@qorechain/wallet-adapter 0.2.0 → 0.2.1

package/README.md

@@ -34,7 +34,7 @@ tx   = TxRaw{ body, authInfo, [sigC] }
 The extension type URL is `/qorechain.pqc.v1.PQCHybridSignature` and algorithm
 `1` = ML-DSA-87. The sign-bytes form `v` is chosen per network — see below.
 
-## Hybrid sign-bytes: v1 and v2 (chain v3.1.98)
+## Hybrid sign-bytes: v1 and v2 (chain v3.2.0, testnet v3.1.98)
 
 The ML-DSA key signs one of two byte forms (B0 = body without the PQC extension,
 A = AuthInfo bytes):
@@ -46,23 +46,40 @@ v2:          "qorechain-pqc-hybrid-v2" ‖ BE64(len chainId) ‖ chainId ‖ BE3
 
 v2 adds a domain tag (a signature the key made in any other context can never be
 valid transaction sign-bytes) and binds the chain-id. **A network accepts exactly
-one form at any height.** The networks that existed before chain v3.1.98
+one form at any height.** The networks that existed before v2
 (`qorechain-vladi` mainnet, `qorechain-diana` testnet) verify v1 until the
-`v3.1.98` upgrade plan is applied on them and v2 from then on; they upgrade at
-different heights. Today the testnet verifies v2 and **mainnet stays on v1 until
-its own upgrade**. Any other chain verifies v2 from its first block.
+upgrade plan that carries the switch is applied on them and v2 from then on; they
+upgrade at different heights. Today the testnet verifies v2 and **mainnet stays
+on v1 until its own upgrade**. Any other chain verifies v2 from its first block.
+
+**The switch ships under two plan names.** The release is `v3.2.0`, but the
+testnet already took the same handler under the earlier name `v3.1.98` and keeps
+that record forever, so the chain registers both (`SIGN_BYTES_V2_UPGRADES =
+['v3.2.0', 'v3.1.98']`). A client must ask for **every** name and sign v2 if the
+numeric height of **any** of them is > 0. Asking for one name only resolves v1 on
+a network that upgraded under the other, and every hybrid transaction is then
+refused with `pqc` code 21.
 
 `signBytesVersion` (on `QoreChainSigner`, per `signHybrid` call, and on
 `signHybridEth`) takes:
 
 - `'auto'` (default) — a non-legacy chain signs v2 with no network call. On
   `qorechain-vladi` / `qorechain-diana` the adapter asks the network
-  `GET {rest}/cosmos/upgrade/v1beta1/applied_plan/v3.1.98` and signs v2 iff the
-  returned height is > 0 (compared numerically: mainnet answers `{"height":"0"}`).
+  `GET {rest}/cosmos/upgrade/v1beta1/applied_plan/{name}` for every name in
+  `SIGN_BYTES_V2_UPGRADES` (`v3.2.0`, then `v3.1.98`) and signs v2 iff the
+  returned height of any of them is > 0 (compared numerically: a network that has
+  not taken a plan answers `{"height":"0"}` or `{}`). The names are asked in
+  order and the first positive height wins, so a network on the current release
+  costs one request and one that upgraded under the earlier name costs two.
   The answer is cached per (rest, chain-id) for 60 s. **Pass `rest` (the LCD URL)**;
-  without it, or if the query fails, signing throws instead of guessing.
+  without it, or if a query fails, signing throws instead of guessing.
 - `'v1'` / `'v2'` — used as given, no network call.
 
+**Upgrading to 0.2.1.** 0.2.0 asked for `v3.1.98` alone, which resolves v1 on a
+mainnet that upgraded as `v3.2.0` and gets every hybrid transaction refused with
+`pqc` code 21. Upgrade before the mainnet upgrade height; nothing else in the
+resolver changed and no call site needs touching.
+
 **Upgrading to 0.2.0.** `rest` is optional in the TypeScript types, so a caller that forgets it compiles cleanly and only fails at runtime on `qorechain-vladi` / `qorechain-diana`. Cover your wiring with a runtime test, not just a type check. In unit tests, pass `signBytesVersion: "v1"` or `"v2"` explicitly (or inject `fetch`): `"auto"` asks the network, so a test that omits it silently depends on a live node.
 
 Signed results are the usual `TxRaw` `Uint8Array`, with `.signBytesVersion`
@@ -156,7 +173,7 @@ Keplr / any-signDirect adapter + PQC framing:
 - `derivePqcKeyFromWallet(wallet, chainId, address)` — deterministic ML-DSA-87 key from a wallet signature.
 - `hybridSignBytesV1(b0, auth)`, `hybridSignBytesV2(chainId, b0, auth)`, `hybridSignBytes(version, chainId, b0, auth)` — the two sign-bytes forms and a dispatcher (version required; the old implicit `frame()` is removed).
 - `signBytesVersionFor(chainId, v2AppliedHeight)`, `resolveSignBytesVersion({ chainId, rest?, signBytesVersion?, fetch?, ttlMs?, forceRefresh? })`, `clearSignBytesCache()`, `isHybridSignBytesRejection(errOrResult)`.
-- Constants `HYBRID_SIGN_BYTES_V2_DOMAIN`, `SIGN_BYTES_V2_UPGRADE` (`"v3.1.98"`), `LEGACY_SIGN_BYTES_CHAINS`.
+- Constants `HYBRID_SIGN_BYTES_V2_DOMAIN`, `SIGN_BYTES_V2_UPGRADES` (`["v3.2.0", "v3.1.98"]` — every plan name that switches a network to v2), `SIGN_BYTES_V2_UPGRADE` (`"v3.2.0"`, the primary name = `SIGN_BYTES_V2_UPGRADES[0]`), `LEGACY_SIGN_BYTES_CHAINS`.
 - `encodePqcHybridSignature(algId, sig)` — proto encoder for the extension.
 - `qoreChainInfo({ chainId?, rpc, rest })` — Keplr chain descriptor; `qoreEvmChainParams(...)` / `addQoreEvmToWallet(provider, opts)` — MetaMask (EIP-3085) EVM descriptor.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qorechain/wallet-adapter",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Drop-in adapter to add QoreChain to any Cosmos wallet (Keplr, Leap, Cosmostation, …) and sign its PQC-required transactions. The wallet signs an ordinary SIGN_MODE_DIRECT SignDoc; the adapter layers a standard FIPS-204 ML-DSA-87 hybrid signature into the tx body, so no wallet code changes are needed.",
   "type": "module",
   "main": "src/index.js",

package/src/index.d.ts

@@ -56,11 +56,14 @@ export function authSignBytes(p: { programId: string; accounts: SvmAccountMeta[]
 export function buildPhantomSvmEnvelope(p: { wallet: any; programId?: string; accounts: SvmAccountMeta[]; data: Uint8Array; recentBlockhashHex: string }): Promise<any>;
 export function buildPhantomTransfer(p: { wallet: any; fromSvmAddr: string; toSvmAddr: string; lamports: number | bigint; recentBlockhashHex: string }): Promise<any>;
 export function registerAuthenticatorMsg(p: { owner: string; phantomPubkey: Uint8Array; permissions?: string[]; expiryUnix: number | bigint; label?: string }): { typeUrl: string; value: any };
-// --- Per-network hybrid PQC sign-bytes (v1 legacy / v2, chain v3.1.98) ---
+// --- Per-network hybrid PQC sign-bytes (v1 legacy / v2, chain v3.2.0 / testnet v3.1.98) ---
 export type SignBytesVersion = 'v1' | 'v2';
 export type SignBytesVersionOption = SignBytesVersion | 'auto';
 export const HYBRID_SIGN_BYTES_V2_DOMAIN: 'qorechain-pqc-hybrid-v2';
-export const SIGN_BYTES_V2_UPGRADE: 'v3.1.98';
+/** Every upgrade plan name that switches a network to v2, most recent first. */
+export const SIGN_BYTES_V2_UPGRADES: readonly ['v3.2.0', 'v3.1.98'];
+/** The primary (current release) plan name. */
+export const SIGN_BYTES_V2_UPGRADE: 'v3.2.0';
 export const LEGACY_SIGN_BYTES_CHAINS: readonly string[];
 /** v1: BE32(len b0) ‖ b0 ‖ BE32(len authInfo) ‖ authInfo. */
 export function hybridSignBytesV1(b0: Uint8Array, authInfo: Uint8Array): Uint8Array;
@@ -68,7 +71,7 @@ export function hybridSignBytesV1(b0: Uint8Array, authInfo: Uint8Array): Uint8Ar
 export function hybridSignBytesV2(chainId: string, b0: Uint8Array, authInfo: Uint8Array): Uint8Array;
 /** Version-dispatching builder; `version` is required. */
 export function hybridSignBytes(version: SignBytesVersion, chainId: string, b0: Uint8Array, authInfo: Uint8Array): Uint8Array;
-/** Mirror of the chain's SignBytesVersionFor; the height is compared numerically ("0" → not applied). */
+/** Mirror of the chain's SignBytesVersionFor; pass the greatest applied height over SIGN_BYTES_V2_UPGRADES. The height is compared numerically ("0" → not applied). */
 export function signBytesVersionFor(chainId: string, v2AppliedHeight: string | number | bigint | null | undefined): SignBytesVersion;
 export function resolveSignBytesVersion(opts: {
   chainId: string;

package/src/index.js

@@ -30,7 +30,7 @@ import { hybridSignBytes, resolveSignBytesVersion } from './signbytes.js';
 export { encodePqcHybridSignature, HYBRID_SIG_TYPE_URL, ALGORITHM_ML_DSA_87 };
 // Per-network hybrid sign-bytes (v1 legacy / v2) + resolver + rejection detector.
 export {
-  HYBRID_SIGN_BYTES_V2_DOMAIN, SIGN_BYTES_V2_UPGRADE, LEGACY_SIGN_BYTES_CHAINS,
+  HYBRID_SIGN_BYTES_V2_DOMAIN, SIGN_BYTES_V2_UPGRADE, SIGN_BYTES_V2_UPGRADES, LEGACY_SIGN_BYTES_CHAINS,
   hybridSignBytesV1, hybridSignBytesV2, hybridSignBytes,
   signBytesVersionFor, resolveSignBytesVersion, clearSignBytesCache,
   isHybridSignBytesRejection,

package/src/signbytes.js

@@ -10,15 +10,26 @@
 // B0 = TxBody WITHOUT the PQC extension option, A = AuthInfo bytes verbatim.
 // Byte-identical to the chain's x/pqc/types.HybridSignBytesLegacy / HybridSignBytes.
 //
-// Which form to sign: a network that existed before chain release v3.1.98
-// (qorechain-vladi mainnet, qorechain-diana testnet) verifies v1 until the
-// "v3.1.98" upgrade plan is applied on it, and v2 from then on. Any other chain
-// verifies v2 from its first block. The two networks upgrade at different
-// heights, so a client must ASK the target network (applied_plan) rather than
-// hardcode a form. That is what resolveSignBytesVersion does.
+// Which form to sign: a network that existed before the release that introduced
+// v2 (qorechain-vladi mainnet, qorechain-diana testnet) verifies v1 until that
+// upgrade plan is applied on it, and v2 from then on. Any other chain verifies
+// v2 from its first block. The two networks upgrade at different heights, so a
+// client must ASK the target network (applied_plan) rather than hardcode a form.
+// That is what resolveSignBytesVersion does.
+//
+// The switch ships under TWO plan names: the release is "v3.2.0", but the
+// testnet already took the same handler under the earlier name "v3.1.98" and
+// keeps that record forever. The chain registers both (x/pqc/types
+// SignBytesV2Upgrades), so a client must ask for EVERY name and sign v2 if the
+// numeric height of ANY of them is greater than zero. Asking for one name only
+// resolves v1 on a network that upgraded under the other, and every hybrid
+// transaction is then refused with pqc code 21.
 
 export const HYBRID_SIGN_BYTES_V2_DOMAIN = 'qorechain-pqc-hybrid-v2';
-export const SIGN_BYTES_V2_UPGRADE = 'v3.1.98';
+/** Every upgrade plan name that switches a network to v2 sign-bytes, most recent first. */
+export const SIGN_BYTES_V2_UPGRADES = Object.freeze(['v3.2.0', 'v3.1.98']);
+/** The primary (current release) plan name; see SIGN_BYTES_V2_UPGRADES for all of them. */
+export const SIGN_BYTES_V2_UPGRADE = SIGN_BYTES_V2_UPGRADES[0];
 export const LEGACY_SIGN_BYTES_CHAINS = Object.freeze(['qorechain-vladi', 'qorechain-diana']);
 
 const te = new TextEncoder();
@@ -86,10 +97,11 @@ function toHeight(h) {
 }
 
 /**
- * The form a client must sign for `chainId`, given the height at which the
- * v3.1.98 plan was applied on it (0 / "0" / missing = not applied). Mirrors the
- * chain's SignBytesVersionFor. Heights are compared NUMERICALLY: the node returns
- * the height as a string, and "0" is truthy.
+ * The form a client must sign for `chainId`, given the height at which a v2
+ * sign-bytes upgrade plan was applied on it (0 / "0" / missing = none applied;
+ * pass the greatest height over SIGN_BYTES_V2_UPGRADES). Mirrors the chain's
+ * SignBytesVersionFor. Heights are compared NUMERICALLY: the node returns the
+ * height as a string, and "0" is truthy.
  */
 export function signBytesVersionFor(chainId, v2AppliedHeight) {
   if (toHeight(v2AppliedHeight) > 0n) return 'v2';
@@ -107,10 +119,13 @@ function normRest(rest) { return String(rest).replace(/\/+$/, ''); }
  * Resolve the hybrid sign-bytes form for a network.
  *   - 'v1' | 'v2' are returned as-is (no network).
  *   - 'auto' (default): a chain that is not a legacy network gets 'v2' with no
- *     HTTP; a legacy network is asked `GET {rest}/cosmos/upgrade/v1beta1/applied_plan/v3.1.98`
- *     and signs v2 iff the returned height > 0. Answers are cached per
- *     (rest, chainId) for `ttlMs`; `forceRefresh` bypasses the cache.
- * Throws (never guesses) when a legacy network has no `rest` or the query fails.
+ *     HTTP; a legacy network is asked `GET {rest}/cosmos/upgrade/v1beta1/applied_plan/{name}`
+ *     for EVERY name in SIGN_BYTES_V2_UPGRADES and signs v2 iff the numeric
+ *     height of ANY of them is > 0. The names are asked in order and the first
+ *     positive height wins, so a network on the current release costs one
+ *     request and one that upgraded under the earlier name costs two. Answers
+ *     are cached per (rest, chainId) for `ttlMs`; `forceRefresh` bypasses the cache.
+ * Throws (never guesses) when a legacy network has no `rest` or a query fails.
  */
 export async function resolveSignBytesVersion({
   chainId, rest, signBytesVersion = 'auto', fetch = globalThis.fetch, ttlMs = 60_000, forceRefresh = false,
@@ -138,15 +153,23 @@ export async function resolveSignBytesVersion({
   if (typeof fetch !== 'function') {
     throw new Error(`Cannot query ${base}: no fetch implementation available; ${hint}.`);
   }
-  const url = `${base}/cosmos/upgrade/v1beta1/applied_plan/${SIGN_BYTES_V2_UPGRADE}`;
+  const plans = `${base}/cosmos/upgrade/v1beta1/applied_plan/{${SIGN_BYTES_V2_UPGRADES.join(',')}}`;
   let version;
   try {
-    const res = await fetch(url, { headers: { accept: 'application/json' } });
-    if (!res || !res.ok) throw new Error(`HTTP ${res ? res.status : 'no response'}`);
-    const body = await res.json();
-    version = signBytesVersionFor(chainId, body?.height ?? '0');
+    // Ask for every plan name; the first positive height decides (v2). Only when
+    // ALL of them answer 0 / {} is the network still on v1.
+    let applied = 0n;
+    for (const name of SIGN_BYTES_V2_UPGRADES) {
+      const url = `${base}/cosmos/upgrade/v1beta1/applied_plan/${name}`;
+      const res = await fetch(url, { headers: { accept: 'application/json' } });
+      if (!res || !res.ok) throw new Error(`HTTP ${res ? res.status : 'no response'} for ${name}`);
+      const body = await res.json();
+      applied = toHeight(body?.height ?? '0');
+      if (applied > 0n) break;
+    }
+    version = signBytesVersionFor(chainId, applied);
   } catch (e) {
-    throw new Error(`Cannot determine the hybrid sign-bytes form for ${chainId} from ${url} (${e && e.message ? e.message : e}); ${hint}.`);
+    throw new Error(`Cannot determine the hybrid sign-bytes form for ${chainId} from ${plans} (${e && e.message ? e.message : e}); ${hint}.`);
   }
   cache.set(key, { version, at: Date.now() });
   return version;