@dynamic-labs-wallet/forward-mpc-shared 0.6.0 → 0.7.1

package/dist/index.cjs

@@ -3,7 +3,7 @@
 var fpTs = require('fp-ts');
 var ioTs = require('io-ts');
 var utils_js = require('@noble/hashes/utils.js');
-var core = require('@dynamic-labs-wallet/core');
+var primitives = require('@dynamic-labs-wallet/primitives');
 var mlKem_js = require('@noble/post-quantum/ml-kem.js');
 var hkdf_js = require('@noble/hashes/hkdf.js');
 var sha2_js = require('@noble/hashes/sha2.js');
@@ -100,6 +100,57 @@ var OptionalStringCodec = ioTs.union([
   ioTs.string,
   ioTs.undefined
 ]);
+function BoundedIntCodec(name, min, max) {
+  return new ioTs.Type(name, (u) => typeof u === "number" && Number.isInteger(u) && u >= min && u <= max, (u, c) => {
+    if (typeof u !== "number") {
+      return ioTs.failure(u, c, `${name}: expected a number`);
+    }
+    if (!Number.isInteger(u)) {
+      return ioTs.failure(u, c, `${name}: expected an integer`);
+    }
+    if (u < min || u > max) {
+      return ioTs.failure(u, c, `${name}: value ${u} out of range [${min}, ${max}]`);
+    }
+    return ioTs.success(u);
+  }, (a) => a);
+}
+__name(BoundedIntCodec, "BoundedIntCodec");
+var DomainCodec = new ioTs.Type("DomainCodec", (u) => typeof u === "string", (u, c) => {
+  if (typeof u !== "string") {
+    return ioTs.failure(u, c, "Value must be a string");
+  }
+  const domainPattern = /^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*(?::\d{1,5})?$/;
+  if (!domainPattern.test(u)) {
+    return ioTs.failure(u, c, "Invalid domain format");
+  }
+  return ioTs.success(u);
+}, ioTs.identity);
+
+// src/codecs/RelayDomainCodec.ts
+var BLOCKED_PATTERNS = [
+  /^localhost(:\d+)?$/i,
+  /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}(:\d+)?$/,
+  /^0\.0\.0\.0(:\d+)?$/,
+  /^10\.\d{1,3}\.\d{1,3}\.\d{1,3}(:\d+)?$/,
+  /^172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}(:\d+)?$/,
+  /^192\.168\.\d{1,3}\.\d{1,3}(:\d+)?$/,
+  /^169\.254\.\d{1,3}\.\d{1,3}(:\d+)?$/,
+  /^\[::1\](:\d+)?$/,
+  /^\[fd[0-9a-f]{2}:/i,
+  /^\[fe80:/i,
+  /^instance-data\.ec2\.internal(:\d+)?$/i
+];
+var RelayDomainCodec = new ioTs.Type("RelayDomainCodec", (u) => typeof u === "string", (u, c) => {
+  const base = DomainCodec.decode(u);
+  if (base._tag === "Left") return base;
+  const domain = base.right;
+  for (const pattern of BLOCKED_PATTERNS) {
+    if (pattern.test(domain)) {
+      return ioTs.failure(u, c, "Relay domain must not be a private, loopback, or link-local address");
+    }
+  }
+  return ioTs.success(domain);
+}, ioTs.identity);
 function buildMessageSchema(messageType, version, additionalFields = {}, ...additionalSchemas) {
   const schema = ioTs.type({
     type: ioTs.literal(messageType),
@@ -378,9 +429,9 @@ function createKeygenResultFromSecretShare(algorithmName, secretShare) {
 }
 __name(createKeygenResultFromSecretShare, "createKeygenResultFromSecretShare");
 var ALGORITHMS = {
-  [core.SigningAlgorithm.ECDSA]: {
+  [primitives.SigningAlgorithm.ECDSA]: {
     name: "ecdsa",
-    dynamicEnum: core.SigningAlgorithm.ECDSA,
+    dynamicEnum: primitives.SigningAlgorithm.ECDSA,
     className: "Ecdsa",
     requiresHashAlgo: true,
     supportsDerivationPath: true,
@@ -391,18 +442,18 @@ var ALGORITHMS = {
       "keccak256"
     ]
   },
-  [core.SigningAlgorithm.ED25519]: {
+  [primitives.SigningAlgorithm.ED25519]: {
     name: "ed25519",
-    dynamicEnum: core.SigningAlgorithm.ED25519,
+    dynamicEnum: primitives.SigningAlgorithm.ED25519,
     className: "Ed25519",
     requiresHashAlgo: false,
     supportsDerivationPath: true,
     supportsTweak: false,
     supportedHashAlgos: []
   },
-  [core.SigningAlgorithm.BIP340]: {
+  [primitives.SigningAlgorithm.BIP340]: {
     name: "bip340",
-    dynamicEnum: core.SigningAlgorithm.BIP340,
+    dynamicEnum: primitives.SigningAlgorithm.BIP340,
     className: "BIP340",
     requiresHashAlgo: false,
     supportsDerivationPath: true,
@@ -437,16 +488,6 @@ var WebSocketCloseCode = {
   /** Abnormal closure — no close frame (network drop, etc.). */
   ABNORMAL: 1006
 };
-var DomainCodec = new ioTs.Type("DomainCodec", (u) => typeof u === "string", (u, c) => {
-  if (typeof u !== "string") {
-    return ioTs.failure(u, c, "Value must be a string");
-  }
-  const domainPattern = /^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*(?::\d{1,5})?$/;
-  if (!domainPattern.test(u)) {
-    return ioTs.failure(u, c, "Invalid domain format");
-  }
-  return ioTs.success(u);
-}, ioTs.identity);
 var Uint8ArrayOrHexCodec = new ioTs.Type(
   "Uint8ArrayOrHex",
   (u) => u instanceof Uint8Array,
@@ -479,7 +520,7 @@ var Uint8ArrayOrHexCodec = new ioTs.Type(
 
 // src/messages/SignMessageV1Request.ts
 var SignMessageRequestSchema = buildMessageSchema("signMessage", 1, {
-  relayDomain: DomainCodec,
+  relayDomain: RelayDomainCodec,
   keyshare: EncryptedPayloadCodec,
   message: Uint8ArrayOrHexCodec,
   roomUuid: ioTs.string,
@@ -567,11 +608,14 @@ var ConnectionAckV1ResponseMessage = createSimpleMessage({
   version: 1,
   schema: ConnectionAckResponseSchema
 });
+var MAX_KEYGEN_PARTIES = 10;
+var NumPartiesCodec = BoundedIntCodec("numParties", 2, MAX_KEYGEN_PARTIES);
+var ThresholdCodec = BoundedIntCodec("threshold", 1, MAX_KEYGEN_PARTIES);
 var BaseKeygenParamsCodec = ioTs.type({
-  relayDomain: DomainCodec,
+  relayDomain: RelayDomainCodec,
   roomUuid: ioTs.string,
-  numParties: ioTs.number,
-  threshold: ioTs.number,
+  numParties: NumPartiesCodec,
+  threshold: ThresholdCodec,
   keygenInit: EncryptedPayloadCodec,
   keygenIds: ioTs.array(ioTs.string),
   userId: OptionalStringCodec,
@@ -591,10 +635,10 @@ var KeygenAlgoParamsCodec = ioTs.union([
   BIP340KeygenParamsCodec
 ]);
 var KeygenRequestSchema = buildMessageSchema("keygen", 1, {
-  relayDomain: DomainCodec,
+  relayDomain: RelayDomainCodec,
   roomUuid: ioTs.string,
-  numParties: ioTs.number,
-  threshold: ioTs.number,
+  numParties: NumPartiesCodec,
+  threshold: ThresholdCodec,
   keygenInit: EncryptedPayloadCodec,
   keygenIds: ioTs.array(ioTs.string),
   userId: OptionalStringCodec,
@@ -644,12 +688,14 @@ var KeygenV1ResponseMessage = createStandardMessage({
     error: decoded.error
   }))
 });
+var NumPartiesCodec2 = BoundedIntCodec("numParties", 2, MAX_KEYGEN_PARTIES);
+var ThresholdCodec2 = BoundedIntCodec("threshold", 1, MAX_KEYGEN_PARTIES);
 var ReceiveKeyRequestSchema = buildMessageSchema("receiveKey", 1, {
-  relayDomain: DomainCodec,
+  relayDomain: RelayDomainCodec,
   signingAlgo: ioTs.literal("ed25519"),
   roomUuid: ioTs.string,
-  numParties: ioTs.number,
-  threshold: ioTs.number,
+  numParties: NumPartiesCodec2,
+  threshold: ThresholdCodec2,
   keygenInit: EncryptedPayloadCodec,
   keygenIds: ioTs.array(ioTs.string),
   userId: OptionalStringCodec,
@@ -1032,6 +1078,7 @@ exports.ALL_SIGNING_ALGORITHM_SCHEMA = ALL_SIGNING_ALGORITHM_SCHEMA;
 exports.BIP340SigningAlgorithm = BIP340SigningAlgorithm;
 exports.BaseMessage = BaseMessage;
 exports.BaseSigningAlgorithm = BaseSigningAlgorithm;
+exports.BoundedIntCodec = BoundedIntCodec;
 exports.ConnectionAckRequestSchema = ConnectionAckRequestSchema;
 exports.ConnectionAckResponseSchema = ConnectionAckResponseSchema;
 exports.ConnectionAckV1RequestMessage = ConnectionAckV1RequestMessage;
@@ -1049,12 +1096,14 @@ exports.KeygenRequestSchema = KeygenRequestSchema;
 exports.KeygenResponseSchema = KeygenResponseSchema;
 exports.KeygenV1RequestMessage = KeygenV1RequestMessage;
 exports.KeygenV1ResponseMessage = KeygenV1ResponseMessage;
+exports.MAX_KEYGEN_PARTIES = MAX_KEYGEN_PARTIES;
 exports.MessageRegistry = MessageRegistry;
 exports.OptionalStringCodec = OptionalStringCodec;
 exports.ReceiveKeyRequestSchema = ReceiveKeyRequestSchema;
 exports.ReceiveKeyResponseSchema = ReceiveKeyResponseSchema;
 exports.ReceiveKeyV1RequestMessage = ReceiveKeyV1RequestMessage;
 exports.ReceiveKeyV1ResponseMessage = ReceiveKeyV1ResponseMessage;
+exports.RelayDomainCodec = RelayDomainCodec;
 exports.SIGNING_ALGORITHM_CLASSES = SIGNING_ALGORITHM_CLASSES;
 exports.SIGNING_ALGORITHM_INSTANCES = SIGNING_ALGORITHM_INSTANCES;
 exports.SignMessageRequestSchema = SignMessageRequestSchema;