact() {
 		--features p1
 }
 
+shim_rustfmt_for_windows
 require_wasip1_target
 fetch_crate
 build_artifact
diff --git a/scripts/release.sh b/scripts/release.sh
index c505c8a..f5157f6 100755
--- a/scripts/release.sh
+++ b/scripts/release.sh
@@ -18,7 +18,7 @@ for arg in "$@"; do
 	esac
 done
 
-[ -n "$version" ] || usage
+[[ -n "$version" ]] || usage
 
 if ! printf '%s' "$version" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+([-.+][0-9A-Za-z.-]+)?$'; then
 	echo "release: '$version' is not a valid semantic version" >&2
@@ -28,12 +28,12 @@ fi
 tag="releases/v${version}"
 
 branch="$(git rev-parse --abbrev-ref HEAD)"
-if [ "$branch" != "main" ]; then
+if [[ "$branch" != "main" ]]; then
 	echo "release: must tag from 'main' (on '$branch')" >&2
 	exit 1
 fi
 
-if [ -n "$(git status --porcelain)" ]; then
+if [[ -n "$(git status --porcelain)" ]]; then
 	echo "release: working tree is not clean" >&2
 	exit 1
 fi
@@ -43,7 +43,7 @@ if git rev-parse -q --verify "refs/tags/${tag}" >/dev/null; then
 	exit 1
 fi
 
-if [ "$dry_run" -eq 1 ]; then
+if [[ "$dry_run" -eq 1 ]]; then
 	echo "release: would create and push signed tag '${tag}'"
 	exit 0
 fi
diff --git a/tests/KeetaNet.Anchor.Tests/ConcurrencyTests.cs b/tests/KeetaNet.Anchor.Tests/ConcurrencyTests.cs
index bfdb6e4..53cc1c9 100644
--- a/tests/KeetaNet.Anchor.Tests/ConcurrencyTests.cs
+++ b/tests/KeetaNet.Anchor.Tests/ConcurrencyTests.cs
@@ -21,7 +21,7 @@ public sealed class ConcurrencyTests
 	public async Task ParallelSignAndVerifyFromThreadPoolThreadsStayConsistent()
 	{
 		using var runtime = WasmRuntime.Load();
-		using Account account = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, "ed25519");
+		using Account account = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, TestSeeds.DefaultAlgorithm);
 		string expectedAddress = account.Address;
 
 		Task<bool>[] work = Enumerable.Range(0, 32)
@@ -59,7 +59,7 @@ public async Task ParallelAccountLifecyclesYieldIndependentResults()
 
 	private static string DeriveAddress(WasmRuntime runtime, uint index)
 	{
-		using Account account = runtime.Accounts.FromSeed(TestSeeds.Subject, index, "ed25519");
+		using Account account = runtime.Accounts.FromSeed(TestSeeds.Subject, index, TestSeeds.DefaultAlgorithm);
 		return account.Address;
 	}
 
@@ -67,8 +67,8 @@ private static string DeriveAddress(WasmRuntime runtime, uint index)
 	public async Task PreCanceledTokenCancelsWithoutDispatching()
 	{
 		using var runtime = WasmRuntime.Load();
-		using Account account = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, "ed25519");
-		using KycClient client = runtime.CreateKycClient("http://127.0.0.1:1", account.Address, account);
+		using Account account = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, TestSeeds.DefaultAlgorithm);
+		using KycClient client = runtime.CreateKycClient(TestSeeds.NonRoutableAnchor, account.Address, account);
 
 		using var cancellation = new CancellationTokenSource();
 		await cancellation.CancelAsync();
@@ -87,7 +87,7 @@ public async Task CancellationDuringHostHttpSurfacesAsCanceled()
 		int port = ((IPEndPoint)listener.LocalEndpoint).Port;
 
 		using var runtime = WasmRuntime.Load();
-		using Account account = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, "ed25519");
+		using Account account = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, TestSeeds.DefaultAlgorithm);
 		using KycClient client = runtime.CreateKycClient($"http://127.0.0.1:{port}", account.Address, account);
 
 		using var cancellation = new CancellationTokenSource(TimeSpan.FromMilliseconds(250));
diff --git a/tests/KeetaNet.Anchor.Tests/LifecycleTests.cs b/tests/KeetaNet.Anchor.Tests/LifecycleTests.cs
index 9ae10ee..e65e3f0 100644
--- a/tests/KeetaNet.Anchor.Tests/LifecycleTests.cs
+++ b/tests/KeetaNet.Anchor.Tests/LifecycleTests.cs
@@ -22,7 +22,7 @@ public sealed class LifecycleTests
 	public void DisposedWrapperRefusesUse()
 	{
 		using var runtime = WasmRuntime.Load();
-		Account account = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, "ed25519");
+		Account account = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, TestSeeds.DefaultAlgorithm);
 
 		account.Dispose();
 
@@ -38,7 +38,7 @@ public void DisposedWrapperRefusesUse()
 	public void DoubleDisposeIsIdempotent()
 	{
 		var runtime = WasmRuntime.Load();
-		Account account = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, "ed25519");
+		Account account = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, TestSeeds.DefaultAlgorithm);
 
 		account.Dispose();
 		account.Dispose();
@@ -54,7 +54,7 @@ public void DoubleDisposeIsIdempotent()
 	public void WrapperOutlivingRuntimeStaysSafe()
 	{
 		var runtime = WasmRuntime.Load();
-		using Account account = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, "ed25519");
+		using Account account = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, TestSeeds.DefaultAlgorithm);
 
 		runtime.Dispose();
 
@@ -66,8 +66,8 @@ public void WrapperOutlivingRuntimeStaysSafe()
 	public async Task ClientOutlivingRuntimeRefusesDispatch()
 	{
 		var runtime = WasmRuntime.Load();
-		using Account account = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, "ed25519");
-		using KycClient client = runtime.CreateKycClient("http://127.0.0.1:1", account.Address, account);
+		using Account account = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, TestSeeds.DefaultAlgorithm);
+		using KycClient client = runtime.CreateKycClient(TestSeeds.NonRoutableAnchor, account.Address, account);
 
 		runtime.Dispose();
 
@@ -90,7 +90,7 @@ public void FinalizerBackstopReclaimsForgottenHandle()
 #endif
 
 		// The queued backstop free must leave the dispatcher healthy.
-		using Account survivor = runtime.Accounts.FromSeed(TestSeeds.Subject, 1, "ed25519");
+		using Account survivor = runtime.Accounts.FromSeed(TestSeeds.Subject, 1, TestSeeds.DefaultAlgorithm);
 		Assert.StartsWith("keeta_", survivor.Address, StringComparison.Ordinal);
 	}
 
@@ -99,7 +99,7 @@ public void FinalizerBackstopReclaimsForgottenHandle()
 	public void LeakCounterFlagsForgottenDispose()
 	{
 		using var runtime = WasmRuntime.Load();
-		Account tracked = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, "ed25519");
+		Account tracked = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, TestSeeds.DefaultAlgorithm);
 
 		Assert.Equal(1, runtime.OutstandingHandles);
 
@@ -119,7 +119,7 @@ public void LeakCounterFlagsForgottenDispose()
 		Justification = "Deliberately leaked to exercise the finalizer backstop.")]
 	private static void LeakAccount(WasmRuntime runtime)
 	{
-		Account leaked = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, "ed25519");
+		Account leaked = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, TestSeeds.DefaultAlgorithm);
 		Assert.StartsWith("keeta_", leaked.Address, StringComparison.Ordinal);
 	}
 }
diff --git a/tests/KeetaNet.Anchor.Tests/ProveTests.cs b/tests/KeetaNet.Anchor.Tests/ProveTests.cs
index 3086bc4..ed4232b 100644
--- a/tests/KeetaNet.Anchor.Tests/ProveTests.cs
+++ b/tests/KeetaNet.Anchor.Tests/ProveTests.cs
@@ -9,6 +9,8 @@ namespace KeetaNet.Anchor.Tests;
 /// </summary>
 public sealed class ProveTests
 {
+	private const string EmailAttribute = "email";
+
 	[Theory]
 	[MemberData(nameof(TestSeeds.Algorithms), MemberType = typeof(TestSeeds))]
 	public void ProofValidatesForItsAttributeOnly(string subjectAlgorithm)
@@ -24,16 +26,16 @@ public void ProofValidatesForItsAttributeOnly(string subjectAlgorithm)
 			.IssuerName("Issuer")
 			.Serial(7)
 			.Validity(TestSeeds.NotBefore, TestSeeds.NotAfter)
-			.SetAttribute("email", sensitive: true, "user@example.com")
+			.SetAttribute(EmailAttribute, sensitive: true, "user@example.com")
 			.SetAttribute("fullName", sensitive: true, "Test User")
 			.Build();
 
-		AttributeProof proof = leaf.GetProof("email", subject);
+		AttributeProof proof = leaf.GetProof(EmailAttribute, subject);
 		Assert.NotEmpty(proof.Value);
 		Assert.NotEmpty(proof.Salt);
-		Assert.True(leaf.ValidateProof("email", subject, proof));
+		Assert.True(leaf.ValidateProof(EmailAttribute, subject, proof));
 
 		AttributeProof other = leaf.GetProof("fullName", subject);
-		Assert.False(leaf.ValidateProof("email", subject, other));
+		Assert.False(leaf.ValidateProof(EmailAttribute, subject, other));
 	}
 }
diff --git a/tests/KeetaNet.Anchor.Tests/SharableTests.cs b/tests/KeetaNet.Anchor.Tests/SharableTests.cs
index 3e27ce7..39c4f27 100644
--- a/tests/KeetaNet.Anchor.Tests/SharableTests.cs
+++ b/tests/KeetaNet.Anchor.Tests/SharableTests.cs
@@ -11,8 +11,10 @@ namespace KeetaNet.Anchor.Tests;
 /// </summary>
 public sealed class SharableTests
 {
-	private static readonly string[] EmailOnly = { "email" };
-	private static readonly string[] BothAttributes = { "postalCode", "email" };
+	private const string EmailAttribute = "email";
+
+	private static readonly string[] EmailOnly = { EmailAttribute };
+	private static readonly string[] BothAttributes = { "postalCode", EmailAttribute };
 
 	[Fact]
 	public void ExportWithoutARecipientIsRejected()
@@ -46,7 +48,7 @@ public void RecipientReadsTheDisclosedBundleBack(string algorithm)
 		byte[]? postalCode = opened.GetAttributeValue("postalCode");
 		Assert.Equal("12345", Encoding.UTF8.GetString(postalCode!));
 
-		byte[]? email = opened.GetAttributeValue("email");
+		byte[]? email = opened.GetAttributeValue(EmailAttribute);
 		Assert.Equal("john@example.com", Encoding.UTF8.GetString(email!));
 
 		Assert.Null(opened.GetAttributeBuffer("doesNotExist"));
@@ -71,7 +73,7 @@ private static KycCertificate IssueLeaf(WasmRuntime runtime, Account subject, Ac
 			.Serial(7)
 			.Validity(TestSeeds.NotBefore, TestSeeds.NotAfter)
 			.SetAttribute("postalCode", sensitive: false, "12345")
-			.SetAttribute("email", sensitive: true, "john@example.com")
+			.SetAttribute(EmailAttribute, sensitive: true, "john@example.com")
 			.Build();
 	}
 }
diff --git a/tests/KeetaNet.Anchor.Tests/TestSeeds.cs b/tests/KeetaNet.Anchor.Tests/TestSeeds.cs
index d825922..11d0527 100644
--- a/tests/KeetaNet.Anchor.Tests/TestSeeds.cs
+++ b/tests/KeetaNet.Anchor.Tests/TestSeeds.cs
@@ -2,13 +2,19 @@
 
 namespace KeetaNet.Anchor.Tests;
 
-/// <summary>The deterministic seeds and algorithms the baseline suites share.</summary>
+/// <summary>The deterministic seeds, algorithms, and endpoints the baseline suites share.</summary>
 internal static class TestSeeds
 {
 	public const string Subject = "1111111111111111111111111111111111111111111111111111111111111111";
 	public const string Issuer = "2222222222222222222222222222222222222222222222222222222222222222";
 	public const string Recipient = "3333333333333333333333333333333333333333333333333333333333333333";
 
+	/// <summary>The account algorithm the suites default to when any one will do.</summary>
+	public const string DefaultAlgorithm = "ed25519";
+
+	/// <summary>An non-routable anchor endpoint for tests that must never reach a live service.</summary>
+	public const string NonRoutableAnchor = "http://127.0.0.1:1";
+
 	/// <summary>The validity window issued leaves share across the suites.</summary>
 	public static readonly DateTimeOffset NotBefore = DateTimeOffset.FromUnixTimeSeconds(1_700_000_000);
 	public static readonly DateTimeOffset NotAfter = DateTimeOffset.FromUnixTimeSeconds(1_900_000_000);

From 073f6d5978a53c4acad7529a748fc1d03b1b31b6 Mon Sep 17 00:00:00 2001
From: Tanveer Wahid <twahid@keeta.com>
Date: Thu, 2 Jul 2026 18:20:28 -0700
Subject: [PATCH 04/11] fix: windows shim

---
 scripts/build-wasm.sh | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/scripts/build-wasm.sh b/scripts/build-wasm.sh
index abbcd65..89b141d 100755
--- a/scripts/build-wasm.sh
+++ b/scripts/build-wasm.sh
@@ -24,16 +24,28 @@ checksum() {
 	fi
 }
 
-# rasn-compiler (used by keetanetwork-asn1's build script) probes for a
-# literal `$CARGO_HOME/bin/rustfmt`.
+# rasn-compiler probes `$CARGO_HOME/bin/rustfmt` and `$CARGO`-adjacent
+# `rustfmt` without the .exe suffix. When both miss it silently emits
+# unformatted bindings that break the keetanetwork-asn1 build. Shim
+# extension-less copies for it.
 shim_rustfmt_for_windows() {
 	[[ "${OS:-}" == "Windows_NT" ]] || return 0
 
 	local cargo_bin="${CARGO_HOME:-${USERPROFILE}/.cargo}/bin"
 	if [[ -f "${cargo_bin}/rustfmt.exe" && ! -f "${cargo_bin}/rustfmt" ]]; then
-		echo "build-wasm: shimming extension-less rustfmt for rasn-compiler"
+		echo "build-wasm: shimming extension-less rustfmt in ${cargo_bin}"
 		cp "${cargo_bin}/rustfmt.exe" "${cargo_bin}/rustfmt"
 	fi
+
+	local toolchain_rustfmt
+	toolchain_rustfmt="$(rustup which rustfmt 2>/dev/null || true)"
+	if [[ "${toolchain_rustfmt}" == *.exe && -f "${toolchain_rustfmt}" ]]; then
+		local bare_rustfmt="${toolchain_rustfmt%.exe}"
+		if [[ ! -f "${bare_rustfmt}" ]]; then
+			echo "build-wasm: shimming extension-less rustfmt in the toolchain bin dir"
+			cp "${toolchain_rustfmt}" "${bare_rustfmt}"
+		fi
+	fi
 }
 
 require_wasip1_target() {

From 4bf4a3f759369bc50cf8265a0cb22fb04d4bad03 Mon Sep 17 00:00:00 2001
From: Tanveer Wahid <twahid@keeta.com>
Date: Thu, 2 Jul 2026 18:29:38 -0700
Subject: [PATCH 05/11] fix(sonar): coverage

---
 .github/workflows/ci.yml                      | 78 +++++++------------
 Makefile                                      | 19 ++---
 README.md                                     |  3 +-
 sonar-project.properties                      |  2 +-
 .../KeetaNet.Anchor.E2eTests.csproj           |  1 +
 5 files changed, 35 insertions(+), 68 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 385fd1f..0eb3399 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,6 +19,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
+        with:
+          # SonarCloud needs the parent branch information.
+          fetch-depth: 0
 
       - name: Set up .NET
         uses: actions/setup-dotnet@v4
@@ -62,7 +65,29 @@ jobs:
         run: dotnet build KeetaNet.Anchor.slnx -c Release --no-restore
 
       - name: Test
-        run: dotnet test KeetaNet.Anchor.slnx -c Release --no-build
+        run: >
+          dotnet test KeetaNet.Anchor.slnx -c Release --no-build
+          -- --coverage --coverage-output-format cobertura --coverage-output coverage.cobertura.xml
+
+      # Run SonarCloud on the coverage this test run
+      - name: Convert coverage to SonarQube format
+        if: matrix.os == 'ubuntu-latest-l' && github.repository == 'KeetaNetwork/anchor-csharp'
+        run: |
+          dotnet tool install --global dotnet-reportgenerator-globaltool
+          reportgenerator \
+            "-reports:**/TestResults/**/coverage.cobertura.xml" \
+            "-targetdir:.sonar-coverage" \
+            "-reporttypes:SonarQube"
+
+      - name: SonarCloud Scan
+        if: matrix.os == 'ubuntu-latest-l' && github.repository == 'KeetaNetwork/anchor-csharp'
+        uses: SonarSource/sonarqube-scan-action@689fb39b34b9aa95ebc5f8f119343ddd51542402 # v4.2.2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        with:
+          args: >
+            -Dproject.settings=./sonar-project.properties
 
   lint:
     name: Lint
@@ -146,54 +171,3 @@ jobs:
             echo "::error::Vulnerable packages found"
             exit 1
           fi
-
-  sonar:
-    name: SonarCloud
-    runs-on: ubuntu-latest-l
-    if: github.repository == 'KeetaNetwork/anchor-csharp'
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Set up .NET
-        uses: actions/setup-dotnet@v4
-        with:
-          global-json-file: global.json
-
-      - name: Set up Rust
-        uses: dsherret/rust-toolchain-file@3551321aa44dd44a0393eb3b6bdfbc5d25ecf621 # v1
-
-      - name: Cache wasm build
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cargo/registry
-            ~/.cargo/git
-            .wasm-build
-          key: wasm-${{ runner.os }}-${{ hashFiles('scripts/build-wasm.sh', 'rust-toolchain.toml') }}
-
-      - name: Build wasm core
-        run: bash scripts/build-wasm.sh
-
-      - name: Test with coverage
-        run: >
-          dotnet test tests/KeetaNet.Anchor.Tests/KeetaNet.Anchor.Tests.csproj -c Release
-          -- --coverage --coverage-output-format cobertura --coverage-output coverage.cobertura.xml
-
-      - name: Convert coverage to SonarQube format
-        run: |
-          dotnet tool install --global dotnet-reportgenerator-globaltool
-          reportgenerator \
-            "-reports:**/TestResults/**/coverage.cobertura.xml" \
-            "-targetdir:.sonar-coverage" \
-            "-reporttypes:SonarQube"
-
-      - name: SonarCloud Scan
-        uses: SonarSource/sonarqube-scan-action@689fb39b34b9aa95ebc5f8f119343ddd51542402 # v4.2.2
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-        with:
-          args: >
-            -Dproject.settings=./sonar-project.properties
diff --git a/Makefile b/Makefile
index 962139c..53b7a3f 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: help developer restore build rebuild do-lint do-lint-ci test coverage pack clean wasm node-harness release
+.PHONY: help developer restore build rebuild do-lint do-lint-ci test pack clean wasm node-harness release
 
 # Build configuration (Debug or Release)
 CONFIG ?= Release
@@ -6,9 +6,6 @@ CONFIG ?= Release
 # Solution under build
 SLN := KeetaNet.Anchor.slnx
 
-# Unit test project
-UNIT_TESTS := tests/KeetaNet.Anchor.Tests/KeetaNet.Anchor.Tests.csproj
-
 # TypeScript interop harness (reference anchor + in-memory test node)
 HARNESS_DIR := tests/node-harness
 HARNESS_SOURCES := $(wildcard $(HARNESS_DIR)/src/*.ts)
@@ -44,9 +41,11 @@ do-lint-ci: node-harness
 	npx --yes cspell --config cspell.yaml --no-progress "src/**/*.cs" "tests/**/*.cs" "tests/node-harness/src/**" "scripts/**" "Makefile" "*.md"
 	cd $(HARNESS_DIR) && npm run lint
 
-# Run all tests: unit + e2e against the live TypeScript reference anchor
+# Run all tests (unit + e2e against the live TypeScript reference anchor)
+# with code coverage (cobertura, for SonarCloud conversion)
 test: build node-harness
-	dotnet test $(SLN) -c $(CONFIG) --no-build
+	dotnet test $(SLN) -c $(CONFIG) --no-build \
+		-- --coverage --coverage-output-format cobertura --coverage-output coverage.cobertura.xml
 
 # Build the TypeScript harnesses (installs deps + compiles every entry)
 $(HARNESS_DIR)/node_modules/.package-lock.json: $(HARNESS_DIR)/package-lock.json
@@ -58,11 +57,6 @@ $(HARNESS_DIR)/dist/.built: $(HARNESS_DIR)/node_modules/.package-lock.json $(HAR
 
 node-harness: $(HARNESS_DIR)/dist/.built
 
-# Run unit tests with code coverage (cobertura, for SonarCloud conversion)
-coverage: build
-	dotnet test $(UNIT_TESTS) -c $(CONFIG) --no-build \
-		-- --coverage --coverage-output-format cobertura --coverage-output coverage.cobertura.xml
-
 # Produce the NuGet packages (.nupkg + .snupkg)
 pack: build
 	dotnet pack $(SLN) -c Release --no-build -o $(ARTIFACTS)
@@ -104,9 +98,8 @@ help:
 	@echo "  make restore      - Restore NuGet dependencies"
 	@echo "  make build        - Build the solution (CONFIG=$(CONFIG))"
 	@echo "  make rebuild      - Clean then build"
-	@echo "  make test         - Run all tests (builds node-harness; unit + e2e)"
+	@echo "  make test         - Run all tests with coverage (builds node-harness; unit + e2e)"
 	@echo "  make node-harness - Install + build the TypeScript interop harnesses"
-	@echo "  make coverage     - Run unit tests with code coverage"
 	@echo "  make do-lint      - Lint code with formatting fixes (C# + harness + spelling)"
 	@echo "  make pack         - Produce the NuGet packages into $(ARTIFACTS)/"
 	@echo "  make wasm         - Build the P1 wasm core from the pinned crates.io release"
diff --git a/README.md b/README.md
index 4fd22e4..07e58b9 100644
--- a/README.md
+++ b/README.md
@@ -27,9 +27,8 @@ Use the `Makefile`, not raw `dotnet`, for every task:
 | Command | Purpose |
 | --- | --- |
 | `make build` | Build the solution (builds the wasm core first if missing) |
-| `make test` | Run all tests: unit + e2e against the live TypeScript anchor |
+| `make test` | Run all tests with coverage: unit + e2e against the live TypeScript anchor |
 | `make node-harness` | Install + build the TypeScript interop harnesses |
-| `make coverage` | Run unit tests with code coverage |
 | `make do-lint` | Lint with formatting fixes (C#, spelling, harness) |
 | `make do-lint-ci` | Lint for CI (check only, no fixes) |
 | `make pack` | Produce the NuGet package |
diff --git a/sonar-project.properties b/sonar-project.properties
index 1c0caea..efd88d0 100644
--- a/sonar-project.properties
+++ b/sonar-project.properties
@@ -6,7 +6,7 @@ sonar.organization=keetapay
 sonar.sources=src
 sonar.tests=tests
 
-# Coverage (cobertura from `make coverage`, converted by ReportGenerator)
+# Coverage (cobertura from `make test`, converted by ReportGenerator)
 sonar.coverageReportPaths=.sonar-coverage/SonarQube.xml
 
 # Exclusions
diff --git a/tests/KeetaNet.Anchor.E2eTests/KeetaNet.Anchor.E2eTests.csproj b/tests/KeetaNet.Anchor.E2eTests/KeetaNet.Anchor.E2eTests.csproj
index 8fcd886..dff3e0f 100644
--- a/tests/KeetaNet.Anchor.E2eTests/KeetaNet.Anchor.E2eTests.csproj
+++ b/tests/KeetaNet.Anchor.E2eTests/KeetaNet.Anchor.E2eTests.csproj
@@ -10,6 +10,7 @@
 
 	<ItemGroup>
 		<PackageReference Include="xunit.v3" />
+		<PackageReference Include="Microsoft.Testing.Extensions.CodeCoverage" />
 	</ItemGroup>
 
 	<ItemGroup>

From 5732c00a43b9a1ebc28ab985ea3c76a432a25885 Mon Sep 17 00:00:00 2001
From: Tanveer Wahid <twahid@keeta.com>
Date: Thu, 2 Jul 2026 18:42:12 -0700
Subject: [PATCH 06/11] test: improve coverage

---
 tests/KeetaNet.Anchor.Tests/CryptoTests.cs | 72 ++++++++++++++++++++++
 tests/KeetaNet.Anchor.Tests/IssueTests.cs  | 31 ++++++++++
 2 files changed, 103 insertions(+)

diff --git a/tests/KeetaNet.Anchor.Tests/CryptoTests.cs b/tests/KeetaNet.Anchor.Tests/CryptoTests.cs
index 7914213..4078c9d 100644
--- a/tests/KeetaNet.Anchor.Tests/CryptoTests.cs
+++ b/tests/KeetaNet.Anchor.Tests/CryptoTests.cs
@@ -45,6 +45,62 @@ public void EncryptToSelfRoundTrips(string algorithm)
 		Assert.Equal(secret, decrypted);
 	}
 
+	[Fact]
+	public void ReadOnlyAccountsShareTheSignerIdentityButCannotSign()
+	{
+		using var runtime = WasmRuntime.Load();
+		using Account signer = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, TestSeeds.DefaultAlgorithm);
+
+		byte[] message = Encoding.UTF8.GetBytes("watch-only verification");
+		byte[] signature = signer.Sign(message);
+
+		// An address-parsed account is the same identity and verifies the
+		// signer's work, but carries no key material to sign with.
+		using Account fromAccount = runtime.Accounts.FromAccount(signer.Address);
+		Assert.Equal(signer.Address, fromAccount.Address);
+		Assert.True(fromAccount.Verify(message, signature));
+		Assert.Throws<KeetaException>(() => fromAccount.Sign(message));
+
+		// `PublicKey` is type-prefixed transport hex. `FromPublicKey` takes the
+		// raw key with the algorithm named separately, so drop the type byte.
+		string rawPublicKey = signer.PublicKey[2..];
+		using Account fromPublicKey = runtime.Accounts.FromPublicKey(rawPublicKey, TestSeeds.DefaultAlgorithm);
+		Assert.Equal(signer.Address, fromPublicKey.Address);
+		Assert.True(fromPublicKey.Verify(message, signature));
+	}
+
+	[Fact]
+	public void ImportedPrivateKeyYieldsAWorkingSignerWithAStablePublicIdentity()
+	{
+		using var runtime = WasmRuntime.Load();
+		using Account imported = runtime.Accounts.FromPrivateKey(TestSeeds.Issuer, TestSeeds.DefaultAlgorithm);
+
+		Assert.StartsWith("keeta_", imported.Address, StringComparison.Ordinal);
+
+		byte[] message = Encoding.UTF8.GetBytes("imported key signer");
+		byte[] signature = imported.Sign(message);
+		Assert.True(imported.Verify(message, signature));
+
+		// The public half round-trips to the same on-ledger identity.
+		string rawPublicKey = imported.PublicKey[2..];
+		using Account publicHalf = runtime.Accounts.FromPublicKey(rawPublicKey, TestSeeds.DefaultAlgorithm);
+		Assert.Equal(imported.Address, publicHalf.Address);
+	}
+
+	[Fact]
+	public void GeneratedSeedsAreUniqueAndDeriveSigners()
+	{
+		using var runtime = WasmRuntime.Load();
+
+		string first = runtime.Accounts.GenerateRandomSeed();
+		string second = runtime.Accounts.GenerateRandomSeed();
+		Assert.NotEqual(first, second);
+
+		using Account account = runtime.Accounts.FromSeed(first, 0, TestSeeds.DefaultAlgorithm);
+		byte[] message = Encoding.UTF8.GetBytes("generated seed signer");
+		Assert.True(account.Verify(message, account.Sign(message)));
+	}
+
 	[Fact]
 	public void GeneratedPassphraseDerivesASigner()
 	{
@@ -80,6 +136,22 @@ public void FixtureCertificateExposesItsFields()
 		Assert.Equal(subject.PublicKey, certificate.SubjectPublicKey);
 	}
 
+	[Fact]
+	public void FixtureCertificateRoundTripsThroughDer()
+	{
+		using var runtime = WasmRuntime.Load();
+		using CryptoCertificate parsed = runtime.Certificates.Parse(KycFixture.Pem);
+
+		byte[] der = parsed.ToDer();
+		Assert.NotEmpty(der);
+
+		// Both transport encodings describe the same certificate.
+		using CryptoCertificate reparsed = runtime.Certificates.ParseDer(der);
+		Assert.Equal(parsed.Serial, reparsed.Serial);
+		Assert.Equal(parsed.Subject, reparsed.Subject);
+		Assert.Equal(parsed.ToPem(), reparsed.ToPem());
+	}
+
 	[Fact]
 	public void FixtureKycCertificateReadsAndDecryptsAttributes()
 	{
diff --git a/tests/KeetaNet.Anchor.Tests/IssueTests.cs b/tests/KeetaNet.Anchor.Tests/IssueTests.cs
index 8f2fd22..8f93ab4 100644
--- a/tests/KeetaNet.Anchor.Tests/IssueTests.cs
+++ b/tests/KeetaNet.Anchor.Tests/IssueTests.cs
@@ -51,4 +51,35 @@ public void IssuedLeafRoundTripsEveryAttributeShape(string subjectAlgorithm)
 		JsonElement addressPostalCode = decodedAddress.GetProperty("postalCode");
 		Assert.Equal("34677", addressPostalCode.GetString());
 	}
+
+	[Fact]
+	public void WrongShapeAccessorsRejectWithTheDecodeCode()
+	{
+		using var runtime = WasmRuntime.Load();
+		using Account subject = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, TestSeeds.DefaultAlgorithm);
+		using Account issuer = runtime.Accounts.FromSeed(TestSeeds.Issuer, 0, "ecdsa_secp256k1");
+
+		using KycCertificate leaf = runtime.KycCertificates.Builder()
+			.Subject(subject)
+			.Issuer(issuer)
+			.SubjectName("Subject")
+			.IssuerName("Issuer")
+			.Serial(7)
+			.Validity(TestSeeds.NotBefore, TestSeeds.NotAfter)
+			.SetAttribute("email", sensitive: true, "user@example.com")
+			.Build();
+
+		KycAttributeValue email = leaf.GetAttribute("email", subject);
+
+		// An email is neither a timestamp nor JSON; each typed accessor must
+		// refuse with the stable decode code instead of returning garbage.
+		KeetaException notATimestamp = Assert.Throws<KeetaException>(() => email.AsTimestamp());
+		Assert.Equal("ATTRIBUTE_DECODE", notATimestamp.Code);
+
+		KeetaException notJson = Assert.Throws<KeetaException>(() => email.AsJson());
+		Assert.Equal("ATTRIBUTE_DECODE", notJson.Code);
+
+		// The undecoded bytes stay reachable regardless of decode failures.
+		Assert.Equal("user@example.com", Encoding.UTF8.GetString(email.Buffer));
+	}
 }

From 9d85b57f9e2e7190cf8f601f852514c6a9012acd Mon Sep 17 00:00:00 2001
From: Tanveer Wahid <twahid@keeta.com>
Date: Thu, 2 Jul 2026 18:49:26 -0700
Subject: [PATCH 07/11] fix: public key and type

---
 README.md                                     |  5 ++-
 src/KeetaNet.Anchor/Crypto/Account.cs         |  8 +++-
 src/KeetaNet.Anchor/Crypto/AccountFactory.cs  | 39 ++++++++++++++++-
 src/KeetaNet.Anchor/Crypto/Certificate.cs     |  2 +-
 .../ContainerInteropTests.cs                  |  4 +-
 tests/KeetaNet.Anchor.Tests/ContainerTests.cs |  4 +-
 tests/KeetaNet.Anchor.Tests/CryptoTests.cs    | 42 ++++++++++++++-----
 tests/KeetaNet.Anchor.Tests/SharableTests.cs  |  2 +-
 8 files changed, 85 insertions(+), 21 deletions(-)

diff --git a/README.md b/README.md
index 07e58b9..7405f00 100644
--- a/README.md
+++ b/README.md
@@ -79,7 +79,10 @@ string seed = runtime.Accounts.GenerateRandomSeed();
 using Account signer = runtime.Accounts.FromSeed(seed, index: 0, algorithm: "ed25519");
 
 Console.WriteLine(signer.Address);   // keeta_...
-Console.WriteLine(signer.PublicKey); // type-prefixed hex
+Console.WriteLine(signer.PublicKeyAndType); // type-prefixed hex
+
+// A watch-only view of the same identity, from the transport key.
+using Account watchOnly = runtime.Accounts.FromPublicKeyAndType(signer.PublicKeyAndType);
 
 // Sign and verify.
 byte[] message = "attest this"u8.ToArray();
diff --git a/src/KeetaNet.Anchor/Crypto/Account.cs b/src/KeetaNet.Anchor/Crypto/Account.cs
index 1c2da2c..292256f 100644
--- a/src/KeetaNet.Anchor/Crypto/Account.cs
+++ b/src/KeetaNet.Anchor/Crypto/Account.cs
@@ -17,8 +17,12 @@ internal Account(WasmRuntime runtime, int handle)
 	/// <summary>The account's algorithm name.</summary>
 	public string Algorithm => Runtime.AccountAlgorithm(Handle);
 
-	/// <summary>The account's type-prefixed public key (hex).</summary>
-	public string PublicKey => Runtime.AccountPublicKey(Handle);
+	/// <summary>
+	/// The account's type-prefixed public key transport hex: the lead byte
+	/// names the algorithm, the rest is the raw public key. Feeds
+	/// <see cref="AccountFactory.FromPublicKeyAndType"/>.
+	/// </summary>
+	public string PublicKeyAndType => Runtime.AccountPublicKey(Handle);
 
 	/// <summary>Sign <paramref name="message"/> with the account's private key.</summary>
 	public byte[] Sign(byte[] message) => Runtime.AccountSign(Handle, message);
diff --git a/src/KeetaNet.Anchor/Crypto/AccountFactory.cs b/src/KeetaNet.Anchor/Crypto/AccountFactory.cs
index 05c1219..5be11b6 100644
--- a/src/KeetaNet.Anchor/Crypto/AccountFactory.cs
+++ b/src/KeetaNet.Anchor/Crypto/AccountFactory.cs
@@ -42,13 +42,39 @@ public Account FromPassphrase(IEnumerable<string> words, uint index, string algo
 		return new(_runtime, handle);
 	}
 
-	/// <summary>Build a read-only account from a hex <paramref name="publicKey"/>.</summary>
+	/// <summary>Build a read-only account from a raw hex <paramref name="publicKey"/> and its <paramref name="algorithm"/>.</summary>
 	public Account FromPublicKey(string publicKey, string algorithm)
 	{
 		int handle = _runtime.AccountFromPublicKey(publicKey, algorithm);
 		return new(_runtime, handle);
 	}
 
+	/// <summary>
+	/// Build a read-only account from type-prefixed transport hex, as returned
+	/// by <see cref="Account.PublicKeyAndType"/>.
+	/// </summary>
+	public Account FromPublicKeyAndType(string publicKeyAndType)
+	{
+		byte[] keyData;
+		try
+		{
+			keyData = Convert.FromHexString(publicKeyAndType);
+		}
+		catch (FormatException)
+		{
+			throw new KeetaException("INVALID_PUBLIC_KEY", "public key must be hex");
+		}
+
+		if (keyData.Length < 2)
+		{
+			throw new KeetaException("INVALID_PUBLIC_KEY", "public key is too short to carry a type byte and key");
+		}
+
+		string algorithm = AlgorithmFromTypeByte(keyData[0]);
+		string rawPublicKey = Convert.ToHexString(keyData.AsSpan(1));
+		return FromPublicKey(rawPublicKey, algorithm);
+	}
+
 	/// <summary>Generate a random hex seed.</summary>
 	public string GenerateRandomSeed() => _runtime.AccountGenerateSeed();
 
@@ -58,4 +84,15 @@ public IReadOnlyList<string> GeneratePassphrase()
 		string words = _runtime.AccountGeneratePassphrase();
 		return words.Split('\n', StringSplitOptions.RemoveEmptyEntries);
 	}
+
+	// The KeyPairType discriminants from the reference implementation. Identifier
+	// account types (network 2, token 3, storage 4, multisig 7) carry no signing
+	// key, so the core module cannot construct them from a public key.
+	private static string AlgorithmFromTypeByte(byte typeByte) => typeByte switch
+	{
+		0 => "ecdsa_secp256k1",
+		1 => "ed25519",
+		6 => "ecdsa_secp256r1",
+		_ => throw new KeetaException("INVALID_ALGORITHM", $"account type {typeByte} is not a supported signing algorithm"),
+	};
 }
diff --git a/src/KeetaNet.Anchor/Crypto/Certificate.cs b/src/KeetaNet.Anchor/Crypto/Certificate.cs
index d0ab09e..8c76c83 100644
--- a/src/KeetaNet.Anchor/Crypto/Certificate.cs
+++ b/src/KeetaNet.Anchor/Crypto/Certificate.cs
@@ -54,7 +54,7 @@ public DateTimeOffset NotAfter
 
 	/// <summary>
 	/// The subject public key, type-prefixed and hex-encoded to match
-	/// <see cref="Account.PublicKey"/>, so a subject can be matched to an account.
+	/// <see cref="Account.PublicKeyAndType"/>, so a subject can be matched to an account.
 	/// </summary>
 	public string SubjectPublicKey => Runtime.CertificateSubjectPublicKey(Handle);
 
diff --git a/tests/KeetaNet.Anchor.E2eTests/ContainerInteropTests.cs b/tests/KeetaNet.Anchor.E2eTests/ContainerInteropTests.cs
index 993796d..e87d1f8 100644
--- a/tests/KeetaNet.Anchor.E2eTests/ContainerInteropTests.cs
+++ b/tests/KeetaNet.Anchor.E2eTests/ContainerInteropTests.cs
@@ -46,7 +46,7 @@ public void CsharpDecryptsAndVerifiesTheTypescriptContainer()
 
 		byte[]? recoveredSigner = opened.GetSigningAccount();
 		Assert.NotNull(recoveredSigner);
-		Assert.Equal(tsSigner.PublicKey, Convert.ToHexString(recoveredSigner!), ignoreCase: true);
+		Assert.Equal(tsSigner.PublicKeyAndType, Convert.ToHexString(recoveredSigner!), ignoreCase: true);
 	}
 
 	[Fact(Skip = "known zlib compression divergence in the TS reference breaks C#-to-TS signature validation; quarantined pending an upstream compression-parity fix")]
@@ -74,7 +74,7 @@ public void TypescriptDecryptsAndVerifiesTheCsharpContainer()
 		Assert.True(decoded.GetProperty("isSigned").GetBoolean());
 		Assert.True(decoded.GetProperty("signatureValid").GetBoolean());
 		Assert.Equal(
-			signer.PublicKey,
+			signer.PublicKeyAndType,
 			decoded.GetProperty("signerPublicKey").GetString(),
 			ignoreCase: true);
 	}
diff --git a/tests/KeetaNet.Anchor.Tests/ContainerTests.cs b/tests/KeetaNet.Anchor.Tests/ContainerTests.cs
index 71881a3..ca41267 100644
--- a/tests/KeetaNet.Anchor.Tests/ContainerTests.cs
+++ b/tests/KeetaNet.Anchor.Tests/ContainerTests.cs
@@ -64,7 +64,7 @@ public void SignedContainerVerifiesAndRecoversItsSigner(string algorithm)
 
 		byte[]? recovered = restored.GetSigningAccount();
 		Assert.NotNull(recovered);
-		Assert.Equal(signer.PublicKey, Convert.ToHexString(recovered!), ignoreCase: true);
+		Assert.Equal(signer.PublicKeyAndType, Convert.ToHexString(recovered!), ignoreCase: true);
 	}
 
 	[Fact]
@@ -79,7 +79,7 @@ public void GrantAndRevokeCyclePrincipals()
 		container.GrantAccess(new[] { reader });
 		Assert.Equal(2, container.GetPrincipals().Count);
 
-		byte[] readerKey = Convert.FromHexString(reader.PublicKey);
+		byte[] readerKey = Convert.FromHexString(reader.PublicKeyAndType);
 		container.RevokeAccess(readerKey);
 		Assert.Single(container.GetPrincipals());
 	}
diff --git a/tests/KeetaNet.Anchor.Tests/CryptoTests.cs b/tests/KeetaNet.Anchor.Tests/CryptoTests.cs
index 4078c9d..b927f48 100644
--- a/tests/KeetaNet.Anchor.Tests/CryptoTests.cs
+++ b/tests/KeetaNet.Anchor.Tests/CryptoTests.cs
@@ -61,10 +61,8 @@ public void ReadOnlyAccountsShareTheSignerIdentityButCannotSign()
 		Assert.True(fromAccount.Verify(message, signature));
 		Assert.Throws<KeetaException>(() => fromAccount.Sign(message));
 
-		// `PublicKey` is type-prefixed transport hex. `FromPublicKey` takes the
-		// raw key with the algorithm named separately, so drop the type byte.
-		string rawPublicKey = signer.PublicKey[2..];
-		using Account fromPublicKey = runtime.Accounts.FromPublicKey(rawPublicKey, TestSeeds.DefaultAlgorithm);
+		// The type-prefixed transport key round-trips to the same identity.
+		using Account fromPublicKey = runtime.Accounts.FromPublicKeyAndType(signer.PublicKeyAndType);
 		Assert.Equal(signer.Address, fromPublicKey.Address);
 		Assert.True(fromPublicKey.Verify(message, signature));
 	}
@@ -81,12 +79,34 @@ public void ImportedPrivateKeyYieldsAWorkingSignerWithAStablePublicIdentity()
 		byte[] signature = imported.Sign(message);
 		Assert.True(imported.Verify(message, signature));
 
-		// The public half round-trips to the same on-ledger identity.
-		string rawPublicKey = imported.PublicKey[2..];
+		// The raw public half plus its algorithm names the same on-ledger identity.
+		string rawPublicKey = imported.PublicKeyAndType[2..];
 		using Account publicHalf = runtime.Accounts.FromPublicKey(rawPublicKey, TestSeeds.DefaultAlgorithm);
 		Assert.Equal(imported.Address, publicHalf.Address);
 	}
 
+	[Fact]
+	public void IdentifierTypedPublicKeysAreRejectedWithACodedError()
+	{
+		using var runtime = WasmRuntime.Load();
+		using Account signer = runtime.Accounts.FromSeed(TestSeeds.Subject, 0, TestSeeds.DefaultAlgorithm);
+
+		// A token identifier (type byte 3) carries no signing key, so the
+		// factory must refuse it rather than mislabel the algorithm.
+		string tokenTyped = "03" + signer.PublicKeyAndType[2..];
+		KeetaException rejected = Assert.Throws<KeetaException>(() =>
+		{
+			using Account unexpected = runtime.Accounts.FromPublicKeyAndType(tokenTyped);
+		});
+		Assert.Equal("INVALID_ALGORITHM", rejected.Code);
+
+		KeetaException notHex = Assert.Throws<KeetaException>(() =>
+		{
+			using Account unexpected = runtime.Accounts.FromPublicKeyAndType("not hex");
+		});
+		Assert.Equal("INVALID_PUBLIC_KEY", notHex.Code);
+	}
+
 	[Fact]
 	public void GeneratedSeedsAreUniqueAndDeriveSigners()
 	{
@@ -133,7 +153,7 @@ public void FixtureCertificateExposesItsFields()
 		Assert.Equal("12345", certificate.Serial);
 		Assert.True(certificate.NotBefore < certificate.NotAfter);
 		Assert.InRange(KycFixture.ValidAt, certificate.NotBefore, certificate.NotAfter);
-		Assert.Equal(subject.PublicKey, certificate.SubjectPublicKey);
+		Assert.Equal(subject.PublicKeyAndType, certificate.SubjectPublicKey);
 	}
 
 	[Fact]
@@ -146,10 +166,10 @@ public void FixtureCertificateRoundTripsThroughDer()
 		Assert.NotEmpty(der);
 
 		// Both transport encodings describe the same certificate.
-		using CryptoCertificate reparsed = runtime.Certificates.ParseDer(der);
-		Assert.Equal(parsed.Serial, reparsed.Serial);
-		Assert.Equal(parsed.Subject, reparsed.Subject);
-		Assert.Equal(parsed.ToPem(), reparsed.ToPem());
+		using CryptoCertificate fromDer = runtime.Certificates.ParseDer(der);
+		Assert.Equal(parsed.Serial, fromDer.Serial);
+		Assert.Equal(parsed.Subject, fromDer.Subject);
+		Assert.Equal(parsed.ToPem(), fromDer.ToPem());
 	}
 
 	[Fact]
diff --git a/tests/KeetaNet.Anchor.Tests/SharableTests.cs b/tests/KeetaNet.Anchor.Tests/SharableTests.cs
index 39c4f27..509a23e 100644
--- a/tests/KeetaNet.Anchor.Tests/SharableTests.cs
+++ b/tests/KeetaNet.Anchor.Tests/SharableTests.cs
@@ -58,7 +58,7 @@ public void RecipientReadsTheDisclosedBundleBack(string algorithm)
 
 		IReadOnlyList<byte[]> principals = opened.GetPrincipals();
 		Assert.Single(principals);
-		Assert.Equal(recipient.PublicKey, Convert.ToHexString(principals[0]), ignoreCase: true);
+		Assert.Equal(recipient.PublicKeyAndType, Convert.ToHexString(principals[0]), ignoreCase: true);
 
 		Assert.Equal(2, opened.GetAttributeNames().Count);
 	}

From 856a218b8bc05462ee48c4177dc0226d343523fa Mon Sep 17 00:00:00 2001
From: Tanveer Wahid <twahid@keeta.com>
Date: Thu, 2 Jul 2026 19:30:17 -0700
Subject: [PATCH 08/11] fix: windows gh action

---
 cspell.yaml           |  3 +++
 scripts/build-wasm.sh | 48 ++++++++++++++++++++++++++++++++-----------
 2 files changed, 39 insertions(+), 12 deletions(-)

diff --git a/cspell.yaml b/cspell.yaml
index b7ded19..e8f1005 100644
--- a/cspell.yaml
+++ b/cspell.yaml
@@ -60,3 +60,6 @@ words:
   - rasn
   - rustfmt
   - userprofile
+  - cygpath
+  - compgen
+  - codegen
diff --git a/scripts/build-wasm.sh b/scripts/build-wasm.sh
index 89b141d..501baab 100755
--- a/scripts/build-wasm.sh
+++ b/scripts/build-wasm.sh
@@ -27,24 +27,47 @@ checksum() {
 # rasn-compiler probes `$CARGO_HOME/bin/rustfmt` and `$CARGO`-adjacent
 # `rustfmt` without the .exe suffix. When both miss it silently emits
 # unformatted bindings that break the keetanetwork-asn1 build. Shim
-# extension-less copies for it.
+# extension-less copies at both probe paths and fail loudly when they
+# cannot be provisioned or executed.
 shim_rustfmt_for_windows() {
 	[[ "${OS:-}" == "Windows_NT" ]] || return 0
 
-	local cargo_bin="${CARGO_HOME:-${USERPROFILE}/.cargo}/bin"
-	if [[ -f "${cargo_bin}/rustfmt.exe" && ! -f "${cargo_bin}/rustfmt" ]]; then
-		echo "build-wasm: shimming extension-less rustfmt in ${cargo_bin}"
+	echo "build-wasm: windows rustfmt shim (CARGO_HOME=${CARGO_HOME:-<unset>})"
+
+	# `$CARGO` inside build scripts points at the toolchain's cargo, so the
+	# adjacent-probe directory is the toolchain bin, not the rustup proxies.
+	local toolchain_bin
+	toolchain_bin="$(dirname "$(cygpath -u "$(rustup which cargo)")")"
+	echo "build-wasm: toolchain bin is ${toolchain_bin}"
+
+	if [[ ! -f "${toolchain_bin}/rustfmt.exe" ]]; then
+		echo "build-wasm: rustfmt missing from the toolchain; installing the component"
+		rustup component add rustfmt
+	fi
+
+	cp "${toolchain_bin}/rustfmt.exe" "${toolchain_bin}/rustfmt"
+	"${toolchain_bin}/rustfmt" --version
+
+	# Cover the `$CARGO_HOME/bin` probe too, via the rustup proxy when one
+	# exists there (proxies dispatch on their basename).
+	local cargo_bin
+	cargo_bin="$(cygpath -u "${CARGO_HOME:-${USERPROFILE}/.cargo}")/bin"
+	if [[ -f "${cargo_bin}/rustfmt.exe" ]]; then
 		cp "${cargo_bin}/rustfmt.exe" "${cargo_bin}/rustfmt"
+		"${cargo_bin}/rustfmt" --version
 	fi
 
-	local toolchain_rustfmt
-	toolchain_rustfmt="$(rustup which rustfmt 2>/dev/null || true)"
-	if [[ "${toolchain_rustfmt}" == *.exe && -f "${toolchain_rustfmt}" ]]; then
-		local bare_rustfmt="${toolchain_rustfmt%.exe}"
-		if [[ ! -f "${bare_rustfmt}" ]]; then
-			echo "build-wasm: shimming extension-less rustfmt in the toolchain bin dir"
-			cp "${toolchain_rustfmt}" "${bare_rustfmt}"
-		fi
+	echo "build-wasm: bare rustfmt shims verified"
+}
+
+# A cached target dir can hold codegen output produced while rustfmt was
+# unreachable (actions/cache saves even from failed jobs). Purge the
+# keetanetwork-asn1 build-script outputs so its codegen always reruns.
+purge_stale_asn1_outputs() {
+	local build_root="${CRATE_DIR}/target/wasm32-wasip1/release"
+	if compgen -G "${build_root}/build/keetanetwork-asn1-*" >/dev/null; then
+		echo "build-wasm: purging cached keetanetwork-asn1 codegen so it reruns"
+		rm -rf "${build_root}"/build/keetanetwork-asn1-* "${build_root}"/.fingerprint/keetanetwork-asn1-*
 	fi
 }
 
@@ -100,6 +123,7 @@ build_artifact() {
 shim_rustfmt_for_windows
 require_wasip1_target
 fetch_crate
+purge_stale_asn1_outputs
 build_artifact
 
 mkdir -p "$(dirname "${DEST}")"

From 09c8eb3701b92de512691f3b5f1285bbd78de35a Mon Sep 17 00:00:00 2001
From: Tanveer Wahid <twahid@keeta.com>
Date: Thu, 2 Jul 2026 19:35:14 -0700
Subject: [PATCH 09/11] fix: another fix for windows ci

---
 cspell.yaml           |  4 ++++
 scripts/build-wasm.sh | 23 ++++++++++++++++++++---
 2 files changed, 24 insertions(+), 3 deletions(-)

diff --git a/cspell.yaml b/cspell.yaml
index e8f1005..8eccb7b 100644
--- a/cspell.yaml
+++ b/cspell.yaml
@@ -63,3 +63,7 @@ words:
   - cygpath
   - compgen
   - codegen
+  - msys
+  - conv
+  - excl
+  - maxdepth
diff --git a/scripts/build-wasm.sh b/scripts/build-wasm.sh
index 501baab..bd9c09d 100755
--- a/scripts/build-wasm.sh
+++ b/scripts/build-wasm.sh
@@ -45,7 +45,7 @@ shim_rustfmt_for_windows() {
 		rustup component add rustfmt
 	fi
 
-	cp "${toolchain_bin}/rustfmt.exe" "${toolchain_bin}/rustfmt"
+	copy_bare_rustfmt "${toolchain_bin}"
 	"${toolchain_bin}/rustfmt" --version
 
 	# Cover the `$CARGO_HOME/bin` probe too, via the rustup proxy when one
@@ -53,13 +53,30 @@ shim_rustfmt_for_windows() {
 	local cargo_bin
 	cargo_bin="$(cygpath -u "${CARGO_HOME:-${USERPROFILE}/.cargo}")/bin"
 	if [[ -f "${cargo_bin}/rustfmt.exe" ]]; then
-		cp "${cargo_bin}/rustfmt.exe" "${cargo_bin}/rustfmt"
-		"${cargo_bin}/rustfmt" --version
+		copy_bare_rustfmt "${cargo_bin}"
 	fi
 
 	echo "build-wasm: bare rustfmt shims verified"
 }
 
+# MSYS transparently resolves an extension-less `rustfmt` path to
+# `rustfmt.exe`, so POSIX tools cannot create the bare copy (cp reports
+# "same file") and `-f` checks lie. Copy with Windows-native cmd, which
+# writes the literal name, and verify via directory entries.
+copy_bare_rustfmt() {
+	local bin_dir="$1"
+	local src dest
+	src="$(cygpath -w "${bin_dir}/rustfmt.exe")"
+	dest="$(cygpath -w "${bin_dir}/rustfmt")"
+	MSYS2_ARG_CONV_EXCL="*" cmd /c copy /y "${src}" "${dest}" >/dev/null
+
+	if [[ -z "$(find "${bin_dir}" -maxdepth 1 -name rustfmt)" ]]; then
+		echo "build-wasm: failed to shim bare rustfmt in ${bin_dir}" >&2
+		exit 1
+	fi
+	echo "build-wasm: bare rustfmt shimmed in ${bin_dir}"
+}
+
 # A cached target dir can hold codegen output produced while rustfmt was
 # unreachable (actions/cache saves even from failed jobs). Purge the
 # keetanetwork-asn1 build-script outputs so its codegen always reruns.

From cacda624cfcbbd275c3b73b243fa7b975a84bf70 Mon Sep 17 00:00:00 2001
From: Tanveer Wahid <twahid@keeta.com>
Date: Thu, 2 Jul 2026 19:44:06 -0700
Subject: [PATCH 10/11] fix: another attempt for windows ci

---
 cspell.yaml           | 3 +--
 scripts/build-wasm.sh | 6 +++---
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/cspell.yaml b/cspell.yaml
index 8eccb7b..561b183 100644
--- a/cspell.yaml
+++ b/cspell.yaml
@@ -64,6 +64,5 @@ words:
   - compgen
   - codegen
   - msys
-  - conv
-  - excl
   - maxdepth
+  - powershell
diff --git a/scripts/build-wasm.sh b/scripts/build-wasm.sh
index bd9c09d..8e9be37 100755
--- a/scripts/build-wasm.sh
+++ b/scripts/build-wasm.sh
@@ -61,14 +61,14 @@ shim_rustfmt_for_windows() {
 
 # MSYS transparently resolves an extension-less `rustfmt` path to
 # `rustfmt.exe`, so POSIX tools cannot create the bare copy (cp reports
-# "same file") and `-f` checks lie. Copy with Windows-native cmd, which
-# writes the literal name, and verify via directory entries.
+# "same file") and `-f` checks lie. Copy with PowerShell, which uses the
+# literal name, and verify via directory entries.
 copy_bare_rustfmt() {
 	local bin_dir="$1"
 	local src dest
 	src="$(cygpath -w "${bin_dir}/rustfmt.exe")"
 	dest="$(cygpath -w "${bin_dir}/rustfmt")"
-	MSYS2_ARG_CONV_EXCL="*" cmd /c copy /y "${src}" "${dest}" >/dev/null
+	powershell -NoProfile -Command "Copy-Item -LiteralPath '${src}' -Destination '${dest}' -Force"
 
 	if [[ -z "$(find "${bin_dir}" -maxdepth 1 -name rustfmt)" ]]; then
 		echo "build-wasm: failed to shim bare rustfmt in ${bin_dir}" >&2

From 42be5299ccf5cbbb190da3c4c2e0ba5ecefe2cd1 Mon Sep 17 00:00:00 2001
From: Tanveer Wahid <twahid@keeta.com>
Date: Thu, 2 Jul 2026 19:46:23 -0700
Subject: [PATCH 11/11] fix(ci): another issue

---
 scripts/build-wasm.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/build-wasm.sh b/scripts/build-wasm.sh
index 8e9be37..7f9af07 100755
--- a/scripts/build-wasm.sh
+++ b/scripts/build-wasm.sh
@@ -67,7 +67,7 @@ copy_bare_rustfmt() {
 	local bin_dir="$1"
 	local src dest
 	src="$(cygpath -w "${bin_dir}/rustfmt.exe")"
-	dest="$(cygpath -w "${bin_dir}/rustfmt")"
+	dest="$(cygpath -w "${bin_dir}")/rustfmt"
 	powershell -NoProfile -Command "Copy-Item -LiteralPath '${src}' -Destination '${dest}' -Force"
 
 	if [[ -z "$(find "${bin_dir}" -maxdepth 1 -name rustfmt)" ]]; then