@btc-vision/cli 1.0.1 → 1.0.2

package/build/commands/CompileCommand.js

@@ -4,7 +4,7 @@ import * as esbuild from 'esbuild';
 import bytenode from 'bytenode';
 import { BaseCommand } from './BaseCommand.js';
 import { getManifestPath, loadManifest } from '../lib/manifest.js';
-import { buildOpnetBinary, computeChecksum, formatFileSize } from '../lib/binary.js';
+import { buildOpnetBinary, formatFileSize } from '../lib/binary.js';
 import { CLIWallet } from '../lib/wallet.js';
 import { canSign, loadCredentials } from '../lib/credentials.js';
 export class CompileCommand extends BaseCommand {
@@ -70,8 +70,8 @@ export class CompileCommand extends BaseCommand {
                 this.logger.info(`Found proto file (${formatFileSize(proto.length)})`);
             }
             let publicKey;
-            let signature;
             let mldsaLevel;
+            let signFn;
             if (options.sign) {
                 this.logger.info('Loading wallet for signing...');
                 const credentials = loadCredentials();
@@ -85,27 +85,25 @@ export class CompileCommand extends BaseCommand {
                 mldsaLevel = wallet.securityLevel;
                 publicKey = wallet.mldsaPublicKey;
                 this.logger.success(`Wallet loaded (MLDSA-${mldsaLevel})`);
-                this.logger.info('Signing plugin...');
-                const metadataBytes = Buffer.from(JSON.stringify(manifest), 'utf-8');
-                const checksum = computeChecksum(metadataBytes, bytecode, proto);
-                signature = wallet.signMLDSA(checksum);
-                this.logger.success(`Plugin signed (${formatFileSize(signature.length)} signature)`);
+                signFn = (checksum) => wallet.signMLDSA(checksum);
             }
             else {
                 this.logger.warn('Skipping signing (--no-sign)');
                 mldsaLevel = 44;
                 publicKey = Buffer.alloc(1312);
-                signature = Buffer.alloc(2420);
             }
             this.logger.info('Assembling .opnet binary...');
-            const binary = buildOpnetBinary({
+            const { binary, checksum } = buildOpnetBinary({
                 mldsaLevel,
                 publicKey,
-                signature,
                 metadata: manifest,
                 bytecode,
                 proto,
+                signFn,
             });
+            if (options.sign) {
+                this.logger.success(`Plugin signed (checksum: sha256:${checksum.toString('hex').substring(0, 16)}...)`);
+            }
             this.logger.success(`Binary assembled (${formatFileSize(binary.length)})`);
             const outputPath = options.output ||
                 path.join(projectDir, 'build', `${manifest.name.replace(/^@/, '').replace(/\//g, '-')}.opnet`);
@@ -121,6 +119,7 @@ export class CompileCommand extends BaseCommand {
             this.logger.log(`Plugin:       ${manifest.name}@${manifest.version}`);
             this.logger.log(`Type:         ${manifest.pluginType}`);
             this.logger.log(`MLDSA Level:  ${mldsaLevel}`);
+            this.logger.log(`Checksum:     sha256:${checksum.toString('hex')}`);
             this.logger.log(`Signed:       ${options.sign ? 'Yes' : 'No'}`);
             this.logger.log('');
             if (!options.sign) {

package/build/commands/InitCommand.js

@@ -112,7 +112,7 @@ export class InitCommand extends BaseCommand {
         const manifest = {
             name: config.pluginName,
             version: '1.0.0',
-            opnetVersion: '^1.0.0',
+            opnetVersion: '>=0.0.1',
             main: 'dist/index.jsc',
             target: 'bytenode',
             type: 'plugin',

package/build/commands/SignCommand.js

@@ -1,7 +1,7 @@
 import * as fs from 'fs';
 import * as crypto from 'crypto';
 import { BaseCommand } from './BaseCommand.js';
-import { buildOpnetBinary, computeChecksum, formatFileSize, parseOpnetBinary, } from '../lib/binary.js';
+import { buildOpnetBinary, formatFileSize, parseOpnetBinary } from '../lib/binary.js';
 import { CLIWallet } from '../lib/wallet.js';
 import { canSign, loadCredentials } from '../lib/credentials.js';
 export class SignCommand extends BaseCommand {
@@ -48,20 +48,17 @@ export class SignCommand extends BaseCommand {
                 this.logger.log('Use --force to re-sign with your key.');
                 process.exit(1);
             }
-            this.logger.info('Signing...');
-            const metadataBytes = Buffer.from(parsed.rawMetadata, 'utf-8');
-            const checksum = computeChecksum(metadataBytes, parsed.bytecode, parsed.proto ?? Buffer.alloc(0));
-            const signature = wallet.signMLDSA(checksum);
-            this.logger.success(`Signed (${formatFileSize(signature.length)} signature)`);
-            this.logger.info('Rebuilding binary...');
-            const newBinary = buildOpnetBinary({
+            this.logger.info('Signing and rebuilding binary...');
+            const signFn = (checksum) => wallet.signMLDSA(checksum);
+            const { binary: newBinary, checksum } = buildOpnetBinary({
                 mldsaLevel: wallet.securityLevel,
                 publicKey: wallet.mldsaPublicKey,
-                signature,
                 metadata: parsed.metadata,
                 bytecode: parsed.bytecode,
                 proto: parsed.proto ?? Buffer.alloc(0),
+                signFn,
             });
+            this.logger.success(`Signed (checksum: sha256:${checksum.toString('hex').substring(0, 16)}...)`);
             this.logger.success(`Binary rebuilt (${formatFileSize(newBinary.length)})`);
             const outputPath = options.output || file;
             fs.writeFileSync(outputPath, newBinary);

package/build/lib/binary.d.ts

@@ -6,11 +6,14 @@ export declare function verifyChecksum(parsed: IParsedPluginFile): boolean;
 export declare function buildOpnetBinary(options: {
     mldsaLevel: CLIMldsaLevel;
     publicKey: Buffer;
-    signature: Buffer;
     metadata: IPluginMetadata;
     bytecode: Buffer;
     proto?: Buffer;
-}): Buffer;
+    signFn?: (checksum: Buffer) => Buffer;
+}): {
+    binary: Buffer;
+    checksum: Buffer;
+};
 export declare function extractMetadata(data: Buffer): IPluginMetadata | null;
 export declare function getParsedMldsaLevel(parsed: IParsedPluginFile): CLIMldsaLevel;
 export declare function formatFileSize(bytes: number): string;

package/build/lib/binary.js

@@ -91,19 +91,24 @@ export function verifyChecksum(parsed) {
     return computed.equals(parsed.checksum);
 }
 export function buildOpnetBinary(options) {
-    const { mldsaLevel, publicKey, signature, metadata, bytecode, proto = Buffer.alloc(0), } = options;
+    const { mldsaLevel, publicKey, metadata, bytecode, proto = Buffer.alloc(0), signFn } = options;
     const sdkLevel = cliLevelToMLDSALevel(mldsaLevel);
     const expectedPkSize = MLDSA_PUBLIC_KEY_SIZES[sdkLevel];
     const expectedSigSize = MLDSA_SIGNATURE_SIZES[sdkLevel];
     if (publicKey.length !== expectedPkSize) {
         throw new Error(`Public key size mismatch: expected ${expectedPkSize}, got ${publicKey.length}`);
     }
+    const tempMetadata = { ...metadata, checksum: '' };
+    const tempMetadataBytes = Buffer.from(JSON.stringify(tempMetadata), 'utf-8');
+    const checksum = computeChecksum(tempMetadataBytes, bytecode, proto);
+    const checksumHex = `sha256:${checksum.toString('hex')}`;
+    const finalMetadata = { ...metadata, checksum: checksumHex };
+    const metadataBytes = Buffer.from(JSON.stringify(finalMetadata), 'utf-8');
+    const finalChecksum = computeChecksum(metadataBytes, bytecode, proto);
+    const signature = signFn ? signFn(finalChecksum) : Buffer.alloc(expectedSigSize);
     if (signature.length !== expectedSigSize) {
         throw new Error(`Signature size mismatch: expected ${expectedSigSize}, got ${signature.length}`);
     }
-    const metadataStr = JSON.stringify(metadata);
-    const metadataBytes = Buffer.from(metadataStr, 'utf-8');
-    const checksum = computeChecksum(metadataBytes, bytecode, proto);
     const totalSize = 8 +
         4 +
         1 +
@@ -140,8 +145,8 @@ export function buildOpnetBinary(options) {
     offset += 4;
     proto.copy(buffer, offset);
     offset += proto.length;
-    checksum.copy(buffer, offset);
-    return buffer;
+    finalChecksum.copy(buffer, offset);
+    return { binary: buffer, checksum: finalChecksum };
 }
 export function extractMetadata(data) {
     try {

package/build/lib/manifest.js

@@ -78,7 +78,7 @@ export function createManifest(options) {
     return {
         name: options.name,
         version: '1.0.0',
-        opnetVersion: '^1.0.0',
+        opnetVersion: '>=0.0.1',
         main: 'dist/index.jsc',
         target: 'bytenode',
         type: 'plugin',

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@btc-vision/cli",
-    "version": "1.0.1",
+    "version": "1.0.2",
     "type": "module",
     "description": "CLI for the OPNet plugin ecosystem - scaffolding, compilation, signing, and registry interaction",
     "author": "OP_NET",

package/src/commands/CompileCommand.ts

@@ -10,7 +10,7 @@ import * as esbuild from 'esbuild';
 import bytenode from 'bytenode';
 import { BaseCommand } from './BaseCommand.js';
 import { getManifestPath, loadManifest } from '../lib/manifest.js';
-import { buildOpnetBinary, computeChecksum, formatFileSize } from '../lib/binary.js';
+import { buildOpnetBinary, formatFileSize } from '../lib/binary.js';
 import { CLIWallet } from '../lib/wallet.js';
 import { canSign, loadCredentials } from '../lib/credentials.js';
 import { CLIMldsaLevel } from '../types/index.js';
@@ -105,8 +105,8 @@ export class CompileCommand extends BaseCommand {
 
             // Prepare signing
             let publicKey: Buffer;
-            let signature: Buffer;
             let mldsaLevel: CLIMldsaLevel;
+            let signFn: ((checksum: Buffer) => Buffer) | undefined;
 
             if (options.sign) {
                 this.logger.info('Loading wallet for signing...');
@@ -125,33 +125,31 @@ export class CompileCommand extends BaseCommand {
 
                 this.logger.success(`Wallet loaded (MLDSA-${mldsaLevel})`);
 
-                // Compute checksum and sign
-                this.logger.info('Signing plugin...');
-                const metadataBytes = Buffer.from(JSON.stringify(manifest), 'utf-8');
-                const checksum = computeChecksum(metadataBytes, bytecode, proto);
-
-                signature = wallet.signMLDSA(checksum);
-                this.logger.success(
-                    `Plugin signed (${formatFileSize(signature.length)} signature)`,
-                );
+                // Create signing function that will be called with the final checksum
+                signFn = (checksum: Buffer) => wallet.signMLDSA(checksum);
             } else {
                 this.logger.warn('Skipping signing (--no-sign)');
                 // Use dummy values for unsigned binary
                 mldsaLevel = 44;
                 publicKey = Buffer.alloc(1312); // MLDSA-44 public key size
-                signature = Buffer.alloc(2420); // MLDSA-44 signature size
             }
 
             // Build .opnet binary
             this.logger.info('Assembling .opnet binary...');
-            const binary = buildOpnetBinary({
+            const { binary, checksum } = buildOpnetBinary({
                 mldsaLevel,
                 publicKey,
-                signature,
                 metadata: manifest,
                 bytecode,
                 proto,
+                signFn,
             });
+
+            if (options.sign) {
+                this.logger.success(
+                    `Plugin signed (checksum: sha256:${checksum.toString('hex').substring(0, 16)}...)`,
+                );
+            }
             this.logger.success(`Binary assembled (${formatFileSize(binary.length)})`);
 
             // Write output
@@ -178,6 +176,7 @@ export class CompileCommand extends BaseCommand {
             this.logger.log(`Plugin:       ${manifest.name}@${manifest.version}`);
             this.logger.log(`Type:         ${manifest.pluginType}`);
             this.logger.log(`MLDSA Level:  ${mldsaLevel}`);
+            this.logger.log(`Checksum:     sha256:${checksum.toString('hex')}`);
             this.logger.log(`Signed:       ${options.sign ? 'Yes' : 'No'}`);
             this.logger.log('');
 

package/src/commands/InitCommand.ts

@@ -185,7 +185,7 @@ export class InitCommand extends BaseCommand {
         const manifest: Record<string, unknown> = {
             name: config.pluginName,
             version: '1.0.0',
-            opnetVersion: '^1.0.0',
+            opnetVersion: '>=0.0.1',
             main: 'dist/index.jsc',
             target: 'bytenode',
             type: 'plugin',

package/src/commands/SignCommand.ts

@@ -7,12 +7,7 @@
 import * as fs from 'fs';
 import * as crypto from 'crypto';
 import { BaseCommand } from './BaseCommand.js';
-import {
-    buildOpnetBinary,
-    computeChecksum,
-    formatFileSize,
-    parseOpnetBinary,
-} from '../lib/binary.js';
+import { buildOpnetBinary, formatFileSize, parseOpnetBinary } from '../lib/binary.js';
 import { CLIWallet } from '../lib/wallet.js';
 import { canSign, loadCredentials } from '../lib/credentials.js';
 
@@ -77,27 +72,20 @@ export class SignCommand extends BaseCommand {
                 process.exit(1);
             }
 
-            // Compute new signature
-            this.logger.info('Signing...');
-            const metadataBytes = Buffer.from(parsed.rawMetadata, 'utf-8');
-            const checksum = computeChecksum(
-                metadataBytes,
-                parsed.bytecode,
-                parsed.proto ?? Buffer.alloc(0),
-            );
-            const signature = wallet.signMLDSA(checksum);
-            this.logger.success(`Signed (${formatFileSize(signature.length)} signature)`);
-
-            // Rebuild binary
-            this.logger.info('Rebuilding binary...');
-            const newBinary = buildOpnetBinary({
+            // Rebuild binary with signing
+            this.logger.info('Signing and rebuilding binary...');
+            const signFn = (checksum: Buffer) => wallet.signMLDSA(checksum);
+            const { binary: newBinary, checksum } = buildOpnetBinary({
                 mldsaLevel: wallet.securityLevel,
                 publicKey: wallet.mldsaPublicKey,
-                signature,
                 metadata: parsed.metadata,
                 bytecode: parsed.bytecode,
                 proto: parsed.proto ?? Buffer.alloc(0),
+                signFn,
             });
+            this.logger.success(
+                `Signed (checksum: sha256:${checksum.toString('hex').substring(0, 16)}...)`,
+            );
             this.logger.success(`Binary rebuilt (${formatFileSize(newBinary.length)})`);
 
             // Write output

package/src/lib/binary.ts

@@ -184,28 +184,21 @@ export function verifyChecksum(parsed: IParsedPluginFile): boolean {
  * Build a .opnet binary file
  *
  * @param options - Build options
- * @returns The assembled binary
+ * @returns The assembled binary and the checksum that was signed
  */
 export function buildOpnetBinary(options: {
     mldsaLevel: CLIMldsaLevel;
     publicKey: Buffer;
-    signature: Buffer;
     metadata: IPluginMetadata;
     bytecode: Buffer;
     proto?: Buffer;
-}): Buffer {
-    const {
-        mldsaLevel,
-        publicKey,
-        signature,
-        metadata,
-        bytecode,
-        proto = Buffer.alloc(0),
-    } = options;
+    signFn?: (checksum: Buffer) => Buffer;
+}): { binary: Buffer; checksum: Buffer } {
+    const { mldsaLevel, publicKey, metadata, bytecode, proto = Buffer.alloc(0), signFn } = options;
 
     const sdkLevel = cliLevelToMLDSALevel(mldsaLevel);
 
-    // Validate sizes
+    // Validate public key size
     const expectedPkSize = MLDSA_PUBLIC_KEY_SIZES[sdkLevel];
     const expectedSigSize = MLDSA_SIGNATURE_SIZES[sdkLevel];
 
@@ -215,19 +208,28 @@ export function buildOpnetBinary(options: {
         );
     }
 
+    // First pass: compute checksum without the checksum field set
+    const tempMetadata = { ...metadata, checksum: '' };
+    const tempMetadataBytes = Buffer.from(JSON.stringify(tempMetadata), 'utf-8');
+    const checksum = computeChecksum(tempMetadataBytes, bytecode, proto);
+    const checksumHex = `sha256:${checksum.toString('hex')}`;
+
+    // Second pass: serialize metadata with checksum included
+    const finalMetadata = { ...metadata, checksum: checksumHex };
+    const metadataBytes = Buffer.from(JSON.stringify(finalMetadata), 'utf-8');
+
+    // Recompute checksum with the final metadata (includes checksum field)
+    const finalChecksum = computeChecksum(metadataBytes, bytecode, proto);
+
+    // Sign the final checksum (this is what gets verified)
+    const signature = signFn ? signFn(finalChecksum) : Buffer.alloc(expectedSigSize);
+
     if (signature.length !== expectedSigSize) {
         throw new Error(
             `Signature size mismatch: expected ${expectedSigSize}, got ${signature.length}`,
         );
     }
 
-    // Serialize metadata
-    const metadataStr = JSON.stringify(metadata);
-    const metadataBytes = Buffer.from(metadataStr, 'utf-8');
-
-    // Compute checksum
-    const checksum = computeChecksum(metadataBytes, bytecode, proto);
-
     // Calculate total size
     const totalSize =
         8 + // magic
@@ -291,10 +293,10 @@ export function buildOpnetBinary(options: {
     proto.copy(buffer, offset);
     offset += proto.length;
 
-    // Checksum
-    checksum.copy(buffer, offset);
+    // Checksum (use finalChecksum which was computed with metadata containing checksum hex)
+    finalChecksum.copy(buffer, offset);
 
-    return buffer;
+    return { binary: buffer, checksum: finalChecksum };
 }
 
 /**

package/src/lib/manifest.ts

@@ -167,7 +167,7 @@ export function createManifest(options: {
     return {
         name: options.name,
         version: '1.0.0',
-        opnetVersion: '^1.0.0',
+        opnetVersion: '>=0.0.1',
         main: 'dist/index.jsc',
         target: 'bytenode',
         type: 'plugin',