@babylonlabs-io/ts-sdk 0.50.0 → 0.51.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.cjs +1 -1
- package/dist/index.js +1 -1
- package/dist/{primeVpAuth-BdrwraAe.js → primeVpAuth-DxMuWQCi.js} +228 -247
- package/dist/{primeVpAuth-BdrwraAe.js.map → primeVpAuth-DxMuWQCi.js.map} +1 -1
- package/dist/{primeVpAuth-Brl_bnBH.cjs → primeVpAuth-yTddDmGy.cjs} +2 -2
- package/dist/{primeVpAuth-Brl_bnBH.cjs.map → primeVpAuth-yTddDmGy.cjs.map} +1 -1
- package/dist/tbv/core/clients/index.cjs +1 -1
- package/dist/tbv/core/clients/index.js +1 -1
- package/dist/tbv/core/clients/vault-provider/auth/createAuthenticatedVpClient.d.ts +0 -6
- package/dist/tbv/core/clients/vault-provider/auth/createAuthenticatedVpClient.d.ts.map +1 -1
- package/dist/tbv/core/clients/vault-provider/auth/primeVpAuth.d.ts +0 -8
- package/dist/tbv/core/clients/vault-provider/auth/primeVpAuth.d.ts.map +1 -1
- package/dist/tbv/core/clients/vault-provider/auth/tokenRegistry.d.ts +3 -14
- package/dist/tbv/core/clients/vault-provider/auth/tokenRegistry.d.ts.map +1 -1
- package/dist/tbv/core/clients/vault-provider/auth/verifyDepositorCwt.d.ts +14 -26
- package/dist/tbv/core/clients/vault-provider/auth/verifyDepositorCwt.d.ts.map +1 -1
- package/dist/tbv/core/index.cjs +1 -1
- package/dist/tbv/core/index.js +1 -1
- package/dist/tbv/index.cjs +1 -1
- package/dist/tbv/index.js +1 -1
- package/package.json +1 -1
|
@@ -1,15 +1,15 @@
|
|
|
1
|
-
var
|
|
2
|
-
var
|
|
3
|
-
var f = (r, e, t) =>
|
|
1
|
+
var Se = Object.defineProperty;
|
|
2
|
+
var Te = (r, e, t) => e in r ? Se(r, e, { enumerable: !0, configurable: !0, writable: !0, value: t }) : r[e] = t;
|
|
3
|
+
var f = (r, e, t) => Te(r, typeof e != "symbol" ? e + "" : e, t);
|
|
4
4
|
import { B as Q } from "./BTCVaultRegistry.abi-Chs4AFBj.js";
|
|
5
5
|
import { P as x, A as L } from "./ApplicationRegistry.abi-Dn2qk6JG.js";
|
|
6
|
-
import { k as
|
|
7
|
-
import { D as
|
|
8
|
-
import { X as R, C as
|
|
6
|
+
import { k as Ce, v as U, l as $e, j as Ie } from "./mempoolApi-Dc1KSVNI.js";
|
|
7
|
+
import { D as Ve, J as ge, e as Re } from "./types-CQDRQvV-.js";
|
|
8
|
+
import { X as R, C as G, s as V, S as Oe, h as Be, p as fe } from "./bitcoin-B5aNKtsk.js";
|
|
9
9
|
import { C as ee } from "./constants-Cd_fN8VT.js";
|
|
10
10
|
import { H as S } from "./validation-CxqROCno.js";
|
|
11
11
|
import * as H from "@bitcoin-js/tiny-secp256k1-asmjs";
|
|
12
|
-
import { payments as
|
|
12
|
+
import { payments as Ne, Transaction as X } from "bitcoinjs-lib";
|
|
13
13
|
import { Buffer as I } from "buffer";
|
|
14
14
|
import { s as q } from "./sha2-BYVxyZzX.js";
|
|
15
15
|
async function or(r, e) {
|
|
@@ -78,7 +78,7 @@ class ar {
|
|
|
78
78
|
abi: x,
|
|
79
79
|
functionName: "getTBVProtocolParams"
|
|
80
80
|
}), t = re(e);
|
|
81
|
-
return
|
|
81
|
+
return Ce(t), t;
|
|
82
82
|
}
|
|
83
83
|
async getLatestOffchainParams() {
|
|
84
84
|
const e = await this.publicClient.readContract({
|
|
@@ -103,7 +103,7 @@ class ar {
|
|
|
103
103
|
abi: x,
|
|
104
104
|
functionName: "latestOffchainParamsVersion"
|
|
105
105
|
}), t = Number(e);
|
|
106
|
-
return
|
|
106
|
+
return $e(t), t;
|
|
107
107
|
}
|
|
108
108
|
async getTimelockPeginByVersion(e) {
|
|
109
109
|
const t = await this.getOffchainParamsByVersion(e);
|
|
@@ -149,7 +149,7 @@ class ar {
|
|
|
149
149
|
offchainParams: n,
|
|
150
150
|
offchainParamsVersion: i
|
|
151
151
|
};
|
|
152
|
-
return
|
|
152
|
+
return Ie(s), s;
|
|
153
153
|
}
|
|
154
154
|
/**
|
|
155
155
|
* Fetch every historical offchain params version in a single multicall.
|
|
@@ -178,10 +178,10 @@ class ar {
|
|
|
178
178
|
const d = B(s[c]);
|
|
179
179
|
try {
|
|
180
180
|
U(d), o.set(n[c], d);
|
|
181
|
-
} catch (
|
|
181
|
+
} catch (l) {
|
|
182
182
|
e == null || e(
|
|
183
183
|
n[c],
|
|
184
|
-
|
|
184
|
+
l instanceof Error ? l : new Error(String(l))
|
|
185
185
|
);
|
|
186
186
|
}
|
|
187
187
|
}
|
|
@@ -254,16 +254,16 @@ class lr {
|
|
|
254
254
|
});
|
|
255
255
|
}
|
|
256
256
|
}
|
|
257
|
-
var
|
|
258
|
-
const se = new Set(Object.values(
|
|
257
|
+
var De = /* @__PURE__ */ ((r) => (r[r.PENDING = 0] = "PENDING", r[r.VERIFIED = 1] = "VERIFIED", r[r.ACTIVE = 2] = "ACTIVE", r[r.REDEEMED = 3] = "REDEEMED", r[r.EXPIRED = 4] = "EXPIRED", r))(De || {});
|
|
258
|
+
const se = new Set(Object.values(Ve)), Ge = 200;
|
|
259
259
|
function p(r) {
|
|
260
260
|
var e;
|
|
261
|
-
return ((e = JSON.stringify(r)) == null ? void 0 : e.slice(0,
|
|
261
|
+
return ((e = JSON.stringify(r)) == null ? void 0 : e.slice(0, Ge)) ?? "undefined";
|
|
262
262
|
}
|
|
263
|
-
const
|
|
263
|
+
const Me = "The vault provider returned an unexpected response. Please try again or contact support.";
|
|
264
264
|
class a extends Error {
|
|
265
265
|
constructor(t) {
|
|
266
|
-
super(
|
|
266
|
+
super(Me);
|
|
267
267
|
f(this, "detail");
|
|
268
268
|
this.name = "VpResponseValidationError", this.detail = t;
|
|
269
269
|
}
|
|
@@ -272,28 +272,28 @@ const O = 64;
|
|
|
272
272
|
function C(r) {
|
|
273
273
|
return typeof r == "string" && r.length > 0 && S.test(r);
|
|
274
274
|
}
|
|
275
|
-
function
|
|
275
|
+
function _e(r) {
|
|
276
276
|
return typeof r == "string" && r.length > 0;
|
|
277
277
|
}
|
|
278
|
-
function
|
|
278
|
+
function me(r, e) {
|
|
279
279
|
if (!C(r))
|
|
280
280
|
throw new a(
|
|
281
281
|
`VP response validation failed: "${e}" must be a non-empty hex string, got ${p(r)}`
|
|
282
282
|
);
|
|
283
283
|
}
|
|
284
284
|
function b(r, e) {
|
|
285
|
-
if (!
|
|
285
|
+
if (!_e(r))
|
|
286
286
|
throw new a(
|
|
287
287
|
`VP response validation failed: "${e}" must be a non-empty string, got ${p(r)}`
|
|
288
288
|
);
|
|
289
289
|
}
|
|
290
290
|
function Z(r, e) {
|
|
291
|
-
if (!C(r) || r.length !== R && r.length !==
|
|
291
|
+
if (!C(r) || r.length !== R && r.length !== G)
|
|
292
292
|
throw new a(
|
|
293
|
-
`VP response validation failed: "${e}" must be a ${R} or ${
|
|
293
|
+
`VP response validation failed: "${e}" must be a ${R} or ${G}-char hex string (BTC pubkey), got ${p(r)}`
|
|
294
294
|
);
|
|
295
295
|
}
|
|
296
|
-
function
|
|
296
|
+
function je(r) {
|
|
297
297
|
const e = r.presigning;
|
|
298
298
|
if (e == null) return;
|
|
299
299
|
if (typeof e != "object" || Array.isArray(e))
|
|
@@ -314,7 +314,7 @@ function Le(r) {
|
|
|
314
314
|
`VP response validation failed: "progress.presigning.vk_challenger_presigning_total" must be a number if present, got ${p(t.vk_challenger_presigning_total)}`
|
|
315
315
|
);
|
|
316
316
|
}
|
|
317
|
-
function
|
|
317
|
+
function ye(r) {
|
|
318
318
|
if (r === null || typeof r != "object")
|
|
319
319
|
throw new a(
|
|
320
320
|
"VP response validation failed: getPeginStatus response is not an object"
|
|
@@ -336,7 +336,7 @@ function we(r) {
|
|
|
336
336
|
throw new a(
|
|
337
337
|
'VP response validation failed: "progress" must be an object'
|
|
338
338
|
);
|
|
339
|
-
if (
|
|
339
|
+
if (je(e.progress), typeof e.health_info != "string")
|
|
340
340
|
throw new a(
|
|
341
341
|
'VP response validation failed: "health_info" must be a string'
|
|
342
342
|
);
|
|
@@ -345,7 +345,7 @@ function we(r) {
|
|
|
345
345
|
`VP response validation failed: "last_error" must be a string if present, got ${p(e.last_error)}`
|
|
346
346
|
);
|
|
347
347
|
}
|
|
348
|
-
function
|
|
348
|
+
function He(r) {
|
|
349
349
|
if (r === null || typeof r != "object")
|
|
350
350
|
throw new a(
|
|
351
351
|
"VP response validation failed: requestDepositorPresignTransactions response is not an object"
|
|
@@ -356,31 +356,31 @@ function Ue(r) {
|
|
|
356
356
|
'VP response validation failed: "txs" must be an array'
|
|
357
357
|
);
|
|
358
358
|
for (let t = 0; t < e.txs.length; t++)
|
|
359
|
-
|
|
359
|
+
Le(e.txs[t], `txs[${t}]`);
|
|
360
360
|
if (e.depositor_graph === null || typeof e.depositor_graph != "object")
|
|
361
361
|
throw new a(
|
|
362
362
|
'VP response validation failed: "depositor_graph" must be an object'
|
|
363
363
|
);
|
|
364
|
-
|
|
364
|
+
ze(
|
|
365
365
|
e.depositor_graph
|
|
366
366
|
);
|
|
367
367
|
}
|
|
368
|
-
function
|
|
368
|
+
function A(r, e) {
|
|
369
369
|
if (r === null || typeof r != "object")
|
|
370
370
|
throw new a(
|
|
371
371
|
`VP response validation failed: "${e}" must be an object`
|
|
372
372
|
);
|
|
373
|
-
|
|
373
|
+
me(r.tx_hex, `${e}.tx_hex`);
|
|
374
374
|
}
|
|
375
|
-
function
|
|
375
|
+
function Le(r, e) {
|
|
376
376
|
if (r === null || typeof r != "object")
|
|
377
377
|
throw new a(
|
|
378
378
|
`VP response validation failed: "${e}" must be an object`
|
|
379
379
|
);
|
|
380
380
|
const t = r;
|
|
381
|
-
Z(t.claimer_pubkey, `${e}.claimer_pubkey`),
|
|
381
|
+
Z(t.claimer_pubkey, `${e}.claimer_pubkey`), A(t.claim_tx, `${e}.claim_tx`), A(t.assert_tx, `${e}.assert_tx`), A(t.payout_tx, `${e}.payout_tx`), b(t.payout_psbt, `${e}.payout_psbt`);
|
|
382
382
|
}
|
|
383
|
-
function
|
|
383
|
+
function Ue(r, e) {
|
|
384
384
|
if (r === null || typeof r != "object")
|
|
385
385
|
throw new a(
|
|
386
386
|
`VP response validation failed: "${e}" must be an object`
|
|
@@ -388,19 +388,19 @@ function Fe(r, e) {
|
|
|
388
388
|
const t = r;
|
|
389
389
|
b(t.wots_pks_json, `${e}.wots_pks_json`), b(t.gc_wots_keys_json, `${e}.gc_wots_keys_json`);
|
|
390
390
|
}
|
|
391
|
-
function
|
|
391
|
+
function Xe(r, e) {
|
|
392
392
|
if (r === null || typeof r != "object")
|
|
393
393
|
throw new a(
|
|
394
394
|
`VP response validation failed: "${e}" must be an object`
|
|
395
395
|
);
|
|
396
396
|
const t = r;
|
|
397
|
-
if (Z(t.challenger_pubkey, `${e}.challenger_pubkey`),
|
|
397
|
+
if (Z(t.challenger_pubkey, `${e}.challenger_pubkey`), A(
|
|
398
398
|
t.challenge_assert_x_tx,
|
|
399
399
|
`${e}.challenge_assert_x_tx`
|
|
400
|
-
),
|
|
400
|
+
), A(
|
|
401
401
|
t.challenge_assert_y_tx,
|
|
402
402
|
`${e}.challenge_assert_y_tx`
|
|
403
|
-
),
|
|
403
|
+
), A(t.nopayout_tx, `${e}.nopayout_tx`), b(t.nopayout_psbt, `${e}.nopayout_psbt`), !Array.isArray(t.challenge_assert_connectors))
|
|
404
404
|
throw new a(
|
|
405
405
|
`VP response validation failed: "${e}.challenge_assert_connectors" must be an array`
|
|
406
406
|
);
|
|
@@ -409,7 +409,7 @@ function Ke(r, e) {
|
|
|
409
409
|
`VP response validation failed: "${e}.challenge_assert_connectors" must have exactly ${ee} entries, got ${t.challenge_assert_connectors.length}`
|
|
410
410
|
);
|
|
411
411
|
for (let n = 0; n < t.challenge_assert_connectors.length; n++)
|
|
412
|
-
|
|
412
|
+
Ue(
|
|
413
413
|
t.challenge_assert_connectors[n],
|
|
414
414
|
`${e}.challenge_assert_connectors[${n}]`
|
|
415
415
|
);
|
|
@@ -418,18 +418,18 @@ function Ke(r, e) {
|
|
|
418
418
|
`VP response validation failed: "${e}.output_label_hashes" must be an array`
|
|
419
419
|
);
|
|
420
420
|
for (let n = 0; n < t.output_label_hashes.length; n++)
|
|
421
|
-
|
|
421
|
+
me(
|
|
422
422
|
t.output_label_hashes[n],
|
|
423
423
|
`${e}.output_label_hashes[${n}]`
|
|
424
424
|
);
|
|
425
425
|
}
|
|
426
|
-
function
|
|
426
|
+
function Fe(r) {
|
|
427
427
|
if (r === null || typeof r != "object")
|
|
428
428
|
throw new a(
|
|
429
429
|
"VP response validation failed: requestDepositorClaimerArtifacts response is not an object"
|
|
430
430
|
);
|
|
431
431
|
const e = r;
|
|
432
|
-
if (!
|
|
432
|
+
if (!_e(e.tx_graph_json))
|
|
433
433
|
throw new a(
|
|
434
434
|
`VP response validation failed: "tx_graph_json" must be a non-empty string, got ${p(e.tx_graph_json)}`
|
|
435
435
|
);
|
|
@@ -460,7 +460,7 @@ function Je(r) {
|
|
|
460
460
|
);
|
|
461
461
|
}
|
|
462
462
|
}
|
|
463
|
-
function
|
|
463
|
+
function Ke(r) {
|
|
464
464
|
if (r === null || typeof r != "object")
|
|
465
465
|
throw new a(
|
|
466
466
|
"VP response validation failed: pegout status payload is not an object"
|
|
@@ -479,16 +479,16 @@ function qe(r) {
|
|
|
479
479
|
throw new a(
|
|
480
480
|
`VP response validation failed: "claimer" must be an object or null, got ${p(e.claimer)}`
|
|
481
481
|
);
|
|
482
|
-
|
|
482
|
+
Je(e.claimer);
|
|
483
483
|
}
|
|
484
484
|
if (!Array.isArray(e.challengers))
|
|
485
485
|
throw new a(
|
|
486
486
|
`VP response validation failed: "challengers" must be an array, got ${p(e.challengers)}`
|
|
487
487
|
);
|
|
488
488
|
for (let t = 0; t < e.challengers.length; t++)
|
|
489
|
-
|
|
489
|
+
qe(e.challengers[t], t);
|
|
490
490
|
}
|
|
491
|
-
function
|
|
491
|
+
function Je(r) {
|
|
492
492
|
if (b(r.status, "claimer.status"), typeof r.failed != "boolean")
|
|
493
493
|
throw new a(
|
|
494
494
|
`VP response validation failed: "claimer.failed" must be a boolean, got ${p(r.failed)}`
|
|
@@ -502,7 +502,7 @@ function We(r) {
|
|
|
502
502
|
`VP response validation failed: "claimer.updated_at" must be a number, got ${p(r.updated_at)}`
|
|
503
503
|
);
|
|
504
504
|
}
|
|
505
|
-
function
|
|
505
|
+
function qe(r, e) {
|
|
506
506
|
if (r === null || typeof r != "object")
|
|
507
507
|
throw new a(
|
|
508
508
|
`VP response validation failed: "challengers[${e}]" must be an object, got ${p(r)}`
|
|
@@ -529,17 +529,17 @@ function N(r, e) {
|
|
|
529
529
|
`VP response validation failed: "${e}" must be a string or null, got ${p(r)}`
|
|
530
530
|
);
|
|
531
531
|
}
|
|
532
|
-
function
|
|
533
|
-
|
|
534
|
-
e.result !== null &&
|
|
532
|
+
function We(r) {
|
|
533
|
+
be(r, "batchGetPeginStatus", (e) => {
|
|
534
|
+
e.result !== null && ye(e.result);
|
|
535
535
|
});
|
|
536
536
|
}
|
|
537
|
-
function
|
|
538
|
-
|
|
539
|
-
e.result !== null &&
|
|
537
|
+
function Ye(r) {
|
|
538
|
+
be(r, "batchGetPegoutStatus", (e) => {
|
|
539
|
+
e.result !== null && Ke(e.result);
|
|
540
540
|
});
|
|
541
541
|
}
|
|
542
|
-
function
|
|
542
|
+
function be(r, e, t) {
|
|
543
543
|
if (r === null || typeof r != "object")
|
|
544
544
|
throw new a(
|
|
545
545
|
`VP response validation failed: ${e} response is not an object`
|
|
@@ -575,13 +575,13 @@ function xe(r, e, t) {
|
|
|
575
575
|
t(o, i);
|
|
576
576
|
}
|
|
577
577
|
}
|
|
578
|
-
function
|
|
579
|
-
if (
|
|
578
|
+
function ze(r) {
|
|
579
|
+
if (A(r.claim_tx, "depositor_graph.claim_tx"), A(r.assert_tx, "depositor_graph.assert_tx"), A(r.payout_tx, "depositor_graph.payout_tx"), b(r.payout_psbt, "depositor_graph.payout_psbt"), !Array.isArray(r.challenger_presign_data))
|
|
580
580
|
throw new a(
|
|
581
581
|
'VP response validation failed: "depositor_graph.challenger_presign_data" must be an array'
|
|
582
582
|
);
|
|
583
583
|
for (let e = 0; e < r.challenger_presign_data.length; e++)
|
|
584
|
-
|
|
584
|
+
Xe(
|
|
585
585
|
r.challenger_presign_data[e],
|
|
586
586
|
`depositor_graph.challenger_presign_data[${e}]`
|
|
587
587
|
);
|
|
@@ -590,13 +590,13 @@ function Qe(r) {
|
|
|
590
590
|
'VP response validation failed: "depositor_graph.offchain_params_version" must be a number'
|
|
591
591
|
);
|
|
592
592
|
}
|
|
593
|
-
const
|
|
594
|
-
class
|
|
593
|
+
const Ze = 6e4;
|
|
594
|
+
class Qe {
|
|
595
595
|
constructor(e, t) {
|
|
596
596
|
f(this, "client");
|
|
597
597
|
const n = {
|
|
598
598
|
baseUrl: e,
|
|
599
|
-
timeout: (t == null ? void 0 : t.timeout) ??
|
|
599
|
+
timeout: (t == null ? void 0 : t.timeout) ?? Ze,
|
|
600
600
|
retries: t == null ? void 0 : t.retries,
|
|
601
601
|
retryDelay: t == null ? void 0 : t.retryDelay,
|
|
602
602
|
retryableFor: t == null ? void 0 : t.retryableFor,
|
|
@@ -604,7 +604,7 @@ class tt {
|
|
|
604
604
|
tokenProvider: t == null ? void 0 : t.tokenProvider,
|
|
605
605
|
maxResponseBytes: t == null ? void 0 : t.maxResponseBytes
|
|
606
606
|
};
|
|
607
|
-
this.client = new
|
|
607
|
+
this.client = new ge(n);
|
|
608
608
|
}
|
|
609
609
|
/**
|
|
610
610
|
* Request the payout/claim/assert transactions that the depositor
|
|
@@ -612,7 +612,7 @@ class tt {
|
|
|
612
612
|
*/
|
|
613
613
|
async requestDepositorPresignTransactions(e, t) {
|
|
614
614
|
const n = await this.client.call("vaultProvider_requestDepositorPresignTransactions", e, t);
|
|
615
|
-
return
|
|
615
|
+
return He(n), n;
|
|
616
616
|
}
|
|
617
617
|
/**
|
|
618
618
|
* Submit the depositor's pre-signatures for the payout transactions
|
|
@@ -643,7 +643,7 @@ class tt {
|
|
|
643
643
|
*/
|
|
644
644
|
async requestDepositorClaimerArtifacts(e, t) {
|
|
645
645
|
const n = await this.client.call("vaultProvider_requestDepositorClaimerArtifacts", e, t);
|
|
646
|
-
return
|
|
646
|
+
return Fe(n), n;
|
|
647
647
|
}
|
|
648
648
|
/** Get the current pegin status from the vault provider daemon. */
|
|
649
649
|
async getPeginStatus(e, t) {
|
|
@@ -652,7 +652,7 @@ class tt {
|
|
|
652
652
|
e,
|
|
653
653
|
t
|
|
654
654
|
);
|
|
655
|
-
return
|
|
655
|
+
return ye(n), n;
|
|
656
656
|
}
|
|
657
657
|
/**
|
|
658
658
|
* Get pegin status for many txids in one round trip. Per-result envelope
|
|
@@ -661,7 +661,7 @@ class tt {
|
|
|
661
661
|
*/
|
|
662
662
|
async batchGetPeginStatus(e, t) {
|
|
663
663
|
const n = await this.client.call("vaultProvider_batchGetPeginStatus", e, t);
|
|
664
|
-
return
|
|
664
|
+
return We(n), n;
|
|
665
665
|
}
|
|
666
666
|
/**
|
|
667
667
|
* Get pegout status for many txids in one round trip. Same per-result
|
|
@@ -669,25 +669,25 @@ class tt {
|
|
|
669
669
|
*/
|
|
670
670
|
async batchGetPegoutStatus(e, t) {
|
|
671
671
|
const n = await this.client.call("vaultProvider_batchGetPegoutStatus", e, t);
|
|
672
|
-
return
|
|
672
|
+
return Ye(n), n;
|
|
673
673
|
}
|
|
674
674
|
}
|
|
675
|
-
function
|
|
675
|
+
function et(r, e) {
|
|
676
676
|
const t = /* @__PURE__ */ new Set();
|
|
677
677
|
for (const d of r)
|
|
678
678
|
t.add(d.toLowerCase());
|
|
679
679
|
const n = /* @__PURE__ */ new Map(), i = /* @__PURE__ */ new Set(), s = [], o = [];
|
|
680
680
|
for (const d of e) {
|
|
681
|
-
const
|
|
682
|
-
if (!t.has(
|
|
683
|
-
o.push(
|
|
681
|
+
const l = d.pegin_txid.toLowerCase();
|
|
682
|
+
if (!t.has(l)) {
|
|
683
|
+
o.push(l);
|
|
684
684
|
continue;
|
|
685
685
|
}
|
|
686
|
-
if (i.has(
|
|
687
|
-
s.push(
|
|
686
|
+
if (i.has(l)) {
|
|
687
|
+
s.push(l);
|
|
688
688
|
continue;
|
|
689
689
|
}
|
|
690
|
-
i.add(
|
|
690
|
+
i.add(l), n.set(l, { result: d.result, error: d.error });
|
|
691
691
|
}
|
|
692
692
|
const c = [];
|
|
693
693
|
for (const d of t)
|
|
@@ -704,8 +704,8 @@ async function ur(r) {
|
|
|
704
704
|
onDuplicate: o,
|
|
705
705
|
onDuplicateBatch: c,
|
|
706
706
|
onWholeBatchError: d,
|
|
707
|
-
onUnexpected:
|
|
708
|
-
batchSize: g =
|
|
707
|
+
onUnexpected: l,
|
|
708
|
+
batchSize: g = Re
|
|
709
709
|
} = r;
|
|
710
710
|
if (!Number.isInteger(g) || g <= 0)
|
|
711
711
|
throw new Error(
|
|
@@ -714,53 +714,53 @@ async function ur(r) {
|
|
|
714
714
|
for (let m = 0; m < e.length; m += g) {
|
|
715
715
|
const w = e.slice(m, m + g), k = /* @__PURE__ */ new Map(), T = [];
|
|
716
716
|
for (const _ of w) {
|
|
717
|
-
const
|
|
718
|
-
k.set(
|
|
717
|
+
const u = t(_).toLowerCase();
|
|
718
|
+
k.set(u, _), T.push(u);
|
|
719
719
|
}
|
|
720
|
-
let
|
|
720
|
+
let P;
|
|
721
721
|
try {
|
|
722
722
|
const _ = await n(T);
|
|
723
|
-
|
|
723
|
+
P = et(T, _.results);
|
|
724
724
|
} catch (_) {
|
|
725
725
|
d(w, _);
|
|
726
726
|
continue;
|
|
727
727
|
}
|
|
728
|
-
|
|
729
|
-
const $ = new Set(
|
|
728
|
+
l && P.unexpected.length > 0 && l(P.unexpected);
|
|
729
|
+
const $ = new Set(P.duplicate);
|
|
730
730
|
for (const _ of $) {
|
|
731
|
-
const
|
|
732
|
-
|
|
731
|
+
const u = k.get(_);
|
|
732
|
+
u && o(u);
|
|
733
733
|
}
|
|
734
734
|
c && $.size > 0 && c($.size);
|
|
735
|
-
for (const _ of
|
|
736
|
-
const
|
|
737
|
-
|
|
735
|
+
for (const _ of P.missing) {
|
|
736
|
+
const u = k.get(_);
|
|
737
|
+
u && s(u);
|
|
738
738
|
}
|
|
739
|
-
for (const [_,
|
|
739
|
+
for (const [_, u] of P.byTxid) {
|
|
740
740
|
if ($.has(_)) continue;
|
|
741
741
|
const E = k.get(_);
|
|
742
742
|
E && i(E, {
|
|
743
743
|
pegin_txid: _,
|
|
744
|
-
result:
|
|
745
|
-
error:
|
|
744
|
+
result: u.result,
|
|
745
|
+
error: u.error
|
|
746
746
|
});
|
|
747
747
|
}
|
|
748
748
|
}
|
|
749
749
|
}
|
|
750
|
-
const
|
|
751
|
-
function
|
|
750
|
+
const tt = "BIP0322-signed-message", rt = "TapTweak", we = 32, nt = 64;
|
|
751
|
+
function xe(r, e) {
|
|
752
752
|
const t = new TextEncoder().encode(r), n = q(t), i = new Uint8Array(n.length * 2 + e.length);
|
|
753
753
|
return i.set(n, 0), i.set(n, n.length), i.set(e, n.length * 2), q(i);
|
|
754
754
|
}
|
|
755
|
-
function
|
|
756
|
-
if (r.length !==
|
|
757
|
-
const e =
|
|
755
|
+
function st(r) {
|
|
756
|
+
if (r.length !== we) return null;
|
|
757
|
+
const e = xe(rt, r), t = H.xOnlyPointAddTweak(r, e);
|
|
758
758
|
return t ? t.xOnlyPubkey : null;
|
|
759
759
|
}
|
|
760
|
-
function
|
|
761
|
-
if (e.length !==
|
|
760
|
+
function it(r, e, t) {
|
|
761
|
+
if (e.length !== we || t.length !== nt) return !1;
|
|
762
762
|
try {
|
|
763
|
-
const n =
|
|
763
|
+
const n = xe(tt, r), i = Ne.p2tr({
|
|
764
764
|
internalPubkey: I.from(e)
|
|
765
765
|
});
|
|
766
766
|
if (!i.output) return !1;
|
|
@@ -779,16 +779,16 @@ function at(r, e, t) {
|
|
|
779
779
|
// sequence = 0
|
|
780
780
|
d
|
|
781
781
|
), c.addOutput(s, o);
|
|
782
|
-
const
|
|
783
|
-
|
|
782
|
+
const l = new X();
|
|
783
|
+
l.version = 0, l.locktime = 0;
|
|
784
784
|
const g = c.getHash();
|
|
785
|
-
|
|
786
|
-
const m =
|
|
785
|
+
l.addInput(g, 0, 0), l.addOutput(I.from([106]), o);
|
|
786
|
+
const m = l.hashForWitnessV1(
|
|
787
787
|
0,
|
|
788
788
|
[s],
|
|
789
789
|
[o],
|
|
790
790
|
X.SIGHASH_DEFAULT
|
|
791
|
-
), w =
|
|
791
|
+
), w = st(e);
|
|
792
792
|
return w ? H.verifySchnorr(m, w, t) : !1;
|
|
793
793
|
} catch {
|
|
794
794
|
return !1;
|
|
@@ -819,7 +819,7 @@ function j(r, e) {
|
|
|
819
819
|
i[1 + s] = Number(n >> BigInt((7 - s) * 8)) & 255;
|
|
820
820
|
return i;
|
|
821
821
|
}
|
|
822
|
-
function
|
|
822
|
+
function Pe(...r) {
|
|
823
823
|
const e = r.reduce((i, s) => i + s.length, 0), t = new Uint8Array(e);
|
|
824
824
|
let n = 0;
|
|
825
825
|
for (const i of r)
|
|
@@ -830,32 +830,32 @@ function ie(r) {
|
|
|
830
830
|
const t = [j(4, r.length)];
|
|
831
831
|
for (const n of r)
|
|
832
832
|
t.push(j(0, n));
|
|
833
|
-
return
|
|
833
|
+
return Pe(...t);
|
|
834
834
|
}
|
|
835
|
-
function
|
|
835
|
+
function ot(r, e, t) {
|
|
836
836
|
if (!Number.isSafeInteger(t) || t < 0)
|
|
837
837
|
throw new Error(
|
|
838
838
|
`encodeServerIdentityPayload: expires_at must be a non-negative safe integer, got ${t}`
|
|
839
839
|
);
|
|
840
840
|
const n = j(4, 3), i = ie(r), s = ie(e), o = j(0, t);
|
|
841
|
-
return
|
|
841
|
+
return Pe(n, i, s, o);
|
|
842
842
|
}
|
|
843
|
-
const
|
|
843
|
+
const at = new TextEncoder().encode(
|
|
844
844
|
"btc-auth.server-identity.v1"
|
|
845
|
-
),
|
|
845
|
+
), ct = 2 * 3600;
|
|
846
846
|
class y extends Error {
|
|
847
847
|
constructor(e, t) {
|
|
848
848
|
super(e), this.reason = t, this.name = "ServerIdentityError";
|
|
849
849
|
}
|
|
850
850
|
}
|
|
851
|
-
function
|
|
851
|
+
function D(r) {
|
|
852
852
|
const e = new Uint8Array(r.length / 2);
|
|
853
853
|
for (let t = 0; t < e.length; t++)
|
|
854
854
|
e[t] = parseInt(r.slice(t * 2, t * 2 + 2), 16);
|
|
855
855
|
return e;
|
|
856
856
|
}
|
|
857
|
-
function
|
|
858
|
-
const { proof: e, pinnedServerPubkey: t, now: n } = r, i = r.maxLifetimeSecs ??
|
|
857
|
+
function lt(r) {
|
|
858
|
+
const { proof: e, pinnedServerPubkey: t, now: n } = r, i = r.maxLifetimeSecs ?? ct, s = V(t).toLowerCase();
|
|
859
859
|
if (s.length !== R || !S.test(s))
|
|
860
860
|
throw new y(
|
|
861
861
|
`pinnedServerPubkey must be 32-byte hex; got ${s.length} chars`,
|
|
@@ -898,7 +898,7 @@ function dt(r) {
|
|
|
898
898
|
"expires_too_far"
|
|
899
899
|
);
|
|
900
900
|
const c = V(e.ephemeral_pubkey).toLowerCase();
|
|
901
|
-
if (c.length !==
|
|
901
|
+
if (c.length !== G || !S.test(c))
|
|
902
902
|
throw new y(
|
|
903
903
|
`ephemeral_pubkey must be 33-byte compressed hex; got ${c.length} chars`,
|
|
904
904
|
"invalid_ephemeral_pubkey"
|
|
@@ -909,51 +909,51 @@ function dt(r) {
|
|
|
909
909
|
`ephemeral_pubkey must be compressed (prefix 02/03); got ${d}`,
|
|
910
910
|
"invalid_ephemeral_pubkey"
|
|
911
911
|
);
|
|
912
|
-
const
|
|
913
|
-
if (!H.isPoint(
|
|
912
|
+
const l = D(c);
|
|
913
|
+
if (!H.isPoint(l))
|
|
914
914
|
throw new y(
|
|
915
915
|
"ephemeral_pubkey is not a valid secp256k1 point",
|
|
916
916
|
"invalid_ephemeral_pubkey"
|
|
917
917
|
);
|
|
918
918
|
const g = V(e.signature).toLowerCase();
|
|
919
|
-
if (g.length !==
|
|
919
|
+
if (g.length !== Oe || !S.test(g))
|
|
920
920
|
throw new y(
|
|
921
921
|
`signature must be 64-byte Schnorr hex; got ${g.length} chars`,
|
|
922
922
|
"invalid_signature_encoding"
|
|
923
923
|
);
|
|
924
|
-
const m =
|
|
925
|
-
|
|
926
|
-
|
|
924
|
+
const m = ot(
|
|
925
|
+
at,
|
|
926
|
+
D(c),
|
|
927
927
|
e.expires_at
|
|
928
928
|
);
|
|
929
|
-
if (!
|
|
929
|
+
if (!it(m, D(o), D(g)))
|
|
930
930
|
throw new y(
|
|
931
931
|
"BIP-322 signature verification failed — ephemeral key is not attested by pinned server pubkey",
|
|
932
932
|
"signature_verification_failed"
|
|
933
933
|
);
|
|
934
934
|
}
|
|
935
|
-
const
|
|
935
|
+
const ut = /* @__PURE__ */ new Set([
|
|
936
936
|
"vaultProvider_submitDepositorWotsKey",
|
|
937
937
|
"vaultProvider_submitDepositorPresignatures",
|
|
938
938
|
"vaultProvider_requestDepositorPresignTransactions"
|
|
939
|
-
]),
|
|
939
|
+
]), dt = /* @__PURE__ */ new Set([
|
|
940
940
|
"vaultProvider_requestDepositorClaimerArtifacts"
|
|
941
941
|
]), ht = 6e4, W = "auth_createDepositorToken", Y = "auth_createDepositorTokenGrpc";
|
|
942
|
-
function
|
|
943
|
-
return new
|
|
942
|
+
function ve(r, e) {
|
|
943
|
+
return new ge({
|
|
944
944
|
baseUrl: r,
|
|
945
945
|
timeout: ht,
|
|
946
946
|
headers: e,
|
|
947
947
|
retryableFor: (t) => t === W || t === Y
|
|
948
948
|
});
|
|
949
949
|
}
|
|
950
|
-
const pt = 0, gt = 1, F = 2, ft = 3, _t = 4, mt = 5, yt = 6, bt = 7,
|
|
951
|
-
class
|
|
950
|
+
const pt = 0, gt = 1, F = 2, ft = 3, _t = 4, mt = 5, yt = 6, bt = 7, oe = 24, wt = 28, xt = 20, Pt = 21, vt = 22, ae = 256;
|
|
951
|
+
class v extends Error {
|
|
952
952
|
constructor(e) {
|
|
953
953
|
super(`CBOR decode: ${e}`), this.name = "CborDecodeError";
|
|
954
954
|
}
|
|
955
955
|
}
|
|
956
|
-
class
|
|
956
|
+
class Ae {
|
|
957
957
|
constructor(e) {
|
|
958
958
|
f(this, "buf");
|
|
959
959
|
/** Current read offset. Public so callers can slice encoded sub-ranges. */
|
|
@@ -962,7 +962,7 @@ class Ee {
|
|
|
962
962
|
}
|
|
963
963
|
nextByte() {
|
|
964
964
|
if (this.pos >= this.buf.length)
|
|
965
|
-
throw new
|
|
965
|
+
throw new v("unexpected end of input");
|
|
966
966
|
return this.buf[this.pos++];
|
|
967
967
|
}
|
|
968
968
|
/**
|
|
@@ -973,24 +973,24 @@ class Ee {
|
|
|
973
973
|
*/
|
|
974
974
|
readHead() {
|
|
975
975
|
const e = this.nextByte(), t = e >> 5, n = e & 31;
|
|
976
|
-
if (n <
|
|
976
|
+
if (n < oe)
|
|
977
977
|
return { major: t, arg: n };
|
|
978
978
|
if (n >= wt)
|
|
979
|
-
throw new
|
|
979
|
+
throw new v(
|
|
980
980
|
`unsupported additional info ${n} (indefinite-length or reserved)`
|
|
981
981
|
);
|
|
982
|
-
const i = 1 << n -
|
|
982
|
+
const i = 1 << n - oe;
|
|
983
983
|
let s = 0n;
|
|
984
984
|
for (let o = 0; o < i; o++)
|
|
985
985
|
s = s << 8n | BigInt(this.nextByte());
|
|
986
986
|
if (s > BigInt(Number.MAX_SAFE_INTEGER))
|
|
987
|
-
throw new
|
|
987
|
+
throw new v(`argument ${s} exceeds safe integer range`);
|
|
988
988
|
return { major: t, arg: Number(s) };
|
|
989
989
|
}
|
|
990
990
|
/** Read `length` raw bytes as a sub-array view into the backing buffer. */
|
|
991
991
|
readBytes(e) {
|
|
992
992
|
if (this.pos + e > this.buf.length)
|
|
993
|
-
throw new
|
|
993
|
+
throw new v("length overruns end of input");
|
|
994
994
|
const t = this.buf.subarray(this.pos, this.pos + e);
|
|
995
995
|
return this.pos += e, t;
|
|
996
996
|
}
|
|
@@ -1001,7 +1001,7 @@ class Ee {
|
|
|
1001
1001
|
readByteString() {
|
|
1002
1002
|
const e = this.readHead();
|
|
1003
1003
|
if (e.major !== F)
|
|
1004
|
-
throw new
|
|
1004
|
+
throw new v(
|
|
1005
1005
|
`expected byte string (major ${F}), got major ${e.major}`
|
|
1006
1006
|
);
|
|
1007
1007
|
return this.readBytes(e.arg);
|
|
@@ -1014,9 +1014,9 @@ class Ee {
|
|
|
1014
1014
|
* native call stack (see {@link MAX_NESTING_DEPTH}).
|
|
1015
1015
|
*/
|
|
1016
1016
|
readValue(e = 0) {
|
|
1017
|
-
if (e >
|
|
1018
|
-
throw new
|
|
1019
|
-
`nesting exceeds maximum depth ${
|
|
1017
|
+
if (e > ae)
|
|
1018
|
+
throw new v(
|
|
1019
|
+
`nesting exceeds maximum depth ${ae}`
|
|
1020
1020
|
);
|
|
1021
1021
|
const t = this.readHead();
|
|
1022
1022
|
switch (t.major) {
|
|
@@ -1048,39 +1048,39 @@ class Ee {
|
|
|
1048
1048
|
return { tag: t.arg, value: this.readValue(e + 1) };
|
|
1049
1049
|
case bt:
|
|
1050
1050
|
if (t.arg === xt) return !1;
|
|
1051
|
-
if (t.arg ===
|
|
1052
|
-
if (t.arg ===
|
|
1053
|
-
throw new
|
|
1051
|
+
if (t.arg === Pt) return !0;
|
|
1052
|
+
if (t.arg === vt) return null;
|
|
1053
|
+
throw new v(
|
|
1054
1054
|
`unsupported simple/float value ${t.arg}`
|
|
1055
1055
|
);
|
|
1056
1056
|
default:
|
|
1057
|
-
throw new
|
|
1057
|
+
throw new v(`unsupported major type ${t.major}`);
|
|
1058
1058
|
}
|
|
1059
1059
|
}
|
|
1060
1060
|
}
|
|
1061
|
-
function
|
|
1062
|
-
const e = new
|
|
1061
|
+
function ke(r) {
|
|
1062
|
+
const e = new Ae(r), t = e.readValue();
|
|
1063
1063
|
if (e.pos !== r.length)
|
|
1064
|
-
throw new
|
|
1064
|
+
throw new v("trailing bytes after top-level item");
|
|
1065
1065
|
return t;
|
|
1066
1066
|
}
|
|
1067
|
-
const
|
|
1067
|
+
const At = "vaultd-jsonrpc", kt = "vaultd-grpc", ce = 18, z = 4, le = -47, Et = 1, ue = 64, St = 128, Tt = 96, Ct = 64, $t = 1, It = 2, Vt = 3, Rt = 4, Ot = 5, Bt = 6, Nt = 7, de = new TextEncoder().encode("Signature1");
|
|
1068
1068
|
class h extends Error {
|
|
1069
1069
|
constructor(e, t) {
|
|
1070
1070
|
super(e), this.reason = t, this.name = "CwtVerificationError";
|
|
1071
1071
|
}
|
|
1072
1072
|
}
|
|
1073
|
-
function
|
|
1074
|
-
const e =
|
|
1073
|
+
function Dt(r) {
|
|
1074
|
+
const e = he(
|
|
1075
1075
|
r.expectedIssuerXOnlyPubkey,
|
|
1076
1076
|
"expectedIssuerXOnlyPubkey"
|
|
1077
|
-
), t =
|
|
1077
|
+
), t = he(
|
|
1078
1078
|
r.expectedAudienceXOnlyPubkey,
|
|
1079
1079
|
"expectedAudienceXOnlyPubkey"
|
|
1080
|
-
), n = Lt(r.ephemeralPubkeyHex), i = Xt(r.token), s = new
|
|
1081
|
-
if (o.major !== 6 || o.arg !==
|
|
1080
|
+
), n = Lt(r.ephemeralPubkeyHex), i = Xt(r.token), s = new Ae(i), o = s.readHead();
|
|
1081
|
+
if (o.major !== 6 || o.arg !== ce)
|
|
1082
1082
|
throw new h(
|
|
1083
|
-
`token is not a COSE Sign1 tagged value (tag ${
|
|
1083
|
+
`token is not a COSE Sign1 tagged value (tag ${ce})`,
|
|
1084
1084
|
"invalid_token_structure"
|
|
1085
1085
|
);
|
|
1086
1086
|
const c = s.readHead();
|
|
@@ -1089,12 +1089,12 @@ function Gt(r) {
|
|
|
1089
1089
|
`COSE Sign1 must be a ${z}-element array`,
|
|
1090
1090
|
"invalid_token_structure"
|
|
1091
1091
|
);
|
|
1092
|
-
const d = s.pos,
|
|
1092
|
+
const d = s.pos, l = s.readByteString(), g = i.subarray(d, s.pos);
|
|
1093
1093
|
s.readValue();
|
|
1094
1094
|
const m = s.pos, w = s.readByteString(), k = i.subarray(m, s.pos), T = s.readByteString();
|
|
1095
|
-
if (T.length !==
|
|
1095
|
+
if (T.length !== ue)
|
|
1096
1096
|
throw new h(
|
|
1097
|
-
`COSE signature must be ${
|
|
1097
|
+
`COSE signature must be ${ue} bytes, got ${T.length}`,
|
|
1098
1098
|
"invalid_token_structure"
|
|
1099
1099
|
);
|
|
1100
1100
|
if (s.pos !== i.length)
|
|
@@ -1102,10 +1102,10 @@ function Gt(r) {
|
|
|
1102
1102
|
"COSE Sign1 token has trailing bytes after the signature",
|
|
1103
1103
|
"invalid_token_structure"
|
|
1104
1104
|
);
|
|
1105
|
-
const
|
|
1106
|
-
if (
|
|
1105
|
+
const P = Gt(l);
|
|
1106
|
+
if (P !== le)
|
|
1107
1107
|
throw new h(
|
|
1108
|
-
`unexpected COSE algorithm ${
|
|
1108
|
+
`unexpected COSE algorithm ${P} (expected ES256K ${le})`,
|
|
1109
1109
|
"unexpected_algorithm"
|
|
1110
1110
|
);
|
|
1111
1111
|
const $ = Mt(g, k), _ = q($);
|
|
@@ -1114,25 +1114,25 @@ function Gt(r) {
|
|
|
1114
1114
|
"COSE signature does not verify against the server's ephemeral key",
|
|
1115
1115
|
"signature_verification_failed"
|
|
1116
1116
|
);
|
|
1117
|
-
const
|
|
1117
|
+
const u = jt(w), E = u.audience.toLowerCase();
|
|
1118
1118
|
if (E.length !== R || !S.test(E))
|
|
1119
1119
|
throw new h(
|
|
1120
1120
|
"token `aud` is not a 32-byte x-only pubkey hex",
|
|
1121
1121
|
"invalid_claims"
|
|
1122
1122
|
);
|
|
1123
|
-
if (
|
|
1123
|
+
if (u.issuedAt > u.expiresAt)
|
|
1124
1124
|
throw new h(
|
|
1125
|
-
`token iat (${
|
|
1125
|
+
`token iat (${u.issuedAt}) is after exp (${u.expiresAt})`,
|
|
1126
1126
|
"invalid_claims"
|
|
1127
1127
|
);
|
|
1128
|
-
if (
|
|
1128
|
+
if (u.issuer.toLowerCase() !== e)
|
|
1129
1129
|
throw new h(
|
|
1130
|
-
`token issuer does not match pinned server pubkey: expected ${e}, got ${
|
|
1130
|
+
`token issuer does not match pinned server pubkey: expected ${e}, got ${u.issuer.toLowerCase()}`,
|
|
1131
1131
|
"issuer_mismatch"
|
|
1132
1132
|
);
|
|
1133
|
-
if (
|
|
1133
|
+
if (u.subject !== r.expectedSubject)
|
|
1134
1134
|
throw new h(
|
|
1135
|
-
`token subject mismatch: expected ${r.expectedSubject}, got ${
|
|
1135
|
+
`token subject mismatch: expected ${r.expectedSubject}, got ${u.subject}`,
|
|
1136
1136
|
"subject_mismatch"
|
|
1137
1137
|
);
|
|
1138
1138
|
if (E !== t)
|
|
@@ -1140,47 +1140,37 @@ function Gt(r) {
|
|
|
1140
1140
|
`token audience does not match depositor pubkey: expected ${t}, got ${E}`,
|
|
1141
1141
|
"audience_mismatch"
|
|
1142
1142
|
);
|
|
1143
|
-
if (
|
|
1144
|
-
throw new h(
|
|
1145
|
-
`token not yet valid: nbf ${l.notBefore} > now ${r.now}`,
|
|
1146
|
-
"token_not_yet_valid"
|
|
1147
|
-
);
|
|
1148
|
-
if (l.issuedAt > r.now)
|
|
1149
|
-
throw new h(
|
|
1150
|
-
`token issued in the future: iat ${l.issuedAt} > now ${r.now}`,
|
|
1151
|
-
"invalid_claims"
|
|
1152
|
-
);
|
|
1153
|
-
if (l.expiresAt <= r.now)
|
|
1143
|
+
if (u.expiresAt <= r.now)
|
|
1154
1144
|
throw new h(
|
|
1155
|
-
`token expired: exp ${
|
|
1145
|
+
`token expired: exp ${u.expiresAt} <= now ${r.now}`,
|
|
1156
1146
|
"token_expired"
|
|
1157
1147
|
);
|
|
1158
|
-
if (r.responseExpiresAt !==
|
|
1148
|
+
if (r.responseExpiresAt !== u.expiresAt)
|
|
1159
1149
|
throw new h(
|
|
1160
|
-
`response expires_at (${r.responseExpiresAt}) does not equal token exp (${
|
|
1150
|
+
`response expires_at (${r.responseExpiresAt}) does not equal token exp (${u.expiresAt})`,
|
|
1161
1151
|
"expiry_mismatch"
|
|
1162
1152
|
);
|
|
1163
|
-
if (r.serverIdentityExpiresAt <
|
|
1153
|
+
if (r.serverIdentityExpiresAt < u.expiresAt)
|
|
1164
1154
|
throw new h(
|
|
1165
|
-
`server identity expires (${r.serverIdentityExpiresAt}) before token exp (${
|
|
1155
|
+
`server identity expires (${r.serverIdentityExpiresAt}) before token exp (${u.expiresAt})`,
|
|
1166
1156
|
"server_identity_expires_before_token"
|
|
1167
1157
|
);
|
|
1168
1158
|
return {
|
|
1169
|
-
issuer:
|
|
1170
|
-
subject:
|
|
1159
|
+
issuer: u.issuer,
|
|
1160
|
+
subject: u.subject,
|
|
1171
1161
|
audience: E,
|
|
1172
|
-
expiresAt:
|
|
1173
|
-
notBefore:
|
|
1174
|
-
issuedAt:
|
|
1162
|
+
expiresAt: u.expiresAt,
|
|
1163
|
+
notBefore: u.notBefore,
|
|
1164
|
+
issuedAt: u.issuedAt
|
|
1175
1165
|
};
|
|
1176
1166
|
}
|
|
1177
|
-
function
|
|
1167
|
+
function Gt(r) {
|
|
1178
1168
|
if (r.length === 0)
|
|
1179
1169
|
throw new h(
|
|
1180
1170
|
"empty COSE protected header (no algorithm)",
|
|
1181
1171
|
"unexpected_algorithm"
|
|
1182
1172
|
);
|
|
1183
|
-
const e =
|
|
1173
|
+
const e = ke(r);
|
|
1184
1174
|
if (!(e instanceof Map))
|
|
1185
1175
|
throw new h(
|
|
1186
1176
|
"COSE protected header is not a map",
|
|
@@ -1197,15 +1187,15 @@ function Dt(r) {
|
|
|
1197
1187
|
function Mt(r, e) {
|
|
1198
1188
|
return Ft(
|
|
1199
1189
|
Uint8Array.of(St | z),
|
|
1200
|
-
Uint8Array.of(Tt |
|
|
1201
|
-
|
|
1190
|
+
Uint8Array.of(Tt | de.length),
|
|
1191
|
+
de,
|
|
1202
1192
|
r,
|
|
1203
1193
|
Uint8Array.of(Ct),
|
|
1204
1194
|
e
|
|
1205
1195
|
);
|
|
1206
1196
|
}
|
|
1207
1197
|
function jt(r) {
|
|
1208
|
-
const e =
|
|
1198
|
+
const e = ke(r);
|
|
1209
1199
|
if (!(e instanceof Map))
|
|
1210
1200
|
throw new h(
|
|
1211
1201
|
"CWT claims root is not a map",
|
|
@@ -1249,7 +1239,7 @@ function J(r, e, t) {
|
|
|
1249
1239
|
);
|
|
1250
1240
|
return n;
|
|
1251
1241
|
}
|
|
1252
|
-
function
|
|
1242
|
+
function he(r, e) {
|
|
1253
1243
|
const t = V(r).toLowerCase();
|
|
1254
1244
|
if (t.length !== R || !S.test(t))
|
|
1255
1245
|
throw new h(
|
|
@@ -1260,12 +1250,12 @@ function ge(r, e) {
|
|
|
1260
1250
|
}
|
|
1261
1251
|
function Lt(r) {
|
|
1262
1252
|
const e = V(r).toLowerCase(), t = e.slice(0, 2);
|
|
1263
|
-
if (e.length !==
|
|
1253
|
+
if (e.length !== G || !S.test(e) || t !== "02" && t !== "03")
|
|
1264
1254
|
throw new h(
|
|
1265
1255
|
"ephemeralPubkeyHex must be 33-byte compressed pubkey hex (prefix 02/03)",
|
|
1266
1256
|
"invalid_input"
|
|
1267
1257
|
);
|
|
1268
|
-
return
|
|
1258
|
+
return Be(e);
|
|
1269
1259
|
}
|
|
1270
1260
|
const Ut = (() => {
|
|
1271
1261
|
const r = new Int16Array(128).fill(-1), e = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
|
|
@@ -1280,8 +1270,8 @@ function Xt(r) {
|
|
|
1280
1270
|
"invalid base64url length",
|
|
1281
1271
|
"invalid_token_structure"
|
|
1282
1272
|
);
|
|
1283
|
-
const i = t * 3 + (n === 0 ? 0 : n - 1), s = new Uint8Array(i), o = (
|
|
1284
|
-
const g =
|
|
1273
|
+
const i = t * 3 + (n === 0 ? 0 : n - 1), s = new Uint8Array(i), o = (l) => {
|
|
1274
|
+
const g = l < 128 ? Ut[l] : -1;
|
|
1285
1275
|
if (g < 0)
|
|
1286
1276
|
throw new h(
|
|
1287
1277
|
"invalid base64url character",
|
|
@@ -1290,16 +1280,16 @@ function Xt(r) {
|
|
|
1290
1280
|
return g;
|
|
1291
1281
|
};
|
|
1292
1282
|
let c = 0, d = 0;
|
|
1293
|
-
for (let
|
|
1283
|
+
for (let l = 0; l < t; l++) {
|
|
1294
1284
|
const g = o(r.charCodeAt(c++)), m = o(r.charCodeAt(c++)), w = o(r.charCodeAt(c++)), k = o(r.charCodeAt(c++));
|
|
1295
1285
|
s[d++] = g << 2 | m >> 4, s[d++] = (m & 15) << 4 | w >> 2, s[d++] = (w & 3) << 6 | k;
|
|
1296
1286
|
}
|
|
1297
1287
|
if (n === 2) {
|
|
1298
|
-
const
|
|
1299
|
-
s[d++] =
|
|
1288
|
+
const l = o(r.charCodeAt(c++)), g = o(r.charCodeAt(c++));
|
|
1289
|
+
s[d++] = l << 2 | g >> 4;
|
|
1300
1290
|
} else if (n === 3) {
|
|
1301
|
-
const
|
|
1302
|
-
s[d++] =
|
|
1291
|
+
const l = o(r.charCodeAt(c++)), g = o(r.charCodeAt(c++)), m = o(r.charCodeAt(c++));
|
|
1292
|
+
s[d++] = l << 2 | g >> 4, s[d++] = (g & 15) << 4 | m >> 2;
|
|
1303
1293
|
}
|
|
1304
1294
|
return s;
|
|
1305
1295
|
}
|
|
@@ -1310,7 +1300,7 @@ function Ft(...r) {
|
|
|
1310
1300
|
t.set(i, n), n += i.length;
|
|
1311
1301
|
return t;
|
|
1312
1302
|
}
|
|
1313
|
-
const
|
|
1303
|
+
const pe = 4102444800, Kt = 30;
|
|
1314
1304
|
class Jt {
|
|
1315
1305
|
constructor(e) {
|
|
1316
1306
|
// `client` is the only mutable field — see `setClient`. The
|
|
@@ -1391,7 +1381,7 @@ class Jt {
|
|
|
1391
1381
|
pegin_txid: this.peginTxid,
|
|
1392
1382
|
auth_anchor: this.authAnchorHex
|
|
1393
1383
|
});
|
|
1394
|
-
if (
|
|
1384
|
+
if (lt({
|
|
1395
1385
|
proof: s.server_identity,
|
|
1396
1386
|
pinnedServerPubkey: this.pinnedServerPubkey,
|
|
1397
1387
|
now: this.now()
|
|
@@ -1400,15 +1390,15 @@ class Jt {
|
|
|
1400
1390
|
`VpTokenProvider: invalid token in acquire response (expected non-empty string, got ${typeof s.token})`
|
|
1401
1391
|
);
|
|
1402
1392
|
const o = this.now();
|
|
1403
|
-
if (!Number.isSafeInteger(s.expires_at) || s.expires_at <= o || s.expires_at >
|
|
1393
|
+
if (!Number.isSafeInteger(s.expires_at) || s.expires_at <= o || s.expires_at > pe)
|
|
1404
1394
|
throw new Error(
|
|
1405
|
-
`VpTokenProvider: invalid expires_at in acquire response (got ${JSON.stringify(s.expires_at)}; must be a safe integer in (${o}, ${
|
|
1395
|
+
`VpTokenProvider: invalid expires_at in acquire response (got ${JSON.stringify(s.expires_at)}; must be a safe integer in (${o}, ${pe}])`
|
|
1406
1396
|
);
|
|
1407
|
-
|
|
1397
|
+
Dt({
|
|
1408
1398
|
token: s.token,
|
|
1409
1399
|
ephemeralPubkeyHex: s.server_identity.ephemeral_pubkey,
|
|
1410
1400
|
expectedIssuerXOnlyPubkey: this.pinnedServerPubkey,
|
|
1411
|
-
expectedSubject: e === "grpc" ? kt :
|
|
1401
|
+
expectedSubject: e === "grpc" ? kt : At,
|
|
1412
1402
|
expectedAudienceXOnlyPubkey: this.expectedAudienceXOnlyPubkey,
|
|
1413
1403
|
responseExpiresAt: s.expires_at,
|
|
1414
1404
|
serverIdentityExpiresAt: s.server_identity.expires_at,
|
|
@@ -1432,49 +1422,42 @@ class qt {
|
|
|
1432
1422
|
}
|
|
1433
1423
|
/**
|
|
1434
1424
|
* Return the cached `VpTokenProvider` for `peginTxid` if one exists
|
|
1435
|
-
* with matching `authAnchorHex
|
|
1436
|
-
*
|
|
1437
|
-
*
|
|
1438
|
-
* mask derivation drift, VP pubkey rotation, or a caller that disagrees
|
|
1439
|
-
* on the auth subject (which the cached provider can't switch).
|
|
1425
|
+
* with matching `authAnchorHex` and `pinnedServerPubkey`, otherwise
|
|
1426
|
+
* construct and cache a fresh provider. A mismatch on either throws —
|
|
1427
|
+
* silent overwrite would mask derivation drift or VP pubkey rotation.
|
|
1440
1428
|
*/
|
|
1441
1429
|
getOrCreate(e) {
|
|
1442
|
-
const t =
|
|
1443
|
-
if (
|
|
1444
|
-
if (
|
|
1430
|
+
const t = this.entries.get(e.peginTxid);
|
|
1431
|
+
if (t) {
|
|
1432
|
+
if (t.authAnchorHex !== e.authAnchorHex)
|
|
1445
1433
|
throw new Error(
|
|
1446
|
-
`VpTokenRegistry: peginTxid ${e.peginTxid} already bound to authAnchorHex ${
|
|
1434
|
+
`VpTokenRegistry: peginTxid ${e.peginTxid} already bound to authAnchorHex ${t.authAnchorHex.slice(0, 8)}…; got ${e.authAnchorHex.slice(0, 8)}…`
|
|
1447
1435
|
);
|
|
1448
|
-
if (
|
|
1436
|
+
if (t.pinnedServerPubkey !== e.pinnedServerPubkey)
|
|
1449
1437
|
throw new Error(
|
|
1450
|
-
`VpTokenRegistry: peginTxid ${e.peginTxid} already bound to pinnedServerPubkey ${
|
|
1438
|
+
`VpTokenRegistry: peginTxid ${e.peginTxid} already bound to pinnedServerPubkey ${t.pinnedServerPubkey.slice(0, 8)}…; got ${e.pinnedServerPubkey.slice(0, 8)}…`
|
|
1451
1439
|
);
|
|
1452
|
-
if (
|
|
1440
|
+
if (t.expectedAudienceXOnlyPubkey !== e.expectedAudienceXOnlyPubkey)
|
|
1453
1441
|
throw new Error(
|
|
1454
|
-
`VpTokenRegistry: peginTxid ${e.peginTxid} already bound to expectedAudienceXOnlyPubkey ${
|
|
1442
|
+
`VpTokenRegistry: peginTxid ${e.peginTxid} already bound to expectedAudienceXOnlyPubkey ${t.expectedAudienceXOnlyPubkey.slice(0, 8)}…; got ${e.expectedAudienceXOnlyPubkey.slice(0, 8)}…`
|
|
1455
1443
|
);
|
|
1456
|
-
|
|
1457
|
-
throw new Error(
|
|
1458
|
-
`VpTokenRegistry: peginTxid ${e.peginTxid} already bound to enableGrpcArtifactAuth=${n.enableGrpcArtifactAuth}; got ${t}`
|
|
1459
|
-
);
|
|
1460
|
-
return n.provider.setClient(e.client), n.provider;
|
|
1444
|
+
return t.provider.setClient(e.client), t.provider;
|
|
1461
1445
|
}
|
|
1462
|
-
const
|
|
1446
|
+
const n = new Jt({
|
|
1463
1447
|
client: e.client,
|
|
1464
1448
|
peginTxid: e.peginTxid,
|
|
1465
1449
|
authAnchorHex: e.authAnchorHex,
|
|
1466
1450
|
pinnedServerPubkey: e.pinnedServerPubkey,
|
|
1467
1451
|
expectedAudienceXOnlyPubkey: e.expectedAudienceXOnlyPubkey,
|
|
1468
|
-
authGatedMethods:
|
|
1469
|
-
grpcGatedMethods:
|
|
1452
|
+
authGatedMethods: ut,
|
|
1453
|
+
grpcGatedMethods: dt
|
|
1470
1454
|
});
|
|
1471
1455
|
return this.entries.set(e.peginTxid, {
|
|
1472
|
-
provider:
|
|
1456
|
+
provider: n,
|
|
1473
1457
|
authAnchorHex: e.authAnchorHex,
|
|
1474
1458
|
pinnedServerPubkey: e.pinnedServerPubkey,
|
|
1475
|
-
expectedAudienceXOnlyPubkey: e.expectedAudienceXOnlyPubkey
|
|
1476
|
-
|
|
1477
|
-
}), i;
|
|
1459
|
+
expectedAudienceXOnlyPubkey: e.expectedAudienceXOnlyPubkey
|
|
1460
|
+
}), n;
|
|
1478
1461
|
}
|
|
1479
1462
|
/** Return the cached provider, or `undefined` if none. */
|
|
1480
1463
|
peek(e) {
|
|
@@ -1502,54 +1485,52 @@ class qt {
|
|
|
1502
1485
|
return this.entries.size;
|
|
1503
1486
|
}
|
|
1504
1487
|
}
|
|
1505
|
-
const
|
|
1488
|
+
const Ee = new qt();
|
|
1506
1489
|
function dr(r) {
|
|
1507
1490
|
var n;
|
|
1508
|
-
const e =
|
|
1491
|
+
const e = ve(
|
|
1509
1492
|
r.baseUrl,
|
|
1510
1493
|
(n = r.options) == null ? void 0 : n.headers
|
|
1511
|
-
), t =
|
|
1494
|
+
), t = Ee.getOrCreate({
|
|
1512
1495
|
client: e,
|
|
1513
1496
|
peginTxid: r.peginTxid,
|
|
1514
1497
|
authAnchorHex: r.authAnchorHex,
|
|
1515
1498
|
pinnedServerPubkey: r.pinnedServerPubkey,
|
|
1516
|
-
expectedAudienceXOnlyPubkey:
|
|
1499
|
+
expectedAudienceXOnlyPubkey: fe(
|
|
1517
1500
|
r.depositorBtcPubkey
|
|
1518
|
-
)
|
|
1519
|
-
enableGrpcArtifactAuth: r.enableGrpcArtifactAuth
|
|
1501
|
+
)
|
|
1520
1502
|
});
|
|
1521
|
-
return new
|
|
1503
|
+
return new Qe(r.baseUrl, {
|
|
1522
1504
|
...r.options,
|
|
1523
1505
|
tokenProvider: t
|
|
1524
1506
|
});
|
|
1525
1507
|
}
|
|
1526
1508
|
function hr(r) {
|
|
1527
|
-
|
|
1528
|
-
client:
|
|
1509
|
+
Ee.getOrCreate({
|
|
1510
|
+
client: ve(r.baseUrl, r.headers),
|
|
1529
1511
|
peginTxid: r.peginTxid,
|
|
1530
1512
|
authAnchorHex: r.authAnchorHex,
|
|
1531
1513
|
pinnedServerPubkey: r.pinnedServerPubkey,
|
|
1532
|
-
expectedAudienceXOnlyPubkey:
|
|
1514
|
+
expectedAudienceXOnlyPubkey: fe(
|
|
1533
1515
|
r.depositorBtcPubkey
|
|
1534
|
-
)
|
|
1535
|
-
enableGrpcArtifactAuth: r.enableGrpcArtifactAuth
|
|
1516
|
+
)
|
|
1536
1517
|
});
|
|
1537
1518
|
}
|
|
1538
1519
|
export {
|
|
1539
|
-
|
|
1520
|
+
De as O,
|
|
1540
1521
|
y as S,
|
|
1541
|
-
|
|
1522
|
+
Qe as V,
|
|
1542
1523
|
a,
|
|
1543
1524
|
ur as b,
|
|
1544
|
-
|
|
1525
|
+
lt as c,
|
|
1545
1526
|
qt as d,
|
|
1546
|
-
|
|
1527
|
+
Ee as e,
|
|
1547
1528
|
dr as f,
|
|
1548
1529
|
ar as g,
|
|
1549
1530
|
lr as h,
|
|
1550
1531
|
cr as i,
|
|
1551
1532
|
hr as p,
|
|
1552
1533
|
or as r,
|
|
1553
|
-
|
|
1534
|
+
Fe as v
|
|
1554
1535
|
};
|
|
1555
|
-
//# sourceMappingURL=primeVpAuth-
|
|
1536
|
+
//# sourceMappingURL=primeVpAuth-DxMuWQCi.js.map
|