feat(auth): use medium keys for Yappr document operations

components/auth/add-encryption-key-modal.tsx

@@ -31,7 +31,7 @@ type Step = 'checking' | 'existing-key' | 'enter-existing' | 'intro' | 'generate
  * Implements PRD §6.2 - Key Addition Flow
  *
  * NOTE: Adding an encryption key to an identity requires a MASTER
- * security level key for signing. The typical HIGH security level login key
+ * security level key for signing. The typical MEDIUM security level login key
  * is insufficient for identity modifications on Dash Platform (SDK dev.11+).
  */
 export function AddEncryptionKeyModal({

components/auth/key-login-form.tsx

@@ -411,7 +411,7 @@ export function KeyLoginForm({ onComplete }: KeyLoginFormProps) {
       {/* Password or Private Key Input */}
       <div>
         <label htmlFor="loginCredential" className="block text-sm font-medium text-gray-700 dark:text-gray-300 mb-1">
-          {hasOnchainBackup ? 'Password or private key' : 'Private key (high or critical)'}
+          {hasOnchainBackup ? 'Password or private key' : 'Private key (medium, high or critical)'}
         </label>
         <motion.div
           className="relative"

components/auth/key-registration-flow.tsx

@@ -102,7 +102,7 @@ export function KeyRegistrationFlow({
               <ul className="text-xs text-gray-600 dark:text-gray-300 space-y-1">
                 <li className="flex items-center gap-2">
                   <span className="w-2 h-2 bg-green-500 rounded-full" />
-                  Authentication key (HIGH security)
+                  Authentication key (MEDIUM security)
                 </li>
                 <li className="flex items-center gap-2">
                   <span className="w-2 h-2 bg-blue-500 rounded-full" />

components/auth/wallet-login-panel.tsx

@@ -80,7 +80,7 @@ async function shouldOfferPasskeyEnrollment(identityId: string): Promise<boolean
  * - complete: success, then `onComplete`
  * - timeout / error: check again
  *
- * A wallet login yields a HIGH key, which can post but not buy YAPP; only the
+ * A wallet login yields a MEDIUM key, which can post but not buy YAPP; only the
  * wallet holds the CRITICAL key. So when the account is ready but can't afford
  * a post, the Buy-YAPP modal opens in wallet-signing mode as this panel goes
  * away, while the wallet is still in hand.

components/token/buy-yapp-modal.tsx

@@ -58,7 +58,7 @@ const WALLET_SIGN_TIMEOUT_MS = 300000
 export function BuyYappModal() {
   const { isOpen, reason, signing, close } = useBuyYappModal()
   // Opened for a wallet-login user: skip local signing (their login key is
-  // HIGH and can't spend) and the paste-a-CRITICAL-key screen, and go straight
+  // MEDIUM and can't spend) and the paste-a-CRITICAL-key screen, and go straight
   // to the dash-st: QR the wallet that just logged them in can approve.
   const preferWallet = signing === 'wallet'
   const { user, refreshBalance } = useAuth()
@@ -71,7 +71,7 @@ export function BuyYappModal() {
   const [pricePerToken, setPricePerToken] = useState<bigint | null>(null)
   const [loading, setLoading] = useState(false)
   const [showCosts, setShowCosts] = useState(false)
-  // CRITICAL key the user pastes when their login key is HIGH — kept in
+  // CRITICAL key the user pastes when their login key is MEDIUM or HIGH — kept in
   // component state only for the purchase, never persisted.
   const [criticalKeyWif, setCriticalKeyWif] = useState('')
   const [showKeyEntry, setShowKeyEntry] = useState(false)
@@ -164,7 +164,7 @@ export function BuyYappModal() {
       tokenService.getBalance(user.identityId).then(setYappBalance).catch(() => {})
       finishPurchase()
     } else if (result.errorCode === 'NEEDS_CRITICAL_KEY') {
-      // Login key is HIGH but purchases must be signed with CRITICAL — ask for
+      // Login key is MEDIUM or HIGH but purchases must be signed with CRITICAL — ask for
       // it. If a key was already entered, it didn't match a CRITICAL key.
       setError(enteredKey ? 'That key doesn\'t match a critical key on your identity. Check it and try again.' : null)
       setShowKeyEntry(Boolean(enteredKey))

contracts/README.md

@@ -1,10 +1,32 @@
 # Yappr Data Contracts
 
-Dash Platform data contracts used by the Yappr dapp. The JSON here is the
-source of record for what was registered; deployed contract ids live in
+Dash Platform data contracts used by the Yappr dapp. These JSON files are
+templates for fresh registration; deployed contract ids live in
 `lib/constants.ts` (testnet defaults) and the `.env.*` files (per-deployment
 overrides).
 
+## Authentication keys
+
+Every document type in these templates explicitly permits MEDIUM authentication
+keys (`signatureSecurityLevelRequirement: 3`), including writes with YAPP fees.
+HIGH and CRITICAL authentication keys remain usable. The clone-based feature
+and test registration scripts apply the same setting to all fetched schemas,
+including types that are absent from older local snapshots.
+
+This setting is for the upcoming fresh deployment. Existing contract IDs retain
+their original requirements; Platform does not allow changing a document type's
+security level in place. The deployment tables below describe existing instances.
+
+Wallet key registration (`dash-st:`) now adds a MEDIUM authentication key and a
+MEDIUM encryption key. The initial `dash-key:` exchange only requests the login
+secret; its v1 format has no security-level field. Existing registered HIGH or
+CRITICAL login keys continue working.
+
+DPNS registration still requires HIGH or CRITICAL authentication. Explicit token
+operations (including buying YAPP) require CRITICAL, credit tips use TRANSFER,
+and identity updates require MASTER. These are Platform requirements, independent
+of the application document schemas.
+
 ## Social contract
 
 | File | Status |

contracts/encrypted-key-backup-contract.json

@@ -1,5 +1,6 @@
 {
   "encryptedKeyBackup": {
+    "signatureSecurityLevelRequirement": 3,
     "type": "object",
     "indices": [
       {

contracts/key-exchange-v2.json

@@ -1,5 +1,6 @@
 {
   "loginKeyResponse": {
+    "signatureSecurityLevelRequirement": 3,
     "type": "object",
     "description": "Encrypted login key response from wallet for key exchange protocol",
     "indices": [

contracts/pollr-contract-v2.json

@@ -1,6 +1,7 @@
 {
   "documentSchemas": {
     "poll": {
+      "signatureSecurityLevelRequirement": 3,
       "type": "object",
       "indices": [
         {
@@ -115,6 +116,7 @@
       "additionalProperties": false
     },
     "vote": {
+      "signatureSecurityLevelRequirement": 3,
       "type": "object",
       "indices": [
         {

contracts/pollr-contract-v3.json

@@ -1,6 +1,7 @@
 {
   "documentSchemas": {
     "poll": {
+      "signatureSecurityLevelRequirement": 3,
       "type": "object",
       "indices": [
         {
@@ -115,6 +116,7 @@
       "additionalProperties": false
     },
     "vote": {
+      "signatureSecurityLevelRequirement": 3,
       "type": "object",
       "indices": [
         {
@@ -174,6 +176,7 @@
       "additionalProperties": false
     },
     "multiVote": {
+      "signatureSecurityLevelRequirement": 3,
       "type": "object",
       "indices": [
         {

contracts/yappr-auth-vault-contract.json

@@ -1,5 +1,6 @@
 {
   "authVault": {
+    "signatureSecurityLevelRequirement": 3,
     "type": "object",
     "indices": [
       {
@@ -68,6 +69,7 @@
     }
   },
   "authVaultAccess": {
+    "signatureSecurityLevelRequirement": 3,
     "type": "object",
     "indices": [
       {

contracts/yappr-block-contract.json

@@ -1,5 +1,6 @@
 {
   "block": {
+    "signatureSecurityLevelRequirement": 3,
     "type": "object",
     "description": "A block relationship with optional public message/reason",
     "indices": [
@@ -36,6 +37,7 @@
   },
 
   "blockFilter": {
+    "signatureSecurityLevelRequirement": 3,
     "type": "object",
     "description": "Bloom filter of blocked users for efficient probabilistic matching. One per user.",
     "indices": [
@@ -75,6 +77,7 @@
   },
 
   "blockFollow": {
+    "signatureSecurityLevelRequirement": 3,
     "type": "object",
     "description": "Tracks which users' block lists this user inherits (hard blocks). One per user.",
     "indices": [

contracts/yappr-blog-contract.json

@@ -1,5 +1,6 @@
 {
   "blog": {
+    "signatureSecurityLevelRequirement": 3,
     "type": "object",
     "documentsKeepHistory": true,
     "documentsMutable": true,
@@ -69,6 +70,7 @@
     "additionalProperties": false
   },
   "blogPost": {
+    "signatureSecurityLevelRequirement": 3,
     "type": "object",
     "documentsKeepHistory": true,
     "documentsMutable": true,
@@ -201,6 +203,7 @@
     "additionalProperties": false
   },
   "blogComment": {
+    "signatureSecurityLevelRequirement": 3,
     "type": "object",
     "documentsMutable": false,
     "indices": [
@@ -263,6 +266,7 @@
     "additionalProperties": false
   },
   "blogFollow": {
+    "signatureSecurityLevelRequirement": 3,
     "type": "object",
     "documentsMutable": false,
     "indices": [

contracts/yappr-dm-contract.json

@@ -1,5 +1,6 @@
 {
   "directMessage": {
+    "signatureSecurityLevelRequirement": 3,
     "type": "object",
     "indices": [
       {

contracts/yappr-hashtag-contract.json

@@ -1,5 +1,6 @@
 {
   "postHashtag": {
+    "signatureSecurityLevelRequirement": 3,
     "type": "object",
     "indices": [
       {

contracts/yappr-mention-contract.json

@@ -1,5 +1,6 @@
 {
   "postMention": {
+    "signatureSecurityLevelRequirement": 3,
     "type": "object",
     "indices": [
       {

contracts/yappr-minimal.json

@@ -5,6 +5,7 @@
   "ownerId": "{{ownerId}}",
   "documents": {
     "profile": {
+      "signatureSecurityLevelRequirement": 3,
       "type": "object",
       "description": "User profile information",
       "indices": [
@@ -30,6 +31,7 @@
       "additionalProperties": false
     },
     "post": {
+      "signatureSecurityLevelRequirement": 3,
       "type": "object",
       "description": "A post in the social network",
       "indices": [

contracts/yappr-profile-contract.json

@@ -1,5 +1,6 @@
 {
   "profile": {
+    "signatureSecurityLevelRequirement": 3,
     "type": "object",
     "description": "User profile with unified identity, avatar, payment addresses, and social links",
     "indices": [

contracts/yappr-social-contract-v2.json

@@ -3,6 +3,7 @@
   "version": 1,
   "documentSchemas": {
     "like": {
+      "signatureSecurityLevelRequirement": 3,
       "type": "object",
       "indices": [
         {
@@ -60,6 +61,7 @@
       "additionalProperties": false
     },
     "post": {
+      "signatureSecurityLevelRequirement": 3,
       "type": "object",
       "indices": [
         {
@@ -187,6 +189,7 @@
       "additionalProperties": false
     },
     "reply": {
+      "signatureSecurityLevelRequirement": 3,
       "type": "object",
       "indices": [
         {
@@ -292,6 +295,7 @@
       "additionalProperties": false
     },
     "repost": {
+      "signatureSecurityLevelRequirement": 3,
       "type": "object",
       "indices": [
         {
@@ -357,6 +361,7 @@
       "additionalProperties": false
     },
     "block": {
+      "signatureSecurityLevelRequirement": 3,
       "type": "object",
       "indices": [
         {
@@ -402,6 +407,7 @@
       "additionalProperties": false
     },
     "blockFilter": {
+      "signatureSecurityLevelRequirement": 3,
       "type": "object",
       "indices": [
         {
@@ -444,6 +450,7 @@
       "additionalProperties": false
     },
     "blockFollow": {
+      "signatureSecurityLevelRequirement": 3,
       "type": "object",
       "indices": [
         {
@@ -473,6 +480,7 @@
       "additionalProperties": false
     },
     "follow": {
+      "signatureSecurityLevelRequirement": 3,
       "type": "object",
       "indices": [
         {
@@ -532,6 +540,7 @@
       "additionalProperties": false
     },
     "profile": {
+      "signatureSecurityLevelRequirement": 3,
       "type": "object",
       "indices": [
         {
@@ -594,6 +603,7 @@
       "additionalProperties": false
     },
     "bookmark": {
+      "signatureSecurityLevelRequirement": 3,
       "type": "object",
       "indices": [
         {
@@ -632,6 +642,7 @@
       "additionalProperties": false
     },
     "followRequest": {
+      "signatureSecurityLevelRequirement": 3,
       "type": "object",
       "indices": [
         {
@@ -677,6 +688,7 @@
       "additionalProperties": false
     },
     "privateFeedGrant": {
+      "signatureSecurityLevelRequirement": 3,
       "type": "object",
       "indices": [
         {
@@ -741,6 +753,7 @@
       "additionalProperties": false
     },
     "privateFeedRekey": {
+      "signatureSecurityLevelRequirement": 3,
       "type": "object",
       "indices": [
         {
@@ -796,6 +809,7 @@
       "additionalProperties": false
     },
     "privateFeedState": {
+      "signatureSecurityLevelRequirement": 3,
       "type": "object",
       "canBeDeleted": false,
       "indices": [
@@ -842,6 +856,7 @@
       "additionalProperties": false
     },
     "postHashtag": {
+      "signatureSecurityLevelRequirement": 3,
       "type": "object",
       "indices": [
         {
@@ -902,6 +917,7 @@
       "additionalProperties": false
     },
     "postMention": {
+      "signatureSecurityLevelRequirement": 3,
       "type": "object",
       "indices": [
         {