@sidhujag/sysweb3-keyring 2.1.11 → 2.1.13

package/types/keyring-host.d.ts

@@ -19,7 +19,10 @@ type BoundHost = {
 export declare function createKeyringHost(storage: KeyringStoragePort, options?: {
     deviceUnlock?: DeviceUnlockPort;
 }): KeyringHost;
+export type SecretLifetimePolicy = 'session' | 'operation';
 export type KeyringOptions = {
+    /** Session is the existing extension policy. Mobile must explicitly select operation. */
+    secretLifetime?: SecretLifetimePolicy;
     captureEvmSubmission: CaptureEvmSubmission | null;
     receiveDeviceUnlock?(controls: DeviceUnlockControls): void;
 };
@@ -30,6 +33,7 @@ export interface KeyringHostBinding {
 type PreparedHost = Omit<BoundHost, 'deviceUnlockPort'> & {
     authority: KeyringHost;
     captureEvmSubmission: CaptureEvmSubmission | null;
+    secretLifetime: SecretLifetimePolicy;
     deviceUnlock?: {
         port: DeviceUnlockPort;
         receive(controls: DeviceUnlockControls): void;

package/types/private-records.d.ts

@@ -17,10 +17,40 @@ export interface IDecryptPrivateRecordParams {
     envelope: IEncryptedPrivateRecord;
     recordId: string;
 }
+export interface PrivateRecordAccessOptions {
+    /** Move this grant with trusted public-session transfer; otherwise transfer retires it. */
+    transferable: boolean;
+}
+export interface IPrivateRecordAccess {
+    getPrivateRecordProfileId(): Promise<string>;
+    encryptPrivateRecord(params: IEncryptPrivateRecordParams): Promise<IEncryptedPrivateRecord>;
+    decryptPrivateRecord(params: IDecryptPrivateRecordParams): Promise<Uint8Array>;
+    dispose(): void;
+}
 export declare const MAX_PRIVATE_RECORD_BYTES: number;
 export declare const MAX_PRIVATE_RECORD_LABEL_BYTES = 128;
 type Guard = () => void;
 export declare function privateRecordProfileId(secret: Uint8Array, guard: Guard): Promise<string>;
 export declare function encryptPrivateRecordBytes(secret: Uint8Array, params: IEncryptPrivateRecordParams, guard: Guard): Promise<IEncryptedPrivateRecord>;
 export declare function decryptPrivateRecordBytes(secret: Uint8Array, params: IDecryptPrivateRecordParams, guard: Guard): Promise<Uint8Array>;
+/** Canonical exact set, used only to retrieve a previously granted capability. */
+export declare function privateRecordDomainSet(domains: readonly string[]): string;
+/** Internal cache inspection; key material is never returned. */
+export declare function activePrivateRecordDomainSet(access: IPrivateRecordAccess, authority: object): string | null;
+/** Internal transfer policy; callers cannot upgrade an existing grant. */
+export declare function privateRecordAccessCanTransfer(access: IPrivateRecordAccess, authority: object): boolean;
+/** Internal trusted SDK transfer. Old methods/dispose cannot affect the moved keys. */
+export declare function transferPrivateRecordAccess(access: IPrivateRecordAccess, sourceAuthority: object, targetAuthority: object, guard: Guard): IPrivateRecordAccess;
+/** Derive only the named record keys, then release the root. No key export or derivation surface escapes. */
+export declare function createPrivateRecordAccess(secret: Uint8Array, domains: readonly string[], options: PrivateRecordAccessOptions, guard: Guard, authority: object): Promise<IPrivateRecordAccess>;
+type PublicRecordCheckpointContext = Readonly<{
+    walletBindingId: string;
+    pairFingerprint: string;
+    stateDigest: Uint8Array;
+    domains: readonly string[];
+}>;
+/** Internal sealing only. No record key or extractable CryptoKey leaves this module. */
+export declare function sealPublicRecordCheckpoint(rootSecret: Uint8Array, wrappingSecret: Uint8Array, context: PublicRecordCheckpointContext, guard: Guard): Promise<IEncryptedPrivateRecord>;
+/** Internal restore imports only the sealed exact domain set as non-extractable keys. */
+export declare function restorePublicRecordCheckpoint(wrappingSecret: Uint8Array, envelope: IEncryptedPrivateRecord, context: PublicRecordCheckpointContext, guard: Guard, authority: object): Promise<IPrivateRecordAccess>;
 export {};

package/types/public-session.d.ts

@@ -0,0 +1,19 @@
+import type { IEncryptedPrivateRecord } from './private-records';
+/** Public state is supplied as one canonical, immutable host manifest. */
+export type PublicSessionCheckpointRequest = Readonly<{
+    walletBindingId: string;
+    publicState: Uint8Array;
+    recordDomains: readonly string[];
+}>;
+export type PublicSessionRestoreRequest = PublicSessionCheckpointRequest & Readonly<{
+    checkpoint: IEncryptedPrivateRecord;
+}>;
+/** A dedicated public-view key; it must never be a vault password or vault key. */
+export type PublicSessionCredentialPort = Readonly<{
+    withKey(assertCurrent: () => void, consume: (key: Uint8Array) => Promise<void>): Promise<void>;
+}>;
+export declare const MAX_PUBLIC_SESSION_STATE_BYTES: number;
+export declare function capturePublicSessionKey(value: Uint8Array): Uint8Array;
+export declare function capturePublicSessionRequest(input: PublicSessionCheckpointRequest): PublicSessionCheckpointRequest;
+export declare function capturePublicSessionCheckpoint(input: PublicSessionRestoreRequest): IEncryptedPrivateRecord;
+export declare function publicSessionStateDigest(state: Uint8Array, guard: () => void): Promise<Uint8Array>;

package/types/software.d.ts

@@ -17,3 +17,8 @@ export type { PreparedEvmSigningOptions, PreparedSoftwareEvmSigningRequest, Sign
 export type { EncryptedEvmHdRuntimeAccount, EvmHdRuntimeAccountOptions, EvmHdRuntimeAccountRequest, } from './software-hd-account';
 export { captureEvmSubmission, submitSignedEvmTransaction, evmSubmissionFailure, } from './transactions/evm-submission';
 export type { CaptureEvmSubmission, EvmSubmissionContext, EvmSubmissionLifecycle, EvmSignedSubmission, EvmSubmissionBoundary, } from './transactions/evm-submission';
+export type { SecretOperationCredentialPort, SecretOperationOptions, } from './keyring-core';
+export type { SecretLifetimePolicy } from './keyring-host';
+export type { IPrivateRecordAccess, PrivateRecordAccessOptions, } from './private-records';
+export type { PublicSessionCheckpointRequest, PublicSessionCredentialPort, PublicSessionRestoreRequest, } from './public-session';
+export { MAX_PUBLIC_SESSION_STATE_BYTES } from './public-session';

package/types/transactions/syscoin-core.d.ts

@@ -69,6 +69,8 @@ export declare class SyscoinTransactionsCore implements ISyscoinTransactions {
     private hardwareSigners;
     private getState;
     private captureSigningContext;
+    private readonly secretLifetime;
+    private readonly assertPublicPreparation;
     constructor(getSyscoinSigner: () => {
         hd: SyscoinHDSigner;
         main: any;
@@ -82,7 +84,7 @@ export declare class SyscoinTransactionsCore implements ISyscoinTransactions {
         activeAccountId: number;
         activeAccountType: KeyringAccountType;
         activeNetwork: INetwork;
-    }, hardwareSigners: ISyscoinHardwareSigners, captureSigningContext: (bindSessionRevision: boolean) => () => void);
+    }, hardwareSigners: ISyscoinHardwareSigners, captureSigningContext: (bindSessionRevision: boolean) => () => void, secretLifetime: 'session' | 'operation', assertPublicPreparation: () => void);
     private getTransactionPSBT;
     decodeRawTransaction: (psbtOrHex: any, isRawHex?: boolean) => any;
     private captureOwnedRead;
@@ -90,6 +92,8 @@ export declare class SyscoinTransactionsCore implements ISyscoinTransactions {
     private signPSBTWithSigner;
     private createNativeSweepPSBT;
     private createUnsignedPSBT;
+    /** Resolve public signing hints without loading a software signer. */
+    private prepareSoftwareSigningPaths;
     private signPSBTWithMethod;
     getEstimateSysTransactionFee: ({ txOptions, isMax, nativeSweep, amount, receivingAddress, feeRate, token, excludedOutpoints, }: {
         amount: number | string;
@@ -109,6 +113,14 @@ export declare class SyscoinTransactionsCore implements ISyscoinTransactions {
         fee: number;
         psbt: any;
     }>;
+    /**
+     * Public metadata preparation for operation-scoped software signing. The
+     * returned PSBT preserves the unsigned transaction and existing cosigner data;
+     * signing still performs the normal account/scope checks.
+     */
+    preparePSBTForSigning: ({ psbt }: {
+        psbt: any;
+    }, ownedRead: SyscoinOwnedReadOptions) => Promise<any>;
     signPSBT: ({ psbt }: {
         isLedger?: boolean;
         isTrezor?: boolean;

package/types/types.d.ts

@@ -4,7 +4,7 @@ import { ITxid } from '@sidhujag/sysweb3-utils';
 import { CustomJsonRpcProvider } from 'providers';
 import { BigNumber, BigNumberish, BytesLike, TransactionResponse } from './ethers-v6';
 import { LedgerKeyring } from './ledger';
-import { IDecryptPrivateRecordParams, IEncryptedPrivateRecord, IEncryptPrivateRecordParams } from './private-records';
+import { IPrivateRecordAccess, PrivateRecordAccessOptions, IDecryptPrivateRecordParams, IEncryptedPrivateRecord, IEncryptPrivateRecordParams } from './private-records';
 import { SyscoinHDSigner } from './signers';
 import { TrezorKeyring } from './trezor';
 import type { KeyringCore, PreparedSessionTransfer } from './keyring-core';
@@ -225,6 +225,10 @@ export interface ISyscoinTransactions {
     decodeRawTransaction: (psbtOrHex: any, isRawHex?: boolean) => any;
     sendTransaction: (rawTransaction: string, authority: SyscoinOwnedSubmissionOptions) => Promise<ITxid>;
     replayRetainedTransaction: (txid: string, authority: SyscoinRetainedSubmissionOptions) => Promise<ITxid>;
+    /** Resolve public signing paths before entering an operation-scoped lease. */
+    preparePSBTForSigning: (input: {
+        psbt: any;
+    }, ownedRead: SyscoinOwnedReadOptions) => Promise<any>;
     signPSBT: ({ psbt, isTrezor, isLedger, }: {
         isLedger?: boolean;
         isTrezor?: boolean;
@@ -255,6 +259,10 @@ export interface IKeyringManager {
     syscoinTransaction: ISyscoinTransactions;
     isSeedValid: (seedPhrase: string) => boolean;
     getSeed: (pwd: string) => Promise<string>;
+    createPublicSessionCheckpoint: (input: import('./public-session').PublicSessionCheckpointRequest, wrappingKey: Uint8Array, assertCurrent: () => void) => Promise<import('./private-records').IEncryptedPrivateRecord>;
+    restorePublicSession: <T>(credential: import('./public-session').PublicSessionCredentialPort, input: import('./public-session').PublicSessionRestoreRequest, options: import('./keyring-core').SecretOperationOptions, work: (authenticatedPublicState: Uint8Array) => T | Promise<T>) => Promise<T>;
+    createPrivateRecordAccess: (domains: readonly string[], options: PrivateRecordAccessOptions) => Promise<IPrivateRecordAccess>;
+    getPrivateRecordAccess: (domains: readonly string[]) => IPrivateRecordAccess;
     getPrivateRecordProfileId: () => Promise<string>;
     encryptPrivateRecord: (params: IEncryptPrivateRecordParams) => Promise<IEncryptedPrivateRecord>;
     decryptPrivateRecord: (params: IDecryptPrivateRecordParams) => Promise<Uint8Array>;

package/types/utils/utxo-fee-rate.d.ts

@@ -0,0 +1,5 @@
+/**
+ * The public rate is coins/vbyte. Convert its decimal representation exactly:
+ * multiplying a binary Number first can make 7e-8 round up to 8 atomic units.
+ */
+export declare function utxoFeeRateUnits(rate: number): number;