@dynamic-labs-wallet/core 1.1.25 → 1.1.27

package/index.cjs

@@ -593,6 +593,57 @@ function getEnvironmentFromUrl(url) {
     return ENVIRONMENT_ENUM.production;
 }
 
+// secp256k1 group order n; ECDSA and BIP340 private keys must be in [1, n).
+const SECP256K1_ORDER = BigInt('0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141');
+const PRIVATE_KEY_HEX_LENGTH = 64;
+// A malformed key fails every ceremony attempt identically, so flag it
+// non-retryable for callers wrapped in retryPromise (browser client).
+const invalidPrivateKeyError = (message)=>{
+    const error = new Error(message);
+    error.isRetryable = false;
+    return error;
+};
+/**
+ * Validates a private key for `importPrivateKey` before any API call or MPC
+ * ceremony starts, and returns it normalized for the MPC importer (surrounding
+ * whitespace trimmed, optional `0x` prefix stripped).
+ *
+ * Every chain expects a 32-byte hex key at this layer — chain-specific input
+ * formats (WIF, base58, bech32, Stellar seed) are converted to hex by the chain
+ * clients beforehand. For secp256k1 chains (ECDSA, BIP340) the key is also
+ * range-checked against the curve order.
+ *
+ * Error messages report only the key's length and character class — never the
+ * key material itself.
+ */ const normalizeAndValidatePrivateKey = ({ privateKey, chainName, bitcoinConfig })=>{
+    const chainLabel = chainName ? ` for chain ${chainName}` : '';
+    if (typeof privateKey !== 'string') {
+        throw invalidPrivateKeyError(`Invalid private key${chainLabel}: expected a hex string, got ${typeof privateKey}`);
+    }
+    let normalized = privateKey.trim();
+    if (normalized.startsWith('0x') || normalized.startsWith('0X')) {
+        normalized = normalized.slice(2);
+    }
+    if (normalized.length !== PRIVATE_KEY_HEX_LENGTH) {
+        throw invalidPrivateKeyError(`Invalid private key${chainLabel}: expected ${PRIVATE_KEY_HEX_LENGTH} hex characters ` + `(32 bytes), got ${normalized.length}`);
+    }
+    if (!/^[0-9a-fA-F]+$/.test(normalized)) {
+        throw invalidPrivateKeyError(`Invalid private key${chainLabel}: expected ${PRIVATE_KEY_HEX_LENGTH} hex characters ` + `(32 bytes), got non-hex characters`);
+    }
+    const { signingAlgorithm } = getMPCChainConfig(chainName, bitcoinConfig);
+    const isSecp256k1Chain = signingAlgorithm === primitives.SigningAlgorithm.ECDSA || signingAlgorithm === primitives.SigningAlgorithm.BIP340;
+    if (isSecp256k1Chain) {
+        const keyValue = BigInt(`0x${normalized}`);
+        if (keyValue === 0n) {
+            throw invalidPrivateKeyError(`Invalid private key${chainLabel}: key cannot be zero`);
+        }
+        if (keyValue >= SECP256K1_ORDER) {
+            throw invalidPrivateKeyError(`Invalid private key${chainLabel}: key exceeds the secp256k1 curve order`);
+        }
+    }
+    return normalized;
+};
+
 function _extends() {
     _extends = Object.assign || function assign(target) {
         for(var i = 1; i < arguments.length; i++){
@@ -1228,7 +1279,7 @@ const getRequiredExternalKeyShareId = (ks)=>{
  * before it is posted and surfaces in Datadog exactly as the recovery path does.
  */ const assertDynamicLocationsHaveExternalKeyShareId = (locations)=>locations.filter((location)=>location.location === BackupLocation.DYNAMIC).forEach((location)=>getRequiredExternalKeyShareId(location));
 
-var version = "1.1.25";
+var version = "1.1.27";
 
 /**
  * Reads the Authorization header off an axios request config, which stores
@@ -3003,6 +3054,7 @@ exports.invokeCeremonyComplete = invokeCeremonyComplete;
 exports.isBusinessAccountActionRequired = isBusinessAccountActionRequired;
 exports.isEvmCompatibleChain = isEvmCompatibleChain;
 exports.isRecoveredForwardMpcConnectionChurn = isRecoveredForwardMpcConnectionChurn;
+exports.normalizeAndValidatePrivateKey = normalizeAndValidatePrivateKey;
 exports.parseNamespacedVersion = parseNamespacedVersion;
 exports.prepareRawMessageSigningPayload = prepareRawMessageSigningPayload;
 exports.sanitizeBusinessAccountSignedIntent = sanitizeBusinessAccountSignedIntent;

package/index.esm.js

@@ -594,6 +594,57 @@ function getEnvironmentFromUrl(url) {
     return ENVIRONMENT_ENUM.production;
 }
 
+// secp256k1 group order n; ECDSA and BIP340 private keys must be in [1, n).
+const SECP256K1_ORDER = BigInt('0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141');
+const PRIVATE_KEY_HEX_LENGTH = 64;
+// A malformed key fails every ceremony attempt identically, so flag it
+// non-retryable for callers wrapped in retryPromise (browser client).
+const invalidPrivateKeyError = (message)=>{
+    const error = new Error(message);
+    error.isRetryable = false;
+    return error;
+};
+/**
+ * Validates a private key for `importPrivateKey` before any API call or MPC
+ * ceremony starts, and returns it normalized for the MPC importer (surrounding
+ * whitespace trimmed, optional `0x` prefix stripped).
+ *
+ * Every chain expects a 32-byte hex key at this layer — chain-specific input
+ * formats (WIF, base58, bech32, Stellar seed) are converted to hex by the chain
+ * clients beforehand. For secp256k1 chains (ECDSA, BIP340) the key is also
+ * range-checked against the curve order.
+ *
+ * Error messages report only the key's length and character class — never the
+ * key material itself.
+ */ const normalizeAndValidatePrivateKey = ({ privateKey, chainName, bitcoinConfig })=>{
+    const chainLabel = chainName ? ` for chain ${chainName}` : '';
+    if (typeof privateKey !== 'string') {
+        throw invalidPrivateKeyError(`Invalid private key${chainLabel}: expected a hex string, got ${typeof privateKey}`);
+    }
+    let normalized = privateKey.trim();
+    if (normalized.startsWith('0x') || normalized.startsWith('0X')) {
+        normalized = normalized.slice(2);
+    }
+    if (normalized.length !== PRIVATE_KEY_HEX_LENGTH) {
+        throw invalidPrivateKeyError(`Invalid private key${chainLabel}: expected ${PRIVATE_KEY_HEX_LENGTH} hex characters ` + `(32 bytes), got ${normalized.length}`);
+    }
+    if (!/^[0-9a-fA-F]+$/.test(normalized)) {
+        throw invalidPrivateKeyError(`Invalid private key${chainLabel}: expected ${PRIVATE_KEY_HEX_LENGTH} hex characters ` + `(32 bytes), got non-hex characters`);
+    }
+    const { signingAlgorithm } = getMPCChainConfig(chainName, bitcoinConfig);
+    const isSecp256k1Chain = signingAlgorithm === SigningAlgorithm.ECDSA || signingAlgorithm === SigningAlgorithm.BIP340;
+    if (isSecp256k1Chain) {
+        const keyValue = BigInt(`0x${normalized}`);
+        if (keyValue === 0n) {
+            throw invalidPrivateKeyError(`Invalid private key${chainLabel}: key cannot be zero`);
+        }
+        if (keyValue >= SECP256K1_ORDER) {
+            throw invalidPrivateKeyError(`Invalid private key${chainLabel}: key exceeds the secp256k1 curve order`);
+        }
+    }
+    return normalized;
+};
+
 function _extends() {
     _extends = Object.assign || function assign(target) {
         for(var i = 1; i < arguments.length; i++){
@@ -1229,7 +1280,7 @@ const getRequiredExternalKeyShareId = (ks)=>{
  * before it is posted and surfaces in Datadog exactly as the recovery path does.
  */ const assertDynamicLocationsHaveExternalKeyShareId = (locations)=>locations.filter((location)=>location.location === BackupLocation.DYNAMIC).forEach((location)=>getRequiredExternalKeyShareId(location));
 
-var version = "1.1.25";
+var version = "1.1.27";
 
 /**
  * Reads the Authorization header off an axios request config, which stores
@@ -2879,4 +2930,4 @@ const handleAxiosError = (error, message, context, /**
     throw new WalletApiError(status, resolvedMessage, extractServerErrorCode(error));
 };
 
-export { AuthMode, BITCOIN_ADDRESS_TYPE_CONFIG, BITCOIN_DERIVATION_PATHS, BROWSER_SDK_ROUTE_PREFIX, BackupLocation, BitcoinAddressType, BitcoinNetwork, BusinessAccountClient, BusinessAccountMemberRole, BusinessAccountSignerType, CreateRoomPartiesOptions, DEFAULT_ED25519_VARIANT, DELEGATED_SHARE_COUNT, DYNAMIC_AUTH_BASE_API_URL_MAP, DYNAMIC_AUTH_DEV_BASE_API_URL, DYNAMIC_AUTH_PREPROD_BASE_API_URL, DYNAMIC_AUTH_PROD_BASE_API_URL, DYNAMIC_CLIENT_RELAY_REDCOAST_API_KEY_MAP, DYNAMIC_CLIENT_RELAY_REDCOAST_APP_ID_MAP, DYNAMIC_FORWARD_MPC_DEV_ENCLAVE_URL, DYNAMIC_FORWARD_MPC_ENCLAVE_ATTESTATION_CONFIG_MAP, DYNAMIC_FORWARD_MPC_ENCLAVE_URL_MAP, DYNAMIC_FORWARD_MPC_PREPROD_ENCLAVE_URL, DYNAMIC_FORWARD_MPC_PROD_ENCLAVE_URL, DYNAMIC_KEYSHARES_RELAY_MAP, DYNAMIC_KEYSHARES_RELAY_PREPROD_BASE_API_URL, DYNAMIC_KEYSHARES_RELAY_PROD_BASE_API_URL, DynamicApiClient, DynamicClientSessionSignature, DynamicElevatedAccessTokenHeader, DynamicForwardMPCHeader, DynamicMfaTokenHeader, DynamicRequestIdHeader, DynamicSessionPublicKeyHeader, DynamicTraceElapsedTimeHeader, DynamicTraceIdHeader, ENCRYPTED_SHARES_STORAGE_SUFFIX, ENVIRONMENT_ENUM, EVM_COMPATIBLE_CHAINS, FEATURE_FLAGS, IFRAME_DOMAIN_MAP, Logger, MIDNIGHT_DERIVATION_PATHS, MPC_CHAIN_CONFIG, MPC_CONFIG, MPC_RELAY_DEV_API_URL, MPC_RELAY_PREPROD_API_URL, MPC_RELAY_PROD_API_URL, MPC_RELAY_URL_MAP, NETWORK_ERROR_CODE, NETWORK_ERROR_STATUS, NoopLogger, PREPROD_RELAY_API_KEY, PREPROD_RELAY_APP_ID, PROD_RELAY_API_KEY, PROD_RELAY_APP_ID, RELAY_API_KEY_HEADER, RELAY_APP_ID_HEADER, SDK_NAMESPACE, SERVER_SDK_ROUTE_PREFIX, SOLANA_RPC_URL, SigningConsentRequiredError, SuccessEventType, ThresholdSignatureScheme, URL_PATTERNS, WalletApiError, WalletOperation, WalletReadyState, assertDynamicLocationsHaveExternalKeyShareId, buildForwardMpcEnclaveUrl, chain, chainEnumToVerifiedCredentialName, createRejectablePromise, createSigningIntent, extractServerErrorCode, formatNamespacedVersion, formatRawMessageForSigning, getBitcoinChainConfig, getClientThreshold, getDynamicServerThreshold, getEnvironmentFromUrl, getMPCChainConfig, getRequiredExternalKeyShareId, getReshareConfig, getServerWalletReshareConfig, getTSSConfig, getVersionNamespace, getVersionWithoutNamespace, handleAxiosError, invokeCeremonyComplete, isBusinessAccountActionRequired, isEvmCompatibleChain, isRecoveredForwardMpcConnectionChurn, parseNamespacedVersion, prepareRawMessageSigningPayload, sanitizeBusinessAccountSignedIntent, serializeError, serializeMessageForForwardMPC, verifiedCredentialNameToChainEnum };
+export { AuthMode, BITCOIN_ADDRESS_TYPE_CONFIG, BITCOIN_DERIVATION_PATHS, BROWSER_SDK_ROUTE_PREFIX, BackupLocation, BitcoinAddressType, BitcoinNetwork, BusinessAccountClient, BusinessAccountMemberRole, BusinessAccountSignerType, CreateRoomPartiesOptions, DEFAULT_ED25519_VARIANT, DELEGATED_SHARE_COUNT, DYNAMIC_AUTH_BASE_API_URL_MAP, DYNAMIC_AUTH_DEV_BASE_API_URL, DYNAMIC_AUTH_PREPROD_BASE_API_URL, DYNAMIC_AUTH_PROD_BASE_API_URL, DYNAMIC_CLIENT_RELAY_REDCOAST_API_KEY_MAP, DYNAMIC_CLIENT_RELAY_REDCOAST_APP_ID_MAP, DYNAMIC_FORWARD_MPC_DEV_ENCLAVE_URL, DYNAMIC_FORWARD_MPC_ENCLAVE_ATTESTATION_CONFIG_MAP, DYNAMIC_FORWARD_MPC_ENCLAVE_URL_MAP, DYNAMIC_FORWARD_MPC_PREPROD_ENCLAVE_URL, DYNAMIC_FORWARD_MPC_PROD_ENCLAVE_URL, DYNAMIC_KEYSHARES_RELAY_MAP, DYNAMIC_KEYSHARES_RELAY_PREPROD_BASE_API_URL, DYNAMIC_KEYSHARES_RELAY_PROD_BASE_API_URL, DynamicApiClient, DynamicClientSessionSignature, DynamicElevatedAccessTokenHeader, DynamicForwardMPCHeader, DynamicMfaTokenHeader, DynamicRequestIdHeader, DynamicSessionPublicKeyHeader, DynamicTraceElapsedTimeHeader, DynamicTraceIdHeader, ENCRYPTED_SHARES_STORAGE_SUFFIX, ENVIRONMENT_ENUM, EVM_COMPATIBLE_CHAINS, FEATURE_FLAGS, IFRAME_DOMAIN_MAP, Logger, MIDNIGHT_DERIVATION_PATHS, MPC_CHAIN_CONFIG, MPC_CONFIG, MPC_RELAY_DEV_API_URL, MPC_RELAY_PREPROD_API_URL, MPC_RELAY_PROD_API_URL, MPC_RELAY_URL_MAP, NETWORK_ERROR_CODE, NETWORK_ERROR_STATUS, NoopLogger, PREPROD_RELAY_API_KEY, PREPROD_RELAY_APP_ID, PROD_RELAY_API_KEY, PROD_RELAY_APP_ID, RELAY_API_KEY_HEADER, RELAY_APP_ID_HEADER, SDK_NAMESPACE, SERVER_SDK_ROUTE_PREFIX, SOLANA_RPC_URL, SigningConsentRequiredError, SuccessEventType, ThresholdSignatureScheme, URL_PATTERNS, WalletApiError, WalletOperation, WalletReadyState, assertDynamicLocationsHaveExternalKeyShareId, buildForwardMpcEnclaveUrl, chain, chainEnumToVerifiedCredentialName, createRejectablePromise, createSigningIntent, extractServerErrorCode, formatNamespacedVersion, formatRawMessageForSigning, getBitcoinChainConfig, getClientThreshold, getDynamicServerThreshold, getEnvironmentFromUrl, getMPCChainConfig, getRequiredExternalKeyShareId, getReshareConfig, getServerWalletReshareConfig, getTSSConfig, getVersionNamespace, getVersionWithoutNamespace, handleAxiosError, invokeCeremonyComplete, isBusinessAccountActionRequired, isEvmCompatibleChain, isRecoveredForwardMpcConnectionChurn, normalizeAndValidatePrivateKey, parseNamespacedVersion, prepareRawMessageSigningPayload, sanitizeBusinessAccountSignedIntent, serializeError, serializeMessageForForwardMPC, verifiedCredentialNameToChainEnum };

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@dynamic-labs-wallet/core",
-  "version": "1.1.25",
+  "version": "1.1.27",
   "license": "MIT",
   "type": "module",
   "dependencies": {
     "@dynamic-labs/sdk-api-core": "0.50.0",
-    "@dynamic-labs-wallet/primitives": "1.1.25",
+    "@dynamic-labs-wallet/primitives": "1.1.27",
     "axios": "1.20.0",
     "uuid": "11.1.0"
   },

package/src/mpc/index.d.ts

@@ -1,3 +1,4 @@
 export * from './constants.js';
 export * from './utils.js';
+export * from './privateKey.js';
 //# sourceMappingURL=index.d.ts.map

package/src/mpc/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mpc/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mpc/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC"}

package/src/mpc/privateKey.d.ts

@@ -0,0 +1,20 @@
+import type { BitcoinConfig } from '../types.js';
+/**
+ * Validates a private key for `importPrivateKey` before any API call or MPC
+ * ceremony starts, and returns it normalized for the MPC importer (surrounding
+ * whitespace trimmed, optional `0x` prefix stripped).
+ *
+ * Every chain expects a 32-byte hex key at this layer — chain-specific input
+ * formats (WIF, base58, bech32, Stellar seed) are converted to hex by the chain
+ * clients beforehand. For secp256k1 chains (ECDSA, BIP340) the key is also
+ * range-checked against the curve order.
+ *
+ * Error messages report only the key's length and character class — never the
+ * key material itself.
+ */
+export declare const normalizeAndValidatePrivateKey: ({ privateKey, chainName, bitcoinConfig, }: {
+    privateKey: string;
+    chainName: string;
+    bitcoinConfig?: BitcoinConfig;
+}) => string;
+//# sourceMappingURL=privateKey.d.ts.map

package/src/mpc/privateKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"privateKey.d.ts","sourceRoot":"","sources":["../../src/mpc/privateKey.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAgBjD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,8BAA8B,8CAIxC;IACD,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B,KAAG,MAwCH,CAAC"}