@orbinum/sdk 0.18.0 → 0.19.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.mts +148 -22
- package/dist/index.d.ts +148 -22
- package/dist/index.js +61 -8
- package/dist/index.mjs +56 -8
- package/package.json +1 -1
package/dist/index.d.mts
CHANGED
|
@@ -2357,36 +2357,152 @@ declare const BABYJUB_SUBORDER = 27360303589799094027808007181571593860768139721
|
|
|
2357
2357
|
*/
|
|
2358
2358
|
declare function randomBlinding(): bigint;
|
|
2359
2359
|
|
|
2360
|
+
/**
|
|
2361
|
+
* SpendingKeyRequest
|
|
2362
|
+
*
|
|
2363
|
+
* What the user signs to derive their Orbinum spending key, per platform.
|
|
2364
|
+
*
|
|
2365
|
+
* These builders produce the *request* (typed data or message string). Turning a
|
|
2366
|
+
* signature into key material lives in `PrivacyKeys` — the split keeps the
|
|
2367
|
+
* platform-specific presentation away from the platform-agnostic KDF.
|
|
2368
|
+
*
|
|
2369
|
+
* SECURITY MODEL
|
|
2370
|
+
*
|
|
2371
|
+
* The signature seeds the spending key, so a deterministic signature over a
|
|
2372
|
+
* fixed, public string is a bearer token: any dapp the user connects to can
|
|
2373
|
+
* request the same string, obtain a byte-identical signature (ECDSA personal_sign
|
|
2374
|
+
* is deterministic, RFC-6979) and reconstruct the spending key, viewing key and
|
|
2375
|
+
* vault key. That is the v1 flaw these builders exist to close.
|
|
2376
|
+
*
|
|
2377
|
+
* The defense has two independent layers:
|
|
2378
|
+
*
|
|
2379
|
+
* 1. Message layer (here) — bind the signature to a domain the user can see.
|
|
2380
|
+
* EVM uses EIP-712, whose domain the wallet renders. Substrate has no
|
|
2381
|
+
* EIP-712, so the warning travels inside the signed text instead. NOTE this
|
|
2382
|
+
* layer is about VISIBILITY, not impossibility: nothing stops a hostile
|
|
2383
|
+
* origin from requesting the same payload, and no wallet verifies that
|
|
2384
|
+
* `verifyingContract` matches the requesting origin.
|
|
2385
|
+
* 2. Derivation layer (`PrivacyKeys`) — the HKDF `info` carries the version, so
|
|
2386
|
+
* v1 and v2 are disjoint identities even given identical signature bytes.
|
|
2387
|
+
* This is the layer that holds when layer 1 fails (e.g. a wallet that
|
|
2388
|
+
* truncates the warning text).
|
|
2389
|
+
*
|
|
2390
|
+
* DETERMINISM IS MANDATORY. No builder may add a nonce, timestamp or challenge:
|
|
2391
|
+
* the digest must stay a pure function of (chainId, address). A signature that
|
|
2392
|
+
* varies per session yields a different spending key each time, which makes
|
|
2393
|
+
* already-shielded notes unspendable — surfacing as an opaque Merkle constraint
|
|
2394
|
+
* failure during witness generation.
|
|
2395
|
+
*/
|
|
2396
|
+
/**
|
|
2397
|
+
* EIP-712 `verifyingContract` for spending-key derivation: the shielded pool
|
|
2398
|
+
* precompile, i.e. the component that actually custodies shielded funds and so
|
|
2399
|
+
* the semantically correct domain anchor.
|
|
2400
|
+
*
|
|
2401
|
+
* WARNING: this value is part of the EIP-712 digest. Changing it changes every
|
|
2402
|
+
* derived spending key and orphans every existing note. It is a protocol
|
|
2403
|
+
* constant, not a config knob — which is why it is re-exported from the single
|
|
2404
|
+
* `PRECOMPILE_ADDR` source rather than written out a second time.
|
|
2405
|
+
*/
|
|
2406
|
+
declare const SPENDING_KEY_VERIFYING_CONTRACT: "0x0000000000000000000000000000000000000801";
|
|
2407
|
+
/**
|
|
2408
|
+
* Shown to the user inside the wallet prompt. Wallets render EIP-712 message
|
|
2409
|
+
* fields (and Substrate raw text) verbatim, so this is the one surface a hostile
|
|
2410
|
+
* origin can neither suppress nor reword.
|
|
2411
|
+
*/
|
|
2412
|
+
declare const SPENDING_KEY_WARNING: string;
|
|
2413
|
+
/** EIP-712 payload for `eth_signTypedData_v4`. */
|
|
2414
|
+
interface SpendingKeyTypedData {
|
|
2415
|
+
domain: {
|
|
2416
|
+
name: string;
|
|
2417
|
+
version: string;
|
|
2418
|
+
chainId: number;
|
|
2419
|
+
verifyingContract: string;
|
|
2420
|
+
};
|
|
2421
|
+
types: {
|
|
2422
|
+
SpendingKeyDerivation: ReadonlyArray<{
|
|
2423
|
+
name: string;
|
|
2424
|
+
type: string;
|
|
2425
|
+
}>;
|
|
2426
|
+
};
|
|
2427
|
+
primaryType: 'SpendingKeyDerivation';
|
|
2428
|
+
message: {
|
|
2429
|
+
warning: string;
|
|
2430
|
+
account: string;
|
|
2431
|
+
};
|
|
2432
|
+
}
|
|
2433
|
+
/**
|
|
2434
|
+
* EIP-712 typed data the user signs to derive their spending key (EVM route).
|
|
2435
|
+
* Pass the result to `eth_signTypedData_v4`.
|
|
2436
|
+
*
|
|
2437
|
+
* @param chainId Chain the identity belongs to; part of the domain separator.
|
|
2438
|
+
* @param address Signer address. Lowercased so checksum casing cannot fork the
|
|
2439
|
+
* identity into two distinct keys for the same account.
|
|
2440
|
+
*/
|
|
2441
|
+
declare function deriveSpendingKeyTypedData(chainId: number, address: string): SpendingKeyTypedData;
|
|
2442
|
+
/**
|
|
2443
|
+
* Message the user signs on signers without EIP-712 (Substrate: sr25519 via VRF,
|
|
2444
|
+
* ed25519 via signRaw).
|
|
2445
|
+
*
|
|
2446
|
+
* Substrate wallets render the raw string, so the warning leads the text — it is
|
|
2447
|
+
* the only channel a malicious extension cannot rewrite. Its protection is
|
|
2448
|
+
* therefore conditional on the wallet not truncating the message; when it does,
|
|
2449
|
+
* only the HKDF domain separation in `PrivacyKeys` still applies.
|
|
2450
|
+
*/
|
|
2451
|
+
declare function deriveSpendingKeyMessageV2(chainId: number, address: string): string;
|
|
2452
|
+
/**
|
|
2453
|
+
* @deprecated INSECURE — v1 derivation. Signs a fixed public string via
|
|
2454
|
+
* `personal_sign`, so any dapp can request it and, because the signature is
|
|
2455
|
+
* deterministic, reconstruct the user's spending key, viewing key and vault key.
|
|
2456
|
+
*
|
|
2457
|
+
* Retained ONLY so existing v1 notes can be swept into a v2 identity. Never call
|
|
2458
|
+
* it on a connect/login path. Use {@link deriveSpendingKeyTypedData} (EVM) or
|
|
2459
|
+
* {@link deriveSpendingKeyMessageV2} (Substrate) instead.
|
|
2460
|
+
*/
|
|
2461
|
+
declare function deriveSpendingKeyMessage(chainId: number, address: string): string;
|
|
2462
|
+
|
|
2360
2463
|
/**
|
|
2361
2464
|
* PrivacyKeys
|
|
2362
2465
|
*
|
|
2363
|
-
* Pure cryptographic derivation
|
|
2364
|
-
*
|
|
2466
|
+
* Pure cryptographic derivation for the Orbinum shielded pool identity: turns a
|
|
2467
|
+
* wallet signature into key material, and key material into the public values
|
|
2468
|
+
* that make up a privacy address. Protocol-level only — no storage, UI or
|
|
2469
|
+
* session concerns. What the user *signs* to produce that signature lives in
|
|
2470
|
+
* `SpendingKeyRequest`.
|
|
2471
|
+
*
|
|
2472
|
+
* Full derivation chain:
|
|
2365
2473
|
*
|
|
2366
|
-
*
|
|
2367
|
-
*
|
|
2368
|
-
*
|
|
2369
|
-
*
|
|
2370
|
-
*
|
|
2474
|
+
* signature ──HKDF(info="orbinum-sk-{version}:{chainId}:{address}")──► masterBytes (32B)
|
|
2475
|
+
* │
|
|
2476
|
+
* ┌─────────────────────────────────────────────────────────────────┤
|
|
2477
|
+
* ▼ ▼
|
|
2478
|
+
* spendingKey = BigInt(masterBytes) % BABYJUB_SUBORDER vaultKey (see vault/)
|
|
2479
|
+
* │ = HKDF(masterBytes, "orbinum-vault-key-v1")
|
|
2480
|
+
* ├──► ownerPk = BJJ_mul(Base8, spendingKey).Ax (public)
|
|
2481
|
+
* │
|
|
2482
|
+
* └──► ivsk = HKDF(LE32(spendingKey), info="orbinum-ivk-v1") (secret)
|
|
2483
|
+
* └──► ivk = packPoint(BJJ_mul(Base8, ivsk_scalar)) (public)
|
|
2371
2484
|
*
|
|
2372
|
-
*
|
|
2373
|
-
*
|
|
2374
|
-
*
|
|
2375
|
-
*
|
|
2485
|
+
* VERSIONING: the HKDF `info` carries the identity version, so v1 and v2 are
|
|
2486
|
+
* cryptographically disjoint even given identical signature bytes. This is the
|
|
2487
|
+
* layer that still separates the identities when the message-level defense fails
|
|
2488
|
+
* — see the security model in `SpendingKeyRequest`.
|
|
2376
2489
|
*
|
|
2377
|
-
*
|
|
2378
|
-
* Num2Bits(253)
|
|
2379
|
-
*
|
|
2490
|
+
* MODULUS: reduce mod BABYJUB_SUBORDER, never BN254_R. circomlib's BabyPbk uses
|
|
2491
|
+
* Num2Bits(253), asserting spending_key < 2^253. BABYJUB_SUBORDER < 2^252
|
|
2492
|
+
* satisfies it; BN254_R ≈ 2^254.8 does not — ~34% of values would fail at runtime.
|
|
2380
2493
|
*/
|
|
2494
|
+
/** Identity version. `v1` is the legacy personal_sign scheme, kept for sweeping only. */
|
|
2495
|
+
type KeyVersion = 'v1' | 'v2';
|
|
2381
2496
|
/**
|
|
2382
|
-
*
|
|
2383
|
-
*
|
|
2497
|
+
* Shortest signature any supported signer produces: sr25519 VRF output is 32
|
|
2498
|
+
* bytes, ed25519 is 64, ECDSA `personal_sign` is 65. Anything shorter is not a
|
|
2499
|
+
* signature, so it must never reach the KDF.
|
|
2384
2500
|
*/
|
|
2385
|
-
declare
|
|
2501
|
+
declare const MIN_SIGNATURE_BYTES = 32;
|
|
2386
2502
|
/**
|
|
2387
2503
|
* Derives the 32-byte master key bytes from a wallet signature.
|
|
2388
2504
|
*
|
|
2389
|
-
* masterBytes = HKDF-SHA256(ikm=sigBytes, salt=empty, info="orbinum-sk-
|
|
2505
|
+
* masterBytes = HKDF-SHA256(ikm=sigBytes, salt=empty, info="orbinum-sk-{version}:{chainId}:{address}")
|
|
2390
2506
|
*
|
|
2391
2507
|
* These bytes are the stable root for ALL derived keys:
|
|
2392
2508
|
* - spendingKey (circuit scalar) = BigInt(masterBytes) % BABYJUB_SUBORDER
|
|
@@ -2396,12 +2512,19 @@ declare function deriveSpendingKeyMessage(chainId: number, address: string): str
|
|
|
2396
2512
|
* Separating masterBytes from the circuit scalar means the viewingSecretKey and
|
|
2397
2513
|
* vault key are STABLE across any future change to the modulus — they never
|
|
2398
2514
|
* depend on which prime field the circuit uses.
|
|
2515
|
+
*
|
|
2516
|
+
* The version is folded into the HKDF `info`, so v1 and v2 stay disjoint even if
|
|
2517
|
+
* the underlying signature bytes were somehow identical.
|
|
2518
|
+
*
|
|
2519
|
+
* @param version Defaults to 'v2'. Pass 'v1' only from the legacy sweep flow.
|
|
2520
|
+
* @throws If the signature is not valid hex, or carries less entropy than the
|
|
2521
|
+
* shortest real signing scheme (see {@link MIN_SIGNATURE_BYTES}).
|
|
2399
2522
|
*/
|
|
2400
|
-
declare function deriveMasterKeyBytes(signatureHex: string, chainId: number, address: string): Promise<Uint8Array>;
|
|
2523
|
+
declare function deriveMasterKeyBytes(signatureHex: string, chainId: number, address: string, version?: KeyVersion): Promise<Uint8Array>;
|
|
2401
2524
|
/**
|
|
2402
2525
|
* Derives an Orbinum spending key from a wallet signature.
|
|
2403
2526
|
*
|
|
2404
|
-
* Uses HKDF-SHA256(ikm=sigBytes, salt=empty, info="orbinum-sk-
|
|
2527
|
+
* Uses HKDF-SHA256(ikm=sigBytes, salt=empty, info="orbinum-sk-{version}:{chainId}:{address}")
|
|
2405
2528
|
* and reduces the resulting 32-byte value modulo BABYJUB_SUBORDER.
|
|
2406
2529
|
*
|
|
2407
2530
|
* IMPORTANT: viewingSecretKey and vaultKey must be derived from masterBytes (via
|
|
@@ -2411,9 +2534,12 @@ declare function deriveMasterKeyBytes(signatureHex: string, chainId: number, add
|
|
|
2411
2534
|
* @param signatureHex 0x-prefixed or bare hex of the wallet signature.
|
|
2412
2535
|
* @param chainId Chain ID used when building the signing message.
|
|
2413
2536
|
* @param address Signer address (EVM or SS58) used in the signing message.
|
|
2537
|
+
* @param version Defaults to 'v2'. Pass 'v1' only from the legacy sweep flow.
|
|
2414
2538
|
* @returns bigint in [1, BABYJUB_SUBORDER)
|
|
2539
|
+
* @throws If the signature is not valid hex or is shorter than
|
|
2540
|
+
* {@link MIN_SIGNATURE_BYTES} — see `deriveMasterKeyBytes`.
|
|
2415
2541
|
*/
|
|
2416
|
-
declare function deriveSpendingKeyFromSignature(signatureHex: string, chainId: number, address: string): Promise<bigint>;
|
|
2542
|
+
declare function deriveSpendingKeyFromSignature(signatureHex: string, chainId: number, address: string, version?: KeyVersion): Promise<bigint>;
|
|
2417
2543
|
/**
|
|
2418
2544
|
* Derive a 32-byte viewing secret key (ivsk) from the spending key.
|
|
2419
2545
|
* ivsk = HKDF-SHA256(ikm=bigintTo32Le(spendingKey), info="orbinum-ivk-v1")
|
|
@@ -4308,4 +4434,4 @@ interface ExtrinsicFailedData {
|
|
|
4308
4434
|
dispatch_info: DispatchInfo;
|
|
4309
4435
|
}
|
|
4310
4436
|
|
|
4311
|
-
export { type AccountListing, type AccountMappedData, type AccountMappedEvent, type AccountMappingCall, type AccountMappingEvent, AccountMappingModule, AccountMappingPrecompile, type AccountMetadata, type AccountUnmappedEvent, type ActiveVersionSetEvent, type AddChainLinkArgs, type AddChainLinkParams, type AddSupportedChainArgs, type AliasFullIdentity, type AliasInfo, type AliasListedForSaleEvent, type AliasOnSaleData, type AliasRegisteredData, type AliasRegisteredEvent, type AliasReleasedEvent, type AliasSaleCancelledEvent, type AliasSoldData, type AliasSoldEvent, type AliasTransferredData, type AliasTransferredEvent, type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BatchRegisterVerificationKeysArgs, type BatchVerificationKeysRegisteredEvent, type BlockInfo, type BuyAliasArgs, type Bytes32, CURRENT_CIRCUIT_VERSION, type ChainInfo, type ChainLink, type ChainLinkAddedEvent, type ChainLinkRemovedEvent, CircuitId, CircuitId as CircuitIdType, CircuitVersionResolver, type ClaimShieldedFeesParams, type ClientProviderConfig, type CommitmentsInsertedEvent, type CommitmentsInsertedEventData, type ConnectionStatus, CryptoPrecompiles, type DecodedAddChainLinkArgs, type DecodedBatchArgs, type DecodedDispatchAsPrivateLinkArgs, type DecodedEthereumTransactArgs, type DecodedEvmCallArgs, type DecodedPrecompile, type DecodedPrivateTransferArgs, type DecodedPutAliasForSaleArgs, type DecodedRegisterAliasArgs, type DecodedRemarkArgs, type DecodedRevealPrivateLinkArgs, type DecodedSetAccountMetadataArgs, type DecodedShieldArgs, type DecodedShieldBatchArgs, type DecodedShieldBatchOperation, type DecodedSudoArgs, type DecodedTransferAllArgs, type DecodedTransferArgs, type DecodedTransferKeepAliveArgs, type DecodedUnshieldArgs, type DecryptedMemo, type DispatchAsLinkedAccountArgs, type DispatchAsLinkedParams, type DispatchAsPrivateLinkArgs, type DispatchError, type DispatchInfo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, type EncryptedNoteRecord, type EndowedEventData, type EthereumExecutedData, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, type EvmExecutedData, type EvmExitReason, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFailedData, type ExtrinsicSuccessData, type FeeClaimProofInputs, type FormatOptions, KNOWN_PRECOMPILES, type KnownPrecompileInfo, type ListingInfo, type MerkleRootUpdatedData, type MerkleRootUpdatedEvent, type MerkleTreeInfo, type MetadataUpdatedEvent, NoteBuilder, type NoteDisclosure, type NoteInput, type NoteStatusUpdate, type NullifiersSpentEvent, type NullifiersSpentEventData, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, PRECOMPILE_ADDR, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateChainLinkAddedEvent, type PrivateChainLinkRemovedEvent, type PrivateChainLinkRevealedEvent, type PrivateLink, type PrivateLinkDispatchExecutedEvent, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type ProofVerificationFailedEvent, type ProofVerifiedEvent, type ProxyCallExecutedEvent, type PutAliasOnSaleArgs, type PutOnSaleParams, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type RegisterAliasArgs, type RegisterAssetArgs, type RegisterPrivateLinkArgs, type RegisterVerificationKeyArgs, type RelayerInfo, RelayerStatusModule, type RemoveChainLinkArgs, type RemovePrivateLinkArgs, type RemoveSupportedChainArgs, type RemoveVerificationKeyArgs, type ReservedEventData, type ResolvedAlias, type ResolvedSpendVersion, type RevealPrivateLinkArgs, type RpcV2MerkleProof, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, SLIP0044_NAMESPACE, type ScanCommitment, type SelfEphWindowEntry, type SetAccountMetadataArgs, type SetActiveVersionArgs, type SetMetadataParams, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedEvent, type ShieldedEventData, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, SignatureScheme, type StatusChangeEvent, type StatusListener, SubstrateClient, type SupportedChain, type SupportedChainAddedEvent, type SupportedChainRemovedEvent, type SystemHealth, type TokenInfo, type TokenTransfer, type TransferAliasArgs, type TransferEventData, type TransferInputNote, type TransferOutputNote, type TryDecryptOptions, type TxResult, type UnsafeTxOptions, type UnshieldArgs, type UnshieldParams, type UnshieldProofInputs, type UnshieldedEvent, type UnshieldedEventData, type UnverifyAssetArgs, VaultLockedError, type VerificationKeyRegisteredEvent, type VerificationKeyRemovedEvent, type VerifyAssetArgs, type VerifyProofArgs, type VkEntry, type ZkNote, type ZkVerifierCall, type ZkVerifierCircuitVersionInfo, type ZkVerifierEvent, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, applyNoteStatus, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildDummyTransferInput, bytesToBigintLE, computeNoteCommitment, computeNullifier, computePathIndices, createNoteDisclosureKey, decodeNoteDisclosureKey, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOwnerPk, deriveSelfEphSk, deriveSpendingKeyFromSignature, deriveSpendingKeyMessage, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewTag, deriveViewingPublicKey, deriveViewingSecretKey, encryptJson, encryptNote, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, formatBalance, formatORB, fromBase64, fromHex, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getPrecompileLabel, hexToBigint, hexToNumber, implicitSubstrateToEvm, isEvmAddress, isImplicitEvmAccount, isSs58, isSubstrateAddress, isUnifiedAddress, leHexToBigint, mapExtrinsicArgs, mapZkEventData, normalizeEvmAddress, noteBlindTag, randomBlinding, recoverOwnerPkPoint, selectNotes, selfEphWindow, shortHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, vaultReplacer, vaultReviver };
|
|
4437
|
+
export { type AccountListing, type AccountMappedData, type AccountMappedEvent, type AccountMappingCall, type AccountMappingEvent, AccountMappingModule, AccountMappingPrecompile, type AccountMetadata, type AccountUnmappedEvent, type ActiveVersionSetEvent, type AddChainLinkArgs, type AddChainLinkParams, type AddSupportedChainArgs, type AliasFullIdentity, type AliasInfo, type AliasListedForSaleEvent, type AliasOnSaleData, type AliasRegisteredData, type AliasRegisteredEvent, type AliasReleasedEvent, type AliasSaleCancelledEvent, type AliasSoldData, type AliasSoldEvent, type AliasTransferredData, type AliasTransferredEvent, type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BatchRegisterVerificationKeysArgs, type BatchVerificationKeysRegisteredEvent, type BlockInfo, type BuyAliasArgs, type Bytes32, CURRENT_CIRCUIT_VERSION, type ChainInfo, type ChainLink, type ChainLinkAddedEvent, type ChainLinkRemovedEvent, CircuitId, CircuitId as CircuitIdType, CircuitVersionResolver, type ClaimShieldedFeesParams, type ClientProviderConfig, type CommitmentsInsertedEvent, type CommitmentsInsertedEventData, type ConnectionStatus, CryptoPrecompiles, type DecodedAddChainLinkArgs, type DecodedBatchArgs, type DecodedDispatchAsPrivateLinkArgs, type DecodedEthereumTransactArgs, type DecodedEvmCallArgs, type DecodedPrecompile, type DecodedPrivateTransferArgs, type DecodedPutAliasForSaleArgs, type DecodedRegisterAliasArgs, type DecodedRemarkArgs, type DecodedRevealPrivateLinkArgs, type DecodedSetAccountMetadataArgs, type DecodedShieldArgs, type DecodedShieldBatchArgs, type DecodedShieldBatchOperation, type DecodedSudoArgs, type DecodedTransferAllArgs, type DecodedTransferArgs, type DecodedTransferKeepAliveArgs, type DecodedUnshieldArgs, type DecryptedMemo, type DispatchAsLinkedAccountArgs, type DispatchAsLinkedParams, type DispatchAsPrivateLinkArgs, type DispatchError, type DispatchInfo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, type EncryptedNoteRecord, type EndowedEventData, type EthereumExecutedData, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, type EvmExecutedData, type EvmExitReason, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFailedData, type ExtrinsicSuccessData, type FeeClaimProofInputs, type FormatOptions, KNOWN_PRECOMPILES, type KeyVersion, type KnownPrecompileInfo, type ListingInfo, MIN_SIGNATURE_BYTES, type MerkleRootUpdatedData, type MerkleRootUpdatedEvent, type MerkleTreeInfo, type MetadataUpdatedEvent, NoteBuilder, type NoteDisclosure, type NoteInput, type NoteStatusUpdate, type NullifiersSpentEvent, type NullifiersSpentEventData, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, PRECOMPILE_ADDR, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateChainLinkAddedEvent, type PrivateChainLinkRemovedEvent, type PrivateChainLinkRevealedEvent, type PrivateLink, type PrivateLinkDispatchExecutedEvent, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type ProofVerificationFailedEvent, type ProofVerifiedEvent, type ProxyCallExecutedEvent, type PutAliasOnSaleArgs, type PutOnSaleParams, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type RegisterAliasArgs, type RegisterAssetArgs, type RegisterPrivateLinkArgs, type RegisterVerificationKeyArgs, type RelayerInfo, RelayerStatusModule, type RemoveChainLinkArgs, type RemovePrivateLinkArgs, type RemoveSupportedChainArgs, type RemoveVerificationKeyArgs, type ReservedEventData, type ResolvedAlias, type ResolvedSpendVersion, type RevealPrivateLinkArgs, type RpcV2MerkleProof, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, SLIP0044_NAMESPACE, SPENDING_KEY_VERIFYING_CONTRACT, SPENDING_KEY_WARNING, type ScanCommitment, type SelfEphWindowEntry, type SetAccountMetadataArgs, type SetActiveVersionArgs, type SetMetadataParams, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedEvent, type ShieldedEventData, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, SignatureScheme, type SpendingKeyTypedData, type StatusChangeEvent, type StatusListener, SubstrateClient, type SupportedChain, type SupportedChainAddedEvent, type SupportedChainRemovedEvent, type SystemHealth, type TokenInfo, type TokenTransfer, type TransferAliasArgs, type TransferEventData, type TransferInputNote, type TransferOutputNote, type TryDecryptOptions, type TxResult, type UnsafeTxOptions, type UnshieldArgs, type UnshieldParams, type UnshieldProofInputs, type UnshieldedEvent, type UnshieldedEventData, type UnverifyAssetArgs, VaultLockedError, type VerificationKeyRegisteredEvent, type VerificationKeyRemovedEvent, type VerifyAssetArgs, type VerifyProofArgs, type VkEntry, type ZkNote, type ZkVerifierCall, type ZkVerifierCircuitVersionInfo, type ZkVerifierEvent, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, applyNoteStatus, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildDummyTransferInput, bytesToBigintLE, computeNoteCommitment, computeNullifier, computePathIndices, createNoteDisclosureKey, decodeNoteDisclosureKey, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOwnerPk, deriveSelfEphSk, deriveSpendingKeyFromSignature, deriveSpendingKeyMessage, deriveSpendingKeyMessageV2, deriveSpendingKeyTypedData, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewTag, deriveViewingPublicKey, deriveViewingSecretKey, encryptJson, encryptNote, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, formatBalance, formatORB, fromBase64, fromHex, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getPrecompileLabel, hexToBigint, hexToNumber, implicitSubstrateToEvm, isEvmAddress, isImplicitEvmAccount, isSs58, isSubstrateAddress, isUnifiedAddress, leHexToBigint, mapExtrinsicArgs, mapZkEventData, normalizeEvmAddress, noteBlindTag, randomBlinding, recoverOwnerPkPoint, selectNotes, selfEphWindow, shortHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, vaultReplacer, vaultReviver };
|
package/dist/index.d.ts
CHANGED
|
@@ -2357,36 +2357,152 @@ declare const BABYJUB_SUBORDER = 27360303589799094027808007181571593860768139721
|
|
|
2357
2357
|
*/
|
|
2358
2358
|
declare function randomBlinding(): bigint;
|
|
2359
2359
|
|
|
2360
|
+
/**
|
|
2361
|
+
* SpendingKeyRequest
|
|
2362
|
+
*
|
|
2363
|
+
* What the user signs to derive their Orbinum spending key, per platform.
|
|
2364
|
+
*
|
|
2365
|
+
* These builders produce the *request* (typed data or message string). Turning a
|
|
2366
|
+
* signature into key material lives in `PrivacyKeys` — the split keeps the
|
|
2367
|
+
* platform-specific presentation away from the platform-agnostic KDF.
|
|
2368
|
+
*
|
|
2369
|
+
* SECURITY MODEL
|
|
2370
|
+
*
|
|
2371
|
+
* The signature seeds the spending key, so a deterministic signature over a
|
|
2372
|
+
* fixed, public string is a bearer token: any dapp the user connects to can
|
|
2373
|
+
* request the same string, obtain a byte-identical signature (ECDSA personal_sign
|
|
2374
|
+
* is deterministic, RFC-6979) and reconstruct the spending key, viewing key and
|
|
2375
|
+
* vault key. That is the v1 flaw these builders exist to close.
|
|
2376
|
+
*
|
|
2377
|
+
* The defense has two independent layers:
|
|
2378
|
+
*
|
|
2379
|
+
* 1. Message layer (here) — bind the signature to a domain the user can see.
|
|
2380
|
+
* EVM uses EIP-712, whose domain the wallet renders. Substrate has no
|
|
2381
|
+
* EIP-712, so the warning travels inside the signed text instead. NOTE this
|
|
2382
|
+
* layer is about VISIBILITY, not impossibility: nothing stops a hostile
|
|
2383
|
+
* origin from requesting the same payload, and no wallet verifies that
|
|
2384
|
+
* `verifyingContract` matches the requesting origin.
|
|
2385
|
+
* 2. Derivation layer (`PrivacyKeys`) — the HKDF `info` carries the version, so
|
|
2386
|
+
* v1 and v2 are disjoint identities even given identical signature bytes.
|
|
2387
|
+
* This is the layer that holds when layer 1 fails (e.g. a wallet that
|
|
2388
|
+
* truncates the warning text).
|
|
2389
|
+
*
|
|
2390
|
+
* DETERMINISM IS MANDATORY. No builder may add a nonce, timestamp or challenge:
|
|
2391
|
+
* the digest must stay a pure function of (chainId, address). A signature that
|
|
2392
|
+
* varies per session yields a different spending key each time, which makes
|
|
2393
|
+
* already-shielded notes unspendable — surfacing as an opaque Merkle constraint
|
|
2394
|
+
* failure during witness generation.
|
|
2395
|
+
*/
|
|
2396
|
+
/**
|
|
2397
|
+
* EIP-712 `verifyingContract` for spending-key derivation: the shielded pool
|
|
2398
|
+
* precompile, i.e. the component that actually custodies shielded funds and so
|
|
2399
|
+
* the semantically correct domain anchor.
|
|
2400
|
+
*
|
|
2401
|
+
* WARNING: this value is part of the EIP-712 digest. Changing it changes every
|
|
2402
|
+
* derived spending key and orphans every existing note. It is a protocol
|
|
2403
|
+
* constant, not a config knob — which is why it is re-exported from the single
|
|
2404
|
+
* `PRECOMPILE_ADDR` source rather than written out a second time.
|
|
2405
|
+
*/
|
|
2406
|
+
declare const SPENDING_KEY_VERIFYING_CONTRACT: "0x0000000000000000000000000000000000000801";
|
|
2407
|
+
/**
|
|
2408
|
+
* Shown to the user inside the wallet prompt. Wallets render EIP-712 message
|
|
2409
|
+
* fields (and Substrate raw text) verbatim, so this is the one surface a hostile
|
|
2410
|
+
* origin can neither suppress nor reword.
|
|
2411
|
+
*/
|
|
2412
|
+
declare const SPENDING_KEY_WARNING: string;
|
|
2413
|
+
/** EIP-712 payload for `eth_signTypedData_v4`. */
|
|
2414
|
+
interface SpendingKeyTypedData {
|
|
2415
|
+
domain: {
|
|
2416
|
+
name: string;
|
|
2417
|
+
version: string;
|
|
2418
|
+
chainId: number;
|
|
2419
|
+
verifyingContract: string;
|
|
2420
|
+
};
|
|
2421
|
+
types: {
|
|
2422
|
+
SpendingKeyDerivation: ReadonlyArray<{
|
|
2423
|
+
name: string;
|
|
2424
|
+
type: string;
|
|
2425
|
+
}>;
|
|
2426
|
+
};
|
|
2427
|
+
primaryType: 'SpendingKeyDerivation';
|
|
2428
|
+
message: {
|
|
2429
|
+
warning: string;
|
|
2430
|
+
account: string;
|
|
2431
|
+
};
|
|
2432
|
+
}
|
|
2433
|
+
/**
|
|
2434
|
+
* EIP-712 typed data the user signs to derive their spending key (EVM route).
|
|
2435
|
+
* Pass the result to `eth_signTypedData_v4`.
|
|
2436
|
+
*
|
|
2437
|
+
* @param chainId Chain the identity belongs to; part of the domain separator.
|
|
2438
|
+
* @param address Signer address. Lowercased so checksum casing cannot fork the
|
|
2439
|
+
* identity into two distinct keys for the same account.
|
|
2440
|
+
*/
|
|
2441
|
+
declare function deriveSpendingKeyTypedData(chainId: number, address: string): SpendingKeyTypedData;
|
|
2442
|
+
/**
|
|
2443
|
+
* Message the user signs on signers without EIP-712 (Substrate: sr25519 via VRF,
|
|
2444
|
+
* ed25519 via signRaw).
|
|
2445
|
+
*
|
|
2446
|
+
* Substrate wallets render the raw string, so the warning leads the text — it is
|
|
2447
|
+
* the only channel a malicious extension cannot rewrite. Its protection is
|
|
2448
|
+
* therefore conditional on the wallet not truncating the message; when it does,
|
|
2449
|
+
* only the HKDF domain separation in `PrivacyKeys` still applies.
|
|
2450
|
+
*/
|
|
2451
|
+
declare function deriveSpendingKeyMessageV2(chainId: number, address: string): string;
|
|
2452
|
+
/**
|
|
2453
|
+
* @deprecated INSECURE — v1 derivation. Signs a fixed public string via
|
|
2454
|
+
* `personal_sign`, so any dapp can request it and, because the signature is
|
|
2455
|
+
* deterministic, reconstruct the user's spending key, viewing key and vault key.
|
|
2456
|
+
*
|
|
2457
|
+
* Retained ONLY so existing v1 notes can be swept into a v2 identity. Never call
|
|
2458
|
+
* it on a connect/login path. Use {@link deriveSpendingKeyTypedData} (EVM) or
|
|
2459
|
+
* {@link deriveSpendingKeyMessageV2} (Substrate) instead.
|
|
2460
|
+
*/
|
|
2461
|
+
declare function deriveSpendingKeyMessage(chainId: number, address: string): string;
|
|
2462
|
+
|
|
2360
2463
|
/**
|
|
2361
2464
|
* PrivacyKeys
|
|
2362
2465
|
*
|
|
2363
|
-
* Pure cryptographic derivation
|
|
2364
|
-
*
|
|
2466
|
+
* Pure cryptographic derivation for the Orbinum shielded pool identity: turns a
|
|
2467
|
+
* wallet signature into key material, and key material into the public values
|
|
2468
|
+
* that make up a privacy address. Protocol-level only — no storage, UI or
|
|
2469
|
+
* session concerns. What the user *signs* to produce that signature lives in
|
|
2470
|
+
* `SpendingKeyRequest`.
|
|
2471
|
+
*
|
|
2472
|
+
* Full derivation chain:
|
|
2365
2473
|
*
|
|
2366
|
-
*
|
|
2367
|
-
*
|
|
2368
|
-
*
|
|
2369
|
-
*
|
|
2370
|
-
*
|
|
2474
|
+
* signature ──HKDF(info="orbinum-sk-{version}:{chainId}:{address}")──► masterBytes (32B)
|
|
2475
|
+
* │
|
|
2476
|
+
* ┌─────────────────────────────────────────────────────────────────┤
|
|
2477
|
+
* ▼ ▼
|
|
2478
|
+
* spendingKey = BigInt(masterBytes) % BABYJUB_SUBORDER vaultKey (see vault/)
|
|
2479
|
+
* │ = HKDF(masterBytes, "orbinum-vault-key-v1")
|
|
2480
|
+
* ├──► ownerPk = BJJ_mul(Base8, spendingKey).Ax (public)
|
|
2481
|
+
* │
|
|
2482
|
+
* └──► ivsk = HKDF(LE32(spendingKey), info="orbinum-ivk-v1") (secret)
|
|
2483
|
+
* └──► ivk = packPoint(BJJ_mul(Base8, ivsk_scalar)) (public)
|
|
2371
2484
|
*
|
|
2372
|
-
*
|
|
2373
|
-
*
|
|
2374
|
-
*
|
|
2375
|
-
*
|
|
2485
|
+
* VERSIONING: the HKDF `info` carries the identity version, so v1 and v2 are
|
|
2486
|
+
* cryptographically disjoint even given identical signature bytes. This is the
|
|
2487
|
+
* layer that still separates the identities when the message-level defense fails
|
|
2488
|
+
* — see the security model in `SpendingKeyRequest`.
|
|
2376
2489
|
*
|
|
2377
|
-
*
|
|
2378
|
-
* Num2Bits(253)
|
|
2379
|
-
*
|
|
2490
|
+
* MODULUS: reduce mod BABYJUB_SUBORDER, never BN254_R. circomlib's BabyPbk uses
|
|
2491
|
+
* Num2Bits(253), asserting spending_key < 2^253. BABYJUB_SUBORDER < 2^252
|
|
2492
|
+
* satisfies it; BN254_R ≈ 2^254.8 does not — ~34% of values would fail at runtime.
|
|
2380
2493
|
*/
|
|
2494
|
+
/** Identity version. `v1` is the legacy personal_sign scheme, kept for sweeping only. */
|
|
2495
|
+
type KeyVersion = 'v1' | 'v2';
|
|
2381
2496
|
/**
|
|
2382
|
-
*
|
|
2383
|
-
*
|
|
2497
|
+
* Shortest signature any supported signer produces: sr25519 VRF output is 32
|
|
2498
|
+
* bytes, ed25519 is 64, ECDSA `personal_sign` is 65. Anything shorter is not a
|
|
2499
|
+
* signature, so it must never reach the KDF.
|
|
2384
2500
|
*/
|
|
2385
|
-
declare
|
|
2501
|
+
declare const MIN_SIGNATURE_BYTES = 32;
|
|
2386
2502
|
/**
|
|
2387
2503
|
* Derives the 32-byte master key bytes from a wallet signature.
|
|
2388
2504
|
*
|
|
2389
|
-
* masterBytes = HKDF-SHA256(ikm=sigBytes, salt=empty, info="orbinum-sk-
|
|
2505
|
+
* masterBytes = HKDF-SHA256(ikm=sigBytes, salt=empty, info="orbinum-sk-{version}:{chainId}:{address}")
|
|
2390
2506
|
*
|
|
2391
2507
|
* These bytes are the stable root for ALL derived keys:
|
|
2392
2508
|
* - spendingKey (circuit scalar) = BigInt(masterBytes) % BABYJUB_SUBORDER
|
|
@@ -2396,12 +2512,19 @@ declare function deriveSpendingKeyMessage(chainId: number, address: string): str
|
|
|
2396
2512
|
* Separating masterBytes from the circuit scalar means the viewingSecretKey and
|
|
2397
2513
|
* vault key are STABLE across any future change to the modulus — they never
|
|
2398
2514
|
* depend on which prime field the circuit uses.
|
|
2515
|
+
*
|
|
2516
|
+
* The version is folded into the HKDF `info`, so v1 and v2 stay disjoint even if
|
|
2517
|
+
* the underlying signature bytes were somehow identical.
|
|
2518
|
+
*
|
|
2519
|
+
* @param version Defaults to 'v2'. Pass 'v1' only from the legacy sweep flow.
|
|
2520
|
+
* @throws If the signature is not valid hex, or carries less entropy than the
|
|
2521
|
+
* shortest real signing scheme (see {@link MIN_SIGNATURE_BYTES}).
|
|
2399
2522
|
*/
|
|
2400
|
-
declare function deriveMasterKeyBytes(signatureHex: string, chainId: number, address: string): Promise<Uint8Array>;
|
|
2523
|
+
declare function deriveMasterKeyBytes(signatureHex: string, chainId: number, address: string, version?: KeyVersion): Promise<Uint8Array>;
|
|
2401
2524
|
/**
|
|
2402
2525
|
* Derives an Orbinum spending key from a wallet signature.
|
|
2403
2526
|
*
|
|
2404
|
-
* Uses HKDF-SHA256(ikm=sigBytes, salt=empty, info="orbinum-sk-
|
|
2527
|
+
* Uses HKDF-SHA256(ikm=sigBytes, salt=empty, info="orbinum-sk-{version}:{chainId}:{address}")
|
|
2405
2528
|
* and reduces the resulting 32-byte value modulo BABYJUB_SUBORDER.
|
|
2406
2529
|
*
|
|
2407
2530
|
* IMPORTANT: viewingSecretKey and vaultKey must be derived from masterBytes (via
|
|
@@ -2411,9 +2534,12 @@ declare function deriveMasterKeyBytes(signatureHex: string, chainId: number, add
|
|
|
2411
2534
|
* @param signatureHex 0x-prefixed or bare hex of the wallet signature.
|
|
2412
2535
|
* @param chainId Chain ID used when building the signing message.
|
|
2413
2536
|
* @param address Signer address (EVM or SS58) used in the signing message.
|
|
2537
|
+
* @param version Defaults to 'v2'. Pass 'v1' only from the legacy sweep flow.
|
|
2414
2538
|
* @returns bigint in [1, BABYJUB_SUBORDER)
|
|
2539
|
+
* @throws If the signature is not valid hex or is shorter than
|
|
2540
|
+
* {@link MIN_SIGNATURE_BYTES} — see `deriveMasterKeyBytes`.
|
|
2415
2541
|
*/
|
|
2416
|
-
declare function deriveSpendingKeyFromSignature(signatureHex: string, chainId: number, address: string): Promise<bigint>;
|
|
2542
|
+
declare function deriveSpendingKeyFromSignature(signatureHex: string, chainId: number, address: string, version?: KeyVersion): Promise<bigint>;
|
|
2417
2543
|
/**
|
|
2418
2544
|
* Derive a 32-byte viewing secret key (ivsk) from the spending key.
|
|
2419
2545
|
* ivsk = HKDF-SHA256(ikm=bigintTo32Le(spendingKey), info="orbinum-ivk-v1")
|
|
@@ -4308,4 +4434,4 @@ interface ExtrinsicFailedData {
|
|
|
4308
4434
|
dispatch_info: DispatchInfo;
|
|
4309
4435
|
}
|
|
4310
4436
|
|
|
4311
|
-
export { type AccountListing, type AccountMappedData, type AccountMappedEvent, type AccountMappingCall, type AccountMappingEvent, AccountMappingModule, AccountMappingPrecompile, type AccountMetadata, type AccountUnmappedEvent, type ActiveVersionSetEvent, type AddChainLinkArgs, type AddChainLinkParams, type AddSupportedChainArgs, type AliasFullIdentity, type AliasInfo, type AliasListedForSaleEvent, type AliasOnSaleData, type AliasRegisteredData, type AliasRegisteredEvent, type AliasReleasedEvent, type AliasSaleCancelledEvent, type AliasSoldData, type AliasSoldEvent, type AliasTransferredData, type AliasTransferredEvent, type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BatchRegisterVerificationKeysArgs, type BatchVerificationKeysRegisteredEvent, type BlockInfo, type BuyAliasArgs, type Bytes32, CURRENT_CIRCUIT_VERSION, type ChainInfo, type ChainLink, type ChainLinkAddedEvent, type ChainLinkRemovedEvent, CircuitId, CircuitId as CircuitIdType, CircuitVersionResolver, type ClaimShieldedFeesParams, type ClientProviderConfig, type CommitmentsInsertedEvent, type CommitmentsInsertedEventData, type ConnectionStatus, CryptoPrecompiles, type DecodedAddChainLinkArgs, type DecodedBatchArgs, type DecodedDispatchAsPrivateLinkArgs, type DecodedEthereumTransactArgs, type DecodedEvmCallArgs, type DecodedPrecompile, type DecodedPrivateTransferArgs, type DecodedPutAliasForSaleArgs, type DecodedRegisterAliasArgs, type DecodedRemarkArgs, type DecodedRevealPrivateLinkArgs, type DecodedSetAccountMetadataArgs, type DecodedShieldArgs, type DecodedShieldBatchArgs, type DecodedShieldBatchOperation, type DecodedSudoArgs, type DecodedTransferAllArgs, type DecodedTransferArgs, type DecodedTransferKeepAliveArgs, type DecodedUnshieldArgs, type DecryptedMemo, type DispatchAsLinkedAccountArgs, type DispatchAsLinkedParams, type DispatchAsPrivateLinkArgs, type DispatchError, type DispatchInfo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, type EncryptedNoteRecord, type EndowedEventData, type EthereumExecutedData, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, type EvmExecutedData, type EvmExitReason, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFailedData, type ExtrinsicSuccessData, type FeeClaimProofInputs, type FormatOptions, KNOWN_PRECOMPILES, type KnownPrecompileInfo, type ListingInfo, type MerkleRootUpdatedData, type MerkleRootUpdatedEvent, type MerkleTreeInfo, type MetadataUpdatedEvent, NoteBuilder, type NoteDisclosure, type NoteInput, type NoteStatusUpdate, type NullifiersSpentEvent, type NullifiersSpentEventData, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, PRECOMPILE_ADDR, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateChainLinkAddedEvent, type PrivateChainLinkRemovedEvent, type PrivateChainLinkRevealedEvent, type PrivateLink, type PrivateLinkDispatchExecutedEvent, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type ProofVerificationFailedEvent, type ProofVerifiedEvent, type ProxyCallExecutedEvent, type PutAliasOnSaleArgs, type PutOnSaleParams, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type RegisterAliasArgs, type RegisterAssetArgs, type RegisterPrivateLinkArgs, type RegisterVerificationKeyArgs, type RelayerInfo, RelayerStatusModule, type RemoveChainLinkArgs, type RemovePrivateLinkArgs, type RemoveSupportedChainArgs, type RemoveVerificationKeyArgs, type ReservedEventData, type ResolvedAlias, type ResolvedSpendVersion, type RevealPrivateLinkArgs, type RpcV2MerkleProof, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, SLIP0044_NAMESPACE, type ScanCommitment, type SelfEphWindowEntry, type SetAccountMetadataArgs, type SetActiveVersionArgs, type SetMetadataParams, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedEvent, type ShieldedEventData, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, SignatureScheme, type StatusChangeEvent, type StatusListener, SubstrateClient, type SupportedChain, type SupportedChainAddedEvent, type SupportedChainRemovedEvent, type SystemHealth, type TokenInfo, type TokenTransfer, type TransferAliasArgs, type TransferEventData, type TransferInputNote, type TransferOutputNote, type TryDecryptOptions, type TxResult, type UnsafeTxOptions, type UnshieldArgs, type UnshieldParams, type UnshieldProofInputs, type UnshieldedEvent, type UnshieldedEventData, type UnverifyAssetArgs, VaultLockedError, type VerificationKeyRegisteredEvent, type VerificationKeyRemovedEvent, type VerifyAssetArgs, type VerifyProofArgs, type VkEntry, type ZkNote, type ZkVerifierCall, type ZkVerifierCircuitVersionInfo, type ZkVerifierEvent, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, applyNoteStatus, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildDummyTransferInput, bytesToBigintLE, computeNoteCommitment, computeNullifier, computePathIndices, createNoteDisclosureKey, decodeNoteDisclosureKey, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOwnerPk, deriveSelfEphSk, deriveSpendingKeyFromSignature, deriveSpendingKeyMessage, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewTag, deriveViewingPublicKey, deriveViewingSecretKey, encryptJson, encryptNote, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, formatBalance, formatORB, fromBase64, fromHex, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getPrecompileLabel, hexToBigint, hexToNumber, implicitSubstrateToEvm, isEvmAddress, isImplicitEvmAccount, isSs58, isSubstrateAddress, isUnifiedAddress, leHexToBigint, mapExtrinsicArgs, mapZkEventData, normalizeEvmAddress, noteBlindTag, randomBlinding, recoverOwnerPkPoint, selectNotes, selfEphWindow, shortHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, vaultReplacer, vaultReviver };
|
|
4437
|
+
export { type AccountListing, type AccountMappedData, type AccountMappedEvent, type AccountMappingCall, type AccountMappingEvent, AccountMappingModule, AccountMappingPrecompile, type AccountMetadata, type AccountUnmappedEvent, type ActiveVersionSetEvent, type AddChainLinkArgs, type AddChainLinkParams, type AddSupportedChainArgs, type AliasFullIdentity, type AliasInfo, type AliasListedForSaleEvent, type AliasOnSaleData, type AliasRegisteredData, type AliasRegisteredEvent, type AliasReleasedEvent, type AliasSaleCancelledEvent, type AliasSoldData, type AliasSoldEvent, type AliasTransferredData, type AliasTransferredEvent, type AssetRegisteredEvent, type AssetUnverifiedEvent, type AssetVerifiedEvent, BABYJUB_SUBORDER, BN254_R, type BatchRegisterVerificationKeysArgs, type BatchVerificationKeysRegisteredEvent, type BlockInfo, type BuyAliasArgs, type Bytes32, CURRENT_CIRCUIT_VERSION, type ChainInfo, type ChainLink, type ChainLinkAddedEvent, type ChainLinkRemovedEvent, CircuitId, CircuitId as CircuitIdType, CircuitVersionResolver, type ClaimShieldedFeesParams, type ClientProviderConfig, type CommitmentsInsertedEvent, type CommitmentsInsertedEventData, type ConnectionStatus, CryptoPrecompiles, type DecodedAddChainLinkArgs, type DecodedBatchArgs, type DecodedDispatchAsPrivateLinkArgs, type DecodedEthereumTransactArgs, type DecodedEvmCallArgs, type DecodedPrecompile, type DecodedPrivateTransferArgs, type DecodedPutAliasForSaleArgs, type DecodedRegisterAliasArgs, type DecodedRemarkArgs, type DecodedRevealPrivateLinkArgs, type DecodedSetAccountMetadataArgs, type DecodedShieldArgs, type DecodedShieldBatchArgs, type DecodedShieldBatchOperation, type DecodedSudoArgs, type DecodedTransferAllArgs, type DecodedTransferArgs, type DecodedTransferKeepAliveArgs, type DecodedUnshieldArgs, type DecryptedMemo, type DispatchAsLinkedAccountArgs, type DispatchAsLinkedParams, type DispatchAsPrivateLinkArgs, type DispatchError, type DispatchInfo, type DynamicBuilder, ENCRYPTED_MEMO_SIZE, EncryptedMemo, type EncryptedNoteRecord, type EndowedEventData, type EthereumExecutedData, type EventData, type EventPhase, type EventRecord, type EvmAddressInfo, type EvmBlock, EvmClient, type EvmExecutedData, type EvmExitReason, EvmExplorer, type EvmLog, type EvmSigner, type EvmTransaction, type EvmTxRequest, type EvmTxSummary, type ExtrinsicDecoder, type ExtrinsicFailedData, type ExtrinsicSuccessData, type FeeClaimProofInputs, type FormatOptions, KNOWN_PRECOMPILES, type KeyVersion, type KnownPrecompileInfo, type ListingInfo, MIN_SIGNATURE_BYTES, type MerkleRootUpdatedData, type MerkleRootUpdatedEvent, type MerkleTreeInfo, type MetadataUpdatedEvent, NoteBuilder, type NoteDisclosure, type NoteInput, type NoteStatusUpdate, type NullifiersSpentEvent, type NullifiersSpentEventData, OrbinumClient, type OrbinumClientConfig, OrbinumClientProvider, PRECOMPILE_ADDR, PrivacyKeyManager, type PrivacyMerkleProof, PrivacyModule, type PrivateChainLinkAddedEvent, type PrivateChainLinkRemovedEvent, type PrivateChainLinkRevealedEvent, type PrivateLink, type PrivateLinkDispatchExecutedEvent, type PrivateTransferArgs, type PrivateTransferInput, type PrivateTransferOutput, type PrivateTransferParams, type PrivateTransferProofInputs, type ProofVerificationFailedEvent, type ProofVerifiedEvent, type ProxyCallExecutedEvent, type PutAliasOnSaleArgs, type PutOnSaleParams, type RawBlock, type RawBlockHeader, type RawTransferInput, type RawTransferOutput, type RegisterAliasArgs, type RegisterAssetArgs, type RegisterPrivateLinkArgs, type RegisterVerificationKeyArgs, type RelayerInfo, RelayerStatusModule, type RemoveChainLinkArgs, type RemovePrivateLinkArgs, type RemoveSupportedChainArgs, type RemoveVerificationKeyArgs, type ReservedEventData, type ResolvedAlias, type ResolvedSpendVersion, type RevealPrivateLinkArgs, type RpcV2MerkleProof, type RpcV2NullifierStatus, type RpcV2PoolAssetBalance, type RpcV2PoolStats, SLIP0044_NAMESPACE, SPENDING_KEY_VERIFYING_CONTRACT, SPENDING_KEY_WARNING, type ScanCommitment, type SelfEphWindowEntry, type SetAccountMetadataArgs, type SetActiveVersionArgs, type SetMetadataParams, type ShieldArgs, type ShieldBatchArgs, type ShieldBatchItem, type ShieldBatchParams, type ShieldOperation, type ShieldParams, type ShieldedEvent, type ShieldedEventData, type ShieldedPoolCall, type ShieldedPoolEvent, ShieldedPoolModule, ShieldedPoolPrecompile, SignatureScheme, type SpendingKeyTypedData, type StatusChangeEvent, type StatusListener, SubstrateClient, type SupportedChain, type SupportedChainAddedEvent, type SupportedChainRemovedEvent, type SystemHealth, type TokenInfo, type TokenTransfer, type TransferAliasArgs, type TransferEventData, type TransferInputNote, type TransferOutputNote, type TryDecryptOptions, type TxResult, type UnsafeTxOptions, type UnshieldArgs, type UnshieldParams, type UnshieldProofInputs, type UnshieldedEvent, type UnshieldedEventData, type UnverifyAssetArgs, VaultLockedError, type VerificationKeyRegisteredEvent, type VerificationKeyRemovedEvent, type VerifyAssetArgs, type VerifyProofArgs, type VkEntry, type ZkNote, type ZkVerifierCall, type ZkVerifierCircuitVersionInfo, type ZkVerifierEvent, type ZkVerifierHistoricalVersion, ZkVerifierModule, type ZkVerifierVersionStats, type ZkVerifierVkHash, accountIdHexToSs58, addressToAccountIdHex, applyNoteStatus, bigintTo32Be, bigintTo32Le, bigintTo32LeArr, blindTag, buildDummyTransferInput, bytesToBigintLE, computeNoteCommitment, computeNullifier, computePathIndices, createNoteDisclosureKey, decodeNoteDisclosureKey, decodePrecompileCalldata, decryptJson, decryptNoteRecord, deriveMasterKeyBytes, deriveOwnerPk, deriveSelfEphSk, deriveSpendingKeyFromSignature, deriveSpendingKeyMessage, deriveSpendingKeyMessageV2, deriveSpendingKeyTypedData, deriveStealthOwnerPk, deriveStealthSk, deriveVaultBlindKey, deriveVaultKey, deriveViewTag, deriveViewingPublicKey, deriveViewingSecretKey, encryptJson, encryptNote, ensureHexPrefix, evmAddressToAccountId, evmToImplicitSubstrate, evmToMappedAccountHex, evmToSubstrate, formatBalance, formatORB, fromBase64, fromHex, generateFeeClaimProof, generateTransferProof, generateUnshieldProof, getPrecompileLabel, hexToBigint, hexToNumber, implicitSubstrateToEvm, isEvmAddress, isImplicitEvmAccount, isSs58, isSubstrateAddress, isUnifiedAddress, leHexToBigint, mapExtrinsicArgs, mapZkEventData, normalizeEvmAddress, noteBlindTag, randomBlinding, recoverOwnerPkPoint, selectNotes, selfEphWindow, shortHash, substrateSs58ToAccountIdHex, substrateToEvm, toBase64, toHex, toTxResult, truncateMiddle, tryDecryptNote, tryDecryptNoteVerbose, vaultReplacer, vaultReviver };
|
package/dist/index.js
CHANGED
|
@@ -37,6 +37,7 @@ __export(index_exports, {
|
|
|
37
37
|
EvmExplorer: () => EvmExplorer,
|
|
38
38
|
KNOWN_PRECOMPILES: () => KNOWN_PRECOMPILES,
|
|
39
39
|
Keccak256: () => import_substrate_bindings3.Keccak256,
|
|
40
|
+
MIN_SIGNATURE_BYTES: () => MIN_SIGNATURE_BYTES,
|
|
40
41
|
NoteBuilder: () => NoteBuilder,
|
|
41
42
|
OrbinumClient: () => OrbinumClient,
|
|
42
43
|
OrbinumClientProvider: () => OrbinumClientProvider,
|
|
@@ -45,6 +46,8 @@ __export(index_exports, {
|
|
|
45
46
|
PrivacyModule: () => PrivacyModule,
|
|
46
47
|
RelayerStatusModule: () => RelayerStatusModule,
|
|
47
48
|
SLIP0044_NAMESPACE: () => SLIP0044_NAMESPACE,
|
|
49
|
+
SPENDING_KEY_VERIFYING_CONTRACT: () => SPENDING_KEY_VERIFYING_CONTRACT,
|
|
50
|
+
SPENDING_KEY_WARNING: () => SPENDING_KEY_WARNING,
|
|
48
51
|
ShieldedPoolModule: () => ShieldedPoolModule,
|
|
49
52
|
ShieldedPoolPrecompile: () => ShieldedPoolPrecompile,
|
|
50
53
|
SignatureScheme: () => SignatureScheme,
|
|
@@ -77,6 +80,8 @@ __export(index_exports, {
|
|
|
77
80
|
deriveSelfEphSk: () => deriveSelfEphSk,
|
|
78
81
|
deriveSpendingKeyFromSignature: () => deriveSpendingKeyFromSignature,
|
|
79
82
|
deriveSpendingKeyMessage: () => deriveSpendingKeyMessage,
|
|
83
|
+
deriveSpendingKeyMessageV2: () => deriveSpendingKeyMessageV2,
|
|
84
|
+
deriveSpendingKeyTypedData: () => deriveSpendingKeyTypedData,
|
|
80
85
|
deriveStealthOwnerPk: () => deriveStealthOwnerPk,
|
|
81
86
|
deriveStealthSk: () => deriveStealthSk,
|
|
82
87
|
deriveVaultBlindKey: () => deriveVaultBlindKey,
|
|
@@ -4201,23 +4206,66 @@ function randomBlinding() {
|
|
|
4201
4206
|
return n === 0n ? 1n : n % BN254_R;
|
|
4202
4207
|
}
|
|
4203
4208
|
|
|
4209
|
+
// src/privacy-keys/SpendingKeyRequest.ts
|
|
4210
|
+
var SPENDING_KEY_VERIFYING_CONTRACT = PRECOMPILE_ADDR.SHIELDED_POOL;
|
|
4211
|
+
var SPENDING_KEY_WARNING = "Signing this grants full control of your Orbinum private funds. Only sign on the official Orbinum app.";
|
|
4212
|
+
function deriveSpendingKeyTypedData(chainId, address) {
|
|
4213
|
+
return {
|
|
4214
|
+
domain: {
|
|
4215
|
+
name: "Orbinum Shielded Pool",
|
|
4216
|
+
version: "2",
|
|
4217
|
+
chainId,
|
|
4218
|
+
verifyingContract: SPENDING_KEY_VERIFYING_CONTRACT
|
|
4219
|
+
},
|
|
4220
|
+
types: {
|
|
4221
|
+
SpendingKeyDerivation: [
|
|
4222
|
+
{ name: "warning", type: "string" },
|
|
4223
|
+
{ name: "account", type: "address" }
|
|
4224
|
+
]
|
|
4225
|
+
},
|
|
4226
|
+
primaryType: "SpendingKeyDerivation",
|
|
4227
|
+
message: {
|
|
4228
|
+
warning: SPENDING_KEY_WARNING,
|
|
4229
|
+
account: address.toLowerCase()
|
|
4230
|
+
}
|
|
4231
|
+
};
|
|
4232
|
+
}
|
|
4233
|
+
function deriveSpendingKeyMessageV2(chainId, address) {
|
|
4234
|
+
return `\u26A0 ${SPENDING_KEY_WARNING}
|
|
4235
|
+
|
|
4236
|
+
orbinum-spending-key-v2
|
|
4237
|
+
${chainId}
|
|
4238
|
+
${address.toLowerCase()}`;
|
|
4239
|
+
}
|
|
4240
|
+
function deriveSpendingKeyMessage(chainId, address) {
|
|
4241
|
+
return `orbinum-spending-key-v1
|
|
4242
|
+
${chainId}
|
|
4243
|
+
${address.toLowerCase()}`;
|
|
4244
|
+
}
|
|
4245
|
+
|
|
4204
4246
|
// src/privacy-keys/PrivacyKeys.ts
|
|
4205
4247
|
var import_hkdf2 = require("@noble/hashes/hkdf.js");
|
|
4206
4248
|
var import_sha24 = require("@noble/hashes/sha2.js");
|
|
4207
4249
|
var import_baby_jubjub6 = require("@zk-kit/baby-jubjub");
|
|
4208
4250
|
var IVK_DOMAIN = new TextEncoder().encode("orbinum-ivk-v1");
|
|
4209
|
-
|
|
4210
|
-
|
|
4211
|
-
|
|
4212
|
-
|
|
4251
|
+
var MIN_SIGNATURE_BYTES = 32;
|
|
4252
|
+
function assertUsableSignature(sigBytes) {
|
|
4253
|
+
if (sigBytes.length < MIN_SIGNATURE_BYTES) {
|
|
4254
|
+
throw new Error(
|
|
4255
|
+
`Cannot derive a spending key: signature is ${sigBytes.length} bytes, expected at least ${MIN_SIGNATURE_BYTES}. The wallet did not return a signature.`
|
|
4256
|
+
);
|
|
4257
|
+
}
|
|
4213
4258
|
}
|
|
4214
|
-
async function deriveMasterKeyBytes(signatureHex, chainId, address) {
|
|
4259
|
+
async function deriveMasterKeyBytes(signatureHex, chainId, address, version = "v2") {
|
|
4215
4260
|
const sigBytes = fromHex(signatureHex);
|
|
4216
|
-
|
|
4261
|
+
assertUsableSignature(sigBytes);
|
|
4262
|
+
const info = new TextEncoder().encode(
|
|
4263
|
+
`orbinum-sk-${version}:${chainId}:${address.toLowerCase()}`
|
|
4264
|
+
);
|
|
4217
4265
|
return (0, import_hkdf2.hkdf)(import_sha24.sha256, sigBytes, new Uint8Array(0), info, 32);
|
|
4218
4266
|
}
|
|
4219
|
-
async function deriveSpendingKeyFromSignature(signatureHex, chainId, address) {
|
|
4220
|
-
const masterBytes = await deriveMasterKeyBytes(signatureHex, chainId, address);
|
|
4267
|
+
async function deriveSpendingKeyFromSignature(signatureHex, chainId, address, version = "v2") {
|
|
4268
|
+
const masterBytes = await deriveMasterKeyBytes(signatureHex, chainId, address, version);
|
|
4221
4269
|
const skBigint = BigInt(toHex(masterBytes)) % BABYJUB_SUBORDER;
|
|
4222
4270
|
return skBigint === 0n ? 1n : skBigint;
|
|
4223
4271
|
}
|
|
@@ -5434,6 +5482,7 @@ var import_polkadot_api4 = require("polkadot-api");
|
|
|
5434
5482
|
EvmExplorer,
|
|
5435
5483
|
KNOWN_PRECOMPILES,
|
|
5436
5484
|
Keccak256,
|
|
5485
|
+
MIN_SIGNATURE_BYTES,
|
|
5437
5486
|
NoteBuilder,
|
|
5438
5487
|
OrbinumClient,
|
|
5439
5488
|
OrbinumClientProvider,
|
|
@@ -5442,6 +5491,8 @@ var import_polkadot_api4 = require("polkadot-api");
|
|
|
5442
5491
|
PrivacyModule,
|
|
5443
5492
|
RelayerStatusModule,
|
|
5444
5493
|
SLIP0044_NAMESPACE,
|
|
5494
|
+
SPENDING_KEY_VERIFYING_CONTRACT,
|
|
5495
|
+
SPENDING_KEY_WARNING,
|
|
5445
5496
|
ShieldedPoolModule,
|
|
5446
5497
|
ShieldedPoolPrecompile,
|
|
5447
5498
|
SignatureScheme,
|
|
@@ -5474,6 +5525,8 @@ var import_polkadot_api4 = require("polkadot-api");
|
|
|
5474
5525
|
deriveSelfEphSk,
|
|
5475
5526
|
deriveSpendingKeyFromSignature,
|
|
5476
5527
|
deriveSpendingKeyMessage,
|
|
5528
|
+
deriveSpendingKeyMessageV2,
|
|
5529
|
+
deriveSpendingKeyTypedData,
|
|
5477
5530
|
deriveStealthOwnerPk,
|
|
5478
5531
|
deriveStealthSk,
|
|
5479
5532
|
deriveVaultBlindKey,
|
package/dist/index.mjs
CHANGED
|
@@ -4069,23 +4069,66 @@ function randomBlinding() {
|
|
|
4069
4069
|
return n === 0n ? 1n : n % BN254_R;
|
|
4070
4070
|
}
|
|
4071
4071
|
|
|
4072
|
+
// src/privacy-keys/SpendingKeyRequest.ts
|
|
4073
|
+
var SPENDING_KEY_VERIFYING_CONTRACT = PRECOMPILE_ADDR.SHIELDED_POOL;
|
|
4074
|
+
var SPENDING_KEY_WARNING = "Signing this grants full control of your Orbinum private funds. Only sign on the official Orbinum app.";
|
|
4075
|
+
function deriveSpendingKeyTypedData(chainId, address) {
|
|
4076
|
+
return {
|
|
4077
|
+
domain: {
|
|
4078
|
+
name: "Orbinum Shielded Pool",
|
|
4079
|
+
version: "2",
|
|
4080
|
+
chainId,
|
|
4081
|
+
verifyingContract: SPENDING_KEY_VERIFYING_CONTRACT
|
|
4082
|
+
},
|
|
4083
|
+
types: {
|
|
4084
|
+
SpendingKeyDerivation: [
|
|
4085
|
+
{ name: "warning", type: "string" },
|
|
4086
|
+
{ name: "account", type: "address" }
|
|
4087
|
+
]
|
|
4088
|
+
},
|
|
4089
|
+
primaryType: "SpendingKeyDerivation",
|
|
4090
|
+
message: {
|
|
4091
|
+
warning: SPENDING_KEY_WARNING,
|
|
4092
|
+
account: address.toLowerCase()
|
|
4093
|
+
}
|
|
4094
|
+
};
|
|
4095
|
+
}
|
|
4096
|
+
function deriveSpendingKeyMessageV2(chainId, address) {
|
|
4097
|
+
return `\u26A0 ${SPENDING_KEY_WARNING}
|
|
4098
|
+
|
|
4099
|
+
orbinum-spending-key-v2
|
|
4100
|
+
${chainId}
|
|
4101
|
+
${address.toLowerCase()}`;
|
|
4102
|
+
}
|
|
4103
|
+
function deriveSpendingKeyMessage(chainId, address) {
|
|
4104
|
+
return `orbinum-spending-key-v1
|
|
4105
|
+
${chainId}
|
|
4106
|
+
${address.toLowerCase()}`;
|
|
4107
|
+
}
|
|
4108
|
+
|
|
4072
4109
|
// src/privacy-keys/PrivacyKeys.ts
|
|
4073
4110
|
import { hkdf as hkdf2 } from "@noble/hashes/hkdf.js";
|
|
4074
4111
|
import { sha256 as sha2564 } from "@noble/hashes/sha2.js";
|
|
4075
4112
|
import { mulPointEscalar as mulPointEscalar4, Base8 as Base82, packPoint as packPoint3 } from "@zk-kit/baby-jubjub";
|
|
4076
4113
|
var IVK_DOMAIN = new TextEncoder().encode("orbinum-ivk-v1");
|
|
4077
|
-
|
|
4078
|
-
|
|
4079
|
-
|
|
4080
|
-
|
|
4114
|
+
var MIN_SIGNATURE_BYTES = 32;
|
|
4115
|
+
function assertUsableSignature(sigBytes) {
|
|
4116
|
+
if (sigBytes.length < MIN_SIGNATURE_BYTES) {
|
|
4117
|
+
throw new Error(
|
|
4118
|
+
`Cannot derive a spending key: signature is ${sigBytes.length} bytes, expected at least ${MIN_SIGNATURE_BYTES}. The wallet did not return a signature.`
|
|
4119
|
+
);
|
|
4120
|
+
}
|
|
4081
4121
|
}
|
|
4082
|
-
async function deriveMasterKeyBytes(signatureHex, chainId, address) {
|
|
4122
|
+
async function deriveMasterKeyBytes(signatureHex, chainId, address, version = "v2") {
|
|
4083
4123
|
const sigBytes = fromHex(signatureHex);
|
|
4084
|
-
|
|
4124
|
+
assertUsableSignature(sigBytes);
|
|
4125
|
+
const info = new TextEncoder().encode(
|
|
4126
|
+
`orbinum-sk-${version}:${chainId}:${address.toLowerCase()}`
|
|
4127
|
+
);
|
|
4085
4128
|
return hkdf2(sha2564, sigBytes, new Uint8Array(0), info, 32);
|
|
4086
4129
|
}
|
|
4087
|
-
async function deriveSpendingKeyFromSignature(signatureHex, chainId, address) {
|
|
4088
|
-
const masterBytes = await deriveMasterKeyBytes(signatureHex, chainId, address);
|
|
4130
|
+
async function deriveSpendingKeyFromSignature(signatureHex, chainId, address, version = "v2") {
|
|
4131
|
+
const masterBytes = await deriveMasterKeyBytes(signatureHex, chainId, address, version);
|
|
4089
4132
|
const skBigint = BigInt(toHex(masterBytes)) % BABYJUB_SUBORDER;
|
|
4090
4133
|
return skBigint === 0n ? 1n : skBigint;
|
|
4091
4134
|
}
|
|
@@ -5324,6 +5367,7 @@ export {
|
|
|
5324
5367
|
EvmExplorer,
|
|
5325
5368
|
KNOWN_PRECOMPILES,
|
|
5326
5369
|
Keccak256,
|
|
5370
|
+
MIN_SIGNATURE_BYTES,
|
|
5327
5371
|
NoteBuilder,
|
|
5328
5372
|
OrbinumClient,
|
|
5329
5373
|
OrbinumClientProvider,
|
|
@@ -5332,6 +5376,8 @@ export {
|
|
|
5332
5376
|
PrivacyModule,
|
|
5333
5377
|
RelayerStatusModule,
|
|
5334
5378
|
SLIP0044_NAMESPACE,
|
|
5379
|
+
SPENDING_KEY_VERIFYING_CONTRACT,
|
|
5380
|
+
SPENDING_KEY_WARNING,
|
|
5335
5381
|
ShieldedPoolModule,
|
|
5336
5382
|
ShieldedPoolPrecompile,
|
|
5337
5383
|
SignatureScheme,
|
|
@@ -5364,6 +5410,8 @@ export {
|
|
|
5364
5410
|
deriveSelfEphSk,
|
|
5365
5411
|
deriveSpendingKeyFromSignature,
|
|
5366
5412
|
deriveSpendingKeyMessage,
|
|
5413
|
+
deriveSpendingKeyMessageV2,
|
|
5414
|
+
deriveSpendingKeyTypedData,
|
|
5367
5415
|
deriveStealthOwnerPk,
|
|
5368
5416
|
deriveStealthSk,
|
|
5369
5417
|
deriveVaultBlindKey,
|