@openzeppelin/miden-multisig-client 0.13.1 → 0.13.2

package/src/signers/miden-wallet.test.ts

@@ -54,6 +54,17 @@ describe('MidenWalletSigner', () => {
       expect(signer.publicKey).toBe('0xcommitment');
     });
 
+    it('should use explicit publicKey when provided', () => {
+      const signer = new MidenWalletSigner(
+        mockWallet,
+        '0xcommitment',
+        'ecdsa',
+        undefined,
+        '0xwalletpubkey',
+      );
+      expect(signer.publicKey).toBe('0xwalletpubkey');
+    });
+
     it('should use localAuthSigner publicKey when provided', () => {
       const localSigner: Signer = {
         commitment: '0xlocal',
@@ -106,6 +117,42 @@ describe('MidenWalletSigner', () => {
     });
   });
 
+  describe('signRequest', () => {
+    it('delegates to localAuthSigner when present', async () => {
+      const localSigner: Signer = {
+        commitment: '0xlocal',
+        publicKey: '0xlocalpubkey',
+        scheme: 'ecdsa',
+        signAccountIdWithTimestamp: vi.fn(),
+        signRequest: vi.fn().mockResolvedValue('0xlocalsig'),
+        signCommitment: vi.fn(),
+      };
+      const signer = new MidenWalletSigner(mockWallet, '0xcommitment', 'ecdsa', localSigner);
+
+      const result = await signer.signRequest(
+        '0x' + 'aa'.repeat(15),
+        1700000000,
+        { toBytes: () => new Uint8Array([1, 2, 3, 4]) } as never,
+      );
+
+      expect(result).toBe('0xlocalsig');
+      expect(localSigner.signRequest).toHaveBeenCalled();
+      expect(mockWallet.signBytes).not.toHaveBeenCalled();
+    });
+
+    it('uses request-bound auth digest for wallet-backed ECDSA signing', async () => {
+      const signer = new MidenWalletSigner(mockWallet, '0xcommitment', 'ecdsa');
+
+      await signer.signRequest(
+        '0x' + 'aa'.repeat(15),
+        1700000000,
+        { toBytes: () => new Uint8Array([1, 2, 3, 4]) } as never,
+      );
+
+      expect(mockWallet.signBytes).toHaveBeenCalledWith(expect.any(Uint8Array), 'word');
+    });
+  });
+
   describe('signature byte stripping', () => {
     it('should strip the first byte from wallet signature response', async () => {
       (mockWallet.signBytes as ReturnType<typeof vi.fn>).mockResolvedValue(

package/src/signers/miden-wallet.ts

@@ -1,3 +1,4 @@
+import type { RequestAuthPayload } from '@openzeppelin/guardian-client';
 import type { Signer, SignatureScheme } from '../types.js';
 import { AuthDigest } from '../utils/digest.js';
 import { bytesToHex } from '../utils/encoding.js';
@@ -19,12 +20,13 @@ export class MidenWalletSigner implements Signer {
     commitment: string,
     scheme: SignatureScheme,
     localAuthSigner?: Signer,
+    publicKey?: string,
   ) {
     this.wallet = wallet;
     this.commitment = commitment;
     this.scheme = scheme;
     this.localAuthSigner = localAuthSigner ?? null;
-    this.publicKey = localAuthSigner?.publicKey ?? commitment;
+    this.publicKey = publicKey ?? localAuthSigner?.publicKey ?? commitment;
   }
 
   async signAccountIdWithTimestamp(accountId: string, timestamp: number): Promise<string> {
@@ -35,6 +37,21 @@ export class MidenWalletSigner implements Signer {
     return this.signWord(word);
   }
 
+  async signRequest(
+    accountId: string,
+    timestamp: number,
+    requestPayload: RequestAuthPayload,
+  ): Promise<string> {
+    if (this.localAuthSigner?.signRequest) {
+      return this.localAuthSigner.signRequest(accountId, timestamp, requestPayload);
+    }
+
+    if (this.scheme === 'falcon') {
+      return this.signWord(AuthDigest.fromRequest(accountId, timestamp, requestPayload));
+    }
+    return this.signWord(AuthDigest.fromRequest(accountId, timestamp, requestPayload));
+  }
+
   async signCommitment(commitmentHex: string): Promise<string> {
     const word = AuthDigest.fromCommitmentHex(commitmentHex);
     return this.signWord(word);

package/src/signers/para.test.ts

@@ -1,6 +1,9 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { ParaSigner } from './para.js';
 import type { ParaSigningContext } from './para.js';
+import { keccak_256 } from '@noble/hashes/sha3.js';
+import { uint8ArrayToBase64 } from '../utils/encoding.js';
+import { wordToBytes } from '../utils/word.js';
 
 vi.mock('@miden-sdk/miden-sdk', () => ({
   Word: {
@@ -81,6 +84,60 @@ describe('ParaSigner', () => {
       );
       expect(result).toMatch(/^0x/);
     });
+
+    it('hashes the auth digest word bytes before signing', async () => {
+      const signer = new ParaSigner(mockPara, 'wallet-1', '0xcommitment', validCompressedKey);
+      await signer.signAccountIdWithTimestamp('0x' + 'aa'.repeat(15), 1700000000);
+
+      const expectedDigestBytes = keccak_256(
+        wordToBytes({
+          toFelts: () => [
+            { asInt: () => 10n },
+            { asInt: () => 20n },
+            { asInt: () => 30n },
+            { asInt: () => 40n },
+          ],
+        }),
+      );
+      const expectedBase64 = uint8ArrayToBase64(expectedDigestBytes);
+
+      expect(mockPara.signMessage).toHaveBeenCalledWith(
+        expect.objectContaining({
+          walletId: 'wallet-1',
+          messageBase64: expectedBase64,
+        }),
+      );
+    });
+  });
+
+  describe('signRequest', () => {
+    it('hashes the request-bound auth digest word bytes before signing', async () => {
+      const signer = new ParaSigner(mockPara, 'wallet-1', '0xcommitment', validCompressedKey);
+      await signer.signRequest(
+        '0x' + 'aa'.repeat(15),
+        1700000000,
+        { toBytes: () => new Uint8Array([1, 2, 3, 4]) } as never,
+      );
+
+      const expectedDigestBytes = keccak_256(
+        wordToBytes({
+          toFelts: () => [
+            { asInt: () => 10n },
+            { asInt: () => 20n },
+            { asInt: () => 30n },
+            { asInt: () => 40n },
+          ],
+        }),
+      );
+      const expectedBase64 = uint8ArrayToBase64(expectedDigestBytes);
+
+      expect(mockPara.signMessage).toHaveBeenCalledWith(
+        expect.objectContaining({
+          walletId: 'wallet-1',
+          messageBase64: expectedBase64,
+        }),
+      );
+    });
   });
 
   describe('signCommitment', () => {

package/src/signers/para.ts

@@ -1,3 +1,4 @@
+import type { RequestAuthPayload } from '@openzeppelin/guardian-client';
 import type { Signer, SignatureScheme } from '../types.js';
 import { AuthDigest } from '../utils/digest.js';
 import { EcdsaFormat } from '../utils/ecdsa.js';
@@ -5,7 +6,16 @@ import { hexToBytes, uint8ArrayToBase64 } from '../utils/encoding.js';
 import { wordToBytes } from '../utils/word.js';
 
 export interface ParaSigningContext {
-  signMessage(params: { walletId: string; messageBase64: string }): Promise<{ signature?: string }>;
+  signMessage(params: { walletId: string; messageBase64: string }): Promise<unknown>;
+}
+
+function extractSignature(response: unknown): string | null {
+  if (!response || typeof response !== 'object') {
+    return null;
+  }
+
+  const signature = (response as { signature?: unknown }).signature;
+  return typeof signature === 'string' ? signature : null;
 }
 
 export class ParaSigner implements Signer {
@@ -35,26 +45,35 @@ export class ParaSigner implements Signer {
     return this.signWord(digest);
   }
 
+  async signRequest(
+    accountId: string,
+    timestamp: number,
+    requestPayload: RequestAuthPayload,
+  ): Promise<string> {
+    const digest = AuthDigest.fromRequest(accountId, timestamp, requestPayload);
+    return this.signWord(digest);
+  }
+
   async signCommitment(commitmentHex: string): Promise<string> {
     const word = AuthDigest.fromCommitmentHex(commitmentHex);
     return this.signWord(word);
   }
 
   private async signWord(word: { toHex: () => string; toFelts: () => Array<{ asInt: () => bigint }> }): Promise<string> {
-    const wordBytes = wordToBytes(word);
-    const hashedHex = EcdsaFormat.keccakDigestHex(wordBytes);
-    const cleanHex = hashedHex.slice(2);
-    const messageBase64 = uint8ArrayToBase64(hexToBytes(cleanHex));
+    const messageBase64 = uint8ArrayToBase64(
+      hexToBytes(EcdsaFormat.keccakDigestHex(wordToBytes(word))),
+    );
 
     const res = await this.para.signMessage({
       walletId: this.walletId,
       messageBase64,
     });
 
-    if (!res.signature) {
+    const signature = extractSignature(res);
+    if (!signature) {
       throw new Error('Para signing was denied by user');
     }
 
-    return EcdsaFormat.normalizeRecoveryByte(res.signature);
+    return EcdsaFormat.normalizeRecoveryByte(signature);
   }
 }

package/src/transaction/consumeNotes.ts

@@ -13,6 +13,7 @@ export async function buildConsumeNotesTransactionRequest(
     throw new Error('At least one note ID is required');
   }
 
+  // Fetch full Note objects from the client store
   const noteAndArgsArray = new NoteAndArgsArray();
   for (const noteIdHex of noteIds) {
     const inputNoteRecord = await webClient.getInputNote(noteIdHex);

package/src/transaction/index.ts

@@ -1,7 +1,7 @@
 export { executeForSummary } from './summary.js';
 export { buildUpdateSignersTransactionRequest } from './updateSigners.js';
-export { buildUpdatePsmTransactionRequest } from './updatePsm.js';
+export { buildUpdateProcedureThresholdTransactionRequest } from './updateProcedureThreshold.js';
+export { buildUpdateGuardianTransactionRequest } from './updateGuardian.js';
 export { buildConsumeNotesTransactionRequest } from './consumeNotes.js';
 export { buildP2idTransactionRequest } from './p2id.js';
 export type { SignatureOptions } from './options.js';
-

package/src/transaction/options.ts

@@ -1,9 +1,8 @@
 import type { AdviceMap, Word } from '@miden-sdk/miden-sdk';
-import type { SignatureScheme } from '@openzeppelin/psm-client';
+import type { SignatureScheme } from '../types.js';
 
 export interface SignatureOptions {
   salt?: Word;
   signatureAdviceMap?: AdviceMap;
   signatureScheme?: SignatureScheme;
 }
-

package/src/transaction/p2id.test.ts

@@ -0,0 +1,190 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import type { Word } from '@miden-sdk/miden-sdk';
+
+const {
+  mockHashElements,
+  mockNormalizeHexWord,
+  mockRandomWord,
+  mockWordFromHex,
+  saltFelts,
+} = vi.hoisted(() => {
+  const saltFelts = [
+    { id: 'felt-0' },
+    { id: 'felt-1' },
+    { id: 'felt-2' },
+    { id: 'felt-3' },
+  ];
+
+  return {
+    mockHashElements: vi.fn().mockReturnValue({ toString: () => 'serial' }),
+    mockNormalizeHexWord: vi.fn((hex: string) => hex),
+    mockRandomWord: vi.fn().mockReturnValue({
+      toHex: () => '0x' + 'aa'.repeat(32),
+    }),
+    mockWordFromHex: vi.fn((hex: string) => ({
+      toHex: () => hex,
+      toFelts: () => saltFelts,
+    })),
+    saltFelts,
+  };
+});
+
+vi.mock('@miden-sdk/miden-sdk', () => {
+  class Felt {
+    readonly value: bigint;
+
+    constructor(value: bigint) {
+      this.value = value;
+    }
+  }
+
+  class FeltArray {
+    readonly values: unknown[];
+
+    constructor(values: unknown[]) {
+      this.values = values;
+    }
+  }
+
+  class NoteAssets {
+    constructor(_assets: unknown[]) {}
+  }
+
+  class NoteInputs {
+    constructor(_inputs: FeltArray) {}
+  }
+
+  class NoteMetadata {
+    constructor(
+      _sender: unknown,
+      _noteType: unknown,
+      _noteTag: unknown,
+    ) {}
+  }
+
+  class NoteRecipient {
+    constructor(
+      _serialNum: unknown,
+      _noteScript: unknown,
+      _noteInputs: unknown,
+    ) {}
+  }
+
+  class Note {
+    constructor(
+      _assets: unknown,
+      _metadata: unknown,
+      _recipient: unknown,
+    ) {}
+  }
+
+  class FungibleAsset {
+    constructor(_faucet: unknown, _amount: bigint) {}
+  }
+
+  class OutputNoteArray {
+    constructor(_notes: unknown[]) {}
+  }
+
+  class TransactionRequestBuilder {
+    withOwnOutputNotes(_notes: unknown): this {
+      return this;
+    }
+
+    withAuthArg(_authArg: unknown): this {
+      return this;
+    }
+
+    extendAdviceMap(_adviceMap: unknown): this {
+      return this;
+    }
+
+    build(): { kind: 'request' } {
+      return { kind: 'request' };
+    }
+  }
+
+  return {
+    AccountId: {
+      fromHex: vi.fn((hex: string) => ({
+        hex,
+        prefix: () => 1,
+        suffix: () => 2,
+      })),
+    },
+    Felt,
+    FeltArray,
+    FungibleAsset,
+    MidenArrays: {
+      OutputNoteArray,
+    },
+    Note,
+    NoteAssets,
+    NoteInputs,
+    NoteMetadata,
+    NoteRecipient,
+    NoteScript: {
+      p2id: vi.fn(() => ({ kind: 'p2id-script' })),
+    },
+    NoteTag: {
+      withAccountTarget: vi.fn(() => ({ kind: 'tag' })),
+    },
+    NoteType: {
+      Public: 'public',
+    },
+    OutputNote: {
+      full: vi.fn((note: unknown) => ({ note })),
+    },
+    Rpo256: {
+      hashElements: mockHashElements,
+    },
+    TransactionRequestBuilder,
+    Word: {
+      fromHex: mockWordFromHex,
+    },
+  };
+});
+
+vi.mock('../utils/encoding.js', () => ({
+  normalizeHexWord: mockNormalizeHexWord,
+}));
+
+vi.mock('../utils/random.js', () => ({
+  randomWord: mockRandomWord,
+}));
+
+import { buildP2idTransactionRequest } from './p2id.js';
+
+describe('buildP2idTransactionRequest', () => {
+  beforeEach(() => {
+    mockHashElements.mockClear();
+    mockNormalizeHexWord.mockClear();
+    mockRandomWord.mockClear();
+    mockWordFromHex.mockClear();
+  });
+
+  it('derives serial number from salt felts plus four zero felts', () => {
+    const salt = { toHex: () => '0x' + '11'.repeat(32) } as unknown as Word;
+
+    buildP2idTransactionRequest(
+      '0x7bfb0f38b0fafa103f86a805594170',
+      '0x8a65fc5a39e4cd106d648e3eb4ab5f',
+      '0x7bfb0f38b0fafa103f86a805594171',
+      10n,
+      { salt },
+    );
+
+    expect(mockRandomWord).not.toHaveBeenCalled();
+    expect(mockHashElements).toHaveBeenCalledTimes(1);
+
+    const [feltArrayArg] = mockHashElements.mock.calls[0] as [{ values: unknown[] }];
+    const values = feltArrayArg.values;
+
+    expect(values).toHaveLength(8);
+    expect(values.slice(0, 4)).toEqual(saltFelts);
+
+    for (const felt of values.slice(4)) {
+      expect((felt as { value: bigint }).value).toBe(0n);
+    }
+  });
+});

package/src/transaction/p2id.ts

@@ -22,6 +22,16 @@ import { randomWord } from '../utils/random.js';
 import { normalizeHexWord } from '../utils/encoding.js';
 import type { SignatureOptions } from './options.js';
 
+export function deriveP2idSerialNumber(salt: Word): Word {
+  return Rpo256.hashElements(new FeltArray([
+    ...salt.toFelts(),
+    new Felt(0n),
+    new Felt(0n),
+    new Felt(0n),
+    new Felt(0n),
+  ]));
+}
+
 function buildP2idNote(
   sender: AccountId,
   recipient: AccountId,
@@ -30,10 +40,7 @@ function buildP2idNote(
   saltHex: string,
 ): Note {
   const salt = WordType.fromHex(normalizeHexWord(saltHex));
-  const serialNum = Rpo256.hashElements(new FeltArray([
-    ...salt.toFelts(),
-    new Felt(0n),
-  ]));
+  const serialNum = deriveP2idSerialNumber(salt);
 
   const noteScript = NoteScript.p2id();
   const noteInputs = new NoteInputs(new FeltArray([
@@ -97,4 +104,3 @@ export function buildP2idTransactionRequest(
     salt: authSaltForReturn,
   };
 }
-

package/src/transaction/rpoRandomCoin.test.ts

@@ -0,0 +1,64 @@
+import { describe, expect, it, vi } from 'vitest';
+import type { Word } from '@miden-sdk/miden-sdk';
+
+const { mockHashElements, seedFelts } = vi.hoisted(() => {
+  const seedFelts = [
+    { id: 'seed-0' },
+    { id: 'seed-1' },
+    { id: 'seed-2' },
+    { id: 'seed-3' },
+  ];
+
+  return {
+    mockHashElements: vi.fn().mockReturnValue({ id: 'drawn-word' }),
+    seedFelts,
+  };
+});
+
+vi.mock('@miden-sdk/miden-sdk', () => {
+  class Felt {
+    readonly value: bigint;
+
+    constructor(value: bigint) {
+      this.value = value;
+    }
+  }
+
+  class FeltArray {
+    readonly values: unknown[];
+
+    constructor(values: unknown[]) {
+      this.values = values;
+    }
+  }
+
+  return {
+    Felt,
+    FeltArray,
+    Rpo256: {
+      hashElements: mockHashElements,
+    },
+  };
+});
+
+import { RpoRandomCoin } from './rpoRandomCoin.js';
+
+describe('RpoRandomCoin', () => {
+  it('drawWord hashes seed felts plus four zero felts', () => {
+    const seed = { toFelts: () => seedFelts } as unknown as Word;
+    const coin = new RpoRandomCoin(seed);
+    const drawn = coin.drawWord();
+
+    expect(drawn).toEqual({ id: 'drawn-word' });
+    expect(mockHashElements).toHaveBeenCalledTimes(1);
+
+    const [feltArrayArg] = mockHashElements.mock.calls[0] as [{ values: unknown[] }];
+    const values = feltArrayArg.values;
+
+    expect(values).toHaveLength(8);
+    expect(values.slice(0, 4)).toEqual(seedFelts);
+    for (const felt of values.slice(4)) {
+      expect((felt as { value: bigint }).value).toBe(0n);
+    }
+  });
+});

package/src/transaction/rpoRandomCoin.ts

@@ -0,0 +1,24 @@
+import {
+  Felt,
+  FeltArray,
+  Rpo256,
+  type Word,
+} from '@miden-sdk/miden-sdk';
+
+export class RpoRandomCoin {
+  private readonly seed: Word;
+
+  constructor(seed: Word) {
+    this.seed = seed;
+  }
+
+  drawWord(): Word {
+    return Rpo256.hashElements(new FeltArray([
+      ...this.seed.toFelts(),
+      new Felt(0n),
+      new Felt(0n),
+      new Felt(0n),
+      new Felt(0n),
+    ]));
+  }
+}

package/src/transaction/{updatePsm.ts → updateGuardian.ts}

@@ -8,62 +8,49 @@ import {
   Word,
   Word as WordType,
 } from '@miden-sdk/miden-sdk';
-import { PSM_ECDSA_MASM, PSM_MASM } from '../account/masm.js';
+import { GUARDIAN_ECDSA_MASM, GUARDIAN_MASM } from '../account/masm/auth.js';
 import { normalizeHexWord } from '../utils/encoding.js';
 import { randomWord } from '../utils/random.js';
 import type { SignatureOptions } from './options.js';
+import type { SignatureScheme } from '../types.js';
 
-function buildUpdatePsmFalconScript(webClient: WebClient): TransactionScript {
-  const libBuilder = webClient.createCodeBuilder();
-  const psmLib = libBuilder.buildLibrary('openzeppelin::psm', PSM_MASM);
-  libBuilder.linkDynamicLibrary(psmLib);
-
-  const scriptSource = `
-use openzeppelin::psm
-
-begin
-    adv.push_mapval
-    dropw
-    call.psm::update_psm_public_key
-end
-  `;
-
-  return libBuilder.compileTxScript(scriptSource);
-}
-
-function buildUpdatePsmEcdsaScript(webClient: WebClient): TransactionScript {
+function buildUpdateGuardianScript(
+  webClient: WebClient,
+  signatureScheme: SignatureScheme,
+): TransactionScript {
   const libBuilder = webClient.createCodeBuilder();
-  const psmLib = libBuilder.buildLibrary('openzeppelin::psm_ecdsa', PSM_ECDSA_MASM);
-  libBuilder.linkDynamicLibrary(psmLib);
+  const guardianLibraryPath = signatureScheme === 'ecdsa' ? 'openzeppelin::guardian_ecdsa' : 'openzeppelin::guardian';
+  const guardianMasm = signatureScheme === 'ecdsa' ? GUARDIAN_ECDSA_MASM : GUARDIAN_MASM;
+  const guardianProcedure = signatureScheme === 'ecdsa' ? 'guardian_ecdsa' : 'guardian';
+  const guardianLib = libBuilder.buildLibrary(guardianLibraryPath, guardianMasm);
+  libBuilder.linkDynamicLibrary(guardianLib);
 
   const scriptSource = `
-use openzeppelin::psm_ecdsa
+use openzeppelin::${guardianProcedure}
 
 begin
     adv.push_mapval
     dropw
-    call.psm_ecdsa::update_psm_public_key
+    call.${guardianProcedure}::update_guardian_public_key
 end
   `;
 
   return libBuilder.compileTxScript(scriptSource);
 }
 
-export async function buildUpdatePsmTransactionRequest(
+export async function buildUpdateGuardianTransactionRequest(
   webClient: WebClient,
-  newPsmPubkey: string,
+  newGuardianPubkey: string,
   options: SignatureOptions = {},
 ): Promise<{ request: TransactionRequest; salt: Word }> {
   const signatureScheme = options.signatureScheme ?? 'falcon';
-  const script = signatureScheme === 'ecdsa'
-    ? buildUpdatePsmEcdsaScript(webClient)
-    : buildUpdatePsmFalconScript(webClient);
+  const script = buildUpdateGuardianScript(webClient, signatureScheme);
 
   const authSaltHex = options.salt ? options.salt.toHex() : randomWord().toHex();
 
-  const pubkeyWordForAdvice = WordType.fromHex(normalizeHexWord(newPsmPubkey));
-  const pubkeyWordForFelts = WordType.fromHex(normalizeHexWord(newPsmPubkey));
-  const pubkeyWordForScript = WordType.fromHex(normalizeHexWord(newPsmPubkey));
+  const pubkeyWordForAdvice = WordType.fromHex(normalizeHexWord(newGuardianPubkey));
+  const pubkeyWordForFelts = WordType.fromHex(normalizeHexWord(newGuardianPubkey));
+  const pubkeyWordForScript = WordType.fromHex(normalizeHexWord(newGuardianPubkey));
 
   const advice = new AdviceMap();
   advice.insert(pubkeyWordForAdvice, new FeltArray(pubkeyWordForFelts.toFelts()));