@zanii/kyb

Owner-to-legal-entity binding: who is legally on the hook? @zanii/kya screens agents; @zanii/credentials binds institutions to domains. This closes the gap between them — binding an owner did:key to a legal entity, so escrow, insurance, and sla parties know who they are contracting with in the legal sense.

npm install @zanii/kyb @zanii/core

The binding is deliberately two-way — one-sided claims are refused:

// 1. the company serves https://acme.com/.well-known/zanii-owner.json
{ "v": 1,
  "entity": { "name": "Acme FZ-LLC", "jurisdiction": "AE-DU", "registration": "DED-12345" },
  "domain": "acme.com",
  "owner_dids": ["did:key:z6Mk…"] }

import { buildOwnerAttestation, fetchAndVerifyOwner } from '@zanii/kyb';

// 2. the owner signs the other half — this key claims this domain and entity
const attestation = buildOwnerAttestation(
  { did: owner.did, domain: 'acme.com', entity: { name: 'Acme FZ-LLC' }, ts: now },
  ownerPrivateKey,
);

// 3. anyone verifies both halves agree
const r = await fetchAndVerifyOwner(attestation);
r.ok;       // signed by the DID + listed by the domain + same entity on both sides
r.entity;   // the entity BOTH sides agree on

Python: from zanii.kyb import build_owner_attestation, fetch_and_verify_owner, ... — byte-identical JCS objects and hashes.

Why two-way

A domain listing a DID proves nothing alone — anyone can list any DID. A key naming a domain proves nothing alone — anyone can name any domain. Both together bind: whoever controls the domain and whoever controls the key agree they are the same entity. The doc must be served from the domain it claims (no cross-domain vouching), entity names must match exactly, and jurisdiction/registration must agree wherever both sides state them (silence on a field is not a mismatch).

The limit, stated up front

Domain control is not corporate registration. Zanii verifies that both sides claim the same entity — it does NOT verify the entity exists in a corporate registry, is solvent, or is lawfully named. Real KYB (registry checks, sanctions, UBO) is an off-protocol process this package makes auditable: the attestation is signed and permanent, so a false claim is attributable forever. We verify domain control; we never certify companies — the @zanii/credentials posture, unchanged.