@hwlt/era-connect 0.1.0 → 0.3.0

package/dist/verify.js

@@ -1,11 +1,15 @@
-import { A as utf8Encode, D as hexToBytes, E as equalBytes, T as concatBytes, Z as EraSdkError, k as utf8Decode, w as bytesToHex } from "./shared-B8Wc7ViU.js";
+import { A as utf8Encode, D as hexToBytes, E as equalBytes, P as parsePath, T as concatBytes, Z as EraSdkError, k as utf8Decode, w as bytesToHex } from "./shared-B8Wc7ViU.js";
+import { a as cardanoSoftDerivePath } from "./derive-C4JdycUh.js";
+import { n as parseWitnessSet } from "./cardano-yuOygqwp.js";
 import { n as EvmDataType, r as foldRecoveryId } from "./evm-kJb3-oiR.js";
+import { n as TonDataType } from "./ton-5Uvi5ifg.js";
 import { a as firstVarint, i as firstBytes, o as readFields, r as splitSignedTronTx } from "./messages-17Oup0-Z.js";
 import { secp256k1 } from "@noble/curves/secp256k1";
 import { sha256 } from "@noble/hashes/sha2";
 import { keccak_256 } from "@noble/hashes/sha3";
 import { createBase58check } from "@scure/base";
 import { ed25519 } from "@noble/curves/ed25519";
+import { blake2b } from "@noble/hashes/blake2b";
 //#region src/verify/psbt-reader.ts
 const MAGIC = [
 	112,
@@ -21,7 +25,7 @@ const PsbtInputType = {
 	taprootKeySpendSignature: 19,
 	taprootScriptSpendSignature: 20
 };
-function err(message) {
+function err$1(message) {
 	return new EraSdkError("malformed-reply", `psbt: ${message}`);
 }
 var Reader = class {
@@ -34,7 +38,7 @@ var Reader = class {
 	}
 	u8() {
 		const b = this.bytes[this.offset];
-		if (b === void 0) throw err("truncated");
+		if (b === void 0) throw err$1("truncated");
 		this.offset += 1;
 		return b;
 	}
@@ -56,12 +60,12 @@ var Reader = class {
 		}
 		let value = 0n;
 		for (let i = 0; i < width; i++) value |= BigInt(this.u8()) << BigInt(8 * i);
-		if (value < minimum) throw err("non-minimal compact-size encoding");
-		if (value > BigInt(Number.MAX_SAFE_INTEGER)) throw err("length exceeds safe range");
+		if (value < minimum) throw err$1("non-minimal compact-size encoding");
+		if (value > BigInt(Number.MAX_SAFE_INTEGER)) throw err$1("length exceeds safe range");
 		return Number(value);
 	}
 	take(length) {
-		if (length > this.remaining) throw err("length exceeds input");
+		if (length > this.remaining) throw err$1("length exceeds input");
 		const out = this.bytes.slice(this.offset, this.offset + length);
 		this.offset += length;
 		return out;
@@ -77,7 +81,7 @@ function readMap(reader) {
 		const key = reader.take(keyLength);
 		const value = reader.take(reader.compactSize());
 		const keyId = Array.from(key).map((b) => b.toString(16).padStart(2, "0")).join("");
-		if (seen.has(keyId)) throw err("duplicate key within one map");
+		if (seen.has(keyId)) throw err$1("duplicate key within one map");
 		seen.add(keyId);
 		entries.push({
 			keyType: key[0],
@@ -91,7 +95,7 @@ function countTxInputsOutputs(tx) {
 	const reader = new Reader(tx);
 	reader.take(4);
 	const inputs = reader.compactSize();
-	if (inputs === 0) throw err("unsigned transaction has zero inputs (or carries witness data)");
+	if (inputs === 0) throw err$1("unsigned transaction has zero inputs (or carries witness data)");
 	for (let i = 0; i < inputs; i++) {
 		reader.take(36);
 		reader.take(reader.compactSize());
@@ -103,7 +107,7 @@ function countTxInputsOutputs(tx) {
 		reader.take(reader.compactSize());
 	}
 	reader.take(4);
-	if (reader.remaining !== 0) throw err("trailing bytes after the unsigned transaction");
+	if (reader.remaining !== 0) throw err$1("trailing bytes after the unsigned transaction");
 	return {
 		inputs,
 		outputs
@@ -111,25 +115,25 @@ function countTxInputsOutputs(tx) {
 }
 function parsePsbt(bytes) {
 	const reader = new Reader(bytes);
-	for (const expected of MAGIC) if (reader.u8() !== expected) throw err("bad magic");
+	for (const expected of MAGIC) if (reader.u8() !== expected) throw err$1("bad magic");
 	const globalMap = readMap(reader);
 	let unsignedTx = null;
 	let version = 0;
 	for (const entry of globalMap) {
 		if (entry.keyType === 0 && entry.keyData.length === 0) unsignedTx = entry.value;
 		if (entry.keyType === 251 && entry.keyData.length === 0) {
-			if (entry.value.length !== 4) throw err("bad version field");
+			if (entry.value.length !== 4) throw err$1("bad version field");
 			version = (entry.value[0] | entry.value[1] << 8 | entry.value[2] << 16 | entry.value[3] << 24) >>> 0;
 		}
 	}
-	if (unsignedTx === null) throw err("no global unsigned transaction — not a PSBT v0");
-	if (version !== 0) throw err(`unsupported PSBT version ${version}`);
+	if (unsignedTx === null) throw err$1("no global unsigned transaction — not a PSBT v0");
+	if (version !== 0) throw err$1(`unsupported PSBT version ${version}`);
 	const counts = countTxInputsOutputs(unsignedTx);
 	const inputs = [];
 	for (let i = 0; i < counts.inputs; i++) inputs.push(readMap(reader));
 	const outputs = [];
 	for (let i = 0; i < counts.outputs; i++) outputs.push(readMap(reader));
-	if (reader.remaining !== 0) throw err("trailing bytes after the output maps");
+	if (reader.remaining !== 0) throw err$1("trailing bytes after the output maps");
 	return {
 		unsignedTx,
 		version,
@@ -245,6 +249,150 @@ function message(e) {
 	return e instanceof EraSdkError || e instanceof Error ? e.message : String(e);
 }
 //#endregion
+//#region src/verify/cardano.ts
+/**
+* Recompute the digest the device signs — BLAKE2b-256 of the ENCODED FIRST
+* ELEMENT of the transaction CBOR array (the tx body) — and verify every
+* `[vkey, signature]` pair against it. With `account` + `signerPaths`, the
+* vkeys are additionally required to be exactly the soft-derived children of
+* YOUR linked account at the request's own paths.
+*/
+function verifyCardanoSignature(args) {
+	let witnesses;
+	try {
+		witnesses = args.witnesses ?? (args.witnessSet ? parseWitnessSet(args.witnessSet) : []);
+	} catch (e) {
+		return failed(`witness set is not readable: ${e.message}`);
+	}
+	if (witnesses.length === 0) return failed("no witnesses to verify");
+	let digest;
+	try {
+		digest = blake2b(firstArrayItemBytes(args.signData), { dkLen: 32 });
+	} catch (e) {
+		return failed(`signData is not a readable transaction array: ${e.message}`);
+	}
+	for (const witness of witnesses) {
+		let ok;
+		try {
+			ok = ed25519.verify(witness.signature, digest, witness.vkey);
+		} catch (e) {
+			return failed(`Cardano signature could not be checked: ${e.message}`);
+		}
+		if (!ok) return failed("a witness signature does not verify against its own vkey");
+	}
+	if (args.account && args.signerPaths && args.signerPaths.length > 0) {
+		const accountLevels = parsePath(args.account.accountPath);
+		const expected = /* @__PURE__ */ new Map();
+		for (const path of new Set(args.signerPaths)) {
+			const levels = parsePath(path);
+			if (levels.length !== accountLevels.length + 2 || !accountLevels.every((l, i) => levels[i].index === l.index && levels[i].hardened === l.hardened) || levels.slice(accountLevels.length).some((l) => l.hardened)) return failed(`signer path ${path} does not extend the account path with two soft components`);
+			const tail = levels.slice(accountLevels.length).map((l) => l.index);
+			const vkey = cardanoSoftDerivePath(args.account.publicKey, args.account.chainCode, tail);
+			expected.set(bytesToHex(vkey), path);
+		}
+		for (const [vkeyHex, path] of expected) if (!witnesses.some((w) => bytesToHex(w.vkey) === vkeyHex)) return failed(`no witness for the requested signer path ${path}`);
+		for (const witness of witnesses) if (!expected.has(bytesToHex(witness.vkey))) return failed("the witness set carries a key your request did not ask for");
+	}
+	return verified;
+}
+function firstArrayItemBytes(bytes) {
+	const top = bytes[0];
+	if (top === void 0) throw new Error("empty input");
+	if (top >> 5 !== 4) throw new Error("not a CBOR array");
+	let start;
+	if ((top & 31) === 31) start = 1;
+	else {
+		const head = readHead(bytes, 0);
+		if (head.value === 0n) throw new Error("transaction array is empty");
+		start = head.next;
+	}
+	const end = skipItem(bytes, start, 0);
+	return bytes.slice(start, end);
+}
+function readHead(bytes, offset) {
+	const initial = bytes[offset];
+	if (initial === void 0) throw new Error("truncated");
+	const info = initial & 31;
+	if (info < 24) return {
+		value: BigInt(info),
+		next: offset + 1
+	};
+	if (info === 31) return {
+		value: -1n,
+		next: offset + 1
+	};
+	let width;
+	if (info === 24) width = 1;
+	else if (info === 25) width = 2;
+	else if (info === 26) width = 4;
+	else if (info === 27) width = 8;
+	else throw new Error("reserved length encoding");
+	let value = 0n;
+	for (let i = 0; i < width; i++) {
+		const b = bytes[offset + 1 + i];
+		if (b === void 0) throw new Error("truncated");
+		value = value << 8n | BigInt(b);
+	}
+	return {
+		value,
+		next: offset + 1 + width
+	};
+}
+/** Returns the offset just past the item starting at `offset`. */
+function skipItem(bytes, offset, depth) {
+	if (depth > 32) throw new Error("nesting too deep");
+	const initial = bytes[offset];
+	if (initial === void 0) throw new Error("truncated");
+	const major = initial >> 5;
+	const head = readHead(bytes, offset);
+	switch (major) {
+		case 0:
+		case 1:
+			if (head.value === -1n) throw new Error("malformed integer");
+			return head.next;
+		case 2:
+		case 3: {
+			if (head.value === -1n) {
+				let pos = head.next;
+				while (bytes[pos] !== 255) {
+					const chunk = readHead(bytes, pos);
+					if (chunk.value < 0n) throw new Error("malformed chunk");
+					pos = chunk.next + Number(chunk.value);
+					if (pos > bytes.length) throw new Error("truncated string");
+				}
+				return pos + 1;
+			}
+			const end = head.next + Number(head.value);
+			if (end > bytes.length) throw new Error("truncated string");
+			return end;
+		}
+		case 4:
+		case 5: {
+			const perEntry = major === 5 ? 2 : 1;
+			if (head.value === -1n) {
+				let pos = head.next;
+				while (bytes[pos] !== 255) for (let i = 0; i < perEntry; i++) pos = skipItem(bytes, pos, depth + 1);
+				return pos + 1;
+			}
+			let pos = head.next;
+			const count = Number(head.value) * perEntry;
+			if (count > 1e6) throw new Error("container too large");
+			for (let i = 0; i < count; i++) pos = skipItem(bytes, pos, depth + 1);
+			return pos;
+		}
+		case 6:
+			if (head.value === -1n) throw new Error("malformed tag");
+			return skipItem(bytes, head.next, depth + 1);
+		case 7:
+			if ((initial & 31) === 31) throw new Error("unexpected break");
+			if ((initial & 31) === 25) return offset + 3;
+			if ((initial & 31) === 26) return offset + 5;
+			if ((initial & 31) === 27) return offset + 9;
+			return head.next;
+		default: throw new Error("unreachable");
+	}
+}
+//#endregion
 //#region src/verify/evm.ts
 /** EIP-191: 0x19 || "Ethereum Signed Message:\n" || len(message). */
 function personalSignDigest(message) {
@@ -300,6 +448,144 @@ function verifySolanaSignature(args) {
 	return ok ? verified : failed("the signature does not belong to this account");
 }
 //#endregion
+//#region src/verify/ton-boc.ts
+/**
+* Minimal TON Bag-of-Cells reader + cell representation hash — exactly the
+* subset the device's signer implements: generic BoC, ordinary level-0 cells,
+* first root. The transaction digest the device signs IS the root cell's
+* representation hash, so this must agree with the firmware bit for bit.
+*
+* Hardened for scanned/untrusted input: size caps, bounds checks, and
+* forward-only references (the standard BoC topological order; a backward
+* reference would make the single-pass hash read an uncomputed child).
+*/
+const BOC_MAGIC = 3052313714;
+const MAX_CELLS = 256;
+const MAX_CELL_DATA_BYTES = 128;
+const MAX_REFS = 4;
+function err(message) {
+	return new EraSdkError("malformed-reply", `ton boc: ${message}`);
+}
+/** Representation hash of the ROOT cell of a BoC — the bytes TON signs. */
+function bocRootHash(boc) {
+	if (boc.length < 10) throw err("too short");
+	if ((boc[0] << 24 | boc[1] << 16 | boc[2] << 8 | boc[3]) >>> 0 !== BOC_MAGIC) throw err("not a generic BoC");
+	const flags = boc[4];
+	const hasIdx = flags >> 7 & 1;
+	const refSize = flags & 7;
+	const offSize = boc[5];
+	if (refSize === 0 || refSize > 4) throw err("bad ref size");
+	if (offSize === 0 || offSize > 8) throw err("bad offset size");
+	let pos = 6;
+	const readInt = (byteLen) => {
+		let value = 0;
+		for (let i = 0; i < byteLen; i++) {
+			if (pos >= boc.length) throw err("truncated header");
+			value = value * 256 + boc[pos++];
+		}
+		if (!Number.isSafeInteger(value)) throw err("header value out of range");
+		return value;
+	};
+	const cellCount = readInt(refSize);
+	const rootCount = readInt(refSize);
+	readInt(refSize);
+	readInt(offSize);
+	if (rootCount === 0) throw err("no roots");
+	if (cellCount === 0 || cellCount > MAX_CELLS) throw err("cell count out of range");
+	const rootIndex = readInt(refSize);
+	for (let i = 1; i < rootCount; i++) readInt(refSize);
+	if (rootIndex >= cellCount) throw err("root index out of range");
+	if (hasIdx) pos += cellCount * offSize;
+	const cells = [];
+	for (let i = 0; i < cellCount; i++) {
+		if (pos + 2 > boc.length) throw err("truncated cell");
+		const d1 = boc[pos++];
+		const d2 = boc[pos++];
+		const refCount = d1 & 7;
+		if (refCount > MAX_REFS) throw err("too many references");
+		const dataByteLen = d2 + 1 >> 1;
+		const incomplete = (d2 & 1) === 1;
+		if (dataByteLen > MAX_CELL_DATA_BYTES) throw err("cell data too large");
+		if (pos + dataByteLen > boc.length) throw err("truncated cell data");
+		const data = boc.slice(pos, pos + dataByteLen);
+		pos += dataByteLen;
+		let dataBits;
+		if (incomplete && dataByteLen > 0) {
+			const last = data[dataByteLen - 1];
+			if (last === 0) dataBits = (dataByteLen - 1) * 8;
+			else {
+				let trailingZeros = 0;
+				for (let b = 0; b < 8; b++) {
+					if (last & 1 << b) break;
+					trailingZeros++;
+				}
+				dataBits = dataByteLen * 8 - 1 - trailingZeros;
+			}
+		} else dataBits = dataByteLen * 8;
+		const refs = [];
+		for (let r = 0; r < refCount; r++) {
+			const ref = readInt(refSize);
+			if (ref >= cellCount) throw err("reference out of range");
+			if (ref <= i) throw err("non-topological cell reference");
+			refs.push(ref);
+		}
+		cells.push({
+			dataBits,
+			data,
+			refs,
+			depth: 0,
+			hash: /* @__PURE__ */ new Uint8Array(0)
+		});
+	}
+	for (let i = cellCount - 1; i >= 0; i--) {
+		const cell = cells[i];
+		let maxChildDepth = -1;
+		for (const r of cell.refs) maxChildDepth = Math.max(maxChildDepth, cells[r].depth);
+		cell.depth = cell.refs.length === 0 ? 0 : maxChildDepth + 1;
+		const dataBytes = cell.dataBits + 7 >> 3;
+		const incomplete = cell.dataBits % 8 !== 0;
+		const repr = [cell.refs.length, dataBytes * 2 - (incomplete ? 1 : 0)];
+		for (let b = 0; b < dataBytes; b++) repr.push(cell.data[b] ?? 0);
+		if (incomplete && dataBytes > 0) {
+			const shift = 7 - cell.dataBits % 8;
+			const last = repr.length - 1;
+			repr[last] = (repr[last] | 1 << shift) & 255 << shift & 255;
+		}
+		for (const r of cell.refs) repr.push(cells[r].depth >> 8 & 255, cells[r].depth & 255);
+		let bytes = new Uint8Array(repr);
+		for (const r of cell.refs) bytes = concatBytes(bytes, cells[r].hash);
+		cell.hash = sha256(bytes);
+	}
+	return cells[rootIndex].hash;
+}
+//#endregion
+//#region src/verify/ton.ts
+/**
+* Recompute the exact digest the device signs — the BoC ROOT CELL's
+* representation hash for a transaction, or the TON Connect proof digest
+* `sha256(0xFFFF || "ton-connect" || sha256(payload))` — and verify the
+* Ed25519 signature against the linked key.
+*/
+function verifyTonSignature(args) {
+	if (args.signature.length !== 64) return failed("signature must be 64 bytes");
+	if (args.publicKey.length !== 32) return failed("public key must be 32 bytes");
+	let digest;
+	if (args.dataType === TonDataType.tonProof) digest = sha256(concatBytes(new Uint8Array([255, 255]), utf8Encode("ton-connect"), sha256(args.signData)));
+	else if (args.dataType === TonDataType.transaction) try {
+		digest = bocRootHash(args.signData);
+	} catch (e) {
+		return failed(`signData is not a readable BoC: ${e.message}`);
+	}
+	else return failed(`unknown dataType ${args.dataType}`);
+	let ok;
+	try {
+		ok = ed25519.verify(args.signature, digest, args.publicKey);
+	} catch (e) {
+		return failed(`TON signature could not be checked: ${e.message}`);
+	}
+	return ok ? verified : failed("the signature does not belong to this account");
+}
+//#endregion
 //#region src/verify/tron.ts
 const base58check = createBase58check(sha256);
 /**
@@ -433,6 +719,6 @@ function compareWindow(repliedBytes, latestBlock) {
 	return verified;
 }
 //#endregion
-export { PsbtInputType, parsePsbt, verifyBtcMessageHeader, verifyEvmSignature, verifySignedPsbt, verifySolanaSignature, verifyTronSignature };
+export { PsbtInputType, bocRootHash, parsePsbt, verifyBtcMessageHeader, verifyCardanoSignature, verifyEvmSignature, verifySignedPsbt, verifySolanaSignature, verifyTonSignature, verifyTronSignature };
 
 //# sourceMappingURL=verify.js.map