@hwlt/era-connect 0.3.0 → 0.5.0

package/dist/verify.d.ts

@@ -24,6 +24,72 @@ type VerifyResult =
   readonly reason: string;
 };
 //#endregion
+//#region src/verify/bch.d.ts
+/**
+ * "The device signed exactly what I sent" for Bitcoin Cash.
+ *
+ * The reply on this chain is a COMPLETE broadcastable transaction, so the
+ * binding has to be rebuilt from it: every outpoint, every output script and
+ * value, and every input signature are checked against the request. The
+ * sighash is BIP-143 with `SIGHASH_FORKID` (0x41) — recomputed here from the
+ * request's own input values, which is also what makes a value lie visible:
+ * a wrong `value` in the request would fail right here, because the network
+ * would reject the same preimage.
+ */
+interface VerifyBchInput {
+  /** Display-order txid, 64 hex chars — as sent in the request. */
+  readonly txid: string;
+  readonly index: number;
+  /** UTXO value in satoshis — as sent in the request. */
+  readonly value: number | bigint;
+  /** The compressed public key the request named as the UTXO owner. */
+  readonly publicKey: Uint8Array | string;
+}
+interface VerifyBchOutput {
+  /** CashAddr as sent in the request (prefixed or bare). */
+  readonly address: string;
+  readonly value: number | bigint;
+}
+interface VerifyBchSignedTxArgs {
+  /** The reply's `rawTx` hex. */
+  readonly rawTx: string;
+  readonly inputs: readonly VerifyBchInput[];
+  readonly outputs: readonly VerifyBchOutput[];
+  /** The reply's `txId`, when you want it checked against the raw bytes too. */
+  readonly txId?: string;
+}
+interface DecodedInput {
+  readonly txidLE: Uint8Array;
+  readonly index: number;
+  readonly scriptSig: Uint8Array;
+  readonly sequence: number;
+}
+interface DecodedOutput {
+  readonly value: bigint;
+  readonly script: Uint8Array;
+}
+interface DecodedBchTx {
+  readonly version: number;
+  readonly inputs: readonly DecodedInput[];
+  readonly outputs: readonly DecodedOutput[];
+  readonly locktime: number;
+}
+/** Hardened reader for the legacy (non-witness) transaction serialization. */
+declare function decodeBchRawTx(rawTxHex: string): DecodedBchTx;
+/**
+ * BIP-143 sighash preimage with FORKID, exactly as consensus defines it:
+ * `version ‖ hashPrevouts ‖ hashSequence ‖ outpoint ‖ scriptCode ‖ value ‖
+ * sequence ‖ hashOutputs ‖ locktime ‖ hashType(LE)`, double-SHA256d.
+ */
+declare function computeBchSighash(args: {
+  readonly tx: DecodedBchTx;
+  readonly inputIndex: number;
+  readonly scriptCode: Uint8Array;
+  readonly value: bigint;
+  readonly hashType?: number;
+}): Uint8Array;
+declare function verifyBchSignedTx(args: VerifyBchSignedTxArgs): VerifyResult;
+//#endregion
 //#region src/verify/btc.d.ts
 interface VerifySignedPsbtArgs {
   /** The PSBT you sent to the device. */
@@ -94,6 +160,24 @@ interface VerifyCardanoSignatureArgs {
  */
 declare function verifyCardanoSignature(args: VerifyCardanoSignatureArgs): VerifyResult;
 //#endregion
+//#region src/verify/cosmos.d.ts
+interface VerifyCosmosSignatureArgs {
+  /** The exact SignDoc bytes the request carried. */
+  readonly signData: Uint8Array;
+  /**
+   * Digest family: vanilla Cosmos zones hash with sha256; Ethermint chains
+   * (Injective, Evmos, Dymension) with keccak256.
+   */
+  readonly digest: 'sha256' | 'keccak256';
+  /** 64-byte compact signature from the reply. */
+  readonly signature: Uint8Array;
+  /** 33-byte compressed public key (from the reply, or derived from your linked xpub). */
+  readonly publicKey: Uint8Array;
+  /** Optional binding: the key you EXPECT (derived from the linked account). */
+  readonly expectedPublicKey?: Uint8Array;
+}
+declare function verifyCosmosSignature(args: VerifyCosmosSignatureArgs): VerifyResult;
+//#endregion
 //#region src/verify/evm.d.ts
 interface VerifyEvmSignatureArgs {
   /** The exact bytes the request carried in `signData`. */
@@ -168,6 +252,21 @@ interface VerifySolanaSignatureArgs {
 }
 declare function verifySolanaSignature(args: VerifySolanaSignatureArgs): VerifyResult;
 //#endregion
+//#region src/verify/sui.d.ts
+interface VerifySuiSignatureArgs {
+  /** The intent message the request carried (or pass `messageHash` for the hash variant). */
+  readonly intentMessage?: Uint8Array;
+  readonly messageHash?: Uint8Array;
+  /** 64-byte Ed25519 signature from the reply. */
+  readonly signature: Uint8Array;
+  /** The signer key the reply carried. */
+  readonly publicKey: Uint8Array;
+  /** The linked account's key (`accounts.sui()[i].publicKey`) — binds the reply to YOUR wallet. */
+  readonly expectedPublicKey?: Uint8Array;
+}
+/** BLAKE2b-256 of the intent message (or the given hash) + Ed25519 verification. */
+declare function verifySuiSignature(args: VerifySuiSignatureArgs): VerifyResult;
+//#endregion
 //#region src/verify/ton.d.ts
 interface VerifyTonSignatureArgs {
   /** The exact bytes the request carried in `signData`. */
@@ -213,5 +312,25 @@ interface VerifyTronSignatureArgs {
  */
 declare function verifyTronSignature(args: VerifyTronSignatureArgs): VerifyResult;
 //#endregion
-export { type ParsedPsbt, PsbtInputType, type PsbtKeyValue, type VerifyBtcMessageHeaderArgs, type VerifyCardanoSignatureArgs, type VerifyEvmSignatureArgs, type VerifyResult, type VerifySignedPsbtArgs, type VerifySolanaSignatureArgs, type VerifyTonSignatureArgs, type VerifyTronSignatureArgs, bocRootHash, parsePsbt, verifyBtcMessageHeader, verifyCardanoSignature, verifyEvmSignature, verifySignedPsbt, verifySolanaSignature, verifyTonSignature, verifyTronSignature };
+//#region src/verify/xrp.d.ts
+interface VerifyXrpSignatureArgs {
+  /** The signed binary transaction from the reply. */
+  readonly signedTx: Uint8Array;
+  /** The `SigningPubKey` hex your request JSON carried (33-byte compressed secp256k1). */
+  readonly expectedSigningPubKey: string;
+}
+/**
+ * XRP has no request id — this check IS the binding. The signed binary is
+ * split into its canonical fields; `TxnSignature` is removed; the remainder
+ * (prefixed with the XRPL signing tag `STX\0`) is hashed with SHA-512-half
+ * and the DER signature is verified against `SigningPubKey`, which must also
+ * equal the key your request carried.
+ *
+ * The field walker covers the types Payment-class transactions use; a
+ * transaction carrying an exotic field type comes back `checked: false`
+ * rather than a false verdict.
+ */
+declare function verifyXrpSignature(args: VerifyXrpSignatureArgs): VerifyResult;
+//#endregion
+export { type DecodedBchTx, type ParsedPsbt, PsbtInputType, type PsbtKeyValue, type VerifyBchInput, type VerifyBchOutput, type VerifyBchSignedTxArgs, type VerifyBtcMessageHeaderArgs, type VerifyCardanoSignatureArgs, type VerifyCosmosSignatureArgs, type VerifyEvmSignatureArgs, type VerifyResult, type VerifySignedPsbtArgs, type VerifySolanaSignatureArgs, type VerifySuiSignatureArgs, type VerifyTonSignatureArgs, type VerifyTronSignatureArgs, type VerifyXrpSignatureArgs, bocRootHash, computeBchSighash, decodeBchRawTx, parsePsbt, verifyBchSignedTx, verifyBtcMessageHeader, verifyCardanoSignature, verifyCosmosSignature, verifyEvmSignature, verifySignedPsbt, verifySolanaSignature, verifySuiSignature, verifyTonSignature, verifyTronSignature, verifyXrpSignature };
 //# sourceMappingURL=verify.d.ts.map

package/dist/verify.js

@@ -1,15 +1,236 @@
-import { A as utf8Encode, D as hexToBytes, E as equalBytes, P as parsePath, T as concatBytes, Z as EraSdkError, k as utf8Decode, w as bytesToHex } from "./shared-B8Wc7ViU.js";
-import { a as cardanoSoftDerivePath } from "./derive-C4JdycUh.js";
-import { n as parseWitnessSet } from "./cardano-yuOygqwp.js";
-import { n as EvmDataType, r as foldRecoveryId } from "./evm-kJb3-oiR.js";
-import { n as TonDataType } from "./ton-5Uvi5ifg.js";
-import { a as firstVarint, i as firstBytes, o as readFields, r as splitSignedTronTx } from "./messages-17Oup0-Z.js";
+import { A as utf8Encode, D as hexToBytes, E as equalBytes, K as EraSdkError, T as concatBytes, k as utf8Decode, w as bytesToHex } from "./shared-Bbgejrus.js";
+import { i as parsePath } from "./keypath-Bvv_cfHt.js";
+import { n as decodeCashAddr } from "./cashaddr-BIzawizX.js";
+import { o as cardanoSoftDerivePath } from "./derive-00JUOkmn.js";
+import { n as parseWitnessSet } from "./cardano-BCT55gwf.js";
+import { a as firstBytes, i as splitSignedTronTx, o as firstVarint, s as readFields } from "./messages--XbVef_k.js";
+import { n as EvmDataType, r as foldRecoveryId } from "./evm-CI1cuZsp.js";
+import { n as suiIntentDigest } from "./sui-BtbPG6Xt.js";
+import { n as TonDataType } from "./ton-BSPKU5B9.js";
 import { secp256k1 } from "@noble/curves/secp256k1";
-import { sha256 } from "@noble/hashes/sha2";
+import { blake2b } from "@noble/hashes/blake2b";
+import { ripemd160 } from "@noble/hashes/ripemd160";
+import { sha256, sha512 } from "@noble/hashes/sha2";
 import { keccak_256 } from "@noble/hashes/sha3";
 import { createBase58check } from "@scure/base";
 import { ed25519 } from "@noble/curves/ed25519";
-import { blake2b } from "@noble/hashes/blake2b";
+//#region src/verify/result.ts
+const verified = {
+	ok: true,
+	checked: true
+};
+const failed = (reason) => ({
+	ok: false,
+	reason
+});
+const unverifiable = (reason) => ({
+	ok: true,
+	checked: false,
+	reason
+});
+//#endregion
+//#region src/verify/bch.ts
+const SIGHASH_FORKID_ALL = 65;
+const BCH_TX_VERSION = 1;
+const BCH_TX_LOCKTIME = 0;
+const BCH_TX_SEQUENCE = 4294967293;
+/** Hardened reader for the legacy (non-witness) transaction serialization. */
+function decodeBchRawTx(rawTxHex) {
+	let bytes;
+	try {
+		bytes = hexToBytes(rawTxHex);
+	} catch {
+		throw new EraSdkError("malformed-reply", "signed transaction is not hex");
+	}
+	let offset = 0;
+	const need = (n) => {
+		if (offset + n > bytes.length) throw new EraSdkError("malformed-reply", "signed transaction is truncated");
+	};
+	const readU32 = () => {
+		need(4);
+		const v = bytes[offset] | bytes[offset + 1] << 8 | bytes[offset + 2] << 16 | bytes[offset + 3] << 24;
+		offset += 4;
+		return v >>> 0;
+	};
+	const readU64 = () => {
+		need(8);
+		let v = 0n;
+		for (let i = 7; i >= 0; i--) v = v << 8n | BigInt(bytes[offset + i]);
+		offset += 8;
+		return v;
+	};
+	const readVarint = () => {
+		need(1);
+		const first = bytes[offset++];
+		if (first < 253) return first;
+		if (first === 253) {
+			need(2);
+			const v = bytes[offset] | bytes[offset + 1] << 8;
+			offset += 2;
+			return v;
+		}
+		throw new EraSdkError("malformed-reply", "unreasonable varint in signed transaction");
+	};
+	const readSlice = (n) => {
+		need(n);
+		const s = bytes.subarray(offset, offset + n);
+		offset += n;
+		return s;
+	};
+	const version = readU32();
+	const inputCount = readVarint();
+	if (inputCount === 0 || inputCount > 1e3) throw new EraSdkError("malformed-reply", "unreasonable input count in signed transaction");
+	const inputs = [];
+	for (let i = 0; i < inputCount; i++) {
+		const txidLE = readSlice(32);
+		const index = readU32();
+		const scriptSig = readSlice(readVarint());
+		const sequence = readU32();
+		inputs.push({
+			txidLE,
+			index,
+			scriptSig,
+			sequence
+		});
+	}
+	const outputCount = readVarint();
+	if (outputCount === 0 || outputCount > 1e3) throw new EraSdkError("malformed-reply", "unreasonable output count in signed transaction");
+	const outputs = [];
+	for (let i = 0; i < outputCount; i++) {
+		const value = readU64();
+		const script = readSlice(readVarint());
+		outputs.push({
+			value,
+			script
+		});
+	}
+	const locktime = readU32();
+	if (offset !== bytes.length) throw new EraSdkError("malformed-reply", "trailing bytes after signed transaction");
+	return {
+		version,
+		inputs,
+		outputs,
+		locktime
+	};
+}
+function sha256d(data) {
+	return sha256(sha256(data));
+}
+function hash160(data) {
+	return ripemd160(sha256(data));
+}
+function p2pkhScript(pubkeyHash) {
+	return concatBytes(new Uint8Array([
+		118,
+		169,
+		20
+	]), pubkeyHash, new Uint8Array([136, 172]));
+}
+function p2shScript(scriptHash) {
+	return concatBytes(new Uint8Array([169, 20]), scriptHash, new Uint8Array([135]));
+}
+function scriptForAddress(address) {
+	const decoded = decodeCashAddr(address);
+	return decoded.type === "p2pkh" ? p2pkhScript(decoded.hash) : p2shScript(decoded.hash);
+}
+function le32(value) {
+	return new Uint8Array([
+		value & 255,
+		value >>> 8 & 255,
+		value >>> 16 & 255,
+		value >>> 24 & 255
+	]);
+}
+function le64(value) {
+	const out = /* @__PURE__ */ new Uint8Array(8);
+	let v = value;
+	for (let i = 0; i < 8; i++) {
+		out[i] = Number(v & 255n);
+		v >>= 8n;
+	}
+	return out;
+}
+function varintBytes(value) {
+	if (value < 253) return new Uint8Array([value]);
+	return new Uint8Array([
+		253,
+		value & 255,
+		value >>> 8 & 255
+	]);
+}
+/**
+* BIP-143 sighash preimage with FORKID, exactly as consensus defines it:
+* `version ‖ hashPrevouts ‖ hashSequence ‖ outpoint ‖ scriptCode ‖ value ‖
+* sequence ‖ hashOutputs ‖ locktime ‖ hashType(LE)`, double-SHA256d.
+*/
+function computeBchSighash(args) {
+	const { tx, inputIndex, scriptCode, value } = args;
+	const hashType = args.hashType ?? SIGHASH_FORKID_ALL;
+	const input = tx.inputs[inputIndex];
+	if (!input) throw new EraSdkError("invalid-props", "sighash input index out of range");
+	const hashPrevouts = sha256d(concatBytes(...tx.inputs.map((i) => concatBytes(i.txidLE, le32(i.index)))));
+	const hashSequence = sha256d(concatBytes(...tx.inputs.map((i) => le32(i.sequence))));
+	const hashOutputs = sha256d(concatBytes(...tx.outputs.map((o) => concatBytes(le64(o.value), varintBytes(o.script.length), o.script))));
+	return sha256d(concatBytes(le32(tx.version), hashPrevouts, hashSequence, input.txidLE, le32(input.index), varintBytes(scriptCode.length), scriptCode, le64(value), le32(input.sequence), hashOutputs, le32(tx.locktime), le32(hashType)));
+}
+function toBigintValue(value, label) {
+	const v = typeof value === "number" ? BigInt(value) : value;
+	if (v <= 0n) throw new EraSdkError("invalid-props", `${label} must be positive`);
+	return v;
+}
+function toPublicKeyBytes(publicKey) {
+	return typeof publicKey === "string" ? hexToBytes(publicKey) : publicKey;
+}
+function verifyBchSignedTx(args) {
+	try {
+		const tx = decodeBchRawTx(args.rawTx);
+		if (tx.version !== BCH_TX_VERSION || tx.locktime !== BCH_TX_LOCKTIME) return failed(`transaction parameters (version ${tx.version}, locktime ${tx.locktime}) are not the device signer's (1, 0)`);
+		for (let i = 0; i < tx.inputs.length; i++) if (tx.inputs[i].sequence !== BCH_TX_SEQUENCE) return failed(`input ${i} sequence is not the device signer's 0xfffffffd`);
+		if (tx.inputs.length !== args.inputs.length) return failed(`signed transaction has ${tx.inputs.length} inputs, the request had ${args.inputs.length}`);
+		if (tx.outputs.length !== args.outputs.length) return failed(`signed transaction has ${tx.outputs.length} outputs, the request had ${args.outputs.length}`);
+		for (let i = 0; i < args.outputs.length; i++) {
+			const requested = args.outputs[i];
+			const actual = tx.outputs[i];
+			if (actual.value !== toBigintValue(requested.value, `output ${i} value`)) return failed(`output ${i} value differs from the request`);
+			if (!equalBytes(actual.script, scriptForAddress(requested.address))) return failed(`output ${i} does not pay the requested address`);
+		}
+		for (let i = 0; i < args.inputs.length; i++) {
+			const requested = args.inputs[i];
+			const actual = tx.inputs[i];
+			const txidLE = hexToBytes(requested.txid).reverse();
+			if (!equalBytes(actual.txidLE, txidLE) || actual.index !== requested.index) return failed(`input ${i} spends a different outpoint than the request named`);
+			const script = actual.scriptSig;
+			if (script.length < 2) return failed(`input ${i} has no signature`);
+			const sigLen = script[0];
+			if (sigLen < 9 || 1 + sigLen + 1 > script.length) return failed(`input ${i} scriptSig is not a signature push`);
+			const sigWithType = script.subarray(1, 1 + sigLen);
+			const pubLen = script[1 + sigLen];
+			if (pubLen !== 33 || 1 + sigLen + 1 + pubLen !== script.length) return failed(`input ${i} scriptSig does not end with a compressed public key push`);
+			const pubkey = script.subarray(1 + sigLen + 1);
+			if (!equalBytes(pubkey, toPublicKeyBytes(requested.publicKey))) return failed(`input ${i} was signed with a different public key than the request named — the transaction cannot spend the requested UTXO`);
+			const hashType = sigWithType[sigWithType.length - 1];
+			if (hashType !== SIGHASH_FORKID_ALL) return failed(`input ${i} uses sighash 0x${hashType.toString(16)}, expected SIGHASH_ALL|FORKID (0x41)`);
+			const sighash = computeBchSighash({
+				tx,
+				inputIndex: i,
+				scriptCode: p2pkhScript(hash160(pubkey)),
+				value: toBigintValue(requested.value, `input ${i} value`)
+			});
+			const signature = secp256k1.Signature.fromDER(sigWithType.subarray(0, sigWithType.length - 1)).toCompactRawBytes();
+			if (!secp256k1.verify(signature, sighash, pubkey)) return failed(`input ${i} signature does not verify against the BIP-143 FORKID sighash`);
+		}
+		if (args.txId !== void 0) {
+			if (bytesToHex(sha256d(hexToBytes(args.rawTx)).reverse()) !== args.txId.toLowerCase()) return failed("reply txId does not match the hash of the signed transaction");
+		}
+		return verified;
+	} catch (e) {
+		return failed(message$1(e));
+	}
+}
+function message$1(e) {
+	return e instanceof EraSdkError || e instanceof Error ? e.message : String(e);
+}
+//#endregion
 //#region src/verify/psbt-reader.ts
 const MAGIC = [
 	112,
@@ -148,21 +369,6 @@ function inputHas(psbt, index, keyType) {
 	return inputEntries(psbt, index, keyType).length > 0;
 }
 //#endregion
-//#region src/verify/result.ts
-const verified = {
-	ok: true,
-	checked: true
-};
-const failed = (reason) => ({
-	ok: false,
-	reason
-});
-const unverifiable = (reason) => ({
-	ok: true,
-	checked: false,
-	reason
-});
-//#endregion
 //#region src/verify/btc.ts
 /**
 * The `crypto-psbt` reply carries NO request id — this comparison IS the
@@ -393,6 +599,21 @@ function skipItem(bytes, offset, depth) {
 	}
 }
 //#endregion
+//#region src/verify/cosmos.ts
+function verifyCosmosSignature(args) {
+	if (args.signature.length !== 64) return failed("signature must be 64 bytes (compact r||s)");
+	if (args.publicKey.length !== 33) return failed("publicKey must be 33 bytes (compressed)");
+	if (args.expectedPublicKey !== void 0 && !equalBytes(args.publicKey, args.expectedPublicKey)) return failed("the reply public key is not the linked account key");
+	const digest = args.digest === "keccak256" ? keccak_256(args.signData) : sha256(args.signData);
+	let ok;
+	try {
+		ok = secp256k1.verify(args.signature, digest, args.publicKey);
+	} catch (e) {
+		return failed(`Cosmos signature could not be checked: ${e.message}`);
+	}
+	return ok ? verified : failed("the signature does not belong to this account");
+}
+//#endregion
 //#region src/verify/evm.ts
 /** EIP-191: 0x19 || "Ethereum Signed Message:\n" || len(message). */
 function personalSignDigest(message) {
@@ -448,6 +669,25 @@ function verifySolanaSignature(args) {
 	return ok ? verified : failed("the signature does not belong to this account");
 }
 //#endregion
+//#region src/verify/sui.ts
+/** BLAKE2b-256 of the intent message (or the given hash) + Ed25519 verification. */
+function verifySuiSignature(args) {
+	let digest;
+	if (args.messageHash !== void 0) {
+		if (args.messageHash.length !== 32) return failed("messageHash must be 32 bytes");
+		digest = args.messageHash;
+	} else if (args.intentMessage !== void 0) digest = suiIntentDigest(args.intentMessage);
+	else return failed("provide intentMessage or messageHash");
+	if (args.expectedPublicKey !== void 0 && !equalBytes(args.publicKey, args.expectedPublicKey)) return failed("the reply public key is not the linked account key");
+	let ok;
+	try {
+		ok = ed25519.verify(args.signature, digest, args.publicKey);
+	} catch (e) {
+		return failed(`Sui signature could not be checked: ${e.message}`);
+	}
+	return ok ? verified : failed("the signature does not belong to this account");
+}
+//#endregion
 //#region src/verify/ton-boc.ts
 /**
 * Minimal TON Bag-of-Cells reader + cell representation hash — exactly the
@@ -719,6 +959,150 @@ function compareWindow(repliedBytes, latestBlock) {
 	return verified;
 }
 //#endregion
-export { PsbtInputType, bocRootHash, parsePsbt, verifyBtcMessageHeader, verifyCardanoSignature, verifyEvmSignature, verifySignedPsbt, verifySolanaSignature, verifyTonSignature, verifyTronSignature };
+//#region src/verify/xrp.ts
+/**
+* XRP has no request id — this check IS the binding. The signed binary is
+* split into its canonical fields; `TxnSignature` is removed; the remainder
+* (prefixed with the XRPL signing tag `STX\0`) is hashed with SHA-512-half
+* and the DER signature is verified against `SigningPubKey`, which must also
+* equal the key your request carried.
+*
+* The field walker covers the types Payment-class transactions use; a
+* transaction carrying an exotic field type comes back `checked: false`
+* rather than a false verdict.
+*/
+function verifyXrpSignature(args) {
+	let fields;
+	try {
+		fields = splitFields(args.signedTx);
+	} catch (e) {
+		const message = e.message;
+		if (message === "unsupported-field") return unverifiable("the transaction carries a field type this checker does not walk");
+		return failed(`the signed transaction is not readable: ${message}`);
+	}
+	const signingPubKey = fields.find((f) => f.header === 115);
+	const txnSignature = fields.find((f) => f.header === 116);
+	if (!signingPubKey || !txnSignature) return failed("the signed transaction is missing SigningPubKey or TxnSignature");
+	const expected = hexToBytes(args.expectedSigningPubKey);
+	if (!equalBytes(signingPubKey.value, expected)) return failed(`the transaction was signed with a different key (${bytesToHex(signingPubKey.value)})`);
+	const payload = concatBytes(new Uint8Array([
+		83,
+		84,
+		88,
+		0
+	]), ...fields.filter((f) => f.header !== 116).map((f) => f.raw));
+	const digest = sha512(payload).slice(0, 32);
+	let ok;
+	try {
+		ok = secp256k1.verify(secp256k1.Signature.fromDER(txnSignature.value).toCompactRawBytes(), digest, expected);
+	} catch (e) {
+		return failed(`XRP signature could not be checked: ${e.message}`);
+	}
+	return ok ? verified : failed("the signature does not verify against SigningPubKey");
+}
+/** Split a canonical STObject into its top-level fields. */
+function splitFields(bytes) {
+	const fields = [];
+	let pos = 0;
+	while (pos < bytes.length) {
+		const field = parseField(bytes, pos);
+		fields.push(field.field);
+		pos = field.end;
+	}
+	return fields;
+}
+/** Parse ONE field at `pos`; returns the field and the offset past it. */
+function parseField(bytes, pos) {
+	const start = pos;
+	const first = bytes[pos++];
+	if (first === void 0) throw new Error("truncated");
+	let type = first >> 4;
+	let fieldCode = first & 15;
+	if (type === 0) {
+		const t = bytes[pos++];
+		if (t === void 0) throw new Error("truncated type");
+		type = t;
+	}
+	if (fieldCode === 0) {
+		const f = bytes[pos++];
+		if (f === void 0) throw new Error("truncated field code");
+		fieldCode = f;
+	}
+	let valueStart = pos;
+	switch (type) {
+		case 1:
+			pos += 2;
+			break;
+		case 2:
+			pos += 4;
+			break;
+		case 5:
+			pos += 32;
+			break;
+		case 6: {
+			const head = bytes[pos];
+			if (head === void 0) throw new Error("truncated amount");
+			pos += (head & 128) !== 0 ? 48 : 8;
+			break;
+		}
+		case 7:
+		case 8: {
+			const vl = readVl(bytes, pos);
+			valueStart = vl.next;
+			pos = vl.next + vl.length;
+			break;
+		}
+		case 14:
+			while (bytes[pos] !== 225) {
+				if (pos >= bytes.length) throw new Error("unterminated inner object");
+				pos = parseField(bytes, pos).end;
+			}
+			pos += 1;
+			break;
+		case 15:
+			while (bytes[pos] !== 241) {
+				if (pos >= bytes.length) throw new Error("unterminated array");
+				pos = parseField(bytes, pos).end;
+			}
+			pos += 1;
+			break;
+		default: throw new Error("unsupported-field");
+	}
+	if (pos > bytes.length) throw new Error("truncated field");
+	return {
+		field: {
+			header: type << 4 | (fieldCode <= 15 ? fieldCode : 0),
+			value: bytes.slice(valueStart, pos),
+			raw: bytes.slice(start, pos)
+		},
+		end: pos
+	};
+}
+/** XRPL variable-length prefix. */
+function readVl(bytes, pos) {
+	const b1 = bytes[pos];
+	if (b1 === void 0) throw new Error("truncated length");
+	if (b1 <= 192) return {
+		length: b1,
+		next: pos + 1
+	};
+	if (b1 <= 240) {
+		const b2 = bytes[pos + 1];
+		if (b2 === void 0) throw new Error("truncated length");
+		return {
+			length: 193 + (b1 - 193) * 256 + b2,
+			next: pos + 2
+		};
+	}
+	const b2 = bytes[pos + 1];
+	const b3 = bytes[pos + 2];
+	if (b2 === void 0 || b3 === void 0) throw new Error("truncated length");
+	return {
+		length: 12481 + (b1 - 241) * 65536 + b2 * 256 + b3,
+		next: pos + 3
+	};
+}
+//#endregion
+export { PsbtInputType, bocRootHash, computeBchSighash, decodeBchRawTx, parsePsbt, verifyBchSignedTx, verifyBtcMessageHeader, verifyCardanoSignature, verifyCosmosSignature, verifyEvmSignature, verifySignedPsbt, verifySolanaSignature, verifySuiSignature, verifyTonSignature, verifyTronSignature, verifyXrpSignature };
 
 //# sourceMappingURL=verify.js.map