[DIS] FiberLatch Access - Open-Source Access Control for Fiber Payments

DAOs & Funding CKB Community Fund DAO
, ,
6

FiberLatch Access — Weeks 5–6 / Final Completion Report

Hi everyone,

This is the final update for the six-week FiberLatch Access grant.

The goal of the grant was to take the reusable access-control part of the earlier FiberLatch work and turn it into something another Node.js developer could install, understand, test, and use without depending on the full FiberLatch backend.

That work is now complete.

What was delivered

The approved grant scope covered:

  • FiberLatch Access scope and design — Complete

  • Access receipt format — Complete

  • Expiration and replay-protection rules — Complete

  • Signing and verification rules — Complete

  • Lightweight reusable Node.js package — Complete

  • Paid-resource example — Complete

  • Documentation, testing, cleanup, and final report — Complete

The reusable package is now publicly available on npm:

@fiberlatch/[email protected]

npm install @fiberlatch/access

FiberLatch Access lets an application take a payment or business decision it already trusts and issue a signed access receipt for a specific user, resource, policy, and intent.

When that receipt is presented later, the application can verify it, check it against trusted request context, and record its use through application-owned atomic storage.

Weeks 5–6

The main implementation was already in place after Weeks 3–4, so the final two weeks focused on making sure the package worked properly outside the FiberLatch repository.

That included:

  • publishing @fiberlatch/access publicly on npm

  • improving the adopter-facing package documentation

  • validating ESM, CommonJS, and TypeScript consumers

  • testing the paid-resource example against the packaged distribution

  • reconciling and cleaning up the technical documentation

  • running the final Node 22 and Node 24 CI

  • publishing the final 0.1.1 polish release

  • installing 0.1.1 directly from the public npm registry in a completely separate consumer and verifying the actual published package

The final registry verification did not use the FiberLatch workspace or a local tarball.

It tested the same package another developer gets from npm.

Final verification

The completed delivery was verified with:

  • 235 access-package tests

  • 12 paid-resource example tests

  • 57 historical backend regression tests

  • Node 22 and Node 24 CI

  • package build and type validation

  • ESM imports

  • CommonJS usage

  • TypeScript declarations

  • access receipt claim construction

  • Ed25519 signing and verification

  • trusted binding checks

  • successful first redemption

  • repeat use of a single-redemption receipt denied as receipt_exhausted

Paid-resource example

The repository includes a runnable paid-resource example showing the intended integration boundary.

The example starts from a server-side payment decision that the host application already trusts, issues an access receipt, allows the first protected-resource request, and denies reuse of the same receipt.

The payment in this example is intentionally demo data.

The earlier FiberLatch work had already proven the live Fiber testnet payment-to-access path before this grant. This grant focused on extracting that reusable access layer rather than rebuilding or claiming the earlier backend work again.

Responsibility boundary

One important boundary remains:

FiberLatch Access does not determine whether a payment happened.

The host application is responsible for establishing payment or business trust before issuing a receipt.

The host also owns:

  • trusted user and resource context

  • signing and verification key configuration

  • persistent and atomic redemption state

  • revocation

  • the final decision to serve or deny a protected resource

payment_ref can reference the application’s payment record, but it is not payment proof by itself.

The package also does not claim to provide a payment SDK, hosted service, production database adapter, browser SDK, production/mainnet readiness, or a formal security audit.

Keeping the package focused on the access boundary was part of the original scope.

Final links

The final package release source is:

cac78216a803b5e287fa5c92ad0270226caf35e1

The final grant documentation closeout is:

ce60df74ae38f7d0ec8a1620b3cd007e4abb25ce

That completes the technical, package, example, testing, and documentation scope from the FiberLatch Access proposal.

Thanks to everyone who reviewed the proposal, gave feedback, and followed the progress over the six weeks.

Submitting this as the final completion report for review.

6 Likes
CKB Ecosystem Biweekly Update