@gvnrdao/dh-lit-actions 0.0.14 → 0.0.15

package/out/pkp-validator.js

@@ -0,0 +1,386 @@
+(() => {
+  // src/pkp-validator.ts
+  var runPkpValidator = async () => {
+    const targetPkpTokenId = globalThis.targetPkpTokenId;
+    const expectedCid = globalThis.expectedCid;
+    const network = globalThis.network;
+    const RPC_ENDPOINTS = {
+      "datil-test": "https://datil-test-rpc.litprotocol.com",
+      datil: "https://yellowstone-rpc.litprotocol.com"
+    };
+    const CONTRACT_ADDRESSES = {
+      "datil-test": {
+        // https://github.com/LIT-Protocol/networks/blob/main/contracts/datil-test.json
+        PKPNFT: "0x6a0f439f064B7167A8Ea6B22AcC07ae5360ee0d1",
+        PKPPermissions: "0x60C1ddC8b9e38F730F0e7B70A2F84C1A98A69167"
+      },
+      datil: {
+        // Updated contract addresses for datil mainnet - these may need verification
+        // Chronicle Yellowstone rollup deployment addresses
+        PKPNFT: "0x8F75a53F65e31DD0D2e40d0827becAaE2299D111",
+        PKPPermissions: "0x969471556e2B9DC984f4C9c24667B8B0Efb5B7F8"
+      }
+    };
+    const withTimeout = async (promise, timeoutMs, operation) => {
+      return Promise.race([
+        promise,
+        new Promise(
+          (_, reject) => setTimeout(() => reject(new Error(`Timeout after ${timeoutMs}ms during ${operation}`)), timeoutMs)
+        )
+      ]);
+    };
+    const makeRpcCall = async (payload, endpoint, operation, maxRetries = 3) => {
+      let lastError;
+      for (let attempt = 1; attempt <= maxRetries; attempt++) {
+        try {
+          console.log(`\u{1F310} [Attempt ${attempt}/${maxRetries}] Making RPC call for ${operation}`);
+          console.log(`   Endpoint: ${endpoint}`);
+          console.log(`   Payload ID: ${payload.id}`);
+          console.log(`   Method: ${payload.method}`);
+          const startTime = Date.now();
+          const response = await withTimeout(
+            fetch(endpoint, {
+              method: "POST",
+              headers: { "Content-Type": "application/json" },
+              body: JSON.stringify(payload)
+            }),
+            3e4,
+            // 30 second timeout
+            operation
+          );
+          const duration = Date.now() - startTime;
+          console.log(`\u23F1\uFE0F  RPC call completed in ${duration}ms`);
+          if (!response.ok) {
+            throw new Error(`HTTP ${response.status}: ${response.statusText}`);
+          }
+          const result = await response.json();
+          if (result.error) {
+            console.log(`\u274C RPC Error:`, result.error);
+            throw new Error(`RPC Error: ${result.error.message} (Code: ${result.error.code})`);
+          }
+          console.log(`\u2705 RPC call successful for ${operation}`);
+          console.log(`   Result length: ${JSON.stringify(result).length} bytes`);
+          return result;
+        } catch (error) {
+          lastError = error;
+          console.log(`\u274C [Attempt ${attempt}/${maxRetries}] ${operation} failed: ${error.message}`);
+          if (attempt < maxRetries) {
+            const delay = Math.pow(2, attempt - 1) * 1e3;
+            console.log(`\u23F3 Retrying in ${delay}ms...`);
+            await new Promise((resolve) => setTimeout(resolve, delay));
+          }
+        }
+      }
+      throw lastError ?? new Error(`Unknown error during ${operation}`);
+    };
+    try {
+      const targetPkpTokenId2 = globalThis.targetPkpTokenId;
+      const expectedCid2 = globalThis.expectedCid;
+      const network2 = globalThis.network || "datil";
+      if (!Object.prototype.hasOwnProperty.call(RPC_ENDPOINTS, network2)) {
+        throw new Error(`Unsupported network: ${network2}`);
+      }
+      if (!targetPkpTokenId2) {
+        throw new Error("targetPkpTokenId is required in parameters");
+      }
+      if (!expectedCid2) {
+        throw new Error("expectedCid is required in parameters");
+      }
+      console.log("\n\u{1F512} PKP SECURITY VALIDATION - ENHANCED DEBUG MODE");
+      console.log("==========================================================");
+      console.log("   Using EXACT same logic as validatePKPSecurity test function");
+      console.log("   Making direct smart contract calls to verify security");
+      console.log(`   Target PKP: ${targetPkpTokenId2}`);
+      console.log(`   Expected CID: ${expectedCid2}`);
+      console.log(`   Network: ${network2}`);
+      console.log(`   Execution timestamp: ${Date.now()}`);
+      console.log("==========================================================");
+      const rpcEndpoint = RPC_ENDPOINTS[network2];
+      const LIT_CONTRACTS = CONTRACT_ADDRESSES[network2];
+      console.log("\n\u{1F527} CONFIGURATION VERIFICATION:");
+      console.log(`   RPC Endpoint: ${rpcEndpoint}`);
+      console.log(`   PKPNFT Contract: ${LIT_CONTRACTS.PKPNFT}`);
+      console.log(`   PKPPermissions Contract: ${LIT_CONTRACTS.PKPPermissions}`);
+      console.log(`   Network resolved: ${network2}`);
+      console.log("\n\u{1F310} TESTING RPC CONNECTIVITY...");
+      try {
+        const connectivityTest = {
+          method: "eth_chainId",
+          params: [],
+          id: 0,
+          jsonrpc: "2.0"
+        };
+        const chainIdResult = await makeRpcCall(connectivityTest, rpcEndpoint, "connectivity_test");
+        const chainId = parseInt(chainIdResult.result, 16);
+        console.log(`\u2705 RPC connectivity confirmed - Chain ID: ${chainId}`);
+      } catch (error) {
+        console.log(`\u274C RPC connectivity failed: ${error.message}`);
+        throw new Error(`Cannot connect to RPC endpoint ${rpcEndpoint}: ${error.message}`);
+      }
+      console.log("\n\u{1F50D} STEP 1: PKP EXISTENCE CHECK");
+      console.log("====================================");
+      console.log(`   Checking PKP existence for: ${targetPkpTokenId2}`);
+      console.log(`   Contract: ${LIT_CONTRACTS.PKPNFT}`);
+      const existsCalldata = ethers.utils.concat([
+        ethers.utils.id("exists(uint256)").substring(0, 10),
+        // function selector
+        ethers.utils.defaultAbiCoder.encode(["uint256"], [targetPkpTokenId2])
+      ]);
+      console.log(`   Function selector: ${ethers.utils.id("exists(uint256)").substring(0, 10)}`);
+      console.log(`   Calldata: ${ethers.utils.hexlify(existsCalldata)}`);
+      const existsCall = {
+        to: LIT_CONTRACTS.PKPNFT,
+        data: ethers.utils.hexlify(existsCalldata)
+      };
+      const existsRpcPayload = {
+        method: "eth_call",
+        params: [existsCall, "latest"],
+        id: 1,
+        jsonrpc: "2.0"
+      };
+      const existsResult = await makeRpcCall(existsRpcPayload, rpcEndpoint, "PKP_existence_check");
+      const exists = ethers.utils.defaultAbiCoder.decode(
+        ["bool"],
+        existsResult.result
+      )[0];
+      console.log(`   Raw result: ${existsResult.result}`);
+      console.log(`   Decoded result: ${exists}`);
+      console.log(`\u2705 PKP EXISTS CHECK RESULT: ${exists}`);
+      if (!exists) {
+        console.log(`\u274C CRITICAL: PKP ${targetPkpTokenId2} does not exist on-chain!`);
+        console.log(`   This PKP was never minted or the token ID is incorrect`);
+        console.log(`   Cannot proceed with security validation`);
+      }
+      console.log("\n\u{1F50D} STEP 2: PKP IMMUTABILITY CHECK");
+      console.log("=====================================");
+      console.log(`   Checking owner status for PKP: ${targetPkpTokenId2}`);
+      const ownerOfCalldata = ethers.utils.concat([
+        ethers.utils.id("ownerOf(uint256)").substring(0, 10),
+        // function selector
+        ethers.utils.defaultAbiCoder.encode(["uint256"], [targetPkpTokenId2])
+      ]);
+      console.log(`   Function selector: ${ethers.utils.id("ownerOf(uint256)").substring(0, 10)}`);
+      console.log(`   Calldata: ${ethers.utils.hexlify(ownerOfCalldata)}`);
+      const ownerOfCall = {
+        to: LIT_CONTRACTS.PKPNFT,
+        data: ethers.utils.hexlify(ownerOfCalldata)
+      };
+      const ownerOfRpcPayload = {
+        method: "eth_call",
+        params: [ownerOfCall, "latest"],
+        id: 2,
+        jsonrpc: "2.0"
+      };
+      let owner = "0x0000000000000000000000000000000000000000";
+      let isImmutable = false;
+      if (exists) {
+        const ownerOfResult = await makeRpcCall(ownerOfRpcPayload, rpcEndpoint, "PKP_owner_check");
+        owner = ethers.utils.defaultAbiCoder.decode(
+          ["address"],
+          ownerOfResult.result
+        )[0];
+        const BURN_ADDRESS = "0x000000000000000000000000000000000000dEaD";
+        isImmutable = owner.toLowerCase() === BURN_ADDRESS.toLowerCase();
+        console.log(`   Raw owner result: ${ownerOfResult.result}`);
+        console.log(`   Decoded owner: ${owner}`);
+        console.log(`   Expected burn address: ${BURN_ADDRESS}`);
+        console.log(`   Owner matches burn address: ${isImmutable}`);
+      } else {
+        console.log(`   Skipping owner check - PKP does not exist`);
+      }
+      console.log(`\u2705 PKP IMMUTABILITY CHECK RESULT: ${isImmutable}`);
+      console.log("\n\u{1F510} STEP 3: AUTHORIZATION CHECK");
+      console.log("==================================");
+      console.log(`   Checking permitted actions for PKP: ${targetPkpTokenId2}`);
+      console.log(`   Contract: ${LIT_CONTRACTS.PKPPermissions}`);
+      const getPermittedActionsCalldata = ethers.utils.concat([
+        ethers.utils.id("getPermittedActions(uint256)").substring(0, 10),
+        // function selector
+        ethers.utils.defaultAbiCoder.encode(["uint256"], [targetPkpTokenId2])
+      ]);
+      console.log(`   Function selector: ${ethers.utils.id("getPermittedActions(uint256)").substring(0, 10)}`);
+      console.log(`   Calldata: ${ethers.utils.hexlify(getPermittedActionsCalldata)}`);
+      const getPermittedActionsCall = {
+        to: LIT_CONTRACTS.PKPPermissions,
+        data: ethers.utils.hexlify(getPermittedActionsCalldata)
+      };
+      const getPermittedActionsRpcPayload = {
+        method: "eth_call",
+        params: [getPermittedActionsCall, "latest"],
+        id: 3,
+        jsonrpc: "2.0"
+      };
+      let actionsBytes = [];
+      let hasOnlyOneAction = false;
+      let matchesExpectedCID = false;
+      let foundCid = null;
+      if (exists) {
+        const getPermittedActionsResult = await makeRpcCall(
+          getPermittedActionsRpcPayload,
+          rpcEndpoint,
+          "PKP_permitted_actions_check"
+        );
+        console.log(`   Raw permissions result: ${getPermittedActionsResult.result}`);
+        actionsBytes = ethers.utils.defaultAbiCoder.decode(
+          ["bytes[]"],
+          getPermittedActionsResult.result
+        )[0];
+        console.log(`   Decoded actions count: ${actionsBytes.length}`);
+        console.log(`   Actions bytes array:`, actionsBytes);
+        hasOnlyOneAction = actionsBytes.length === 1;
+        foundCid = actionsBytes[0] || null;
+        matchesExpectedCID = foundCid?.toLowerCase() === expectedCid2.toLowerCase();
+        console.log(`   First action bytes: ${foundCid}`);
+        console.log(`   Expected CID (input): ${expectedCid2}`);
+        console.log(`   CID comparison (case-insensitive):`);
+        console.log(`     Found:    ${foundCid?.toLowerCase()}`);
+        console.log(`     Expected: ${expectedCid2.toLowerCase()}`);
+        console.log(`     Match:    ${matchesExpectedCID}`);
+      } else {
+        console.log(`   Skipping authorization check - PKP does not exist`);
+      }
+      console.log("\n\u{1F4CA} AUTHORIZATION CHECK SUMMARY:");
+      console.log(`   Permitted actions count: ${actionsBytes.length}`);
+      console.log(`   Has exactly one action: ${hasOnlyOneAction}`);
+      console.log(`   Matches expected CID: ${matchesExpectedCID}`);
+      console.log(`   Expected CID: ${expectedCid2}`);
+      console.log(`   Found CID: ${foundCid || "NONE"}`);
+      if (actionsBytes.length > 1) {
+        console.log(`   \u26A0\uFE0F  WARNING: PKP has ${actionsBytes.length} authorized actions (expected 1)`);
+        console.log(`   Additional actions:`);
+        actionsBytes.slice(1).forEach((action, index) => {
+          console.log(`     [${index + 2}]: ${action}`);
+        });
+      }
+      if (actionsBytes.length === 0) {
+        console.log(`   \u274C CRITICAL: PKP has no authorized actions!`);
+      }
+      const allValid = exists && isImmutable && hasOnlyOneAction && matchesExpectedCID;
+      const validationSummary = {
+        pkpExists: `${exists} ${exists ? "\u2705" : "\u274C"}`,
+        pkpImmutable: `${isImmutable} ${isImmutable ? "\u2705" : "\u274C"}`,
+        singleAction: `${hasOnlyOneAction} ${hasOnlyOneAction ? "\u2705" : "\u274C"}`,
+        correctCID: `${matchesExpectedCID} ${matchesExpectedCID ? "\u2705" : "\u274C"}`,
+        overallSecurity: `${allValid} ${allValid ? "\u{1F512} SECURE" : "\u26A0\uFE0F INSECURE"}`
+      };
+      console.log("\n\u{1F512} COMPLETE SECURITY VALIDATION RESULT:");
+      console.log("==========================================");
+      console.log(`   PKP exists: ${validationSummary.pkpExists}`);
+      console.log(`   PKP immutable: ${validationSummary.pkpImmutable}`);
+      console.log(`   Single action: ${validationSummary.singleAction}`);
+      console.log(`   Correct CID: ${validationSummary.correctCID}`);
+      console.log(`   OVERALL SECURITY: ${validationSummary.overallSecurity}`);
+      console.log("==========================================");
+      if (!allValid) {
+        const failureReasons = [];
+        if (!exists) failureReasons.push("PKP does not exist on-chain");
+        if (!isImmutable) failureReasons.push("PKP is not immutable (not burned)");
+        if (!hasOnlyOneAction) failureReasons.push(`PKP has ${actionsBytes.length} actions instead of 1`);
+        if (!matchesExpectedCID) failureReasons.push("PKP CID does not match expected value");
+        const errorMessage = `PKP security validation failed:
+${failureReasons.map((r) => `  - ${r}`).join("\n")}`;
+        console.log(`
+\u274C VALIDATION FAILURES:`);
+        failureReasons.forEach((reason) => console.log(`   - ${reason}`));
+        throw new Error(errorMessage);
+      }
+      console.log("\n\u{1F389} PKP IS FULLY SECURE!");
+      console.log("   \u2705 Exists on-chain");
+      console.log("   \u2705 Immutable (cannot be modified)");
+      console.log("   \u2705 Only authorized for expected LIT Action");
+      console.log("   \u{1F512} READY FOR PRODUCTION USE");
+      console.log("\n\u{1F50F} STEP 4: GENERATING VALIDATION PROOF");
+      console.log("=========================================");
+      console.log("All security validations passed - generating verifiable proof...");
+      console.log("");
+      console.log("ARCHITECTURAL NOTE:");
+      console.log("This validator PKP is BURNED (immutable) and cannot sign within");
+      console.log("a LIT Action called via session signatures from another wallet.");
+      console.log("The validation proof is the on-chain state verification itself.");
+      console.log("");
+      console.log("The fact that THIS LIT Action (authorized for this PKP) executed");
+      console.log("successfully and verified all security conditions IS the certification.");
+      console.log("");
+      const pkpIdBigInt = BigInt(`0x${targetPkpTokenId2}`);
+      const pkpIdDecimal = `0x${pkpIdBigInt.toString(10)}`;
+      const cidHex = expectedCid2.toLowerCase();
+      const proofMessage = `PKP::${pkpIdDecimal}::CID::${cidHex}::SECURE`;
+      const proofHash = ethers.utils.keccak256(ethers.utils.toUtf8Bytes(proofMessage));
+      console.log(`   Proof message: ${proofMessage}`);
+      console.log(`   Proof hash: ${proofHash}`);
+      console.log(`   Validator PKP: ${globalThis.publicKey}`);
+      console.log(`   Validator LIT Action CID: ${expectedCid2}`);
+      console.log("");
+      console.log("\u2705 Validation proof generated successfully");
+      console.log("");
+      console.log("VERIFICATION INSTRUCTIONS:");
+      console.log("Anyone can independently verify this validation by:");
+      console.log("1. Querying PKP NFT contract for existence and immutability");
+      console.log("2. Querying PKP Permissions contract for authorized actions");
+      console.log("3. Confirming PKP is only authorized for the expected LIT Action CID");
+      console.log("4. This validation result proves the PKP passed all security checks");
+      Lit.Actions.setResponse({
+        response: JSON.stringify({
+          success: true,
+          validated: {
+            pkpTokenId: targetPkpTokenId2,
+            exists,
+            immutable: isImmutable,
+            singleAction: hasOnlyOneAction,
+            correctCid: matchesExpectedCID,
+            expectedCid: expectedCid2,
+            foundCidHex: actionsBytes[0]
+          },
+          validatorPkp: globalThis.publicKey,
+          validatorActionCid: expectedCid2,
+          proofMessage,
+          proofHash,
+          timestamp: Date.now(),
+          network: network2,
+          verificationNote: "This validation was performed by the authorized LIT Action for this validator PKP. The validation itself is the proof of security."
+        })
+      });
+    } catch (error) {
+      console.error("\n\u{1F4A5} CRITICAL ERROR - PKP VALIDATION FAILED");
+      console.error("===========================================");
+      console.error(`Error type: ${error.constructor.name}`);
+      console.error(`Error message: ${error.message}`);
+      console.error(`Error stack: ${error.stack}`);
+      console.error(`Network: ${network}`);
+      console.error(`Target PKP: ${globalThis.targetPkpTokenId || "unknown"}`);
+      console.error(`Expected CID: ${globalThis.expectedCid || "unknown"}`);
+      console.error(`Validator PKP: ${globalThis.publicKey || "unknown"}`);
+      console.error(`Timestamp: ${(/* @__PURE__ */ new Date()).toISOString()}`);
+      console.error("===========================================");
+      let errorCategory = "UNKNOWN_ERROR";
+      if (error.message.includes("Timeout")) {
+        errorCategory = "TIMEOUT_ERROR";
+      } else if (error.message.includes("RPC") || error.message.includes("HTTP")) {
+        errorCategory = "NETWORK_ERROR";
+      } else if (error.message.includes("PKP security validation failed")) {
+        errorCategory = "VALIDATION_ERROR";
+      } else if (error.message.includes("signEcdsa") || error.message.includes("signature")) {
+        errorCategory = "SIGNATURE_ERROR";
+      }
+      Lit.Actions.setResponse({
+        response: JSON.stringify({
+          success: false,
+          error: error.message || error.toString(),
+          errorCategory,
+          errorStack: error.stack || "No stack trace available",
+          targetPkpTokenId: globalThis.targetPkpTokenId || "unknown",
+          expectedCid: globalThis.expectedCid || "unknown",
+          validatorPkp: globalThis.publicKey || "unknown",
+          network,
+          timestamp: Date.now(),
+          debug: {
+            rpcEndpoint: RPC_ENDPOINTS[network],
+            contracts: CONTRACT_ADDRESSES[network] || CONTRACT_ADDRESSES["datil-test"],
+            globalThisKeys: Object.keys(globalThis)
+          }
+        })
+      });
+    }
+  };
+  runPkpValidator();
+})();

package/out/ucd-mint-validator.hash

@@ -0,0 +1 @@
+b23bea3f3679043482afc9f1e58a035d6b1cf5f582100faf1dd80e7114c7bc35