@bitgo-beta/sdk-lib-safes 1.0.0-beta.26 → 1.0.0-beta.28

package/dist/src/index.d.ts

@@ -1,10 +1,11 @@
 /**
  * @prettier
  *
- * @experimental Pure Safe derivation leaf. Never imports sdk-core/BaseCoin/Wallet/Safe/key-card.
+ * @experimental Pure Safe derivation and keycard box codec leaf. Never imports sdk-core/BaseCoin/Wallet/Safe/key-card.
  */
 export * from './ed25519KeyDeriver';
 export * from './ed25519Pub';
+export * from './keycardCodec';
 export * from './safeDerivation';
 export * from './safeRecovery';
 export * from './safeSlot';

package/dist/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,cAAc,qBAAqB,CAAC;AACpC,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,cAAc,qBAAqB,CAAC;AACpC,cAAc,cAAc,CAAC;AAC7B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC"}

package/dist/src/index.js

@@ -17,11 +17,12 @@ Object.defineProperty(exports, "__esModule", { value: true });
 /**
  * @prettier
  *
- * @experimental Pure Safe derivation leaf. Never imports sdk-core/BaseCoin/Wallet/Safe/key-card.
+ * @experimental Pure Safe derivation and keycard box codec leaf. Never imports sdk-core/BaseCoin/Wallet/Safe/key-card.
  */
 __exportStar(require("./ed25519KeyDeriver"), exports);
 __exportStar(require("./ed25519Pub"), exports);
+__exportStar(require("./keycardCodec"), exports);
 __exportStar(require("./safeDerivation"), exports);
 __exportStar(require("./safeRecovery"), exports);
 __exportStar(require("./safeSlot"), exports);
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7OztBQUFBOzs7O0dBSUc7QUFDSCxzREFBb0M7QUFDcEMsK0NBQTZCO0FBQzdCLG1EQUFpQztBQUNqQyxpREFBK0I7QUFDL0IsNkNBQTJCIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBAcHJldHRpZXJcbiAqXG4gKiBAZXhwZXJpbWVudGFsIFB1cmUgU2FmZSBkZXJpdmF0aW9uIGxlYWYuIE5ldmVyIGltcG9ydHMgc2RrLWNvcmUvQmFzZUNvaW4vV2FsbGV0L1NhZmUva2V5LWNhcmQuXG4gKi9cbmV4cG9ydCAqIGZyb20gJy4vZWQyNTUxOUtleURlcml2ZXInO1xuZXhwb3J0ICogZnJvbSAnLi9lZDI1NTE5UHViJztcbmV4cG9ydCAqIGZyb20gJy4vc2FmZURlcml2YXRpb24nO1xuZXhwb3J0ICogZnJvbSAnLi9zYWZlUmVjb3ZlcnknO1xuZXhwb3J0ICogZnJvbSAnLi9zYWZlU2xvdCc7XG4iXX0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7OztBQUFBOzs7O0dBSUc7QUFDSCxzREFBb0M7QUFDcEMsK0NBQTZCO0FBQzdCLGlEQUErQjtBQUMvQixtREFBaUM7QUFDakMsaURBQStCO0FBQy9CLDZDQUEyQiIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogQHByZXR0aWVyXG4gKlxuICogQGV4cGVyaW1lbnRhbCBQdXJlIFNhZmUgZGVyaXZhdGlvbiBhbmQga2V5Y2FyZCBib3ggY29kZWMgbGVhZi4gTmV2ZXIgaW1wb3J0cyBzZGstY29yZS9CYXNlQ29pbi9XYWxsZXQvU2FmZS9rZXktY2FyZC5cbiAqL1xuZXhwb3J0ICogZnJvbSAnLi9lZDI1NTE5S2V5RGVyaXZlcic7XG5leHBvcnQgKiBmcm9tICcuL2VkMjU1MTlQdWInO1xuZXhwb3J0ICogZnJvbSAnLi9rZXljYXJkQ29kZWMnO1xuZXhwb3J0ICogZnJvbSAnLi9zYWZlRGVyaXZhdGlvbic7XG5leHBvcnQgKiBmcm9tICcuL3NhZmVSZWNvdmVyeSc7XG5leHBvcnQgKiBmcm9tICcuL3NhZmVTbG90JztcbiJdfQ==

package/dist/src/keycardCodec.d.ts

@@ -0,0 +1,24 @@
+import type { RootKeyType } from '@bitgo/public-types';
+/**
+ * Identifier for one of a safe's four roots (one per signing scheme). Each value is the
+ * root's `rootKeyType`, which is also the key used in the keycard's per-box JSON.
+ */
+export type SafeRootKeyType = RootKeyType;
+/**
+ * The JSON object encoded in a safe keycard box (A/B/C): the four roots keyed by
+ * {@link SafeRootKeyType}. Values are per-root ciphertext for A/B (encryptedPrv or
+ * reducedEncryptedPrv; safe MPC ciphertext decrypts to a versioned signing+VRF envelope) or
+ * public keys for C. The root-key-type keys are self-identifying, so a
+ * consumer parses by key rather than by size/offset.
+ */
+export type SafeKeycardRoots = Record<SafeRootKeyType, string>;
+/**
+ * Parses a safe keycard box value — the JSON packed by key-card's `generateSafeQrData`, e.g.
+ * `{"secp256k1Multisig":"…","ecdsaMpc":"…",…}` — into its four roots. Throws if the value is
+ * not valid JSON or any root is missing/non-string. Recovery tooling calls this on the A/B/C
+ * box value, then decrypts each root value with the safe password. An MPC root value is an
+ * opaque versioned envelope; recovery must unwrap its `prvKeyShare` and `vrf` fields instead
+ * of treating the decrypted bytes as a bare share.
+ */
+export declare function parseSafeKeycardBox(data: string): SafeKeycardRoots;
+//# sourceMappingURL=keycardCodec.d.ts.map

package/dist/src/keycardCodec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keycardCodec.d.ts","sourceRoot":"","sources":["../../src/keycardCodec.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEvD;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;AAa/D;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,CAOlE"}

package/dist/src/keycardCodec.js

@@ -0,0 +1,75 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseSafeKeycardBox = parseSafeKeycardBox;
+/**
+ * @prettier
+ *
+ * @experimental Safe keycard box codec.
+ *
+ * Each of Boxes A/B/C on a Safe keycard is a JSON object mapping a root slot name to that slot's key
+ * string. It lives in this leaf so sdk-core and WRW can parse a box without depending on key-card,
+ * which pulls in PDF/QR libraries and itself depends on sdk-core.
+ */
+const t = __importStar(require("io-ts"));
+const E = __importStar(require("fp-ts/Either"));
+const PathReporter_1 = require("io-ts/lib/PathReporter");
+const io_ts_types_1 = require("io-ts-types");
+// Annotating with SafeKeycardRoots makes the compiler reject a key added to or removed from one side only.
+const SafeKeycardRootsCodec = t.type({
+    secp256k1Multisig: t.string,
+    ecdsaMpc: t.string,
+    eddsaMpc: t.string,
+    ed25519Multisig: t.string,
+});
+// Decodes a box's JSON string straight into the validated roots record.
+const SafeKeycardBoxFromString = io_ts_types_1.JsonFromString.pipe(SafeKeycardRootsCodec);
+/**
+ * Parses a safe keycard box value — the JSON packed by key-card's `generateSafeQrData`, e.g.
+ * `{"secp256k1Multisig":"…","ecdsaMpc":"…",…}` — into its four roots. Throws if the value is
+ * not valid JSON or any root is missing/non-string. Recovery tooling calls this on the A/B/C
+ * box value, then decrypts each root value with the safe password. An MPC root value is an
+ * opaque versioned envelope; recovery must unwrap its `prvKeyShare` and `vrf` fields instead
+ * of treating the decrypted bytes as a bare share.
+ */
+function parseSafeKeycardBox(data) {
+    const decoded = SafeKeycardBoxFromString.decode(data);
+    if (E.isLeft(decoded)) {
+        // PathReporter, not decodeWithCodec: io-ts errors carry no message, so decodeWithCodec would report only "unknown".
+        throw new Error(`parseSafeKeycardBox: ${PathReporter_1.PathReporter.report(decoded).join('; ')}`);
+    }
+    return decoded.right;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoia2V5Y2FyZENvZGVjLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2tleWNhcmRDb2RlYy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztBQWlEQSxrREFPQztBQXhERDs7Ozs7Ozs7R0FRRztBQUNILHlDQUEyQjtBQUMzQixnREFBa0M7QUFDbEMseURBQXNEO0FBQ3RELDZDQUE2QztBQWtCN0MsMkdBQTJHO0FBQzNHLE1BQU0scUJBQXFCLEdBQTZCLENBQUMsQ0FBQyxJQUFJLENBQUM7SUFDN0QsaUJBQWlCLEVBQUUsQ0FBQyxDQUFDLE1BQU07SUFDM0IsUUFBUSxFQUFFLENBQUMsQ0FBQyxNQUFNO0lBQ2xCLFFBQVEsRUFBRSxDQUFDLENBQUMsTUFBTTtJQUNsQixlQUFlLEVBQUUsQ0FBQyxDQUFDLE1BQU07Q0FDMUIsQ0FBQyxDQUFDO0FBRUgsd0VBQXdFO0FBQ3hFLE1BQU0sd0JBQXdCLEdBQUcsNEJBQWMsQ0FBQyxJQUFJLENBQUMscUJBQXFCLENBQUMsQ0FBQztBQUU1RTs7Ozs7OztHQU9HO0FBQ0gsU0FBZ0IsbUJBQW1CLENBQUMsSUFBWTtJQUM5QyxNQUFNLE9BQU8sR0FBRyx3QkFBd0IsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDdEQsSUFBSSxDQUFDLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDdEIsb0hBQW9IO1FBQ3BILE1BQU0sSUFBSSxLQUFLLENBQUMsd0JBQXdCLDJCQUFZLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDckYsQ0FBQztJQUNELE9BQU8sT0FBTyxDQUFDLEtBQUssQ0FBQztBQUN2QixDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLyoqXG4gKiBAcHJldHRpZXJcbiAqXG4gKiBAZXhwZXJpbWVudGFsIFNhZmUga2V5Y2FyZCBib3ggY29kZWMuXG4gKlxuICogRWFjaCBvZiBCb3hlcyBBL0IvQyBvbiBhIFNhZmUga2V5Y2FyZCBpcyBhIEpTT04gb2JqZWN0IG1hcHBpbmcgYSByb290IHNsb3QgbmFtZSB0byB0aGF0IHNsb3QncyBrZXlcbiAqIHN0cmluZy4gSXQgbGl2ZXMgaW4gdGhpcyBsZWFmIHNvIHNkay1jb3JlIGFuZCBXUlcgY2FuIHBhcnNlIGEgYm94IHdpdGhvdXQgZGVwZW5kaW5nIG9uIGtleS1jYXJkLFxuICogd2hpY2ggcHVsbHMgaW4gUERGL1FSIGxpYnJhcmllcyBhbmQgaXRzZWxmIGRlcGVuZHMgb24gc2RrLWNvcmUuXG4gKi9cbmltcG9ydCAqIGFzIHQgZnJvbSAnaW8tdHMnO1xuaW1wb3J0ICogYXMgRSBmcm9tICdmcC10cy9FaXRoZXInO1xuaW1wb3J0IHsgUGF0aFJlcG9ydGVyIH0gZnJvbSAnaW8tdHMvbGliL1BhdGhSZXBvcnRlcic7XG5pbXBvcnQgeyBKc29uRnJvbVN0cmluZyB9IGZyb20gJ2lvLXRzLXR5cGVzJztcbmltcG9ydCB0eXBlIHsgUm9vdEtleVR5cGUgfSBmcm9tICdAYml0Z28vcHVibGljLXR5cGVzJztcblxuLyoqXG4gKiBJZGVudGlmaWVyIGZvciBvbmUgb2YgYSBzYWZlJ3MgZm91ciByb290cyAob25lIHBlciBzaWduaW5nIHNjaGVtZSkuIEVhY2ggdmFsdWUgaXMgdGhlXG4gKiByb290J3MgYHJvb3RLZXlUeXBlYCwgd2hpY2ggaXMgYWxzbyB0aGUga2V5IHVzZWQgaW4gdGhlIGtleWNhcmQncyBwZXItYm94IEpTT04uXG4gKi9cbmV4cG9ydCB0eXBlIFNhZmVSb290S2V5VHlwZSA9IFJvb3RLZXlUeXBlO1xuXG4vKipcbiAqIFRoZSBKU09OIG9iamVjdCBlbmNvZGVkIGluIGEgc2FmZSBrZXljYXJkIGJveCAoQS9CL0MpOiB0aGUgZm91ciByb290cyBrZXllZCBieVxuICoge0BsaW5rIFNhZmVSb290S2V5VHlwZX0uIFZhbHVlcyBhcmUgcGVyLXJvb3QgY2lwaGVydGV4dCBmb3IgQS9CIChlbmNyeXB0ZWRQcnYgb3JcbiAqIHJlZHVjZWRFbmNyeXB0ZWRQcnY7IHNhZmUgTVBDIGNpcGhlcnRleHQgZGVjcnlwdHMgdG8gYSB2ZXJzaW9uZWQgc2lnbmluZytWUkYgZW52ZWxvcGUpIG9yXG4gKiBwdWJsaWMga2V5cyBmb3IgQy4gVGhlIHJvb3Qta2V5LXR5cGUga2V5cyBhcmUgc2VsZi1pZGVudGlmeWluZywgc28gYVxuICogY29uc3VtZXIgcGFyc2VzIGJ5IGtleSByYXRoZXIgdGhhbiBieSBzaXplL29mZnNldC5cbiAqL1xuZXhwb3J0IHR5cGUgU2FmZUtleWNhcmRSb290cyA9IFJlY29yZDxTYWZlUm9vdEtleVR5cGUsIHN0cmluZz47XG5cbi8vIEFubm90YXRpbmcgd2l0aCBTYWZlS2V5Y2FyZFJvb3RzIG1ha2VzIHRoZSBjb21waWxlciByZWplY3QgYSBrZXkgYWRkZWQgdG8gb3IgcmVtb3ZlZCBmcm9tIG9uZSBzaWRlIG9ubHkuXG5jb25zdCBTYWZlS2V5Y2FyZFJvb3RzQ29kZWM6IHQuVHlwZTxTYWZlS2V5Y2FyZFJvb3RzPiA9IHQudHlwZSh7XG4gIHNlY3AyNTZrMU11bHRpc2lnOiB0LnN0cmluZyxcbiAgZWNkc2FNcGM6IHQuc3RyaW5nLFxuICBlZGRzYU1wYzogdC5zdHJpbmcsXG4gIGVkMjU1MTlNdWx0aXNpZzogdC5zdHJpbmcsXG59KTtcblxuLy8gRGVjb2RlcyBhIGJveCdzIEpTT04gc3RyaW5nIHN0cmFpZ2h0IGludG8gdGhlIHZhbGlkYXRlZCByb290cyByZWNvcmQuXG5jb25zdCBTYWZlS2V5Y2FyZEJveEZyb21TdHJpbmcgPSBKc29uRnJvbVN0cmluZy5waXBlKFNhZmVLZXljYXJkUm9vdHNDb2RlYyk7XG5cbi8qKlxuICogUGFyc2VzIGEgc2FmZSBrZXljYXJkIGJveCB2YWx1ZSDigJQgdGhlIEpTT04gcGFja2VkIGJ5IGtleS1jYXJkJ3MgYGdlbmVyYXRlU2FmZVFyRGF0YWAsIGUuZy5cbiAqIGB7XCJzZWNwMjU2azFNdWx0aXNpZ1wiOlwi4oCmXCIsXCJlY2RzYU1wY1wiOlwi4oCmXCIs4oCmfWAg4oCUIGludG8gaXRzIGZvdXIgcm9vdHMuIFRocm93cyBpZiB0aGUgdmFsdWUgaXNcbiAqIG5vdCB2YWxpZCBKU09OIG9yIGFueSByb290IGlzIG1pc3Npbmcvbm9uLXN0cmluZy4gUmVjb3ZlcnkgdG9vbGluZyBjYWxscyB0aGlzIG9uIHRoZSBBL0IvQ1xuICogYm94IHZhbHVlLCB0aGVuIGRlY3J5cHRzIGVhY2ggcm9vdCB2YWx1ZSB3aXRoIHRoZSBzYWZlIHBhc3N3b3JkLiBBbiBNUEMgcm9vdCB2YWx1ZSBpcyBhblxuICogb3BhcXVlIHZlcnNpb25lZCBlbnZlbG9wZTsgcmVjb3ZlcnkgbXVzdCB1bndyYXAgaXRzIGBwcnZLZXlTaGFyZWAgYW5kIGB2cmZgIGZpZWxkcyBpbnN0ZWFkXG4gKiBvZiB0cmVhdGluZyB0aGUgZGVjcnlwdGVkIGJ5dGVzIGFzIGEgYmFyZSBzaGFyZS5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHBhcnNlU2FmZUtleWNhcmRCb3goZGF0YTogc3RyaW5nKTogU2FmZUtleWNhcmRSb290cyB7XG4gIGNvbnN0IGRlY29kZWQgPSBTYWZlS2V5Y2FyZEJveEZyb21TdHJpbmcuZGVjb2RlKGRhdGEpO1xuICBpZiAoRS5pc0xlZnQoZGVjb2RlZCkpIHtcbiAgICAvLyBQYXRoUmVwb3J0ZXIsIG5vdCBkZWNvZGVXaXRoQ29kZWM6IGlvLXRzIGVycm9ycyBjYXJyeSBubyBtZXNzYWdlLCBzbyBkZWNvZGVXaXRoQ29kZWMgd291bGQgcmVwb3J0IG9ubHkgXCJ1bmtub3duXCIuXG4gICAgdGhyb3cgbmV3IEVycm9yKGBwYXJzZVNhZmVLZXljYXJkQm94OiAke1BhdGhSZXBvcnRlci5yZXBvcnQoZGVjb2RlZCkuam9pbignOyAnKX1gKTtcbiAgfVxuICByZXR1cm4gZGVjb2RlZC5yaWdodDtcbn1cbiJdfQ==