@babylonlabs-io/ts-sdk 2.0.0 → 2.0.2

package/dist/{bip322Verify-DSco3Yhl.js → bip322Verify-BXYrHBh8.js}

@@ -1,6 +1,6 @@
 import * as u from "@bitcoin-js/tiny-secp256k1-asmjs";
 import { Transaction as c, payments as l, script as S } from "bitcoinjs-lib";
-import { s as p } from "./sha2-CLpQd0Rd.js";
+import { s as p } from "./sha2-YqVHJiFj.js";
 import { Buffer as a } from "buffer";
 const O = "BIP0322-signed-message", A = "TapTweak", P = 32, H = 64, N = 33, d = 71, w = 72, _ = 0, E = 0, T = 0, g = 0, B = 32, D = 4294967295, U = 0, k = 0, G = 32, R = 106;
 function I(r, n) {
@@ -76,4 +76,4 @@ export {
   v as b,
   L as v
 };
-//# sourceMappingURL=bip322Verify-DSco3Yhl.js.map
+//# sourceMappingURL=bip322Verify-BXYrHBh8.js.map

package/dist/{bip322Verify-DSco3Yhl.js.map → bip322Verify-BXYrHBh8.js.map}

@@ -1 +1 @@
-{"version":3,"file":"bip322Verify-DSco3Yhl.js","sources":["../src/tbv/core/clients/vault-provider/auth/bip322Verify.ts"],"sourcesContent":["/**\n * BIP-322 \"simple\" signature verification for P2TR key-path and P2WPKH.\n *\n * Mirrors the Rust reference in\n * `btc-vault/crates/btc-signer/src/message.rs` (`verify_bip322_message`\n * and the P2WPKH arm of `verify_pop_witness`, both of which delegate to\n * the `bip322` crate 0.0.10's `verify_simple`).\n *\n * The algorithm:\n *\n *   1. Compute the BIP-322 tagged-hash of the message:\n *        m_hash = SHA256( SHA256(tag) || SHA256(tag) || message )\n *      where tag = \"BIP0322-signed-message\".\n *\n *   2. Build a virtual \"to_spend\" transaction with one input (prevout\n *      all-zero txid + 0xFFFFFFFF vout, scriptSig = `OP_0 PUSH32 m_hash`,\n *      sequence = 0) and one output (value 0, scriptPubKey = the signer's\n *      address: P2TR key-path-only, or P2WPKH of the compressed pubkey).\n *\n *   3. Build a \"to_sign\" transaction that spends to_spend[0] and has a\n *      single `OP_RETURN` output (value 0).\n *\n *   4. Compute the sighash of to_sign input 0: BIP-341 taproot for P2TR\n *      (SIGHASH_DEFAULT 0x00 unless the witness item carried a trailing\n *      SIGHASH_ALL 0x01 byte), BIP-143 with the standard P2WPKH\n *      scriptCode for P2WPKH (SIGHASH_ALL only).\n *\n *   5. Verify the signature: Schnorr against the **tweaked** output key\n *      `Q = P + tap_tweak(P) * G` for P2TR (no merkle root — key-path\n *      only), ECDSA against the compressed pubkey for P2WPKH.\n *\n * `bitcoinjs-lib` handles (2)–(4); `tiny-secp256k1-asmjs` provides\n * the tweak and the Schnorr/ECDSA verifies. Pulling in a full BIP-322\n * library would add a peer dep for what amounts to ~40 lines of glue.\n *\n * @module tbv/core/clients/vault-provider/auth/bip322Verify\n */\n\nimport * as ecc from \"@bitcoin-js/tiny-secp256k1-asmjs\";\nimport { script as bscript, payments, Transaction } from \"bitcoinjs-lib\";\n\nimport { sha256 } from \"@noble/hashes/sha2.js\";\nimport { Buffer } from \"buffer\";\n\n/** BIP-322 message tag (BIP-340 tagged-hash style). */\nconst BIP322_TAG = \"BIP0322-signed-message\";\n\n/** BIP-341 taproot-tweak tag. */\nconst TAPTWEAK_TAG = \"TapTweak\";\n\nconst X_ONLY_PUBKEY_SIZE = 32;\nconst SCHNORR_SIG_SIZE = 64;\n/** SEC1 compressed pubkey: 0x02/0x03 prefix + 32-byte x coordinate. */\nconst COMPRESSED_PUBKEY_SIZE = 33;\n/**\n * vaultd's P2WPKH BIP-322 verifier accepts ONLY 71/72-byte encoded\n * signatures — DER (70/71B) + sighash byte (`bip322` crate 0.0.10\n * `verify.rs:141-153`). A shorter (short-DER) signature fails ingestion\n * permanently, so this gate must be exactly as strict. Exported so\n * `verifyPopWitness` can pre-screen with a cause-naming error.\n */\nexport const P2WPKH_ENCODED_SIG_MIN = 71;\nexport const P2WPKH_ENCODED_SIG_MAX = 72;\n\n// NOTE: bitcoinjs-lib v6.x's `Transaction.addOutput` and its sighash\n// methods are typed for `Satoshi` (a UInt53 number), not `bigint`.\n// Passing `BigInt(0)` triggers a typeforce assertion in `addOutput`\n// (\"Expected property '1' of type Satoshi, got BigInt 0\") which the\n// verifiers' try/catch silently turns into `verify -> false`. Use\n// plain `0` everywhere.\nconst ZERO_SATS = 0;\n\n// Wire fields of the virtual to_spend/to_sign transactions (`bip322`\n// crate 0.0.10 `util.rs:18-85`).\nconst BIP322_TX_VERSION = 0;\nconst BIP322_TX_LOCKTIME = 0;\nconst BIP322_INPUT_SEQUENCE = 0;\n/** to_spend prevout: all-zero 32-byte txid at index 0xFFFFFFFF (`util.rs:18-85`). */\nconst TO_SPEND_PREVOUT_TXID_BYTES = 32;\nconst TO_SPEND_PREVOUT_INDEX = 0xffffffff;\n/** to_sign spends to_spend's only output (`util.rs:18-85`). */\nconst TO_SPEND_OUTPUT_INDEX = 0;\nconst OP_0 = 0x00;\n/** Direct push of the 32-byte tagged message hash. */\nconst OP_PUSHBYTES_32 = 0x20;\nconst OP_RETURN = 0x6a;\n\n/**\n * BIP-340 tagged hash: `SHA256( SHA256(tag) || SHA256(tag) || data )`.\n * Used for both BIP-322 message hashing and BIP-341 tap-tweak.\n */\nfunction taggedHash(tag: string, data: Uint8Array): Uint8Array {\n  const tagBytes = new TextEncoder().encode(tag);\n  const tagHash = sha256(tagBytes);\n  const preimage = new Uint8Array(tagHash.length * 2 + data.length);\n  preimage.set(tagHash, 0);\n  preimage.set(tagHash, tagHash.length);\n  preimage.set(data, tagHash.length * 2);\n  return sha256(preimage);\n}\n\n/**\n * Apply BIP-341 taproot tweak to an x-only pubkey with no merkle\n * root (key-path-only address).\n *\n * `tap_tweak = hash_TapTweak(P)`\n * `Q = P + tap_tweak * G` (x-only, even-Y parity)\n *\n * Returns the tweaked 32-byte x-only pubkey, or null if the tweak\n * produces a point-at-infinity or invalid result.\n */\nfunction tweakXOnlyKey(xOnly: Uint8Array): Uint8Array | null {\n  if (xOnly.length !== X_ONLY_PUBKEY_SIZE) return null;\n  const tweak = taggedHash(TAPTWEAK_TAG, xOnly);\n  const tweaked = ecc.xOnlyPointAddTweak(xOnly, tweak);\n  return tweaked ? tweaked.xOnlyPubkey : null;\n}\n\n/**\n * Build the BIP-322 virtual `to_sign` transaction for a signer\n * scriptPubKey (steps 1–3 above; `bip322` crate 0.0.10 `util.rs:18-85`:\n * both txs version 0, locktime 0, sequence 0, all values 0).\n */\nfunction buildToSignTransaction(\n  messageBytes: Uint8Array,\n  scriptPubKey: Buffer,\n): Transaction {\n  const messageHash = taggedHash(BIP322_TAG, messageBytes);\n\n  const toSpend = new Transaction();\n  toSpend.version = BIP322_TX_VERSION;\n  toSpend.locktime = BIP322_TX_LOCKTIME;\n  const scriptSig = Buffer.concat([\n    Buffer.from([OP_0, OP_PUSHBYTES_32]),\n    Buffer.from(messageHash),\n  ]);\n  toSpend.addInput(\n    Buffer.alloc(TO_SPEND_PREVOUT_TXID_BYTES, 0),\n    TO_SPEND_PREVOUT_INDEX,\n    BIP322_INPUT_SEQUENCE,\n    scriptSig,\n  );\n  toSpend.addOutput(scriptPubKey, ZERO_SATS);\n\n  const toSign = new Transaction();\n  toSign.version = BIP322_TX_VERSION;\n  toSign.locktime = BIP322_TX_LOCKTIME;\n  // Bitcoin txid in natural-byte (little-endian) form.\n  toSign.addInput(\n    toSpend.getHash(),\n    TO_SPEND_OUTPUT_INDEX,\n    BIP322_INPUT_SEQUENCE,\n  );\n  toSign.addOutput(Buffer.from([OP_RETURN]), ZERO_SATS);\n\n  return toSign;\n}\n\n/**\n * Verify a BIP-322 \"simple\" P2TR key-path signature over an arbitrary\n * byte message.\n *\n * @internal Consumed by `verifyServerIdentity` (VP auth) and\n * `verifyPopWitness` (PoP pre-registration check), and exposed so the\n * golden-vector test suite can pin the verifier independently.\n *\n * @param messageBytes - The bytes that were signed (e.g. a CBOR-encoded\n *                       payload). Not pre-hashed; this function applies\n *                       the BIP-322 tagged hash internally.\n * @param xOnlyPubkey  - 32-byte x-only pubkey of the signer (pre-tweak).\n * @param signature    - 64-byte raw Schnorr signature (BIP-340), as\n *                       emitted by a key-path witness. The trailing\n *                       sighash byte of a 65-byte witness item is not\n *                       part of it — pass it as `hashType` instead.\n * @param hashType     - BIP-341 sighash type the signature commits to.\n *                       `SIGHASH_DEFAULT` (0x00) for a 64-byte witness\n *                       item, `SIGHASH_ALL` (0x01) for a 65-byte one.\n * @returns `true` if the signature verifies against the address\n *          derived from `xOnlyPubkey`; `false` otherwise.\n */\nexport function verifyBip322Simple(\n  messageBytes: Uint8Array,\n  xOnlyPubkey: Uint8Array,\n  signature: Uint8Array,\n  hashType: number = Transaction.SIGHASH_DEFAULT,\n): boolean {\n  if (xOnlyPubkey.length !== X_ONLY_PUBKEY_SIZE) return false;\n  if (signature.length !== SCHNORR_SIG_SIZE) return false;\n  // Only the two types a BIP-322 witness may carry. SIGHASH_NONE/SINGLE and the\n  // ANYONECANPAY variants would verify here but are rejected downstream.\n  if (\n    hashType !== Transaction.SIGHASH_DEFAULT &&\n    hashType !== Transaction.SIGHASH_ALL\n  ) {\n    return false;\n  }\n\n  // Any exception from the underlying crypto libraries (e.g. the\n  // `Expected Point` error `tiny-secp256k1` throws when the supplied\n  // 32 bytes don't represent a valid x-coordinate on secp256k1) is\n  // treated as a verification failure rather than propagated — a\n  // verifier MUST return a boolean, not raise.\n  try {\n    // scriptPubKey for the signer's P2TR key-path-only address.\n    // bitcoinjs-lib's `payments.p2tr({ internalPubkey })` computes the\n    // tweak and produces the `OP_1 <tweaked_xonly>` output script.\n    const p2tr = payments.p2tr({\n      internalPubkey: Buffer.from(xOnlyPubkey),\n    });\n    if (!p2tr.output) return false;\n    const scriptPubKey = p2tr.output;\n\n    const toSign = buildToSignTransaction(messageBytes, scriptPubKey);\n\n    // Taproot sighash for to_sign input 0.\n    const sighash = toSign.hashForWitnessV1(\n      0,\n      [scriptPubKey],\n      [ZERO_SATS],\n      hashType,\n    );\n\n    // Tweak the x-only pubkey (no merkle root) and verify Schnorr.\n    const tweakedXOnly = tweakXOnlyKey(xOnlyPubkey);\n    if (!tweakedXOnly) return false;\n\n    return ecc.verifySchnorr(sighash, tweakedXOnly, signature);\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Verify a BIP-322 \"simple\" P2WPKH signature over an arbitrary byte\n * message, mirroring the verifier vaultd runs on a two-item PoP witness\n * (`bip322` crate 0.0.10 `verify.rs:102-186 verify_full_p2wpkh`).\n *\n * @internal Consumed by `verifyPopWitness` for Native SegWit software\n * wallets, and exposed so the BIP-322 official-vector test suite can pin\n * the verifier independently.\n *\n * @param compressedPubkey - 33-byte SEC1 compressed pubkey of the signer\n *                           (witness item 1). The address is derived from\n *                           it; network affects only bech32 encoding, not\n *                           script or sighash (`message.rs:125-127`).\n * @param encodedSignature - Witness item 0: DER signature with trailing\n *                           sighash byte, 71 or 72 bytes, SIGHASH_ALL only\n *                           (`verify.rs:141-161`).\n * @returns `true` if the signature verifies against the P2WPKH address of\n *          `compressedPubkey`; `false` otherwise.\n */\nexport function verifyBip322P2wpkhSimple(\n  messageBytes: Uint8Array,\n  compressedPubkey: Uint8Array,\n  encodedSignature: Uint8Array,\n): boolean {\n  if (compressedPubkey.length !== COMPRESSED_PUBKEY_SIZE) return false;\n  if (\n    encodedSignature.length < P2WPKH_ENCODED_SIG_MIN ||\n    encodedSignature.length > P2WPKH_ENCODED_SIG_MAX\n  ) {\n    return false;\n  }\n  // Any exception below (strict-DER decode, malformed pubkey) is a\n  // verification failure, not an error — a verifier returns a boolean.\n  try {\n    // Full curve-point parse, as `PublicKey::from_slice` (`verify.rs:82-83`).\n    if (!ecc.isPointCompressed(compressedPubkey)) return false;\n\n    // Strict DER decode, then SIGHASH_ALL only — deliberately NARROWER than\n    // `verify.rs:156-161` (its from_consensus maps more bytes to All); host-stricter is safe.\n    const { signature, hashType } = bscript.signature.decode(\n      Buffer.from(encodedSignature),\n    );\n    // decode tolerates non-minimal integers (bip66.js never bounds lenR/lenS at 33;\n    // fromDER truncates, script_signature.js:29-35) that vaultd's strict libsecp\n    // parse rejects (secp256k1-sys ecdsa_impl.h:127-136) — require the unique\n    // minimal encoding by re-encoding and byte-comparing.\n    if (\n      !bscript.signature\n        .encode(signature, hashType)\n        .equals(Buffer.from(encodedSignature))\n    ) {\n      return false;\n    }\n    if (hashType !== Transaction.SIGHASH_ALL) return false;\n\n    // scriptPubKey = OP_0 PUSH20 hash160(pubkey) (`message.rs:127 Address::p2wpkh`).\n    const p2wpkh = payments.p2wpkh({ pubkey: Buffer.from(compressedPubkey) });\n    if (!p2wpkh.output || !p2wpkh.hash) return false;\n\n    const toSign = buildToSignTransaction(messageBytes, p2wpkh.output);\n\n    // BIP-143 sighash with the standard P2WPKH scriptCode\n    // `OP_DUP OP_HASH160 <20B> OP_EQUALVERIFY OP_CHECKSIG` and value 0\n    // (`verify.rs:163-173 p2wpkh_signature_hash`; scriptCode template per\n    // bitcoinjs-lib's own P2WPKH signer, `src/psbt.js:1245-1255`).\n    const scriptCode = payments.p2pkh({ hash: p2wpkh.hash }).output;\n    if (!scriptCode) return false;\n    const sighash = toSign.hashForWitnessV0(0, scriptCode, ZERO_SATS, hashType);\n\n    // strict=true rejects high-S, as libsecp256k1's verify does\n    // (`verify.rs:180-182`; secp256k1 crate `ecdsa/mod.rs:194`).\n    return ecc.verify(sighash, compressedPubkey, signature, true);\n  } catch {\n    return false;\n  }\n}\n"],"names":["BIP322_TAG","TAPTWEAK_TAG","X_ONLY_PUBKEY_SIZE","SCHNORR_SIG_SIZE","COMPRESSED_PUBKEY_SIZE","P2WPKH_ENCODED_SIG_MIN","P2WPKH_ENCODED_SIG_MAX","ZERO_SATS","BIP322_TX_VERSION","BIP322_TX_LOCKTIME","BIP322_INPUT_SEQUENCE","TO_SPEND_PREVOUT_TXID_BYTES","TO_SPEND_PREVOUT_INDEX","TO_SPEND_OUTPUT_INDEX","OP_0","OP_PUSHBYTES_32","OP_RETURN","taggedHash","tag","data","tagBytes","tagHash","sha256","preimage","tweakXOnlyKey","xOnly","tweak","tweaked","ecc","buildToSignTransaction","messageBytes","scriptPubKey","messageHash","toSpend","Transaction","scriptSig","Buffer","toSign","verifyBip322Simple","xOnlyPubkey","signature","hashType","p2tr","payments","sighash","tweakedXOnly","verifyBip322P2wpkhSimple","compressedPubkey","encodedSignature","bscript","p2wpkh","scriptCode"],"mappings":";;;;AA6CA,MAAMA,IAAa,0BAGbC,IAAe,YAEfC,IAAqB,IACrBC,IAAmB,IAEnBC,IAAyB,IAQlBC,IAAyB,IACzBC,IAAyB,IAQhCC,IAAY,GAIZC,IAAoB,GACpBC,IAAqB,GACrBC,IAAwB,GAExBC,IAA8B,IAC9BC,IAAyB,YAEzBC,IAAwB,GACxBC,IAAO,GAEPC,IAAkB,IAClBC,IAAY;AAMlB,SAASC,EAAWC,GAAaC,GAA8B;AAC7D,QAAMC,IAAW,IAAI,cAAc,OAAOF,CAAG,GACvCG,IAAUC,EAAOF,CAAQ,GACzBG,IAAW,IAAI,WAAWF,EAAQ,SAAS,IAAIF,EAAK,MAAM;AAChE,SAAAI,EAAS,IAAIF,GAAS,CAAC,GACvBE,EAAS,IAAIF,GAASA,EAAQ,MAAM,GACpCE,EAAS,IAAIJ,GAAME,EAAQ,SAAS,CAAC,GAC9BC,EAAOC,CAAQ;AACxB;AAYA,SAASC,EAAcC,GAAsC;AAC3D,MAAIA,EAAM,WAAWvB,EAAoB,QAAO;AAChD,QAAMwB,IAAQT,EAAWhB,GAAcwB,CAAK,GACtCE,IAAUC,EAAI,mBAAmBH,GAAOC,CAAK;AACnD,SAAOC,IAAUA,EAAQ,cAAc;AACzC;AAOA,SAASE,EACPC,GACAC,GACa;AACb,QAAMC,IAAcf,EAAWjB,GAAY8B,CAAY,GAEjDG,IAAU,IAAIC,EAAA;AACpB,EAAAD,EAAQ,UAAUzB,GAClByB,EAAQ,WAAWxB;AACnB,QAAM0B,IAAYC,EAAO,OAAO;AAAA,IAC9BA,EAAO,KAAK,CAACtB,GAAMC,CAAe,CAAC;AAAA,IACnCqB,EAAO,KAAKJ,CAAW;AAAA,EAAA,CACxB;AACD,EAAAC,EAAQ;AAAA,IACNG,EAAO,MAAMzB,GAA6B,CAAC;AAAA,IAC3CC;AAAA,IACAF;AAAA,IACAyB;AAAA,EAAA,GAEFF,EAAQ,UAAUF,GAAcxB,CAAS;AAEzC,QAAM8B,IAAS,IAAIH,EAAA;AACnB,SAAAG,EAAO,UAAU7B,GACjB6B,EAAO,WAAW5B,GAElB4B,EAAO;AAAA,IACLJ,EAAQ,QAAA;AAAA,IACRpB;AAAA,IACAH;AAAA,EAAA,GAEF2B,EAAO,UAAUD,EAAO,KAAK,CAACpB,CAAS,CAAC,GAAGT,CAAS,GAE7C8B;AACT;AAwBO,SAASC,EACdR,GACAS,GACAC,GACAC,IAAmBP,EAAY,iBACtB;AAKT,MAJIK,EAAY,WAAWrC,KACvBsC,EAAU,WAAWrC,KAIvBsC,MAAaP,EAAY,mBACzBO,MAAaP,EAAY;AAEzB,WAAO;AAQT,MAAI;AAIF,UAAMQ,IAAOC,EAAS,KAAK;AAAA,MACzB,gBAAgBP,EAAO,KAAKG,CAAW;AAAA,IAAA,CACxC;AACD,QAAI,CAACG,EAAK,OAAQ,QAAO;AACzB,UAAMX,IAAeW,EAAK,QAKpBE,IAHSf,EAAuBC,GAAcC,CAAY,EAGzC;AAAA,MACrB;AAAA,MACA,CAACA,CAAY;AAAA,MACb,CAACxB,CAAS;AAAA,MACVkC;AAAA,IAAA,GAIII,IAAerB,EAAce,CAAW;AAC9C,WAAKM,IAEEjB,EAAI,cAAcgB,GAASC,GAAcL,CAAS,IAF/B;AAAA,EAG5B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAqBO,SAASM,EACdhB,GACAiB,GACAC,GACS;AAET,MADID,EAAiB,WAAW3C,KAE9B4C,EAAiB,SAAS3C,KAC1B2C,EAAiB,SAAS1C;AAE1B,WAAO;AAIT,MAAI;AAEF,QAAI,CAACsB,EAAI,kBAAkBmB,CAAgB,EAAG,QAAO;AAIrD,UAAM,EAAE,WAAAP,GAAW,UAAAC,EAAA,IAAaQ,EAAQ,UAAU;AAAA,MAChDb,EAAO,KAAKY,CAAgB;AAAA,IAAA;AAa9B,QANE,CAACC,EAAQ,UACN,OAAOT,GAAWC,CAAQ,EAC1B,OAAOL,EAAO,KAAKY,CAAgB,CAAC,KAIrCP,MAAaP,EAAY,YAAa,QAAO;AAGjD,UAAMgB,IAASP,EAAS,OAAO,EAAE,QAAQP,EAAO,KAAKW,CAAgB,GAAG;AACxE,QAAI,CAACG,EAAO,UAAU,CAACA,EAAO,KAAM,QAAO;AAE3C,UAAMb,IAASR,EAAuBC,GAAcoB,EAAO,MAAM,GAM3DC,IAAaR,EAAS,MAAM,EAAE,MAAMO,EAAO,KAAA,CAAM,EAAE;AACzD,QAAI,CAACC,EAAY,QAAO;AACxB,UAAMP,IAAUP,EAAO,iBAAiB,GAAGc,GAAY5C,GAAWkC,CAAQ;AAI1E,WAAOb,EAAI,OAAOgB,GAASG,GAAkBP,GAAW,EAAI;AAAA,EAC9D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;"}
+{"version":3,"file":"bip322Verify-BXYrHBh8.js","sources":["../src/tbv/core/clients/vault-provider/auth/bip322Verify.ts"],"sourcesContent":["/**\n * BIP-322 \"simple\" signature verification for P2TR key-path and P2WPKH.\n *\n * Mirrors the Rust reference in\n * `btc-vault/crates/btc-signer/src/message.rs` (`verify_bip322_message`\n * and the P2WPKH arm of `verify_pop_witness`, both of which delegate to\n * the `bip322` crate 0.0.10's `verify_simple`).\n *\n * The algorithm:\n *\n *   1. Compute the BIP-322 tagged-hash of the message:\n *        m_hash = SHA256( SHA256(tag) || SHA256(tag) || message )\n *      where tag = \"BIP0322-signed-message\".\n *\n *   2. Build a virtual \"to_spend\" transaction with one input (prevout\n *      all-zero txid + 0xFFFFFFFF vout, scriptSig = `OP_0 PUSH32 m_hash`,\n *      sequence = 0) and one output (value 0, scriptPubKey = the signer's\n *      address: P2TR key-path-only, or P2WPKH of the compressed pubkey).\n *\n *   3. Build a \"to_sign\" transaction that spends to_spend[0] and has a\n *      single `OP_RETURN` output (value 0).\n *\n *   4. Compute the sighash of to_sign input 0: BIP-341 taproot for P2TR\n *      (SIGHASH_DEFAULT 0x00 unless the witness item carried a trailing\n *      SIGHASH_ALL 0x01 byte), BIP-143 with the standard P2WPKH\n *      scriptCode for P2WPKH (SIGHASH_ALL only).\n *\n *   5. Verify the signature: Schnorr against the **tweaked** output key\n *      `Q = P + tap_tweak(P) * G` for P2TR (no merkle root — key-path\n *      only), ECDSA against the compressed pubkey for P2WPKH.\n *\n * `bitcoinjs-lib` handles (2)–(4); `tiny-secp256k1-asmjs` provides\n * the tweak and the Schnorr/ECDSA verifies. Pulling in a full BIP-322\n * library would add a peer dep for what amounts to ~40 lines of glue.\n *\n * @module tbv/core/clients/vault-provider/auth/bip322Verify\n */\n\nimport * as ecc from \"@bitcoin-js/tiny-secp256k1-asmjs\";\nimport { script as bscript, payments, Transaction } from \"bitcoinjs-lib\";\n\nimport { sha256 } from \"@noble/hashes/sha2.js\";\nimport { Buffer } from \"buffer\";\n\n/** BIP-322 message tag (BIP-340 tagged-hash style). */\nconst BIP322_TAG = \"BIP0322-signed-message\";\n\n/** BIP-341 taproot-tweak tag. */\nconst TAPTWEAK_TAG = \"TapTweak\";\n\nconst X_ONLY_PUBKEY_SIZE = 32;\nconst SCHNORR_SIG_SIZE = 64;\n/** SEC1 compressed pubkey: 0x02/0x03 prefix + 32-byte x coordinate. */\nconst COMPRESSED_PUBKEY_SIZE = 33;\n/**\n * vaultd's P2WPKH BIP-322 verifier accepts ONLY 71/72-byte encoded\n * signatures — DER (70/71B) + sighash byte (`bip322` crate 0.0.10\n * `verify.rs:141-153`). A shorter (short-DER) signature fails ingestion\n * permanently, so this gate must be exactly as strict. Exported so\n * `verifyPopWitness` can pre-screen with a cause-naming error.\n */\nexport const P2WPKH_ENCODED_SIG_MIN = 71;\nexport const P2WPKH_ENCODED_SIG_MAX = 72;\n\n// NOTE: bitcoinjs-lib v6.x's `Transaction.addOutput` and its sighash\n// methods are typed for `Satoshi` (a UInt53 number), not `bigint`.\n// Passing `BigInt(0)` triggers a typeforce assertion in `addOutput`\n// (\"Expected property '1' of type Satoshi, got BigInt 0\") which the\n// verifiers' try/catch silently turns into `verify -> false`. Use\n// plain `0` everywhere.\nconst ZERO_SATS = 0;\n\n// Wire fields of the virtual to_spend/to_sign transactions (`bip322`\n// crate 0.0.10 `util.rs:18-85`).\nconst BIP322_TX_VERSION = 0;\nconst BIP322_TX_LOCKTIME = 0;\nconst BIP322_INPUT_SEQUENCE = 0;\n/** to_spend prevout: all-zero 32-byte txid at index 0xFFFFFFFF (`util.rs:18-85`). */\nconst TO_SPEND_PREVOUT_TXID_BYTES = 32;\nconst TO_SPEND_PREVOUT_INDEX = 0xffffffff;\n/** to_sign spends to_spend's only output (`util.rs:18-85`). */\nconst TO_SPEND_OUTPUT_INDEX = 0;\nconst OP_0 = 0x00;\n/** Direct push of the 32-byte tagged message hash. */\nconst OP_PUSHBYTES_32 = 0x20;\nconst OP_RETURN = 0x6a;\n\n/**\n * BIP-340 tagged hash: `SHA256( SHA256(tag) || SHA256(tag) || data )`.\n * Used for both BIP-322 message hashing and BIP-341 tap-tweak.\n */\nfunction taggedHash(tag: string, data: Uint8Array): Uint8Array {\n  const tagBytes = new TextEncoder().encode(tag);\n  const tagHash = sha256(tagBytes);\n  const preimage = new Uint8Array(tagHash.length * 2 + data.length);\n  preimage.set(tagHash, 0);\n  preimage.set(tagHash, tagHash.length);\n  preimage.set(data, tagHash.length * 2);\n  return sha256(preimage);\n}\n\n/**\n * Apply BIP-341 taproot tweak to an x-only pubkey with no merkle\n * root (key-path-only address).\n *\n * `tap_tweak = hash_TapTweak(P)`\n * `Q = P + tap_tweak * G` (x-only, even-Y parity)\n *\n * Returns the tweaked 32-byte x-only pubkey, or null if the tweak\n * produces a point-at-infinity or invalid result.\n */\nfunction tweakXOnlyKey(xOnly: Uint8Array): Uint8Array | null {\n  if (xOnly.length !== X_ONLY_PUBKEY_SIZE) return null;\n  const tweak = taggedHash(TAPTWEAK_TAG, xOnly);\n  const tweaked = ecc.xOnlyPointAddTweak(xOnly, tweak);\n  return tweaked ? tweaked.xOnlyPubkey : null;\n}\n\n/**\n * Build the BIP-322 virtual `to_sign` transaction for a signer\n * scriptPubKey (steps 1–3 above; `bip322` crate 0.0.10 `util.rs:18-85`:\n * both txs version 0, locktime 0, sequence 0, all values 0).\n */\nfunction buildToSignTransaction(\n  messageBytes: Uint8Array,\n  scriptPubKey: Buffer,\n): Transaction {\n  const messageHash = taggedHash(BIP322_TAG, messageBytes);\n\n  const toSpend = new Transaction();\n  toSpend.version = BIP322_TX_VERSION;\n  toSpend.locktime = BIP322_TX_LOCKTIME;\n  const scriptSig = Buffer.concat([\n    Buffer.from([OP_0, OP_PUSHBYTES_32]),\n    Buffer.from(messageHash),\n  ]);\n  toSpend.addInput(\n    Buffer.alloc(TO_SPEND_PREVOUT_TXID_BYTES, 0),\n    TO_SPEND_PREVOUT_INDEX,\n    BIP322_INPUT_SEQUENCE,\n    scriptSig,\n  );\n  toSpend.addOutput(scriptPubKey, ZERO_SATS);\n\n  const toSign = new Transaction();\n  toSign.version = BIP322_TX_VERSION;\n  toSign.locktime = BIP322_TX_LOCKTIME;\n  // Bitcoin txid in natural-byte (little-endian) form.\n  toSign.addInput(\n    toSpend.getHash(),\n    TO_SPEND_OUTPUT_INDEX,\n    BIP322_INPUT_SEQUENCE,\n  );\n  toSign.addOutput(Buffer.from([OP_RETURN]), ZERO_SATS);\n\n  return toSign;\n}\n\n/**\n * Verify a BIP-322 \"simple\" P2TR key-path signature over an arbitrary\n * byte message.\n *\n * @internal Consumed by `verifyServerIdentity` (VP auth) and\n * `verifyPopWitness` (PoP pre-registration check), and exposed so the\n * golden-vector test suite can pin the verifier independently.\n *\n * @param messageBytes - The bytes that were signed (e.g. a CBOR-encoded\n *                       payload). Not pre-hashed; this function applies\n *                       the BIP-322 tagged hash internally.\n * @param xOnlyPubkey  - 32-byte x-only pubkey of the signer (pre-tweak).\n * @param signature    - 64-byte raw Schnorr signature (BIP-340), as\n *                       emitted by a key-path witness. The trailing\n *                       sighash byte of a 65-byte witness item is not\n *                       part of it — pass it as `hashType` instead.\n * @param hashType     - BIP-341 sighash type the signature commits to.\n *                       `SIGHASH_DEFAULT` (0x00) for a 64-byte witness\n *                       item, `SIGHASH_ALL` (0x01) for a 65-byte one.\n * @returns `true` if the signature verifies against the address\n *          derived from `xOnlyPubkey`; `false` otherwise.\n */\nexport function verifyBip322Simple(\n  messageBytes: Uint8Array,\n  xOnlyPubkey: Uint8Array,\n  signature: Uint8Array,\n  hashType: number = Transaction.SIGHASH_DEFAULT,\n): boolean {\n  if (xOnlyPubkey.length !== X_ONLY_PUBKEY_SIZE) return false;\n  if (signature.length !== SCHNORR_SIG_SIZE) return false;\n  // Only the two types a BIP-322 witness may carry. SIGHASH_NONE/SINGLE and the\n  // ANYONECANPAY variants would verify here but are rejected downstream.\n  if (\n    hashType !== Transaction.SIGHASH_DEFAULT &&\n    hashType !== Transaction.SIGHASH_ALL\n  ) {\n    return false;\n  }\n\n  // Any exception from the underlying crypto libraries (e.g. the\n  // `Expected Point` error `tiny-secp256k1` throws when the supplied\n  // 32 bytes don't represent a valid x-coordinate on secp256k1) is\n  // treated as a verification failure rather than propagated — a\n  // verifier MUST return a boolean, not raise.\n  try {\n    // scriptPubKey for the signer's P2TR key-path-only address.\n    // bitcoinjs-lib's `payments.p2tr({ internalPubkey })` computes the\n    // tweak and produces the `OP_1 <tweaked_xonly>` output script.\n    const p2tr = payments.p2tr({\n      internalPubkey: Buffer.from(xOnlyPubkey),\n    });\n    if (!p2tr.output) return false;\n    const scriptPubKey = p2tr.output;\n\n    const toSign = buildToSignTransaction(messageBytes, scriptPubKey);\n\n    // Taproot sighash for to_sign input 0.\n    const sighash = toSign.hashForWitnessV1(\n      0,\n      [scriptPubKey],\n      [ZERO_SATS],\n      hashType,\n    );\n\n    // Tweak the x-only pubkey (no merkle root) and verify Schnorr.\n    const tweakedXOnly = tweakXOnlyKey(xOnlyPubkey);\n    if (!tweakedXOnly) return false;\n\n    return ecc.verifySchnorr(sighash, tweakedXOnly, signature);\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Verify a BIP-322 \"simple\" P2WPKH signature over an arbitrary byte\n * message, mirroring the verifier vaultd runs on a two-item PoP witness\n * (`bip322` crate 0.0.10 `verify.rs:102-186 verify_full_p2wpkh`).\n *\n * @internal Consumed by `verifyPopWitness` for Native SegWit software\n * wallets, and exposed so the BIP-322 official-vector test suite can pin\n * the verifier independently.\n *\n * @param compressedPubkey - 33-byte SEC1 compressed pubkey of the signer\n *                           (witness item 1). The address is derived from\n *                           it; network affects only bech32 encoding, not\n *                           script or sighash (`message.rs:125-127`).\n * @param encodedSignature - Witness item 0: DER signature with trailing\n *                           sighash byte, 71 or 72 bytes, SIGHASH_ALL only\n *                           (`verify.rs:141-161`).\n * @returns `true` if the signature verifies against the P2WPKH address of\n *          `compressedPubkey`; `false` otherwise.\n */\nexport function verifyBip322P2wpkhSimple(\n  messageBytes: Uint8Array,\n  compressedPubkey: Uint8Array,\n  encodedSignature: Uint8Array,\n): boolean {\n  if (compressedPubkey.length !== COMPRESSED_PUBKEY_SIZE) return false;\n  if (\n    encodedSignature.length < P2WPKH_ENCODED_SIG_MIN ||\n    encodedSignature.length > P2WPKH_ENCODED_SIG_MAX\n  ) {\n    return false;\n  }\n  // Any exception below (strict-DER decode, malformed pubkey) is a\n  // verification failure, not an error — a verifier returns a boolean.\n  try {\n    // Full curve-point parse, as `PublicKey::from_slice` (`verify.rs:82-83`).\n    if (!ecc.isPointCompressed(compressedPubkey)) return false;\n\n    // Strict DER decode, then SIGHASH_ALL only — deliberately NARROWER than\n    // `verify.rs:156-161` (its from_consensus maps more bytes to All); host-stricter is safe.\n    const { signature, hashType } = bscript.signature.decode(\n      Buffer.from(encodedSignature),\n    );\n    // decode tolerates non-minimal integers (bip66.js never bounds lenR/lenS at 33;\n    // fromDER truncates, script_signature.js:29-35) that vaultd's strict libsecp\n    // parse rejects (secp256k1-sys ecdsa_impl.h:127-136) — require the unique\n    // minimal encoding by re-encoding and byte-comparing.\n    if (\n      !bscript.signature\n        .encode(signature, hashType)\n        .equals(Buffer.from(encodedSignature))\n    ) {\n      return false;\n    }\n    if (hashType !== Transaction.SIGHASH_ALL) return false;\n\n    // scriptPubKey = OP_0 PUSH20 hash160(pubkey) (`message.rs:127 Address::p2wpkh`).\n    const p2wpkh = payments.p2wpkh({ pubkey: Buffer.from(compressedPubkey) });\n    if (!p2wpkh.output || !p2wpkh.hash) return false;\n\n    const toSign = buildToSignTransaction(messageBytes, p2wpkh.output);\n\n    // BIP-143 sighash with the standard P2WPKH scriptCode\n    // `OP_DUP OP_HASH160 <20B> OP_EQUALVERIFY OP_CHECKSIG` and value 0\n    // (`verify.rs:163-173 p2wpkh_signature_hash`; scriptCode template per\n    // bitcoinjs-lib's own P2WPKH signer, `src/psbt.js:1245-1255`).\n    const scriptCode = payments.p2pkh({ hash: p2wpkh.hash }).output;\n    if (!scriptCode) return false;\n    const sighash = toSign.hashForWitnessV0(0, scriptCode, ZERO_SATS, hashType);\n\n    // strict=true rejects high-S, as libsecp256k1's verify does\n    // (`verify.rs:180-182`; secp256k1 crate `ecdsa/mod.rs:194`).\n    return ecc.verify(sighash, compressedPubkey, signature, true);\n  } catch {\n    return false;\n  }\n}\n"],"names":["BIP322_TAG","TAPTWEAK_TAG","X_ONLY_PUBKEY_SIZE","SCHNORR_SIG_SIZE","COMPRESSED_PUBKEY_SIZE","P2WPKH_ENCODED_SIG_MIN","P2WPKH_ENCODED_SIG_MAX","ZERO_SATS","BIP322_TX_VERSION","BIP322_TX_LOCKTIME","BIP322_INPUT_SEQUENCE","TO_SPEND_PREVOUT_TXID_BYTES","TO_SPEND_PREVOUT_INDEX","TO_SPEND_OUTPUT_INDEX","OP_0","OP_PUSHBYTES_32","OP_RETURN","taggedHash","tag","data","tagBytes","tagHash","sha256","preimage","tweakXOnlyKey","xOnly","tweak","tweaked","ecc","buildToSignTransaction","messageBytes","scriptPubKey","messageHash","toSpend","Transaction","scriptSig","Buffer","toSign","verifyBip322Simple","xOnlyPubkey","signature","hashType","p2tr","payments","sighash","tweakedXOnly","verifyBip322P2wpkhSimple","compressedPubkey","encodedSignature","bscript","p2wpkh","scriptCode"],"mappings":";;;;AA6CA,MAAMA,IAAa,0BAGbC,IAAe,YAEfC,IAAqB,IACrBC,IAAmB,IAEnBC,IAAyB,IAQlBC,IAAyB,IACzBC,IAAyB,IAQhCC,IAAY,GAIZC,IAAoB,GACpBC,IAAqB,GACrBC,IAAwB,GAExBC,IAA8B,IAC9BC,IAAyB,YAEzBC,IAAwB,GACxBC,IAAO,GAEPC,IAAkB,IAClBC,IAAY;AAMlB,SAASC,EAAWC,GAAaC,GAA8B;AAC7D,QAAMC,IAAW,IAAI,cAAc,OAAOF,CAAG,GACvCG,IAAUC,EAAOF,CAAQ,GACzBG,IAAW,IAAI,WAAWF,EAAQ,SAAS,IAAIF,EAAK,MAAM;AAChE,SAAAI,EAAS,IAAIF,GAAS,CAAC,GACvBE,EAAS,IAAIF,GAASA,EAAQ,MAAM,GACpCE,EAAS,IAAIJ,GAAME,EAAQ,SAAS,CAAC,GAC9BC,EAAOC,CAAQ;AACxB;AAYA,SAASC,EAAcC,GAAsC;AAC3D,MAAIA,EAAM,WAAWvB,EAAoB,QAAO;AAChD,QAAMwB,IAAQT,EAAWhB,GAAcwB,CAAK,GACtCE,IAAUC,EAAI,mBAAmBH,GAAOC,CAAK;AACnD,SAAOC,IAAUA,EAAQ,cAAc;AACzC;AAOA,SAASE,EACPC,GACAC,GACa;AACb,QAAMC,IAAcf,EAAWjB,GAAY8B,CAAY,GAEjDG,IAAU,IAAIC,EAAA;AACpB,EAAAD,EAAQ,UAAUzB,GAClByB,EAAQ,WAAWxB;AACnB,QAAM0B,IAAYC,EAAO,OAAO;AAAA,IAC9BA,EAAO,KAAK,CAACtB,GAAMC,CAAe,CAAC;AAAA,IACnCqB,EAAO,KAAKJ,CAAW;AAAA,EAAA,CACxB;AACD,EAAAC,EAAQ;AAAA,IACNG,EAAO,MAAMzB,GAA6B,CAAC;AAAA,IAC3CC;AAAA,IACAF;AAAA,IACAyB;AAAA,EAAA,GAEFF,EAAQ,UAAUF,GAAcxB,CAAS;AAEzC,QAAM8B,IAAS,IAAIH,EAAA;AACnB,SAAAG,EAAO,UAAU7B,GACjB6B,EAAO,WAAW5B,GAElB4B,EAAO;AAAA,IACLJ,EAAQ,QAAA;AAAA,IACRpB;AAAA,IACAH;AAAA,EAAA,GAEF2B,EAAO,UAAUD,EAAO,KAAK,CAACpB,CAAS,CAAC,GAAGT,CAAS,GAE7C8B;AACT;AAwBO,SAASC,EACdR,GACAS,GACAC,GACAC,IAAmBP,EAAY,iBACtB;AAKT,MAJIK,EAAY,WAAWrC,KACvBsC,EAAU,WAAWrC,KAIvBsC,MAAaP,EAAY,mBACzBO,MAAaP,EAAY;AAEzB,WAAO;AAQT,MAAI;AAIF,UAAMQ,IAAOC,EAAS,KAAK;AAAA,MACzB,gBAAgBP,EAAO,KAAKG,CAAW;AAAA,IAAA,CACxC;AACD,QAAI,CAACG,EAAK,OAAQ,QAAO;AACzB,UAAMX,IAAeW,EAAK,QAKpBE,IAHSf,EAAuBC,GAAcC,CAAY,EAGzC;AAAA,MACrB;AAAA,MACA,CAACA,CAAY;AAAA,MACb,CAACxB,CAAS;AAAA,MACVkC;AAAA,IAAA,GAIII,IAAerB,EAAce,CAAW;AAC9C,WAAKM,IAEEjB,EAAI,cAAcgB,GAASC,GAAcL,CAAS,IAF/B;AAAA,EAG5B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAqBO,SAASM,EACdhB,GACAiB,GACAC,GACS;AAET,MADID,EAAiB,WAAW3C,KAE9B4C,EAAiB,SAAS3C,KAC1B2C,EAAiB,SAAS1C;AAE1B,WAAO;AAIT,MAAI;AAEF,QAAI,CAACsB,EAAI,kBAAkBmB,CAAgB,EAAG,QAAO;AAIrD,UAAM,EAAE,WAAAP,GAAW,UAAAC,EAAA,IAAaQ,EAAQ,UAAU;AAAA,MAChDb,EAAO,KAAKY,CAAgB;AAAA,IAAA;AAa9B,QANE,CAACC,EAAQ,UACN,OAAOT,GAAWC,CAAQ,EAC1B,OAAOL,EAAO,KAAKY,CAAgB,CAAC,KAIrCP,MAAaP,EAAY,YAAa,QAAO;AAGjD,UAAMgB,IAASP,EAAS,OAAO,EAAE,QAAQP,EAAO,KAAKW,CAAgB,GAAG;AACxE,QAAI,CAACG,EAAO,UAAU,CAACA,EAAO,KAAM,QAAO;AAE3C,UAAMb,IAASR,EAAuBC,GAAcoB,EAAO,MAAM,GAM3DC,IAAaR,EAAS,MAAM,EAAE,MAAMO,EAAO,KAAA,CAAM,EAAE;AACzD,QAAI,CAACC,EAAY,QAAO;AACxB,UAAMP,IAAUP,EAAO,iBAAiB,GAAGc,GAAY5C,GAAWkC,CAAQ;AAI1E,WAAOb,EAAI,OAAOgB,GAASG,GAAkBP,GAAW,EAAI;AAAA,EAC9D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;"}

package/dist/{bip322Verify-B7_gIhRk.cjs → bip322Verify-DLxJR9CQ.cjs}

@@ -1,2 +1,2 @@
-"use strict";const B=require("@bitcoin-js/tiny-secp256k1-asmjs"),c=require("bitcoinjs-lib"),p=require("./sha2-DI0-0SHr.cjs"),i=require("buffer");function m(r){const n=Object.create(null,{[Symbol.toStringTag]:{value:"Module"}});if(r){for(const e in r)if(e!=="default"){const t=Object.getOwnPropertyDescriptor(r,e);Object.defineProperty(n,e,t.get?t:{enumerable:!0,get:()=>r[e]})}}return n.default=r,Object.freeze(n)}const u=m(B),D="BIP0322-signed-message",d="TapTweak",T=32,H=64,N=33,P=71,g=72,_=0,S=0,h=0,E=0,A=32,w=4294967295,y=0,U=0,k=32,G=106;function I(r,n){const e=new TextEncoder().encode(r),t=p.sha256(e),s=new Uint8Array(t.length*2+n.length);return s.set(t,0),s.set(t,t.length),s.set(n,t.length*2),p.sha256(s)}function C(r){if(r.length!==T)return null;const n=I(d,r),e=u.xOnlyPointAddTweak(r,n);return e?e.xOnlyPubkey:null}function O(r,n){const e=I(D,r),t=new c.Transaction;t.version=S,t.locktime=h;const s=i.Buffer.concat([i.Buffer.from([U,k]),i.Buffer.from(e)]);t.addInput(i.Buffer.alloc(A,0),w,E,s),t.addOutput(n,_);const o=new c.Transaction;return o.version=S,o.locktime=h,o.addInput(t.getHash(),y,E),o.addOutput(i.Buffer.from([G]),_),o}function K(r,n,e,t=c.Transaction.SIGHASH_DEFAULT){if(n.length!==T||e.length!==H||t!==c.Transaction.SIGHASH_DEFAULT&&t!==c.Transaction.SIGHASH_ALL)return!1;try{const s=c.payments.p2tr({internalPubkey:i.Buffer.from(n)});if(!s.output)return!1;const o=s.output,a=O(r,o).hashForWitnessV1(0,[o],[_],t),f=C(n);return f?u.verifySchnorr(a,f,e):!1}catch{return!1}}function X(r,n,e){if(n.length!==N||e.length<P||e.length>g)return!1;try{if(!u.isPointCompressed(n))return!1;const{signature:t,hashType:s}=c.script.signature.decode(i.Buffer.from(e));if(!c.script.signature.encode(t,s).equals(i.Buffer.from(e))||s!==c.Transaction.SIGHASH_ALL)return!1;const o=c.payments.p2wpkh({pubkey:i.Buffer.from(n)});if(!o.output||!o.hash)return!1;const l=O(r,o.output),a=c.payments.p2pkh({hash:o.hash}).output;if(!a)return!1;const f=l.hashForWitnessV0(0,a,_,s);return u.verify(f,n,t,!0)}catch{return!1}}exports.P2WPKH_ENCODED_SIG_MAX=g;exports.P2WPKH_ENCODED_SIG_MIN=P;exports.verifyBip322P2wpkhSimple=X;exports.verifyBip322Simple=K;
-//# sourceMappingURL=bip322Verify-B7_gIhRk.cjs.map
+"use strict";const B=require("@bitcoin-js/tiny-secp256k1-asmjs"),c=require("bitcoinjs-lib"),p=require("./sha2-Ce6KewYx.cjs"),i=require("buffer");function m(r){const n=Object.create(null,{[Symbol.toStringTag]:{value:"Module"}});if(r){for(const e in r)if(e!=="default"){const t=Object.getOwnPropertyDescriptor(r,e);Object.defineProperty(n,e,t.get?t:{enumerable:!0,get:()=>r[e]})}}return n.default=r,Object.freeze(n)}const u=m(B),D="BIP0322-signed-message",d="TapTweak",T=32,H=64,N=33,P=71,g=72,_=0,S=0,h=0,E=0,A=32,w=4294967295,y=0,U=0,k=32,G=106;function I(r,n){const e=new TextEncoder().encode(r),t=p.sha256(e),s=new Uint8Array(t.length*2+n.length);return s.set(t,0),s.set(t,t.length),s.set(n,t.length*2),p.sha256(s)}function C(r){if(r.length!==T)return null;const n=I(d,r),e=u.xOnlyPointAddTweak(r,n);return e?e.xOnlyPubkey:null}function O(r,n){const e=I(D,r),t=new c.Transaction;t.version=S,t.locktime=h;const s=i.Buffer.concat([i.Buffer.from([U,k]),i.Buffer.from(e)]);t.addInput(i.Buffer.alloc(A,0),w,E,s),t.addOutput(n,_);const o=new c.Transaction;return o.version=S,o.locktime=h,o.addInput(t.getHash(),y,E),o.addOutput(i.Buffer.from([G]),_),o}function K(r,n,e,t=c.Transaction.SIGHASH_DEFAULT){if(n.length!==T||e.length!==H||t!==c.Transaction.SIGHASH_DEFAULT&&t!==c.Transaction.SIGHASH_ALL)return!1;try{const s=c.payments.p2tr({internalPubkey:i.Buffer.from(n)});if(!s.output)return!1;const o=s.output,a=O(r,o).hashForWitnessV1(0,[o],[_],t),f=C(n);return f?u.verifySchnorr(a,f,e):!1}catch{return!1}}function X(r,n,e){if(n.length!==N||e.length<P||e.length>g)return!1;try{if(!u.isPointCompressed(n))return!1;const{signature:t,hashType:s}=c.script.signature.decode(i.Buffer.from(e));if(!c.script.signature.encode(t,s).equals(i.Buffer.from(e))||s!==c.Transaction.SIGHASH_ALL)return!1;const o=c.payments.p2wpkh({pubkey:i.Buffer.from(n)});if(!o.output||!o.hash)return!1;const l=O(r,o.output),a=c.payments.p2pkh({hash:o.hash}).output;if(!a)return!1;const f=l.hashForWitnessV0(0,a,_,s);return u.verify(f,n,t,!0)}catch{return!1}}exports.P2WPKH_ENCODED_SIG_MAX=g;exports.P2WPKH_ENCODED_SIG_MIN=P;exports.verifyBip322P2wpkhSimple=X;exports.verifyBip322Simple=K;
+//# sourceMappingURL=bip322Verify-DLxJR9CQ.cjs.map

package/dist/{bip322Verify-B7_gIhRk.cjs.map → bip322Verify-DLxJR9CQ.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"bip322Verify-B7_gIhRk.cjs","sources":["../src/tbv/core/clients/vault-provider/auth/bip322Verify.ts"],"sourcesContent":["/**\n * BIP-322 \"simple\" signature verification for P2TR key-path and P2WPKH.\n *\n * Mirrors the Rust reference in\n * `btc-vault/crates/btc-signer/src/message.rs` (`verify_bip322_message`\n * and the P2WPKH arm of `verify_pop_witness`, both of which delegate to\n * the `bip322` crate 0.0.10's `verify_simple`).\n *\n * The algorithm:\n *\n *   1. Compute the BIP-322 tagged-hash of the message:\n *        m_hash = SHA256( SHA256(tag) || SHA256(tag) || message )\n *      where tag = \"BIP0322-signed-message\".\n *\n *   2. Build a virtual \"to_spend\" transaction with one input (prevout\n *      all-zero txid + 0xFFFFFFFF vout, scriptSig = `OP_0 PUSH32 m_hash`,\n *      sequence = 0) and one output (value 0, scriptPubKey = the signer's\n *      address: P2TR key-path-only, or P2WPKH of the compressed pubkey).\n *\n *   3. Build a \"to_sign\" transaction that spends to_spend[0] and has a\n *      single `OP_RETURN` output (value 0).\n *\n *   4. Compute the sighash of to_sign input 0: BIP-341 taproot for P2TR\n *      (SIGHASH_DEFAULT 0x00 unless the witness item carried a trailing\n *      SIGHASH_ALL 0x01 byte), BIP-143 with the standard P2WPKH\n *      scriptCode for P2WPKH (SIGHASH_ALL only).\n *\n *   5. Verify the signature: Schnorr against the **tweaked** output key\n *      `Q = P + tap_tweak(P) * G` for P2TR (no merkle root — key-path\n *      only), ECDSA against the compressed pubkey for P2WPKH.\n *\n * `bitcoinjs-lib` handles (2)–(4); `tiny-secp256k1-asmjs` provides\n * the tweak and the Schnorr/ECDSA verifies. Pulling in a full BIP-322\n * library would add a peer dep for what amounts to ~40 lines of glue.\n *\n * @module tbv/core/clients/vault-provider/auth/bip322Verify\n */\n\nimport * as ecc from \"@bitcoin-js/tiny-secp256k1-asmjs\";\nimport { script as bscript, payments, Transaction } from \"bitcoinjs-lib\";\n\nimport { sha256 } from \"@noble/hashes/sha2.js\";\nimport { Buffer } from \"buffer\";\n\n/** BIP-322 message tag (BIP-340 tagged-hash style). */\nconst BIP322_TAG = \"BIP0322-signed-message\";\n\n/** BIP-341 taproot-tweak tag. */\nconst TAPTWEAK_TAG = \"TapTweak\";\n\nconst X_ONLY_PUBKEY_SIZE = 32;\nconst SCHNORR_SIG_SIZE = 64;\n/** SEC1 compressed pubkey: 0x02/0x03 prefix + 32-byte x coordinate. */\nconst COMPRESSED_PUBKEY_SIZE = 33;\n/**\n * vaultd's P2WPKH BIP-322 verifier accepts ONLY 71/72-byte encoded\n * signatures — DER (70/71B) + sighash byte (`bip322` crate 0.0.10\n * `verify.rs:141-153`). A shorter (short-DER) signature fails ingestion\n * permanently, so this gate must be exactly as strict. Exported so\n * `verifyPopWitness` can pre-screen with a cause-naming error.\n */\nexport const P2WPKH_ENCODED_SIG_MIN = 71;\nexport const P2WPKH_ENCODED_SIG_MAX = 72;\n\n// NOTE: bitcoinjs-lib v6.x's `Transaction.addOutput` and its sighash\n// methods are typed for `Satoshi` (a UInt53 number), not `bigint`.\n// Passing `BigInt(0)` triggers a typeforce assertion in `addOutput`\n// (\"Expected property '1' of type Satoshi, got BigInt 0\") which the\n// verifiers' try/catch silently turns into `verify -> false`. Use\n// plain `0` everywhere.\nconst ZERO_SATS = 0;\n\n// Wire fields of the virtual to_spend/to_sign transactions (`bip322`\n// crate 0.0.10 `util.rs:18-85`).\nconst BIP322_TX_VERSION = 0;\nconst BIP322_TX_LOCKTIME = 0;\nconst BIP322_INPUT_SEQUENCE = 0;\n/** to_spend prevout: all-zero 32-byte txid at index 0xFFFFFFFF (`util.rs:18-85`). */\nconst TO_SPEND_PREVOUT_TXID_BYTES = 32;\nconst TO_SPEND_PREVOUT_INDEX = 0xffffffff;\n/** to_sign spends to_spend's only output (`util.rs:18-85`). */\nconst TO_SPEND_OUTPUT_INDEX = 0;\nconst OP_0 = 0x00;\n/** Direct push of the 32-byte tagged message hash. */\nconst OP_PUSHBYTES_32 = 0x20;\nconst OP_RETURN = 0x6a;\n\n/**\n * BIP-340 tagged hash: `SHA256( SHA256(tag) || SHA256(tag) || data )`.\n * Used for both BIP-322 message hashing and BIP-341 tap-tweak.\n */\nfunction taggedHash(tag: string, data: Uint8Array): Uint8Array {\n  const tagBytes = new TextEncoder().encode(tag);\n  const tagHash = sha256(tagBytes);\n  const preimage = new Uint8Array(tagHash.length * 2 + data.length);\n  preimage.set(tagHash, 0);\n  preimage.set(tagHash, tagHash.length);\n  preimage.set(data, tagHash.length * 2);\n  return sha256(preimage);\n}\n\n/**\n * Apply BIP-341 taproot tweak to an x-only pubkey with no merkle\n * root (key-path-only address).\n *\n * `tap_tweak = hash_TapTweak(P)`\n * `Q = P + tap_tweak * G` (x-only, even-Y parity)\n *\n * Returns the tweaked 32-byte x-only pubkey, or null if the tweak\n * produces a point-at-infinity or invalid result.\n */\nfunction tweakXOnlyKey(xOnly: Uint8Array): Uint8Array | null {\n  if (xOnly.length !== X_ONLY_PUBKEY_SIZE) return null;\n  const tweak = taggedHash(TAPTWEAK_TAG, xOnly);\n  const tweaked = ecc.xOnlyPointAddTweak(xOnly, tweak);\n  return tweaked ? tweaked.xOnlyPubkey : null;\n}\n\n/**\n * Build the BIP-322 virtual `to_sign` transaction for a signer\n * scriptPubKey (steps 1–3 above; `bip322` crate 0.0.10 `util.rs:18-85`:\n * both txs version 0, locktime 0, sequence 0, all values 0).\n */\nfunction buildToSignTransaction(\n  messageBytes: Uint8Array,\n  scriptPubKey: Buffer,\n): Transaction {\n  const messageHash = taggedHash(BIP322_TAG, messageBytes);\n\n  const toSpend = new Transaction();\n  toSpend.version = BIP322_TX_VERSION;\n  toSpend.locktime = BIP322_TX_LOCKTIME;\n  const scriptSig = Buffer.concat([\n    Buffer.from([OP_0, OP_PUSHBYTES_32]),\n    Buffer.from(messageHash),\n  ]);\n  toSpend.addInput(\n    Buffer.alloc(TO_SPEND_PREVOUT_TXID_BYTES, 0),\n    TO_SPEND_PREVOUT_INDEX,\n    BIP322_INPUT_SEQUENCE,\n    scriptSig,\n  );\n  toSpend.addOutput(scriptPubKey, ZERO_SATS);\n\n  const toSign = new Transaction();\n  toSign.version = BIP322_TX_VERSION;\n  toSign.locktime = BIP322_TX_LOCKTIME;\n  // Bitcoin txid in natural-byte (little-endian) form.\n  toSign.addInput(\n    toSpend.getHash(),\n    TO_SPEND_OUTPUT_INDEX,\n    BIP322_INPUT_SEQUENCE,\n  );\n  toSign.addOutput(Buffer.from([OP_RETURN]), ZERO_SATS);\n\n  return toSign;\n}\n\n/**\n * Verify a BIP-322 \"simple\" P2TR key-path signature over an arbitrary\n * byte message.\n *\n * @internal Consumed by `verifyServerIdentity` (VP auth) and\n * `verifyPopWitness` (PoP pre-registration check), and exposed so the\n * golden-vector test suite can pin the verifier independently.\n *\n * @param messageBytes - The bytes that were signed (e.g. a CBOR-encoded\n *                       payload). Not pre-hashed; this function applies\n *                       the BIP-322 tagged hash internally.\n * @param xOnlyPubkey  - 32-byte x-only pubkey of the signer (pre-tweak).\n * @param signature    - 64-byte raw Schnorr signature (BIP-340), as\n *                       emitted by a key-path witness. The trailing\n *                       sighash byte of a 65-byte witness item is not\n *                       part of it — pass it as `hashType` instead.\n * @param hashType     - BIP-341 sighash type the signature commits to.\n *                       `SIGHASH_DEFAULT` (0x00) for a 64-byte witness\n *                       item, `SIGHASH_ALL` (0x01) for a 65-byte one.\n * @returns `true` if the signature verifies against the address\n *          derived from `xOnlyPubkey`; `false` otherwise.\n */\nexport function verifyBip322Simple(\n  messageBytes: Uint8Array,\n  xOnlyPubkey: Uint8Array,\n  signature: Uint8Array,\n  hashType: number = Transaction.SIGHASH_DEFAULT,\n): boolean {\n  if (xOnlyPubkey.length !== X_ONLY_PUBKEY_SIZE) return false;\n  if (signature.length !== SCHNORR_SIG_SIZE) return false;\n  // Only the two types a BIP-322 witness may carry. SIGHASH_NONE/SINGLE and the\n  // ANYONECANPAY variants would verify here but are rejected downstream.\n  if (\n    hashType !== Transaction.SIGHASH_DEFAULT &&\n    hashType !== Transaction.SIGHASH_ALL\n  ) {\n    return false;\n  }\n\n  // Any exception from the underlying crypto libraries (e.g. the\n  // `Expected Point` error `tiny-secp256k1` throws when the supplied\n  // 32 bytes don't represent a valid x-coordinate on secp256k1) is\n  // treated as a verification failure rather than propagated — a\n  // verifier MUST return a boolean, not raise.\n  try {\n    // scriptPubKey for the signer's P2TR key-path-only address.\n    // bitcoinjs-lib's `payments.p2tr({ internalPubkey })` computes the\n    // tweak and produces the `OP_1 <tweaked_xonly>` output script.\n    const p2tr = payments.p2tr({\n      internalPubkey: Buffer.from(xOnlyPubkey),\n    });\n    if (!p2tr.output) return false;\n    const scriptPubKey = p2tr.output;\n\n    const toSign = buildToSignTransaction(messageBytes, scriptPubKey);\n\n    // Taproot sighash for to_sign input 0.\n    const sighash = toSign.hashForWitnessV1(\n      0,\n      [scriptPubKey],\n      [ZERO_SATS],\n      hashType,\n    );\n\n    // Tweak the x-only pubkey (no merkle root) and verify Schnorr.\n    const tweakedXOnly = tweakXOnlyKey(xOnlyPubkey);\n    if (!tweakedXOnly) return false;\n\n    return ecc.verifySchnorr(sighash, tweakedXOnly, signature);\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Verify a BIP-322 \"simple\" P2WPKH signature over an arbitrary byte\n * message, mirroring the verifier vaultd runs on a two-item PoP witness\n * (`bip322` crate 0.0.10 `verify.rs:102-186 verify_full_p2wpkh`).\n *\n * @internal Consumed by `verifyPopWitness` for Native SegWit software\n * wallets, and exposed so the BIP-322 official-vector test suite can pin\n * the verifier independently.\n *\n * @param compressedPubkey - 33-byte SEC1 compressed pubkey of the signer\n *                           (witness item 1). The address is derived from\n *                           it; network affects only bech32 encoding, not\n *                           script or sighash (`message.rs:125-127`).\n * @param encodedSignature - Witness item 0: DER signature with trailing\n *                           sighash byte, 71 or 72 bytes, SIGHASH_ALL only\n *                           (`verify.rs:141-161`).\n * @returns `true` if the signature verifies against the P2WPKH address of\n *          `compressedPubkey`; `false` otherwise.\n */\nexport function verifyBip322P2wpkhSimple(\n  messageBytes: Uint8Array,\n  compressedPubkey: Uint8Array,\n  encodedSignature: Uint8Array,\n): boolean {\n  if (compressedPubkey.length !== COMPRESSED_PUBKEY_SIZE) return false;\n  if (\n    encodedSignature.length < P2WPKH_ENCODED_SIG_MIN ||\n    encodedSignature.length > P2WPKH_ENCODED_SIG_MAX\n  ) {\n    return false;\n  }\n  // Any exception below (strict-DER decode, malformed pubkey) is a\n  // verification failure, not an error — a verifier returns a boolean.\n  try {\n    // Full curve-point parse, as `PublicKey::from_slice` (`verify.rs:82-83`).\n    if (!ecc.isPointCompressed(compressedPubkey)) return false;\n\n    // Strict DER decode, then SIGHASH_ALL only — deliberately NARROWER than\n    // `verify.rs:156-161` (its from_consensus maps more bytes to All); host-stricter is safe.\n    const { signature, hashType } = bscript.signature.decode(\n      Buffer.from(encodedSignature),\n    );\n    // decode tolerates non-minimal integers (bip66.js never bounds lenR/lenS at 33;\n    // fromDER truncates, script_signature.js:29-35) that vaultd's strict libsecp\n    // parse rejects (secp256k1-sys ecdsa_impl.h:127-136) — require the unique\n    // minimal encoding by re-encoding and byte-comparing.\n    if (\n      !bscript.signature\n        .encode(signature, hashType)\n        .equals(Buffer.from(encodedSignature))\n    ) {\n      return false;\n    }\n    if (hashType !== Transaction.SIGHASH_ALL) return false;\n\n    // scriptPubKey = OP_0 PUSH20 hash160(pubkey) (`message.rs:127 Address::p2wpkh`).\n    const p2wpkh = payments.p2wpkh({ pubkey: Buffer.from(compressedPubkey) });\n    if (!p2wpkh.output || !p2wpkh.hash) return false;\n\n    const toSign = buildToSignTransaction(messageBytes, p2wpkh.output);\n\n    // BIP-143 sighash with the standard P2WPKH scriptCode\n    // `OP_DUP OP_HASH160 <20B> OP_EQUALVERIFY OP_CHECKSIG` and value 0\n    // (`verify.rs:163-173 p2wpkh_signature_hash`; scriptCode template per\n    // bitcoinjs-lib's own P2WPKH signer, `src/psbt.js:1245-1255`).\n    const scriptCode = payments.p2pkh({ hash: p2wpkh.hash }).output;\n    if (!scriptCode) return false;\n    const sighash = toSign.hashForWitnessV0(0, scriptCode, ZERO_SATS, hashType);\n\n    // strict=true rejects high-S, as libsecp256k1's verify does\n    // (`verify.rs:180-182`; secp256k1 crate `ecdsa/mod.rs:194`).\n    return ecc.verify(sighash, compressedPubkey, signature, true);\n  } catch {\n    return false;\n  }\n}\n"],"names":["BIP322_TAG","TAPTWEAK_TAG","X_ONLY_PUBKEY_SIZE","SCHNORR_SIG_SIZE","COMPRESSED_PUBKEY_SIZE","P2WPKH_ENCODED_SIG_MIN","P2WPKH_ENCODED_SIG_MAX","ZERO_SATS","BIP322_TX_VERSION","BIP322_TX_LOCKTIME","BIP322_INPUT_SEQUENCE","TO_SPEND_PREVOUT_TXID_BYTES","TO_SPEND_PREVOUT_INDEX","TO_SPEND_OUTPUT_INDEX","OP_0","OP_PUSHBYTES_32","OP_RETURN","taggedHash","tag","data","tagBytes","tagHash","sha256","preimage","tweakXOnlyKey","xOnly","tweak","tweaked","ecc","buildToSignTransaction","messageBytes","scriptPubKey","messageHash","toSpend","Transaction","scriptSig","Buffer","toSign","verifyBip322Simple","xOnlyPubkey","signature","hashType","p2tr","payments","sighash","tweakedXOnly","verifyBip322P2wpkhSimple","compressedPubkey","encodedSignature","bscript","p2wpkh","scriptCode"],"mappings":"2aA6CMA,EAAa,yBAGbC,EAAe,WAEfC,EAAqB,GACrBC,EAAmB,GAEnBC,EAAyB,GAQlBC,EAAyB,GACzBC,EAAyB,GAQhCC,EAAY,EAIZC,EAAoB,EACpBC,EAAqB,EACrBC,EAAwB,EAExBC,EAA8B,GAC9BC,EAAyB,WAEzBC,EAAwB,EACxBC,EAAO,EAEPC,EAAkB,GAClBC,EAAY,IAMlB,SAASC,EAAWC,EAAaC,EAA8B,CAC7D,MAAMC,EAAW,IAAI,cAAc,OAAOF,CAAG,EACvCG,EAAUC,EAAAA,OAAOF,CAAQ,EACzBG,EAAW,IAAI,WAAWF,EAAQ,OAAS,EAAIF,EAAK,MAAM,EAChE,OAAAI,EAAS,IAAIF,EAAS,CAAC,EACvBE,EAAS,IAAIF,EAASA,EAAQ,MAAM,EACpCE,EAAS,IAAIJ,EAAME,EAAQ,OAAS,CAAC,EAC9BC,EAAAA,OAAOC,CAAQ,CACxB,CAYA,SAASC,EAAcC,EAAsC,CAC3D,GAAIA,EAAM,SAAWvB,EAAoB,OAAO,KAChD,MAAMwB,EAAQT,EAAWhB,EAAcwB,CAAK,EACtCE,EAAUC,EAAI,mBAAmBH,EAAOC,CAAK,EACnD,OAAOC,EAAUA,EAAQ,YAAc,IACzC,CAOA,SAASE,EACPC,EACAC,EACa,CACb,MAAMC,EAAcf,EAAWjB,EAAY8B,CAAY,EAEjDG,EAAU,IAAIC,cACpBD,EAAQ,QAAUzB,EAClByB,EAAQ,SAAWxB,EACnB,MAAM0B,EAAYC,EAAAA,OAAO,OAAO,CAC9BA,EAAAA,OAAO,KAAK,CAACtB,EAAMC,CAAe,CAAC,EACnCqB,EAAAA,OAAO,KAAKJ,CAAW,CAAA,CACxB,EACDC,EAAQ,SACNG,SAAO,MAAMzB,EAA6B,CAAC,EAC3CC,EACAF,EACAyB,CAAA,EAEFF,EAAQ,UAAUF,EAAcxB,CAAS,EAEzC,MAAM8B,EAAS,IAAIH,cACnB,OAAAG,EAAO,QAAU7B,EACjB6B,EAAO,SAAW5B,EAElB4B,EAAO,SACLJ,EAAQ,QAAA,EACRpB,EACAH,CAAA,EAEF2B,EAAO,UAAUD,SAAO,KAAK,CAACpB,CAAS,CAAC,EAAGT,CAAS,EAE7C8B,CACT,CAwBO,SAASC,EACdR,EACAS,EACAC,EACAC,EAAmBP,EAAAA,YAAY,gBACtB,CAKT,GAJIK,EAAY,SAAWrC,GACvBsC,EAAU,SAAWrC,GAIvBsC,IAAaP,EAAAA,YAAY,iBACzBO,IAAaP,EAAAA,YAAY,YAEzB,MAAO,GAQT,GAAI,CAIF,MAAMQ,EAAOC,EAAAA,SAAS,KAAK,CACzB,eAAgBP,EAAAA,OAAO,KAAKG,CAAW,CAAA,CACxC,EACD,GAAI,CAACG,EAAK,OAAQ,MAAO,GACzB,MAAMX,EAAeW,EAAK,OAKpBE,EAHSf,EAAuBC,EAAcC,CAAY,EAGzC,iBACrB,EACA,CAACA,CAAY,EACb,CAACxB,CAAS,EACVkC,CAAA,EAIII,EAAerB,EAAce,CAAW,EAC9C,OAAKM,EAEEjB,EAAI,cAAcgB,EAASC,EAAcL,CAAS,EAF/B,EAG5B,MAAQ,CACN,MAAO,EACT,CACF,CAqBO,SAASM,EACdhB,EACAiB,EACAC,EACS,CAET,GADID,EAAiB,SAAW3C,GAE9B4C,EAAiB,OAAS3C,GAC1B2C,EAAiB,OAAS1C,EAE1B,MAAO,GAIT,GAAI,CAEF,GAAI,CAACsB,EAAI,kBAAkBmB,CAAgB,EAAG,MAAO,GAIrD,KAAM,CAAE,UAAAP,EAAW,SAAAC,CAAA,EAAaQ,EAAAA,OAAQ,UAAU,OAChDb,EAAAA,OAAO,KAAKY,CAAgB,CAAA,EAa9B,GANE,CAACC,EAAAA,OAAQ,UACN,OAAOT,EAAWC,CAAQ,EAC1B,OAAOL,EAAAA,OAAO,KAAKY,CAAgB,CAAC,GAIrCP,IAAaP,EAAAA,YAAY,YAAa,MAAO,GAGjD,MAAMgB,EAASP,EAAAA,SAAS,OAAO,CAAE,OAAQP,SAAO,KAAKW,CAAgB,EAAG,EACxE,GAAI,CAACG,EAAO,QAAU,CAACA,EAAO,KAAM,MAAO,GAE3C,MAAMb,EAASR,EAAuBC,EAAcoB,EAAO,MAAM,EAM3DC,EAAaR,EAAAA,SAAS,MAAM,CAAE,KAAMO,EAAO,IAAA,CAAM,EAAE,OACzD,GAAI,CAACC,EAAY,MAAO,GACxB,MAAMP,EAAUP,EAAO,iBAAiB,EAAGc,EAAY5C,EAAWkC,CAAQ,EAI1E,OAAOb,EAAI,OAAOgB,EAASG,EAAkBP,EAAW,EAAI,CAC9D,MAAQ,CACN,MAAO,EACT,CACF"}
+{"version":3,"file":"bip322Verify-DLxJR9CQ.cjs","sources":["../src/tbv/core/clients/vault-provider/auth/bip322Verify.ts"],"sourcesContent":["/**\n * BIP-322 \"simple\" signature verification for P2TR key-path and P2WPKH.\n *\n * Mirrors the Rust reference in\n * `btc-vault/crates/btc-signer/src/message.rs` (`verify_bip322_message`\n * and the P2WPKH arm of `verify_pop_witness`, both of which delegate to\n * the `bip322` crate 0.0.10's `verify_simple`).\n *\n * The algorithm:\n *\n *   1. Compute the BIP-322 tagged-hash of the message:\n *        m_hash = SHA256( SHA256(tag) || SHA256(tag) || message )\n *      where tag = \"BIP0322-signed-message\".\n *\n *   2. Build a virtual \"to_spend\" transaction with one input (prevout\n *      all-zero txid + 0xFFFFFFFF vout, scriptSig = `OP_0 PUSH32 m_hash`,\n *      sequence = 0) and one output (value 0, scriptPubKey = the signer's\n *      address: P2TR key-path-only, or P2WPKH of the compressed pubkey).\n *\n *   3. Build a \"to_sign\" transaction that spends to_spend[0] and has a\n *      single `OP_RETURN` output (value 0).\n *\n *   4. Compute the sighash of to_sign input 0: BIP-341 taproot for P2TR\n *      (SIGHASH_DEFAULT 0x00 unless the witness item carried a trailing\n *      SIGHASH_ALL 0x01 byte), BIP-143 with the standard P2WPKH\n *      scriptCode for P2WPKH (SIGHASH_ALL only).\n *\n *   5. Verify the signature: Schnorr against the **tweaked** output key\n *      `Q = P + tap_tweak(P) * G` for P2TR (no merkle root — key-path\n *      only), ECDSA against the compressed pubkey for P2WPKH.\n *\n * `bitcoinjs-lib` handles (2)–(4); `tiny-secp256k1-asmjs` provides\n * the tweak and the Schnorr/ECDSA verifies. Pulling in a full BIP-322\n * library would add a peer dep for what amounts to ~40 lines of glue.\n *\n * @module tbv/core/clients/vault-provider/auth/bip322Verify\n */\n\nimport * as ecc from \"@bitcoin-js/tiny-secp256k1-asmjs\";\nimport { script as bscript, payments, Transaction } from \"bitcoinjs-lib\";\n\nimport { sha256 } from \"@noble/hashes/sha2.js\";\nimport { Buffer } from \"buffer\";\n\n/** BIP-322 message tag (BIP-340 tagged-hash style). */\nconst BIP322_TAG = \"BIP0322-signed-message\";\n\n/** BIP-341 taproot-tweak tag. */\nconst TAPTWEAK_TAG = \"TapTweak\";\n\nconst X_ONLY_PUBKEY_SIZE = 32;\nconst SCHNORR_SIG_SIZE = 64;\n/** SEC1 compressed pubkey: 0x02/0x03 prefix + 32-byte x coordinate. */\nconst COMPRESSED_PUBKEY_SIZE = 33;\n/**\n * vaultd's P2WPKH BIP-322 verifier accepts ONLY 71/72-byte encoded\n * signatures — DER (70/71B) + sighash byte (`bip322` crate 0.0.10\n * `verify.rs:141-153`). A shorter (short-DER) signature fails ingestion\n * permanently, so this gate must be exactly as strict. Exported so\n * `verifyPopWitness` can pre-screen with a cause-naming error.\n */\nexport const P2WPKH_ENCODED_SIG_MIN = 71;\nexport const P2WPKH_ENCODED_SIG_MAX = 72;\n\n// NOTE: bitcoinjs-lib v6.x's `Transaction.addOutput` and its sighash\n// methods are typed for `Satoshi` (a UInt53 number), not `bigint`.\n// Passing `BigInt(0)` triggers a typeforce assertion in `addOutput`\n// (\"Expected property '1' of type Satoshi, got BigInt 0\") which the\n// verifiers' try/catch silently turns into `verify -> false`. Use\n// plain `0` everywhere.\nconst ZERO_SATS = 0;\n\n// Wire fields of the virtual to_spend/to_sign transactions (`bip322`\n// crate 0.0.10 `util.rs:18-85`).\nconst BIP322_TX_VERSION = 0;\nconst BIP322_TX_LOCKTIME = 0;\nconst BIP322_INPUT_SEQUENCE = 0;\n/** to_spend prevout: all-zero 32-byte txid at index 0xFFFFFFFF (`util.rs:18-85`). */\nconst TO_SPEND_PREVOUT_TXID_BYTES = 32;\nconst TO_SPEND_PREVOUT_INDEX = 0xffffffff;\n/** to_sign spends to_spend's only output (`util.rs:18-85`). */\nconst TO_SPEND_OUTPUT_INDEX = 0;\nconst OP_0 = 0x00;\n/** Direct push of the 32-byte tagged message hash. */\nconst OP_PUSHBYTES_32 = 0x20;\nconst OP_RETURN = 0x6a;\n\n/**\n * BIP-340 tagged hash: `SHA256( SHA256(tag) || SHA256(tag) || data )`.\n * Used for both BIP-322 message hashing and BIP-341 tap-tweak.\n */\nfunction taggedHash(tag: string, data: Uint8Array): Uint8Array {\n  const tagBytes = new TextEncoder().encode(tag);\n  const tagHash = sha256(tagBytes);\n  const preimage = new Uint8Array(tagHash.length * 2 + data.length);\n  preimage.set(tagHash, 0);\n  preimage.set(tagHash, tagHash.length);\n  preimage.set(data, tagHash.length * 2);\n  return sha256(preimage);\n}\n\n/**\n * Apply BIP-341 taproot tweak to an x-only pubkey with no merkle\n * root (key-path-only address).\n *\n * `tap_tweak = hash_TapTweak(P)`\n * `Q = P + tap_tweak * G` (x-only, even-Y parity)\n *\n * Returns the tweaked 32-byte x-only pubkey, or null if the tweak\n * produces a point-at-infinity or invalid result.\n */\nfunction tweakXOnlyKey(xOnly: Uint8Array): Uint8Array | null {\n  if (xOnly.length !== X_ONLY_PUBKEY_SIZE) return null;\n  const tweak = taggedHash(TAPTWEAK_TAG, xOnly);\n  const tweaked = ecc.xOnlyPointAddTweak(xOnly, tweak);\n  return tweaked ? tweaked.xOnlyPubkey : null;\n}\n\n/**\n * Build the BIP-322 virtual `to_sign` transaction for a signer\n * scriptPubKey (steps 1–3 above; `bip322` crate 0.0.10 `util.rs:18-85`:\n * both txs version 0, locktime 0, sequence 0, all values 0).\n */\nfunction buildToSignTransaction(\n  messageBytes: Uint8Array,\n  scriptPubKey: Buffer,\n): Transaction {\n  const messageHash = taggedHash(BIP322_TAG, messageBytes);\n\n  const toSpend = new Transaction();\n  toSpend.version = BIP322_TX_VERSION;\n  toSpend.locktime = BIP322_TX_LOCKTIME;\n  const scriptSig = Buffer.concat([\n    Buffer.from([OP_0, OP_PUSHBYTES_32]),\n    Buffer.from(messageHash),\n  ]);\n  toSpend.addInput(\n    Buffer.alloc(TO_SPEND_PREVOUT_TXID_BYTES, 0),\n    TO_SPEND_PREVOUT_INDEX,\n    BIP322_INPUT_SEQUENCE,\n    scriptSig,\n  );\n  toSpend.addOutput(scriptPubKey, ZERO_SATS);\n\n  const toSign = new Transaction();\n  toSign.version = BIP322_TX_VERSION;\n  toSign.locktime = BIP322_TX_LOCKTIME;\n  // Bitcoin txid in natural-byte (little-endian) form.\n  toSign.addInput(\n    toSpend.getHash(),\n    TO_SPEND_OUTPUT_INDEX,\n    BIP322_INPUT_SEQUENCE,\n  );\n  toSign.addOutput(Buffer.from([OP_RETURN]), ZERO_SATS);\n\n  return toSign;\n}\n\n/**\n * Verify a BIP-322 \"simple\" P2TR key-path signature over an arbitrary\n * byte message.\n *\n * @internal Consumed by `verifyServerIdentity` (VP auth) and\n * `verifyPopWitness` (PoP pre-registration check), and exposed so the\n * golden-vector test suite can pin the verifier independently.\n *\n * @param messageBytes - The bytes that were signed (e.g. a CBOR-encoded\n *                       payload). Not pre-hashed; this function applies\n *                       the BIP-322 tagged hash internally.\n * @param xOnlyPubkey  - 32-byte x-only pubkey of the signer (pre-tweak).\n * @param signature    - 64-byte raw Schnorr signature (BIP-340), as\n *                       emitted by a key-path witness. The trailing\n *                       sighash byte of a 65-byte witness item is not\n *                       part of it — pass it as `hashType` instead.\n * @param hashType     - BIP-341 sighash type the signature commits to.\n *                       `SIGHASH_DEFAULT` (0x00) for a 64-byte witness\n *                       item, `SIGHASH_ALL` (0x01) for a 65-byte one.\n * @returns `true` if the signature verifies against the address\n *          derived from `xOnlyPubkey`; `false` otherwise.\n */\nexport function verifyBip322Simple(\n  messageBytes: Uint8Array,\n  xOnlyPubkey: Uint8Array,\n  signature: Uint8Array,\n  hashType: number = Transaction.SIGHASH_DEFAULT,\n): boolean {\n  if (xOnlyPubkey.length !== X_ONLY_PUBKEY_SIZE) return false;\n  if (signature.length !== SCHNORR_SIG_SIZE) return false;\n  // Only the two types a BIP-322 witness may carry. SIGHASH_NONE/SINGLE and the\n  // ANYONECANPAY variants would verify here but are rejected downstream.\n  if (\n    hashType !== Transaction.SIGHASH_DEFAULT &&\n    hashType !== Transaction.SIGHASH_ALL\n  ) {\n    return false;\n  }\n\n  // Any exception from the underlying crypto libraries (e.g. the\n  // `Expected Point` error `tiny-secp256k1` throws when the supplied\n  // 32 bytes don't represent a valid x-coordinate on secp256k1) is\n  // treated as a verification failure rather than propagated — a\n  // verifier MUST return a boolean, not raise.\n  try {\n    // scriptPubKey for the signer's P2TR key-path-only address.\n    // bitcoinjs-lib's `payments.p2tr({ internalPubkey })` computes the\n    // tweak and produces the `OP_1 <tweaked_xonly>` output script.\n    const p2tr = payments.p2tr({\n      internalPubkey: Buffer.from(xOnlyPubkey),\n    });\n    if (!p2tr.output) return false;\n    const scriptPubKey = p2tr.output;\n\n    const toSign = buildToSignTransaction(messageBytes, scriptPubKey);\n\n    // Taproot sighash for to_sign input 0.\n    const sighash = toSign.hashForWitnessV1(\n      0,\n      [scriptPubKey],\n      [ZERO_SATS],\n      hashType,\n    );\n\n    // Tweak the x-only pubkey (no merkle root) and verify Schnorr.\n    const tweakedXOnly = tweakXOnlyKey(xOnlyPubkey);\n    if (!tweakedXOnly) return false;\n\n    return ecc.verifySchnorr(sighash, tweakedXOnly, signature);\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Verify a BIP-322 \"simple\" P2WPKH signature over an arbitrary byte\n * message, mirroring the verifier vaultd runs on a two-item PoP witness\n * (`bip322` crate 0.0.10 `verify.rs:102-186 verify_full_p2wpkh`).\n *\n * @internal Consumed by `verifyPopWitness` for Native SegWit software\n * wallets, and exposed so the BIP-322 official-vector test suite can pin\n * the verifier independently.\n *\n * @param compressedPubkey - 33-byte SEC1 compressed pubkey of the signer\n *                           (witness item 1). The address is derived from\n *                           it; network affects only bech32 encoding, not\n *                           script or sighash (`message.rs:125-127`).\n * @param encodedSignature - Witness item 0: DER signature with trailing\n *                           sighash byte, 71 or 72 bytes, SIGHASH_ALL only\n *                           (`verify.rs:141-161`).\n * @returns `true` if the signature verifies against the P2WPKH address of\n *          `compressedPubkey`; `false` otherwise.\n */\nexport function verifyBip322P2wpkhSimple(\n  messageBytes: Uint8Array,\n  compressedPubkey: Uint8Array,\n  encodedSignature: Uint8Array,\n): boolean {\n  if (compressedPubkey.length !== COMPRESSED_PUBKEY_SIZE) return false;\n  if (\n    encodedSignature.length < P2WPKH_ENCODED_SIG_MIN ||\n    encodedSignature.length > P2WPKH_ENCODED_SIG_MAX\n  ) {\n    return false;\n  }\n  // Any exception below (strict-DER decode, malformed pubkey) is a\n  // verification failure, not an error — a verifier returns a boolean.\n  try {\n    // Full curve-point parse, as `PublicKey::from_slice` (`verify.rs:82-83`).\n    if (!ecc.isPointCompressed(compressedPubkey)) return false;\n\n    // Strict DER decode, then SIGHASH_ALL only — deliberately NARROWER than\n    // `verify.rs:156-161` (its from_consensus maps more bytes to All); host-stricter is safe.\n    const { signature, hashType } = bscript.signature.decode(\n      Buffer.from(encodedSignature),\n    );\n    // decode tolerates non-minimal integers (bip66.js never bounds lenR/lenS at 33;\n    // fromDER truncates, script_signature.js:29-35) that vaultd's strict libsecp\n    // parse rejects (secp256k1-sys ecdsa_impl.h:127-136) — require the unique\n    // minimal encoding by re-encoding and byte-comparing.\n    if (\n      !bscript.signature\n        .encode(signature, hashType)\n        .equals(Buffer.from(encodedSignature))\n    ) {\n      return false;\n    }\n    if (hashType !== Transaction.SIGHASH_ALL) return false;\n\n    // scriptPubKey = OP_0 PUSH20 hash160(pubkey) (`message.rs:127 Address::p2wpkh`).\n    const p2wpkh = payments.p2wpkh({ pubkey: Buffer.from(compressedPubkey) });\n    if (!p2wpkh.output || !p2wpkh.hash) return false;\n\n    const toSign = buildToSignTransaction(messageBytes, p2wpkh.output);\n\n    // BIP-143 sighash with the standard P2WPKH scriptCode\n    // `OP_DUP OP_HASH160 <20B> OP_EQUALVERIFY OP_CHECKSIG` and value 0\n    // (`verify.rs:163-173 p2wpkh_signature_hash`; scriptCode template per\n    // bitcoinjs-lib's own P2WPKH signer, `src/psbt.js:1245-1255`).\n    const scriptCode = payments.p2pkh({ hash: p2wpkh.hash }).output;\n    if (!scriptCode) return false;\n    const sighash = toSign.hashForWitnessV0(0, scriptCode, ZERO_SATS, hashType);\n\n    // strict=true rejects high-S, as libsecp256k1's verify does\n    // (`verify.rs:180-182`; secp256k1 crate `ecdsa/mod.rs:194`).\n    return ecc.verify(sighash, compressedPubkey, signature, true);\n  } catch {\n    return false;\n  }\n}\n"],"names":["BIP322_TAG","TAPTWEAK_TAG","X_ONLY_PUBKEY_SIZE","SCHNORR_SIG_SIZE","COMPRESSED_PUBKEY_SIZE","P2WPKH_ENCODED_SIG_MIN","P2WPKH_ENCODED_SIG_MAX","ZERO_SATS","BIP322_TX_VERSION","BIP322_TX_LOCKTIME","BIP322_INPUT_SEQUENCE","TO_SPEND_PREVOUT_TXID_BYTES","TO_SPEND_PREVOUT_INDEX","TO_SPEND_OUTPUT_INDEX","OP_0","OP_PUSHBYTES_32","OP_RETURN","taggedHash","tag","data","tagBytes","tagHash","sha256","preimage","tweakXOnlyKey","xOnly","tweak","tweaked","ecc","buildToSignTransaction","messageBytes","scriptPubKey","messageHash","toSpend","Transaction","scriptSig","Buffer","toSign","verifyBip322Simple","xOnlyPubkey","signature","hashType","p2tr","payments","sighash","tweakedXOnly","verifyBip322P2wpkhSimple","compressedPubkey","encodedSignature","bscript","p2wpkh","scriptCode"],"mappings":"2aA6CMA,EAAa,yBAGbC,EAAe,WAEfC,EAAqB,GACrBC,EAAmB,GAEnBC,EAAyB,GAQlBC,EAAyB,GACzBC,EAAyB,GAQhCC,EAAY,EAIZC,EAAoB,EACpBC,EAAqB,EACrBC,EAAwB,EAExBC,EAA8B,GAC9BC,EAAyB,WAEzBC,EAAwB,EACxBC,EAAO,EAEPC,EAAkB,GAClBC,EAAY,IAMlB,SAASC,EAAWC,EAAaC,EAA8B,CAC7D,MAAMC,EAAW,IAAI,cAAc,OAAOF,CAAG,EACvCG,EAAUC,EAAAA,OAAOF,CAAQ,EACzBG,EAAW,IAAI,WAAWF,EAAQ,OAAS,EAAIF,EAAK,MAAM,EAChE,OAAAI,EAAS,IAAIF,EAAS,CAAC,EACvBE,EAAS,IAAIF,EAASA,EAAQ,MAAM,EACpCE,EAAS,IAAIJ,EAAME,EAAQ,OAAS,CAAC,EAC9BC,EAAAA,OAAOC,CAAQ,CACxB,CAYA,SAASC,EAAcC,EAAsC,CAC3D,GAAIA,EAAM,SAAWvB,EAAoB,OAAO,KAChD,MAAMwB,EAAQT,EAAWhB,EAAcwB,CAAK,EACtCE,EAAUC,EAAI,mBAAmBH,EAAOC,CAAK,EACnD,OAAOC,EAAUA,EAAQ,YAAc,IACzC,CAOA,SAASE,EACPC,EACAC,EACa,CACb,MAAMC,EAAcf,EAAWjB,EAAY8B,CAAY,EAEjDG,EAAU,IAAIC,cACpBD,EAAQ,QAAUzB,EAClByB,EAAQ,SAAWxB,EACnB,MAAM0B,EAAYC,EAAAA,OAAO,OAAO,CAC9BA,EAAAA,OAAO,KAAK,CAACtB,EAAMC,CAAe,CAAC,EACnCqB,EAAAA,OAAO,KAAKJ,CAAW,CAAA,CACxB,EACDC,EAAQ,SACNG,SAAO,MAAMzB,EAA6B,CAAC,EAC3CC,EACAF,EACAyB,CAAA,EAEFF,EAAQ,UAAUF,EAAcxB,CAAS,EAEzC,MAAM8B,EAAS,IAAIH,cACnB,OAAAG,EAAO,QAAU7B,EACjB6B,EAAO,SAAW5B,EAElB4B,EAAO,SACLJ,EAAQ,QAAA,EACRpB,EACAH,CAAA,EAEF2B,EAAO,UAAUD,SAAO,KAAK,CAACpB,CAAS,CAAC,EAAGT,CAAS,EAE7C8B,CACT,CAwBO,SAASC,EACdR,EACAS,EACAC,EACAC,EAAmBP,EAAAA,YAAY,gBACtB,CAKT,GAJIK,EAAY,SAAWrC,GACvBsC,EAAU,SAAWrC,GAIvBsC,IAAaP,EAAAA,YAAY,iBACzBO,IAAaP,EAAAA,YAAY,YAEzB,MAAO,GAQT,GAAI,CAIF,MAAMQ,EAAOC,EAAAA,SAAS,KAAK,CACzB,eAAgBP,EAAAA,OAAO,KAAKG,CAAW,CAAA,CACxC,EACD,GAAI,CAACG,EAAK,OAAQ,MAAO,GACzB,MAAMX,EAAeW,EAAK,OAKpBE,EAHSf,EAAuBC,EAAcC,CAAY,EAGzC,iBACrB,EACA,CAACA,CAAY,EACb,CAACxB,CAAS,EACVkC,CAAA,EAIII,EAAerB,EAAce,CAAW,EAC9C,OAAKM,EAEEjB,EAAI,cAAcgB,EAASC,EAAcL,CAAS,EAF/B,EAG5B,MAAQ,CACN,MAAO,EACT,CACF,CAqBO,SAASM,EACdhB,EACAiB,EACAC,EACS,CAET,GADID,EAAiB,SAAW3C,GAE9B4C,EAAiB,OAAS3C,GAC1B2C,EAAiB,OAAS1C,EAE1B,MAAO,GAIT,GAAI,CAEF,GAAI,CAACsB,EAAI,kBAAkBmB,CAAgB,EAAG,MAAO,GAIrD,KAAM,CAAE,UAAAP,EAAW,SAAAC,CAAA,EAAaQ,EAAAA,OAAQ,UAAU,OAChDb,EAAAA,OAAO,KAAKY,CAAgB,CAAA,EAa9B,GANE,CAACC,EAAAA,OAAQ,UACN,OAAOT,EAAWC,CAAQ,EAC1B,OAAOL,EAAAA,OAAO,KAAKY,CAAgB,CAAC,GAIrCP,IAAaP,EAAAA,YAAY,YAAa,MAAO,GAGjD,MAAMgB,EAASP,EAAAA,SAAS,OAAO,CAAE,OAAQP,SAAO,KAAKW,CAAgB,EAAG,EACxE,GAAI,CAACG,EAAO,QAAU,CAACA,EAAO,KAAM,MAAO,GAE3C,MAAMb,EAASR,EAAuBC,EAAcoB,EAAO,MAAM,EAM3DC,EAAaR,EAAAA,SAAS,MAAM,CAAE,KAAMO,EAAO,IAAA,CAAM,EAAE,OACzD,GAAI,CAACC,EAAY,MAAO,GACxB,MAAMP,EAAUP,EAAO,iBAAiB,EAAGc,EAAY5C,EAAWkC,CAAQ,EAI1E,OAAOb,EAAI,OAAOgB,EAASG,EAAkBP,EAAW,EAAI,CAC9D,MAAQ,CACN,MAAO,EACT,CACF"}