@hazbase/simplicity 0.4.6 → 0.4.7

package/dist/domain/damp.d.ts

@@ -0,0 +1,94 @@
+import type { SimplicityArtifact, SimplicityClientConfig } from "../core/types";
+export declare const STRICT_POLICY_SNAPSHOT_SCHEMA: "hazbase_strict_policy_snapshot_v1";
+export declare const STRICT_POLICY_SNAPSHOT_APPROVAL_SCHEMA: "hazbase_strict_policy_snapshot_approval_v1";
+export declare const STRICT_POLICY_SNAPSHOT_APPROVAL_DOMAIN: "HAZBASE-RWA-POLICY-SNAPSHOT-V1";
+export declare const STRICT_POLICY_AUTHORITY_SET_DOMAIN: "HAZBASE-RWA-POLICY-AUTHORITY-SET-V1";
+export declare const STRICT_POLICY_VERIFIER_MAX_INPUTS: 16;
+export declare const STRICT_POLICY_VERIFIER_MAX_OUTPUTS: 8;
+export type StrictPolicyNetwork = "liquid-regtest" | "liquid-testnet" | "liquid-mainnet";
+export interface StrictPolicyVerifierReference {
+    outpoint: {
+        txid: string;
+        vout: number;
+    };
+    assetId: string;
+    amountAtomic: string;
+    cmr: string;
+    scriptHash: string;
+}
+export interface StrictPolicySnapshotPayload {
+    schema: typeof STRICT_POLICY_SNAPSHOT_SCHEMA;
+    network: StrictPolicyNetwork;
+    liquidGenesisHash: string;
+    assetBindingId: string;
+    liquidAssetId: string;
+    epoch: string;
+    previousSnapshotHash: string | null;
+    policyRoot: string;
+    whitelistRoot: string;
+    verifier: StrictPolicyVerifierReference;
+    effectiveAt: string;
+    validUntil: string | null;
+}
+export interface StrictPolicySnapshotAuthority {
+    authorityType: "issuer_single";
+    authorityId: string;
+    authorityVersion: string;
+    authoritySetHash: string;
+    approvalScheme: "bip340-sha256";
+    approvalThreshold: 1;
+    signerXonly: string;
+    approvedAt: string;
+}
+export interface StrictPolicySnapshotApprovalProof {
+    type: "issuer_single_v1";
+    signerXonly: string;
+    signatureHex: string;
+}
+export interface PreparedStrictPolicySnapshot {
+    payload: StrictPolicySnapshotPayload;
+    authority: StrictPolicySnapshotAuthority;
+    canonicalPayload: string;
+    snapshotHash: string;
+    canonicalApprovalMessage: string;
+    approvalMessageHash: string;
+}
+export interface StrictPolicySnapshotEnvelope extends PreparedStrictPolicySnapshot {
+    approvalProof: StrictPolicySnapshotApprovalProof;
+    approvalProofHash: string;
+}
+export interface StrictPolicyHolderCovenantParams {
+    strictAssetIdJetHex: string;
+    verifierAssetIdJetHex: string;
+    verifierAmountAtomic: string;
+    numsInternalKey: string;
+}
+export interface StrictPolicyVerifierCovenantParams {
+    strictAssetIdJetHex: string;
+    verifierAssetIdJetHex: string;
+    verifierAmountAtomic: string;
+    holderProgramCmr: string;
+    holderNumsInternalKey: string;
+    whitelistRoot: string;
+    redemptionScriptHash: string;
+    authorityXonly: string;
+}
+export declare function normalizeStrictPolicySnapshotPayload(value: unknown): StrictPolicySnapshotPayload;
+export declare function normalizeStrictPolicySnapshotAuthority(value: unknown): StrictPolicySnapshotAuthority;
+export declare function normalizeStrictPolicySnapshotApprovalProof(value: unknown): StrictPolicySnapshotApprovalProof;
+export declare function normalizeStrictPolicyHolderCovenantParams(value: StrictPolicyHolderCovenantParams | unknown): StrictPolicyHolderCovenantParams;
+export declare function normalizeStrictPolicyVerifierCovenantParams(value: StrictPolicyVerifierCovenantParams | unknown): StrictPolicyVerifierCovenantParams;
+export declare function strictPolicyHolderCovenantTemplatePath(): string;
+export declare function renderStrictPolicyHolderCovenantSource(value: StrictPolicyHolderCovenantParams | unknown): Promise<string>;
+export declare function compileStrictPolicyHolderCovenant(config: SimplicityClientConfig, value: StrictPolicyHolderCovenantParams | unknown): Promise<SimplicityArtifact>;
+export declare function strictPolicyVerifierCovenantTemplatePath(): string;
+export declare function renderStrictPolicyVerifierCovenantSource(value: StrictPolicyVerifierCovenantParams | unknown): Promise<string>;
+export declare function compileStrictPolicyVerifierCovenant(config: SimplicityClientConfig, value: StrictPolicyVerifierCovenantParams | unknown): Promise<SimplicityArtifact>;
+export declare function taggedHashHexUtf8(tag: string, canonicalPayload: string): string;
+export declare function computeStrictPolicyAuthoritySetHash(signerXonlyValue: string): string;
+export declare function prepareStrictPolicySnapshot(input: {
+    payload: StrictPolicySnapshotPayload | unknown;
+    authority: StrictPolicySnapshotAuthority | unknown;
+}): PreparedStrictPolicySnapshot;
+export declare function finalizeStrictPolicySnapshot(prepared: PreparedStrictPolicySnapshot, proofValue: StrictPolicySnapshotApprovalProof | unknown): StrictPolicySnapshotEnvelope;
+export declare function verifyStrictPolicySnapshot(envelopeValue: StrictPolicySnapshotEnvelope): Promise<PreparedStrictPolicySnapshot>;

package/dist/domain/damp.js

@@ -0,0 +1,371 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STRICT_POLICY_VERIFIER_MAX_OUTPUTS = exports.STRICT_POLICY_VERIFIER_MAX_INPUTS = exports.STRICT_POLICY_AUTHORITY_SET_DOMAIN = exports.STRICT_POLICY_SNAPSHOT_APPROVAL_DOMAIN = exports.STRICT_POLICY_SNAPSHOT_APPROVAL_SCHEMA = exports.STRICT_POLICY_SNAPSHOT_SCHEMA = void 0;
+exports.normalizeStrictPolicySnapshotPayload = normalizeStrictPolicySnapshotPayload;
+exports.normalizeStrictPolicySnapshotAuthority = normalizeStrictPolicySnapshotAuthority;
+exports.normalizeStrictPolicySnapshotApprovalProof = normalizeStrictPolicySnapshotApprovalProof;
+exports.normalizeStrictPolicyHolderCovenantParams = normalizeStrictPolicyHolderCovenantParams;
+exports.normalizeStrictPolicyVerifierCovenantParams = normalizeStrictPolicyVerifierCovenantParams;
+exports.strictPolicyHolderCovenantTemplatePath = strictPolicyHolderCovenantTemplatePath;
+exports.renderStrictPolicyHolderCovenantSource = renderStrictPolicyHolderCovenantSource;
+exports.compileStrictPolicyHolderCovenant = compileStrictPolicyHolderCovenant;
+exports.strictPolicyVerifierCovenantTemplatePath = strictPolicyVerifierCovenantTemplatePath;
+exports.renderStrictPolicyVerifierCovenantSource = renderStrictPolicyVerifierCovenantSource;
+exports.compileStrictPolicyVerifierCovenant = compileStrictPolicyVerifierCovenant;
+exports.taggedHashHexUtf8 = taggedHashHexUtf8;
+exports.computeStrictPolicyAuthoritySetHash = computeStrictPolicyAuthoritySetHash;
+exports.prepareStrictPolicySnapshot = prepareStrictPolicySnapshot;
+exports.finalizeStrictPolicySnapshot = finalizeStrictPolicySnapshot;
+exports.verifyStrictPolicySnapshot = verifyStrictPolicySnapshot;
+const node_crypto_1 = require("node:crypto");
+const errors_1 = require("../core/errors");
+const schnorr_1 = require("../core/schnorr");
+const summary_1 = require("../core/summary");
+const templating_1 = require("../core/templating");
+const dampPolicy_1 = require("./dampPolicy");
+// These imports support Node-only template compilation. Keep their dynamic
+// importer lazy so merely importing the snapshot verifier remains compatible
+// with Chrome extension CSP.
+function nativeImport(specifier) {
+    const importModule = new Function("value", "return import(value);");
+    return importModule(specifier);
+}
+async function readTemplateFile(templatePath) {
+    const fileSystem = await nativeImport("node:fs/promises");
+    return fileSystem.readFile(templatePath, "utf8");
+}
+async function loadCompiler() {
+    return await nativeImport(`${__dirname}/../core/compiler.js`);
+}
+exports.STRICT_POLICY_SNAPSHOT_SCHEMA = "hazbase_strict_policy_snapshot_v1";
+exports.STRICT_POLICY_SNAPSHOT_APPROVAL_SCHEMA = "hazbase_strict_policy_snapshot_approval_v1";
+exports.STRICT_POLICY_SNAPSHOT_APPROVAL_DOMAIN = "HAZBASE-RWA-POLICY-SNAPSHOT-V1";
+exports.STRICT_POLICY_AUTHORITY_SET_DOMAIN = "HAZBASE-RWA-POLICY-AUTHORITY-SET-V1";
+exports.STRICT_POLICY_VERIFIER_MAX_INPUTS = 16;
+exports.STRICT_POLICY_VERIFIER_MAX_OUTPUTS = 8;
+function validationError(field, message) {
+    throw new errors_1.ValidationError(`${field} ${message}`, {
+        code: "STRICT_POLICY_SNAPSHOT_INVALID",
+        field,
+    });
+}
+function recordValue(value, field) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        validationError(field, "must be an object");
+    }
+    return value;
+}
+function stringValue(value, field) {
+    if (typeof value !== "string" || value.trim().length === 0) {
+        validationError(field, "must be a non-empty string");
+    }
+    return value.trim();
+}
+function literalValue(value, field, allowed) {
+    const normalized = stringValue(value, field);
+    if (!allowed.includes(normalized)) {
+        validationError(field, `must be one of ${allowed.join(", ")}`);
+    }
+    return normalized;
+}
+function hexValue(value, field, byteLength) {
+    const normalized = stringValue(value, field).toLowerCase().replace(/^0x/u, "");
+    if (!/^[0-9a-f]+$/u.test(normalized) || normalized.length !== byteLength * 2) {
+        validationError(field, `must be ${byteLength} bytes of hex`);
+    }
+    return normalized;
+}
+function decimalValue(value, field, allowZero = true) {
+    const normalized = stringValue(value, field);
+    if (!/^(0|[1-9][0-9]*)$/u.test(normalized)) {
+        validationError(field, "must be a canonical unsigned decimal string");
+    }
+    if (!allowZero && normalized === "0") {
+        validationError(field, "must be greater than zero");
+    }
+    return normalized;
+}
+function u64DecimalValue(value, field, allowZero = true) {
+    const normalized = decimalValue(value, field, allowZero);
+    if (BigInt(normalized) > 0xffffffffffffffffn) {
+        validationError(field, "must fit in an unsigned 64-bit integer");
+    }
+    return normalized;
+}
+function timestampValue(value, field) {
+    const normalized = stringValue(value, field);
+    const date = new Date(normalized);
+    if (!Number.isFinite(date.getTime()) || date.toISOString() !== normalized) {
+        validationError(field, "must be a canonical UTC ISO-8601 timestamp");
+    }
+    return normalized;
+}
+function nullableHexValue(value, field, byteLength) {
+    return value === null ? null : hexValue(value, field, byteLength);
+}
+function nullableTimestampValue(value, field) {
+    return value === null ? null : timestampValue(value, field);
+}
+function voutValue(value, field) {
+    if (!Number.isSafeInteger(value) || value < 0 || value > 0xffff_ffff) {
+        validationError(field, "must be a uint32");
+    }
+    return value;
+}
+function normalizeStrictPolicySnapshotPayload(value) {
+    const record = recordValue(value, "payload");
+    const verifier = recordValue(record.verifier, "payload.verifier");
+    const outpoint = recordValue(verifier.outpoint, "payload.verifier.outpoint");
+    const effectiveAt = timestampValue(record.effectiveAt, "payload.effectiveAt");
+    const validUntil = nullableTimestampValue(record.validUntil, "payload.validUntil");
+    if (validUntil !== null && Date.parse(validUntil) <= Date.parse(effectiveAt)) {
+        validationError("payload.validUntil", "must be later than effectiveAt");
+    }
+    const epoch = decimalValue(record.epoch, "payload.epoch");
+    const previousSnapshotHash = nullableHexValue(record.previousSnapshotHash, "payload.previousSnapshotHash", 32);
+    if (epoch === "0" && previousSnapshotHash !== null) {
+        validationError("payload.previousSnapshotHash", "must be null for epoch 0");
+    }
+    if (epoch !== "0" && previousSnapshotHash === null) {
+        validationError("payload.previousSnapshotHash", "is required after epoch 0");
+    }
+    return {
+        schema: literalValue(record.schema, "payload.schema", [exports.STRICT_POLICY_SNAPSHOT_SCHEMA]),
+        network: literalValue(record.network, "payload.network", [
+            "liquid-regtest",
+            "liquid-testnet",
+            "liquid-mainnet",
+        ]),
+        liquidGenesisHash: hexValue(record.liquidGenesisHash, "payload.liquidGenesisHash", 32),
+        assetBindingId: stringValue(record.assetBindingId, "payload.assetBindingId"),
+        liquidAssetId: hexValue(record.liquidAssetId, "payload.liquidAssetId", 32),
+        epoch,
+        previousSnapshotHash,
+        policyRoot: hexValue(record.policyRoot, "payload.policyRoot", 32),
+        whitelistRoot: hexValue(record.whitelistRoot, "payload.whitelistRoot", 32),
+        verifier: {
+            outpoint: {
+                txid: hexValue(outpoint.txid, "payload.verifier.outpoint.txid", 32),
+                vout: voutValue(outpoint.vout, "payload.verifier.outpoint.vout"),
+            },
+            assetId: hexValue(verifier.assetId, "payload.verifier.assetId", 32),
+            amountAtomic: decimalValue(verifier.amountAtomic, "payload.verifier.amountAtomic", false),
+            cmr: hexValue(verifier.cmr, "payload.verifier.cmr", 32),
+            scriptHash: hexValue(verifier.scriptHash, "payload.verifier.scriptHash", 32),
+        },
+        effectiveAt,
+        validUntil,
+    };
+}
+function normalizeStrictPolicySnapshotAuthority(value) {
+    const record = recordValue(value, "authority");
+    const threshold = record.approvalThreshold;
+    if (threshold !== 1) {
+        validationError("authority.approvalThreshold", "must equal 1 for issuer_single");
+    }
+    const signerXonly = hexValue(record.signerXonly, "authority.signerXonly", 32);
+    const authoritySetHash = hexValue(record.authoritySetHash, "authority.authoritySetHash", 32);
+    const expectedAuthoritySetHash = computeStrictPolicyAuthoritySetHash(signerXonly);
+    if (authoritySetHash !== expectedAuthoritySetHash) {
+        validationError("authority.authoritySetHash", "does not match signerXonly and threshold");
+    }
+    return {
+        authorityType: literalValue(record.authorityType, "authority.authorityType", ["issuer_single"]),
+        authorityId: stringValue(record.authorityId, "authority.authorityId"),
+        authorityVersion: stringValue(record.authorityVersion, "authority.authorityVersion"),
+        authoritySetHash,
+        approvalScheme: literalValue(record.approvalScheme, "authority.approvalScheme", ["bip340-sha256"]),
+        approvalThreshold: threshold,
+        signerXonly,
+        approvedAt: timestampValue(record.approvedAt, "authority.approvedAt"),
+    };
+}
+function normalizeStrictPolicySnapshotApprovalProof(value) {
+    const record = recordValue(value, "approvalProof");
+    return {
+        type: literalValue(record.type, "approvalProof.type", ["issuer_single_v1"]),
+        signerXonly: hexValue(record.signerXonly, "approvalProof.signerXonly", 32),
+        signatureHex: hexValue(record.signatureHex, "approvalProof.signatureHex", 64),
+    };
+}
+function normalizeStrictPolicyHolderCovenantParams(value) {
+    const record = recordValue(value, "holderCovenant");
+    return {
+        strictAssetIdJetHex: hexValue(record.strictAssetIdJetHex, "holderCovenant.strictAssetIdJetHex", 32),
+        verifierAssetIdJetHex: hexValue(record.verifierAssetIdJetHex, "holderCovenant.verifierAssetIdJetHex", 32),
+        verifierAmountAtomic: u64DecimalValue(record.verifierAmountAtomic, "holderCovenant.verifierAmountAtomic", false),
+        numsInternalKey: hexValue(record.numsInternalKey, "holderCovenant.numsInternalKey", 32),
+    };
+}
+function normalizeStrictPolicyVerifierCovenantParams(value) {
+    const record = recordValue(value, "verifierCovenant");
+    const strictAssetIdJetHex = hexValue(record.strictAssetIdJetHex, "verifierCovenant.strictAssetIdJetHex", 32);
+    const verifierAssetIdJetHex = hexValue(record.verifierAssetIdJetHex, "verifierCovenant.verifierAssetIdJetHex", 32);
+    if (strictAssetIdJetHex === verifierAssetIdJetHex) {
+        validationError("verifierCovenant", "strict and verifier assets must be distinct");
+    }
+    return {
+        strictAssetIdJetHex,
+        verifierAssetIdJetHex,
+        verifierAmountAtomic: u64DecimalValue(record.verifierAmountAtomic, "verifierCovenant.verifierAmountAtomic", false),
+        holderProgramCmr: hexValue(record.holderProgramCmr, "verifierCovenant.holderProgramCmr", 32),
+        holderNumsInternalKey: hexValue(record.holderNumsInternalKey, "verifierCovenant.holderNumsInternalKey", 32),
+        whitelistRoot: hexValue(record.whitelistRoot, "verifierCovenant.whitelistRoot", 32),
+        redemptionScriptHash: hexValue(record.redemptionScriptHash, "verifierCovenant.redemptionScriptHash", 32),
+        authorityXonly: hexValue(record.authorityXonly, "verifierCovenant.authorityXonly", 32),
+    };
+}
+function strictPolicyHolderCovenantTemplatePath() {
+    return `${__dirname}/../docs/definitions/strict-holder-input-v1.simf`;
+}
+async function renderStrictPolicyHolderCovenantSource(value) {
+    const params = normalizeStrictPolicyHolderCovenantParams(value);
+    const source = await readTemplateFile(strictPolicyHolderCovenantTemplatePath());
+    return (0, templating_1.renderTemplate)(source, {
+        STRICT_ASSET_ID_JET_HEX: params.strictAssetIdJetHex,
+        VERIFIER_ASSET_ID_JET_HEX: params.verifierAssetIdJetHex,
+        VERIFIER_AMOUNT_ATOMIC: params.verifierAmountAtomic,
+        NUMS_INTERNAL_KEY: params.numsInternalKey,
+    });
+}
+async function compileStrictPolicyHolderCovenant(config, value) {
+    const params = normalizeStrictPolicyHolderCovenantParams(value);
+    const { compileFromFile } = await loadCompiler();
+    return compileFromFile(config, {
+        simfPath: strictPolicyHolderCovenantTemplatePath(),
+        templateVars: {
+            STRICT_ASSET_ID_JET_HEX: params.strictAssetIdJetHex,
+            VERIFIER_ASSET_ID_JET_HEX: params.verifierAssetIdJetHex,
+            VERIFIER_AMOUNT_ATOMIC: params.verifierAmountAtomic,
+            NUMS_INTERNAL_KEY: params.numsInternalKey,
+        },
+    });
+}
+function strictPolicyVerifierCovenantTemplatePath() {
+    return `${__dirname}/../docs/definitions/strict-verifier-ordinary-v1.simf`;
+}
+function strictPolicyVerifierTemplateVars(value) {
+    const params = normalizeStrictPolicyVerifierCovenantParams(value);
+    const tagHashes = (0, dampPolicy_1.strictPolicyWhitelistTagHashes)();
+    return {
+        STRICT_ASSET_ID_JET_HEX: params.strictAssetIdJetHex,
+        VERIFIER_ASSET_ID_JET_HEX: params.verifierAssetIdJetHex,
+        VERIFIER_AMOUNT_ATOMIC: params.verifierAmountAtomic,
+        HOLDER_PROGRAM_CMR: params.holderProgramCmr,
+        HOLDER_NUMS_INTERNAL_KEY: params.holderNumsInternalKey,
+        WHITELIST_ROOT: params.whitelistRoot,
+        REDEMPTION_SCRIPT_HASH: params.redemptionScriptHash,
+        AUTHORITY_XONLY: params.authorityXonly,
+        WHITELIST_OWNER_TAG_HASH: tagHashes.owner,
+        WHITELIST_NODE_TAG_HASH: tagHashes.node,
+        WHITELIST_DEPTH: dampPolicy_1.STRICT_POLICY_WHITELIST_DEPTH,
+        MAX_INPUTS: exports.STRICT_POLICY_VERIFIER_MAX_INPUTS,
+        MAX_OUTPUTS: exports.STRICT_POLICY_VERIFIER_MAX_OUTPUTS,
+        INPUT_UNIT_SLOTS: Array.from({ length: exports.STRICT_POLICY_VERIFIER_MAX_INPUTS }, () => "()").join(", "),
+        OUTPUT_UNIT_SLOTS: Array.from({ length: exports.STRICT_POLICY_VERIFIER_MAX_OUTPUTS }, () => "()").join(", "),
+    };
+}
+async function renderStrictPolicyVerifierCovenantSource(value) {
+    const source = await readTemplateFile(strictPolicyVerifierCovenantTemplatePath());
+    return (0, templating_1.renderTemplate)(source, strictPolicyVerifierTemplateVars(value));
+}
+async function compileStrictPolicyVerifierCovenant(config, value) {
+    const { compileFromFile } = await loadCompiler();
+    return compileFromFile(config, {
+        simfPath: strictPolicyVerifierCovenantTemplatePath(),
+        templateVars: strictPolicyVerifierTemplateVars(value),
+    });
+}
+function taggedHashHexUtf8(tag, canonicalPayload) {
+    const tagHash = (0, node_crypto_1.createHash)("sha256").update(tag, "utf8").digest();
+    return (0, node_crypto_1.createHash)("sha256")
+        .update(tagHash)
+        .update(tagHash)
+        .update(canonicalPayload, "utf8")
+        .digest("hex");
+}
+function computeStrictPolicyAuthoritySetHash(signerXonlyValue) {
+    const signerXonly = hexValue(signerXonlyValue, "signerXonly", 32);
+    return taggedHashHexUtf8(exports.STRICT_POLICY_AUTHORITY_SET_DOMAIN, (0, summary_1.stableStringify)({
+        authorityType: "issuer_single",
+        approvalThreshold: 1,
+        members: [signerXonly],
+    }));
+}
+function prepareStrictPolicySnapshot(input) {
+    const payload = normalizeStrictPolicySnapshotPayload(input.payload);
+    const authority = normalizeStrictPolicySnapshotAuthority(input.authority);
+    if (Date.parse(authority.approvedAt) > Date.parse(payload.effectiveAt)) {
+        validationError("authority.approvedAt", "must not be later than payload.effectiveAt");
+    }
+    const canonicalPayload = (0, summary_1.stableStringify)(payload);
+    const snapshotHash = (0, summary_1.sha256HexUtf8)(canonicalPayload);
+    const canonicalApprovalMessage = (0, summary_1.stableStringify)({
+        schema: exports.STRICT_POLICY_SNAPSHOT_APPROVAL_SCHEMA,
+        network: payload.network,
+        liquidGenesisHash: payload.liquidGenesisHash,
+        assetBindingId: payload.assetBindingId,
+        liquidAssetId: payload.liquidAssetId,
+        epoch: payload.epoch,
+        previousSnapshotHash: payload.previousSnapshotHash,
+        snapshotHash,
+        verifierCmr: payload.verifier.cmr,
+        verifierScriptHash: payload.verifier.scriptHash,
+        authorityType: authority.authorityType,
+        authorityId: authority.authorityId,
+        authorityVersion: authority.authorityVersion,
+        authoritySetHash: authority.authoritySetHash,
+        approvalScheme: authority.approvalScheme,
+        approvalThreshold: authority.approvalThreshold,
+        signerXonly: authority.signerXonly,
+        approvedAt: authority.approvedAt,
+    });
+    const approvalMessageHash = taggedHashHexUtf8(exports.STRICT_POLICY_SNAPSHOT_APPROVAL_DOMAIN, canonicalApprovalMessage);
+    return {
+        payload,
+        authority,
+        canonicalPayload,
+        snapshotHash,
+        canonicalApprovalMessage,
+        approvalMessageHash,
+    };
+}
+function finalizeStrictPolicySnapshot(prepared, proofValue) {
+    const approvalProof = normalizeStrictPolicySnapshotApprovalProof(proofValue);
+    if (approvalProof.signerXonly !== prepared.authority.signerXonly) {
+        validationError("approvalProof.signerXonly", "must match authority.signerXonly");
+    }
+    const approvalProofHash = (0, summary_1.sha256HexUtf8)((0, summary_1.stableStringify)(approvalProof));
+    return {
+        ...prepared,
+        approvalProof,
+        approvalProofHash,
+    };
+}
+async function verifyStrictPolicySnapshot(envelopeValue) {
+    const prepared = prepareStrictPolicySnapshot({
+        payload: envelopeValue.payload,
+        authority: envelopeValue.authority,
+    });
+    const envelope = finalizeStrictPolicySnapshot(prepared, envelopeValue.approvalProof);
+    if (envelopeValue.canonicalPayload !== prepared.canonicalPayload) {
+        validationError("canonicalPayload", "does not match the normalized snapshot payload");
+    }
+    if (envelopeValue.snapshotHash !== prepared.snapshotHash) {
+        validationError("snapshotHash", "does not match the canonical payload");
+    }
+    if (envelopeValue.canonicalApprovalMessage !== prepared.canonicalApprovalMessage) {
+        validationError("canonicalApprovalMessage", "does not match the normalized snapshot approval message");
+    }
+    if (envelopeValue.approvalMessageHash !== prepared.approvalMessageHash) {
+        validationError("approvalMessageHash", "does not match the canonical approval message");
+    }
+    if (envelopeValue.approvalProofHash !== envelope.approvalProofHash) {
+        validationError("approvalProofHash", "does not match the canonical approval proof");
+    }
+    const valid = await (0, schnorr_1.schnorrVerifyHex)(envelope.approvalProof.signatureHex, prepared.approvalMessageHash, prepared.authority.signerXonly);
+    if (!valid) {
+        validationError("approvalProof.signatureHex", "is not valid for the snapshot authority");
+    }
+    return prepared;
+}

package/dist/domain/dampPolicy.d.ts

@@ -0,0 +1,61 @@
+export declare const STRICT_POLICY_WHITELIST_DEPTH: 8;
+export declare const STRICT_POLICY_MAX_WHITELIST_OWNERS: number;
+export declare const STRICT_POLICY_WHITELIST_OWNER_DOMAIN: "HAZBASE-RWA-STRICT-WHITELIST-OWNER-V1";
+export declare const STRICT_POLICY_WHITELIST_EMPTY_DOMAIN: "HAZBASE-RWA-STRICT-WHITELIST-EMPTY-V1";
+export declare const STRICT_POLICY_WHITELIST_NODE_DOMAIN: "HAZBASE-RWA-STRICT-WHITELIST-NODE-V1";
+export interface StrictPolicyHolderPositionParams {
+    holderProgramCmr: string;
+    numsInternalKey: string;
+    holderXonly: string;
+}
+export interface StrictPolicyHolderPosition {
+    holderProgramCmr: string;
+    holderTapleafHash: string;
+    holderXonly: string;
+    ownerTapDataHash: string;
+    taprootRoot: string;
+    numsInternalKey: string;
+    outputKey: string;
+    scriptPubKey: string;
+    scriptHash: string;
+}
+export interface StrictPolicyWhitelistProofStep {
+    siblingPosition: "left" | "right";
+    siblingHash: string;
+}
+export interface StrictPolicyWhitelistEntry {
+    ownerXonly: string;
+    leafHash: string;
+    proof: StrictPolicyWhitelistProofStep[];
+}
+export interface StrictPolicyWhitelist {
+    depth: typeof STRICT_POLICY_WHITELIST_DEPTH;
+    root: string;
+    entries: StrictPolicyWhitelistEntry[];
+}
+export interface StrictPolicyWhitelistProof {
+    ownerXonly: string;
+    proof: StrictPolicyWhitelistProofStep[];
+}
+export declare function computeStrictPolicyHolderTapleafHash(holderProgramCmrValue: string): string;
+export declare function computeStrictPolicyOwnerTapDataHash(holderXonlyValue: string): string;
+export declare function computeElementsTapBranch(leftValue: string, rightValue: string): string;
+export declare function deriveStrictPolicyHolderPosition(value: StrictPolicyHolderPositionParams): Promise<StrictPolicyHolderPosition>;
+export declare function computeStrictPolicyWhitelistOwnerLeaf(ownerXonlyValue: string): string;
+export declare function computeStrictPolicyWhitelistEmptyLeaf(): string;
+export declare function computeStrictPolicyWhitelistNode(leftValue: string, rightValue: string): string;
+export declare function buildStrictPolicyWhitelist(ownerXonlyValues: readonly string[]): StrictPolicyWhitelist;
+export declare function verifyStrictPolicyWhitelistProof(input: {
+    ownerXonly: string;
+    proof: readonly StrictPolicyWhitelistProofStep[];
+    expectedRoot: string;
+}): boolean;
+export declare function normalizeStrictPolicyWhitelistProof(input: {
+    ownerXonly: string;
+    proof: readonly StrictPolicyWhitelistProofStep[];
+}): StrictPolicyWhitelistProof;
+export declare function strictPolicyWhitelistTagHashes(): {
+    owner: string;
+    empty: string;
+    node: string;
+};