@opendatalabs/vana-sdk 3.22.0-pr.207.0dbb052 → 3.22.0-pr.207.247f7c0

package/dist/index.browser.d.ts

@@ -37,7 +37,7 @@ export { parseWeb3SignedHeader, verifyWeb3Signed, type Web3SignedPayload, type V
 export { buildWeb3SignedHeader, computeBodyHash, type Web3SignedSignFn, } from "./auth/web3-signed-builder.js";
 export { MissingAuthError, InvalidSignatureError, ExpiredTokenError, } from "./auth/errors.js";
 export { NATIVE_VANA_ASSET, dataRegistryDomain, grantRegistrationDomain, grantRevocationDomain, serverRegistrationDomain, builderRegistrationDomain, escrowPaymentDomain, GRANT_REGISTRATION_TYPES, GRANT_REVOCATION_TYPES, SERVER_REGISTRATION_TYPES, BUILDER_REGISTRATION_TYPES, ADD_DATA_TYPES, RECORD_DATA_ACCESS_TYPES, type DataPortabilityContracts, type DataPortabilityGatewayConfig, type GrantRegistrationMessage, type GrantRevocationMessage, type ServerRegistrationMessage, type BuilderRegistrationMessage, type AddDataMessage, type RecordDataAccessMessage, } from "./protocol/eip712.js";
-export { ENCLAVE_IDENTITY_EVIDENCE_VERSION, USER_PS_ID_DOMAIN, ENCLAVE_WALLET_PURPOSE, MASTER_SIGNATURE_DELIVERY_VERSION, SEALED_ENVELOPE_VERSION, ENCLAVE_TRUST_ANCHORS, userPsId, appRootPreimage, kmsIssuedPreimage, verifyEnclaveIdentityEvidence, buildMasterSignatureDelivery, encryptMasterSignatureDelivery, type UserPsId, type EnclaveIdentityEvidence, type ExpectedIdentity, type IdentityRequest, type IdentityState, type IdentityResponse, type IdentityRegistrationRequest, type IdentityRegistrationResponse, type MasterSignatureDelivery, type SealedSecretSubmission, type SealedSecretResponse, type AesGcmBox, type SealedEnvelope, type EnclaveTrustAnchors, } from "./protocol/identity.js";
+export { ENCLAVE_IDENTITY_EVIDENCE_VERSION, USER_PS_ID_DOMAIN, ENCLAVE_WALLET_PURPOSE, MASTER_SIGNATURE_DELIVERY_VERSION, MASTER_SIGNATURE_DELIVERY_MAX_AGE_SECONDS, SEALED_ENVELOPE_VERSION, ENCLAVE_TRUST_ANCHORS, userPsId, appRootPreimage, kmsIssuedPreimage, verifyEnclaveIdentityEvidence, buildMasterSignatureDelivery, encryptMasterSignatureDelivery, type UserPsId, type EnclaveIdentityEvidence, type ExpectedIdentity, type IdentityRequest, type IdentityState, type IdentityResponse, type IdentityRegistrationRequest, type IdentityRegistrationResponse, type MasterSignatureDelivery, type SealedSecretSubmission, type SealedSecretResponse, type AesGcmBox, type SealedEnvelope, type EnclaveTrustAnchors, } from "./protocol/identity.js";
 export { PERSONAL_SERVER_REGISTRATION_DEFAULT_CHAIN_ID, PERSONAL_SERVER_REGISTRATION_DEFAULT_VERIFYING_CONTRACT, personalServerRegistrationDomain, createViemPersonalServerRegistrationSigner, buildPersonalServerRegistrationTypedData, buildPersonalServerRegistrationSignature, registerPersonalServerSignature, type PersonalServerRegistrationTypedData, type PersonalServerRegistrationSigner, type PersonalServerRegistrationDomainInput, type ViemPersonalServerRegistrationWalletClient, type ViemPersonalServerRegistrationSignerSource, type BuildPersonalServerRegistrationTypedDataInput, type BuildPersonalServerRegistrationSignatureInput, type PersonalServerRegistrationSignature, } from "./protocol/personal-server-registration.js";
 export { PERSONAL_SERVER_LITE_OWNER_BINDING_VERSION, PERSONAL_SERVER_LITE_OWNER_BINDING_PURPOSE, PERSONAL_SERVER_LITE_OWNER_BINDING_PREFIX, buildPersonalServerLiteOwnerBindingMessage, createViemPersonalServerLiteOwnerBindingSigner, buildPersonalServerLiteOwnerBindingSignature, signPersonalServerLiteOwnerBinding, type PersonalServerLiteOwnerBindingPurpose, type PersonalServerLiteOwnerBindingMessage, type PersonalServerLiteOwnerBindingSigner, type ViemPersonalServerLiteOwnerBindingWalletClient, type ViemPersonalServerLiteOwnerBindingSignerSource, type BuildPersonalServerLiteOwnerBindingSignatureInput, type PersonalServerLiteOwnerBindingSignature, } from "./personal-server-lite/owner-binding.js";
 export { ACCOUNT_PERSONAL_SERVER_REGISTRATION_INTENT, AccountPersonalServerRegistrationError, signPersonalServerRegistrationWithAccount, type AccountPersonalServerRegistrationIntent, type AccountPersonalServerRegistrationSignature, type AccountPersonalServerRegistrationStatus, type AccountPersonalServerRegistrationRequest, type AccountPersonalServerRegistrationConfig, type AccountSignedPersonalServerRegistration, type AccountConfirmationRequiredPersonalServerRegistration, type AccountFallbackSignedPersonalServerRegistration, type AccountPersonalServerRegistrationResult, } from "./account/personal-server-registration.js";

package/dist/index.browser.js

@@ -31755,6 +31755,7 @@ var ENCLAVE_IDENTITY_EVIDENCE_VERSION = 1;
 var USER_PS_ID_DOMAIN = "vana.ps-enclave.v1";
 var ENCLAVE_WALLET_PURPOSE = "vana.ps-enclave.wallet.v1";
 var MASTER_SIGNATURE_DELIVERY_VERSION = "vana.ps-enclave.delivery.v1";
+var MASTER_SIGNATURE_DELIVERY_MAX_AGE_SECONDS = 600;
 var SEALED_ENVELOPE_VERSION = 1;
 var VANA_MAINNET_CHAIN_ID = 1480;
 var MOKSHA_CHAIN_ID = 14800;
@@ -31762,12 +31763,19 @@ var KMS_ISSUED_PREFIX = "dstack-kms-issued";
 var PREIMAGE_SEPARATOR = ":";
 var UNCOMPRESSED_PUBLIC_KEY_BYTES = 65;
 var UNCOMPRESSED_PUBLIC_KEY_PREFIX = "04";
-var ENCLAVE_TRUST_ANCHORS = {
+var EMPTY_HEX = "0x";
+function emptyAnchor() {
+  return Object.freeze({
+    kmsRootPubkey: EMPTY_HEX,
+    appIds: Object.freeze([])
+  });
+}
+var ENCLAVE_TRUST_ANCHORS = Object.freeze({
   // filled at fleet provisioning; verify fails closed while empty
-  [VANA_MAINNET_CHAIN_ID]: { kmsRootPubkey: "0x", appIds: [] },
+  [VANA_MAINNET_CHAIN_ID]: emptyAnchor(),
   // filled at fleet provisioning; verify fails closed while empty
-  [MOKSHA_CHAIN_ID]: { kmsRootPubkey: "0x", appIds: [] }
-};
+  [MOKSHA_CHAIN_ID]: emptyAnchor()
+});
 function userPsId(chainId, ownerAddress) {
   const packed = encodePacked(
     ["string", "uint256", "address"],
@@ -31780,6 +31788,15 @@ function compressPublicKey(publicKey) {
     fromHex5(publicKey, "bytes")
   ).toRawBytes(true);
 }
+function sameKey(a, b) {
+  return toHex6(compressPublicKey(a)) === toHex6(compressPublicKey(b));
+}
+function assertUncompressedKey(publicKey) {
+  const hex = publicKey.slice(2);
+  if (hex.length !== UNCOMPRESSED_PUBLIC_KEY_BYTES * 2 || !hex.startsWith(UNCOMPRESSED_PUBLIC_KEY_PREFIX) || !/^[0-9a-fA-F]+$/.test(hex)) {
+    throw new Error("Public key must be a 65-byte uncompressed secp256k1 key");
+  }
+}
 function appRootPreimage(purpose, publicKey) {
   const keyHex = toHex6(compressPublicKey(publicKey)).slice(2);
   return keccak256(toBytes(`${purpose}${PREIMAGE_SEPARATOR}${keyHex}`));
@@ -31824,6 +31841,10 @@ async function verifyEnclaveIdentityEvidence(evidence, anchors, expected) {
   if (evidence.purpose !== ENCLAVE_WALLET_PURPOSE) {
     throw new Error("Unexpected enclave wallet purpose");
   }
+  if (anchors.kmsRootPubkey === EMPTY_HEX) {
+    throw new Error("KMS root trust anchor is not provisioned");
+  }
+  assertUncompressedKey(evidence.publicKey);
   const derivedAddress = publicKeyToAddress(evidence.publicKey);
   if (getAddress(derivedAddress) !== getAddress(evidence.address)) {
     throw new Error("Enclave public key does not match its address");
@@ -31838,10 +31859,13 @@ async function verifyEnclaveIdentityEvidence(evidence, anchors, expected) {
     evidence.signatureChain[1],
     1
   );
-  if (anchors.kmsRootPubkey === "0x") {
-    throw new Error("KMS root trust anchor is not provisioned");
+  let matchesAnchor;
+  try {
+    matchesAnchor = sameKey(kmsRootPublicKey, anchors.kmsRootPubkey);
+  } catch {
+    throw new Error("KMS root trust anchor is malformed");
   }
-  if (kmsRootPublicKey !== anchors.kmsRootPubkey.toLowerCase()) {
+  if (!matchesAnchor) {
     throw new Error("KMS root public key does not match the trust anchor");
   }
   if (keccak256(kmsRootPublicKey) !== evidence.kmsRootFingerprint.toLowerCase()) {
@@ -31868,14 +31892,13 @@ async function buildMasterSignatureDelivery(evidence, masterSignature, now = Mat
     issuedAt: now
   };
 }
-function assertUncompressedKey(publicKey) {
-  const hex = publicKey.slice(2);
-  if (hex.length !== UNCOMPRESSED_PUBLIC_KEY_BYTES * 2 || !hex.startsWith(UNCOMPRESSED_PUBLIC_KEY_PREFIX) || !/^[0-9a-fA-F]+$/.test(hex)) {
-    throw new Error("Public key must be a 65-byte uncompressed secp256k1 key");
-  }
-}
 async function encryptMasterSignatureDelivery(delivery, publicKey, ecies) {
   assertUncompressedKey(publicKey);
+  if (!isAddressEqual(publicKeyToAddress(publicKey), delivery.enclaveAddress)) {
+    throw new Error(
+      "Public key does not belong to the delivery's enclave address"
+    );
+  }
   const plaintext = toBytes(JSON.stringify(delivery));
   const encrypted = await ecies.encrypt(fromHex5(publicKey, "bytes"), plaintext);
   return `0x${serializeECIES(encrypted)}`;
@@ -35191,6 +35214,7 @@ export {
   LineageNodeSchema,
   LineageReadError,
   MASTER_KEY_MESSAGE,
+  MASTER_SIGNATURE_DELIVERY_MAX_AGE_SECONDS,
   MASTER_SIGNATURE_DELIVERY_VERSION,
   MAX_LINEAGE_SOURCES,
   MAX_QUESTION_CHARS,