@meshconnect/uwc-bitcoin 0.4.3 → 0.5.0

package/src/psbt.ts

@@ -0,0 +1,373 @@
+import { WalletConnectorError } from '@meshconnect/uwc-types'
+import { bytesToHex, hexToBytes } from './encoding'
+
+/**
+ * Finalize a wallet-signed PSBT (BIP-174 v0) and extract the network-ready
+ * raw transaction as hex.
+ *
+ * Hand-rolled rather than pulling in a Bitcoin library so `uwc-bitcoin` stays
+ * dependency-free. That is only safe because the scope is deliberately narrow:
+ * single-key spends, where finalizing is pure re-arrangement of what the wallet
+ * already produced — no script interpretation, no signature checks. Anything
+ * else (multisig, Taproot script-path, bare scripts) throws instead of guessing.
+ *
+ * Per input, in order:
+ * - Already final (`final_scriptsig` / `final_scriptwitness` present) → used
+ *   as-is. Required, not optional: OKX finalizes every input it signs even when
+ *   asked not to (`autoFinalized: false`), so a finalizer that only accepted
+ *   partial signatures would reject every OKX transaction.
+ * - P2WPKH, P2TR key-path, P2PKH, P2SH-P2WPKH → finalized from the partial
+ *   signature (or `tap_key_sig`).
+ *
+ * The caller owns the trust decision about the PSBT's contents — this never
+ * inspects outputs or amounts.
+ */
+export function finalizePsbt(signedPsbt: Uint8Array): string {
+  const psbt = parsePsbt(signedPsbt)
+  const finals = psbt.inputs.map((input, index) =>
+    finalizeInput(input, index, psbt.tx.inputs[index]!.prevIndex)
+  )
+  return bytesToHex(serializeTransaction(psbt.tx, finals))
+}
+
+/**
+ * The txid of a raw transaction (hex, legacy or segwit serialization): the
+ * double SHA-256 of its witness-stripped serialization, byte-reversed.
+ *
+ * Lets a broadcaster know the txid before the network answers, so a lost
+ * response or an "already known" rejection can still be tied to the payment.
+ */
+export async function computeTxid(rawTxHex: string): Promise<string> {
+  const tx = parseTransaction(hexToBytes(rawTxHex))
+  const stripped = serializeTransaction(
+    tx,
+    tx.inputs.map(input => ({ scriptSig: input.scriptSig, witness: [] }))
+  )
+  const once = await crypto.subtle.digest('SHA-256', stripped)
+  const twice = new Uint8Array(await crypto.subtle.digest('SHA-256', once))
+  return bytesToHex(twice.reverse())
+}
+
+// BIP-174 key types used here.
+const GLOBAL_UNSIGNED_TX = 0x00
+const GLOBAL_VERSION = 0xfb
+const IN_NON_WITNESS_UTXO = 0x00
+const IN_WITNESS_UTXO = 0x01
+const IN_PARTIAL_SIG = 0x02
+const IN_REDEEM_SCRIPT = 0x04
+const IN_FINAL_SCRIPTSIG = 0x07
+const IN_FINAL_SCRIPTWITNESS = 0x08
+const IN_TAP_KEY_SIG = 0x13
+
+const PSBT_MAGIC = [0x70, 0x73, 0x62, 0x74, 0xff]
+
+interface TxInput {
+  /** Serialized outpoint (32-byte txid LE + 4-byte index LE). */
+  outpoint: Uint8Array
+  prevIndex: number
+  scriptSig: Uint8Array
+  sequence: Uint8Array
+}
+
+interface Transaction {
+  version: Uint8Array
+  inputs: TxInput[]
+  outputs: Uint8Array[]
+  locktime: Uint8Array
+}
+
+interface KeyValue {
+  type: number
+  keyData: Uint8Array
+  value: Uint8Array
+}
+
+interface ParsedPsbt {
+  tx: Transaction
+  inputs: KeyValue[][]
+}
+
+interface FinalInput {
+  scriptSig: Uint8Array
+  witness: Uint8Array[]
+}
+
+function fail(message: string): never {
+  throw new WalletConnectorError({
+    type: 'unknown',
+    message: `finalizePsbt: ${message}`
+  })
+}
+
+class Reader {
+  private offset = 0
+
+  constructor(private readonly bytes: Uint8Array) {}
+
+  take(length: number): Uint8Array {
+    if (this.offset + length > this.bytes.length) fail('truncated data')
+    const slice = this.bytes.subarray(this.offset, this.offset + length)
+    this.offset += length
+    return slice
+  }
+
+  byte(): number {
+    return this.take(1)[0]!
+  }
+
+  uint32(): number {
+    const b = this.take(4)
+    return (b[0]! | (b[1]! << 8) | (b[2]! << 16) | (b[3]! << 24)) >>> 0
+  }
+
+  compactSize(): number {
+    const first = this.byte()
+    if (first < 0xfd) return first
+    if (first === 0xfd) {
+      const b = this.take(2)
+      return b[0]! | (b[1]! << 8)
+    }
+    if (first === 0xfe) return this.uint32()
+    const low = this.uint32()
+    const high = this.uint32()
+    // No PSBT field legitimately approaches 2^53; anything that large is corrupt.
+    if (high > 0x1fffff) fail('length out of range')
+    return high * 0x100000000 + low
+  }
+
+  varBytes(): Uint8Array {
+    return this.take(this.compactSize())
+  }
+}
+
+function parsePsbt(bytes: Uint8Array): ParsedPsbt {
+  const reader = new Reader(bytes)
+  if (!PSBT_MAGIC.every(b => reader.byte() === b)) fail('not a PSBT')
+
+  const global = readMap(reader)
+  const version = global.find(kv => kv.type === GLOBAL_VERSION)
+  if (version && new Reader(version.value).uint32() !== 0) {
+    fail('only PSBT version 0 is supported')
+  }
+  const unsignedTx = global.find(kv => kv.type === GLOBAL_UNSIGNED_TX)
+  if (!unsignedTx) fail('missing unsigned transaction')
+  const tx = parseTransaction(unsignedTx.value)
+
+  const inputs = tx.inputs.map(() => readMap(reader))
+  // Output maps carry nothing extraction needs, but must be present — a PSBT
+  // cut short there is malformed and should not be trusted.
+  for (let i = 0; i < tx.outputs.length; i++) readMap(reader)
+  return { tx, inputs }
+}
+
+function readMap(reader: Reader): KeyValue[] {
+  const map: KeyValue[] = []
+  for (;;) {
+    const key = reader.varBytes()
+    if (key.length === 0) return map
+    map.push({
+      type: key[0]!,
+      keyData: key.subarray(1),
+      value: reader.varBytes()
+    })
+  }
+}
+
+/** Parse a transaction in either legacy or segwit serialization. */
+function parseTransaction(bytes: Uint8Array): Transaction {
+  const reader = new Reader(bytes)
+  const version = reader.take(4)
+  let inputCount = reader.compactSize()
+  const segwit = inputCount === 0
+  if (segwit) {
+    if (reader.byte() !== 0x01) fail('invalid segwit flag')
+    inputCount = reader.compactSize()
+  }
+  const inputs: TxInput[] = []
+  for (let i = 0; i < inputCount; i++) {
+    const outpoint = reader.take(36)
+    inputs.push({
+      outpoint,
+      prevIndex: new Reader(outpoint.subarray(32)).uint32(),
+      scriptSig: reader.varBytes(),
+      sequence: reader.take(4)
+    })
+  }
+  const outputCount = reader.compactSize()
+  const outputs: Uint8Array[] = []
+  for (let i = 0; i < outputCount; i++) {
+    const value = reader.take(8)
+    const script = reader.varBytes()
+    outputs.push(concat([value, compactSize(script.length), script]))
+  }
+  if (segwit) {
+    for (let i = 0; i < inputCount; i++) {
+      const items = reader.compactSize()
+      for (let j = 0; j < items; j++) reader.varBytes()
+    }
+  }
+  return { version, inputs, outputs, locktime: reader.take(4) }
+}
+
+function finalizeInput(
+  input: KeyValue[],
+  index: number,
+  prevIndex: number
+): FinalInput {
+  const get = (type: number) => input.find(kv => kv.type === type)?.value
+
+  const finalScriptSig = get(IN_FINAL_SCRIPTSIG)
+  const finalWitness = get(IN_FINAL_SCRIPTWITNESS)
+  if (finalScriptSig || finalWitness) {
+    return {
+      scriptSig: finalScriptSig ?? new Uint8Array(),
+      witness: finalWitness ? parseWitness(finalWitness) : []
+    }
+  }
+
+  const script = prevoutScript(input, index, prevIndex)
+  const partialSigs = input.filter(kv => kv.type === IN_PARTIAL_SIG)
+  const singleSig = (): [Uint8Array, Uint8Array] => {
+    if (partialSigs.length === 0) fail(`input ${index} is not signed`)
+    if (partialSigs.length > 1) {
+      fail(
+        `input ${index} has ${partialSigs.length} signatures; only single-key spends are supported`
+      )
+    }
+    const { value: signature, keyData: pubkey } = partialSigs[0]!
+    return [signature, pubkey]
+  }
+
+  if (isP2wpkh(script)) {
+    return { scriptSig: new Uint8Array(), witness: singleSig() }
+  }
+  if (isP2tr(script)) {
+    const tapKeySig = get(IN_TAP_KEY_SIG)
+    if (!tapKeySig) {
+      fail(
+        `input ${index} has no Taproot key-path signature; script-path spends are not supported`
+      )
+    }
+    return { scriptSig: new Uint8Array(), witness: [tapKeySig] }
+  }
+  if (isP2pkh(script)) {
+    const [signature, pubkey] = singleSig()
+    return {
+      scriptSig: concat([pushData(signature), pushData(pubkey)]),
+      witness: []
+    }
+  }
+  if (isP2sh(script)) {
+    const redeemScript = get(IN_REDEEM_SCRIPT)
+    if (!redeemScript || !isP2wpkh(redeemScript)) {
+      fail(`input ${index} is P2SH but not P2SH-P2WPKH; unsupported`)
+    }
+    return { scriptSig: pushData(redeemScript), witness: singleSig() }
+  }
+  fail(`input ${index} has an unsupported script type`)
+}
+
+/** The scriptPubKey this input spends, from whichever UTXO field is present. */
+function prevoutScript(
+  input: KeyValue[],
+  index: number,
+  prevIndex: number
+): Uint8Array {
+  const witnessUtxo = input.find(kv => kv.type === IN_WITNESS_UTXO)?.value
+  if (witnessUtxo) {
+    const reader = new Reader(witnessUtxo)
+    reader.take(8) // amount
+    return reader.varBytes()
+  }
+  const nonWitnessUtxo = input.find(
+    kv => kv.type === IN_NON_WITNESS_UTXO
+  )?.value
+  if (nonWitnessUtxo) {
+    const output = parseTransaction(nonWitnessUtxo).outputs[prevIndex]
+    if (!output) fail(`input ${index} spends an output its UTXO does not have`)
+    const reader = new Reader(output)
+    reader.take(8)
+    return reader.varBytes()
+  }
+  fail(`input ${index} has no UTXO information`)
+}
+
+function parseWitness(bytes: Uint8Array): Uint8Array[] {
+  const reader = new Reader(bytes)
+  const items: Uint8Array[] = []
+  const count = reader.compactSize()
+  for (let i = 0; i < count; i++) items.push(reader.varBytes())
+  return items
+}
+
+const isP2wpkh = (s: Uint8Array) =>
+  s.length === 22 && s[0] === 0x00 && s[1] === 0x14
+const isP2tr = (s: Uint8Array) =>
+  s.length === 34 && s[0] === 0x51 && s[1] === 0x20
+const isP2pkh = (s: Uint8Array) =>
+  s.length === 25 &&
+  s[0] === 0x76 &&
+  s[1] === 0xa9 &&
+  s[2] === 0x14 &&
+  s[23] === 0x88 &&
+  s[24] === 0xac
+const isP2sh = (s: Uint8Array) =>
+  s.length === 23 && s[0] === 0xa9 && s[1] === 0x14 && s[22] === 0x87
+
+function serializeTransaction(
+  tx: Transaction,
+  finals: FinalInput[]
+): Uint8Array<ArrayBuffer> {
+  const segwit = finals.some(f => f.witness.length > 0)
+  const parts: Uint8Array[] = [tx.version]
+  if (segwit) parts.push(Uint8Array.of(0x00, 0x01))
+  parts.push(compactSize(tx.inputs.length))
+  tx.inputs.forEach((input, i) => {
+    const { scriptSig } = finals[i]!
+    parts.push(
+      input.outpoint,
+      compactSize(scriptSig.length),
+      scriptSig,
+      input.sequence
+    )
+  })
+  parts.push(compactSize(tx.outputs.length), ...tx.outputs)
+  if (segwit) {
+    for (const { witness } of finals) {
+      parts.push(compactSize(witness.length))
+      for (const item of witness) parts.push(compactSize(item.length), item)
+    }
+  }
+  parts.push(tx.locktime)
+  return concat(parts)
+}
+
+/** Minimal script push for data up to 255 bytes (signatures, keys, redeem scripts). */
+function pushData(data: Uint8Array): Uint8Array {
+  if (data.length <= 75) return concat([Uint8Array.of(data.length), data])
+  if (data.length <= 0xff)
+    return concat([Uint8Array.of(0x4c, data.length), data])
+  fail('script push too large')
+}
+
+function compactSize(n: number): Uint8Array {
+  if (n < 0xfd) return Uint8Array.of(n)
+  if (n <= 0xffff) return Uint8Array.of(0xfd, n & 0xff, n >> 8)
+  return Uint8Array.of(
+    0xfe,
+    n & 0xff,
+    (n >> 8) & 0xff,
+    (n >> 16) & 0xff,
+    n >>> 24
+  )
+}
+
+function concat(parts: Uint8Array[]): Uint8Array<ArrayBuffer> {
+  const out = new Uint8Array(parts.reduce((sum, p) => sum + p.length, 0))
+  let offset = 0
+  for (const part of parts) {
+    out.set(part, offset)
+    offset += part.length
+  }
+  return out
+}