@kaspacom/kcc20-tx-builder 0.5.0 → 0.6.0

package/src/profile-transfer.ts

@@ -0,0 +1,425 @@
+import {
+  authenticateTokenArtifact,
+  requireTokenCapability,
+  resolveAuthenticatedTokenProfile,
+  type AuthenticatedTokenProfileRegistry,
+} from "./token-profiles.js";
+import {
+  buildKcc20ScriptForState,
+  encodeKcc20StateRecordArrays,
+} from "./abi.js";
+import {
+  planTokenOwnerWitness,
+  buildTokenBorrowWitness,
+  type TokenSigningCapabilities,
+} from "./token-authorization.js";
+
+export interface ProfileTokenState {
+  amount: bigint;
+  owner: Uint8Array;
+  ownerScheme: number;
+  borrowScheme: number;
+  borrowGuard: Uint8Array;
+  extensionCommitment: Uint8Array;
+}
+export interface ProfileTransferInput {
+  /** A current, authenticated RPC UTXO. This API does not fetch chain state. */
+  entry: any;
+  state: ProfileTokenState;
+  publicKey?: string;
+  authorityInputIndex?: number;
+}
+export interface ProfileAuthorityInput {
+  entry: any;
+  revealScript: Uint8Array;
+  /** Exact authority witness, supplied by its reviewed authority adapter. */
+  arguments: Array<
+    | { type: "data"; hex: string }
+    | { type: "i64"; value: string }
+    | { type: "signature"; prefixHex?: string }
+  >;
+  signatureAlgorithm?: "schnorr" | "ecdsa";
+}
+export interface ProfileTransferPlan {
+  /** Host-authenticated registry input; never populate this from transaction request data. */
+  tokenProfileRegistry: AuthenticatedTokenProfileRegistry;
+  profileId: string;
+  artifact: unknown;
+  tokenInputs: ProfileTransferInput[];
+  nextStates: ProfileTokenState[];
+  authorities?: ProfileAuthorityInput[];
+  fundingEntry: any;
+  fundingAddress: string;
+  feeSompi: bigint;
+  network: string;
+  tokenOutputSompi?: bigint;
+  capabilities: TokenSigningCapabilities;
+  mode: "owner" | "borrow";
+  borrow?: {
+    nextGuard?: string;
+    oneTimePublicKey?: string;
+    signingPublicKey?: string;
+  };
+}
+const hex = (v: Uint8Array) =>
+  Array.from(v, (b) => b.toString(16).padStart(2, "0")).join("");
+const amount = (e: any) =>
+  BigInt(e.amount ?? e.entry?.amount ?? e.utxoEntry?.amount);
+const spk = (e: any) =>
+  e.scriptPublicKey ?? e.entry?.scriptPublicKey ?? e.utxoEntry?.scriptPublicKey;
+const cid = (e: any): string | undefined => {
+  const c = e.covenantId ?? e.entry?.covenantId ?? e.utxoEntry?.covenantId;
+  return c == null ? undefined : String(c).toLowerCase();
+};
+const outpoint = (e: any) => e.outpoint ?? e.entry?.outpoint;
+const assert = (ok: unknown, message: string) => {
+  if (!ok) throw Error(message);
+};
+
+/**
+ * Deterministic standard transfer construction for explicit authority/borrow flows.
+ * Callers authenticate RPC freshness and canonical acceptance before signing.
+ * Authority continuations preserve their script, value and covenant identity.
+ */
+export function buildProfileTransferTransaction(
+  kw: any,
+  plan: ProfileTransferPlan,
+): any {
+  const profile = resolveAuthenticatedTokenProfile(
+    plan.tokenProfileRegistry,
+    plan.profileId,
+  );
+  const { tokenInputs, nextStates } = plan;
+  requireTokenCapability(
+    profile,
+    plan.mode === "borrow" ? "borrow" : "transfer",
+  );
+  assert(
+    plan.mode === "owner" || plan.mode === "borrow",
+    "explicit owner or borrow mode is required",
+  );
+  const artifact = authenticateTokenArtifact(profile, plan.artifact);
+  assert(
+    tokenInputs.length > 0 && tokenInputs.length <= profile.maxTokenInputs,
+    "token input bound exceeded",
+  );
+  assert(
+    nextStates.length > 0 && nextStates.length <= profile.maxTokenOutputs,
+    "token output bound exceeded",
+  );
+  assert(
+    plan.feeSompi >= 0n && plan.feeSompi <= 50_000_000n,
+    "fee exceeds transaction limit",
+  );
+  const tokenId = cid(tokenInputs[0].entry);
+  assert(
+    tokenId && /^[0-9a-f]{64}$/.test(tokenId),
+    "native token identity is required",
+  );
+  const extension = hex(tokenInputs[0].state.extensionCommitment);
+  let total = 0n;
+  for (const input of tokenInputs) {
+    assert(cid(input.entry) === tokenId, "mixed native token identities");
+    assert(
+      input.state.amount >= 0n &&
+        hex(input.state.extensionCommitment) === extension,
+      "invalid input amount or extension",
+    );
+    total += input.state.amount;
+    const expected = kw.payToScriptHashScript(
+      buildKcc20ScriptForState(artifact, input.state),
+    );
+    assert(
+      kw.addressFromScriptPublicKey(expected, plan.network).toString() ===
+        kw
+          .addressFromScriptPublicKey(spk(input.entry), plan.network)
+          .toString(),
+      "token input script does not authenticate its state",
+    );
+  }
+  assert(total <= 0x7fffffffffffffffn, "transfer total exceeds integer limit");
+  for (const state of nextStates) {
+    assert(
+      state.amount >= 0n && hex(state.extensionCommitment) === extension,
+      "invalid output amount or extension",
+    );
+    assert(
+      profile.ownerSchemes.includes(state.ownerScheme) &&
+        [0, 1, 2, 3].includes(state.borrowScheme),
+      "unsupported output owner or borrow scheme",
+    );
+  }
+  assert(
+    nextStates.reduce((sum, s) => sum + s.amount, 0n) === total,
+    "token conservation failed",
+  );
+  const authorities = plan.authorities ?? [];
+  assert(
+    authorities.length <= 255 - tokenInputs.length,
+    "too many authority inputs",
+  );
+  const authorityEvidence = authorities.map((a, i) => {
+    assert(
+      a.revealScript.length > 0 && a.revealScript.length <= 100_000,
+      "invalid authority reveal size",
+    );
+    const expected = kw.payToScriptHashScript(a.revealScript);
+    assert(
+      kw.addressFromScriptPublicKey(expected, plan.network).toString() ===
+        kw.addressFromScriptPublicKey(spk(a.entry), plan.network).toString(),
+      "authority reveal does not match its RPC output",
+    );
+    assert(
+      cid(a.entry) !== tokenId,
+      "token family inputs must be listed as token inputs",
+    );
+    assert(a.arguments.length <= 128, "authority witness exceeds limit");
+    for (const arg of a.arguments) {
+      assert(
+        ["data", "i64", "signature"].includes(arg.type),
+        "unsupported authority witness argument",
+      );
+      if (arg.type === "data")
+        assert(
+          /^(?:[a-f0-9]{2})*$/i.test(arg.hex) && arg.hex.length <= 200_000,
+          "invalid authority witness data",
+        );
+      if (arg.type === "i64")
+        assert(
+          /^-?\d+$/.test(arg.value) &&
+            BigInt(arg.value) >= -0x7fffffffffffffffn &&
+            BigInt(arg.value) <= 0x7fffffffffffffffn,
+          "invalid authority integer",
+        );
+      if (arg.type === "signature") {
+        assert(
+          a.signatureAlgorithm && plan.capabilities[a.signatureAlgorithm],
+          "wallet cannot sign the authority scheme",
+        );
+        assert(
+          /^(?:[a-f0-9]{2})*$/i.test(arg.prefixHex ?? ""),
+          "invalid authority signature prefix",
+        );
+      }
+    }
+    return {
+      index: tokenInputs.length + i,
+      scriptPublicKeyHex: String(expected.script),
+      covenantId: cid(a.entry),
+    };
+  });
+  const entries = [
+    ...tokenInputs.map((i) => i.entry),
+    ...authorities.map((i) => i.entry),
+    plan.fundingEntry,
+  ];
+  const keys = entries.map((e) => {
+    const o = outpoint(e);
+    assert(
+      o &&
+        /^[0-9a-f]{64}$/i.test(String(o.transactionId)) &&
+        Number.isInteger(o.index) &&
+        o.index >= 0,
+      "invalid source outpoint",
+    );
+    return `${String(o.transactionId).toLowerCase()}:${o.index}`;
+  });
+  assert(new Set(keys).size === keys.length, "duplicate transaction input");
+  assert(!cid(plan.fundingEntry), "funding input must not spend a covenant");
+  assert(
+    kw
+      .addressFromScriptPublicKey(spk(plan.fundingEntry), plan.network)
+      .toString() === plan.fundingAddress,
+    "funding input does not belong to wallet",
+  );
+  const scripts: any[] = [];
+  for (let index = 0; index < tokenInputs.length; index++) {
+    const input = tokenInputs[index];
+    let authorization: any;
+    if (index === 0 && plan.mode === "borrow") {
+      const previous = input.state,
+        next = nextStates[0],
+        borrow = plan.borrow ?? {};
+      assert(previous.borrowScheme !== 0, "borrowing is disabled");
+      assert(
+        hex(previous.owner) === hex(next.owner) &&
+          previous.ownerScheme === next.ownerScheme &&
+          previous.borrowScheme === next.borrowScheme,
+        "borrow successor changes ownership or scheme",
+      );
+      const delta = next.amount - previous.amount;
+      let threshold = 0n;
+      if (previous.borrowScheme === 1) {
+        for (let i = 7; i >= 0; i--)
+          threshold = (threshold << 8n) | BigInt(previous.borrowGuard[i]);
+        assert(
+          (threshold & (1n << 63n)) === 0n || threshold === 1n << 63n,
+          "negative thresholds are not supported by this adapter",
+        );
+        if (threshold === 1n << 63n) threshold = 0n;
+      }
+      assert(delta > threshold, "borrow increase does not exceed threshold");
+      if (previous.borrowScheme !== 3)
+        assert(
+          hex(previous.borrowGuard) === hex(next.borrowGuard),
+          "borrow guard must be preserved",
+        );
+      else
+        assert(
+          hex(next.borrowGuard) === borrow.nextGuard,
+          "borrow successor guard differs from committed next link",
+        );
+      if (previous.borrowScheme !== 1) {
+        assert(
+          plan.capabilities.schnorr,
+          "wallet cannot sign borrowed receive",
+        );
+        assert(
+          borrow.signingPublicKey ===
+            (previous.borrowScheme === 2
+              ? hex(previous.borrowGuard)
+              : borrow.oneTimePublicKey),
+          "borrow signing key does not match authorization",
+        );
+      }
+      // Validate the complete witness shape/hash link before leaving a signature slot.
+      const witness = buildTokenBorrowWitness({
+        profile,
+        borrowScheme: previous.borrowScheme,
+        currentGuard: hex(previous.borrowGuard),
+        ...(previous.borrowScheme === 1
+          ? {}
+          : {
+              signature: "00".repeat(64) + "01",
+              nextGuard: borrow.nextGuard,
+              oneTimePublicKey: borrow.oneTimePublicKey,
+            }),
+      });
+      authorization =
+        previous.borrowScheme === 1
+          ? { argument: { type: "data", hex: hex(witness) } }
+          : {
+              argument: {
+                type: "signature",
+                prefixHex: hex(witness.slice(0, -65)),
+              },
+              signatureAlgorithm: "schnorr",
+            };
+    } else {
+      authorization = planTokenOwnerWitness({
+        profile,
+        owner: hex(input.state.owner),
+        ownerScheme: input.state.ownerScheme,
+        publicKey: input.publicKey,
+        capabilities: plan.capabilities,
+        role: index === 0 ? "leader" : "delegator",
+        authorityInputIndex: input.authorityInputIndex,
+        authorityInputs: authorityEvidence,
+      });
+    }
+    scripts.push({
+      inputIndex: index,
+      scriptHex: hex(buildKcc20ScriptForState(artifact, input.state)),
+      signType: 1,
+      ...(authorization.signatureAlgorithm
+        ? { signatureAlgorithm: authorization.signatureAlgorithm }
+        : {}),
+      signatureScript: {
+        mode: "ordered-args",
+        args: [
+          ...(index === 0
+            ? encodeKcc20StateRecordArrays(nextStates).map((v: Uint8Array) => ({
+                type: "data",
+                hex: hex(v),
+              }))
+            : []),
+          authorization.argument,
+          {
+            type: "data",
+            hex: index === 0 ? profile.transferTag : profile.delegatorTag,
+          },
+        ],
+      },
+    });
+  }
+  for (let i = 0; i < authorities.length; i++)
+    scripts.push({
+      inputIndex: tokenInputs.length + i,
+      scriptHex: hex(authorities[i].revealScript),
+      signType: 1,
+      signatureAlgorithm: authorities[i].signatureAlgorithm,
+      signatureScript: { mode: "ordered-args", args: authorities[i].arguments },
+    });
+  const tokenValue = plan.tokenOutputSompi ?? 50_000_000n;
+  assert(tokenValue > 0n, "token output KAS must be positive");
+  if (plan.mode === "borrow")
+    assert(
+      tokenValue >= amount(tokenInputs[0].entry),
+      "borrow successor must preserve its KAS value",
+    );
+  const outputs = nextStates.map(
+    (state) =>
+      new kw.TransactionOutput(
+        tokenValue,
+        kw.payToScriptHashScript(buildKcc20ScriptForState(artifact, state)),
+        new kw.CovenantBinding(0, new kw.Hash(tokenId)),
+      ),
+  );
+  for (let i = 0; i < authorities.length; i++) {
+    const entry = authorities[i].entry,
+      identity = cid(entry);
+    outputs.push(
+      new kw.TransactionOutput(
+        amount(entry),
+        spk(entry),
+        identity
+          ? new kw.CovenantBinding(
+              tokenInputs.length + i,
+              new kw.Hash(identity),
+            )
+          : undefined,
+      ),
+    );
+  }
+  const change =
+    entries.reduce((sum, e) => sum + amount(e), 0n) -
+    BigInt(nextStates.length) * tokenValue -
+    authorities.reduce((sum, a) => sum + amount(a.entry), 0n) -
+    plan.feeSompi;
+  assert(change > 10_000n, "insufficient funding or change");
+  outputs.push(
+    new kw.TransactionOutput(
+      change,
+      kw.payToAddressScript(plan.fundingAddress),
+    ),
+  );
+  const transaction = new kw.Transaction({
+    version: 1,
+    lockTime: 0n,
+    subnetworkId: "00".repeat(20),
+    gas: 0n,
+    payload: "",
+    inputs: entries.map((e) => ({
+      previousOutpoint: outpoint(e),
+      utxo: e,
+      sequence: 0n,
+      sigOpCount: 0,
+      computeBudget: 1000,
+    })),
+    outputs,
+  });
+  transaction.inputs[entries.length - 1].computeBudget = 30;
+  return {
+    schema: "kcc20-in-process-pskt-builder-output/v1",
+    psktTransactionJson: transaction.serializeToSafeJSON(),
+    scripts,
+    signInputs: [{ index: entries.length - 1, sighashType: 1 }],
+    submitTransactionSupported: true,
+    metadata: {
+      tokenProfileId: profile.id,
+      covenantId: tokenId,
+      mode: plan.mode,
+      fundingChangeOutputIndex: outputs.length - 1,
+    },
+  };
+}

package/src/snapshot-signerless-transactions.ts

@@ -61,10 +61,7 @@ export function buildSnapshotKcc20DeploymentPayload({
   if (normalizedProtocolFeeBps > 10_000n) {
     throw new Error("snapshot token protocol fee bps exceeds 10000");
   }
-  const normalizedMigrationId = hex32(
-    migrationId,
-    "snapshot migration id",
-  );
+  const normalizedMigrationId = hex32(migrationId, "snapshot migration id");
   const normalizedManifestCommitment = hex32(
     manifestCommitment,
     "snapshot manifest commitment",
@@ -132,11 +129,7 @@ export function buildSnapshotKcc20DeploymentPayload({
     claimArg("displayScale", "u64", normalizedDisplayScale.toString()),
     claimArg("mintPriceSompi", "u64", "0"),
     claimArg("treasury", "byte[32]", normalizedTreasury),
-    claimArg(
-      "protocolFeeRecipient",
-      "byte[32]",
-      normalizedFeeRecipient,
-    ),
+    claimArg("protocolFeeRecipient", "byte[32]", normalizedFeeRecipient),
     claimArg("protocolFeeBps", "u64", normalizedProtocolFeeBps.toString()),
     claimArg("ticker", "string", normalizedTicker),
     claimArg("name", "string", normalizedName),
@@ -780,9 +773,7 @@ function fixedText32(value, label) {
 }
 
 function bytesHex(value) {
-  return [...value]
-    .map((byte) => byte.toString(16).padStart(2, "0"))
-    .join("");
+  return [...value].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 
 function transactionOf(kw, inputs, outputs, lockTime, payload) {
@@ -968,10 +959,10 @@ function setP2shSignatureScript(
   revealScript,
   prefix,
 ) {
-  transaction.inputs[inputIndex].signatureScript =
-    kw.ScriptBuilder.fromScript(
-      revealScript,
-    ).encodePayToScriptHashSignatureScript(prefix);
+  transaction.inputs[inputIndex].signatureScript = kw.ScriptBuilder.fromScript(
+    revealScript,
+    { flags: { covenantsEnabled: true } },
+  ).encodePayToScriptHashSignatureScript(prefix);
 }
 
 function unsignedEnvelope(kw, transaction, intent, signInputs) {

package/src/snapshot-signerless.ts

@@ -363,7 +363,9 @@ export function buildSnapshotStartSignatureScripts(
   const reserves = plan.reserves.map(normalizeKcc20State);
   const kcc20Template = templateParts(kcc20Artifact);
   const controllerTemplate = templateParts(controllerArtifact);
-  const bootstrapBuilder = new kw.ScriptBuilder();
+  const bootstrapBuilder = new kw.ScriptBuilder({
+    flags: { covenantsEnabled: true },
+  });
   for (const field of encodeControllerStateRecordArrays(controllers))
     bootstrapBuilder.addData(field);
   for (const field of encodeKcc20StateRecordArrays(reserves))
@@ -374,7 +376,7 @@ export function buildSnapshotStartSignatureScripts(
   bootstrapBuilder.addData(controllerTemplate.suffix);
   bootstrapBuilder.addData(dispatchTagFor(bootstrapArtifact, "start"));
   const controllerSignatureScripts = controllers.map((state, index) => {
-    const builder = new kw.ScriptBuilder();
+    const builder = new kw.ScriptBuilder({ flags: { covenantsEnabled: true } });
     addControllerState(builder, state);
     builder.addI64(BigInt(bootstrapInputIndex));
     builder.addI64(BigInt(index));
@@ -591,7 +593,7 @@ export function buildClaimSignatureScripts(
   requireControllerArtifact(controllerArtifact);
   requireKcc20Artifact(kcc20Artifact);
   requireOwnerWitness(claim.ownerScheme, claim.ownerWitness);
-  const builder = new kw.ScriptBuilder();
+  const builder = new kw.ScriptBuilder({ flags: { covenantsEnabled: true } });
   builder.addI64(BigInt(claim.globalIndex));
   builder.addI64(BigInt(claim.shardLeafIndex));
   addByte(builder, claim.ownerScheme);

package/src/token-authorization.ts

@@ -0,0 +1,135 @@
+import { blake3 } from "@noble/hashes/blake3";
+import { requireTokenCapability, type TokenProfile } from "./token-profiles.js";
+
+export interface TokenSigningCapabilities {
+  schnorr: boolean;
+  ecdsa: boolean;
+}
+export type TokenWitnessArgument =
+  | { type: "data"; hex: string }
+  | { type: "signature"; prefixHex: string };
+export interface TokenAuthorityInput {
+  index: number;
+  scriptPublicKeyHex: string;
+  covenantId?: string;
+}
+const hex = (v: Uint8Array) =>
+  Array.from(v, (b) => b.toString(16).padStart(2, "0")).join("");
+const bytes = (v: string, size: number, label: string) => {
+  if (!new RegExp(`^[0-9a-f]{${size * 2}}$`, "i").test(v))
+    throw new Error(`invalid ${label}`);
+  return Uint8Array.from(v.match(/../g)!, (b) => parseInt(b, 16));
+};
+export function tokenPublicKeyHash(publicKey: Uint8Array): Uint8Array {
+  if (![32, 33].includes(publicKey.length))
+    throw new Error("invalid token public key length");
+  return blake3(publicKey);
+}
+/** Authority inputs must come from the authenticated transaction UTXOs, never an uploaded artifact. */
+export function planTokenOwnerWitness(input: {
+  profile: TokenProfile;
+  owner: string;
+  ownerScheme: number;
+  publicKey?: string;
+  capabilities: TokenSigningCapabilities;
+  authorityInputIndex?: number;
+  authorityInputs?: readonly TokenAuthorityInput[];
+  role: "leader" | "delegator";
+}): {
+  argument: TokenWitnessArgument;
+  signatureAlgorithm?: "schnorr" | "ecdsa";
+  authorityInputIndex?: number;
+} {
+  const { profile, ownerScheme } = input;
+  requireTokenCapability(profile, "transfer");
+  bytes(input.owner, 32, "token owner");
+  if (!profile.ownerSchemes.includes(ownerScheme))
+    throw new Error("token profile does not support this owner scheme");
+  const prefix = input.role === "leader" ? "00" : "";
+  if (ownerScheme <= 2) {
+    const algorithm = ownerScheme === 2 ? "ecdsa" : "schnorr";
+    if (!input.capabilities[algorithm])
+      throw new Error(`wallet does not support ${algorithm} token signatures`);
+    const key = bytes(
+      input.publicKey ?? "",
+      ownerScheme === 2 ? 33 : 32,
+      "wallet public key",
+    );
+    if (ownerScheme === 2 && key[0] !== 2 && key[0] !== 3)
+      throw new Error("ECDSA key must be compressed");
+    const expected =
+      ownerScheme === 0 ? hex(key) : hex(tokenPublicKeyHash(key));
+    if (expected !== input.owner.toLowerCase())
+      throw new Error("wallet public key does not own the token output");
+    return {
+      argument: {
+        type: "signature",
+        prefixHex: prefix + (ownerScheme === 0 ? "" : hex(key)),
+      },
+      signatureAlgorithm: algorithm,
+    };
+  }
+  const index = input.authorityInputIndex;
+  if (!Number.isSafeInteger(index) || index! < 0 || index! > 255)
+    throw new Error("explicit authority input index is required");
+  const matches = (input.authorityInputs ?? []).filter(
+    (a) => a.index === index,
+  );
+  if (matches.length !== 1)
+    throw new Error("authority input is missing or ambiguous");
+  const authority = matches[0];
+  if (
+    ownerScheme === 3 &&
+    authority.scriptPublicKeyHex.toLowerCase() !==
+      `aa20${input.owner.toLowerCase()}87`
+  )
+    throw new Error("authority input does not match token P2SH owner");
+  if (
+    ownerScheme === 4 &&
+    authority.covenantId?.toLowerCase() !== input.owner.toLowerCase()
+  )
+    throw new Error("authority input does not match token covenant owner");
+  return {
+    argument: {
+      type: "data",
+      hex:
+        prefix +
+        (ownerScheme === 3 ? index!.toString(16).padStart(2, "0") : ""),
+    },
+    authorityInputIndex: index,
+  };
+}
+/** Borrowing is an explicit mode. This function never converts an ordinary send into a borrow. */
+export function buildTokenBorrowWitness(input: {
+  profile: TokenProfile;
+  borrowScheme: number;
+  currentGuard: string;
+  signature?: string;
+  nextGuard?: string;
+  oneTimePublicKey?: string;
+}): Uint8Array {
+  requireTokenCapability(input.profile, "borrow");
+  const current = bytes(input.currentGuard, 32, "borrow guard");
+  if (input.borrowScheme === 1) {
+    if (
+      input.signature !== undefined ||
+      input.nextGuard !== undefined ||
+      input.oneTimePublicKey !== undefined
+    )
+      throw new Error("threshold borrowing requires an empty authorization");
+    return Uint8Array.of(1);
+  }
+  const sig = bytes(input.signature ?? "", 65, "borrow signature");
+  if (input.borrowScheme === 2) {
+    if (input.nextGuard !== undefined || input.oneTimePublicKey !== undefined)
+      throw new Error("Schnorr borrowing does not rotate its guard");
+    return Uint8Array.from([1, ...sig]);
+  }
+  if (input.borrowScheme !== 3)
+    throw new Error("unsupported or disabled borrow scheme");
+  const guard = bytes(input.nextGuard ?? "", 32, "next borrow guard");
+  const key = bytes(input.oneTimePublicKey ?? "", 32, "one-time public key");
+  if (hex(blake3(Uint8Array.from([...guard, ...key]))) !== hex(current))
+    throw new Error("hash-chain link does not match current guard");
+  return Uint8Array.from([1, ...guard, ...key, ...sig]);
+}