@novasamatech/statement-store 0.8.7-0 → 0.8.7-2

package/dist/session/statementProver.d.ts

@@ -4,4 +4,7 @@ export type StatementProver = {
     generateMessageProof(statement: Statement): ResultAsync<SignedStatement, Error>;
     verifyMessageProof(statement: Statement): ResultAsync<boolean, Error>;
 };
+/** Prover for scure-HDKD / device statement account secrets. */
 export declare function createSr25519Prover(secret: Uint8Array): StatementProver;
+/** Prover for a mobile slot-account secret (`privateKey || nonce`). Call `ensureSubstrateSlotSr25519Ready()` first. */
+export declare function createSlotAccountProver(secret: Uint8Array): StatementProver;

package/dist/session/statementProver.js

@@ -2,11 +2,11 @@ import { getStatementSigner, statementCodec } from '@novasamatech/sdk-statement'
 import { compact } from '@polkadot-api/substrate-bindings';
 import { errAsync, fromPromise, fromThrowable, okAsync } from 'neverthrow';
 import { fromHex } from 'polkadot-api/utils';
-import { deriveSr25519PublicKey, signWithSr25519Secret, verifySr25519Signature } from '../crypto.js';
+import { deriveSlotAccountPublicKey, deriveSr25519PublicKey, signSlotAccountSecret, signWithSr25519Secret, verifySlotAccountSignature, verifySr25519Signature, } from '../crypto.js';
 import { toError } from '../helpers.js';
-export function createSr25519Prover(secret) {
-    const signer = getStatementSigner(deriveSr25519PublicKey(secret), 'sr25519', data => signWithSr25519Secret(secret, data));
-    const verify = fromThrowable(verifySr25519Signature, toError);
+function createSr25519SchemeProver(secret, scheme) {
+    const signer = getStatementSigner(scheme.derivePublicKey(secret), 'sr25519', data => scheme.sign(secret, data));
+    const verify = fromThrowable(scheme.verify, toError);
     return {
         generateMessageProof(statement) {
             return fromPromise(signer.sign(statement), toError);
@@ -27,3 +27,19 @@ export function createSr25519Prover(secret) {
         },
     };
 }
+/** Prover for scure-HDKD / device statement account secrets. */
+export function createSr25519Prover(secret) {
+    return createSr25519SchemeProver(secret, {
+        derivePublicKey: deriveSr25519PublicKey,
+        sign: signWithSr25519Secret,
+        verify: verifySr25519Signature,
+    });
+}
+/** Prover for a mobile slot-account secret (`privateKey || nonce`). Call `ensureSubstrateSlotSr25519Ready()` first. */
+export function createSlotAccountProver(secret) {
+    return createSr25519SchemeProver(secret, {
+        derivePublicKey: deriveSlotAccountPublicKey,
+        sign: signSlotAccountSecret,
+        verify: verifySlotAccountSignature,
+    });
+}

package/dist/session/statementProver.spec.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/session/statementProver.spec.js

@@ -0,0 +1,71 @@
+import { createExpiryFromDuration } from '@novasamatech/sdk-statement';
+import { ensureSubstrateSlotSr25519Ready, substrateSlotSecretFromSeedBytes, } from '@novasamatech/substrate-slot-sr25519-wasm';
+import { mnemonicToEntropy, mnemonicToMiniSecret } from '@polkadot-labs/hdkd-helpers';
+import { beforeAll, describe, expect, it } from 'vitest';
+import { createSr25519Secret, deriveSlotAccountPublicKey, deriveSr25519PublicKey } from '../crypto.js';
+import { createSlotAccountProver, createSr25519Prover } from './statementProver.js';
+const DEV_MNEMONIC = 'bottom drive obey lake curtain smoke basket hold race lonely fit walk';
+const toHex = (bytes) => `0x${[...bytes].map(b => b.toString(16).padStart(2, '0')).join('')}`;
+function makeStatement(data) {
+    return {
+        expiry: createExpiryFromDuration(7 * 24 * 60 * 60),
+        data,
+        topics: [],
+        channel: `0x${'00'.repeat(32)}`,
+    };
+}
+function proofSigner(signed) {
+    if (signed.proof.type !== 'sr25519') {
+        throw new Error(`unexpected proof type ${signed.proof.type}`);
+    }
+    return signed.proof.value.signer;
+}
+describe('statementProver', () => {
+    beforeAll(async () => {
+        // Only the slot scheme needs explicit init; the scure path initializes lazily.
+        await ensureSubstrateSlotSr25519Ready();
+    });
+    describe('createSr25519Prover (scure-HDKD secrets)', () => {
+        it('signs a statement under the scure-derived public key and verifies it', async () => {
+            const secret = createSr25519Secret(mnemonicToEntropy(DEV_MNEMONIC));
+            const prover = createSr25519Prover(secret);
+            const signed = (await prover.generateMessageProof(makeStatement(new Uint8Array([1, 2, 3]))))._unsafeUnwrap();
+            expect(proofSigner(signed)).toBe(toHex(deriveSr25519PublicKey(secret)));
+            const verified = await prover.verifyMessageProof(signed);
+            expect(verified._unsafeUnwrap()).toBe(true);
+        });
+    });
+    describe('createSlotAccountProver (mobile slot secrets)', () => {
+        // Derived inside each test: the wasm is only ready after beforeAll runs.
+        const makeSlotSecret = () => substrateSlotSecretFromSeedBytes(mnemonicToMiniSecret(DEV_MNEMONIC));
+        it('signs a statement under the slot-derived public key and verifies it', async () => {
+            const slotSecret = makeSlotSecret();
+            const prover = createSlotAccountProver(slotSecret);
+            const signed = (await prover.generateMessageProof(makeStatement(new Uint8Array([4, 5, 6]))))._unsafeUnwrap();
+            expect(proofSigner(signed)).toBe(toHex(deriveSlotAccountPublicKey(slotSecret)));
+            const verified = await prover.verifyMessageProof(signed);
+            expect(verified._unsafeUnwrap()).toBe(true);
+        });
+        it('signs under a different public key than the scure prover would for the same secret', () => {
+            // Regression guard: a slot secret pushed through the scure scheme derives the WRONG
+            // signer, which is the bug createSlotAccountProver fixes for getStatementStoreProver.
+            const slotSecret = makeSlotSecret();
+            expect(toHex(deriveSlotAccountPublicKey(slotSecret))).not.toBe(toHex(deriveSr25519PublicKey(slotSecret)));
+        });
+        it('rejects a proof whose statement data was tampered with', async () => {
+            const slotSecret = makeSlotSecret();
+            const prover = createSlotAccountProver(slotSecret);
+            const signed = (await prover.generateMessageProof(makeStatement(new Uint8Array([7, 8, 9]))))._unsafeUnwrap();
+            const tampered = { ...signed, data: new Uint8Array([9, 9, 9]) };
+            const verified = await prover.verifyMessageProof(tampered);
+            expect(verified._unsafeUnwrap()).toBe(false);
+        });
+    });
+    describe('verifyMessageProof', () => {
+        it('errors when the statement carries no proof', async () => {
+            const prover = createSr25519Prover(createSr25519Secret(mnemonicToEntropy(DEV_MNEMONIC)));
+            const verified = await prover.verifyMessageProof(makeStatement(new Uint8Array([1])));
+            expect(verified.isErr()).toBe(true);
+        });
+    });
+});

package/dist/session/types.d.ts

@@ -31,6 +31,18 @@ export type Session = {
         requestId: string;
     }, Error>;
     submitResponseMessage(requestId: string, responseCode: ResponseStatus): ResultAsync<void, Error>;
+    /**
+     * Subscribe to incoming peer requests and answer each one automatically.
+     * The handler returns the transport-level {@link ResponseStatus} (or a
+     * `ResultAsync` resolving to one) that the session submits as the response on
+     * the peer's behalf; a handler that errors is answered with `'unknown'`.
+     *
+     * This is the can't-forget counterpart to {@link submitResponseMessage}: the
+     * ACK is driven by the handler's return value, so a consumer cannot receive a
+     * request and silently fail to respond. Response-type statements are ignored
+     * (only requests are answered).
+     */
+    respondToRequests<T>(codec: Codec<T>, handler: (request: RequestMessage<T>) => ResponseStatus | ResultAsync<ResponseStatus, Error>): VoidFunction;
     /**
      * Replace the in-flight outgoing request batch with an empty one on the same
      * request channel at the session's current expiry (the statement store keeps

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@novasamatech/statement-store",
   "type": "module",
-  "version": "0.8.7-0",
+  "version": "0.8.7-2",
   "description": "Statement store integration",
   "license": "Apache-2.0",
   "repository": {
@@ -25,9 +25,9 @@
     "README.md"
   ],
   "dependencies": {
-    "@novasamatech/scale": "0.8.7-0",
+    "@novasamatech/scale": "0.8.7-2",
     "@novasamatech/sdk-statement": "^0.6.0",
-    "@novasamatech/substrate-slot-sr25519-wasm": "0.8.7-0",
+    "@novasamatech/substrate-slot-sr25519-wasm": "0.8.7-2",
     "@polkadot-api/substrate-bindings": "^0.20.3",
     "@polkadot-api/substrate-client": "^0.7.0",
     "@polkadot-labs/hdkd-helpers": "^0.0.30",