@hwlt/era-connect 0.2.0 → 0.4.0

package/dist/verify.js

@@ -1,9 +1,14 @@
-import { A as utf8Encode, D as hexToBytes, E as equalBytes, T as concatBytes, Z as EraSdkError, k as utf8Decode, w as bytesToHex } from "./shared-B8Wc7ViU.js";
-import { n as EvmDataType, r as foldRecoveryId } from "./evm-kJb3-oiR.js";
-import { n as TonDataType } from "./ton-5Uvi5ifg.js";
-import { a as firstVarint, i as firstBytes, o as readFields, r as splitSignedTronTx } from "./messages-17Oup0-Z.js";
+import { A as utf8Encode, D as hexToBytes, E as equalBytes, K as EraSdkError, T as concatBytes, k as utf8Decode, w as bytesToHex } from "./shared-Bbgejrus.js";
+import { i as parsePath } from "./keypath-Bvv_cfHt.js";
+import { a as cardanoSoftDerivePath } from "./derive-CK9Nc9Jc.js";
+import { n as parseWitnessSet } from "./cardano-BCT55gwf.js";
+import { n as EvmDataType, r as foldRecoveryId } from "./evm-CI1cuZsp.js";
+import { n as suiIntentDigest } from "./sui-BtbPG6Xt.js";
+import { n as TonDataType } from "./ton-BSPKU5B9.js";
+import { a as firstVarint, i as firstBytes, o as readFields, r as splitSignedTronTx } from "./messages-DbnXy3dC.js";
 import { secp256k1 } from "@noble/curves/secp256k1";
-import { sha256 } from "@noble/hashes/sha2";
+import { blake2b } from "@noble/hashes/blake2b";
+import { sha256, sha512 } from "@noble/hashes/sha2";
 import { keccak_256 } from "@noble/hashes/sha3";
 import { createBase58check } from "@scure/base";
 import { ed25519 } from "@noble/curves/ed25519";
@@ -246,6 +251,165 @@ function message(e) {
 	return e instanceof EraSdkError || e instanceof Error ? e.message : String(e);
 }
 //#endregion
+//#region src/verify/cardano.ts
+/**
+* Recompute the digest the device signs — BLAKE2b-256 of the ENCODED FIRST
+* ELEMENT of the transaction CBOR array (the tx body) — and verify every
+* `[vkey, signature]` pair against it. With `account` + `signerPaths`, the
+* vkeys are additionally required to be exactly the soft-derived children of
+* YOUR linked account at the request's own paths.
+*/
+function verifyCardanoSignature(args) {
+	let witnesses;
+	try {
+		witnesses = args.witnesses ?? (args.witnessSet ? parseWitnessSet(args.witnessSet) : []);
+	} catch (e) {
+		return failed(`witness set is not readable: ${e.message}`);
+	}
+	if (witnesses.length === 0) return failed("no witnesses to verify");
+	let digest;
+	try {
+		digest = blake2b(firstArrayItemBytes(args.signData), { dkLen: 32 });
+	} catch (e) {
+		return failed(`signData is not a readable transaction array: ${e.message}`);
+	}
+	for (const witness of witnesses) {
+		let ok;
+		try {
+			ok = ed25519.verify(witness.signature, digest, witness.vkey);
+		} catch (e) {
+			return failed(`Cardano signature could not be checked: ${e.message}`);
+		}
+		if (!ok) return failed("a witness signature does not verify against its own vkey");
+	}
+	if (args.account && args.signerPaths && args.signerPaths.length > 0) {
+		const accountLevels = parsePath(args.account.accountPath);
+		const expected = /* @__PURE__ */ new Map();
+		for (const path of new Set(args.signerPaths)) {
+			const levels = parsePath(path);
+			if (levels.length !== accountLevels.length + 2 || !accountLevels.every((l, i) => levels[i].index === l.index && levels[i].hardened === l.hardened) || levels.slice(accountLevels.length).some((l) => l.hardened)) return failed(`signer path ${path} does not extend the account path with two soft components`);
+			const tail = levels.slice(accountLevels.length).map((l) => l.index);
+			const vkey = cardanoSoftDerivePath(args.account.publicKey, args.account.chainCode, tail);
+			expected.set(bytesToHex(vkey), path);
+		}
+		for (const [vkeyHex, path] of expected) if (!witnesses.some((w) => bytesToHex(w.vkey) === vkeyHex)) return failed(`no witness for the requested signer path ${path}`);
+		for (const witness of witnesses) if (!expected.has(bytesToHex(witness.vkey))) return failed("the witness set carries a key your request did not ask for");
+	}
+	return verified;
+}
+function firstArrayItemBytes(bytes) {
+	const top = bytes[0];
+	if (top === void 0) throw new Error("empty input");
+	if (top >> 5 !== 4) throw new Error("not a CBOR array");
+	let start;
+	if ((top & 31) === 31) start = 1;
+	else {
+		const head = readHead(bytes, 0);
+		if (head.value === 0n) throw new Error("transaction array is empty");
+		start = head.next;
+	}
+	const end = skipItem(bytes, start, 0);
+	return bytes.slice(start, end);
+}
+function readHead(bytes, offset) {
+	const initial = bytes[offset];
+	if (initial === void 0) throw new Error("truncated");
+	const info = initial & 31;
+	if (info < 24) return {
+		value: BigInt(info),
+		next: offset + 1
+	};
+	if (info === 31) return {
+		value: -1n,
+		next: offset + 1
+	};
+	let width;
+	if (info === 24) width = 1;
+	else if (info === 25) width = 2;
+	else if (info === 26) width = 4;
+	else if (info === 27) width = 8;
+	else throw new Error("reserved length encoding");
+	let value = 0n;
+	for (let i = 0; i < width; i++) {
+		const b = bytes[offset + 1 + i];
+		if (b === void 0) throw new Error("truncated");
+		value = value << 8n | BigInt(b);
+	}
+	return {
+		value,
+		next: offset + 1 + width
+	};
+}
+/** Returns the offset just past the item starting at `offset`. */
+function skipItem(bytes, offset, depth) {
+	if (depth > 32) throw new Error("nesting too deep");
+	const initial = bytes[offset];
+	if (initial === void 0) throw new Error("truncated");
+	const major = initial >> 5;
+	const head = readHead(bytes, offset);
+	switch (major) {
+		case 0:
+		case 1:
+			if (head.value === -1n) throw new Error("malformed integer");
+			return head.next;
+		case 2:
+		case 3: {
+			if (head.value === -1n) {
+				let pos = head.next;
+				while (bytes[pos] !== 255) {
+					const chunk = readHead(bytes, pos);
+					if (chunk.value < 0n) throw new Error("malformed chunk");
+					pos = chunk.next + Number(chunk.value);
+					if (pos > bytes.length) throw new Error("truncated string");
+				}
+				return pos + 1;
+			}
+			const end = head.next + Number(head.value);
+			if (end > bytes.length) throw new Error("truncated string");
+			return end;
+		}
+		case 4:
+		case 5: {
+			const perEntry = major === 5 ? 2 : 1;
+			if (head.value === -1n) {
+				let pos = head.next;
+				while (bytes[pos] !== 255) for (let i = 0; i < perEntry; i++) pos = skipItem(bytes, pos, depth + 1);
+				return pos + 1;
+			}
+			let pos = head.next;
+			const count = Number(head.value) * perEntry;
+			if (count > 1e6) throw new Error("container too large");
+			for (let i = 0; i < count; i++) pos = skipItem(bytes, pos, depth + 1);
+			return pos;
+		}
+		case 6:
+			if (head.value === -1n) throw new Error("malformed tag");
+			return skipItem(bytes, head.next, depth + 1);
+		case 7:
+			if ((initial & 31) === 31) throw new Error("unexpected break");
+			if ((initial & 31) === 25) return offset + 3;
+			if ((initial & 31) === 26) return offset + 5;
+			if ((initial & 31) === 27) return offset + 9;
+			return head.next;
+		default: throw new Error("unreachable");
+	}
+}
+//#endregion
+//#region src/verify/cosmos.ts
+function verifyCosmosSignature(args) {
+	if (args.signature.length !== 64) return failed("signature must be 64 bytes (compact r||s)");
+	if (args.publicKey.length !== 33) return failed("publicKey must be 33 bytes (compressed)");
+	if (args.expectedPublicKey !== void 0 && !equalBytes(args.publicKey, args.expectedPublicKey)) return failed("the reply public key is not the linked account key");
+	const digest = args.digest === "keccak256" ? keccak_256(args.signData) : sha256(args.signData);
+	let ok;
+	try {
+		ok = secp256k1.verify(args.signature, digest, args.publicKey);
+	} catch (e) {
+		return failed(`Cosmos signature could not be checked: ${e.message}`);
+	}
+	return ok ? verified : failed("the signature does not belong to this account");
+}
+//#endregion
 //#region src/verify/evm.ts
 /** EIP-191: 0x19 || "Ethereum Signed Message:\n" || len(message). */
 function personalSignDigest(message) {
@@ -301,6 +465,25 @@ function verifySolanaSignature(args) {
 	return ok ? verified : failed("the signature does not belong to this account");
 }
 //#endregion
+//#region src/verify/sui.ts
+/** BLAKE2b-256 of the intent message (or the given hash) + Ed25519 verification. */
+function verifySuiSignature(args) {
+	let digest;
+	if (args.messageHash !== void 0) {
+		if (args.messageHash.length !== 32) return failed("messageHash must be 32 bytes");
+		digest = args.messageHash;
+	} else if (args.intentMessage !== void 0) digest = suiIntentDigest(args.intentMessage);
+	else return failed("provide intentMessage or messageHash");
+	if (args.expectedPublicKey !== void 0 && !equalBytes(args.publicKey, args.expectedPublicKey)) return failed("the reply public key is not the linked account key");
+	let ok;
+	try {
+		ok = ed25519.verify(args.signature, digest, args.publicKey);
+	} catch (e) {
+		return failed(`Sui signature could not be checked: ${e.message}`);
+	}
+	return ok ? verified : failed("the signature does not belong to this account");
+}
+//#endregion
 //#region src/verify/ton-boc.ts
 /**
 * Minimal TON Bag-of-Cells reader + cell representation hash — exactly the
@@ -572,6 +755,150 @@ function compareWindow(repliedBytes, latestBlock) {
 	return verified;
 }
 //#endregion
-export { PsbtInputType, bocRootHash, parsePsbt, verifyBtcMessageHeader, verifyEvmSignature, verifySignedPsbt, verifySolanaSignature, verifyTonSignature, verifyTronSignature };
+//#region src/verify/xrp.ts
+/**
+* XRP has no request id — this check IS the binding. The signed binary is
+* split into its canonical fields; `TxnSignature` is removed; the remainder
+* (prefixed with the XRPL signing tag `STX\0`) is hashed with SHA-512-half
+* and the DER signature is verified against `SigningPubKey`, which must also
+* equal the key your request carried.
+*
+* The field walker covers the types Payment-class transactions use; a
+* transaction carrying an exotic field type comes back `checked: false`
+* rather than a false verdict.
+*/
+function verifyXrpSignature(args) {
+	let fields;
+	try {
+		fields = splitFields(args.signedTx);
+	} catch (e) {
+		const message = e.message;
+		if (message === "unsupported-field") return unverifiable("the transaction carries a field type this checker does not walk");
+		return failed(`the signed transaction is not readable: ${message}`);
+	}
+	const signingPubKey = fields.find((f) => f.header === 115);
+	const txnSignature = fields.find((f) => f.header === 116);
+	if (!signingPubKey || !txnSignature) return failed("the signed transaction is missing SigningPubKey or TxnSignature");
+	const expected = hexToBytes(args.expectedSigningPubKey);
+	if (!equalBytes(signingPubKey.value, expected)) return failed(`the transaction was signed with a different key (${bytesToHex(signingPubKey.value)})`);
+	const payload = concatBytes(new Uint8Array([
+		83,
+		84,
+		88,
+		0
+	]), ...fields.filter((f) => f.header !== 116).map((f) => f.raw));
+	const digest = sha512(payload).slice(0, 32);
+	let ok;
+	try {
+		ok = secp256k1.verify(secp256k1.Signature.fromDER(txnSignature.value).toCompactRawBytes(), digest, expected);
+	} catch (e) {
+		return failed(`XRP signature could not be checked: ${e.message}`);
+	}
+	return ok ? verified : failed("the signature does not verify against SigningPubKey");
+}
+/** Split a canonical STObject into its top-level fields. */
+function splitFields(bytes) {
+	const fields = [];
+	let pos = 0;
+	while (pos < bytes.length) {
+		const field = parseField(bytes, pos);
+		fields.push(field.field);
+		pos = field.end;
+	}
+	return fields;
+}
+/** Parse ONE field at `pos`; returns the field and the offset past it. */
+function parseField(bytes, pos) {
+	const start = pos;
+	const first = bytes[pos++];
+	if (first === void 0) throw new Error("truncated");
+	let type = first >> 4;
+	let fieldCode = first & 15;
+	if (type === 0) {
+		const t = bytes[pos++];
+		if (t === void 0) throw new Error("truncated type");
+		type = t;
+	}
+	if (fieldCode === 0) {
+		const f = bytes[pos++];
+		if (f === void 0) throw new Error("truncated field code");
+		fieldCode = f;
+	}
+	let valueStart = pos;
+	switch (type) {
+		case 1:
+			pos += 2;
+			break;
+		case 2:
+			pos += 4;
+			break;
+		case 5:
+			pos += 32;
+			break;
+		case 6: {
+			const head = bytes[pos];
+			if (head === void 0) throw new Error("truncated amount");
+			pos += (head & 128) !== 0 ? 48 : 8;
+			break;
+		}
+		case 7:
+		case 8: {
+			const vl = readVl(bytes, pos);
+			valueStart = vl.next;
+			pos = vl.next + vl.length;
+			break;
+		}
+		case 14:
+			while (bytes[pos] !== 225) {
+				if (pos >= bytes.length) throw new Error("unterminated inner object");
+				pos = parseField(bytes, pos).end;
+			}
+			pos += 1;
+			break;
+		case 15:
+			while (bytes[pos] !== 241) {
+				if (pos >= bytes.length) throw new Error("unterminated array");
+				pos = parseField(bytes, pos).end;
+			}
+			pos += 1;
+			break;
+		default: throw new Error("unsupported-field");
+	}
+	if (pos > bytes.length) throw new Error("truncated field");
+	return {
+		field: {
+			header: type << 4 | (fieldCode <= 15 ? fieldCode : 0),
+			value: bytes.slice(valueStart, pos),
+			raw: bytes.slice(start, pos)
+		},
+		end: pos
+	};
+}
+/** XRPL variable-length prefix. */
+function readVl(bytes, pos) {
+	const b1 = bytes[pos];
+	if (b1 === void 0) throw new Error("truncated length");
+	if (b1 <= 192) return {
+		length: b1,
+		next: pos + 1
+	};
+	if (b1 <= 240) {
+		const b2 = bytes[pos + 1];
+		if (b2 === void 0) throw new Error("truncated length");
+		return {
+			length: 193 + (b1 - 193) * 256 + b2,
+			next: pos + 2
+		};
+	}
+	const b2 = bytes[pos + 1];
+	const b3 = bytes[pos + 2];
+	if (b2 === void 0 || b3 === void 0) throw new Error("truncated length");
+	return {
+		length: 12481 + (b1 - 241) * 65536 + b2 * 256 + b3,
+		next: pos + 3
+	};
+}
+//#endregion
+export { PsbtInputType, bocRootHash, parsePsbt, verifyBtcMessageHeader, verifyCardanoSignature, verifyCosmosSignature, verifyEvmSignature, verifySignedPsbt, verifySolanaSignature, verifySuiSignature, verifyTonSignature, verifyTronSignature, verifyXrpSignature };
 
 //# sourceMappingURL=verify.js.map