@bitgo/wasm-utxo 5.5.0 → 5.6.0

package/dist/cjs/js/fixedScriptWallet/BitGoPsbt.d.ts

@@ -610,6 +610,41 @@ export declare class BitGoPsbt<TOutput extends ParsedOutput = ParsedOutput> exte
      * @returns The serialized unsigned transaction bytes (network/consensus encoding).
      */
     getUnsignedTransaction(): Uint8Array;
+    /**
+     * Returns each input's declared sighash type (BIP-174 PSBT_IN_SIGHASH_TYPE),
+     * in input order.
+     *
+     * Entries are `undefined` when the input does not declare a sighash type, in
+     * which case the signer's default sighash type applies.
+     */
+    getInputSighashTypes(): (number | undefined)[];
+    /**
+     * Asserts the sighash policy required when signing an externally supplied
+     * PSBT: every input must commit to the entire transaction.
+     *
+     * For every input this checks that
+     *
+     * 1. the declared sighash type (PSBT_IN_SIGHASH_TYPE), if present, commits
+     *    to every input and every output: SIGHASH_ALL (0x01) — SIGHASH_ALL |
+     *    SIGHASH_FORKID (0x41) on BCH-family coins — or SIGHASH_DEFAULT
+     *    (0x00) / SIGHASH_ALL (0x01) on Taproot inputs. An absent sighash type
+     *    is accepted: the signer then applies its default, which commits to
+     *    the entire transaction.
+     * 2. every signature already present on the input (ECDSA partial
+     *    signatures, Taproot key-path and script-path signatures) uses such a
+     *    sighash type. MuSig2 partial signatures carry no sighash byte; the
+     *    declared sighash type checked above governs them.
+     *
+     * SIGHASH_NONE, SIGHASH_SINGLE, SIGHASH_ANYONECANPAY, and combinations
+     * thereof leave outputs (or inputs) uncommitted, so a signature produced
+     * under one of them does not bind the signer to the transaction the signer
+     * reviewed. Callers that ingest foreign PSBTs must run this check before
+     * signing and again afterwards.
+     *
+     * @throws Error if any input declares a sighash type, or carries a
+     *         signature, that does not commit to the entire transaction.
+     */
+    assertSighashAllPolicy(): void;
     /**
      * Get all PSBT outputs with resolved address strings
      *

package/dist/cjs/js/fixedScriptWallet/BitGoPsbt.js

@@ -626,6 +626,45 @@ class BitGoPsbt extends psbtBase_js_1.PsbtBase {
     getUnsignedTransaction() {
         return this._wasm.get_unsigned_tx();
     }
+    /**
+     * Returns each input's declared sighash type (BIP-174 PSBT_IN_SIGHASH_TYPE),
+     * in input order.
+     *
+     * Entries are `undefined` when the input does not declare a sighash type, in
+     * which case the signer's default sighash type applies.
+     */
+    getInputSighashTypes() {
+        return this._wasm.get_input_sighash_types().map((sighashType) => sighashType ?? undefined);
+    }
+    /**
+     * Asserts the sighash policy required when signing an externally supplied
+     * PSBT: every input must commit to the entire transaction.
+     *
+     * For every input this checks that
+     *
+     * 1. the declared sighash type (PSBT_IN_SIGHASH_TYPE), if present, commits
+     *    to every input and every output: SIGHASH_ALL (0x01) — SIGHASH_ALL |
+     *    SIGHASH_FORKID (0x41) on BCH-family coins — or SIGHASH_DEFAULT
+     *    (0x00) / SIGHASH_ALL (0x01) on Taproot inputs. An absent sighash type
+     *    is accepted: the signer then applies its default, which commits to
+     *    the entire transaction.
+     * 2. every signature already present on the input (ECDSA partial
+     *    signatures, Taproot key-path and script-path signatures) uses such a
+     *    sighash type. MuSig2 partial signatures carry no sighash byte; the
+     *    declared sighash type checked above governs them.
+     *
+     * SIGHASH_NONE, SIGHASH_SINGLE, SIGHASH_ANYONECANPAY, and combinations
+     * thereof leave outputs (or inputs) uncommitted, so a signature produced
+     * under one of them does not bind the signer to the transaction the signer
+     * reviewed. Callers that ingest foreign PSBTs must run this check before
+     * signing and again afterwards.
+     *
+     * @throws Error if any input declares a sighash type, or carries a
+     *         signature, that does not commit to the entire transaction.
+     */
+    assertSighashAllPolicy() {
+        this._wasm.assert_sighash_all_policy();
+    }
     /**
      * Get all PSBT outputs with resolved address strings
      *

package/dist/cjs/js/fixedScriptWallet/ZcashIronwoodBitGoPsbt.d.ts

@@ -135,7 +135,9 @@ export declare class ZcashIronwoodBitGoPsbt extends ZcashBitGoPsbt {
      * @param amount - note value in zatoshi
      * @param options.anchor - 32-byte Ironwood note-commitment-tree root
      * @param options.memo - optional 512-byte memo (defaults to the ZIP-302 "no memo" encoding)
-     * @param options.ovk - optional 32-byte outgoing viewing key (omit for a keyless build)
+     * @param options.ovk - optional 32-byte outgoing viewing key (omit for a keyless build). Has no
+     *   effect in the normal flow: {@link sign}'s first round re-encrypts every action's
+     *   `out_ciphertext` under the wallet `ovk`, replacing whatever this produced
      * @param options.unifiedAddress - optional full Unified Address string this output was addressed
      *   to. Its Orchard receiver must equal `recipient`. The PCZT itself only carries the raw 43-byte
      *   receiver — a lossy encoding for a multi-receiver UA, since any transparent/Sapling receiver
@@ -156,12 +158,14 @@ export declare class ZcashIronwoodBitGoPsbt extends ZcashBitGoPsbt {
      * {@link addShieldedOutput}).
      *
      * @param outputs - one entry per recipient; `memo` defaults per-entry to the ZIP-302 "no memo"
-     *   encoding, exactly as {@link addShieldedOutput}'s does
+     *   encoding, exactly as {@link addShieldedOutput}'s does, and `ovk` is likewise replaced by
+     *   {@link sign}'s first round
      * @param anchor - 32-byte Ironwood note-commitment-tree root, shared by every output
      * @returns the action index assigned to each output, in the same order as `outputs` — the
-     *   orchard builder pads/reorders actions, so a client-managed-`ovk` caller must use these
-     *   indices (not the position in `outputs`) when later calling
-     *   `setIronwoodOutCiphertext`/`setIronwoodOutCiphertextForUser` for a specific recipient.
+     *   orchard builder pads/reorders actions, so any caller correlating per-action data (a stored
+     *   unified address, an explicit `setShieldedOutCiphertext` call) must use these indices, not the
+     *   position in `outputs` — though note {@link sign}'s first round already patches every action's
+     *   `out_ciphertext` with the wallet `ovk` on its own.
      */
     addShieldedOutputs(outputs: Array<{
         recipient: Uint8Array;
@@ -181,14 +185,16 @@ export declare class ZcashIronwoodBitGoPsbt extends ZcashBitGoPsbt {
      * `ovk` derived from those is one neither the user nor the server can reproduce, and the resulting
      * transaction would broadcast fine while leaving the shielded output permanently unrecoverable.
      *
-     * Normally you do not call this directly: {@link sign} performs it on the first signing round.
+     * Normally you do not call this directly: {@link sign} performs it for **every** action on the
+     * first signing round (idempotently — same `ovk`, same bytes).
      *
      * Must be called **before** signing: `out_ciphertext` is committed by the ZIP-244 sighash, so
      * calling this after any transparent signature has been added (via
      * {@link addTransparentSignature}) throws rather than silently invalidating that signature.
      *
-     * @param actionIndex - index of the Ironwood action whose output to re-encrypt (always `0`: only
-     *   one shielded output per transaction is supported, see {@link addShieldedOutput})
+     * @param actionIndex - index of the Ironwood action whose output to re-encrypt; use an index
+     *   returned by {@link addShieldedOutputs} (the orchard builder may reorder actions, so it is not
+     *   necessarily the output's position in the call)
      * @param userKey - the wallet's user root key (an xpriv)
      * @param rootWalletKeys - the wallet's root keys, supplying the BitGo cosigner pubkey
      */
@@ -220,7 +226,8 @@ export declare class ZcashIronwoodBitGoPsbt extends ZcashBitGoPsbt {
      *
      * If no transparent signature has been added to this PSBT yet, this is the first signing round and
      * `key` must be the wallet's user root key: it is used with `rootWalletKeys.bitgoKey()` to derive
-     * this wallet's `ovk` and finalize `out_ciphertext` — the client-managed-`ovk` flow — before any
+     * this wallet's `ovk` and finalize **every** action's `out_ciphertext` — the client-managed-`ovk`
+     * flow, multi-recipient builds included — before any
      * sighash is computed. Once a signature exists, that step is a no-op, so a caller passes
      * `rootWalletKeys` on every signing round unconditionally: `psbt.sign(userXpriv, rootWalletKeys)`
      * and later `psbt.sign(bitgoXpriv, rootWalletKeys)` — only the first call actually uses it.

package/dist/cjs/js/fixedScriptWallet/ZcashIronwoodBitGoPsbt.js

@@ -136,7 +136,9 @@ class ZcashIronwoodBitGoPsbt extends ZcashBitGoPsbt_js_1.ZcashBitGoPsbt {
      * @param amount - note value in zatoshi
      * @param options.anchor - 32-byte Ironwood note-commitment-tree root
      * @param options.memo - optional 512-byte memo (defaults to the ZIP-302 "no memo" encoding)
-     * @param options.ovk - optional 32-byte outgoing viewing key (omit for a keyless build)
+     * @param options.ovk - optional 32-byte outgoing viewing key (omit for a keyless build). Has no
+     *   effect in the normal flow: {@link sign}'s first round re-encrypts every action's
+     *   `out_ciphertext` under the wallet `ovk`, replacing whatever this produced
      * @param options.unifiedAddress - optional full Unified Address string this output was addressed
      *   to. Its Orchard receiver must equal `recipient`. The PCZT itself only carries the raw 43-byte
      *   receiver — a lossy encoding for a multi-receiver UA, since any transparent/Sapling receiver
@@ -155,12 +157,14 @@ class ZcashIronwoodBitGoPsbt extends ZcashBitGoPsbt_js_1.ZcashBitGoPsbt {
      * {@link addShieldedOutput}).
      *
      * @param outputs - one entry per recipient; `memo` defaults per-entry to the ZIP-302 "no memo"
-     *   encoding, exactly as {@link addShieldedOutput}'s does
+     *   encoding, exactly as {@link addShieldedOutput}'s does, and `ovk` is likewise replaced by
+     *   {@link sign}'s first round
      * @param anchor - 32-byte Ironwood note-commitment-tree root, shared by every output
      * @returns the action index assigned to each output, in the same order as `outputs` — the
-     *   orchard builder pads/reorders actions, so a client-managed-`ovk` caller must use these
-     *   indices (not the position in `outputs`) when later calling
-     *   `setIronwoodOutCiphertext`/`setIronwoodOutCiphertextForUser` for a specific recipient.
+     *   orchard builder pads/reorders actions, so any caller correlating per-action data (a stored
+     *   unified address, an explicit `setShieldedOutCiphertext` call) must use these indices, not the
+     *   position in `outputs` — though note {@link sign}'s first round already patches every action's
+     *   `out_ciphertext` with the wallet `ovk` on its own.
      */
     addShieldedOutputs(outputs, anchor) {
         return Array.from(this.wasm.add_ironwood_outputs(outputs.map((o) => ({
@@ -182,14 +186,16 @@ class ZcashIronwoodBitGoPsbt extends ZcashBitGoPsbt_js_1.ZcashBitGoPsbt {
      * `ovk` derived from those is one neither the user nor the server can reproduce, and the resulting
      * transaction would broadcast fine while leaving the shielded output permanently unrecoverable.
      *
-     * Normally you do not call this directly: {@link sign} performs it on the first signing round.
+     * Normally you do not call this directly: {@link sign} performs it for **every** action on the
+     * first signing round (idempotently — same `ovk`, same bytes).
      *
      * Must be called **before** signing: `out_ciphertext` is committed by the ZIP-244 sighash, so
      * calling this after any transparent signature has been added (via
      * {@link addTransparentSignature}) throws rather than silently invalidating that signature.
      *
-     * @param actionIndex - index of the Ironwood action whose output to re-encrypt (always `0`: only
-     *   one shielded output per transaction is supported, see {@link addShieldedOutput})
+     * @param actionIndex - index of the Ironwood action whose output to re-encrypt; use an index
+     *   returned by {@link addShieldedOutputs} (the orchard builder may reorder actions, so it is not
+     *   necessarily the output's position in the call)
      * @param userKey - the wallet's user root key (an xpriv)
      * @param rootWalletKeys - the wallet's root keys, supplying the BitGo cosigner pubkey
      */

package/dist/cjs/js/wasm/wasm_utxo.d.ts

@@ -144,7 +144,9 @@ export class BitGoPsbt {
      *
      * * `recipient` - raw Orchard/Ironwood address ([`ORCHARD_ADDRESS_SIZE`] bytes)
      * * `amount` - note value in zatoshi
-     * * `ovk` - optional outgoing viewing key ([`OVK_SIZE`] bytes; `None` for a keyless build)
+     * * `ovk` - optional outgoing viewing key ([`OVK_SIZE`] bytes; `None` for a keyless build).
+     *   Has no effect in the normal flow: `sign_ironwood_v6`'s first round re-encrypts every
+     *   action's `out_ciphertext` under the wallet `ovk`, replacing whatever this produced
      * * `anchor` - Ironwood note-commitment-tree root ([`ANCHOR_SIZE`] bytes)
      * * `memo` - ZIP-302 memo field ([`MEMO_SIZE`] bytes)
      * * `unified_address` - optional full Unified Address the output was addressed to; if given,
@@ -168,9 +170,10 @@ export class BitGoPsbt {
      * output.
      *
      * Returns the action index assigned to each output, in the same order as `outputs` — the
-     * orchard builder pads/reorders actions, so a client-managed-`ovk` caller must use these
-     * indices (not the position in `outputs`) when later calling `set_ironwood_out_ciphertext`
-     * for a specific recipient.
+     * orchard builder pads/reorders actions, so a caller correlating per-action data (a stored
+     * Unified Address, an explicit `set_ironwood_out_ciphertext` call) must use these indices, not
+     * the position in `outputs` — though note `sign_ironwood_v6`'s first round already patches
+     * every action's `out_ciphertext` with the wallet `ovk` on its own.
      */
     add_ironwood_outputs(outputs: any, anchor: Uint8Array): Uint32Array;
     /**
@@ -213,6 +216,20 @@ export class BitGoPsbt {
     add_wallet_input_at_index(index: number, txid: string, vout: number, value: bigint, wallet_keys: WasmRootWalletKeys, chain: number, derivation_index: number, signer?: string | null, cosigner?: string | null, sequence?: number | null, prev_tx?: Uint8Array | null): number;
     add_wallet_output(chain: number, index: number, value: bigint, wallet_keys: WasmRootWalletKeys): number;
     add_wallet_output_at_index(index: number, chain: number, derivation_index: number, value: bigint, wallet_keys: WasmRootWalletKeys): number;
+    /**
+     * Asserts the sighash policy required when signing an externally
+     * supplied PSBT: every input must commit to the entire transaction.
+     *
+     * Rejects SIGHASH_NONE, SIGHASH_SINGLE, SIGHASH_ANYONECANPAY, and
+     * combinations thereof — in both the declared per-input sighash type
+     * and the signatures already present in the PSBT — because signatures
+     * produced under those types do not bind the signer to the outputs of
+     * the transaction. Accepted types are SIGHASH_ALL (0x01),
+     * SIGHASH_ALL | SIGHASH_FORKID (0x41) on BCH-family networks, and
+     * SIGHASH_DEFAULT (0x00) / SIGHASH_ALL (0x01) on Taproot inputs; an
+     * absent sighash type uses the signer default.
+     */
+    assert_sighash_all_policy(): void;
     /**
      * Merge all input fields from a raw PSBT (given as bytes) into this PSBT.
      *
@@ -490,6 +507,14 @@ export class BitGoPsbt {
     get_global_xpubs(): any;
     get_input_key_values(index: number): any;
     get_input_kv(index: number, key: any): Uint8Array | undefined;
+    /**
+     * Returns each input's declared sighash type (BIP-174
+     * `PSBT_IN_SIGHASH_TYPE`), in input order.
+     *
+     * Entries are `null` when the input does not declare a sighash type, in
+     * which case the signer's default sighash type applies.
+     */
+    get_input_sighash_types(): any;
     get_inputs(): any;
     get_kv(key: any): Uint8Array | undefined;
     /**
@@ -665,7 +690,8 @@ export class BitGoPsbt {
      *
      * If no transparent signature has been collected yet, this is the first signing round and
      * `xpriv` must be the wallet's user root key: it is used with `root_wallet_keys.bitgo_key()` to
-     * derive this wallet's `ovk` and finalize `out_ciphertext` before computing any sighash (it is
+     * derive this wallet's `ovk` and finalize every action's `out_ciphertext` (multi-recipient
+     * builds included) before computing any sighash (it is
      * sighash-committed). Any other key signing first is rejected, rather than deriving an `ovk`
      * nobody can reproduce. Once a signature exists, the step is skipped and any key may sign — so
      * callers pass `root_wallet_keys` unconditionally on every signing round without needing to know

package/dist/cjs/js/wasm/wasm_utxo.js

@@ -475,7 +475,9 @@ class BitGoPsbt {
      *
      * * `recipient` - raw Orchard/Ironwood address ([`ORCHARD_ADDRESS_SIZE`] bytes)
      * * `amount` - note value in zatoshi
-     * * `ovk` - optional outgoing viewing key ([`OVK_SIZE`] bytes; `None` for a keyless build)
+     * * `ovk` - optional outgoing viewing key ([`OVK_SIZE`] bytes; `None` for a keyless build).
+     *   Has no effect in the normal flow: `sign_ironwood_v6`'s first round re-encrypts every
+     *   action's `out_ciphertext` under the wallet `ovk`, replacing whatever this produced
      * * `anchor` - Ironwood note-commitment-tree root ([`ANCHOR_SIZE`] bytes)
      * * `memo` - ZIP-302 memo field ([`MEMO_SIZE`] bytes)
      * * `unified_address` - optional full Unified Address the output was addressed to; if given,
@@ -527,9 +529,10 @@ class BitGoPsbt {
      * output.
      *
      * Returns the action index assigned to each output, in the same order as `outputs` — the
-     * orchard builder pads/reorders actions, so a client-managed-`ovk` caller must use these
-     * indices (not the position in `outputs`) when later calling `set_ironwood_out_ciphertext`
-     * for a specific recipient.
+     * orchard builder pads/reorders actions, so a caller correlating per-action data (a stored
+     * Unified Address, an explicit `set_ironwood_out_ciphertext` call) must use these indices, not
+     * the position in `outputs` — though note `sign_ironwood_v6`'s first round already patches
+     * every action's `out_ciphertext` with the wallet `ovk` on its own.
      * @param {any} outputs
      * @param {Uint8Array} anchor
      * @returns {Uint32Array}
@@ -915,6 +918,32 @@ class BitGoPsbt {
             wasm.__wbindgen_add_to_stack_pointer(16);
         }
     }
+    /**
+     * Asserts the sighash policy required when signing an externally
+     * supplied PSBT: every input must commit to the entire transaction.
+     *
+     * Rejects SIGHASH_NONE, SIGHASH_SINGLE, SIGHASH_ANYONECANPAY, and
+     * combinations thereof — in both the declared per-input sighash type
+     * and the signatures already present in the PSBT — because signatures
+     * produced under those types do not bind the signer to the outputs of
+     * the transaction. Accepted types are SIGHASH_ALL (0x01),
+     * SIGHASH_ALL | SIGHASH_FORKID (0x41) on BCH-family networks, and
+     * SIGHASH_DEFAULT (0x00) / SIGHASH_ALL (0x01) on Taproot inputs; an
+     * absent sighash type uses the signer default.
+     */
+    assert_sighash_all_policy() {
+        try {
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            wasm.bitgopsbt_assert_sighash_all_policy(retptr, this.__wbg_ptr);
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+            if (r1) {
+                throw takeObject(r0);
+            }
+        } finally {
+            wasm.__wbindgen_add_to_stack_pointer(16);
+        }
+    }
     /**
      * Merge all input fields from a raw PSBT (given as bytes) into this PSBT.
      *
@@ -1736,6 +1765,29 @@ class BitGoPsbt {
             wasm.__wbindgen_add_to_stack_pointer(16);
         }
     }
+    /**
+     * Returns each input's declared sighash type (BIP-174
+     * `PSBT_IN_SIGHASH_TYPE`), in input order.
+     *
+     * Entries are `null` when the input does not declare a sighash type, in
+     * which case the signer's default sighash type applies.
+     * @returns {any}
+     */
+    get_input_sighash_types() {
+        try {
+            const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+            wasm.bitgopsbt_get_input_sighash_types(retptr, this.__wbg_ptr);
+            var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+            var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+            var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+            if (r2) {
+                throw takeObject(r1);
+            }
+            return takeObject(r0);
+        } finally {
+            wasm.__wbindgen_add_to_stack_pointer(16);
+        }
+    }
     /**
      * @returns {any}
      */
@@ -2369,7 +2421,8 @@ class BitGoPsbt {
      *
      * If no transparent signature has been collected yet, this is the first signing round and
      * `xpriv` must be the wallet's user root key: it is used with `root_wallet_keys.bitgo_key()` to
-     * derive this wallet's `ovk` and finalize `out_ciphertext` before computing any sighash (it is
+     * derive this wallet's `ovk` and finalize every action's `out_ciphertext` (multi-recipient
+     * builds included) before computing any sighash (it is
      * sighash-committed). Any other key signing first is rejected, rather than deriving an `ovk`
      * nobody can reproduce. Once a signature exists, the step is skipped and any key may sign — so
      * callers pass `root_wallet_keys` unconditionally on every signing round without needing to know